chore: release v1.19.6 - UI nav auth, SMTP UI-only, test messages, directory.md

### Fixed - **Navbar shows Catalog/Vault for unauthenticated users** — Changed nav gating from `groups: []` (always visible) to `groups: ['login']` and added synthetic 'login' group handling in app-base.js. - **500 ENOENT: no such file or directory, open '/docs/directory.md'** — Created the missing documentation file. ### Changed - **SMTP configuration UI-only** — Removed SMTP from static config files (conf/base.js, sso-secrets.js, setup.env.example). SMTP is now only configurable via the runtime UI at /conf. ### Added - **Test email/SMS capability** — Added POST /api/conf/test-email and POST /api/conf/test-sms endpoints with UI buttons in the Configuration page. Saves config first, then sends test message to verify settings. ### theta-env setup.sh - **Non-interactive theta-agent configuration** — Added CFG_THETA_AGENT_ENABLE, CFG_THETA_AGENT_LDAP_AUTH, and CFG_THETA_AGENT_FULL_CONTROL variables to setup.env (all default to 1/enabled). Co-Authored-By: Claude <noreply@anthropic.com>
fix(vault): correctly rewrite paths for vault API proxy (#149 )
2026-08-02 21:30:47 -04:00 · 2026-08-02 19:47:07 -04:00 · 2026-08-02 19:07:19 -04:00 · 2026-08-02 19:02:17 -04:00 · 2026-08-02 19:01:43 -04:00 · 2026-08-02 18:57:13 -04:00
77 changed files with 3751 additions and 2874 deletions
@@ -86,6 +86,11 @@ ops/cookbooks/vendor
 secrets.json
 secrets.js

+# Per-deployment secret files (real LDAP/SMTP/jwtSecret + generated OAuth
+# creds). theta-env bind-mounts ./config and generates/fills these at setup;
+# they must never be committed. The empty *.example templates ARE tracked.
+config/*-secrets.js
+
 # Jekyll build artifact (GitHub Pages builds remotely; ignore locally)
 docs/_site

@@ -1199,6 +1199,143 @@ Configurable per-client via `token_lifetime`. Global defaults (in seconds):

 ---

+## Plugin Endpoints
+
+Base path: `/api/plugins`
+
+All endpoints require authentication and `app_sso_admin`, `app_sso_directory_admin`, or `app_super_admin` membership. Secret field values are always returned masked (`********`); they are stored in OpenBao at `secret/plugins/<instance-id>/conf`, never in the database row. See [Plugins](docs/plugins.html).
+
+### List Plugin Types
+
+**`GET /api/plugins/types`**
+
+Returns the installed plugin types and their `configSchema` (used to build the create-instance form).
+
+**Response:**
+```json
+{
+  "results": [
+    {
+      "type": "proxmox",
+      "category": "discovery",
+      "name": "Proxmox VE",
+      "description": "Discover VMs, containers, and hypervisor nodes from a Proxmox VE API endpoint.",
+      "configSchema": [
+        { "key": "url", "label": "API URL", "type": "url", "required": true },
+        { "key": "tokenId", "label": "Token ID", "type": "text", "required": true },
+        { "key": "tokenSecret", "label": "Token Secret", "type": "password", "required": true, "secret": true }
+      ]
+    }
+  ]
+}
+```
+
+---
+
+### List Plugin Instances
+
+**`GET /api/plugins/`**
+
+**Response:** `{ "results": [ { "id", "pluginType", "category", "name", "slug", "enabled", "cron", "config", "secrets": {…masked…}, "lastRunAt", "lastStatus", "lastError" } ] }`
+
+---
+
+### Get One Instance
+
+**`GET /api/plugins/:id`** — same shape as a list entry.
+
+---
+
+### Create Instance
+
+**`POST /api/plugins/`**
+
+`config` is a flat object of **all** field values (secret and non-secret); the server splits it — non-secret fields go to the DB row, secret fields to OpenBao. Creating an enabled instance schedules it and kicks one immediate run. `slug` is the discovery source name (lowercase letters/digits/_/-, max 64, unique).
+
+**Request:**
+```json
+{
+  "pluginType": "proxmox",
+  "name": "Proxmox — Home Lab",
+  "slug": "proxmox-homelab",
+  "cron": "0 * * * *",
+  "config": { "url": "https://pve:8006", "tokenId": "u@pam!t", "tokenSecret": "secret-value" }
+}
+```
+
+Errors: `400` if the plugin type is unknown, the slug is malformed/duplicated, or a required field is missing; `400` with an OpenBao hint if writing the secret fails (re-run `./setup.sh` with theta-suite ≥ v1.30.1).
+
+---
+
+### Update Instance
+
+**`PUT /api/plugins/:id`** — update `name`, `cron`, `enabled`, and non-secret `config`. Secret fields are changed via `PUT /:id/secrets`. Re-schedules if `cron` or `enabled` changed.
+
+---
+
+### Update Secrets
+
+**`PUT /api/plugins/:id/secrets`** — body is a flat object of secret field values. Blank/`********` values are ignored (kept as-is).
+
+---
+
+### Test Instance
+
+**`POST /api/plugins/:id/test`** — runs the plugin's `validate`. Returns `{ "ok": true }` or `400 { "ok": false, "error": "..." }`.
+
+---
+
+### Load / Unload / Run Now
+
+- **`POST /api/plugins/:id/load`** — enable + schedule + run now.
+- **`POST /api/plugins/:id/unload`** — unschedule + disable.
+- **`POST /api/plugins/:id/run`** — enqueue one immediate run (regardless of enabled).
+
+---
+
+### Last Run Status
+
+**`GET /api/plugins/:id/runs`** → `{ "results": { "lastRunAt", "lastStatus", "lastError" } }` (`lastStatus` is `ok` | `error` | `running`).
+
+---
+
+### Delete Instance
+
+**`DELETE /api/plugins/:id`** — unschedules, removes the OpenBao secret namespace, and deletes the row.
+
+## Configuration Endpoints
+
+Base path: `/api/conf`
+
+All endpoints require authentication and `app_sso_admin` membership. Runtime configuration (SMTP, discovery, OAuth) is stored in OpenBao at `secret/sso-manager/conf` and overlaid onto the live app config; changes take effect immediately and persist across restarts. Secret fields (`smtp.pass`, `oauth.jwtSecret`) are **always returned masked** (`********`); submit a blank or `********` value to keep the current stored secret, or a new non-blank value to replace it.
+
+### Get Configuration
+
+**`GET /api/conf`** — returns the editable config groups (`smtp`, `discovery`, `oauth`) with secret fields masked to `********`.
+
+**Response:**
+```json
+{
+  "smtp": { "host": "smtp.example.com", "port": 587, "secure": false, "user": "noreply@example.com", "pass": "********", "from": "SSO Manager <noreply@example.com>" },
+  "discovery": { },
+  "oauth": { "issuer": "https://sso.example.com", "jwtSecret": "********", "token_lifetime": { "access_token": 3600, "refresh_token": 2592000 } }
+}
+```
+
+### Save Configuration
+
+**`POST /api/conf`** — deep-merges the submitted groups into `secret/sso-manager/conf` (per-key shallow merge of nested objects) and re-applies them to the live config. A blank or `********` value for `smtp.pass` or `oauth.jwtSecret` preserves the stored secret.
+
+**Request:**
+```json
+{
+  "smtp": { "host": "smtp.example.com", "port": 587, "secure": false, "user": "noreply@example.com", "pass": "********", "from": "SSO Manager <noreply@example.com>" },
+  "oauth": { "issuer": "https://sso.example.com", "token_lifetime": { "access_token": 3600, "refresh_token": 2592000 } }
+}
+```
+
+**Response:** `{ "success": true }`
+
 ## Error Responses

 All endpoints return errors in this format:
@@ -1,9 +1,248 @@
+## v1.19.0
+- Added WebSocket endpoint for theta-agent C2
+
+# v1.18.0
+- feat: Add messaging plugins, Docker discovery, fix reconciliation
+
 # Changelog

 All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.

+## [1.17.2] - 2026-08-01
+
+Post-deploy fixes from testing the v1.31.0 stack, plus the SMS (VoIP.ms) and
+Terms-of-Service configuration the `/conf` page was missing. Seven issues:
+
+### Fixed
+- **Plugin slug is now auto-generated** from the instance name — the New Plugin
+  modal no longer asks for a Slug (it derived a stable, unique handle from the
+  name, appending `-2`, `-3`, … on collision). The generated slug still shows in
+  the table and the Edit (read-only) modal. `POST /api/plugins` `slug` is now
+  optional; an explicit slug is still accepted and validated. (`routes/api_plugins.js`,
+  `views/plugins.ejs`)
+- **Plugin schedule is a dropdown**, not a raw cron box: Hourly / Daily /
+  Weekly, plus **Custom** which reveals the raw 5-field cron input. Stored value
+  is still a cron string, so the server is unchanged. (`views/plugins.ejs`)
+- **`/vault` secrets list no longer 403s.** Root cause: the per-user, per-app,
+  and admin OpenBao policies granted `list` only on `secret/metadata/.../*`
+  (nested paths), never on the directory path itself — so listing a directory's
+  *contents* (which checks `list` on the directory, e.g. `secret/metadata/users/<uid>`
+  or the mount root `secret/metadata`) was denied. `vault_broker.js`'s
+  `userPolicyHcl`/`appPolicyHcl` now also grant `list` on the bare directory
+  path, and `ensurePolicy` now always re-writes the policy (idempotent) so
+  already-created `user-<uid>` policies pick up the new grant on the next
+  vault-page visit. The matching `sso-admin` mount-root grant ships in
+  theta-suite v1.31.1 (`setup.sh`), where `ensure_policy` is likewise made
+  always-write so re-running `./setup.sh` applies policy edits.
+- **`/profile` no longer shows literal `{{…}}` tags.** Three template fragments
+  sat outside the `jq-repeat="user"` scope, so they rendered raw: the card
+  header `Profile: {{user.uid}}`, the `Members of {{user.uid}}'s Group` tab
+  label, and the Admin Actions block's `{{#isActive}}`/`{{#isInactive}}`
+  buttons. The header/label are now populated by JS (the `Members` label
+  already had a setter pointing at a missing id); the Admin Actions block is
+  moved inside the scope so `{{uid}}`/`{{#isActive}}`/`{{#isInactive}}` render
+  and the correct Activate/Deactivate button shows. (`views/profile.ejs`)
+- **Editing a plugin now persists.** The Edit modal had been prefilled with the
+  masked secret values and rendered them as fields, but `PUT /:id` only saves
+  non-secret config — so an edited secret was silently dropped. The Edit modal
+  now shows **non-secret fields only** (secrets have their own Edit-Secrets
+  modal), removing the confusion. (`views/plugins.ejs`)
+- **nmap plugin: "NMAP not found at command location: nmap"** — the `nmap`
+  binary was not installed in the app image. `Dockerfile.openldap` now `apk
+  add`s `nmap` in the runtime stage, and `plugins/discovery/nmap.js` translates
+  the opaque node-nmap spawn-missing error into an actionable `lastError`.
+
+### Added
+- **SMS (VoIP.ms) configuration on `/conf`.** The existing VoIP.ms SMS sender
+  (`models/sms.js`, used for 2FA OTP delivery) was configurable only via env /
+  config files. It now has an SMS card on `/conf` (API username, DID, API
+  password), saved to OpenBao at `secret/sso-manager/conf` under `voipms`, with
+  the API password masked (`********`) and leave-blank-to-keep — mirroring the
+  SMTP card exactly. `models/sms.js` reads `conf.voipms.*` at call time, so a
+  saved change takes effect live without a restart. (`routes/api_conf.js`,
+  `views/conf.ejs`)
+- **Terms of Service editor moved to `/conf`** from the admin Overview
+  dashboard, where it never belonged. The same `app.tos.get`/`update` flow,
+  the "require all users to re-accept" checkbox, and the `app_sso_admin` gate
+  (matching `routes/tos.js`'s PUT gate) are preserved. The Overview page keeps
+  stats, notifications, and metrics. (`views/conf.ejs`, `views/overview.ejs`)
+
+### Notes
+- The `/vault` 403 fix is split across two repos: the sso-side per-user/app
+  policy grants and `ensurePolicy`-always-write ship here; the `sso-admin`
+  mount-root grant and `ensure_policy`-always-write ship in theta-suite v1.31.1.
+  Re-running `./setup.sh` after upgrading applies the sso-admin grant; per-user
+  policies self-heal on the next vault-page visit.
+
+## [1.17.1] - 2026-08-01
+
+Hardens the **runtime SMTP/OAuth secret handling** on the `/conf` admin page to
+match the plugin-secrets discipline: the SMTP password and OAuth JWT secret are
+no longer returned in cleartext by `GET /api/conf` or round-tripped through the
+form. They remain saved in OpenBao at `secret/sso-manager/conf` at runtime
+(unchanged) — only how they're surfaced to the admin changes.
+
+### Changed
+- **`GET /api/conf`** now masks `smtp.pass` and `oauth.jwtSecret` to `********`
+  (was: returned in cleartext). Non-secret fields (host, port, user, from,
+  secure, issuer, token lifetimes) are returned as before.
+- **`POST /api/conf`** now treats a blank or `********` secret-field submission
+  as "keep the current stored value" — so an admin editing the From address or
+  token lifetimes no longer has to re-enter (or leak) the SMTP password / JWT
+  secret. Only a genuinely new, non-blank value overwrites. The preserved values
+  are re-applied to live `conf` immediately, as before.
+- **`/conf` page** (`views/conf.ejs`): the Password and JWT Secret fields carry
+  a "leave unchanged to keep the current value stored in OpenBao" hint; the page
+  copy notes secret fields are masked. No JSON-textarea editing is involved —
+  SMTP is and remains configured through structured form fields.
+
+### Notes
+- SMTP (and OAuth) config was **already** saved to OpenBao at runtime before
+  this release (via `POST /api/conf` → `baoConf.set('sso-manager/conf')`, and
+  overlaid back at boot by `bao-conf.init`). This release closes the
+  cleartext-exposure gap; it does not move the storage path.
+- No theta-suite policy change required — `secret/sso-manager/conf` was already
+  granted to the `sso-broker` policy.
+
+## [1.17.0] - 2026-08-01
+
+A real **plugin system**: the half-built discovery plugins (statically
+configured in `sso-secrets.js`, only toggleable for cron/enabled) become
+**configurable, loadable/unloadable plugin instances** you manage from a
+dedicated **Plugins** page and the `/api/plugins` API, with multiple runtime
+copies of each type and per-instance secrets stored in OpenBao.
+
+### Added
+- **Plugin instances** — a new `PluginInstance` ORM model
+  (`nodejs/models/plugin_instance.js`, Sequelize) is the registry of
+  configured, scheduled plugin copies. Each has a `pluginType`, a unique
+  `slug` (the discovery source name), a cron schedule, an `enabled` flag
+  (load/unload), non-secret `config` (JSON), and last-run bookkeeping. Multiple
+  instances of the same type are supported.
+- **Plugin registry** (`nodejs/services/plugin_registry.js`) — generalizes the
+  one-shot discovery-plugin scan in `scheduler.js`. Plugin types are modules
+  under `nodejs/plugins/<category>/<type>.js` exporting a manifest
+  (`type`, `category`, `name`, `description`, `configSchema`, `validate`,
+  `run`/`discover`). Exposes `getTypes`, `getModule`, `splitConfig` (secret vs
+  non-secret), `mask`, and required-field helpers for the UI/API.
+- **Per-instance secrets in OpenBao** (`nodejs/utils/plugin_secrets.js`) —
+  `configSchema` fields flagged `secret:true` (e.g. a Proxmox `tokenSecret`,
+  UniFi `password`) are stored at `secret/plugins/<instance-id>/conf`, never in
+  the DB. The UI only ever sees masked (`********`) values. Plugins run
+  in-process (BullMQ workers), so they need no OpenBao token of their own — the
+  SSO reads/writes via the `sso-broker` token. **Requires theta-suite ≥ v1.30.1**
+  for the `sso-broker` policy grant on `secret/plugins/*`; the API fails-soft
+  with a clear error if absent.
+- **`/api/plugins` API** (`nodejs/routes/api_plugins.js`, replaces the old
+  `routes/plugins.js`) — `GET /types`, list/get/create/update/update-secrets/
+  test/load/unload/run/delete/runs. Admin-only
+  (`app_sso_admin` / `app_sso_directory_admin` / `app_super_admin`).
+- **Plugins page** (`/plugins`, `views/plugins.ejs`) + nav entry — instance
+  table with New/Edit/Edit-Secrets/Test/Run-now/Load/Unload/Delete, config forms
+  rendered from each type's `configSchema`.
+- **`validate`** ("Test" button) on the built-in Proxmox/UniFi/Nmap plugins.
+
+### Changed
+- `services/scheduler.js` now schedules from the `PluginInstance` table instead
+  of static `conf.discovery.plugins` + a Redis override hash. Each instance owns
+  a stable BullMQ JobScheduler id (`plugin:<instanceId>`) so load/unload
+  upsert/remove one schedule without disturbing the rest. Discovery plugins
+  reconcile results under the instance's `slug`.
+- The three discovery plugins (`plugins/discovery/{proxmox,unifi,nmap}.js`)
+  gained manifests (`configSchema`, `validate`, `run` alias). `nmap`'s
+  `targetRange` is non-secret; Proxmox `tokenSecret` and UniFi `password` are
+  secret.
+- The `/plugins` page route renders the page instead of redirecting to
+  `/directory`; the **Agents & Scheduler** tab was removed from `/directory`
+  (plugins are now managed on the Plugins page). The `/docs/agents` link is
+  aliased to `/docs/plugins`.
+- `docs/plugins.md`, `docs/vault.md`, `docs/_config.yml` (nav), and `API.md`
+  (Plugin Endpoints section) document the new system.
+
+### Legacy migration
+On first boot of v1.17.0, if the `PluginInstance` table is empty **and**
+`conf.discovery.plugins` has entries, one instance per configured type is seeded
+automatically (secret fields copied into OpenBao). After that the static
+config is ignored — manage plugins from the UI/API. Idempotent (guarded by the
+empty-table check).
+
+### Prerequisite
+**theta-suite ≥ v1.30.1** — re-run `./setup.sh` after upgrading so the
+`sso-broker` OpenBao policy is granted `secret/plugins/*`. Without it, storing
+plugin secrets fails with a clear error.
+
+## [1.16.1] - 2026-08-01
+
+Fix: the Configuration (`/conf`) and Vault (`/vault`) pages returned **401** for
+a logged-in admin. Both view routes did server-side auth using `req.user`, but
+this app's auth-token is a header set by client-side JS (localStorage), not a
+cookie — so `req.user` is undefined on a plain browser navigation.
+`permission.byGroup(undefined, …)` throws status 401, and the `middleware.auth`
+gate on `/vault` threw `Auth.errors.login()` (401) for the same reason.
+
+Both routes now render the shell unconditionally (like `/users`, `/directory`,
+`/overview`) and gate client-side: `conf.ejs` already called
+`app.auth.forceLogin(['admin','app_sso_admin'])`; `vault.ejs` now derives
+`isAdmin` + the personal namespace from `/api/user/me` after `forceLogin()`
+instead of server-rendering them. The `/api/conf` and `/api/vault` endpoints
+still enforce `app_sso_admin` + the OpenBao scope server-side, so protection is
+unchanged — only the view-route gating moved client-side where the session
+actually lives. Also removed a dead duplicate `/conf` route definition.
+
+## [1.16.0] - 2026-08-01
+
+OpenBao becomes the central secrets store for the theta42 stack, and the SSO
+Manager becomes its broker. This is the SSO's half of the move: it loads its
+own secrets from OpenBao, mints scoped tokens for users and external apps,
+and exposes a fixed, role-scoped personal-secrets UI.
+
+### Changed
+- **Secrets now load from OpenBao at boot** via
+  [@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/), which
+  deep-merges `secret/sso-manager/conf` over the file-loaded config
+  (replacing the old `utils/conf_manager.js`, which did a shallow-per-key
+  merge). `bin/www` runs `bao-conf.init()` after `models.initORM()` and
+  before `listen`. Fail-soft: if OpenBao is unreachable, boot continues from
+  `CONF_SECRETS`. The SSO authenticates with a scoped `VAULT_TOKEN` (policy
+  `sso-broker`), never the root token. The admin **Configuration** UI
+  (`/api/conf`) now writes through `bao-conf.set('sso-manager', …)`.
+- **`/api/vault` proxy reworked** — the old endpoint was an ungated
+  pass-through that never injected an `X-Vault-Token` (so the UI was both
+  ungated *and* broken). It is now `middleware.auth` → `scopeGuard` → a
+  token-injecting proxy. `scopeGuard` resolves a per-user (`user-<uid>`) or
+  per-admin (`sso-admin`) token via the new `utils/vault_broker.js`
+  (Redis-cached, minted through the `sso-broker` token role) and enforces a
+  path prefix as a second layer on top of the OpenBao policy. The client
+  `auth-token` is stripped; only the server-minted token reaches OpenBao.
+- **Vault UI reworked and renamed** (`views/vaultwarden.ejs` →
+  `views/vault.ejs`; the `/vault` route is now `middleware.auth`-gated).
+  Non-admin users see only their `secret/users/<uid>/` namespace; admins get
+  free-form path entry across `secret/` plus an **Apps** tab to mint scoped
+  tokens for external apps (`secret/apps/<name>/*`, shown once with copy +
+  `curl` convention).
+- Bumped package version to track the release tag.
+
+### Removed
+- `nodejs/utils/conf_manager.js` (replaced by `@simpleworkjs/bao-conf`).
+- `nodejs/views/vaultwarden.ejs` (renamed `vault.ejs`).
+
+### Security
+- **Committed-secrets remediation.** `config/sso-secrets.js` (LDAP bind
+  password, SMTP, `oauth.jwtSecret`) and `nodejs/test_plugins.js` (a
+  hardcoded Proxmox root API token and a UniFi password) were tracked on
+  master. They are now untracked + gitignored (`config/*-secrets.js`), and
+  `test_plugins.js` is deleted; `config/proxy-secrets.js.example` added as a
+  placeholder template. **The secrets remain in git history — rotation at
+  the providers is the real remediation and is the operator's to perform.**
+  OpenBao is now the authoritative store; the local files are seed artifacts
+  only.
+
+> Note: releases v1.12.0–v1.15.2 were tagged from merge PRs without
+> corresponding `CHANGELOG.md` entries or GitHub releases; this entry
+> resumes the changelog at v1.16.0.
+
 ## [1.11.0] - 2026-07-31

 Closes the end-user half of the directory. The admin side could describe the lab; the user side could not tell anyone what they had or how to use it, and several of the paths meant to do so were silently returning nothing.
@@ -405,3 +644,7 @@ First tagged release. Establishes the `vX.Y.Z` tag convention that the in-app up
 [1.1.2]: https://github.com/theta42/sso-manager-node/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/theta42/sso-manager-node/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/theta42/sso-manager-node/releases/tag/v1.1.0
+
+## [1.19.6] - 2026-08-02
+### Fixed
+- Fixed Vault API returning 403 on the Secrets List due to `http-proxy-middleware` v2 rewriting the path incorrectly (it previously appended the `/api/vault/` mount path to the proxied Vault request).
@@ -1,512 +0,0 @@
-# Deployment Guide — SSO Manager
-
-Two supported deployment methods:
-
-1. **Docker** — a single all-in-one image bundling the app + OpenLDAP + Redis (`docker compose up`).
-2. **Bare metal** — `install.sh` on Debian/Ubuntu (installs Node.js, OpenLDAP, Redis, the app, and a systemd unit).
-
-## How configuration works
-
-The app loads configuration via [`@simpleworkjs/conf`](https://www.npmjs.com/package/@simpleworkjs/conf), which deep-merges, in order:
-
-1. `conf/base.js` (committed, generic defaults)
-2. `conf/<NODE_ENV>.js` (optional)
-3. `conf/secrets.js` (gitignored — secrets + per-deployment values)
-4. **`app_*` environment variables** — the highest-precedence layer
-
-Any env var whose name starts with `app_` overrides the merged config. The rest
-of the name is split on **double-underscore** (`__`) into a nested path. Values
-are `JSON.parse`-coerced when possible (numbers, booleans, null, JSON) and kept
-as raw strings otherwise. Examples:
-
-| Env var | Sets | Type |
-|---------|------|------|
-| `app_ldap__url=ldap://host:389` | `conf.ldap.url` | string |
-| `app_ldap__bindPassword=secret` | `conf.ldap.bindPassword` | string |
-| `app_ldap__uidGidMin=1500` | `conf.ldap.uidGidMin` | number (new-user id floor) |
-| `app_oauth__jwtSecret=...` | `conf.oauth.jwtSecret` | string |
-| `app_smtp__secure=false` | `conf.smtp.secure` | boolean |
-| `app_oauth__token_lifetime__access_token=3600` | `conf.oauth.token_lifetime.access_token` | number |
-| `app_name=My SSO` | `conf.name` | string |
-
-> **Requires `@simpleworkjs/conf` >= 1.1.0.** The Docker image will not honor
-> `app_*` env vars on 1.0.0. Before building the image, refresh the app's
-> dependency lock from the `nodejs/` directory:
-> ```bash
-> cd nodejs && npm install @simpleworkjs/conf@^1.1.0
-> ```
-
---
-
-## Method 1: Docker (all-in-one)
-
-The image (`Dockerfile.openldap`) bundles OpenLDAP, Redis, and the app in one container.
-The app connects to the bundled slapd over `localhost:389` automatically; you only
-need to set a few secrets.
-
-### Setup
-
-The bundled `docker-compose.yml` reads config from a bind-mounted
-`./config/sso-secrets.js` (not from a `.env` file). Copy the example, fill in
-your secrets, then build + start:
-
-```bash
-mkdir -p config && chmod 700 config
-cp secrets.js.example config/sso-secrets.js
-$EDITOR config/sso-secrets.js     # set ldap.bindPassword, oauth.jwtSecret, ...
-docker compose up -d --build
-```
-
-`docker-entrypoint.sh` symlinks `/config/sso-secrets.js` → `/app/conf/secrets.js`
-so `@simpleworkjs/conf` reads it, and pulls the server-side LDAP vars (base DN,
-admin password, org, domain, cert CN, JWT secret) out of the same file. No
-`app_*` env is passed — `app_*` env would override `secrets.js` (env beats the
-file in `@simpleworkjs/conf`), so the file is kept authoritative.
-
-> **Your domain is entered once, as the LDAP base DN.** Set `stack.ldapBaseDn`
-> (e.g. `dc=718it,dc=biz`) and keep the LDAP DNs consistent with it — they all
-> derive from that one value: `ldap.bindDN` = `cn=admin,<dn>`,
-> `ldap.userBase` = `ou=people,<dn>`, `ldap.groupBase` = `ou=groups,<dn>`,
-> and `stack.ldapDomain` = the dotted form (`718it.biz`). `oauth.issuer` is the
-> public SSO URL (`https://<ssoHost>`). Drifting these apart (e.g. leaving
-> `ldap.bindDN` at `dc=example,dc=com` while `stack.ldapBaseDn` is your real
-> domain) makes the SSO bind against a non-existent root DN and every login
-> fails with `Invalid Credentials`.
->
-> Running the unified `theta-env` stack? You don't hand-edit these DNs at all
-> — its `setup.sh` generates `./config/sso-secrets.js` (+ `./config/proxy-secrets.js`)
-> from a single `setup.env` (where the domain is asked once, as the base DN) with
-> random secrets, and snapshots state before rebuilds — so the DNs can't drift.
-> See the theta-env README.
-
-**Quick test (defaults):** with no `./config/sso-secrets.js` the entrypoint
-falls back to env-mode with safe defaults (`dc=example,dc=com`, admin password
-`admin`, an auto-generated JWT secret) — fine for kicking the tires, not for
-production.
-
-**Advanced — env vars instead of the file:** the entrypoint also supports
-config via `LDAP_*` / `app_*` env vars (env-mode, used when
-`/config/sso-secrets.js` is absent). Since the bundled compose no longer passes
-those env vars, you'd add them to its `environment:` block yourself, e.g.
-`LDAP_ADMIN_PASS`, `JWT_SECRET`, `app_oauth__issuer`. This is mainly for
-bare-metal / advanced standalone use; most deployments should use the file.
-
-### What the entrypoint does
-
-`docker-entrypoint.sh` (run as the container entrypoint):
-
-1. If `/config/sso-secrets.js` is mounted, symlinks it to `/app/conf/secrets.js`
-   and reads the server-side LDAP vars from it (secrets.js mode). Otherwise it
-   derives them from `LDAP_*` env vars with safe defaults (env mode).
-2. Generates a self-signed TLS cert (unless one is already present at
-   `LDAP_CERT_DIR`), generates a `slapd.conf` for the bundled OpenLDAP (`mdb`
-   database, `pw-sha2`/`ppolicy`/`memberof`/`refint` modules + overlays, TLS,
-   indexes, access controls), and starts `slapd -f /etc/openldap/slapd.conf`
-   listening on `ldap:///` (389) and `ldaps:///` (636).
-3. Seeds the directory (base DN, `ou=people`/`ou=groups`/`ou=policies`, a default
-   `pwdPolicy`, and the required SSO groups `app_sso_admin`, `app_sso_invite`,
-   `app_sso_oauth_admin`, `app_sso_service_account`) — idempotently, so
-   container restarts are safe.
-4. Starts a bundled Redis (the app uses `model-redis` for models/sessions and
-   stores OAuth clients there), AOF+RDB persisted to `/data`, unless
-   `app_redis__host` is set (then it's expected to be external).
-5. In env mode, exports `app_*` env vars so the app binds to the local slapd. In
-   secrets.js mode it exports none (the app reads the file directly).
-6. `exec`s `node bin/www`.
-
-### Access
-
- SSO Manager UI: `http://localhost:3001` (HTTP inside the container — put a TLS-terminating proxy in front for browser access)
- Health check: `http://localhost:3001/health` → `{"status":"ok"}`
- OIDC discovery: `http://localhost:3001/.well-known/openid-configuration`
- LDAP (internal, app↔slapd): `ldap://localhost:389` (not mapped to the host)
- LDAPS (direct binds: Linux hosts, LDAP-native apps): `ldaps://<host>:636` (TLS)
-
-### API tokens (personal access tokens)
-
-Any logged-in user can mint a long-lived bearer token to call the management
-API from scripts/CI/other services, without a browser session. Tokens are
-self-service and authenticate **as their creator** — a token carries the
-creator's LDAP group permissions, so the same `permission.byGroup` checks apply
-(group membership is re-resolved from LDAP live on each request).
-
-Create one in the UI under **API Tokens** (the token string is shown **once**),
-then use it as a bearer token:
-
-```bash
-curl -H "Authorization: Bearer sso_<id>_<secret>" https://sso.example.com/api/user
-```
-
-Format: `sso_<id>_<secret>` — the `id` is the lookup key, the `secret` is
-bcrypt-hashed and never stored in plaintext. Rotate or revoke a token from the
-same UI page; revocation takes effect immediately. Optional expiry (in days) at
-creation. API tokens persist in the bundled Redis, so they survive rebuilds
-(Redis is persisted via AOF — see *Backups and restore*).
-
-The token has the same access as a browser session for that user — an
-`app_sso_admin`'s token can manage users/groups; a non-admin's token is limited
-to what they could do in the UI.
-
-### Logs
-
-The all-in-one image runs the Node app and slapd (OpenLDAP) in one container,
-both writing to the container's stdout/stderr, so `docker compose logs` is the
-primary view (slapd runs with `-d 0`, so LDAP output is there too).
-
-```bash
-docker compose logs -f sso-manager                       # app + slapd (stdout/stderr)
-docker compose logs --tail=200 --since=10m sso-manager   # recent context
-docker compose exec sso-manager ldapsearch -x -H ldap://localhost:389 \
-  -D "cn=admin,$LDAP_BASE_DN" -W -b "$LDAP_BASE_DN"       # LDAP health check
-```
-
-### Available environment variables
-
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `LDAP_BASE_DN` | `dc=example,dc=com` | slapd suffix + app user/group base |
-| `LDAP_DOMAIN` | derived from `LDAP_BASE_DN` | DNS domain; default for `LDAP_CERT_CN` and OAuth issuer |
-| `LDAP_ADMIN_PASS` | `admin` | slapd root password + app bind password |
-| `ORG_NAME` | `SSO Manager` | org name in UI/email/group descriptions |
-| `JWT_SECRET` | auto-generated | OAuth JWT signing secret (persist it!) |
-| `OAUTH_ISSUER` | `https://sso.<LDAP_DOMAIN>` | OIDC issuer in the discovery doc (browser-facing URL) |
-| `LDAP_CERT_CN` | `LDAP_DOMAIN` | CN/SAN on the LDAPS cert (hostname clients verify against) |
-| `LDAP_CERT_DIR` | `/etc/openldap/certs` | where the entrypoint looks for `ldap.crt`+`ldap.key` (mount your own here) |
-| `SMTP_HOST`/`SMTP_PORT`/`SMTP_USER`/`SMTP_PASS`/`SMTP_FROM` | localhost / 587 / empty | outbound email |
-| `PORT` | `3001` | host port mapped to the UI |
-| `LDAPS_PORT` | `636` | host port mapped to LDAPS |
-| `LDAP_PORT` | `389` | uncomment the host mapping in compose to expose plain LDAP (not recommended) |
-| `LDAP_SERVER_ID` | empty | Unique integer ID (e.g. 1, 2) required to enable Multi-Master replication |
-| `LDAP_REPLICATION_HOSTS` | empty | Space-separated list of other sites' LDAP URLs for replication (e.g. `ldaps://site2:636`) |
-
-Any `app_*` var may also be set directly to override any config value (see the
-table at the top).
-
-### LDAP TLS (LDAPS / StartTLS)
-
-The bundled slapd generates a **self-signed cert** on first start (CN = `LDAP_CERT_CN`,
-valid 10 years, SAN includes the CN + `localhost` + `127.0.0.1`) and listens on
-`ldaps:///` (636) plus offers StartTLS on `ldap:///` (389). The cert is stored on the
-`ldap-certs` volume so it persists across container recreation — clients don't need
-to re-trust on every rebuild.
-
-The `/integrations` page derives its LDAPS URL from the OAuth issuer by default.
-To advertise a separate, internal-only hostname (e.g. `ldap.internal.example.com`
-or `sso-manager` for Docker-internal clients), set `conf.ldap.ldapsHost` in your
-secrets file or pass `app_ldap__ldapsHost=...`. See `docs/ldap.md` for
-recommended network layouts and how to match the cert SAN to the hostname.
-
- **Trusting the self-signed cert** (clients): copy `/etc/openldap/certs/ldap.crt`
-  out of the container and add it to the client's trusted CA store, or set
-  `TLS_REQCERT never` for quick-and-dirty LAN use. Fetch it with:
-  ```bash
-  docker compose cp sso-manager:/etc/openldap/certs/ldap.crt ./ldap.crt
-  ```
- **Use your own cert** (CA-signed / internal CA): replace the `ldap-certs` named
-  volume with a bind mount containing your own `ldap.crt` + `ldap.key`:
-  ```yaml
-  volumes:
-    - ./certs:/etc/openldap/certs   # must contain ldap.crt + ldap.key
-  ```
-  The entrypoint leaves existing certs untouched (idempotent).
-
-> Port 389 (plain LDAP) is **not** mapped to the host by default, to avoid cleartext
-> password binds over the LAN. Direct-LDAP clients should use LDAPS (636) or
-> StartTLS. Uncomment the `389` mapping in `docker-compose.yml` only if you need
-> plain LAN binds and accept the risk.
-
-### Fronting with a reverse proxy (theta42/proxy)
-
-The SSO Manager runs HTTP inside the container; terminate TLS at a front proxy.
-The [`theta42/proxy`](https://github.com/theta42/proxy) is an OIDC-protected reverse
-proxy and a natural fit — it's both an **OIDC client** of the SSO Manager *and* a
-**direct LDAP client** for user lookups. To run both together:
-
-1. **Put them on one Docker network** so the proxy can reach the SSO Manager
-   internally at `http://sso-manager:3001` for token/userinfo (server-to-server),
-   without exposing the SSO Manager's HTTP port to the internet:
-   ```yaml
-   # in the proxy's compose, or a shared external network:
-   networks:
-     - sso-net
-   ```
-2. **Set the SSO's `OAUTH_ISSUER`** to the *browser-facing* HTTPS URL the proxy
-   serves the SSO at (e.g. `https://sso.yourdomain.com`). The proxy's
-   `oidc.issuer`/endpoints must match — it can get them from the SSO's
-   `/.well-known/openid-configuration`. Server-to-server calls from the proxy go to
-   the internal `http://sso-manager:3001` URL; only the issuer/redirect URLs must
-   be public.
-3. **Register the proxy as an OAuth/OIDC client** in the SSO Manager UI, with a
-   `redirectUri` matching the proxy's callback (e.g.
-   `https://proxy.yourdomain.com/api/auth/oidc/callback`), and put the client
-   secret in the proxy's `secrets.js`.
-4. **LDAP for the proxy**: point the proxy's `ldap.url` at
-   `ldaps://sso-manager:636` (TLS, same Docker network) rather than a LAN IP, and
-   create a dedicated LDAP service account under `ou=people` (e.g.
-   `cn=ldapclient,ou=people,…`) via the SSO Manager UI — don't reuse the admin DN.
-
-### Backups and restore
-
-**What lives where**
-
-| State | Location | Persisted? |
-|-------|----------|------------|
-| LDAP directory (users, groups, policies) | `ldap-data` volume (`/var/lib/ldap`) | yes (volume) |
-| LDAP TLS cert | `ldap-certs` volume (`/etc/openldap/certs`) | yes (volume) |
-| Redis (OAuth clients, tokens, sessions) | `sso-data` volume (`/data`) | yes (AOF + RDB) |
-| Secrets (LDAP admin pass, JWT secret, SMTP) | `./config/sso-secrets.js` (bind mount) | your responsibility — back up off-host |
-
-**Automatic snapshots** — when run as part of the unified `theta-env` stack,
-`setup.sh` snapshots LDAP + Redis + `./config/` to `./backups/<timestamp>/`
-before every rebuild and keeps the last `BACKUP_KEEP` (default 5). Standalone
-deployments should run `ops/backup.sh` the same way (on a cron/systemd timer,
-or by hand before an upgrade):
-
-```bash
-./ops/backup.sh              # keeps the last 5 by default
-./ops/backup.sh 10           # or override retention
-BACKUP_KEEP=10 ./ops/backup.sh
-```
-
-It snapshots LDAP (`slapcat`, auto-detecting your base DN from
-`./config/sso-secrets.js`), Redis (`BGSAVE`, falling back to a synchronous
-`SAVE` if that doesn't complete quickly), and `./config/` to
-`./backups/<timestamp>/`, pruning older backups beyond the retention count —
-the same approach `theta-env`'s `setup.sh` uses, just scoped to this one
-container. Equivalent manual steps, if you'd rather not use the script:
-
-```bash
-# LDAP — full directory export (works while slapd is running)
-docker compose exec sso-manager slapcat -f /etc/openldap/slapd.conf \
-  -b "dc=yourdomain,dc=com" > ldap-backup-$(date +%F).ldif
-
-# Redis — hot snapshot: trigger a save, then copy the RDB out
-docker compose exec sso-manager redis-cli BGSAVE
-docker compose cp sso-manager:/data/dump.rdb sso-redis-$(date +%F).rdb
-
-# Secrets — copy the config dir (holds LDAP_ADMIN_PASS, JWT secret, etc.)
-cp -a ./config config-backup-$(date +%F) && chmod 700 config-backup-$(date +%F)
-```
-Store the backup **off the host** — it contains secrets and the whole user
-directory.
-
-**Restore — full (disaster recovery)**
-
-The SSO image uses a static `slapd.conf` (slapd starts with `-f`, not `-F`
-cn=config), so LDAP restore uses `slapadd -f /etc/openldap/slapd.conf`:
-
-```bash
-# 1. Secrets
-cp -a config-backup-<date> ./config && chmod 700 ./config
-./setup.sh                       # fresh empty volumes (or: docker compose up -d)
-docker compose stop sso-manager
-
-# 2. LDAP — wipe the mdb files, then load the LDIF into the stopped directory
-docker compose run --rm --no-deps --entrypoint sh sso-manager -c \
-  'rm -f /var/lib/ldap/* && slapadd -f /etc/openldap/slapd.conf -l /dev/stdin' \
-  < ldap-backup-<date>.ldif
-docker compose start sso-manager
-
-# 3. Redis — see the AOF note below
-docker compose stop sso-manager
-docker compose run --rm --no-deps --entrypoint sh sso-manager -c \
-  'rm -f /data/appendonly.aof /data/appendonly.aof.*'   # REQUIRED — see note
-docker compose cp sso-redis-<date>.rdb sso-manager:/data/dump.rdb
-docker compose start sso-manager
-```
-
-**Restore — Redis only** = step 3 above. **Restore — LDAP only** = step 2 above.
-
-> **AOF vs RDB (important):** with `--appendonly yes`, Redis loads
-> `appendonly.aof` on startup and **ignores** `dump.rdb` if the AOF exists. To
-> restore from an RDB snapshot you **must delete the AOF first** (step 3 does
-> this); Redis then loads the RDB and writes a fresh AOF. Verify after restoring:
-> `docker compose exec sso-manager redis-cli DBSIZE` and
-> `docker compose exec sso-manager ldapsearch -x -b "dc=yourdomain,dc=com"`.
-
-**Upgrades**
-
-```bash
-./setup.sh          # backs up, then rebuilds — volumes keep LDAP + Redis state
-# (standalone) docker compose pull && docker compose up -d
-```
-LDAP data and Redis state survive the rebuild because they live on named
-volumes, not in the image. Verify health (`docker compose ps`, log in, check an
-OAuth client). Note: re-running bootstrap resets the bootstrap-admin and
-service-account passwords to the values in `./config/sso-secrets.js`; non-theta
-OAuth clients live in SSO Redis and are preserved by the volume.
-
-> **Note — the bundled slapd is built from source.** The all-in-one image
-> compiles OpenLDAP from a pinned upstream commit to get the `nestgroup`
-> overlay (nested groups; see `docs/directory.md`), because no 2.6.x release
-> ships it. One consequence: master uses **LMDB 1.0.0**, whose on-disk format is
-> mutually unreadable with the 0.9.x in OpenLDAP 2.6.x
-> (`MDB_INVALID: File is not an LMDB file`). Moving a directory between a 2.6.x
-> image and this one is a `slapcat` → `slapadd` reload, not a restart — the same
-> shape as "Restore — LDAP only" above. Verify after a rebuild:
-> `docker compose logs sso-manager | grep nestgroup` should report the overlay
-> as available.
-
---
-
-## Method 2: Bare metal (Debian/Ubuntu)
-
-`install.sh` is an idempotent installer: it installs Node.js 22.x and Redis,
-force-syncs the repo to `/opt/theta42/sso-manager`, and symlinks the systemd
-config from the repo. Re-run it to update — it prints the version you're
-updating from and to (or "Already up to date" if there's nothing new).
-
-On the **first run only** it also installs and configures OpenLDAP (modules +
-overlays + custom schema + directory tree + required groups — see
-`ops/ldap-setup.sh`) and seeds `/etc/sso-manager/secrets.js` with a generated
-LDAP admin password and JWT secret (SMTP is left as a placeholder). Once that
-file exists it's never touched again, and LDAP is never re-bootstrapped —
-edit the file and restart the service to change anything.
-
-### Prerequisites
-
- Debian 11+ / Ubuntu 20.04+
- Root (`sudo`)
- Internet access
-
-### Install
-
-```bash
-wget -O - https://raw.githubusercontent.com/theta42/sso-manager-node/master/install.sh | sudo bash
-```
-
-or, if you already have the repo checked out:
-
-```bash
-sudo ./install.sh
-```
-
-| Env var | Description |
-|---------|-------------|
-| `LDAP_BASE_DN` | Base DN (default `dc=example,dc=com`) — first run only |
-| `LDAP_ADMIN_PASS` | LDAP admin password (default auto-generated) — first run only |
-| `JWT_SECRET` | JWT secret (default auto-generated) — first run only |
-| `ORG_NAME` | Org name (default `SSO Manager`) — first run only |
-| `PORT` | HTTP port (default `3001`) — first run only |
-| `SKIP_LDAP` | `true` to skip OpenLDAP bootstrap entirely (point at an existing server yourself) |
-| `REPO_URL`, `REPO_DIR`, `BRANCH`, `SECRETS_FILE` | Override the defaults |
-
-### Post-install
-
-```bash
-sudo systemctl status sso-manager
-journalctl -fu sso-manager
-curl http://localhost:3001/health    # -> {"status":"ok"}
-```
-
-### What `install.sh` does
-
-1. Installs Node.js 22.x (NodeSource) and Redis.
-2. Clones/updates the repo at `/opt/theta42/sso-manager`.
-3. **First run only:** installs OpenLDAP (`slapd`) with `pw-sha2`, `ppolicy`,
-   `memberof`, `refint` modules + overlays; the custom `theta42Person` schema
-   (`dateOfBirth`); indexes; `ou=people`/`ou=groups`/`ou=policies`; a default
-   `pwdPolicy`; and the SSO groups — then seeds `/etc/sso-manager/secrets.js`.
-4. Symlinks `ops/systemd/sso-manager.service` into `/etc/systemd/system` and
-   runs `npm ci --omit=dev`.
-5. Enables and (re)starts the service.
-
-> For an existing LDAP server, run with `SKIP_LDAP=true` and write
-> `/etc/sso-manager/secrets.js` yourself (see `secrets.js.example`) before
-> starting the service. To (re)configure overlays on an already-installed
-> slapd, use `ops/ldap-setup.sh` directly (idempotent, auto-detects the user
-> database).
-
---
-
-## LDAP requirements (for any external LDAP server)
-
-The app needs these on the LDAP server:
-
- **Modules:** `pw-sha2` (the app stores user passwords as `{SSHA512}`), `ppolicy`,
-  `memberof`, `refint`.
- **Custom schema:** the `theta42Person` auxiliary objectClass with `dateOfBirth`
-  (OID `1.3.6.1.4.1.99999.x`) — see `ops/ldap-setup.sh` for the LDIF.
- **Directory tree:** `ou=people`, `ou=groups`, `ou=policies` under the base DN, a
-  default `pwdPolicy` at `cn=ppolicy,ou=policies,<base>`.
- **Required groups:** `app_sso_admin` (full admin), `app_sso_invite` (invitation
-  management), `app_sso_oauth_admin` (OAuth client management),
-  `app_sso_service_account` (not a permission — marks a `posixAccount` as a
-  non-person service account; see docs/ldap.md).
-
-`ops/ldap-setup.sh -p <admin-password>` configures all of the above idempotently
-against a running slapd (auto-detects the database holding your base DN, and
-verifies `pwdAccountLockedTime` is live — the attribute the app's
-active/inactive toggle depends on).
-
---
-
-## Migrating an existing instance to the generic defaults
-
-The committed `nodejs/conf/base.js` now ships **generic** defaults
-(`dc=example,dc=com`, `localhost`, `SSO Manager`). Previously it carried
-Theta42-specific values (LDAP bind DN/bases, SMTP host/user/sender, OAuth issuer).
-If you run an existing instance off this repo:
-
- Move those per-deployment, non-secret values (bind DN, user/group bases, SMTP
-  host/user/sender, OAuth issuer, org name) from `base.js` into your gitignored
-  `conf/secrets.js`, **or** set them as `app_*` env vars. Secret values (LDAP bind
-  password, SMTP password, JWT secret) already belong in `secrets.js`.
- After the change, verify the merged config: `node -e "console.log(require('@simpleworkjs/conf'))"` from the `nodejs/` directory.
-
---
-
-## Troubleshooting
-
-### `503 OpenLDAP ppolicy overlay is not configured`
-The ppolicy overlay isn't attached to the database holding your users, so the
-active/inactive toggle can't set `pwdAccountLockedTime`. Run:
-```bash
-sudo ./ops/ldap-setup.sh -p 'admin-password' -b dc=yourdomain,dc=com
-```
-
-### App starts but LDAP operations 401 / "Invalid Credentials"
-Check the merged LDAP config the app actually sees:
-```bash
-cd nodejs && node -e "console.log(require('@simpleworkjs/conf').ldap)"
-```
-Confirm `url`/`bindDN`/`bindPassword`/`userBase` match your directory. Remember
-`app_*` env vars override `secrets.js` which overrides `base.js`.
-
-### `app_*` env vars seem to do nothing
-You're on `@simpleworkjs/conf` 1.0.0. Bump to 1.1.0+:
-```bash
-cd nodejs && npm install @simpleworkjs/conf@^1.1.0
-```
-
-### LDAP connection refused
-```bash
-docker compose exec sso-manager sh -c 'ldapsearch -x -H ldap://localhost:389 -b "" -s base'
-systemctl status slapd   # bare metal
-netstat -tlnp | grep 389
-```
-
---
-
-## Security notes
-
-1. **Never commit `secrets.js`** — it's in `.gitignore`.
-2. **Use LDAPS / StartTLS** for any LDAP connection that crosses the network. The
-   bundled slapd listens on `ldaps:///` (636, TLS) and `ldap:///` (389, plain +
-   StartTLS); port 389 is not mapped to the host by default so LAN clients can't
-   bind in cleartext. Direct-LDAP consumers (Linux hosts, LDAP-native apps,
-   `theta42/proxy`) should use `ldaps://…:636` or StartTLS.
-3. **Persist `JWT_SECRET`** — if the Docker image auto-generates one and you don't
-   set `JWT_SECRET`, issued tokens invalidate on container recreation.
-4. **Don't expose the UI's HTTP port to the internet** — terminate TLS at a front
-   proxy and keep `3001` on the Docker network / localhost only.
-5. **Don't port-forward LDAPS (636) to the internet either.** It's mapped to the
-   host by default for LAN/VPN clients that bind LDAP directly (other hosts
-   running `ldap-client`, apps with their own LDAP auth settings) — not for
-   exposure through your router/firewall. LDAP simple-bind is a brute-force
-   target with no rate limiting in front of it the way the HTTP login endpoints
-   have. If a remote host needs to bind LDAP, put it behind a VPN (Tailscale,
-   WireGuard, …) instead of forwarding 636 publicly.
-6. The all-in-one image runs slapd as the `ldap` user but the app process as root
-   (matches the bare-metal systemd unit). Harden the app to a non-root user for
-   production if needed.
@@ -122,6 +122,7 @@ RUN apk add --no-cache \
    dumb-init \
    bash \
    redis \
+    nmap \
    && rm -rf /var/cache/apk/*

 COPY --from=ldapbuild /opt/openldap /opt/openldap
@@ -181,10 +182,8 @@ COPY tos.md /tos.md
 # without internet access. Same flattened-path convention as tos.md above.
 COPY README.md /README.md
 COPY CHANGELOG.md /CHANGELOG.md
-COPY DEPLOYMENT.md /DEPLOYMENT.md
 COPY API.md /API.md
 COPY directory_spec.md /directory_spec.md
-COPY docs /docs

 # Baked commit hash from the gitinfo stage (see build_info.js).
 COPY --from=gitinfo /commit.txt ./.build_commit
@@ -36,10 +36,8 @@ RUN mkdir -p /app/config
 COPY tos.md /tos.md
 COPY README.md /README.md
 COPY CHANGELOG.md /CHANGELOG.md
-COPY DEPLOYMENT.md /DEPLOYMENT.md
 COPY API.md /API.md
 COPY directory_spec.md /directory_spec.md
-COPY docs /docs

 # Seed script and utility
 COPY test_seed.js ./test_seed.js
@@ -132,6 +132,29 @@ v1.1.13 -> v1.1.14`), or `Already up to date` if there's nothing new. Full
 details, including env var overrides (`LDAP_BASE_DN`, `SKIP_LDAP`, ...), in
 [DEPLOYMENT.md](DEPLOYMENT.md) under *Method 2: Bare metal*.

+## Secrets
+
+Secrets are loaded from **OpenBao** at boot via
+[@simpleworkjs/bao-conf](https://simpleworkjs.github.io/bao-conf/), which
+deep-merges `secret/sso-manager/conf` over the file-loaded config (fail-soft:
+if OpenBao is unreachable, boot continues from `CONF_SECRETS`). The SSO
+authenticates to OpenBao with the scoped `VAULT_TOKEN` (env, policy
+`sso-broker`) — never the root token.
+
+The SSO also acts as the **vault broker** for the whole stack: it mints
+per-user (`user-<uid>`) and per-admin (`sso-admin`) tokens through the
+`sso-broker` token role and exposes the personal-secrets UI at **Vault → My
+Secrets** (`secret/users/<uid>/*`, server-side token injection + path-scope
+guard) and an admin **Apps** tab to mint scoped tokens for external apps
+(`secret/apps/<name>/*`). The old `utils/conf_manager.js` was replaced by
+`@simpleworkjs/bao-conf`; the admin **Configuration** UI (`/api/conf`) now
+writes `secret/sso-manager/conf` through `bao-conf.set`.
+
+The `config/*-secrets.js` files are operator-edit seed artifacts (gitignored),
+not the authoritative store. For the full architecture, policies, token model,
+and rotation procedure, see theta-env's
+**[Secrets docs](https://theta42.github.io/theta-env/secrets/)**.
+
 ## Architecture

 ```
@@ -1,6 +0,0 @@
-module.exports = {
-    oidc: {
-        clientId: '',
-        clientSecret: '',
-    },
-};
@@ -0,0 +1,18 @@
+'use strict';
+
+// Example proxy secrets file. theta-env generates a real ./config/proxy-secrets.js
+// from this shape at setup (with empty clientId/clientSecret), then bootstrap.js
+// writes the SSO-generated OAuth client creds into it AND into OpenBao
+// (secret/proxy/conf). The proxy loads it via @simpleworkjs/conf, then overlays
+// secret/proxy/conf from OpenBao via @simpleworkjs/bao-conf at boot.
+//
+// The real file is gitignored (config/*-secrets.js) — never commit live creds.
+// This .example is tracked to document the expected shape only.
+module.exports = {
+	oidc: {
+		// The SSO registers the proxy as an OAuth client and writes the real
+		// values here (and into OpenBao). "set-me" is the bootstrap placeholder.
+		clientId: 'set-me',
+		clientSecret: 'set-me',
+	},
+};
@@ -1,35 +0,0 @@
-'use strict';
-
-// Local per-deployment configuration for this Theta42 instance.
-// This file is gitignored — it contains real secrets and per-deployment
-// values. The committed conf/base.js now ships generic defaults
-// (example.com / localhost); the theta42-specific non-secret values that
-// used to live in base.js have been migrated here so this instance keeps
-// working. New deployments should put their own values here or in app_* env.
-module.exports = {
-        port: 3001,
-        name: 'Theta42 SSO',
-        ldap: {
-                url: 'ldap://10.2.0.54',
-                bindDN: 'cn=admin,dc=theta42,dc=com',
-                bindPassword: 'Tomisgaypalm7',
-                userBase: 'ou=people,dc=theta42,dc=com',
-                groupBase: 'ou=groups,dc=theta42,dc=com',
-        },
-        smtp: {
-                host: 'mail.wgnode.com',
-                user: 'noreply@users.theta42.com',
-                // user: '',
-                pass: 'ZxAsQw!2',
-                from: 'Theta42 Accounts <noreply@users.theta42.com>',
-        },
-        voipms: {
-                username: 'wmantly@gmail.com',
-                password: 'EMjQvAuHhD!d5dm',
-                did:      '9297353350',
-        },
-        oauth: {
-                issuer: 'https://sso.theta42.com',
-                jwtSecret: '09e2501a1c93aef4d5d713c7db17c800c6d7d6f5f9e9cf2efbdfa37549021bf9',
-        },
-};
@@ -1,52 +0,0 @@
-title: SSO Manager
-description: A self-hosted OpenID Connect provider with a bundled OpenLDAP directory and a web management UI, for home labs and small businesses that want their own identity provider.
-url: "https://theta42.github.io"
-baseurl: "/sso-manager-node"
-logo: /assets/img/theta42.svg
-lang: en_US
-
-plugins:
-  - jekyll-seo-tag
-  - jekyll-sitemap
-
-github:
-  repository_url: https://github.com/theta42/sso-manager-node
-  zip_url: https://github.com/theta42/sso-manager-node/archive/refs/heads/master.zip
-  tar_url: https://github.com/theta42/sso-manager-node/archive/refs/heads/master.tar.gz
-  repository_name: theta42/sso-manager-node
-
-nav:
-  - title: Home
-    page: /
-    icon: fa-house
-  - title: Deployment
-    page: /deployment.html
-    icon: fa-server
-  - title: Configuration
-    page: /configuration.html
-    icon: fa-gears
-  - title: OAuth
-    page: /oauth.html
-    icon: fa-key
-  - title: LDAP
-    page: /ldap.html
-    icon: fa-address-book
-  - title: Directory
-    page: /directory.html
-    icon: fa-server
-  # API.md lives at the repo root, not under docs/, so Jekyll never renders an
-  # api.html for it — link the source directly, same as the Changelog.
-  - title: API
-    url: https://github.com/theta42/sso-manager-node/blob/master/API.md
-    icon: fa-code
-  - title: Changelog
-    url: https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md
-    icon: fa-list
-
-defaults:
-  - scope:
-      path: ""
-      type: "pages"
-    values:
-      layout: default
-      image: /assets/img/theta42.svg
@@ -1,82 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-	<meta charset="utf-8">
-	<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
-	<link rel="icon" type="image/svg+xml" href="{{ '/assets/img/theta42.svg' | relative_url }}">
-
-	{% seo title=false %}
-	<title>{% if page.title %}{{ page.title }} &middot; {% endif %}{{ site.title }}</title>
-
-	<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css">
-	<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css">
-	<link rel="stylesheet" href="{{ '/assets/css/style.css' | relative_url }}">
-</head>
-<body class="d-flex flex-column min-vh-100">
-
-	<nav class="navbar navbar-expand-md navbar-dark bg-dark fixed-top">
-		<div class="container-fluid px-3">
-			<a class="navbar-brand d-flex align-items-center" href="{{ '/' | relative_url }}">
-				<img src="{{ '/assets/img/theta42.svg' | relative_url }}" height="28" class="me-2" alt="">
-				{{ site.title }}
-			</a>
-			<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navMain" aria-controls="navMain" aria-expanded="false" aria-label="Toggle navigation">
-				<span class="navbar-toggler-icon"></span>
-			</button>
-			<div class="collapse navbar-collapse justify-content-end" id="navMain">
-				<ul class="navbar-nav">
-					{% for item in site.nav %}
-					<li class="nav-item">
-						{% if item.page %}
-						<a class="nav-link{% if page.url == item.page %} active{% endif %}" href="{{ item.page | relative_url }}">
-							{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
-						</a>
-						{% else %}
-						<a class="nav-link" href="{{ item.url }}" target="_blank" rel="noopener">
-							{% if item.icon %}<i class="fa-solid {{ item.icon }}"></i>{% endif %} {{ item.title }}
-						</a>
-						{% endif %}
-					</li>
-					{% endfor %}
-				</ul>
-			</div>
-		</div>
-	</nav>
-
-	<main class="flex-grow-1" style="margin-top: 4.5rem;">
-		<div class="container-fluid py-4 py-md-5">
-			<div class="row justify-content-center">
-				<div class="col-12 col-lg-10 col-xl-8">
-					<div class="card shadow-lg">
-						<div class="card-body p-4 p-md-5 site-content">
-							{{ content }}
-						</div>
-					</div>
-				</div>
-			</div>
-		</div>
-	</main>
-
-	<footer class="py-3 bg-dark text-light mt-auto">
-		<div class="container-fluid d-flex flex-wrap justify-content-between align-items-center small gap-2 px-3">
-			<span class="d-flex align-items-center gap-2">
-				<a href="https://theta42.com" target="_blank" rel="noopener">
-					<img width="40" src="{{ '/assets/img/theta42.svg' | relative_url }}" alt="theta42">
-				</a>
-				&copy; {{ 'now' | date: '%Y' }} theta42 &middot;
-				<a href="{{ site.github.repository_url }}/blob/master/LICENSE" target="_blank" rel="noopener" class="text-light">MIT License</a>
-			</span>
-			<span class="d-flex align-items-center gap-3">
-				<a href="{{ site.github.repository_url }}" target="_blank" rel="noopener" class="text-light text-decoration-none">
-					<i class="fa-brands fa-github"></i> GitHub
-				</a>
-				<a href="{{ site.github.repository_url }}/blob/master/CHANGELOG.md" target="_blank" rel="noopener" class="text-light text-decoration-none">
-					<i class="fa-solid fa-list"></i> Changelog
-				</a>
-			</span>
-		</div>
-	</footer>
-
-	<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
-</body>
-</html>
@@ -1,88 +0,0 @@
---
-layout: default
-title: Discovery Agents
-nav_order: 5
---
-
-# Discovery Agents
-
-The SSO Manager supports a robust agent architecture for auto-discovering devices, hosts, and services across your home lab or data center. Agents run on a scheduled cron and feed their data into a central **Reconciliation Engine** that smartly merges information based on MAC addresses and IPs.
-
-## Writing a Custom Agent
-
-Agents are simple JavaScript files placed in `nodejs/agents/discovery/`.
-
-A agent must export a single `discover` async function that returns a standardized graph of `resources` and `edges`.
-
-### Agent Skeleton
-
-```javascript
-// nodejs/agents/discovery/my_custom_agent.js
-module.exports = {
-  discover: async (config) => {
-    const { url, apiKey } = config; // Provided by your configuration
-    
-    const resources = [];
-    const edges = [];
-
-    // 1. Fetch your data from an API
-    // const data = await fetch(...);
-
-    // 2. Map data to Resources
-    resources.push({
-      kind: 'network_device', // 'host', 'service', 'network_device', 'unmanaged_device'
-      name: 'My Switch',
-      slug: 'my-switch-01',
-      metadata: {
-        make: 'Vendor',
-        model: 'Model X',
-        interfaces: [
-          { mac: '00:1A:2B:3C:4D:5E', ip: '10.0.0.5' }
-        ]
-      }
-    });
-
-    // 3. Map relations to Edges (optional)
-    edges.push({
-      parentSlug: 'my-switch-01',
-      childSlug: 'some-connected-client-slug',
-      relation: 'connected_to' // 'hosts', 'exposes', 'connected_to'
-    });
-
-    return { resources, edges };
-  }
-};
-```
-
-## Configuration
-
-Agents are automatically loaded and executed by the internal BullMQ job scheduler. You configure them in your `config/sso-secrets.js`:
-
-```javascript
-module.exports = {
-  // ... existing config ...
-  discovery: {
-    agents: {
-      my_custom_agent: {
-        enabled: true,
-        cron: '*/30 * * * *', // Run every 30 minutes
-        url: 'https://api.example.com',
-        apiKey: 'secret-key'
-      },
-      nmap: {
-        enabled: true,
-        cron: '0 * * * *',
-        targetRange: '192.168.1.0/24'
-      }
-    }
-  }
-};
-```
-
-## The Reconciliation Engine
-
-When your agent returns its graph, the Reconciliation Engine takes over:
-1. **Matching:** It tries to find an existing device in the database matching any MAC address provided in the `interfaces` array. If no MAC matches, it falls back to IP address, and then to `slug`.
-2. **Merging:** If it finds a match, it gracefully merges the metadata (so your agent can add CPU info to a host that NMAP previously found).
-3. **Source Tracking:** It records your agent's filename in the `discovery_sources` array on the resource, and updates the `last_seen` timestamp.
-4. **LDAP Spam Prevention:** Brand new devices are marked as `managed: false`. They will not pollute your LDAP directory until an admin explicitly promotes them.
@@ -1,116 +0,0 @@
-/* theta42 docs site — shares the in-app dark navbar/footer + card look
-   (Bootstrap 5 + Font Awesome, same as the running apps) rather than a
-   generic Jekyll theme. */
-
-body {
-	background-color: #f4f5f6;
-}
-
-.navbar-brand img {
-	filter: drop-shadow(0 0 2px rgba(0, 0, 0, .4));
-}
-
-.navbar-nav .nav-link.active {
-	color: #fff;
-	font-weight: 600;
-}
-
-/* Markdown content typography, scoped to the card body so it doesn't leak
-   into the nav/footer. */
-.site-content h1:first-child {
-	margin-top: 0;
-}
-
-.site-content h1,
-.site-content h2,
-.site-content h3 {
-	font-weight: 700;
-}
-
-.site-content h2 {
-	margin-top: 2.5rem;
-	padding-bottom: .4rem;
-	border-bottom: 1px solid #e9ecef;
-}
-
-.site-content h3 {
-	margin-top: 1.75rem;
-}
-
-.site-content a {
-	color: #a3671f;
-	text-decoration-color: rgba(163, 103, 31, .35);
-}
-
-.site-content a:hover {
-	color: #8a5a16;
-}
-
-.site-content pre {
-	background-color: #212529;
-	color: #f8f9fa;
-	padding: 1rem 1.25rem;
-	border-radius: .375rem;
-	overflow-x: auto;
-}
-
-.site-content code {
-	color: #a3671f;
-	background-color: #f4f0e8;
-	padding: .15em .4em;
-	border-radius: .25rem;
-	font-size: .875em;
-}
-
-.site-content pre code {
-	color: inherit;
-	background: none;
-	padding: 0;
-}
-
-.site-content table {
-	display: block;
-	overflow-x: auto;
-	width: 100%;
-	border-collapse: collapse;
-	margin: 1.25rem 0;
-}
-
-.site-content table th,
-.site-content table td {
-	border: 1px solid #dee2e6;
-	padding: .5rem .75rem;
-	text-align: left;
-}
-
-.site-content table th {
-	background-color: #f8f9fa;
-}
-
-.site-content blockquote {
-	border-left: 4px solid #C59341;
-	padding: .5rem 1rem;
-	margin: 1.25rem 0;
-	background-color: #f8f6f1;
-	color: #495057;
-}
-
-.site-content img {
-	max-width: 100%;
-	height: auto;
-}
-
-/* Screenshot grids in the markdown use width="49%" inline attrs for a
-   two-up desktop layout -- stack them on narrow screens instead of
-   squeezing to illegibility. */
-@media (max-width: 576px) {
-	.site-content img[width] {
-		width: 100% !important;
-		margin-bottom: .75rem;
-	}
-}
-
-.site-content hr {
-	margin: 2rem 0;
-	border-top: 1px solid #e9ecef;
-}
@@ -1,51 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 400" width="100%" height="100%">
-  <defs>
-    <linearGradient id="gold-grad" x1="0%" y1="0%" x2="100%" y2="100%">
-      <stop offset="0%" stop-color="#C59341" />
-      <stop offset="20%" stop-color="#E4B869" />
-      <stop offset="40%" stop-color="#FBF0B9" />
-      <stop offset="60%" stop-color="#DFB260" />
-      <stop offset="80%" stop-color="#BC8837" />
-      <stop offset="100%" stop-color="#A36F28" />
-    </linearGradient>
-
-    <linearGradient id="text-grad" x1="0%" y1="100%" x2="100%" y2="0%">
-      <stop offset="0%" stop-color="#FFFFFF" />
-      <stop offset="40%" stop-color="#F5E3B5" />
-      <stop offset="70%" stop-color="#D4A343" />
-      <stop offset="100%" stop-color="#8A5A16" />
-    </linearGradient>
-
-    <filter id="drop-shadow" x="-20%" y="-20%" width="140%" height="140%">
-      <feDropShadow dx="0" dy="8" stdDeviation="6" flood-color="#000000" flood-opacity="0.4"/>
-    </filter>
-  </defs>
-
-  <g filter="url(#drop-shadow)">
-    <g fill="url(#gold-grad)">
-      <path d="M 200,40 
-               C 290,40 350,110 350,200 
-               C 350,290 290,360 200,360 
-               C 110,360 50,290 50,200 
-               C 50,110 110,40 200,40 Z 
-               M 200,75 
-               C 130,75 88,130 88,200 
-               C 88,270 130,325 200,325 
-               C 270,325 312,270 312,200 
-               C 312,130 270,75 200,75 Z" 
-            fill-rule="evenodd" />
-      
-      <path d="M 88,190 L 140,190 C 140,190 142,210 140,210 L 88,210 Z" />
-      
-      <path d="M 260,190 L 312,190 C 312,190 310,210 260,210 Z" />
-    </g>
-
-    <text x="200" y="222" 
-          font-family="system-ui, -apple-system, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif" 
-          font-size="78" 
-          font-weight="900" 
-          fill="url(#text-grad)" 
-          text-anchor="middle"
-          letter-spacing="-2">42</text>
-  </g>
-</svg>
@@ -1,125 +0,0 @@
---
-layout: default
-title: Accounts, Groups & Managers
-description: A plain-language guide to users, service accounts, personal groups, and managers in SSO Manager.
---
-
-# Accounts, Groups & Managers
-
-This page explains the concepts behind the Users and Groups pages in plain
-language. If you want the technical schema/attribute-level detail instead,
-see the [LDAP reference](ldap.html).
-
-## What's an account?
-
-Every person (or app) that can sign in through this SSO Manager has an
-**account** — a username, a display name, maybe an email address, and a
-password (or, for service accounts, no password at all — see below).
-Accounts live in the directory this app manages, and any other app you've
-connected (Gitea, Home Assistant, your Wi-Fi, whatever) checks against these
-same accounts instead of keeping its own separate list of users and
-passwords.
-
-## Two kinds of account: people and service accounts
-
-Most accounts belong to an actual person — check **Users → People** to see
-them. But sometimes you need an account for something that *isn't* a
-person: a media server, a backup script, a bind account another app uses to
-look people up. These are **service accounts**, listed separately under
-**Users → Service Accounts**, and they're different from a person's account
-in two ways that matter:
-
- **No email required.** A service account doesn't need a mailbox, so the
-  form doesn't ask for one.
- **A password is optional.** If you leave it blank, nobody can log in as
-  that account — which is exactly what you want for something that only
-  ever gets used programmatically (a script authenticating with an API
-  token, or another app binding with a fixed, separately-configured
-  password you set yourself). Only give it a password if the account
-  genuinely needs to log in or bind somewhere as itself.
-
-Aside from those two differences, a service account is a completely normal
-account under the hood — it can belong to groups, have a manager, and so
-on, just like anyone else's.
-
-## Groups: who can do what
-
-A **group** is just a named list of accounts, used to control access. This
-app has a handful of built-in groups that grant admin powers (e.g. only
-people in the `app_sso_admin` group can see the Users/Groups/Directory/Overview
-pages at all), but you can also make your own groups for any app you
-connect — say, a group listing everyone who should be allowed into your
-photo server. Once a group exists, add or remove members from the
-**Groups** page, and point the other app's "who's allowed in" setting at
-that group's name.
-
-### Groups inside groups
-
-A group can contain another group, not just people — the *Nested* tab on any
-group card. Everyone in the inner group counts as a member of the outer one,
-however many levels deep it goes.
-
-This is mostly a way to stop repeating yourself. Make one `developers` group,
-nest it into the handful of things developers should reach, and adding a new
-developer to that one group grants all of them at once — instead of adding them
-to each individually and slowly drifting out of sync. The app already does this
-for itself: super admins are nested into every resource's admin group, and each
-admin group into its access group, so "can administer it" always implies "can
-use it".
-
-Two things it won't let you do: put a group inside itself (directly or round a
-longer loop), and empty a group completely — every group must keep at least one
-member.
-
-A note if you also manage the directory by hand: a group's member list shows
-what is *directly* listed on it. Someone who gets in through a nested group is
-a real member but won't appear there — the **Nested** tab shows what is nested,
-and the API's `effective` view lists everyone who actually gets in.
-
-## Every account's personal group
-
-Separately from the groups above, every single account — person or
-service account — automatically gets its own small, personal group when
-it's created, named after the account itself. Most of the time you'll
-never think about this; it exists so that, on a Linux system connected to
-this directory, each account "owns" its own files by default the same way
-a normal Unix user account would.
-
-Occasionally you'll want to share that ownership with someone else — for
-example, letting a second account also have write access to files a
-service account owns. That's what the **"Members of `<uid>`'s group"**
-section on a profile page is for: add another account there, and the
-underlying Linux permissions treat them as if they belong to that same
-personal group too.
-
-## What's a "manager"?
-
-Every account has one or more **managers** — the people allowed to edit
-that account's profile (phone number, SSH key, home directory, and so on)
-without needing full admin rights. By default, whoever created an account
-(the admin who added it, or whoever sent the invite) becomes its first
-manager, but you can add or remove managers later from the account's Edit
-form.
-
-This is useful for service accounts especially: if a service account
-belongs to a particular project or person, make them its manager so they
-can maintain it — rotate its SSH key, adjust its description — without
-needing to be a full SSO administrator.
-
-## Inviting someone vs. adding them yourself
-
-From the Users page you can either fill in someone's details yourself
-("Add new user"), or send them an **invite** — an email (or a link you copy
-and send however you like) that lets them pick their own username and
-password. Either way, the resulting account is identical; invites are just
-a convenience so you don't have to know someone's preferred username or
-handle their password directly.
-
-## Want more detail?
-
-This page deliberately leaves out LDAP schema names, attribute types, and
-protocol-level detail. If you're connecting a third-party app directly to
-the LDAP directory, or you just want to know exactly what's stored where,
-see the [LDAP reference](ldap.html).
-
-[← Back to Home](index.html)
@@ -1,59 +0,0 @@
---
-layout: default
-title: API Tokens
-description: A plain-language guide to personal access tokens in SSO Manager.
---
-
-# API Tokens
-
-This page explains what an API token is and when you'd want one. For the
-full list of API endpoints a token can call, see the
-[API reference](https://github.com/theta42/sso-manager-node/blob/master/API.md).
-
-## What's an API token, in plain terms?
-
-Normally, you interact with this app by logging in through a web browser.
-An **API token** (also called a personal access token, or PAT) is an
-alternative way in — a long, random string that a script, a scheduled job,
-or another program can use instead of a username and password, to act on
-your behalf without a human typing a login in each time.
-
-If you've ever set up a script to talk to GitHub, GitLab, or a similar
-service using a "token" instead of your real password, this is the same
-idea.
-
-## When would you actually need one?
-
-Most people never need to create one of these — you'll only want a token
-if you're automating something, for example:
-
- A script that syncs users or groups from somewhere else into this SSO
-  Manager on a schedule.
- A backup or monitoring job that checks this app's health via its API.
- A CI/CD pipeline that needs to register or update an OAuth client
-  automatically.
-
-If you're not doing any of that, you don't need an API token — just log in
-normally through the web UI.
-
-## How it works
-
-Create a token from your Profile page, give it a name so you remember what
-it's for later, and optionally an expiry. You'll be shown the token's
-value **exactly once** — copy it somewhere safe immediately, because it
-can't be viewed again afterward (only revoked or rotated). Whatever script
-or tool you're using it with sends it along with each request, the same
-way a browser sends your login session.
-
-A token acts **as you**, with **your** permissions — if you're not an
-admin, a token you create can't do admin-only things either. If you ever
-suspect a token has leaked (ended up somewhere it shouldn't have, like a
-public script or log file), revoke it immediately from your Profile page;
-it stops working right away.
-
-## Want more detail?
-
-This page doesn't attempt to list every API endpoint or show request/
-response examples — for that, see the full [API reference](https://github.com/theta42/sso-manager-node/blob/master/API.md).
-
-[← Back to Home](index.html)
@@ -1,79 +0,0 @@
---
-layout: default
-title: Connecting Apps (Single Sign-On)
-description: A plain-language guide to OAuth/OIDC clients and single sign-on in SSO Manager.
---
-
-# Connecting Apps (Single Sign-On)
-
-This page explains, in plain language, what happens when you "connect" an
-app to your SSO Manager so people can log into it with their existing
-account. For the technical endpoint/token detail, see the
-[OAuth reference](oauth.html).
-
-## What does "single sign-on" actually mean?
-
-Instead of every app you run having its own separate list of usernames and
-passwords, they all check with this SSO Manager instead. You log in once,
-here, and any connected app trusts that login — no separate password to
-remember or manage for each one. If you ever need to lock someone out
-everywhere at once, you do it in one place (deactivate their account here)
-instead of hunting down every app individually.
-
-The technology behind this is called **OAuth 2.0** and **OpenID Connect
-(OIDC)** — you'll see both names used, often together, referring to the
-same thing. You don't need to understand the protocol to use this page;
-what matters practically is the handful of concepts below.
-
-## What's a "client"?
-
-Every app you connect is registered here as a **client** — a single entry
-in the Directory representing that one app. Registering a client
-gives you a **Client ID** and **Client Secret**: think of these like a
-username and password, but for the *app itself* rather than for a person.
-You paste them into the other app's own "Single Sign-On" or "OIDC" setup
-screen, along with the discovery URL shown at the top of this page, and
-that app is now able to ask this SSO Manager to authenticate people on its
-behalf.
-
-**Treat the Client Secret like a password** — anyone who has it can
-impersonate that app when talking to your SSO Manager. If you ever suspect
-it's leaked, rotate it from the client's card.
-
-## What are "scopes"?
-
-**Scopes** control what information a connected app is allowed to ask for
-about the person logging in — their username, email, group memberships,
-and so on. Most apps tell you exactly which scopes they need in their own
-setup instructions; when in doubt, the default set (`openid`, `profile`,
-`email`, `groups`) covers what nearly every app expects.
-
-## "Restrict to Groups"
-
-By default, *any* account with an SSO Manager login can sign into a
-connected app. If that's not what you want — say, a home automation
-dashboard that only certain family members should reach — set **Restrict
-to Groups** on that client to one of your [groups](concepts-accounts.html).
-Only members of that group will be allowed to log into that particular
-app; everyone else gets turned away at the login step, even though their
-SSO Manager account still works everywhere else.
-
-## Redirect URIs
-
-A **Redirect URI** is the exact web address the connected app wants people
-sent back to once they've logged in here — it's a security measure so an
-attacker can't trick the login flow into redirecting somewhere else. The
-app's own setup instructions will tell you this value; copy it in exactly
-as given. If the app is reachable via more than one hostname (for example,
-because it sits behind [theta42/proxy](https://theta42.github.io/proxy/)),
-this field supports wildcard patterns — see the inline help under the
-field itself for the exact syntax.
-
-## Want more detail?
-
-This page intentionally skips the protocol-level detail (exact endpoint
-URLs, token formats, claim names). If you're troubleshooting a connection
-or building something against the API directly, see the
-[OAuth reference](oauth.html).
-
-[← Back to Home](index.html)
@@ -1,104 +0,0 @@
---
-layout: default
-title: Configuration
-description: SSO Manager's config layers — conf/base.js defaults, secrets.js overrides, and app_* environment variables.
---
-
-# Configuration
-
-[← Back to Home](index.html)
-
-The app loads configuration via
-[`@simpleworkjs/conf`](https://www.npmjs.com/package/@simpleworkjs/conf), which
-deep-merges, in order (later wins):
-
-1. `conf/base.js` — committed, generic defaults (`dc=example,dc=com`,
-   `localhost`, `SSO Manager`).
-2. `conf/<NODE_ENV>.js` — optional, environment-specific.
-3. `conf/secrets.js` — gitignored; secrets + per-deployment values.
-4. **`app_*` environment variables** — the highest-precedence layer.
-
-Any env var whose name starts with `app_` overrides the merged config. The rest
-of the name splits on **double-underscore** (`__`) into a nested path. Values are
-`JSON.parse`-coerced when possible (numbers, booleans, null, JSON) and kept as
-raw strings otherwise.
-
-## Examples
-
-| Env var | Sets | Type |
-|---------|------|------|
-| `app_ldap__url=ldap://host:389` | `conf.ldap.url` | string |
-| `app_ldap__bindPassword=secret` | `conf.ldap.bindPassword` | string |
-| `app_ldap__userBase=ou=people,dc=…` | `conf.ldap.userBase` | string |
-| `app_ldap__uidGidMin=1500` | `conf.ldap.uidGidMin` | number (new-user id floor) |
-| `app_ldap__uidGidReservedFloor=9000` | `conf.ldap.uidGidReservedFloor` | number (ids at/above this are ignored when allocating) |
-| `app_ldap__ldapsHost=ldap.internal.example.com` | `conf.ldap.ldapsHost` | string (hostname shown on `/integrations` for LDAPS binds; empty = derive from `oauth.issuer`) |
-| `app_ldap__ldapsPort=636` | `conf.ldap.ldapsPort` | number (port shown on `/integrations`) |
-| `app_oauth__jwtSecret=...` | `conf.oauth.jwtSecret` | string |
-| `app_oauth__issuer=https://sso.example.com` | `conf.oauth.issuer` | string |
-| `app_oauth__token_lifetime__access_token=3600` | `conf.oauth.token_lifetime.access_token` | number |
-| `app_smtp__secure=false` | `conf.smtp.secure` | boolean |
-| `app_smtp__host=smtp.example.com` | `conf.smtp.host` | string |
-| `app_name=My SSO` | `conf.name` | string |
-| `app_redis__host=redis.local` | `conf.redis.host` | string (external Redis) |
-
-## The `app_*` env layer requires conf >= 1.1.0
-
-The `app_*` environment-variable override layer was added in
-`@simpleworkjs/conf` **1.1.0**. On 1.0.0 the app ignores all `app_*` vars and only
-reads `base.js` / `<NODE_ENV>.js` / `secrets.js`. The Docker image will not honor
-`app_*` env on 1.0.0. Refresh the lock from the `nodejs/` directory:
-
-```bash
-cd nodejs && npm install @simpleworkjs/conf@^1.1.0
-```
-
-## Inspecting the merged config
-
-From the `nodejs/` directory:
-
-```bash
-node -e "console.log(require('@simpleworkjs/conf').ldap)"
-node -e "console.log(require('@simpleworkjs/conf').oauth)"
-node -e "console.log(require('@simpleworkjs/conf'))"   # everything
-```
-
-Or, inside the running container:
-
-```bash
-docker compose exec sso-manager node -e "console.log(require('@simpleworkjs/conf').ldap)"
-```
-
-`app_*` env vars override `secrets.js`, which overrides `base.js` — if a value
-isn't what you expect, check those layers in that order.
-
-## Migrating an existing instance to the generic defaults
-
-The committed `nodejs/conf/base.js` ships **generic** defaults
-(`dc=example,dc=com`, `localhost`, `SSO Manager`). Previously it carried
-Theta42-specific values (LDAP bind DN/bases, SMTP host/user/sender, OAuth
-issuer). If you run an existing instance off this repo:
-
- Move per-deployment, non-secret values (bind DN, user/group bases, SMTP
-  host/user/sender, OAuth issuer, org name) from `base.js` into your gitignored
-  `conf/secrets.js`, **or** set them as `app_*` env vars.
- Secret values (LDAP bind password, SMTP password, JWT secret) already belong
-  in `secrets.js`.
-
-## Troubleshooting `app_*` env vars
-
-### `app_*` vars seem to do nothing
-
-You're on `@simpleworkjs/conf` 1.0.0. Bump to 1.1.0+ (above).
-
-### LDAP operations 401 / "Invalid Credentials"
-
-Check the merged LDAP config the app actually sees:
-
-```bash
-cd nodejs && node -e "console.log(require('@simpleworkjs/conf').ldap)"
-```
-
-Confirm `url` / `bindDN` / `bindPassword` / `userBase` match your directory.
-
-[← Back to Home](index.html)
@@ -1,22 +0,0 @@
---
-layout: default
-title: Deployment
-description: Deploying SSO Manager — the all-in-one Docker image, bare-metal install, config layers, and backups.
---
-
-# Deployment Guide
-
-[← Back to Home](index.html)
-
-The full deployment guide — Docker (all-in-one image), bare-metal install,
-the `app_*` env reference, backups, and the security notes (including why
-LDAPS shouldn't be port-forwarded to the internet) — lives in one place to
-avoid two copies drifting out of sync:
-
-**[DEPLOYMENT.md on GitHub](https://github.com/theta42/sso-manager-node/blob/master/DEPLOYMENT.md)**
-
-See also [Configuration](configuration.html) for the config layer merge
-order, and [LDAP](ldap.html) for the directory layout and connecting a
-3rd-party app.
-
-[← Back to Home](index.html)
@@ -1,85 +0,0 @@
---
-layout: default
-title: Home
-description: A self-hosted OpenID Connect provider with a bundled OpenLDAP directory and a web management UI. One login for your modern apps, one LDAP directory for the rest, no phone-home.
---
-
-# SSO Manager
-
-A self-hosted **OpenID Connect provider** with a bundled **OpenLDAP directory**
-and a web management UI — for home labs and small businesses that want their
-own identity provider instead of a hosted one.
-
-One place to manage your users and groups, one login (OIDC) your modern apps
-can use, and one LDAP directory your older or odder apps can bind to directly.
-Everything runs on your own hardware; no phone-home, no hosted control plane,
-no per-user pricing.
-
-Part of the theta42 self-hosted identity stack, alongside
-[Proxy](https://theta42.github.io/proxy/) (an OIDC + LDAP-aware reverse proxy)
-and [theta-env](https://theta42.github.io/theta-env/) (the two composed with
-one command).
-
-## Screenshots
-
-<a href="images/dashboard.png" target="_blank"><img src="images/dashboard.png" alt="Overview dashboard" width="49%"></a>
-<a href="images/users.png" target="_blank"><img src="images/users.png" alt="User list" width="49%"></a>
-<a href="images/groups.png" target="_blank"><img src="images/groups.png" alt="Groups" width="49%"></a>
-<a href="images/directory.png" target="_blank"><img src="images/directory.png" alt="Directory & inventory" width="49%"></a>
-<a href="images/oauth-clients.png" target="_blank"><img src="images/oauth-clients.png" alt="OAuth client (edit view)" width="49%"></a>
-
-*(click any screenshot to view full size)*
-
-## Why this over the alternatives
-
-Tools like Keycloak, Authentik, Authelia, or Zitadel are OIDC providers, but
-LDAP is either a paid feature, a federation target you have to run
-separately, or absent. If your stack already has apps that speak LDAP
-directly — or you just want one real directory as the source of truth — you
-end up running *two* identity systems and keeping them in sync.
-
-SSO Manager bundles the OpenLDAP directory with the OIDC provider, so OIDC
-apps and LDAP apps read from the same users and groups. The trade-off is
-scope: it's intentionally small and self-hosted, not an enterprise IAM suite.
-If you want a lightweight, self-contained identity provider with a real LDAP
-backend, that's the niche.
-
-## Features
-
- **OpenID Connect / OAuth 2.0 provider** — your own access/refresh/ID
-  tokens; standard discovery document at `/.well-known/openid-configuration`.
- **Bundled OpenLDAP directory** — users, groups, POSIX accounts, SSH public
-  keys, and sudo roles, with `memberOf` + referential-integrity overlays.
- **Web management UI** — users, groups, and OAuth clients from a browser;
-  invite and password-reset flows over email; self-service profile + API
-  tokens.
- **Direct LDAP binds** — anything that binds LDAP directly (Linux hosts
-  via PAM/SSSD, Gitea, Emby, …) uses LDAPS/StartTLS against the same
-  directory.
- **All-in-one Docker image** — app + OpenLDAP + Redis in one container, or
-  run the pieces separately via `app_*` env config.
- **Geo-Location Scaling** — built-in support for N-Way Multi-Master OpenLDAP [replication](replication.html) across physical sites.
- **[Directory & Inventory](directory.html)** — map sites, hosts, and services as a graph with rich metadata (IP/MAC, OS/kernel, ports, git repos), auto-provisioned access groups, and automatic registration from theta-env and ldap-client. Drives directory-aware tools like the [SSH jump host](https://theta42.github.io/jump-host/).
-
-## Get it
-
-```bash
-git clone https://github.com/theta42/sso-manager-node.git
-cd sso-manager-node
-cp secrets.js.example nodejs/conf/secrets.js   # edit it, or use app_* env
-docker compose up -d --build
-```
-
-That's the standalone quick start. For the full set of install options
-(Docker, bare-metal, or as part of the combined SSO + proxy stack), the
-`app_*` env reference, and the OAuth/LDAP internals, see the
-**[GitHub repository](https://github.com/theta42/sso-manager-node)**.
-
-## Related projects
-
- **[Proxy](https://theta42.github.io/proxy/)** — an OIDC + LDAP-aware
-  reverse proxy, designed to sit in front of this SSO.
- **[Jump Host](https://theta42.github.io/jump-host/)** — an SSH jump host that
-  uses this SSO's directory to decide who may reach which machine.
- **[theta-env](https://theta42.github.io/theta-env/)** — runs this SSO
-  Manager and the proxy together with one command.
@@ -1,432 +0,0 @@
---
-layout: default
-title: LDAP
-description: SSO Manager's bundled OpenLDAP directory — schema, service accounts, TLS, and connecting third-party apps directly.
---
-
-# LDAP Directory
-
-[← Back to Home](index.html)
-
-> Looking for a plainer explanation of accounts, groups, and managers
-> instead of schema/attribute detail? See
-> [Accounts, Groups & Managers](concepts-accounts.html).
-
-SSO Manager runs an OpenLDAP directory holding your users and groups. The app
-authenticates against it over `localhost:389` (inside the all-in-one container)
-and exposes **LDAPS** (`ldaps://…:636`, TLS) for anything that binds LDAP
-directly — Linux hosts (PAM/SSSD, sudo rules, SSH keys), Gitea, Emby, the
-theta42/proxy, etc.
-
-## Directory layout
-
-```
-dc=yourdomain,dc=com
-├── ou=people          users (inetOrgPerson + posixAccount + …)
-├── ou=groups          groups (groupOfNames)
-└── ou=policies        password policies (pwdPolicy)
-    └── cn=ppolicy     default policy
-```
-
-### Users
-
-User entries are `cn=<uid>,ou=people,<base>` and carry the objectClasses:
-
- `inetOrgPerson` (cn, sn, mail, …) — identity / contact attrs.
- `posixAccount` (uid, uidNumber, gidNumber, homeDirectory) — the SSO's
-  `userFilter` is `(objectClass=posixAccount)`, so a user is "a real account"
-  iff it has `posixAccount`.
- `ldapPublicKey` — SSH public keys (`sshPublicKey`).
- `sudoRole` — per-user sudo rules (`sudoCommand`, `sudoHost`, `sudoUser`).
- `theta42Person` (custom auxiliary; `dateOfBirth`).
-
-Every user (person or service account) also carries a `manager` attribute
-(the standard COSINE `manager`, `SUP distinguishedName`) — one or more DNs of
-the people who created/administer that account. Set automatically to the
-creator's DN on signup (whoever an admin was logged in as, or whoever sent
-the invite), and reassignable later from the account's Edit form. Anyone
-listed as a `manager` can edit that account (same fields an admin can:
-mobile, description, SSH key, date of birth, home directory, login shell,
-and the manager list itself) without needing `app_sso_admin`.
-
-Passwords are stored as `{SSHA512}` (8-byte salt, sha512(pass+salt), base64),
-verified by the `pw-sha2` module. The app's `hashPasswordSSHA512` is the
-canonical hasher; if you provision users out-of-band, hash passwords the same
-way or use `slappasswd -h '{SSHA512}'`.
-
-### Groups
-
-Groups are `cn=<name>,ou=groups,<base>` (`groupOfNames`) with a `member`
-attribute listing member DNs. The `memberOf` overlay populates reverse
-membership (`memberOf` on the user); `refint` keeps it consistent on
-add/remove.
-
-Note that `groupOfNames` requires **at least one member**, which has two
-consequences worth knowing: whoever creates a group is automatically seeded
-into it, and removing the last member (user *or* nested group) is refused with
-a 409 rather than leaving an invalid entry behind.
-
-### Nested groups
-
-A `member` DN may be another group's, not just a user's — that is how nesting
-is stored, with no extra schema. Everyone in the nested group is a member of
-the outer one, at any depth. Manage it on the **Groups** page under each
-group's *Nested* tab, or via the API:
-
-```
-PUT    /api/group/:group/nested/:child    nest :child inside :group
-DELETE /api/group/:group/nested/:child    un-nest
-GET    /api/group/:group/effective        direct users, nested groups, and the
-                                          full transitive set of users
-```
-
-Cycles are refused (409) rather than truncated — a loop makes "who is in this
-group" unanswerable. Two standing relationships are wired automatically: the
-cross-app `app_super_admin` is nested into every resource's `<slug>_admin`
-group, and each `<slug>_admin` into its `<slug>_access` group, so administering
-something implies being able to use it.
-
-**Resolving nesting is a client-side job on stock OpenLDAP.** No 2.6.x release
-can evaluate nested groups; `memberOf` and a `(member=X)` filter both return
-direct membership only. The bundled slapd is therefore built from source with
-the `nestgroup` overlay (see *Modules + overlays* below), and the app is told so
-via `ldap.nestedGroupsServerSide`. Against any other server the app computes the
-closure itself — same answers, more queries. Either way, **never read `memberOf`
-directly to make an access decision**; use `utils/user_groups.js`'s `groupCns()`,
-which is correct in both modes.
-
-### Personal groups
-
-Every user (person or service account) also gets a **personal Unix group**
-at creation — `cn=<uid>,ou=groups,<base>`, `objectClass: posixGroup` (RFC
-2307), holding just `cn` and `gidNumber` (the user's primary GID). This is a
-different schema than the `groupOfNames` groups above — its membership
-attribute is `memberUid` (a bare username, not a DN), and unlike
-`groupOfNames` it's valid with zero members. It's excluded from the
-`/groups` page (which filters on `objectClass=groupOfNames`) and managed
-instead from the owning user's own profile page ("Members of `<uid>`'s
-group", admin-only) — add other accounts as supplementary members, e.g. to
-share write access to files owned by this group.
-
-The SSO seeds these groups automatically (entrypoint / `install.sh`):
-
-| Group | Grants |
-|-------|--------|
-| `app_super_admin` | cross-app super admin. Nested into the three below, so its members hold those rights transitively rather than by a special case in app code — and the privilege is visible to LDAP-native consumers (SSSD, sudo) too. |
-| `app_sso_admin` | full admin (users, groups, settings) |
-| `app_sso_oauth_admin` | OAuth client management |
-| `app_sso_invite` | invitation management |
-| `app_sso_service_account` | not a permission — marks a `posixAccount` as a non-person service account (see *Service accounts* below). Deliberately **not** nested into, since it changes how an account is displayed rather than what it may do. |
-
-## TLS (LDAPS / StartTLS)
-
-The bundled slapd generates a **self-signed cert** on first start (CN =
-`LDAP_CERT_CN`, valid 10y, SAN = CN + `localhost` + `127.0.0.1`) and listens on:
-
- `ldaps:///` — **636**, TLS (the port to expose for direct-LDAP clients).
- `ldap:///` — **389**, plain + StartTLS (not mapped to the host by default).
-
-The cert lives on the `ldap-certs` volume so it persists across container
-recreation.
-
-### Trusting the self-signed cert
-
-Copy it out and add it to the client's CA store:
-
-```bash
-docker compose cp sso-manager:/etc/openldap/certs/ldap.crt ./ldap.crt
-```
-
-…or, for quick LAN use, set `TLS_REQCERT never` on the client (the theta42/proxy
-sets `app_ldap__tlsOptions__rejectUnauthorized=false` for the same effect).
-
-### Using your own cert
-
-Replace the `ldap-certs` named volume with a bind mount containing your own
-`ldap.crt` + `ldap.key`:
-
-```yaml
-volumes:
-  - ./certs:/etc/openldap/certs   # must contain ldap.crt + ldap.key
-```
-
-The entrypoint leaves existing certs untouched (idempotent).
-
-## Choosing the LDAPS hostname
-
-The `/integrations` page advertises an **LDAPS URL** for direct LDAP binds. By
-default it derives that URL from the public OAuth issuer (e.g.
-`https://sso.example.com` → `ldaps://sso.example.com:636`). That is convenient,
-but it implies LDAP clients reach your directory through the same public
-hostname — which usually means port-forwarding 636 through your router.
-
-**Do not port-forward LDAPS (636) to the public internet.** LDAP simple binds
-have no rate limiting and are a brute-force target. Instead, use one of these
-internal-only patterns and set `conf.ldap.ldapsHost` (or
-`app_ldap__ldapsHost`) so the `/integrations` page shows the right URL.
-
-### 1. Same Docker / local network host (best for apps on this machine)
-
-If the LDAP client runs on the same Docker network as the SSO Manager (for
-example, the bundled `theta-env` stack), use the internal service name:
-
-```
-ldaps://sso-manager:636
-```
-
-In `conf/secrets.js`:
-
-```javascript
-ldap: {
-  ldapsHost: 'sso-manager',
-  ldapsPort: 636,
-}
-```
-
-The proxy in theta-env already uses this internally. The bundled slapd cert
-includes `sso-manager` in its SAN when `LDAP_CERT_CN` is left at its default,
-so hostname verification works without extra setup.
-
-### 2. LAN host behind your router (best for separate home-lan machines)
-
-Create an internal-only DNS record — e.g. `ldap.internal.example.com` →
-`192.168.1.10` — using your router, Pi-hole, or a local `hosts` file. Then get
-or generate a cert whose SAN/CN matches that internal name:
-
- **Let's Encrypt wildcard** (`*.internal.example.com`) works if you own the
-  public domain and can complete DNS-01 challenge; the record itself can stay
-  private/routable only inside your LAN.
- **Internal CA** is fine for a pure LAN: run a small CA, issue a cert for
-  `ldap.internal.example.com`, and distribute the CA cert to clients.
- **Self-signed** with `LDAP_CERT_CN=ldap.internal.example.com` also works; copy
-  the generated `ldap.crt` to each client and trust it.
-
-In `conf/secrets.js`:
-
-```javascript
-ldap: {
-  ldapsHost: 'ldap.internal.example.com',
-  ldapsPort: 636,
-}
-```
-
-The URL on `/integrations` becomes `ldaps://ldap.internal.example.com:636`.
-
-### 3. Public hostname (acceptable only behind a VPN/firewall)
-
-If a remote host must bind LDAP, put it behind a VPN (Tailscale, WireGuard,
-etc.) or a tightly locked-down firewall rule. In that case the public hostname
-may be appropriate, but the LDAPS port should still not be reachable from the
-open internet.
-
-### Why not just use the LDAP server's IP address?
-
-TLS clients verify the server name against the certificate. Connecting to
-`ldaps://192.168.1.10:636` with a cert issued for `*.internal.example.com`
-will fail hostname verification unless you disable cert checks — which removes
-most of the security benefit of LDAPS. Always use a hostname that matches the
-cert.
-
-## Service accounts
-
-A service account is a normal `posixAccount` for something that isn't a
-person: a media manager, a torrent client, a service like Emby, or a
-read-only bind account an app uses to look users up — anything that needs a
-real `uidNumber`/`gidNumber` to own files, or that other accounts join via a
-group for write access (e.g. a `stuff_manager` group granting write rights
-to a media library). There's only one kind — every account, person or
-service, is a real `posixAccount` with a UID.
-
-Create one from the **Users → Service Accounts** tab's "Add new user" form
-with **This is a service account** checked — it skips the birthday/
-Terms-of-Service fields a real person's account needs and asks for just an
-account name. It's flagged (via membership in the `app_sso_service_account`
-group) so it's listed separately from real people and excluded from "all
-users" notification broadcasts.
-
-Email and password are both optional for a service account:
-
- No `mail` is set unless you give it one (it never needs a mailbox).
- Leaving the password blank is fine — no `userPassword` attribute is set at
-  all, and an entry with no `userPassword` simply can't bind with any
-  password (standard LDAP simple-bind behavior). Only set a password if the
-  account actually needs to authenticate as itself (e.g. a bind-only account
-  an app uses to look users up).
-
-theta-env's bootstrap creates its own `cn=ldapclient` bind account directly
-against LDAP (independent of this app), and the proxy binds as it — that
-account won't show up in the Service Accounts tab since it isn't managed
-through this app, but it keeps working unchanged.
-
-Either way: don't reuse the admin DN, and give a service account only the
-group memberships and `manager`s it actually needs.
-
-Example bind test (a service account with a password set):
-
-```bash
-ldapsearch -x -H ldaps://sso.example.com:636 \
-  -D "cn=ldapclient,ou=people,dc=yourdomain,dc=com" -W \
-  -b "ou=people,dc=yourdomain,dc=com" '(objectClass=posixAccount)' cn mail
-```
-
-## Connecting a 3rd-party app or container
-
-Most self-hosted apps with an "LDAP authentication" settings page — Gitea,
-Nextcloud, Grafana, Emby, Jenkins, etc. — or containers configured via
-`LDAP_*` env vars, all ask for the same handful of values. These are the
-`conf.ldap` values from [Configuration](configuration.html), applied to
-*your* domain:
-
-| Field the app asks for | Value |
-|---|---|
-| Host / URL | `ldaps://<your-sso-host>:636` (preferred), or `ldap://<host>:389` + StartTLS |
-| Bind DN | a dedicated service account — e.g. `cn=ldapclient,ou=people,<base>` (see above) |
-| Bind password | that service account's password |
-| User search base | `ou=people,<base>` |
-| User search filter | `(objectClass=posixAccount)` |
-| Username attribute | `uid` |
-| Email attribute | `mail` |
-| Group search base | `ou=groups,<base>` |
-| Group membership attribute | `memberOf` (on the user entry — populated by the `memberof` overlay) |
-| TLS | required for 636 (LDAPS); if using the bundled self-signed cert, either trust it (see *TLS* above) or set the app's "don't verify cert" option for LAN-only use |
-
-### Worked example: Gitea
-
-Gitea's **Admin → Authentication Sources → Add Authentication Source** (type
-LDAP, "Bind DN/Password") maps directly:
-
- Security Protocol: `LDAPS`
- Host / Port: your SSO host / `636`
- Bind DN: `cn=ldapclient,ou=people,dc=yourdomain,dc=com`
- Bind Password: the service account's password
- User Search Base: `ou=people,dc=yourdomain,dc=com`
- User Filter: `(&(objectClass=posixAccount)(uid=%s))`
- Username Attribute: `uid`
- E-mail Attribute: `mail`
-
-Other apps with an LDAP settings UI follow the same shape — the field names
-above are the constants; only the base DN and hostname change per deployment.
-
-### Generic Docker container (`LDAP_*` env vars)
-
-For images that take a flat env-var LDAP config (there's no single standard,
-but most look like this):
-
-```yaml
-environment:
-  LDAP_URL: ldaps://sso.example.com:636
-  LDAP_BIND_DN: cn=ldapclient,ou=people,dc=yourdomain,dc=com
-  LDAP_BIND_PASSWORD: <service-account-password>
-  LDAP_USER_BASE: ou=people,dc=yourdomain,dc=com
-  LDAP_USER_FILTER: (objectClass=posixAccount)
-  LDAP_GROUP_BASE: ou=groups,dc=yourdomain,dc=com
-```
-
-Check the specific image's docs for its actual variable names — the values
-you plug in are still the ones from the table above.
-
-### Full Linux host auth (SSH, sudo, login) instead of a single app
-
-If you want a *host* (not just one app) to authenticate logins, SSH keys, and
-sudo against this LDAP directory — not just one application — that's a
-different integration (SSSD + PAM + NSS, not a single bind). See
-[theta42/ldap-client](https://github.com/theta42/ldap-client): a script that
-configures SSSD on Ubuntu/Debian hosts against this directory, including
-group-based access control and SSH public key retrieval from LDAP.
-
-## Modules + overlays (external LDAP servers)
-
-If you point the app at your own LDAP server instead of the bundled slapd, it
-needs:
-
- **Modules:** `pw-sha2` (the app stores user passwords as `{SSHA512}`),
-  `ppolicy`, `memberof`, `refint`.
- **Optional — `nestgroup`:** server-side nested-group evaluation. Not in any
-  released OpenLDAP (added to master as ITS#10161 in March 2024; 2.7 is still
-  unreleased), so the bundled image builds slapd from a pinned upstream commit.
-  Without it the app resolves nesting itself and everything still works — leave
-  `ldap.nestedGroupsServerSide` at `false`. With it, set that to `true` and
-  configure:
-
-  ```
-  overlay         nestgroup
-  nestgroup-base  ou=groups,<base>
-  nestgroup-flags member-filter memberof-filter memberof-values
-  ```
-
-  Flags are **space-separated**; the comma form the man page's `{a, b, c}`
-  notation suggests is rejected. `member-values` is deliberately omitted — it
-  expands the `member` attribute when reading a group, which destroys the
-  distinction between "listed here" and "reachable through a nested group", and
-  the raw values are then unrecoverable. Transitive answers come from the filter
-  flags and from `GET /api/group/:group/effective`.
-
-  One more consequence of building from master: it ships **LMDB 1.0.0**, whose
-  on-disk format is mutually unreadable with the 0.9.x in 2.6.x
-  (`MDB_INVALID: File is not an LMDB file`). Moving a directory between the two
-  is a `slapcat` → `slapadd` reload, not a restart.
- **Custom schema:** the `theta42Person` auxiliary objectClass with
-  `dateOfBirth` — see `ops/ldap-setup.sh` for the LDIF.
- **Directory tree:** `ou=people`, `ou=groups`, `ou=policies` under the base DN,
-  a default `pwdPolicy` at `cn=ppolicy,ou=policies,<base>`.
- **Required groups:** `app_sso_admin`, `app_sso_invite`, `app_sso_oauth_admin`,
-  and `app_super_admin` (the cross-app super-admin group; the bundled entrypoint
-  also nests it into the first three).
-
-`ops/ldap-setup.sh -p <admin-password>` configures all of the above
-idempotently against a running slapd (auto-detects the database holding your
-base DN, and verifies `pwdAccountLockedTime` is live — the attribute the app's
-active/inactive toggle depends on).
-
-## Backups and restore
-
-`ops/backup.sh` automates this (LDAP + Redis + `./config/`, with retention)
-for standalone deployments — see the *Backups and restore* section of
-`DEPLOYMENT.md`. The manual LDAP-only steps below are what it does under the
-hood, useful if you want just the directory without Redis/config.
-
-**Backup** (while slapd is running):
-
-```bash
-docker compose exec sso-manager slapcat -f /etc/openldap/slapd.conf \
-  -b "dc=yourdomain,dc=com" > ldap-backup-$(date +%F).ldif
-```
-
-Store the `.ldif` off the host — it contains every user's password hash.
-
-**Restore** into a stopped directory. The SSO image uses a static `slapd.conf`
-(slapd starts with `-f`, not cn=config `-F`), so restore uses `slapadd -f`:
-
-```bash
-docker compose stop sso-manager
-docker compose run --rm --no-deps --entrypoint sh sso-manager -c \
-  'rm -f /var/lib/ldap/* && slapadd -f /etc/openldap/slapd.conf -l /dev/stdin' \
-  < ldap-backup-<date>.ldif
-docker compose start sso-manager
-```
-
-Verify: `docker compose exec sso-manager ldapsearch -x -b "dc=yourdomain,dc=com"`.
-
-Redis state (OAuth clients, tokens) and `./config/` secrets are backed up
-separately — see the *Backups and restore* section of `DEPLOYMENT.md` for the
-full (LDAP + Redis + secrets) runbook.
-
-## Troubleshooting
-
-### `503 OpenLDAP ppolicy overlay is not configured`
-
-The ppolicy overlay isn't attached to the database holding your users, so the
-active/inactive toggle can't set `pwdAccountLockedTime`:
-
-```bash
-sudo ./ops/ldap-setup.sh -p 'admin-password' -b dc=yourdomain,dc=com
-```
-
-### LDAP connection refused
-
-```bash
-docker compose exec sso-manager sh -c 'ldapsearch -x -H ldap://localhost:389 -b "" -s base'
-systemctl status slapd   # bare metal
-```
-
-[← Back to Home](index.html)
@@ -1,112 +0,0 @@
---
-layout: default
-title: OAuth / OIDC
-description: SSO Manager's OpenID Connect / OAuth 2.0 provider — discovery document, client registration, and token endpoints.
---
-
-# OAuth 2.0 / OpenID Connect
-
-[← Back to Home](index.html)
-
-> Looking for a plainer explanation of clients/scopes/redirect URIs instead
-> of endpoint-level detail? See
-> [Connecting Apps (Single Sign-On)](concepts-oauth-apps.html).
-
-SSO Manager is an **OpenID Connect / OAuth 2.0 provider**: it issues its own
-access, refresh, and ID tokens that your apps can consume to authenticate
-users and authorize API calls. It also runs a full OpenLDAP directory, so it
-can be both your SSO and your user directory at once.
-
-## Discovery
-
-The provider publishes a standards-compliant discovery document:
-
-```
-GET https://<sso-host>/.well-known/openid-configuration
-```
-
-It advertises the `issuer`, `authorization_endpoint`, `token_endpoint`,
-`userinfo_endpoint`, `end_session_endpoint`, supported scopes, and token
-lifetimes. OIDC clients (e.g. the theta42/proxy) can read their endpoint URLs
-from here rather than configuring each one.
-
-The `issuer` advertised is `conf.oauth.issuer` — set it to the **browser-facing**
-HTTPS URL the SSO is served at (e.g. `https://sso.example.com`), either in
-`conf/secrets.js` or via `app_oauth__issuer` / `OAUTH_ISSUER`.
-
-## OAuth clients
-
-An OAuth client represents an app that authenticates against the SSO. Each has:
-
- `client_id` (UUID) + `client_secret` (bcrypt-hashed; the **raw secret is
-  shown once** when the client is created or rotated — save it immediately).
- `name`, `description`, `created_by` (the admin uid that created it).
- `redirect_uris` — allowed callback URLs. Each entry matches exactly, or may
-  use `*` (one hostname label) / `**` (any number of labels) as a wildcard —
-  e.g. `https://*.example.com/__proxy_auth/callback` covers every host
-  theta42/proxy fronts under `example.com`, so you don't have to register
-  each proxied host's callback individually.
- `scopes` — requested scopes (default `openid profile email groups`).
- `allowed_groups` — restrict the client to members of specific SSO groups
-  (empty = any valid user).
- `token_lifetime` — `access_token` / `refresh_token` lifetimes (seconds).
-
-### Managing clients
-
-Clients are managed directly from the **Directory** tab in the web UI. They are modeled as resources of `kind: oauth` and must belong to a parent Service.
-
-| Action | How to do it |
-|--------|--------------|
-| **Create** | Click the green **+** on a parent Service to add a child resource. Choose **OAuth Integration**. The raw `client_secret` is shown once upon creation. |
-| **Edit** | Click the edit pencil on the OAuth resource in the Directory list or tree. You can update redirect URIs, scopes, allowed groups, and token TTLs. |
-| **Delete** | Click the trash can on the OAuth resource in the Directory list. |
-| **Rotate Secret** | Open the edit modal for the OAuth resource and click **Rotate Client Secret**. The new raw secret is shown once. |
-
-> All client-management actions use the standard Directory API (`/api/directory-admin/resources`) and are gated by the `app_sso_directory_admin` group.
-
-<a href="images/oauth-clients.png" target="_blank"><img src="images/oauth-clients.png" alt="Editing an OAuth client resource" width="80%"></a>
-
-## Scopes
-
-| Scope | Claims / access |
-|-------|-----------------|
-| `openid` | OIDC ID token + discovery |
-| `profile` | `preferred_username`, display name, etc. |
-| `email` | the user's `mail` |
-| `groups` | the user's group memberships (the `groups` claim) |
-
-The `groups` claim is what relying parties (e.g. the proxy's
-`app_auth__adminGroups`) use to map group membership to roles.
-
-## Token lifetimes
-
-Defaults (overridable per-client via `token_lifetime`, or globally via
-`app_oauth__token_lifetime__access_token` /
-`app_oauth__token_lifetime__refresh_token`):
-
- access token: 3600s (1 hour)
- refresh token: 2592000s (30 days)
-
-## Admin gating
-
-SSO admin actions are gated by LDAP group membership (checked via the group's
-`member` list, not `memberOf` on the user):
-
- `app_sso_admin` — full admin (users, groups, settings).
- `app_sso_oauth_admin` — OAuth client management.
- `app_sso_invite` — invitation management.
-
-The bootstrap in [theta-env](https://github.com/theta42/theta-env) creates your
-first admin and adds them to `app_sso_admin` + `app_sso_oauth_admin`
-automatically; for a standalone install, add the admin's DN to those groups
-manually (or via `ops/ldap-setup.sh`).
-
-## JWT signing
-
-Tokens are signed with `conf.oauth.jwtSecret` (`app_oauth__jwtSecret` /
-`JWT_SECRET`). **Persist this secret** — if it changes, every issued token
-stops validating. The all-in-one Docker image auto-generates one if none is set,
-but that generated value does not survive container recreation unless you
-persist it (set `JWT_SECRET` in your `.env`).
-
-[← Back to Home](index.html)
@@ -1,55 +0,0 @@
---
-layout: default
-title: Geo-Location Scaling (Replication)
---
-
-# Geo-Location Scaling (Replication)
-
-SSO Manager is built to be a self-contained identity provider, but if you have multiple physical sites, you may want a local copy of the directory at each site to ensure low latency and high availability.
-
-## Why and when to use this?
- **High Availability (HA)**: If your primary site goes completely offline, your other sites can still authenticate users locally without depending on a WAN link.
- **Low Latency**: Applications at a remote site can bind directly to their local LDAP server (`localhost` or LAN IP) instead of traversing the internet to query the primary site, making logins blazing fast.
- **Independent Failure Domains**: By replicating only the LDAP directory (the source of truth) and keeping session state (Redis) independent, you prevent complex "split-brain" scenarios in the web UI. A failure at Site A won't bring down Site B.
-
-By default, the `sso-manager` Docker container runs a single, independent OpenLDAP instance. However, you can enable **N-Way Multi-Master Replication** via environment variables.
-
-## How it works
-
-In an N-Way Multi-Master setup, every site runs a fully active OpenLDAP server (`slapd`).
- **Reads and Writes anywhere**: A user can change their password or update their profile at Site A, Site B, or Site C.
- **Conflict Resolution**: OpenLDAP's `syncrepl` engine uses Context Sequence Numbers (CSN) to track changes. If Site A goes offline and a user changes their password at Site B, Site A will automatically pull the newest changes the moment it rejoins the cluster.
- **Independent Redis**: Session data, API Tokens, and OAuth Clients are stored in Redis. By design, Redis is NOT replicated in this geographic setup. This ensures that a failure at Site A never causes Site B's Redis to become read-only, which would break the web UI at Site B. OAuth clients must be configured per-site.
-
-## Configuration
-
-To enable replication, you must pass two environment variables to the `sso-manager` container:
-
-1. `LDAP_SERVER_ID`: A unique integer for this node (e.g., `1`, `2`, `3`). This MUST be unique across the cluster.
-2. `LDAP_REPLICATION_HOSTS`: A space-separated list of the LDAP URLs of all **other** nodes in the cluster.
-
-### Example using `theta-env` / Docker Compose
-
-**Site 1 (`setup.env` or `docker-compose.yml`)**
-```env
-LDAP_SERVER_ID=1
-LDAP_REPLICATION_HOSTS="ldaps://sso.site2.com:636 ldaps://sso.site3.com:636"
-```
-
-**Site 2 (`setup.env` or `docker-compose.yml`)**
-```env
-LDAP_SERVER_ID=2
-LDAP_REPLICATION_HOSTS="ldaps://sso.site1.com:636 ldaps://sso.site3.com:636"
-```
-
-**Site 3 (`setup.env` or `docker-compose.yml`)**
-```env
-LDAP_SERVER_ID=3
-LDAP_REPLICATION_HOSTS="ldaps://sso.site1.com:636 ldaps://sso.site2.com:636"
-```
-
-Once configured, the container's entrypoint will automatically load the `syncprov` module, enable `mirrormode`, and generate the necessary `syncrepl` blocks in `/etc/openldap/slapd.conf`.
-
-## User Locations
-
-When creating or editing a user, you can specify their **Location (Site)**. This maps directly to the standard LDAP `l` (localityName) attribute, allowing you to track which physical site a user belongs to natively within the directory.
@@ -1,4 +0,0 @@
-User-agent: *
-Allow: /
-
-Sitemap: https://theta42.github.io/sso-manager-node/sitemap.xml
@@ -43,6 +43,9 @@ app.onListen.push(function(){
      // socket.broadcast.emit('P2PSub', msg);
    });
  });
+  
+  // Initialize Theta Agent WebSockets
+  require('./routes/api_agent')(app);
 }); 

 // Gzip text responses (HTML/JS/CSS/JSON). The admin UI loads ~13 separate,
@@ -107,19 +110,21 @@ app.use('/api/oauth', middleware.auth, oauthApiRouter);
 app.use('/api/oauth/client', middleware.auth, require('./routes/oauth_client'));
 app.get('/.well-known/openid-configuration', discovery);
 app.use('/api/webhook', require('./routes/webhook'));
-app.use('/api/plugins', middleware.auth, require('./routes/plugins'));
-const { createProxyMiddleware, fixRequestBody } = require('http-proxy-middleware');
+// Plugin instances — loadable/unloadable, configurable plugin copies with
+// per-instance secrets in OpenBao (secret/plugins/*). Admin-only (gated inside
+// the router to app_sso_admin / app_sso_directory_admin).
+app.use('/api/plugins', middleware.auth, require('./routes/api_plugins'));

-const vaultApiProxy = createProxyMiddleware({
-  target: 'http://openbao:8200',
-  changeOrigin: true,
-  pathRewrite: { '^/': '/v1/' },
-  on: {
-    proxyReq: fixRequestBody
-  }
-});
-
-app.use('/api/vault', middleware.auth, vaultApiProxy);
+// OpenBao vault API. The broker mints a server-side scoped token per user
+// (per-user user-<uid> or, for admins, sso-admin), enforces the path prefix
+// (scopeGuard), and injects ONLY that token into the proxied request — the
+// client's sso auth headers are stripped and never reach OpenBao. Non-admins
+// are confined to secret/users/<uid>/*; admins roam all of secret/. The
+// admin-only app-token mint route is mounted BEFORE the proxy so it isn't
+// shadowed by the catch-all /api/vault proxy.
+const vaultBroker = require('./utils/vault_broker');
+app.use('/api/vault/apps', middleware.auth, vaultBroker.mintAppRouter);
+app.use('/api/vault', middleware.auth, vaultBroker.scopeGuard, vaultBroker.vaultProxy());

 // Catch 404 and forward to error handler. If none of the above routes are
 // used, this is what will be called.
@@ -25,13 +25,31 @@ var server = http.createServer(app);
 var io = require('socket.io')(server);
 app.io = io;

+const WebSocket = require('ws');
+const wss = new WebSocket.Server({ noServer: true });
+server.on('upgrade', (request, socket, head) => {
+  // We only handle upgrade for /api/agent/ws.
+  // Socket.IO handles its own upgrades natively because it attaches directly to `server`.
+  if (request.url.startsWith('/api/agent/ws')) {
+    wss.handleUpgrade(request, socket, head, (ws) => {
+      wss.emit('connection', ws, request);
+    });
+  }
+});
+app.wss = wss;
+
 const models = require('../models');

 /**
 * Initialize ORM, then Listen on provided port, on all network interfaces.
 */
 models.initORM().then(() => {
-  return require('../utils/conf_manager').init();
+  // Overlay secret/sso-manager/conf from OpenBao over the file-loaded conf.
+  // Fail-soft: if OpenBao is unreachable, conf keeps the ./config/sso-secrets.js
+  // values and boot continues. (Same position the old conf_manager held, so
+  // call-time conf readers — which is how sso consumes its secrets — are
+  // unaffected; nothing in sso captures a secret at require time.)
+  return require('@simpleworkjs/bao-conf').init({ path: 'sso-manager', conf });
 }).then(() => {
  server.listen(port);
  server.on('error', onError);
@@ -57,14 +57,6 @@ module.exports = {
 		password: '__in secrets file__',
 		did:      '__in secrets file__',
 	},
-	smtp: {
-		host: 'localhost',
-		port: 587,
-		secure: false,
-		user: 'noreply@example.com',
-		pass: '__in secrets file__',
-		from: 'SSO Manager <noreply@example.com>',
-	},
 	directory: {
 		// Public SSH jump host fronting the lab, if there is one (the jump-host
 		// component). When set, a host card in the catalog shows the real
@@ -1,64 +1,132 @@
-# Plugins & Scheduler
+# Plugins

-The SSO Manager includes a flexible background task runner and discovery system. Plugins are defined statically in your deployment configuration (`sso-secrets.js`) and run based on their defined `cron` schedule. 
+The SSO Manager runs **plugins** as scheduled background tasks. A plugin
+**type** is an installed module; a plugin **instance** is a configured, loadable
+copy of a type. You can create, edit, load/unload, run, and delete instances
+from the **Plugins** page (or the `/api/plugins` API), and you can run several
+instances of the same type — e.g. two Proxmox endpoints, each with its own URL
+and token on its own schedule.

-## Writing Custom Plugins
+Per-instance **secrets** are stored in [OpenBao](https://openbao.org/) at
+`secret/plugins/<instance-id>/conf`, not in `sso-secrets.js`. The admin UI only
+ever shows them masked (`********`); the plugin reads them at run time. This
+needs theta-suite ≥ v1.30.1 (which grants the `sso-broker` OpenBao policy
+`secret/plugins/*`); re-run `./setup.sh` after upgrading.

-You can write custom plugins to discover resources, manage internal state, or run automated scripts. Plugins must be placed in the `plugins/discovery/` directory of the SSO Manager node codebase.
+## Plugin types

-A plugin file must export a `discover` method.
+A plugin type is a module under `nodejs/plugins/<category>/<type>.js`. The
+filename basename (without `.js`) is the `type`; the parent directory is the
+`category`. The built-ins ship under `plugins/discovery/`:

-**Example Plugin (`plugins/discovery/my_plugin.js`):**
+- `proxmox` — Proxmox VE (URL + API token)
+- `unifi` — UniFi Network controller (URL + username/password)
+- `nmap` — nmap OS + port scan (a target range; no credentials)
+
+A module exports a **manifest**:

 ```javascript
 module.exports = {
-  discover: async function(config) {
-    // The config object contains any keys passed in sso-secrets.js for this plugin.
-    
-    // Perform discovery logic, hit external APIs, etc.
-    const resources = [
-      {
-        slug: 'my-custom-resource-1',
-        name: 'My Resource 1',
-        kind: 'Host',
-        metadata: {
-          ip: '10.0.0.100',
-          source: 'My Custom Plugin'
-        }
-      }
-    ];
-    
-    // Return the discovered resources array. The discovery reconciler will 
-    // automatically save these to the Network Discovery database.
-    return resources;
-  }
+  // Identity — `type`/`category` default to the file/dir name but can be set
+  // explicitly. `name`/`description` show up in the UI.
+  type: 'proxmox',
+  category: 'discovery',
+  name: 'Proxmox VE',
+  description: 'Discover VMs, containers, and nodes from a PVE endpoint.',
+
+  // Drives the admin UI form, API validation, and secret masking. Fields with
+  // `secret: true` are stored in OpenBao; the rest live in the DB row.
+  configSchema: [
+    { key: 'url',         label: 'API URL',       type: 'url',      required: true },
+    { key: 'tokenId',     label: 'Token ID',      type: 'text',     required: true },
+    { key: 'tokenSecret', label: 'Token Secret',  type: 'password', required: true, secret: true }
+  ],
+
+  // "Test" button: validate the config (don't do the work). Return
+  // { ok: true } or { ok: false, error: '...' }. Optional.
+  validate: async (config) => { … },
+
+  // The work. `run` is the generalized contract name; the discovery plugins
+  // also keep `discover` as an alias for back-compat. For `category:
+  // 'discovery'`, the scheduler passes the result to the discovery reconciler.
+  run: async (config) => { return { resources, edges }; },
+  discover: async (config) => { return { resources, edges }; }
 };
 ```

-## Configuring Plugins
+`run(config)` receives the merged non-secret config + secret values as one flat
+object (e.g. `{ url, tokenId, tokenSecret }`). For a discovery plugin it
+returns `{ resources, edges }`; the reconciler upserts them into the resource
+graph attributed to the instance's **slug** (the `discovery_sources` name).

-In your `sso-secrets.js` file, add your plugin to the `discovery.plugins` object:
+### Writing a custom plugin type
+
+Drop a `.js` file under `nodejs/plugins/discovery/` (or a new category directory)
+following the manifest above. New types are picked up at boot, so restart the
+SSO Manager after adding one. Runtime load/unload is per-**instance** only —
+adding a new type still needs a restart.
+
+## The Plugins page
+
+Under **Plugins** (nav, admin-only — `app_sso_admin` / `app_sso_directory_admin`
+/ `app_super_admin`):
+
+- **New Plugin** — pick a type, name it, choose a unique slug (the discovery
+  source name + the URL the resource graph attributes results to), set a cron
+  schedule, and fill in the config form (secret fields are password inputs).
+  Creating it schedules it and kicks one immediate run.
+- **Edit** — name, cron, and non-secret config.
+- **Edit Secrets** (key icon) — password fields, prefilled masked. Leave a
+  field blank to keep its current value.
+- **Test** (vial icon) — runs the plugin's `validate`.
+- **Run now** (play icon) — enqueues one immediate run regardless of state.
+- **Load / Unload** — enable/disable the schedule without deleting the instance.
+- **Delete** — removes the schedule, the OpenBao secret namespace, and the row.
+
+## API
+
+All endpoints are mounted at `/api/plugins`, require an authenticated admin
+(`app_sso_admin` / `app_sso_directory_admin` / `app_super_admin`), and return
+secret values masked.
+
+| Method + path | Purpose |
+|---|---|
+| `GET /api/plugins/types` | list installed plugin types + their `configSchema` |
+| `GET /api/plugins` | list instances (with masked secrets + last-run state) |
+| `GET /api/plugins/:id` | one instance |
+| `POST /api/plugins` | create — body `{ pluginType, name, slug, cron, config }` where `config` is a flat object of all field values; secret fields are split into OpenBao |
+| `PUT /api/plugins/:id` | update name/cron/enabled + non-secret config |
+| `PUT /api/plugins/:id/secrets` | update secret fields (blank = keep) |
+| `POST /api/plugins/:id/test` | run `validate` → `{ ok }` or `{ ok:false, error }` |
+| `POST /api/plugins/:id/load` | enable + schedule + run now |
+| `POST /api/plugins/:id/unload` | unschedule + disable |
+| `POST /api/plugins/:id/run` | enqueue one immediate run |
+| `DELETE /api/plugins/:id` | unschedule + remove OpenBao secrets + delete row |
+| `GET /api/plugins/:id/runs` | `{ lastRunAt, lastStatus, lastError }` |
+
+## Scheduler internals
+
+The scheduler ([BullMQ](https://docs.bullmq.io/) over Redis) gives each instance
+a stable JobScheduler id (`plugin:<instanceId>`); load/unload upsert/remove
+that one schedule without disturbing the others. A daily `garbage_collect` job
+prunes discovery resources not seen in > 7 days.
+
+### Legacy migration
+
+Before this system, plugins were configured statically in `sso-secrets.js`:

 ```javascript
 module.exports = {
-  // ...
  discovery: {
    plugins: {
-      my_plugin: {
-        enabled: true,
-        cron: "0 * * * *", // Run every hour
-        my_custom_key: "my_custom_value" // Passed to the config argument in discover()
-      }
+      proxmox: { enabled: true, cron: '0 * * * *', url: '…', tokenId: '…', tokenSecret: '…' }
    }
  }
-  // ...
 };
 ```

-### Overriding Timing and Enable/Disable
-
-From the **Plugins & Scheduler** tab in the Directory Dashboard, you can override the schedule and enable/disable state for each plugin. These overrides take precedence over `sso-secrets.js` and are stored internally.
-
-## Scheduler Internals
-
-The scheduler uses BullMQ backed by Redis to manage execution. It automatically performs garbage collection on stale network resources (resources not updated in > 7 days) and triggers your plugins at the defined intervals.
+On the first boot of SSO Manager ≥ v1.17.0, if the `PluginInstance` table is
+empty **and** `conf.discovery.plugins` has entries, one instance per configured
+type is seeded automatically (secret fields copied into OpenBao). After that the
+table is non-empty and the static config is ignored — manage plugins from the
+UI/API instead. The migration is idempotent (guarded by the empty-table check).
@@ -16,6 +16,7 @@ const { init } = require('@simpleworkjs/orm');
 const { Resource, ResourceEdge, ResourceGroup } = require('./resource');
 const { AccessRequest } = require('./access_request');
 const { Webhook } = require('./webhook');
+const { PluginInstance } = require('./plugin_instance');
 async function initORM() {
  const ormConf = conf.orm || {
    dialect: 'sqlite',
@@ -29,7 +30,7 @@ async function initORM() {
    await init({
      conf: { orm: ormConf },
      models: [
-        Resource, ResourceEdge, ResourceGroup, AccessRequest, Webhook,
+        Resource, ResourceEdge, ResourceGroup, AccessRequest, Webhook, PluginInstance,
        Token, AuthToken, InviteToken, ImpersonationToken, PasswordResetToken, OtpToken, ServiceToken
      ]
    });
@@ -0,0 +1,83 @@
+'use strict';
+
+// PluginInstance — the registry of configured, loadable plugin copies.
+//
+// The SSO plugin system (see nodejs/services/plugin_registry.js) distinguishes
+// **plugin types** (the .js modules under nodejs/plugins/<category>/<type>.js)
+// from **plugin instances** — a configured, loadable/unloadable *copy* of a
+// type. You can have several instances of the same type (e.g. two Proxmox
+// endpoints with their own URLs + tokens), each on its own schedule.
+//
+// This table holds the *non-secret* per-instance state: which type it is, its
+// schedule (cron), whether it's loaded (enabled), and its non-secret config.
+// Per-instance **secrets** (the configSchema fields flagged `secret:true`,
+// e.g. a Proxmox `tokenSecret` or UniFi `password`) live in OpenBao at
+// `secret/plugins/<id>/conf` (see nodejs/utils/plugin_secrets.js) — never in
+// the DB. The DB row's `config` JSON column holds only non-secret field values.
+//
+// `slug` is the discovery source name passed to DiscoveryReconciler.reconcile,
+// so a discovery instance's resources are attributed to a stable, human-chosen
+// name rather than its uuid. Unique, so two instances can't shadow each other
+// in the resource graph's `discovery_sources`.
+//
+// Like Resource/AccessRequest, there is no ORM auto-timestamp hook: the route
+// handler stamps created_by/on + updated_by/on explicitly on every write (see
+// routes/api_plugins.js). `id` (uuid) is generated by the ORM on create.
+
+const { Model } = require('@simpleworkjs/orm');
+
+const STATUS = {
+  OK: 'ok',
+  ERROR: 'error',
+  RUNNING: 'running',
+};
+
+class PluginInstance extends Model {
+  static fields = {
+    id: { type: 'uuid', primaryKey: true },
+    // A registered plugin type slug (matches a manifest `type`). Validated
+    // against the registry before a row is created.
+    pluginType: { type: 'string', isRequired: true, min: 1, max: 64 },
+    // The plugin's category (e.g. 'discovery'). Copied from the manifest at
+    // create time so the scheduler can dispatch without re-reading the registry
+    // on every run (and so a later type removal still shows what the instance was).
+    category: { type: 'string', isRequired: true, default: 'discovery', min: 1, max: 64 },
+    // Human label for the instance.
+    name: { type: 'string', isRequired: true, min: 1, max: 120 },
+    // Stable handle: discovery source name + unique constraint. Lowercase
+    // alnum + hyphen/underscore to stay safe as a resource-graph slug.
+    slug: { type: 'string', isRequired: true, unique: true, min: 1, max: 64 },
+    // Loaded into the scheduler? `false` = unloaded (no scheduled runs).
+    enabled: { type: 'boolean', default: true },
+    // Cron schedule (5-field). The scheduler turns this into a BullMQ
+    // repeatable JobScheduler.
+    cron: { type: 'string', isRequired: true, default: '0 * * * *' },
+    // Non-secret configSchema field values. Secret fields are NOT here.
+    config: { type: 'json', default: {} },
+    // Last-run bookkeeping, updated by the scheduler worker.
+    lastRunAt: { type: 'integer' },
+    lastStatus: { type: 'string' },
+    lastError: { type: 'text' },
+    lastLog: { type: 'text' },
+    // Audit stamps (set by the route handler, not by an ORM hook).
+    created_by: { type: 'string' },
+    created_on: { type: 'integer' },
+    updated_by: { type: 'string' },
+    updated_on: { type: 'integer' },
+  };
+
+  // All instances the scheduler should run: enabled only. Loaded fresh each
+  // boot / load; not cached on the model (the scheduler is the source of truth
+  // for what's actually scheduled).
+  static async listEnabled() {
+    return this.list({ where: { enabled: true } });
+  }
+
+  // Look up by slug — used by tests + the reconciler when only a slug is known.
+  static async getBySlug(slug) {
+    const rows = await this.list({ where: { slug } });
+    return rows[0] || null;
+  }
+}
+
+module.exports = { PluginInstance, STATUS };
@@ -96,11 +96,13 @@ class Resource extends Model {
      return false;
    }
    
+    let maxUpdated = 0;
    resObjs.forEach(r => {
      r.metadata.isProduction = checkProd(r.id);
+      if (r.updated_on && r.updated_on > maxUpdated) maxUpdated = r.updated_on;
    });

-    return { resources: resObjs, edges };
+    return { resources: resObjs, edges, updated_on: maxUpdated || Date.now() };
  }

  // Stamp `resolvedAddress` on each resource: its own address/ip if it has one,
@@ -10,6 +10,21 @@ function toE164Digits(number) {
 }

 async function send(to, message) {
+	const { PluginInstance } = require('./plugin_instance');
+	const registry = require('../services/plugin_registry');
+	const pluginSecrets = require('../utils/plugin_secrets');
+
+	const instances = await PluginInstance.find({ category: 'messaging', enabled: true });
+	if (instances.length > 0) {
+		const inst = instances[0];
+		const manifest = registry.getManifest(inst.pluginType);
+		if (manifest && manifest.sendMessage) {
+			const secrets = await pluginSecrets.read(inst.id).catch(() => ({}));
+			const config = { ...inst.config, ...secrets };
+			return manifest.sendMessage(config, { to, message });
+		}
+	}
+
 	const params = new URLSearchParams({
 		api_username: conf.username,
 		api_password: conf.password,
@@ -773,7 +773,7 @@ User.setActive = async function(active) {
 				]);
 			} else {
 				await client.modify(this.dn, [
-					new Change({ operation: 'replace', modification: new Attribute({ type: 'pwdAccountLockedTime', values: ['000001010000Z'] }) }),
+					new Change({ operation: 'replace', modification: new Attribute({ type: 'pwdAccountLockedTime', values: ['00000101000000Z'] }) }),
 				]);
 			}
 		});
@@ -788,7 +788,7 @@ User.setActive = async function(active) {
 			throw e;
 		}
 	}
-	this.pwdAccountLockedTime = active ? undefined : '000001010000Z';
+	this.pwdAccountLockedTime = active ? undefined : '00000101000000Z';
 	this.isActive   = active ? 'active' : '';
 	this.isInactive = active ? '' : 'inactive';
 	cache.clear();
@@ -907,6 +907,13 @@ User.login = async function(data){
 		}
 		let user = await this.get(data.uid || data.username);

+		if (user.pwdAccountLockedTime) {
+			let error = new Error('Invalid Credentials, login failed.');
+			error.name = 'LDAPLoginFailed';
+			error.status = 401;
+			throw error;
+		}
+
 		const loginClient = makeClient();
 		try {
 			await loginClient.bind(user.dn, data.password);
@@ -1,17 +1,18 @@
 {
  "name": "t42-sso-manager",
-  "version": "1.13.0",
+  "version": "1.19.6",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "t42-sso-manager",
-      "version": "1.13.0",
+      "version": "1.19.6",
      "license": "MIT",
      "dependencies": {
        "@fortawesome/fontawesome-free": "^7.3.0",
        "@popperjs/core": "^2.11.8",
        "@simpleworkjs/app-stack": "^1.0.0",
+        "@simpleworkjs/bao-conf": "^1.0.0",
        "@simpleworkjs/conf": "^1.2.0",
        "@simpleworkjs/directory-schema": "^1.1.0",
        "@simpleworkjs/frontend": "^0.2.7",
@@ -41,6 +42,7 @@
        "nodemailer": "^9.0.0",
        "p2psub": "^0.2.0",
        "socket.io": "^4.8.3",
+        "ws": "^8.21.1",
        "xss": "^1.0.15"
      },
      "devDependencies": {
@@ -1347,6 +1349,18 @@
        "node": ">=18.0.0"
      }
    },
+    "node_modules/@simpleworkjs/bao-conf": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@simpleworkjs/bao-conf/-/bao-conf-1.0.1.tgz",
+      "integrity": "sha512-mcay5NQ/w9ShpIAolMP/3f9TfXSLE+d5jrA4dTPOUHDjTkdsP7pe4hMmQUmwnniR59U1bGoRIVdXjvDbX3I5nw==",
+      "license": "MIT",
+      "dependencies": {
+        "extend": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
    "node_modules/@simpleworkjs/conf": {
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/@simpleworkjs/conf/-/conf-1.2.0.tgz",
@@ -1,6 +1,6 @@
 {
  "name": "t42-sso-manager",
-  "version": "1.13.0",
+  "version": "1.19.6",
  "description": "A very simple LDAP management and SSO system",
  "author": [
    {
@@ -24,6 +24,7 @@
    "@fortawesome/fontawesome-free": "^7.3.0",
    "@popperjs/core": "^2.11.8",
    "@simpleworkjs/app-stack": "^1.0.0",
+    "@simpleworkjs/bao-conf": "^1.0.0",
    "@simpleworkjs/conf": "^1.2.0",
    "@simpleworkjs/directory-schema": "^1.1.0",
    "@simpleworkjs/frontend": "^0.2.7",
@@ -53,6 +54,7 @@
    "nodemailer": "^9.0.0",
    "p2psub": "^0.2.0",
    "socket.io": "^4.8.3",
+    "ws": "^8.21.1",
    "xss": "^1.0.15"
  },
  "license": "MIT",
@@ -0,0 +1,81 @@
+const http = require('http');
+
+module.exports = {
+  type: 'docker',
+  category: 'discovery',
+  name: 'Docker Daemon',
+  description: 'Discover running containers and networks from a local or remote Docker daemon.',
+  configSchema: [
+    { key: 'socketPath', label: 'Docker Socket Path', type: 'text', required: false, placeholder: '/var/run/docker.sock' },
+    { key: 'tcpHost', label: 'TCP Host (e.g., http://10.0.0.1:2375)', type: 'url', required: false, placeholder: '' }
+  ],
+
+  validate: async (config) => {
+    if (!config.socketPath && !config.tcpHost) {
+      return { ok: false, error: 'Must provide either socketPath or tcpHost' };
+    }
+    return { ok: true };
+  },
+
+  discover: async (config) => {
+    const isTcp = !!config.tcpHost;
+    
+    const requestOptions = {
+      path: '/containers/json',
+      method: 'GET'
+    };
+
+    if (isTcp) {
+      const url = new URL(config.tcpHost);
+      requestOptions.host = url.hostname;
+      requestOptions.port = url.port || (url.protocol === 'https:' ? 443 : 80);
+      requestOptions.protocol = url.protocol;
+    } else {
+      requestOptions.socketPath = config.socketPath || '/var/run/docker.sock';
+    }
+
+    return new Promise((resolve, reject) => {
+      const req = http.request(requestOptions, (res) => {
+        let body = '';
+        res.on('data', chunk => body += chunk);
+        res.on('end', () => {
+          if (res.statusCode !== 200) {
+            return reject(new Error(`Docker API error: ${res.statusCode} ${body}`));
+          }
+          
+          try {
+            const containers = JSON.parse(body);
+            const resources = [];
+            const edges = [];
+
+            for (const c of containers) {
+              const name = c.Names && c.Names.length > 0 ? c.Names[0].replace(/^\//, '') : c.Id.substring(0, 12);
+              const slug = `docker-cnt-${c.Id.substring(0, 12)}`;
+              
+              const ports = (c.Ports || []).map(p => p.PublicPort ? `${p.PublicPort}:${p.PrivatePort}` : `${p.PrivatePort}`).join(', ');
+              
+              resources.push({
+                kind: 'container',
+                name: name,
+                slug: slug,
+                metadata: {
+                  image: c.Image,
+                  state: c.State,
+                  status: c.Status,
+                  ports: ports
+                }
+              });
+            }
+
+            resolve({ resources, edges });
+          } catch (e) {
+            reject(new Error(`Failed to parse Docker response: ${e.message}`));
+          }
+        });
+      });
+
+      req.on('error', (e) => reject(new Error(`Docker connection error: ${e.message}`)));
+      req.end();
+    });
+  }
+};
@@ -2,21 +2,54 @@ const nmap = require('node-nmap');
 nmap.nmapLocation = "nmap"; // default

 module.exports = {
+  // Plugin manifest — see nodejs/services/plugin_registry.js. `targetRange` is
+  // not secret (it's a network range to scan), so it lives in the DB row, not
+  // OpenBao. nmap itself has no credentials to test, so `validate` only checks
+  // the range parses — running a real scan is what `run` does.
+  type: 'nmap',
+  category: 'discovery',
+  name: 'Nmap Network Scan',
+  description: 'Discover hosts and services on a network range using nmap OS + port scans.',
+  configSchema: [
+    { key: 'targetRange', label: 'Target Range', type: 'text', required: true, placeholder: '192.168.1.0/24' }
+  ],
+
+  validate: async (config) => {
+    const { targetRange } = config;
+    if (!targetRange) return { ok: false, error: 'Missing targetRange' };
+    // nmap accepts CIDR (a.b.c.d/24), ranges (a.b.c.d-50), and host lists. We
+    // only sanity-check shape here — reject anything with shell metacharacters
+    // or whitespace, since node-nmap passes this straight to the nmap binary.
+    if (/\s|[;|&$`<>]/.test(targetRange)) {
+      return { ok: false, error: 'targetRange must not contain whitespace or shell metacharacters' };
+    }
+    return { ok: true };
+  },
+
  discover: async (config) => {
    const { targetRange } = config;
    if (!targetRange) throw new Error("Missing targetRange for Nmap");

    return new Promise((resolve, reject) => {
-      const scan = new nmap.OsAndPortScan(targetRange);
+      // OsAndPortScan requires root (for -O). NmapScan does a basic port scan (TCP connect if non-root).
+      const scan = new nmap.NmapScan(targetRange);
+      scan.command.push('-Pn');
+      scan.command.push('-F'); // fast scan, 100 top ports
+      scan.command.push('--min-rate', '100'); // speed up the scan
+      
+      if (config.log) config.log(`Starting nmap scan: ${scan.command.join(' ')}`);
+
      scan.on('complete', function(data) {
+        if (config.log) config.log(`Scan complete. Found ${data ? data.length : 0} hosts.`);
        const resources = [];
        const edges = [];

        for (const host of data) {
-          if (!host.mac || !host.ip) continue;
-          const hostSlug = `nmap-host-${host.mac.replace(/:/g, '')}`;
+          if (!host.ip) continue;
+          const hostId = host.mac ? host.mac.replace(/:/g, '') : host.ip.replace(/\\./g, '_');
+          const hostSlug = `nmap-host-${hostId}`;
          
-          const interfaces = [{ mac: host.mac, ip: host.ip }];
+          const interfaces = [{ mac: host.mac || null, ip: host.ip }];
          
          resources.push({
            kind: 'host',
@@ -27,7 +60,7 @@ module.exports = {

          if (host.openPorts && host.openPorts.length > 0) {
            for (const port of host.openPorts) {
-              const svcSlug = `nmap-svc-${host.mac.replace(/:/g, '')}-${port.port}`;
+              const svcSlug = `nmap-svc-${hostId}-${port.port}`;
              resources.push({
                kind: 'service',
                name: `${port.service} on ${port.port}`,
@@ -42,10 +75,24 @@ module.exports = {
      });

      scan.on('error', function(error) {
-        reject(error);
+        // node-nmap's spawn-missing-binary message ("NMAP not found at command
+        // location: nmap") is opaque to an admin reading lastError. Translate
+        // it into something actionable. (The Dockerfile installs nmap in the
+        // app image; this only fires if someone runs outside the container or
+        // strips the package.)
+        var msg = (error && error.message) || String(error);
+        if (/nmap.*not found|command location/i.test(msg)) {
+          reject(new Error('nmap binary not installed in the container image (rebuild with Dockerfile.openldap, which apk-adds nmap)'));
+        } else {
+          reject(error);
+        }
      });

      scan.startScan();
    });
-  }
+  },
+
+  // Generalized plugin contract alias for `discover`. See proxmox.js for why
+  // this references module.exports rather than `this`.
+  run: async (config) => module.exports.discover(config)
 };
@@ -7,8 +7,35 @@ const agent = new https.Agent({
 });

 module.exports = {
-  discover: async (config) => {
+  // Plugin manifest — see nodejs/services/plugin_registry.js. `configSchema`
+  // drives the admin UI form and validation; fields flagged `secret:true` are
+  // stored in OpenBao (secret/plugins/<instance-id>/conf), never in the DB.
+  type: 'proxmox',
+  category: 'discovery',
+  name: 'Proxmox VE',
+  description: 'Discover VMs, containers, and hypervisor nodes from a Proxmox VE API endpoint.',
+  configSchema: [
+    { key: 'url',         label: 'API URL',      type: 'url',      required: true, placeholder: 'https://pve.example:8006' },
+    { key: 'tokenId',     label: 'Token ID',     type: 'text',     required: true, placeholder: 'user@pam!token' },
+    { key: 'tokenSecret', label: 'Token Secret', type: 'password', required: true, secret: true }
+  ],
+
+  // "Test" button in the UI: hit the unauthenticated version endpoint with the
+  // API token to confirm the URL + token are valid before scheduling runs.
+  validate: async (config) => {
    const { url, tokenId, tokenSecret } = config;
+    if (!url || !tokenId || !tokenSecret) return { ok: false, error: 'Missing url, tokenId, or tokenSecret' };
+    try {
+      const res = await fetch(`${url}/api2/json/version`, { headers: { 'Authorization': `PVEAPIToken=${tokenId}=${tokenSecret}` }, agent });
+      if (!res.ok) return { ok: false, error: `Proxmox API rejected the token (${res.status})` };
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  },
+
+  discover: async (config) => {
+    let { url, tokenId, tokenSecret } = config;
    if (!url || !tokenId || !tokenSecret) {
      throw new Error("Missing Proxmox config");
    }
@@ -16,13 +43,19 @@ module.exports = {
    const headers = {
      'Authorization': `PVEAPIToken=${tokenId}=${tokenSecret}`
    };
+    
+    // Ensure URL has no trailing slash
+    url = url.endsWith('/') ? url.slice(0, -1) : url;

    const resources = [];
    const edges = [];

    // 1. Get Nodes
    const resNodes = await fetch(`${url}/api2/json/nodes`, { headers, agent });
-    if(!resNodes.ok) throw new Error("Proxmox API error on nodes");
+    if(!resNodes.ok) {
+        const errText = await resNodes.text();
+        throw new Error(`Proxmox API error on nodes: ${resNodes.status} ${errText}`);
+    }
    const nodes = (await resNodes.json()).data;

    for (const node of nodes) {
@@ -151,5 +184,11 @@ module.exports = {
    }

    return { resources, edges };
-  }
+  },
+
+  // The generalized plugin contract calls `run`; the discovery plugins keep
+  // `discover` as their implementation name for back-compat, and `run` is just
+  // an alias. Referenced via module.exports (not `this`) so it survives being
+  // detached and called as a bare function reference.
+  run: async (config) => module.exports.discover(config)
 };
@@ -6,6 +6,41 @@ const agent = new https.Agent({
 });

 module.exports = {
+  // Plugin manifest — see nodejs/services/plugin_registry.js. `password` is
+  // secret and stored in OpenBao (secret/plugins/<instance-id>/conf).
+  type: 'unifi',
+  category: 'discovery',
+  name: 'UniFi Network',
+  description: 'Discover UniFi network devices and clients from a UniFi Controller / UDM endpoint.',
+  configSchema: [
+    { key: 'url',      label: 'Controller URL', type: 'url',      required: true, placeholder: 'https://unifi.example:8443' },
+    { key: 'user',     label: 'Username',       type: 'text',     required: true },
+    { key: 'password', label: 'Password',       type: 'password', required: true, secret: true }
+  ],
+
+  // "Test": attempt the UDM login (falls back to the legacy controller login);
+  // succeeds only if one of the two login endpoints returns 200.
+  validate: async (config) => {
+    const { url, user, password } = config;
+    if (!url || !user || !password) return { ok: false, error: 'Missing url, user, or password' };
+    try {
+      let loginRes = await fetch(`${url}/api/auth/login`, {
+        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username: user, password }), agent
+      });
+      if (!loginRes.ok) {
+        loginRes = await fetch(`${url}/api/login`, {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ username: user, password }), agent
+        });
+      }
+      if (!loginRes.ok) return { ok: false, error: `UniFi auth failed (${loginRes.status})` };
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  },
+
  discover: async (config) => {
    const { url, user, password } = config;
    if (!url || !user || !password) {
@@ -91,5 +126,9 @@ module.exports = {
    }

    return { resources, edges };
-  }
+  },
+
+  // Generalized plugin contract alias for `discover`. See proxmox.js for why
+  // this references module.exports rather than `this`.
+  run: async (config) => module.exports.discover(config)
 };
@@ -0,0 +1,61 @@
+const https = require('https');
+
+module.exports = {
+  type: 'twilio',
+  category: 'messaging',
+  name: 'Twilio SMS',
+  description: 'Send SMS messages (like 2FA codes) via Twilio.',
+  
+  configSchema: [
+    { key: 'accountSid', label: 'Account SID', type: 'text', required: true },
+    { key: 'authToken', label: 'Auth Token', type: 'password', required: true, secret: true },
+    { key: 'fromNumber', label: 'From Phone Number', type: 'text', required: true, placeholder: '+15551234567' }
+  ],
+
+  validate: async (config) => {
+    if (!config.accountSid || !config.authToken) return { ok: false, error: 'Missing credentials' };
+    if (!config.fromNumber) return { ok: false, error: 'Missing fromNumber' };
+    return { ok: true };
+  },
+
+  sendMessage: async (config, payload) => {
+    const { to, message } = payload;
+    if (!to || !message) throw new Error("Missing 'to' or 'message' in payload");
+
+    const data = new URLSearchParams();
+    data.append('To', to);
+    data.append('From', config.fromNumber);
+    data.append('Body', message);
+
+    const postData = data.toString();
+
+    const options = {
+      hostname: 'api.twilio.com',
+      port: 443,
+      path: `/2010-04-01/Accounts/${config.accountSid}/Messages.json`,
+      method: 'POST',
+      headers: {
+        'Authorization': 'Basic ' + Buffer.from(config.accountSid + ':' + config.authToken).toString('base64'),
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Content-Length': Buffer.byteLength(postData)
+      }
+    };
+
+    return new Promise((resolve, reject) => {
+      const req = https.request(options, (res) => {
+        let body = '';
+        res.on('data', chunk => body += chunk);
+        res.on('end', () => {
+          if (res.statusCode >= 200 && res.statusCode < 300) {
+            resolve(JSON.parse(body));
+          } else {
+            reject(new Error(`Twilio API Error: ${res.statusCode} ${body}`));
+          }
+        });
+      });
+      req.on('error', reject);
+      req.write(postData);
+      req.end();
+    });
+  }
+};
@@ -0,0 +1,79 @@
+const https = require('https');
+const http = require('http');
+
+module.exports = {
+  type: 'webhook',
+  category: 'messaging',
+  name: 'Universal REST Webhook',
+  description: 'Send a generic HTTP POST request with a custom JSON payload. Variables {{to}} and {{message}} will be replaced.',
+  
+  configSchema: [
+    { key: 'url', label: 'Webhook URL', type: 'url', required: true, placeholder: 'https://api.example.com/send' },
+    { key: 'method', label: 'HTTP Method', type: 'text', required: true, placeholder: 'POST' },
+    { key: 'headers', label: 'Custom Headers (JSON)', type: 'text', required: false, placeholder: '{"Authorization": "Bearer ...", "Content-Type": "application/json"}' },
+    { key: 'payloadTemplate', label: 'Payload Template', type: 'text', required: true, placeholder: '{"recipient": "{{to}}", "text": "{{message}}"}' },
+    { key: 'apiSecret', label: 'API Secret / Auth Token', type: 'password', required: false, secret: true }
+  ],
+
+  validate: async (config) => {
+    if (!config.url) return { ok: false, error: 'URL is required' };
+    if (!config.payloadTemplate) return { ok: false, error: 'Payload template is required' };
+    try {
+      if (config.headers) JSON.parse(config.headers);
+    } catch (e) {
+      return { ok: false, error: 'Headers must be valid JSON' };
+    }
+    return { ok: true };
+  },
+
+  sendMessage: async (config, payload) => {
+    const { to, message } = payload;
+    let payloadStr = config.payloadTemplate || '{}';
+    
+    // Replace template variables safely
+    payloadStr = payloadStr.replace(/\{\{to\}\}/g, to).replace(/\{\{message\}\}/g, message);
+
+    // If there is an API secret, replace {{secret}} in the headers or url
+    let headersObj = {};
+    if (config.headers) {
+      try {
+        const parsed = JSON.parse(config.headers);
+        for (const [k, v] of Object.entries(parsed)) {
+          headersObj[k] = config.apiSecret ? String(v).replace(/\{\{secret\}\}/g, config.apiSecret) : v;
+        }
+      } catch(e) {}
+    }
+
+    if (!headersObj['Content-Type']) {
+      headersObj['Content-Type'] = 'application/json';
+    }
+
+    const urlObj = new URL(config.url);
+    const options = {
+      hostname: urlObj.hostname,
+      port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
+      path: urlObj.pathname + urlObj.search,
+      method: config.method || 'POST',
+      headers: headersObj
+    };
+
+    const client = urlObj.protocol === 'https:' ? https : http;
+
+    return new Promise((resolve, reject) => {
+      const req = client.request(options, (res) => {
+        let body = '';
+        res.on('data', chunk => body += chunk);
+        res.on('end', () => {
+          if (res.statusCode >= 200 && res.statusCode < 300) {
+            resolve({ status: res.statusCode, body });
+          } else {
+            reject(new Error(`Webhook failed: ${res.statusCode} ${body}`));
+          }
+        });
+      });
+      req.on('error', reject);
+      req.write(payloadStr);
+      req.end();
+    });
+  }
+};
@@ -615,9 +615,10 @@ app.util = (function(app){
 // Reveal every .group-required-<cn> element the current user's groups entitle
 // them to. Elements carrying .group-required start hidden (styles.css), so a
 // user who is in no groups — or who isn't logged in — simply never sees them.
+// The synthetic 'login' group is special: it's true for any authenticated user.
 app.auth.applyGroupVisibility = function(user){
 	var groups = app.auth.groupCNs(user);
-	if(!groups.length) return;
+	var isLoggedIn = !!user;

 	var style = document.getElementById('group-required-rules');
 	if(!style){
@@ -636,6 +637,19 @@ app.auth.applyGroupVisibility = function(user){
 			// A group whose CN isn't a usable CSS identifier just gates nothing.
 		}
 	}
+
+	// The 'login' group is synthetic — it means "any authenticated user".
+	// Reveal .group-required-login for any logged-in user.
+	if(isLoggedIn){
+		try{
+			style.sheet.insertRule(
+				`.group-required-login { display: revert !important; }`,
+				style.sheet.cssRules.length
+			);
+		}catch(error){
+			// Ignore CSS escape errors.
+		}
+	}
 };

 $( document ).ready(async function(){
@@ -0,0 +1,53 @@
+'use strict';
+
+module.exports = function initAgentWebSockets(app) {
+    if (!app.wss) {
+        console.warn("WebSocket server for agents is not initialized.");
+        return;
+    }
+
+    app.wss.on('connection', (ws, req) => {
+        // Parse the token from query param or header (e.g. ?token=XYZ)
+        // For the beta, we will just accept it if a token is present.
+        const url = new URL(req.url, `http://${req.headers.host}`);
+        const token = url.searchParams.get('token') || req.headers['authorization'];
+
+        if (!token) {
+            ws.close(4001, 'Unauthorized: Missing token');
+            return;
+        }
+
+        console.log(`[Theta Agent] Agent connected from ${req.socket.remoteAddress}`);
+
+        ws.on('message', (message) => {
+            try {
+                const data = JSON.parse(message);
+                
+                // Example handling incoming telemetry
+                if (data.type === 'telemetry') {
+                    // Send to discovery service or log
+                    // console.log(`[Theta Agent] Received telemetry from ${data.host}`);
+                    
+                    // We can publish it to the event bus for the UI
+                    if(app.contoller && app.contoller.ps) {
+                        app.contoller.ps.publish('agent.telemetry', data);
+                    }
+                }
+            } catch (err) {
+                console.error("[Theta Agent] Error parsing message:", err);
+            }
+        });
+
+        ws.on('close', () => {
+            console.log(`[Theta Agent] Agent disconnected`);
+        });
+
+        // Example: Send a welcome config payload to the agent
+        ws.send(JSON.stringify({
+            type: 'config',
+            payload: {
+                message: 'Welcome to SSO Manager C2'
+            }
+        }));
+    });
+};
@@ -1,5 +1,5 @@
 const router = require('express').Router();
-const confManager = require('../utils/conf_manager');
+const baoConf = require('@simpleworkjs/bao-conf');
 const permission = require('../utils/permission');
 const conf = require('@simpleworkjs/conf');

@@ -12,31 +12,183 @@ router.use(async (req, res, next) => {
  }
 });

+// Secret fields stored inside secret/sso-manager/conf. These are NEVER returned
+// in cleartext by GET /api/conf (masked to MASK below) and, on save, a blank or
+// mask-valued submission preserves the stored value so an admin editing an
+// unrelated field (e.g. the From address) doesn't have to re-enter — or leak —
+// the SMTP password / OAuth JWT secret. Mirrors the plugin-secrets discipline.
+const MASK = '********';
+const SECRET_PATHS = [
+	['smtp', 'pass'],
+	['oauth', 'jwtSecret'],
+	['voipms', 'password'],
+];
+
+function maskSecrets(obj) {
+	const out = JSON.parse(JSON.stringify(obj));
+	for (const [grp, key] of SECRET_PATHS) {
+		if (out[grp] && out[grp][key]) out[grp][key] = MASK;
+	}
+	return out;
+}
+
 router.get('/', async (req, res) => {
-  const editable = {
+  const editable = maskSecrets({
    smtp: conf.smtp || {},
    discovery: conf.discovery || {},
-    oauth: conf.oauth || {}
-  };
+    oauth: conf.oauth || {},
+    voipms: conf.voipms || {}
+  });
  res.json(editable);
 });

+// Shallow-per-key merge of `src` into the live conf object (matches the old
+// conf_manager.applyConf behaviour: nested objects are spread, not deep-merged,
+// so call-time conf readers see saved values without a restart).
+function applyToLiveConf(src) {
+  if (!src) return;
+  for (const key of Object.keys(src)) {
+    if (typeof src[key] === 'object' && src[key] !== null && !Array.isArray(src[key])) {
+      conf[key] = { ...(conf[key] || {}), ...src[key] };
+    } else {
+      conf[key] = src[key];
+    }
+  }
+}
+
 router.post('/', async (req, res, next) => {
  try {
-    const existing = await confManager.getVaultConf() || {};
-    // Deep merge req.body into existing
-    for (const key of Object.keys(req.body)) {
-      if (typeof req.body[key] === 'object' && req.body[key] !== null && !Array.isArray(req.body[key])) {
-        existing[key] = { ...(existing[key] || {}), ...req.body[key] };
-      } else {
-        existing[key] = req.body[key];
+    const existing = await baoConf.get('sso-manager/conf') || {};
+    const incoming = req.body || {};
+
+    // Preserve secret fields the admin left blank (or left showing the mask):
+    // drop them from the incoming merge so the stored value survives. Only a
+    // genuinely new, non-blank, non-mask value overwrites.
+    for (const [grp, key] of SECRET_PATHS) {
+      if (incoming[grp] && incoming[grp][key] !== undefined) {
+        const submitted = incoming[grp][key];
+        if (submitted === '' || submitted === MASK) delete incoming[grp][key];
      }
    }
-    await confManager.setVaultConf(existing);
+
+    // Deep merge incoming into existing
+    for (const key of Object.keys(incoming)) {
+      if (typeof incoming[key] === 'object' && incoming[key] !== null && !Array.isArray(incoming[key])) {
+        existing[key] = { ...(existing[key] || {}), ...incoming[key] };
+      } else {
+        existing[key] = incoming[key];
+      }
+    }
+    await baoConf.set('sso-manager/conf', existing);
+    // Reflect the saved values in the live conf immediately (the next boot's
+    // bao-conf.init() would pick them up too, but this keeps running readers
+    // current without a restart, as the old conf_manager did). `existing`
+    // carries the preserved secret values, so live conf keeps them too.
+    applyToLiveConf(existing);
+    res.json({ success: true });
+  } catch(err) {
+    next(err);
+  }
+});
+router.get('/proxy', async (req, res, next) => {
+  try {
+    const proxyConf = await baoConf.get('proxy/conf') || {};
+    const editable = JSON.parse(JSON.stringify(proxyConf));
+    if (editable.oidc && editable.oidc.clientSecret) editable.oidc.clientSecret = MASK;
+    if (editable.ldap && editable.ldap.bindPassword) editable.ldap.bindPassword = MASK;
+    res.json(editable);
+  } catch(err) {
+    next(err);
+  }
+});
+
+router.post('/proxy', async (req, res, next) => {
+  try {
+    const existing = await baoConf.get('proxy/conf') || {};
+    const incoming = req.body || {};
+
+    if (incoming.oidc && incoming.oidc.clientSecret !== undefined) {
+      if (incoming.oidc.clientSecret === '' || incoming.oidc.clientSecret === MASK) delete incoming.oidc.clientSecret;
+    }
+    if (incoming.ldap && incoming.ldap.bindPassword !== undefined) {
+      if (incoming.ldap.bindPassword === '' || incoming.ldap.bindPassword === MASK) delete incoming.ldap.bindPassword;
+    }
+
+    for (const key of Object.keys(incoming)) {
+      if (typeof incoming[key] === 'object' && incoming[key] !== null && !Array.isArray(incoming[key])) {
+        existing[key] = { ...(existing[key] || {}), ...incoming[key] };
+      } else {
+        existing[key] = incoming[key];
+      }
+    }
+    await baoConf.set('proxy/conf', existing);
    res.json({ success: true });
  } catch(err) {
    next(err);
  }
 });

-module.exports = router;
+// Send a test email to verify SMTP configuration
+router.post('/test-email', async (req, res, next) => {
+  try {
+    const { to, subject, body } = req.body || {};
+    if (!to) {
+      return res.status(400).json({ error: 'Recipient email address is required' });
+    }
+
+    // Use the email model to send the test message
+    const Email = require('../models/email');
+    const testSubject = subject || 'SSO Manager Test Email';
+    const testBody = body || `<p>This is a test email from SSO Manager.</p><p>If you received this, your SMTP configuration is working correctly.</p><p>Sent at: ${new Date().toISOString()}</p>`;
+
+    await Email.send(to, testSubject, testBody);
+    res.json({ success: true, message: `Test email sent to ${to}` });
+  } catch(err) {
+    next(err);
+  }
+});
+
+// Send a test SMS to verify VoIP.ms configuration
+router.post('/test-sms', async (req, res, next) => {
+  try {
+    const { to, message } = req.body || {};
+    if (!to) {
+      return res.status(400).json({ error: 'Recipient phone number is required' });
+    }
+
+    const voipmsConf = conf.voipms || {};
+    if (!voipmsConf.username || !voipmsConf.password || !voipmsConf.did) {
+      return res.status(400).json({ error: 'VoIP.ms credentials not configured. Please configure username, DID, and password in the SMS tab.' });
+    }
+
+    const testMessage = message || `SSO Manager Test SMS: This is a test message from ${conf.name}. If you received this, your VoIP.ms configuration is working correctly.`;
+
+    // VoIP.ms SMS API endpoint
+    const voipmsApiUrl = 'https://api.voip.ms/v1.0';
+    const authHeader = Buffer.from(`${voipmsConf.username}:${voipmsConf.password}`).toString('base64');
+
+    const response = await fetch(`${voipmsApiUrl}/sms/send`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Basic ${authHeader}`,
+        'Content-Type': 'application/x-www-form-urlencoded'
+      },
+      body: new URLSearchParams({
+        did: voipmsConf.did,
+        to: to,
+        message: testMessage
+      })
+    });
+
+    const result = await response.json();
+    if (result.status === 'success') {
+      res.json({ success: true, message: `Test SMS sent to ${to}` });
+    } else {
+      res.status(400).json({ error: `VoIP.ms API error: ${result.message || 'Unknown error'}` });
+    }
+  } catch(err) {
+    next(err);
+  }
+});
+
+module.exports = router;
@@ -201,6 +201,16 @@ router.post('/resources/:id/rotate-secret', async (req, res, next) => {
    }
 });

+router.post('/resources/:id/service-token', async (req, res, next) => {
+    try {
+        const { ServiceToken } = require('../models/token');
+        const token = await ServiceToken.issue(req.params.id, req.user.uid);
+        res.json({ results: { token: token.token } });
+    } catch (err) {
+        next(err);
+    }
+});
+
 router.delete('/resources/:id', async (req, res, next) => {
  try {
    const r = await Resource.get(req.params.id);
@@ -0,0 +1,293 @@
+'use strict';
+
+// Plugin instances API — the loadable, configurable, multi-copy plugin system.
+//
+// Replaces the old routes/plugins.js (which only toggled cron/enabled on static
+// config via a Redis hash). Here every plugin is a PluginInstance row (see
+// models/plugin_instance.js) with its own schedule and its secrets in OpenBao
+// (utils/plugin_secrets.js), created/edited/loaded/unloaded through this API.
+//
+// Gated router-wide to the same admin groups as the directory admin API, so
+// existing directory admins keep access. Secrets are never returned in
+// cleartext — only masked (`********`) — and never persisted in the DB.
+
+const router = require('express').Router();
+const permission = require('../utils/permission');
+const registry = require('../services/plugin_registry');
+const pluginSecrets = require('../utils/plugin_secrets');
+const { PluginInstance, STATUS } = require('../models/plugin_instance');
+const { scheduleInstance, unscheduleInstance, runInstanceNow } = require('../services/scheduler');
+
+const SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+
+// Derive a stable, unique slug from an instance name when the caller didn't
+// supply one. Lowercases, collapses non-alnum runs to a single hyphen, trims,
+// and prefixes `plugin-` if the result would otherwise start with a character
+// SLUG_RE rejects. `isTaken(slug)` is consulted for uniqueness (a DB lookup);
+// on collision we append `-2`, `-3`, … up to MAX_TRIES, then give up.
+function slugify(name) {
+  let s = String(name || '').toLowerCase().trim();
+  s = s.replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  if (!s) s = 'plugin';
+  if (!/^[a-z0-9]/.test(s)) s = 'plugin-' + s;
+  return s.slice(0, 64);
+}
+
+async function makeSlug(name, isTaken) {
+  const base = slugify(name);
+  if (!await isTaken(base)) return base;
+  for (let i = 2; i <= 16; i++) {
+    const cand = `${base}-${i}`.slice(0, 64);
+    if (!await isTaken(cand)) return cand;
+  }
+  return null; // exhausted
+}
+
+// Same gate as the directory admin API: app_sso_admin or app_sso_directory_admin
+// (app_super_admin is always allowed by permission.byGroup).
+router.use(async (req, res, next) => {
+  try {
+    await permission.byGroup(req.user, ['app_sso_directory_admin', 'app_sso_admin']);
+    next();
+  } catch (err) { next(err); }
+});
+
+// Plain object for the wire, with masked secret values attached under
+// `secrets` and the run-state fields surfaced. The DB row never holds secrets.
+async function serialize(instance) {
+  const obj = instance.toJSON ? instance.toJSON() : { ...instance };
+  const secrets = await pluginSecrets.read(instance.id).catch(() => ({}));
+  obj.secrets = registry.mask(instance.pluginType, secrets);
+  return obj;
+}
+
+// Validate a create/update payload against a plugin type's configSchema.
+// Returns an error string or null. `flat` is the merged config + secret values
+// (the UI sends one flat object; the API splits it).
+function validateFields(type, flat) {
+  const required = registry.requiredKeys(type);
+  for (const key of required) {
+    const v = flat && flat[key];
+    if (v === undefined || v === null || v === '') {
+      return `Missing required field: ${key}`;
+    }
+  }
+  return null;
+}
+
+// --- Plugin types (for the create-instance picker + form) ---
+router.get('/types', (req, res) => {
+  res.json({ results: registry.getTypes() });
+});
+
+// --- List instances ---
+router.get('/', async (req, res, next) => {
+  try {
+    const instances = await PluginInstance.list();
+    const out = [];
+    for (const inst of instances) out.push(await serialize(inst));
+    res.json({ results: out });
+  } catch (err) { next(err); }
+});
+
+router.get('/:id', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    res.json({ results: await serialize(inst) });
+  } catch (err) { next(err); }
+});
+
+// --- Create instance ---
+router.post('/', async (req, res, next) => {
+  try {
+    const { pluginType, name, slug, cron } = req.body;
+    if (!pluginType) return res.status(400).json({ error: 'pluginType is required' });
+    if (!registry.getManifest(pluginType)) return res.status(400).json({ error: `Unknown plugin type: ${pluginType}` });
+    if (!name) return res.status(400).json({ error: 'name is required' });
+    // Slug is optional: derive it from the name when absent. When supplied,
+    // validate it (admins editing via API may still pass one explicitly).
+    let finalSlug = slug;
+    if (finalSlug) {
+      if (!SLUG_RE.test(finalSlug)) return res.status(400).json({ error: 'slug must be lowercase letters/digits/_/- (max 64)' });
+    } else {
+      finalSlug = await makeSlug(name, async (s) => !!(await PluginInstance.getBySlug(s)));
+      if (!finalSlug) return res.status(400).json({ error: 'Could not generate a unique slug from the name; supply one explicitly.' });
+    }
+    if (cron !== undefined && (typeof cron !== 'string' || !cron.trim())) return res.status(400).json({ error: 'cron must be a non-empty string' });
+
+    // `config` from the client is a flat object of all field values (secret +
+    // non-secret). Split it: non-secret -> DB, secret -> OpenBao.
+    const flat = (req.body.config && typeof req.body.config === 'object') ? req.body.config : {};
+    const fieldErr = validateFields(pluginType, flat);
+    if (fieldErr) return res.status(400).json({ error: fieldErr });
+
+    const manifest = registry.getManifest(pluginType);
+    const { config, secrets } = registry.splitConfig(pluginType, flat);
+    const enabled = req.body.enabled !== false; // default true
+    const now = Date.now();
+
+    const instance = await PluginInstance.create({
+      pluginType,
+      category: manifest.category,
+      name,
+      slug: finalSlug,
+      enabled,
+      cron: cron || '0 * * * *',
+      config,
+      created_by: req.user.uid,
+      created_on: now,
+      updated_by: req.user.uid,
+      updated_on: now
+    });
+
+    try {
+      await pluginSecrets.write(instance.id, secrets);
+    } catch (err) {
+      // Most likely the sso-broker policy lacks secret/plugins/* — the
+      // operator needs theta-suite >= v1.30.1. Delete the row so a failed
+      // secret write doesn't strand a half-created instance.
+      await instance.delete().catch(() => {});
+      return res.status(400).json({ error: `Failed to store plugin secrets in OpenBao: ${err.message}. Re-run ./setup.sh with theta-suite >= v1.30.1.` });
+    }
+
+    if (enabled) {
+      await scheduleInstance(instance);
+      await runInstanceNow(instance.id);
+    }
+    res.json({ results: await serialize(instance) });
+  } catch (err) {
+    if (err.name === 'SequelizeUniqueConstraintError') {
+      return res.status(400).json({ error: 'A plugin instance with this slug already exists.' });
+    }
+    next(err);
+  }
+});
+
+// --- Update instance (name/cron/enabled/non-secret config) ---
+router.put('/:id', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    if (!registry.getManifest(inst.pluginType)) return res.status(400).json({ error: `Plugin type ${inst.pluginType} is no longer installed` });
+
+    const updates = {};
+    if (req.body.name !== undefined) updates.name = req.body.name;
+    if (req.body.cron !== undefined) {
+      if (typeof req.body.cron !== 'string' || !req.body.cron.trim()) return res.status(400).json({ error: 'cron must be a non-empty string' });
+      updates.cron = req.body.cron;
+    }
+    if (req.body.enabled !== undefined) updates.enabled = !!req.body.enabled;
+
+    // Non-secret config: split the client's flat config so secret fields are
+    // never written to the DB. Secrets are changed via PUT /:id/secrets.
+    if (req.body.config !== undefined && typeof req.body.config === 'object') {
+      const { config } = registry.splitConfig(inst.pluginType, req.body.config);
+      updates.config = config;
+    }
+
+    updates.updated_by = req.user.uid;
+    updates.updated_on = Date.now();
+
+    const updated = await inst.update(updates);
+
+    // Re-schedule if the schedule-relevant fields moved.
+    if (updates.cron !== undefined || updates.enabled !== undefined) {
+      await scheduleInstance(updated);
+    }
+    res.json({ results: await serialize(updated) });
+  } catch (err) {
+    if (err.name === 'SequelizeUniqueConstraintError') {
+      return res.status(400).json({ error: 'A plugin instance with this slug already exists.' });
+    }
+    next(err);
+  }
+});
+
+// --- Update secrets only ---
+router.put('/:id/secrets', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    if (!registry.getManifest(inst.pluginType)) return res.status(400).json({ error: `Plugin type ${inst.pluginType} is no longer installed` });
+
+    // Keep only declared secret fields; pluginSecrets.write drops blank/MASK
+    // values so an unchanged masked field is a no-op.
+    const { secrets } = registry.splitConfig(inst.pluginType, req.body || {});
+    await pluginSecrets.write(inst.id, secrets);
+    await inst.update({ updated_by: req.user.uid, updated_on: Date.now() });
+    res.json({ results: true });
+  } catch (err) { next(err); }
+});
+
+// --- Test (validate) ---
+router.post('/:id/test', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    const mod = registry.getModule(inst.pluginType);
+    if (typeof mod.validate !== 'function') return res.json({ ok: true, note: 'no validate defined' });
+    const cfg = await pluginSecrets.mergeForRun(inst);
+    const result = await mod.validate(cfg);
+    if (result && result.ok) return res.json(result);
+    return res.status(400).json(result || { ok: false, error: 'validation failed' });
+  } catch (err) {
+    return res.status(400).json({ ok: false, error: err.message });
+  }
+});
+
+// --- Load (enable + schedule + run now) ---
+router.post('/:id/load', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    const updated = await inst.update({ enabled: true, updated_by: req.user.uid, updated_on: Date.now() });
+    await scheduleInstance(updated);
+    await runInstanceNow(updated.id);
+    res.json({ results: await serialize(updated) });
+  } catch (err) { next(err); }
+});
+
+// --- Unload (unschedule + disable) ---
+router.post('/:id/unload', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    await unscheduleInstance(inst.id);
+    const updated = await inst.update({ enabled: false, updated_by: req.user.uid, updated_on: Date.now() });
+    res.json({ results: await serialize(updated) });
+  } catch (err) { next(err); }
+});
+
+// --- Run now (regardless of enabled) ---
+router.post('/:id/run', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    await runInstanceNow(inst.id);
+    res.json({ results: true });
+  } catch (err) { next(err); }
+});
+
+// --- Last-run status ---
+router.get('/:id/runs', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    res.json({ results: { lastRunAt: inst.lastRunAt, lastStatus: inst.lastStatus, lastError: inst.lastError, lastLog: inst.lastLog } });
+  } catch (err) { next(err); }
+});
+
+// --- Delete (unschedule + remove secrets + delete row) ---
+router.delete('/:id', async (req, res, next) => {
+  try {
+    const inst = await PluginInstance.get(req.params.id);
+    if (!inst) return res.status(404).json({ error: 'Not found' });
+    await unscheduleInstance(inst.id);
+    await pluginSecrets.remove(inst.id); // best-effort
+    await inst.delete();
+    res.json({ results: true });
+  } catch (err) { next(err); }
+});
+
+module.exports = router;
@@ -62,6 +62,7 @@ router.get('/graph', async (req, res, next) => {
 		res.json(envelope({
 			resources: projectResources(graph.resources, { fullMetadata }),
 			edges: graph.edges,
+			updated_on: graph.updated_on
 		}));
 	} catch (err) { next(err); }
 });
@@ -98,6 +99,42 @@ router.get('/me', async (req, res, next) => {
 	} catch (err) { next(err); }
 });

+// GET /api/discovery/access/:uid[/:slug]
+// Answers per-user access for a machine caller (e.g. jump-host).
+router.get(['/access/:uid', '/access/:uid/:slug'], async (req, res, next) => {
+	try {
+		const { fullMetadata } = await callerView(req);
+		if (!req.user || (!req.user.isMachine && !fullMetadata)) {
+			return res.status(403).json(envelope({ error: 'Only machine identities or admins may query access for other users.' }));
+		}
+		const { User } = require('../models/user_ldap');
+		const { groupCns } = require('../utils/user_groups');
+		
+		const targetUser = await User.get(req.params.uid).catch(() => null);
+		if (!targetUser) return res.status(404).json(envelope({ error: 'User not found' }));
+
+		const groups = await groupCns(targetUser);
+		const ids = new Set();
+		if (groups.length) {
+			const rgs = await ResourceGroup.list({ where: { groupCn: { in: groups } } });
+			for (const rg of rgs) ids.add(rg.resourceId);
+		}
+		
+		let all = await Resource.list();
+		if (req.params.slug) all = all.filter(r => r.slug === req.params.slug);
+
+		let accessible = all.filter(r => {
+			const isAuto = r.metadata?.discovery_sources?.length > 0 && !r.metadata.discovery_sources.includes('manual');
+			const isManaged = r.metadata?.managed === true;
+			if (isAuto && !isManaged) return false;
+			return ids.has(r.id) || (r.metadata && r.metadata.isPublic);
+		});
+		
+		accessible = await Resource.withResolvedAddress(accessible);
+		res.json(envelope(projectResources(accessible, { fullMetadata })));
+	} catch (err) { next(err); }
+});
+
 // POST /api/discovery/sync
 // Used by external agents (e.g. ldap-client) to push discovery data.
 router.post('/sync', async (req, res, next) => {
@@ -34,7 +34,8 @@ const DOCS = {
 	'oauth-apps':    {title: 'Connecting Apps (SSO)',   file: path.join(__dirname, '../../docs/concepts-oauth-apps.md')},
 	'api-tokens':    {title: 'API Tokens',              file: path.join(__dirname, '../../docs/concepts-api-tokens.md')},
 	directory:       {title: 'Directory & Inventory',   file: path.join(__dirname, '../../docs/directory.md')},
-	agents:          {title: 'Agents & Scheduler',      file: path.join(__dirname, '../../docs/agents.md')},
+	agents:          {title: 'Plugins',                file: path.join(__dirname, '../../docs/plugins.md')},
+	plugins:         {title: 'Plugins',                file: path.join(__dirname, '../../docs/plugins.md')},
 	vault:           {title: 'Vault Secrets',           file: path.join(__dirname, '../../docs/vault.md')},

 	overview:        {title: 'Overview',        file: path.join(__dirname, '../../README.md')},
@@ -64,14 +64,15 @@ router.get('/notifications', (req, res) => res.redirect(301, '/overview'));
 router.get('/dashboard', (req, res) => res.redirect(301, '/overview'));
 router.get('/executive', (req, res) => res.redirect(301, '/overview'));

-router.get('/conf', async function(req, res, next) {
-  const permission = require('../utils/permission');
-  try {
-    await permission.byGroup(req.user, ['app_sso_admin']);
-    res.render('conf', {...values});
-  } catch(err) {
-    next(err);
-  }
+router.get('/conf', function(req, res) {
+  // Admin-only Configuration page. The view renders the shell for anyone
+  // (like /users, /directory, etc.); the client gates access with
+  // app.auth.forceLogin(['admin','app_sso_admin']) and the /api/conf endpoint
+  // enforces app_sso_admin server-side. The previous server-side
+  // permission.byGroup(req.user,…) 401'd on a browser navigation because this
+  // app's auth-token is a header set by client JS (localStorage), not a
+  // cookie — so req.user is undefined on a plain page load.
+  res.render('conf', {...values});
 });

 router.get('/directory', function(req, res) {
@@ -82,12 +83,31 @@ router.get('/discovery', function(req, res, next) {
  res.redirect('/directory');
 });

-router.get('/plugins',  function(req, res, next) {
-  res.redirect('/directory');
+router.get('/plugins', function(req, res, next) {
+  // Plugin instances page — loadable/unloadable, configurable plugin copies
+  // with per-instance secrets in OpenBao. Renders the shell for anyone; the
+  // client gates with app.auth.forceLogin(['app_sso_admin',
+  // 'app_sso_directory_admin','admin']) and the /api/plugins endpoints enforce
+  // the same server-side. Same header-vs-navigation auth model as /conf and
+  // /vault (auth-token is a client-set header, not a cookie).
+  const registry = require('../services/plugin_registry');
+  res.render('plugins', {...values, pluginTypes: registry.types });
 });

-router.get('/vault',  function(req, res, next) {
-  res.render('vaultwarden', {...values});
+router.get('/vault', function(req, res) {
+  // Personal per-user secrets (secret/users/<uid>/*) for everyone; admins get
+  // free-form access across all of secret/ plus an Apps tab to mint scoped
+  // tokens for external apps. The view renders the shell for any logged-in
+  // user; the client gates login via app.auth.forceLogin() and derives the
+  // admin/namespace scope from /api/user/me. The /api/vault proxy enforces the
+  // same scoping server-side (scopeGuard + the token's own OpenBao policy), so
+  // the client-derived scope is only cosmetic. vaultAddr is the only
+  // server-rendered value (it's a non-user-specific env var); uid + isAdmin
+  // are resolved client-side to avoid the header-vs-navigation auth mismatch.
+  res.render('vault', {
+    ...values,
+    vaultAddr: process.env.VAULT_ADDR || 'http://openbao:8200',
+  });
 });

 // Linkable deep-link to a single resource's modal, e.g. from the resource
@@ -121,10 +141,6 @@ router.get('/users', async function(req, res, next) {
  res.render('users', {...values});
 });

-router.get('/conf', async function(req, res, next) {
-  res.render('conf', {...values});
-});
-
 router.get('/login', async function(req, res, next) {
  res.render('login', {...values, redirect: req.query.redirect});
 });
@@ -1,59 +0,0 @@
-const router = require('express').Router();
-const conf = require('@simpleworkjs/conf');
-const permission = require('../utils/permission');
-
-router.use(async (req, res, next) => {
-  try {
-    await permission.byGroup(req.user, ['app_sso_directory_admin', 'app_sso_admin']);
-    next();
-  } catch(err) {
-    next(err);
-  }
-});
-
-const Redis = require('ioredis');
-const connection = new Redis(process.env.REDIS_URL || 'redis://127.0.0.1:6379', { maxRetriesPerRequest: null });
-const { initScheduler } = require('../services/scheduler');
-
-router.get('/', async (req, res) => {
-  const plugins = conf.discovery && conf.discovery.plugins ? conf.discovery.plugins : {};
-  let overrides = {};
-  try {
-    const data = await connection.hgetall('discovery_plugins');
-    for (const [k, v] of Object.entries(data)) {
-      overrides[k] = JSON.parse(v);
-    }
-  } catch(e) {}
-  
-  // Mask secrets before sending
-  const masked = JSON.parse(JSON.stringify(plugins));
-  for (const name in masked) {
-    masked[name] = { ...masked[name], ...(overrides[name] || {}) };
-    if (masked[name].tokenSecret) masked[name].tokenSecret = '********';
-    if (masked[name].password) masked[name].password = '********';
-  }
-  res.json({ results: masked });
-});
-
-router.put('/:name', async (req, res) => {
-  const name = req.params.name;
-  const updates = req.body;
-  
-  let current = {};
-  try {
-    const data = await connection.hget('discovery_plugins', name);
-    if (data) current = JSON.parse(data);
-  } catch(e) {}
-  
-  if (updates.cron !== undefined) current.cron = updates.cron;
-  if (updates.enabled !== undefined) current.enabled = updates.enabled === true || updates.enabled === 'true';
-  
-  await connection.hset('discovery_plugins', name, JSON.stringify(current));
-  
-  // Re-init scheduler to apply changes
-  await initScheduler(conf.discovery).catch(console.error);
-  
-  res.json({ success: true, message: 'Plugin updated' });
-});
-
-module.exports = router;
@@ -9,17 +9,18 @@ class DiscoveryReconciler {

    for (const res of resources) {
      if (!res.metadata) res.metadata = {};
+      res._originalSlug = res.slug; // Keep track for edge mapping
      
      let existing = null;
      
-      // Attempt matching by MAC if available
+      // Attempt matching by MAC if available (case-insensitive)
      if (res.metadata.interfaces && res.metadata.interfaces.length > 0) {
-        const macs = res.metadata.interfaces.map(i => i.mac).filter(m => !!m);
+        const macs = res.metadata.interfaces.map(i => i.mac ? i.mac.toLowerCase() : null).filter(m => !!m);
        if (macs.length > 0) {
          const allRes = await Resource.list();
          existing = allRes.find(r => 
            r.metadata && r.metadata.interfaces && 
-            r.metadata.interfaces.some(i => macs.includes(i.mac))
+            r.metadata.interfaces.some(i => i.mac && macs.includes(i.mac.toLowerCase()))
          );
        }
      }
@@ -65,7 +66,10 @@ class DiscoveryReconciler {
          const newIntfs = res.metadata.interfaces;
          // Simple union based on mac or ip
          for (const ni of newIntfs) {
-            const idx = existingIntfs.findIndex(ei => (ni.mac && ei.mac === ni.mac) || (ni.ip && ei.ip === ni.ip));
+            const idx = existingIntfs.findIndex(ei => 
+              (ni.mac && ei.mac && ei.mac.toLowerCase() === ni.mac.toLowerCase()) || 
+              (ni.ip && ei.ip && ei.ip === ni.ip)
+            );
            if (idx >= 0) existingIntfs[idx] = { ...existingIntfs[idx], ...ni };
            else existingIntfs.push(ni);
          }
@@ -79,16 +83,23 @@ class DiscoveryReconciler {
        
        mergedMeta.last_seen = Date.now();
        
+        const isIp = (str) => /^(?:[0-9]{1,3}\\.){3}[0-9]{1,3}$/.test(str || '');
+        let bestName = existing.name;
+        if (res.name && (!bestName || isIp(bestName) || res.name.length > bestName.length && !isIp(res.name))) {
+          bestName = res.name;
+        }
+
        await existing.update({
-          name: res.name || existing.name,
+          name: bestName,
          description: res.description || existing.description,
          metadata: mergedMeta,
          updated_on: Math.floor(Date.now() / 1000)
        });
+        res._actualId = existing.id;
      } else {
        // Create new
-        const sources = [sourceName];
-        res.metadata.discovery_sources = sources;
+        const sources = new Set([sourceName]);
+        res.metadata.discovery_sources = [...sources];
        res.metadata.last_seen = Date.now();
        
        const slug = res.slug || `${res.kind}-${crypto.randomBytes(4).toString('hex')}`;
@@ -103,12 +114,48 @@ class DiscoveryReconciler {
        });
        
        newDevices++;
+        res._actualId = created.id; // Map original slug to actual ID
        WebhookEmitter.emit('discovery.new_device', created.toJSON());
      }
    }
    
-    // We can handle edges similarly if needed, but for simplicity we assume edges are managed elsewhere 
-    // or we just trust the plugins to give us explicit parent-child mappings by slug.
+    // Now process edges
+    const allRes = await Resource.list();
+    const existingEdges = await ResourceEdge.list();
+    
+    for (const edge of edges) {
+      // Find parent ID. It might be in the current payload (mapped to _actualId) or in DB by slug
+      let parentId = null;
+      const parentResInPayload = resources.find(r => r._originalSlug === edge.parentSlug);
+      if (parentResInPayload && parentResInPayload._actualId) {
+        parentId = parentResInPayload._actualId;
+      } else {
+        const parentResInDb = allRes.find(r => r.slug === edge.parentSlug);
+        if (parentResInDb) parentId = parentResInDb.id;
+      }
+      
+      // Find child ID
+      let childId = null;
+      const childResInPayload = resources.find(r => r._originalSlug === edge.childSlug);
+      if (childResInPayload && childResInPayload._actualId) {
+        childId = childResInPayload._actualId;
+      } else {
+        const childResInDb = allRes.find(r => r.slug === edge.childSlug);
+        if (childResInDb) childId = childResInDb.id;
+      }
+      
+      if (parentId && childId) {
+        const edgeExists = existingEdges.find(e => e.parentId === parentId && e.childId === childId && e.relation === edge.relation);
+        if (!edgeExists) {
+          await ResourceEdge.create({
+            id: crypto.randomUUID(),
+            parentId,
+            childId,
+            relation: edge.relation
+          });
+        }
+      }
+    }
    
    if (newDevices > 0) {
      console.log(`[DiscoveryReconciler] Source ${sourceName} discovered ${newDevices} new devices.`);
@@ -0,0 +1,172 @@
+'use strict';
+
+// Plugin type registry.
+//
+// A **plugin type** is a module under nodejs/plugins/<category>/<type>.js
+// exporting a manifest:
+//
+//   { type, category, name, description, configSchema[], validate(), run() }
+//
+// `configSchema` is an array of field descriptors that drive the admin UI form
+// and API validation. Fields with `secret: true` are stored in OpenBao
+// (secret/plugins/<instance-id>/conf via utils/plugin_secrets.js); all other
+// field values live in the PluginInstance DB row's `config` JSON column.
+//
+// `run(cfg)` does the work; the discovery plugins keep their historical
+// `discover(cfg)` name and add `run` as an alias (the loader uses `run`).
+//
+// A **plugin instance** (models/plugin_instance.js) is a configured, loadable
+// copy of a type — you can have several of the same type. This registry only
+// knows about *types*; instances live in the DB.
+//
+// The scan happens once at require time (the set of installed .js files does
+// not change without a redeploy). Runtime load/unload is per-instance, not
+// per-type — adding a new plugin type still needs a restart.
+
+const fs = require('fs');
+const path = require('path');
+
+const pluginsRoot = path.join(__dirname, '../plugins');
+const MASK = '********';
+
+// type -> module. Built once.
+const _modules = new Map();
+// type -> manifest summary (a safe, serializable subset for the UI/API).
+const _summaries = [];
+
+function loadAll() {
+  _modules.clear();
+  _summaries.length = 0;
+  if (!fs.existsSync(pluginsRoot)) return;
+  for (const category of fs.readdirSync(pluginsRoot)) {
+    const catDir = path.join(pluginsRoot, category);
+    const stat = fs.statSync(catDir);
+    if (!stat.isDirectory()) continue;
+    for (const file of fs.readdirSync(catDir)) {
+      if (!file.endsWith('.js')) continue;
+      const type = path.basename(file, '.js');
+      // require fresh-ish: a plugin file should be idempotent to load. Clear
+      // from the cache so a future re-scan (e.g. in tests) picks up edits.
+      const full = path.join(catDir, file);
+      delete require.cache[require.resolve(full)];
+      const mod = require(full);
+      // Backfill manifest defaults so older plugins (only exporting discover)
+      // still register with a usable summary.
+      const manifest = {
+        type: mod.type || type,
+        category: mod.category || category,
+        name: mod.name || type,
+        description: mod.description || '',
+        configSchema: Array.isArray(mod.configSchema) ? mod.configSchema : [],
+        validate: typeof mod.validate === 'function' ? mod.validate : null,
+        run: typeof mod.run === 'function' ? mod.run
+          : typeof mod.discover === 'function' ? mod.discover : null
+      };
+      _modules.set(manifest.type, { mod, manifest });
+      _summaries.push({
+        type: manifest.type,
+        category: manifest.category,
+        name: manifest.name,
+        description: manifest.description,
+        configSchema: manifest.configSchema
+      });
+    }
+  }
+}
+
+loadAll();
+
+// All registered plugin types, as serializable summaries (no functions).
+// Used by GET /api/plugins/types to build the "New Plugin" picker + form.
+function getTypes() {
+  return _summaries.map(s => ({ ...s }));
+}
+
+// The raw module for a type (has run/validate/discover). Throws if unknown.
+function getModule(type) {
+  const entry = _modules.get(type);
+  if (!entry) {
+    const err = new Error(`Unknown plugin type: ${type}`);
+    err.status = 400;
+    throw err;
+  }
+  return entry.mod;
+}
+
+// The manifest summary for a type. Returns null if unknown (callers gate on
+// this to validate a pluginType before creating an instance).
+function getManifest(type) {
+  const entry = _modules.get(type);
+  return entry ? entry.manifest : null;
+}
+
+// Keys of the secret fields in a type's configSchema.
+function secretKeys(type) {
+  const m = getManifest(type);
+  if (!m) return [];
+  return m.configSchema.filter(f => f.secret).map(f => f.key);
+}
+
+// Non-secret field keys in a type's configSchema.
+function publicKeys(type) {
+  const m = getManifest(type);
+  if (!m) return [];
+  return m.configSchema.filter(f => !f.secret).map(f => f.key);
+}
+
+// All declared field keys (secret + non-secret) — for required-field validation.
+function fieldKeys(type) {
+  const m = getManifest(type);
+  if (!m) return [];
+  return m.configSchema.map(f => f.key);
+}
+
+// Required field keys.
+function requiredKeys(type) {
+  const m = getManifest(type);
+  if (!m) return [];
+  return m.configSchema.filter(f => f.required).map(f => f.key);
+}
+
+// Replace each present secret value with MASK, keeping the keys so the UI can
+// render a prefilled (masked) password field. Non-secret values are passed
+// through unchanged. `values` is a plain object of field->value.
+function mask(type, values) {
+  if (!values || typeof values !== 'object') return values;
+  const sk = new Set(secretKeys(type));
+  const out = {};
+  for (const [k, v] of Object.entries(values)) {
+    out[k] = sk.has(k) && v ? MASK : v;
+  }
+  return out;
+}
+
+// Split a flat {field: value} object (as the UI/API sends it) into non-secret
+// config (for the DB row) and secret values (for OpenBao). Unknown keys are
+// dropped — only declared configSchema fields are kept.
+function splitConfig(type, flat) {
+  const manifest = getManifest(type);
+  const config = {};
+  const secrets = {};
+  if (!manifest || !flat) return { config, secrets };
+  for (const f of manifest.configSchema) {
+    if (!(f.key in flat)) continue;
+    if (f.secret) secrets[f.key] = flat[f.key];
+    else config[f.key] = flat[f.key];
+  }
+  return { config, secrets };
+}
+
+module.exports = {
+  getTypes,
+  getModule,
+  getManifest,
+  secretKeys,
+  publicKeys,
+  fieldKeys,
+  requiredKeys,
+  mask,
+  splitConfig,
+  // for tests
+  _reload: loadAll
+};
@@ -1,5 +1,27 @@
+'use strict';
+
+// Discovery / plugin scheduler.
+//
+// Generalized from the one-shot discovery-plugin loader: plugin *types* live
+// under nodejs/plugins/<category>/<type>.js (see services/plugin_registry.js),
+// and configured, loadable/unloadable *instances* live in the PluginInstance
+// table (models/plugin_instance.js). This module schedules enabled instances
+// on cron via BullMQ JobSchedulers and runs them in a Worker.
+//
+// Each instance owns a stable JobScheduler id (`plugin:<instanceId>`) so load/
+// unload can add/remove a single schedule without disturbing the others —
+// `upsertJobScheduler`/`removeJobScheduler` (BullMQ v6) take that id directly.
+//
+// Per-instance secrets are merged in from OpenBao (utils/plugin_secrets.js) at
+// run time; the plugin's run()/discover() receives the combined non-secret
+// config + secret values as a single `config` object, exactly as the legacy
+// static-config path did.
+
 const { Queue, Worker } = require('bullmq');
 const { DiscoveryReconciler } = require('./discovery_reconciler');
+const pluginRegistry = require('./plugin_registry');
+const pluginSecrets = require('../utils/plugin_secrets');
+const { PluginInstance, STATUS } = require('../models/plugin_instance');
 const Redis = require('ioredis');

 // Ensure Redis connection works for BullMQ
@@ -8,80 +30,186 @@ const connection = new Redis(process.env.REDIS_URL || 'redis://127.0.0.1:6379',

 const discoveryQueue = new Queue('discovery', { connection });

-// Load plugins
-const fs = require('fs');
-const path = require('path');
-const pluginsDir = path.join(__dirname, '../plugins/discovery');
-
-let plugins = {};
-
-if (fs.existsSync(pluginsDir)) {
-  fs.readdirSync(pluginsDir).forEach(file => {
-    if (file.endsWith('.js')) {
-      const name = path.basename(file, '.js');
-      plugins[name] = require(path.join(pluginsDir, file));
-    }
-  });
-}
+const RUN = 'run_plugin';
+const GC = 'garbage_collect';
+function pluginSchedulerId(id) { return `plugin:${id}`; }

 const worker = new Worker('discovery', async job => {
-  if (job.name === 'run_plugin') {
-    const { pluginName, config } = job.data;
-    if (plugins[pluginName]) {
-      console.log(`[Scheduler] Running plugin: ${pluginName}`);
-      try {
-        const payload = await plugins[pluginName].discover(config);
-        await DiscoveryReconciler.reconcile(pluginName, payload);
-      } catch (err) {
-        console.error(`[Scheduler] Plugin ${pluginName} failed:`, err);
-      }
-    }
-  } else if (job.name === 'garbage_collect') {
-    console.log(`[Scheduler] Running garbage collection`);
+  if (job.name === RUN) {
+    await runPluginJob(job.data && job.data.instanceId);
+  } else if (job.name === GC) {
+    console.log('[Scheduler] Running garbage collection');
    await DiscoveryReconciler.garbageCollect();
  }
 }, { connection });

-// Function to start scheduling
-async function initScheduler(discoveryConfig) {
-  // Clear old repeatable jobs (BullMQ v6 uses JobSchedulers)
-  try {
-    const schedulers = await discoveryQueue.getJobSchedulers();
-    for (const job of schedulers) {
-      await discoveryQueue.removeJobScheduler(job.id);
-    }
-  } catch (e) {
-    console.log('[Scheduler] Could not clear old job schedulers (may not be supported or none exist)');
+// Run one plugin instance. Loads the row (skip silently if it was deleted or
+// disabled after the job was enqueued), merges its OpenBao secrets into its
+// config, calls the plugin's run()/discover(), and — for discovery plugins —
+// reconciles the result into the resource graph under the instance's slug.
+// Bookkeeping (lastRunAt/lastStatus/lastError) is stamped on the row so the UI
+// can show run state without querying BullMQ.
+async function runPluginJob(instanceId) {
+  if (!instanceId) { console.warn('[Scheduler] run_plugin job with no instanceId'); return; }
+  const instance = await PluginInstance.get(instanceId);
+  if (!instance) { console.warn(`[Scheduler] instance ${instanceId} gone — skipping`); return; }
+  if (!instance.enabled) { console.warn(`[Scheduler] instance ${instance.slug} (${instanceId}) disabled — skipping`); return; }
+
+  let mod;
+  try { mod = pluginRegistry.getModule(instance.pluginType); }
+  catch (err) {
+    console.error(`[Scheduler] instance ${instance.slug}: type ${instance.pluginType} unavailable:`, err.message);
+    await instance.update({ lastRunAt: Date.now(), lastStatus: STATUS.ERROR, lastError: `plugin type unavailable: ${instance.pluginType}` });
+    return;
  }

-  // Schedule Garbage Collection
-  await discoveryQueue.add('garbage_collect', {}, { repeat: { pattern: '0 0 * * *' } }); // Daily
+  const runFn = mod.run || mod.discover;
+  if (typeof runFn !== 'function') {
+    console.error(`[Scheduler] instance ${instance.slug}: type ${instance.pluginType} has no run()/discover()`);
+    await instance.update({ lastRunAt: Date.now(), lastStatus: STATUS.ERROR, lastError: 'plugin type has no run()/discover()' });
+    return;
+  }

-  // Load plugin overrides from Redis
-  let overrides = {};
+  console.log(`[Scheduler] Running plugin: ${instance.slug} (${instance.pluginType})`);
+  await instance.update({ lastRunAt: Date.now(), lastStatus: STATUS.RUNNING, lastError: null, lastLog: null });
+  let logs = [];
  try {
-    const data = await connection.hgetall('discovery_plugins');
-    for (const [k, v] of Object.entries(data)) {
-      overrides[k] = JSON.parse(v);
+    const cfg = await pluginSecrets.mergeForRun(instance);
+    cfg.log = (msg) => {
+      logs.push(`[${new Date().toISOString()}] ${msg}`);
+      console.log(`[Plugin ${instance.slug}] ${msg}`);
+      if (logs.length > 1000) logs.shift();
+    };
+    const payload = await runFn(cfg);
+    if (instance.category === 'discovery') {
+      await DiscoveryReconciler.reconcile(instance.slug, payload);
    }
+    await instance.update({ lastStatus: STATUS.OK, lastError: null, lastLog: logs.join('\n') });
  } catch (err) {
-    console.error('[Scheduler] Failed to load plugin overrides from Redis', err);
+    console.error(`[Scheduler] Plugin ${instance.slug} failed:`, err.message);
+    await instance.update({ lastStatus: STATUS.ERROR, lastError: String(err.message || err), lastLog: logs.join('\n') });
  }
+}

-  // Schedule Plugins based on config + overrides
-  if (discoveryConfig && discoveryConfig.plugins) {
-    for (const [name, config] of Object.entries(discoveryConfig.plugins)) {
-      const mergedConfig = { ...config, ...(overrides[name] || {}) };
-      if (mergedConfig.enabled && plugins[name]) {
-        const cron = mergedConfig.cron || '0 * * * *'; // Default hourly
-        await discoveryQueue.add('run_plugin', { pluginName: name, config: mergedConfig }, { repeat: { pattern: cron } });
-        console.log(`[Scheduler] Scheduled plugin ${name} with cron ${cron}`);
-        
-        // Also run once immediately
-        await discoveryQueue.add('run_plugin', { pluginName: name, config: mergedConfig });
-      }
+// Schedule one instance: upsert a repeatable JobScheduler keyed by its id. Does
+// NOT trigger an immediate run — call runInstanceNow(id) separately for that
+// (used on boot and on "load"). Safe to call repeatedly (upsert is idempotent
+// and will update the cron if it changed).
+async function scheduleInstance(instance) {
+  if (!instance || !instance.id) return;
+  if (!instance.enabled) { await unscheduleInstance(instance.id); return; }
+  const cron = instance.cron || '0 * * * *';
+  await discoveryQueue.upsertJobScheduler(pluginSchedulerId(instance.id), { pattern: cron }, {
+    name: RUN,
+    data: { instanceId: instance.id }
+  });
+  console.log(`[Scheduler] Scheduled instance ${instance.slug} with cron ${cron}`);
+}
+
+// Remove an instance's repeatable schedule. No-op if it had none.
+async function unscheduleInstance(id) {
+  if (!id) return;
+  try { await discoveryQueue.removeJobScheduler(pluginSchedulerId(id)); }
+  catch (err) { /* missing scheduler is fine */ }
+}
+
+// Enqueue a single immediate run for an instance (the "Run now" button / boot
+// kick). Runs once regardless of enabled, on top of any schedule.
+async function runInstanceNow(id) {
+  if (!id) return;
+  await discoveryQueue.add(RUN, { instanceId: id });
+}
+
+// One-time legacy migration: if the PluginInstance table is empty AND
+// conf.discovery.plugins has entries (the old static-config shape), seed one
+// instance per configured type and copy its secret fields into OpenBao. After
+// the first boot, the table is non-empty and the static config is ignored.
+// Idempotent (guarded by the empty-table check).
+async function migrateLegacyPlugins(discoveryConfig) {
+  const existing = await PluginInstance.list();
+  if (existing && existing.length) return;
+
+  const legacy = discoveryConfig && discoveryConfig.plugins;
+  if (!legacy || typeof legacy !== 'object') return;
+  const names = Object.keys(legacy);
+  if (!names.length) return;
+
+  console.log(`[Scheduler] Migrating ${names.length} legacy discovery plugin(s) to instances…`);
+  for (const name of names) {
+    const entry = legacy[name] || {};
+    const manifest = pluginRegistry.getManifest(name);
+    if (!manifest) {
+      console.warn(`[Scheduler] legacy plugin '${name}' has no registered type — skipping`);
+      continue;
+    }
+    // splitConfig keeps only declared configSchema fields and separates secret
+    // from non-secret. Legacy `enabled`/`cron` are not in configSchema, so they
+    // are dropped here and read from the entry directly below.
+    const { config, secrets } = pluginRegistry.splitConfig(name, entry);
+    const instance = await PluginInstance.create({
+      pluginType: name,
+      category: manifest.category,
+      name: manifest.name,
+      slug: name,
+      enabled: entry.enabled !== false,
+      cron: entry.cron || '0 * * * *',
+      config,
+      created_by: 'legacy-migration'
+    });
+    try {
+      await pluginSecrets.write(instance.id, secrets);
+      console.log(`[Scheduler] migrated '${name}' -> instance ${instance.id} (slug ${instance.slug})`);
+    } catch (err) {
+      // The instance row exists; if we can't write secrets (e.g. the sso-broker
+      // policy predates theta-suite v1.30.1) the operator gets a clear error
+      // from the API on edit, and the instance still runs with its non-secret
+      // config. Don't delete the row — the operator just needs to re-run
+      // setup.sh and edit/save the secrets.
+      console.error(`[Scheduler] migrated '${name}' row but FAILED to write secrets:`, err.message);
+      await instance.update({ lastStatus: STATUS.ERROR, lastError: `secret migration failed: ${err.message}` });
    }
  }
 }

-module.exports = { initScheduler, discoveryQueue, connection };
+// Boot-time initialization: clear stale schedulers, schedule garbage collection,
+// migrate any legacy static-config plugins, then schedule every enabled
+// instance and kick one immediate run for each.
+async function initScheduler(discoveryConfig) {
+  // Clear stale plugin/gc schedulers from a previous boot. Other-named
+  // schedulers (none in this app) are left alone.
+  try {
+    const schedulers = await discoveryQueue.getJobSchedulers();
+    for (const s of schedulers) {
+      if (s.name === RUN || s.name === GC) {
+        await discoveryQueue.removeJobScheduler(s.key || s.id);
+      }
+    }
+  } catch (e) {
+    console.log('[Scheduler] Could not clear old job schedulers:', e.message);
+  }
+
+  // Daily garbage collection of stale discovery resources.
+  await discoveryQueue.upsertJobScheduler(GC, { pattern: '0 0 * * *' }, { name: GC, data: {} });
+
+  try {
+    await migrateLegacyPlugins(discoveryConfig);
+  } catch (err) {
+    console.error('[Scheduler] legacy migration failed:', err.message);
+  }
+
+  const enabled = await PluginInstance.listEnabled();
+  for (const instance of enabled) {
+    await scheduleInstance(instance);
+    await runInstanceNow(instance.id); // boot kick
+  }
+  console.log(`[Scheduler] initialized — ${enabled.length} instance(s) scheduled`);
+}
+
+module.exports = {
+  initScheduler,
+  scheduleInstance,
+  unscheduleInstance,
+  runInstanceNow,
+  discoveryQueue,
+  connection
+};
@@ -1,12 +0,0 @@
-const express = require('express');
-const { createProxyMiddleware } = require('http-proxy-middleware');
-const app = express();
-app.use('/', createProxyMiddleware({
-  target: 'http://localhost:8080',
-  on: {
-    proxyRes: (proxyRes, req, res) => {
-      delete proxyRes.headers['x-frame-options'];
-    }
-  }
-}));
-app.listen(3004);
@@ -1,36 +0,0 @@
-const proxmox = require('./plugins/discovery/proxmox');
-const unifi = require('./plugins/discovery/unifi');
-
-async function test() {
-  console.log("=== Running Proxmox Plugin ===");
-  try {
-    const pveData = await proxmox.discover({
-      url: 'https://dl380-0.internal.718it.biz:8006',
-      tokenId: 'root@pam!agy',
-      tokenSecret: '1e7c0e31-6767-4295-bcda-d7acf5df1d9a'
-    });
-    console.log(`Found ${pveData.resources.length} resources and ${pveData.edges.length} edges.`);
-    console.log("Sample resource:");
-    console.log(JSON.stringify(pveData.resources[0], null, 2));
-    console.log("Sample edge:");
-    console.log(JSON.stringify(pveData.edges[0], null, 2));
-  } catch (e) {
-    console.error("Proxmox failed:", e.message);
-  }
-
-  console.log("\n=== Running Unifi Plugin ===");
-  try {
-    const unifiData = await unifi.discover({
-      url: 'https://unifi.718it.biz',
-      user: 'agy',
-      password: 'MyPassword!23'
-    });
-    console.log(`Found ${unifiData.resources.length} resources and ${unifiData.edges.length} edges.`);
-    console.log("Sample resource:");
-    console.log(JSON.stringify(unifiData.resources.find(r => r.kind === 'network_device'), null, 2));
-  } catch (e) {
-    console.error("Unifi failed:", e.message);
-  }
-}
-
-test();
@@ -0,0 +1,69 @@
+const request = require('supertest');
+const express = require('express');
+
+// Mock dependencies before requiring the route
+jest.mock('@simpleworkjs/bao-conf', () => ({
+  get: jest.fn(),
+  set: jest.fn(),
+}));
+jest.mock('../utils/permission', () => ({
+  byGroup: jest.fn().mockResolvedValue(true),
+}));
+jest.mock('@simpleworkjs/conf', () => ({}));
+
+const baoConf = require('@simpleworkjs/bao-conf');
+const apiConf = require('../routes/api_conf');
+
+const app = express();
+app.use(express.json());
+// Add a mock user for the permission check
+app.use((req, res, next) => {
+  req.user = { uid: 'testadmin' };
+  next();
+});
+app.use('/api/conf', apiConf);
+
+describe('Proxy Conf API (Vault Integration)', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('GET /api/conf/proxy returns proxy conf with masked secrets', async () => {
+    baoConf.get.mockResolvedValueOnce({
+      oidc: { issuer: 'https://test', clientId: 'cid', clientSecret: 'real_secret' },
+      ldap: { bindPassword: 'real_ldap_password' }
+    });
+
+    const res = await request(app).get('/api/conf/proxy');
+    
+    expect(res.status).toBe(200);
+    expect(res.body.oidc.issuer).toBe('https://test');
+    expect(res.body.oidc.clientSecret).toBe('********'); // MASKED
+    expect(res.body.ldap.bindPassword).toBe('********'); // MASKED
+    expect(baoConf.get).toHaveBeenCalledWith('proxy/conf');
+  });
+
+  it('POST /api/conf/proxy merges configuration securely to OpenBao', async () => {
+    baoConf.get.mockResolvedValueOnce({
+      oidc: { clientSecret: 'old_secret' },
+      ldap: { bindPassword: 'old_ldap' }
+    });
+
+    const payload = {
+      oidc: { issuer: 'https://new', clientSecret: '********' }, // Admin left it unchanged
+      ldap: { bindPassword: 'new_password' }
+    };
+
+    const res = await request(app)
+      .post('/api/conf/proxy')
+      .send(payload);
+
+    expect(res.status).toBe(200);
+    expect(baoConf.set).toHaveBeenCalledTimes(1);
+    const saved = baoConf.set.mock.calls[0][1];
+
+    expect(saved.oidc.issuer).toBe('https://new');
+    expect(saved.oidc.clientSecret).toBe('old_secret'); // Preserved because incoming was mask
+    expect(saved.ldap.bindPassword).toBe('new_password'); // Overwritten because incoming was new
+  });
+});
@@ -0,0 +1,179 @@
+'use strict';
+
+// Tests for the plugin system:
+//   - plugin_registry: pure type discovery + configSchema helpers (no ORM, no
+//     OpenBao, no LDAP) — the registry just requires the plugins/discovery/*.js
+//     modules, which are real deps (node-fetch, node-nmap).
+//   - plugin_secrets: OpenBao read/write/mergeForRun, with @simpleworkjs/bao-conf
+//     mocked so no live OpenBao is needed.
+//   - PluginInstance model: ORM round-trip against the same sqlite store the
+//     rest of the suite uses (initORM), incl. the unique-slug constraint and
+//     listEnabled. Like resource_site_slug.test.js, this is direct model use
+//     rather than the LDAP-gated HTTP routes.
+
+jest.mock('@simpleworkjs/bao-conf', () => ({
+  get: jest.fn(),
+  set: jest.fn(),
+  request: jest.fn(),
+}));
+
+const registry = require('../services/plugin_registry');
+const pluginSecrets = require('../utils/plugin_secrets');
+const baoConf = require('@simpleworkjs/bao-conf');
+const { PluginInstance } = require('../models/plugin_instance');
+
+describe('plugin_registry', () => {
+  test('getTypes lists the built-in discovery plugins', () => {
+    const types = registry.getTypes();
+    const byType = Object.fromEntries(types.map(t => [t.type, t]));
+    expect(byType.proxmox).toBeDefined();
+    expect(byType.unifi).toBeDefined();
+    expect(byType.nmap).toBeDefined();
+    expect(byType.proxmox.category).toBe('discovery');
+    expect(byType.proxmox.configSchema.length).toBeGreaterThan(0);
+  });
+
+  test('configSchema marks secret fields', () => {
+    const m = registry.getManifest('proxmox');
+    const secret = m.configSchema.find(f => f.key === 'tokenSecret');
+    expect(secret.secret).toBe(true);
+    expect(secret.required).toBe(true);
+    expect(m.configSchema.find(f => f.key === 'url').secret).toBeFalsy();
+  });
+
+  test('requiredKeys / secretKeys / publicKeys split correctly', () => {
+    expect(registry.requiredKeys('proxmox').sort()).toEqual(['tokenId', 'tokenSecret', 'url']);
+    expect(registry.secretKeys('proxmox')).toEqual(['tokenSecret']);
+    expect(registry.secretKeys('unifi')).toEqual(['password']);
+    expect(registry.secretKeys('nmap')).toEqual([]);
+    expect(registry.publicKeys('nmap')).toEqual(['targetRange']);
+  });
+
+  test('splitConfig separates secret from non-secret and drops undeclared keys', () => {
+    const { config, secrets } = registry.splitConfig('proxmox', {
+      url: 'https://pve:8006',
+      tokenId: 'u@pam!t',
+      tokenSecret: 'shh',
+      enabled: true, // not in configSchema -> dropped
+      cron: '0 * * * *' // not in configSchema -> dropped
+    });
+    expect(config).toEqual({ url: 'https://pve:8006', tokenId: 'u@pam!t' });
+    expect(secrets).toEqual({ tokenSecret: 'shh' });
+  });
+
+  test('mask redacts only secret values', () => {
+    const masked = registry.mask('proxmox', { url: 'https://pve:8006', tokenId: 'u@pam!t', tokenSecret: 'shh' });
+    expect(masked.url).toBe('https://pve:8006');
+    expect(masked.tokenId).toBe('u@pam!t');
+    expect(masked.tokenSecret).toBe('********');
+  });
+
+  test('getModule throws for an unknown type', () => {
+    expect(() => registry.getModule('does-not-exist')).toThrow(/Unknown plugin type/);
+  });
+
+  test('getModule returns a module with run()/discover()', () => {
+    const mod = registry.getModule('proxmox');
+    expect(typeof mod.run).toBe('function');
+    expect(typeof mod.discover).toBe('function');
+    expect(typeof mod.validate).toBe('function');
+  });
+});
+
+describe('plugin_secrets', () => {
+  const VALID_ID = '11111111-1111-4111-8111-111111111111';
+
+  beforeEach(() => { baoConf.get.mockReset(); baoConf.set.mockReset(); baoConf.request.mockReset(); });
+
+  test('read returns the data object', async () => {
+    baoConf.get.mockResolvedValue({ tokenSecret: 'shh' });
+    const out = await pluginSecrets.read(VALID_ID);
+    expect(out).toEqual({ tokenSecret: 'shh' });
+    expect(baoConf.get).toHaveBeenCalledWith(`plugins/${VALID_ID}/conf`);
+  });
+
+  test('read returns {} when none stored', async () => {
+    baoConf.get.mockResolvedValue(null);
+    expect(await pluginSecrets.read(VALID_ID)).toEqual({});
+  });
+
+  test('write drops blank and masked placeholder values', async () => {
+    await pluginSecrets.write(VALID_ID, { tokenSecret: 'new', keep: '********', blank: '' });
+    expect(baoConf.set).toHaveBeenCalledWith(`plugins/${VALID_ID}/conf`, { tokenSecret: 'new' });
+  });
+
+  test('mergeForRun layers secrets over the row config', async () => {
+    baoConf.get.mockResolvedValue({ tokenSecret: 'shh' });
+    const instance = { id: VALID_ID, config: { url: 'https://pve:8006', tokenId: 'u@pam!t' } };
+    const cfg = await pluginSecrets.mergeForRun(instance);
+    expect(cfg).toEqual({ url: 'https://pve:8006', tokenId: 'u@pam!t', tokenSecret: 'shh' });
+  });
+
+  test('read rejects a non-uuid id', async () => {
+    await expect(pluginSecrets.read('not-a-uuid')).rejects.toThrow(/invalid plugin instance id/);
+  });
+
+  test('remove is best-effort (404 is fine)', async () => {
+    baoConf.request.mockResolvedValue({ status: 404 });
+    await expect(pluginSecrets.remove(VALID_ID)).resolves.toBeUndefined();
+  });
+});
+
+describe('PluginInstance model', () => {
+  const marker = 'test_plugin_' + Date.now();
+  const created = [];
+
+  async function makeInstance(slug, extra = {}) {
+    const r = await PluginInstance.create({
+      pluginType: 'proxmox',
+      category: 'discovery',
+      name: 'Test ' + slug,
+      slug: `${marker}_${slug}`,
+      enabled: true,
+      cron: '0 * * * *',
+      config: { url: 'https://pve:8006' },
+      ...extra
+    });
+    created.push(r);
+    return r;
+  }
+
+  beforeAll(async () => {
+    const { initORM } = require('../models');
+    await initORM();
+  });
+
+  afterAll(async () => {
+    for (const r of created) {
+      try { await r.delete(); } catch (_) {}
+    }
+  });
+
+  test('create generates a uuid id and round-trips json config', async () => {
+    const r = await makeInstance('a');
+    expect(r.id).toMatch(/^[0-9a-f-]{36}$/i);
+    const fetched = await PluginInstance.get(r.id);
+    expect(fetched.slug).toBe(`${marker}_a`);
+    expect(fetched.config).toEqual({ url: 'https://pve:8006' });
+  });
+
+  test('slug is unique', async () => {
+    await makeInstance('dup');
+    await expect(makeInstance('dup')).rejects.toThrow(/Validation error|SequelizeUniqueConstraint/i);
+  });
+
+  test('getBySlug resolves', async () => {
+    const r = await makeInstance('bySlug');
+    const found = await PluginInstance.getBySlug(`${marker}_bySlug`);
+    expect(found.id).toBe(r.id);
+  });
+
+  test('listEnabled returns only enabled instances', async () => {
+    const on = await makeInstance('on', { enabled: true });
+    const off = await makeInstance('off', { enabled: false });
+    const enabled = await PluginInstance.listEnabled();
+    const slugs = enabled.map(e => e.slug);
+    expect(slugs).toContain(on.slug);
+    expect(slugs).not.toContain(off.slug);
+  });
+});
@@ -1,53 +0,0 @@
-'use strict';
-const conf = require('@simpleworkjs/conf');
-const VAULT_URL = process.env.VAULT_ADDR || 'http://openbao:8200';
-const VAULT_TOKEN = process.env.VAULT_TOKEN || ('ro' + 'ot');
-
-async function getVaultConf() {
-  try {
-    const res = await fetch(`${VAULT_URL}/v1/secret/data/sso-manager/conf`, {
-      headers: { 'X-Vault-Token': VAULT_TOKEN }
-    });
-    if (res.status === 200) {
-      const json = await res.json();
-      return json.data.data;
-    }
-  } catch (err) {
-    console.error('Error fetching conf from Vault:', err);
-  }
-  return null;
-}
-
-async function setVaultConf(newConf) {
-  const res = await fetch(`${VAULT_URL}/v1/secret/data/sso-manager/conf`, {
-    method: 'POST',
-    headers: { 'X-Vault-Token': VAULT_TOKEN, 'Content-Type': 'application/json' },
-    body: JSON.stringify({ data: newConf })
-  });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Vault API error: ${res.status} ${text}`);
-  }
-  applyConf(newConf);
-}
-
-function applyConf(newConf) {
-  if (!newConf) return;
-  // Deep merge into conf
-  for (const key of Object.keys(newConf)) {
-    if (typeof newConf[key] === 'object' && newConf[key] !== null && !Array.isArray(newConf[key])) {
-      conf[key] = { ...conf[key], ...newConf[key] };
-    } else {
-      conf[key] = newConf[key];
-    }
-  }
-}
-
-async function init() {
-  const vaultConf = await getVaultConf();
-  if (vaultConf) {
-    applyConf(vaultConf);
-  }
-}
-
-module.exports = { getVaultConf, setVaultConf, init };
@@ -0,0 +1,91 @@
+'use strict';
+
+// Per-instance plugin secrets, stored in OpenBao at `secret/plugins/<id>/conf`.
+//
+// Plugins run in-process (as BullMQ workers in the SSO Node process), so they
+// need no OpenBao token of their own — the SSO reads/writes their secrets
+// server-side through the `sso-broker` token (@simpleworkjs/bao-conf), exactly
+// like it reads its own `secret/sso-manager/conf`. This mirrors the per-user
+// (`secret/users/<uid>/*`) and per-app (`secret/apps/<name>/*`) namespaces.
+//
+// Only the configSchema fields flagged `secret:true` are stored here; the rest
+// of an instance's config lives in the PluginInstance DB row. The admin UI
+// only ever sees these masked (`********`).
+//
+// Requires theta-suite >= v1.30.1: the sso-broker policy must grant
+// `secret/data/plugins/*` + `secret/metadata/plugins/*`. Without it, write/
+// read fail with a 403 — the API surfaces that as a clear error so the operator
+// knows to re-run `./setup.sh`.
+
+const baoConf = require('@simpleworkjs/bao-conf');
+
+// Instance ids are ORM-generated uuids, so this is defense-in-depth against a
+// bogus id ever being interpolated into a secret path. 404s are expected
+// (no secret written yet); other malformed input is rejected hard.
+function assertId(id) {
+  if (typeof id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) {
+    const err = new Error('invalid plugin instance id for secret path');
+    err.status = 400;
+    throw err;
+  }
+}
+
+function path(id) {
+  return `plugins/${id}/conf`; // baoConf.get/set add the secret/data prefix
+}
+
+// Read the secret field values for an instance. Returns {} when none are
+// stored yet (a brand-new instance, or one with no secret fields). A 404 from
+// OpenBao is normal — anything else propagates.
+async function read(id) {
+  assertId(id);
+  try {
+    const data = await baoConf.get(path(id));
+    return (data && typeof data === 'object') ? data : {};
+  } catch (err) {
+    // bao-conf treats a missing KV path as null/empty, but a 403 means the
+    // sso-broker policy lacks secret/plugins/* — surface that distinctly.
+    if (err && /403|permission/i.test(err.message)) throw err;
+    return {};
+  }
+}
+
+// Write (replace) the secret field values for an instance. `secrets` is a flat
+// {field: value} object of only the secret configSchema fields. Empty/blank
+// values are dropped so we never store a masked placeholder back as a secret.
+async function write(id, secrets) {
+  assertId(id);
+  const clean = {};
+  for (const [k, v] of Object.entries(secrets || {})) {
+    if (v === undefined || v === null || v === '' || v === '********') continue;
+    clean[k] = v;
+  }
+  await baoConf.set(path(id), clean);
+}
+
+// Merge the stored secret field values over the instance's non-secret config,
+// producing the single `config` object the plugin's run()/validate() receive.
+// Non-secret values come from the DB row; secret values come from OpenBao.
+async function mergeForRun(instance) {
+  if (!instance) return {};
+  const config = (instance.config && typeof instance.config === 'object') ? instance.config : {};
+  const secrets = await read(instance.id);
+  return { ...config, ...secrets };
+}
+
+// Best-effort delete of the instance's secret namespace. Called when an
+// instance is deleted. A 404 (already gone / never written) is fine; anything
+// else is logged and swallowed so a stuck OpenBao can't strand an instance row.
+async function remove(id) {
+  assertId(id);
+  try {
+    const res = await baoConf.request('DELETE', `secret/metadata/plugins/${id}/conf`);
+    if (res && res.status && res.status !== 404 && !res.ok) {
+      console.error(`[plugin_secrets] delete for ${id} returned ${res.status}`);
+    }
+  } catch (err) {
+    console.error(`[plugin_secrets] failed to delete secrets for ${id}:`, err.message);
+  }
+}
+
+module.exports = { read, write, remove, mergeForRun };
@@ -38,15 +38,15 @@ module.exports = {
 	// app-base.js, which reveals .group-required-<cn> for each group the user is
 	// in (plus the synthetic `admin` group when user/me reports isAdmin).
 	nav: [
-		// Ungated on purpose: the catalog is the one page that exists for
-		// ordinary users. Before this, every nav item was admin-only and a
-		// non-admin had no signposted destination at all.
-		{href: '/', icon: 'fa-solid fa-compass', label: 'Catalog', groups: []},
+		// Catalog requires login - it's the end-user view of their accessible resources.
+		{href: '/', icon: 'fa-solid fa-compass', label: 'Catalog', groups: ['login']},
 		{href: '/users', icon: 'fa-solid fa-users', label: 'Users', groups: ['app_sso_admin', 'admin']},
 		{href: '/groups', icon: 'fas fa-users-cog', label: 'Groups', groups: ['app_sso_admin']},
 		{href: '/conf', icon: 'fas fa-cogs', label: 'Configuration', groups: ['app_sso_admin']},
 		{href: '/directory', icon: 'fa-solid fa-server', label: 'Directory', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
-		{href: '/vault', icon: 'fa-solid fa-vault', label: 'Vault', groups: []},
+		{href: '/plugins', icon: 'fa-solid fa-plug', label: 'Plugins', groups: ['app_sso_admin', 'app_sso_directory_admin', 'admin']},
+		// Vault requires login - per-user secrets at secret/users/<uid>/*.
+		{href: '/vault', icon: 'fa-solid fa-vault', label: 'Vault', groups: ['login']},
 		{href: '/overview', icon: 'fa-solid fa-gauge-high', label: 'Overview', groups: ['app_sso_admin', 'admin']},
 	],
 };
@@ -0,0 +1,244 @@
+'use strict';
+
+// Vault broker — mints scoped OpenBao tokens for end users, admins, and
+// external apps, using the SSO_VAULT_TOKEN (policy `sso-broker`) and the
+// `sso-broker` token role created by theta-env/setup.sh.
+//
+//   secret/users/<uid>/*   per-user personal KV (user-<uid> policy)
+//   secret/apps/<name>/*   per-external-app namespace (app-<name> policy)
+//   secret/*               admin UI sessions (sso-admin policy)
+//
+// The sso-broker policy grants update on auth/token/create/sso-broker and on
+// sys/policies/acl/user-*, app-*, sso-admin — exactly what this module needs to
+// create the per-subject policies and mint their tokens. Per-user/admin tokens
+// are cached in Redis for the token's lifetime and re-minted on miss; per-app
+// tokens are returned ONCE (displayed in the UI, never stored retrievably).
+
+const baoConf = require('@simpleworkjs/bao-conf');
+const { createClient } = require('redis');
+const express = require('express');
+const { createProxyMiddleware, fixRequestBody } = require('http-proxy-middleware');
+const conf = require('@simpleworkjs/conf');
+const permission = require('./permission');
+
+const ROLE = 'sso-broker';
+const DEFAULT_TTL = 24 * 60 * 60; // matches the role's token_period (24h)
+
+let redisClient;
+async function getRedis() {
+	if (!redisClient) {
+		const url = (conf.redis && typeof conf.redis === 'string') ? conf.redis
+			: (conf.redis && conf.redis.url) ? conf.redis.url : undefined;
+		redisClient = createClient({ url });
+		redisClient.on('error', (err) => console.error('Redis vault_broker error', err));
+		await redisClient.connect();
+	}
+	return redisClient;
+}
+
+async function cacheGet(key) {
+	try { return await (await getRedis()).get(key); } catch (e) { return null; }
+}
+async function cacheSet(key, value, ttl) {
+	try { await (await getRedis()).set(key, value, { EX: ttl }); } catch (e) { /* best-effort */ }
+}
+
+// Low-level OpenBao call via @simpleworkjs/bao-conf.request (authenticates with
+// SSO_VAULT_TOKEN). Throws on non-2xx.
+async function bao(method, path, body) {
+	const res = await baoConf.request(method, path, body);
+	if (!res.ok) {
+		const text = await res.text().catch(() => '');
+		throw new Error(`OpenBao ${method} ${path} failed (${res.status}) ${text}`);
+	}
+	return res;
+}
+
+// Ensure an ACL policy exists AND carries the latest HCL. Always (re)writes —
+// `bao policy write` is an idempotent overwrite — so policy edits (e.g. adding
+// a list grant on a directory path) propagate on the next vault-page visit
+// without an operator re-running setup.sh. Skipping on an existing policy
+// would strand the old, narrower HCL forever.
+async function ensurePolicy(name, hcl) {
+	const existing = await baoConf.request('GET', `sys/policies/acl/${name}`);
+	if (existing.status !== 200 && existing.status !== 404) {
+		const t = await existing.text().catch(() => '');
+		throw new Error(`OpenBao policy read ${name} failed (${existing.status}) ${t}`);
+	}
+	await bao('PUT', `sys/policies/acl/${name}`, { policy: hcl });
+}
+
+// Mint a token through the sso-broker role with the given policies. Returns
+// { token, ttl } (ttl = lease_duration seconds, falls back to DEFAULT_TTL).
+async function mintToken(policies) {
+	const res = await bao('POST', 'auth/token/create/sso-broker', { policies });
+	const json = await res.json();
+	const token = json && json.auth && json.auth.client_token;
+	if (!token) throw new Error(`OpenBao token mint returned no client_token: ${JSON.stringify(json)}`);
+	const ttl = (json.auth && json.auth.lease_duration) || DEFAULT_TTL;
+	return { token, ttl };
+}
+
+// ── Per-user token ──────────────────────────────────────────────────────────
+function userPolicyHcl(uid) {
+	// uid is an LDAP uid (alphanumeric + a few separators); it is interpolated
+	// into a policy path, so reject anything but a safe charset.
+	// The bare `secret/metadata/users/<uid>` grant is required to LIST the
+	// contents of the namespace: `.../*` covers nested paths but NOT the
+	// directory itself, so without it the /vault secrets list 403s.
+	return `path "secret/data/users/${uid}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+path "secret/metadata/users/${uid}" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/users/${uid}/" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/users/${uid}/*" { capabilities = ["list", "read", "delete"] }`;
+}
+
+// Mint (or return the cached) per-user token confined to secret/users/<uid>/*.
+// Re-minted when the cache entry expires (a little before the token's own TTL).
+async function getOrCreateUserToken(uid) {
+	if (!/^[A-Za-z0-9._-]{1,64}$/.test(uid)) throw new Error(`invalid uid for vault token: ${uid}`);
+	const cacheKey = `vault_token:${uid}`;
+	const cached = await cacheGet(cacheKey);
+	if (cached) return cached;
+	await ensurePolicy(`user-${uid}`, userPolicyHcl(uid));
+	const { token, ttl } = await mintToken([`user-${uid}`]);
+	await cacheSet(cacheKey, token, Math.max(ttl - 60, 60));
+	return token;
+}
+
+// ── Admin token (read/write all of secret/) ─────────────────────────────────
+async function getOrCreateAdminToken(uid) {
+	const cacheKey = `vault_token:admin:${uid || 'global'}`;
+	const cached = await cacheGet(cacheKey);
+	if (cached) return cached;
+	const { token, ttl } = await mintToken(['sso-admin']);
+	await cacheSet(cacheKey, token, Math.max(ttl - 60, 60));
+	return token;
+}
+
+// ── Per-app token (minted ONCE, returned to the caller, never cached) ───────
+function appPolicyHcl(name) {
+	// The bare `secret/metadata/apps/<name>` grant lets an app LIST its own
+	// namespace root (see userPolicyHcl for why `/*` alone isn't enough).
+	return `path "secret/data/apps/${name}/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+path "secret/metadata/apps/${name}" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/apps/${name}/*" { capabilities = ["list", "read", "delete"] }`;
+}
+
+// Create the app-<name> policy + mint a token for it. Returns the token ONCE
+// (the admin UI shows it with a copy button); it is not stored retrievably, so
+// a later compromise of an admin session cannot recover previously-minted app
+// tokens. The caller must record it in the external app immediately.
+async function mintAppToken(name) {
+	if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)) {
+		throw new Error('invalid app name (lowercase letters, digits, hyphens; max 63 chars)');
+	}
+	await ensurePolicy(`app-${name}`, appPolicyHcl(name));
+	const { token, ttl } = await mintToken([`app-${name}`]);
+	return { token, ttl, policy: `app-${name}`, path: `secret/apps/${name}/` };
+}
+
+// ── /api/vault proxy: scope guard + token-injecting proxy ───────────────────
+// Replaces the old bare pass-through (which sent no X-Vault-Token and gated
+// nothing). The guard mints a server-side token for the user (per-user or
+// admin) and enforces the path prefix as defense-in-depth on top of the
+// token's own policy; the proxy injects ONLY that token and strips the
+// client's sso auth headers so OpenBao never sees them.
+
+const VAULT_ADDR = process.env.VAULT_ADDR || 'http://openbao:8200';
+const ADMIN_GROUP = 'app_sso_admin';
+
+async function isAdmin(user) {
+	try {
+		await permission.byGroup(user, [ADMIN_GROUP]);
+		return true;
+	} catch (e) {
+		return false;
+	}
+}
+
+// Normalize a KV-v2 request path by stripping the data/metadata segment so the
+// prefix check works on the logical path: /secret/data/users/alice/foo ->
+// /secret/users/alice/foo. Returns null if the path isn't under /secret/.
+function normalizeVaultPath(p) {
+	const norm = p.replace(/^\/secret\/(data|metadata)\//, '/secret/');
+	if (norm !== '/secret' && !norm.startsWith('/secret/')) return null;
+	return norm;
+}
+
+async function scopeGuard(req, res, next) {
+	if (!req.user || req.user.isMachine) {
+		return res.status(403).json({ error: 'machine tokens cannot use the vault API' });
+	}
+	const uid = req.user.uid;
+	const admin = await isAdmin(req.user);
+	let token;
+	try {
+		token = admin ? await getOrCreateAdminToken(uid) : await getOrCreateUserToken(uid);
+	} catch (e) {
+		return res.status(503).json({ error: 'vault broker unavailable', detail: e.message });
+	}
+
+	// Defense-in-depth: confirm the requested path is within the subject's
+	// namespace. Admins roam all of secret/; users are confined to
+	// secret/users/<uid>/. (The token's own policy enforces the same at the
+	// OpenBao layer; this catches a buggy/malicious client early with a clear
+	// 403 instead of an opaque OpenBao denial.)
+	const norm = normalizeVaultPath(req.path);
+	if (norm === null) {
+		return res.status(403).json({ error: 'vault paths must be under /secret/' });
+	}
+	const base = `/secret/users/${uid}`;
+	const allowed = admin || norm === base || norm.startsWith(base + '/');
+	if (!allowed) {
+		return res.status(403).json({ error: 'path outside your vault namespace' });
+	}
+
+	req.vaultToken = token;
+	req.vaultIsAdmin = admin;
+	next();
+}
+
+function vaultProxy() {
+	return createProxyMiddleware({
+		target: VAULT_ADDR,
+		changeOrigin: true,
+		pathRewrite: { '^/api/vault': '/v1' },
+		on: {
+			proxyReq(proxyReq, req, res, options) {
+				fixRequestBody(proxyReq, req, res, options);
+				// Inject ONLY the server-minted scoped token; strip the client's
+				// sso session/api auth so it never reaches OpenBao.
+				proxyReq.setHeader('X-Vault-Token', req.vaultToken);
+				proxyReq.removeHeader('auth-token');
+				proxyReq.removeHeader('authorization');
+			},
+		},
+	});
+}
+
+// Admin-only: mint a one-time token for an external app. POST /api/vault/apps
+// { name } -> { token, ttl, policy, path }. The token is returned ONCE and is
+// not cached/stored retrievably. Mount BEFORE the /api/vault proxy.
+const mintAppRouter = express.Router();
+mintAppRouter.post('/', async (req, res, next) => {
+	try {
+		await permission.byGroup(req.user, [ADMIN_GROUP]);
+		const name = (req.body && req.body.name || '').trim();
+		if (!name) return res.status(400).json({ error: 'name is required' });
+		const result = await mintAppToken(name);
+		res.json(result);
+	} catch (e) {
+		if (e.status === 401) return res.status(403).json({ error: 'admin only' });
+		next(e);
+	}
+});
+
+module.exports = {
+	getOrCreateUserToken,
+	getOrCreateAdminToken,
+	mintAppToken,
+	ensurePolicy,
+	scopeGuard,
+	vaultProxy,
+	mintAppRouter,
+};
@@ -4,6 +4,8 @@

 	$(document).ready(function() {
 		loadConf();
+		loadProxyConf();
+		loadTos();
 	});

 	async function loadConf() {
@@ -28,6 +30,13 @@
 					$('#oauth-token-refresh').val(data.oauth.token_lifetime.refresh_token || 2592000);
 				}
 			}
+
+			// Populate SMS (VoIP.ms)
+			if (data.voipms) {
+				$('#voipms-username').val(data.voipms.username || '');
+				$('#voipms-did').val(data.voipms.did || '');
+				$('#voipms-password').val(data.voipms.password || '');
+			}
 		} catch (error) {
 			app.messages.toast('Failed to load configuration: ' + (error.message || 'Unknown error'), 'danger');
 		}
@@ -36,7 +45,7 @@
 	async function saveConf() {
 		const btn = $('#btn-save');
 		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Saving...');
-		
+
 		const payload = {
 			smtp: {
 				host: $('#smtp-host').val(),
@@ -53,6 +62,11 @@
 					access_token: parseInt($('#oauth-token-access').val(), 10) || 3600,
 					refresh_token: parseInt($('#oauth-token-refresh').val(), 10) || 2592000
 				}
+			},
+			voipms: {
+				username: $('#voipms-username').val(),
+				did: $('#voipms-did').val(),
+				password: $('#voipms-password').val()
 			}
 		};

@@ -65,7 +79,82 @@
 			btn.prop('disabled', false).html('<i class="fas fa-save"></i> Save Configuration');
 		}
 	}
-	
+
+	async function sendTestEmail() {
+		const to = $('#test-email-to').val().trim();
+		if (!to) {
+			app.messages.toast('Please enter a recipient email address', 'warning');
+			return;
+		}
+
+		const $inputGroup = $('#test-email-to').closest('.input-group');
+		const btn = $inputGroup.find('button');
+		const originalHtml = btn.html();
+		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Sending...');
+
+		try {
+			// First save the SMTP config, then send test email
+			const payload = {
+				smtp: {
+					host: $('#smtp-host').val(),
+					port: parseInt($('#smtp-port').val(), 10) || 587,
+					user: $('#smtp-user').val(),
+					pass: $('#smtp-pass').val(),
+					from: $('#smtp-from').val(),
+					secure: $('#smtp-secure').is(':checked')
+				}
+			};
+
+			// Save config first
+			await app.api.post('conf', payload);
+
+			// Then send test email
+			const result = await app.api.post('conf/test-email', { to });
+			app.messages.toast(result.message || 'Test email sent!', 'success');
+			$('#test-email-to').val('');
+		} catch (error) {
+			app.messages.toast('Failed to send test email: ' + (error.message || 'Unknown error'), 'danger');
+		} finally {
+			btn.prop('disabled', false).html(originalHtml);
+		}
+	}
+
+	async function sendTestSms() {
+		const to = $('#test-sms-to').val().trim();
+		if (!to) {
+			app.messages.toast('Please enter a recipient phone number', 'warning');
+			return;
+		}
+
+		const $inputGroup = $('#test-sms-to').closest('.input-group');
+		const btn = $inputGroup.find('button');
+		const originalHtml = btn.html();
+		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Sending...');
+
+		try {
+			// First save the VoIP.ms config, then send test SMS
+			const payload = {
+				voipms: {
+					username: $('#voipms-username').val(),
+					did: $('#voipms-did').val(),
+					password: $('#voipms-password').val()
+				}
+			};
+
+			// Save config first
+			await app.api.post('conf', payload);
+
+			// Then send test SMS
+			const result = await app.api.post('conf/test-sms', { to });
+			app.messages.toast(result.message || 'Test SMS sent!', 'success');
+			$('#test-sms-to').val('');
+		} catch (error) {
+			app.messages.toast('Failed to send test SMS: ' + (error.message || 'Unknown error'), 'danger');
+		} finally {
+			btn.prop('disabled', false).html(originalHtml);
+		}
+	}
+
 	function togglePassword(id) {
 		const el = document.getElementById(id);
 		if (el.type === 'password') {
@@ -74,6 +163,91 @@
 			el.type = 'password';
 		}
 	}
+
+	async function loadProxyConf() {
+		try {
+			const data = await app.api.get('conf/proxy');
+			if (data.oidc) {
+				$('#proxy-issuer').val(data.oidc.issuer || '');
+				$('#proxy-client-id').val(data.oidc.clientId || '');
+				$('#proxy-client-secret').val(data.oidc.clientSecret || '');
+			}
+			if (data.ldap) {
+				$('#proxy-ldap-bindpass').val(data.ldap.bindPassword || '');
+			}
+		} catch (error) {
+			console.error('Failed to load Proxy conf:', error);
+		}
+	}
+
+	async function saveProxyConf() {
+		const btn = $('#btn-save-proxy');
+		btn.prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Saving...');
+		
+		const payload = {
+			oidc: {
+				issuer: $('#proxy-issuer').val(),
+				clientId: $('#proxy-client-id').val(),
+				clientSecret: $('#proxy-client-secret').val()
+			},
+			ldap: {
+				bindPassword: $('#proxy-ldap-bindpass').val()
+			}
+		};
+
+		try {
+			await app.api.post('conf/proxy', payload);
+			app.messages.toast('Proxy configuration saved securely to OpenBao!', 'success');
+		} catch (error) {
+			app.messages.toast('Failed to save Proxy configuration: ' + error.message, 'danger');
+		} finally {
+			btn.prop('disabled', false).html('<i class="fas fa-save"></i> Save Proxy Secrets');
+		}
+	}
+
+	// ── Terms of Service editor ──────────────────────────────────────────
+	// Moved here from the admin Overview dashboard — it's a configuration
+	// control, so it belongs on the System Configuration page. The API is
+	// routes/tos.js (GET to read, PUT to save; PUT is app_sso_admin-gated, which
+	// matches this page's gate). app.tos.get/update are the shared frontend
+	// helpers (@simpleworkjs/frontend).
+	async function loadTos() {
+		try {
+			const tos = await app.tos.get();
+			document.getElementById('tos-content').value = tos.content;
+			document.getElementById('tos-meta').textContent =
+				'Last updated ' + moment(tos.updated_on, 'x').fromNow() + ' by ' + tos.updated_by;
+		} catch(e) {
+			console.error('Failed to load ToS:', e);
+		}
+	}
+
+	function saveTos() {
+		const content = document.getElementById('tos-content').value.trim();
+		const resetAcceptance = document.getElementById('tos-reset-acceptance').checked;
+		const msgEl = document.getElementById('tos-result');
+
+		if (!content) {
+			msgEl.className = 'alert alert-danger mt-2';
+			msgEl.textContent = 'Terms of Service text cannot be empty.';
+			msgEl.style.display = '';
+			return;
+		}
+
+		app.tos.update({content, resetAcceptance}, function(error, data) {
+			if (error) {
+				msgEl.className = 'alert alert-danger mt-2';
+				msgEl.textContent = 'Failed: ' + ((data && data.message) || error);
+				msgEl.style.display = '';
+				return;
+			}
+			msgEl.className = 'alert alert-success mt-2';
+			msgEl.textContent = 'Saved.' + (data.resetCount ? ' ' + data.resetCount + ' user(s) will be asked to re-accept.' : '');
+			msgEl.style.display = '';
+			document.getElementById('tos-reset-acceptance').checked = false;
+			loadTos();
+		});
+	}
 </script>

 <div class="container py-4">
@@ -82,8 +256,10 @@
 			<div>
 				<h2><i class="fas fa-cogs"></i> System Configuration</h2>
 				<p class="text-muted mb-0">
-					Manage runtime configuration such as SMTP settings and OAuth parameters.
-					These secrets are stored securely in OpenBao Vault.
+					Manage runtime configuration such as SMTP, SMS, OAuth, and Terms of Service
+					settings. These are stored securely in OpenBao and take effect immediately.
+					Secret fields (the SMTP password, OAuth JWT secret, and VoIP.ms API password)
+					are masked — leave them unchanged to keep the stored value.
 				</p>
 			</div>
 			<div>
@@ -93,9 +269,28 @@
 		</div>
 	</div>

-	<div class="row">
-		<div class="col-md-6 mb-4">
-			<div class="card shadow-sm border-0 h-100">
+	<ul class="nav nav-tabs mb-4" id="confTabs" role="tablist">
+		<li class="nav-item" role="presentation">
+			<button class="nav-link active" id="smtp-tab" data-bs-toggle="tab" data-bs-target="#smtp" type="button" role="tab">SMTP Settings</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="oauth-tab" data-bs-toggle="tab" data-bs-target="#oauth" type="button" role="tab">OAuth & JWT</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="sms-tab" data-bs-toggle="tab" data-bs-target="#sms" type="button" role="tab">SMS (VoIP.ms)</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="tos-tab" data-bs-toggle="tab" data-bs-target="#tos" type="button" role="tab">Terms of Service</button>
+		</li>
+		<li class="nav-item" role="presentation">
+			<button class="nav-link" id="proxy-tab" data-bs-toggle="tab" data-bs-target="#proxy" type="button" role="tab">Proxy Secrets</button>
+		</li>
+	</ul>
+
+	<div class="tab-content" id="confTabsContent">
+		<!-- SMTP Tab -->
+		<div class="tab-pane fade show active" id="smtp" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
 				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
 					<h5 class="mb-0"><i class="fas fa-envelope text-primary me-2"></i> SMTP Settings</h5>
 				</div>
@@ -115,9 +310,32 @@
 					<div class="mb-3">
 						<label class="form-label">Password</label>
 						<div class="input-group">
-							<input type="password" class="form-control" id="smtp-pass">
+							<input type="password" class="form-control" id="smtp-pass" placeholder="********">
 							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('smtp-pass')"><i class="fas fa-eye"></i></button>
 						</div>
+						<div class="form-text">Leave unchanged to keep the current password stored in OpenBao. Clear and type a new value to replace it.</div>
+					<hr class="my-4">
+					<div class="mb-3">
+						<label class="form-label">Send Test SMS</label>
+						<div class="input-group">
+							<input type="tel" class="form-control" id="test-sms-to" placeholder="+15551234567">
+							<button class="btn btn-outline-primary" type="button" onclick="sendTestSms()">
+								<i class="fas fa-paper-plane"></i> Send Test SMS
+							</button>
+						</div>
+						<div class="form-text">Send a test SMS to verify your VoIP.ms configuration is working.</div>
+					</div>
+					</div>
+					<hr class="my-4">
+					<div class="mb-3">
+						<label class="form-label">Send Test SMS</label>
+						<div class="input-group">
+							<input type="tel" class="form-control" id="test-sms-to" placeholder="+15551234567">
+							<button class="btn btn-outline-primary" type="button" onclick="sendTestSms()">
+								<i class="fas fa-paper-plane"></i> Send Test SMS
+							</button>
+						</div>
+						<div class="form-text">Send a test SMS to verify your VoIP.ms configuration is working.</div>
 					</div>
 					<div class="mb-3">
 						<label class="form-label">From Address</label>
@@ -127,12 +345,24 @@
 						<input class="form-check-input" type="checkbox" id="smtp-secure">
 						<label class="form-check-label">Use Secure (TLS)</label>
 					</div>
+						<hr class="my-4">
+						<div class="mb-3">
+							<label class="form-label">Send Test Email</label>
+							<div class="input-group">
+								<input type="email" class="form-control" id="test-email-to" placeholder="recipient@example.com">
+								<button class="btn btn-outline-primary" type="button" onclick="sendTestEmail()">
+									<i class="fas fa-paper-plane"></i> Send Test Email
+								</button>
+							</div>
+							<div class="form-text">Send a test email to verify your SMTP configuration is working.</div>
+						</div>
 				</div>
 			</div>
 		</div>

-		<div class="col-md-6 mb-4">
-			<div class="card shadow-sm border-0 h-100">
+		<!-- OAuth Tab -->
+		<div class="tab-pane fade" id="oauth" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
 				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
 					<h5 class="mb-0"><i class="fas fa-key text-success me-2"></i> OAuth & JWT Settings</h5>
 				</div>
@@ -144,9 +374,10 @@
 					<div class="mb-3">
 						<label class="form-label">JWT Secret</label>
 						<div class="input-group">
-							<input type="password" class="form-control" id="oauth-jwtsecret">
+							<input type="password" class="form-control" id="oauth-jwtsecret" placeholder="********">
 							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('oauth-jwtsecret')"><i class="fas fa-eye"></i></button>
 						</div>
+						<div class="form-text">Leave unchanged to keep the current secret stored in OpenBao. Clear and type a new value to replace it.</div>
 					</div>
 					<div class="mb-3">
 						<label class="form-label">Access Token Lifetime (seconds)</label>
@@ -159,6 +390,107 @@
 				</div>
 			</div>
 		</div>
+
+		<!-- SMS Tab -->
+		<div class="tab-pane fade" id="sms" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
+					<h5 class="mb-0"><i class="fas fa-comment text-info me-2"></i> SMS (VoIP.ms)</h5>
+				</div>
+				<div class="card-body">
+					<p class="form-text">Used to deliver SMS 2FA login codes. The API password is stored in OpenBao and masked below.</p>
+					<div class="mb-3">
+						<label class="form-label">API Username</label>
+						<input type="text" class="form-control" id="voipms-username">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">DID (sender number)</label>
+						<input type="text" class="form-control" id="voipms-did" placeholder="15551234567">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">API Password</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="voipms-password" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('voipms-password')"><i class="fas fa-eye"></i></button>
+						</div>
+						<div class="form-text">Leave unchanged to keep the current password stored in OpenBao. Clear and type a new value to replace it.</div>
+					<hr class="my-4">
+					<div class="mb-3">
+						<label class="form-label">Send Test SMS</label>
+						<div class="input-group">
+							<input type="tel" class="form-control" id="test-sms-to" placeholder="+15551234567">
+							<button class="btn btn-outline-primary" type="button" onclick="sendTestSms()">
+								<i class="fas fa-paper-plane"></i> Send Test SMS
+							</button>
+						</div>
+						<div class="form-text">Send a test SMS to verify your VoIP.ms configuration is working.</div>
+					</div>
+				</div>
+			</div>
+		</div>
+
+		<!-- Proxy Secrets Tab -->
+		<div class="tab-pane fade" id="proxy" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0">
+					<h5 class="mb-0"><i class="fas fa-shield-alt text-warning me-2"></i> Proxy Secrets (OpenBao)</h5>
+				</div>
+				<div class="card-body">
+					<p class="form-text">These secrets are stored directly in OpenBao (`secret/proxy/conf`) and read by the Proxy at boot.</p>
+					
+					<h6 class="mt-3 mb-2">OAuth / OIDC Integration</h6>
+					<div class="mb-3">
+						<label class="form-label">Issuer URL</label>
+						<input type="text" class="form-control" id="proxy-issuer" placeholder="https://sso.example.com">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Client ID</label>
+						<input type="text" class="form-control" id="proxy-client-id">
+					</div>
+					<div class="mb-3">
+						<label class="form-label">Client Secret</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="proxy-client-secret" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('proxy-client-secret')"><i class="fas fa-eye"></i></button>
+						</div>
+					</div>
+
+					<h6 class="mt-4 mb-2">LDAP Integration</h6>
+					<div class="mb-3">
+						<label class="form-label">Bind Password</label>
+						<div class="input-group">
+							<input type="password" class="form-control" id="proxy-ldap-bindpass" placeholder="********">
+							<button class="btn btn-outline-secondary" type="button" onclick="togglePassword('proxy-ldap-bindpass')"><i class="fas fa-eye"></i></button>
+						</div>
+						<div class="form-text">Password for the Proxy's LDAP service account.</div>
+					</div>
+
+					<button id="btn-save-proxy" class="btn btn-warning mt-2" onclick="saveProxyConf()"><i class="fas fa-save"></i> Save Proxy Secrets</button>
+				</div>
+			</div>
+		</div>
+
+		<!-- ToS Tab -->
+		<div class="tab-pane fade" id="tos" role="tabpanel">
+			<div class="card shadow-sm border-0 mb-4">
+				<div class="card-header bg-white border-bottom-0 pt-4 pb-0 d-flex justify-content-between align-items-center">
+					<h5 class="mb-0"><i class="fas fa-file-contract me-2"></i> Terms of Service</h5>
+					<small class="text-muted" id="tos-meta"></small>
+				</div>
+				<div class="card-body">
+					<div class="mb-3">
+						<label class="form-label">Content <small class="text-muted">(Markdown)</small></label>
+						<textarea class="form-control" id="tos-content" rows="8"></textarea>
+					</div>
+					<div class="form-check mb-3">
+						<input class="form-check-input" type="checkbox" id="tos-reset-acceptance">
+						<label class="form-check-label" for="tos-reset-acceptance">Require all users to re-accept these terms</label>
+					</div>
+					<button class="btn btn-primary" onclick="saveTos()"><i class="fas fa-floppy-disk"></i> Save Terms</button>
+					<div id="tos-result" style="display:none" class="mt-2"></div>
+				</div>
+			</div>
+		</div>
 	</div>
 </div>

@@ -3,26 +3,25 @@
 <div class="container mt-4">
  <div class="row">
    <div class="col-12">
-      <ul class="nav nav-tabs mb-3 card-header-tabs" id="directoryTabs" role="tablist">
-        <li class="nav-item" role="presentation">
-          <button class="nav-link active" id="directory-tab" data-bs-toggle="tab" data-bs-target="#directory-tab-pane" type="button" role="tab" aria-controls="directory-tab-pane" aria-selected="true">
-            <i class="fa-solid fa-server"></i> Directory
-          </button>
-        </li>
-        <li class="nav-item" role="presentation">
-          <button class="nav-link" id="discovery-tab" data-bs-toggle="tab" data-bs-target="#discovery-tab-pane" type="button" role="tab" aria-controls="discovery-tab-pane" aria-selected="false">
-            <i class="fa-solid fa-network-wired"></i> Discovery
-          </button>
-        </li>
-        <li class="nav-item" role="presentation">
-          <button class="nav-link" id="plugins-tab" data-bs-toggle="tab" data-bs-target="#plugins-tab-pane" type="button" role="tab" aria-controls="plugins-tab-pane" aria-selected="false">
-            <i class="fa-solid fa-robot"></i> Agents & Scheduler
-          </button>
-        </li>
-      </ul>
-      <div class="tab-content" id="directoryTabsContent">
-        <div class="tab-pane fade show active" id="directory-tab-pane" role="tabpanel" aria-labelledby="directory-tab">
-			<div class="card shadow border-top-0">
+      <div class="card shadow">
+        <div class="card-header">
+          <ul class="nav nav-tabs card-header-tabs" id="directoryTabs" role="tablist">
+            <li class="nav-item" role="presentation">
+              <button class="nav-link active" id="directory-tab" data-bs-toggle="tab" data-bs-target="#directory-tab-pane" type="button" role="tab" aria-controls="directory-tab-pane" aria-selected="true">
+                <i class="fa-solid fa-server"></i> Directory
+              </button>
+            </li>
+            <li class="nav-item" role="presentation">
+              <button class="nav-link" id="discovery-tab" data-bs-toggle="tab" data-bs-target="#discovery-tab-pane" type="button" role="tab" aria-controls="discovery-tab-pane" aria-selected="false">
+                <i class="fa-solid fa-network-wired"></i> Discovery
+              </button>
+            </li>
+          </ul>
+        </div>
+        <div class="card-body p-0">
+          <div class="tab-content" id="directoryTabsContent">
+            <div class="tab-pane fade show active" id="directory-tab-pane" role="tabpanel" aria-labelledby="directory-tab">
+              <div class="border-0">
 				<div class="card-header d-flex flex-wrap justify-content-between align-items-center gap-2">
 				    <div>
    					<i class="fa-solid fa-server"></i> Directory Management
@@ -97,7 +96,7 @@
      
      <!-- Discovery Tab Pane -->
      <div class="tab-pane fade" id="discovery-tab-pane" role="tabpanel" aria-labelledby="discovery-tab">
-        <div class="card shadow border-top-0">
+        <div class="border-0">
          <div class="card-header d-flex flex-wrap justify-content-between align-items-center gap-2">
            <div>
              <i class="fa-solid fa-network-wired"></i> Network Discovery Dashboard
@@ -185,55 +184,9 @@
          </div>
        </div>
      </div>
-      
-      <!-- Agents Tab Pane -->
-      <div class="tab-pane fade" id="plugins-tab-pane" role="tabpanel" aria-labelledby="plugins-tab">
-        <div class="card shadow border-top-0">
-          <div class="card-header d-flex flex-wrap justify-content-between align-items-center gap-2">
-            <div>
-              <i class="fa-solid fa-robot"></i> Agents & Scheduler
-            </div>
-          </div>
-          <div class="p-3 pb-0 text-muted small border-bottom">
-            <i class="fa-solid fa-circle-info"></i> Manage background tasks and schedules. <a href="/docs/agents">Learn how to make and use custom agents</a>.
-          </div>
-          <div class="table-responsive">
-            <table class="card-body table table-hover mb-0 align-middle">
-              <thead class="table-light">
-                <tr>
-                  <th class="ps-3">Agent Name</th>
-                  <th>Cron Schedule</th>
-                  <th>Status</th>
-                  <th>Actions</th>
-                </tr>
-              </thead>
-              <tbody id="plugins-list" jq-repeat="plugins">
-                <tr>
-                  <td class="ps-3 fw-bold">{{name}}</td>
-                  <td><input type="text" class="form-control form-control-sm font-monospace" id="cron-{{name}}" value="{{cron}}" style="max-width: 150px;"></td>
-                  <td>
-                    {{#enabled}}<span class="badge bg-success">Enabled</span>{{/enabled}}
-                    {{^enabled}}<span class="badge bg-secondary">Disabled</span>{{/enabled}}
-                  </td>
-                  <td>
-                    <button class="btn btn-sm btn-outline-primary" onclick="updatePlugin('{{name}}')" title="Save Schedule">Save</button>
-                    {{#enabled}}<button class="btn btn-sm btn-outline-danger" onclick="togglePlugin('{{name}}', false)">Disable</button>{{/enabled}}
-                    {{^enabled}}<button class="btn btn-sm btn-outline-success" onclick="togglePlugin('{{name}}', true)">Enable</button>{{/enabled}}
-                  </td>
-                </tr>
-              </tbody>
-              <tbody id="plugins-empty-state" style="display: none;">
-                <tr>
-                  <td colspan="4" class="text-center py-4 text-muted">
-                    No agents configured.
-                  </td>
-                </tr>
-              </tbody>
-            </table>
          </div>
        </div>
      </div>
-      </div>
    </div>
  </div>
 </div>
@@ -1319,59 +1272,12 @@
    });
  }

-  // --- AGENT SCRIPTS ---
-  function loadPlugins() {
-    app.api.get('plugins', function(err, res) {
-      if(err) {
-        app.messages.toast("Error loading agents: " + (err.message || err), 'danger');
-        return;
-      }
-      const plugins = res.results || {};
-      const pluginNames = Object.keys(plugins);
-      
-      $.scope.plugins.empty();
-      if(pluginNames.length === 0) {
-        $('#plugins-list').hide();
-        $('#plugins-empty-state').show();
-      } else {
-        pluginNames.forEach(name => {
-          const config = plugins[name];
-          $.scope.plugins.push({
-            name: name,
-            cron: config.cron || '',
-            enabled: !!config.enabled
-          });
-        });
-        $('#plugins-list').show();
-        $('#plugins-empty-state').hide();
-      }
-    });
-  }
-
-  function updatePlugin(name) {
-    const cron = $('#cron-' + name).val();
-    app.api.put('plugins/' + name, {cron: cron}, function(err, res) {
-      if(err) {
-        app.messages.toast("Error saving agent schedule: " + (err.message || err), 'danger');
-        return;
-      }
-      app.messages.toast("Agent schedule saved successfully.", 'success');
-    });
-  }
-  
-  function togglePlugin(name, enable) {
-    app.api.put('plugins/' + name, {enabled: enable}, function(err, res) {
-      if(err) {
-        app.messages.toast("Error toggling agent: " + (err.message || err), 'danger');
-        return;
-      }
-      loadPlugins();
-    });
-  }
+  // Plugin scheduling moved to the dedicated /plugins page (the Agents &
+  // Scheduler tab here was its old home). Discovery inventory + the discovery
+  // results table remain on this page.

  $(document).ready(function(){
    loadDiscoveryResources();
-    loadPlugins();
  });
 </script>

@@ -21,11 +21,6 @@
          </div>
          <div class="d-flex flex-wrap gap-2 align-items-center">
            <input type="text" id="search-filter" class="form-control form-control-sm shadow-sm" placeholder="Search resources..." onkeyup="renderTable()" style="width: 250px;">
-            <select id="filter-managed" class="form-select form-select-sm shadow-sm" onchange="renderTable()" style="width: 150px;">
-              <option value="all">All Resources</option>
-              <option value="unmanaged" selected>Unmanaged Only</option>
-              <option value="managed">Managed Only</option>
-            </select>
          </div>
        </div>
        <div class="card-header actionMessage" style="display:none"></div>
@@ -132,10 +127,12 @@
      // Name search
      if(search && !r.name.toLowerCase().includes(search) && !r.slug.toLowerCase().includes(search)) return false;
      
-      // Managed filter
+      // Always hide items that have been committed to the catalog (managed)
      const isManaged = !!(r.metadata && r.metadata.managed);
-      if(managedFilter === 'managed' && !isManaged) return false;
-      if(managedFilter === 'unmanaged' && isManaged) return false;
+      if(isManaged) return false;
+      
+      const isAuto = r.metadata && r.metadata.discovery_sources && r.metadata.discovery_sources.length > 0 && !r.metadata.discovery_sources.includes('manual');
+      if(!isAuto) return false;

      return true;
    });
@@ -161,7 +158,7 @@
        return;
      }
      $('.actionMessage').html('<div class="alert alert-success alert-dismissible"><button type="button" class="btn-close" data-bs-dismiss="alert"></button>Successfully promoted! Created groups: ' + res.groups.join(', ') + '</div>').show();
-      renderTable();
+      loadResources();
    });
  }

@@ -162,50 +162,10 @@
 		}
 	}

-	// ── Terms of Service ──────────────────────────────────────────────────
-	async function loadTos() {
-		try {
-			const tos = await app.tos.get();
-			document.getElementById('tos-content').value = tos.content;
-			document.getElementById('tos-meta').textContent =
-				'Last updated ' + moment(tos.updated_on, 'x').fromNow() + ' by ' + tos.updated_by;
-		} catch(e) {
-			console.error('Failed to load ToS:', e);
-		}
-	}
-
-	function saveTos() {
-		const content = document.getElementById('tos-content').value.trim();
-		const resetAcceptance = document.getElementById('tos-reset-acceptance').checked;
-		const msgEl = document.getElementById('tos-result');
-
-		if (!content) {
-			msgEl.className = 'alert alert-danger mt-2';
-			msgEl.textContent = 'Terms of Service text cannot be empty.';
-			msgEl.style.display = '';
-			return;
-		}
-
-		app.tos.update({content, resetAcceptance}, function(error, data) {
-			if (error) {
-				msgEl.className = 'alert alert-danger mt-2';
-				msgEl.textContent = 'Failed: ' + ((data && data.message) || error);
-				msgEl.style.display = '';
-				return;
-			}
-			msgEl.className = 'alert alert-success mt-2';
-			msgEl.textContent = 'Saved.' + (data.resetCount ? ' ' + data.resetCount + ' user(s) will be asked to re-accept.' : '');
-			msgEl.style.display = '';
-			document.getElementById('tos-reset-acceptance').checked = false;
-			loadTos();
-		});
-	}
-
 	$(document).ready(function() {
 		loadDashboard();
 		loadHistory();
 		toggleFilterInputs();
-		loadTos();
 		loadMetrics();
 	});
 </script>
@@ -385,30 +345,6 @@
 		</div>
 	</div>

-	<!-- TOS Card -->
-	<div class="card shadow mb-5">
-		<div class="card-header d-flex justify-content-between align-items-center">
-			<div><i class="fa-solid fa-file-contract"></i> Terms of Service Editor</div>
-			<small class="text-muted" id="tos-meta"></small>
-		</div>
-		<div class="card-body">
-			<div class="mb-3">
-				<label class="form-label">Content <small class="text-muted">(Markdown)</small></label>
-				<textarea class="form-control shadow-sm" id="tos-content" rows="12"></textarea>
-			</div>
-			<div class="form-check mb-3">
-				<input class="form-check-input" type="checkbox" id="tos-reset-acceptance">
-				<label class="form-check-label" for="tos-reset-acceptance">
-					Require all users to re-accept these terms
-				</label>
-			</div>
-			<button class="btn btn-primary shadow-sm" onclick="saveTos()">
-				<i class="fa-solid fa-floppy-disk"></i> Save
-			</button>
-			<div id="tos-result" style="display:none" class="mt-3"></div>
-		</div>
-	</div>
-
 	<!-- Actionable Metrics Card -->
 	<div class="card shadow mb-5">
 		<div class="card-header d-flex justify-content-between align-items-center">
@@ -3,54 +3,73 @@
 <div class="container mt-4">
  <div class="row">
    <div class="col-12">
-      <ul class="nav nav-tabs mb-3">
-        <li class="nav-item">
-          <a class="nav-link" href="/directory"><i class="fa-solid fa-server"></i> Directory</a>
-        </li>
-        <li class="nav-item">
-          <a class="nav-link" href="/discovery"><i class="fa-solid fa-network-wired"></i> Discovery</a>
-        </li>
-        <li class="nav-item">
-          <a class="nav-link active" href="/plugins"><i class="fa-solid fa-plug"></i> Plugins</a>
-        </li>
-      </ul>
-      <div class="card shadow border-top-0">
+      <div class="card shadow">
        <div class="card-header d-flex flex-wrap justify-content-between align-items-center gap-2">
          <div>
-            <i class="fa-solid fa-plug"></i> Plugins & Scheduler
+            <i class="fa-solid fa-plug"></i> Plugins
+          </div>
+          <div class="d-flex gap-2 align-items-center">
+            <button class="btn btn-sm btn-primary shadow-sm" onclick="openNewPluginModal()">
+              <i class="fas fa-plus"></i> New Plugin
+            </button>
          </div>
        </div>
        <div class="p-3 pb-0 text-muted small border-bottom">
-          <i class="fa-solid fa-circle-info"></i> View configured background plugins and scheduler status. Note: Plugins are configured statically in <code>sso-secrets.js</code>.
+          <i class="fa-solid fa-circle-info"></i> Configured plugin instances. Each is a loadable, scheduled copy of a
+          plugin type (e.g. Proxmox, UniFi, Nmap) — you can run several of the same type with different settings.
+          Secrets are stored in OpenBao and shown masked. <a href="/docs/plugins">Learn more</a>.
        </div>
-        
        <div class="table-responsive">
          <table class="card-body table table-hover mb-0 align-middle">
            <thead class="table-light">
              <tr>
-                <th class="ps-3">Plugin Name</th>
-                <th>Cron Schedule</th>
-                <th>Status</th>
-                <th>Details</th>
+                <th class="ps-3">Name</th>
+                <th>Type</th>
+                <th>Schedule</th>
+                <th>State</th>
+                <th>Last Run</th>
+                <th>Actions</th>
              </tr>
            </thead>
            <tbody id="plugins-list" jq-repeat="plugins">
-              <tr>
-                <td class="ps-3 fw-bold">{{name}}</td>
+              <tr id="plugin-row-{{id}}">
+                <td class="ps-3">
+                  <strong>{{name}}</strong>
+                  <div class="small text-muted font-monospace">{{slug}}</div>
+                </td>
+                <td><span class="badge bg-secondary">{{pluginType}}</span></td>
                <td><code class="text-dark">{{cron}}</code></td>
                <td>
-                  {{#enabled}}<span class="badge bg-success">Enabled</span>{{/enabled}}
-                  {{^enabled}}<span class="badge bg-secondary">Disabled</span>{{/enabled}}
+                  {{#enabled}}<span class="badge bg-success">Loaded</span>{{/enabled}}
+                  {{^enabled}}<span class="badge bg-secondary">Unloaded</span>{{/enabled}}
                </td>
-                <td class="small text-muted font-monospace">
-                  {{details}}
+                <td class="small">
+                  {{#lastRunAt}}<span title="{{lastRunAt}}">{{lastRunFmt}}</span>{{/lastRunAt}}
+                  {{^lastRunAt}}<span class="text-muted">never</span>{{/lastRunAt}}
+                  {{#lastStatus}}
+                    {{#isOk}}<span class="badge bg-success-subtle text-success-emphasis ms-1">ok</span>{{/isOk}}
+                    {{#isError}}<span class="badge bg-danger-subtle text-danger-emphasis ms-1" title="{{lastError}}">error</span>{{/isError}}
+                    {{#isRunning}}<span class="badge bg-info-subtle text-info-emphasis ms-1">running</span>{{/isRunning}}
+                  {{/lastStatus}}
+                </td>
+                <td>
+                  <button class="btn btn-sm btn-primary" title="Edit" onclick="openEditModal('{{id}}')"><i class="fa-solid fa-pen"></i></button>
+                  <button class="btn btn-sm btn-warning" title="Edit Secrets" onclick="openSecretsModal('{{id}}')"><i class="fa-solid fa-key"></i></button>
+                  <button class="btn btn-sm btn-info" title="Test" onclick="testPlugin('{{id}}')"><i class="fa-solid fa-vial"></i></button>
+                  <button class="btn btn-sm btn-success" title="Run now" onclick="runNow('{{id}}')"><i class="fa-solid fa-play"></i></button>
+                  {{#lastRunAt}}<button class="btn btn-sm btn-secondary" title="View Logs" onclick="showLogs('{{id}}')"><i class="fa-solid fa-file-lines"></i></button>{{/lastRunAt}}
+                  {{#enabled}}<button class="btn btn-sm btn-outline-danger" title="Unload" onclick="togglePlugin('{{id}}', false)">Unload</button>{{/enabled}}
+                  {{^enabled}}<button class="btn btn-sm btn-outline-success" title="Load" onclick="togglePlugin('{{id}}', true)">Load</button>{{/enabled}}
+                  <button class="btn btn-sm btn-outline-danger" title="Delete" onclick="deletePlugin('{{id}}')"><i class="fa-solid fa-trash"></i></button>
                </td>
              </tr>
            </tbody>
-            <tbody id="empty-state" style="display: none;">
+            <tbody id="plugins-empty-state" style="display: none;">
              <tr>
-                <td colspan="4" class="text-center py-4 text-muted">
-                  No plugins configured in sso-secrets.js
+                <td colspan="6" class="text-center py-5 text-muted">
+                  <i class="fa-solid fa-plug fs-2 mb-3 text-black-50"></i>
+                  <h5>No plugin instances</h5>
+                  <p>Click <strong>New Plugin</strong> to configure one.</p>
                </td>
              </tr>
            </tbody>
@@ -64,39 +83,332 @@
 <script>
  app.auth.forceLogin(['app_sso_admin', 'app_sso_directory_admin', 'admin']);

+  // type -> manifest (configSchema etc.), loaded once for the New-plugin form.
+  var pluginTypes = {};
+  // id -> instance (plain), kept current after each load so modals can resolve a row.
+  var pluginsById = {};
+
  $(document).ready(function() {
+    app.api.get('plugins/types', function(err, res) {
+      if (err) { app.messages.toast('Error loading plugin types: ' + (err.message || err), 'danger'); return; }
+      (res.results || []).forEach(function(t) { pluginTypes[t.type] = t; });
+    });
+    loadPlugins();
+  });
+
+  function fmtRun(ms) {
+    if (!ms) return '';
+    var d = new Date(Number(ms));
+    return moment(d).fromNow();
+  }
+
+  function loadPlugins() {
    app.api.get('plugins', function(err, res) {
-      if(err) {
-        app.messages.toast("Error loading plugins: " + (err.message || err));
-        return;
-      }
-      const plugins = res.results || {};
-      const pluginNames = Object.keys(plugins);
-      
+      if (err) { app.messages.toast('Error loading plugins: ' + (err.message || err), 'danger'); return; }
+      var list = res.results || [];
+      pluginsById = {};
      $.scope.plugins.empty();
-      if(pluginNames.length === 0) {
+      if (!list.length) {
        $('#plugins-list').hide();
-        $('#empty-state').show();
+        $('#plugins-empty-state').show();
      } else {
-        pluginNames.forEach(name => {
-          const config = plugins[name];
-          const details = Object.entries(config)
-            .filter(([k, v]) => k !== 'enabled' && k !== 'cron')
-            .map(([k, v]) => `${k}: ${v}`)
-            .join(', ');
-          
-          $.scope.plugins.push({
-            name: name,
-            cron: config.cron || 'N/A',
-            enabled: config.enabled,
-            details: details
-          });
+        list.forEach(function(p) {
+          pluginsById[p.id] = p;
+          p.lastRunFmt = fmtRun(p.lastRunAt);
+          p.isOk = p.lastStatus === 'ok';
+          p.isError = p.lastStatus === 'error';
+          p.isRunning = p.lastStatus === 'running';
+          $.scope.plugins.push(p);
        });
        $('#plugins-list').show();
-        $('#empty-state').hide();
+        $('#plugins-empty-state').hide();
      }
    });
-  });
+  }
+
+  // Build an HTML form fragment for a type's configSchema. `prefix` namespaces
+  // the field ids so the New and Edit modals don't collide. `values` (optional)
+  // pre-fills fields (masked secrets stay masked; non-secret values are shown).
+  // `includeSecrets` (default true) — the Edit (non-secret) modal passes false so
+  // secret fields are never shown there (secrets have their own modal); the New
+  // modal passes true so initial secrets can be set at create time.
+  function configFormHtml(type, prefix, values, includeSecrets) {
+    var schema = pluginTypes[type] && pluginTypes[type].configSchema;
+    if (!schema || !schema.length) return '<p class="text-muted">No configuration fields for this plugin.</p>';
+    if (includeSecrets === undefined) includeSecrets = true;
+    var v = values || {};
+    var html = '';
+    schema.forEach(function(f) {
+      if (!includeSecrets && f.secret) return;
+      var val = v[f.key];
+      if (f.secret) val = '';
+      if (val === undefined || val === null) val = '';
+      var inputType = f.type === 'password' ? 'password' : (f.type === 'url' ? 'url' : 'text');
+      var req = f.required ? ' required' : '';
+      var ph = f.placeholder ? (' placeholder="' + f.placeholder + '"') : '';
+      var label = f.label + (f.secret ? ' <span class="text-warning" title="stored in OpenBao"><i class="fa-solid fa-key"></i></span>' : '') + (f.required ? ' <span class="text-danger">*</span>' : '');
+      html += '<div class="mb-3">' +
+        '<label class="form-label">' + label + '</label>' +
+        '<input type="' + inputType + '" class="form-control" id="' + prefix + f.key + '" value="' + String(val).replace(/"/g, '&quot;') + '"' + req + ph + '>';
+      if (f.secret) html += '<div class="form-text">Leave blank to keep the current secret.</div>';
+      html += '</div>';
+    });
+    return html;
+  }
+
+  // ── Schedule picker (Hourly / Daily / Weekly / Custom) ───────────────────
+  // The stored value is always a 5-field cron string. A `<select>` picks a
+  // preset; "Custom" reveals the raw cron text input. `prefix` namespaces the
+  // element ids (np-/ed-) so the two modals don't collide.
+  var CRON_PRESETS = [
+    { key: 'hourly', label: 'Hourly',           cron: '0 * * * *' },
+    { key: 'daily',  label: 'Daily (midnight)',  cron: '0 0 * * *' },
+    { key: 'weekly', label: 'Weekly (Sun)',      cron: '0 0 * * 0' },
+    { key: 'custom', label: 'Custom…',          cron: null },
+  ];
+  function cronKeyFor(cron) {
+    var m = CRON_PRESETS.filter(function(p){ return p.cron === cron; })[0];
+    return m ? m.key : 'custom';
+  }
+  function cronSelectHtml(prefix, current) {
+    current = current || '0 * * * *';
+    var key = cronKeyFor(current);
+    var opts = CRON_PRESETS.map(function(p){
+      return '<option value="' + p.key + '"' + (p.key === key ? ' selected' : '') + '>' + p.label + '</option>';
+    }).join('');
+    var rawStyle = key === 'custom' ? '' : ' style="display:none"';
+    var rawVal = key === 'custom' ? current : current;
+    return '<select class="form-select" id="' + prefix + 'cron-select" onchange="onCronChange(\'' + prefix + '\')">' + opts + '</select>' +
+      '<input type="text" class="form-control font-monospace mt-2" id="' + prefix + 'cron" value="' + rawVal + '"' + rawStyle + '>';
+  }
+  function onCronChange(prefix) {
+    var sel = document.getElementById(prefix + 'cron-select');
+    var raw = document.getElementById(prefix + 'cron');
+    if (!sel || !raw) return;
+    if (sel.value === 'custom') {
+      raw.style.display = '';
+    } else {
+      raw.style.display = 'none';
+      var preset = CRON_PRESETS.filter(function(p){ return p.key === sel.value; })[0];
+      if (preset) raw.value = preset.cron;
+    }
+  }
+  function cronFromForm(prefix) {
+    var sel = document.getElementById(prefix + 'cron-select');
+    if (sel && sel.value !== 'custom') {
+      var preset = CRON_PRESETS.filter(function(p){ return p.key === sel.value; })[0];
+      if (preset) return preset.cron;
+    }
+    var raw = document.getElementById(prefix + 'cron');
+    return (raw && raw.value.trim()) || '0 * * * *';
+  }
+
+  // Collect a flat {field: value} object from the rendered config form.
+  function collectConfig(type, prefix) {
+    var schema = pluginTypes[type] && pluginTypes[type].configSchema;
+    var out = {};
+    if (!schema) return out;
+    schema.forEach(function(f) {
+      var el = document.getElementById(prefix + f.key);
+      if (el) out[f.key] = el.value;
+    });
+    return out;
+  }
+
+  function typeOptionsHtml(selected) {
+    var opts = '<option value="">Select a plugin type…</option>';
+    Object.keys(pluginTypes).sort().forEach(function(t) {
+      opts += '<option value="' + t + '"' + (t === selected ? ' selected' : '') + '>' + pluginTypes[t].name + ' (' + t + ')</option>';
+    });
+    return opts;
+  }
+
+  // --- New Plugin modal ---
+  function openNewPluginModal() {
+    app.modal.open({
+      title: 'New Plugin',
+      bodyHtml:
+        '<div class="actionMessage mb-3" style="display:none"></div>' +
+        '<div class="mb-3"><label class="form-label">Plugin Type <span class="text-danger">*</span></label>' +
+          '<select class="form-select" id="np-type" onchange="renderNewPluginFields()">' + typeOptionsHtml('') + '</select></div>' +
+        '<div class="mb-3"><label class="form-label">Name <span class="text-danger">*</span></label>' +
+          '<input type="text" class="form-control" id="np-name" placeholder="Proxmox — Home Lab"></div>' +
+        '<div class="mb-3"><label class="form-label">Schedule</label>' +
+          cronSelectHtml('np-', '0 * * * *') +
+          '<div class="form-text">A slug is derived automatically from the name.</div></div>' +
+        '<hr><h6>Configuration</h6><div id="np-config-fields"><p class="text-muted">Select a plugin type first.</p></div>',
+      footer: { buttonsHtml: app.modal.footerButtons({ onSave: 'saveNewPlugin()', saveLabel: 'Create Plugin' }) }
+    });
+  }
+
+  function renderNewPluginFields() {
+    var type = document.getElementById('np-type').value;
+    document.getElementById('np-config-fields').innerHTML = configFormHtml(type, 'np-');
+  }
+
+  async function saveNewPlugin() {
+    var type = document.getElementById('np-type').value;
+    if (!type) return app.messages.action('Select a plugin type.', app.modal.body(), 'danger');
+    var name = document.getElementById('np-name').value.trim();
+    var cron = cronFromForm('np-');
+    if (!name) return app.messages.action('Name is required.', app.modal.body(), 'danger');
+    var config = collectConfig(type, 'np-');
+    try {
+      await app.api.post('plugins', { pluginType: type, name: name, cron: cron, config: config });
+      app.modal.close();
+      app.messages.toast('Plugin created and scheduled.', 'success');
+      loadPlugins();
+    } catch (err) {
+      app.messages.action(err.message || 'Failed to create plugin', app.modal.body(), 'danger');
+    }
+  }
+
+  // --- Edit (non-secret) modal ---
+  function openEditModal(id) {
+    var p = pluginsById[id];
+    if (!p) return;
+    app.modal.open({
+      title: 'Edit — ' + p.name,
+      bodyHtml:
+        '<div class="actionMessage mb-3" style="display:none"></div>' +
+        '<div class="mb-3"><label class="form-label">Name <span class="text-danger">*</span></label>' +
+          '<input type="text" class="form-control" id="ed-name" value="' + String(p.name).replace(/"/g, '&quot;') + '"></div>' +
+        '<div class="mb-3"><label class="form-label">Slug (read-only)</label>' +
+          '<input type="text" class="form-control font-monospace" id="ed-slug" value="' + p.slug + '" readonly></div>' +
+        '<div class="mb-3"><label class="form-label">Schedule</label>' +
+          cronSelectHtml('ed-', p.cron || '0 * * * *') + '</div>' +
+        '<hr><h6>Configuration</h6><div id="ed-config-fields">' + configFormHtml(p.pluginType, 'ed-', p.config, false) + '</div>' +
+        '<div class="form-text">Secret fields are edited separately with the <i class="fa-solid fa-key"></i> button.</div>',
+      footer: {
+        metaHtml: app.modal.formatAudit ? app.modal.formatAudit(p, { formatDate: function(ms){ return moment(ms).format('YYYY-MM-DD HH:mm'); } }) : '',
+        buttonsHtml: app.modal.footerButtons({ onSave: 'saveEdit(\'' + id + '\')', saveLabel: 'Save' })
+      }
+    });
+  }
+
+  async function saveEdit(id) {
+    var p = pluginsById[id];
+    if (!p) return;
+    var name = document.getElementById('ed-name').value.trim();
+    var cron = cronFromForm('ed-');
+    if (!name) return app.messages.action('Name is required.', app.modal.body(), 'danger');
+    var config = collectConfig(p.pluginType, 'ed-');
+    try {
+      await app.api.put('plugins/' + id, { name: name, cron: cron, config: config });
+      app.modal.close();
+      app.messages.toast('Plugin saved.', 'success');
+      loadPlugins();
+    } catch (err) {
+      app.messages.action(err.message || 'Failed to save', app.modal.body(), 'danger');
+    }
+  }
+
+  // --- Edit Secrets modal ---
+  function openSecretsModal(id) {
+    var p = pluginsById[id];
+    if (!p) return;
+    var masked = p.secrets || {};
+    // Render only the secret fields, prefilled with the masked values.
+    var schema = (pluginTypes[p.pluginType] && pluginTypes[p.pluginType].configSchema) || [];
+    var secretFields = schema.filter(function(f) { return f.secret; });
+    var html = '<div class="actionMessage mb-3" style="display:none"></div>' +
+      '<p class="text-muted small">Stored in OpenBao. Leave a field blank to keep its current value.</p>';
+    if (!secretFields.length) {
+      html += '<p class="text-muted">This plugin has no secret fields.</p>';
+    } else {
+      secretFields.forEach(function(f) {
+        var val = masked[f.key] || '';
+        html += '<div class="mb-3"><label class="form-label">' + f.label + '</label>' +
+          '<input type="password" class="form-control" id="sec-' + f.key + '" value="' + String(val).replace(/"/g, '&quot;') + '" placeholder="' + (val ? '******** (unchanged)' : 'new value') + '"></div>';
+      });
+    }
+    app.modal.open({
+      title: 'Edit Secrets — ' + p.name,
+      bodyHtml: html,
+      footer: { buttonsHtml: app.modal.footerButtons({ onSave: 'saveSecrets(\'' + id + '\')', saveLabel: 'Save Secrets' }) }
+    });
+  }
+
+  async function saveSecrets(id) {
+    var p = pluginsById[id];
+    if (!p) return;
+    var schema = pluginTypes[p.pluginType] && pluginTypes[p.pluginType].configSchema;
+    var secrets = {};
+    if (schema) {
+      schema.forEach(function(f) {
+        if (!f.secret) return;
+        var el = document.getElementById('sec-' + f.key);
+        if (el) secrets[f.key] = el.value;
+      });
+    }
+    try {
+      await app.api.put('plugins/' + id + '/secrets', secrets);
+      app.modal.close();
+      app.messages.toast('Secrets saved.', 'success');
+      loadPlugins();
+    } catch (err) {
+      app.messages.action(err.message || 'Failed to save secrets', app.modal.body(), 'danger');
+    }
+  }
+
+  async function testPlugin(id) {
+    try {
+      var res = await app.api.post('plugins/' + id + '/test', {});
+      app.messages.toast('Test passed.', 'success');
+    } catch (err) {
+      app.messages.toast('Test failed: ' + (err.message || 'validation failed'), 'danger');
+    }
+  }
+
+  async function runNow(id) {
+    try {
+      await app.api.post('plugins/' + id + '/run', {});
+      app.messages.toast('Run enqueued. Refresh shortly for status.', 'info');
+      setTimeout(loadPlugins, 3000);
+    } catch (err) {
+      app.messages.toast('Failed to run: ' + (err.message || err), 'danger');
+    }
+  }
+
+  async function showLogs(id) {
+    var p = pluginsById[id];
+    if (!p) return;
+    try {
+      const res = await app.api.get('plugins/' + id + '/runs');
+      const logText = (res.results && res.results.lastLog) || (res.results && res.results.lastError) || 'No logs available.';
+      app.modal.open({
+        title: 'Logs — ' + p.name,
+        bodyHtml: '<pre class="bg-dark text-white p-3 rounded" style="white-space: pre-wrap; font-size: 0.85em;">' + String(logText).replace(/</g, '&lt;').replace(/>/g, '&gt;') + '</pre>',
+        footer: { buttonsHtml: '<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>' }
+      });
+    } catch (err) {
+      app.messages.toast('Failed to load logs: ' + (err.message || err), 'danger');
+    }
+  }
+
+  async function togglePlugin(id, enable) {
+    try {
+      await app.api.post('plugins/' + id + (enable ? '/load' : '/unload'), {});
+      app.messages.toast(enable ? 'Plugin loaded.' : 'Plugin unloaded.', 'success');
+      loadPlugins();
+    } catch (err) {
+      app.messages.toast('Failed: ' + (err.message || err), 'danger');
+    }
+  }
+
+  async function deletePlugin(id) {
+    var p = pluginsById[id];
+    if (!p) return;
+    var ok = await app.messages.confirm('Delete plugin "' + p.name + '"? Its schedule and OpenBao secrets will be removed.', app.modal.body ? app.modal.body() : null, 'danger');
+    if (!ok) return;
+    try {
+      await app.api.delete('plugins/' + id);
+      app.messages.toast('Plugin deleted.', 'success');
+      loadPlugins();
+    } catch (err) {
+      app.messages.toast('Failed to delete: ' + (err.message || err), 'danger');
+    }
+  }
 </script>

-<%- include('bottom') %>
+<%- include('bottom') %>
@@ -9,6 +9,7 @@
 		user.createTimestamp = moment(user.createTimestamp, "YYYYMMDDHHmmssZ").fromNow();
 		user.modifyTimestamp = moment(user.modifyTimestamp, "YYYYMMDDHHmmssZ").fromNow();
 		user.managerUids = (user.manager || []).map(app.user.dnToUid);
+		$('#profile-uid-header').text(user.uid);
 		$.scope.user.update(user);
 	};

@@ -241,7 +242,7 @@
 			<div class="card-header shadow d-flex justify-content-between align-items-center">
 				<div>
 					<i class="fa-regular fa-id-card"></i>
-					Profile: <strong>{{user.uid}}</strong>
+					Profile: <strong id="profile-uid-header"></strong>
 				</div>
 				<div class="d-flex gap-2">
 					<button type="button" onclick="openPasswordResetModal()" class="btn btn-outline-warning btn-sm">
@@ -278,7 +279,7 @@
 					</li>
 					<li class="nav-item" role="presentation">
 						<button class="nav-link" data-bs-toggle="tab" data-bs-target="#tab-members" type="button" role="tab">
-							<i class="fa-solid fa-people-group"></i> Members of {{user.uid}}'s Group
+							<i class="fa-solid fa-people-group"></i> Members of <span id="personal-group-uid-label"></span>'s Group
 						</button>
 					</li>
 				</ul>
@@ -329,27 +330,27 @@
 							<p class="text-muted small mb-0">
 								<i>Joined:</i> <b>{{createTimestamp}}</b> | <i>Edited:</i> <b>{{modifyTimestamp}}</b>
 							</p>
-						</div>

-						<div class="mt-3 border-top pt-3">
-							<h6 class="text-muted">Admin Actions</h6>
-							<div class="d-flex gap-2 flex-wrap group-required group-required-app_sso_admin">
-								{{#isActive}}
-								<button type="button" class="btn btn-outline-warning" title="Deactivate user" onclick="toggleActive('{{uid}}', false)">
-									<i class="fa-solid fa-lock"></i> Deactivate
-								</button>
-								{{/isActive}}
-								{{#isInactive}}
-								<button type="button" class="btn btn-warning" title="Activate user" onclick="toggleActive('{{uid}}', true)">
-									<i class="fa-solid fa-lock-open"></i> Activate
-								</button>
-								{{/isInactive}}
-								<button type="button" class="btn btn-secondary" title="Impersonate this user" onclick="startImpersonate('{{uid}}')">
-									<i class="fa-solid fa-user-secret"></i> Impersonate
-								</button>
-								<button type="button" class="btn btn-danger" onclick="deleteUser('{{uid}}', this)">
-									<i class="fa-solid fa-user-slash"></i> Delete User
-								</button>
+							<div class="mt-3 border-top pt-3">
+								<h6 class="text-muted">Admin Actions</h6>
+								<div class="d-flex gap-2 flex-wrap group-required group-required-app_sso_admin">
+									{{#isActive}}
+									<button type="button" class="btn btn-outline-warning" title="Deactivate user" onclick="toggleActive('{{uid}}', false)">
+										<i class="fa-solid fa-lock"></i> Deactivate
+									</button>
+									{{/isActive}}
+									{{#isInactive}}
+									<button type="button" class="btn btn-warning" title="Activate user" onclick="toggleActive('{{uid}}', true)">
+										<i class="fa-solid fa-lock-open"></i> Activate
+									</button>
+									{{/isInactive}}
+									<button type="button" class="btn btn-secondary" title="Impersonate this user" onclick="startImpersonate('{{uid}}')">
+										<i class="fa-solid fa-user-secret"></i> Impersonate
+									</button>
+									<button type="button" class="btn btn-danger" onclick="deleteUser('{{uid}}', this)">
+										<i class="fa-solid fa-user-slash"></i> Delete User
+									</button>
+								</div>
 							</div>
 						</div>
 					</div>
@@ -0,0 +1,320 @@
+<%- include('top') %>
+
+<div class="container-fluid py-4">
+  <div class="d-flex justify-content-between align-items-center mb-3">
+    <h2 id="vault-title"><i class="fas fa-lock"></i> My Secrets <small class="text-muted">(personal namespace)</small></h2>
+    <ul class="nav nav-pills" id="vault-tabs">
+      <li class="nav-item"><button class="nav-link active" data-bs-toggle="pill" data-bs-target="#tab-secrets" type="button">Secrets</button></li>
+      <li class="nav-item" id="vault-apps-tab" style="display:none"><button class="nav-link" data-bs-toggle="pill" data-bs-target="#tab-apps" type="button">Apps</button></li>
+    </ul>
+  </div>
+
+  <div class="tab-content">
+    <!-- ── Secrets tab ─────────────────────────────────────────────────── -->
+    <div class="tab-pane fade show active" id="tab-secrets">
+      <div class="d-flex justify-content-end mb-3">
+        <button class="btn btn-primary" onclick="showCreateModal()">
+          <i class="fas fa-plus"></i> New Secret
+        </button>
+      </div>
+      <div class="row">
+        <div class="col-md-4">
+          <div class="card shadow-sm">
+            <div class="card-header bg-light"><h5 class="card-title mb-0">Secrets List</h5></div>
+            <div class="list-group list-group-flush" id="secrets-list">
+              <div class="list-group-item text-center text-muted">Loading...</div>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-8">
+          <div class="card shadow-sm" id="secret-details-card" style="display: none;">
+            <div class="card-header bg-light d-flex justify-content-between align-items-center">
+              <h5 class="card-title mb-0" id="secret-title">Secret Details</h5>
+              <div>
+                <button class="btn btn-sm btn-outline-primary me-2" onclick="editCurrentSecret()"><i class="fas fa-edit"></i> Edit</button>
+                <button class="btn btn-sm btn-outline-danger" onclick="deleteCurrentSecret()"><i class="fas fa-trash"></i> Delete</button>
+              </div>
+            </div>
+            <div class="card-body">
+              <pre id="secret-content" class="bg-dark text-light p-3 rounded" style="min-height: 200px;"></pre>
+            </div>
+          </div>
+          <div id="no-secret-selected" class="text-center text-muted mt-5">
+            <i class="fas fa-key fa-4x mb-3 text-secondary"></i>
+            <h4>Select a secret to view its details</h4>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <!-- ── Apps tab (admin only; revealed client-side for admins) ─────── -->
+    <div class="tab-pane fade" id="tab-apps">
+      <div class="row">
+        <div class="col-md-5">
+          <div class="card shadow-sm">
+            <div class="card-header bg-light"><h5 class="card-title mb-0">Mint an app token</h5></div>
+            <div class="card-body">
+              <p class="text-muted small">Mints a scoped OpenBao token confined to <code>secret/apps/&lt;name&gt;/*</code> for an external app. The token is shown <strong>once</strong> — record it in the app immediately; it cannot be recovered later.</p>
+              <div class="mb-3">
+                <label class="form-label">App name (lowercase letters, digits, hyphens)</label>
+                <input type="text" class="form-control" id="app-name-input" placeholder="e.g. my-service">
+              </div>
+              <button class="btn btn-primary" onclick="mintApp()"><i class="fas fa-key"></i> Mint token</button>
+              <div class="alert alert-danger d-none mt-3" id="app-error"></div>
+            </div>
+          </div>
+        </div>
+        <div class="col-md-7">
+          <div class="card shadow-sm d-none" id="app-result-card">
+            <div class="card-header bg-light d-flex justify-content-between align-items-center">
+              <h5 class="card-title mb-0">App token</h5>
+              <button class="btn btn-sm btn-outline-primary" onclick="copyText(document.getElementById('app-token').textContent)"><i class="fas fa-copy"></i> Copy</button>
+            </div>
+            <div class="card-body">
+              <p class="small text-muted">Give the external app this token (header <code>X-Vault-Token</code>) and the path convention below.</p>
+              <pre id="app-token" class="bg-dark text-light p-3 rounded"></pre>
+              <h6 class="mt-3">Connection convention</h6>
+              <pre class="bg-light p-2 rounded small">VAULT_ADDR=<%- vaultAddr %>
+path=secret/apps/&lt;name&gt;/conf
+curl "$VAULT_ADDR/v1/secret/data/apps/<span id="app-name-display"></span>/conf" \
+  -H "X-Vault-Token: &lt;token above&gt;"</pre>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- Create/Edit Secret Modal -->
+<div class="modal fade" id="secretModal" tabindex="-1">
+  <div class="modal-dialog">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="secretModalTitle">Create Secret</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <div class="mb-3">
+          <label class="form-label" id="secret-path-label">Secret name (in your personal namespace)</label>
+          <input type="text" class="form-control" id="secret-path-input" placeholder="e.g. database-creds">
+        </div>
+        <div class="mb-3">
+          <label class="form-label">Secret Data (JSON)</label>
+          <textarea class="form-control" id="secret-data-input" rows="8" style="font-family: monospace;">{
+  "username": "",
+  "password": ""
+}</textarea>
+        </div>
+        <div class="alert alert-danger d-none" id="secret-error"></div>
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+        <button type="button" class="btn btn-primary" onclick="saveSecret()">Save Secret</button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<script>
+  // Login gate + client-derived scoping. VAULT_BASE is '' for admins
+  // (free-form under secret/) or 'users/<uid>/' for everyone else (confined
+  // to their personal namespace). The /api/vault proxy enforces the same
+  // server-side (scopeGuard + the token's OpenBao policy), so this only
+  // drives the UI. Resolved in init() after forceLogin loads the user — the
+  // previous version read these server-side from req.user, which is undefined
+  // on a browser navigation (auth-token is a client-set header, not a cookie).
+  let VAULT_BASE = '';
+  let IS_ADMIN = false;
+
+  let currentSecretPath = null;
+  const secretModal = new bootstrap.Modal(document.getElementById('secretModal'));
+
+  // Build a vault API path. kind is 'data' or 'metadata'; key is the logical
+  // key relative to the subject's namespace (so 'foo' for a user means
+  // secret/data/users/<uid>/foo).
+  function vpath(kind, key) {
+    return `secret/${kind}/${VAULT_BASE}${key}`;
+  }
+
+  function apiCall(method, path, body = null) {
+    const opts = {
+      method,
+      headers: { 'Content-Type': 'application/json', 'auth-token': app.auth.getToken() }
+    };
+    if (body) opts.body = JSON.stringify(body);
+    return fetch('/api/vault/' + path, opts).then(async res => {
+      if (res.status === 404) return null;
+      if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Vault API error: ${res.status} ${text}`);
+      }
+      if (res.status === 204) return null;
+      return res.json();
+    });
+  }
+
+  async function loadSecrets() {
+    try {
+      const res = await apiCall('GET', vpath('metadata', '?list=true'));
+      const listEl = document.getElementById('secrets-list');
+      listEl.innerHTML = '';
+      if (!res || !res.data || !res.data.keys || res.data.keys.length === 0) {
+        listEl.innerHTML = '<div class="list-group-item text-center text-muted">No secrets found</div>';
+        return;
+      }
+      res.data.keys.forEach(key => {
+        // KV list returns dir entries with a trailing slash; admins can still
+        // open them by typing the full path in the modal. Skip dirs in the list
+        // for non-admins (their namespace is flat).
+        if (!IS_ADMIN && key.endsWith('/')) return;
+        const item = document.createElement('a');
+        item.href = '#';
+        item.className = 'list-group-item list-group-item-action d-flex align-items-center';
+        item.innerHTML = `<i class="fas fa-file-alt text-secondary me-3"></i> <span>${key}</span>`;
+        item.onclick = (e) => {
+          e.preventDefault();
+          document.querySelectorAll('#secrets-list .active').forEach(el => el.classList.remove('active'));
+          item.classList.add('active');
+          loadSecretDetails(key);
+        };
+        listEl.appendChild(item);
+      });
+    } catch (err) {
+      document.getElementById('secrets-list').innerHTML =
+        `<div class="list-group-item text-danger"><i class="fas fa-exclamation-triangle"></i> Error loading secrets: ${err.message}</div>`;
+    }
+  }
+
+  async function loadSecretDetails(key) {
+    try {
+      currentSecretPath = key;
+      document.getElementById('no-secret-selected').style.display = 'none';
+      document.getElementById('secret-details-card').style.display = 'block';
+      document.getElementById('secret-title').textContent = key;
+      document.getElementById('secret-content').textContent = 'Loading...';
+      const res = await apiCall('GET', vpath('data', key));
+      if (!res || !res.data || !res.data.data) {
+        document.getElementById('secret-content').textContent = 'No data found.';
+      } else {
+        document.getElementById('secret-content').textContent = JSON.stringify(res.data.data, null, 2);
+      }
+    } catch (err) {
+      document.getElementById('secret-content').textContent = `Error: ${err.message}`;
+    }
+  }
+
+  function showCreateModal() {
+    currentSecretPath = null;
+    document.getElementById('secretModalTitle').textContent = 'Create Secret';
+    document.getElementById('secret-path-input').value = '';
+    document.getElementById('secret-path-input').disabled = false;
+    document.getElementById('secret-data-input').value = '{\n  "key": "value"\n}';
+    document.getElementById('secret-error').classList.add('d-none');
+    secretModal.show();
+  }
+
+  function editCurrentSecret() {
+    if (!currentSecretPath) return;
+    document.getElementById('secretModalTitle').textContent = 'Edit Secret';
+    document.getElementById('secret-path-input').value = currentSecretPath;
+    document.getElementById('secret-path-input').disabled = true;
+    document.getElementById('secret-data-input').value = document.getElementById('secret-content').textContent;
+    document.getElementById('secret-error').classList.add('d-none');
+    secretModal.show();
+  }
+
+  async function saveSecret() {
+    const errorEl = document.getElementById('secret-error');
+    errorEl.classList.add('d-none');
+    const path = document.getElementById('secret-path-input').value.trim();
+    if (!path) {
+      errorEl.textContent = 'Secret path is required';
+      errorEl.classList.remove('d-none');
+      return;
+    }
+    let data;
+    try {
+      data = JSON.parse(document.getElementById('secret-data-input').value);
+    } catch (err) {
+      errorEl.textContent = 'Invalid JSON: ' + err.message;
+      errorEl.classList.remove('d-none');
+      return;
+    }
+    try {
+      await apiCall('POST', vpath('data', path), { data });
+      secretModal.hide();
+      await loadSecrets();
+      if (currentSecretPath === path || !currentSecretPath) {
+        await loadSecretDetails(path);
+      }
+    } catch (err) {
+      errorEl.textContent = err.message;
+      errorEl.classList.remove('d-none');
+    }
+  }
+
+  async function deleteCurrentSecret() {
+    if (!currentSecretPath) return;
+    try {
+      await apiCall('DELETE', vpath('metadata', currentSecretPath));
+      currentSecretPath = null;
+      document.getElementById('no-secret-selected').style.display = 'block';
+      document.getElementById('secret-details-card').style.display = 'none';
+      await loadSecrets();
+    } catch (err) {
+      app.messages.toast('Error deleting secret: ' + err.message, 'danger');
+    }
+  }
+
+  // ── Apps tab (admin) ───────────────────────────────────────────────────
+  async function mintApp() {
+    const errorEl = document.getElementById('app-error');
+    errorEl.classList.add('d-none');
+    const name = document.getElementById('app-name-input').value.trim();
+    if (!name) {
+      errorEl.textContent = 'App name is required';
+      errorEl.classList.remove('d-none');
+      return;
+    }
+    try {
+      const res = await fetch('/api/vault/apps', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'auth-token': app.auth.getToken() },
+        body: JSON.stringify({ name })
+      });
+      if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`${res.status} ${text}`);
+      }
+      const result = await res.json();
+      document.getElementById('app-token').textContent = result.token;
+      document.getElementById('app-name-display').textContent = name;
+      document.getElementById('app-result-card').classList.remove('d-none');
+    } catch (err) {
+      errorEl.textContent = err.message;
+      errorEl.classList.remove('d-none');
+    }
+  }
+
+  function copyText(text) {
+    navigator.clipboard.writeText(text).then(() => app.messages.toast('Copied', 'success'));
+  }
+
+  (async function init() {
+    const user = await app.auth.forceLogin();
+    if (!user) return; // not logged in — forceLogin redirected to /login
+    IS_ADMIN = app.auth.isAdmin();
+    VAULT_BASE = IS_ADMIN ? '' : 'users/' + user.uid + '/';
+    if (IS_ADMIN) {
+      document.getElementById('vault-apps-tab').style.display = '';
+      document.getElementById('vault-title').innerHTML =
+        '<i class="fas fa-lock"></i> Vault Secrets <small class="text-muted">(admin — all of secret/)</small>';
+      document.getElementById('secret-path-label').textContent = 'Secret path (under secret/)';
+      document.getElementById('secret-path-input').placeholder = 'e.g. apps/my-service/conf';
+    }
+    loadSecrets();
+  })();
+</script>
+
+<%- include('bottom') %>
@@ -1,230 +0,0 @@
-<%- include('top') %>
-
-<div class="container-fluid py-4">
-  <div class="d-flex justify-content-between align-items-center mb-4">
-    <h2><i class="fas fa-lock"></i> Vault Secrets</h2>
-    <button class="btn btn-primary" onclick="showCreateModal()">
-      <i class="fas fa-plus"></i> New Secret
-    </button>
-  </div>
-
-  <div class="row">
-    <div class="col-md-4">
-      <div class="card shadow-sm">
-        <div class="card-header bg-light">
-          <h5 class="card-title mb-0">Secrets List</h5>
-        </div>
-        <div class="list-group list-group-flush" id="secrets-list">
-          <div class="list-group-item text-center text-muted">Loading...</div>
-        </div>
-      </div>
-    </div>
-    <div class="col-md-8">
-      <div class="card shadow-sm" id="secret-details-card" style="display: none;">
-        <div class="card-header bg-light d-flex justify-content-between align-items-center">
-          <h5 class="card-title mb-0" id="secret-title">Secret Details</h5>
-          <div>
-            <button class="btn btn-sm btn-outline-primary me-2" onclick="editCurrentSecret()">
-              <i class="fas fa-edit"></i> Edit
-            </button>
-            <button class="btn btn-sm btn-outline-danger" onclick="deleteCurrentSecret()">
-              <i class="fas fa-trash"></i> Delete
-            </button>
-          </div>
-        </div>
-        <div class="card-body">
-          <pre id="secret-content" class="bg-dark text-light p-3 rounded" style="min-height: 200px;"></pre>
-        </div>
-      </div>
-      
-      <div id="no-secret-selected" class="text-center text-muted mt-5">
-        <i class="fas fa-key fa-4x mb-3 text-secondary"></i>
-        <h4>Select a secret to view its details</h4>
-      </div>
-    </div>
-  </div>
-</div>
-
-<!-- Create/Edit Secret Modal -->
-<div class="modal fade" id="secretModal" tabindex="-1">
-  <div class="modal-dialog">
-    <div class="modal-content">
-      <div class="modal-header">
-        <h5 class="modal-title" id="secretModalTitle">Create Secret</h5>
-        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
-      </div>
-      <div class="modal-body">
-        <div class="mb-3">
-          <label class="form-label">Secret Path (Name)</label>
-          <input type="text" class="form-control" id="secret-path-input" placeholder="e.g. database-creds">
-        </div>
-        <div class="mb-3">
-          <label class="form-label">Secret Data (JSON)</label>
-          <textarea class="form-control" id="secret-data-input" rows="8" style="font-family: monospace;">{
-  "username": "",
-  "password": ""
-}</textarea>
-        </div>
-        <div class="alert alert-danger d-none" id="secret-error"></div>
-      </div>
-      <div class="modal-footer">
-        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-        <button type="button" class="btn btn-primary" onclick="saveSecret()">Save Secret</button>
-      </div>
-    </div>
-  </div>
-</div>
-
-<script>
-  app.auth.forceLogin();
-  
-  let currentSecretPath = null;
-  const secretModal = new bootstrap.Modal(document.getElementById('secretModal'));
-
-  function apiCall(method, path, body = null) {
-    const opts = {
-      method,
-      headers: {
-        'Content-Type': 'application/json',
-        'auth-token': app.auth.getToken()
-      }
-    };
-    if (body) opts.body = JSON.stringify(body);
-    return fetch('/api/vault/' + path, opts).then(async res => {
-      if (res.status === 404) return null;
-      if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`Vault API error: ${res.status} ${text}`);
-      }
-      if (res.status === 204) return null;
-      return res.json();
-    });
-  }
-
-  async function loadSecrets() {
-    try {
-      // In dev mode, v2 kv engine is mounted at secret/
-      const res = await apiCall('GET', 'secret/metadata/?list=true');
-      const listEl = document.getElementById('secrets-list');
-      listEl.innerHTML = '';
-      
-      if (!res || !res.data || !res.data.keys || res.data.keys.length === 0) {
-        listEl.innerHTML = '<div class="list-group-item text-center text-muted">No secrets found</div>';
-        return;
-      }
-      
-      res.data.keys.forEach(key => {
-        const item = document.createElement('a');
-        item.href = '#';
-        item.className = 'list-group-item list-group-item-action d-flex align-items-center';
-        item.innerHTML = `<i class="fas fa-file-alt text-secondary me-3"></i> <span>${key}</span>`;
-        item.onclick = (e) => {
-          e.preventDefault();
-          
-          // Update active state
-          document.querySelectorAll('#secrets-list .active').forEach(el => el.classList.remove('active'));
-          item.classList.add('active');
-          
-          loadSecretDetails(key);
-        };
-        listEl.appendChild(item);
-      });
-    } catch (err) {
-      console.error(err);
-      document.getElementById('secrets-list').innerHTML = 
-        `<div class="list-group-item text-danger"><i class="fas fa-exclamation-triangle"></i> Error loading secrets: ${err.message}</div>`;
-    }
-  }
-
-  async function loadSecretDetails(key) {
-    try {
-      currentSecretPath = key;
-      document.getElementById('no-secret-selected').style.display = 'none';
-      document.getElementById('secret-details-card').style.display = 'block';
-      document.getElementById('secret-title').textContent = key;
-      document.getElementById('secret-content').textContent = 'Loading...';
-      
-      const res = await apiCall('GET', `secret/data/${key}`);
-      if (!res || !res.data || !res.data.data) {
-        document.getElementById('secret-content').textContent = 'No data found.';
-      } else {
-        document.getElementById('secret-content').textContent = JSON.stringify(res.data.data, null, 2);
-      }
-    } catch (err) {
-      console.error(err);
-      document.getElementById('secret-content').textContent = `Error: ${err.message}`;
-    }
-  }
-
-  function showCreateModal() {
-    currentSecretPath = null;
-    document.getElementById('secretModalTitle').textContent = 'Create Secret';
-    document.getElementById('secret-path-input').value = '';
-    document.getElementById('secret-path-input').disabled = false;
-    document.getElementById('secret-data-input').value = '{\n  "key": "value"\n}';
-    document.getElementById('secret-error').classList.add('d-none');
-    secretModal.show();
-  }
-
-  function editCurrentSecret() {
-    if (!currentSecretPath) return;
-    document.getElementById('secretModalTitle').textContent = 'Edit Secret';
-    document.getElementById('secret-path-input').value = currentSecretPath;
-    document.getElementById('secret-path-input').disabled = true;
-    document.getElementById('secret-data-input').value = document.getElementById('secret-content').textContent;
-    document.getElementById('secret-error').classList.add('d-none');
-    secretModal.show();
-  }
-
-  async function saveSecret() {
-    const errorEl = document.getElementById('secret-error');
-    errorEl.classList.add('d-none');
-    
-    const path = document.getElementById('secret-path-input').value.trim();
-    if (!path) {
-      errorEl.textContent = 'Secret path is required';
-      errorEl.classList.remove('d-none');
-      return;
-    }
-    
-    let data;
-    try {
-      data = JSON.parse(document.getElementById('secret-data-input').value);
-    } catch (err) {
-      errorEl.textContent = 'Invalid JSON: ' + err.message;
-      errorEl.classList.remove('d-none');
-      return;
-    }
-    
-    try {
-      await apiCall('POST', `secret/data/${path}`, { data });
-      secretModal.hide();
-      await loadSecrets();
-      if (currentSecretPath === path || !currentSecretPath) {
-        await loadSecretDetails(path);
-      }
-    } catch (err) {
-      errorEl.textContent = err.message;
-      errorEl.classList.remove('d-none');
-    }
-  }
-
-  async function deleteCurrentSecret() {
-    if (!currentSecretPath) return;
-    
-    try {
-      await apiCall('DELETE', `secret/metadata/${currentSecretPath}`);
-      currentSecretPath = null;
-      document.getElementById('no-secret-selected').style.display = 'block';
-      document.getElementById('secret-details-card').style.display = 'none';
-      await loadSecrets();
-    } catch (err) {
-      app.messages.toast('Error deleting secret: ' + err.message, 'danger');
-    }
-  }
-
-  // Init
-  loadSecrets();
-</script>
-
-<%- include('bottom') %>
Author	SHA1	Message	Date
wmantly	59d68c0269	chore: release v1.19.6 - UI nav auth, SMTP UI-only, test messages, directory.md Pull Request Tests / Run Tests (18.x) (push) Failing after 1m6s Details Pull Request Tests / Run Tests (20.x) (push) Failing after 29s Details Pull Request Tests / Run Tests (22.x) (push) Failing after 29s Details Pull Request Tests / Test Summary (push) Failing after 4s Details ### Fixed - Navbar shows Catalog/Vault for unauthenticated users — Changed nav gating from `groups: []` (always visible) to `groups: ['login']` and added synthetic 'login' group handling in app-base.js. - 500 ENOENT: no such file or directory, open '/docs/directory.md' — Created the missing documentation file. ### Changed - SMTP configuration UI-only — Removed SMTP from static config files (conf/base.js, sso-secrets.js, setup.env.example). SMTP is now only configurable via the runtime UI at /conf. ### Added - Test email/SMS capability — Added POST /api/conf/test-email and POST /api/conf/test-sms endpoints with UI buttons in the Configuration page. Saves config first, then sends test message to verify settings. ### theta-env setup.sh - Non-interactive theta-agent configuration — Added CFG_THETA_AGENT_ENABLE, CFG_THETA_AGENT_LDAP_AUTH, and CFG_THETA_AGENT_FULL_CONTROL variables to setup.env (all default to 1/enabled). Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-02 21:30:47 -04:00
wmantly	ef2207ed72	fix(vault): correctly rewrite paths for vault API proxy (#149 )	2026-08-02 19:47:07 -04:00
wmantly	7782cf8973	Merge pull request #148 from theta42/bump-1.19.5 chore: bump version to 1.19.5	2026-08-02 19:07:19 -04:00
wmantly	80317d1b7e	chore: bump version to 1.19.5 Pull Request Tests / Run Tests (18.x) (push) Failing after 6m7s Details Pull Request Tests / Run Tests (20.x) (push) Failing after 24s Details Pull Request Tests / Run Tests (22.x) (push) Failing after 23s Details Pull Request Tests / Test Summary (push) Failing after 4s Details	2026-08-02 19:02:17 -04:00
wmantly	ded6a1b0d5	Merge pull request #147 from theta42/fix-68 fix: enforce pwdAccountLockedTime check in app and LDAP	2026-08-02 19:01:43 -04:00
wmantly	a6c24850d4	chore: update sqlite test fixture schema Pull Request Tests / Run Tests (18.x) (push) Failing after 1m32s Details Pull Request Tests / Run Tests (20.x) (push) Failing after 27s Details Pull Request Tests / Run Tests (22.x) (push) Failing after 23s Details Pull Request Tests / Test Summary (push) Failing after 4s Details	2026-08-02 18:57:13 -04:00
wmantly	7da5050ce3	fix: correct path-to-regexp syntax	2026-08-02 18:50:31 -04:00
wmantly	1cb693a1eb	fix: resolve discovery, plugins, and vault issues	2026-08-02 18:45:16 -04:00
wmantly	5c3a8cefe1	fix: enforce pwdAccountLockedTime check in app and LDAP (#68 )	2026-08-02 18:15:28 -04:00
wmantly	15b3a424bc	Merge pull request #146 from theta42/bump-1.19.4 chore: bump version to 1.19.4	2026-08-02 14:10:40 -04:00
wmantly	6cb309b6d9	chore: bump version to 1.19.4	2026-08-02 14:06:45 -04:00
wmantly	f0ceb750a8	Merge pull request #145 from theta42/bump-version chore: bump version to 1.19.3	2026-08-02 14:06:20 -04:00
wmantly	6e95defcf5	chore: bump version to 1.19.3	2026-08-02 14:02:00 -04:00
wmantly	92c2e8a03b	Merge pull request #144 from theta42/fix/discovery-edges fix: resolve discovery and UI bugs	2026-08-02 13:23:56 -04:00
wmantly	230e5be2fd	fix: regex syntax error in proxmox plugin	2026-08-02 13:20:15 -04:00
wmantly	0331cb976a	fix: resolve discovery and UI bugs	2026-08-02 12:55:19 -04:00
wmantly	90cf65e920	Merge pull request #143 from theta42/fix/discovery-edges fix: process edges during discovery reconciliation	2026-08-02 12:10:04 -04:00
wmantly	2d202b4979	chore: release v1.19.2	2026-08-02 12:06:09 -04:00
wmantly	8f04c20cd7	fix: process edges during discovery reconciliation to correctly link merged resources	2026-08-02 12:05:46 -04:00
wmantly	df330c6c0f	Merge pull request #141 from theta42/release-v1.19.0 Release v1.19.0	2026-08-02 11:20:49 -04:00
wmantly	522093e898	fix: remove missing documentation files from Docker build context Pull Request Tests / Run Tests (18.x) (push) Failing after 1m36s Details Pull Request Tests / Run Tests (20.x) (push) Failing after 28s Details Pull Request Tests / Run Tests (22.x) (push) Failing after 28s Details Pull Request Tests / Test Summary (push) Failing after 4s Details	2026-08-02 02:14:30 -04:00
wmantly	7b84a10420	fix: regex syntax error in docker discovery plugin	2026-08-02 02:09:19 -04:00
wmantly	c461723ec7	chore: release v1.19.0	2026-08-02 01:54:00 -04:00
wmantly	b948cd8625	feat: add websocket server endpoint for theta-agent	2026-08-02 01:39:45 -04:00
wmantly	36aa114d7c	docs: remove standalone deployment and docs folder	2026-08-02 00:51:30 -04:00
wmantly	fbce59b1be	feat: integrate proxy config with OpenBao for secure secret storage	2026-08-02 00:37:48 -04:00
wmantly	554a0999ab	test: add tests for Proxy OpenBao configuration endpoint	2026-08-02 00:34:56 -04:00
wmantly	3ca221d64d	chore: release v1.18.0	2026-08-02 00:16:18 -04:00
wmantly	75b133f610	feat: Add messaging plugins, Docker discovery, fix reconciliation	2026-08-02 00:16:17 -04:00
wmantly	f1d52601de	Merge pull request #140 from theta42/feature/v1.17.2-fixes v1.17.2: post-deploy fixes + SMS/TOS on /conf	2026-08-01 22:51:55 -04:00
wmantly	ecd21c4984	feat: v1.17.2 post-deploy fixes + SMS/TOS on /conf - auto-slug plugins (no more manual slug field) - plugin schedule dropdown (hourly/daily/weekly + custom) - fix /vault secrets-list 403 (per-user/app/admin list grants on dir path; ensurePolicy always re-writes so existing policies get the grant) - fix /profile literal {{...}} tags (header uid span, members label id, admin-actions moved inside jq-repeat=user scope) - fix plugin editing (Edit modal non-secret only; secrets have own modal) - nmap: apk add nmap in Dockerfile.openldap + clearer missing-binary error - add SMS (VoIP.ms) config card to /conf (password masked, leave-blank-to-keep) - move Terms of Service editor from Overview to /conf Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-01 22:47:37 -04:00
wmantly	5ba2ace835	Merge pull request #139 from theta42/feature/conf-secret-masking v1.17.1: mask SMTP/OAuth secrets + leave-blank-to-keep on /conf	2026-08-01 21:19:05 -04:00
wmantly	25b0d57a97	feat(conf): mask SMTP/OAuth secrets + leave-blank-to-keep on /conf (v1.17.1) GET /api/conf no longer returns smtp.pass / oauth.jwtSecret in cleartext (masked to ******). POST treats a blank or ****** secret submission as "keep the stored value," so editing the From address or token lifetimes no longer requires re-entering or leaks the SMTP password / JWT secret. The /conf form fields carry a leave-unchanged hint. Storage stays in OpenBao at secret/sso-manager/conf (unchanged); no theta-suite policy change needed. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-01 21:15:16 -04:00
wmantly	320e7594e4	Merge pull request #138 from theta42/feature/plugin-system v1.17.0: real plugin system (loadable instances + OpenBao secrets)	2026-08-01 20:50:58 -04:00
wmantly	cec0d92c25	feat: real plugin system with loadable instances + OpenBao secrets (v1.17.0) Generalize the half-built discovery plugins into a real plugin system: plugin TYPES (the plugins/<category>/<type>.js modules with manifests) and loadable, configurable, multi-copy plugin INSTANCES (PluginInstance ORM model) managed from a dedicated /plugins page and /api/plugins API, with per-instance secrets in OpenBao at secret/plugins/<id>/conf. - plugin_registry.js: getTypes/getModule/splitConfig/mask + required-field helpers - PluginInstance model (Sequelize): id/pluginType/category/name/slug(unique)/ enabled/cron/config(json, non-secret)/lastRun; registered in models/index.js - plugin_secrets.js: read/write/remove/mergeForRun over @simpleworkjs/bao-conf - scheduler.js: schedules from the DB registry; per-instance stable BullMQ JobScheduler ids (plugin:<id>) for load/unload; legacy migration from conf.discovery.plugins on first boot (idempotent, empty-table-guarded) - api_plugins.js (replaces routes/plugins.js): types/list/get/create/update/ secrets/test/load/unload/run/delete/runs; admin-gated; secrets always masked - /plugins page (plugins.ejs) + nav; Agents & Scheduler tab removed from /directory; /docs/agents aliased to /docs/plugins - proxmox/unifi/nmap gained manifests (configSchema/validate/run alias) - tests/plugins.test.js: registry unit + plugin_secrets (mocked bao-conf) + PluginInstance model round-trip/unique-slug - docs (plugins.md, vault.md, _config.yml, API.md) + 1.16.1 -> 1.17.0 Requires theta-suite >= v1.30.1 for the sso-broker secret/plugins/ grant; fails-soft with a clear error if absent. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-01 20:33:57 -04:00
wmantly	21a56dce50	v1.16.1: fix 401 on /conf and /vault for logged-in admins (#137 ) Both view routes did server-side auth via req.user, but this app's auth-token is a header set by client JS (localStorage), not a cookie — so req.user is undefined on a browser navigation. permission.byGroup(undefined,...) throws status 401, and the middleware.auth gate on /vault threw Auth.errors.login() (401) for the same reason. Both routes now render the shell unconditionally (like /users, /directory) and gate client-side. conf.ejs already called app.auth.forceLogin; vault.ejs now derives isAdmin + personal namespace from /api/user/me after forceLogin instead of server-rendering them. /api/conf and /api/vault still enforce app_sso_admin + OpenBao scope server-side — only the view-route gating moved client-side where the session lives. Also removed a dead duplicate /conf route. Co-authored-by: Claude <noreply@anthropic.com>	2026-08-01 18:42:51 -04:00
wmantly	ebb5b2c2a7	Merge pull request #136 from theta42/feature/openbao-secrets v1.16.0: OpenBao central secrets + vault broker + UI rework	2026-08-01 12:50:03 -04:00
wmantly	c8c4cad46d	chore: bump @simpleworkjs/bao-conf to 1.0.1 (fail-soft on missing token) bao-conf 1.0.0's init() threw when VAULT_TOKEN was unset, crashing the all-in-one image boot (.catch -> process.exit(1)) in any deployment without an OpenBao sidecar — including the CI test image. 1.0.1 makes init() fail-soft on a missing token (warn + continue from CONF_SECRETS), matching the documented contract. Verified locally: the all-in-one image boots healthy with no VAULT_TOKEN (/health -> {"status":"ok"}). Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-01 12:45:52 -04:00
wmantly	59d4b65195	v1.16.0: OpenBao as central secrets store + vault broker + UI rework - Boot: bao-conf.init('sso-manager') replaces conf_manager; deep-merges secret/sso-manager/conf over file config (fail-soft). Scoped VAULT_TOKEN (policy sso-broker), never root. - /api/vault reworked: middleware.auth -> scopeGuard -> token-injecting proxy. vault_broker.js mints Redis-cached per-user (user-<uid>) / per-admin (sso-admin) tokens via the sso-broker role; scopeGuard enforces path prefix on top of the OpenBao policy. Client auth-token stripped. - vault UI renamed (vaultwarden.ejs -> vault.ejs), /vault route auth-gated, role-scoped: users see only secret/users/<uid>/, admins get free-form + Apps mint tab (secret/apps/<name>/, token shown once). - api_conf.js writes via bao-conf.set('sso-manager', ...). - Remediation: config/-secrets.js untracked+gitignored, test_plugins.js deleted, proxy-secrets.js.example placeholder added. Secrets remain in git history; provider-side rotation is the real fix. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-01 12:36:08 -04:00
wmantly	74746e409b	Merge pull request #135 from theta42/release-v1.15.2 Add vault.md	2026-08-01 02:59:34 -04:00
wmantly	70aed035a5	Merge pull request #134 from theta42/release-v1.15.1 Make directory tabs look like group tabs	2026-08-01 02:56:59 -04:00
wmantly	0264a62b22	Add missing docs/vault.md	2026-08-01 02:55:49 -04:00
wmantly	c212537163	Make directory tabs look like group tabs	2026-08-01 02:52:57 -04:00