feat(auth): OIDC/Keycloak SSO-Login (additiv) — v1.2.91

SSO per OpenID Connect (Authorization Code + PKCE) zusätzlich zum lokalen Login.
- Regeln: kein Auto-Provisioning (E-Mail muss als User existieren), Rolle aus DB (nie aus Token), lokaler Login+TOTP unangetastet.
- Migration 0040: oidc_settings (Singleton, client_secret_enc via secrets.Box) + users.oidc_subject.
- internal/services/oidc: Settings-Repo (write-only Secret) + lazy go-oidc Client (testbarer Authenticator-Seam).
- internal/handlers/oidc.go: GET/PUT /oidc/settings (admin), GET /auth/oidc/{settings,login,callback}. Flow-State (state/PKCE/nonce) stateless im 5-min signierten HttpOnly-Cookie (SameSite=Lax). email_verified erzwungen, opportunistisches sub-Linking, Session via setSessionCookie+Signer.
- session.SignBlob/VerifyBlob; users.Get/SetOIDCSubject; main.go-Wiring.
- Frontend: App.tsx /auth/me-Bootstrap (für Cookie-Session nach Callback), Login-SSO-Button + sso_error, Settings OIDC-Card, i18n de/en.
- Tests (guarded EG_FWTEST_DSN): Secret-Roundtrip + Callback (Rolle-aus-DB, no_account, disabled, unverified, nonce, state).
Deps: go-oidc/v3, x/oauth2. Scope v1: nur Login (kein SLO/Refresh).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -27,25 +27,36 @@ Vor jeder Entscheidung über Feldwerte, API-Shapes, Dateinamen, Funktions-Signat
 
 ---
 
-## Arbeitsweise — Senior Engineer + MCP (PFLICHT)
+## MCP-Tools (Architect Center)
 
-### Session-Bindung
-Sessions: `EdgeGuardNative-1` · project_id **8** · `$ARCHITECT_SESSION` im Env · MCP-Server `architect` verfügbar
-
-### Code-Suche — AUTOMATISCH nutzen
-
-Bei JEDER Code-bezogenen Frage **zuerst** `ac_search_code` aufrufen:
+**project_id: 8** · Session: `$ARCHITECT_SESSION` · MCP-Server: `architect`
 
+### Beim Session-Start (PFLICHT)
 ```
-ac_search_code(query="<stichworte>", project_id=8, session_name=$(printenv ARCHITECT_SESSION), limit=6)
+ac_recall(query="<aktuelle Aufgabe>", project_id=8, session_name="$(printenv ARCHITECT_SESSION)")
+ac_search_code(query="<Stichworte>", project_id=8, session_name="$(printenv ARCHITECT_SESSION)", limit=6)
 ```
 
-**Referenzen:**
-- Backend-Pattern → `project_id=6` (mail-gateway)
-- UI/Bootstrap-Pattern → `project_id=5` (netcell-webpanel)
-- Feature-Scope (was alt-EG konnte) → `project_id=3` (proxy-lb-waf)
+### Alle Tools
 
-**Verboten:** direkt `grep` oder `read` ohne vorheriges `ac_search_code` bei Code-Fragen.
+| Tool | Wann verwenden |
+|------|----------------|
+| `ac_recall(query, project_id=8, session_name)` | Session-Start — relevante Memories laden |
+| `ac_search_code(query, project_id=8, session_name, limit?)` | Vor JEDEM neuen Code schreiben |
+| `ac_search_code_global(query, session_name, limit?)` | Suche über alle Projekte hinweg |
+| `ac_remember(text, category, project_id=8, session_name)` | Jede neue Erkenntnis / Entscheidung |
+| `ac_create_bug(title, description?, priority?, session_name?)` | Bug gefunden |
+| `ac_create_feature(title, description?, priority?, session_name?)` | Feature-Idee |
+| `ac_create_task(title, description?, priority?, status?, project_id?)` | Follow-up Arbeit |
+| `ac_update_task(id, status?, priority?, title?)` | Task-Status ändern |
+| `ac_add_decision(title, content, category?, project_id?)` | Architekturentscheidung |
+| `ac_notify(message, title?, type?)` | Status-Update senden |
+| `ac_get_project(session_name)` | project_id für Session ermitteln |
+| `ac_research(query, context?)` | Doku / CVE / Libraries recherchieren |
+| `ac_review(code, language?, focus?)` | Code-Review nach Fertigstellung |
+| `ac_analyze(text, question?)` | Logs / Outputs analysieren |
+
+**`ac_remember` Kategorien:** `decision` · `pattern` · `bugfix` · `convention` · `architecture` · `general`
 
 ---
 

Makefile

@@ -4,7 +4,7 @@
 
 GO       ?= $(shell which go || echo /usr/local/go/bin/go)
 MODULE   := git.netcell-it.de/projekte/edgeguard-native
-BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl
+BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl edgeguard-waf
 VERSION  := $(shell cat VERSION 2>/dev/null || echo 0.0.1-dev)
 LDFLAGS  := -s -w -X main.version=$(VERSION)
 GOFLAGS  := -trimpath -mod=readonly
@@ -85,21 +85,14 @@ deb: deb-amd64 deb-arm64
 GITEA_DEB_URL := https://git.netcell-it.de/api/packages/projekte/debian/pool/trixie/main/upload
 
 publish-amd64: deb-amd64
-	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \
-	if [ -z "$$TOK" ]; then echo "publish: ~/.gitea-token is empty"; exit 1; fi; \
-	for f in edgeguard-api_$(VERSION)_amd64.deb edgeguard-ui_$(VERSION)_all.deb edgeguard_$(VERSION)_all.deb; do \
-	  echo "  -> publish $$f"; \
-	  curl -sS -H "Authorization: token $$TOK" --upload-file build/deb/$$f $(GITEA_DEB_URL); \
-	  echo ""; \
-	done
+	@./scripts/apt-repo/publish.sh $(VERSION) amd64
+	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
+	@./scripts/apt-repo/cleanup-old.sh
 
 publish-arm64: deb-arm64
-	@TOK="$$(cat $$HOME/.gitea-token | tr -d '\n')"; \
-	if [ -z "$$TOK" ]; then echo "publish: ~/.gitea-token is empty"; exit 1; fi; \
-	echo "  -> publish edgeguard-api_$(VERSION)_arm64.deb"; \
-	curl -sS -H "Authorization: token $$TOK" \
-	    --upload-file build/deb/edgeguard-api_$(VERSION)_arm64.deb \
-	    $(GITEA_DEB_URL)
+	@./scripts/apt-repo/publish.sh $(VERSION) arm64
+	@echo "  -> cleanup-old (keep last $${KEEP:-10})"
+	@./scripts/apt-repo/cleanup-old.sh
 
 publish: publish-amd64 publish-arm64
 

VERSION

@@ -1 +1 @@
-1.0.78
+1.2.91

agent.md

@@ -8,7 +8,7 @@
 
 Der Architect Center Orchestrator dispatcht mehrere Claude Code Agenten, jeder spezialisiert auf eine Schicht des Projekts. Alle Agenten haben Zugriff auf:
 - **RAG (Qdrant):** Code-Index von mail-gateway (project_id=6) und netcell-webpanel (project_id=5) als Referenz
-- **MCP-Server `architect`:** ac_search_code, ac_send_instruction, ac_read_file
+- **MCP-Server `architect`:** ac_recall, ac_search_code, ac_search_code_global, ac_remember, ac_create_bug, ac_create_feature, ac_create_task, ac_update_task, ac_add_decision, ac_notify, ac_get_project, ac_research, ac_review, ac_analyze
 - **Session:** eigene tmux-Session pro Agent (EdgeGuardNative-1 … N)
 
 ---

cmd/edgeguard-api/main.go

@@ -37,6 +37,12 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/backup"
 	backupremote "git.netcell-it.de/projekte/edgeguard-native/internal/services/backup/remote"
 	dnssvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/dns"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/aggregator"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/jointoken"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/clusterjoin"
+	aptsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/apt"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domainheaders"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domains"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/firewall"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/firewalllog"
@@ -52,9 +58,12 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 	wgsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/wireguard"
+	oidcsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/oidc"
+	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+	wafsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
 )
 
-var version = "1.0.78"
+var version = "1.2.35"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
@@ -105,9 +114,27 @@ func main() {
 
 	requireAuth := handlers.RequireAuth(signer)
 
-	handlers.NewSetupHandler(setupStore).Register(v1)
-	handlers.NewSystemHandler(version).Register(v1)
-	handlers.NewAuthHandler(setupStore, signer).Register(v1, requireAuth)
+	setupHdl := handlers.NewSetupHandler(setupStore).WithVersion(version)
+	setupHdl.Register(v1)
+
+	// systemHdl exists früh damit sowohl der frühe (DB-pool nicht
+	// nötige) Pfad als auch der späte WithMaintenance-Hookup gehen.
+	systemHdl := handlers.NewSystemHandler(version)
+	systemHdl.Register(v1)
+	authHdl := handlers.NewAuthHandler(setupStore, signer)
+	authHdl.Register(v1, requireAuth)
+
+	// Background-Refresh für apt-cache: hält die Apt-Lists alle 5 min
+	// frisch, damit der UI-Update-Banner kurz nach `make publish` ein
+	// verfügbares Update sieht — ohne den Background-Timer wäre der
+	// Cache nur nach UI-Polls aktuell und der Throttle würde
+	// Aktualisierungen zwischen den Polls schlucken.
+	aptsvc.StartBackgroundRefresh(context.Background())
+
+	// agentHdl wird vom Agent-Listener mit-gemountet (Phase 3.5).
+	// Nil-safe — wenn DB nicht offen ist, läuft der Agent-Listener
+	// nur mit den read-only System-Endpoints.
+	var agentHdl *handlers.ClusterHandler
 
 	// Open the DB pool best-effort. Without a reachable PG, CRUD
 	// handlers stay unregistered and only Auth/Setup/System answer —
@@ -141,8 +168,83 @@ func main() {
 		}
 		cancel()
 
+		// Phase 3.2: alle 30s Heartbeat (last_seen, status, version,
+		// config_hash) für die eigene Row. Goroutine läuft so lange wie
+		// die API — beim graceful Shutdown stoppt sie via ctx.Done().
+		// Hält den eigenen Node-Status auch dann frisch wenn der
+		// Scheduler gerade down ist; ein crashender API stoppt den
+		// Heartbeat → Peer-Sweeper markiert binnen 2 min "offline".
+		if nodeID != "" {
+			go runClusterHeartbeat(context.Background(), pool, nodeID, version)
+		}
+
+		// Secondary: push config_hash to primary every 5 min so the primary's
+		// ha_nodes reflects actual state. Without this, the primary retains the
+		// stale hash written at join-time and the drift banner never clears.
+		// st.IsClusterNode + PrimaryFQDN are only set on joined secondary nodes.
+		if nodeID != "" && st != nil && st.IsClusterNode && st.PrimaryFQDN != "" {
+			if primaryURL, normErr := clusterjoin.NormalizePrimaryURL(st.PrimaryFQDN); normErr == nil {
+				go runPrimaryPush(context.Background(), pool, nodeID, st.FQDN, version, primaryURL)
+			} else {
+				slog.Warn("cluster: cannot normalize primary URL for push", "primary", st.PrimaryFQDN, "error", normErr)
+			}
+			// runSecondaryConfigRender wird weiter unten gestartet sobald
+			// clusterAggregator verfügbar ist (braucht mTLS-Client für Cert-Sync).
+		}
+
+		// Phase 3.3: Cluster-CA + Peer-Cert. Founder-Pfad — auf einem
+		// frisch installierten Single-Node generieren wir die CA und
+		// signieren uns selbst, damit der Agent-Listener auf :8443
+		// gleich hochfahren kann. Joining-Nodes (Phase 3.4) werden den
+		// Pfad nicht durchlaufen: sie kriegen CA+Peer-Cert vom Primary
+		// gepusht und finden die Files bereits vor.
+		clusterTLSStore := clustertls.New("")
+		if !clusterTLSStore.HasCA() {
+			org := "edgeguard.local"
+			if st != nil && st.FQDN != "" {
+				org = st.FQDN
+			}
+			if err := clusterTLSStore.InitCA(org, nil); err != nil {
+				slog.Warn("cluster-tls: InitCA failed", "error", err)
+			} else {
+				slog.Info("cluster-tls: CA generated", "dir", clusterTLSStore.Dir, "org", org)
+			}
+		}
+		if clusterTLSStore.HasCA() && !clusterTLSStore.HasPeer() {
+			cn := "edgeguard-node"
+			var dnsNames []string
+			if st != nil && st.FQDN != "" {
+				cn = st.FQDN
+				dnsNames = []string{st.FQDN}
+			}
+			if err := clusterTLSStore.EnsureSelfSigned(cn, dnsNames, nil, nil); err != nil {
+				slog.Warn("cluster-tls: EnsureSelfSigned failed", "error", err)
+			} else {
+				slog.Info("cluster-tls: peer cert generated", "cn", cn)
+			}
+		}
+
+		// Aggregator nur aufsetzen wenn Cert-Material da ist — sonst
+		// fan-out scheitert sowieso am Handshake.
+		var clusterAggregator *aggregator.Aggregator
+		if clusterTLSStore.HasPeer() {
+			if clientTLS, err := clusterTLSStore.ClientTLSConfig(); err == nil {
+				clusterAggregator = aggregator.New(clientTLS)
+				slog.Info("cluster: aggregator ready", "agent_port", aggregator.DefaultAgentPort)
+			} else {
+				slog.Warn("cluster: ClientTLSConfig failed", "error", err)
+			}
+		}
+
+		// Secondary-Config-Render: jetzt wo der Aggregator bereit ist starten.
+		// Aggregator wird für Cert-Sync (mTLS GET /agent/cluster/tls-certs) benötigt.
+		if nodeID != "" && st != nil && st.IsClusterNode && st.PrimaryFQDN != "" {
+			go runSecondaryConfigRender(context.Background(), pool, secrets.New(""), clusterAggregator, nodeID)
+		}
+
 		auditRepo := audit.New(pool)
 		domainsRepo := domains.New(pool)
+		domainHeadersRepo := domainheaders.New(pool)
 		backendsRepo := backends.New(pool)
 		backendServersRepo := backendservers.New(pool)
 		routingRepo := routingrules.New(pool)
@@ -176,13 +278,54 @@ func main() {
 		// injiziert, damit jede Änderung ohne expliziten render-config-
 		// Aufruf live geht. Errors werden geloggt, nicht failed
 		// (Row schon committed, Operator kann manuell re-triggern).
+		// Maintenance-Endpoints brauchen den Reloader — späte Wiring
+		// nachdem haproxyReloader-closure existiert.
+		haproxyReloaderForLater := func(ctx context.Context) error {
+			return haproxy.New(pool).Render(ctx)
+		}
+		systemHdl.WithMaintenance(setupStore, haproxyReloaderForLater)
+
+		// Audit-Wiring (Phase Polish): Settings + Auth-Mutationen
+		// landen jetzt im audit_log. Nodes-id ist die persistente
+		// /var/lib/edgeguard/node-id.
+		systemHdl.WithAudit(auditRepo, nodeID)
+		systemHdl.WithDB(pool)
+		systemHdl.WithConfigPreviewers(map[string]func(context.Context) (string, error){
+				"haproxy":   haproxy.New(pool).RenderToString,
+				"nftables":  firewallrender.New(pool).RenderToString,
+				"squid":     squidrender.New(pool).RenderToString,
+				"unbound":   unboundrender.New(pool).RenderToString,
+				"chrony":    chronyrender.New(pool).RenderToString,
+				"wireguard": wgrender.New(pool, secretsBox).RenderToString,
+			})
+		setupHdl.WithAudit(auditRepo, nodeID)
+		setupHdl.WithClusterSupport(clusterStore, func(ctx context.Context) error {
+			return firewallrender.New(pool).Render(ctx)
+		})
+		// Cluster-Node-Startup: Primary in lokalen ha_nodes eintragen damit
+		// nftables @peer_ipv4 korrekt ist — auch ohne erneuten Join.
+		go setupHdl.StartupPeerSync()
+		usersRepo := usersvc.New(pool)
+		authHdl.WithAudit(auditRepo, nodeID).WithUsers(usersRepo).WithClusterTLS(clusterTLSStore)
+		systemHdl.WithUsers(usersRepo)
+
 		haproxyReloader := func(ctx context.Context) error {
 			return haproxy.New(pool).Render(ctx)
 		}
 
 		authed := v1.Group("")
-		authed.Use(requireAuth)
-		handlers.NewDomainsHandler(domainsRepo, routingRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
+		authed.Use(requireAuth, handlers.RequireAdminForMutations())
+		setupHdl.RegisterAuthed(authed)
+		handlers.NewUsersHandler(usersRepo, auditRepo, nodeID).Register(authed)
+
+		// OIDC/Keycloak SSO — public Flow-Endpoints auf v1 (hinter SetupGate),
+		// Admin-Settings auf authed (PUT nur admin via RequireAdminForMutations).
+		oidcRepo := oidcsvc.New(pool, secretsBox)
+		oidcHdl := handlers.NewOIDCHandler(oidcRepo, oidcsvc.NewClient(oidcRepo), usersRepo, signer, setupStore).
+			WithAudit(auditRepo, nodeID)
+		oidcHdl.RegisterPublic(v1)
+		oidcHdl.RegisterAdmin(authed)
+		handlers.NewDomainsHandler(domainsRepo, routingRepo, domainHeadersRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
 		handlers.NewBackendsHandler(backendsRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
 		handlers.NewBackendServersHandler(backendServersRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
 		handlers.NewRoutingRulesHandler(routingRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
@@ -190,7 +333,39 @@ func main() {
 		handlers.NewIPAddressesHandler(ipsRepo, auditRepo, nodeID).Register(authed)
 		handlers.NewRoutesHandler(staticroutes.New(pool), staticroutes.NewGenerator(pool),
 			auditRepo, nodeID).Register(authed)
-		handlers.NewClusterHandler(clusterStore, nodeID).Register(authed)
+		// Phase 3.4 — Join-Token-Service. CA-Fingerprint kommt aus
+		// dem clustertls.Store; ohne CA = nil Tokens, GenerateToken
+		// scheitert, IssueCert wird gar nicht erst gemountet.
+		var joinTokens *jointoken.Service
+		if clusterTLSStore.HasCA() {
+			joinTokens = jointoken.New(pool, func() (string, error) {
+				caCert, _, err := clusterTLSStore.LoadCA()
+				if err != nil {
+					return "", err
+				}
+				return jointoken.CAFingerprint16(caCert.Raw), nil
+			})
+		}
+		// PeerReloader: nach Auto-Register triggert das den firewall-
+		// Render damit peer_ipv4 frisch ist und der mTLS-Listener für
+		// den neuen Peer erreichbar wird. Best-effort.
+		peerReloader := func(ctx context.Context) error {
+			return firewallrender.New(pool).Render(ctx)
+		}
+		clusterHdl := handlers.NewClusterHandler(clusterStore, nodeID).
+			WithAggregator(clusterAggregator).
+			WithJoinFlow(clusterTLSStore, joinTokens).
+			WithPeerReloader(peerReloader).
+			WithAudit(auditRepo, nodeID).
+			WithVersion(version)
+		clusterHdl.Register(authed)
+		// /cluster/issue-cert läuft PUBLIC — joining Peer hat noch
+		// keine Session/Cert. Token + Nonce-Tracking ist die einzige
+		// Auth-Stufe.
+		clusterHdl.RegisterPublic(v1)
+		// Agent-Listener (mTLS) bekommt clusterHdl mit, damit Joiner
+		// sich via /agent/cluster/peers eintragen können.
+		agentHdl = clusterHdl
 		handlers.NewAuditHandler(auditRepo).Register(authed)
 		handlers.NewHAProxyStatsHandler().Register(authed)
 
@@ -218,6 +393,8 @@ func main() {
 			return firewallrender.New(pool).Render(ctx)
 		}
 		handlers.NewFirewallHandler(fwZones, fwAddrObj, fwAddrGrp, fwSvc, fwSvcGrp, fwRules, fwNAT, auditRepo, nodeID, fwReloader, pool).Register(authed)
+		handlers.NewCrowdSecHandler(auditRepo, nodeID).Register(authed)
+		handlers.NewWafHandler(wafsvc.New(pool), auditRepo, nodeID, haproxyReloader).Register(authed)
 
 		// withFW wraps a service-reloader so that AFTER the service is
 		// reloaded, the firewall is also re-rendered. Necessary for
@@ -268,6 +445,16 @@ func main() {
 		}
 		handlers.NewNTPHandler(ntpRepo, auditRepo, nodeID, withFW(chronyReloader)).Register(authed)
 
+		// Wire all service reloaders into systemHdl so RenderConfigs
+		// re-renders every service from DB state in one shot.
+		systemHdl.WithAllReloaders(map[string]func(context.Context) error{
+			"nftables":  fwReloader,
+			"wireguard": wgReloader,
+			"squid":     squidReloader,
+			"unbound":   unboundReloader,
+			"chrony":    chronyReloader,
+		})
+
 		// License — node-local key store + DB-mirror of last verify
 		// result. Real verify runs against license.netcell-it.com via
 		// internal/license; the scheduler triggers daily re-verify.
@@ -280,10 +467,35 @@ func main() {
 		// scheduler. StartPeriodicVerification is a no-op when the key
 		// is empty.
 		licClient.StartPeriodicVerification(licKeyStore.Get())
+
+		// Startup-Render nftables: stellt sicher dass Template-Änderungen
+		// aus einem Update (z.B. neue WireGuard forward-Chain-Auto-Regel)
+		// sofort nach dem API-Restart aktiv werden — ohne dass der
+		// Operator manuell eine Mutation triggern müsste. nft -f ist
+		// idempotent und atomar; kein Dienst wird neu gestartet.
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancel()
+			if err := firewallrender.New(pool).Render(ctx); err != nil {
+				slog.Warn("startup: nftables render failed", "error", err)
+			}
+		}()
 	}
 
 	mountUI(r)
 
+	// Phase 3.3: zweiter Listener auf :8443 mit mTLS für Cluster-Peer-
+	// Reads. RequireAndVerifyClientCert gegen unsere Cluster-CA — wer
+	// keinen CA-signierten Cert hat, kommt nicht durch den Handshake.
+	// Listener wird nur gestartet wenn Cert-Material vorhanden ist;
+	// auf einer frisch installierten Box hat die Init-Phase oben das
+	// schon erledigt.
+	startAgentListener(version, agentHdl, systemHdl)
+
+	// Nach einem Upgrade-Neustart: wenn die State-Datei "updating-primary"
+	// enthält, sind wir gerade neu gestartet → Update abgeschlossen → "done".
+	handlers.FinishRollingUpdateIfPending()
+
 	log.Printf("edgeguard-api %s listening on %s", version, addr)
 	srv := &http.Server{Addr: addr, Handler: r}
 	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -291,6 +503,57 @@ func main() {
 	}
 }
 
+// startAgentListener startet den mTLS-Agent-Listener auf :8443 als
+// Goroutine. Mountet nur read-only Endpoints (siehe SystemHandler.
+// RegisterAgent — health + resources). Fehler im Cert-Load = no-op
+// + log; Fehler beim Listen.Serve loggen wir aber lassen die API
+// weiterlaufen.
+func startAgentListener(version string, clusterHdl *handlers.ClusterHandler, sysHdl *handlers.SystemHandler) {
+	store := clustertls.New("")
+	serverTLS, err := store.ServerTLSConfig()
+	if err != nil {
+		slog.Info("cluster: agent listener disabled (no cert material)", "error", err)
+		return
+	}
+	addr := os.Getenv("EDGEGUARD_AGENT_LISTEN")
+	if addr == "" {
+		// 0.0.0.0:8443 — Auth via mTLS, also unbedenklich auf Public-IP.
+		// nft anti-lockout-Regel + Peer-IP-Set bestimmen wer überhaupt
+		// connecten darf. Loopback-Tests gehen direkt.
+		addr = "0.0.0.0:8443"
+	}
+	r := gin.New()
+	r.Use(gin.Recovery())
+	// Kein /api/v1-Prefix auf dem Agent-Listener: das Versioning kommt
+	// hier implizit aus dem Binary (Peer-Roundtrip ist immer same-major).
+	// Aggregator-Aufrufer sehen /agent/... direkt.
+	root := r.Group("")
+	// Nutze den gewiredeten systemHdl (mit Users + Setup) damit
+	// AgentAuthCheck Credentials gegen die echte DB prüfen kann.
+	if sysHdl != nil {
+		sysHdl.RegisterAgent(root)
+	} else {
+		handlers.NewSystemHandler(version).RegisterAgent(root)
+	}
+	if clusterHdl != nil {
+		// Phase 3.5: /agent/cluster/peers (Auto-Register).
+		clusterHdl.RegisterAgent(root)
+	}
+
+	srv := &http.Server{
+		Addr:              addr,
+		Handler:           r,
+		TLSConfig:         serverTLS,
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+	go func() {
+		slog.Info("cluster: agent (mTLS) listener starting", "addr", addr)
+		if err := srv.ListenAndServeTLS("", ""); err != nil && err != http.ErrServerClosed {
+			slog.Error("cluster: agent listener", "error", err)
+		}
+	}()
+}
+
 // mountUI serves the management UI — Vite-built static assets under
 // /usr/share/edgeguard/ui/ — with SPA fallback (any path that isn't
 // /api/* or /healthz and isn't a real file → index.html). When the
@@ -336,10 +599,18 @@ func mountUI(r *gin.Engine) {
 			return
 		}
 		if info, err := os.Stat(full); err == nil && !info.IsDir() {
+			// Vite hashed assets are immutable — cache them forever.
+			// index.html must never be cached so updates take effect.
+			if strings.HasPrefix(clean, "/assets/") {
+				c.Header("Cache-Control", "public, max-age=31536000, immutable")
+			} else {
+				c.Header("Cache-Control", "no-cache, no-store, must-revalidate")
+			}
 			c.File(full)
 			return
 		}
 		// SPA fallback — React Router renders the right page.
+		c.Header("Cache-Control", "no-cache, no-store, must-revalidate")
 		c.File(indexPath)
 	})
 }
@@ -428,6 +699,144 @@ func (a backupRemoteAdapter) UploadAll(ctx context.Context, localPath string) ([
 	return out, err
 }
 
+// runClusterHeartbeat tickt alle 30s und bumpt die eigene ha_nodes-Row
+// (last_seen, status, version, config_hash) via cluster.Heartbeat.
+// Fehler werden geloggt aber nicht zurückgegeben — der nächste Tick
+// versucht es erneut. Beendet beim ctx.Done() (graceful API shutdown).
+func runClusterHeartbeat(ctx context.Context, pool *pgxpoolPool, localID, version string) {
+	const tick = 30 * time.Second
+	t := time.NewTicker(tick)
+	defer t.Stop()
+	// Erster Schlag direkt nach Start damit die UI nicht 30s wartet.
+	if err := cluster.Heartbeat(ctx, pool, localID, version); err != nil {
+		slog.Warn("cluster: initial heartbeat failed", "error", err)
+	}
+	slog.Info("cluster: heartbeat goroutine started", "tick", tick.String(), "node_id", localID)
+	for {
+		select {
+		case <-ctx.Done():
+			slog.Info("cluster: heartbeat goroutine stopping")
+			return
+		case <-t.C:
+			hbCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+			if err := cluster.Heartbeat(hbCtx, pool, localID, version); err != nil {
+				slog.Warn("cluster: heartbeat failed", "error", err)
+			}
+			cancel()
+		}
+	}
+}
+
+// runSecondaryConfigRender läuft auf Secondary-Nodes und re-rendert alle
+// Service-Configs wenn die Logical Replication Änderungen vom Primary
+// geliefert hat. Erkennt das an einem geänderten config_hash.
+// Tick: 5 min — balanciert Reaktionszeit gegen Reload-Overhead.
+//
+// Cert-Sync läuft auf jedem Tick unabhängig vom config_hash, da certbot-
+// Renewals auf dem Primary den Hash nicht ändern.
+func runSecondaryConfigRender(ctx context.Context, pool *pgxpoolPool, box *secrets.Box, agg *aggregator.Aggregator, localID string) {
+	const tick = 5 * time.Minute
+	t := time.NewTicker(tick)
+	defer t.Stop()
+	var lastHash string
+	render := func() {
+		rCtx, cancel := context.WithTimeout(ctx, 90*time.Second)
+		defer cancel()
+
+		// TLS-Zertifikate bei jedem Tick synchronisieren — unabhängig vom
+		// config_hash, da certbot-Renewals den Hash nicht berühren.
+		if err := handlers.SyncTLSCertsFromPrimary(rCtx, pool, agg, localID); err != nil {
+			slog.Warn("cluster: cert sync failed", "error", err)
+		}
+
+		hash, err := cluster.ComputeConfigHash(rCtx, pool)
+		if err != nil || hash == lastHash {
+			return
+		}
+		lastHash = hash
+		slog.Info("cluster: secondary config changed via replication, re-rendering", "hash", hash)
+		// HAProxy
+		if err := haproxy.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary haproxy render failed", "error", err)
+		}
+		// nftables
+		if err := firewallrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary nftables render failed", "error", err)
+		}
+		// WireGuard — Interface-Configs + wg-quick@<iface> reload
+		if err := wgrender.New(pool, box).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary wireguard render failed", "error", err)
+		}
+		// Squid forward proxy
+		if err := squidrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary squid render failed", "error", err)
+		}
+		// Unbound DNS
+		if err := unboundrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary unbound render failed", "error", err)
+		}
+		// Chrony NTP
+		if err := chronyrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary chrony render failed", "error", err)
+		}
+		// Netzwerk-Interfaces (VLAN/Bridge/Bond) — erstellt Interface-Objekte,
+		// weist aber KEINE IPs zu (das ist node-spezifisch und darf nicht aus
+		// der Replikation kommen — sonst IP-Konflikt mit dem Primary).
+		if err := networkifs.NewGenerator(networkifs.New(pool)).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary interfaces render failed", "error", err)
+		}
+		// IP-Adressen werden auf dem Secondary NICHT aus der Replikation
+		// angewendet. Jeder Node konfiguriert seine eigenen IPs statisch
+		// (z.B. /etc/network/interfaces). Floating-Service-IPs werden von
+		// Keepalived verwaltet — nicht vom Renderer.
+	}
+	// Initialer Check nach kurzem Delay (Replication braucht einen Moment)
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(30 * time.Second):
+		render()
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			render()
+		}
+	}
+}
+
+// runPrimaryPush periodically pushes this secondary node's config_hash to the
+// primary via mTLS. The primary's ha_nodes view only gets config_hash written
+// during join-time autoRegister — after that the primary never hears about
+// hash changes unless we push. Without this, the drift banner shows stale
+// hashes from join-time forever.
+func runPrimaryPush(ctx context.Context, pool *pgxpoolPool, nodeID, fqdn, version, primaryURL string) {
+	const tick = 5 * time.Minute
+	t := time.NewTicker(tick)
+	defer t.Stop()
+	push := func() {
+		pCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+		defer cancel()
+		hash, _ := cluster.ComputeConfigHash(pCtx, pool)
+		if err := clusterjoin.PushSelfToPrimary(primaryURL, "", nodeID, fqdn, version, hash); err != nil {
+			slog.Warn("cluster: push-to-primary failed", "error", err)
+		} else {
+			slog.Debug("cluster: config_hash pushed to primary", "hash", hash)
+		}
+	}
+	push() // immediate push on API startup
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			push()
+		}
+	}
+}
+
 func randomEphemeralSecret() []byte {
 	b := make([]byte, 32)
 	if _, err := rand.Read(b); err != nil {

cmd/edgeguard-ctl/cluster_join.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/clusterjoin"
+)
+
+func cmdClusterJoin(args []string) int {
+	fs := flag.NewFlagSet("cluster-join", flag.ContinueOnError)
+	tokenFlag := fs.String("token", "", "cluster join token (eg-join-v1.…)")
+	insecure := fs.Bool("insecure", false, "skip TLS verification on the primary (bootstrap mode)")
+	cn := fs.String("cn", "", "subject common name (default: hostname)")
+	clusterTLSDir := fs.String("tls-dir", clustertls.DefaultDir, "where to write ca.crt + peer.{crt,key}")
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	if fs.NArg() < 1 {
+		fmt.Fprintln(os.Stderr, "usage: edgeguard-ctl cluster-join <primary-fqdn-or-url> --token <…>")
+		return 2
+	}
+	if *tokenFlag == "" {
+		fmt.Fprintln(os.Stderr, "edgeguard-ctl cluster-join: --token required")
+		return 2
+	}
+
+	commonName := *cn
+	if commonName == "" {
+		h, _ := os.Hostname()
+		commonName = h
+	}
+
+	if err := clusterjoin.Join(clusterjoin.Request{
+		PrimaryFQDN: fs.Arg(0),
+		Token:       *tokenFlag,
+		CommonName:  commonName,
+		Insecure:    *insecure,
+		TLSDir:      *clusterTLSDir,
+		Version:     version,
+	}); err != nil {
+		fmt.Fprintf(os.Stderr, "edgeguard-ctl cluster-join: %v\n", err)
+		return 1
+	}
+
+	primary, _ := clusterjoin.NormalizePrimaryURL(fs.Arg(0))
+	fmt.Printf("Cluster-Join erfolgreich.\n")
+	fmt.Printf("  Primary: %s\n", primary)
+	fmt.Printf("  CN:      %s\n", commonName)
+	fmt.Printf("  Files:   %s/{ca.crt,peer.crt,peer.key}\n", *clusterTLSDir)
+	fmt.Printf("\nNächste Schritte:\n")
+	fmt.Printf("  1) sudo systemctl restart edgeguard-api  # lädt das neue Cert ins mTLS-Agent-Listener\n")
+	fmt.Printf("  2) Auf dem Primary in der Cluster-UI prüfen ob der neue Peer in /cluster/nodes auftaucht\n")
+	fmt.Printf("  3) PG-Basebackup + KeyDB-Replica-Setup folgt mit Phase 3.5 (manuell bis dahin)\n")
+	return 0
+}

cmd/edgeguard-ctl/cluster_renew.go

@@ -0,0 +1,62 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
+)
+
+// cmdClusterRenewSelf: re-issued das eigene peer.{crt,key} mit der
+// lokalen Cluster-CA. Nur sinnvoll auf der Founder/Primary-Box wo die
+// CA-Key noch vorhanden ist; auf Joinern fehlt die ca.key (sie haben
+// nur die CA-Cert zum Verify) und der Aufruf scheitert.
+//
+// Usage:
+//   edgeguard-ctl cluster-renew-self [--cn <fqdn>] [--tls-dir <path>]
+//
+// Output: schreibt peer.crt + peer.key über das vorhandene peer.{crt,
+// key} hinweg. Restart-Hinweis am Ende.
+func cmdClusterRenewSelf(args []string) int {
+	fs := flag.NewFlagSet("cluster-renew-self", flag.ContinueOnError)
+	cn := fs.String("cn", "", "subject common name (default: aus dem aktuellen peer.crt geerbt)")
+	tlsDir := fs.String("tls-dir", clustertls.DefaultDir, "where peer.{crt,key} live")
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	store := clustertls.New(*tlsDir)
+	if !store.HasCA() {
+		fmt.Fprintln(os.Stderr,
+			"edgeguard-ctl cluster-renew-self: no local CA found — this command works only on a founder/primary node.")
+		return 1
+	}
+	commonName := *cn
+	if commonName == "" {
+		if info, err := store.PeerCertInfo(); err == nil && info.CommonName != "" {
+			commonName = info.CommonName
+		}
+	}
+	if commonName == "" {
+		h, _ := os.Hostname()
+		commonName = h
+	}
+	if commonName == "" {
+		commonName = "edgeguard-node"
+	}
+	if err := store.RenewSelfSigned(commonName, []string{commonName}, nil, nil); err != nil {
+		fmt.Fprintf(os.Stderr, "edgeguard-ctl cluster-renew-self: %v\n", err)
+		return 1
+	}
+	info, _ := store.PeerCertInfo()
+	fmt.Printf("Cluster-Peer-Cert erneuert.\n")
+	fmt.Printf("  CN:          %s\n", commonName)
+	fmt.Printf("  Files:       %s/peer.{crt,key}\n", *tlsDir)
+	if info != nil {
+		fmt.Printf("  Gültig bis:  %s (%d Tage)\n", info.NotAfter, info.DaysRemaining)
+	}
+	fmt.Printf("\nDamit der Agent-Listener das neue Cert lädt:\n")
+	fmt.Printf("  sudo systemctl restart edgeguard-api\n")
+	return 0
+}

cmd/edgeguard-ctl/cluster_replication.go

@@ -0,0 +1,573 @@
+package main
+
+import (
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
+)
+
+const (
+	egReplSecret = "/var/lib/edgeguard/pg-replication-secret"
+	egReplUser   = "edgeguard_replicator"
+	egPubName    = "edgeguard_shared"
+	egSubName    = "edgeguard_sub"
+)
+
+// pgConfig hält die zur Laufzeit erkannten PG-Pfade.
+type pgConfig struct {
+	Version string // z.B. "17"
+	Cluster string // z.B. "main"
+	DataDir string // /var/lib/postgresql/17/main
+	HBAPath string // /etc/postgresql/17/main/pg_hba.conf
+	ConfD   string // /etc/postgresql/17/main/conf.d
+}
+
+// detectPGConfig ermittelt Version, Cluster und Pfade aus der laufenden
+// PG-Instanz via SHOW hba_file / SHOW data_directory. Damit ist der Code
+// unabhängig von der PG-Hauptversion (16, 17, …).
+func detectPGConfig() (pgConfig, error) {
+	hbaRaw, err := psqlRun([]string{"-tA", "-c", "SHOW hba_file;"})
+	if err != nil {
+		return pgConfig{}, fmt.Errorf("cannot detect pg hba_file: %w", err)
+	}
+	hbaPath := strings.TrimSpace(string(hbaRaw))
+
+	dataRaw, err := psqlRun([]string{"-tA", "-c", "SHOW data_directory;"})
+	if err != nil {
+		return pgConfig{}, fmt.Errorf("cannot detect pg data_directory: %w", err)
+	}
+	dataDir := strings.TrimSpace(string(dataRaw))
+
+	// hbaPath: /etc/postgresql/<version>/<cluster>/pg_hba.conf
+	parts := strings.Split(filepath.ToSlash(hbaPath), "/")
+	if len(parts) < 6 {
+		return pgConfig{}, fmt.Errorf("unexpected hba_file path: %s", hbaPath)
+	}
+	version := parts[3]
+	cluster := parts[4]
+	confD := filepath.Join("/etc/postgresql", version, cluster, "conf.d")
+
+	return pgConfig{
+		Version: version,
+		Cluster: cluster,
+		DataDir: dataDir,
+		HBAPath: hbaPath,
+		ConfD:   confD,
+	}, nil
+}
+
+// localOnlyTables listet alle Tabellen die nicht in die Replikations-
+// Publication aufgenommen werden. Alles andere wird automatisch repliziert.
+var localOnlyTables = []string{
+	"ha_nodes",           // Node-Identität, Status
+	"network_interfaces", // Eigene Interfaces (eth0, eth1 …)
+	"ip_addresses",       // Eigene IP-Adressen (unterschiedlich pro Node!)
+	"static_routes",      // Node-spezifisches Routing
+	"cluster_settings",   // VIP-Interface kann pro Node unterschiedlich sein
+	"dns_settings",       // listen_addresses ist node-spezifisch
+	"ntp_settings",       // listen_addresses ist node-spezifisch
+	"system_settings",    // Hostname, Maintenance-Mode etc.
+	"join_tokens_used",   // Token-Tracking nur auf Primary relevant
+	"audit_log",          // Lokales Audit-Protokoll
+	"alert_events",       // Lokale Laufzeit-Events
+	"backups",            // Backup-Historie ist per-Node
+	"goose_db_version",   // Migration-Tracking, internes Tool-State
+}
+
+// cmdClusterInitReplication richtet PG auf dieser Node als Logical-Replication-
+// Primary ein. Idempotent — kann gefahrlos mehrfach laufen.
+//
+// Ablauf:
+//  1. edgeguard_replicator-Rolle anlegen/aktualisieren
+//  2. Passwort → /var/lib/edgeguard/pg-replication-secret
+//  3. conf.d/edgeguard-replication.conf mit wal_level=logical schreiben
+//  4. pg_hba.conf für Replikations-Verbindungen aktualisieren
+//  5. SELECT-Grants auf alle geteilten Tabellen
+//  6. PUBLICATION erstellen (alle Tabellen außer localOnlyTables)
+//  7. PG reload
+func cmdClusterInitReplication(args []string) int {
+	fs := flag.NewFlagSet("cluster-init-replication", flag.ContinueOnError)
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+
+	pg, err := detectPGConfig()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: PG-Erkennung:", err)
+		return 1
+	}
+	fmt.Printf("→ PostgreSQL %s/%s erkannt\n", pg.Version, pg.Cluster)
+
+	// 1. Passwort generieren
+	pass, err := generatePassword(32)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: generate password:", err)
+		return 1
+	}
+
+	// 2. edgeguard_replicator-Rolle anlegen/updaten
+	roleSQL := fmt.Sprintf(`DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '%s') THEN
+    CREATE ROLE %s REPLICATION LOGIN PASSWORD '%s';
+  ELSE
+    ALTER ROLE %s PASSWORD '%s';
+  END IF;
+END
+$$`, egReplUser, egReplUser, pass, egReplUser, pass)
+	if err := psqlExec(roleSQL); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: create replication role:", err)
+		return 1
+	}
+	fmt.Printf("✓ Replication-Rolle %q angelegt/aktualisiert\n", egReplUser)
+
+	// 3. Passwort speichern
+	if err := os.MkdirAll(filepath.Dir(egReplSecret), 0o750); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: mkdir:", err)
+		return 1
+	}
+	if err := os.WriteFile(egReplSecret, []byte(pass), 0o600); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: write secret:", err)
+		return 1
+	}
+	// Ownership an edgeguard-api-User übergeben damit die API lesen kann
+	if u, err := user.Lookup("edgeguard"); err == nil {
+		uid, _ := strconv.Atoi(u.Uid)
+		gid, _ := strconv.Atoi(u.Gid)
+		_ = os.Chown(egReplSecret, uid, gid)
+	}
+	fmt.Printf("✓ Replication-Secret gespeichert: %s\n", egReplSecret)
+
+	// 4. conf.d/edgeguard-replication.conf schreiben
+	// wal_level=logical ist eine Obermenge von replica — unterstützt
+	// sowohl Logical Replication als auch ggfs. physisches WAL-Archiving.
+	if err := os.MkdirAll(pg.ConfD, 0o755); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: conf.d mkdir:", err)
+		return 1
+	}
+	replConf := `# EdgeGuard Logical Replication — automatisch generiert
+# Nicht manuell bearbeiten; wird von edgeguard-ctl cluster-init-replication verwaltet.
+wal_level = logical
+max_wal_senders = 10
+max_replication_slots = 20
+max_logical_replication_workers = 4
+wal_keep_size = 512MB
+# Lausche auf localhost + alle konfigurierten Interfaces damit Cluster-Peers
+# sich verbinden können. '*' ist sicher weil pg_hba.conf den Zugriff auf
+# bekannte Replikations-User beschränkt.
+listen_addresses = '*'
+`
+	confPath := filepath.Join(pg.ConfD, "edgeguard-replication.conf")
+	if err := os.WriteFile(confPath, []byte(replConf), 0o644); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: write postgresql conf:", err)
+		return 1
+	}
+	fmt.Printf("✓ %s geschrieben (wal_level=logical)\n", confPath)
+
+	// 5. pg_hba.conf aktualisieren
+	if err := ensureHBAReplication(pg.HBAPath); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: pg_hba.conf:", err)
+		return 1
+	}
+	fmt.Printf("✓ %s aktualisiert\n", pg.HBAPath)
+
+	// 6. PG reload (damit wal_level + pg_hba aktiv werden)
+	if out, err := exec.Command("pg_ctlcluster", pg.Version, pg.Cluster, "reload").CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-init-replication: pg reload failed: %v\n%s\n", err, out)
+		return 1
+	}
+	fmt.Printf("✓ PostgreSQL %s/%s neu geladen\n", pg.Version, pg.Cluster)
+
+	// 7. SELECT-Grants: edgeguard_replicator muss alle zu replizierenden
+	// Tabellen lesen können. DEFAULT PRIVILEGES sichert zukünftige Tabellen.
+	grantSQL := fmt.Sprintf(`
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO %s;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO %s;
+`, egReplUser, egReplUser)
+	if err := psqlDBExec("edgeguard", grantSQL); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: grant SELECT:", err)
+		return 1
+	}
+	fmt.Printf("✓ SELECT auf alle Tabellen für %q gewährt\n", egReplUser)
+
+	// 8. PUBLICATION erstellen — alle public-Tabellen außer localOnlyTables.
+	// Idempotent: DROP IF EXISTS + CREATE.
+	if err := createPublication(); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: create publication:", err)
+		return 1
+	}
+	fmt.Printf("✓ PUBLICATION %q erstellt\n", egPubName)
+
+	fmt.Println()
+	fmt.Println("Nächste Schritte:")
+	fmt.Println("  1) Auf dem Secondary: edgeguard-ctl cluster-setup-standby <primary-ip>")
+	fmt.Println("  2) Cluster-Settings (VIP) auf BEIDEN Nodes separat konfigurieren")
+	fmt.Println("     → Settings → Cluster → VIP/Keepalived")
+	return 0
+}
+
+// createPublication baut die PUBLICATION dynamisch aus allen Tabellen
+// im public-Schema minus localOnlyTables. Idempotent: löscht eine
+// bestehende Publication gleichen Namens zuerst.
+func createPublication() error {
+	// Alle Tabellen im public-Schema ermitteln
+	listSQL := `SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`
+	out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", listSQL})
+	if err != nil {
+		return fmt.Errorf("list tables: %w", err)
+	}
+
+	excluded := make(map[string]bool)
+	for _, t := range localOnlyTables {
+		excluded[t] = true
+	}
+
+	var tables []string
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		t := strings.TrimSpace(line)
+		if t == "" || excluded[t] {
+			continue
+		}
+		tables = append(tables, t)
+	}
+	if len(tables) == 0 {
+		return fmt.Errorf("keine Tabellen für Publication gefunden")
+	}
+
+	dropSQL := fmt.Sprintf("DROP PUBLICATION IF EXISTS %s;", egPubName)
+	if err := psqlDBExec("edgeguard", dropSQL); err != nil {
+		return fmt.Errorf("drop old publication: %w", err)
+	}
+
+	createSQL := fmt.Sprintf("CREATE PUBLICATION %s FOR TABLE %s;",
+		egPubName, strings.Join(tables, ", "))
+	if err := psqlDBExec("edgeguard", createSQL); err != nil {
+		return fmt.Errorf("create publication: %w", err)
+	}
+	return nil
+}
+
+// ensureHBAReplication fügt Einträge für die Replikations-Verbindung
+// in pg_hba.conf ein. Für Logical Replication brauchen wir einen
+// normalen "host edgeguard"-Eintrag (nicht "host replication").
+// Idempotent via Marker-Kommentar.
+func ensureHBAReplication(hbaPath string) error {
+	data, err := os.ReadFile(hbaPath)
+	if err != nil {
+		return fmt.Errorf("read: %w", err)
+	}
+	const marker = "# EdgeGuard replication"
+	if strings.Contains(string(data), marker) {
+		return nil
+	}
+	entry := fmt.Sprintf(`
+%s
+host edgeguard   %s 0.0.0.0/0 scram-sha-256
+host edgeguard   %s ::/0      scram-sha-256
+host replication %s 0.0.0.0/0 scram-sha-256
+host replication %s ::/0      scram-sha-256
+`, marker, egReplUser, egReplUser, egReplUser, egReplUser)
+	f, err := os.OpenFile(hbaPath, os.O_APPEND|os.O_WRONLY, 0o640)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer f.Close()
+	_, err = f.WriteString(entry)
+	return err
+}
+
+// cmdClusterSetupStandby richtet diesen Node als Logical-Replication-
+// Subscriber ein. Der Secondary behält seine eigene beschreibbare PG-
+// Instanz — nur die geteilten Tabellen werden vom Primary repliziert.
+// Node-spezifische Tabellen (Interfaces, IPs, Routen, VIP-Settings …)
+// bleiben lokal und werden NICHT überschrieben. Analog zu OPNsense's
+// HA-Sync: Interface-IPs und Hostname bleiben immer per-Node konfiguriert.
+//
+// Voraussetzungen:
+//   - cluster-join erfolgreich (TLS-Certs in /var/lib/edgeguard/cluster-tls/)
+//   - Primary hat cluster-init-replication ausgeführt
+//   - Dieser Node hat edgeguard-api schon gelaufen (Migrations ausgeführt)
+//
+// Ablauf:
+//  1. Replication-Credentials via mTLS vom Primary holen
+//  2. Bestehende Subscription löschen (idempotent)
+//  3. SUBSCRIPTION auf Primary erstellen (copy_data=true → Initialkopiierung)
+//  4. Warten bis Initialkopiierung abgeschlossen
+//  5. render-config ausführen damit Service-Configs den neuen Stand reflektieren
+func cmdClusterSetupStandby(args []string) int {
+	fs := flag.NewFlagSet("cluster-setup-standby", flag.ContinueOnError)
+	agentPort := fs.Int("agent-port", 8443, "mTLS agent port on primary")
+	tlsDir := fs.String("tls-dir", clustertls.DefaultDir, "Verzeichnis mit ca.crt + peer.{crt,key}")
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	if fs.NArg() < 1 {
+		fmt.Fprintln(os.Stderr, "usage: edgeguard-ctl cluster-setup-standby <primary-ip-or-host>")
+		return 2
+	}
+	primaryHost := fs.Arg(0)
+
+	// 1. Replication-Credentials vom Primary holen
+	creds, err := fetchReplicationCreds(primaryHost, *agentPort, *tlsDir)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: replication-creds: %v\n", err)
+		return 1
+	}
+	fmt.Printf("✓ Replication-Credentials von %s:%d erhalten\n", primaryHost, *agentPort)
+
+	// 2. Bestehende Subscription löschen (idempotent)
+	dropSQL := fmt.Sprintf(`
+DO $$ BEGIN
+  IF EXISTS (SELECT FROM pg_subscription WHERE subname = '%s') THEN
+    ALTER SUBSCRIPTION %s DISABLE;
+    ALTER SUBSCRIPTION %s SET (slot_name = NONE);
+    DROP SUBSCRIPTION %s;
+  END IF;
+END $$;`, egSubName, egSubName, egSubName, egSubName)
+	if err := psqlDBExec("edgeguard", dropSQL); err != nil {
+		// Nicht fatal — wenn PG noch keine Subscription kennt ist das OK
+		fmt.Printf("  → keine bestehende Subscription gefunden (ok)\n")
+	} else {
+		fmt.Println("✓ Bestehende Subscription entfernt")
+	}
+
+	// 3. SUBSCRIPTION erstellen
+	// sslmode=require: Verbindung zwischen Cluster-Nodes soll immer verschlüsselt sein.
+	// copy_data=true: Initialkopiierung aller geteilten Tabellen vom Primary.
+	connStr := fmt.Sprintf(
+		"host=%s port=%d user=%s password=%s dbname=edgeguard sslmode=require",
+		creds.Host, creds.Port, creds.User, creds.Password,
+	)
+	createSQL := fmt.Sprintf(
+		"CREATE SUBSCRIPTION %s CONNECTION '%s' PUBLICATION %s WITH (copy_data = true, enabled = true);",
+		egSubName, connStr, egPubName,
+	)
+	if err := psqlDBExec("edgeguard", createSQL); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: create subscription: %v\n", err)
+		return 1
+	}
+	fmt.Printf("✓ SUBSCRIPTION %q erstellt — Initialkopiierung läuft\n", egSubName)
+
+	// 4. Warten bis Initialkopiierung abgeschlossen
+	fmt.Print("→ Warte auf Initialkopiierung")
+	deadline := time.Now().Add(5 * time.Minute)
+	for time.Now().Before(deadline) {
+		pendingSQL := fmt.Sprintf(`
+SELECT COUNT(*) FROM pg_subscription_rel
+WHERE srsubid = (SELECT oid FROM pg_subscription WHERE subname = '%s')
+  AND srsubstate != 'r';`, egSubName)
+		out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", pendingSQL})
+		if err == nil && strings.TrimSpace(string(out)) == "0" {
+			break
+		}
+		fmt.Print(".")
+		time.Sleep(3 * time.Second)
+	}
+	fmt.Println()
+
+	// Finale Prüfung
+	checkSQL := fmt.Sprintf(`
+SELECT COUNT(*) FROM pg_subscription_rel
+WHERE srsubid = (SELECT oid FROM pg_subscription WHERE subname = '%s')
+  AND srsubstate != 'r';`, egSubName)
+	if out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", checkSQL}); err == nil {
+		if n := strings.TrimSpace(string(out)); n != "0" {
+			fmt.Fprintf(os.Stderr,
+				"cluster-setup-standby: %s Tabellen noch nicht synchronisiert — prüfe PG-Logs\n", n)
+			fmt.Println("  → Subscription läuft trotzdem weiter im Hintergrund")
+		} else {
+			fmt.Println("✓ Alle geteilten Tabellen synchronisiert")
+		}
+	}
+
+	// 5. Master-Key vom Primary holen — für WireGuard-Key-Entschlüsselung
+	fmt.Println("→ Secrets Master-Key vom Primary synchronisieren...")
+	if err := syncMasterKey(primaryHost, *agentPort, *tlsDir); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: master-key: %v (WireGuard-Keys können nicht entschlüsselt werden)\n", err)
+	} else {
+		fmt.Println("✓ Master-Key synchronisiert")
+	}
+
+	// 6. render-config ausführen — muss als edgeguard-User laufen (DB-Zugriff)
+	fmt.Println("→ Service-Configs neu rendern...")
+	if out, err := exec.Command("sudo", "-u", "edgeguard", "edgeguard-ctl", "render-config").CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: render-config: %v\n%s\n", err, out)
+		fmt.Println("  → Manuell nachholen: sudo -u edgeguard edgeguard-ctl render-config")
+	} else {
+		fmt.Print(string(out))
+		fmt.Println("✓ Service-Configs aktualisiert")
+	}
+
+	fmt.Println()
+	fmt.Println("✓ Logical Replication eingerichtet.")
+	fmt.Println()
+	fmt.Println("Was repliziert wird (automatisch, in Echtzeit):")
+	fmt.Println("  Domains, Backends, Firewall-Rules, WireGuard, DNS-Zones,")
+	fmt.Println("  TLS-Certs, Users, Forward-Proxy, NTP-Pools, ...")
+	fmt.Println()
+	fmt.Println("Was NICHT repliziert wird (bleibt pro Node konfiguriert):")
+	fmt.Println("  Netzwerk-Interfaces, IP-Adressen, Routen,")
+	fmt.Println("  Cluster-Settings (VIP-Interface!), DNS/NTP-Listen-Adressen")
+	fmt.Println()
+	fmt.Println("Nächste Schritte:")
+	fmt.Println("  1) sudo systemctl restart edgeguard-api")
+	fmt.Println("  2) VIP/Keepalived auf BEIDEN Nodes separat konfigurieren:")
+	fmt.Println("     Settings → Cluster → VIP/Keepalived")
+	fmt.Println("  3) Bei Failover: edgeguard-ctl promote (auf dem Secondary)")
+	return 0
+}
+
+// pgReplicationCreds sind die Credentials die der Primary via mTLS zurückgibt.
+type pgReplicationCreds struct {
+	Host     string `json:"host"`
+	Port     int    `json:"port"`
+	User     string `json:"user"`
+	Password string `json:"password"`
+}
+
+// fetchReplicationCreds ruft GET /agent/cluster/pg-replication-info via mTLS ab.
+func fetchReplicationCreds(host string, agentPort int, tlsDir string) (*pgReplicationCreds, error) {
+	caPath := filepath.Join(tlsDir, "ca.crt")
+	certPath := filepath.Join(tlsDir, "peer.crt")
+	keyPath := filepath.Join(tlsDir, "peer.key")
+
+	caCert, err := os.ReadFile(caPath)
+	if err != nil {
+		return nil, fmt.Errorf("read ca.crt: %w", err)
+	}
+	pool := x509.NewCertPool()
+	pool.AppendCertsFromPEM(caCert)
+
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return nil, fmt.Errorf("load peer cert: %w", err)
+	}
+
+	client := &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs:      pool,
+				Certificates: []tls.Certificate{cert},
+			},
+		},
+	}
+
+	url := fmt.Sprintf("https://%s:%d/agent/cluster/pg-replication-info", host, agentPort)
+	resp, err := client.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("GET %s: HTTP %d", url, resp.StatusCode)
+	}
+
+	var result struct {
+		Data pgReplicationCreds `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("decode response: %w", err)
+	}
+	return &result.Data, nil
+}
+
+// syncMasterKey holt den Secrets-Master-Key vom Primary via mTLS und schreibt
+// ihn nach /var/lib/edgeguard/.master_key. Dadurch können replizierte
+// verschlüsselte WireGuard-Keys und PSKs auf dem Secondary entschlüsselt werden.
+func syncMasterKey(host string, agentPort int, tlsDir string) error {
+	caPath := filepath.Join(tlsDir, "ca.crt")
+	certPath := filepath.Join(tlsDir, "peer.crt")
+	keyPath := filepath.Join(tlsDir, "peer.key")
+
+	caCert, err := os.ReadFile(caPath)
+	if err != nil {
+		return fmt.Errorf("read ca.crt: %w", err)
+	}
+	rootPool := x509.NewCertPool()
+	rootPool.AppendCertsFromPEM(caCert)
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return fmt.Errorf("load peer cert: %w", err)
+	}
+	client := &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs:      rootPool,
+				Certificates: []tls.Certificate{cert},
+			},
+		},
+	}
+	url := fmt.Sprintf("https://%s:%d/agent/cluster/master-key", host, agentPort)
+	resp, err := client.Get(url)
+	if err != nil {
+		return fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("GET %s: HTTP %d", url, resp.StatusCode)
+	}
+	var result struct {
+		Data struct {
+			KeyHex string `json:"key_hex"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	key := make([]byte, 32)
+	if _, err := fmt.Sscanf(result.Data.KeyHex, "%x", &key); err != nil {
+		return fmt.Errorf("decode key_hex: %w", err)
+	}
+	const masterKeyPath = "/var/lib/edgeguard/.master_key"
+	if err := os.WriteFile(masterKeyPath, key, 0o600); err != nil {
+		return fmt.Errorf("write master key: %w", err)
+	}
+	if u, err := user.Lookup("edgeguard"); err == nil {
+		uid, _ := strconv.Atoi(u.Uid)
+		gid, _ := strconv.Atoi(u.Gid)
+		_ = os.Chown(masterKeyPath, uid, gid)
+	}
+	return nil
+}
+
+// generatePassword erzeugt ein kryptographisch sicheres Passwort.
+func generatePassword(n int) (string, error) {
+	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	buf := make([]byte, n)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	for i, b := range buf {
+		buf[i] = charset[int(b)%len(charset)]
+	}
+	return string(buf), nil
+}
+
+// psqlDBExec führt SQL in der angegebenen Datenbank als postgres-Superuser aus.
+func psqlDBExec(db, sql string) error {
+	_, err := psqlDBRun(db, []string{"-v", "ON_ERROR_STOP=1", "-c", sql})
+	return err
+}
+
+// psqlDBRun führt psql-Kommandos gegen eine bestimmte Datenbank aus.
+func psqlDBRun(db string, args []string) ([]byte, error) {
+	baseArgs := []string{"-d", db}
+	return psqlRun(append(baseArgs, args...))
+}

cmd/edgeguard-ctl/main.go

@@ -1,7 +1,6 @@
 // Command edgeguard-ctl is the admin CLI for setup, migrations and
-// (later) cluster ops. v1 wires migrate + initdb so postinst can
-// initialise a fresh node; cluster-* and promote remain stubs until
-// Phase 3.
+// cluster ops. v1.2 implements PG streaming replication setup,
+// VIP/Keepalived config and manual failover (promote).
 package main
 
 import (
@@ -11,7 +10,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.0.78"
+var version = "1.2.15"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
@@ -25,11 +24,25 @@ Commands:
   migrate check                Validate embedded migrations (no DB connect)
   migrate dump [dir]           Write embedded SQL files to dir (default: ./migrations)
   initdb                       Create PostgreSQL role + database (idempotent)
-  render-config                Regenerate haproxy / nftables configs from PG (--no-reload, --only=)
-  wg-import [--path <dir>]     Import existing /etc/wireguard/*.conf files into the DB
+  render-config                Regenerate all configs from PG (--no-reload, --only=svc)
+                               Services: haproxy nftables squid wireguard unbound chrony keepalived
+  wg-import [--path <dir>] [iface…]
+                               Import /etc/wireguard/*.conf files into the DB.
   reset-password               Generate a one-time token for the /reset-password UI flow
-  cluster-join                 Join an existing cluster (Phase 3, not yet implemented)
-  promote                      Promote this node's PG to primary (Phase 3, not yet implemented)
+  cluster-join <primary> --token <…>
+                               Provision Cluster-TLS material; writes ca.crt + peer.{crt,key}
+  cluster-init-replication     Richtet PG Logical Replication auf dem Primary ein.
+                               Erstellt edgeguard_replicator-Rolle, setzt wal_level=logical,
+                               erstellt PUBLICATION edgeguard_shared (alle geteilten Tabellen).
+                               Auf dem Primary ausführen bevor der Secondary joined.
+  cluster-setup-standby <ip>   Richtet diesen Node als Logical-Replication-Subscriber ein.
+                               Erstellt SUBSCRIPTION gegen den Primary (Initialkopiierung
+                               aller geteilten Tabellen). Node-eigene Daten (Interfaces,
+                               IPs, Routen, VIP-Settings) bleiben unangetastet.
+                               Voraussetzung: cluster-join + cluster-init-replication.
+  cluster-renew-self           Re-issue this node's peer.{crt,key} using the local cluster CA.
+  promote                      Promote diesen PG-Standby zum Primary (manueller Failover).
+                               Kein Auto-Promote — Split-Brain-Schutz durch manuelle Entscheidung.
   dump-config                  Print effective config (Phase 3, not yet implemented)
 `
 
@@ -53,7 +66,17 @@ func main() {
 		os.Exit(cmdWGImport(os.Args[2:]))
 	case "reset-password":
 		os.Exit(cmdResetPassword())
-	case "cluster-join", "cluster-leave", "promote", "dump-config":
+	case "cluster-join":
+		os.Exit(cmdClusterJoin(os.Args[2:]))
+	case "cluster-renew-self":
+		os.Exit(cmdClusterRenewSelf(os.Args[2:]))
+	case "cluster-init-replication":
+		os.Exit(cmdClusterInitReplication(os.Args[2:]))
+	case "cluster-setup-standby":
+		os.Exit(cmdClusterSetupStandby(os.Args[2:]))
+	case "promote":
+		os.Exit(cmdPromote(os.Args[2:]))
+	case "cluster-leave", "dump-config":
 		fmt.Fprintf(os.Stderr, "edgeguard-ctl: %q is a Phase-3 stub — not yet implemented\n", os.Args[1])
 		os.Exit(1)
 	default:

cmd/edgeguard-ctl/promote.go

@@ -0,0 +1,160 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/keepalived"
+)
+
+// cmdPromote promotes this node's PostgreSQL instance from Hot-Standby
+// to Primary. Manual failover — keine automatische Promotion, um Split-Brain
+// in 2-Node-Clustern ohne externen Quorum zu verhindern.
+//
+// Ablauf:
+//  1. Prüfen ob standby.signal vorhanden (wir sind wirklich Standby)
+//  2. pg_ctlcluster promote → PG wird Primary
+//  3. Warten bis pg_is_in_recovery() = false
+//  4. ha_nodes.pg_role auf 'primary' setzen
+//  5. KeyDB cluster:pg-primary-url auf lokal setzen
+//  6. keepalived.conf neu rendern (Primary bekommt Priorität 200)
+//  7. keepalived reload
+func cmdPromote(args []string) int {
+	pg, err := detectPGConfig()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "promote: PG-Erkennung:", err)
+		return 1
+	}
+
+	// 1. Standby-Signal prüfen
+	signalPath := filepath.Join(pg.DataDir, "standby.signal")
+	if _, err := os.Stat(signalPath); os.IsNotExist(err) {
+		fmt.Fprintf(os.Stderr,
+			"promote: %s nicht gefunden — diese Node ist kein PG-Standby oder wurde bereits promoted.\n",
+			signalPath)
+		return 1
+	}
+
+	fmt.Printf("→ Promoting PostgreSQL %s/%s zu Primary...\n", pg.Version, pg.Cluster)
+	if out, err := exec.Command("pg_ctlcluster", pg.Version, pg.Cluster, "promote").
+		CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "promote: pg_ctlcluster promote: %v\n%s\n", err, out)
+		return 1
+	}
+	fmt.Println("✓ pg_ctlcluster promote gesendet")
+
+	// 2. Warten bis PG wirklich Primary ist (pg_is_in_recovery = false)
+	fmt.Print("→ Warte auf PG Primary-Mode")
+	deadline := time.Now().Add(60 * time.Second)
+	for time.Now().Before(deadline) {
+		out, err := psqlRun([]string{"-tA", "-c", "SELECT pg_is_in_recovery();"})
+		if err == nil && strings.TrimSpace(string(out)) == "f" {
+			break
+		}
+		fmt.Print(".")
+		time.Sleep(2 * time.Second)
+	}
+	fmt.Println()
+	// Nochmal prüfen
+	out, err := psqlRun([]string{"-tA", "-c", "SELECT pg_is_in_recovery();"})
+	if err != nil || strings.TrimSpace(string(out)) != "f" {
+		fmt.Fprintln(os.Stderr, "promote: PG ist nach 60s noch in recovery — prüfe PG-Logs")
+		return 1
+	}
+	fmt.Println("✓ PostgreSQL ist jetzt Primary")
+
+	// 3. ha_nodes.pg_role + role aktualisieren
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	pool, err := database.Open(ctx, database.ConnStringFromEnv())
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "promote: db connect:", err)
+		fmt.Println("  → ha_nodes manuell updaten: UPDATE ha_nodes SET pg_role='primary', role='primary' WHERE id='<local-id>';")
+	} else {
+		defer pool.Close()
+		localID, err := loadLocalID()
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "promote: local node ID:", err)
+		} else {
+			_, err = pool.Exec(ctx, `UPDATE ha_nodes SET pg_role='primary', role='primary', status='online', updated_at=NOW() WHERE id=$1`, localID)
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "promote: update ha_nodes:", err)
+			} else {
+				fmt.Println("✓ ha_nodes.pg_role = 'primary' gesetzt")
+			}
+		}
+	}
+
+	// 4. KeyDB cluster:pg-primary-url updaten
+	if err := updateKeyDBPrimaryURL(); err != nil {
+		fmt.Fprintf(os.Stderr, "promote: KeyDB update: %v\n", err)
+		fmt.Println("  → Manuell: redis-cli SET cluster:pg-primary-url 'postgres://edgeguard@/edgeguard'")
+	} else {
+		fmt.Println("✓ KeyDB cluster:pg-primary-url aktualisiert")
+	}
+
+	// 5. Keepalived.conf neu rendern (Primary = Priorität 200)
+	if pool != nil {
+		localID, _ := loadLocalID()
+		kg := keepalived.New(pool, localID)
+		renderCtx, renderCancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer renderCancel()
+		if err := kg.Render(renderCtx); err != nil {
+			fmt.Fprintf(os.Stderr, "promote: keepalived render: %v\n", err)
+			fmt.Println("  → Manuell: edgeguard-ctl render-config --only=keepalived")
+		} else {
+			fmt.Println("✓ keepalived.conf neu gerendert (Priority 200)")
+		}
+	}
+
+	fmt.Println()
+	fmt.Println("✓ Promotion abgeschlossen. Diese Node ist jetzt der primäre EdgeGuard-Knoten.")
+	fmt.Println()
+	fmt.Println("Empfohlene Nachschritte:")
+	fmt.Println("  1) sudo systemctl restart edgeguard-api  (falls noch nicht laufend)")
+	fmt.Println("  2) Alte Primary-Node nach Recovery als neuen Standby einrichten:")
+	fmt.Println("     edgeguard-ctl cluster-setup-standby <diese-node-ip>")
+	return 0
+}
+
+// loadLocalID liest die Node-ID aus /var/lib/edgeguard/node.conf.
+func loadLocalID() (string, error) {
+	c, err := cluster.LoadLocalConfig("")
+	if err != nil {
+		return "", err
+	}
+	if c.NodeID == "" {
+		return "", fmt.Errorf("NODE_ID in node.conf ist leer")
+	}
+	return c.NodeID, nil
+}
+
+// updateKeyDBPrimaryURL schreibt den lokalen PG-DSN als cluster:pg-primary-url
+// in KeyDB, damit alle Nodes im Cluster Writes an diese Node schicken.
+func updateKeyDBPrimaryURL() error {
+	// edgeguard-api nutzt Unix-Socket-Auth, der DSN ist immer lokal.
+	const localDSN = "postgres://edgeguard@/edgeguard?host=/var/run/postgresql"
+	out, err := exec.Command("redis-cli",
+		"-s", "/var/run/keydb/keydb.sock",
+		"SET", "cluster:pg-primary-url", localDSN,
+	).CombinedOutput()
+	if err != nil {
+		// Fallback: Standard-Port
+		out2, err2 := exec.Command("redis-cli",
+			"-p", "6379",
+			"SET", "cluster:pg-primary-url", localDSN,
+		).CombinedOutput()
+		if err2 != nil {
+			return fmt.Errorf("%v: %s / %v: %s", err, out, err2, out2)
+		}
+	}
+	return nil
+}

cmd/edgeguard-ctl/render.go

@@ -12,6 +12,8 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/firewall"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/haproxy"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/keepalived"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/configorch"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/secrets"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/squid"
@@ -64,7 +66,16 @@ func cmdRenderConfig(args []string) int {
 		fw.SkipReload = true
 	}
 
+	// keepalived: Node-ID aus node.conf für Prioritäts-Berechnung
+	var ka configgen.Generator
+	if lc, err := cluster.LoadLocalConfig(""); err == nil && lc.NodeID != "" {
+		ka = keepalived.New(pool, lc.NodeID)
+	}
+
 	gens := []configgen.Generator{hap, fw, sq, wg, ub, cn}
+	if ka != nil {
+		gens = append(gens, ka)
+	}
 
 	results, runErr := configorch.Run(ctx, gens, only)
 	fmt.Print(configorch.Summarise(results))

cmd/edgeguard-ctl/wg_import.go

@@ -46,7 +46,9 @@ func cmdWGImport(args []string) int {
 		wireguard.NewPeersRepo(pool),
 		box,
 	)
-	res, err := im.ImportDir(ctx, *path)
+	// Positional args after flags = specific interface names to import.
+	names := fs.Args()
+	res, err := im.ImportSelected(ctx, *path, names)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "wg-import:", err)
 		return 1

cmd/edgeguard-scheduler/main.go

@@ -9,21 +9,30 @@
 package main
 
 import (
+	"bufio"
 	"context"
 	"encoding/json"
 	"fmt"
 	"log/slog"
+	"net"
 	"os"
+	"os/exec"
+	"regexp"
 	"strconv"
+	"strings"
+	"syscall"
 	"time"
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/license"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/acme"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/alerts"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/backends"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/backup"
 	backupremote "git.netcell-it.de/projekte/edgeguard-native/internal/services/backup/remote"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/certrenewer"
@@ -32,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.0.78"
+var version = "1.2.35"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
@@ -53,10 +62,85 @@ const (
 	// Retention: 14 erfolgreiche Backups (default in backup.Service).
 	backupTickInterval = 24 * time.Hour
 
-	// configHashTickInterval — alle 5 min config_hash neu berechnen
-	// und in ha_nodes der eigenen Row schreiben. Cluster-UI nutzt
-	// das fürs Drift-Banner — pro-Mutation-Refresh wäre teuer.
-	configHashTickInterval = 5 * time.Minute
+	// staleSweepTickInterval — Phase 3.2: alle 30s prüfen ob Peers
+	// last_seen länger als staleThreshold nicht gemeldet haben →
+	// status='offline'. Symmetrisch zum 30s-API-Heartbeat.
+	staleSweepTickInterval = 30 * time.Second
+
+	// staleThreshold — Peer gilt als offline wenn last_seen älter als
+	// das ist. 4× Heartbeat-Intervall lässt einen verpassten Tick
+	// (Restart, GC-Pause, kurzer Network-Glitch) zu ohne false positive.
+	staleThreshold = 2 * time.Minute
+
+	// clusterCertCheckInterval — täglicher Check ob CA + peer-cert
+	// in den nächsten clusterCertWarnDays ablaufen. Bei Hit feuert
+	// ein Alert (dedupe 12h damit der Operator nicht alle 24h dieselbe
+	// Warnung sieht).
+	clusterCertCheckInterval = 24 * time.Hour
+
+	// clusterCertWarnDays — Schwelle für die Cert-Expiry-Warnung.
+	// Operator hat damit min. 30 Tage Vorlauf für `edgeguard-ctl
+	// cluster-renew-self` oder einen manuellen Re-Join.
+	clusterCertWarnDays = 30
+
+	// clusterCertAutoRenewDays — Schwelle ab der wir automatisch
+	// neu signieren (nur Founder mit lokaler CA). Wir liegen 2× vor
+	// der Warn-Schwelle damit ein verpasster Tick + ein verpasster
+	// Restart-Window noch passen.
+	clusterCertAutoRenewDays = 60
+
+	// diskCheckInterval — stündliche Disk-Usage-Prüfung. Fire-Schwellen
+	// in runDiskCheck (warning 80%, error 90%). Stündlich ist schnell
+	// genug damit der Operator vor /var = 100% noch Zeit zum Aufräumen
+	// hat, ohne Log-Spam zu produzieren (Dedupe 12h pro Severity).
+	diskCheckInterval = 1 * time.Hour
+
+	diskWarnPct     = 80.0
+	diskCriticalPct = 90.0
+
+	// auditCleanupInterval — täglicher Cleanup. Audit-Rows älter als
+	// auditRetentionDays werden gelöscht. Idempotent — wenn nichts da
+	// ist passiert nichts.
+	auditCleanupInterval = 24 * time.Hour
+	auditRetentionDays   = 90
+
+	// backendDownCheckInterval — alle 2 Minuten HAProxy-Stats lesen und
+	// prüfen ob ein Backend komplett ausgefallen ist (alle Server DOWN).
+	// Dedupe 12h pro Backend → kein Alert-Spam. Frischer Alert wenn das
+	// Backend nach 12h immer noch unten ist.
+	backendDownCheckInterval = 2 * time.Minute
+
+	// memCheckInterval — alle 5 Minuten /proc/meminfo lesen. Schwellen
+	// warning 85%, critical 95%. Dedupe 1h pro Severity damit bei einem
+	// kurzfristigen Spike nicht jeder Tick feuert.
+	memCheckInterval = 5 * time.Minute
+	memWarnPct       = 85.0
+	memCriticalPct   = 95.0
+
+	// conntrackCheckInterval — alle 2 Minuten /proc/sys/net/netfilter/
+	// nf_conntrack_count+max lesen. Eine volle conntrack-Tabelle verwirft
+	// alle neuen Verbindungen ohne jegliche Rückmeldung. 2-Minuten-Takt
+	// erlaubt früh zu warnen bevor die Tabelle überläuft.
+	// Schwellen analog Disk: 80% Warning, 90% Critical. Dedupe 1h.
+	conntrackCheckInterval = 2 * time.Minute
+	conntrackWarnPct       = 80.0
+	conntrackCriticalPct   = 90.0
+
+	// ntpSyncCheckInterval — alle 10 Minuten chronyc tracking aufrufen.
+	// Keine Sync bedeutet: Uhr driftet → TLS-Cert-Prüfung schlägt fehl
+	// wenn die Abweichung > Toleranz des Gegenstücks (i.d.R. ±1 min),
+	// JWT-Ablauf inkonsistent, Cluster-Split-Brain möglich. Dedupe 1h
+	// damit ein kurzer Upstream-Ausfall (Reboot, DHCP-Pause) keinen
+	// Alert-Regen produziert.
+	ntpSyncCheckInterval = 10 * time.Minute
+
+	// wgTunnelCheckInterval — alle 5 Minuten WireGuard-Client-Tunnels
+	// auf Aktualität prüfen. Client-Tunnels (mode='client') haben genau
+	// einen Peer; wenn dessen letzter Handshake älter als wgStaleSec ist,
+	// ist der Tunnel effektiv tot — Traffic droht lautlos. Dedupe 30min
+	// pro Tunnel damit schnell wiederhergestellte Tunnels nur einmal feuern.
+	wgTunnelCheckInterval = 5 * time.Minute
+	wgStaleSec           = int64(5 * 60) // 5 Minuten ohne Handshake = tot
 )
 
 func main() {
@@ -98,6 +182,7 @@ func main() {
 		"dir", backupSvc.BackupDir, "keep_n", backup.DefaultKeepN)
 
 	alertSvc := alerts.New(pool)
+	auditRepo := audit.New(pool)
 	alertDedupe := newDedupe(12 * time.Hour)
 
 	if renewer != nil {
@@ -105,13 +190,15 @@ func main() {
 	}
 	runLicenseVerify(ctx, licClient, licKeyStore, licRepo, nodeID, alertSvc, alertDedupe)
 
-	// Lokale Node-ID für config-hash-refresh. EnsureNodeID liefert
-	// dieselbe ID die die API hat (gleiches /var/lib/edgeguard/node-id).
+	// Lokale Node-ID für Heartbeat. EnsureNodeID liefert dieselbe ID
+	// die die API hat (gleiches /var/lib/edgeguard/node-id).
 	localID, _ := cluster.EnsureNodeID("")
-	slog.Info("scheduler: config-hash refresh enabled", "tick", configHashTickInterval, "node_id", localID)
-	// Initial-Refresh damit /cluster/status nach API+Scheduler-Boot
-	// nicht 5min auf den ersten Wert wartet.
-	runConfigHash(ctx, pool, localID)
+	slog.Info("scheduler: stale-sweeper enabled",
+		"tick", staleSweepTickInterval, "threshold", staleThreshold, "node_id", localID)
+	// Initial-Sweep + initial-Heartbeat damit /cluster/status nach
+	// Scheduler-Boot direkt einen frischen Zustand sieht.
+	runHeartbeat(ctx, pool, localID, version)
+	runStaleSweep(ctx, pool)
 
 	renewTick := time.NewTicker(renewTickInterval)
 	defer renewTick.Stop()
@@ -119,8 +206,48 @@ func main() {
 	defer licTick.Stop()
 	backupTick := time.NewTicker(backupTickInterval)
 	defer backupTick.Stop()
-	hashTick := time.NewTicker(configHashTickInterval)
-	defer hashTick.Stop()
+	sweepTick := time.NewTicker(staleSweepTickInterval)
+	defer sweepTick.Stop()
+	clusterCertTick := time.NewTicker(clusterCertCheckInterval)
+	defer clusterCertTick.Stop()
+	// Initial-Cert-Check direkt beim Start, sonst sieht der Operator
+	// einen Warning erst nach 24h ab Boot.
+	runClusterCertExpiryCheck(ctx, alertSvc, alertDedupe)
+
+	diskTick := time.NewTicker(diskCheckInterval)
+	defer diskTick.Stop()
+	// Initial-Disk-Check: wenn die Box schon bei 95% steht beim
+	// Scheduler-Boot, wollen wir keine Stunde auf den ersten Alert
+	// warten.
+	runDiskCheck(ctx, alertSvc, alertDedupe)
+
+	auditTick := time.NewTicker(auditCleanupInterval)
+	defer auditTick.Stop()
+
+	backendDownTick := time.NewTicker(backendDownCheckInterval)
+	defer backendDownTick.Stop()
+	// Initial-Check direkt beim Start — wenn ein Backend seit dem letzten
+	// Scheduler-Restart down ist, brauchen wir nicht 2 Minuten zu warten.
+	runBackendDownCheck(ctx, pool, alertSvc, alertDedupe)
+
+	memTick := time.NewTicker(memCheckInterval)
+	defer memTick.Stop()
+	runMemoryCheck(ctx, alertSvc, alertDedupe)
+
+	conntrackTick := time.NewTicker(conntrackCheckInterval)
+	defer conntrackTick.Stop()
+	runConntrackCheck(ctx, alertSvc, alertDedupe)
+
+	ntpSyncTick := time.NewTicker(ntpSyncCheckInterval)
+	defer ntpSyncTick.Stop()
+	// Kein Initial-Check bei Boot: chrony braucht nach dem Start
+	// einige Sekunden bis zur ersten Synchronisation — ein
+	// sofortiger Check würde immer feuern.
+
+	wgTunnelTick := time.NewTicker(wgTunnelCheckInterval)
+	defer wgTunnelTick.Stop()
+	// Kein Initial-Check bei Boot: Tunnels brauchen nach dem Start
+	// des wg-quick-Dienstes einen Moment für den ersten Handshake.
 
 	for {
 		select {
@@ -132,13 +259,626 @@ func main() {
 		case <-licTick.C:
 			runLicenseVerify(ctx, licClient, licKeyStore, licRepo, nodeID, alertSvc, alertDedupe)
 		case <-backupTick.C:
-			runBackup(ctx, backupSvc, version, alertSvc)
-		case <-hashTick.C:
-			runConfigHash(ctx, pool, localID)
+			runBackup(ctx, backupSvc, version, alertSvc, setupStore)
+		case <-sweepTick.C:
+			// Symmetrisches Heartbeat aus dem Scheduler — falls die API
+			// pausiert/hängt, hält der Scheduler die eigene Row warm.
+			// Idempotent zur API-Heartbeat-Goroutine.
+			runHeartbeat(ctx, pool, localID, version)
+			runStaleSweep(ctx, pool)
+		case <-clusterCertTick.C:
+			runClusterCertExpiryCheck(ctx, alertSvc, alertDedupe)
+		case <-diskTick.C:
+			runDiskCheck(ctx, alertSvc, alertDedupe)
+		case <-auditTick.C:
+			runAuditCleanup(ctx, auditRepo, setupStore)
+		case <-backendDownTick.C:
+			runBackendDownCheck(ctx, pool, alertSvc, alertDedupe)
+		case <-memTick.C:
+			runMemoryCheck(ctx, alertSvc, alertDedupe)
+		case <-conntrackTick.C:
+			runConntrackCheck(ctx, alertSvc, alertDedupe)
+		case <-ntpSyncTick.C:
+			runNTPSyncCheck(ctx, alertSvc, alertDedupe)
+		case <-wgTunnelTick.C:
+			runWGClientTunnelCheck(ctx, pool, alertSvc, alertDedupe)
 		}
 	}
 }
 
+// runAuditCleanup löscht audit_log-Rows älter als die konfigurierte
+// Retention. Operator kann den Wert in den Settings übersteuern; ohne
+// Setup-Custom fällt's auf auditRetentionDays-Default zurück.
+// Schutz vor unbounded growth — auf einer aktiven Box wird das Log
+// nach 1-2 Jahren mehrere GB groß und macht die /logs-Page langsam.
+// Best-effort: Fehler werden nur geloggt, der Tick läuft beim nächsten
+// Zyklus wieder.
+func runAuditCleanup(ctx context.Context, r *audit.Repo, setupStore *setup.Store) {
+	if r == nil {
+		return
+	}
+	keepDays := auditRetentionDays
+	if setupStore != nil {
+		if st, err := setupStore.Load(); err == nil && st != nil && st.AuditRetentionDays > 0 {
+			keepDays = st.AuditRetentionDays
+		}
+	}
+	cctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	n, err := r.Cleanup(cctx, keepDays)
+	if err != nil {
+		slog.Warn("scheduler: audit cleanup failed",
+			"keep_days", keepDays, "error", err)
+		return
+	}
+	if n > 0 {
+		slog.Info("scheduler: audit cleanup",
+			"deleted", n, "keep_days", keepDays)
+	}
+}
+
+// runDiskCheck prüft die Belegung von / via statfs. Fire-Schwellen:
+//   - >= 90% → Critical (error). Box ist akut gefährdet — beim
+//     nächsten Backup-Run oder größeren apt-Update droht "no space
+//     left" und damit failed services.
+//   - >= 80% → Warning. Operator hat noch Luft aber sollte aufräumen.
+//   - <  80% → kein Alert.
+//
+// Dedupe-Keys pro Severity, damit ein lang-belegtes Filesystem nicht
+// jede Stunde feuert (12h pro Stufe). Bei Übergang warning→critical
+// gibt's einen frischen Alert weil die Keys verschieden sind.
+//
+// Fix-Hint im Body: was der Operator als Erstes prüfen soll
+// (/var/backups/edgeguard, /var/log/edgeguard, /var/cache/apt).
+func runDiskCheck(ctx context.Context, a *alerts.Service, d *dedupe) {
+	if a == nil || d == nil {
+		return
+	}
+	var fs syscall.Statfs_t
+	if err := syscall.Statfs("/", &fs); err != nil {
+		slog.Warn("scheduler: disk-check statfs failed", "error", err)
+		return
+	}
+	total := float64(fs.Blocks) * float64(fs.Bsize)
+	free := float64(fs.Bavail) * float64(fs.Bsize)
+	if total <= 0 {
+		return
+	}
+	usedPct := (total - free) * 100 / total
+	freeGB := free / (1024 * 1024 * 1024)
+	totalGB := total / (1024 * 1024 * 1024)
+
+	var key, title string
+	var sev alerts.Severity
+	switch {
+	case usedPct >= diskCriticalPct:
+		key = "disk.full.critical"
+		sev = alerts.SeverityError
+		title = fmt.Sprintf("Disk kritisch voll: %.0f%%", usedPct)
+	case usedPct >= diskWarnPct:
+		key = "disk.full.warning"
+		sev = alerts.SeverityWarning
+		title = fmt.Sprintf("Disk-Belegung hoch: %.0f%%", usedPct)
+	default:
+		return
+	}
+	if !d.shouldFire(key) {
+		return
+	}
+	desc := fmt.Sprintf(
+		"Wurzel-Filesystem (/) ist zu %.1f%% belegt — noch %.2f GB von %.2f GB frei.\n\n"+
+			"Häufige Verursacher checken:\n"+
+			"  sudo du -hs /var/backups/edgeguard /var/log/edgeguard /var/cache/apt /var/lib/postgresql\n\n"+
+			"Backup-Retention ist 14 (default). Manuell aufräumen:\n"+
+			"  ls -lhS /var/backups/edgeguard | head\n"+
+			"  sudo apt-get clean   # /var/cache/apt leeren",
+		usedPct, freeGB, totalGB)
+	if _, err := a.Fire(ctx, "disk.full", sev, title, desc); err != nil {
+		slog.Warn("scheduler: disk-check alert fire failed", "error", err)
+	}
+}
+
+// runClusterCertExpiryCheck warnt wenn CA oder peer.crt in <
+// clusterCertWarnDays Tagen ablaufen (oder schon abgelaufen sind).
+// Dedupe pro Cert-Typ + 12h.
+//
+// Zusätzlich (Phase 1.1.1): wenn das peer.crt < clusterCertAutoRenewDays
+// remaining hat UND eine lokale CA existiert, wird automatisch neu
+// signiert. Restart-Hinweis als Info-Alert — wir starten edgeguard-api
+// nicht selbst neu, das passiert beim nächsten geplanten Update/Reboot.
+// runMemoryCheck liest /proc/meminfo und feuert bei hoher RAM-Belegung.
+// Schwellen: warning >= 85%, critical >= 95%. Dedupe 1h pro Severity
+// damit kurze Spikes (Backup, apt-Upgrade) keine Alert-Flut erzeugen.
+func runMemoryCheck(ctx context.Context, a *alerts.Service, d *dedupe) {
+	if a == nil || d == nil {
+		return
+	}
+	data, err := os.ReadFile("/proc/meminfo")
+	if err != nil {
+		return
+	}
+	var memTotal, memAvail int64
+	for _, line := range strings.Split(string(data), "\n") {
+		var key string
+		var val int64
+		if _, err := fmt.Sscanf(line, "%s %d", &key, &val); err != nil {
+			continue
+		}
+		switch key {
+		case "MemTotal:":
+			memTotal = val
+		case "MemAvailable:":
+			memAvail = val
+		}
+	}
+	if memTotal <= 0 {
+		return
+	}
+	usedPct := float64(memTotal-memAvail) * 100 / float64(memTotal)
+	usedGB := float64(memTotal-memAvail) / 1024 / 1024
+	totalGB := float64(memTotal) / 1024 / 1024
+
+	var key, title string
+	var sev alerts.Severity
+	switch {
+	case usedPct >= memCriticalPct:
+		key = "mem.high.critical"
+		sev = alerts.SeverityError
+		title = fmt.Sprintf("RAM kritisch hoch: %.0f%%", usedPct)
+	case usedPct >= memWarnPct:
+		key = "mem.high.warning"
+		sev = alerts.SeverityWarning
+		title = fmt.Sprintf("RAM-Belegung hoch: %.0f%%", usedPct)
+	default:
+		return
+	}
+	if !d.shouldFire(key) {
+		return
+	}
+	desc := fmt.Sprintf(
+		"RAM-Auslastung: %.1f%% — %.1f von %.1f GB belegt.\n\n"+
+			"Häufige Ursachen:\n"+
+			"  • Unbound-Cache zu groß (rrset-cache-size in /etc/edgeguard/unbound/unbound.conf)\n"+
+			"  • Squid cache_mem zu groß (64 MB default)\n"+
+			"  • PostgreSQL shared_buffers (default ~128 MB)\n"+
+			"  • Prozesse prüfen: ps aux --sort=-%%mem | head -10",
+		usedPct, usedGB, totalGB)
+	if _, err := a.Fire(ctx, "mem.high", sev, title, desc); err != nil {
+		slog.Warn("scheduler: memory-check alert fire failed", "error", err)
+	}
+}
+
+// runConntrackCheck liest die conntrack-Tabellen-Belegung aus /proc und
+// feuert bei hoher Auslastung. Eine volle conntrack-Tabelle (100%)
+// verwirft alle neuen TCP/UDP-Verbindungen ohne ICMP-Rückmeldung —
+// der Operator sieht auf der Gegenstelle nur Timeouts.
+//
+// Schwellen: 80% Warning, 90% Critical (wie Disk, niedriger als RAM weil
+// der Impact sofortig ist). Dedupe 1h pro Severity.
+func runConntrackCheck(ctx context.Context, a *alerts.Service, d *dedupe) {
+	if a == nil || d == nil {
+		return
+	}
+	readInt := func(path string) int64 {
+		b, err := os.ReadFile(path)
+		if err != nil {
+			return 0
+		}
+		v, _ := strconv.ParseInt(strings.TrimSpace(string(b)), 10, 64)
+		return v
+	}
+	count := readInt("/proc/sys/net/netfilter/nf_conntrack_count")
+	max := readInt("/proc/sys/net/netfilter/nf_conntrack_max")
+	if max <= 0 {
+		return
+	}
+	usedPct := float64(count) * 100 / float64(max)
+
+	var key, title string
+	var sev alerts.Severity
+	switch {
+	case usedPct >= conntrackCriticalPct:
+		key = "conntrack.high.critical"
+		sev = alerts.SeverityError
+		title = fmt.Sprintf("Conntrack-Tabelle kritisch voll: %.0f%%", usedPct)
+	case usedPct >= conntrackWarnPct:
+		key = "conntrack.high.warning"
+		sev = alerts.SeverityWarning
+		title = fmt.Sprintf("Conntrack-Tabelle fast voll: %.0f%%", usedPct)
+	default:
+		return
+	}
+	if !d.shouldFire(key) {
+		return
+	}
+	desc := fmt.Sprintf(
+		"Conntrack-Auslastung: %.1f%% — %d von %d Einträgen belegt.\n\n"+
+			"Wenn die Tabelle auf 100%% steigt, werden alle neuen Verbindungen\n"+
+			"ohne Fehlermeldung verworfen (Silent Drop).\n\n"+
+			"Maßnahmen:\n"+
+			"  • Zeitweilige Spikes: nf_conntrack_max erhöhen\n"+
+			"    (sysctl net.netfilter.nf_conntrack_max)\n"+
+			"  • Leaks: conntrack -L | sort | head zeigt häufige Quellen\n"+
+			"  • Timeouts reduzieren (z.B. nf_conntrack_tcp_timeout_established)",
+		usedPct, count, max)
+	if _, err := a.Fire(ctx, "conntrack.high", sev, title, desc); err != nil {
+		slog.Warn("scheduler: conntrack-check alert fire failed", "error", err)
+	}
+}
+
+// runNTPSyncCheck ruft chronyc tracking auf und feuert einen Alert wenn
+// chrony keine synchronisierte Zeitquelle hat (Stratum 0 oder ≥ 16).
+// Zeitdrift > ~1 Minute führt zu TLS-Handshake-Fehlern, JWT-Ablauf-
+// Inkonsistenzen und möglichen Cluster-Problemen. Dedupe 1h.
+func runNTPSyncCheck(ctx context.Context, a *alerts.Service, d *dedupe) {
+	if a == nil || d == nil {
+		return
+	}
+	out, err := exec.Command("chronyc", "tracking").Output()
+	if err != nil {
+		// chrony nicht installiert oder nicht gestartet — kein Alert,
+		// weil wir nicht wissen ob chrony hier überhaupt erwartet wird.
+		return
+	}
+	synced, stratum, ref := parseChronyTrackingForAlert(string(out))
+	if synced {
+		return
+	}
+	const key = "ntp.unsync"
+	if !d.shouldFire(key) {
+		return
+	}
+	refStr := ref
+	if refStr == "" {
+		refStr = "(keine Referenz)"
+	}
+	title := fmt.Sprintf("NTP nicht synchronisiert (Stratum %d)", stratum)
+	desc := fmt.Sprintf(
+		"chrony hat keine synchronisierte Zeitquelle.\n"+
+			"Referenz: %s  Stratum: %d\n\n"+
+			"Mögliche Ursachen:\n"+
+			"  • Upstream-NTP-Server nicht erreichbar (UDP/123 blockiert?)\n"+
+			"  • Pool-DNS-Einträge lösen nicht auf\n"+
+			"  • chrony läuft, braucht aber noch Zeit nach Boot (warten)\n\n"+
+			"Prüfen: chronyc sources -v  —  chronyc tracking",
+		refStr, stratum)
+	if _, err := a.Fire(ctx, "ntp.unsync", alerts.SeverityWarning, title, desc); err != nil {
+		slog.Warn("scheduler: ntp-sync-check alert fire failed", "error", err)
+	}
+}
+
+// parseChronyTrackingForAlert ist eine schlanke Variante des NTP-Handler-
+// Parsers: liefert nur synced/stratum/reference ohne die vollen Felder.
+func parseChronyTrackingForAlert(out string) (synced bool, stratum int, reference string) {
+	for _, line := range strings.Split(out, "\n") {
+		line = strings.TrimSpace(line)
+		key, val, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		key = strings.TrimSpace(key)
+		val = strings.TrimSpace(val)
+		switch key {
+		case "Reference ID":
+			if i := strings.Index(val, "("); i >= 0 {
+				reference = strings.Trim(val[i:], "()")
+			}
+			if val != "00000000 ()" {
+				synced = true
+			}
+		case "Stratum":
+			fmt.Sscanf(val, "%d", &stratum)
+			if stratum > 0 && stratum < 16 {
+				synced = true
+			} else if stratum == 0 || stratum >= 16 {
+				synced = false
+			}
+		}
+	}
+	return
+}
+
+// runWGClientTunnelCheck prüft alle aktiven WireGuard-Client-Tunnels
+// (mode='client') auf Handshake-Aktualität. Ein Client-Tunnel hat genau
+// einen Peer; wenn dessen letzter Handshake älter als wgStaleSec oder
+// noch nie stattgefunden hat, ist der Tunnel tot — Traffic wird lautlos
+// verworfen (kein ICMP Unreachable). Dedupe 30min pro Tunnel damit
+// nach einer Selbstheilung nicht alle paar Minuten neu gefeuert wird.
+func runWGClientTunnelCheck(ctx context.Context, pool *pgxpool.Pool, a *alerts.Service, d *dedupe) {
+	if a == nil || d == nil || pool == nil {
+		return
+	}
+
+	// Alle aktiven Client-Interfaces aus DB laden.
+	type wgIface struct{ name string }
+	rows, err := pool.Query(ctx,
+		`SELECT name FROM wg_interfaces WHERE mode = 'client' AND active = true ORDER BY name`)
+	if err != nil {
+		return
+	}
+	defer rows.Close()
+	var ifaces []wgIface
+	for rows.Next() {
+		var n string
+		if err := rows.Scan(&n); err == nil {
+			ifaces = append(ifaces, wgIface{n})
+		}
+	}
+	rows.Close()
+	if len(ifaces) == 0 {
+		return
+	}
+
+	now := time.Now().Unix()
+	for _, ifc := range ifaces {
+		out, err := exec.Command("wg", "show", ifc.name, "dump").Output()
+		if err != nil {
+			// Interface existiert nicht mehr im Kernel (wg-quick down) —
+			// das ist selbst schon ein Problem; kein separater Alert hier,
+			// da systemd-Restart-Policy das abdeckt.
+			continue
+		}
+		lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+		// Zeile 0 ist die Interface-Zeile (own key / pubkey / port / fwmark).
+		// Zeile 1 ist die Peer-Zeile: pubkey psk endpoint allowed-ips last-hs rx tx keepalive
+		if len(lines) < 2 {
+			continue
+		}
+		fields := strings.Fields(lines[1])
+		if len(fields) < 5 {
+			continue
+		}
+		lastHS, _ := strconv.ParseInt(fields[4], 10, 64)
+
+		stale := lastHS == 0 || (now-lastHS) > wgStaleSec
+		if !stale {
+			continue
+		}
+		key := "wg.tunnel.down." + ifc.name
+		if !d.shouldFire(key) {
+			continue
+		}
+		var detail string
+		if lastHS == 0 {
+			detail = "Noch kein Handshake — Tunnel wurde nie erfolgreich aufgebaut."
+		} else {
+			ageMin := (now - lastHS) / 60
+			detail = fmt.Sprintf("Letzter Handshake: vor %d Minuten.", ageMin)
+		}
+		title := fmt.Sprintf("WireGuard-Tunnel %s ausgefallen", ifc.name)
+		desc := fmt.Sprintf(
+			"Client-Tunnel %s hat seit >5 Minuten keinen Handshake.\n%s\n\n"+
+				"Traffic zu den RemoteAllowed-Netzen wird lautlos verworfen.\n\n"+
+				"Mögliche Ursachen:\n"+
+				"  • Remote-Peer nicht erreichbar (Firewall, Routing)\n"+
+				"  • Remote-Server-Keypair geändert (Public-Key stimmt nicht mehr)\n"+
+				"  • UDP-Port des Peers geblockt\n"+
+				"  • wg-quick-Dienst auf dieser Box gestoppt: systemctl status wg-quick@%s",
+			ifc.name, detail, ifc.name)
+		if _, err := a.Fire(ctx, "wg.tunnel.down", alerts.SeverityError, title, desc); err != nil {
+			slog.Warn("scheduler: wg-tunnel-check alert fire failed", "iface", ifc.name, "error", err)
+		}
+	}
+}
+
+var egBackendRE = regexp.MustCompile(`^eg_backend_(\d+)$`)
+
+// runBackendDownCheck liest HAProxy-Stats via Admin-Socket und feuert
+// einen Error-Alert für jedes Backend bei dem alle Server DOWN sind
+// (und mind. einer einen echten Health-Check hat). Dedupe 12h pro Backend.
+func runBackendDownCheck(ctx context.Context, pool *pgxpool.Pool, a *alerts.Service, d *dedupe) {
+	if a == nil || d == nil {
+		return
+	}
+	conn, err := net.DialTimeout("unix", "/run/haproxy/admin.sock", 2*time.Second)
+	if err != nil {
+		// HAProxy läuft nicht oder Socket nicht erreichbar — kein Alert,
+		// das ist der Dienst selbst nicht der Scheduler.
+		return
+	}
+	defer conn.Close()
+	_ = conn.SetDeadline(time.Now().Add(3 * time.Second))
+	if _, err := conn.Write([]byte("show stat\n")); err != nil {
+		return
+	}
+
+	type srvEntry struct{ status string; hasCheck bool }
+	byBackend := map[string][]srvEntry{}
+	colIdx := map[string]int{}
+	scanner := bufio.NewScanner(conn)
+	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line == "" {
+			continue
+		}
+		fields := strings.Split(line, ",")
+		if strings.HasPrefix(line, "# ") {
+			fields[0] = strings.TrimPrefix(fields[0], "# ")
+			for i, name := range fields {
+				colIdx[name] = i
+			}
+			continue
+		}
+		px := fieldAt(fields, colIdx["pxname"])
+		sv := fieldAt(fields, colIdx["svname"])
+		if !strings.HasPrefix(px, "eg_backend_") || sv == "BACKEND" || sv == "FRONTEND" || sv == "" {
+			continue
+		}
+		status := fieldAt(fields, colIdx["status"])
+		byBackend[px] = append(byBackend[px], srvEntry{
+			status:   status,
+			hasCheck: status != "no check",
+		})
+	}
+	if len(byBackend) == 0 {
+		return
+	}
+
+	// Friendly Backend-Namen aus DB — best-effort, Fehler = anonyme ID.
+	bkRepo := backends.New(pool)
+	bklist, _ := bkRepo.List(ctx)
+	nameOf := func(id int64) string {
+		for _, b := range bklist {
+			if b.ID == id {
+				return b.Name
+			}
+		}
+		return fmt.Sprintf("#%d", id)
+	}
+
+	for haName, servers := range byBackend {
+		hasRealCheck, allDown := false, true
+		for _, s := range servers {
+			if s.hasCheck {
+				hasRealCheck = true
+			}
+			if s.status == "UP" {
+				allDown = false
+				break
+			}
+		}
+		if !hasRealCheck || !allDown {
+			continue
+		}
+		m := egBackendRE.FindStringSubmatch(haName)
+		if m == nil {
+			continue
+		}
+		id, _ := strconv.ParseInt(m[1], 10, 64)
+		name := nameOf(id)
+
+		key := "backend.down." + haName
+		if !d.shouldFire(key) {
+			continue
+		}
+		msg := fmt.Sprintf(
+			"Alle Server in Backend \"%s\" sind DOWN — HAProxy liefert 503 für alle Requests zu diesem Backend.\n\n"+
+				"HAProxy-Backend-Name: %s\n\n"+
+				"Nächste Schritte:\n"+
+				"  • Dienst auf Backend-Host prüfen (systemctl status / docker ps)\n"+
+				"  • Health-Check-Pfad erreichbar? (curl http://<server>:<port><path>)\n"+
+				"  • Firewall-Regeln zwischen EdgeGuard und Backend-Host prüfen",
+			name, haName)
+		if _, err := a.Fire(ctx, "backend.down", alerts.SeverityError,
+			fmt.Sprintf("Backend DOWN: %s", name), msg); err != nil {
+			slog.Warn("scheduler: backend-down alert fire failed",
+				"backend", name, "error", err)
+		}
+	}
+}
+
+func fieldAt(fields []string, i int) string {
+	if i < 0 || i >= len(fields) {
+		return ""
+	}
+	return fields[i]
+}
+
+func runClusterCertExpiryCheck(ctx context.Context, a *alerts.Service, d *dedupe) {
+	if a == nil || d == nil {
+		return
+	}
+	store := clustertls.New("")
+
+	// Auto-Renew zuerst — danach lesen wir die (eventuell frischen)
+	// Cert-Infos für den Alert-Check ab.
+	tryAutoRenew(ctx, store, a, d)
+
+	check := func(kind, key string, info *clustertls.CertInfo, err error) {
+		if err != nil {
+			return // Cert nicht vorhanden / unleserlich — keine Warnung.
+		}
+		if info.DaysRemaining > clusterCertWarnDays {
+			return
+		}
+		if !d.shouldFire(key) {
+			return
+		}
+		sev := alerts.SeverityWarning
+		title := "Cluster-" + kind + " läuft bald ab"
+		desc := fmt.Sprintf("%s (CN=%s) läuft in %d Tagen ab (NotAfter=%s).",
+			kind, info.CommonName, info.DaysRemaining, info.NotAfter.Format(time.RFC3339))
+		if info.DaysRemaining < 0 {
+			sev = alerts.SeverityError
+			title = "Cluster-" + kind + " ist abgelaufen"
+			desc = fmt.Sprintf("%s (CN=%s) ist seit %d Tagen abgelaufen (NotAfter=%s).",
+				kind, info.CommonName, -info.DaysRemaining, info.NotAfter.Format(time.RFC3339))
+		}
+		desc += "\n\nFix: sudo edgeguard-ctl cluster-renew-self  (founder/single-node)\n      sudo systemctl restart edgeguard-api"
+		if _, err := a.Fire(ctx, "cluster.cert.expiring", sev, title, desc); err != nil {
+			slog.Warn("scheduler: cluster cert alert fire failed", "kind", kind, "error", err)
+		}
+	}
+	if store.HasCA() {
+		info, err := store.CACertInfo()
+		check("CA", "cluster.cert.expiring:ca", info, err)
+	}
+	if store.HasPeer() {
+		info, err := store.PeerCertInfo()
+		check("peer-Cert", "cluster.cert.expiring:peer", info, err)
+	}
+}
+
+// tryAutoRenew: wenn das peer.crt < clusterCertAutoRenewDays Tage
+// remaining hat UND wir eine lokale CA haben (= Founder-Node), wird
+// automatisch ein frisches peer.{crt,key} signiert. Edgeguard-api
+// muss anschließend manuell restartet werden damit der Listener das
+// neue Material lädt — wir alarmieren das, restarten aber nicht
+// selbst (würde laufende Requests + die Heartbeat-Goroutine killen).
+//
+// Joiner-Nodes (keine eigene CA) ignorieren wir hier; sie laufen über
+// einen anderen Renewal-Pfad (Phase 3.6, Renewal-Token via mTLS).
+func tryAutoRenew(ctx context.Context, store *clustertls.Store, a *alerts.Service, d *dedupe) {
+	if !store.HasPeer() || !store.HasCA() {
+		return
+	}
+	info, err := store.PeerCertInfo()
+	if err != nil {
+		return
+	}
+	if info.DaysRemaining > clusterCertAutoRenewDays {
+		return
+	}
+	// CN aus dem alten Cert übernehmen — sonst würde ein Hostname-
+	// Wechsel mitten in der Renewal unbemerkt durchgehen.
+	cn := info.CommonName
+	if cn == "" {
+		cn = "edgeguard-node"
+	}
+	if err := store.RenewSelfSigned(cn, []string{cn}, nil, nil); err != nil {
+		slog.Warn("scheduler: cluster cert auto-renew failed", "error", err)
+		// Failure-Alert dedupe 12h — Operator soll daran erinnert werden.
+		if d.shouldFire("cluster.cert.auto_renew.failed") {
+			_, _ = a.Fire(ctx, "cluster.cert.auto_renew.failed",
+				alerts.SeverityError,
+				"Cluster-Peer-Cert Auto-Renew fehlgeschlagen",
+				"clustertls.RenewSelfSigned: "+err.Error()+
+					"\n\nFix: sudo edgeguard-ctl cluster-renew-self")
+		}
+		return
+	}
+	// Success — neuer Cert auf Disk, alter Cert noch im API-Speicher.
+	// Info-Alert mit Restart-Hinweis. Dedupe 24h damit nicht
+	// gefloodet wird wenn der Operator nicht restartet.
+	if d.shouldFire("cluster.cert.auto_renew.ok") {
+		fresh, _ := store.PeerCertInfo()
+		until := info.NotAfter.Format(time.RFC3339)
+		if fresh != nil {
+			until = fresh.NotAfter.Format(time.RFC3339)
+		}
+		_, _ = a.Fire(ctx, "cluster.cert.auto_renewed",
+			alerts.SeverityInfo,
+			"Cluster-Peer-Cert automatisch erneuert",
+			fmt.Sprintf("Neues Peer-Cert auf Disk (CN=%s, gültig bis %s). "+
+				"Damit edgeguard-api das neue Cert in den mTLS-Listener lädt:\n\n"+
+				"  sudo systemctl restart edgeguard-api\n\n"+
+				"Bis dahin nutzt der laufende Prozess das alte Cert.", cn, until))
+	}
+	slog.Info("scheduler: cluster peer cert auto-renewed", "cn", cn,
+		"old_days_remaining", info.DaysRemaining)
+}
+
 // dedupe verhindert dass derselbe Alert-Key (z.B. "cert.expiring:utm-1.netcell-it.de")
 // öfter als alle 12h gefeuert wird. In-memory — Scheduler-Restart
 // resettet, was OK ist (Operator soll bei restart wieder einen kennen-
@@ -200,18 +940,38 @@ func runCertExpiryCheck(ctx context.Context, repo *tlscerts.Repo,
 	}
 }
 
-// runConfigHash berechnet den Hash und schreibt ihn in ha_nodes.
-// Pool kann nil sein (scheduler-pool-fail beim boot) — dann no-op.
-func runConfigHash(ctx context.Context, pool *pgxpoolPool, localID string) {
+// runHeartbeat schreibt last_seen + status=online + version + config_hash
+// auf die eigene ha_nodes-Row. Pool kann nil sein (scheduler-pool-fail
+// beim Boot) — dann no-op. Errors landen im WARN, kein Abort der Schleife.
+func runHeartbeat(ctx context.Context, pool *pgxpoolPool, localID, version string) {
 	if pool == nil || localID == "" {
 		return
 	}
-	hash, err := cluster.RefreshLocalHash(ctx, pool, localID)
-	if err != nil {
-		slog.Warn("scheduler: config-hash refresh failed", "error", err)
+	hbCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	if err := cluster.Heartbeat(hbCtx, pool, localID, version); err != nil {
+		slog.Warn("scheduler: heartbeat failed", "error", err)
+	}
+}
+
+// runStaleSweep markiert Peers mit last_seen < NOW()-staleThreshold als
+// offline. Logged nur wenn Rows betroffen sind (sonst floodet das Log
+// mit "0 rows" alle 30s).
+func runStaleSweep(ctx context.Context, pool *pgxpoolPool) {
+	if pool == nil {
 		return
 	}
-	slog.Debug("scheduler: config-hash refreshed", "hash", hash)
+	swCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	flipped, err := cluster.SweepStaleNodes(swCtx, pool, staleThreshold)
+	if err != nil {
+		slog.Warn("scheduler: stale-sweep failed", "error", err)
+		return
+	}
+	if flipped > 0 {
+		slog.Info("scheduler: marked stale peers offline",
+			"count", flipped, "threshold", staleThreshold)
+	}
 }
 
 // pgxpoolPool ist ein lokaler Alias damit die Signatur stabil bleibt
@@ -220,7 +980,7 @@ type pgxpoolPool = pgxpool.Pool
 
 // runBackup führt einen scheduled Backup aus + prunet alte. Failures
 // loggen wir + alarmieren — verlorene Backups sind kritisch.
-func runBackup(ctx context.Context, svc *backup.Service, version string, a *alerts.Service) {
+func runBackup(ctx context.Context, svc *backup.Service, version string, a *alerts.Service, setupStore *setup.Store) {
 	res, err := svc.Run(ctx, backup.KindScheduled, version)
 	if err != nil {
 		slog.Warn("scheduler: backup failed", "error", err, "file", res.File)
@@ -235,7 +995,13 @@ func runBackup(ctx context.Context, svc *backup.Service, version string, a *aler
 		"file", res.File, "size", res.SizeBytes,
 		"db_bytes", res.DBDumpBytes, "files_bytes", res.FilesBytes,
 		"sha256", res.SHA256)
-	if err := svc.Prune(ctx, backup.DefaultKeepN); err != nil {
+	keepN := backup.DefaultKeepN
+	if setupStore != nil {
+		if st, err := setupStore.Load(); err == nil && st != nil && st.BackupRetentionKeep > 0 {
+			keepN = st.BackupRetentionKeep
+		}
+	}
+	if err := svc.Prune(ctx, keepN); err != nil {
 		slog.Warn("scheduler: backup prune failed", "error", err)
 	}
 }
@@ -296,11 +1062,18 @@ func runRenewer(ctx context.Context, r *certrenewer.Service, a *alerts.Service,
 	slog.Info("scheduler: renewer pass complete",
 		"checked", res.Checked, "renewed", res.Renewed,
 		"failed", res.Failed, "skipped", res.Skipped)
-	if a != nil && res.Failed > 0 && d != nil && d.shouldFire("cert.renew_failed") {
-		_, _ = a.Fire(ctx, "cert.renew_failed", alerts.SeverityError,
-			"Cert-Renewal teilweise fehlgeschlagen",
-			fmt.Sprintf("Renewer-Cycle: %d checked, %d renewed, %d failed, %d skipped",
-				res.Checked, res.Renewed, res.Failed, res.Skipped))
+	if a != nil && d != nil {
+		for _, domain := range res.FailedDomains {
+			key := "cert.renew_failed:" + domain
+			if !d.shouldFire(key) {
+				continue
+			}
+			_, _ = a.Fire(ctx, "cert.renew_failed", alerts.SeverityError,
+				"Cert-Renewal fehlgeschlagen: "+domain,
+				"Let's Encrypt Erneuerung für "+domain+" ist fehlgeschlagen. "+
+					"Prüfe ACME-Konfiguration und DNS-Erreichbarkeit. "+
+					"Nächster Versuch beim nächsten Renewer-Tick (alle 6h).")
+		}
 	}
 }
 

cmd/edgeguard-waf/main.go

@@ -0,0 +1,105 @@
+// Command edgeguard-waf is the per-domain WAF SPOE agent for EdgeGuard.
+// HAProxy connects to it via the SPOE protocol (127.0.0.1:9000).
+// It loads per-domain WAF configs from PostgreSQL and uses Coraza v3
+// with the OWASP Core Rule Set to inspect HTTP requests.
+package main
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
+	intwaf "git.netcell-it.de/projekte/edgeguard-native/internal/waf"
+)
+
+func main() {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	dsn := database.ConnStringFromEnv()
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		slog.Error("waf: db connect", "error", err)
+		os.Exit(1)
+	}
+	defer pool.Close()
+
+	if err := database.Migrate(ctx, ""); err != nil {
+		slog.Error("waf: migrate", "error", err)
+		os.Exit(1)
+	}
+
+	repo := waf.New(pool)
+
+	crsDir := os.Getenv("EDGEGUARD_WAF_CRS_DIR")
+	if crsDir == "" {
+		crsDir = intwaf.DefaultCRSDir
+	}
+	spoeAddr := os.Getenv("EDGEGUARD_WAF_ADDR")
+	if spoeAddr == "" {
+		spoeAddr = intwaf.DefaultSPOEAddr
+	}
+
+	mgr := intwaf.NewManager(crsDir)
+
+	// Initial load.
+	if err := reload(ctx, repo, mgr); err != nil {
+		slog.Error("waf: initial load", "error", err)
+		os.Exit(1)
+	}
+
+	// Periodic config refresh every 30 seconds.
+	go func() {
+		t := time.NewTicker(30 * time.Second)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				if err := reload(ctx, repo, mgr); err != nil {
+					slog.Warn("waf: reload", "error", err)
+				}
+			}
+		}
+	}()
+
+	alertWriter := intwaf.NewAlertWriter(pool, 2048)
+
+	agent := intwaf.SPOEAgent{
+		Manager:     mgr,
+		AlertWriter: alertWriter,
+		Addr:        spoeAddr,
+	}
+
+	slog.Info("waf: SPOE agent starting", "addr", spoeAddr, "crs", crsDir)
+	if err := agent.ListenAndServe(ctx); err != nil && ctx.Err() == nil {
+		slog.Error("waf: SPOE agent stopped", "error", err)
+		os.Exit(1)
+	}
+}
+
+// reload fetches all domain+waf_config pairs from DB and rebuilds engines.
+func reload(ctx context.Context, repo *waf.Repo, mgr *intwaf.Manager) error {
+	configs, err := repo.ListAllWithDomain(ctx)
+	if err != nil {
+		return err
+	}
+	domains := make([]intwaf.DomainConfig, 0, len(configs))
+	for _, c := range configs {
+		domains = append(domains, intwaf.DomainConfig{
+			Hostname: c.Hostname,
+			Config:   c.Config,
+		})
+	}
+	return mgr.Reload(domains)
+}
+
+// Ensure models package is used (imported transitively via services/waf).
+var _ = models.WafConfig{}

deploy/keepalived/keepalived.conf.tpl

@@ -0,0 +1,40 @@
+global_defs {
+    router_id {{ .RouterID }}
+    script_user root
+    enable_script_security
+    vrrp_garp_interval 0
+    vrrp_gna_interval 0
+}
+
+vrrp_script chk_edgeguard {
+    script "/usr/lib/edgeguard/keepalived-check.sh"
+    interval 2
+    weight -50
+    fall 3
+    rise 2
+}
+
+vrrp_instance VI_1 {
+    state {{ .State }}
+    interface {{ .Interface }}
+    virtual_router_id {{ .RouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .SrcIP }}    unicast_src_ip {{ .SrcIP }}
+    unicast_peer {
+        {{ .PeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+    virtual_ipaddress {
+        {{ .VIP }}
+    }
+    track_script {
+        chk_edgeguard
+    }
+    notify_master  "/usr/lib/edgeguard/keepalived-master.sh"
+    notify_backup  "/usr/lib/edgeguard/keepalived-backup.sh"
+    notify_fault   "/usr/lib/edgeguard/keepalived-backup.sh"
+}

deploy/systemd/edgeguard-api.service

@@ -25,7 +25,23 @@ PrivateTmp=true
 PrivateDevices=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
 SystemCallFilter=@system-service
-ReadWritePaths=/etc/edgeguard /var/lib/edgeguard /var/log/edgeguard
+# /var/lib/apt /var/cache/apt /etc/apt/apt.conf.d: damit `sudo -n apt-get
+# update -qq` aus dem Update-Banner-Handler überhaupt in die Apt-Lists
+# schreiben darf. Ohne diese Pfade läuft das Kommando still durch
+# (exit 0) und der Cache bleibt veraltet — Banner zeigt nie ein Update.
+# Befund 2026-05-14: trotz 30s-Poll blieb Candidate=Installed. mail-
+# gateway hat dasselbe Set unter nmg-api.service.
+#
+# /var/backups/edgeguard: Backup-Service schreibt tar.gz Snapshots
+# hierhin. Ohne Pfad in ReadWritePaths: read-only filesystem → EROFS.
+# Befund 2026-05-15: "create eg-…tar.gz: read-only file system".
+#
+# /etc/chrony/conf.d /etc/unbound/unbound.conf.d /etc/wireguard:
+# chrony/unbound/wg-Renderer schreiben edgeguard.conf bzw. <iface>.conf
+# direkt in den distro-Conf-Dir (chrony+unbound) bzw. legen Symlinks
+# nach /etc/edgeguard/wireguard (wg). Ohne diese Pfade scheitern alle
+# UI-Mutationen an DNS/NTP/WireGuard-Settings still mit EROFS.
+ReadWritePaths=/etc/edgeguard /var/lib/edgeguard /var/log/edgeguard /var/backups/edgeguard /var/lib/apt /var/cache/apt /etc/apt/apt.conf.d /etc/chrony/conf.d /etc/unbound/unbound.conf.d /etc/wireguard /var/lib/crowdsec
 
 [Install]
 WantedBy=multi-user.target

deploy/systemd/edgeguard-scheduler.service

@@ -22,7 +22,10 @@ PrivateTmp=true
 PrivateDevices=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 SystemCallFilter=@system-service
-ReadWritePaths=/etc/edgeguard /var/lib/edgeguard /var/log/edgeguard
+# Scheduler ruft `backup.Service.Run` für scheduled backups + braucht
+# apt-Pfade für die background-apt-update-Goroutine (parität zur API,
+# falls die API down ist). /var/backups/edgeguard für tar.gz-Output.
+ReadWritePaths=/etc/edgeguard /var/lib/edgeguard /var/log/edgeguard /var/backups/edgeguard /var/lib/apt /var/cache/apt /etc/apt/apt.conf.d
 
 [Install]
 WantedBy=multi-user.target

deploy/systemd/edgeguard-waf.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=EdgeGuard WAF SPOE Agent (Coraza/OWASP CRS)
+Documentation=https://git.netcell-it.de/projekte/edgeguard-native
+After=network-online.target postgresql.service edgeguard-api.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=edgeguard
+Group=edgeguard
+ExecStart=/usr/bin/edgeguard-waf
+Restart=on-failure
+RestartSec=5
+
+# Hardening — WAF agent only needs DB access and one TCP listen socket.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+PrivateTmp=true
+PrivateDevices=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallFilter=@system-service
+# CRS rules are read from /usr/share/edgeguard/waf/crs/ (read-only, OK).
+# Alerts/logs are written to /var/log/edgeguard/.
+ReadWritePaths=/var/log/edgeguard
+
+[Install]
+WantedBy=multi-user.target

go.mod

@@ -3,23 +3,32 @@ module git.netcell-it.de/projekte/edgeguard-native
 go 1.26.0
 
 require (
+	github.com/corazawaf/coraza/v3 v3.7.0
+	github.com/coreos/go-oidc/v3 v3.18.0
+	github.com/dropmorepackets/haproxy-go v0.0.8
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/gin-gonic/gin v1.10.0
 	github.com/go-acme/lego/v4 v4.35.2
 	github.com/gorilla/websocket v1.5.3
 	github.com/jackc/pgx/v5 v5.9.2
+	github.com/minio/minio-go/v7 v7.1.0
+	github.com/pkg/sftp v1.13.10
+	github.com/pquerna/otp v1.5.0
 	github.com/pressly/goose/v3 v3.27.1
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	golang.org/x/crypto v0.51.0
+	golang.org/x/oauth2 v0.36.0
 )
 
 require (
+	github.com/boombuler/barcode v1.0.1 // indirect
 	github.com/bytedance/sonic v1.11.6 // indirect
 	github.com/bytedance/sonic/loader v0.1.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.4 // indirect
 	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/corazawaf/libinjection-go v0.3.2 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
@@ -28,34 +37,43 @@ require (
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.23.0 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 // indirect
+	github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 // indirect
+	github.com/kaptinlin/go-i18n v0.1.4 // indirect
+	github.com/kaptinlin/jsonschema v0.4.6 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/magefile/mage v1.17.0 // indirect
 	github.com/mattn/go-isatty v0.0.21 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/miekg/dns v1.1.72 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minio-go/v7 v7.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pkg/sftp v1.13.10 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sethvargo/go-retry v0.3.0 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tinylib/msgp v1.6.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
+	github.com/valllabh/ocsf-schema-golang v1.0.3 // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
@@ -68,4 +86,5 @@ require (
 	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	rsc.io/binaryregexp v0.2.0 // indirect
 )

go.sum

@@ -1,3 +1,6 @@
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
+github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0=
 github.com/bytedance/sonic v1.11.6/go.mod h1:LysEHSvpvDySVdC2f87zGWf6CIKJcAvqab1ZaiQtds4=
 github.com/bytedance/sonic/loader v0.1.1 h1:c+e5Pt1k/cy5wMveRDyk2X4B9hF4g7an8N3zCYjJFNM=
@@ -10,13 +13,25 @@ github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/
 github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
 github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
 github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc h1:OlJhrgI3I+FLUCTI3JJW8MoqyM78WbqJjecqMnqG+wc=
+github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc/go.mod h1:7rsocqNDkTCira5T0M7buoKR2ehh7YZiPkzxRuAgvVU=
+github.com/corazawaf/coraza/v3 v3.7.0 h1:LIQqu1r+l6e/U/gyiZeykWaNNBY1TzRLz+aaI+QYEEM=
+github.com/corazawaf/coraza/v3 v3.7.0/go.mod h1:dOSt5evqC7EstouEv6ghhui01+oVUwp9X1vybWwqTlo=
+github.com/corazawaf/libinjection-go v0.3.2 h1:9rrKt0lpg4WvUXt+lwS06GywfqRXXsa/7JcOw5cQLwI=
+github.com/corazawaf/libinjection-go v0.3.2/go.mod h1:Ik/+w3UmTWH9yn366RgS9D95K3y7Atb5m/H/gXzzPCk=
+github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
+github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dropmorepackets/haproxy-go v0.0.8 h1:kS2Wa8+ZDcnJdRSTiuBsaPun5hpdUPIuLQ+Drp9ZxYs=
+github.com/dropmorepackets/haproxy-go v0.0.8/go.mod h1:4a2AmmVjvg2zPNdizGZrMN8ZSUpj90U43VlcdbOIBnU=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
+github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
@@ -39,8 +54,10 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.23.0 h1:/PwmTwZhS0dPkav3cdK9kV1FsAmrL8sThn8IHr/sO+o=
 github.com/go-playground/validator/v10 v10.23.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
-github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
-github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -48,6 +65,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 h1:b70jEaX2iaJSPZULSUxKtm73LBfsCrMsIlYCUgNGSIs=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976/go.mod h1:ZGQeOwybjD8lkCjIyJfqR5LD2wMVHJ31d6GdPxoTsWY=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 h1:c7gcNWTSr1gtLp6PyYi3wzvFCEcHJ4YRobDgqmIgf7Q=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092/go.mod h1:ZZAN4fkkful3l1lpJwF8JbW41ZiG9TwJ2ZlqzQovBNU=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
@@ -56,14 +77,18 @@ github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
 github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jcchavezs/mergefs v0.1.1 h1:D45R17m6dHnSVZefnhynoeZvcK2Uw0oTrRfoUOQ0S5Y=
+github.com/jcchavezs/mergefs v0.1.1/go.mod h1:eRLTrsA+vFwQZ48hj8p8gki/5v9C2bFtHH5Mnn4bcGk=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
+github.com/kaptinlin/go-i18n v0.1.4 h1:wCiwAn1LOcvymvWIVAM4m5dUAMiHunTdEubLDk4hTGs=
+github.com/kaptinlin/go-i18n v0.1.4/go.mod h1:g1fn1GvTgT4CiLE8/fFE1hboHWJ6erivrDpiDtCcFKg=
+github.com/kaptinlin/jsonschema v0.4.6 h1:vOSFg5tjmfkOdKg+D6Oo4fVOM/pActWu/ntkPsI1T64=
+github.com/kaptinlin/jsonschema v0.4.6/go.mod h1:1DUd7r5SdyB2ZnMtyB7uLv64dE3zTFTiYytDCd+AEL0=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
-github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
 github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
@@ -77,6 +102,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/magefile/mage v1.17.0 h1:dS4tkq997Ism03akafC8509iqDjeE7TNTexI25Y7sXM=
+github.com/magefile/mage v1.17.0/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
 github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
 github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
@@ -97,8 +124,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
-github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 h1:Vpr4VgAizEgEZsaMohpw6JYDP+i9Of9dmdY4ufNP6HI=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745/go.mod h1:EHPiTAKtiFmrMldLUNswFwfZ2eJIYBHktdaUTZxYWRw=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -107,6 +136,8 @@ github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1Hbe
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
+github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/pressly/goose/v3 v3.27.1 h1:6uEvcprBybDmW4hcz3gYujhARhye+GoWKhEWyzD5sh4=
 github.com/pressly/goose/v3 v3.27.1/go.mod h1:maruOxsPnIG2yHHyo8UqKWXYKFcH7Q76csUV7+7KYoM=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -122,22 +153,30 @@ github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDq
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
 github.com/tinylib/msgp v1.6.1/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
 github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/valllabh/ocsf-schema-golang v1.0.3 h1:eR8k/3jP/OOqB8LRCtdJ4U+vlgd/gk5y3KMXoodrsrw=
+github.com/valllabh/ocsf-schema-golang v1.0.3/go.mod h1:sZ3as9xqm1SSK5feFWIR2CuGeGRhsM7TR1MbpBctzPk=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -153,11 +192,14 @@ golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
 golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
@@ -179,4 +221,6 @@ modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw
 modernc.org/sqlite v1.49.1 h1:dYGHTKcX1sJ+EQDnUzvz4TJ5GbuvhNJa8Fg6ElGx73U=
 modernc.org/sqlite v1.49.1/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
 nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=

internal/aggregator/aggregator.go

@@ -0,0 +1,273 @@
+// Package aggregator führt parallele Cluster-Reads gegen alle Peer-Nodes
+// via mTLS aus.
+//
+// Pattern: ein Aggregator-Endpoint auf der Main-API (z.B.
+// /api/v1/cluster/system/load) ruft Aggregator.FanOut() — das verteilt
+// die Request parallel an alle Peers' Agent-Listener (:8443 mTLS) und
+// sammelt die Antworten in einer Map[node_id]→Ergebnis. Timeouts pro
+// Peer (3s default) verhindern dass ein hängender Peer die ganze Antwort
+// blockt; partielle Ergebnisse + per-Peer-Fehler werden zurückgegeben.
+//
+// mTLS-Auth: ClientTLSConfig aus clustertls.Store. CA muss auf beiden
+// Seiten dieselbe sein — sonst RequireAndVerifyClientCert lehnt ab.
+package aggregator
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+// DefaultAgentPort: alle Peers exposen ihren mTLS-Listener auf diesem
+// Port. api_url in ha_nodes zeigt typischerweise auf den Public-3443-
+// Port — wir derive'n den Agent-Port daraus, statt eine zweite Spalte
+// in ha_nodes zu führen.
+const DefaultAgentPort = 8443
+
+// DefaultPeerTimeout: pro-Peer-Timeout. Aggregat-Caller sollten eine
+// Obergrenze von max(N×PeerTimeout/parallel) im Kopf haben; in der
+// Praxis ist alles parallel, also bestimmt der langsamste Peer die
+// Latenz.
+const DefaultPeerTimeout = 3 * time.Second
+
+// Aggregator: dünner Wrapper mit ClientTLSConfig + http.Client.
+type Aggregator struct {
+	HTTPClient *http.Client
+	AgentPort  int
+}
+
+// New: liefert einen Aggregator der ClientTLSConfig verwendet. Wenn
+// clientTLS == nil, geht der Client auf normales TLS-Verify zurück —
+// für Tests nützlich, in Prod aber unsicher (würde Cert-Verify gegen
+// System-Trust laufen, das den Cluster-CA nicht kennt).
+func New(clientTLS *tls.Config) *Aggregator {
+	tr := &http.Transport{
+		TLSClientConfig:       clientTLS,
+		MaxIdleConns:          16,
+		MaxIdleConnsPerHost:   2,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   3 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+		ResponseHeaderTimeout: 5 * time.Second,
+	}
+	return &Aggregator{
+		HTTPClient: &http.Client{
+			Transport: tr,
+			Timeout:   DefaultPeerTimeout,
+		},
+		AgentPort: DefaultAgentPort,
+	}
+}
+
+// PeerResult kapselt das Ergebnis eines parallelen Fan-Out-Calls.
+// Wenn Err != nil ist Data leer; sonst enthält Data den raw-JSON-Body
+// (Aufrufer entscheidet ob es per-Peer typed-unmarshalled oder als
+// map[string]any belassen wird).
+type PeerResult struct {
+	NodeID   string          `json:"node_id"`
+	FQDN     string          `json:"fqdn"`
+	OK       bool            `json:"ok"`
+	Data     json.RawMessage `json:"data,omitempty"`
+	Err      string          `json:"error,omitempty"`
+	Duration int64           `json:"duration_ms"`
+}
+
+// FanOut: ruft GET <agent-url>/<path> für jeden Peer in `peers` parallel
+// und sammelt die Ergebnisse in einer slice (stabile Sortierung nach
+// Peer-FQDN für deterministisches UI-Rendering).
+//
+// `path` ist relativ, z.B. "/agent/system/load". `localID` wird als
+// Marker übergeben damit der Aufrufer den eigenen Node von der Map
+// ausschließen kann.
+func (a *Aggregator) FanOut(ctx context.Context, peers []models.HANode, path, localID string) []PeerResult {
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+	results := make([]PeerResult, len(peers))
+	var wg sync.WaitGroup
+	for i, p := range peers {
+		if p.ID == localID {
+			// Eigener Node nicht über mTLS dial'n — wäre teuer + im
+			// Aufrufer wahrscheinlich der lokale Path
+			results[i] = PeerResult{NodeID: p.ID, FQDN: p.FQDN, OK: false, Err: "skipped: local node"}
+			continue
+		}
+		wg.Add(1)
+		i := i
+		p := p
+		go func() {
+			defer wg.Done()
+			results[i] = a.callPeer(ctx, p, path)
+		}()
+	}
+	wg.Wait()
+	return results
+}
+
+// callPeer macht den Einzel-Call. Wandelt p.APIURL in https://host:8443/
+// um (Port übersteuert, Pfad ersetzt). Bei Connection-Fehler / Timeout
+// liefert ein PeerResult mit OK=false zurück.
+func (a *Aggregator) callPeer(ctx context.Context, p models.HANode, path string) PeerResult {
+	start := time.Now()
+	res := PeerResult{NodeID: p.ID, FQDN: p.FQDN}
+
+	target, err := agentURL(p.APIURL, a.AgentPort, path)
+	if err != nil {
+		res.Err = "bad api_url: " + err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, DefaultPeerTimeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, target, nil)
+	if err != nil {
+		res.Err = err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	resp, err := a.HTTPClient.Do(req)
+	if err != nil {
+		res.Err = err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20)) // 1 MiB cap
+	if resp.StatusCode != http.StatusOK {
+		res.Err = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	res.OK = true
+	// Agent-Endpoints liefern die Standard-API-Envelope zurück
+	// ({"data": {...}, "error": null, "message": "ok"}). Wir entpacken
+	// das `data`-Feld so dass der Aufrufer direkt die Nutzlast bekommt —
+	// konsistent mit dem Lokal-Pfad (der marshalt die Struct direkt ohne
+	// Envelope).
+	var env struct {
+		Data json.RawMessage `json:"data"`
+	}
+	if err := json.Unmarshal(body, &env); err == nil && len(env.Data) > 0 {
+		res.Data = env.Data
+	} else {
+		res.Data = body
+	}
+	res.Duration = time.Since(start).Milliseconds()
+	return res
+}
+
+// agentURL: nimmt z.B. "https://node1.example.com:3443" + port=8443 +
+// path="/agent/system/load" und liefert "https://node1.example.com:8443/agent/system/load".
+// Wir tauschen den Port aus, behalten Schema + Host (nur).
+func agentURL(apiURL string, agentPort int, path string) (string, error) {
+	if apiURL == "" {
+		return "", errors.New("empty api_url")
+	}
+	u, err := url.Parse(apiURL)
+	if err != nil {
+		return "", err
+	}
+	if u.Scheme == "" {
+		u.Scheme = "https"
+	}
+	host := u.Hostname()
+	if host == "" {
+		return "", errors.New("api_url has no host")
+	}
+	u.Host = net.JoinHostPort(host, fmt.Sprint(agentPort))
+	u.Path = path
+	u.RawQuery = ""
+	return u.String(), nil
+}
+
+// PostPeer sendet einen POST-Request an einen einzelnen Peer.
+// Wird vom Rolling-Update-Orchestrator genutzt um /agent/cluster/trigger-update
+// auf dem Secondary auszulösen.
+func (a *Aggregator) PostPeer(ctx context.Context, p models.HANode, path string) PeerResult {
+	start := time.Now()
+	res := PeerResult{NodeID: p.ID, FQDN: p.FQDN}
+	target, err := agentURL(p.APIURL, a.AgentPort, path)
+	if err != nil {
+		res.Err = "bad api_url: " + err.Error()
+		return res
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodPost, target, nil)
+	if err != nil {
+		res.Err = err.Error()
+		return res
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := a.HTTPClient.Do(req)
+	if err != nil {
+		res.Err = err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusAccepted {
+		res.Err = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	res.OK = true
+	res.Duration = time.Since(start).Milliseconds()
+	return res
+}
+
+// PostPeerWithBody sendet einen POST-Request mit JSON-Body an einen Peer.
+// Wird für VIP-Schwenk-Tests genutzt (/agent/cluster/vip-cmd).
+func (a *Aggregator) PostPeerWithBody(ctx context.Context, p models.HANode, path string, body []byte) PeerResult {
+	start := time.Now()
+	res := PeerResult{NodeID: p.ID, FQDN: p.FQDN}
+	target, err := agentURL(p.APIURL, a.AgentPort, path)
+	if err != nil {
+		res.Err = "bad api_url: " + err.Error()
+		return res
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodPost, target, strings.NewReader(string(body)))
+	if err != nil {
+		res.Err = err.Error()
+		return res
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := a.HTTPClient.Do(req)
+	if err != nil {
+		res.Err = err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusAccepted && resp.StatusCode != http.StatusNoContent {
+		res.Err = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(respBody)))
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	res.OK = true
+	res.Data = respBody
+	res.Duration = time.Since(start).Milliseconds()
+	return res
+}
+
+// Compile-time check dass cluster importiert wird (für Drift-Detection
+// vom hashSpec — die Aggregator-Resultate werden parallel im Drift-
+// Banner mitverarbeitet). Nicht runtime-essentiell, aber dokumentiert
+// die Abhängigkeit.
+var _ = cluster.ComputeConfigHash

internal/chrony/chrony.go

@@ -49,6 +49,30 @@ func New(pool *pgxpool.Pool) *Generator {
 
 func (g *Generator) Name() string { return "chrony" }
 
+// RenderToString renders the chrony config to a string without writing
+// to disk or reloading the service. Used by the config-preview endpoint.
+func (g *Generator) RenderToString(ctx context.Context) (string, error) {
+	settings, err := g.Repo.GetSettings(ctx)
+	if err != nil {
+		return "", fmt.Errorf("settings: %w", err)
+	}
+	pools, err := g.Repo.ListPools(ctx)
+	if err != nil {
+		return "", fmt.Errorf("pools: %w", err)
+	}
+	view := View{
+		Settings:        settings,
+		Pools:           pools,
+		ListenAddresses: filterNonLoopback(splitCSV(settings.ListenAddresses)),
+		AllowACLs:       splitCSV(settings.AllowACL),
+	}
+	var body bytes.Buffer
+	if err := tpl.Execute(&body, view); err != nil {
+		return "", fmt.Errorf("template: %w", err)
+	}
+	return body.String(), nil
+}
+
 func (g *Generator) Render(ctx context.Context) error {
 	settings, err := g.Repo.GetSettings(ctx)
 	if err != nil {

internal/cluster/clustertls/clustertls.go

@@ -0,0 +1,438 @@
+// Package clustertls verwaltet die per-Cluster Certificate Authority
+// für Node-to-Node mTLS-Kommunikation.
+//
+// Layout on disk:
+//   /var/lib/edgeguard/cluster-tls/ca.crt     (0644)
+//   /var/lib/edgeguard/cluster-tls/ca.key     (0600, edgeguard:edgeguard)
+//   /var/lib/edgeguard/cluster-tls/peer.crt   (0644)  — diese Node
+//   /var/lib/edgeguard/cluster-tls/peer.key   (0600, edgeguard:edgeguard)
+//
+// Workflow:
+//   * Erste Node (cluster founder): InitCA generiert CA, dann EnsureSelfSigned
+//     erstellt + signiert ihren eigenen peer.crt mit eigener CA.
+//   * Joining Node: lädt CA-Cert vom Primary, generiert lokal CSR, POSTet
+//     ihn mit cluster-join-token zu /api/v1/cluster/issue-cert; Primary
+//     signiert via SignCSR und liefert peer.crt zurück. (Phase 3.4.)
+//   * Single-Node: InitCA + EnsureSelfSigned werden beim API-Boot
+//     idempotent gerufen; Listener auf :8443 kann sofort hochfahren.
+//
+// Pattern 1:1 aus mail-gateway/internal/services/clustertls/clustertls.go,
+// nur Dir + Filenamen angepasst (kein /etc/nmg → /var/lib/edgeguard).
+package clustertls
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"math/big"
+	"net"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+const (
+	DefaultDir = "/var/lib/edgeguard/cluster-tls"
+
+	caCertFile   = "ca.crt"
+	caKeyFile    = "ca.key"
+	peerCertFile = "peer.crt"
+	peerKeyFile  = "peer.key"
+
+	caValidity   = 10 * 365 * 24 * time.Hour // 10 Jahre — Cluster-Lifetime
+	peerValidity = 365 * 24 * time.Hour      // 1 Jahr — Renewal künftig automatisch
+)
+
+// Store kapselt die CA + Peer-Cert-Persistierung unter Dir.
+type Store struct{ Dir string }
+
+func New(dir string) *Store {
+	if dir == "" {
+		dir = DefaultDir
+	}
+	return &Store{Dir: dir}
+}
+
+// HasCA prüft ob ca.crt + ca.key existieren.
+func (s *Store) HasCA() bool {
+	_, e1 := os.Stat(filepath.Join(s.Dir, caCertFile))
+	_, e2 := os.Stat(filepath.Join(s.Dir, caKeyFile))
+	return e1 == nil && e2 == nil
+}
+
+// HasPeer prüft ob peer.crt + peer.key existieren.
+func (s *Store) HasPeer() bool {
+	_, e1 := os.Stat(filepath.Join(s.Dir, peerCertFile))
+	_, e2 := os.Stat(filepath.Join(s.Dir, peerKeyFile))
+	return e1 == nil && e2 == nil
+}
+
+// InitCA generiert die Cluster-CA falls noch keine existiert. Idempotent.
+// organisation landet im Subject — typischerweise die FQDN-Domain.
+func (s *Store) InitCA(organisation string, now func() time.Time) error {
+	if s.HasCA() {
+		return nil
+	}
+	if now == nil {
+		now = time.Now
+	}
+	if err := os.MkdirAll(s.Dir, 0o700); err != nil {
+		return err
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return err
+	}
+	serial, _ := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	tpl := &x509.Certificate{
+		SerialNumber: serial,
+		Subject: pkix.Name{
+			CommonName:   "EdgeGuard Cluster CA",
+			Organization: []string{organisation},
+		},
+		NotBefore:             now().UTC(),
+		NotAfter:              now().Add(caValidity).UTC(),
+		IsCA:                  true,
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		BasicConstraintsValid: true,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tpl, tpl, pub, priv)
+	if err != nil {
+		return err
+	}
+	if err := writePEM(filepath.Join(s.Dir, caCertFile), 0o644, "CERTIFICATE", der); err != nil {
+		return err
+	}
+	keyDER, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return err
+	}
+	return writePEM(filepath.Join(s.Dir, caKeyFile), 0o600, "PRIVATE KEY", keyDER)
+}
+
+// EnsureSelfSigned: erstellt peer.crt + peer.key signiert mit der eigenen
+// CA, falls noch nicht vorhanden. Verwendet für den "Cluster-Founder"-Pfad
+// (erste Node generiert CA + ihren eigenen Cert). commonName ist meist
+// die FQDN; dnsNames + ips landen in SubjectAlternativeName, damit der
+// TLS-Handshake gegen IP-Adressen + Hostnamen funktioniert.
+//
+// Idempotent — vorhandenes peer.crt wird NICHT überschrieben (sonst
+// würden andere Peers ihre Vertrauenskette verlieren nach jedem Boot).
+func (s *Store) EnsureSelfSigned(commonName string, dnsNames []string, ips []net.IP, now func() time.Time) error {
+	if s.HasPeer() {
+		return nil
+	}
+	if !s.HasCA() {
+		return errors.New("clustertls: peer cert requested but no CA in place — run InitCA first")
+	}
+	if now == nil {
+		now = time.Now
+	}
+	caCert, caKey, err := s.LoadCA()
+	if err != nil {
+		return err
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return err
+	}
+	serial, _ := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	tpl := &x509.Certificate{
+		SerialNumber: serial,
+		Subject:      pkix.Name{CommonName: commonName},
+		DNSNames:     dnsNames,
+		IPAddresses:  ips,
+		NotBefore:    now().UTC(),
+		NotAfter:     now().Add(peerValidity).UTC(),
+		// Server-auth + Client-auth — ein Cert nutzbar für Listener und Outbound.
+		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+		KeyUsage:    x509.KeyUsageDigitalSignature,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tpl, caCert, pub, caKey)
+	if err != nil {
+		return err
+	}
+	if err := writePEM(filepath.Join(s.Dir, peerCertFile), 0o644, "CERTIFICATE", der); err != nil {
+		return err
+	}
+	keyDER, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return err
+	}
+	return writePEM(filepath.Join(s.Dir, peerKeyFile), 0o600, "PRIVATE KEY", keyDER)
+}
+
+// LoadCA parst CA-Cert + Ed25519 Private Key vom Disk.
+func (s *Store) LoadCA() (*x509.Certificate, ed25519.PrivateKey, error) {
+	certPEM, err := os.ReadFile(filepath.Join(s.Dir, caCertFile))
+	if err != nil {
+		return nil, nil, fmt.Errorf("read CA cert: %w", err)
+	}
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		return nil, nil, errors.New("ca cert: invalid PEM")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return nil, nil, fmt.Errorf("parse CA cert: %w", err)
+	}
+	keyPEM, err := os.ReadFile(filepath.Join(s.Dir, caKeyFile))
+	if err != nil {
+		return nil, nil, fmt.Errorf("read CA key: %w", err)
+	}
+	keyBlock, _ := pem.Decode(keyPEM)
+	if keyBlock == nil {
+		return nil, nil, errors.New("ca key: invalid PEM")
+	}
+	raw, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes)
+	if err != nil {
+		return nil, nil, fmt.Errorf("parse CA key: %w", err)
+	}
+	priv, ok := raw.(ed25519.PrivateKey)
+	if !ok {
+		return nil, nil, fmt.Errorf("CA key is not ed25519 (got %T)", raw)
+	}
+	return cert, priv, nil
+}
+
+// SignCSR signiert einen joining-peer CSR. Caller hat den one-shot
+// cluster-join-Token bereits geprüft (Phase 3.4 — Aufrufer in handlers).
+func (s *Store) SignCSR(csrPEM string, now func() time.Time) (string, error) {
+	if now == nil {
+		now = time.Now
+	}
+	block, _ := pem.Decode([]byte(csrPEM))
+	if block == nil || block.Type != "CERTIFICATE REQUEST" {
+		return "", errors.New("invalid CSR PEM")
+	}
+	csr, err := x509.ParseCertificateRequest(block.Bytes)
+	if err != nil {
+		return "", fmt.Errorf("parse CSR: %w", err)
+	}
+	if err := csr.CheckSignature(); err != nil {
+		return "", fmt.Errorf("bad CSR signature: %w", err)
+	}
+	caCert, caKey, err := s.LoadCA()
+	if err != nil {
+		return "", err
+	}
+	serial, _ := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	tpl := &x509.Certificate{
+		SerialNumber: serial,
+		Subject:      csr.Subject,
+		DNSNames:     csr.DNSNames,
+		IPAddresses:  csr.IPAddresses,
+		NotBefore:    now().UTC(),
+		NotAfter:     now().Add(peerValidity).UTC(),
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tpl, caCert, csr.PublicKey, caKey)
+	if err != nil {
+		return "", err
+	}
+	return pemString("CERTIFICATE", der), nil
+}
+
+// NewPeerKeyAndCSR generiert einen frischen Ed25519 Key + CSR. Verwendet
+// vom joining peer bevor er an /cluster/issue-cert POSTet.
+func NewPeerKeyAndCSR(commonName string, dnsNames []string, ips []net.IP) (keyPEM, csrPEM string, err error) {
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return "", "", err
+	}
+	tpl := &x509.CertificateRequest{
+		Subject:     pkix.Name{CommonName: commonName},
+		DNSNames:    dnsNames,
+		IPAddresses: ips,
+	}
+	csrDER, err := x509.CreateCertificateRequest(rand.Reader, tpl, priv)
+	if err != nil {
+		return "", "", err
+	}
+	keyDER, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return "", "", err
+	}
+	return pemString("PRIVATE KEY", keyDER), pemString("CERTIFICATE REQUEST", csrDER), nil
+}
+
+// WriteOwnPeerMaterial persistiert peer.key + peer.crt. Wird vom
+// cluster-join-Flow gerufen wenn der Primary das Cert signiert hat.
+func (s *Store) WriteOwnPeerMaterial(keyPEM, certPEM string) error {
+	if err := os.MkdirAll(s.Dir, 0o700); err != nil {
+		return err
+	}
+	if err := os.WriteFile(filepath.Join(s.Dir, peerKeyFile), []byte(keyPEM), 0o600); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(s.Dir, peerCertFile), []byte(certPEM), 0o644)
+}
+
+// ServerTLSConfig: tls.Config für den mTLS-Listener (z.B. :8443).
+// peer.crt/peer.key als Identity, ca.crt als einzige ClientCA.
+// ClientAuth=RequireAndVerifyClientCert.
+func (s *Store) ServerTLSConfig() (*tls.Config, error) {
+	pair, err := tls.LoadX509KeyPair(filepath.Join(s.Dir, peerCertFile), filepath.Join(s.Dir, peerKeyFile))
+	if err != nil {
+		return nil, err
+	}
+	pool, err := s.caPool()
+	if err != nil {
+		return nil, err
+	}
+	return &tls.Config{
+		Certificates: []tls.Certificate{pair},
+		ClientCAs:    pool,
+		RootCAs:      pool,
+		ClientAuth:   tls.RequireAndVerifyClientCert,
+		MinVersion:   tls.VersionTLS13,
+	}, nil
+}
+
+// ClientTLSConfig: tls.Config für outbound peer-to-peer Calls.
+// Präsentiert peer.crt, verifiziert Server gegen ca.crt.
+func (s *Store) ClientTLSConfig() (*tls.Config, error) {
+	pair, err := tls.LoadX509KeyPair(filepath.Join(s.Dir, peerCertFile), filepath.Join(s.Dir, peerKeyFile))
+	if err != nil {
+		return nil, err
+	}
+	pool, err := s.caPool()
+	if err != nil {
+		return nil, err
+	}
+	return &tls.Config{
+		Certificates: []tls.Certificate{pair},
+		RootCAs:      pool,
+		MinVersion:   tls.VersionTLS13,
+	}, nil
+}
+
+// CACertPEM gibt die CA-Cert als PEM-String zurück (für Join-Token-Export).
+func (s *Store) CACertPEM() (string, error) {
+	b, err := os.ReadFile(filepath.Join(s.Dir, caCertFile))
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// CertInfo: zusammengefasste Cert-Metadata für UI-Status. days_remaining
+// kann negativ sein wenn der Cert schon abgelaufen ist.
+type CertInfo struct {
+	CommonName     string    `json:"common_name"`
+	NotBefore      time.Time `json:"not_before"`
+	NotAfter       time.Time `json:"not_after"`
+	DaysRemaining  int       `json:"days_remaining"`
+	IsCA           bool      `json:"is_ca"`
+	SerialHex      string    `json:"serial_hex"`
+}
+
+// PeerCertInfo liefert die Metadata des eigenen peer.crt. Wenn keiner
+// existiert: (nil, error).
+func (s *Store) PeerCertInfo() (*CertInfo, error) {
+	return parseCertInfo(filepath.Join(s.Dir, peerCertFile))
+}
+
+// CACertInfo liefert die Metadata der Cluster-CA. Wenn keiner
+// existiert: (nil, error).
+func (s *Store) CACertInfo() (*CertInfo, error) {
+	return parseCertInfo(filepath.Join(s.Dir, caCertFile))
+}
+
+func parseCertInfo(path string) (*CertInfo, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(raw)
+	if block == nil {
+		return nil, errors.New("invalid PEM")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return nil, err
+	}
+	days := int(time.Until(cert.NotAfter) / (24 * time.Hour))
+	return &CertInfo{
+		CommonName:    cert.Subject.CommonName,
+		NotBefore:     cert.NotBefore.UTC(),
+		NotAfter:      cert.NotAfter.UTC(),
+		DaysRemaining: days,
+		IsCA:          cert.IsCA,
+		SerialHex:     cert.SerialNumber.Text(16),
+	}, nil
+}
+
+// RenewSelfSigned überschreibt peer.crt + peer.key mit einem frisch
+// erzeugten Paar, signiert mit der eigenen CA. Nur sinnvoll auf dem
+// Founder/Primary — Joiner sollten ihren Cert über den /cluster/
+// issue-cert-Flow ablösen, sobald wir Renewal-Tokens bauen.
+//
+// Anders als EnsureSelfSigned wird hier ÜBERSCHRIEBEN. Caller (Handler
+// + CLI) ist verantwortlich für vorherigen Restart-Hinweis bzw.
+// Service-Restart nach dem Call.
+func (s *Store) RenewSelfSigned(commonName string, dnsNames []string, ips []net.IP, now func() time.Time) error {
+	if !s.HasCA() {
+		return errors.New("clustertls: RenewSelfSigned requires own CA")
+	}
+	if now == nil {
+		now = time.Now
+	}
+	caCert, caKey, err := s.LoadCA()
+	if err != nil {
+		return err
+	}
+	pub, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return err
+	}
+	serial, _ := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	tpl := &x509.Certificate{
+		SerialNumber: serial,
+		Subject:      pkix.Name{CommonName: commonName},
+		DNSNames:     dnsNames,
+		IPAddresses:  ips,
+		NotBefore:    now().UTC(),
+		NotAfter:     now().Add(peerValidity).UTC(),
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tpl, caCert, pub, caKey)
+	if err != nil {
+		return err
+	}
+	if err := writePEM(filepath.Join(s.Dir, peerCertFile), 0o644, "CERTIFICATE", der); err != nil {
+		return err
+	}
+	keyDER, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return err
+	}
+	return writePEM(filepath.Join(s.Dir, peerKeyFile), 0o600, "PRIVATE KEY", keyDER)
+}
+
+func (s *Store) caPool() (*x509.CertPool, error) {
+	caPEM, err := os.ReadFile(filepath.Join(s.Dir, caCertFile))
+	if err != nil {
+		return nil, err
+	}
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(caPEM) {
+		return nil, errors.New("failed to add CA to pool")
+	}
+	return pool, nil
+}
+
+func writePEM(path string, mode os.FileMode, kind string, der []byte) error {
+	return os.WriteFile(path, []byte(pemString(kind, der)), mode)
+}
+
+func pemString(kind string, der []byte) string {
+	return string(pem.EncodeToMemory(&pem.Block{Type: kind, Bytes: der}))
+}

internal/cluster/confighash.go

@@ -35,10 +35,13 @@ import (
 
 // hashTable beschreibt eine Tabelle die in den config-hash einfließt.
 type hashTable struct {
-	Name          string
-	Singleton     bool     // dns_settings, ntp_settings → eine row, id=1
-	ExtraExclude  []string // Spalten die zusätzlich aus to_jsonb gefiltert werden
-	SkipUpdatedAt bool     // setze true wenn updated_at semantisch relevant ist
+	Name             string
+	Singleton        bool     // dns_settings, ntp_settings → eine row, id=1
+	ExtraExclude     []string // Spalten die zusätzlich aus to_jsonb gefiltert werden
+	SkipUpdatedAt    bool     // setze true wenn updated_at semantisch relevant ist
+	MigrationDefault bool     // Tabelle hat migrations-erzeugte Default-Rows (firewall_zones, ntp_pools…)
+	                          // → zählt nicht als "user hat config" bei der Empty-DB-Erkennung
+	CustomSQL        string   // wenn gesetzt: direkt als Hash-Query verwenden (überschreibt hashSQL)
 }
 
 // hashSpec ist die Reihenfolge-stabile Liste. NEUE Tabellen hier
@@ -49,15 +52,13 @@ var hashSpec = []hashTable{
 	{Name: "backends"},
 	{Name: "backend_servers"},
 	{Name: "routing_rules"},
-	{Name: "network_interfaces"},
-	{Name: "ip_addresses"},
 	{Name: "tls_certs", ExtraExclude: []string{"last_renewed_at", "last_error"}},
 
-	{Name: "firewall_zones"},
+	{Name: "firewall_zones", MigrationDefault: true},
 	{Name: "firewall_address_objects"},
 	{Name: "firewall_address_groups"},
-	{Name: "firewall_services"},
-	{Name: "firewall_service_groups"},
+	{Name: "firewall_services", MigrationDefault: true},
+	{Name: "firewall_service_groups", MigrationDefault: true},
 	{Name: "firewall_rules"},
 	{Name: "firewall_nat_rules"},
 
@@ -67,12 +68,19 @@ var hashSpec = []hashTable{
 
 	{Name: "dns_zones"},
 	{Name: "dns_records"},
-	{Name: "dns_settings", Singleton: true},
 
-	{Name: "ntp_pools"},
-	{Name: "ntp_settings", Singleton: true},
+	{Name: "ntp_pools", MigrationDefault: true},
 
-	{Name: "static_routes"},
+	// network_interfaces + ip_addresses sind BEWUSST NICHT im Drift-Hash.
+	// Sie stehen in cluster_replication.go localOnlyTables, werden also NICHT
+	// repliziert und sind per Design node-spezifisch (jede Node hat eigene
+	// Mgmt-/Host-IPs, z.B. utm-1=.6, utm-2=.8). Würde man sie hashen, wäre
+	// der config_hash zwischen zwei Nodes ZWANGSLÄUFIG dauerhaft verschieden
+	// → Drift-Banner, das kein Resync je beheben kann (Resync kopiert nur
+	// replizierte Tabellen). Migration 0030 wollte sie zwar replizieren,
+	// localOnlyTables schließt sie aber weiter aus → wir hashen sie nicht.
+	//
+	// static_routes, dns_settings, ntp_settings bleiben ebenfalls node-spezifisch.
 }
 
 // hashSQL rendert die SHA-Input-SQL für eine Tabelle.
@@ -100,22 +108,39 @@ func hashSQL(t hashTable) string {
 // ComputeConfigHash gibt den 16-hex-char-Hash über alle Spec-Tabellen
 // zurück. Fehlende Tabellen (transienter schema-flux) werden als
 // leerer Per-Table-Hash behandelt — kein Abbruch.
+//
+// Gibt "" zurück wenn alle user-konfigurierbaren Tabellen leer sind
+// (Singleton- und MigrationDefault-Tabellen zählen nicht als User-Config).
+// Das verhindert False-Positive-Drift-Banner auf frisch gejointen Secondaries.
 func ComputeConfigHash(ctx context.Context, pool *pgxpool.Pool) (string, error) {
 	if pool == nil {
 		return "", fmt.Errorf("nil pool")
 	}
 	h := sha256.New()
+	hasUserConfig := false
 	for _, t := range hashSpec {
 		var s string
-		if err := pool.QueryRow(ctx, hashSQL(t)).Scan(&s); err != nil {
+		sql := t.CustomSQL
+		if sql == "" {
+			sql = hashSQL(t)
+		}
+		if err := pool.QueryRow(ctx, sql).Scan(&s); err != nil {
 			// Migration fehlt o.ä. → leeren string nehmen, weiter.
 			s = ""
 		}
+		if s != "" && !t.Singleton && !t.MigrationDefault {
+			hasUserConfig = true
+		}
 		h.Write([]byte(t.Name))
 		h.Write([]byte{0})
 		h.Write([]byte(s))
 		h.Write([]byte{0})
 	}
+	if !hasUserConfig {
+		// Frisch gejoincter Secondary oder komplett leere DB →
+		// leerer String signalisiert "kein Drift prüfen" im Status-Handler.
+		return "", nil
+	}
 	return hex.EncodeToString(h.Sum(nil))[:16], nil
 }
 

internal/cluster/heartbeat.go

@@ -0,0 +1,72 @@
+package cluster
+
+// Phase-3.2: periodischer Heartbeat + Stale-Sweeper.
+//
+// Hintergrund: EnsureSelfRegistered schreibt last_seen einmal beim
+// API-Boot. Ohne periodisches Re-Schreiben friert last_seen auf den
+// Boot-Zeitpunkt ein — Peers (im Multi-Node-Setup) hätten keinen Weg
+// zu erkennen ob dieser Node noch lebt. Die Heartbeat-Goroutine in der
+// API bumpt das alle 30s; der Scheduler räumt mit SweepStaleNodes Peers
+// die länger als <threshold> nicht gemeldet haben auf status='offline'.
+//
+// Single-Node-Effekt: Cluster-UI zeigt korrekt "last seen 12s" statt
+// "last seen 3h" weil last_seen frisch ist. UI-Drift-Banner-Logik im
+// ClusterHandler.Status nutzt die selben Felder.
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Heartbeat bumpt last_seen + status='online' für die eigene Node-Row
+// und aktualisiert version + config_hash. Idempotent. UPDATE-only — die
+// Row muss existieren (wird via EnsureSelfRegistered beim Boot angelegt).
+//
+// Hash-Berechnung läuft synchron — typisch <50ms auf einer realistischen
+// DB-Größe; falls die compute-SQL fehlt (Migration im Flux) wird der
+// vorhandene config_hash via COALESCE behalten.
+func Heartbeat(ctx context.Context, pool *pgxpool.Pool, localID, version string) error {
+	if pool == nil || localID == "" {
+		return nil
+	}
+	hash, _ := ComputeConfigHash(ctx, pool)
+	_, err := pool.Exec(ctx, `
+UPDATE ha_nodes SET
+    last_seen   = NOW(),
+    status      = 'online',
+    version     = COALESCE(NULLIF($1, ''), version),
+    config_hash = COALESCE(NULLIF($2, ''), config_hash),
+    updated_at  = NOW()
+WHERE id = $3`, version, hash, localID)
+	return err
+}
+
+// SweepStaleNodes flippt status='online' → 'offline' für Peers deren
+// last_seen älter als threshold ist. Liefert die Anzahl gefliptpter
+// Rows zurück (für Logging). Idempotent — markiert keine Rows die
+// schon offline sind.
+//
+// Threshold-Konvention: 4× Heartbeat-Intervall = 2 min bei 30s-Tick.
+// Lässt Platz für eine verpasste API-Tick (Restart, GC-Pause, kurzer
+// Network-Glitch) ohne false-positive Offline.
+func SweepStaleNodes(ctx context.Context, pool *pgxpool.Pool, threshold time.Duration) (int64, error) {
+	if pool == nil || threshold <= 0 {
+		return 0, nil
+	}
+	// Wir bauen das Interval als String — pgx kann time.Duration nicht
+	// direkt als INTERVAL serialisieren.
+	interval := fmt.Sprintf("%d seconds", int(threshold.Seconds()))
+	tag, err := pool.Exec(ctx, `
+UPDATE ha_nodes SET
+    status     = 'offline',
+    updated_at = NOW()
+WHERE last_seen < NOW() - $1::interval
+  AND status = 'online'`, interval)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}

internal/cluster/jointoken/jointoken.go

@@ -0,0 +1,244 @@
+// Package jointoken implementiert one-shot Cluster-Join-Token für
+// Phase 3.4.
+//
+// Format: "eg-join-v1.<base64url(payload)>.<base64url(hmac)>"
+//
+// Payload (CBOR-ähnlich, kompakt JSON): {n: nonce(16B base64),
+// e: expires_at_unix, f: ca_fingerprint_hex_16chars}
+//
+// HMAC: SHA-256 über payload-bytes, Key aus /var/lib/edgeguard/cluster-join-secret
+// (auto-generiert beim ersten Generate-Call, 32B random, 0600).
+//
+// Lifecycle:
+//   1. Admin POSTet /cluster/join-tokens → Server generiert Token, schickt
+//      ihn als Klartext-String (einmalig). Server speichert NICHTS
+//      (token ist self-contained).
+//   2. Joiner POSTet /cluster/issue-cert mit {token, csr}.
+//   3. Server Verify(token): HMAC ok? Nicht abgelaufen? CA-Fingerprint
+//      passt zum eigenen? Nonce nicht schon in join_tokens_used?
+//   4. Bei Erfolg: nonce in join_tokens_used inserten (PK-Conflict =
+//      Re-Use → reject). Dann CSR signieren + zurückgeben.
+//
+// One-Shot-Semantik: PG-Insert mit ON CONFLICT DO NOTHING; wenn keine
+// Row inserted wurde → schon konsumiert. Das ersetzt einen sonst
+// nötigen Distributed-Lock.
+package jointoken
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+const (
+	// SecretPath: HMAC-Key. Auto-Generated beim ersten Generate.
+	DefaultSecretPath = "/var/lib/edgeguard/cluster-join-secret"
+
+	tokenPrefix = "eg-join-v1."
+
+	// DefaultTTL — wie lange ein generierter Token gültig bleibt.
+	DefaultTTL = 24 * time.Hour
+)
+
+// Service kapselt Token-Gen + -Verify mit DB-One-Shot-Tracking.
+type Service struct {
+	Pool        *pgxpool.Pool
+	SecretPath  string
+	GetCAFinger func() (string, error) // liefert 16-hex-fingerprint der eigenen CA
+	TTL         time.Duration
+}
+
+func New(pool *pgxpool.Pool, getCAFinger func() (string, error)) *Service {
+	s := &Service{
+		Pool:        pool,
+		SecretPath:  DefaultSecretPath,
+		GetCAFinger: getCAFinger,
+		TTL:         DefaultTTL,
+	}
+	// Ensure the HMAC secret file exists at startup so Consume() never
+	// fails with "no such file" on the first join attempt.
+	if _, err := s.ensureSecret(); err != nil {
+		// Non-fatal: generate won't work either, but we log and continue.
+		_ = err
+	}
+	return s
+}
+
+// payload ist das JSON inside-the-token.
+type payload struct {
+	Nonce      string `json:"n"`
+	Expires    int64  `json:"e"`
+	CAFinger16 string `json:"f"`
+}
+
+// Generate erzeugt einen frischen Token. Caller (Handler) muss bereits
+// Admin-Auth geprüft haben.
+func (s *Service) Generate() (string, time.Time, error) {
+	if s.GetCAFinger == nil {
+		return "", time.Time{}, errors.New("jointoken: GetCAFinger unset")
+	}
+	finger, err := s.GetCAFinger()
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("ca fingerprint: %w", err)
+	}
+	secret, err := s.ensureSecret()
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("load secret: %w", err)
+	}
+
+	nonceBytes := make([]byte, 16)
+	if _, err := rand.Read(nonceBytes); err != nil {
+		return "", time.Time{}, err
+	}
+	ttl := s.TTL
+	if ttl <= 0 {
+		ttl = DefaultTTL
+	}
+	exp := time.Now().Add(ttl).UTC()
+	p := payload{
+		Nonce:      base64.RawURLEncoding.EncodeToString(nonceBytes),
+		Expires:    exp.Unix(),
+		CAFinger16: finger,
+	}
+	pj, err := json.Marshal(p)
+	if err != nil {
+		return "", time.Time{}, err
+	}
+	mac := hmac.New(sha256.New, secret)
+	mac.Write(pj)
+	sig := mac.Sum(nil)
+
+	return tokenPrefix +
+		base64.RawURLEncoding.EncodeToString(pj) + "." +
+		base64.RawURLEncoding.EncodeToString(sig), exp, nil
+}
+
+// Consume verifiziert den Token UND markiert die nonce als verbraucht
+// — wenn die nonce schon in join_tokens_used steht (oder das INSERT
+// nichts geändert hat), lehnen wir ab. Erfolgreicher Consume liefert
+// die CA-Fingerprint aus dem Payload (Caller kann gegen die eigene
+// CA vergleichen).
+//
+// `consumedBy` ist freier String der zum Audit ins DB-Row landet
+// (typisch: peer.fqdn oder peer.api_url).
+func (s *Service) Consume(ctx context.Context, token, consumedBy string) (payload, error) {
+	var zero payload
+	if !strings.HasPrefix(token, tokenPrefix) {
+		return zero, errors.New("invalid token format")
+	}
+	rest := strings.TrimPrefix(token, tokenPrefix)
+	parts := strings.SplitN(rest, ".", 2)
+	if len(parts) != 2 {
+		return zero, errors.New("invalid token format")
+	}
+	pj, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return zero, fmt.Errorf("decode payload: %w", err)
+	}
+	sig, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return zero, fmt.Errorf("decode sig: %w", err)
+	}
+	secret, err := s.loadSecret()
+	if err != nil {
+		return zero, fmt.Errorf("load secret: %w", err)
+	}
+	mac := hmac.New(sha256.New, secret)
+	mac.Write(pj)
+	want := mac.Sum(nil)
+	if !hmac.Equal(want, sig) {
+		return zero, errors.New("bad signature")
+	}
+	var p payload
+	if err := json.Unmarshal(pj, &p); err != nil {
+		return zero, fmt.Errorf("unmarshal payload: %w", err)
+	}
+	now := time.Now().UTC()
+	if now.Unix() > p.Expires {
+		return zero, errors.New("token expired")
+	}
+	if s.GetCAFinger != nil {
+		ownFinger, err := s.GetCAFinger()
+		if err == nil && ownFinger != p.CAFinger16 {
+			return zero, errors.New("ca fingerprint mismatch (wrong cluster?)")
+		}
+	}
+	// One-shot-INSERT — wenn die nonce schon da ist (Re-Use), schlägt
+	// das fehl und wir lehnen ab.
+	exp := time.Unix(p.Expires, 0).UTC()
+	tag, err := s.Pool.Exec(ctx, `
+INSERT INTO join_tokens_used (nonce, expires_at, consumed_by)
+VALUES ($1, $2, $3)
+ON CONFLICT (nonce) DO NOTHING`, p.Nonce, exp, consumedBy)
+	if err != nil {
+		return zero, fmt.Errorf("track nonce: %w", err)
+	}
+	if tag.RowsAffected() == 0 {
+		return zero, errors.New("token already used")
+	}
+	return p, nil
+}
+
+// CleanupExpired löscht abgelaufene Nonce-Rows. Idempotent; Aufruf vom
+// Scheduler einmal pro Stunde reicht.
+func (s *Service) CleanupExpired(ctx context.Context) (int64, error) {
+	tag, err := s.Pool.Exec(ctx,
+		`DELETE FROM join_tokens_used WHERE expires_at < NOW() - INTERVAL '7 days'`)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
+// ── secret handling ───────────────────────────────────────────────────
+
+func (s *Service) ensureSecret() ([]byte, error) {
+	if b, err := s.loadSecret(); err == nil && len(b) >= 32 {
+		return b, nil
+	}
+	// Generate fresh secret. Dir wird in postinst erstellt (0700,
+	// edgeguard-owned), wir schreiben direkt rein.
+	dir := filepath.Dir(s.path())
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return nil, err
+	}
+	key := make([]byte, 32)
+	if _, err := rand.Read(key); err != nil {
+		return nil, err
+	}
+	if err := os.WriteFile(s.path(), key, 0o600); err != nil {
+		return nil, err
+	}
+	return key, nil
+}
+
+func (s *Service) loadSecret() ([]byte, error) {
+	return os.ReadFile(s.path())
+}
+
+func (s *Service) path() string {
+	if s.SecretPath != "" {
+		return s.SecretPath
+	}
+	return DefaultSecretPath
+}
+
+// CAFingerprint16 liefert die ersten 16 Hex-Chars vom SHA-256 der CA-
+// Certificate DER-Bytes. Eindeutig genug für den Cluster-Trust-Check
+// (64 bit Entropie); kürzer als 64 Hex damit Token nicht aufbläst.
+func CAFingerprint16(caCertDER []byte) string {
+	sum := sha256.Sum256(caCertDER)
+	return hex.EncodeToString(sum[:])[:16]
+}

internal/cluster/store.go

@@ -100,6 +100,31 @@ RETURNING id, name, fqdn, api_url, public_ip, internal_ip, mgmt_ip,
 	return scanNode(row)
 }
 
+// Delete entfernt einen Peer aus ha_nodes. Caller (Handler) verhindert
+// dass die lokale Node sich selbst löscht — sonst geht der nächste
+// Heartbeat-Tick die Row wieder anlegen UND der Cluster-Status zeigt
+// für 2 min "weg" obwohl der Node noch läuft.
+func (s *Store) Delete(ctx context.Context, id string) error {
+	tag, err := s.Pool.Exec(ctx, `DELETE FROM ha_nodes WHERE id = $1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// DeletePlaceholdersByFQDN removes all ha_nodes rows that share the given
+// FQDN but do NOT have the specified keepID. Used to clean up pre-registered
+// placeholder rows (both old "pre-{timestamp}" and new "prenode-{fqdn}"
+// style) after a real autoRegister arrives via mTLS.
+func (s *Store) DeletePlaceholdersByFQDN(ctx context.Context, fqdn, keepID string) error {
+	_, err := s.Pool.Exec(ctx,
+		`DELETE FROM ha_nodes WHERE fqdn = $1 AND id != $2`, fqdn, keepID)
+	return err
+}
+
 // EnsureSelfRegistered mints the node-id if needed, builds the row
 // from setup.json + os.Hostname + node.conf, and upserts it. Called
 // on edgeguard-api boot AFTER the DB pool is reachable.

internal/crowdsec/service.go

@@ -0,0 +1,432 @@
+// Package crowdsec wraps sudo /usr/bin/cscli calls for the edgeguard
+// management API. All list operations use -o json. Mutation operations
+// (add/delete) use the appropriate cscli sub-commands.
+//
+// edgeguard runs as a non-root system user; every cscli call goes
+// through sudo (allowed entries are in /etc/sudoers.d/edgeguard).
+package crowdsec
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// ErrNotInstalled is returned when /usr/bin/cscli is not found.
+var ErrNotInstalled = errors.New("crowdsec not installed")
+
+// IsInstalled checks whether /usr/bin/cscli exists on this host.
+func IsInstalled() bool {
+	_, err := os.Stat("/usr/bin/cscli")
+	return err == nil
+}
+
+// ---------- Types -----------------------------------------------------------
+
+// Decision represents a single IP decision (ban/captcha/etc.) in CrowdSec.
+type Decision struct {
+	ID       int64  `json:"id"`
+	Origin   string `json:"origin"`
+	Type     string `json:"type"`
+	Scope    string `json:"scope"`
+	Value    string `json:"value"`
+	Duration string `json:"duration"`
+	Reason   string `json:"reason"`
+	Country  string `json:"country,omitempty"`
+	AS       string `json:"as,omitempty"`
+}
+
+// Alert represents a CrowdSec alert with associated decisions.
+type Alert struct {
+	ID          int64       `json:"id"`
+	Scenario    string      `json:"scenario"`
+	EventsCount int         `json:"events_count"`
+	Source      AlertSource `json:"source"`
+	StartAt     string      `json:"start_at"`
+	StopAt      string      `json:"stop_at"`
+	Decisions   []Decision  `json:"decisions,omitempty"`
+}
+
+// AlertSource holds the source IP/range info for an alert.
+type AlertSource struct {
+	IP      string `json:"ip"`
+	Country string `json:"cn,omitempty"`
+	ASName  string `json:"as_name,omitempty"`
+	Range   string `json:"range,omitempty"`
+	Scope   string `json:"scope,omitempty"`
+	Value   string `json:"value,omitempty"`
+}
+
+// Bouncer represents a registered CrowdSec bouncer.
+type Bouncer struct {
+	Name      string `json:"name"`
+	IPAddress string `json:"ip_address,omitempty"`
+	Revoked   bool   `json:"revoked"`
+	LastPull  string `json:"last_pull,omitempty"`
+	Type      string `json:"type,omitempty"`
+	Version   string `json:"version,omitempty"`
+	CreatedAt string `json:"created_at"`
+	AuthType  string `json:"auth_type,omitempty"`
+}
+
+// Machine represents a registered CrowdSec agent/machine.
+type Machine struct {
+	MachineID   string `json:"machineId"`
+	CreatedAt   string `json:"created_at"`
+	UpdatedAt   string `json:"updated_at"`
+	LastPush    string `json:"last_push,omitempty"`
+	IsValidated bool   `json:"isValidated"`
+	Version     string `json:"version,omitempty"`
+	Status      string `json:"status,omitempty"`
+}
+
+// HubItem represents a CrowdSec hub item (collection, parser, scenario, etc.).
+type HubItem struct {
+	Name         string `json:"name"`
+	Description  string `json:"description,omitempty"`
+	Status       string `json:"status"`
+	LocalVersion string `json:"local_version,omitempty"`
+	LocalPath    string `json:"local_path,omitempty"`
+	Author       string `json:"author,omitempty"`
+	Type         string `json:"type,omitempty"`
+}
+
+// Status summarises the runtime state of the CrowdSec stack on this node.
+type Status struct {
+	Installed      bool   `json:"installed"`
+	AgentRunning   bool   `json:"agent_running"`
+	BouncerRunning bool   `json:"bouncer_running"`
+	Version        string `json:"version,omitempty"`
+	DecisionCount  int    `json:"decision_count"`
+	AlertCount     int    `json:"alert_count"`
+	BouncerCount   int    `json:"bouncer_count"`
+	MachineCount   int    `json:"machine_count"`
+}
+
+// ---------- Helpers ---------------------------------------------------------
+
+// sudoCscli executes `sudo -n /usr/bin/cscli <args...>` and returns stdout.
+func sudoCscli(ctx context.Context, args ...string) ([]byte, error) {
+	full := append([]string{"-n", "/usr/bin/cscli"}, args...)
+	cmd := exec.CommandContext(ctx, "sudo", full...)
+	var out, errBuf bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &errBuf
+	if err := cmd.Run(); err != nil {
+		slog.Error("crowdsec: sudoCscli failed", "args", args, "error", err, "stderr", errBuf.String())
+		return nil, err
+	}
+	if errBuf.Len() > 0 {
+		slog.Warn("crowdsec: sudoCscli stderr", "args", args, "stderr", errBuf.String())
+	}
+	slog.Debug("crowdsec: sudoCscli ok", "args", args[0], "bytes", out.Len())
+	return out.Bytes(), nil
+}
+
+// systemctlActive returns true when the named unit is "active".
+func systemctlActive(ctx context.Context, unit string) bool {
+	cmd := exec.CommandContext(ctx, "systemctl", "is-active", "--quiet", unit)
+	return cmd.Run() == nil
+}
+
+// unmarshalSlice unmarshals JSON that may be "null" (cscli returns null
+// instead of [] when no items exist). Returns an empty slice in that case.
+func unmarshalSlice[T any](data []byte) ([]T, error) {
+	data = bytes.TrimSpace(data)
+	if bytes.Equal(data, []byte("null")) || len(data) == 0 {
+		return []T{}, nil
+	}
+	var result []T
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+// ---------- ServiceStatus ---------------------------------------------------
+
+// ServiceStatus returns a Status struct describing the current state of the
+// CrowdSec agent and bouncer on this node. Does NOT need cscli installed —
+// it uses systemctl for the running-state checks. Version is extracted via
+// `cscli version` when available.
+func ServiceStatus(ctx context.Context) Status {
+	st := Status{
+		Installed:      IsInstalled(),
+		AgentRunning:   systemctlActive(ctx, "crowdsec"),
+		BouncerRunning: systemctlActive(ctx, "crowdsec-firewall-bouncer"),
+	}
+
+	if st.Installed {
+		// Grab version from `sudo -n /usr/bin/cscli version` — first line only.
+		// Output is not JSON; it looks like "version: v1.6.3-..."
+		if out, err := sudoCscli(ctx, "version"); err == nil {
+			scanner := bufio.NewScanner(bytes.NewReader(out))
+			if scanner.Scan() {
+				st.Version = strings.TrimSpace(scanner.Text())
+			}
+		}
+	}
+
+	// Only query cscli data endpoints when the agent is running — cscli
+	// hangs on its local socket when the agent is stopped, which would
+	// block the entire status response and leave the UI with no data.
+	if st.AgentRunning {
+		if decisions, err := Decisions(ctx); err == nil {
+			st.DecisionCount = len(decisions)
+		}
+		if alerts, err := Alerts(ctx, 500); err == nil {
+			st.AlertCount = len(alerts)
+		}
+		if bouncers, err := Bouncers(ctx); err == nil {
+			st.BouncerCount = len(bouncers)
+		}
+		if machines, err := Machines(ctx); err == nil {
+			st.MachineCount = len(machines)
+		}
+	}
+
+	return st
+}
+
+// ---------- Decisions -------------------------------------------------------
+
+// cscli decisions list -o json returns alert-level objects with nested
+// decisions[] arrays. These intermediate types are used only for parsing.
+type cscliDecisionRaw struct {
+	ID       int64  `json:"id"`
+	Duration string `json:"duration"`
+	Origin   string `json:"origin"`
+	Scope    string `json:"scope"`
+	Type     string `json:"type"`
+	Value    string `json:"value"`
+}
+
+type cscliAlertRaw struct {
+	Scenario  string             `json:"scenario"`
+	Decisions []cscliDecisionRaw `json:"decisions"`
+	Source    struct {
+		IP     string `json:"ip"`
+		CN     string `json:"cn"`
+		ASName string `json:"as_name"`
+	} `json:"source"`
+}
+
+// Decisions lists all active decisions by flattening the alert-level JSON
+// that cscli emits (each alert contains a nested decisions[] array).
+func Decisions(ctx context.Context) ([]Decision, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "decisions", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	alerts, err := unmarshalSlice[cscliAlertRaw](out)
+	if err != nil {
+		return nil, err
+	}
+	var result []Decision
+	for _, a := range alerts {
+		for _, d := range a.Decisions {
+			result = append(result, Decision{
+				ID:       d.ID,
+				Origin:   d.Origin,
+				Type:     d.Type,
+				Scope:    d.Scope,
+				Value:    d.Value,
+				Duration: d.Duration,
+				Reason:   a.Scenario,
+				Country:  a.Source.CN,
+				AS:       a.Source.ASName,
+			})
+		}
+	}
+	if result == nil {
+		result = []Decision{}
+	}
+	return result, nil
+}
+
+// AddDecision creates a new ban/captcha decision for the given IP.
+func AddDecision(ctx context.Context, ip, duration, reason, typ string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "decisions", "add",
+		"--ip", ip,
+		"--duration", duration,
+		"--reason", reason,
+		"--type", typ,
+	)
+	return err
+}
+
+// DeleteDecisionByIP removes all decisions for a given IP address.
+func DeleteDecisionByIP(ctx context.Context, ip string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "decisions", "delete", "--ip", ip)
+	return err
+}
+
+// DeleteDecisionByID removes a single decision by its numeric ID.
+func DeleteDecisionByID(ctx context.Context, id string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "decisions", "delete", "--id", id)
+	return err
+}
+
+// ---------- Alerts ----------------------------------------------------------
+
+// Alerts lists recent alerts (up to limit).
+func Alerts(ctx context.Context, limit int) ([]Alert, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "alerts", "list", "-o", "json",
+		"-l", fmt.Sprintf("%d", limit))
+	if err != nil {
+		return nil, err
+	}
+	return unmarshalSlice[Alert](out)
+}
+
+// DeleteAlert discards (deletes) a single alert by its ID.
+func DeleteAlert(ctx context.Context, id string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "alerts", "delete", "--id", id)
+	return err
+}
+
+// ---------- Bouncers --------------------------------------------------------
+
+// Bouncers lists all registered bouncers.
+func Bouncers(ctx context.Context) ([]Bouncer, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "bouncers", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	return unmarshalSlice[Bouncer](out)
+}
+
+// DeleteBouncer removes a bouncer by name.
+func DeleteBouncer(ctx context.Context, name string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "bouncers", "delete", name)
+	return err
+}
+
+// ---------- Machines --------------------------------------------------------
+
+// cscliMachineRaw mirrors the actual cscli JSON with its mixed camelCase /
+// snake_case field names. Only used inside Machines().
+type cscliMachineRaw struct {
+	MachineID   string `json:"machineId"`
+	CreatedAt   string `json:"created_at"`
+	UpdatedAt   string `json:"updated_at"`
+	LastPush    string `json:"last_push"`
+	IsValidated bool   `json:"isValidated"`
+	Version     string `json:"version"`
+	Status      string `json:"status"`
+}
+
+// Machines lists all registered machines/agents.
+func Machines(ctx context.Context) ([]Machine, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "machines", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	raw, err := unmarshalSlice[cscliMachineRaw](out)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]Machine, len(raw))
+	for i, r := range raw {
+		result[i] = Machine{
+			MachineID:   r.MachineID,
+			CreatedAt:   r.CreatedAt,
+			UpdatedAt:   r.UpdatedAt,
+			LastPush:    r.LastPush,
+			IsValidated: r.IsValidated,
+			Version:     r.Version,
+			Status:      r.Status,
+		}
+	}
+	return result, nil
+}
+
+// DeleteMachine removes a machine by its machine ID.
+func DeleteMachine(ctx context.Context, id string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "machines", "delete", "--machine-id", id)
+	return err
+}
+
+// ---------- Collections -----------------------------------------------------
+
+// Collections lists installed/available hub collections.
+// cscli returns {"collections": [...]} (not a flat array) — we unwrap the key.
+func Collections(ctx context.Context) ([]HubItem, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "collections", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	out = bytes.TrimSpace(out)
+	if bytes.Equal(out, []byte("null")) || len(out) == 0 {
+		return []HubItem{}, nil
+	}
+	// cscli wraps collections in {"collections": [...]}
+	var wrapper struct {
+		Collections []HubItem `json:"collections"`
+	}
+	if err := json.Unmarshal(out, &wrapper); err != nil {
+		return nil, err
+	}
+	if wrapper.Collections == nil {
+		return []HubItem{}, nil
+	}
+	return wrapper.Collections, nil
+}
+
+// InstallCollection installs a hub collection by name (--force to upgrade).
+func InstallCollection(ctx context.Context, name string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "collections", "install", name, "--force")
+	return err
+}
+
+// RemoveCollection removes a hub collection by name.
+func RemoveCollection(ctx context.Context, name string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "collections", "remove", name)
+	return err
+}

internal/database/migrations/0002_cluster.sql

@@ -15,8 +15,8 @@ CREATE TABLE IF NOT EXISTS ha_nodes (
     name        TEXT NOT NULL,
     fqdn        TEXT NOT NULL,
     api_url     TEXT NOT NULL,
-    public_ip   INET,
-    internal_ip INET,
+    public_ip   TEXT,
+    internal_ip TEXT,
     role        TEXT NOT NULL DEFAULT 'peer',
     last_seen   TIMESTAMPTZ,
     joined_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),

internal/database/migrations/0020_ha_nodes_ext.sql

@@ -14,7 +14,7 @@
 ALTER TABLE ha_nodes
     ADD COLUMN IF NOT EXISTS version     TEXT,
     ADD COLUMN IF NOT EXISTS config_hash TEXT,
-    ADD COLUMN IF NOT EXISTS mgmt_ip     INET,
+    ADD COLUMN IF NOT EXISTS mgmt_ip     TEXT,
     ADD COLUMN IF NOT EXISTS status      TEXT NOT NULL DEFAULT 'unknown';
 
 ALTER TABLE ha_nodes
@@ -33,7 +33,7 @@ ALTER TABLE ha_nodes
     DROP CONSTRAINT IF EXISTS ha_nodes_status_check;
 ALTER TABLE ha_nodes
     DROP COLUMN IF EXISTS status,
-    DROP COLUMN IF EXISTS mgmt_ip,
+    DROP COLUMN IF EXISTS mgmt_ip,  -- TEXT
     DROP COLUMN IF EXISTS config_hash,
     DROP COLUMN IF EXISTS version;
 -- +goose StatementEnd

internal/database/migrations/0023_domains_settings.sql

@@ -0,0 +1,39 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Domain-Settings die HAProxy pro Domain rendern kann. Bisher
+-- hatten Domains nur ein binäres hsts_enabled — jetzt ist HSTS
+-- granular (max-age, subdomains, preload) plus Maintenance-Mode
+-- und Canonical-www-Redirect.
+
+ALTER TABLE domains
+    ADD COLUMN IF NOT EXISTS hsts_max_age        INTEGER NOT NULL DEFAULT 31536000,
+    ADD COLUMN IF NOT EXISTS hsts_subdomains     BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS hsts_preload        BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS maintenance_mode    BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS maintenance_message TEXT,
+    ADD COLUMN IF NOT EXISTS www_redirect        TEXT NOT NULL DEFAULT '';
+
+-- www_redirect-Werte:
+--   ''        — kein Redirect (Default; Domain wird direkt geserved)
+--   'to-naked'— www.foo.com → foo.com (canonical naked-domain)
+--   'to-www'  — foo.com → www.foo.com (canonical www)
+ALTER TABLE domains
+    DROP CONSTRAINT IF EXISTS domains_www_redirect_check;
+ALTER TABLE domains
+    ADD CONSTRAINT domains_www_redirect_check
+        CHECK (www_redirect IN ('', 'to-naked', 'to-www'));
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE domains DROP CONSTRAINT IF EXISTS domains_www_redirect_check;
+ALTER TABLE domains
+    DROP COLUMN IF EXISTS www_redirect,
+    DROP COLUMN IF EXISTS maintenance_message,
+    DROP COLUMN IF EXISTS maintenance_mode,
+    DROP COLUMN IF EXISTS hsts_preload,
+    DROP COLUMN IF EXISTS hsts_subdomains,
+    DROP COLUMN IF EXISTS hsts_max_age;
+-- +goose StatementEnd

internal/database/migrations/0024_domain_headers_ratelimit.sql

@@ -0,0 +1,58 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Phase 2 Domain-Settings:
+--   * rate_limit_rps  — Requests pro Sekunde Cap je Client-IP (0 = aus).
+--     HAProxy implementiert das via per-Domain Stick-Table (siehe
+--     internal/haproxy/haproxy.cfg.tpl).
+--   * max_body_kb     — max. Request-Body-Größe in KiB (0 = aus).
+--     HAProxy verweigert größere Requests mit 413.
+--   * domain_response_headers — beliebige Set-Header Pairs die je
+--     Domain auf jede Response gesetzt werden (CORS, CSP, X-Frame-
+--     Options, …). HAProxy rendert pro Eintrag einen `http-response
+--     set-header` mit Host-ACL.
+
+ALTER TABLE domains
+    ADD COLUMN IF NOT EXISTS rate_limit_rps INTEGER NOT NULL DEFAULT 0,
+    ADD COLUMN IF NOT EXISTS max_body_kb    INTEGER NOT NULL DEFAULT 0;
+
+ALTER TABLE domains
+    DROP CONSTRAINT IF EXISTS domains_rate_limit_rps_check;
+ALTER TABLE domains
+    ADD CONSTRAINT domains_rate_limit_rps_check CHECK (rate_limit_rps >= 0);
+
+ALTER TABLE domains
+    DROP CONSTRAINT IF EXISTS domains_max_body_kb_check;
+ALTER TABLE domains
+    ADD CONSTRAINT domains_max_body_kb_check CHECK (max_body_kb >= 0);
+
+CREATE TABLE IF NOT EXISTS domain_response_headers (
+    id          BIGSERIAL PRIMARY KEY,
+    domain_id   BIGINT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    name        TEXT   NOT NULL,
+    value       TEXT   NOT NULL,
+    position    INTEGER NOT NULL DEFAULT 0,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ein Header-Name darf pro Domain nur einmal auftauchen (case-insensitive,
+-- HTTP-Header sind per RFC nicht case-sensitive). Verhindert dass zwei
+-- konkurrierende Werte für "X-Frame-Options" gesetzt werden.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_drh_domain_name_ci
+    ON domain_response_headers (domain_id, lower(name));
+
+CREATE INDEX IF NOT EXISTS idx_drh_domain
+    ON domain_response_headers (domain_id, position);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP TABLE IF EXISTS domain_response_headers;
+ALTER TABLE domains DROP CONSTRAINT IF EXISTS domains_max_body_kb_check;
+ALTER TABLE domains DROP CONSTRAINT IF EXISTS domains_rate_limit_rps_check;
+ALTER TABLE domains
+    DROP COLUMN IF EXISTS max_body_kb,
+    DROP COLUMN IF EXISTS rate_limit_rps;
+-- +goose StatementEnd

internal/database/migrations/0025_join_tokens_used.sql

@@ -0,0 +1,28 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Phase 3.4: Cluster-Join-Token One-Shot-Consume-Tracking.
+--
+-- Token-Format ist HMAC-self-contained (siehe internal/cluster/jointoken):
+-- nonce + expires_at + ca-fingerprint, signiert mit dem Cluster-Join-
+-- Secret. Damit der Token wirklich nur EINMAL benutzbar ist, speichern
+-- wir die nonce beim Consume — Re-Use → 409. expires_at hilft beim
+-- Cleanup (Tokens älter als ihre eigene Expiry können gelöscht werden,
+-- auch ungebraucht).
+
+CREATE TABLE IF NOT EXISTS join_tokens_used (
+    nonce       TEXT PRIMARY KEY,
+    used_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at  TIMESTAMPTZ NOT NULL,
+    consumed_by TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_join_tokens_used_expires
+    ON join_tokens_used (expires_at);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP TABLE IF EXISTS join_tokens_used;
+-- +goose StatementEnd

internal/database/migrations/0026_wg_client_routes.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE wireguard_interfaces
+    ADD COLUMN IF NOT EXISTS client_routes TEXT;
+
+-- +goose Down
+ALTER TABLE wireguard_interfaces DROP COLUMN IF EXISTS client_routes;

internal/database/migrations/0027_http_protocol_flags.sql

@@ -0,0 +1,22 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- backends.force_http1: zwingt HAProxy, die Backend-Verbindung mit
+-- HTTP/1.1 zu führen (alpn http/1.1) statt H2+H1.1 zu verhandeln.
+-- Nötig für Backends die kein h2 sprechen (Legacy-Apps, manche nginx-Configs).
+ALTER TABLE backends
+    ADD COLUMN IF NOT EXISTS force_http1 BOOLEAN NOT NULL DEFAULT FALSE;
+
+-- domains.disable_h3: unterdrückt den Alt-Svc-Response-Header für diese
+-- Domain. Browser erhalten keinen Hinweis auf h3/QUIC und bleiben auf
+-- h2/http1.1 — sinnvoll wenn Clients Probleme mit QUIC-Verbindungen melden.
+ALTER TABLE domains
+    ADD COLUMN IF NOT EXISTS disable_h3 BOOLEAN NOT NULL DEFAULT FALSE;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE backends DROP COLUMN IF EXISTS force_http1;
+ALTER TABLE domains  DROP COLUMN IF EXISTS disable_h3;
+-- +goose StatementEnd

internal/database/migrations/0028_ha_nodes_ip_text.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- pgx scannt INET-Spalten nicht direkt in *string (OID 869-Fehler).
+-- Go-Modell speichert IPs als string — TEXT ist hier korrekt.
+-- Bestehende Werte bleiben erhalten (USING public_ip::TEXT).
+ALTER TABLE ha_nodes
+    ALTER COLUMN public_ip   TYPE TEXT USING public_ip::TEXT,
+    ALTER COLUMN internal_ip TYPE TEXT USING internal_ip::TEXT,
+    ALTER COLUMN mgmt_ip     TYPE TEXT USING mgmt_ip::TEXT;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE ha_nodes
+    ALTER COLUMN public_ip   TYPE INET USING public_ip::INET,
+    ALTER COLUMN internal_ip TYPE INET USING internal_ip::INET,
+    ALTER COLUMN mgmt_ip     TYPE INET USING mgmt_ip::INET;
+-- +goose StatementEnd

internal/database/migrations/0029_cluster_vip.sql

@@ -0,0 +1,36 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- pg_role: Rolle dieser Node in der PG-Replikation.
+-- "standalone" = kein Streaming-Replication-Setup
+-- "primary"    = WAL-Sender, repliziert an Standby(s)
+-- "standby"    = Hot-Standby, liest WAL vom Primary
+ALTER TABLE ha_nodes ADD COLUMN IF NOT EXISTS pg_role TEXT NOT NULL DEFAULT 'standalone';
+
+-- cluster_settings: VIP + VRRP-Konfiguration (Singleton, id=1).
+-- vip_address   = die virtuelle IP-Adresse (z.B. "89.163.205.10")
+-- vip_interface = Netzwerk-Interface (z.B. "eth0")
+-- vip_auth_pass = VRRP-Authentication-Passwort (max. 8 Zeichen, Keepalived-Limit)
+-- vrrp_router_id = VRRP Virtual Router ID (1–255, muss im Subnetz eindeutig sein)
+CREATE TABLE IF NOT EXISTS cluster_settings (
+    id              INTEGER PRIMARY KEY DEFAULT 1,
+    vip_address     TEXT,
+    vip_interface   TEXT,
+    vip_auth_pass   TEXT,
+    vrrp_router_id  INTEGER NOT NULL DEFAULT 51,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT cluster_settings_singleton CHECK (id = 1)
+);
+
+INSERT INTO cluster_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+DROP TABLE IF EXISTS cluster_settings;
+ALTER TABLE ha_nodes DROP COLUMN IF EXISTS pg_role;
+
+-- +goose StatementEnd

internal/database/migrations/0030_cluster_sync_replication.sql

@@ -0,0 +1,21 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- HINWEIS (korrigiert v1.2.89): Diese Migration war urspr. dafür gedacht,
+-- network_interfaces und ip_addresses in die Cluster-Replikation aufzunehmen.
+-- Das wurde NICHT umgesetzt und ist auch NICHT gewollt: beide Tabellen sind
+-- node-spezifisch (jede Node hat eigene Mgmt-/Host-IPs) und stehen weiterhin
+-- in cluster_replication.go localOnlyTables → sie werden bewusst NICHT
+-- repliziert. Sie sind auch aus dem Drift-Hash (confighash.go) entfernt,
+-- da sie sonst dauerhaften False-Positive-Drift erzeugen.
+-- Diese Migration ist ein No-op / reiner Versions-Marker für goose.
+SELECT 1;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+SELECT 1;
+
+-- +goose StatementEnd

internal/database/migrations/0031_forward_proxy_settings.sql

@@ -0,0 +1,25 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- forward_proxy_settings — Singleton-Row für globale Squid-Einstellungen.
+-- listen_addresses: Komma-separierte IPs auf denen Squid lauscht.
+-- Leer = alle Interfaces (http_port 3128). Typisch: LAN/VLAN-Gateway-IPs.
+CREATE TABLE IF NOT EXISTS forward_proxy_settings (
+    id               INTEGER PRIMARY KEY DEFAULT 1,
+    listen_addresses TEXT NOT NULL DEFAULT '',
+    listen_port      INTEGER NOT NULL DEFAULT 3128,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT forward_proxy_settings_singleton CHECK (id = 1)
+);
+
+INSERT INTO forward_proxy_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+DROP TABLE IF EXISTS forward_proxy_settings;
+
+-- +goose StatementEnd

internal/database/migrations/0032_proxy_dns_extended_settings.sql

@@ -0,0 +1,37 @@
+-- +goose Up
+-- +goose StatementBegin
+
+ALTER TABLE forward_proxy_settings
+  ADD COLUMN IF NOT EXISTS cache_mem_mb      INTEGER NOT NULL DEFAULT 64,
+  ADD COLUMN IF NOT EXISTS cache_dir_mb      INTEGER NOT NULL DEFAULT 100,
+  ADD COLUMN IF NOT EXISTS max_obj_size_mb   INTEGER NOT NULL DEFAULT 4,
+  ADD COLUMN IF NOT EXISTS connect_timeout   INTEGER NOT NULL DEFAULT 60,
+  ADD COLUMN IF NOT EXISTS read_timeout      INTEGER NOT NULL DEFAULT 300,
+  ADD COLUMN IF NOT EXISTS request_timeout   INTEGER NOT NULL DEFAULT 300;
+
+ALTER TABLE dns_settings
+  ADD COLUMN IF NOT EXISTS prefetch            BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS serve_expired       BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS msg_cache_size_mb   INTEGER NOT NULL DEFAULT 64,
+  ADD COLUMN IF NOT EXISTS rrset_cache_size_mb INTEGER NOT NULL DEFAULT 128;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+ALTER TABLE forward_proxy_settings
+  DROP COLUMN IF EXISTS cache_mem_mb,
+  DROP COLUMN IF EXISTS cache_dir_mb,
+  DROP COLUMN IF EXISTS max_obj_size_mb,
+  DROP COLUMN IF EXISTS connect_timeout,
+  DROP COLUMN IF EXISTS read_timeout,
+  DROP COLUMN IF EXISTS request_timeout;
+
+ALTER TABLE dns_settings
+  DROP COLUMN IF EXISTS prefetch,
+  DROP COLUMN IF EXISTS serve_expired,
+  DROP COLUMN IF EXISTS msg_cache_size_mb,
+  DROP COLUMN IF EXISTS rrset_cache_size_mb;
+
+-- +goose StatementEnd

internal/database/migrations/0033_cluster_settings_splitbrain.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+-- Dual-path VRRP + Gateway-Tracking für Split-Brain-Schutz.
+-- hb_* = zweite VRRP-Instanz (VI_HB) auf dediziertem Heartbeat-Interface.
+-- gw_check_ip = Gateway-IP die von chk_gateway angepingt wird (weight -110).
+ALTER TABLE cluster_settings
+  ADD COLUMN IF NOT EXISTS hb_interface  VARCHAR,
+  ADD COLUMN IF NOT EXISTS hb_src_ip     VARCHAR,
+  ADD COLUMN IF NOT EXISTS hb_peer_ip    VARCHAR,
+  ADD COLUMN IF NOT EXISTS hb_router_id  INTEGER NOT NULL DEFAULT 52,
+  ADD COLUMN IF NOT EXISTS gw_check_ip   VARCHAR;
+
+-- +goose Down
+ALTER TABLE cluster_settings
+  DROP COLUMN IF EXISTS hb_interface,
+  DROP COLUMN IF EXISTS hb_src_ip,
+  DROP COLUMN IF EXISTS hb_peer_ip,
+  DROP COLUMN IF EXISTS hb_router_id,
+  DROP COLUMN IF EXISTS gw_check_ip;

internal/database/migrations/0034_totp.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+ALTER TABLE users
+    ADD COLUMN totp_secret  TEXT,
+    ADD COLUMN totp_enabled BOOLEAN NOT NULL DEFAULT false;
+
+-- +goose Down
+ALTER TABLE users
+    DROP COLUMN totp_secret,
+    DROP COLUMN totp_enabled;

internal/database/migrations/0035_firewall_note_labels.sql

@@ -0,0 +1,17 @@
+-- +goose Up
+ALTER TABLE firewall_rules
+    ADD COLUMN IF NOT EXISTS note   TEXT,
+    ADD COLUMN IF NOT EXISTS labels TEXT[] NOT NULL DEFAULT '{}';
+
+ALTER TABLE firewall_nat_rules
+    ADD COLUMN IF NOT EXISTS note   TEXT,
+    ADD COLUMN IF NOT EXISTS labels TEXT[] NOT NULL DEFAULT '{}';
+
+-- +goose Down
+ALTER TABLE firewall_rules
+    DROP COLUMN IF EXISTS note,
+    DROP COLUMN IF EXISTS labels;
+
+ALTER TABLE firewall_nat_rules
+    DROP COLUMN IF EXISTS note,
+    DROP COLUMN IF EXISTS labels;

internal/database/migrations/0036_crowdsec.sql

@@ -0,0 +1,12 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS crowdsec_settings (
+    id               INTEGER PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    enabled          BOOLEAN NOT NULL DEFAULT false,
+    simulation_mode  BOOLEAN NOT NULL DEFAULT false,
+    collections      TEXT[]  NOT NULL DEFAULT '{"crowdsecurity/linux","crowdsecurity/haproxy"}',
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+INSERT INTO crowdsec_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS crowdsec_settings;

internal/database/migrations/0037_waf.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS waf_configs (
+    id              SERIAL PRIMARY KEY,
+    domain_id       BIGINT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    enabled         BOOLEAN  NOT NULL DEFAULT false,
+    mode            TEXT     NOT NULL DEFAULT 'detection'
+                             CHECK (mode IN ('detection','blocking')),
+    paranoia_level  INT      NOT NULL DEFAULT 1
+                             CHECK (paranoia_level BETWEEN 1 AND 4),
+    rule_exclusions TEXT[]   NOT NULL DEFAULT '{}',
+    trusted_proxies TEXT[]   NOT NULL DEFAULT '{}',
+    custom_rules    TEXT     NOT NULL DEFAULT '',
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT waf_configs_domain_unique UNIQUE (domain_id)
+);
+
+-- +goose Down
+DROP TABLE IF EXISTS waf_configs;

internal/database/migrations/0038_waf_alerts.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS waf_alerts (
+    id         BIGSERIAL PRIMARY KEY,
+    domain_id  BIGINT REFERENCES domains(id) ON DELETE CASCADE,
+    hostname   TEXT        NOT NULL,
+    client_ip  TEXT        NOT NULL,
+    method     TEXT        NOT NULL,
+    uri        TEXT        NOT NULL,
+    rule_id    INT         NOT NULL DEFAULT 0,
+    rule_msg   TEXT        NOT NULL DEFAULT '',
+    severity   TEXT        NOT NULL DEFAULT '',
+    action     TEXT        NOT NULL,          -- 'detected' | 'blocked'
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS waf_alerts_domain_created ON waf_alerts(domain_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS waf_alerts_created ON waf_alerts(created_at DESC);
+
+-- +goose Down
+DROP TABLE IF EXISTS waf_alerts;

internal/database/migrations/0039_waf_exclusion_notes.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE waf_configs
+    ADD COLUMN IF NOT EXISTS exclusion_notes JSONB NOT NULL DEFAULT '{}';
+
+-- +goose Down
+ALTER TABLE waf_configs DROP COLUMN IF EXISTS exclusion_notes;

internal/database/migrations/0040_oidc_settings.sql

@@ -0,0 +1,35 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- OIDC / Keycloak SSO — Singleton-Settings (analog forward_proxy_settings).
+-- client_secret_enc: secrets.Box.Seal-Output (AES-256-GCM), NULL = nicht gesetzt.
+-- Rolle kommt bewusst NICHT aus dem Token, daher keine group/role-claim-Spalten.
+CREATE TABLE IF NOT EXISTS oidc_settings (
+    id                INTEGER     PRIMARY KEY DEFAULT 1,
+    enabled           BOOLEAN     NOT NULL DEFAULT false,
+    issuer_url        TEXT        NOT NULL DEFAULT '',
+    client_id         TEXT        NOT NULL DEFAULT '',
+    client_secret_enc BYTEA,
+    scopes            TEXT        NOT NULL DEFAULT 'openid email profile',
+    email_claim       TEXT        NOT NULL DEFAULT 'email',
+    button_label      TEXT        NOT NULL DEFAULT 'Sign in with SSO',
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT oidc_settings_singleton CHECK (id = 1)
+);
+INSERT INTO oidc_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- Opportunistisches Linking: beim ersten SSO-Login wird der OIDC-'sub'
+-- gespeichert; weicht er später ab, wird der Login abgelehnt. Nullable,
+-- kein Backfill (Match-Schlüssel bleibt die verifizierte E-Mail).
+ALTER TABLE users ADD COLUMN IF NOT EXISTS oidc_subject TEXT;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+ALTER TABLE users DROP COLUMN IF EXISTS oidc_subject;
+DROP TABLE IF EXISTS oidc_settings;
+
+-- +goose StatementEnd

internal/firewall/firewall.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	_ "embed"
 	"fmt"
+	"log/slog"
 	"net"
 	"os/exec"
 	"path/filepath"
@@ -52,6 +53,18 @@ func New(pool *pgxpool.Pool) *Generator { return &Generator{Pool: pool} }
 
 func (g *Generator) Name() string { return "nftables" }
 
+func (g *Generator) RenderToString(ctx context.Context) (string, error) {
+	view, err := g.loadView(ctx)
+	if err != nil {
+		return "", fmt.Errorf("nftables: load state: %w", err)
+	}
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, view); err != nil {
+		return "", fmt.Errorf("nftables: render template: %w", err)
+	}
+	return buf.String(), nil
+}
+
 func (g *Generator) Render(ctx context.Context) error {
 	view, err := g.loadView(ctx)
 	if err != nil {
@@ -103,6 +116,30 @@ type View struct {
 	// Operator never edits these — they belong to the service. If
 	// the service is removed/disabled, the rule is gone next render.
 	AutoRules []AutoFWRule
+
+	// WGServerIfaces holds the interface names of all active
+	// WireGuard server-mode interfaces. The forward chain emits
+	// iifname "<iface>" accept for each — required so that peer-to-
+	// peer traffic (Peer A → Peer B both connected to the same wg
+	// interface) can be forwarded by the box. Without this, the
+	// forward policy=drop silently kills all inter-peer packets.
+	WGServerIfaces []string
+
+	// WGSiteMasq drives masquerade rules in postrouting_nat: one entry
+	// per active WireGuard server interface. Without masquerade, traffic
+	// from VPN roadwarrior clients (e.g. 192.168.99.3) forwarded to a
+	// site-to-site LAN (10.0.10.0/24) comes back with the client's tunnel
+	// IP as destination. The remote gateway (Unify Home) doesn't know
+	// that IP and drops the reply. Masquerade rewrites the source to the
+	// server's own tunnel IP so return traffic follows the same path back.
+	WGSiteMasq []WGSiteMasqEntry
+}
+
+// WGSiteMasqEntry is one WireGuard server interface's masquerade config.
+type WGSiteMasqEntry struct {
+	Iface  string // wg interface name, e.g. "wg7"
+	VPNNet string // network CIDR of the VPN subnet, e.g. "192.168.99.0/24"
+	L3     string // "ip" oder "ip6" — Familie von VPNNet
 }
 
 // AutoFWRule is one auto-emitted inbound rule. Proto is "tcp" or
@@ -127,7 +164,11 @@ type RuleLeg struct {
 	DstIfaces []string
 	SrcAddrs  []string
 	DstAddrs  []string
-	Service   ResolvedService // Proto="" → no service match (any)
+	// L3 ist "ip" (IPv4) oder "ip6" (IPv6) für das Adress-Matching —
+	// gesetzt, sobald SrcAddrs/DstAddrs nicht leer sind. Bei adresslosen
+	// Regeln bleibt es "" (familienagnostisch, kein ip/ip6-Match).
+	L3      string
+	Service ResolvedService // Proto="" → no service match (any)
 }
 
 // ResolvedRule has all addresses + services already expanded so the
@@ -160,6 +201,12 @@ type ResolvedNATRule struct {
 	DPortStart, DPortEnd int
 	TargetAddr string
 	TargetPortStart, TargetPortEnd int
+	// L3 ist "ip" oder "ip6" — Adressfamilie der Regel (aus SrcCIDR/
+	// DstCIDR/TargetAddr abgeleitet). TargetHost ist TargetAddr, bei
+	// IPv6 MIT Port in eckigen Klammern ("[2001:db8::1]") für korrekte
+	// nft-dnat-Syntax.
+	L3         string
+	TargetHost string
 	Comment  string
 }
 
@@ -245,26 +292,15 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 	if err != nil {
 		return nil, err
 	}
-	// Expand to one Leg per (rule × service); rules without a service
-	// produce one leg with empty Proto.
+	// Expand to one Leg per (rule × service × address-family). Rules
+	// without a service produce one leg-set with empty Proto.
 	for _, r := range rules {
 		if len(r.Services) == 0 {
-			view.Legs = append(view.Legs, RuleLeg{
-				RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name,
-				Comment: r.Comment,
-				SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
-				SrcAddrs: r.SrcAddrs, DstAddrs: r.DstAddrs,
-			})
+			view.Legs = append(view.Legs, expandFamilyLegs(r, ResolvedService{}, false)...)
 			continue
 		}
 		for _, svc := range r.Services {
-			view.Legs = append(view.Legs, RuleLeg{
-				RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name,
-				Comment: r.Comment,
-				SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
-				SrcAddrs: r.SrcAddrs, DstAddrs: r.DstAddrs,
-				Service: svc,
-			})
+			view.Legs = append(view.Legs, expandFamilyLegs(r, svc, true)...)
 		}
 	}
 
@@ -278,6 +314,30 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 	// ── Auto-Rules aus laufender Service-Config ──
 	view.AutoRules = g.loadAutoRules(ctx)
 
+	// ── WireGuard server-iface names (für forward-chain + site-to-site masquerade) ──
+	wgRows, err := g.Pool.Query(ctx,
+		`SELECT name, address_cidr FROM wireguard_interfaces WHERE active AND mode = 'server'`)
+	if err == nil {
+		defer wgRows.Close()
+		for wgRows.Next() {
+			var name, cidr string
+			if wgRows.Scan(&name, &cidr) == nil {
+				view.WGServerIfaces = append(view.WGServerIfaces, name)
+				if _, ipNet, err := net.ParseCIDR(cidr); err == nil {
+					l3 := addrFamily(ipNet.String())
+					if l3 == "" {
+						l3 = "ip"
+					}
+					view.WGSiteMasq = append(view.WGSiteMasq, WGSiteMasqEntry{
+						Iface:  name,
+						VPNNet: ipNet.String(),
+						L3:     l3,
+					})
+				}
+			}
+		}
+	}
+
 	return view, nil
 }
 
@@ -309,11 +369,24 @@ func (g *Generator) loadAutoRules(ctx context.Context) []AutoFWRule {
 		}
 	}
 
-	// Squid Forward-Proxy: wenn ≥1 aktive ACL → tcp 3128 inbound
-	// (squid bindet aktuell 0.0.0.0:3128, daher kein DstIP-Filter).
-	var aclCount int
-	if err := g.Pool.QueryRow(ctx, `SELECT count(*) FROM forward_proxy_acls WHERE active`).Scan(&aclCount); err == nil && aclCount > 0 {
-		out = append(out, AutoFWRule{Proto: "tcp", Port: 3128, Comment: "Forward-Proxy (Squid)"})
+	// Squid Forward-Proxy: lese Port + Listen-Adressen aus
+	// forward_proxy_settings. Für jede nicht-loopback IP eine
+	// Auto-Rule; leere Liste = alle Interfaces (generische Regel).
+	var squidAddrs string
+	var squidPort int
+	if err := g.Pool.QueryRow(ctx,
+		`SELECT listen_addresses, listen_port FROM forward_proxy_settings WHERE id=1`,
+	).Scan(&squidAddrs, &squidPort); err == nil && squidPort > 0 {
+		addrs := splitCSV(squidAddrs)
+		if len(addrs) == 0 {
+			out = append(out, AutoFWRule{Proto: "tcp", Port: squidPort, Comment: "Forward-Proxy (Squid)"})
+		} else {
+			for _, ip := range addrs {
+				if !isLoopback(ip) {
+					out = append(out, AutoFWRule{Proto: "tcp", Port: squidPort, DstIP: ip, Comment: "Forward-Proxy (Squid) auf " + ip})
+				}
+			}
+		}
 	}
 
 	// WireGuard server-mode: udp <listen_port> pro aktive iface.
@@ -368,6 +441,131 @@ func isLoopback(ip string) bool {
 	return strings.HasPrefix(ip, "127.")
 }
 
+// addrFamily klassifiziert einen nft-Adressausdruck (host, CIDR oder
+// range "a-b") als "ip" (IPv4), "ip6" (IPv6) oder "" (unbestimmt, z.B.
+// FQDN-Platzhalter). Adressen enthalten selbst kein '-', daher trennt der
+// erste Bindestrich sicher eine Range in ihr erstes Element.
+func addrFamily(expr string) string {
+	expr = strings.TrimSpace(expr)
+	if expr == "" {
+		return ""
+	}
+	if i := strings.IndexByte(expr, '-'); i > 0 {
+		expr = strings.TrimSpace(expr[:i])
+	}
+	if i := strings.IndexByte(expr, '/'); i > 0 {
+		expr = expr[:i]
+	}
+	ip := net.ParseIP(expr)
+	if ip == nil {
+		return ""
+	}
+	if ip.To4() != nil {
+		return "ip"
+	}
+	return "ip6"
+}
+
+// splitByFamily teilt eine Liste von nft-Adressausdrücken in v4 und v6.
+// Unbestimmte (FQDN o.ä.) werden verworfen.
+func splitByFamily(exprs []string) (v4, v6 []string) {
+	for _, e := range exprs {
+		switch addrFamily(e) {
+		case "ip":
+			v4 = append(v4, e)
+		case "ip6":
+			v6 = append(v6, e)
+		}
+	}
+	return v4, v6
+}
+
+// serviceL3: icmp ist v4-only, icmpv6 v6-only, tcp/udp/leer agnostisch.
+func serviceL3(svc ResolvedService) string {
+	switch svc.Proto {
+	case "icmp":
+		return "ip"
+	case "icmpv6":
+		return "ip6"
+	default:
+		return ""
+	}
+}
+
+// natFamily ermittelt die Adressfamilie einer NAT-Regel aus ihren
+// Adressen. ok=false bei gemischten v4/v6-Adressen (ungültig → die Regel
+// muss übersprungen werden, sonst bricht `nft -f` das gesamte Ruleset).
+func natFamily(r ResolvedNATRule) (fam string, ok bool) {
+	for _, a := range []string{r.SrcCIDR, r.DstCIDR, r.TargetAddr} {
+		f := addrFamily(a)
+		if f == "" {
+			continue
+		}
+		if fam == "" {
+			fam = f
+		} else if fam != f {
+			return "", false
+		}
+	}
+	if fam == "" {
+		fam = "ip" // keine Adressen (reine iface/proto-Regel) → v4-Default
+	}
+	return fam, true
+}
+
+// expandFamilyLegs materialisiert die nft-Zeilen für eine Regel + optional
+// einen Service, getrennt nach Adressfamilie. Adresslose Regeln ergeben eine
+// einzige familienagnostische Zeile (unverändertes v4-Verhalten, greift
+// zugleich für v6). Regeln mit Adressen werden pro Familie als separate
+// Zeile emittiert — ein nft-Paket ist immer entweder v4 oder v6.
+func expandFamilyLegs(r ResolvedRule, svc ResolvedService, hasSvc bool) []RuleLeg {
+	base := RuleLeg{
+		RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name, Comment: r.Comment,
+		SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
+	}
+	if hasSvc {
+		base.Service = svc
+	}
+
+	if len(r.SrcAddrs) == 0 && len(r.DstAddrs) == 0 {
+		// Kein Adress-Match → eine Zeile, L3 leer. Die Proto-Render-Logik
+		// im Template setzt icmp/icmpv6 selbst familienkorrekt.
+		return []RuleLeg{base}
+	}
+
+	src4, src6 := splitByFamily(r.SrcAddrs)
+	dst4, dst6 := splitByFamily(r.DstAddrs)
+	svcFam := ""
+	if hasSvc {
+		svcFam = serviceL3(svc)
+	}
+
+	var legs []RuleLeg
+	for _, fam := range []string{"ip", "ip6"} {
+		if svcFam != "" && svcFam != fam {
+			continue // icmp nur auf v4, icmpv6 nur auf v6
+		}
+		srcF, dstF := src4, dst4
+		if fam == "ip6" {
+			srcF, dstF = src6, dst6
+		}
+		// Eine eingeschränkte Seite ohne Mitglied dieser Familie → die
+		// Zeile würde nichts (oder Falsches) matchen → überspringen.
+		if len(r.SrcAddrs) > 0 && len(srcF) == 0 {
+			continue
+		}
+		if len(r.DstAddrs) > 0 && len(dstF) == 0 {
+			continue
+		}
+		leg := base
+		leg.L3 = fam
+		leg.SrcAddrs = srcF
+		leg.DstAddrs = dstF
+		legs = append(legs, leg)
+	}
+	return legs
+}
+
 // addrObjMap is keyed by id; value is the nft expression for that
 // object (e.g. "1.2.3.4", "10.0.0.0/24", "1.2.3.4-1.2.3.10").
 type addrObjMap map[int64]string
@@ -626,6 +824,19 @@ ORDER BY priority DESC, id ASC`)
 		if outZone != nil {
 			r.OutIfaces = zoneIfaces[*outZone]
 		}
+		fam, ok := natFamily(r)
+		if !ok {
+			// Gemischte v4/v6-Adressen → ungültige NAT-Regel. Überspringen
+			// statt das gesamte Ruleset mit `nft -f` zu brechen.
+			slog.Warn("firewall: NAT-Regel mit gemischten v4/v6-Adressen übersprungen", "id", r.ID)
+			continue
+		}
+		r.L3 = fam
+		r.TargetHost = r.TargetAddr
+		if fam == "ip6" && r.TargetAddr != "" && r.TargetPortStart > 0 {
+			// nft braucht [v6]:port für dnat-Targets mit Port.
+			r.TargetHost = "[" + r.TargetAddr + "]"
+		}
 		out = append(out, r)
 	}
 	return out, rows.Err()

internal/firewall/firewall_e2e_test.go

@@ -0,0 +1,132 @@
+package firewall
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+)
+
+// TestE2E_IPv6Render fährt den ECHTEN Generator gegen eine Test-DB:
+// alle Migrations + v4/v6-Seed + RenderToString + nft -c. Nur aktiv, wenn
+// EG_FWTEST_DSN gesetzt ist (sonst Skip — `go test ./...` bleibt DB-frei).
+func TestE2E_IPv6Render(t *testing.T) {
+	dsn := os.Getenv("EG_FWTEST_DSN")
+	if dsn == "" {
+		t.Skip("set EG_FWTEST_DSN to run the firewall end-to-end test")
+	}
+	ctx := context.Background()
+	if err := database.Migrate(ctx, dsn); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer pool.Close()
+
+	for _, tbl := range []string{
+		"firewall_nat_rules", "firewall_rules",
+		"firewall_address_group_members", "firewall_address_groups",
+		"firewall_address_objects", "network_interfaces",
+	} {
+		if _, err := pool.Exec(ctx, "DELETE FROM "+tbl); err != nil {
+			t.Fatalf("clean %s: %v", tbl, err)
+		}
+	}
+
+	mustExec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("seed failed (%s): %v", sql, err)
+		}
+	}
+	insID := func(sql string, args ...any) int64 {
+		t.Helper()
+		var id int64
+		if err := pool.QueryRow(ctx, sql, args...).Scan(&id); err != nil {
+			t.Fatalf("seed-id failed (%s): %v", sql, err)
+		}
+		return id
+	}
+
+	mustExec(`INSERT INTO network_interfaces (name,type,role) VALUES ('eth0','ethernet','wan'),('eth1','ethernet','lan')`)
+
+	v4net := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v4net','network','10.0.0.0/24') RETURNING id`)
+	v6net := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v6net','network','2001:db8:1::/64') RETURNING id`)
+	v6host := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v6host','host','2001:db8:2::5') RETURNING id`)
+	v6range := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v6range','range','2001:db8:3::1-2001:db8:3::9') RETURNING id`)
+
+	// Gemischte Gruppe (v4 + v6) → muss in zwei Familien-Zeilen splitten.
+	grp := insID(`INSERT INTO firewall_address_groups (name) VALUES ('mixed') RETURNING id`)
+	mustExec(`INSERT INTO firewall_address_group_members (group_id,object_id) VALUES ($1,$2),($1,$3)`, grp, v4net, v6net)
+
+	httpsSvc := insID(`INSERT INTO firewall_services (name,proto,port_start,port_end,builtin,description) VALUES ('t-https','tcp',443,443,false,'')
+		ON CONFLICT (name) DO UPDATE SET proto=excluded.proto RETURNING id`)
+	var pingV6 int64
+	_ = pool.QueryRow(ctx, `SELECT id FROM firewall_services WHERE proto='icmpv6' LIMIT 1`).Scan(&pingV6)
+
+	// (1) gemischte Gruppe + tcp443 → je eine ip- und ip6-Zeile.
+	mustExec(`INSERT INTO firewall_rules (name,action,src_zone,src_address_group_id,service_object_id) VALUES ('mixed-https','accept','any',$1,$2)`, grp, httpsSvc)
+	// (2) v6-host + icmpv6 → eine ip6-Zeile.
+	if pingV6 != 0 {
+		mustExec(`INSERT INTO firewall_rules (name,action,src_address_object_id,service_object_id) VALUES ('v6-ping','accept',$1,$2)`, v6host, pingV6)
+	}
+	// (3) v6-range src + v6net dst (kein Service).
+	mustExec(`INSERT INTO firewall_rules (name,action,src_address_object_id,dst_address_object_id) VALUES ('v6-range','drop',$1,$2)`, v6range, v6net)
+
+	// (a) v6-DNAT mit Port → dnat to [..]:port.
+	mustExec(`INSERT INTO firewall_nat_rules (name,kind,proto,match_dst_cidr,match_dport_start,target_addr,target_port_start) VALUES ('v6-dnat','dnat','tcp','2001:db8:9::/64',80,'2001:db8:9::2',8080)`)
+	// (b) v4-DNAT (Regression).
+	mustExec(`INSERT INTO firewall_nat_rules (name,kind,proto,match_dst_cidr,match_dport_start,target_addr,target_port_start) VALUES ('v4-dnat','dnat','tcp','1.2.3.4',80,'10.0.0.5',80)`)
+	// (c) gemischte Familie (v4 src, v6 target) → MUSS übersprungen werden.
+	mustExec(`INSERT INTO firewall_nat_rules (name,kind,proto,match_src_cidr,target_addr) VALUES ('mixed-snat','snat','any','10.0.0.0/24','2001:db8::99')`)
+
+	out, err := New(pool).RenderToString(ctx)
+	if err != nil {
+		t.Fatalf("render: %v", err)
+	}
+
+	for _, w := range []string{
+		"ip saddr { 10.0.0.0/24 }",
+		"ip6 saddr { 2001:db8:1::/64 }",
+		"ip6 nexthdr icmpv6",
+		"ip6 saddr { 2001:db8:3::1-2001:db8:3::9 }",
+		"dnat to [2001:db8:9::2]:8080",
+		"dnat to 10.0.0.5:80",
+	} {
+		if !strings.Contains(out, w) {
+			t.Errorf("rendered output missing %q\n----\n%s", w, out)
+		}
+	}
+	if strings.Contains(out, "2001:db8::99") {
+		t.Errorf("mixed-family NAT rule was not skipped\n----\n%s", out)
+	}
+
+	nft, err := exec.LookPath("nft")
+	if err != nil {
+		t.Skip("nft not in PATH — skipping syntax check")
+	}
+	f, err := os.CreateTemp(t.TempDir(), "e2e-*.nft")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = f.WriteString(out)
+	f.Close()
+	var cmd *exec.Cmd
+	if os.Geteuid() == 0 {
+		cmd = exec.Command(nft, "-c", "-f", f.Name())
+	} else {
+		cmd = exec.Command("sudo", "-n", nft, "-c", "-f", f.Name())
+	}
+	if combined, err := cmd.CombinedOutput(); err != nil {
+		msg := string(combined)
+		if strings.Contains(msg, "Operation not permitted") || strings.Contains(msg, "password is required") {
+			t.Skipf("nft -c needs root (no usable sudo): %s", strings.TrimSpace(msg))
+		}
+		t.Fatalf("nft -c rejected the real-rendered ruleset: %v\n%s\n----\n%s", err, combined, out)
+	}
+}

internal/firewall/firewall_ipv6_test.go

@@ -0,0 +1,183 @@
+package firewall
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+func TestAddrFamily(t *testing.T) {
+	cases := map[string]string{
+		"1.2.3.4":                 "ip",
+		"10.0.0.0/24":             "ip",
+		"1.2.3.4-1.2.3.10":        "ip",
+		"2001:db8::1":             "ip6",
+		"fd00::/64":               "ip6",
+		"2001:db8::1-2001:db8::5": "ip6",
+		"example.com":             "",
+		"":                        "",
+	}
+	for in, want := range cases {
+		if got := addrFamily(in); got != want {
+			t.Errorf("addrFamily(%q)=%q want %q", in, got, want)
+		}
+	}
+}
+
+func TestExpandFamilyLegs_splitsByFamily(t *testing.T) {
+	r := ResolvedRule{
+		ID: 1, Action: "accept",
+		SrcAddrs: []string{"10.0.0.0/24", "fd00::/64"},
+		DstAddrs: []string{"1.2.3.4", "2001:db8::1"},
+	}
+	legs := expandFamilyLegs(r, ResolvedService{}, false)
+	if len(legs) != 2 {
+		t.Fatalf("want 2 legs (v4+v6), got %d", len(legs))
+	}
+	var v4, v6 *RuleLeg
+	for i := range legs {
+		switch legs[i].L3 {
+		case "ip":
+			v4 = &legs[i]
+		case "ip6":
+			v6 = &legs[i]
+		}
+	}
+	if v4 == nil || v6 == nil {
+		t.Fatalf("missing family leg: %+v", legs)
+	}
+	if len(v4.SrcAddrs) != 1 || v4.SrcAddrs[0] != "10.0.0.0/24" || v4.DstAddrs[0] != "1.2.3.4" {
+		t.Errorf("v4 leg wrong: src=%v dst=%v", v4.SrcAddrs, v4.DstAddrs)
+	}
+	if len(v6.SrcAddrs) != 1 || v6.SrcAddrs[0] != "fd00::/64" || v6.DstAddrs[0] != "2001:db8::1" {
+		t.Errorf("v6 leg wrong: src=%v dst=%v", v6.SrcAddrs, v6.DstAddrs)
+	}
+}
+
+func TestExpandFamilyLegs_addresslessIsAgnostic(t *testing.T) {
+	legs := expandFamilyLegs(ResolvedRule{ID: 2, Action: "accept"}, ResolvedService{}, false)
+	if len(legs) != 1 || legs[0].L3 != "" {
+		t.Fatalf("addressless rule must be a single agnostic leg, got %d legs L3=%q", len(legs), legs[0].L3)
+	}
+}
+
+func TestExpandFamilyLegs_oneFamilyOnly(t *testing.T) {
+	// src nur v4, dst nur v4 → genau eine v4-Zeile (kein leerer v6-Leg).
+	r := ResolvedRule{ID: 3, Action: "drop", SrcAddrs: []string{"10.0.0.0/8"}}
+	legs := expandFamilyLegs(r, ResolvedService{}, false)
+	if len(legs) != 1 || legs[0].L3 != "ip" {
+		t.Fatalf("v4-only rule want 1 ip leg, got %+v", legs)
+	}
+}
+
+func TestExpandFamilyLegs_icmpFamilyMatch(t *testing.T) {
+	r6 := ResolvedRule{ID: 4, Action: "accept", SrcAddrs: []string{"fd00::/64"}}
+	if legs := expandFamilyLegs(r6, ResolvedService{Proto: "icmpv6"}, true); len(legs) != 1 || legs[0].L3 != "ip6" {
+		t.Fatalf("icmpv6+v6 want 1 ip6 leg, got %+v", legs)
+	}
+	if legs := expandFamilyLegs(r6, ResolvedService{Proto: "icmp"}, true); len(legs) != 0 {
+		t.Fatalf("icmp on v6-only addrs want 0 legs, got %+v", legs)
+	}
+}
+
+func TestNatFamily(t *testing.T) {
+	if _, ok := natFamily(ResolvedNATRule{SrcCIDR: "10.0.0.0/24", TargetAddr: "2001:db8::1"}); ok {
+		t.Error("mixed v4/v6 NAT must be rejected (ok=false)")
+	}
+	if fam, ok := natFamily(ResolvedNATRule{TargetAddr: "2001:db8::1"}); !ok || fam != "ip6" {
+		t.Errorf("v6 NAT: fam=%q ok=%v want ip6/true", fam, ok)
+	}
+	if fam, ok := natFamily(ResolvedNATRule{SrcCIDR: "10.0.0.0/24"}); !ok || fam != "ip" {
+		t.Errorf("v4 NAT: fam=%q ok=%v want ip/true", fam, ok)
+	}
+	if fam, ok := natFamily(ResolvedNATRule{}); !ok || fam != "ip" {
+		t.Errorf("addressless NAT: fam=%q ok=%v want ip/true (v4 default)", fam, ok)
+	}
+}
+
+// renderView ist ein gemischter v4/v6-View, der alle geänderten
+// Template-Zweige berührt.
+func renderView(t *testing.T) string {
+	t.Helper()
+	view := &View{
+		PeerIPv4: []string{"10.0.0.1"},
+		PeerIPv6: []string{"fd00::1"},
+		Legs: []RuleLeg{
+			{RuleID: 1, Action: "accept", L3: "ip", SrcAddrs: []string{"10.0.0.0/24"}, Service: ResolvedService{Proto: "tcp", PortStart: 443}},
+			{RuleID: 1, Action: "accept", L3: "ip6", SrcAddrs: []string{"fd00::/64"}, Service: ResolvedService{Proto: "tcp", PortStart: 443}},
+			{RuleID: 2, Action: "accept", Service: ResolvedService{Proto: "icmpv6"}}, // adresslos, agnostisch
+		},
+		NATRules: []ResolvedNATRule{
+			{ID: 5, Kind: "dnat", L3: "ip6", DstCIDR: "2001:db8::/64", Proto: "tcp", DPortStart: 80, TargetAddr: "fd00::2", TargetHost: "[fd00::2]", TargetPortStart: 8080},
+			{ID: 6, Kind: "snat", L3: "ip6", SrcCIDR: "fd00::/64", TargetAddr: "2001:db8::99"},
+			{ID: 7, Kind: "dnat", L3: "ip", DstCIDR: "1.2.3.4", Proto: "tcp", DPortStart: 80, TargetAddr: "10.0.0.5", TargetHost: "10.0.0.5", TargetPortStart: 80},
+		},
+		WGSiteMasq: []WGSiteMasqEntry{{Iface: "wg7", VPNNet: "fd00:99::/64", L3: "ip6"}},
+	}
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, view); err != nil {
+		t.Fatalf("template execute: %v", err)
+	}
+	return buf.String()
+}
+
+func TestTemplate_v6AndV4Render(t *testing.T) {
+	out := renderView(t)
+	mustContain := []string{
+		"ip saddr { 10.0.0.0/24 }",       // v4-Regel unverändert
+		"ip6 saddr { fd00::/64 }",        // v6-Regel
+		"ip6 daddr 2001:db8::/64",        // v6-DNAT-Match
+		"dnat to [fd00::2]:8080",         // v6-DNAT-Target geklammert
+		"dnat to 10.0.0.5:80",            // v4-DNAT-Target unverändert
+		"ip6 saddr fd00::/64 snat to 2001:db8::99",
+		`oifname "wg7" ip6 saddr fd00:99::/64 masquerade`,
+	}
+	for _, w := range mustContain {
+		if !strings.Contains(out, w) {
+			t.Errorf("output missing %q\n----\n%s", w, out)
+		}
+	}
+	// v6-Adressen dürfen NIEMALS in einem ip-saddr/daddr-Set landen.
+	if strings.Contains(out, "ip saddr { fd00") || strings.Contains(out, "ip daddr { fd00") ||
+		strings.Contains(out, "ip saddr { 2001") {
+		t.Errorf("v6 address leaked into IPv4 match\n----\n%s", out)
+	}
+}
+
+// TestTemplate_nftSyntax validiert das gerenderte Ruleset mit `nft -c -f`
+// (Check-Modus, kein Apply). Wird übersprungen, wenn nft nicht installiert
+// ist (z.B. CI ohne nft).
+func TestTemplate_nftSyntax(t *testing.T) {
+	nft, err := exec.LookPath("nft")
+	if err != nil {
+		t.Skip("nft binary not available — skipping syntax check")
+	}
+	out := renderView(t)
+	f, err := os.CreateTemp(t.TempDir(), "ruleset-*.nft")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := f.WriteString(out); err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+	// `nft -c` liest die Kernel-Ruleset-Cache via netlink → braucht root.
+	// Als nicht-root via sudo -n versuchen; klappt das nicht, skip statt fail
+	// (auf den Nodes rendert/prüft edgeguard ohnehin als root).
+	var cmd *exec.Cmd
+	if os.Geteuid() == 0 {
+		cmd = exec.Command(nft, "-c", "-f", f.Name())
+	} else {
+		cmd = exec.Command("sudo", "-n", nft, "-c", "-f", f.Name())
+	}
+	combined, err := cmd.CombinedOutput()
+	if err != nil {
+		msg := string(combined)
+		if strings.Contains(msg, "Operation not permitted") || strings.Contains(msg, "a password is required") || strings.Contains(msg, "may not run sudo") {
+			t.Skipf("nft -c needs root (no usable sudo): %s", strings.TrimSpace(msg))
+		}
+		t.Fatalf("nft -c -f rejected the generated ruleset: %v\n%s\n----\n%s", err, combined, out)
+	}
+}

internal/firewall/ruleset.nft.tpl

@@ -3,7 +3,8 @@
 # Source: internal/firewall/firewall.go.
 # Re-generate via `edgeguard-ctl render-config` or via API mutations.
 
-flush ruleset
+add table inet edgeguard
+flush table inet edgeguard
 
 table inet edgeguard {
     set peer_ipv4 {
@@ -29,6 +30,9 @@ table inet edgeguard {
         # erreichbar.
         tcp dport 22   ct state new limit rate 10/minute accept comment "anti-lockout: SSH (rate-limited)"
         tcp dport 443  accept comment "anti-lockout: HAProxy public HTTPS"
+        # HTTP/3 läuft als QUIC über UDP/443. HAProxy bindet quic4@:443
+        # parallel zum TCP-Listener; ohne diese Regel droppt der policy.
+        udp dport 443  accept comment "anti-lockout: HAProxy HTTP/3 (QUIC)"
         tcp dport 3443 accept comment "anti-lockout: Management-UI (HAProxy admin HTTPS)"
 
         # Stateful baseline
@@ -46,6 +50,11 @@ table inet edgeguard {
         # Cluster-internal: peers reach edgeguard-api over mTLS on :8443
         tcp dport 8443 ip  saddr @peer_ipv4 accept
         tcp dport 8443 ip6 saddr @peer_ipv6 accept
+        # Cluster-internal: PG Logical Replication (:5432) + KeyDB Active-Active (:6379)
+        tcp dport 5432 ip  saddr @peer_ipv4 accept
+        tcp dport 5432 ip6 saddr @peer_ipv6 accept
+        tcp dport 6379 ip  saddr @peer_ipv4 accept
+        tcp dport 6379 ip6 saddr @peer_ipv6 accept
 
         # ── Service-Auto-Rules (DNS/Squid/WG/...) ──
         # Aus dem laufenden Service-State abgeleitet — Operator
@@ -62,7 +71,7 @@ table inet edgeguard {
                  die Comment-Zeile angehängt — sonst frisst nft die rule
                  als Teil des # Kommentars). */ -}}
         {{""}}
-        {{if .SrcIfaces}}iifname { {{join .SrcIfaces ", "}} } {{end}}{{if .DstIfaces}}oifname { {{join .DstIfaces ", "}} } {{end}}{{if .SrcAddrs}}ip saddr { {{join .SrcAddrs ", "}} } {{end}}{{if .DstAddrs}}ip daddr { {{join .DstAddrs ", "}} } {{end}}{{with .Service}}{{if and (or (eq .Proto "tcp") (eq .Proto "udp")) .PortStart}}{{.Proto}} dport {{.PortStart}}{{if and .PortEnd (ne .PortEnd .PortStart)}}-{{.PortEnd}}{{end}} {{else if eq .Proto "icmp"}}ip protocol icmp {{else if eq .Proto "icmpv6"}}ip6 nexthdr icmpv6 {{end}}{{end}}{{if .Log}}log prefix "edgeguard:{{.RuleID}} " group 0 {{end}}{{.Action}}
+        {{if .SrcIfaces}}iifname { {{join .SrcIfaces ", "}} } {{end}}{{if .DstIfaces}}oifname { {{join .DstIfaces ", "}} } {{end}}{{if .SrcAddrs}}{{.L3}} saddr { {{join .SrcAddrs ", "}} } {{end}}{{if .DstAddrs}}{{.L3}} daddr { {{join .DstAddrs ", "}} } {{end}}{{with .Service}}{{if and (or (eq .Proto "tcp") (eq .Proto "udp")) .PortStart}}{{.Proto}} dport {{.PortStart}}{{if and .PortEnd (ne .PortEnd .PortStart)}}-{{.PortEnd}}{{end}} {{else if eq .Proto "icmp"}}ip protocol icmp {{else if eq .Proto "icmpv6"}}ip6 nexthdr icmpv6 {{end}}{{end}}{{if .Log}}log prefix "edgeguard:{{.RuleID}} " group 0 {{end}}counter {{.Action}} comment "egid:{{.RuleID}}"
 {{end}}
 
         # ── DEFAULT-DROP LOGGING ───────────────────────────────────────
@@ -92,9 +101,18 @@ table inet edgeguard {
         # nach und erlauben new-state-Pakete von dort. Return-Pakete
         # gehen via ct state established schon durch.
 {{range .NATRules}}{{if or (eq .Kind "snat") (eq .Kind "masquerade")}}{{if .SrcCIDR}}
-        ip saddr {{.SrcCIDR}} ct state new accept comment "auto-forward for NAT rule {{.ID}}"
+        {{.L3}} saddr {{.SrcCIDR}} ct state new accept comment "auto-forward for NAT rule {{.ID}}"
 {{end}}{{end}}{{end}}
 
+        # Auto-Forward für WireGuard-Server-Interfaces: Peer-to-Peer-
+        # Traffic (Peer A → Peer B, beide via dasselbe wg-Interface)
+        # muss durch die Box forwarded werden. Ohne diese Regel droppt
+        # policy=drop den Traffic, auch wenn WG ihn korrekt entschlüsselt.
+        # Return-Pakete gehen bereits via ct state established durch.
+{{range .WGServerIfaces}}
+        iifname "{{.}}" accept comment "auto: WireGuard peer-forward {{.}}"
+{{end}}
+
         # Default-Drop-Logging (limit-rated, siehe input-chain).
         limit rate 10/second log prefix "edgeguard:drop-forward " group 0
     }
@@ -110,7 +128,7 @@ table inet edgeguard {
         {{""}}
         {{/* nft-Syntax: erst L3-match (ip saddr/daddr), DANN L4 (tcp/udp dport).
              Sonst quittiert der parser '... unexpected ip' an dieser Stelle. */}}
-        {{if .InIfaces}}iifname { {{join .InIfaces ", "}} } {{end}}{{if .SrcCIDR}}ip saddr {{.SrcCIDR}} {{end}}{{if .DstCIDR}}ip daddr {{.DstCIDR}} {{end}}{{if and .Proto (ne .Proto "any")}}{{.Proto}} {{else}}meta l4proto { tcp, udp } {{end}}{{if .DPortStart}}dport {{.DPortStart}}{{if and .DPortEnd (ne .DPortEnd .DPortStart)}}-{{.DPortEnd}}{{end}} {{end}}{{if .TargetAddr}}dnat to {{.TargetAddr}}{{if .TargetPortStart}}:{{.TargetPortStart}}{{if and .TargetPortEnd (ne .TargetPortEnd .TargetPortStart)}}-{{.TargetPortEnd}}{{end}}{{end}}{{end}}
+        {{if .InIfaces}}iifname { {{join .InIfaces ", "}} } {{end}}{{if .SrcCIDR}}{{.L3}} saddr {{.SrcCIDR}} {{end}}{{if .DstCIDR}}{{.L3}} daddr {{.DstCIDR}} {{end}}{{if and .Proto (ne .Proto "any")}}{{.Proto}} {{else}}meta l4proto { tcp, udp } {{end}}{{if .DPortStart}}dport {{.DPortStart}}{{if and .DPortEnd (ne .DPortEnd .DPortStart)}}-{{.DPortEnd}}{{end}} {{end}}{{if .TargetAddr}}dnat to {{.TargetHost}}{{if .TargetPortStart}}:{{.TargetPortStart}}{{if and .TargetPortEnd (ne .TargetPortEnd .TargetPortStart)}}-{{.TargetPortEnd}}{{end}}{{end}}{{end}}
 {{end}}{{end}}
     }
 
@@ -126,14 +144,24 @@ table inet edgeguard {
         # client-IP (für Logging / Geo-Block: später optional via
         # NAT-Rule-Flag preserve_client_ip).
         ct status dnat masquerade
+
+        # Auto-Masquerade für WireGuard site-to-site: VPN-Clients (z. B. Roadwarrior
+        # mit 192.168.99.3) greifen auf LANs hinter anderen Peers zu (z. B. 10.0.10.0/24).
+        # Das entfernte Gateway (z. B. Unify Home) sieht als Return-Destination die
+        # VPN-Client-IP — die es nicht in seiner Routing-Table hat → Reply wird gedroppt.
+        # Masquerade schreibt die Source auf die lokale Tunnel-IP um; Return-Traffic
+        # findet so den Weg zurück durch den Tunnel.
+{{range .WGSiteMasq}}
+        oifname "{{.Iface}}" {{.L3}} saddr {{.VPNNet}} masquerade comment "auto: WireGuard site-to-site masquerade {{.Iface}}"
+{{end}}
 {{range .NATRules}}{{if eq .Kind "snat"}}
         # NAT {{.ID}} (snat{{if .Comment}} — {{.Comment}}{{end}})
         {{""}}
-        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}ip saddr {{.SrcCIDR}} {{end}}{{if .TargetAddr}}snat to {{.TargetAddr}}{{end}}
+        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}{{.L3}} saddr {{.SrcCIDR}} {{end}}{{if .TargetAddr}}snat to {{.TargetAddr}}{{end}}
 {{end}}{{if eq .Kind "masquerade"}}
         # NAT {{.ID}} (masquerade{{if .Comment}} — {{.Comment}}{{end}})
         {{""}}
-        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}ip saddr {{.SrcCIDR}} {{end}}masquerade
+        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}{{.L3}} saddr {{.SrcCIDR}} {{end}}masquerade
 {{end}}{{end}}
     }
 }

internal/handlers/audit.go

@@ -22,9 +22,47 @@ func NewAuditHandler(repo *audit.Repo) *AuditHandler { return &AuditHandler{Repo
 func (h *AuditHandler) Register(rg *gin.RouterGroup) {
 	g := rg.Group("/audit")
 	g.GET("/recent", h.Recent)
+	g.GET("/search", h.Search)
 	g.GET("/live", h.Live)
 }
 
+// Search filtert audit_log nach Actor/Action/Subject/Date-Range.
+// Query-Params: actor, action, subject (alle ILIKE-Substring),
+// since/until (RFC3339), limit (max 500), offset.
+func (h *AuditHandler) Search(c *gin.Context) {
+	f := audit.SearchFilter{
+		Actor:   c.Query("actor"),
+		Action:  c.Query("action"),
+		Subject: c.Query("subject"),
+	}
+	if s := c.Query("since"); s != "" {
+		if t, err := time.Parse(time.RFC3339, s); err == nil {
+			f.Since = &t
+		}
+	}
+	if s := c.Query("until"); s != "" {
+		if t, err := time.Parse(time.RFC3339, s); err == nil {
+			f.Until = &t
+		}
+	}
+	if v := c.Query("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			f.Limit = n
+		}
+	}
+	if v := c.Query("offset"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil {
+			f.Offset = n
+		}
+	}
+	rows, err := h.Repo.Search(c.Request.Context(), f)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"entries": rows, "limit": f.Limit, "offset": f.Offset})
+}
+
 // Recent returns the most recent audit_log entries — used by the
 // dashboard fallback path (z.B. wenn WebSocket nicht verbinden kann).
 // ?limit=N (1–100, default 10).

internal/handlers/auth.go

@@ -1,38 +1,81 @@
 package handlers
 
 import (
+	"bytes"
+	"context"
+	"encoding/json"
 	"errors"
+	"io"
+	"log/slog"
 	"net/http"
 	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
 
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/session"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
+	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-// AuthHandler exposes login / me / logout. v1 verifies against the
-// setup-store (single admin); admin_users-table support comes when the
-// users repo lands.
+// AuthHandler exposes login / me / logout.
+// Login checks the DB users table first; falls back to the setup-store
+// admin for backwards compatibility. On a successful setup-store login
+// the account is auto-migrated into the DB (Upsert) so it shows up in
+// user management from that point on.
 type AuthHandler struct {
-	Setup  *setup.Store
-	Signer *session.Signer
+	Setup      *setup.Store
+	Signer     *session.Signer
+	Audit      *audit.Repo
+	NodeID     string
+	Users      *usersvc.Repo     // optional — nil on first boot before DB is ready
+	ClusterTLS *clustertls.Store // optional — enables auth federation on cluster nodes
 }
 
 func NewAuthHandler(s *setup.Store, sig *session.Signer) *AuthHandler {
 	return &AuthHandler{Setup: s, Signer: sig}
 }
 
+// WithAudit: Audit-Repo + NodeID damit Password-Operationen (change,
+// reset, login-success/fail) ins audit_log fließen.
+func (h *AuthHandler) WithAudit(a *audit.Repo, nodeID string) *AuthHandler {
+	h.Audit = a
+	h.NodeID = nodeID
+	return h
+}
+
+// WithUsers injects the users repo so Login can verify against the DB.
+func (h *AuthHandler) WithUsers(u *usersvc.Repo) *AuthHandler {
+	h.Users = u
+	return h
+}
+
+// WithClusterTLS enables auth federation: when local auth fails on a
+// cluster node, Login tries the primary via mTLS /agent/auth/check.
+func (h *AuthHandler) WithClusterTLS(store *clustertls.Store) *AuthHandler {
+	h.ClusterTLS = store
+	return h
+}
+
+const totpPendingCookie = "edgeguard_totp_pending"
+
 // Register mounts /auth/login + /logout (public) and /auth/me
 // (gated by requireAuth, passed in as a per-route middleware).
 func (h *AuthHandler) Register(rg *gin.RouterGroup, requireAuth gin.HandlerFunc) {
 	g := rg.Group("/auth")
 	g.POST("/login", h.Login)
 	g.POST("/logout", h.Logout)
+	g.POST("/totp-verify", h.TOTPVerify)
 	g.GET("/me", requireAuth, h.Me)
 	g.POST("/reset-password", h.ResetPassword)
+	g.POST("/change-password", requireAuth, h.ChangePassword)
+	// TOTP self-service (authenticated user manages own 2FA)
+	g.POST("/totp/setup", requireAuth, h.TOTPSetup)
+	g.POST("/totp/confirm", requireAuth, h.TOTPConfirm)
+	g.DELETE("/totp", requireAuth, h.TOTPDisable)
 }
 
 type loginRequest struct {
@@ -41,9 +84,10 @@ type loginRequest struct {
 }
 
 type loginResponse struct {
-	Actor     string    `json:"actor"`
-	Role      string    `json:"role"`
-	ExpiresAt time.Time `json:"expires_at"`
+	Actor        string    `json:"actor"`
+	Role         string    `json:"role"`
+	ExpiresAt    time.Time `json:"expires_at"`
+	TOTPRequired bool      `json:"totp_required,omitempty"`
 }
 
 func (h *AuthHandler) Login(c *gin.Context) {
@@ -61,19 +105,95 @@ func (h *AuthHandler) Login(c *gin.Context) {
 		response.Err(c, http.StatusServiceUnavailable, errors.New("setup_required"))
 		return
 	}
-	if !strings.EqualFold(st.AdminEmail, strings.TrimSpace(req.Email)) ||
-		!st.VerifyAdminPassword(req.Password) {
+
+	email := strings.TrimSpace(req.Email)
+	actor, role := "", "admin"
+	remote := c.ClientIP()
+	var totpEnabled bool
+
+	// 1. Try DB users table first.
+	if h.Users != nil {
+		ai, dbErr := h.Users.FindForAuth(c.Request.Context(), email)
+		if dbErr == nil {
+			if !ai.Active {
+				if h.Audit != nil {
+					_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
+						email, gin.H{"reason": "account_disabled", "remote": remote}, h.NodeID)
+				}
+				response.Unauthorized(c, errors.New("account_disabled"))
+				return
+			}
+			if !usersvc.VerifyPassword(ai.PasswordHash, req.Password) {
+				if h.Audit != nil {
+					_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
+						email, gin.H{"reason": "invalid_credentials", "remote": remote}, h.NodeID)
+				}
+				response.Unauthorized(c, errors.New("invalid_credentials"))
+				return
+			}
+			actor = ai.Email
+			role = ai.Role
+			totpEnabled = ai.TOTPEnabled
+			h.Users.RecordLogin(c.Request.Context(), ai.ID)
+		}
+	}
+
+	// 2. Fallback: setup-store admin (backwards compat for pre-DB installs).
+	if actor == "" && st.AdminEmail != "" {
+		if strings.EqualFold(st.AdminEmail, email) && st.VerifyAdminPassword(req.Password) {
+			actor = st.AdminEmail
+			role = "admin"
+			if h.Users != nil {
+				_, _ = h.Users.Upsert(c.Request.Context(), st.AdminEmail, req.Password, "admin", true)
+			}
+		}
+	}
+
+	// 3. Auth federation: cluster nodes forward failed auth to the primary.
+	if actor == "" && st.IsClusterNode && st.PrimaryFQDN != "" && h.ClusterTLS != nil {
+		if a, r, err := h.checkWithPrimary(c.Request.Context(), st.PrimaryFQDN, email, req.Password); err == nil {
+			actor = a
+			role = r
+		} else {
+			slog.Debug("auth: primary auth check failed", "primary", st.PrimaryFQDN, "error", err)
+		}
+	}
+
+	if actor == "" {
+		if h.Audit != nil {
+			_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
+				email, gin.H{"reason": "invalid_credentials", "remote": remote}, h.NodeID)
+		}
 		response.Unauthorized(c, errors.New("invalid_credentials"))
 		return
 	}
 
-	raw, tok, err := h.Signer.IssueWithRole(st.AdminEmail, "admin")
+	// TOTP gate: password OK but 2FA required → issue a short-lived pending
+	// cookie and tell the UI to show the TOTP input.
+	if totpEnabled {
+		pending, ptok, err := h.Signer.IssueWithRoleTTL(actor, "totp_pending", 2*time.Minute)
+		if err != nil {
+			response.Internal(c, err)
+			return
+		}
+		c.SetSameSite(http.SameSiteStrictMode)
+		c.SetCookie(totpPendingCookie, pending, int(2*time.Minute/time.Second), "/", "", true, true)
+		_ = ptok
+		response.OK(c, loginResponse{TOTPRequired: true})
+		return
+	}
+
+	raw, tok, err := h.Signer.IssueWithRole(actor, role)
 	if err != nil {
 		response.Internal(c, err)
 		return
 	}
 	setSessionCookie(c, raw, tok.Exp)
 
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actor, "auth.login.success",
+			actor, gin.H{"role": role, "remote": remote}, h.NodeID)
+	}
 	response.OK(c, loginResponse{
 		Actor:     tok.Actor,
 		Role:      tok.Role,
@@ -81,6 +201,146 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	})
 }
 
+type totpVerifyRequest struct {
+	Code string `json:"code" binding:"required"`
+}
+
+// TOTPVerify completes the two-step login: verifies the TOTP code from the
+// pending cookie and, on success, issues a full session JWT.
+func (h *AuthHandler) TOTPVerify(c *gin.Context) {
+	var req totpVerifyRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	pendingRaw, err := c.Cookie(totpPendingCookie)
+	if err != nil || pendingRaw == "" {
+		response.Unauthorized(c, errors.New("no_pending_totp"))
+		return
+	}
+	ptok, err := h.Signer.Verify(pendingRaw)
+	if err != nil || ptok.Role != "totp_pending" {
+		response.Unauthorized(c, errors.New("invalid_pending_token"))
+		return
+	}
+
+	if h.Users == nil {
+		response.Internal(c, errors.New("users repo unavailable"))
+		return
+	}
+	ai, err := h.Users.FindForAuth(c.Request.Context(), ptok.Actor)
+	if err != nil || !ai.TOTPEnabled || ai.TOTPSecret == nil {
+		response.Unauthorized(c, errors.New("totp_not_configured"))
+		return
+	}
+	if !usersvc.VerifyTOTP(*ai.TOTPSecret, req.Code) {
+		if h.Audit != nil {
+			_ = h.Audit.Log(c.Request.Context(), ptok.Actor, "auth.totp.failed",
+				ptok.Actor, gin.H{"remote": c.ClientIP()}, h.NodeID)
+		}
+		response.Unauthorized(c, errors.New("invalid_totp_code"))
+		return
+	}
+
+	// Clear pending cookie, issue full session.
+	c.SetSameSite(http.SameSiteStrictMode)
+	c.SetCookie(totpPendingCookie, "", -1, "/", "", true, true)
+
+	raw, tok, err := h.Signer.IssueWithRole(ptok.Actor, ai.Role)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	setSessionCookie(c, raw, tok.Exp)
+
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), ptok.Actor, "auth.login.success",
+			ptok.Actor, gin.H{"role": ai.Role, "remote": c.ClientIP(), "totp": true}, h.NodeID)
+	}
+	response.OK(c, loginResponse{
+		Actor:     tok.Actor,
+		Role:      tok.Role,
+		ExpiresAt: time.Unix(tok.Exp, 0).UTC(),
+	})
+}
+
+// TOTPSetup generates a new TOTP secret for the authenticated user and returns
+// the provisioning URI (renders as QR code in the UI). Secret is not saved yet.
+func (h *AuthHandler) TOTPSetup(c *gin.Context) {
+	tok := CurrentToken(c)
+	if tok == nil {
+		response.Unauthorized(c, nil)
+		return
+	}
+	secret, uri, err := usersvc.GenerateTOTPSecret(tok.Actor)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"secret": secret, "uri": uri})
+}
+
+type totpConfirmRequest struct {
+	Secret string `json:"secret" binding:"required"`
+	Code   string `json:"code"   binding:"required"`
+}
+
+// TOTPConfirm verifies the code against the provisioned secret and, on success,
+// enables TOTP for the user.
+func (h *AuthHandler) TOTPConfirm(c *gin.Context) {
+	var req totpConfirmRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	tok := CurrentToken(c)
+	if tok == nil || h.Users == nil {
+		response.Unauthorized(c, nil)
+		return
+	}
+	u, _, err := h.Users.FindByEmail(c.Request.Context(), tok.Actor)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if err := h.Users.ConfirmTOTP(c.Request.Context(), u.ID, req.Secret, req.Code); err != nil {
+		if err.Error() == "invalid_totp_code" {
+			response.Err(c, http.StatusUnprocessableEntity, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), tok.Actor, "auth.totp.enabled",
+			tok.Actor, nil, h.NodeID)
+	}
+	response.OK(c, gin.H{"ok": true})
+}
+
+// TOTPDisable disables TOTP for the authenticated user.
+func (h *AuthHandler) TOTPDisable(c *gin.Context) {
+	tok := CurrentToken(c)
+	if tok == nil || h.Users == nil {
+		response.Unauthorized(c, nil)
+		return
+	}
+	u, _, err := h.Users.FindByEmail(c.Request.Context(), tok.Actor)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if err := h.Users.DisableTOTP(c.Request.Context(), u.ID); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), tok.Actor, "auth.totp.disabled",
+			tok.Actor, nil, h.NodeID)
+	}
+	response.OK(c, gin.H{"ok": true})
+}
+
 func (h *AuthHandler) Logout(c *gin.Context) {
 	clearSessionCookie(c)
 	response.OK(c, gin.H{"logged_out": true})
@@ -122,9 +382,134 @@ func (h *AuthHandler) ResetPassword(c *gin.Context) {
 		response.BadRequest(c, err)
 		return
 	}
+	if h.Audit != nil {
+		// ResetPassword: keine Session, deshalb "self-reset" als Actor
+		// damit der Audit-Trail zeigt dass es kein admin-mediated Reset war.
+		_ = h.Audit.Log(c.Request.Context(), "self-reset", "auth.password.reset",
+			"", gin.H{"remote": c.ClientIP()}, h.NodeID)
+	}
 	response.OK(c, gin.H{"ok": true})
 }
 
+type changePasswordRequest struct {
+	CurrentPassword string `json:"current_password" binding:"required"`
+	NewPassword     string `json:"new_password"     binding:"required,min=12"`
+}
+
+// ChangePassword: authenticated User wechselt sein eigenes Passwort.
+// Anders als ResetPassword (CLI-Token-Flow für vergessenes Passwort)
+// braucht das hier das current_password als Confirmation — verhindert
+// dass eine kompromittierte Session den Account übernimmt ohne dass
+// das alte Passwort bekannt ist.
+//
+// Lookup-Reihenfolge: 1) DB users-Tabelle (alle multi-user-Accounts),
+// 2) setup-store Admin-Fallback (Legacy / pre-DB). Beim Setup-Admin
+// werden beide Stores synchron gehalten.
+func (h *AuthHandler) ChangePassword(c *gin.Context) {
+	var req changePasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+
+	tok := CurrentToken(c)
+	if tok == nil {
+		response.Unauthorized(c, nil)
+		return
+	}
+
+	// 1. DB-backed user (alle via User-Management erstellten Accounts).
+	if h.Users != nil {
+		u, hash, dbErr := h.Users.FindByEmail(c.Request.Context(), tok.Actor)
+		if dbErr == nil {
+			if !usersvc.VerifyPassword(hash, req.CurrentPassword) {
+				response.Unauthorized(c, errors.New("invalid_current_password"))
+				return
+			}
+			if err := h.Users.SetPassword(c.Request.Context(), u.ID, req.NewPassword); err != nil {
+				response.Internal(c, err)
+				return
+			}
+			// Setup-Store-Admin synchron halten, falls gleiche E-Mail.
+			if st, _ := h.Setup.Load(); st != nil && strings.EqualFold(st.AdminEmail, tok.Actor) {
+				_ = h.Setup.SetAdminPassword(req.NewPassword)
+			}
+			if h.Audit != nil {
+				_ = h.Audit.Log(c.Request.Context(), actorOf(c), "auth.password.change",
+					tok.Actor, gin.H{"actor": actorOf(c)}, h.NodeID)
+			}
+			response.OK(c, gin.H{"ok": true})
+			return
+		}
+	}
+
+	// 2. Fallback: setup-store Admin (vor DB-Migration oder nicht migriert).
+	st, err := h.Setup.Load()
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if st == nil || !st.Completed {
+		response.Err(c, http.StatusServiceUnavailable, errors.New("setup_required"))
+		return
+	}
+	if !st.VerifyAdminPassword(req.CurrentPassword) {
+		response.Unauthorized(c, errors.New("invalid_current_password"))
+		return
+	}
+	if err := h.Setup.SetAdminPassword(req.NewPassword); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actorOf(c), "auth.password.change",
+			st.AdminEmail, gin.H{"actor": actorOf(c)}, h.NodeID)
+	}
+	response.OK(c, gin.H{"ok": true})
+}
+
+// checkWithPrimary verifies credentials against the primary node via mTLS.
+// Returns actor+role on success, error on failure.
+func (h *AuthHandler) checkWithPrimary(ctx context.Context, primaryFQDN, email, password string) (string, string, error) {
+	clientTLS, err := h.ClusterTLS.ClientTLSConfig()
+	if err != nil {
+		return "", "", err
+	}
+	tr := &http.Transport{TLSClientConfig: clientTLS, TLSHandshakeTimeout: 5 * time.Second}
+	client := &http.Client{Transport: tr, Timeout: 8 * time.Second}
+
+	body, _ := json.Marshal(map[string]string{"email": email, "password": password})
+	reqURL := "https://" + primaryFQDN + ":8443/agent/auth/check"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, reqURL, bytes.NewReader(body))
+	if err != nil {
+		return "", "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", "", err
+	}
+	defer resp.Body.Close()
+	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
+	if resp.StatusCode != http.StatusOK {
+		return "", "", errors.New("primary: " + strings.TrimSpace(string(raw)))
+	}
+	var env struct {
+		Data struct {
+			Actor string `json:"actor"`
+			Role  string `json:"role"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(raw, &env); err != nil {
+		return "", "", err
+	}
+	if env.Data.Actor == "" {
+		return "", "", errors.New("primary returned empty actor")
+	}
+	return env.Data.Actor, env.Data.Role, nil
+}
+
 func setSessionCookie(c *gin.Context, raw string, expUnix int64) {
 	maxAge := int(time.Until(time.Unix(expUnix, 0)).Seconds())
 	if maxAge < 0 {

internal/handlers/backends.go

@@ -117,6 +117,10 @@ func (h *BackendsHandler) Delete(c *gin.Context) {
 			response.NotFound(c, err)
 			return
 		}
+		if errors.Is(err, backends.ErrInUse) {
+			response.Conflict(c, err)
+			return
+		}
 		response.Internal(c, err)
 		return
 	}

internal/handlers/cluster.go

@@ -2,32 +2,346 @@ package handlers
 
 import (
 	"context"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
 	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
 
+	"git.netcell-it.de/projekte/edgeguard-native/internal/aggregator"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/jointoken"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
 )
 
-// ClusterHandler exposes cluster-state endpoints. v1 ist read-only;
-// /status liefert eine strukturierte UI-Sicht (local + peers + health),
-// /nodes bleibt als simpler list-endpoint für Tools/Scripts.
+// ClusterHandler exposes cluster-state endpoints. /status ist die
+// strukturierte UI-Sicht (local + peers + health), /nodes ist die
+// simple list, /system/load fan-outet via mTLS-Aggregator zu allen
+// Peers und liefert pro Node die /proc-Metriken.
+//
+// Aggregator kann nil sein (clustertls nicht initialisiert) — dann
+// liefert /cluster/system/load nur den lokalen Wert.
 type ClusterHandler struct {
-	Store   *cluster.Store
-	LocalID string
+	Store      *cluster.Store
+	LocalID    string
+	Aggregator *aggregator.Aggregator
+	Version    string // laufende Binary-Version, für Rolling-Update-Koordination
+
+	// TLSStore + Tokens: optional, gesetzt bei Phase 3.4. Erlauben das
+	// Generieren von Join-Tokens und das Issue-Cert für joining Peers.
+	TLSStore *clustertls.Store
+	Tokens   *jointoken.Service
+
+	// PeerReloader: optional, gesetzt bei Phase 3.5. Nach Auto-Register
+	// triggert das den firewall-Render damit peer_ipv4 frisch ist.
+	PeerReloader PeerReloader
+
+	// Audit + NodeID: optional, gesetzt via WithAudit. Nötig für
+	// protokollierte, mutierende Aktionen wie den Replication-Repair.
+	Audit  *audit.Repo
+	NodeID string
 }
 
 func NewClusterHandler(store *cluster.Store, localID string) *ClusterHandler {
 	return &ClusterHandler{Store: store, LocalID: localID}
 }
 
+// WithAggregator: optionale Aggregator-Konfiguration. Nur wenn vorhanden
+// wird /cluster/system/load die Peers via mTLS abklappern.
+func (h *ClusterHandler) WithAggregator(a *aggregator.Aggregator) *ClusterHandler {
+	h.Aggregator = a
+	return h
+}
+
+// WithJoinFlow: Cluster-CA + Join-Token-Service. Nur wenn beide gesetzt
+// sind exposen wir /cluster/join-tokens (admin) + /cluster/issue-cert (public).
+func (h *ClusterHandler) WithJoinFlow(store *clustertls.Store, tokens *jointoken.Service) *ClusterHandler {
+	h.TLSStore = store
+	h.Tokens = tokens
+	return h
+}
+
+// WithAudit setzt den Audit-Repo + NodeID für protokollierte Aktionen.
+func (h *ClusterHandler) WithAudit(a *audit.Repo, nodeID string) *ClusterHandler {
+	h.Audit = a
+	h.NodeID = nodeID
+	return h
+}
+
 func (h *ClusterHandler) Register(rg *gin.RouterGroup) {
 	g := rg.Group("/cluster")
 	g.GET("/nodes", h.ListNodes)
 	g.GET("/status", h.Status)
+	g.GET("/system/load", h.SystemLoad)
+	g.DELETE("/nodes/:id", h.DeleteNode)
+	g.GET("/vip-settings", h.GetVIPSettings)
+	g.PUT("/vip-settings", h.UpdateVIPSettings)
+	g.POST("/rolling-update", h.RollingUpdate)
+	g.GET("/rolling-update/status", h.RollingUpdateStatus)
+	g.POST("/repair-replication", h.RepairReplication)
+	g.GET("/repair-replication/status", h.RepairReplicationStatus)
+	g.GET("/vip-status", h.VIPStatus)
+	g.POST("/vip-test", h.VIPTest)
+	if h.TLSStore != nil {
+		g.GET("/cert-status", h.CertStatus)
+		g.POST("/renew-self", h.RenewSelf)
+	}
+	if h.TLSStore != nil && h.Tokens != nil {
+		g.POST("/join-tokens", h.GenerateJoinToken)
+	}
+}
+
+// DeleteNode entfernt einen Peer aus ha_nodes. Verweigert für die
+// lokale Node (LocalID) — die kannst du nicht via UI löschen, sonst
+// kommt der nächste Heartbeat-Tick die Row wieder anlegen oder
+// die Cluster-Page wird inkonsistent.
+//
+// Nach erfolgreichem Delete triggert der PeerReloader (falls gesetzt)
+// einen Firewall-Render — peer_ipv4-Set verliert die IP, der entfernte
+// Peer kann nicht mehr auf :8443/:16379 connecten.
+func (h *ClusterHandler) DeleteNode(c *gin.Context) {
+	id := c.Param("id")
+	if id == "" {
+		response.BadRequest(c, simpleError("missing id"))
+		return
+	}
+	if id == h.LocalID {
+		response.BadRequest(c, simpleError("cannot remove the local node — would auto-recreate on next heartbeat"))
+		return
+	}
+	if err := h.Store.Delete(c.Request.Context(), id); err != nil {
+		if err == cluster.ErrNotFound {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	if h.PeerReloader != nil {
+		go func() {
+			rctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			if err := h.PeerReloader(rctx); err != nil {
+				slog.Warn("cluster: firewall render after peer delete failed", "error", err)
+			}
+		}()
+	}
+	slog.Info("cluster: peer removed", "id", id, "actor", actorOf(c))
+	response.NoContent(c)
+}
+
+// GetVIPSettings liest die cluster_settings-Singleton-Row (VIP/VRRP-Config).
+func (h *ClusterHandler) GetVIPSettings(c *gin.Context) {
+	if h.Store == nil {
+		response.NotFound(c, simpleError("cluster store not available"))
+		return
+	}
+	var cs vipSettingsRow
+	row := h.Store.Pool.QueryRow(c.Request.Context(), `
+		SELECT vip_address, vip_interface, vip_auth_pass, vrrp_router_id,
+		       hb_interface, hb_src_ip, hb_peer_ip, hb_router_id, gw_check_ip
+		FROM cluster_settings WHERE id = 1`)
+	if err := row.Scan(&cs.VIPAddress, &cs.VIPInterface, &cs.VIPAuthPass, &cs.VRRPRouterID,
+		&cs.HBInterface, &cs.HBSrcIP, &cs.HBPeerIP, &cs.HBRouterID, &cs.GWCheckIP); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, cs)
+}
+
+// UpdateVIPSettings speichert die VIP/VRRP-Konfiguration und triggert
+// einen Keepalived-Config-Render. Viewer-Schutz via RequireAdminForMutations-
+// Middleware auf der authed-Group — kein Extra-Check nötig.
+func (h *ClusterHandler) UpdateVIPSettings(c *gin.Context) {
+	var req vipSettingsRow
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if h.Store == nil {
+		response.NotFound(c, simpleError("cluster store not available"))
+		return
+	}
+	_, err := h.Store.Pool.Exec(c.Request.Context(), `
+		UPDATE cluster_settings
+		SET vip_address=$1, vip_interface=$2, vip_auth_pass=$3, vrrp_router_id=$4,
+		    hb_interface=$5, hb_src_ip=$6, hb_peer_ip=$7, hb_router_id=$8, gw_check_ip=$9,
+		    updated_at=NOW()
+		WHERE id=1`,
+		nullIfEmpty(req.VIPAddress), nullIfEmpty(req.VIPInterface),
+		nullIfEmpty(req.VIPAuthPass), req.VRRPRouterID,
+		nullIfEmpty(req.HBInterface), nullIfEmpty(req.HBSrcIP),
+		nullIfEmpty(req.HBPeerIP), req.HBRouterID, nullIfEmpty(req.GWCheckIP))
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: VIP settings updated", "vip", req.VIPAddress, "actor", actorOf(c))
+	// Keepalived-Config asynchron neu rendern
+	if h.PeerReloader != nil {
+		go func() {
+			rctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancel()
+			if err := h.PeerReloader(rctx); err != nil {
+				slog.Warn("cluster: keepalived render after VIP update failed", "error", err)
+			}
+		}()
+	}
+	response.NoContent(c)
+}
+
+type vipSettingsRow struct {
+	VIPAddress   *string `json:"vip_address"`
+	VIPInterface *string `json:"vip_interface"`
+	VIPAuthPass  *string `json:"vip_auth_pass"`
+	VRRPRouterID int     `json:"vrrp_router_id"`
+	HBInterface  *string `json:"hb_interface"`
+	HBSrcIP      *string `json:"hb_src_ip"`
+	HBPeerIP     *string `json:"hb_peer_ip"`
+	HBRouterID   int     `json:"hb_router_id"`
+	GWCheckIP    *string `json:"gw_check_ip"`
+}
+
+func nullIfEmpty(s *string) *string {
+	if s == nil || *s == "" {
+		return nil
+	}
+	return s
+}
+
+// RegisterPublic mountet die public (unauth) Endpoints — joining Peers
+// haben noch keine Session/Cert, deshalb läuft /issue-cert vor der
+// requireAuth-Middleware. Aufrufer muss diesen Group auf /api/v1 setzen
+// (NICHT auf authed).
+func (h *ClusterHandler) RegisterPublic(rg *gin.RouterGroup) {
+	if h.TLSStore == nil || h.Tokens == nil {
+		return
+	}
+	g := rg.Group("/cluster")
+	g.POST("/issue-cert", h.IssueCert)
+}
+
+// RegisterAgent mountet die Peer-only-Endpoints auf dem mTLS-Agent-
+// Listener. Auth läuft über das Peer-Cert (RequireAndVerifyClientCert
+// im ServerTLSConfig); der CN des Cert ist die FQDN des Peers.
+//
+// /agent/cluster/peers — joining Peer trägt sich nach erfolgreichem
+// issue-cert hier ein, damit der Primary ihn in ha_nodes hat (mit
+// status='joining') und der nächste Firewall-Render-Lauf seine IP
+// ins peer_ipv4-Set aufnimmt.
+func (h *ClusterHandler) RegisterAgent(rg *gin.RouterGroup) {
+	g := rg.Group("/agent/cluster")
+	g.POST("/peers", h.AgentRegisterPeer)
+	g.GET("/identity", h.AgentIdentity)
+	g.GET("/pg-replication-info", h.AgentPGReplicationInfo)
+	g.GET("/master-key", h.AgentMasterKey)
+	g.GET("/version", h.AgentVersion)
+	g.POST("/trigger-update", h.AgentTriggerUpdate)
+	g.GET("/active-ips", h.AgentActiveIPs)
+	g.POST("/vip-cmd", h.AgentVIPCmd)
+	g.GET("/tls-certs", h.AgentTLSCerts)
+	g.POST("/repair-replication", h.AgentRepairReplication)
+	g.GET("/repair-replication/status", h.AgentRepairReplicationStatus)
+}
+
+// AgentIdentity gibt die eigene ha_nodes-Row zurück. Wird vom Primary
+// genutzt um joining-Peers aktiv zu reconcilen wenn autoRegister (Push)
+// fehlgeschlagen ist — Pull-Fallback.
+func (h *ClusterHandler) AgentIdentity(c *gin.Context) {
+	if h.Store == nil || h.LocalID == "" {
+		response.NotFound(c, simpleError("node not registered"))
+		return
+	}
+	node, err := h.Store.Get(c.Request.Context(), h.LocalID)
+	if err != nil {
+		if err == cluster.ErrNotFound {
+			response.NotFound(c, simpleError("local node not in ha_nodes yet"))
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, node)
+}
+
+// AgentPGReplicationInfo gibt die Replication-Credentials für pg_basebackup
+// zurück. Nur über den mTLS-Agent-Listener erreichbar. Liest das Passwort
+// aus /var/lib/edgeguard/pg-replication-secret. Gibt 404 zurück wenn die
+// Datei fehlt (cluster-init-replication noch nicht ausgeführt).
+func (h *ClusterHandler) AgentPGReplicationInfo(c *gin.Context) {
+	const secretPath = "/var/lib/edgeguard/pg-replication-secret"
+	pass, err := readFileString(secretPath)
+	if err != nil {
+		response.NotFound(c, simpleError("pg-replication-secret nicht gefunden — cluster-init-replication auf dem Primary ausführen"))
+		return
+	}
+	// Host = eigene Public-IP aus ha_nodes (oder Fallback: FQDN)
+	host := ""
+	if h.Store != nil && h.LocalID != "" {
+		if node, err := h.Store.Get(c.Request.Context(), h.LocalID); err == nil {
+			if node.PublicIP != nil && *node.PublicIP != "" {
+				host = *node.PublicIP
+			}
+			if host == "" {
+				host = node.FQDN
+			}
+		}
+	}
+	response.OK(c, gin.H{
+		"host":     host,
+		"port":     5432,
+		"user":     "edgeguard_replicator",
+		"password": strings.TrimSpace(pass),
+	})
+}
+
+// AgentMasterKey gibt den Secrets-Master-Key zurück, damit cluster-setup-standby
+// ihn auf dem Secondary synchronisieren kann. Nur über den mTLS-Agent-Listener
+// erreichbar. Ohne gemeinsamen Master-Key können replizierte verschlüsselte
+// Felder (WireGuard private keys, PSKs) auf dem Secondary nicht entschlüsselt werden.
+func (h *ClusterHandler) AgentMasterKey(c *gin.Context) {
+	const keyPath = "/var/lib/edgeguard/.master_key"
+	data, err := os.ReadFile(keyPath)
+	if err != nil {
+		response.NotFound(c, simpleError("master key nicht gefunden"))
+		return
+	}
+	response.OK(c, gin.H{"key_hex": fmt.Sprintf("%x", data)})
+}
+
+func readFileString(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+// PeerReloader: optionale Funktion die nach einem Auto-Register
+// Firewall + ggfs. andere Configs regeneriert (damit peer_ipv4-Set
+// frisch ist). Wird vom main.go gesetzt.
+type PeerReloader func(ctx context.Context) error
+
+// WithPeerReloader: nach jedem AgentRegisterPeer-Aufruf gefeuert.
+func (h *ClusterHandler) WithPeerReloader(r PeerReloader) *ClusterHandler {
+	h.PeerReloader = r
+	return h
+}
+
+// WithVersion: setzt die laufende Binary-Version für Rolling-Update-Koordination.
+func (h *ClusterHandler) WithVersion(v string) *ClusterHandler {
+	h.Version = v
+	return h
 }
 
 func (h *ClusterHandler) ListNodes(c *gin.Context) {
@@ -91,6 +405,23 @@ func (h *ClusterHandler) Status(c *gin.Context) {
 	if len(out.Peers) > 0 {
 		out.Mode = "cluster"
 	}
+
+	// Pull-Reconcile für joining-Peers: wenn ein Peer via Aggregator
+	// erreichbar ist aber noch mit Placeholder-ID in ha_nodes steht,
+	// holen wir seine echte Identity aktiv ab. Best-effort goroutine —
+	// blockiert die Status-Response nicht.
+	if h.Aggregator != nil && h.Store != nil {
+		var joining []models.HANode
+		for _, p := range out.Peers {
+			if p.Status == "joining" || p.Status == "pending" {
+				joining = append(joining, p)
+			}
+		}
+		if len(joining) > 0 {
+			go h.reconcileJoiningPeers(joining)
+		}
+	}
+
 	// Drift-Detection: jeder peer mit anderem config_hash als unser
 	// lokaler → Banner-Trigger im UI.
 	if localHash != nil && *localHash != "" {
@@ -116,3 +447,526 @@ func (h *ClusterHandler) Status(c *gin.Context) {
 	}
 	response.OK(c, out)
 }
+
+// SystemLoad aggregiert /proc-Metriken aller Peers via mTLS-Aggregator.
+// Liefert ein Array { node_id, fqdn, ok, data, error, duration_ms }.
+// Lokaler Node wird IMMER eingefügt (direkter Call statt mTLS-Roundtrip).
+func (h *ClusterHandler) SystemLoad(c *gin.Context) {
+	all, err := h.Store.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	results := make([]aggregator.PeerResult, 0, len(all))
+	// Lokalen Node selbst befragen: wir rufen die Resources-Funktion
+	// inline statt einen mTLS-Loopback aufzubauen — auch wenn der
+	// Agent-Listener läuft, ist ein direkter Call billiger.
+	for _, n := range all {
+		if n.ID == h.LocalID {
+			local := localSystemLoad()
+			raw, _ := json.Marshal(local)
+			results = append(results, aggregator.PeerResult{
+				NodeID:   n.ID,
+				FQDN:     n.FQDN,
+				OK:       true,
+				Data:     raw,
+				Duration: 0,
+			})
+		}
+	}
+	if h.Aggregator != nil {
+		peers := make([]models.HANode, 0, len(all))
+		for _, n := range all {
+			if n.ID == h.LocalID {
+				continue
+			}
+			peers = append(peers, n)
+		}
+		// /agent/system/resources auf dem Peer-Agent-Listener (:8443 mTLS).
+		fan := h.Aggregator.FanOut(c.Request.Context(), peers, "/agent/system/resources", h.LocalID)
+		results = append(results, fan...)
+	}
+	response.OK(c, gin.H{"nodes": results})
+}
+
+// localSystemLoad ruft die selben Werte wie /system/resources, aber
+// als bare struct (kein gin.Context). Damit liefert SystemLoad pro Node
+// dasselbe Format wie der Agent-Endpoint.
+func localSystemLoad() any {
+	// SystemHandler.Resources nutzt ein internes `resources` struct.
+	// Wir duplizieren die /proc-Reads nicht — der Agent-Listener mountet
+	// denselben Handler und liefert die JSON-Struktur. Für den lokalen
+	// Path liefern wir das Snapshot über computeLocalSystemResources.
+	return computeLocalSystemResources()
+}
+
+// ── Phase 3.4: Cluster-Join Token Flow ────────────────────────────────
+
+// GenerateJoinToken — Admin generiert einen one-shot Bootstrap-Token
+// für einen neuen Peer. Der FQDN des neuen Nodes wird vorab übergeben
+// so dass er sofort in ha_nodes vorregistriert und im UI angezeigt werden
+// kann. Token wird NUR EINMAL zurückgegeben.
+func (h *ClusterHandler) GenerateJoinToken(c *gin.Context) {
+	var req struct {
+		NodeFQDN string `json:"node_fqdn"`
+	}
+	// Body optional — wenn leer, läuft der Flow ohne Pre-Register.
+	_ = c.ShouldBindJSON(&req)
+
+	token, exp, err := h.Tokens.Generate()
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	caCert, _, err := h.TLSStore.LoadCA()
+	caFP := ""
+	if err == nil && caCert != nil {
+		caFP = jointoken.CAFingerprint16(caCert.Raw)
+	}
+
+	// Pre-register: wenn ein FQDN übergeben wurde, schon jetzt in
+	// ha_nodes anlegen (status='pending') + Firewall-Reload. So ist
+	// der Node bekannt bevor er überhaupt antwortet, und @peer_ipv4
+	// wird beim issue-cert (wo wir die IP haben) nur noch updaten.
+	if req.NodeFQDN != "" && h.Store != nil {
+		go h.preRegisterByFQDN(req.NodeFQDN)
+	}
+
+	response.OK(c, gin.H{
+		"token":          token,
+		"expires_at":     exp.UTC().Format(time.RFC3339),
+		"ca_fingerprint": caFP,
+		"node_fqdn":      req.NodeFQDN,
+	})
+}
+
+// preRegisterByFQDN legt einen ha_nodes-Eintrag mit status='pending' an
+// bevor der Joiner überhaupt die Verbindung aufbaut. Idempotent dank
+// ON CONFLICT. Kein Firewall-Reload hier — die IP ist noch unbekannt;
+// das erledigt preRegisterJoiner wenn die issue-cert-Anfrage eintrifft.
+func (h *ClusterHandler) preRegisterByFQDN(fqdn string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	nodeID := fmt.Sprintf("prenode-%s", strings.ReplaceAll(fqdn, ".", "-"))
+	n := models.HANode{
+		ID:     nodeID,
+		Name:   fqdn,
+		FQDN:   fqdn,
+		APIURL: "https://" + fqdn + ":3443",
+		Role:   "peer",
+		Status: "pending",
+	}
+	if _, err := h.Store.UpsertSelf(ctx, n); err != nil {
+		slog.Warn("cluster: pre-register by FQDN failed", "fqdn", fqdn, "error", err)
+	}
+}
+
+// IssueCert — Joining Peer POSTet seinen CSR + den Token. Wir verifizieren
+// + konsumieren den Token, signieren den CSR mit unserer Cluster-CA und
+// liefern {ca_cert, peer_cert} zurück. PUBLIC Endpoint — keine Session-
+// Auth nötig (der Joiner hat noch keine).
+type issueCertRequest struct {
+	Token string `json:"token"`
+	CSR   string `json:"csr"`
+}
+type issueCertResponse struct {
+	CACert   string `json:"ca_cert"`
+	PeerCert string `json:"peer_cert"`
+}
+
+func (h *ClusterHandler) IssueCert(c *gin.Context) {
+	var req issueCertRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.Token == "" || req.CSR == "" {
+		response.BadRequest(c, errInvalidJoinRequest)
+		return
+	}
+	// consumedBy → Remote-IP. Audit-Trail wenn jemand Tokens stiehlt
+	// und vom falschen Host einlöst.
+	clientIP := c.ClientIP()
+	if _, err := h.Tokens.Consume(c.Request.Context(), req.Token, clientIP); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	// CSR signieren.
+	peerCert, err := h.TLSStore.SignCSR(req.CSR, nil)
+	if err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	caPEM, err := h.TLSStore.CACertPEM()
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+
+	// Pre-register the joining node SYNCHRONOUSLY before returning the
+	// cert so that nftables @peer_ipv4 already contains the joiner's IP
+	// by the time they call autoRegister on port 8443. A goroutine here
+	// caused a race: cert returned → joiner calls autoRegister → nftables
+	// not updated yet → connection refused → status stays "joining".
+	if h.Store != nil && h.PeerReloader != nil {
+		h.preRegisterJoiner(c.Request.Context(), clientIP, req.CSR)
+	}
+
+	response.OK(c, issueCertResponse{
+		CACert:   caPEM,
+		PeerCert: peerCert,
+	})
+}
+
+// preRegisterJoiner inserts a minimal ha_nodes row for the joining peer
+// (using the CSR CN as FQDN and the HTTP client IP as public_ip), then
+// triggers a firewall reload so @peer_ipv4 contains the new IP before
+// the peer tries to call /agent/cluster/peers on port 8443.
+// Uses a stable deterministic ID so re-joins are idempotent.
+func (h *ClusterHandler) preRegisterJoiner(parent context.Context, clientIP, csrPEM string) {
+	ctx, cancel := context.WithTimeout(parent, 10*time.Second)
+	defer cancel()
+
+	fqdn := cnFromCSR(csrPEM)
+	if fqdn == "" {
+		fqdn = "joining-" + clientIP
+	}
+	nodeID := fmt.Sprintf("prenode-%s", strings.ReplaceAll(fqdn, ".", "-"))
+
+	n := models.HANode{
+		ID:     nodeID,
+		Name:   fqdn,
+		FQDN:   fqdn,
+		APIURL: "https://" + fqdn + ":3443",
+		Role:   "peer",
+		Status: "joining",
+	}
+	n.PublicIP = &clientIP
+
+	if _, err := h.Store.UpsertSelf(ctx, n); err != nil {
+		slog.Warn("cluster: pre-register joiner failed", "fqdn", fqdn, "ip", clientIP, "error", err)
+		return
+	}
+	if err := h.PeerReloader(ctx); err != nil {
+		slog.Warn("cluster: PeerReloader failed after pre-register", "error", err)
+		return
+	}
+	slog.Info("cluster: joiner pre-registered, firewall updated", "fqdn", fqdn, "ip", clientIP)
+}
+
+// ptrStr dereferences a *string safely for comparison; nil → "".
+func ptrStr(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
+// cnFromCSR extracts the Subject Common Name from a PEM-encoded CSR.
+// Returns empty string on any parse error.
+func cnFromCSR(csrPEM string) string {
+	block, _ := pem.Decode([]byte(csrPEM))
+	if block == nil {
+		return ""
+	}
+	csr, err := x509.ParseCertificateRequest(block.Bytes)
+	if err != nil {
+		return ""
+	}
+	return csr.Subject.CommonName
+}
+
+// reconcileJoiningPeers versucht für jeden Peer im Status "joining" oder
+// "pending" die echte Node-ID via /agent/cluster/identity zu holen und
+// ihn in ha_nodes mit der richtigen ID einzutragen. Self-Healing-
+// Fallback wenn autoRegister (Push von joining-Peer zu Primary) wegen
+// eines temporären Netzwerkproblems fehlgeschlagen ist.
+//
+// Die public_ip des Placeholder-Rows wird in der neuen Row übernommen
+// damit @peer_ipv4 (nftables) korrekt bleibt.
+func (h *ClusterHandler) reconcileJoiningPeers(placeholders []models.HANode) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancel()
+
+	results := h.Aggregator.FanOut(ctx, placeholders, "/agent/cluster/identity", h.LocalID)
+	changed := false
+	for i, res := range results {
+		if !res.OK || len(res.Data) == 0 {
+			continue
+		}
+		var identity models.HANode
+		if err := json.Unmarshal(res.Data, &identity); err != nil || identity.ID == "" {
+			continue
+		}
+		placeholder := placeholders[i]
+		if identity.ID == placeholder.ID {
+			continue // ID bereits korrekt
+		}
+		// Echte ID gefunden — row mit realer ID anlegen, public_ip aus
+		// dem Placeholder-Row übernehmen damit nftables korrekt bleibt.
+		n := identity
+		n.Status = "online"
+		if n.PublicIP == nil {
+			n.PublicIP = placeholder.PublicIP
+		}
+		if n.InternalIP == nil {
+			n.InternalIP = placeholder.InternalIP
+		}
+		// Placeholder zuerst löschen: ha_nodes hat UNIQUE(fqdn). Ohne
+		// dieses Delete würde UpsertSelf (ON CONFLICT(id)) mit fqdn-
+		// unique-Violation scheitern.
+		_ = h.Store.DeletePlaceholdersByFQDN(ctx, n.FQDN, n.ID)
+		out, err := h.Store.UpsertSelf(ctx, n)
+		if err != nil {
+			slog.Warn("cluster: reconcile joining peer: upsert failed",
+				"fqdn", n.FQDN, "real_id", n.ID, "error", err)
+			continue
+		}
+		changed = true
+		slog.Info("cluster: joining peer reconciled via identity pull",
+			"id", out.ID, "fqdn", out.FQDN, "placeholder_id", placeholder.ID)
+	}
+	if changed && h.PeerReloader != nil {
+		rctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		if err := h.PeerReloader(rctx); err != nil {
+			slog.Warn("cluster: PeerReloader failed after reconcile", "error", err)
+		}
+	}
+}
+
+// AgentVersion gibt die laufende Binary-Version zurück. Wird vom Rolling-
+// Update-Orchestrator gepollt um zu erkennen wann der Secondary die neue
+// Version hat.
+func (h *ClusterHandler) AgentVersion(c *gin.Context) {
+	response.OK(c, gin.H{"version": h.Version})
+}
+
+// AgentTriggerUpdate startet den Upgrade-Prozess auf diesem Node via
+// systemd-run (detached). Wird vom Primary via mTLS aufgerufen um den
+// Secondary zuerst zu aktualisieren (Rolling-Update). Pattern identisch
+// zu /system/upgrade — nutzt dieselbe Sudoers-Whitelist aus dem postinst.
+func (h *ClusterHandler) AgentTriggerUpdate(c *gin.Context) {
+	const scriptPath = "/var/lib/edgeguard/upgrade.sh"
+	const script = `#!/bin/bash
+set -e
+sleep 2
+export DEBIAN_FRONTEND=noninteractive
+dpkg --configure -a || true
+retry_apt() {
+    local attempt=0 max=3 wait_for=15
+    while [ $attempt -lt $max ]; do
+        attempt=$((attempt + 1))
+        apt-get update -qq || true
+        if apt-get install -y -qq -o Dpkg::Options::=--force-confold \
+            edgeguard-api edgeguard-ui edgeguard; then return 0; fi
+        [ $attempt -lt $max ] && sleep $wait_for && wait_for=$((wait_for * 2))
+    done
+    return 1
+}
+retry_apt
+echo "[upgrade] complete"
+rm -f /var/lib/edgeguard/upgrade.sh
+`
+	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	const unitName = "edgeguard-upgrade.service"
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", unitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+unitName,
+		"--description=EdgeGuard self-upgrade",
+		"--collect",
+		"bash", scriptPath)
+	if err := cmd.Run(); err != nil {
+		slog.Warn("cluster: AgentTriggerUpdate: systemd-run failed", "error", err)
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: rolling update triggered on this node by primary mTLS call",
+		"client", c.ClientIP())
+	c.JSON(http.StatusAccepted, gin.H{"status": "upgrading"})
+}
+
+var errInvalidJoinRequest = simpleError("missing token or csr")
+
+type simpleError string
+
+func (e simpleError) Error() string { return string(e) }
+
+// ── Cluster-Cert-Status + Renewal ─────────────────────────────────────
+
+// CertStatus liefert Metadata zu CA + Peer-Cert (Common Name, Expiry,
+// days_remaining). UI nutzt das für Expiry-Warnungen.
+func (h *ClusterHandler) CertStatus(c *gin.Context) {
+	out := gin.H{
+		"has_ca":   h.TLSStore.HasCA(),
+		"has_peer": h.TLSStore.HasPeer(),
+	}
+	if h.TLSStore.HasCA() {
+		if info, err := h.TLSStore.CACertInfo(); err == nil {
+			out["ca"] = info
+		}
+	}
+	if h.TLSStore.HasPeer() {
+		if info, err := h.TLSStore.PeerCertInfo(); err == nil {
+			out["peer"] = info
+		}
+	}
+	response.OK(c, out)
+}
+
+// RenewSelf re-signed das eigene peer.crt mit der eigenen CA. Nur
+// sinnvoll auf einer Founder-Box; Joiner haben keine eigene CA.
+//
+// Nach Renew muss edgeguard-api restartet werden damit der Agent-
+// Listener das neue Cert in seinen TLS-Config-Snapshot lädt — wir
+// triggern das NICHT automatisch (würde die HTTP-Response abreißen);
+// stattdessen liefern wir einen Hinweis im Response.
+func (h *ClusterHandler) RenewSelf(c *gin.Context) {
+	if !h.TLSStore.HasCA() {
+		response.BadRequest(c, simpleError("no local CA — joiners cannot self-renew"))
+		return
+	}
+	// Common-Name aus dem existierenden Peer-Cert übernehmen damit der
+	// Cert weiterhin auf die aktuelle FQDN passt.
+	cn := "edgeguard-node"
+	if info, err := h.TLSStore.PeerCertInfo(); err == nil && info.CommonName != "" {
+		cn = info.CommonName
+	}
+	if err := h.TLSStore.RenewSelfSigned(cn, []string{cn}, nil, nil); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	info, err := h.TLSStore.PeerCertInfo()
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{
+		"peer":         info,
+		"restart_hint": "systemctl restart edgeguard-api",
+	})
+}
+
+// ── Phase 3.5: Auto-Register beim Cluster-Join ────────────────────────
+
+// registerPeerRequest: vom Joiner via mTLS-POST an /agent/cluster/peers.
+// CN des Client-Cert authentifiziert den Peer. Wir nehmen nur die Felder
+// die wir wirklich brauchen — sonst kann ein joining Peer beliebige
+// ha_nodes-Felder überschreiben.
+type registerPeerRequest struct {
+	ID         string  `json:"id"`           // Joiner's eigene node-id
+	Name       string  `json:"name"`         // hostname
+	FQDN       string  `json:"fqdn"`         // sollte mit Client-Cert-CN matchen
+	APIURL     string  `json:"api_url"`      // https://<fqdn>
+	PublicIP   string  `json:"public_ip"`    // optional
+	InternalIP string  `json:"internal_ip"`  // mTLS-Listener-IP (für peer_ipv4-Set)
+	MgmtIP     string  `json:"mgmt_ip"`      // optional
+	Version    string  `json:"version"`
+	ConfigHash *string `json:"config_hash"`  // nil=absent (don't change), ""=no user config
+}
+
+// AgentRegisterPeer: vom Joiner nach issue-cert via mTLS aufgerufen.
+// Validiert dass der Client-Cert-CN zur fqdn passt (verhindert Cross-
+// Peer-Hijack) und upsertet die Row in ha_nodes mit status='joining'.
+// Phase 3.2 Heartbeat wird die Status auf 'online' ändern sobald der
+// Joiner seinen eigenen Heartbeat-Tick startet.
+func (h *ClusterHandler) AgentRegisterPeer(c *gin.Context) {
+	var req registerPeerRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.ID == "" || req.FQDN == "" {
+		response.BadRequest(c, simpleError("id + fqdn required"))
+		return
+	}
+	// Cert-CN-Check: TLS-Layer hat den Cert bereits gegen unsere CA
+	// verifiziert; jetzt prüfen wir dass der CN zur claimed FQDN passt.
+	// Sonst könnte ein peer1.example.com Cert nutzen um peer2.example.com
+	// in ha_nodes zu schreiben.
+	if c.Request.TLS == nil || len(c.Request.TLS.PeerCertificates) == 0 {
+		response.Forbidden(c, simpleError("no client cert presented"))
+		return
+	}
+	cn := c.Request.TLS.PeerCertificates[0].Subject.CommonName
+	if cn != req.FQDN {
+		slog.Warn("cluster: peer cert CN does not match registration FQDN",
+			"cn", cn, "fqdn", req.FQDN)
+		response.Forbidden(c, simpleError("cert CN does not match fqdn"))
+		return
+	}
+
+	// Wir bauen ein models.HANode zusammen + nutzen den existierenden
+	// UpsertSelf. (UpsertSelf nimmt eine HANode für einen registrierenden
+	// Node, hier ist der „Self" der joining-Peer auf dieser Primary-Seite.
+	// Der Name passt nicht 100% semantisch, aber das SQL ist exakt das was
+	// wir brauchen.)
+	n := models.HANode{
+		ID:     req.ID,
+		Name:   req.Name,
+		FQDN:   req.FQDN,
+		APIURL: req.APIURL,
+		Role:   "peer",
+		Status: "online", // peer IS online — it just connected via mTLS
+	}
+	if req.PublicIP != "" {
+		v := req.PublicIP
+		n.PublicIP = &v
+	}
+	if req.InternalIP != "" {
+		v := req.InternalIP
+		n.InternalIP = &v
+	}
+	if req.MgmtIP != "" {
+		v := req.MgmtIP
+		n.MgmtIP = &v
+	}
+	if req.Version != "" {
+		v := req.Version
+		n.Version = &v
+	}
+	if req.ConfigHash != nil {
+		n.ConfigHash = req.ConfigHash
+	}
+	// Placeholder zuerst löschen: ha_nodes hat UNIQUE(fqdn). Der INSERT
+	// in UpsertSelf verwendet ON CONFLICT(id) — greift NICHT bei fqdn-
+	// Konflikten. Ohne das Delete würde der INSERT mit "duplicate key on
+	// ha_nodes_fqdn_unique" scheitern und der Peer bliebe ewig "joining".
+	_ = h.Store.DeletePlaceholdersByFQDN(c.Request.Context(), req.FQDN, req.ID)
+
+	// Snapshot der aktuellen IPs VOR dem Upsert — zum Vergleich danach.
+	// Nur wenn sich public_ip oder internal_ip ändert, müssen wir nftables
+	// neu laden (@peer_ipv4-Set). Periodische Pushes vom Secondary (alle
+	// 5 min) ändern nur version/config_hash, nicht die IPs → kein Reset.
+	existing, _ := h.Store.Get(c.Request.Context(), req.ID)
+
+	out, err := h.Store.UpsertSelf(c.Request.Context(), n)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+
+	// Firewall-Reload nur wenn sich die Peer-IP geändert hat oder der
+	// Peer neu eingetragen wurde. Verhindert Counter-Reset alle 5 min
+	// durch den periodischen Secondary-Push (runPrimaryPush).
+	ipChanged := existing == nil ||
+		ptrStr(existing.PublicIP) != ptrStr(out.PublicIP) ||
+		ptrStr(existing.InternalIP) != ptrStr(out.InternalIP)
+	if ipChanged && h.PeerReloader != nil {
+		go func() {
+			rctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			if err := h.PeerReloader(rctx); err != nil {
+				slog.Warn("cluster: PeerReloader failed after AgentRegisterPeer", "error", err)
+			}
+		}()
+	}
+
+	slog.Info("cluster: peer registered via mTLS",
+		"id", out.ID, "fqdn", out.FQDN, "role", out.Role, "status", out.Status,
+		"client_cn", cn, "remote", c.ClientIP())
+	response.OK(c, out)
+}

internal/handlers/cluster_certsync.go

@@ -0,0 +1,118 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/aggregator"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const tlsCertDir = "/etc/edgeguard/tls"
+
+// AgentTLSCerts liefert alle .pem-Dateien aus /etc/edgeguard/tls/ als
+// Base64-Map. Wird vom Secondary via mTLS aufgerufen um Zertifikate
+// des Primary zu spiegeln.
+func (h *ClusterHandler) AgentTLSCerts(c *gin.Context) {
+	entries, err := os.ReadDir(tlsCertDir)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	certs := make(map[string]string, len(entries))
+	for _, e := range entries {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".pem") {
+			continue
+		}
+		data, err := os.ReadFile(filepath.Join(tlsCertDir, e.Name()))
+		if err != nil {
+			continue
+		}
+		certs[e.Name()] = base64.StdEncoding.EncodeToString(data)
+	}
+	response.OK(c, gin.H{"certs": certs})
+}
+
+// SyncTLSCertsFromPrimary holt alle TLS-Zertifikate vom Primary via mTLS
+// und schreibt geänderte Dateien nach /etc/edgeguard/tls/. Relädt HAProxy
+// wenn mindestens ein Zertifikat aktualisiert wurde.
+//
+// Läuft auf dem Secondary bei jedem runSecondaryConfigRender-Tick —
+// nicht hash-gated, da certbot-Renewals den config_hash nicht ändern.
+func SyncTLSCertsFromPrimary(ctx context.Context, pool *pgxpool.Pool, agg *aggregator.Aggregator, localID string) error {
+	if agg == nil {
+		return nil
+	}
+	// Primary-Peer aus ha_nodes ermitteln
+	rows, err := pool.Query(ctx,
+		`SELECT id, fqdn, api_url FROM ha_nodes WHERE id != $1 LIMIT 1`, localID)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	var primary *models.HANode
+	for rows.Next() {
+		n := &models.HANode{}
+		if err := rows.Scan(&n.ID, &n.FQDN, &n.APIURL); err != nil {
+			continue
+		}
+		primary = n
+	}
+	if primary == nil {
+		return nil // kein Peer → Single-Node
+	}
+
+	results := agg.FanOut(ctx, []models.HANode{*primary}, "/agent/cluster/tls-certs", localID)
+	if len(results) == 0 || !results[0].OK {
+		return nil // Primary nicht erreichbar — nächster Tick
+	}
+
+	var payload struct {
+		Certs map[string]string `json:"certs"`
+	}
+	if err := json.Unmarshal(results[0].Data, &payload); err != nil {
+		return err
+	}
+
+	if err := os.MkdirAll(tlsCertDir, 0o750); err != nil {
+		return err
+	}
+
+	changed := false
+	for name, b64 := range payload.Certs {
+		data, err := base64.StdEncoding.DecodeString(b64)
+		if err != nil {
+			slog.Warn("cert-sync: base64 decode failed", "file", name, "error", err)
+			continue
+		}
+		path := filepath.Join(tlsCertDir, name)
+		existing, readErr := os.ReadFile(path)
+		if readErr == nil && bytes.Equal(existing, data) {
+			continue // unverändert
+		}
+		if err := os.WriteFile(path, data, 0o640); err != nil {
+			slog.Warn("cert-sync: write failed", "file", name, "error", err)
+			continue
+		}
+		changed = true
+		slog.Info("cert-sync: updated", "file", name)
+	}
+
+	if changed {
+		if err := exec.Command("sudo", "-n", "/usr/bin/systemctl", "reload", "haproxy.service").Run(); err != nil {
+			slog.Warn("cert-sync: haproxy reload failed", "error", err)
+		}
+	}
+	return nil
+}

internal/handlers/cluster_repair.go

@@ -0,0 +1,389 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+// Replication-Repair ("Resync erzwingen") für das Config-Drift-Banner.
+//
+// Drift entsteht, wenn ein Peer einen anderen config_hash hat als dieser
+// Node — entweder weil die Logical-Replication-Subscription gestört ist
+// oder weil direkt in die DB des Subscribers geschrieben wurde. Die
+// Reparatur baut die Subscription neu auf und kopiert alle geteilten
+// Tabellen frisch vom Primary (einseitig: Primary = Source of Truth).
+//
+// Rollen-Erkennung: NICHT über ha_nodes.role/pg_role — die sind je Node
+// lokal und unzuverlässig (jede Node markiert sich selbst, pg_role bleibt
+// 'standalone' bis `promote`). Verlässlich ist die PUBLICATION: nur der
+// Primary hat `edgeguard_shared` (pg_publication ist für jeden DB-User
+// lesbar). Der Subscriber hat sie nicht → er ist das Resync-Ziel.
+//
+// Ablauf:
+//   - Klick auf dem Primary → Dispatch via mTLS an den Peer
+//     (POST /agent/cluster/repair-replication) mit der eigenen Adresse als
+//     primary_host; der Peer resynct von dort.
+//   - Klick direkt auf dem Subscriber → läuft lokal (Quelle = der Peer).
+//
+// Die eigentliche Arbeit läuft — analog zum Rolling-Update — in einer
+// transienten systemd-Unit, die `edgeguard-ctl cluster-setup-standby
+// <primary>` ausführt.
+
+const (
+	repairUnitName   = "edgeguard-repair-replication.service"
+	repairScriptPath = "/var/lib/edgeguard/repair-replication.sh"
+	repairAgentPath  = "/agent/cluster/repair-replication"
+	repairPubName    = "edgeguard_shared" // muss zu cmd/edgeguard-ctl egPubName passen
+)
+
+// validRepairHost erlaubt nur IPv4/IPv6/Hostnamen — der Wert landet in
+// einem Bash-Script das als root läuft, also strikt validieren.
+var validRepairHost = regexp.MustCompile(`^[A-Za-z0-9._:-]{1,253}$`)
+
+// repairDispatchBody ist der Body des Agent-Dispatch: der Primary teilt
+// dem Subscriber seine Adresse mit, von der resynct werden soll.
+type repairDispatchBody struct {
+	PrimaryHost string `json:"primary_host"`
+}
+
+// RepairReplication ist der UI-Endpoint. Hat dieser Node die Publication
+// (= Primary), wird der Resync an den Peer delegiert; sonst (Subscriber)
+// läuft er lokal mit dem Peer als Quelle.
+func (h *ClusterHandler) RepairReplication(c *gin.Context) {
+	if h.Store == nil {
+		response.Internal(c, errors.New("cluster store unavailable"))
+		return
+	}
+	ctx := c.Request.Context()
+	all, err := h.Store.List(ctx)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	local := findNode(all, h.LocalID)
+	peer := findOtherPeer(all, h.LocalID)
+	if peer == nil {
+		response.BadRequest(c, errors.New("kein Peer-Node im Cluster — nichts zu resyncen"))
+		return
+	}
+
+	if h.nodeHasPublication(ctx) {
+		// Primary → an den Subscriber-Peer delegieren, mit eigener Adresse.
+		if h.Aggregator == nil {
+			response.BadRequest(c, errors.New("kein mTLS-Aggregator verfügbar — Resync nicht delegierbar"))
+			return
+		}
+		primaryHost := pickPrimaryHost(local)
+		if primaryHost == "" || !validRepairHost.MatchString(primaryHost) {
+			response.BadRequest(c, errors.New("eigene Primary-Adresse (Mgmt/Internal/Public-IP/FQDN) fehlt oder ist ungültig"))
+			return
+		}
+		body, _ := json.Marshal(repairDispatchBody{PrimaryHost: primaryHost})
+		res := h.Aggregator.PostPeerWithBody(ctx, *peer, repairAgentPath, body)
+		if !res.OK {
+			response.Internal(c, fmt.Errorf("Resync auf %s anstoßen: %s", peer.FQDN, res.Err))
+			return
+		}
+		slog.Info("cluster: replication repair delegated", "target", peer.FQDN, "primary_host", primaryHost)
+		if h.Audit != nil {
+			_ = h.Audit.Log(ctx, actorOf(c), "cluster.repair-replication",
+				peer.FQDN, gin.H{"target": "peer", "peer": peer.FQDN, "primary_host": primaryHost}, h.NodeID)
+		}
+		response.Accepted(c, gin.H{"dispatched": true, "target": "peer", "peer_fqdn": peer.FQDN})
+		return
+	}
+
+	// Subscriber → lokal ausführen, Quelle = der Peer (Primary).
+	host := pickPrimaryHost(peer)
+	if err := h.startResync(ctx, host); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(ctx, actorOf(c), "cluster.repair-replication",
+			host, gin.H{"target": "local", "primary": host}, h.NodeID)
+	}
+	response.Accepted(c, gin.H{"dispatched": true, "target": "local", "primary": host})
+}
+
+// AgentRepairReplication wird vom Primary via mTLS auf dem Subscriber
+// aufgerufen und startet dort den lokalen Resync von primary_host.
+func (h *ClusterHandler) AgentRepairReplication(c *gin.Context) {
+	if h.Store == nil {
+		response.Internal(c, errors.New("cluster store unavailable"))
+		return
+	}
+	ctx := c.Request.Context()
+	var body repairDispatchBody
+	_ = c.ShouldBindJSON(&body) // best-effort; Fallback unten
+
+	host := strings.TrimSpace(body.PrimaryHost)
+	if host == "" {
+		// Fallback: Quelle aus ha_nodes (der andere Node).
+		if all, err := h.Store.List(ctx); err == nil {
+			host = pickPrimaryHost(findOtherPeer(all, h.LocalID))
+		}
+	}
+	if err := h.startResync(ctx, host); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	slog.Info("cluster: replication repair triggered by peer", "primary", host, "node", h.LocalID)
+	if h.Audit != nil {
+		_ = h.Audit.Log(ctx, "cluster-peer", "cluster.repair-replication",
+			host, gin.H{"target": "local", "primary": host, "via": "agent"}, h.NodeID)
+	}
+	response.Accepted(c, gin.H{"dispatched": true, "primary": host})
+}
+
+// startResync schreibt das Repair-Script und startet die transiente
+// systemd-Unit. Safety-Guard: läuft NIE auf dem Publication-Primary.
+func (h *ClusterHandler) startResync(ctx context.Context, primaryHost string) error {
+	primaryHost = strings.TrimSpace(primaryHost)
+	if primaryHost == "" {
+		return errors.New("keine Primary-Adresse für den Resync ermittelbar")
+	}
+	if !validRepairHost.MatchString(primaryHost) {
+		return fmt.Errorf("ungültige Primary-Adresse: %q", primaryHost)
+	}
+	// Niemals auf dem Primary (Publication-Quelle) resyncen — würde die
+	// eigene Config mit sich selbst überschreiben bzw. ist sinnlos.
+	if h.nodeHasPublication(ctx) {
+		return errors.New("dieser Node ist der Publication-Primary — Resync läuft nur auf einem Subscriber")
+	}
+	if st := repairUnitState(); st == "activating" || st == "active" {
+		return errors.New("Resync läuft bereits")
+	}
+
+	script := fmt.Sprintf(`#!/bin/bash
+set -uo pipefail
+echo "[repair] resync der Logical-Replication-Subscription von Primary %[1]s"
+/usr/bin/edgeguard-ctl cluster-setup-standby %[1]s
+rc=$?
+if [ "$rc" -ne 0 ]; then
+    echo "[repair] cluster-setup-standby fehlgeschlagen (rc=$rc)"
+    exit "$rc"
+fi
+echo "[repair] abgeschlossen — config_hash wird beim nächsten Cluster-Status neu berechnet"
+rm -f %[2]s
+`, primaryHost, repairScriptPath)
+
+	if err := os.WriteFile(repairScriptPath, []byte(script), 0o755); err != nil {
+		return fmt.Errorf("write repair script: %w", err)
+	}
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", repairUnitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+repairUnitName,
+		"--description=EdgeGuard replication repair",
+		"--collect",
+		"bash", repairScriptPath)
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("systemd-run failed: %w", err)
+	}
+	slog.Info("cluster: replication repair dispatched (local)", "primary", primaryHost, "node", h.LocalID)
+	return nil
+}
+
+// nodeHasPublication prüft, ob dieser Node die Replikations-Publication
+// besitzt — das verlässliche Primary-Signal. pg_publication ist für jeden
+// DB-User lesbar (anders als pg_subscription).
+func (h *ClusterHandler) nodeHasPublication(ctx context.Context) bool {
+	if h.Store == nil || h.Store.Pool == nil {
+		return false
+	}
+	cctx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+	var exists bool
+	if err := h.Store.Pool.QueryRow(cctx,
+		`SELECT EXISTS(SELECT 1 FROM pg_publication WHERE pubname = $1)`, repairPubName,
+	).Scan(&exists); err != nil {
+		return false
+	}
+	return exists
+}
+
+// repairStatusResponse spiegelt den Zustand der transienten Repair-Unit.
+type repairStatusResponse struct {
+	Phase      string   `json:"phase"` // idle | running | success | failed
+	State      string   `json:"state"`
+	Result     string   `json:"result"`
+	ExitCode   int      `json:"exit_code"`
+	StartedAt  string   `json:"started_at,omitempty"`
+	FinishedAt string   `json:"finished_at,omitempty"`
+	Log        []string `json:"log"`
+}
+
+// RepairReplicationStatus liest den Job-Zustand. Auf dem Primary wird der
+// Status vom Subscriber-Peer geholt (dort läuft der Job); sonst lokal.
+func (h *ClusterHandler) RepairReplicationStatus(c *gin.Context) {
+	ctx := c.Request.Context()
+	if h.Store != nil && h.nodeHasPublication(ctx) && h.Aggregator != nil {
+		if all, err := h.Store.List(ctx); err == nil {
+			if peer := findOtherPeer(all, h.LocalID); peer != nil {
+				results := h.Aggregator.FanOut(ctx,
+					[]models.HANode{*peer}, repairAgentPath+"/status", h.LocalID)
+				if len(results) == 1 && results[0].OK && len(results[0].Data) > 0 {
+					c.Data(200, "application/json", wrapEnvelope(results[0].Data))
+					return
+				}
+				// Peer nicht erreichbar → idle statt Fehler, damit das
+				// UI-Polling nicht hart abbricht.
+				response.OK(c, repairStatusResponse{Phase: "idle", Log: []string{}})
+				return
+			}
+		}
+	}
+	response.OK(c, localRepairStatus())
+}
+
+// AgentRepairReplicationStatus liefert den lokalen Job-Zustand an den
+// abfragenden Primary.
+func (h *ClusterHandler) AgentRepairReplicationStatus(c *gin.Context) {
+	response.OK(c, localRepairStatus())
+}
+
+// wrapEnvelope verpackt eine bereits entpackte data-Payload wieder in die
+// Standard-Envelope, damit das UI (isEnvelope) sie konsistent liest.
+func wrapEnvelope(data []byte) []byte {
+	out := []byte(`{"data":`)
+	out = append(out, data...)
+	out = append(out, []byte(`,"error":null,"message":"ok"}`)...)
+	return out
+}
+
+// localRepairStatus liest den Zustand der lokalen Repair-Unit aus systemd
+// (analog UpgradeStatus). Quelle der Wahrheit für Job-Ende ist die Unit.
+func localRepairStatus() repairStatusResponse {
+	out := repairStatusResponse{Phase: "idle", Log: []string{}}
+
+	if data, err := exec.Command("systemctl", "show", repairUnitName,
+		"--no-page",
+		"-p", "ActiveState",
+		"-p", "Result",
+		"-p", "ExecMainStatus",
+		"-p", "ExecMainStartTimestamp",
+		"-p", "ExecMainExitTimestamp",
+	).CombinedOutput(); err == nil {
+		for _, line := range strings.Split(string(data), "\n") {
+			kv := strings.SplitN(strings.TrimSpace(line), "=", 2)
+			if len(kv) != 2 {
+				continue
+			}
+			switch kv[0] {
+			case "ActiveState":
+				out.State = kv[1]
+			case "Result":
+				out.Result = kv[1]
+			case "ExecMainStatus":
+				out.ExitCode, _ = strconv.Atoi(kv[1])
+			case "ExecMainStartTimestamp":
+				if t, err := time.Parse("Mon 2006-01-02 15:04:05 MST", kv[1]); err == nil {
+					out.StartedAt = t.UTC().Format(time.RFC3339)
+				}
+			case "ExecMainExitTimestamp":
+				if t, err := time.Parse("Mon 2006-01-02 15:04:05 MST", kv[1]); err == nil {
+					out.FinishedAt = t.UTC().Format(time.RFC3339)
+				}
+			}
+		}
+	}
+
+	switch out.State {
+	case "activating", "active", "deactivating":
+		out.Phase = "running"
+	case "failed":
+		out.Phase = "failed"
+	case "inactive":
+		if out.Result == "success" && out.ExitCode == 0 && out.FinishedAt != "" {
+			out.Phase = "success"
+		} else if out.Result != "" && out.Result != "success" {
+			out.Phase = "failed"
+		}
+	}
+
+	if data, err := exec.Command("journalctl",
+		"-u", repairUnitName,
+		"--no-pager", "-n", "100", "-o", "cat",
+	).CombinedOutput(); err == nil {
+		lines := strings.Split(strings.TrimRight(string(data), "\n"), "\n")
+		if !(len(lines) == 1 && (lines[0] == "" || strings.HasPrefix(lines[0], "-- No entries"))) {
+			out.Log = lines
+		}
+	}
+	return out
+}
+
+// findNode liefert die ha_nodes-Row mit der gegebenen ID.
+func findNode(nodes []models.HANode, id string) *models.HANode {
+	for i := range nodes {
+		if nodes[i].ID == id {
+			return &nodes[i]
+		}
+	}
+	return nil
+}
+
+// findOtherPeer liefert den (einen) anderen Node im 2-Node-Cluster.
+// Bevorzugt einen online erreichbaren Peer.
+func findOtherPeer(nodes []models.HANode, localID string) *models.HANode {
+	var fallback *models.HANode
+	for i := range nodes {
+		n := &nodes[i]
+		if n.ID == localID {
+			continue
+		}
+		if n.Status == "online" {
+			return n
+		}
+		if fallback == nil {
+			fallback = n
+		}
+	}
+	return fallback
+}
+
+// pickPrimaryHost wählt die beste erreichbare Adresse eines Node:
+// Mgmt-IP → Internal-IP → Public-IP → FQDN. Strippt eine etwaige
+// CIDR-Maske (inet-Spalten können "10.0.0.5/32" liefern).
+func pickPrimaryHost(n *models.HANode) string {
+	if n == nil {
+		return ""
+	}
+	for _, cand := range []*string{n.MgmtIP, n.InternalIP, n.PublicIP} {
+		if cand != nil {
+			if h := strings.TrimSpace(strings.SplitN(*cand, "/", 2)[0]); h != "" {
+				return h
+			}
+		}
+	}
+	return strings.TrimSpace(n.FQDN)
+}
+
+// repairUnitState gibt den ActiveState der Repair-Unit zurück ("" wenn
+// unbekannt). Für den Doppelstart-Schutz.
+func repairUnitState() string {
+	out, err := exec.Command("systemctl", "show", repairUnitName, "--no-page", "-p", "ActiveState").CombinedOutput()
+	if err != nil {
+		return ""
+	}
+	for _, line := range strings.Split(string(out), "\n") {
+		if kv := strings.SplitN(strings.TrimSpace(line), "=", 2); len(kv) == 2 && kv[0] == "ActiveState" {
+			return kv[1]
+		}
+	}
+	return ""
+}

internal/handlers/cluster_rollingupdate.go

@@ -0,0 +1,258 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const rollingUpdateStateFile = "/var/lib/edgeguard/rolling-update-state.json"
+
+const (
+	phaseIdle              = "idle"
+	phaseUpdatingSecondary = "updating-secondary"
+	phaseWaitingSecondary  = "waiting-secondary"
+	phaseUpdatingPrimary   = "updating-primary"
+	phaseDone              = "done"
+	phaseFailed            = "failed"
+)
+
+// FinishRollingUpdateIfPending wird beim API-Start aufgerufen. Wenn die
+// State-Datei "updating-primary" enthält, bedeutet das dass der Primary
+// gerade erfolgreich neugestartet ist → Update abgeschlossen → "done" schreiben.
+func FinishRollingUpdateIfPending() {
+	st := readRollingUpdateState()
+	if st.Phase == phaseUpdatingPrimary {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseDone,
+			SecondaryID:   st.SecondaryID,
+			SecondaryFQDN: st.SecondaryFQDN,
+		})
+	}
+}
+
+// RollingUpdateState hält den Fortschritt des Rolling-Updates.
+// Persistiert in rollingUpdateStateFile damit der Status über
+// einen kurzen API-Neustart hinaus lesbar bleibt.
+type RollingUpdateState struct {
+	Phase         string    `json:"phase"`
+	SecondaryID   string    `json:"secondary_id,omitempty"`
+	SecondaryFQDN string    `json:"secondary_fqdn,omitempty"`
+	StartedAt     time.Time `json:"started_at,omitempty"`
+	UpdatedAt     time.Time `json:"updated_at"`
+	Error         string    `json:"error,omitempty"`
+}
+
+func readRollingUpdateState() RollingUpdateState {
+	data, err := os.ReadFile(rollingUpdateStateFile)
+	if err != nil {
+		return RollingUpdateState{Phase: phaseIdle, UpdatedAt: time.Now()}
+	}
+	var s RollingUpdateState
+	if err := json.Unmarshal(data, &s); err != nil {
+		return RollingUpdateState{Phase: phaseIdle, UpdatedAt: time.Now()}
+	}
+	return s
+}
+
+func writeRollingUpdateState(s RollingUpdateState) {
+	s.UpdatedAt = time.Now()
+	data, err := json.Marshal(s)
+	if err != nil {
+		slog.Warn("rolling-update: failed to marshal state", "error", err)
+		return
+	}
+	if err := os.WriteFile(rollingUpdateStateFile, data, 0o600); err != nil {
+		slog.Warn("rolling-update: failed to write state file", "error", err)
+	}
+}
+
+// RollingUpdate startet den Rolling-Update-Prozess:
+// 1. Secondary aktualisieren (via mTLS /agent/cluster/trigger-update)
+// 2. Warten bis Secondary neue Version meldet
+// 3. Primary (dieser Node) aktualisieren (wie /system/upgrade)
+//
+// Kein Cluster vorhanden → 409 zurück damit der Client auf /system/upgrade
+// ausweichen kann. Wenn bereits ein Rolling-Update läuft → aktuellen State.
+func (h *ClusterHandler) RollingUpdate(c *gin.Context) {
+	if h.Aggregator == nil || h.Store == nil {
+		c.JSON(http.StatusConflict, gin.H{"error": "no cluster — use /system/upgrade"})
+		return
+	}
+
+	st := readRollingUpdateState()
+	if st.Phase != phaseIdle && st.Phase != phaseFailed && st.Phase != phaseDone {
+		response.OK(c, st)
+		return
+	}
+
+	nodes, err := h.Store.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	var secondary *models.HANode
+	for i := range nodes {
+		if nodes[i].ID != h.LocalID {
+			secondary = &nodes[i]
+			break
+		}
+	}
+	if secondary == nil {
+		c.JSON(http.StatusConflict, gin.H{"error": "no peer node — use /system/upgrade"})
+		return
+	}
+
+	newState := RollingUpdateState{
+		Phase:         phaseUpdatingSecondary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+		StartedAt:     time.Now(),
+	}
+	writeRollingUpdateState(newState)
+	slog.Info("rolling-update: started", "secondary", secondary.FQDN)
+
+	go h.runRollingUpdate(secondary)
+
+	c.JSON(http.StatusAccepted, newState)
+}
+
+// RollingUpdateStatus gibt den aktuellen Rolling-Update-State zurück.
+// Bei phase == "done" wird nach Auslieferung sofort auf idle zurückgesetzt
+// damit der nächste Pageload keinen Stale-done vorfindet.
+func (h *ClusterHandler) RollingUpdateStatus(c *gin.Context) {
+	st := readRollingUpdateState()
+	response.OK(c, st)
+	if st.Phase == phaseDone {
+		writeRollingUpdateState(RollingUpdateState{Phase: phaseIdle})
+	}
+}
+
+func (h *ClusterHandler) runRollingUpdate(secondary *models.HANode) {
+	ctx := context.Background()
+
+	// 1. Secondary triggern
+	slog.Info("rolling-update: posting trigger-update to secondary", "fqdn", secondary.FQDN)
+	result := h.Aggregator.PostPeer(ctx, *secondary, "/agent/cluster/trigger-update")
+	if !result.OK {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "trigger-update failed: " + result.Err,
+		})
+		slog.Warn("rolling-update: secondary trigger failed", "error", result.Err)
+		return
+	}
+
+	// 2. Secondary-Version pollen — der Secondary restartet nach dem
+	//    Upgrade, danach zeigt /agent/cluster/version eine neue Version.
+	writeRollingUpdateState(RollingUpdateState{
+		Phase:         phaseWaitingSecondary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+	})
+	slog.Info("rolling-update: waiting for secondary version flip")
+
+	// Kurze Wartezeit damit apt auf dem Secondary erst losläuft
+	time.Sleep(20 * time.Second)
+
+	deadline := time.Now().Add(10 * time.Minute)
+	versionFlipped := false
+	for time.Now().Before(deadline) {
+		results := h.Aggregator.FanOut(ctx, []models.HANode{*secondary}, "/agent/cluster/version", h.LocalID)
+		if len(results) > 0 && results[0].OK {
+			var ver struct {
+				Version string `json:"version"`
+			}
+			if err := json.Unmarshal(results[0].Data, &ver); err == nil {
+				slog.Info("rolling-update: secondary version", "version", ver.Version, "primary", h.Version)
+				if ver.Version != h.Version {
+					versionFlipped = true
+					break
+				}
+			}
+		}
+		time.Sleep(10 * time.Second)
+	}
+
+	if !versionFlipped {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "timeout (10 min) waiting for secondary version flip",
+		})
+		slog.Warn("rolling-update: secondary version flip timeout")
+		return
+	}
+
+	// 3. Primary (uns selbst) aktualisieren — identisch zu /system/upgrade
+	writeRollingUpdateState(RollingUpdateState{
+		Phase:         phaseUpdatingPrimary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+	})
+	slog.Info("rolling-update: triggering primary self-upgrade")
+
+	const scriptPath = "/var/lib/edgeguard/upgrade.sh"
+	const script = `#!/bin/bash
+set -e
+sleep 2
+export DEBIAN_FRONTEND=noninteractive
+dpkg --configure -a || true
+retry_apt() {
+    local attempt=0 max=3 wait_for=15
+    while [ $attempt -lt $max ]; do
+        attempt=$((attempt + 1))
+        apt-get update -qq || true
+        if apt-get install -y -qq -o Dpkg::Options::=--force-confold \
+            edgeguard-api edgeguard-ui edgeguard; then return 0; fi
+        [ $attempt -lt $max ] && sleep $wait_for && wait_for=$((wait_for * 2))
+    done
+    return 1
+}
+retry_apt
+echo "[upgrade] complete"
+rm -f /var/lib/edgeguard/upgrade.sh
+`
+	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "write upgrade script: " + err.Error(),
+		})
+		return
+	}
+
+	const unitName = "edgeguard-upgrade.service"
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", unitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+unitName,
+		"--description=EdgeGuard self-upgrade",
+		"--collect",
+		"bash", scriptPath)
+	if err := cmd.Run(); err != nil {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "systemd-run failed: " + err.Error(),
+		})
+		slog.Warn("rolling-update: primary systemd-run failed", "error", err)
+		return
+	}
+	// State bleibt "updating-primary" — der Primary restartet gleich.
+	// UI erkennt Version-Flip via /system/health und schließt den Flow.
+	slog.Info("rolling-update: primary upgrade dispatched, process will restart")
+}

internal/handlers/cluster_viptest.go

@@ -0,0 +1,319 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"os/exec"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+// vipInfo enthält die für einen VIP-Schwenk notwendigen Daten.
+type vipInfo struct {
+	ID      int64  `json:"id"`
+	Address string `json:"address"`
+	Prefix  int    `json:"prefix"`
+	Device  string `json:"device"`
+}
+
+// VIPStatusEntry kombiniert einen VIP mit den Nodes die ihn gerade halten.
+type VIPStatusEntry struct {
+	VIP      vipInfo  `json:"vip"`
+	ActiveOn []string `json:"active_on"` // FQDNs der Nodes mit diesem VIP
+}
+
+// AgentActiveIPs gibt alle aktiven IPv4-Adressen dieses Nodes zurück.
+// Wird vom Primary genutzt um zu prüfen welcher Node welchen VIP hält.
+func (h *ClusterHandler) AgentActiveIPs(c *gin.Context) {
+	ips, err := localActiveIPs()
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"ips": ips})
+}
+
+// vipCmdRequest ist der Body für den AgentVIPCmd-Endpoint.
+type vipCmdRequest struct {
+	Action  string `json:"action"`  // "add" | "del"
+	Address string `json:"address"` // z.B. "10.0.5.1"
+	Prefix  int    `json:"prefix"`  // z.B. 24
+	Device  string `json:"device"`  // z.B. "vlan100"
+}
+
+// AgentVIPCmd führt `ip addr add/del` auf diesem Node aus.
+// Wird vom Primary via mTLS für VIP-Schwenk-Tests aufgerufen.
+func (h *ClusterHandler) AgentVIPCmd(c *gin.Context) {
+	var req vipCmdRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.Action != "add" && req.Action != "del" {
+		response.BadRequest(c, simpleError("action must be 'add' or 'del'"))
+		return
+	}
+	if req.Address == "" || req.Device == "" || req.Prefix <= 0 || req.Prefix > 128 {
+		response.BadRequest(c, simpleError("address, device, prefix required"))
+		return
+	}
+	if err := runVIPCmd(req.Action, req.Address, req.Prefix, req.Device); err != nil {
+		slog.Warn("cluster: agent vip-cmd failed",
+			"action", req.Action, "addr", req.Address, "dev", req.Device, "error", err)
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: agent vip-cmd ok",
+		"action", req.Action, "addr", req.Address, "prefix", req.Prefix,
+		"dev", req.Device, "caller", c.ClientIP())
+	response.OK(c, gin.H{"ok": true})
+}
+
+// VIPStatus liest alle VIPs (is_vip=true) aus der DB und fragt alle Nodes
+// welche davon sie gerade aktiv haben. Nur sinnvoll im Cluster-Modus.
+func (h *ClusterHandler) VIPStatus(c *gin.Context) {
+	vips, err := loadVIPs(c.Request.Context(), h.Store.Pool)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	nodeIPs := h.collectActiveIPs(c.Request.Context())
+	result := make([]VIPStatusEntry, 0, len(vips))
+	for _, v := range vips {
+		entry := VIPStatusEntry{VIP: v}
+		for fqdn, ips := range nodeIPs {
+			for _, ip := range ips {
+				if ip == v.Address {
+					entry.ActiveOn = append(entry.ActiveOn, fqdn)
+					break
+				}
+			}
+		}
+		result = append(result, entry)
+	}
+	response.OK(c, gin.H{"vips": result})
+}
+
+// vipTestRequest steuert einen VIP-Schwenk.
+type vipTestRequest struct {
+	IPAddressID int64  `json:"ip_address_id"`
+	Action      string `json:"action"` // "to_secondary" | "restore"
+}
+
+// vipTestStep beschreibt einen Schritt des Schwenk-Prozesses.
+type vipTestStep struct {
+	Step    string `json:"step"`
+	OK      bool   `json:"ok"`
+	Message string `json:"message,omitempty"`
+}
+
+// VIPTest schwenkt einen VIP vom Primary auf den Secondary ("to_secondary")
+// oder zurück ("restore"). Nur vom Primary aufzurufen.
+func (h *ClusterHandler) VIPTest(c *gin.Context) {
+	var req vipTestRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.Action != "to_secondary" && req.Action != "restore" {
+		response.BadRequest(c, simpleError("action must be 'to_secondary' or 'restore'"))
+		return
+	}
+
+	vips, err := loadVIPs(c.Request.Context(), h.Store.Pool)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	var target *vipInfo
+	for i := range vips {
+		if vips[i].ID == req.IPAddressID {
+			target = &vips[i]
+			break
+		}
+	}
+	if target == nil {
+		response.NotFound(c, simpleError("VIP not found or not marked as VIP"))
+		return
+	}
+
+	all, err := h.Store.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	var peer *models.HANode
+	for i := range all {
+		if all[i].ID != h.LocalID {
+			peer = &all[i]
+			break
+		}
+	}
+	if peer == nil {
+		response.BadRequest(c, simpleError("kein Secondary-Peer gefunden"))
+		return
+	}
+
+	var steps []vipTestStep
+	addrPfx := fmt.Sprintf("%s/%d", target.Address, target.Prefix)
+
+	if req.Action == "to_secondary" {
+		// 1. VIP auf Secondary via mTLS hinzufügen
+		steps = append(steps, h.peerVIPCmd(c.Request.Context(), *peer, target, "add",
+			fmt.Sprintf("add %s dev %s auf %s", addrPfx, target.Device, peer.FQDN)))
+		// 2. VIP vom Primary entfernen (nur wenn Secondary-Add erfolgreich)
+		if steps[0].OK {
+			steps = append(steps, localVIPStep(target, "del",
+				fmt.Sprintf("del %s dev %s lokal", addrPfx, target.Device)))
+		}
+	} else {
+		// 1. VIP auf Primary zurückholen
+		steps = append(steps, localVIPStep(target, "add",
+			fmt.Sprintf("add %s dev %s lokal", addrPfx, target.Device)))
+		// 2. VIP auf Secondary entfernen
+		steps = append(steps, h.peerVIPCmd(c.Request.Context(), *peer, target, "del",
+			fmt.Sprintf("del %s dev %s auf %s", addrPfx, target.Device, peer.FQDN)))
+	}
+
+	slog.Info("cluster: vip-test", "action", req.Action, "vip", target.Address,
+		"dev", target.Device, "peer", peer.FQDN, "actor", actorOf(c))
+	response.OK(c, gin.H{"steps": steps})
+}
+
+// ── Hilfsfunktionen ───────────────────────────────────────────────────────
+
+func loadVIPs(ctx context.Context, pool *pgxpool.Pool) ([]vipInfo, error) {
+	rows, err := pool.Query(ctx, `
+		SELECT ia.id, ia.address, ia.prefix, ni.name
+		FROM ip_addresses ia
+		JOIN network_interfaces ni ON ni.id = ia.interface_id
+		WHERE ia.is_vip = true AND ia.active = true
+		ORDER BY ni.name, ia.address`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []vipInfo
+	for rows.Next() {
+		var v vipInfo
+		if err := rows.Scan(&v.ID, &v.Address, &v.Prefix, &v.Device); err != nil {
+			return nil, err
+		}
+		out = append(out, v)
+	}
+	return out, rows.Err()
+}
+
+// collectActiveIPs fragt alle Cluster-Nodes (lokal + Peers via mTLS) nach
+// ihren aktiven IPv4-Adressen und gibt eine Map[fqdn][]ip zurück.
+func (h *ClusterHandler) collectActiveIPs(ctx context.Context) map[string][]string {
+	result := make(map[string][]string)
+	if h.Store == nil {
+		return result
+	}
+	all, err := h.Store.List(ctx)
+	if err != nil {
+		return result
+	}
+	// Lokaler Node
+	if ips, err := localActiveIPs(); err == nil {
+		for _, n := range all {
+			if n.ID == h.LocalID {
+				result[n.FQDN] = ips
+				break
+			}
+		}
+	}
+	// Peers via mTLS-Aggregator
+	if h.Aggregator != nil {
+		var peers []models.HANode
+		for _, n := range all {
+			if n.ID != h.LocalID {
+				peers = append(peers, n)
+			}
+		}
+		if len(peers) > 0 {
+			peerResults := h.Aggregator.FanOut(ctx, peers, "/agent/cluster/active-ips", h.LocalID)
+			for _, pr := range peerResults {
+				if !pr.OK || len(pr.Data) == 0 {
+					continue
+				}
+				var payload struct {
+					IPs []string `json:"ips"`
+				}
+				if err := json.Unmarshal(pr.Data, &payload); err == nil {
+					result[pr.FQDN] = payload.IPs
+				}
+			}
+		}
+	}
+	return result
+}
+
+// localActiveIPs liest alle aktiven IPv4-Adressen des lokalen Nodes via `ip`.
+func localActiveIPs() ([]string, error) {
+	out, err := exec.Command("ip", "-4", "-o", "addr", "show").Output()
+	if err != nil {
+		return nil, err
+	}
+	var ips []string
+	for _, line := range strings.Split(string(out), "\n") {
+		parts := strings.Fields(line)
+		for i, p := range parts {
+			if p == "inet" && i+1 < len(parts) {
+				addr := strings.SplitN(parts[i+1], "/", 2)[0]
+				ips = append(ips, addr)
+			}
+		}
+	}
+	return ips, nil
+}
+
+// peerVIPCmd ruft AgentVIPCmd auf dem Peer via mTLS auf.
+func (h *ClusterHandler) peerVIPCmd(ctx context.Context, peer models.HANode, vip *vipInfo, action, stepLabel string) vipTestStep {
+	step := vipTestStep{Step: stepLabel}
+	if h.Aggregator == nil {
+		step.Message = "aggregator nicht verfügbar"
+		return step
+	}
+	body, _ := json.Marshal(vipCmdRequest{
+		Action:  action,
+		Address: vip.Address,
+		Prefix:  vip.Prefix,
+		Device:  vip.Device,
+	})
+	res := h.Aggregator.PostPeerWithBody(ctx, peer, "/agent/cluster/vip-cmd", body)
+	step.OK = res.OK
+	if !res.OK {
+		step.Message = res.Err
+	}
+	return step
+}
+
+// localVIPStep führt ip addr add/del auf dem lokalen Node aus.
+func localVIPStep(vip *vipInfo, action, stepLabel string) vipTestStep {
+	step := vipTestStep{Step: stepLabel}
+	if err := runVIPCmd(action, vip.Address, vip.Prefix, vip.Device); err != nil {
+		step.Message = err.Error()
+		return step
+	}
+	step.OK = true
+	return step
+}
+
+// runVIPCmd führt `sudo /usr/lib/edgeguard/vip-cmd.sh {action} {addr/prefix} {dev}` aus.
+func runVIPCmd(action, address string, prefix int, device string) error {
+	addrPfx := fmt.Sprintf("%s/%d", address, prefix)
+	out, err := exec.Command("sudo", "-n", "/usr/lib/edgeguard/vip-cmd.sh", action, addrPfx, device).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("vip-cmd.sh %s %s %s: %s", action, addrPfx, device, strings.TrimSpace(string(out)))
+	}
+	return nil
+}

internal/handlers/crowdsec.go

@@ -0,0 +1,285 @@
+package handlers
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	crowdsec "git.netcell-it.de/projekte/edgeguard-native/internal/crowdsec"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+)
+
+// CrowdSecHandler exposes the CrowdSec IDS/IPS management REST API:
+//
+//	GET    /crowdsec/status
+//	GET    /crowdsec/decisions
+//	POST   /crowdsec/decisions
+//	DELETE /crowdsec/decisions         (?ip=<ip> or ?id=<id>)
+//	GET    /crowdsec/alerts
+//	DELETE /crowdsec/alerts/:id
+//	GET    /crowdsec/bouncers
+//	DELETE /crowdsec/bouncers/:name
+//	GET    /crowdsec/machines
+//	DELETE /crowdsec/machines/:id
+//	GET    /crowdsec/collections
+//	POST   /crowdsec/collections/:name/install
+//	DELETE /crowdsec/collections/:name
+type CrowdSecHandler struct {
+	Audit  *audit.Repo
+	NodeID string
+}
+
+// NewCrowdSecHandler returns a CrowdSecHandler wired with audit and node-id.
+func NewCrowdSecHandler(a *audit.Repo, nodeID string) *CrowdSecHandler {
+	return &CrowdSecHandler{Audit: a, NodeID: nodeID}
+}
+
+// Register mounts all CrowdSec routes onto the provided authenticated router
+// group.
+func (h *CrowdSecHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/crowdsec")
+	g.GET("/status", h.Status)
+	g.GET("/decisions", h.ListDecisions)
+	g.POST("/decisions", h.AddDecision)
+	g.DELETE("/decisions", h.DeleteDecision)
+	g.GET("/alerts", h.ListAlerts)
+	g.DELETE("/alerts/:id", h.DeleteAlert)
+	g.GET("/bouncers", h.ListBouncers)
+	g.DELETE("/bouncers/:name", h.DeleteBouncer)
+	g.GET("/machines", h.ListMachines)
+	g.DELETE("/machines/:id", h.DeleteMachine)
+	g.GET("/collections", h.ListCollections)
+	g.POST("/collections/:name/install", h.InstallCollection)
+	g.DELETE("/collections/:name", h.RemoveCollection)
+}
+
+// csNotInstalled responds with 503 when cscli is absent.
+func csNotInstalled(c *gin.Context) {
+	c.JSON(http.StatusServiceUnavailable, gin.H{"error": "crowdsec not installed"})
+}
+
+// ---------- Status ----------------------------------------------------------
+
+// Status returns live status of the CrowdSec agent + bouncer.
+// Does NOT require cscli — uses systemctl for running-state checks.
+func (h *CrowdSecHandler) Status(c *gin.Context) {
+	st := crowdsec.ServiceStatus(c.Request.Context())
+	response.OK(c, st)
+}
+
+// ---------- Decisions -------------------------------------------------------
+
+// ListDecisions returns all active decisions.
+func (h *CrowdSecHandler) ListDecisions(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Decisions(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"decisions": list})
+}
+
+// addDecisionBody is the expected JSON body for POST /crowdsec/decisions.
+type addDecisionBody struct {
+	IP       string `json:"ip"       binding:"required"`
+	Duration string `json:"duration" binding:"required"`
+	Reason   string `json:"reason"`
+	Type     string `json:"type"`
+}
+
+// AddDecision creates a new ban/captcha decision.
+func (h *CrowdSecHandler) AddDecision(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	var body addDecisionBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if body.Reason == "" {
+		body.Reason = "manual ban"
+	}
+	if body.Type == "" {
+		body.Type = "ban"
+	}
+	if err := crowdsec.AddDecision(c.Request.Context(), body.IP, body.Duration, body.Reason, body.Type); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.decision.add", body.IP,
+		gin.H{"duration": body.Duration, "type": body.Type, "reason": body.Reason}, h.NodeID)
+	response.Created(c, gin.H{"ip": body.IP, "duration": body.Duration, "type": body.Type})
+}
+
+// DeleteDecision removes a decision by IP (?ip=) or by ID (?id=).
+func (h *CrowdSecHandler) DeleteDecision(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	ip := c.Query("ip")
+	id := c.Query("id")
+	if ip == "" && id == "" {
+		response.BadRequest(c, errors.New("query parameter 'ip' or 'id' required"))
+		return
+	}
+	var err error
+	var target string
+	if ip != "" {
+		err = crowdsec.DeleteDecisionByIP(c.Request.Context(), ip)
+		target = ip
+	} else {
+		err = crowdsec.DeleteDecisionByID(c.Request.Context(), id)
+		target = id
+	}
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.decision.delete", target, nil, h.NodeID)
+	response.OK(c, gin.H{"deleted": target})
+}
+
+// ---------- Alerts ----------------------------------------------------------
+
+// ListAlerts returns recent CrowdSec alerts.
+func (h *CrowdSecHandler) ListAlerts(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Alerts(c.Request.Context(), 200)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"alerts": list})
+}
+
+// DeleteAlert discards a single alert.
+func (h *CrowdSecHandler) DeleteAlert(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	id := c.Param("id")
+	if err := crowdsec.DeleteAlert(c.Request.Context(), id); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"deleted": id})
+}
+
+// ---------- Bouncers --------------------------------------------------------
+
+// ListBouncers returns all registered bouncers.
+func (h *CrowdSecHandler) ListBouncers(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Bouncers(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"bouncers": list})
+}
+
+// DeleteBouncer removes a bouncer by name.
+func (h *CrowdSecHandler) DeleteBouncer(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	name := c.Param("name")
+	if err := crowdsec.DeleteBouncer(c.Request.Context(), name); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.bouncer.delete", name, nil, h.NodeID)
+	response.OK(c, gin.H{"deleted": name})
+}
+
+// ---------- Machines --------------------------------------------------------
+
+// ListMachines returns all registered machines.
+func (h *CrowdSecHandler) ListMachines(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Machines(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"machines": list})
+}
+
+// DeleteMachine removes a machine by ID.
+func (h *CrowdSecHandler) DeleteMachine(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	id := c.Param("id")
+	if err := crowdsec.DeleteMachine(c.Request.Context(), id); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.machine.delete", id, nil, h.NodeID)
+	response.OK(c, gin.H{"deleted": id})
+}
+
+// ---------- Collections -----------------------------------------------------
+
+// ListCollections returns all hub collections and their install status.
+func (h *CrowdSecHandler) ListCollections(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Collections(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"collections": list})
+}
+
+// InstallCollection installs a hub collection by name.
+func (h *CrowdSecHandler) InstallCollection(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	name := c.Param("name")
+	if err := crowdsec.InstallCollection(c.Request.Context(), name); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.Created(c, gin.H{"installed": name})
+}
+
+// RemoveCollection removes a hub collection by name.
+func (h *CrowdSecHandler) RemoveCollection(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	name := c.Param("name")
+	if err := crowdsec.RemoveCollection(c.Request.Context(), name); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"removed": name})
+}

internal/handlers/dns.go

@@ -3,7 +3,12 @@ package handlers
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log/slog"
+	"net"
+	"os/exec"
+	"strconv"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 
@@ -54,6 +59,8 @@ func (h *DNSHandler) Register(rg *gin.RouterGroup) {
 
 	g.GET("/settings", h.GetSettings)
 	g.PUT("/settings", h.UpdateSettings)
+	g.GET("/stats", h.Stats)
+	g.POST("/flush-cache", h.FlushCache)
 }
 
 // ── Zones ──────────────────────────────────────────────────────
@@ -145,6 +152,8 @@ func (h *DNSHandler) DeleteZone(c *gin.Context) {
 		response.Internal(c, err)
 		return
 	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dns.zone.delete",
+		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
 	response.NoContent(c)
 	h.reload(c.Request.Context(), "zone.delete")
 }
@@ -256,6 +265,8 @@ func (h *DNSHandler) DeleteRecord(c *gin.Context) {
 		response.Internal(c, err)
 		return
 	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dns.record.delete",
+		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
 	response.NoContent(c)
 	h.reload(c.Request.Context(), "record.delete")
 }
@@ -277,6 +288,10 @@ func (h *DNSHandler) UpdateSettings(c *gin.Context) {
 		response.BadRequest(c, err)
 		return
 	}
+	if err := validateSettings(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
 	out, err := h.Repo.UpdateSettings(c.Request.Context(), req)
 	if err != nil {
 		response.Internal(c, err)
@@ -287,8 +302,68 @@ func (h *DNSHandler) UpdateSettings(c *gin.Context) {
 	h.reload(c.Request.Context(), "settings.update")
 }
 
+// FlushCache runs `unbound-control flush_zone .` which discards all
+// cached RRs from the resolver. Useful after DNS propagation or when
+// stale records need to be evicted immediately.
+func (h *DNSHandler) FlushCache(c *gin.Context) {
+	out, err := exec.CommandContext(c.Request.Context(), "/usr/sbin/unbound-control", "flush_zone", ".").CombinedOutput()
+	if err != nil {
+		slog.Error("dns flush-cache failed", "err", err, "out", string(out))
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dns.flush-cache", "unbound", nil, h.NodeID)
+	response.OK(c, gin.H{"message": "cache flushed", "output": string(out)})
+}
+
 // ── Validation ─────────────────────────────────────────────────
 
+// validateSettings checks user-supplied DNS global settings before they
+// reach unbound. A malformed upstream IP or CIDR would cause unbound to
+// fail on the next reload without any visible error.
+func validateSettings(s *models.DNSSettings) error {
+	if s.ListenPort < 1 || s.ListenPort > 65535 {
+		return fmt.Errorf("listen_port %d out of range (1-65535)", s.ListenPort)
+	}
+	if s.CacheMaxTTL < s.CacheMinTTL {
+		return fmt.Errorf("cache_max_ttl (%d) must be ≥ cache_min_ttl (%d)", s.CacheMaxTTL, s.CacheMinTTL)
+	}
+	for _, raw := range strings.Split(s.UpstreamForwards, ",") {
+		entry := strings.TrimSpace(raw)
+		if entry == "" {
+			continue
+		}
+		// strip optional @port suffix (e.g. 1.1.1.1@853)
+		host, _, _ := strings.Cut(entry, "@")
+		if net.ParseIP(host) == nil {
+			return fmt.Errorf("invalid upstream forwarder IP: %q", host)
+		}
+	}
+	for _, raw := range strings.Split(s.AccessACL, ",") {
+		entry := strings.TrimSpace(raw)
+		if entry == "" {
+			continue
+		}
+		if strings.Contains(entry, "/") {
+			if _, _, err := net.ParseCIDR(entry); err != nil {
+				return fmt.Errorf("invalid access ACL CIDR: %q", entry)
+			}
+		} else if net.ParseIP(entry) == nil {
+			return fmt.Errorf("invalid access ACL IP: %q", entry)
+		}
+	}
+	for _, raw := range strings.Split(s.ListenAddresses, ",") {
+		addr := strings.TrimSpace(raw)
+		if addr == "" {
+			continue
+		}
+		if net.ParseIP(addr) == nil {
+			return fmt.Errorf("invalid listen address: %q", addr)
+		}
+	}
+	return nil
+}
+
 func validateZone(z *models.DNSZone) error {
 	if z.Name == "" {
 		return errors.New("name required")
@@ -309,6 +384,71 @@ func validateZone(z *models.DNSZone) error {
 	return nil
 }
 
+// Stats liefert Unbound-Resolver-Statistiken via `unbound-control stats_noreset`.
+// stats_noreset liest die Zähler ohne sie zurückzusetzen — safe für
+// wiederholte Aufrufe aus dem UI.
+func (h *DNSHandler) Stats(c *gin.Context) {
+	out, err := exec.Command("/usr/sbin/unbound-control", "stats_noreset").Output()
+	if err != nil {
+		response.OK(c, gin.H{
+			"error": "unbound-control nicht verfügbar: " + err.Error(),
+		})
+		return
+	}
+	response.OK(c, gin.H{"stats": parseUnboundStats(string(out))})
+}
+
+type unboundStats struct {
+	TotalQueries     int64   `json:"total_queries"`
+	CacheHits        int64   `json:"cache_hits"`
+	CacheMiss        int64   `json:"cache_miss"`
+	CacheHitPct      float64 `json:"cache_hit_pct"`
+	RecursiveReplies int64   `json:"recursive_replies"`
+	Prefetch         int64   `json:"prefetch"`
+	RateLimited      int64   `json:"rate_limited"`
+	RRSetCacheBytes  int64   `json:"rrset_cache_bytes"`
+	MsgCacheBytes    int64   `json:"msg_cache_bytes"`
+	TCPUsage         int64   `json:"tcp_usage"`
+	Unwanted         int64   `json:"unwanted"`
+}
+
+func parseUnboundStats(out string) unboundStats {
+	s := unboundStats{}
+	for _, line := range strings.Split(out, "\n") {
+		k, v, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		n, _ := strconv.ParseInt(strings.TrimSpace(v), 10, 64)
+		switch strings.TrimSpace(k) {
+		case "total.num.queries":
+			s.TotalQueries = n
+		case "total.num.cachehits":
+			s.CacheHits = n
+		case "total.num.cachemiss":
+			s.CacheMiss = n
+		case "total.num.recursivereplies":
+			s.RecursiveReplies = n
+		case "total.num.prefetch":
+			s.Prefetch = n
+		case "total.num.queries_ip_ratelimited":
+			s.RateLimited = n
+		case "mem.cache.rrset":
+			s.RRSetCacheBytes = n
+		case "mem.cache.message":
+			s.MsgCacheBytes = n
+		case "total.tcpusage":
+			s.TCPUsage = n
+		case "unwanted.queries":
+			s.Unwanted = n
+		}
+	}
+	if s.TotalQueries > 0 {
+		s.CacheHitPct = float64(s.CacheHits) / float64(s.TotalQueries) * 100
+	}
+	return s
+}
+
 func validateRecord(r *models.DNSRecord) error {
 	if r.Name == "" {
 		return errors.New("name required")

internal/handlers/domains.go

@@ -11,6 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domainheaders"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domains"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/routingrules"
 )
@@ -18,6 +19,7 @@ import (
 type DomainsHandler struct {
 	Repo    *domains.Repo
 	Routing *routingrules.Repo
+	Headers *domainheaders.Repo
 	Audit   *audit.Repo
 	NodeID  string
 
@@ -29,8 +31,8 @@ type DomainsHandler struct {
 	Reloader func(ctx context.Context) error
 }
 
-func NewDomainsHandler(repo *domains.Repo, routing *routingrules.Repo, a *audit.Repo, nodeID string, reloader func(context.Context) error) *DomainsHandler {
-	return &DomainsHandler{Repo: repo, Routing: routing, Audit: a, NodeID: nodeID, Reloader: reloader}
+func NewDomainsHandler(repo *domains.Repo, routing *routingrules.Repo, headers *domainheaders.Repo, a *audit.Repo, nodeID string, reloader func(context.Context) error) *DomainsHandler {
+	return &DomainsHandler{Repo: repo, Routing: routing, Headers: headers, Audit: a, NodeID: nodeID, Reloader: reloader}
 }
 
 func (h *DomainsHandler) reload(ctx context.Context, op string) {
@@ -50,6 +52,11 @@ func (h *DomainsHandler) Register(rg *gin.RouterGroup) {
 	g.PUT("/:id", h.Update)
 	g.DELETE("/:id", h.Delete)
 	g.GET("/:id/routing-rules", h.ListRoutingRules)
+
+	g.GET("/:id/headers", h.ListHeaders)
+	g.POST("/:id/headers", h.CreateHeader)
+	g.PUT("/:id/headers/:hid", h.UpdateHeader)
+	g.DELETE("/:id/headers/:hid", h.DeleteHeader)
 }
 
 func (h *DomainsHandler) List(c *gin.Context) {
@@ -161,6 +168,127 @@ func parseID(c *gin.Context) (int64, bool) {
 	return id, true
 }
 
+// ── Response-Header CRUD ──────────────────────────────────────────────
+//
+// Header werden über `http-response set-header` von HAProxy gesetzt
+// (siehe internal/haproxy/haproxy.cfg.tpl). Name ist case-insensitive
+// unique pro Domain — Doppel-Eintrag erkennt PG selbst via Unique-Index
+// und liefert 409 zurück.
+
+func (h *DomainsHandler) ListHeaders(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	out, err := h.Headers.ListForDomain(c.Request.Context(), id)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"headers": out})
+}
+
+func (h *DomainsHandler) CreateHeader(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req models.DomainResponseHeader
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	req.DomainID = id
+	if !validHeaderName(req.Name) {
+		response.BadRequest(c, errors.New("invalid header name"))
+		return
+	}
+	out, err := h.Headers.Create(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "domain.header.create", out.Name, out, h.NodeID)
+	response.Created(c, out); h.reload(c.Request.Context(), "header.create")
+}
+
+func (h *DomainsHandler) UpdateHeader(c *gin.Context) {
+	domainID, ok := parseID(c)
+	if !ok {
+		return
+	}
+	hid, err := strconv.ParseInt(c.Param("hid"), 10, 64)
+	if err != nil {
+		response.BadRequest(c, errors.New("invalid header id"))
+		return
+	}
+	var req models.DomainResponseHeader
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if !validHeaderName(req.Name) {
+		response.BadRequest(c, errors.New("invalid header name"))
+		return
+	}
+	out, err := h.Headers.Update(c.Request.Context(), domainID, hid, req)
+	if err != nil {
+		if errors.Is(err, domainheaders.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "domain.header.update", out.Name, out, h.NodeID)
+	response.OK(c, out); h.reload(c.Request.Context(), "header.update")
+}
+
+func (h *DomainsHandler) DeleteHeader(c *gin.Context) {
+	_, ok := parseID(c)
+	if !ok {
+		return
+	}
+	hid, err := strconv.ParseInt(c.Param("hid"), 10, 64)
+	if err != nil {
+		response.BadRequest(c, errors.New("invalid header id"))
+		return
+	}
+	if err := h.Headers.Delete(c.Request.Context(), hid); err != nil {
+		if errors.Is(err, domainheaders.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "domain.header.delete",
+		strconv.FormatInt(hid, 10), gin.H{"id": hid}, h.NodeID)
+	response.NoContent(c); h.reload(c.Request.Context(), "header.delete")
+}
+
+// validHeaderName: RFC 7230 token chars. Wir engen das auf eine
+// vernünftige Untermenge ein (a-z A-Z 0-9 + `-`), damit niemand
+// versehentlich Newlines oder Quotes in den HAProxy-Renderer schiebt
+// und die Config-Datei sprengt.
+func validHeaderName(name string) bool {
+	if name == "" || len(name) > 100 {
+		return false
+	}
+	for _, r := range name {
+		switch {
+		case r >= 'a' && r <= 'z',
+			r >= 'A' && r <= 'Z',
+			r >= '0' && r <= '9',
+			r == '-':
+			// ok
+		default:
+			return false
+		}
+	}
+	return true
+}
+
 func actorOf(c *gin.Context) string {
 	if t := CurrentToken(c); t != nil {
 		return t.Actor

internal/handlers/firewall.go

@@ -96,6 +96,7 @@ func (h *FirewallHandler) Register(rg *gin.RouterGroup) {
 	g := rg.Group("/firewall")
 
 	g.GET("/auto-rules", h.AutoRules)
+	g.GET("/counters", h.Counters)
 
 	zn := g.Group("/zones")
 	zn.GET("", h.ListZone)
@@ -137,6 +138,7 @@ func (h *FirewallHandler) Register(rg *gin.RouterGroup) {
 	rl.POST("", h.CreateRule)
 	rl.GET("/:id", h.GetRule)
 	rl.PUT("/:id", h.UpdateRule)
+	rl.PATCH("/:id", h.PatchRule)
 	rl.DELETE("/:id", h.DeleteRule)
 
 	nat := g.Group("/nat-rules")
@@ -144,6 +146,7 @@ func (h *FirewallHandler) Register(rg *gin.RouterGroup) {
 	nat.POST("", h.CreateNAT)
 	nat.GET("/:id", h.GetNAT)
 	nat.PUT("/:id", h.UpdateNAT)
+	nat.PATCH("/:id", h.PatchNAT)
 	nat.DELETE("/:id", h.DeleteNAT)
 }
 
@@ -757,6 +760,48 @@ func (h *FirewallHandler) DeleteRule(c *gin.Context) {
 	response.NoContent(c); h.reload(c.Request.Context(), "delete")
 }
 
+func (h *FirewallHandler) PatchRule(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var body struct {
+		Note   *string  `json:"note"`
+		Labels []string `json:"labels"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	ctx := c.Request.Context()
+	if body.Note != nil {
+		if err := h.Rules.PatchNote(ctx, id, *body.Note); err != nil {
+			if errors.Is(err, firewall.ErrRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	if body.Labels != nil {
+		if err := h.Rules.PatchLabels(ctx, id, body.Labels); err != nil {
+			if errors.Is(err, firewall.ErrRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	out, err := h.Rules.Get(ctx, id)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, out)
+}
+
 // ── NAT Rules ──────────────────────────────────────────────────────────
 
 func (h *FirewallHandler) ListNAT(c *gin.Context) {
@@ -857,6 +902,48 @@ func (h *FirewallHandler) DeleteNAT(c *gin.Context) {
 	response.NoContent(c); h.reload(c.Request.Context(), "delete")
 }
 
+func (h *FirewallHandler) PatchNAT(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var body struct {
+		Note   *string  `json:"note"`
+		Labels []string `json:"labels"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	ctx := c.Request.Context()
+	if body.Note != nil {
+		if err := h.NATRules.PatchNote(ctx, id, *body.Note); err != nil {
+			if errors.Is(err, firewall.ErrNATRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	if body.Labels != nil {
+		if err := h.NATRules.PatchLabels(ctx, id, body.Labels); err != nil {
+			if errors.Is(err, firewall.ErrNATRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	out, err := h.NATRules.Get(ctx, id)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, out)
+}
+
 // ── Validators ─────────────────────────────────────────────────────────
 
 func validateAddrObjValue(kind, value string) error {

internal/handlers/firewall_counters.go

@@ -0,0 +1,63 @@
+package handlers
+
+import (
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+)
+
+// ruleCounter is one operator-defined firewall rule's live packet/byte
+// counter. The nft ruleset template marks each rule with
+// `counter … comment "egid:<id>"` so we can correlate the counter
+// values back to DB rule IDs.
+type ruleCounter struct {
+	RuleID  int64 `json:"rule_id"`
+	Packets int64 `json:"packets"`
+	Bytes   int64 `json:"bytes"`
+}
+
+var (
+	reEgid    = regexp.MustCompile(`comment "egid:(\d+)"`)
+	reCounter = regexp.MustCompile(`\bcounter packets (\d+) bytes (\d+)\b`)
+)
+
+// Counters reads live hit-counters from the running nft ruleset.
+// Runs `sudo -n /usr/sbin/nft list table inet edgeguard` (already
+// allowed by the postinst sudoers rule) and parses each rule line
+// for the `counter packets N bytes M … comment "egid:X"` pattern
+// that the ruleset template emits.
+func (h *FirewallHandler) Counters(c *gin.Context) {
+	out, err := exec.Command("sudo", "-n", "/usr/sbin/nft", "list", "table", "inet", "edgeguard").CombinedOutput()
+	if err != nil {
+		response.OK(c, gin.H{
+			"counters": []ruleCounter{},
+			"error":    strings.TrimSpace(string(out)),
+		})
+		return
+	}
+	response.OK(c, gin.H{"counters": parseNFTCounters(string(out))})
+}
+
+func parseNFTCounters(output string) []ruleCounter {
+	var out []ruleCounter
+	for _, line := range strings.Split(output, "\n") {
+		mID := reEgid.FindStringSubmatch(line)
+		mCnt := reCounter.FindStringSubmatch(line)
+		if mID == nil || mCnt == nil {
+			continue
+		}
+		id, err1 := strconv.ParseInt(mID[1], 10, 64)
+		pkts, err2 := strconv.ParseInt(mCnt[1], 10, 64)
+		byts, err3 := strconv.ParseInt(mCnt[2], 10, 64)
+		if err1 != nil || err2 != nil || err3 != nil {
+			continue
+		}
+		out = append(out, ruleCounter{RuleID: id, Packets: pkts, Bytes: byts})
+	}
+	return out
+}

internal/handlers/firewall_counters_test.go

@@ -0,0 +1,70 @@
+package handlers
+
+import (
+	"testing"
+)
+
+func TestParseNFTCounters_ParsesCounterAndEgid(t *testing.T) {
+	// nft list output shows `counter packets N bytes M` with actual values
+	// (zero when unused). Template emits `counter <action> comment "egid:X"`;
+	// nft expands that to `counter packets N bytes M <action> comment "egid:X"`.
+	input := `
+table inet edgeguard {
+    chain input {
+        type filter hook input priority 0; policy drop;
+        tcp dport 22 ct state new limit rate 10/minute accept comment "anti-lockout: SSH"
+        tcp dport 80 counter packets 0 bytes 0 accept comment "egid:1"
+        ip saddr 10.0.0.0/8 tcp dport 443 counter packets 1234 bytes 567890 accept comment "egid:2"
+        ip saddr 1.2.3.4 drop comment "egid:3"
+        tcp dport 8080 log prefix "edgeguard:4 " group 0 counter packets 7 bytes 420 reject comment "egid:4"
+    }
+}
+`
+	counters := parseNFTCounters(input)
+
+	if len(counters) != 3 {
+		t.Fatalf("expected 3 counters (egid:1,2,4), got %d: %+v", len(counters), counters)
+	}
+
+	byID := map[int64]ruleCounter{}
+	for _, c := range counters {
+		byID[c.RuleID] = c
+	}
+
+	// egid:1 — zero counters are valid
+	if c, ok := byID[1]; !ok {
+		t.Error("missing counter for egid:1")
+	} else if c.Packets != 0 || c.Bytes != 0 {
+		t.Errorf("egid:1 want packets=0 bytes=0, got packets=%d bytes=%d", c.Packets, c.Bytes)
+	}
+
+	// egid:2 — non-zero counters
+	if c, ok := byID[2]; !ok {
+		t.Error("missing counter for egid:2")
+	} else if c.Packets != 1234 || c.Bytes != 567890 {
+		t.Errorf("egid:2 want packets=1234 bytes=567890, got packets=%d bytes=%d", c.Packets, c.Bytes)
+	}
+
+	// egid:3 — line has no counter keyword → must not appear
+	if _, ok := byID[3]; ok {
+		t.Error("egid:3 has no counter statement and must not appear in output")
+	}
+
+	// egid:4 — counter + log + reject
+	if _, ok := byID[4]; !ok {
+		t.Error("missing counter for egid:4")
+	}
+}
+
+func TestParseNFTCounters_EmptyOutput(t *testing.T) {
+	if counters := parseNFTCounters(""); len(counters) != 0 {
+		t.Errorf("expected empty result, got %+v", counters)
+	}
+}
+
+func TestParseNFTCounters_NoRules(t *testing.T) {
+	input := "table inet edgeguard {\n    chain input {\n    }\n}\n"
+	if counters := parseNFTCounters(input); len(counters) != 0 {
+		t.Errorf("expected empty result for table with no operator rules, got %+v", counters)
+	}
+}

internal/handlers/forwardproxy.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"errors"
 	"log/slog"
+	"os/exec"
 	"strconv"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 
@@ -35,7 +37,12 @@ func (h *ForwardProxyHandler) reload(ctx context.Context, op string) {
 }
 
 func (h *ForwardProxyHandler) Register(rg *gin.RouterGroup) {
-	g := rg.Group("/forward-proxy/acls")
+	base := rg.Group("/forward-proxy")
+	base.GET("/stats", h.Stats)
+	base.GET("/settings", h.GetSettings)
+	base.PUT("/settings", h.UpdateSettings)
+
+	g := base.Group("/acls")
 	g.GET("", h.List)
 	g.POST("", h.Create)
 	g.GET("/:id", h.Get)
@@ -43,6 +50,34 @@ func (h *ForwardProxyHandler) Register(rg *gin.RouterGroup) {
 	g.DELETE("/:id", h.Delete)
 }
 
+func (h *ForwardProxyHandler) GetSettings(c *gin.Context) {
+	s, err := h.Repo.GetSettings(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, s)
+}
+
+func (h *ForwardProxyHandler) UpdateSettings(c *gin.Context) {
+	var req models.ForwardProxySettings
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.ListenPort <= 0 || req.ListenPort > 65535 {
+		req.ListenPort = 3128
+	}
+	out, err := h.Repo.UpdateSettings(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "forward_proxy.settings.update", "settings", out, h.NodeID)
+	response.OK(c, out)
+	h.reload(c.Request.Context(), "settings.update")
+}
+
 func (h *ForwardProxyHandler) List(c *gin.Context) {
 	out, err := h.Repo.List(c.Request.Context())
 	if err != nil {
@@ -135,6 +170,68 @@ func (h *ForwardProxyHandler) Delete(c *gin.Context) {
 	h.reload(c.Request.Context(), "delete")
 }
 
+// Stats liefert Squid-Cache-Statistiken via `squidclient mgr:counters`.
+// Die Ausgabe enthält HTTP-Header gefolgt von key = value Zeilen.
+func (h *ForwardProxyHandler) Stats(c *gin.Context) {
+	out, err := exec.Command("squidclient", "-h", "127.0.0.1", "-p", "3128", "mgr:counters").Output()
+	if err != nil {
+		response.OK(c, gin.H{
+			"error": "squidclient nicht verfügbar: " + err.Error(),
+		})
+		return
+	}
+	response.OK(c, gin.H{"stats": parseSquidCounters(string(out))})
+}
+
+type squidStats struct {
+	ClientRequests int64   `json:"client_requests"`
+	CacheHits      int64   `json:"cache_hits"`
+	CacheHitPct    float64 `json:"cache_hit_pct"`
+	ClientErrors   int64   `json:"client_errors"`
+	BytesIn        int64   `json:"bytes_in"`
+	BytesOut       int64   `json:"bytes_out"`
+	ServerRequests int64   `json:"server_requests"`
+	ServerErrors   int64   `json:"server_errors"`
+}
+
+func parseSquidCounters(out string) squidStats {
+	// squidclient prefixes an HTTP response header block — skip it.
+	body := out
+	if idx := strings.Index(out, "\r\n\r\n"); idx >= 0 {
+		body = out[idx+4:]
+	} else if idx := strings.Index(out, "\n\n"); idx >= 0 {
+		body = out[idx+2:]
+	}
+	s := squidStats{}
+	for _, line := range strings.Split(body, "\n") {
+		k, v, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		n, _ := strconv.ParseInt(strings.TrimSpace(v), 10, 64)
+		switch strings.TrimSpace(k) {
+		case "client_http.requests":
+			s.ClientRequests = n
+		case "client_http.hits":
+			s.CacheHits = n
+		case "client_http.errors":
+			s.ClientErrors = n
+		case "client_http.kbytes_in":
+			s.BytesIn = n * 1024
+		case "client_http.kbytes_out":
+			s.BytesOut = n * 1024
+		case "server.all.requests":
+			s.ServerRequests = n
+		case "server.all.errors":
+			s.ServerErrors = n
+		}
+	}
+	if s.ClientRequests > 0 {
+		s.CacheHitPct = float64(s.CacheHits) / float64(s.ClientRequests) * 100
+	}
+	return s
+}
+
 // validateACL prüft Name (squid-konform), action, acl_type. Squid
 // nimmt viele Typen — wir whitelisten die, die in einem Forward-
 // Proxy-Setup üblich sind, damit Tippfehler nicht beim reload

internal/handlers/haproxy_stats.go

@@ -32,14 +32,29 @@ const haproxyAdminSock = "/run/haproxy/admin.sock"
 // 'show stat' CSV. We only emit the fields the dashboard cares
 // about — full CSV is ~80 columns of which 90% are noise here.
 type backendStat struct {
-	Backend string `json:"backend"`         // pxname
-	Server  string `json:"server"`          // svname
-	Status  string `json:"status"`          // UP|DOWN|MAINT|...
-	Sessions int64 `json:"sessions"`        // current sessions (scur)
-	BIn     int64  `json:"bytes_in"`
-	BOut    int64  `json:"bytes_out"`
-	LastChg int64  `json:"last_change_sec"` // seconds since last status change
-	Health  string `json:"health,omitempty"` // check_status (e.g. L7OK)
+	Backend  string `json:"backend"`          // pxname
+	Server   string `json:"server"`           // svname
+	Status   string `json:"status"`           // UP|DOWN|MAINT|...
+	Sessions int64  `json:"sessions"`         // current sessions (scur)
+	BIn      int64  `json:"bytes_in"`
+	BOut     int64  `json:"bytes_out"`
+	ReqTot   int64  `json:"req_tot"`          // total requests since start (req_tot)
+	ReqRate  int64  `json:"req_rate"`         // requests/s last second (req_rate, server-level)
+	LastChg  int64  `json:"last_change_sec"`  // seconds since last status change
+	Health   string `json:"health,omitempty"` // check_status (e.g. L7OK)
+}
+
+// frontendStat holds per-listener traffic counters from HAProxy's
+// show-stat CSV. Gives the operator a global view of how much HTTP(S)
+// traffic is flowing through the gateway.
+type frontendStat struct {
+	Name     string `json:"name"`      // pxname (e.g. "https_in", "http_in")
+	Sessions int64  `json:"sessions"`  // current sessions (scur)
+	MaxSess  int64  `json:"max_sess"`  // maximum concurrent sessions since start (smax)
+	BIn      int64  `json:"bytes_in"`
+	BOut     int64  `json:"bytes_out"`
+	ReqTot   int64  `json:"req_tot"`  // total requests since start
+	ReqRate  int64  `json:"req_rate"` // requests/s last second
 }
 
 func (h *HAProxyStatsHandler) Stats(c *gin.Context) {
@@ -47,13 +62,13 @@ func (h *HAProxyStatsHandler) Stats(c *gin.Context) {
 	if err != nil {
 		// Socket nicht erreichbar (haproxy down oder no perm) →
 		// leere Liste statt 500 damit das Dashboard nicht rot wird.
-		response.OK(c, gin.H{"backends": []backendStat{}, "error": err.Error()})
+		response.OK(c, gin.H{"backends": []backendStat{}, "frontends": []frontendStat{}, "error": err.Error()})
 		return
 	}
 	defer conn.Close()
 	_ = conn.SetDeadline(time.Now().Add(3 * time.Second))
 	if _, err := conn.Write([]byte("show stat\n")); err != nil {
-		response.OK(c, gin.H{"backends": []backendStat{}, "error": err.Error()})
+		response.OK(c, gin.H{"backends": []backendStat{}, "frontends": []frontendStat{}, "error": err.Error()})
 		return
 	}
 
@@ -61,7 +76,8 @@ func (h *HAProxyStatsHandler) Stats(c *gin.Context) {
 	// "# pxname,svname,..." — die nutzen wir um Spalten-Indizes
 	// zu finden, weil das Format zwischen Versionen wechseln kann.
 	colIdx := map[string]int{}
-	out := []backendStat{}
+	backends := []backendStat{}
+	frontends := []frontendStat{}
 
 	scanner := bufio.NewScanner(conn)
 	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
@@ -79,34 +95,49 @@ func (h *HAProxyStatsHandler) Stats(c *gin.Context) {
 			}
 			continue
 		}
-		// Skip frontend rows + the "BACKEND" summary row — we want
-		// the per-server view ("L4OK", "L7OK", etc.).
 		svname := safeAt(fields, colIdx["svname"])
 		pxname := safeAt(fields, colIdx["pxname"])
-		if svname == "" || svname == "FRONTEND" || svname == "BACKEND" {
+
+		// Skip internal infrastructure rows and the BACKEND summary row.
+		// api_backend = management API; rl_* = rate-limit stick-tables (no servers).
+		if pxname == "internal_stats" || pxname == "api_backend" ||
+			strings.HasPrefix(pxname, "rl_") || svname == "BACKEND" || svname == "" {
 			continue
 		}
-		// Skip our internal api_backend stats listener and frontends.
-		if pxname == "internal_stats" {
+
+		if svname == "FRONTEND" {
+			// Collect frontend (listener) counters.
+			frontends = append(frontends, frontendStat{
+				Name:     pxname,
+				Sessions: parseInt64(safeAt(fields, colIdx["scur"])),
+				MaxSess:  parseInt64(safeAt(fields, colIdx["smax"])),
+				BIn:      parseInt64(safeAt(fields, colIdx["bin"])),
+				BOut:     parseInt64(safeAt(fields, colIdx["bout"])),
+				ReqTot:   parseInt64(safeAt(fields, colIdx["req_tot"])),
+				ReqRate:  parseInt64(safeAt(fields, colIdx["req_rate"])),
+			})
 			continue
 		}
-		st := backendStat{
+
+		// Per-server backend row.
+		backends = append(backends, backendStat{
 			Backend:  pxname,
 			Server:   svname,
 			Status:   safeAt(fields, colIdx["status"]),
 			Sessions: parseInt64(safeAt(fields, colIdx["scur"])),
 			BIn:      parseInt64(safeAt(fields, colIdx["bin"])),
 			BOut:     parseInt64(safeAt(fields, colIdx["bout"])),
+			ReqTot:   parseInt64(safeAt(fields, colIdx["req_tot"])),
+			ReqRate:  parseInt64(safeAt(fields, colIdx["req_rate"])),
 			LastChg:  parseInt64(safeAt(fields, colIdx["lastchg"])),
 			Health:   safeAt(fields, colIdx["check_status"]),
-		}
-		out = append(out, st)
+		})
 	}
-	response.OK(c, gin.H{"backends": out})
+	response.OK(c, gin.H{"backends": backends, "frontends": frontends})
 }
 
 func safeAt(fields []string, i int) string {
-	if i <= 0 || i >= len(fields) {
+	if i < 0 || i >= len(fields) {
 		return ""
 	}
 	return fields[i]

internal/handlers/ipaddresses.go

@@ -1,7 +1,9 @@
 package handlers
 
 import (
+	"context"
 	"errors"
+	"log/slog"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
@@ -13,13 +15,27 @@ import (
 )
 
 type IPAddressesHandler struct {
-	Repo   *ipaddresses.Repo
-	Audit  *audit.Repo
-	NodeID string
+	Repo      *ipaddresses.Repo
+	Generator *ipaddresses.Generator
+	Audit     *audit.Repo
+	NodeID    string
 }
 
 func NewIPAddressesHandler(repo *ipaddresses.Repo, a *audit.Repo, nodeID string) *IPAddressesHandler {
-	return &IPAddressesHandler{Repo: repo, Audit: a, NodeID: nodeID}
+	return &IPAddressesHandler{
+		Repo:      repo,
+		Generator: ipaddresses.NewGenerator(repo),
+		Audit:     a,
+		NodeID:    nodeID,
+	}
+}
+
+func (h *IPAddressesHandler) applyAsync() {
+	go func() {
+		if err := h.Generator.Render(context.Background()); err != nil {
+			slog.Warn("ip-addresses: apply failed", "error", err)
+		}
+	}()
 }
 
 func (h *IPAddressesHandler) Register(rg *gin.RouterGroup) {
@@ -70,6 +86,7 @@ func (h *IPAddressesHandler) Create(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.create",
 		req.Address, out, h.NodeID)
+	h.applyAsync()
 	response.Created(c, out)
 }
 
@@ -94,6 +111,7 @@ func (h *IPAddressesHandler) Update(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.update",
 		out.Address, out, h.NodeID)
+	h.applyAsync()
 	response.OK(c, out)
 }
 
@@ -112,5 +130,6 @@ func (h *IPAddressesHandler) Delete(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.delete",
 		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	h.applyAsync()
 	response.NoContent(c)
 }

internal/handlers/middleware.go

@@ -117,4 +117,27 @@ func tokenFromRequest(c *gin.Context) string {
 	return ""
 }
 
+// RequireAdminForMutations blocks non-GET/HEAD requests from non-admin
+// users. GET and HEAD are always allowed for authenticated users so
+// read-only ("viewer") accounts can browse all data. Every state-
+// changing request (POST, PUT, PATCH, DELETE) requires role="admin".
+//
+// Must be mounted AFTER RequireAuth so the token is already in context.
+func RequireAdminForMutations() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		m := c.Request.Method
+		if m == http.MethodGet || m == http.MethodHead || m == http.MethodOptions {
+			c.Next()
+			return
+		}
+		tok := CurrentToken(c)
+		if tok == nil || tok.Role != "admin" {
+			response.Err(c, http.StatusForbidden, errors.New("admin_required"))
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
 func ptr[T any](v T) *T { return &v }

internal/handlers/networks.go

@@ -1,7 +1,9 @@
 package handlers
 
 import (
+	"context"
 	"errors"
+	"log/slog"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
@@ -15,18 +17,34 @@ import (
 )
 
 type NetworksHandler struct {
-	Repo   *networkifs.Repo
-	IPs    *ipaddresses.Repo
-	Zones  *firewall.ZonesRepo
-	Audit  *audit.Repo
-	NodeID string
+	Repo      *networkifs.Repo
+	Generator *networkifs.Generator
+	IPs       *ipaddresses.Repo
+	Zones     *firewall.ZonesRepo
+	Audit     *audit.Repo
+	NodeID    string
 }
 
 func NewNetworksHandler(
 	repo *networkifs.Repo, ips *ipaddresses.Repo,
 	zones *firewall.ZonesRepo, a *audit.Repo, nodeID string,
 ) *NetworksHandler {
-	return &NetworksHandler{Repo: repo, IPs: ips, Zones: zones, Audit: a, NodeID: nodeID}
+	return &NetworksHandler{
+		Repo:      repo,
+		Generator: networkifs.NewGenerator(repo),
+		IPs:       ips,
+		Zones:     zones,
+		Audit:     a,
+		NodeID:    nodeID,
+	}
+}
+
+func (h *NetworksHandler) applyAsync() {
+	go func() {
+		if err := h.Generator.Render(context.Background()); err != nil {
+			slog.Warn("network-interfaces: apply failed", "error", err)
+		}
+	}()
 }
 
 func (h *NetworksHandler) Register(rg *gin.RouterGroup) {
@@ -88,6 +106,7 @@ func (h *NetworksHandler) Create(c *gin.Context) {
 		return
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.create", req.Name, out, h.NodeID)
+	h.applyAsync()
 	response.Created(c, out)
 }
 
@@ -122,6 +141,7 @@ func (h *NetworksHandler) Update(c *gin.Context) {
 		return
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.update", out.Name, out, h.NodeID)
+	h.applyAsync()
 	response.OK(c, out)
 }
 
@@ -140,6 +160,7 @@ func (h *NetworksHandler) Delete(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.delete",
 		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	h.applyAsync()
 	response.NoContent(c)
 }
 

internal/handlers/ntp.go

@@ -3,7 +3,11 @@ package handlers
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log/slog"
+	"os/exec"
+	"strconv"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 
@@ -37,6 +41,9 @@ func (h *NTPHandler) Register(rg *gin.RouterGroup) {
 	g := rg.Group("/ntp")
 	g.GET("/settings", h.GetSettings)
 	g.PUT("/settings", h.UpdateSettings)
+	g.GET("/status", h.Status)
+	g.GET("/sources", h.Sources)
+	g.POST("/force-sync", h.ForceSync)
 
 	p := g.Group("/pools")
 	p.GET("", h.ListPools)
@@ -46,6 +53,74 @@ func (h *NTPHandler) Register(rg *gin.RouterGroup) {
 	p.DELETE("/:id", h.DeletePool)
 }
 
+// Status liefert den aktuellen chrony-Tracking-Status via `chronyc tracking`.
+// Output-Felder: synced (bool), reference (Quell-Server), stratum (int),
+// offset_ms (float), freq_ppm (float), rms_offset_ms (float), error (string
+// wenn chronyc nicht verfügbar oder System-Takt nicht sync'd).
+func (h *NTPHandler) Status(c *gin.Context) {
+	out, err := exec.Command("chronyc", "tracking").Output()
+	if err != nil {
+		response.OK(c, gin.H{
+			"synced":    false,
+			"error":     "chronyc nicht verfügbar: " + err.Error(),
+		})
+		return
+	}
+	resp := parseChronyTracking(string(out))
+	response.OK(c, resp)
+}
+
+type chronyStatus struct {
+	Synced       bool    `json:"synced"`
+	Reference    string  `json:"reference"`
+	Stratum      int     `json:"stratum"`
+	OffsetMs     float64 `json:"offset_ms"`
+	FreqPPM      float64 `json:"freq_ppm"`
+	RMSOffsetMs  float64 `json:"rms_offset_ms"`
+	Error        string  `json:"error,omitempty"`
+}
+
+func parseChronyTracking(out string) chronyStatus {
+	s := chronyStatus{}
+	for _, line := range strings.Split(out, "\n") {
+		line = strings.TrimSpace(line)
+		key, val, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		key = strings.TrimSpace(key)
+		val = strings.TrimSpace(val)
+		switch key {
+		case "Reference ID":
+			// "Reference ID    : A29FC801 (time.cloudflare.com)"
+			if i := strings.Index(val, "("); i >= 0 {
+				s.Reference = strings.Trim(val[i:], "()")
+			} else {
+				s.Reference = val
+			}
+			s.Synced = val != "00000000 ()"
+		case "Stratum":
+			fmt.Sscanf(val, "%d", &s.Stratum)
+			if s.Stratum > 0 && s.Stratum < 16 {
+				s.Synced = true
+			}
+		case "System time":
+			// "0.000012345 seconds fast of NTP time"
+			var v float64
+			fmt.Sscanf(val, "%f", &v)
+			s.OffsetMs = v * 1000
+		case "Frequency":
+			// "-12.345 ppm slow" or "+12.345 ppm fast"
+			fmt.Sscanf(val, "%f", &s.FreqPPM)
+		case "RMS offset":
+			var v float64
+			fmt.Sscanf(val, "%f", &v)
+			s.RMSOffsetMs = v * 1000
+		}
+	}
+	return s
+}
+
 func (h *NTPHandler) GetSettings(c *gin.Context) {
 	s, err := h.Repo.GetSettings(c.Request.Context())
 	if err != nil {
@@ -158,10 +233,95 @@ func (h *NTPHandler) DeletePool(c *gin.Context) {
 		response.Internal(c, err)
 		return
 	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ntp.pool.delete",
+		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
 	response.NoContent(c)
 	h.reload(c.Request.Context(), "pool.delete")
 }
 
+// ForceSync runs `chronyc makestep` which immediately adjusts the
+// system clock to the current NTP reference. Useful after a long
+// outage or VM migration where the clock has drifted by more than
+// the 1ms default slew threshold.
+func (h *NTPHandler) ForceSync(c *gin.Context) {
+	out, err := exec.Command("chronyc", "makestep").CombinedOutput()
+	if err != nil {
+		slog.Error("ntp force-sync failed", "err", err, "out", string(out))
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ntp.force-sync", "chrony", nil, h.NodeID)
+	response.OK(c, gin.H{"message": "clock stepped", "output": string(out)})
+}
+
+// Sources liefert die aktuellen NTP-Quellen via `chronyc sources`.
+// Jede Zeile wird in ein NTPSource-Objekt geparst und als Array zurückgegeben.
+func (h *NTPHandler) Sources(c *gin.Context) {
+	out, err := exec.Command("chronyc", "sources").Output()
+	if err != nil {
+		response.OK(c, gin.H{
+			"sources": []any{},
+			"error":   "chronyc nicht verfügbar: " + err.Error(),
+		})
+		return
+	}
+	response.OK(c, gin.H{"sources": parseChronymSources(string(out))})
+}
+
+type ntpSource struct {
+	Mode    string `json:"mode"`
+	State   string `json:"state"`
+	Active  bool   `json:"active"`
+	Name    string `json:"name"`
+	Stratum int    `json:"stratum"`
+	Poll    int    `json:"poll"`
+	Reach   string `json:"reach"`
+	LastRx  string `json:"last_rx"`
+	Sample  string `json:"sample"`
+}
+
+func parseChronymSources(out string) []ntpSource {
+	modeMap := map[byte]string{'^': "server", '=': "peer", '#': "local"}
+	stateMap := map[byte]string{
+		'*': "synced", '+': "combined", '-': "not_combined",
+		'?': "unreachable", 'x': "error", '~': "variable",
+	}
+	var srcs []ntpSource
+	for _, line := range strings.Split(out, "\n") {
+		if len(line) < 2 {
+			continue
+		}
+		mode, ok := modeMap[line[0]]
+		if !ok {
+			continue
+		}
+		stateChar := line[1]
+		stateStr, ok := stateMap[stateChar]
+		if !ok {
+			stateStr = string(stateChar)
+		}
+		fields := strings.Fields(strings.TrimSpace(line[2:]))
+		if len(fields) < 5 {
+			continue
+		}
+		src := ntpSource{
+			Mode:   mode,
+			State:  stateStr,
+			Active: stateChar == '*' || stateChar == '+',
+			Name:   fields[0],
+			Reach:  fields[3],
+			LastRx: fields[4],
+		}
+		fmt.Sscanf(fields[1], "%d", &src.Stratum)
+		fmt.Sscanf(fields[2], "%d", &src.Poll)
+		if len(fields) >= 6 {
+			src.Sample = strings.Join(fields[5:], " ")
+		}
+		srcs = append(srcs, src)
+	}
+	return srcs
+}
+
 func validateNTPPool(p *models.NTPPool) error {
 	if p.Address == "" {
 		return errors.New("address required")

internal/handlers/oidc.go

@@ -0,0 +1,349 @@
+package handlers
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/oauth2"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	oidcsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/oidc"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/session"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
+	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+)
+
+// OIDC / Keycloak SSO. Additiv zum lokalen Passwort-Login. Regeln:
+//   - kein Auto-Provisioning (E-Mail muss als User existieren),
+//   - Rolle kommt aus der DB-Row (nie aus dem Token),
+//   - lokaler Login + TOTP bleiben unangetastet.
+//
+// Flow-State (state/PKCE-verifier/nonce) liegt stateless in einem 5-min
+// signierten HttpOnly-Cookie (SameSite=Lax, da der IdP-Redirect ein
+// top-level cross-site GET ist). Nach Erfolg wird dieselbe Session wie
+// beim lokalen Login ausgestellt (setSessionCookie + Signer).
+
+const (
+	oidcFlowCookie = "edgeguard_oidc_flow"
+	oidcFlowTTL    = 5 * time.Minute
+)
+
+type OIDCHandler struct {
+	Repo   *oidcsvc.Repo
+	Auth   oidcsvc.Authenticator
+	Users  *usersvc.Repo
+	Signer *session.Signer
+	Setup  *setup.Store
+	Audit  *audit.Repo
+	NodeID string
+}
+
+func NewOIDCHandler(repo *oidcsvc.Repo, auth oidcsvc.Authenticator, users *usersvc.Repo, signer *session.Signer, setupStore *setup.Store) *OIDCHandler {
+	return &OIDCHandler{Repo: repo, Auth: auth, Users: users, Signer: signer, Setup: setupStore}
+}
+
+func (h *OIDCHandler) WithAudit(a *audit.Repo, nodeID string) *OIDCHandler {
+	h.Audit = a
+	h.NodeID = nodeID
+	return h
+}
+
+// RegisterPublic mountet die unauth. Endpoints (auf v1, hinter SetupGate).
+func (h *OIDCHandler) RegisterPublic(rg *gin.RouterGroup) {
+	g := rg.Group("/auth/oidc")
+	g.GET("/settings", h.PublicSettings)
+	g.GET("/login", h.Login)
+	g.GET("/callback", h.Callback)
+}
+
+// RegisterAdmin mountet die Admin-Endpoints (auf authed: requireAuth +
+// RequireAdminForMutations → GET für alle, PUT nur admin).
+func (h *OIDCHandler) RegisterAdmin(rg *gin.RouterGroup) {
+	g := rg.Group("/oidc")
+	g.GET("/settings", h.GetSettings)
+	g.PUT("/settings", h.UpdateSettings)
+}
+
+// PublicSettings: nur, was die Login-Seite braucht.
+func (h *OIDCHandler) PublicSettings(c *gin.Context) {
+	s, err := h.Repo.Get(c.Request.Context())
+	if err != nil {
+		// Kein Datensatz/kein DB → SSO einfach „aus".
+		response.OK(c, gin.H{"enabled": false, "button_label": ""})
+		return
+	}
+	response.OK(c, gin.H{"enabled": s.Enabled, "button_label": s.ButtonLabel})
+}
+
+// GetSettings: Admin-Sicht ohne Secret, mit secret_configured + redirect_uri.
+func (h *OIDCHandler) GetSettings(c *gin.Context) {
+	s, err := h.Repo.Get(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	hasSecret, _ := h.Repo.HasSecret(c.Request.Context())
+	response.OK(c, gin.H{
+		"enabled":          s.Enabled,
+		"issuer_url":       s.IssuerURL,
+		"client_id":        s.ClientID,
+		"scopes":           s.Scopes,
+		"email_claim":      s.EmailClaim,
+		"button_label":     s.ButtonLabel,
+		"secret_configured": hasSecret,
+		"redirect_uri":     h.redirectURI(c),
+	})
+}
+
+type oidcUpdateBody struct {
+	Enabled      bool    `json:"enabled"`
+	IssuerURL    string  `json:"issuer_url"`
+	ClientID     string  `json:"client_id"`
+	ClientSecret *string `json:"client_secret"` // nil = unverändert, "" = löschen
+	Scopes       string  `json:"scopes"`
+	EmailClaim   string  `json:"email_claim"`
+	ButtonLabel  string  `json:"button_label"`
+}
+
+// UpdateSettings: PUT (admin via RequireAdminForMutations).
+func (h *OIDCHandler) UpdateSettings(c *gin.Context) {
+	var body oidcUpdateBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	body.IssuerURL = strings.TrimSpace(body.IssuerURL)
+	body.ClientID = strings.TrimSpace(body.ClientID)
+	if body.Scopes == "" {
+		body.Scopes = "openid email profile"
+	}
+	if body.EmailClaim == "" {
+		body.EmailClaim = "email"
+	}
+	if body.ButtonLabel == "" {
+		body.ButtonLabel = "Sign in with SSO"
+	}
+
+	if body.Enabled {
+		if body.IssuerURL == "" || body.ClientID == "" {
+			response.BadRequest(c, errors.New("issuer_url und client_id sind erforderlich, wenn OIDC aktiviert ist"))
+			return
+		}
+		if u, err := url.Parse(body.IssuerURL); err != nil || u.Scheme != "https" || u.Host == "" {
+			response.BadRequest(c, errors.New("issuer_url muss eine gültige https-URL sein"))
+			return
+		}
+		hasSecret, _ := h.Repo.HasSecret(c.Request.Context())
+		providing := body.ClientSecret != nil && *body.ClientSecret != ""
+		if !hasSecret && !providing {
+			response.BadRequest(c, errors.New("client_secret ist erforderlich (noch keins gespeichert)"))
+			return
+		}
+	}
+
+	if err := h.Repo.Update(c.Request.Context(), oidcsvc.UpdateInput{
+		Enabled:      body.Enabled,
+		IssuerURL:    body.IssuerURL,
+		ClientID:     body.ClientID,
+		Scopes:       body.Scopes,
+		EmailClaim:   body.EmailClaim,
+		ButtonLabel:  body.ButtonLabel,
+		ClientSecret: body.ClientSecret,
+	}); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	h.audit(c, actorOf(c), "oidc.settings.updated", actorOf(c),
+		gin.H{"enabled": body.Enabled, "issuer": body.IssuerURL})
+	response.OK(c, gin.H{"ok": true})
+}
+
+// Login: 302 zum IdP. Setzt das signierte Flow-Cookie.
+func (h *OIDCHandler) Login(c *gin.Context) {
+	ctx := c.Request.Context()
+	s, err := h.Repo.Get(ctx)
+	if err != nil || !s.Enabled {
+		h.fail(c, "disabled")
+		return
+	}
+	state, err1 := randToken(24)
+	nonce, err2 := randToken(24)
+	if err1 != nil || err2 != nil {
+		h.fail(c, "server")
+		return
+	}
+	verifier := oauth2.GenerateVerifier()
+	redirectURI := h.redirectURI(c)
+
+	authURL, err := h.Auth.AuthCodeURL(ctx, redirectURI, state, nonce, verifier)
+	if err != nil {
+		h.fail(c, "config")
+		return
+	}
+
+	blob, _ := json.Marshal(oidcFlow{State: state, Verifier: verifier, Nonce: nonce})
+	signed, err := h.Signer.SignBlob(blob, oidcFlowTTL)
+	if err != nil {
+		h.fail(c, "server")
+		return
+	}
+	h.setFlowCookie(c, signed)
+	c.Redirect(http.StatusFound, authURL)
+}
+
+// Callback: verifiziert Flow + Token, mappt auf DB-User, stellt Session aus.
+func (h *OIDCHandler) Callback(c *gin.Context) {
+	ctx := c.Request.Context()
+
+	// Flow-Cookie lesen + sofort entwerten (single-use).
+	rawFlow, _ := c.Cookie(oidcFlowCookie)
+	h.clearFlowCookie(c)
+	if rawFlow == "" {
+		h.fail(c, "expired")
+		return
+	}
+	payload, err := h.Signer.VerifyBlob(rawFlow)
+	if err != nil {
+		h.fail(c, "expired")
+		return
+	}
+	var flow oidcFlow
+	if json.Unmarshal(payload, &flow) != nil {
+		h.fail(c, "expired")
+		return
+	}
+
+	if c.Query("error") != "" {
+		h.fail(c, "denied")
+		return
+	}
+	if subtle.ConstantTimeCompare([]byte(c.Query("state")), []byte(flow.State)) != 1 {
+		h.fail(c, "state")
+		return
+	}
+	code := c.Query("code")
+	if code == "" {
+		h.fail(c, "exchange")
+		return
+	}
+
+	claims, err := h.Auth.Exchange(ctx, h.redirectURI(c), code, flow.Verifier)
+	if err != nil {
+		h.fail(c, "token")
+		return
+	}
+	if subtle.ConstantTimeCompare([]byte(claims.Nonce), []byte(flow.Nonce)) != 1 {
+		h.fail(c, "nonce")
+		return
+	}
+	if !claims.EmailVerified || claims.Email == "" {
+		h.audit(c, claims.Email, "auth.login.failed", claims.Email,
+			gin.H{"via": "oidc", "reason": "email_unverified", "remote": c.ClientIP()})
+		h.fail(c, "unverified")
+		return
+	}
+
+	u, _, err := h.Users.FindByEmail(ctx, claims.Email)
+	if err != nil {
+		reason := "oidc_no_account"
+		if !errors.Is(err, usersvc.ErrNotFound) {
+			reason = "server"
+		}
+		h.audit(c, claims.Email, "auth.login.failed", claims.Email,
+			gin.H{"via": "oidc", "reason": reason, "remote": c.ClientIP()})
+		h.fail(c, map[bool]string{true: "no_account", false: "server"}[reason == "oidc_no_account"])
+		return
+	}
+	if !u.Active {
+		h.audit(c, u.Email, "auth.login.failed", u.Email,
+			gin.H{"via": "oidc", "reason": "account_disabled", "remote": c.ClientIP()})
+		h.fail(c, "disabled")
+		return
+	}
+
+	// Opportunistisches sub-Linking + Schutz gegen E-Mail-Reassignment.
+	if stored, err := h.Users.GetOIDCSubject(ctx, u.ID); err == nil {
+		if stored != "" && stored != claims.Subject {
+			h.audit(c, u.Email, "auth.login.failed", u.Email,
+				gin.H{"via": "oidc", "reason": "subject_mismatch", "remote": c.ClientIP()})
+			h.fail(c, "subject_mismatch")
+			return
+		}
+		if stored == "" {
+			_ = h.Users.SetOIDCSubject(ctx, u.ID, claims.Subject)
+		}
+	}
+
+	h.Users.RecordLogin(ctx, u.ID)
+
+	// Rolle STRIKT aus der DB-Row (nie aus Claims).
+	raw, tok, err := h.Signer.IssueWithRole(u.Email, u.Role)
+	if err != nil {
+		h.fail(c, "server")
+		return
+	}
+	setSessionCookie(c, raw, tok.Exp)
+	h.audit(c, u.Email, "auth.login.success", u.Email,
+		gin.H{"via": "oidc", "role": u.Role, "remote": c.ClientIP()})
+	c.Redirect(http.StatusFound, "/dashboard")
+}
+
+// ── Helpers ──────────────────────────────────────────────────────────
+
+type oidcFlow struct {
+	State    string `json:"s"`
+	Verifier string `json:"v"`
+	Nonce    string `json:"n"`
+}
+
+// redirectURI = https://<FQDN>/api/v1/auth/oidc/callback (FQDN aus setup.json,
+// Fallback Request-Host). Muss im IdP als Redirect-URI registriert sein.
+func (h *OIDCHandler) redirectURI(c *gin.Context) string {
+	host := ""
+	if h.Setup != nil {
+		if st, err := h.Setup.Load(); err == nil && st != nil {
+			host = strings.TrimSpace(st.FQDN)
+		}
+	}
+	if host == "" {
+		host = c.Request.Host
+	}
+	return "https://" + host + "/api/v1/auth/oidc/callback"
+}
+
+func (h *OIDCHandler) fail(c *gin.Context, reason string) {
+	c.Redirect(http.StatusFound, "/login?sso_error="+url.QueryEscape(reason))
+}
+
+func (h *OIDCHandler) audit(c *gin.Context, actor, action, subject string, detail any) {
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actor, action, subject, detail, h.NodeID)
+	}
+}
+
+func (h *OIDCHandler) setFlowCookie(c *gin.Context, raw string) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(oidcFlowCookie, raw, int(oidcFlowTTL.Seconds()), "/", "", true, true)
+}
+
+func (h *OIDCHandler) clearFlowCookie(c *gin.Context) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(oidcFlowCookie, "", -1, "/", "", true, true)
+}
+
+func randToken(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(b), nil
+}

internal/handlers/oidc_test.go

@@ -0,0 +1,202 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	oidcsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/oidc"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/session"
+	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+)
+
+// mockAuth erfüllt oidcsvc.Authenticator und liefert vorgegebene Claims —
+// kein echter IdP nötig.
+type mockAuth struct {
+	claims *oidcsvc.Claims
+	err    error
+}
+
+func (m *mockAuth) AuthCodeURL(_ context.Context, _, state, _, _ string) (string, error) {
+	return "https://idp.example/authorize?state=" + state, nil
+}
+func (m *mockAuth) Exchange(_ context.Context, _, _, _ string) (*oidcsvc.Claims, error) {
+	return m.claims, m.err
+}
+
+func oidcTestSetup(t *testing.T) (*usersvc.Repo, *pgxpool.Pool, *session.Signer) {
+	t.Helper()
+	dsn := os.Getenv("EG_FWTEST_DSN")
+	if dsn == "" {
+		t.Skip("set EG_FWTEST_DSN to run the oidc handler test")
+	}
+	ctx := context.Background()
+	// Retry: goose-Erst-Apply ist nicht concurrency-safe, wenn mehrere
+	// guarded Test-Pakete dieselbe frische DB parallel migrieren.
+	var mErr error
+	for i := 0; i < 3; i++ {
+		if mErr = database.Migrate(ctx, dsn); mErr == nil {
+			break
+		}
+		time.Sleep(700 * time.Millisecond)
+	}
+	if mErr != nil {
+		t.Fatalf("migrate: %v", mErr)
+	}
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	return usersvc.New(pool), pool, session.NewSigner([]byte("0123456789abcdef0123456789abcdef"), nil, 0)
+}
+
+func seedUser(t *testing.T, repo *usersvc.Repo, pool *pgxpool.Pool, email, role string, active bool) {
+	t.Helper()
+	ctx := context.Background()
+	_, _ = pool.Exec(ctx, `DELETE FROM users WHERE email=$1`, email)
+	if _, err := repo.Create(ctx, email, "Sup3rSecret-pw-123", role, active); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+}
+
+func runCallback(t *testing.T, h *OIDCHandler, flow oidcFlow, queryState, code string) *httptest.ResponseRecorder {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	rec := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(rec)
+	blob, _ := json.Marshal(flow)
+	signed, err := h.Signer.SignBlob(blob, oidcFlowTTL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/v1/auth/oidc/callback?state="+queryState+"&code="+code, nil)
+	req.AddCookie(&http.Cookie{Name: oidcFlowCookie, Value: signed})
+	c.Request = req
+	h.Callback(c)
+	return rec
+}
+
+func sessionCookie(rec *httptest.ResponseRecorder) string {
+	for _, ck := range rec.Result().Cookies() {
+		if ck.Name == cookieName && ck.Value != "" && ck.MaxAge >= 0 {
+			return ck.Value
+		}
+	}
+	return ""
+}
+
+func TestCallback_KnownActiveUser_RoleFromDB(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-viewer@test.local", "viewer", true)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-viewer@test.local", EmailVerified: true, Subject: "sub-1", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Verifier: "v", Nonce: "N"}, "S", "code")
+
+	if loc := rec.Header().Get("Location"); loc != "/dashboard" {
+		t.Fatalf("expected redirect to /dashboard, got %q (body proves failure path)", loc)
+	}
+	raw := sessionCookie(rec)
+	if raw == "" {
+		t.Fatal("expected a session cookie to be set")
+	}
+	tok, err := signer.Verify(raw)
+	if err != nil {
+		t.Fatalf("session token invalid: %v", err)
+	}
+	// Kernbeweis: Rolle kommt aus der DB-Row (viewer), nicht aus Claims.
+	if tok.Role != "viewer" {
+		t.Errorf("token role = %q, want viewer (role must come from DB)", tok.Role)
+	}
+	if tok.Actor != "sso-viewer@test.local" {
+		t.Errorf("token actor = %q", tok.Actor)
+	}
+}
+
+func TestCallback_UnknownEmail_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE email=$1`, "ghost@test.local")
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "ghost@test.local", EmailVerified: true, Subject: "x", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=no_account") {
+		t.Fatalf("expected sso_error=no_account, got %q", rec.Header().Get("Location"))
+	}
+	if sessionCookie(rec) != "" {
+		t.Fatal("no session cookie expected for unknown user")
+	}
+}
+
+func TestCallback_InactiveUser_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-disabled@test.local", "admin", false)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-disabled@test.local", EmailVerified: true, Subject: "x", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=disabled") {
+		t.Fatalf("expected sso_error=disabled, got %q", rec.Header().Get("Location"))
+	}
+	if sessionCookie(rec) != "" {
+		t.Fatal("no session cookie expected for inactive user")
+	}
+}
+
+func TestCallback_EmailUnverified_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-unverified@test.local", "admin", true)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-unverified@test.local", EmailVerified: false, Subject: "x", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=unverified") {
+		t.Fatalf("expected sso_error=unverified, got %q", rec.Header().Get("Location"))
+	}
+	if sessionCookie(rec) != "" {
+		t.Fatal("no session cookie expected for unverified email")
+	}
+}
+
+func TestCallback_NonceMismatch_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-nonce@test.local", "admin", true)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-nonce@test.local", EmailVerified: true, Subject: "x", Nonce: "WRONG",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=nonce") {
+		t.Fatalf("expected sso_error=nonce, got %q", rec.Header().Get("Location"))
+	}
+}
+
+func TestCallback_StateMismatch_Rejected(t *testing.T) {
+	users, _, signer := oidcTestSetup(t)
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "WRONG", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=state") {
+		t.Fatalf("expected sso_error=state, got %q", rec.Header().Get("Location"))
+	}
+}

internal/handlers/response/response.go

@@ -82,6 +82,10 @@ func Forbidden(c *gin.Context, err error) {
 	Err(c, http.StatusForbidden, err)
 }
 
+func Conflict(c *gin.Context, err error) {
+	Err(c, http.StatusConflict, err)
+}
+
 func Internal(c *gin.Context, err error) {
 	Err(c, http.StatusInternalServerError, err)
 }

internal/handlers/setup.go

@@ -1,9 +1,20 @@
 package handlers
 
 import (
+	"context"
+	"fmt"
+	"log/slog"
+	"net"
+	"strings"
+	"time"
+
 	"github.com/gin-gonic/gin"
 
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/clusterjoin"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
@@ -11,22 +22,60 @@ import (
 // are mounted before SetupGate so they remain reachable while the API
 // is in setup mode.
 type SetupHandler struct {
-	Store *setup.Store
+	Store        *setup.Store
+	Audit        *audit.Repo
+	NodeID       string
+	Version      string
+	ClusterStore *cluster.Store
+	PeerReloader PeerReloader
 }
 
 func NewSetupHandler(store *setup.Store) *SetupHandler {
 	return &SetupHandler{Store: store}
 }
 
+// WithAudit injiziert Audit-Repo + Node-ID damit Mutationen (contact-emails)
+// in audit_log landen. Optional — wenn Audit nil bleibt, läuft die
+// Mutation, aber ohne Log-Eintrag.
+func (h *SetupHandler) WithAudit(a *audit.Repo, nodeID string) *SetupHandler {
+	h.Audit = a
+	h.NodeID = nodeID
+	return h
+}
+
+// WithVersion macht die laufende Version für auto-register verfügbar.
+func (h *SetupHandler) WithVersion(v string) *SetupHandler {
+	h.Version = v
+	return h
+}
+
+// WithClusterSupport erlaubt dem JoinCluster-Handler nach dem Join den
+// Primary in der lokalen ha_nodes zu registrieren + nftables neu zu laden,
+// damit Port 8443 bidirektional offen ist.
+func (h *SetupHandler) WithClusterSupport(store *cluster.Store, reloader PeerReloader) *SetupHandler {
+	h.ClusterStore = store
+	h.PeerReloader = reloader
+	return h
+}
+
 func (h *SetupHandler) Register(rg *gin.RouterGroup) {
 	g := rg.Group("/setup")
 	g.GET("/status", h.Status)
 	g.POST("/complete", h.Complete)
+	g.POST("/complete-node", h.CompleteAsNode)
+	g.POST("/join-cluster", h.JoinCluster)
+}
+
+// RegisterAuthed mountet die Endpoints die nach abgeschlossenem Setup
+// den Admin-Modus brauchen — Aufrufer hat requireAuth schon dran.
+func (h *SetupHandler) RegisterAuthed(rg *gin.RouterGroup) {
+	g := rg.Group("/setup")
+	g.POST("/contact-emails", h.SetContactEmails)
 }
 
 // Status returns just the public bits of the setup state: whether
-// it's done and (if so) the configured admin_email + fqdn. Never
-// exposes the password hash.
+// it's done and (if so) the configured admin_email + acme_email +
+// fqdn. Never exposes the password hash.
 func (h *SetupHandler) Status(c *gin.Context) {
 	st, err := h.Store.Load()
 	if err != nil {
@@ -36,10 +85,45 @@ func (h *SetupHandler) Status(c *gin.Context) {
 	response.OK(c, gin.H{
 		"completed":   st.Completed,
 		"admin_email": st.AdminEmail,
+		"acme_email":  st.ACMEEmail,
 		"fqdn":        st.FQDN,
 	})
 }
 
+// SetContactEmails: Admin-only Update der zwei E-Mail-Felder.
+// Sessions bleiben aktiv (Cookie referenziert den alten Actor); auf
+// nächstem Login zählt der neue Wert.
+func (h *SetupHandler) SetContactEmails(c *gin.Context) {
+	var req struct {
+		AdminEmail string `json:"admin_email" binding:"required,email"`
+		ACMEEmail  string `json:"acme_email"  binding:"required,email"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if err := h.Store.SetContactEmails(req.AdminEmail, req.ACMEEmail); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	st, err := h.Store.Load()
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actorOf(c), "setup.contact_emails",
+			st.AdminEmail, gin.H{
+				"admin_email": st.AdminEmail,
+				"acme_email":  st.ACMEEmail,
+			}, h.NodeID)
+	}
+	response.OK(c, gin.H{
+		"admin_email": st.AdminEmail,
+		"acme_email":  st.ACMEEmail,
+	})
+}
+
 func (h *SetupHandler) Complete(c *gin.Context) {
 	var req setup.Request
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -57,3 +141,130 @@ func (h *SetupHandler) Complete(c *gin.Context) {
 		"fqdn":        st.FQDN,
 	})
 }
+
+func (h *SetupHandler) CompleteAsNode(c *gin.Context) {
+	var req setup.NodeRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	st, err := h.Store.CompleteAsNode(req)
+	if err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	response.OK(c, gin.H{
+		"completed":       st.Completed,
+		"is_cluster_node": st.IsClusterNode,
+		"fqdn":            st.FQDN,
+	})
+}
+
+// JoinCluster performs the full cluster-join flow from the setup wizard:
+// fetches certs from the primary, writes them to disk, then marks setup
+// as completed. No CLI required.
+func (h *SetupHandler) JoinCluster(c *gin.Context) {
+	var body struct {
+		FQDN        string `json:"fqdn"         binding:"required"`
+		ACMEEmail   string `json:"acme_email"   binding:"required,email"`
+		PrimaryFQDN string `json:"primary_fqdn" binding:"required"`
+		Token       string `json:"token"        binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+
+	fqdn := strings.ToLower(strings.TrimSpace(body.FQDN))
+
+	if err := clusterjoin.Join(clusterjoin.Request{
+		PrimaryFQDN: body.PrimaryFQDN,
+		Token:       strings.TrimSpace(body.Token),
+		CommonName:  fqdn,
+		Insecure:    true, // security comes from the HMAC token, not TLS cert trust
+		Force:       true, // bootstrap self-signed cert must be replaced
+		Version:     h.Version,
+		NodeID:      h.NodeID,
+	}); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+
+	st, err := h.Store.CompleteAsNode(setup.NodeRequest{
+		FQDN:        fqdn,
+		ACMEEmail:   body.ACMEEmail,
+		PrimaryFQDN: strings.ToLower(strings.TrimSpace(body.PrimaryFQDN)),
+	})
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+
+	// Pre-register the primary in our local ha_nodes so its IP lands in
+	// @peer_ipv4 and port 8443 is open bidirectionally.
+	if h.ClusterStore != nil && h.PeerReloader != nil {
+		go h.preRegisterPrimary(body.PrimaryFQDN)
+	}
+
+	response.OK(c, gin.H{
+		"completed":       st.Completed,
+		"is_cluster_node": st.IsClusterNode,
+		"fqdn":            st.FQDN,
+	})
+}
+
+// StartupPeerSync is called once after the DB pool and ClusterStore are
+// ready. On cluster nodes it re-registers the primary in the local ha_nodes
+// and reloads nftables so @peer_ipv4 is correct after a package update or
+// reboot — without requiring a new join.
+func (h *SetupHandler) StartupPeerSync() {
+	if h.ClusterStore == nil || h.PeerReloader == nil {
+		return
+	}
+	st, err := h.Store.Load()
+	if err != nil || st == nil || !st.IsClusterNode || st.PrimaryFQDN == "" {
+		return
+	}
+	h.preRegisterPrimary(st.PrimaryFQDN)
+}
+
+// preRegisterPrimary inserts the primary node into the local ha_nodes with
+// its resolved IP so nftables @peer_ipv4 allows port 8443 from the primary.
+// Uses a stable ID derived from the FQDN so repeated calls are idempotent.
+func (h *SetupHandler) preRegisterPrimary(primaryFQDN string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	primaryFQDN = strings.ToLower(strings.TrimSpace(primaryFQDN))
+
+	addrs, err := net.DefaultResolver.LookupHost(ctx, primaryFQDN)
+	if err != nil || len(addrs) == 0 {
+		slog.Warn("setup: could not resolve primary FQDN for pre-registration",
+			"fqdn", primaryFQDN, "error", err)
+		return
+	}
+	ip := addrs[0]
+
+	// Stable ID so repeated calls (join + startup) don't accumulate rows.
+	nodeID := fmt.Sprintf("prenode-%s", strings.ReplaceAll(primaryFQDN, ".", "-"))
+	n := models.HANode{
+		ID:     nodeID,
+		Name:   primaryFQDN,
+		FQDN:   primaryFQDN,
+		APIURL: "https://" + primaryFQDN + ":3443",
+		Role:   "primary",
+		Status: "online",
+	}
+	n.PublicIP = &ip
+
+	if _, err := h.ClusterStore.UpsertSelf(ctx, n); err != nil {
+		slog.Warn("setup: pre-register primary in ha_nodes failed", "fqdn", primaryFQDN, "error", err)
+		return
+	}
+	if err := h.PeerReloader(ctx); err != nil {
+		slog.Warn("setup: PeerReloader failed after primary pre-register", "error", err)
+		return
+	}
+	slog.Info("setup: primary pre-registered locally, firewall updated",
+		"fqdn", primaryFQDN, "ip", ip)
+}

internal/handlers/users.go

@@ -0,0 +1,186 @@
+package handlers
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+)
+
+// UsersHandler exposes:
+//
+//	GET    /api/v1/users           — list all users
+//	POST   /api/v1/users           — create user
+//	PUT    /api/v1/users/:id       — update email/role/active (not password)
+//	POST   /api/v1/users/:id/password — set new password
+//	DELETE /api/v1/users/:id       — delete user
+type UsersHandler struct {
+	Repo   *users.Repo
+	Audit  *audit.Repo
+	NodeID string
+}
+
+func NewUsersHandler(repo *users.Repo, a *audit.Repo, nodeID string) *UsersHandler {
+	return &UsersHandler{Repo: repo, Audit: a, NodeID: nodeID}
+}
+
+func (h *UsersHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/users")
+	g.GET("", h.List)
+	g.POST("", h.Create)
+	g.PUT("/:id", h.Update)
+	g.POST("/:id/password", h.SetPassword)
+	g.DELETE("/:id", h.Delete)
+	g.DELETE("/:id/totp", h.DisableTOTP)
+}
+
+func (h *UsersHandler) List(c *gin.Context) {
+	out, err := h.Repo.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if out == nil {
+		out = []users.User{}
+	}
+	response.OK(c, gin.H{"users": out})
+}
+
+type createUserReq struct {
+	Email    string `json:"email"    binding:"required,email"`
+	Password string `json:"password" binding:"required,min=12"`
+	Role     string `json:"role"     binding:"required,oneof=admin viewer"`
+	Active   bool   `json:"active"`
+}
+
+func (h *UsersHandler) Create(c *gin.Context) {
+	var req createUserReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	u, err := h.Repo.Create(c.Request.Context(), req.Email, req.Password, req.Role, req.Active)
+	if errors.Is(err, users.ErrEmailTaken) {
+		response.Err(c, http.StatusConflict, err)
+		return
+	}
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.create", u.Email,
+		gin.H{"role": u.Role, "active": u.Active}, h.NodeID)
+	response.Created(c, u)
+}
+
+type updateUserReq struct {
+	Email  string `json:"email"  binding:"required,email"`
+	Role   string `json:"role"   binding:"required,oneof=admin viewer"`
+	Active bool   `json:"active"`
+}
+
+func (h *UsersHandler) Update(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req updateUserReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	u, err := h.Repo.Update(c.Request.Context(), id, req.Email, req.Role, req.Active)
+	if errors.Is(err, users.ErrNotFound) {
+		response.NotFound(c, err)
+		return
+	}
+	if errors.Is(err, users.ErrEmailTaken) {
+		response.Err(c, http.StatusConflict, err)
+		return
+	}
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.update", u.Email,
+		gin.H{"role": u.Role, "active": u.Active}, h.NodeID)
+	response.OK(c, u)
+}
+
+type setPasswordReq struct {
+	Password string `json:"password" binding:"required,min=12"`
+}
+
+func (h *UsersHandler) SetPassword(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req setPasswordReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if err := h.Repo.SetPassword(c.Request.Context(), id, req.Password); err != nil {
+		if errors.Is(err, users.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.password.set",
+		c.Param("id"), nil, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+}
+
+func (h *UsersHandler) Delete(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	// Prevent deleting the own account.
+	tok := CurrentToken(c)
+	if tok != nil {
+		if u, _, err := h.Repo.FindByEmail(c.Request.Context(), tok.Actor); err == nil {
+			if u.ID == id {
+				response.Err(c, http.StatusBadRequest, errors.New("cannot delete own account"))
+				return
+			}
+		}
+	}
+	if err := h.Repo.Delete(c.Request.Context(), id); err != nil {
+		if errors.Is(err, users.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.delete",
+		c.Param("id"), nil, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+}
+
+// DisableTOTP allows an admin to disable 2FA for any user.
+func (h *UsersHandler) DisableTOTP(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.Repo.DisableTOTP(c.Request.Context(), id); err != nil {
+		if errors.Is(err, users.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.totp.disabled",
+		c.Param("id"), nil, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+}

internal/handlers/waf.go

@@ -0,0 +1,199 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	wafsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
+)
+
+// WafHandler exposes the per-domain WAF configuration REST API:
+//
+//	GET    /waf/configs              — list all configs (one per domain)
+//	GET    /waf/configs/:domain_id   — get config for a domain
+//	PUT    /waf/configs/:domain_id   — upsert config for a domain
+type WafHandler struct {
+	Repo     *wafsvc.Repo
+	Audit    *audit.Repo
+	NodeID   string
+	Reloader func(ctx context.Context) error
+}
+
+func NewWafHandler(repo *wafsvc.Repo, a *audit.Repo, nodeID string, reloader func(context.Context) error) *WafHandler {
+	return &WafHandler{Repo: repo, Audit: a, NodeID: nodeID, Reloader: reloader}
+}
+
+func (h *WafHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/waf")
+	g.GET("/configs", h.List)
+	g.GET("/configs/:domain_id", h.Get)
+	g.PUT("/configs/:domain_id", h.Upsert)
+	g.GET("/alerts", h.ListAlerts)
+	g.DELETE("/alerts", h.PurgeAlerts)
+}
+
+// List returns all WAF configs.
+func (h *WafHandler) List(c *gin.Context) {
+	configs, err := h.Repo.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"configs": configs})
+}
+
+// Get returns the WAF config for a single domain.
+// Returns a default (disabled) config when none exists yet.
+func (h *WafHandler) Get(c *gin.Context) {
+	domainID, err := strconv.ParseInt(c.Param("domain_id"), 10, 64)
+	if err != nil {
+		response.BadRequest(c, errors.New("invalid domain_id"))
+		return
+	}
+	cfg, err := h.Repo.GetByDomain(c.Request.Context(), domainID)
+	if err != nil {
+		if errors.Is(err, wafsvc.ErrNotFound) {
+			// Return a default config so the UI always gets a usable object.
+			response.OK(c, gin.H{"config": defaultConfig(domainID)})
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"config": cfg})
+}
+
+// upsertBody is the accepted JSON for PUT /waf/configs/:domain_id.
+type upsertBody struct {
+	Enabled         bool              `json:"enabled"`
+	Mode            string            `json:"mode"`
+	ParanoiaLevel   int               `json:"paranoia_level"`
+	RuleExclusions  []string          `json:"rule_exclusions"`
+	ExclusionNotes  map[string]string `json:"exclusion_notes"`
+	TrustedProxies  []string          `json:"trusted_proxies"`
+	CustomRules     string            `json:"custom_rules"`
+}
+
+// Upsert creates or updates the WAF config for a domain.
+func (h *WafHandler) Upsert(c *gin.Context) {
+	domainID, err := strconv.ParseInt(c.Param("domain_id"), 10, 64)
+	if err != nil {
+		response.BadRequest(c, errors.New("invalid domain_id"))
+		return
+	}
+	var body upsertBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if body.Mode == "" {
+		body.Mode = "detection"
+	}
+	if body.ParanoiaLevel < 1 || body.ParanoiaLevel > 4 {
+		body.ParanoiaLevel = 1
+	}
+	if body.RuleExclusions == nil {
+		body.RuleExclusions = []string{}
+	}
+	if body.TrustedProxies == nil {
+		body.TrustedProxies = []string{}
+	}
+
+	if body.ExclusionNotes == nil {
+		body.ExclusionNotes = map[string]string{}
+	}
+	cfg := models.WafConfig{
+		DomainID:       domainID,
+		Enabled:        body.Enabled,
+		Mode:           body.Mode,
+		ParanoiaLevel:  body.ParanoiaLevel,
+		RuleExclusions: body.RuleExclusions,
+		ExclusionNotes: body.ExclusionNotes,
+		TrustedProxies: body.TrustedProxies,
+		CustomRules:    body.CustomRules,
+	}
+	result, err := h.Repo.Upsert(c.Request.Context(), cfg)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "waf.config.upsert",
+		strconv.FormatInt(domainID, 10),
+		gin.H{"enabled": body.Enabled, "mode": body.Mode, "paranoia_level": body.ParanoiaLevel},
+		h.NodeID)
+	// Reload HAProxy so the SPOE filter is added/removed based on
+	// whether any domain now has WAF enabled.
+	if h.Reloader != nil {
+		go func() {
+			if err := h.Reloader(context.Background()); err != nil {
+				slog.Warn("waf: haproxy reload after config change failed", "error", err)
+			}
+		}()
+	}
+	c.JSON(http.StatusOK, gin.H{"config": result})
+}
+
+// ListAlerts returns recent WAF alerts. Optional: ?domain_id=X&limit=N
+func (h *WafHandler) ListAlerts(c *gin.Context) {
+	var domainID *int64
+	if v := c.Query("domain_id"); v != "" {
+		id, err := strconv.ParseInt(v, 10, 64)
+		if err != nil {
+			response.BadRequest(c, errors.New("invalid domain_id"))
+			return
+		}
+		domainID = &id
+	}
+	limit := 200
+	if v := c.Query("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	alerts, err := h.Repo.ListAlerts(c.Request.Context(), domainID, limit)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"alerts": alerts})
+}
+
+// PurgeAlerts deletes old WAF alerts. Optional: ?days=N (default 30)
+func (h *WafHandler) PurgeAlerts(c *gin.Context) {
+	days := 30
+	if v := c.Query("days"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			days = n
+		}
+	}
+	if err := h.Repo.PurgeAlerts(c.Request.Context(), days); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "waf.alerts.purge",
+		"", gin.H{"days": days}, h.NodeID)
+	response.OK(c, gin.H{"ok": true, "days": days})
+}
+
+// defaultConfig returns a sensible disabled default for a domain
+// that has no WAF config row yet.
+func defaultConfig(domainID int64) models.WafConfig {
+	return models.WafConfig{
+		DomainID:       domainID,
+		Enabled:        false,
+		Mode:           "detection",
+		ParanoiaLevel:  1,
+		RuleExclusions: []string{},
+		ExclusionNotes: map[string]string{},
+		TrustedProxies: []string{},
+		CustomRules:    "",
+	}
+}

internal/handlers/wireguard.go

@@ -83,6 +83,8 @@ func (h *WireguardHandler) Register(rg *gin.RouterGroup) {
 	// row per (iface, peer) with last_handshake + transfer counters.
 	// Polled by the UI every 10s; no DB write.
 	g.GET("/status", h.Status)
+	g.GET("/importable", h.ListImportable)
+	g.POST("/import", h.Import)
 }
 
 // ── Live wg-show status ─────────────────────────────────────────────
@@ -142,6 +144,45 @@ func (h *WireguardHandler) Status(c *gin.Context) {
 	response.OK(c, gin.H{"status": rows})
 }
 
+// ── Import ────────────────────────────────────────────────────────
+
+const wgImportDir = "/etc/wireguard"
+
+// ListImportable scans /etc/wireguard for *.conf files and reports
+// which are new (not yet in the DB) vs. already imported.
+func (h *WireguardHandler) ListImportable(c *gin.Context) {
+	im := wireguard.NewImporter(h.Ifaces, h.Peers, h.Box)
+	entries, err := im.ListImportable(c.Request.Context(), wgImportDir)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"entries": entries})
+}
+
+// Import imports selected (or all) WireGuard .conf files from
+// /etc/wireguard into the DB. Body: { "names": ["wg0","wg1"] }.
+// Empty or missing names → import all.
+func (h *WireguardHandler) Import(c *gin.Context) {
+	var req struct {
+		Names []string `json:"names"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	im := wireguard.NewImporter(h.Ifaces, h.Peers, h.Box)
+	res, err := im.ImportSelected(c.Request.Context(), wgImportDir, req.Names)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "wireguard.import",
+		fmt.Sprintf("%d ifaces", res.IfacesAdded), res, h.NodeID)
+	h.reload(c.Request.Context(), "import")
+	response.OK(c, res)
+}
+
 // ── Keygen ────────────────────────────────────────────────────────
 
 func (h *WireguardHandler) GenerateKeypair(c *gin.Context) {
@@ -173,6 +214,7 @@ type ifaceCreateReq struct {
 	AllowedIPs          *string `json:"allowed_ips,omitempty"`
 	PersistentKeepalive *int    `json:"persistent_keepalive,omitempty"`
 	MTU                 *int    `json:"mtu,omitempty"`
+	ClientRoutes        *string `json:"client_routes,omitempty"`
 	Role                string  `json:"role"`
 	Active              bool    `json:"active"`
 	Description         *string `json:"description,omitempty"`
@@ -222,6 +264,7 @@ func (h *WireguardHandler) CreateIface(c *gin.Context) {
 		PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
 		PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
 		PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
+		ClientRoutes: req.ClientRoutes,
 		Role: req.Role, Active: req.Active, Description: req.Description,
 	}
 	if ifc.Role == "" {
@@ -311,6 +354,7 @@ func (h *WireguardHandler) UpdateIface(c *gin.Context) {
 		PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
 		PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
 		PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
+		ClientRoutes: req.ClientRoutes,
 		Role: req.Role, Active: req.Active, Description: req.Description,
 	}
 	if ifc.Role == "" {
@@ -526,7 +570,11 @@ func (h *WireguardHandler) UpdatePeer(c *gin.Context) {
 		}
 	} else if req.PublicKey != "" {
 		pub = req.PublicKey
-		encPriv = nil
+		if req.PublicKey != cur.PublicKey {
+			// New externally-provided public key — server has no private key for it.
+			encPriv = nil
+		}
+		// Same public key → keep cur.PrivateKeyEnc (peer still has generated keypair).
 	}
 	encPSK := cur.PSKEnc
 	if req.GeneratePSK {
@@ -645,12 +693,15 @@ func (h *WireguardHandler) peerConfigText(ctx context.Context, peerID int64) (st
 		}
 		fmt.Fprintf(&b, "PresharedKey = %s\n", string(psk))
 	}
-	// AllowedIPs on the client side is "everything that should go
-	// through the tunnel". For a server hosting an internal LAN
-	// this is typically 10.x/8 or the server's address range. We
-	// default to the iface address (so the client can at least
-	// reach the gateway) — operator can edit downloaded conf.
-	fmt.Fprintf(&b, "AllowedIPs = %s\n", ifc.AddressCIDR)
+	// AllowedIPs on the client side: the server's tunnel subnet
+	// (so peers can reach each other + the gateway) plus any
+	// additional "push routes" the operator configured on the
+	// server interface (e.g. 10.0.10.0/24 for a LAN behind the box).
+	clientAllowedIPs := ifc.AddressCIDR
+	if ifc.ClientRoutes != nil && strings.TrimSpace(*ifc.ClientRoutes) != "" {
+		clientAllowedIPs += ", " + strings.TrimSpace(*ifc.ClientRoutes)
+	}
+	fmt.Fprintf(&b, "AllowedIPs = %s\n", clientAllowedIPs)
 	// Endpoint — the operator's public host:port that peers dial.
 	// We don't know this here (could be a CNAME or behind a load
 	// balancer); leave a placeholder the operator must fill in.

internal/haproxy/haproxy.cfg.tpl

@@ -10,6 +10,14 @@ global
     daemon
     ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
     ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
+    # HAProxy 3.0.x in Trixie ist mit USE_QUIC=1 + USE_QUIC_OPENSSL_COMPAT=1
+    # gebaut; die System-OpenSSL kann QUIC aber nur über den Kompat-Layer.
+    # Ohne dieses Flag verweigert HAProxy `bind quic4@…` mit "this SSL
+    # library does not support the QUIC protocol".
+    limited-quic
+    # Runtime-API-Socket für edgeguard-api (show stat, show info, …).
+    # mode 0660 + group haproxy → edgeguard-user (in haproxy-group) kann lesen.
+    stats socket /run/haproxy/admin.sock mode 0660 level admin expose-fd listeners
 
 defaults
     log     global
@@ -27,16 +35,30 @@ defaults
 
 # ── Public :80 ─────────────────────────────────────────────────────────
 # ACME-01 challenges proxy to edgeguard-api which serves the webroot.
-# Everything else redirects to HTTPS.
+# Domains with http_to_https=false bypass the redirect and are proxied
+# directly. Everything else redirects to HTTPS.
 frontend public_http
     bind :80
+    {{- if .IPv6Enabled}}
+    bind [::]:80
+    {{- end}}
 
     acl is_acme path_beg /.well-known/acme-challenge/
+    {{- range $d := .HTTPDomains}}
+    acl is_http_only hdr(host) -i {{$d.Name}}
+    {{- end}}
 
-    # Redirect to HTTPS first (skipped for ACME paths) — must come
-    # before use_backend so HAProxy doesn't warn about ordering.
-    http-request redirect scheme https code 301 unless is_acme
+    # Redirect to HTTPS (skipped for ACME and http-only domains).
+    http-request redirect scheme https code 301 unless is_acme{{if .HTTPDomains}} or is_http_only{{end}}
 
+    {{- range $d := .HTTPDomains}}
+    {{- range $r := $d.Routes}}
+    use_backend eg_backend_{{$r.BackendID}} if { hdr(host) -i {{$d.Name}} } { path_beg {{$r.PathPrefix}} }
+    {{- end}}
+    {{- if $d.PrimaryBackendID}}
+    use_backend eg_backend_{{$d.PrimaryBackendID}} if { hdr(host) -i {{$d.Name}} }
+    {{- end}}
+    {{- end}}
     use_backend api_backend if is_acme
 
 # ── Public :443 (Customer-Backends only) ──────────────────────────────
@@ -50,8 +72,23 @@ frontend public_http
 # Admin-Panel fällt. mailgateway/enconf-Pattern.
 frontend public_https
     bind :443 ssl crt /etc/edgeguard/tls/ alpn h2,http/1.1
+    # HTTP/3 via QUIC (UDP/443). HAProxy 3.0.x ist mit USE_QUIC=1
+    # gebaut; Browser fallen via Alt-Svc-Header (siehe unten) für
+    # Folge-Requests auf h3 zurück.
+    bind quic4@:443 ssl crt /etc/edgeguard/tls/ alpn h3
+    {{- if .IPv6Enabled}}
+    bind [::]:443 ssl crt /etc/edgeguard/tls/ alpn h2,http/1.1
+    bind quic6@:443 ssl crt /etc/edgeguard/tls/ alpn h3
+    {{- end}}
+    {{- if .WAFEnabled}}
+    # WAF: SPOE-Filter — edgeguard-waf inspiziert jeden Request.
+    # filter muss vor allen http-request/http-response-Direktiven stehen.
+    filter spoe engine edgeguard-waf config /etc/edgeguard/haproxy/coraza-spoe.cfg
+    {{- end}}
 
-    http-response set-header Strict-Transport-Security "max-age=31536000"
+    # Alt-Svc: signalisiert dass h3 auf demselben Port verfügbar ist.
+    # ma=86400 = Browser darf den Hinweis 24h cachen.
+    http-response set-header Alt-Svc "h3=\":443\"; ma=86400"
 
     # Client-IP-Weiterleitung an Backends. `option forwardfor` (defaults)
     # setzt X-Forwarded-For; wir ergänzen Proto + RealIP damit Apps
@@ -59,8 +96,59 @@ frontend public_https
     # echte Source-IP ohne XFF-Chain-Parsing brauchen.
     http-request set-header X-Forwarded-Proto https
     http-request set-header X-Real-IP %[src]
+    {{- if .WAFEnabled}}
+    # WAF: Request blockieren wenn edgeguard-waf txn.waf.status gesetzt hat.
+    http-request deny deny_status 403 if { var(txn.waf.status) -m found }
+    {{- end}}
+
+    {{- if .GlobalMaintenance}}
+    # Whole-Box-Maintenance — Settings → Maintenance-Mode aktiv. Dieser
+    # Block kommt VOR allen per-Domain ACLs und blockt JEDEN Customer-
+    # Request. Mgmt-UI auf :3443 (mgmt_https) ist davon nicht betroffen.
+    http-request return status 503 content-type "text/plain; charset=utf-8" string "{{.GlobalMaintenanceMessage}}"
+    {{- end}}
 
     {{- range $d := .Domains}}
+    {{- if $d.RedirectFromHost}}
+    # www-Redirect: {{$d.RedirectFromHost}} → {{$d.Name}}
+    http-request redirect prefix https://{{$d.Name}} code 301 if { hdr(host) -i {{$d.RedirectFromHost}} }
+    {{- end}}
+    {{- if $d.MaintenanceMode}}
+    # Wartungs-Modus für {{$d.Name}} — alle Requests werden mit 503 beantwortet.
+    http-request return status 503 content-type "text/plain; charset=utf-8" string "{{$d.MaintMessage}}" if { hdr(host) -i {{$d.Name}} }
+    {{- end}}
+    {{- if $d.MaxBodyBytes}}
+    # Body-Size-Cap für {{$d.Name}}: {{$d.MaxBodyBytes}} Bytes.
+    # Nur Content-Length wird geprüft — Chunked-Bodies wären erst nach
+    # http-buffer-request abgreifbar, das wollen wir auf Frontend-Level
+    # nicht aktivieren (verbraucht RAM pro Connection).
+    http-request deny deny_status 413 if { hdr(host) -i {{$d.Name}} } { req.hdr_val(content-length) -m int gt {{$d.MaxBodyBytes}} }
+    {{- end}}
+    {{- if $d.RateLimitThreshold}}
+    # Rate-Limit für {{$d.Name}}: {{$d.RateLimitRPS}} req/s pro Client-IP
+    # (Schwelle = rps × 10s-Fenster = {{$d.RateLimitThreshold}} hits).
+    http-request track-sc0 src table rl_{{$d.ID}} if { hdr(host) -i {{$d.Name}} }
+    http-request deny deny_status 429 if { hdr(host) -i {{$d.Name}} } { sc_http_req_rate(0) gt {{$d.RateLimitThreshold}} }
+    {{- end}}
+    {{- if $d.HSTSHeader}}
+    # del + set damit ein vom Backend gesetztes HSTS (z. B. nginx mit
+    # eigener add_header-Direktive) garantiert von unserer Policy
+    # überschrieben wird — sonst tauchen 2 Strict-Transport-Security
+    # Header in der Response auf.
+    http-response del-header Strict-Transport-Security if { hdr(host) -i {{$d.Name}} }
+    http-response set-header Strict-Transport-Security "{{$d.HSTSHeader}}" if { hdr(host) -i {{$d.Name}} }
+    {{- end}}
+    {{- if $d.DisableH3}}
+    # HTTP/3 (QUIC) Werbung für diese Domain unterdrücken: Alt-Svc-Header
+    # entfernen damit Browser nicht auf h3 upgraden. Der globale set-header
+    # oben hat ihn bereits gesetzt; dieses del-header kommt DANACH und
+    # überschreibt ihn für Requests an diese Domain.
+    http-response del-header Alt-Svc if { hdr(host) -i {{$d.Name}} }
+    {{- end}}
+    {{- range $h := $d.ResponseHeaders}}
+    http-response del-header {{$h.Name}} if { hdr(host) -i {{$d.Name}} }
+    http-response set-header {{$h.Name}} "{{$h.Value}}" if { hdr(host) -i {{$d.Name}} }
+    {{- end}}
     {{- range $r := $d.Routes}}
     use_backend eg_backend_{{$r.BackendID}} if { hdr(host) -i {{$d.Name}} } { path_beg {{$r.PathPrefix}} }
     {{- end}}
@@ -76,6 +164,9 @@ frontend public_https
 # (Hostname egal — default_backend), inkl. der direkten IP.
 frontend mgmt_https
     bind :3443 ssl crt /etc/edgeguard/tls/ alpn h2,http/1.1
+    {{- if .IPv6Enabled}}
+    bind [::]:3443 ssl crt /etc/edgeguard/tls/ alpn h2,http/1.1
+    {{- end}}
     http-response set-header Strict-Transport-Security "max-age=31536000"
     http-request set-header X-Forwarded-Proto https
     http-request set-header X-Real-IP %[src]
@@ -99,6 +190,30 @@ backend api_backend
     timeout tunnel 1h
     server api1 127.0.0.1:9443 check
 
+{{- /* Per-Domain Rate-Limit Stick-Tables.
+       Eigenes Backend pro Domain damit verschiedene Schwellen nicht
+       miteinander interferieren; HAProxy 3.0 erlaubt mehrere
+       stick-table-Backends die per Frontend mit track-sc0 angesteuert
+       werden. expire 10s hält den Speicher knapp. */ -}}
+{{- range $d := .Domains}}
+{{- if $d.RateLimitThreshold}}
+
+backend rl_{{$d.ID}}
+    # Rate-Limit-Counter für {{$d.Name}}; gefüllt von public_https.
+    stick-table type ip size 100k expire 10s store http_req_rate(10s)
+{{- end}}
+{{- end}}
+
+{{- if .WAFEnabled}}
+
+# SPOE-Backend für edgeguard-waf (TCP, kein HTTP-Parsing).
+backend spoe-edgeguard-waf
+    mode    tcp
+    timeout connect 100ms
+    timeout server   1s
+    server  spoe-waf-1 127.0.0.1:9000
+{{- end}}
+
 {{- range $b := .Backends}}
 
 backend eg_backend_{{$b.ID}}
@@ -111,6 +226,6 @@ backend eg_backend_{{$b.ID}}
     http-check send meth GET uri {{$b.HealthCheckPath}}
     {{- end}}
     {{- range $s := $b.Servers}}
-    server {{$s.Name | safeID}} {{$s.Address}}:{{$s.Port}}{{if eq $b.Scheme "https"}} ssl verify none alpn h2,http/1.1{{end}}{{if $b.HealthCheckPath}} check inter 5s{{if eq $b.Scheme "https"}} check-alpn http/1.1{{end}}{{end}} weight {{$s.Weight}}{{if $s.Backup}} backup{{end}}
+    server {{$s.Name | safeID}} {{$s.Address}}:{{$s.Port}}{{if eq $b.Scheme "https"}} ssl verify none alpn {{if $b.ForceHTTP1}}http/1.1{{else}}h2,http/1.1{{end}}{{end}}{{if $b.HealthCheckPath}} check inter 5s{{if eq $b.Scheme "https"}} check-alpn http/1.1{{end}}{{end}} weight {{$s.Weight}}{{if $s.Backup}} backup{{end}}
     {{- end}}
 {{- end}}

internal/haproxy/haproxy.go

@@ -20,8 +20,11 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/backends"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/backendservers"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domainheaders"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domains"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/routingrules"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
+	wafsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
 )
 
 //go:embed haproxy.cfg.tpl
@@ -61,23 +64,47 @@ type Generator struct {
 	BackendsRepo  *backends.Repo
 	ServersRepo   *backendservers.Repo
 	RoutingRepo   *routingrules.Repo
+	HeadersRepo   *domainheaders.Repo
+	WafRepo       *wafsvc.Repo
 
-	OutputPath string
-	SkipReload bool
+	// SetupStore (optional): wenn gesetzt, lesen wir Whole-Box-
+	// Maintenance-Status hieraus und reichen ihn als View.GlobalMaintenance
+	// ans Template weiter.
+	SetupStore *setup.Store
+
+	OutputPath     string
+	SPOEConfigPath string
+	SkipReload     bool
 }
 
 func New(pool *pgxpool.Pool) *Generator {
 	return &Generator{
-		Pool:         pool,
-		DomainsRepo:  domains.New(pool),
-		BackendsRepo: backends.New(pool),
-		ServersRepo:  backendservers.New(pool),
-		RoutingRepo:  routingrules.New(pool),
+		Pool:           pool,
+		DomainsRepo:    domains.New(pool),
+		BackendsRepo:   backends.New(pool),
+		ServersRepo:    backendservers.New(pool),
+		RoutingRepo:    routingrules.New(pool),
+		HeadersRepo:    domainheaders.New(pool),
+		WafRepo:        wafsvc.New(pool),
+		SetupStore:     setup.NewStore(setup.DefaultDir),
+		SPOEConfigPath: filepath.Join(configgen.EtcEdgeguard, "haproxy", "coraza-spoe.cfg"),
 	}
 }
 
 func (g *Generator) Name() string { return "haproxy" }
 
+func (g *Generator) RenderToString(ctx context.Context) (string, error) {
+	view, err := g.loadView(ctx)
+	if err != nil {
+		return "", fmt.Errorf("haproxy: load state: %w", err)
+	}
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, view); err != nil {
+		return "", fmt.Errorf("haproxy: render template: %w", err)
+	}
+	return buf.String(), nil
+}
+
 func (g *Generator) Render(ctx context.Context) error {
 	view, err := g.loadView(ctx)
 	if err != nil {
@@ -94,6 +121,17 @@ func (g *Generator) Render(ctx context.Context) error {
 	if err := configgen.AtomicWrite(out, buf.Bytes(), 0o644); err != nil {
 		return fmt.Errorf("haproxy: write: %w", err)
 	}
+	// Write SPOE config whenever WAF is enabled; remove it when disabled
+	// so HAProxy doesn't fail on a missing backend reference.
+	if view.WAFEnabled {
+		spoeOut := g.SPOEConfigPath
+		if spoeOut == "" {
+			spoeOut = filepath.Join(configgen.EtcEdgeguard, "haproxy", "coraza-spoe.cfg")
+		}
+		if err := configgen.AtomicWrite(spoeOut, []byte(spoeCfg), 0o644); err != nil {
+			return fmt.Errorf("haproxy: write spoe config: %w", err)
+		}
+	}
 	if g.SkipReload {
 		return nil
 	}
@@ -103,6 +141,29 @@ func (g *Generator) Render(ctx context.Context) error {
 	return nil
 }
 
+// spoeCfg is the static SPOE configuration for edgeguard-waf.
+// HAProxy 3.x format: [<engine-name>] section + spoe-agent / spoe-message
+// (no square brackets around spoe-agent/spoe-message keywords).
+// spoeCfg uses `option continue-on-error` so that HAProxy never blocks
+// a request when the SPOE agent is slow or unavailable. Without this,
+// a timeout during CRS engine initialization would block all traffic,
+// including domains without WAF configured.
+const spoeCfg = `# Generated by edgeguard-api. DO NOT EDIT.
+[edgeguard-waf]
+spoe-agent edgeguard-waf-agent
+    messages        edgeguard-waf-req
+    option          var-prefix waf
+    option          continue-on-error
+    timeout         hello      100ms
+    timeout         idle       30s
+    timeout         processing 1s
+    use-backend     spoe-edgeguard-waf
+
+spoe-message edgeguard-waf-req
+    args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host)
+    event on-frontend-http-request
+`
+
 // View is what the template consumes. Routes per domain are pre-
 // joined here so the template can stay declarative; Servers leben pro
 // BackendView, damit das Template einen `backend …`-Block mit den N
@@ -110,11 +171,66 @@ func (g *Generator) Render(ctx context.Context) error {
 type View struct {
 	Domains  []DomainView
 	Backends []BackendView
+
+	// HTTPDomains: aktive Domains mit HTTPToHTTPS=false. Diese bekommen
+	// in public_http eigene use_backend-Regeln statt dem globalen Redirect.
+	HTTPDomains []DomainView
+
+	// GlobalMaintenance: wenn true emittiert public_https einen
+	// 503-Block ganz am Anfang (vor allen anderen ACLs), der
+	// alle Customer-Domains gleichzeitig stilllegt. mgmt_https
+	// (:3443) bleibt unverändert. Whole-Box-Mode für
+	// OS-Upgrades / Wartungsfenster.
+	GlobalMaintenance        bool
+	GlobalMaintenanceMessage string
+
+	// IPv6Enabled: wenn true fügt das Template zusätzliche
+	// bind-Direktiven für [::]:80, [::]:443 und [::]:3443 hinzu.
+	IPv6Enabled bool
+
+	// WAFEnabled: wenn true wird der SPOE-Filter für edgeguard-waf
+	// in public_https eingebunden und das spoe-Backend gerendert.
+	// Wird gesetzt sobald mindestens eine Domain WAF enabled hat.
+	WAFEnabled bool
 }
 
 type DomainView struct {
 	models.Domain
 	Routes []RouteView
+
+	// HSTSHeader: fertige Header-Value `max-age=…; includeSubDomains; preload`,
+	// nur gesetzt wenn HSTSEnabled — Template muss nichts mehr zusammenbauen.
+	HSTSHeader string
+
+	// MaintMessage: aus MaintenanceMessage übernommen, leer → Default.
+	// Bereits HAProxy-safe (kein " enthalten).
+	MaintMessage string
+
+	// RedirectFromHost: aliasing-Host der nach Name umgeleitet werden soll.
+	// Nur gesetzt wenn WWWRedirect != "":
+	//   to-naked  → Name="example.com"     → "www.example.com"
+	//   to-www    → Name="www.example.com" → "example.com" (strip www.-Prefix)
+	RedirectFromHost string
+
+	// ResponseHeaders: Custom-Headers die HAProxy auf jede Response für
+	// diese Domain setzt. Werte sind bereits HAProxy-safe escaped
+	// (Quotes → ', Newlines → Space).
+	ResponseHeaders []ResponseHeaderView
+
+	// MaxBodyBytes: Content-Length-Cap in Bytes (max_body_kb * 1024).
+	// 0 = aus, kein Rendering.
+	MaxBodyBytes int
+
+	// RateLimitThreshold: requests-pro-10s über die Stick-Table.
+	// 0 = aus, kein Rendering. = RateLimitRPS * 10.
+	RateLimitThreshold int
+}
+
+// ResponseHeaderView: pre-escaped Name/Value damit das Template
+// nicht escapen muss.
+type ResponseHeaderView struct {
+	Name  string
+	Value string
 }
 
 type RouteView struct {
@@ -144,6 +260,17 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 	if err != nil {
 		return nil, fmt.Errorf("list routing rules: %w", err)
 	}
+	headers, err := g.HeadersRepo.ListAll(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("list domain headers: %w", err)
+	}
+	headersByDomain := map[int64][]ResponseHeaderView{}
+	for _, h := range headers {
+		headersByDomain[h.DomainID] = append(headersByDomain[h.DomainID], ResponseHeaderView{
+			Name:  h.Name,
+			Value: sanitizeHeaderValue(h.Value),
+		})
+	}
 
 	rulesByDomain := map[int64][]RouteView{}
 	for _, r := range rules {
@@ -180,11 +307,125 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 		if !d.Active {
 			continue
 		}
-		domViews = append(domViews, DomainView{
-			Domain: d,
-			Routes: rulesByDomain[d.ID],
-		})
+		dv := DomainView{
+			Domain:           d,
+			Routes:           rulesByDomain[d.ID],
+			HSTSHeader:       buildHSTSHeader(d),
+			MaintMessage:     buildMaintMessage(d),
+			RedirectFromHost: buildRedirectFromHost(d),
+			ResponseHeaders:  headersByDomain[d.ID],
+		}
+		if d.MaxBodyKB > 0 {
+			dv.MaxBodyBytes = d.MaxBodyKB * 1024
+		}
+		if d.RateLimitRPS > 0 {
+			// Stick-Table store-window ist 10s (siehe Template); deshalb
+			// ist die Threshold-Größe rps * 10.
+			dv.RateLimitThreshold = d.RateLimitRPS * 10
+		}
+		domViews = append(domViews, dv)
 	}
 
-	return &View{Domains: domViews, Backends: activeBackends}, nil
+	httpDomains := make([]DomainView, 0)
+	for _, dv := range domViews {
+		if !dv.HTTPToHTTPS && (dv.PrimaryBackendID != nil || len(dv.Routes) > 0) {
+			httpDomains = append(httpDomains, dv)
+		}
+	}
+	v := &View{Domains: domViews, Backends: activeBackends, HTTPDomains: httpDomains}
+
+	// Check whether any domain has WAF enabled.
+	if g.WafRepo != nil {
+		if wafEnabled, err := g.WafRepo.ListEnabled(ctx); err == nil {
+			v.WAFEnabled = len(wafEnabled) > 0
+		}
+	}
+
+	if g.SetupStore != nil {
+		if st, err := g.SetupStore.Load(); err == nil && st != nil {
+			v.GlobalMaintenance = st.MaintenanceMode
+			v.GlobalMaintenanceMessage = sanitizeHeaderValue(st.MaintenanceMessage)
+			if v.GlobalMaintenanceMessage == "" && v.GlobalMaintenance {
+				v.GlobalMaintenanceMessage = "EdgeGuard maintenance in progress."
+			}
+			v.IPv6Enabled = st.IPv6Enabled
+		}
+	}
+	return v, nil
+}
+
+// buildHSTSHeader baut den fertigen Strict-Transport-Security Wert.
+// Leer wenn HSTS für die Domain aus ist — das Template prüft dann.
+func buildHSTSHeader(d models.Domain) string {
+	if !d.HSTSEnabled {
+		return ""
+	}
+	maxAge := d.HSTSMaxAge
+	if maxAge <= 0 {
+		maxAge = 31536000
+	}
+	out := fmt.Sprintf("max-age=%d", maxAge)
+	if d.HSTSSubdomains {
+		out += "; includeSubDomains"
+	}
+	if d.HSTSPreload {
+		out += "; preload"
+	}
+	return out
+}
+
+// buildMaintMessage liefert die Wartungs-Meldung HAProxy-safe (ohne ").
+// Default-Text wenn nichts gesetzt ist.
+func buildMaintMessage(d models.Domain) string {
+	if !d.MaintenanceMode {
+		return ""
+	}
+	msg := ""
+	if d.MaintenanceMessage != nil {
+		msg = *d.MaintenanceMessage
+	}
+	msg = strings.TrimSpace(msg)
+	if msg == "" {
+		msg = "Service temporarily unavailable for maintenance."
+	}
+	// HAProxy kennt kein Escape innerhalb von "…". Lieber " durch ' tauschen
+	// und Newlines flatten, damit der Template-Output garantiert parst.
+	msg = strings.ReplaceAll(msg, `"`, "'")
+	msg = strings.ReplaceAll(msg, "\n", " ")
+	msg = strings.ReplaceAll(msg, "\r", " ")
+	return msg
+}
+
+// sanitizeHeaderValue macht den Wert HAProxy-safe für `set-header "…"`.
+// HAProxy versteht innerhalb einer "…"-Sequenz keine Escapes, deshalb
+// werden Quotes durch ' ersetzt und CR/LF entfernt (sonst sprengt ein
+// böser Wert die Config oder ermöglicht Header-Injection).
+func sanitizeHeaderValue(v string) string {
+	v = strings.ReplaceAll(v, `"`, "'")
+	v = strings.ReplaceAll(v, "\n", " ")
+	v = strings.ReplaceAll(v, "\r", " ")
+	return v
+}
+
+// buildRedirectFromHost gibt den Alias-Host zurück der nach Name umgeleitet
+// werden soll, oder "" wenn kein Redirect konfiguriert ist.
+func buildRedirectFromHost(d models.Domain) string {
+	switch d.WWWRedirect {
+	case "to-naked":
+		// Name ist die nackte Form → wir leiten www.Name → Name um.
+		if strings.HasPrefix(strings.ToLower(d.Name), "www.") {
+			// User-Fehlkonfiguration — Name beginnt schon mit www. Skip.
+			return ""
+		}
+		return "www." + d.Name
+	case "to-www":
+		// Name ist die www-Form → wir leiten Name-ohne-www → Name um.
+		lower := strings.ToLower(d.Name)
+		if !strings.HasPrefix(lower, "www.") {
+			return ""
+		}
+		return d.Name[4:]
+	default:
+		return ""
+	}
 }

internal/haproxy/haproxy_test.go

@@ -41,6 +41,13 @@ func TestRender_BaselineHasFrontendsAndApiBackend(t *testing.T) {
 		"backend api_backend",
 		"server api1 127.0.0.1:9443 check",
 		"bind :443 ssl crt /etc/edgeguard/tls/",
+		// HTTP/3 (QUIC) zusätzlich zum h2/http1.1-Listener.
+		"bind quic4@:443 ssl crt /etc/edgeguard/tls/ alpn h3",
+		// limited-quic global muss gesetzt sein, sonst weigert sich
+		// HAProxy 3.0 das quic4-bind anzunehmen (OpenSSL-Kompat-Layer).
+		"limited-quic",
+		// Alt-Svc damit Browser auf h3 upgraden.
+		`Alt-Svc "h3=\":443\"; ma=86400"`,
 		"path_beg /.well-known/acme-challenge/",
 		"http-request redirect scheme https",
 		// Client-IP-Weiterleitung an Backends — XFF kommt aus
@@ -54,6 +61,326 @@ func TestRender_BaselineHasFrontendsAndApiBackend(t *testing.T) {
 			t.Errorf("missing %q in baseline output:\n%s", w, out)
 		}
 	}
+	// Globales HSTS auf public_https darf NICHT mehr drin sein —
+	// das wird jetzt pro Domain via ACL gesetzt (siehe HSTS-Test).
+	// mgmt_https hat aber weiterhin ein globales HSTS.
+	publicIdx := strings.Index(out, "frontend public_https")
+	mgmtIdx := strings.Index(out, "frontend mgmt_https")
+	if publicIdx < 0 || mgmtIdx < 0 || publicIdx >= mgmtIdx {
+		t.Fatalf("frontend ordering unexpected:\n%s", out)
+	}
+	publicBlock := out[publicIdx:mgmtIdx]
+	if strings.Contains(publicBlock, "set-header Strict-Transport-Security") {
+		t.Errorf("public_https soll KEIN globales HSTS mehr enthalten (pro-Domain ACL):\n%s", publicBlock)
+	}
+}
+
+func TestRender_HSTSPerDomain(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{
+					ID: 1, Name: "a.example.com", Active: true,
+					HSTSEnabled: true, HSTSMaxAge: 63072000,
+					HSTSSubdomains: true, HSTSPreload: true,
+				},
+				HSTSHeader: "max-age=63072000; includeSubDomains; preload",
+			},
+			{
+				Domain: models.Domain{
+					ID: 2, Name: "b.example.com", Active: true,
+					HSTSEnabled: false,
+				},
+			},
+		},
+	}
+	out := renderView(t, v)
+	for _, w := range []string{
+		// Erst löschen (gegen Backend-set HSTS), dann setzen.
+		`http-response del-header Strict-Transport-Security if { hdr(host) -i a.example.com }`,
+		`http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" if { hdr(host) -i a.example.com }`,
+	} {
+		if !strings.Contains(out, w) {
+			t.Errorf("missing %q in per-domain HSTS output:\n%s", w, out)
+		}
+	}
+	if strings.Contains(out, "Strict-Transport-Security \"\" if { hdr(host) -i b.example.com }") ||
+		strings.Contains(out, "if { hdr(host) -i b.example.com }") && strings.Contains(out, "Strict-Transport-Security") &&
+			strings.Contains(out, "b.example.com") && strings.Count(out, "Strict-Transport-Security") > 2 {
+		// HSTS soll für Domain ohne HSTSEnabled gar nicht erst gerendert werden.
+		// (mgmt_https hat noch eins, plus die eine Zeile von a.example.com → 2 Vorkommen erwartet.)
+	}
+}
+
+func TestRender_MaintenanceModeBlocksWith503(t *testing.T) {
+	msg := `Wartung — bitte später wiederkommen.`
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{
+					ID: 1, Name: "down.example.com", Active: true,
+					MaintenanceMode: true, MaintenanceMessage: &msg,
+				},
+				MaintMessage: msg,
+			},
+		},
+	}
+	out := renderView(t, v)
+	want := `http-request return status 503 content-type "text/plain; charset=utf-8" string "Wartung — bitte später wiederkommen." if { hdr(host) -i down.example.com }`
+	if !strings.Contains(out, want) {
+		t.Errorf("missing maintenance-503 line:\n%s", out)
+	}
+}
+
+func TestRender_WWWRedirectToNaked(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{
+					ID: 1, Name: "example.com", Active: true,
+					WWWRedirect: "to-naked",
+				},
+				RedirectFromHost: "www.example.com",
+			},
+		},
+	}
+	out := renderView(t, v)
+	want := `http-request redirect prefix https://example.com code 301 if { hdr(host) -i www.example.com }`
+	if !strings.Contains(out, want) {
+		t.Errorf("missing www→naked redirect line:\n%s", out)
+	}
+}
+
+func TestRender_WWWRedirectToWWW(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{
+					ID: 1, Name: "www.example.com", Active: true,
+					WWWRedirect: "to-www",
+				},
+				RedirectFromHost: "example.com",
+			},
+		},
+	}
+	out := renderView(t, v)
+	want := `http-request redirect prefix https://www.example.com code 301 if { hdr(host) -i example.com }`
+	if !strings.Contains(out, want) {
+		t.Errorf("missing naked→www redirect line:\n%s", out)
+	}
+}
+
+func TestBuildHSTSHeader(t *testing.T) {
+	cases := []struct {
+		name string
+		d    models.Domain
+		want string
+	}{
+		{"disabled", models.Domain{HSTSEnabled: false}, ""},
+		{"defaults", models.Domain{HSTSEnabled: true}, "max-age=31536000"},
+		{"explicit", models.Domain{HSTSEnabled: true, HSTSMaxAge: 7200}, "max-age=7200"},
+		{"sub", models.Domain{HSTSEnabled: true, HSTSMaxAge: 60, HSTSSubdomains: true}, "max-age=60; includeSubDomains"},
+		{"sub+preload", models.Domain{HSTSEnabled: true, HSTSMaxAge: 60, HSTSSubdomains: true, HSTSPreload: true}, "max-age=60; includeSubDomains; preload"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := buildHSTSHeader(tc.d); got != tc.want {
+				t.Errorf("buildHSTSHeader: got %q want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestBuildMaintMessage(t *testing.T) {
+	msg := `He said "hi"` + "\n" + `and left`
+	d := models.Domain{MaintenanceMode: true, MaintenanceMessage: &msg}
+	got := buildMaintMessage(d)
+	// Quotes durch ' ersetzt, Newline → Space.
+	want := `He said 'hi' and left`
+	if got != want {
+		t.Errorf("buildMaintMessage: got %q want %q", got, want)
+	}
+	if buildMaintMessage(models.Domain{MaintenanceMode: false}) != "" {
+		t.Errorf("buildMaintMessage should be empty when MaintenanceMode is off")
+	}
+	if got := buildMaintMessage(models.Domain{MaintenanceMode: true}); got == "" {
+		t.Errorf("buildMaintMessage should emit fallback text when no message set")
+	}
+}
+
+func TestRender_GlobalMaintenanceBlocksAllCustomerTraffic(t *testing.T) {
+	v := View{
+		GlobalMaintenance:        true,
+		GlobalMaintenanceMessage: "Wartung läuft.",
+		Domains: []DomainView{
+			{Domain: models.Domain{ID: 1, Name: "site.example.com", Active: true}},
+		},
+	}
+	out := renderView(t, v)
+	want := `http-request return status 503 content-type "text/plain; charset=utf-8" string "Wartung läuft."`
+	if !strings.Contains(out, want) {
+		t.Errorf("missing global-maintenance 503 block:\n%s", out)
+	}
+	// Block muss VOR den use_backend-Zeilen IM SELBEN public_https-
+	// Frontend stehen (sonst ineffektiv — HAProxy execut'ed in-order,
+	// return-actions terminieren die Chain). public_http hat ein
+	// frühes use_backend api_backend für ACME — das hier nicht
+	// matchen.
+	pubIdx := strings.Index(out, "frontend public_https")
+	mgmtIdxStart := strings.Index(out, "frontend mgmt_https")
+	if pubIdx < 0 || mgmtIdxStart < 0 {
+		t.Fatalf("frontends not found in output:\n%s", out)
+	}
+	publicBlock := out[pubIdx:mgmtIdxStart]
+	idxBlock := strings.Index(publicBlock, want)
+	idxUseBackend := strings.Index(publicBlock, "use_backend")
+	if idxBlock < 0 || (idxUseBackend > 0 && idxBlock > idxUseBackend) {
+		t.Errorf("global-maintenance block must precede use_backend in public_https\n  block at %d, use_backend at %d", idxBlock, idxUseBackend)
+	}
+	// mgmt_https darf NICHT betroffen sein.
+	mgmtIdx := strings.Index(out, "frontend mgmt_https")
+	if mgmtIdx > 0 {
+		mgmtBlock := out[mgmtIdx:]
+		if strings.Contains(mgmtBlock, want) {
+			t.Errorf("mgmt_https must NOT contain global-maintenance block:\n%s", mgmtBlock)
+		}
+	}
+}
+
+func TestRender_GlobalMaintenanceOff_NoBlock(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{Domain: models.Domain{ID: 1, Name: "site.example.com", Active: true}},
+		},
+	}
+	out := renderView(t, v)
+	if strings.Contains(out, "Whole-Box-Maintenance") {
+		t.Errorf("global-maintenance comment should not be rendered when off:\n%s", out)
+	}
+}
+
+func TestRender_RateLimitEmitsStickTableAndDeny(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{
+					ID: 7, Name: "api.example.com", Active: true,
+					RateLimitRPS: 50,
+				},
+				RateLimitThreshold: 500, // 50 rps × 10s
+			},
+		},
+	}
+	out := renderView(t, v)
+	for _, w := range []string{
+		"backend rl_7",
+		"stick-table type ip size 100k expire 10s store http_req_rate(10s)",
+		`http-request track-sc0 src table rl_7 if { hdr(host) -i api.example.com }`,
+		`http-request deny deny_status 429 if { hdr(host) -i api.example.com } { sc_http_req_rate(0) gt 500 }`,
+	} {
+		if !strings.Contains(out, w) {
+			t.Errorf("missing %q in rate-limit output:\n%s", w, out)
+		}
+	}
+}
+
+func TestRender_NoRateLimitNoStickTable(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{ID: 9, Name: "a.example.com", Active: true},
+			},
+		},
+	}
+	out := renderView(t, v)
+	if strings.Contains(out, "backend rl_9") {
+		t.Errorf("stick-table backend rendered for domain without rate-limit:\n%s", out)
+	}
+	if strings.Contains(out, "track-sc0") {
+		t.Errorf("track-sc0 emitted without rate-limit:\n%s", out)
+	}
+}
+
+func TestRender_BodySizeDeny413(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{
+					ID: 1, Name: "upload.example.com", Active: true,
+					MaxBodyKB: 2048,
+				},
+				MaxBodyBytes: 2048 * 1024,
+			},
+		},
+	}
+	out := renderView(t, v)
+	want := `http-request deny deny_status 413 if { hdr(host) -i upload.example.com } { req.hdr_val(content-length) -m int gt 2097152 }`
+	if !strings.Contains(out, want) {
+		t.Errorf("missing 413 body-size deny:\n%s", out)
+	}
+}
+
+func TestRender_CustomResponseHeaders(t *testing.T) {
+	v := View{
+		Domains: []DomainView{
+			{
+				Domain: models.Domain{ID: 1, Name: "x.example.com", Active: true},
+				ResponseHeaders: []ResponseHeaderView{
+					{Name: "X-Frame-Options", Value: "DENY"},
+					{Name: "Content-Security-Policy", Value: "default-src 'self'"},
+				},
+			},
+		},
+	}
+	out := renderView(t, v)
+	for _, w := range []string{
+		// del + set pro Custom-Header, damit Upstream-Werte
+		// garantiert überschrieben werden.
+		`http-response del-header X-Frame-Options if { hdr(host) -i x.example.com }`,
+		`http-response set-header X-Frame-Options "DENY" if { hdr(host) -i x.example.com }`,
+		`http-response del-header Content-Security-Policy if { hdr(host) -i x.example.com }`,
+		`http-response set-header Content-Security-Policy "default-src 'self'" if { hdr(host) -i x.example.com }`,
+	} {
+		if !strings.Contains(out, w) {
+			t.Errorf("missing %q:\n%s", w, out)
+		}
+	}
+}
+
+func TestSanitizeHeaderValue(t *testing.T) {
+	cases := map[string]string{
+		`plain`:              `plain`,
+		`with "quotes"`:      `with 'quotes'`,
+		"with\nnewline":      "with newline",
+		"crlf\r\nattack":     "crlf  attack",
+		`csp default-src 'self'`: `csp default-src 'self'`,
+	}
+	for in, want := range cases {
+		if got := sanitizeHeaderValue(in); got != want {
+			t.Errorf("sanitizeHeaderValue(%q) = %q want %q", in, got, want)
+		}
+	}
+}
+
+func TestBuildRedirectFromHost(t *testing.T) {
+	cases := []struct {
+		name string
+		d    models.Domain
+		want string
+	}{
+		{"none", models.Domain{Name: "example.com"}, ""},
+		{"to-naked", models.Domain{Name: "example.com", WWWRedirect: "to-naked"}, "www.example.com"},
+		{"to-naked invalid (name already has www)", models.Domain{Name: "www.example.com", WWWRedirect: "to-naked"}, ""},
+		{"to-www", models.Domain{Name: "www.example.com", WWWRedirect: "to-www"}, "example.com"},
+		{"to-www invalid (name lacks www)", models.Domain{Name: "example.com", WWWRedirect: "to-www"}, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := buildRedirectFromHost(tc.d); got != tc.want {
+				t.Errorf("buildRedirectFromHost: got %q want %q", got, tc.want)
+			}
+		})
+	}
 }
 
 func TestRender_DomainRoutesEmitUseBackend(t *testing.T) {

internal/keepalived/keepalived.conf.tpl

@@ -0,0 +1,72 @@
+global_defs {
+    router_id {{ .RouterID }}
+    script_user root
+    enable_script_security
+}
+
+vrrp_script chk_edgeguard {
+    script "/usr/lib/edgeguard/keepalived-check.sh"
+    interval 2
+    weight -50
+    fall 3
+    rise 2
+}
+{{ if .GWCheckIP }}
+vrrp_script chk_gateway {
+    script "/usr/lib/edgeguard/keepalived-gw-check.sh {{ .GWCheckIP }}"
+    interval 5
+    weight -110
+    fall 2
+    rise 2
+}
+{{ end }}
+{{ if .HBInterface }}
+vrrp_sync_group VG_1 {
+    group {
+        VI_1
+        VI_HB
+    }
+}
+{{ end }}
+vrrp_instance VI_1 {
+    state {{ .State }}
+    interface {{ .Interface }}
+    virtual_router_id {{ .RouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .SrcIP }}    unicast_src_ip {{ .SrcIP }}
+    unicast_peer {
+        {{ .PeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+    virtual_ipaddress {
+{{ range .VIPs }}        {{ .Address }}/{{ .Prefix }} dev {{ .Device }}
+{{ end }}    }
+    track_script {
+        chk_edgeguard
+{{ if .GWCheckIP }}        chk_gateway
+{{ end }}    }
+    notify_master  "/usr/lib/edgeguard/keepalived-master.sh"
+    notify_backup  "/usr/lib/edgeguard/keepalived-backup.sh"
+    notify_fault   "/usr/lib/edgeguard/keepalived-backup.sh"
+}
+{{ if .HBInterface }}
+vrrp_instance VI_HB {
+    state {{ .State }}
+    interface {{ .HBInterface }}
+    virtual_router_id {{ .HBRouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .HBSrcIP }}    unicast_src_ip {{ .HBSrcIP }}
+    unicast_peer {
+        {{ .HBPeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+}
+{{ end }}

internal/keepalived/keepalived.go

@@ -0,0 +1,210 @@
+// Package keepalived rendert /etc/keepalived/keepalived.conf aus
+// cluster_settings (VIP/VRRP-Config) und ha_nodes (local vs. peer).
+//
+// Split-Brain-Strategie: kein Auto-Promote. notify_master loggt nur
+// und sendet einen internen Alert. Promotion ist immer manuell via
+// "edgeguard-ctl promote" — das ist die einzig sichere Option ohne
+// externes Quorum in einem 2-Node-Cluster.
+package keepalived
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"text/template"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const ConfPath = "/etc/keepalived/keepalived.conf"
+
+//go:embed keepalived.conf.tpl
+var cfgTpl string
+
+var tpl = template.Must(template.New("keepalived").Parse(cfgTpl))
+
+// VIPEntry ist eine einzelne VIP-Adresse die keepalived verwaltet.
+type VIPEntry struct {
+	Address string // z.B. 89.163.205.100
+	Prefix  int    // z.B. 24
+	Device  string // z.B. eth0
+}
+
+// View ist der Template-Kontext.
+type View struct {
+	State     string // MASTER | BACKUP
+	Interface string // Interface für VRRP-Advertisements (VI_1)
+	RouterID  int
+	Priority  int    // MASTER=200, BACKUP=100
+	SrcIP     string // eigene Public-IP (unicast_src_ip)
+	PeerIP    string // Peer-Public-IP (unicast_peer)
+	AuthPass  string
+	VIPs      []VIPEntry // alle is_vip=true Einträge aus ip_addresses
+	// Dual-path VRRP (Split-Brain-Schutz, Migration 0033)
+	HBInterface string
+	HBSrcIP     string
+	HBPeerIP    string
+	HBRouterID  int
+	// GW-Tracking
+	GWCheckIP string
+}
+
+type generator struct {
+	pool    *pgxpool.Pool
+	localID string
+}
+
+func New(pool *pgxpool.Pool, localID string) configgen.Generator {
+	return &generator{pool: pool, localID: localID}
+}
+
+func (g *generator) Name() string { return "keepalived" }
+
+func (g *generator) Render(ctx context.Context) error {
+	cs, vips, local, peer, err := g.loadData(ctx)
+	if err != nil {
+		return fmt.Errorf("keepalived: load: %w", err)
+	}
+	if len(vips) == 0 {
+		// Keine VIPs konfiguriert → keepalived.conf nicht schreiben.
+		return nil
+	}
+	v := g.buildView(cs, vips, local, peer)
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, v); err != nil {
+		return fmt.Errorf("keepalived: template: %w", err)
+	}
+	if err := configgen.AtomicWrite(ConfPath, buf.Bytes(), 0o640); err != nil {
+		return fmt.Errorf("keepalived: write: %w", err)
+	}
+	if err := reloadKeepalived(); err != nil {
+		return fmt.Errorf("keepalived: reload: %w", err)
+	}
+	return nil
+}
+
+func (g *generator) loadData(ctx context.Context) (*models.ClusterSettings, []VIPEntry, *models.HANode, *models.HANode, error) {
+	var cs models.ClusterSettings
+	row := g.pool.QueryRow(ctx, `
+		SELECT id, vip_address, vip_interface, vip_auth_pass, vrrp_router_id,
+		       hb_interface, hb_src_ip, hb_peer_ip, hb_router_id, gw_check_ip
+		FROM cluster_settings WHERE id = 1`)
+	if err := row.Scan(&cs.ID, &cs.VIPAddress, &cs.VIPInterface, &cs.VIPAuthPass, &cs.VRRPRouterID,
+		&cs.HBInterface, &cs.HBSrcIP, &cs.HBPeerIP, &cs.HBRouterID, &cs.GWCheckIP); err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("cluster_settings: %w", err)
+	}
+
+	// Alle VIPs aus ip_addresses (is_vip=true, active=true) inkl. Interface-Name.
+	vipRows, err := g.pool.Query(ctx, `
+		SELECT ia.address, ia.prefix, ni.name
+		FROM ip_addresses ia
+		JOIN network_interfaces ni ON ia.interface_id = ni.id
+		WHERE ia.is_vip = true AND ia.active = true
+		ORDER BY ni.name, ia.address`)
+	if err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("ip_addresses: %w", err)
+	}
+	defer vipRows.Close()
+	var vips []VIPEntry
+	for vipRows.Next() {
+		var v VIPEntry
+		if err := vipRows.Scan(&v.Address, &v.Prefix, &v.Device); err != nil {
+			continue
+		}
+		vips = append(vips, v)
+	}
+
+	nodeRows, err := g.pool.Query(ctx, `SELECT id, fqdn, role, pg_role, public_ip, status FROM ha_nodes ORDER BY joined_at`)
+	if err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("ha_nodes: %w", err)
+	}
+	defer nodeRows.Close()
+
+	var local, peer *models.HANode
+	for nodeRows.Next() {
+		n := &models.HANode{}
+		if err := nodeRows.Scan(&n.ID, &n.FQDN, &n.Role, &n.PGRole, &n.PublicIP, &n.Status); err != nil {
+			continue
+		}
+		if n.ID == g.localID {
+			local = n
+		} else {
+			peer = n
+		}
+	}
+	if local == nil {
+		return nil, nil, nil, nil, fmt.Errorf("local node %s not in ha_nodes", g.localID)
+	}
+	return &cs, vips, local, peer, nil
+}
+
+func (g *generator) buildView(cs *models.ClusterSettings, vips []VIPEntry, local, peer *models.HANode) View {
+	v := View{
+		RouterID:    cs.VRRPRouterID,
+		VIPs:        vips,
+		Interface:   deref(cs.VIPInterface),
+		AuthPass:    deref(cs.VIPAuthPass),
+		HBInterface: deref(cs.HBInterface),
+		HBSrcIP:     deref(cs.HBSrcIP),
+		HBPeerIP:    deref(cs.HBPeerIP),
+		HBRouterID:  cs.HBRouterID,
+		GWCheckIP:   deref(cs.GWCheckIP),
+	}
+	if v.Interface == "" {
+		v.Interface = "eth0"
+	}
+	if v.AuthPass == "" {
+		v.AuthPass = "edgeguard"
+	}
+	if v.HBRouterID == 0 {
+		v.HBRouterID = 52
+	}
+
+	// pg_role=standby ist das härtere Signal — ein Standby-Node ist niemals
+	// MASTER, auch wenn role='primary' noch aus dem Join-Prozess stammt.
+	// Reihenfolge: standby → BACKUP; sonst primary-Check.
+	if local.PGRole == "standby" {
+		v.State = "BACKUP"
+		v.Priority = 100
+	} else if local.PGRole == "primary" || local.Role == "primary" {
+		v.State = "MASTER"
+		v.Priority = 200
+	} else {
+		v.State = "BACKUP"
+		v.Priority = 100
+	}
+
+	if local.PublicIP != nil {
+		v.SrcIP = *local.PublicIP
+	}
+	if peer != nil && peer.PublicIP != nil {
+		v.PeerIP = *peer.PublicIP
+	}
+	return v
+}
+
+func reloadKeepalived() error {
+	if _, err := os.Stat("/run/keepalived.pid"); os.IsNotExist(err) {
+		// keepalived läuft noch nicht — erster Render beim Start.
+		return nil
+	}
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "reload-or-restart", "keepalived.service")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("sudo systemctl reload-or-restart keepalived.service: %w (output: %s)", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+func deref(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}

internal/license/license.go

@@ -365,23 +365,16 @@ func (c *Client) Trial() (*Result, error) {
 	daysLeft := int(remaining.Hours()/24) + 1
 	expiresAt := info.StartedAt.Add(TrialDuration)
 
-	// Trial schaltet alle Pro-Features frei, Limits bleiben 0 (= Skip-
-	// Enforcement-Konvention). nmg-Backend prüft `lim > 0 && count >= lim`
-	// und blockiert in Trial-Mode niemanden.
+	// Trial schaltet alle Features frei, Limits bleiben 0 (= Skip-
+	// Enforcement-Konvention). Enforcement: `lim > 0 && count >= lim`.
 	return &Result{
 		Valid:       true,
 		Type:        "trial",
 		Status:      "active",
-		Product:     "NetCell MailGuard",
+		Product:     "NetCell EdgeGuard",
 		ExpiresAt:   &expiresAt,
 		GracePeriod: daysLeft <= 2,
-		Features: map[string]bool{
-			"reporting":      true,
-			"eu_portal":      true,
-			"digest":         true,
-			"whitelabel":     true,
-			"rest_api_write": true,
-		},
+		Features:    map[string]bool{},
 		Limits: map[string]int64{
 			"max_domains":     0, // 0 = Skip-Enforcement (Trial-Konvention)
 			"max_nodes":       0,

internal/models/backend.go

@@ -11,6 +11,7 @@ type Backend struct {
 	HealthCheckPath *string   `gorm:"column:health_check_path"   json:"health_check_path,omitempty"`
 	LBAlgorithm     string    `gorm:"column:lb_algorithm"        json:"lb_algorithm"`
 	WebSocket       bool      `gorm:"column:websocket"           json:"websocket"`
+	ForceHTTP1      bool      `gorm:"column:force_http1"         json:"force_http1"`
 	Active          bool      `gorm:"column:active"              json:"active"`
 	CreatedAt       time.Time `gorm:"column:created_at"          json:"created_at"`
 	UpdatedAt       time.Time `gorm:"column:updated_at"          json:"updated_at"`

internal/models/cluster_settings.go

@@ -0,0 +1,24 @@
+package models
+
+import "time"
+
+// ClusterSettings ist die Singleton-Tabelle (id=1) für VIP/VRRP-
+// und Replikations-Konfiguration. Angelegt in Migration 0029.
+// hb_* = zweite VRRP-Instanz für Split-Brain-Schutz (0033).
+// gw_check_ip = Gateway-IP für vrrp_script chk_gateway (0033).
+type ClusterSettings struct {
+	ID           int       `gorm:"column:id;primaryKey"   json:"id"`
+	VIPAddress   *string   `gorm:"column:vip_address"     json:"vip_address,omitempty"`
+	VIPInterface *string   `gorm:"column:vip_interface"   json:"vip_interface,omitempty"`
+	VIPAuthPass  *string   `gorm:"column:vip_auth_pass"   json:"vip_auth_pass,omitempty"`
+	VRRPRouterID int       `gorm:"column:vrrp_router_id"  json:"vrrp_router_id"`
+	HBInterface  *string   `gorm:"column:hb_interface"    json:"hb_interface,omitempty"`
+	HBSrcIP      *string   `gorm:"column:hb_src_ip"       json:"hb_src_ip,omitempty"`
+	HBPeerIP     *string   `gorm:"column:hb_peer_ip"      json:"hb_peer_ip,omitempty"`
+	HBRouterID   int       `gorm:"column:hb_router_id"    json:"hb_router_id"`
+	GWCheckIP    *string   `gorm:"column:gw_check_ip"     json:"gw_check_ip,omitempty"`
+	CreatedAt    time.Time `gorm:"column:created_at"      json:"created_at"`
+	UpdatedAt    time.Time `gorm:"column:updated_at"      json:"updated_at"`
+}
+
+func (ClusterSettings) TableName() string { return "cluster_settings" }

internal/models/dns.go

@@ -40,16 +40,20 @@ func (DNSRecord) TableName() string { return "dns_records" }
 // Optionen. Default kommt aus der Migration (alle Werte sinnvoll
 // für die typische LAN-Resolver-Rolle).
 type DNSSettings struct {
-	ID                int64     `gorm:"primaryKey"                  json:"id"`
-	ListenAddresses   string    `gorm:"column:listen_addresses"     json:"listen_addresses"`
-	ListenPort        int       `gorm:"column:listen_port"          json:"listen_port"`
-	UpstreamForwards  string    `gorm:"column:upstream_forwards"    json:"upstream_forwards"`
-	AccessACL         string    `gorm:"column:access_acl"           json:"access_acl"`
-	DNSSEC            bool      `gorm:"column:dnssec"               json:"dnssec"`
-	QNameMinimisation bool      `gorm:"column:qname_minimisation"   json:"qname_minimisation"`
-	CacheMinTTL       int       `gorm:"column:cache_min_ttl"        json:"cache_min_ttl"`
-	CacheMaxTTL       int       `gorm:"column:cache_max_ttl"        json:"cache_max_ttl"`
-	UpdatedAt         time.Time `gorm:"column:updated_at"           json:"updated_at"`
+	ID                int64     `gorm:"primaryKey"                    json:"id"`
+	ListenAddresses   string    `gorm:"column:listen_addresses"       json:"listen_addresses"`
+	ListenPort        int       `gorm:"column:listen_port"            json:"listen_port"`
+	UpstreamForwards  string    `gorm:"column:upstream_forwards"      json:"upstream_forwards"`
+	AccessACL         string    `gorm:"column:access_acl"             json:"access_acl"`
+	DNSSEC            bool      `gorm:"column:dnssec"                 json:"dnssec"`
+	QNameMinimisation bool      `gorm:"column:qname_minimisation"     json:"qname_minimisation"`
+	CacheMinTTL       int       `gorm:"column:cache_min_ttl"          json:"cache_min_ttl"`
+	CacheMaxTTL       int       `gorm:"column:cache_max_ttl"          json:"cache_max_ttl"`
+	Prefetch          bool      `gorm:"column:prefetch"               json:"prefetch"`
+	ServeExpired      bool      `gorm:"column:serve_expired"          json:"serve_expired"`
+	MsgCacheSizeMB    int       `gorm:"column:msg_cache_size_mb"      json:"msg_cache_size_mb"`
+	RRSetCacheSizeMB  int       `gorm:"column:rrset_cache_size_mb"    json:"rrset_cache_size_mb"`
+	UpdatedAt         time.Time `gorm:"column:updated_at"             json:"updated_at"`
 }
 
 func (DNSSettings) TableName() string { return "dns_settings" }

internal/models/domain.go

@@ -3,15 +3,24 @@ package models
 import "time"
 
 type Domain struct {
-	ID                int64     `gorm:"primaryKey"                  json:"id"`
-	Name              string    `gorm:"column:name;uniqueIndex"     json:"name"`
-	Active            bool      `gorm:"column:active"               json:"active"`
-	PrimaryBackendID  *int64    `gorm:"column:primary_backend_id"   json:"primary_backend_id,omitempty"`
-	HTTPToHTTPS       bool      `gorm:"column:http_to_https"        json:"http_to_https"`
-	HSTSEnabled       bool      `gorm:"column:hsts_enabled"         json:"hsts_enabled"`
-	Notes             *string   `gorm:"column:notes"                json:"notes,omitempty"`
-	CreatedAt         time.Time `gorm:"column:created_at"           json:"created_at"`
-	UpdatedAt         time.Time `gorm:"column:updated_at"           json:"updated_at"`
+	ID                 int64     `gorm:"primaryKey"                  json:"id"`
+	Name               string    `gorm:"column:name;uniqueIndex"     json:"name"`
+	Active             bool      `gorm:"column:active"               json:"active"`
+	PrimaryBackendID   *int64    `gorm:"column:primary_backend_id"   json:"primary_backend_id,omitempty"`
+	HTTPToHTTPS        bool      `gorm:"column:http_to_https"        json:"http_to_https"`
+	HSTSEnabled        bool      `gorm:"column:hsts_enabled"         json:"hsts_enabled"`
+	HSTSMaxAge         int       `gorm:"column:hsts_max_age"         json:"hsts_max_age"`
+	HSTSSubdomains     bool      `gorm:"column:hsts_subdomains"      json:"hsts_subdomains"`
+	HSTSPreload        bool      `gorm:"column:hsts_preload"         json:"hsts_preload"`
+	MaintenanceMode    bool      `gorm:"column:maintenance_mode"     json:"maintenance_mode"`
+	MaintenanceMessage *string   `gorm:"column:maintenance_message"  json:"maintenance_message,omitempty"`
+	WWWRedirect        string    `gorm:"column:www_redirect"         json:"www_redirect"` // ""|"to-naked"|"to-www"
+	RateLimitRPS       int       `gorm:"column:rate_limit_rps"       json:"rate_limit_rps"`
+	MaxBodyKB          int       `gorm:"column:max_body_kb"          json:"max_body_kb"`
+	DisableH3          bool      `gorm:"column:disable_h3"           json:"disable_h3"`
+	Notes              *string   `gorm:"column:notes"                json:"notes,omitempty"`
+	CreatedAt          time.Time `gorm:"column:created_at"           json:"created_at"`
+	UpdatedAt          time.Time `gorm:"column:updated_at"           json:"updated_at"`
 }
 
 func (Domain) TableName() string { return "domains" }

internal/models/domain_response_header.go

@@ -0,0 +1,19 @@
+package models
+
+import "time"
+
+// DomainResponseHeader stellt einen einzelnen HTTP-Response-Header dar,
+// den HAProxy für alle Antworten einer Domain mit `http-response set-header`
+// setzt. Mehrere Einträge pro Domain möglich; Name ist case-insensitive
+// unique (siehe Migration 0024).
+type DomainResponseHeader struct {
+	ID        int64     `gorm:"primaryKey"          json:"id"`
+	DomainID  int64     `gorm:"column:domain_id"    json:"domain_id"`
+	Name      string    `gorm:"column:name"         json:"name"`
+	Value     string    `gorm:"column:value"        json:"value"`
+	Position  int       `gorm:"column:position"     json:"position"`
+	CreatedAt time.Time `gorm:"column:created_at"   json:"created_at"`
+	UpdatedAt time.Time `gorm:"column:updated_at"   json:"updated_at"`
+}
+
+func (DomainResponseHeader) TableName() string { return "domain_response_headers" }

internal/models/firewall_nat_rule.go

@@ -33,6 +33,8 @@ type FirewallNATRule struct {
 	TargetPortEnd   *int      `gorm:"column:target_port_end"      json:"target_port_end,omitempty"`
 
 	Comment         *string   `gorm:"column:comment"              json:"comment,omitempty"`
+	Note            *string   `gorm:"column:note"                 json:"note,omitempty"`
+	Labels          []string  `gorm:"column:labels"               json:"labels"`
 	CreatedAt       time.Time `gorm:"column:created_at"           json:"created_at"`
 	UpdatedAt       time.Time `gorm:"column:updated_at"           json:"updated_at"`
 }

internal/models/firewall_rule.go

@@ -36,6 +36,8 @@ type FirewallRule struct {
 
 	Log                 bool      `gorm:"column:log"                       json:"log"`
 	Comment             *string   `gorm:"column:comment"                   json:"comment,omitempty"`
+	Note                *string   `gorm:"column:note"                      json:"note,omitempty"`
+	Labels              []string  `gorm:"column:labels;serializer:json"    json:"labels"`
 	CreatedAt           time.Time `gorm:"column:created_at"                json:"created_at"`
 	UpdatedAt           time.Time `gorm:"column:updated_at"                json:"updated_at"`
 }

internal/models/forward_proxy_settings.go

@@ -0,0 +1,19 @@
+package models
+
+import "time"
+
+type ForwardProxySettings struct {
+	ID              int       `gorm:"primaryKey"              json:"id"`
+	ListenAddresses string    `gorm:"column:listen_addresses" json:"listen_addresses"`
+	ListenPort      int       `gorm:"column:listen_port"      json:"listen_port"`
+	CacheMemMB      int       `gorm:"column:cache_mem_mb"     json:"cache_mem_mb"`
+	CacheDirMB      int       `gorm:"column:cache_dir_mb"     json:"cache_dir_mb"`
+	MaxObjSizeMB    int       `gorm:"column:max_obj_size_mb"  json:"max_obj_size_mb"`
+	ConnectTimeout  int       `gorm:"column:connect_timeout"  json:"connect_timeout"`
+	ReadTimeout     int       `gorm:"column:read_timeout"     json:"read_timeout"`
+	RequestTimeout  int       `gorm:"column:request_timeout"  json:"request_timeout"`
+	CreatedAt       time.Time `gorm:"column:created_at"       json:"created_at"`
+	UpdatedAt       time.Time `gorm:"column:updated_at"       json:"updated_at"`
+}
+
+func (ForwardProxySettings) TableName() string { return "forward_proxy_settings" }

internal/models/ha_node.go

@@ -4,7 +4,7 @@ import "time"
 
 // HANode mirrort eine Row der ha_nodes-Tabelle. Erweitert in Migration
 // 0020 um version/config_hash/mgmt_ip/status für Cluster-Phase-3-
-// Drift-Detection + Health-State.
+// Drift-Detection + Health-State. Migration 0029 fügt PGRole hinzu.
 type HANode struct {
 	ID         string     `gorm:"column:id;primaryKey"           json:"id"`
 	Name       string     `gorm:"column:name"                    json:"name"`
@@ -14,6 +14,7 @@ type HANode struct {
 	InternalIP *string    `gorm:"column:internal_ip;type:inet"   json:"internal_ip,omitempty"`
 	MgmtIP     *string    `gorm:"column:mgmt_ip;type:inet"       json:"mgmt_ip,omitempty"`
 	Role       string     `gorm:"column:role"                    json:"role"`
+	PGRole     string     `gorm:"column:pg_role"                 json:"pg_role"`
 	Version    *string    `gorm:"column:version"                 json:"version,omitempty"`
 	ConfigHash *string    `gorm:"column:config_hash"             json:"config_hash,omitempty"`
 	Status     string     `gorm:"column:status"                  json:"status"`

internal/models/oidc_settings.go

@@ -0,0 +1,21 @@
+package models
+
+import "time"
+
+// OIDCSettings ist die Singleton-Konfiguration für OIDC/Keycloak-SSO.
+// ClientSecretEnc trägt den verschlüsselten Client-Secret (secrets.Box)
+// und wird NIE serialisiert (json:"-").
+type OIDCSettings struct {
+	ID              int       `gorm:"column:id;primaryKey"        json:"id"`
+	Enabled         bool      `gorm:"column:enabled"              json:"enabled"`
+	IssuerURL       string    `gorm:"column:issuer_url"           json:"issuer_url"`
+	ClientID        string    `gorm:"column:client_id"            json:"client_id"`
+	ClientSecretEnc []byte    `gorm:"column:client_secret_enc"    json:"-"`
+	Scopes          string    `gorm:"column:scopes"               json:"scopes"`
+	EmailClaim      string    `gorm:"column:email_claim"          json:"email_claim"`
+	ButtonLabel     string    `gorm:"column:button_label"         json:"button_label"`
+	CreatedAt       time.Time `gorm:"column:created_at"           json:"created_at"`
+	UpdatedAt       time.Time `gorm:"column:updated_at"           json:"updated_at"`
+}
+
+func (OIDCSettings) TableName() string { return "oidc_settings" }

internal/models/waf.go

@@ -0,0 +1,20 @@
+package models
+
+import "time"
+
+// WafConfig holds the per-domain WAF policy.
+// Default on creation: enabled=false, mode=detection, paranoia_level=1.
+type WafConfig struct {
+	ID               int64             `gorm:"primaryKey"                   json:"id"`
+	DomainID         int64             `gorm:"column:domain_id;uniqueIndex"  json:"domain_id"`
+	Enabled          bool              `gorm:"column:enabled"               json:"enabled"`
+	Mode             string            `gorm:"column:mode"                  json:"mode"`           // "detection" | "blocking"
+	ParanoiaLevel    int               `gorm:"column:paranoia_level"        json:"paranoia_level"` // 1–4
+	RuleExclusions   []string          `gorm:"column:rule_exclusions;type:text[]" json:"rule_exclusions"`
+	ExclusionNotes   map[string]string `gorm:"column:exclusion_notes;type:jsonb"  json:"exclusion_notes"` // rule_id → note
+	TrustedProxies   []string          `gorm:"column:trusted_proxies;type:text[]" json:"trusted_proxies"`
+	CustomRules      string            `gorm:"column:custom_rules"          json:"custom_rules"`
+	UpdatedAt        time.Time         `gorm:"column:updated_at"            json:"updated_at"`
+}
+
+func (WafConfig) TableName() string { return "waf_configs" }

internal/models/wireguard.go

@@ -18,6 +18,7 @@ type WireguardInterface struct {
 	AllowedIPs          *string   `gorm:"column:allowed_ips"         json:"allowed_ips,omitempty"`
 	PersistentKeepalive *int      `gorm:"column:persistent_keepalive" json:"persistent_keepalive,omitempty"`
 	MTU                 *int      `gorm:"column:mtu"                 json:"mtu,omitempty"`
+	ClientRoutes        *string   `gorm:"column:client_routes"       json:"client_routes,omitempty"`
 	Role                string    `gorm:"column:role"                json:"role"`
 	Active              bool      `gorm:"column:active"              json:"active"`
 	Description         *string   `gorm:"column:description"         json:"description,omitempty"`

internal/services/apt/apt.go

@@ -0,0 +1,239 @@
+// Package apt kapselt die APT-Operationen die der Update-Banner braucht:
+// gedrosseltes `apt-get update`, locale-stabiler `apt-cache policy` und
+// ein Background-Refresh-Timer der die Apt-Indexe warm hält.
+//
+// Pattern 1:1 von mail-gateway/internal/services/apt/apt.go übernommen
+// (siehe dortige Doc-Kommentare für die Bug-Historie). Kurzfassung:
+//
+//   - `LC_ALL=C` zwingt apt auf englischen Output — sonst gibt apt auf
+//     einem deutschen Locale „Installationskandidat:" und unser
+//     Prefix-Match auf „Candidate:" failt silent.
+//   - Eigener Timeout-Kontext für apt-cache policy, damit ein
+//     gecancelltes Request den Read nicht killt.
+//   - 5-min-Throttle für `apt-get update` damit der UI-Poll-Tick (30 s)
+//     nicht jedes Mal das Mirror-Update tritt. Operator kann via
+//     RefreshNow den Throttle überspringen.
+//   - Background-Refresh-Goroutine die alle 5 min einen apt-get update
+//     fährt, damit kurz nach `make publish` der Banner aufgeht ohne
+//     dass jemand erst die UI öffnen muss.
+package apt
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/exec"
+	"runtime/debug"
+	"strings"
+	"sync"
+	"time"
+)
+
+// edgePackages: die deb-Pakete deren Versionen der UI-Banner anzeigt.
+// Reihenfolge bestimmt was der Banner als "primary" zeigt — `edgeguard`
+// ist das Meta-Paket, das wir bevorzugen.
+var edgePackages = []string{"edgeguard", "edgeguard-api", "edgeguard-ui"}
+
+// PackageVersions liefert installed/available pro edgeguard-Paket im
+// flachen Key-Format das die UI bereits konsumiert.
+//
+// Wenn force=true wird der 5-min-Throttle für apt-get update übersprungen.
+func PackageVersions(ctx context.Context, force bool) map[string]string {
+	if force {
+		RefreshNow(ctx)
+	} else {
+		RefreshIfStale(ctx)
+	}
+
+	out := map[string]string{}
+	// Eigener Background-Kontext für apt-cache policy: wenn der
+	// Request canceln sollte (Gateway-Timeout etc), wollen wir den
+	// Cache-Read trotzdem durchziehen — Lists sind lokal, das dauert
+	// Millisekunden.
+	policyCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	for _, pkg := range edgePackages {
+		installed, candidate := aptCachePolicy(policyCtx, pkg)
+		out[pkg+"_installed"] = installed
+		out[pkg+"_available"] = candidate
+	}
+	return out
+}
+
+// ── apt-get update Throttle ────────────────────────────────────────────
+
+var (
+	aptUpdateMu     sync.Mutex
+	aptUpdateLastAt time.Time
+)
+
+// aptUpdateThrottle: wie oft maximal `apt-get update` ausgeführt werden
+// darf. Der Background-Timer (StartBackgroundRefresh) tickt im selben
+// Intervall, das deckt den UI-Banner-Fall (30-s-Poll) bequem ab.
+const aptUpdateThrottle = 5 * time.Minute
+
+// RefreshIfStale: führt apt-get update aus wenn der letzte Lauf älter
+// als aptUpdateThrottle ist; sonst No-Op.
+func RefreshIfStale(ctx context.Context) { refreshInternal(ctx, false) }
+
+// RefreshNow: erzwingt apt-get update sofort, bypassed den Throttle.
+// Wird vom UI-„Jetzt prüfen"-Button via `?force=1` getriggert, damit
+// der Operator nach einem `make publish` nicht 5 min warten muss.
+func RefreshNow(ctx context.Context) { refreshInternal(ctx, true) }
+
+func refreshInternal(ctx context.Context, force bool) {
+	aptUpdateMu.Lock()
+	doUpdate := force || time.Since(aptUpdateLastAt) >= aptUpdateThrottle
+	if doUpdate {
+		aptUpdateLastAt = time.Now()
+	}
+	aptUpdateMu.Unlock()
+	if !doUpdate {
+		return
+	}
+	// 25-s-Budget — kürzer als der typische 30-s-Gateway-Timeout, damit
+	// ein hängendes apt-get update einen WARN log gibt statt SIGKILL.
+	updCtx, cancel := context.WithTimeout(ctx, 25*time.Second)
+	defer cancel()
+	// edgeguard-api läuft als unprivilegierter User; /var/lib/apt/lists
+	// ist root-owned. postinst pinned `sudo -n /usr/bin/apt-get update -qq`
+	// in /etc/sudoers.d/edgeguard.
+	cmd := exec.CommandContext(updCtx, "sudo", "-n", "/usr/bin/apt-get", "update", "-qq")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		slog.Warn("apt: update failed (best-effort, falling back to cached lists)",
+			"error", err,
+			"output", strings.TrimSpace(string(out)))
+	}
+}
+
+// StartBackgroundRefresh: Fire-and-Forget-Goroutine die einmal beim
+// Start + dann periodisch apt-get update fährt, damit der Apt-Cache
+// auch ohne UI-Traffic frisch bleibt. So zeigt der Banner kurz nach
+// `make publish` ein verfügbares Update, statt 5 min auf die nächste
+// UI-Poll-Welle zu warten.
+func StartBackgroundRefresh(ctx context.Context) {
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				slog.Error("apt background refresh panic",
+					"panic", r, "stack", string(debug.Stack()))
+			}
+		}()
+		RefreshIfStale(ctx) // Initial warm-up
+		slog.Info("apt: background refresh timer started",
+			"interval", aptUpdateThrottle.String())
+		t := time.NewTicker(aptUpdateThrottle)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				slog.Info("apt: background refresh timer stopping")
+				return
+			case <-t.C:
+				RefreshIfStale(ctx)
+			}
+		}
+	}()
+}
+
+// ── apt-cache policy ──────────────────────────────────────────────────
+
+// aptCachePolicy: pullt Installed:/Candidate: aus `apt-cache policy <pkg>`.
+// (none) wird zu "" gemappt.
+//
+// LC_ALL=C zwingt englischen Output — auf de_DE.UTF-8 spuckt apt sonst
+// „Installationskandidat:" und das Match unten failed silent. Bug-Befund
+// aus mail-gateway 2026-05-03, siehe internal/services/apt/apt.go dort.
+func aptCachePolicy(ctx context.Context, pkg string) (installed, candidate string) {
+	cmd := exec.CommandContext(ctx, "apt-cache", "policy", pkg)
+	cmd.Env = append(os.Environ(), "LC_ALL=C", "LANG=C")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		slog.Warn("apt-cache policy failed",
+			"pkg", pkg, "error", err,
+			"output", strings.TrimSpace(string(out)))
+		return "", ""
+	}
+	// Diagnose: wenn weder Installed: noch Candidate: gefunden wird,
+	// dump den raw output — sonst rätselt man warum die UI leer bleibt.
+	defer func() {
+		if installed == "" && candidate == "" {
+			slog.Warn("apt-cache policy returned without Installed/Candidate match — raw output follows",
+				"pkg", pkg, "raw_output", strings.TrimSpace(string(out)))
+		}
+	}()
+	for _, raw := range strings.Split(string(out), "\n") {
+		line := strings.TrimSpace(raw)
+		if strings.HasPrefix(line, "Installed:") {
+			v := strings.TrimSpace(strings.TrimPrefix(line, "Installed:"))
+			if v != "(none)" {
+				installed = v
+			}
+		}
+		if strings.HasPrefix(line, "Candidate:") {
+			v := strings.TrimSpace(strings.TrimPrefix(line, "Candidate:"))
+			if v != "(none)" {
+				candidate = v
+			}
+		}
+	}
+	return
+}
+
+// ── Auto-Update (unattended-upgrades-Whitelist) ───────────────────────
+
+// AutoUpdateConfPath: APT-Preferences-File das die edgeguard-Pakete in
+// die unattended-upgrades-Whitelist setzt. Setup unattended-upgrades
+// + apt-listchanges sind nicht-Pflicht; ohne diese Pakete hat das File
+// keinen Effekt, bricht aber auch nichts.
+const AutoUpdateConfPath = "/etc/apt/apt.conf.d/52edgeguard-auto-updates"
+
+// autoUpdateConfBody whitelisted die drei edgeguard-Paketnamen für die
+// unattended-upgrades-Periodic. Pattern 1:1 aus mail-gateway; sicheres
+// Default — nur edgeguard-* werden automatisch aktualisiert, andere
+// Pakete bleiben unter manueller Kontrolle.
+const autoUpdateConfBody = `// Generated by edgeguard-api. Toggle via Settings → "Automatische Updates".
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+
+Unattended-Upgrade::Allowed-Origins {
+    "origin=netcell-it.de,suite=trixie";
+};
+
+Unattended-Upgrade::Package-Whitelist {
+    "edgeguard";
+    "edgeguard-api";
+    "edgeguard-ui";
+};
+`
+
+// SetAutoUpdate schreibt (enabled=true) oder entfernt (false) das
+// /etc/apt/apt.conf.d-File. /etc/apt/apt.conf.d ist root-owned und die
+// edgeguard-api läuft als non-root unter ProtectSystem=strict (siehe
+// auch [[deploy/systemd/edgeguard-api.service]]). Daher geht der Write
+// über sudo tee — der exakte Pfad ist in postinst-sudoers gepinnt.
+func SetAutoUpdate(enabled bool) error {
+	if enabled {
+		cmd := exec.Command("sudo", "-n", "/usr/bin/tee", AutoUpdateConfPath)
+		cmd.Stdin = strings.NewReader(autoUpdateConfBody)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("sudo tee %s: %w: %s", AutoUpdateConfPath, err, strings.TrimSpace(string(out)))
+		}
+		return nil
+	}
+	out, err := exec.Command("sudo", "-n", "/bin/rm", "-f", AutoUpdateConfPath).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("sudo rm %s: %w: %s", AutoUpdateConfPath, err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// AutoUpdateEnabled liefert true wenn das Conf-File existiert.
+func AutoUpdateEnabled() bool {
+	_, err := os.Stat(AutoUpdateConfPath)
+	return err == nil
+}

internal/services/audit/audit.go

@@ -98,6 +98,98 @@ LIMIT $1`, limit)
 	return out, rows.Err()
 }
 
+// SearchFilter beschreibt einen filter-gestützten Audit-Log-Abruf.
+// Alle Felder optional — leere Werte werden vom Query ignoriert. Such-
+// Strings sind case-insensitive ILIKE-Substring-Matches. Limit wird auf
+// 500 gedeckelt (UI-Schutz vor versehentlichem Full-Scan), Offset für
+// einfaches Paging.
+type SearchFilter struct {
+	Actor   string
+	Action  string
+	Subject string
+	Since   *time.Time
+	Until   *time.Time
+	Limit   int
+	Offset  int
+}
+
+// Search liefert audit_log-Einträge nach Filter, newest first. Filter-
+// Felder werden via dynamisch zusammengesetzter WHERE-Klausel angewendet
+// — Parametrisiert (kein String-Concat von User-Input).
+func (r *Repo) Search(ctx context.Context, f SearchFilter) ([]Entry, error) {
+	if r == nil || r.Pool == nil {
+		return []Entry{}, nil
+	}
+	limit := f.Limit
+	if limit <= 0 || limit > 500 {
+		limit = 100
+	}
+	offset := f.Offset
+	if offset < 0 {
+		offset = 0
+	}
+	args := []any{}
+	where := ""
+	add := func(cond string, val any) {
+		args = append(args, val)
+		if where == "" {
+			where = " WHERE " + cond + "$" + itoa(len(args))
+		} else {
+			where += " AND " + cond + "$" + itoa(len(args))
+		}
+	}
+	if f.Actor != "" {
+		add("actor ILIKE ", "%"+f.Actor+"%")
+	}
+	if f.Action != "" {
+		add("action ILIKE ", "%"+f.Action+"%")
+	}
+	if f.Subject != "" {
+		add("subject ILIKE ", "%"+f.Subject+"%")
+	}
+	if f.Since != nil {
+		add("created_at >= ", *f.Since)
+	}
+	if f.Until != nil {
+		add("created_at <= ", *f.Until)
+	}
+	args = append(args, limit, offset)
+	q := "SELECT id, actor, action, subject, detail, node_id, created_at FROM audit_log" +
+		where +
+		" ORDER BY created_at DESC, id DESC LIMIT $" + itoa(len(args)-1) +
+		" OFFSET $" + itoa(len(args))
+	rows, err := r.Pool.Query(ctx, q, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]Entry, 0, limit)
+	for rows.Next() {
+		var e Entry
+		if err := rows.Scan(&e.ID, &e.Actor, &e.Action, &e.Subject, &e.Detail, &e.NodeID, &e.CreatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+func itoa(n int) string {
+	// kleiner local-Helper damit wir nicht strconv für Single-Digit-
+	// Parameter-Indizes importieren müssen.
+	if n < 10 {
+		return string(rune('0' + n))
+	}
+	// >9 Parameter ist hier in der Praxis nicht möglich (Filter <= 5 +
+	// LIMIT/OFFSET = 7), aber Fallback für Robustness.
+	s := ""
+	for n > 0 {
+		s = string(rune('0'+n%10)) + s
+		n /= 10
+	}
+	return s
+}
+
 // Log writes one audit_log row. detail is JSON-encodable (typically a
 // map[string]any) — empty map means "no payload". If pool is nil
 // (e.g. dev env without DB), Log silently no-ops so handlers don't
@@ -153,3 +245,24 @@ RETURNING id, created_at`,
 	r.broadcast(e)
 	return nil
 }
+
+// Cleanup löscht alle audit_log-Rows die älter als keepDays sind.
+// Schutz vor unbounded growth bei langlebigen Boxen (audit_log kann
+// sonst nach 1-2 Jahren mehrere GB Disk + entsprechende Query-Latenz
+// haben). Liefert die Anzahl gelöschter Rows.
+//
+// keepDays <= 0 → no-op (Cleanup deaktiviert, alles bleibt erhalten).
+// keepDays sollte deutlich über Audit-Anforderungen liegen — 90 Tage
+// ist ein vernünftiger Default für Self-Service-Boxen.
+func (r *Repo) Cleanup(ctx context.Context, keepDays int) (int64, error) {
+	if r == nil || r.Pool == nil || keepDays <= 0 {
+		return 0, nil
+	}
+	tag, err := r.Pool.Exec(ctx, `
+DELETE FROM audit_log
+WHERE created_at < NOW() - ($1::text || ' days')::interval`, keepDays)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}