feat(dhcp): DHCPv4-Server via Kea (kea-dhcp4-server) — v1.2.92

Verwalteter DHCPv4-Server analog Unbound/Squid/Chrony.
- Migration 0041: dhcp_settings (singleton, node-lokal), dhcp_subnets, dhcp_reservations.
- internal/kea: Renderer baut Kea-JSON via Go-Struct→Marshal (garantiert valide), managed /etc/edgeguard/kea/kea-dhcp4.conf (Symlink von /etc/kea), Service-Lifecycle an enabled gekoppelt (default AUS, kein rogue DHCP). Interface per NAME (cluster-sicher, kein node-lokaler FK).
- internal/services/dhcp + internal/handlers/dhcp.go: Settings + Subnet/Reservation-CRUD, Validierung (CIDR/IP/MAC/interface exists).
- configgen: Stop/Enable/DisableService. Firewall: AutoFWRule.Iface → udp/67 pro LAN-Interface gescopt (kein WAN). Cluster: subnets/reservations repliziert (hashSpec), dhcp_settings node-lokal (localOnlyTables).
- main.go + render.go + WithAllReloaders Wiring. Packaging: kea-dhcp4-server Dependency, /etc/edgeguard/kea Dir, Symlink, disable-on-install, sudoers (restart/stop/enable/disable).
- UI: DHCP-Seite (Settings + Subnets + Reservierungen pro Subnet), Route/Nav/i18n de/en, HA-Warnung 'nur auf einer Node aktivieren'.
- Tests (guarded EG_FWTEST_DSN): Kea-Renderer gegen DB (valides JSON + Felder), FW-Auto-Rule-Iface inkl. nft -c. Scope v1: DHCPv4.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Makefile

@@ -4,7 +4,7 @@
 
 GO       ?= $(shell which go || echo /usr/local/go/bin/go)
 MODULE   := git.netcell-it.de/projekte/edgeguard-native
-BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl
+BINARIES := edgeguard-api edgeguard-scheduler edgeguard-ctl edgeguard-waf
 VERSION  := $(shell cat VERSION 2>/dev/null || echo 0.0.1-dev)
 LDFLAGS  := -s -w -X main.version=$(VERSION)
 GOFLAGS  := -trimpath -mod=readonly

VERSION

@@ -1 +1 @@
-1.1.162
+1.2.92

cmd/edgeguard-api/main.go

@@ -28,6 +28,7 @@ import (
 	squidrender "git.netcell-it.de/projekte/edgeguard-native/internal/squid"
 	unboundrender "git.netcell-it.de/projekte/edgeguard-native/internal/unbound"
 	wgrender "git.netcell-it.de/projekte/edgeguard-native/internal/wireguard"
+	kearender "git.netcell-it.de/projekte/edgeguard-native/internal/kea"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/acme"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/alerts"
@@ -40,6 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/aggregator"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/jointoken"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/clusterjoin"
 	aptsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/apt"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domainheaders"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domains"
@@ -57,10 +59,13 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 	wgsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/wireguard"
+	dhcpsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/dhcp"
+	oidcsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/oidc"
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+	wafsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
 )
 
-var version = "1.1.162"
+var version = "1.2.35"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
@@ -175,6 +180,20 @@ func main() {
 			go runClusterHeartbeat(context.Background(), pool, nodeID, version)
 		}
 
+		// Secondary: push config_hash to primary every 5 min so the primary's
+		// ha_nodes reflects actual state. Without this, the primary retains the
+		// stale hash written at join-time and the drift banner never clears.
+		// st.IsClusterNode + PrimaryFQDN are only set on joined secondary nodes.
+		if nodeID != "" && st != nil && st.IsClusterNode && st.PrimaryFQDN != "" {
+			if primaryURL, normErr := clusterjoin.NormalizePrimaryURL(st.PrimaryFQDN); normErr == nil {
+				go runPrimaryPush(context.Background(), pool, nodeID, st.FQDN, version, primaryURL)
+			} else {
+				slog.Warn("cluster: cannot normalize primary URL for push", "primary", st.PrimaryFQDN, "error", normErr)
+			}
+			// runSecondaryConfigRender wird weiter unten gestartet sobald
+			// clusterAggregator verfügbar ist (braucht mTLS-Client für Cert-Sync).
+		}
+
 		// Phase 3.3: Cluster-CA + Peer-Cert. Founder-Pfad — auf einem
 		// frisch installierten Single-Node generieren wir die CA und
 		// signieren uns selbst, damit der Agent-Listener auf :8443
@@ -219,6 +238,12 @@ func main() {
 			}
 		}
 
+		// Secondary-Config-Render: jetzt wo der Aggregator bereit ist starten.
+		// Aggregator wird für Cert-Sync (mTLS GET /agent/cluster/tls-certs) benötigt.
+		if nodeID != "" && st != nil && st.IsClusterNode && st.PrimaryFQDN != "" {
+			go runSecondaryConfigRender(context.Background(), pool, secrets.New(""), clusterAggregator, nodeID)
+		}
+
 		auditRepo := audit.New(pool)
 		domainsRepo := domains.New(pool)
 		domainHeadersRepo := domainheaders.New(pool)
@@ -294,6 +319,14 @@ func main() {
 		authed.Use(requireAuth, handlers.RequireAdminForMutations())
 		setupHdl.RegisterAuthed(authed)
 		handlers.NewUsersHandler(usersRepo, auditRepo, nodeID).Register(authed)
+
+		// OIDC/Keycloak SSO — public Flow-Endpoints auf v1 (hinter SetupGate),
+		// Admin-Settings auf authed (PUT nur admin via RequireAdminForMutations).
+		oidcRepo := oidcsvc.New(pool, secretsBox)
+		oidcHdl := handlers.NewOIDCHandler(oidcRepo, oidcsvc.NewClient(oidcRepo), usersRepo, signer, setupStore).
+			WithAudit(auditRepo, nodeID)
+		oidcHdl.RegisterPublic(v1)
+		oidcHdl.RegisterAdmin(authed)
 		handlers.NewDomainsHandler(domainsRepo, routingRepo, domainHeadersRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
 		handlers.NewBackendsHandler(backendsRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
 		handlers.NewBackendServersHandler(backendServersRepo, auditRepo, nodeID, haproxyReloader).Register(authed)
@@ -324,7 +357,9 @@ func main() {
 		clusterHdl := handlers.NewClusterHandler(clusterStore, nodeID).
 			WithAggregator(clusterAggregator).
 			WithJoinFlow(clusterTLSStore, joinTokens).
-			WithPeerReloader(peerReloader)
+			WithPeerReloader(peerReloader).
+			WithAudit(auditRepo, nodeID).
+			WithVersion(version)
 		clusterHdl.Register(authed)
 		// /cluster/issue-cert läuft PUBLIC — joining Peer hat noch
 		// keine Session/Cert. Token + Nonce-Tracking ist die einzige
@@ -360,6 +395,8 @@ func main() {
 			return firewallrender.New(pool).Render(ctx)
 		}
 		handlers.NewFirewallHandler(fwZones, fwAddrObj, fwAddrGrp, fwSvc, fwSvcGrp, fwRules, fwNAT, auditRepo, nodeID, fwReloader, pool).Register(authed)
+		handlers.NewCrowdSecHandler(auditRepo, nodeID).Register(authed)
+		handlers.NewWafHandler(wafsvc.New(pool), auditRepo, nodeID, haproxyReloader).Register(authed)
 
 		// withFW wraps a service-reloader so that AFTER the service is
 		// reloaded, the firewall is also re-rendered. Necessary for
@@ -410,6 +447,12 @@ func main() {
 		}
 		handlers.NewNTPHandler(ntpRepo, auditRepo, nodeID, withFW(chronyReloader)).Register(authed)
 
+		// DHCP (Kea) — re-render kea-dhcp4.conf + manage service lifecycle.
+		keaReloader := func(ctx context.Context) error {
+			return kearender.New(pool).Render(ctx)
+		}
+		handlers.NewDHCPHandler(dhcpsvc.New(pool), auditRepo, nodeID, withFW(keaReloader)).Register(authed)
+
 		// Wire all service reloaders into systemHdl so RenderConfigs
 		// re-renders every service from DB state in one shot.
 		systemHdl.WithAllReloaders(map[string]func(context.Context) error{
@@ -418,6 +461,7 @@ func main() {
 			"squid":     squidReloader,
 			"unbound":   unboundReloader,
 			"chrony":    chronyReloader,
+			"kea":       keaReloader,
 		})
 
 		// License — node-local key store + DB-mirror of last verify
@@ -457,6 +501,10 @@ func main() {
 	// schon erledigt.
 	startAgentListener(version, agentHdl, systemHdl)
 
+	// Nach einem Upgrade-Neustart: wenn die State-Datei "updating-primary"
+	// enthält, sind wir gerade neu gestartet → Update abgeschlossen → "done".
+	handlers.FinishRollingUpdateIfPending()
+
 	log.Printf("edgeguard-api %s listening on %s", version, addr)
 	srv := &http.Server{Addr: addr, Handler: r}
 	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -560,10 +608,18 @@ func mountUI(r *gin.Engine) {
 			return
 		}
 		if info, err := os.Stat(full); err == nil && !info.IsDir() {
+			// Vite hashed assets are immutable — cache them forever.
+			// index.html must never be cached so updates take effect.
+			if strings.HasPrefix(clean, "/assets/") {
+				c.Header("Cache-Control", "public, max-age=31536000, immutable")
+			} else {
+				c.Header("Cache-Control", "no-cache, no-store, must-revalidate")
+			}
 			c.File(full)
 			return
 		}
 		// SPA fallback — React Router renders the right page.
+		c.Header("Cache-Control", "no-cache, no-store, must-revalidate")
 		c.File(indexPath)
 	})
 }
@@ -680,6 +736,116 @@ func runClusterHeartbeat(ctx context.Context, pool *pgxpoolPool, localID, versio
 	}
 }
 
+// runSecondaryConfigRender läuft auf Secondary-Nodes und re-rendert alle
+// Service-Configs wenn die Logical Replication Änderungen vom Primary
+// geliefert hat. Erkennt das an einem geänderten config_hash.
+// Tick: 5 min — balanciert Reaktionszeit gegen Reload-Overhead.
+//
+// Cert-Sync läuft auf jedem Tick unabhängig vom config_hash, da certbot-
+// Renewals auf dem Primary den Hash nicht ändern.
+func runSecondaryConfigRender(ctx context.Context, pool *pgxpoolPool, box *secrets.Box, agg *aggregator.Aggregator, localID string) {
+	const tick = 5 * time.Minute
+	t := time.NewTicker(tick)
+	defer t.Stop()
+	var lastHash string
+	render := func() {
+		rCtx, cancel := context.WithTimeout(ctx, 90*time.Second)
+		defer cancel()
+
+		// TLS-Zertifikate bei jedem Tick synchronisieren — unabhängig vom
+		// config_hash, da certbot-Renewals den Hash nicht berühren.
+		if err := handlers.SyncTLSCertsFromPrimary(rCtx, pool, agg, localID); err != nil {
+			slog.Warn("cluster: cert sync failed", "error", err)
+		}
+
+		hash, err := cluster.ComputeConfigHash(rCtx, pool)
+		if err != nil || hash == lastHash {
+			return
+		}
+		lastHash = hash
+		slog.Info("cluster: secondary config changed via replication, re-rendering", "hash", hash)
+		// HAProxy
+		if err := haproxy.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary haproxy render failed", "error", err)
+		}
+		// nftables
+		if err := firewallrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary nftables render failed", "error", err)
+		}
+		// WireGuard — Interface-Configs + wg-quick@<iface> reload
+		if err := wgrender.New(pool, box).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary wireguard render failed", "error", err)
+		}
+		// Squid forward proxy
+		if err := squidrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary squid render failed", "error", err)
+		}
+		// Unbound DNS
+		if err := unboundrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary unbound render failed", "error", err)
+		}
+		// Chrony NTP
+		if err := chronyrender.New(pool).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary chrony render failed", "error", err)
+		}
+		// Netzwerk-Interfaces (VLAN/Bridge/Bond) — erstellt Interface-Objekte,
+		// weist aber KEINE IPs zu (das ist node-spezifisch und darf nicht aus
+		// der Replikation kommen — sonst IP-Konflikt mit dem Primary).
+		if err := networkifs.NewGenerator(networkifs.New(pool)).Render(rCtx); err != nil {
+			slog.Warn("cluster: secondary interfaces render failed", "error", err)
+		}
+		// IP-Adressen werden auf dem Secondary NICHT aus der Replikation
+		// angewendet. Jeder Node konfiguriert seine eigenen IPs statisch
+		// (z.B. /etc/network/interfaces). Floating-Service-IPs werden von
+		// Keepalived verwaltet — nicht vom Renderer.
+	}
+	// Initialer Check nach kurzem Delay (Replication braucht einen Moment)
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(30 * time.Second):
+		render()
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			render()
+		}
+	}
+}
+
+// runPrimaryPush periodically pushes this secondary node's config_hash to the
+// primary via mTLS. The primary's ha_nodes view only gets config_hash written
+// during join-time autoRegister — after that the primary never hears about
+// hash changes unless we push. Without this, the drift banner shows stale
+// hashes from join-time forever.
+func runPrimaryPush(ctx context.Context, pool *pgxpoolPool, nodeID, fqdn, version, primaryURL string) {
+	const tick = 5 * time.Minute
+	t := time.NewTicker(tick)
+	defer t.Stop()
+	push := func() {
+		pCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+		defer cancel()
+		hash, _ := cluster.ComputeConfigHash(pCtx, pool)
+		if err := clusterjoin.PushSelfToPrimary(primaryURL, "", nodeID, fqdn, version, hash); err != nil {
+			slog.Warn("cluster: push-to-primary failed", "error", err)
+		} else {
+			slog.Debug("cluster: config_hash pushed to primary", "hash", hash)
+		}
+	}
+	push() // immediate push on API startup
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			push()
+		}
+	}
+}
+
 func randomEphemeralSecret() []byte {
 	b := make([]byte, 32)
 	if _, err := rand.Read(b); err != nil {

cmd/edgeguard-ctl/cluster_replication.go

@@ -0,0 +1,574 @@
+package main
+
+import (
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/clustertls"
+)
+
+const (
+	egReplSecret = "/var/lib/edgeguard/pg-replication-secret"
+	egReplUser   = "edgeguard_replicator"
+	egPubName    = "edgeguard_shared"
+	egSubName    = "edgeguard_sub"
+)
+
+// pgConfig hält die zur Laufzeit erkannten PG-Pfade.
+type pgConfig struct {
+	Version string // z.B. "17"
+	Cluster string // z.B. "main"
+	DataDir string // /var/lib/postgresql/17/main
+	HBAPath string // /etc/postgresql/17/main/pg_hba.conf
+	ConfD   string // /etc/postgresql/17/main/conf.d
+}
+
+// detectPGConfig ermittelt Version, Cluster und Pfade aus der laufenden
+// PG-Instanz via SHOW hba_file / SHOW data_directory. Damit ist der Code
+// unabhängig von der PG-Hauptversion (16, 17, …).
+func detectPGConfig() (pgConfig, error) {
+	hbaRaw, err := psqlRun([]string{"-tA", "-c", "SHOW hba_file;"})
+	if err != nil {
+		return pgConfig{}, fmt.Errorf("cannot detect pg hba_file: %w", err)
+	}
+	hbaPath := strings.TrimSpace(string(hbaRaw))
+
+	dataRaw, err := psqlRun([]string{"-tA", "-c", "SHOW data_directory;"})
+	if err != nil {
+		return pgConfig{}, fmt.Errorf("cannot detect pg data_directory: %w", err)
+	}
+	dataDir := strings.TrimSpace(string(dataRaw))
+
+	// hbaPath: /etc/postgresql/<version>/<cluster>/pg_hba.conf
+	parts := strings.Split(filepath.ToSlash(hbaPath), "/")
+	if len(parts) < 6 {
+		return pgConfig{}, fmt.Errorf("unexpected hba_file path: %s", hbaPath)
+	}
+	version := parts[3]
+	cluster := parts[4]
+	confD := filepath.Join("/etc/postgresql", version, cluster, "conf.d")
+
+	return pgConfig{
+		Version: version,
+		Cluster: cluster,
+		DataDir: dataDir,
+		HBAPath: hbaPath,
+		ConfD:   confD,
+	}, nil
+}
+
+// localOnlyTables listet alle Tabellen die nicht in die Replikations-
+// Publication aufgenommen werden. Alles andere wird automatisch repliziert.
+var localOnlyTables = []string{
+	"ha_nodes",           // Node-Identität, Status
+	"network_interfaces", // Eigene Interfaces (eth0, eth1 …)
+	"ip_addresses",       // Eigene IP-Adressen (unterschiedlich pro Node!)
+	"static_routes",      // Node-spezifisches Routing
+	"cluster_settings",   // VIP-Interface kann pro Node unterschiedlich sein
+	"dns_settings",       // listen_addresses ist node-spezifisch
+	"ntp_settings",       // listen_addresses ist node-spezifisch
+	"dhcp_settings",      // ob DIESE Node DHCP betreibt (Dual-DHCP vermeiden)
+	"system_settings",    // Hostname, Maintenance-Mode etc.
+	"join_tokens_used",   // Token-Tracking nur auf Primary relevant
+	"audit_log",          // Lokales Audit-Protokoll
+	"alert_events",       // Lokale Laufzeit-Events
+	"backups",            // Backup-Historie ist per-Node
+	"goose_db_version",   // Migration-Tracking, internes Tool-State
+}
+
+// cmdClusterInitReplication richtet PG auf dieser Node als Logical-Replication-
+// Primary ein. Idempotent — kann gefahrlos mehrfach laufen.
+//
+// Ablauf:
+//  1. edgeguard_replicator-Rolle anlegen/aktualisieren
+//  2. Passwort → /var/lib/edgeguard/pg-replication-secret
+//  3. conf.d/edgeguard-replication.conf mit wal_level=logical schreiben
+//  4. pg_hba.conf für Replikations-Verbindungen aktualisieren
+//  5. SELECT-Grants auf alle geteilten Tabellen
+//  6. PUBLICATION erstellen (alle Tabellen außer localOnlyTables)
+//  7. PG reload
+func cmdClusterInitReplication(args []string) int {
+	fs := flag.NewFlagSet("cluster-init-replication", flag.ContinueOnError)
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+
+	pg, err := detectPGConfig()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: PG-Erkennung:", err)
+		return 1
+	}
+	fmt.Printf("→ PostgreSQL %s/%s erkannt\n", pg.Version, pg.Cluster)
+
+	// 1. Passwort generieren
+	pass, err := generatePassword(32)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: generate password:", err)
+		return 1
+	}
+
+	// 2. edgeguard_replicator-Rolle anlegen/updaten
+	roleSQL := fmt.Sprintf(`DO $$
+BEGIN
+  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '%s') THEN
+    CREATE ROLE %s REPLICATION LOGIN PASSWORD '%s';
+  ELSE
+    ALTER ROLE %s PASSWORD '%s';
+  END IF;
+END
+$$`, egReplUser, egReplUser, pass, egReplUser, pass)
+	if err := psqlExec(roleSQL); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: create replication role:", err)
+		return 1
+	}
+	fmt.Printf("✓ Replication-Rolle %q angelegt/aktualisiert\n", egReplUser)
+
+	// 3. Passwort speichern
+	if err := os.MkdirAll(filepath.Dir(egReplSecret), 0o750); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: mkdir:", err)
+		return 1
+	}
+	if err := os.WriteFile(egReplSecret, []byte(pass), 0o600); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: write secret:", err)
+		return 1
+	}
+	// Ownership an edgeguard-api-User übergeben damit die API lesen kann
+	if u, err := user.Lookup("edgeguard"); err == nil {
+		uid, _ := strconv.Atoi(u.Uid)
+		gid, _ := strconv.Atoi(u.Gid)
+		_ = os.Chown(egReplSecret, uid, gid)
+	}
+	fmt.Printf("✓ Replication-Secret gespeichert: %s\n", egReplSecret)
+
+	// 4. conf.d/edgeguard-replication.conf schreiben
+	// wal_level=logical ist eine Obermenge von replica — unterstützt
+	// sowohl Logical Replication als auch ggfs. physisches WAL-Archiving.
+	if err := os.MkdirAll(pg.ConfD, 0o755); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: conf.d mkdir:", err)
+		return 1
+	}
+	replConf := `# EdgeGuard Logical Replication — automatisch generiert
+# Nicht manuell bearbeiten; wird von edgeguard-ctl cluster-init-replication verwaltet.
+wal_level = logical
+max_wal_senders = 10
+max_replication_slots = 20
+max_logical_replication_workers = 4
+wal_keep_size = 512MB
+# Lausche auf localhost + alle konfigurierten Interfaces damit Cluster-Peers
+# sich verbinden können. '*' ist sicher weil pg_hba.conf den Zugriff auf
+# bekannte Replikations-User beschränkt.
+listen_addresses = '*'
+`
+	confPath := filepath.Join(pg.ConfD, "edgeguard-replication.conf")
+	if err := os.WriteFile(confPath, []byte(replConf), 0o644); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: write postgresql conf:", err)
+		return 1
+	}
+	fmt.Printf("✓ %s geschrieben (wal_level=logical)\n", confPath)
+
+	// 5. pg_hba.conf aktualisieren
+	if err := ensureHBAReplication(pg.HBAPath); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: pg_hba.conf:", err)
+		return 1
+	}
+	fmt.Printf("✓ %s aktualisiert\n", pg.HBAPath)
+
+	// 6. PG reload (damit wal_level + pg_hba aktiv werden)
+	if out, err := exec.Command("pg_ctlcluster", pg.Version, pg.Cluster, "reload").CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-init-replication: pg reload failed: %v\n%s\n", err, out)
+		return 1
+	}
+	fmt.Printf("✓ PostgreSQL %s/%s neu geladen\n", pg.Version, pg.Cluster)
+
+	// 7. SELECT-Grants: edgeguard_replicator muss alle zu replizierenden
+	// Tabellen lesen können. DEFAULT PRIVILEGES sichert zukünftige Tabellen.
+	grantSQL := fmt.Sprintf(`
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO %s;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO %s;
+`, egReplUser, egReplUser)
+	if err := psqlDBExec("edgeguard", grantSQL); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: grant SELECT:", err)
+		return 1
+	}
+	fmt.Printf("✓ SELECT auf alle Tabellen für %q gewährt\n", egReplUser)
+
+	// 8. PUBLICATION erstellen — alle public-Tabellen außer localOnlyTables.
+	// Idempotent: DROP IF EXISTS + CREATE.
+	if err := createPublication(); err != nil {
+		fmt.Fprintln(os.Stderr, "cluster-init-replication: create publication:", err)
+		return 1
+	}
+	fmt.Printf("✓ PUBLICATION %q erstellt\n", egPubName)
+
+	fmt.Println()
+	fmt.Println("Nächste Schritte:")
+	fmt.Println("  1) Auf dem Secondary: edgeguard-ctl cluster-setup-standby <primary-ip>")
+	fmt.Println("  2) Cluster-Settings (VIP) auf BEIDEN Nodes separat konfigurieren")
+	fmt.Println("     → Settings → Cluster → VIP/Keepalived")
+	return 0
+}
+
+// createPublication baut die PUBLICATION dynamisch aus allen Tabellen
+// im public-Schema minus localOnlyTables. Idempotent: löscht eine
+// bestehende Publication gleichen Namens zuerst.
+func createPublication() error {
+	// Alle Tabellen im public-Schema ermitteln
+	listSQL := `SELECT tablename FROM pg_tables WHERE schemaname = 'public' ORDER BY tablename`
+	out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", listSQL})
+	if err != nil {
+		return fmt.Errorf("list tables: %w", err)
+	}
+
+	excluded := make(map[string]bool)
+	for _, t := range localOnlyTables {
+		excluded[t] = true
+	}
+
+	var tables []string
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		t := strings.TrimSpace(line)
+		if t == "" || excluded[t] {
+			continue
+		}
+		tables = append(tables, t)
+	}
+	if len(tables) == 0 {
+		return fmt.Errorf("keine Tabellen für Publication gefunden")
+	}
+
+	dropSQL := fmt.Sprintf("DROP PUBLICATION IF EXISTS %s;", egPubName)
+	if err := psqlDBExec("edgeguard", dropSQL); err != nil {
+		return fmt.Errorf("drop old publication: %w", err)
+	}
+
+	createSQL := fmt.Sprintf("CREATE PUBLICATION %s FOR TABLE %s;",
+		egPubName, strings.Join(tables, ", "))
+	if err := psqlDBExec("edgeguard", createSQL); err != nil {
+		return fmt.Errorf("create publication: %w", err)
+	}
+	return nil
+}
+
+// ensureHBAReplication fügt Einträge für die Replikations-Verbindung
+// in pg_hba.conf ein. Für Logical Replication brauchen wir einen
+// normalen "host edgeguard"-Eintrag (nicht "host replication").
+// Idempotent via Marker-Kommentar.
+func ensureHBAReplication(hbaPath string) error {
+	data, err := os.ReadFile(hbaPath)
+	if err != nil {
+		return fmt.Errorf("read: %w", err)
+	}
+	const marker = "# EdgeGuard replication"
+	if strings.Contains(string(data), marker) {
+		return nil
+	}
+	entry := fmt.Sprintf(`
+%s
+host edgeguard   %s 0.0.0.0/0 scram-sha-256
+host edgeguard   %s ::/0      scram-sha-256
+host replication %s 0.0.0.0/0 scram-sha-256
+host replication %s ::/0      scram-sha-256
+`, marker, egReplUser, egReplUser, egReplUser, egReplUser)
+	f, err := os.OpenFile(hbaPath, os.O_APPEND|os.O_WRONLY, 0o640)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	defer f.Close()
+	_, err = f.WriteString(entry)
+	return err
+}
+
+// cmdClusterSetupStandby richtet diesen Node als Logical-Replication-
+// Subscriber ein. Der Secondary behält seine eigene beschreibbare PG-
+// Instanz — nur die geteilten Tabellen werden vom Primary repliziert.
+// Node-spezifische Tabellen (Interfaces, IPs, Routen, VIP-Settings …)
+// bleiben lokal und werden NICHT überschrieben. Analog zu OPNsense's
+// HA-Sync: Interface-IPs und Hostname bleiben immer per-Node konfiguriert.
+//
+// Voraussetzungen:
+//   - cluster-join erfolgreich (TLS-Certs in /var/lib/edgeguard/cluster-tls/)
+//   - Primary hat cluster-init-replication ausgeführt
+//   - Dieser Node hat edgeguard-api schon gelaufen (Migrations ausgeführt)
+//
+// Ablauf:
+//  1. Replication-Credentials via mTLS vom Primary holen
+//  2. Bestehende Subscription löschen (idempotent)
+//  3. SUBSCRIPTION auf Primary erstellen (copy_data=true → Initialkopiierung)
+//  4. Warten bis Initialkopiierung abgeschlossen
+//  5. render-config ausführen damit Service-Configs den neuen Stand reflektieren
+func cmdClusterSetupStandby(args []string) int {
+	fs := flag.NewFlagSet("cluster-setup-standby", flag.ContinueOnError)
+	agentPort := fs.Int("agent-port", 8443, "mTLS agent port on primary")
+	tlsDir := fs.String("tls-dir", clustertls.DefaultDir, "Verzeichnis mit ca.crt + peer.{crt,key}")
+	fs.SetOutput(os.Stderr)
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	if fs.NArg() < 1 {
+		fmt.Fprintln(os.Stderr, "usage: edgeguard-ctl cluster-setup-standby <primary-ip-or-host>")
+		return 2
+	}
+	primaryHost := fs.Arg(0)
+
+	// 1. Replication-Credentials vom Primary holen
+	creds, err := fetchReplicationCreds(primaryHost, *agentPort, *tlsDir)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: replication-creds: %v\n", err)
+		return 1
+	}
+	fmt.Printf("✓ Replication-Credentials von %s:%d erhalten\n", primaryHost, *agentPort)
+
+	// 2. Bestehende Subscription löschen (idempotent)
+	dropSQL := fmt.Sprintf(`
+DO $$ BEGIN
+  IF EXISTS (SELECT FROM pg_subscription WHERE subname = '%s') THEN
+    ALTER SUBSCRIPTION %s DISABLE;
+    ALTER SUBSCRIPTION %s SET (slot_name = NONE);
+    DROP SUBSCRIPTION %s;
+  END IF;
+END $$;`, egSubName, egSubName, egSubName, egSubName)
+	if err := psqlDBExec("edgeguard", dropSQL); err != nil {
+		// Nicht fatal — wenn PG noch keine Subscription kennt ist das OK
+		fmt.Printf("  → keine bestehende Subscription gefunden (ok)\n")
+	} else {
+		fmt.Println("✓ Bestehende Subscription entfernt")
+	}
+
+	// 3. SUBSCRIPTION erstellen
+	// sslmode=require: Verbindung zwischen Cluster-Nodes soll immer verschlüsselt sein.
+	// copy_data=true: Initialkopiierung aller geteilten Tabellen vom Primary.
+	connStr := fmt.Sprintf(
+		"host=%s port=%d user=%s password=%s dbname=edgeguard sslmode=require",
+		creds.Host, creds.Port, creds.User, creds.Password,
+	)
+	createSQL := fmt.Sprintf(
+		"CREATE SUBSCRIPTION %s CONNECTION '%s' PUBLICATION %s WITH (copy_data = true, enabled = true);",
+		egSubName, connStr, egPubName,
+	)
+	if err := psqlDBExec("edgeguard", createSQL); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: create subscription: %v\n", err)
+		return 1
+	}
+	fmt.Printf("✓ SUBSCRIPTION %q erstellt — Initialkopiierung läuft\n", egSubName)
+
+	// 4. Warten bis Initialkopiierung abgeschlossen
+	fmt.Print("→ Warte auf Initialkopiierung")
+	deadline := time.Now().Add(5 * time.Minute)
+	for time.Now().Before(deadline) {
+		pendingSQL := fmt.Sprintf(`
+SELECT COUNT(*) FROM pg_subscription_rel
+WHERE srsubid = (SELECT oid FROM pg_subscription WHERE subname = '%s')
+  AND srsubstate != 'r';`, egSubName)
+		out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", pendingSQL})
+		if err == nil && strings.TrimSpace(string(out)) == "0" {
+			break
+		}
+		fmt.Print(".")
+		time.Sleep(3 * time.Second)
+	}
+	fmt.Println()
+
+	// Finale Prüfung
+	checkSQL := fmt.Sprintf(`
+SELECT COUNT(*) FROM pg_subscription_rel
+WHERE srsubid = (SELECT oid FROM pg_subscription WHERE subname = '%s')
+  AND srsubstate != 'r';`, egSubName)
+	if out, err := psqlDBRun("edgeguard", []string{"-tA", "-c", checkSQL}); err == nil {
+		if n := strings.TrimSpace(string(out)); n != "0" {
+			fmt.Fprintf(os.Stderr,
+				"cluster-setup-standby: %s Tabellen noch nicht synchronisiert — prüfe PG-Logs\n", n)
+			fmt.Println("  → Subscription läuft trotzdem weiter im Hintergrund")
+		} else {
+			fmt.Println("✓ Alle geteilten Tabellen synchronisiert")
+		}
+	}
+
+	// 5. Master-Key vom Primary holen — für WireGuard-Key-Entschlüsselung
+	fmt.Println("→ Secrets Master-Key vom Primary synchronisieren...")
+	if err := syncMasterKey(primaryHost, *agentPort, *tlsDir); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: master-key: %v (WireGuard-Keys können nicht entschlüsselt werden)\n", err)
+	} else {
+		fmt.Println("✓ Master-Key synchronisiert")
+	}
+
+	// 6. render-config ausführen — muss als edgeguard-User laufen (DB-Zugriff)
+	fmt.Println("→ Service-Configs neu rendern...")
+	if out, err := exec.Command("sudo", "-u", "edgeguard", "edgeguard-ctl", "render-config").CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "cluster-setup-standby: render-config: %v\n%s\n", err, out)
+		fmt.Println("  → Manuell nachholen: sudo -u edgeguard edgeguard-ctl render-config")
+	} else {
+		fmt.Print(string(out))
+		fmt.Println("✓ Service-Configs aktualisiert")
+	}
+
+	fmt.Println()
+	fmt.Println("✓ Logical Replication eingerichtet.")
+	fmt.Println()
+	fmt.Println("Was repliziert wird (automatisch, in Echtzeit):")
+	fmt.Println("  Domains, Backends, Firewall-Rules, WireGuard, DNS-Zones,")
+	fmt.Println("  TLS-Certs, Users, Forward-Proxy, NTP-Pools, ...")
+	fmt.Println()
+	fmt.Println("Was NICHT repliziert wird (bleibt pro Node konfiguriert):")
+	fmt.Println("  Netzwerk-Interfaces, IP-Adressen, Routen,")
+	fmt.Println("  Cluster-Settings (VIP-Interface!), DNS/NTP-Listen-Adressen")
+	fmt.Println()
+	fmt.Println("Nächste Schritte:")
+	fmt.Println("  1) sudo systemctl restart edgeguard-api")
+	fmt.Println("  2) VIP/Keepalived auf BEIDEN Nodes separat konfigurieren:")
+	fmt.Println("     Settings → Cluster → VIP/Keepalived")
+	fmt.Println("  3) Bei Failover: edgeguard-ctl promote (auf dem Secondary)")
+	return 0
+}
+
+// pgReplicationCreds sind die Credentials die der Primary via mTLS zurückgibt.
+type pgReplicationCreds struct {
+	Host     string `json:"host"`
+	Port     int    `json:"port"`
+	User     string `json:"user"`
+	Password string `json:"password"`
+}
+
+// fetchReplicationCreds ruft GET /agent/cluster/pg-replication-info via mTLS ab.
+func fetchReplicationCreds(host string, agentPort int, tlsDir string) (*pgReplicationCreds, error) {
+	caPath := filepath.Join(tlsDir, "ca.crt")
+	certPath := filepath.Join(tlsDir, "peer.crt")
+	keyPath := filepath.Join(tlsDir, "peer.key")
+
+	caCert, err := os.ReadFile(caPath)
+	if err != nil {
+		return nil, fmt.Errorf("read ca.crt: %w", err)
+	}
+	pool := x509.NewCertPool()
+	pool.AppendCertsFromPEM(caCert)
+
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return nil, fmt.Errorf("load peer cert: %w", err)
+	}
+
+	client := &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs:      pool,
+				Certificates: []tls.Certificate{cert},
+			},
+		},
+	}
+
+	url := fmt.Sprintf("https://%s:%d/agent/cluster/pg-replication-info", host, agentPort)
+	resp, err := client.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("GET %s: HTTP %d", url, resp.StatusCode)
+	}
+
+	var result struct {
+		Data pgReplicationCreds `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("decode response: %w", err)
+	}
+	return &result.Data, nil
+}
+
+// syncMasterKey holt den Secrets-Master-Key vom Primary via mTLS und schreibt
+// ihn nach /var/lib/edgeguard/.master_key. Dadurch können replizierte
+// verschlüsselte WireGuard-Keys und PSKs auf dem Secondary entschlüsselt werden.
+func syncMasterKey(host string, agentPort int, tlsDir string) error {
+	caPath := filepath.Join(tlsDir, "ca.crt")
+	certPath := filepath.Join(tlsDir, "peer.crt")
+	keyPath := filepath.Join(tlsDir, "peer.key")
+
+	caCert, err := os.ReadFile(caPath)
+	if err != nil {
+		return fmt.Errorf("read ca.crt: %w", err)
+	}
+	rootPool := x509.NewCertPool()
+	rootPool.AppendCertsFromPEM(caCert)
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return fmt.Errorf("load peer cert: %w", err)
+	}
+	client := &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				RootCAs:      rootPool,
+				Certificates: []tls.Certificate{cert},
+			},
+		},
+	}
+	url := fmt.Sprintf("https://%s:%d/agent/cluster/master-key", host, agentPort)
+	resp, err := client.Get(url)
+	if err != nil {
+		return fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("GET %s: HTTP %d", url, resp.StatusCode)
+	}
+	var result struct {
+		Data struct {
+			KeyHex string `json:"key_hex"`
+		} `json:"data"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	key := make([]byte, 32)
+	if _, err := fmt.Sscanf(result.Data.KeyHex, "%x", &key); err != nil {
+		return fmt.Errorf("decode key_hex: %w", err)
+	}
+	const masterKeyPath = "/var/lib/edgeguard/.master_key"
+	if err := os.WriteFile(masterKeyPath, key, 0o600); err != nil {
+		return fmt.Errorf("write master key: %w", err)
+	}
+	if u, err := user.Lookup("edgeguard"); err == nil {
+		uid, _ := strconv.Atoi(u.Uid)
+		gid, _ := strconv.Atoi(u.Gid)
+		_ = os.Chown(masterKeyPath, uid, gid)
+	}
+	return nil
+}
+
+// generatePassword erzeugt ein kryptographisch sicheres Passwort.
+func generatePassword(n int) (string, error) {
+	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+	buf := make([]byte, n)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	for i, b := range buf {
+		buf[i] = charset[int(b)%len(charset)]
+	}
+	return string(buf), nil
+}
+
+// psqlDBExec führt SQL in der angegebenen Datenbank als postgres-Superuser aus.
+func psqlDBExec(db, sql string) error {
+	_, err := psqlDBRun(db, []string{"-v", "ON_ERROR_STOP=1", "-c", sql})
+	return err
+}
+
+// psqlDBRun führt psql-Kommandos gegen eine bestimmte Datenbank aus.
+func psqlDBRun(db string, args []string) ([]byte, error) {
+	baseArgs := []string{"-d", db}
+	return psqlRun(append(baseArgs, args...))
+}

cmd/edgeguard-ctl/main.go

@@ -1,7 +1,6 @@
 // Command edgeguard-ctl is the admin CLI for setup, migrations and
-// (later) cluster ops. v1 wires migrate + initdb so postinst can
-// initialise a fresh node; cluster-* and promote remain stubs until
-// Phase 3.
+// cluster ops. v1.2 implements PG streaming replication setup,
+// VIP/Keepalived config and manual failover (promote).
 package main
 
 import (
@@ -11,7 +10,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.162"
+var version = "1.2.15"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
@@ -25,23 +24,25 @@ Commands:
   migrate check                Validate embedded migrations (no DB connect)
   migrate dump [dir]           Write embedded SQL files to dir (default: ./migrations)
   initdb                       Create PostgreSQL role + database (idempotent)
-  render-config                Regenerate haproxy / nftables configs from PG (--no-reload, --only=)
+  render-config                Regenerate all configs from PG (--no-reload, --only=svc)
+                               Services: haproxy nftables squid wireguard unbound chrony keepalived
   wg-import [--path <dir>] [iface…]
                                Import /etc/wireguard/*.conf files into the DB.
-                               Without iface arguments: imports all .conf files.
-                               With iface args: imports only the named interfaces.
   reset-password               Generate a one-time token for the /reset-password UI flow
   cluster-join <primary> --token <…>
-                               Provision Cluster-TLS material on this node by
-                               exchanging the join-token at the primary's
-                               /api/v1/cluster/issue-cert endpoint. Writes
-                               ca.crt + peer.{crt,key} into /var/lib/edgeguard/
-                               cluster-tls/. PG-Basebackup + KeyDB replica
-                               setup remain manual until Phase 3.5.
-  cluster-renew-self           Re-issue this node's peer.{crt,key} using the
-                               local cluster CA (founder/single-node only).
-                               1-year validity. Restart edgeguard-api after.
-  promote                      Promote this node's PG to primary (Phase 3, not yet implemented)
+                               Provision Cluster-TLS material; writes ca.crt + peer.{crt,key}
+  cluster-init-replication     Richtet PG Logical Replication auf dem Primary ein.
+                               Erstellt edgeguard_replicator-Rolle, setzt wal_level=logical,
+                               erstellt PUBLICATION edgeguard_shared (alle geteilten Tabellen).
+                               Auf dem Primary ausführen bevor der Secondary joined.
+  cluster-setup-standby <ip>   Richtet diesen Node als Logical-Replication-Subscriber ein.
+                               Erstellt SUBSCRIPTION gegen den Primary (Initialkopiierung
+                               aller geteilten Tabellen). Node-eigene Daten (Interfaces,
+                               IPs, Routen, VIP-Settings) bleiben unangetastet.
+                               Voraussetzung: cluster-join + cluster-init-replication.
+  cluster-renew-self           Re-issue this node's peer.{crt,key} using the local cluster CA.
+  promote                      Promote diesen PG-Standby zum Primary (manueller Failover).
+                               Kein Auto-Promote — Split-Brain-Schutz durch manuelle Entscheidung.
   dump-config                  Print effective config (Phase 3, not yet implemented)
 `
 
@@ -69,7 +70,13 @@ func main() {
 		os.Exit(cmdClusterJoin(os.Args[2:]))
 	case "cluster-renew-self":
 		os.Exit(cmdClusterRenewSelf(os.Args[2:]))
-	case "cluster-leave", "promote", "dump-config":
+	case "cluster-init-replication":
+		os.Exit(cmdClusterInitReplication(os.Args[2:]))
+	case "cluster-setup-standby":
+		os.Exit(cmdClusterSetupStandby(os.Args[2:]))
+	case "promote":
+		os.Exit(cmdPromote(os.Args[2:]))
+	case "cluster-leave", "dump-config":
 		fmt.Fprintf(os.Stderr, "edgeguard-ctl: %q is a Phase-3 stub — not yet implemented\n", os.Args[1])
 		os.Exit(1)
 	default:

cmd/edgeguard-ctl/promote.go

@@ -0,0 +1,160 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/keepalived"
+)
+
+// cmdPromote promotes this node's PostgreSQL instance from Hot-Standby
+// to Primary. Manual failover — keine automatische Promotion, um Split-Brain
+// in 2-Node-Clustern ohne externen Quorum zu verhindern.
+//
+// Ablauf:
+//  1. Prüfen ob standby.signal vorhanden (wir sind wirklich Standby)
+//  2. pg_ctlcluster promote → PG wird Primary
+//  3. Warten bis pg_is_in_recovery() = false
+//  4. ha_nodes.pg_role auf 'primary' setzen
+//  5. KeyDB cluster:pg-primary-url auf lokal setzen
+//  6. keepalived.conf neu rendern (Primary bekommt Priorität 200)
+//  7. keepalived reload
+func cmdPromote(args []string) int {
+	pg, err := detectPGConfig()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "promote: PG-Erkennung:", err)
+		return 1
+	}
+
+	// 1. Standby-Signal prüfen
+	signalPath := filepath.Join(pg.DataDir, "standby.signal")
+	if _, err := os.Stat(signalPath); os.IsNotExist(err) {
+		fmt.Fprintf(os.Stderr,
+			"promote: %s nicht gefunden — diese Node ist kein PG-Standby oder wurde bereits promoted.\n",
+			signalPath)
+		return 1
+	}
+
+	fmt.Printf("→ Promoting PostgreSQL %s/%s zu Primary...\n", pg.Version, pg.Cluster)
+	if out, err := exec.Command("pg_ctlcluster", pg.Version, pg.Cluster, "promote").
+		CombinedOutput(); err != nil {
+		fmt.Fprintf(os.Stderr, "promote: pg_ctlcluster promote: %v\n%s\n", err, out)
+		return 1
+	}
+	fmt.Println("✓ pg_ctlcluster promote gesendet")
+
+	// 2. Warten bis PG wirklich Primary ist (pg_is_in_recovery = false)
+	fmt.Print("→ Warte auf PG Primary-Mode")
+	deadline := time.Now().Add(60 * time.Second)
+	for time.Now().Before(deadline) {
+		out, err := psqlRun([]string{"-tA", "-c", "SELECT pg_is_in_recovery();"})
+		if err == nil && strings.TrimSpace(string(out)) == "f" {
+			break
+		}
+		fmt.Print(".")
+		time.Sleep(2 * time.Second)
+	}
+	fmt.Println()
+	// Nochmal prüfen
+	out, err := psqlRun([]string{"-tA", "-c", "SELECT pg_is_in_recovery();"})
+	if err != nil || strings.TrimSpace(string(out)) != "f" {
+		fmt.Fprintln(os.Stderr, "promote: PG ist nach 60s noch in recovery — prüfe PG-Logs")
+		return 1
+	}
+	fmt.Println("✓ PostgreSQL ist jetzt Primary")
+
+	// 3. ha_nodes.pg_role + role aktualisieren
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	pool, err := database.Open(ctx, database.ConnStringFromEnv())
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "promote: db connect:", err)
+		fmt.Println("  → ha_nodes manuell updaten: UPDATE ha_nodes SET pg_role='primary', role='primary' WHERE id='<local-id>';")
+	} else {
+		defer pool.Close()
+		localID, err := loadLocalID()
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "promote: local node ID:", err)
+		} else {
+			_, err = pool.Exec(ctx, `UPDATE ha_nodes SET pg_role='primary', role='primary', status='online', updated_at=NOW() WHERE id=$1`, localID)
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "promote: update ha_nodes:", err)
+			} else {
+				fmt.Println("✓ ha_nodes.pg_role = 'primary' gesetzt")
+			}
+		}
+	}
+
+	// 4. KeyDB cluster:pg-primary-url updaten
+	if err := updateKeyDBPrimaryURL(); err != nil {
+		fmt.Fprintf(os.Stderr, "promote: KeyDB update: %v\n", err)
+		fmt.Println("  → Manuell: redis-cli SET cluster:pg-primary-url 'postgres://edgeguard@/edgeguard'")
+	} else {
+		fmt.Println("✓ KeyDB cluster:pg-primary-url aktualisiert")
+	}
+
+	// 5. Keepalived.conf neu rendern (Primary = Priorität 200)
+	if pool != nil {
+		localID, _ := loadLocalID()
+		kg := keepalived.New(pool, localID)
+		renderCtx, renderCancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer renderCancel()
+		if err := kg.Render(renderCtx); err != nil {
+			fmt.Fprintf(os.Stderr, "promote: keepalived render: %v\n", err)
+			fmt.Println("  → Manuell: edgeguard-ctl render-config --only=keepalived")
+		} else {
+			fmt.Println("✓ keepalived.conf neu gerendert (Priority 200)")
+		}
+	}
+
+	fmt.Println()
+	fmt.Println("✓ Promotion abgeschlossen. Diese Node ist jetzt der primäre EdgeGuard-Knoten.")
+	fmt.Println()
+	fmt.Println("Empfohlene Nachschritte:")
+	fmt.Println("  1) sudo systemctl restart edgeguard-api  (falls noch nicht laufend)")
+	fmt.Println("  2) Alte Primary-Node nach Recovery als neuen Standby einrichten:")
+	fmt.Println("     edgeguard-ctl cluster-setup-standby <diese-node-ip>")
+	return 0
+}
+
+// loadLocalID liest die Node-ID aus /var/lib/edgeguard/node.conf.
+func loadLocalID() (string, error) {
+	c, err := cluster.LoadLocalConfig("")
+	if err != nil {
+		return "", err
+	}
+	if c.NodeID == "" {
+		return "", fmt.Errorf("NODE_ID in node.conf ist leer")
+	}
+	return c.NodeID, nil
+}
+
+// updateKeyDBPrimaryURL schreibt den lokalen PG-DSN als cluster:pg-primary-url
+// in KeyDB, damit alle Nodes im Cluster Writes an diese Node schicken.
+func updateKeyDBPrimaryURL() error {
+	// edgeguard-api nutzt Unix-Socket-Auth, der DSN ist immer lokal.
+	const localDSN = "postgres://edgeguard@/edgeguard?host=/var/run/postgresql"
+	out, err := exec.Command("redis-cli",
+		"-s", "/var/run/keydb/keydb.sock",
+		"SET", "cluster:pg-primary-url", localDSN,
+	).CombinedOutput()
+	if err != nil {
+		// Fallback: Standard-Port
+		out2, err2 := exec.Command("redis-cli",
+			"-p", "6379",
+			"SET", "cluster:pg-primary-url", localDSN,
+		).CombinedOutput()
+		if err2 != nil {
+			return fmt.Errorf("%v: %s / %v: %s", err, out, err2, out2)
+		}
+	}
+	return nil
+}

cmd/edgeguard-ctl/render.go

@@ -8,10 +8,13 @@ import (
 	"time"
 
 	"git.netcell-it.de/projekte/edgeguard-native/internal/chrony"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/kea"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/firewall"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/haproxy"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/keepalived"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/configorch"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/secrets"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/squid"
@@ -59,12 +62,23 @@ func cmdRenderConfig(args []string) int {
 	wg := wireguard.New(pool, secrets.New(""))
 	ub := unbound.New(pool)
 	cn := chrony.New(pool)
+	ke := kea.New(pool)
 	if skipReload {
 		hap.SkipReload = true
 		fw.SkipReload = true
+		ke.SkipReload = true
 	}
 
-	gens := []configgen.Generator{hap, fw, sq, wg, ub, cn}
+	// keepalived: Node-ID aus node.conf für Prioritäts-Berechnung
+	var ka configgen.Generator
+	if lc, err := cluster.LoadLocalConfig(""); err == nil && lc.NodeID != "" {
+		ka = keepalived.New(pool, lc.NodeID)
+	}
+
+	gens := []configgen.Generator{hap, fw, sq, wg, ub, cn, ke}
+	if ka != nil {
+		gens = append(gens, ka)
+	}
 
 	results, runErr := configorch.Run(ctx, gens, only)
 	fmt.Print(configorch.Summarise(results))

cmd/edgeguard-scheduler/main.go

@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.162"
+var version = "1.2.35"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.

cmd/edgeguard-waf/main.go

@@ -0,0 +1,105 @@
+// Command edgeguard-waf is the per-domain WAF SPOE agent for EdgeGuard.
+// HAProxy connects to it via the SPOE protocol (127.0.0.1:9000).
+// It loads per-domain WAF configs from PostgreSQL and uses Coraza v3
+// with the OWASP Core Rule Set to inspect HTTP requests.
+package main
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
+	intwaf "git.netcell-it.de/projekte/edgeguard-native/internal/waf"
+)
+
+func main() {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	dsn := database.ConnStringFromEnv()
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		slog.Error("waf: db connect", "error", err)
+		os.Exit(1)
+	}
+	defer pool.Close()
+
+	if err := database.Migrate(ctx, ""); err != nil {
+		slog.Error("waf: migrate", "error", err)
+		os.Exit(1)
+	}
+
+	repo := waf.New(pool)
+
+	crsDir := os.Getenv("EDGEGUARD_WAF_CRS_DIR")
+	if crsDir == "" {
+		crsDir = intwaf.DefaultCRSDir
+	}
+	spoeAddr := os.Getenv("EDGEGUARD_WAF_ADDR")
+	if spoeAddr == "" {
+		spoeAddr = intwaf.DefaultSPOEAddr
+	}
+
+	mgr := intwaf.NewManager(crsDir)
+
+	// Initial load.
+	if err := reload(ctx, repo, mgr); err != nil {
+		slog.Error("waf: initial load", "error", err)
+		os.Exit(1)
+	}
+
+	// Periodic config refresh every 30 seconds.
+	go func() {
+		t := time.NewTicker(30 * time.Second)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				if err := reload(ctx, repo, mgr); err != nil {
+					slog.Warn("waf: reload", "error", err)
+				}
+			}
+		}
+	}()
+
+	alertWriter := intwaf.NewAlertWriter(pool, 2048)
+
+	agent := intwaf.SPOEAgent{
+		Manager:     mgr,
+		AlertWriter: alertWriter,
+		Addr:        spoeAddr,
+	}
+
+	slog.Info("waf: SPOE agent starting", "addr", spoeAddr, "crs", crsDir)
+	if err := agent.ListenAndServe(ctx); err != nil && ctx.Err() == nil {
+		slog.Error("waf: SPOE agent stopped", "error", err)
+		os.Exit(1)
+	}
+}
+
+// reload fetches all domain+waf_config pairs from DB and rebuilds engines.
+func reload(ctx context.Context, repo *waf.Repo, mgr *intwaf.Manager) error {
+	configs, err := repo.ListAllWithDomain(ctx)
+	if err != nil {
+		return err
+	}
+	domains := make([]intwaf.DomainConfig, 0, len(configs))
+	for _, c := range configs {
+		domains = append(domains, intwaf.DomainConfig{
+			Hostname: c.Hostname,
+			Config:   c.Config,
+		})
+	}
+	return mgr.Reload(domains)
+}
+
+// Ensure models package is used (imported transitively via services/waf).
+var _ = models.WafConfig{}

deploy/keepalived/keepalived.conf.tpl

@@ -0,0 +1,40 @@
+global_defs {
+    router_id {{ .RouterID }}
+    script_user root
+    enable_script_security
+    vrrp_garp_interval 0
+    vrrp_gna_interval 0
+}
+
+vrrp_script chk_edgeguard {
+    script "/usr/lib/edgeguard/keepalived-check.sh"
+    interval 2
+    weight -50
+    fall 3
+    rise 2
+}
+
+vrrp_instance VI_1 {
+    state {{ .State }}
+    interface {{ .Interface }}
+    virtual_router_id {{ .RouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .SrcIP }}    unicast_src_ip {{ .SrcIP }}
+    unicast_peer {
+        {{ .PeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+    virtual_ipaddress {
+        {{ .VIP }}
+    }
+    track_script {
+        chk_edgeguard
+    }
+    notify_master  "/usr/lib/edgeguard/keepalived-master.sh"
+    notify_backup  "/usr/lib/edgeguard/keepalived-backup.sh"
+    notify_fault   "/usr/lib/edgeguard/keepalived-backup.sh"
+}

deploy/systemd/edgeguard-api.service

@@ -41,7 +41,7 @@ SystemCallFilter=@system-service
 # direkt in den distro-Conf-Dir (chrony+unbound) bzw. legen Symlinks
 # nach /etc/edgeguard/wireguard (wg). Ohne diese Pfade scheitern alle
 # UI-Mutationen an DNS/NTP/WireGuard-Settings still mit EROFS.
-ReadWritePaths=/etc/edgeguard /var/lib/edgeguard /var/log/edgeguard /var/backups/edgeguard /var/lib/apt /var/cache/apt /etc/apt/apt.conf.d /etc/chrony/conf.d /etc/unbound/unbound.conf.d /etc/wireguard
+ReadWritePaths=/etc/edgeguard /var/lib/edgeguard /var/log/edgeguard /var/backups/edgeguard /var/lib/apt /var/cache/apt /etc/apt/apt.conf.d /etc/chrony/conf.d /etc/unbound/unbound.conf.d /etc/wireguard /var/lib/crowdsec
 
 [Install]
 WantedBy=multi-user.target

deploy/systemd/edgeguard-waf.service

@@ -0,0 +1,32 @@
+[Unit]
+Description=EdgeGuard WAF SPOE Agent (Coraza/OWASP CRS)
+Documentation=https://git.netcell-it.de/projekte/edgeguard-native
+After=network-online.target postgresql.service edgeguard-api.service
+Wants=network-online.target
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=edgeguard
+Group=edgeguard
+ExecStart=/usr/bin/edgeguard-waf
+Restart=on-failure
+RestartSec=5
+
+# Hardening — WAF agent only needs DB access and one TCP listen socket.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+PrivateTmp=true
+PrivateDevices=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallFilter=@system-service
+# CRS rules are read from /usr/share/edgeguard/waf/crs/ (read-only, OK).
+# Alerts/logs are written to /var/log/edgeguard/.
+ReadWritePaths=/var/log/edgeguard
+
+[Install]
+WantedBy=multi-user.target

go.mod

@@ -3,23 +3,32 @@ module git.netcell-it.de/projekte/edgeguard-native
 go 1.26.0
 
 require (
+	github.com/corazawaf/coraza/v3 v3.7.0
+	github.com/coreos/go-oidc/v3 v3.18.0
+	github.com/dropmorepackets/haproxy-go v0.0.8
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/gin-gonic/gin v1.10.0
 	github.com/go-acme/lego/v4 v4.35.2
 	github.com/gorilla/websocket v1.5.3
 	github.com/jackc/pgx/v5 v5.9.2
+	github.com/minio/minio-go/v7 v7.1.0
+	github.com/pkg/sftp v1.13.10
+	github.com/pquerna/otp v1.5.0
 	github.com/pressly/goose/v3 v3.27.1
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	golang.org/x/crypto v0.51.0
+	golang.org/x/oauth2 v0.36.0
 )
 
 require (
+	github.com/boombuler/barcode v1.0.1 // indirect
 	github.com/bytedance/sonic v1.11.6 // indirect
 	github.com/bytedance/sonic/loader v0.1.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.4 // indirect
 	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/corazawaf/libinjection-go v0.3.2 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
@@ -28,34 +37,43 @@ require (
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.23.0 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 // indirect
+	github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 // indirect
+	github.com/kaptinlin/go-i18n v0.1.4 // indirect
+	github.com/kaptinlin/jsonschema v0.4.6 // indirect
 	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/magefile/mage v1.17.0 // indirect
 	github.com/mattn/go-isatty v0.0.21 // indirect
 	github.com/mfridman/interpolate v0.0.2 // indirect
 	github.com/miekg/dns v1.1.72 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minio-go/v7 v7.1.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pkg/sftp v1.13.10 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sethvargo/go-retry v0.3.0 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tinylib/msgp v1.6.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
+	github.com/valllabh/ocsf-schema-golang v1.0.3 // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
@@ -68,4 +86,5 @@ require (
 	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	rsc.io/binaryregexp v0.2.0 // indirect
 )

go.sum

@@ -1,3 +1,6 @@
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
+github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0=
 github.com/bytedance/sonic v1.11.6/go.mod h1:LysEHSvpvDySVdC2f87zGWf6CIKJcAvqab1ZaiQtds4=
 github.com/bytedance/sonic/loader v0.1.1 h1:c+e5Pt1k/cy5wMveRDyk2X4B9hF4g7an8N3zCYjJFNM=
@@ -10,13 +13,25 @@ github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/
 github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
 github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
 github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc h1:OlJhrgI3I+FLUCTI3JJW8MoqyM78WbqJjecqMnqG+wc=
+github.com/corazawaf/coraza-coreruleset v0.0.0-20240226094324-415b1017abdc/go.mod h1:7rsocqNDkTCira5T0M7buoKR2ehh7YZiPkzxRuAgvVU=
+github.com/corazawaf/coraza/v3 v3.7.0 h1:LIQqu1r+l6e/U/gyiZeykWaNNBY1TzRLz+aaI+QYEEM=
+github.com/corazawaf/coraza/v3 v3.7.0/go.mod h1:dOSt5evqC7EstouEv6ghhui01+oVUwp9X1vybWwqTlo=
+github.com/corazawaf/libinjection-go v0.3.2 h1:9rrKt0lpg4WvUXt+lwS06GywfqRXXsa/7JcOw5cQLwI=
+github.com/corazawaf/libinjection-go v0.3.2/go.mod h1:Ik/+w3UmTWH9yn366RgS9D95K3y7Atb5m/H/gXzzPCk=
+github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=
+github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dropmorepackets/haproxy-go v0.0.8 h1:kS2Wa8+ZDcnJdRSTiuBsaPun5hpdUPIuLQ+Drp9ZxYs=
+github.com/dropmorepackets/haproxy-go v0.0.8/go.mod h1:4a2AmmVjvg2zPNdizGZrMN8ZSUpj90U43VlcdbOIBnU=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/foxcpp/go-mockdns v1.1.0 h1:jI0rD8M0wuYAxL7r/ynTrCQQq0BVqfB99Vgk7DlmewI=
+github.com/foxcpp/go-mockdns v1.1.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
@@ -39,8 +54,10 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.23.0 h1:/PwmTwZhS0dPkav3cdK9kV1FsAmrL8sThn8IHr/sO+o=
 github.com/go-playground/validator/v10 v10.23.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
-github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
-github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -48,6 +65,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 h1:b70jEaX2iaJSPZULSUxKtm73LBfsCrMsIlYCUgNGSIs=
+github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976/go.mod h1:ZGQeOwybjD8lkCjIyJfqR5LD2wMVHJ31d6GdPxoTsWY=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 h1:c7gcNWTSr1gtLp6PyYi3wzvFCEcHJ4YRobDgqmIgf7Q=
+github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092/go.mod h1:ZZAN4fkkful3l1lpJwF8JbW41ZiG9TwJ2ZlqzQovBNU=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
@@ -56,14 +77,18 @@ github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
 github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jcchavezs/mergefs v0.1.1 h1:D45R17m6dHnSVZefnhynoeZvcK2Uw0oTrRfoUOQ0S5Y=
+github.com/jcchavezs/mergefs v0.1.1/go.mod h1:eRLTrsA+vFwQZ48hj8p8gki/5v9C2bFtHH5Mnn4bcGk=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU=
 github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0=
+github.com/kaptinlin/go-i18n v0.1.4 h1:wCiwAn1LOcvymvWIVAM4m5dUAMiHunTdEubLDk4hTGs=
+github.com/kaptinlin/go-i18n v0.1.4/go.mod h1:g1fn1GvTgT4CiLE8/fFE1hboHWJ6erivrDpiDtCcFKg=
+github.com/kaptinlin/jsonschema v0.4.6 h1:vOSFg5tjmfkOdKg+D6Oo4fVOM/pActWu/ntkPsI1T64=
+github.com/kaptinlin/jsonschema v0.4.6/go.mod h1:1DUd7r5SdyB2ZnMtyB7uLv64dE3zTFTiYytDCd+AEL0=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
-github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
 github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
@@ -77,6 +102,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/magefile/mage v1.17.0 h1:dS4tkq997Ism03akafC8509iqDjeE7TNTexI25Y7sXM=
+github.com/magefile/mage v1.17.0/go.mod h1:Yj51kqllmsgFpvvSzgrZPK9WtluG3kUhFaBUVLo4feA=
 github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
 github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mfridman/interpolate v0.0.2 h1:pnuTK7MQIxxFz1Gr+rjSIx9u7qVjf5VOoM/u6BbAxPY=
@@ -97,8 +124,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
-github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 h1:Vpr4VgAizEgEZsaMohpw6JYDP+i9Of9dmdY4ufNP6HI=
+github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745/go.mod h1:EHPiTAKtiFmrMldLUNswFwfZ2eJIYBHktdaUTZxYWRw=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -107,6 +136,8 @@ github.com/pkg/sftp v1.13.10/go.mod h1:bJ1a7uDhrX/4OII+agvy28lzRvQrmIQuaHrcI1Hbe
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pquerna/otp v1.5.0 h1:NMMR+WrmaqXU4EzdGJEE1aUUI0AMRzsp96fFFWNPwxs=
+github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/pressly/goose/v3 v3.27.1 h1:6uEvcprBybDmW4hcz3gYujhARhye+GoWKhEWyzD5sh4=
 github.com/pressly/goose/v3 v3.27.1/go.mod h1:maruOxsPnIG2yHHyo8UqKWXYKFcH7Q76csUV7+7KYoM=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -122,22 +153,30 @@ github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDq
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
 github.com/tinylib/msgp v1.6.1/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
 github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/valllabh/ocsf-schema-golang v1.0.3 h1:eR8k/3jP/OOqB8LRCtdJ4U+vlgd/gk5y3KMXoodrsrw=
+github.com/valllabh/ocsf-schema-golang v1.0.3/go.mod h1:sZ3as9xqm1SSK5feFWIR2CuGeGRhsM7TR1MbpBctzPk=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -153,11 +192,14 @@ golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
 golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
 golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
@@ -179,4 +221,6 @@ modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw
 modernc.org/sqlite v1.49.1 h1:dYGHTKcX1sJ+EQDnUzvz4TJ5GbuvhNJa8Fg6ElGx73U=
 modernc.org/sqlite v1.49.1/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
 nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
+rsc.io/binaryregexp v0.2.0 h1:HfqmD5MEmC0zvwBuF187nq9mdnXjXsSivRiXN7SmRkE=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=

internal/aggregator/aggregator.go

@@ -192,6 +192,80 @@ func agentURL(apiURL string, agentPort int, path string) (string, error) {
 	return u.String(), nil
 }
 
+// PostPeer sendet einen POST-Request an einen einzelnen Peer.
+// Wird vom Rolling-Update-Orchestrator genutzt um /agent/cluster/trigger-update
+// auf dem Secondary auszulösen.
+func (a *Aggregator) PostPeer(ctx context.Context, p models.HANode, path string) PeerResult {
+	start := time.Now()
+	res := PeerResult{NodeID: p.ID, FQDN: p.FQDN}
+	target, err := agentURL(p.APIURL, a.AgentPort, path)
+	if err != nil {
+		res.Err = "bad api_url: " + err.Error()
+		return res
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodPost, target, nil)
+	if err != nil {
+		res.Err = err.Error()
+		return res
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := a.HTTPClient.Do(req)
+	if err != nil {
+		res.Err = err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusAccepted {
+		res.Err = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	res.OK = true
+	res.Duration = time.Since(start).Milliseconds()
+	return res
+}
+
+// PostPeerWithBody sendet einen POST-Request mit JSON-Body an einen Peer.
+// Wird für VIP-Schwenk-Tests genutzt (/agent/cluster/vip-cmd).
+func (a *Aggregator) PostPeerWithBody(ctx context.Context, p models.HANode, path string, body []byte) PeerResult {
+	start := time.Now()
+	res := PeerResult{NodeID: p.ID, FQDN: p.FQDN}
+	target, err := agentURL(p.APIURL, a.AgentPort, path)
+	if err != nil {
+		res.Err = "bad api_url: " + err.Error()
+		return res
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodPost, target, strings.NewReader(string(body)))
+	if err != nil {
+		res.Err = err.Error()
+		return res
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := a.HTTPClient.Do(req)
+	if err != nil {
+		res.Err = err.Error()
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusAccepted && resp.StatusCode != http.StatusNoContent {
+		res.Err = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(respBody)))
+		res.Duration = time.Since(start).Milliseconds()
+		return res
+	}
+	res.OK = true
+	res.Data = respBody
+	res.Duration = time.Since(start).Milliseconds()
+	return res
+}
+
 // Compile-time check dass cluster importiert wird (für Drift-Detection
 // vom hashSpec — die Aggregator-Resultate werden parallel im Drift-
 // Banner mitverarbeitet). Nicht runtime-essentiell, aber dokumentiert

internal/cluster/confighash.go

@@ -35,10 +35,13 @@ import (
 
 // hashTable beschreibt eine Tabelle die in den config-hash einfließt.
 type hashTable struct {
-	Name          string
-	Singleton     bool     // dns_settings, ntp_settings → eine row, id=1
-	ExtraExclude  []string // Spalten die zusätzlich aus to_jsonb gefiltert werden
-	SkipUpdatedAt bool     // setze true wenn updated_at semantisch relevant ist
+	Name             string
+	Singleton        bool     // dns_settings, ntp_settings → eine row, id=1
+	ExtraExclude     []string // Spalten die zusätzlich aus to_jsonb gefiltert werden
+	SkipUpdatedAt    bool     // setze true wenn updated_at semantisch relevant ist
+	MigrationDefault bool     // Tabelle hat migrations-erzeugte Default-Rows (firewall_zones, ntp_pools…)
+	                          // → zählt nicht als "user hat config" bei der Empty-DB-Erkennung
+	CustomSQL        string   // wenn gesetzt: direkt als Hash-Query verwenden (überschreibt hashSQL)
 }
 
 // hashSpec ist die Reihenfolge-stabile Liste. NEUE Tabellen hier
@@ -49,15 +52,13 @@ var hashSpec = []hashTable{
 	{Name: "backends"},
 	{Name: "backend_servers"},
 	{Name: "routing_rules"},
-	{Name: "network_interfaces"},
-	{Name: "ip_addresses"},
 	{Name: "tls_certs", ExtraExclude: []string{"last_renewed_at", "last_error"}},
 
-	{Name: "firewall_zones"},
+	{Name: "firewall_zones", MigrationDefault: true},
 	{Name: "firewall_address_objects"},
 	{Name: "firewall_address_groups"},
-	{Name: "firewall_services"},
-	{Name: "firewall_service_groups"},
+	{Name: "firewall_services", MigrationDefault: true},
+	{Name: "firewall_service_groups", MigrationDefault: true},
 	{Name: "firewall_rules"},
 	{Name: "firewall_nat_rules"},
 
@@ -67,12 +68,24 @@ var hashSpec = []hashTable{
 
 	{Name: "dns_zones"},
 	{Name: "dns_records"},
-	{Name: "dns_settings", Singleton: true},
 
-	{Name: "ntp_pools"},
-	{Name: "ntp_settings", Singleton: true},
+	{Name: "ntp_pools", MigrationDefault: true},
 
-	{Name: "static_routes"},
+	// DHCP: Subnets + Reservierungen sind geteilte Config (repliziert).
+	// dhcp_settings ist node-lokal (ob DIESE Node DHCP betreibt) → NICHT hier.
+	{Name: "dhcp_subnets"},
+	{Name: "dhcp_reservations"},
+
+	// network_interfaces + ip_addresses sind BEWUSST NICHT im Drift-Hash.
+	// Sie stehen in cluster_replication.go localOnlyTables, werden also NICHT
+	// repliziert und sind per Design node-spezifisch (jede Node hat eigene
+	// Mgmt-/Host-IPs, z.B. utm-1=.6, utm-2=.8). Würde man sie hashen, wäre
+	// der config_hash zwischen zwei Nodes ZWANGSLÄUFIG dauerhaft verschieden
+	// → Drift-Banner, das kein Resync je beheben kann (Resync kopiert nur
+	// replizierte Tabellen). Migration 0030 wollte sie zwar replizieren,
+	// localOnlyTables schließt sie aber weiter aus → wir hashen sie nicht.
+	//
+	// static_routes, dns_settings, ntp_settings bleiben ebenfalls node-spezifisch.
 }
 
 // hashSQL rendert die SHA-Input-SQL für eine Tabelle.
@@ -100,22 +113,39 @@ func hashSQL(t hashTable) string {
 // ComputeConfigHash gibt den 16-hex-char-Hash über alle Spec-Tabellen
 // zurück. Fehlende Tabellen (transienter schema-flux) werden als
 // leerer Per-Table-Hash behandelt — kein Abbruch.
+//
+// Gibt "" zurück wenn alle user-konfigurierbaren Tabellen leer sind
+// (Singleton- und MigrationDefault-Tabellen zählen nicht als User-Config).
+// Das verhindert False-Positive-Drift-Banner auf frisch gejointen Secondaries.
 func ComputeConfigHash(ctx context.Context, pool *pgxpool.Pool) (string, error) {
 	if pool == nil {
 		return "", fmt.Errorf("nil pool")
 	}
 	h := sha256.New()
+	hasUserConfig := false
 	for _, t := range hashSpec {
 		var s string
-		if err := pool.QueryRow(ctx, hashSQL(t)).Scan(&s); err != nil {
+		sql := t.CustomSQL
+		if sql == "" {
+			sql = hashSQL(t)
+		}
+		if err := pool.QueryRow(ctx, sql).Scan(&s); err != nil {
 			// Migration fehlt o.ä. → leeren string nehmen, weiter.
 			s = ""
 		}
+		if s != "" && !t.Singleton && !t.MigrationDefault {
+			hasUserConfig = true
+		}
 		h.Write([]byte(t.Name))
 		h.Write([]byte{0})
 		h.Write([]byte(s))
 		h.Write([]byte{0})
 	}
+	if !hasUserConfig {
+		// Frisch gejoincter Secondary oder komplett leere DB →
+		// leerer String signalisiert "kein Drift prüfen" im Status-Handler.
+		return "", nil
+	}
 	return hex.EncodeToString(h.Sum(nil))[:16], nil
 }
 

internal/configgen/configgen.go

@@ -99,6 +99,33 @@ func RestartService(name string) error {
 	return nil
 }
 
+// StopService runs `sudo -n systemctl stop <name>.service`.
+func StopService(name string) error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "stop", name+".service")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("sudo systemctl stop %s.service: %w (output: %s)", name, err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// EnableService runs `sudo -n systemctl enable <name>.service` (boot-persistent).
+func EnableService(name string) error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "enable", name+".service")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("sudo systemctl enable %s.service: %w (output: %s)", name, err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// DisableService runs `sudo -n systemctl disable <name>.service`.
+func DisableService(name string) error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "disable", name+".service")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("sudo systemctl disable %s.service: %w (output: %s)", name, err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
 // EtcEdgeguard is the on-target config root. Templated path used by
 // all renderers — never let renderers hard-code their own.
 const EtcEdgeguard = "/etc/edgeguard"

internal/crowdsec/service.go

@@ -0,0 +1,432 @@
+// Package crowdsec wraps sudo /usr/bin/cscli calls for the edgeguard
+// management API. All list operations use -o json. Mutation operations
+// (add/delete) use the appropriate cscli sub-commands.
+//
+// edgeguard runs as a non-root system user; every cscli call goes
+// through sudo (allowed entries are in /etc/sudoers.d/edgeguard).
+package crowdsec
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+// ErrNotInstalled is returned when /usr/bin/cscli is not found.
+var ErrNotInstalled = errors.New("crowdsec not installed")
+
+// IsInstalled checks whether /usr/bin/cscli exists on this host.
+func IsInstalled() bool {
+	_, err := os.Stat("/usr/bin/cscli")
+	return err == nil
+}
+
+// ---------- Types -----------------------------------------------------------
+
+// Decision represents a single IP decision (ban/captcha/etc.) in CrowdSec.
+type Decision struct {
+	ID       int64  `json:"id"`
+	Origin   string `json:"origin"`
+	Type     string `json:"type"`
+	Scope    string `json:"scope"`
+	Value    string `json:"value"`
+	Duration string `json:"duration"`
+	Reason   string `json:"reason"`
+	Country  string `json:"country,omitempty"`
+	AS       string `json:"as,omitempty"`
+}
+
+// Alert represents a CrowdSec alert with associated decisions.
+type Alert struct {
+	ID          int64       `json:"id"`
+	Scenario    string      `json:"scenario"`
+	EventsCount int         `json:"events_count"`
+	Source      AlertSource `json:"source"`
+	StartAt     string      `json:"start_at"`
+	StopAt      string      `json:"stop_at"`
+	Decisions   []Decision  `json:"decisions,omitempty"`
+}
+
+// AlertSource holds the source IP/range info for an alert.
+type AlertSource struct {
+	IP      string `json:"ip"`
+	Country string `json:"cn,omitempty"`
+	ASName  string `json:"as_name,omitempty"`
+	Range   string `json:"range,omitempty"`
+	Scope   string `json:"scope,omitempty"`
+	Value   string `json:"value,omitempty"`
+}
+
+// Bouncer represents a registered CrowdSec bouncer.
+type Bouncer struct {
+	Name      string `json:"name"`
+	IPAddress string `json:"ip_address,omitempty"`
+	Revoked   bool   `json:"revoked"`
+	LastPull  string `json:"last_pull,omitempty"`
+	Type      string `json:"type,omitempty"`
+	Version   string `json:"version,omitempty"`
+	CreatedAt string `json:"created_at"`
+	AuthType  string `json:"auth_type,omitempty"`
+}
+
+// Machine represents a registered CrowdSec agent/machine.
+type Machine struct {
+	MachineID   string `json:"machineId"`
+	CreatedAt   string `json:"created_at"`
+	UpdatedAt   string `json:"updated_at"`
+	LastPush    string `json:"last_push,omitempty"`
+	IsValidated bool   `json:"isValidated"`
+	Version     string `json:"version,omitempty"`
+	Status      string `json:"status,omitempty"`
+}
+
+// HubItem represents a CrowdSec hub item (collection, parser, scenario, etc.).
+type HubItem struct {
+	Name         string `json:"name"`
+	Description  string `json:"description,omitempty"`
+	Status       string `json:"status"`
+	LocalVersion string `json:"local_version,omitempty"`
+	LocalPath    string `json:"local_path,omitempty"`
+	Author       string `json:"author,omitempty"`
+	Type         string `json:"type,omitempty"`
+}
+
+// Status summarises the runtime state of the CrowdSec stack on this node.
+type Status struct {
+	Installed      bool   `json:"installed"`
+	AgentRunning   bool   `json:"agent_running"`
+	BouncerRunning bool   `json:"bouncer_running"`
+	Version        string `json:"version,omitempty"`
+	DecisionCount  int    `json:"decision_count"`
+	AlertCount     int    `json:"alert_count"`
+	BouncerCount   int    `json:"bouncer_count"`
+	MachineCount   int    `json:"machine_count"`
+}
+
+// ---------- Helpers ---------------------------------------------------------
+
+// sudoCscli executes `sudo -n /usr/bin/cscli <args...>` and returns stdout.
+func sudoCscli(ctx context.Context, args ...string) ([]byte, error) {
+	full := append([]string{"-n", "/usr/bin/cscli"}, args...)
+	cmd := exec.CommandContext(ctx, "sudo", full...)
+	var out, errBuf bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &errBuf
+	if err := cmd.Run(); err != nil {
+		slog.Error("crowdsec: sudoCscli failed", "args", args, "error", err, "stderr", errBuf.String())
+		return nil, err
+	}
+	if errBuf.Len() > 0 {
+		slog.Warn("crowdsec: sudoCscli stderr", "args", args, "stderr", errBuf.String())
+	}
+	slog.Debug("crowdsec: sudoCscli ok", "args", args[0], "bytes", out.Len())
+	return out.Bytes(), nil
+}
+
+// systemctlActive returns true when the named unit is "active".
+func systemctlActive(ctx context.Context, unit string) bool {
+	cmd := exec.CommandContext(ctx, "systemctl", "is-active", "--quiet", unit)
+	return cmd.Run() == nil
+}
+
+// unmarshalSlice unmarshals JSON that may be "null" (cscli returns null
+// instead of [] when no items exist). Returns an empty slice in that case.
+func unmarshalSlice[T any](data []byte) ([]T, error) {
+	data = bytes.TrimSpace(data)
+	if bytes.Equal(data, []byte("null")) || len(data) == 0 {
+		return []T{}, nil
+	}
+	var result []T
+	if err := json.Unmarshal(data, &result); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+// ---------- ServiceStatus ---------------------------------------------------
+
+// ServiceStatus returns a Status struct describing the current state of the
+// CrowdSec agent and bouncer on this node. Does NOT need cscli installed —
+// it uses systemctl for the running-state checks. Version is extracted via
+// `cscli version` when available.
+func ServiceStatus(ctx context.Context) Status {
+	st := Status{
+		Installed:      IsInstalled(),
+		AgentRunning:   systemctlActive(ctx, "crowdsec"),
+		BouncerRunning: systemctlActive(ctx, "crowdsec-firewall-bouncer"),
+	}
+
+	if st.Installed {
+		// Grab version from `sudo -n /usr/bin/cscli version` — first line only.
+		// Output is not JSON; it looks like "version: v1.6.3-..."
+		if out, err := sudoCscli(ctx, "version"); err == nil {
+			scanner := bufio.NewScanner(bytes.NewReader(out))
+			if scanner.Scan() {
+				st.Version = strings.TrimSpace(scanner.Text())
+			}
+		}
+	}
+
+	// Only query cscli data endpoints when the agent is running — cscli
+	// hangs on its local socket when the agent is stopped, which would
+	// block the entire status response and leave the UI with no data.
+	if st.AgentRunning {
+		if decisions, err := Decisions(ctx); err == nil {
+			st.DecisionCount = len(decisions)
+		}
+		if alerts, err := Alerts(ctx, 500); err == nil {
+			st.AlertCount = len(alerts)
+		}
+		if bouncers, err := Bouncers(ctx); err == nil {
+			st.BouncerCount = len(bouncers)
+		}
+		if machines, err := Machines(ctx); err == nil {
+			st.MachineCount = len(machines)
+		}
+	}
+
+	return st
+}
+
+// ---------- Decisions -------------------------------------------------------
+
+// cscli decisions list -o json returns alert-level objects with nested
+// decisions[] arrays. These intermediate types are used only for parsing.
+type cscliDecisionRaw struct {
+	ID       int64  `json:"id"`
+	Duration string `json:"duration"`
+	Origin   string `json:"origin"`
+	Scope    string `json:"scope"`
+	Type     string `json:"type"`
+	Value    string `json:"value"`
+}
+
+type cscliAlertRaw struct {
+	Scenario  string             `json:"scenario"`
+	Decisions []cscliDecisionRaw `json:"decisions"`
+	Source    struct {
+		IP     string `json:"ip"`
+		CN     string `json:"cn"`
+		ASName string `json:"as_name"`
+	} `json:"source"`
+}
+
+// Decisions lists all active decisions by flattening the alert-level JSON
+// that cscli emits (each alert contains a nested decisions[] array).
+func Decisions(ctx context.Context) ([]Decision, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "decisions", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	alerts, err := unmarshalSlice[cscliAlertRaw](out)
+	if err != nil {
+		return nil, err
+	}
+	var result []Decision
+	for _, a := range alerts {
+		for _, d := range a.Decisions {
+			result = append(result, Decision{
+				ID:       d.ID,
+				Origin:   d.Origin,
+				Type:     d.Type,
+				Scope:    d.Scope,
+				Value:    d.Value,
+				Duration: d.Duration,
+				Reason:   a.Scenario,
+				Country:  a.Source.CN,
+				AS:       a.Source.ASName,
+			})
+		}
+	}
+	if result == nil {
+		result = []Decision{}
+	}
+	return result, nil
+}
+
+// AddDecision creates a new ban/captcha decision for the given IP.
+func AddDecision(ctx context.Context, ip, duration, reason, typ string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "decisions", "add",
+		"--ip", ip,
+		"--duration", duration,
+		"--reason", reason,
+		"--type", typ,
+	)
+	return err
+}
+
+// DeleteDecisionByIP removes all decisions for a given IP address.
+func DeleteDecisionByIP(ctx context.Context, ip string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "decisions", "delete", "--ip", ip)
+	return err
+}
+
+// DeleteDecisionByID removes a single decision by its numeric ID.
+func DeleteDecisionByID(ctx context.Context, id string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "decisions", "delete", "--id", id)
+	return err
+}
+
+// ---------- Alerts ----------------------------------------------------------
+
+// Alerts lists recent alerts (up to limit).
+func Alerts(ctx context.Context, limit int) ([]Alert, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "alerts", "list", "-o", "json",
+		"-l", fmt.Sprintf("%d", limit))
+	if err != nil {
+		return nil, err
+	}
+	return unmarshalSlice[Alert](out)
+}
+
+// DeleteAlert discards (deletes) a single alert by its ID.
+func DeleteAlert(ctx context.Context, id string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "alerts", "delete", "--id", id)
+	return err
+}
+
+// ---------- Bouncers --------------------------------------------------------
+
+// Bouncers lists all registered bouncers.
+func Bouncers(ctx context.Context) ([]Bouncer, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "bouncers", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	return unmarshalSlice[Bouncer](out)
+}
+
+// DeleteBouncer removes a bouncer by name.
+func DeleteBouncer(ctx context.Context, name string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "bouncers", "delete", name)
+	return err
+}
+
+// ---------- Machines --------------------------------------------------------
+
+// cscliMachineRaw mirrors the actual cscli JSON with its mixed camelCase /
+// snake_case field names. Only used inside Machines().
+type cscliMachineRaw struct {
+	MachineID   string `json:"machineId"`
+	CreatedAt   string `json:"created_at"`
+	UpdatedAt   string `json:"updated_at"`
+	LastPush    string `json:"last_push"`
+	IsValidated bool   `json:"isValidated"`
+	Version     string `json:"version"`
+	Status      string `json:"status"`
+}
+
+// Machines lists all registered machines/agents.
+func Machines(ctx context.Context) ([]Machine, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "machines", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	raw, err := unmarshalSlice[cscliMachineRaw](out)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]Machine, len(raw))
+	for i, r := range raw {
+		result[i] = Machine{
+			MachineID:   r.MachineID,
+			CreatedAt:   r.CreatedAt,
+			UpdatedAt:   r.UpdatedAt,
+			LastPush:    r.LastPush,
+			IsValidated: r.IsValidated,
+			Version:     r.Version,
+			Status:      r.Status,
+		}
+	}
+	return result, nil
+}
+
+// DeleteMachine removes a machine by its machine ID.
+func DeleteMachine(ctx context.Context, id string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "machines", "delete", "--machine-id", id)
+	return err
+}
+
+// ---------- Collections -----------------------------------------------------
+
+// Collections lists installed/available hub collections.
+// cscli returns {"collections": [...]} (not a flat array) — we unwrap the key.
+func Collections(ctx context.Context) ([]HubItem, error) {
+	if !IsInstalled() {
+		return nil, ErrNotInstalled
+	}
+	out, err := sudoCscli(ctx, "collections", "list", "-o", "json")
+	if err != nil {
+		return nil, err
+	}
+	out = bytes.TrimSpace(out)
+	if bytes.Equal(out, []byte("null")) || len(out) == 0 {
+		return []HubItem{}, nil
+	}
+	// cscli wraps collections in {"collections": [...]}
+	var wrapper struct {
+		Collections []HubItem `json:"collections"`
+	}
+	if err := json.Unmarshal(out, &wrapper); err != nil {
+		return nil, err
+	}
+	if wrapper.Collections == nil {
+		return []HubItem{}, nil
+	}
+	return wrapper.Collections, nil
+}
+
+// InstallCollection installs a hub collection by name (--force to upgrade).
+func InstallCollection(ctx context.Context, name string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "collections", "install", name, "--force")
+	return err
+}
+
+// RemoveCollection removes a hub collection by name.
+func RemoveCollection(ctx context.Context, name string) error {
+	if !IsInstalled() {
+		return ErrNotInstalled
+	}
+	_, err := sudoCscli(ctx, "collections", "remove", name)
+	return err
+}

internal/database/migrations/0029_cluster_vip.sql

@@ -0,0 +1,36 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- pg_role: Rolle dieser Node in der PG-Replikation.
+-- "standalone" = kein Streaming-Replication-Setup
+-- "primary"    = WAL-Sender, repliziert an Standby(s)
+-- "standby"    = Hot-Standby, liest WAL vom Primary
+ALTER TABLE ha_nodes ADD COLUMN IF NOT EXISTS pg_role TEXT NOT NULL DEFAULT 'standalone';
+
+-- cluster_settings: VIP + VRRP-Konfiguration (Singleton, id=1).
+-- vip_address   = die virtuelle IP-Adresse (z.B. "89.163.205.10")
+-- vip_interface = Netzwerk-Interface (z.B. "eth0")
+-- vip_auth_pass = VRRP-Authentication-Passwort (max. 8 Zeichen, Keepalived-Limit)
+-- vrrp_router_id = VRRP Virtual Router ID (1–255, muss im Subnetz eindeutig sein)
+CREATE TABLE IF NOT EXISTS cluster_settings (
+    id              INTEGER PRIMARY KEY DEFAULT 1,
+    vip_address     TEXT,
+    vip_interface   TEXT,
+    vip_auth_pass   TEXT,
+    vrrp_router_id  INTEGER NOT NULL DEFAULT 51,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT cluster_settings_singleton CHECK (id = 1)
+);
+
+INSERT INTO cluster_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+DROP TABLE IF EXISTS cluster_settings;
+ALTER TABLE ha_nodes DROP COLUMN IF EXISTS pg_role;
+
+-- +goose StatementEnd

internal/database/migrations/0030_cluster_sync_replication.sql

@@ -0,0 +1,21 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- HINWEIS (korrigiert v1.2.89): Diese Migration war urspr. dafür gedacht,
+-- network_interfaces und ip_addresses in die Cluster-Replikation aufzunehmen.
+-- Das wurde NICHT umgesetzt und ist auch NICHT gewollt: beide Tabellen sind
+-- node-spezifisch (jede Node hat eigene Mgmt-/Host-IPs) und stehen weiterhin
+-- in cluster_replication.go localOnlyTables → sie werden bewusst NICHT
+-- repliziert. Sie sind auch aus dem Drift-Hash (confighash.go) entfernt,
+-- da sie sonst dauerhaften False-Positive-Drift erzeugen.
+-- Diese Migration ist ein No-op / reiner Versions-Marker für goose.
+SELECT 1;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+SELECT 1;
+
+-- +goose StatementEnd

internal/database/migrations/0031_forward_proxy_settings.sql

@@ -0,0 +1,25 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- forward_proxy_settings — Singleton-Row für globale Squid-Einstellungen.
+-- listen_addresses: Komma-separierte IPs auf denen Squid lauscht.
+-- Leer = alle Interfaces (http_port 3128). Typisch: LAN/VLAN-Gateway-IPs.
+CREATE TABLE IF NOT EXISTS forward_proxy_settings (
+    id               INTEGER PRIMARY KEY DEFAULT 1,
+    listen_addresses TEXT NOT NULL DEFAULT '',
+    listen_port      INTEGER NOT NULL DEFAULT 3128,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT forward_proxy_settings_singleton CHECK (id = 1)
+);
+
+INSERT INTO forward_proxy_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+DROP TABLE IF EXISTS forward_proxy_settings;
+
+-- +goose StatementEnd

internal/database/migrations/0032_proxy_dns_extended_settings.sql

@@ -0,0 +1,37 @@
+-- +goose Up
+-- +goose StatementBegin
+
+ALTER TABLE forward_proxy_settings
+  ADD COLUMN IF NOT EXISTS cache_mem_mb      INTEGER NOT NULL DEFAULT 64,
+  ADD COLUMN IF NOT EXISTS cache_dir_mb      INTEGER NOT NULL DEFAULT 100,
+  ADD COLUMN IF NOT EXISTS max_obj_size_mb   INTEGER NOT NULL DEFAULT 4,
+  ADD COLUMN IF NOT EXISTS connect_timeout   INTEGER NOT NULL DEFAULT 60,
+  ADD COLUMN IF NOT EXISTS read_timeout      INTEGER NOT NULL DEFAULT 300,
+  ADD COLUMN IF NOT EXISTS request_timeout   INTEGER NOT NULL DEFAULT 300;
+
+ALTER TABLE dns_settings
+  ADD COLUMN IF NOT EXISTS prefetch            BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS serve_expired       BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS msg_cache_size_mb   INTEGER NOT NULL DEFAULT 64,
+  ADD COLUMN IF NOT EXISTS rrset_cache_size_mb INTEGER NOT NULL DEFAULT 128;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+ALTER TABLE forward_proxy_settings
+  DROP COLUMN IF EXISTS cache_mem_mb,
+  DROP COLUMN IF EXISTS cache_dir_mb,
+  DROP COLUMN IF EXISTS max_obj_size_mb,
+  DROP COLUMN IF EXISTS connect_timeout,
+  DROP COLUMN IF EXISTS read_timeout,
+  DROP COLUMN IF EXISTS request_timeout;
+
+ALTER TABLE dns_settings
+  DROP COLUMN IF EXISTS prefetch,
+  DROP COLUMN IF EXISTS serve_expired,
+  DROP COLUMN IF EXISTS msg_cache_size_mb,
+  DROP COLUMN IF EXISTS rrset_cache_size_mb;
+
+-- +goose StatementEnd

internal/database/migrations/0033_cluster_settings_splitbrain.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+-- Dual-path VRRP + Gateway-Tracking für Split-Brain-Schutz.
+-- hb_* = zweite VRRP-Instanz (VI_HB) auf dediziertem Heartbeat-Interface.
+-- gw_check_ip = Gateway-IP die von chk_gateway angepingt wird (weight -110).
+ALTER TABLE cluster_settings
+  ADD COLUMN IF NOT EXISTS hb_interface  VARCHAR,
+  ADD COLUMN IF NOT EXISTS hb_src_ip     VARCHAR,
+  ADD COLUMN IF NOT EXISTS hb_peer_ip    VARCHAR,
+  ADD COLUMN IF NOT EXISTS hb_router_id  INTEGER NOT NULL DEFAULT 52,
+  ADD COLUMN IF NOT EXISTS gw_check_ip   VARCHAR;
+
+-- +goose Down
+ALTER TABLE cluster_settings
+  DROP COLUMN IF EXISTS hb_interface,
+  DROP COLUMN IF EXISTS hb_src_ip,
+  DROP COLUMN IF EXISTS hb_peer_ip,
+  DROP COLUMN IF EXISTS hb_router_id,
+  DROP COLUMN IF EXISTS gw_check_ip;

internal/database/migrations/0034_totp.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+ALTER TABLE users
+    ADD COLUMN totp_secret  TEXT,
+    ADD COLUMN totp_enabled BOOLEAN NOT NULL DEFAULT false;
+
+-- +goose Down
+ALTER TABLE users
+    DROP COLUMN totp_secret,
+    DROP COLUMN totp_enabled;

internal/database/migrations/0035_firewall_note_labels.sql

@@ -0,0 +1,17 @@
+-- +goose Up
+ALTER TABLE firewall_rules
+    ADD COLUMN IF NOT EXISTS note   TEXT,
+    ADD COLUMN IF NOT EXISTS labels TEXT[] NOT NULL DEFAULT '{}';
+
+ALTER TABLE firewall_nat_rules
+    ADD COLUMN IF NOT EXISTS note   TEXT,
+    ADD COLUMN IF NOT EXISTS labels TEXT[] NOT NULL DEFAULT '{}';
+
+-- +goose Down
+ALTER TABLE firewall_rules
+    DROP COLUMN IF EXISTS note,
+    DROP COLUMN IF EXISTS labels;
+
+ALTER TABLE firewall_nat_rules
+    DROP COLUMN IF EXISTS note,
+    DROP COLUMN IF EXISTS labels;

internal/database/migrations/0036_crowdsec.sql

@@ -0,0 +1,12 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS crowdsec_settings (
+    id               INTEGER PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    enabled          BOOLEAN NOT NULL DEFAULT false,
+    simulation_mode  BOOLEAN NOT NULL DEFAULT false,
+    collections      TEXT[]  NOT NULL DEFAULT '{"crowdsecurity/linux","crowdsecurity/haproxy"}',
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+INSERT INTO crowdsec_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS crowdsec_settings;

internal/database/migrations/0037_waf.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS waf_configs (
+    id              SERIAL PRIMARY KEY,
+    domain_id       BIGINT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    enabled         BOOLEAN  NOT NULL DEFAULT false,
+    mode            TEXT     NOT NULL DEFAULT 'detection'
+                             CHECK (mode IN ('detection','blocking')),
+    paranoia_level  INT      NOT NULL DEFAULT 1
+                             CHECK (paranoia_level BETWEEN 1 AND 4),
+    rule_exclusions TEXT[]   NOT NULL DEFAULT '{}',
+    trusted_proxies TEXT[]   NOT NULL DEFAULT '{}',
+    custom_rules    TEXT     NOT NULL DEFAULT '',
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT waf_configs_domain_unique UNIQUE (domain_id)
+);
+
+-- +goose Down
+DROP TABLE IF EXISTS waf_configs;

internal/database/migrations/0038_waf_alerts.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS waf_alerts (
+    id         BIGSERIAL PRIMARY KEY,
+    domain_id  BIGINT REFERENCES domains(id) ON DELETE CASCADE,
+    hostname   TEXT        NOT NULL,
+    client_ip  TEXT        NOT NULL,
+    method     TEXT        NOT NULL,
+    uri        TEXT        NOT NULL,
+    rule_id    INT         NOT NULL DEFAULT 0,
+    rule_msg   TEXT        NOT NULL DEFAULT '',
+    severity   TEXT        NOT NULL DEFAULT '',
+    action     TEXT        NOT NULL,          -- 'detected' | 'blocked'
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS waf_alerts_domain_created ON waf_alerts(domain_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS waf_alerts_created ON waf_alerts(created_at DESC);
+
+-- +goose Down
+DROP TABLE IF EXISTS waf_alerts;

internal/database/migrations/0039_waf_exclusion_notes.sql

@@ -0,0 +1,6 @@
+-- +goose Up
+ALTER TABLE waf_configs
+    ADD COLUMN IF NOT EXISTS exclusion_notes JSONB NOT NULL DEFAULT '{}';
+
+-- +goose Down
+ALTER TABLE waf_configs DROP COLUMN IF EXISTS exclusion_notes;

internal/database/migrations/0040_oidc_settings.sql

@@ -0,0 +1,35 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- OIDC / Keycloak SSO — Singleton-Settings (analog forward_proxy_settings).
+-- client_secret_enc: secrets.Box.Seal-Output (AES-256-GCM), NULL = nicht gesetzt.
+-- Rolle kommt bewusst NICHT aus dem Token, daher keine group/role-claim-Spalten.
+CREATE TABLE IF NOT EXISTS oidc_settings (
+    id                INTEGER     PRIMARY KEY DEFAULT 1,
+    enabled           BOOLEAN     NOT NULL DEFAULT false,
+    issuer_url        TEXT        NOT NULL DEFAULT '',
+    client_id         TEXT        NOT NULL DEFAULT '',
+    client_secret_enc BYTEA,
+    scopes            TEXT        NOT NULL DEFAULT 'openid email profile',
+    email_claim       TEXT        NOT NULL DEFAULT 'email',
+    button_label      TEXT        NOT NULL DEFAULT 'Sign in with SSO',
+    created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT oidc_settings_singleton CHECK (id = 1)
+);
+INSERT INTO oidc_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- Opportunistisches Linking: beim ersten SSO-Login wird der OIDC-'sub'
+-- gespeichert; weicht er später ab, wird der Login abgelehnt. Nullable,
+-- kein Backfill (Match-Schlüssel bleibt die verifizierte E-Mail).
+ALTER TABLE users ADD COLUMN IF NOT EXISTS oidc_subject TEXT;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+ALTER TABLE users DROP COLUMN IF EXISTS oidc_subject;
+DROP TABLE IF EXISTS oidc_settings;
+
+-- +goose StatementEnd

internal/database/migrations/0041_dhcp.sql

@@ -0,0 +1,62 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- DHCP (Kea) — globale Singleton-Settings (node-lokal, wie dns_settings/
+-- ntp_settings: ob DIESE Node DHCP betreibt). Subnets/Reservierungen sind
+-- geteilte Config und werden repliziert.
+CREATE TABLE IF NOT EXISTS dhcp_settings (
+    id             INTEGER     PRIMARY KEY DEFAULT 1,
+    enabled        BOOLEAN     NOT NULL DEFAULT false,
+    default_lease  INTEGER     NOT NULL DEFAULT 3600,
+    max_lease      INTEGER     NOT NULL DEFAULT 7200,
+    domain_name    TEXT        NOT NULL DEFAULT '',
+    dns_servers    TEXT        NOT NULL DEFAULT '',
+    created_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT dhcp_settings_singleton CHECK (id = 1)
+);
+INSERT INTO dhcp_settings (id) VALUES (1) ON CONFLICT DO NOTHING;
+
+-- Subnets: an ein Interface per NAME gebunden (nicht per node-lokaler FK,
+-- damit die Replikation nicht an divergierenden interface_id bricht).
+CREATE TABLE IF NOT EXISTS dhcp_subnets (
+    id             BIGSERIAL   PRIMARY KEY,
+    name           TEXT        NOT NULL,
+    interface_name TEXT        NOT NULL,
+    subnet_cidr    TEXT        NOT NULL,
+    pool_start     TEXT        NOT NULL DEFAULT '',
+    pool_end       TEXT        NOT NULL DEFAULT '',
+    gateway        TEXT        NOT NULL DEFAULT '',
+    dns_servers    TEXT        NOT NULL DEFAULT '',
+    lease_time     INTEGER,
+    active         BOOLEAN     NOT NULL DEFAULT true,
+    description    TEXT        NOT NULL DEFAULT '',
+    created_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT dhcp_subnets_name_unique UNIQUE (name)
+);
+
+CREATE TABLE IF NOT EXISTS dhcp_reservations (
+    id          BIGSERIAL   PRIMARY KEY,
+    subnet_id   BIGINT      NOT NULL REFERENCES dhcp_subnets(id) ON DELETE CASCADE,
+    name        TEXT        NOT NULL DEFAULT '',
+    mac_address TEXT        NOT NULL,
+    ip_address  TEXT        NOT NULL,
+    hostname    TEXT        NOT NULL DEFAULT '',
+    active      BOOLEAN     NOT NULL DEFAULT true,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    CONSTRAINT dhcp_reservations_subnet_mac_unique UNIQUE (subnet_id, mac_address)
+);
+CREATE INDEX IF NOT EXISTS idx_dhcp_reservations_subnet ON dhcp_reservations(subnet_id);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+DROP TABLE IF EXISTS dhcp_reservations;
+DROP TABLE IF EXISTS dhcp_subnets;
+DROP TABLE IF EXISTS dhcp_settings;
+
+-- +goose StatementEnd

internal/firewall/firewall.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	_ "embed"
 	"fmt"
+	"log/slog"
 	"net"
 	"os/exec"
 	"path/filepath"
@@ -138,6 +139,7 @@ type View struct {
 type WGSiteMasqEntry struct {
 	Iface  string // wg interface name, e.g. "wg7"
 	VPNNet string // network CIDR of the VPN subnet, e.g. "192.168.99.0/24"
+	L3     string // "ip" oder "ip6" — Familie von VPNNet
 }
 
 // AutoFWRule is one auto-emitted inbound rule. Proto is "tcp" or
@@ -148,6 +150,7 @@ type AutoFWRule struct {
 	Proto   string
 	Port    int
 	DstIP   string
+	Iface   string // optional: scope auf ein iifname (z.B. DHCP udp/67 nur auf LAN)
 	Comment string
 }
 
@@ -162,7 +165,11 @@ type RuleLeg struct {
 	DstIfaces []string
 	SrcAddrs  []string
 	DstAddrs  []string
-	Service   ResolvedService // Proto="" → no service match (any)
+	// L3 ist "ip" (IPv4) oder "ip6" (IPv6) für das Adress-Matching —
+	// gesetzt, sobald SrcAddrs/DstAddrs nicht leer sind. Bei adresslosen
+	// Regeln bleibt es "" (familienagnostisch, kein ip/ip6-Match).
+	L3      string
+	Service ResolvedService // Proto="" → no service match (any)
 }
 
 // ResolvedRule has all addresses + services already expanded so the
@@ -195,6 +202,12 @@ type ResolvedNATRule struct {
 	DPortStart, DPortEnd int
 	TargetAddr string
 	TargetPortStart, TargetPortEnd int
+	// L3 ist "ip" oder "ip6" — Adressfamilie der Regel (aus SrcCIDR/
+	// DstCIDR/TargetAddr abgeleitet). TargetHost ist TargetAddr, bei
+	// IPv6 MIT Port in eckigen Klammern ("[2001:db8::1]") für korrekte
+	// nft-dnat-Syntax.
+	L3         string
+	TargetHost string
 	Comment  string
 }
 
@@ -280,26 +293,15 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 	if err != nil {
 		return nil, err
 	}
-	// Expand to one Leg per (rule × service); rules without a service
-	// produce one leg with empty Proto.
+	// Expand to one Leg per (rule × service × address-family). Rules
+	// without a service produce one leg-set with empty Proto.
 	for _, r := range rules {
 		if len(r.Services) == 0 {
-			view.Legs = append(view.Legs, RuleLeg{
-				RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name,
-				Comment: r.Comment,
-				SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
-				SrcAddrs: r.SrcAddrs, DstAddrs: r.DstAddrs,
-			})
+			view.Legs = append(view.Legs, expandFamilyLegs(r, ResolvedService{}, false)...)
 			continue
 		}
 		for _, svc := range r.Services {
-			view.Legs = append(view.Legs, RuleLeg{
-				RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name,
-				Comment: r.Comment,
-				SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
-				SrcAddrs: r.SrcAddrs, DstAddrs: r.DstAddrs,
-				Service: svc,
-			})
+			view.Legs = append(view.Legs, expandFamilyLegs(r, svc, true)...)
 		}
 	}
 
@@ -323,9 +325,14 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 			if wgRows.Scan(&name, &cidr) == nil {
 				view.WGServerIfaces = append(view.WGServerIfaces, name)
 				if _, ipNet, err := net.ParseCIDR(cidr); err == nil {
+					l3 := addrFamily(ipNet.String())
+					if l3 == "" {
+						l3 = "ip"
+					}
 					view.WGSiteMasq = append(view.WGSiteMasq, WGSiteMasqEntry{
 						Iface:  name,
 						VPNNet: ipNet.String(),
+						L3:     l3,
 					})
 				}
 			}
@@ -363,11 +370,24 @@ func (g *Generator) loadAutoRules(ctx context.Context) []AutoFWRule {
 		}
 	}
 
-	// Squid Forward-Proxy: wenn ≥1 aktive ACL → tcp 3128 inbound
-	// (squid bindet aktuell 0.0.0.0:3128, daher kein DstIP-Filter).
-	var aclCount int
-	if err := g.Pool.QueryRow(ctx, `SELECT count(*) FROM forward_proxy_acls WHERE active`).Scan(&aclCount); err == nil && aclCount > 0 {
-		out = append(out, AutoFWRule{Proto: "tcp", Port: 3128, Comment: "Forward-Proxy (Squid)"})
+	// Squid Forward-Proxy: lese Port + Listen-Adressen aus
+	// forward_proxy_settings. Für jede nicht-loopback IP eine
+	// Auto-Rule; leere Liste = alle Interfaces (generische Regel).
+	var squidAddrs string
+	var squidPort int
+	if err := g.Pool.QueryRow(ctx,
+		`SELECT listen_addresses, listen_port FROM forward_proxy_settings WHERE id=1`,
+	).Scan(&squidAddrs, &squidPort); err == nil && squidPort > 0 {
+		addrs := splitCSV(squidAddrs)
+		if len(addrs) == 0 {
+			out = append(out, AutoFWRule{Proto: "tcp", Port: squidPort, Comment: "Forward-Proxy (Squid)"})
+		} else {
+			for _, ip := range addrs {
+				if !isLoopback(ip) {
+					out = append(out, AutoFWRule{Proto: "tcp", Port: squidPort, DstIP: ip, Comment: "Forward-Proxy (Squid) auf " + ip})
+				}
+			}
+		}
 	}
 
 	// WireGuard server-mode: udp <listen_port> pro aktive iface.
@@ -398,6 +418,22 @@ func (g *Generator) loadAutoRules(ctx context.Context) []AutoFWRule {
 		}
 	}
 
+	// DHCP (Kea): wenn auf DIESER Node aktiviert → udp/67 pro aktivem
+	// Subnet-Interface (gescopt auf die LAN-iface, NICHT global/WAN).
+	var dhcpEnabled bool
+	if err := g.Pool.QueryRow(ctx, `SELECT enabled FROM dhcp_settings WHERE id=1`).Scan(&dhcpEnabled); err == nil && dhcpEnabled {
+		rows, err := g.Pool.Query(ctx, `SELECT DISTINCT interface_name FROM dhcp_subnets WHERE active AND interface_name <> ''`)
+		if err == nil {
+			defer rows.Close()
+			for rows.Next() {
+				var iface string
+				if rows.Scan(&iface) == nil && iface != "" {
+					out = append(out, AutoFWRule{Proto: "udp", Port: 67, Iface: iface, Comment: "DHCP (Kea) auf " + iface})
+				}
+			}
+		}
+	}
+
 	return out
 }
 
@@ -422,6 +458,131 @@ func isLoopback(ip string) bool {
 	return strings.HasPrefix(ip, "127.")
 }
 
+// addrFamily klassifiziert einen nft-Adressausdruck (host, CIDR oder
+// range "a-b") als "ip" (IPv4), "ip6" (IPv6) oder "" (unbestimmt, z.B.
+// FQDN-Platzhalter). Adressen enthalten selbst kein '-', daher trennt der
+// erste Bindestrich sicher eine Range in ihr erstes Element.
+func addrFamily(expr string) string {
+	expr = strings.TrimSpace(expr)
+	if expr == "" {
+		return ""
+	}
+	if i := strings.IndexByte(expr, '-'); i > 0 {
+		expr = strings.TrimSpace(expr[:i])
+	}
+	if i := strings.IndexByte(expr, '/'); i > 0 {
+		expr = expr[:i]
+	}
+	ip := net.ParseIP(expr)
+	if ip == nil {
+		return ""
+	}
+	if ip.To4() != nil {
+		return "ip"
+	}
+	return "ip6"
+}
+
+// splitByFamily teilt eine Liste von nft-Adressausdrücken in v4 und v6.
+// Unbestimmte (FQDN o.ä.) werden verworfen.
+func splitByFamily(exprs []string) (v4, v6 []string) {
+	for _, e := range exprs {
+		switch addrFamily(e) {
+		case "ip":
+			v4 = append(v4, e)
+		case "ip6":
+			v6 = append(v6, e)
+		}
+	}
+	return v4, v6
+}
+
+// serviceL3: icmp ist v4-only, icmpv6 v6-only, tcp/udp/leer agnostisch.
+func serviceL3(svc ResolvedService) string {
+	switch svc.Proto {
+	case "icmp":
+		return "ip"
+	case "icmpv6":
+		return "ip6"
+	default:
+		return ""
+	}
+}
+
+// natFamily ermittelt die Adressfamilie einer NAT-Regel aus ihren
+// Adressen. ok=false bei gemischten v4/v6-Adressen (ungültig → die Regel
+// muss übersprungen werden, sonst bricht `nft -f` das gesamte Ruleset).
+func natFamily(r ResolvedNATRule) (fam string, ok bool) {
+	for _, a := range []string{r.SrcCIDR, r.DstCIDR, r.TargetAddr} {
+		f := addrFamily(a)
+		if f == "" {
+			continue
+		}
+		if fam == "" {
+			fam = f
+		} else if fam != f {
+			return "", false
+		}
+	}
+	if fam == "" {
+		fam = "ip" // keine Adressen (reine iface/proto-Regel) → v4-Default
+	}
+	return fam, true
+}
+
+// expandFamilyLegs materialisiert die nft-Zeilen für eine Regel + optional
+// einen Service, getrennt nach Adressfamilie. Adresslose Regeln ergeben eine
+// einzige familienagnostische Zeile (unverändertes v4-Verhalten, greift
+// zugleich für v6). Regeln mit Adressen werden pro Familie als separate
+// Zeile emittiert — ein nft-Paket ist immer entweder v4 oder v6.
+func expandFamilyLegs(r ResolvedRule, svc ResolvedService, hasSvc bool) []RuleLeg {
+	base := RuleLeg{
+		RuleID: r.ID, Action: r.Action, Log: r.Log, Name: r.Name, Comment: r.Comment,
+		SrcIfaces: r.SrcIfaces, DstIfaces: r.DstIfaces,
+	}
+	if hasSvc {
+		base.Service = svc
+	}
+
+	if len(r.SrcAddrs) == 0 && len(r.DstAddrs) == 0 {
+		// Kein Adress-Match → eine Zeile, L3 leer. Die Proto-Render-Logik
+		// im Template setzt icmp/icmpv6 selbst familienkorrekt.
+		return []RuleLeg{base}
+	}
+
+	src4, src6 := splitByFamily(r.SrcAddrs)
+	dst4, dst6 := splitByFamily(r.DstAddrs)
+	svcFam := ""
+	if hasSvc {
+		svcFam = serviceL3(svc)
+	}
+
+	var legs []RuleLeg
+	for _, fam := range []string{"ip", "ip6"} {
+		if svcFam != "" && svcFam != fam {
+			continue // icmp nur auf v4, icmpv6 nur auf v6
+		}
+		srcF, dstF := src4, dst4
+		if fam == "ip6" {
+			srcF, dstF = src6, dst6
+		}
+		// Eine eingeschränkte Seite ohne Mitglied dieser Familie → die
+		// Zeile würde nichts (oder Falsches) matchen → überspringen.
+		if len(r.SrcAddrs) > 0 && len(srcF) == 0 {
+			continue
+		}
+		if len(r.DstAddrs) > 0 && len(dstF) == 0 {
+			continue
+		}
+		leg := base
+		leg.L3 = fam
+		leg.SrcAddrs = srcF
+		leg.DstAddrs = dstF
+		legs = append(legs, leg)
+	}
+	return legs
+}
+
 // addrObjMap is keyed by id; value is the nft expression for that
 // object (e.g. "1.2.3.4", "10.0.0.0/24", "1.2.3.4-1.2.3.10").
 type addrObjMap map[int64]string
@@ -680,6 +841,19 @@ ORDER BY priority DESC, id ASC`)
 		if outZone != nil {
 			r.OutIfaces = zoneIfaces[*outZone]
 		}
+		fam, ok := natFamily(r)
+		if !ok {
+			// Gemischte v4/v6-Adressen → ungültige NAT-Regel. Überspringen
+			// statt das gesamte Ruleset mit `nft -f` zu brechen.
+			slog.Warn("firewall: NAT-Regel mit gemischten v4/v6-Adressen übersprungen", "id", r.ID)
+			continue
+		}
+		r.L3 = fam
+		r.TargetHost = r.TargetAddr
+		if fam == "ip6" && r.TargetAddr != "" && r.TargetPortStart > 0 {
+			// nft braucht [v6]:port für dnat-Targets mit Port.
+			r.TargetHost = "[" + r.TargetAddr + "]"
+		}
 		out = append(out, r)
 	}
 	return out, rows.Err()

internal/firewall/firewall_autorule_test.go

@@ -0,0 +1,59 @@
+package firewall
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// TestTemplate_autoRuleIface prüft, dass eine Auto-Rule mit Iface als
+// `iifname "<x>"`-gescopte Zeile rendert (DHCP udp/67 auf LAN) und dass
+// DstIP-basierte Auto-Rules unverändert bleiben.
+func TestTemplate_autoRuleIface(t *testing.T) {
+	view := &View{
+		AutoRules: []AutoFWRule{
+			{Proto: "udp", Port: 67, Iface: "eth1", Comment: "DHCP (Kea) auf eth1"},
+			{Proto: "udp", Port: 53, DstIP: "10.0.0.1", Comment: "DNS"},
+		},
+	}
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, view); err != nil {
+		t.Fatalf("template execute: %v", err)
+	}
+	out := buf.String()
+
+	if !strings.Contains(out, `iifname "eth1" udp dport 67 accept comment "auto: DHCP (Kea) auf eth1"`) {
+		t.Errorf("missing iface-scoped DHCP auto-rule\n----\n%s", out)
+	}
+	// Regression: DstIP-Auto-Rule ohne Iface bleibt unverändert.
+	if !strings.Contains(out, `ip daddr 10.0.0.1 udp dport 53 accept`) {
+		t.Errorf("DstIP auto-rule changed\n----\n%s", out)
+	}
+
+	// Echte nft-Syntaxvalidierung (braucht root → via sudo, sonst skip).
+	nft, err := exec.LookPath("nft")
+	if err != nil {
+		t.Skip("nft not in PATH")
+	}
+	f, err := os.CreateTemp(t.TempDir(), "autorule-*.nft")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = f.WriteString(out)
+	f.Close()
+	var cmd *exec.Cmd
+	if os.Geteuid() == 0 {
+		cmd = exec.Command(nft, "-c", "-f", f.Name())
+	} else {
+		cmd = exec.Command("sudo", "-n", nft, "-c", "-f", f.Name())
+	}
+	if combined, err := cmd.CombinedOutput(); err != nil {
+		msg := string(combined)
+		if strings.Contains(msg, "Operation not permitted") || strings.Contains(msg, "password is required") {
+			t.Skipf("nft -c needs root: %s", strings.TrimSpace(msg))
+		}
+		t.Fatalf("nft -c rejected ruleset: %v\n%s\n----\n%s", err, combined, out)
+	}
+}

internal/firewall/firewall_e2e_test.go

@@ -0,0 +1,142 @@
+package firewall
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+)
+
+// TestE2E_IPv6Render fährt den ECHTEN Generator gegen eine Test-DB:
+// alle Migrations + v4/v6-Seed + RenderToString + nft -c. Nur aktiv, wenn
+// EG_FWTEST_DSN gesetzt ist (sonst Skip — `go test ./...` bleibt DB-frei).
+func TestE2E_IPv6Render(t *testing.T) {
+	dsn := os.Getenv("EG_FWTEST_DSN")
+	if dsn == "" {
+		t.Skip("set EG_FWTEST_DSN to run the firewall end-to-end test")
+	}
+	ctx := context.Background()
+	// Retry: goose-Erst-Apply ist nicht concurrency-safe, wenn mehrere
+	// guarded Test-Pakete dieselbe frische DB parallel migrieren.
+	var mErr error
+	for i := 0; i < 3; i++ {
+		if mErr = database.Migrate(ctx, dsn); mErr == nil {
+			break
+		}
+		time.Sleep(700 * time.Millisecond)
+	}
+	if mErr != nil {
+		t.Fatalf("migrate: %v", mErr)
+	}
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer pool.Close()
+
+	for _, tbl := range []string{
+		"firewall_nat_rules", "firewall_rules",
+		"firewall_address_group_members", "firewall_address_groups",
+		"firewall_address_objects", "network_interfaces",
+	} {
+		if _, err := pool.Exec(ctx, "DELETE FROM "+tbl); err != nil {
+			t.Fatalf("clean %s: %v", tbl, err)
+		}
+	}
+
+	mustExec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("seed failed (%s): %v", sql, err)
+		}
+	}
+	insID := func(sql string, args ...any) int64 {
+		t.Helper()
+		var id int64
+		if err := pool.QueryRow(ctx, sql, args...).Scan(&id); err != nil {
+			t.Fatalf("seed-id failed (%s): %v", sql, err)
+		}
+		return id
+	}
+
+	mustExec(`INSERT INTO network_interfaces (name,type,role) VALUES ('eth0','ethernet','wan'),('eth1','ethernet','lan')`)
+
+	v4net := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v4net','network','10.0.0.0/24') RETURNING id`)
+	v6net := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v6net','network','2001:db8:1::/64') RETURNING id`)
+	v6host := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v6host','host','2001:db8:2::5') RETURNING id`)
+	v6range := insID(`INSERT INTO firewall_address_objects (name,kind,value) VALUES ('v6range','range','2001:db8:3::1-2001:db8:3::9') RETURNING id`)
+
+	// Gemischte Gruppe (v4 + v6) → muss in zwei Familien-Zeilen splitten.
+	grp := insID(`INSERT INTO firewall_address_groups (name) VALUES ('mixed') RETURNING id`)
+	mustExec(`INSERT INTO firewall_address_group_members (group_id,object_id) VALUES ($1,$2),($1,$3)`, grp, v4net, v6net)
+
+	httpsSvc := insID(`INSERT INTO firewall_services (name,proto,port_start,port_end,builtin,description) VALUES ('t-https','tcp',443,443,false,'')
+		ON CONFLICT (name) DO UPDATE SET proto=excluded.proto RETURNING id`)
+	var pingV6 int64
+	_ = pool.QueryRow(ctx, `SELECT id FROM firewall_services WHERE proto='icmpv6' LIMIT 1`).Scan(&pingV6)
+
+	// (1) gemischte Gruppe + tcp443 → je eine ip- und ip6-Zeile.
+	mustExec(`INSERT INTO firewall_rules (name,action,src_zone,src_address_group_id,service_object_id) VALUES ('mixed-https','accept','any',$1,$2)`, grp, httpsSvc)
+	// (2) v6-host + icmpv6 → eine ip6-Zeile.
+	if pingV6 != 0 {
+		mustExec(`INSERT INTO firewall_rules (name,action,src_address_object_id,service_object_id) VALUES ('v6-ping','accept',$1,$2)`, v6host, pingV6)
+	}
+	// (3) v6-range src + v6net dst (kein Service).
+	mustExec(`INSERT INTO firewall_rules (name,action,src_address_object_id,dst_address_object_id) VALUES ('v6-range','drop',$1,$2)`, v6range, v6net)
+
+	// (a) v6-DNAT mit Port → dnat to [..]:port.
+	mustExec(`INSERT INTO firewall_nat_rules (name,kind,proto,match_dst_cidr,match_dport_start,target_addr,target_port_start) VALUES ('v6-dnat','dnat','tcp','2001:db8:9::/64',80,'2001:db8:9::2',8080)`)
+	// (b) v4-DNAT (Regression).
+	mustExec(`INSERT INTO firewall_nat_rules (name,kind,proto,match_dst_cidr,match_dport_start,target_addr,target_port_start) VALUES ('v4-dnat','dnat','tcp','1.2.3.4',80,'10.0.0.5',80)`)
+	// (c) gemischte Familie (v4 src, v6 target) → MUSS übersprungen werden.
+	mustExec(`INSERT INTO firewall_nat_rules (name,kind,proto,match_src_cidr,target_addr) VALUES ('mixed-snat','snat','any','10.0.0.0/24','2001:db8::99')`)
+
+	out, err := New(pool).RenderToString(ctx)
+	if err != nil {
+		t.Fatalf("render: %v", err)
+	}
+
+	for _, w := range []string{
+		"ip saddr { 10.0.0.0/24 }",
+		"ip6 saddr { 2001:db8:1::/64 }",
+		"ip6 nexthdr icmpv6",
+		"ip6 saddr { 2001:db8:3::1-2001:db8:3::9 }",
+		"dnat to [2001:db8:9::2]:8080",
+		"dnat to 10.0.0.5:80",
+	} {
+		if !strings.Contains(out, w) {
+			t.Errorf("rendered output missing %q\n----\n%s", w, out)
+		}
+	}
+	if strings.Contains(out, "2001:db8::99") {
+		t.Errorf("mixed-family NAT rule was not skipped\n----\n%s", out)
+	}
+
+	nft, err := exec.LookPath("nft")
+	if err != nil {
+		t.Skip("nft not in PATH — skipping syntax check")
+	}
+	f, err := os.CreateTemp(t.TempDir(), "e2e-*.nft")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _ = f.WriteString(out)
+	f.Close()
+	var cmd *exec.Cmd
+	if os.Geteuid() == 0 {
+		cmd = exec.Command(nft, "-c", "-f", f.Name())
+	} else {
+		cmd = exec.Command("sudo", "-n", nft, "-c", "-f", f.Name())
+	}
+	if combined, err := cmd.CombinedOutput(); err != nil {
+		msg := string(combined)
+		if strings.Contains(msg, "Operation not permitted") || strings.Contains(msg, "password is required") {
+			t.Skipf("nft -c needs root (no usable sudo): %s", strings.TrimSpace(msg))
+		}
+		t.Fatalf("nft -c rejected the real-rendered ruleset: %v\n%s\n----\n%s", err, combined, out)
+	}
+}

internal/firewall/firewall_ipv6_test.go

@@ -0,0 +1,183 @@
+package firewall
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+func TestAddrFamily(t *testing.T) {
+	cases := map[string]string{
+		"1.2.3.4":                 "ip",
+		"10.0.0.0/24":             "ip",
+		"1.2.3.4-1.2.3.10":        "ip",
+		"2001:db8::1":             "ip6",
+		"fd00::/64":               "ip6",
+		"2001:db8::1-2001:db8::5": "ip6",
+		"example.com":             "",
+		"":                        "",
+	}
+	for in, want := range cases {
+		if got := addrFamily(in); got != want {
+			t.Errorf("addrFamily(%q)=%q want %q", in, got, want)
+		}
+	}
+}
+
+func TestExpandFamilyLegs_splitsByFamily(t *testing.T) {
+	r := ResolvedRule{
+		ID: 1, Action: "accept",
+		SrcAddrs: []string{"10.0.0.0/24", "fd00::/64"},
+		DstAddrs: []string{"1.2.3.4", "2001:db8::1"},
+	}
+	legs := expandFamilyLegs(r, ResolvedService{}, false)
+	if len(legs) != 2 {
+		t.Fatalf("want 2 legs (v4+v6), got %d", len(legs))
+	}
+	var v4, v6 *RuleLeg
+	for i := range legs {
+		switch legs[i].L3 {
+		case "ip":
+			v4 = &legs[i]
+		case "ip6":
+			v6 = &legs[i]
+		}
+	}
+	if v4 == nil || v6 == nil {
+		t.Fatalf("missing family leg: %+v", legs)
+	}
+	if len(v4.SrcAddrs) != 1 || v4.SrcAddrs[0] != "10.0.0.0/24" || v4.DstAddrs[0] != "1.2.3.4" {
+		t.Errorf("v4 leg wrong: src=%v dst=%v", v4.SrcAddrs, v4.DstAddrs)
+	}
+	if len(v6.SrcAddrs) != 1 || v6.SrcAddrs[0] != "fd00::/64" || v6.DstAddrs[0] != "2001:db8::1" {
+		t.Errorf("v6 leg wrong: src=%v dst=%v", v6.SrcAddrs, v6.DstAddrs)
+	}
+}
+
+func TestExpandFamilyLegs_addresslessIsAgnostic(t *testing.T) {
+	legs := expandFamilyLegs(ResolvedRule{ID: 2, Action: "accept"}, ResolvedService{}, false)
+	if len(legs) != 1 || legs[0].L3 != "" {
+		t.Fatalf("addressless rule must be a single agnostic leg, got %d legs L3=%q", len(legs), legs[0].L3)
+	}
+}
+
+func TestExpandFamilyLegs_oneFamilyOnly(t *testing.T) {
+	// src nur v4, dst nur v4 → genau eine v4-Zeile (kein leerer v6-Leg).
+	r := ResolvedRule{ID: 3, Action: "drop", SrcAddrs: []string{"10.0.0.0/8"}}
+	legs := expandFamilyLegs(r, ResolvedService{}, false)
+	if len(legs) != 1 || legs[0].L3 != "ip" {
+		t.Fatalf("v4-only rule want 1 ip leg, got %+v", legs)
+	}
+}
+
+func TestExpandFamilyLegs_icmpFamilyMatch(t *testing.T) {
+	r6 := ResolvedRule{ID: 4, Action: "accept", SrcAddrs: []string{"fd00::/64"}}
+	if legs := expandFamilyLegs(r6, ResolvedService{Proto: "icmpv6"}, true); len(legs) != 1 || legs[0].L3 != "ip6" {
+		t.Fatalf("icmpv6+v6 want 1 ip6 leg, got %+v", legs)
+	}
+	if legs := expandFamilyLegs(r6, ResolvedService{Proto: "icmp"}, true); len(legs) != 0 {
+		t.Fatalf("icmp on v6-only addrs want 0 legs, got %+v", legs)
+	}
+}
+
+func TestNatFamily(t *testing.T) {
+	if _, ok := natFamily(ResolvedNATRule{SrcCIDR: "10.0.0.0/24", TargetAddr: "2001:db8::1"}); ok {
+		t.Error("mixed v4/v6 NAT must be rejected (ok=false)")
+	}
+	if fam, ok := natFamily(ResolvedNATRule{TargetAddr: "2001:db8::1"}); !ok || fam != "ip6" {
+		t.Errorf("v6 NAT: fam=%q ok=%v want ip6/true", fam, ok)
+	}
+	if fam, ok := natFamily(ResolvedNATRule{SrcCIDR: "10.0.0.0/24"}); !ok || fam != "ip" {
+		t.Errorf("v4 NAT: fam=%q ok=%v want ip/true", fam, ok)
+	}
+	if fam, ok := natFamily(ResolvedNATRule{}); !ok || fam != "ip" {
+		t.Errorf("addressless NAT: fam=%q ok=%v want ip/true (v4 default)", fam, ok)
+	}
+}
+
+// renderView ist ein gemischter v4/v6-View, der alle geänderten
+// Template-Zweige berührt.
+func renderView(t *testing.T) string {
+	t.Helper()
+	view := &View{
+		PeerIPv4: []string{"10.0.0.1"},
+		PeerIPv6: []string{"fd00::1"},
+		Legs: []RuleLeg{
+			{RuleID: 1, Action: "accept", L3: "ip", SrcAddrs: []string{"10.0.0.0/24"}, Service: ResolvedService{Proto: "tcp", PortStart: 443}},
+			{RuleID: 1, Action: "accept", L3: "ip6", SrcAddrs: []string{"fd00::/64"}, Service: ResolvedService{Proto: "tcp", PortStart: 443}},
+			{RuleID: 2, Action: "accept", Service: ResolvedService{Proto: "icmpv6"}}, // adresslos, agnostisch
+		},
+		NATRules: []ResolvedNATRule{
+			{ID: 5, Kind: "dnat", L3: "ip6", DstCIDR: "2001:db8::/64", Proto: "tcp", DPortStart: 80, TargetAddr: "fd00::2", TargetHost: "[fd00::2]", TargetPortStart: 8080},
+			{ID: 6, Kind: "snat", L3: "ip6", SrcCIDR: "fd00::/64", TargetAddr: "2001:db8::99"},
+			{ID: 7, Kind: "dnat", L3: "ip", DstCIDR: "1.2.3.4", Proto: "tcp", DPortStart: 80, TargetAddr: "10.0.0.5", TargetHost: "10.0.0.5", TargetPortStart: 80},
+		},
+		WGSiteMasq: []WGSiteMasqEntry{{Iface: "wg7", VPNNet: "fd00:99::/64", L3: "ip6"}},
+	}
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, view); err != nil {
+		t.Fatalf("template execute: %v", err)
+	}
+	return buf.String()
+}
+
+func TestTemplate_v6AndV4Render(t *testing.T) {
+	out := renderView(t)
+	mustContain := []string{
+		"ip saddr { 10.0.0.0/24 }",       // v4-Regel unverändert
+		"ip6 saddr { fd00::/64 }",        // v6-Regel
+		"ip6 daddr 2001:db8::/64",        // v6-DNAT-Match
+		"dnat to [fd00::2]:8080",         // v6-DNAT-Target geklammert
+		"dnat to 10.0.0.5:80",            // v4-DNAT-Target unverändert
+		"ip6 saddr fd00::/64 snat to 2001:db8::99",
+		`oifname "wg7" ip6 saddr fd00:99::/64 masquerade`,
+	}
+	for _, w := range mustContain {
+		if !strings.Contains(out, w) {
+			t.Errorf("output missing %q\n----\n%s", w, out)
+		}
+	}
+	// v6-Adressen dürfen NIEMALS in einem ip-saddr/daddr-Set landen.
+	if strings.Contains(out, "ip saddr { fd00") || strings.Contains(out, "ip daddr { fd00") ||
+		strings.Contains(out, "ip saddr { 2001") {
+		t.Errorf("v6 address leaked into IPv4 match\n----\n%s", out)
+	}
+}
+
+// TestTemplate_nftSyntax validiert das gerenderte Ruleset mit `nft -c -f`
+// (Check-Modus, kein Apply). Wird übersprungen, wenn nft nicht installiert
+// ist (z.B. CI ohne nft).
+func TestTemplate_nftSyntax(t *testing.T) {
+	nft, err := exec.LookPath("nft")
+	if err != nil {
+		t.Skip("nft binary not available — skipping syntax check")
+	}
+	out := renderView(t)
+	f, err := os.CreateTemp(t.TempDir(), "ruleset-*.nft")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := f.WriteString(out); err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+	// `nft -c` liest die Kernel-Ruleset-Cache via netlink → braucht root.
+	// Als nicht-root via sudo -n versuchen; klappt das nicht, skip statt fail
+	// (auf den Nodes rendert/prüft edgeguard ohnehin als root).
+	var cmd *exec.Cmd
+	if os.Geteuid() == 0 {
+		cmd = exec.Command(nft, "-c", "-f", f.Name())
+	} else {
+		cmd = exec.Command("sudo", "-n", nft, "-c", "-f", f.Name())
+	}
+	combined, err := cmd.CombinedOutput()
+	if err != nil {
+		msg := string(combined)
+		if strings.Contains(msg, "Operation not permitted") || strings.Contains(msg, "a password is required") || strings.Contains(msg, "may not run sudo") {
+			t.Skipf("nft -c needs root (no usable sudo): %s", strings.TrimSpace(msg))
+		}
+		t.Fatalf("nft -c -f rejected the generated ruleset: %v\n%s\n----\n%s", err, combined, out)
+	}
+}

internal/firewall/ruleset.nft.tpl

@@ -3,7 +3,8 @@
 # Source: internal/firewall/firewall.go.
 # Re-generate via `edgeguard-ctl render-config` or via API mutations.
 
-flush ruleset
+add table inet edgeguard
+flush table inet edgeguard
 
 table inet edgeguard {
     set peer_ipv4 {
@@ -49,13 +50,18 @@ table inet edgeguard {
         # Cluster-internal: peers reach edgeguard-api over mTLS on :8443
         tcp dport 8443 ip  saddr @peer_ipv4 accept
         tcp dport 8443 ip6 saddr @peer_ipv6 accept
+        # Cluster-internal: PG Logical Replication (:5432) + KeyDB Active-Active (:6379)
+        tcp dport 5432 ip  saddr @peer_ipv4 accept
+        tcp dport 5432 ip6 saddr @peer_ipv6 accept
+        tcp dport 6379 ip  saddr @peer_ipv4 accept
+        tcp dport 6379 ip6 saddr @peer_ipv6 accept
 
         # ── Service-Auto-Rules (DNS/Squid/WG/...) ──
         # Aus dem laufenden Service-State abgeleitet — Operator
         # editiert diese nicht. Wenn der Service entfernt/disabled
         # wird, ist die Rule beim nächsten Render weg.
 {{range .AutoRules}}
-        {{if .DstIP}}ip daddr {{.DstIP}} {{end}}{{.Proto}} dport {{.Port}} accept comment "auto: {{.Comment}}"
+        {{if .Iface}}iifname "{{.Iface}}" {{end}}{{if .DstIP}}ip daddr {{.DstIP}} {{end}}{{.Proto}} dport {{.Port}} accept comment "auto: {{.Comment}}"
 {{end}}
 
         # ── Operator-defined rules ──
@@ -65,7 +71,7 @@ table inet edgeguard {
                  die Comment-Zeile angehängt — sonst frisst nft die rule
                  als Teil des # Kommentars). */ -}}
         {{""}}
-        {{if .SrcIfaces}}iifname { {{join .SrcIfaces ", "}} } {{end}}{{if .DstIfaces}}oifname { {{join .DstIfaces ", "}} } {{end}}{{if .SrcAddrs}}ip saddr { {{join .SrcAddrs ", "}} } {{end}}{{if .DstAddrs}}ip daddr { {{join .DstAddrs ", "}} } {{end}}{{with .Service}}{{if and (or (eq .Proto "tcp") (eq .Proto "udp")) .PortStart}}{{.Proto}} dport {{.PortStart}}{{if and .PortEnd (ne .PortEnd .PortStart)}}-{{.PortEnd}}{{end}} {{else if eq .Proto "icmp"}}ip protocol icmp {{else if eq .Proto "icmpv6"}}ip6 nexthdr icmpv6 {{end}}{{end}}{{if .Log}}log prefix "edgeguard:{{.RuleID}} " group 0 {{end}}counter {{.Action}} comment "egid:{{.RuleID}}"
+        {{if .SrcIfaces}}iifname { {{join .SrcIfaces ", "}} } {{end}}{{if .DstIfaces}}oifname { {{join .DstIfaces ", "}} } {{end}}{{if .SrcAddrs}}{{.L3}} saddr { {{join .SrcAddrs ", "}} } {{end}}{{if .DstAddrs}}{{.L3}} daddr { {{join .DstAddrs ", "}} } {{end}}{{with .Service}}{{if and (or (eq .Proto "tcp") (eq .Proto "udp")) .PortStart}}{{.Proto}} dport {{.PortStart}}{{if and .PortEnd (ne .PortEnd .PortStart)}}-{{.PortEnd}}{{end}} {{else if eq .Proto "icmp"}}ip protocol icmp {{else if eq .Proto "icmpv6"}}ip6 nexthdr icmpv6 {{end}}{{end}}{{if .Log}}log prefix "edgeguard:{{.RuleID}} " group 0 {{end}}counter {{.Action}} comment "egid:{{.RuleID}}"
 {{end}}
 
         # ── DEFAULT-DROP LOGGING ───────────────────────────────────────
@@ -95,7 +101,7 @@ table inet edgeguard {
         # nach und erlauben new-state-Pakete von dort. Return-Pakete
         # gehen via ct state established schon durch.
 {{range .NATRules}}{{if or (eq .Kind "snat") (eq .Kind "masquerade")}}{{if .SrcCIDR}}
-        ip saddr {{.SrcCIDR}} ct state new accept comment "auto-forward for NAT rule {{.ID}}"
+        {{.L3}} saddr {{.SrcCIDR}} ct state new accept comment "auto-forward for NAT rule {{.ID}}"
 {{end}}{{end}}{{end}}
 
         # Auto-Forward für WireGuard-Server-Interfaces: Peer-to-Peer-
@@ -122,7 +128,7 @@ table inet edgeguard {
         {{""}}
         {{/* nft-Syntax: erst L3-match (ip saddr/daddr), DANN L4 (tcp/udp dport).
              Sonst quittiert der parser '... unexpected ip' an dieser Stelle. */}}
-        {{if .InIfaces}}iifname { {{join .InIfaces ", "}} } {{end}}{{if .SrcCIDR}}ip saddr {{.SrcCIDR}} {{end}}{{if .DstCIDR}}ip daddr {{.DstCIDR}} {{end}}{{if and .Proto (ne .Proto "any")}}{{.Proto}} {{else}}meta l4proto { tcp, udp } {{end}}{{if .DPortStart}}dport {{.DPortStart}}{{if and .DPortEnd (ne .DPortEnd .DPortStart)}}-{{.DPortEnd}}{{end}} {{end}}{{if .TargetAddr}}dnat to {{.TargetAddr}}{{if .TargetPortStart}}:{{.TargetPortStart}}{{if and .TargetPortEnd (ne .TargetPortEnd .TargetPortStart)}}-{{.TargetPortEnd}}{{end}}{{end}}{{end}}
+        {{if .InIfaces}}iifname { {{join .InIfaces ", "}} } {{end}}{{if .SrcCIDR}}{{.L3}} saddr {{.SrcCIDR}} {{end}}{{if .DstCIDR}}{{.L3}} daddr {{.DstCIDR}} {{end}}{{if and .Proto (ne .Proto "any")}}{{.Proto}} {{else}}meta l4proto { tcp, udp } {{end}}{{if .DPortStart}}dport {{.DPortStart}}{{if and .DPortEnd (ne .DPortEnd .DPortStart)}}-{{.DPortEnd}}{{end}} {{end}}{{if .TargetAddr}}dnat to {{.TargetHost}}{{if .TargetPortStart}}:{{.TargetPortStart}}{{if and .TargetPortEnd (ne .TargetPortEnd .TargetPortStart)}}-{{.TargetPortEnd}}{{end}}{{end}}{{end}}
 {{end}}{{end}}
     }
 
@@ -146,16 +152,16 @@ table inet edgeguard {
         # Masquerade schreibt die Source auf die lokale Tunnel-IP um; Return-Traffic
         # findet so den Weg zurück durch den Tunnel.
 {{range .WGSiteMasq}}
-        oifname "{{.Iface}}" ip saddr {{.VPNNet}} masquerade comment "auto: WireGuard site-to-site masquerade {{.Iface}}"
+        oifname "{{.Iface}}" {{.L3}} saddr {{.VPNNet}} masquerade comment "auto: WireGuard site-to-site masquerade {{.Iface}}"
 {{end}}
 {{range .NATRules}}{{if eq .Kind "snat"}}
         # NAT {{.ID}} (snat{{if .Comment}} — {{.Comment}}{{end}})
         {{""}}
-        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}ip saddr {{.SrcCIDR}} {{end}}{{if .TargetAddr}}snat to {{.TargetAddr}}{{end}}
+        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}{{.L3}} saddr {{.SrcCIDR}} {{end}}{{if .TargetAddr}}snat to {{.TargetAddr}}{{end}}
 {{end}}{{if eq .Kind "masquerade"}}
         # NAT {{.ID}} (masquerade{{if .Comment}} — {{.Comment}}{{end}})
         {{""}}
-        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}ip saddr {{.SrcCIDR}} {{end}}masquerade
+        {{if .OutIfaces}}oifname { {{join .OutIfaces ", "}} } {{end}}{{if .SrcCIDR}}{{.L3}} saddr {{.SrcCIDR}} {{end}}masquerade
 {{end}}{{end}}
     }
 }

internal/handlers/auth.go

@@ -60,15 +60,22 @@ func (h *AuthHandler) WithClusterTLS(store *clustertls.Store) *AuthHandler {
 	return h
 }
 
+const totpPendingCookie = "edgeguard_totp_pending"
+
 // Register mounts /auth/login + /logout (public) and /auth/me
 // (gated by requireAuth, passed in as a per-route middleware).
 func (h *AuthHandler) Register(rg *gin.RouterGroup, requireAuth gin.HandlerFunc) {
 	g := rg.Group("/auth")
 	g.POST("/login", h.Login)
 	g.POST("/logout", h.Logout)
+	g.POST("/totp-verify", h.TOTPVerify)
 	g.GET("/me", requireAuth, h.Me)
 	g.POST("/reset-password", h.ResetPassword)
 	g.POST("/change-password", requireAuth, h.ChangePassword)
+	// TOTP self-service (authenticated user manages own 2FA)
+	g.POST("/totp/setup", requireAuth, h.TOTPSetup)
+	g.POST("/totp/confirm", requireAuth, h.TOTPConfirm)
+	g.DELETE("/totp", requireAuth, h.TOTPDisable)
 }
 
 type loginRequest struct {
@@ -77,9 +84,10 @@ type loginRequest struct {
 }
 
 type loginResponse struct {
-	Actor     string    `json:"actor"`
-	Role      string    `json:"role"`
-	ExpiresAt time.Time `json:"expires_at"`
+	Actor        string    `json:"actor"`
+	Role         string    `json:"role"`
+	ExpiresAt    time.Time `json:"expires_at"`
+	TOTPRequired bool      `json:"totp_required,omitempty"`
 }
 
 func (h *AuthHandler) Login(c *gin.Context) {
@@ -101,12 +109,13 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	email := strings.TrimSpace(req.Email)
 	actor, role := "", "admin"
 	remote := c.ClientIP()
+	var totpEnabled bool
 
 	// 1. Try DB users table first.
 	if h.Users != nil {
-		u, hash, dbErr := h.Users.FindByEmail(c.Request.Context(), email)
+		ai, dbErr := h.Users.FindForAuth(c.Request.Context(), email)
 		if dbErr == nil {
-			if !u.Active {
+			if !ai.Active {
 				if h.Audit != nil {
 					_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
 						email, gin.H{"reason": "account_disabled", "remote": remote}, h.NodeID)
@@ -114,7 +123,7 @@ func (h *AuthHandler) Login(c *gin.Context) {
 				response.Unauthorized(c, errors.New("account_disabled"))
 				return
 			}
-			if !usersvc.VerifyPassword(hash, req.Password) {
+			if !usersvc.VerifyPassword(ai.PasswordHash, req.Password) {
 				if h.Audit != nil {
 					_ = h.Audit.Log(c.Request.Context(), email, "auth.login.failed",
 						email, gin.H{"reason": "invalid_credentials", "remote": remote}, h.NodeID)
@@ -122,9 +131,10 @@ func (h *AuthHandler) Login(c *gin.Context) {
 				response.Unauthorized(c, errors.New("invalid_credentials"))
 				return
 			}
-			actor = u.Email
-			role = u.Role
-			h.Users.RecordLogin(c.Request.Context(), u.ID)
+			actor = ai.Email
+			role = ai.Role
+			totpEnabled = ai.TOTPEnabled
+			h.Users.RecordLogin(c.Request.Context(), ai.ID)
 		}
 	}
 
@@ -133,16 +143,13 @@ func (h *AuthHandler) Login(c *gin.Context) {
 		if strings.EqualFold(st.AdminEmail, email) && st.VerifyAdminPassword(req.Password) {
 			actor = st.AdminEmail
 			role = "admin"
-			// Auto-migrate: insert the setup-store admin into the DB so it
-			// shows up in user management from this point on.
 			if h.Users != nil {
 				_, _ = h.Users.Upsert(c.Request.Context(), st.AdminEmail, req.Password, "admin", true)
 			}
 		}
 	}
 
-	// 3. Auth federation: cluster nodes forward failed auth to the primary
-	// via mTLS so users can log in with their primary credentials on any node.
+	// 3. Auth federation: cluster nodes forward failed auth to the primary.
 	if actor == "" && st.IsClusterNode && st.PrimaryFQDN != "" && h.ClusterTLS != nil {
 		if a, r, err := h.checkWithPrimary(c.Request.Context(), st.PrimaryFQDN, email, req.Password); err == nil {
 			actor = a
@@ -161,6 +168,21 @@ func (h *AuthHandler) Login(c *gin.Context) {
 		return
 	}
 
+	// TOTP gate: password OK but 2FA required → issue a short-lived pending
+	// cookie and tell the UI to show the TOTP input.
+	if totpEnabled {
+		pending, ptok, err := h.Signer.IssueWithRoleTTL(actor, "totp_pending", 2*time.Minute)
+		if err != nil {
+			response.Internal(c, err)
+			return
+		}
+		c.SetSameSite(http.SameSiteStrictMode)
+		c.SetCookie(totpPendingCookie, pending, int(2*time.Minute/time.Second), "/", "", true, true)
+		_ = ptok
+		response.OK(c, loginResponse{TOTPRequired: true})
+		return
+	}
+
 	raw, tok, err := h.Signer.IssueWithRole(actor, role)
 	if err != nil {
 		response.Internal(c, err)
@@ -179,6 +201,146 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	})
 }
 
+type totpVerifyRequest struct {
+	Code string `json:"code" binding:"required"`
+}
+
+// TOTPVerify completes the two-step login: verifies the TOTP code from the
+// pending cookie and, on success, issues a full session JWT.
+func (h *AuthHandler) TOTPVerify(c *gin.Context) {
+	var req totpVerifyRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	pendingRaw, err := c.Cookie(totpPendingCookie)
+	if err != nil || pendingRaw == "" {
+		response.Unauthorized(c, errors.New("no_pending_totp"))
+		return
+	}
+	ptok, err := h.Signer.Verify(pendingRaw)
+	if err != nil || ptok.Role != "totp_pending" {
+		response.Unauthorized(c, errors.New("invalid_pending_token"))
+		return
+	}
+
+	if h.Users == nil {
+		response.Internal(c, errors.New("users repo unavailable"))
+		return
+	}
+	ai, err := h.Users.FindForAuth(c.Request.Context(), ptok.Actor)
+	if err != nil || !ai.TOTPEnabled || ai.TOTPSecret == nil {
+		response.Unauthorized(c, errors.New("totp_not_configured"))
+		return
+	}
+	if !usersvc.VerifyTOTP(*ai.TOTPSecret, req.Code) {
+		if h.Audit != nil {
+			_ = h.Audit.Log(c.Request.Context(), ptok.Actor, "auth.totp.failed",
+				ptok.Actor, gin.H{"remote": c.ClientIP()}, h.NodeID)
+		}
+		response.Unauthorized(c, errors.New("invalid_totp_code"))
+		return
+	}
+
+	// Clear pending cookie, issue full session.
+	c.SetSameSite(http.SameSiteStrictMode)
+	c.SetCookie(totpPendingCookie, "", -1, "/", "", true, true)
+
+	raw, tok, err := h.Signer.IssueWithRole(ptok.Actor, ai.Role)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	setSessionCookie(c, raw, tok.Exp)
+
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), ptok.Actor, "auth.login.success",
+			ptok.Actor, gin.H{"role": ai.Role, "remote": c.ClientIP(), "totp": true}, h.NodeID)
+	}
+	response.OK(c, loginResponse{
+		Actor:     tok.Actor,
+		Role:      tok.Role,
+		ExpiresAt: time.Unix(tok.Exp, 0).UTC(),
+	})
+}
+
+// TOTPSetup generates a new TOTP secret for the authenticated user and returns
+// the provisioning URI (renders as QR code in the UI). Secret is not saved yet.
+func (h *AuthHandler) TOTPSetup(c *gin.Context) {
+	tok := CurrentToken(c)
+	if tok == nil {
+		response.Unauthorized(c, nil)
+		return
+	}
+	secret, uri, err := usersvc.GenerateTOTPSecret(tok.Actor)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"secret": secret, "uri": uri})
+}
+
+type totpConfirmRequest struct {
+	Secret string `json:"secret" binding:"required"`
+	Code   string `json:"code"   binding:"required"`
+}
+
+// TOTPConfirm verifies the code against the provisioned secret and, on success,
+// enables TOTP for the user.
+func (h *AuthHandler) TOTPConfirm(c *gin.Context) {
+	var req totpConfirmRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	tok := CurrentToken(c)
+	if tok == nil || h.Users == nil {
+		response.Unauthorized(c, nil)
+		return
+	}
+	u, _, err := h.Users.FindByEmail(c.Request.Context(), tok.Actor)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if err := h.Users.ConfirmTOTP(c.Request.Context(), u.ID, req.Secret, req.Code); err != nil {
+		if err.Error() == "invalid_totp_code" {
+			response.Err(c, http.StatusUnprocessableEntity, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), tok.Actor, "auth.totp.enabled",
+			tok.Actor, nil, h.NodeID)
+	}
+	response.OK(c, gin.H{"ok": true})
+}
+
+// TOTPDisable disables TOTP for the authenticated user.
+func (h *AuthHandler) TOTPDisable(c *gin.Context) {
+	tok := CurrentToken(c)
+	if tok == nil || h.Users == nil {
+		response.Unauthorized(c, nil)
+		return
+	}
+	u, _, err := h.Users.FindByEmail(c.Request.Context(), tok.Actor)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if err := h.Users.DisableTOTP(c.Request.Context(), u.ID); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), tok.Actor, "auth.totp.disabled",
+			tok.Actor, nil, h.NodeID)
+	}
+	response.OK(c, gin.H{"ok": true})
+}
+
 func (h *AuthHandler) Logout(c *gin.Context) {
 	clearSessionCookie(c)
 	response.OK(c, gin.H{"logged_out": true})

internal/handlers/cluster.go

@@ -7,6 +7,9 @@ import (
 	"encoding/pem"
 	"fmt"
 	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
 	"strings"
 	"time"
 
@@ -18,6 +21,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/cluster/jointoken"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
 )
 
 // ClusterHandler exposes cluster-state endpoints. /status ist die
@@ -31,6 +35,7 @@ type ClusterHandler struct {
 	Store      *cluster.Store
 	LocalID    string
 	Aggregator *aggregator.Aggregator
+	Version    string // laufende Binary-Version, für Rolling-Update-Koordination
 
 	// TLSStore + Tokens: optional, gesetzt bei Phase 3.4. Erlauben das
 	// Generieren von Join-Tokens und das Issue-Cert für joining Peers.
@@ -40,6 +45,11 @@ type ClusterHandler struct {
 	// PeerReloader: optional, gesetzt bei Phase 3.5. Nach Auto-Register
 	// triggert das den firewall-Render damit peer_ipv4 frisch ist.
 	PeerReloader PeerReloader
+
+	// Audit + NodeID: optional, gesetzt via WithAudit. Nötig für
+	// protokollierte, mutierende Aktionen wie den Replication-Repair.
+	Audit  *audit.Repo
+	NodeID string
 }
 
 func NewClusterHandler(store *cluster.Store, localID string) *ClusterHandler {
@@ -61,12 +71,27 @@ func (h *ClusterHandler) WithJoinFlow(store *clustertls.Store, tokens *jointoken
 	return h
 }
 
+// WithAudit setzt den Audit-Repo + NodeID für protokollierte Aktionen.
+func (h *ClusterHandler) WithAudit(a *audit.Repo, nodeID string) *ClusterHandler {
+	h.Audit = a
+	h.NodeID = nodeID
+	return h
+}
+
 func (h *ClusterHandler) Register(rg *gin.RouterGroup) {
 	g := rg.Group("/cluster")
 	g.GET("/nodes", h.ListNodes)
 	g.GET("/status", h.Status)
 	g.GET("/system/load", h.SystemLoad)
 	g.DELETE("/nodes/:id", h.DeleteNode)
+	g.GET("/vip-settings", h.GetVIPSettings)
+	g.PUT("/vip-settings", h.UpdateVIPSettings)
+	g.POST("/rolling-update", h.RollingUpdate)
+	g.GET("/rolling-update/status", h.RollingUpdateStatus)
+	g.POST("/repair-replication", h.RepairReplication)
+	g.GET("/repair-replication/status", h.RepairReplicationStatus)
+	g.GET("/vip-status", h.VIPStatus)
+	g.POST("/vip-test", h.VIPTest)
 	if h.TLSStore != nil {
 		g.GET("/cert-status", h.CertStatus)
 		g.POST("/renew-self", h.RenewSelf)
@@ -115,6 +140,85 @@ func (h *ClusterHandler) DeleteNode(c *gin.Context) {
 	response.NoContent(c)
 }
 
+// GetVIPSettings liest die cluster_settings-Singleton-Row (VIP/VRRP-Config).
+func (h *ClusterHandler) GetVIPSettings(c *gin.Context) {
+	if h.Store == nil {
+		response.NotFound(c, simpleError("cluster store not available"))
+		return
+	}
+	var cs vipSettingsRow
+	row := h.Store.Pool.QueryRow(c.Request.Context(), `
+		SELECT vip_address, vip_interface, vip_auth_pass, vrrp_router_id,
+		       hb_interface, hb_src_ip, hb_peer_ip, hb_router_id, gw_check_ip
+		FROM cluster_settings WHERE id = 1`)
+	if err := row.Scan(&cs.VIPAddress, &cs.VIPInterface, &cs.VIPAuthPass, &cs.VRRPRouterID,
+		&cs.HBInterface, &cs.HBSrcIP, &cs.HBPeerIP, &cs.HBRouterID, &cs.GWCheckIP); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, cs)
+}
+
+// UpdateVIPSettings speichert die VIP/VRRP-Konfiguration und triggert
+// einen Keepalived-Config-Render. Viewer-Schutz via RequireAdminForMutations-
+// Middleware auf der authed-Group — kein Extra-Check nötig.
+func (h *ClusterHandler) UpdateVIPSettings(c *gin.Context) {
+	var req vipSettingsRow
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if h.Store == nil {
+		response.NotFound(c, simpleError("cluster store not available"))
+		return
+	}
+	_, err := h.Store.Pool.Exec(c.Request.Context(), `
+		UPDATE cluster_settings
+		SET vip_address=$1, vip_interface=$2, vip_auth_pass=$3, vrrp_router_id=$4,
+		    hb_interface=$5, hb_src_ip=$6, hb_peer_ip=$7, hb_router_id=$8, gw_check_ip=$9,
+		    updated_at=NOW()
+		WHERE id=1`,
+		nullIfEmpty(req.VIPAddress), nullIfEmpty(req.VIPInterface),
+		nullIfEmpty(req.VIPAuthPass), req.VRRPRouterID,
+		nullIfEmpty(req.HBInterface), nullIfEmpty(req.HBSrcIP),
+		nullIfEmpty(req.HBPeerIP), req.HBRouterID, nullIfEmpty(req.GWCheckIP))
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: VIP settings updated", "vip", req.VIPAddress, "actor", actorOf(c))
+	// Keepalived-Config asynchron neu rendern
+	if h.PeerReloader != nil {
+		go func() {
+			rctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancel()
+			if err := h.PeerReloader(rctx); err != nil {
+				slog.Warn("cluster: keepalived render after VIP update failed", "error", err)
+			}
+		}()
+	}
+	response.NoContent(c)
+}
+
+type vipSettingsRow struct {
+	VIPAddress   *string `json:"vip_address"`
+	VIPInterface *string `json:"vip_interface"`
+	VIPAuthPass  *string `json:"vip_auth_pass"`
+	VRRPRouterID int     `json:"vrrp_router_id"`
+	HBInterface  *string `json:"hb_interface"`
+	HBSrcIP      *string `json:"hb_src_ip"`
+	HBPeerIP     *string `json:"hb_peer_ip"`
+	HBRouterID   int     `json:"hb_router_id"`
+	GWCheckIP    *string `json:"gw_check_ip"`
+}
+
+func nullIfEmpty(s *string) *string {
+	if s == nil || *s == "" {
+		return nil
+	}
+	return s
+}
+
 // RegisterPublic mountet die public (unauth) Endpoints — joining Peers
 // haben noch keine Session/Cert, deshalb läuft /issue-cert vor der
 // requireAuth-Middleware. Aufrufer muss diesen Group auf /api/v1 setzen
@@ -139,6 +243,15 @@ func (h *ClusterHandler) RegisterAgent(rg *gin.RouterGroup) {
 	g := rg.Group("/agent/cluster")
 	g.POST("/peers", h.AgentRegisterPeer)
 	g.GET("/identity", h.AgentIdentity)
+	g.GET("/pg-replication-info", h.AgentPGReplicationInfo)
+	g.GET("/master-key", h.AgentMasterKey)
+	g.GET("/version", h.AgentVersion)
+	g.POST("/trigger-update", h.AgentTriggerUpdate)
+	g.GET("/active-ips", h.AgentActiveIPs)
+	g.POST("/vip-cmd", h.AgentVIPCmd)
+	g.GET("/tls-certs", h.AgentTLSCerts)
+	g.POST("/repair-replication", h.AgentRepairReplication)
+	g.GET("/repair-replication/status", h.AgentRepairReplicationStatus)
 }
 
 // AgentIdentity gibt die eigene ha_nodes-Row zurück. Wird vom Primary
@@ -161,6 +274,59 @@ func (h *ClusterHandler) AgentIdentity(c *gin.Context) {
 	response.OK(c, node)
 }
 
+// AgentPGReplicationInfo gibt die Replication-Credentials für pg_basebackup
+// zurück. Nur über den mTLS-Agent-Listener erreichbar. Liest das Passwort
+// aus /var/lib/edgeguard/pg-replication-secret. Gibt 404 zurück wenn die
+// Datei fehlt (cluster-init-replication noch nicht ausgeführt).
+func (h *ClusterHandler) AgentPGReplicationInfo(c *gin.Context) {
+	const secretPath = "/var/lib/edgeguard/pg-replication-secret"
+	pass, err := readFileString(secretPath)
+	if err != nil {
+		response.NotFound(c, simpleError("pg-replication-secret nicht gefunden — cluster-init-replication auf dem Primary ausführen"))
+		return
+	}
+	// Host = eigene Public-IP aus ha_nodes (oder Fallback: FQDN)
+	host := ""
+	if h.Store != nil && h.LocalID != "" {
+		if node, err := h.Store.Get(c.Request.Context(), h.LocalID); err == nil {
+			if node.PublicIP != nil && *node.PublicIP != "" {
+				host = *node.PublicIP
+			}
+			if host == "" {
+				host = node.FQDN
+			}
+		}
+	}
+	response.OK(c, gin.H{
+		"host":     host,
+		"port":     5432,
+		"user":     "edgeguard_replicator",
+		"password": strings.TrimSpace(pass),
+	})
+}
+
+// AgentMasterKey gibt den Secrets-Master-Key zurück, damit cluster-setup-standby
+// ihn auf dem Secondary synchronisieren kann. Nur über den mTLS-Agent-Listener
+// erreichbar. Ohne gemeinsamen Master-Key können replizierte verschlüsselte
+// Felder (WireGuard private keys, PSKs) auf dem Secondary nicht entschlüsselt werden.
+func (h *ClusterHandler) AgentMasterKey(c *gin.Context) {
+	const keyPath = "/var/lib/edgeguard/.master_key"
+	data, err := os.ReadFile(keyPath)
+	if err != nil {
+		response.NotFound(c, simpleError("master key nicht gefunden"))
+		return
+	}
+	response.OK(c, gin.H{"key_hex": fmt.Sprintf("%x", data)})
+}
+
+func readFileString(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
 // PeerReloader: optionale Funktion die nach einem Auto-Register
 // Firewall + ggfs. andere Configs regeneriert (damit peer_ipv4-Set
 // frisch ist). Wird vom main.go gesetzt.
@@ -172,6 +338,12 @@ func (h *ClusterHandler) WithPeerReloader(r PeerReloader) *ClusterHandler {
 	return h
 }
 
+// WithVersion: setzt die laufende Binary-Version für Rolling-Update-Koordination.
+func (h *ClusterHandler) WithVersion(v string) *ClusterHandler {
+	h.Version = v
+	return h
+}
+
 func (h *ClusterHandler) ListNodes(c *gin.Context) {
 	nodes, err := h.Store.List(c.Request.Context())
 	if err != nil {
@@ -482,6 +654,14 @@ func (h *ClusterHandler) preRegisterJoiner(parent context.Context, clientIP, csr
 	slog.Info("cluster: joiner pre-registered, firewall updated", "fqdn", fqdn, "ip", clientIP)
 }
 
+// ptrStr dereferences a *string safely for comparison; nil → "".
+func ptrStr(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
 // cnFromCSR extracts the Subject Common Name from a PEM-encoded CSR.
 // Returns empty string on any parse error.
 func cnFromCSR(csrPEM string) string {
@@ -555,6 +735,60 @@ func (h *ClusterHandler) reconcileJoiningPeers(placeholders []models.HANode) {
 	}
 }
 
+// AgentVersion gibt die laufende Binary-Version zurück. Wird vom Rolling-
+// Update-Orchestrator gepollt um zu erkennen wann der Secondary die neue
+// Version hat.
+func (h *ClusterHandler) AgentVersion(c *gin.Context) {
+	response.OK(c, gin.H{"version": h.Version})
+}
+
+// AgentTriggerUpdate startet den Upgrade-Prozess auf diesem Node via
+// systemd-run (detached). Wird vom Primary via mTLS aufgerufen um den
+// Secondary zuerst zu aktualisieren (Rolling-Update). Pattern identisch
+// zu /system/upgrade — nutzt dieselbe Sudoers-Whitelist aus dem postinst.
+func (h *ClusterHandler) AgentTriggerUpdate(c *gin.Context) {
+	const scriptPath = "/var/lib/edgeguard/upgrade.sh"
+	const script = `#!/bin/bash
+set -e
+sleep 2
+export DEBIAN_FRONTEND=noninteractive
+dpkg --configure -a || true
+retry_apt() {
+    local attempt=0 max=3 wait_for=15
+    while [ $attempt -lt $max ]; do
+        attempt=$((attempt + 1))
+        apt-get update -qq || true
+        if apt-get install -y -qq -o Dpkg::Options::=--force-confold \
+            edgeguard-api edgeguard-ui edgeguard; then return 0; fi
+        [ $attempt -lt $max ] && sleep $wait_for && wait_for=$((wait_for * 2))
+    done
+    return 1
+}
+retry_apt
+echo "[upgrade] complete"
+rm -f /var/lib/edgeguard/upgrade.sh
+`
+	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	const unitName = "edgeguard-upgrade.service"
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", unitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+unitName,
+		"--description=EdgeGuard self-upgrade",
+		"--collect",
+		"bash", scriptPath)
+	if err := cmd.Run(); err != nil {
+		slog.Warn("cluster: AgentTriggerUpdate: systemd-run failed", "error", err)
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: rolling update triggered on this node by primary mTLS call",
+		"client", c.ClientIP())
+	c.JSON(http.StatusAccepted, gin.H{"status": "upgrading"})
+}
+
 var errInvalidJoinRequest = simpleError("missing token or csr")
 
 type simpleError string
@@ -623,14 +857,15 @@ func (h *ClusterHandler) RenewSelf(c *gin.Context) {
 // die wir wirklich brauchen — sonst kann ein joining Peer beliebige
 // ha_nodes-Felder überschreiben.
 type registerPeerRequest struct {
-	ID         string `json:"id"`           // Joiner's eigene node-id
-	Name       string `json:"name"`         // hostname
-	FQDN       string `json:"fqdn"`         // sollte mit Client-Cert-CN matchen
-	APIURL     string `json:"api_url"`      // https://<fqdn>
-	PublicIP   string `json:"public_ip"`    // optional
-	InternalIP string `json:"internal_ip"`  // mTLS-Listener-IP (für peer_ipv4-Set)
-	MgmtIP     string `json:"mgmt_ip"`      // optional
-	Version    string `json:"version"`
+	ID         string  `json:"id"`           // Joiner's eigene node-id
+	Name       string  `json:"name"`         // hostname
+	FQDN       string  `json:"fqdn"`         // sollte mit Client-Cert-CN matchen
+	APIURL     string  `json:"api_url"`      // https://<fqdn>
+	PublicIP   string  `json:"public_ip"`    // optional
+	InternalIP string  `json:"internal_ip"`  // mTLS-Listener-IP (für peer_ipv4-Set)
+	MgmtIP     string  `json:"mgmt_ip"`      // optional
+	Version    string  `json:"version"`
+	ConfigHash *string `json:"config_hash"`  // nil=absent (don't change), ""=no user config
 }
 
 // AgentRegisterPeer: vom Joiner nach issue-cert via mTLS aufgerufen.
@@ -693,23 +928,34 @@ func (h *ClusterHandler) AgentRegisterPeer(c *gin.Context) {
 		v := req.Version
 		n.Version = &v
 	}
+	if req.ConfigHash != nil {
+		n.ConfigHash = req.ConfigHash
+	}
 	// Placeholder zuerst löschen: ha_nodes hat UNIQUE(fqdn). Der INSERT
 	// in UpsertSelf verwendet ON CONFLICT(id) — greift NICHT bei fqdn-
 	// Konflikten. Ohne das Delete würde der INSERT mit "duplicate key on
 	// ha_nodes_fqdn_unique" scheitern und der Peer bliebe ewig "joining".
 	_ = h.Store.DeletePlaceholdersByFQDN(c.Request.Context(), req.FQDN, req.ID)
 
+	// Snapshot der aktuellen IPs VOR dem Upsert — zum Vergleich danach.
+	// Nur wenn sich public_ip oder internal_ip ändert, müssen wir nftables
+	// neu laden (@peer_ipv4-Set). Periodische Pushes vom Secondary (alle
+	// 5 min) ändern nur version/config_hash, nicht die IPs → kein Reset.
+	existing, _ := h.Store.Get(c.Request.Context(), req.ID)
+
 	out, err := h.Store.UpsertSelf(c.Request.Context(), n)
 	if err != nil {
 		response.Internal(c, err)
 		return
 	}
 
-	// Firewall-Reload damit peer_ipv4-Set die neue IP aufnimmt. Best-
-	// effort: Fehler loggen, Response weiter durchreichen — der Peer
-	// hat seine Identity erfolgreich registriert, Operator kann manuell
-	// nachrendern.
-	if h.PeerReloader != nil {
+	// Firewall-Reload nur wenn sich die Peer-IP geändert hat oder der
+	// Peer neu eingetragen wurde. Verhindert Counter-Reset alle 5 min
+	// durch den periodischen Secondary-Push (runPrimaryPush).
+	ipChanged := existing == nil ||
+		ptrStr(existing.PublicIP) != ptrStr(out.PublicIP) ||
+		ptrStr(existing.InternalIP) != ptrStr(out.InternalIP)
+	if ipChanged && h.PeerReloader != nil {
 		go func() {
 			rctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 			defer cancel()

internal/handlers/cluster_certsync.go

@@ -0,0 +1,118 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/aggregator"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const tlsCertDir = "/etc/edgeguard/tls"
+
+// AgentTLSCerts liefert alle .pem-Dateien aus /etc/edgeguard/tls/ als
+// Base64-Map. Wird vom Secondary via mTLS aufgerufen um Zertifikate
+// des Primary zu spiegeln.
+func (h *ClusterHandler) AgentTLSCerts(c *gin.Context) {
+	entries, err := os.ReadDir(tlsCertDir)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	certs := make(map[string]string, len(entries))
+	for _, e := range entries {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".pem") {
+			continue
+		}
+		data, err := os.ReadFile(filepath.Join(tlsCertDir, e.Name()))
+		if err != nil {
+			continue
+		}
+		certs[e.Name()] = base64.StdEncoding.EncodeToString(data)
+	}
+	response.OK(c, gin.H{"certs": certs})
+}
+
+// SyncTLSCertsFromPrimary holt alle TLS-Zertifikate vom Primary via mTLS
+// und schreibt geänderte Dateien nach /etc/edgeguard/tls/. Relädt HAProxy
+// wenn mindestens ein Zertifikat aktualisiert wurde.
+//
+// Läuft auf dem Secondary bei jedem runSecondaryConfigRender-Tick —
+// nicht hash-gated, da certbot-Renewals den config_hash nicht ändern.
+func SyncTLSCertsFromPrimary(ctx context.Context, pool *pgxpool.Pool, agg *aggregator.Aggregator, localID string) error {
+	if agg == nil {
+		return nil
+	}
+	// Primary-Peer aus ha_nodes ermitteln
+	rows, err := pool.Query(ctx,
+		`SELECT id, fqdn, api_url FROM ha_nodes WHERE id != $1 LIMIT 1`, localID)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	var primary *models.HANode
+	for rows.Next() {
+		n := &models.HANode{}
+		if err := rows.Scan(&n.ID, &n.FQDN, &n.APIURL); err != nil {
+			continue
+		}
+		primary = n
+	}
+	if primary == nil {
+		return nil // kein Peer → Single-Node
+	}
+
+	results := agg.FanOut(ctx, []models.HANode{*primary}, "/agent/cluster/tls-certs", localID)
+	if len(results) == 0 || !results[0].OK {
+		return nil // Primary nicht erreichbar — nächster Tick
+	}
+
+	var payload struct {
+		Certs map[string]string `json:"certs"`
+	}
+	if err := json.Unmarshal(results[0].Data, &payload); err != nil {
+		return err
+	}
+
+	if err := os.MkdirAll(tlsCertDir, 0o750); err != nil {
+		return err
+	}
+
+	changed := false
+	for name, b64 := range payload.Certs {
+		data, err := base64.StdEncoding.DecodeString(b64)
+		if err != nil {
+			slog.Warn("cert-sync: base64 decode failed", "file", name, "error", err)
+			continue
+		}
+		path := filepath.Join(tlsCertDir, name)
+		existing, readErr := os.ReadFile(path)
+		if readErr == nil && bytes.Equal(existing, data) {
+			continue // unverändert
+		}
+		if err := os.WriteFile(path, data, 0o640); err != nil {
+			slog.Warn("cert-sync: write failed", "file", name, "error", err)
+			continue
+		}
+		changed = true
+		slog.Info("cert-sync: updated", "file", name)
+	}
+
+	if changed {
+		if err := exec.Command("sudo", "-n", "/usr/bin/systemctl", "reload", "haproxy.service").Run(); err != nil {
+			slog.Warn("cert-sync: haproxy reload failed", "error", err)
+		}
+	}
+	return nil
+}

internal/handlers/cluster_repair.go

@@ -0,0 +1,389 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+// Replication-Repair ("Resync erzwingen") für das Config-Drift-Banner.
+//
+// Drift entsteht, wenn ein Peer einen anderen config_hash hat als dieser
+// Node — entweder weil die Logical-Replication-Subscription gestört ist
+// oder weil direkt in die DB des Subscribers geschrieben wurde. Die
+// Reparatur baut die Subscription neu auf und kopiert alle geteilten
+// Tabellen frisch vom Primary (einseitig: Primary = Source of Truth).
+//
+// Rollen-Erkennung: NICHT über ha_nodes.role/pg_role — die sind je Node
+// lokal und unzuverlässig (jede Node markiert sich selbst, pg_role bleibt
+// 'standalone' bis `promote`). Verlässlich ist die PUBLICATION: nur der
+// Primary hat `edgeguard_shared` (pg_publication ist für jeden DB-User
+// lesbar). Der Subscriber hat sie nicht → er ist das Resync-Ziel.
+//
+// Ablauf:
+//   - Klick auf dem Primary → Dispatch via mTLS an den Peer
+//     (POST /agent/cluster/repair-replication) mit der eigenen Adresse als
+//     primary_host; der Peer resynct von dort.
+//   - Klick direkt auf dem Subscriber → läuft lokal (Quelle = der Peer).
+//
+// Die eigentliche Arbeit läuft — analog zum Rolling-Update — in einer
+// transienten systemd-Unit, die `edgeguard-ctl cluster-setup-standby
+// <primary>` ausführt.
+
+const (
+	repairUnitName   = "edgeguard-repair-replication.service"
+	repairScriptPath = "/var/lib/edgeguard/repair-replication.sh"
+	repairAgentPath  = "/agent/cluster/repair-replication"
+	repairPubName    = "edgeguard_shared" // muss zu cmd/edgeguard-ctl egPubName passen
+)
+
+// validRepairHost erlaubt nur IPv4/IPv6/Hostnamen — der Wert landet in
+// einem Bash-Script das als root läuft, also strikt validieren.
+var validRepairHost = regexp.MustCompile(`^[A-Za-z0-9._:-]{1,253}$`)
+
+// repairDispatchBody ist der Body des Agent-Dispatch: der Primary teilt
+// dem Subscriber seine Adresse mit, von der resynct werden soll.
+type repairDispatchBody struct {
+	PrimaryHost string `json:"primary_host"`
+}
+
+// RepairReplication ist der UI-Endpoint. Hat dieser Node die Publication
+// (= Primary), wird der Resync an den Peer delegiert; sonst (Subscriber)
+// läuft er lokal mit dem Peer als Quelle.
+func (h *ClusterHandler) RepairReplication(c *gin.Context) {
+	if h.Store == nil {
+		response.Internal(c, errors.New("cluster store unavailable"))
+		return
+	}
+	ctx := c.Request.Context()
+	all, err := h.Store.List(ctx)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	local := findNode(all, h.LocalID)
+	peer := findOtherPeer(all, h.LocalID)
+	if peer == nil {
+		response.BadRequest(c, errors.New("kein Peer-Node im Cluster — nichts zu resyncen"))
+		return
+	}
+
+	if h.nodeHasPublication(ctx) {
+		// Primary → an den Subscriber-Peer delegieren, mit eigener Adresse.
+		if h.Aggregator == nil {
+			response.BadRequest(c, errors.New("kein mTLS-Aggregator verfügbar — Resync nicht delegierbar"))
+			return
+		}
+		primaryHost := pickPrimaryHost(local)
+		if primaryHost == "" || !validRepairHost.MatchString(primaryHost) {
+			response.BadRequest(c, errors.New("eigene Primary-Adresse (Mgmt/Internal/Public-IP/FQDN) fehlt oder ist ungültig"))
+			return
+		}
+		body, _ := json.Marshal(repairDispatchBody{PrimaryHost: primaryHost})
+		res := h.Aggregator.PostPeerWithBody(ctx, *peer, repairAgentPath, body)
+		if !res.OK {
+			response.Internal(c, fmt.Errorf("Resync auf %s anstoßen: %s", peer.FQDN, res.Err))
+			return
+		}
+		slog.Info("cluster: replication repair delegated", "target", peer.FQDN, "primary_host", primaryHost)
+		if h.Audit != nil {
+			_ = h.Audit.Log(ctx, actorOf(c), "cluster.repair-replication",
+				peer.FQDN, gin.H{"target": "peer", "peer": peer.FQDN, "primary_host": primaryHost}, h.NodeID)
+		}
+		response.Accepted(c, gin.H{"dispatched": true, "target": "peer", "peer_fqdn": peer.FQDN})
+		return
+	}
+
+	// Subscriber → lokal ausführen, Quelle = der Peer (Primary).
+	host := pickPrimaryHost(peer)
+	if err := h.startResync(ctx, host); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(ctx, actorOf(c), "cluster.repair-replication",
+			host, gin.H{"target": "local", "primary": host}, h.NodeID)
+	}
+	response.Accepted(c, gin.H{"dispatched": true, "target": "local", "primary": host})
+}
+
+// AgentRepairReplication wird vom Primary via mTLS auf dem Subscriber
+// aufgerufen und startet dort den lokalen Resync von primary_host.
+func (h *ClusterHandler) AgentRepairReplication(c *gin.Context) {
+	if h.Store == nil {
+		response.Internal(c, errors.New("cluster store unavailable"))
+		return
+	}
+	ctx := c.Request.Context()
+	var body repairDispatchBody
+	_ = c.ShouldBindJSON(&body) // best-effort; Fallback unten
+
+	host := strings.TrimSpace(body.PrimaryHost)
+	if host == "" {
+		// Fallback: Quelle aus ha_nodes (der andere Node).
+		if all, err := h.Store.List(ctx); err == nil {
+			host = pickPrimaryHost(findOtherPeer(all, h.LocalID))
+		}
+	}
+	if err := h.startResync(ctx, host); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	slog.Info("cluster: replication repair triggered by peer", "primary", host, "node", h.LocalID)
+	if h.Audit != nil {
+		_ = h.Audit.Log(ctx, "cluster-peer", "cluster.repair-replication",
+			host, gin.H{"target": "local", "primary": host, "via": "agent"}, h.NodeID)
+	}
+	response.Accepted(c, gin.H{"dispatched": true, "primary": host})
+}
+
+// startResync schreibt das Repair-Script und startet die transiente
+// systemd-Unit. Safety-Guard: läuft NIE auf dem Publication-Primary.
+func (h *ClusterHandler) startResync(ctx context.Context, primaryHost string) error {
+	primaryHost = strings.TrimSpace(primaryHost)
+	if primaryHost == "" {
+		return errors.New("keine Primary-Adresse für den Resync ermittelbar")
+	}
+	if !validRepairHost.MatchString(primaryHost) {
+		return fmt.Errorf("ungültige Primary-Adresse: %q", primaryHost)
+	}
+	// Niemals auf dem Primary (Publication-Quelle) resyncen — würde die
+	// eigene Config mit sich selbst überschreiben bzw. ist sinnlos.
+	if h.nodeHasPublication(ctx) {
+		return errors.New("dieser Node ist der Publication-Primary — Resync läuft nur auf einem Subscriber")
+	}
+	if st := repairUnitState(); st == "activating" || st == "active" {
+		return errors.New("Resync läuft bereits")
+	}
+
+	script := fmt.Sprintf(`#!/bin/bash
+set -uo pipefail
+echo "[repair] resync der Logical-Replication-Subscription von Primary %[1]s"
+/usr/bin/edgeguard-ctl cluster-setup-standby %[1]s
+rc=$?
+if [ "$rc" -ne 0 ]; then
+    echo "[repair] cluster-setup-standby fehlgeschlagen (rc=$rc)"
+    exit "$rc"
+fi
+echo "[repair] abgeschlossen — config_hash wird beim nächsten Cluster-Status neu berechnet"
+rm -f %[2]s
+`, primaryHost, repairScriptPath)
+
+	if err := os.WriteFile(repairScriptPath, []byte(script), 0o755); err != nil {
+		return fmt.Errorf("write repair script: %w", err)
+	}
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", repairUnitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+repairUnitName,
+		"--description=EdgeGuard replication repair",
+		"--collect",
+		"bash", repairScriptPath)
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("systemd-run failed: %w", err)
+	}
+	slog.Info("cluster: replication repair dispatched (local)", "primary", primaryHost, "node", h.LocalID)
+	return nil
+}
+
+// nodeHasPublication prüft, ob dieser Node die Replikations-Publication
+// besitzt — das verlässliche Primary-Signal. pg_publication ist für jeden
+// DB-User lesbar (anders als pg_subscription).
+func (h *ClusterHandler) nodeHasPublication(ctx context.Context) bool {
+	if h.Store == nil || h.Store.Pool == nil {
+		return false
+	}
+	cctx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+	var exists bool
+	if err := h.Store.Pool.QueryRow(cctx,
+		`SELECT EXISTS(SELECT 1 FROM pg_publication WHERE pubname = $1)`, repairPubName,
+	).Scan(&exists); err != nil {
+		return false
+	}
+	return exists
+}
+
+// repairStatusResponse spiegelt den Zustand der transienten Repair-Unit.
+type repairStatusResponse struct {
+	Phase      string   `json:"phase"` // idle | running | success | failed
+	State      string   `json:"state"`
+	Result     string   `json:"result"`
+	ExitCode   int      `json:"exit_code"`
+	StartedAt  string   `json:"started_at,omitempty"`
+	FinishedAt string   `json:"finished_at,omitempty"`
+	Log        []string `json:"log"`
+}
+
+// RepairReplicationStatus liest den Job-Zustand. Auf dem Primary wird der
+// Status vom Subscriber-Peer geholt (dort läuft der Job); sonst lokal.
+func (h *ClusterHandler) RepairReplicationStatus(c *gin.Context) {
+	ctx := c.Request.Context()
+	if h.Store != nil && h.nodeHasPublication(ctx) && h.Aggregator != nil {
+		if all, err := h.Store.List(ctx); err == nil {
+			if peer := findOtherPeer(all, h.LocalID); peer != nil {
+				results := h.Aggregator.FanOut(ctx,
+					[]models.HANode{*peer}, repairAgentPath+"/status", h.LocalID)
+				if len(results) == 1 && results[0].OK && len(results[0].Data) > 0 {
+					c.Data(200, "application/json", wrapEnvelope(results[0].Data))
+					return
+				}
+				// Peer nicht erreichbar → idle statt Fehler, damit das
+				// UI-Polling nicht hart abbricht.
+				response.OK(c, repairStatusResponse{Phase: "idle", Log: []string{}})
+				return
+			}
+		}
+	}
+	response.OK(c, localRepairStatus())
+}
+
+// AgentRepairReplicationStatus liefert den lokalen Job-Zustand an den
+// abfragenden Primary.
+func (h *ClusterHandler) AgentRepairReplicationStatus(c *gin.Context) {
+	response.OK(c, localRepairStatus())
+}
+
+// wrapEnvelope verpackt eine bereits entpackte data-Payload wieder in die
+// Standard-Envelope, damit das UI (isEnvelope) sie konsistent liest.
+func wrapEnvelope(data []byte) []byte {
+	out := []byte(`{"data":`)
+	out = append(out, data...)
+	out = append(out, []byte(`,"error":null,"message":"ok"}`)...)
+	return out
+}
+
+// localRepairStatus liest den Zustand der lokalen Repair-Unit aus systemd
+// (analog UpgradeStatus). Quelle der Wahrheit für Job-Ende ist die Unit.
+func localRepairStatus() repairStatusResponse {
+	out := repairStatusResponse{Phase: "idle", Log: []string{}}
+
+	if data, err := exec.Command("systemctl", "show", repairUnitName,
+		"--no-page",
+		"-p", "ActiveState",
+		"-p", "Result",
+		"-p", "ExecMainStatus",
+		"-p", "ExecMainStartTimestamp",
+		"-p", "ExecMainExitTimestamp",
+	).CombinedOutput(); err == nil {
+		for _, line := range strings.Split(string(data), "\n") {
+			kv := strings.SplitN(strings.TrimSpace(line), "=", 2)
+			if len(kv) != 2 {
+				continue
+			}
+			switch kv[0] {
+			case "ActiveState":
+				out.State = kv[1]
+			case "Result":
+				out.Result = kv[1]
+			case "ExecMainStatus":
+				out.ExitCode, _ = strconv.Atoi(kv[1])
+			case "ExecMainStartTimestamp":
+				if t, err := time.Parse("Mon 2006-01-02 15:04:05 MST", kv[1]); err == nil {
+					out.StartedAt = t.UTC().Format(time.RFC3339)
+				}
+			case "ExecMainExitTimestamp":
+				if t, err := time.Parse("Mon 2006-01-02 15:04:05 MST", kv[1]); err == nil {
+					out.FinishedAt = t.UTC().Format(time.RFC3339)
+				}
+			}
+		}
+	}
+
+	switch out.State {
+	case "activating", "active", "deactivating":
+		out.Phase = "running"
+	case "failed":
+		out.Phase = "failed"
+	case "inactive":
+		if out.Result == "success" && out.ExitCode == 0 && out.FinishedAt != "" {
+			out.Phase = "success"
+		} else if out.Result != "" && out.Result != "success" {
+			out.Phase = "failed"
+		}
+	}
+
+	if data, err := exec.Command("journalctl",
+		"-u", repairUnitName,
+		"--no-pager", "-n", "100", "-o", "cat",
+	).CombinedOutput(); err == nil {
+		lines := strings.Split(strings.TrimRight(string(data), "\n"), "\n")
+		if !(len(lines) == 1 && (lines[0] == "" || strings.HasPrefix(lines[0], "-- No entries"))) {
+			out.Log = lines
+		}
+	}
+	return out
+}
+
+// findNode liefert die ha_nodes-Row mit der gegebenen ID.
+func findNode(nodes []models.HANode, id string) *models.HANode {
+	for i := range nodes {
+		if nodes[i].ID == id {
+			return &nodes[i]
+		}
+	}
+	return nil
+}
+
+// findOtherPeer liefert den (einen) anderen Node im 2-Node-Cluster.
+// Bevorzugt einen online erreichbaren Peer.
+func findOtherPeer(nodes []models.HANode, localID string) *models.HANode {
+	var fallback *models.HANode
+	for i := range nodes {
+		n := &nodes[i]
+		if n.ID == localID {
+			continue
+		}
+		if n.Status == "online" {
+			return n
+		}
+		if fallback == nil {
+			fallback = n
+		}
+	}
+	return fallback
+}
+
+// pickPrimaryHost wählt die beste erreichbare Adresse eines Node:
+// Mgmt-IP → Internal-IP → Public-IP → FQDN. Strippt eine etwaige
+// CIDR-Maske (inet-Spalten können "10.0.0.5/32" liefern).
+func pickPrimaryHost(n *models.HANode) string {
+	if n == nil {
+		return ""
+	}
+	for _, cand := range []*string{n.MgmtIP, n.InternalIP, n.PublicIP} {
+		if cand != nil {
+			if h := strings.TrimSpace(strings.SplitN(*cand, "/", 2)[0]); h != "" {
+				return h
+			}
+		}
+	}
+	return strings.TrimSpace(n.FQDN)
+}
+
+// repairUnitState gibt den ActiveState der Repair-Unit zurück ("" wenn
+// unbekannt). Für den Doppelstart-Schutz.
+func repairUnitState() string {
+	out, err := exec.Command("systemctl", "show", repairUnitName, "--no-page", "-p", "ActiveState").CombinedOutput()
+	if err != nil {
+		return ""
+	}
+	for _, line := range strings.Split(string(out), "\n") {
+		if kv := strings.SplitN(strings.TrimSpace(line), "=", 2); len(kv) == 2 && kv[0] == "ActiveState" {
+			return kv[1]
+		}
+	}
+	return ""
+}

internal/handlers/cluster_rollingupdate.go

@@ -0,0 +1,258 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/exec"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const rollingUpdateStateFile = "/var/lib/edgeguard/rolling-update-state.json"
+
+const (
+	phaseIdle              = "idle"
+	phaseUpdatingSecondary = "updating-secondary"
+	phaseWaitingSecondary  = "waiting-secondary"
+	phaseUpdatingPrimary   = "updating-primary"
+	phaseDone              = "done"
+	phaseFailed            = "failed"
+)
+
+// FinishRollingUpdateIfPending wird beim API-Start aufgerufen. Wenn die
+// State-Datei "updating-primary" enthält, bedeutet das dass der Primary
+// gerade erfolgreich neugestartet ist → Update abgeschlossen → "done" schreiben.
+func FinishRollingUpdateIfPending() {
+	st := readRollingUpdateState()
+	if st.Phase == phaseUpdatingPrimary {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseDone,
+			SecondaryID:   st.SecondaryID,
+			SecondaryFQDN: st.SecondaryFQDN,
+		})
+	}
+}
+
+// RollingUpdateState hält den Fortschritt des Rolling-Updates.
+// Persistiert in rollingUpdateStateFile damit der Status über
+// einen kurzen API-Neustart hinaus lesbar bleibt.
+type RollingUpdateState struct {
+	Phase         string    `json:"phase"`
+	SecondaryID   string    `json:"secondary_id,omitempty"`
+	SecondaryFQDN string    `json:"secondary_fqdn,omitempty"`
+	StartedAt     time.Time `json:"started_at,omitempty"`
+	UpdatedAt     time.Time `json:"updated_at"`
+	Error         string    `json:"error,omitempty"`
+}
+
+func readRollingUpdateState() RollingUpdateState {
+	data, err := os.ReadFile(rollingUpdateStateFile)
+	if err != nil {
+		return RollingUpdateState{Phase: phaseIdle, UpdatedAt: time.Now()}
+	}
+	var s RollingUpdateState
+	if err := json.Unmarshal(data, &s); err != nil {
+		return RollingUpdateState{Phase: phaseIdle, UpdatedAt: time.Now()}
+	}
+	return s
+}
+
+func writeRollingUpdateState(s RollingUpdateState) {
+	s.UpdatedAt = time.Now()
+	data, err := json.Marshal(s)
+	if err != nil {
+		slog.Warn("rolling-update: failed to marshal state", "error", err)
+		return
+	}
+	if err := os.WriteFile(rollingUpdateStateFile, data, 0o600); err != nil {
+		slog.Warn("rolling-update: failed to write state file", "error", err)
+	}
+}
+
+// RollingUpdate startet den Rolling-Update-Prozess:
+// 1. Secondary aktualisieren (via mTLS /agent/cluster/trigger-update)
+// 2. Warten bis Secondary neue Version meldet
+// 3. Primary (dieser Node) aktualisieren (wie /system/upgrade)
+//
+// Kein Cluster vorhanden → 409 zurück damit der Client auf /system/upgrade
+// ausweichen kann. Wenn bereits ein Rolling-Update läuft → aktuellen State.
+func (h *ClusterHandler) RollingUpdate(c *gin.Context) {
+	if h.Aggregator == nil || h.Store == nil {
+		c.JSON(http.StatusConflict, gin.H{"error": "no cluster — use /system/upgrade"})
+		return
+	}
+
+	st := readRollingUpdateState()
+	if st.Phase != phaseIdle && st.Phase != phaseFailed && st.Phase != phaseDone {
+		response.OK(c, st)
+		return
+	}
+
+	nodes, err := h.Store.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	var secondary *models.HANode
+	for i := range nodes {
+		if nodes[i].ID != h.LocalID {
+			secondary = &nodes[i]
+			break
+		}
+	}
+	if secondary == nil {
+		c.JSON(http.StatusConflict, gin.H{"error": "no peer node — use /system/upgrade"})
+		return
+	}
+
+	newState := RollingUpdateState{
+		Phase:         phaseUpdatingSecondary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+		StartedAt:     time.Now(),
+	}
+	writeRollingUpdateState(newState)
+	slog.Info("rolling-update: started", "secondary", secondary.FQDN)
+
+	go h.runRollingUpdate(secondary)
+
+	c.JSON(http.StatusAccepted, newState)
+}
+
+// RollingUpdateStatus gibt den aktuellen Rolling-Update-State zurück.
+// Bei phase == "done" wird nach Auslieferung sofort auf idle zurückgesetzt
+// damit der nächste Pageload keinen Stale-done vorfindet.
+func (h *ClusterHandler) RollingUpdateStatus(c *gin.Context) {
+	st := readRollingUpdateState()
+	response.OK(c, st)
+	if st.Phase == phaseDone {
+		writeRollingUpdateState(RollingUpdateState{Phase: phaseIdle})
+	}
+}
+
+func (h *ClusterHandler) runRollingUpdate(secondary *models.HANode) {
+	ctx := context.Background()
+
+	// 1. Secondary triggern
+	slog.Info("rolling-update: posting trigger-update to secondary", "fqdn", secondary.FQDN)
+	result := h.Aggregator.PostPeer(ctx, *secondary, "/agent/cluster/trigger-update")
+	if !result.OK {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "trigger-update failed: " + result.Err,
+		})
+		slog.Warn("rolling-update: secondary trigger failed", "error", result.Err)
+		return
+	}
+
+	// 2. Secondary-Version pollen — der Secondary restartet nach dem
+	//    Upgrade, danach zeigt /agent/cluster/version eine neue Version.
+	writeRollingUpdateState(RollingUpdateState{
+		Phase:         phaseWaitingSecondary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+	})
+	slog.Info("rolling-update: waiting for secondary version flip")
+
+	// Kurze Wartezeit damit apt auf dem Secondary erst losläuft
+	time.Sleep(20 * time.Second)
+
+	deadline := time.Now().Add(10 * time.Minute)
+	versionFlipped := false
+	for time.Now().Before(deadline) {
+		results := h.Aggregator.FanOut(ctx, []models.HANode{*secondary}, "/agent/cluster/version", h.LocalID)
+		if len(results) > 0 && results[0].OK {
+			var ver struct {
+				Version string `json:"version"`
+			}
+			if err := json.Unmarshal(results[0].Data, &ver); err == nil {
+				slog.Info("rolling-update: secondary version", "version", ver.Version, "primary", h.Version)
+				if ver.Version != h.Version {
+					versionFlipped = true
+					break
+				}
+			}
+		}
+		time.Sleep(10 * time.Second)
+	}
+
+	if !versionFlipped {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "timeout (10 min) waiting for secondary version flip",
+		})
+		slog.Warn("rolling-update: secondary version flip timeout")
+		return
+	}
+
+	// 3. Primary (uns selbst) aktualisieren — identisch zu /system/upgrade
+	writeRollingUpdateState(RollingUpdateState{
+		Phase:         phaseUpdatingPrimary,
+		SecondaryID:   secondary.ID,
+		SecondaryFQDN: secondary.FQDN,
+	})
+	slog.Info("rolling-update: triggering primary self-upgrade")
+
+	const scriptPath = "/var/lib/edgeguard/upgrade.sh"
+	const script = `#!/bin/bash
+set -e
+sleep 2
+export DEBIAN_FRONTEND=noninteractive
+dpkg --configure -a || true
+retry_apt() {
+    local attempt=0 max=3 wait_for=15
+    while [ $attempt -lt $max ]; do
+        attempt=$((attempt + 1))
+        apt-get update -qq || true
+        if apt-get install -y -qq -o Dpkg::Options::=--force-confold \
+            edgeguard-api edgeguard-ui edgeguard; then return 0; fi
+        [ $attempt -lt $max ] && sleep $wait_for && wait_for=$((wait_for * 2))
+    done
+    return 1
+}
+retry_apt
+echo "[upgrade] complete"
+rm -f /var/lib/edgeguard/upgrade.sh
+`
+	if err := os.WriteFile(scriptPath, []byte(script), 0o755); err != nil {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "write upgrade script: " + err.Error(),
+		})
+		return
+	}
+
+	const unitName = "edgeguard-upgrade.service"
+	_ = exec.Command("sudo", "-n", "/usr/bin/systemctl", "reset-failed", unitName).Run()
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemd-run",
+		"--unit="+unitName,
+		"--description=EdgeGuard self-upgrade",
+		"--collect",
+		"bash", scriptPath)
+	if err := cmd.Run(); err != nil {
+		writeRollingUpdateState(RollingUpdateState{
+			Phase:         phaseFailed,
+			SecondaryID:   secondary.ID,
+			SecondaryFQDN: secondary.FQDN,
+			Error:         "systemd-run failed: " + err.Error(),
+		})
+		slog.Warn("rolling-update: primary systemd-run failed", "error", err)
+		return
+	}
+	// State bleibt "updating-primary" — der Primary restartet gleich.
+	// UI erkennt Version-Flip via /system/health und schließt den Flow.
+	slog.Info("rolling-update: primary upgrade dispatched, process will restart")
+}

internal/handlers/cluster_viptest.go

@@ -0,0 +1,319 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"os/exec"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+// vipInfo enthält die für einen VIP-Schwenk notwendigen Daten.
+type vipInfo struct {
+	ID      int64  `json:"id"`
+	Address string `json:"address"`
+	Prefix  int    `json:"prefix"`
+	Device  string `json:"device"`
+}
+
+// VIPStatusEntry kombiniert einen VIP mit den Nodes die ihn gerade halten.
+type VIPStatusEntry struct {
+	VIP      vipInfo  `json:"vip"`
+	ActiveOn []string `json:"active_on"` // FQDNs der Nodes mit diesem VIP
+}
+
+// AgentActiveIPs gibt alle aktiven IPv4-Adressen dieses Nodes zurück.
+// Wird vom Primary genutzt um zu prüfen welcher Node welchen VIP hält.
+func (h *ClusterHandler) AgentActiveIPs(c *gin.Context) {
+	ips, err := localActiveIPs()
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"ips": ips})
+}
+
+// vipCmdRequest ist der Body für den AgentVIPCmd-Endpoint.
+type vipCmdRequest struct {
+	Action  string `json:"action"`  // "add" | "del"
+	Address string `json:"address"` // z.B. "10.0.5.1"
+	Prefix  int    `json:"prefix"`  // z.B. 24
+	Device  string `json:"device"`  // z.B. "vlan100"
+}
+
+// AgentVIPCmd führt `ip addr add/del` auf diesem Node aus.
+// Wird vom Primary via mTLS für VIP-Schwenk-Tests aufgerufen.
+func (h *ClusterHandler) AgentVIPCmd(c *gin.Context) {
+	var req vipCmdRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.Action != "add" && req.Action != "del" {
+		response.BadRequest(c, simpleError("action must be 'add' or 'del'"))
+		return
+	}
+	if req.Address == "" || req.Device == "" || req.Prefix <= 0 || req.Prefix > 128 {
+		response.BadRequest(c, simpleError("address, device, prefix required"))
+		return
+	}
+	if err := runVIPCmd(req.Action, req.Address, req.Prefix, req.Device); err != nil {
+		slog.Warn("cluster: agent vip-cmd failed",
+			"action", req.Action, "addr", req.Address, "dev", req.Device, "error", err)
+		response.Internal(c, err)
+		return
+	}
+	slog.Info("cluster: agent vip-cmd ok",
+		"action", req.Action, "addr", req.Address, "prefix", req.Prefix,
+		"dev", req.Device, "caller", c.ClientIP())
+	response.OK(c, gin.H{"ok": true})
+}
+
+// VIPStatus liest alle VIPs (is_vip=true) aus der DB und fragt alle Nodes
+// welche davon sie gerade aktiv haben. Nur sinnvoll im Cluster-Modus.
+func (h *ClusterHandler) VIPStatus(c *gin.Context) {
+	vips, err := loadVIPs(c.Request.Context(), h.Store.Pool)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	nodeIPs := h.collectActiveIPs(c.Request.Context())
+	result := make([]VIPStatusEntry, 0, len(vips))
+	for _, v := range vips {
+		entry := VIPStatusEntry{VIP: v}
+		for fqdn, ips := range nodeIPs {
+			for _, ip := range ips {
+				if ip == v.Address {
+					entry.ActiveOn = append(entry.ActiveOn, fqdn)
+					break
+				}
+			}
+		}
+		result = append(result, entry)
+	}
+	response.OK(c, gin.H{"vips": result})
+}
+
+// vipTestRequest steuert einen VIP-Schwenk.
+type vipTestRequest struct {
+	IPAddressID int64  `json:"ip_address_id"`
+	Action      string `json:"action"` // "to_secondary" | "restore"
+}
+
+// vipTestStep beschreibt einen Schritt des Schwenk-Prozesses.
+type vipTestStep struct {
+	Step    string `json:"step"`
+	OK      bool   `json:"ok"`
+	Message string `json:"message,omitempty"`
+}
+
+// VIPTest schwenkt einen VIP vom Primary auf den Secondary ("to_secondary")
+// oder zurück ("restore"). Nur vom Primary aufzurufen.
+func (h *ClusterHandler) VIPTest(c *gin.Context) {
+	var req vipTestRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.Action != "to_secondary" && req.Action != "restore" {
+		response.BadRequest(c, simpleError("action must be 'to_secondary' or 'restore'"))
+		return
+	}
+
+	vips, err := loadVIPs(c.Request.Context(), h.Store.Pool)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	var target *vipInfo
+	for i := range vips {
+		if vips[i].ID == req.IPAddressID {
+			target = &vips[i]
+			break
+		}
+	}
+	if target == nil {
+		response.NotFound(c, simpleError("VIP not found or not marked as VIP"))
+		return
+	}
+
+	all, err := h.Store.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	var peer *models.HANode
+	for i := range all {
+		if all[i].ID != h.LocalID {
+			peer = &all[i]
+			break
+		}
+	}
+	if peer == nil {
+		response.BadRequest(c, simpleError("kein Secondary-Peer gefunden"))
+		return
+	}
+
+	var steps []vipTestStep
+	addrPfx := fmt.Sprintf("%s/%d", target.Address, target.Prefix)
+
+	if req.Action == "to_secondary" {
+		// 1. VIP auf Secondary via mTLS hinzufügen
+		steps = append(steps, h.peerVIPCmd(c.Request.Context(), *peer, target, "add",
+			fmt.Sprintf("add %s dev %s auf %s", addrPfx, target.Device, peer.FQDN)))
+		// 2. VIP vom Primary entfernen (nur wenn Secondary-Add erfolgreich)
+		if steps[0].OK {
+			steps = append(steps, localVIPStep(target, "del",
+				fmt.Sprintf("del %s dev %s lokal", addrPfx, target.Device)))
+		}
+	} else {
+		// 1. VIP auf Primary zurückholen
+		steps = append(steps, localVIPStep(target, "add",
+			fmt.Sprintf("add %s dev %s lokal", addrPfx, target.Device)))
+		// 2. VIP auf Secondary entfernen
+		steps = append(steps, h.peerVIPCmd(c.Request.Context(), *peer, target, "del",
+			fmt.Sprintf("del %s dev %s auf %s", addrPfx, target.Device, peer.FQDN)))
+	}
+
+	slog.Info("cluster: vip-test", "action", req.Action, "vip", target.Address,
+		"dev", target.Device, "peer", peer.FQDN, "actor", actorOf(c))
+	response.OK(c, gin.H{"steps": steps})
+}
+
+// ── Hilfsfunktionen ───────────────────────────────────────────────────────
+
+func loadVIPs(ctx context.Context, pool *pgxpool.Pool) ([]vipInfo, error) {
+	rows, err := pool.Query(ctx, `
+		SELECT ia.id, ia.address, ia.prefix, ni.name
+		FROM ip_addresses ia
+		JOIN network_interfaces ni ON ni.id = ia.interface_id
+		WHERE ia.is_vip = true AND ia.active = true
+		ORDER BY ni.name, ia.address`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []vipInfo
+	for rows.Next() {
+		var v vipInfo
+		if err := rows.Scan(&v.ID, &v.Address, &v.Prefix, &v.Device); err != nil {
+			return nil, err
+		}
+		out = append(out, v)
+	}
+	return out, rows.Err()
+}
+
+// collectActiveIPs fragt alle Cluster-Nodes (lokal + Peers via mTLS) nach
+// ihren aktiven IPv4-Adressen und gibt eine Map[fqdn][]ip zurück.
+func (h *ClusterHandler) collectActiveIPs(ctx context.Context) map[string][]string {
+	result := make(map[string][]string)
+	if h.Store == nil {
+		return result
+	}
+	all, err := h.Store.List(ctx)
+	if err != nil {
+		return result
+	}
+	// Lokaler Node
+	if ips, err := localActiveIPs(); err == nil {
+		for _, n := range all {
+			if n.ID == h.LocalID {
+				result[n.FQDN] = ips
+				break
+			}
+		}
+	}
+	// Peers via mTLS-Aggregator
+	if h.Aggregator != nil {
+		var peers []models.HANode
+		for _, n := range all {
+			if n.ID != h.LocalID {
+				peers = append(peers, n)
+			}
+		}
+		if len(peers) > 0 {
+			peerResults := h.Aggregator.FanOut(ctx, peers, "/agent/cluster/active-ips", h.LocalID)
+			for _, pr := range peerResults {
+				if !pr.OK || len(pr.Data) == 0 {
+					continue
+				}
+				var payload struct {
+					IPs []string `json:"ips"`
+				}
+				if err := json.Unmarshal(pr.Data, &payload); err == nil {
+					result[pr.FQDN] = payload.IPs
+				}
+			}
+		}
+	}
+	return result
+}
+
+// localActiveIPs liest alle aktiven IPv4-Adressen des lokalen Nodes via `ip`.
+func localActiveIPs() ([]string, error) {
+	out, err := exec.Command("ip", "-4", "-o", "addr", "show").Output()
+	if err != nil {
+		return nil, err
+	}
+	var ips []string
+	for _, line := range strings.Split(string(out), "\n") {
+		parts := strings.Fields(line)
+		for i, p := range parts {
+			if p == "inet" && i+1 < len(parts) {
+				addr := strings.SplitN(parts[i+1], "/", 2)[0]
+				ips = append(ips, addr)
+			}
+		}
+	}
+	return ips, nil
+}
+
+// peerVIPCmd ruft AgentVIPCmd auf dem Peer via mTLS auf.
+func (h *ClusterHandler) peerVIPCmd(ctx context.Context, peer models.HANode, vip *vipInfo, action, stepLabel string) vipTestStep {
+	step := vipTestStep{Step: stepLabel}
+	if h.Aggregator == nil {
+		step.Message = "aggregator nicht verfügbar"
+		return step
+	}
+	body, _ := json.Marshal(vipCmdRequest{
+		Action:  action,
+		Address: vip.Address,
+		Prefix:  vip.Prefix,
+		Device:  vip.Device,
+	})
+	res := h.Aggregator.PostPeerWithBody(ctx, peer, "/agent/cluster/vip-cmd", body)
+	step.OK = res.OK
+	if !res.OK {
+		step.Message = res.Err
+	}
+	return step
+}
+
+// localVIPStep führt ip addr add/del auf dem lokalen Node aus.
+func localVIPStep(vip *vipInfo, action, stepLabel string) vipTestStep {
+	step := vipTestStep{Step: stepLabel}
+	if err := runVIPCmd(action, vip.Address, vip.Prefix, vip.Device); err != nil {
+		step.Message = err.Error()
+		return step
+	}
+	step.OK = true
+	return step
+}
+
+// runVIPCmd führt `sudo /usr/lib/edgeguard/vip-cmd.sh {action} {addr/prefix} {dev}` aus.
+func runVIPCmd(action, address string, prefix int, device string) error {
+	addrPfx := fmt.Sprintf("%s/%d", address, prefix)
+	out, err := exec.Command("sudo", "-n", "/usr/lib/edgeguard/vip-cmd.sh", action, addrPfx, device).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("vip-cmd.sh %s %s %s: %s", action, addrPfx, device, strings.TrimSpace(string(out)))
+	}
+	return nil
+}

internal/handlers/crowdsec.go

@@ -0,0 +1,285 @@
+package handlers
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	crowdsec "git.netcell-it.de/projekte/edgeguard-native/internal/crowdsec"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+)
+
+// CrowdSecHandler exposes the CrowdSec IDS/IPS management REST API:
+//
+//	GET    /crowdsec/status
+//	GET    /crowdsec/decisions
+//	POST   /crowdsec/decisions
+//	DELETE /crowdsec/decisions         (?ip=<ip> or ?id=<id>)
+//	GET    /crowdsec/alerts
+//	DELETE /crowdsec/alerts/:id
+//	GET    /crowdsec/bouncers
+//	DELETE /crowdsec/bouncers/:name
+//	GET    /crowdsec/machines
+//	DELETE /crowdsec/machines/:id
+//	GET    /crowdsec/collections
+//	POST   /crowdsec/collections/:name/install
+//	DELETE /crowdsec/collections/:name
+type CrowdSecHandler struct {
+	Audit  *audit.Repo
+	NodeID string
+}
+
+// NewCrowdSecHandler returns a CrowdSecHandler wired with audit and node-id.
+func NewCrowdSecHandler(a *audit.Repo, nodeID string) *CrowdSecHandler {
+	return &CrowdSecHandler{Audit: a, NodeID: nodeID}
+}
+
+// Register mounts all CrowdSec routes onto the provided authenticated router
+// group.
+func (h *CrowdSecHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/crowdsec")
+	g.GET("/status", h.Status)
+	g.GET("/decisions", h.ListDecisions)
+	g.POST("/decisions", h.AddDecision)
+	g.DELETE("/decisions", h.DeleteDecision)
+	g.GET("/alerts", h.ListAlerts)
+	g.DELETE("/alerts/:id", h.DeleteAlert)
+	g.GET("/bouncers", h.ListBouncers)
+	g.DELETE("/bouncers/:name", h.DeleteBouncer)
+	g.GET("/machines", h.ListMachines)
+	g.DELETE("/machines/:id", h.DeleteMachine)
+	g.GET("/collections", h.ListCollections)
+	g.POST("/collections/:name/install", h.InstallCollection)
+	g.DELETE("/collections/:name", h.RemoveCollection)
+}
+
+// csNotInstalled responds with 503 when cscli is absent.
+func csNotInstalled(c *gin.Context) {
+	c.JSON(http.StatusServiceUnavailable, gin.H{"error": "crowdsec not installed"})
+}
+
+// ---------- Status ----------------------------------------------------------
+
+// Status returns live status of the CrowdSec agent + bouncer.
+// Does NOT require cscli — uses systemctl for running-state checks.
+func (h *CrowdSecHandler) Status(c *gin.Context) {
+	st := crowdsec.ServiceStatus(c.Request.Context())
+	response.OK(c, st)
+}
+
+// ---------- Decisions -------------------------------------------------------
+
+// ListDecisions returns all active decisions.
+func (h *CrowdSecHandler) ListDecisions(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Decisions(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"decisions": list})
+}
+
+// addDecisionBody is the expected JSON body for POST /crowdsec/decisions.
+type addDecisionBody struct {
+	IP       string `json:"ip"       binding:"required"`
+	Duration string `json:"duration" binding:"required"`
+	Reason   string `json:"reason"`
+	Type     string `json:"type"`
+}
+
+// AddDecision creates a new ban/captcha decision.
+func (h *CrowdSecHandler) AddDecision(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	var body addDecisionBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if body.Reason == "" {
+		body.Reason = "manual ban"
+	}
+	if body.Type == "" {
+		body.Type = "ban"
+	}
+	if err := crowdsec.AddDecision(c.Request.Context(), body.IP, body.Duration, body.Reason, body.Type); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.decision.add", body.IP,
+		gin.H{"duration": body.Duration, "type": body.Type, "reason": body.Reason}, h.NodeID)
+	response.Created(c, gin.H{"ip": body.IP, "duration": body.Duration, "type": body.Type})
+}
+
+// DeleteDecision removes a decision by IP (?ip=) or by ID (?id=).
+func (h *CrowdSecHandler) DeleteDecision(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	ip := c.Query("ip")
+	id := c.Query("id")
+	if ip == "" && id == "" {
+		response.BadRequest(c, errors.New("query parameter 'ip' or 'id' required"))
+		return
+	}
+	var err error
+	var target string
+	if ip != "" {
+		err = crowdsec.DeleteDecisionByIP(c.Request.Context(), ip)
+		target = ip
+	} else {
+		err = crowdsec.DeleteDecisionByID(c.Request.Context(), id)
+		target = id
+	}
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.decision.delete", target, nil, h.NodeID)
+	response.OK(c, gin.H{"deleted": target})
+}
+
+// ---------- Alerts ----------------------------------------------------------
+
+// ListAlerts returns recent CrowdSec alerts.
+func (h *CrowdSecHandler) ListAlerts(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Alerts(c.Request.Context(), 200)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"alerts": list})
+}
+
+// DeleteAlert discards a single alert.
+func (h *CrowdSecHandler) DeleteAlert(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	id := c.Param("id")
+	if err := crowdsec.DeleteAlert(c.Request.Context(), id); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"deleted": id})
+}
+
+// ---------- Bouncers --------------------------------------------------------
+
+// ListBouncers returns all registered bouncers.
+func (h *CrowdSecHandler) ListBouncers(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Bouncers(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"bouncers": list})
+}
+
+// DeleteBouncer removes a bouncer by name.
+func (h *CrowdSecHandler) DeleteBouncer(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	name := c.Param("name")
+	if err := crowdsec.DeleteBouncer(c.Request.Context(), name); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.bouncer.delete", name, nil, h.NodeID)
+	response.OK(c, gin.H{"deleted": name})
+}
+
+// ---------- Machines --------------------------------------------------------
+
+// ListMachines returns all registered machines.
+func (h *CrowdSecHandler) ListMachines(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Machines(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"machines": list})
+}
+
+// DeleteMachine removes a machine by ID.
+func (h *CrowdSecHandler) DeleteMachine(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	id := c.Param("id")
+	if err := crowdsec.DeleteMachine(c.Request.Context(), id); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "crowdsec.machine.delete", id, nil, h.NodeID)
+	response.OK(c, gin.H{"deleted": id})
+}
+
+// ---------- Collections -----------------------------------------------------
+
+// ListCollections returns all hub collections and their install status.
+func (h *CrowdSecHandler) ListCollections(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	list, err := crowdsec.Collections(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"collections": list})
+}
+
+// InstallCollection installs a hub collection by name.
+func (h *CrowdSecHandler) InstallCollection(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	name := c.Param("name")
+	if err := crowdsec.InstallCollection(c.Request.Context(), name); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.Created(c, gin.H{"installed": name})
+}
+
+// RemoveCollection removes a hub collection by name.
+func (h *CrowdSecHandler) RemoveCollection(c *gin.Context) {
+	if !crowdsec.IsInstalled() {
+		csNotInstalled(c)
+		return
+	}
+	name := c.Param("name")
+	if err := crowdsec.RemoveCollection(c.Request.Context(), name); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"removed": name})
+}

internal/handlers/dhcp.go

@@ -0,0 +1,346 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	dhcpsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/dhcp"
+)
+
+// DHCPHandler exposes /api/v1/dhcp/{settings,subnets,reservations} for
+// the Kea DHCPv4 server.
+type DHCPHandler struct {
+	Repo     *dhcpsvc.Repo
+	Audit    *audit.Repo
+	NodeID   string
+	Reloader func(ctx context.Context) error
+}
+
+func NewDHCPHandler(repo *dhcpsvc.Repo, a *audit.Repo, nodeID string, reloader func(context.Context) error) *DHCPHandler {
+	return &DHCPHandler{Repo: repo, Audit: a, NodeID: nodeID, Reloader: reloader}
+}
+
+func (h *DHCPHandler) reload(ctx context.Context, op string) {
+	if h.Reloader == nil {
+		return
+	}
+	if err := h.Reloader(ctx); err != nil {
+		slog.Warn("kea: reload after mutation failed", "op", op, "error", err)
+	}
+}
+
+func (h *DHCPHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/dhcp")
+	g.GET("/settings", h.GetSettings)
+	g.PUT("/settings", h.UpdateSettings)
+
+	s := g.Group("/subnets")
+	s.GET("", h.ListSubnets)
+	s.POST("", h.CreateSubnet)
+	s.GET("/:id", h.GetSubnet)
+	s.PUT("/:id", h.UpdateSubnet)
+	s.DELETE("/:id", h.DeleteSubnet)
+	s.GET("/:id/reservations", h.ListReservationsForSubnet)
+	s.POST("/:id/reservations", h.CreateReservation)
+
+	r := g.Group("/reservations")
+	r.GET("", h.ListAllReservations)
+	r.GET("/:id", h.GetReservation)
+	r.PUT("/:id", h.UpdateReservation)
+	r.DELETE("/:id", h.DeleteReservation)
+}
+
+// ── Settings ─────────────────────────────────────────────────────────
+
+func (h *DHCPHandler) GetSettings(c *gin.Context) {
+	s, err := h.Repo.GetSettings(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, s)
+}
+
+func (h *DHCPHandler) UpdateSettings(c *gin.Context) {
+	var req models.DHCPSettings
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.DefaultLease <= 0 {
+		req.DefaultLease = 3600
+	}
+	if req.MaxLease < req.DefaultLease {
+		req.MaxLease = req.DefaultLease
+	}
+	if err := validateIPList(req.DNSServers); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.UpdateSettings(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dhcp.settings.update", "",
+		gin.H{"enabled": out.Enabled}, h.NodeID)
+	response.OK(c, out)
+	h.reload(c.Request.Context(), "settings.update")
+}
+
+// ── Subnets ──────────────────────────────────────────────────────────
+
+func (h *DHCPHandler) ListSubnets(c *gin.Context) {
+	out, err := h.Repo.ListSubnets(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"subnets": out})
+}
+
+func (h *DHCPHandler) GetSubnet(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	s, err := h.Repo.GetSubnet(c.Request.Context(), id)
+	if err != nil {
+		h.subnetErr(c, err)
+		return
+	}
+	response.OK(c, s)
+}
+
+func (h *DHCPHandler) CreateSubnet(c *gin.Context) {
+	var req models.DHCPSubnet
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if err := h.validateSubnet(c, &req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.CreateSubnet(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dhcp.subnet.create", out.Name, out, h.NodeID)
+	response.Created(c, out)
+	h.reload(c.Request.Context(), "subnet.create")
+}
+
+func (h *DHCPHandler) UpdateSubnet(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req models.DHCPSubnet
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if err := h.validateSubnet(c, &req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.UpdateSubnet(c.Request.Context(), id, req)
+	if err != nil {
+		h.subnetErr(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dhcp.subnet.update", out.Name, out, h.NodeID)
+	response.OK(c, out)
+	h.reload(c.Request.Context(), "subnet.update")
+}
+
+func (h *DHCPHandler) DeleteSubnet(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.Repo.DeleteSubnet(c.Request.Context(), id); err != nil {
+		h.subnetErr(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dhcp.subnet.delete", "", gin.H{"id": id}, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+	h.reload(c.Request.Context(), "subnet.delete")
+}
+
+// ── Reservations ─────────────────────────────────────────────────────
+
+func (h *DHCPHandler) ListAllReservations(c *gin.Context) {
+	out, err := h.Repo.ListAllReservations(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"reservations": out})
+}
+
+func (h *DHCPHandler) ListReservationsForSubnet(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	out, err := h.Repo.ListReservationsForSubnet(c.Request.Context(), id)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"reservations": out})
+}
+
+func (h *DHCPHandler) GetReservation(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	v, err := h.Repo.GetReservation(c.Request.Context(), id)
+	if err != nil {
+		h.resvErr(c, err)
+		return
+	}
+	response.OK(c, v)
+}
+
+func (h *DHCPHandler) CreateReservation(c *gin.Context) {
+	subnetID, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req models.DHCPReservation
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	req.SubnetID = subnetID
+	if err := validateReservation(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.CreateReservation(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dhcp.reservation.create", out.MACAddress, out, h.NodeID)
+	response.Created(c, out)
+	h.reload(c.Request.Context(), "reservation.create")
+}
+
+func (h *DHCPHandler) UpdateReservation(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var req models.DHCPReservation
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if err := validateReservation(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	out, err := h.Repo.UpdateReservation(c.Request.Context(), id, req)
+	if err != nil {
+		h.resvErr(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dhcp.reservation.update", out.MACAddress, out, h.NodeID)
+	response.OK(c, out)
+	h.reload(c.Request.Context(), "reservation.update")
+}
+
+func (h *DHCPHandler) DeleteReservation(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.Repo.DeleteReservation(c.Request.Context(), id); err != nil {
+		h.resvErr(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "dhcp.reservation.delete", "", gin.H{"id": id}, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+	h.reload(c.Request.Context(), "reservation.delete")
+}
+
+// ── Validation + error mapping ───────────────────────────────────────
+
+func (h *DHCPHandler) validateSubnet(c *gin.Context, s *models.DHCPSubnet) error {
+	s.Name = strings.TrimSpace(s.Name)
+	s.InterfaceName = strings.TrimSpace(s.InterfaceName)
+	if s.Name == "" {
+		return errors.New("name ist erforderlich")
+	}
+	if s.InterfaceName == "" {
+		return errors.New("interface_name ist erforderlich")
+	}
+	if exists, err := h.Repo.InterfaceExists(c.Request.Context(), s.InterfaceName); err == nil && !exists {
+		return errors.New("interface_name existiert nicht: " + s.InterfaceName)
+	}
+	if _, _, err := net.ParseCIDR(s.SubnetCIDR); err != nil {
+		return errors.New("subnet_cidr ist kein gültiges CIDR: " + s.SubnetCIDR)
+	}
+	if (s.PoolStart == "") != (s.PoolEnd == "") {
+		return errors.New("pool_start und pool_end müssen beide gesetzt sein (oder beide leer)")
+	}
+	for _, ip := range []string{s.PoolStart, s.PoolEnd, s.Gateway} {
+		if ip != "" && net.ParseIP(ip) == nil {
+			return errors.New("ungültige IP-Adresse: " + ip)
+		}
+	}
+	return validateIPList(s.DNSServers)
+}
+
+func validateReservation(r *models.DHCPReservation) error {
+	r.MACAddress = strings.TrimSpace(strings.ToLower(r.MACAddress))
+	r.IPAddress = strings.TrimSpace(r.IPAddress)
+	if _, err := net.ParseMAC(r.MACAddress); err != nil {
+		return errors.New("mac_address ist ungültig: " + r.MACAddress)
+	}
+	if net.ParseIP(r.IPAddress) == nil {
+		return errors.New("ip_address ist ungültig: " + r.IPAddress)
+	}
+	return nil
+}
+
+// validateIPList prüft eine optionale Komma-Liste von IPs.
+func validateIPList(csv string) error {
+	for _, p := range strings.Split(csv, ",") {
+		p = strings.TrimSpace(p)
+		if p != "" && net.ParseIP(p) == nil {
+			return errors.New("ungültige IP in dns_servers: " + p)
+		}
+	}
+	return nil
+}
+
+func (h *DHCPHandler) subnetErr(c *gin.Context, err error) {
+	if errors.Is(err, dhcpsvc.ErrSubnetNotFound) {
+		response.NotFound(c, err)
+		return
+	}
+	response.Internal(c, err)
+}
+
+func (h *DHCPHandler) resvErr(c *gin.Context, err error) {
+	if errors.Is(err, dhcpsvc.ErrReservationNotFound) {
+		response.NotFound(c, err)
+		return
+	}
+	response.Internal(c, err)
+}

internal/handlers/dns.go

@@ -306,7 +306,7 @@ func (h *DNSHandler) UpdateSettings(c *gin.Context) {
 // cached RRs from the resolver. Useful after DNS propagation or when
 // stale records need to be evicted immediately.
 func (h *DNSHandler) FlushCache(c *gin.Context) {
-	out, err := exec.CommandContext(c.Request.Context(), "unbound-control", "flush_zone", ".").CombinedOutput()
+	out, err := exec.CommandContext(c.Request.Context(), "/usr/sbin/unbound-control", "flush_zone", ".").CombinedOutput()
 	if err != nil {
 		slog.Error("dns flush-cache failed", "err", err, "out", string(out))
 		response.Internal(c, err)
@@ -388,7 +388,7 @@ func validateZone(z *models.DNSZone) error {
 // stats_noreset liest die Zähler ohne sie zurückzusetzen — safe für
 // wiederholte Aufrufe aus dem UI.
 func (h *DNSHandler) Stats(c *gin.Context) {
-	out, err := exec.Command("unbound-control", "stats_noreset").Output()
+	out, err := exec.Command("/usr/sbin/unbound-control", "stats_noreset").Output()
 	if err != nil {
 		response.OK(c, gin.H{
 			"error": "unbound-control nicht verfügbar: " + err.Error(),

internal/handlers/firewall.go

@@ -138,6 +138,7 @@ func (h *FirewallHandler) Register(rg *gin.RouterGroup) {
 	rl.POST("", h.CreateRule)
 	rl.GET("/:id", h.GetRule)
 	rl.PUT("/:id", h.UpdateRule)
+	rl.PATCH("/:id", h.PatchRule)
 	rl.DELETE("/:id", h.DeleteRule)
 
 	nat := g.Group("/nat-rules")
@@ -145,6 +146,7 @@ func (h *FirewallHandler) Register(rg *gin.RouterGroup) {
 	nat.POST("", h.CreateNAT)
 	nat.GET("/:id", h.GetNAT)
 	nat.PUT("/:id", h.UpdateNAT)
+	nat.PATCH("/:id", h.PatchNAT)
 	nat.DELETE("/:id", h.DeleteNAT)
 }
 
@@ -758,6 +760,48 @@ func (h *FirewallHandler) DeleteRule(c *gin.Context) {
 	response.NoContent(c); h.reload(c.Request.Context(), "delete")
 }
 
+func (h *FirewallHandler) PatchRule(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var body struct {
+		Note   *string  `json:"note"`
+		Labels []string `json:"labels"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	ctx := c.Request.Context()
+	if body.Note != nil {
+		if err := h.Rules.PatchNote(ctx, id, *body.Note); err != nil {
+			if errors.Is(err, firewall.ErrRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	if body.Labels != nil {
+		if err := h.Rules.PatchLabels(ctx, id, body.Labels); err != nil {
+			if errors.Is(err, firewall.ErrRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	out, err := h.Rules.Get(ctx, id)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, out)
+}
+
 // ── NAT Rules ──────────────────────────────────────────────────────────
 
 func (h *FirewallHandler) ListNAT(c *gin.Context) {
@@ -858,6 +902,48 @@ func (h *FirewallHandler) DeleteNAT(c *gin.Context) {
 	response.NoContent(c); h.reload(c.Request.Context(), "delete")
 }
 
+func (h *FirewallHandler) PatchNAT(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	var body struct {
+		Note   *string  `json:"note"`
+		Labels []string `json:"labels"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	ctx := c.Request.Context()
+	if body.Note != nil {
+		if err := h.NATRules.PatchNote(ctx, id, *body.Note); err != nil {
+			if errors.Is(err, firewall.ErrNATRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	if body.Labels != nil {
+		if err := h.NATRules.PatchLabels(ctx, id, body.Labels); err != nil {
+			if errors.Is(err, firewall.ErrNATRuleNotFound) {
+				response.NotFound(c, err)
+				return
+			}
+			response.Internal(c, err)
+			return
+		}
+	}
+	out, err := h.NATRules.Get(ctx, id)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, out)
+}
+
 // ── Validators ─────────────────────────────────────────────────────────
 
 func validateAddrObjValue(kind, value string) error {

internal/handlers/forwardproxy.go

@@ -39,6 +39,8 @@ func (h *ForwardProxyHandler) reload(ctx context.Context, op string) {
 func (h *ForwardProxyHandler) Register(rg *gin.RouterGroup) {
 	base := rg.Group("/forward-proxy")
 	base.GET("/stats", h.Stats)
+	base.GET("/settings", h.GetSettings)
+	base.PUT("/settings", h.UpdateSettings)
 
 	g := base.Group("/acls")
 	g.GET("", h.List)
@@ -48,6 +50,34 @@ func (h *ForwardProxyHandler) Register(rg *gin.RouterGroup) {
 	g.DELETE("/:id", h.Delete)
 }
 
+func (h *ForwardProxyHandler) GetSettings(c *gin.Context) {
+	s, err := h.Repo.GetSettings(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, s)
+}
+
+func (h *ForwardProxyHandler) UpdateSettings(c *gin.Context) {
+	var req models.ForwardProxySettings
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if req.ListenPort <= 0 || req.ListenPort > 65535 {
+		req.ListenPort = 3128
+	}
+	out, err := h.Repo.UpdateSettings(c.Request.Context(), req)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "forward_proxy.settings.update", "settings", out, h.NodeID)
+	response.OK(c, out)
+	h.reload(c.Request.Context(), "settings.update")
+}
+
 func (h *ForwardProxyHandler) List(c *gin.Context) {
 	out, err := h.Repo.List(c.Request.Context())
 	if err != nil {

internal/handlers/ipaddresses.go

@@ -1,7 +1,9 @@
 package handlers
 
 import (
+	"context"
 	"errors"
+	"log/slog"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
@@ -13,13 +15,27 @@ import (
 )
 
 type IPAddressesHandler struct {
-	Repo   *ipaddresses.Repo
-	Audit  *audit.Repo
-	NodeID string
+	Repo      *ipaddresses.Repo
+	Generator *ipaddresses.Generator
+	Audit     *audit.Repo
+	NodeID    string
 }
 
 func NewIPAddressesHandler(repo *ipaddresses.Repo, a *audit.Repo, nodeID string) *IPAddressesHandler {
-	return &IPAddressesHandler{Repo: repo, Audit: a, NodeID: nodeID}
+	return &IPAddressesHandler{
+		Repo:      repo,
+		Generator: ipaddresses.NewGenerator(repo),
+		Audit:     a,
+		NodeID:    nodeID,
+	}
+}
+
+func (h *IPAddressesHandler) applyAsync() {
+	go func() {
+		if err := h.Generator.Render(context.Background()); err != nil {
+			slog.Warn("ip-addresses: apply failed", "error", err)
+		}
+	}()
 }
 
 func (h *IPAddressesHandler) Register(rg *gin.RouterGroup) {
@@ -70,6 +86,7 @@ func (h *IPAddressesHandler) Create(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.create",
 		req.Address, out, h.NodeID)
+	h.applyAsync()
 	response.Created(c, out)
 }
 
@@ -94,6 +111,7 @@ func (h *IPAddressesHandler) Update(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.update",
 		out.Address, out, h.NodeID)
+	h.applyAsync()
 	response.OK(c, out)
 }
 
@@ -112,5 +130,6 @@ func (h *IPAddressesHandler) Delete(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "ip_address.delete",
 		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	h.applyAsync()
 	response.NoContent(c)
 }

internal/handlers/networks.go

@@ -1,7 +1,9 @@
 package handlers
 
 import (
+	"context"
 	"errors"
+	"log/slog"
 	"strconv"
 
 	"github.com/gin-gonic/gin"
@@ -15,18 +17,34 @@ import (
 )
 
 type NetworksHandler struct {
-	Repo   *networkifs.Repo
-	IPs    *ipaddresses.Repo
-	Zones  *firewall.ZonesRepo
-	Audit  *audit.Repo
-	NodeID string
+	Repo      *networkifs.Repo
+	Generator *networkifs.Generator
+	IPs       *ipaddresses.Repo
+	Zones     *firewall.ZonesRepo
+	Audit     *audit.Repo
+	NodeID    string
 }
 
 func NewNetworksHandler(
 	repo *networkifs.Repo, ips *ipaddresses.Repo,
 	zones *firewall.ZonesRepo, a *audit.Repo, nodeID string,
 ) *NetworksHandler {
-	return &NetworksHandler{Repo: repo, IPs: ips, Zones: zones, Audit: a, NodeID: nodeID}
+	return &NetworksHandler{
+		Repo:      repo,
+		Generator: networkifs.NewGenerator(repo),
+		IPs:       ips,
+		Zones:     zones,
+		Audit:     a,
+		NodeID:    nodeID,
+	}
+}
+
+func (h *NetworksHandler) applyAsync() {
+	go func() {
+		if err := h.Generator.Render(context.Background()); err != nil {
+			slog.Warn("network-interfaces: apply failed", "error", err)
+		}
+	}()
 }
 
 func (h *NetworksHandler) Register(rg *gin.RouterGroup) {
@@ -88,6 +106,7 @@ func (h *NetworksHandler) Create(c *gin.Context) {
 		return
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.create", req.Name, out, h.NodeID)
+	h.applyAsync()
 	response.Created(c, out)
 }
 
@@ -122,6 +141,7 @@ func (h *NetworksHandler) Update(c *gin.Context) {
 		return
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.update", out.Name, out, h.NodeID)
+	h.applyAsync()
 	response.OK(c, out)
 }
 
@@ -140,6 +160,7 @@ func (h *NetworksHandler) Delete(c *gin.Context) {
 	}
 	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "network_interface.delete",
 		strconv.FormatInt(id, 10), gin.H{"id": id}, h.NodeID)
+	h.applyAsync()
 	response.NoContent(c)
 }
 

internal/handlers/oidc.go

@@ -0,0 +1,349 @@
+package handlers
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/oauth2"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	oidcsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/oidc"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/session"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
+	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+)
+
+// OIDC / Keycloak SSO. Additiv zum lokalen Passwort-Login. Regeln:
+//   - kein Auto-Provisioning (E-Mail muss als User existieren),
+//   - Rolle kommt aus der DB-Row (nie aus dem Token),
+//   - lokaler Login + TOTP bleiben unangetastet.
+//
+// Flow-State (state/PKCE-verifier/nonce) liegt stateless in einem 5-min
+// signierten HttpOnly-Cookie (SameSite=Lax, da der IdP-Redirect ein
+// top-level cross-site GET ist). Nach Erfolg wird dieselbe Session wie
+// beim lokalen Login ausgestellt (setSessionCookie + Signer).
+
+const (
+	oidcFlowCookie = "edgeguard_oidc_flow"
+	oidcFlowTTL    = 5 * time.Minute
+)
+
+type OIDCHandler struct {
+	Repo   *oidcsvc.Repo
+	Auth   oidcsvc.Authenticator
+	Users  *usersvc.Repo
+	Signer *session.Signer
+	Setup  *setup.Store
+	Audit  *audit.Repo
+	NodeID string
+}
+
+func NewOIDCHandler(repo *oidcsvc.Repo, auth oidcsvc.Authenticator, users *usersvc.Repo, signer *session.Signer, setupStore *setup.Store) *OIDCHandler {
+	return &OIDCHandler{Repo: repo, Auth: auth, Users: users, Signer: signer, Setup: setupStore}
+}
+
+func (h *OIDCHandler) WithAudit(a *audit.Repo, nodeID string) *OIDCHandler {
+	h.Audit = a
+	h.NodeID = nodeID
+	return h
+}
+
+// RegisterPublic mountet die unauth. Endpoints (auf v1, hinter SetupGate).
+func (h *OIDCHandler) RegisterPublic(rg *gin.RouterGroup) {
+	g := rg.Group("/auth/oidc")
+	g.GET("/settings", h.PublicSettings)
+	g.GET("/login", h.Login)
+	g.GET("/callback", h.Callback)
+}
+
+// RegisterAdmin mountet die Admin-Endpoints (auf authed: requireAuth +
+// RequireAdminForMutations → GET für alle, PUT nur admin).
+func (h *OIDCHandler) RegisterAdmin(rg *gin.RouterGroup) {
+	g := rg.Group("/oidc")
+	g.GET("/settings", h.GetSettings)
+	g.PUT("/settings", h.UpdateSettings)
+}
+
+// PublicSettings: nur, was die Login-Seite braucht.
+func (h *OIDCHandler) PublicSettings(c *gin.Context) {
+	s, err := h.Repo.Get(c.Request.Context())
+	if err != nil {
+		// Kein Datensatz/kein DB → SSO einfach „aus".
+		response.OK(c, gin.H{"enabled": false, "button_label": ""})
+		return
+	}
+	response.OK(c, gin.H{"enabled": s.Enabled, "button_label": s.ButtonLabel})
+}
+
+// GetSettings: Admin-Sicht ohne Secret, mit secret_configured + redirect_uri.
+func (h *OIDCHandler) GetSettings(c *gin.Context) {
+	s, err := h.Repo.Get(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	hasSecret, _ := h.Repo.HasSecret(c.Request.Context())
+	response.OK(c, gin.H{
+		"enabled":          s.Enabled,
+		"issuer_url":       s.IssuerURL,
+		"client_id":        s.ClientID,
+		"scopes":           s.Scopes,
+		"email_claim":      s.EmailClaim,
+		"button_label":     s.ButtonLabel,
+		"secret_configured": hasSecret,
+		"redirect_uri":     h.redirectURI(c),
+	})
+}
+
+type oidcUpdateBody struct {
+	Enabled      bool    `json:"enabled"`
+	IssuerURL    string  `json:"issuer_url"`
+	ClientID     string  `json:"client_id"`
+	ClientSecret *string `json:"client_secret"` // nil = unverändert, "" = löschen
+	Scopes       string  `json:"scopes"`
+	EmailClaim   string  `json:"email_claim"`
+	ButtonLabel  string  `json:"button_label"`
+}
+
+// UpdateSettings: PUT (admin via RequireAdminForMutations).
+func (h *OIDCHandler) UpdateSettings(c *gin.Context) {
+	var body oidcUpdateBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	body.IssuerURL = strings.TrimSpace(body.IssuerURL)
+	body.ClientID = strings.TrimSpace(body.ClientID)
+	if body.Scopes == "" {
+		body.Scopes = "openid email profile"
+	}
+	if body.EmailClaim == "" {
+		body.EmailClaim = "email"
+	}
+	if body.ButtonLabel == "" {
+		body.ButtonLabel = "Sign in with SSO"
+	}
+
+	if body.Enabled {
+		if body.IssuerURL == "" || body.ClientID == "" {
+			response.BadRequest(c, errors.New("issuer_url und client_id sind erforderlich, wenn OIDC aktiviert ist"))
+			return
+		}
+		if u, err := url.Parse(body.IssuerURL); err != nil || u.Scheme != "https" || u.Host == "" {
+			response.BadRequest(c, errors.New("issuer_url muss eine gültige https-URL sein"))
+			return
+		}
+		hasSecret, _ := h.Repo.HasSecret(c.Request.Context())
+		providing := body.ClientSecret != nil && *body.ClientSecret != ""
+		if !hasSecret && !providing {
+			response.BadRequest(c, errors.New("client_secret ist erforderlich (noch keins gespeichert)"))
+			return
+		}
+	}
+
+	if err := h.Repo.Update(c.Request.Context(), oidcsvc.UpdateInput{
+		Enabled:      body.Enabled,
+		IssuerURL:    body.IssuerURL,
+		ClientID:     body.ClientID,
+		Scopes:       body.Scopes,
+		EmailClaim:   body.EmailClaim,
+		ButtonLabel:  body.ButtonLabel,
+		ClientSecret: body.ClientSecret,
+	}); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	h.audit(c, actorOf(c), "oidc.settings.updated", actorOf(c),
+		gin.H{"enabled": body.Enabled, "issuer": body.IssuerURL})
+	response.OK(c, gin.H{"ok": true})
+}
+
+// Login: 302 zum IdP. Setzt das signierte Flow-Cookie.
+func (h *OIDCHandler) Login(c *gin.Context) {
+	ctx := c.Request.Context()
+	s, err := h.Repo.Get(ctx)
+	if err != nil || !s.Enabled {
+		h.fail(c, "disabled")
+		return
+	}
+	state, err1 := randToken(24)
+	nonce, err2 := randToken(24)
+	if err1 != nil || err2 != nil {
+		h.fail(c, "server")
+		return
+	}
+	verifier := oauth2.GenerateVerifier()
+	redirectURI := h.redirectURI(c)
+
+	authURL, err := h.Auth.AuthCodeURL(ctx, redirectURI, state, nonce, verifier)
+	if err != nil {
+		h.fail(c, "config")
+		return
+	}
+
+	blob, _ := json.Marshal(oidcFlow{State: state, Verifier: verifier, Nonce: nonce})
+	signed, err := h.Signer.SignBlob(blob, oidcFlowTTL)
+	if err != nil {
+		h.fail(c, "server")
+		return
+	}
+	h.setFlowCookie(c, signed)
+	c.Redirect(http.StatusFound, authURL)
+}
+
+// Callback: verifiziert Flow + Token, mappt auf DB-User, stellt Session aus.
+func (h *OIDCHandler) Callback(c *gin.Context) {
+	ctx := c.Request.Context()
+
+	// Flow-Cookie lesen + sofort entwerten (single-use).
+	rawFlow, _ := c.Cookie(oidcFlowCookie)
+	h.clearFlowCookie(c)
+	if rawFlow == "" {
+		h.fail(c, "expired")
+		return
+	}
+	payload, err := h.Signer.VerifyBlob(rawFlow)
+	if err != nil {
+		h.fail(c, "expired")
+		return
+	}
+	var flow oidcFlow
+	if json.Unmarshal(payload, &flow) != nil {
+		h.fail(c, "expired")
+		return
+	}
+
+	if c.Query("error") != "" {
+		h.fail(c, "denied")
+		return
+	}
+	if subtle.ConstantTimeCompare([]byte(c.Query("state")), []byte(flow.State)) != 1 {
+		h.fail(c, "state")
+		return
+	}
+	code := c.Query("code")
+	if code == "" {
+		h.fail(c, "exchange")
+		return
+	}
+
+	claims, err := h.Auth.Exchange(ctx, h.redirectURI(c), code, flow.Verifier)
+	if err != nil {
+		h.fail(c, "token")
+		return
+	}
+	if subtle.ConstantTimeCompare([]byte(claims.Nonce), []byte(flow.Nonce)) != 1 {
+		h.fail(c, "nonce")
+		return
+	}
+	if !claims.EmailVerified || claims.Email == "" {
+		h.audit(c, claims.Email, "auth.login.failed", claims.Email,
+			gin.H{"via": "oidc", "reason": "email_unverified", "remote": c.ClientIP()})
+		h.fail(c, "unverified")
+		return
+	}
+
+	u, _, err := h.Users.FindByEmail(ctx, claims.Email)
+	if err != nil {
+		reason := "oidc_no_account"
+		if !errors.Is(err, usersvc.ErrNotFound) {
+			reason = "server"
+		}
+		h.audit(c, claims.Email, "auth.login.failed", claims.Email,
+			gin.H{"via": "oidc", "reason": reason, "remote": c.ClientIP()})
+		h.fail(c, map[bool]string{true: "no_account", false: "server"}[reason == "oidc_no_account"])
+		return
+	}
+	if !u.Active {
+		h.audit(c, u.Email, "auth.login.failed", u.Email,
+			gin.H{"via": "oidc", "reason": "account_disabled", "remote": c.ClientIP()})
+		h.fail(c, "disabled")
+		return
+	}
+
+	// Opportunistisches sub-Linking + Schutz gegen E-Mail-Reassignment.
+	if stored, err := h.Users.GetOIDCSubject(ctx, u.ID); err == nil {
+		if stored != "" && stored != claims.Subject {
+			h.audit(c, u.Email, "auth.login.failed", u.Email,
+				gin.H{"via": "oidc", "reason": "subject_mismatch", "remote": c.ClientIP()})
+			h.fail(c, "subject_mismatch")
+			return
+		}
+		if stored == "" {
+			_ = h.Users.SetOIDCSubject(ctx, u.ID, claims.Subject)
+		}
+	}
+
+	h.Users.RecordLogin(ctx, u.ID)
+
+	// Rolle STRIKT aus der DB-Row (nie aus Claims).
+	raw, tok, err := h.Signer.IssueWithRole(u.Email, u.Role)
+	if err != nil {
+		h.fail(c, "server")
+		return
+	}
+	setSessionCookie(c, raw, tok.Exp)
+	h.audit(c, u.Email, "auth.login.success", u.Email,
+		gin.H{"via": "oidc", "role": u.Role, "remote": c.ClientIP()})
+	c.Redirect(http.StatusFound, "/dashboard")
+}
+
+// ── Helpers ──────────────────────────────────────────────────────────
+
+type oidcFlow struct {
+	State    string `json:"s"`
+	Verifier string `json:"v"`
+	Nonce    string `json:"n"`
+}
+
+// redirectURI = https://<FQDN>/api/v1/auth/oidc/callback (FQDN aus setup.json,
+// Fallback Request-Host). Muss im IdP als Redirect-URI registriert sein.
+func (h *OIDCHandler) redirectURI(c *gin.Context) string {
+	host := ""
+	if h.Setup != nil {
+		if st, err := h.Setup.Load(); err == nil && st != nil {
+			host = strings.TrimSpace(st.FQDN)
+		}
+	}
+	if host == "" {
+		host = c.Request.Host
+	}
+	return "https://" + host + "/api/v1/auth/oidc/callback"
+}
+
+func (h *OIDCHandler) fail(c *gin.Context, reason string) {
+	c.Redirect(http.StatusFound, "/login?sso_error="+url.QueryEscape(reason))
+}
+
+func (h *OIDCHandler) audit(c *gin.Context, actor, action, subject string, detail any) {
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actor, action, subject, detail, h.NodeID)
+	}
+}
+
+func (h *OIDCHandler) setFlowCookie(c *gin.Context, raw string) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(oidcFlowCookie, raw, int(oidcFlowTTL.Seconds()), "/", "", true, true)
+}
+
+func (h *OIDCHandler) clearFlowCookie(c *gin.Context) {
+	c.SetSameSite(http.SameSiteLaxMode)
+	c.SetCookie(oidcFlowCookie, "", -1, "/", "", true, true)
+}
+
+func randToken(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(b), nil
+}

internal/handlers/oidc_test.go

@@ -0,0 +1,202 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	oidcsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/oidc"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/session"
+	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
+)
+
+// mockAuth erfüllt oidcsvc.Authenticator und liefert vorgegebene Claims —
+// kein echter IdP nötig.
+type mockAuth struct {
+	claims *oidcsvc.Claims
+	err    error
+}
+
+func (m *mockAuth) AuthCodeURL(_ context.Context, _, state, _, _ string) (string, error) {
+	return "https://idp.example/authorize?state=" + state, nil
+}
+func (m *mockAuth) Exchange(_ context.Context, _, _, _ string) (*oidcsvc.Claims, error) {
+	return m.claims, m.err
+}
+
+func oidcTestSetup(t *testing.T) (*usersvc.Repo, *pgxpool.Pool, *session.Signer) {
+	t.Helper()
+	dsn := os.Getenv("EG_FWTEST_DSN")
+	if dsn == "" {
+		t.Skip("set EG_FWTEST_DSN to run the oidc handler test")
+	}
+	ctx := context.Background()
+	// Retry: goose-Erst-Apply ist nicht concurrency-safe, wenn mehrere
+	// guarded Test-Pakete dieselbe frische DB parallel migrieren.
+	var mErr error
+	for i := 0; i < 3; i++ {
+		if mErr = database.Migrate(ctx, dsn); mErr == nil {
+			break
+		}
+		time.Sleep(700 * time.Millisecond)
+	}
+	if mErr != nil {
+		t.Fatalf("migrate: %v", mErr)
+	}
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	return usersvc.New(pool), pool, session.NewSigner([]byte("0123456789abcdef0123456789abcdef"), nil, 0)
+}
+
+func seedUser(t *testing.T, repo *usersvc.Repo, pool *pgxpool.Pool, email, role string, active bool) {
+	t.Helper()
+	ctx := context.Background()
+	_, _ = pool.Exec(ctx, `DELETE FROM users WHERE email=$1`, email)
+	if _, err := repo.Create(ctx, email, "Sup3rSecret-pw-123", role, active); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+}
+
+func runCallback(t *testing.T, h *OIDCHandler, flow oidcFlow, queryState, code string) *httptest.ResponseRecorder {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	rec := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(rec)
+	blob, _ := json.Marshal(flow)
+	signed, err := h.Signer.SignBlob(blob, oidcFlowTTL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodGet,
+		"/api/v1/auth/oidc/callback?state="+queryState+"&code="+code, nil)
+	req.AddCookie(&http.Cookie{Name: oidcFlowCookie, Value: signed})
+	c.Request = req
+	h.Callback(c)
+	return rec
+}
+
+func sessionCookie(rec *httptest.ResponseRecorder) string {
+	for _, ck := range rec.Result().Cookies() {
+		if ck.Name == cookieName && ck.Value != "" && ck.MaxAge >= 0 {
+			return ck.Value
+		}
+	}
+	return ""
+}
+
+func TestCallback_KnownActiveUser_RoleFromDB(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-viewer@test.local", "viewer", true)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-viewer@test.local", EmailVerified: true, Subject: "sub-1", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Verifier: "v", Nonce: "N"}, "S", "code")
+
+	if loc := rec.Header().Get("Location"); loc != "/dashboard" {
+		t.Fatalf("expected redirect to /dashboard, got %q (body proves failure path)", loc)
+	}
+	raw := sessionCookie(rec)
+	if raw == "" {
+		t.Fatal("expected a session cookie to be set")
+	}
+	tok, err := signer.Verify(raw)
+	if err != nil {
+		t.Fatalf("session token invalid: %v", err)
+	}
+	// Kernbeweis: Rolle kommt aus der DB-Row (viewer), nicht aus Claims.
+	if tok.Role != "viewer" {
+		t.Errorf("token role = %q, want viewer (role must come from DB)", tok.Role)
+	}
+	if tok.Actor != "sso-viewer@test.local" {
+		t.Errorf("token actor = %q", tok.Actor)
+	}
+}
+
+func TestCallback_UnknownEmail_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE email=$1`, "ghost@test.local")
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "ghost@test.local", EmailVerified: true, Subject: "x", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=no_account") {
+		t.Fatalf("expected sso_error=no_account, got %q", rec.Header().Get("Location"))
+	}
+	if sessionCookie(rec) != "" {
+		t.Fatal("no session cookie expected for unknown user")
+	}
+}
+
+func TestCallback_InactiveUser_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-disabled@test.local", "admin", false)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-disabled@test.local", EmailVerified: true, Subject: "x", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=disabled") {
+		t.Fatalf("expected sso_error=disabled, got %q", rec.Header().Get("Location"))
+	}
+	if sessionCookie(rec) != "" {
+		t.Fatal("no session cookie expected for inactive user")
+	}
+}
+
+func TestCallback_EmailUnverified_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-unverified@test.local", "admin", true)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-unverified@test.local", EmailVerified: false, Subject: "x", Nonce: "N",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=unverified") {
+		t.Fatalf("expected sso_error=unverified, got %q", rec.Header().Get("Location"))
+	}
+	if sessionCookie(rec) != "" {
+		t.Fatal("no session cookie expected for unverified email")
+	}
+}
+
+func TestCallback_NonceMismatch_Rejected(t *testing.T) {
+	users, pool, signer := oidcTestSetup(t)
+	seedUser(t, users, pool, "sso-nonce@test.local", "admin", true)
+
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{
+		Email: "sso-nonce@test.local", EmailVerified: true, Subject: "x", Nonce: "WRONG",
+	}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "S", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=nonce") {
+		t.Fatalf("expected sso_error=nonce, got %q", rec.Header().Get("Location"))
+	}
+}
+
+func TestCallback_StateMismatch_Rejected(t *testing.T) {
+	users, _, signer := oidcTestSetup(t)
+	h := NewOIDCHandler(nil, &mockAuth{claims: &oidcsvc.Claims{}}, users, signer, nil)
+
+	rec := runCallback(t, h, oidcFlow{State: "S", Nonce: "N"}, "WRONG", "code")
+	if !strings.Contains(rec.Header().Get("Location"), "sso_error=state") {
+		t.Fatalf("expected sso_error=state, got %q", rec.Header().Get("Location"))
+	}
+}

internal/handlers/system.go

@@ -118,10 +118,12 @@ func (h *SystemHandler) Register(rg *gin.RouterGroup) {
 	g.POST("/haproxy-reload", h.HAProxyReload)
 	g.POST("/render-configs", h.RenderConfigs)
 	g.POST("/service-restart", h.ServiceRestart)
+	g.POST("/service-toggle", h.ServiceToggle)
 	g.GET("/upgrade-status", h.UpgradeStatus)
 	g.GET("/ipv6", h.IPv6)
 	g.POST("/ipv6", h.SetIPv6)
 	g.GET("/config-preview", h.ConfigPreview)
+	g.GET("/vip-status", h.VIPStatus)
 }
 
 // RegisterAgent mountet die read-only System-Endpoints auf der mTLS-
@@ -188,10 +190,14 @@ var servicesToCheck = []struct{ Label, Unit string }{
 	{"edgeguard-scheduler", "edgeguard-scheduler"},
 	{"haproxy", "haproxy"},
 	{"nftables", "nftables"},
+	{"keepalived", "keepalived"},
 	{"unbound", "unbound"},
 	{"chrony", "chrony"},
 	{"squid", "squid"},
 	{"postgresql", "postgresql"},
+	{"crowdsec", "crowdsec"},
+	{"crowdsec-firewall-bouncer", "crowdsec-firewall-bouncer"},
+	{"edgeguard-waf", "edgeguard-waf"},
 }
 
 type serviceStatus struct {
@@ -630,6 +636,53 @@ func (h *SystemHandler) ServiceRestart(c *gin.Context) {
 	response.OK(c, gin.H{"ok": true, "service": svc})
 }
 
+// toggleAllowlist defines which services may be started/stopped via the UI.
+var toggleAllowlist = map[string]bool{
+	"crowdsec":                  true,
+	"crowdsec-firewall-bouncer": true,
+	"edgeguard-waf":             true,
+	"squid":                     true,
+	"unbound":                   true,
+}
+
+// ServiceToggle starts or stops (and enables/disables) a service.
+// Body: {"service": "crowdsec", "enabled": true}
+func (h *SystemHandler) ServiceToggle(c *gin.Context) {
+	var req struct {
+		Service string `json:"service" binding:"required"`
+		Enabled bool   `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Err(c, http.StatusBadRequest, simpleErr("service and enabled required"))
+		return
+	}
+	svc := strings.TrimSpace(req.Service)
+	if !toggleAllowlist[svc] {
+		response.Err(c, http.StatusBadRequest, simpleErr("service not in toggle allowlist: "+svc))
+		return
+	}
+	unit := svc + ".service"
+	action := "stop"
+	sysdAction := "disable"
+	if req.Enabled {
+		action = "start"
+		sysdAction = "enable"
+	}
+	if out, err := exec.Command("sudo", "-n", "/usr/bin/systemctl", sysdAction, unit).CombinedOutput(); err != nil {
+		response.Err(c, http.StatusInternalServerError, simpleErr(strings.TrimSpace(string(out))+": "+err.Error()))
+		return
+	}
+	if out, err := exec.Command("sudo", "-n", "/usr/bin/systemctl", action, unit).CombinedOutput(); err != nil {
+		response.Err(c, http.StatusInternalServerError, simpleErr(strings.TrimSpace(string(out))+": "+err.Error()))
+		return
+	}
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actorOf(c), "system.service_toggle",
+			svc, gin.H{"service": svc, "enabled": req.Enabled}, h.NodeID)
+	}
+	response.OK(c, gin.H{"ok": true, "service": svc, "enabled": req.Enabled})
+}
+
 // RenderConfigs erzwingt ein Re-Render aller Service-Configs aus dem
 // aktuellen DB-State. Läuft haproxy + alle ExtraReloaders (nftables,
 // wireguard, squid, unbound, chrony) durch. Fehler werden gesammelt
@@ -1077,6 +1130,87 @@ func classifyLinkType(ifc net.Interface) string {
 	return ""
 }
 
+// VIPStatus returns the VRRP state and active VIPs for this node.
+// Uses net.Interfaces() (no shell-out) to check which VIPs from
+// ip_addresses WHERE is_vip=true are currently assigned locally.
+// MASTER = at least one VIP is locally present; BACKUP = none present.
+func (h *SystemHandler) VIPStatus(c *gin.Context) {
+	type vipEntry struct {
+		Address string `json:"address"`
+		Prefix  int    `json:"prefix"`
+		Device  string `json:"device"`
+		Active  bool   `json:"active"`
+	}
+	type vipStatus struct {
+		VRRPState        string     `json:"vrrp_state"`
+		KeepalivedActive bool       `json:"keepalived_active"`
+		VIPs             []vipEntry `json:"vips"`
+	}
+
+	ctx := c.Request.Context()
+
+	// keepalived service active?
+	kaOut, _ := exec.CommandContext(ctx, "systemctl", "is-active", "keepalived").Output()
+	kaActive := strings.TrimSpace(string(kaOut)) == "active"
+
+	// query VIPs from DB
+	var dbVIPs []vipEntry
+	if h.Pool != nil {
+		rows, err := h.Pool.Query(ctx,
+			`SELECT a.address, a.prefix, COALESCE(i.name,'') AS device
+			   FROM ip_addresses a
+			   LEFT JOIN network_interfaces i ON i.id = a.interface_id
+			  WHERE a.is_vip = true AND a.active = true
+			  ORDER BY a.address`)
+		if err == nil {
+			defer rows.Close()
+			for rows.Next() {
+				var e vipEntry
+				if err2 := rows.Scan(&e.Address, &e.Prefix, &e.Device); err2 == nil {
+					dbVIPs = append(dbVIPs, e)
+				}
+			}
+		}
+	}
+
+	// build set of locally assigned IPs
+	localIPs := make(map[string]bool)
+	if ifaces, err := net.Interfaces(); err == nil {
+		for _, ifc := range ifaces {
+			if addrs, err2 := ifc.Addrs(); err2 == nil {
+				for _, a := range addrs {
+					if ipnet, ok := a.(*net.IPNet); ok {
+						localIPs[ipnet.IP.String()] = true
+					}
+				}
+			}
+		}
+	}
+
+	anyActive := false
+	for i := range dbVIPs {
+		dbVIPs[i].Active = localIPs[dbVIPs[i].Address]
+		if dbVIPs[i].Active {
+			anyActive = true
+		}
+	}
+
+	state := "UNKNOWN"
+	if kaActive {
+		if anyActive {
+			state = "MASTER"
+		} else {
+			state = "BACKUP"
+		}
+	}
+
+	response.OK(c, vipStatus{
+		VRRPState:        state,
+		KeepalivedActive: kaActive,
+		VIPs:             dbVIPs,
+	})
+}
+
 func flagsToList(f net.Flags) []string {
 	var out []string
 	if f&net.FlagUp != 0 {

internal/handlers/users.go

@@ -35,6 +35,7 @@ func (h *UsersHandler) Register(rg *gin.RouterGroup) {
 	g.PUT("/:id", h.Update)
 	g.POST("/:id/password", h.SetPassword)
 	g.DELETE("/:id", h.Delete)
+	g.DELETE("/:id/totp", h.DisableTOTP)
 }
 
 func (h *UsersHandler) List(c *gin.Context) {
@@ -164,3 +165,22 @@ func (h *UsersHandler) Delete(c *gin.Context) {
 		c.Param("id"), nil, h.NodeID)
 	response.OK(c, gin.H{"ok": true})
 }
+
+// DisableTOTP allows an admin to disable 2FA for any user.
+func (h *UsersHandler) DisableTOTP(c *gin.Context) {
+	id, ok := parseID(c)
+	if !ok {
+		return
+	}
+	if err := h.Repo.DisableTOTP(c.Request.Context(), id); err != nil {
+		if errors.Is(err, users.ErrNotFound) {
+			response.NotFound(c, err)
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "user.totp.disabled",
+		c.Param("id"), nil, h.NodeID)
+	response.OK(c, gin.H{"ok": true})
+}

internal/handlers/waf.go

@@ -0,0 +1,199 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/handlers/response"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/audit"
+	wafsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
+)
+
+// WafHandler exposes the per-domain WAF configuration REST API:
+//
+//	GET    /waf/configs              — list all configs (one per domain)
+//	GET    /waf/configs/:domain_id   — get config for a domain
+//	PUT    /waf/configs/:domain_id   — upsert config for a domain
+type WafHandler struct {
+	Repo     *wafsvc.Repo
+	Audit    *audit.Repo
+	NodeID   string
+	Reloader func(ctx context.Context) error
+}
+
+func NewWafHandler(repo *wafsvc.Repo, a *audit.Repo, nodeID string, reloader func(context.Context) error) *WafHandler {
+	return &WafHandler{Repo: repo, Audit: a, NodeID: nodeID, Reloader: reloader}
+}
+
+func (h *WafHandler) Register(rg *gin.RouterGroup) {
+	g := rg.Group("/waf")
+	g.GET("/configs", h.List)
+	g.GET("/configs/:domain_id", h.Get)
+	g.PUT("/configs/:domain_id", h.Upsert)
+	g.GET("/alerts", h.ListAlerts)
+	g.DELETE("/alerts", h.PurgeAlerts)
+}
+
+// List returns all WAF configs.
+func (h *WafHandler) List(c *gin.Context) {
+	configs, err := h.Repo.List(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"configs": configs})
+}
+
+// Get returns the WAF config for a single domain.
+// Returns a default (disabled) config when none exists yet.
+func (h *WafHandler) Get(c *gin.Context) {
+	domainID, err := strconv.ParseInt(c.Param("domain_id"), 10, 64)
+	if err != nil {
+		response.BadRequest(c, errors.New("invalid domain_id"))
+		return
+	}
+	cfg, err := h.Repo.GetByDomain(c.Request.Context(), domainID)
+	if err != nil {
+		if errors.Is(err, wafsvc.ErrNotFound) {
+			// Return a default config so the UI always gets a usable object.
+			response.OK(c, gin.H{"config": defaultConfig(domainID)})
+			return
+		}
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"config": cfg})
+}
+
+// upsertBody is the accepted JSON for PUT /waf/configs/:domain_id.
+type upsertBody struct {
+	Enabled         bool              `json:"enabled"`
+	Mode            string            `json:"mode"`
+	ParanoiaLevel   int               `json:"paranoia_level"`
+	RuleExclusions  []string          `json:"rule_exclusions"`
+	ExclusionNotes  map[string]string `json:"exclusion_notes"`
+	TrustedProxies  []string          `json:"trusted_proxies"`
+	CustomRules     string            `json:"custom_rules"`
+}
+
+// Upsert creates or updates the WAF config for a domain.
+func (h *WafHandler) Upsert(c *gin.Context) {
+	domainID, err := strconv.ParseInt(c.Param("domain_id"), 10, 64)
+	if err != nil {
+		response.BadRequest(c, errors.New("invalid domain_id"))
+		return
+	}
+	var body upsertBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	if body.Mode == "" {
+		body.Mode = "detection"
+	}
+	if body.ParanoiaLevel < 1 || body.ParanoiaLevel > 4 {
+		body.ParanoiaLevel = 1
+	}
+	if body.RuleExclusions == nil {
+		body.RuleExclusions = []string{}
+	}
+	if body.TrustedProxies == nil {
+		body.TrustedProxies = []string{}
+	}
+
+	if body.ExclusionNotes == nil {
+		body.ExclusionNotes = map[string]string{}
+	}
+	cfg := models.WafConfig{
+		DomainID:       domainID,
+		Enabled:        body.Enabled,
+		Mode:           body.Mode,
+		ParanoiaLevel:  body.ParanoiaLevel,
+		RuleExclusions: body.RuleExclusions,
+		ExclusionNotes: body.ExclusionNotes,
+		TrustedProxies: body.TrustedProxies,
+		CustomRules:    body.CustomRules,
+	}
+	result, err := h.Repo.Upsert(c.Request.Context(), cfg)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "waf.config.upsert",
+		strconv.FormatInt(domainID, 10),
+		gin.H{"enabled": body.Enabled, "mode": body.Mode, "paranoia_level": body.ParanoiaLevel},
+		h.NodeID)
+	// Reload HAProxy so the SPOE filter is added/removed based on
+	// whether any domain now has WAF enabled.
+	if h.Reloader != nil {
+		go func() {
+			if err := h.Reloader(context.Background()); err != nil {
+				slog.Warn("waf: haproxy reload after config change failed", "error", err)
+			}
+		}()
+	}
+	c.JSON(http.StatusOK, gin.H{"config": result})
+}
+
+// ListAlerts returns recent WAF alerts. Optional: ?domain_id=X&limit=N
+func (h *WafHandler) ListAlerts(c *gin.Context) {
+	var domainID *int64
+	if v := c.Query("domain_id"); v != "" {
+		id, err := strconv.ParseInt(v, 10, 64)
+		if err != nil {
+			response.BadRequest(c, errors.New("invalid domain_id"))
+			return
+		}
+		domainID = &id
+	}
+	limit := 200
+	if v := c.Query("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	alerts, err := h.Repo.ListAlerts(c.Request.Context(), domainID, limit)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"alerts": alerts})
+}
+
+// PurgeAlerts deletes old WAF alerts. Optional: ?days=N (default 30)
+func (h *WafHandler) PurgeAlerts(c *gin.Context) {
+	days := 30
+	if v := c.Query("days"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			days = n
+		}
+	}
+	if err := h.Repo.PurgeAlerts(c.Request.Context(), days); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "waf.alerts.purge",
+		"", gin.H{"days": days}, h.NodeID)
+	response.OK(c, gin.H{"ok": true, "days": days})
+}
+
+// defaultConfig returns a sensible disabled default for a domain
+// that has no WAF config row yet.
+func defaultConfig(domainID int64) models.WafConfig {
+	return models.WafConfig{
+		DomainID:       domainID,
+		Enabled:        false,
+		Mode:           "detection",
+		ParanoiaLevel:  1,
+		RuleExclusions: []string{},
+		ExclusionNotes: map[string]string{},
+		TrustedProxies: []string{},
+		CustomRules:    "",
+	}
+}

internal/haproxy/haproxy.cfg.tpl

@@ -80,6 +80,11 @@ frontend public_https
     bind [::]:443 ssl crt /etc/edgeguard/tls/ alpn h2,http/1.1
     bind quic6@:443 ssl crt /etc/edgeguard/tls/ alpn h3
     {{- end}}
+    {{- if .WAFEnabled}}
+    # WAF: SPOE-Filter — edgeguard-waf inspiziert jeden Request.
+    # filter muss vor allen http-request/http-response-Direktiven stehen.
+    filter spoe engine edgeguard-waf config /etc/edgeguard/haproxy/coraza-spoe.cfg
+    {{- end}}
 
     # Alt-Svc: signalisiert dass h3 auf demselben Port verfügbar ist.
     # ma=86400 = Browser darf den Hinweis 24h cachen.
@@ -91,6 +96,10 @@ frontend public_https
     # echte Source-IP ohne XFF-Chain-Parsing brauchen.
     http-request set-header X-Forwarded-Proto https
     http-request set-header X-Real-IP %[src]
+    {{- if .WAFEnabled}}
+    # WAF: Request blockieren wenn edgeguard-waf txn.waf.status gesetzt hat.
+    http-request deny deny_status 403 if { var(txn.waf.status) -m found }
+    {{- end}}
 
     {{- if .GlobalMaintenance}}
     # Whole-Box-Maintenance — Settings → Maintenance-Mode aktiv. Dieser
@@ -195,6 +204,16 @@ backend rl_{{$d.ID}}
 {{- end}}
 {{- end}}
 
+{{- if .WAFEnabled}}
+
+# SPOE-Backend für edgeguard-waf (TCP, kein HTTP-Parsing).
+backend spoe-edgeguard-waf
+    mode    tcp
+    timeout connect 100ms
+    timeout server   1s
+    server  spoe-waf-1 127.0.0.1:9000
+{{- end}}
+
 {{- range $b := .Backends}}
 
 backend eg_backend_{{$b.ID}}

internal/haproxy/haproxy.go

@@ -24,6 +24,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/domains"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/routingrules"
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
+	wafsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
 )
 
 //go:embed haproxy.cfg.tpl
@@ -64,25 +65,29 @@ type Generator struct {
 	ServersRepo   *backendservers.Repo
 	RoutingRepo   *routingrules.Repo
 	HeadersRepo   *domainheaders.Repo
+	WafRepo       *wafsvc.Repo
 
 	// SetupStore (optional): wenn gesetzt, lesen wir Whole-Box-
 	// Maintenance-Status hieraus und reichen ihn als View.GlobalMaintenance
 	// ans Template weiter.
 	SetupStore *setup.Store
 
-	OutputPath string
-	SkipReload bool
+	OutputPath     string
+	SPOEConfigPath string
+	SkipReload     bool
 }
 
 func New(pool *pgxpool.Pool) *Generator {
 	return &Generator{
-		Pool:         pool,
-		DomainsRepo:  domains.New(pool),
-		BackendsRepo: backends.New(pool),
-		ServersRepo:  backendservers.New(pool),
-		RoutingRepo:  routingrules.New(pool),
-		HeadersRepo:  domainheaders.New(pool),
-		SetupStore:   setup.NewStore(setup.DefaultDir),
+		Pool:           pool,
+		DomainsRepo:    domains.New(pool),
+		BackendsRepo:   backends.New(pool),
+		ServersRepo:    backendservers.New(pool),
+		RoutingRepo:    routingrules.New(pool),
+		HeadersRepo:    domainheaders.New(pool),
+		WafRepo:        wafsvc.New(pool),
+		SetupStore:     setup.NewStore(setup.DefaultDir),
+		SPOEConfigPath: filepath.Join(configgen.EtcEdgeguard, "haproxy", "coraza-spoe.cfg"),
 	}
 }
 
@@ -116,6 +121,17 @@ func (g *Generator) Render(ctx context.Context) error {
 	if err := configgen.AtomicWrite(out, buf.Bytes(), 0o644); err != nil {
 		return fmt.Errorf("haproxy: write: %w", err)
 	}
+	// Write SPOE config whenever WAF is enabled; remove it when disabled
+	// so HAProxy doesn't fail on a missing backend reference.
+	if view.WAFEnabled {
+		spoeOut := g.SPOEConfigPath
+		if spoeOut == "" {
+			spoeOut = filepath.Join(configgen.EtcEdgeguard, "haproxy", "coraza-spoe.cfg")
+		}
+		if err := configgen.AtomicWrite(spoeOut, []byte(spoeCfg), 0o644); err != nil {
+			return fmt.Errorf("haproxy: write spoe config: %w", err)
+		}
+	}
 	if g.SkipReload {
 		return nil
 	}
@@ -125,6 +141,29 @@ func (g *Generator) Render(ctx context.Context) error {
 	return nil
 }
 
+// spoeCfg is the static SPOE configuration for edgeguard-waf.
+// HAProxy 3.x format: [<engine-name>] section + spoe-agent / spoe-message
+// (no square brackets around spoe-agent/spoe-message keywords).
+// spoeCfg uses `option continue-on-error` so that HAProxy never blocks
+// a request when the SPOE agent is slow or unavailable. Without this,
+// a timeout during CRS engine initialization would block all traffic,
+// including domains without WAF configured.
+const spoeCfg = `# Generated by edgeguard-api. DO NOT EDIT.
+[edgeguard-waf]
+spoe-agent edgeguard-waf-agent
+    messages        edgeguard-waf-req
+    option          var-prefix waf
+    option          continue-on-error
+    timeout         hello      100ms
+    timeout         idle       30s
+    timeout         processing 1s
+    use-backend     spoe-edgeguard-waf
+
+spoe-message edgeguard-waf-req
+    args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host)
+    event on-frontend-http-request
+`
+
 // View is what the template consumes. Routes per domain are pre-
 // joined here so the template can stay declarative; Servers leben pro
 // BackendView, damit das Template einen `backend …`-Block mit den N
@@ -148,6 +187,11 @@ type View struct {
 	// IPv6Enabled: wenn true fügt das Template zusätzliche
 	// bind-Direktiven für [::]:80, [::]:443 und [::]:3443 hinzu.
 	IPv6Enabled bool
+
+	// WAFEnabled: wenn true wird der SPOE-Filter für edgeguard-waf
+	// in public_https eingebunden und das spoe-Backend gerendert.
+	// Wird gesetzt sobald mindestens eine Domain WAF enabled hat.
+	WAFEnabled bool
 }
 
 type DomainView struct {
@@ -289,6 +333,14 @@ func (g *Generator) loadView(ctx context.Context) (*View, error) {
 		}
 	}
 	v := &View{Domains: domViews, Backends: activeBackends, HTTPDomains: httpDomains}
+
+	// Check whether any domain has WAF enabled.
+	if g.WafRepo != nil {
+		if wafEnabled, err := g.WafRepo.ListEnabled(ctx); err == nil {
+			v.WAFEnabled = len(wafEnabled) > 0
+		}
+	}
+
 	if g.SetupStore != nil {
 		if st, err := g.SetupStore.Load(); err == nil && st != nil {
 			v.GlobalMaintenance = st.MaintenanceMode

internal/kea/kea.go

@@ -0,0 +1,235 @@
+// Package kea renders the Kea DHCPv4 server config from the dhcp_*
+// tables and manages the kea-dhcp4-server service lifecycle.
+//
+// The config is built as a Go struct and json-marshalled (NOT a text
+// template) so the output is always syntactically valid JSON. Managed
+// at /etc/edgeguard/kea/kea-dhcp4.conf (edgeguard-owned); postinst
+// symlinks /etc/kea/kea-dhcp4.conf to it.
+//
+// Safety: the service runs ONLY when dhcp_settings.enabled is true on
+// THIS node (a DHCP server is network-sensitive; default off). enabled
+// → enable + restart; disabled → disable + stop.
+package kea
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+	dhcpsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/dhcp"
+)
+
+const (
+	ConfPath    = configgen.EtcEdgeguard + "/kea/kea-dhcp4.conf"
+	serviceName = "kea-dhcp4-server"
+	leaseFile   = "/var/lib/kea/kea-leases4.csv"
+	keaBinary   = "/usr/sbin/kea-dhcp4"
+)
+
+type Generator struct {
+	Pool       *pgxpool.Pool
+	Repo       *dhcpsvc.Repo
+	SkipReload bool
+}
+
+func New(pool *pgxpool.Pool) *Generator {
+	return &Generator{Pool: pool, Repo: dhcpsvc.New(pool)}
+}
+
+func (g *Generator) Name() string { return "kea" }
+
+// ── Kea config JSON shape ────────────────────────────────────────────
+
+type keaConfig struct {
+	Dhcp4 dhcp4 `json:"Dhcp4"`
+}
+type dhcp4 struct {
+	InterfacesConfig ifcfg        `json:"interfaces-config"`
+	LeaseDatabase    leaseDB      `json:"lease-database"`
+	ValidLifetime    int          `json:"valid-lifetime"`
+	MaxValidLifetime int          `json:"max-valid-lifetime"`
+	OptionData       []optionData `json:"option-data,omitempty"`
+	Subnet4          []subnet4    `json:"subnet4"`
+	Loggers          []logger     `json:"loggers"`
+}
+type ifcfg struct {
+	Interfaces []string `json:"interfaces"`
+}
+type leaseDB struct {
+	Type    string `json:"type"`
+	Persist bool   `json:"persist"`
+	Name    string `json:"name"`
+}
+type optionData struct {
+	Name string `json:"name"`
+	Data string `json:"data"`
+}
+type subnet4 struct {
+	ID           int64         `json:"id"`
+	Subnet       string        `json:"subnet"`
+	Pools        []pool        `json:"pools,omitempty"`
+	OptionData   []optionData  `json:"option-data,omitempty"`
+	Reservations []reservation `json:"reservations,omitempty"`
+}
+type pool struct {
+	Pool string `json:"pool"`
+}
+type reservation struct {
+	HWAddress string `json:"hw-address"`
+	IPAddress string `json:"ip-address"`
+	Hostname  string `json:"hostname,omitempty"`
+}
+type logger struct {
+	Name          string   `json:"name"`
+	Severity      string   `json:"severity"`
+	OutputOptions []outOpt `json:"output_options"`
+}
+type outOpt struct {
+	Output string `json:"output"`
+}
+
+// buildConfig assembliert die Kea-Config aus dem DB-State.
+func (g *Generator) buildConfig(ctx context.Context) (*keaConfig, *bool, error) {
+	settings, err := g.Repo.GetSettings(ctx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("get dhcp settings: %w", err)
+	}
+	subnets, err := g.Repo.ListSubnets(ctx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("list subnets: %w", err)
+	}
+	resv, err := g.Repo.ListAllReservations(ctx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("list reservations: %w", err)
+	}
+	bySubnet := map[int64][]reservation{}
+	for _, r := range resv {
+		if !r.Active {
+			continue
+		}
+		bySubnet[r.SubnetID] = append(bySubnet[r.SubnetID], reservation{
+			HWAddress: r.MACAddress, IPAddress: r.IPAddress, Hostname: r.Hostname,
+		})
+	}
+
+	ifaceSet := map[string]bool{}
+	var ifaces []string
+	var sn4 []subnet4
+
+	for _, s := range subnets {
+		if !s.Active {
+			continue
+		}
+		if !ifaceSet[s.InterfaceName] {
+			ifaceSet[s.InterfaceName] = true
+			ifaces = append(ifaces, s.InterfaceName)
+		}
+		sub := subnet4{ID: s.ID, Subnet: s.SubnetCIDR}
+		if s.PoolStart != "" && s.PoolEnd != "" {
+			sub.Pools = []pool{{Pool: s.PoolStart + " - " + s.PoolEnd}}
+		}
+		if s.Gateway != "" {
+			sub.OptionData = append(sub.OptionData, optionData{Name: "routers", Data: s.Gateway})
+		}
+		dns := s.DNSServers
+		if dns == "" {
+			dns = settings.DNSServers
+		}
+		if dns != "" {
+			sub.OptionData = append(sub.OptionData, optionData{Name: "domain-name-servers", Data: normalizeCSV(dns)})
+		}
+		sub.Reservations = bySubnet[s.ID]
+		sn4 = append(sn4, sub)
+	}
+
+	d := dhcp4{
+		InterfacesConfig: ifcfg{Interfaces: ifaces},
+		LeaseDatabase:    leaseDB{Type: "memfile", Persist: true, Name: leaseFile},
+		ValidLifetime:    settings.DefaultLease,
+		MaxValidLifetime: settings.MaxLease,
+		Subnet4:          sn4,
+		Loggers: []logger{{
+			Name: "kea-dhcp4", Severity: "INFO",
+			OutputOptions: []outOpt{{Output: "stdout"}},
+		}},
+	}
+	if settings.DNSServers != "" {
+		d.OptionData = append(d.OptionData, optionData{Name: "domain-name-servers", Data: normalizeCSV(settings.DNSServers)})
+	}
+	if settings.DomainName != "" {
+		d.OptionData = append(d.OptionData, optionData{Name: "domain-name", Data: settings.DomainName})
+	}
+	if d.Subnet4 == nil {
+		d.Subnet4 = []subnet4{}
+	}
+	return &keaConfig{Dhcp4: d}, &settings.Enabled, nil
+}
+
+func (g *Generator) RenderToString(ctx context.Context) (string, error) {
+	cfg, _, err := g.buildConfig(ctx)
+	if err != nil {
+		return "", err
+	}
+	b, err := json.MarshalIndent(cfg, "", "  ")
+	if err != nil {
+		return "", err
+	}
+	return string(b) + "\n", nil
+}
+
+func (g *Generator) Render(ctx context.Context) error {
+	cfg, enabled, err := g.buildConfig(ctx)
+	if err != nil {
+		return err
+	}
+
+	// Default-off / disabled: Service stoppen + disablen, nichts weiter.
+	if enabled == nil || !*enabled {
+		if g.SkipReload {
+			return nil
+		}
+		_ = configgen.DisableService(serviceName)
+		_ = configgen.StopService(serviceName)
+		return nil
+	}
+
+	b, err := json.MarshalIndent(cfg, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := configgen.AtomicWrite(ConfPath, append(b, '\n'), 0o644); err != nil {
+		return fmt.Errorf("write kea config: %w", err)
+	}
+	if g.SkipReload {
+		return nil
+	}
+	// Best-effort Config-Test (verhindert Restart mit kaputter Semantik).
+	if _, statErr := os.Stat(keaBinary); statErr == nil {
+		if out, terr := exec.Command(keaBinary, "-t", ConfPath).CombinedOutput(); terr != nil {
+			return fmt.Errorf("kea-dhcp4 -t rejected config: %w (output: %s)", terr, strings.TrimSpace(string(out)))
+		}
+	}
+	if err := configgen.EnableService(serviceName); err != nil {
+		return err
+	}
+	return configgen.RestartService(serviceName)
+}
+
+// normalizeCSV trimmt Whitespace um Komma-getrennte Werte (Kea will
+// "a,b,c" ohne Leerzeichen-Toleranz-Probleme).
+func normalizeCSV(s string) string {
+	parts := strings.Split(s, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if t := strings.TrimSpace(p); t != "" {
+			out = append(out, t)
+		}
+	}
+	return strings.Join(out, ",")
+}

internal/kea/kea_test.go

@@ -0,0 +1,89 @@
+package kea
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+)
+
+// Guarded integration test: set EG_FWTEST_DSN (sonst skip).
+func TestRender_DHCPConfig(t *testing.T) {
+	dsn := os.Getenv("EG_FWTEST_DSN")
+	if dsn == "" {
+		t.Skip("set EG_FWTEST_DSN to run the kea renderer test")
+	}
+	ctx := context.Background()
+	var mErr error
+	for i := 0; i < 3; i++ {
+		if mErr = database.Migrate(ctx, dsn); mErr == nil {
+			break
+		}
+		time.Sleep(700 * time.Millisecond)
+	}
+	if mErr != nil {
+		t.Fatalf("migrate: %v", mErr)
+	}
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	defer pool.Close()
+
+	for _, q := range []string{
+		`DELETE FROM dhcp_reservations`,
+		`DELETE FROM dhcp_subnets`,
+		`UPDATE dhcp_settings SET enabled=true, default_lease=3600, max_lease=7200, domain_name='lan', dns_servers='1.1.1.1, 8.8.8.8' WHERE id=1`,
+	} {
+		if _, err := pool.Exec(ctx, q); err != nil {
+			t.Fatalf("seed (%s): %v", q, err)
+		}
+	}
+	var subID int64
+	if err := pool.QueryRow(ctx, `
+INSERT INTO dhcp_subnets (name, interface_name, subnet_cidr, pool_start, pool_end, gateway, dns_servers, active)
+VALUES ('lan','eth1','10.0.0.0/24','10.0.0.100','10.0.0.200','10.0.0.1','',true) RETURNING id`).Scan(&subID); err != nil {
+		t.Fatalf("seed subnet: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+INSERT INTO dhcp_reservations (subnet_id, mac_address, ip_address, hostname, active)
+VALUES ($1,'aa:bb:cc:dd:ee:ff','10.0.0.50','printer',true)`, subID); err != nil {
+		t.Fatalf("seed reservation: %v", err)
+	}
+
+	out, err := New(pool).RenderToString(ctx)
+	if err != nil {
+		t.Fatalf("render: %v", err)
+	}
+	if !json.Valid([]byte(out)) {
+		t.Fatalf("rendered config is not valid JSON:\n%s", out)
+	}
+	for _, want := range []string{
+		`"10.0.0.0/24"`,
+		`"10.0.0.100 - 10.0.0.200"`,
+		`"aa:bb:cc:dd:ee:ff"`,
+		`"routers"`,
+		`"eth1"`,
+		`"hw-address"`,
+		`"valid-lifetime": 3600`,
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("rendered config missing %q\n----\n%s", want, out)
+		}
+	}
+
+	// Best-effort: echte Kea-Validierung, falls die Binary da ist.
+	if _, statErr := os.Stat(keaBinary); statErr == nil {
+		f, _ := os.CreateTemp(t.TempDir(), "kea-*.conf")
+		_, _ = f.WriteString(out)
+		f.Close()
+		if combined, err := exec.Command(keaBinary, "-t", f.Name()).CombinedOutput(); err != nil {
+			t.Fatalf("kea-dhcp4 -t rejected rendered config: %v\n%s", err, combined)
+		}
+	}
+}

internal/keepalived/keepalived.conf.tpl

@@ -0,0 +1,72 @@
+global_defs {
+    router_id {{ .RouterID }}
+    script_user root
+    enable_script_security
+}
+
+vrrp_script chk_edgeguard {
+    script "/usr/lib/edgeguard/keepalived-check.sh"
+    interval 2
+    weight -50
+    fall 3
+    rise 2
+}
+{{ if .GWCheckIP }}
+vrrp_script chk_gateway {
+    script "/usr/lib/edgeguard/keepalived-gw-check.sh {{ .GWCheckIP }}"
+    interval 5
+    weight -110
+    fall 2
+    rise 2
+}
+{{ end }}
+{{ if .HBInterface }}
+vrrp_sync_group VG_1 {
+    group {
+        VI_1
+        VI_HB
+    }
+}
+{{ end }}
+vrrp_instance VI_1 {
+    state {{ .State }}
+    interface {{ .Interface }}
+    virtual_router_id {{ .RouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .SrcIP }}    unicast_src_ip {{ .SrcIP }}
+    unicast_peer {
+        {{ .PeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+    virtual_ipaddress {
+{{ range .VIPs }}        {{ .Address }}/{{ .Prefix }} dev {{ .Device }}
+{{ end }}    }
+    track_script {
+        chk_edgeguard
+{{ if .GWCheckIP }}        chk_gateway
+{{ end }}    }
+    notify_master  "/usr/lib/edgeguard/keepalived-master.sh"
+    notify_backup  "/usr/lib/edgeguard/keepalived-backup.sh"
+    notify_fault   "/usr/lib/edgeguard/keepalived-backup.sh"
+}
+{{ if .HBInterface }}
+vrrp_instance VI_HB {
+    state {{ .State }}
+    interface {{ .HBInterface }}
+    virtual_router_id {{ .HBRouterID }}
+    priority {{ .Priority }}
+    advert_int 1
+{{ if .HBSrcIP }}    unicast_src_ip {{ .HBSrcIP }}
+    unicast_peer {
+        {{ .HBPeerIP }}
+    }
+{{ end }}    authentication {
+        auth_type PASS
+        auth_pass {{ .AuthPass }}
+    }
+}
+{{ end }}

internal/keepalived/keepalived.go

@@ -0,0 +1,210 @@
+// Package keepalived rendert /etc/keepalived/keepalived.conf aus
+// cluster_settings (VIP/VRRP-Config) und ha_nodes (local vs. peer).
+//
+// Split-Brain-Strategie: kein Auto-Promote. notify_master loggt nur
+// und sendet einen internen Alert. Promotion ist immer manuell via
+// "edgeguard-ctl promote" — das ist die einzig sichere Option ohne
+// externes Quorum in einem 2-Node-Cluster.
+package keepalived
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"text/template"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const ConfPath = "/etc/keepalived/keepalived.conf"
+
+//go:embed keepalived.conf.tpl
+var cfgTpl string
+
+var tpl = template.Must(template.New("keepalived").Parse(cfgTpl))
+
+// VIPEntry ist eine einzelne VIP-Adresse die keepalived verwaltet.
+type VIPEntry struct {
+	Address string // z.B. 89.163.205.100
+	Prefix  int    // z.B. 24
+	Device  string // z.B. eth0
+}
+
+// View ist der Template-Kontext.
+type View struct {
+	State     string // MASTER | BACKUP
+	Interface string // Interface für VRRP-Advertisements (VI_1)
+	RouterID  int
+	Priority  int    // MASTER=200, BACKUP=100
+	SrcIP     string // eigene Public-IP (unicast_src_ip)
+	PeerIP    string // Peer-Public-IP (unicast_peer)
+	AuthPass  string
+	VIPs      []VIPEntry // alle is_vip=true Einträge aus ip_addresses
+	// Dual-path VRRP (Split-Brain-Schutz, Migration 0033)
+	HBInterface string
+	HBSrcIP     string
+	HBPeerIP    string
+	HBRouterID  int
+	// GW-Tracking
+	GWCheckIP string
+}
+
+type generator struct {
+	pool    *pgxpool.Pool
+	localID string
+}
+
+func New(pool *pgxpool.Pool, localID string) configgen.Generator {
+	return &generator{pool: pool, localID: localID}
+}
+
+func (g *generator) Name() string { return "keepalived" }
+
+func (g *generator) Render(ctx context.Context) error {
+	cs, vips, local, peer, err := g.loadData(ctx)
+	if err != nil {
+		return fmt.Errorf("keepalived: load: %w", err)
+	}
+	if len(vips) == 0 {
+		// Keine VIPs konfiguriert → keepalived.conf nicht schreiben.
+		return nil
+	}
+	v := g.buildView(cs, vips, local, peer)
+	var buf bytes.Buffer
+	if err := tpl.Execute(&buf, v); err != nil {
+		return fmt.Errorf("keepalived: template: %w", err)
+	}
+	if err := configgen.AtomicWrite(ConfPath, buf.Bytes(), 0o640); err != nil {
+		return fmt.Errorf("keepalived: write: %w", err)
+	}
+	if err := reloadKeepalived(); err != nil {
+		return fmt.Errorf("keepalived: reload: %w", err)
+	}
+	return nil
+}
+
+func (g *generator) loadData(ctx context.Context) (*models.ClusterSettings, []VIPEntry, *models.HANode, *models.HANode, error) {
+	var cs models.ClusterSettings
+	row := g.pool.QueryRow(ctx, `
+		SELECT id, vip_address, vip_interface, vip_auth_pass, vrrp_router_id,
+		       hb_interface, hb_src_ip, hb_peer_ip, hb_router_id, gw_check_ip
+		FROM cluster_settings WHERE id = 1`)
+	if err := row.Scan(&cs.ID, &cs.VIPAddress, &cs.VIPInterface, &cs.VIPAuthPass, &cs.VRRPRouterID,
+		&cs.HBInterface, &cs.HBSrcIP, &cs.HBPeerIP, &cs.HBRouterID, &cs.GWCheckIP); err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("cluster_settings: %w", err)
+	}
+
+	// Alle VIPs aus ip_addresses (is_vip=true, active=true) inkl. Interface-Name.
+	vipRows, err := g.pool.Query(ctx, `
+		SELECT ia.address, ia.prefix, ni.name
+		FROM ip_addresses ia
+		JOIN network_interfaces ni ON ia.interface_id = ni.id
+		WHERE ia.is_vip = true AND ia.active = true
+		ORDER BY ni.name, ia.address`)
+	if err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("ip_addresses: %w", err)
+	}
+	defer vipRows.Close()
+	var vips []VIPEntry
+	for vipRows.Next() {
+		var v VIPEntry
+		if err := vipRows.Scan(&v.Address, &v.Prefix, &v.Device); err != nil {
+			continue
+		}
+		vips = append(vips, v)
+	}
+
+	nodeRows, err := g.pool.Query(ctx, `SELECT id, fqdn, role, pg_role, public_ip, status FROM ha_nodes ORDER BY joined_at`)
+	if err != nil {
+		return nil, nil, nil, nil, fmt.Errorf("ha_nodes: %w", err)
+	}
+	defer nodeRows.Close()
+
+	var local, peer *models.HANode
+	for nodeRows.Next() {
+		n := &models.HANode{}
+		if err := nodeRows.Scan(&n.ID, &n.FQDN, &n.Role, &n.PGRole, &n.PublicIP, &n.Status); err != nil {
+			continue
+		}
+		if n.ID == g.localID {
+			local = n
+		} else {
+			peer = n
+		}
+	}
+	if local == nil {
+		return nil, nil, nil, nil, fmt.Errorf("local node %s not in ha_nodes", g.localID)
+	}
+	return &cs, vips, local, peer, nil
+}
+
+func (g *generator) buildView(cs *models.ClusterSettings, vips []VIPEntry, local, peer *models.HANode) View {
+	v := View{
+		RouterID:    cs.VRRPRouterID,
+		VIPs:        vips,
+		Interface:   deref(cs.VIPInterface),
+		AuthPass:    deref(cs.VIPAuthPass),
+		HBInterface: deref(cs.HBInterface),
+		HBSrcIP:     deref(cs.HBSrcIP),
+		HBPeerIP:    deref(cs.HBPeerIP),
+		HBRouterID:  cs.HBRouterID,
+		GWCheckIP:   deref(cs.GWCheckIP),
+	}
+	if v.Interface == "" {
+		v.Interface = "eth0"
+	}
+	if v.AuthPass == "" {
+		v.AuthPass = "edgeguard"
+	}
+	if v.HBRouterID == 0 {
+		v.HBRouterID = 52
+	}
+
+	// pg_role=standby ist das härtere Signal — ein Standby-Node ist niemals
+	// MASTER, auch wenn role='primary' noch aus dem Join-Prozess stammt.
+	// Reihenfolge: standby → BACKUP; sonst primary-Check.
+	if local.PGRole == "standby" {
+		v.State = "BACKUP"
+		v.Priority = 100
+	} else if local.PGRole == "primary" || local.Role == "primary" {
+		v.State = "MASTER"
+		v.Priority = 200
+	} else {
+		v.State = "BACKUP"
+		v.Priority = 100
+	}
+
+	if local.PublicIP != nil {
+		v.SrcIP = *local.PublicIP
+	}
+	if peer != nil && peer.PublicIP != nil {
+		v.PeerIP = *peer.PublicIP
+	}
+	return v
+}
+
+func reloadKeepalived() error {
+	if _, err := os.Stat("/run/keepalived.pid"); os.IsNotExist(err) {
+		// keepalived läuft noch nicht — erster Render beim Start.
+		return nil
+	}
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "reload-or-restart", "keepalived.service")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("sudo systemctl reload-or-restart keepalived.service: %w (output: %s)", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+func deref(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}

internal/models/cluster_settings.go

@@ -0,0 +1,24 @@
+package models
+
+import "time"
+
+// ClusterSettings ist die Singleton-Tabelle (id=1) für VIP/VRRP-
+// und Replikations-Konfiguration. Angelegt in Migration 0029.
+// hb_* = zweite VRRP-Instanz für Split-Brain-Schutz (0033).
+// gw_check_ip = Gateway-IP für vrrp_script chk_gateway (0033).
+type ClusterSettings struct {
+	ID           int       `gorm:"column:id;primaryKey"   json:"id"`
+	VIPAddress   *string   `gorm:"column:vip_address"     json:"vip_address,omitempty"`
+	VIPInterface *string   `gorm:"column:vip_interface"   json:"vip_interface,omitempty"`
+	VIPAuthPass  *string   `gorm:"column:vip_auth_pass"   json:"vip_auth_pass,omitempty"`
+	VRRPRouterID int       `gorm:"column:vrrp_router_id"  json:"vrrp_router_id"`
+	HBInterface  *string   `gorm:"column:hb_interface"    json:"hb_interface,omitempty"`
+	HBSrcIP      *string   `gorm:"column:hb_src_ip"       json:"hb_src_ip,omitempty"`
+	HBPeerIP     *string   `gorm:"column:hb_peer_ip"      json:"hb_peer_ip,omitempty"`
+	HBRouterID   int       `gorm:"column:hb_router_id"    json:"hb_router_id"`
+	GWCheckIP    *string   `gorm:"column:gw_check_ip"     json:"gw_check_ip,omitempty"`
+	CreatedAt    time.Time `gorm:"column:created_at"      json:"created_at"`
+	UpdatedAt    time.Time `gorm:"column:updated_at"      json:"updated_at"`
+}
+
+func (ClusterSettings) TableName() string { return "cluster_settings" }

internal/models/dhcp.go

@@ -0,0 +1,53 @@
+package models
+
+import "time"
+
+// DHCPSettings ist die node-lokale Singleton-Konfiguration des Kea-DHCPv4-
+// Servers (ob diese Node DHCP betreibt + globale Defaults).
+type DHCPSettings struct {
+	ID           int       `gorm:"column:id;primaryKey"   json:"id"`
+	Enabled      bool      `gorm:"column:enabled"         json:"enabled"`
+	DefaultLease int       `gorm:"column:default_lease"   json:"default_lease"`
+	MaxLease     int       `gorm:"column:max_lease"       json:"max_lease"`
+	DomainName   string    `gorm:"column:domain_name"     json:"domain_name"`
+	DNSServers   string    `gorm:"column:dns_servers"     json:"dns_servers"`
+	CreatedAt    time.Time `gorm:"column:created_at"      json:"created_at"`
+	UpdatedAt    time.Time `gorm:"column:updated_at"      json:"updated_at"`
+}
+
+func (DHCPSettings) TableName() string { return "dhcp_settings" }
+
+// DHCPSubnet ist ein vom DHCP-Server bedientes Subnetz (an ein Interface
+// per NAME gebunden — cluster-sicher, da interface_id node-lokal wäre).
+type DHCPSubnet struct {
+	ID            int64     `gorm:"column:id;primaryKey"      json:"id"`
+	Name          string    `gorm:"column:name"               json:"name"`
+	InterfaceName string    `gorm:"column:interface_name"     json:"interface_name"`
+	SubnetCIDR    string    `gorm:"column:subnet_cidr"        json:"subnet_cidr"`
+	PoolStart     string    `gorm:"column:pool_start"         json:"pool_start"`
+	PoolEnd       string    `gorm:"column:pool_end"           json:"pool_end"`
+	Gateway       string    `gorm:"column:gateway"            json:"gateway"`
+	DNSServers    string    `gorm:"column:dns_servers"        json:"dns_servers"`
+	LeaseTime     *int      `gorm:"column:lease_time"         json:"lease_time,omitempty"`
+	Active        bool      `gorm:"column:active"             json:"active"`
+	Description   string    `gorm:"column:description"        json:"description"`
+	CreatedAt     time.Time `gorm:"column:created_at"         json:"created_at"`
+	UpdatedAt     time.Time `gorm:"column:updated_at"         json:"updated_at"`
+}
+
+func (DHCPSubnet) TableName() string { return "dhcp_subnets" }
+
+// DHCPReservation ist eine statische MAC→IP-Zuordnung innerhalb eines Subnets.
+type DHCPReservation struct {
+	ID         int64     `gorm:"column:id;primaryKey"   json:"id"`
+	SubnetID   int64     `gorm:"column:subnet_id"       json:"subnet_id"`
+	Name       string    `gorm:"column:name"            json:"name"`
+	MACAddress string    `gorm:"column:mac_address"     json:"mac_address"`
+	IPAddress  string    `gorm:"column:ip_address"      json:"ip_address"`
+	Hostname   string    `gorm:"column:hostname"        json:"hostname"`
+	Active     bool      `gorm:"column:active"          json:"active"`
+	CreatedAt  time.Time `gorm:"column:created_at"      json:"created_at"`
+	UpdatedAt  time.Time `gorm:"column:updated_at"      json:"updated_at"`
+}
+
+func (DHCPReservation) TableName() string { return "dhcp_reservations" }

internal/models/dns.go

@@ -40,16 +40,20 @@ func (DNSRecord) TableName() string { return "dns_records" }
 // Optionen. Default kommt aus der Migration (alle Werte sinnvoll
 // für die typische LAN-Resolver-Rolle).
 type DNSSettings struct {
-	ID                int64     `gorm:"primaryKey"                  json:"id"`
-	ListenAddresses   string    `gorm:"column:listen_addresses"     json:"listen_addresses"`
-	ListenPort        int       `gorm:"column:listen_port"          json:"listen_port"`
-	UpstreamForwards  string    `gorm:"column:upstream_forwards"    json:"upstream_forwards"`
-	AccessACL         string    `gorm:"column:access_acl"           json:"access_acl"`
-	DNSSEC            bool      `gorm:"column:dnssec"               json:"dnssec"`
-	QNameMinimisation bool      `gorm:"column:qname_minimisation"   json:"qname_minimisation"`
-	CacheMinTTL       int       `gorm:"column:cache_min_ttl"        json:"cache_min_ttl"`
-	CacheMaxTTL       int       `gorm:"column:cache_max_ttl"        json:"cache_max_ttl"`
-	UpdatedAt         time.Time `gorm:"column:updated_at"           json:"updated_at"`
+	ID                int64     `gorm:"primaryKey"                    json:"id"`
+	ListenAddresses   string    `gorm:"column:listen_addresses"       json:"listen_addresses"`
+	ListenPort        int       `gorm:"column:listen_port"            json:"listen_port"`
+	UpstreamForwards  string    `gorm:"column:upstream_forwards"      json:"upstream_forwards"`
+	AccessACL         string    `gorm:"column:access_acl"             json:"access_acl"`
+	DNSSEC            bool      `gorm:"column:dnssec"                 json:"dnssec"`
+	QNameMinimisation bool      `gorm:"column:qname_minimisation"     json:"qname_minimisation"`
+	CacheMinTTL       int       `gorm:"column:cache_min_ttl"          json:"cache_min_ttl"`
+	CacheMaxTTL       int       `gorm:"column:cache_max_ttl"          json:"cache_max_ttl"`
+	Prefetch          bool      `gorm:"column:prefetch"               json:"prefetch"`
+	ServeExpired      bool      `gorm:"column:serve_expired"          json:"serve_expired"`
+	MsgCacheSizeMB    int       `gorm:"column:msg_cache_size_mb"      json:"msg_cache_size_mb"`
+	RRSetCacheSizeMB  int       `gorm:"column:rrset_cache_size_mb"    json:"rrset_cache_size_mb"`
+	UpdatedAt         time.Time `gorm:"column:updated_at"             json:"updated_at"`
 }
 
 func (DNSSettings) TableName() string { return "dns_settings" }

internal/models/firewall_nat_rule.go

@@ -33,6 +33,8 @@ type FirewallNATRule struct {
 	TargetPortEnd   *int      `gorm:"column:target_port_end"      json:"target_port_end,omitempty"`
 
 	Comment         *string   `gorm:"column:comment"              json:"comment,omitempty"`
+	Note            *string   `gorm:"column:note"                 json:"note,omitempty"`
+	Labels          []string  `gorm:"column:labels"               json:"labels"`
 	CreatedAt       time.Time `gorm:"column:created_at"           json:"created_at"`
 	UpdatedAt       time.Time `gorm:"column:updated_at"           json:"updated_at"`
 }

internal/models/firewall_rule.go

@@ -36,6 +36,8 @@ type FirewallRule struct {
 
 	Log                 bool      `gorm:"column:log"                       json:"log"`
 	Comment             *string   `gorm:"column:comment"                   json:"comment,omitempty"`
+	Note                *string   `gorm:"column:note"                      json:"note,omitempty"`
+	Labels              []string  `gorm:"column:labels;serializer:json"    json:"labels"`
 	CreatedAt           time.Time `gorm:"column:created_at"                json:"created_at"`
 	UpdatedAt           time.Time `gorm:"column:updated_at"                json:"updated_at"`
 }

internal/models/forward_proxy_settings.go

@@ -0,0 +1,19 @@
+package models
+
+import "time"
+
+type ForwardProxySettings struct {
+	ID              int       `gorm:"primaryKey"              json:"id"`
+	ListenAddresses string    `gorm:"column:listen_addresses" json:"listen_addresses"`
+	ListenPort      int       `gorm:"column:listen_port"      json:"listen_port"`
+	CacheMemMB      int       `gorm:"column:cache_mem_mb"     json:"cache_mem_mb"`
+	CacheDirMB      int       `gorm:"column:cache_dir_mb"     json:"cache_dir_mb"`
+	MaxObjSizeMB    int       `gorm:"column:max_obj_size_mb"  json:"max_obj_size_mb"`
+	ConnectTimeout  int       `gorm:"column:connect_timeout"  json:"connect_timeout"`
+	ReadTimeout     int       `gorm:"column:read_timeout"     json:"read_timeout"`
+	RequestTimeout  int       `gorm:"column:request_timeout"  json:"request_timeout"`
+	CreatedAt       time.Time `gorm:"column:created_at"       json:"created_at"`
+	UpdatedAt       time.Time `gorm:"column:updated_at"       json:"updated_at"`
+}
+
+func (ForwardProxySettings) TableName() string { return "forward_proxy_settings" }

internal/models/ha_node.go

@@ -4,7 +4,7 @@ import "time"
 
 // HANode mirrort eine Row der ha_nodes-Tabelle. Erweitert in Migration
 // 0020 um version/config_hash/mgmt_ip/status für Cluster-Phase-3-
-// Drift-Detection + Health-State.
+// Drift-Detection + Health-State. Migration 0029 fügt PGRole hinzu.
 type HANode struct {
 	ID         string     `gorm:"column:id;primaryKey"           json:"id"`
 	Name       string     `gorm:"column:name"                    json:"name"`
@@ -14,6 +14,7 @@ type HANode struct {
 	InternalIP *string    `gorm:"column:internal_ip;type:inet"   json:"internal_ip,omitempty"`
 	MgmtIP     *string    `gorm:"column:mgmt_ip;type:inet"       json:"mgmt_ip,omitempty"`
 	Role       string     `gorm:"column:role"                    json:"role"`
+	PGRole     string     `gorm:"column:pg_role"                 json:"pg_role"`
 	Version    *string    `gorm:"column:version"                 json:"version,omitempty"`
 	ConfigHash *string    `gorm:"column:config_hash"             json:"config_hash,omitempty"`
 	Status     string     `gorm:"column:status"                  json:"status"`

internal/models/oidc_settings.go

@@ -0,0 +1,21 @@
+package models
+
+import "time"
+
+// OIDCSettings ist die Singleton-Konfiguration für OIDC/Keycloak-SSO.
+// ClientSecretEnc trägt den verschlüsselten Client-Secret (secrets.Box)
+// und wird NIE serialisiert (json:"-").
+type OIDCSettings struct {
+	ID              int       `gorm:"column:id;primaryKey"        json:"id"`
+	Enabled         bool      `gorm:"column:enabled"              json:"enabled"`
+	IssuerURL       string    `gorm:"column:issuer_url"           json:"issuer_url"`
+	ClientID        string    `gorm:"column:client_id"            json:"client_id"`
+	ClientSecretEnc []byte    `gorm:"column:client_secret_enc"    json:"-"`
+	Scopes          string    `gorm:"column:scopes"               json:"scopes"`
+	EmailClaim      string    `gorm:"column:email_claim"          json:"email_claim"`
+	ButtonLabel     string    `gorm:"column:button_label"         json:"button_label"`
+	CreatedAt       time.Time `gorm:"column:created_at"           json:"created_at"`
+	UpdatedAt       time.Time `gorm:"column:updated_at"           json:"updated_at"`
+}
+
+func (OIDCSettings) TableName() string { return "oidc_settings" }

internal/models/waf.go

@@ -0,0 +1,20 @@
+package models
+
+import "time"
+
+// WafConfig holds the per-domain WAF policy.
+// Default on creation: enabled=false, mode=detection, paranoia_level=1.
+type WafConfig struct {
+	ID               int64             `gorm:"primaryKey"                   json:"id"`
+	DomainID         int64             `gorm:"column:domain_id;uniqueIndex"  json:"domain_id"`
+	Enabled          bool              `gorm:"column:enabled"               json:"enabled"`
+	Mode             string            `gorm:"column:mode"                  json:"mode"`           // "detection" | "blocking"
+	ParanoiaLevel    int               `gorm:"column:paranoia_level"        json:"paranoia_level"` // 1–4
+	RuleExclusions   []string          `gorm:"column:rule_exclusions;type:text[]" json:"rule_exclusions"`
+	ExclusionNotes   map[string]string `gorm:"column:exclusion_notes;type:jsonb"  json:"exclusion_notes"` // rule_id → note
+	TrustedProxies   []string          `gorm:"column:trusted_proxies;type:text[]" json:"trusted_proxies"`
+	CustomRules      string            `gorm:"column:custom_rules"          json:"custom_rules"`
+	UpdatedAt        time.Time         `gorm:"column:updated_at"            json:"updated_at"`
+}
+
+func (WafConfig) TableName() string { return "waf_configs" }

internal/services/clusterjoin/join.go

@@ -128,7 +128,7 @@ func Join(req Request) error {
 	// synchronous on the primary side.
 	var autoRegErr error
 	for i := 0; i < 3; i++ {
-		if err := autoRegister(primary, tlsDir, req.CommonName, req.Version, req.NodeID); err == nil {
+		if err := autoRegister(primary, tlsDir, req.CommonName, req.Version, req.NodeID, ""); err == nil {
 			autoRegErr = nil
 			break
 		} else {
@@ -217,7 +217,18 @@ func issueCert(primary, token, csr string, insecure bool) (caCert, peerCert stri
 	return env.Data.CACert, env.Data.PeerCert, nil
 }
 
-func autoRegister(primary, tlsDir, commonName, version, nodeID string) error {
+// PushSelfToPrimary sends this node's current identity + configHash to the
+// primary via mTLS. Exported for use by the API server's periodic push
+// goroutine so the primary's ha_nodes always reflects the secondary's actual
+// config_hash (not the stale join-time value).
+func PushSelfToPrimary(primaryURL, tlsDir, nodeID, fqdn, version, configHash string) error {
+	if tlsDir == "" {
+		tlsDir = clustertls.DefaultDir
+	}
+	return autoRegister(primaryURL, tlsDir, fqdn, version, nodeID, configHash)
+}
+
+func autoRegister(primary, tlsDir, commonName, version, nodeID, configHash string) error {
 	u, err := url.Parse(primary)
 	if err != nil {
 		return err
@@ -231,11 +242,12 @@ func autoRegister(primary, tlsDir, commonName, version, nodeID string) error {
 	}
 	hostname, _ := os.Hostname()
 	body, _ := json.Marshal(map[string]string{
-		"id":      nodeID,
-		"name":    hostname,
-		"fqdn":    commonName,
-		"api_url": "https://" + commonName + ":3443",
-		"version": version,
+		"id":          nodeID,
+		"name":        hostname,
+		"fqdn":        commonName,
+		"api_url":     "https://" + commonName + ":3443",
+		"version":     version,
+		"config_hash": configHash,
 	})
 
 	pair, err := tls.LoadX509KeyPair(tlsDir+"/peer.crt", tlsDir+"/peer.key")

internal/services/dhcp/dhcp.go

@@ -0,0 +1,238 @@
+// Package dhcp provides CRUD against the dhcp_settings (singleton),
+// dhcp_subnets, and dhcp_reservations tables. The Kea config renderer
+// in internal/kea consumes these.
+package dhcp
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+var (
+	ErrSubnetNotFound      = errors.New("dhcp subnet not found")
+	ErrReservationNotFound = errors.New("dhcp reservation not found")
+)
+
+type Repo struct {
+	Pool *pgxpool.Pool
+}
+
+func New(pool *pgxpool.Pool) *Repo { return &Repo{Pool: pool} }
+
+// ── Settings (singleton id=1) ────────────────────────────────────────
+
+func (r *Repo) GetSettings(ctx context.Context) (*models.DHCPSettings, error) {
+	var s models.DHCPSettings
+	if err := r.Pool.QueryRow(ctx, `
+SELECT id, enabled, default_lease, max_lease, domain_name, dns_servers, created_at, updated_at
+FROM dhcp_settings WHERE id=1`).Scan(
+		&s.ID, &s.Enabled, &s.DefaultLease, &s.MaxLease, &s.DomainName, &s.DNSServers,
+		&s.CreatedAt, &s.UpdatedAt,
+	); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+func (r *Repo) UpdateSettings(ctx context.Context, s models.DHCPSettings) (*models.DHCPSettings, error) {
+	row := r.Pool.QueryRow(ctx, `
+UPDATE dhcp_settings
+   SET enabled=$1, default_lease=$2, max_lease=$3, domain_name=$4, dns_servers=$5, updated_at=NOW()
+ WHERE id=1
+RETURNING id, enabled, default_lease, max_lease, domain_name, dns_servers, created_at, updated_at`,
+		s.Enabled, s.DefaultLease, s.MaxLease, s.DomainName, s.DNSServers)
+	var out models.DHCPSettings
+	if err := row.Scan(&out.ID, &out.Enabled, &out.DefaultLease, &out.MaxLease,
+		&out.DomainName, &out.DNSServers, &out.CreatedAt, &out.UpdatedAt); err != nil {
+		return nil, err
+	}
+	return &out, nil
+}
+
+// ── Subnets ──────────────────────────────────────────────────────────
+
+const subnetCols = `id, name, interface_name, subnet_cidr, pool_start, pool_end,
+       gateway, dns_servers, lease_time, active, description, created_at, updated_at`
+
+func scanSubnet(row pgx.Row) (*models.DHCPSubnet, error) {
+	var s models.DHCPSubnet
+	if err := row.Scan(&s.ID, &s.Name, &s.InterfaceName, &s.SubnetCIDR, &s.PoolStart,
+		&s.PoolEnd, &s.Gateway, &s.DNSServers, &s.LeaseTime, &s.Active, &s.Description,
+		&s.CreatedAt, &s.UpdatedAt); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+func (r *Repo) ListSubnets(ctx context.Context) ([]models.DHCPSubnet, error) {
+	rows, err := r.Pool.Query(ctx, `SELECT `+subnetCols+` FROM dhcp_subnets ORDER BY name ASC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]models.DHCPSubnet, 0, 8)
+	for rows.Next() {
+		s, err := scanSubnet(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *s)
+	}
+	return out, rows.Err()
+}
+
+func (r *Repo) GetSubnet(ctx context.Context, id int64) (*models.DHCPSubnet, error) {
+	s, err := scanSubnet(r.Pool.QueryRow(ctx, `SELECT `+subnetCols+` FROM dhcp_subnets WHERE id=$1`, id))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrSubnetNotFound
+		}
+		return nil, err
+	}
+	return s, nil
+}
+
+func (r *Repo) CreateSubnet(ctx context.Context, s models.DHCPSubnet) (*models.DHCPSubnet, error) {
+	return scanSubnet(r.Pool.QueryRow(ctx, `
+INSERT INTO dhcp_subnets (name, interface_name, subnet_cidr, pool_start, pool_end,
+       gateway, dns_servers, lease_time, active, description)
+VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)
+RETURNING `+subnetCols,
+		s.Name, s.InterfaceName, s.SubnetCIDR, s.PoolStart, s.PoolEnd,
+		s.Gateway, s.DNSServers, s.LeaseTime, s.Active, s.Description))
+}
+
+func (r *Repo) UpdateSubnet(ctx context.Context, id int64, s models.DHCPSubnet) (*models.DHCPSubnet, error) {
+	out, err := scanSubnet(r.Pool.QueryRow(ctx, `
+UPDATE dhcp_subnets
+   SET name=$1, interface_name=$2, subnet_cidr=$3, pool_start=$4, pool_end=$5,
+       gateway=$6, dns_servers=$7, lease_time=$8, active=$9, description=$10, updated_at=NOW()
+ WHERE id=$11
+RETURNING `+subnetCols,
+		s.Name, s.InterfaceName, s.SubnetCIDR, s.PoolStart, s.PoolEnd,
+		s.Gateway, s.DNSServers, s.LeaseTime, s.Active, s.Description, id))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrSubnetNotFound
+		}
+		return nil, err
+	}
+	return out, nil
+}
+
+func (r *Repo) DeleteSubnet(ctx context.Context, id int64) error {
+	tag, err := r.Pool.Exec(ctx, `DELETE FROM dhcp_subnets WHERE id=$1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrSubnetNotFound
+	}
+	return nil
+}
+
+// ── Reservations ─────────────────────────────────────────────────────
+
+const resvCols = `id, subnet_id, name, mac_address, ip_address, hostname, active, created_at, updated_at`
+
+func scanResv(row pgx.Row) (*models.DHCPReservation, error) {
+	var r models.DHCPReservation
+	if err := row.Scan(&r.ID, &r.SubnetID, &r.Name, &r.MACAddress, &r.IPAddress,
+		&r.Hostname, &r.Active, &r.CreatedAt, &r.UpdatedAt); err != nil {
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (r *Repo) ListAllReservations(ctx context.Context) ([]models.DHCPReservation, error) {
+	rows, err := r.Pool.Query(ctx, `SELECT `+resvCols+` FROM dhcp_reservations ORDER BY subnet_id, ip_address`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]models.DHCPReservation, 0, 16)
+	for rows.Next() {
+		v, err := scanResv(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *v)
+	}
+	return out, rows.Err()
+}
+
+func (r *Repo) ListReservationsForSubnet(ctx context.Context, subnetID int64) ([]models.DHCPReservation, error) {
+	rows, err := r.Pool.Query(ctx, `SELECT `+resvCols+` FROM dhcp_reservations WHERE subnet_id=$1 ORDER BY ip_address`, subnetID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]models.DHCPReservation, 0, 8)
+	for rows.Next() {
+		v, err := scanResv(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *v)
+	}
+	return out, rows.Err()
+}
+
+func (r *Repo) GetReservation(ctx context.Context, id int64) (*models.DHCPReservation, error) {
+	v, err := scanResv(r.Pool.QueryRow(ctx, `SELECT `+resvCols+` FROM dhcp_reservations WHERE id=$1`, id))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrReservationNotFound
+		}
+		return nil, err
+	}
+	return v, nil
+}
+
+func (r *Repo) CreateReservation(ctx context.Context, v models.DHCPReservation) (*models.DHCPReservation, error) {
+	return scanResv(r.Pool.QueryRow(ctx, `
+INSERT INTO dhcp_reservations (subnet_id, name, mac_address, ip_address, hostname, active)
+VALUES ($1,$2,$3,$4,$5,$6)
+RETURNING `+resvCols,
+		v.SubnetID, v.Name, v.MACAddress, v.IPAddress, v.Hostname, v.Active))
+}
+
+func (r *Repo) UpdateReservation(ctx context.Context, id int64, v models.DHCPReservation) (*models.DHCPReservation, error) {
+	out, err := scanResv(r.Pool.QueryRow(ctx, `
+UPDATE dhcp_reservations
+   SET name=$1, mac_address=$2, ip_address=$3, hostname=$4, active=$5, updated_at=NOW()
+ WHERE id=$6
+RETURNING `+resvCols,
+		v.Name, v.MACAddress, v.IPAddress, v.Hostname, v.Active, id))
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrReservationNotFound
+		}
+		return nil, err
+	}
+	return out, nil
+}
+
+func (r *Repo) DeleteReservation(ctx context.Context, id int64) error {
+	tag, err := r.Pool.Exec(ctx, `DELETE FROM dhcp_reservations WHERE id=$1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrReservationNotFound
+	}
+	return nil
+}
+
+// InterfaceExists prüft, ob ein Interface-Name in network_interfaces existiert
+// (für die Validierung beim Anlegen/Ändern von Subnets).
+func (r *Repo) InterfaceExists(ctx context.Context, name string) (bool, error) {
+	var exists bool
+	err := r.Pool.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM network_interfaces WHERE name=$1)`, name).Scan(&exists)
+	return exists, err
+}

internal/services/dns/dns.go

@@ -204,12 +204,16 @@ func (r *Repo) DeleteRecord(ctx context.Context, id int64) error {
 func (r *Repo) GetSettings(ctx context.Context) (*models.DNSSettings, error) {
 	row := r.Pool.QueryRow(ctx, `
 SELECT id, listen_addresses, listen_port, upstream_forwards, access_acl,
-       dnssec, qname_minimisation, cache_min_ttl, cache_max_ttl, updated_at
+       dnssec, qname_minimisation, cache_min_ttl, cache_max_ttl,
+       prefetch, serve_expired, msg_cache_size_mb, rrset_cache_size_mb,
+       updated_at
 FROM dns_settings WHERE id=1`)
 	var s models.DNSSettings
 	if err := row.Scan(&s.ID, &s.ListenAddresses, &s.ListenPort, &s.UpstreamForwards,
 		&s.AccessACL, &s.DNSSEC, &s.QNameMinimisation,
-		&s.CacheMinTTL, &s.CacheMaxTTL, &s.UpdatedAt); err != nil {
+		&s.CacheMinTTL, &s.CacheMaxTTL,
+		&s.Prefetch, &s.ServeExpired, &s.MsgCacheSizeMB, &s.RRSetCacheSizeMB,
+		&s.UpdatedAt); err != nil {
 		return nil, err
 	}
 	return &s, nil
@@ -220,16 +224,22 @@ func (r *Repo) UpdateSettings(ctx context.Context, s models.DNSSettings) (*model
 UPDATE dns_settings SET
    listen_addresses=$1, listen_port=$2, upstream_forwards=$3, access_acl=$4,
    dnssec=$5, qname_minimisation=$6, cache_min_ttl=$7, cache_max_ttl=$8,
+   prefetch=$9, serve_expired=$10, msg_cache_size_mb=$11, rrset_cache_size_mb=$12,
    updated_at=NOW()
 WHERE id=1
 RETURNING id, listen_addresses, listen_port, upstream_forwards, access_acl,
-          dnssec, qname_minimisation, cache_min_ttl, cache_max_ttl, updated_at`,
+          dnssec, qname_minimisation, cache_min_ttl, cache_max_ttl,
+          prefetch, serve_expired, msg_cache_size_mb, rrset_cache_size_mb,
+          updated_at`,
 		s.ListenAddresses, s.ListenPort, s.UpstreamForwards, s.AccessACL,
-		s.DNSSEC, s.QNameMinimisation, s.CacheMinTTL, s.CacheMaxTTL)
+		s.DNSSEC, s.QNameMinimisation, s.CacheMinTTL, s.CacheMaxTTL,
+		s.Prefetch, s.ServeExpired, s.MsgCacheSizeMB, s.RRSetCacheSizeMB)
 	var out models.DNSSettings
 	if err := row.Scan(&out.ID, &out.ListenAddresses, &out.ListenPort, &out.UpstreamForwards,
 		&out.AccessACL, &out.DNSSEC, &out.QNameMinimisation,
-		&out.CacheMinTTL, &out.CacheMaxTTL, &out.UpdatedAt); err != nil {
+		&out.CacheMinTTL, &out.CacheMaxTTL,
+		&out.Prefetch, &out.ServeExpired, &out.MsgCacheSizeMB, &out.RRSetCacheSizeMB,
+		&out.UpdatedAt); err != nil {
 		return nil, err
 	}
 	return &out, nil

internal/services/firewall/natrules.go

@@ -23,7 +23,7 @@ SELECT id, name, priority, enabled, kind,
        in_zone, out_zone, proto,
        match_src_cidr, match_dst_cidr, match_dport_start, match_dport_end,
        target_addr, target_port_start, target_port_end,
-       comment, created_at, updated_at
+       comment, note, labels, created_at, updated_at
 FROM firewall_nat_rules
 `
 
@@ -57,52 +57,58 @@ func (r *NATRulesRepo) Get(ctx context.Context, id int64) (*models.FirewallNATRu
 }
 
 func (r *NATRulesRepo) Create(ctx context.Context, x models.FirewallNATRule) (*models.FirewallNATRule, error) {
+	if x.Labels == nil {
+		x.Labels = []string{}
+	}
 	row := r.Pool.QueryRow(ctx, `
 INSERT INTO firewall_nat_rules (
     name, priority, enabled, kind,
     in_zone, out_zone, proto,
     match_src_cidr, match_dst_cidr, match_dport_start, match_dport_end,
     target_addr, target_port_start, target_port_end,
-    comment
+    comment, note, labels
 ) VALUES (
     $1, $2, $3, $4,
     $5, $6, $7,
     $8, $9, $10, $11,
     $12, $13, $14,
-    $15
+    $15, $16, $17
 )
 RETURNING id, name, priority, enabled, kind,
           in_zone, out_zone, proto,
           match_src_cidr, match_dst_cidr, match_dport_start, match_dport_end,
           target_addr, target_port_start, target_port_end,
-          comment, created_at, updated_at`,
+          comment, note, labels, created_at, updated_at`,
 		x.Name, x.Priority, x.Enabled, x.Kind,
 		x.InZone, x.OutZone, x.Proto,
 		x.MatchSrcCIDR, x.MatchDstCIDR, x.MatchDPortStart, x.MatchDPortEnd,
 		x.TargetAddr, x.TargetPortStart, x.TargetPortEnd,
-		x.Comment)
+		x.Comment, x.Note, x.Labels)
 	return scanNATRule(row)
 }
 
 func (r *NATRulesRepo) Update(ctx context.Context, id int64, x models.FirewallNATRule) (*models.FirewallNATRule, error) {
+	if x.Labels == nil {
+		x.Labels = []string{}
+	}
 	row := r.Pool.QueryRow(ctx, `
 UPDATE firewall_nat_rules SET
    name = $1, priority = $2, enabled = $3, kind = $4,
    in_zone = $5, out_zone = $6, proto = $7,
    match_src_cidr = $8, match_dst_cidr = $9, match_dport_start = $10, match_dport_end = $11,
    target_addr = $12, target_port_start = $13, target_port_end = $14,
-   comment = $15, updated_at = NOW()
-WHERE id = $16
+   comment = $15, note = $16, labels = $17, updated_at = NOW()
+WHERE id = $18
 RETURNING id, name, priority, enabled, kind,
           in_zone, out_zone, proto,
           match_src_cidr, match_dst_cidr, match_dport_start, match_dport_end,
           target_addr, target_port_start, target_port_end,
-          comment, created_at, updated_at`,
+          comment, note, labels, created_at, updated_at`,
 		x.Name, x.Priority, x.Enabled, x.Kind,
 		x.InZone, x.OutZone, x.Proto,
 		x.MatchSrcCIDR, x.MatchDstCIDR, x.MatchDPortStart, x.MatchDPortEnd,
 		x.TargetAddr, x.TargetPortStart, x.TargetPortEnd,
-		x.Comment, id)
+		x.Comment, x.Note, x.Labels, id)
 	out, err := scanNATRule(row)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
@@ -124,6 +130,37 @@ func (r *NATRulesRepo) Delete(ctx context.Context, id int64) error {
 	return nil
 }
 
+// PatchNote updates only the note field of a NAT rule.
+func (r *NATRulesRepo) PatchNote(ctx context.Context, id int64, note string) error {
+	var n *string
+	if note != "" {
+		n = &note
+	}
+	tag, err := r.Pool.Exec(ctx, `UPDATE firewall_nat_rules SET note = $1, updated_at = NOW() WHERE id = $2`, n, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNATRuleNotFound
+	}
+	return nil
+}
+
+// PatchLabels replaces the labels array of a NAT rule.
+func (r *NATRulesRepo) PatchLabels(ctx context.Context, id int64, labels []string) error {
+	if labels == nil {
+		labels = []string{}
+	}
+	tag, err := r.Pool.Exec(ctx, `UPDATE firewall_nat_rules SET labels = $1, updated_at = NOW() WHERE id = $2`, labels, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNATRuleNotFound
+	}
+	return nil
+}
+
 func scanNATRule(row interface{ Scan(...any) error }) (*models.FirewallNATRule, error) {
 	var x models.FirewallNATRule
 	if err := row.Scan(
@@ -131,9 +168,12 @@ func scanNATRule(row interface{ Scan(...any) error }) (*models.FirewallNATRule,
 		&x.InZone, &x.OutZone, &x.Proto,
 		&x.MatchSrcCIDR, &x.MatchDstCIDR, &x.MatchDPortStart, &x.MatchDPortEnd,
 		&x.TargetAddr, &x.TargetPortStart, &x.TargetPortEnd,
-		&x.Comment, &x.CreatedAt, &x.UpdatedAt,
+		&x.Comment, &x.Note, &x.Labels, &x.CreatedAt, &x.UpdatedAt,
 	); err != nil {
 		return nil, err
 	}
+	if x.Labels == nil {
+		x.Labels = []string{}
+	}
 	return &x, nil
 }

internal/services/firewall/rules.go

@@ -23,7 +23,7 @@ SELECT id, name, priority, enabled, action,
        src_zone, src_address_object_id, src_address_group_id, src_cidr,
        dst_zone, dst_address_object_id, dst_address_group_id, dst_cidr,
        service_object_id, service_group_id,
-       log, comment, created_at, updated_at
+       log, comment, note, labels, created_at, updated_at
 FROM firewall_rules
 `
 
@@ -57,52 +57,58 @@ func (r *RulesRepo) Get(ctx context.Context, id int64) (*models.FirewallRule, er
 }
 
 func (r *RulesRepo) Create(ctx context.Context, x models.FirewallRule) (*models.FirewallRule, error) {
+	if x.Labels == nil {
+		x.Labels = []string{}
+	}
 	row := r.Pool.QueryRow(ctx, `
 INSERT INTO firewall_rules (
     name, priority, enabled, action,
     src_zone, src_address_object_id, src_address_group_id, src_cidr,
     dst_zone, dst_address_object_id, dst_address_group_id, dst_cidr,
     service_object_id, service_group_id,
-    log, comment
+    log, comment, note, labels
 ) VALUES (
     $1, $2, $3, $4,
     $5, $6, $7, $8,
     $9, $10, $11, $12,
     $13, $14,
-    $15, $16
+    $15, $16, $17, $18
 )
 RETURNING id, name, priority, enabled, action,
           src_zone, src_address_object_id, src_address_group_id, src_cidr,
           dst_zone, dst_address_object_id, dst_address_group_id, dst_cidr,
           service_object_id, service_group_id,
-          log, comment, created_at, updated_at`,
+          log, comment, note, labels, created_at, updated_at`,
 		x.Name, x.Priority, x.Enabled, x.Action,
 		x.SrcZone, x.SrcAddressObjectID, x.SrcAddressGroupID, x.SrcCIDR,
 		x.DstZone, x.DstAddressObjectID, x.DstAddressGroupID, x.DstCIDR,
 		x.ServiceObjectID, x.ServiceGroupID,
-		x.Log, x.Comment)
+		x.Log, x.Comment, x.Note, x.Labels)
 	return scanRule(row)
 }
 
 func (r *RulesRepo) Update(ctx context.Context, id int64, x models.FirewallRule) (*models.FirewallRule, error) {
+	if x.Labels == nil {
+		x.Labels = []string{}
+	}
 	row := r.Pool.QueryRow(ctx, `
 UPDATE firewall_rules SET
    name = $1, priority = $2, enabled = $3, action = $4,
    src_zone = $5, src_address_object_id = $6, src_address_group_id = $7, src_cidr = $8,
    dst_zone = $9, dst_address_object_id = $10, dst_address_group_id = $11, dst_cidr = $12,
    service_object_id = $13, service_group_id = $14,
-   log = $15, comment = $16, updated_at = NOW()
-WHERE id = $17
+   log = $15, comment = $16, note = $17, labels = $18, updated_at = NOW()
+WHERE id = $19
 RETURNING id, name, priority, enabled, action,
           src_zone, src_address_object_id, src_address_group_id, src_cidr,
           dst_zone, dst_address_object_id, dst_address_group_id, dst_cidr,
           service_object_id, service_group_id,
-          log, comment, created_at, updated_at`,
+          log, comment, note, labels, created_at, updated_at`,
 		x.Name, x.Priority, x.Enabled, x.Action,
 		x.SrcZone, x.SrcAddressObjectID, x.SrcAddressGroupID, x.SrcCIDR,
 		x.DstZone, x.DstAddressObjectID, x.DstAddressGroupID, x.DstCIDR,
 		x.ServiceObjectID, x.ServiceGroupID,
-		x.Log, x.Comment, id)
+		x.Log, x.Comment, x.Note, x.Labels, id)
 	out, err := scanRule(row)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
@@ -124,6 +130,37 @@ func (r *RulesRepo) Delete(ctx context.Context, id int64) error {
 	return nil
 }
 
+// PatchNote updates only the note field of a rule.
+func (r *RulesRepo) PatchNote(ctx context.Context, id int64, note string) error {
+	var n *string
+	if note != "" {
+		n = &note
+	}
+	tag, err := r.Pool.Exec(ctx, `UPDATE firewall_rules SET note = $1, updated_at = NOW() WHERE id = $2`, n, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrRuleNotFound
+	}
+	return nil
+}
+
+// PatchLabels replaces the labels array of a rule.
+func (r *RulesRepo) PatchLabels(ctx context.Context, id int64, labels []string) error {
+	if labels == nil {
+		labels = []string{}
+	}
+	tag, err := r.Pool.Exec(ctx, `UPDATE firewall_rules SET labels = $1, updated_at = NOW() WHERE id = $2`, labels, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrRuleNotFound
+	}
+	return nil
+}
+
 func scanRule(row interface{ Scan(...any) error }) (*models.FirewallRule, error) {
 	var x models.FirewallRule
 	if err := row.Scan(
@@ -131,9 +168,12 @@ func scanRule(row interface{ Scan(...any) error }) (*models.FirewallRule, error)
 		&x.SrcZone, &x.SrcAddressObjectID, &x.SrcAddressGroupID, &x.SrcCIDR,
 		&x.DstZone, &x.DstAddressObjectID, &x.DstAddressGroupID, &x.DstCIDR,
 		&x.ServiceObjectID, &x.ServiceGroupID,
-		&x.Log, &x.Comment, &x.CreatedAt, &x.UpdatedAt,
+		&x.Log, &x.Comment, &x.Note, &x.Labels, &x.CreatedAt, &x.UpdatedAt,
 	); err != nil {
 		return nil, err
 	}
+	if x.Labels == nil {
+		x.Labels = []string{}
+	}
 	return &x, nil
 }

internal/services/forwardproxy/forwardproxy.go

@@ -1,6 +1,6 @@
 // Package forwardproxy provides CRUD against the forward_proxy_acls
-// table. Renderer in internal/squid consumes the same rows to emit
-// /etc/edgeguard/squid/squid.conf.
+// table and settings in forward_proxy_settings. Renderer in internal/squid
+// consumes both tables to emit /etc/edgeguard/squid/squid.conf.
 package forwardproxy
 
 import (
@@ -97,6 +97,52 @@ func (r *Repo) Delete(ctx context.Context, id int64) error {
 	return nil
 }
 
+// Settings returns the singleton forward_proxy_settings row.
+func (r *Repo) GetSettings(ctx context.Context) (*models.ForwardProxySettings, error) {
+	var s models.ForwardProxySettings
+	if err := r.Pool.QueryRow(ctx, `
+SELECT id, listen_addresses, listen_port,
+       cache_mem_mb, cache_dir_mb, max_obj_size_mb,
+       connect_timeout, read_timeout, request_timeout,
+       created_at, updated_at
+FROM forward_proxy_settings WHERE id=1`).Scan(
+		&s.ID, &s.ListenAddresses, &s.ListenPort,
+		&s.CacheMemMB, &s.CacheDirMB, &s.MaxObjSizeMB,
+		&s.ConnectTimeout, &s.ReadTimeout, &s.RequestTimeout,
+		&s.CreatedAt, &s.UpdatedAt,
+	); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+func (r *Repo) UpdateSettings(ctx context.Context, s models.ForwardProxySettings) (*models.ForwardProxySettings, error) {
+	var out models.ForwardProxySettings
+	if err := r.Pool.QueryRow(ctx, `
+UPDATE forward_proxy_settings SET
+   listen_addresses=$1, listen_port=$2,
+   cache_mem_mb=$3, cache_dir_mb=$4, max_obj_size_mb=$5,
+   connect_timeout=$6, read_timeout=$7, request_timeout=$8,
+   updated_at=NOW()
+WHERE id=1
+RETURNING id, listen_addresses, listen_port,
+          cache_mem_mb, cache_dir_mb, max_obj_size_mb,
+          connect_timeout, read_timeout, request_timeout,
+          created_at, updated_at`,
+		s.ListenAddresses, s.ListenPort,
+		s.CacheMemMB, s.CacheDirMB, s.MaxObjSizeMB,
+		s.ConnectTimeout, s.ReadTimeout, s.RequestTimeout,
+	).Scan(
+		&out.ID, &out.ListenAddresses, &out.ListenPort,
+		&out.CacheMemMB, &out.CacheDirMB, &out.MaxObjSizeMB,
+		&out.ConnectTimeout, &out.ReadTimeout, &out.RequestTimeout,
+		&out.CreatedAt, &out.UpdatedAt,
+	); err != nil {
+		return nil, err
+	}
+	return &out, nil
+}
+
 func scan(row interface{ Scan(...any) error }) (*models.ForwardProxyACL, error) {
 	var a models.ForwardProxyACL
 	if err := row.Scan(

internal/services/ipaddresses/apply.go

@@ -0,0 +1,105 @@
+package ipaddresses
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+)
+
+// ConfPath wird von edgeguard-apply-ipaddresses gelesen.
+const ConfPath = "/etc/edgeguard/ip-addresses.conf"
+
+type Generator struct {
+	Repo *Repo
+}
+
+func NewGenerator(repo *Repo) *Generator { return &Generator{Repo: repo} }
+
+// Render schreibt /etc/edgeguard/ip-addresses.conf (Format: dev|addr/prefix)
+// und triggert das apply-Skript via sudo.
+func (g *Generator) Render(ctx context.Context) error {
+	return g.render(ctx, false)
+}
+
+// RenderSecondary wie Render, aber schließt Ethernet-Interface-IPs aus.
+// Auf einem Secondary-Node werden eth0-IPs (Public-IP + VIP) von
+// cloud-init bzw. Keepalived verwaltet — edgeguard soll sie nicht
+// überschreiben oder entfernen.
+func (g *Generator) RenderSecondary(ctx context.Context) error {
+	return g.render(ctx, true)
+}
+
+func (g *Generator) render(ctx context.Context, excludeEthernet bool) error {
+	type addrRow struct {
+		dev    string
+		addr   string
+		prefix int
+	}
+
+	q := `
+		SELECT ni.name, ia.address, ia.prefix
+		FROM ip_addresses ia
+		JOIN network_interfaces ni ON ni.id = ia.interface_id
+		WHERE ia.active = true`
+	if excludeEthernet {
+		q += `
+		  AND ni.type != 'ethernet'`
+	}
+	q += `
+		ORDER BY ni.name, ia.address`
+
+	rows, err := g.Repo.Pool.Query(ctx, q)
+	if err != nil {
+		return fmt.Errorf("query: %w", err)
+	}
+	defer rows.Close()
+
+	var entries []addrRow
+	for rows.Next() {
+		var r addrRow
+		if err := rows.Scan(&r.dev, &r.addr, &r.prefix); err != nil {
+			return fmt.Errorf("scan: %w", err)
+		}
+		entries = append(entries, r)
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+
+	var buf bytes.Buffer
+	buf.WriteString("# Generated by edgeguard-api — DO NOT EDIT.\n")
+	buf.WriteString("# Read by edgeguard-apply-ipaddresses. Format: dev|address/prefix\n")
+	for _, e := range entries {
+		fmt.Fprintf(&buf, "%s|%s/%d\n",
+			sanitize(e.dev), sanitize(e.addr), e.prefix)
+	}
+
+	if err := configgen.AtomicWrite(ConfPath, buf.Bytes(), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", ConfPath, err)
+	}
+	if err := applyIPAddresses(); err != nil {
+		return fmt.Errorf("apply: %w", err)
+	}
+	return nil
+}
+
+func applyIPAddresses() error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl",
+		"restart", "edgeguard-ipaddresses.service")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("systemctl restart edgeguard-ipaddresses.service: %s: %w",
+			strings.TrimSpace(string(out)), err)
+	}
+	return nil
+}
+
+func sanitize(s string) string {
+	s = strings.ReplaceAll(s, "|", "")
+	s = strings.ReplaceAll(s, "\n", "")
+	return strings.TrimSpace(s)
+}

internal/services/networkifs/apply.go

@@ -0,0 +1,103 @@
+package networkifs
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
+)
+
+// ConfPath is read by edgeguard-apply-interfaces.
+const ConfPath = "/etc/edgeguard/interfaces.conf"
+
+type Generator struct {
+	Repo *Repo
+}
+
+func NewGenerator(repo *Repo) *Generator { return &Generator{Repo: repo} }
+
+// Render writes /etc/edgeguard/interfaces.conf (format: type|name|parent|vlan_id|mtu|members)
+// for VLAN/bridge/bond interfaces and triggers edgeguard-interfaces.service.
+// Ethernet and WireGuard interfaces are managed by the OS / wg-quick and are excluded.
+func (g *Generator) Render(ctx context.Context) error {
+	rows, err := g.Repo.Pool.Query(ctx, `
+		SELECT type, name,
+		       COALESCE(parent, ''),
+		       COALESCE(vlan_id::text, ''),
+		       COALESCE(mtu::text, ''),
+		       members
+		FROM network_interfaces
+		WHERE active = true
+		  AND type IN ('vlan', 'bridge', 'bond')
+		  AND (type = 'vlan' OR jsonb_array_length(members) > 0)
+		ORDER BY type, name`,
+	)
+	if err != nil {
+		return fmt.Errorf("query: %w", err)
+	}
+	defer rows.Close()
+
+	type ifRow struct {
+		typ     string
+		name    string
+		parent  string
+		vlanID  string
+		mtu     string
+		members []string
+	}
+
+	var entries []ifRow
+	for rows.Next() {
+		var r ifRow
+		var membersRaw []byte
+		if err := rows.Scan(&r.typ, &r.name, &r.parent, &r.vlanID, &r.mtu, &membersRaw); err != nil {
+			return fmt.Errorf("scan: %w", err)
+		}
+		if len(membersRaw) > 0 {
+			_ = json.Unmarshal(membersRaw, &r.members)
+		}
+		entries = append(entries, r)
+	}
+	if err := rows.Err(); err != nil {
+		return err
+	}
+
+	var buf bytes.Buffer
+	buf.WriteString("# Generated by edgeguard-api — DO NOT EDIT.\n")
+	buf.WriteString("# Read by edgeguard-apply-interfaces. Format: type|name|parent|vlan_id|mtu|members\n")
+	for _, e := range entries {
+		fmt.Fprintf(&buf, "%s|%s|%s|%s|%s|%s\n",
+			sanitizeIf(e.typ), sanitizeIf(e.name), sanitizeIf(e.parent),
+			sanitizeIf(e.vlanID), sanitizeIf(e.mtu),
+			sanitizeIf(strings.Join(e.members, ",")))
+	}
+
+	if err := configgen.AtomicWrite(ConfPath, buf.Bytes(), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", ConfPath, err)
+	}
+	if err := applyInterfaces(); err != nil {
+		return fmt.Errorf("apply: %w", err)
+	}
+	return nil
+}
+
+func applyInterfaces() error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl",
+		"restart", "edgeguard-interfaces.service")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("systemctl restart edgeguard-interfaces.service: %s: %w",
+			strings.TrimSpace(string(out)), err)
+	}
+	return nil
+}
+
+func sanitizeIf(s string) string {
+	s = strings.ReplaceAll(s, "|", "")
+	s = strings.ReplaceAll(s, "\n", "")
+	return strings.TrimSpace(s)
+}

internal/services/oidc/client.go

@@ -0,0 +1,181 @@
+package oidc
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+
+	gooidc "github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+)
+
+// Claims sind die aus dem ID-Token extrahierten Felder, die der Login-
+// Flow braucht. Bewusst minimal — Rolle kommt NIE aus dem Token.
+type Claims struct {
+	Subject       string
+	Email         string
+	EmailVerified bool
+	Nonce         string
+}
+
+// Authenticator ist der testbare Seam: Aufbau der Auth-URL und der
+// Code-Exchange inkl. ID-Token-Verifikation + Claim-Extraktion. Der
+// Handler hängt nur hieran, sodass Tests einen Fake injizieren können.
+type Authenticator interface {
+	// AuthCodeURL baut die Redirect-URL zum IdP (state + nonce + PKCE-Challenge).
+	AuthCodeURL(ctx context.Context, redirectURI, state, nonce, pkceVerifier string) (string, error)
+	// Exchange tauscht den Code (PKCE), verifiziert das ID-Token und gibt
+	// die Claims zurück. Prüft Issuer/Audience/Signatur/Expiry.
+	Exchange(ctx context.Context, redirectURI, code, pkceVerifier string) (*Claims, error)
+}
+
+// Client implementiert Authenticator gegen einen echten OIDC-Provider.
+// Provider+Verifier werden lazy aufgebaut und gecached; bei geänderten
+// Settings (Fingerprint) neu aufgebaut.
+type Client struct {
+	repo *Repo
+
+	mu       sync.Mutex
+	cacheKey string
+	provider *gooidc.Provider
+	verifier *gooidc.IDTokenVerifier
+}
+
+func NewClient(repo *Repo) *Client { return &Client{repo: repo} }
+
+// loaded baut (oder reused) Provider+Verifier aus den aktuellen Settings.
+// Cache-Key = Fingerprint(issuer, client_id, scopes); Rebuild bei Änderung.
+func (c *Client) loaded(ctx context.Context) (*gooidc.Provider, *gooidc.IDTokenVerifier, error) {
+	s, err := c.repo.Get(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	if !s.Enabled {
+		return nil, nil, ErrDisabled
+	}
+	if strings.TrimSpace(s.IssuerURL) == "" || strings.TrimSpace(s.ClientID) == "" {
+		return nil, nil, fmt.Errorf("oidc: issuer_url and client_id required")
+	}
+	key := fingerprint(s.IssuerURL, s.ClientID, s.Scopes)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.provider == nil || c.cacheKey != key {
+		prov, err := gooidc.NewProvider(ctx, s.IssuerURL)
+		if err != nil {
+			return nil, nil, fmt.Errorf("oidc: discovery: %w", err)
+		}
+		c.provider = prov
+		c.verifier = prov.Verifier(&gooidc.Config{ClientID: s.ClientID})
+		c.cacheKey = key
+	}
+	return c.provider, c.verifier, nil
+}
+
+func (c *Client) oauthConfig(prov *gooidc.Provider, clientID, secret, redirectURI, scopes string) oauth2.Config {
+	return oauth2.Config{
+		ClientID:     clientID,
+		ClientSecret: secret,
+		Endpoint:     prov.Endpoint(),
+		RedirectURL:  redirectURI,
+		Scopes:       splitScopes(scopes),
+	}
+}
+
+// AuthCodeURL implementiert Authenticator.
+func (c *Client) AuthCodeURL(ctx context.Context, redirectURI, state, nonce, pkceVerifier string) (string, error) {
+	s, err := c.repo.Get(ctx)
+	if err != nil {
+		return "", err
+	}
+	prov, _, err := c.loaded(ctx)
+	if err != nil {
+		return "", err
+	}
+	secret, _ := c.repo.ClientSecret(ctx)
+	cfg := c.oauthConfig(prov, s.ClientID, secret, redirectURI, s.Scopes)
+	return cfg.AuthCodeURL(state,
+		gooidc.Nonce(nonce),
+		oauth2.S256ChallengeOption(pkceVerifier),
+	), nil
+}
+
+// Exchange implementiert Authenticator.
+func (c *Client) Exchange(ctx context.Context, redirectURI, code, pkceVerifier string) (*Claims, error) {
+	s, err := c.repo.Get(ctx)
+	if err != nil {
+		return nil, err
+	}
+	prov, verifier, err := c.loaded(ctx)
+	if err != nil {
+		return nil, err
+	}
+	secret, _ := c.repo.ClientSecret(ctx)
+	cfg := c.oauthConfig(prov, s.ClientID, secret, redirectURI, s.Scopes)
+
+	tok, err := cfg.Exchange(ctx, code, oauth2.VerifierOption(pkceVerifier))
+	if err != nil {
+		return nil, fmt.Errorf("oidc: code exchange: %w", err)
+	}
+	rawID, ok := tok.Extra("id_token").(string)
+	if !ok || rawID == "" {
+		return nil, errors.New("oidc: no id_token in response")
+	}
+	idToken, err := verifier.Verify(ctx, rawID)
+	if err != nil {
+		return nil, fmt.Errorf("oidc: id_token verify: %w", err)
+	}
+	return extractClaims(idToken, s.EmailClaim)
+}
+
+// extractClaims liest E-Mail (via konfigurierbarem Claim), email_verified,
+// sub und nonce aus dem verifizierten ID-Token.
+func extractClaims(idToken *gooidc.IDToken, emailClaim string) (*Claims, error) {
+	var raw map[string]any
+	if err := idToken.Claims(&raw); err != nil {
+		return nil, fmt.Errorf("oidc: decode claims: %w", err)
+	}
+	if emailClaim == "" {
+		emailClaim = "email"
+	}
+	out := &Claims{Subject: idToken.Subject}
+	if v, ok := raw[emailClaim].(string); ok {
+		out.Email = strings.TrimSpace(strings.ToLower(v))
+	}
+	// email_verified kann bool oder "true"/"false" sein.
+	switch ev := raw["email_verified"].(type) {
+	case bool:
+		out.EmailVerified = ev
+	case string:
+		out.EmailVerified = ev == "true"
+	}
+	if n, ok := raw["nonce"].(string); ok {
+		out.Nonce = n
+	}
+	return out, nil
+}
+
+func splitScopes(s string) []string {
+	out := []string{}
+	for _, p := range strings.Fields(s) {
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	if len(out) == 0 {
+		out = []string{gooidc.ScopeOpenID, "email", "profile"}
+	}
+	return out
+}
+
+func fingerprint(parts ...string) string {
+	h := sha256.New()
+	for _, p := range parts {
+		h.Write([]byte(p))
+		h.Write([]byte{0})
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}

internal/services/oidc/settings.go

@@ -0,0 +1,111 @@
+// Package oidc kapselt die OIDC/Keycloak-SSO-Konfiguration (Singleton-
+// Settings + verschlüsseltes Client-Secret) und einen lazy aufgebauten
+// OIDC-Provider/Verifier. Login-Flow-State ist stateless (signiertes
+// Cookie im Handler), daher hält dieses Paket keinen Request-State.
+package oidc
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/secrets"
+)
+
+// ErrDisabled signalisiert, dass OIDC nicht aktiviert/konfiguriert ist.
+var ErrDisabled = errors.New("oidc: not enabled")
+
+// Repo liest/schreibt die oidc_settings-Singleton-Row und ver-/entschlüsselt
+// das Client-Secret via secrets.Box.
+type Repo struct {
+	pool *pgxpool.Pool
+	box  *secrets.Box
+}
+
+func New(pool *pgxpool.Pool, box *secrets.Box) *Repo {
+	return &Repo{pool: pool, box: box}
+}
+
+// Get liefert die Settings (client_secret_enc als Bytes, NULL → nil).
+func (r *Repo) Get(ctx context.Context) (*models.OIDCSettings, error) {
+	var s models.OIDCSettings
+	if err := r.pool.QueryRow(ctx, `
+SELECT id, enabled, issuer_url, client_id, client_secret_enc,
+       scopes, email_claim, button_label, created_at, updated_at
+FROM oidc_settings WHERE id = 1`).Scan(
+		&s.ID, &s.Enabled, &s.IssuerURL, &s.ClientID, &s.ClientSecretEnc,
+		&s.Scopes, &s.EmailClaim, &s.ButtonLabel, &s.CreatedAt, &s.UpdatedAt,
+	); err != nil {
+		return nil, err
+	}
+	return &s, nil
+}
+
+// ClientSecret entschlüsselt das gespeicherte Client-Secret ("" wenn keins).
+func (r *Repo) ClientSecret(ctx context.Context) (string, error) {
+	s, err := r.Get(ctx)
+	if err != nil {
+		return "", err
+	}
+	if len(s.ClientSecretEnc) == 0 {
+		return "", nil
+	}
+	pt, err := r.box.Open(s.ClientSecretEnc)
+	if err != nil {
+		return "", err
+	}
+	return string(pt), nil
+}
+
+// HasSecret meldet, ob ein Client-Secret hinterlegt ist (für die Admin-UI,
+// ohne das Secret selbst preiszugeben).
+func (r *Repo) HasSecret(ctx context.Context) (bool, error) {
+	var present bool
+	err := r.pool.QueryRow(ctx,
+		`SELECT client_secret_enc IS NOT NULL FROM oidc_settings WHERE id = 1`).Scan(&present)
+	return present, err
+}
+
+// UpdateInput beschreibt eine Settings-Änderung. ClientSecret nutzt
+// write-only-Semantik: nil = unverändert, "" = löschen, sonst neu sealen.
+type UpdateInput struct {
+	Enabled      bool
+	IssuerURL    string
+	ClientID     string
+	Scopes       string
+	EmailClaim   string
+	ButtonLabel  string
+	ClientSecret *string
+}
+
+// Update schreibt die Settings. Das Secret wird nur angefasst, wenn
+// ClientSecret != nil.
+func (r *Repo) Update(ctx context.Context, in UpdateInput) error {
+	if in.ClientSecret == nil {
+		_, err := r.pool.Exec(ctx, `
+UPDATE oidc_settings
+   SET enabled=$1, issuer_url=$2, client_id=$3, scopes=$4,
+       email_claim=$5, button_label=$6, updated_at=NOW()
+ WHERE id=1`,
+			in.Enabled, in.IssuerURL, in.ClientID, in.Scopes, in.EmailClaim, in.ButtonLabel)
+		return err
+	}
+
+	var enc []byte
+	if *in.ClientSecret != "" {
+		sealed, err := r.box.Seal([]byte(*in.ClientSecret))
+		if err != nil {
+			return err
+		}
+		enc = sealed
+	}
+	_, err := r.pool.Exec(ctx, `
+UPDATE oidc_settings
+   SET enabled=$1, issuer_url=$2, client_id=$3, scopes=$4,
+       email_claim=$5, button_label=$6, client_secret_enc=$7, updated_at=NOW()
+ WHERE id=1`,
+		in.Enabled, in.IssuerURL, in.ClientID, in.Scopes, in.EmailClaim, in.ButtonLabel, enc)
+	return err
+}

internal/services/oidc/settings_test.go

@@ -0,0 +1,90 @@
+package oidc
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
+	"git.netcell-it.de/projekte/edgeguard-native/internal/services/secrets"
+)
+
+// migrateRetry umgeht die goose-Erst-Apply-Race, wenn mehrere guarded
+// Test-Pakete dieselbe frische DB parallel migrieren.
+func migrateRetry(ctx context.Context, dsn string) error {
+	var err error
+	for i := 0; i < 3; i++ {
+		if err = database.Migrate(ctx, dsn); err == nil {
+			return nil
+		}
+		time.Sleep(700 * time.Millisecond)
+	}
+	return err
+}
+
+// Guarded integration test: set EG_FWTEST_DSN (sonst skip).
+func testRepo(t *testing.T) *Repo {
+	t.Helper()
+	dsn := os.Getenv("EG_FWTEST_DSN")
+	if dsn == "" {
+		t.Skip("set EG_FWTEST_DSN to run the oidc settings test")
+	}
+	ctx := context.Background()
+	if err := migrateRetry(ctx, dsn); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	pool, err := database.Open(ctx, dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	box := secrets.New(t.TempDir() + "/master_key")
+	// Settings auf einen sauberen Default zurücksetzen.
+	if _, err := pool.Exec(ctx, `UPDATE oidc_settings SET enabled=false, issuer_url='', client_id='', client_secret_enc=NULL WHERE id=1`); err != nil {
+		t.Fatalf("reset: %v", err)
+	}
+	return New(pool, box)
+}
+
+func TestSettings_SecretWriteOnly(t *testing.T) {
+	r := testRepo(t)
+	ctx := context.Background()
+	str := func(s string) *string { return &s }
+
+	// 1) Neues Secret setzen.
+	if err := r.Update(ctx, UpdateInput{Enabled: true, IssuerURL: "https://idp.example/realms/x", ClientID: "eg", ClientSecret: str("s3cr3t")}); err != nil {
+		t.Fatal(err)
+	}
+	if has, _ := r.HasSecret(ctx); !has {
+		t.Fatal("HasSecret should be true after setting a secret")
+	}
+	got, err := r.ClientSecret(ctx)
+	if err != nil || got != "s3cr3t" {
+		t.Fatalf("ClientSecret = %q, %v; want s3cr3t", got, err)
+	}
+
+	// 2) Update mit nil → Secret bleibt unverändert.
+	if err := r.Update(ctx, UpdateInput{Enabled: true, IssuerURL: "https://idp.example/realms/x", ClientID: "eg2", ClientSecret: nil}); err != nil {
+		t.Fatal(err)
+	}
+	got, _ = r.ClientSecret(ctx)
+	if got != "s3cr3t" {
+		t.Fatalf("secret should be preserved on nil update, got %q", got)
+	}
+	if s, _ := r.Get(ctx); s.ClientID != "eg2" {
+		t.Fatalf("client_id should update to eg2, got %q", s.ClientID)
+	}
+
+	// 3) Update mit "" → Secret gelöscht.
+	if err := r.Update(ctx, UpdateInput{Enabled: false, IssuerURL: "", ClientID: "", ClientSecret: str("")}); err != nil {
+		t.Fatal(err)
+	}
+	if has, _ := r.HasSecret(ctx); has {
+		t.Fatal("HasSecret should be false after clearing the secret")
+	}
+	got, _ = r.ClientSecret(ctx)
+	if got != "" {
+		t.Fatalf("secret should be empty after clear, got %q", got)
+	}
+}

internal/services/session/session.go

@@ -122,6 +122,15 @@ func (s *Signer) Issue(actor string) (string, *Token, error) {
 	return s.IssueWithRole(actor, "")
 }
 
+// IssueWithRoleTTL issues a token with a custom TTL (overrides s.TTL for this call).
+func (s *Signer) IssueWithRoleTTL(actor, role string, ttl time.Duration) (string, *Token, error) {
+	orig := s.TTL
+	s.TTL = ttl
+	raw, tok, err := s.IssueWithRole(actor, role)
+	s.TTL = orig
+	return raw, tok, err
+}
+
 // Verify checks a token. Returns ErrInvalidToken or ErrExpiredToken.
 func (s *Signer) Verify(raw string) (*Token, error) {
 	if raw == "" {
@@ -165,3 +174,67 @@ var (
 	ErrInvalidToken = errors.New("invalid session token")
 	ErrExpiredToken = errors.New("session token expired")
 )
+
+// blobEnvelope umhüllt eine beliebige Payload mit einem Ablaufzeitpunkt.
+type blobEnvelope struct {
+	Exp     int64  `json:"exp"`
+	Payload []byte `json:"p"`
+}
+
+// SignBlob signiert beliebige Bytes mit dem Session-Secret (HMAC-SHA256,
+// gleiches Format wie Tokens: base64url(json).base64url(sig)) und einer
+// TTL. Für stateless, cluster-sichere Kurzzeit-Cookies (z.B. der
+// OIDC-Flow-State). Das Secret ist clusterweit synchron (.jwt_fingerprint).
+func (s *Signer) SignBlob(payload []byte, ttl time.Duration) (string, error) {
+	env := blobEnvelope{
+		Exp:     s.Now().Add(ttl).Unix(),
+		Payload: payload,
+	}
+	data, err := json.Marshal(env)
+	if err != nil {
+		return "", err
+	}
+	mac := hmac.New(sha256.New, s.Secret)
+	mac.Write(data)
+	return base64.RawURLEncoding.EncodeToString(data) + "." +
+		base64.RawURLEncoding.EncodeToString(mac.Sum(nil)), nil
+}
+
+// VerifyBlob prüft Signatur + Ablauf und gibt die ursprüngliche Payload
+// zurück. ErrInvalidToken / ErrExpiredToken bei Fehlern.
+func (s *Signer) VerifyBlob(raw string) ([]byte, error) {
+	if raw == "" {
+		return nil, ErrInvalidToken
+	}
+	dot := -1
+	for i := 0; i < len(raw); i++ {
+		if raw[i] == '.' {
+			dot = i
+			break
+		}
+	}
+	if dot <= 0 || dot >= len(raw)-1 {
+		return nil, ErrInvalidToken
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(raw[:dot])
+	if err != nil {
+		return nil, ErrInvalidToken
+	}
+	sig, err := base64.RawURLEncoding.DecodeString(raw[dot+1:])
+	if err != nil {
+		return nil, ErrInvalidToken
+	}
+	mac := hmac.New(sha256.New, s.Secret)
+	mac.Write(payload)
+	if subtle.ConstantTimeCompare(mac.Sum(nil), sig) != 1 {
+		return nil, ErrInvalidToken
+	}
+	var env blobEnvelope
+	if err := json.Unmarshal(payload, &env); err != nil {
+		return nil, ErrInvalidToken
+	}
+	if s.Now().Unix() >= env.Exp {
+		return nil, ErrExpiredToken
+	}
+	return env.Payload, nil
+}

internal/services/users/users.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/pquerna/otp/totp"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -27,22 +28,30 @@ type User struct {
 	Email       string     `json:"email"`
 	Role        string     `json:"role"`
 	Active      bool       `json:"active"`
+	TOTPEnabled bool       `json:"totp_enabled"`
 	LastLoginAt *time.Time `json:"last_login_at"`
 	CreatedAt   time.Time  `json:"created_at"`
 	UpdatedAt   time.Time  `json:"updated_at"`
 }
 
+// AuthInfo is returned by FindForAuth — contains credentials needed during login.
+type AuthInfo struct {
+	User
+	PasswordHash string
+	TOTPSecret   *string
+}
+
 type Repo struct {
 	pool *pgxpool.Pool
 }
 
 func New(pool *pgxpool.Pool) *Repo { return &Repo{pool: pool} }
 
-const selectCols = `id, email, role, active, last_login_at, created_at, updated_at`
+const selectCols = `id, email, role, active, totp_enabled, last_login_at, created_at, updated_at`
 
 func scan(row pgx.Row) (User, error) {
 	var u User
-	err := row.Scan(&u.ID, &u.Email, &u.Role, &u.Active,
+	err := row.Scan(&u.ID, &u.Email, &u.Role, &u.Active, &u.TOTPEnabled,
 		&u.LastLoginAt, &u.CreatedAt, &u.UpdatedAt)
 	return u, err
 }
@@ -71,7 +80,7 @@ func (r *Repo) FindByEmail(ctx context.Context, email string) (User, string, err
 	var hash string
 	err := r.pool.QueryRow(ctx,
 		`SELECT `+selectCols+`, password_hash FROM users WHERE lower(email)=lower($1)`,
-		email).Scan(&u.ID, &u.Email, &u.Role, &u.Active,
+		email).Scan(&u.ID, &u.Email, &u.Role, &u.Active, &u.TOTPEnabled,
 		&u.LastLoginAt, &u.CreatedAt, &u.UpdatedAt, &hash)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return u, "", ErrNotFound
@@ -79,6 +88,70 @@ func (r *Repo) FindByEmail(ctx context.Context, email string) (User, string, err
 	return u, hash, err
 }
 
+// FindForAuth returns full auth credentials including TOTP secret. ErrNotFound if absent.
+func (r *Repo) FindForAuth(ctx context.Context, email string) (*AuthInfo, error) {
+	var a AuthInfo
+	err := r.pool.QueryRow(ctx,
+		`SELECT `+selectCols+`, password_hash, totp_secret FROM users WHERE lower(email)=lower($1)`,
+		email).Scan(&a.ID, &a.Email, &a.Role, &a.Active, &a.TOTPEnabled,
+		&a.LastLoginAt, &a.CreatedAt, &a.UpdatedAt, &a.PasswordHash, &a.TOTPSecret)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, ErrNotFound
+	}
+	return &a, err
+}
+
+// GenerateTOTPSecret creates a new TOTP secret for the given email and returns
+// the secret + the otpauth:// provisioning URI (for QR code rendering in the UI).
+// The secret is NOT saved yet — call ConfirmTOTP after the user verifies the code.
+func GenerateTOTPSecret(email string) (secret, uri string, err error) {
+	key, err := totp.Generate(totp.GenerateOpts{
+		Issuer:      "EdgeGuard",
+		AccountName: email,
+	})
+	if err != nil {
+		return "", "", err
+	}
+	return key.Secret(), key.URL(), nil
+}
+
+// ConfirmTOTP verifies the given TOTP code against the (not-yet-saved) secret
+// and, on success, persists it and enables TOTP for the user.
+func (r *Repo) ConfirmTOTP(ctx context.Context, userID int64, secret, code string) error {
+	if !totp.Validate(code, secret) {
+		return errors.New("invalid_totp_code")
+	}
+	tag, err := r.pool.Exec(ctx,
+		`UPDATE users SET totp_secret=$1, totp_enabled=true, updated_at=NOW() WHERE id=$2`,
+		secret, userID)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// DisableTOTP clears the TOTP secret and disables 2FA for the given user.
+func (r *Repo) DisableTOTP(ctx context.Context, userID int64) error {
+	tag, err := r.pool.Exec(ctx,
+		`UPDATE users SET totp_secret=NULL, totp_enabled=false, updated_at=NOW() WHERE id=$1`,
+		userID)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// VerifyTOTP checks a live TOTP code against the stored secret.
+func VerifyTOTP(secret, code string) bool {
+	return totp.Validate(code, secret)
+}
+
 func (r *Repo) Count(ctx context.Context) (int, error) {
 	var n int
 	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM users`).Scan(&n)
@@ -167,6 +240,21 @@ func (r *Repo) RecordLogin(ctx context.Context, id int64) {
 	_, _ = r.pool.Exec(ctx, `UPDATE users SET last_login_at=NOW() WHERE id=$1`, id)
 }
 
+// GetOIDCSubject liefert den gespeicherten OIDC-'sub' des Users ("" wenn
+// noch nicht verknüpft).
+func (r *Repo) GetOIDCSubject(ctx context.Context, id int64) (string, error) {
+	var sub string
+	err := r.pool.QueryRow(ctx, `SELECT COALESCE(oidc_subject, '') FROM users WHERE id=$1`, id).Scan(&sub)
+	return sub, err
+}
+
+// SetOIDCSubject speichert den OIDC-'sub' beim ersten erfolgreichen
+// SSO-Login (opportunistisches Linking).
+func (r *Repo) SetOIDCSubject(ctx context.Context, id int64, sub string) error {
+	_, err := r.pool.Exec(ctx, `UPDATE users SET oidc_subject=$1, updated_at=NOW() WHERE id=$2`, sub, id)
+	return err
+}
+
 // VerifyPassword is a constant-time bcrypt compare.
 func VerifyPassword(hash, password string) bool {
 	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) == nil

internal/services/waf/waf.go

@@ -0,0 +1,227 @@
+// Package waf implements CRUD for per-domain WAF policies (waf_configs).
+package waf
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+var ErrNotFound = errors.New("waf config not found")
+
+type Repo struct {
+	Pool *pgxpool.Pool
+}
+
+func New(pool *pgxpool.Pool) *Repo { return &Repo{Pool: pool} }
+
+const baseSelect = `
+SELECT id, domain_id, enabled, mode, paranoia_level,
+       rule_exclusions, exclusion_notes, trusted_proxies, custom_rules, updated_at
+FROM waf_configs
+`
+
+func scan(row pgx.Row) (*models.WafConfig, error) {
+	var c models.WafConfig
+	err := row.Scan(
+		&c.ID, &c.DomainID, &c.Enabled, &c.Mode, &c.ParanoiaLevel,
+		&c.RuleExclusions, &c.ExclusionNotes, &c.TrustedProxies, &c.CustomRules, &c.UpdatedAt,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if c.ExclusionNotes == nil {
+		c.ExclusionNotes = map[string]string{}
+	}
+	return &c, nil
+}
+
+// List returns all WAF configs ordered by domain_id.
+func (r *Repo) List(ctx context.Context) ([]models.WafConfig, error) {
+	rows, err := r.Pool.Query(ctx, baseSelect+" ORDER BY domain_id ASC")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]models.WafConfig, 0, 16)
+	for rows.Next() {
+		c, err := scan(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *c)
+	}
+	return out, rows.Err()
+}
+
+// GetByDomain returns the WAF config for a domain, or ErrNotFound.
+func (r *Repo) GetByDomain(ctx context.Context, domainID int64) (*models.WafConfig, error) {
+	row := r.Pool.QueryRow(ctx, baseSelect+" WHERE domain_id = $1", domainID)
+	c, err := scan(row)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, err
+	}
+	return c, nil
+}
+
+// Upsert inserts or updates the WAF config for a domain.
+// Returns the resulting row.
+func (r *Repo) Upsert(ctx context.Context, c models.WafConfig) (*models.WafConfig, error) {
+	c.UpdatedAt = time.Now()
+	if c.ExclusionNotes == nil {
+		c.ExclusionNotes = map[string]string{}
+	}
+	row := r.Pool.QueryRow(ctx, `
+		INSERT INTO waf_configs
+		    (domain_id, enabled, mode, paranoia_level,
+		     rule_exclusions, exclusion_notes, trusted_proxies, custom_rules, updated_at)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+		ON CONFLICT (domain_id) DO UPDATE SET
+		    enabled          = EXCLUDED.enabled,
+		    mode             = EXCLUDED.mode,
+		    paranoia_level   = EXCLUDED.paranoia_level,
+		    rule_exclusions  = EXCLUDED.rule_exclusions,
+		    exclusion_notes  = EXCLUDED.exclusion_notes,
+		    trusted_proxies  = EXCLUDED.trusted_proxies,
+		    custom_rules     = EXCLUDED.custom_rules,
+		    updated_at       = EXCLUDED.updated_at
+		RETURNING id, domain_id, enabled, mode, paranoia_level,
+		          rule_exclusions, exclusion_notes, trusted_proxies, custom_rules, updated_at
+	`,
+		c.DomainID, c.Enabled, c.Mode, c.ParanoiaLevel,
+		c.RuleExclusions, c.ExclusionNotes, c.TrustedProxies, c.CustomRules, c.UpdatedAt,
+	)
+	return scan(row)
+}
+
+// ListEnabled returns only configs with enabled=true (used by the WAF agent).
+func (r *Repo) ListEnabled(ctx context.Context) ([]models.WafConfig, error) {
+	rows, err := r.Pool.Query(ctx, baseSelect+" WHERE enabled = true ORDER BY domain_id ASC")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]models.WafConfig, 0, 8)
+	for rows.Next() {
+		c, err := scan(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, *c)
+	}
+	return out, rows.Err()
+}
+
+// WafAlert mirrors the waf_alerts DB row.
+type WafAlert struct {
+	ID        int64      `json:"id"`
+	DomainID  *int64     `json:"domain_id,omitempty"`
+	Hostname  string     `json:"hostname"`
+	ClientIP  string     `json:"client_ip"`
+	Method    string     `json:"method"`
+	URI       string     `json:"uri"`
+	RuleID    int        `json:"rule_id"`
+	RuleMsg   string     `json:"rule_msg"`
+	Severity  string     `json:"severity"`
+	Action    string     `json:"action"`
+	CreatedAt time.Time  `json:"created_at"`
+}
+
+// ListAlerts returns recent WAF alerts, optionally filtered by domain_id.
+func (r *Repo) ListAlerts(ctx context.Context, domainID *int64, limit int) ([]WafAlert, error) {
+	if limit <= 0 || limit > 1000 {
+		limit = 200
+	}
+	var rows interface{ Next() bool; Scan(...any) error; Close(); Err() error }
+	var err error
+	if domainID != nil {
+		rows2, e := r.Pool.Query(ctx, `
+			SELECT id, domain_id, hostname, client_ip, method, uri,
+			       rule_id, rule_msg, severity, action, created_at
+			FROM waf_alerts
+			WHERE domain_id = $1
+			ORDER BY created_at DESC LIMIT $2
+		`, *domainID, limit)
+		rows, err = rows2, e
+	} else {
+		rows2, e := r.Pool.Query(ctx, `
+			SELECT id, domain_id, hostname, client_ip, method, uri,
+			       rule_id, rule_msg, severity, action, created_at
+			FROM waf_alerts
+			ORDER BY created_at DESC LIMIT $1
+		`, limit)
+		rows, err = rows2, e
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]WafAlert, 0, limit)
+	for rows.Next() {
+		var a WafAlert
+		if err := rows.Scan(
+			&a.ID, &a.DomainID, &a.Hostname, &a.ClientIP, &a.Method, &a.URI,
+			&a.RuleID, &a.RuleMsg, &a.Severity, &a.Action, &a.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		out = append(out, a)
+	}
+	return out, rows.Err()
+}
+
+// PurgeAlerts removes alerts older than the given number of days.
+func (r *Repo) PurgeAlerts(ctx context.Context, olderThanDays int) error {
+	_, err := r.Pool.Exec(ctx,
+		`DELETE FROM waf_alerts WHERE created_at < NOW() - ($1 || ' days')::interval`,
+		olderThanDays,
+	)
+	return err
+}
+
+// DomainConfigPair combines a domain hostname with its WAF config.
+type DomainConfigPair struct {
+	Hostname string
+	Config   models.WafConfig
+}
+
+// ListAllWithDomain returns all WAF configs joined with their domain name.
+// Used by the WAF agent to build the hostname→engine mapping.
+func (r *Repo) ListAllWithDomain(ctx context.Context) ([]DomainConfigPair, error) {
+	rows, err := r.Pool.Query(ctx, `
+		SELECT d.name,
+		       w.id, w.domain_id, w.enabled, w.mode, w.paranoia_level,
+		       w.rule_exclusions, w.trusted_proxies, w.custom_rules, w.updated_at
+		FROM waf_configs w
+		JOIN domains d ON d.id = w.domain_id
+		WHERE d.active = true
+		ORDER BY d.name ASC
+	`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make([]DomainConfigPair, 0, 16)
+	for rows.Next() {
+		var p DomainConfigPair
+		var c models.WafConfig
+		if err := rows.Scan(
+			&p.Hostname,
+			&c.ID, &c.DomainID, &c.Enabled, &c.Mode, &c.ParanoiaLevel,
+			&c.RuleExclusions, &c.TrustedProxies, &c.CustomRules, &c.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		p.Config = c
+		out = append(out, p)
+	}
+	return out, rows.Err()
+}

internal/squid/squid.cfg.tpl

@@ -2,12 +2,14 @@
 # Source: internal/squid/squid.go (template: squid.cfg.tpl).
 # Re-generate via `edgeguard-ctl render-config --only=squid`.
 
-http_port {{.ListenPort}}
+{{range .ListenAddrs -}}
+{{if .Addr}}http_port {{.Addr}}:{{.Port}}
+{{else}}http_port {{.Port}}
+{{end}}{{- end}}
 
-# Standard cache directory + small in-memory cache. Forward proxy
-# isn't a CDN — we keep cache modest to avoid disk pressure.
-cache_dir ufs /var/spool/squid 100 16 256
-cache_mem 64 MB
+cache_dir ufs /var/spool/squid {{.CacheDirMB}} 16 256
+cache_mem {{.CacheMemMB}} MB
+maximum_object_size {{.MaxObjSizeMB}} MB
 
 # Logging — combined access log, rotated by logrotate.
 access_log /var/log/squid/access.log squid
@@ -56,7 +58,9 @@ http_access allow localhost
 http_access allow localnet
 http_access deny all
 
-# Hostnames + visible name — operator can override via squid.conf
-# drop-in if needed.
+connect_timeout {{.ConnectTimeout}} seconds
+read_timeout {{.ReadTimeout}} seconds
+request_timeout {{.RequestTimeout}} seconds
+
 visible_hostname edgeguard-proxy
 forwarded_for on

internal/squid/squid.go

@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"text/template"
 
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -21,8 +22,8 @@ import (
 )
 
 const (
-	confPath   = "/etc/edgeguard/squid/squid.conf"
-	listenPort = 3128
+	confPath          = "/etc/edgeguard/squid/squid.conf"
+	defaultListenPort = 3128
 )
 
 //go:embed squid.cfg.tpl
@@ -30,9 +31,20 @@ var cfgTpl string
 
 var tpl = template.Must(template.New("squid").Parse(cfgTpl))
 
+type ListenAddr struct {
+	Addr string // empty = all interfaces
+	Port int
+}
+
 type View struct {
-	ListenPort int
-	ACLs       []models.ForwardProxyACL
+	ListenAddrs    []ListenAddr
+	ACLs           []models.ForwardProxyACL
+	CacheMemMB     int
+	CacheDirMB     int
+	MaxObjSizeMB   int
+	ConnectTimeout int
+	ReadTimeout    int
+	RequestTimeout int
 }
 
 type Generator struct {
@@ -52,7 +64,45 @@ func (g *Generator) renderBuf(ctx context.Context) (bytes.Buffer, error) {
 	if err != nil {
 		return bytes.Buffer{}, fmt.Errorf("list acls: %w", err)
 	}
-	view := View{ListenPort: listenPort, ACLs: acls}
+
+	// Read all settings — fall back to defaults if table not migrated yet.
+	s := models.ForwardProxySettings{
+		ListenPort:     defaultListenPort,
+		CacheMemMB:     64,
+		CacheDirMB:     100,
+		MaxObjSizeMB:   4,
+		ConnectTimeout: 60,
+		ReadTimeout:    300,
+		RequestTimeout: 300,
+	}
+	_ = g.Pool.QueryRow(ctx, `
+SELECT listen_addresses, listen_port,
+       cache_mem_mb, cache_dir_mb, max_obj_size_mb,
+       connect_timeout, read_timeout, request_timeout
+FROM forward_proxy_settings WHERE id=1`).Scan(
+		&s.ListenAddresses, &s.ListenPort,
+		&s.CacheMemMB, &s.CacheDirMB, &s.MaxObjSizeMB,
+		&s.ConnectTimeout, &s.ReadTimeout, &s.RequestTimeout,
+	)
+
+	var listenAddrs []ListenAddr
+	for _, raw := range splitCSV(s.ListenAddresses) {
+		listenAddrs = append(listenAddrs, ListenAddr{Addr: raw, Port: s.ListenPort})
+	}
+	if len(listenAddrs) == 0 {
+		listenAddrs = []ListenAddr{{Addr: "", Port: s.ListenPort}}
+	}
+
+	view := View{
+		ListenAddrs:    listenAddrs,
+		ACLs:           acls,
+		CacheMemMB:     s.CacheMemMB,
+		CacheDirMB:     s.CacheDirMB,
+		MaxObjSizeMB:   s.MaxObjSizeMB,
+		ConnectTimeout: s.ConnectTimeout,
+		ReadTimeout:    s.ReadTimeout,
+		RequestTimeout: s.RequestTimeout,
+	}
 	var body bytes.Buffer
 	if err := tpl.Execute(&body, view); err != nil {
 		return bytes.Buffer{}, fmt.Errorf("template: %w", err)
@@ -60,6 +110,17 @@ func (g *Generator) renderBuf(ctx context.Context) (bytes.Buffer, error) {
 	return body, nil
 }
 
+func splitCSV(s string) []string {
+	var out []string
+	for _, p := range strings.Split(s, ",") {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
 func (g *Generator) RenderToString(ctx context.Context) (string, error) {
 	buf, err := g.renderBuf(ctx)
 	if err != nil {

internal/unbound/unbound.cfg.tpl

@@ -31,8 +31,10 @@ server:
     do-tcp: yes
     cache-min-ttl: {{.Settings.CacheMinTTL}}
     cache-max-ttl: {{.Settings.CacheMaxTTL}}
-    msg-cache-size: 64m
-    rrset-cache-size: 128m
+    msg-cache-size: {{.Settings.MsgCacheSizeMB}}m
+    rrset-cache-size: {{.Settings.RRSetCacheSizeMB}}m
+    prefetch: {{if .Settings.Prefetch}}yes{{else}}no{{end}}
+    serve-expired: {{if .Settings.ServeExpired}}yes{{else}}no{{end}}
     num-threads: 2
 
     # Hardening

internal/waf/alerts.go

@@ -0,0 +1,84 @@
+package waf
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Alert represents a single WAF rule match that was logged.
+type Alert struct {
+	ID        int64     `json:"id"`
+	DomainID  *int64    `json:"domain_id,omitempty"`
+	Hostname  string    `json:"hostname"`
+	ClientIP  string    `json:"client_ip"`
+	Method    string    `json:"method"`
+	URI       string    `json:"uri"`
+	RuleID    int       `json:"rule_id"`
+	RuleMsg   string    `json:"rule_msg"`
+	Severity  string    `json:"severity"`
+	Action    string    `json:"action"` // "detected" | "blocked"
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// AlertWriter accepts Alert values via a buffered channel and writes
+// them to PostgreSQL asynchronously so SPOE handling stays low-latency.
+type AlertWriter struct {
+	pool   *pgxpool.Pool
+	ch     chan Alert
+}
+
+// NewAlertWriter creates an AlertWriter and starts its background goroutine.
+// bufSize is the number of unwritten alerts that can queue before drops.
+func NewAlertWriter(pool *pgxpool.Pool, bufSize int) *AlertWriter {
+	aw := &AlertWriter{
+		pool: pool,
+		ch:   make(chan Alert, bufSize),
+	}
+	go aw.run()
+	return aw
+}
+
+// Send enqueues an alert. Drops silently if the channel is full to
+// avoid slowing down SPOE request handling.
+func (aw *AlertWriter) Send(a Alert) {
+	select {
+	case aw.ch <- a:
+	default:
+		slog.Warn("waf: alert channel full — dropping alert", "host", a.Hostname, "rule", a.RuleID)
+	}
+}
+
+func (aw *AlertWriter) run() {
+	for a := range aw.ch {
+		aw.write(a)
+	}
+}
+
+func (aw *AlertWriter) write(a Alert) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	// Resolve domain_id from hostname (best-effort).
+	var domainID *int64
+	var id int64
+	if err := aw.pool.QueryRow(ctx,
+		`SELECT id FROM domains WHERE name = $1 AND active = true LIMIT 1`,
+		a.Hostname,
+	).Scan(&id); err == nil {
+		domainID = &id
+	}
+
+	if _, err := aw.pool.Exec(ctx, `
+		INSERT INTO waf_alerts
+		    (domain_id, hostname, client_ip, method, uri,
+		     rule_id, rule_msg, severity, action)
+		VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+	`, domainID, a.Hostname, a.ClientIP, a.Method, a.URI,
+		a.RuleID, a.RuleMsg, a.Severity, a.Action,
+	); err != nil {
+		slog.Warn("waf: write alert to db failed", "error", err)
+	}
+}

internal/waf/engine.go

@@ -0,0 +1,110 @@
+// Package waf implements the per-domain WAF engine for EdgeGuard.
+// It wraps Coraza v3 (OWASP Core Rule Set) and exposes a simple
+// hostname-keyed engine manager that the SPOE agent uses.
+package waf
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/corazawaf/coraza/v3"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+const (
+	DefaultCRSDir   = "/usr/share/edgeguard/waf/crs"
+	DefaultSPOEAddr = "127.0.0.1:9000"
+)
+
+// BuildEngine creates a Coraza WAF instance for the given domain config.
+// crsDir is the path to the OWASP CRS directory (may be empty — engine
+// works without CRS, using only the basic Coraza core rules).
+func BuildEngine(cfg models.WafConfig, crsDir string) (coraza.WAF, error) {
+	directives := buildDirectives(cfg, crsDir)
+	wafCfg := coraza.NewWAFConfig().
+		WithRequestBodyAccess().
+		WithDirectives(directives)
+	return coraza.NewWAF(wafCfg)
+}
+
+// buildDirectives assembles the SecLang directives for a domain config.
+func buildDirectives(cfg models.WafConfig, crsDir string) string {
+	var sb strings.Builder
+
+	sb.WriteString("SecRequestBodyAccess On\n")
+	sb.WriteString("SecResponseBodyAccess Off\n")
+	sb.WriteString("SecRequestBodyLimit 13107200\n")   // 12.5 MB
+	sb.WriteString("SecRequestBodyInMemoryLimit 131072\n") // 128 KB
+
+	sb.WriteString(fmt.Sprintf("SecRuleEngine %s\n", ruleEngineMode(cfg.Mode)))
+
+	if crsDir != "" && crsAvailable(crsDir) {
+		// Paranoia level MUST be set before CRS rules are included.
+		pl := cfg.ParanoiaLevel
+		if pl < 1 || pl > 4 {
+			pl = 1
+		}
+		sb.WriteString(fmt.Sprintf(
+			"SecAction \"id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=%d\"\n", pl,
+		))
+		setupConf := filepath.Join(crsDir, "crs-setup.conf")
+		if _, err := os.Stat(setupConf); err == nil {
+			sb.WriteString(fmt.Sprintf("Include %s\n", setupConf))
+		}
+		rulesGlob := filepath.Join(crsDir, "rules", "*.conf")
+		sb.WriteString(fmt.Sprintf("Include %s\n", rulesGlob))
+	}
+
+	// Rule exclusions (applied after CRS load so they override CRS).
+	for _, id := range cfg.RuleExclusions {
+		id = strings.TrimSpace(id)
+		if id != "" {
+			sb.WriteString(fmt.Sprintf("SecRuleRemoveById %s\n", id))
+		}
+	}
+
+	// Trusted proxies: tell Coraza to trust X-Forwarded-For from these IPs.
+	for _, ip := range cfg.TrustedProxies {
+		ip = strings.TrimSpace(ip)
+		if ip != "" {
+			sb.WriteString(fmt.Sprintf("SecRemoteRulesFailAction Abort\n"))
+			_ = ip // used in custom rules below if needed
+		}
+	}
+
+	// Custom rules (appended last so they can override CRS).
+	if strings.TrimSpace(cfg.CustomRules) != "" {
+		sb.WriteString(cfg.CustomRules)
+		sb.WriteString("\n")
+	}
+
+	return sb.String()
+}
+
+func ruleEngineMode(mode string) string {
+	switch mode {
+	case "blocking":
+		return "On"
+	default: // "detection"
+		return "DetectionOnly"
+	}
+}
+
+// crsAvailable returns true when the CRS rules directory exists and
+// contains at least one .conf file.
+func crsAvailable(crsDir string) bool {
+	rulesDir := filepath.Join(crsDir, "rules")
+	entries, err := os.ReadDir(rulesDir)
+	if err != nil {
+		return false
+	}
+	for _, e := range entries {
+		if strings.HasSuffix(e.Name(), ".conf") {
+			return true
+		}
+	}
+	return false
+}

internal/waf/manager.go

@@ -0,0 +1,157 @@
+package waf
+
+import (
+	"fmt"
+	"log/slog"
+	"sync"
+
+	"github.com/corazawaf/coraza/v3"
+
+	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
+)
+
+// DomainEngine bundles a Coraza WAF with its operating mode.
+type DomainEngine struct {
+	WAF  coraza.WAF
+	Mode string // "detection" | "blocking"
+}
+
+// Manager holds per-domain Coraza engine instances. Engines are
+// rebuilt only when their configuration changes (UpdatedAt differs).
+// All public methods are safe for concurrent use.
+type Manager struct {
+	mu         sync.RWMutex
+	engines    map[string]*DomainEngine // hostname → engine (nil entry = disabled)
+	configKeys map[string]configKey     // hostname → last-seen config fingerprint
+	crsDir     string
+}
+
+// configKey identifies a specific WAF config snapshot so we only
+// rebuild the engine when something actually changed.
+type configKey struct {
+	enabled       bool
+	mode          string
+	paranoiaLevel int
+	updatedAt     int64 // unix nano
+}
+
+// NewManager creates an empty Manager with the given CRS directory.
+func NewManager(crsDir string) *Manager {
+	if crsDir == "" {
+		crsDir = DefaultCRSDir
+	}
+	return &Manager{
+		engines:    make(map[string]*DomainEngine),
+		configKeys: make(map[string]configKey),
+		crsDir:     crsDir,
+	}
+}
+
+// DomainConfig pairs a domain hostname with its WAF policy.
+type DomainConfig struct {
+	Hostname string
+	Config   models.WafConfig
+}
+
+// Reload refreshes engines from the given list, rebuilding only when
+// the config has actually changed since the last call.
+func (m *Manager) Reload(domains []DomainConfig) error {
+	m.mu.RLock()
+	prevEngines := m.engines
+	prevKeys := m.configKeys
+	m.mu.RUnlock()
+
+	newEngines := make(map[string]*DomainEngine, len(domains))
+	newKeys := make(map[string]configKey, len(domains))
+
+	for _, dc := range domains {
+		ck := configKey{
+			enabled:       dc.Config.Enabled,
+			mode:          dc.Config.Mode,
+			paranoiaLevel: dc.Config.ParanoiaLevel,
+			updatedAt:     dc.Config.UpdatedAt.UnixNano(),
+		}
+		newKeys[dc.Hostname] = ck
+
+		if !dc.Config.Enabled {
+			newEngines[dc.Hostname] = nil
+			continue
+		}
+
+		// Reuse existing engine if config hasn't changed.
+		if prev, ok := prevKeys[dc.Hostname]; ok && prev == ck {
+			if existing := prevEngines[dc.Hostname]; existing != nil {
+				newEngines[dc.Hostname] = existing
+				continue
+			}
+		}
+
+		waf, err := BuildEngine(dc.Config, m.crsDir)
+		if err != nil {
+			return fmt.Errorf("waf: build engine for %s: %w", dc.Hostname, err)
+		}
+		newEngines[dc.Hostname] = &DomainEngine{WAF: waf, Mode: dc.Config.Mode}
+		slog.Info("waf: engine (re)loaded",
+			"host", dc.Hostname,
+			"mode", dc.Config.Mode,
+			"paranoia_level", dc.Config.ParanoiaLevel,
+			"crs", crsAvailable(m.crsDir),
+		)
+	}
+
+	m.mu.Lock()
+	m.engines = newEngines
+	m.configKeys = newKeys
+	m.mu.Unlock()
+	return nil
+}
+
+// GetForHost returns the DomainEngine for the given hostname, or
+// (nil, false) when the domain has no WAF or WAF is disabled.
+func (m *Manager) GetForHost(host string) (*DomainEngine, bool) {
+	// Strip port if present (e.g. "example.com:443" → "example.com").
+	if i := lastColon(host); i >= 0 {
+		host = host[:i]
+	}
+	m.mu.RLock()
+	de, ok := m.engines[host]
+	m.mu.RUnlock()
+	if !ok || de == nil {
+		return nil, false
+	}
+	return de, true
+}
+
+// lastColon returns the index of the last ':' in s that looks like a
+// port separator (after the final ']' for IPv6), or -1.
+func lastColon(s string) int {
+	// IPv6 addresses in brackets: "[::1]:443"
+	if len(s) > 0 && s[0] == '[' {
+		if rb := lastByte(s, ']'); rb >= 0 && rb < len(s)-1 && s[rb+1] == ':' {
+			return rb + 1
+		}
+		return -1
+	}
+	// Plain host — only strip port if there's exactly one colon.
+	count := 0
+	idx := -1
+	for i, c := range s {
+		if c == ':' {
+			count++
+			idx = i
+		}
+	}
+	if count == 1 {
+		return idx
+	}
+	return -1
+}
+
+func lastByte(s string, b byte) int {
+	for i := len(s) - 1; i >= 0; i-- {
+		if s[i] == b {
+			return i
+		}
+	}
+	return -1
+}

internal/waf/spoe.go

@@ -0,0 +1,186 @@
+package waf
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"github.com/corazawaf/coraza/v3/types"
+	"github.com/dropmorepackets/haproxy-go/pkg/encoding"
+	"github.com/dropmorepackets/haproxy-go/spop"
+)
+
+// SPOEAgent wraps the haproxy-go SPOE server and dispatches each
+// inspected request to the appropriate per-domain Coraza engine.
+type SPOEAgent struct {
+	Manager      *Manager
+	AlertWriter  *AlertWriter
+	Addr         string
+}
+
+// ListenAndServe starts the SPOE agent. Blocks until ctx is cancelled.
+func (a *SPOEAgent) ListenAndServe(ctx context.Context) error {
+	agent := spop.Agent{
+		Addr:        a.Addr,
+		Handler:     spop.HandlerFunc(a.handle),
+		BaseContext: ctx,
+	}
+	return agent.ListenAndServe()
+}
+
+// handle is called by the haproxy-go SPOE library for every NOTIFY
+// frame HAProxy sends. It extracts the request data, runs Coraza,
+// and optionally sets a txn.waf.status variable to trigger a deny ACL.
+func (a *SPOEAgent) handle(ctx context.Context, w *encoding.ActionWriter, m *encoding.Message) {
+	var (
+		clientIP string
+		method   string
+		uri      string // full request URI (path + optional ?query)
+		httpVer  string
+		host     string
+		rawHdrs  string
+	)
+
+	// Iterate over the key-value pairs HAProxy sent with this message.
+	entry := encoding.AcquireKVEntry()
+	defer encoding.ReleaseKVEntry(entry)
+	for m.KV.Next(entry) {
+		switch {
+		case entry.NameEquals("src"):
+			addr := entry.ValueAddr()
+			if addr.IsValid() {
+				clientIP = addr.String()
+			}
+		case entry.NameEquals("method"):
+			method = string(entry.ValueBytes())
+		case entry.NameEquals("uri"):
+			uri = string(entry.ValueBytes())
+		case entry.NameEquals("ver"):
+			httpVer = string(entry.ValueBytes())
+		case entry.NameEquals("host"):
+			host = string(entry.ValueBytes())
+		case entry.NameEquals("headers"):
+			rawHdrs = string(entry.ValueBytes())
+		}
+		entry.Reset()
+	}
+
+	if host == "" {
+		return
+	}
+
+	de, ok := a.Manager.GetForHost(host)
+	if !ok {
+		return // WAF not configured or disabled for this domain
+	}
+
+	tx := de.WAF.NewTransaction()
+	defer func() {
+		tx.ProcessLogging()
+		if err := tx.Close(); err != nil {
+			slog.Warn("waf: tx.Close", "error", err)
+		}
+	}()
+
+	// Feed connection metadata.
+	if clientIP != "" {
+		tx.ProcessConnection(clientIP, 0, "", 0)
+	}
+
+	if uri == "" {
+		uri = "/"
+	}
+	if httpVer == "" {
+		httpVer = "HTTP/1.1"
+	}
+	tx.ProcessURI(uri, method, httpVer)
+
+	// Feed Host header first (required by many CRS rules).
+	tx.AddRequestHeader("Host", host)
+
+	// Parse and feed all raw headers.
+	parseHeaders(rawHdrs, func(name, val string) {
+		if !strings.EqualFold(name, "host") { // already added above
+			tx.AddRequestHeader(name, val)
+		}
+	})
+
+	// Evaluate request headers.
+	interruption := tx.ProcessRequestHeaders()
+
+	// Log all matched rules (detection + blocking).
+	for _, mr := range tx.MatchedRules() {
+		a.sendAlert(host, clientIP, method, uri, mr, interruption != nil)
+	}
+
+	if interruption != nil {
+		status := interruption.Status
+		if status == 0 {
+			status = http.StatusForbidden
+		}
+		slog.Info("waf: request blocked",
+			"host", host, "method", method, "uri", uri,
+			"client", clientIP, "status", status, "rule", interruption.RuleID,
+		)
+		if de.Mode == "blocking" {
+			if err := w.SetInt64(encoding.VarScopeTransaction, "status", int64(status)); err != nil {
+				slog.Warn("waf: SetInt64 status", "error", err)
+			}
+		}
+	}
+}
+
+// sendAlert enqueues a WAF alert for async DB write.
+// Control-flow rules (pass+nolog with empty message) are skipped —
+// they are CRS paranoia-level skip-markers, not real detections.
+func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.MatchedRule, blocked bool) {
+	if a.AlertWriter == nil {
+		return
+	}
+	ruleID := mr.Rule().ID()
+	// Skip CRS setup/initialization rules (900xxx–909xxx) — they fire on
+	// every request as part of CRS init and are not security events.
+	// Real detection rules start at 910xxx (IP reputation) and above.
+	if ruleID > 0 && ruleID < 910000 {
+		return
+	}
+	// Skip control-flow rules with no message (PL-skip markers).
+	if mr.Message() == "" {
+		return
+	}
+	action := "detected"
+	if blocked && mr.Disruptive() {
+		action = "blocked"
+	}
+	a.AlertWriter.Send(Alert{
+		Hostname: host,
+		ClientIP: clientIP,
+		Method:   method,
+		URI:      uri,
+		RuleID:   mr.Rule().ID(),
+		RuleMsg:  mr.Message(),
+		Severity: mr.Rule().Severity().String(),
+		Action:   action,
+	})
+}
+
+// parseHeaders splits HAProxy raw headers ("Name: value\r\n…") and
+// calls fn for each valid header line.
+func parseHeaders(raw string, fn func(name, val string)) {
+	for _, line := range strings.Split(raw, "\n") {
+		line = strings.TrimRight(line, "\r")
+		if line == "" {
+			continue
+		}
+		idx := strings.IndexByte(line, ':')
+		if idx <= 0 {
+			continue
+		}
+		name := strings.TrimSpace(line[:idx])
+		val := strings.TrimSpace(line[idx+1:])
+		if name != "" {
+			fn(name, val)
+		}
+	}
+}

internal/wireguard/systemd.go

@@ -34,6 +34,21 @@ func stopWGQuick(iface string) error {
 	return nil
 }
 
+func enableWGQuick(iface string) error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "enable", "wg-quick@"+iface+".service")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("systemctl enable wg-quick@%s: %w: %s", iface, err, string(out))
+	}
+	return nil
+}
+
+func disableWGQuick(iface string) error {
+	cmd := exec.Command("sudo", "-n", "/usr/bin/systemctl", "disable", "wg-quick@"+iface+".service")
+	// Ignore failures — unit may already be disabled.
+	_ = cmd.Run()
+	return nil
+}
+
 // symlinkWGQuickConf creates (or atomically replaces) the symlink
 // /etc/wireguard/<iface>.conf → target via sudo. /etc/wireguard/ is
 // owned root:root 700 so the edgeguard user cannot write to it directly;

internal/wireguard/wireguard.go

@@ -152,6 +152,7 @@ func (g *Generator) Render(ctx context.Context) error {
 			}
 			_ = os.Remove(filepath.Join(ConfDir, e.Name()))
 			_ = stopWGQuick(ifaceName)
+			_ = disableWGQuick(ifaceName)
 		}
 	}
 	return nil
@@ -235,6 +236,7 @@ func (g *Generator) renderIface(ctx context.Context, ifc models.WireguardInterfa
 	if err := symlinkWGQuickConf(ifc.Name, path); err != nil {
 		return fmt.Errorf("symlink: %w", err)
 	}
+	_ = enableWGQuick(ifc.Name)
 	if existing, err := os.ReadFile(path); err == nil && bytes.Equal(existing, body.Bytes()) {
 		return startWGQuick(ifc.Name)
 	}

management-ui/src/App.tsx

@@ -1,5 +1,6 @@
-import { Suspense, lazy, useEffect, type ReactNode } from 'react'
+import { Suspense, lazy, useEffect, useState, type ReactNode } from 'react'
 import { BrowserRouter, Navigate, Route, Routes, useLocation } from 'react-router-dom'
+import ErrorBoundary from './components/ErrorBoundary'
 import { ConfigProvider, Spin } from 'antd'
 import deDE from 'antd/locale/de_DE'
 import enUS from 'antd/locale/en_US'
@@ -26,6 +27,7 @@ const FirewallPage = lazy(() => import('./pages/Firewall'))
 const WireguardPage = lazy(() => import('./pages/Wireguard'))
 const ForwardProxyPage = lazy(() => import('./pages/ForwardProxy'))
 const DNSPage = lazy(() => import('./pages/DNS'))
+const DHCPPage = lazy(() => import('./pages/DHCP'))
 const NTPPage = lazy(() => import('./pages/NTP'))
 const ClusterPage = lazy(() => import('./pages/Cluster'))
 const FirewallLivePage = lazy(() => import('./pages/FirewallLive'))
@@ -37,6 +39,8 @@ const AlertsPage = lazy(() => import('./pages/Alerts'))
 const LicensePage = lazy(() => import('./pages/License'))
 const SettingsPage = lazy(() => import('./pages/Settings'))
 const UsersPage = lazy(() => import('./pages/Users'))
+const CrowdSecPage = lazy(() => import('./pages/CrowdSec'))
+const WAFPage = lazy(() => import('./pages/WAF'))
 
 const queryClient = new QueryClient({
   defaultOptions: {
@@ -62,15 +66,51 @@ const antdTheme = {
     colorTextSecondary: '#64748B',
     controlHeight: 34,
   },
+  components: {
+    Tabs: {
+      itemColor: '#334155',
+      itemHoverColor: '#0F172A',
+      itemSelectedColor: '#0EA5E9',
+      inkBarColor: '#0EA5E9',
+      cardBg: '#F1F5F9',
+      titleFontSize: 13,
+    },
+  },
 }
 
 function RequireAuth({ children }: { children: ReactNode }) {
   const user = useAuthStore((s) => s.user)
+  const setUser = useAuthStore((s) => s.set)
   const location = useLocation()
-  if (!user) {
-    return <Navigate to="/login" replace state={{ from: location }} />
+  // Wenn kein Store-User da ist (z.B. direkt nach SSO-Callback: Cookie
+  // gesetzt, sessionStorage leer — oder Hard-Refresh), einmal /auth/me
+  // probieren, bevor wir nach /login umleiten.
+  const [checking, setChecking] = useState(user === null)
+
+  useEffect(() => {
+    if (user !== null) {
+      setChecking(false)
+      return
+    }
+    let cancelled = false
+    apiClient.get('/auth/me')
+      .then((r) => {
+        if (!cancelled && isEnvelope(r.data)) setUser(r.data.data as SessionUser)
+      })
+      .catch(() => { /* 401 → Interceptor leitet auf /login */ })
+      .finally(() => { if (!cancelled) setChecking(false) })
+    return () => { cancelled = true }
+  }, [user, setUser])
+
+  if (user) return <>{children}</>
+  if (checking) {
+    return (
+      <div style={{ minHeight: '100vh', display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+        <Spin size="large" />
+      </div>
+    )
   }
-  return <>{children}</>
+  return <Navigate to="/login" replace state={{ from: location }} />
 }
 
 function SetupGate({ children }: { children: ReactNode }) {
@@ -99,6 +139,7 @@ export default function App() {
       <QueryClientProvider client={queryClient}>
         <BrowserRouter>
           <SetupGate>
+            <LocationKeyBoundary>
             <Suspense fallback={<div className="loader-center"><Spin size="large" /></div>}>
               <Routes>
                 <Route path="/setup" element={<SetupPage onComplete={(u: SessionUser) => useAuthStore.getState().set(u)} />} />
@@ -121,6 +162,7 @@ export default function App() {
                 <Route path="/vpn/wireguard" element={<WireguardPage />} />
                 <Route path="/forward-proxy" element={<ForwardProxyPage />} />
                 <Route path="/dns" element={<DNSPage />} />
+                <Route path="/dhcp" element={<DHCPPage />} />
                 <Route path="/ntp" element={<NTPPage />} />
                   <Route path="/cluster" element={<ClusterPage />} />
                   <Route path="/logs" element={<LogsPage />} />
@@ -131,14 +173,24 @@ export default function App() {
                   <Route path="/license" element={<LicensePage />} />
                   <Route path="/users" element={<UsersPage />} />
                   <Route path="/settings" element={<SettingsPage />} />
+                  <Route path="/crowdsec" element={<CrowdSecPage />} />
+                  <Route path="/waf" element={<WAFPage />} />
                 </Route>
 
                 <Route path="*" element={<Navigate to="/dashboard" replace />} />
               </Routes>
             </Suspense>
+            </LocationKeyBoundary>
           </SetupGate>
         </BrowserRouter>
       </QueryClientProvider>
     </ConfigProvider>
   )
 }
+
+// Resets the ErrorBoundary on every route change so a render error on
+// one page never permanently blocks navigation to another page.
+function LocationKeyBoundary({ children }: { children: ReactNode }) {
+  const { pathname } = useLocation()
+  return <ErrorBoundary key={pathname}>{children}</ErrorBoundary>
+}

management-ui/src/components/ErrorBoundary.tsx

@@ -1,35 +1,65 @@
 import { Component, type ErrorInfo, type ReactNode } from 'react'
 
-// Top-level ErrorBoundary. Catches throws aus dem React-Tree (inkl.
-// Lazy-Chunk-Loadfehler, die auf flakigem Mobilfunk häufig sind) und
-// rendert eine sichtbare Fehlerseite statt #root leer zu lassen.
-// Ohne diese Boundary endet jeder Render-Throw als „blank page".
-//
-// Wir loggen den Fehler in die Browser-Console (für Remote-Debug via
-// Safari-Inspector/Chrome-Remote) und zeigen dem Operator die
-// Fehlermeldung wörtlich — kein Translation-Layer, weil i18n selbst
-// schon kaputt sein kann.
+import { isStaleChunkError, reloadForStaleChunkOnce } from '../lib/staleChunkReload'
 
-interface State { error: Error | null }
+// Top-level ErrorBoundary. Catches throws aus dem React-Tree (inkl.
+// Lazy-Chunk-Loadfehler nach einem Deploy) und rendert eine sichtbare
+// Fehlerseite statt #root leer zu lassen. Ohne diese Boundary endet
+// jeder Render-Throw als „blank page".
+//
+// Stale-Chunk-Fehler (alter Tab referenziert nicht mehr existierende
+// gehashte Chunks nach einem Deploy) werden automatisch per einmaligem
+// Reload behoben — der Operator sieht dann nur kurz „Aktualisiere…".
+// Erst wenn auch der Reload nicht hilft (giveUp) zeigen wir die manuelle
+// Fehlerkarte. Andere Fehler werden wörtlich angezeigt — kein
+// Translation-Layer, weil i18n selbst kaputt sein kann.
+
+interface State { error: Error | null; giveUp: boolean }
 
 export default class ErrorBoundary extends Component<{ children: ReactNode }, State> {
-  state: State = { error: null }
+  state: State = { error: null, giveUp: false }
 
-  static getDerivedStateFromError(error: Error): State {
+  static getDerivedStateFromError(error: Error): Partial<State> {
     return { error }
   }
 
   componentDidCatch(error: Error, info: ErrorInfo) {
     // eslint-disable-next-line no-console
     console.error('[ErrorBoundary]', error, info.componentStack)
+    // Stale-Chunk → einmalig neu laden. Schlägt der Loop-Schutz an
+    // (Reload half nicht), auf die manuelle Karte zurückfallen.
+    if (isStaleChunkError(error) && !reloadForStaleChunkOnce()) {
+      this.setState({ giveUp: true })
+    }
   }
 
-  reset = () => { this.setState({ error: null }) }
+  reset = () => { this.setState({ error: null, giveUp: false }) }
 
   render() {
     const err = this.state.error
     if (!err) return this.props.children
-    const isChunkErr = /Loading chunk|Failed to fetch dynamically imported module|Importing a module script failed/i.test(err.message)
+    const isChunkErr = isStaleChunkError(err)
+
+    // Auto-Reload läuft (Chunk-Fehler, Loop-Schutz noch nicht erreicht):
+    // neutralen Lade-Hinweis zeigen statt der Fehlerkarte.
+    if (isChunkErr && !this.state.giveUp) {
+      return (
+        <div style={{
+          minHeight: '100vh',
+          display: 'flex',
+          alignItems: 'center',
+          justifyContent: 'center',
+          padding: 24,
+          background: '#F8FAFC',
+          color: '#64748B',
+          fontSize: 14,
+          fontFamily: "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif",
+        }}>
+          Aktualisiere EdgeGuard…
+        </div>
+      )
+    }
+
     return (
       <div style={{
         minHeight: '100vh',
@@ -54,7 +84,7 @@ export default class ErrorBoundary extends Component<{ children: ReactNode }, St
           </div>
           <div style={{ fontSize: 13, color: '#64748B', marginBottom: 16 }}>
             {isChunkErr
-              ? 'Ein Teil der App konnte nicht aus dem Netz geladen werden. Das passiert häufig bei wechselndem Mobilfunk-Empfang. Versuche es mit einem Reload.'
+              ? 'Ein Teil der App konnte nicht geladen werden — auch ein automatischer Reload hat nicht geholfen. Bitte lade die Seite manuell neu (ggf. mit Strg+F5), oder prüfe die Verbindung zum Server.'
               : 'Beim Initialisieren der Oberfläche ist ein Fehler aufgetreten.'}
           </div>
           <pre style={{

management-ui/src/components/Layout/AppLayout.tsx

@@ -19,6 +19,7 @@ const PAGE_TITLES: Record<string, string> = {
   '/ip-addresses':   'nav.ipAddresses',
   '/ssl':            'nav.ssl',
   '/dns':            'nav.dns',
+  '/dhcp':           'nav.dhcp',
   '/ntp':            'nav.ntp',
   '/vpn/wireguard':  'nav.wireguard',
   '/forward-proxy':  'nav.forwardProxy',

management-ui/src/components/Layout/Sidebar.tsx

@@ -19,6 +19,7 @@ import {
   FireOutlined,
   GlobalOutlined,
   NodeIndexOutlined,
+  RadarChartOutlined,
   SafetyCertificateOutlined,
   SettingOutlined,
   TeamOutlined,
@@ -66,6 +67,7 @@ const NAV: NavSection[] = [
       { path: '/ip-addresses', labelKey: 'nav.ipAddresses', icon: <NodeIndexOutlined /> },
       { path: '/ssl',          labelKey: 'nav.ssl',         icon: <SafetyCertificateOutlined /> },
       { path: '/dns',          labelKey: 'nav.dns',         icon: <GlobalOutlined /> },
+      { path: '/dhcp',         labelKey: 'nav.dhcp',        icon: <CloudServerOutlined /> },
       { path: '/ntp',          labelKey: 'nav.ntp',         icon: <ClockCircleOutlined /> },
     ],
   },
@@ -76,6 +78,8 @@ const NAV: NavSection[] = [
       { path: '/firewall/live',  labelKey: 'nav.firewallLive', icon: <EyeOutlined />, child: true },
       { path: '/vpn/wireguard',  labelKey: 'nav.wireguard',    icon: <ThunderboltOutlined /> },
       { path: '/forward-proxy',  labelKey: 'nav.forwardProxy', icon: <CloudServerOutlined /> },
+      { path: '/crowdsec',       labelKey: 'nav.crowdsec',     icon: <RadarChartOutlined /> },
+      { path: '/waf',            labelKey: 'nav.waf',          icon: <SafetyCertificateOutlined /> },
     ],
   },
   {
@@ -130,9 +134,9 @@ export default function Sidebar({ isOpen, onClose }: SidebarProps) {
         <span className="sidebar-logo-text">{t('app.title')}</span>
       </div>
 
-      {NAV.map((section) => (
+      {NAV.map((section, idx) => (
         <div key={section.labelKey}>
-          <div className="sidebar-section">
+          <div className={`sidebar-section${idx > 0 ? ' sidebar-section--bordered' : ''}`}>
             <div className="sidebar-section-label">{t(section.labelKey)}</div>
           </div>
           <ul className="sidebar-menu">

management-ui/src/components/UpdateBanner.tsx

@@ -1,5 +1,5 @@
-import { Alert, Button, Popconfirm, Space, Tooltip, message } from 'antd'
-import { CloudDownloadOutlined, ReloadOutlined, RocketOutlined } from '@ant-design/icons'
+import { Alert, Button, Popconfirm, Tooltip, message } from 'antd'
+import { CloudDownloadOutlined, ReloadOutlined, RocketOutlined, ClusterOutlined } from '@ant-design/icons'
 import { useQuery } from '@tanstack/react-query'
 import { useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -20,6 +20,19 @@ interface SystemHealth { status: string; version: string }
 
 interface PendingUpdate { pkg: string; installed: string; available: string }
 
+interface ClusterStatus {
+  mode: string   // "single-node" | "cluster"
+  peers: Array<{ id: string; fqdn: string }>
+}
+
+interface RollingUpdateState {
+  phase: string         // idle | updating-secondary | waiting-secondary | updating-primary | failed
+  secondary_fqdn: string
+  secondary_id: string
+  error?: string
+  updated_at: string
+}
+
 // allUpdates parsed das flache map-Format ({pkg_installed,pkg_available})
 // das /system/package-versions zurückliefert. Eines davon ist meist
 // das meta-Paket "edgeguard" → die "Ziel-Version".
@@ -53,6 +66,46 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
     gcTime: 0,
   })
 
+  const clusterStatus = useQuery({
+    queryKey: ['cluster', 'status-update-banner'],
+    queryFn: async () => {
+      try {
+        const r = await apiClient.get('/cluster/status')
+        return isEnvelope(r.data) ? (r.data.data as ClusterStatus) : null
+      } catch {
+        return null
+      }
+    },
+    refetchInterval: 60_000,
+    staleTime: 30_000,
+  })
+
+  const rollingStatus = useQuery({
+    queryKey: ['cluster', 'rolling-update-status'],
+    queryFn: async () => {
+      try {
+        const r = await apiClient.get('/cluster/rolling-update/status')
+        return isEnvelope(r.data) ? (r.data.data as RollingUpdateState) : null
+      } catch {
+        return null
+      }
+    },
+    refetchInterval: 5_000,
+    staleTime: 0,
+    gcTime: 0,
+  })
+
+  const isCluster = clusterStatus.data?.mode === 'cluster'
+  const rollingPhase = rollingStatus.data?.phase ?? 'idle'
+  const rollingActive = rollingPhase !== 'idle' && rollingPhase !== 'failed' && rollingPhase !== 'done'
+  const secondaryFQDN = rollingStatus.data?.secondary_fqdn ?? ''
+
+  // Verhindert dass ein stale "done" aus einer vorherigen Session sofort
+  // einen Reload auslöst. Nur wenn rollingActive in DIESER Session true
+  // war, reagieren wir auf "done".
+  const wasRollingActiveRef = useRef(false)
+
+  // Normal single-node upgrade state
   const [upgrading, setUpgrading] = useState(false)
   const [upgradeElapsed, setUpgradeElapsed] = useState(0)
   const [forceChecking, setForceChecking] = useState(false)
@@ -61,11 +114,62 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
   const installedRef = useRef<string>('')
   const targetRef = useRef<string>('')
 
+  // Rolling update elapsed counter
+  const [rollingElapsed, setRollingElapsed] = useState(0)
+  const rollingTickRef = useRef<ReturnType<typeof setInterval> | null>(null)
+
   useEffect(() => () => {
     if (upgradePollRef.current) clearInterval(upgradePollRef.current)
     if (upgradeTickRef.current) clearInterval(upgradeTickRef.current)
+    if (rollingTickRef.current) clearInterval(rollingTickRef.current)
   }, [])
 
+  // Start rolling elapsed timer when rolling becomes active
+  useEffect(() => {
+    if (rollingActive) {
+      wasRollingActiveRef.current = true
+      if (!rollingTickRef.current) {
+        setRollingElapsed(0)
+        rollingTickRef.current = setInterval(() => setRollingElapsed(e => e + 1), 1000)
+      }
+    } else if (!rollingActive && rollingTickRef.current) {
+      clearInterval(rollingTickRef.current)
+      rollingTickRef.current = null
+    }
+  }, [rollingActive])
+
+  // "done": nur reagieren wenn wir in DIESER Session rollingActive gesehen
+  // haben — sonst würde ein stale "done" sofort einen Reload auslösen.
+  useEffect(() => {
+    if (rollingPhase === 'done' && wasRollingActiveRef.current) {
+      msg.success(t('update.success', { version: targetRef.current || '…' }))
+      setTimeout(() => window.location.reload(), 1500)
+    }
+  }, [rollingPhase, msg, t])
+
+  // Fallback: wenn "updating-primary" und die API noch antwortet (Primary
+  // schon neu gestartet bevor das UI die Phase gesehen hat), poll auf "done".
+  useEffect(() => {
+    if (rollingPhase === 'updating-primary') {
+      let sawDown = false
+      const poll = setInterval(async () => {
+        try {
+          const res = await apiClient.get('/system/health')
+          const newV = isEnvelope(res.data) ? (res.data.data as SystemHealth).version : ''
+          if (sawDown && newV) {
+            clearInterval(poll)
+            void rollingStatus.refetch()
+          }
+        } catch {
+          sawDown = true
+        }
+      }, 3000)
+      // Safety: nach 2 Min einfach reload
+      const safety = setTimeout(() => { clearInterval(poll); window.location.reload() }, 120_000)
+      return () => { clearInterval(poll); clearTimeout(safety) }
+    }
+  }, [rollingPhase, rollingStatus])
+
   const data = pkgVersions.data ?? {}
   const updates = allUpdates(data)
   const updateAvailable = updates.length > 0
@@ -76,14 +180,8 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
   const forceCheck = async () => {
     setForceChecking(true)
     try {
-      // ?force=1: bypassed den Server-seitigen 5-min-Throttle für
-      // apt-get update. Ohne den Force-Hint würde der Endpoint
-      // einfach den letzten Cache zurückliefern (max. 5 min alt) und
-      // der Button fühlt sich kaputt an. Pattern aus mail-gateway.
       const r = await apiClient.get('/system/package-versions?force=1')
       const fresh = (isEnvelope(r.data) ? (r.data.data as PackageVersions) : {})
-      // useQuery-Cache mit dem frischen Wert füttern damit der Banner
-      // sofort umschaltet, ohne auf die nächste 30s-Welle zu warten.
       void pkgVersions.refetch()
       const found = allUpdates(fresh).length > 0
       msg[found ? 'success' : 'info'](
@@ -105,8 +203,6 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
 
     apiClient.post('/system/upgrade')
       .then(() => {
-        // Poll /healthz (kein Auth, robust auch wenn die API gerade
-        // restartet und Cookie ihre Session nicht erkennt).
         let sawDown = false
         upgradePollRef.current = setInterval(async () => {
           try {
@@ -121,14 +217,9 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
               setTimeout(() => window.location.reload(), 1500)
             }
           } catch {
-            // Connection refused / 502 → API restartet. Beim nächsten
-            // erfolgreichen Poll erkennen wir den Version-Flip.
             sawDown = true
           }
         }, 3000)
-        // Sicherheits-Timeout: nach 2 Min einfach reload — falls der
-        // Restart länger braucht als erwartet, kommt die UI in jedem
-        // Fall wieder hoch.
         setTimeout(() => {
           if (upgradePollRef.current) clearInterval(upgradePollRef.current)
           if (upgradeTickRef.current) clearInterval(upgradeTickRef.current)
@@ -144,13 +235,19 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
       })
   }
 
+  const startRollingUpdate = () => {
+    installedRef.current = installedVersion
+    targetRef.current = targetVersion
+    apiClient.post('/cluster/rolling-update')
+      .then(() => {
+        void rollingStatus.refetch()
+      })
+      .catch((e: Error) => {
+        msg.error(t('update.failed') + ': ' + e.message)
+      })
+  }
+
   if (compact) {
-    // Compact-Variante: Force-Check-Button für "ich will jetzt prüfen",
-    // wenn aktuell NICHTS ausstehendes da ist. Sobald ein Update
-    // verfügbar ist, übernimmt der gelbe Full-Mode-Banner (in
-    // AppLayout) die Sichtbarkeit — wir blenden den Compact-Button
-    // dann komplett aus, sonst doppelt-doppelt Info (Befund 2026-05-15:
-    // "die roten Banner können weg, der gelbe Banner reicht").
     if (updateAvailable) {
       return <>{msgCtx}</>
     }
@@ -171,7 +268,7 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
     )
   }
 
-  if (!updateAvailable && !upgrading) {
+  if (!updateAvailable && !upgrading && !rollingActive) {
     return <>{msgCtx}</>
   }
 
@@ -179,38 +276,43 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
     <>
       {msgCtx}
 
-      {updateAvailable && !upgrading && (
+      {updateAvailable && !upgrading && !rollingActive && (
         <Alert
           type="warning"
           banner
           showIcon
           icon={<CloudDownloadOutlined />}
-          message={t('update.available', { version: targetVersion })}
-          description={updates.length > 1
-            ? t('update.multiPackageHint', { count: updates.length })
-            : undefined}
-          action={
-            <Space>
-              <Button
-                size="small"
-                icon={<ReloadOutlined />}
-                loading={forceChecking}
-                onClick={forceCheck}
-              >
-                {t('update.checkNow')}
-              </Button>
-              <Popconfirm
-                title={t('update.confirmTitle')}
-                description={t('update.confirmDesc', { version: targetVersion })}
-                okText={t('update.applyNow')}
-                cancelText={t('common.cancel')}
-                onConfirm={startUpgrade}
-              >
-                <Button size="small" type="primary" icon={<CloudDownloadOutlined />}>
-                  {t('update.applyNow')}
-                </Button>
-              </Popconfirm>
-            </Space>
+          message={
+            <div className="update-banner-row">
+              <span>{t('update.available', { version: targetVersion })}</span>
+              {isCluster ? (
+                <Popconfirm
+                  title={t('update.rollingConfirmTitle')}
+                  description={t('update.rollingConfirmDesc', {
+                    secondary: clusterStatus.data?.peers?.[0]?.fqdn ?? 'secondary',
+                  })}
+                  okText={t('update.rollingUpdate')}
+                  cancelText={t('common.cancel')}
+                  onConfirm={startRollingUpdate}
+                >
+                  <Button size="small" type="primary" icon={<ClusterOutlined />}>
+                    Rolling Update
+                  </Button>
+                </Popconfirm>
+              ) : (
+                <Popconfirm
+                  title={t('update.confirmTitle')}
+                  description={t('update.confirmDesc', { version: targetVersion })}
+                  okText={t('update.applyNow')}
+                  cancelText={t('common.cancel')}
+                  onConfirm={startUpgrade}
+                >
+                  <Button size="small" type="primary" icon={<CloudDownloadOutlined />}>
+                    {t('update.applyNow')}
+                  </Button>
+                </Popconfirm>
+              )}
+            </div>
           }
         />
       )}
@@ -234,26 +336,10 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
             </div>
 
             <div className="update-modal__steps">
-              <Step
-                done={upgradeElapsed >= 5}
-                active={upgradeElapsed < 5}
-                label={t('update.stepDownload')}
-              />
-              <Step
-                done={upgradeElapsed >= 15}
-                active={upgradeElapsed >= 5 && upgradeElapsed < 15}
-                label={t('update.stepInstall')}
-              />
-              <Step
-                done={upgradeElapsed >= 25}
-                active={upgradeElapsed >= 15 && upgradeElapsed < 25}
-                label={t('update.stepRestart')}
-              />
-              <Step
-                done={false}
-                active={upgradeElapsed >= 25}
-                label={t('update.stepVerify')}
-              />
+              <Step done={upgradeElapsed >= 5} active={upgradeElapsed < 5} label={t('update.stepDownload')} />
+              <Step done={upgradeElapsed >= 15} active={upgradeElapsed >= 5 && upgradeElapsed < 15} label={t('update.stepInstall')} />
+              <Step done={upgradeElapsed >= 25} active={upgradeElapsed >= 15 && upgradeElapsed < 25} label={t('update.stepRestart')} />
+              <Step done={false} active={upgradeElapsed >= 25} label={t('update.stepVerify')} />
             </div>
 
             <div className="update-modal__timer">{upgradeElapsed}s</div>
@@ -261,6 +347,54 @@ export default function UpdateBanner({ compact = false }: UpdateBannerProps = {}
           </div>
         </div>
       )}
+
+      {rollingActive && (
+        <div className="update-modal-overlay">
+          <div className="update-modal">
+            <div className="update-modal__orbit">
+              <div className="update-modal__ring" />
+              <div className="update-modal__ring update-modal__ring--2" />
+              <div className="update-modal__dot" />
+              <div className="update-modal__dot update-modal__dot--2" />
+              <div className="update-modal__center">
+                <ClusterOutlined className="update-modal__icon" />
+              </div>
+            </div>
+
+            <div className="update-modal__title">{t('update.rollingRunning')}</div>
+            <div className="update-modal__version">
+              v{installedRef.current || '…'} → v{targetRef.current || '…'}
+            </div>
+
+            <div className="update-modal__steps">
+              <Step
+                done={rollingPhase === 'waiting-secondary' || rollingPhase === 'updating-primary'}
+                active={rollingPhase === 'updating-secondary'}
+                label={t('update.rollingStepSecondary', { fqdn: secondaryFQDN })}
+              />
+              <Step
+                done={rollingPhase === 'updating-primary'}
+                active={rollingPhase === 'waiting-secondary'}
+                label={t('update.rollingStepWaiting')}
+              />
+              <Step
+                done={false}
+                active={rollingPhase === 'updating-primary'}
+                label={t('update.rollingStepPrimary')}
+              />
+            </div>
+
+            <div className="update-modal__timer">{rollingElapsed}s</div>
+            <div className="update-modal__hint">{t('update.waitHint')}</div>
+
+            {rollingStatus.data?.error && (
+              <div className="update-modal__hint" style={{ color: '#ff4d4f' }}>
+                {rollingStatus.data.error}
+              </div>
+            )}
+          </div>
+        </div>
+      )}
     </>
   )
 }

management-ui/src/i18n/locales/de/common.json

@@ -15,6 +15,7 @@
     "wireguard": "WireGuard",
     "forwardProxy": "Forward-Proxy",
     "dns": "DNS",
+    "dhcp": "DHCP",
     "ntp": "Zeit (NTP)",
     "firewall": "Firewall",
     "firewallLive": "Firewall-Log",
@@ -27,13 +28,15 @@
     "alerts": "Alarme",
     "license": "Lizenz",
     "settings": "Einstellungen",
+    "crowdsec": "CrowdSec IDS",
     "section": {
       "overview": "Übersicht",
       "routing": "Routing",
       "network": "Netzwerk",
       "security": "Sicherheit",
       "system": "System"
-    }
+    },
+    "waf": "WAF"
   },
   "fw": {
     "title": "Firewall",
@@ -152,7 +155,9 @@
       "emptyTitle": "Noch keine eigenen Firewall-Regeln.",
       "emptyDesc": "Die System-Regeln oben halten SSH (rate-limited), HTTPS :443 und Mgmt-UI :3443 immer offen (Anti-Lockout). Eigene Regeln für app-spezifische Inbound-Ports oder zonenübergreifende Forwards anlegen.",
       "logEnabled": "Logging aktiv — gematchte Pakete werden ins Firewall-Log geschrieben",
-      "ruleDisabled": "Regel deaktiviert"
+      "ruleDisabled": "Regel deaktiviert",
+      "unnamed": "(kein Name)",
+      "zeroHitHint": "Keine Treffer seit dem letzten Neustart — möglicherweise ungenutzte oder überlagerte Regel"
     },
     "kpi": {
       "policyRules": "Policy-Regeln",
@@ -171,7 +176,10 @@
       "allActions": "Alle Aktionen",
       "allZones": "Alle Zonen",
       "noResults": "Keine Regeln entsprechen dem Filter",
-      "noResultsHint": "Filter zurücksetzen um alle Regeln zu sehen."
+      "noResultsHint": "Filter zurücksetzen um alle Regeln zu sehen.",
+      "groupView": "Nach Zone gruppieren",
+      "flatView": "Flache Liste",
+      "rules": "Regeln"
     },
     "nat": {
       "name": "Name",
@@ -281,7 +289,30 @@
     "loggedInAs": "Angemeldet als",
     "forgotPassword": "Passwort vergessen?",
     "viewerBadge": "Nur lesen",
-    "viewerHint": "Dieser Account hat die Rolle Betrachter — Änderungen sind gesperrt. Ein Admin kann die Rolle anpassen."
+    "viewerHint": "Dieser Account hat die Rolle Betrachter — Änderungen sind gesperrt. Ein Admin kann die Rolle anpassen.",
+    "sso": {
+      "login": "Mit SSO anmelden",
+      "err": {
+        "no_account": "Kein EdgeGuard-Konto für diese E-Mail. Bitte wende dich an einen Administrator.",
+        "disabled": "Dieses Konto ist deaktiviert.",
+        "unverified": "Die E-Mail-Adresse ist beim Identity-Provider nicht verifiziert.",
+        "state": "Sicherheitsprüfung fehlgeschlagen (State). Bitte erneut versuchen.",
+        "nonce": "Sicherheitsprüfung fehlgeschlagen (Nonce). Bitte erneut versuchen.",
+        "token": "Das Token vom Identity-Provider konnte nicht verifiziert werden.",
+        "exchange": "Code-Austausch mit dem Identity-Provider fehlgeschlagen.",
+        "expired": "Die Anmeldesitzung ist abgelaufen. Bitte erneut versuchen.",
+        "denied": "Anmeldung beim Identity-Provider abgebrochen.",
+        "subject_mismatch": "Die Identität passt nicht zum hinterlegten Konto.",
+        "config": "SSO ist nicht korrekt konfiguriert.",
+        "server": "Interner Fehler bei der SSO-Anmeldung.",
+        "generic": "SSO-Anmeldung fehlgeschlagen."
+      }
+    },
+    "totp": {
+      "prompt": "Bitte gib den 6-stelligen Code aus deiner Authenticator-App ein.",
+      "verify": "Code bestätigen",
+      "invalidCode": "Ungültiger Code"
+    }
   },
   "reset": {
     "title": "Admin-Passwort zurücksetzen",
@@ -392,6 +423,17 @@
       "backends": "Backends",
       "attached": "{{count}}/{{total}} Domains haben einen Primary-Backend"
     },
+    "vipCard": {
+      "title": "VIP / VRRP",
+      "noVips": "Keine VIPs konfiguriert",
+      "keepalivedInactive": "keepalived läuft nicht",
+      "state": {
+        "MASTER": "MASTER",
+        "BACKUP": "BACKUP",
+        "FAULT": "FAULT",
+        "UNKNOWN": "Unbekannt"
+      }
+    },
     "systemCard": {
       "title": "System",
       "version": "Version",
@@ -399,9 +441,16 @@
       "ifaces": "Interfaces",
       "wg": "WireGuard"
     },
+    "networkServicesCard": {
+      "title": "Netzwerk-Dienste",
+      "configure": "Konfigurieren"
+    },
     "alertsCard": {
       "title": "Aktuelle Alerts",
-      "viewAll": "Alle anzeigen"
+      "viewAll": "Alle anzeigen",
+      "summary": "{{critical}} kritisch · {{warning}} Warnung",
+      "summaryWarning": "{{warning}} Warnung",
+      "summaryCritical": "{{critical}} kritisch"
     },
     "downBackendsAlert": "{{count}} Backend(s) komplett ausgefallen — kein Server UP",
     "maintenanceAlert": "{{count}} Domain(s) im Wartungs-Modus",
@@ -624,11 +673,22 @@
     "tokenLabel": "Token",
     "caFingerprintLabel": "CA-Fingerabdruck",
     "driftBanner": "Config-Drift erkannt",
-    "driftBannerDesc": "Ein oder mehrere Peers haben einen anderen Config-Hash als dieser Node. Entweder stehen noch Änderungen in der Outbox, oder auf einem Peer wurde direkt in der DB editiert. Warte bis die Outbox leer ist oder starte Diagnostics.",
+    "driftBannerDesc": "Ein oder mehrere Peers haben einen anderen Config-Hash als dieser Node. Kurz nach einer Änderung ist das normal (die Replikation hinkt nach) und verschwindet von selbst. Bleibt der Drift bestehen, ist die Replikation gestört oder es wurde direkt in die DB eines Peers geschrieben.",
+    "repair": {
+      "button": "Resync erzwingen",
+      "noStandbyHint": "Kein Standby-Node gefunden, an den der Resync delegiert werden könnte.",
+      "confirmTitle": "Replikation reparieren?",
+      "confirmDesc": "Baut die Replikations-Subscription auf dem Standby-Node neu auf und kopiert alle geteilten Config-Tabellen frisch vom Primary. Vom Primary aus geklickt wird der Resync per mTLS an den Standby delegiert. Lokale Direkt-Edits am Standby werden dabei überschrieben (Primary = Source of Truth).",
+      "confirmOk": "Resync starten",
+      "started": "Resync angestoßen — läuft im Hintergrund auf dem Standby.",
+      "ok": "Replikation repariert — Config wieder synchron.",
+      "failed": "Resync fehlgeschlagen"
+    },
     "col": {
       "node": "Knoten",
       "status": "Status",
       "role": "Rolle",
+      "pgRole": "PG-Rolle",
       "apiUrl": "API-URL",
       "configHash": "Config-Hash",
       "version": "Version",
@@ -641,6 +701,41 @@
       "uptime": "Uptime",
       "fetchMs": "Fetch"
     },
+    "pgRole": {
+      "standalone": "standalone",
+      "primary": "primary",
+      "standby": "standby"
+    },
+    "vipCard": {
+      "title": "Hochverfügbarkeit (VIP / Keepalived)",
+      "vipAddress": "VIP-Adresse",
+      "vipAddressHelp": "Virtuelle IP-Adresse die zwischen Nodes wandert (z.B. 89.163.205.10)",
+      "vipInterface": "Netzwerk-Interface",
+      "vipInterfaceHelp": "Interface auf dem die VIP gebunden wird (z.B. eth0)",
+      "vipAuthPass": "VRRP Auth-Passwort",
+      "vipAuthPassHelp": "Max. 8 Zeichen — Keepalived-Limit. Gleich auf allen Nodes.",
+      "vrrpRouterId": "VRRP Router-ID",
+      "vrrpRouterIdHelp": "Muss im Subnetz eindeutig sein (1–255). Standard: 51.",
+      "saveBtn": "Speichern & Keepalived neu konfigurieren",
+      "saved": "VIP-Einstellungen gespeichert",
+      "saveFailed": "Speichern fehlgeschlagen",
+      "hintTitle": "Nächste Schritte nach dem Speichern",
+      "hintPrimary": "Auf dem Primary: edgeguard-ctl cluster-init-replication",
+      "hintStandby": "Auf dem Secondary: edgeguard-ctl cluster-setup-standby <primary-ip>",
+      "hintKeepalived": "Keepalived auf beiden Nodes: sudo systemctl enable --now keepalived",
+      "hintFailover": "Bei Failover: edgeguard-ctl promote (auf dem Secondary)",
+      "splitBrainSection": "Split-Brain-Schutz (Dual-Path VRRP + Gateway-Tracking)",
+      "hbInterface": "Heartbeat-Interface",
+      "hbInterfaceHelp": "Zweites Interface für die VI_HB-Instanz — VRRP-Advertisements laufen hier unabhängig von VI_1. Leer lassen um zu deaktivieren.",
+      "hbSrcIp": "Heartbeat-Quell-IP",
+      "hbSrcIpHelp": "Eigene IP auf dem Heartbeat-Interface (unicast_src_ip für VI_HB).",
+      "hbPeerIp": "Heartbeat-Peer-IP",
+      "hbPeerIpHelp": "Peer-IP auf dem Heartbeat-Interface (unicast_peer für VI_HB).",
+      "hbRouterId": "Heartbeat Router-ID",
+      "hbRouterIdHelp": "VRRP virtual_router_id für VI_HB — muss sich von der Haupt-Router-ID unterscheiden. Standard: 52.",
+      "gwCheckIp": "Gateway-Check-IP",
+      "gwCheckIpHelp": "Upstream-Gateway-IP die alle 5 s angepingt wird. Nicht erreichbar → Priorität sinkt um 110 → Failover wird ausgelöst. Leer lassen um zu deaktivieren."
+    },
     "loadTitle": "Per-Node Resources (mTLS-Aggregator)",
     "loadEmpty": "Keine Node-Resources verfügbar — Agent-Listener nicht erreichbar?",
     "certCardTitle": "Cluster-TLS-Zertifikate",
@@ -674,7 +769,27 @@
     "step3SetupDesc": "Setup-Wizard auf dem neuen Knoten öffnen (https://<node-fqdn>:3443/setup), \"Vorhandenem Cluster beitreten\" wählen, Primary-FQDN ({{primaryFqdn}}) eingeben und den Token oben einfügen.",
     "generateNewToken": "Neuen Token generieren",
     "setupWizardHint": "Setup-Wizard auf dem neuen Knoten öffnen",
-    "newNodeFqdnLabel": "FQDN des neuen Knotens"
+    "newNodeFqdnLabel": "FQDN des neuen Knotens",
+    "vipTest": {
+      "cardTitle": "VIP-Schwenk Test",
+      "cardDesc": "Verschiebt einen VIP temporär auf den Secondary um zu prüfen ob die Dienste korrekt antworten. Keepalived ist nicht beteiligt — reiner ip addr add/del Test.",
+      "colAddress": "VIP-Adresse",
+      "colInterface": "Interface",
+      "colActiveOn": "Aktiv auf",
+      "swingBtn": "→ Secondary",
+      "restoreBtn": "← Primary",
+      "swingOk": "VIP erfolgreich auf Secondary geschwenkt",
+      "restoreOk": "VIP zurück auf Primary",
+      "swingFailed": "VIP-Schwenk fehlgeschlagen",
+      "restoreFailed": "VIP-Rückschwenk fehlgeschlagen",
+      "noVips": "Keine VIPs konfiguriert (ip_addresses mit is_vip=true)",
+      "steps": "Schritte",
+      "stepOk": "OK",
+      "stepFail": "Fehler",
+      "confirmSwing": "{{addr}} auf Secondary verschieben?",
+      "confirmRestore": "{{addr}} zurück auf Primary?",
+      "unknown": "unbekannt"
+    }
   },
   "ssl": {
     "title": "SSL-Zertifikate",
@@ -811,6 +926,24 @@
     "configPreviewBtn": "Vorschau laden",
     "configPreviewHint": "Rendert die gewählte Service-Config aus dem aktuellen DB-State. Nur Lesezugriff — es wird nichts auf Disk geschrieben oder neu geladen.",
     "configCopied": "Config in Zwischenablage kopiert",
+    "oidc": {
+      "title": "Single Sign-On (OIDC)",
+      "intro": "SSO-Login per OpenID Connect (z. B. Keycloak), zusätzlich zum lokalen Login. Anmeldung gelingt nur für bereits angelegte Benutzer; die Rolle wird in EdgeGuard verwaltet.",
+      "enabled": "SSO aktiviert",
+      "issuerUrl": "Issuer-URL",
+      "issuerHint": "Basis-URL des Realms, z. B. https://keycloak.example.com/realms/edgeguard",
+      "clientId": "Client-ID",
+      "clientSecret": "Client-Secret",
+      "secretSet": "Gespeichert — leer lassen, um es unverändert zu lassen.",
+      "secretUnset": "Noch kein Secret gespeichert.",
+      "scopes": "Scopes",
+      "emailClaim": "E-Mail-Claim",
+      "buttonLabel": "Button-Beschriftung",
+      "redirectUri": "Redirect-URI",
+      "redirectHint": "Diese URL im Keycloak-Client als gültige Redirect-URI eintragen (pro Cluster-Node die jeweilige FQDN).",
+      "saved": "OIDC-Einstellungen gespeichert",
+      "saveFailed": "Speichern der OIDC-Einstellungen fehlgeschlagen"
+    },
     "passwordCardTitle": "Admin-Passwort ändern",
     "currentPassword": "Aktuelles Passwort",
     "newPassword": "Neues Passwort",
@@ -841,7 +974,14 @@
     "stepDownload": "Pakete laden",
     "stepInstall": "Installation",
     "stepRestart": "Service-Restart",
-    "stepVerify": "Verifizierung"
+    "stepVerify": "Verifizierung",
+    "rollingUpdate": "Rolling Update (Cluster)",
+    "rollingConfirmTitle": "Rolling Update starten?",
+    "rollingConfirmDesc": "Der Secondary-Node ({{secondary}}) wird zuerst aktualisiert, danach dieser Primary. Kein Ausfall für den Proxied-Traffic während der Secondary-Phase.",
+    "rollingRunning": "Rolling Update läuft…",
+    "rollingStepSecondary": "Secondary aktualisieren ({{fqdn}})",
+    "rollingStepWaiting": "Warte auf Neustart des Secondary",
+    "rollingStepPrimary": "Primary aktualisieren (dieser Node)"
   },
   "wg": {
     "title": "WireGuard",
@@ -936,6 +1076,52 @@
       "failed": "Import fehlgeschlagen"
     }
   },
+  "dhcp": {
+    "title": "DHCP (Kea)",
+    "intro": "DHCPv4-Server: globale Optionen, pro-Subnet-Pools und statische Reservierungen.",
+    "csvHint": "Komma-getrennt.",
+    "saved": "Gespeichert",
+    "saveFailed": "Speichern fehlgeschlagen",
+    "deleted": "Gelöscht",
+    "deleteFailed": "Löschen fehlgeschlagen",
+    "reservations": "Reservierungen",
+    "haWarnTitle": "Nur auf EINER Node aktivieren",
+    "haWarnDesc": "Zwei DHCP-Server im selben LAN führen zu Adresskonflikten. Diese Einstellung ist node-lokal — aktiviere DHCP nur auf einer Cluster-Node.",
+    "tabs": {
+      "settings": "Einstellungen",
+      "subnets": "Subnets"
+    },
+    "settings": {
+      "enabled": "DHCP auf dieser Node aktiv",
+      "defaultLease": "Standard-Lease-Zeit (Sekunden)",
+      "maxLease": "Max-Lease-Zeit (Sekunden)",
+      "domainName": "Domain-Name",
+      "dnsServers": "DNS-Server (global)"
+    },
+    "subnet": {
+      "name": "Name",
+      "interface": "Interface",
+      "cidr": "Subnetz (CIDR)",
+      "pool": "Pool",
+      "poolStart": "Pool-Start",
+      "poolEnd": "Pool-Ende",
+      "gateway": "Gateway",
+      "dnsServers": "DNS-Server",
+      "active": "Aktiv",
+      "add": "Subnet hinzufügen",
+      "edit": "Subnet bearbeiten",
+      "deleteConfirm": "Subnet \"{{name}}\" wirklich löschen?"
+    },
+    "reservation": {
+      "name": "Name",
+      "mac": "MAC-Adresse",
+      "ip": "IP-Adresse",
+      "hostname": "Hostname",
+      "add": "Reservierung hinzufügen",
+      "edit": "Reservierung bearbeiten",
+      "deleteConfirm": "Reservierung wirklich löschen?"
+    }
+  },
   "ntp": {
     "title": "Zeitserver (Chrony)",
     "intro": "Chrony als Time-Sync-Daemon (NTP). Quellen oben, Listen-/Serve-Konfig im Settings-Tab. Wenn 'serve_clients' aktiv und LAN-IPs gebound sind, wird die Box selbst zum NTP-Server für das LAN.",
@@ -1094,7 +1280,16 @@
       "flushCacheFailed": "Cache-Flush fehlgeschlagen",
       "upstreamForwardsInvalid": "Jeder Forwarder muss eine gültige IP sein (z.B. 1.1.1.1 oder 9.9.9.9)",
       "accessACLInvalid": "Jeder Eintrag muss eine gültige IP oder CIDR sein (z.B. 10.0.0.0/8)",
-      "cacheTTLError": "Cache-Max-TTL muss ≥ Cache-Min-TTL sein"
+      "cacheTTLError": "Cache-Max-TTL muss ≥ Cache-Min-TTL sein",
+      "cacheSection": "Cache",
+      "prefetch": "Häufige Records vorausladen",
+      "prefetchExtra": "Häufig abgefragte Records werden vor Ablauf der TTL neu aufgelöst — reduziert Latenz für bekannte Namen.",
+      "serveExpired": "Abgelaufene Records ausliefern",
+      "serveExpiredExtra": "Stale Cache-Einträge zurückgeben wenn Upstream-Resolver nicht erreichbar ist. Reduziert SERVFAIL bei Ausfällen.",
+      "msgCacheSizeMB": "Message-Cache (MB)",
+      "msgCacheSizeMBExtra": "RAM für DNS-Antwort-Cache (msg-cache-size). Standard 64 MB.",
+      "rrsetCacheSizeMB": "RRset-Cache (MB)",
+      "rrsetCacheSizeMBExtra": "RAM für Resource-Record-Cache (rrset-cache-size). Sollte ~2x Message-Cache sein. Standard 128 MB."
     }
   },
   "fwd": {
@@ -1148,11 +1343,34 @@
       "dstdom_regex": "dstdom_regex — Domain-Regex",
       "srcdom_regex": "srcdom_regex — Quell-Domain-Regex",
       "browser": "browser — User-Agent-Regex"
+    },
+    "settings": {
+      "title": "Proxy-Einstellungen",
+      "listenAddresses": "Listen-Adressen",
+      "listenAddressesExtra": "Komma-getrennte IPs auf denen Squid lauscht (z.B. 10.0.5.1, 10.0.20.1). Leer = alle Interfaces.",
+      "listenPort": "Port",
+      "listenPortExtra": "Standard: 3128.",
+      "saveFailed": "Einstellungen konnten nicht gespeichert werden.",
+      "cacheSection": "Cache",
+      "cacheMemMB": "RAM-Cache (MB)",
+      "cacheMemMBExtra": "RAM den Squid für Caching nutzt (cache_mem). Standard 64 MB.",
+      "cacheDirMB": "Disk-Cache (MB)",
+      "cacheDirMBExtra": "Speicherplatz für den UFS-Cache. Standard 100 MB.",
+      "maxObjSizeMB": "Max. Objektgröße (MB)",
+      "maxObjSizeMBExtra": "Größtes Objekt das Squid cached. Größere Objekte werden direkt durchgeleitet. Standard 4 MB.",
+      "timeoutSection": "Timeouts",
+      "connectTimeout": "Verbindungs-Timeout (s)",
+      "connectTimeoutExtra": "Sekunden, die Squid beim Verbindungsaufbau zum Upstream wartet.",
+      "readTimeout": "Lese-Timeout (s)",
+      "readTimeoutExtra": "Sekunden zwischen aufeinanderfolgenden Lesevorgängen vom Upstream.",
+      "requestTimeout": "Anfrage-Timeout (s)",
+      "requestTimeoutExtra": "Maximale Zeit für einen vollständigen Request/Response-Zyklus."
     }
   },
   "common": {
     "yes": "Ja",
     "no": "Nein",
+    "or": "oder",
     "save": "Speichern",
     "cancel": "Abbrechen",
     "loading": "Lädt …",
@@ -1173,6 +1391,8 @@
     "retry": "Erneut versuchen",
     "close": "Schließen",
     "refresh": "Aktualisieren",
+    "back": "Zurück",
+    "next": "Weiter",
     "up": "UP",
     "down": "DOWN",
     "relTime": {
@@ -1510,7 +1730,24 @@
     "errorEmailTaken": "Diese E-Mail-Adresse wird bereits verwendet.",
     "cannotDeleteSelf": "Das eigene Konto kann nicht gelöscht werden.",
     "you": "Ich",
-    "never": "Nie"
+    "never": "Nie",
+    "totp": {
+      "on": "2FA",
+      "off": "–",
+      "setup": "2FA einrichten",
+      "manage": "2FA verwalten",
+      "disable": "2FA deaktivieren",
+      "disableFor": "2FA für {{email}} deaktivieren",
+      "enabled": "2FA wurde aktiviert",
+      "disabled": "2FA wurde deaktiviert",
+      "setupTitle": "Zwei-Faktor-Authentifizierung einrichten",
+      "manageTitle": "Zwei-Faktor-Authentifizierung",
+      "scanHint": "Scanne den QR-Code mit Google Authenticator, Authy oder einer kompatiblen App.",
+      "enterCode": "Gib den 6-stelligen Code aus deiner Authenticator-App ein:",
+      "confirm": "Bestätigen & aktivieren",
+      "alreadyEnabled": "2FA ist für diesen Account aktiv.",
+      "disableHint": "Klicke auf 'Deaktivieren' um 2FA für diesen Account zu entfernen."
+    }
   },
   "audit": {
     "title": "Audit-Log",
@@ -1540,5 +1777,158 @@
       "next": "Weiter",
       "showing": "Zeile {{from}}–{{to}}"
     }
+  },
+  "cs": {
+    "title": "CrowdSec IDS",
+    "intro": "Kollaborative Intrusion-Detection: Log-basierte Erkennung + Community-Blocklisten via nftables-Bouncer.",
+    "notInstalled": "CrowdSec ist nicht installiert. Bitte das Paket crowdsec + crowdsec-firewall-bouncer-nftables installieren.",
+    "status": {
+      "agent": "Agent",
+      "bouncer": "Bouncer",
+      "decisions": "Aktive Sperren",
+      "alerts": "Alarme",
+      "running": "Aktiv",
+      "stopped": "Gestoppt",
+      "notInstalled": "Nicht installiert"
+    },
+    "tabs": {
+      "decisions": "Entscheidungen",
+      "alerts": "Alarme",
+      "bouncers": "Bouncers",
+      "machines": "Maschinen",
+      "collections": "Collections"
+    },
+    "decision": {
+      "ip": "IP-Adresse",
+      "reason": "Grund",
+      "origin": "Herkunft",
+      "duration": "Dauer",
+      "country": "Land",
+      "as": "AS-Name",
+      "type": "Typ",
+      "unban": "Entsperren",
+      "banModal": "Manuell sperren",
+      "banBtn": "IP sperren",
+      "confirmUnban": "IP {{ip}} wirklich entsperren?",
+      "addSuccess": "IP {{ip}} wurde gesperrt.",
+      "deleteSuccess": "Sperre aufgehoben."
+    },
+    "alert": {
+      "id": "ID",
+      "scenario": "Szenario",
+      "events": "Events",
+      "sourceIP": "Quell-IP",
+      "country": "Land",
+      "start": "Beginn",
+      "stop": "Ende",
+      "delete": "Verwerfen",
+      "confirmDelete": "Alarm #{{id}} wirklich verwerfen?"
+    },
+    "bouncer": {
+      "name": "Name",
+      "ip": "IP",
+      "validKey": "Key gültig",
+      "version": "Version",
+      "lastPull": "Letzter Pull",
+      "type": "Typ",
+      "delete": "Entfernen",
+      "confirmDelete": "Bouncer {{name}} wirklich entfernen?"
+    },
+    "machine": {
+      "id": "Machine-ID",
+      "created": "Angelegt",
+      "lastPush": "Letzter Push",
+      "validated": "Validiert",
+      "version": "Version",
+      "delete": "Entfernen",
+      "confirmDelete": "Maschine {{id}} wirklich entfernen?"
+    },
+    "collection": {
+      "name": "Collection",
+      "status": "Status",
+      "version": "Version",
+      "author": "Author",
+      "install": "Installieren",
+      "remove": "Entfernen",
+      "enabled": "Installiert",
+      "disabled": "Nicht installiert",
+      "confirmRemove": "Collection {{name}} wirklich entfernen?"
+    }
+  },
+  "waf": {
+    "title": "Web Application Firewall",
+    "intro": "Domänen-spezifische HTTP-Request-Inspektion via Coraza/OWASP CRS. Standard: für alle Domains deaktiviert.",
+    "configure": "Konfigurieren",
+    "toggleFailed": "WAF-Status konnte nicht geändert werden.",
+    "defaultOffHint": "WAF ist standardmäßig für alle Domains deaktiviert. Unten pro Domain aktivieren und konfigurieren.",
+    "col": {
+      "domain": "Domain",
+      "status": "WAF",
+      "mode": "Modus",
+      "paranoia": "Paranoia"
+    },
+    "stat": {
+      "protected": "Geschützt",
+      "blocking": "Blocking",
+      "detection": "Nur Erkennung"
+    },
+    "mode": {
+      "detection": "Erkennung",
+      "blocking": "Blocking"
+    },
+    "pl": {
+      "1": "Basis (empfohlen)",
+      "2": "Standard",
+      "3": "Erweitert",
+      "4": "Maximum (kann Traffic brechen)"
+    },
+    "config": {
+      "enabled": "Aktiviert",
+      "mode": "Modus",
+      "paranoia": "Paranoia-Level",
+      "exclusions": "Regel-Ausnahmen",
+      "exclusionsHint": "Kommagetrennte Regel-IDs die deaktiviert werden (z.B. 920350, 941130).",
+      "trustedProxies": "Vertrauenswürdige Proxys",
+      "trustedProxiesHint": "IPs/CIDRs die die WAF-Inspektion umgehen (z.B. interne Load Balancer).",
+      "customRules": "Eigene SecRules",
+      "customRulesHint": "Rohe SecRule-Direktiven die nach dem CRS eingefügt werden. Können CRS-Regeln überschreiben.",
+      "defaultHint": "Standard: Nur-Erkennung, Paranoia-Level 1. Erst auf Blocking wechseln, nachdem Alerts geprüft wurden.",
+      "saveFailed": "WAF-Konfiguration konnte nicht gespeichert werden.",
+      "noExclusions": "Noch keine Regelausnahmen.",
+      "noNote": "Keine Notiz",
+      "exclusionsAddHint": "Ausnahmen über den Alarme-Tab hinzufügen — \"Als Ausnahme\" auf einem Alarm klicken."
+    },
+    "tabs": {
+      "domains": "Domains",
+      "alerts": "Alarme"
+    },
+    "alerts": {
+      "total": "Einträge",
+      "empty": "Noch keine WAF-Alarme. Regelübereinstimmungen erscheinen hier.",
+      "purge30d": "> 30 Tage löschen",
+      "purgeConfirm": "Alle Alarme älter als 30 Tage löschen?",
+      "purged": "Alarme gelöscht.",
+      "blocked": "Geblockt",
+      "detected": "Erkannt",
+      "col": {
+        "time": "Zeit",
+        "action": "Aktion",
+        "hostname": "Domain",
+        "clientIp": "Client-IP",
+        "method": "Methode",
+        "uri": "URI",
+        "ruleId": "Regel-ID",
+        "severity": "Schwere",
+        "msg": "Meldung"
+      },
+      "addException": "Als Ausnahme",
+      "exceptionAdded": "Regel als Ausnahme für diese Domain hinzugefügt.",
+      "exceptionFailed": "Ausnahme konnte nicht gespeichert werden.",
+      "noDomain": "Domain nicht gefunden — Ausnahme manuell konfigurieren.",
+      "exceptionModalTitle": "Ausnahme für Regel {{rule}} hinzufügen",
+      "exceptionModalHint": "Optional: Begründung warum diese Regel ein False Positive für diese Domain ist.",
+      "exceptionNotePlaceholder": "z.B. Unsere API verwendet nicht-standardisierte Header die diese Regel auslösen.",
+      "alreadyExcluded": "Bereits Ausnahme"
+    }
   }
-}
+}

management-ui/src/i18n/locales/en/common.json

@@ -15,6 +15,7 @@
     "wireguard": "WireGuard",
     "forwardProxy": "Forward proxy",
     "dns": "DNS",
+    "dhcp": "DHCP",
     "ntp": "Time (NTP)",
     "firewall": "Firewall",
     "firewallLive": "Firewall log",
@@ -27,13 +28,15 @@
     "alerts": "Alerts",
     "license": "License",
     "settings": "Settings",
+    "crowdsec": "CrowdSec IDS",
     "section": {
       "overview": "Overview",
       "routing": "Routing",
       "network": "Network",
       "security": "Security",
       "system": "System"
-    }
+    },
+    "waf": "WAF"
   },
   "fw": {
     "title": "Firewall",
@@ -112,7 +115,7 @@
     "rule": {
       "name": "Name",
       "priority": "Priority",
-      "enabled": "Enabled",
+      "enabled": "Active",
       "log": "Log",
       "action": "Action",
       "src": "Source",
@@ -152,7 +155,9 @@
       "emptyTitle": "No custom firewall rules yet.",
       "emptyDesc": "The system rules above keep SSH (rate-limited), HTTPS :443 and the mgmt UI :3443 open (anti-lockout). Add custom rules for app-specific inbound ports or cross-zone forwards.",
       "logEnabled": "Logging active — matched packets are written to the firewall log",
-      "ruleDisabled": "Rule disabled"
+      "ruleDisabled": "Rule disabled",
+      "unnamed": "(unnamed)",
+      "zeroHitHint": "No hits since last restart — possibly unused or shadowed rule"
     },
     "kpi": {
       "policyRules": "Policy Rules",
@@ -171,7 +176,10 @@
       "allActions": "All actions",
       "allZones": "All zones",
       "noResults": "No rules match the filter",
-      "noResultsHint": "Clear the filter to see all rules."
+      "noResultsHint": "Clear the filter to see all rules.",
+      "groupView": "Group by zone",
+      "flatView": "Flat list",
+      "rules": "rules"
     },
     "nat": {
       "name": "Name",
@@ -281,7 +289,30 @@
     "loggedInAs": "Signed in as",
     "forgotPassword": "Forgot your password?",
     "viewerBadge": "Read-only",
-    "viewerHint": "Your account has viewer role — all changes are blocked. Contact an admin to change your role."
+    "viewerHint": "Your account has viewer role — all changes are blocked. Contact an admin to change your role.",
+    "sso": {
+      "login": "Sign in with SSO",
+      "err": {
+        "no_account": "No EdgeGuard account for this email. Please contact an administrator.",
+        "disabled": "This account is disabled.",
+        "unverified": "The email address is not verified at the identity provider.",
+        "state": "Security check failed (state). Please try again.",
+        "nonce": "Security check failed (nonce). Please try again.",
+        "token": "Could not verify the token from the identity provider.",
+        "exchange": "Code exchange with the identity provider failed.",
+        "expired": "The sign-in session expired. Please try again.",
+        "denied": "Sign-in at the identity provider was cancelled.",
+        "subject_mismatch": "The identity does not match the linked account.",
+        "config": "SSO is not configured correctly.",
+        "server": "Internal error during SSO sign-in.",
+        "generic": "SSO sign-in failed."
+      }
+    },
+    "totp": {
+      "prompt": "Enter the 6-digit code from your authenticator app.",
+      "verify": "Verify code",
+      "invalidCode": "Invalid code"
+    }
   },
   "reset": {
     "title": "Reset admin password",
@@ -392,6 +423,17 @@
       "backends": "Backends",
       "attached": "{{count}}/{{total}} domains have a primary backend"
     },
+    "vipCard": {
+      "title": "VIP / VRRP",
+      "noVips": "No VIPs configured",
+      "keepalivedInactive": "keepalived not running",
+      "state": {
+        "MASTER": "MASTER",
+        "BACKUP": "BACKUP",
+        "FAULT": "FAULT",
+        "UNKNOWN": "Unknown"
+      }
+    },
     "systemCard": {
       "title": "System",
       "version": "Version",
@@ -399,9 +441,16 @@
       "ifaces": "Interfaces",
       "wg": "WireGuard"
     },
+    "networkServicesCard": {
+      "title": "Network services",
+      "configure": "Configure"
+    },
     "alertsCard": {
-      "title": "Recent alerts",
-      "viewAll": "View all"
+      "title": "Active alerts",
+      "viewAll": "View all",
+      "summary": "{{critical}} critical · {{warning}} warning",
+      "summaryWarning": "{{warning}} warning",
+      "summaryCritical": "{{critical}} critical"
     },
     "downBackendsAlert": "{{count}} backend(s) completely down — no server UP",
     "maintenanceAlert": "{{count}} domain(s) in maintenance mode",
@@ -624,11 +673,22 @@
     "tokenLabel": "Token",
     "caFingerprintLabel": "CA fingerprint",
     "driftBanner": "Config drift detected",
-    "driftBannerDesc": "One or more peers have a different config hash than this node. Either changes are still in the outbox or a peer was edited directly in the DB. Wait for the outbox to drain or run diagnostics.",
+    "driftBannerDesc": "One or more peers have a different config hash than this node. Right after a change this is normal (replication is catching up) and clears on its own. If the drift persists, replication is broken or a peer's DB was edited directly.",
+    "repair": {
+      "button": "Force resync",
+      "noStandbyHint": "No standby node found to delegate the resync to.",
+      "confirmTitle": "Repair replication?",
+      "confirmDesc": "Rebuilds the replication subscription on the standby node and re-copies all shared config tables from the primary. When clicked on the primary, the resync is delegated to the standby via mTLS. Local direct edits on the standby will be overwritten (primary = source of truth).",
+      "confirmOk": "Start resync",
+      "started": "Resync dispatched — running in the background on the standby.",
+      "ok": "Replication repaired — config in sync again.",
+      "failed": "Resync failed"
+    },
     "col": {
       "node": "Node",
       "status": "Status",
       "role": "Role",
+      "pgRole": "PG role",
       "apiUrl": "API URL",
       "configHash": "Config hash",
       "version": "Version",
@@ -641,6 +701,41 @@
       "uptime": "Uptime",
       "fetchMs": "Fetch"
     },
+    "pgRole": {
+      "standalone": "standalone",
+      "primary": "primary",
+      "standby": "standby"
+    },
+    "vipCard": {
+      "title": "High Availability (VIP / Keepalived)",
+      "vipAddress": "VIP address",
+      "vipAddressHelp": "Virtual IP address that moves between nodes (e.g. 89.163.205.10)",
+      "vipInterface": "Network interface",
+      "vipInterfaceHelp": "Interface to bind the VIP on (e.g. eth0)",
+      "vipAuthPass": "VRRP auth password",
+      "vipAuthPassHelp": "Max. 8 characters — Keepalived limit. Same on all nodes.",
+      "vrrpRouterId": "VRRP router ID",
+      "vrrpRouterIdHelp": "Must be unique in the subnet (1–255). Default: 51.",
+      "saveBtn": "Save & reconfigure Keepalived",
+      "saved": "VIP settings saved",
+      "saveFailed": "Failed to save",
+      "hintTitle": "Next steps after saving",
+      "hintPrimary": "On primary: edgeguard-ctl cluster-init-replication",
+      "hintStandby": "On secondary: edgeguard-ctl cluster-setup-standby <primary-ip>",
+      "hintKeepalived": "Keepalived on both nodes: sudo systemctl enable --now keepalived",
+      "hintFailover": "On failover: edgeguard-ctl promote (on the secondary node)",
+      "splitBrainSection": "Split-brain protection (dual-path VRRP + gateway tracking)",
+      "hbInterface": "Heartbeat interface",
+      "hbInterfaceHelp": "Second interface for VI_HB instance — VRRP advertisements run here independently of VI_1. Leave empty to disable.",
+      "hbSrcIp": "Heartbeat source IP",
+      "hbSrcIpHelp": "Own IP on the heartbeat interface (unicast_src_ip for VI_HB).",
+      "hbPeerIp": "Heartbeat peer IP",
+      "hbPeerIpHelp": "Peer IP on the heartbeat interface (unicast_peer for VI_HB).",
+      "hbRouterId": "Heartbeat router ID",
+      "hbRouterIdHelp": "VRRP virtual_router_id for VI_HB — must differ from main Router ID. Default: 52.",
+      "gwCheckIp": "Gateway check IP",
+      "gwCheckIpHelp": "Upstream gateway IP to ping every 5 s. If unreachable: priority drops by 110 → failover triggers. Leave empty to disable."
+    },
     "loadTitle": "Per-node resources (mTLS aggregator)",
     "loadEmpty": "No node resources available — agent listener unreachable?",
     "certCardTitle": "Cluster TLS certificates",
@@ -674,7 +769,27 @@
     "step3SetupDesc": "Open the setup wizard on the new node (https://<node-fqdn>:3443/setup), choose \"Join existing cluster\", enter the primary FQDN ({{primaryFqdn}}) and paste the token above.",
     "generateNewToken": "Generate new token",
     "setupWizardHint": "Open the setup wizard on the new node",
-    "newNodeFqdnLabel": "New node FQDN"
+    "newNodeFqdnLabel": "New node FQDN",
+    "vipTest": {
+      "cardTitle": "VIP failover test",
+      "cardDesc": "Temporarily move a VIP to the secondary to test that services respond correctly. Keepalived is not involved — this is a raw ip addr add/del test.",
+      "colAddress": "VIP address",
+      "colInterface": "Interface",
+      "colActiveOn": "Active on",
+      "swingBtn": "→ Secondary",
+      "restoreBtn": "← Primary",
+      "swingOk": "VIP successfully moved to secondary",
+      "restoreOk": "VIP restored to primary",
+      "swingFailed": "VIP swing failed",
+      "restoreFailed": "VIP restore failed",
+      "noVips": "No VIPs configured (ip_addresses with is_vip=true)",
+      "steps": "Steps",
+      "stepOk": "OK",
+      "stepFail": "Failed",
+      "confirmSwing": "Move {{addr}} to secondary?",
+      "confirmRestore": "Restore {{addr}} to primary?",
+      "unknown": "unknown"
+    }
   },
   "ssl": {
     "title": "SSL certificates",
@@ -811,6 +926,24 @@
     "configPreviewBtn": "Load preview",
     "configPreviewHint": "Renders the selected service config from the current DB state. Read-only — nothing is written to disk or reloaded.",
     "configCopied": "Config copied to clipboard",
+    "oidc": {
+      "title": "Single Sign-On (OIDC)",
+      "intro": "SSO login via OpenID Connect (e.g. Keycloak), in addition to local login. Only existing users can sign in; the role is managed in EdgeGuard.",
+      "enabled": "SSO enabled",
+      "issuerUrl": "Issuer URL",
+      "issuerHint": "Realm base URL, e.g. https://keycloak.example.com/realms/edgeguard",
+      "clientId": "Client ID",
+      "clientSecret": "Client secret",
+      "secretSet": "Stored — leave empty to keep unchanged.",
+      "secretUnset": "No secret stored yet.",
+      "scopes": "Scopes",
+      "emailClaim": "Email claim",
+      "buttonLabel": "Button label",
+      "redirectUri": "Redirect URI",
+      "redirectHint": "Register this URL as a valid redirect URI in the Keycloak client (per cluster node its own FQDN).",
+      "saved": "OIDC settings saved",
+      "saveFailed": "Failed to save OIDC settings"
+    },
     "passwordCardTitle": "Change admin password",
     "currentPassword": "Current password",
     "newPassword": "New password",
@@ -841,7 +974,14 @@
     "stepDownload": "Download packages",
     "stepInstall": "Install",
     "stepRestart": "Service restart",
-    "stepVerify": "Verification"
+    "stepVerify": "Verification",
+    "rollingUpdate": "Rolling Update (Cluster)",
+    "rollingConfirmTitle": "Start Rolling Update?",
+    "rollingConfirmDesc": "The secondary node ({{secondary}}) is updated first, then this primary. No downtime for proxied traffic during the secondary phase.",
+    "rollingRunning": "Rolling update in progress…",
+    "rollingStepSecondary": "Updating secondary ({{fqdn}})",
+    "rollingStepWaiting": "Waiting for secondary restart",
+    "rollingStepPrimary": "Updating primary (this node)"
   },
   "wg": {
     "title": "WireGuard",
@@ -936,6 +1076,52 @@
       "failed": "Import failed"
     }
   },
+  "dhcp": {
+    "title": "DHCP (Kea)",
+    "intro": "DHCPv4 server: global options, per-subnet pools and static reservations.",
+    "csvHint": "Comma-separated.",
+    "saved": "Saved",
+    "saveFailed": "Save failed",
+    "deleted": "Deleted",
+    "deleteFailed": "Delete failed",
+    "reservations": "Reservations",
+    "haWarnTitle": "Enable on ONE node only",
+    "haWarnDesc": "Two DHCP servers on the same LAN cause address conflicts. This setting is node-local — enable DHCP on a single cluster node only.",
+    "tabs": {
+      "settings": "Settings",
+      "subnets": "Subnets"
+    },
+    "settings": {
+      "enabled": "DHCP active on this node",
+      "defaultLease": "Default lease time (seconds)",
+      "maxLease": "Max lease time (seconds)",
+      "domainName": "Domain name",
+      "dnsServers": "DNS servers (global)"
+    },
+    "subnet": {
+      "name": "Name",
+      "interface": "Interface",
+      "cidr": "Subnet (CIDR)",
+      "pool": "Pool",
+      "poolStart": "Pool start",
+      "poolEnd": "Pool end",
+      "gateway": "Gateway",
+      "dnsServers": "DNS servers",
+      "active": "Active",
+      "add": "Add subnet",
+      "edit": "Edit subnet",
+      "deleteConfirm": "Really delete subnet \"{{name}}\"?"
+    },
+    "reservation": {
+      "name": "Name",
+      "mac": "MAC address",
+      "ip": "IP address",
+      "hostname": "Hostname",
+      "add": "Add reservation",
+      "edit": "Edit reservation",
+      "deleteConfirm": "Really delete this reservation?"
+    }
+  },
   "ntp": {
     "title": "Time server (Chrony)",
     "intro": "Chrony as time-sync daemon (NTP). Sources on top, listen/serve config on the settings tab. With 'serve_clients' on and LAN-IPs bound, the box itself becomes an NTP server for the LAN.",
@@ -1094,7 +1280,16 @@
       "flushCacheFailed": "Flush failed",
       "upstreamForwardsInvalid": "Each forwarder must be a valid IP (e.g. 1.1.1.1 or 9.9.9.9)",
       "accessACLInvalid": "Each entry must be a valid IP or CIDR (e.g. 10.0.0.0/8 or 192.168.1.0/24)",
-      "cacheTTLError": "Cache max-TTL must be ≥ cache min-TTL"
+      "cacheTTLError": "Cache max-TTL must be ≥ cache min-TTL",
+      "cacheSection": "Cache",
+      "prefetch": "Prefetch popular records",
+      "prefetchExtra": "Re-fetch records before TTL expires if queried frequently — reduces latency for hot names.",
+      "serveExpired": "Serve expired records",
+      "serveExpiredExtra": "Return stale cache entries when upstream resolvers are unreachable. Reduces SERVFAIL during outages.",
+      "msgCacheSizeMB": "Message cache (MB)",
+      "msgCacheSizeMBExtra": "RAM for DNS response cache (msg-cache-size). Default 64 MB.",
+      "rrsetCacheSizeMB": "RRset cache (MB)",
+      "rrsetCacheSizeMBExtra": "RAM for resource-record cache (rrset-cache-size). Should be ~2x message cache. Default 128 MB."
     }
   },
   "fwd": {
@@ -1148,11 +1343,34 @@
       "dstdom_regex": "dstdom_regex — destination domain regex",
       "srcdom_regex": "srcdom_regex — source domain regex",
       "browser": "browser — User-Agent regex"
+    },
+    "settings": {
+      "title": "Proxy settings",
+      "listenAddresses": "Listen addresses",
+      "listenAddressesExtra": "Comma-separated IPs Squid listens on (e.g. 10.0.5.1, 10.0.20.1). Leave empty to listen on all interfaces.",
+      "listenPort": "Port",
+      "listenPortExtra": "Default: 3128.",
+      "saveFailed": "Settings could not be saved.",
+      "cacheSection": "Cache",
+      "cacheMemMB": "In-memory cache (MB)",
+      "cacheMemMBExtra": "RAM used by Squid for caching (cache_mem). Default 64 MB.",
+      "cacheDirMB": "Disk cache (MB)",
+      "cacheDirMBExtra": "Disk space for the UFS cache. Default 100 MB.",
+      "maxObjSizeMB": "Max. object size (MB)",
+      "maxObjSizeMBExtra": "Largest object Squid will cache. Objects above this are fetched fresh. Default 4 MB.",
+      "timeoutSection": "Timeouts",
+      "connectTimeout": "Connect timeout (s)",
+      "connectTimeoutExtra": "Seconds to wait when opening a connection to the upstream server.",
+      "readTimeout": "Read timeout (s)",
+      "readTimeoutExtra": "Seconds Squid waits between consecutive reads from the upstream.",
+      "requestTimeout": "Request timeout (s)",
+      "requestTimeoutExtra": "Maximum time for a complete request/response cycle."
     }
   },
   "common": {
     "yes": "Yes",
     "no": "No",
+    "or": "or",
     "save": "Save",
     "cancel": "Cancel",
     "loading": "Loading …",
@@ -1173,6 +1391,8 @@
     "retry": "Retry",
     "close": "Close",
     "refresh": "Refresh",
+    "back": "Back",
+    "next": "Next",
     "up": "UP",
     "down": "DOWN",
     "relTime": {
@@ -1510,7 +1730,24 @@
     "errorEmailTaken": "This email address is already in use.",
     "cannotDeleteSelf": "You cannot delete your own account.",
     "you": "You",
-    "never": "Never"
+    "never": "Never",
+    "totp": {
+      "on": "2FA",
+      "off": "–",
+      "setup": "Set up 2FA",
+      "manage": "Manage 2FA",
+      "disable": "Disable 2FA",
+      "disableFor": "Disable 2FA for {{email}}",
+      "enabled": "2FA has been enabled",
+      "disabled": "2FA has been disabled",
+      "setupTitle": "Set up two-factor authentication",
+      "manageTitle": "Two-factor authentication",
+      "scanHint": "Scan the QR code with Google Authenticator, Authy, or any compatible app.",
+      "enterCode": "Enter the 6-digit code from your authenticator app:",
+      "confirm": "Confirm & activate",
+      "alreadyEnabled": "2FA is active for this account.",
+      "disableHint": "Click 'Disable 2FA' to remove two-factor authentication from this account."
+    }
   },
   "audit": {
     "title": "Audit log",
@@ -1540,5 +1777,158 @@
       "next": "Next",
       "showing": "Row {{from}}–{{to}}"
     }
+  },
+  "cs": {
+    "title": "CrowdSec IDS",
+    "intro": "Collaborative intrusion detection: log-based detection + community blocklists via nftables bouncer.",
+    "notInstalled": "CrowdSec is not installed. Please install the crowdsec + crowdsec-firewall-bouncer-nftables packages.",
+    "status": {
+      "agent": "Agent",
+      "bouncer": "Bouncer",
+      "decisions": "Active bans",
+      "alerts": "Alerts",
+      "running": "Active",
+      "stopped": "Stopped",
+      "notInstalled": "Not installed"
+    },
+    "tabs": {
+      "decisions": "Decisions",
+      "alerts": "Alerts",
+      "bouncers": "Bouncers",
+      "machines": "Machines",
+      "collections": "Collections"
+    },
+    "decision": {
+      "ip": "IP address",
+      "reason": "Reason",
+      "origin": "Origin",
+      "duration": "Duration",
+      "country": "Country",
+      "as": "AS name",
+      "type": "Type",
+      "unban": "Unban",
+      "banModal": "Manual ban",
+      "banBtn": "Ban IP",
+      "confirmUnban": "Really unban IP {{ip}}?",
+      "addSuccess": "IP {{ip}} has been banned.",
+      "deleteSuccess": "Ban removed."
+    },
+    "alert": {
+      "id": "ID",
+      "scenario": "Scenario",
+      "events": "Events",
+      "sourceIP": "Source IP",
+      "country": "Country",
+      "start": "Start",
+      "stop": "End",
+      "delete": "Dismiss",
+      "confirmDelete": "Really dismiss alert #{{id}}?"
+    },
+    "bouncer": {
+      "name": "Name",
+      "ip": "IP",
+      "validKey": "Key valid",
+      "version": "Version",
+      "lastPull": "Last pull",
+      "type": "Type",
+      "delete": "Remove",
+      "confirmDelete": "Really remove bouncer {{name}}?"
+    },
+    "machine": {
+      "id": "Machine ID",
+      "created": "Created",
+      "lastPush": "Last push",
+      "validated": "Validated",
+      "version": "Version",
+      "delete": "Remove",
+      "confirmDelete": "Really remove machine {{id}}?"
+    },
+    "collection": {
+      "name": "Collection",
+      "status": "Status",
+      "version": "Version",
+      "author": "Author",
+      "install": "Install",
+      "remove": "Remove",
+      "enabled": "Installed",
+      "disabled": "Not installed",
+      "confirmRemove": "Really remove collection {{name}}?"
+    }
+  },
+  "waf": {
+    "title": "Web Application Firewall",
+    "intro": "Per-domain HTTP request inspection via Coraza/OWASP CRS. Default: off for all domains.",
+    "configure": "Configure",
+    "toggleFailed": "Could not change WAF state.",
+    "defaultOffHint": "WAF is disabled by default for all domains. Enable and configure per domain below.",
+    "col": {
+      "domain": "Domain",
+      "status": "WAF",
+      "mode": "Mode",
+      "paranoia": "Paranoia"
+    },
+    "stat": {
+      "protected": "Protected",
+      "blocking": "Blocking",
+      "detection": "Detection only"
+    },
+    "mode": {
+      "detection": "Detection",
+      "blocking": "Blocking"
+    },
+    "pl": {
+      "1": "Basic (recommended)",
+      "2": "Standard",
+      "3": "Advanced",
+      "4": "Maximum (may break traffic)"
+    },
+    "config": {
+      "enabled": "Enabled",
+      "mode": "Mode",
+      "paranoia": "Paranoia Level",
+      "exclusions": "Rule Exclusions",
+      "exclusionsHint": "Comma-separated rule IDs to disable (e.g. 920350, 941130).",
+      "trustedProxies": "Trusted Proxies",
+      "trustedProxiesHint": "IPs/CIDRs that bypass WAF inspection (e.g. internal load balancers).",
+      "customRules": "Custom SecRules",
+      "customRulesHint": "Raw SecRule directives appended after the CRS. Applied last, can override CRS rules.",
+      "defaultHint": "Default: Detection-Only, Paranoia Level 1. Switch to Blocking only after reviewing alerts.",
+      "saveFailed": "Failed to save WAF configuration.",
+      "noExclusions": "No rule exclusions yet.",
+      "noNote": "No note",
+      "exclusionsAddHint": "Add exceptions via the Alerts tab — click \"Add exception\" on an alert."
+    },
+    "tabs": {
+      "domains": "Domains",
+      "alerts": "Alerts"
+    },
+    "alerts": {
+      "total": "entries",
+      "empty": "No WAF alerts yet. Rules matched will appear here.",
+      "purge30d": "Purge > 30 days",
+      "purgeConfirm": "Delete all alerts older than 30 days?",
+      "purged": "Alerts purged.",
+      "blocked": "Blocked",
+      "detected": "Detected",
+      "col": {
+        "time": "Time",
+        "action": "Action",
+        "hostname": "Domain",
+        "clientIp": "Client IP",
+        "method": "Method",
+        "uri": "URI",
+        "ruleId": "Rule ID",
+        "severity": "Severity",
+        "msg": "Message"
+      },
+      "addException": "Add exception",
+      "exceptionAdded": "Rule added as exception for this domain.",
+      "exceptionFailed": "Failed to add exception.",
+      "noDomain": "Domain not found — configure exception manually.",
+      "exceptionModalTitle": "Add exception for rule {{rule}}",
+      "exceptionModalHint": "Optional: describe why this rule is a false positive for this domain.",
+      "exceptionNotePlaceholder": "e.g. Our custom API uses non-standard headers that trigger this rule.",
+      "alreadyExcluded": "Already excluded"
+    }
   }
-}
+}

management-ui/src/lib/staleChunkReload.ts

@@ -0,0 +1,44 @@
+// Behandelt "stale chunk"-Fehler: Ein Tab, der noch den Build von gestern
+// fährt, referenziert gehashte Chunk-Dateien (z.B. Cluster-BOSNsJEn.js).
+// Nach einem Deploy existieren diese Hashes nicht mehr → der Lazy-Import
+// läuft auf 404 ("Failed to fetch dynamically imported module"). Ein
+// voller Reload holt frisches index.html mit den neuen Hashes und behebt
+// das. Wir machen diesen Reload automatisch — aber nur einmal pro
+// Cooldown-Fenster, damit es keine Endlosschleife gibt wenn der Server
+// wirklich nicht erreichbar ist.
+
+const RELOAD_FLAG = 'eg:stale-chunk-reload-at'
+const COOLDOWN_MS = 15_000
+
+// isStaleChunkError erkennt die Lazy-Import-/Preload-Fehler quer über
+// Browser (Chrome/Safari/Firefox formulieren sie unterschiedlich).
+export function isStaleChunkError(err: unknown): boolean {
+  const msg = err instanceof Error ? err.message : String(err ?? '')
+  return /Loading chunk|Failed to fetch dynamically imported module|Importing a module script failed|error loading dynamically imported module|'text\/html' is not a valid JavaScript MIME type/i.test(msg)
+}
+
+// reloadForStaleChunkOnce lädt die Seite genau einmal neu. Gibt false
+// zurück, wenn innerhalb des Cooldowns bereits neu geladen wurde — dann
+// soll der Aufrufer auf eine manuelle Fehler-UI zurückfallen (der Reload
+// hat das Problem offensichtlich nicht gelöst, z.B. Server down).
+export function reloadForStaleChunkOnce(): boolean {
+  let last = 0
+  try { last = Number(sessionStorage.getItem(RELOAD_FLAG) || 0) } catch { /* private mode */ }
+  const now = Date.now()
+  if (last && now - last < COOLDOWN_MS) return false
+  try { sessionStorage.setItem(RELOAD_FLAG, String(now)) } catch { /* ignore */ }
+  window.location.reload()
+  return true
+}
+
+// installStaleChunkReload registriert einen globalen Listener für Vites
+// preloadError-Event (gefeuert wenn ein dynamisch importiertes Modul
+// nicht geladen werden kann). preventDefault verhindert das erneute
+// Werfen durch Vite; danach laden wir einmalig neu. Fängt Fälle ab, die
+// nicht im React-Render-Pfad landen (z.B. Modul-Preload).
+export function installStaleChunkReload(): void {
+  window.addEventListener('vite:preloadError', (e) => {
+    e.preventDefault()
+    reloadForStaleChunkOnce()
+  })
+}