update tests

chore: remove easypanel screenshot

.github/CODEOWNERS

@@ -1 +1 @@
-*     @ajhollid @mohicody @Br0wnHammer @Owaiseimdad @karenvicent @shanikauwu1
+

README.md

@@ -36,8 +36,7 @@
 
 [![Run on PikaPods](https://www.pikapods.com/static/run-button.svg)](https://www.pikapods.com/pods?run=checkmate)
 
-
-<img width="1703" height="1041" alt="image" src="https://github.com/user-attachments/assets/0f4dcf38-9b42-4b84-8633-ff34778df1a8" />
+<img width="1461" height="853" alt="image" src="https://github.com/user-attachments/assets/d5ee1a4e-9db9-47cc-ad47-e1ba88a9d796" />
 </p>
 <br>
 
@@ -93,7 +92,7 @@ JWT_SECRET="$(openssl rand -hex 32)" docker compose up -d
 Then open http://localhost:52345. If the app is reached at another origin (domain or LAN IP), set `CLIENT_HOST` accordingly. To build the image yourself, run `docker build -f docker/Dockerfile -t checkmate .` from a checkout. For TLS, put any reverse proxy (Caddy, Traefik, nginx) in front of port 52345.
 
 There are also 1-click installation options like [Repocloud](https://repocloud.io/details/Checkmate),
-[Pikapods](https://www.pikapods.com/), [Coolify](https://coolify.io/), [Elestio](https://elest.io/open-source/checkmate), [K8s](../../charts/helm/checkmate/INSTALLATION.md), [Sive Host](https://sive.host) or [Cloudzy](https://cloudzy.com/marketplace/checkmate).
+[Pikapods](https://www.pikapods.com/), [Coolify](https://coolify.io/), [Elestio](https://elest.io/open-source/checkmate), [Easypanel](https://easypanel.io/templates/checkmate), [K8s](./charts/helm/checkmate/INSTALLATION.md), [Sive Host](https://sive.host) or [Cloudzy](https://cloudzy.com/marketplace/checkmate). Note that the Helm chart has not yet been migrated to the all-in-one image: it still deploys the legacy `checkmate-client`, `checkmate-backend` and `checkmate-mongo` images, pinned at v3.8.1.
 
 
 ### Configuration
@@ -105,7 +104,15 @@ The image is configured entirely through environment variables on the server con
 | `DB_CONNECTION_STRING` | Yes | MongoDB connection string, e.g. `mongodb://mongodb:27017/uptime_db` |
 | `JWT_SECRET` | Yes | Secret used to sign auth tokens; generate one with `openssl rand -hex 32` |
 | `CLIENT_HOST` | Yes | The URL users reach the app at, e.g. `https://checkmate.example.com`; used for CORS and for links in notifications and emails |
+| `ENCRYPTION_KEY` | No | Encrypts stored Docker TLS client keys at rest; generate one with `openssl rand -base64 32`. Comma-separated list: the first key encrypts, every key decrypts. Must be identical on the API and every worker. To rotate without downtime, deploy `OLD_KEY,NEW_KEY` everywhere, then `NEW_KEY,OLD_KEY` everywhere, wait for the worker to re-encrypt every row, then drop `OLD_KEY`. |
+| `PORT` | No | Port the API and web client are served on (default `52345`) |
+| `HEALTH_PORT` | No | Port for the `/livez`, `/readyz` and `/metrics` endpoints, served by any process that runs the job worker (default `52346`) |
+| `NODE_ENV` | No | `development`, `production` or `test` (default `development`). `development` disables the general API rate limiter; set `production` on real deployments |
 | `LOG_LEVEL` | No | Server log level: `error`, `warn`, `info`, or `debug` (default `debug`) |
+| `TOKEN_TTL` | No | Lifetime of issued auth tokens, e.g. `12h` or `7d` (default `99d`) |
+| `QUEUE_MODE` | No | `primary` (default) runs the API, the web client and the job scheduler; `worker` runs a job-processing worker only, with no API |
+| `QUEUE_PRIMARY_PROCESSES` | No | `true` (default) or `false`. Whether a `primary` node also processes monitoring jobs itself; set `false` when dedicated `worker` nodes handle all checks. Ignored in `worker` mode |
+| `STATUS_PAGE_THEMES_ENABLED` | No | `true` (default) or `false`. When `false`, status pages ignore theme settings and always render the default theme |
 
 The web client needs no configuration by default: it calls the API on the same origin it was served from (`/api/v1`). For setups where the defaults don't apply — for example, the API is reached through a different origin than the page — the server renders overrides into the client at runtime via these optional variables:
 
@@ -119,12 +126,119 @@ The web client needs no configuration by default: it calls the API on the same o
 
 See full installation instructions in the [Checkmate documentation portal](https://checkmate.so/docs). 
 
-Alternatively, you can also use [Coolify](https://coolify.io/), [Elestio](https://elest.io/open-source/checkmate), [K8s](./charts/helm/checkmate/INSTALLATION.md), [Sive Host](https://sive.host) (South Africa), [Cloudzy](https://cloudzy.com/marketplace/checkmate) or [Pikapods](https://www.pikapods.com/) to quickly spin off a Checkmate instance. If you would like to monitor your server infrastructure, you'll need [Capture agent](https://github.com/bluewave-labs/capture). Capture repository also contains the installation instructions.
+Alternatively, you can also use [Coolify](https://coolify.io/), [Elestio](https://elest.io/open-source/checkmate), [K8s](./charts/helm/checkmate/INSTALLATION.md) (legacy images, pinned at v3.8.1), [Sive Host](https://sive.host) (South Africa), [Cloudzy](https://cloudzy.com/marketplace/checkmate) or [Pikapods](https://www.pikapods.com/) to quickly spin off a Checkmate instance. If you would like to monitor your server infrastructure, you'll need [Capture agent](https://github.com/bluewave-labs/capture). Capture repository also contains the installation instructions.
 
 ### Using a Custom CA
 
 If you need to monitor internal HTTPS endpoints with certificates from private Certificate Authorities (like Smallstep), see our [Custom CA Trust Guide](./docs/custom-ca-trust.md) for Docker configuration options.
 
+### Docker monitors
+
+A Docker monitor connects to a Docker daemon and reports on every container it runs. The daemon's ping response decides whether the monitor is up or down and its latency is the response time. Each check also records every container's state, health, CPU and memory usage, restart count, published ports and mounts. Enabling **Collect container logs** additionally stores the latest 200 log lines per container on every check; logs are kept for 7 days.
+
+The **Docker host** field accepts two forms:
+
+| Host | Example | Notes |
+|---|---|---|
+| Local socket | `unix:///var/run/docker.sock` | Also accepts a bare absolute path such as `/var/run/docker.sock`. Use this for the daemon on the same machine Checkmate runs on. |
+| Remote daemon | `tcp://docker.example.com:2376` | Always uses mutual TLS; the port defaults to `2376`. Unencrypted daemons on `2375` are not supported. |
+
+**Monitoring the local socket.** The reference Compose file does not mount the socket, so add it and grant the container the host's `docker` group. The image runs as an unprivileged user and cannot read the socket otherwise. Find the group id with `stat -c %g /var/run/docker.sock`, then:
+
+```yaml
+services:
+  checkmate:
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    group_add:
+      - "989"   # the gid printed by stat
+```
+
+**Monitoring a remote daemon.** Set the host to `tcp://host:port` and fill in the **TLS credentials** section of the monitor form with the same PEM files you would pass to `docker --tlsverify`:
+
+- **CA certificate**: the CA that signed the daemon's server certificate. Required unless **Ignore TLS/SSL errors** is on, which skips verifying the daemon's identity.
+- **Client certificate**: the certificate the daemon uses to authenticate Checkmate.
+- **Client key**: the matching private key, unencrypted (no passphrase). Checkmate checks that it matches the certificate, encrypts it with `ENCRYPTION_KEY`, and never shows it again. Leave the field blank when editing to keep the stored key.
+
+TLS Docker monitors require `ENCRYPTION_KEY` to be set on the server (see [Configuration](#configuration)). Saving one without it fails with an error telling you so. If the key is ever removed or rotated incorrectly, affected checks fail with a decryption error until it is restored.
+
+If the daemon's certificate is signed by a private CA that you also want the rest of Checkmate to trust, see the [Custom CA Trust Guide](./docs/custom-ca-trust.md); for Docker monitors alone, the **CA certificate** field is enough.
+
+### Securing the Docker daemon with TLS
+
+The Docker daemon does not enable TLS by default. Follow these steps on the Docker host to generate a CA, a server certificate, and a client certificate for Checkmate. This is the procedure from [Docker's own guide](https://docs.docker.com/engine/security/protect-access/), condensed. Replace `docker.example.com` and `203.0.113.10` with your daemon's DNS name and IP.
+
+**1. Create a CA.** The CA key gets a passphrase; keep it offline once the certificates are issued.
+
+```bash
+openssl genrsa -aes256 -out ca-key.pem 4096
+openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -subj "/CN=docker-ca" -out ca.pem
+```
+
+**2. Create the server certificate.** The subject alternative names must cover every name or address Checkmate will use to reach the daemon.
+
+```bash
+openssl genrsa -out server-key.pem 4096
+openssl req -subj "/CN=docker.example.com" -sha256 -new -key server-key.pem -out server.csr
+cat > server-ext.cnf <<EOF
+subjectAltName = DNS:docker.example.com,IP:203.0.113.10
+extendedKeyUsage = serverAuth
+EOF
+openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial \
+  -out server-cert.pem -extfile server-ext.cnf
+```
+
+**3. Create the client certificate for Checkmate.** Do not add a passphrase to this key; Checkmate cannot use encrypted private keys.
+
+```bash
+openssl genrsa -out key.pem 4096
+openssl req -subj "/CN=checkmate" -new -key key.pem -out client.csr
+echo "extendedKeyUsage = clientAuth" > client-ext.cnf
+openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial \
+  -out cert.pem -extfile client-ext.cnf
+rm client.csr server.csr server-ext.cnf client-ext.cnf
+chmod 0400 ca-key.pem key.pem server-key.pem
+chmod 0444 ca.pem server-cert.pem cert.pem
+```
+
+**4. Point the daemon at the certificates.** Move `ca.pem`, `server-cert.pem` and `server-key.pem` to `/etc/docker/certs/` and configure `/etc/docker/daemon.json`:
+
+```json
+{
+  "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2376"],
+  "tls": true,
+  "tlsverify": true,
+  "tlscacert": "/etc/docker/certs/ca.pem",
+  "tlscert": "/etc/docker/certs/server-cert.pem",
+  "tlskey": "/etc/docker/certs/server-key.pem"
+}
+```
+
+On distributions where the systemd unit already passes `-H fd://` (Debian, Ubuntu and derivatives), the daemon refuses to start with `hosts` set in both places. Remove the flag from the unit with an override, then restart:
+
+```bash
+sudo systemctl edit docker.service
+```
+
+```ini
+[Service]
+ExecStart=
+ExecStart=/usr/bin/dockerd
+```
+
+```bash
+sudo systemctl daemon-reload && sudo systemctl restart docker
+```
+
+Open port `2376` on the host firewall only to the machine running Checkmate.
+
+**5. Verify from the Checkmate host**, then paste `ca.pem`, `cert.pem` and `key.pem` into the monitor form:
+
+```bash
+docker --tlsverify --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem \
+  -H=docker.example.com:2376 version
+```
+
 For more documentation, see the [docs directory](./docs/).
 
 <a id="performance"></a>
@@ -134,7 +248,7 @@ Thanks to extensive optimizations, Checkmate operates with an exceptionally smal
 
 ![image](https://github.com/user-attachments/assets/37e04a75-d83a-488f-b25c-025511b492c9)
 
-You can see the memory footprint of MongoDB and Redis on the same server (398Mb and 15Mb) for the same amount of servers:
+You can see the memory footprint of MongoDB on the same server (398Mb) for the same amount of servers:
 
 ![image](https://github.com/user-attachments/assets/3b469e85-e675-4040-a162-3f24c1afc751)
 
@@ -152,16 +266,16 @@ Feel free to ask questions or share your ideas - we'd love to hear from you!
 ## Features
 
 - Completely open source, deployable on your servers or home devices (e.g Raspberry Pi 4 or 5)
-- Several monitoring options: Uptime, Docker, Ping, SSL, Port, Game server
+- Several monitoring options: HTTP (with SSL certificate expiry), Ping, Port, DNS, Docker, gRPC, WebSocket, Game server
 - Page speed monitoring
 - Infrastructure monitoring (memory, disk usage, CPU performance, network etc) - requires [Capture](https://github.com/bluewave-labs/capture) agent
   - Selective disk monitoring with mountpoint selection
 - Incidents at a glance
-- Status pages with 4 beautiful themes
-- E-mail, Webhooks, Discord, Slack, PagerDuty, Matrix, Rocket.Chat, Microsoft Teams, Telegram, Pushover, Twilio (SMS) notifications
+- Status pages with 5 beautiful themes
+- E-mail, Webhooks, Discord, Slack, PagerDuty, Matrix, Rocket.Chat, Microsoft Teams, Telegram, Pushover, ntfy, SignalGrid, Twilio (SMS) notifications
 - Scheduled maintenance
 - JSON query monitoring
-- Multi-language support for Arabic, Chinese (Simplified), Chinese (Traditional, Taiwan), Czech, English, Finnish, French, German, Japanese, Portuguese (Brazil), Russian, Spanish, Thai, Turkish, Ukrainian, and Vietnamese
+- Multi-language support for Arabic, Catalan, Chinese (Simplified), Chinese (Traditional, Taiwan), Czech, English, Finnish, French, German, Italian, Japanese, Polish, Portuguese (Brazil), Russian, Spanish, Thai, Turkish, Ukrainian, and Vietnamese
 
 
 ## Monitor Lifecycle
@@ -212,9 +326,9 @@ Feel free to ask questions or share your ideas - we'd love to hear from you!
 <a id="contributing"></a>
 ## Contributing
 
-We are [Alex](http://github.com/ajhollid) (team lead), [Gorkem](http://github.com/gorkem-bwl/), [Aryaman](https://github.com/Br0wnHammer) and [Mert](https://github.com/mertssmnoglu) helping individuals and businesses monitor their infra and servers.
+We are [Alex](http://github.com/ajhollid) (team lead), [Gorkem](http://github.com/gorkem-bwl/), [Aryaman](https://github.com/Br0wnHammer), [Malena](https://github.com/malenacaroline) and [Mert](https://github.com/mertssmnoglu) helping individuals and businesses monitor their infra and servers.
 
-We pride ourselves on building strong connections with contributors at every level. Despite being a young project, Checkmate has already earned almost 11K+ stars and attracted 150+ contributors from around the globe.
+We pride ourselves on building strong connections with contributors at every level. Despite being a young project, Checkmate has already earned almost 11K stars and attracted 150+ contributors from around the globe.
 
 Our repo is starred by employees from **Google, Microsoft, Intel, Cisco, Tencent, Electronic Arts, ByteDance, JP Morgan Chase, Deloitte, Accenture, Foxconn, Broadcom, China Telecom, Barclays, Capgemini, Wipro, Cloudflare, Dassault Systèmes and NEC**, so don’t hold back — jump in, contribute and learn with us!
 

client/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "client",
-	"version": "3.11.0",
+	"version": "3.12.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "client",
-			"version": "3.11.0",
+			"version": "3.12.0",
 			"dependencies": {
 				"@csstools/css-tokenizer": "^3.0.4",
 				"@emotion/react": "^11.13.3",
@@ -93,6 +93,7 @@
 			"resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
 			"integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@babel/code-frame": "^7.29.7",
 				"@babel/generator": "^7.29.7",
@@ -408,6 +409,7 @@
 		"node_modules/@emotion/react": {
 			"version": "11.14.0",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@babel/runtime": "^7.18.3",
 				"@emotion/babel-plugin": "^11.13.5",
@@ -445,6 +447,7 @@
 		"node_modules/@emotion/styled": {
 			"version": "11.14.1",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@babel/runtime": "^7.18.3",
 				"@emotion/babel-plugin": "^11.13.5",
@@ -1233,6 +1236,7 @@
 		"node_modules/@mui/material": {
 			"version": "7.3.7",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@babel/runtime": "^7.28.4",
 				"@mui/core-downloads-tracker": "^7.3.7",
@@ -1337,6 +1341,7 @@
 		"node_modules/@mui/system": {
 			"version": "7.3.7",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@babel/runtime": "^7.28.4",
 				"@mui/private-theming": "^7.3.7",
@@ -2381,6 +2386,7 @@
 			"version": "24.5.2",
 			"devOptional": true,
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"undici-types": "~7.12.0"
 			}
@@ -2396,6 +2402,7 @@
 		"node_modules/@types/react": {
 			"version": "18.3.27",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@types/prop-types": "*",
 				"csstype": "^3.2.2"
@@ -2486,6 +2493,7 @@
 			"integrity": "sha512-4Z+L8I2OqhZV8qA132M4wNL30ypZGYOQVBfMgxDH/K5UX0PNqTu1c6za9ST5r9+tavvHiTWmBnKzpCJ/GlVFtg==",
 			"dev": true,
 			"license": "BSD-2-Clause",
+			"peer": true,
 			"dependencies": {
 				"@typescript-eslint/scope-manager": "7.18.0",
 				"@typescript-eslint/types": "7.18.0",
@@ -2766,6 +2774,7 @@
 			"version": "8.15.0",
 			"dev": true,
 			"license": "MIT",
+			"peer": true,
 			"bin": {
 				"acorn": "bin/acorn"
 			},
@@ -3122,6 +3131,7 @@
 				}
 			],
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"baseline-browser-mapping": "^2.10.42",
 				"caniuse-lite": "^1.0.30001800",
@@ -3565,7 +3575,8 @@
 		},
 		"node_modules/dayjs": {
 			"version": "1.11.13",
-			"license": "MIT"
+			"license": "MIT",
+			"peer": true
 		},
 		"node_modules/debug": {
 			"version": "4.4.3",
@@ -3964,6 +3975,7 @@
 			"version": "8.57.1",
 			"dev": true,
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@eslint-community/eslint-utils": "^4.2.0",
 				"@eslint-community/regexpp": "^4.6.1",
@@ -4776,6 +4788,7 @@
 				}
 			],
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@babel/runtime": "^7.27.6"
 			},
@@ -5587,6 +5600,7 @@
 			"resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-5.19.0.tgz",
 			"integrity": "sha512-REhYUN8gNP3HlcIZS6QU2uy8iovl31cXsrNDkCcqWSQbCkcpdYLczqDz5PVIwNH42UQNyvukjes/RoHPDrOUmQ==",
 			"license": "BSD-3-Clause",
+			"peer": true,
 			"dependencies": {
 				"@mapbox/geojson-rewind": "^0.5.2",
 				"@mapbox/jsonlint-lines-primitives": "^2.0.2",
@@ -6368,6 +6382,7 @@
 		"node_modules/react-dom": {
 			"version": "18.3.1",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"loose-envify": "^1.1.0",
 				"scheduler": "^0.23.2"
@@ -6379,6 +6394,7 @@
 		"node_modules/react-hook-form": {
 			"version": "7.71.1",
 			"license": "MIT",
+			"peer": true,
 			"engines": {
 				"node": ">=18.0.0"
 			},
@@ -6582,7 +6598,8 @@
 		},
 		"node_modules/redux": {
 			"version": "5.0.1",
-			"license": "MIT"
+			"license": "MIT",
+			"peer": true
 		},
 		"node_modules/redux-persist": {
 			"version": "6.0.0",
@@ -6732,6 +6749,7 @@
 			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.2.tgz",
 			"integrity": "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"@types/estree": "1.0.9"
 			},
@@ -7573,6 +7591,7 @@
 			"version": "5.9.3",
 			"devOptional": true,
 			"license": "Apache-2.0",
+			"peer": true,
 			"bin": {
 				"tsc": "bin/tsc",
 				"tsserver": "bin/tsserver"
@@ -7710,6 +7729,7 @@
 			"resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
 			"integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
 			"license": "MIT",
+			"peer": true,
 			"dependencies": {
 				"esbuild": "^0.25.0",
 				"fdir": "^6.4.4",

client/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "client",
 	"private": true,
-	"version": "3.11.0",
+	"version": "3.12.0",
 	"type": "module",
 	"scripts": {
 		"lockfile": "docker run --rm -v \"$PWD\":/w -w /w $(grep -m1 -o 'node:[^ ]*' ../docker/Dockerfile) npm install --package-lock-only",
@@ -12,7 +12,8 @@
 		"lint-strict": "eslint . --ext js,jsx,ts,tsx --report-unused-disable-directives --max-warnings 0",
 		"preview": "vite preview",
 		"format": "prettier --write .",
-		"format-check": "prettier --check ."
+		"format-check": "prettier --check .",
+		"compile": "tsc -b"
 	},
 	"lint-staged": {
 		"**/*": "prettier --write --ignore-unknown"

client/src/Components/design-elements/BaseBox.tsx

@@ -1,10 +1,12 @@
 import Box, { type BoxProps } from "@mui/material/Box";
 import { useTheme } from "@mui/material/styles";
+import { forwardRef } from "react";
 
-export const BaseBox = ({ sx, ...rest }: BoxProps) => {
+export const BaseBox = forwardRef<HTMLDivElement, BoxProps>(({ sx, ...rest }, ref) => {
 	const theme = useTheme();
 	return (
 		<Box
+			ref={ref}
 			{...rest}
 			sx={{
 				backgroundColor: theme.palette.background.paper,
@@ -16,4 +18,6 @@ export const BaseBox = ({ sx, ...rest }: BoxProps) => {
 			}}
 		/>
 	);
-};
+});
+
+BaseBox.displayName = "BaseBox";

client/src/Components/design-elements/MonitorStatus.tsx

@@ -8,8 +8,11 @@ import { typographyLevels } from "@/Utils/Theme/Palette";
 import useMediaQuery from "@mui/material/useMediaQuery";
 import { LAYOUT } from "@/Utils/Theme/constants";
 import { formatDuration } from "@/Utils/TimeUtils";
+import { useTranslation } from "react-i18next";
+
 export const MonitorStatus = ({ monitor }: { monitor: Monitor }) => {
 	const theme = useTheme();
+	const { t, i18n } = useTranslation();
 	const isSmall = useMediaQuery(theme.breakpoints.down("md"));
 
 	if (!monitor) {
@@ -52,7 +55,12 @@ export const MonitorStatus = ({ monitor }: { monitor: Monitor }) => {
 					<>
 						<Dot />
 						<Typography>
-							Checking every {formatDuration(monitor?.interval, true)}
+							{t("pages.common.monitors.statBoxes.checkingEvery", {
+								interval: formatDuration(monitor.interval, {
+									long: true,
+									locale: i18n.resolvedLanguage,
+								}),
+							})}
 						</Typography>
 					</>
 				)}

client/src/Components/design-elements/PageHeader.tsx

@@ -6,7 +6,7 @@ import { Link as RouterLink } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { useTheme } from "@mui/material/styles";
 import { ChevronLeft, HelpCircle, FileText, Code } from "lucide-react";
-import { CONTROL_HEIGHT, ICON_CONTROL_WIDTH } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 
 import type { ReactNode } from "react";
 
@@ -142,8 +142,8 @@ export const PageHeader = ({
 								display: "inline-flex",
 								alignItems: "center",
 								justifyContent: "center",
-								width: ICON_CONTROL_WIDTH,
-								height: CONTROL_HEIGHT,
+								width: 36,
+								height: INPUT_BASE_HEIGHT,
 								color: theme.palette.text.secondary,
 								borderRight:
 									idx < linkItems.length - 1

client/src/Components/design-elements/SkeletonCard.tsx

@@ -1,5 +1,5 @@
 import { Box, Stack, useTheme } from "@mui/material";
-import { CONTROL_HEIGHT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 
 interface SkeletonCardProps {
 	width?: number | string | { xs?: number | string; md?: number | string };
@@ -45,7 +45,7 @@ export const SkeletonCard = ({
 
 	const blockStyle = {
 		width: 55,
-		height: CONTROL_HEIGHT,
+		height: INPUT_BASE_HEIGHT,
 		borderRadius: theme.shape.borderRadius,
 		background: theme.palette.secondary.main,
 		border: `1px solid ${theme.palette.divider}`,

client/src/Components/design-elements/StatusBox.tsx

@@ -33,12 +33,6 @@ export const BGBox = ({ children, sx }: StatusBoxProps) => {
 				bottom={0}
 				sx={{
 					pointerEvents: "none",
-					// Deliberately far fainter than `divider` - this is texture
-					// behind the number, not a rule, and it must never compete
-					// with the box's own border. Note alpha() *replaces* the
-					// alpha channel, so this relies on `divider` being an opaque
-					// hex; if it ever goes translucent this gets stronger, not
-					// weaker.
 					backgroundImage: `
 						linear-gradient(${alpha(theme.palette.divider, 0.4)} 1px, transparent 1px),
 						linear-gradient(90deg, ${alpha(theme.palette.divider, 0.4)} 1px, transparent 1px)

client/src/Components/design-elements/Table.tsx

@@ -52,11 +52,6 @@ type DataTableProps<T extends { id?: string | number; _id?: string | number }> =
 	emptyViewText?: string;
 	emptyViewPositive?: boolean;
 	getRowSx?: (row: T) => SxProps<Theme>;
-	/**
-	 * Marks a row selected so it gets the shared selected + hover treatment.
-	 * Desktop table only - the small-screen card branch does not style
-	 * selection yet, same as `getRowSx`.
-	 */
 	isRowSelected?: (row: T) => boolean;
 };
 
@@ -86,6 +81,21 @@ export function DataTable<
 	};
 
 	const isSmall = useMediaQuery(theme.breakpoints.down("md"));
+
+	const hasTextSelectionWithin = (element: Element) => {
+		const selection = window.getSelection();
+		if (!selection || selection.isCollapsed || !selection.toString().trim()) {
+			return false;
+		}
+		return (
+			selection.anchorNode !== null &&
+			element.contains(
+				selection.anchorNode.nodeType === Node.TEXT_NODE
+					? selection.anchorNode.parentNode
+					: selection.anchorNode
+			)
+		);
+	};
 	const isInteractive = Boolean(onRowClick) || expandableRows;
 
 	if (data.length === 0 || headers.length === 0) {
@@ -107,7 +117,10 @@ export function DataTable<
 					keys.push(key);
 					return (
 						<Stack
-							onClick={() => (onRowClick ? onRowClick(row) : null)}
+							onClick={(e) => {
+								if (hasTextSelectionWithin(e.currentTarget)) return;
+								if (onRowClick) onRowClick(row);
+							}}
 							spacing={theme.spacing(LAYOUT.XS)}
 							sx={{
 								borderStyle: "solid",
@@ -220,17 +233,6 @@ export function DataTable<
 					"& .MuiTableBody-root .MuiTableRow-root:last-child .MuiTableCell-root": {
 						borderBottom: "none",
 					},
-					"& .MuiTableBody-root .MuiTableRow-root.is-selected .MuiTableCell-root": {
-						backgroundColor: theme.palette.action.selected,
-					},
-					"& .MuiTableBody-root .MuiTableRow-root.is-clickable:hover .MuiTableCell-root":
-						{
-							backgroundColor: theme.palette.action.rowHover,
-						},
-					"& .MuiTableBody-root .MuiTableRow-root.is-selected.is-clickable:hover .MuiTableCell-root":
-						{
-							backgroundColor: theme.palette.action.selectedHover,
-						},
 				}}
 			>
 				<TableHead>
@@ -251,21 +253,29 @@ export function DataTable<
 					{data.map((row) => {
 						const key = row.id || row._id || Math.random();
 						const isExpanded = expanded === key;
+						const selected = isRowSelected?.(row);
 
 						return (
 							<Fragment key={key}>
 								<TableRow
-									className={[
-										isInteractive ? "is-clickable" : "",
-										isRowSelected?.(row) ? "is-selected" : "",
-									]
-										.filter(Boolean)
-										.join(" ")}
 									sx={{
 										cursor: isInteractive ? "pointer" : "default",
+										...(isInteractive && {
+											"&:hover .MuiTableCell-root": {
+												backgroundColor: selected
+													? theme.palette.action.selectedHover
+													: theme.palette.action.rowHover,
+											},
+										}),
+										...(selected && {
+											"& .MuiTableCell-root": {
+												backgroundColor: theme.palette.action.selected,
+											},
+										}),
 										...(getRowSx?.(row) as object),
 									}}
-									onClick={() => {
+									onClick={(e) => {
+										if (hasTextSelectionWithin(e.currentTarget)) return;
 										if (expandableRows) handleExpand(row);
 										else if (onRowClick) onRowClick(row);
 									}}

client/src/Components/design-elements/Tabs.tsx

@@ -2,7 +2,7 @@ import MuiTabs from "@mui/material/Tabs";
 import type { TabsProps } from "@mui/material/Tabs";
 import { useTheme } from "@mui/material/styles";
 import { typographyLevels } from "@/Utils/Theme/Palette";
-import { CONTROL_HEIGHT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 interface CustomTabsProps extends TabsProps {}
 
 export const Tabs = (props: CustomTabsProps) => {
@@ -10,7 +10,7 @@ export const Tabs = (props: CustomTabsProps) => {
 	return (
 		<MuiTabs
 			sx={{
-				minHeight: CONTROL_HEIGHT,
+				minHeight: INPUT_BASE_HEIGHT,
 				borderBottom: `1px solid ${theme.palette.divider}`,
 				"& .MuiTabs-indicator": {
 					backgroundColor: theme.palette.primary.main,
@@ -42,7 +42,7 @@ export const Tab = (props: CustomTabProps) => {
 				textTransform: "none",
 				fontSize: typographyLevels.m,
 				fontWeight: 500,
-				minHeight: CONTROL_HEIGHT,
+				minHeight: INPUT_BASE_HEIGHT,
 				padding: theme.spacing(1, 0),
 				paddingBottom: 0,
 				minWidth: "auto",

client/src/Components/inputs/Button.tsx

@@ -1,7 +1,7 @@
 import Button from "@mui/material/Button";
 import type { ButtonProps } from "@mui/material/Button";
 import { useTheme, darken } from "@mui/material/styles";
-import { CONTROL_HEIGHT, HOVER } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT, HOVER } from "@/Utils/Theme/constants";
 
 const PALETTE_COLORS = [
 	"primary",
@@ -43,7 +43,7 @@ export const ButtonInput = ({ sx, ...props }: ButtonProps) => {
 			{...props}
 			sx={{
 				textTransform: "none",
-				height: CONTROL_HEIGHT,
+				height: INPUT_BASE_HEIGHT,
 				lineHeight: 1.2,
 				fontWeight: 400,
 				borderRadius: 2,

client/src/Components/inputs/ColorPicker.tsx

@@ -4,7 +4,7 @@ import { typographyLevels } from "@/Utils/Theme/Palette";
 import { useTheme } from "@mui/material";
 import Stack from "@mui/material/Stack";
 import { FieldLabel } from "@/Components/inputs/FieldLabel";
-import { CONTROL_HEIGHT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 
 interface ColorPickerProps extends MuiColorInputProps {
 	fieldLabel?: string;
@@ -19,7 +19,7 @@ export const ColorInput = ({ fieldLabel, required, ...props }: ColorPickerProps)
 			sx={{
 				"& .MuiOutlinedInput-root": {
 					borderRadius: theme.shape.borderRadius,
-					height: CONTROL_HEIGHT,
+					height: INPUT_BASE_HEIGHT,
 					fontSize: typographyLevels.base,
 				},
 				"& .MuiOutlinedInput-notchedOutline": {

client/src/Components/inputs/DatePicker.tsx

@@ -8,7 +8,7 @@ import { FieldLabel } from "./FieldLabel";
 import { Calendar } from "lucide-react";
 import { AdapterDayjs } from "@mui/x-date-pickers/AdapterDayjs";
 import { LocalizationProvider } from "@mui/x-date-pickers";
-import { CONTROL_HEIGHT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 
 interface DatePickerComponentProps extends Omit<DatePickerProps<Dayjs>, "label"> {
 	fieldLabel?: string;
@@ -56,7 +56,7 @@ export const DatePickerComponent = ({
 								flexDirection: "row-reverse",
 							},
 							"& input": {
-								minHeight: CONTROL_HEIGHT,
+								minHeight: INPUT_BASE_HEIGHT,
 								p: 0,
 								pl: theme.spacing(3),
 								pr: theme.spacing(5),

client/src/Components/inputs/Select.tsx

@@ -6,7 +6,7 @@ import Stack from "@mui/material/Stack";
 import { FieldLabel } from "./FieldLabel";
 import { ChevronDown } from "lucide-react";
 import Typography from "@mui/material/Typography";
-import { CONTROL_HEIGHT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 
 interface SelectInputProps<T> extends Omit<SelectProps<T>, "label"> {
 	fieldLabel?: string;
@@ -72,7 +72,7 @@ const SelectInputInner = <T,>(
 				/>
 			)}
 			sx={{
-				height: `${CONTROL_HEIGHT}px`,
+				height: `${INPUT_BASE_HEIGHT}px`,
 				"& .MuiSelect-select": {
 					display: "flex",
 					alignItems: "center",

client/src/Components/inputs/TextInput.tsx

@@ -5,7 +5,7 @@ import { typographyLevels } from "@/Utils/Theme/Palette";
 import { useTheme } from "@mui/material/styles";
 import Stack from "@mui/material/Stack";
 import { FieldLabel } from "./FieldLabel";
-import { CONTROL_HEIGHT, LAYOUT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT, LAYOUT } from "@/Utils/Theme/constants";
 
 interface TextInputProps extends Omit<TextFieldProps, "label"> {
 	fieldLabel?: string;
@@ -22,7 +22,7 @@ export const TextInput = forwardRef<HTMLInputElement, TextInputProps>(function T
 		width: "100%",
 		"& .MuiOutlinedInput-root": {
 			borderRadius: theme.shape.borderRadius,
-			height: props.multiline ? "auto" : CONTROL_HEIGHT,
+			height: props.multiline ? "auto" : INPUT_BASE_HEIGHT,
 			fontSize: typographyLevels.base,
 			overflow: "hidden",
 		},

client/src/Components/inputs/TimePicker.tsx

@@ -7,7 +7,7 @@ import Typography from "@mui/material/Typography";
 import { FieldLabel } from "./FieldLabel";
 import { AdapterDayjs } from "@mui/x-date-pickers/AdapterDayjs";
 import { LocalizationProvider } from "@mui/x-date-pickers";
-import { CONTROL_HEIGHT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 
 interface TimePickerComponentProps extends Omit<MobileTimePickerProps<Dayjs>, "label"> {
 	fieldLabel?: string;
@@ -34,7 +34,7 @@ export const TimePickerComponent = ({
 						sx: {
 							width: "fit-content",
 							"& input": {
-								minHeight: CONTROL_HEIGHT,
+								minHeight: INPUT_BASE_HEIGHT,
 								p: 0,
 								px: theme.spacing(5),
 							},

client/src/Components/inputs/ToggleButton.tsx

@@ -4,7 +4,7 @@ import type { ToggleButtonProps } from "@mui/material/ToggleButton";
 import type { ToggleButtonGroupProps } from "@mui/material/ToggleButtonGroup";
 import { useTheme } from "@mui/material/styles";
 import { alpha } from "@mui/material/styles";
-import { CONTROL_HEIGHT } from "@/Utils/Theme/constants";
+import { INPUT_BASE_HEIGHT } from "@/Utils/Theme/constants";
 
 export const ToggleButtonInput = ({ sx, ...props }: ToggleButtonProps) => {
 	const theme = useTheme();
@@ -21,7 +21,7 @@ export const ToggleButtonInput = ({ sx, ...props }: ToggleButtonProps) => {
 			sx={{
 				px: 8,
 				textTransform: "none",
-				height: CONTROL_HEIGHT,
+				height: INPUT_BASE_HEIGHT,
 				fontWeight: 400,
 				whiteSpace: "nowrap",
 				textOverflow: "ellipsis",

client/src/Components/inputs/forms/FormAutoCompleteField.tsx

@@ -5,9 +5,10 @@ import {
 	type FieldValues,
 } from "react-hook-form";
 import { Autocomplete } from "@/Components/inputs";
+import type { AutocompleteProps } from "@mui/material/Autocomplete";
 
 export interface AutocompleteOption {
-	id: string;
+	id: string | number;
 	name: string;
 }
 
@@ -16,6 +17,9 @@ interface FormAutocompleteProps<T extends FieldValues, O extends AutocompleteOpt
 	options: O[];
 	fieldLabel?: string;
 	placeholder?: string;
+	filterOptions?: AutocompleteProps<O, false, false, false>["filterOptions"];
+	getOptionDisabled?: AutocompleteProps<O, false, false, false>["getOptionDisabled"];
+	disableClearable?: boolean;
 }
 
 export const FormAutocompleteField = <
@@ -26,6 +30,9 @@ export const FormAutocompleteField = <
 	options,
 	fieldLabel,
 	placeholder,
+	filterOptions,
+	getOptionDisabled,
+	disableClearable,
 }: FormAutocompleteProps<T, O>) => {
 	const { control } = useFormContext<T>();
 	return (
@@ -39,10 +46,14 @@ export const FormAutocompleteField = <
 					isOptionEqualToValue={(option, value) => option.id === value.id}
 					value={options.find((o) => o.id === field.value) ?? null}
 					onChange={(_: unknown, newValue: O | null) => {
+						if (newValue === null && disableClearable) return;
 						field.onChange(newValue?.id ?? "");
 					}}
 					fieldLabel={fieldLabel}
 					placeholder={placeholder}
+					filterOptions={filterOptions}
+					getOptionDisabled={getOptionDisabled}
+					disableClearable={disableClearable}
 					error={!!fieldState.error}
 					helperText={fieldState.error?.message ?? ""}
 				/>

client/src/Components/monitors/HeaderMonitorControls.tsx

@@ -60,20 +60,22 @@ export const HeaderMonitorControls = ({
 				direction={{ xs: "column", md: "row" }}
 				gap={theme.spacing(2)}
 			>
-				<Button
-					variant="contained"
-					color="secondary"
-					loading={isPosting}
-					startIcon={<Icon icon={Mail} />}
-					onClick={async () => {
-						await post(`/notifications/test/all`, { monitorId: monitor.id });
-					}}
-					sx={{
-						whiteSpace: "nowrap",
-					}}
-				>
-					{t("common.buttons.testNotifications")}
-				</Button>
+				{isAdmin && (
+					<Button
+						variant="contained"
+						color="secondary"
+						loading={isPosting}
+						startIcon={<Icon icon={Mail} />}
+						onClick={async () => {
+							await post(`/notifications/test/all`, { monitorId: monitor.id });
+						}}
+						sx={{
+							whiteSpace: "nowrap",
+						}}
+					>
+						{t("common.buttons.testNotifications")}
+					</Button>
+				)}
 				<Button
 					variant="contained"
 					color="secondary"

client/src/Components/monitors/MonitorListPage.tsx

@@ -35,7 +35,7 @@ export const MonitorListPage = ({
 	headerKey,
 	page,
 	actionLink,
-	controller: c,
+	controller,
 	bulkActions,
 	showTypeFilter,
 	summaryProps,
@@ -48,14 +48,14 @@ export const MonitorListPage = ({
 	const theme = useTheme();
 	const isSmall = useMediaQuery(theme.breakpoints.down("md"));
 	const isAdmin = useIsAdmin();
-	const isLoading = c.isLoading || Boolean(extraLoading);
+	const isLoading = controller.isLoading || Boolean(extraLoading);
 
 	return (
 		<MonitorBasePageWithStates
 			headerKey={headerKey}
 			loading={isLoading}
-			error={c.error || extraError}
-			totalCount={c.effectiveTotalCount}
+			error={controller.error || extraError}
+			totalCount={controller.effectiveTotalCount}
 			page={page}
 			actionLink={actionLink}
 			priorityFallback={priorityFallback}
@@ -66,7 +66,7 @@ export const MonitorListPage = ({
 				isAdmin={isAdmin}
 			/>
 			<HeaderMonitorsSummary
-				summary={c.summary}
+				summary={controller.summary}
 				{...summaryProps}
 			/>
 			<Stack
@@ -78,27 +78,27 @@ export const MonitorListPage = ({
 					{...(showTypeFilter === false
 						? { showTypes: false }
 						: {
-								selectedTypes: c.selectedTypes,
-								setSelectedTypes: c.setSelectedTypes,
+								selectedTypes: controller.selectedTypes,
+								setSelectedTypes: controller.setSelectedTypes,
 							})}
-					selectedStatus={c.selectedStatus}
-					setSelectedStatus={c.setSelectedStatus}
-					selectedState={c.selectedState}
-					setSelectedState={c.setSelectedState}
-					tagOptions={c.tags ?? []}
-					selectedTags={c.selectedTags}
-					setSelectedTags={c.setSelectedTags}
-					onClearFilters={c.handleClearFilters}
+					selectedStatus={controller.selectedStatus}
+					setSelectedStatus={controller.setSelectedStatus}
+					selectedState={controller.selectedState}
+					setSelectedState={controller.setSelectedState}
+					tagOptions={controller.tags ?? []}
+					selectedTags={controller.selectedTags}
+					setSelectedTags={controller.setSelectedTags}
+					onClearFilters={controller.handleClearFilters}
 				/>
 				<TextField
 					placeholder={t("pages.uptime.filters.search.placeholder")}
-					value={c.search}
+					value={controller.search}
 					onChange={(event) => {
-						c.setSearch(event.target.value);
+						controller.setSearch(event.target.value);
 					}}
 				/>
 			</Stack>
-			{c.selectedTags.length > 0 && (
+			{controller.selectedTags.length > 0 && (
 				<Stack
 					direction={isSmall ? "column" : "row"}
 					alignItems={isSmall ? "flex-start" : "center"}
@@ -108,8 +108,8 @@ export const MonitorListPage = ({
 					<Typography color={theme.palette.text.secondary}>
 						{t("pages.uptime.filters.activeTags")}
 					</Typography>
-					{c.selectedTags.map((tagId) => {
-						const tag = c.tags?.find((t) => t.id === tagId);
+					{controller.selectedTags.map((tagId) => {
+						const tag = controller.tags?.find((t) => t.id === tagId);
 						if (!tag) return null;
 						return (
 							<ColoredLabel
@@ -123,20 +123,20 @@ export const MonitorListPage = ({
 			)}
 			{bulkActions && !isLoading && (
 				<BulkActionsBar
-					selectedCount={c.selectedRows.length}
-					onCancel={c.handleCancelSelection}
+					selectedCount={controller.selectedRows.length}
+					onCancel={controller.handleCancelSelection}
 				>
 					<Button
 						size="small"
 						startIcon={<Play size={16} />}
-						onClick={c.handleBulkResume}
+						onClick={controller.handleBulkResume}
 					>
 						{t("common.buttons.resume")}
 					</Button>
 					<Button
 						size="small"
 						startIcon={<Pause size={16} />}
-						onClick={c.handleBulkPause}
+						onClick={controller.handleBulkPause}
 					>
 						{t("common.buttons.pause")}
 					</Button>
@@ -144,12 +144,12 @@ export const MonitorListPage = ({
 			)}
 			{children}
 			<Dialog
-				open={c.isDialogOpen}
+				open={controller.isDialogOpen}
 				title={t("common.dialogs.delete.title")}
 				content={t("common.dialogs.delete.description")}
-				onConfirm={c.handleConfirmDelete}
-				onCancel={c.handleCancelDelete}
-				loading={c.isDeleting}
+				onConfirm={controller.handleConfirmDelete}
+				onCancel={controller.handleCancelDelete}
+				loading={controller.isDeleting}
 			/>
 		</MonitorBasePageWithStates>
 	);

client/src/Components/monitors/MonitorStatBoxes.tsx

@@ -21,7 +21,7 @@ export const MonitorStatBoxes = ({
 	domainExpiry,
 }: MonitorStatBoxesProps) => {
 	const theme = useTheme();
-	const { t } = useTranslation();
+	const { t, i18n } = useTranslation();
 	if (!monitorStats || !monitor) {
 		return null;
 	}
@@ -29,13 +29,16 @@ export const MonitorStatBoxes = ({
 	const timeOfLastFailure = monitorStats?.timeOfLastFailure || 0;
 	const timeSinceLastFailure = timeOfLastFailure > 0 ? Date.now() - timeOfLastFailure : 0;
 
-	// Determine time since last check
 	const timeOfLastCheck = monitorStats?.lastCheckTimestamp || 0;
-	const timeSinceLastCheck = Date.now() - timeOfLastCheck || 0;
 
 	const streakTime = formatDuration(timeSinceLastFailure);
-
-	const lastCheckTime = formatDuration(timeSinceLastCheck);
+	const lastCheckTime = timeOfLastCheck
+		? formatDuration(Date.now() - timeOfLastCheck, {
+				long: true,
+				relative: true,
+				locale: i18n.resolvedLanguage,
+			})
+		: t("common.labels.na");
 	const isActive =
 		monitor?.status === "up" ||
 		monitor?.status === "paused" ||

client/src/Components/monitors/charts/HistogramDockerContainer.tsx

@@ -1,15 +1,58 @@
-import { BaseChart } from "@/Components/design-elements";
-import { Area, AreaChart, CartesianGrid, ResponsiveContainer } from "recharts";
+import { BaseChart, BaseBox } from "@/Components/design-elements";
+import { Area, AreaChart, CartesianGrid, ResponsiveContainer, Tooltip } from "recharts";
+import Typography from "@mui/material/Typography";
 
 // Types
 import type { DockerContainerStats } from "@/Types/Monitor";
+import type { TooltipProps } from "recharts";
+import type { NameType, ValueType } from "recharts/types/component/DefaultTooltipContent";
+import type { Theme } from "@mui/material/styles";
+import type { RootState } from "@/Types/state";
 
 // Hooks
 import { useTheme } from "@mui/material";
 import { Fragment, useId } from "react";
+import { useTranslation } from "react-i18next";
+import { useSelector } from "react-redux";
 
 // Utils
 import { createGradient } from "@/Components/monitors/charts/ChartUtils";
+import { tooltipDateFormatLookup, formatDateWithTz } from "@/Utils/TimeUtils";
+import type { DateRange } from "@/Types/Query";
+
+type DockerHistogramToolTipProps = TooltipProps<ValueType, NameType> & {
+	dataKey: string;
+	range: string;
+	theme: Theme;
+	uiTimezone: string;
+	valueFormatter: (value: number) => string;
+	labelKey: string;
+};
+
+const DockerHistogramToolTip = ({
+	dataKey,
+	active,
+	payload,
+	range,
+	theme,
+	uiTimezone,
+	valueFormatter,
+	labelKey,
+}: DockerHistogramToolTipProps) => {
+	const { t } = useTranslation();
+	if (!payload) return null;
+	if (!active) return null;
+	const format = tooltipDateFormatLookup(range);
+	const ts = payload[0].payload?._id ?? null;
+	const dataPoint = payload[0].payload?.[dataKey] ?? null;
+
+	return (
+		<BaseBox sx={{ py: theme.spacing(2), px: theme.spacing(4) }}>
+			<Typography>{formatDateWithTz(ts, format, uiTimezone)}</Typography>
+			<Typography>{t(labelKey, { value: valueFormatter(dataPoint) })}</Typography>
+		</BaseBox>
+	);
+};
 interface HistogramDockerContainerProps {
 	title: string;
 	rightTitle: string;
@@ -17,6 +60,9 @@ interface HistogramDockerContainerProps {
 	dataKey: string;
 	strokeColor: string;
 	gradientStartColor: string;
+	range: DateRange;
+	formatter: (value: number) => string;
+	labelKey: string;
 }
 
 export const HistogramDockerContainer = ({
@@ -26,11 +72,14 @@ export const HistogramDockerContainer = ({
 	dataKey,
 	strokeColor,
 	gradientStartColor,
+	range,
+	formatter,
+	labelKey,
 }: HistogramDockerContainerProps) => {
 	const uniqueId = useId();
 	const theme = useTheme();
 	const gradientId = `gradient-${uniqueId}`;
-
+	const uiTimezone = useSelector((state: RootState) => state.ui.timezone);
 	return (
 		<BaseChart
 			icon="null"
@@ -56,6 +105,19 @@ export const HistogramDockerContainer = ({
 							endColor: "transparent",
 							direction: "vertical",
 						})}
+						<Tooltip
+							content={(props) => (
+								<DockerHistogramToolTip
+									{...props}
+									range={range}
+									theme={theme}
+									uiTimezone={uiTimezone}
+									dataKey={dataKey}
+									valueFormatter={formatter}
+									labelKey={labelKey}
+								/>
+							)}
+						/>
 						<Area
 							dataKey={dataKey}
 							type="monotone"

client/src/Components/sidebar/Menu.tsx

@@ -20,21 +20,27 @@ import {
 	Tag,
 	Waypoints,
 	Container,
+	// LayoutDashboard,
 } from "lucide-react";
 export const getMenu = (t: Function) => {
 	return [
 		{
 			group: t("components.sidebar.menu.groups.monitoring"),
 			items: [
+				// {
+				// 	name: t("components.sidebar.menu.dashboard"),
+				// 	path: "dashboard",
+				// 	icon: <Icon icon={LayoutDashboard} />,
+				// },
 				{
 					name: t("components.sidebar.menu.uptime"),
 					path: "uptime",
 					icon: <Icon icon={Globe} />,
 				},
 				{
-					name: t("components.sidebar.menu.pagespeed"),
-					path: "pagespeed",
-					icon: <Icon icon={Gauge} />,
+					name: t("components.sidebar.menu.docker"),
+					path: "docker",
+					icon: <Icon icon={Container} />,
 				},
 				{
 					name: t("components.sidebar.menu.infrastructure"),
@@ -42,9 +48,9 @@ export const getMenu = (t: Function) => {
 					icon: <Icon icon={Link} />,
 				},
 				{
-					name: t("components.sidebar.menu.docker"),
-					path: "docker",
-					icon: <Icon icon={Container} />,
+					name: t("components.sidebar.menu.pagespeed"),
+					path: "pagespeed",
+					icon: <Icon icon={Gauge} />,
 				},
 			],
 		},

client/src/Components/sidebar/NavItem.tsx

@@ -25,7 +25,6 @@ export const NavItem = ({
 	const iconStroke = selected
 		? theme.palette.sidebar.accent
 		: theme.palette.text.secondary;
-
 	const buttonBgColor = selected ? theme.palette.action.selected : "transparent";
 	const buttonBgHoverColor = selected
 		? theme.palette.action.selectedHover

client/src/Hooks/UseApi.ts

@@ -6,7 +6,7 @@ import { useState } from "react";
 import { useToast } from "@/Hooks/UseToast";
 import { logger } from "@/Utils/logger";
 
-interface ApiResponse<T> {
+export interface ApiResponse<T> {
 	success: boolean;
 	msg: string;
 	data: T;

client/src/Hooks/UseToast.ts

@@ -1,27 +1,30 @@
 import { toast, type ToastOptions } from "react-toastify";
+import { useMemo } from "react";
 
 export const useToast = () => {
-	const showToast = (message: string, options?: ToastOptions) => {
-		toast.dismiss();
-		const baseStyle: React.CSSProperties = {
-			whiteSpace: "nowrap",
-			overflow: "hidden",
-			textOverflow: "ellipsis",
+	return useMemo(() => {
+		const showToast = (message: string, options?: ToastOptions) => {
+			toast.dismiss();
+			const baseStyle: React.CSSProperties = {
+				whiteSpace: "nowrap",
+				overflow: "hidden",
+				textOverflow: "ellipsis",
+			};
+			toast(message, {
+				...options,
+				style: { ...baseStyle, ...(options?.style || {}) },
+			});
 		};
-		toast(message, {
-			...options,
-			style: { ...baseStyle, ...(options?.style || {}) },
-		});
-	};
 
-	const toastSuccess = (msg: string, opts?: ToastOptions) =>
-		showToast(msg, { ...opts, type: "success" });
-	const toastError = (msg: string, opts?: ToastOptions) =>
-		showToast(msg, { ...opts, type: "error" });
-	const toastInfo = (msg: string, opts?: ToastOptions) =>
-		showToast(msg, { ...opts, type: "info" });
-	const toastWarning = (msg: string, opts?: ToastOptions) =>
-		showToast(msg, { ...opts, type: "warning" });
+		const toastSuccess = (msg: string, opts?: ToastOptions) =>
+			showToast(msg, { ...opts, type: "success" });
+		const toastError = (msg: string, opts?: ToastOptions) =>
+			showToast(msg, { ...opts, type: "error" });
+		const toastInfo = (msg: string, opts?: ToastOptions) =>
+			showToast(msg, { ...opts, type: "info" });
+		const toastWarning = (msg: string, opts?: ToastOptions) =>
+			showToast(msg, { ...opts, type: "warning" });
 
-	return { showToast, toastSuccess, toastError, toastInfo, toastWarning };
+		return { showToast, toastSuccess, toastError, toastInfo, toastWarning };
+	}, []);
 };

client/src/Hooks/useMonitorForm.ts

@@ -77,6 +77,13 @@ export const getMonitorDefaults = (
 				...base,
 				type: "docker",
 				url: data?.url || "",
+				ignoreTlsErrors: data?.ignoreTlsErrors || false,
+				dockerTlsCa: data?.dockerTlsCa || "",
+				dockerTlsCert: data?.dockerTlsCert || "",
+				// The key is write-only; the API never returns it.
+				dockerTlsKey: "",
+				dockerTlsKeySet: data?.dockerTlsKeySet ?? false,
+				dockerLogsEnabled: data?.dockerLogsEnabled ?? false,
 			};
 			break;
 		case "game":

client/src/Pages/CreateMonitor/index.tsx

@@ -38,6 +38,7 @@ import {
 	PageSpeedStrategies,
 	DnsRecordTypes,
 	MonitorIntervalOptions,
+	MIN_MONITOR_INTERVAL_MS,
 	DefaultMonitorMatchMethod,
 	MonitorMatchMethods,
 	GeoCheckIntervalOptions,
@@ -50,6 +51,7 @@ import type { AppSettingsResponse } from "@/Types/Settings";
 import {
 	stepFieldsFor,
 	monitorStepCount,
+	isDockerTlsUrl,
 	type MonitorFormData,
 } from "@/Validation/monitor";
 import { FormNumberField } from "@/Components/inputs/forms/FormNumberField";
@@ -57,15 +59,62 @@ import { FormTextField } from "@/Components/inputs/forms/FormTextField";
 import { FormRadioGroup } from "@/Components/inputs/forms/FormRadioGroupField";
 import { FormMultiSelectField } from "@/Components/inputs/forms/FormMultiSelectField";
 import { FormSelectField } from "@/Components/inputs/forms/FormSelectField";
+import {
+	FormAutocompleteField,
+	type AutocompleteOption,
+} from "@/Components/inputs/forms/FormAutoCompleteField";
 import { FormSliderField } from "@/Components/inputs/forms/FormSliderField";
 import { FormSwitchField } from "@/Components/inputs/forms/FormSwitchField";
 import type { ProxyResponse } from "@/Types/Proxy";
+import { formatDuration } from "@/Utils/TimeUtils";
 
 const httpMethodOptions = HttpMethods.map((method) => ({
 	value: method,
 	label: method,
 }));
 
+const PEM_FIELD_ROWS = 6;
+
+// Hides the pasted key while the field is not focused. Ignored by browsers
+// without -webkit-text-security, which then show the key as plain text.
+const maskedInputSx = {
+	"&:not(.Mui-focused) textarea": { WebkitTextSecurity: "disc" },
+};
+
+interface IntervalOption extends AutocompleteOption {
+	id: number;
+}
+
+const INTERVAL_UNIT_MULTIPLIERS = [1000, 60000, 3600000, 86400000] as const;
+
+const toIntervalOption = (
+	intervalMs: number,
+	locale: string | undefined
+): IntervalOption => ({
+	id: intervalMs,
+	name: formatDuration(intervalMs, { long: true, locale }),
+});
+
+const filterIntervalOptions = (
+	options: IntervalOption[],
+	inputValue: string,
+	locale: string | undefined
+): IntervalOption[] => {
+	const input = inputValue.trim();
+	if (input === "" || options.some((option) => option.name === input)) {
+		return options;
+	}
+
+	const amount = Number(input);
+	if (!Number.isFinite(amount) || amount <= 0) {
+		return [];
+	}
+
+	return INTERVAL_UNIT_MULTIPLIERS.map((multiplier) => amount * multiplier)
+		.filter(Number.isSafeInteger)
+		.map((ms) => toIntervalOption(ms, locale));
+};
+
 interface GeneralSettingsConfig {
 	urlLabel: string;
 	urlPlaceholder: string;
@@ -118,8 +167,8 @@ const getGeneralSettingsConfig = (
 			showDnsRecordType: false,
 		},
 		docker: {
-			urlLabel: t("pages.createMonitor.form.general.option.container.label"),
-			urlPlaceholder: t("pages.createMonitor.form.general.option.container.placeholder"),
+			urlLabel: t("pages.createMonitor.form.general.option.dockerHost.label"),
+			urlPlaceholder: t("pages.createMonitor.form.general.option.dockerHost.placeholder"),
 			namePlaceholder: t("pages.createMonitor.form.general.option.name.placeholder"),
 			showUrl: true,
 			showProxy: false,
@@ -243,7 +292,7 @@ const getGeneralSettingsConfig = (
 
 const CreateMonitorPage = () => {
 	const theme = useTheme();
-	const { t } = useTranslation();
+	const { t, i18n } = useTranslation();
 	const { monitorId } = useParams();
 	const location = useLocation();
 	const navigate = useNavigate();
@@ -255,6 +304,7 @@ const CreateMonitorPage = () => {
 		const firstSegment = pathSegments[0];
 		if (firstSegment === "pagespeed") return "pagespeed";
 		if (firstSegment === "infrastructure") return "hardware";
+		if (firstSegment === "docker") return "docker";
 		return "uptime";
 	}, [location.pathname]);
 
@@ -264,7 +314,9 @@ const CreateMonitorPage = () => {
 			? "pagespeed"
 			: pageType === "hardware"
 				? "hardware"
-				: "http";
+				: pageType === "docker"
+					? "docker"
+					: "http";
 
 	const { data: existingMonitor, refetch: refetchMonitor } = useGet<Monitor>(
 		isEditMode ? `/monitors/${monitorId}` : null
@@ -297,10 +349,12 @@ const CreateMonitorPage = () => {
 	const showStep = (step: number) => isEditMode || currentStep === step;
 
 	const watchedType = watch("type") as MonitorType;
+	const watchedUrl = watch("url") as string;
 	const watchedMethod = watch("method") as HttpMethod | undefined;
 	const watchedProxyMode = watch("proxyMode") as ProxyMode | undefined;
 	const watchedUseAdvancedMatching = watch("useAdvancedMatching") as boolean;
 	const watchGeoCheckEnabled = watch("geoCheckEnabled") as boolean;
+	const watchedInterval = watch("interval");
 
 	// Steps without an advanced section drop it, so the last step is the form's.
 	const totalSteps = monitorStepCount(watchedType);
@@ -331,6 +385,8 @@ const CreateMonitorPage = () => {
 		[watchedType, t]
 	);
 
+	const pemInputSx = { fontFamily: theme.typography.fontFamilyMonospace };
+
 	const { post, loading: isCreating } = usePost<MonitorFormData, Monitor>();
 	const { patch, loading: isUpdating } = usePatch<MonitorFormData, Monitor>();
 	const isSubmitting = isCreating || isUpdating;
@@ -373,6 +429,8 @@ const CreateMonitorPage = () => {
 				navigate("/pagespeed");
 			} else if (pageType === "hardware") {
 				navigate("/infrastructure");
+			} else if (pageType === "docker") {
+				navigate("/docker");
 			} else {
 				navigate("/uptime");
 			}
@@ -454,16 +512,18 @@ const CreateMonitorPage = () => {
 		[t]
 	);
 
-	const intervalOptions = useMemo(
-		() =>
-			MonitorIntervalOptions.map((option) => ({
-				value: option.value,
-				label: t(
-					`pages.createMonitor.form.frequency.option.frequency.value.${option.labelKey}`
-				),
-			})),
-		[t]
-	);
+	const intervalOptions = useMemo(() => {
+		const options = MonitorIntervalOptions.map(({ value }) =>
+			toIntervalOption(value, i18n.resolvedLanguage)
+		);
+		if (
+			typeof watchedInterval === "number" &&
+			!options.some((option) => option.id === watchedInterval)
+		) {
+			options.push(toIntervalOption(watchedInterval, i18n.resolvedLanguage));
+		}
+		return options;
+	}, [watchedInterval, i18n.resolvedLanguage]);
 
 	const matchMethodOptions = useMemo(
 		() =>
@@ -684,17 +744,80 @@ const CreateMonitorPage = () => {
 					/>
 				)}
 
+				{showStep(0) && watchedType === "docker" && isDockerTlsUrl(watchedUrl) && (
+					<ConfigBox
+						title={t("pages.createMonitor.form.dockerTls.title")}
+						subtitle={t("pages.createMonitor.form.dockerTls.description")}
+						rightContent={
+							<Stack spacing={theme.spacing(LAYOUT.MD)}>
+								<FormTextField
+									name="dockerTlsCa"
+									multiline
+									rows={PEM_FIELD_ROWS}
+									fieldLabel={t("pages.createMonitor.form.dockerTls.option.ca.label")}
+									placeholder={t(
+										"pages.createMonitor.form.dockerTls.option.ca.placeholder"
+									)}
+									slotProps={{ input: { sx: pemInputSx } }}
+								/>
+								<FormTextField
+									name="dockerTlsCert"
+									multiline
+									rows={PEM_FIELD_ROWS}
+									fieldLabel={t("pages.createMonitor.form.dockerTls.option.cert.label")}
+									placeholder={t(
+										"pages.createMonitor.form.dockerTls.option.cert.placeholder"
+									)}
+									slotProps={{ input: { sx: pemInputSx } }}
+								/>
+								<FormTextField
+									name="dockerTlsKey"
+									multiline
+									rows={PEM_FIELD_ROWS}
+									fieldLabel={t("pages.createMonitor.form.dockerTls.option.key.label")}
+									placeholder={t(
+										"pages.createMonitor.form.dockerTls.option.key.placeholder"
+									)}
+									helperText={
+										existingMonitor?.dockerTlsKeySet
+											? t("pages.createMonitor.form.dockerTls.option.key.stored")
+											: undefined
+									}
+									autoComplete="off"
+									slotProps={{ input: { sx: { ...pemInputSx, ...maskedInputSx } } }}
+								/>
+								<FormSwitchField
+									name="ignoreTlsErrors"
+									label={t("pages.createMonitor.form.dockerTls.option.ignoreTls.label")}
+								/>
+								<Typography
+									component="span"
+									color={theme.palette.text.secondary}
+									sx={{ opacity: 0.8 }}
+								>
+									{t("pages.createMonitor.form.dockerTls.option.ignoreTls.description")}
+								</Typography>
+							</Stack>
+						}
+					/>
+				)}
+
 				{showStep(1) && (
 					<ConfigBox
 						title={t("pages.createMonitor.form.frequency.title")}
 						subtitle={t("pages.createMonitor.form.frequency.description")}
 						rightContent={
-							<FormSelectField
+							<FormAutocompleteField
 								name="interval"
 								fieldLabel={t(
 									"pages.createMonitor.form.frequency.option.frequency.label"
 								)}
 								options={intervalOptions}
+								filterOptions={(options, { inputValue }) =>
+									filterIntervalOptions(options, inputValue, i18n.resolvedLanguage)
+								}
+								getOptionDisabled={(option) => option.id < MIN_MONITOR_INTERVAL_MS}
+								disableClearable
 							/>
 						}
 					/>
@@ -823,6 +946,19 @@ const CreateMonitorPage = () => {
 					/>
 				)}
 
+				{showStep(1) && watchedType === "docker" && (
+					<ConfigBox
+						title={t("pages.createMonitor.form.dockerLogs.title")}
+						subtitle={t("pages.createMonitor.form.dockerLogs.description")}
+						rightContent={
+							<FormSwitchField
+								name="dockerLogsEnabled"
+								label={t("pages.createMonitor.form.dockerLogs.option.enabled.label")}
+							/>
+						}
+					/>
+				)}
+
 				{showStep(2) &&
 					(watchedType === "http" ||
 						watchedType === "grpc" ||

client/src/Pages/Dashboard/components/DashboardCard.tsx

@@ -0,0 +1,54 @@
+import Box from "@mui/material/Box";
+import Stack from "@mui/material/Stack";
+import Typography from "@mui/material/Typography";
+import { useTheme } from "@mui/material/styles";
+import { LAYOUT } from "@/Utils/Theme/constants";
+import { typographyLevels } from "@/Utils/Theme/Palette";
+
+interface DashboardCardProps {
+	title: string;
+	topRight?: React.ReactNode;
+	children: React.ReactNode;
+}
+
+export const DashboardCard = ({ title, topRight, children }: DashboardCardProps) => {
+	const theme = useTheme();
+
+	return (
+		<Box
+			bgcolor={theme.palette.background.paper}
+			border={1}
+			borderColor={theme.palette.divider}
+			borderRadius={`${theme.shape.borderRadius}px`}
+			padding={theme.spacing(LAYOUT.MD)}
+			display="flex"
+			flexDirection="column"
+			gap={theme.spacing(LAYOUT.SM)}
+			height="100%"
+			boxSizing="border-box"
+		>
+			<Stack
+				direction="row"
+				alignItems="center"
+				justifyContent="space-between"
+			>
+				<Typography
+					fontSize={typographyLevels.m}
+					fontWeight={500}
+					color={theme.palette.text.primary}
+				>
+					{title}
+				</Typography>
+				{topRight && (
+					<Typography
+						fontSize={typographyLevels.s}
+						color={theme.palette.text.secondary}
+					>
+						{topRight}
+					</Typography>
+				)}
+			</Stack>
+			{children}
+		</Box>
+	);
+};

client/src/Pages/Dashboard/components/ProgressBar.tsx

@@ -0,0 +1,28 @@
+import { LAYOUT } from "@/Utils/Theme/constants";
+import Box from "@mui/material/Box";
+import { useTheme } from "@mui/material/styles";
+
+interface ProgressBarProps {
+	fillRatio: number;
+}
+
+export const ProgressBar = ({ fillRatio }: ProgressBarProps) => {
+	const theme = useTheme();
+	const clamped = Math.min(1, Math.max(0, fillRatio));
+
+	return (
+		<Box
+			height={theme.spacing(LAYOUT.XS)}
+			borderRadius={theme.shape.borderRadius}
+			bgcolor={theme.palette.action.disabledBackground}
+			overflow="hidden"
+		>
+			<Box
+				height="100%"
+				width={`${clamped * 100}%`}
+				borderRadius={theme.shape.borderRadius}
+				bgcolor={theme.palette.primary.main}
+			/>
+		</Box>
+	);
+};

client/src/Pages/Dashboard/components/cards/BarRow.tsx

@@ -0,0 +1,42 @@
+import Stack from "@mui/material/Stack";
+import Typography from "@mui/material/Typography";
+import { useTheme } from "@mui/material/styles";
+import { typographyLevels } from "@/Utils/Theme/Palette";
+import { SPACING } from "@/Utils/Theme/constants";
+import { ProgressBar } from "@/Pages/Dashboard/components/ProgressBar";
+
+interface BarRowProps {
+	label: string;
+	value: string;
+	fillRatio: number;
+	valueColor?: string;
+}
+
+export const BarRow = ({ label, value, fillRatio, valueColor }: BarRowProps) => {
+	const theme = useTheme();
+
+	return (
+		<Stack gap={theme.spacing(SPACING.LG)}>
+			<Stack
+				direction="row"
+				justifyContent="space-between"
+				alignItems="center"
+			>
+				<Typography
+					fontSize={typographyLevels.m}
+					color={theme.palette.text.primary}
+				>
+					{label}
+				</Typography>
+				<Typography
+					fontSize={typographyLevels.m}
+					color={valueColor ?? theme.palette.primary.main}
+					fontWeight={500}
+				>
+					{value}
+				</Typography>
+			</Stack>
+			<ProgressBar fillRatio={fillRatio} />
+		</Stack>
+	);
+};

client/src/Pages/Dashboard/components/cards/MonitorStatusCard.tsx

@@ -0,0 +1,49 @@
+import Stack from "@mui/material/Stack";
+import Typography from "@mui/material/Typography";
+import { useTheme } from "@mui/material/styles";
+import { DashboardCard } from "@/Pages/Dashboard/components/DashboardCard";
+import { ProgressBar } from "@/Pages/Dashboard/components/ProgressBar";
+import { typographyLevels } from "@/Utils/Theme/Palette";
+import { SPACING } from "@/Utils/Theme/constants";
+import { useTranslation } from "react-i18next";
+import type { MonitorsSummary } from "@/Types/Monitor";
+
+interface MonitorStatusCardProps {
+	summary: MonitorsSummary;
+}
+
+export const MonitorStatusCard = ({ summary }: MonitorStatusCardProps) => {
+	const theme = useTheme();
+	const { t } = useTranslation();
+
+	const up = summary.upMonitors;
+	const total = summary.totalMonitors;
+	const ratio = total > 0 ? up / total : 0;
+
+	return (
+		<DashboardCard title={t("pages.dashboard.cards.monitorStatus")}>
+			<Stack gap={theme.spacing(SPACING.SM)}>
+				<Stack
+					direction="row"
+					alignItems="baseline"
+					gap={theme.spacing(SPACING.XS)}
+				>
+					<Typography
+						fontSize={typographyLevels.xxl}
+						fontWeight={500}
+						color={theme.palette.text.primary}
+					>
+						{up}
+					</Typography>
+					<Typography
+						fontSize={typographyLevels.m}
+						color={theme.palette.text.secondary}
+					>
+						{t("pages.dashboard.monitorStatus.ofUp", { total })}
+					</Typography>
+				</Stack>
+				<ProgressBar fillRatio={ratio} />
+			</Stack>
+		</DashboardCard>
+	);
+};

client/src/Pages/Dashboard/components/cards/MonitorsByTypeCard.tsx

@@ -0,0 +1,35 @@
+import Stack from "@mui/material/Stack";
+import { DashboardCard } from "@/Pages/Dashboard/components/DashboardCard";
+import { BarRow } from "@/Pages/Dashboard/components/cards/BarRow";
+import { useTranslation } from "react-i18next";
+import { useTheme } from "@mui/material/styles";
+import type { DashboardTypeCount } from "@/Pages/Dashboard/types";
+import { getMonitorTypeLabel } from "@/Types/Monitor";
+import { LAYOUT } from "@/Utils/Theme/constants";
+
+interface MonitorsByTypeCardProps {
+	monitorsByType: DashboardTypeCount[];
+}
+
+export const MonitorsByTypeCard = ({ monitorsByType }: MonitorsByTypeCardProps) => {
+	const { t } = useTranslation();
+	const theme = useTheme();
+
+	const maxCount = monitorsByType[0]?.count ?? 1;
+
+	return (
+		<DashboardCard title={t("pages.dashboard.cards.monitorsByType")}>
+			<Stack gap={theme.spacing(LAYOUT.SM)}>
+				{monitorsByType.map(({ type, count }) => (
+					<BarRow
+						key={type}
+						label={getMonitorTypeLabel(type, t)}
+						value={String(count)}
+						fillRatio={count / maxCount}
+						valueColor={theme.palette.text.primary}
+					/>
+				))}
+			</Stack>
+		</DashboardCard>
+	);
+};

client/src/Pages/Dashboard/index.tsx

@@ -0,0 +1,45 @@
+import Box from "@mui/material/Box";
+import { useTheme } from "@mui/material/styles";
+
+import { BasePage } from "@/Components/design-elements/BasePage";
+import { LAYOUT } from "@/Utils/Theme/constants";
+
+import { MonitorStatusCard } from "@/Pages/Dashboard/components/cards/MonitorStatusCard";
+import { MonitorsByTypeCard } from "@/Pages/Dashboard/components/cards/MonitorsByTypeCard";
+import type { MonitorsSummary } from "@/Types/Monitor";
+import type { DashboardTypeCount } from "@/Pages/Dashboard/types";
+
+const MOCK_SUMMARY: MonitorsSummary = {
+	totalMonitors: 12,
+	upMonitors: 10,
+	downMonitors: 1,
+	pausedMonitors: 1,
+	initializingMonitors: 0,
+	maintenanceMonitors: 0,
+	breachedMonitors: 0,
+};
+
+const MOCK_MONITORS_BY_TYPE: DashboardTypeCount[] = [
+	{ type: "http", count: 7 },
+	{ type: "ping", count: 3 },
+	{ type: "port", count: 2 },
+];
+
+const Dashboard = () => {
+	const theme = useTheme();
+
+	return (
+		<BasePage headerKey="dashboard">
+			<Box
+				display="grid"
+				gridTemplateColumns={{ xs: "1fr", md: "1fr 1fr" }}
+				gap={theme.spacing(LAYOUT.MD)}
+			>
+				<MonitorStatusCard summary={MOCK_SUMMARY} />
+				<MonitorsByTypeCard monitorsByType={MOCK_MONITORS_BY_TYPE} />
+			</Box>
+		</BasePage>
+	);
+};
+
+export default Dashboard;

client/src/Pages/Dashboard/types.ts

@@ -0,0 +1,6 @@
+import type { MonitorType } from "@/Types/Monitor";
+
+export interface DashboardTypeCount {
+	type: MonitorType;
+	count: number;
+}

client/src/Pages/Docker/ContainerDetails/Components/HeaderLogs.tsx

@@ -0,0 +1,69 @@
+import Stack from "@mui/material/Stack";
+import Typography from "@mui/material/Typography";
+import { Dot } from "@/Components/design-elements";
+
+// Hooks
+import { useEffect, useState } from "react";
+import { useTheme } from "@mui/material";
+import { useTranslation } from "react-i18next";
+
+// Utils
+import { LAYOUT, SPACING } from "@/Utils/Theme/constants";
+import { MS_PER_SECOND, MS_PER_MINUTE } from "@/Utils/TimeUtils";
+
+interface HeaderLogsProps {
+	lines: number;
+	loading: boolean;
+	lastUpdatedAt: number | null;
+}
+
+export const HeaderLogs = ({ lines, loading, lastUpdatedAt }: HeaderLogsProps) => {
+	const theme = useTheme();
+	const { t } = useTranslation();
+	const [now, setNow] = useState(() => Date.now());
+
+	useEffect(() => {
+		if (lastUpdatedAt === null) return;
+		setNow(Date.now());
+		const id = window.setInterval(() => setNow(Date.now()), MS_PER_SECOND);
+		return () => window.clearInterval(id);
+	}, [lastUpdatedAt]);
+
+	const renderStatus = () => {
+		if (loading) return t("pages.docker.container.logs.loading");
+		if (lastUpdatedAt === null) return null;
+		const ageMs = Math.max(0, now - lastUpdatedAt);
+		return ageMs < MS_PER_MINUTE
+			? t("pages.docker.container.logs.updatedSecondsAgo", {
+					count: Math.floor(ageMs / MS_PER_SECOND),
+				})
+			: t("pages.docker.container.logs.updatedMinutesAgo", {
+					count: Math.floor(ageMs / MS_PER_MINUTE),
+				});
+	};
+
+	return (
+		<Stack
+			direction="row"
+			alignItems="center"
+			gap={LAYOUT.MD}
+		>
+			<Typography>
+				{t("pages.docker.container.logs.recentLines", { count: lines })}
+			</Typography>
+			<Stack
+				direction="row"
+				alignItems="center"
+				gap={SPACING.SM}
+			>
+				{lastUpdatedAt !== null && !loading && (
+					<Dot
+						color={theme.palette.success.main}
+						size="md"
+					/>
+				)}
+				<Typography color={theme.palette.text.secondary}>{renderStatus()}</Typography>
+			</Stack>
+		</Stack>
+	);
+};

client/src/Pages/Docker/ContainerDetails/Components/RowLog.tsx

@@ -0,0 +1,78 @@
+import Grid from "@mui/material/Grid";
+import Typography from "@mui/material/Typography";
+import Box from "@mui/material/Box";
+import Stack from "@mui/material/Stack";
+import Divider from "@mui/material/Divider";
+import { Fragment } from "react";
+
+// Hooks
+import { useTheme } from "@mui/material";
+import { useSelector } from "react-redux";
+import { useTranslation } from "react-i18next";
+
+// Utils
+import type { DockerLogRow } from "@/Utils/MonitorUtils";
+import { LAYOUT, SPACING } from "@/Utils/Theme/constants";
+import { formatDateWithTz } from "@/Utils/TimeUtils";
+import type { RootState } from "@/store";
+
+export const RowLog = ({ row }: { row: DockerLogRow }) => {
+	const theme = useTheme();
+	const uiTimezone = useSelector((state: RootState) => state.ui.timezone);
+	const { t } = useTranslation();
+
+	return (
+		<Fragment>
+			<Grid
+				container
+				spacing={{ xs: 0, md: LAYOUT.MD }}
+				py={{ xs: LAYOUT.LG, md: 0 }}
+			>
+				<Grid size={{ xs: 12, md: "auto" }}>
+					<Typography
+						fontFamily="monospace"
+						color={theme.palette.text.secondary}
+					>
+						{formatDateWithTz(row.ts, "MMM D HH:mm:ss", uiTimezone)}
+					</Typography>
+				</Grid>
+				<Grid size={{ xs: 12, md: "grow" }}>
+					<Typography
+						fontFamily={"monospace"}
+						whiteSpace={{ xs: "pre-wrap", md: "nowrap" }}
+						sx={{
+							overflowWrap: { xs: "anywhere", md: "normal" },
+						}}
+					>
+						<Box
+							component={"span"}
+							color={
+								row.stream === "stderr"
+									? theme.palette.error.main
+									: theme.palette.success.main
+							}
+						>
+							{row.stream}
+						</Box>
+						: {row.text}
+					</Typography>
+				</Grid>
+			</Grid>
+			{row.gapBefore ? (
+				<Stack
+					width="100%"
+					direction="row"
+					alignItems={"center"}
+					py={SPACING.MD}
+				>
+					<Typography pr={SPACING.MD}>
+						{t("pages.docker.container.logs.skipped")}
+					</Typography>
+					<Divider sx={{ flex: 1 }} />
+				</Stack>
+			) : (
+				<Divider sx={{ display: { xs: "block", md: "none" } }} />
+			)}
+		</Fragment>
+	);
+};

client/src/Pages/Docker/ContainerDetails/Components/StatBoxes.tsx

@@ -10,6 +10,7 @@ import type { DockerContainerInfo } from "@/Types/Check";
 
 // Utils
 import { formatDuration } from "@/Utils/TimeUtils";
+import { getDockerPalette } from "@/Utils/MonitorUtils";
 
 export const DockerContainerStatusBoxes = ({
 	container,
@@ -24,6 +25,7 @@ export const DockerContainerStatusBoxes = ({
 	const { state, restartCount, health } = container;
 	const startedAt = container.startedAt ?? "0";
 	const runningFor = Date.now() - new Date(startedAt).getTime();
+	const palette = getDockerPalette(state);
 	return (
 		<Stack
 			direction="row"
@@ -33,6 +35,7 @@ export const DockerContainerStatusBoxes = ({
 			<StatBox
 				title={t("common.labels.state")}
 				subtitle={state}
+				palette={palette}
 			/>
 			<StatBox
 				title={t("common.labels.uptime")}

client/src/Pages/Docker/ContainerDetails/TabLogs.tsx

@@ -1,3 +1,252 @@
-export const TabLogs = () => {
-	return "This is the logs tab";
+// Components
+import Stack from "@mui/material/Stack";
+import Typography from "@mui/material/Typography";
+import { BaseBox, EmptyState } from "@/Components/design-elements";
+import { Button } from "@/Components/inputs";
+import { HeaderLogs } from "@/Pages/Docker/ContainerDetails/Components/HeaderLogs";
+import { RowLog } from "@/Pages/Docker/ContainerDetails/Components/RowLog";
+
+// Types
+import type { DockerContainerLogsResponse } from "@/Types/Monitor";
+import type { DockerLog } from "@/Types/Check";
+import type { ApiResponse } from "@/Hooks/UseApi";
+
+// Hooks
+import {
+	useState,
+	useEffect,
+	useLayoutEffect,
+	useMemo,
+	useRef,
+	useCallback,
+} from "react";
+import { useTheme } from "@mui/material";
+import { useTranslation } from "react-i18next";
+import { useToast } from "@/Hooks/UseToast";
+import { useIsAdmin } from "@/Hooks/useIsAdmin";
+
+// Utils
+import { get } from "@/Utils/ApiClient";
+import { LAYOUT } from "@/Utils/Theme/constants";
+import { flattenDockerLogs } from "@/Utils/MonitorUtils";
+
+interface TabLogsProps {
+	monitorId?: string;
+	containerName?: string;
+	enabled: boolean;
+}
+
+const SCROLL_PIN_THRESHOLD_PX = 8;
+const TAIL_POLL_MS = 10_000;
+
+const isScrolledToBottom = (el: HTMLElement) =>
+	el.scrollHeight - el.scrollTop - el.clientHeight <= SCROLL_PIN_THRESHOLD_PX;
+
+const fetchLogs = async (url: string, params: { before?: string; after?: string }) => {
+	const res = await get<ApiResponse<DockerContainerLogsResponse>>(url, { params });
+	return res.data.data;
+};
+
+export const TabLogs = ({ monitorId, containerName, enabled }: TabLogsProps) => {
+	const theme = useTheme();
+	const { t } = useTranslation();
+	const { toastError } = useToast();
+	const isAdmin = useIsAdmin();
+
+	// logs is newest-first, matching the API and what flattenDockerLogs expects.
+	const [logs, setLogs] = useState<DockerLog[]>([]);
+	const [olderExhausted, setOlderExhausted] = useState(false);
+	const [loadingInitial, setLoadingInitial] = useState(false);
+	const [loadingOlder, setLoadingOlder] = useState(false);
+	const [lastUpdatedAt, setLastUpdatedAt] = useState<number | null>(null);
+
+	const logsUrl =
+		isAdmin && enabled && monitorId && containerName
+			? `/monitors/docker/details/${encodeURIComponent(monitorId)}/containers/${encodeURIComponent(containerName)}/logs`
+			: null;
+
+	const newestCursor = logs[0]?.checkedAt;
+	const oldestCursor = logs[logs.length - 1]?.checkedAt;
+
+	// Initial page. Resets everything when the container changes.
+	useEffect(() => {
+		setLogs([]);
+		setOlderExhausted(false);
+		if (!logsUrl) return;
+		let cancelled = false;
+		setLoadingInitial(true);
+		fetchLogs(logsUrl, {})
+			.then((page) => {
+				if (cancelled) return;
+				setLogs(page.logs);
+				setOlderExhausted(page.nextCursor === null);
+				setLastUpdatedAt(Date.now());
+			})
+			.catch(() => {
+				if (cancelled) return;
+				toastError(t("pages.docker.container.logs.loadError"));
+			})
+			.finally(() => {
+				if (!cancelled) setLoadingInitial(false);
+			});
+		return () => {
+			cancelled = true;
+		};
+	}, [logsUrl, t, toastError]);
+
+	const newestCursorRef = useRef(newestCursor);
+	newestCursorRef.current = newestCursor;
+
+	useEffect(() => {
+		if (!logsUrl) return;
+		let inFlight = false;
+		const tick = async () => {
+			if (inFlight || document.hidden) return;
+			inFlight = true;
+			try {
+				const cursor = newestCursorRef.current;
+				const page = await fetchLogs(logsUrl, cursor ? { after: cursor } : {});
+				if (page.logs.length > 0) setLogs((prev) => [...page.logs, ...prev]);
+				setLastUpdatedAt(Date.now());
+			} catch (err: unknown) {
+				console.error(err);
+			} finally {
+				inFlight = false;
+			}
+		};
+		const id = window.setInterval(tick, TAIL_POLL_MS);
+		document.addEventListener("visibilitychange", tick);
+		return () => {
+			window.clearInterval(id);
+			document.removeEventListener("visibilitychange", tick);
+		};
+	}, [logsUrl]);
+
+	const rows = useMemo(() => flattenDockerLogs(logs), [logs]);
+
+	const logBoxRef = useRef<HTMLDivElement>(null);
+	const pinnedToBottom = useRef(true);
+	const prependAnchor = useRef<{ scrollHeight: number; scrollTop: number } | null>(null);
+
+	// Always pin to bottom when container/monitor changes
+	useLayoutEffect(() => {
+		pinnedToBottom.current = true;
+	}, [monitorId, containerName]);
+
+	// Rows changed: restore position after a prepend, otherwise honour the pin
+	useLayoutEffect(() => {
+		const el = logBoxRef.current;
+		if (!el) return;
+		const anchor = prependAnchor.current;
+		if (anchor) {
+			prependAnchor.current = null;
+			el.scrollTop = el.scrollHeight - anchor.scrollHeight + anchor.scrollTop;
+			return;
+		}
+		if (pinnedToBottom.current) el.scrollTop = el.scrollHeight;
+	}, [rows]);
+
+	const handleScroll = useCallback((event: React.UIEvent<HTMLDivElement>) => {
+		pinnedToBottom.current = isScrolledToBottom(event.currentTarget);
+	}, []);
+
+	const loadOlder = useCallback(async () => {
+		if (!logsUrl || !oldestCursor || loadingOlder) return;
+		setLoadingOlder(true);
+		try {
+			const page = await fetchLogs(logsUrl, { before: oldestCursor });
+			const el = logBoxRef.current;
+			if (el)
+				prependAnchor.current = {
+					scrollHeight: el.scrollHeight,
+					scrollTop: el.scrollTop,
+				};
+			setLogs((prev) => [...prev, ...page.logs]);
+			setOlderExhausted(page.nextCursor === null);
+		} catch {
+			toastError(t("pages.docker.container.logs.loadOlderError"));
+		} finally {
+			setLoadingOlder(false);
+		}
+	}, [logsUrl, oldestCursor, loadingOlder, t, toastError]);
+
+	if (!isAdmin) {
+		return (
+			<EmptyState
+				title={t("pages.docker.container.logs.forbidden.title")}
+				description={t("pages.docker.container.logs.forbidden.description")}
+			/>
+		);
+	}
+
+	if (!enabled) {
+		return (
+			<EmptyState
+				title={t("pages.docker.container.logs.disabled.title")}
+				description={t("pages.docker.container.logs.disabled.description")}
+				actionText={t("pages.docker.container.logs.disabled.action")}
+				actionTo={`/docker/configure/${monitorId}`}
+			/>
+		);
+	}
+
+	if (lastUpdatedAt !== null && rows.length === 0) {
+		return (
+			<EmptyState
+				title={t("pages.docker.container.logs.empty.title")}
+				description={t("pages.docker.container.logs.empty.description")}
+			/>
+		);
+	}
+
+	return (
+		<Stack gap={LAYOUT.MD}>
+			<HeaderLogs
+				lines={rows.length}
+				loading={loadingInitial}
+				lastUpdatedAt={lastUpdatedAt}
+			/>
+			<BaseBox
+				ref={logBoxRef}
+				onScroll={handleScroll}
+				minHeight={240}
+				maxHeight="50vh"
+				overflow="auto"
+				padding={LAYOUT.MD}
+				sx={{ overflowAnchor: "none" }}
+			>
+				{rows.length > 0 && (
+					<Stack
+						direction="row"
+						justifyContent="center"
+						pb={LAYOUT.MD}
+					>
+						{olderExhausted ? (
+							<Typography color={theme.palette.text.secondary}>
+								{t("pages.docker.container.logs.noOlder")}
+							</Typography>
+						) : (
+							<Button
+								variant="contained"
+								disabled={loadingOlder}
+								onClick={loadOlder}
+							>
+								{loadingOlder
+									? t("pages.docker.container.logs.loadingOlder")
+									: t("pages.docker.container.logs.loadOlder")}
+							</Button>
+						)}
+					</Stack>
+				)}
+				{rows.map((row) => {
+					return (
+						<RowLog
+							key={row.key}
+							row={row}
+						/>
+					);
+				})}
+			</BaseBox>
+		</Stack>
+	);
 };

client/src/Pages/Docker/ContainerDetails/TabOverview.tsx

@@ -17,6 +17,7 @@ import { formatPercentage } from "@/Utils/FormatUtils";
 import prettyBytes from "pretty-bytes";
 import { BaseBox } from "@/Components/design-elements";
 import { dedupeDockerPorts, getDockerMountLabel } from "@/Utils/MonitorUtils";
+import type { DateRange } from "@/Types/Query";
 
 const getChartConfigs = (theme: Theme, t: TFunction, stats: DockerContainerStats) => [
 	{
@@ -24,20 +25,29 @@ const getChartConfigs = (theme: Theme, t: TFunction, stats: DockerContainerStats
 		key: "avgCpuPct",
 		color: theme.palette.success.main,
 		rightTitle: formatPercentage(stats?.latest?.container.cpuPct || 0),
+		formatter: formatPercentage,
+		labelKey: "common.charts.histogram.avgCpuUsage",
 	},
 	{
 		title: t("common.charts.labels.memoryUsage"),
 		key: "avgMemoryUsedBytes",
 		color: theme.palette.primary.main,
 		rightTitle: prettyBytes(stats?.latest?.container.memoryUsedBytes || 0),
+		formatter: prettyBytes,
+		labelKey: "common.charts.histogram.avgMemoryUsage",
 	},
 ];
 
-export const TabOverview = ({ stats }: { stats: DockerContainerStats }) => {
+export const TabOverview = ({
+	stats,
+	range,
+}: {
+	stats: DockerContainerStats;
+	range: DateRange;
+}) => {
 	const theme = useTheme();
 	const { t } = useTranslation();
 	const isSmall = useMediaQuery(theme.breakpoints.down("md"));
-
 	const { ports, mounts } = stats?.latest?.container ?? {};
 	const dedupedPorts = dedupeDockerPorts(ports ?? []);
 	return (
@@ -58,6 +68,9 @@ export const TabOverview = ({ stats }: { stats: DockerContainerStats }) => {
 							dataKey={config.key}
 							strokeColor={config.color}
 							gradientStartColor={config.color}
+							range={range}
+							formatter={config.formatter}
+							labelKey={config.labelKey}
 						/>
 					</Grid>
 				);

client/src/Pages/Docker/ContainerDetails/index.tsx

@@ -69,8 +69,19 @@ const DockerDetailsPage = ({ open = "overview" }: DockerContainerDetailsProps) =
 				<Tab label={t("pages.docker.container.tabs.overview")} />
 				<Tab label={t("pages.docker.container.tabs.logs")} />
 			</Tabs>
-			{activeTab === 0 && <TabOverview stats={stats} />}
-			{activeTab === 1 && <TabLogs />}
+			{activeTab === 0 && (
+				<TabOverview
+					stats={stats}
+					range={dateRange}
+				/>
+			)}
+			{activeTab === 1 && (
+				<TabLogs
+					monitorId={monitorId}
+					containerName={containerName}
+					enabled={monitor.dockerLogsEnabled ?? false}
+				/>
+			)}
 		</BasePage>
 	);
 };

client/src/Pages/Incidents/Components/CardSummary.tsx

@@ -30,9 +30,6 @@ const SummaryItem = ({ icon, label, value }: SummaryItemProps) => {
 				direction="row"
 				alignItems="center"
 				gap={theme.spacing(2)}
-				// The icons are supporting marks beside the label, not content,
-				// so they take secondary ink rather than lucide's currentColor
-				// default, which renders them heavier than the text.
 				sx={{ "& svg": { color: theme.palette.text.secondary } }}
 			>
 				{icon}

client/src/Pages/Logs/index.tsx

@@ -8,7 +8,7 @@ import { useTranslation } from "react-i18next";
 
 const LogsPage = () => {
 	const { t } = useTranslation();
-	const [activeTab, setActiveTab] = useState<number>(1);
+	const [activeTab, setActiveTab] = useState<number>(0);
 	return (
 		<BasePage headerKey="logs">
 			<Tabs

client/src/Pages/NotFound/index.tsx

@@ -1,4 +1,4 @@
-import NotFoundSvg from "@/assets/Images/sushi_404.svg";
+import NotFoundSvg from "@/assets/Images/sushi_404.svg?react";
 import { Button } from "@/Components/inputs";
 import Box from "@mui/material/Box";
 import Stack from "@mui/material/Stack";
@@ -36,10 +36,11 @@ const NotFoundPage = ({ title, desc }: NotFoundProps) => {
 				alignItems="center"
 			>
 				<Box
-					component="img"
-					src={NotFoundSvg}
-					alt="404"
-					maxHeight={"25rem"}
+					component={NotFoundSvg}
+					role="img"
+					aria-label="404"
+					width="100%"
+					maxHeight="25rem"
 				/>
 				<Typography
 					component="h1"

client/src/Pages/Notifications/create/index.tsx

@@ -126,6 +126,7 @@ const NotificationsCreatePage = () => {
 				{watchedType !== "matrix" &&
 					watchedType !== "telegram" &&
 					watchedType !== "pushover" &&
+					watchedType !== "signalgrid" &&
 					watchedType !== "twilio" &&
 					watchedType !== "ntfy" && (
 						<ConfigBox
@@ -201,6 +202,31 @@ const NotificationsCreatePage = () => {
 						}
 					/>
 				)}
+				{watchedType === "signalgrid" && (
+					<ConfigBox
+						title={t("pages.notifications.form.signalgrid.title")}
+						subtitle={t("pages.notifications.form.signalgrid.description")}
+						rightContent={
+							<Stack spacing={theme.spacing(8)}>
+								<FormTextField
+									name="accessToken"
+									fieldLabel={t("pages.notifications.form.signalgrid.optionClientKey")}
+									placeholder={t(
+										"pages.notifications.form.signalgrid.placeholderClientKey"
+									)}
+								/>
+
+								<FormTextField
+									name="address"
+									fieldLabel={t("pages.notifications.form.signalgrid.optionChannel")}
+									placeholder={t(
+										"pages.notifications.form.signalgrid.placeholderChannel"
+									)}
+								/>
+							</Stack>
+						}
+					/>
+				)}
 				{watchedType === "twilio" && (
 					<ConfigBox
 						title={t("pages.notifications.form.twilio.title")}

client/src/Pages/StatusPage/Status/themes/shared/fontStacks.ts

@@ -1,6 +1,3 @@
-// No "Inter" here: its webfont was never self-hosted, so once the Google Fonts
-// import went it resolved to a fallback anyway. Listing it only made the stack
-// look intentional on machines that happen to have Inter installed.
 export const SANS_STACK =
 	'-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif';
 

client/src/Pages/Uptime/Monitors/index.tsx

@@ -4,7 +4,7 @@ import { MonitorTable } from "@/Pages/Uptime/Monitors/Components/UptimeMonitorsT
 import { useMonitorListController } from "@/Hooks/useMonitorListController";
 
 const UptimeMonitorsPage = () => {
-	const c = useMonitorListController({
+	const monitorListController = useMonitorListController({
 		types: "selectable",
 		checksLimit: 25,
 		refreshInterval: 5000,
@@ -17,25 +17,25 @@ const UptimeMonitorsPage = () => {
 			headerKey="uptime"
 			page="uptime"
 			actionLink="/uptime/create"
-			controller={c}
+			controller={monitorListController}
 			bulkActions
 		>
 			<MonitorTable
-				monitors={c.monitors || []}
-				tags={c.tags || []}
-				refetch={c.refetch}
-				setSelectedMonitor={c.setSelectedMonitor}
-				count={c.count || 0}
-				page={c.page}
-				setPage={c.setPage}
-				rowsPerPage={c.rowsPerPage}
-				sortField={c.sortField}
-				setSortField={c.setSortField}
-				sortOrder={c.sortOrder}
-				setSortOrder={c.setSortOrder}
-				setRowsPerPage={c.handleSetRowsPerPage}
-				selectedRows={c.selectedRows}
-				onSelectionChange={c.setSelectedRows}
+				monitors={monitorListController.monitors || []}
+				tags={monitorListController.tags || []}
+				refetch={monitorListController.refetch}
+				setSelectedMonitor={monitorListController.setSelectedMonitor}
+				count={monitorListController.count || 0}
+				page={monitorListController.page}
+				setPage={monitorListController.setPage}
+				rowsPerPage={monitorListController.rowsPerPage}
+				sortField={monitorListController.sortField}
+				setSortField={monitorListController.setSortField}
+				sortOrder={monitorListController.sortOrder}
+				setSortOrder={monitorListController.setSortOrder}
+				setRowsPerPage={monitorListController.handleSetRowsPerPage}
+				selectedRows={monitorListController.selectedRows}
+				onSelectionChange={monitorListController.setSelectedRows}
 			/>
 		</MonitorListPage>
 	);

client/src/Routes/index.tsx

@@ -8,6 +8,9 @@ import AuthRegister from "@/Pages/Auth/Register";
 import AuthForgotPassword from "@/Pages/Auth/Recovery";
 import AuthSetNewPassword from "@/Pages/Auth/SetNewPassword";
 
+// Dashboard
+import Dashboard from "@/Pages/Dashboard";
+
 // Uptime
 import Uptime from "@/Pages/Uptime/Monitors";
 import UptimeDetails from "@/Pages/Uptime/Details";
@@ -92,6 +95,10 @@ const Routes = () => {
 					path="/"
 					element={<Navigate to="/uptime" />}
 				/>
+				<Route
+					path="dashboard"
+					element={<Dashboard />}
+				/>
 				<Route
 					path="/uptime"
 					element={<Uptime />}

client/src/Types/Check.ts

@@ -161,6 +161,31 @@ export interface DockerContainerMount {
 	rw: boolean;
 }
 
+export const DockerLogStreams = ["stdout", "stderr"] as const;
+export type DockerLogStream = (typeof DockerLogStreams)[number];
+
+export interface DockerLogLine {
+	ts: string;
+	stream: DockerLogStream;
+	text: string;
+}
+
+export interface DockerLog {
+	id: string;
+	metadata: {
+		monitorId: string;
+		teamId: string;
+		containerId: string;
+		containerName: string;
+	};
+	lines: DockerLogLine[];
+	gap: boolean;
+	checkedAt: string;
+	expiry: string;
+	createdAt: string;
+	updatedAt: string;
+}
+
 export interface DockerContainerInfo {
 	id: string;
 	name: string;

client/src/Types/Monitor.ts

@@ -5,6 +5,7 @@ import type {
 	DailyCheckBucket,
 	DockerContainerInfo,
 	DockerContainerSummary,
+	DockerLog,
 } from "@/Types/Check";
 import type { PageSpeedGroupedCheck } from "@/Types/Check";
 import type { GeoContinent } from "@/Types/GeoCheck";
@@ -59,6 +60,15 @@ export const monitorTypeLabelKey: Record<SelectableMonitorType, string> &
 	pagespeed: "optionPagespeed",
 };
 
+export const getMonitorTypeLabel = (
+	type: MonitorType,
+	t: (key: string) => string
+): string => {
+	const monitorLabel = monitorTypeLabelKey[type];
+	return monitorLabel ? t(`pages.common.monitors.monitorTypes.${monitorLabel}`) : type;
+};
+export const MIN_MONITOR_INTERVAL_MS = 10000;
+
 export const MonitorIntervalOptions = [
 	{ value: 15000, labelKey: "fifteenSeconds" },
 	{ value: 30000, labelKey: "thirtySeconds" },
@@ -158,6 +168,10 @@ export interface Monitor {
 	geoCheckEnabled?: boolean;
 	geoCheckLocations?: GeoContinent[];
 	geoCheckInterval?: number;
+	dockerLogsEnabled?: boolean;
+	dockerTlsCa?: string;
+	dockerTlsCert?: string;
+	dockerTlsKeySet?: boolean;
 	dnsServer?: string;
 	dnsRecordType?: DnsRecordType;
 	recentChecks: CheckSnapshot[];
@@ -322,6 +336,10 @@ export interface DockerContainerResponse {
 	stats: DockerContainerStats;
 }
 
+export interface DockerContainerLogsResponse {
+	logs: DockerLog[];
+	nextCursor: string | null;
+}
 export interface Game {
 	name: string;
 	options?: {

client/src/Types/Notification.ts

@@ -9,6 +9,7 @@ export const NotificationChannels = [
 	"teams",
 	"telegram",
 	"pushover",
+	"signalgrid",
 	"twilio",
 	"ntfy",
 ] as const;

client/src/Utils/MonitorUtils.ts

@@ -1,10 +1,13 @@
 import type { MonitorStatus, MonitorType } from "@/Types/Monitor";
 import type { PaletteKey } from "@/Utils/Theme/Theme";
 import type { ValueType } from "@/Components/design-elements/StatusLabel";
-import type {
-	DockerContainerMount,
-	DockerContainerPort,
-	DockerContainerState,
+import {
+	DockerLogStreams,
+	type DockerContainerMount,
+	type DockerContainerPort,
+	type DockerContainerState,
+	type DockerLog,
+	type DockerLogLine,
 } from "@/Types/Check";
 
 export const getMonitorPath = (type: MonitorType): string => {
@@ -37,6 +40,14 @@ export const getStatusPalette = (status: MonitorStatus): PaletteKey => {
 	return "warning";
 };
 
+export const getDockerPalette = (dockerState: DockerContainerState): PaletteKey => {
+	if (dockerState === "created") return "success";
+	if (dockerState === "running") return "success";
+	if (dockerState === "dead") return "error";
+	if (dockerState === "exited") return "error";
+	return "warning";
+};
+
 export const getValuePalette = (value: ValueType): PaletteKey => {
 	const paletteMap: Record<ValueType, PaletteKey> = {
 		positive: "success",
@@ -144,3 +155,35 @@ export const getDockerMountLabel = (mount: DockerContainerMount) => {
 	if (mount.source) return mount.source;
 	return mount.type;
 };
+
+export const DockerLogStreamFilters = ["all", ...DockerLogStreams] as const;
+export type DockerLogStreamFilter = (typeof DockerLogStreamFilters)[number];
+
+export interface DockerLogRow extends DockerLogLine {
+	key: string;
+	gapBefore: boolean; // This signifies lines skipped
+}
+
+export const flattenDockerLogs = (logs: DockerLog[]): DockerLogRow[] => {
+	const rows: DockerLogRow[] = [];
+	for (const log of [...logs].reverse()) {
+		log.lines.forEach((line: DockerLogLine, idx: number) => {
+			rows.push({ ...line, key: `${log.id}:${idx}`, gapBefore: idx === 0 && log.gap });
+		});
+	}
+	return rows;
+};
+
+export const filterDockerLogRows = (
+	rows: DockerLogRow[],
+	stream: DockerLogStreamFilter,
+	query: string
+): DockerLogRow[] => {
+	const normalizedQuery = query.trim().toLowerCase();
+	return rows.filter((row) => {
+		return (
+			(stream === "all" || row.stream === stream) &&
+			(normalizedQuery === "" || row.text.toLowerCase().includes(normalizedQuery))
+		);
+	});
+};

client/src/Utils/Theme/Theme.ts

@@ -192,7 +192,6 @@ export const theme = (mode: string, palette: any) =>
 					}),
 				},
 			},
-
 			MuiOutlinedInput: {
 				styleOverrides: {
 					input: {

client/src/Utils/Theme/constants.ts

@@ -18,19 +18,7 @@ export const LAYOUT = {
 	XXL: 16,
 } as const;
 
-/**
- * Shared height for anything that can sit in a row with something else -
- * buttons, inputs, selects, pickers, toggles, tabs, icon buttons. One number so
- * they share a baseline instead of drifting 2px apart.
- */
-export const CONTROL_HEIGHT = 32;
-
-/**
- * Width of a square-ish icon-only control that sits in a header strip - wider
- * than CONTROL_HEIGHT so the icon has breathing room either side of the
- * dividers between them.
- */
-export const ICON_CONTROL_WIDTH = 36;
+export const INPUT_BASE_HEIGHT = 32; // Height for inputs/controls
 
 export const HOVER = {
 	DARKEN: 0.06, // This is a coefficient for darkening function

client/src/Utils/TimeUtils.ts

@@ -104,9 +104,52 @@ export const formatMs = (ms: number, hasSpace: boolean = true): string => {
 	return formatted;
 };
 
-export const formatDuration = (ms: number, verbose: boolean = false, hasSpace = true) => {
-	if (verbose) {
-		return prettyMilliseconds(ms, { verbose: true });
+type DurationUnit = "day" | "hour" | "minute" | "second";
+
+interface FormatDurationOptions {
+	long?: boolean;
+	relative?: boolean;
+	hasSpace?: boolean;
+	locale?: string;
+}
+
+const DURATION_UNITS: Array<{ unit: DurationUnit; milliseconds: number }> = [
+	{ unit: "day", milliseconds: MS_PER_DAY },
+	{ unit: "hour", milliseconds: MS_PER_HOUR },
+	{ unit: "minute", milliseconds: MS_PER_MINUTE },
+	{ unit: "second", milliseconds: MS_PER_SECOND },
+];
+
+const FALLBACK_DURATION_UNIT = DURATION_UNITS[DURATION_UNITS.length - 1];
+
+const getDurationUnit = (ms: number) =>
+	DURATION_UNITS.find(({ milliseconds }) => Math.abs(ms) >= milliseconds) ??
+	FALLBACK_DURATION_UNIT;
+
+const getExactDurationUnit = (ms: number) =>
+	DURATION_UNITS.find(({ milliseconds }) => ms !== 0 && ms % milliseconds === 0) ??
+	FALLBACK_DURATION_UNIT;
+
+export const formatDuration = (
+	ms: number,
+	{ long = false, relative = false, hasSpace = true, locale }: FormatDurationOptions = {}
+): string => {
+	if (relative) {
+		const { unit, milliseconds } = getDurationUnit(ms);
+		const value = Math.sign(ms) * Math.floor(Math.abs(ms) / milliseconds);
+		return new Intl.RelativeTimeFormat(locale, {
+			numeric: "always",
+			style: long ? "long" : "narrow",
+		}).format(-value, unit);
+	}
+
+	if (long) {
+		const { unit, milliseconds } = getExactDurationUnit(ms);
+		return new Intl.NumberFormat(locale, {
+			style: "unit",
+			unit,
+			unitDisplay: "long",
+		}).format(ms / milliseconds);
 	}
 
 	const formatted = prettyMilliseconds(ms, {

client/src/Validation/monitor.ts

@@ -6,6 +6,7 @@ import {
 	HttpMethods,
 	PageSpeedStrategies,
 	ProxyModes,
+	MIN_MONITOR_INTERVAL_MS,
 	type MonitorType,
 } from "@/Types/Monitor";
 import { ALL_HTTP_STATUS_CODES } from "@/Utils/statusCode";
@@ -27,7 +28,8 @@ const baseSchema = z.object({
 	description: z.string().optional(),
 	interval: z
 		.number()
-		.min(15000, "Interval must be at least 15 seconds")
+		.int("Interval must be a whole number of milliseconds")
+		.min(MIN_MONITOR_INTERVAL_MS, "Interval must be at least 10 seconds")
 		.register(monitorStepRegistry, { step: 1 }),
 	notifications: z.array(z.string()).register(monitorStepRegistry, { step: 1 }),
 	tags: z.array(z.string()).register(monitorStepRegistry, { step: 1 }),
@@ -108,10 +110,31 @@ const portSchema = baseSchema.extend({
 		.max(65535, "Port must be at most 65535"),
 });
 
-// Docker monitor schema
+// Docker monitor schema. The url forms mirror DOCKER_TLS_URL and
+// DOCKER_SOCKET_URL in server/src/utils/dockerHost.ts.
+const dockerTlsUrlRegex = /^(tcp|https):\/\/([^/\s:]+)(?::(\d+))?\/?$/;
+const dockerSocketUrlRegex = /^(?:unix:\/\/\/\S+|\/\S+)$/;
+
+export const isDockerTlsUrl = (url: string | undefined): boolean =>
+	dockerTlsUrlRegex.test(url?.trim() ?? "");
+
 const dockerSchema = baseSchema.extend({
 	type: z.literal("docker"),
-	url: z.string().min(1, "Container ID is required"),
+	url: z
+		.string()
+		.min(1, "Docker host URL is required")
+		.refine(
+			(url) => dockerSocketUrlRegex.test(url.trim()) || isDockerTlsUrl(url),
+			"Docker host must be unix:///path, an absolute socket path, or tcp://host[:port]"
+		),
+	ignoreTlsErrors: z.boolean(),
+	dockerTlsCa: z.string(),
+	dockerTlsCert: z.string(),
+	// blank on edit keeps the stored key.
+	dockerTlsKey: z.string(),
+	// Read only mirror of the server flag, stripped on submit
+	dockerTlsKeySet: z.boolean(),
+	dockerLogsEnabled: z.boolean().register(monitorStepRegistry, { step: 1 }),
 });
 
 // Game server monitor schema
@@ -216,7 +239,8 @@ const monitorSchemaUnion = z.discriminatedUnion("type", [
 	dnsSchema,
 ]);
 
-// Mirrors the server's refineProxySelection (monitorValidation.ts)
+// Mirrors the server's refineProxySelection and refineDockerTls
+// (monitorValidation.ts). PEM contents are only parsed on the server.
 export const monitorSchema = monitorSchemaUnion.superRefine((data, ctx) => {
 	if (data.type === "http" && data.proxyMode === "custom" && !data.proxyId) {
 		ctx.addIssue({
@@ -225,6 +249,30 @@ export const monitorSchema = monitorSchemaUnion.superRefine((data, ctx) => {
 			message: "A proxy must be selected when proxy mode is custom",
 		});
 	}
+
+	if (data.type === "docker" && isDockerTlsUrl(data.url)) {
+		if (!data.dockerTlsCert.trim()) {
+			ctx.addIssue({
+				code: "custom",
+				path: ["dockerTlsCert"],
+				message: "Client certificate is required for a TLS Docker host",
+			});
+		}
+		if (!data.dockerTlsKeySet && !data.dockerTlsKey.trim()) {
+			ctx.addIssue({
+				code: "custom",
+				path: ["dockerTlsKey"],
+				message: "Client key is required for a TLS Docker host",
+			});
+		}
+		if (!data.ignoreTlsErrors && !data.dockerTlsCa.trim()) {
+			ctx.addIssue({
+				code: "custom",
+				path: ["dockerTlsCa"],
+				message: "CA certificate is required unless TLS errors are ignored",
+			});
+		}
+	}
 });
 
 export type MonitorFormData = z.infer<typeof monitorSchema>;

client/src/Validation/notifications.ts

@@ -70,6 +70,12 @@ const pushoverSchema = baseSchema.extend({
 	accessToken: z.string().min(1, "App token is required"),
 });
 
+const signalgridSchema = baseSchema.extend({
+	type: z.literal("signalgrid"),
+	address: z.string().min(1, "Channel is required"),
+	accessToken: z.string().min(1, "Client key is required"),
+});
+
 const twilioSchema = baseSchema.extend({
 	type: z.literal("twilio"),
 	accountSid: z.string().min(1, "Account SID is required"),
@@ -95,6 +101,7 @@ export const notificationSchema = z.discriminatedUnion("type", [
 	teamsSchema,
 	telegramSchema,
 	pushoverSchema,
+	signalgridSchema,
 	twilioSchema,
 	ntfySchema,
 ]);

client/src/locales/de.json

@@ -448,6 +448,7 @@
 				},
 				"statBoxes": {
 					"activeFor": "Aktiv seit",
+					"checkingEvery": "Check alle {{interval}}",
 					"certificateExpiry": "Zertifikatablauf",
 					"lastCheck": "Letzter Check",
 					"lastResponseTime": "Letzte Antwortzeit",

client/src/locales/en.json

@@ -80,7 +80,9 @@
 				"avg": "Avg: {{value}}",
 				"max": "Max: {{value}}",
 				"responseTime": "Response time: {{value}}",
-				"total": "Total: {{value}}"
+				"total": "Total: {{value}}",
+				"avgCpuUsage": "Average CPU usage: {{value}}",
+				"avgMemoryUsage": "Average memory usage: {{value}}"
 			},
 			"phases": {
 				"dns": "DNS",
@@ -224,7 +226,8 @@
 					"alerting": "Alerting",
 					"reporting": "Reporting",
 					"configuration": "Configuration"
-				}
+				},
+				"dashboard": "Dashboard"
 			},
 			"bottomMenu": {
 				"support": "Support",
@@ -545,6 +548,7 @@
 				},
 				"statBoxes": {
 					"activeFor": "Active for",
+					"checkingEvery": "Checking every {{interval}}",
 					"certificateExpiry": "Certificate expiry",
 					"domainExpiry": "Domain expiry",
 					"lastCheck": "Last check",
@@ -632,9 +636,9 @@
 				},
 				"general": {
 					"option": {
-						"container": {
-							"label": "Container name/ID",
-							"placeholder": "my-app or abcd1234"
+						"dockerHost": {
+							"label": "Docker host",
+							"placeholder": "unix:///var/run/docker.sock"
 						},
 						"host": {
 							"label": "Host",
@@ -716,7 +720,7 @@
 						"http": "Enter the URL or IP to monitor (e.g., https://example.com/ or 192.168.1.100) and add a clear display name that appears on the dashboard.  Set an optional proxy server to connect through.",
 						"ping": "Enter the IP address or hostname to ping (e.g., 192.168.1.100 or example.com) and add a clear display name that appears on the dashboard.",
 						"port": "Enter the URL or IP of the server, the port number and a clear display name that appears on the dashboard.",
-						"docker": "Enter the Docker container name or ID. You can use either the container name (e.g., my-app) or the container ID (full 64-char ID or short ID).",
+						"docker": "Enter the Docker socket to monitor, as unix:///var/run/docker.sock or an absolute path such as /var/run/docker.sock, or a remote daemon as tcp://host:2376 to connect with TLS client certificates. Every container on the host is monitored.",
 						"game": "Enter the IP address or hostname and the port number to ping (e.g., 192.168.1.100 or example.com) and choose game type. Some games require enabling server queries in their config file — check your game server's documentation. See the <gamedigLink>supported games list</gamedigLink> for protocol details.",
 						"pagespeed": "Track page load performance, Core Web Vitals, and optimization scores for your website.",
 						"grpc": "Enter the hostname and port of the gRPC server, optionally specify a service name for the health check, and add a display name.",
@@ -756,7 +760,7 @@
 				},
 				"type": {
 					"description": "Select the type of check to perform",
-					"optionDockerDescription": "Use Docker to monitor if a container is running.",
+					"optionDockerDescription": "Monitor a Docker host and every container running on it.",
 					"optionGameDescription": "Monitor if a specific game server is online.",
 					"optionGrpcDescription": "Monitor gRPC services using the standard Health Checking Protocol.",
 					"optionWebSocketDescription": "Monitor WebSocket endpoints for connection health and response time.",
@@ -814,6 +818,15 @@
 						}
 					}
 				},
+				"dockerLogs": {
+					"title": "Container logs",
+					"description": "Collect the most recent log lines from every container on this host on each check. Logs are kept for 7 days. Leave this off for hosts with chatty containers to save database space.",
+					"option": {
+						"enabled": {
+							"label": "Collect container logs"
+						}
+					}
+				},
 				"stats": {
 					"title": "Monitor history",
 					"description": "Clear all monitoring history and statistics for your team. This action is irreversible.",
@@ -823,6 +836,29 @@
 						"description": "This will permanently delete all monitoring history, statistics, and check data for your team. This action cannot be undone.",
 						"confirm": "Yes, clear all stats"
 					}
+				},
+				"dockerTls": {
+					"title": "TLS credentials",
+					"description": "Connect to a remote Docker daemon over mutual TLS. Paste the PEM files you would pass to docker --tlsverify. The client key is encrypted before it is stored and is never shown again.",
+					"option": {
+						"ca": {
+							"label": "CA certificate",
+							"placeholder": "-----BEGIN CERTIFICATE-----"
+						},
+						"cert": {
+							"label": "Client certificate",
+							"placeholder": "-----BEGIN CERTIFICATE-----"
+						},
+						"key": {
+							"label": "Client key",
+							"placeholder": "-----BEGIN PRIVATE KEY-----",
+							"stored": "A key is stored. Leave blank to keep it."
+						},
+						"ignoreTls": {
+							"label": "Ignore TLS/SSL errors",
+							"description": "Skips verifying the daemon's certificate, so the CA certificate becomes optional. The client certificate and key are still required because the daemon verifies them."
+						}
+					}
 				}
 			}
 		},
@@ -956,6 +992,31 @@
 				"tabs": {
 					"overview": "Overview",
 					"logs": "Logs"
+				},
+				"logs": {
+					"recentLines": "{{count}} recent lines",
+					"loading": "Loading...",
+					"updatedSecondsAgo": "Updated {{count}}s ago",
+					"updatedMinutesAgo": "Updated {{count}}m ago",
+					"skipped": "Some log entries were skipped",
+					"loadOlder": "Load older logs",
+					"loadingOlder": "Loading...",
+					"noOlder": "Beginning of retained logs",
+					"loadError": "Could not load logs",
+					"loadOlderError": "Could not load older logs",
+					"empty": {
+						"title": "No logs collected yet",
+						"description": "Lines will appear here after the next check. Only output written since collection was turned on is stored."
+					},
+					"disabled": {
+						"title": "Log collection is off for this host",
+						"description": "Turn on container logs in the monitor settings to start collecting.",
+						"action": "Configure monitor"
+					},
+					"forbidden": {
+						"title": "You don't have access to container logs",
+						"description": "Only administrators can view logs. Ask an administrator for access if you need to see them."
+					}
 				}
 			},
 			"host": {
@@ -1217,7 +1278,7 @@
 				},
 				"startTime": {
 					"title": "Start time",
-					"description": "Set the start time and duration for your maintenance window. All values are in UTC",
+					"description": "Set the start time and duration for your maintenance window. All values are in your local time zone.",
 					"option": {
 						"duration": {
 							"label": "Duration"
@@ -1299,6 +1360,7 @@
 						"teams": "Teams",
 						"telegram": "Telegram",
 						"pushover": "Pushover",
+						"signalgrid": "Signalgrid",
 						"twilio": "Twilio",
 						"ntfy": "ntfy"
 					}
@@ -1319,6 +1381,14 @@
 					"optionUserKey": "User key",
 					"placeholderUserKey": "uQiRzpo4DXghDmr9QzzfQu27cmVRsG"
 				},
+				"signalgrid": {
+					"title": "Signalgrid configuration",
+					"description": "Configure Signalgrid to receive push notifications on your devices.",
+					"optionClientKey": "Client key",
+					"placeholderClientKey": "Your Signalgrid client key",
+					"optionChannel": "Channel",
+					"placeholderChannel": "Your Signalgrid channel"
+				},
 				"twilio": {
 					"title": "Twilio SMS configuration",
 					"description": "Configure Twilio to send SMS notifications to a phone number.",
@@ -1839,6 +1909,19 @@
 				"title": "Uptime monitors",
 				"description": "Watch HTTP endpoints, pings, containers, and ports — and get alerted the moment something goes down."
 			}
+		},
+		"dashboard": {
+			"monitorStatus": {
+				"ofUp": "of {{total}} up"
+			},
+			"cards": {
+				"monitorStatus": "Monitor status",
+				"monitorsByType": "Monitors by type"
+			},
+			"header": {
+				"title": "Dashboard",
+				"description": "See every monitor type in one place and spot what needs attention."
+			}
 		}
 	}
 }

docker/docker-compose.yaml

@@ -9,6 +9,7 @@ services:
       - DB_CONNECTION_STRING=mongodb://mongodb:27017/uptime_db
       - CLIENT_HOST=${CLIENT_HOST:-http://localhost:52345}
       - JWT_SECRET=${JWT_SECRET:?set JWT_SECRET in your environment}
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
     stop_grace_period: 60s
     healthcheck:
       test:

docs/hosting/checkmate-so/docker-compose.yaml

@@ -24,6 +24,8 @@ services:
   checkmate-demo:
     image: ghcr.io/bluewave-labs/checkmate:master
     container_name: checkmate-demo
+    group_add:
+      - "989"
     restart: always
     env_file:
       - server-prod.env
@@ -68,6 +70,8 @@ services:
   checkmate-staging:
     image: ghcr.io/bluewave-labs/checkmate:develop
     container_name: checkmate-staging
+    group_add:
+      - "989"
     restart: always
     env_file:
       - server-staging.env

server/.env.example

@@ -27,6 +27,17 @@ CLIENT_HOST=http://localhost:5173
 # ----------------------
 ORIGIN=localhost
 
+# Encryption
+# ------------------
+# Encrypts stored Docker TLS client keys. Not needed for socket-only Docker monitors.
+# Generate a key:      openssl rand -base64 32
+# Key list:            comma-separated; the first key encrypts, every key decrypts.
+# Split deployments:   set the same value on the API and every worker.
+# Rotate a key:        1. deploy OLD_KEY,NEW_KEY everywhere so every process can read both
+#                      2. deploy NEW_KEY,OLD_KEY everywhere so new writes use the new key
+#                      3. wait for the worker to re-encrypt every row, then drop OLD_KEY
+# ENCRYPTION_KEY=<output of openssl rand -base64 32>
+
 # Feature Flags
 # -------------
 # Set to "false" to disable the selectable theme feature on status pages.

server/openapi.json

@@ -422,9 +422,6 @@
 					"secret": {
 						"type": "string"
 					},
-					"sshPrivateKey": {
-						"type": "string"
-					},
 					"cpuAlertThreshold": {
 						"type": "number"
 					},
@@ -466,6 +463,18 @@
 					"geoCheckInterval": {
 						"type": "number"
 					},
+					"dockerLogsEnabled": {
+						"type": "boolean"
+					},
+					"dockerTlsCa": {
+						"type": "string"
+					},
+					"dockerTlsCert": {
+						"type": "string"
+					},
+					"dockerTlsKeySet": {
+						"type": "boolean"
+					},
 					"dnsServer": {
 						"type": "string"
 					},
@@ -513,6 +522,7 @@
 					"geoCheckEnabled",
 					"geoCheckLocations",
 					"geoCheckInterval",
+					"dockerLogsEnabled",
 					"teamId",
 					"userId",
 					"createdAt",
@@ -640,9 +650,6 @@
 									"secret": {
 										"type": "string"
 									},
-									"sshPrivateKey": {
-										"type": "string"
-									},
 									"cpuAlertThreshold": {
 										"type": "number"
 									},
@@ -684,6 +691,18 @@
 									"geoCheckInterval": {
 										"type": "number"
 									},
+									"dockerLogsEnabled": {
+										"type": "boolean"
+									},
+									"dockerTlsCa": {
+										"type": "string"
+									},
+									"dockerTlsCert": {
+										"type": "string"
+									},
+									"dockerTlsKeySet": {
+										"type": "boolean"
+									},
 									"dnsServer": {
 										"type": "string"
 									},
@@ -733,6 +752,7 @@
 									"geoCheckEnabled",
 									"geoCheckLocations",
 									"geoCheckInterval",
+									"dockerLogsEnabled",
 									"teamId",
 									"userId",
 									"createdAt",
@@ -929,6 +949,9 @@
 					{
 						"$ref": "#/components/schemas/PushoverNotification"
 					},
+					{
+						"$ref": "#/components/schemas/SignalgridNotification"
+					},
 					{
 						"$ref": "#/components/schemas/TwilioNotification"
 					},
@@ -949,6 +972,7 @@
 						"teams": "#/components/schemas/TeamsNotification",
 						"telegram": "#/components/schemas/TelegramNotification",
 						"pushover": "#/components/schemas/PushoverNotification",
+						"signalgrid": "#/components/schemas/SignalgridNotification",
 						"twilio": "#/components/schemas/TwilioNotification",
 						"ntfy": "#/components/schemas/NtfyNotification"
 					}
@@ -1380,6 +1404,34 @@
 					"accessToken": "a1234567890abcdef"
 				}
 			},
+			"SignalgridNotification": {
+				"type": "object",
+				"properties": {
+					"notificationName": {
+						"type": "string",
+						"minLength": 1
+					},
+					"type": {
+						"type": "string",
+						"enum": ["signalgrid"]
+					},
+					"address": {
+						"type": "string",
+						"minLength": 1
+					},
+					"accessToken": {
+						"type": "string",
+						"minLength": 1
+					}
+				},
+				"required": ["notificationName", "type", "address", "accessToken"],
+				"example": {
+					"notificationName": "Signalgrid",
+					"type": "signalgrid",
+					"address": "your-channel",
+					"accessToken": "your-client-key"
+				}
+			},
 			"TwilioNotification": {
 				"type": "object",
 				"properties": {
@@ -7090,9 +7142,6 @@
 														"secret": {
 															"type": "string"
 														},
-														"sshPrivateKey": {
-															"type": "string"
-														},
 														"cpuAlertThreshold": {
 															"type": "number"
 														},
@@ -7134,6 +7183,18 @@
 														"geoCheckInterval": {
 															"type": "number"
 														},
+														"dockerLogsEnabled": {
+															"type": "boolean"
+														},
+														"dockerTlsCa": {
+															"type": "string"
+														},
+														"dockerTlsCert": {
+															"type": "string"
+														},
+														"dockerTlsKeySet": {
+															"type": "boolean"
+														},
 														"dnsServer": {
 															"type": "string"
 														},
@@ -7183,6 +7244,7 @@
 														"geoCheckEnabled",
 														"geoCheckLocations",
 														"geoCheckInterval",
+														"dockerLogsEnabled",
 														"teamId",
 														"userId",
 														"createdAt",
@@ -7655,9 +7717,6 @@
 														"secret": {
 															"type": "string"
 														},
-														"sshPrivateKey": {
-															"type": "string"
-														},
 														"cpuAlertThreshold": {
 															"type": "number"
 														},
@@ -7699,6 +7758,18 @@
 														"geoCheckInterval": {
 															"type": "number"
 														},
+														"dockerLogsEnabled": {
+															"type": "boolean"
+														},
+														"dockerTlsCa": {
+															"type": "string"
+														},
+														"dockerTlsCert": {
+															"type": "string"
+														},
+														"dockerTlsKeySet": {
+															"type": "boolean"
+														},
 														"dnsServer": {
 															"type": "string"
 														},
@@ -7748,6 +7819,7 @@
 														"geoCheckEnabled",
 														"geoCheckLocations",
 														"geoCheckInterval",
+														"dockerLogsEnabled",
 														"teamId",
 														"userId",
 														"createdAt",
@@ -7984,6 +8056,231 @@
 				}
 			}
 		},
+		"/monitors/docker/details/{monitorId}/containers/{containerName}/logs": {
+			"get": {
+				"tags": ["monitors"],
+				"summary": "Get stored log lines for one container on a Docker host monitor, newest first",
+				"security": [
+					{
+						"bearerAuth": []
+					}
+				],
+				"parameters": [
+					{
+						"schema": {
+							"type": "string",
+							"minLength": 1
+						},
+						"required": true,
+						"name": "monitorId",
+						"in": "path"
+					},
+					{
+						"schema": {
+							"type": "string",
+							"minLength": 1
+						},
+						"required": true,
+						"name": "containerName",
+						"in": "path"
+					},
+					{
+						"schema": {
+							"type": "string",
+							"format": "date-time"
+						},
+						"required": false,
+						"name": "before",
+						"in": "query"
+					},
+					{
+						"schema": {
+							"type": "string",
+							"format": "date-time"
+						},
+						"required": false,
+						"name": "after",
+						"in": "query"
+					},
+					{
+						"schema": {
+							"type": "integer",
+							"minimum": 1,
+							"maximum": 50,
+							"default": 20
+						},
+						"required": false,
+						"name": "limit",
+						"in": "query"
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"properties": {
+										"success": {
+											"type": "boolean",
+											"enum": [true]
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"type": "object",
+											"properties": {
+												"logs": {
+													"type": "array",
+													"items": {
+														"type": "object",
+														"properties": {
+															"id": {
+																"type": "string"
+															},
+															"metadata": {
+																"type": "object",
+																"properties": {
+																	"monitorId": {
+																		"type": "string"
+																	},
+																	"teamId": {
+																		"type": "string"
+																	},
+																	"containerId": {
+																		"type": "string"
+																	},
+																	"containerName": {
+																		"type": "string"
+																	}
+																},
+																"required": ["monitorId", "teamId", "containerId", "containerName"]
+															},
+															"lines": {
+																"type": "array",
+																"items": {
+																	"type": "object",
+																	"properties": {
+																		"ts": {
+																			"type": "string"
+																		},
+																		"stream": {
+																			"type": "string",
+																			"enum": ["stdout", "stderr"]
+																		},
+																		"text": {
+																			"type": "string"
+																		}
+																	},
+																	"required": ["ts", "stream", "text"]
+																}
+															},
+															"gap": {
+																"type": "boolean"
+															},
+															"checkedAt": {
+																"type": "string"
+															},
+															"expiry": {
+																"type": "string"
+															},
+															"createdAt": {
+																"type": "string"
+															},
+															"updatedAt": {
+																"type": "string"
+															}
+														},
+														"required": ["id", "metadata", "lines", "gap", "checkedAt", "expiry", "createdAt", "updatedAt"]
+													}
+												},
+												"nextCursor": {
+													"type": "string",
+													"nullable": true
+												}
+											},
+											"required": ["logs", "nextCursor"]
+										}
+									},
+									"required": ["success", "msg", "data"]
+								}
+							}
+						}
+					},
+					"401": {
+						"description": "Unauthorized",
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"properties": {
+										"success": {
+											"type": "boolean",
+											"enum": [false]
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"nullable": true
+										}
+									},
+									"required": ["success", "msg"]
+								}
+							}
+						}
+					},
+					"403": {
+						"description": "Forbidden",
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"properties": {
+										"success": {
+											"type": "boolean",
+											"enum": [false]
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"nullable": true
+										}
+									},
+									"required": ["success", "msg"]
+								}
+							}
+						}
+					},
+					"500": {
+						"description": "Internal server error",
+						"content": {
+							"application/json": {
+								"schema": {
+									"type": "object",
+									"properties": {
+										"success": {
+											"type": "boolean",
+											"enum": [false]
+										},
+										"msg": {
+											"type": "string"
+										},
+										"data": {
+											"nullable": true
+										}
+									},
+									"required": ["success", "msg"]
+								}
+							}
+						}
+					}
+				}
+			}
+		},
 		"/monitors/pagespeed/details/{monitorId}": {
 			"get": {
 				"tags": ["monitors"],
@@ -8908,9 +9205,6 @@
 									"secret": {
 										"type": "string"
 									},
-									"sshPrivateKey": {
-										"type": "string"
-									},
 									"jsonPath": {
 										"anyOf": [
 											{
@@ -9011,6 +9305,42 @@
 										"type": "number",
 										"minimum": 300000
 									},
+									"dockerLogsEnabled": {
+										"type": "boolean"
+									},
+									"dockerTlsCa": {
+										"anyOf": [
+											{
+												"type": "string"
+											},
+											{
+												"type": "string",
+												"enum": [""]
+											}
+										]
+									},
+									"dockerTlsCert": {
+										"anyOf": [
+											{
+												"type": "string"
+											},
+											{
+												"type": "string",
+												"enum": [""]
+											}
+										]
+									},
+									"dockerTlsKey": {
+										"anyOf": [
+											{
+												"type": "string"
+											},
+											{
+												"type": "string",
+												"enum": [""]
+											}
+										]
+									},
 									"dnsServer": {
 										"type": "string",
 										"minLength": 1
@@ -9604,9 +9934,6 @@
 												"secret": {
 													"type": "string"
 												},
-												"sshPrivateKey": {
-													"type": "string"
-												},
 												"cpuAlertThreshold": {
 													"type": "number",
 													"default": 100
@@ -9702,6 +10029,10 @@
 													"minimum": 300000,
 													"default": 300000
 												},
+												"dockerLogsEnabled": {
+													"type": "boolean",
+													"default": false
+												},
 												"dnsServer": {
 													"type": "string",
 													"minLength": 1
@@ -10137,9 +10468,6 @@
 									"secret": {
 										"type": "string"
 									},
-									"sshPrivateKey": {
-										"type": "string"
-									},
 									"ignoreTlsErrors": {
 										"type": "boolean"
 									},
@@ -10269,6 +10597,42 @@
 										"type": "number",
 										"minimum": 300000
 									},
+									"dockerLogsEnabled": {
+										"type": "boolean"
+									},
+									"dockerTlsCa": {
+										"anyOf": [
+											{
+												"type": "string"
+											},
+											{
+												"type": "string",
+												"enum": [""]
+											}
+										]
+									},
+									"dockerTlsCert": {
+										"anyOf": [
+											{
+												"type": "string"
+											},
+											{
+												"type": "string",
+												"enum": [""]
+											}
+										]
+									},
+									"dockerTlsKey": {
+										"anyOf": [
+											{
+												"type": "string"
+											},
+											{
+												"type": "string",
+												"enum": [""]
+											}
+										]
+									},
 									"dnsServer": {
 										"type": "string",
 										"minLength": 1
@@ -12930,6 +13294,30 @@
 									"globalProxyId": {
 										"type": "string",
 										"nullable": true
+									},
+									"egressCheckEnabled": {
+										"type": "boolean"
+									},
+									"egressCheckTargets": {
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 253
+										},
+										"maxItems": 10
+									},
+									"egressPollIntervalSeconds": {
+										"type": "integer",
+										"minimum": 5,
+										"maximum": 600
+									},
+									"egressNotifications": {
+										"type": "array",
+										"items": {
+											"type": "string",
+											"pattern": "^[0-9a-fA-F]{24}$"
+										}
 									}
 								}
 							}

server/openapi/routes/monitor.ts

@@ -24,6 +24,8 @@ import {
 	dockerContainerDetailsResponseSchema,
 	monitorResponseSchema,
 	uptimeDetailsResponseSchema,
+	getDockerContainerLogsQueryValidation,
+	dockerContainerLogsResponseSchema,
 } from "@/api/validation/monitorValidation.js";
 import { updateNotificationsValidation } from "@/api/validation/notificationValidation.js";
 
@@ -131,6 +133,16 @@ registry.registerPath({
 	responses: { "200": okJson(dockerContainerDetailsResponseSchema), ...standardErrors },
 });
 
+registry.registerPath({
+	method: "get",
+	path: "/monitors/docker/details/{monitorId}/containers/{containerName}/logs",
+	tags,
+	summary: "Get stored log lines for one container on a Docker host monitor, newest first",
+	security: bearer,
+	request: { params: getDockerContainerNameParamValidation, query: getDockerContainerLogsQueryValidation },
+	responses: { "200": okJson(dockerContainerLogsResponseSchema), ...standardErrors },
+});
+
 registry.registerPath({
 	method: "get",
 	path: "/monitors/pagespeed/details/{monitorId}",

server/openapi/routes/notification.ts

@@ -65,6 +65,10 @@ const notificationVariantMeta: Record<string, { component: string; example: Reco
 		component: "PushoverNotification",
 		example: { notificationName: "Pushover personal", type: "pushover", address: "u1234567890abcdef", accessToken: "a1234567890abcdef" },
 	},
+	signalgrid: {
+		component: "SignalgridNotification",
+		example: { notificationName: "Signalgrid", type: "signalgrid", address: "your-channel", accessToken: "your-client-key" },
+	},
 	twilio: {
 		component: "TwilioNotification",
 		example: {

server/src/api/controllers/authController.ts

@@ -5,6 +5,7 @@ import { requireTeamId, requireUserEmail, requireUserId, requireUserRoles } from
 
 import {
 	registrationBodyValidation,
+	registerInviteTokenValidation,
 	loginValidation,
 	recoveryValidation,
 	recoveryTokenBodyValidation,
@@ -48,7 +49,7 @@ class AuthController implements IAuthController {
 
 	registerUser = catchAsync(async (req: Request, res: Response) => {
 		const newUser = req.body.user;
-		const newUserToken = req.body.token;
+		const newUserToken = registerInviteTokenValidation.parse(req.body.token);
 		if (newUser?.email) {
 			const newUserEmail = requireUserEmail(newUser.email);
 			newUser.email = newUserEmail.toLowerCase();

server/src/api/controllers/monitorController.ts

@@ -21,6 +21,7 @@ import {
 	getDockerDetailsByIdQueryValidation,
 	getDockerContainerNameParamValidation,
 	getDockerContainerByNameQueryValidation,
+	getDockerContainerLogsQueryValidation,
 } from "@/api/validation/monitorValidation.js";
 import sslChecker from "ssl-checker";
 import * as whoiser from "whoiser";
@@ -37,6 +38,7 @@ export interface IMonitorController {
 	getPageSpeedDetailsById: RequestHandler;
 	getDockerDetailsById: RequestHandler;
 	getDockerContainerByName: RequestHandler;
+	getDockerContainerLogs: RequestHandler;
 	getGeoChecksByMonitorId: RequestHandler;
 	getMonitorById: RequestHandler;
 	createMonitor: RequestHandler;
@@ -198,6 +200,30 @@ class MonitorController implements IMonitorController {
 		});
 	});
 
+	getDockerContainerLogs = catchAsync(async (req: Request, res: Response) => {
+		const validatedParams = getDockerContainerNameParamValidation.parse(req.params);
+		const validatedQuery = getDockerContainerLogsQueryValidation.parse(req.query);
+
+		const { monitorId, containerName } = validatedParams;
+		const { before, after, limit } = validatedQuery;
+		const teamId = requireTeamId(req.user?.teamId);
+
+		const data = await this.monitorService.getDockerContainerLogs({
+			teamId,
+			monitorId,
+			containerName,
+			before: before ? new Date(before) : undefined,
+			after: after ? new Date(after) : undefined,
+			limit,
+		});
+
+		return res.status(200).json({
+			success: true,
+			msg: "Docker container logs retrieved successfully",
+			data,
+		});
+	});
+
 	getGeoChecksByMonitorId = catchAsync(async (req: Request, res: Response) => {
 		const validatedParams = getMonitorByIdParamValidation.parse(req.params);
 		const validatedQuery = getMonitorByIdQueryValidation.parse(req.query);

server/src/api/controllers/settingsController.ts

@@ -6,6 +6,7 @@ import { AppError } from "@/utils/AppError.js";
 import { ISettingsService } from "@/domain/app-settings/app-settings.service.js";
 import { IEmailService } from "@/service/emailService.js";
 import { IProxiesService } from "@/domain/proxies/proxy.service.js";
+import { IEgressStateService } from "@/domain/egress/egress-state.service.js";
 import { Settings } from "@/domain/app-settings/app-settings.type.js";
 
 export interface ISettingsController {
@@ -18,10 +19,17 @@ class SettingsController implements ISettingsController {
 	private settingsService: ISettingsService;
 	private emailService: IEmailService;
 	private proxiesService: IProxiesService;
-	constructor(settingsService: ISettingsService, emailService: IEmailService, proxiesService: IProxiesService) {
+	private egressStateService: IEgressStateService;
+	constructor(
+		settingsService: ISettingsService,
+		emailService: IEmailService,
+		proxiesService: IProxiesService,
+		egressStateService: IEgressStateService
+	) {
 		this.settingsService = settingsService;
 		this.emailService = emailService;
 		this.proxiesService = proxiesService;
+		this.egressStateService = egressStateService;
 	}
 
 	buildAppSettings = async (dbSettings: Settings) => {
@@ -70,7 +78,14 @@ class SettingsController implements ISettingsController {
 			}
 		}
 
+		const previousSettings = await this.settingsService.getDBSettings();
 		const updatedSettings = await this.settingsService.updateDbSettings(validatedBody);
+
+		// Switching the egress check on or off starts from a clean state: no degraded episode, no pending recovery job
+		if (validatedBody.egressCheckEnabled !== undefined && validatedBody.egressCheckEnabled !== previousSettings.egressCheckEnabled) {
+			await this.egressStateService.reset();
+		}
+
 		const returnSettings = await this.buildAppSettings(updatedSettings);
 		return res.status(200).json({
 			success: true,

server/src/api/routes/checkRoutes.ts

@@ -9,6 +9,6 @@ export const createCheckRoutes = (checkController: ICheckController): Router =>
 	router.get("/team", checkController.getChecksByTeam);
 	router.delete("/team", isAllowed(["admin", "superadmin"]), checkController.deleteChecksByTeamId);
 	router.get("/:monitorId", checkController.getChecksByMonitor);
-	router.delete("/:monitorId", checkController.deleteChecks);
+	router.delete("/:monitorId", isAllowed(["admin", "superadmin"]), checkController.deleteChecks);
 	return router;
 };

server/src/api/routes/maintenanceWindowRoutes.ts

@@ -1,15 +1,16 @@
 import { IMaintenanceWindowController } from "@/api/controllers/maintenanceWindowController.js";
+import { isAllowed } from "@/api/middleware/isAllowed.js";
 import { Router } from "express";
 
 export const createMaintenanceWindowRoutes = (maintenanceWindowController: IMaintenanceWindowController): Router => {
 	const router = Router();
-	router.post("/", maintenanceWindowController.createMaintenanceWindows);
+	router.post("/", isAllowed(["admin", "superadmin"]), maintenanceWindowController.createMaintenanceWindows);
 	router.get("/team/", maintenanceWindowController.getMaintenanceWindowsByTeamId);
 
 	router.get("/monitor/:monitorId", maintenanceWindowController.getMaintenanceWindowsByMonitorId);
 
 	router.get("/:id", maintenanceWindowController.getMaintenanceWindowById);
-	router.patch("/:id", maintenanceWindowController.editMaintenanceWindow);
-	router.delete("/:id", maintenanceWindowController.deleteMaintenanceWindow);
+	router.patch("/:id", isAllowed(["admin", "superadmin"]), maintenanceWindowController.editMaintenanceWindow);
+	router.delete("/:id", isAllowed(["admin", "superadmin"]), maintenanceWindowController.deleteMaintenanceWindow);
 	return router;
 };

server/src/api/routes/monitorRoutes.ts

@@ -21,6 +21,11 @@ export const createMonitorRoutes = (monitorController: IMonitorController): Rout
 	// Docker routes
 	router.get("/docker/details/:monitorId", monitorController.getDockerDetailsById);
 	router.get("/docker/details/:monitorId/containers/:containerName", monitorController.getDockerContainerByName);
+	router.get(
+		"/docker/details/:monitorId/containers/:containerName/logs",
+		isAllowed(["admin", "superadmin"]),
+		monitorController.getDockerContainerLogs
+	);
 
 	// Geo checks routes
 	router.get("/:monitorId/geo-checks", monitorController.getGeoChecksByMonitorId);

server/src/api/routes/notificationRoutes.ts

@@ -1,14 +1,15 @@
 import { INotificationController } from "@/api/controllers/notificationController.js";
+import { isAllowed } from "@/api/middleware/isAllowed.js";
 import { Router } from "express";
 
 export const createNotificationRoutes = (notificationController: INotificationController): Router => {
 	const router = Router();
-	router.post("/", notificationController.createNotification);
-	router.post("/test/all", notificationController.testAllNotifications);
-	router.post("/test", notificationController.testNotification);
+	router.post("/", isAllowed(["admin", "superadmin"]), notificationController.createNotification);
+	router.post("/test/all", isAllowed(["admin", "superadmin"]), notificationController.testAllNotifications);
+	router.post("/test", isAllowed(["admin", "superadmin"]), notificationController.testNotification);
 	router.get("/team", notificationController.getNotificationsByTeamId);
 	router.get("/:id", notificationController.getNotificationById);
-	router.delete("/:id", notificationController.deleteNotification);
-	router.patch("/:id", notificationController.editNotification);
+	router.delete("/:id", isAllowed(["admin", "superadmin"]), notificationController.deleteNotification);
+	router.patch("/:id", isAllowed(["admin", "superadmin"]), notificationController.editNotification);
 	return router;
 };

server/src/api/validation/authValidation.ts

@@ -23,6 +23,8 @@ export const registrationBodyValidation = z.object({
 	inviteToken: z.string().optional().default(""),
 });
 
+export const registerInviteTokenValidation = z.string().optional().default("");
+
 export const recoveryValidation = z.object({
 	email: z.email("Must be a valid email address"),
 });

server/src/api/validation/monitorValidation.ts

@@ -13,7 +13,11 @@ import {
 	ProxyModes,
 } from "@/domain/monitors/monitor.type.js";
 import { DateRanges, SortOrders } from "@/types/query.js";
-import { DockerContainerStates, DockerHealthStatuses, DockerPortProtocols } from "@/types/network.js";
+import { DockerContainerStates, DockerHealthStatuses, DockerLogStreams, DockerPortProtocols } from "@/domain/docker/docker.type.js";
+import { DOCKER_LOG_PAGE_DEFAULT, DOCKER_LOG_PAGE_MAX } from "@/domain/docker/docker-log.type.js";
+import { isDockerSocketUrl, isDockerTlsUrl } from "@/utils/dockerHost.js";
+import { X509Certificate } from "node:crypto";
+import { keyMatchesCertificate, parseCertificates, parsePrivateKey } from "@/utils/pem.js";
 
 const httpStatusCode = z.number().refine((code) => HttpStatusCodeSet.has(code), { message: "Must be a valid HTTP status code" });
 
@@ -119,23 +123,57 @@ const refineProxySelection = (body: { proxyMode?: string; proxyId?: string }, ct
 	}
 };
 
-const dockerUrlRegex = /^(?:ssh:\/\/[^@\s]+@[^\s/:@]+(?::\d{1,5})?\/?|unix:\/\/\/\S+|\/\S+)$/;
-
-const refineDockerUrl = (data: { type?: string; url?: string; sshPrivateKey?: string }, ctx: z.RefinementCtx) => {
+const refineDockerUrl = (data: { type?: string; url?: string }, ctx: z.RefinementCtx) => {
 	if (data.type !== "docker" || data.url === undefined) return;
-	if (!dockerUrlRegex.test(data.url)) {
+	if (!isDockerSocketUrl(data.url) && !isDockerTlsUrl(data.url)) {
 		ctx.addIssue({
 			code: "custom",
 			path: ["url"],
-			message: "Docker host must be ssh://user@host[:port], unix:///path, or an absolute socket path",
+			message: "Docker host must be unix:///path, an absolute socket path, or tcp://host[:port]",
 		});
 	}
-	if (data.url.startsWith("ssh://") && !data.sshPrivateKey) {
-		ctx.addIssue({
-			code: "custom",
-			path: ["sshPrivateKey"],
-			message: "SSH Docker hosts require a private key",
-		});
+};
+
+type DockerTlsFields = {
+	type?: string;
+	url?: string;
+	ignoreTlsErrors?: boolean;
+	dockerTlsCa?: string;
+	dockerTlsCert?: string;
+	dockerTlsKey?: string;
+};
+
+const refineDockerTls = (mode: "create" | "edit") => (data: DockerTlsFields, ctx: z.RefinementCtx) => {
+	if (data.type !== "docker" || !isDockerTlsUrl(data.url)) return;
+	const issue = (path: string, message: string) => ctx.addIssue({ code: "custom", path: [path], message });
+
+	if (!data.dockerTlsCert) issue("dockerTlsCert", "TLS certificate is required for a TLS Docker host");
+
+	if (mode === "create" && !data.dockerTlsKey) issue("dockerTlsKey", "TLS key is required for a TLS Docker host");
+
+	if (!data.ignoreTlsErrors && !data.dockerTlsCa) issue("dockerTlsCa", "CA certificate is required unless TLS errors are ignored");
+
+	let certificate: X509Certificate | undefined;
+
+	try {
+		if (data.dockerTlsCa) parseCertificates(data.dockerTlsCa);
+	} catch (error: unknown) {
+		issue("dockerTlsCa", error instanceof Error ? error.message : "Docker TLS CA error");
+	}
+
+	try {
+		if (data.dockerTlsCert) [certificate] = parseCertificates(data.dockerTlsCert);
+	} catch (error) {
+		issue("dockerTlsCert", error instanceof Error ? error.message : "Docker TLS cert error");
+	}
+
+	try {
+		if (data.dockerTlsKey) {
+			const key = parsePrivateKey(data.dockerTlsKey);
+			if (certificate && !keyMatchesCertificate(key, certificate)) issue("dockerTlsKey", "Key does not match certificate");
+		}
+	} catch (error: unknown) {
+		issue("dockerTlsKey", error instanceof Error ? error.message : "Docker TLS key error");
 	}
 };
 
@@ -163,7 +201,6 @@ export const createMonitorBodyValidation = z
 		tags: z.array(z.string()).optional(),
 		customUpCodes: z.array(httpStatusCode).default([]),
 		secret: z.string().optional(),
-		sshPrivateKey: z.string().optional(),
 		jsonPath: z.union([z.string(), z.literal("")]).optional(),
 		expectedValue: z.union([z.string(), z.literal("")]).optional(),
 		matchMethod: z.union([z.enum(MonitorMatchMethods), z.literal("")]).optional(),
@@ -176,6 +213,10 @@ export const createMonitorBodyValidation = z
 		geoCheckEnabled: z.boolean().optional(),
 		geoCheckLocations: z.array(z.enum(GeoContinents)).optional(),
 		geoCheckInterval: z.number().min(300000).optional(),
+		dockerLogsEnabled: z.boolean().optional(),
+		dockerTlsCa: z.union([z.string(), z.literal("")]).optional(),
+		dockerTlsCert: z.union([z.string(), z.literal("")]).optional(),
+		dockerTlsKey: z.union([z.string(), z.literal("")]).optional(),
 		dnsServer: dnsServerValidation.optional(),
 		dnsRecordType: z.enum(DnsRecordTypes).optional(),
 	})
@@ -184,7 +225,8 @@ export const createMonitorBodyValidation = z
 	.superRefine(refineHeadMatching)
 	.superRefine(refineRegexPattern)
 	.superRefine(refineProxySelection)
-	.superRefine(refineDockerUrl);
+	.superRefine(refineDockerUrl)
+	.superRefine(refineDockerTls("create"));
 
 export const editMonitorBodyValidation = z
 	.object({
@@ -199,7 +241,6 @@ export const editMonitorBodyValidation = z
 		tags: z.array(z.string()).optional(),
 		customUpCodes: z.array(httpStatusCode).optional(),
 		secret: z.string().optional(),
-		sshPrivateKey: z.string().optional(),
 		ignoreTlsErrors: z.boolean().optional(),
 		proxyMode: z.enum(ProxyModes).optional(),
 		proxyId: proxyIdValidation,
@@ -221,6 +262,10 @@ export const editMonitorBodyValidation = z
 		geoCheckEnabled: z.boolean().optional(),
 		geoCheckLocations: z.array(z.enum(GeoContinents)).optional(),
 		geoCheckInterval: z.number().min(300000).optional(),
+		dockerLogsEnabled: z.boolean().optional(),
+		dockerTlsCa: z.union([z.string(), z.literal("")]).optional(),
+		dockerTlsCert: z.union([z.string(), z.literal("")]).optional(),
+		dockerTlsKey: z.union([z.string(), z.literal("")]).optional(),
 		dnsServer: dnsServerValidation.optional(),
 		dnsRecordType: z.enum(DnsRecordTypes).optional(),
 	})
@@ -229,7 +274,8 @@ export const editMonitorBodyValidation = z
 	.superRefine(refineHeadMatching)
 	.superRefine(refineRegexPattern)
 	.superRefine(refineProxySelection)
-	.superRefine(refineDockerUrl);
+	.superRefine(refineDockerUrl)
+	.superRefine(refineDockerTls("edit"));
 
 export const pauseMonitorParamValidation = z.object({
 	monitorId: z.string().min(1, "Monitor ID is required"),
@@ -280,7 +326,6 @@ const importedMonitorSchema = z
 		tags: z.array(z.string()).default([]),
 		customUpCodes: z.array(httpStatusCode).default([]),
 		secret: z.string().optional(),
-		sshPrivateKey: z.string().optional(),
 		cpuAlertThreshold: z.number().default(100),
 		cpuAlertCounter: z.number().default(5),
 		memoryAlertThreshold: z.number().default(100),
@@ -297,6 +342,7 @@ const importedMonitorSchema = z
 		geoCheckEnabled: z.boolean().default(false),
 		geoCheckLocations: z.array(z.enum(GeoContinents)).default([]),
 		geoCheckInterval: z.number().min(300000).default(300000),
+		dockerLogsEnabled: z.boolean().default(false),
 		dnsServer: dnsServerValidation.optional(),
 		dnsRecordType: z.enum(DnsRecordTypes).optional(),
 		createdAt: z.string().optional(),
@@ -332,6 +378,21 @@ export const getDockerContainerNameParamValidation = z.object({
 });
 export const getDockerContainerByNameQueryValidation = z.object({ dateRange: z.enum(DateRanges).optional() });
 
+export const getDockerContainerLogsQueryValidation = z
+	.object({
+		before: z.iso.datetime().optional(),
+		after: z.iso.datetime().optional(),
+		limit: z.coerce.number().int().min(1).max(DOCKER_LOG_PAGE_MAX).default(DOCKER_LOG_PAGE_DEFAULT),
+	})
+	.superRefine((query, ctx) => {
+		if (query.before && query.after) {
+			ctx.addIssue({
+				code: "custom",
+				message: "Specify either before or after, not both",
+				path: ["after"],
+			});
+		}
+	});
 // Canonical monitor shape returned by /monitors endpoints. Keep aligned with
 // what the controllers actually serialize.
 export const monitorResponseSchema = z
@@ -359,7 +420,6 @@ export const monitorResponseSchema = z
 		tags: z.array(z.string()),
 		customUpCodes: z.array(httpStatusCode).optional(),
 		secret: z.string().optional(),
-		sshPrivateKey: z.string().optional(),
 		cpuAlertThreshold: z.number(),
 		memoryAlertThreshold: z.number(),
 		diskAlertThreshold: z.number(),
@@ -371,6 +431,10 @@ export const monitorResponseSchema = z
 		geoCheckEnabled: z.boolean(),
 		geoCheckLocations: z.array(z.enum(GeoContinents)),
 		geoCheckInterval: z.number(),
+		dockerLogsEnabled: z.boolean(),
+		dockerTlsCa: z.string().optional(),
+		dockerTlsCert: z.string().optional(),
+		dockerTlsKeySet: z.boolean().optional(),
 		dnsServer: z.string().optional(),
 		dnsRecordType: z.enum(DnsRecordTypes).optional(),
 		teamId: z.string(),
@@ -529,3 +593,26 @@ export const dockerContainerDetailsResponseSchema = z.object({
 			.nullable(),
 	}),
 });
+
+export const dockerLogLineResponseSchema = z.object({
+	ts: z.string(),
+	stream: z.enum(DockerLogStreams),
+	text: z.string(),
+});
+
+export const dockerLogResponseSchema = z.object({
+	id: z.string(),
+	metadata: z.object({ monitorId: z.string(), teamId: z.string(), containerId: z.string(), containerName: z.string() }),
+	lines: z.array(dockerLogLineResponseSchema),
+	gap: z.boolean(),
+	checkedAt: z.string(),
+	expiry: z.string(),
+	createdAt: z.string(),
+	updatedAt: z.string(),
+});
+
+// Response of GET /monitors/docker/details/{monitorId}/containers/{containerName}/logs.
+export const dockerContainerLogsResponseSchema = z.object({
+	logs: z.array(dockerLogResponseSchema),
+	nextCursor: z.string().nullable(),
+});

server/src/api/validation/notificationValidation.ts

@@ -123,6 +123,13 @@ export const createNotificationBodyValidation = z.discriminatedUnion("type", [
 		address: z.string().min(1, "User key is required"),
 		accessToken: z.string().min(1, "App token is required"),
 	}),
+	// Signalgrid notification
+	z.object({
+		notificationName: z.string().min(1, "Notification name is required"),
+		type: z.literal("signalgrid"),
+		address: z.string().min(1, "Channel is required"),
+		accessToken: z.string().min(1, "Client key is required"),
+	}),
 	// Twilio SMS notification
 	z.object({
 		notificationName: z.string().min(1, "Notification name is required"),

server/src/api/validation/settingsValidation.ts

@@ -1,6 +1,17 @@
 import { CHECK_TTL_SENTINEL } from "@/domain/checks/check.type.js";
+import { MAX_EGRESS_POLL_INTERVAL_SECONDS, MAX_EGRESS_TARGETS, MIN_EGRESS_POLL_INTERVAL_SECONDS } from "@/domain/egress/egress.type.js";
+import { parseEgressTarget } from "@/utils/egressTarget.js";
 import { z } from "zod";
 
+// A reliability target is a bare host/IP (ICMP ping), host:port (TCP connect) or an http(s) URL.
+// Parsed with the same function the probe uses, so nothing the validator accepts can fail to probe.
+const egressTargetValidation = z
+	.string()
+	.trim()
+	.min(1)
+	.max(253)
+	.refine((target) => parseEgressTarget(target) !== null, "Enter a hostname or IP address, host:port, or http(s) URL");
+
 //****************************************
 // Settings Validations
 //****************************************
@@ -42,6 +53,11 @@ export const updateAppSettingsBodyValidation = z
 			.optional(),
 		globalProxyEnabled: z.boolean().optional(),
 		globalProxyId: z.string().nullable().optional(),
+
+		egressCheckEnabled: z.boolean().optional(),
+		egressCheckTargets: z.array(egressTargetValidation).max(MAX_EGRESS_TARGETS).optional(), // empty list falls back to DEFAULT_EGRESS_TARGETS
+		egressPollIntervalSeconds: z.number().int().min(MIN_EGRESS_POLL_INTERVAL_SECONDS).max(MAX_EGRESS_POLL_INTERVAL_SECONDS).optional(),
+		egressNotifications: z.array(z.string().regex(/^[0-9a-fA-F]{24}$/, "Invalid notification id")).optional(),
 	})
 	.strip()
 	.superRefine((body, ctx) => {

server/src/config/controllers.ts

@@ -36,7 +36,12 @@ export const initializeControllers = (apiServices: ApiServices): InitializedCont
 	return {
 		authController: new AuthController(apiServices.userService),
 		monitorController: new MonitorController(apiServices.monitorService, apiServices.notificationsService),
-		settingsController: new SettingsController(apiServices.settingsService, apiServices.emailService, apiServices.proxiesService),
+		settingsController: new SettingsController(
+			apiServices.settingsService,
+			apiServices.emailService,
+			apiServices.proxiesService,
+			apiServices.egressStateService
+		),
 		checkController: new CheckController(apiServices.checkService),
 		geoCheckController: new GeoCheckController(apiServices.geoChecksService),
 		inviteController: new InviteController(apiServices.inviteService),

server/src/config/envValidation.ts

@@ -3,6 +3,39 @@ import { DbTypes, LogLevels, QueueModes } from "@/domain/app-settings/app-settin
 import { booleanCoercion } from "@/api/validation/shared.js";
 import { ILogger } from "@/utils/logger.js";
 
+// Padded standard base64 of exactly 32 bytes, as produced by `openssl rand -base64 32`
+const ENCRYPTION_KEY_ENTRY = /^[A-Za-z0-9+/]{43}=$/;
+
+export const encryptionKeyList = z
+	.string()
+	.optional()
+	.transform((raw, ctx) => {
+		if (raw === undefined) return [];
+		const entries = raw
+			.split(",")
+			.map((entry, index) => ({ entry: entry.trim(), slot: index + 1 }))
+			.filter(({ entry }) => entry.length > 0);
+		const seen = new Set<string>();
+		const keys: Buffer[] = [];
+		entries.forEach(({ entry, slot }) => {
+			if (!ENCRYPTION_KEY_ENTRY.test(entry)) {
+				ctx.addIssue({
+					code: "custom",
+					message: `ENCRYPTION_KEY entry ${slot} must be 32 bytes as padded standard base64 (openssl rand -base64 32)`,
+				});
+				return;
+			}
+			const decoded = Buffer.from(entry, "base64");
+			const fingerprint = decoded.toString("hex");
+			if (seen.has(fingerprint)) {
+				ctx.addIssue({ code: "custom", message: `ENCRYPTION_KEY entry ${slot} duplicates an earlier entry` });
+			}
+			seen.add(fingerprint);
+			keys.push(decoded);
+		});
+		return keys;
+	});
+
 const envSchema = z.object({
 	// Server Configuration
 	PORT: z.string().default("52345"),
@@ -36,6 +69,9 @@ const envSchema = z.object({
 
 	// Feature flags
 	STATUS_PAGE_THEMES_ENABLED: booleanCoercion.default(true),
+
+	// Encryption
+	ENCRYPTION_KEY: encryptionKeyList,
 });
 
 export type ValidatedEnv = z.infer<typeof envSchema>;

server/src/config/services.api.ts

@@ -7,6 +7,7 @@ import { ITagsService, TagsService } from "@/domain/tags/tag.service.js";
 import { IUserService, UserService } from "@/domain/users/user.service.js";
 import { IJobScheduler } from "@/worker/worker.interface.js";
 import { ProxiesService, IProxiesService } from "@/domain/proxies/proxy.service.js";
+import { EgressStateService, IEgressStateService } from "@/domain/egress/egress-state.service.js";
 import { SharedServices } from "@/config/services.shared.js";
 
 // Third-party
@@ -24,6 +25,7 @@ export interface ApiServices extends SharedServices {
 	tagsService: ITagsService;
 	diagnosticService: IDiagnosticService;
 	proxiesService: IProxiesService;
+	egressStateService: IEgressStateService;
 }
 
 export const buildApi = (shared: SharedServices, jobScheduler: IJobScheduler): ApiServices => {
@@ -35,6 +37,7 @@ export const buildApi = (shared: SharedServices, jobScheduler: IJobScheduler): A
 		monitorsRepository,
 		checksRepository,
 		geoChecksRepository,
+		dockerLogsRepository,
 		monitorStatsRepository,
 		statusPagesRepository,
 		usersRepository,
@@ -47,6 +50,7 @@ export const buildApi = (shared: SharedServices, jobScheduler: IJobScheduler): A
 		maintenanceWindowsRepository,
 		jobsRepository,
 		proxiesRepository,
+		egressStateRepository,
 	} = shared;
 
 	const userService = new UserService({
@@ -75,9 +79,11 @@ export const buildApi = (shared: SharedServices, jobScheduler: IJobScheduler): A
 		monitorsRepository,
 		checksRepository,
 		geoChecksRepository,
+		dockerLogsRepository,
 		monitorStatsRepository,
 		statusPagesRepository,
 		incidentsRepository,
+		encryptionService: shared.encryptionService,
 	});
 
 	const maintenanceWindowService = new MaintenanceWindowService({
@@ -97,6 +103,7 @@ export const buildApi = (shared: SharedServices, jobScheduler: IJobScheduler): A
 	const tagsService = new TagsService(tagsRepository, monitorsRepository);
 	const diagnosticService = new DiagnosticService(db);
 	const proxiesService = new ProxiesService(proxiesRepository, monitorsRepository, settingsService);
+	const egressStateService = new EgressStateService(egressStateRepository, jobsRepository);
 	return {
 		...shared,
 		worker: jobScheduler,
@@ -108,5 +115,6 @@ export const buildApi = (shared: SharedServices, jobScheduler: IJobScheduler): A
 		tagsService,
 		diagnosticService,
 		proxiesService,
+		egressStateService,
 	};
 };

server/src/config/services.shared.ts

@@ -1,6 +1,6 @@
 import { Mongoose } from "mongoose";
 import { hostname } from "node:os";
-import { randomUUID } from "node:crypto";
+import * as nodeCrypto from "node:crypto";
 import fs from "fs";
 import path from "path";
 import nodemailer from "nodemailer";
@@ -13,12 +13,14 @@ import { IDb } from "@/db/db.interface.js";
 import { ISettingsService, EnvConfig, SettingsService } from "@/domain/app-settings/app-settings.service.js";
 import { ICheckService, CheckService } from "@/domain/checks/check.service.js";
 import { IGeoChecksService, GeoChecksService } from "@/domain/geo-checks/geo-check.service.js";
+import { IDockerLogsService, DockerLogsService } from "@/domain/docker/docker-log.service.js";
 import { IIncidentService, IncidentService } from "@/domain/incidents/incident.service.js";
 import { INotificationMessageBuilder, NotificationMessageBuilder } from "@/domain/notifications/notification.message-builder.js";
 import { INotificationsService, NotificationsService } from "@/domain/notifications/notification.service.js";
 import { IEmailService, EmailService } from "@/service/emailService.js";
 import { GlobalPingService } from "@/service/globalPingService.js";
 import { ILogger } from "@/utils/logger.js";
+import { IEncryptionService, EncryptionService } from "@/service/encryption/encryptionService.js";
 
 // Notification providers
 import type { NotificationProviderRegistry } from "@/domain/notifications/notification.service.js";
@@ -32,6 +34,7 @@ import { MatrixProvider } from "@/domain/notifications/providers/matrix.js";
 import { TeamsProvider } from "@/domain/notifications/providers/teams.js";
 import { TelegramProvider } from "@/domain/notifications/providers/telegram.js";
 import { PushoverProvider } from "@/domain/notifications/providers/pushover.js";
+import { SignalgridProvider } from "@/domain/notifications/providers/signalgrid.js";
 import { TwilioProvider } from "@/domain/notifications/providers/twilio.js";
 import { NtfyProvider } from "@/domain/notifications/providers/ntfy.js";
 
@@ -53,11 +56,13 @@ import { ITagsRepository } from "@/domain/tags/tag.repository.interface.js";
 import { ITeamsRepository } from "@/domain/teams/team.repository.interface.js";
 import { IUsersRepository } from "@/domain/users/user.repository.interface.js";
 import { IProxiesRepository } from "@/domain/proxies/proxy.repository.interface.js";
+import { IEgressStateRepository } from "@/domain/egress/egress-state.repository.interface.js";
 
 // Mongo repository implementations
 import MongoSettingsRepository from "@/domain/app-settings/app-settings.repository.mongo.js";
 import MongoChecksRepository from "@/domain/checks/check.repository.mongo.js";
 import MongoGeoChecksRepository from "@/domain/geo-checks/geo-check.repository.mongo.js";
+import MongoDockerLogsRepository from "@/domain/docker/docker-log.repository.mongo.js";
 import MongoIncidentsRepository from "@/domain/incidents/incident.repository.mongo.js";
 import MongoInvitesRepository from "@/domain/invites/invite.repository.mongo.js";
 import MongoJobsRepository from "@/domain/jobs/job.repository.mongo.js";
@@ -72,6 +77,8 @@ import MongoTagsRepository from "@/domain/tags/tag.repository.mongo.js";
 import MongoTeamsRepository from "@/domain/teams/team.repository.model.js";
 import MongoUsersRepository from "@/domain/users/user.repository.mongo.js";
 import MongoProxiesRepository from "@/domain/proxies/proxy.repository.mongo.js";
+import MongoEgressStateRepository from "@/domain/egress/egress-state.repository.mongo.js";
+import { IDockerLogsRepository } from "@/domain/docker/docker-log.repository.interface.js";
 
 // Shared infrastructure + business services that both the API and the worker process construct.
 export interface SharedServices {
@@ -79,10 +86,12 @@ export interface SharedServices {
 	db: IDb<Mongoose>;
 	settingsService: ISettingsService;
 	emailService: IEmailService;
+	encryptionService: IEncryptionService;
 	notificationMessageBuilder: INotificationMessageBuilder;
 	incidentService: IIncidentService;
 	checkService: ICheckService;
 	geoChecksService: IGeoChecksService;
+	dockerLogsService: IDockerLogsService;
 	notificationsService: INotificationsService;
 
 	// Queue identity (one per process; the worker reuses these)
@@ -94,6 +103,7 @@ export interface SharedServices {
 	monitorsRepository: IMonitorsRepository;
 	checksRepository: IChecksRepository;
 	geoChecksRepository: IGeoChecksRepository;
+	dockerLogsRepository: IDockerLogsRepository;
 	monitorStatsRepository: IMonitorStatsRepository;
 	statusPagesRepository: IStatusPagesRepository;
 	usersRepository: IUsersRepository;
@@ -106,19 +116,25 @@ export interface SharedServices {
 	teamsRepository: ITeamsRepository;
 	maintenanceWindowsRepository: IMaintenanceWindowsRepository;
 	proxiesRepository: IProxiesRepository;
+	egressStateRepository: IEgressStateRepository;
 }
 
 export const buildShared = async ({
 	logger,
 	envSettings,
 	settingsService,
+	encryptionKeys,
 }: {
 	logger: ILogger;
 	envSettings: EnvConfig;
 	settingsService: ISettingsService;
+	encryptionKeys: Buffer[];
 }): Promise<SharedServices> => {
 	// Shared worker ID
-	const workerId = `${hostname()}:${process.pid}:${randomUUID()}`;
+	const workerId = `${hostname()}:${process.pid}:${nodeCrypto.randomUUID()}`;
+
+	// Create the encryption service
+	const encryptionService = new EncryptionService(encryptionKeys, logger, nodeCrypto);
 
 	// Create DB
 	let db: IDb<Mongoose> | null = null;
@@ -131,6 +147,7 @@ export const buildShared = async ({
 	const incidentsRepository = new MongoIncidentsRepository();
 	const usersRepository = new MongoUsersRepository();
 	const geoChecksRepository = new MongoGeoChecksRepository();
+	const dockerLogsRepository = new MongoDockerLogsRepository();
 	const notificationsRepository = new MongoNotificationsRepository();
 	const jobsRepository = new MongoJobsRepository(workerId);
 	const queueWorkersRepository = new MongoQueueWorkersRepository();
@@ -143,6 +160,7 @@ export const buildShared = async ({
 	const teamsRepository = new MongoTeamsRepository();
 	const maintenanceWindowsRepository = new MongoMaintenanceWindowsRepository();
 	const proxiesRepository = new MongoProxiesRepository();
+	const egressStateRepository = new MongoEgressStateRepository();
 
 	// Inject settings repository into settings service (now that DB is connected)
 	(settingsService as SettingsService).setRepository(settingsRepository);
@@ -161,6 +179,7 @@ export const buildShared = async ({
 		monitorsRepository,
 	});
 
+	const dockerLogsService = new DockerLogsService({ logger, dockerLogsRepository });
 	const webhookProvider = new WebhookProvider(logger);
 	const rocketChatProvider = new RocketChatProvider(logger);
 	const slackProvider = new SlackProvider(logger);
@@ -171,6 +190,7 @@ export const buildShared = async ({
 	const teamsProvider = new TeamsProvider(logger);
 	const telegramProvider = new TelegramProvider(logger);
 	const pushoverProvider = new PushoverProvider(logger);
+	const signalgridProvider = new SignalgridProvider(logger);
 	const twilioProvider = new TwilioProvider(logger);
 	const ntfyProvider = new NtfyProvider(logger);
 
@@ -185,6 +205,7 @@ export const buildShared = async ({
 		teams: teamsProvider,
 		telegram: telegramProvider,
 		pushover: pushoverProvider,
+		signalgrid: signalgridProvider,
 		twilio: twilioProvider,
 		ntfy: ntfyProvider,
 	};
@@ -203,10 +224,12 @@ export const buildShared = async ({
 		db,
 		settingsService,
 		emailService,
+		encryptionService,
 		notificationMessageBuilder,
 		incidentService,
 		checkService,
 		geoChecksService,
+		dockerLogsService,
 		notificationsService,
 		workerId,
 		jobsRepository,
@@ -214,6 +237,7 @@ export const buildShared = async ({
 		queueWorkersRepository,
 		checksRepository,
 		geoChecksRepository,
+		dockerLogsRepository,
 		monitorStatsRepository,
 		statusPagesRepository,
 		usersRepository,
@@ -226,6 +250,7 @@ export const buildShared = async ({
 		teamsRepository,
 		maintenanceWindowsRepository,
 		proxiesRepository,
+		egressStateRepository,
 	};
 	return sharedServices;
 };

server/src/config/services.worker.ts

@@ -16,6 +16,7 @@ import { SharedServices } from "@/config/services.shared.js";
 import { INetworkService, NetworkService } from "@/service/networkService.js";
 import { IBufferService, BufferService } from "@/service/bufferService.js";
 import { IStatusService, StatusService } from "@/service/statusService.js";
+import { SecretsRotationService } from "@/service/encryption/secretsRotationService.js";
 import { IQueueWorker } from "@/worker/worker.interface.js";
 import { MonitorStatusPolicy } from "@/worker/worker.monitor-status-policy.js";
 import { WorkerHelper } from "@/worker/worker.helper.js";
@@ -27,6 +28,7 @@ import { IncidentReactor } from "@/worker/reactors/reactor.incident.js";
 import { ReactorDispatcher } from "@/worker/reactors/reactor.dispatcher.js";
 import { DBQueueWorker } from "@/worker/worker.db-queue.js";
 import { ProxyResolver } from "@/service/network/ProxyResolver.js";
+import { IEgressService, EgressService } from "@/domain/egress/egress.service.js";
 // Network providers
 import { PingProvider } from "@/service/network/PingProvider.js";
 import { HttpProvider } from "@/service/network/HttpProvider.js";
@@ -39,11 +41,13 @@ import { GameProvider } from "@/service/network/GameProvider.js";
 import { GrpcProvider } from "@/service/network/GrpcProvider.js";
 import { WebSocketProvider } from "@/service/network/WebSocketProvider.js";
 import { DNSProvider } from "@/service/network/DNSProvider.js";
+import { AppError } from "@/utils/AppError.js";
 export interface WorkerServices {
 	worker: IQueueWorker;
 	networkService: INetworkService;
 	bufferService: IBufferService;
 	statusService: IStatusService;
+	egressService: IEgressService;
 }
 
 export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig): Promise<WorkerServices> => {
@@ -52,29 +56,33 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 		settingsService,
 		checkService,
 		geoChecksService,
+		dockerLogsService,
 		notificationsService,
 		incidentService,
 		workerId,
 		jobsRepository,
 		queueWorkersRepository,
 		monitorsRepository,
+		encryptionService,
 		checksRepository,
 		geoChecksRepository,
+		dockerLogsRepository,
 		monitorStatsRepository,
 		incidentsRepository,
 		teamsRepository,
 		maintenanceWindowsRepository,
 		proxiesRepository,
+		egressStateRepository,
 	} = shared;
 
 	// ***********************
 	// Network providers
 	// ***********************
-	const pingProvider = new PingProvider(ping);
+	const pingProvider = new PingProvider(ping, net);
 	const httpProvider = new HttpProvider(got, new AdvancedMatcher(jmespath));
 	const pageSpeedProvider = new PageSpeedProvider(httpProvider, settingsService, logger);
 	const hardwareProvider = new HardwareProvider(httpProvider);
-	const dockerProvider = new DockerProvider(logger, Docker);
+	const dockerProvider = new DockerProvider(logger, Docker, encryptionService);
 	const portProvider = new PortProvider(net);
 	const gameProvider = new GameProvider(logger, GameDig);
 	const grpcProvider = new GrpcProvider(grpc, protoLoader);
@@ -95,9 +103,10 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 	]);
 
 	const proxyResolver = new ProxyResolver(proxiesRepository, settingsService, logger);
-	const bufferService = new BufferService(logger, checkService, geoChecksService, settingsService, jobsRepository);
+	const bufferService = new BufferService(logger, checkService, geoChecksService, dockerLogsService, settingsService, jobsRepository);
 	const statusService = new StatusService(logger, monitorsRepository, monitorStatsRepository);
 	const monitorStatusPolicy = new MonitorStatusPolicy();
+	const egressService = new EgressService(settingsService, egressStateRepository, jobsRepository, networkService, proxyResolver, logger);
 
 	// ***********************
 	// Reactors and dispatcher
@@ -119,6 +128,7 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 		networkService,
 		proxyResolver,
 		bufferService,
+		dockerLogsService,
 		logger
 	);
 	const checkEvaluator = new CheckEvaluator(statusService, monitorStatusPolicy);
@@ -138,7 +148,9 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 		monitorStatsRepository,
 		checksRepository,
 		incidentsRepository,
-		geoChecksRepository
+		geoChecksRepository,
+		dockerLogsRepository,
+		egressService
 	);
 
 	const worker = await DBQueueWorker.create({
@@ -160,5 +172,23 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 		workerId,
 	});
 
-	return { worker, networkService, bufferService, statusService };
+	const secretsRotationService = new SecretsRotationService(monitorsRepository, encryptionService, logger);
+	try {
+		const result = await secretsRotationService.run();
+		logger.debug({
+			message: "Secrets rotation run successfully",
+			service: "WorkerServices",
+			method: "buildWorker",
+			details: { ...result },
+		});
+	} catch (error: unknown) {
+		logger.warn({
+			message: `Could not rotate Docker TLS secrets: ${error instanceof Error ? error.message : String(error)}`,
+			service: "WorkerServices",
+			method: "buildWorker",
+			details: { ...(error instanceof AppError ? error.details : {}) },
+		});
+	}
+
+	return { worker, networkService, bufferService, statusService, egressService };
 };

server/src/db/migration/0012_migrateDockerMonitorUrls.ts

@@ -7,8 +7,8 @@ import type { ILogger } from "@/utils/logger.js";
  * The old docker provider interpreted monitor.url as a container name/ID and only
  * ever talked to the local socket, so every pre-existing docker monitor's host is
  * definitionally unix:///var/run/docker.sock. The container name is preserved in
- * the description. Urls already in host form (unix://, ssh://, or an absolute
- * socket path) are left untouched, which makes the migration idempotent.
+ * the description. Urls already in host form (unix:// or an absolute socket
+ * path) are left untouched, which makes the migration idempotent.
  */
 export async function migrateDockerMonitorUrls(logger: ILogger): Promise<void> {
 	const SERVICE_NAME = "Migration:MigrateDockerMonitorUrls";
@@ -16,7 +16,7 @@ export async function migrateDockerMonitorUrls(logger: ILogger): Promise<void> {
 	try {
 		logger.info({ service: SERVICE_NAME, message: "Starting docker monitor url migration" });
 
-		const result = await MonitorModel.updateMany({ type: "docker", url: { $not: /^((unix|ssh):\/\/|\/)/ } }, [
+		const result = await MonitorModel.updateMany({ type: "docker", url: { $not: /^(unix:\/\/|\/)/ } }, [
 			{
 				$set: {
 					description: {

server/src/domain/app-settings/app-settings-repository.interface.ts

@@ -6,6 +6,7 @@ export interface ISettingsRepository {
 	findSingleton(): Promise<Settings | null>;
 	// update
 	update(settings: SettingsUpdate): Promise<Settings>;
+	removeEgressNotification(notificationId: string): Promise<void>; // $pull, so it cannot race a concurrent settings update
 	// delete
 	deleteLegacy: () => Promise<boolean>;
 }

server/src/domain/app-settings/app-settings.model.ts

@@ -1,5 +1,6 @@
 import { Schema, model, type Types } from "mongoose";
 import type { Settings, SettingsThresholds } from "@/domain/app-settings/app-settings.type.js";
+import { DEFAULT_EGRESS_POLL_INTERVAL_SECONDS, DEFAULT_EGRESS_TARGETS } from "@/domain/egress/egress.type.js";
 
 interface AppSettingsDocument extends Omit<Settings, "id" | "createdAt" | "updatedAt"> {
 	_id: Types.ObjectId;
@@ -42,6 +43,10 @@ const AppSettingsSchema = new Schema<AppSettingsDocument>(
 		globalThresholds: { type: thresholdsSchema },
 		globalProxyEnabled: { type: Boolean, default: false },
 		globalProxyId: { type: String, default: null },
+		egressCheckEnabled: { type: Boolean, default: false },
+		egressCheckTargets: { type: [String], default: () => [...DEFAULT_EGRESS_TARGETS] },
+		egressPollIntervalSeconds: { type: Number, default: DEFAULT_EGRESS_POLL_INTERVAL_SECONDS },
+		egressNotifications: { type: [String], default: () => [] }, // Notification ids, stored as strings like globalProxyId
 	},
 	{ timestamps: true }
 );

server/src/domain/app-settings/app-settings.repository.mongo.ts

@@ -3,6 +3,7 @@ import { ISettingsRepository } from "@/domain/app-settings/app-settings-reposito
 import type { Settings, SettingsUpdate } from "@/domain/app-settings/app-settings.type.js";
 import { AppSettingsModel, type AppSettingsDocument } from "@/domain/app-settings/app-settings.model.js";
 import { toStringId, toDateString } from "@/utils/mongoMappers.js";
+import { DEFAULT_EGRESS_POLL_INTERVAL_SECONDS, DEFAULT_EGRESS_TARGETS } from "@/domain/egress/egress.type.js";
 
 class MongoSettingsRepository implements ISettingsRepository {
 	private toEntity = (doc: AppSettingsDocument): Settings => {
@@ -30,6 +31,10 @@ class MongoSettingsRepository implements ISettingsRepository {
 			globalThresholds: doc.globalThresholds ?? undefined,
 			globalProxyEnabled: doc.globalProxyEnabled ?? false,
 			globalProxyId: doc.globalProxyId ?? undefined,
+			egressCheckEnabled: doc.egressCheckEnabled ?? false,
+			egressCheckTargets: doc.egressCheckTargets ?? [...DEFAULT_EGRESS_TARGETS],
+			egressPollIntervalSeconds: doc.egressPollIntervalSeconds ?? DEFAULT_EGRESS_POLL_INTERVAL_SECONDS,
+			egressNotifications: doc.egressNotifications ?? [],
 			createdAt: toDateString(doc.createdAt),
 			updatedAt: toDateString(doc.updatedAt),
 		};
@@ -79,6 +84,10 @@ class MongoSettingsRepository implements ISettingsRepository {
 		return this.toEntity(updatedSettings);
 	};
 
+	removeEgressNotification = async (notificationId: string) => {
+		await AppSettingsModel.updateMany({ egressNotifications: notificationId }, { $pull: { egressNotifications: notificationId } });
+	};
+
 	deleteLegacy = async () => {
 		const res = await AppSettingsModel.deleteMany({ version: { $exists: false } });
 		return res.deletedCount > 0;

server/src/domain/app-settings/app-settings.service.ts

@@ -23,15 +23,27 @@ export interface ISettingsService {
 	getSettings(): EnvConfig;
 	areStatusPageThemesEnabled(): boolean;
 	getDBSettings(): Promise<Settings>;
+	getCachedDBSettings(): Promise<Settings>;
 	updateDbSettings(newSettings: SettingsUpdate): Promise<Settings>;
+	removeEgressNotification(notificationId: string): Promise<void>;
 }
 
+const DB_SETTINGS_CACHE_TTL_MS = 60_000;
+
+type CachedSettings = {
+	value: Promise<Settings>;
+	expiresAt: number;
+};
 export class SettingsService implements ISettingsService {
 	static SERVICE_NAME = SERVICE_NAME;
 	private settings: EnvConfig;
 	private settingsRepository: ISettingsRepository | null = null;
+	private dbSettingsCache: CachedSettings | null = null;
 
-	constructor(env: ValidatedEnv) {
+	constructor(
+		env: ValidatedEnv,
+		private dbSettingsTTLMs: number = DB_SETTINGS_CACHE_TTL_MS
+	) {
 		this.settings = {
 			jwtSecret: env.JWT_SECRET,
 			jwtTTL: env.TOKEN_TTL as StringValue,
@@ -75,7 +87,14 @@ export class SettingsService implements ISettingsService {
 	}
 
 	updateDbSettings = async (newSettings: SettingsUpdate) => {
-		return await this.getRepository().update(newSettings);
+		const updated = await this.getRepository().update(newSettings);
+		this.dbSettingsCache = null;
+		return updated;
+	};
+
+	removeEgressNotification = async (notificationId: string) => {
+		await this.getRepository().removeEgressNotification(notificationId);
+		this.dbSettingsCache = null;
 	};
 
 	getDBSettings = async () => {
@@ -95,4 +114,17 @@ export class SettingsService implements ISettingsService {
 
 		return settings;
 	};
+
+	getCachedDBSettings = async () => {
+		const hit = this.dbSettingsCache;
+		if (hit && hit.expiresAt > Date.now()) {
+			return hit.value;
+		}
+		const entry: CachedSettings = { value: this.getDBSettings(), expiresAt: Date.now() + this.dbSettingsTTLMs };
+		this.dbSettingsCache = entry;
+		entry.value.catch(() => {
+			if (this.dbSettingsCache === entry) this.dbSettingsCache = null;
+		});
+		return entry.value;
+	};
 }

server/src/domain/app-settings/app-settings.type.ts

@@ -51,6 +51,11 @@ export interface Settings {
 	globalThresholds?: SettingsThresholds;
 	globalProxyEnabled: boolean;
 	globalProxyId?: string | null;
+	// Egress self-check (see domain/egress)
+	egressCheckEnabled: boolean;
+	egressCheckTargets: string[];
+	egressPollIntervalSeconds: number; // recovery poll cadence while degraded, not a general schedule
+	egressNotifications: string[]; // Notification ids to receive the "egress recovered" alert
 	createdAt: string;
 	updatedAt: string;
 }

server/src/domain/checks/check.model.ts

@@ -22,7 +22,7 @@ import {
 	DockerContainerSummary,
 	DockerHealthStatuses,
 	DockerPortProtocols,
-} from "@/types/network.js";
+} from "@/domain/docker/docker.type.js";
 
 type CheckMetadataDocument = Omit<CheckMetadata, "monitorId" | "teamId"> & {
 	monitorId: Types.ObjectId;

server/src/domain/checks/check.snapshot.ts

@@ -11,7 +11,7 @@ import type {
 	SnapshotHostInfo,
 	SnapshotMemoryInfo,
 } from "@/domain/checks/check.type.js";
-import { DockerContainerSummary } from "@/types/network.js";
+import { DockerContainerSummary } from "@/domain/docker/docker.type.js";
 import { toDateString } from "@/utils/mongoMappers.js";
 
 export type CheckSnapshotSource = Pick<

server/src/domain/checks/check.type.ts

@@ -1,5 +1,5 @@
 import type { MonitorType } from "@/domain/monitors/monitor.type.js";
-import { DockerContainerInfo, DockerContainerSummary } from "@/types/network.js";
+import { DockerContainerInfo, DockerContainerSummary } from "@/domain/docker/docker.type.js";
 import type { Response } from "got";
 
 export const CHECK_TTL_SENTINEL = 366;

server/src/domain/docker/docker-log.model.ts

@@ -0,0 +1,60 @@
+import { Schema, model, Types } from "mongoose";
+import { DockerLogStreams, type DockerLogLine } from "@/domain/docker/docker.type.js";
+import type { DockerLog, DockerLogMetadata } from "@/domain/docker/docker-log.type.js";
+
+type DockerLogMetadataDocument = Omit<DockerLogMetadata, "monitorId" | "teamId"> & {
+	monitorId: Types.ObjectId;
+	teamId: Types.ObjectId;
+};
+
+type DockerLogDocumentBase = Omit<DockerLog, "id" | "metadata" | "checkedAt" | "expiry" | "createdAt" | "updatedAt"> & {
+	metadata: DockerLogMetadataDocument;
+	checkedAt: Date;
+	expiry: Date;
+	createdAt: Date;
+	updatedAt: Date;
+};
+
+export interface DockerLogDocument extends DockerLogDocumentBase {
+	_id: Types.ObjectId;
+}
+
+const dockerLogMetadataSchema = new Schema<DockerLogMetadataDocument>(
+	{
+		monitorId: { type: Schema.Types.ObjectId, required: true },
+		teamId: { type: Schema.Types.ObjectId, required: true },
+		containerId: { type: String, required: true },
+		containerName: { type: String, required: true },
+	},
+	{ _id: false }
+);
+
+const dockerLogLineSchema = new Schema<DockerLogLine>(
+	{
+		ts: { type: String, required: true },
+		stream: { type: String, enum: DockerLogStreams, required: true },
+		text: { type: String, default: "" },
+	},
+	{ _id: false }
+);
+
+const DockerLogSchema = new Schema<DockerLogDocument>(
+	{
+		metadata: { type: dockerLogMetadataSchema, required: true },
+		lines: { type: [dockerLogLineSchema], required: true, default: [] },
+		gap: { type: Boolean, default: false },
+		checkedAt: { type: Date, required: true },
+		expiry: { type: Date, required: true, index: { expires: 0 } }, // TTL: Mongo deletes the doc once `expiry` passes
+	},
+	{ timestamps: true }
+);
+
+DockerLogSchema.index({ "metadata.monitorId": 1, "metadata.containerName": 1, checkedAt: -1 }); // API paging
+DockerLogSchema.index({ "metadata.monitorId": 1, "metadata.containerId": 1, checkedAt: -1 }); // cursor seed
+DockerLogSchema.index({ "metadata.teamId": 1 });
+
+const DockerLogModel = model<DockerLogDocument>("DockerLog", DockerLogSchema);
+
+export type { DockerLogMetadataDocument };
+export { DockerLogModel };
+export default DockerLogModel;

server/src/domain/docker/docker-log.repository.interface.ts

@@ -0,0 +1,10 @@
+import { DockerLog } from "@/domain/docker/docker-log.type.js";
+
+export interface IDockerLogsRepository {
+	createDockerLogs(logs: Omit<DockerLog, "id" | "createdAt" | "updatedAt">[]): Promise<number>;
+	findLastLineTimestamp(monitorId: string, containerId: string): Promise<string | null>;
+	findByContainerName(args: { monitorId: string; containerName: string; before?: Date; after?: Date; limit: number }): Promise<DockerLog[]>;
+	deleteByMonitorId(monitorId: string): Promise<number>;
+	deleteByTeamId(teamId: string): Promise<number>;
+	deleteByMonitorIdsNotIn(monitorIds: string[]): Promise<number>;
+}

server/src/domain/docker/docker-log.repository.mongo.ts

@@ -0,0 +1,99 @@
+import DockerLogModel, { DockerLogDocument } from "@/domain/docker/docker-log.model.js";
+import { IDockerLogsRepository } from "@/domain/docker/docker-log.repository.interface.js";
+import { DockerLog } from "@/domain/docker/docker-log.type.js";
+import { toDateString, toStringId } from "@/utils/mongoMappers.js";
+import mongoose from "mongoose";
+
+const SERVICE_NAME = "DockerLogsRepository";
+
+class MongoDockerLogsRepository implements IDockerLogsRepository {
+	static SERVICE_NAME = SERVICE_NAME;
+
+	private toEntity = (doc: DockerLogDocument): DockerLog => {
+		return {
+			id: toStringId(doc._id),
+			metadata: {
+				monitorId: toStringId(doc.metadata.monitorId),
+				teamId: toStringId(doc.metadata.teamId),
+				containerId: doc.metadata.containerId,
+				containerName: doc.metadata.containerName,
+			},
+			lines: (doc.lines ?? []).map((line) => ({ ts: line.ts, stream: line.stream, text: line.text ?? "" })),
+			gap: doc.gap ?? false,
+			checkedAt: toDateString(doc.checkedAt),
+			expiry: toDateString(doc.expiry),
+			createdAt: toDateString(doc.createdAt),
+			updatedAt: toDateString(doc.updatedAt),
+		};
+	};
+
+	createDockerLogs = async (logs: Omit<DockerLog, "id" | "createdAt" | "updatedAt">[]): Promise<number> => {
+		if (logs.length === 0) return 0;
+		const docs = await DockerLogModel.insertMany(
+			logs.map((log) => {
+				return {
+					metadata: {
+						monitorId: new mongoose.Types.ObjectId(log.metadata.monitorId),
+						teamId: new mongoose.Types.ObjectId(log.metadata.teamId),
+						containerId: log.metadata.containerId,
+						containerName: log.metadata.containerName,
+					},
+					lines: log.lines,
+					gap: log.gap,
+					checkedAt: new Date(log.checkedAt),
+					expiry: new Date(log.expiry),
+				};
+			}),
+			{ ordered: false }
+		);
+		return docs.length;
+	};
+
+	findLastLineTimestamp = async (monitorId: string, containerId: string): Promise<string | null> => {
+		const doc = await DockerLogModel.findOne({
+			"metadata.monitorId": new mongoose.Types.ObjectId(monitorId),
+			"metadata.containerId": containerId,
+		})
+			.sort({ checkedAt: -1 })
+			.select({ lines: { $slice: -1 } })
+			.lean<Pick<DockerLogDocument, "lines">>();
+		return doc?.lines?.[0]?.ts ?? null;
+	};
+
+	findByContainerName = async ({
+		monitorId,
+		containerName,
+		before,
+		after,
+		limit,
+	}: {
+		monitorId: string;
+		containerName: string;
+		before?: Date;
+		after?: Date;
+		limit: number;
+	}): Promise<DockerLog[]> => {
+		const docs = await DockerLogModel.find({
+			"metadata.monitorId": new mongoose.Types.ObjectId(monitorId),
+			"metadata.containerName": containerName,
+			...(before ? { checkedAt: { $lt: before } } : {}),
+			...(after ? { checkedAt: { $gt: after } } : {}),
+		})
+			.sort({ checkedAt: after ? 1 : -1 })
+			.limit(limit)
+			.lean<DockerLogDocument[]>();
+		const entities = docs.map(this.toEntity);
+		return after ? entities.reverse() : entities;
+	};
+
+	deleteByMonitorId = async (monitorId: string) =>
+		(await DockerLogModel.deleteMany({ "metadata.monitorId": new mongoose.Types.ObjectId(monitorId) })).deletedCount ?? 0;
+
+	deleteByTeamId = async (teamId: string) =>
+		(await DockerLogModel.deleteMany({ "metadata.teamId": new mongoose.Types.ObjectId(teamId) })).deletedCount ?? 0;
+
+	deleteByMonitorIdsNotIn = async (monitorIds: string[]) =>
+		(await DockerLogModel.deleteMany({ "metadata.monitorId": { $nin: monitorIds.map((id) => new mongoose.Types.ObjectId(id)) } })).deletedCount ?? 0;
+}
+
+export default MongoDockerLogsRepository;

server/src/domain/docker/docker-log.service.ts

@@ -0,0 +1,100 @@
+import { IDockerLogsRepository } from "@/domain/docker/docker-log.repository.interface.js";
+import { DOCKER_LOG_RETENTION_DAYS, DockerLog } from "@/domain/docker/docker-log.type.js";
+import { DOCKER_LOG_TAIL_LINES, DockerLogLine } from "@/domain/docker/docker.type.js";
+import { DockerStatusPayload, MonitorStatusResponse } from "@/types/network.js";
+import { ILogger } from "@/utils/logger.js";
+import mongoose from "mongoose";
+
+const SERVICE_NAME = "DockerLogsService";
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+export interface IDockerLogsService {
+	buildDockerLogs(status: MonitorStatusResponse<DockerStatusPayload>): Promise<DockerLog[]>;
+	createDockerLogs(logs: DockerLog[]): Promise<number>;
+}
+
+export class DockerLogsService implements IDockerLogsService {
+	static SERVICE_NAME = SERVICE_NAME;
+
+	private logger: ILogger;
+	private dockerLogsRepository: IDockerLogsRepository;
+
+	private lastTimestampByContainer = new Map<string, string>();
+
+	constructor({ logger, dockerLogsRepository }: { logger: ILogger; dockerLogsRepository: IDockerLogsRepository }) {
+		this.logger = logger;
+		this.dockerLogsRepository = dockerLogsRepository;
+	}
+
+	private generateCursorKey = (monitorId: string, containerId: string) => `${monitorId}:${containerId}`;
+
+	private getLastTimestamp = async (monitorId: string, containerId: string) => {
+		const key = this.generateCursorKey(monitorId, containerId);
+		const cached = this.lastTimestampByContainer.get(key);
+		if (cached !== undefined) return cached || null;
+		const stored = await this.dockerLogsRepository.findLastLineTimestamp(monitorId, containerId);
+		this.lastTimestampByContainer.set(key, stored ?? "");
+		return stored;
+	};
+
+	private newLines = (lines: DockerLogLine[], lastTimestamp: string | null): DockerLogLine[] => {
+		return lastTimestamp
+			? lines.filter((line) => {
+					return line.ts > lastTimestamp;
+				})
+			: lines;
+	};
+
+	private maxTimestamp = (lines: DockerLogLine[]) => {
+		return lines.reduce((max, line) => (line.ts > max ? line.ts : max), "");
+	};
+
+	buildDockerLogs = async (status: MonitorStatusResponse<DockerStatusPayload>): Promise<DockerLog[]> => {
+		const payload = typeof status.payload === "object" ? status.payload : null;
+		const containerLogs = payload?.logs ?? [];
+		if (containerLogs.length === 0) return [];
+
+		const now = new Date();
+		const checkedAt = now.toISOString();
+		const expiry = new Date(now.getTime() + DOCKER_LOG_RETENTION_DAYS * MS_PER_DAY).toISOString();
+		const results: DockerLog[] = [];
+
+		for (const dockerContainerLog of containerLogs) {
+			const { containerId, containerName, lines } = dockerContainerLog;
+			try {
+				const lastTimestamp = await this.getLastTimestamp(status.monitorId, containerId);
+				const fresh = this.newLines(lines, lastTimestamp);
+				if (fresh.length === 0) continue;
+				this.lastTimestampByContainer.set(this.generateCursorKey(status.monitorId, containerId), this.maxTimestamp(fresh));
+				results.push({
+					id: new mongoose.Types.ObjectId().toString(),
+					metadata: {
+						monitorId: status.monitorId,
+						teamId: status.teamId,
+						containerId,
+						containerName,
+					},
+					lines: fresh,
+					gap: fresh.length === DOCKER_LOG_TAIL_LINES,
+					// We only fetch DOCKER_LOG_TAIL_LINES worth of logs.
+					// If we have 200 fresh logs, there _could_ be more than 200 lines, so set gap = true
+					// Client can display that some logs may be missing
+					checkedAt,
+					expiry,
+					createdAt: checkedAt,
+					updatedAt: checkedAt,
+				});
+			} catch (error: unknown) {
+				this.logger.warn({
+					message: `Failed to build docker logs for container ${containerName}`,
+					service: SERVICE_NAME,
+					method: "buildDockerLogs",
+					details: { monitorId: status.monitorId, containerId, error: error instanceof Error ? error.message : String(error) },
+				});
+			}
+		}
+		return results;
+	};
+
+	createDockerLogs = async (logs: DockerLog[]): Promise<number> => this.dockerLogsRepository.createDockerLogs(logs);
+}

server/src/domain/docker/docker-log.type.ts

@@ -0,0 +1,28 @@
+import { DockerLogLine } from "@/domain/docker/docker.type.js";
+
+export const DOCKER_LOG_RETENTION_DAYS = 7;
+export const DOCKER_LOG_PAGE_DEFAULT = 20;
+export const DOCKER_LOG_PAGE_MAX = 50;
+
+export interface DockerLogMetadata {
+	monitorId: string;
+	teamId: string;
+	containerId: string;
+	containerName: string;
+}
+
+export interface DockerLog {
+	id: string;
+	metadata: DockerLogMetadata;
+	lines: DockerLogLine[];
+	gap: boolean;
+	checkedAt: string;
+	expiry: string;
+	createdAt: string;
+	updatedAt: string;
+}
+
+export interface DockerLogPage {
+	logs: DockerLog[];
+	nextCursor: string | null;
+}

server/src/domain/docker/docker.type.ts

@@ -0,0 +1,65 @@
+export const DockerContainerStates = ["created", "running", "paused", "restarting", "removing", "exited", "dead"] as const;
+export type DockerContainerState = (typeof DockerContainerStates)[number];
+
+export const DockerHealthStatuses = ["healthy", "unhealthy", "starting", "none"] as const;
+export type DockerHealthStatus = (typeof DockerHealthStatuses)[number];
+
+export const DockerPortProtocols = ["tcp", "udp", "sctp"] as const;
+export type DockerPortProtocol = (typeof DockerPortProtocols)[number];
+
+export const DockerLogStreams = ["stdout", "stderr"] as const;
+export type DockerLogStream = (typeof DockerLogStreams)[number];
+
+export const DOCKER_LOG_TAIL_LINES = 200;
+
+export interface DockerLogLine {
+	ts: string;
+	stream: DockerLogStream;
+	text: string;
+}
+
+export interface DockerContainerLogs {
+	containerId: string;
+	containerName: string;
+	lines: DockerLogLine[];
+}
+
+export interface DockerContainerPort {
+	privatePort: number;
+	protocol: DockerPortProtocol;
+	publicPort?: number;
+	hostIp?: string;
+}
+
+export interface DockerContainerMount {
+	type: string; // open set: bind, volume, tmpfs, image, npipe, cluster, …
+	name?: string;
+	source: string;
+	destination: string;
+	mode: string;
+	rw: boolean;
+}
+
+export interface DockerContainerInfo {
+	id: string;
+	name: string;
+	image: string;
+	state: DockerContainerState;
+	status: string;
+	health: DockerHealthStatus;
+	cpuPct?: number; // fraction of one core (docker stats convention / 100); exceeds 1 when using multiple cores
+	memoryUsedBytes?: number;
+	memoryLimitBytes?: number;
+	memoryPct?: number; // 0-1 fraction of the memory limit
+	restartCount?: number;
+	startedAt?: string; // ISO date
+	ports?: DockerContainerPort[];
+	mounts?: DockerContainerMount[];
+}
+
+export interface DockerContainerSummary {
+	total: number;
+	running: number;
+	stopped: number;
+	unhealthy: number;
+}

server/src/domain/egress/egress-state.model.ts

@@ -0,0 +1,40 @@
+import { Schema, model, type Types } from "mongoose";
+import { EgressStatuses, type EgressProbeResult, type EgressState } from "@/domain/egress/egress.type.js";
+
+interface EgressStateDocument extends Omit<EgressState, "id" | "degradedSince" | "lastRecoveredAt" | "lastProbeAt" | "createdAt" | "updatedAt"> {
+	_id: Types.ObjectId;
+	singleton: boolean;
+	degradedSince: Date | null;
+	lastRecoveredAt: Date | null;
+	lastProbeAt: Date | null;
+	createdAt: Date;
+	updatedAt: Date;
+}
+
+const probeResultSchema = new Schema<EgressProbeResult>(
+	{
+		target: { type: String, required: true },
+		reachable: { type: Boolean, required: true },
+		responseTime: { type: Number, default: 0 },
+		message: { type: String },
+	},
+	{ _id: false }
+);
+
+const EgressStateSchema = new Schema<EgressStateDocument>(
+	{
+		singleton: { type: Boolean, required: true, unique: true, default: true },
+		status: { type: String, enum: EgressStatuses, required: true, default: "ok" },
+		degradedSince: { type: Date, default: null },
+		lastRecoveredAt: { type: Date, default: null },
+		lastProbeAt: { type: Date, default: null },
+		lastProbeResults: { type: [probeResultSchema], default: () => [] },
+	},
+	{ timestamps: true }
+);
+
+const EgressStateModel = model<EgressStateDocument>("EgressState", EgressStateSchema);
+
+export type { EgressStateDocument };
+export { EgressStateModel };
+export default EgressStateModel;