refactor to show multiple percentages and simplify data structure

Co-authored-by: Shelby Tucker <shelby.tucker@gmail.com>

.dockerignore

@@ -0,0 +1,48 @@
+# Node.js dependencies
+node_modules
+internalsite/node_modules
+
+# Go build artifacts and binaries
+build
+dist
+*.exe
+beszel-agent
+beszel_data*
+pb_data
+data
+temp
+
+# Development and IDE files
+.vscode
+.idea*
+*.swc
+__debug_*
+
+# Git and version control
+.git
+.gitignore
+
+# Documentation and supplemental files
+*.md
+supplemental
+freebsd-port
+
+# Test files (exclude from production builds)
+*_test.go
+coverage
+
+# Docker files
+dockerfile_*
+
+# Temporary files
+*.tmp
+*.bak
+*.log
+
+# OS specific files
+.DS_Store
+Thumbs.db
+
+# .NET build artifacts
+agent/lhm/obj
+agent/lhm/bin

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,8 +1,19 @@
 name: 🐛 Bug report
 description: Report a new bug or issue.
 title: '[Bug]: '
-labels: ['bug']
+labels: ['bug', "needs confirmation"]
 body:
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Which part of Beszel is this about?
+      options:
+        - Hub
+        - Agent
+        - Hub & Agent
+    validations:
+      required: true
   - type: markdown
     attributes:
       value: |
@@ -43,6 +54,39 @@ body:
         3. Pour it into a cup.
     validations:
       required: true
+  - type: dropdown
+    id: category
+    attributes:
+      label: Category
+      description: Which category does this relate to most?
+      options:
+        - Metrics
+        - Charts & Visualization
+        - Settings & Configuration
+        - Notifications & Alerts
+        - Authentication
+        - Installation
+        - Performance
+        - UI / UX
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: metrics
+    attributes:
+      label: Affected Metrics
+      description: If applicable, which specific metric does this relate to most?
+      options:
+        - CPU
+        - Memory
+        - Storage
+        - Network
+        - Containers
+        - GPU
+        - Sensors
+        - Other
+    validations:
+      required: true
   - type: input
     id: system
     attributes:
@@ -61,7 +105,6 @@ body:
     id: install-method
     attributes:
       label: Installation method
-      default: 0
       options:
         - Docker
         - Binary

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,8 +1,19 @@
 name: 🚀 Feature request
 description: Request a new feature or change.
 title: "[Feature]: "
-labels: ["enhancement"]
+labels: ["enhancement", "needs review"]
 body:
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Which part of Beszel is this about?
+      options:
+        - Hub
+        - Agent
+        - Hub & Agent
+    validations:
+      required: true
   - type: markdown
     attributes:
       value: Before submitting, please search existing [issues](https://github.com/henrygd/beszel/issues) and [discussions](https://github.com/henrygd/beszel/discussions) (including closed).
@@ -11,8 +22,55 @@ body:
       label: Describe the feature you would like to see
     validations:
       required: true
+  - type: textarea
+    id: motivation
+    attributes:
+      label: Motivation / Use Case
+      description: Why do you want this feature? What problem does it solve?
+    validations:
+      required: true
   - type: textarea
     attributes:
       label: Describe how you would like to see this feature implemented
     validations:
       required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Screenshots
+      description: Please attach any relevant screenshots, such as images from your current solution or similar implementations.
+    validations:
+      required: false
+  - type: dropdown
+    id: category
+    attributes:
+      label: Category
+      description: Which category does this relate to most?
+      options:
+        - Metrics
+        - Charts & Visualization
+        - Settings & Configuration
+        - Notifications & Alerts
+        - Authentication
+        - Installation
+        - Performance
+        - UI / UX
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: metrics
+    attributes:
+      label: Affected Metrics
+      description: If applicable, which specific metric does this relate to most?
+      options:
+        - CPU
+        - Memory
+        - Storage
+        - Network
+        - Containers
+        - GPU
+        - Sensors
+        - Other
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,33 @@
+## 📃 Description
+
+A short description of the pull request changes should go here and the sections below should list in detail all changes. You can remove the sections you don't need.
+
+## 📖 Documentation
+
+Add a link to the PR for [documentation](https://github.com/henrygd/beszel-docs) changes.
+
+## 🪵 Changelog
+
+### ➕ Added
+
+- one
+- two
+
+### ✏️ Changed
+
+- one
+- two
+
+### 🔧 Fixed
+
+- one
+- two
+
+### 🗑️ Removed
+
+- one
+- two
+
+## 📷 Screenshots
+
+If this PR has any UI/UX changes it's strongly suggested you add screenshots here.

.github/workflows/docker-images.yml

@@ -3,7 +3,7 @@ name: Make docker images
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
 
 jobs:
   build:
@@ -12,30 +12,138 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # henrygd/beszel
           - image: henrygd/beszel
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_Hub
+            dockerfile: ./internal/dockerfile_hub
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # henrygd/beszel-agent
           - image: henrygd/beszel-agent
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_Agent
+            dockerfile: ./internal/dockerfile_agent
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # henrygd/beszel-agent-nvidia
+          - image: henrygd/beszel-agent-nvidia
+            dockerfile: ./internal/dockerfile_agent_nvidia
+            platforms: linux/amd64
+            registry: docker.io
+            username_secret: DOCKERHUB_USERNAME
+            password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # henrygd/beszel-agent-intel
+          - image: henrygd/beszel-agent-intel
+            dockerfile: ./internal/dockerfile_agent_intel
+            platforms: linux/amd64
+            registry: docker.io
+            username_secret: DOCKERHUB_USERNAME
+            password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # henrygd/beszel-agent:alpine
+          - image: henrygd/beszel-agent
+            dockerfile: ./internal/dockerfile_agent_alpine
+            registry: docker.io
+            username_secret: DOCKERHUB_USERNAME
+            password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=alpine
+              type=semver,pattern={{version}}-alpine
+              type=semver,pattern={{major}}.{{minor}}-alpine
+              type=semver,pattern={{major}}-alpine
+
+          # ghcr.io/henrygd/beszel
           - image: ghcr.io/${{ github.repository }}/beszel
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_Hub
+            dockerfile: ./internal/dockerfile_hub
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # ghcr.io/henrygd/beszel-agent
           - image: ghcr.io/${{ github.repository }}/beszel-agent
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_Agent
+            dockerfile: ./internal/dockerfile_agent
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # ghcr.io/henrygd/beszel-agent-nvidia
+          - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
+            dockerfile: ./internal/dockerfile_agent_nvidia
+            platforms: linux/amd64
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # ghcr.io/henrygd/beszel-agent-intel
+          - image: ghcr.io/${{ github.repository }}/beszel-agent-intel
+            dockerfile: ./internal/dockerfile_agent_intel
+            platforms: linux/amd64
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # ghcr.io/henrygd/beszel-agent:alpine
+          - image: ghcr.io/${{ github.repository }}/beszel-agent
+            dockerfile: ./internal/dockerfile_agent_alpine
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=alpine
+              type=semver,pattern={{version}}-alpine
+              type=semver,pattern={{major}}.{{minor}}-alpine
+              type=semver,pattern={{major}}-alpine
+
     permissions:
       contents: read
       packages: write
@@ -48,10 +156,10 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --no-save --cwd ./beszel/site
+        run: bun install --no-save --cwd ./internal/site
 
       - name: Build site
-        run: bun run --cwd ./beszel/site build
+        run: bun run --cwd ./internal/site build
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -64,15 +172,13 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ matrix.image }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+          tags: ${{ matrix.tags }}
 
       # https://github.com/docker/login-action
       - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
+        env:
+          password_secret_exists: ${{ secrets[matrix.password_secret] != '' && 'true' || 'false' }}
+        if: github.event_name != 'pull_request' && env.password_secret_exists == 'true'
         uses: docker/login-action@v3
         with:
           username: ${{ matrix.username || secrets[matrix.username_secret] }}
@@ -84,9 +190,9 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:
-          context: '${{ matrix.context }}'
+          context: ./
           file: ${{ matrix.dockerfile }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          push: ${{ github.ref_type == 'tag' }}
+          platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
+          push: ${{ github.ref_type == 'tag' && secrets[matrix.password_secret] != '' }}
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/inactivity-actions.yml

@@ -0,0 +1,43 @@
+name: 'Issue and PR Maintenance'
+
+on:
+  schedule:
+    - cron: '0 0 * * *'   # runs at midnight UTC
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  close-stale:
+    name: Close Stale Issues
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Close Stale Issues
+        uses: actions/stale@v9
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+          # Messaging
+          stale-issue-message: >
+            👋 This issue has been automatically marked as stale due to inactivity.
+            If this issue is still relevant, please comment to keep it open.
+            Without activity, it will be closed in 7 days.
+
+          close-issue-message: >
+            🔒 This issue has been automatically closed due to prolonged inactivity.
+            Feel free to open a new issue if you have further questions or concerns.
+
+          # Timing
+          days-before-issue-stale: 14
+          days-before-issue-close: 7
+
+          # Labels
+          stale-issue-label: 'stale'
+          remove-stale-when-updated: true
+          only-issue-labels: 'awaiting-requester'
+
+          # Exemptions
+          exempt-assignees: true
+          exempt-milestones: true

.github/workflows/label-from-dropdown.yml

@@ -0,0 +1,82 @@
+name: Label issues from dropdowns
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  label_from_dropdown:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - name: Apply labels based on dropdown choices
+        uses: actions/github-script@v7
+        with:
+          script: |
+
+            const issueNumber = context.issue.number;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Get the issue body
+            const body = context.payload.issue.body;
+
+            // Helper to find dropdown value in the body (assuming markdown format)
+            function extractSectionValue(heading) {
+              const regex = new RegExp(`### ${heading}\\s+([\\s\\S]*?)(?:\\n###|$)`, 'i');
+              const match = body.match(regex);
+              if (match) {
+                // Get the first non-empty line after the heading
+                const lines = match[1].split('\n').map(l => l.trim()).filter(Boolean);
+                return lines[0] || null;
+              }
+              return null;
+            }
+
+            // Extract dropdown selections
+            const category = extractSectionValue('Category');
+            const metrics = extractSectionValue('Affected Metrics');
+            const component = extractSectionValue('Component');
+
+            // Build labels to add
+            let labelsToAdd = [];
+            if (category) labelsToAdd.push(category);
+            if (metrics) labelsToAdd.push(metrics);
+            if (component) labelsToAdd.push(component);
+
+            // Get existing labels in the repo
+            const { data: existingLabels } = await github.rest.issues.listLabelsForRepo({
+              owner,
+              repo,
+              per_page: 100
+            });
+            const existingLabelNames = existingLabels.map(l => l.name);
+
+            // Find labels that need to be created
+            const labelsToCreate = labelsToAdd.filter(label => !existingLabelNames.includes(label));
+
+            // Create missing labels (with a default color)
+            for (const label of labelsToCreate) {
+              try {
+                await github.rest.issues.createLabel({
+                  owner,
+                  repo,
+                  name: label,
+                  color: 'ededed' // light gray, you can pick any hex color
+                });
+              } catch (e) {
+                // Ignore if label already exists (race condition), otherwise rethrow
+                if (!e || e.status !== 422) throw e;
+              }
+            }
+
+            // Now apply all labels (they all exist now)
+            if (labelsToAdd.length > 0) {
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
+                issue_number: issueNumber,
+                labels: labelsToAdd
+              });
+            } 

.github/workflows/release.yml

@@ -3,7 +3,7 @@ name: Make release and binaries
 on:
   push:
     tags:
-      - '*'
+      - "v*"
 
 permissions:
   contents: write
@@ -21,22 +21,34 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --no-save --cwd ./beszel/site
+        run: bun install --no-save --cwd ./internal/site
 
       - name: Build site
-        run: bun run --cwd ./beszel/site build
+        run: bun run --cwd ./internal/site build
 
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '^1.22.1'
+          go-version: "^1.22.1"
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "9.0.x"
+
+      - name: Build .NET LHM executable for Windows sensors
+        run: |
+          dotnet build -c Release ./agent/lhm/beszel_lhm.csproj
+        shell: bash
 
       - name: GoReleaser beszel
         uses: goreleaser/goreleaser-action@v6
         with:
-          workdir: ./beszel
+          workdir: ./
           distribution: goreleaser
           version: latest
           args: release --clean
         env:
-          GITHUB_TOKEN: ${{ secrets.TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.TOKEN || secrets.GITHUB_TOKEN }}
+          WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          IS_FORK: ${{ github.repository_owner != 'henrygd' }}

.github/workflows/vulncheck.yml

@@ -0,0 +1,33 @@
+# https://github.com/minio/minio/blob/master/.github/workflows/vulncheck.yml
+
+name: VulnCheck
+on:
+  pull_request:
+    branches:
+      - main
+
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
+jobs:
+  vulncheck:
+    name: VulnCheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.25.x
+          # cached: false
+      - name: Get official govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+        shell: bash
+      - name: Run govulncheck
+        run: govulncheck -show verbose ./...
+        shell: bash

.gitignore

@@ -8,12 +8,15 @@ beszel_data
 beszel_data*
 dist
 *.exe
-beszel/cmd/hub/hub
-beszel/cmd/agent/agent
+internal/cmd/hub/hub
+internal/cmd/agent/agent
 node_modules
-beszel/build
+build
 *timestamp*
 .swc
-beszel/site/src/locales/**/*.ts
+internal/site/src/locales/**/*.ts
 *.bak
 __debug_*
+agent/lhm/obj
+agent/lhm/bin
+dockerfile_agent_dev

.goreleaser.yml

@@ -0,0 +1,238 @@
+version: 2
+
+project_name: beszel
+
+before:
+  hooks:
+    - go mod tidy
+    - go generate -run fetchsmartctl ./agent
+
+builds:
+  - id: beszel
+    binary: beszel
+    main: internal/cmd/hub/hub.go
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+    goarch:
+      - amd64
+      - arm64
+      - arm
+
+  - id: beszel-agent
+    binary: beszel-agent
+    main: internal/cmd/agent/agent.go
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - freebsd
+      - openbsd
+      - windows
+    goarch:
+      - amd64
+      - arm64
+      - arm
+      - mips64
+      - riscv64
+      - mipsle
+      - mips
+      - ppc64le
+    gomips:
+      - hardfloat
+      - softfloat
+    ignore:
+      - goos: freebsd
+        goarch: arm
+      - goos: openbsd
+        goarch: arm
+      - goos: linux
+        goarch: mips64
+        gomips: softfloat
+      - goos: linux
+        goarch: mipsle
+        gomips: hardfloat
+      - goos: linux
+        goarch: mips
+        gomips: hardfloat
+      - goos: windows
+        goarch: arm
+      - goos: darwin
+        goarch: riscv64
+      - goos: windows
+        goarch: riscv64
+
+archives:
+  - id: beszel-agent
+    formats: [tar.gz]
+    ids:
+      - beszel-agent
+    name_template: >-
+      {{ .Binary }}_
+      {{- .Os }}_
+      {{- .Arch }}
+    format_overrides:
+      - goos: windows
+        formats: [zip]
+
+  - id: beszel
+    formats: [tar.gz]
+    ids:
+      - beszel
+    name_template: >-
+      {{ .Binary }}_
+      {{- .Os }}_
+      {{- .Arch }}
+
+nfpms:
+  - id: beszel-agent
+    package_name: beszel-agent
+    description: |-
+      Agent for Beszel
+      Beszel is a lightweight server monitoring platform that includes Docker
+      statistics, historical data, and alert functions. It has a friendly web
+      interface, simple configuration, and is ready to use out of the box.
+      It supports automatic backup, multi-user, OAuth authentication, and
+      API access.
+    maintainer: henrygd <hank@henrygd.me>
+    section: net
+    ids:
+      - beszel-agent
+    formats:
+      - deb
+    contents:
+      - src: ./supplemental/debian/beszel-agent.service
+        dst: lib/systemd/system/beszel-agent.service
+        packager: deb
+      - src: ./supplemental/debian/copyright
+        dst: usr/share/doc/beszel-agent/copyright
+        packager: deb
+      - src: ./supplemental/debian/lintian-overrides
+        dst: usr/share/lintian/overrides/beszel-agent
+        packager: deb
+    scripts:
+      postinstall: ./supplemental/debian/postinstall.sh
+      preremove: ./supplemental/debian/prerm.sh
+      postremove: ./supplemental/debian/postrm.sh
+    deb:
+      predepends:
+        - adduser
+        - debconf
+      scripts:
+        templates: ./supplemental/debian/templates
+        # Currently broken due to a bug in goreleaser
+        # https://github.com/goreleaser/goreleaser/issues/5487
+        #config: ./supplemental/debian/config.sh
+
+scoops:
+  - ids: [beszel-agent]
+    name: beszel-agent
+    repository:
+      owner: henrygd
+      name: beszel-scoops
+    homepage: "https://beszel.dev"
+    description: "Agent for Beszel, a lightweight server monitoring platform."
+    license: MIT
+    skip_upload: '{{ if eq (tolower .Env.IS_FORK) "true" }}true{{ else }}auto{{ end }}'
+
+# # Needs choco installed, so doesn't build on linux / default gh workflow :(
+# chocolateys:
+#   - title: Beszel Agent
+#     ids: [beszel-agent]
+#     package_source_url: https://github.com/henrygd/beszel-chocolatey
+#     owners: henrygd
+#     authors: henrygd
+#     summary: 'Agent for Beszel, a lightweight server monitoring platform.'
+#     description: |
+#       Beszel is a lightweight server monitoring platform that includes Docker statistics, historical data, and alert functions.
+
+#       It has a friendly web interface, simple configuration, and is ready to use out of the box. It supports automatic backup, multi-user, OAuth authentication, and API access.
+#     license_url: https://github.com/henrygd/beszel/blob/main/LICENSE
+#     project_url: https://beszel.dev
+#     project_source_url: https://github.com/henrygd/beszel
+#     docs_url: https://beszel.dev/guide/getting-started
+#     icon_url: https://cdn.jsdelivr.net/gh/selfhst/icons/png/beszel.png
+#     bug_tracker_url: https://github.com/henrygd/beszel/issues
+#     copyright: 2025 henrygd
+#     tags: foss cross-platform admin monitoring
+#     require_license_acceptance: false
+#     release_notes: 'https://github.com/henrygd/beszel/releases/tag/v{{ .Version }}'
+
+brews:
+  - ids: [beszel-agent]
+    name: beszel-agent
+    repository:
+      owner: henrygd
+      name: homebrew-beszel
+    homepage: "https://beszel.dev"
+    description: "Agent for Beszel, a lightweight server monitoring platform."
+    license: MIT
+    skip_upload: '{{ if eq (tolower .Env.IS_FORK) "true" }}true{{ else }}auto{{ end }}'
+    extra_install: |
+      (bin/"beszel-agent-launcher").write <<~EOS
+        #!/bin/bash
+        set -a
+        if [ -f "$HOME/.config/beszel/beszel-agent.env" ]; then
+          source "$HOME/.config/beszel/beszel-agent.env"
+        fi
+        set +a
+        exec #{bin}/beszel-agent "$@"
+      EOS
+      (bin/"beszel-agent-launcher").chmod 0755
+    service: |
+      run ["#{bin}/beszel-agent-launcher"]
+      log_path "#{Dir.home}/.cache/beszel/beszel-agent.log"
+      error_log_path "#{Dir.home}/.cache/beszel/beszel-agent.log"
+      keep_alive true
+      restart_delay 5
+      process_type :background
+
+winget:
+  - ids: [beszel-agent]
+    name: beszel-agent
+    package_identifier: henrygd.beszel-agent
+    publisher: henrygd
+    license: MIT
+    license_url: "https://github.com/henrygd/beszel/blob/main/LICENSE"
+    copyright: "2025 henrygd"
+    homepage: "https://beszel.dev"
+    release_notes_url: "https://github.com/henrygd/beszel/releases/tag/v{{ .Version }}"
+    publisher_support_url: "https://github.com/henrygd/beszel/issues"
+    short_description: "Agent for Beszel, a lightweight server monitoring platform."
+    skip_upload: '{{ if eq (tolower .Env.IS_FORK) "true" }}true{{ else }}auto{{ end }}'
+    description: |
+      Beszel is a lightweight server monitoring platform that includes Docker
+      statistics, historical data, and alert functions. It has a friendly web
+      interface, simple configuration, and is ready to use out of the box.
+      It supports automatic backup, multi-user, OAuth authentication, and
+      API access.
+    tags:
+      - homelab
+      - monitoring
+      - self-hosted
+    repository:
+      owner: henrygd
+      name: beszel-winget
+      branch: henrygd.beszel-agent-{{ .Version }}
+      token: "{{ .Env.WINGET_TOKEN }}"
+      # pull_request:
+      #   enabled: true
+      #   draft: false
+      #   base:
+      #     owner: microsoft
+      #     name: winget-pkgs
+      #     branch: master
+
+release:
+  draft: true
+
+changelog:
+  disable: true
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"

Makefile

@@ -0,0 +1,108 @@
+# Default OS/ARCH values
+OS ?= $(shell go env GOOS)
+ARCH ?= $(shell go env GOARCH)
+# Skip building the web UI if true
+SKIP_WEB ?= false
+
+# Set executable extension based on target OS
+EXE_EXT := $(if $(filter windows,$(OS)),.exe,)
+
+.PHONY: tidy build-agent build-hub build-hub-dev build clean lint dev-server dev-agent dev-hub dev generate-locales fetch-smartctl-conditional
+.DEFAULT_GOAL := build
+
+clean:
+	go clean
+	rm -rf ./build
+
+lint:
+	golangci-lint run
+
+test: export GOEXPERIMENT=synctest
+test:
+	go test -tags=testing ./...
+
+tidy:
+	go mod tidy
+
+build-web-ui:
+	@if command -v bun >/dev/null 2>&1; then \
+		bun install --cwd ./internal/site && \
+		bun run --cwd ./internal/site build; \
+	else \
+		npm install --prefix ./internal/site && \
+		npm run --prefix ./internal/site build; \
+	fi
+
+# Conditional .NET build - only for Windows
+build-dotnet-conditional:
+	@if [ "$(OS)" = "windows" ]; then \
+		echo "Building .NET executable for Windows..."; \
+		if command -v dotnet >/dev/null 2>&1; then \
+			rm -rf ./agent/lhm/bin; \
+			dotnet build -c Release ./agent/lhm/beszel_lhm.csproj; \
+		else \
+			echo "Error: dotnet not found. Install .NET SDK to build Windows agent."; \
+			exit 1; \
+		fi; \
+	fi
+
+# Download smartctl.exe at build time for Windows (skips if already present)
+fetch-smartctl-conditional:
+	@if [ "$(OS)" = "windows" ]; then \
+		go generate -run fetchsmartctl ./agent; \
+	fi
+
+# Update build-agent to include conditional .NET build
+build-agent: tidy build-dotnet-conditional fetch-smartctl-conditional
+	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel-agent_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/agent
+
+build-hub: tidy $(if $(filter false,$(SKIP_WEB)),build-web-ui)
+	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/hub
+
+build-hub-dev: tidy
+	mkdir -p ./internal/site/dist && touch ./internal/site/dist/index.html
+	GOOS=$(OS) GOARCH=$(ARCH) go build -tags development -o ./build/beszel-dev_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/hub
+
+build: build-agent build-hub
+
+generate-locales:
+	@if [ ! -f ./internal/site/src/locales/en/en.ts ]; then \
+		echo "Generating locales..."; \
+		command -v bun >/dev/null 2>&1 && cd ./internal/site && bun install && bun run sync || cd ./internal/site && npm install && npm run sync; \
+	fi
+
+dev-server: generate-locales
+	cd ./internal/site
+	@if command -v bun >/dev/null 2>&1; then \
+		cd ./internal/site && bun run dev --host 0.0.0.0; \
+	else \
+		cd ./internal/site && npm run dev --host 0.0.0.0; \
+	fi
+
+dev-hub: export ENV=dev
+dev-hub:
+	mkdir -p ./internal/site/dist && touch ./internal/site/dist/index.html
+	@if command -v entr >/dev/null 2>&1; then \
+		find ./internal -type f -name '*.go' | entr -r -s "cd ./internal/cmd/hub && go run -tags development . serve --http 0.0.0.0:8090"; \
+	else \
+		cd ./internal/cmd/hub && go run -tags development . serve --http 0.0.0.0:8090; \
+	fi
+
+dev-agent:
+	@if command -v entr >/dev/null 2>&1; then \
+		find ./internal/cmd/agent/*.go ./agent/*.go | entr -r go run github.com/henrygd/beszel/internal/cmd/agent; \
+	else \
+		go run github.com/henrygd/beszel/internal/cmd/agent; \
+	fi
+	
+build-dotnet:
+	@if command -v dotnet >/dev/null 2>&1; then \
+		rm -rf ./agent/lhm/bin; \
+		dotnet build -c Release ./agent/lhm/beszel_lhm.csproj; \
+	else \
+		echo "dotnet not found"; \
+	fi
+
+
+# KEY="..." make -j dev
+dev: dev-server dev-hub dev-agent

agent/agent.go

@@ -0,0 +1,224 @@
+// Package agent implements the Beszel monitoring agent that collects and serves system metrics.
+//
+// The agent runs on monitored systems and communicates collected data
+// to the Beszel hub for centralized monitoring and alerting.
+package agent
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/gliderlabs/ssh"
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/agent/deltatracker"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/host"
+	gossh "golang.org/x/crypto/ssh"
+)
+
+type Agent struct {
+	sync.Mutex                                                                      // Used to lock agent while collecting data
+	debug                     bool                                                  // true if LOG_LEVEL is set to debug
+	zfs                       bool                                                  // true if system has arcstats
+	memCalc                   string                                                // Memory calculation formula
+	fsNames                   []string                                              // List of filesystem device names being monitored
+	fsStats                   map[string]*system.FsStats                            // Keeps track of disk stats for each filesystem
+	diskPrev                  map[uint16]map[string]prevDisk                        // Previous disk I/O counters per cache interval
+	netInterfaces             map[string]struct{}                                   // Stores all valid network interfaces
+	netIoStats                map[uint16]system.NetIoStats                          // Keeps track of bandwidth usage per cache interval
+	netInterfaceDeltaTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64] // Per-cache-time NIC delta trackers
+	dockerManager             *dockerManager                                        // Manages Docker API requests
+	sensorConfig              *SensorConfig                                         // Sensors config
+	systemInfo                system.Info                                           // Host system info
+	gpuManager                *GPUManager                                           // Manages GPU data
+	cache                     *systemDataCache                                      // Cache for system stats based on cache time
+	connectionManager         *ConnectionManager                                    // Channel to signal connection events
+	handlerRegistry           *HandlerRegistry                                      // Registry for routing incoming messages
+	server                    *ssh.Server                                           // SSH server
+	dataDir                   string                                                // Directory for persisting data
+	keys                      []gossh.PublicKey                                     // SSH public keys
+	smartManager              *SmartManager                                         // Manages SMART data
+	systemdManager            *systemdManager                                       // Manages systemd services
+}
+
+// NewAgent creates a new agent with the given data directory for persisting data.
+// If the data directory is not set, it will attempt to find the optimal directory.
+func NewAgent(dataDir ...string) (agent *Agent, err error) {
+	agent = &Agent{
+		fsStats: make(map[string]*system.FsStats),
+		cache:   NewSystemDataCache(),
+	}
+
+	// Initialize disk I/O previous counters storage
+	agent.diskPrev = make(map[uint16]map[string]prevDisk)
+	// Initialize per-cache-time network tracking structures
+	agent.netIoStats = make(map[uint16]system.NetIoStats)
+	agent.netInterfaceDeltaTrackers = make(map[uint16]*deltatracker.DeltaTracker[string, uint64])
+
+	agent.dataDir, err = getDataDir(dataDir...)
+	if err != nil {
+		slog.Warn("Data directory not found")
+	} else {
+		slog.Info("Data directory", "path", agent.dataDir)
+	}
+
+	agent.memCalc, _ = GetEnv("MEM_CALC")
+	agent.sensorConfig = agent.newSensorConfig()
+	// Set up slog with a log level determined by the LOG_LEVEL env var
+	if logLevelStr, exists := GetEnv("LOG_LEVEL"); exists {
+		switch strings.ToLower(logLevelStr) {
+		case "debug":
+			agent.debug = true
+			slog.SetLogLoggerLevel(slog.LevelDebug)
+		case "warn":
+			slog.SetLogLoggerLevel(slog.LevelWarn)
+		case "error":
+			slog.SetLogLoggerLevel(slog.LevelError)
+		}
+	}
+
+	slog.Debug(beszel.Version)
+
+	// initialize system info
+	agent.initializeSystemInfo()
+
+	// initialize connection manager
+	agent.connectionManager = newConnectionManager(agent)
+
+	// initialize handler registry
+	agent.handlerRegistry = NewHandlerRegistry()
+
+	// initialize disk info
+	agent.initializeDiskInfo()
+
+	// initialize net io stats
+	agent.initializeNetIoStats()
+
+	// initialize docker manager
+	agent.dockerManager = newDockerManager(agent)
+
+	agent.systemdManager, err = newSystemdManager()
+	if err != nil {
+		slog.Debug("Systemd", "err", err)
+	}
+
+	agent.smartManager, err = NewSmartManager()
+	if err != nil {
+		slog.Debug("SMART", "err", err)
+	}
+
+	// initialize GPU manager
+	agent.gpuManager, err = NewGPUManager()
+	if err != nil {
+		slog.Debug("GPU", "err", err)
+	}
+
+	// if debugging, print stats
+	if agent.debug {
+		slog.Debug("Stats", "data", agent.gatherStats(0))
+	}
+
+	return agent, nil
+}
+
+// GetEnv retrieves an environment variable with a "BESZEL_AGENT_" prefix, or falls back to the unprefixed key.
+func GetEnv(key string) (value string, exists bool) {
+	if value, exists = os.LookupEnv("BESZEL_AGENT_" + key); exists {
+		return value, exists
+	}
+	// Fallback to the old unprefixed key
+	return os.LookupEnv(key)
+}
+
+func (a *Agent) gatherStats(cacheTimeMs uint16) *system.CombinedData {
+	a.Lock()
+	defer a.Unlock()
+
+	data, isCached := a.cache.Get(cacheTimeMs)
+	if isCached {
+		slog.Debug("Cached data", "cacheTimeMs", cacheTimeMs)
+		return data
+	}
+
+	*data = system.CombinedData{
+		Stats: a.getSystemStats(cacheTimeMs),
+		Info:  a.systemInfo,
+	}
+	// slog.Info("System data", "data", data, "cacheTimeMs", cacheTimeMs)
+
+	if a.dockerManager != nil {
+		if containerStats, err := a.dockerManager.getDockerStats(cacheTimeMs); err == nil {
+			data.Containers = containerStats
+			slog.Debug("Containers", "data", data.Containers)
+		} else {
+			slog.Debug("Containers", "err", err)
+		}
+	}
+
+	// skip updating systemd services if cache time is not the default 60sec interval
+	if a.systemdManager != nil && cacheTimeMs == 60_000 && a.systemdManager.hasFreshStats {
+		data.SystemdServices = a.systemdManager.getServiceStats(nil, false)
+	}
+
+	data.Stats.ExtraFs = make(map[string]*system.FsStats)
+	data.Info.ExtraFsPct = make(map[string]float64)
+	for name, stats := range a.fsStats {
+		if !stats.Root && stats.DiskTotal > 0 {
+			// Use custom name if available, otherwise use device name
+			key := name
+			if stats.Name != "" {
+				key = stats.Name
+			}
+			data.Stats.ExtraFs[key] = stats
+			// Add percentage info to Info struct for dashboard
+			if stats.DiskTotal > 0 {
+				pct := twoDecimals((stats.DiskUsed / stats.DiskTotal) * 100)
+				data.Info.ExtraFsPct[key] = pct
+			}
+		}
+	}
+	slog.Debug("Extra FS", "data", data.Stats.ExtraFs)
+
+	a.cache.Set(data, cacheTimeMs)
+	return data
+}
+
+// StartAgent initializes and starts the agent with optional WebSocket connection
+func (a *Agent) Start(serverOptions ServerOptions) error {
+	a.keys = serverOptions.Keys
+	return a.connectionManager.Start(serverOptions)
+}
+
+func (a *Agent) getFingerprint() string {
+	// first look for a fingerprint in the data directory
+	if a.dataDir != "" {
+		if fp, err := os.ReadFile(filepath.Join(a.dataDir, "fingerprint")); err == nil {
+			return string(fp)
+		}
+	}
+
+	// if no fingerprint is found, generate one
+	fingerprint, err := host.HostID()
+	if err != nil || fingerprint == "" {
+		fingerprint = a.systemInfo.Hostname + a.systemInfo.CpuModel
+	}
+
+	// hash fingerprint
+	sum := sha256.Sum256([]byte(fingerprint))
+	fingerprint = hex.EncodeToString(sum[:24])
+
+	// save fingerprint to data directory
+	if a.dataDir != "" {
+		err = os.WriteFile(filepath.Join(a.dataDir, "fingerprint"), []byte(fingerprint), 0644)
+		if err != nil {
+			slog.Warn("Failed to save fingerprint", "err", err)
+		}
+	}
+
+	return fingerprint
+}

agent/agent_cache.go

@@ -0,0 +1,55 @@
+package agent
+
+import (
+	"sync"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+type systemDataCache struct {
+	sync.RWMutex
+	cache map[uint16]*cacheNode
+}
+
+type cacheNode struct {
+	data       *system.CombinedData
+	lastUpdate time.Time
+}
+
+// NewSystemDataCache creates a cache keyed by the polling interval in milliseconds.
+func NewSystemDataCache() *systemDataCache {
+	return &systemDataCache{
+		cache: make(map[uint16]*cacheNode),
+	}
+}
+
+// Get returns cached combined data when the entry is still considered fresh.
+func (c *systemDataCache) Get(cacheTimeMs uint16) (stats *system.CombinedData, isCached bool) {
+	c.RLock()
+	defer c.RUnlock()
+
+	node, ok := c.cache[cacheTimeMs]
+	if !ok {
+		return &system.CombinedData{}, false
+	}
+	// allowedSkew := time.Second
+	// isFresh := time.Since(node.lastUpdate) < time.Duration(cacheTimeMs)*time.Millisecond-allowedSkew
+	// allow a 50% skew of the cache time
+	isFresh := time.Since(node.lastUpdate) < time.Duration(cacheTimeMs/2)*time.Millisecond
+	return node.data, isFresh
+}
+
+// Set stores the latest combined data snapshot for the given interval.
+func (c *systemDataCache) Set(data *system.CombinedData, cacheTimeMs uint16) {
+	c.Lock()
+	defer c.Unlock()
+
+	node, ok := c.cache[cacheTimeMs]
+	if !ok {
+		node = &cacheNode{}
+		c.cache[cacheTimeMs] = node
+	}
+	node.data = data
+	node.lastUpdate = time.Now()
+}

agent/agent_cache_test.go

@@ -0,0 +1,246 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func createTestCacheData() *system.CombinedData {
+	return &system.CombinedData{
+		Stats: system.Stats{
+			Cpu:       50.5,
+			Mem:       8192,
+			DiskTotal: 100000,
+		},
+		Info: system.Info{
+			Hostname: "test-host",
+		},
+		Containers: []*container.Stats{
+			{
+				Name: "test-container",
+				Cpu:  25.0,
+			},
+		},
+	}
+}
+
+func TestNewSystemDataCache(t *testing.T) {
+	cache := NewSystemDataCache()
+	require.NotNil(t, cache)
+	assert.NotNil(t, cache.cache)
+	assert.Empty(t, cache.cache)
+}
+
+func TestCacheGetSet(t *testing.T) {
+	cache := NewSystemDataCache()
+	data := createTestCacheData()
+
+	// Test setting data
+	cache.Set(data, 1000) // 1 second cache
+
+	// Test getting fresh data
+	retrieved, isCached := cache.Get(1000)
+	assert.True(t, isCached)
+	assert.Equal(t, data, retrieved)
+
+	// Test getting non-existent cache key
+	_, isCached = cache.Get(2000)
+	assert.False(t, isCached)
+}
+
+func TestCacheFreshness(t *testing.T) {
+	cache := NewSystemDataCache()
+	data := createTestCacheData()
+
+	testCases := []struct {
+		name        string
+		cacheTimeMs uint16
+		sleepMs     time.Duration
+		expectFresh bool
+	}{
+		{
+			name:        "fresh data - well within cache time",
+			cacheTimeMs: 1000, // 1 second
+			sleepMs:     100,  // 100ms
+			expectFresh: true,
+		},
+		{
+			name:        "fresh data - at 50% of cache time boundary",
+			cacheTimeMs: 1000, // 1 second, 50% = 500ms
+			sleepMs:     499,  // just under 500ms
+			expectFresh: true,
+		},
+		{
+			name:        "stale data - exactly at 50% cache time",
+			cacheTimeMs: 1000, // 1 second, 50% = 500ms
+			sleepMs:     500,  // exactly 500ms
+			expectFresh: false,
+		},
+		{
+			name:        "stale data - well beyond cache time",
+			cacheTimeMs: 1000, // 1 second
+			sleepMs:     800,  // 800ms
+			expectFresh: false,
+		},
+		{
+			name:        "short cache time",
+			cacheTimeMs: 200, // 200ms, 50% = 100ms
+			sleepMs:     150, // 150ms > 100ms
+			expectFresh: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				// Set data
+				cache.Set(data, tc.cacheTimeMs)
+
+				// Wait for the specified duration
+				if tc.sleepMs > 0 {
+					time.Sleep(tc.sleepMs * time.Millisecond)
+				}
+
+				// Check freshness
+				_, isCached := cache.Get(tc.cacheTimeMs)
+				assert.Equal(t, tc.expectFresh, isCached)
+			})
+		})
+	}
+}
+
+func TestCacheMultipleIntervals(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		cache := NewSystemDataCache()
+		data1 := createTestCacheData()
+		data2 := &system.CombinedData{
+			Stats: system.Stats{
+				Cpu: 75.0,
+				Mem: 16384,
+			},
+			Info: system.Info{
+				Hostname: "test-host-2",
+			},
+			Containers: []*container.Stats{},
+		}
+
+		// Set data for different intervals
+		cache.Set(data1, 500)  // 500ms cache
+		cache.Set(data2, 1000) // 1000ms cache
+
+		// Both should be fresh immediately
+		retrieved1, isCached1 := cache.Get(500)
+		assert.True(t, isCached1)
+		assert.Equal(t, data1, retrieved1)
+
+		retrieved2, isCached2 := cache.Get(1000)
+		assert.True(t, isCached2)
+		assert.Equal(t, data2, retrieved2)
+
+		// Wait 300ms - 500ms cache should be stale (250ms threshold), 1000ms should still be fresh (500ms threshold)
+		time.Sleep(300 * time.Millisecond)
+
+		_, isCached1 = cache.Get(500)
+		assert.False(t, isCached1)
+
+		_, isCached2 = cache.Get(1000)
+		assert.True(t, isCached2)
+
+		// Wait another 300ms (total 600ms) - now 1000ms cache should also be stale
+		time.Sleep(300 * time.Millisecond)
+		_, isCached2 = cache.Get(1000)
+		assert.False(t, isCached2)
+	})
+}
+
+func TestCacheOverwrite(t *testing.T) {
+	cache := NewSystemDataCache()
+	data1 := createTestCacheData()
+	data2 := &system.CombinedData{
+		Stats: system.Stats{
+			Cpu: 90.0,
+			Mem: 32768,
+		},
+		Info: system.Info{
+			Hostname: "updated-host",
+		},
+		Containers: []*container.Stats{},
+	}
+
+	// Set initial data
+	cache.Set(data1, 1000)
+	retrieved, isCached := cache.Get(1000)
+	assert.True(t, isCached)
+	assert.Equal(t, data1, retrieved)
+
+	// Overwrite with new data
+	cache.Set(data2, 1000)
+	retrieved, isCached = cache.Get(1000)
+	assert.True(t, isCached)
+	assert.Equal(t, data2, retrieved)
+	assert.NotEqual(t, data1, retrieved)
+}
+
+func TestCacheMiss(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		cache := NewSystemDataCache()
+
+		// Test getting from empty cache
+		_, isCached := cache.Get(1000)
+		assert.False(t, isCached)
+
+		// Set data for one interval
+		data := createTestCacheData()
+		cache.Set(data, 1000)
+
+		// Test getting different interval
+		_, isCached = cache.Get(2000)
+		assert.False(t, isCached)
+
+		// Test getting after data has expired
+		time.Sleep(600 * time.Millisecond) // 600ms > 500ms (50% of 1000ms)
+		_, isCached = cache.Get(1000)
+		assert.False(t, isCached)
+	})
+}
+
+func TestCacheZeroInterval(t *testing.T) {
+	cache := NewSystemDataCache()
+	data := createTestCacheData()
+
+	// Set with zero interval - should allow immediate cache
+	cache.Set(data, 0)
+
+	// With 0 interval, 50% is 0, so it should never be considered fresh
+	// (time.Since(lastUpdate) >= 0, which is not < 0)
+	_, isCached := cache.Get(0)
+	assert.False(t, isCached)
+}
+
+func TestCacheLargeInterval(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		cache := NewSystemDataCache()
+		data := createTestCacheData()
+
+		// Test with maximum uint16 value
+		cache.Set(data, 65535) // ~65 seconds
+
+		// Should be fresh immediately
+		_, isCached := cache.Get(65535)
+		assert.True(t, isCached)
+
+		// Should still be fresh after a short time
+		time.Sleep(100 * time.Millisecond)
+		_, isCached = cache.Get(65535)
+		assert.True(t, isCached)
+	})
+}

agent/agent_test_helpers.go

@@ -0,0 +1,9 @@
+//go:build testing
+// +build testing
+
+package agent
+
+// TESTING ONLY: GetConnectionManager is a helper function to get the connection manager for testing.
+func (a *Agent) GetConnectionManager() *ConnectionManager {
+	return a.connectionManager
+}

agent/battery/battery.go

@@ -0,0 +1,84 @@
+//go:build !freebsd
+
+// Package battery provides functions to check if the system has a battery and to get the battery stats.
+package battery
+
+import (
+	"errors"
+	"log/slog"
+	"math"
+
+	"github.com/distatus/battery"
+)
+
+var (
+	systemHasBattery   = false
+	haveCheckedBattery = false
+)
+
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+func HasReadableBattery() bool {
+	if haveCheckedBattery {
+		return systemHasBattery
+	}
+	haveCheckedBattery = true
+	batteries, err := battery.GetAll()
+	for _, bat := range batteries {
+		if bat != nil && (bat.Full > 0 || bat.Design > 0) {
+			systemHasBattery = true
+			break
+		}
+	}
+	if !systemHasBattery {
+		slog.Debug("No battery found", "err", err)
+	}
+	return systemHasBattery
+}
+
+// GetBatteryStats returns the current battery percent and charge state
+// percent = (current charge of all batteries) / (sum of designed/full capacity of all batteries)
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+	batteries, err := battery.GetAll()
+	// we'll handle errors later by skipping batteries with errors, rather
+	// than skipping everything because of the presence of some errors.
+	if len(batteries) == 0 {
+		return batteryPercent, batteryState, errors.New("no batteries")
+	}
+
+	totalCapacity := float64(0)
+	totalCharge := float64(0)
+	errs, partialErrs := err.(battery.Errors)
+
+	batteryState = math.MaxUint8
+
+	for i, bat := range batteries {
+		if partialErrs && errs[i] != nil {
+			// if there were some errors, like missing data, skip it
+			continue
+		}
+		if bat == nil || bat.Full == 0 {
+			// skip batteries with no capacity. Charge is unlikely to ever be zero, but
+			// we can't guarantee that, so don't skip based on charge.
+			continue
+		}
+		totalCapacity += bat.Full
+		totalCharge += bat.Current
+		if bat.State.Raw >= 0 {
+			batteryState = uint8(bat.State.Raw)
+		}
+	}
+
+	if totalCapacity == 0 || batteryState == math.MaxUint8 {
+		// for macs there's sometimes a ghost battery with 0 capacity
+		// https://github.com/distatus/battery/issues/34
+		// Instead of skipping over those batteries, we'll check for total 0 capacity
+		// and return an error. This also prevents a divide by zero.
+		return batteryPercent, batteryState, errors.New("no battery capacity")
+	}
+
+	batteryPercent = uint8(totalCharge / totalCapacity * 100)
+	return batteryPercent, batteryState, nil
+}

agent/battery/battery_freebsd.go

@@ -0,0 +1,13 @@
+//go:build freebsd
+
+package battery
+
+import "errors"
+
+func HasReadableBattery() bool {
+	return false
+}
+
+func GetBatteryStats() (uint8, uint8, error) {
+	return 0, 0, errors.ErrUnsupported
+}

agent/client.go

@@ -0,0 +1,310 @@
+package agent
+
+import (
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/lxzan/gws"
+	"golang.org/x/crypto/ssh"
+)
+
+const (
+	wsDeadline = 70 * time.Second
+)
+
+// WebSocketClient manages the WebSocket connection between the agent and hub.
+// It handles authentication, message routing, and connection lifecycle management.
+type WebSocketClient struct {
+	gws.BuiltinEventHandler
+	options            *gws.ClientOption                   // WebSocket client configuration options
+	agent              *Agent                              // Reference to the parent agent
+	Conn               *gws.Conn                           // Active WebSocket connection
+	hubURL             *url.URL                            // Parsed hub URL for connection
+	token              string                              // Authentication token for hub registration
+	fingerprint        string                              // System fingerprint for identification
+	hubRequest         *common.HubRequest[cbor.RawMessage] // Reusable request structure for message parsing
+	lastConnectAttempt time.Time                           // Timestamp of last connection attempt
+	hubVerified        bool                                // Whether the hub has been cryptographically verified
+}
+
+// newWebSocketClient creates a new WebSocket client for the given agent.
+// It reads configuration from environment variables and validates the hub URL.
+func newWebSocketClient(agent *Agent) (client *WebSocketClient, err error) {
+	hubURLStr, exists := GetEnv("HUB_URL")
+	if !exists {
+		return nil, errors.New("HUB_URL environment variable not set")
+	}
+
+	client = &WebSocketClient{}
+
+	client.hubURL, err = url.Parse(hubURLStr)
+	if err != nil {
+		return nil, errors.New("invalid hub URL")
+	}
+	// get registration token
+	client.token, err = getToken()
+	if err != nil {
+		return nil, err
+	}
+
+	client.agent = agent
+	client.hubRequest = &common.HubRequest[cbor.RawMessage]{}
+	client.fingerprint = agent.getFingerprint()
+
+	return client, nil
+}
+
+// getToken returns the token for the WebSocket client.
+// It first checks the TOKEN environment variable, then the TOKEN_FILE environment variable.
+// If neither is set, it returns an error.
+func getToken() (string, error) {
+	// get token from env var
+	token, _ := GetEnv("TOKEN")
+	if token != "" {
+		return token, nil
+	}
+	// get token from file
+	tokenFile, _ := GetEnv("TOKEN_FILE")
+	if tokenFile == "" {
+		return "", errors.New("must set TOKEN or TOKEN_FILE")
+	}
+	tokenBytes, err := os.ReadFile(tokenFile)
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(tokenBytes)), nil
+}
+
+// getOptions returns the WebSocket client options, creating them if necessary.
+// It configures the connection URL, TLS settings, and authentication headers.
+func (client *WebSocketClient) getOptions() *gws.ClientOption {
+	if client.options != nil {
+		return client.options
+	}
+
+	// update the hub url to use websocket scheme and api path
+	if client.hubURL.Scheme == "https" {
+		client.hubURL.Scheme = "wss"
+	} else {
+		client.hubURL.Scheme = "ws"
+	}
+	client.hubURL.Path = path.Join(client.hubURL.Path, "api/beszel/agent-connect")
+
+	client.options = &gws.ClientOption{
+		Addr:      client.hubURL.String(),
+		TlsConfig: &tls.Config{InsecureSkipVerify: true},
+		RequestHeader: http.Header{
+			"User-Agent": []string{getUserAgent()},
+			"X-Token":    []string{client.token},
+			"X-Beszel":   []string{beszel.Version},
+		},
+	}
+	return client.options
+}
+
+// Connect establishes a WebSocket connection to the hub.
+// It closes any existing connection before attempting to reconnect.
+func (client *WebSocketClient) Connect() (err error) {
+	client.lastConnectAttempt = time.Now()
+
+	// make sure previous connection is closed
+	client.Close()
+
+	client.Conn, _, err = gws.NewClient(client, client.getOptions())
+	if err != nil {
+		return err
+	}
+
+	go client.Conn.ReadLoop()
+
+	return nil
+}
+
+// OnOpen handles WebSocket connection establishment.
+// It sets a deadline for the connection to prevent hanging.
+func (client *WebSocketClient) OnOpen(conn *gws.Conn) {
+	conn.SetDeadline(time.Now().Add(wsDeadline))
+}
+
+// OnClose handles WebSocket connection closure.
+// It logs the closure reason and notifies the connection manager.
+func (client *WebSocketClient) OnClose(conn *gws.Conn, err error) {
+	if err != nil {
+		slog.Warn("Connection closed", "err", strings.TrimPrefix(err.Error(), "gws: "))
+	}
+	client.agent.connectionManager.eventChan <- WebSocketDisconnect
+}
+
+// OnMessage handles incoming WebSocket messages from the hub.
+// It decodes CBOR messages and routes them to appropriate handlers.
+func (client *WebSocketClient) OnMessage(conn *gws.Conn, message *gws.Message) {
+	defer message.Close()
+	conn.SetDeadline(time.Now().Add(wsDeadline))
+
+	if message.Opcode != gws.OpcodeBinary {
+		return
+	}
+
+	var HubRequest common.HubRequest[cbor.RawMessage]
+
+	err := cbor.Unmarshal(message.Data.Bytes(), &HubRequest)
+	if err != nil {
+		slog.Error("Error parsing message", "err", err)
+		return
+	}
+
+	if err := client.handleHubRequest(&HubRequest, HubRequest.Id); err != nil {
+		slog.Error("Error handling message", "err", err)
+	}
+}
+
+// OnPing handles WebSocket ping frames.
+// It responds with a pong and updates the connection deadline.
+func (client *WebSocketClient) OnPing(conn *gws.Conn, message []byte) {
+	conn.SetDeadline(time.Now().Add(wsDeadline))
+	conn.WritePong(message)
+}
+
+// handleAuthChallenge verifies the authenticity of the hub and returns the system's fingerprint.
+func (client *WebSocketClient) handleAuthChallenge(msg *common.HubRequest[cbor.RawMessage], requestID *uint32) (err error) {
+	var authRequest common.FingerprintRequest
+	if err := cbor.Unmarshal(msg.Data, &authRequest); err != nil {
+		return err
+	}
+
+	if err := client.verifySignature(authRequest.Signature); err != nil {
+		return err
+	}
+
+	client.hubVerified = true
+	client.agent.connectionManager.eventChan <- WebSocketConnect
+
+	response := &common.FingerprintResponse{
+		Fingerprint: client.fingerprint,
+	}
+
+	if authRequest.NeedSysInfo {
+		response.Name, _ = GetEnv("SYSTEM_NAME")
+		response.Hostname = client.agent.systemInfo.Hostname
+		serverAddr := client.agent.connectionManager.serverOptions.Addr
+		_, response.Port, _ = net.SplitHostPort(serverAddr)
+	}
+
+	return client.sendResponse(response, requestID)
+}
+
+// verifySignature verifies the signature of the token using the public keys.
+func (client *WebSocketClient) verifySignature(signature []byte) (err error) {
+	for _, pubKey := range client.agent.keys {
+		sig := ssh.Signature{
+			Format: pubKey.Type(),
+			Blob:   signature,
+		}
+		if err = pubKey.Verify([]byte(client.token), &sig); err == nil {
+			return nil
+		}
+	}
+	return errors.New("invalid signature - check KEY value")
+}
+
+// Close closes the WebSocket connection gracefully.
+// This method is safe to call multiple times.
+func (client *WebSocketClient) Close() {
+	if client.Conn != nil {
+		_ = client.Conn.WriteClose(1000, nil)
+	}
+}
+
+// handleHubRequest routes the request to the appropriate handler using the handler registry.
+func (client *WebSocketClient) handleHubRequest(msg *common.HubRequest[cbor.RawMessage], requestID *uint32) error {
+	ctx := &HandlerContext{
+		Client:       client,
+		Agent:        client.agent,
+		Request:      msg,
+		RequestID:    requestID,
+		HubVerified:  client.hubVerified,
+		SendResponse: client.sendResponse,
+	}
+	return client.agent.handlerRegistry.Handle(ctx)
+}
+
+// sendMessage encodes the given data to CBOR and sends it as a binary message over the WebSocket connection to the hub.
+func (client *WebSocketClient) sendMessage(data any) error {
+	bytes, err := cbor.Marshal(data)
+	if err != nil {
+		return err
+	}
+	err = client.Conn.WriteMessage(gws.OpcodeBinary, bytes)
+	if err != nil {
+		// If writing fails (e.g., broken pipe due to network issues),
+		// close the connection to trigger reconnection logic (#1263)
+		client.Close()
+	}
+	return err
+}
+
+// sendResponse sends a response with optional request ID for the new protocol
+func (client *WebSocketClient) sendResponse(data any, requestID *uint32) error {
+	if requestID != nil {
+		// New format with ID - use typed fields
+		response := common.AgentResponse{
+			Id: requestID,
+		}
+
+		// Set the appropriate typed field based on data type
+		switch v := data.(type) {
+		case *system.CombinedData:
+			response.SystemData = v
+		case *common.FingerprintResponse:
+			response.Fingerprint = v
+		case string:
+			response.String = &v
+		case map[string]smart.SmartData:
+			response.SmartData = v
+		case systemd.ServiceDetails:
+			response.ServiceInfo = v
+		// case []byte:
+		// 	response.RawBytes = v
+		// case string:
+		// 	response.RawBytes = []byte(v)
+		default:
+			// For any other type, convert to error
+			response.Error = fmt.Sprintf("unsupported response type: %T", data)
+		}
+
+		return client.sendMessage(response)
+	} else {
+		// Legacy format - send data directly
+		return client.sendMessage(data)
+	}
+}
+
+// getUserAgent returns one of two User-Agent strings based on current time.
+// This is used to avoid being blocked by Cloudflare or other anti-bot measures.
+func getUserAgent() string {
+	const (
+		uaBase    = "Mozilla/5.0 (%s) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
+		uaWindows = "Windows NT 11.0; Win64; x64"
+		uaMac     = "Macintosh; Intel Mac OS X 14_0_0"
+	)
+	if time.Now().UnixNano()%2 == 0 {
+		return fmt.Sprintf(uaBase, uaWindows)
+	}
+	return fmt.Sprintf(uaBase, uaMac)
+}

agent/client_test.go

@@ -0,0 +1,561 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"crypto/ed25519"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel"
+
+	"github.com/henrygd/beszel/internal/common"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+
+// TestNewWebSocketClient tests WebSocket client creation
+func TestNewWebSocketClient(t *testing.T) {
+	agent := createTestAgent(t)
+
+	testCases := []struct {
+		name        string
+		hubURL      string
+		token       string
+		expectError bool
+		errorMsg    string
+	}{
+		{
+			name:        "valid configuration",
+			hubURL:      "http://localhost:8080",
+			token:       "test-token-123",
+			expectError: false,
+		},
+		{
+			name:        "valid https URL",
+			hubURL:      "https://hub.example.com",
+			token:       "secure-token",
+			expectError: false,
+		},
+		{
+			name:        "missing hub URL",
+			hubURL:      "",
+			token:       "test-token",
+			expectError: true,
+			errorMsg:    "HUB_URL environment variable not set",
+		},
+		{
+			name:        "invalid URL",
+			hubURL:      "ht\ttp://invalid",
+			token:       "test-token",
+			expectError: true,
+			errorMsg:    "invalid hub URL",
+		},
+		{
+			name:        "missing token",
+			hubURL:      "http://localhost:8080",
+			token:       "",
+			expectError: true,
+			errorMsg:    "must set TOKEN or TOKEN_FILE",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up environment
+			if tc.hubURL != "" {
+				os.Setenv("BESZEL_AGENT_HUB_URL", tc.hubURL)
+			} else {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
+			}
+			if tc.token != "" {
+				os.Setenv("BESZEL_AGENT_TOKEN", tc.token)
+			} else {
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
+			}
+			defer func() {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
+			}()
+
+			client, err := newWebSocketClient(agent)
+
+			if tc.expectError {
+				assert.Error(t, err)
+				if err != nil && tc.errorMsg != "" {
+					assert.Contains(t, err.Error(), tc.errorMsg)
+				}
+				assert.Nil(t, client)
+			} else {
+				require.NoError(t, err)
+				assert.NotNil(t, client)
+				assert.Equal(t, agent, client.agent)
+				assert.Equal(t, tc.token, client.token)
+				assert.Equal(t, tc.hubURL, client.hubURL.String())
+				assert.NotEmpty(t, client.fingerprint)
+				assert.NotNil(t, client.hubRequest)
+			}
+		})
+	}
+}
+
+// TestWebSocketClient_GetOptions tests WebSocket client options configuration
+func TestWebSocketClient_GetOptions(t *testing.T) {
+	agent := createTestAgent(t)
+
+	testCases := []struct {
+		name           string
+		inputURL       string
+		expectedScheme string
+		expectedPath   string
+	}{
+		{
+			name:           "http to ws conversion",
+			inputURL:       "http://localhost:8080",
+			expectedScheme: "ws",
+			expectedPath:   "/api/beszel/agent-connect",
+		},
+		{
+			name:           "https to wss conversion",
+			inputURL:       "https://hub.example.com",
+			expectedScheme: "wss",
+			expectedPath:   "/api/beszel/agent-connect",
+		},
+		{
+			name:           "existing path preservation",
+			inputURL:       "http://localhost:8080/custom/path",
+			expectedScheme: "ws",
+			expectedPath:   "/custom/path/api/beszel/agent-connect",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up environment
+			os.Setenv("BESZEL_AGENT_HUB_URL", tc.inputURL)
+			os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+			defer func() {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
+			}()
+
+			client, err := newWebSocketClient(agent)
+			require.NoError(t, err)
+
+			options := client.getOptions()
+
+			// Parse the WebSocket URL
+			wsURL, err := url.Parse(options.Addr)
+			require.NoError(t, err)
+
+			assert.Equal(t, tc.expectedScheme, wsURL.Scheme)
+			assert.Equal(t, tc.expectedPath, wsURL.Path)
+
+			// Check headers
+			assert.Equal(t, "test-token", options.RequestHeader.Get("X-Token"))
+			assert.Equal(t, beszel.Version, options.RequestHeader.Get("X-Beszel"))
+			assert.Contains(t, options.RequestHeader.Get("User-Agent"), "Mozilla/5.0")
+
+			// Test options caching
+			options2 := client.getOptions()
+			assert.Same(t, options, options2, "Options should be cached")
+		})
+	}
+}
+
+// TestWebSocketClient_VerifySignature tests signature verification
+func TestWebSocketClient_VerifySignature(t *testing.T) {
+	agent := createTestAgent(t)
+
+	// Generate test key pairs
+	_, goodPrivKey, err := ed25519.GenerateKey(nil)
+	require.NoError(t, err)
+	goodPubKey, err := ssh.NewPublicKey(goodPrivKey.Public().(ed25519.PublicKey))
+	require.NoError(t, err)
+
+	_, badPrivKey, err := ed25519.GenerateKey(nil)
+	require.NoError(t, err)
+	badPubKey, err := ssh.NewPublicKey(badPrivKey.Public().(ed25519.PublicKey))
+	require.NoError(t, err)
+
+	// Set up environment
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
+
+	client, err := newWebSocketClient(agent)
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name        string
+		keys        []ssh.PublicKey
+		token       string
+		signWith    ed25519.PrivateKey
+		expectError bool
+	}{
+		{
+			name:        "valid signature with correct key",
+			keys:        []ssh.PublicKey{goodPubKey},
+			token:       "test-token",
+			signWith:    goodPrivKey,
+			expectError: false,
+		},
+		{
+			name:        "invalid signature with wrong key",
+			keys:        []ssh.PublicKey{goodPubKey},
+			token:       "test-token",
+			signWith:    badPrivKey,
+			expectError: true,
+		},
+		{
+			name:        "valid signature with multiple keys",
+			keys:        []ssh.PublicKey{badPubKey, goodPubKey},
+			token:       "test-token",
+			signWith:    goodPrivKey,
+			expectError: false,
+		},
+		{
+			name:        "no valid keys",
+			keys:        []ssh.PublicKey{badPubKey},
+			token:       "test-token",
+			signWith:    goodPrivKey,
+			expectError: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up agent with test keys
+			agent.keys = tc.keys
+			client.token = tc.token
+
+			// Create signature
+			signature := ed25519.Sign(tc.signWith, []byte(tc.token))
+
+			err := client.verifySignature(signature)
+
+			if tc.expectError {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), "invalid signature")
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestWebSocketClient_HandleHubRequest tests hub request routing (basic verification logic)
+func TestWebSocketClient_HandleHubRequest(t *testing.T) {
+	agent := createTestAgent(t)
+
+	// Set up environment
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
+
+	client, err := newWebSocketClient(agent)
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name        string
+		action      common.WebSocketAction
+		hubVerified bool
+		expectError bool
+		errorMsg    string
+	}{
+		{
+			name:        "CheckFingerprint without verification",
+			action:      common.CheckFingerprint,
+			hubVerified: false,
+			expectError: false, // CheckFingerprint is allowed without verification
+		},
+		{
+			name:        "GetData without verification",
+			action:      common.GetData,
+			hubVerified: false,
+			expectError: true,
+			errorMsg:    "hub not verified",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			client.hubVerified = tc.hubVerified
+
+			// Create minimal request
+			hubRequest := &common.HubRequest[cbor.RawMessage]{
+				Action: tc.action,
+				Data:   cbor.RawMessage{},
+			}
+
+			err := client.handleHubRequest(hubRequest, nil)
+
+			if tc.expectError {
+				assert.Error(t, err)
+				if tc.errorMsg != "" {
+					assert.Contains(t, err.Error(), tc.errorMsg)
+				}
+			} else {
+				// For CheckFingerprint, we expect a decode error since we're not providing valid data,
+				// but it shouldn't be the "hub not verified" error
+				if err != nil && tc.errorMsg != "" {
+					assert.NotContains(t, err.Error(), tc.errorMsg)
+				}
+			}
+		})
+	}
+}
+
+// TestWebSocketClient_GetUserAgent tests user agent generation
+func TestGetUserAgent(t *testing.T) {
+	// Run multiple times to check both variants
+	userAgents := make(map[string]bool)
+
+	for range 20 {
+		ua := getUserAgent()
+		userAgents[ua] = true
+
+		// Check that it's a valid Mozilla user agent
+		assert.Contains(t, ua, "Mozilla/5.0")
+		assert.Contains(t, ua, "AppleWebKit/537.36")
+		assert.Contains(t, ua, "Chrome/124.0.0.0")
+		assert.Contains(t, ua, "Safari/537.36")
+
+		// Should contain either Windows or Mac
+		isWindows := strings.Contains(ua, "Windows NT 11.0")
+		isMac := strings.Contains(ua, "Macintosh; Intel Mac OS X 14_0_0")
+		assert.True(t, isWindows || isMac, "User agent should contain either Windows or Mac identifier")
+	}
+
+	// With enough iterations, we should see both variants
+	// though this might occasionally fail
+	if len(userAgents) == 1 {
+		t.Log("Note: Only one user agent variant was generated in this test run")
+	}
+}
+
+// TestWebSocketClient_Close tests connection closing
+func TestWebSocketClient_Close(t *testing.T) {
+	agent := createTestAgent(t)
+
+	// Set up environment
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
+
+	client, err := newWebSocketClient(agent)
+	require.NoError(t, err)
+
+	// Test closing with nil connection (should not panic)
+	assert.NotPanics(t, func() {
+		client.Close()
+	})
+}
+
+// TestWebSocketClient_ConnectRateLimit tests connection rate limiting
+func TestWebSocketClient_ConnectRateLimit(t *testing.T) {
+	agent := createTestAgent(t)
+
+	// Set up environment
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
+
+	client, err := newWebSocketClient(agent)
+	require.NoError(t, err)
+
+	// Set recent connection attempt
+	client.lastConnectAttempt = time.Now()
+
+	// Test that connection fails quickly due to rate limiting
+	// This won't actually connect but should fail fast
+	err = client.Connect()
+	assert.Error(t, err, "Connection should fail but not hang")
+}
+
+// TestGetToken tests the getToken function with various scenarios
+func TestGetToken(t *testing.T) {
+	unsetEnvVars := func() {
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+		os.Unsetenv("TOKEN")
+		os.Unsetenv("BESZEL_AGENT_TOKEN_FILE")
+		os.Unsetenv("TOKEN_FILE")
+	}
+
+	t.Run("token from TOKEN environment variable", func(t *testing.T) {
+		unsetEnvVars()
+
+		// Set TOKEN env var
+		expectedToken := "test-token-from-env"
+		os.Setenv("TOKEN", expectedToken)
+		defer os.Unsetenv("TOKEN")
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, expectedToken, token)
+	})
+
+	t.Run("token from BESZEL_AGENT_TOKEN environment variable", func(t *testing.T) {
+		unsetEnvVars()
+
+		// Set BESZEL_AGENT_TOKEN env var (should take precedence)
+		expectedToken := "test-token-from-beszel-env"
+		os.Setenv("BESZEL_AGENT_TOKEN", expectedToken)
+		defer os.Unsetenv("BESZEL_AGENT_TOKEN")
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, expectedToken, token)
+	})
+
+	t.Run("token from TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
+		// Create a temporary token file
+		expectedToken := "test-token-from-file"
+		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tokenFile.Name())
+
+		_, err = tokenFile.WriteString(expectedToken)
+		require.NoError(t, err)
+		tokenFile.Close()
+
+		// Set TOKEN_FILE env var
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("TOKEN_FILE")
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, expectedToken, token)
+	})
+
+	t.Run("token from BESZEL_AGENT_TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
+		// Create a temporary token file
+		expectedToken := "test-token-from-beszel-file"
+		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tokenFile.Name())
+
+		_, err = tokenFile.WriteString(expectedToken)
+		require.NoError(t, err)
+		tokenFile.Close()
+
+		// Set BESZEL_AGENT_TOKEN_FILE env var (should take precedence)
+		os.Setenv("BESZEL_AGENT_TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("BESZEL_AGENT_TOKEN_FILE")
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, expectedToken, token)
+	})
+
+	t.Run("TOKEN takes precedence over TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
+		// Create a temporary token file
+		fileToken := "token-from-file"
+		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tokenFile.Name())
+
+		_, err = tokenFile.WriteString(fileToken)
+		require.NoError(t, err)
+		tokenFile.Close()
+
+		// Set both TOKEN and TOKEN_FILE
+		envToken := "token-from-env"
+		os.Setenv("TOKEN", envToken)
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer func() {
+			os.Unsetenv("TOKEN")
+			os.Unsetenv("TOKEN_FILE")
+		}()
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, envToken, token, "TOKEN should take precedence over TOKEN_FILE")
+	})
+
+	t.Run("error when neither TOKEN nor TOKEN_FILE is set", func(t *testing.T) {
+		unsetEnvVars()
+
+		token, err := getToken()
+		assert.Error(t, err)
+		assert.Equal(t, "", token)
+		assert.Contains(t, err.Error(), "must set TOKEN or TOKEN_FILE")
+	})
+
+	t.Run("error when TOKEN_FILE points to non-existent file", func(t *testing.T) {
+		unsetEnvVars()
+
+		// Set TOKEN_FILE to a non-existent file
+		os.Setenv("TOKEN_FILE", "/non/existent/file.txt")
+		defer os.Unsetenv("TOKEN_FILE")
+
+		token, err := getToken()
+		assert.Error(t, err)
+		assert.Equal(t, "", token)
+		assert.Contains(t, err.Error(), "no such file or directory")
+	})
+
+	t.Run("handles empty token file", func(t *testing.T) {
+		unsetEnvVars()
+
+		// Create an empty token file
+		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tokenFile.Name())
+		tokenFile.Close()
+
+		// Set TOKEN_FILE env var
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("TOKEN_FILE")
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, "", token, "Empty file should return empty string")
+	})
+
+	t.Run("strips whitespace from TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
+		tokenWithWhitespace := "  test-token-with-whitespace  \n\t"
+		expectedToken := "test-token-with-whitespace"
+		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tokenFile.Name())
+
+		_, err = tokenFile.WriteString(tokenWithWhitespace)
+		require.NoError(t, err)
+		tokenFile.Close()
+
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("TOKEN_FILE")
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, expectedToken, token, "Whitespace should be stripped from token file content")
+	})
+}

agent/connection_manager.go

@@ -0,0 +1,226 @@
+package agent
+
+import (
+	"errors"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/henrygd/beszel/agent/health"
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+// ConnectionManager manages the connection state and events for the agent.
+// It handles both WebSocket and SSH connections, automatically switching between
+// them based on availability and managing reconnection attempts.
+type ConnectionManager struct {
+	agent          *Agent               // Reference to the parent agent
+	State          ConnectionState      // Current connection state
+	eventChan      chan ConnectionEvent // Channel for connection events
+	wsClient       *WebSocketClient     // WebSocket client for hub communication
+	serverOptions  ServerOptions        // Configuration for SSH server
+	wsTicker       *time.Ticker         // Ticker for WebSocket connection attempts
+	isConnecting   bool                 // Prevents multiple simultaneous reconnection attempts
+	ConnectionType system.ConnectionType
+}
+
+// ConnectionState represents the current connection state of the agent.
+type ConnectionState uint8
+
+// ConnectionEvent represents connection-related events that can occur.
+type ConnectionEvent uint8
+
+// Connection states
+const (
+	Disconnected       ConnectionState = iota // No active connection
+	WebSocketConnected                        // Connected via WebSocket
+	SSHConnected                              // Connected via SSH
+)
+
+// Connection events
+const (
+	WebSocketConnect    ConnectionEvent = iota // WebSocket connection established
+	WebSocketDisconnect                        // WebSocket connection lost
+	SSHConnect                                 // SSH connection established
+	SSHDisconnect                              // SSH connection lost
+)
+
+const wsTickerInterval = 10 * time.Second
+
+// newConnectionManager creates a new connection manager for the given agent.
+func newConnectionManager(agent *Agent) *ConnectionManager {
+	cm := &ConnectionManager{
+		agent: agent,
+		State: Disconnected,
+	}
+	return cm
+}
+
+// startWsTicker starts or resets the WebSocket connection attempt ticker.
+func (c *ConnectionManager) startWsTicker() {
+	if c.wsTicker == nil {
+		c.wsTicker = time.NewTicker(wsTickerInterval)
+	} else {
+		c.wsTicker.Reset(wsTickerInterval)
+	}
+}
+
+// stopWsTicker stops the WebSocket connection attempt ticker.
+func (c *ConnectionManager) stopWsTicker() {
+	if c.wsTicker != nil {
+		c.wsTicker.Stop()
+	}
+}
+
+// Start begins connection attempts and enters the main event loop.
+// It handles connection events, periodic health updates, and graceful shutdown.
+func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
+	if c.eventChan != nil {
+		return errors.New("already started")
+	}
+
+	wsClient, err := newWebSocketClient(c.agent)
+	if err != nil {
+		slog.Warn("Error creating WebSocket client", "err", err)
+	}
+	c.wsClient = wsClient
+
+	c.serverOptions = serverOptions
+	c.eventChan = make(chan ConnectionEvent, 1)
+
+	// signal handling for shutdown
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
+
+	c.startWsTicker()
+	c.connect()
+
+	// update health status immediately and every 90 seconds
+	_ = health.Update()
+	healthTicker := time.Tick(90 * time.Second)
+
+	for {
+		select {
+		case connectionEvent := <-c.eventChan:
+			c.handleEvent(connectionEvent)
+		case <-c.wsTicker.C:
+			_ = c.startWebSocketConnection()
+		case <-healthTicker:
+			_ = health.Update()
+		case <-sigChan:
+			slog.Info("Shutting down")
+			_ = c.agent.StopServer()
+			c.closeWebSocket()
+			return health.CleanUp()
+		}
+	}
+}
+
+// handleEvent processes connection events and updates the connection state accordingly.
+func (c *ConnectionManager) handleEvent(event ConnectionEvent) {
+	switch event {
+	case WebSocketConnect:
+		c.handleStateChange(WebSocketConnected)
+	case SSHConnect:
+		c.handleStateChange(SSHConnected)
+	case WebSocketDisconnect:
+		if c.State == WebSocketConnected {
+			c.handleStateChange(Disconnected)
+		}
+	case SSHDisconnect:
+		if c.State == SSHConnected {
+			c.handleStateChange(Disconnected)
+		}
+	}
+}
+
+// handleStateChange updates the connection state and performs necessary actions
+// based on the new state, including stopping services and initiating reconnections.
+func (c *ConnectionManager) handleStateChange(newState ConnectionState) {
+	if c.State == newState {
+		return
+	}
+	c.State = newState
+	switch newState {
+	case WebSocketConnected:
+		slog.Info("WebSocket connected", "host", c.wsClient.hubURL.Host)
+		c.ConnectionType = system.ConnectionTypeWebSocket
+		c.stopWsTicker()
+		_ = c.agent.StopServer()
+		c.isConnecting = false
+	case SSHConnected:
+		// stop new ws connection attempts
+		slog.Info("SSH connection established")
+		c.ConnectionType = system.ConnectionTypeSSH
+		c.stopWsTicker()
+		c.isConnecting = false
+	case Disconnected:
+		c.ConnectionType = system.ConnectionTypeNone
+		if c.isConnecting {
+			// Already handling reconnection, avoid duplicate attempts
+			return
+		}
+		c.isConnecting = true
+		slog.Warn("Disconnected from hub")
+		// make sure old ws connection is closed
+		c.closeWebSocket()
+		// reconnect
+		go c.connect()
+	}
+}
+
+// connect handles the connection logic with proper delays and priority.
+// It attempts WebSocket connection first, falling back to SSH server if needed.
+func (c *ConnectionManager) connect() {
+	c.isConnecting = true
+	defer func() {
+		c.isConnecting = false
+	}()
+
+	if c.wsClient != nil && time.Since(c.wsClient.lastConnectAttempt) < 5*time.Second {
+		time.Sleep(5 * time.Second)
+	}
+
+	// Try WebSocket first, if it fails, start SSH server
+	err := c.startWebSocketConnection()
+	if err != nil && c.State == Disconnected {
+		c.startSSHServer()
+		c.startWsTicker()
+	}
+}
+
+// startWebSocketConnection attempts to establish a WebSocket connection to the hub.
+func (c *ConnectionManager) startWebSocketConnection() error {
+	if c.State != Disconnected {
+		return errors.New("already connected")
+	}
+	if c.wsClient == nil {
+		return errors.New("WebSocket client not initialized")
+	}
+	if time.Since(c.wsClient.lastConnectAttempt) < 5*time.Second {
+		return errors.New("already connecting")
+	}
+
+	err := c.wsClient.Connect()
+	if err != nil {
+		slog.Warn("WebSocket connection failed", "err", err)
+		c.closeWebSocket()
+	}
+	return err
+}
+
+// startSSHServer starts the SSH server if the agent is currently disconnected.
+func (c *ConnectionManager) startSSHServer() {
+	if c.State == Disconnected {
+		go c.agent.StartServer(c.serverOptions)
+	}
+}
+
+// closeWebSocket closes the WebSocket connection if it exists.
+func (c *ConnectionManager) closeWebSocket() {
+	if c.wsClient != nil {
+		c.wsClient.Close()
+	}
+}

agent/connection_manager_test.go

@@ -0,0 +1,315 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"crypto/ed25519"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
+)
+
+func createTestAgent(t *testing.T) *Agent {
+	dataDir := t.TempDir()
+	agent, err := NewAgent(dataDir)
+	require.NoError(t, err)
+	return agent
+}
+
+func createTestServerOptions(t *testing.T) ServerOptions {
+	// Generate test key pair
+	_, privKey, err := ed25519.GenerateKey(nil)
+	require.NoError(t, err)
+	sshPubKey, err := ssh.NewPublicKey(privKey.Public().(ed25519.PublicKey))
+	require.NoError(t, err)
+
+	// Find available port
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	port := listener.Addr().(*net.TCPAddr).Port
+	listener.Close()
+
+	return ServerOptions{
+		Network: "tcp",
+		Addr:    fmt.Sprintf("127.0.0.1:%d", port),
+		Keys:    []ssh.PublicKey{sshPubKey},
+	}
+}
+
+// TestConnectionManager_NewConnectionManager tests connection manager creation
+func TestConnectionManager_NewConnectionManager(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := newConnectionManager(agent)
+
+	assert.NotNil(t, cm, "Connection manager should not be nil")
+	assert.Equal(t, agent, cm.agent, "Agent reference should be set")
+	assert.Equal(t, Disconnected, cm.State, "Initial state should be Disconnected")
+	assert.Nil(t, cm.eventChan, "Event channel should be nil initially")
+	assert.Nil(t, cm.wsClient, "WebSocket client should be nil initially")
+	assert.Nil(t, cm.wsTicker, "WebSocket ticker should be nil initially")
+	assert.False(t, cm.isConnecting, "isConnecting should be false initially")
+}
+
+// TestConnectionManager_StateTransitions tests basic state transitions
+func TestConnectionManager_StateTransitions(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+	initialState := cm.State
+	cm.wsClient = &WebSocketClient{
+		hubURL: &url.URL{
+			Host: "localhost:8080",
+		},
+	}
+	assert.NotNil(t, cm, "Connection manager should not be nil")
+	assert.Equal(t, Disconnected, initialState, "Initial state should be Disconnected")
+
+	// Test state transitions
+	cm.handleStateChange(WebSocketConnected)
+	assert.Equal(t, WebSocketConnected, cm.State, "State should change to WebSocketConnected")
+
+	cm.handleStateChange(SSHConnected)
+	assert.Equal(t, SSHConnected, cm.State, "State should change to SSHConnected")
+
+	cm.handleStateChange(Disconnected)
+	assert.Equal(t, Disconnected, cm.State, "State should change to Disconnected")
+
+	// Test that same state doesn't trigger changes
+	cm.State = WebSocketConnected
+	cm.handleStateChange(WebSocketConnected)
+	assert.Equal(t, WebSocketConnected, cm.State, "Same state should not trigger change")
+}
+
+// TestConnectionManager_EventHandling tests event handling logic
+func TestConnectionManager_EventHandling(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+	cm.wsClient = &WebSocketClient{
+		hubURL: &url.URL{
+			Host: "localhost:8080",
+		},
+	}
+
+	testCases := []struct {
+		name          string
+		initialState  ConnectionState
+		event         ConnectionEvent
+		expectedState ConnectionState
+	}{
+		{
+			name:          "WebSocket connect from disconnected",
+			initialState:  Disconnected,
+			event:         WebSocketConnect,
+			expectedState: WebSocketConnected,
+		},
+		{
+			name:          "SSH connect from disconnected",
+			initialState:  Disconnected,
+			event:         SSHConnect,
+			expectedState: SSHConnected,
+		},
+		{
+			name:          "WebSocket disconnect from connected",
+			initialState:  WebSocketConnected,
+			event:         WebSocketDisconnect,
+			expectedState: Disconnected,
+		},
+		{
+			name:          "SSH disconnect from connected",
+			initialState:  SSHConnected,
+			event:         SSHDisconnect,
+			expectedState: Disconnected,
+		},
+		{
+			name:          "WebSocket disconnect from SSH connected (no change)",
+			initialState:  SSHConnected,
+			event:         WebSocketDisconnect,
+			expectedState: SSHConnected,
+		},
+		{
+			name:          "SSH disconnect from WebSocket connected (no change)",
+			initialState:  WebSocketConnected,
+			event:         SSHDisconnect,
+			expectedState: WebSocketConnected,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			cm.State = tc.initialState
+			cm.handleEvent(tc.event)
+			assert.Equal(t, tc.expectedState, cm.State, "State should match expected after event")
+		})
+	}
+}
+
+// TestConnectionManager_TickerManagement tests WebSocket ticker management
+func TestConnectionManager_TickerManagement(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+
+	// Test starting ticker
+	cm.startWsTicker()
+	assert.NotNil(t, cm.wsTicker, "Ticker should be created")
+
+	// Test stopping ticker (should not panic)
+	assert.NotPanics(t, func() {
+		cm.stopWsTicker()
+	}, "Stopping ticker should not panic")
+
+	// Test stopping nil ticker (should not panic)
+	cm.wsTicker = nil
+	assert.NotPanics(t, func() {
+		cm.stopWsTicker()
+	}, "Stopping nil ticker should not panic")
+
+	// Test restarting ticker
+	cm.startWsTicker()
+	assert.NotNil(t, cm.wsTicker, "Ticker should be recreated")
+
+	// Test resetting existing ticker
+	firstTicker := cm.wsTicker
+	cm.startWsTicker()
+	assert.Equal(t, firstTicker, cm.wsTicker, "Same ticker instance should be reused")
+
+	cm.stopWsTicker()
+}
+
+// TestConnectionManager_WebSocketConnectionFlow tests WebSocket connection logic
+func TestConnectionManager_WebSocketConnectionFlow(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping WebSocket connection test in short mode")
+	}
+
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+
+	// Test WebSocket connection without proper environment
+	err := cm.startWebSocketConnection()
+	assert.Error(t, err, "WebSocket connection should fail without proper environment")
+	assert.Equal(t, Disconnected, cm.State, "State should remain Disconnected after failed connection")
+
+	// Test with invalid URL
+	os.Setenv("BESZEL_AGENT_HUB_URL", "invalid-url")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
+
+	// Test with missing token
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Unsetenv("BESZEL_AGENT_TOKEN")
+
+	_, err2 := newWebSocketClient(agent)
+	assert.Error(t, err2, "WebSocket client creation should fail without token")
+}
+
+// TestConnectionManager_ReconnectionLogic tests reconnection prevention logic
+func TestConnectionManager_ReconnectionLogic(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+	cm.eventChan = make(chan ConnectionEvent, 1)
+
+	// Test that isConnecting flag prevents duplicate reconnection attempts
+	// Start from connected state, then simulate disconnect
+	cm.State = WebSocketConnected
+	cm.isConnecting = false
+
+	// First disconnect should trigger reconnection logic
+	cm.handleStateChange(Disconnected)
+	assert.Equal(t, Disconnected, cm.State, "Should change to disconnected")
+	assert.True(t, cm.isConnecting, "Should set isConnecting flag")
+}
+
+// TestConnectionManager_ConnectWithRateLimit tests connection rate limiting
+func TestConnectionManager_ConnectWithRateLimit(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+
+	// Set up environment for WebSocket client creation
+	os.Setenv("BESZEL_AGENT_HUB_URL", "ws://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
+
+	// Create WebSocket client
+	wsClient, err := newWebSocketClient(agent)
+	require.NoError(t, err)
+	cm.wsClient = wsClient
+
+	// Set recent connection attempt
+	cm.wsClient.lastConnectAttempt = time.Now()
+
+	// Test that connection is rate limited
+	err = cm.startWebSocketConnection()
+	assert.Error(t, err, "Should error due to rate limiting")
+	assert.Contains(t, err.Error(), "already connecting", "Error should indicate rate limiting")
+
+	// Test connection after rate limit expires
+	cm.wsClient.lastConnectAttempt = time.Now().Add(-10 * time.Second)
+	err = cm.startWebSocketConnection()
+	// This will fail due to no actual server, but should not be rate limited
+	assert.Error(t, err, "Connection should fail but not due to rate limiting")
+	assert.NotContains(t, err.Error(), "already connecting", "Error should not indicate rate limiting")
+}
+
+// TestConnectionManager_StartWithInvalidConfig tests starting with invalid configuration
+func TestConnectionManager_StartWithInvalidConfig(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+	serverOptions := createTestServerOptions(t)
+
+	// Test starting when already started
+	cm.eventChan = make(chan ConnectionEvent, 5)
+	err := cm.Start(serverOptions)
+	assert.Error(t, err, "Should error when starting already started connection manager")
+}
+
+// TestConnectionManager_CloseWebSocket tests WebSocket closing
+func TestConnectionManager_CloseWebSocket(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+
+	// Test closing when no WebSocket client exists
+	assert.NotPanics(t, func() {
+		cm.closeWebSocket()
+	}, "Should not panic when closing nil WebSocket client")
+
+	// Set up environment and create WebSocket client
+	os.Setenv("BESZEL_AGENT_HUB_URL", "ws://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
+
+	wsClient, err := newWebSocketClient(agent)
+	require.NoError(t, err)
+	cm.wsClient = wsClient
+
+	// Test closing when WebSocket client exists
+	assert.NotPanics(t, func() {
+		cm.closeWebSocket()
+	}, "Should not panic when closing WebSocket client")
+}
+
+// TestConnectionManager_ConnectFlow tests the connect method
+func TestConnectionManager_ConnectFlow(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+
+	// Test connect without WebSocket client
+	assert.NotPanics(t, func() {
+		cm.connect()
+	}, "Connect should not panic without WebSocket client")
+}

agent/cpu.go

@@ -0,0 +1,134 @@
+package agent
+
+import (
+	"math"
+	"runtime"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/cpu"
+)
+
+var lastCpuTimes = make(map[uint16]cpu.TimesStat)
+var lastPerCoreCpuTimes = make(map[uint16][]cpu.TimesStat)
+
+// init initializes the CPU monitoring by storing the initial CPU times
+// for the default 60-second cache interval.
+func init() {
+	if times, err := cpu.Times(false); err == nil {
+		lastCpuTimes[60000] = times[0]
+	}
+	if perCoreTimes, err := cpu.Times(true); err == nil {
+		lastPerCoreCpuTimes[60000] = perCoreTimes
+	}
+}
+
+// CpuMetrics contains detailed CPU usage breakdown
+type CpuMetrics struct {
+	Total  float64
+	User   float64
+	System float64
+	Iowait float64
+	Steal  float64
+	Idle   float64
+}
+
+// getCpuMetrics calculates detailed CPU usage metrics using cached previous measurements.
+// It returns percentages for total, user, system, iowait, and steal time.
+func getCpuMetrics(cacheTimeMs uint16) (CpuMetrics, error) {
+	times, err := cpu.Times(false)
+	if err != nil || len(times) == 0 {
+		return CpuMetrics{}, err
+	}
+	// if cacheTimeMs is not in lastCpuTimes, use 60000 as fallback lastCpuTime
+	if _, ok := lastCpuTimes[cacheTimeMs]; !ok {
+		lastCpuTimes[cacheTimeMs] = lastCpuTimes[60000]
+	}
+
+	t1 := lastCpuTimes[cacheTimeMs]
+	t2 := times[0]
+
+	t1All, _ := getAllBusy(t1)
+	t2All, _ := getAllBusy(t2)
+
+	totalDelta := t2All - t1All
+	if totalDelta <= 0 {
+		return CpuMetrics{}, nil
+	}
+
+	metrics := CpuMetrics{
+		Total:  calculateBusy(t1, t2),
+		User:   clampPercent((t2.User - t1.User) / totalDelta * 100),
+		System: clampPercent((t2.System - t1.System) / totalDelta * 100),
+		Iowait: clampPercent((t2.Iowait - t1.Iowait) / totalDelta * 100),
+		Steal:  clampPercent((t2.Steal - t1.Steal) / totalDelta * 100),
+		Idle:   clampPercent((t2.Idle - t1.Idle) / totalDelta * 100),
+	}
+
+	lastCpuTimes[cacheTimeMs] = times[0]
+	return metrics, nil
+}
+
+// clampPercent ensures the percentage is between 0 and 100
+func clampPercent(value float64) float64 {
+	return math.Min(100, math.Max(0, value))
+}
+
+// getPerCoreCpuUsage calculates per-core CPU busy usage as integer percentages (0-100).
+// It uses cached previous measurements for the provided cache interval.
+func getPerCoreCpuUsage(cacheTimeMs uint16) (system.Uint8Slice, error) {
+	perCoreTimes, err := cpu.Times(true)
+	if err != nil || len(perCoreTimes) == 0 {
+		return nil, err
+	}
+
+	// Initialize cache if needed
+	if _, ok := lastPerCoreCpuTimes[cacheTimeMs]; !ok {
+		lastPerCoreCpuTimes[cacheTimeMs] = lastPerCoreCpuTimes[60000]
+	}
+
+	lastTimes := lastPerCoreCpuTimes[cacheTimeMs]
+
+	// Limit to the number of cores available in both samples
+	length := len(perCoreTimes)
+	if len(lastTimes) < length {
+		length = len(lastTimes)
+	}
+
+	usage := make([]uint8, length)
+	for i := 0; i < length; i++ {
+		t1 := lastTimes[i]
+		t2 := perCoreTimes[i]
+		usage[i] = uint8(math.Round(calculateBusy(t1, t2)))
+	}
+
+	lastPerCoreCpuTimes[cacheTimeMs] = perCoreTimes
+	return usage, nil
+}
+
+// calculateBusy calculates the CPU busy percentage between two time points.
+// It computes the ratio of busy time to total time elapsed between t1 and t2,
+// returning a percentage clamped between 0 and 100.
+func calculateBusy(t1, t2 cpu.TimesStat) float64 {
+	t1All, t1Busy := getAllBusy(t1)
+	t2All, t2Busy := getAllBusy(t2)
+
+	if t2All <= t1All || t2Busy <= t1Busy {
+		return 0
+	}
+	return clampPercent((t2Busy - t1Busy) / (t2All - t1All) * 100)
+}
+
+// getAllBusy calculates the total CPU time and busy CPU time from CPU times statistics.
+// On Linux, it excludes guest and guest_nice time from the total to match kernel behavior.
+// Returns total CPU time and busy CPU time (total minus idle and I/O wait time).
+func getAllBusy(t cpu.TimesStat) (float64, float64) {
+	tot := t.Total()
+	if runtime.GOOS == "linux" {
+		tot -= t.Guest     // Linux 2.6.24+
+		tot -= t.GuestNice // Linux 3.2.0+
+	}
+
+	busy := tot - t.Idle - t.Iowait
+
+	return tot, busy
+}

agent/data_dir.go

@@ -0,0 +1,117 @@
+package agent
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// getDataDir returns the path to the data directory for the agent and an error
+// if the directory is not valid. Attempts to find the optimal data directory if
+// no data directories are provided.
+func getDataDir(dataDirs ...string) (string, error) {
+	if len(dataDirs) > 0 {
+		return testDataDirs(dataDirs)
+	}
+
+	dataDir, _ := GetEnv("DATA_DIR")
+	if dataDir != "" {
+		dataDirs = append(dataDirs, dataDir)
+	}
+
+	if runtime.GOOS == "windows" {
+		dataDirs = append(dataDirs,
+			filepath.Join(os.Getenv("APPDATA"), "beszel-agent"),
+			filepath.Join(os.Getenv("LOCALAPPDATA"), "beszel-agent"),
+		)
+	} else {
+		dataDirs = append(dataDirs, "/var/lib/beszel-agent")
+		if homeDir, err := os.UserHomeDir(); err == nil {
+			dataDirs = append(dataDirs, filepath.Join(homeDir, ".config", "beszel"))
+		}
+	}
+	return testDataDirs(dataDirs)
+}
+
+func testDataDirs(paths []string) (string, error) {
+	// first check if the directory exists and is writable
+	for _, path := range paths {
+		if valid, _ := isValidDataDir(path, false); valid {
+			return path, nil
+		}
+	}
+	// if the directory doesn't exist, try to create it
+	for _, path := range paths {
+		exists, _ := directoryExists(path)
+		if exists {
+			continue
+		}
+
+		if err := os.MkdirAll(path, 0755); err != nil {
+			continue
+		}
+
+		// Verify the created directory is actually writable
+		writable, _ := directoryIsWritable(path)
+		if !writable {
+			continue
+		}
+
+		return path, nil
+	}
+
+	return "", errors.New("data directory not found")
+}
+
+func isValidDataDir(path string, createIfNotExists bool) (bool, error) {
+	exists, err := directoryExists(path)
+	if err != nil {
+		return false, err
+	}
+
+	if !exists {
+		if !createIfNotExists {
+			return false, nil
+		}
+		if err = os.MkdirAll(path, 0755); err != nil {
+			return false, err
+		}
+	}
+
+	// Always check if the directory is writable
+	writable, err := directoryIsWritable(path)
+	if err != nil {
+		return false, err
+	}
+	return writable, nil
+}
+
+// directoryExists checks if a directory exists
+func directoryExists(path string) (bool, error) {
+	// Check if directory exists
+	stat, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	if !stat.IsDir() {
+		return false, fmt.Errorf("%s is not a directory", path)
+	}
+	return true, nil
+}
+
+// directoryIsWritable tests if a directory is writable by creating and removing a temporary file
+func directoryIsWritable(path string) (bool, error) {
+	testFile := filepath.Join(path, ".write-test")
+	file, err := os.Create(testFile)
+	if err != nil {
+		return false, err
+	}
+	defer file.Close()
+	defer os.Remove(testFile)
+	return true, nil
+}

agent/data_dir_test.go

@@ -0,0 +1,263 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetDataDir(t *testing.T) {
+	// Test with explicit dataDir parameter
+	t.Run("explicit data dir", func(t *testing.T) {
+		tempDir := t.TempDir()
+		result, err := getDataDir(tempDir)
+		require.NoError(t, err)
+		assert.Equal(t, tempDir, result)
+	})
+
+	// Test with explicit non-existent dataDir that can be created
+	t.Run("explicit data dir - create new", func(t *testing.T) {
+		tempDir := t.TempDir()
+		newDir := filepath.Join(tempDir, "new-data-dir")
+		result, err := getDataDir(newDir)
+		require.NoError(t, err)
+		assert.Equal(t, newDir, result)
+
+		// Verify directory was created
+		stat, err := os.Stat(newDir)
+		require.NoError(t, err)
+		assert.True(t, stat.IsDir())
+	})
+
+	// Test with DATA_DIR environment variable
+	t.Run("DATA_DIR environment variable", func(t *testing.T) {
+		tempDir := t.TempDir()
+
+		// Set environment variable
+		oldValue := os.Getenv("DATA_DIR")
+		defer func() {
+			if oldValue == "" {
+				os.Unsetenv("BESZEL_AGENT_DATA_DIR")
+			} else {
+				os.Setenv("BESZEL_AGENT_DATA_DIR", oldValue)
+			}
+		}()
+
+		os.Setenv("BESZEL_AGENT_DATA_DIR", tempDir)
+
+		result, err := getDataDir()
+		require.NoError(t, err)
+		assert.Equal(t, tempDir, result)
+	})
+
+	// Test with invalid explicit dataDir
+	t.Run("invalid explicit data dir", func(t *testing.T) {
+		invalidPath := "/invalid/path/that/cannot/be/created"
+		_, err := getDataDir(invalidPath)
+		assert.Error(t, err)
+	})
+
+	// Test fallback behavior (empty dataDir, no env var)
+	t.Run("fallback to default directories", func(t *testing.T) {
+		// Clear DATA_DIR environment variable
+		oldValue := os.Getenv("DATA_DIR")
+		defer func() {
+			if oldValue == "" {
+				os.Unsetenv("DATA_DIR")
+			} else {
+				os.Setenv("DATA_DIR", oldValue)
+			}
+		}()
+		os.Unsetenv("DATA_DIR")
+
+		// This will try platform-specific defaults, which may or may not work
+		// We're mainly testing that it doesn't panic and returns some result
+		result, err := getDataDir()
+		// We don't assert success/failure here since it depends on system permissions
+		// Just verify we get a string result if no error
+		if err == nil {
+			assert.NotEmpty(t, result)
+		}
+	})
+}
+
+func TestTestDataDirs(t *testing.T) {
+	// Test with existing valid directory
+	t.Run("existing valid directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		result, err := testDataDirs([]string{tempDir})
+		require.NoError(t, err)
+		assert.Equal(t, tempDir, result)
+	})
+
+	// Test with multiple directories, first one valid
+	t.Run("multiple dirs - first valid", func(t *testing.T) {
+		tempDir := t.TempDir()
+		invalidDir := "/invalid/path"
+		result, err := testDataDirs([]string{tempDir, invalidDir})
+		require.NoError(t, err)
+		assert.Equal(t, tempDir, result)
+	})
+
+	// Test with multiple directories, second one valid
+	t.Run("multiple dirs - second valid", func(t *testing.T) {
+		tempDir := t.TempDir()
+		invalidDir := "/invalid/path"
+		result, err := testDataDirs([]string{invalidDir, tempDir})
+		require.NoError(t, err)
+		assert.Equal(t, tempDir, result)
+	})
+
+	// Test with non-existing directory that can be created
+	t.Run("create new directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		newDir := filepath.Join(tempDir, "new-dir")
+		result, err := testDataDirs([]string{newDir})
+		require.NoError(t, err)
+		assert.Equal(t, newDir, result)
+
+		// Verify directory was created
+		stat, err := os.Stat(newDir)
+		require.NoError(t, err)
+		assert.True(t, stat.IsDir())
+	})
+
+	// Test with no valid directories
+	t.Run("no valid directories", func(t *testing.T) {
+		invalidPaths := []string{"/invalid/path1", "/invalid/path2"}
+		_, err := testDataDirs(invalidPaths)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "data directory not found")
+	})
+}
+
+func TestIsValidDataDir(t *testing.T) {
+	// Test with existing directory
+	t.Run("existing directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		valid, err := isValidDataDir(tempDir, false)
+		require.NoError(t, err)
+		assert.True(t, valid)
+	})
+
+	// Test with non-existing directory, createIfNotExists=false
+	t.Run("non-existing dir - no create", func(t *testing.T) {
+		tempDir := t.TempDir()
+		nonExistentDir := filepath.Join(tempDir, "does-not-exist")
+		valid, err := isValidDataDir(nonExistentDir, false)
+		require.NoError(t, err)
+		assert.False(t, valid)
+	})
+
+	// Test with non-existing directory, createIfNotExists=true
+	t.Run("non-existing dir - create", func(t *testing.T) {
+		tempDir := t.TempDir()
+		newDir := filepath.Join(tempDir, "new-dir")
+		valid, err := isValidDataDir(newDir, true)
+		require.NoError(t, err)
+		assert.True(t, valid)
+
+		// Verify directory was created
+		stat, err := os.Stat(newDir)
+		require.NoError(t, err)
+		assert.True(t, stat.IsDir())
+	})
+
+	// Test with file instead of directory
+	t.Run("file instead of directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		tempFile := filepath.Join(tempDir, "testfile")
+		err := os.WriteFile(tempFile, []byte("test"), 0644)
+		require.NoError(t, err)
+
+		valid, err := isValidDataDir(tempFile, false)
+		assert.Error(t, err)
+		assert.False(t, valid)
+		assert.Contains(t, err.Error(), "is not a directory")
+	})
+}
+
+func TestDirectoryExists(t *testing.T) {
+	// Test with existing directory
+	t.Run("existing directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		exists, err := directoryExists(tempDir)
+		require.NoError(t, err)
+		assert.True(t, exists)
+	})
+
+	// Test with non-existing directory
+	t.Run("non-existing directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		nonExistentDir := filepath.Join(tempDir, "does-not-exist")
+		exists, err := directoryExists(nonExistentDir)
+		require.NoError(t, err)
+		assert.False(t, exists)
+	})
+
+	// Test with file instead of directory
+	t.Run("file instead of directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		tempFile := filepath.Join(tempDir, "testfile")
+		err := os.WriteFile(tempFile, []byte("test"), 0644)
+		require.NoError(t, err)
+
+		exists, err := directoryExists(tempFile)
+		assert.Error(t, err)
+		assert.False(t, exists)
+		assert.Contains(t, err.Error(), "is not a directory")
+	})
+}
+
+func TestDirectoryIsWritable(t *testing.T) {
+	// Test with writable directory
+	t.Run("writable directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		writable, err := directoryIsWritable(tempDir)
+		require.NoError(t, err)
+		assert.True(t, writable)
+	})
+
+	// Test with non-existing directory
+	t.Run("non-existing directory", func(t *testing.T) {
+		tempDir := t.TempDir()
+		nonExistentDir := filepath.Join(tempDir, "does-not-exist")
+		writable, err := directoryIsWritable(nonExistentDir)
+		assert.Error(t, err)
+		assert.False(t, writable)
+	})
+
+	// Test with non-writable directory (Unix-like systems only)
+	t.Run("non-writable directory", func(t *testing.T) {
+		if runtime.GOOS != "linux" && runtime.GOOS != "darwin" {
+			t.Skip("Skipping non-writable directory test on", runtime.GOOS)
+		}
+
+		tempDir := t.TempDir()
+		readOnlyDir := filepath.Join(tempDir, "readonly")
+
+		// Create the directory
+		err := os.Mkdir(readOnlyDir, 0755)
+		require.NoError(t, err)
+
+		// Make it read-only
+		err = os.Chmod(readOnlyDir, 0444)
+		require.NoError(t, err)
+
+		// Restore permissions after test for cleanup
+		defer func() {
+			os.Chmod(readOnlyDir, 0755)
+		}()
+
+		writable, err := directoryIsWritable(readOnlyDir)
+		assert.Error(t, err)
+		assert.False(t, writable)
+	})
+}

agent/deltatracker/deltatracker.go

@@ -0,0 +1,100 @@
+// Package deltatracker provides a tracker for calculating differences in numeric values over time.
+package deltatracker
+
+import (
+	"sync"
+
+	"golang.org/x/exp/constraints"
+)
+
+// Numeric is a constraint that permits any integer or floating-point type.
+type Numeric interface {
+	constraints.Integer | constraints.Float
+}
+
+// DeltaTracker is a generic, thread-safe tracker for calculating differences
+// in numeric values over time.
+// K is the key type (e.g., int, string).
+// V is the value type (e.g., int, int64, float32, float64).
+type DeltaTracker[K comparable, V Numeric] struct {
+	sync.RWMutex
+	current  map[K]V
+	previous map[K]V
+}
+
+// NewDeltaTracker creates a new generic tracker.
+func NewDeltaTracker[K comparable, V Numeric]() *DeltaTracker[K, V] {
+	return &DeltaTracker[K, V]{
+		current:  make(map[K]V),
+		previous: make(map[K]V),
+	}
+}
+
+// Set records the current value for a given ID.
+func (t *DeltaTracker[K, V]) Set(id K, value V) {
+	t.Lock()
+	defer t.Unlock()
+	t.current[id] = value
+}
+
+// Snapshot returns a copy of the current map.
+// func (t *DeltaTracker[K, V]) Snapshot() map[K]V {
+// 	t.RLock()
+// 	defer t.RUnlock()
+
+// 	copyMap := make(map[K]V, len(t.current))
+// 	maps.Copy(copyMap, t.current)
+// 	return copyMap
+// }
+
+// Deltas returns a map of all calculated deltas for the current interval.
+func (t *DeltaTracker[K, V]) Deltas() map[K]V {
+	t.RLock()
+	defer t.RUnlock()
+
+	deltas := make(map[K]V)
+	for id, currentVal := range t.current {
+		if previousVal, ok := t.previous[id]; ok {
+			deltas[id] = currentVal - previousVal
+		} else {
+			deltas[id] = 0
+		}
+	}
+	return deltas
+}
+
+// Previous returns the previously recorded value for the given key, if it exists.
+func (t *DeltaTracker[K, V]) Previous(id K) (V, bool) {
+	t.RLock()
+	defer t.RUnlock()
+
+	value, ok := t.previous[id]
+	return value, ok
+}
+
+// Delta returns the delta for a single key.
+// Returns 0 if the key doesn't exist or has no previous value.
+func (t *DeltaTracker[K, V]) Delta(id K) V {
+	t.RLock()
+	defer t.RUnlock()
+
+	currentVal, currentOk := t.current[id]
+	if !currentOk {
+		return 0
+	}
+
+	previousVal, previousOk := t.previous[id]
+	if !previousOk {
+		return 0
+	}
+
+	return currentVal - previousVal
+}
+
+// Cycle prepares the tracker for the next interval.
+func (t *DeltaTracker[K, V]) Cycle() {
+	t.Lock()
+	defer t.Unlock()
+	t.previous = t.current
+	t.current = make(map[K]V)
+}

agent/deltatracker/deltatracker_test.go

@@ -0,0 +1,217 @@
+package deltatracker
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func ExampleDeltaTracker() {
+	tracker := NewDeltaTracker[string, int]()
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+	tracker.Cycle()
+	tracker.Set("key1", 15)
+	tracker.Set("key2", 30)
+	fmt.Println(tracker.Delta("key1"))
+	fmt.Println(tracker.Delta("key2"))
+	fmt.Println(tracker.Deltas())
+	// Output: 5
+	// 10
+	// map[key1:5 key2:10]
+}
+
+func TestNewDeltaTracker(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+	assert.NotNil(t, tracker)
+	assert.Empty(t, tracker.current)
+	assert.Empty(t, tracker.previous)
+}
+
+func TestSet(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+	tracker.Set("key1", 10)
+
+	tracker.RLock()
+	defer tracker.RUnlock()
+
+	assert.Equal(t, 10, tracker.current["key1"])
+}
+
+func TestDeltas(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// Test with no previous values
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+
+	deltas := tracker.Deltas()
+	assert.Equal(t, 0, deltas["key1"])
+	assert.Equal(t, 0, deltas["key2"])
+
+	// Cycle to move current to previous
+	tracker.Cycle()
+
+	// Set new values and check deltas
+	tracker.Set("key1", 15) // Delta should be 5 (15-10)
+	tracker.Set("key2", 25) // Delta should be 5 (25-20)
+	tracker.Set("key3", 30) // New key, delta should be 0
+
+	deltas = tracker.Deltas()
+	assert.Equal(t, 5, deltas["key1"])
+	assert.Equal(t, 5, deltas["key2"])
+	assert.Equal(t, 0, deltas["key3"])
+}
+
+func TestCycle(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+
+	// Verify current has values
+	tracker.RLock()
+	assert.Equal(t, 10, tracker.current["key1"])
+	assert.Equal(t, 20, tracker.current["key2"])
+	assert.Empty(t, tracker.previous)
+	tracker.RUnlock()
+
+	tracker.Cycle()
+
+	// After cycle, previous should have the old current values
+	// and current should be empty
+	tracker.RLock()
+	assert.Empty(t, tracker.current)
+	assert.Equal(t, 10, tracker.previous["key1"])
+	assert.Equal(t, 20, tracker.previous["key2"])
+	tracker.RUnlock()
+}
+
+func TestCompleteWorkflow(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// First interval
+	tracker.Set("server1", 100)
+	tracker.Set("server2", 200)
+
+	// Get deltas for first interval (should be zero)
+	firstDeltas := tracker.Deltas()
+	assert.Equal(t, 0, firstDeltas["server1"])
+	assert.Equal(t, 0, firstDeltas["server2"])
+
+	// Cycle to next interval
+	tracker.Cycle()
+
+	// Second interval
+	tracker.Set("server1", 150) // Delta: 50
+	tracker.Set("server2", 180) // Delta: -20
+	tracker.Set("server3", 300) // New server, delta: 300
+
+	secondDeltas := tracker.Deltas()
+	assert.Equal(t, 50, secondDeltas["server1"])
+	assert.Equal(t, -20, secondDeltas["server2"])
+	assert.Equal(t, 0, secondDeltas["server3"])
+}
+
+func TestDeltaTrackerWithDifferentTypes(t *testing.T) {
+	// Test with int64
+	intTracker := NewDeltaTracker[string, int64]()
+	intTracker.Set("pid1", 1000)
+	intTracker.Cycle()
+	intTracker.Set("pid1", 1200)
+	intDeltas := intTracker.Deltas()
+	assert.Equal(t, int64(200), intDeltas["pid1"])
+
+	// Test with float64
+	floatTracker := NewDeltaTracker[string, float64]()
+	floatTracker.Set("cpu1", 1.5)
+	floatTracker.Cycle()
+	floatTracker.Set("cpu1", 2.7)
+	floatDeltas := floatTracker.Deltas()
+	assert.InDelta(t, 1.2, floatDeltas["cpu1"], 0.0001)
+
+	// Test with int keys
+	pidTracker := NewDeltaTracker[int, int64]()
+	pidTracker.Set(101, 20000)
+	pidTracker.Cycle()
+	pidTracker.Set(101, 22500)
+	pidDeltas := pidTracker.Deltas()
+	assert.Equal(t, int64(2500), pidDeltas[101])
+}
+
+func TestDelta(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// Test getting delta for non-existent key
+	result := tracker.Delta("nonexistent")
+	assert.Equal(t, 0, result)
+
+	// Test getting delta for key with no previous value
+	tracker.Set("key1", 10)
+	result = tracker.Delta("key1")
+	assert.Equal(t, 0, result)
+
+	// Cycle to move current to previous
+	tracker.Cycle()
+
+	// Test getting delta for key with previous value
+	tracker.Set("key1", 15)
+	result = tracker.Delta("key1")
+	assert.Equal(t, 5, result)
+
+	// Test getting delta for key that exists in previous but not current
+	result = tracker.Delta("key1")
+	assert.Equal(t, 5, result) // Should still return 5
+
+	// Test getting delta for key that exists in current but not previous
+	tracker.Set("key2", 20)
+	result = tracker.Delta("key2")
+	assert.Equal(t, 0, result)
+}
+
+func TestDeltaWithDifferentTypes(t *testing.T) {
+	// Test with int64
+	intTracker := NewDeltaTracker[string, int64]()
+	intTracker.Set("pid1", 1000)
+	intTracker.Cycle()
+	intTracker.Set("pid1", 1200)
+	result := intTracker.Delta("pid1")
+	assert.Equal(t, int64(200), result)
+
+	// Test with float64
+	floatTracker := NewDeltaTracker[string, float64]()
+	floatTracker.Set("cpu1", 1.5)
+	floatTracker.Cycle()
+	floatTracker.Set("cpu1", 2.7)
+	floatResult := floatTracker.Delta("cpu1")
+	assert.InDelta(t, 1.2, floatResult, 0.0001)
+
+	// Test with int keys
+	pidTracker := NewDeltaTracker[int, int64]()
+	pidTracker.Set(101, 20000)
+	pidTracker.Cycle()
+	pidTracker.Set(101, 22500)
+	pidResult := pidTracker.Delta(101)
+	assert.Equal(t, int64(2500), pidResult)
+}
+
+func TestDeltaConcurrentAccess(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// Set initial values
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+	tracker.Cycle()
+
+	// Set new values
+	tracker.Set("key1", 15)
+	tracker.Set("key2", 25)
+
+	// Test concurrent access safety
+	result1 := tracker.Delta("key1")
+	result2 := tracker.Delta("key2")
+
+	assert.Equal(t, 5, result1)
+	assert.Equal(t, 5, result2)
+}

agent/disk.go

@@ -1,21 +1,37 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"log/slog"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/shirou/gopsutil/v4/disk"
 )
 
+// parseFilesystemEntry parses a filesystem entry in the format "device__customname"
+// Returns the device/filesystem part and the custom name part
+func parseFilesystemEntry(entry string) (device, customName string) {
+	entry = strings.TrimSpace(entry)
+	if parts := strings.SplitN(entry, "__", 2); len(parts) == 2 {
+		device = strings.TrimSpace(parts[0])
+		customName = strings.TrimSpace(parts[1])
+	} else {
+		device = entry
+	}
+	return device, customName
+}
+
 // Sets up the filesystems to monitor for disk usage and I/O.
 func (a *Agent) initializeDiskInfo() {
 	filesystem, _ := GetEnv("FILESYSTEM")
 	efPath := "/extra-filesystems"
 	hasRoot := false
+	isWindows := runtime.GOOS == "windows"
 
 	partitions, err := disk.Partitions(false)
 	if err != nil {
@@ -23,6 +39,13 @@ func (a *Agent) initializeDiskInfo() {
 	}
 	slog.Debug("Disk", "partitions", partitions)
 
+	// trim trailing backslash for Windows devices (#1361)
+	if isWindows {
+		for i, p := range partitions {
+			partitions[i].Device = strings.TrimSuffix(p.Device, "\\")
+		}
+	}
+
 	// ioContext := context.WithValue(a.sensorsContext,
 	// 	common.EnvKey, common.EnvMap{common.HostProcEnvKey: "/tmp/testproc"},
 	// )
@@ -35,8 +58,13 @@ func (a *Agent) initializeDiskInfo() {
 	slog.Debug("Disk I/O", "diskstats", diskIoCounters)
 
 	// Helper function to add a filesystem to fsStats if it doesn't exist
-	addFsStat := func(device, mountpoint string, root bool) {
-		key := filepath.Base(device)
+	addFsStat := func(device, mountpoint string, root bool, customName ...string) {
+		var key string
+		if isWindows {
+			key = device
+		} else {
+			key = filepath.Base(device)
+		}
 		var ioMatch bool
 		if _, exists := a.fsStats[key]; !exists {
 			if root {
@@ -59,7 +87,11 @@ func (a *Agent) initializeDiskInfo() {
 					}
 				}
 			}
-			a.fsStats[key] = &system.FsStats{Root: root, Mountpoint: mountpoint}
+			fsStats := &system.FsStats{Root: root, Mountpoint: mountpoint}
+			if len(customName) > 0 && customName[0] != "" {
+				fsStats.Name = customName[0]
+			}
+			a.fsStats[key] = fsStats
 		}
 	}
 
@@ -79,11 +111,14 @@ func (a *Agent) initializeDiskInfo() {
 
 	// Add EXTRA_FILESYSTEMS env var values to fsStats
 	if extraFilesystems, exists := GetEnv("EXTRA_FILESYSTEMS"); exists {
-		for _, fs := range strings.Split(extraFilesystems, ",") {
+		for _, fsEntry := range strings.Split(extraFilesystems, ",") {
+			// Parse custom name from format: device__customname
+			fs, customName := parseFilesystemEntry(fsEntry)
+
 			found := false
 			for _, p := range partitions {
 				if strings.HasSuffix(p.Device, fs) || p.Mountpoint == fs {
-					addFsStat(p.Device, p.Mountpoint, false)
+					addFsStat(p.Device, p.Mountpoint, false, customName)
 					found = true
 					break
 				}
@@ -91,7 +126,7 @@ func (a *Agent) initializeDiskInfo() {
 			// if not in partitions, test if we can get disk usage
 			if !found {
 				if _, err := disk.Usage(fs); err == nil {
-					addFsStat(filepath.Base(fs), fs, false)
+					addFsStat(filepath.Base(fs), fs, false, customName)
 				} else {
 					slog.Error("Invalid filesystem", "name", fs, "err", err)
 				}
@@ -113,7 +148,8 @@ func (a *Agent) initializeDiskInfo() {
 
 		// Check if device is in /extra-filesystems
 		if strings.HasPrefix(p.Mountpoint, efPath) {
-			addFsStat(p.Device, p.Mountpoint, false)
+			device, customName := parseFilesystemEntry(p.Mountpoint)
+			addFsStat(device, p.Mountpoint, false, customName)
 		}
 	}
 
@@ -128,7 +164,8 @@ func (a *Agent) initializeDiskInfo() {
 				mountpoint := filepath.Join(efPath, folder.Name())
 				slog.Debug("/extra-filesystems", "mountpoint", mountpoint)
 				if !existingMountpoints[mountpoint] {
-					addFsStat(folder.Name(), mountpoint, false)
+					device, customName := parseFilesystemEntry(folder.Name())
+					addFsStat(device, mountpoint, false, customName)
 				}
 			}
 		}
@@ -182,3 +219,96 @@ func (a *Agent) initializeDiskIoStats(diskIoCounters map[string]disk.IOCountersS
 		a.fsNames = append(a.fsNames, device)
 	}
 }
+
+// Updates disk usage statistics for all monitored filesystems
+func (a *Agent) updateDiskUsage(systemStats *system.Stats) {
+	// disk usage
+	for _, stats := range a.fsStats {
+		if d, err := disk.Usage(stats.Mountpoint); err == nil {
+			stats.DiskTotal = bytesToGigabytes(d.Total)
+			stats.DiskUsed = bytesToGigabytes(d.Used)
+			if stats.Root {
+				systemStats.DiskTotal = bytesToGigabytes(d.Total)
+				systemStats.DiskUsed = bytesToGigabytes(d.Used)
+				systemStats.DiskPct = twoDecimals(d.UsedPercent)
+			}
+		} else {
+			// reset stats if error (likely unmounted)
+			slog.Error("Error getting disk stats", "name", stats.Mountpoint, "err", err)
+			stats.DiskTotal = 0
+			stats.DiskUsed = 0
+			stats.TotalRead = 0
+			stats.TotalWrite = 0
+		}
+	}
+}
+
+// Updates disk I/O statistics for all monitored filesystems
+func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
+	// disk i/o (cache-aware per interval)
+	if ioCounters, err := disk.IOCounters(a.fsNames...); err == nil {
+		// Ensure map for this interval exists
+		if _, ok := a.diskPrev[cacheTimeMs]; !ok {
+			a.diskPrev[cacheTimeMs] = make(map[string]prevDisk)
+		}
+		now := time.Now()
+		for name, d := range ioCounters {
+			stats := a.fsStats[d.Name]
+			if stats == nil {
+				// skip devices not tracked
+				continue
+			}
+
+			// Previous snapshot for this interval and device
+			prev, hasPrev := a.diskPrev[cacheTimeMs][name]
+			if !hasPrev {
+				// Seed from agent-level fsStats if present, else seed from current
+				prev = prevDisk{readBytes: stats.TotalRead, writeBytes: stats.TotalWrite, at: stats.Time}
+				if prev.at.IsZero() {
+					prev = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+				}
+			}
+
+			msElapsed := uint64(now.Sub(prev.at).Milliseconds())
+			if msElapsed < 100 {
+				// Avoid division by zero or clock issues; update snapshot and continue
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+				continue
+			}
+
+			diskIORead := (d.ReadBytes - prev.readBytes) * 1000 / msElapsed
+			diskIOWrite := (d.WriteBytes - prev.writeBytes) * 1000 / msElapsed
+			readMbPerSecond := bytesToMegabytes(float64(diskIORead))
+			writeMbPerSecond := bytesToMegabytes(float64(diskIOWrite))
+
+			// validate values
+			if readMbPerSecond > 50_000 || writeMbPerSecond > 50_000 {
+				slog.Warn("Invalid disk I/O. Resetting.", "name", d.Name, "read", readMbPerSecond, "write", writeMbPerSecond)
+				// Reset interval snapshot and seed from current
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+				// also refresh agent baseline to avoid future negatives
+				a.initializeDiskIoStats(ioCounters)
+				continue
+			}
+
+			// Update per-interval snapshot
+			a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+
+			// Update global fsStats baseline for cross-interval correctness
+			stats.Time = now
+			stats.TotalRead = d.ReadBytes
+			stats.TotalWrite = d.WriteBytes
+			stats.DiskReadPs = readMbPerSecond
+			stats.DiskWritePs = writeMbPerSecond
+			stats.DiskReadBytes = diskIORead
+			stats.DiskWriteBytes = diskIOWrite
+
+			if stats.Root {
+				systemStats.DiskReadPs = stats.DiskReadPs
+				systemStats.DiskWritePs = stats.DiskWritePs
+				systemStats.DiskIO[0] = diskIORead
+				systemStats.DiskIO[1] = diskIOWrite
+			}
+		}
+	}
+}

agent/disk_test.go

@@ -0,0 +1,235 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/disk"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseFilesystemEntry(t *testing.T) {
+	tests := []struct {
+		name         string
+		input        string
+		expectedFs   string
+		expectedName string
+	}{
+		{
+			name:         "simple device name",
+			input:        "sda1",
+			expectedFs:   "sda1",
+			expectedName: "",
+		},
+		{
+			name:         "device with custom name",
+			input:        "sda1__my-storage",
+			expectedFs:   "sda1",
+			expectedName: "my-storage",
+		},
+		{
+			name:         "full device path with custom name",
+			input:        "/dev/sdb1__backup-drive",
+			expectedFs:   "/dev/sdb1",
+			expectedName: "backup-drive",
+		},
+		{
+			name:         "NVMe device with custom name",
+			input:        "nvme0n1p2__fast-ssd",
+			expectedFs:   "nvme0n1p2",
+			expectedName: "fast-ssd",
+		},
+		{
+			name:         "whitespace trimmed",
+			input:        "  sda2__trimmed-name  ",
+			expectedFs:   "sda2",
+			expectedName: "trimmed-name",
+		},
+		{
+			name:         "empty custom name",
+			input:        "sda3__",
+			expectedFs:   "sda3",
+			expectedName: "",
+		},
+		{
+			name:         "empty device name",
+			input:        "__just-custom",
+			expectedFs:   "",
+			expectedName: "just-custom",
+		},
+		{
+			name:         "multiple underscores in custom name",
+			input:        "sda1__my_custom_drive",
+			expectedFs:   "sda1",
+			expectedName: "my_custom_drive",
+		},
+		{
+			name:         "custom name with spaces",
+			input:        "sda1__My Storage Drive",
+			expectedFs:   "sda1",
+			expectedName: "My Storage Drive",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fsEntry := strings.TrimSpace(tt.input)
+			var fs, customName string
+			if parts := strings.SplitN(fsEntry, "__", 2); len(parts) == 2 {
+				fs = strings.TrimSpace(parts[0])
+				customName = strings.TrimSpace(parts[1])
+			} else {
+				fs = fsEntry
+			}
+
+			assert.Equal(t, tt.expectedFs, fs)
+			assert.Equal(t, tt.expectedName, customName)
+		})
+	}
+}
+
+func TestInitializeDiskInfoWithCustomNames(t *testing.T) {
+	// Set up environment variables
+	oldEnv := os.Getenv("EXTRA_FILESYSTEMS")
+	defer func() {
+		if oldEnv != "" {
+			os.Setenv("EXTRA_FILESYSTEMS", oldEnv)
+		} else {
+			os.Unsetenv("EXTRA_FILESYSTEMS")
+		}
+	}()
+
+	// Test with custom names
+	os.Setenv("EXTRA_FILESYSTEMS", "sda1__my-storage,/dev/sdb1__backup-drive,nvme0n1p2")
+
+	// Mock disk partitions (we'll just test the parsing logic)
+	// Since the actual disk operations are system-dependent, we'll focus on the parsing
+	testCases := []struct {
+		envValue      string
+		expectedFs    []string
+		expectedNames map[string]string
+	}{
+		{
+			envValue:   "sda1__my-storage,sdb1__backup-drive",
+			expectedFs: []string{"sda1", "sdb1"},
+			expectedNames: map[string]string{
+				"sda1": "my-storage",
+				"sdb1": "backup-drive",
+			},
+		},
+		{
+			envValue:   "sda1,nvme0n1p2__fast-ssd",
+			expectedFs: []string{"sda1", "nvme0n1p2"},
+			expectedNames: map[string]string{
+				"nvme0n1p2": "fast-ssd",
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run("env_"+tc.envValue, func(t *testing.T) {
+			os.Setenv("EXTRA_FILESYSTEMS", tc.envValue)
+
+			// Create mock partitions that would match our test cases
+			partitions := []disk.PartitionStat{}
+			for _, fs := range tc.expectedFs {
+				if strings.HasPrefix(fs, "/dev/") {
+					partitions = append(partitions, disk.PartitionStat{
+						Device:     fs,
+						Mountpoint: fs,
+					})
+				} else {
+					partitions = append(partitions, disk.PartitionStat{
+						Device:     "/dev/" + fs,
+						Mountpoint: "/" + fs,
+					})
+				}
+			}
+
+			// Test the parsing logic by calling the relevant part
+			// We'll create a simplified version to test just the parsing
+			extraFilesystems := tc.envValue
+			for _, fsEntry := range strings.Split(extraFilesystems, ",") {
+				// Parse the entry
+				fsEntry = strings.TrimSpace(fsEntry)
+				var fs, customName string
+				if parts := strings.SplitN(fsEntry, "__", 2); len(parts) == 2 {
+					fs = strings.TrimSpace(parts[0])
+					customName = strings.TrimSpace(parts[1])
+				} else {
+					fs = fsEntry
+				}
+
+				// Verify the device is in our expected list
+				assert.Contains(t, tc.expectedFs, fs, "parsed device should be in expected list")
+
+				// Check if custom name should exist
+				if expectedName, exists := tc.expectedNames[fs]; exists {
+					assert.Equal(t, expectedName, customName, "custom name should match expected")
+				} else {
+					assert.Empty(t, customName, "custom name should be empty when not expected")
+				}
+			}
+		})
+	}
+}
+
+func TestFsStatsWithCustomNames(t *testing.T) {
+	// Test that FsStats properly stores custom names
+	fsStats := &system.FsStats{
+		Mountpoint: "/mnt/storage",
+		Name:       "my-custom-storage",
+		DiskTotal:  100.0,
+		DiskUsed:   50.0,
+	}
+
+	assert.Equal(t, "my-custom-storage", fsStats.Name)
+	assert.Equal(t, "/mnt/storage", fsStats.Mountpoint)
+	assert.Equal(t, 100.0, fsStats.DiskTotal)
+	assert.Equal(t, 50.0, fsStats.DiskUsed)
+}
+
+func TestExtraFsKeyGeneration(t *testing.T) {
+	// Test the logic for generating ExtraFs keys with custom names
+	testCases := []struct {
+		name        string
+		deviceName  string
+		customName  string
+		expectedKey string
+	}{
+		{
+			name:        "with custom name",
+			deviceName:  "sda1",
+			customName:  "my-storage",
+			expectedKey: "my-storage",
+		},
+		{
+			name:        "without custom name",
+			deviceName:  "sda1",
+			customName:  "",
+			expectedKey: "sda1",
+		},
+		{
+			name:        "empty custom name falls back to device",
+			deviceName:  "nvme0n1p2",
+			customName:  "",
+			expectedKey: "nvme0n1p2",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Simulate the key generation logic from agent.go
+			key := tc.deviceName
+			if tc.customName != "" {
+				key = tc.customName
+			}
+			assert.Equal(t, tc.expectedKey, key)
+		})
+	}
+}

agent/docker.go

@@ -0,0 +1,757 @@
+package agent
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/henrygd/beszel/agent/deltatracker"
+	"github.com/henrygd/beszel/internal/entities/container"
+
+	"github.com/blang/semver"
+)
+
+const (
+	// Docker API timeout in milliseconds
+	dockerTimeoutMs = 2100
+	// Maximum realistic network speed (5 GB/s) to detect bad deltas
+	maxNetworkSpeedBps uint64 = 5e9
+	// Maximum conceivable memory usage of a container (100TB) to detect bad memory stats
+	maxMemoryUsage uint64 = 100 * 1024 * 1024 * 1024 * 1024
+	// Number of log lines to request when fetching container logs
+	dockerLogsTail = 200
+	// Maximum size of a single log frame (1MB) to prevent memory exhaustion
+	// A single log line larger than 1MB is likely an error or misconfiguration
+	maxLogFrameSize = 1024 * 1024
+	// Maximum total log content size (5MB) to prevent memory exhaustion
+	// This provides a reasonable limit for network transfer and browser rendering
+	maxTotalLogSize = 5 * 1024 * 1024
+)
+
+type dockerManager struct {
+	client              *http.Client                // Client to query Docker API
+	wg                  sync.WaitGroup              // WaitGroup to wait for all goroutines to finish
+	sem                 chan struct{}               // Semaphore to limit concurrent container requests
+	containerStatsMutex sync.RWMutex                // Mutex to prevent concurrent access to containerStatsMap
+	apiContainerList    []*container.ApiInfo        // List of containers from Docker API
+	containerStatsMap   map[string]*container.Stats // Keeps track of container stats
+	validIds            map[string]struct{}         // Map of valid container ids, used to prune invalid containers from containerStatsMap
+	goodDockerVersion   bool                        // Whether docker version is at least 25.0.0 (one-shot works correctly)
+	isWindows           bool                        // Whether the Docker Engine API is running on Windows
+	buf                 *bytes.Buffer               // Buffer to store and read response bodies
+	decoder             *json.Decoder               // Reusable JSON decoder that reads from buf
+	apiStats            *container.ApiStats         // Reusable API stats object
+	excludeContainers   []string                    // Patterns to exclude containers by name
+
+	// Cache-time-aware tracking for CPU stats (similar to cpu.go)
+	// Maps cache time intervals to container-specific CPU usage tracking
+	lastCpuContainer map[uint16]map[string]uint64    // cacheTimeMs -> containerId -> last cpu container usage
+	lastCpuSystem    map[uint16]map[string]uint64    // cacheTimeMs -> containerId -> last cpu system usage
+	lastCpuReadTime  map[uint16]map[string]time.Time // cacheTimeMs -> containerId -> last read time (Windows)
+
+	// Network delta trackers - one per cache time to avoid interference
+	// cacheTimeMs -> DeltaTracker for network bytes sent/received
+	networkSentTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
+	networkRecvTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
+}
+
+// userAgentRoundTripper is a custom http.RoundTripper that adds a User-Agent header to all requests
+type userAgentRoundTripper struct {
+	rt        http.RoundTripper
+	userAgent string
+}
+
+// RoundTrip implements the http.RoundTripper interface
+func (u *userAgentRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req.Header.Set("User-Agent", u.userAgent)
+	return u.rt.RoundTrip(req)
+}
+
+// Add goroutine to the queue
+func (d *dockerManager) queue() {
+	d.wg.Add(1)
+	if d.goodDockerVersion {
+		d.sem <- struct{}{}
+	}
+}
+
+// Remove goroutine from the queue
+func (d *dockerManager) dequeue() {
+	d.wg.Done()
+	if d.goodDockerVersion {
+		<-d.sem
+	}
+}
+
+// shouldExcludeContainer checks if a container name matches any exclusion pattern
+func (dm *dockerManager) shouldExcludeContainer(name string) bool {
+	if len(dm.excludeContainers) == 0 {
+		return false
+	}
+	for _, pattern := range dm.excludeContainers {
+		if match, _ := path.Match(pattern, name); match {
+			return true
+		}
+	}
+	return false
+}
+
+// Returns stats for all running containers with cache-time-aware delta tracking
+func (dm *dockerManager) getDockerStats(cacheTimeMs uint16) ([]*container.Stats, error) {
+	resp, err := dm.client.Get("http://localhost/containers/json")
+	if err != nil {
+		return nil, err
+	}
+
+	dm.apiContainerList = dm.apiContainerList[:0]
+	if err := dm.decode(resp, &dm.apiContainerList); err != nil {
+		return nil, err
+	}
+
+	dm.isWindows = strings.Contains(resp.Header.Get("Server"), "windows")
+
+	containersLength := len(dm.apiContainerList)
+
+	// store valid ids to clean up old container ids from map
+	if dm.validIds == nil {
+		dm.validIds = make(map[string]struct{}, containersLength)
+	} else {
+		clear(dm.validIds)
+	}
+
+	var failedContainers []*container.ApiInfo
+
+	for _, ctr := range dm.apiContainerList {
+		ctr.IdShort = ctr.Id[:12]
+
+		// Skip this container if it matches the exclusion pattern
+		if dm.shouldExcludeContainer(ctr.Names[0][1:]) {
+			slog.Debug("Excluding container", "name", ctr.Names[0][1:])
+			continue
+		}
+
+		dm.validIds[ctr.IdShort] = struct{}{}
+		// check if container is less than 1 minute old (possible restart)
+		// note: can't use Created field because it's not updated on restart
+		if strings.Contains(ctr.Status, "second") {
+			// if so, remove old container data
+			dm.deleteContainerStatsSync(ctr.IdShort)
+		}
+		dm.queue()
+		go func(ctr *container.ApiInfo) {
+			defer dm.dequeue()
+			err := dm.updateContainerStats(ctr, cacheTimeMs)
+			// if error, delete from map and add to failed list to retry
+			if err != nil {
+				dm.containerStatsMutex.Lock()
+				delete(dm.containerStatsMap, ctr.IdShort)
+				failedContainers = append(failedContainers, ctr)
+				dm.containerStatsMutex.Unlock()
+			}
+		}(ctr)
+	}
+
+	dm.wg.Wait()
+
+	// retry failed containers separately so we can run them in parallel (docker 24 bug)
+	if len(failedContainers) > 0 {
+		slog.Debug("Retrying failed containers", "count", len(failedContainers))
+		for i := range failedContainers {
+			ctr := failedContainers[i]
+			dm.queue()
+			go func(ctr *container.ApiInfo) {
+				defer dm.dequeue()
+				if err2 := dm.updateContainerStats(ctr, cacheTimeMs); err2 != nil {
+					slog.Error("Error getting container stats", "err", err2)
+				}
+			}(ctr)
+		}
+		dm.wg.Wait()
+	}
+
+	// populate final stats and remove old / invalid container stats
+	stats := make([]*container.Stats, 0, containersLength)
+	for id, v := range dm.containerStatsMap {
+		if _, exists := dm.validIds[id]; !exists {
+			delete(dm.containerStatsMap, id)
+		} else {
+			stats = append(stats, v)
+		}
+	}
+
+	// prepare network trackers for next interval for this cache time
+	dm.cycleNetworkDeltasForCacheTime(cacheTimeMs)
+
+	return stats, nil
+}
+
+// initializeCpuTracking initializes CPU tracking maps for a specific cache time interval
+func (dm *dockerManager) initializeCpuTracking(cacheTimeMs uint16) {
+	// Initialize cache time maps if they don't exist
+	if dm.lastCpuContainer[cacheTimeMs] == nil {
+		dm.lastCpuContainer[cacheTimeMs] = make(map[string]uint64)
+	}
+	if dm.lastCpuSystem[cacheTimeMs] == nil {
+		dm.lastCpuSystem[cacheTimeMs] = make(map[string]uint64)
+	}
+	// Ensure the outer map exists before indexing
+	if dm.lastCpuReadTime == nil {
+		dm.lastCpuReadTime = make(map[uint16]map[string]time.Time)
+	}
+	if dm.lastCpuReadTime[cacheTimeMs] == nil {
+		dm.lastCpuReadTime[cacheTimeMs] = make(map[string]time.Time)
+	}
+}
+
+// getCpuPreviousValues returns previous CPU values for a container and cache time interval
+func (dm *dockerManager) getCpuPreviousValues(cacheTimeMs uint16, containerId string) (uint64, uint64) {
+	return dm.lastCpuContainer[cacheTimeMs][containerId], dm.lastCpuSystem[cacheTimeMs][containerId]
+}
+
+// setCpuCurrentValues stores current CPU values for a container and cache time interval
+func (dm *dockerManager) setCpuCurrentValues(cacheTimeMs uint16, containerId string, cpuContainer, cpuSystem uint64) {
+	dm.lastCpuContainer[cacheTimeMs][containerId] = cpuContainer
+	dm.lastCpuSystem[cacheTimeMs][containerId] = cpuSystem
+}
+
+// calculateMemoryUsage calculates memory usage from Docker API stats
+func calculateMemoryUsage(apiStats *container.ApiStats, isWindows bool) (uint64, error) {
+	if isWindows {
+		return apiStats.MemoryStats.PrivateWorkingSet, nil
+	}
+
+	memCache := apiStats.MemoryStats.Stats.InactiveFile
+	if memCache == 0 {
+		memCache = apiStats.MemoryStats.Stats.Cache
+	}
+
+	usedDelta := apiStats.MemoryStats.Usage - memCache
+	if usedDelta <= 0 || usedDelta > maxMemoryUsage {
+		return 0, fmt.Errorf("bad memory stats")
+	}
+
+	return usedDelta, nil
+}
+
+// getNetworkTracker returns the DeltaTracker for a specific cache time, creating it if needed
+func (dm *dockerManager) getNetworkTracker(cacheTimeMs uint16, isSent bool) *deltatracker.DeltaTracker[string, uint64] {
+	var trackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
+	if isSent {
+		trackers = dm.networkSentTrackers
+	} else {
+		trackers = dm.networkRecvTrackers
+	}
+
+	if trackers[cacheTimeMs] == nil {
+		trackers[cacheTimeMs] = deltatracker.NewDeltaTracker[string, uint64]()
+	}
+
+	return trackers[cacheTimeMs]
+}
+
+// cycleNetworkDeltasForCacheTime cycles the network delta trackers for a specific cache time
+func (dm *dockerManager) cycleNetworkDeltasForCacheTime(cacheTimeMs uint16) {
+	if dm.networkSentTrackers[cacheTimeMs] != nil {
+		dm.networkSentTrackers[cacheTimeMs].Cycle()
+	}
+	if dm.networkRecvTrackers[cacheTimeMs] != nil {
+		dm.networkRecvTrackers[cacheTimeMs].Cycle()
+	}
+}
+
+// calculateNetworkStats calculates network sent/receive deltas using DeltaTracker
+func (dm *dockerManager) calculateNetworkStats(ctr *container.ApiInfo, apiStats *container.ApiStats, stats *container.Stats, initialized bool, name string, cacheTimeMs uint16) (uint64, uint64) {
+	var total_sent, total_recv uint64
+	for _, v := range apiStats.Networks {
+		total_sent += v.TxBytes
+		total_recv += v.RxBytes
+	}
+
+	// Get the DeltaTracker for this specific cache time
+	sentTracker := dm.getNetworkTracker(cacheTimeMs, true)
+	recvTracker := dm.getNetworkTracker(cacheTimeMs, false)
+
+	// Set current values in the cache-time-specific DeltaTracker
+	sentTracker.Set(ctr.IdShort, total_sent)
+	recvTracker.Set(ctr.IdShort, total_recv)
+
+	// Get deltas (bytes since last measurement)
+	sent_delta_raw := sentTracker.Delta(ctr.IdShort)
+	recv_delta_raw := recvTracker.Delta(ctr.IdShort)
+
+	// Calculate bytes per second independently for Tx and Rx if we have previous data
+	var sent_delta, recv_delta uint64
+	if initialized {
+		millisecondsElapsed := uint64(time.Since(stats.PrevReadTime).Milliseconds())
+		if millisecondsElapsed > 0 {
+			if sent_delta_raw > 0 {
+				sent_delta = sent_delta_raw * 1000 / millisecondsElapsed
+				if sent_delta > maxNetworkSpeedBps {
+					slog.Warn("Bad network delta", "container", name)
+					sent_delta = 0
+				}
+			}
+			if recv_delta_raw > 0 {
+				recv_delta = recv_delta_raw * 1000 / millisecondsElapsed
+				if recv_delta > maxNetworkSpeedBps {
+					slog.Warn("Bad network delta", "container", name)
+					recv_delta = 0
+				}
+			}
+		}
+	}
+
+	return sent_delta, recv_delta
+}
+
+// validateCpuPercentage checks if CPU percentage is within valid range
+func validateCpuPercentage(cpuPct float64, containerName string) error {
+	if cpuPct > 100 {
+		return fmt.Errorf("%s cpu pct greater than 100: %+v", containerName, cpuPct)
+	}
+	return nil
+}
+
+// updateContainerStatsValues updates the final stats values
+func updateContainerStatsValues(stats *container.Stats, cpuPct float64, usedMemory uint64, sent_delta, recv_delta uint64, readTime time.Time) {
+	stats.Cpu = twoDecimals(cpuPct)
+	stats.Mem = bytesToMegabytes(float64(usedMemory))
+	stats.NetworkSent = bytesToMegabytes(float64(sent_delta))
+	stats.NetworkRecv = bytesToMegabytes(float64(recv_delta))
+	stats.PrevReadTime = readTime
+}
+
+func parseDockerStatus(status string) (string, container.DockerHealth) {
+	trimmed := strings.TrimSpace(status)
+	if trimmed == "" {
+		return "", container.DockerHealthNone
+	}
+
+	// Remove "About " from status
+	trimmed = strings.Replace(trimmed, "About ", "", 1)
+
+	openIdx := strings.LastIndex(trimmed, "(")
+	if openIdx == -1 || !strings.HasSuffix(trimmed, ")") {
+		return trimmed, container.DockerHealthNone
+	}
+
+	statusText := strings.TrimSpace(trimmed[:openIdx])
+	if statusText == "" {
+		statusText = trimmed
+	}
+
+	healthText := strings.ToLower(strings.TrimSpace(strings.TrimSuffix(trimmed[openIdx+1:], ")")))
+	// Some Docker statuses include a "health:" prefix inside the parentheses.
+	// Strip it so it maps correctly to the known health states.
+	if colonIdx := strings.IndexRune(healthText, ':'); colonIdx != -1 {
+		prefix := strings.TrimSpace(healthText[:colonIdx])
+		if prefix == "health" || prefix == "health status" {
+			healthText = strings.TrimSpace(healthText[colonIdx+1:])
+		}
+	}
+	if health, ok := container.DockerHealthStrings[healthText]; ok {
+		return statusText, health
+	}
+
+	return trimmed, container.DockerHealthNone
+}
+
+// Updates stats for individual container with cache-time-aware delta tracking
+func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo, cacheTimeMs uint16) error {
+	name := ctr.Names[0][1:]
+
+	resp, err := dm.client.Get(fmt.Sprintf("http://localhost/containers/%s/stats?stream=0&one-shot=1", ctr.IdShort))
+	if err != nil {
+		return err
+	}
+
+	dm.containerStatsMutex.Lock()
+	defer dm.containerStatsMutex.Unlock()
+
+	// add empty values if they doesn't exist in map
+	stats, initialized := dm.containerStatsMap[ctr.IdShort]
+	if !initialized {
+		stats = &container.Stats{Name: name, Id: ctr.IdShort, Image: ctr.Image}
+		dm.containerStatsMap[ctr.IdShort] = stats
+	}
+
+	stats.Id = ctr.IdShort
+
+	statusText, health := parseDockerStatus(ctr.Status)
+	stats.Status = statusText
+	stats.Health = health
+
+	// reset current stats
+	stats.Cpu = 0
+	stats.Mem = 0
+	stats.NetworkSent = 0
+	stats.NetworkRecv = 0
+
+	res := dm.apiStats
+	res.Networks = nil
+	if err := dm.decode(resp, res); err != nil {
+		return err
+	}
+
+	// Initialize CPU tracking for this cache time interval
+	dm.initializeCpuTracking(cacheTimeMs)
+
+	// Get previous CPU values
+	prevCpuContainer, prevCpuSystem := dm.getCpuPreviousValues(cacheTimeMs, ctr.IdShort)
+
+	// Calculate CPU percentage based on platform
+	var cpuPct float64
+	if dm.isWindows {
+		prevRead := dm.lastCpuReadTime[cacheTimeMs][ctr.IdShort]
+		cpuPct = res.CalculateCpuPercentWindows(prevCpuContainer, prevRead)
+	} else {
+		cpuPct = res.CalculateCpuPercentLinux(prevCpuContainer, prevCpuSystem)
+	}
+
+	// Calculate memory usage
+	usedMemory, err := calculateMemoryUsage(res, dm.isWindows)
+	if err != nil {
+		return fmt.Errorf("%s - %w - see https://github.com/henrygd/beszel/issues/144", name, err)
+	}
+
+	// Store current CPU stats for next calculation
+	currentCpuContainer := res.CPUStats.CPUUsage.TotalUsage
+	currentCpuSystem := res.CPUStats.SystemUsage
+	dm.setCpuCurrentValues(cacheTimeMs, ctr.IdShort, currentCpuContainer, currentCpuSystem)
+
+	// Validate CPU percentage
+	if err := validateCpuPercentage(cpuPct, name); err != nil {
+		return err
+	}
+
+	// Calculate network stats using DeltaTracker
+	sent_delta, recv_delta := dm.calculateNetworkStats(ctr, res, stats, initialized, name, cacheTimeMs)
+
+	// Store current network values for legacy compatibility
+	var total_sent, total_recv uint64
+	for _, v := range res.Networks {
+		total_sent += v.TxBytes
+		total_recv += v.RxBytes
+	}
+	stats.PrevNet.Sent, stats.PrevNet.Recv = total_sent, total_recv
+
+	// Update final stats values
+	updateContainerStatsValues(stats, cpuPct, usedMemory, sent_delta, recv_delta, res.Read)
+	// store per-cache-time read time for Windows CPU percent calc
+	dm.lastCpuReadTime[cacheTimeMs][ctr.IdShort] = res.Read
+
+	return nil
+}
+
+// Delete container stats from map using mutex
+func (dm *dockerManager) deleteContainerStatsSync(id string) {
+	dm.containerStatsMutex.Lock()
+	defer dm.containerStatsMutex.Unlock()
+	delete(dm.containerStatsMap, id)
+	for ct := range dm.lastCpuContainer {
+		delete(dm.lastCpuContainer[ct], id)
+	}
+	for ct := range dm.lastCpuSystem {
+		delete(dm.lastCpuSystem[ct], id)
+	}
+	for ct := range dm.lastCpuReadTime {
+		delete(dm.lastCpuReadTime[ct], id)
+	}
+}
+
+// Creates a new http client for Docker or Podman API
+func newDockerManager(a *Agent) *dockerManager {
+	dockerHost, exists := GetEnv("DOCKER_HOST")
+	if exists {
+		// return nil if set to empty string
+		if dockerHost == "" {
+			return nil
+		}
+	} else {
+		dockerHost = getDockerHost()
+	}
+
+	parsedURL, err := url.Parse(dockerHost)
+	if err != nil {
+		os.Exit(1)
+	}
+
+	transport := &http.Transport{
+		DisableCompression: true,
+		MaxConnsPerHost:    0,
+	}
+
+	switch parsedURL.Scheme {
+	case "unix":
+		transport.DialContext = func(ctx context.Context, proto, addr string) (net.Conn, error) {
+			return (&net.Dialer{}).DialContext(ctx, "unix", parsedURL.Path)
+		}
+	case "tcp", "http", "https":
+		transport.DialContext = func(ctx context.Context, proto, addr string) (net.Conn, error) {
+			return (&net.Dialer{}).DialContext(ctx, "tcp", parsedURL.Host)
+		}
+	default:
+		slog.Error("Invalid DOCKER_HOST", "scheme", parsedURL.Scheme)
+		os.Exit(1)
+	}
+
+	// configurable timeout
+	timeout := time.Millisecond * time.Duration(dockerTimeoutMs)
+	if t, set := GetEnv("DOCKER_TIMEOUT"); set {
+		timeout, err = time.ParseDuration(t)
+		if err != nil {
+			slog.Error(err.Error())
+			os.Exit(1)
+		}
+		slog.Info("DOCKER_TIMEOUT", "timeout", timeout)
+	}
+
+	// Custom user-agent to avoid docker bug: https://github.com/docker/for-mac/issues/7575
+	userAgentTransport := &userAgentRoundTripper{
+		rt:        transport,
+		userAgent: "Docker-Client/",
+	}
+
+	// Read container exclusion patterns from environment variable
+	var excludeContainers []string
+	if excludeStr, set := GetEnv("EXCLUDE_CONTAINERS"); set && excludeStr != "" {
+		parts := strings.SplitSeq(excludeStr, ",")
+		for part := range parts {
+			trimmed := strings.TrimSpace(part)
+			if trimmed != "" {
+				excludeContainers = append(excludeContainers, trimmed)
+			}
+		}
+		slog.Info("EXCLUDE_CONTAINERS", "patterns", excludeContainers)
+	}
+
+	manager := &dockerManager{
+		client: &http.Client{
+			Timeout:   timeout,
+			Transport: userAgentTransport,
+		},
+		containerStatsMap: make(map[string]*container.Stats),
+		sem:               make(chan struct{}, 5),
+		apiContainerList:  []*container.ApiInfo{},
+		apiStats:          &container.ApiStats{},
+		excludeContainers: excludeContainers,
+
+		// Initialize cache-time-aware tracking structures
+		lastCpuContainer:    make(map[uint16]map[string]uint64),
+		lastCpuSystem:       make(map[uint16]map[string]uint64),
+		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
+		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+	}
+
+	// If using podman, return client
+	if strings.Contains(dockerHost, "podman") {
+		a.systemInfo.Podman = true
+		manager.goodDockerVersion = true
+		return manager
+	}
+
+	// this can take up to 5 seconds with retry, so run in goroutine
+	go manager.checkDockerVersion()
+
+	// give version check a chance to complete before returning
+	time.Sleep(50 * time.Millisecond)
+
+	return manager
+}
+
+// checkDockerVersion checks Docker version and sets goodDockerVersion if at least 25.0.0.
+// Versions before 25.0.0 have a bug with one-shot which requires all requests to be made in one batch.
+func (dm *dockerManager) checkDockerVersion() {
+	var err error
+	var resp *http.Response
+	var versionInfo struct {
+		Version string `json:"Version"`
+	}
+	const versionMaxTries = 2
+	for i := 1; i <= versionMaxTries; i++ {
+		resp, err = dm.client.Get("http://localhost/version")
+		if err == nil {
+			break
+		}
+		if resp != nil {
+			resp.Body.Close()
+		}
+		if i < versionMaxTries {
+			slog.Debug("Failed to get Docker version; retrying", "attempt", i, "error", err)
+			time.Sleep(5 * time.Second)
+		}
+	}
+	if err != nil {
+		return
+	}
+	if err := dm.decode(resp, &versionInfo); err != nil {
+		return
+	}
+	// if version > 24, one-shot works correctly and we can limit concurrent operations
+	if dockerVersion, err := semver.Parse(versionInfo.Version); err == nil && dockerVersion.Major > 24 {
+		dm.goodDockerVersion = true
+	} else {
+		slog.Info(fmt.Sprintf("Docker %s is outdated. Upgrade if possible. See https://github.com/henrygd/beszel/issues/58", versionInfo.Version))
+	}
+}
+
+// Decodes Docker API JSON response using a reusable buffer and decoder. Not thread safe.
+func (dm *dockerManager) decode(resp *http.Response, d any) error {
+	if dm.buf == nil {
+		// initialize buffer with 256kb starting size
+		dm.buf = bytes.NewBuffer(make([]byte, 0, 1024*256))
+		dm.decoder = json.NewDecoder(dm.buf)
+	}
+	defer resp.Body.Close()
+	defer dm.buf.Reset()
+	_, err := dm.buf.ReadFrom(resp.Body)
+	if err != nil {
+		return err
+	}
+	return dm.decoder.Decode(d)
+}
+
+// Test docker / podman sockets and return if one exists
+func getDockerHost() string {
+	scheme := "unix://"
+	socks := []string{"/var/run/docker.sock", fmt.Sprintf("/run/user/%v/podman/podman.sock", os.Getuid())}
+	for _, sock := range socks {
+		if _, err := os.Stat(sock); err == nil {
+			return scheme + sock
+		}
+	}
+	return scheme + socks[0]
+}
+
+// getContainerInfo fetches the inspection data for a container
+func (dm *dockerManager) getContainerInfo(ctx context.Context, containerID string) ([]byte, error) {
+	endpoint := fmt.Sprintf("http://localhost/containers/%s/json", containerID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := dm.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
+		return nil, fmt.Errorf("container info request failed: %s: %s", resp.Status, strings.TrimSpace(string(body)))
+	}
+
+	// Remove sensitive environment variables from Config.Env
+	var containerInfo map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&containerInfo); err != nil {
+		return nil, err
+	}
+	if config, ok := containerInfo["Config"].(map[string]any); ok {
+		delete(config, "Env")
+	}
+
+	return json.Marshal(containerInfo)
+}
+
+// getLogs fetches the logs for a container
+func (dm *dockerManager) getLogs(ctx context.Context, containerID string) (string, error) {
+	endpoint := fmt.Sprintf("http://localhost/containers/%s/logs?stdout=1&stderr=1&tail=%d", containerID, dockerLogsTail)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return "", err
+	}
+
+	resp, err := dm.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
+		return "", fmt.Errorf("logs request failed: %s: %s", resp.Status, strings.TrimSpace(string(body)))
+	}
+
+	var builder strings.Builder
+	if err := decodeDockerLogStream(resp.Body, &builder); err != nil {
+		return "", err
+	}
+
+	return builder.String(), nil
+}
+
+func decodeDockerLogStream(reader io.Reader, builder *strings.Builder) error {
+	const headerSize = 8
+	var header [headerSize]byte
+	buf := make([]byte, 0, dockerLogsTail*200)
+	totalBytesRead := 0
+
+	for {
+		if _, err := io.ReadFull(reader, header[:]); err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				return nil
+			}
+			return err
+		}
+
+		frameLen := binary.BigEndian.Uint32(header[4:])
+		if frameLen == 0 {
+			continue
+		}
+
+		// Prevent memory exhaustion from excessively large frames
+		if frameLen > maxLogFrameSize {
+			return fmt.Errorf("log frame size (%d) exceeds maximum (%d)", frameLen, maxLogFrameSize)
+		}
+
+		// Check if reading this frame would exceed total log size limit
+		if totalBytesRead+int(frameLen) > maxTotalLogSize {
+			// Read and discard remaining data to avoid blocking
+			_, _ = io.Copy(io.Discard, io.LimitReader(reader, int64(frameLen)))
+			slog.Debug("Truncating logs: limit reached", "read", totalBytesRead, "limit", maxTotalLogSize)
+			return nil
+		}
+
+		buf = allocateBuffer(buf, int(frameLen))
+		if _, err := io.ReadFull(reader, buf[:frameLen]); err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				if len(buf) > 0 {
+					builder.Write(buf[:min(int(frameLen), len(buf))])
+				}
+				return nil
+			}
+			return err
+		}
+		builder.Write(buf[:frameLen])
+		totalBytesRead += int(frameLen)
+	}
+}
+
+func allocateBuffer(current []byte, needed int) []byte {
+	if cap(current) >= needed {
+		return current[:needed]
+	}
+	return make([]byte, needed)
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}

agent/gpu.go

@@ -0,0 +1,483 @@
+package agent
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"golang.org/x/exp/slog"
+)
+
+const (
+	// Commands
+	nvidiaSmiCmd  string = "nvidia-smi"
+	rocmSmiCmd    string = "rocm-smi"
+	tegraStatsCmd string = "tegrastats"
+
+	// Polling intervals
+	nvidiaSmiInterval  string        = "4"    // in seconds
+	tegraStatsInterval string        = "3700" // in milliseconds
+	rocmSmiInterval    time.Duration = 4300 * time.Millisecond
+	// Command retry and timeout constants
+	retryWaitTime     time.Duration = 5 * time.Second
+	maxFailureRetries int           = 5
+
+	// Unit Conversions
+	mebibytesInAMegabyte float64 = 1.024  // nvidia-smi reports memory in MiB
+	milliwattsInAWatt    float64 = 1000.0 // tegrastats reports power in mW
+)
+
+// GPUManager manages data collection for GPUs (either Nvidia or AMD)
+type GPUManager struct {
+	sync.Mutex
+	nvidiaSmi     bool
+	rocmSmi       bool
+	tegrastats    bool
+	intelGpuStats bool
+	GpuDataMap    map[string]*system.GPUData
+	// lastAvgData stores the last calculated averages for each GPU
+	// Used when a collection happens before new data arrives (Count == 0)
+	lastAvgData map[string]system.GPUData
+	// Per-cache-key tracking for delta calculations
+	// cacheKey -> gpuId -> snapshot of last count/usage/power values
+	lastSnapshots map[uint16]map[string]*gpuSnapshot
+}
+
+// gpuSnapshot stores the last observed incremental values for delta tracking
+type gpuSnapshot struct {
+	count    uint32
+	usage    float64
+	power    float64
+	powerPkg float64
+	engines  map[string]float64
+}
+
+// RocmSmiJson represents the JSON structure of rocm-smi output
+type RocmSmiJson struct {
+	ID           string `json:"GUID"`
+	Name         string `json:"Card series"`
+	Temperature  string `json:"Temperature (Sensor edge) (C)"`
+	MemoryUsed   string `json:"VRAM Total Used Memory (B)"`
+	MemoryTotal  string `json:"VRAM Total Memory (B)"`
+	Usage        string `json:"GPU use (%)"`
+	PowerPackage string `json:"Average Graphics Package Power (W)"`
+	PowerSocket  string `json:"Current Socket Graphics Package Power (W)"`
+}
+
+// gpuCollector defines a collector for a specific GPU management utility (nvidia-smi or rocm-smi)
+type gpuCollector struct {
+	name    string
+	cmdArgs []string
+	parse   func([]byte) bool // returns true if valid data was found
+	buf     []byte
+	bufSize uint16
+}
+
+var errNoValidData = fmt.Errorf("no valid GPU data found") // Error for missing data
+
+// starts and manages the ongoing collection of GPU data for the specified GPU management utility
+func (c *gpuCollector) start() {
+	for {
+		err := c.collect()
+		if err != nil {
+			if err == errNoValidData {
+				slog.Warn(c.name + " found no valid GPU data, stopping")
+				break
+			}
+			slog.Warn(c.name+" failed, restarting", "err", err)
+			time.Sleep(retryWaitTime)
+			continue
+		}
+	}
+}
+
+// collect executes the command, parses output with the assigned parser function
+func (c *gpuCollector) collect() error {
+	cmd := exec.Command(c.name, c.cmdArgs...)
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+
+	scanner := bufio.NewScanner(stdout)
+	if c.buf == nil {
+		c.buf = make([]byte, 0, c.bufSize)
+	}
+	scanner.Buffer(c.buf, bufio.MaxScanTokenSize)
+
+	for scanner.Scan() {
+		hasValidData := c.parse(scanner.Bytes())
+		if !hasValidData {
+			return errNoValidData
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		return fmt.Errorf("scanner error: %w", err)
+	}
+	return cmd.Wait()
+}
+
+// getJetsonParser returns a function to parse the output of tegrastats and update the GPUData map
+func (gm *GPUManager) getJetsonParser() func(output []byte) bool {
+	// use closure to avoid recompiling the regex
+	ramPattern := regexp.MustCompile(`RAM (\d+)/(\d+)MB`)
+	gr3dPattern := regexp.MustCompile(`GR3D_FREQ (\d+)%`)
+	tempPattern := regexp.MustCompile(`tj@(\d+\.?\d*)C`)
+	// Orin Nano / NX do not have GPU specific power monitor
+	// TODO: Maybe use VDD_IN for Nano / NX and add a total system power chart
+	powerPattern := regexp.MustCompile(`(GPU_SOC|CPU_GPU_CV) (\d+)mW`)
+
+	// jetson devices have only one gpu so we'll just initialize here
+	gpuData := &system.GPUData{Name: "GPU"}
+	gm.GpuDataMap["0"] = gpuData
+
+	return func(output []byte) bool {
+		gm.Lock()
+		defer gm.Unlock()
+		// Parse RAM usage
+		ramMatches := ramPattern.FindSubmatch(output)
+		if ramMatches != nil {
+			gpuData.MemoryUsed, _ = strconv.ParseFloat(string(ramMatches[1]), 64)
+			gpuData.MemoryTotal, _ = strconv.ParseFloat(string(ramMatches[2]), 64)
+		}
+		// Parse GR3D (GPU) usage
+		gr3dMatches := gr3dPattern.FindSubmatch(output)
+		if gr3dMatches != nil {
+			gr3dUsage, _ := strconv.ParseFloat(string(gr3dMatches[1]), 64)
+			gpuData.Usage += gr3dUsage
+		}
+		// Parse temperature
+		tempMatches := tempPattern.FindSubmatch(output)
+		if tempMatches != nil {
+			gpuData.Temperature, _ = strconv.ParseFloat(string(tempMatches[1]), 64)
+		}
+		// Parse power usage
+		powerMatches := powerPattern.FindSubmatch(output)
+		if powerMatches != nil {
+			power, _ := strconv.ParseFloat(string(powerMatches[2]), 64)
+			gpuData.Power += power / milliwattsInAWatt
+		}
+		gpuData.Count++
+		return true
+	}
+}
+
+// parseNvidiaData parses the output of nvidia-smi and updates the GPUData map
+func (gm *GPUManager) parseNvidiaData(output []byte) bool {
+	gm.Lock()
+	defer gm.Unlock()
+	scanner := bufio.NewScanner(bytes.NewReader(output))
+	var valid bool
+	for scanner.Scan() {
+		line := scanner.Text() // Or use scanner.Bytes() for []byte
+		fields := strings.Split(strings.TrimSpace(line), ", ")
+		if len(fields) < 7 {
+			continue
+		}
+		valid = true
+		id := fields[0]
+		temp, _ := strconv.ParseFloat(fields[2], 64)
+		memoryUsage, _ := strconv.ParseFloat(fields[3], 64)
+		totalMemory, _ := strconv.ParseFloat(fields[4], 64)
+		usage, _ := strconv.ParseFloat(fields[5], 64)
+		power, _ := strconv.ParseFloat(fields[6], 64)
+		// add gpu if not exists
+		if _, ok := gm.GpuDataMap[id]; !ok {
+			name := strings.TrimPrefix(fields[1], "NVIDIA ")
+			gm.GpuDataMap[id] = &system.GPUData{Name: strings.TrimSuffix(name, " Laptop GPU")}
+		}
+		// update gpu data
+		gpu := gm.GpuDataMap[id]
+		gpu.Temperature = temp
+		gpu.MemoryUsed = memoryUsage / mebibytesInAMegabyte
+		gpu.MemoryTotal = totalMemory / mebibytesInAMegabyte
+		gpu.Usage += usage
+		gpu.Power += power
+		gpu.Count++
+	}
+	return valid
+}
+
+// parseAmdData parses the output of rocm-smi and updates the GPUData map
+func (gm *GPUManager) parseAmdData(output []byte) bool {
+	var rocmSmiInfo map[string]RocmSmiJson
+	if err := json.Unmarshal(output, &rocmSmiInfo); err != nil || len(rocmSmiInfo) == 0 {
+		return false
+	}
+	gm.Lock()
+	defer gm.Unlock()
+	for _, v := range rocmSmiInfo {
+		var power float64
+		if v.PowerPackage != "" {
+			power, _ = strconv.ParseFloat(v.PowerPackage, 64)
+		} else {
+			power, _ = strconv.ParseFloat(v.PowerSocket, 64)
+		}
+		memoryUsage, _ := strconv.ParseFloat(v.MemoryUsed, 64)
+		totalMemory, _ := strconv.ParseFloat(v.MemoryTotal, 64)
+		usage, _ := strconv.ParseFloat(v.Usage, 64)
+
+		if _, ok := gm.GpuDataMap[v.ID]; !ok {
+			gm.GpuDataMap[v.ID] = &system.GPUData{Name: v.Name}
+		}
+		gpu := gm.GpuDataMap[v.ID]
+		gpu.Temperature, _ = strconv.ParseFloat(v.Temperature, 64)
+		gpu.MemoryUsed = bytesToMegabytes(memoryUsage)
+		gpu.MemoryTotal = bytesToMegabytes(totalMemory)
+		gpu.Usage += usage
+		gpu.Power += power
+		gpu.Count++
+	}
+	return true
+}
+
+// GetCurrentData returns GPU utilization data averaged since the last call with this cacheKey
+func (gm *GPUManager) GetCurrentData(cacheKey uint16) map[string]system.GPUData {
+	gm.Lock()
+	defer gm.Unlock()
+
+	gm.initializeSnapshots(cacheKey)
+	nameCounts := gm.countGPUNames()
+
+	gpuData := make(map[string]system.GPUData, len(gm.GpuDataMap))
+	for id, gpu := range gm.GpuDataMap {
+		gpuAvg := gm.calculateGPUAverage(id, gpu, cacheKey)
+		gm.updateInstantaneousValues(&gpuAvg, gpu)
+		gm.storeSnapshot(id, gpu, cacheKey)
+
+		// Append id to name if there are multiple GPUs with the same name
+		if nameCounts[gpu.Name] > 1 {
+			gpuAvg.Name = fmt.Sprintf("%s %s", gpu.Name, id)
+		}
+		gpuData[id] = gpuAvg
+	}
+	slog.Debug("GPU", "data", gpuData)
+	return gpuData
+}
+
+// initializeSnapshots ensures snapshot maps are initialized for the given cache key
+func (gm *GPUManager) initializeSnapshots(cacheKey uint16) {
+	if gm.lastAvgData == nil {
+		gm.lastAvgData = make(map[string]system.GPUData)
+	}
+	if gm.lastSnapshots == nil {
+		gm.lastSnapshots = make(map[uint16]map[string]*gpuSnapshot)
+	}
+	if gm.lastSnapshots[cacheKey] == nil {
+		gm.lastSnapshots[cacheKey] = make(map[string]*gpuSnapshot)
+	}
+}
+
+// countGPUNames returns a map of GPU names to their occurrence count
+func (gm *GPUManager) countGPUNames() map[string]int {
+	nameCounts := make(map[string]int)
+	for _, gpu := range gm.GpuDataMap {
+		nameCounts[gpu.Name]++
+	}
+	return nameCounts
+}
+
+// calculateGPUAverage computes the average GPU metrics since the last snapshot for this cache key
+func (gm *GPUManager) calculateGPUAverage(id string, gpu *system.GPUData, cacheKey uint16) system.GPUData {
+	lastSnapshot := gm.lastSnapshots[cacheKey][id]
+	currentCount := uint32(gpu.Count)
+	deltaCount := gm.calculateDeltaCount(currentCount, lastSnapshot)
+
+	// If no new data arrived, use last known average
+	if deltaCount == 0 {
+		return gm.lastAvgData[id] // zero value if not found
+	}
+
+	// Calculate new average
+	gpuAvg := *gpu
+	deltaUsage, deltaPower, deltaPowerPkg := gm.calculateDeltas(gpu, lastSnapshot)
+
+	gpuAvg.Power = twoDecimals(deltaPower / float64(deltaCount))
+
+	if gpu.Engines != nil {
+		// make fresh map for averaged engine metrics to avoid mutating
+		// the accumulator map stored in gm.GpuDataMap
+		gpuAvg.Engines = make(map[string]float64, len(gpu.Engines))
+		gpuAvg.Usage = gm.calculateIntelGPUUsage(&gpuAvg, gpu, lastSnapshot, deltaCount)
+		gpuAvg.PowerPkg = twoDecimals(deltaPowerPkg / float64(deltaCount))
+	} else {
+		gpuAvg.Usage = twoDecimals(deltaUsage / float64(deltaCount))
+	}
+
+	gm.lastAvgData[id] = gpuAvg
+	return gpuAvg
+}
+
+// calculateDeltaCount returns the change in count since the last snapshot
+func (gm *GPUManager) calculateDeltaCount(currentCount uint32, lastSnapshot *gpuSnapshot) uint32 {
+	if lastSnapshot != nil {
+		return currentCount - lastSnapshot.count
+	}
+	return currentCount
+}
+
+// calculateDeltas computes the change in usage, power, and powerPkg since the last snapshot
+func (gm *GPUManager) calculateDeltas(gpu *system.GPUData, lastSnapshot *gpuSnapshot) (deltaUsage, deltaPower, deltaPowerPkg float64) {
+	if lastSnapshot != nil {
+		return gpu.Usage - lastSnapshot.usage,
+			gpu.Power - lastSnapshot.power,
+			gpu.PowerPkg - lastSnapshot.powerPkg
+	}
+	return gpu.Usage, gpu.Power, gpu.PowerPkg
+}
+
+// calculateIntelGPUUsage computes Intel GPU usage from engine metrics and returns max engine usage
+func (gm *GPUManager) calculateIntelGPUUsage(gpuAvg, gpu *system.GPUData, lastSnapshot *gpuSnapshot, deltaCount uint32) float64 {
+	maxEngineUsage := 0.0
+	for name, engine := range gpu.Engines {
+		var deltaEngine float64
+		if lastSnapshot != nil && lastSnapshot.engines != nil {
+			deltaEngine = engine - lastSnapshot.engines[name]
+		} else {
+			deltaEngine = engine
+		}
+		gpuAvg.Engines[name] = twoDecimals(deltaEngine / float64(deltaCount))
+		maxEngineUsage = max(maxEngineUsage, deltaEngine/float64(deltaCount))
+	}
+	return twoDecimals(maxEngineUsage)
+}
+
+// updateInstantaneousValues updates values that should reflect current state, not averages
+func (gm *GPUManager) updateInstantaneousValues(gpuAvg *system.GPUData, gpu *system.GPUData) {
+	gpuAvg.Temperature = twoDecimals(gpu.Temperature)
+	gpuAvg.MemoryUsed = twoDecimals(gpu.MemoryUsed)
+	gpuAvg.MemoryTotal = twoDecimals(gpu.MemoryTotal)
+}
+
+// storeSnapshot saves the current GPU state for this cache key
+func (gm *GPUManager) storeSnapshot(id string, gpu *system.GPUData, cacheKey uint16) {
+	snapshot := &gpuSnapshot{
+		count:    uint32(gpu.Count),
+		usage:    gpu.Usage,
+		power:    gpu.Power,
+		powerPkg: gpu.PowerPkg,
+	}
+	if gpu.Engines != nil {
+		snapshot.engines = make(map[string]float64, len(gpu.Engines))
+		maps.Copy(snapshot.engines, gpu.Engines)
+	}
+	gm.lastSnapshots[cacheKey][id] = snapshot
+}
+
+// detectGPUs checks for the presence of GPU management tools (nvidia-smi, rocm-smi, tegrastats)
+// in the system path. It sets the corresponding flags in the GPUManager struct if any of these
+// tools are found. If none of the tools are found, it returns an error indicating that no GPU
+// management tools are available.
+func (gm *GPUManager) detectGPUs() error {
+	if _, err := exec.LookPath(nvidiaSmiCmd); err == nil {
+		gm.nvidiaSmi = true
+	}
+	if _, err := exec.LookPath(rocmSmiCmd); err == nil {
+		gm.rocmSmi = true
+	}
+	if _, err := exec.LookPath(tegraStatsCmd); err == nil {
+		gm.tegrastats = true
+		gm.nvidiaSmi = false
+	}
+	if _, err := exec.LookPath(intelGpuStatsCmd); err == nil {
+		gm.intelGpuStats = true
+	}
+	if gm.nvidiaSmi || gm.rocmSmi || gm.tegrastats || gm.intelGpuStats {
+		return nil
+	}
+	return fmt.Errorf("no GPU found - install nvidia-smi, rocm-smi, tegrastats, or intel_gpu_top")
+}
+
+// startCollector starts the appropriate GPU data collector based on the command
+func (gm *GPUManager) startCollector(command string) {
+	collector := gpuCollector{
+		name:    command,
+		bufSize: 10 * 1024,
+	}
+	switch command {
+	case intelGpuStatsCmd:
+		go func() {
+			failures := 0
+			for {
+				if err := gm.collectIntelStats(); err != nil {
+					failures++
+					if failures > maxFailureRetries {
+						break
+					}
+					slog.Warn("Error collecting Intel GPU data; see https://beszel.dev/guide/gpu", "err", err)
+					time.Sleep(retryWaitTime)
+					continue
+				}
+			}
+		}()
+	case nvidiaSmiCmd:
+		collector.cmdArgs = []string{
+			"-l", nvidiaSmiInterval,
+			"--query-gpu=index,name,temperature.gpu,memory.used,memory.total,utilization.gpu,power.draw",
+			"--format=csv,noheader,nounits",
+		}
+		collector.parse = gm.parseNvidiaData
+		go collector.start()
+	case tegraStatsCmd:
+		collector.cmdArgs = []string{"--interval", tegraStatsInterval}
+		collector.parse = gm.getJetsonParser()
+		go collector.start()
+	case rocmSmiCmd:
+		collector.cmdArgs = []string{"--showid", "--showtemp", "--showuse", "--showpower", "--showproductname", "--showmeminfo", "vram", "--json"}
+		collector.parse = gm.parseAmdData
+		go func() {
+			failures := 0
+			for {
+				if err := collector.collect(); err != nil {
+					failures++
+					if failures > maxFailureRetries {
+						break
+					}
+					slog.Warn("Error collecting AMD GPU data", "err", err)
+				}
+				time.Sleep(rocmSmiInterval)
+			}
+		}()
+	}
+}
+
+// NewGPUManager creates and initializes a new GPUManager
+func NewGPUManager() (*GPUManager, error) {
+	if skipGPU, _ := GetEnv("SKIP_GPU"); skipGPU == "true" {
+		return nil, nil
+	}
+	var gm GPUManager
+	if err := gm.detectGPUs(); err != nil {
+		return nil, err
+	}
+	gm.GpuDataMap = make(map[string]*system.GPUData)
+
+	if gm.nvidiaSmi {
+		gm.startCollector(nvidiaSmiCmd)
+	}
+	if gm.rocmSmi {
+		gm.startCollector(rocmSmiCmd)
+	}
+	if gm.tegrastats {
+		gm.startCollector(tegraStatsCmd)
+	}
+	if gm.intelGpuStats {
+		gm.startCollector(intelGpuStatsCmd)
+	}
+
+	return &gm, nil
+}

agent/gpu_intel.go

@@ -0,0 +1,206 @@
+package agent
+
+import (
+	"bufio"
+	"io"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+const (
+	intelGpuStatsCmd      string = "intel_gpu_top"
+	intelGpuStatsInterval string = "3300" // in milliseconds
+)
+
+type intelGpuStats struct {
+	PowerGPU float64
+	PowerPkg float64
+	Engines  map[string]float64
+}
+
+// updateIntelFromStats updates aggregated GPU data from a single intelGpuStats sample
+func (gm *GPUManager) updateIntelFromStats(sample *intelGpuStats) bool {
+	gm.Lock()
+	defer gm.Unlock()
+
+	// only one gpu for now - cmd doesn't provide all by default
+	gpuData, ok := gm.GpuDataMap["0"]
+	if !ok {
+		gpuData = &system.GPUData{Name: "GPU", Engines: make(map[string]float64)}
+		gm.GpuDataMap["0"] = gpuData
+	}
+
+	gpuData.Power += sample.PowerGPU
+	gpuData.PowerPkg += sample.PowerPkg
+
+	if gpuData.Engines == nil {
+		gpuData.Engines = make(map[string]float64, len(sample.Engines))
+	}
+	for name, engine := range sample.Engines {
+		gpuData.Engines[name] += engine
+	}
+
+	gpuData.Count++
+	return true
+}
+
+// collectIntelStats executes intel_gpu_top in text mode (-l) and parses the output
+func (gm *GPUManager) collectIntelStats() (err error) {
+	// Build command arguments, optionally selecting a device via -d
+	args := []string{"-s", intelGpuStatsInterval, "-l"}
+	if dev, ok := GetEnv("INTEL_GPU_DEVICE"); ok && dev != "" {
+		args = append(args, "-d", dev)
+	}
+	cmd := exec.Command(intelGpuStatsCmd, args...)
+	// Avoid blocking if intel_gpu_top writes to stderr
+	cmd.Stderr = io.Discard
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+
+	// Ensure we always reap the child to avoid zombies on any return path and
+	// propagate a non-zero exit code if no other error was set.
+	defer func() {
+		// Best-effort close of the pipe (unblock the child if it writes)
+		_ = stdout.Close()
+		if cmd.ProcessState == nil || !cmd.ProcessState.Exited() {
+			_ = cmd.Process.Kill()
+		}
+		if waitErr := cmd.Wait(); err == nil && waitErr != nil {
+			err = waitErr
+		}
+	}()
+
+	scanner := bufio.NewScanner(stdout)
+	var header1 string
+	var engineNames []string
+	var friendlyNames []string
+	var preEngineCols int
+	var powerIndex int
+	var hadDataRow bool
+	// skip first data row because it sometimes has erroneous data
+	var skippedFirstDataRow bool
+
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+
+		// first header line
+		if strings.HasPrefix(line, "Freq") {
+			header1 = line
+			continue
+		}
+
+		// second header line
+		if strings.HasPrefix(line, "req") {
+			engineNames, friendlyNames, powerIndex, preEngineCols = gm.parseIntelHeaders(header1, line)
+			continue
+		}
+
+		// Data row
+		if !skippedFirstDataRow {
+			skippedFirstDataRow = true
+			continue
+		}
+		sample, err := gm.parseIntelData(line, engineNames, friendlyNames, powerIndex, preEngineCols)
+		if err != nil {
+			return err
+		}
+		hadDataRow = true
+		gm.updateIntelFromStats(&sample)
+	}
+	if scanErr := scanner.Err(); scanErr != nil {
+		return scanErr
+	}
+	if !hadDataRow {
+		return errNoValidData
+	}
+	return nil
+}
+
+func (gm *GPUManager) parseIntelHeaders(header1 string, header2 string) (engineNames []string, friendlyNames []string, powerIndex int, preEngineCols int) {
+	// Build indexes
+	h1 := strings.Fields(header1)
+	h2 := strings.Fields(header2)
+	powerIndex = -1 // Initialize to -1, will be set to actual index if found
+	// Collect engine names from header1
+	for _, col := range h1 {
+		key := strings.TrimRightFunc(col, func(r rune) bool {
+			return (r >= '0' && r <= '9') || r == '/'
+		})
+		var friendly string
+		switch key {
+		case "RCS":
+			friendly = "Render/3D"
+		case "BCS":
+			friendly = "Blitter"
+		case "VCS":
+			friendly = "Video"
+		case "VECS":
+			friendly = "VideoEnhance"
+		case "CCS":
+			friendly = "Compute"
+		default:
+			continue
+		}
+		engineNames = append(engineNames, key)
+		friendlyNames = append(friendlyNames, friendly)
+	}
+	// find power gpu index among pre-engine columns
+	if n := len(engineNames); n > 0 {
+		preEngineCols = max(len(h2)-3*n, 0)
+		limit := min(len(h2), preEngineCols)
+		for i := range limit {
+			if strings.EqualFold(h2[i], "gpu") {
+				powerIndex = i
+				break
+			}
+		}
+	}
+	return engineNames, friendlyNames, powerIndex, preEngineCols
+}
+
+func (gm *GPUManager) parseIntelData(line string, engineNames []string, friendlyNames []string, powerIndex int, preEngineCols int) (sample intelGpuStats, err error) {
+	fields := strings.Fields(line)
+	if len(fields) == 0 {
+		return sample, errNoValidData
+	}
+	// Make sure row has enough columns for engines
+	if need := preEngineCols + 3*len(engineNames); len(fields) < need {
+		return sample, errNoValidData
+	}
+	if powerIndex >= 0 && powerIndex < len(fields) {
+		if v, perr := strconv.ParseFloat(fields[powerIndex], 64); perr == nil {
+			sample.PowerGPU = v
+		}
+		if v, perr := strconv.ParseFloat(fields[powerIndex+1], 64); perr == nil {
+			sample.PowerPkg = v
+		}
+	}
+	if len(engineNames) > 0 {
+		sample.Engines = make(map[string]float64, len(engineNames))
+		for k := range engineNames {
+			base := preEngineCols + 3*k
+			if base < len(fields) {
+				busy := 0.0
+				if v, e := strconv.ParseFloat(fields[base], 64); e == nil {
+					busy = v
+				}
+				cur := sample.Engines[friendlyNames[k]]
+				sample.Engines[friendlyNames[k]] = cur + busy
+			} else {
+				sample.Engines[friendlyNames[k]] = 0
+			}
+		}
+	}
+	return sample, nil
+}

agent/handlers.go

@@ -0,0 +1,205 @@
+package agent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
+
+	"golang.org/x/exp/slog"
+)
+
+// HandlerContext provides context for request handlers
+type HandlerContext struct {
+	Client      *WebSocketClient
+	Agent       *Agent
+	Request     *common.HubRequest[cbor.RawMessage]
+	RequestID   *uint32
+	HubVerified bool
+	// SendResponse abstracts how a handler sends responses (WS or SSH)
+	SendResponse func(data any, requestID *uint32) error
+}
+
+// RequestHandler defines the interface for handling specific websocket request types
+type RequestHandler interface {
+	// Handle processes the request and returns an error if unsuccessful
+	Handle(hctx *HandlerContext) error
+}
+
+// Responder sends handler responses back to the hub (over WS or SSH)
+type Responder interface {
+	SendResponse(data any, requestID *uint32) error
+}
+
+// HandlerRegistry manages the mapping between actions and their handlers
+type HandlerRegistry struct {
+	handlers map[common.WebSocketAction]RequestHandler
+}
+
+// NewHandlerRegistry creates a new handler registry with default handlers
+func NewHandlerRegistry() *HandlerRegistry {
+	registry := &HandlerRegistry{
+		handlers: make(map[common.WebSocketAction]RequestHandler),
+	}
+
+	registry.Register(common.GetData, &GetDataHandler{})
+	registry.Register(common.CheckFingerprint, &CheckFingerprintHandler{})
+	registry.Register(common.GetContainerLogs, &GetContainerLogsHandler{})
+	registry.Register(common.GetContainerInfo, &GetContainerInfoHandler{})
+	registry.Register(common.GetSmartData, &GetSmartDataHandler{})
+	registry.Register(common.GetSystemdInfo, &GetSystemdInfoHandler{})
+
+	return registry
+}
+
+// Register registers a handler for a specific action type
+func (hr *HandlerRegistry) Register(action common.WebSocketAction, handler RequestHandler) {
+	hr.handlers[action] = handler
+}
+
+// Handle routes the request to the appropriate handler
+func (hr *HandlerRegistry) Handle(hctx *HandlerContext) error {
+	handler, exists := hr.handlers[hctx.Request.Action]
+	if !exists {
+		return fmt.Errorf("unknown action: %d", hctx.Request.Action)
+	}
+
+	// Check verification requirement - default to requiring verification
+	if hctx.Request.Action != common.CheckFingerprint && !hctx.HubVerified {
+		return errors.New("hub not verified")
+	}
+
+	// Log handler execution for debugging
+	// slog.Debug("Executing handler", "action", hctx.Request.Action)
+
+	return handler.Handle(hctx)
+}
+
+// GetHandler returns the handler for a specific action
+func (hr *HandlerRegistry) GetHandler(action common.WebSocketAction) (RequestHandler, bool) {
+	handler, exists := hr.handlers[action]
+	return handler, exists
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetDataHandler handles system data requests
+type GetDataHandler struct{}
+
+func (h *GetDataHandler) Handle(hctx *HandlerContext) error {
+	var options common.DataRequestOptions
+	_ = cbor.Unmarshal(hctx.Request.Data, &options)
+
+	sysStats := hctx.Agent.gatherStats(options.CacheTimeMs)
+	return hctx.SendResponse(sysStats, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// CheckFingerprintHandler handles authentication challenges
+type CheckFingerprintHandler struct{}
+
+func (h *CheckFingerprintHandler) Handle(hctx *HandlerContext) error {
+	return hctx.Client.handleAuthChallenge(hctx.Request, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetContainerLogsHandler handles container log requests
+type GetContainerLogsHandler struct{}
+
+func (h *GetContainerLogsHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.dockerManager == nil {
+		return hctx.SendResponse("", hctx.RequestID)
+	}
+
+	var req common.ContainerLogsRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+
+	ctx := context.Background()
+	logContent, err := hctx.Agent.dockerManager.getLogs(ctx, req.ContainerID)
+	if err != nil {
+		return err
+	}
+
+	return hctx.SendResponse(logContent, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetContainerInfoHandler handles container info requests
+type GetContainerInfoHandler struct{}
+
+func (h *GetContainerInfoHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.dockerManager == nil {
+		return hctx.SendResponse("", hctx.RequestID)
+	}
+
+	var req common.ContainerInfoRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+
+	ctx := context.Background()
+	info, err := hctx.Agent.dockerManager.getContainerInfo(ctx, req.ContainerID)
+	if err != nil {
+		return err
+	}
+
+	return hctx.SendResponse(string(info), hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetSmartDataHandler handles SMART data requests
+type GetSmartDataHandler struct{}
+
+func (h *GetSmartDataHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.smartManager == nil {
+		// return empty map to indicate no data
+		return hctx.SendResponse(map[string]smart.SmartData{}, hctx.RequestID)
+	}
+	if err := hctx.Agent.smartManager.Refresh(false); err != nil {
+		slog.Debug("smart refresh failed", "err", err)
+	}
+	data := hctx.Agent.smartManager.GetCurrentData()
+	return hctx.SendResponse(data, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetSystemdInfoHandler handles detailed systemd service info requests
+type GetSystemdInfoHandler struct{}
+
+func (h *GetSystemdInfoHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.systemdManager == nil {
+		return errors.ErrUnsupported
+	}
+
+	var req common.SystemdInfoRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+	if req.ServiceName == "" {
+		return errors.New("service name is required")
+	}
+
+	details, err := hctx.Agent.systemdManager.getServiceDetails(req.ServiceName)
+	if err != nil {
+		return err
+	}
+
+	return hctx.SendResponse(details, hctx.RequestID)
+}

agent/handlers_test.go

@@ -0,0 +1,112 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"testing"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/stretchr/testify/assert"
+)
+
+// MockHandler for testing
+type MockHandler struct {
+	requiresVerification bool
+	description          string
+	handleFunc           func(ctx *HandlerContext) error
+}
+
+func (m *MockHandler) Handle(ctx *HandlerContext) error {
+	if m.handleFunc != nil {
+		return m.handleFunc(ctx)
+	}
+	return nil
+}
+
+func (m *MockHandler) RequiresVerification() bool {
+	return m.requiresVerification
+}
+
+// TestHandlerRegistry tests the handler registry functionality
+func TestHandlerRegistry(t *testing.T) {
+	t.Run("default registration", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+
+		// Check default handlers are registered
+		getDataHandler, exists := registry.GetHandler(common.GetData)
+		assert.True(t, exists)
+		assert.IsType(t, &GetDataHandler{}, getDataHandler)
+
+		fingerprintHandler, exists := registry.GetHandler(common.CheckFingerprint)
+		assert.True(t, exists)
+		assert.IsType(t, &CheckFingerprintHandler{}, fingerprintHandler)
+	})
+
+	t.Run("custom handler registration", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+		mockHandler := &MockHandler{
+			requiresVerification: true,
+			description:          "Test handler",
+		}
+
+		// Register a custom handler for a mock action
+		const mockAction common.WebSocketAction = 99
+		registry.Register(mockAction, mockHandler)
+
+		// Verify registration
+		handler, exists := registry.GetHandler(mockAction)
+		assert.True(t, exists)
+		assert.Equal(t, mockHandler, handler)
+	})
+
+	t.Run("unknown action", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+		ctx := &HandlerContext{
+			Request: &common.HubRequest[cbor.RawMessage]{
+				Action: common.WebSocketAction(255), // Unknown action
+			},
+			HubVerified: true,
+		}
+
+		err := registry.Handle(ctx)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "unknown action: 255")
+	})
+
+	t.Run("verification required", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+		ctx := &HandlerContext{
+			Request: &common.HubRequest[cbor.RawMessage]{
+				Action: common.GetData, // Requires verification
+			},
+			HubVerified: false, // Not verified
+		}
+
+		err := registry.Handle(ctx)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "hub not verified")
+	})
+}
+
+// TestCheckFingerprintHandler tests the CheckFingerprint handler
+func TestCheckFingerprintHandler(t *testing.T) {
+	handler := &CheckFingerprintHandler{}
+
+	t.Run("handle with invalid data", func(t *testing.T) {
+		client := &WebSocketClient{}
+		ctx := &HandlerContext{
+			Client:      client,
+			HubVerified: false,
+			Request: &common.HubRequest[cbor.RawMessage]{
+				Action: common.CheckFingerprint,
+				Data:   cbor.RawMessage{}, // Empty/invalid data
+			},
+		}
+
+		// Should fail to decode the fingerprint request
+		err := handler.Handle(ctx)
+		assert.Error(t, err)
+	})
+}

agent/health/health.go

@@ -0,0 +1,43 @@
+// Package health provides functions to check and update the health of the agent.
+// It uses a file in the temp directory to store the timestamp of the last connection attempt.
+// If the timestamp is older than 90 seconds, the agent is considered unhealthy.
+// NB: The agent must be started with the Start() method to be considered healthy.
+package health
+
+import (
+	"errors"
+	"log"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// healthFile is the path to the health file
+var healthFile = filepath.Join(os.TempDir(), "beszel_health")
+
+// Check checks if the agent is connected by checking the modification time of the health file
+func Check() error {
+	fileInfo, err := os.Stat(healthFile)
+	if err != nil {
+		return err
+	}
+	if time.Since(fileInfo.ModTime()) > 91*time.Second {
+		log.Println("over 90 seconds since last connection")
+		return errors.New("unhealthy")
+	}
+	return nil
+}
+
+// Update updates the modification time of the health file
+func Update() error {
+	file, err := os.Create(healthFile)
+	if err != nil {
+		return err
+	}
+	return file.Close()
+}
+
+// CleanUp removes the health file
+func CleanUp() error {
+	return os.Remove(healthFile)
+}

agent/health/health_test.go

@@ -0,0 +1,67 @@
+//go:build testing
+// +build testing
+
+package health
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"testing/synctest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHealth(t *testing.T) {
+	// Override healthFile to use a temporary directory for this test.
+	originalHealthFile := healthFile
+	tmpDir := t.TempDir()
+	healthFile = filepath.Join(tmpDir, "beszel_health_test")
+	defer func() { healthFile = originalHealthFile }()
+
+	t.Run("check with no health file", func(t *testing.T) {
+		err := Check()
+		require.Error(t, err)
+		assert.True(t, os.IsNotExist(err), "expected a file-not-exist error, but got: %v", err)
+	})
+
+	t.Run("update and check", func(t *testing.T) {
+		err := Update()
+		require.NoError(t, err, "Update() failed")
+
+		err = Check()
+		assert.NoError(t, err, "Check() failed immediately after Update()")
+	})
+
+	// This test uses synctest to simulate time passing.
+	// NOTE: This test requires GOEXPERIMENT=synctest to run.
+	t.Run("check with simulated time", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			// Update the file to set the initial timestamp.
+			require.NoError(t, Update(), "Update() failed inside synctest")
+
+			// Set the mtime to the current fake time to align the file's timestamp with the simulated clock.
+			now := time.Now()
+			require.NoError(t, os.Chtimes(healthFile, now, now), "Chtimes failed")
+
+			// Wait a duration less than the threshold.
+			time.Sleep(89 * time.Second)
+			synctest.Wait()
+
+			// The check should still pass.
+			assert.NoError(t, Check(), "Check() failed after 89s")
+
+			// Wait for the total duration to exceed the threshold.
+			time.Sleep(5 * time.Second)
+			synctest.Wait()
+
+			// The check should now fail as unhealthy.
+			err := Check()
+			require.Error(t, err, "Check() should have failed after 91s")
+			assert.Equal(t, "unhealthy", err.Error(), "Check() returned wrong error")
+		})
+	})
+}

agent/lhm/beszel_lhm.cs

@@ -0,0 +1,80 @@
+using System;
+using System.Globalization;
+using LibreHardwareMonitor.Hardware;
+
+class Program
+{
+  static void Main()
+  {
+    var computer = new Computer
+    {
+      IsCpuEnabled = true,
+      IsGpuEnabled = true,
+      IsMemoryEnabled = true,
+      IsMotherboardEnabled = true,
+      IsStorageEnabled = true,
+      // IsPsuEnabled = true,
+      // IsNetworkEnabled = true,
+    };
+    computer.Open();
+
+    var reader = Console.In;
+    var writer = Console.Out;
+
+    string line;
+    while ((line = reader.ReadLine()) != null)
+    {
+      if (line.Trim().Equals("getTemps", StringComparison.OrdinalIgnoreCase))
+      {
+        foreach (var hw in computer.Hardware)
+        {
+          // process main hardware sensors
+          ProcessSensors(hw, writer);
+
+          // process subhardware sensors
+          foreach (var subhardware in hw.SubHardware)
+          {
+            ProcessSensors(subhardware, writer);
+          }
+        }
+        // send empty line to signal end of sensor data
+        writer.WriteLine();
+        writer.Flush();
+      }
+    }
+
+    computer.Close();
+  }
+
+  static void ProcessSensors(IHardware hardware, System.IO.TextWriter writer)
+  {
+    var updated = false;
+    foreach (var sensor in hardware.Sensors)
+    {
+      var validTemp = sensor.SensorType == SensorType.Temperature && sensor.Value.HasValue;
+      if (!validTemp || sensor.Name.Contains("Distance"))
+      {
+        continue;
+      }
+
+      if (!updated)
+      {
+        hardware.Update();
+        updated = true;
+      }
+
+      var name = sensor.Name;
+      // if sensor.Name starts with "Temperature" replace with hardware.Identifier but retain the rest of the name.
+      // usually this is a number like Temperature 3
+      if (sensor.Name.StartsWith("Temperature"))
+      {
+        name = hardware.Identifier.ToString().Replace("/", "_").TrimStart('_') + sensor.Name.Substring(11);
+      }
+
+      // invariant culture assures the value is parsable as a float
+      var value = sensor.Value.Value.ToString("0.##", CultureInfo.InvariantCulture);
+      // write the name and value to the writer
+      writer.WriteLine($"{name}|{value}");
+    }
+  }
+}

agent/lhm/beszel_lhm.csproj

@@ -0,0 +1,11 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net48</TargetFramework>
+    <Platforms>x64</Platforms>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.4" />
+  </ItemGroup>
+</Project>

agent/network.go

@@ -0,0 +1,259 @@
+package agent
+
+import (
+	"fmt"
+	"log/slog"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel/agent/deltatracker"
+	"github.com/henrygd/beszel/internal/entities/system"
+	psutilNet "github.com/shirou/gopsutil/v4/net"
+)
+
+// NicConfig controls inclusion/exclusion of network interfaces via the NICS env var
+//
+// Behavior mirrors SensorConfig's matching logic:
+// - Leading '-' means blacklist mode; otherwise whitelist mode
+// - Supports '*' wildcards using path.Match
+// - In whitelist mode with an empty list, no NICs are selected
+// - In blacklist mode with an empty list, all NICs are selected
+type NicConfig struct {
+	nics         map[string]struct{}
+	isBlacklist  bool
+	hasWildcards bool
+}
+
+func newNicConfig(nicsEnvVal string) *NicConfig {
+	cfg := &NicConfig{
+		nics: make(map[string]struct{}),
+	}
+	if strings.HasPrefix(nicsEnvVal, "-") {
+		cfg.isBlacklist = true
+		nicsEnvVal = nicsEnvVal[1:]
+	}
+	for nic := range strings.SplitSeq(nicsEnvVal, ",") {
+		nic = strings.TrimSpace(nic)
+		if nic != "" {
+			cfg.nics[nic] = struct{}{}
+			if strings.Contains(nic, "*") {
+				cfg.hasWildcards = true
+			}
+		}
+	}
+	return cfg
+}
+
+// isValidNic determines if a NIC should be included based on NicConfig rules
+func isValidNic(nicName string, cfg *NicConfig) bool {
+	// Empty list behavior differs by mode: blacklist: allow all; whitelist: allow none
+	if len(cfg.nics) == 0 {
+		return cfg.isBlacklist
+	}
+
+	// Exact match: return true if whitelist, false if blacklist
+	if _, exactMatch := cfg.nics[nicName]; exactMatch {
+		return !cfg.isBlacklist
+	}
+
+	// If no wildcards, return true if blacklist, false if whitelist
+	if !cfg.hasWildcards {
+		return cfg.isBlacklist
+	}
+
+	// Check for wildcard patterns
+	for pattern := range cfg.nics {
+		if !strings.Contains(pattern, "*") {
+			continue
+		}
+		if match, _ := path.Match(pattern, nicName); match {
+			return !cfg.isBlacklist
+		}
+	}
+
+	return cfg.isBlacklist
+}
+
+func (a *Agent) updateNetworkStats(cacheTimeMs uint16, systemStats *system.Stats) {
+	// network stats
+	a.ensureNetInterfacesInitialized()
+
+	a.ensureNetworkInterfacesMap(systemStats)
+
+	if netIO, err := psutilNet.IOCounters(true); err == nil {
+		nis, msElapsed := a.loadAndTickNetBaseline(cacheTimeMs)
+		totalBytesSent, totalBytesRecv := a.sumAndTrackPerNicDeltas(cacheTimeMs, msElapsed, netIO, systemStats)
+		bytesSentPerSecond, bytesRecvPerSecond := a.computeBytesPerSecond(msElapsed, totalBytesSent, totalBytesRecv, nis)
+		a.applyNetworkTotals(cacheTimeMs, netIO, systemStats, nis, totalBytesSent, totalBytesRecv, bytesSentPerSecond, bytesRecvPerSecond)
+	}
+}
+
+func (a *Agent) initializeNetIoStats() {
+	// reset valid network interfaces
+	a.netInterfaces = make(map[string]struct{}, 0)
+
+	// parse NICS env var for whitelist / blacklist
+	nicsEnvVal, nicsEnvExists := GetEnv("NICS")
+	var nicCfg *NicConfig
+	if nicsEnvExists {
+		nicCfg = newNicConfig(nicsEnvVal)
+	}
+
+	// get current network I/O stats and record valid interfaces
+	if netIO, err := psutilNet.IOCounters(true); err == nil {
+		for _, v := range netIO {
+			if nicsEnvExists && !isValidNic(v.Name, nicCfg) {
+				continue
+			}
+			if a.skipNetworkInterface(v) {
+				continue
+			}
+			slog.Info("Detected network interface", "name", v.Name, "sent", v.BytesSent, "recv", v.BytesRecv)
+			// store as a valid network interface
+			a.netInterfaces[v.Name] = struct{}{}
+		}
+	}
+
+	// Reset per-cache-time trackers and baselines so they will reinitialize on next use
+	a.netInterfaceDeltaTrackers = make(map[uint16]*deltatracker.DeltaTracker[string, uint64])
+	a.netIoStats = make(map[uint16]system.NetIoStats)
+}
+
+// ensureNetInterfacesInitialized re-initializes NICs if none are currently tracked
+func (a *Agent) ensureNetInterfacesInitialized() {
+	if len(a.netInterfaces) == 0 {
+		// if no network interfaces, initialize again
+		// this is a fix if agent started before network is online (#466)
+		// maybe refactor this in the future to not cache interface names at all so we
+		// don't miss an interface that's been added after agent started in any circumstance
+		a.initializeNetIoStats()
+	}
+}
+
+// ensureNetworkInterfacesMap ensures systemStats.NetworkInterfaces map exists
+func (a *Agent) ensureNetworkInterfacesMap(systemStats *system.Stats) {
+	if systemStats.NetworkInterfaces == nil {
+		systemStats.NetworkInterfaces = make(map[string][4]uint64, 0)
+	}
+}
+
+// loadAndTickNetBaseline returns the NetIoStats baseline and milliseconds elapsed, updating time
+func (a *Agent) loadAndTickNetBaseline(cacheTimeMs uint16) (netIoStat system.NetIoStats, msElapsed uint64) {
+	netIoStat = a.netIoStats[cacheTimeMs]
+	if netIoStat.Time.IsZero() {
+		netIoStat.Time = time.Now()
+		msElapsed = 0
+	} else {
+		msElapsed = uint64(time.Since(netIoStat.Time).Milliseconds())
+		netIoStat.Time = time.Now()
+	}
+	return netIoStat, msElapsed
+}
+
+// sumAndTrackPerNicDeltas accumulates totals and records per-NIC up/down deltas into systemStats
+func (a *Agent) sumAndTrackPerNicDeltas(cacheTimeMs uint16, msElapsed uint64, netIO []psutilNet.IOCountersStat, systemStats *system.Stats) (totalBytesSent, totalBytesRecv uint64) {
+	tracker := a.netInterfaceDeltaTrackers[cacheTimeMs]
+	if tracker == nil {
+		tracker = deltatracker.NewDeltaTracker[string, uint64]()
+		a.netInterfaceDeltaTrackers[cacheTimeMs] = tracker
+	}
+	tracker.Cycle()
+
+	for _, v := range netIO {
+		if _, exists := a.netInterfaces[v.Name]; !exists {
+			continue
+		}
+		totalBytesSent += v.BytesSent
+		totalBytesRecv += v.BytesRecv
+
+		var upDelta, downDelta uint64
+		upKey, downKey := fmt.Sprintf("%sup", v.Name), fmt.Sprintf("%sdown", v.Name)
+		tracker.Set(upKey, v.BytesSent)
+		tracker.Set(downKey, v.BytesRecv)
+		if msElapsed > 0 {
+			if prevVal, ok := tracker.Previous(upKey); ok {
+				var deltaBytes uint64
+				if v.BytesSent >= prevVal {
+					deltaBytes = v.BytesSent - prevVal
+				} else {
+					deltaBytes = v.BytesSent
+				}
+				upDelta = deltaBytes * 1000 / msElapsed
+			}
+			if prevVal, ok := tracker.Previous(downKey); ok {
+				var deltaBytes uint64
+				if v.BytesRecv >= prevVal {
+					deltaBytes = v.BytesRecv - prevVal
+				} else {
+					deltaBytes = v.BytesRecv
+				}
+				downDelta = deltaBytes * 1000 / msElapsed
+			}
+		}
+		systemStats.NetworkInterfaces[v.Name] = [4]uint64{upDelta, downDelta, v.BytesSent, v.BytesRecv}
+	}
+
+	return totalBytesSent, totalBytesRecv
+}
+
+// computeBytesPerSecond calculates per-second totals from elapsed time and totals
+func (a *Agent) computeBytesPerSecond(msElapsed, totalBytesSent, totalBytesRecv uint64, nis system.NetIoStats) (bytesSentPerSecond, bytesRecvPerSecond uint64) {
+	if msElapsed > 0 {
+		bytesSentPerSecond = (totalBytesSent - nis.BytesSent) * 1000 / msElapsed
+		bytesRecvPerSecond = (totalBytesRecv - nis.BytesRecv) * 1000 / msElapsed
+	}
+	return bytesSentPerSecond, bytesRecvPerSecond
+}
+
+// applyNetworkTotals validates and writes computed network stats, or resets on anomaly
+func (a *Agent) applyNetworkTotals(
+	cacheTimeMs uint16,
+	netIO []psutilNet.IOCountersStat,
+	systemStats *system.Stats,
+	nis system.NetIoStats,
+	totalBytesSent, totalBytesRecv uint64,
+	bytesSentPerSecond, bytesRecvPerSecond uint64,
+) {
+	networkSentPs := bytesToMegabytes(float64(bytesSentPerSecond))
+	networkRecvPs := bytesToMegabytes(float64(bytesRecvPerSecond))
+	if networkSentPs > 10_000 || networkRecvPs > 10_000 {
+		slog.Warn("Invalid net stats. Resetting.", "sent", networkSentPs, "recv", networkRecvPs)
+		for _, v := range netIO {
+			if _, exists := a.netInterfaces[v.Name]; !exists {
+				continue
+			}
+			slog.Info(v.Name, "recv", v.BytesRecv, "sent", v.BytesSent)
+		}
+		a.initializeNetIoStats()
+		delete(a.netIoStats, cacheTimeMs)
+		delete(a.netInterfaceDeltaTrackers, cacheTimeMs)
+		systemStats.NetworkSent = 0
+		systemStats.NetworkRecv = 0
+		systemStats.Bandwidth[0], systemStats.Bandwidth[1] = 0, 0
+		return
+	}
+
+	systemStats.NetworkSent = networkSentPs
+	systemStats.NetworkRecv = networkRecvPs
+	systemStats.Bandwidth[0], systemStats.Bandwidth[1] = bytesSentPerSecond, bytesRecvPerSecond
+	nis.BytesSent = totalBytesSent
+	nis.BytesRecv = totalBytesRecv
+	a.netIoStats[cacheTimeMs] = nis
+}
+
+func (a *Agent) skipNetworkInterface(v psutilNet.IOCountersStat) bool {
+	switch {
+	case strings.HasPrefix(v.Name, "lo"),
+		strings.HasPrefix(v.Name, "docker"),
+		strings.HasPrefix(v.Name, "br-"),
+		strings.HasPrefix(v.Name, "veth"),
+		strings.HasPrefix(v.Name, "bond"),
+		strings.HasPrefix(v.Name, "cali"),
+		v.BytesRecv == 0,
+		v.BytesSent == 0:
+		return true
+	default:
+		return false
+	}
+}

agent/network_test.go

@@ -0,0 +1,502 @@
+//go:build testing
+
+package agent
+
+import (
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/agent/deltatracker"
+	"github.com/henrygd/beszel/internal/entities/system"
+	psutilNet "github.com/shirou/gopsutil/v4/net"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsValidNic(t *testing.T) {
+	tests := []struct {
+		name          string
+		nicName       string
+		config        *NicConfig
+		expectedValid bool
+	}{
+		{
+			name:    "Whitelist - NIC in list",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: false,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Whitelist - NIC not in list",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: false,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist - NIC in list",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist - NIC not in list",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Whitelist with wildcard - matching pattern",
+			nicName: "eth1",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Whitelist with wildcard - non-matching pattern",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist with wildcard - matching pattern",
+			nicName: "eth1",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist with wildcard - non-matching pattern",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Empty whitelist config - no NICs allowed",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{},
+				isBlacklist: false,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Empty blacklist config - all NICs allowed",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{},
+				isBlacklist: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Multiple patterns - exact match",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}, "wlan*": {}},
+				isBlacklist: false,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Multiple patterns - wildcard match",
+			nicName: "wlan1",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Multiple patterns - no match",
+			nicName: "bond0",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isValidNic(tt.nicName, tt.config)
+			assert.Equal(t, tt.expectedValid, result)
+		})
+	}
+}
+
+func TestNewNicConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		nicsEnvVal  string
+		expectedCfg *NicConfig
+	}{
+		{
+			name:       "Empty string",
+			nicsEnvVal: "",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Single NIC whitelist",
+			nicsEnvVal: "eth0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Multiple NICs whitelist",
+			nicsEnvVal: "eth0,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan0": {}},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Blacklist mode",
+			nicsEnvVal: "-eth0,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan0": {}},
+				isBlacklist:  true,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "With wildcards",
+			nicsEnvVal: "eth*,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}, "wlan0": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:       "Blacklist with wildcards",
+			nicsEnvVal: "-eth*,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}, "wlan0": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:       "With whitespace",
+			nicsEnvVal: "eth0, wlan0 , eth1",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan0": {}, "eth1": {}},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Only wildcards",
+			nicsEnvVal: "eth*,wlan*",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}, "wlan*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:       "Leading dash only",
+			nicsEnvVal: "-",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{},
+				isBlacklist:  true,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Mixed exact and wildcard",
+			nicsEnvVal: "eth0,br-*",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "br-*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := newNicConfig(tt.nicsEnvVal)
+			require.NotNil(t, cfg)
+			assert.Equal(t, tt.expectedCfg.isBlacklist, cfg.isBlacklist)
+			assert.Equal(t, tt.expectedCfg.hasWildcards, cfg.hasWildcards)
+			assert.Equal(t, tt.expectedCfg.nics, cfg.nics)
+		})
+	}
+}
+func TestEnsureNetworkInterfacesMap(t *testing.T) {
+	var a Agent
+	var stats system.Stats
+
+	// Initially nil
+	assert.Nil(t, stats.NetworkInterfaces)
+	// Ensure map is created
+	a.ensureNetworkInterfacesMap(&stats)
+	assert.NotNil(t, stats.NetworkInterfaces)
+	// Idempotent
+	a.ensureNetworkInterfacesMap(&stats)
+	assert.NotNil(t, stats.NetworkInterfaces)
+}
+
+func TestLoadAndTickNetBaseline(t *testing.T) {
+	a := &Agent{netIoStats: make(map[uint16]system.NetIoStats)}
+
+	// First call initializes time and returns 0 elapsed
+	ni, elapsed := a.loadAndTickNetBaseline(100)
+	assert.Equal(t, uint64(0), elapsed)
+	assert.False(t, ni.Time.IsZero())
+
+	// Store back what loadAndTick returns to mimic updateNetworkStats behavior
+	a.netIoStats[100] = ni
+
+	time.Sleep(2 * time.Millisecond)
+
+	// Next call should produce >= 0 elapsed and update time
+	ni2, elapsed2 := a.loadAndTickNetBaseline(100)
+	assert.True(t, elapsed2 > 0)
+	assert.False(t, ni2.Time.IsZero())
+}
+
+func TestComputeBytesPerSecond(t *testing.T) {
+	a := &Agent{}
+
+	// No elapsed -> zero rate
+	bytesUp, bytesDown := a.computeBytesPerSecond(0, 2000, 3000, system.NetIoStats{BytesSent: 1000, BytesRecv: 1000})
+	assert.Equal(t, uint64(0), bytesUp)
+	assert.Equal(t, uint64(0), bytesDown)
+
+	// With elapsed -> per-second calculation
+	bytesUp, bytesDown = a.computeBytesPerSecond(500, 6000, 11000, system.NetIoStats{BytesSent: 1000, BytesRecv: 1000})
+	// (6000-1000)*1000/500 = 10000; (11000-1000)*1000/500 = 20000
+	assert.Equal(t, uint64(10000), bytesUp)
+	assert.Equal(t, uint64(20000), bytesDown)
+}
+
+func TestSumAndTrackPerNicDeltas(t *testing.T) {
+	a := &Agent{
+		netInterfaces:             map[string]struct{}{"eth0": {}, "wlan0": {}},
+		netInterfaceDeltaTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+	}
+
+	// Two samples for same cache interval to verify delta behavior
+	cache := uint16(42)
+	net1 := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 1000, BytesRecv: 2000}}
+	stats1 := &system.Stats{}
+	a.ensureNetworkInterfacesMap(stats1)
+	tx1, rx1 := a.sumAndTrackPerNicDeltas(cache, 0, net1, stats1)
+	assert.Equal(t, uint64(1000), tx1)
+	assert.Equal(t, uint64(2000), rx1)
+
+	// Second cycle with elapsed, larger counters -> deltas computed inside
+	net2 := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 4000, BytesRecv: 9000}}
+	stats := &system.Stats{}
+	a.ensureNetworkInterfacesMap(stats)
+	tx2, rx2 := a.sumAndTrackPerNicDeltas(cache, 1000, net2, stats)
+	assert.Equal(t, uint64(4000), tx2)
+	assert.Equal(t, uint64(9000), rx2)
+	// Up/Down deltas per second should be (4000-1000)/1s = 3000 and (9000-2000)/1s = 7000
+	ni, ok := stats.NetworkInterfaces["eth0"]
+	assert.True(t, ok)
+	assert.Equal(t, uint64(3000), ni[0])
+	assert.Equal(t, uint64(7000), ni[1])
+}
+
+func TestSumAndTrackPerNicDeltasHandlesCounterReset(t *testing.T) {
+	a := &Agent{
+		netInterfaces:             map[string]struct{}{"eth0": {}},
+		netInterfaceDeltaTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+	}
+
+	cache := uint16(77)
+
+	// First interval establishes baseline values
+	initial := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 4_000, BytesRecv: 6_000}}
+	statsInitial := &system.Stats{}
+	a.ensureNetworkInterfacesMap(statsInitial)
+	_, _ = a.sumAndTrackPerNicDeltas(cache, 0, initial, statsInitial)
+
+	// Second interval increments counters normally so previous snapshot gets populated
+	increment := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 9_000, BytesRecv: 11_000}}
+	statsIncrement := &system.Stats{}
+	a.ensureNetworkInterfacesMap(statsIncrement)
+	_, _ = a.sumAndTrackPerNicDeltas(cache, 1_000, increment, statsIncrement)
+
+	niIncrement, ok := statsIncrement.NetworkInterfaces["eth0"]
+	require.True(t, ok)
+	assert.Equal(t, uint64(5_000), niIncrement[0])
+	assert.Equal(t, uint64(5_000), niIncrement[1])
+
+	// Third interval simulates counter reset (values drop below previous totals)
+	reset := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 1_200, BytesRecv: 1_500}}
+	statsReset := &system.Stats{}
+	a.ensureNetworkInterfacesMap(statsReset)
+	_, _ = a.sumAndTrackPerNicDeltas(cache, 1_000, reset, statsReset)
+
+	niReset, ok := statsReset.NetworkInterfaces["eth0"]
+	require.True(t, ok)
+	assert.Equal(t, uint64(1_200), niReset[0], "upload delta should match new counter value after reset")
+	assert.Equal(t, uint64(1_500), niReset[1], "download delta should match new counter value after reset")
+}
+
+func TestApplyNetworkTotals(t *testing.T) {
+	tests := []struct {
+		name                  string
+		bytesSentPerSecond    uint64
+		bytesRecvPerSecond    uint64
+		totalBytesSent        uint64
+		totalBytesRecv        uint64
+		expectReset           bool
+		expectedNetworkSent   float64
+		expectedNetworkRecv   float64
+		expectedBandwidthSent uint64
+		expectedBandwidthRecv uint64
+	}{
+		{
+			name:                  "Valid network stats - normal values",
+			bytesSentPerSecond:    1000000, // 1 MB/s
+			bytesRecvPerSecond:    2000000, // 2 MB/s
+			totalBytesSent:        10000000,
+			totalBytesRecv:        20000000,
+			expectReset:           false,
+			expectedNetworkSent:   0.95, // ~1 MB/s rounded to 2 decimals
+			expectedNetworkRecv:   1.91, // ~2 MB/s rounded to 2 decimals
+			expectedBandwidthSent: 1000000,
+			expectedBandwidthRecv: 2000000,
+		},
+		{
+			name:               "Invalid network stats - sent exceeds threshold",
+			bytesSentPerSecond: 11000000000, // ~10.5 GB/s > 10 GB/s threshold
+			bytesRecvPerSecond: 1000000,     // 1 MB/s
+			totalBytesSent:     10000000,
+			totalBytesRecv:     20000000,
+			expectReset:        true,
+		},
+		{
+			name:               "Invalid network stats - recv exceeds threshold",
+			bytesSentPerSecond: 1000000,     // 1 MB/s
+			bytesRecvPerSecond: 11000000000, // ~10.5 GB/s > 10 GB/s threshold
+			totalBytesSent:     10000000,
+			totalBytesRecv:     20000000,
+			expectReset:        true,
+		},
+		{
+			name:               "Invalid network stats - both exceed threshold",
+			bytesSentPerSecond: 12000000000, // ~11.4 GB/s
+			bytesRecvPerSecond: 13000000000, // ~12.4 GB/s
+			totalBytesSent:     10000000,
+			totalBytesRecv:     20000000,
+			expectReset:        true,
+		},
+		{
+			name:                  "Valid network stats - at threshold boundary",
+			bytesSentPerSecond:    10485750000, // ~9999.99 MB/s (rounds to 9999.99)
+			bytesRecvPerSecond:    10485750000, // ~9999.99 MB/s (rounds to 9999.99)
+			totalBytesSent:        10000000,
+			totalBytesRecv:        20000000,
+			expectReset:           false,
+			expectedNetworkSent:   9999.99,
+			expectedNetworkRecv:   9999.99,
+			expectedBandwidthSent: 10485750000,
+			expectedBandwidthRecv: 10485750000,
+		},
+		{
+			name:                  "Zero values",
+			bytesSentPerSecond:    0,
+			bytesRecvPerSecond:    0,
+			totalBytesSent:        0,
+			totalBytesRecv:        0,
+			expectReset:           false,
+			expectedNetworkSent:   0.0,
+			expectedNetworkRecv:   0.0,
+			expectedBandwidthSent: 0,
+			expectedBandwidthRecv: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup agent with initialized maps
+			a := &Agent{
+				netInterfaces:             make(map[string]struct{}),
+				netIoStats:                make(map[uint16]system.NetIoStats),
+				netInterfaceDeltaTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+			}
+
+			cacheTimeMs := uint16(100)
+			netIO := []psutilNet.IOCountersStat{
+				{Name: "eth0", BytesSent: 1000, BytesRecv: 2000},
+			}
+			systemStats := &system.Stats{}
+			nis := system.NetIoStats{}
+
+			a.applyNetworkTotals(
+				cacheTimeMs,
+				netIO,
+				systemStats,
+				nis,
+				tt.totalBytesSent,
+				tt.totalBytesRecv,
+				tt.bytesSentPerSecond,
+				tt.bytesRecvPerSecond,
+			)
+
+			if tt.expectReset {
+				// Should have reset network tracking state - maps cleared and stats zeroed
+				assert.NotContains(t, a.netIoStats, cacheTimeMs, "cache entry should be cleared after reset")
+				assert.NotContains(t, a.netInterfaceDeltaTrackers, cacheTimeMs, "tracker should be cleared on reset")
+				assert.Zero(t, systemStats.NetworkSent)
+				assert.Zero(t, systemStats.NetworkRecv)
+				assert.Zero(t, systemStats.Bandwidth[0])
+				assert.Zero(t, systemStats.Bandwidth[1])
+			} else {
+				// Should have applied stats
+				assert.Equal(t, tt.expectedNetworkSent, systemStats.NetworkSent)
+				assert.Equal(t, tt.expectedNetworkRecv, systemStats.NetworkRecv)
+				assert.Equal(t, tt.expectedBandwidthSent, systemStats.Bandwidth[0])
+				assert.Equal(t, tt.expectedBandwidthRecv, systemStats.Bandwidth[1])
+
+				// Should have updated NetIoStats
+				updatedNis := a.netIoStats[cacheTimeMs]
+				assert.Equal(t, tt.totalBytesSent, updatedNis.BytesSent)
+				assert.Equal(t, tt.totalBytesRecv, updatedNis.BytesRecv)
+			}
+		})
+	}
+}

agent/sensors.go

@@ -0,0 +1,198 @@
+package agent
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"path"
+	"runtime"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/shirou/gopsutil/v4/common"
+	"github.com/shirou/gopsutil/v4/sensors"
+)
+
+type SensorConfig struct {
+	context        context.Context
+	sensors        map[string]struct{}
+	primarySensor  string
+	isBlacklist    bool
+	hasWildcards   bool
+	skipCollection bool
+}
+
+func (a *Agent) newSensorConfig() *SensorConfig {
+	primarySensor, _ := GetEnv("PRIMARY_SENSOR")
+	sysSensors, _ := GetEnv("SYS_SENSORS")
+	sensorsEnvVal, sensorsSet := GetEnv("SENSORS")
+	skipCollection := sensorsSet && sensorsEnvVal == ""
+
+	return a.newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, skipCollection)
+}
+
+// Matches sensors.TemperaturesWithContext to allow for panic recovery (gopsutil/issues/1832)
+type getTempsFn func(ctx context.Context) ([]sensors.TemperatureStat, error)
+
+// newSensorConfigWithEnv creates a SensorConfig with the provided environment variables
+// sensorsSet indicates if the SENSORS environment variable was explicitly set (even to empty string)
+func (a *Agent) newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal string, skipCollection bool) *SensorConfig {
+	config := &SensorConfig{
+		context:        context.Background(),
+		primarySensor:  primarySensor,
+		skipCollection: skipCollection,
+		sensors:        make(map[string]struct{}),
+	}
+
+	// Set sensors context (allows overriding sys location for sensors)
+	if sysSensors != "" {
+		slog.Info("SYS_SENSORS", "path", sysSensors)
+		config.context = context.WithValue(config.context,
+			common.EnvKey, common.EnvMap{common.HostSysEnvKey: sysSensors},
+		)
+	}
+
+	// handle blacklist
+	if strings.HasPrefix(sensorsEnvVal, "-") {
+		config.isBlacklist = true
+		sensorsEnvVal = sensorsEnvVal[1:]
+	}
+
+	for sensor := range strings.SplitSeq(sensorsEnvVal, ",") {
+		sensor = strings.TrimSpace(sensor)
+		if sensor != "" {
+			config.sensors[sensor] = struct{}{}
+			if strings.Contains(sensor, "*") {
+				config.hasWildcards = true
+			}
+		}
+	}
+
+	return config
+}
+
+// updateTemperatures updates the agent with the latest sensor temperatures
+func (a *Agent) updateTemperatures(systemStats *system.Stats) {
+	// skip if sensors whitelist is set to empty string
+	if a.sensorConfig.skipCollection {
+		slog.Debug("Skipping temperature collection")
+		return
+	}
+
+	// reset high temp
+	a.systemInfo.DashboardTemp = 0
+
+	temps, err := a.getTempsWithPanicRecovery(getSensorTemps)
+	if err != nil {
+		// retry once on panic (gopsutil/issues/1832)
+		temps, err = a.getTempsWithPanicRecovery(getSensorTemps)
+		if err != nil {
+			slog.Warn("Error updating temperatures", "err", err)
+			if len(systemStats.Temperatures) > 0 {
+				systemStats.Temperatures = make(map[string]float64)
+			}
+			return
+		}
+	}
+	slog.Debug("Temperature", "sensors", temps)
+
+	// return if no sensors
+	if len(temps) == 0 {
+		return
+	}
+
+	systemStats.Temperatures = make(map[string]float64, len(temps))
+	for i, sensor := range temps {
+		// check for malformed strings on darwin (gopsutil/issues/1832)
+		if runtime.GOOS == "darwin" && !utf8.ValidString(sensor.SensorKey) {
+			continue
+		}
+
+		// scale temperature
+		if sensor.Temperature != 0 && sensor.Temperature < 1 {
+			sensor.Temperature = scaleTemperature(sensor.Temperature)
+		}
+		// skip if temperature is unreasonable
+		if sensor.Temperature <= 0 || sensor.Temperature >= 200 {
+			continue
+		}
+		sensorName := sensor.SensorKey
+		if _, ok := systemStats.Temperatures[sensorName]; ok {
+			// if key already exists, append int to key
+			sensorName = sensorName + "_" + strconv.Itoa(i)
+		}
+		// skip if not in whitelist or blacklist
+		if !isValidSensor(sensorName, a.sensorConfig) {
+			continue
+		}
+		// set dashboard temperature
+		switch a.sensorConfig.primarySensor {
+		case "":
+			a.systemInfo.DashboardTemp = max(a.systemInfo.DashboardTemp, sensor.Temperature)
+		case sensorName:
+			a.systemInfo.DashboardTemp = sensor.Temperature
+		}
+		systemStats.Temperatures[sensorName] = twoDecimals(sensor.Temperature)
+	}
+}
+
+// getTempsWithPanicRecovery wraps sensors.TemperaturesWithContext to recover from panics (gopsutil/issues/1832)
+func (a *Agent) getTempsWithPanicRecovery(getTemps getTempsFn) (temps []sensors.TemperatureStat, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("panic: %v", r)
+		}
+	}()
+	// get sensor data (error ignored intentionally as it may be only with one sensor)
+	temps, _ = getTemps(a.sensorConfig.context)
+	return
+}
+
+// isValidSensor checks if a sensor is valid based on the sensor name and the sensor config
+func isValidSensor(sensorName string, config *SensorConfig) bool {
+	// if no sensors configured, everything is valid
+	if len(config.sensors) == 0 {
+		return true
+	}
+
+	// Exact match - return true if whitelist, false if blacklist
+	if _, exactMatch := config.sensors[sensorName]; exactMatch {
+		return !config.isBlacklist
+	}
+
+	// If no wildcards, return true if blacklist, false if whitelist
+	if !config.hasWildcards {
+		return config.isBlacklist
+	}
+
+	// Check for wildcard patterns
+	for pattern := range config.sensors {
+		if !strings.Contains(pattern, "*") {
+			continue
+		}
+		if match, _ := path.Match(pattern, sensorName); match {
+			return !config.isBlacklist
+		}
+	}
+
+	return config.isBlacklist
+}
+
+// scaleTemperature scales temperatures in fractional values to reasonable Celsius values
+func scaleTemperature(temp float64) float64 {
+	if temp > 1 {
+		return temp
+	}
+	scaled100 := temp * 100
+	scaled1000 := temp * 1000
+
+	if scaled100 >= 15 && scaled100 <= 95 {
+		return scaled100
+	} else if scaled1000 >= 15 && scaled1000 <= 95 {
+		return scaled1000
+	}
+	return scaled100
+}

agent/sensors_default.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package agent
+
+import (
+	"github.com/shirou/gopsutil/v4/sensors"
+)
+
+var getSensorTemps = sensors.TemperaturesWithContext

agent/sensors_test.go

@@ -0,0 +1,554 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/shirou/gopsutil/v4/common"
+	"github.com/shirou/gopsutil/v4/sensors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsValidSensor(t *testing.T) {
+	tests := []struct {
+		name          string
+		sensorName    string
+		config        *SensorConfig
+		expectedValid bool
+	}{
+		{
+			name:       "Whitelist - sensor in list",
+			sensorName: "cpu_temp",
+			config: &SensorConfig{
+				sensors:     map[string]struct{}{"cpu_temp": {}},
+				isBlacklist: false,
+			},
+			expectedValid: true,
+		},
+		{
+			name:       "Whitelist - sensor not in list",
+			sensorName: "gpu_temp",
+			config: &SensorConfig{
+				sensors:     map[string]struct{}{"cpu_temp": {}},
+				isBlacklist: false,
+			},
+			expectedValid: false,
+		},
+		{
+			name:       "Blacklist - sensor in list",
+			sensorName: "cpu_temp",
+			config: &SensorConfig{
+				sensors:     map[string]struct{}{"cpu_temp": {}},
+				isBlacklist: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:       "Blacklist - sensor not in list",
+			sensorName: "gpu_temp",
+			config: &SensorConfig{
+				sensors:     map[string]struct{}{"cpu_temp": {}},
+				isBlacklist: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:       "Whitelist with wildcard - matching pattern",
+			sensorName: "core_0_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"core_*_temp": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:       "Whitelist with wildcard - non-matching pattern",
+			sensorName: "gpu_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"core_*_temp": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:       "Blacklist with wildcard - matching pattern",
+			sensorName: "core_0_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"core_*_temp": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:       "Blacklist with wildcard - non-matching pattern",
+			sensorName: "gpu_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"core_*_temp": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:       "No sensors configured",
+			sensorName: "any_temp",
+			config: &SensorConfig{
+				sensors:        map[string]struct{}{},
+				isBlacklist:    false,
+				hasWildcards:   false,
+				skipCollection: false,
+			},
+			expectedValid: true,
+		},
+		{
+			name:       "Mixed patterns in whitelist - exact match",
+			sensorName: "cpu_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"cpu_temp": {}, "core_*_temp": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:       "Mixed patterns in whitelist - wildcard match",
+			sensorName: "core_1_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"cpu_temp": {}, "core_*_temp": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:       "Mixed patterns in blacklist - exact match",
+			sensorName: "cpu_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"cpu_temp": {}, "core_*_temp": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:       "Mixed patterns in blacklist - wildcard match",
+			sensorName: "core_1_temp",
+			config: &SensorConfig{
+				sensors:      map[string]struct{}{"cpu_temp": {}, "core_*_temp": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isValidSensor(tt.sensorName, tt.config)
+			assert.Equal(t, tt.expectedValid, result, "isValidSensor(%q, config) returned unexpected result", tt.sensorName)
+		})
+	}
+}
+
+func TestNewSensorConfigWithEnv(t *testing.T) {
+	agent := &Agent{}
+
+	tests := []struct {
+		name           string
+		primarySensor  string
+		sysSensors     string
+		sensors        string
+		skipCollection bool
+		expectedConfig *SensorConfig
+	}{
+		{
+			name:          "Empty configuration",
+			primarySensor: "",
+			sysSensors:    "",
+			sensors:       "",
+			expectedConfig: &SensorConfig{
+				context:        context.Background(),
+				primarySensor:  "",
+				sensors:        map[string]struct{}{},
+				isBlacklist:    false,
+				hasWildcards:   false,
+				skipCollection: false,
+			},
+		},
+		{
+			name:           "Explicitly set to empty string",
+			primarySensor:  "",
+			sysSensors:     "",
+			sensors:        "",
+			skipCollection: true,
+			expectedConfig: &SensorConfig{
+				context:        context.Background(),
+				primarySensor:  "",
+				sensors:        map[string]struct{}{},
+				isBlacklist:    false,
+				hasWildcards:   false,
+				skipCollection: true,
+			},
+		},
+		{
+			name:          "Primary sensor only - should create sensor map",
+			primarySensor: "cpu_temp",
+			sysSensors:    "",
+			sensors:       "",
+			expectedConfig: &SensorConfig{
+				context:       context.Background(),
+				primarySensor: "cpu_temp",
+				sensors:       map[string]struct{}{},
+				isBlacklist:   false,
+				hasWildcards:  false,
+			},
+		},
+		{
+			name:          "Whitelist sensors",
+			primarySensor: "cpu_temp",
+			sysSensors:    "",
+			sensors:       "cpu_temp,gpu_temp",
+			expectedConfig: &SensorConfig{
+				context:       context.Background(),
+				primarySensor: "cpu_temp",
+				sensors: map[string]struct{}{
+					"cpu_temp": {},
+					"gpu_temp": {},
+				},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:          "Blacklist sensors",
+			primarySensor: "cpu_temp",
+			sysSensors:    "",
+			sensors:       "-cpu_temp,gpu_temp",
+			expectedConfig: &SensorConfig{
+				context:       context.Background(),
+				primarySensor: "cpu_temp",
+				sensors: map[string]struct{}{
+					"cpu_temp": {},
+					"gpu_temp": {},
+				},
+				isBlacklist:  true,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:          "Sensors with wildcard",
+			primarySensor: "cpu_temp",
+			sysSensors:    "",
+			sensors:       "cpu_*,gpu_temp",
+			expectedConfig: &SensorConfig{
+				context:       context.Background(),
+				primarySensor: "cpu_temp",
+				sensors: map[string]struct{}{
+					"cpu_*":    {},
+					"gpu_temp": {},
+				},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:          "Sensors with whitespace",
+			primarySensor: "cpu_temp",
+			sysSensors:    "",
+			sensors:       "cpu_*, gpu_temp",
+			expectedConfig: &SensorConfig{
+				context:       context.Background(),
+				primarySensor: "cpu_temp",
+				sensors: map[string]struct{}{
+					"cpu_*":    {},
+					"gpu_temp": {},
+				},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:          "With SYS_SENSORS path",
+			primarySensor: "cpu_temp",
+			sysSensors:    "/custom/path",
+			sensors:       "cpu_temp",
+			expectedConfig: &SensorConfig{
+				primarySensor: "cpu_temp",
+				sensors: map[string]struct{}{
+					"cpu_temp": {},
+				},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := agent.newSensorConfigWithEnv(tt.primarySensor, tt.sysSensors, tt.sensors, tt.skipCollection)
+
+			// Check primary sensor
+			assert.Equal(t, tt.expectedConfig.primarySensor, result.primarySensor)
+
+			// Check sensor map
+			if tt.expectedConfig.sensors == nil {
+				assert.Nil(t, result.sensors)
+			} else {
+				assert.Equal(t, len(tt.expectedConfig.sensors), len(result.sensors))
+				for sensor := range tt.expectedConfig.sensors {
+					_, exists := result.sensors[sensor]
+					assert.True(t, exists, "Sensor %s should exist in the result", sensor)
+				}
+			}
+
+			// Check flags
+			assert.Equal(t, tt.expectedConfig.isBlacklist, result.isBlacklist)
+			assert.Equal(t, tt.expectedConfig.hasWildcards, result.hasWildcards)
+
+			// Check context
+			if tt.sysSensors != "" {
+				// Verify context contains correct values
+				envMap, ok := result.context.Value(common.EnvKey).(common.EnvMap)
+				require.True(t, ok, "Context should contain EnvMap")
+				sysPath, ok := envMap[common.HostSysEnvKey]
+				require.True(t, ok, "EnvMap should contain HostSysEnvKey")
+				assert.Equal(t, tt.sysSensors, sysPath)
+			}
+		})
+	}
+}
+
+func TestNewSensorConfig(t *testing.T) {
+	// Save original environment variables
+	originalPrimary, hasPrimary := os.LookupEnv("BESZEL_AGENT_PRIMARY_SENSOR")
+	originalSys, hasSys := os.LookupEnv("BESZEL_AGENT_SYS_SENSORS")
+	originalSensors, hasSensors := os.LookupEnv("BESZEL_AGENT_SENSORS")
+
+	// Restore environment variables after the test
+	defer func() {
+		// Clean up test environment variables
+		os.Unsetenv("BESZEL_AGENT_PRIMARY_SENSOR")
+		os.Unsetenv("BESZEL_AGENT_SYS_SENSORS")
+		os.Unsetenv("BESZEL_AGENT_SENSORS")
+
+		// Restore original values if they existed
+		if hasPrimary {
+			os.Setenv("BESZEL_AGENT_PRIMARY_SENSOR", originalPrimary)
+		}
+		if hasSys {
+			os.Setenv("BESZEL_AGENT_SYS_SENSORS", originalSys)
+		}
+		if hasSensors {
+			os.Setenv("BESZEL_AGENT_SENSORS", originalSensors)
+		}
+	}()
+
+	// Set test environment variables
+	os.Setenv("BESZEL_AGENT_PRIMARY_SENSOR", "test_primary")
+	os.Setenv("BESZEL_AGENT_SYS_SENSORS", "/test/path")
+	os.Setenv("BESZEL_AGENT_SENSORS", "test_sensor1,test_*,test_sensor3")
+
+	agent := &Agent{}
+	result := agent.newSensorConfig()
+
+	// Verify results
+	assert.Equal(t, "test_primary", result.primarySensor)
+	assert.NotNil(t, result.sensors)
+	assert.Equal(t, 3, len(result.sensors))
+	assert.True(t, result.hasWildcards)
+	assert.False(t, result.isBlacklist)
+
+	// Check that sys sensors path is in context
+	envMap, ok := result.context.Value(common.EnvKey).(common.EnvMap)
+	require.True(t, ok, "Context should contain EnvMap")
+	sysPath, ok := envMap[common.HostSysEnvKey]
+	require.True(t, ok, "EnvMap should contain HostSysEnvKey")
+	assert.Equal(t, "/test/path", sysPath)
+}
+
+func TestScaleTemperature(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    float64
+		expected float64
+		desc     string
+	}{
+		// Normal temperatures (no scaling needed)
+		{"normal_cpu_temp", 45.0, 45.0, "Normal CPU temperature"},
+		{"normal_room_temp", 25.0, 25.0, "Normal room temperature"},
+		{"high_cpu_temp", 85.0, 85.0, "High CPU temperature"},
+		// Zero temperature
+		{"zero_temp", 0.0, 0.0, "Zero temperature"},
+		// Fractional values that should use 100x scaling
+		{"fractional_45c", 0.45, 45.0, "0.45 should become 45°C (100x)"},
+		{"fractional_25c", 0.25, 25.0, "0.25 should become 25°C (100x)"},
+		{"fractional_60c", 0.60, 60.0, "0.60 should become 60°C (100x)"},
+		{"fractional_75c", 0.75, 75.0, "0.75 should become 75°C (100x)"},
+		{"fractional_30c", 0.30, 30.0, "0.30 should become 30°C (100x)"},
+		// Fractional values that should use 1000x scaling
+		{"millifractional_45c", 0.045, 45.0, "0.045 should become 45°C (1000x)"},
+		{"millifractional_25c", 0.025, 25.0, "0.025 should become 25°C (1000x)"},
+		{"millifractional_60c", 0.060, 60.0, "0.060 should become 60°C (1000x)"},
+		{"millifractional_75c", 0.075, 75.0, "0.075 should become 75°C (1000x)"},
+		{"millifractional_35c", 0.035, 35.0, "0.035 should become 35°C (1000x)"},
+		// Edge cases - values outside reasonable range
+		{"very_low_fractional", 0.01, 1.0, "0.01 should default to 100x scaling (1°C)"},
+		{"very_high_fractional", 0.99, 99.0, "0.99 should default to 100x scaling (99°C)"},
+		{"extremely_low", 0.001, 0.1, "0.001 should default to 100x scaling (0.1°C)"},
+		// Boundary cases around the reasonable range (15-95°C)
+		{"boundary_low_100x", 0.15, 15.0, "0.15 should use 100x scaling (15°C)"},
+		{"boundary_high_100x", 0.95, 95.0, "0.95 should use 100x scaling (95°C)"},
+		{"boundary_low_1000x", 0.015, 15.0, "0.015 should use 1000x scaling (15°C)"},
+		{"boundary_high_1000x", 0.095, 95.0, "0.095 should use 1000x scaling (95°C)"},
+		// Values just outside reasonable range
+		{"just_below_range_100x", 0.14, 14.0, "0.14 should default to 100x (14°C)"},
+		{"just_above_range_100x", 0.96, 96.0, "0.96 should default to 100x (96°C)"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := scaleTemperature(tt.input)
+			assert.InDelta(t, tt.expected, result, 0.001,
+				"scaleTemperature(%v) = %v, expected %v (%s)",
+				tt.input, result, tt.expected, tt.desc)
+		})
+	}
+}
+
+func TestScaleTemperatureLogic(t *testing.T) {
+	// Test the logic flow for ambiguous cases
+	t.Run("prefers_100x_when_both_valid", func(t *testing.T) {
+		// 0.5 could be 50°C (100x) or 500°C (1000x)
+		// Should prefer 100x since it's tried first and is in range
+		result := scaleTemperature(0.5)
+		expected := 50.0
+		assert.InDelta(t, expected, result, 0.001,
+			"scaleTemperature(0.5) = %v, expected %v (should prefer 100x scaling)",
+			result, expected)
+	})
+
+	t.Run("uses_1000x_when_100x_too_low", func(t *testing.T) {
+		// 0.05 -> 5°C (100x, too low) or 50°C (1000x, in range)
+		// Should use 1000x since 100x is below reasonable range
+		result := scaleTemperature(0.05)
+		expected := 50.0
+		assert.InDelta(t, expected, result, 0.001,
+			"scaleTemperature(0.05) = %v, expected %v (should use 1000x scaling)",
+			result, expected)
+	})
+
+	t.Run("defaults_to_100x_when_both_invalid", func(t *testing.T) {
+		// 0.005 -> 0.5°C (100x, too low) or 5°C (1000x, too low)
+		// Should default to 100x scaling
+		result := scaleTemperature(0.005)
+		expected := 0.5
+		assert.InDelta(t, expected, result, 0.001,
+			"scaleTemperature(0.005) = %v, expected %v (should default to 100x)",
+			result, expected)
+	})
+}
+
+func TestGetTempsWithPanicRecovery(t *testing.T) {
+	agent := &Agent{
+		systemInfo: system.Info{},
+		sensorConfig: &SensorConfig{
+			context: context.Background(),
+		},
+	}
+
+	tests := []struct {
+		name        string
+		getTempsFn  getTempsFn
+		expectError bool
+		errorMsg    string
+	}{
+		{
+			name: "successful_function_call",
+			getTempsFn: func(ctx context.Context) ([]sensors.TemperatureStat, error) {
+				return []sensors.TemperatureStat{
+					{SensorKey: "test_sensor", Temperature: 45.0},
+				}, nil
+			},
+			expectError: false,
+		},
+		{
+			name: "function_returns_error",
+			getTempsFn: func(ctx context.Context) ([]sensors.TemperatureStat, error) {
+				return []sensors.TemperatureStat{
+					{SensorKey: "test_sensor", Temperature: 45.0},
+				}, fmt.Errorf("sensor error")
+			},
+			expectError: false, // getTempsWithPanicRecovery ignores errors from the function
+		},
+		{
+			name: "function_panics_with_string",
+			getTempsFn: func(ctx context.Context) ([]sensors.TemperatureStat, error) {
+				panic("test panic")
+			},
+			expectError: true,
+			errorMsg:    "panic: test panic",
+		},
+		{
+			name: "function_panics_with_error",
+			getTempsFn: func(ctx context.Context) ([]sensors.TemperatureStat, error) {
+				panic(fmt.Errorf("panic error"))
+			},
+			expectError: true,
+			errorMsg:    "panic:",
+		},
+		{
+			name: "function_panics_with_index_out_of_bounds",
+			getTempsFn: func(ctx context.Context) ([]sensors.TemperatureStat, error) {
+				slice := []int{1, 2, 3}
+				_ = slice[10] // out of bounds panic
+				return nil, nil
+			},
+			expectError: true,
+			errorMsg:    "panic:",
+		},
+		{
+			name: "function_panics_with_any_conversion",
+			getTempsFn: func(ctx context.Context) ([]sensors.TemperatureStat, error) {
+				var i any = "string"
+				_ = i.(int) // type assertion panic
+				return nil, nil
+			},
+			expectError: true,
+			errorMsg:    "panic:",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var temps []sensors.TemperatureStat
+			var err error
+
+			// The function should not panic, regardless of what the injected function does
+			assert.NotPanics(t, func() {
+				temps, err = agent.getTempsWithPanicRecovery(tt.getTempsFn)
+			}, "getTempsWithPanicRecovery should not panic")
+
+			if tt.expectError {
+				assert.Error(t, err, "Expected an error to be returned")
+				if tt.errorMsg != "" {
+					assert.Contains(t, err.Error(), tt.errorMsg,
+						"Error message should contain expected text")
+				}
+				assert.Nil(t, temps, "Temps should be nil when panic occurs")
+			} else {
+				assert.NoError(t, err, "Should not return error for successful calls")
+			}
+		})
+	}
+}

agent/sensors_windows.go

@@ -0,0 +1,286 @@
+//go:build windows
+
+//go:generate dotnet build -c Release lhm/beszel_lhm.csproj
+
+package agent
+
+import (
+	"bufio"
+	"context"
+	"embed"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/shirou/gopsutil/v4/sensors"
+)
+
+// Note: This is always called from Agent.gatherStats() which holds Agent.Lock(),
+// so no internal concurrency protection is needed.
+
+// lhmProcess is a wrapper around the LHM .NET process.
+type lhmProcess struct {
+	cmd                  *exec.Cmd
+	stdin                io.WriteCloser
+	stdout               io.ReadCloser
+	scanner              *bufio.Scanner
+	isRunning            bool
+	stoppedNoSensors     bool
+	consecutiveNoSensors uint8
+	execPath             string
+	tempDir              string
+}
+
+//go:embed all:lhm/bin/Release/net48
+var lhmFs embed.FS
+
+var (
+	beszelLhm     *lhmProcess
+	beszelLhmOnce sync.Once
+	useLHM        = os.Getenv("LHM") == "true"
+)
+
+var errNoSensors = errors.New("no sensors found (try running as admin with LHM=true)")
+
+// newlhmProcess copies the embedded LHM executable to a temporary directory and starts it.
+func newlhmProcess() (*lhmProcess, error) {
+	destDir := filepath.Join(os.TempDir(), "beszel")
+	execPath := filepath.Join(destDir, "beszel_lhm.exe")
+
+	if err := os.MkdirAll(destDir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create temp directory: %w", err)
+	}
+
+	// Only copy if executable doesn't exist
+	if _, err := os.Stat(execPath); os.IsNotExist(err) {
+		if err := copyEmbeddedDir(lhmFs, "lhm/bin/Release/net48", destDir); err != nil {
+			return nil, fmt.Errorf("failed to copy embedded directory: %w", err)
+		}
+	}
+
+	lhm := &lhmProcess{
+		execPath: execPath,
+		tempDir:  destDir,
+	}
+
+	if err := lhm.startProcess(); err != nil {
+		return nil, fmt.Errorf("failed to start process: %w", err)
+	}
+
+	return lhm, nil
+}
+
+// startProcess starts the external LHM process
+func (lhm *lhmProcess) startProcess() error {
+	// Clean up any existing process
+	lhm.cleanupProcess()
+
+	cmd := exec.Command(lhm.execPath)
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return err
+	}
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		stdin.Close()
+		return err
+	}
+
+	if err := cmd.Start(); err != nil {
+		stdin.Close()
+		stdout.Close()
+		return err
+	}
+
+	// Update process state
+	lhm.cmd = cmd
+	lhm.stdin = stdin
+	lhm.stdout = stdout
+	lhm.scanner = bufio.NewScanner(stdout)
+	lhm.isRunning = true
+
+	// Give process a moment to initialize
+	time.Sleep(100 * time.Millisecond)
+
+	return nil
+}
+
+// cleanupProcess terminates the process and closes resources but preserves files
+func (lhm *lhmProcess) cleanupProcess() {
+	lhm.isRunning = false
+
+	if lhm.cmd != nil && lhm.cmd.Process != nil {
+		lhm.cmd.Process.Kill()
+		lhm.cmd.Wait()
+	}
+
+	if lhm.stdin != nil {
+		lhm.stdin.Close()
+		lhm.stdin = nil
+	}
+	if lhm.stdout != nil {
+		lhm.stdout.Close()
+		lhm.stdout = nil
+	}
+
+	lhm.cmd = nil
+	lhm.scanner = nil
+	lhm.stoppedNoSensors = false
+	lhm.consecutiveNoSensors = 0
+}
+
+func (lhm *lhmProcess) getTemps(ctx context.Context) (temps []sensors.TemperatureStat, err error) {
+	if !useLHM || lhm.stoppedNoSensors {
+		// Fall back to gopsutil if we can't get sensors from LHM
+		return sensors.TemperaturesWithContext(ctx)
+	}
+
+	// Start process if it's not running
+	if !lhm.isRunning || lhm.stdin == nil || lhm.scanner == nil {
+		err := lhm.startProcess()
+		if err != nil {
+			return temps, err
+		}
+	}
+
+	// Send command to process
+	_, err = fmt.Fprintln(lhm.stdin, "getTemps")
+	if err != nil {
+		lhm.isRunning = false
+		return temps, fmt.Errorf("failed to send command: %w", err)
+	}
+
+	// Read all sensor lines until we hit an empty line or EOF
+	for lhm.scanner.Scan() {
+		line := strings.TrimSpace(lhm.scanner.Text())
+		if line == "" {
+			break
+		}
+
+		parts := strings.Split(line, "|")
+		if len(parts) != 2 {
+			slog.Debug("Invalid sensor format", "line", line)
+			continue
+		}
+
+		name := strings.TrimSpace(parts[0])
+		valueStr := strings.TrimSpace(parts[1])
+
+		value, err := strconv.ParseFloat(valueStr, 64)
+		if err != nil {
+			slog.Debug("Failed to parse sensor", "err", err, "line", line)
+			continue
+		}
+
+		if name == "" || value <= 0 || value > 150 {
+			slog.Debug("Invalid sensor", "name", name, "val", value, "line", line)
+			continue
+		}
+
+		temps = append(temps, sensors.TemperatureStat{
+			SensorKey:   name,
+			Temperature: value,
+		})
+	}
+
+	if err := lhm.scanner.Err(); err != nil {
+		lhm.isRunning = false
+		return temps, err
+	}
+
+	// Handle no sensors case
+	if len(temps) == 0 {
+		lhm.consecutiveNoSensors++
+		if lhm.consecutiveNoSensors >= 3 {
+			lhm.stoppedNoSensors = true
+			slog.Warn(errNoSensors.Error())
+			lhm.cleanup()
+		}
+		return sensors.TemperaturesWithContext(ctx)
+	}
+
+	lhm.consecutiveNoSensors = 0
+
+	return temps, nil
+}
+
+// getSensorTemps attempts to pull sensor temperatures from the embedded LHM process.
+// NB: LibreHardwareMonitorLib requires admin privileges to access all available sensors.
+func getSensorTemps(ctx context.Context) (temps []sensors.TemperatureStat, err error) {
+	defer func() {
+		if err != nil {
+			slog.Debug("Error reading sensors", "err", err)
+		}
+	}()
+
+	if !useLHM {
+		return sensors.TemperaturesWithContext(ctx)
+	}
+
+	// Initialize process once
+	beszelLhmOnce.Do(func() {
+		beszelLhm, err = newlhmProcess()
+	})
+
+	if err != nil {
+		return temps, fmt.Errorf("failed to initialize lhm: %w", err)
+	}
+
+	if beszelLhm == nil {
+		return temps, fmt.Errorf("lhm not available")
+	}
+
+	return beszelLhm.getTemps(ctx)
+}
+
+// cleanup terminates the process and closes resources
+func (lhm *lhmProcess) cleanup() {
+	lhm.cleanupProcess()
+	if lhm.tempDir != "" {
+		os.RemoveAll(lhm.tempDir)
+	}
+}
+
+// copyEmbeddedDir copies the embedded directory to the destination path
+func copyEmbeddedDir(fs embed.FS, srcPath, destPath string) error {
+	entries, err := fs.ReadDir(srcPath)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(destPath, 0755); err != nil {
+		return err
+	}
+
+	for _, entry := range entries {
+		srcEntryPath := path.Join(srcPath, entry.Name())
+		destEntryPath := filepath.Join(destPath, entry.Name())
+
+		if entry.IsDir() {
+			if err := copyEmbeddedDir(fs, srcEntryPath, destEntryPath); err != nil {
+				return err
+			}
+			continue
+		}
+
+		data, err := fs.ReadFile(srcEntryPath)
+		if err != nil {
+			return err
+		}
+
+		if err := os.WriteFile(destEntryPath, data, 0755); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

agent/server.go

@@ -0,0 +1,292 @@
+package agent
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+
+	"github.com/blang/semver"
+	"github.com/fxamacker/cbor/v2"
+	"github.com/gliderlabs/ssh"
+	gossh "golang.org/x/crypto/ssh"
+)
+
+// ServerOptions contains configuration options for starting the SSH server.
+type ServerOptions struct {
+	Addr    string            // Network address to listen on (e.g., ":45876" or "/path/to/socket")
+	Network string            // Network type ("tcp" or "unix")
+	Keys    []gossh.PublicKey // SSH public keys for authentication
+}
+
+// hubVersions caches hub versions by session ID to avoid repeated parsing.
+var hubVersions map[string]semver.Version
+
+// StartServer starts the SSH server with the provided options.
+// It configures the server with secure defaults, sets up authentication,
+// and begins listening for connections. Returns an error if the server
+// is already running or if there's an issue starting the server.
+func (a *Agent) StartServer(opts ServerOptions) error {
+	if a.server != nil {
+		return errors.New("server already started")
+	}
+
+	slog.Info("Starting SSH server", "addr", opts.Addr, "network", opts.Network)
+
+	if opts.Network == "unix" {
+		// remove existing socket file if it exists
+		if err := os.Remove(opts.Addr); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+	}
+
+	// start listening on the address
+	ln, err := net.Listen(opts.Network, opts.Addr)
+	if err != nil {
+		return err
+	}
+	defer ln.Close()
+
+	// base config (limit to allowed algorithms)
+	config := &gossh.ServerConfig{
+		ServerVersion: fmt.Sprintf("SSH-2.0-%s_%s", beszel.AppName, beszel.Version),
+	}
+	config.KeyExchanges = common.DefaultKeyExchanges
+	config.MACs = common.DefaultMACs
+	config.Ciphers = common.DefaultCiphers
+
+	// set default handler
+	ssh.Handle(a.handleSession)
+
+	a.server = &ssh.Server{
+		ServerConfigCallback: func(ctx ssh.Context) *gossh.ServerConfig {
+			return config
+		},
+		// check public key(s)
+		PublicKeyHandler: func(ctx ssh.Context, key ssh.PublicKey) bool {
+			remoteAddr := ctx.RemoteAddr()
+			for _, pubKey := range opts.Keys {
+				if ssh.KeysEqual(key, pubKey) {
+					slog.Info("SSH connected", "addr", remoteAddr)
+					return true
+				}
+			}
+			slog.Warn("Invalid SSH key", "addr", remoteAddr)
+			return false
+		},
+		// disable pty
+		PtyCallback: func(ctx ssh.Context, pty ssh.Pty) bool {
+			return false
+		},
+		// close idle connections after 70 seconds
+		IdleTimeout: 70 * time.Second,
+	}
+
+	// Start SSH server on the listener
+	return a.server.Serve(ln)
+}
+
+// getHubVersion retrieves and caches the hub version for a given session.
+// It extracts the version from the SSH client version string and caches
+// it to avoid repeated parsing. Returns a zero version if parsing fails.
+func (a *Agent) getHubVersion(sessionId string, sessionCtx ssh.Context) semver.Version {
+	if hubVersions == nil {
+		hubVersions = make(map[string]semver.Version, 1)
+	}
+	hubVersion, ok := hubVersions[sessionId]
+	if ok {
+		return hubVersion
+	}
+	// Extract hub version from SSH client version
+	clientVersion := sessionCtx.Value(ssh.ContextKeyClientVersion)
+	if versionStr, ok := clientVersion.(string); ok {
+		hubVersion, _ = extractHubVersion(versionStr)
+	}
+	hubVersions[sessionId] = hubVersion
+	return hubVersion
+}
+
+// handleSession handles an incoming SSH session by gathering system statistics
+// and sending them to the hub. It signals connection events, determines the
+// appropriate encoding format based on hub version, and exits with appropriate
+// status codes.
+func (a *Agent) handleSession(s ssh.Session) {
+	a.connectionManager.eventChan <- SSHConnect
+
+	sessionCtx := s.Context()
+	sessionID := sessionCtx.SessionID()
+
+	hubVersion := a.getHubVersion(sessionID, sessionCtx)
+
+	// Legacy one-shot behavior for older hubs
+	if hubVersion.LT(beszel.MinVersionAgentResponse) {
+		if err := a.handleLegacyStats(s, hubVersion); err != nil {
+			slog.Error("Error encoding stats", "err", err)
+			s.Exit(1)
+			return
+		}
+	}
+
+	var req common.HubRequest[cbor.RawMessage]
+	if err := cbor.NewDecoder(s).Decode(&req); err != nil {
+		// Fallback to legacy one-shot if the first decode fails
+		if err2 := a.handleLegacyStats(s, hubVersion); err2 != nil {
+			slog.Error("Error encoding stats (fallback)", "err", err2)
+			s.Exit(1)
+			return
+		}
+		s.Exit(0)
+		return
+	}
+	if err := a.handleSSHRequest(s, &req); err != nil {
+		slog.Error("SSH request handling failed", "err", err)
+		s.Exit(1)
+		return
+	}
+	s.Exit(0)
+}
+
+// handleSSHRequest builds a handler context and dispatches to the shared registry
+func (a *Agent) handleSSHRequest(w io.Writer, req *common.HubRequest[cbor.RawMessage]) error {
+	// SSH does not support fingerprint auth action
+	if req.Action == common.CheckFingerprint {
+		return cbor.NewEncoder(w).Encode(common.AgentResponse{Error: "unsupported action"})
+	}
+
+	// responder that writes AgentResponse to stdout
+	sshResponder := func(data any, requestID *uint32) error {
+		response := common.AgentResponse{Id: requestID}
+		switch v := data.(type) {
+		case *system.CombinedData:
+			response.SystemData = v
+		case string:
+			response.String = &v
+		case map[string]smart.SmartData:
+			response.SmartData = v
+		case systemd.ServiceDetails:
+			response.ServiceInfo = v
+		default:
+			response.Error = fmt.Sprintf("unsupported response type: %T", data)
+		}
+		return cbor.NewEncoder(w).Encode(response)
+	}
+
+	ctx := &HandlerContext{
+		Client:       nil,
+		Agent:        a,
+		Request:      req,
+		RequestID:    nil,
+		HubVerified:  true,
+		SendResponse: sshResponder,
+	}
+
+	if handler, ok := a.handlerRegistry.GetHandler(req.Action); ok {
+		if err := handler.Handle(ctx); err != nil {
+			return cbor.NewEncoder(w).Encode(common.AgentResponse{Error: err.Error()})
+		}
+		return nil
+	}
+	return cbor.NewEncoder(w).Encode(common.AgentResponse{Error: fmt.Sprintf("unknown action: %d", req.Action)})
+}
+
+// handleLegacyStats serves the legacy one-shot stats payload for older hubs
+func (a *Agent) handleLegacyStats(w io.Writer, hubVersion semver.Version) error {
+	stats := a.gatherStats(60_000)
+	return a.writeToSession(w, stats, hubVersion)
+}
+
+// writeToSession encodes and writes system statistics to the session.
+// It chooses between CBOR and JSON encoding based on the hub version,
+// using CBOR for newer versions and JSON for legacy compatibility.
+func (a *Agent) writeToSession(w io.Writer, stats *system.CombinedData, hubVersion semver.Version) error {
+	if hubVersion.GTE(beszel.MinVersionCbor) {
+		return cbor.NewEncoder(w).Encode(stats)
+	}
+	return json.NewEncoder(w).Encode(stats)
+}
+
+// extractHubVersion extracts the beszel version from SSH client version string.
+// Expected format: "SSH-2.0-beszel_X.Y.Z" or "beszel_X.Y.Z"
+func extractHubVersion(versionString string) (semver.Version, error) {
+	_, after, _ := strings.Cut(versionString, "_")
+	return semver.Parse(after)
+}
+
+// ParseKeys parses a string containing SSH public keys in authorized_keys format.
+// It returns a slice of ssh.PublicKey and an error if any key fails to parse.
+func ParseKeys(input string) ([]gossh.PublicKey, error) {
+	var parsedKeys []gossh.PublicKey
+	for line := range strings.Lines(input) {
+		line = strings.TrimSpace(line)
+		// Skip empty lines or comments
+		if len(line) == 0 || strings.HasPrefix(line, "#") {
+			continue
+		}
+		// Parse the key
+		parsedKey, _, _, _, err := gossh.ParseAuthorizedKey([]byte(line))
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse key: %s, error: %w", line, err)
+		}
+		parsedKeys = append(parsedKeys, parsedKey)
+	}
+	return parsedKeys, nil
+}
+
+// GetAddress determines the network address to listen on from various sources.
+// It checks the provided address, then environment variables (LISTEN, PORT),
+// and finally defaults to ":45876".
+func GetAddress(addr string) string {
+	if addr == "" {
+		addr, _ = GetEnv("LISTEN")
+	}
+	if addr == "" {
+		// Legacy PORT environment variable support
+		addr, _ = GetEnv("PORT")
+	}
+	if addr == "" {
+		return ":45876"
+	}
+	// prefix with : if only port was provided
+	if GetNetwork(addr) != "unix" && !strings.Contains(addr, ":") {
+		addr = ":" + addr
+	}
+	return addr
+}
+
+// GetNetwork determines the network type based on the address format.
+// It checks the NETWORK environment variable first, then infers from
+// the address format: addresses starting with "/" are "unix", others are "tcp".
+func GetNetwork(addr string) string {
+	if network, ok := GetEnv("NETWORK"); ok && network != "" {
+		return network
+	}
+	if strings.HasPrefix(addr, "/") {
+		return "unix"
+	}
+	return "tcp"
+}
+
+// StopServer stops the SSH server if it's running.
+// It returns an error if the server is not running or if there's an error stopping it.
+func (a *Agent) StopServer() error {
+	if a.server == nil {
+		return errors.New("SSH server not running")
+	}
+
+	slog.Info("Stopping SSH server")
+	_ = a.server.Close()
+	a.server = nil
+	a.connectionManager.eventChan <- SSHDisconnect
+	return nil
+}

agent/server_test.go

@@ -0,0 +1,606 @@
+package agent
+
+import (
+	"context"
+	"crypto/ed25519"
+	"encoding/json"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/blang/semver"
+	"github.com/fxamacker/cbor/v2"
+	"github.com/gliderlabs/ssh"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	gossh "golang.org/x/crypto/ssh"
+)
+
+func TestStartServer(t *testing.T) {
+	// Generate a test key pair
+	pubKey, privKey, err := ed25519.GenerateKey(nil)
+	require.NoError(t, err)
+	signer, err := gossh.NewSignerFromKey(privKey)
+	require.NoError(t, err)
+	sshPubKey, err := gossh.NewPublicKey(pubKey)
+	require.NoError(t, err)
+
+	// Generate a different key pair for bad key test
+	badPubKey, badPrivKey, err := ed25519.GenerateKey(nil)
+	require.NoError(t, err)
+	badSigner, err := gossh.NewSignerFromKey(badPrivKey)
+	require.NoError(t, err)
+	sshBadPubKey, err := gossh.NewPublicKey(badPubKey)
+	require.NoError(t, err)
+
+	socketFile := filepath.Join(t.TempDir(), "beszel-test.sock")
+
+	tests := []struct {
+		name        string
+		config      ServerOptions
+		wantErr     bool
+		errContains string
+		setup       func() error
+		cleanup     func() error
+	}{
+		{
+			name: "tcp port only",
+			config: ServerOptions{
+				Network: "tcp",
+				Addr:    ":45987",
+				Keys:    []gossh.PublicKey{sshPubKey},
+			},
+		},
+		{
+			name: "tcp with ipv4",
+			config: ServerOptions{
+				Network: "tcp4",
+				Addr:    "127.0.0.1:45988",
+				Keys:    []gossh.PublicKey{sshPubKey},
+			},
+		},
+		{
+			name: "tcp with ipv6",
+			config: ServerOptions{
+				Network: "tcp6",
+				Addr:    "[::1]:45989",
+				Keys:    []gossh.PublicKey{sshPubKey},
+			},
+		},
+		{
+			name: "unix socket",
+			config: ServerOptions{
+				Network: "unix",
+				Addr:    socketFile,
+				Keys:    []gossh.PublicKey{sshPubKey},
+			},
+			setup: func() error {
+				// Create a socket file that should be removed
+				f, err := os.Create(socketFile)
+				if err != nil {
+					return err
+				}
+				return f.Close()
+			},
+			cleanup: func() error {
+				return os.Remove(socketFile)
+			},
+		},
+		{
+			name: "bad key should fail",
+			config: ServerOptions{
+				Network: "tcp",
+				Addr:    ":45987",
+				Keys:    []gossh.PublicKey{sshBadPubKey},
+			},
+			wantErr:     true,
+			errContains: "ssh: handshake failed",
+		},
+		{
+			name: "good key still good",
+			config: ServerOptions{
+				Network: "tcp",
+				Addr:    ":45987",
+				Keys:    []gossh.PublicKey{sshPubKey},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.setup != nil {
+				err := tt.setup()
+				require.NoError(t, err)
+			}
+
+			if tt.cleanup != nil {
+				defer tt.cleanup()
+			}
+
+			agent, err := NewAgent("")
+			require.NoError(t, err)
+
+			// Start server in a goroutine since it blocks
+			errChan := make(chan error, 1)
+			go func() {
+				errChan <- agent.StartServer(tt.config)
+			}()
+
+			// Add a short delay to allow the server to start
+			time.Sleep(100 * time.Millisecond)
+
+			// Try to connect to verify server is running
+			var client *gossh.Client
+
+			// Choose the appropriate signer based on the test case
+			testSigner := signer
+			if tt.name == "bad key should fail" {
+				testSigner = badSigner
+			}
+
+			sshClientConfig := &gossh.ClientConfig{
+				User: "a",
+				Auth: []gossh.AuthMethod{
+					gossh.PublicKeys(testSigner),
+				},
+				HostKeyCallback: gossh.InsecureIgnoreHostKey(),
+				Timeout:         4 * time.Second,
+			}
+
+			switch tt.config.Network {
+			case "unix":
+				client, err = gossh.Dial("unix", tt.config.Addr, sshClientConfig)
+			default:
+				if !strings.Contains(tt.config.Addr, ":") {
+					tt.config.Addr = ":" + tt.config.Addr
+				}
+				client, err = gossh.Dial("tcp", tt.config.Addr, sshClientConfig)
+			}
+
+			if tt.wantErr {
+				assert.Error(t, err)
+				if tt.errContains != "" {
+					assert.Contains(t, err.Error(), tt.errContains)
+				}
+				return
+			}
+
+			require.NoError(t, err)
+			require.NotNil(t, client)
+			client.Close()
+		})
+	}
+}
+
+/////////////////////////////////////////////////////////////////
+//////////////////// ParseKeys Tests ////////////////////////////
+/////////////////////////////////////////////////////////////////
+
+// Helper function to generate a temporary file with content
+func createTempFile(content string) (string, error) {
+	tmpFile, err := os.CreateTemp("", "ssh_keys_*.txt")
+	if err != nil {
+		return "", fmt.Errorf("failed to create temp file: %w", err)
+	}
+	defer tmpFile.Close()
+
+	if _, err := tmpFile.WriteString(content); err != nil {
+		return "", fmt.Errorf("failed to write to temp file: %w", err)
+	}
+
+	return tmpFile.Name(), nil
+}
+
+// Test case 1: String with a single SSH key
+func TestParseSingleKeyFromString(t *testing.T) {
+	input := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo"
+	keys, err := ParseKeys(input)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+	if len(keys) != 1 {
+		t.Fatalf("Expected 1 key, got %d keys", len(keys))
+	}
+	if keys[0].Type() != "ssh-ed25519" {
+		t.Fatalf("Expected key type 'ssh-ed25519', got '%s'", keys[0].Type())
+	}
+}
+
+// Test case 2: String with multiple SSH keys
+func TestParseMultipleKeysFromString(t *testing.T) {
+	input := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D \n #comment\n ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D"
+	keys, err := ParseKeys(input)
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+	if len(keys) != 3 {
+		t.Fatalf("Expected 3 keys, got %d keys", len(keys))
+	}
+	if keys[0].Type() != "ssh-ed25519" || keys[1].Type() != "ssh-ed25519" || keys[2].Type() != "ssh-ed25519" {
+		t.Fatalf("Unexpected key types: %s, %s, %s", keys[0].Type(), keys[1].Type(), keys[2].Type())
+	}
+}
+
+// Test case 3: File with a single SSH key
+func TestParseSingleKeyFromFile(t *testing.T) {
+	content := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo"
+	filePath, err := createTempFile(content)
+	if err != nil {
+		t.Fatalf("Failed to create temp file: %v", err)
+	}
+	defer os.Remove(filePath) // Clean up the file after the test
+
+	// Read the file content
+	fileContent, err := os.ReadFile(filePath)
+	if err != nil {
+		t.Fatalf("Failed to read temp file: %v", err)
+	}
+
+	// Parse the keys
+	keys, err := ParseKeys(string(fileContent))
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+	if len(keys) != 1 {
+		t.Fatalf("Expected 1 key, got %d keys", len(keys))
+	}
+	if keys[0].Type() != "ssh-ed25519" {
+		t.Fatalf("Expected key type 'ssh-ed25519', got '%s'", keys[0].Type())
+	}
+}
+
+// Test case 4: File with multiple SSH keys
+func TestParseMultipleKeysFromFile(t *testing.T) {
+	content := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D \n #comment\n ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D"
+	filePath, err := createTempFile(content)
+	if err != nil {
+		t.Fatalf("Failed to create temp file: %v", err)
+	}
+	// defer os.Remove(filePath) // Clean up the file after the test
+
+	// Read the file content
+	fileContent, err := os.ReadFile(filePath)
+	if err != nil {
+		t.Fatalf("Failed to read temp file: %v", err)
+	}
+
+	// Parse the keys
+	keys, err := ParseKeys(string(fileContent))
+	if err != nil {
+		t.Fatalf("Expected no error, got: %v", err)
+	}
+	if len(keys) != 3 {
+		t.Fatalf("Expected 3 keys, got %d keys", len(keys))
+	}
+	if keys[0].Type() != "ssh-ed25519" || keys[1].Type() != "ssh-ed25519" || keys[2].Type() != "ssh-ed25519" {
+		t.Fatalf("Unexpected key types: %s, %s, %s", keys[0].Type(), keys[1].Type(), keys[2].Type())
+	}
+}
+
+// Test case 5: Invalid SSH key input
+func TestParseInvalidKey(t *testing.T) {
+	input := "invalid-key-data"
+	_, err := ParseKeys(input)
+	if err == nil {
+		t.Fatalf("Expected an error for invalid key, got nil")
+	}
+	expectedErrMsg := "failed to parse key"
+	if !strings.Contains(err.Error(), expectedErrMsg) {
+		t.Fatalf("Expected error message to contain '%s', got: %v", expectedErrMsg, err)
+	}
+}
+
+/////////////////////////////////////////////////////////////////
+//////////////////// Hub Version Tests //////////////////////////
+/////////////////////////////////////////////////////////////////
+
+func TestExtractHubVersion(t *testing.T) {
+	tests := []struct {
+		name            string
+		clientVersion   string
+		expectedVersion string
+		expectError     bool
+	}{
+		{
+			name:            "valid beszel client version with underscore",
+			clientVersion:   "SSH-2.0-beszel_0.11.1",
+			expectedVersion: "0.11.1",
+			expectError:     false,
+		},
+		{
+			name:            "valid beszel client version with beta",
+			clientVersion:   "SSH-2.0-beszel_1.0.0-beta",
+			expectedVersion: "1.0.0-beta",
+			expectError:     false,
+		},
+		{
+			name:            "valid beszel client version with rc",
+			clientVersion:   "SSH-2.0-beszel_0.12.0-rc1",
+			expectedVersion: "0.12.0-rc1",
+			expectError:     false,
+		},
+		{
+			name:            "different SSH client",
+			clientVersion:   "SSH-2.0-OpenSSH_8.0",
+			expectedVersion: "8.0",
+			expectError:     true,
+		},
+		{
+			name:          "malformed version string without underscore",
+			clientVersion: "SSH-2.0-beszel",
+			expectError:   true,
+		},
+		{
+			name:          "empty version string",
+			clientVersion: "",
+			expectError:   true,
+		},
+		{
+			name:            "version string with underscore but no version",
+			clientVersion:   "beszel_",
+			expectedVersion: "",
+			expectError:     true,
+		},
+		{
+			name:            "version with patch and build metadata",
+			clientVersion:   "SSH-2.0-beszel_1.2.3+build.123",
+			expectedVersion: "1.2.3+build.123",
+			expectError:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := extractHubVersion(tt.clientVersion)
+
+			if tt.expectError {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.expectedVersion, result.String())
+		})
+	}
+}
+
+/////////////////////////////////////////////////////////////////
+/////////////// Hub Version Detection Tests ////////////////////
+/////////////////////////////////////////////////////////////////
+
+func TestGetHubVersion(t *testing.T) {
+	agent, err := NewAgent("")
+	require.NoError(t, err)
+
+	// Mock SSH context that implements the ssh.Context interface
+	mockCtx := &mockSSHContext{
+		sessionID:     "test-session-123",
+		clientVersion: "SSH-2.0-beszel_0.12.0",
+	}
+
+	// Test first call - should extract and cache version
+	version := agent.getHubVersion("test-session-123", mockCtx)
+	assert.Equal(t, "0.12.0", version.String())
+
+	// Test second call - should return cached version
+	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0" // Change version but should still return cached
+	version = agent.getHubVersion("test-session-123", mockCtx)
+	assert.Equal(t, "0.12.0", version.String()) // Should still be cached version
+
+	// Test different session - should extract new version
+	version = agent.getHubVersion("different-session", mockCtx)
+	assert.Equal(t, "0.11.0", version.String())
+
+	// Test with invalid version string (non-beszel client)
+	mockCtx.clientVersion = "SSH-2.0-OpenSSH_8.0"
+	version = agent.getHubVersion("invalid-session", mockCtx)
+	assert.Equal(t, "0.0.0", version.String()) // Should be empty version for non-beszel clients
+
+	// Test with no client version
+	mockCtx.clientVersion = ""
+	version = agent.getHubVersion("no-version-session", mockCtx)
+	assert.True(t, version.EQ(semver.Version{})) // Should be empty version
+}
+
+// mockSSHContext implements ssh.Context for testing
+type mockSSHContext struct {
+	context.Context
+	sync.Mutex
+	sessionID     string
+	clientVersion string
+}
+
+func (m *mockSSHContext) SessionID() string {
+	return m.sessionID
+}
+
+func (m *mockSSHContext) ClientVersion() string {
+	return m.clientVersion
+}
+
+func (m *mockSSHContext) ServerVersion() string {
+	return "SSH-2.0-beszel_test"
+}
+
+func (m *mockSSHContext) Value(key interface{}) interface{} {
+	if key == ssh.ContextKeyClientVersion {
+		return m.clientVersion
+	}
+	return nil
+}
+
+func (m *mockSSHContext) User() string                    { return "test-user" }
+func (m *mockSSHContext) RemoteAddr() net.Addr            { return nil }
+func (m *mockSSHContext) LocalAddr() net.Addr             { return nil }
+func (m *mockSSHContext) Permissions() *ssh.Permissions   { return nil }
+func (m *mockSSHContext) SetValue(key, value interface{}) {}
+
+/////////////////////////////////////////////////////////////////
+/////////////// CBOR vs JSON Encoding Tests ////////////////////
+/////////////////////////////////////////////////////////////////
+
+// TestWriteToSessionEncoding tests that writeToSession actually encodes data in the correct format
+func TestWriteToSessionEncoding(t *testing.T) {
+	tests := []struct {
+		name             string
+		hubVersion       string
+		expectedUsesCbor bool
+	}{
+		{
+			name:             "old hub version should use JSON",
+			hubVersion:       "0.11.1",
+			expectedUsesCbor: false,
+		},
+		{
+			name:             "non-beta release should use CBOR",
+			hubVersion:       "0.12.0",
+			expectedUsesCbor: true,
+		},
+		{
+			name:             "even newer hub version should use CBOR",
+			hubVersion:       "0.16.4",
+			expectedUsesCbor: true,
+		},
+		{
+			name:             "beta version below release threshold should use JSON",
+			hubVersion:       "0.12.0-beta0",
+			expectedUsesCbor: false,
+		},
+		// {
+		// 	name:             "matching beta version should use CBOR",
+		// 	hubVersion:       "0.12.0-beta2",
+		// 	expectedUsesCbor: true,
+		// },
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Reset the global hubVersions map to ensure clean state for each test
+			hubVersions = nil
+
+			agent, err := NewAgent("")
+			require.NoError(t, err)
+
+			// Parse the test version
+			version, err := semver.Parse(tt.hubVersion)
+			require.NoError(t, err)
+
+			// Create test data to encode
+			testData := createTestCombinedData()
+
+			var buf strings.Builder
+			err = agent.writeToSession(&buf, testData, version)
+			require.NoError(t, err)
+
+			encodedData := buf.String()
+			require.NotEmpty(t, encodedData)
+
+			// Verify the encoding format by attempting to decode
+			if tt.expectedUsesCbor {
+				var decodedCbor system.CombinedData
+				err = cbor.Unmarshal([]byte(encodedData), &decodedCbor)
+				assert.NoError(t, err, "Should be valid CBOR data")
+
+				var decodedJson system.CombinedData
+				err = json.Unmarshal([]byte(encodedData), &decodedJson)
+				assert.Error(t, err, "Should not be valid JSON data")
+
+				assert.Equal(t, testData.Info.Hostname, decodedCbor.Info.Hostname)
+				assert.Equal(t, testData.Stats.Cpu, decodedCbor.Stats.Cpu)
+			} else {
+				// Should be JSON - try to decode as JSON
+				var decodedJson system.CombinedData
+				err = json.Unmarshal([]byte(encodedData), &decodedJson)
+				assert.NoError(t, err, "Should be valid JSON data")
+
+				var decodedCbor system.CombinedData
+				err = cbor.Unmarshal([]byte(encodedData), &decodedCbor)
+				assert.Error(t, err, "Should not be valid CBOR data")
+
+				// Verify the decoded JSON data matches our test data
+				assert.Equal(t, testData.Info.Hostname, decodedJson.Info.Hostname)
+				assert.Equal(t, testData.Stats.Cpu, decodedJson.Stats.Cpu)
+
+				// Verify it looks like JSON (starts with '{' and contains readable field names)
+				assert.True(t, strings.HasPrefix(encodedData, "{"), "JSON should start with '{'")
+				assert.Contains(t, encodedData, `"info"`, "JSON should contain readable field names")
+				assert.Contains(t, encodedData, `"stats"`, "JSON should contain readable field names")
+			}
+		})
+	}
+}
+
+// Helper function to create test data for encoding tests
+func createTestCombinedData() *system.CombinedData {
+	return &system.CombinedData{
+		Stats: system.Stats{
+			Cpu:       25.5,
+			Mem:       8589934592, // 8GB
+			MemUsed:   4294967296, // 4GB
+			MemPct:    50.0,
+			DiskTotal: 1099511627776, // 1TB
+			DiskUsed:  549755813888,  // 512GB
+			DiskPct:   50.0,
+		},
+		Info: system.Info{
+			Hostname:     "test-host",
+			Cores:        8,
+			CpuModel:     "Test CPU Model",
+			Uptime:       3600,
+			AgentVersion: "0.12.0",
+			Os:           system.Linux,
+		},
+		Containers: []*container.Stats{
+			{
+				Name: "test-container",
+				Cpu:  10.5,
+				Mem:  1073741824, // 1GB
+			},
+		},
+	}
+}
+
+func TestHubVersionCaching(t *testing.T) {
+	// Reset the global hubVersions map to ensure clean state
+	hubVersions = nil
+
+	agent, err := NewAgent("")
+	require.NoError(t, err)
+
+	ctx1 := &mockSSHContext{
+		sessionID:     "session1",
+		clientVersion: "SSH-2.0-beszel_0.12.0",
+	}
+	ctx2 := &mockSSHContext{
+		sessionID:     "session2",
+		clientVersion: "SSH-2.0-beszel_0.11.0",
+	}
+
+	// First calls should cache the versions
+	v1 := agent.getHubVersion("session1", ctx1)
+	v2 := agent.getHubVersion("session2", ctx2)
+
+	assert.Equal(t, "0.12.0", v1.String())
+	assert.Equal(t, "0.11.0", v2.String())
+
+	// Verify caching by changing context but keeping same session ID
+	ctx1.clientVersion = "SSH-2.0-beszel_0.10.0"
+	v1Cached := agent.getHubVersion("session1", ctx1)
+	assert.Equal(t, "0.12.0", v1Cached.String()) // Should still be cached version
+
+	// New session should get new version
+	ctx3 := &mockSSHContext{
+		sessionID:     "session3",
+		clientVersion: "SSH-2.0-beszel_0.13.0",
+	}
+	v3 := agent.getHubVersion("session3", ctx3)
+	assert.Equal(t, "0.13.0", v3.String())
+}

agent/smart.go

@@ -0,0 +1,926 @@
+//go:generate -command fetchsmartctl go run ./tools/fetchsmartctl
+//go:generate fetchsmartctl -out ./smartmontools/smartctl.exe -url https://static.beszel.dev/bin/smartctl/smartctl-nc.exe -sha 3912249c3b329249aa512ce796fd1b64d7cbd8378b68ad2756b39163d9c30b47
+
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/smart"
+
+	"golang.org/x/exp/slog"
+)
+
+// SmartManager manages data collection for SMART devices
+type SmartManager struct {
+	sync.Mutex
+	SmartDataMap map[string]*smart.SmartData
+	SmartDevices []*DeviceInfo
+	refreshMutex sync.Mutex
+	lastScanTime time.Time
+	binPath      string
+}
+
+type scanOutput struct {
+	Devices []struct {
+		Name     string `json:"name"`
+		Type     string `json:"type"`
+		InfoName string `json:"info_name"`
+		Protocol string `json:"protocol"`
+	} `json:"devices"`
+}
+
+type DeviceInfo struct {
+	Name     string `json:"name"`
+	Type     string `json:"type"`
+	InfoName string `json:"info_name"`
+	Protocol string `json:"protocol"`
+	// typeVerified reports whether we have already parsed SMART data for this device
+	// with the stored parserType. When true we can skip re-running the detection logic.
+	typeVerified bool
+	// parserType holds the parser type (nvme, sat, scsi) that last succeeded.
+	parserType string
+}
+
+var errNoValidSmartData = fmt.Errorf("no valid SMART data found") // Error for missing data
+
+// Refresh updates SMART data for all known devices
+func (sm *SmartManager) Refresh(forceScan bool) error {
+	sm.refreshMutex.Lock()
+	defer sm.refreshMutex.Unlock()
+
+	scanErr := sm.ScanDevices(false)
+	if scanErr != nil {
+		slog.Debug("smartctl scan failed", "err", scanErr)
+	}
+
+	devices := sm.devicesSnapshot()
+	var collectErr error
+	for _, deviceInfo := range devices {
+		if deviceInfo == nil {
+			continue
+		}
+		if err := sm.CollectSmart(deviceInfo); err != nil {
+			slog.Debug("smartctl collect failed", "device", deviceInfo.Name, "err", err)
+			collectErr = err
+		}
+	}
+
+	return sm.resolveRefreshError(scanErr, collectErr)
+}
+
+// devicesSnapshot returns a copy of the current device slice to avoid iterating
+// while holding the primary mutex for longer than necessary.
+func (sm *SmartManager) devicesSnapshot() []*DeviceInfo {
+	sm.Lock()
+	defer sm.Unlock()
+
+	devices := make([]*DeviceInfo, len(sm.SmartDevices))
+	copy(devices, sm.SmartDevices)
+	return devices
+}
+
+// hasSmartData reports whether any SMART data has been collected.
+// func (sm *SmartManager) hasSmartData() bool {
+// 	sm.Lock()
+// 	defer sm.Unlock()
+
+// 	return len(sm.SmartDataMap) > 0
+// }
+
+// resolveRefreshError determines the proper error to return after a refresh.
+func (sm *SmartManager) resolveRefreshError(scanErr, collectErr error) error {
+	sm.Lock()
+	noDevices := len(sm.SmartDevices) == 0
+	noData := len(sm.SmartDataMap) == 0
+	sm.Unlock()
+
+	if noDevices {
+		if scanErr != nil {
+			return scanErr
+		}
+	}
+
+	if !noData {
+		return nil
+	}
+
+	if collectErr != nil {
+		return collectErr
+	}
+	if scanErr != nil {
+		return scanErr
+	}
+	return errNoValidSmartData
+}
+
+// GetCurrentData returns the current SMART data
+func (sm *SmartManager) GetCurrentData() map[string]smart.SmartData {
+	sm.Lock()
+	defer sm.Unlock()
+	result := make(map[string]smart.SmartData, len(sm.SmartDataMap))
+	for key, value := range sm.SmartDataMap {
+		if value != nil {
+			result[key] = *value
+		}
+	}
+	return result
+}
+
+// ScanDevices scans for SMART devices
+// Scan devices using `smartctl --scan -j`
+// If scan fails, return error
+// If scan succeeds, parse the output and update the SmartDevices slice
+func (sm *SmartManager) ScanDevices(force bool) error {
+	if !force && time.Since(sm.lastScanTime) < 30*time.Minute {
+		return nil
+	}
+	sm.lastScanTime = time.Now()
+	currentDevices := sm.devicesSnapshot()
+
+	var configuredDevices []*DeviceInfo
+	if configuredRaw, ok := GetEnv("SMART_DEVICES"); ok {
+		slog.Info("SMART_DEVICES", "value", configuredRaw)
+		config := strings.TrimSpace(configuredRaw)
+		if config == "" {
+			return errNoValidSmartData
+		}
+
+		parsedDevices, err := sm.parseConfiguredDevices(config)
+		if err != nil {
+			return err
+		}
+		configuredDevices = parsedDevices
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, sm.binPath, "--scan", "-j")
+	output, err := cmd.Output()
+
+	var (
+		scanErr        error
+		scannedDevices []*DeviceInfo
+		hasValidScan   bool
+	)
+
+	if err != nil {
+		scanErr = err
+	} else {
+		scannedDevices, hasValidScan = sm.parseScan(output)
+		if !hasValidScan {
+			scanErr = errNoValidSmartData
+		}
+	}
+
+	finalDevices := mergeDeviceLists(currentDevices, scannedDevices, configuredDevices)
+	sm.updateSmartDevices(finalDevices)
+
+	if len(finalDevices) == 0 {
+		if scanErr != nil {
+			slog.Debug("smartctl scan failed", "err", scanErr)
+			return scanErr
+		}
+		return errNoValidSmartData
+	}
+
+	return nil
+}
+
+func (sm *SmartManager) parseConfiguredDevices(config string) ([]*DeviceInfo, error) {
+	entries := strings.Split(config, ",")
+	devices := make([]*DeviceInfo, 0, len(entries))
+	for _, entry := range entries {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+
+		parts := strings.SplitN(entry, ":", 2)
+
+		name := strings.TrimSpace(parts[0])
+		if name == "" {
+			return nil, fmt.Errorf("invalid SMART_DEVICES entry %q", entry)
+		}
+
+		devType := ""
+		if len(parts) == 2 {
+			devType = strings.ToLower(strings.TrimSpace(parts[1]))
+		}
+
+		devices = append(devices, &DeviceInfo{
+			Name: name,
+			Type: devType,
+		})
+	}
+
+	if len(devices) == 0 {
+		return nil, errNoValidSmartData
+	}
+
+	return devices, nil
+}
+
+// detectSmartOutputType inspects sections that are unique to each smartctl
+// JSON schema (NVMe, ATA/SATA, SCSI) to determine which parser should be used
+// when the reported device type is ambiguous or missing.
+func detectSmartOutputType(output []byte) string {
+	var hints struct {
+		AtaSmartAttributes            json.RawMessage `json:"ata_smart_attributes"`
+		NVMeSmartHealthInformationLog json.RawMessage `json:"nvme_smart_health_information_log"`
+		ScsiErrorCounterLog           json.RawMessage `json:"scsi_error_counter_log"`
+	}
+
+	if err := json.Unmarshal(output, &hints); err != nil {
+		return ""
+	}
+
+	switch {
+	case hasJSONValue(hints.NVMeSmartHealthInformationLog):
+		return "nvme"
+	case hasJSONValue(hints.AtaSmartAttributes):
+		return "sat"
+	case hasJSONValue(hints.ScsiErrorCounterLog):
+		return "scsi"
+	default:
+		return "sat"
+	}
+}
+
+// hasJSONValue reports whether a JSON payload contains a concrete value. The
+// smartctl output often emits "null" for sections that do not apply, so we
+// only treat non-null content as a hint.
+func hasJSONValue(raw json.RawMessage) bool {
+	if len(raw) == 0 {
+		return false
+	}
+	trimmed := strings.TrimSpace(string(raw))
+	return trimmed != "" && trimmed != "null"
+}
+
+func normalizeParserType(value string) string {
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case "nvme", "sntasmedia", "sntrealtek":
+		return "nvme"
+	case "sat", "ata":
+		return "sat"
+	case "scsi":
+		return "scsi"
+	default:
+		return strings.ToLower(strings.TrimSpace(value))
+	}
+}
+
+// parseSmartOutput attempts each SMART parser, optionally detecting the type when
+// it is not provided, and updates the device info when a parser succeeds.
+func (sm *SmartManager) parseSmartOutput(deviceInfo *DeviceInfo, output []byte) bool {
+	parsers := []struct {
+		Type  string
+		Parse func([]byte) (bool, int)
+	}{
+		{Type: "nvme", Parse: sm.parseSmartForNvme},
+		{Type: "sat", Parse: sm.parseSmartForSata},
+		{Type: "scsi", Parse: sm.parseSmartForScsi},
+	}
+
+	deviceType := normalizeParserType(deviceInfo.parserType)
+	if deviceType == "" {
+		deviceType = normalizeParserType(deviceInfo.Type)
+	}
+	if deviceInfo.parserType == "" {
+		switch deviceType {
+		case "nvme", "sat", "scsi":
+			deviceInfo.parserType = deviceType
+		}
+	}
+
+	// Only run the type detection when we do not yet know which parser works
+	// or the previous attempt failed.
+	needsDetection := deviceType == "" || !deviceInfo.typeVerified
+	if needsDetection {
+		structureType := detectSmartOutputType(output)
+		if deviceType != structureType {
+			deviceType = structureType
+			deviceInfo.parserType = structureType
+			deviceInfo.typeVerified = false
+		}
+		if deviceInfo.Type == "" || strings.EqualFold(deviceInfo.Type, structureType) {
+			deviceInfo.Type = structureType
+		}
+	}
+
+	// Try the most likely parser first, but keep the remaining parsers in reserve
+	// so an incorrect hint never leaves the device unparsed.
+	selectedParsers := make([]struct {
+		Type  string
+		Parse func([]byte) (bool, int)
+	}, 0, len(parsers))
+	if deviceType != "" {
+		for _, parser := range parsers {
+			if parser.Type == deviceType {
+				selectedParsers = append(selectedParsers, parser)
+				break
+			}
+		}
+	}
+	for _, parser := range parsers {
+		alreadySelected := false
+		for _, selected := range selectedParsers {
+			if selected.Type == parser.Type {
+				alreadySelected = true
+				break
+			}
+		}
+		if alreadySelected {
+			continue
+		}
+		selectedParsers = append(selectedParsers, parser)
+	}
+
+	// Try the selected parsers in order until we find one that succeeds.
+	for _, parser := range selectedParsers {
+		hasData, _ := parser.Parse(output)
+		if hasData {
+			deviceInfo.parserType = parser.Type
+			if deviceInfo.Type == "" || strings.EqualFold(deviceInfo.Type, parser.Type) {
+				deviceInfo.Type = parser.Type
+			}
+			// Remember that this parser is valid so future refreshes can bypass
+			// detection entirely.
+			deviceInfo.typeVerified = true
+			return true
+		}
+		slog.Debug("parser failed", "device", deviceInfo.Name, "parser", parser.Type)
+	}
+
+	// Leave verification false so the next pass will attempt detection again.
+	deviceInfo.typeVerified = false
+	slog.Debug("parsing failed", "device", deviceInfo.Name)
+	return false
+}
+
+// CollectSmart collects SMART data for a device
+// Collect data using `smartctl -d <type> -aj /dev/<device>` when device type is known
+// Always attempts to parse output even if command fails, as some data may still be available
+// If collect fails, return error
+// If collect succeeds, parse the output and update the SmartDataMap
+// Uses -n standby to avoid waking up sleeping disks, but bypasses standby mode
+// for initial data collection when no cached data exists
+func (sm *SmartManager) CollectSmart(deviceInfo *DeviceInfo) error {
+	// slog.Info("collecting SMART data", "device", deviceInfo.Name, "type", deviceInfo.Type, "has_existing_data", sm.hasDataForDevice(deviceInfo.Name))
+
+	// Check if we have any existing data for this device
+	hasExistingData := sm.hasDataForDevice(deviceInfo.Name)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+
+	// Try with -n standby first if we have existing data
+	args := sm.smartctlArgs(deviceInfo, true)
+	cmd := exec.CommandContext(ctx, sm.binPath, args...)
+	output, err := cmd.CombinedOutput()
+
+	// Check if device is in standby (exit status 2)
+	if exitErr, ok := err.(*exec.ExitError); ok && exitErr.ExitCode() == 2 {
+		if hasExistingData {
+			// Device is in standby and we have cached data, keep using cache
+			return nil
+		}
+		// No cached data, need to collect initial data by bypassing standby
+		ctx2, cancel2 := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel2()
+		args = sm.smartctlArgs(deviceInfo, false)
+		cmd = exec.CommandContext(ctx2, sm.binPath, args...)
+		output, err = cmd.CombinedOutput()
+	}
+
+	hasValidData := sm.parseSmartOutput(deviceInfo, output)
+
+	if !hasValidData {
+		if err != nil {
+			slog.Debug("smartctl failed", "device", deviceInfo.Name, "err", err)
+			return err
+		}
+		slog.Debug("no valid SMART data found", "device", deviceInfo.Name)
+		return errNoValidSmartData
+	}
+
+	return nil
+}
+
+// smartctlArgs returns the arguments for the smartctl command
+// based on the device type and whether to include standby mode
+func (sm *SmartManager) smartctlArgs(deviceInfo *DeviceInfo, includeStandby bool) []string {
+	args := make([]string, 0, 7)
+
+	if deviceInfo != nil {
+		deviceType := strings.ToLower(deviceInfo.Type)
+		// types sometimes misidentified in scan; see github.com/henrygd/beszel/issues/1345
+		if deviceType != "" && deviceType != "scsi" && deviceType != "ata" {
+			args = append(args, "-d", deviceInfo.Type)
+		}
+	}
+
+	args = append(args, "-a", "--json=c")
+
+	if includeStandby {
+		args = append(args, "-n", "standby")
+	}
+
+	if deviceInfo != nil {
+		args = append(args, deviceInfo.Name)
+	}
+
+	return args
+}
+
+// hasDataForDevice checks if we have cached SMART data for a specific device
+func (sm *SmartManager) hasDataForDevice(deviceName string) bool {
+	sm.Lock()
+	defer sm.Unlock()
+
+	// Check if any cached data has this device name
+	for _, data := range sm.SmartDataMap {
+		if data != nil && data.DiskName == deviceName {
+			return true
+		}
+	}
+	return false
+}
+
+// parseScan parses the output of smartctl --scan -j and returns the discovered devices.
+func (sm *SmartManager) parseScan(output []byte) ([]*DeviceInfo, bool) {
+	scan := &scanOutput{}
+
+	if err := json.Unmarshal(output, scan); err != nil {
+		return nil, false
+	}
+
+	if len(scan.Devices) == 0 {
+		slog.Debug("no devices found in smartctl scan")
+		return nil, false
+	}
+
+	devices := make([]*DeviceInfo, 0, len(scan.Devices))
+	for _, device := range scan.Devices {
+		slog.Debug("smartctl scan", "name", device.Name, "type", device.Type, "protocol", device.Protocol)
+		devices = append(devices, &DeviceInfo{
+			Name:     device.Name,
+			Type:     device.Type,
+			InfoName: device.InfoName,
+			Protocol: device.Protocol,
+		})
+	}
+
+	return devices, true
+}
+
+// mergeDeviceLists combines scanned and configured SMART devices, preferring
+// configured SMART_DEVICES when both sources reference the same device.
+func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo {
+	if len(scanned) == 0 && len(configured) == 0 {
+		return existing
+	}
+
+	// preserveVerifiedType copies the verified type/parser metadata from an existing
+	// device record so that subsequent scans/config updates never downgrade a
+	// previously verified device.
+	preserveVerifiedType := func(target, prev *DeviceInfo) {
+		if prev == nil || !prev.typeVerified {
+			return
+		}
+		target.Type = prev.Type
+		target.typeVerified = true
+		target.parserType = prev.parserType
+	}
+
+	existingIndex := make(map[string]*DeviceInfo, len(existing))
+	for _, dev := range existing {
+		if dev == nil || dev.Name == "" {
+			continue
+		}
+		existingIndex[dev.Name] = dev
+	}
+
+	finalDevices := make([]*DeviceInfo, 0, len(scanned)+len(configured))
+	deviceIndex := make(map[string]*DeviceInfo, len(scanned)+len(configured))
+
+	// Start with the newly scanned devices so we always surface fresh metadata,
+	// but ensure we retain any previously verified parser assignment.
+	for _, dev := range scanned {
+		if dev == nil || dev.Name == "" {
+			continue
+		}
+
+		// Work on a copy so we can safely adjust metadata without mutating the
+		// input slices that may be reused elsewhere.
+		copyDev := *dev
+		if prev := existingIndex[copyDev.Name]; prev != nil {
+			preserveVerifiedType(&copyDev, prev)
+		}
+
+		finalDevices = append(finalDevices, &copyDev)
+		deviceIndex[copyDev.Name] = finalDevices[len(finalDevices)-1]
+	}
+
+	// Merge configured devices on top so users can override scan results (except
+	// for verified type information).
+	for _, dev := range configured {
+		if dev == nil || dev.Name == "" {
+			continue
+		}
+
+		if existingDev, ok := deviceIndex[dev.Name]; ok {
+			// Only update the type if it has not been verified yet; otherwise we
+			// keep the existing verified metadata intact.
+			if dev.Type != "" && !existingDev.typeVerified {
+				newType := strings.TrimSpace(dev.Type)
+				existingDev.Type = newType
+				existingDev.typeVerified = false
+				existingDev.parserType = normalizeParserType(newType)
+			}
+			if dev.InfoName != "" {
+				existingDev.InfoName = dev.InfoName
+			}
+			if dev.Protocol != "" {
+				existingDev.Protocol = dev.Protocol
+			}
+			continue
+		}
+
+		copyDev := *dev
+		if prev := existingIndex[copyDev.Name]; prev != nil {
+			preserveVerifiedType(&copyDev, prev)
+		} else if copyDev.Type != "" {
+			copyDev.parserType = normalizeParserType(copyDev.Type)
+		}
+
+		finalDevices = append(finalDevices, &copyDev)
+		deviceIndex[copyDev.Name] = finalDevices[len(finalDevices)-1]
+	}
+
+	return finalDevices
+}
+
+// updateSmartDevices replaces the cached device list and prunes SMART data
+// entries whose backing device no longer exists.
+func (sm *SmartManager) updateSmartDevices(devices []*DeviceInfo) {
+	sm.Lock()
+	defer sm.Unlock()
+
+	sm.SmartDevices = devices
+
+	if len(sm.SmartDataMap) == 0 {
+		return
+	}
+
+	validNames := make(map[string]struct{}, len(devices))
+	for _, device := range devices {
+		if device == nil || device.Name == "" {
+			continue
+		}
+		validNames[device.Name] = struct{}{}
+	}
+
+	for key, data := range sm.SmartDataMap {
+		if data == nil {
+			delete(sm.SmartDataMap, key)
+			continue
+		}
+
+		if _, ok := validNames[data.DiskName]; ok {
+			continue
+		}
+
+		delete(sm.SmartDataMap, key)
+	}
+}
+
+// isVirtualDevice checks if a device is a virtual disk that should be filtered out
+func (sm *SmartManager) isVirtualDevice(data *smart.SmartInfoForSata) bool {
+	vendorUpper := strings.ToUpper(data.ScsiVendor)
+	productUpper := strings.ToUpper(data.ScsiProduct)
+	modelUpper := strings.ToUpper(data.ModelName)
+
+	return sm.isVirtualDeviceFromStrings(vendorUpper, productUpper, modelUpper)
+}
+
+// isVirtualDeviceNvme checks if an NVMe device is a virtual disk that should be filtered out
+func (sm *SmartManager) isVirtualDeviceNvme(data *smart.SmartInfoForNvme) bool {
+	modelUpper := strings.ToUpper(data.ModelName)
+
+	return sm.isVirtualDeviceFromStrings(modelUpper)
+}
+
+// isVirtualDeviceScsi checks if a SCSI device is a virtual disk that should be filtered out
+func (sm *SmartManager) isVirtualDeviceScsi(data *smart.SmartInfoForScsi) bool {
+	vendorUpper := strings.ToUpper(data.ScsiVendor)
+	productUpper := strings.ToUpper(data.ScsiProduct)
+	modelUpper := strings.ToUpper(data.ScsiModelName)
+
+	return sm.isVirtualDeviceFromStrings(vendorUpper, productUpper, modelUpper)
+}
+
+// isVirtualDeviceFromStrings checks if any of the provided strings indicate a virtual device
+func (sm *SmartManager) isVirtualDeviceFromStrings(fields ...string) bool {
+	for _, field := range fields {
+		fieldUpper := strings.ToUpper(field)
+		switch {
+		case strings.Contains(fieldUpper, "IET"), // iSCSI Enterprise Target
+			strings.Contains(fieldUpper, "VIRTUAL"),
+			strings.Contains(fieldUpper, "QEMU"),
+			strings.Contains(fieldUpper, "VBOX"),
+			strings.Contains(fieldUpper, "VMWARE"),
+			strings.Contains(fieldUpper, "MSFT"): // Microsoft Hyper-V
+			return true
+		}
+	}
+	return false
+}
+
+// parseSmartForSata parses the output of smartctl --all -j for SATA/ATA devices and updates the SmartDataMap
+// Returns hasValidData and exitStatus
+func (sm *SmartManager) parseSmartForSata(output []byte) (bool, int) {
+	var data smart.SmartInfoForSata
+
+	if err := json.Unmarshal(output, &data); err != nil {
+		return false, 0
+	}
+
+	if data.SerialNumber == "" {
+		slog.Debug("no serial number", "device", data.Device.Name)
+		return false, data.Smartctl.ExitStatus
+	}
+
+	// Skip virtual devices (e.g., Kubernetes PVCs, QEMU, VirtualBox, etc.)
+	if sm.isVirtualDevice(&data) {
+		slog.Debug("skipping smart", "device", data.Device.Name, "model", data.ModelName)
+		return false, data.Smartctl.ExitStatus
+	}
+
+	sm.Lock()
+	defer sm.Unlock()
+
+	keyName := data.SerialNumber
+
+	// if device does not exist in SmartDataMap, initialize it
+	if _, ok := sm.SmartDataMap[keyName]; !ok {
+		sm.SmartDataMap[keyName] = &smart.SmartData{}
+	}
+
+	// update SmartData
+	smartData := sm.SmartDataMap[keyName]
+	// smartData.ModelFamily = data.ModelFamily
+	smartData.ModelName = data.ModelName
+	smartData.SerialNumber = data.SerialNumber
+	smartData.FirmwareVersion = data.FirmwareVersion
+	smartData.Capacity = data.UserCapacity.Bytes
+	smartData.Temperature = data.Temperature.Current
+	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
+	smartData.DiskName = data.Device.Name
+	smartData.DiskType = data.Device.Type
+
+	// update SmartAttributes
+	smartData.Attributes = make([]*smart.SmartAttribute, 0, len(data.AtaSmartAttributes.Table))
+	for _, attr := range data.AtaSmartAttributes.Table {
+		rawValue := uint64(attr.Raw.Value)
+		if parsed, ok := smart.ParseSmartRawValueString(attr.Raw.String); ok {
+			rawValue = parsed
+		}
+		smartAttr := &smart.SmartAttribute{
+			ID:         attr.ID,
+			Name:       attr.Name,
+			Value:      attr.Value,
+			Worst:      attr.Worst,
+			Threshold:  attr.Thresh,
+			RawValue:   rawValue,
+			RawString:  attr.Raw.String,
+			WhenFailed: attr.WhenFailed,
+		}
+		smartData.Attributes = append(smartData.Attributes, smartAttr)
+	}
+	sm.SmartDataMap[keyName] = smartData
+
+	return true, data.Smartctl.ExitStatus
+}
+
+func getSmartStatus(temperature uint8, passed bool) string {
+	if passed {
+		return "PASSED"
+	} else if temperature > 0 {
+		return "FAILED"
+	} else {
+		return "UNKNOWN"
+	}
+}
+
+func (sm *SmartManager) parseSmartForScsi(output []byte) (bool, int) {
+	var data smart.SmartInfoForScsi
+
+	if err := json.Unmarshal(output, &data); err != nil {
+		return false, 0
+	}
+
+	if data.SerialNumber == "" {
+		slog.Debug("no serial number", "device", data.Device.Name)
+		return false, data.Smartctl.ExitStatus
+	}
+
+	// Skip virtual devices (e.g., Kubernetes PVCs, QEMU, VirtualBox, etc.)
+	if sm.isVirtualDeviceScsi(&data) {
+		slog.Debug("skipping smart", "device", data.Device.Name, "model", data.ScsiModelName)
+		return false, data.Smartctl.ExitStatus
+	}
+
+	sm.Lock()
+	defer sm.Unlock()
+
+	keyName := data.SerialNumber
+	if _, ok := sm.SmartDataMap[keyName]; !ok {
+		sm.SmartDataMap[keyName] = &smart.SmartData{}
+	}
+
+	smartData := sm.SmartDataMap[keyName]
+	smartData.ModelName = data.ScsiModelName
+	smartData.SerialNumber = data.SerialNumber
+	smartData.FirmwareVersion = data.ScsiRevision
+	smartData.Capacity = data.UserCapacity.Bytes
+	smartData.Temperature = data.Temperature.Current
+	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
+	smartData.DiskName = data.Device.Name
+	smartData.DiskType = data.Device.Type
+
+	attributes := make([]*smart.SmartAttribute, 0, 10)
+	attributes = append(attributes, &smart.SmartAttribute{Name: "PowerOnHours", RawValue: data.PowerOnTime.Hours})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "PowerOnMinutes", RawValue: data.PowerOnTime.Minutes})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "GrownDefectList", RawValue: data.ScsiGrownDefectList})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "StartStopCycles", RawValue: data.ScsiStartStopCycleCounter.AccumulatedStartStopCycles})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "LoadUnloadCycles", RawValue: data.ScsiStartStopCycleCounter.AccumulatedLoadUnloadCycles})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "StartStopSpecified", RawValue: data.ScsiStartStopCycleCounter.SpecifiedCycleCountOverDeviceLifetime})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "LoadUnloadSpecified", RawValue: data.ScsiStartStopCycleCounter.SpecifiedLoadUnloadCountOverDeviceLifetime})
+
+	readStats := data.ScsiErrorCounterLog.Read
+	writeStats := data.ScsiErrorCounterLog.Write
+	verifyStats := data.ScsiErrorCounterLog.Verify
+
+	attributes = append(attributes, &smart.SmartAttribute{Name: "ReadTotalErrorsCorrected", RawValue: readStats.TotalErrorsCorrected})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "ReadTotalUncorrectedErrors", RawValue: readStats.TotalUncorrectedErrors})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "ReadCorrectionAlgorithmInvocations", RawValue: readStats.CorrectionAlgorithmInvocations})
+	if val := parseScsiGigabytesProcessed(readStats.GigabytesProcessed); val >= 0 {
+		attributes = append(attributes, &smart.SmartAttribute{Name: "ReadGigabytesProcessed", RawValue: uint64(val)})
+	}
+	attributes = append(attributes, &smart.SmartAttribute{Name: "WriteTotalErrorsCorrected", RawValue: writeStats.TotalErrorsCorrected})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "WriteTotalUncorrectedErrors", RawValue: writeStats.TotalUncorrectedErrors})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "WriteCorrectionAlgorithmInvocations", RawValue: writeStats.CorrectionAlgorithmInvocations})
+	if val := parseScsiGigabytesProcessed(writeStats.GigabytesProcessed); val >= 0 {
+		attributes = append(attributes, &smart.SmartAttribute{Name: "WriteGigabytesProcessed", RawValue: uint64(val)})
+	}
+	attributes = append(attributes, &smart.SmartAttribute{Name: "VerifyTotalErrorsCorrected", RawValue: verifyStats.TotalErrorsCorrected})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "VerifyTotalUncorrectedErrors", RawValue: verifyStats.TotalUncorrectedErrors})
+	attributes = append(attributes, &smart.SmartAttribute{Name: "VerifyCorrectionAlgorithmInvocations", RawValue: verifyStats.CorrectionAlgorithmInvocations})
+	if val := parseScsiGigabytesProcessed(verifyStats.GigabytesProcessed); val >= 0 {
+		attributes = append(attributes, &smart.SmartAttribute{Name: "VerifyGigabytesProcessed", RawValue: uint64(val)})
+	}
+
+	smartData.Attributes = attributes
+	sm.SmartDataMap[keyName] = smartData
+
+	return true, data.Smartctl.ExitStatus
+}
+
+func parseScsiGigabytesProcessed(value string) int64 {
+	if value == "" {
+		return -1
+	}
+	normalized := strings.ReplaceAll(value, ",", "")
+	parsed, err := strconv.ParseInt(normalized, 10, 64)
+	if err != nil {
+		return -1
+	}
+	return parsed
+}
+
+// parseSmartForNvme parses the output of smartctl --all -j /dev/nvmeX and updates the SmartDataMap
+// Returns hasValidData and exitStatus
+func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
+	data := &smart.SmartInfoForNvme{}
+
+	if err := json.Unmarshal(output, &data); err != nil {
+		return false, 0
+	}
+
+	if data.SerialNumber == "" {
+		slog.Debug("no serial number", "device", data.Device.Name)
+		return false, data.Smartctl.ExitStatus
+	}
+
+	// Skip virtual devices (e.g., Kubernetes PVCs, QEMU, VirtualBox, etc.)
+	if sm.isVirtualDeviceNvme(data) {
+		slog.Debug("skipping smart", "device", data.Device.Name, "model", data.ModelName)
+		return false, data.Smartctl.ExitStatus
+	}
+
+	sm.Lock()
+	defer sm.Unlock()
+
+	keyName := data.SerialNumber
+
+	// if device does not exist in SmartDataMap, initialize it
+	if _, ok := sm.SmartDataMap[keyName]; !ok {
+		sm.SmartDataMap[keyName] = &smart.SmartData{}
+	}
+
+	// update SmartData
+	smartData := sm.SmartDataMap[keyName]
+	smartData.ModelName = data.ModelName
+	smartData.SerialNumber = data.SerialNumber
+	smartData.FirmwareVersion = data.FirmwareVersion
+	smartData.Capacity = data.UserCapacity.Bytes
+	smartData.Temperature = data.NVMeSmartHealthInformationLog.Temperature
+	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
+	smartData.DiskName = data.Device.Name
+	smartData.DiskType = data.Device.Type
+
+	// nvme attributes does not follow the same format as ata attributes,
+	// so we manually map each field to SmartAttributes
+	log := data.NVMeSmartHealthInformationLog
+	smartData.Attributes = []*smart.SmartAttribute{
+		{Name: "CriticalWarning", RawValue: uint64(log.CriticalWarning)},
+		{Name: "Temperature", RawValue: uint64(log.Temperature)},
+		{Name: "AvailableSpare", RawValue: uint64(log.AvailableSpare)},
+		{Name: "AvailableSpareThreshold", RawValue: uint64(log.AvailableSpareThreshold)},
+		{Name: "PercentageUsed", RawValue: uint64(log.PercentageUsed)},
+		{Name: "DataUnitsRead", RawValue: log.DataUnitsRead},
+		{Name: "DataUnitsWritten", RawValue: log.DataUnitsWritten},
+		{Name: "HostReads", RawValue: uint64(log.HostReads)},
+		{Name: "HostWrites", RawValue: uint64(log.HostWrites)},
+		{Name: "ControllerBusyTime", RawValue: uint64(log.ControllerBusyTime)},
+		{Name: "PowerCycles", RawValue: uint64(log.PowerCycles)},
+		{Name: "PowerOnHours", RawValue: uint64(log.PowerOnHours)},
+		{Name: "UnsafeShutdowns", RawValue: uint64(log.UnsafeShutdowns)},
+		{Name: "MediaErrors", RawValue: uint64(log.MediaErrors)},
+		{Name: "NumErrLogEntries", RawValue: uint64(log.NumErrLogEntries)},
+		{Name: "WarningTempTime", RawValue: uint64(log.WarningTempTime)},
+		{Name: "CriticalCompTime", RawValue: uint64(log.CriticalCompTime)},
+	}
+
+	sm.SmartDataMap[keyName] = smartData
+
+	return true, data.Smartctl.ExitStatus
+}
+
+// detectSmartctl checks if smartctl is installed, returns an error if not
+func (sm *SmartManager) detectSmartctl() (string, error) {
+	isWindows := runtime.GOOS == "windows"
+
+	// Load embedded smartctl.exe for Windows amd64 builds.
+	if isWindows && runtime.GOARCH == "amd64" {
+		if path, err := ensureEmbeddedSmartctl(); err == nil {
+			return path, nil
+		}
+	}
+
+	if path, err := exec.LookPath("smartctl"); err == nil {
+		return path, nil
+	}
+	locations := []string{}
+	if isWindows {
+		locations = append(locations,
+			"C:\\Program Files\\smartmontools\\bin\\smartctl.exe",
+		)
+	} else {
+		locations = append(locations, "/opt/homebrew/bin/smartctl")
+	}
+	for _, location := range locations {
+		if _, err := os.Stat(location); err == nil {
+			return location, nil
+		}
+	}
+	return "", errors.New("smartctl not found")
+}
+
+// NewSmartManager creates and initializes a new SmartManager
+func NewSmartManager() (*SmartManager, error) {
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+	path, err := sm.detectSmartctl()
+	if err != nil {
+		slog.Debug(err.Error())
+		return nil, err
+	}
+	slog.Debug("smartctl", "path", path)
+	sm.binPath = path
+	return sm, nil
+}

agent/smart_nonwindows.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package agent
+
+import "errors"
+
+func ensureEmbeddedSmartctl() (string, error) {
+	return "", errors.ErrUnsupported
+}

agent/smart_test.go

@@ -0,0 +1,590 @@
+//go:build testing
+// +build testing
+
+package agent
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseSmartForScsi(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "scsi.json")
+	data, err := os.ReadFile(fixturePath)
+	if err != nil {
+		t.Fatalf("failed reading fixture: %v", err)
+	}
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	hasData, exitStatus := sm.parseSmartForScsi(data)
+	if !hasData {
+		t.Fatalf("expected SCSI data to parse successfully")
+	}
+	if exitStatus != 0 {
+		t.Fatalf("expected exit status 0, got %d", exitStatus)
+	}
+
+	deviceData, ok := sm.SmartDataMap["9YHSDH9B"]
+	if !ok {
+		t.Fatalf("expected smart data entry for serial 9YHSDH9B")
+	}
+
+	assert.Equal(t, deviceData.ModelName, "YADRO WUH721414AL4204")
+	assert.Equal(t, deviceData.SerialNumber, "9YHSDH9B")
+	assert.Equal(t, deviceData.FirmwareVersion, "C240")
+	assert.Equal(t, deviceData.DiskName, "/dev/sde")
+	assert.Equal(t, deviceData.DiskType, "scsi")
+	assert.EqualValues(t, deviceData.Temperature, 34)
+	assert.Equal(t, deviceData.SmartStatus, "PASSED")
+	assert.EqualValues(t, deviceData.Capacity, 14000519643136)
+
+	if len(deviceData.Attributes) == 0 {
+		t.Fatalf("expected attributes to be populated")
+	}
+
+	assertAttrValue(t, deviceData.Attributes, "PowerOnHours", 458)
+	assertAttrValue(t, deviceData.Attributes, "PowerOnMinutes", 25)
+	assertAttrValue(t, deviceData.Attributes, "GrownDefectList", 0)
+	assertAttrValue(t, deviceData.Attributes, "StartStopCycles", 2)
+	assertAttrValue(t, deviceData.Attributes, "LoadUnloadCycles", 418)
+	assertAttrValue(t, deviceData.Attributes, "ReadGigabytesProcessed", 3641)
+	assertAttrValue(t, deviceData.Attributes, "WriteGigabytesProcessed", 2124590)
+	assertAttrValue(t, deviceData.Attributes, "VerifyGigabytesProcessed", 0)
+}
+
+func TestParseSmartForSata(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "sda.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	hasData, exitStatus := sm.parseSmartForSata(data)
+	require.True(t, hasData)
+	assert.Equal(t, 64, exitStatus)
+
+	deviceData, ok := sm.SmartDataMap["9C40918040082"]
+	require.True(t, ok, "expected smart data entry for serial 9C40918040082")
+
+	assert.Equal(t, "P3-2TB", deviceData.ModelName)
+	assert.Equal(t, "X0104A0", deviceData.FirmwareVersion)
+	assert.Equal(t, "/dev/sda", deviceData.DiskName)
+	assert.Equal(t, "sat", deviceData.DiskType)
+	assert.Equal(t, uint8(31), deviceData.Temperature)
+	assert.Equal(t, "PASSED", deviceData.SmartStatus)
+	assert.Equal(t, uint64(2048408248320), deviceData.Capacity)
+	if assert.NotEmpty(t, deviceData.Attributes) {
+		assertAttrValue(t, deviceData.Attributes, "Temperature_Celsius", 31)
+	}
+}
+
+func TestParseSmartForSataParentheticalRawValue(t *testing.T) {
+	jsonPayload := []byte(`{
+		"smartctl": {"exit_status": 0},
+		"device": {"name": "/dev/sdz", "type": "sat"},
+		"model_name": "Example",
+		"serial_number": "PARENTHESES123",
+		"firmware_version": "1.0",
+		"user_capacity": {"bytes": 1024},
+		"smart_status": {"passed": true},
+		"temperature": {"current": 25},
+		"ata_smart_attributes": {
+			"table": [
+				{
+					"id": 9,
+					"name": "Power_On_Hours",
+					"value": 93,
+					"worst": 55,
+					"thresh": 0,
+					"when_failed": "",
+                    "raw": {
+                        "value": 57891864217128,
+                        "string": "39925 (212 206 0)"
+                    }
+				}
+			]
+		}
+	}`)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+
+	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
+	require.True(t, hasData)
+	assert.Equal(t, 0, exitStatus)
+
+	data, ok := sm.SmartDataMap["PARENTHESES123"]
+	require.True(t, ok)
+	require.Len(t, data.Attributes, 1)
+
+	attr := data.Attributes[0]
+	assert.Equal(t, uint64(39925), attr.RawValue)
+	assert.Equal(t, "39925 (212 206 0)", attr.RawString)
+}
+
+func TestParseSmartForNvme(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "nvme0.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	hasData, exitStatus := sm.parseSmartForNvme(data)
+	require.True(t, hasData)
+	assert.Equal(t, 0, exitStatus)
+
+	deviceData, ok := sm.SmartDataMap["2024031600129"]
+	require.True(t, ok, "expected smart data entry for serial 2024031600129")
+
+	assert.Equal(t, "PELADN 512GB", deviceData.ModelName)
+	assert.Equal(t, "VC2S038E", deviceData.FirmwareVersion)
+	assert.Equal(t, "/dev/nvme0", deviceData.DiskName)
+	assert.Equal(t, "nvme", deviceData.DiskType)
+	assert.Equal(t, uint8(61), deviceData.Temperature)
+	assert.Equal(t, "PASSED", deviceData.SmartStatus)
+	assert.Equal(t, uint64(512110190592), deviceData.Capacity)
+	if assert.NotEmpty(t, deviceData.Attributes) {
+		assertAttrValue(t, deviceData.Attributes, "PercentageUsed", 0)
+		assertAttrValue(t, deviceData.Attributes, "DataUnitsWritten", 16040567)
+	}
+}
+
+func TestHasDataForDevice(t *testing.T) {
+	sm := &SmartManager{
+		SmartDataMap: map[string]*smart.SmartData{
+			"serial-1": {DiskName: "/dev/sda"},
+			"serial-2": nil,
+		},
+	}
+
+	assert.True(t, sm.hasDataForDevice("/dev/sda"))
+	assert.False(t, sm.hasDataForDevice("/dev/sdb"))
+}
+
+func TestDevicesSnapshotReturnsCopy(t *testing.T) {
+	originalDevice := &DeviceInfo{Name: "/dev/sda"}
+	sm := &SmartManager{
+		SmartDevices: []*DeviceInfo{
+			originalDevice,
+			{Name: "/dev/sdb"},
+		},
+	}
+
+	snapshot := sm.devicesSnapshot()
+	require.Len(t, snapshot, 2)
+
+	sm.SmartDevices[0] = &DeviceInfo{Name: "/dev/sdz"}
+	assert.Equal(t, "/dev/sda", snapshot[0].Name)
+
+	snapshot[1] = &DeviceInfo{Name: "/dev/nvme0"}
+	assert.Equal(t, "/dev/sdb", sm.SmartDevices[1].Name)
+
+	sm.SmartDevices = append(sm.SmartDevices, &DeviceInfo{Name: "/dev/nvme1"})
+	assert.Len(t, snapshot, 2)
+}
+
+func TestScanDevicesWithEnvOverride(t *testing.T) {
+	t.Setenv("SMART_DEVICES", "/dev/sda:sat, /dev/nvme0:nvme")
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	err := sm.ScanDevices(true)
+	require.NoError(t, err)
+
+	require.Len(t, sm.SmartDevices, 2)
+	assert.Equal(t, "/dev/sda", sm.SmartDevices[0].Name)
+	assert.Equal(t, "sat", sm.SmartDevices[0].Type)
+	assert.Equal(t, "/dev/nvme0", sm.SmartDevices[1].Name)
+	assert.Equal(t, "nvme", sm.SmartDevices[1].Type)
+}
+
+func TestScanDevicesWithEnvOverrideInvalid(t *testing.T) {
+	t.Setenv("SMART_DEVICES", ":sat")
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	err := sm.ScanDevices(true)
+	require.Error(t, err)
+}
+
+func TestScanDevicesWithEnvOverrideEmpty(t *testing.T) {
+	t.Setenv("SMART_DEVICES", "   ")
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	err := sm.ScanDevices(true)
+	assert.ErrorIs(t, err, errNoValidSmartData)
+	assert.Empty(t, sm.SmartDevices)
+}
+
+func TestSmartctlArgsWithoutType(t *testing.T) {
+	device := &DeviceInfo{Name: "/dev/sda"}
+
+	sm := &SmartManager{}
+
+	args := sm.smartctlArgs(device, true)
+	assert.Equal(t, []string{"-a", "--json=c", "-n", "standby", "/dev/sda"}, args)
+}
+
+func TestSmartctlArgs(t *testing.T) {
+	sm := &SmartManager{}
+
+	sataDevice := &DeviceInfo{Name: "/dev/sda", Type: "sat"}
+	assert.Equal(t,
+		[]string{"-d", "sat", "-a", "--json=c", "-n", "standby", "/dev/sda"},
+		sm.smartctlArgs(sataDevice, true),
+	)
+
+	assert.Equal(t,
+		[]string{"-d", "sat", "-a", "--json=c", "/dev/sda"},
+		sm.smartctlArgs(sataDevice, false),
+	)
+
+	assert.Equal(t,
+		[]string{"-a", "--json=c", "-n", "standby"},
+		sm.smartctlArgs(nil, true),
+	)
+}
+
+func TestResolveRefreshError(t *testing.T) {
+	scanErr := errors.New("scan failed")
+	collectErr := errors.New("collect failed")
+
+	tests := []struct {
+		name        string
+		devices     []*DeviceInfo
+		data        map[string]*smart.SmartData
+		scanErr     error
+		collectErr  error
+		expectedErr error
+		expectNoErr bool
+	}{
+		{
+			name:        "no devices returns scan error",
+			devices:     nil,
+			data:        make(map[string]*smart.SmartData),
+			scanErr:     scanErr,
+			expectedErr: scanErr,
+		},
+		{
+			name:        "has data ignores errors",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        map[string]*smart.SmartData{"serial": {}},
+			scanErr:     scanErr,
+			collectErr:  collectErr,
+			expectNoErr: true,
+		},
+		{
+			name:        "collect error preferred",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        make(map[string]*smart.SmartData),
+			collectErr:  collectErr,
+			expectedErr: collectErr,
+		},
+		{
+			name:        "scan error returned when no data",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        make(map[string]*smart.SmartData),
+			scanErr:     scanErr,
+			expectedErr: scanErr,
+		},
+		{
+			name:        "no errors returns sentinel",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        make(map[string]*smart.SmartData),
+			expectedErr: errNoValidSmartData,
+		},
+		{
+			name:        "no devices collect error",
+			devices:     nil,
+			data:        make(map[string]*smart.SmartData),
+			collectErr:  collectErr,
+			expectedErr: collectErr,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sm := &SmartManager{
+				SmartDevices: tt.devices,
+				SmartDataMap: tt.data,
+			}
+
+			err := sm.resolveRefreshError(tt.scanErr, tt.collectErr)
+			if tt.expectNoErr {
+				assert.NoError(t, err)
+				return
+			}
+
+			if tt.expectedErr == nil {
+				assert.NoError(t, err)
+			} else {
+				assert.Equal(t, tt.expectedErr, err)
+			}
+		})
+	}
+}
+
+func TestParseScan(t *testing.T) {
+	sm := &SmartManager{
+		SmartDataMap: map[string]*smart.SmartData{
+			"serial-active": {DiskName: "/dev/sda"},
+			"serial-stale":  {DiskName: "/dev/sdb"},
+		},
+	}
+
+	scanJSON := []byte(`{
+        "devices": [
+            {"name": "/dev/sda", "type": "sat", "info_name": "/dev/sda [SAT]", "protocol": "ATA"},
+            {"name": "/dev/nvme0", "type": "nvme", "info_name": "/dev/nvme0", "protocol": "NVMe"}
+        ]
+    }`)
+
+	devices, hasData := sm.parseScan(scanJSON)
+	assert.True(t, hasData)
+
+	sm.updateSmartDevices(devices)
+
+	require.Len(t, sm.SmartDevices, 2)
+	assert.Equal(t, "/dev/sda", sm.SmartDevices[0].Name)
+	assert.Equal(t, "sat", sm.SmartDevices[0].Type)
+	assert.Equal(t, "/dev/nvme0", sm.SmartDevices[1].Name)
+	assert.Equal(t, "nvme", sm.SmartDevices[1].Type)
+
+	_, activeExists := sm.SmartDataMap["serial-active"]
+	assert.True(t, activeExists, "active smart data should be preserved when device path remains")
+
+	_, staleExists := sm.SmartDataMap["serial-stale"]
+	assert.False(t, staleExists, "stale smart data entry should be removed when device path disappears")
+}
+
+func TestMergeDeviceListsPrefersConfigured(t *testing.T) {
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat", InfoName: "scan-info", Protocol: "ATA"},
+		{Name: "/dev/nvme0", Type: "nvme"},
+	}
+
+	configured := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat-override"},
+		{Name: "/dev/sdb", Type: "sat"},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, configured)
+	require.Len(t, merged, 3)
+
+	byName := make(map[string]*DeviceInfo, len(merged))
+	for _, dev := range merged {
+		byName[dev.Name] = dev
+	}
+
+	require.Contains(t, byName, "/dev/sda")
+	assert.Equal(t, "sat-override", byName["/dev/sda"].Type, "configured type should override scanned type")
+	assert.Equal(t, "scan-info", byName["/dev/sda"].InfoName, "scan metadata should be preserved when config does not provide it")
+
+	require.Contains(t, byName, "/dev/nvme0")
+	assert.Equal(t, "nvme", byName["/dev/nvme0"].Type)
+
+	require.Contains(t, byName, "/dev/sdb")
+	assert.Equal(t, "sat", byName["/dev/sdb"].Type)
+}
+
+func TestMergeDeviceListsPreservesVerification(t *testing.T) {
+	existing := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat+megaraid", parserType: "sat", typeVerified: true},
+	}
+
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "nvme"},
+	}
+
+	merged := mergeDeviceLists(existing, scanned, nil)
+	require.Len(t, merged, 1)
+
+	device := merged[0]
+	assert.True(t, device.typeVerified)
+	assert.Equal(t, "sat", device.parserType)
+	assert.Equal(t, "sat+megaraid", device.Type)
+}
+
+func TestMergeDeviceListsUpdatesTypeWhenUnverified(t *testing.T) {
+	existing := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat", parserType: "sat", typeVerified: false},
+	}
+
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "nvme"},
+	}
+
+	merged := mergeDeviceLists(existing, scanned, nil)
+	require.Len(t, merged, 1)
+
+	device := merged[0]
+	assert.False(t, device.typeVerified)
+	assert.Equal(t, "nvme", device.Type)
+	assert.Equal(t, "", device.parserType)
+}
+
+func TestParseSmartOutputMarksVerified(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "nvme0.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	device := &DeviceInfo{Name: "/dev/nvme0"}
+
+	require.True(t, sm.parseSmartOutput(device, data))
+	assert.Equal(t, "nvme", device.Type)
+	assert.Equal(t, "nvme", device.parserType)
+	assert.True(t, device.typeVerified)
+}
+
+func TestParseSmartOutputKeepsCustomType(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "sda.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	device := &DeviceInfo{Name: "/dev/sda", Type: "sat+megaraid"}
+
+	require.True(t, sm.parseSmartOutput(device, data))
+	assert.Equal(t, "sat+megaraid", device.Type)
+	assert.Equal(t, "sat", device.parserType)
+	assert.True(t, device.typeVerified)
+}
+
+func TestParseSmartOutputResetsVerificationOnFailure(t *testing.T) {
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	device := &DeviceInfo{Name: "/dev/sda", Type: "sat", parserType: "sat", typeVerified: true}
+
+	assert.False(t, sm.parseSmartOutput(device, []byte("not json")))
+	assert.False(t, device.typeVerified)
+	assert.Equal(t, "sat", device.parserType)
+}
+
+func assertAttrValue(t *testing.T, attributes []*smart.SmartAttribute, name string, expected uint64) {
+	t.Helper()
+	attr := findAttr(attributes, name)
+	if attr == nil {
+		t.Fatalf("expected attribute %s to be present", name)
+	}
+	if attr.RawValue != expected {
+		t.Fatalf("unexpected attribute %s value: got %d, want %d", name, attr.RawValue, expected)
+	}
+}
+
+func findAttr(attributes []*smart.SmartAttribute, name string) *smart.SmartAttribute {
+	for _, attr := range attributes {
+		if attr != nil && attr.Name == name {
+			return attr
+		}
+	}
+	return nil
+}
+
+func TestIsVirtualDevice(t *testing.T) {
+	sm := &SmartManager{}
+
+	tests := []struct {
+		name     string
+		vendor   string
+		product  string
+		model    string
+		expected bool
+	}{
+		{"regular drive", "SEAGATE", "ST1000DM003", "ST1000DM003-1CH162", false},
+		{"qemu virtual", "QEMU", "QEMU HARDDISK", "QEMU HARDDISK", true},
+		{"virtualbox virtual", "VBOX", "HARDDISK", "VBOX HARDDISK", true},
+		{"vmware virtual", "VMWARE", "Virtual disk", "VMWARE Virtual disk", true},
+		{"virtual in model", "ATA", "VIRTUAL", "VIRTUAL DISK", true},
+		{"iet virtual", "IET", "VIRTUAL-DISK", "VIRTUAL-DISK", true},
+		{"hyper-v virtual", "MSFT", "VIRTUAL HD", "VIRTUAL HD", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data := &smart.SmartInfoForSata{
+				ScsiVendor:  tt.vendor,
+				ScsiProduct: tt.product,
+				ModelName:   tt.model,
+			}
+			result := sm.isVirtualDevice(data)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsVirtualDeviceNvme(t *testing.T) {
+	sm := &SmartManager{}
+
+	tests := []struct {
+		name     string
+		model    string
+		expected bool
+	}{
+		{"regular nvme", "Samsung SSD 970 EVO Plus 1TB", false},
+		{"qemu virtual", "QEMU NVMe Ctrl", true},
+		{"virtualbox virtual", "VBOX NVMe", true},
+		{"vmware virtual", "VMWARE NVMe", true},
+		{"virtual in model", "Virtual NVMe Device", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data := &smart.SmartInfoForNvme{
+				ModelName: tt.model,
+			}
+			result := sm.isVirtualDeviceNvme(data)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsVirtualDeviceScsi(t *testing.T) {
+	sm := &SmartManager{}
+
+	tests := []struct {
+		name     string
+		vendor   string
+		product  string
+		model    string
+		expected bool
+	}{
+		{"regular scsi", "SEAGATE", "ST1000DM003", "ST1000DM003-1CH162", false},
+		{"qemu virtual", "QEMU", "QEMU HARDDISK", "QEMU HARDDISK", true},
+		{"virtualbox virtual", "VBOX", "HARDDISK", "VBOX HARDDISK", true},
+		{"vmware virtual", "VMWARE", "Virtual disk", "VMWARE Virtual disk", true},
+		{"virtual in model", "ATA", "VIRTUAL", "VIRTUAL DISK", true},
+		{"iet virtual", "IET", "VIRTUAL-DISK", "VIRTUAL-DISK", true},
+		{"hyper-v virtual", "MSFT", "VIRTUAL HD", "VIRTUAL HD", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data := &smart.SmartInfoForScsi{
+				ScsiVendor:    tt.vendor,
+				ScsiProduct:   tt.product,
+				ScsiModelName: tt.model,
+			}
+			result := sm.isVirtualDeviceScsi(data)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}

agent/smart_windows.go

@@ -0,0 +1,40 @@
+//go:build windows
+
+package agent
+
+import (
+	_ "embed"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+)
+
+//go:embed smartmontools/smartctl.exe
+var embeddedSmartctl []byte
+
+var (
+	smartctlOnce sync.Once
+	smartctlPath string
+	smartctlErr  error
+)
+
+func ensureEmbeddedSmartctl() (string, error) {
+	smartctlOnce.Do(func() {
+		destDir := filepath.Join(os.TempDir(), "beszel", "smartmontools")
+		if err := os.MkdirAll(destDir, 0o755); err != nil {
+			smartctlErr = fmt.Errorf("failed to create smartctl directory: %w", err)
+			return
+		}
+
+		destPath := filepath.Join(destDir, "smartctl.exe")
+		if err := os.WriteFile(destPath, embeddedSmartctl, 0o755); err != nil {
+			smartctlErr = fmt.Errorf("failed to write embedded smartctl: %w", err)
+			return
+		}
+
+		smartctlPath = destPath
+	})
+
+	return smartctlPath, smartctlErr
+}

agent/system.go

@@ -0,0 +1,241 @@
+package agent
+
+import (
+	"bufio"
+	"fmt"
+	"log/slog"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/agent/battery"
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/shirou/gopsutil/v4/cpu"
+	"github.com/shirou/gopsutil/v4/host"
+	"github.com/shirou/gopsutil/v4/load"
+	"github.com/shirou/gopsutil/v4/mem"
+)
+
+// prevDisk stores previous per-device disk counters for a given cache interval
+type prevDisk struct {
+	readBytes  uint64
+	writeBytes uint64
+	at         time.Time
+}
+
+// Sets initial / non-changing values about the host system
+func (a *Agent) initializeSystemInfo() {
+	a.systemInfo.AgentVersion = beszel.Version
+	a.systemInfo.Hostname, _ = os.Hostname()
+
+	platform, _, version, _ := host.PlatformInformation()
+
+	if platform == "darwin" {
+		a.systemInfo.KernelVersion = version
+		a.systemInfo.Os = system.Darwin
+	} else if strings.Contains(platform, "indows") {
+		a.systemInfo.KernelVersion = fmt.Sprintf("%s %s", strings.Replace(platform, "Microsoft ", "", 1), version)
+		a.systemInfo.Os = system.Windows
+	} else if platform == "freebsd" {
+		a.systemInfo.Os = system.Freebsd
+		a.systemInfo.KernelVersion = version
+	} else {
+		a.systemInfo.Os = system.Linux
+	}
+
+	if a.systemInfo.KernelVersion == "" {
+		a.systemInfo.KernelVersion, _ = host.KernelVersion()
+	}
+
+	// cpu model
+	if info, err := cpu.Info(); err == nil && len(info) > 0 {
+		a.systemInfo.CpuModel = info[0].ModelName
+	}
+	// cores / threads
+	a.systemInfo.Cores, _ = cpu.Counts(false)
+	if threads, err := cpu.Counts(true); err == nil {
+		if threads > 0 && threads < a.systemInfo.Cores {
+			// in lxc logical cores reflects container limits, so use that as cores if lower
+			a.systemInfo.Cores = threads
+		} else {
+			a.systemInfo.Threads = threads
+		}
+	}
+
+	// zfs
+	if _, err := getARCSize(); err != nil {
+		slog.Debug("Not monitoring ZFS ARC", "err", err)
+	} else {
+		a.zfs = true
+	}
+}
+
+// Returns current info, stats about the host system
+func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
+	var systemStats system.Stats
+
+	// battery
+	if batteryPercent, batteryState, err := battery.GetBatteryStats(); err == nil {
+		systemStats.Battery[0] = batteryPercent
+		systemStats.Battery[1] = batteryState
+	}
+
+	// cpu metrics
+	cpuMetrics, err := getCpuMetrics(cacheTimeMs)
+	if err == nil {
+		systemStats.Cpu = twoDecimals(cpuMetrics.Total)
+		systemStats.CpuBreakdown = []float64{
+			twoDecimals(cpuMetrics.User),
+			twoDecimals(cpuMetrics.System),
+			twoDecimals(cpuMetrics.Iowait),
+			twoDecimals(cpuMetrics.Steal),
+			twoDecimals(cpuMetrics.Idle),
+		}
+	} else {
+		slog.Error("Error getting cpu metrics", "err", err)
+	}
+
+	// per-core cpu usage
+	if perCoreUsage, err := getPerCoreCpuUsage(cacheTimeMs); err == nil {
+		systemStats.CpuCoresUsage = perCoreUsage
+	}
+
+	// load average
+	if avgstat, err := load.Avg(); err == nil {
+		systemStats.LoadAvg[0] = avgstat.Load1
+		systemStats.LoadAvg[1] = avgstat.Load5
+		systemStats.LoadAvg[2] = avgstat.Load15
+		slog.Debug("Load average", "5m", avgstat.Load5, "15m", avgstat.Load15)
+	} else {
+		slog.Error("Error getting load average", "err", err)
+	}
+
+	// memory
+	if v, err := mem.VirtualMemory(); err == nil {
+		// swap
+		systemStats.Swap = bytesToGigabytes(v.SwapTotal)
+		systemStats.SwapUsed = bytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
+		// cache + buffers value for default mem calculation
+		// note: gopsutil automatically adds SReclaimable to v.Cached
+		cacheBuff := v.Cached + v.Buffers - v.Shared
+		if cacheBuff <= 0 {
+			cacheBuff = max(v.Total-v.Free-v.Used, 0)
+		}
+		// htop memory calculation overrides (likely outdated as of mid 2025)
+		if a.memCalc == "htop" {
+			// cacheBuff = v.Cached + v.Buffers - v.Shared
+			v.Used = v.Total - (v.Free + cacheBuff)
+			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+		}
+		// if a.memCalc == "legacy" {
+		// 	v.Used = v.Total - v.Free - v.Buffers - v.Cached
+		// 	cacheBuff = v.Total - v.Free - v.Used
+		// 	v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+		// }
+		// subtract ZFS ARC size from used memory and add as its own category
+		if a.zfs {
+			if arcSize, _ := getARCSize(); arcSize > 0 && arcSize < v.Used {
+				v.Used = v.Used - arcSize
+				v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+				systemStats.MemZfsArc = bytesToGigabytes(arcSize)
+			}
+		}
+		systemStats.Mem = bytesToGigabytes(v.Total)
+		systemStats.MemBuffCache = bytesToGigabytes(cacheBuff)
+		systemStats.MemUsed = bytesToGigabytes(v.Used)
+		systemStats.MemPct = twoDecimals(v.UsedPercent)
+	}
+
+	// disk usage
+	a.updateDiskUsage(&systemStats)
+
+	// disk i/o (cache-aware per interval)
+	a.updateDiskIo(cacheTimeMs, &systemStats)
+
+	// network stats (per cache interval)
+	a.updateNetworkStats(cacheTimeMs, &systemStats)
+
+	// temperatures
+	// TODO: maybe refactor to methods on systemStats
+	a.updateTemperatures(&systemStats)
+
+	// GPU data
+	if a.gpuManager != nil {
+		// reset high gpu percent
+		a.systemInfo.GpuPct = 0
+		// get current GPU data
+		if gpuData := a.gpuManager.GetCurrentData(cacheTimeMs); len(gpuData) > 0 {
+			systemStats.GPUData = gpuData
+
+			// add temperatures
+			if systemStats.Temperatures == nil {
+				systemStats.Temperatures = make(map[string]float64, len(gpuData))
+			}
+			highestTemp := 0.0
+			for _, gpu := range gpuData {
+				if gpu.Temperature > 0 {
+					systemStats.Temperatures[gpu.Name] = gpu.Temperature
+					if a.sensorConfig.primarySensor == gpu.Name {
+						a.systemInfo.DashboardTemp = gpu.Temperature
+					}
+					if gpu.Temperature > highestTemp {
+						highestTemp = gpu.Temperature
+					}
+				}
+				// update high gpu percent for dashboard
+				a.systemInfo.GpuPct = max(a.systemInfo.GpuPct, gpu.Usage)
+			}
+			// use highest temp for dashboard temp if dashboard temp is unset
+			if a.systemInfo.DashboardTemp == 0 {
+				a.systemInfo.DashboardTemp = highestTemp
+			}
+		}
+	}
+
+	// update base system info
+	a.systemInfo.ConnectionType = a.connectionManager.ConnectionType
+	a.systemInfo.Cpu = systemStats.Cpu
+	a.systemInfo.LoadAvg = systemStats.LoadAvg
+	// TODO: remove these in future release in favor of load avg array
+	a.systemInfo.LoadAvg1 = systemStats.LoadAvg[0]
+	a.systemInfo.LoadAvg5 = systemStats.LoadAvg[1]
+	a.systemInfo.LoadAvg15 = systemStats.LoadAvg[2]
+	a.systemInfo.MemPct = systemStats.MemPct
+	a.systemInfo.DiskPct = systemStats.DiskPct
+	a.systemInfo.Uptime, _ = host.Uptime()
+	// TODO: in future release, remove MB bandwidth values in favor of bytes
+	a.systemInfo.Bandwidth = twoDecimals(systemStats.NetworkSent + systemStats.NetworkRecv)
+	a.systemInfo.BandwidthBytes = systemStats.Bandwidth[0] + systemStats.Bandwidth[1]
+	slog.Debug("sysinfo", "data", a.systemInfo)
+
+	return systemStats
+}
+
+// Returns the size of the ZFS ARC memory cache in bytes
+func getARCSize() (uint64, error) {
+	file, err := os.Open("/proc/spl/kstat/zfs/arcstats")
+	if err != nil {
+		return 0, err
+	}
+	defer file.Close()
+
+	// Scan the lines
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if strings.HasPrefix(line, "size") {
+			// Example line: size 4 15032385536
+			fields := strings.Fields(line)
+			if len(fields) < 3 {
+				return 0, err
+			}
+			// Return the size as uint64
+			return strconv.ParseUint(fields[2], 10, 64)
+		}
+	}
+
+	return 0, fmt.Errorf("failed to parse size field")
+}

agent/systemd.go

@@ -0,0 +1,229 @@
+//go:build linux
+
+package agent
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"maps"
+	"math"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/coreos/go-systemd/v22/dbus"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+)
+
+var (
+	errNoActiveTime = errors.New("no active time")
+)
+
+// systemdManager manages the collection of systemd service statistics.
+type systemdManager struct {
+	sync.Mutex
+	serviceStatsMap map[string]*systemd.Service
+	isRunning       bool
+	hasFreshStats   bool
+}
+
+// newSystemdManager creates a new systemdManager.
+func newSystemdManager() (*systemdManager, error) {
+	conn, err := dbus.NewSystemConnectionContext(context.Background())
+	if err != nil {
+		slog.Warn("Error connecting to systemd", "err", err, "ref", "https://beszel.dev/guide/systemd")
+		return nil, err
+	}
+
+	manager := &systemdManager{
+		serviceStatsMap: make(map[string]*systemd.Service),
+	}
+
+	manager.startWorker(conn)
+
+	return manager, nil
+}
+
+func (sm *systemdManager) startWorker(conn *dbus.Conn) {
+	if sm.isRunning {
+		return
+	}
+	sm.isRunning = true
+	// prime the service stats map with the current services
+	_ = sm.getServiceStats(conn, true)
+	// update the services every 10 minutes
+	go func() {
+		for {
+			time.Sleep(time.Minute * 10)
+			_ = sm.getServiceStats(nil, true)
+		}
+	}()
+}
+
+// getServiceStats collects statistics for all running systemd services.
+func (sm *systemdManager) getServiceStats(conn *dbus.Conn, refresh bool) []*systemd.Service {
+	// start := time.Now()
+	// defer func() {
+	// 	slog.Info("systemdManager.getServiceStats", "duration", time.Since(start))
+	// }()
+
+	var services []*systemd.Service
+	var err error
+
+	if !refresh {
+		// return nil
+		sm.Lock()
+		defer sm.Unlock()
+		for _, service := range sm.serviceStatsMap {
+			services = append(services, service)
+		}
+		sm.hasFreshStats = false
+		return services
+	}
+
+	if conn == nil || !conn.Connected() {
+		conn, err = dbus.NewSystemConnectionContext(context.Background())
+		if err != nil {
+			return nil
+		}
+		defer conn.Close()
+	}
+
+	units, err := conn.ListUnitsByPatternsContext(context.Background(), []string{"loaded"}, []string{"*.service"})
+	if err != nil {
+		slog.Error("Error listing systemd service units", "err", err)
+		return nil
+	}
+
+	for _, unit := range units {
+		service, err := sm.updateServiceStats(conn, unit)
+		if err != nil {
+			continue
+		}
+		services = append(services, service)
+	}
+	sm.hasFreshStats = true
+	return services
+}
+
+// updateServiceStats updates the statistics for a single systemd service.
+func (sm *systemdManager) updateServiceStats(conn *dbus.Conn, unit dbus.UnitStatus) (*systemd.Service, error) {
+	sm.Lock()
+	defer sm.Unlock()
+
+	ctx := context.Background()
+
+	// if service has never been active (no active since time), skip it
+	if activeEnterTsProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Unit", "ActiveEnterTimestamp"); err == nil {
+		if ts, ok := activeEnterTsProp.Value.Value().(uint64); !ok || ts == 0 || ts == math.MaxUint64 {
+			return nil, errNoActiveTime
+		}
+	} else {
+		return nil, err
+	}
+
+	service, serviceExists := sm.serviceStatsMap[unit.Name]
+	if !serviceExists {
+		service = &systemd.Service{Name: unescapeServiceName(strings.TrimSuffix(unit.Name, ".service"))}
+		sm.serviceStatsMap[unit.Name] = service
+	}
+
+	memPeak := service.MemPeak
+	if memPeakProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Service", "MemoryPeak"); err == nil {
+		// If memPeak is MaxUint64 the api is saying it's not available
+		if v, ok := memPeakProp.Value.Value().(uint64); ok && v != math.MaxUint64 {
+			memPeak = v
+		}
+	}
+
+	var memUsage uint64
+	if memProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Service", "MemoryCurrent"); err == nil {
+		// If memUsage is MaxUint64 the api is saying it's not available
+		if v, ok := memProp.Value.Value().(uint64); ok && v != math.MaxUint64 {
+			memUsage = v
+		}
+	}
+
+	service.State = systemd.ParseServiceStatus(unit.ActiveState)
+	service.Sub = systemd.ParseServiceSubState(unit.SubState)
+
+	// some systems always return 0 for mem peak, so we should update the peak if the current usage is greater
+	if memUsage > memPeak {
+		memPeak = memUsage
+	}
+
+	var cpuUsage uint64
+	if cpuProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Service", "CPUUsageNSec"); err == nil {
+		if v, ok := cpuProp.Value.Value().(uint64); ok {
+			cpuUsage = v
+		}
+	}
+
+	service.Mem = memUsage
+	if memPeak > service.MemPeak {
+		service.MemPeak = memPeak
+	}
+	service.UpdateCPUPercent(cpuUsage)
+
+	return service, nil
+}
+
+// getServiceDetails collects extended information for a specific systemd service.
+func (sm *systemdManager) getServiceDetails(serviceName string) (systemd.ServiceDetails, error) {
+	conn, err := dbus.NewSystemConnectionContext(context.Background())
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	unitName := serviceName
+	if !strings.HasSuffix(unitName, ".service") {
+		unitName += ".service"
+	}
+
+	ctx := context.Background()
+	props, err := conn.GetUnitPropertiesContext(ctx, unitName)
+	if err != nil {
+		return nil, err
+	}
+
+	// Start with all unit properties
+	details := make(systemd.ServiceDetails)
+	maps.Copy(details, props)
+
+	// // Add service-specific properties
+	servicePropNames := []string{
+		"MainPID", "ExecMainPID", "TasksCurrent", "TasksMax",
+		"MemoryCurrent", "MemoryPeak", "MemoryLimit", "CPUUsageNSec",
+		"NRestarts", "ExecMainStartTimestampRealtime", "Result",
+	}
+
+	for _, propName := range servicePropNames {
+		if variant, err := conn.GetUnitTypePropertyContext(ctx, unitName, "Service", propName); err == nil {
+			value := variant.Value.Value()
+			// Check if the value is MaxUint64, which indicates unlimited/infinite
+			if uint64Value, ok := value.(uint64); ok && uint64Value == math.MaxUint64 {
+				// Set to nil to indicate unlimited - frontend will handle this appropriately
+				details[propName] = nil
+			} else {
+				details[propName] = value
+			}
+		}
+	}
+
+	return details, nil
+}
+
+// unescapeServiceName unescapes systemd service names that contain C-style escape sequences like \x2d
+func unescapeServiceName(name string) string {
+	if !strings.Contains(name, "\\x") {
+		return name
+	}
+	unescaped, err := strconv.Unquote("\"" + name + "\"")
+	if err != nil {
+		return name
+	}
+	return unescaped
+}

agent/systemd_nonlinux.go

@@ -0,0 +1,28 @@
+//go:build !linux
+
+package agent
+
+import (
+	"errors"
+
+	"github.com/henrygd/beszel/internal/entities/systemd"
+)
+
+// systemdManager manages the collection of systemd service statistics.
+type systemdManager struct {
+	hasFreshStats bool
+}
+
+// newSystemdManager creates a new systemdManager.
+func newSystemdManager() (*systemdManager, error) {
+	return &systemdManager{}, nil
+}
+
+// getServiceStats returns nil for non-linux systems.
+func (sm *systemdManager) getServiceStats(conn any, refresh bool) []*systemd.Service {
+	return nil
+}
+
+func (sm *systemdManager) getServiceDetails(string) (systemd.ServiceDetails, error) {
+	return nil, errors.New("systemd manager unavailable")
+}

agent/systemd_nonlinux_test.go

@@ -0,0 +1,53 @@
+//go:build !linux && testing
+
+package agent
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewSystemdManager(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+	assert.NotNil(t, manager)
+}
+
+func TestSystemdManagerGetServiceStats(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+
+	// Test with refresh = true
+	result := manager.getServiceStats(true)
+	assert.Nil(t, result)
+
+	// Test with refresh = false
+	result = manager.getServiceStats(false)
+	assert.Nil(t, result)
+}
+
+func TestSystemdManagerGetServiceDetails(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+
+	result, err := manager.getServiceDetails("any-service")
+	assert.Error(t, err)
+	assert.Equal(t, "systemd manager unavailable", err.Error())
+	assert.Nil(t, result)
+
+	// Test with empty service name
+	result, err = manager.getServiceDetails("")
+	assert.Error(t, err)
+	assert.Equal(t, "systemd manager unavailable", err.Error())
+	assert.Nil(t, result)
+}
+
+func TestSystemdManagerFields(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+
+	// The non-linux manager should be a simple struct with no special fields
+	// We can't test private fields directly, but we can test the methods work
+	assert.NotNil(t, manager)
+}

agent/systemd_test.go

@@ -0,0 +1,48 @@
+//go:build linux && testing
+
+package agent
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUnescapeServiceName(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"nginx.service", "nginx.service"},                                     // No escaping needed
+		{"test\\x2dwith\\x2ddashes.service", "test-with-dashes.service"},       // \x2d is dash
+		{"service\\x20with\\x20spaces.service", "service with spaces.service"}, // \x20 is space
+		{"mixed\\x2dand\\x2dnormal", "mixed-and-normal"},                       // Mixed escaped and normal
+		{"no-escape-here", "no-escape-here"},                                   // No escape sequences
+		{"", ""},                                                               // Empty string
+		{"\\x2d\\x2d", "--"},                                                   // Multiple escapes
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			result := unescapeServiceName(test.input)
+			assert.Equal(t, test.expected, result)
+		})
+	}
+}
+
+func TestUnescapeServiceNameInvalid(t *testing.T) {
+	// Test invalid escape sequences - should return original string
+	invalidInputs := []string{
+		"invalid\\x",   // Incomplete escape
+		"invalid\\xZZ", // Invalid hex
+		"invalid\\x2",  // Incomplete hex
+		"invalid\\xyz", // Not a valid escape
+	}
+
+	for _, input := range invalidInputs {
+		t.Run(input, func(t *testing.T) {
+			result := unescapeServiceName(input)
+			assert.Equal(t, input, result, "Invalid escape sequences should return original string")
+		})
+	}
+}

agent/test-data/container.json

@@ -0,0 +1,24 @@
+{
+	"cpu_stats": {
+		"cpu_usage": {
+			"total_usage": 312055276000
+		},
+		"system_cpu_usage": 1366399830000000
+	},
+	"memory_stats": {
+		"usage": 507400192,
+		"stats": {
+			"inactive_file": 165130240
+		}
+	},
+	"networks": {
+		"eth0": {
+			"tx_bytes": 20376558,
+			"rx_bytes": 537029455
+		},
+		"eth1": {
+			"tx_bytes": 2003766,
+			"rx_bytes": 6241
+		}
+	}
+}

agent/test-data/container2.json

@@ -0,0 +1,24 @@
+{
+	"cpu_stats": {
+		"cpu_usage": {
+			"total_usage": 314891801000
+		},
+		"system_cpu_usage": 1368474900000000
+	},
+	"memory_stats": {
+		"usage": 507400192,
+		"stats": {
+			"inactive_file": 165130240
+		}
+	},
+	"networks": {
+		"eth0": {
+			"tx_bytes": 20376558,
+			"rx_bytes": 537029455
+		},
+		"eth1": {
+			"tx_bytes": 2003766,
+			"rx_bytes": 6241
+		}
+	}
+}

agent/test-data/smart/nvme0.json

@@ -0,0 +1,272 @@
+{
+  "json_format_version": [
+    1,
+    0
+  ],
+  "smartctl": {
+    "version": [
+      7,
+      5
+    ],
+    "pre_release": false,
+    "svn_revision": "5714",
+    "platform_info": "x86_64-linux-6.17.1-2-cachyos",
+    "build_info": "(local build)",
+    "argv": [
+      "smartctl",
+      "-aj",
+      "/dev/nvme0"
+    ],
+    "exit_status": 0
+  },
+  "local_time": {
+    "time_t": 1761507494,
+    "asctime": "Sun Oct 26 15:38:14 2025 EDT"
+  },
+  "device": {
+    "name": "/dev/nvme0",
+    "info_name": "/dev/nvme0",
+    "type": "nvme",
+    "protocol": "NVMe"
+  },
+  "model_name": "PELADN 512GB",
+  "serial_number": "2024031600129",
+  "firmware_version": "VC2S038E",
+  "nvme_pci_vendor": {
+    "id": 4332,
+    "subsystem_id": 4332
+  },
+  "nvme_ieee_oui_identifier": 57420,
+  "nvme_controller_id": 1,
+  "nvme_version": {
+    "string": "1.4",
+    "value": 66560
+  },
+  "nvme_number_of_namespaces": 1,
+  "nvme_namespaces": [
+    {
+      "id": 1,
+      "size": {
+        "blocks": 1000215216,
+        "bytes": 512110190592
+      },
+      "capacity": {
+        "blocks": 1000215216,
+        "bytes": 512110190592
+      },
+      "utilization": {
+        "blocks": 1000215216,
+        "bytes": 512110190592
+      },
+      "formatted_lba_size": 512,
+      "eui64": {
+        "oui": 57420,
+        "ext_id": 112094110470
+      },
+      "features": {
+        "value": 0,
+        "thin_provisioning": false,
+        "na_fields": false,
+        "dealloc_or_unwritten_block_error": false,
+        "uid_reuse": false,
+        "np_fields": false,
+        "other": 0
+      },
+      "lba_formats": [
+        {
+          "formatted": true,
+          "data_bytes": 512,
+          "metadata_bytes": 0,
+          "relative_performance": 0
+        }
+      ]
+    }
+  ],
+  "user_capacity": {
+    "blocks": 1000215216,
+    "bytes": 512110190592
+  },
+  "logical_block_size": 512,
+  "smart_support": {
+    "available": true,
+    "enabled": true
+  },
+  "nvme_firmware_update_capabilities": {
+    "value": 2,
+    "slots": 1,
+    "first_slot_is_read_only": false,
+    "activiation_without_reset": false,
+    "multiple_update_detection": false,
+    "other": 0
+  },
+  "nvme_optional_admin_commands": {
+    "value": 23,
+    "security_send_receive": true,
+    "format_nvm": true,
+    "firmware_download": true,
+    "namespace_management": false,
+    "self_test": true,
+    "directives": false,
+    "mi_send_receive": false,
+    "virtualization_management": false,
+    "doorbell_buffer_config": false,
+    "get_lba_status": false,
+    "command_and_feature_lockdown": false,
+    "other": 0
+  },
+  "nvme_optional_nvm_commands": {
+    "value": 94,
+    "compare": false,
+    "write_uncorrectable": true,
+    "dataset_management": true,
+    "write_zeroes": true,
+    "save_select_feature_nonzero": true,
+    "reservations": false,
+    "timestamp": true,
+    "verify": false,
+    "copy": false,
+    "other": 0
+  },
+  "nvme_log_page_attributes": {
+    "value": 2,
+    "smart_health_per_namespace": false,
+    "commands_effects_log": true,
+    "extended_get_log_page_cmd": false,
+    "telemetry_log": false,
+    "persistent_event_log": false,
+    "supported_log_pages_log": false,
+    "telemetry_data_area_4": false,
+    "other": 0
+  },
+  "nvme_maximum_data_transfer_pages": 32,
+  "nvme_composite_temperature_threshold": {
+    "warning": 100,
+    "critical": 110
+  },
+  "temperature": {
+    "op_limit_max": 100,
+    "critical_limit_max": 110,
+    "current": 61
+  },
+  "nvme_power_states": [
+    {
+      "non_operational_state": false,
+      "relative_read_latency": 0,
+      "relative_read_throughput": 0,
+      "relative_write_latency": 0,
+      "relative_write_throughput": 0,
+      "entry_latency_us": 230000,
+      "exit_latency_us": 50000,
+      "max_power": {
+        "value": 800,
+        "scale": 2,
+        "units_per_watt": 100
+      }
+    },
+    {
+      "non_operational_state": false,
+      "relative_read_latency": 1,
+      "relative_read_throughput": 1,
+      "relative_write_latency": 1,
+      "relative_write_throughput": 1,
+      "entry_latency_us": 4000,
+      "exit_latency_us": 50000,
+      "max_power": {
+        "value": 400,
+        "scale": 2,
+        "units_per_watt": 100
+      }
+    },
+    {
+      "non_operational_state": false,
+      "relative_read_latency": 2,
+      "relative_read_throughput": 2,
+      "relative_write_latency": 2,
+      "relative_write_throughput": 2,
+      "entry_latency_us": 4000,
+      "exit_latency_us": 250000,
+      "max_power": {
+        "value": 300,
+        "scale": 2,
+        "units_per_watt": 100
+      }
+    },
+    {
+      "non_operational_state": true,
+      "relative_read_latency": 3,
+      "relative_read_throughput": 3,
+      "relative_write_latency": 3,
+      "relative_write_throughput": 3,
+      "entry_latency_us": 5000,
+      "exit_latency_us": 10000,
+      "max_power": {
+        "value": 300,
+        "scale": 1,
+        "units_per_watt": 10000
+      }
+    },
+    {
+      "non_operational_state": true,
+      "relative_read_latency": 4,
+      "relative_read_throughput": 4,
+      "relative_write_latency": 4,
+      "relative_write_throughput": 4,
+      "entry_latency_us": 54000,
+      "exit_latency_us": 45000,
+      "max_power": {
+        "value": 50,
+        "scale": 1,
+        "units_per_watt": 10000
+      }
+    }
+  ],
+  "smart_status": {
+    "passed": true,
+    "nvme": {
+      "value": 0
+    }
+  },
+  "nvme_smart_health_information_log": {
+    "nsid": -1,
+    "critical_warning": 0,
+    "temperature": 61,
+    "available_spare": 100,
+    "available_spare_threshold": 32,
+    "percentage_used": 0,
+    "data_units_read": 6573104,
+    "data_units_written": 16040567,
+    "host_reads": 63241130,
+    "host_writes": 253050006,
+    "controller_busy_time": 0,
+    "power_cycles": 430,
+    "power_on_hours": 4399,
+    "unsafe_shutdowns": 44,
+    "media_errors": 0,
+    "num_err_log_entries": 0,
+    "warning_temp_time": 0,
+    "critical_comp_time": 0
+  },
+  "spare_available": {
+    "current_percent": 100,
+    "threshold_percent": 32
+  },
+  "endurance_used": {
+    "current_percent": 0
+  },
+  "power_cycle_count": 430,
+  "power_on_time": {
+    "hours": 4399
+  },
+  "nvme_error_information_log": {
+    "size": 8,
+    "read": 8,
+    "unread": 0
+  },
+  "nvme_self_test_log": {
+    "nsid": -1,
+    "current_self_test_operation": {
+      "value": 0,
+      "string": "No self-test in progress"
+    }
+  }
+}

agent/test-data/smart/scan.json

@@ -0,0 +1,36 @@
+{
+  "json_format_version": [
+    1,
+    0
+  ],
+  "smartctl": {
+    "version": [
+      7,
+      5
+    ],
+    "pre_release": false,
+    "svn_revision": "5714",
+    "platform_info": "x86_64-linux-6.17.1-2-cachyos",
+    "build_info": "(local build)",
+    "argv": [
+      "smartctl",
+      "--scan",
+      "-j"
+    ],
+    "exit_status": 0
+  },
+  "devices": [
+    {
+      "name": "/dev/sda",
+      "info_name": "/dev/sda [SAT]",
+      "type": "sat",
+      "protocol": "ATA"
+    },
+    {
+      "name": "/dev/nvme0",
+      "info_name": "/dev/nvme0",
+      "type": "nvme",
+      "protocol": "NVMe"
+    }
+  ]
+}

agent/test-data/smart/scsi.json

@@ -0,0 +1,125 @@
+{
+   "json_format_version": [
+      1,
+      0
+   ],
+   "smartctl": {
+      "version": [
+         7,
+         3
+      ],
+      "svn_revision": "5338",
+      "platform_info": "x86_64-linux-6.12.43+deb12-amd64",
+      "build_info": "(local build)",
+      "argv": [
+         "smartctl",
+         "-aj",
+         "/dev/sde"
+      ],
+      "exit_status": 0
+   },
+   "local_time": {
+      "time_t": 1761502142,
+      "asctime": "Sun Oct 21 21:09:02 2025 MSK"
+   },
+   "device": {
+      "name": "/dev/sde",
+      "info_name": "/dev/sde",
+      "type": "scsi",
+      "protocol": "SCSI"
+   },
+   "scsi_vendor": "YADRO",
+   "scsi_product": "WUH721414AL4204",
+   "scsi_model_name": "YADRO WUH721414AL4204",
+   "scsi_revision": "C240",
+   "scsi_version": "SPC-4",
+   "user_capacity": {
+      "blocks": 3418095616,
+      "bytes": 14000519643136
+   },
+   "logical_block_size": 4096,
+   "scsi_lb_provisioning": {
+      "name": "fully provisioned",
+      "value": 0,
+      "management_enabled": {
+         "name": "LBPME",
+         "value": 0
+      },
+      "read_zeros": {
+         "name": "LBPRZ",
+         "value": 0
+      }
+   },
+   "rotation_rate": 7200,
+   "form_factor": {
+      "scsi_value": 2,
+      "name": "3.5 inches"
+   },
+   "logical_unit_id": "0x5000cca29063dc00",
+   "serial_number": "9YHSDH9B",
+   "device_type": {
+      "scsi_terminology": "Peripheral Device Type [PDT]",
+      "scsi_value": 0,
+      "name": "disk"
+   },
+   "scsi_transport_protocol": {
+      "name": "SAS (SPL-4)",
+      "value": 6
+   },
+   "smart_support": {
+      "available": true,
+      "enabled": true
+   },
+   "temperature_warning": {
+      "enabled": true
+   },
+   "smart_status": {
+      "passed": true
+   },
+   "temperature": {
+      "current": 34,
+      "drive_trip": 85
+   },
+   "power_on_time": {
+      "hours": 458,
+      "minutes": 25
+   },
+   "scsi_start_stop_cycle_counter": {
+      "year_of_manufacture": "2022",
+      "week_of_manufacture": "41",
+      "specified_cycle_count_over_device_lifetime": 50000,
+      "accumulated_start_stop_cycles": 2,
+      "specified_load_unload_count_over_device_lifetime": 600000,
+      "accumulated_load_unload_cycles": 418
+   },
+   "scsi_grown_defect_list": 0,
+   "scsi_error_counter_log": {
+      "read": {
+         "errors_corrected_by_eccfast": 0,
+         "errors_corrected_by_eccdelayed": 0,
+         "errors_corrected_by_rereads_rewrites": 0,
+         "total_errors_corrected": 0,
+         "correction_algorithm_invocations": 346,
+         "gigabytes_processed": "3,641",
+         "total_uncorrected_errors": 0
+      },
+      "write": {
+         "errors_corrected_by_eccfast": 0,
+         "errors_corrected_by_eccdelayed": 0,
+         "errors_corrected_by_rereads_rewrites": 0,
+         "total_errors_corrected": 0,
+         "correction_algorithm_invocations": 4052,
+         "gigabytes_processed": "2124,590",
+         "total_uncorrected_errors": 0
+      },
+      "verify": {
+         "errors_corrected_by_eccfast": 0,
+         "errors_corrected_by_eccdelayed": 0,
+         "errors_corrected_by_rereads_rewrites": 0,
+         "total_errors_corrected": 0,
+         "correction_algorithm_invocations": 223,
+         "gigabytes_processed": "0,000",
+         "total_uncorrected_errors": 0
+      }
+   }
+}

agent/tools/fetchsmartctl/main.go

@@ -0,0 +1,130 @@
+package main
+
+import (
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/hex"
+	"flag"
+	"fmt"
+	"hash"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// Download smartctl.exe from the given URL and save it to the given destination.
+// This is used to embed smartctl.exe in the Windows build.
+
+func main() {
+	url := flag.String("url", "", "URL to download smartctl.exe from (required)")
+	out := flag.String("out", "", "Destination path for smartctl.exe (required)")
+	sha := flag.String("sha", "", "Optional SHA1/SHA256 checksum for integrity validation")
+	force := flag.Bool("force", false, "Force re-download even if destination exists")
+	flag.Parse()
+
+	if *url == "" || *out == "" {
+		fatalf("-url and -out are required")
+	}
+
+	if !*force {
+		if info, err := os.Stat(*out); err == nil && info.Size() > 0 {
+			fmt.Println("smartctl.exe already present, skipping download")
+			return
+		}
+	}
+
+	if err := downloadFile(*url, *out, *sha); err != nil {
+		fatalf("download failed: %v", err)
+	}
+}
+
+func downloadFile(url, dest, shaHex string) error {
+	// Prepare destination
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return fmt.Errorf("create dir: %w", err)
+	}
+
+	// HTTP client
+	client := &http.Client{Timeout: 60 * time.Second}
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return fmt.Errorf("new request: %w", err)
+	}
+	req.Header.Set("User-Agent", "beszel-fetchsmartctl/1.0")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("http get: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("unexpected HTTP status: %s", resp.Status)
+	}
+
+	tmp := dest + ".tmp"
+	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)
+	if err != nil {
+		return fmt.Errorf("open tmp: %w", err)
+	}
+
+	// Determine hash algorithm based on length (SHA1=40, SHA256=64)
+	var hasher hash.Hash
+	if shaHex := strings.TrimSpace(shaHex); shaHex != "" {
+		cleanSha := strings.ToLower(strings.ReplaceAll(shaHex, " ", ""))
+		switch len(cleanSha) {
+		case 40:
+			hasher = sha1.New()
+		case 64:
+			hasher = sha256.New()
+		default:
+			f.Close()
+			os.Remove(tmp)
+			return fmt.Errorf("unsupported hash length: %d (expected 40 for SHA1 or 64 for SHA256)", len(cleanSha))
+		}
+	}
+
+	var mw io.Writer = f
+	if hasher != nil {
+		mw = io.MultiWriter(f, hasher)
+	}
+	if _, err := io.Copy(mw, resp.Body); err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return fmt.Errorf("write tmp: %w", err)
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmp)
+		return fmt.Errorf("close tmp: %w", err)
+	}
+
+	if hasher != nil && shaHex != "" {
+		cleanSha := strings.ToLower(strings.ReplaceAll(strings.TrimSpace(shaHex), " ", ""))
+		got := strings.ToLower(hex.EncodeToString(hasher.Sum(nil)))
+		if got != cleanSha {
+			os.Remove(tmp)
+			return fmt.Errorf("hash mismatch: got %s want %s", got, cleanSha)
+		}
+	}
+
+	// Make executable and move into place
+	if err := os.Chmod(tmp, 0o755); err != nil {
+		os.Remove(tmp)
+		return fmt.Errorf("chmod: %w", err)
+	}
+	if err := os.Rename(tmp, dest); err != nil {
+		os.Remove(tmp)
+		return fmt.Errorf("rename: %w", err)
+	}
+
+	fmt.Println("smartctl.exe downloaded to", dest)
+	return nil
+}
+
+func fatalf(format string, a ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", a...)
+	os.Exit(1)
+}

agent/update.go

@@ -0,0 +1,168 @@
+package agent
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+
+	"github.com/henrygd/beszel/internal/ghupdate"
+)
+
+// restarter knows how to restart the beszel-agent service.
+type restarter interface {
+	Restart() error
+}
+
+type systemdRestarter struct{ cmd string }
+
+func (s *systemdRestarter) Restart() error {
+	// Only restart if the service is active
+	if err := exec.Command(s.cmd, "is-active", "beszel-agent.service").Run(); err != nil {
+		return nil
+	}
+	ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel-agent.service via systemd…")
+	return exec.Command(s.cmd, "restart", "beszel-agent.service").Run()
+}
+
+type openRCRestarter struct{ cmd string }
+
+func (o *openRCRestarter) Restart() error {
+	if err := exec.Command(o.cmd, "beszel-agent", "status").Run(); err != nil {
+		return nil
+	}
+	ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel-agent via OpenRC…")
+	return exec.Command(o.cmd, "beszel-agent", "restart").Run()
+}
+
+type openWRTRestarter struct{ cmd string }
+
+func (w *openWRTRestarter) Restart() error {
+	// https://openwrt.org/docs/guide-user/base-system/managing_services?s[]=service
+	if err := exec.Command("/etc/init.d/beszel-agent", "running").Run(); err != nil {
+		return nil
+	}
+	ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel-agent via procd…")
+	return exec.Command("/etc/init.d/beszel-agent", "restart").Run()
+}
+
+type freeBSDRestarter struct{ cmd string }
+
+func (f *freeBSDRestarter) Restart() error {
+	if err := exec.Command(f.cmd, "beszel-agent", "status").Run(); err != nil {
+		return nil
+	}
+	ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel-agent via FreeBSD rc…")
+	return exec.Command(f.cmd, "beszel-agent", "restart").Run()
+}
+
+func detectRestarter() restarter {
+	if path, err := exec.LookPath("systemctl"); err == nil {
+		return &systemdRestarter{cmd: path}
+	}
+	if path, err := exec.LookPath("rc-service"); err == nil {
+		return &openRCRestarter{cmd: path}
+	}
+    if path, err := exec.LookPath("procd"); err == nil {
+        return &openWRTRestarter{cmd: path}
+    }
+	if path, err := exec.LookPath("service"); err == nil {
+		if runtime.GOOS == "freebsd" {
+			return &freeBSDRestarter{cmd: path}
+		}
+	}
+	return nil
+}
+
+// Update checks GitHub for a newer release of beszel-agent, applies it,
+// fixes SELinux context if needed, and restarts the service.
+func Update(useMirror bool) error {
+	exePath, _ := os.Executable()
+
+	dataDir, err := getDataDir()
+	if err != nil {
+		dataDir = os.TempDir()
+	}
+	updated, err := ghupdate.Update(ghupdate.Config{
+		ArchiveExecutable: "beszel-agent",
+		DataDir:           dataDir,
+		UseMirror:         useMirror,
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+	if !updated {
+		return nil
+	}
+
+	// make sure the file is executable
+	if err := os.Chmod(exePath, 0755); err != nil {
+		ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: failed to set executable permissions: %v", err)
+	}
+	// set ownership to beszel:beszel if possible
+	if chownPath, err := exec.LookPath("chown"); err == nil {
+		if err := exec.Command(chownPath, "beszel:beszel", exePath).Run(); err != nil {
+			ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: failed to set file ownership: %v", err)
+		}
+	}
+
+	// 6) Fix SELinux context if necessary
+	if err := handleSELinuxContext(exePath); err != nil {
+		ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: SELinux context handling: %v", err)
+	}
+
+	// 7) Restart service if running under a recognised init system
+	if r := detectRestarter(); r != nil {
+		if err := r.Restart(); err != nil {
+			ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: failed to restart service: %v", err)
+			ghupdate.ColorPrint(ghupdate.ColorYellow, "Please restart the service manually.")
+		} else {
+			ghupdate.ColorPrint(ghupdate.ColorGreen, "Service restarted successfully")
+		}
+	} else {
+		ghupdate.ColorPrint(ghupdate.ColorYellow, "No supported init system detected; please restart manually if needed.")
+	}
+
+	return nil
+}
+
+// handleSELinuxContext restores or applies the correct SELinux label to the binary.
+func handleSELinuxContext(path string) error {
+	out, err := exec.Command("getenforce").Output()
+	if err != nil {
+		// SELinux not enabled or getenforce not available
+		return nil
+	}
+	state := strings.TrimSpace(string(out))
+	if state == "Disabled" {
+		return nil
+	}
+
+	ghupdate.ColorPrint(ghupdate.ColorYellow, "SELinux is enabled; applying context…")
+	var errs []string
+
+	// Try persistent context via semanage+restorecon
+	if semanagePath, err := exec.LookPath("semanage"); err == nil {
+		if err := exec.Command(semanagePath, "fcontext", "-a", "-t", "bin_t", path).Run(); err != nil {
+			errs = append(errs, "semanage fcontext failed: "+err.Error())
+		} else if restoreconPath, err := exec.LookPath("restorecon"); err == nil {
+			if err := exec.Command(restoreconPath, "-v", path).Run(); err != nil {
+				errs = append(errs, "restorecon failed: "+err.Error())
+			}
+		}
+	}
+
+	// Fallback to temporary context via chcon
+	if chconPath, err := exec.LookPath("chcon"); err == nil {
+		if err := exec.Command(chconPath, "-t", "bin_t", path).Run(); err != nil {
+			errs = append(errs, "chcon failed: "+err.Error())
+		}
+	}
+
+	if len(errs) > 0 {
+		return fmt.Errorf("SELinux context errors: %s", strings.Join(errs, "; "))
+	}
+	return nil
+}

beszel.go

@@ -0,0 +1,18 @@
+// Package beszel provides core application constants and version information
+// which are used throughout the application.
+package beszel
+
+import "github.com/blang/semver"
+
+const (
+	// Version is the current version of the application.
+	Version = "0.16.0-beta.1"
+	// AppName is the name of the application.
+	AppName = "beszel"
+)
+
+// MinVersionCbor is the minimum supported version for CBOR compatibility.
+var MinVersionCbor = semver.MustParse("0.12.0")
+
+// MinVersionAgentResponse is the minimum supported version for AgentResponse compatibility.
+var MinVersionAgentResponse = semver.MustParse("0.13.0")

beszel/.goreleaser.yml

@@ -1,123 +0,0 @@
-version: 2
-
-project_name: beszel
-
-before:
-  hooks:
-    - go mod tidy
-
-builds:
-  - id: beszel
-    binary: beszel
-    main: cmd/hub/hub.go
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-      - arm
-
-  - id: beszel-agent
-    binary: beszel-agent
-    main: cmd/agent/agent.go
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - darwin
-      - freebsd
-      - windows
-    goarch:
-      - amd64
-      - arm64
-      - arm
-      - mips64
-      - riscv64
-    ignore:
-      - goos: freebsd
-        goarch: arm
-      - goos: windows
-        goarch: arm
-      - goos: darwin
-        goarch: riscv64
-      - goos: windows
-        goarch: riscv64
-
-archives:
-  - id: beszel
-    format: tar.gz
-    builds:
-      - beszel-agent
-    name_template: >-
-      {{ .Binary }}_
-      {{- .Os }}_
-      {{- .Arch }}
-    format_overrides:
-      - goos: windows
-        format: zip
-
-  - id: beszel-agent
-    format: tar.gz
-    builds:
-      - beszel
-    name_template: >-
-      {{ .Binary }}_
-      {{- .Os }}_
-      {{- .Arch }}
-
-nfpms:
-  - id: beszel-agent
-    package_name: beszel-agent
-    description: |-
-      Agent for Beszel
-      Beszel is a lightweight server monitoring platform that includes Docker
-      statistics, historical data, and alert functions. It has a friendly web
-      interface, simple configuration, and is ready to use out of the box.
-      It supports automatic backup, multi-user, OAuth authentication, and
-      API access.
-    maintainer: henrygd <hank@henrygd.me>
-    section: net
-    builds:
-      - beszel-agent
-    formats:
-      - deb
-    # don't think this is needed with CGO_ENABLED=0
-    # dependencies:
-    #   - libc6
-    contents:
-      - src: ../supplemental/debian/beszel-agent.service
-        dst: lib/systemd/system/beszel-agent.service
-        packager: deb
-      - src: ../supplemental/debian/copyright
-        dst: usr/share/doc/beszel-agent/copyright
-        packager: deb
-      - src: ../supplemental/debian/lintian-overrides
-        dst: usr/share/lintian/overrides/beszel-agent
-        packager: deb
-    scripts:
-      postinstall: ../supplemental/debian/postinstall.sh
-      preremove: ../supplemental/debian/prerm.sh
-      postremove: ../supplemental/debian/postrm.sh
-    deb:
-      predepends:
-        - adduser
-        - debconf
-      scripts:
-        templates: ../supplemental/debian/templates
-        # Currently broken due to a bug in goreleaser
-        # https://github.com/goreleaser/goreleaser/issues/5487
-        #config: ../supplemental/debian/config.sh
-
-release:
-  draft: true
-
-changelog:
-  disable: true
-  sort: asc
-  filters:
-    exclude:
-      - '^docs:'
-      - '^test:'

beszel/Makefile

@@ -1,72 +0,0 @@
-# Default OS/ARCH values
-OS ?= $(shell go env GOOS)
-ARCH ?= $(shell go env GOARCH)
-# Skip building the web UI if true
-SKIP_WEB ?= false
-
-.PHONY: tidy build-agent build-hub build clean lint dev-server dev-agent dev-hub dev generate-locales
-.DEFAULT_GOAL := build
-
-clean:
-	go clean
-	rm -rf ./build
-
-lint:
-	golangci-lint run
-
-test: export GOEXPERIMENT=synctest
-test:
-	go test -tags=testing ./...
-
-tidy:
-	go mod tidy
-
-build-web-ui:
-	@if command -v bun >/dev/null 2>&1; then \
-		bun install --cwd ./site && \
-		bun run --cwd ./site build; \
-	else \
-		npm install --prefix ./site && \
-		npm run --prefix ./site build; \
-	fi
-
-build-agent: tidy
-	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel-agent_$(OS)_$(ARCH) -ldflags "-w -s" beszel/cmd/agent
-
-build-hub: tidy $(if $(filter false,$(SKIP_WEB)),build-web-ui)
-	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel_$(OS)_$(ARCH) -ldflags "-w -s" beszel/cmd/hub
-
-build: build-agent build-hub
-
-generate-locales:
-	@if [ ! -f ./site/src/locales/en/en.ts ]; then \
-		echo "Generating locales..."; \
-		command -v bun >/dev/null 2>&1 && cd ./site && bun install && bun run sync || cd ./site && npm install && npm run sync; \
-	fi
-
-dev-server: generate-locales
-	cd ./site
-	@if command -v bun >/dev/null 2>&1; then \
-		cd ./site && bun run dev; \
-	else \
-		cd ./site && npm run dev; \
-	fi
-
-dev-hub: export ENV=dev
-dev-hub:
-	mkdir -p ./site/dist && touch ./site/dist/index.html
-	@if command -v entr >/dev/null 2>&1; then \
-		find ./cmd/hub/*.go ./internal/{alerts,hub,records,users}/*.go | entr -r -s "cd ./cmd/hub && go run . serve"; \
-	else \
-		cd ./cmd/hub && go run . serve; \
-	fi
-
-dev-agent:
-	@if command -v entr >/dev/null 2>&1; then \
-		find ./cmd/agent/*.go ./internal/agent/*.go | entr -r go run beszel/cmd/agent; \
-	else \
-		go run beszel/cmd/agent; \
-	fi
-
-# KEY="..." make -j dev
-dev: dev-server dev-hub dev-agent

beszel/cmd/agent/agent.go

@@ -1,136 +0,0 @@
-package main
-
-import (
-	"beszel"
-	"beszel/internal/agent"
-	"flag"
-	"fmt"
-	"log"
-	"os"
-	"strings"
-
-	"golang.org/x/crypto/ssh"
-)
-
-// cli options
-type cmdOptions struct {
-	key    string // key is the public key(s) for SSH authentication.
-	listen string // listen is the address or port to listen on.
-}
-
-// parseFlags parses the command line flags and populates the config struct.
-func (opts *cmdOptions) parseFlags() {
-	flag.StringVar(&opts.key, "key", "", "Public key(s) for SSH authentication")
-	flag.StringVar(&opts.listen, "listen", "", "Address or port to listen on")
-
-	flag.Usage = func() {
-		fmt.Printf("Usage: %s [options] [subcommand]\n", os.Args[0])
-		fmt.Println("\nOptions:")
-		flag.PrintDefaults()
-		fmt.Println("\nSubcommands:")
-		fmt.Println("  version      Display the version")
-		fmt.Println("  help         Display this help message")
-		fmt.Println("  update       Update the agent to the latest version")
-	}
-}
-
-// handleSubcommand handles subcommands such as version, help, and update.
-// It returns true if a subcommand was handled, false otherwise.
-func handleSubcommand() bool {
-	if len(os.Args) <= 1 {
-		return false
-	}
-	switch os.Args[1] {
-	case "version", "-v":
-		fmt.Println(beszel.AppName+"-agent", beszel.Version)
-		os.Exit(0)
-	case "help":
-		flag.Usage()
-		os.Exit(0)
-	case "update":
-		agent.Update()
-		os.Exit(0)
-	}
-	return false
-}
-
-// loadPublicKeys loads the public keys from the command line flag, environment variable, or key file.
-func (opts *cmdOptions) loadPublicKeys() ([]ssh.PublicKey, error) {
-	// Try command line flag first
-	if opts.key != "" {
-		return agent.ParseKeys(opts.key)
-	}
-
-	// Try environment variable
-	if key, ok := agent.GetEnv("KEY"); ok && key != "" {
-		return agent.ParseKeys(key)
-	}
-
-	// Try key file
-	keyFile, ok := agent.GetEnv("KEY_FILE")
-	if !ok {
-		return nil, fmt.Errorf("no key provided: must set -key flag, KEY env var, or KEY_FILE env var. Use 'beszel-agent help' for usage")
-	}
-
-	pubKey, err := os.ReadFile(keyFile)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read key file: %w", err)
-	}
-	return agent.ParseKeys(string(pubKey))
-}
-
-// getAddress gets the address to listen on from the command line flag, environment variable, or default value.
-func (opts *cmdOptions) getAddress() string {
-	// Try command line flag first
-	if opts.listen != "" {
-		return opts.listen
-	}
-	// Try environment variables
-	if addr, ok := agent.GetEnv("LISTEN"); ok && addr != "" {
-		return addr
-	}
-	// Legacy PORT environment variable support
-	if port, ok := agent.GetEnv("PORT"); ok && port != "" {
-		return port
-	}
-	return ":45876"
-}
-
-// getNetwork returns the network type to use for the server.
-func (opts *cmdOptions) getNetwork() string {
-	if network, _ := agent.GetEnv("NETWORK"); network != "" {
-		return network
-	}
-	if strings.HasPrefix(opts.listen, "/") {
-		return "unix"
-	}
-	return "tcp"
-}
-
-func main() {
-	var opts cmdOptions
-	opts.parseFlags()
-
-	if handleSubcommand() {
-		return
-	}
-
-	flag.Parse()
-
-	opts.listen = opts.getAddress()
-
-	var serverConfig agent.ServerOptions
-	var err error
-	serverConfig.Keys, err = opts.loadPublicKeys()
-	if err != nil {
-		log.Fatal("Failed to load public keys:", err)
-	}
-
-	serverConfig.Addr = opts.listen
-	serverConfig.Network = opts.getNetwork()
-
-	agent := agent.NewAgent()
-	if err := agent.StartServer(serverConfig); err != nil {
-		log.Fatal("Failed to start server:", err)
-	}
-}

beszel/cmd/hub/hub.go

@@ -1,46 +0,0 @@
-package main
-
-import (
-	"beszel"
-	"beszel/internal/hub"
-	_ "beszel/migrations"
-	"os"
-
-	"github.com/pocketbase/pocketbase"
-	"github.com/pocketbase/pocketbase/plugins/migratecmd"
-	"github.com/spf13/cobra"
-)
-
-func main() {
-	baseApp := getBaseApp()
-	h := hub.NewHub(baseApp)
-	h.BootstrapHub()
-	h.Start()
-}
-
-// getBaseApp creates a new PocketBase app with the default config
-func getBaseApp() *pocketbase.PocketBase {
-	isDev := os.Getenv("ENV") == "dev"
-
-	baseApp := pocketbase.NewWithConfig(pocketbase.Config{
-		DefaultDataDir: beszel.AppName + "_data",
-		DefaultDev:     isDev,
-	})
-	baseApp.RootCmd.Version = beszel.Version
-	baseApp.RootCmd.Use = beszel.AppName
-	baseApp.RootCmd.Short = ""
-	// add update command
-	baseApp.RootCmd.AddCommand(&cobra.Command{
-		Use:   "update",
-		Short: "Update " + beszel.AppName + " to the latest version",
-		Run:   hub.Update,
-	})
-
-	// enable auto creation of migration files when making collection changes in the Admin UI
-	migratecmd.MustRegister(baseApp, baseApp.RootCmd, migratecmd.Config{
-		Automigrate: isDev,
-		Dir:         "../../migrations",
-	})
-
-	return baseApp
-}

beszel/dockerfile_Agent

@@ -1,20 +0,0 @@
-FROM --platform=$BUILDPLATFORM golang:alpine AS builder
-
-WORKDIR /app
-
-COPY go.mod go.sum ./
-# RUN go mod download
-COPY *.go ./
-COPY cmd ./cmd
-COPY internal ./internal
-
-# Build
-ARG TARGETOS TARGETARCH
-RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./cmd/agent
-
-# ? -------------------------
-FROM scratch
-
-COPY --from=builder /agent /agent
-
-ENTRYPOINT ["/agent"]

beszel/go.mod

@@ -1,92 +0,0 @@
-module beszel
-
-go 1.24.0
-
-require (
-	github.com/blang/semver v3.5.1+incompatible
-	github.com/containrrr/shoutrrr v0.8.0
-	github.com/gliderlabs/ssh v0.3.8
-	github.com/goccy/go-json v0.10.5
-	github.com/pocketbase/dbx v1.11.0
-	github.com/pocketbase/pocketbase v0.25.9
-	github.com/rhysd/go-github-selfupdate v1.2.3
-	github.com/shirou/gopsutil/v4 v4.25.2
-	github.com/spf13/cast v1.7.1
-	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.10.0
-	golang.org/x/crypto v0.35.0
-	golang.org/x/exp v0.0.0-20250228200357-dead58393ab7
-	gopkg.in/yaml.v3 v3.0.1
-)
-
-require (
-	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.29.8 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.61 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.64 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.78.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.25.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.29.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.33.16 // indirect
-	github.com/aws/smithy-go v1.22.3 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/disintegration/imaging v1.6.2 // indirect
-	github.com/domodwyer/mailyak/v3 v3.6.2 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.8.2 // indirect
-	github.com/fatih/color v1.18.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
-	github.com/ganigeorgiev/fexpr v0.4.1 // indirect
-	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/google/go-github/v30 v30.1.0 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
-	github.com/inconshreveable/go-update v0.0.0-20160112193335-8152e7eb6ccf // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20250224150550-a661cff19cfb // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
-	github.com/tcnksm/go-gitconfig v0.1.2 // indirect
-	github.com/tklauser/go-sysconf v0.3.14 // indirect
-	github.com/tklauser/numcpus v0.9.0 // indirect
-	github.com/ulikunitz/xz v0.5.12 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.opencensus.io v0.24.0 // indirect
-	gocloud.dev v0.40.0 // indirect
-	golang.org/x/image v0.24.0 // indirect
-	golang.org/x/net v0.35.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
-	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
-	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/api v0.223.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250227231956-55c901821b1e // indirect
-	google.golang.org/grpc v1.70.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
-	modernc.org/libc v1.61.13 // indirect
-	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.8.2 // indirect
-	modernc.org/sqlite v1.35.0 // indirect
-)

beszel/go.sum

@@ -1,394 +0,0 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
-cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
-cloud.google.com/go/auth v0.15.0 h1:Ly0u4aA5vG/fsSsxu98qCQBemXtAtJf+95z9HK+cxps=
-cloud.google.com/go/auth v0.15.0/go.mod h1:WJDGqZ1o9E9wKIL+IwStfyn/+s59zl4Bi+1KQNVXLZ8=
-cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M=
-cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc=
-cloud.google.com/go/compute v1.14.0 h1:hfm2+FfxVmnRlh6LpB7cg1ZNU+5edAHmW679JePztk0=
-cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
-cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
-cloud.google.com/go/iam v1.1.13 h1:7zWBXG9ERbMLrzQBRhFliAV+kjcRToDTgQT3CTwYyv4=
-cloud.google.com/go/iam v1.1.13/go.mod h1:K8mY0uSXwEXS30KrnVb+j54LB/ntfZu1dr+4zFMNbus=
-cloud.google.com/go/storage v1.43.0 h1:CcxnSohZwizt4LCzQHWvBf1/kvtHUn7gk9QERXPyXFs=
-cloud.google.com/go/storage v1.43.0/go.mod h1:ajvxEa7WmZS1PxvKRq4bq0tFT3vMd502JwstCcYv0Q0=
-filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
-filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
-github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
-github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
-github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
-github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
-github.com/aws/aws-sdk-go-v2/config v1.29.8 h1:RpwAfYcV2lr/yRc4lWhUM9JRPQqKgKWmou3LV7UfWP4=
-github.com/aws/aws-sdk-go-v2/config v1.29.8/go.mod h1:t+G7Fq1OcO8cXTPPXzxQSnj/5Xzdc9jAAD3Xrn9/Mgo=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.61 h1:Hd/uX6Wo2iUW1JWII+rmyCD7MMhOe7ALwQXN6sKDd1o=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.61/go.mod h1:L7vaLkwHY1qgW0gG1zG0z/X0sQ5tpIY5iI13+j3qI80=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.64 h1:RTko0AQ0i1vWXDM97DkuW6zskgOxFxm4RqC0kmBJFkE=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.64/go.mod h1:ty968MpOa5CoQ/ALWNB8Gmfoehof2nRHDR/DZDPfimE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.2 h1:t/gZFyrijKuSU0elA5kRngP/oU3mc0I+Dvp8HwRE4c0=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.6.2/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.78.0 h1:EBm8lXevBWe+kK9VOU/IBeOI189WPRwPUc3LvJK9GOs=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.78.0/go.mod h1:4qzsZSzB/KiX2EzDjs9D7A8rI/WGJxZceVJIHqtJjIU=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.0 h1:2U9sF8nKy7UgyEeLiZTRg6ShBS22z8UnYpV6aRFL0is=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.0/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.29.0 h1:wjAdc85cXdQR5uLx5FwWvGIHm4OPJhTyzUHU8craXtE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.29.0/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.16 h1:BHEK2Q/7CMRMCb3nySi/w8UbIcPhKvYP5s1xf8/izn0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.33.16/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
-github.com/aws/smithy-go v1.22.3 h1:Z//5NuZCSW6R4PhQ93hShNbyBbn8BWCmCVCt+Q8Io5k=
-github.com/aws/smithy-go v1.22.3/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
-github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
-github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/containrrr/shoutrrr v0.8.0 h1:mfG2ATzIS7NR2Ec6XL+xyoHzN97H8WPjir8aYzJUSec=
-github.com/containrrr/shoutrrr v0.8.0/go.mod h1:ioyQAyu1LJY6sILuNyKaQaw+9Ttik5QePU8atnAdO2o=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
-github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
-github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
-github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
-github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
-github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
-github.com/ganigeorgiev/fexpr v0.4.1 h1:hpUgbUEEWIZhSDBtf4M9aUNfQQ0BZkGRaMePy7Gcx5k=
-github.com/ganigeorgiev/fexpr v0.4.1/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
-github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
-github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
-github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
-github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
-github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
-github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
-github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v30 v30.1.0 h1:VLDx+UolQICEOKu2m4uAoMti1SxuEBAl7RSEG16L+Oo=
-github.com/google/go-github/v30 v30.1.0/go.mod h1:n8jBpHl45a/rlBUtRJMOG4GhNADUQFEufcolZ95JfU8=
-github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
-github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
-github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
-github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
-github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
-github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/wire v0.6.0 h1:HBkoIh4BdSxoyo9PveV8giw7ZsaBOvzWKfcg/6MrVwI=
-github.com/google/wire v0.6.0/go.mod h1:F4QhpQ9EDIdJ1Mbop/NZBRB+5yrR6qg3BnctaoUk6NA=
-github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
-github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
-github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
-github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/inconshreveable/go-update v0.0.0-20160112193335-8152e7eb6ccf h1:WfD7VjIE6z8dIvMsI4/s+1qr5EL+zoIGev1BQj1eoJ8=
-github.com/inconshreveable/go-update v0.0.0-20160112193335-8152e7eb6ccf/go.mod h1:hyb9oH7vZsitZCiBt0ZvifOrB+qc8PS5IiilCIb87rg=
-github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
-github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jarcoal/httpmock v1.3.0 h1:2RJ8GP0IIaWwcC9Fp2BmVi8Kog3v2Hn7VXM3fTd+nuc=
-github.com/jarcoal/httpmock v1.3.0/go.mod h1:3yb8rc4BI7TCBhFY8ng0gjuLKJNquuDNiPaZjnENuYg=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lufia/plan9stats v0.0.0-20250224150550-a661cff19cfb h1:YU0XAr3+rMpM8fP80KEesn32Qa9qkbquokvuwzWyYuA=
-github.com/lufia/plan9stats v0.0.0-20250224150550-a661cff19cfb/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/onsi/ginkgo v1.6.0 h1:Ix8l273rp3QzYgXSR+c8d1fTG7UPgYkOSELPhiY/YGw=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo/v2 v2.9.2 h1:BA2GMJOtfGAfagzYtrAlufIP0lq6QERkFmHLMLPwFSU=
-github.com/onsi/ginkgo/v2 v2.9.2/go.mod h1:WHcJJG2dIlcCqVfBAwUCrJxSPFb6v4azBwgxeMeDuts=
-github.com/onsi/gomega v1.4.2/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
-github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pocketbase/dbx v1.11.0 h1:LpZezioMfT3K4tLrqA55wWFw1EtH1pM4tzSVa7kgszU=
-github.com/pocketbase/dbx v1.11.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/pocketbase v0.25.9 h1:/PSJcy39vEGv4lsBG4HV0ZFLcFsTdK9oMkJbxVlVJSs=
-github.com/pocketbase/pocketbase v0.25.9/go.mod h1:gOnPr+g/GS+iqKh5XYXycdRWVGhiHY4c1H4TGjU9DDw=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rhysd/go-github-selfupdate v1.2.3 h1:iaa+J202f+Nc+A8zi75uccC8Wg3omaM7HDeimXA22Ag=
-github.com/rhysd/go-github-selfupdate v1.2.3/go.mod h1:mp/N8zj6jFfBQy/XMYoWsmfzxazpPAODuqarmPDe2Rg=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.25.2 h1:NMscG3l2CqtWFS86kj3vP7soOczqrQYIEhO/pMvvQkk=
-github.com/shirou/gopsutil/v4 v4.25.2/go.mod h1:34gBYJzyqCDT11b6bMHP0XCvWeU3J61XRT7a2EmCRTA=
-github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
-github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/tcnksm/go-gitconfig v0.1.2 h1:iiDhRitByXAEyjgBqsKi9QU4o2TNtv9kPP3RgPgXBPw=
-github.com/tcnksm/go-gitconfig v0.1.2/go.mod h1:/8EhP4H7oJZdIPyT+/UIsG87kTzrzM4UsLGSItWYCpE=
-github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
-github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
-github.com/tklauser/numcpus v0.9.0 h1:lmyCHtANi8aRUgkckBgoDk1nHCux3n2cgkJLXdQGPDo=
-github.com/tklauser/numcpus v0.9.0/go.mod h1:SN6Nq1O3VychhC1npsWostA+oW+VOQTxZrS604NSRyI=
-github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
-github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
-github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
-go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 h1:rgMkmiGfix9vFJDcDi1PK8WEQP4FLQwLDfhp5ZLpFeE=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0/go.mod h1:ijPqXp5P6IRRByFVVg9DY8P5HkxkHE5ARIa+86aXPf4=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
-go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
-go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
-go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
-go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
-go.opentelemetry.io/otel/sdk v1.32.0 h1:RNxepc9vK59A8XsgZQouW8ue8Gkb4jpWtJm9ge5lEG4=
-go.opentelemetry.io/otel/sdk v1.32.0/go.mod h1:LqgegDBjKMmb2GC6/PrTnteJG39I8/vJCAP9LlJXEjU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
-go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
-go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
-go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
-gocloud.dev v0.40.0 h1:f8LgP+4WDqOG/RXoUcyLpeIAGOcAbZrZbDQCUee10ng=
-gocloud.dev v0.40.0/go.mod h1:drz+VyYNBvrMTW0KZiBAYEdl8lbNZx+OQ7oQvdrFmSQ=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
-golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20250228200357-dead58393ab7 h1:aWwlzYV971S4BXRS9AmqwDLAD85ouC6X+pocatKY58c=
-golang.org/x/exp v0.0.0-20250228200357-dead58393ab7/go.mod h1:BHOTPb3L19zxehTsLoJXVaTktb06DFgmdW6Wb9s8jqk=
-golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.24.0 h1:AN7zRgVsbvmTfNyqIbbOraYL8mSwcKncEj8ofjgzcMQ=
-golang.org/x/image v0.24.0/go.mod h1:4b/ITuLfqYq1hqZcjofwctIhi7sZh2WaCjvsBNjjya8=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
-golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
-golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
-golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
-golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
-golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
-google.golang.org/api v0.223.0 h1:JUTaWEriXmEy5AhvdMgksGGPEFsYfUKaPEYXd4c3Wvc=
-google.golang.org/api v0.223.0/go.mod h1:C+RS7Z+dDwds2b+zoAk5hN/eSfsiCn0UDrYof/M4d2M=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988 h1:CT2Thj5AuPV9phrYMtzX11k+XkzMGfRAet42PmoTATM=
-google.golang.org/genproto v0.0.0-20240812133136-8ffd90a71988/go.mod h1:7uvplUBj4RjHAxIZ//98LzOvrQ04JBkaixRmCMI29hc=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250227231956-55c901821b1e h1:YA5lmSs3zc/5w+xsRcHqpETkaYyK63ivEPzNTcUUlSA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250227231956-55c901821b1e/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
-google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-modernc.org/cc/v4 v4.24.4 h1:TFkx1s6dCkQpd6dKurBNmpo+G8Zl4Sq/ztJ+2+DEsh0=
-modernc.org/cc/v4 v4.24.4/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.23.16 h1:Z2N+kk38b7SfySC1ZkpGLN2vthNJP1+ZzGZIlH7uBxo=
-modernc.org/ccgo/v4 v4.23.16/go.mod h1:nNma8goMTY7aQZQNTyN9AIoJfxav4nvTnvKThAeMDdo=
-modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
-modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
-modernc.org/gc/v2 v2.6.3 h1:aJVhcqAte49LF+mGveZ5KPlsp4tdGdAOT4sipJXADjw=
-modernc.org/gc/v2 v2.6.3/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/libc v1.61.13 h1:3LRd6ZO1ezsFiX1y+bHd1ipyEHIJKvuprv0sLTBwLW8=
-modernc.org/libc v1.61.13/go.mod h1:8F/uJWL/3nNil0Lgt1Dpz+GgkApWh04N3el3hxJcA6E=
-modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
-modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.8.2 h1:cL9L4bcoAObu4NkxOlKWBWtNHIsnnACGF/TbqQ6sbcI=
-modernc.org/memory v1.8.2/go.mod h1:ZbjSvMO5NQ1A2i3bWeDiVMxIorXwdClKE/0SZ+BMotU=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
-modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
-modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.35.0 h1:yQps4fegMnZFdphtzlfQTCNBWtS0CZv48pRpW3RFHRw=
-modernc.org/sqlite v1.35.0/go.mod h1:9cr2sicr7jIaWTBKQmAxQLfBv9LL0su4ZTEV+utt3ic=
-modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
-modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
-modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
-modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

beszel/internal/agent/agent.go

@@ -1,139 +0,0 @@
-// Package agent handles the agent's SSH server and system stats collection.
-package agent
-
-import (
-	"beszel"
-	"beszel/internal/entities/system"
-	"context"
-	"log/slog"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/shirou/gopsutil/v4/common"
-)
-
-type Agent struct {
-	sync.Mutex                                  // Used to lock agent while collecting data
-	debug            bool                       // true if LOG_LEVEL is set to debug
-	zfs              bool                       // true if system has arcstats
-	memCalc          string                     // Memory calculation formula
-	fsNames          []string                   // List of filesystem device names being monitored
-	fsStats          map[string]*system.FsStats // Keeps track of disk stats for each filesystem
-	netInterfaces    map[string]struct{}        // Stores all valid network interfaces
-	netIoStats       system.NetIoStats          // Keeps track of bandwidth usage
-	dockerManager    *dockerManager             // Manages Docker API requests
-	sensorsContext   context.Context            // Sensors context to override sys location
-	sensorsWhitelist map[string]struct{}        // List of sensors to monitor
-	systemInfo       system.Info                // Host system info
-	gpuManager       *GPUManager                // Manages GPU data
-	cache            *SessionCache              // Cache for system stats based on primary session ID
-}
-
-func NewAgent() *Agent {
-	agent := &Agent{
-		fsStats: make(map[string]*system.FsStats),
-		cache:   NewSessionCache(69 * time.Second),
-	}
-	agent.memCalc, _ = GetEnv("MEM_CALC")
-
-	// Set up slog with a log level determined by the LOG_LEVEL env var
-	if logLevelStr, exists := GetEnv("LOG_LEVEL"); exists {
-		switch strings.ToLower(logLevelStr) {
-		case "debug":
-			agent.debug = true
-			slog.SetLogLoggerLevel(slog.LevelDebug)
-		case "warn":
-			slog.SetLogLoggerLevel(slog.LevelWarn)
-		case "error":
-			slog.SetLogLoggerLevel(slog.LevelError)
-		}
-	}
-
-	slog.Debug(beszel.Version)
-
-	// Set sensors context (allows overriding sys location for sensors)
-	if sysSensors, exists := GetEnv("SYS_SENSORS"); exists {
-		slog.Info("SYS_SENSORS", "path", sysSensors)
-		agent.sensorsContext = context.WithValue(agent.sensorsContext,
-			common.EnvKey, common.EnvMap{common.HostSysEnvKey: sysSensors},
-		)
-	} else {
-		agent.sensorsContext = context.Background()
-	}
-
-	// Set sensors whitelist
-	if sensors, exists := GetEnv("SENSORS"); exists {
-		agent.sensorsWhitelist = make(map[string]struct{})
-		for sensor := range strings.SplitSeq(sensors, ",") {
-			if sensor != "" {
-				agent.sensorsWhitelist[sensor] = struct{}{}
-			}
-		}
-	}
-
-	// initialize system info / docker manager
-	agent.initializeSystemInfo()
-	agent.initializeDiskInfo()
-	agent.initializeNetIoStats()
-	agent.dockerManager = newDockerManager(agent)
-
-	// initialize GPU manager
-	if gm, err := NewGPUManager(); err != nil {
-		slog.Debug("GPU", "err", err)
-	} else {
-		agent.gpuManager = gm
-	}
-
-	// if debugging, print stats
-	if agent.debug {
-		slog.Debug("Stats", "data", agent.gatherStats(""))
-	}
-
-	return agent
-}
-
-// GetEnv retrieves an environment variable with a "BESZEL_AGENT_" prefix, or falls back to the unprefixed key.
-func GetEnv(key string) (value string, exists bool) {
-	if value, exists = os.LookupEnv("BESZEL_AGENT_" + key); exists {
-		return value, exists
-	}
-	// Fallback to the old unprefixed key
-	return os.LookupEnv(key)
-}
-
-func (a *Agent) gatherStats(sessionID string) *system.CombinedData {
-	a.Lock()
-	defer a.Unlock()
-
-	cachedData, ok := a.cache.Get(sessionID)
-	if ok {
-		slog.Debug("Cached stats", "session", sessionID)
-		return cachedData
-	}
-
-	*cachedData = system.CombinedData{
-		Stats: a.getSystemStats(),
-		Info:  a.systemInfo,
-	}
-	slog.Debug("System stats", "data", cachedData)
-
-	if containerStats, err := a.dockerManager.getDockerStats(); err == nil {
-		cachedData.Containers = containerStats
-		slog.Debug("Docker stats", "data", cachedData.Containers)
-	} else {
-		slog.Debug("Docker stats", "err", err)
-	}
-
-	cachedData.Stats.ExtraFs = make(map[string]*system.FsStats)
-	for name, stats := range a.fsStats {
-		if !stats.Root && stats.DiskTotal > 0 {
-			cachedData.Stats.ExtraFs[name] = stats
-		}
-	}
-	slog.Debug("Extra filesystems", "data", cachedData.Stats.ExtraFs)
-
-	a.cache.Set(sessionID, cachedData)
-	return cachedData
-}

beszel/internal/agent/agent_cache.go

@@ -1,36 +0,0 @@
-package agent
-
-import (
-	"beszel/internal/entities/system"
-	"time"
-)
-
-// Not thread safe since we only access from gatherStats which is already locked
-type SessionCache struct {
-	data           *system.CombinedData
-	lastUpdate     time.Time
-	primarySession string
-	leaseTime      time.Duration
-}
-
-func NewSessionCache(leaseTime time.Duration) *SessionCache {
-	return &SessionCache{
-		leaseTime: leaseTime,
-		data:      &system.CombinedData{},
-	}
-}
-
-func (c *SessionCache) Get(sessionID string) (stats *system.CombinedData, isCached bool) {
-	if sessionID != c.primarySession && time.Since(c.lastUpdate) < c.leaseTime {
-		return c.data, true
-	}
-	return c.data, false
-}
-
-func (c *SessionCache) Set(sessionID string, data *system.CombinedData) {
-	if data != nil {
-		*c.data = *data
-	}
-	c.primarySession = sessionID
-	c.lastUpdate = time.Now()
-}

beszel/internal/agent/agent_cache_test.go

@@ -1,85 +0,0 @@
-package agent
-
-import (
-	"beszel/internal/entities/system"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSessionCache_GetSet(t *testing.T) {
-	synctest.Run(func() {
-		cache := NewSessionCache(69 * time.Second)
-
-		testData := &system.CombinedData{
-			Info: system.Info{
-				Hostname: "test-host",
-				Cores:    4,
-			},
-			Stats: system.Stats{
-				Cpu:     50.0,
-				MemPct:  30.0,
-				DiskPct: 40.0,
-			},
-		}
-
-		// Test initial state - should not be cached
-		data, isCached := cache.Get("session1")
-		assert.False(t, isCached, "Expected no cached data initially")
-		assert.NotNil(t, data, "Expected data to be initialized")
-		// Set data for session1
-		cache.Set("session1", testData)
-
-		time.Sleep(15 * time.Second)
-
-		// Get data for a different session - should be cached
-		data, isCached = cache.Get("session2")
-		assert.True(t, isCached, "Expected data to be cached for non-primary session")
-		require.NotNil(t, data, "Expected cached data to be returned")
-		assert.Equal(t, "test-host", data.Info.Hostname, "Hostname should match test data")
-		assert.Equal(t, 4, data.Info.Cores, "Cores should match test data")
-		assert.Equal(t, 50.0, data.Stats.Cpu, "CPU should match test data")
-		assert.Equal(t, 30.0, data.Stats.MemPct, "Memory percentage should match test data")
-		assert.Equal(t, 40.0, data.Stats.DiskPct, "Disk percentage should match test data")
-
-		time.Sleep(10 * time.Second)
-
-		// Get data for the primary session - should not be cached
-		data, isCached = cache.Get("session1")
-		assert.False(t, isCached, "Expected data not to be cached for primary session")
-		require.NotNil(t, data, "Expected data to be returned even if not cached")
-		assert.Equal(t, "test-host", data.Info.Hostname, "Hostname should match test data")
-		// if not cached, agent will update the data
-		cache.Set("session1", testData)
-
-		time.Sleep(45 * time.Second)
-
-		// Get data for a different session - should still be cached
-		_, isCached = cache.Get("session2")
-		assert.True(t, isCached, "Expected data to be cached for non-primary session")
-
-		// Wait for the lease to expire
-		time.Sleep(30 * time.Second)
-
-		// Get data for session2 - should not be cached
-		_, isCached = cache.Get("session2")
-		assert.False(t, isCached, "Expected data not to be cached after lease expiration")
-	})
-}
-
-func TestSessionCache_NilData(t *testing.T) {
-	// Create a new SessionCache
-	cache := NewSessionCache(30 * time.Second)
-
-	// Test setting nil data (should not panic)
-	assert.NotPanics(t, func() {
-		cache.Set("session1", nil)
-	}, "Setting nil data should not panic")
-
-	// Get data - should not be nil even though we set nil
-	data, _ := cache.Get("session2")
-	assert.NotNil(t, data, "Expected data to not be nil after setting nil data")
-}

beszel/internal/agent/docker.go

@@ -1,326 +0,0 @@
-package agent
-
-import (
-	"beszel/internal/entities/container"
-	"context"
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/blang/semver"
-)
-
-type dockerManager struct {
-	client              *http.Client                // Client to query Docker API
-	wg                  sync.WaitGroup              // WaitGroup to wait for all goroutines to finish
-	sem                 chan struct{}               // Semaphore to limit concurrent container requests
-	containerStatsMutex sync.RWMutex                // Mutex to prevent concurrent access to containerStatsMap
-	apiContainerList    []*container.ApiInfo        // List of containers from Docker API (no pointer)
-	containerStatsMap   map[string]*container.Stats // Keeps track of container stats
-	validIds            map[string]struct{}         // Map of valid container ids, used to prune invalid containers from containerStatsMap
-	goodDockerVersion   bool                        // Whether docker version is at least 25.0.0 (one-shot works correctly)
-}
-
-// userAgentRoundTripper is a custom http.RoundTripper that adds a User-Agent header to all requests
-type userAgentRoundTripper struct {
-	rt        http.RoundTripper
-	userAgent string
-}
-
-// RoundTrip implements the http.RoundTripper interface
-func (u *userAgentRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	req.Header.Set("User-Agent", u.userAgent)
-	return u.rt.RoundTrip(req)
-}
-
-// Add goroutine to the queue
-func (d *dockerManager) queue() {
-	d.wg.Add(1)
-	if d.goodDockerVersion {
-		d.sem <- struct{}{}
-	}
-}
-
-// Remove goroutine from the queue
-func (d *dockerManager) dequeue() {
-	d.wg.Done()
-	if d.goodDockerVersion {
-		<-d.sem
-	}
-}
-
-// Returns stats for all running containers
-func (dm *dockerManager) getDockerStats() ([]*container.Stats, error) {
-	resp, err := dm.client.Get("http://localhost/containers/json")
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	dm.apiContainerList = dm.apiContainerList[:0]
-	if err := json.NewDecoder(resp.Body).Decode(&dm.apiContainerList); err != nil {
-		return nil, err
-	}
-
-	containersLength := len(dm.apiContainerList)
-
-	// store valid ids to clean up old container ids from map
-	if dm.validIds == nil {
-		dm.validIds = make(map[string]struct{}, containersLength)
-	} else {
-		clear(dm.validIds)
-	}
-
-	var failedContainers []*container.ApiInfo
-
-	for i := range dm.apiContainerList {
-		ctr := dm.apiContainerList[i]
-		ctr.IdShort = ctr.Id[:12]
-		dm.validIds[ctr.IdShort] = struct{}{}
-		// check if container is less than 1 minute old (possible restart)
-		// note: can't use Created field because it's not updated on restart
-		if strings.Contains(ctr.Status, "second") {
-			// if so, remove old container data
-			dm.deleteContainerStatsSync(ctr.IdShort)
-		}
-		dm.queue()
-		go func() {
-			defer dm.dequeue()
-			err := dm.updateContainerStats(ctr)
-			// if error, delete from map and add to failed list to retry
-			if err != nil {
-				dm.containerStatsMutex.Lock()
-				delete(dm.containerStatsMap, ctr.IdShort)
-				failedContainers = append(failedContainers, ctr)
-				dm.containerStatsMutex.Unlock()
-			}
-		}()
-	}
-
-	dm.wg.Wait()
-
-	// retry failed containers separately so we can run them in parallel (docker 24 bug)
-	if len(failedContainers) > 0 {
-		slog.Debug("Retrying failed containers", "count", len(failedContainers))
-		for _, ctr := range failedContainers {
-			dm.queue()
-			go func() {
-				defer dm.dequeue()
-				err = dm.updateContainerStats(ctr)
-				if err != nil {
-					slog.Error("Error getting container stats", "err", err)
-				}
-			}()
-		}
-		dm.wg.Wait()
-	}
-
-	// populate final stats and remove old / invalid container stats
-	stats := make([]*container.Stats, 0, containersLength)
-	for id, v := range dm.containerStatsMap {
-		if _, exists := dm.validIds[id]; !exists {
-			delete(dm.containerStatsMap, id)
-		} else {
-			stats = append(stats, v)
-		}
-	}
-
-	return stats, nil
-}
-
-// Updates stats for individual container
-func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo) error {
-	name := ctr.Names[0][1:]
-
-	resp, err := dm.client.Get("http://localhost/containers/" + ctr.IdShort + "/stats?stream=0&one-shot=1")
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	dm.containerStatsMutex.Lock()
-	defer dm.containerStatsMutex.Unlock()
-
-	// add empty values if they doesn't exist in map
-	stats, initialized := dm.containerStatsMap[ctr.IdShort]
-	if !initialized {
-		stats = &container.Stats{Name: name}
-		dm.containerStatsMap[ctr.IdShort] = stats
-	}
-
-	// reset current stats
-	stats.Cpu = 0
-	stats.Mem = 0
-	stats.NetworkSent = 0
-	stats.NetworkRecv = 0
-
-	// docker host container stats response
-	var res container.ApiStats
-	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
-		return err
-	}
-
-	// check if container has valid data, otherwise may be in restart loop (#103)
-	if res.MemoryStats.Usage == 0 {
-		return fmt.Errorf("%s - no memory stats - see https://github.com/henrygd/beszel/issues/144", name)
-	}
-
-	// memory (https://docs.docker.com/reference/cli/docker/container/stats/)
-	memCache := res.MemoryStats.Stats.InactiveFile
-	if memCache == 0 {
-		memCache = res.MemoryStats.Stats.Cache
-	}
-	usedMemory := res.MemoryStats.Usage - memCache
-
-	// cpu
-	cpuDelta := res.CPUStats.CPUUsage.TotalUsage - stats.PrevCpu[0]
-	systemDelta := res.CPUStats.SystemUsage - stats.PrevCpu[1]
-	cpuPct := float64(cpuDelta) / float64(systemDelta) * 100
-	if cpuPct > 100 {
-		return fmt.Errorf("%s cpu pct greater than 100: %+v", name, cpuPct)
-	}
-	stats.PrevCpu = [2]uint64{res.CPUStats.CPUUsage.TotalUsage, res.CPUStats.SystemUsage}
-
-	// network
-	var total_sent, total_recv uint64
-	for _, v := range res.Networks {
-		total_sent += v.TxBytes
-		total_recv += v.RxBytes
-	}
-	var sent_delta, recv_delta float64
-	// prevent first run from sending all prev sent/recv bytes
-	if initialized {
-		secondsElapsed := time.Since(stats.PrevNet.Time).Seconds()
-		sent_delta = float64(total_sent-stats.PrevNet.Sent) / secondsElapsed
-		recv_delta = float64(total_recv-stats.PrevNet.Recv) / secondsElapsed
-	}
-	stats.PrevNet.Sent = total_sent
-	stats.PrevNet.Recv = total_recv
-	stats.PrevNet.Time = time.Now()
-
-	stats.Cpu = twoDecimals(cpuPct)
-	stats.Mem = bytesToMegabytes(float64(usedMemory))
-	stats.NetworkSent = bytesToMegabytes(sent_delta)
-	stats.NetworkRecv = bytesToMegabytes(recv_delta)
-
-	return nil
-}
-
-// Delete container stats from map using mutex
-func (dm *dockerManager) deleteContainerStatsSync(id string) {
-	dm.containerStatsMutex.Lock()
-	defer dm.containerStatsMutex.Unlock()
-	delete(dm.containerStatsMap, id)
-}
-
-// Creates a new http client for Docker or Podman API
-func newDockerManager(a *Agent) *dockerManager {
-	dockerHost, exists := GetEnv("DOCKER_HOST")
-	if exists {
-		slog.Info("DOCKER_HOST", "host", dockerHost)
-	} else {
-		dockerHost = getDockerHost()
-	}
-
-	parsedURL, err := url.Parse(dockerHost)
-	if err != nil {
-		slog.Error("Error parsing DOCKER_HOST", "err", err)
-		os.Exit(1)
-	}
-
-	transport := &http.Transport{
-		DisableCompression: true,
-		MaxConnsPerHost:    0,
-	}
-
-	switch parsedURL.Scheme {
-	case "unix":
-		transport.DialContext = func(ctx context.Context, proto, addr string) (net.Conn, error) {
-			return (&net.Dialer{}).DialContext(ctx, "unix", parsedURL.Path)
-		}
-	case "tcp", "http", "https":
-		transport.DialContext = func(ctx context.Context, proto, addr string) (net.Conn, error) {
-			return (&net.Dialer{}).DialContext(ctx, "tcp", parsedURL.Host)
-		}
-	default:
-		slog.Error("Invalid DOCKER_HOST", "scheme", parsedURL.Scheme)
-		os.Exit(1)
-	}
-
-	// configurable timeout
-	timeout := time.Millisecond * 2100
-	if t, set := GetEnv("DOCKER_TIMEOUT"); set {
-		timeout, err = time.ParseDuration(t)
-		if err != nil {
-			slog.Error(err.Error())
-			os.Exit(1)
-		}
-		slog.Info("DOCKER_TIMEOUT", "timeout", timeout)
-	}
-
-	// Custom user-agent to avoid docker bug: https://github.com/docker/for-mac/issues/7575
-	userAgentTransport := &userAgentRoundTripper{
-		rt:        transport,
-		userAgent: "Docker-Client/",
-	}
-
-	manager := &dockerManager{
-		client: &http.Client{
-			Timeout:   timeout,
-			Transport: userAgentTransport,
-		},
-		containerStatsMap: make(map[string]*container.Stats),
-		sem:               make(chan struct{}, 5),
-		apiContainerList:  []*container.ApiInfo{},
-	}
-
-	// If using podman, return client
-	if strings.Contains(dockerHost, "podman") {
-		a.systemInfo.Podman = true
-		manager.goodDockerVersion = true
-		return manager
-	}
-
-	// Check docker version
-	// (versions before 25.0.0 have a bug with one-shot which requires all requests to be made in one batch)
-	var versionInfo struct {
-		Version string `json:"Version"`
-	}
-	resp, err := manager.client.Get("http://localhost/version")
-	if err != nil {
-		return manager
-	}
-	defer resp.Body.Close()
-
-	if err := json.NewDecoder(resp.Body).Decode(&versionInfo); err != nil {
-		return manager
-	}
-
-	// if version > 24, one-shot works correctly and we can limit concurrent operations
-	if dockerVersion, err := semver.Parse(versionInfo.Version); err == nil && dockerVersion.Major > 24 {
-		manager.goodDockerVersion = true
-	} else {
-		slog.Info(fmt.Sprintf("Docker %s is outdated. Upgrade if possible. See https://github.com/henrygd/beszel/issues/58", versionInfo.Version))
-	}
-
-	return manager
-}
-
-// Test docker / podman sockets and return if one exists
-func getDockerHost() string {
-	scheme := "unix://"
-	socks := []string{"/var/run/docker.sock", fmt.Sprintf("/run/user/%v/podman/podman.sock", os.Getuid())}
-	for _, sock := range socks {
-		if _, err := os.Stat(sock); err == nil {
-			return scheme + sock
-		}
-	}
-	return scheme + socks[0]
-}

beszel/internal/agent/gpu.go

@@ -1,323 +0,0 @@
-package agent
-
-import (
-	"beszel/internal/entities/system"
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"os/exec"
-	"regexp"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	"golang.org/x/exp/slog"
-)
-
-// GPUManager manages data collection for GPUs (either Nvidia or AMD)
-type GPUManager struct {
-	sync.Mutex
-	nvidiaSmi  bool
-	rocmSmi    bool
-	tegrastats bool
-	GpuDataMap map[string]*system.GPUData
-}
-
-// RocmSmiJson represents the JSON structure of rocm-smi output
-type RocmSmiJson struct {
-	ID           string `json:"GUID"`
-	Name         string `json:"Card series"`
-	Temperature  string `json:"Temperature (Sensor edge) (C)"`
-	MemoryUsed   string `json:"VRAM Total Used Memory (B)"`
-	MemoryTotal  string `json:"VRAM Total Memory (B)"`
-	Usage        string `json:"GPU use (%)"`
-	PowerPackage string `json:"Average Graphics Package Power (W)"`
-	PowerSocket  string `json:"Current Socket Graphics Package Power (W)"`
-}
-
-// gpuCollector defines a collector for a specific GPU management utility (nvidia-smi or rocm-smi)
-type gpuCollector struct {
-	name    string
-	cmdArgs []string
-	parse   func([]byte) bool // returns true if valid data was found
-	buf     []byte
-}
-
-var errNoValidData = fmt.Errorf("no valid GPU data found") // Error for missing data
-
-// starts and manages the ongoing collection of GPU data for the specified GPU management utility
-func (c *gpuCollector) start() {
-	for {
-		err := c.collect()
-		if err != nil {
-			if err == errNoValidData {
-				slog.Warn(c.name + " found no valid GPU data, stopping")
-				break
-			}
-			slog.Warn(c.name+" failed, restarting", "err", err)
-			time.Sleep(time.Second * 5)
-			continue
-		}
-	}
-}
-
-// collect executes the command, parses output with the assigned parser function
-func (c *gpuCollector) collect() error {
-	cmd := exec.Command(c.name, c.cmdArgs...)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		return err
-	}
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-
-	scanner := bufio.NewScanner(stdout)
-	if c.buf == nil {
-		c.buf = make([]byte, 0, 10*1024)
-	}
-	scanner.Buffer(c.buf, bufio.MaxScanTokenSize)
-
-	for scanner.Scan() {
-		hasValidData := c.parse(scanner.Bytes())
-		if !hasValidData {
-			return errNoValidData
-		}
-	}
-
-	if err := scanner.Err(); err != nil {
-		return fmt.Errorf("scanner error: %w", err)
-	}
-	return cmd.Wait()
-}
-
-// getJetsonParser returns a function to parse the output of tegrastats and update the GPUData map
-func (gm *GPUManager) getJetsonParser() func(output []byte) bool {
-	// use closure to avoid recompiling the regex
-	ramPattern := regexp.MustCompile(`RAM (\d+)/(\d+)MB`)
-	gr3dPattern := regexp.MustCompile(`GR3D_FREQ (\d+)%`)
-	tempPattern := regexp.MustCompile(`tj@(\d+\.?\d*)C`)
-	// Orin Nano / NX do not have GPU specific power monitor
-	// TODO: Maybe use VDD_IN for Nano / NX and add a total system power chart
-	powerPattern := regexp.MustCompile(`(GPU_SOC|CPU_GPU_CV) (\d+)mW`)
-
-	return func(output []byte) bool {
-		gm.Lock()
-		defer gm.Unlock()
-		// we get gpu name from the intitial run of nvidia-smi, so return if it hasn't been initialized
-		gpuData, ok := gm.GpuDataMap["0"]
-		if !ok {
-			return true
-		}
-		// Parse RAM usage
-		ramMatches := ramPattern.FindSubmatch(output)
-		if ramMatches != nil {
-			gpuData.MemoryUsed, _ = strconv.ParseFloat(string(ramMatches[1]), 64)
-			gpuData.MemoryTotal, _ = strconv.ParseFloat(string(ramMatches[2]), 64)
-		}
-		// Parse GR3D (GPU) usage
-		gr3dMatches := gr3dPattern.FindSubmatch(output)
-		if gr3dMatches != nil {
-			gpuData.Usage, _ = strconv.ParseFloat(string(gr3dMatches[1]), 64)
-		}
-		// Parse temperature
-		tempMatches := tempPattern.FindSubmatch(output)
-		if tempMatches != nil {
-			gpuData.Temperature, _ = strconv.ParseFloat(string(tempMatches[1]), 64)
-		}
-		// Parse power usage
-		powerMatches := powerPattern.FindSubmatch(output)
-		if powerMatches != nil {
-			power, _ := strconv.ParseFloat(string(powerMatches[2]), 64)
-			gpuData.Power = power / 1000
-		}
-		gpuData.Count++
-		return true
-	}
-}
-
-// parseNvidiaData parses the output of nvidia-smi and updates the GPUData map
-func (gm *GPUManager) parseNvidiaData(output []byte) bool {
-	gm.Lock()
-	defer gm.Unlock()
-	scanner := bufio.NewScanner(bytes.NewReader(output))
-	var valid bool
-	for scanner.Scan() {
-		line := scanner.Text() // Or use scanner.Bytes() for []byte
-		fields := strings.Split(strings.TrimSpace(line), ", ")
-		if len(fields) < 7 {
-			continue
-		}
-		valid = true
-		id := fields[0]
-		temp, _ := strconv.ParseFloat(fields[2], 64)
-		memoryUsage, _ := strconv.ParseFloat(fields[3], 64)
-		totalMemory, _ := strconv.ParseFloat(fields[4], 64)
-		usage, _ := strconv.ParseFloat(fields[5], 64)
-		power, _ := strconv.ParseFloat(fields[6], 64)
-		// add gpu if not exists
-		if _, ok := gm.GpuDataMap[id]; !ok {
-			name := strings.TrimPrefix(fields[1], "NVIDIA ")
-			gm.GpuDataMap[id] = &system.GPUData{Name: strings.TrimSuffix(name, " Laptop GPU")}
-			// check if tegrastats is active - if so we will only use nvidia-smi to get gpu name
-			// - nvidia-smi does not provide metrics for tegra / jetson devices
-			// this will end the nvidia-smi collector
-			if gm.tegrastats {
-				return false
-			}
-		}
-		// update gpu data
-		gpu := gm.GpuDataMap[id]
-		gpu.Temperature = temp
-		gpu.MemoryUsed = memoryUsage / 1.024
-		gpu.MemoryTotal = totalMemory / 1.024
-		gpu.Usage += usage
-		gpu.Power += power
-		gpu.Count++
-	}
-	return valid
-}
-
-// parseAmdData parses the output of rocm-smi and updates the GPUData map
-func (gm *GPUManager) parseAmdData(output []byte) bool {
-	var rocmSmiInfo map[string]RocmSmiJson
-	if err := json.Unmarshal(output, &rocmSmiInfo); err != nil || len(rocmSmiInfo) == 0 {
-		return false
-	}
-	gm.Lock()
-	defer gm.Unlock()
-	for _, v := range rocmSmiInfo {
-		var power float64
-		if v.PowerPackage != "" {
-			power, _ = strconv.ParseFloat(v.PowerPackage, 64)
-		} else {
-			power, _ = strconv.ParseFloat(v.PowerSocket, 64)
-		}
-		memoryUsage, _ := strconv.ParseFloat(v.MemoryUsed, 64)
-		totalMemory, _ := strconv.ParseFloat(v.MemoryTotal, 64)
-		usage, _ := strconv.ParseFloat(v.Usage, 64)
-
-		if _, ok := gm.GpuDataMap[v.ID]; !ok {
-			gm.GpuDataMap[v.ID] = &system.GPUData{Name: v.Name}
-		}
-		gpu := gm.GpuDataMap[v.ID]
-		gpu.Temperature, _ = strconv.ParseFloat(v.Temperature, 64)
-		gpu.MemoryUsed = bytesToMegabytes(memoryUsage)
-		gpu.MemoryTotal = bytesToMegabytes(totalMemory)
-		gpu.Usage += usage
-		gpu.Power += power
-		gpu.Count++
-	}
-	return true
-}
-
-// sums and resets the current GPU utilization data since the last update
-func (gm *GPUManager) GetCurrentData() map[string]system.GPUData {
-	gm.Lock()
-	defer gm.Unlock()
-
-	// check for GPUs with the same name
-	nameCounts := make(map[string]int)
-	for _, gpu := range gm.GpuDataMap {
-		nameCounts[gpu.Name]++
-	}
-
-	// copy / reset the data
-	gpuData := make(map[string]system.GPUData, len(gm.GpuDataMap))
-	for id, gpu := range gm.GpuDataMap {
-		// sum the data
-		gpu.Temperature = twoDecimals(gpu.Temperature)
-		gpu.MemoryUsed = twoDecimals(gpu.MemoryUsed)
-		gpu.MemoryTotal = twoDecimals(gpu.MemoryTotal)
-		gpu.Usage = twoDecimals(gpu.Usage / gpu.Count)
-		gpu.Power = twoDecimals(gpu.Power / gpu.Count)
-		// reset the count
-		gpu.Count = 1
-		// dereference to avoid overwriting anything else
-		gpuCopy := *gpu
-		// append id to the name if there are multiple GPUs with the same name
-		if nameCounts[gpu.Name] > 1 {
-			gpuCopy.Name = fmt.Sprintf("%s %s", gpu.Name, id)
-		}
-		gpuData[id] = gpuCopy
-	}
-	return gpuData
-}
-
-// detectGPUs checks for the presence of GPU management tools (nvidia-smi, rocm-smi, tegrastats)
-// in the system path. It sets the corresponding flags in the GPUManager struct if any of these
-// tools are found. If none of the tools are found, it returns an error indicating that no GPU
-// management tools are available.
-func (gm *GPUManager) detectGPUs() error {
-	if _, err := exec.LookPath("nvidia-smi"); err == nil {
-		gm.nvidiaSmi = true
-	}
-	if _, err := exec.LookPath("rocm-smi"); err == nil {
-		gm.rocmSmi = true
-	}
-	if _, err := exec.LookPath("tegrastats"); err == nil {
-		gm.tegrastats = true
-	}
-	if gm.nvidiaSmi || gm.rocmSmi || gm.tegrastats {
-		return nil
-	}
-	return fmt.Errorf("no GPU found - install nvidia-smi, rocm-smi, or tegrastats")
-}
-
-// startCollector starts the appropriate GPU data collector based on the command
-func (gm *GPUManager) startCollector(command string) {
-	collector := gpuCollector{
-		name: command,
-	}
-	switch command {
-	case "nvidia-smi":
-		collector.cmdArgs = []string{"-l", "4",
-			"--query-gpu=index,name,temperature.gpu,memory.used,memory.total,utilization.gpu,power.draw",
-			"--format=csv,noheader,nounits"}
-		collector.parse = gm.parseNvidiaData
-		go collector.start()
-	case "tegrastats":
-		collector.cmdArgs = []string{"--interval", "3000"}
-		collector.parse = gm.getJetsonParser()
-		go collector.start()
-	case "rocm-smi":
-		collector.cmdArgs = []string{"--showid", "--showtemp", "--showuse", "--showpower", "--showproductname", "--showmeminfo", "vram", "--json"}
-		collector.parse = gm.parseAmdData
-		go func() {
-			failures := 0
-			for {
-				if err := collector.collect(); err != nil {
-					failures++
-					if failures > 5 {
-						break
-					}
-					slog.Warn("Error collecting AMD GPU data", "err", err)
-				}
-				time.Sleep(4300 * time.Millisecond)
-			}
-		}()
-	}
-}
-
-// NewGPUManager creates and initializes a new GPUManager
-func NewGPUManager() (*GPUManager, error) {
-	var gm GPUManager
-	if err := gm.detectGPUs(); err != nil {
-		return nil, err
-	}
-	gm.GpuDataMap = make(map[string]*system.GPUData)
-
-	if gm.nvidiaSmi {
-		gm.startCollector("nvidia-smi")
-	}
-	if gm.rocmSmi {
-		gm.startCollector("rocm-smi")
-	}
-	if gm.tegrastats {
-		gm.startCollector("tegrastats")
-	}
-
-	return &gm, nil
-}

beszel/internal/agent/gpu_test.go

@@ -1,525 +0,0 @@
-package agent
-
-import (
-	"beszel/internal/entities/system"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseNvidiaData(t *testing.T) {
-	tests := []struct {
-		name      string
-		input     string
-		wantData  map[string]system.GPUData
-		wantValid bool
-	}{
-		{
-			name:  "valid multi-gpu data",
-			input: "0, NVIDIA GeForce RTX 3050 Ti Laptop GPU, 48, 12, 4096, 26.3, 12.73\n1, NVIDIA A100-PCIE-40GB, 38, 74, 40960, [N/A], 36.79",
-			wantData: map[string]system.GPUData{
-				"0": {
-					Name:        "GeForce RTX 3050 Ti",
-					Temperature: 48.0,
-					MemoryUsed:  12.0 / 1.024,
-					MemoryTotal: 4096.0 / 1.024,
-					Usage:       26.3,
-					Power:       12.73,
-					Count:       1,
-				},
-				"1": {
-					Name:        "A100-PCIE-40GB",
-					Temperature: 38.0,
-					MemoryUsed:  74.0 / 1.024,
-					MemoryTotal: 40960.0 / 1.024,
-					Usage:       0.0,
-					Power:       36.79,
-					Count:       1,
-				},
-			},
-			wantValid: true,
-		},
-		{
-			name:      "empty input",
-			input:     "",
-			wantData:  map[string]system.GPUData{},
-			wantValid: false,
-		},
-		{
-			name:      "malformed data",
-			input:     "bad, data, here",
-			wantData:  map[string]system.GPUData{},
-			wantValid: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			gm := &GPUManager{
-				GpuDataMap: make(map[string]*system.GPUData),
-			}
-			valid := gm.parseNvidiaData([]byte(tt.input))
-			assert.Equal(t, tt.wantValid, valid)
-
-			if tt.wantValid {
-				for id, want := range tt.wantData {
-					got := gm.GpuDataMap[id]
-					require.NotNil(t, got)
-					assert.Equal(t, want.Name, got.Name)
-					assert.InDelta(t, want.Temperature, got.Temperature, 0.01)
-					assert.InDelta(t, want.MemoryUsed, got.MemoryUsed, 0.01)
-					assert.InDelta(t, want.MemoryTotal, got.MemoryTotal, 0.01)
-					assert.InDelta(t, want.Usage, got.Usage, 0.01)
-					assert.InDelta(t, want.Power, got.Power, 0.01)
-					assert.Equal(t, want.Count, got.Count)
-				}
-			}
-		})
-	}
-}
-
-func TestParseAmdData(t *testing.T) {
-	tests := []struct {
-		name      string
-		input     string
-		wantData  map[string]system.GPUData
-		wantValid bool
-	}{
-		{
-			name: "valid single gpu data",
-			input: `{
-				"card0": {
-					"GUID": "34756",
-					"Temperature (Sensor edge) (C)": "47.0",
-					"Current Socket Graphics Package Power (W)": "9.215",
-					"GPU use (%)": "0",
-					"VRAM Total Memory (B)": "536870912",
-					"VRAM Total Used Memory (B)": "482263040",
-					"Card Series": "Rembrandt [Radeon 680M]"
-				}
-			}`,
-			wantData: map[string]system.GPUData{
-				"34756": {
-					Name:        "Rembrandt [Radeon 680M]",
-					Temperature: 47.0,
-					MemoryUsed:  482263040.0 / (1024 * 1024),
-					MemoryTotal: 536870912.0 / (1024 * 1024),
-					Usage:       0.0,
-					Power:       9.215,
-					Count:       1,
-				},
-			},
-			wantValid: true,
-		},
-		{
-			name: "valid multi gpu data",
-			input: `{
-				"card0": {
-					"GUID": "34756",
-					"Temperature (Sensor edge) (C)": "47.0",
-					"Current Socket Graphics Package Power (W)": "9.215",
-					"GPU use (%)": "0",
-					"VRAM Total Memory (B)": "536870912",
-					"VRAM Total Used Memory (B)": "482263040",
-					"Card Series": "Rembrandt [Radeon 680M]"
-				},
-				"card1": {
-					"GUID": "38294",
-					"Temperature (Sensor edge) (C)": "49.0",
-					"Temperature (Sensor junction) (C)": "49.0",
-					"Temperature (Sensor memory) (C)": "62.0",
-					"Average Graphics Package Power (W)": "19.0",
-					"GPU use (%)": "20.3",
-					"VRAM Total Memory (B)": "25753026560",
-					"VRAM Total Used Memory (B)": "794341376",
-					"Card Series": "Navi 31 [Radeon RX 7900 XT]"
-				}
-			}`,
-			wantData: map[string]system.GPUData{
-				"34756": {
-					Name:        "Rembrandt [Radeon 680M]",
-					Temperature: 47.0,
-					MemoryUsed:  482263040.0 / (1024 * 1024),
-					MemoryTotal: 536870912.0 / (1024 * 1024),
-					Usage:       0.0,
-					Power:       9.215,
-					Count:       1,
-				},
-				"38294": {
-					Name:        "Navi 31 [Radeon RX 7900 XT]",
-					Temperature: 49.0,
-					MemoryUsed:  794341376.0 / (1024 * 1024),
-					MemoryTotal: 25753026560.0 / (1024 * 1024),
-					Usage:       20.3,
-					Power:       19.0,
-					Count:       1,
-				},
-			},
-			wantValid: true,
-		},
-		{
-			name:  "invalid json",
-			input: "{bad json",
-		},
-		{
-			name:      "invalid json",
-			input:     "{bad json",
-			wantData:  map[string]system.GPUData{},
-			wantValid: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			gm := &GPUManager{
-				GpuDataMap: make(map[string]*system.GPUData),
-			}
-			valid := gm.parseAmdData([]byte(tt.input))
-			assert.Equal(t, tt.wantValid, valid)
-
-			if tt.wantValid {
-				for id, want := range tt.wantData {
-					got := gm.GpuDataMap[id]
-					require.NotNil(t, got)
-					assert.Equal(t, want.Name, got.Name)
-					assert.InDelta(t, want.Temperature, got.Temperature, 0.01)
-					assert.InDelta(t, want.MemoryUsed, got.MemoryUsed, 0.01)
-					assert.InDelta(t, want.MemoryTotal, got.MemoryTotal, 0.01)
-					assert.InDelta(t, want.Usage, got.Usage, 0.01)
-					assert.InDelta(t, want.Power, got.Power, 0.01)
-					assert.Equal(t, want.Count, got.Count)
-				}
-			}
-		})
-	}
-}
-
-func TestParseJetsonData(t *testing.T) {
-	tests := []struct {
-		name        string
-		input       string
-		gm          *GPUManager
-		wantMetrics *system.GPUData
-	}{
-		{
-			name:  "valid data",
-			input: "RAM 4300/30698MB GR3D_FREQ 45% tj@52.468C VDD_GPU_SOC 2171mW",
-			wantMetrics: &system.GPUData{
-				Name:        "Jetson",
-				MemoryUsed:  4300.0,
-				MemoryTotal: 30698.0,
-				Usage:       45.0,
-				Temperature: 52.468,
-				Power:       2.171,
-				Count:       1,
-			},
-		},
-		{
-			name:  "missing temperature",
-			input: "RAM 4300/30698MB GR3D_FREQ 45% VDD_GPU_SOC 2171mW",
-			wantMetrics: &system.GPUData{
-				Name:        "Jetson",
-				MemoryUsed:  4300.0,
-				MemoryTotal: 30698.0,
-				Usage:       45.0,
-				Power:       2.171,
-				Count:       1,
-			},
-		},
-		{
-			name:  "no gpu defined by nvidia-smi",
-			input: "RAM 4300/30698MB GR3D_FREQ 45% VDD_GPU_SOC 2171mW",
-			gm: &GPUManager{
-				GpuDataMap: map[string]*system.GPUData{},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.gm != nil {
-				// should return if no gpu set by nvidia-smi
-				assert.Empty(t, tt.gm.GpuDataMap)
-				return
-			}
-			tt.gm = &GPUManager{
-				GpuDataMap: map[string]*system.GPUData{
-					"0": {Name: "Jetson"},
-				},
-			}
-			parser := tt.gm.getJetsonParser()
-			valid := parser([]byte(tt.input))
-			assert.Equal(t, true, valid)
-
-			got := tt.gm.GpuDataMap["0"]
-			require.NotNil(t, got)
-			assert.Equal(t, tt.wantMetrics.Name, got.Name)
-			assert.InDelta(t, tt.wantMetrics.MemoryUsed, got.MemoryUsed, 0.01)
-			assert.InDelta(t, tt.wantMetrics.MemoryTotal, got.MemoryTotal, 0.01)
-			assert.InDelta(t, tt.wantMetrics.Usage, got.Usage, 0.01)
-			if tt.wantMetrics.Temperature > 0 {
-				assert.InDelta(t, tt.wantMetrics.Temperature, got.Temperature, 0.01)
-			}
-			assert.InDelta(t, tt.wantMetrics.Power, got.Power, 0.01)
-			assert.Equal(t, tt.wantMetrics.Count, got.Count)
-		})
-	}
-}
-
-func TestGetCurrentData(t *testing.T) {
-	gm := &GPUManager{
-		GpuDataMap: map[string]*system.GPUData{
-			"0": {
-				Name:        "GPU1",
-				Temperature: 50,
-				MemoryUsed:  2048,
-				MemoryTotal: 4096,
-				Usage:       100, // 100 over 2 counts = 50 avg
-				Power:       200, // 200 over 2 counts = 100 avg
-				Count:       2,
-			},
-			"1": {
-				Name:        "GPU1",
-				Temperature: 60,
-				MemoryUsed:  3072,
-				MemoryTotal: 8192,
-				Usage:       30,
-				Power:       60,
-				Count:       1,
-			},
-		},
-	}
-
-	result := gm.GetCurrentData()
-
-	// Verify name disambiguation
-	assert.Equal(t, "GPU1 0", result["0"].Name)
-	assert.Equal(t, "GPU1 1", result["1"].Name)
-
-	// Check averaged values
-	assert.InDelta(t, 50.0, result["0"].Usage, 0.01)
-	assert.InDelta(t, 100.0, result["0"].Power, 0.01)
-	assert.InDelta(t, 30.0, result["1"].Usage, 0.01)
-	assert.InDelta(t, 60.0, result["1"].Power, 0.01)
-
-	// Verify reset counts
-	assert.Equal(t, float64(1), gm.GpuDataMap["0"].Count)
-	assert.Equal(t, float64(1), gm.GpuDataMap["1"].Count)
-}
-
-func TestDetectGPUs(t *testing.T) {
-	// Save original PATH
-	origPath := os.Getenv("PATH")
-	defer os.Setenv("PATH", origPath)
-
-	// Set up temp dir with the commands
-	tempDir := t.TempDir()
-	os.Setenv("PATH", tempDir)
-
-	tests := []struct {
-		name           string
-		setupCommands  func() error
-		wantNvidiaSmi  bool
-		wantRocmSmi    bool
-		wantTegrastats bool
-		wantErr        bool
-	}{
-		{
-			name: "nvidia-smi not available",
-			setupCommands: func() error {
-				return nil
-			},
-			wantNvidiaSmi:  false,
-			wantRocmSmi:    false,
-			wantTegrastats: false,
-			wantErr:        true,
-		},
-		{
-			name: "nvidia-smi available",
-			setupCommands: func() error {
-				path := filepath.Join(tempDir, "nvidia-smi")
-				script := `#!/bin/sh
-echo "test"`
-				if err := os.WriteFile(path, []byte(script), 0755); err != nil {
-					return err
-				}
-				return nil
-			},
-			wantNvidiaSmi:  true,
-			wantTegrastats: false,
-			wantRocmSmi:    false,
-			wantErr:        false,
-		},
-		{
-			name: "rocm-smi available",
-			setupCommands: func() error {
-				path := filepath.Join(tempDir, "rocm-smi")
-				script := `#!/bin/sh
-echo "test"`
-				if err := os.WriteFile(path, []byte(script), 0755); err != nil {
-					return err
-				}
-				return nil
-			},
-			wantNvidiaSmi:  true,
-			wantRocmSmi:    true,
-			wantTegrastats: false,
-			wantErr:        false,
-		},
-		{
-			name: "tegrastats available",
-			setupCommands: func() error {
-				path := filepath.Join(tempDir, "tegrastats")
-				script := `#!/bin/sh
-echo "test"`
-				if err := os.WriteFile(path, []byte(script), 0755); err != nil {
-					return err
-				}
-				return nil
-			},
-			wantNvidiaSmi:  true,
-			wantRocmSmi:    true,
-			wantTegrastats: true,
-			wantErr:        false,
-		},
-		{
-			name: "no gpu tools available",
-			setupCommands: func() error {
-				os.Setenv("PATH", "")
-				return nil
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.setupCommands(); err != nil {
-				t.Fatal(err)
-			}
-
-			gm := &GPUManager{}
-			err := gm.detectGPUs()
-
-			t.Logf("nvidiaSmi: %v, rocmSmi: %v, tegrastats: %v", gm.nvidiaSmi, gm.rocmSmi, gm.tegrastats)
-
-			if tt.wantErr {
-				assert.Error(t, err)
-				return
-			}
-
-			assert.NoError(t, err)
-			assert.Equal(t, tt.wantNvidiaSmi, gm.nvidiaSmi)
-			assert.Equal(t, tt.wantRocmSmi, gm.rocmSmi)
-			assert.Equal(t, tt.wantTegrastats, gm.tegrastats)
-		})
-	}
-}
-
-func TestStartCollector(t *testing.T) {
-	// Save original PATH
-	origPath := os.Getenv("PATH")
-	defer os.Setenv("PATH", origPath)
-
-	// Set up temp dir with the commands
-	dir := t.TempDir()
-	os.Setenv("PATH", dir)
-
-	tests := []struct {
-		name     string
-		command  string
-		setup    func(t *testing.T) error
-		validate func(t *testing.T, gm *GPUManager)
-		gm       *GPUManager
-	}{
-		{
-			name:    "nvidia-smi collector",
-			command: "nvidia-smi",
-			setup: func(t *testing.T) error {
-				path := filepath.Join(dir, "nvidia-smi")
-				script := `#!/bin/sh
-echo "0, NVIDIA Test GPU, 50, 1024, 4096, 25, 100"`
-				if err := os.WriteFile(path, []byte(script), 0755); err != nil {
-					return err
-				}
-				return nil
-			},
-			validate: func(t *testing.T, gm *GPUManager) {
-				gpu, exists := gm.GpuDataMap["0"]
-				assert.True(t, exists)
-				if exists {
-					assert.Equal(t, "Test GPU", gpu.Name)
-					assert.Equal(t, 50.0, gpu.Temperature)
-
-				}
-			},
-		},
-		{
-			name:    "rocm-smi collector",
-			command: "rocm-smi",
-			setup: func(t *testing.T) error {
-				path := filepath.Join(dir, "rocm-smi")
-				script := `#!/bin/sh
-echo '{"card0": {"Temperature (Sensor edge) (C)": "49.0", "Current Socket Graphics Package Power (W)": "28.159", "GPU use (%)": "0", "VRAM Total Memory (B)": "536870912", "VRAM Total Used Memory (B)": "445550592", "Card Series": "Rembrandt [Radeon 680M]", "Card Model": "0x1681", "Card Vendor": "Advanced Micro Devices, Inc. [AMD/ATI]", "Card SKU": "REMBRANDT", "Subsystem ID": "0x8a22", "Device Rev": "0xc8", "Node ID": "1", "GUID": "34756", "GFX Version": "gfx1035"}}'`
-				if err := os.WriteFile(path, []byte(script), 0755); err != nil {
-					return err
-				}
-				return nil
-			},
-			validate: func(t *testing.T, gm *GPUManager) {
-				gpu, exists := gm.GpuDataMap["34756"]
-				assert.True(t, exists)
-				if exists {
-					assert.Equal(t, "Rembrandt [Radeon 680M]", gpu.Name)
-					assert.InDelta(t, 49.0, gpu.Temperature, 0.01)
-					assert.InDelta(t, 28.159, gpu.Power, 0.01)
-				}
-			},
-		},
-		{
-			name:    "tegrastats collector",
-			command: "tegrastats",
-			setup: func(t *testing.T) error {
-				path := filepath.Join(dir, "tegrastats")
-				script := `#!/bin/sh
-echo "RAM 1024/4096MB GR3D_FREQ 80% tj@70C VDD_GPU_SOC 1000mW"`
-				if err := os.WriteFile(path, []byte(script), 0755); err != nil {
-					return err
-				}
-				return nil
-			},
-			validate: func(t *testing.T, gm *GPUManager) {
-				gpu, exists := gm.GpuDataMap["0"]
-				assert.True(t, exists)
-				if exists {
-					assert.InDelta(t, 70.0, gpu.Temperature, 0.1)
-				}
-			},
-			gm: &GPUManager{
-				GpuDataMap: map[string]*system.GPUData{
-					"0": {},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.setup(t); err != nil {
-				t.Fatal(err)
-			}
-			if tt.gm == nil {
-				tt.gm = &GPUManager{
-					GpuDataMap: make(map[string]*system.GPUData),
-				}
-			}
-			tt.gm.startCollector(tt.command)
-			time.Sleep(50 * time.Millisecond) // Give collector time to run
-			tt.validate(t, tt.gm)
-		})
-	}
-}

beszel/internal/agent/network.go

@@ -1,66 +0,0 @@
-package agent
-
-import (
-	"log/slog"
-	"strings"
-	"time"
-
-	psutilNet "github.com/shirou/gopsutil/v4/net"
-)
-
-func (a *Agent) initializeNetIoStats() {
-	// reset valid network interfaces
-	a.netInterfaces = make(map[string]struct{}, 0)
-
-	// map of network interface names passed in via NICS env var
-	var nicsMap map[string]struct{}
-	nics, nicsEnvExists := GetEnv("NICS")
-	if nicsEnvExists {
-		nicsMap = make(map[string]struct{}, 0)
-		for _, nic := range strings.Split(nics, ",") {
-			nicsMap[nic] = struct{}{}
-		}
-	}
-
-	// reset network I/O stats
-	a.netIoStats.BytesSent = 0
-	a.netIoStats.BytesRecv = 0
-
-	// get intial network I/O stats
-	if netIO, err := psutilNet.IOCounters(true); err == nil {
-		a.netIoStats.Time = time.Now()
-		for _, v := range netIO {
-			switch {
-			// skip if nics exists and the interface is not in the list
-			case nicsEnvExists:
-				if _, nameInNics := nicsMap[v.Name]; !nameInNics {
-					continue
-				}
-			// otherwise run the interface name through the skipNetworkInterface function
-			default:
-				if a.skipNetworkInterface(v) {
-					continue
-				}
-			}
-			slog.Info("Detected network interface", "name", v.Name, "sent", v.BytesSent, "recv", v.BytesRecv)
-			a.netIoStats.BytesSent += v.BytesSent
-			a.netIoStats.BytesRecv += v.BytesRecv
-			// store as a valid network interface
-			a.netInterfaces[v.Name] = struct{}{}
-		}
-	}
-}
-
-func (a *Agent) skipNetworkInterface(v psutilNet.IOCountersStat) bool {
-	switch {
-	case strings.HasPrefix(v.Name, "lo"),
-		strings.HasPrefix(v.Name, "docker"),
-		strings.HasPrefix(v.Name, "br-"),
-		strings.HasPrefix(v.Name, "veth"),
-		v.BytesRecv == 0,
-		v.BytesSent == 0:
-		return true
-	default:
-		return false
-	}
-}

beszel/internal/agent/server.go

@@ -1,91 +0,0 @@
-package agent
-
-import (
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"net"
-	"os"
-	"strings"
-
-	sshServer "github.com/gliderlabs/ssh"
-	"golang.org/x/crypto/ssh"
-)
-
-type ServerOptions struct {
-	Addr    string
-	Network string
-	Keys    []ssh.PublicKey
-}
-
-func (a *Agent) StartServer(opts ServerOptions) error {
-	sshServer.Handle(a.handleSession)
-
-	slog.Info("Starting SSH server", "addr", opts.Addr, "network", opts.Network)
-
-	switch opts.Network {
-	case "unix":
-		// remove existing socket file if it exists
-		if err := os.Remove(opts.Addr); err != nil && !os.IsNotExist(err) {
-			return err
-		}
-	default:
-		// prefix with : if only port was provided
-		if !strings.Contains(opts.Addr, ":") {
-			opts.Addr = ":" + opts.Addr
-		}
-	}
-
-	// Listen on the address
-	ln, err := net.Listen(opts.Network, opts.Addr)
-	if err != nil {
-		return err
-	}
-	defer ln.Close()
-
-	// Start SSH server on the listener
-	err = sshServer.Serve(ln, nil, sshServer.NoPty(),
-		sshServer.PublicKeyAuth(func(ctx sshServer.Context, key sshServer.PublicKey) bool {
-			for _, pubKey := range opts.Keys {
-				if sshServer.KeysEqual(key, pubKey) {
-					return true
-				}
-			}
-			return false
-		}),
-	)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func (a *Agent) handleSession(s sshServer.Session) {
-	slog.Debug("New session", "client", s.RemoteAddr())
-	stats := a.gatherStats(s.Context().SessionID())
-	if err := json.NewEncoder(s).Encode(stats); err != nil {
-		slog.Error("Error encoding stats", "err", err, "stats", stats)
-		s.Exit(1)
-	}
-	s.Exit(0)
-}
-
-// ParseKeys parses a string containing SSH public keys in authorized_keys format.
-// It returns a slice of ssh.PublicKey and an error if any key fails to parse.
-func ParseKeys(input string) ([]ssh.PublicKey, error) {
-	var parsedKeys []ssh.PublicKey
-	for line := range strings.Lines(input) {
-		line = strings.TrimSpace(line)
-		// Skip empty lines or comments
-		if len(line) == 0 || strings.HasPrefix(line, "#") {
-			continue
-		}
-		// Parse the key
-		parsedKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(line))
-		if err != nil {
-			return nil, fmt.Errorf("failed to parse key: %s, error: %w", line, err)
-		}
-		parsedKeys = append(parsedKeys, parsedKey)
-	}
-	return parsedKeys, nil
-}

beszel/internal/agent/server_test.go

@@ -1,289 +0,0 @@
-package agent
-
-import (
-	"crypto/ed25519"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/ssh"
-)
-
-func TestStartServer(t *testing.T) {
-	// Generate a test key pair
-	pubKey, privKey, err := ed25519.GenerateKey(nil)
-	require.NoError(t, err)
-	signer, err := ssh.NewSignerFromKey(privKey)
-	require.NoError(t, err)
-	sshPubKey, err := ssh.NewPublicKey(pubKey)
-	require.NoError(t, err)
-
-	// Generate a different key pair for bad key test
-	badPubKey, badPrivKey, err := ed25519.GenerateKey(nil)
-	require.NoError(t, err)
-	badSigner, err := ssh.NewSignerFromKey(badPrivKey)
-	require.NoError(t, err)
-	sshBadPubKey, err := ssh.NewPublicKey(badPubKey)
-	require.NoError(t, err)
-
-	socketFile := filepath.Join(t.TempDir(), "beszel-test.sock")
-
-	tests := []struct {
-		name        string
-		config      ServerOptions
-		wantErr     bool
-		errContains string
-		setup       func() error
-		cleanup     func() error
-	}{
-		{
-			name: "tcp port only",
-			config: ServerOptions{
-				Network: "tcp",
-				Addr:    "45987",
-				Keys:    []ssh.PublicKey{sshPubKey},
-			},
-		},
-		{
-			name: "tcp with ipv4",
-			config: ServerOptions{
-				Network: "tcp4",
-				Addr:    "127.0.0.1:45988",
-				Keys:    []ssh.PublicKey{sshPubKey},
-			},
-		},
-		{
-			name: "tcp with ipv6",
-			config: ServerOptions{
-				Network: "tcp6",
-				Addr:    "[::1]:45989",
-				Keys:    []ssh.PublicKey{sshPubKey},
-			},
-		},
-		{
-			name: "unix socket",
-			config: ServerOptions{
-				Network: "unix",
-				Addr:    socketFile,
-				Keys:    []ssh.PublicKey{sshPubKey},
-			},
-			setup: func() error {
-				// Create a socket file that should be removed
-				f, err := os.Create(socketFile)
-				if err != nil {
-					return err
-				}
-				return f.Close()
-			},
-			cleanup: func() error {
-				return os.Remove(socketFile)
-			},
-		},
-		{
-			name: "bad key should fail",
-			config: ServerOptions{
-				Network: "tcp",
-				Addr:    "45987",
-				Keys:    []ssh.PublicKey{sshBadPubKey},
-			},
-			wantErr:     true,
-			errContains: "ssh: handshake failed",
-		},
-		{
-			name: "good key still good",
-			config: ServerOptions{
-				Network: "tcp",
-				Addr:    "45987",
-				Keys:    []ssh.PublicKey{sshPubKey},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.setup != nil {
-				err := tt.setup()
-				require.NoError(t, err)
-			}
-
-			if tt.cleanup != nil {
-				defer tt.cleanup()
-			}
-
-			agent := NewAgent()
-
-			// Start server in a goroutine since it blocks
-			errChan := make(chan error, 1)
-			go func() {
-				errChan <- agent.StartServer(tt.config)
-			}()
-
-			// Add a short delay to allow the server to start
-			time.Sleep(100 * time.Millisecond)
-
-			// Try to connect to verify server is running
-			var client *ssh.Client
-			var err error
-
-			// Choose the appropriate signer based on the test case
-			testSigner := signer
-			if tt.name == "bad key should fail" {
-				testSigner = badSigner
-			}
-
-			sshClientConfig := &ssh.ClientConfig{
-				User: "a",
-				Auth: []ssh.AuthMethod{
-					ssh.PublicKeys(testSigner),
-				},
-				HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-				Timeout:         4 * time.Second,
-			}
-
-			switch tt.config.Network {
-			case "unix":
-				client, err = ssh.Dial("unix", tt.config.Addr, sshClientConfig)
-			default:
-				if !strings.Contains(tt.config.Addr, ":") {
-					tt.config.Addr = ":" + tt.config.Addr
-				}
-				client, err = ssh.Dial("tcp", tt.config.Addr, sshClientConfig)
-			}
-
-			if tt.wantErr {
-				assert.Error(t, err)
-				if tt.errContains != "" {
-					assert.Contains(t, err.Error(), tt.errContains)
-				}
-				return
-			}
-
-			require.NoError(t, err)
-			require.NotNil(t, client)
-			client.Close()
-		})
-	}
-}
-
-/////////////////////////////////////////////////////////////////
-//////////////////// ParseKeys Tests ////////////////////////////
-/////////////////////////////////////////////////////////////////
-
-// Helper function to generate a temporary file with content
-func createTempFile(content string) (string, error) {
-	tmpFile, err := os.CreateTemp("", "ssh_keys_*.txt")
-	if err != nil {
-		return "", fmt.Errorf("failed to create temp file: %w", err)
-	}
-	defer tmpFile.Close()
-
-	if _, err := tmpFile.WriteString(content); err != nil {
-		return "", fmt.Errorf("failed to write to temp file: %w", err)
-	}
-
-	return tmpFile.Name(), nil
-}
-
-// Test case 1: String with a single SSH key
-func TestParseSingleKeyFromString(t *testing.T) {
-	input := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo"
-	keys, err := ParseKeys(input)
-	if err != nil {
-		t.Fatalf("Expected no error, got: %v", err)
-	}
-	if len(keys) != 1 {
-		t.Fatalf("Expected 1 key, got %d keys", len(keys))
-	}
-	if keys[0].Type() != "ssh-ed25519" {
-		t.Fatalf("Expected key type 'ssh-ed25519', got '%s'", keys[0].Type())
-	}
-}
-
-// Test case 2: String with multiple SSH keys
-func TestParseMultipleKeysFromString(t *testing.T) {
-	input := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D \n #comment\n ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D"
-	keys, err := ParseKeys(input)
-	if err != nil {
-		t.Fatalf("Expected no error, got: %v", err)
-	}
-	if len(keys) != 3 {
-		t.Fatalf("Expected 3 keys, got %d keys", len(keys))
-	}
-	if keys[0].Type() != "ssh-ed25519" || keys[1].Type() != "ssh-ed25519" || keys[2].Type() != "ssh-ed25519" {
-		t.Fatalf("Unexpected key types: %s, %s, %s", keys[0].Type(), keys[1].Type(), keys[2].Type())
-	}
-}
-
-// Test case 3: File with a single SSH key
-func TestParseSingleKeyFromFile(t *testing.T) {
-	content := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo"
-	filePath, err := createTempFile(content)
-	if err != nil {
-		t.Fatalf("Failed to create temp file: %v", err)
-	}
-	defer os.Remove(filePath) // Clean up the file after the test
-
-	// Read the file content
-	fileContent, err := os.ReadFile(filePath)
-	if err != nil {
-		t.Fatalf("Failed to read temp file: %v", err)
-	}
-
-	// Parse the keys
-	keys, err := ParseKeys(string(fileContent))
-	if err != nil {
-		t.Fatalf("Expected no error, got: %v", err)
-	}
-	if len(keys) != 1 {
-		t.Fatalf("Expected 1 key, got %d keys", len(keys))
-	}
-	if keys[0].Type() != "ssh-ed25519" {
-		t.Fatalf("Expected key type 'ssh-ed25519', got '%s'", keys[0].Type())
-	}
-}
-
-// Test case 4: File with multiple SSH keys
-func TestParseMultipleKeysFromFile(t *testing.T) {
-	content := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCBM91kukN7hbvFKtbpEeo2JXjCcNxXcdBH7V7ADMBo\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D \n #comment\n ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDMtAOQfxDlCxe+A5lVbUY/DHxK1LAF2Z3AV0FYv36D"
-	filePath, err := createTempFile(content)
-	if err != nil {
-		t.Fatalf("Failed to create temp file: %v", err)
-	}
-	// defer os.Remove(filePath) // Clean up the file after the test
-
-	// Read the file content
-	fileContent, err := os.ReadFile(filePath)
-	if err != nil {
-		t.Fatalf("Failed to read temp file: %v", err)
-	}
-
-	// Parse the keys
-	keys, err := ParseKeys(string(fileContent))
-	if err != nil {
-		t.Fatalf("Expected no error, got: %v", err)
-	}
-	if len(keys) != 3 {
-		t.Fatalf("Expected 3 keys, got %d keys", len(keys))
-	}
-	if keys[0].Type() != "ssh-ed25519" || keys[1].Type() != "ssh-ed25519" || keys[2].Type() != "ssh-ed25519" {
-		t.Fatalf("Unexpected key types: %s, %s, %s", keys[0].Type(), keys[1].Type(), keys[2].Type())
-	}
-}
-
-// Test case 5: Invalid SSH key input
-func TestParseInvalidKey(t *testing.T) {
-	input := "invalid-key-data"
-	_, err := ParseKeys(input)
-	if err == nil {
-		t.Fatalf("Expected an error for invalid key, got nil")
-	}
-	expectedErrMsg := "failed to parse key"
-	if !strings.Contains(err.Error(), expectedErrMsg) {
-		t.Fatalf("Expected error message to contain '%s', got: %v", expectedErrMsg, err)
-	}
-}

beszel/internal/agent/system.go

@@ -1,304 +0,0 @@
-package agent
-
-import (
-	"beszel"
-	"beszel/internal/entities/system"
-	"bufio"
-	"fmt"
-	"log/slog"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/shirou/gopsutil/v4/cpu"
-	"github.com/shirou/gopsutil/v4/disk"
-	"github.com/shirou/gopsutil/v4/host"
-	"github.com/shirou/gopsutil/v4/mem"
-	psutilNet "github.com/shirou/gopsutil/v4/net"
-	"github.com/shirou/gopsutil/v4/sensors"
-)
-
-// Sets initial / non-changing values about the host system
-func (a *Agent) initializeSystemInfo() {
-	a.systemInfo.AgentVersion = beszel.Version
-	a.systemInfo.Hostname, _ = os.Hostname()
-	a.systemInfo.KernelVersion, _ = host.KernelVersion()
-
-	// cpu model
-	if info, err := cpu.Info(); err == nil && len(info) > 0 {
-		a.systemInfo.CpuModel = info[0].ModelName
-	}
-	// cores / threads
-	a.systemInfo.Cores, _ = cpu.Counts(false)
-	if threads, err := cpu.Counts(true); err == nil {
-		if threads > 0 && threads < a.systemInfo.Cores {
-			// in lxc logical cores reflects container limits, so use that as cores if lower
-			a.systemInfo.Cores = threads
-		} else {
-			a.systemInfo.Threads = threads
-		}
-	}
-
-	// zfs
-	if _, err := getARCSize(); err == nil {
-		a.zfs = true
-	} else {
-		slog.Debug("Not monitoring ZFS ARC", "err", err)
-	}
-}
-
-// Returns current info, stats about the host system
-func (a *Agent) getSystemStats() system.Stats {
-	systemStats := system.Stats{}
-
-	// cpu percent
-	cpuPct, err := cpu.Percent(0, false)
-	if err != nil {
-		slog.Error("Error getting cpu percent", "err", err)
-	} else if len(cpuPct) > 0 {
-		systemStats.Cpu = twoDecimals(cpuPct[0])
-	}
-
-	// memory
-	if v, err := mem.VirtualMemory(); err == nil {
-		// swap
-		systemStats.Swap = bytesToGigabytes(v.SwapTotal)
-		systemStats.SwapUsed = bytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
-		// cache + buffers value for default mem calculation
-		cacheBuff := v.Total - v.Free - v.Used
-		// htop memory calculation overrides
-		if a.memCalc == "htop" {
-			// note: gopsutil automatically adds SReclaimable to v.Cached
-			cacheBuff = v.Cached + v.Buffers - v.Shared
-			v.Used = v.Total - (v.Free + cacheBuff)
-			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
-		}
-		// subtract ZFS ARC size from used memory and add as its own category
-		if a.zfs {
-			if arcSize, _ := getARCSize(); arcSize > 0 && arcSize < v.Used {
-				v.Used = v.Used - arcSize
-				v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
-				systemStats.MemZfsArc = bytesToGigabytes(arcSize)
-			}
-		}
-		systemStats.Mem = bytesToGigabytes(v.Total)
-		systemStats.MemBuffCache = bytesToGigabytes(cacheBuff)
-		systemStats.MemUsed = bytesToGigabytes(v.Used)
-		systemStats.MemPct = twoDecimals(v.UsedPercent)
-	}
-
-	// disk usage
-	for _, stats := range a.fsStats {
-		if d, err := disk.Usage(stats.Mountpoint); err == nil {
-			stats.DiskTotal = bytesToGigabytes(d.Total)
-			stats.DiskUsed = bytesToGigabytes(d.Used)
-			if stats.Root {
-				systemStats.DiskTotal = bytesToGigabytes(d.Total)
-				systemStats.DiskUsed = bytesToGigabytes(d.Used)
-				systemStats.DiskPct = twoDecimals(d.UsedPercent)
-			}
-		} else {
-			// reset stats if error (likely unmounted)
-			slog.Error("Error getting disk stats", "name", stats.Mountpoint, "err", err)
-			stats.DiskTotal = 0
-			stats.DiskUsed = 0
-			stats.TotalRead = 0
-			stats.TotalWrite = 0
-		}
-	}
-
-	// disk i/o
-	if ioCounters, err := disk.IOCounters(a.fsNames...); err == nil {
-		for _, d := range ioCounters {
-			stats := a.fsStats[d.Name]
-			if stats == nil {
-				continue
-			}
-			secondsElapsed := time.Since(stats.Time).Seconds()
-			readPerSecond := bytesToMegabytes(float64(d.ReadBytes-stats.TotalRead) / secondsElapsed)
-			writePerSecond := bytesToMegabytes(float64(d.WriteBytes-stats.TotalWrite) / secondsElapsed)
-			// check for invalid values and reset stats if so
-			if readPerSecond < 0 || writePerSecond < 0 || readPerSecond > 50_000 || writePerSecond > 50_000 {
-				slog.Warn("Invalid disk I/O. Resetting.", "name", d.Name, "read", readPerSecond, "write", writePerSecond)
-				a.initializeDiskIoStats(ioCounters)
-				break
-			}
-			stats.Time = time.Now()
-			stats.DiskReadPs = readPerSecond
-			stats.DiskWritePs = writePerSecond
-			stats.TotalRead = d.ReadBytes
-			stats.TotalWrite = d.WriteBytes
-			// if root filesystem, update system stats
-			if stats.Root {
-				systemStats.DiskReadPs = stats.DiskReadPs
-				systemStats.DiskWritePs = stats.DiskWritePs
-			}
-		}
-	}
-
-	// network stats
-	if len(a.netInterfaces) == 0 {
-		// if no network interfaces, initialize again
-		// this is a fix if agent started before network is online (#466)
-		// maybe refactor this in the future to not cache interface names at all so we
-		// don't miss an interface that's been added after agent started in any circumstance
-		a.initializeNetIoStats()
-	}
-	if netIO, err := psutilNet.IOCounters(true); err == nil {
-		secondsElapsed := time.Since(a.netIoStats.Time).Seconds()
-		a.netIoStats.Time = time.Now()
-		bytesSent := uint64(0)
-		bytesRecv := uint64(0)
-		// sum all bytes sent and received
-		for _, v := range netIO {
-			// skip if not in valid network interfaces list
-			if _, exists := a.netInterfaces[v.Name]; !exists {
-				continue
-			}
-			bytesSent += v.BytesSent
-			bytesRecv += v.BytesRecv
-		}
-		// add to systemStats
-		sentPerSecond := float64(bytesSent-a.netIoStats.BytesSent) / secondsElapsed
-		recvPerSecond := float64(bytesRecv-a.netIoStats.BytesRecv) / secondsElapsed
-		networkSentPs := bytesToMegabytes(sentPerSecond)
-		networkRecvPs := bytesToMegabytes(recvPerSecond)
-		// add check for issue (#150) where sent is a massive number
-		if networkSentPs > 10_000 || networkRecvPs > 10_000 {
-			slog.Warn("Invalid net stats. Resetting.", "sent", networkSentPs, "recv", networkRecvPs)
-			for _, v := range netIO {
-				if _, exists := a.netInterfaces[v.Name]; !exists {
-					continue
-				}
-				slog.Info(v.Name, "recv", v.BytesRecv, "sent", v.BytesSent)
-			}
-			// reset network I/O stats
-			a.initializeNetIoStats()
-		} else {
-			systemStats.NetworkSent = networkSentPs
-			systemStats.NetworkRecv = networkRecvPs
-			// update netIoStats
-			a.netIoStats.BytesSent = bytesSent
-			a.netIoStats.BytesRecv = bytesRecv
-		}
-	}
-
-	// temperatures (skip if sensors whitelist is set to empty string)
-	err = a.updateTemperatures(&systemStats)
-	if err != nil {
-		slog.Error("Error getting temperatures", "err", err)
-	}
-
-	// GPU data
-	if a.gpuManager != nil {
-		// reset high gpu percent
-		a.systemInfo.GpuPct = 0
-		// get current GPU data
-		if gpuData := a.gpuManager.GetCurrentData(); len(gpuData) > 0 {
-			systemStats.GPUData = gpuData
-
-			// add temperatures
-			if systemStats.Temperatures == nil {
-				systemStats.Temperatures = make(map[string]float64, len(gpuData))
-			}
-			for _, gpu := range gpuData {
-				if gpu.Temperature > 0 {
-					systemStats.Temperatures[gpu.Name] = gpu.Temperature
-				}
-				// update high gpu percent for dashboard
-				a.systemInfo.GpuPct = max(a.systemInfo.GpuPct, gpu.Usage)
-			}
-		}
-	}
-
-	// update base system info
-	a.systemInfo.Cpu = systemStats.Cpu
-	a.systemInfo.MemPct = systemStats.MemPct
-	a.systemInfo.DiskPct = systemStats.DiskPct
-	a.systemInfo.Uptime, _ = host.Uptime()
-	a.systemInfo.Bandwidth = twoDecimals(systemStats.NetworkSent + systemStats.NetworkRecv)
-	slog.Debug("sysinfo", "data", a.systemInfo)
-
-	return systemStats
-}
-
-func (a *Agent) updateTemperatures(systemStats *system.Stats) error {
-	// skip if sensors whitelist is set to empty string
-	if a.sensorsWhitelist != nil && len(a.sensorsWhitelist) == 0 {
-		slog.Debug("Skipping temperature collection")
-		return nil
-	}
-
-	primarySensor, primarySensorIsDefined := GetEnv("PRIMARY_SENSOR")
-
-	// reset high temp
-	a.systemInfo.DashboardTemp = 0
-
-	// get sensor data
-	temps, err := sensors.TemperaturesWithContext(a.sensorsContext)
-	if err != nil {
-		return err
-	}
-	slog.Debug("Temperature", "sensors", temps)
-
-	// return if no sensors
-	if len(temps) == 0 {
-		return nil
-	}
-
-	systemStats.Temperatures = make(map[string]float64, len(temps))
-	for i, sensor := range temps {
-		// skip if temperature is unreasonable
-		if sensor.Temperature <= 0 || sensor.Temperature >= 200 {
-			continue
-		}
-		sensorName := sensor.SensorKey
-		if _, ok := systemStats.Temperatures[sensorName]; ok {
-			// if key already exists, append int to key
-			sensorName = sensorName + "_" + strconv.Itoa(i)
-		}
-		// skip if not in whitelist
-		if a.sensorsWhitelist != nil {
-			if _, nameInWhitelist := a.sensorsWhitelist[sensorName]; !nameInWhitelist {
-				continue
-			}
-		}
-		// set dashboard temperature
-		if primarySensorIsDefined {
-			if sensorName == primarySensor {
-				a.systemInfo.DashboardTemp = sensor.Temperature
-			}
-		} else {
-			a.systemInfo.DashboardTemp = max(a.systemInfo.DashboardTemp, sensor.Temperature)
-		}
-		systemStats.Temperatures[sensorName] = twoDecimals(sensor.Temperature)
-	}
-	return nil
-}
-
-// Returns the size of the ZFS ARC memory cache in bytes
-func getARCSize() (uint64, error) {
-	file, err := os.Open("/proc/spl/kstat/zfs/arcstats")
-	if err != nil {
-		return 0, err
-	}
-	defer file.Close()
-
-	// Scan the lines
-	scanner := bufio.NewScanner(file)
-	for scanner.Scan() {
-		line := scanner.Text()
-		if strings.HasPrefix(line, "size") {
-			// Example line: size 4 15032385536
-			fields := strings.Fields(line)
-			if len(fields) < 3 {
-				return 0, err
-			}
-			// Return the size as uint64
-			return strconv.ParseUint(fields[2], 10, 64)
-		}
-	}
-
-	return 0, fmt.Errorf("failed to parse size field")
-}

beszel/internal/agent/update.go

@@ -1,56 +0,0 @@
-package agent
-
-import (
-	"beszel"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/blang/semver"
-	"github.com/rhysd/go-github-selfupdate/selfupdate"
-)
-
-// Update updates beszel-agent to the latest version
-func Update() {
-	var latest *selfupdate.Release
-	var found bool
-	var err error
-	currentVersion := semver.MustParse(beszel.Version)
-	fmt.Println("beszel-agent", currentVersion)
-	fmt.Println("Checking for updates...")
-	updater, _ := selfupdate.NewUpdater(selfupdate.Config{
-		Filters: []string{"beszel-agent"},
-	})
-	latest, found, err = updater.DetectLatest("henrygd/beszel")
-
-	if err != nil {
-		fmt.Println("Error checking for updates:", err)
-		os.Exit(1)
-	}
-
-	if !found {
-		fmt.Println("No updates found")
-		os.Exit(0)
-	}
-
-	fmt.Println("Latest version:", latest.Version)
-
-	if latest.Version.LTE(currentVersion) {
-		fmt.Println("You are up to date")
-		return
-	}
-
-	var binaryPath string
-	fmt.Printf("Updating from %s to %s...\n", currentVersion, latest.Version)
-	binaryPath, err = os.Executable()
-	if err != nil {
-		fmt.Println("Error getting binary path:", err)
-		os.Exit(1)
-	}
-	err = selfupdate.UpdateTo(latest.AssetURL, binaryPath)
-	if err != nil {
-		fmt.Println("Please try rerunning with sudo. Error:", err)
-		os.Exit(1)
-	}
-	fmt.Printf("Successfully updated to %s\n\n%s\n", latest.Version, strings.TrimSpace(latest.ReleaseNotes))
-}

beszel/internal/entities/container/container.go

@@ -1,134 +0,0 @@
-package container
-
-import "time"
-
-// Docker container info from /containers/json
-type ApiInfo struct {
-	Id      string
-	IdShort string
-	Names   []string
-	Status  string
-	// Image   string
-	// ImageID string
-	// Command string
-	// Created int64
-	// Ports      []Port
-	// SizeRw     int64 `json:",omitempty"`
-	// SizeRootFs int64 `json:",omitempty"`
-	// Labels     map[string]string
-	// State      string
-	// HostConfig struct {
-	// 	NetworkMode string            `json:",omitempty"`
-	// 	Annotations map[string]string `json:",omitempty"`
-	// }
-	// NetworkSettings *SummaryNetworkSettings
-	// Mounts          []MountPoint
-}
-
-// Docker container resources from /containers/{id}/stats
-type ApiStats struct {
-	// Common stats
-	// Read    time.Time `json:"read"`
-	// PreRead time.Time `json:"preread"`
-
-	// Linux specific stats, not populated on Windows.
-	// PidsStats  PidsStats  `json:"pids_stats,omitempty"`
-	// BlkioStats BlkioStats `json:"blkio_stats,omitempty"`
-
-	// Windows specific stats, not populated on Linux.
-	// NumProcs uint32 `json:"num_procs"`
-	// StorageStats StorageStats `json:"storage_stats,omitempty"`
-	// Networks request version >=1.21
-	Networks map[string]NetworkStats
-
-	// Shared stats
-	CPUStats CPUStats `json:"cpu_stats,omitempty"`
-	// PreCPUStats CPUStats    `json:"precpu_stats,omitempty"` // "Pre"="Previous"
-	MemoryStats MemoryStats `json:"memory_stats,omitempty"`
-}
-
-type CPUStats struct {
-	// CPU Usage. Linux and Windows.
-	CPUUsage CPUUsage `json:"cpu_usage"`
-
-	// System Usage. Linux only.
-	SystemUsage uint64 `json:"system_cpu_usage,omitempty"`
-
-	// Online CPUs. Linux only.
-	// OnlineCPUs uint32 `json:"online_cpus,omitempty"`
-
-	// Throttling Data. Linux only.
-	// ThrottlingData ThrottlingData `json:"throttling_data,omitempty"`
-}
-
-type CPUUsage struct {
-	// Total CPU time consumed.
-	// Units: nanoseconds (Linux)
-	// Units: 100's of nanoseconds (Windows)
-	TotalUsage uint64 `json:"total_usage"`
-
-	// Total CPU time consumed per core (Linux). Not used on Windows.
-	// Units: nanoseconds.
-	// PercpuUsage []uint64 `json:"percpu_usage,omitempty"`
-
-	// Time spent by tasks of the cgroup in kernel mode (Linux).
-	// Time spent by all container processes in kernel mode (Windows).
-	// Units: nanoseconds (Linux).
-	// Units: 100's of nanoseconds (Windows). Not populated for Hyper-V Containers.
-	// UsageInKernelmode uint64 `json:"usage_in_kernelmode"`
-
-	// Time spent by tasks of the cgroup in user mode (Linux).
-	// Time spent by all container processes in user mode (Windows).
-	// Units: nanoseconds (Linux).
-	// Units: 100's of nanoseconds (Windows). Not populated for Hyper-V Containers
-	// UsageInUsermode uint64 `json:"usage_in_usermode"`
-}
-
-type MemoryStats struct {
-	// current res_counter usage for memory
-	Usage uint64 `json:"usage,omitempty"`
-	// all the stats exported via memory.stat.
-	Stats MemoryStatsStats `json:"stats,omitempty"`
-	// maximum usage ever recorded.
-	// MaxUsage uint64 `json:"max_usage,omitempty"`
-	// TODO(vishh): Export these as stronger types.
-	// number of times memory usage hits limits.
-	// Failcnt uint64 `json:"failcnt,omitempty"`
-	// Limit   uint64 `json:"limit,omitempty"`
-
-	// // committed bytes
-	// Commit uint64 `json:"commitbytes,omitempty"`
-	// // peak committed bytes
-	// CommitPeak uint64 `json:"commitpeakbytes,omitempty"`
-	// // private working set
-	// PrivateWorkingSet uint64 `json:"privateworkingset,omitempty"`
-}
-
-type MemoryStatsStats struct {
-	Cache        uint64 `json:"cache,omitempty"`
-	InactiveFile uint64 `json:"inactive_file,omitempty"`
-}
-
-type NetworkStats struct {
-	// Bytes received. Windows and Linux.
-	RxBytes uint64 `json:"rx_bytes"`
-	// Bytes sent. Windows and Linux.
-	TxBytes uint64 `json:"tx_bytes"`
-}
-
-type prevNetStats struct {
-	Sent uint64
-	Recv uint64
-	Time time.Time
-}
-
-// Docker container stats
-type Stats struct {
-	Name        string       `json:"n"`
-	Cpu         float64      `json:"c"`
-	Mem         float64      `json:"m"`
-	NetworkSent float64      `json:"ns"`
-	NetworkRecv float64      `json:"nr"`
-	PrevCpu     [2]uint64    `json:"-"`
-	PrevNet     prevNetStats `json:"-"`
-}

beszel/internal/entities/system/system.go

@@ -1,89 +0,0 @@
-package system
-
-// TODO: this is confusing, make common package with common/types common/helpers etc
-
-import (
-	"beszel/internal/entities/container"
-	"time"
-)
-
-type Stats struct {
-	Cpu            float64             `json:"cpu"`
-	MaxCpu         float64             `json:"cpum,omitempty"`
-	Mem            float64             `json:"m"`
-	MemUsed        float64             `json:"mu"`
-	MemPct         float64             `json:"mp"`
-	MemBuffCache   float64             `json:"mb"`
-	MemZfsArc      float64             `json:"mz,omitempty"` // ZFS ARC memory
-	Swap           float64             `json:"s,omitempty"`
-	SwapUsed       float64             `json:"su,omitempty"`
-	DiskTotal      float64             `json:"d"`
-	DiskUsed       float64             `json:"du"`
-	DiskPct        float64             `json:"dp"`
-	DiskReadPs     float64             `json:"dr"`
-	DiskWritePs    float64             `json:"dw"`
-	MaxDiskReadPs  float64             `json:"drm,omitempty"`
-	MaxDiskWritePs float64             `json:"dwm,omitempty"`
-	NetworkSent    float64             `json:"ns"`
-	NetworkRecv    float64             `json:"nr"`
-	MaxNetworkSent float64             `json:"nsm,omitempty"`
-	MaxNetworkRecv float64             `json:"nrm,omitempty"`
-	Temperatures   map[string]float64  `json:"t,omitempty"`
-	ExtraFs        map[string]*FsStats `json:"efs,omitempty"`
-	GPUData        map[string]GPUData  `json:"g,omitempty"`
-}
-
-type GPUData struct {
-	Name        string  `json:"n"`
-	Temperature float64 `json:"-"`
-	MemoryUsed  float64 `json:"mu,omitempty"`
-	MemoryTotal float64 `json:"mt,omitempty"`
-	Usage       float64 `json:"u"`
-	Power       float64 `json:"p,omitempty"`
-	Count       float64 `json:"-"`
-}
-
-type FsStats struct {
-	Time           time.Time `json:"-"`
-	Root           bool      `json:"-"`
-	Mountpoint     string    `json:"-"`
-	DiskTotal      float64   `json:"d"`
-	DiskUsed       float64   `json:"du"`
-	TotalRead      uint64    `json:"-"`
-	TotalWrite     uint64    `json:"-"`
-	DiskReadPs     float64   `json:"r"`
-	DiskWritePs    float64   `json:"w"`
-	MaxDiskReadPS  float64   `json:"rm,omitempty"`
-	MaxDiskWritePS float64   `json:"wm,omitempty"`
-}
-
-type NetIoStats struct {
-	BytesRecv uint64
-	BytesSent uint64
-	Time      time.Time
-	Name      string
-}
-
-type Info struct {
-	Hostname      string  `json:"h"`
-	KernelVersion string  `json:"k,omitempty"`
-	Cores         int     `json:"c"`
-	Threads       int     `json:"t,omitempty"`
-	CpuModel      string  `json:"m"`
-	Uptime        uint64  `json:"u"`
-	Cpu           float64 `json:"cpu"`
-	MemPct        float64 `json:"mp"`
-	DiskPct       float64 `json:"dp"`
-	Bandwidth     float64 `json:"b"`
-	AgentVersion  string  `json:"v"`
-	Podman        bool    `json:"p,omitempty"`
-	GpuPct        float64 `json:"g,omitempty"`
-	DashboardTemp float64 `json:"dt,omitempty"`
-}
-
-// Final data structure to return to the hub
-type CombinedData struct {
-	Stats      Stats              `json:"stats"`
-	Info       Info               `json:"info"`
-	Containers []*container.Stats `json:"container"`
-}

beszel/internal/hub/hub.go

@@ -1,304 +0,0 @@
-// Package hub handles updating systems and serving the web UI.
-package hub
-
-import (
-	"beszel"
-	"beszel/internal/alerts"
-	"beszel/internal/hub/systems"
-	"beszel/internal/records"
-	"beszel/internal/users"
-	"beszel/site"
-	"crypto/ed25519"
-	"encoding/pem"
-	"fmt"
-	"io/fs"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"os"
-	"strings"
-
-	"github.com/pocketbase/pocketbase"
-	"github.com/pocketbase/pocketbase/apis"
-	"github.com/pocketbase/pocketbase/core"
-	"golang.org/x/crypto/ssh"
-)
-
-type Hub struct {
-	core.App
-	*alerts.AlertManager
-	um     *users.UserManager
-	rm     *records.RecordManager
-	sm     *systems.SystemManager
-	pubKey string
-	appURL string
-}
-
-// NewHub creates a new Hub instance with default configuration
-func NewHub(app core.App) *Hub {
-	hub := &Hub{}
-	hub.App = app
-
-	hub.AlertManager = alerts.NewAlertManager(hub)
-	hub.um = users.NewUserManager(hub)
-	hub.rm = records.NewRecordManager(hub)
-	hub.sm = systems.NewSystemManager(hub)
-	hub.appURL, _ = GetEnv("APP_URL")
-	return hub
-}
-
-// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
-func GetEnv(key string) (value string, exists bool) {
-	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
-		return value, exists
-	}
-	// Fallback to the old unprefixed key
-	return os.LookupEnv(key)
-}
-
-func (h *Hub) BootstrapHub() (*Hub, error) {
-	if !h.App.IsBootstrapped() {
-		err := h.App.Bootstrap()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// initial setup
-	if err := h.initialize(); err != nil {
-		return nil, err
-	}
-
-	// serve web ui
-	h.OnServe().BindFunc(h.startServer)
-	// set up scheduled jobs
-	h.OnServe().BindFunc(h.registerCronJobs)
-	// custom api routes
-	h.OnServe().BindFunc(h.registerApiRoutes)
-	// TODO: move to users package
-	// handle default values for user / user_settings creation
-	h.OnRecordCreate("users").BindFunc(h.um.InitializeUserRole)
-	h.OnRecordCreate("user_settings").BindFunc(h.um.InitializeUserSettings)
-
-	// sync systems with config
-	h.syncSystemsWithConfig()
-	// start system updates
-	h.sm.Initialize()
-
-	return h, nil
-}
-
-// initialize sets up initial configuration (collections, settings, etc.)
-func (h *Hub) initialize() error {
-	// set general settings
-	settings := h.Settings()
-	// batch requests (for global alerts)
-	settings.Batch.Enabled = true
-	// set URL if BASE_URL env is set
-	if h.appURL != "" {
-		settings.Meta.AppURL = h.appURL
-	}
-	// set auth settings
-	usersCollection, err := h.FindCollectionByNameOrId("users")
-	if err != nil {
-		return err
-	}
-	// disable email auth if DISABLE_PASSWORD_AUTH env var is set
-	disablePasswordAuth, _ := GetEnv("DISABLE_PASSWORD_AUTH")
-	usersCollection.PasswordAuth.Enabled = disablePasswordAuth != "true"
-	usersCollection.PasswordAuth.IdentityFields = []string{"email"}
-	// disable oauth if no providers are configured (todo: remove this in post 0.9.0 release)
-	if usersCollection.OAuth2.Enabled {
-		usersCollection.OAuth2.Enabled = len(usersCollection.OAuth2.Providers) > 0
-	}
-	// allow oauth user creation if USER_CREATION is set
-	if userCreation, _ := GetEnv("USER_CREATION"); userCreation == "true" {
-		cr := "@request.context = 'oauth2'"
-		usersCollection.CreateRule = &cr
-	} else {
-		usersCollection.CreateRule = nil
-	}
-	if err := h.Save(usersCollection); err != nil {
-		return err
-	}
-	// allow all users to access systems if SHARE_ALL_SYSTEMS is set
-	systemsCollection, err := h.FindCachedCollectionByNameOrId("systems")
-	if err != nil {
-		return err
-	}
-	shareAllSystems, _ := GetEnv("SHARE_ALL_SYSTEMS")
-	systemsReadRule := "@request.auth.id != \"\""
-	if shareAllSystems != "true" {
-		// default is to only show systems that the user id is assigned to
-		systemsReadRule += " && users.id ?= @request.auth.id"
-	}
-	updateDeleteRule := systemsReadRule + " && @request.auth.role != \"readonly\""
-	systemsCollection.ListRule = &systemsReadRule
-	systemsCollection.ViewRule = &systemsReadRule
-	systemsCollection.UpdateRule = &updateDeleteRule
-	systemsCollection.DeleteRule = &updateDeleteRule
-	if err := h.Save(systemsCollection); err != nil {
-		return err
-	}
-	return nil
-}
-
-// Start starts the hub application / server
-func (h *Hub) Start() error {
-	// Use type assertion to access the Start method
-	if pb, ok := h.App.(*pocketbase.PocketBase); ok {
-		return pb.Start()
-	}
-	return fmt.Errorf("unable to start: App is not *pocketbase.PocketBase")
-}
-
-func (h *Hub) startServer(se *core.ServeEvent) error {
-	switch h.IsDev() {
-	case true:
-		proxy := httputil.NewSingleHostReverseProxy(&url.URL{
-			Scheme: "http",
-			Host:   "localhost:5173",
-		})
-		se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
-			proxy.ServeHTTP(e.Response, e.Request)
-			return nil
-		})
-	default:
-		// parse app url
-		parsedURL, err := url.Parse(h.appURL)
-		if err != nil {
-			return err
-		}
-		// fix base paths in html if using subpath
-		basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
-		indexFile, _ := fs.ReadFile(site.DistDirFS, "index.html")
-		indexContent := strings.ReplaceAll(string(indexFile), "./", basePath)
-		// set up static asset serving
-		staticPaths := [2]string{"/static/", "/assets/"}
-		serveStatic := apis.Static(site.DistDirFS, false)
-		// get CSP configuration
-		csp, cspExists := GetEnv("CSP")
-		// add route
-		se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
-			// serve static assets if path is in staticPaths
-			for i := range staticPaths {
-				if strings.Contains(e.Request.URL.Path, staticPaths[i]) {
-					e.Response.Header().Set("Cache-Control", "public, max-age=2592000")
-					return serveStatic(e)
-				}
-			}
-			if cspExists {
-				e.Response.Header().Del("X-Frame-Options")
-				e.Response.Header().Set("Content-Security-Policy", csp)
-			}
-			return e.HTML(http.StatusOK, indexContent)
-		})
-	}
-	return se.Next()
-}
-
-// registerCronJobs sets up all scheduled tasks
-func (h *Hub) registerCronJobs(se *core.ServeEvent) error {
-	// delete old records once every hour
-	h.Cron().MustAdd("delete old records", "8 * * * *", h.rm.DeleteOldRecords)
-	// create longer records every 10 minutes
-	h.Cron().MustAdd("create longer records", "*/10 * * * *", h.rm.CreateLongerRecords)
-	return se.Next()
-}
-
-// custom api routes
-func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
-	// returns public key and version
-	se.Router.GET("/api/beszel/getkey", func(e *core.RequestEvent) error {
-		info, _ := e.RequestInfo()
-		if info.Auth == nil {
-			return apis.NewForbiddenError("Forbidden", nil)
-		}
-		return e.JSON(http.StatusOK, map[string]string{"key": h.pubKey, "v": beszel.Version})
-	})
-	// check if first time setup on login page
-	se.Router.GET("/api/beszel/first-run", func(e *core.RequestEvent) error {
-		total, err := h.CountRecords("users")
-		return e.JSON(http.StatusOK, map[string]bool{"firstRun": err == nil && total == 0})
-	})
-	// send test notification
-	se.Router.GET("/api/beszel/send-test-notification", h.SendTestNotification)
-	// API endpoint to get config.yml content
-	se.Router.GET("/api/beszel/config-yaml", h.getYamlConfig)
-	// create first user endpoint only needed if no users exist
-	if totalUsers, _ := h.CountRecords("users"); totalUsers == 0 {
-		se.Router.POST("/api/beszel/create-user", h.um.CreateFirstUser)
-	}
-	return se.Next()
-}
-
-// generates key pair if it doesn't exist and returns private key bytes
-func (h *Hub) GetSSHKey() ([]byte, error) {
-	dataDir := h.DataDir()
-	// check if the key pair already exists
-	existingKey, err := os.ReadFile(dataDir + "/id_ed25519")
-	if err == nil {
-		if pubKey, err := os.ReadFile(h.DataDir() + "/id_ed25519.pub"); err == nil {
-			h.pubKey = strings.TrimSuffix(string(pubKey), "\n")
-		}
-		// return existing private key
-		return existingKey, nil
-	}
-
-	// Generate the Ed25519 key pair
-	pubKey, privKey, err := ed25519.GenerateKey(nil)
-	if err != nil {
-		// h.Logger().Error("Error generating key pair:", "err", err.Error())
-		return nil, err
-	}
-
-	// Get the private key in OpenSSH format
-	privKeyBytes, err := ssh.MarshalPrivateKey(privKey, "")
-	if err != nil {
-		// h.Logger().Error("Error marshaling private key:", "err", err.Error())
-		return nil, err
-	}
-
-	// Save the private key to a file
-	privateFile, err := os.Create(dataDir + "/id_ed25519")
-	if err != nil {
-		// h.Logger().Error("Error creating private key file:", "err", err.Error())
-		return nil, err
-	}
-	defer privateFile.Close()
-
-	if err := pem.Encode(privateFile, privKeyBytes); err != nil {
-		// h.Logger().Error("Error writing private key to file:", "err", err.Error())
-		return nil, err
-	}
-
-	// Generate the public key in OpenSSH format
-	publicKey, err := ssh.NewPublicKey(pubKey)
-	if err != nil {
-		return nil, err
-	}
-
-	pubKeyBytes := ssh.MarshalAuthorizedKey(publicKey)
-	h.pubKey = strings.TrimSuffix(string(pubKeyBytes), "\n")
-
-	// Save the public key to a file
-	publicFile, err := os.Create(dataDir + "/id_ed25519.pub")
-	if err != nil {
-		return nil, err
-	}
-	defer publicFile.Close()
-
-	if _, err := publicFile.Write(pubKeyBytes); err != nil {
-		return nil, err
-	}
-
-	h.Logger().Info("ed25519 SSH key pair generated successfully.")
-	h.Logger().Info("Private key saved to: " + dataDir + "/id_ed25519")
-	h.Logger().Info("Public key saved to: " + dataDir + "/id_ed25519.pub")
-
-	existingKey, err = os.ReadFile(dataDir + "/id_ed25519")
-	if err == nil {
-		return existingKey, nil
-	}
-	return nil, err
-}

beszel/internal/hub/systems/systems.go

@@ -1,435 +0,0 @@
-package systems
-
-import (
-	"beszel/internal/entities/system"
-	"context"
-	"fmt"
-	"net"
-	"strings"
-	"time"
-
-	"github.com/goccy/go-json"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/store"
-	"golang.org/x/crypto/ssh"
-)
-
-const (
-	up      string = "up"
-	down    string = "down"
-	paused  string = "paused"
-	pending string = "pending"
-
-	interval int = 60_000
-
-	sessionTimeout = 4 * time.Second
-)
-
-type SystemManager struct {
-	hub       hubLike
-	systems   *store.Store[string, *System]
-	sshConfig *ssh.ClientConfig
-}
-
-type System struct {
-	Id      string `db:"id"`
-	Host    string `db:"host"`
-	Port    string `db:"port"`
-	Status  string `db:"status"`
-	manager *SystemManager
-	client  *ssh.Client
-	data    *system.CombinedData
-	ctx     context.Context
-	cancel  context.CancelFunc
-}
-
-type hubLike interface {
-	core.App
-	GetSSHKey() ([]byte, error)
-	HandleSystemAlerts(systemRecord *core.Record, data *system.CombinedData) error
-	HandleStatusAlerts(status string, systemRecord *core.Record) error
-}
-
-func NewSystemManager(hub hubLike) *SystemManager {
-	return &SystemManager{
-		systems: store.New(map[string]*System{}),
-		hub:     hub,
-	}
-}
-
-// Initialize initializes the system manager.
-// It binds the event hooks and starts updating existing systems.
-func (sm *SystemManager) Initialize() error {
-	sm.bindEventHooks()
-	// ssh setup
-	key, err := sm.hub.GetSSHKey()
-	if err != nil {
-		return err
-	}
-	if err := sm.createSSHClientConfig(key); err != nil {
-		return err
-	}
-	// start updating existing systems
-	var systems []*System
-	err = sm.hub.DB().NewQuery("SELECT id, host, port, status FROM systems WHERE status != 'paused'").All(&systems)
-	if err != nil || len(systems) == 0 {
-		return err
-	}
-	go func() {
-		// time between initial system updates
-		delta := interval / max(1, len(systems))
-		delta = min(delta, 2_000)
-		sleepTime := time.Duration(delta) * time.Millisecond
-		for _, system := range systems {
-			time.Sleep(sleepTime)
-			_ = sm.AddSystem(system)
-		}
-	}()
-	return nil
-}
-
-func (sm *SystemManager) bindEventHooks() {
-	sm.hub.OnRecordCreate("systems").BindFunc(sm.onRecordCreate)
-	sm.hub.OnRecordAfterCreateSuccess("systems").BindFunc(sm.onRecordAfterCreateSuccess)
-	sm.hub.OnRecordUpdate("systems").BindFunc(sm.onRecordUpdate)
-	sm.hub.OnRecordAfterUpdateSuccess("systems").BindFunc(sm.onRecordAfterUpdateSuccess)
-	sm.hub.OnRecordAfterDeleteSuccess("systems").BindFunc(sm.onRecordAfterDeleteSuccess)
-}
-
-// Runs before the record is committed to the database
-func (sm *SystemManager) onRecordCreate(e *core.RecordEvent) error {
-	e.Record.Set("info", system.Info{})
-	e.Record.Set("status", pending)
-	return e.Next()
-}
-
-// Runs after the record is committed to the database
-func (sm *SystemManager) onRecordAfterCreateSuccess(e *core.RecordEvent) error {
-	if err := sm.AddRecord(e.Record); err != nil {
-		e.App.Logger().Error("Error adding record", "err", err)
-	}
-	return e.Next()
-}
-
-// Runs before the record is updated
-func (sm *SystemManager) onRecordUpdate(e *core.RecordEvent) error {
-	if e.Record.GetString("status") == paused {
-		e.Record.Set("info", system.Info{})
-	}
-	return e.Next()
-}
-
-// Runs after the record is updated
-func (sm *SystemManager) onRecordAfterUpdateSuccess(e *core.RecordEvent) error {
-	newStatus := e.Record.GetString("status")
-	switch newStatus {
-	case paused:
-		sm.RemoveSystem(e.Record.Id)
-		return e.Next()
-	case pending:
-		if err := sm.AddRecord(e.Record); err != nil {
-			e.App.Logger().Error("Error adding record", "err", err)
-		}
-		return e.Next()
-	}
-	system, ok := sm.systems.GetOk(e.Record.Id)
-	if !ok {
-		return sm.AddRecord(e.Record)
-	}
-	prevStatus := system.Status
-	system.Status = newStatus
-	// system alerts if system is up
-	if system.Status == up {
-		if err := sm.hub.HandleSystemAlerts(e.Record, system.data); err != nil {
-			e.App.Logger().Error("Error handling system alerts", "err", err)
-		}
-	}
-	if (system.Status == down && prevStatus == up) || (system.Status == up && prevStatus == down) {
-		if err := sm.hub.HandleStatusAlerts(system.Status, e.Record); err != nil {
-			e.App.Logger().Error("Error handling status alerts", "err", err)
-		}
-	}
-	return e.Next()
-}
-
-// Runs after the record is deleted
-func (sm *SystemManager) onRecordAfterDeleteSuccess(e *core.RecordEvent) error {
-	sm.RemoveSystem(e.Record.Id)
-	return e.Next()
-}
-
-// AddSystem adds a system to the manager
-func (sm *SystemManager) AddSystem(sys *System) error {
-	if sm.systems.Has(sys.Id) {
-		return fmt.Errorf("system exists")
-	}
-	if sys.Id == "" || sys.Host == "" {
-		return fmt.Errorf("system is missing required fields")
-	}
-	sys.manager = sm
-	sys.ctx, sys.cancel = context.WithCancel(context.Background())
-	sys.data = &system.CombinedData{}
-	sm.systems.Set(sys.Id, sys)
-	go sys.StartUpdater()
-	return nil
-}
-
-// RemoveSystem removes a system from the manager
-func (sm *SystemManager) RemoveSystem(systemID string) error {
-	system, ok := sm.systems.GetOk(systemID)
-	if !ok {
-		return fmt.Errorf("system not found")
-	}
-	// cancel the context to signal stop
-	if system.cancel != nil {
-		system.cancel()
-	}
-	system.resetSSHClient()
-	sm.systems.Remove(systemID)
-	return nil
-}
-
-// AddRecord adds a record to the system manager.
-// It first removes any existing system with the same ID, then creates a new System
-// instance from the record data and adds it to the manager.
-// This function is typically called when a new system is created or when an existing
-// system's status changes to pending.
-func (sm *SystemManager) AddRecord(record *core.Record) (err error) {
-	_ = sm.RemoveSystem(record.Id)
-	system := &System{
-		Id:     record.Id,
-		Status: record.GetString("status"),
-		Host:   record.GetString("host"),
-		Port:   record.GetString("port"),
-	}
-	return sm.AddSystem(system)
-}
-
-// StartUpdater starts the system updater.
-// It first fetches the data from the agent then updates the records.
-// If the data is not found or the system is down, it sets the system down.
-func (sys *System) StartUpdater() {
-	if sys.data == nil {
-		sys.data = &system.CombinedData{}
-	}
-	if err := sys.update(); err != nil {
-		_ = sys.setDown(err)
-	}
-
-	c := time.Tick(time.Duration(interval) * time.Millisecond)
-
-	for {
-		select {
-		case <-sys.ctx.Done():
-			return
-		case <-c:
-			err := sys.update()
-			if err != nil {
-				_ = sys.setDown(err)
-			}
-		}
-	}
-}
-
-// update updates the system data and records.
-// It first fetches the data from the agent then updates the records.
-func (sys *System) update() error {
-	_, err := sys.fetchDataFromAgent()
-	if err == nil {
-		_, err = sys.createRecords()
-	}
-	return err
-}
-
-// createRecords updates the system record and adds system_stats and container_stats records
-func (sys *System) createRecords() (*core.Record, error) {
-	systemRecord, err := sys.getRecord()
-	if err != nil {
-		return nil, err
-	}
-	hub := sys.manager.hub
-	// add system_stats and container_stats records
-	systemStats, err := hub.FindCachedCollectionByNameOrId("system_stats")
-	if err != nil {
-		return nil, err
-	}
-	systemStatsRecord := core.NewRecord(systemStats)
-	systemStatsRecord.Set("system", systemRecord.Id)
-	systemStatsRecord.Set("stats", sys.data.Stats)
-	systemStatsRecord.Set("type", "1m")
-	if err := hub.SaveNoValidate(systemStatsRecord); err != nil {
-		return nil, err
-	}
-	// add new container_stats record
-	if len(sys.data.Containers) > 0 {
-		containerStats, err := hub.FindCachedCollectionByNameOrId("container_stats")
-		if err != nil {
-			return nil, err
-		}
-		containerStatsRecord := core.NewRecord(containerStats)
-		containerStatsRecord.Set("system", systemRecord.Id)
-		containerStatsRecord.Set("stats", sys.data.Containers)
-		containerStatsRecord.Set("type", "1m")
-		if err := hub.SaveNoValidate(containerStatsRecord); err != nil {
-			return nil, err
-		}
-	}
-	// update system record (do this last because it triggers alerts and we need above records to be inserted first)
-	systemRecord.Set("status", up)
-	systemRecord.Set("info", sys.data.Info)
-	if err := hub.SaveNoValidate(systemRecord); err != nil {
-		return nil, err
-	}
-	return systemRecord, nil
-}
-
-// getRecord retrieves the system record from the database.
-// If the record is not found or the system is paused, it removes the system from the manager.
-func (sys *System) getRecord() (*core.Record, error) {
-	record, err := sys.manager.hub.FindRecordById("systems", sys.Id)
-	if err != nil || record == nil {
-		_ = sys.manager.RemoveSystem(sys.Id)
-		return nil, err
-	}
-	return record, nil
-}
-
-// setDown marks a system as down in the database.
-// It takes the original error that caused the system to go down and returns any error
-// encountered during the process of updating the system status.
-func (sys *System) setDown(OriginalError error) error {
-	if sys.Status == down {
-		return nil
-	}
-	record, err := sys.getRecord()
-	if err != nil {
-		return err
-	}
-	sys.manager.hub.Logger().Error("System down", "system", record.GetString("name"), "err", OriginalError)
-	record.Set("status", down)
-	err = sys.manager.hub.SaveNoValidate(record)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-// fetchDataFromAgent fetches the data from the agent.
-// It first creates a new SSH client if it doesn't exist or the system is down.
-// Then it creates a new SSH session and fetches the data from the agent.
-// If the data is not found or the system is down, it sets the system down.
-func (sys *System) fetchDataFromAgent() (*system.CombinedData, error) {
-	maxRetries := 1
-	for attempt := 0; attempt <= maxRetries; attempt++ {
-		if sys.client == nil || sys.Status == down {
-			if err := sys.createSSHClient(); err != nil {
-				return nil, err
-			}
-		}
-
-		session, err := sys.createSessionWithTimeout(4 * time.Second)
-		if err != nil {
-			if attempt >= maxRetries {
-				return nil, err
-			}
-			sys.manager.hub.Logger().Warn("Session closed. Retrying...", "host", sys.Host, "port", sys.Port, "err", err)
-			sys.resetSSHClient()
-			continue
-		}
-		defer session.Close()
-
-		stdout, err := session.StdoutPipe()
-		if err != nil {
-			return nil, err
-		}
-		if err := session.Shell(); err != nil {
-			return nil, err
-		}
-
-		// this is initialized in startUpdater, should never be nil
-		*sys.data = system.CombinedData{}
-		if err := json.NewDecoder(stdout).Decode(sys.data); err != nil {
-			return nil, err
-		}
-		// wait for the session to complete
-		if err := session.Wait(); err != nil {
-			return nil, err
-		}
-		return sys.data, nil
-	}
-
-	// this should never be reached due to the return in the loop
-	return nil, fmt.Errorf("failed to fetch data")
-}
-
-func (sm *SystemManager) createSSHClientConfig(key []byte) error {
-	signer, err := ssh.ParsePrivateKey(key)
-	if err != nil {
-		return err
-	}
-	sm.sshConfig = &ssh.ClientConfig{
-		User: "u",
-		Auth: []ssh.AuthMethod{
-			ssh.PublicKeys(signer),
-		},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-		Timeout:         sessionTimeout,
-	}
-	return nil
-}
-
-// createSSHClient creates a new SSH client for the system
-func (s *System) createSSHClient() error {
-	network := "tcp"
-	host := s.Host
-	if strings.HasPrefix(host, "/") {
-		network = "unix"
-	} else {
-		host = net.JoinHostPort(host, s.Port)
-	}
-	var err error
-	s.client, err = ssh.Dial(network, host, s.manager.sshConfig)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-// createSessionWithTimeout creates a new SSH session with a timeout to avoid hanging
-// in case of network issues
-func (sys *System) createSessionWithTimeout(timeout time.Duration) (*ssh.Session, error) {
-	if sys.client == nil {
-		return nil, fmt.Errorf("client not initialized")
-	}
-
-	ctx, cancel := context.WithTimeout(sys.ctx, timeout)
-	defer cancel()
-
-	sessionChan := make(chan *ssh.Session, 1)
-	errChan := make(chan error, 1)
-
-	go func() {
-		if session, err := sys.client.NewSession(); err != nil {
-			errChan <- err
-		} else {
-			sessionChan <- session
-		}
-	}()
-
-	select {
-	case session := <-sessionChan:
-		return session, nil
-	case err := <-errChan:
-		return nil, err
-	case <-ctx.Done():
-		return nil, fmt.Errorf("timeout")
-	}
-}
-
-// resetSSHClient closes the SSH connection and resets the client to nil
-func (sys *System) resetSSHClient() {
-	if sys.client != nil {
-		sys.client.Close()
-	}
-	sys.client = nil
-}

beszel/internal/hub/update.go

@@ -1,57 +0,0 @@
-package hub
-
-import (
-	"beszel"
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/blang/semver"
-	"github.com/rhysd/go-github-selfupdate/selfupdate"
-	"github.com/spf13/cobra"
-)
-
-// Update updates beszel to the latest version
-func Update(_ *cobra.Command, _ []string) {
-	var latest *selfupdate.Release
-	var found bool
-	var err error
-	currentVersion := semver.MustParse(beszel.Version)
-	fmt.Println("beszel", currentVersion)
-	fmt.Println("Checking for updates...")
-	updater, _ := selfupdate.NewUpdater(selfupdate.Config{
-		Filters: []string{"beszel_"},
-	})
-	latest, found, err = updater.DetectLatest("henrygd/beszel")
-
-	if err != nil {
-		fmt.Println("Error checking for updates:", err)
-		os.Exit(1)
-	}
-
-	if !found {
-		fmt.Println("No updates found")
-		os.Exit(0)
-	}
-
-	fmt.Println("Latest version:", latest.Version)
-
-	if latest.Version.LTE(currentVersion) {
-		fmt.Println("You are up to date")
-		return
-	}
-
-	var binaryPath string
-	fmt.Printf("Updating from %s to %s...\n", currentVersion, latest.Version)
-	binaryPath, err = os.Executable()
-	if err != nil {
-		fmt.Println("Error getting binary path:", err)
-		os.Exit(1)
-	}
-	err = selfupdate.UpdateTo(latest.AssetURL, binaryPath)
-	if err != nil {
-		fmt.Println("Please try rerunning with sudo. Error:", err)
-		os.Exit(1)
-	}
-	fmt.Printf("Successfully updated to %s\n\n%s\n", latest.Version, strings.TrimSpace(latest.ReleaseNotes))
-}

beszel/internal/tests/hub.go

@@ -1,58 +0,0 @@
-// Package tests provides helpers for testing the application.
-package tests
-
-import (
-	"beszel/internal/hub"
-
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tests"
-
-	_ "github.com/pocketbase/pocketbase/migrations"
-)
-
-// TestHub is a wrapper hub instance used for testing.
-type TestHub struct {
-	core.App
-	*tests.TestApp
-	*hub.Hub
-}
-
-// NewTestHub creates and initializes a test application instance.
-//
-// It is the caller's responsibility to call app.Cleanup() when the app is no longer needed.
-func NewTestHub(optTestDataDir ...string) (*TestHub, error) {
-	var testDataDir string
-	if len(optTestDataDir) > 0 {
-		testDataDir = optTestDataDir[0]
-	}
-
-	return NewTestHubWithConfig(core.BaseAppConfig{
-		DataDir:       testDataDir,
-		EncryptionEnv: "pb_test_env",
-	})
-}
-
-// NewTestHubWithConfig creates and initializes a test application instance
-// from the provided config.
-//
-// If config.DataDir is not set it fallbacks to the default internal test data directory.
-//
-// config.DataDir is cloned for each new test application instance.
-//
-// It is the caller's responsibility to call app.Cleanup() when the app is no longer needed.
-func NewTestHubWithConfig(config core.BaseAppConfig) (*TestHub, error) {
-	testApp, err := tests.NewTestAppWithConfig(config)
-	if err != nil {
-		return nil, err
-	}
-
-	hub := hub.NewHub(testApp)
-
-	t := &TestHub{
-		App:     testApp,
-		TestApp: testApp,
-		Hub:     hub,
-	}
-
-	return t, nil
-}

beszel/migrations/initial-settings.go

@@ -1,29 +0,0 @@
-package migrations
-
-import (
-	"github.com/pocketbase/pocketbase/core"
-	m "github.com/pocketbase/pocketbase/migrations"
-)
-
-var (
-	TempAdminEmail = "_@b.b"
-)
-
-func init() {
-	m.Register(func(app core.App) error {
-		// initial settings
-		settings := app.Settings()
-		settings.Meta.AppName = "Beszel"
-		settings.Meta.HideControls = true
-		settings.Logs.MinLevel = 4
-		if err := app.Save(settings); err != nil {
-			return err
-		}
-		// create superuser
-		collection, _ := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
-		user := core.NewRecord(collection)
-		user.SetEmail(TempAdminEmail)
-		user.SetRandomPassword()
-		return app.Save(user)
-	}, nil)
-}

beszel/site/package.json

@@ -1,72 +0,0 @@
-{
-	"name": "beszel",
-	"private": true,
-	"version": "0.0.0",
-	"type": "module",
-	"scripts": {
-		"dev": "vite",
-		"build": "lingui extract --overwrite && lingui compile && vite build",
-		"preview": "vite preview",
-		"sync": "lingui extract --overwrite && lingui compile",
-		"sync_and_purge": "lingui extract --overwrite --clean && lingui compile"
-	},
-	"dependencies": {
-		"@henrygd/queue": "^1.0.7",
-		"@lingui/detect-locale": "^4.14.1",
-		"@lingui/macro": "^4.14.1",
-		"@lingui/react": "^4.14.1",
-		"@nanostores/react": "^0.7.3",
-		"@nanostores/router": "^0.11.0",
-		"@radix-ui/react-alert-dialog": "^1.1.6",
-		"@radix-ui/react-checkbox": "^1.1.4",
-		"@radix-ui/react-dialog": "^1.1.6",
-		"@radix-ui/react-direction": "^1.1.0",
-		"@radix-ui/react-dropdown-menu": "^2.1.6",
-		"@radix-ui/react-label": "^2.1.2",
-		"@radix-ui/react-select": "^2.1.6",
-		"@radix-ui/react-separator": "^1.1.2",
-		"@radix-ui/react-slider": "^1.2.3",
-		"@radix-ui/react-slot": "^1.1.2",
-		"@radix-ui/react-switch": "^1.1.3",
-		"@radix-ui/react-tabs": "^1.1.3",
-		"@radix-ui/react-toast": "^1.2.6",
-		"@radix-ui/react-tooltip": "^1.1.8",
-		"@tanstack/react-table": "^8.21.2",
-		"class-variance-authority": "^0.7.1",
-		"clsx": "^2.1.1",
-		"cmdk": "^1.0.4",
-		"d3-time": "^3.1.0",
-		"lucide-react": "^0.452.0",
-		"nanostores": "^0.11.4",
-		"pocketbase": "^0.25.2",
-		"react": "^18.3.1",
-		"react-dom": "^18.3.1",
-		"recharts": "^2.15.1",
-		"tailwind-merge": "^2.6.0",
-		"tailwindcss-animate": "^1.0.7",
-		"valibot": "^0.42.0"
-	},
-	"devDependencies": {
-		"@lingui/cli": "^5.2.0",
-		"@lingui/swc-plugin": "^5.4.0",
-		"@lingui/vite-plugin": "^5.2.0",
-		"@types/bun": "^1.2.4",
-		"@types/react": "^18.3.1",
-		"@types/react-dom": "^18.3.1",
-		"@vitejs/plugin-react-swc": "^3.8.0",
-		"autoprefixer": "^10.4.20",
-		"postcss": "^8.5.3",
-		"tailwindcss": "^3.4.17",
-		"tailwindcss-rtl": "^0.9.0",
-		"typescript": "^5.8.2",
-		"vite": "^6.2.0"
-	},
-	"overrides": {
-		"@nanostores/router": {
-			"nanostores": "^0.11.3"
-		}
-	},
-	"optionalDependencies": {
-		"@esbuild/linux-arm64": "^0.21.5"
-	}
-}

beszel/site/postcss.config.js

@@ -1,6 +0,0 @@
-export default {
-	plugins: {
-		tailwindcss: {},
-		autoprefixer: {},
-	},
-}

beszel/site/public/static/favicon-green.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 56 70" fill="#22c55e"><path d="M35 70H0V0h35q4.4 0 8.2 1.7a21.4 21.4 0 0 1 6.6 4.5q2.9 2.8 4.5 6.6Q56 16.7 56 21a15.4 15.4 0 0 1-.3 3.2 17.6 17.6 0 0 1-.2.8 19.4 19.4 0 0 1-1.5 4 17 17 0 0 1-2.4 3.4 13.5 13.5 0 0 1-2.6 2.3 12.5 12.5 0 0 1-.4.3q1.7 1 3 2.5Q53 39.1 54 41a18.3 18.3 0 0 1 1.5 4 17.4 17.4 0 0 1 .5 3 15.3 15.3 0 0 1 0 1q0 4.4-1.7 8.2a21.4 21.4 0 0 1-4.5 6.6q-2.8 2.9-6.6 4.6Q39.4 70 35 70ZM14 14v14h21a7 7 0 0 0 2.3-.3 6.6 6.6 0 0 0 .4-.2Q39 27 40 26a6.9 6.9 0 0 0 1.5-2.2q.5-1.3.5-2.8a7 7 0 0 0-.4-2.3 6.6 6.6 0 0 0-.1-.4Q40.9 17 40 16a7 7 0 0 0-2.3-1.4 6.9 6.9 0 0 0-2.5-.6 7.9 7.9 0 0 0-.2 0H14Zm0 28v14h21a7 7 0 0 0 2.3-.4 6.6 6.6 0 0 0 .4-.1Q39 54.9 40 54a7 7 0 0 0 1.5-2.2 6.9 6.9 0 0 0 .5-2.6 7.9 7.9 0 0 0 0-.2 7 7 0 0 0-.4-2.3 6.6 6.6 0 0 0-.1-.4Q40.9 45 40 44a7 7 0 0 0-2.3-1.5 6.9 6.9 0 0 0-2.5-.6 7.9 7.9 0 0 0-.2 0H14Z"/></svg>

beszel/site/public/static/favicon-red.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 56 70" fill="#dc2626"><path d="M35 70H0V0h35q4.4 0 8.2 1.7a21.4 21.4 0 0 1 6.6 4.5q2.9 2.8 4.5 6.6Q56 16.7 56 21a15.4 15.4 0 0 1-.3 3.2 17.6 17.6 0 0 1-.2.8 19.4 19.4 0 0 1-1.5 4 17 17 0 0 1-2.4 3.4 13.5 13.5 0 0 1-2.6 2.3 12.5 12.5 0 0 1-.4.3q1.7 1 3 2.5Q53 39.1 54 41a18.3 18.3 0 0 1 1.5 4 17.4 17.4 0 0 1 .5 3 15.3 15.3 0 0 1 0 1q0 4.4-1.7 8.2a21.4 21.4 0 0 1-4.5 6.6q-2.8 2.9-6.6 4.6Q39.4 70 35 70ZM14 14v14h21a7 7 0 0 0 2.3-.3 6.6 6.6 0 0 0 .4-.2Q39 27 40 26a6.9 6.9 0 0 0 1.5-2.2q.5-1.3.5-2.8a7 7 0 0 0-.4-2.3 6.6 6.6 0 0 0-.1-.4Q40.9 17 40 16a7 7 0 0 0-2.3-1.4 6.9 6.9 0 0 0-2.5-.6 7.9 7.9 0 0 0-.2 0H14Zm0 28v14h21a7 7 0 0 0 2.3-.4 6.6 6.6 0 0 0 .4-.1Q39 54.9 40 54a7 7 0 0 0 1.5-2.2 6.9 6.9 0 0 0 .5-2.6 7.9 7.9 0 0 0 0-.2 7 7 0 0 0-.4-2.3 6.6 6.6 0 0 0-.1-.4Q40.9 45 40 44a7 7 0 0 0-2.3-1.5 6.9 6.9 0 0 0-2.5-.6 7.9 7.9 0 0 0-.2 0H14Z"/></svg>

beszel/site/public/static/favicon.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 56 70" fill="#888"><path d="M35 70H0V0h35q4.4 0 8.2 1.7a21.4 21.4 0 0 1 6.6 4.5q2.9 2.8 4.5 6.6Q56 16.7 56 21a15.4 15.4 0 0 1-.3 3.2 17.6 17.6 0 0 1-.2.8 19.4 19.4 0 0 1-1.5 4 17 17 0 0 1-2.4 3.4 13.5 13.5 0 0 1-2.6 2.3 12.5 12.5 0 0 1-.4.3q1.7 1 3 2.5Q53 39.1 54 41a18.3 18.3 0 0 1 1.5 4 17.4 17.4 0 0 1 .5 3 15.3 15.3 0 0 1 0 1q0 4.4-1.7 8.2a21.4 21.4 0 0 1-4.5 6.6q-2.8 2.9-6.6 4.6Q39.4 70 35 70ZM14 14v14h21a7 7 0 0 0 2.3-.3 6.6 6.6 0 0 0 .4-.2Q39 27 40 26a6.9 6.9 0 0 0 1.5-2.2q.5-1.3.5-2.8a7 7 0 0 0-.4-2.3 6.6 6.6 0 0 0-.1-.4Q40.9 17 40 16a7 7 0 0 0-2.3-1.4 6.9 6.9 0 0 0-2.5-.6 7.9 7.9 0 0 0-.2 0H14Zm0 28v14h21a7 7 0 0 0 2.3-.4 6.6 6.6 0 0 0 .4-.1Q39 54.9 40 54a7 7 0 0 0 1.5-2.2 6.9 6.9 0 0 0 .5-2.6 7.9 7.9 0 0 0 0-.2 7 7 0 0 0-.4-2.3 6.6 6.6 0 0 0-.1-.4Q40.9 45 40 44a7 7 0 0 0-2.3-1.5 6.9 6.9 0 0 0-2.5-.6 7.9 7.9 0 0 0-.2 0H14Z"/></svg>

beszel/site/src/components/add-system.tsx

@@ -1,274 +0,0 @@
-import { Button } from "@/components/ui/button"
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog"
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
-import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip"
-
-import { Input } from "@/components/ui/input"
-import { Label } from "@/components/ui/label"
-import { $publicKey, pb } from "@/lib/stores"
-import { cn, copyToClipboard, isReadOnlyUser, useLocalStorage } from "@/lib/utils"
-import { i18n } from "@lingui/core"
-import { t, Trans } from "@lingui/macro"
-import { useStore } from "@nanostores/react"
-import { ChevronDownIcon, Copy, PlusIcon } from "lucide-react"
-import { memo, useRef, useState } from "react"
-import { basePath, navigate } from "./router"
-import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from "./ui/dropdown-menu"
-import { SystemRecord } from "@/types"
-
-export function AddSystemButton({ className }: { className?: string }) {
-	const [open, setOpen] = useState(false)
-	let opened = useRef(false)
-	if (open) {
-		opened.current = true
-	}
-
-	return (
-		<Dialog open={open} onOpenChange={setOpen}>
-			<DialogTrigger asChild>
-				<Button
-					variant="outline"
-					className={cn("flex gap-1 max-xs:h-[2.4rem]", className, isReadOnlyUser() && "hidden")}
-				>
-					<PlusIcon className="h-4 w-4 -ms-1" />
-					<Trans>
-						Add <span className="hidden sm:inline">System</span>
-					</Trans>
-				</Button>
-			</DialogTrigger>
-			{opened.current && <SystemDialog setOpen={setOpen} />}
-		</Dialog>
-	)
-}
-
-function copyDockerCompose(port = "45876", publicKey: string) {
-	copyToClipboard(`services:
-  beszel-agent:
-    image: "henrygd/beszel-agent"
-    container_name: "beszel-agent"
-    restart: unless-stopped
-    network_mode: host
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      # monitor other disks / partitions by mounting a folder in /extra-filesystems
-      # - /mnt/disk/.beszel:/extra-filesystems/sda1:ro
-    environment:
-      LISTEN: ${port}
-      KEY: "${publicKey}"`)
-}
-
-function copyDockerRun(port = "45876", publicKey: string) {
-	copyToClipboard(
-		`docker run -d --name beszel-agent --network host --restart unless-stopped -v /var/run/docker.sock:/var/run/docker.sock:ro -e KEY="${publicKey}" -e LISTEN=${port} henrygd/beszel-agent:latest`
-	)
-}
-
-function copyInstallCommand(port = "45876", publicKey: string) {
-	let cmd = `curl -sL https://raw.githubusercontent.com/henrygd/beszel/main/supplemental/scripts/install-agent.sh -o install-agent.sh && chmod +x install-agent.sh && ./install-agent.sh -p ${port} -k "${publicKey}"`
-	// add china mirrors flag if zh-CN
-	if ((i18n.locale + navigator.language).includes("zh-CN")) {
-		cmd += ` --china-mirrors`
-	}
-	copyToClipboard(cmd)
-}
-
-/**
- * SystemDialog component for adding or editing a system.
- * @param {Object} props - The component props.
- * @param {function} props.setOpen - Function to set the open state of the dialog.
- * @param {SystemRecord} [props.system] - Optional system record for editing an existing system.
- */
-export const SystemDialog = memo(({ setOpen, system }: { setOpen: (open: boolean) => void; system?: SystemRecord }) => {
-	const publicKey = useStore($publicKey)
-	const port = useRef<HTMLInputElement>(null)
-	const [hostValue, setHostValue] = useState(system?.host ?? "")
-	const isUnixSocket = hostValue.startsWith("/")
-	const [tab, setTab] = useLocalStorage("as-tab", "docker")
-
-	async function handleSubmit(e: SubmitEvent) {
-		e.preventDefault()
-		const formData = new FormData(e.target as HTMLFormElement)
-		const data = Object.fromEntries(formData) as Record<string, any>
-		data.users = pb.authStore.record!.id
-		try {
-			setOpen(false)
-			if (system) {
-				await pb.collection("systems").update(system.id, { ...data, status: "pending" })
-			} else {
-				await pb.collection("systems").create(data)
-			}
-			navigate(basePath)
-			// console.log(record)
-		} catch (e) {
-			console.log(e)
-		}
-	}
-
-	return (
-		<DialogContent
-			className="w-[90%] sm:w-auto sm:ns-dialog max-w-full rounded-lg"
-			onCloseAutoFocus={() => {
-				setHostValue(system?.host ?? "")
-			}}
-		>
-			<Tabs defaultValue={tab} onValueChange={setTab}>
-				<DialogHeader>
-					<DialogTitle className="mb-2">
-						{system ? `${t`Edit`} ${system?.name}` : <Trans>Add New System</Trans>}
-					</DialogTitle>
-					<TabsList className="grid w-full grid-cols-2">
-						<TabsTrigger value="docker">Docker</TabsTrigger>
-						<TabsTrigger value="binary">
-							<Trans>Binary</Trans>
-						</TabsTrigger>
-					</TabsList>
-				</DialogHeader>
-				{/* Docker (set tab index to prevent auto focusing content in edit system dialog) */}
-				<TabsContent value="docker" tabIndex={-1}>
-					<DialogDescription className="mb-4 leading-normal w-0 min-w-full">
-						<Trans>
-							The agent must be running on the system to connect. Copy the
-							<code className="bg-muted px-1 rounded-sm leading-3">docker-compose.yml</code> for the agent below.
-						</Trans>
-					</DialogDescription>
-				</TabsContent>
-				{/* Binary */}
-				<TabsContent value="binary" tabIndex={-1}>
-					<DialogDescription className="mb-4 leading-normal w-0 min-w-full">
-						<Trans>
-							The agent must be running on the system to connect. Copy the installation command for the agent below.
-						</Trans>
-					</DialogDescription>
-				</TabsContent>
-				<form onSubmit={handleSubmit as any}>
-					<div className="grid xs:grid-cols-[auto_1fr] gap-y-3 gap-x-4 items-center mt-1 mb-4">
-						<Label htmlFor="name" className="xs:text-end">
-							<Trans>Name</Trans>
-						</Label>
-						<Input id="name" name="name" defaultValue={system?.name} required />
-						<Label htmlFor="host" className="xs:text-end">
-							<Trans>Host / IP</Trans>
-						</Label>
-						<Input
-							id="host"
-							name="host"
-							value={hostValue}
-							required
-							onChange={(e) => {
-								setHostValue(e.target.value)
-							}}
-						/>
-						<Label htmlFor="port" className={cn("xs:text-end", isUnixSocket && "hidden")}>
-							<Trans>Port</Trans>
-						</Label>
-						<Input
-							ref={port}
-							name="port"
-							id="port"
-							defaultValue={system?.port || "45876"}
-							required={!isUnixSocket}
-							className={cn(isUnixSocket && "hidden")}
-						/>
-						<Label htmlFor="pkey" className="xs:text-end whitespace-pre">
-							<Trans comment="Use 'Key' if your language requires many more characters">Public Key</Trans>
-						</Label>
-						<div className="relative">
-							<Input readOnly id="pkey" value={publicKey} required></Input>
-							<div
-								className={
-									"h-6 w-24 bg-gradient-to-r rtl:bg-gradient-to-l from-transparent to-background to-65% absolute top-2 end-1 pointer-events-none"
-								}
-							></div>
-							<TooltipProvider delayDuration={100}>
-								<Tooltip>
-									<TooltipTrigger asChild>
-										<Button
-											type="button"
-											variant={"link"}
-											className="absolute end-0 top-0"
-											onClick={() => copyToClipboard(publicKey)}
-										>
-											<Copy className="h-4 w-4 " />
-										</Button>
-									</TooltipTrigger>
-									<TooltipContent>
-										<p>
-											<Trans>Click to copy</Trans>
-										</p>
-									</TooltipContent>
-								</Tooltip>
-							</TooltipProvider>
-						</div>
-					</div>
-					<DialogFooter className="flex justify-end gap-x-2 gap-y-3 flex-col mt-5">
-						{/* Docker */}
-						<TabsContent value="docker" className="contents">
-							<CopyButton
-								text={t`Copy` + " docker compose"}
-								onClick={() => copyDockerCompose(isUnixSocket ? hostValue : port.current?.value, publicKey)}
-								dropdownText={t`Copy` + " docker run"}
-								dropdownOnClick={() => copyDockerRun(isUnixSocket ? hostValue : port.current?.value, publicKey)}
-							/>
-						</TabsContent>
-						{/* Binary */}
-						<TabsContent value="binary" className="contents">
-							<CopyButton
-								text={t`Copy Linux command`}
-								onClick={() => copyInstallCommand(isUnixSocket ? hostValue : port.current?.value, publicKey)}
-								dropdownText={t`Manual setup instructions`}
-								dropdownUrl="https://beszel.dev/guide/agent-installation#binary"
-							/>
-						</TabsContent>
-						{/* Save */}
-						<Button>{system ? <Trans>Save system</Trans> : <Trans>Add system</Trans>}</Button>
-					</DialogFooter>
-				</form>
-			</Tabs>
-		</DialogContent>
-	)
-})
-
-interface CopyButtonProps {
-	text: string
-	onClick: () => void
-	dropdownText: string
-	dropdownOnClick?: () => void
-	dropdownUrl?: string
-}
-
-const CopyButton = memo((props: CopyButtonProps) => {
-	return (
-		<div className="flex gap-0 rounded-lg">
-			<Button type="button" variant="outline" onClick={props.onClick} className="rounded-e-none dark:border-e-0 grow">
-				{props.text}
-			</Button>
-			<div className="w-px h-full bg-muted"></div>
-			<DropdownMenu>
-				<DropdownMenuTrigger asChild>
-					<Button variant="outline" className={"px-2 rounded-s-none border-s-0"}>
-						<ChevronDownIcon />
-					</Button>
-				</DropdownMenuTrigger>
-				<DropdownMenuContent align="end">
-					{props.dropdownUrl ? (
-						<DropdownMenuItem asChild>
-							<a href={props.dropdownUrl} className="cursor-pointer" target="_blank" rel="noopener noreferrer">
-								{props.dropdownText}
-							</a>
-						</DropdownMenuItem>
-					) : (
-						<DropdownMenuItem onClick={props.dropdownOnClick} className="cursor-pointer">{props.dropdownText}</DropdownMenuItem>
-					)}
-				</DropdownMenuContent>
-			</DropdownMenu>
-		</div>
-	)
-})

beszel/site/src/components/alerts/alert-button.tsx

@@ -1,120 +0,0 @@
-import { memo, useState } from "react"
-import { useStore } from "@nanostores/react"
-import { $alerts, $systems } from "@/lib/stores"
-import {
-	Dialog,
-	DialogTrigger,
-	DialogContent,
-	DialogDescription,
-	DialogHeader,
-	DialogTitle,
-} from "@/components/ui/dialog"
-import { BellIcon, GlobeIcon, ServerIcon } from "lucide-react"
-import { alertInfo, cn } from "@/lib/utils"
-import { Button } from "@/components/ui/button"
-import { AlertRecord, SystemRecord } from "@/types"
-import { Link } from "../router"
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
-import { Checkbox } from "../ui/checkbox"
-import { SystemAlert, SystemAlertGlobal } from "./alerts-system"
-import { Trans, t } from "@lingui/macro"
-
-export default memo(function AlertsButton({ system }: { system: SystemRecord }) {
-	const alerts = useStore($alerts)
-	const [opened, setOpened] = useState(false)
-
-	const systemAlerts = alerts.filter((alert) => alert.system === system.id) as AlertRecord[]
-	const active = systemAlerts.length > 0
-
-	return (
-		<Dialog>
-			<DialogTrigger asChild>
-				<Button variant="ghost" size="icon" aria-label={t`Alerts`} data-nolink onClick={() => setOpened(true)}>
-					<BellIcon
-						className={cn("h-[1.2em] w-[1.2em] pointer-events-none", {
-							"fill-primary": active,
-						})}
-					/>
-				</Button>
-			</DialogTrigger>
-			<DialogContent className="max-h-full overflow-auto max-w-[35rem]">
-				{opened && <TheContent data={{ system, alerts, systemAlerts }} />}
-			</DialogContent>
-		</Dialog>
-	)
-})
-
-function TheContent({
-	data: { system, alerts, systemAlerts },
-}: {
-	data: { system: SystemRecord; alerts: AlertRecord[]; systemAlerts: AlertRecord[] }
-}) {
-	const [overwriteExisting, setOverwriteExisting] = useState<boolean | "indeterminate">(false)
-	const systems = $systems.get()
-
-	const data = Object.keys(alertInfo).map((key) => {
-		const alert = alertInfo[key as keyof typeof alertInfo]
-		return {
-			key: key as keyof typeof alertInfo,
-			alert,
-			system,
-		}
-	})
-
-	return (
-		<>
-			<DialogHeader>
-				<DialogTitle className="text-xl">
-					<Trans>Alerts</Trans>
-				</DialogTitle>
-				<DialogDescription>
-					<Trans>
-						See{" "}
-						<Link href="/settings/notifications" className="link">
-							notification settings
-						</Link>{" "}
-						to configure how you receive alerts.
-					</Trans>
-				</DialogDescription>
-			</DialogHeader>
-			<Tabs defaultValue="system">
-				<TabsList className="mb-1 -mt-0.5">
-					<TabsTrigger value="system">
-						<ServerIcon className="me-2 h-3.5 w-3.5" />
-						{system.name}
-					</TabsTrigger>
-					<TabsTrigger value="global">
-						<GlobeIcon className="me-1.5 h-3.5 w-3.5" />
-						<Trans>All Systems</Trans>
-					</TabsTrigger>
-				</TabsList>
-				<TabsContent value="system">
-					<div className="grid gap-3">
-						{data.map((d) => (
-							<SystemAlert key={d.key} system={system} data={d} systemAlerts={systemAlerts} />
-						))}
-					</div>
-				</TabsContent>
-				<TabsContent value="global">
-					<label
-						htmlFor="ovw"
-						className="mb-3 flex gap-2 items-center justify-center cursor-pointer border rounded-sm py-3 px-4 border-destructive text-destructive font-semibold text-sm"
-					>
-						<Checkbox
-							id="ovw"
-							className="text-destructive border-destructive data-[state=checked]:bg-destructive"
-							checked={overwriteExisting}
-							onCheckedChange={setOverwriteExisting}
-						/>
-						<Trans>Overwrite existing alerts</Trans>
-					</label>
-					<div className="grid gap-3">
-						{data.map((d) => (
-							<SystemAlertGlobal key={d.key} data={d} overwrite={overwriteExisting} alerts={alerts} systems={systems} />
-						))}
-					</div>
-				</TabsContent>
-			</Tabs>
-		</>
-	)
-}