release 0.12.9

- also update changelog

.dockerignore

@@ -0,0 +1,48 @@
+# Node.js dependencies
+node_modules
+internalsite/node_modules
+
+# Go build artifacts and binaries
+build
+dist
+*.exe
+beszel-agent
+beszel_data*
+pb_data
+data
+temp
+
+# Development and IDE files
+.vscode
+.idea*
+*.swc
+__debug_*
+
+# Git and version control
+.git
+.gitignore
+
+# Documentation and supplemental files
+*.md
+supplemental
+freebsd-port
+
+# Test files (exclude from production builds)
+*_test.go
+coverage
+
+# Docker files
+dockerfile_*
+
+# Temporary files
+*.tmp
+*.bak
+*.log
+
+# OS specific files
+.DS_Store
+Thumbs.db
+
+# .NET build artifacts
+agent/lhm/obj
+agent/lhm/bin

.github/workflows/docker-images.yml

@@ -13,44 +13,44 @@ jobs:
       matrix:
         include:
           - image: henrygd/beszel
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_hub
+            context: ./
+            dockerfile: ./internal/dockerfile_hub
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
 
           - image: henrygd/beszel-agent
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_agent
+            context: ./
+            dockerfile: ./internal/dockerfile_agent
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
 
           - image: henrygd/beszel-agent-nvidia
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_agent_nvidia
+            context: ./
+            dockerfile: ./internal/dockerfile_agent_nvidia
             platforms: linux/amd64
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
 
           - image: ghcr.io/${{ github.repository }}/beszel
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_hub
+            context: ./
+            dockerfile: ./internal/dockerfile_hub
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
 
           - image: ghcr.io/${{ github.repository }}/beszel-agent
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_agent
+            context: ./
+            dockerfile: ./internal/dockerfile_agent
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
 
           - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
-            context: ./beszel
-            dockerfile: ./beszel/dockerfile_agent_nvidia
+            context: ./
+            dockerfile: ./internal/dockerfile_agent_nvidia
             platforms: linux/amd64
             registry: ghcr.io
             username: ${{ github.actor }}
@@ -68,10 +68,10 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --no-save --cwd ./beszel/site
+        run: bun install --no-save --cwd ./internal/site
 
       - name: Build site
-        run: bun run --cwd ./beszel/site build
+        run: bun run --cwd ./internal/site build
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -93,7 +93,9 @@ jobs:
 
       # https://github.com/docker/login-action
       - name: Login to Docker Hub
-        if: github.event_name != 'pull_request'
+        env:
+          password_secret_exists: ${{ secrets[matrix.password_secret] != '' && 'true' || 'false' }}
+        if: github.event_name != 'pull_request' && env.password_secret_exists == 'true'
         uses: docker/login-action@v3
         with:
           username: ${{ matrix.username || secrets[matrix.username_secret] }}
@@ -108,6 +110,6 @@ jobs:
           context: "${{ matrix.context }}"
           file: ${{ matrix.dockerfile }}
           platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
-          push: ${{ github.ref_type == 'tag' }}
+          push: ${{ github.ref_type == 'tag' && secrets[matrix.password_secret] != '' }}
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/release.yml

@@ -21,10 +21,10 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Install dependencies
-        run: bun install --no-save --cwd ./beszel/site
+        run: bun install --no-save --cwd ./internal/site
 
       - name: Build site
-        run: bun run --cwd ./beszel/site build
+        run: bun run --cwd ./internal/site build
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -38,16 +38,17 @@ jobs:
 
       - name: Build .NET LHM executable for Windows sensors
         run: |
-          dotnet build -c Release ./beszel/internal/agent/lhm/beszel_lhm.csproj
+          dotnet build -c Release ./agent/lhm/beszel_lhm.csproj
         shell: bash
 
       - name: GoReleaser beszel
         uses: goreleaser/goreleaser-action@v6
         with:
-          workdir: ./beszel
+          workdir: ./
           distribution: goreleaser
           version: latest
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.TOKEN || secrets.GITHUB_TOKEN }}
           WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          IS_FORK: ${{ github.repository_owner != 'henrygd' }}

.github/workflows/vulncheck.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   vulncheck:
-    name: Analysis
+    name: VulnCheck
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
@@ -23,11 +23,11 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.x
-          cached: false
+          go-version: 1.25.x
+          # cached: false
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
         shell: bash
       - name: Run govulncheck
-        run: govulncheck -C ./beszel -show verbose ./...
+        run: govulncheck -show verbose ./...
         shell: bash

.gitignore

@@ -8,15 +8,15 @@ beszel_data
 beszel_data*
 dist
 *.exe
-beszel/cmd/hub/hub
-beszel/cmd/agent/agent
+internal/cmd/hub/hub
+internal/cmd/agent/agent
 node_modules
-beszel/build
+build
 *timestamp*
 .swc
-beszel/site/src/locales/**/*.ts
+internal/site/src/locales/**/*.ts
 *.bak
 __debug_*
-beszel/internal/agent/lhm/obj
-beszel/internal/agent/lhm/bin
+agent/lhm/obj
+agent/lhm/bin
 dockerfile_agent_dev

.goreleaser.yml

@@ -9,7 +9,7 @@ before:
 builds:
   - id: beszel
     binary: beszel
-    main: cmd/hub/hub.go
+    main: internal/cmd/hub/hub.go
     env:
       - CGO_ENABLED=0
     goos:
@@ -22,7 +22,7 @@ builds:
 
   - id: beszel-agent
     binary: beszel-agent
-    main: cmd/agent/agent.go
+    main: internal/cmd/agent/agent.go
     env:
       - CGO_ENABLED=0
     goos:
@@ -38,12 +38,25 @@ builds:
       - mips64
       - riscv64
       - mipsle
+      - mips
       - ppc64le
+    gomips:
+      - hardfloat
+      - softfloat
     ignore:
       - goos: freebsd
         goarch: arm
       - goos: openbsd
         goarch: arm
+      - goos: linux
+        goarch: mips64
+        gomips: softfloat
+      - goos: linux
+        goarch: mipsle
+        gomips: hardfloat
+      - goos: linux
+        goarch: mips
+        gomips: hardfloat
       - goos: windows
         goarch: arm
       - goos: darwin
@@ -54,7 +67,7 @@ builds:
 archives:
   - id: beszel-agent
     formats: [tar.gz]
-    builds:
+    ids:
       - beszel-agent
     name_template: >-
       {{ .Binary }}_
@@ -66,7 +79,7 @@ archives:
 
   - id: beszel
     formats: [tar.gz]
-    builds:
+    ids:
       - beszel
     name_template: >-
       {{ .Binary }}_
@@ -85,33 +98,33 @@ nfpms:
       API access.
     maintainer: henrygd <hank@henrygd.me>
     section: net
-    builds:
+    ids:
       - beszel-agent
     formats:
       - deb
     contents:
-      - src: ../supplemental/debian/beszel-agent.service
+      - src: ./supplemental/debian/beszel-agent.service
         dst: lib/systemd/system/beszel-agent.service
         packager: deb
-      - src: ../supplemental/debian/copyright
+      - src: ./supplemental/debian/copyright
         dst: usr/share/doc/beszel-agent/copyright
         packager: deb
-      - src: ../supplemental/debian/lintian-overrides
+      - src: ./supplemental/debian/lintian-overrides
         dst: usr/share/lintian/overrides/beszel-agent
         packager: deb
     scripts:
-      postinstall: ../supplemental/debian/postinstall.sh
-      preremove: ../supplemental/debian/prerm.sh
-      postremove: ../supplemental/debian/postrm.sh
+      postinstall: ./supplemental/debian/postinstall.sh
+      preremove: ./supplemental/debian/prerm.sh
+      postremove: ./supplemental/debian/postrm.sh
     deb:
       predepends:
         - adduser
         - debconf
       scripts:
-        templates: ../supplemental/debian/templates
+        templates: ./supplemental/debian/templates
         # Currently broken due to a bug in goreleaser
         # https://github.com/goreleaser/goreleaser/issues/5487
-        #config: ../supplemental/debian/config.sh
+        #config: ./supplemental/debian/config.sh
 
 scoops:
   - ids: [beszel-agent]
@@ -122,6 +135,7 @@ scoops:
     homepage: "https://beszel.dev"
     description: "Agent for Beszel, a lightweight server monitoring platform."
     license: MIT
+    skip_upload: '{{ if eq (tolower .Env.IS_FORK) "true" }}true{{ else }}auto{{ end }}'
 
 # # Needs choco installed, so doesn't build on linux / default gh workflow :(
 # chocolateys:
@@ -155,7 +169,7 @@ brews:
     homepage: "https://beszel.dev"
     description: "Agent for Beszel, a lightweight server monitoring platform."
     license: MIT
-    skip_upload: auto
+    skip_upload: '{{ if eq (tolower .Env.IS_FORK) "true" }}true{{ else }}auto{{ end }}'
     extra_install: |
       (bin/"beszel-agent-launcher").write <<~EOS
         #!/bin/bash
@@ -187,7 +201,7 @@ winget:
     release_notes_url: "https://github.com/henrygd/beszel/releases/tag/v{{ .Version }}"
     publisher_support_url: "https://github.com/henrygd/beszel/issues"
     short_description: "Agent for Beszel, a lightweight server monitoring platform."
-    skip_upload: auto
+    skip_upload: '{{ if eq (tolower .Env.IS_FORK) "true" }}true{{ else }}auto{{ end }}'
     description: |
       Beszel is a lightweight server monitoring platform that includes Docker
       statistics, historical data, and alert functions. It has a friendly web

Makefile

@@ -0,0 +1,102 @@
+# Default OS/ARCH values
+OS ?= $(shell go env GOOS)
+ARCH ?= $(shell go env GOARCH)
+# Skip building the web UI if true
+SKIP_WEB ?= false
+
+# Set executable extension based on target OS
+EXE_EXT := $(if $(filter windows,$(OS)),.exe,)
+
+.PHONY: tidy build-agent build-hub build-hub-dev build clean lint dev-server dev-agent dev-hub dev generate-locales
+.DEFAULT_GOAL := build
+
+clean:
+	go clean
+	rm -rf ./build
+
+lint:
+	golangci-lint run
+
+test: export GOEXPERIMENT=synctest
+test:
+	go test -tags=testing ./...
+
+tidy:
+	go mod tidy
+
+build-web-ui:
+	@if command -v bun >/dev/null 2>&1; then \
+		bun install --cwd ./internal/site && \
+		bun run --cwd ./internal/site build; \
+	else \
+		npm install --prefix ./internal/site && \
+		npm run --prefix ./internal/site build; \
+	fi
+
+# Conditional .NET build - only for Windows
+build-dotnet-conditional:
+	@if [ "$(OS)" = "windows" ]; then \
+		echo "Building .NET executable for Windows..."; \
+		if command -v dotnet >/dev/null 2>&1; then \
+			rm -rf ./agent/lhm/bin; \
+			dotnet build -c Release ./agent/lhm/beszel_lhm.csproj; \
+		else \
+			echo "Error: dotnet not found. Install .NET SDK to build Windows agent."; \
+			exit 1; \
+		fi; \
+	fi
+
+# Update build-agent to include conditional .NET build
+build-agent: tidy build-dotnet-conditional
+	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel-agent_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/agent
+
+build-hub: tidy $(if $(filter false,$(SKIP_WEB)),build-web-ui)
+	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/hub
+
+build-hub-dev: tidy
+	mkdir -p ./internal/site/dist && touch ./internal/site/dist/index.html
+	GOOS=$(OS) GOARCH=$(ARCH) go build -tags development -o ./build/beszel-dev_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/hub
+
+build: build-agent build-hub
+
+generate-locales:
+	@if [ ! -f ./internal/site/src/locales/en/en.ts ]; then \
+		echo "Generating locales..."; \
+		command -v bun >/dev/null 2>&1 && cd ./internal/site && bun install && bun run sync || cd ./internal/site && npm install && npm run sync; \
+	fi
+
+dev-server: generate-locales
+	cd ./internal/site
+	@if command -v bun >/dev/null 2>&1; then \
+		cd ./internal/site && bun run dev --host 0.0.0.0; \
+	else \
+		cd ./internal/site && npm run dev --host 0.0.0.0; \
+	fi
+
+dev-hub: export ENV=dev
+dev-hub:
+	mkdir -p ./internal/site/dist && touch ./internal/site/dist/index.html
+	@if command -v entr >/dev/null 2>&1; then \
+		find ./internal -type f -name '*.go' | entr -r -s "cd ./internal/cmd/hub && go run -tags development . serve --http 0.0.0.0:8090"; \
+	else \
+		cd ./internal/cmd/hub && go run -tags development . serve --http 0.0.0.0:8090; \
+	fi
+
+dev-agent:
+	@if command -v entr >/dev/null 2>&1; then \
+		find ./internal/cmd/agent/*.go ./agent/*.go | entr -r go run github.com/henrygd/beszel/internal/cmd/agent; \
+	else \
+		go run github.com/henrygd/beszel/internal/cmd/agent; \
+	fi
+	
+build-dotnet:
+	@if command -v dotnet >/dev/null 2>&1; then \
+		rm -rf ./agent/lhm/bin; \
+		dotnet build -c Release ./agent/lhm/beszel_lhm.csproj; \
+	else \
+		echo "dotnet not found"; \
+	fi
+
+
+# KEY="..." make -j dev
+dev: dev-server dev-hub dev-agent

agent/agent.go

@@ -1,9 +1,10 @@
-// Package agent handles the agent's SSH server and system stats collection.
+// Package agent implements the Beszel monitoring agent that collects and serves system metrics.
+//
+// The agent runs on monitored systems and communicates collected data
+// to the Beszel hub for centralized monitoring and alerting.
 package agent
 
 import (
-	"beszel"
-	"beszel/internal/entities/system"
 	"crypto/sha256"
 	"encoding/hex"
 	"log/slog"
@@ -14,6 +15,8 @@ import (
 	"time"
 
 	"github.com/gliderlabs/ssh"
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/shirou/gopsutil/v4/host"
 	gossh "golang.org/x/crypto/ssh"
 )
@@ -36,7 +39,6 @@ type Agent struct {
 	server            *ssh.Server                // SSH server
 	dataDir           string                     // Directory for persisting data
 	keys              []gossh.PublicKey          // SSH public keys
-	hasBattery        bool                       // true if agent has access to battery stats
 }
 
 // NewAgent creates a new agent with the given data directory for persisting data.

agent/agent_cache.go

@@ -1,8 +1,9 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
 )
 
 // Not thread safe since we only access from gatherStats which is already locked

agent/agent_cache_test.go

@@ -4,11 +4,12 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"testing"
 	"testing/synctest"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

agent/battery/battery.go

@@ -0,0 +1,52 @@
+//go:build !freebsd
+
+// Package battery provides functions to check if the system has a battery and to get the battery stats.
+package battery
+
+import (
+	"errors"
+	"log/slog"
+
+	"github.com/distatus/battery"
+)
+
+var systemHasBattery = false
+var haveCheckedBattery = false
+
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+func HasReadableBattery() bool {
+	if haveCheckedBattery {
+		return systemHasBattery
+	}
+	haveCheckedBattery = true
+	bat, err := battery.Get(0)
+	systemHasBattery = err == nil && bat != nil && bat.Design != 0 && bat.Full != 0
+	if !systemHasBattery {
+		slog.Debug("No battery found", "err", err)
+	}
+	return systemHasBattery
+}
+
+// GetBatteryStats returns the current battery percent and charge state
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !systemHasBattery {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+	batteries, err := battery.GetAll()
+	if err != nil || len(batteries) == 0 {
+		return batteryPercent, batteryState, err
+	}
+	totalCapacity := float64(0)
+	totalCharge := float64(0)
+	for _, bat := range batteries {
+		if bat.Design != 0 {
+			totalCapacity += bat.Design
+		} else {
+			totalCapacity += bat.Full
+		}
+		totalCharge += bat.Current
+	}
+	batteryPercent = uint8(totalCharge / totalCapacity * 100)
+	batteryState = uint8(batteries[0].State.Raw)
+	return batteryPercent, batteryState, nil
+}

agent/battery/battery_freebsd.go

@@ -0,0 +1,13 @@
+//go:build freebsd
+
+package battery
+
+import "errors"
+
+func HasReadableBattery() bool {
+	return false
+}
+
+func GetBatteryStats() (uint8, uint8, error) {
+	return 0, 0, errors.ErrUnsupported
+}

agent/client.go

@@ -1,8 +1,6 @@
 package agent
 
 import (
-	"beszel"
-	"beszel/internal/common"
 	"crypto/tls"
 	"errors"
 	"fmt"
@@ -15,6 +13,9 @@ import (
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/common"
+
 	"github.com/fxamacker/cbor/v2"
 	"github.com/lxzan/gws"
 	"golang.org/x/crypto/ssh"
@@ -84,7 +85,7 @@ func getToken() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return string(tokenBytes), nil
+	return strings.TrimSpace(string(tokenBytes)), nil
 }
 
 // getOptions returns the WebSocket client options, creating them if necessary.

agent/client_test.go

@@ -4,8 +4,6 @@
 package agent
 
 import (
-	"beszel"
-	"beszel/internal/common"
 	"crypto/ed25519"
 	"net/url"
 	"os"
@@ -13,6 +11,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/henrygd/beszel"
+
+	"github.com/henrygd/beszel/internal/common"
+
 	"github.com/fxamacker/cbor/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -535,4 +537,25 @@ func TestGetToken(t *testing.T) {
 		assert.NoError(t, err)
 		assert.Equal(t, "", token, "Empty file should return empty string")
 	})
+
+	t.Run("strips whitespace from TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
+		tokenWithWhitespace := "  test-token-with-whitespace  \n\t"
+		expectedToken := "test-token-with-whitespace"
+		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
+		require.NoError(t, err)
+		defer os.Remove(tokenFile.Name())
+
+		_, err = tokenFile.WriteString(tokenWithWhitespace)
+		require.NoError(t, err)
+		tokenFile.Close()
+
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("TOKEN_FILE")
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, expectedToken, token, "Whitespace should be stripped from token file content")
+	})
 }

agent/connection_manager.go

@@ -1,13 +1,14 @@
 package agent
 
 import (
-	"beszel/internal/agent/health"
 	"errors"
 	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
+
+	"github.com/henrygd/beszel/agent/health"
 )
 
 // ConnectionManager manages the connection state and events for the agent.

agent/deltatracker/deltatracker.go

@@ -0,0 +1,81 @@
+// Package deltatracker provides a tracker for calculating differences in numeric values over time.
+package deltatracker
+
+import (
+	"sync"
+
+	"golang.org/x/exp/constraints"
+)
+
+// Numeric is a constraint that permits any integer or floating-point type.
+type Numeric interface {
+	constraints.Integer | constraints.Float
+}
+
+// DeltaTracker is a generic, thread-safe tracker for calculating differences
+// in numeric values over time.
+// K is the key type (e.g., int, string).
+// V is the value type (e.g., int, int64, float32, float64).
+type DeltaTracker[K comparable, V Numeric] struct {
+	sync.RWMutex
+	current  map[K]V
+	previous map[K]V
+}
+
+// NewDeltaTracker creates a new generic tracker.
+func NewDeltaTracker[K comparable, V Numeric]() *DeltaTracker[K, V] {
+	return &DeltaTracker[K, V]{
+		current:  make(map[K]V),
+		previous: make(map[K]V),
+	}
+}
+
+// Set records the current value for a given ID.
+func (t *DeltaTracker[K, V]) Set(id K, value V) {
+	t.Lock()
+	defer t.Unlock()
+	t.current[id] = value
+}
+
+// Deltas returns a map of all calculated deltas for the current interval.
+func (t *DeltaTracker[K, V]) Deltas() map[K]V {
+	t.RLock()
+	defer t.RUnlock()
+
+	deltas := make(map[K]V)
+	for id, currentVal := range t.current {
+		if previousVal, ok := t.previous[id]; ok {
+			deltas[id] = currentVal - previousVal
+		} else {
+			deltas[id] = 0
+		}
+	}
+	return deltas
+}
+
+// Delta returns the delta for a single key.
+// Returns 0 if the key doesn't exist or has no previous value.
+func (t *DeltaTracker[K, V]) Delta(id K) V {
+	t.RLock()
+	defer t.RUnlock()
+
+	currentVal, currentOk := t.current[id]
+	if !currentOk {
+		return 0
+	}
+
+	previousVal, previousOk := t.previous[id]
+	if !previousOk {
+		return 0
+	}
+
+	return currentVal - previousVal
+}
+
+// Cycle prepares the tracker for the next interval.
+func (t *DeltaTracker[K, V]) Cycle() {
+	t.Lock()
+	defer t.Unlock()
+	t.previous = t.current
+	t.current = make(map[K]V)
+}

agent/deltatracker/deltatracker_test.go

@@ -0,0 +1,217 @@
+package deltatracker
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func ExampleDeltaTracker() {
+	tracker := NewDeltaTracker[string, int]()
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+	tracker.Cycle()
+	tracker.Set("key1", 15)
+	tracker.Set("key2", 30)
+	fmt.Println(tracker.Delta("key1"))
+	fmt.Println(tracker.Delta("key2"))
+	fmt.Println(tracker.Deltas())
+	// Output: 5
+	// 10
+	// map[key1:5 key2:10]
+}
+
+func TestNewDeltaTracker(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+	assert.NotNil(t, tracker)
+	assert.Empty(t, tracker.current)
+	assert.Empty(t, tracker.previous)
+}
+
+func TestSet(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+	tracker.Set("key1", 10)
+
+	tracker.RLock()
+	defer tracker.RUnlock()
+
+	assert.Equal(t, 10, tracker.current["key1"])
+}
+
+func TestDeltas(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// Test with no previous values
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+
+	deltas := tracker.Deltas()
+	assert.Equal(t, 0, deltas["key1"])
+	assert.Equal(t, 0, deltas["key2"])
+
+	// Cycle to move current to previous
+	tracker.Cycle()
+
+	// Set new values and check deltas
+	tracker.Set("key1", 15) // Delta should be 5 (15-10)
+	tracker.Set("key2", 25) // Delta should be 5 (25-20)
+	tracker.Set("key3", 30) // New key, delta should be 0
+
+	deltas = tracker.Deltas()
+	assert.Equal(t, 5, deltas["key1"])
+	assert.Equal(t, 5, deltas["key2"])
+	assert.Equal(t, 0, deltas["key3"])
+}
+
+func TestCycle(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+
+	// Verify current has values
+	tracker.RLock()
+	assert.Equal(t, 10, tracker.current["key1"])
+	assert.Equal(t, 20, tracker.current["key2"])
+	assert.Empty(t, tracker.previous)
+	tracker.RUnlock()
+
+	tracker.Cycle()
+
+	// After cycle, previous should have the old current values
+	// and current should be empty
+	tracker.RLock()
+	assert.Empty(t, tracker.current)
+	assert.Equal(t, 10, tracker.previous["key1"])
+	assert.Equal(t, 20, tracker.previous["key2"])
+	tracker.RUnlock()
+}
+
+func TestCompleteWorkflow(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// First interval
+	tracker.Set("server1", 100)
+	tracker.Set("server2", 200)
+
+	// Get deltas for first interval (should be zero)
+	firstDeltas := tracker.Deltas()
+	assert.Equal(t, 0, firstDeltas["server1"])
+	assert.Equal(t, 0, firstDeltas["server2"])
+
+	// Cycle to next interval
+	tracker.Cycle()
+
+	// Second interval
+	tracker.Set("server1", 150) // Delta: 50
+	tracker.Set("server2", 180) // Delta: -20
+	tracker.Set("server3", 300) // New server, delta: 300
+
+	secondDeltas := tracker.Deltas()
+	assert.Equal(t, 50, secondDeltas["server1"])
+	assert.Equal(t, -20, secondDeltas["server2"])
+	assert.Equal(t, 0, secondDeltas["server3"])
+}
+
+func TestDeltaTrackerWithDifferentTypes(t *testing.T) {
+	// Test with int64
+	intTracker := NewDeltaTracker[string, int64]()
+	intTracker.Set("pid1", 1000)
+	intTracker.Cycle()
+	intTracker.Set("pid1", 1200)
+	intDeltas := intTracker.Deltas()
+	assert.Equal(t, int64(200), intDeltas["pid1"])
+
+	// Test with float64
+	floatTracker := NewDeltaTracker[string, float64]()
+	floatTracker.Set("cpu1", 1.5)
+	floatTracker.Cycle()
+	floatTracker.Set("cpu1", 2.7)
+	floatDeltas := floatTracker.Deltas()
+	assert.InDelta(t, 1.2, floatDeltas["cpu1"], 0.0001)
+
+	// Test with int keys
+	pidTracker := NewDeltaTracker[int, int64]()
+	pidTracker.Set(101, 20000)
+	pidTracker.Cycle()
+	pidTracker.Set(101, 22500)
+	pidDeltas := pidTracker.Deltas()
+	assert.Equal(t, int64(2500), pidDeltas[101])
+}
+
+func TestDelta(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// Test getting delta for non-existent key
+	result := tracker.Delta("nonexistent")
+	assert.Equal(t, 0, result)
+
+	// Test getting delta for key with no previous value
+	tracker.Set("key1", 10)
+	result = tracker.Delta("key1")
+	assert.Equal(t, 0, result)
+
+	// Cycle to move current to previous
+	tracker.Cycle()
+
+	// Test getting delta for key with previous value
+	tracker.Set("key1", 15)
+	result = tracker.Delta("key1")
+	assert.Equal(t, 5, result)
+
+	// Test getting delta for key that exists in previous but not current
+	result = tracker.Delta("key1")
+	assert.Equal(t, 5, result) // Should still return 5
+
+	// Test getting delta for key that exists in current but not previous
+	tracker.Set("key2", 20)
+	result = tracker.Delta("key2")
+	assert.Equal(t, 0, result)
+}
+
+func TestDeltaWithDifferentTypes(t *testing.T) {
+	// Test with int64
+	intTracker := NewDeltaTracker[string, int64]()
+	intTracker.Set("pid1", 1000)
+	intTracker.Cycle()
+	intTracker.Set("pid1", 1200)
+	result := intTracker.Delta("pid1")
+	assert.Equal(t, int64(200), result)
+
+	// Test with float64
+	floatTracker := NewDeltaTracker[string, float64]()
+	floatTracker.Set("cpu1", 1.5)
+	floatTracker.Cycle()
+	floatTracker.Set("cpu1", 2.7)
+	floatResult := floatTracker.Delta("cpu1")
+	assert.InDelta(t, 1.2, floatResult, 0.0001)
+
+	// Test with int keys
+	pidTracker := NewDeltaTracker[int, int64]()
+	pidTracker.Set(101, 20000)
+	pidTracker.Cycle()
+	pidTracker.Set(101, 22500)
+	pidResult := pidTracker.Delta(101)
+	assert.Equal(t, int64(2500), pidResult)
+}
+
+func TestDeltaConcurrentAccess(t *testing.T) {
+	tracker := NewDeltaTracker[string, int]()
+
+	// Set initial values
+	tracker.Set("key1", 10)
+	tracker.Set("key2", 20)
+	tracker.Cycle()
+
+	// Set new values
+	tracker.Set("key1", 15)
+	tracker.Set("key2", 25)
+
+	// Test concurrent access safety
+	result1 := tracker.Delta("key1")
+	result2 := tracker.Delta("key2")
+
+	assert.Equal(t, 5, result1)
+	assert.Equal(t, 5, result2)
+}

agent/disk.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -9,6 +8,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/shirou/gopsutil/v4/disk"
 )
 

agent/docker.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"beszel/internal/entities/container"
 	"bytes"
 	"context"
 	"encoding/json"
@@ -15,6 +14,8 @@ import (
 	"sync"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/container"
+
 	"github.com/blang/semver"
 )
 

agent/gpu.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"bufio"
 	"bytes"
 	"encoding/json"
@@ -13,6 +12,8 @@ import (
 	"sync"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"golang.org/x/exp/slog"
 )
 

agent/gpu_test.go

@@ -4,12 +4,13 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"os"
 	"path/filepath"
 	"testing"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

agent/network.go

@@ -0,0 +1,140 @@
+package agent
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	psutilNet "github.com/shirou/gopsutil/v4/net"
+)
+
+func (a *Agent) updateNetworkStats(systemStats *system.Stats) {
+	// network stats
+	if len(a.netInterfaces) == 0 {
+		// if no network interfaces, initialize again
+		// this is a fix if agent started before network is online (#466)
+		// maybe refactor this in the future to not cache interface names at all so we
+		// don't miss an interface that's been added after agent started in any circumstance
+		a.initializeNetIoStats()
+	}
+
+	if systemStats.NetworkInterfaces == nil {
+		systemStats.NetworkInterfaces = make(map[string][4]uint64, 0)
+	}
+
+	if netIO, err := psutilNet.IOCounters(true); err == nil {
+		msElapsed := uint64(time.Since(a.netIoStats.Time).Milliseconds())
+		a.netIoStats.Time = time.Now()
+		totalBytesSent := uint64(0)
+		totalBytesRecv := uint64(0)
+		netInterfaceDeltaTracker.Cycle()
+		// sum all bytes sent and received
+		for _, v := range netIO {
+			// skip if not in valid network interfaces list
+			if _, exists := a.netInterfaces[v.Name]; !exists {
+				continue
+			}
+			totalBytesSent += v.BytesSent
+			totalBytesRecv += v.BytesRecv
+
+			// track deltas for each network interface
+			netInterfaceDeltaTracker.Set(fmt.Sprintf("%sdown", v.Name), v.BytesRecv)
+			netInterfaceDeltaTracker.Set(fmt.Sprintf("%sup", v.Name), v.BytesSent)
+			var upDelta, downDelta uint64
+			if msElapsed > 0 {
+				upDelta = netInterfaceDeltaTracker.Delta(fmt.Sprintf("%sup", v.Name)) * 1000 / msElapsed
+				downDelta = netInterfaceDeltaTracker.Delta(fmt.Sprintf("%sdown", v.Name)) * 1000 / msElapsed
+			}
+			// add interface to systemStats
+			systemStats.NetworkInterfaces[v.Name] = [4]uint64{upDelta, downDelta, v.BytesSent, v.BytesRecv}
+		}
+
+		// add to systemStats
+		var bytesSentPerSecond, bytesRecvPerSecond uint64
+		if msElapsed > 0 {
+			bytesSentPerSecond = (totalBytesSent - a.netIoStats.BytesSent) * 1000 / msElapsed
+			bytesRecvPerSecond = (totalBytesRecv - a.netIoStats.BytesRecv) * 1000 / msElapsed
+		}
+		networkSentPs := bytesToMegabytes(float64(bytesSentPerSecond))
+		networkRecvPs := bytesToMegabytes(float64(bytesRecvPerSecond))
+		// add check for issue (#150) where sent is a massive number
+		if networkSentPs > 10_000 || networkRecvPs > 10_000 {
+			slog.Warn("Invalid net stats. Resetting.", "sent", networkSentPs, "recv", networkRecvPs)
+			for _, v := range netIO {
+				if _, exists := a.netInterfaces[v.Name]; !exists {
+					continue
+				}
+				slog.Info(v.Name, "recv", v.BytesRecv, "sent", v.BytesSent)
+			}
+			// reset network I/O stats
+			a.initializeNetIoStats()
+		} else {
+			systemStats.NetworkSent = networkSentPs
+			systemStats.NetworkRecv = networkRecvPs
+			systemStats.Bandwidth[0], systemStats.Bandwidth[1] = bytesSentPerSecond, bytesRecvPerSecond
+			// update netIoStats
+			a.netIoStats.BytesSent = totalBytesSent
+			a.netIoStats.BytesRecv = totalBytesRecv
+		}
+	}
+}
+
+func (a *Agent) initializeNetIoStats() {
+	// reset valid network interfaces
+	a.netInterfaces = make(map[string]struct{}, 0)
+
+	// map of network interface names passed in via NICS env var
+	var nicsMap map[string]struct{}
+	nics, nicsEnvExists := GetEnv("NICS")
+	if nicsEnvExists {
+		nicsMap = make(map[string]struct{}, 0)
+		for nic := range strings.SplitSeq(nics, ",") {
+			nicsMap[nic] = struct{}{}
+		}
+	}
+
+	// reset network I/O stats
+	a.netIoStats.BytesSent = 0
+	a.netIoStats.BytesRecv = 0
+
+	// get intial network I/O stats
+	if netIO, err := psutilNet.IOCounters(true); err == nil {
+		a.netIoStats.Time = time.Now()
+		for _, v := range netIO {
+			switch {
+			// skip if nics exists and the interface is not in the list
+			case nicsEnvExists:
+				if _, nameInNics := nicsMap[v.Name]; !nameInNics {
+					continue
+				}
+			// otherwise run the interface name through the skipNetworkInterface function
+			default:
+				if a.skipNetworkInterface(v) {
+					continue
+				}
+			}
+			slog.Info("Detected network interface", "name", v.Name, "sent", v.BytesSent, "recv", v.BytesRecv)
+			a.netIoStats.BytesSent += v.BytesSent
+			a.netIoStats.BytesRecv += v.BytesRecv
+			// store as a valid network interface
+			a.netInterfaces[v.Name] = struct{}{}
+		}
+	}
+}
+
+func (a *Agent) skipNetworkInterface(v psutilNet.IOCountersStat) bool {
+	switch {
+	case strings.HasPrefix(v.Name, "lo"),
+		strings.HasPrefix(v.Name, "docker"),
+		strings.HasPrefix(v.Name, "br-"),
+		strings.HasPrefix(v.Name, "veth"),
+		strings.HasPrefix(v.Name, "bond"),
+		v.BytesRecv == 0,
+		v.BytesSent == 0:
+		return true
+	default:
+		return false
+	}
+}

agent/sensors.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"context"
 	"fmt"
 	"log/slog"
@@ -11,6 +10,8 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/shirou/gopsutil/v4/common"
 	"github.com/shirou/gopsutil/v4/sensors"
 )

agent/sensors_test.go

@@ -4,12 +4,13 @@
 package agent
 
 import (
-	"beszel/internal/entities/system"
 	"context"
 	"fmt"
 	"os"
 	"testing"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/shirou/gopsutil/v4/common"
 	"github.com/shirou/gopsutil/v4/sensors"
 	"github.com/stretchr/testify/assert"

agent/sensors_windows.go

@@ -46,9 +46,10 @@ var lhmFs embed.FS
 var (
 	beszelLhm     *lhmProcess
 	beszelLhmOnce sync.Once
+	useLHM        = os.Getenv("LHM") == "true"
 )
 
-var errNoSensors = errors.New("no sensors found (try running as admin)")
+var errNoSensors = errors.New("no sensors found (try running as admin with LHM=true)")
 
 // newlhmProcess copies the embedded LHM executable to a temporary directory and starts it.
 func newlhmProcess() (*lhmProcess, error) {
@@ -139,7 +140,7 @@ func (lhm *lhmProcess) cleanupProcess() {
 }
 
 func (lhm *lhmProcess) getTemps(ctx context.Context) (temps []sensors.TemperatureStat, err error) {
-	if lhm.stoppedNoSensors {
+	if !useLHM || lhm.stoppedNoSensors {
 		// Fall back to gopsutil if we can't get sensors from LHM
 		return sensors.TemperaturesWithContext(ctx)
 	}
@@ -222,6 +223,10 @@ func getSensorTemps(ctx context.Context) (temps []sensors.TemperatureStat, err e
 		}
 	}()
 
+	if !useLHM {
+		return sensors.TemperaturesWithContext(ctx)
+	}
+
 	// Initialize process once
 	beszelLhmOnce.Do(func() {
 		beszelLhm, err = newlhmProcess()

agent/server.go

@@ -1,9 +1,6 @@
 package agent
 
 import (
-	"beszel"
-	"beszel/internal/common"
-	"beszel/internal/entities/system"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -14,6 +11,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/blang/semver"
 	"github.com/fxamacker/cbor/v2"
 	"github.com/gliderlabs/ssh"

agent/server_test.go

@@ -1,8 +1,6 @@
 package agent
 
 import (
-	"beszel/internal/entities/container"
-	"beszel/internal/entities/system"
 	"context"
 	"crypto/ed25519"
 	"encoding/json"
@@ -15,6 +13,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/blang/semver"
 	"github.com/fxamacker/cbor/v2"
 	"github.com/gliderlabs/ssh"

agent/system.go

@@ -1,8 +1,6 @@
 package agent
 
 import (
-	"beszel"
-	"beszel/internal/entities/system"
 	"bufio"
 	"fmt"
 	"log/slog"
@@ -11,14 +9,20 @@ import (
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/agent/battery"
+	"github.com/henrygd/beszel/agent/deltatracker"
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/shirou/gopsutil/v4/cpu"
 	"github.com/shirou/gopsutil/v4/disk"
 	"github.com/shirou/gopsutil/v4/host"
 	"github.com/shirou/gopsutil/v4/load"
 	"github.com/shirou/gopsutil/v4/mem"
-	psutilNet "github.com/shirou/gopsutil/v4/net"
 )
 
+var netInterfaceDeltaTracker = deltatracker.NewDeltaTracker[string, uint64]()
+
 // Sets initial / non-changing values about the host system
 func (a *Agent) initializeSystemInfo() {
 	a.systemInfo.AgentVersion = beszel.Version
@@ -64,22 +68,15 @@ func (a *Agent) initializeSystemInfo() {
 	} else {
 		a.zfs = true
 	}
-
-	// battery
-	if _, _, err := getBatteryStats(); err != nil {
-		slog.Debug("No battery detected", "err", err)
-	} else {
-		a.hasBattery = true
-	}
 }
 
 // Returns current info, stats about the host system
 func (a *Agent) getSystemStats() system.Stats {
-	systemStats := system.Stats{}
+	var systemStats system.Stats
 
 	// battery
-	if a.hasBattery {
-		systemStats.Battery[0], systemStats.Battery[1], _ = getBatteryStats()
+	if battery.HasReadableBattery() {
+		systemStats.Battery[0], systemStats.Battery[1], _ = battery.GetBatteryStats()
 	}
 
 	// cpu percent
@@ -178,55 +175,7 @@ func (a *Agent) getSystemStats() system.Stats {
 	}
 
 	// network stats
-	if len(a.netInterfaces) == 0 {
-		// if no network interfaces, initialize again
-		// this is a fix if agent started before network is online (#466)
-		// maybe refactor this in the future to not cache interface names at all so we
-		// don't miss an interface that's been added after agent started in any circumstance
-		a.initializeNetIoStats()
-	}
-	if netIO, err := psutilNet.IOCounters(true); err == nil {
-		msElapsed := uint64(time.Since(a.netIoStats.Time).Milliseconds())
-		a.netIoStats.Time = time.Now()
-		totalBytesSent := uint64(0)
-		totalBytesRecv := uint64(0)
-		// sum all bytes sent and received
-		for _, v := range netIO {
-			// skip if not in valid network interfaces list
-			if _, exists := a.netInterfaces[v.Name]; !exists {
-				continue
-			}
-			totalBytesSent += v.BytesSent
-			totalBytesRecv += v.BytesRecv
-		}
-		// add to systemStats
-		var bytesSentPerSecond, bytesRecvPerSecond uint64
-		if msElapsed > 0 {
-			bytesSentPerSecond = (totalBytesSent - a.netIoStats.BytesSent) * 1000 / msElapsed
-			bytesRecvPerSecond = (totalBytesRecv - a.netIoStats.BytesRecv) * 1000 / msElapsed
-		}
-		networkSentPs := bytesToMegabytes(float64(bytesSentPerSecond))
-		networkRecvPs := bytesToMegabytes(float64(bytesRecvPerSecond))
-		// add check for issue (#150) where sent is a massive number
-		if networkSentPs > 10_000 || networkRecvPs > 10_000 {
-			slog.Warn("Invalid net stats. Resetting.", "sent", networkSentPs, "recv", networkRecvPs)
-			for _, v := range netIO {
-				if _, exists := a.netInterfaces[v.Name]; !exists {
-					continue
-				}
-				slog.Info(v.Name, "recv", v.BytesRecv, "sent", v.BytesSent)
-			}
-			// reset network I/O stats
-			a.initializeNetIoStats()
-		} else {
-			systemStats.NetworkSent = networkSentPs
-			systemStats.NetworkRecv = networkRecvPs
-			systemStats.Bandwidth[0], systemStats.Bandwidth[1] = bytesSentPerSecond, bytesRecvPerSecond
-			// update netIoStats
-			a.netIoStats.BytesSent = totalBytesSent
-			a.netIoStats.BytesRecv = totalBytesRecv
-		}
-	}
+	a.updateNetworkStats(&systemStats)
 
 	// temperatures
 	// TODO: maybe refactor to methods on systemStats

agent/update.go

@@ -1,12 +1,14 @@
 package agent
 
 import (
-	"beszel/internal/ghupdate"
 	"fmt"
 	"log"
 	"os"
 	"os/exec"
+	"runtime"
 	"strings"
+
+	"github.com/henrygd/beszel/internal/ghupdate"
 )
 
 // restarter knows how to restart the beszel-agent service.
@@ -45,6 +47,16 @@ func (w *openWRTRestarter) Restart() error {
 	return exec.Command(w.cmd, "restart", "beszel-agent").Run()
 }
 
+type freeBSDRestarter struct{ cmd string }
+
+func (f *freeBSDRestarter) Restart() error {
+	if err := exec.Command(f.cmd, "beszel-agent", "status").Run(); err != nil {
+		return nil
+	}
+	ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel-agent via FreeBSD rc…")
+	return exec.Command(f.cmd, "beszel-agent", "restart").Run()
+}
+
 func detectRestarter() restarter {
 	if path, err := exec.LookPath("systemctl"); err == nil {
 		return &systemdRestarter{cmd: path}
@@ -53,6 +65,9 @@ func detectRestarter() restarter {
 		return &openRCRestarter{cmd: path}
 	}
 	if path, err := exec.LookPath("service"); err == nil {
+		if runtime.GOOS == "freebsd" {
+			return &freeBSDRestarter{cmd: path}
+		}
 		return &openWRTRestarter{cmd: path}
 	}
 	return nil
@@ -60,7 +75,7 @@ func detectRestarter() restarter {
 
 // Update checks GitHub for a newer release of beszel-agent, applies it,
 // fixes SELinux context if needed, and restarts the service.
-func Update() error {
+func Update(useMirror bool) error {
 	exePath, _ := os.Executable()
 
 	dataDir, err := getDataDir()
@@ -70,6 +85,7 @@ func Update() error {
 	updated, err := ghupdate.Update(ghupdate.Config{
 		ArchiveExecutable: "beszel-agent",
 		DataDir:           dataDir,
+		UseMirror:         useMirror,
 	})
 	if err != nil {
 		log.Fatal(err)
@@ -99,6 +115,8 @@ func Update() error {
 		if err := r.Restart(); err != nil {
 			ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: failed to restart service: %v", err)
 			ghupdate.ColorPrint(ghupdate.ColorYellow, "Please restart the service manually.")
+		} else {
+			ghupdate.ColorPrint(ghupdate.ColorGreen, "Service restarted successfully")
 		}
 	} else {
 		ghupdate.ColorPrint(ghupdate.ColorYellow, "No supported init system detected; please restart manually if needed.")

beszel.go

@@ -0,0 +1,15 @@
+// Package beszel provides core application constants and version information
+// which are used throughout the application.
+package beszel
+
+import "github.com/blang/semver"
+
+const (
+	// Version is the current version of the application.
+	Version = "0.12.9"
+	// AppName is the name of the application.
+	AppName = "beszel"
+)
+
+// MinVersionCbor is the minimum supported version for CBOR compatibility.
+var MinVersionCbor = semver.MustParse("0.12.0")

beszel/Makefile

@@ -1,98 +0,0 @@
-# Default OS/ARCH values
-OS ?= $(shell go env GOOS)
-ARCH ?= $(shell go env GOARCH)
-# Skip building the web UI if true
-SKIP_WEB ?= false
-
-# Set executable extension based on target OS
-EXE_EXT := $(if $(filter windows,$(OS)),.exe,)
-
-.PHONY: tidy build-agent build-hub build clean lint dev-server dev-agent dev-hub dev generate-locales
-.DEFAULT_GOAL := build
-
-clean:
-	go clean
-	rm -rf ./build
-
-lint:
-	golangci-lint run
-
-test: export GOEXPERIMENT=synctest
-test:
-	go test -tags=testing ./...
-
-tidy:
-	go mod tidy
-
-build-web-ui:
-	@if command -v bun >/dev/null 2>&1; then \
-		bun install --cwd ./site && \
-		bun run --cwd ./site build; \
-	else \
-		npm install --prefix ./site && \
-		npm run --prefix ./site build; \
-	fi
-
-# Conditional .NET build - only for Windows
-build-dotnet-conditional:
-	@if [ "$(OS)" = "windows" ]; then \
-		echo "Building .NET executable for Windows..."; \
-		if command -v dotnet >/dev/null 2>&1; then \
-			rm -rf ./internal/agent/lhm/bin; \
-			dotnet build -c Release ./internal/agent/lhm/beszel_lhm.csproj; \
-		else \
-			echo "Error: dotnet not found. Install .NET SDK to build Windows agent."; \
-			exit 1; \
-		fi; \
-	fi
-
-# Update build-agent to include conditional .NET build
-build-agent: tidy build-dotnet-conditional
-	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel-agent_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" beszel/cmd/agent
-
-build-hub: tidy $(if $(filter false,$(SKIP_WEB)),build-web-ui)
-	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" beszel/cmd/hub
-
-build: build-agent build-hub
-
-generate-locales:
-	@if [ ! -f ./site/src/locales/en/en.ts ]; then \
-		echo "Generating locales..."; \
-		command -v bun >/dev/null 2>&1 && cd ./site && bun install && bun run sync || cd ./site && npm install && npm run sync; \
-	fi
-
-dev-server: generate-locales
-	cd ./site
-	@if command -v bun >/dev/null 2>&1; then \
-		cd ./site && bun run dev --host 0.0.0.0; \
-	else \
-		cd ./site && npm run dev --host 0.0.0.0; \
-	fi
-
-dev-hub: export ENV=dev
-dev-hub:
-	mkdir -p ./site/dist && touch ./site/dist/index.html
-	@if command -v entr >/dev/null 2>&1; then \
-		find ./cmd/hub/*.go ./internal/{alerts,hub,records,users}/*.go | entr -r -s "cd ./cmd/hub && go run . serve --http 0.0.0.0:8090"; \
-	else \
-		cd ./cmd/hub && go run . serve --http 0.0.0.0:8090; \
-	fi
-
-dev-agent:
-	@if command -v entr >/dev/null 2>&1; then \
-		find ./cmd/agent/*.go ./internal/agent/*.go | entr -r go run beszel/cmd/agent; \
-	else \
-		go run beszel/cmd/agent; \
-	fi
-	
-build-dotnet:
-	@if command -v dotnet >/dev/null 2>&1; then \
-		rm -rf ./internal/agent/lhm/bin; \
-		dotnet build -c Release ./internal/agent/lhm/beszel_lhm.csproj; \
-	else \
-		echo "dotnet not found"; \
-	fi
-
-
-# KEY="..." make -j dev
-dev: dev-server dev-hub dev-agent

beszel/internal/agent/battery.go

@@ -1,24 +0,0 @@
-package agent
-
-import "github.com/distatus/battery"
-
-// getBatteryStats returns the current battery percent and charge state
-func getBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	batteries, err := battery.GetAll()
-	if err != nil || len(batteries) == 0 {
-		return batteryPercent, batteryState, err
-	}
-	totalCapacity := float64(0)
-	totalCharge := float64(0)
-	for _, bat := range batteries {
-		if bat.Design != 0 {
-			totalCapacity += bat.Design
-		} else {
-			totalCapacity += bat.Full
-		}
-		totalCharge += bat.Current
-	}
-	batteryPercent = uint8(totalCharge / totalCapacity * 100)
-	batteryState = uint8(batteries[0].State.Raw)
-	return batteryPercent, batteryState, nil
-}

beszel/internal/agent/network.go

@@ -1,67 +0,0 @@
-package agent
-
-import (
-	"log/slog"
-	"strings"
-	"time"
-
-	psutilNet "github.com/shirou/gopsutil/v4/net"
-)
-
-func (a *Agent) initializeNetIoStats() {
-	// reset valid network interfaces
-	a.netInterfaces = make(map[string]struct{}, 0)
-
-	// map of network interface names passed in via NICS env var
-	var nicsMap map[string]struct{}
-	nics, nicsEnvExists := GetEnv("NICS")
-	if nicsEnvExists {
-		nicsMap = make(map[string]struct{}, 0)
-		for nic := range strings.SplitSeq(nics, ",") {
-			nicsMap[nic] = struct{}{}
-		}
-	}
-
-	// reset network I/O stats
-	a.netIoStats.BytesSent = 0
-	a.netIoStats.BytesRecv = 0
-
-	// get intial network I/O stats
-	if netIO, err := psutilNet.IOCounters(true); err == nil {
-		a.netIoStats.Time = time.Now()
-		for _, v := range netIO {
-			switch {
-			// skip if nics exists and the interface is not in the list
-			case nicsEnvExists:
-				if _, nameInNics := nicsMap[v.Name]; !nameInNics {
-					continue
-				}
-			// otherwise run the interface name through the skipNetworkInterface function
-			default:
-				if a.skipNetworkInterface(v) {
-					continue
-				}
-			}
-			slog.Info("Detected network interface", "name", v.Name, "sent", v.BytesSent, "recv", v.BytesRecv)
-			a.netIoStats.BytesSent += v.BytesSent
-			a.netIoStats.BytesRecv += v.BytesRecv
-			// store as a valid network interface
-			a.netInterfaces[v.Name] = struct{}{}
-		}
-	}
-}
-
-func (a *Agent) skipNetworkInterface(v psutilNet.IOCountersStat) bool {
-	switch {
-	case strings.HasPrefix(v.Name, "lo"),
-		strings.HasPrefix(v.Name, "docker"),
-		strings.HasPrefix(v.Name, "br-"),
-		strings.HasPrefix(v.Name, "veth"),
-		strings.HasPrefix(v.Name, "bond"),
-		v.BytesRecv == 0,
-		v.BytesSent == 0:
-		return true
-	default:
-		return false
-	}
-}

beszel/internal/alerts/alerts_test.go

@@ -1,368 +0,0 @@
-//go:build testing
-// +build testing
-
-package alerts_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-
-	beszelTests "beszel/internal/tests"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	pbTests "github.com/pocketbase/pocketbase/tests"
-	"github.com/stretchr/testify/assert"
-)
-
-// marshal to json and return an io.Reader (for use in ApiScenario.Body)
-func jsonReader(v any) io.Reader {
-	data, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	return bytes.NewReader(data)
-}
-
-func TestUserAlertsApi(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	hub.StartHub()
-
-	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
-	user1Token, _ := user1.NewAuthToken()
-
-	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
-	user2Token, _ := user2.NewAuthToken()
-
-	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system1",
-		"users": []string{user1.Id},
-		"host":  "127.0.0.1",
-	})
-
-	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system2",
-		"users": []string{user1.Id, user2.Id},
-		"host":  "127.0.0.2",
-	})
-
-	userRecords, _ := hub.CountRecords("users")
-	assert.EqualValues(t, 2, userRecords, "all users should be created")
-
-	systemRecords, _ := hub.CountRecords("systems")
-	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		{
-			Name:            "GET not implemented - returns index",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "POST no auth",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST no body",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST bad data",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"invalidField": "this should cause validation error",
-				"threshold":    "not a number",
-			}),
-		},
-		{
-			Name:   "POST malformed JSON",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
-		},
-		{
-			Name:   "POST valid alert data multiple systems",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     69,
-				"min":       9,
-				"systems":   []string{system1.Id, system2.Id},
-				"overwrite": false,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				// check total alerts
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				// check alert has correct values
-				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
-				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "POST valid alert data single system",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id},
-				"value":   90,
-				"min":     10,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
-			},
-		},
-		{
-			Name:   "Overwrite: false, should not overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system1.Id},
-				"overwrite": false,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
-				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
-			},
-		},
-		{
-			Name:   "Overwrite: true, should overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system2.Id},
-				"overwrite": true,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system2.Id,
-					"user":   user2.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
-				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
-			},
-		},
-		{
-			Name:            "DELETE no auth",
-			Method:          http.MethodDelete,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "DELETE alert",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "DELETE alert multiple systems",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id, system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, systemId := range []string{system1.Id, system2.Id} {
-					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "Memory",
-						"system": systemId,
-						"user":   user1.Id,
-						"value":  90,
-						"min":    10,
-					})
-					assert.NoError(t, err, "should create alert")
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "User 2 should not be able to delete alert of user 1",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, user := range []string{user1.Id, user2.Id} {
-					beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "CPU",
-						"system": system2.Id,
-						"user":   user,
-						"value":  80,
-						"min":    10,
-					})
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.Zero(t, user2AlertCount, "should have 0 alerts")
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

beszel/internal/records/records_test_helpers.go

@@ -1,23 +0,0 @@
-//go:build testing
-// +build testing
-
-package records
-
-import (
-	"github.com/pocketbase/pocketbase/core"
-)
-
-// TestDeleteOldSystemStats exposes deleteOldSystemStats for testing
-func TestDeleteOldSystemStats(app core.App) error {
-	return deleteOldSystemStats(app)
-}
-
-// TestDeleteOldAlertsHistory exposes deleteOldAlertsHistory for testing
-func TestDeleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
-	return deleteOldAlertsHistory(app, countToKeep, countBeforeDeletion)
-}
-
-// TestTwoDecimals exposes twoDecimals for testing
-func TestTwoDecimals(value float64) float64 {
-	return twoDecimals(value)
-}

beszel/migrations/initial-settings.go

@@ -1,29 +0,0 @@
-package migrations
-
-import (
-	"github.com/pocketbase/pocketbase/core"
-	m "github.com/pocketbase/pocketbase/migrations"
-)
-
-const (
-	TempAdminEmail = "_@b.b"
-)
-
-func init() {
-	m.Register(func(app core.App) error {
-		// initial settings
-		settings := app.Settings()
-		settings.Meta.AppName = "Beszel"
-		settings.Meta.HideControls = true
-		settings.Logs.MinLevel = 4
-		if err := app.Save(settings); err != nil {
-			return err
-		}
-		// create superuser
-		collection, _ := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
-		user := core.NewRecord(collection)
-		user.SetEmail(TempAdminEmail)
-		user.SetRandomPassword()
-		return app.Save(user)
-	}, nil)
-}

beszel/site/src/components/ui/command.tsx

@@ -1,132 +0,0 @@
-import * as React from "react"
-import { DialogTitle, type DialogProps } from "@radix-ui/react-dialog"
-import { Command as CommandPrimitive } from "cmdk"
-import { Search } from "lucide-react"
-
-import { cn } from "@/lib/utils"
-import { Dialog, DialogContent } from "@/components/ui/dialog"
-
-const Command = React.forwardRef<
-	React.ElementRef<typeof CommandPrimitive>,
-	React.ComponentPropsWithoutRef<typeof CommandPrimitive>
->(({ className, ...props }, ref) => (
-	<CommandPrimitive
-		ref={ref}
-		className={cn("flex h-full w-full flex-col overflow-hidden bg-card", className)}
-		{...props}
-	/>
-))
-Command.displayName = CommandPrimitive.displayName
-
-interface CommandDialogProps extends DialogProps {}
-
-const CommandDialog = ({ children, ...props }: CommandDialogProps) => {
-	return (
-		<Dialog {...props}>
-			<DialogContent className="overflow-hidden p-0 shadow-lg">
-				<div className="sr-only">
-					<DialogTitle>Command</DialogTitle>
-				</div>
-				<Command className="[&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:font-medium [&_[cmdk-group-heading]]:text-muted-foreground [&_[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0 [&_[cmdk-group]]:px-2 [&_[cmdk-input-wrapper]_svg]:h-5 [&_[cmdk-input-wrapper]_svg]:w-5 [&_[cmdk-input]]:h-12 [&_[cmdk-item]]:px-2 [&_[cmdk-item]]:py-3 [&_[cmdk-item]_svg]:h-5 [&_[cmdk-item]_svg]:w-5">
-					{children}
-				</Command>
-			</DialogContent>
-		</Dialog>
-	)
-}
-
-const CommandInput = React.forwardRef<
-	React.ElementRef<typeof CommandPrimitive.Input>,
-	React.ComponentPropsWithoutRef<typeof CommandPrimitive.Input>
->(({ className, ...props }, ref) => (
-	<div className="flex items-center border-b px-3" cmdk-input-wrapper="">
-		<Search className="me-2 h-4 w-4 shrink-0 opacity-50" />
-		<CommandPrimitive.Input
-			ref={ref}
-			className={cn(
-				"flex h-11 w-full rounded-md bg-transparent py-3 text-sm outline-hidden placeholder:text-muted-foreground disabled:cursor-not-allowed disabled:opacity-50",
-				className
-			)}
-			{...props}
-		/>
-	</div>
-))
-
-CommandInput.displayName = CommandPrimitive.Input.displayName
-
-const CommandList = React.forwardRef<
-	React.ElementRef<typeof CommandPrimitive.List>,
-	React.ComponentPropsWithoutRef<typeof CommandPrimitive.List>
->(({ className, ...props }, ref) => (
-	<CommandPrimitive.List
-		ref={ref}
-		className={cn("max-h-[300px] overflow-y-auto overflow-x-hidden", className)}
-		{...props}
-	/>
-))
-
-CommandList.displayName = CommandPrimitive.List.displayName
-
-const CommandEmpty = React.forwardRef<
-	React.ElementRef<typeof CommandPrimitive.Empty>,
-	React.ComponentPropsWithoutRef<typeof CommandPrimitive.Empty>
->((props, ref) => <CommandPrimitive.Empty ref={ref} className="py-6 text-center text-sm" {...props} />)
-
-CommandEmpty.displayName = CommandPrimitive.Empty.displayName
-
-const CommandGroup = React.forwardRef<
-	React.ElementRef<typeof CommandPrimitive.Group>,
-	React.ComponentPropsWithoutRef<typeof CommandPrimitive.Group>
->(({ className, ...props }, ref) => (
-	<CommandPrimitive.Group
-		ref={ref}
-		className={cn(
-			"overflow-hidden p-1 text-foreground [&_[cmdk-group-heading]]:px-2 [&_[cmdk-group-heading]]:py-1.5 [&_[cmdk-group-heading]]:text-xs [&_[cmdk-group-heading]]:font-medium [&_[cmdk-group-heading]]:text-muted-foreground",
-			className
-		)}
-		{...props}
-	/>
-))
-
-CommandGroup.displayName = CommandPrimitive.Group.displayName
-
-const CommandSeparator = React.forwardRef<
-	React.ElementRef<typeof CommandPrimitive.Separator>,
-	React.ComponentPropsWithoutRef<typeof CommandPrimitive.Separator>
->(({ className, ...props }, ref) => (
-	<CommandPrimitive.Separator ref={ref} className={cn("-mx-1 h-px bg-border", className)} {...props} />
-))
-CommandSeparator.displayName = CommandPrimitive.Separator.displayName
-
-const CommandItem = React.forwardRef<
-	React.ElementRef<typeof CommandPrimitive.Item>,
-	React.ComponentPropsWithoutRef<typeof CommandPrimitive.Item>
->(({ className, ...props }, ref) => (
-	<CommandPrimitive.Item
-		ref={ref}
-		className={cn(
-			"relative flex cursor-default opacity-70 select-none items-center rounded-sm px-2 py-1.5 text-sm outline-hidden aria-selected:bg-accent/60 aria-selected:opacity-90 data-[disabled='true']:pointer-events-none data-[disabled='true']:opacity-50",
-			className
-		)}
-		{...props}
-	/>
-))
-
-CommandItem.displayName = CommandPrimitive.Item.displayName
-
-const CommandShortcut = ({ className, ...props }: React.HTMLAttributes<HTMLSpanElement>) => {
-	return <span className={cn("ms-auto text-xs tracking-wide text-muted-foreground", className)} {...props} />
-}
-CommandShortcut.displayName = "CommandShortcut"
-
-export {
-	Command,
-	CommandDialog,
-	CommandInput,
-	CommandList,
-	CommandEmpty,
-	CommandGroup,
-	CommandItem,
-	CommandShortcut,
-	CommandSeparator,
-}

beszel/site/src/components/ui/toaster.tsx

@@ -1,24 +0,0 @@
-import { Toast, ToastClose, ToastDescription, ToastProvider, ToastTitle, ToastViewport } from "@/components/ui/toast"
-import { useToast } from "@/components/ui/use-toast"
-
-export function Toaster() {
-	const { toasts } = useToast()
-
-	return (
-		<ToastProvider>
-			{toasts.map(function ({ id, title, description, action, ...props }) {
-				return (
-					<Toast key={id} {...props}>
-						<div className="grid gap-1">
-							{title && <ToastTitle>{title}</ToastTitle>}
-							{description && <ToastDescription>{description}</ToastDescription>}
-						</div>
-						{action}
-						<ToastClose />
-					</Toast>
-				)
-			})}
-			<ToastViewport />
-		</ToastProvider>
-	)
-}

beszel/site/src/components/ui/tooltip.tsx

@@ -1,28 +0,0 @@
-import * as React from "react"
-import * as TooltipPrimitive from "@radix-ui/react-tooltip"
-
-import { cn } from "@/lib/utils"
-
-const TooltipProvider = TooltipPrimitive.Provider
-
-const Tooltip = TooltipPrimitive.Root
-
-const TooltipTrigger = TooltipPrimitive.Trigger
-
-const TooltipContent = React.forwardRef<
-	React.ElementRef<typeof TooltipPrimitive.Content>,
-	React.ComponentPropsWithoutRef<typeof TooltipPrimitive.Content>
->(({ className, sideOffset = 4, ...props }, ref) => (
-	<TooltipPrimitive.Content
-		ref={ref}
-		sideOffset={sideOffset}
-		className={cn(
-			"z-50 overflow-hidden rounded-md border bg-popover px-3 py-1.5 text-sm text-popover-foreground shadow-md animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
-			className
-		)}
-		{...props}
-	/>
-))
-TooltipContent.displayName = TooltipPrimitive.Content.displayName
-
-export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider }

beszel/version.go

@@ -1,10 +0,0 @@
-package beszel
-
-import "github.com/blang/semver"
-
-const (
-	Version = "0.12.4"
-	AppName = "beszel"
-)
-
-var MinVersionCbor = semver.MustParse("0.12.0")

go.mod

@@ -1,6 +1,6 @@
-module beszel
+module github.com/henrygd/beszel
 
-go 1.24.4
+go 1.25.1
 
 // lock shoutrrr to specific version to allow review before updating
 replace github.com/nicholas-fedor/shoutrrr => github.com/nicholas-fedor/shoutrrr v0.8.8
@@ -15,9 +15,10 @@ require (
 	github.com/nicholas-fedor/shoutrrr v0.8.17
 	github.com/pocketbase/dbx v1.11.0
 	github.com/pocketbase/pocketbase v0.29.3
-	github.com/shirou/gopsutil/v4 v4.25.7
+	github.com/shirou/gopsutil/v4 v4.25.6
 	github.com/spf13/cast v1.9.2
 	github.com/spf13/cobra v1.9.1
+	github.com/spf13/pflag v1.0.7
 	github.com/stretchr/testify v1.11.0
 	golang.org/x/crypto v0.41.0
 	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b
@@ -49,7 +50,6 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/tklauser/go-sysconf v0.3.15 // indirect
 	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect

go.sum

@@ -97,8 +97,8 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qq
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.25.7 h1:bNb2JuqKuAu3tRlPv5piSmBZyMfecwQ+t/ILq+1JqVM=
-github.com/shirou/gopsutil/v4 v4.25.7/go.mod h1:XV/egmwJtd3ZQjBpJVY5kndsiOO4IRqy9TQnmm6VP7U=
+github.com/shirou/gopsutil/v4 v4.25.6 h1:kLysI2JsKorfaFPcYmcJqbzROzsBWEOAtw6A7dIfqXs=
+github.com/shirou/gopsutil/v4 v4.25.6/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c=
 github.com/spf13/cast v1.9.2 h1:SsGfm7M8QOFtEzumm7UZrZdLLquNdzFYfIbEXntcFbE=
 github.com/spf13/cast v1.9.2/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=

i18n.yml

@@ -1,3 +1,3 @@
 files:
-  - source: /beszel/site/src/locales/en/en.po
-    translation: /beszel/site/src/locales/%two_letters_code%/%two_letters_code%.po
+  - source: /internal/site/src/locales/en/
+    translation: /internal/site/src/locales/%two_letters_code%/%two_letters_code%.po

internal/alerts/alerts.go

@@ -87,7 +87,7 @@ var supportsTitle = map[string]struct{}{
 func NewAlertManager(app hubLike) *AlertManager {
 	am := &AlertManager{
 		hub:        app,
-		alertQueue: make(chan alertTask),
+		alertQueue: make(chan alertTask, 5),
 		stopChan:   make(chan struct{}),
 	}
 	am.bindEvents()

internal/alerts/alerts_history.go

@@ -42,21 +42,10 @@ func updateHistoryOnAlertUpdate(e *core.RecordEvent) error {
 
 // resolveAlertHistoryRecord sets the resolved field to the current time
 func resolveAlertHistoryRecord(app core.App, alertRecordID string) error {
-	alertHistoryRecords, err := app.FindRecordsByFilter(
-		"alerts_history",
-		"alert_id={:alert_id} && resolved=null",
-		"-created",
-		1,
-		0,
-		dbx.Params{"alert_id": alertRecordID},
-	)
-	if err != nil {
+	alertHistoryRecord, err := app.FindFirstRecordByFilter("alerts_history", "alert_id={:alert_id} && resolved=null", dbx.Params{"alert_id": alertRecordID})
+	if err != nil || alertHistoryRecord == nil {
 		return err
 	}
-	if len(alertHistoryRecords) == 0 {
-		return nil
-	}
-	alertHistoryRecord := alertHistoryRecords[0] // there should be only one record
 	alertHistoryRecord.Set("resolved", time.Now().UTC())
 	err = app.Save(alertHistoryRecord)
 	if err != nil {

internal/alerts/alerts_status.go

@@ -25,7 +25,12 @@ type alertInfo struct {
 // startWorker is a long-running goroutine that processes alert tasks
 // every x seconds. It must be running to process status alerts.
 func (am *AlertManager) startWorker() {
-	tick := time.Tick(15 * time.Second)
+	processPendingAlerts := time.Tick(15 * time.Second)
+
+	// check for status alerts that are not resolved when system comes up
+	// (can be removed if we figure out core bug in #1052)
+	checkStatusAlerts := time.Tick(561 * time.Second)
+
 	for {
 		select {
 		case <-am.stopChan:
@@ -41,7 +46,9 @@ func (am *AlertManager) startWorker() {
 			case "cancel":
 				am.pendingAlerts.Delete(task.alertRecord.Id)
 			}
-		case <-tick:
+		case <-checkStatusAlerts:
+			resolveStatusAlerts(am.hub)
+		case <-processPendingAlerts:
 			// Check for expired alerts every tick
 			now := time.Now()
 			for key, value := range am.pendingAlerts.Range {
@@ -170,3 +177,35 @@ func (am *AlertManager) sendStatusAlert(alertStatus string, systemName string, a
 		LinkText: "View " + systemName,
 	})
 }
+
+// resolveStatusAlerts resolves any status alerts that weren't resolved
+// when system came up (https://github.com/henrygd/beszel/issues/1052)
+func resolveStatusAlerts(app core.App) error {
+	db := app.DB()
+	// Find all active status alerts where the system is actually up
+	var alertIds []string
+	err := db.NewQuery(`
+		SELECT a.id 
+		FROM alerts a
+		JOIN systems s ON a.system = s.id
+		WHERE a.name = 'Status' 
+		AND a.triggered = true
+		AND s.status = 'up'
+	`).Column(&alertIds)
+	if err != nil {
+		return err
+	}
+	// resolve all matching alert records
+	for _, alertId := range alertIds {
+		alert, err := app.FindRecordById("alerts", alertId)
+		if err != nil {
+			return err
+		}
+		alert.Set("triggered", false)
+		err = app.Save(alert)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}

internal/alerts/alerts_system.go

@@ -1,12 +1,13 @@
 package alerts
 
 import (
-	"beszel/internal/entities/system"
 	"encoding/json"
 	"fmt"
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/types"

internal/alerts/alerts_test.go

@@ -0,0 +1,680 @@
+//go:build testing
+// +build testing
+
+package alerts_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/henrygd/beszel/internal/alerts"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	pbTests "github.com/pocketbase/pocketbase/tests"
+	"github.com/stretchr/testify/assert"
+)
+
+// marshal to json and return an io.Reader (for use in ApiScenario.Body)
+func jsonReader(v any) io.Reader {
+	data, err := json.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	return bytes.NewReader(data)
+}
+
+func TestUserAlertsApi(t *testing.T) {
+	hub, _ := beszelTests.NewTestHub(t.TempDir())
+	defer hub.Cleanup()
+
+	hub.StartHub()
+
+	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
+	user1Token, _ := user1.NewAuthToken()
+
+	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
+	user2Token, _ := user2.NewAuthToken()
+
+	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system1",
+		"users": []string{user1.Id},
+		"host":  "127.0.0.1",
+	})
+
+	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system2",
+		"users": []string{user1.Id, user2.Id},
+		"host":  "127.0.0.2",
+	})
+
+	userRecords, _ := hub.CountRecords("users")
+	assert.EqualValues(t, 2, userRecords, "all users should be created")
+
+	systemRecords, _ := hub.CountRecords("systems")
+	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		// {
+		// 	Name:            "GET not implemented - returns index",
+		// 	Method:          http.MethodGet,
+		// 	URL:             "/api/beszel/user-alerts",
+		// 	ExpectedStatus:  200,
+		// 	ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
+		// 	TestAppFactory:  testAppFactory,
+		// },
+		{
+			Name:            "POST no auth",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST no body",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST bad data",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"invalidField": "this should cause validation error",
+				"threshold":    "not a number",
+			}),
+		},
+		{
+			Name:   "POST malformed JSON",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
+		},
+		{
+			Name:   "POST valid alert data multiple systems",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     69,
+				"min":       9,
+				"systems":   []string{system1.Id, system2.Id},
+				"overwrite": false,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				// check total alerts
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				// check alert has correct values
+				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
+				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "POST valid alert data single system",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id},
+				"value":   90,
+				"min":     10,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
+			},
+		},
+		{
+			Name:   "Overwrite: false, should not overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system1.Id},
+				"overwrite": false,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
+				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
+			},
+		},
+		{
+			Name:   "Overwrite: true, should overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system2.Id},
+				"overwrite": true,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system2.Id,
+					"user":   user2.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
+				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
+			},
+		},
+		{
+			Name:            "DELETE no auth",
+			Method:          http.MethodDelete,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "DELETE alert",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "DELETE alert multiple systems",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id, system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, systemId := range []string{system1.Id, system2.Id} {
+					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "Memory",
+						"system": systemId,
+						"user":   user1.Id,
+						"value":  90,
+						"min":    10,
+					})
+					assert.NoError(t, err, "should create alert")
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "User 2 should not be able to delete alert of user 1",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, user := range []string{user1.Id, user2.Id} {
+					beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "CPU",
+						"system": system2.Id,
+						"user":   user,
+						"value":  80,
+						"min":    10,
+					})
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.Zero(t, user2AlertCount, "should have 0 alerts")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestStatusAlerts(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
+		defer hub.Cleanup()
+
+		systems, err := beszelTests.CreateSystems(hub, 4, user.Id, "paused")
+		assert.NoError(t, err)
+
+		var alerts []*core.Record
+		for i, system := range systems {
+			alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+				"name":   "Status",
+				"system": system.Id,
+				"user":   user.Id,
+				"min":    i + 1,
+			})
+			assert.NoError(t, err)
+			alerts = append(alerts, alert)
+		}
+
+		time.Sleep(10 * time.Millisecond)
+
+		for _, alert := range alerts {
+			assert.False(t, alert.GetBool("triggered"), "Alert should not be triggered immediately")
+		}
+		if hub.TestMailer.TotalSend() != 0 {
+			assert.Zero(t, hub.TestMailer.TotalSend(), "Expected 0 messages, got %d", hub.TestMailer.TotalSend())
+		}
+		for _, system := range systems {
+			assert.EqualValues(t, "paused", system.GetString("status"), "System should be paused")
+		}
+		for _, system := range systems {
+			system.Set("status", "up")
+			err = hub.SaveNoValidate(system)
+			assert.NoError(t, err)
+		}
+		time.Sleep(time.Second)
+		assert.EqualValues(t, 0, hub.GetPendingAlertsCount(), "should have 0 alerts in the pendingAlerts map")
+		for _, system := range systems {
+			system.Set("status", "down")
+			err = hub.SaveNoValidate(system)
+			assert.NoError(t, err)
+		}
+		// after 30 seconds, should have 4 alerts in the pendingAlerts map, no triggered alerts
+		time.Sleep(time.Second * 30)
+		assert.EqualValues(t, 4, hub.GetPendingAlertsCount(), "should have 4 alerts in the pendingAlerts map")
+		triggeredCount, err := hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 0, triggeredCount, "should have 0 alert triggered")
+		assert.EqualValues(t, 0, hub.TestMailer.TotalSend(), "should have 0 messages sent")
+		// after 1:30 seconds, should have 1 triggered alert and 3 pending alerts
+		time.Sleep(time.Second * 60)
+		assert.EqualValues(t, 3, hub.GetPendingAlertsCount(), "should have 3 alerts in the pendingAlerts map")
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 1, triggeredCount, "should have 1 alert triggered")
+		assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should have 1 messages sent")
+		// after 2:30 seconds, should have 2 triggered alerts and 2 pending alerts
+		time.Sleep(time.Second * 60)
+		assert.EqualValues(t, 2, hub.GetPendingAlertsCount(), "should have 2 alerts in the pendingAlerts map")
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 2, triggeredCount, "should have 2 alert triggered")
+		assert.EqualValues(t, 2, hub.TestMailer.TotalSend(), "should have 2 messages sent")
+		// now we will bring the remaning systems back up
+		for _, system := range systems {
+			system.Set("status", "up")
+			err = hub.SaveNoValidate(system)
+			assert.NoError(t, err)
+		}
+		time.Sleep(time.Second)
+		// should have 0 alerts in the pendingAlerts map and 0 alerts triggered
+		assert.EqualValues(t, 0, hub.GetPendingAlertsCount(), "should have 0 alerts in the pendingAlerts map")
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.Zero(t, triggeredCount, "should have 0 alert triggered")
+		// 4 messages sent, 2 down alerts and 2 up alerts for first 2 systems
+		assert.EqualValues(t, 4, hub.TestMailer.TotalSend(), "should have 4 messages sent")
+	})
+}
+
+func TestAlertsHistory(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
+		defer hub.Cleanup()
+
+		// Create systems and alerts
+		systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+		assert.NoError(t, err)
+		system := systems[0]
+
+		alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+			"name":   "Status",
+			"system": system.Id,
+			"user":   user.Id,
+			"min":    1,
+		})
+		assert.NoError(t, err)
+
+		// Initially, no alert history records should exist
+		initialHistoryCount, err := hub.CountRecords("alerts_history", nil)
+		assert.NoError(t, err)
+		assert.Zero(t, initialHistoryCount, "Should have 0 alert history records initially")
+
+		// Set system to up initially
+		system.Set("status", "up")
+		err = hub.SaveNoValidate(system)
+		assert.NoError(t, err)
+		time.Sleep(10 * time.Millisecond)
+
+		// Set system to down to trigger alert
+		system.Set("status", "down")
+		err = hub.SaveNoValidate(system)
+		assert.NoError(t, err)
+
+		// Wait for alert to trigger (after the downtime delay)
+		// With 1 minute delay, we need to wait at least 1 minute + some buffer
+		time.Sleep(time.Second * 75)
+
+		// Check that alert is triggered
+		triggeredCount, err := hub.CountRecords("alerts", dbx.HashExp{"triggered": true, "id": alert.Id})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 1, triggeredCount, "Alert should be triggered")
+
+		// Check that alert history record was created
+		historyCount, err := hub.CountRecords("alerts_history", dbx.HashExp{"alert_id": alert.Id})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 1, historyCount, "Should have 1 alert history record for triggered alert")
+
+		// Get the alert history record and verify it's not resolved immediately
+		historyRecord, err := hub.FindFirstRecordByFilter("alerts_history", "alert_id={:alert_id}", dbx.Params{"alert_id": alert.Id})
+		assert.NoError(t, err)
+		assert.NotNil(t, historyRecord, "Alert history record should exist")
+		assert.Equal(t, alert.Id, historyRecord.GetString("alert_id"), "Alert history should reference correct alert")
+		assert.Equal(t, system.Id, historyRecord.GetString("system"), "Alert history should reference correct system")
+		assert.Equal(t, "Status", historyRecord.GetString("name"), "Alert history should have correct name")
+
+		// The alert history might be resolved immediately in some cases, so let's check the alert's triggered status
+		alertRecord, err := hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alert.Id})
+		assert.NoError(t, err)
+		assert.True(t, alertRecord.GetBool("triggered"), "Alert should still be triggered when checking history")
+
+		// Now resolve the alert by setting system back to up
+		system.Set("status", "up")
+		err = hub.SaveNoValidate(system)
+		assert.NoError(t, err)
+		time.Sleep(200 * time.Millisecond)
+
+		// Check that alert is no longer triggered
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true, "id": alert.Id})
+		assert.NoError(t, err)
+		assert.Zero(t, triggeredCount, "Alert should not be triggered after system is back up")
+
+		// Check that alert history record is now resolved
+		historyRecord, err = hub.FindFirstRecordByFilter("alerts_history", "alert_id={:alert_id}", dbx.Params{"alert_id": alert.Id})
+		assert.NoError(t, err)
+		assert.NotNil(t, historyRecord, "Alert history record should still exist")
+		assert.NotNil(t, historyRecord.Get("resolved"), "Alert history should be resolved")
+
+		// Test deleting a triggered alert resolves its history
+		// Create another system and alert
+		systems2, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+		assert.NoError(t, err)
+		system2 := systems2[0]
+		system2.Set("name", "test-system-2") // Rename for clarity
+		err = hub.SaveNoValidate(system2)
+		assert.NoError(t, err)
+
+		alert2, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+			"name":   "Status",
+			"system": system2.Id,
+			"user":   user.Id,
+			"min":    1,
+		})
+		assert.NoError(t, err)
+
+		// Set system2 to down to trigger alert
+		system2.Set("status", "down")
+		err = hub.SaveNoValidate(system2)
+		assert.NoError(t, err)
+
+		// Wait for alert to trigger
+		time.Sleep(time.Second * 75)
+
+		// Verify alert is triggered and history record exists
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true, "id": alert2.Id})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 1, triggeredCount, "Second alert should be triggered")
+
+		historyCount, err = hub.CountRecords("alerts_history", dbx.HashExp{"alert_id": alert2.Id})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 1, historyCount, "Should have 1 alert history record for second alert")
+
+		// Delete the triggered alert
+		err = hub.Delete(alert2)
+		assert.NoError(t, err)
+
+		// Check that alert history record is resolved after deletion
+		historyRecord2, err := hub.FindFirstRecordByFilter("alerts_history", "alert_id={:alert_id}", dbx.Params{"alert_id": alert2.Id})
+		assert.NoError(t, err)
+		assert.NotNil(t, historyRecord2, "Alert history record should still exist after alert deletion")
+		assert.NotNil(t, historyRecord2.Get("resolved"), "Alert history should be resolved after alert deletion")
+
+		// Verify total history count is correct (2 records total)
+		totalHistoryCount, err := hub.CountRecords("alerts_history", nil)
+		assert.NoError(t, err)
+		assert.EqualValues(t, 2, totalHistoryCount, "Should have 2 total alert history records")
+	})
+}
+func TestResolveStatusAlerts(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a systemUp
+	systemUp, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"users":  []string{user.Id},
+		"host":   "127.0.0.1",
+		"status": "up",
+	})
+	assert.NoError(t, err)
+
+	systemDown, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system-2",
+		"users":  []string{user.Id},
+		"host":   "127.0.0.2",
+		"status": "up",
+	})
+	assert.NoError(t, err)
+
+	// Create a status alertUp for the system
+	alertUp, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Status",
+		"system": systemUp.Id,
+		"user":   user.Id,
+		"min":    1,
+	})
+	assert.NoError(t, err)
+
+	alertDown, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Status",
+		"system": systemDown.Id,
+		"user":   user.Id,
+		"min":    1,
+	})
+	assert.NoError(t, err)
+
+	// Verify alert is not triggered initially
+	assert.False(t, alertUp.GetBool("triggered"), "Alert should not be triggered initially")
+
+	// Set the system to 'up' (this should not trigger the alert)
+	systemUp.Set("status", "up")
+	err = hub.SaveNoValidate(systemUp)
+	assert.NoError(t, err)
+
+	systemDown.Set("status", "down")
+	err = hub.SaveNoValidate(systemDown)
+	assert.NoError(t, err)
+
+	// Wait a moment for any processing
+	time.Sleep(10 * time.Millisecond)
+
+	// Verify alertUp is still not triggered after setting system to up
+	alertUp, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertUp.Id})
+	assert.NoError(t, err)
+	assert.False(t, alertUp.GetBool("triggered"), "Alert should not be triggered when system is up")
+
+	// Manually set both alerts triggered to true
+	alertUp.Set("triggered", true)
+	err = hub.SaveNoValidate(alertUp)
+	assert.NoError(t, err)
+	alertDown.Set("triggered", true)
+	err = hub.SaveNoValidate(alertDown)
+	assert.NoError(t, err)
+
+	// Verify we have exactly one alert with triggered true
+	triggeredCount, err := hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+	assert.NoError(t, err)
+	assert.EqualValues(t, 2, triggeredCount, "Should have exactly two alerts with triggered true")
+
+	// Verify the specific alertUp is triggered
+	alertUp, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertUp.Id})
+	assert.NoError(t, err)
+	assert.True(t, alertUp.GetBool("triggered"), "Alert should be triggered")
+
+	// Verify we have two unresolved alert history records
+	alertHistoryCount, err := hub.CountRecords("alerts_history", dbx.HashExp{"resolved": ""})
+	assert.NoError(t, err)
+	assert.EqualValues(t, 2, alertHistoryCount, "Should have exactly two unresolved alert history records")
+
+	err = alerts.ResolveStatusAlerts(hub)
+	assert.NoError(t, err)
+
+	// Verify alertUp is not triggered after resolving
+	alertUp, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertUp.Id})
+	assert.NoError(t, err)
+	assert.False(t, alertUp.GetBool("triggered"), "Alert should not be triggered after resolving")
+	// Verify alertDown is still triggered
+	alertDown, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertDown.Id})
+	assert.NoError(t, err)
+	assert.True(t, alertDown.GetBool("triggered"), "Alert should still be triggered after resolving")
+
+	// Verify we have one unresolved alert history record
+	alertHistoryCount, err = hub.CountRecords("alerts_history", dbx.HashExp{"resolved": ""})
+	assert.NoError(t, err)
+	assert.EqualValues(t, 1, alertHistoryCount, "Should have exactly one unresolved alert history record")
+
+}

internal/alerts/alerts_test_helpers.go

@@ -0,0 +1,62 @@
+//go:build testing
+// +build testing
+
+package alerts
+
+import (
+	"sync"
+	"time"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func (am *AlertManager) GetAlertManager() *AlertManager {
+	return am
+}
+
+func (am *AlertManager) GetPendingAlerts() *sync.Map {
+	return &am.pendingAlerts
+}
+
+func (am *AlertManager) GetPendingAlertsCount() int {
+	count := 0
+	am.pendingAlerts.Range(func(key, value any) bool {
+		count++
+		return true
+	})
+	return count
+}
+
+// ProcessPendingAlerts manually processes all expired alerts (for testing)
+func (am *AlertManager) ProcessPendingAlerts() ([]*core.Record, error) {
+	now := time.Now()
+	var lastErr error
+	var processedAlerts []*core.Record
+	am.pendingAlerts.Range(func(key, value any) bool {
+		info := value.(*alertInfo)
+		if now.After(info.expireTime) {
+			// Downtime delay has passed, process alert
+			if err := am.sendStatusAlert("down", info.systemName, info.alertRecord); err != nil {
+				lastErr = err
+			}
+			processedAlerts = append(processedAlerts, info.alertRecord)
+			am.pendingAlerts.Delete(key)
+		}
+		return true
+	})
+	return processedAlerts, lastErr
+}
+
+// ForceExpirePendingAlerts sets all pending alerts to expire immediately (for testing)
+func (am *AlertManager) ForceExpirePendingAlerts() {
+	now := time.Now()
+	am.pendingAlerts.Range(func(key, value any) bool {
+		info := value.(*alertInfo)
+		info.expireTime = now.Add(-time.Second) // Set to 1 second ago
+		return true
+	})
+}
+
+func ResolveStatusAlerts(app core.App) error {
+	return resolveStatusAlerts(app)
+}

internal/cmd/agent/agent.go

@@ -1,15 +1,15 @@
 package main
 
 import (
-	"beszel"
-	"beszel/internal/agent"
-	"beszel/internal/agent/health"
-	"flag"
 	"fmt"
 	"log"
 	"os"
 	"strings"
 
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/agent"
+	"github.com/henrygd/beszel/agent/health"
+	"github.com/spf13/pflag"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -17,43 +17,24 @@ import (
 type cmdOptions struct {
 	key    string // key is the public key(s) for SSH authentication.
 	listen string // listen is the address or port to listen on.
+	// TODO: add hubURL and token
+	// hubURL string // hubURL is the URL of the hub to use.
+	// token  string // token is the token to use for authentication.
 }
 
 // parse parses the command line flags and populates the config struct.
 // It returns true if a subcommand was handled and the program should exit.
 func (opts *cmdOptions) parse() bool {
-	flag.StringVar(&opts.key, "key", "", "Public key(s) for SSH authentication")
-	flag.StringVar(&opts.listen, "listen", "", "Address or port to listen on")
-
-	flag.Usage = func() {
-		builder := strings.Builder{}
-		builder.WriteString("Usage: ")
-		builder.WriteString(os.Args[0])
-		builder.WriteString(" [command] [flags]\n")
-		builder.WriteString("\nCommands:\n")
-		builder.WriteString("  health    Check if the agent is running\n")
-		builder.WriteString("  help      Display this help message\n")
-		builder.WriteString("  update    Update to the latest version\n")
-		builder.WriteString("\nFlags:\n")
-		fmt.Print(builder.String())
-		flag.PrintDefaults()
-	}
-
 	subcommand := ""
 	if len(os.Args) > 1 {
 		subcommand = os.Args[1]
 	}
 
+	// Subcommands that don't require any pflag parsing
 	switch subcommand {
 	case "-v", "version":
 		fmt.Println(beszel.AppName+"-agent", beszel.Version)
 		return true
-	case "help":
-		flag.Usage()
-		return true
-	case "update":
-		agent.Update()
-		return true
 	case "health":
 		err := health.Check()
 		if err != nil {
@@ -63,7 +44,57 @@ func (opts *cmdOptions) parse() bool {
 		return true
 	}
 
-	flag.Parse()
+	// pflag.CommandLine.ParseErrorsWhitelist.UnknownFlags = true
+	pflag.StringVarP(&opts.key, "key", "k", "", "Public key(s) for SSH authentication")
+	pflag.StringVarP(&opts.listen, "listen", "l", "", "Address or port to listen on")
+	// pflag.StringVarP(&opts.hubURL, "hub-url", "u", "", "URL of the hub to use")
+	// pflag.StringVarP(&opts.token, "token", "t", "", "Token to use for authentication")
+	chinaMirrors := pflag.BoolP("china-mirrors", "c", false, "Use mirror for update (gh.beszel.dev) instead of GitHub")
+	help := pflag.BoolP("help", "h", false, "Show this help message")
+
+	// Convert old single-dash long flags to double-dash for backward compatibility
+	flagsToConvert := []string{"key", "listen"}
+	for i, arg := range os.Args {
+		for _, flag := range flagsToConvert {
+			singleDash := "-" + flag
+			doubleDash := "--" + flag
+			if arg == singleDash {
+				os.Args[i] = doubleDash
+				break
+			} else if strings.HasPrefix(arg, singleDash+"=") {
+				os.Args[i] = doubleDash + arg[len(singleDash):]
+				break
+			}
+		}
+	}
+
+	pflag.Usage = func() {
+		builder := strings.Builder{}
+		builder.WriteString("Usage: ")
+		builder.WriteString(os.Args[0])
+		builder.WriteString(" [command] [flags]\n")
+		builder.WriteString("\nCommands:\n")
+		builder.WriteString("  health    Check if the agent is running\n")
+		// builder.WriteString("  help      Display this help message\n")
+		builder.WriteString("  update    Update to the latest version\n")
+		builder.WriteString("\nFlags:\n")
+		fmt.Print(builder.String())
+		pflag.PrintDefaults()
+	}
+
+	// Parse all arguments with pflag
+	pflag.Parse()
+
+	// Must run after pflag.Parse()
+	switch {
+	case *help || subcommand == "help":
+		pflag.Usage()
+		return true
+	case subcommand == "update":
+		agent.Update(*chinaMirrors)
+		return true
+	}
+
 	return false
 }
 

internal/cmd/agent/agent_test.go

@@ -1,13 +1,14 @@
 package main
 
 import (
-	"beszel/internal/agent"
 	"crypto/ed25519"
-	"flag"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/henrygd/beszel/agent"
+
+	"github.com/spf13/pflag"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
@@ -245,7 +246,7 @@ func TestParseFlags(t *testing.T) {
 	oldArgs := os.Args
 	defer func() {
 		os.Args = oldArgs
-		flag.CommandLine = flag.NewFlagSet(os.Args[0], flag.ExitOnError)
+		pflag.CommandLine = pflag.NewFlagSet(os.Args[0], pflag.ExitOnError)
 	}()
 
 	tests := []struct {
@@ -269,6 +270,22 @@ func TestParseFlags(t *testing.T) {
 				listen: "",
 			},
 		},
+		{
+			name: "key flag double dash",
+			args: []string{"cmd", "--key", "testkey"},
+			expected: cmdOptions{
+				key:    "testkey",
+				listen: "",
+			},
+		},
+		{
+			name: "key flag short",
+			args: []string{"cmd", "-k", "testkey"},
+			expected: cmdOptions{
+				key:    "testkey",
+				listen: "",
+			},
+		},
 		{
 			name: "addr flag only",
 			args: []string{"cmd", "-listen", ":8080"},
@@ -277,6 +294,22 @@ func TestParseFlags(t *testing.T) {
 				listen: ":8080",
 			},
 		},
+		{
+			name: "addr flag double dash",
+			args: []string{"cmd", "--listen", ":8080"},
+			expected: cmdOptions{
+				key:    "",
+				listen: ":8080",
+			},
+		},
+		{
+			name: "addr flag short",
+			args: []string{"cmd", "-l", ":8080"},
+			expected: cmdOptions{
+				key:    "",
+				listen: ":8080",
+			},
+		},
 		{
 			name: "both flags",
 			args: []string{"cmd", "-key", "testkey", "-listen", ":8080"},
@@ -290,12 +323,12 @@ func TestParseFlags(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			// Reset flags for each test
-			flag.CommandLine = flag.NewFlagSet(tt.args[0], flag.ExitOnError)
+			pflag.CommandLine = pflag.NewFlagSet(tt.args[0], pflag.ExitOnError)
 			os.Args = tt.args
 
 			var opts cmdOptions
 			opts.parse()
-			flag.Parse()
+			pflag.Parse()
 
 			assert.Equal(t, tt.expected, opts)
 		})

internal/cmd/hub/hub.go

@@ -1,15 +1,16 @@
 package main
 
 import (
-	"beszel"
-	"beszel/internal/hub"
-	_ "beszel/migrations"
 	"fmt"
 	"log"
 	"net/http"
 	"os"
 	"time"
 
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/hub"
+	_ "github.com/henrygd/beszel/internal/migrations"
+
 	"github.com/pocketbase/pocketbase"
 	"github.com/pocketbase/pocketbase/plugins/migratecmd"
 	"github.com/spf13/cobra"
@@ -45,11 +46,13 @@ func getBaseApp() *pocketbase.PocketBase {
 	baseApp.RootCmd.Use = beszel.AppName
 	baseApp.RootCmd.Short = ""
 	// add update command
-	baseApp.RootCmd.AddCommand(&cobra.Command{
+	updateCmd := &cobra.Command{
 		Use:   "update",
 		Short: "Update " + beszel.AppName + " to the latest version",
 		Run:   hub.Update,
-	})
+	}
+	updateCmd.Flags().Bool("china-mirrors", false, "Use mirror (gh.beszel.dev) instead of GitHub")
+	baseApp.RootCmd.AddCommand(updateCmd)
 	// add health command
 	baseApp.RootCmd.AddCommand(newHealthCmd())
 

internal/dockerfile_agent

@@ -2,15 +2,15 @@ FROM --platform=$BUILDPLATFORM golang:alpine AS builder
 
 WORKDIR /app
 
-COPY go.mod go.sum ./
-# RUN go mod download
-COPY *.go ./
-COPY cmd ./cmd
-COPY internal ./internal
+COPY ../go.mod ../go.sum ./
+RUN go mod download
+
+# Copy source files
+COPY . ./
 
 # Build
 ARG TARGETOS TARGETARCH
-RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./cmd/agent
+RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./internal/cmd/agent
 
 RUN rm -rf /tmp/*
 

internal/dockerfile_agent_nvidia

@@ -2,20 +2,26 @@ FROM --platform=$BUILDPLATFORM golang:alpine AS builder
 
 WORKDIR /app
 
-COPY go.mod go.sum ./
-# RUN go mod download
-COPY *.go ./
-COPY cmd ./cmd
-COPY internal ./internal
+
+COPY ../go.mod ../go.sum ./
+RUN go mod download
+
+# Copy source files
+COPY . ./
 
 # Build
 ARG TARGETOS TARGETARCH
-RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./cmd/agent
+RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./internal/cmd/agent
+
+RUN rm -rf /tmp/*
 
 # --------------------------
 # Final image: GPU-enabled agent with nvidia-smi
 # --------------------------
-FROM nvidia/cuda:12.9.1-base-ubuntu22.04
+FROM nvidia/cuda:12.2.2-base-ubuntu22.04
 COPY --from=builder /agent /agent
 
+# this is so we don't need to create the /tmp directory in the scratch container
+COPY --from=builder /tmp /tmp
+
 ENTRYPOINT ["/agent"]

internal/dockerfile_hub

@@ -3,16 +3,11 @@ FROM --platform=$BUILDPLATFORM golang:alpine AS builder
 WORKDIR /app
 
 # Download Go modules
-COPY go.mod go.sum ./
+COPY ../go.mod ../go.sum ./
 RUN go mod download
 
 # Copy source files
-COPY *.go ./
-COPY cmd ./cmd
-COPY internal ./internal
-COPY migrations ./migrations
-COPY site/dist ./site/dist
-COPY site/*.go ./site
+COPY . ./
 
 RUN apk add --no-cache \
     unzip \
@@ -22,7 +17,7 @@ RUN update-ca-certificates
 
 # Build
 ARG TARGETOS TARGETARCH
-RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /beszel ./cmd/hub
+RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /beszel ./internal/cmd/hub
 
 # ? -------------------------
 FROM scratch

internal/entities/system/system.go

@@ -3,8 +3,9 @@ package system
 // TODO: this is confusing, make common package with common/types common/helpers etc
 
 import (
-	"beszel/internal/entities/container"
 	"time"
+
+	"github.com/henrygd/beszel/internal/entities/container"
 )
 
 type Stats struct {
@@ -37,8 +38,10 @@ type Stats struct {
 	Bandwidth      [2]uint64           `json:"b,omitzero" cbor:"26,keyasint,omitzero"`  // [sent bytes, recv bytes]
 	MaxBandwidth   [2]uint64           `json:"bm,omitzero" cbor:"27,keyasint,omitzero"` // [sent bytes, recv bytes]
 	// TODO: remove other load fields in future release in favor of load avg array
-	LoadAvg [3]float64 `json:"la,omitempty" cbor:"28,keyasint"`
-	Battery [2]uint8   `json:"bat,omitzero" cbor:"29,keyasint,omitzero"` // [percent, charge state, current]
+	LoadAvg           [3]float64           `json:"la,omitempty" cbor:"28,keyasint"`
+	Battery           [2]uint8             `json:"bat,omitzero" cbor:"29,keyasint,omitzero"` // [percent, charge state, current]
+	MaxMem            float64              `json:"mm,omitempty" cbor:"30,keyasint,omitempty"`
+	NetworkInterfaces map[string][4]uint64 `json:"ni,omitempty" cbor:"31,keyasint,omitempty"` // [upload bytes, download bytes, total upload, total download]
 }
 
 type GPUData struct {

internal/ghupdate/ghupdate.go

@@ -4,7 +4,6 @@
 package ghupdate
 
 import (
-	"beszel"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -16,6 +15,8 @@ import (
 	"runtime"
 	"strings"
 
+	"github.com/henrygd/beszel"
+
 	"github.com/blang/semver"
 )
 
@@ -23,7 +24,7 @@ import (
 const (
 	colorReset  = "\033[0m"
 	ColorYellow = "\033[33m"
-	colorGreen  = "\033[32m"
+	ColorGreen  = "\033[32m"
 	colorCyan   = "\033[36m"
 	colorGray   = "\033[90m"
 )
@@ -64,10 +65,19 @@ type Config struct {
 
 	// The data directory to use when fetching and downloading the latest release.
 	DataDir string
+
+	// UseMirror specifies whether to use the beszel.dev mirror instead of GitHub API.
+	// When false (default), always uses api.github.com. When true, uses gh.beszel.dev.
+	UseMirror bool
+}
+
+type updater struct {
+	config         Config
+	currentVersion string
 }
 
 func Update(config Config) (updated bool, err error) {
-	p := &plugin{
+	p := &updater{
 		currentVersion: beszel.Version,
 		config:         config,
 	}
@@ -75,12 +85,7 @@ func Update(config Config) (updated bool, err error) {
 	return p.update()
 }
 
-type plugin struct {
-	config         Config
-	currentVersion string
-}
-
-func (p *plugin) update() (updated bool, err error) {
+func (p *updater) update() (updated bool, err error) {
 	ColorPrint(ColorYellow, "Fetching release information...")
 
 	if p.config.DataDir == "" {
@@ -106,21 +111,19 @@ func (p *plugin) update() (updated bool, err error) {
 	var latest *release
 	var useMirror bool
 
+	// Determine the API endpoint based on UseMirror flag
+	apiURL := fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", p.config.Owner, p.config.Repo)
+	if p.config.UseMirror {
+		useMirror = true
+		apiURL = fmt.Sprintf("https://gh.beszel.dev/repos/%s/%s/releases/latest?api=true", p.config.Owner, p.config.Repo)
+		ColorPrint(ColorYellow, "Using mirror for update.")
+	}
+
 	latest, err = fetchLatestRelease(
 		p.config.Context,
 		p.config.HttpClient,
-		fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", p.config.Owner, p.config.Repo),
+		apiURL,
 	)
-	// if the first fetch fails, try the beszel.dev API (fallback for China)
-	if err != nil {
-		ColorPrint(ColorYellow, "Failed to fetch release. Trying beszel.dev mirror...")
-		useMirror = true
-		latest, err = fetchLatestRelease(
-			p.config.Context,
-			p.config.HttpClient,
-			fmt.Sprintf("https://gh.beszel.dev/repos/%s/%s/releases/latest?api=true", p.config.Owner, p.config.Repo),
-		)
-	}
 	if err != nil {
 		return false, err
 	}
@@ -129,7 +132,7 @@ func (p *plugin) update() (updated bool, err error) {
 	newVersion := semver.MustParse(strings.TrimPrefix(latest.Tag, "v"))
 
 	if newVersion.LTE(currentVersion) {
-		ColorPrintf(colorGreen, "You already have the latest version %s.", p.currentVersion)
+		ColorPrintf(ColorGreen, "You already have the latest version %s.", p.currentVersion)
 		return false, nil
 	}
 
@@ -209,14 +212,11 @@ func (p *plugin) update() (updated bool, err error) {
 	}
 
 	ColorPrint(colorGray, "---")
-	ColorPrint(colorGreen, "Update completed successfully! You can start the executable as usual.")
+	ColorPrint(ColorGreen, "Update completed successfully!")
 
 	// print the release notes
 	if latest.Body != "" {
 		fmt.Print("\n")
-		ColorPrintf(colorCyan, "Here is a list with some of the %s changes:", latest.Tag)
-		// remove the update command note to avoid "stuttering"
-		// (@todo consider moving to a config option)
 		releaseNotes := strings.TrimSpace(strings.Replace(latest.Body, "> _To update the prebuilt executable you can run `./"+p.config.ArchiveExecutable+" update`._", "", 1))
 		ColorPrint(colorCyan, releaseNotes)
 		fmt.Print("\n")

internal/hub/agent_connect.go

@@ -1,9 +1,6 @@
 package hub
 
 import (
-	"beszel/internal/common"
-	"beszel/internal/hub/expirymap"
-	"beszel/internal/hub/ws"
 	"errors"
 	"net"
 	"net/http"
@@ -11,6 +8,10 @@ import (
 	"sync"
 	"time"
 
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/hub/expirymap"
+	"github.com/henrygd/beszel/internal/hub/ws"
+
 	"github.com/blang/semver"
 	"github.com/lxzan/gws"
 	"github.com/pocketbase/dbx"

internal/hub/agent_connect_test.go

@@ -4,9 +4,6 @@
 package hub
 
 import (
-	"beszel/internal/agent"
-	"beszel/internal/common"
-	"beszel/internal/hub/ws"
 	"crypto/ed25519"
 	"fmt"
 	"net/http"
@@ -17,6 +14,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/henrygd/beszel/agent"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/hub/ws"
+
 	"github.com/pocketbase/pocketbase/core"
 	pbtests "github.com/pocketbase/pocketbase/tests"
 	"github.com/stretchr/testify/assert"

internal/hub/config/config.go

@@ -2,13 +2,14 @@
 package config
 
 import (
-	"beszel/internal/entities/system"
 	"fmt"
 	"log"
 	"os"
 	"path/filepath"
 
 	"github.com/google/uuid"
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/spf13/cast"

internal/hub/config/config_test.go

@@ -4,12 +4,14 @@
 package config_test
 
 import (
-	"beszel/internal/hub/config"
-	"beszel/internal/tests"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/henrygd/beszel/internal/tests"
+
+	"github.com/henrygd/beszel/internal/hub/config"
+
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

internal/hub/hub.go

@@ -2,25 +2,23 @@
 package hub
 
 import (
-	"beszel"
-	"beszel/internal/alerts"
-	"beszel/internal/hub/config"
-	"beszel/internal/hub/systems"
-	"beszel/internal/records"
-	"beszel/internal/users"
-	"beszel/site"
 	"crypto/ed25519"
 	"encoding/pem"
 	"fmt"
-	"io/fs"
 	"net/http"
-	"net/http/httputil"
 	"net/url"
 	"os"
 	"path"
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/alerts"
+	"github.com/henrygd/beszel/internal/hub/config"
+	"github.com/henrygd/beszel/internal/hub/systems"
+	"github.com/henrygd/beszel/internal/records"
+	"github.com/henrygd/beszel/internal/users"
+
 	"github.com/google/uuid"
 	"github.com/pocketbase/pocketbase"
 	"github.com/pocketbase/pocketbase/apis"
@@ -71,6 +69,8 @@ func (h *Hub) StartHub() error {
 		if err := config.SyncSystems(e); err != nil {
 			return err
 		}
+		// register middlewares
+		h.registerMiddlewares(e)
 		// register api routes
 		if err := h.registerApiRoutes(e); err != nil {
 			return err
@@ -164,55 +164,6 @@ func (h *Hub) initialize(e *core.ServeEvent) error {
 	return nil
 }
 
-// startServer sets up the server for Beszel
-func (h *Hub) startServer(se *core.ServeEvent) error {
-	// TODO: exclude dev server from production binary
-	switch h.IsDev() {
-	case true:
-		proxy := httputil.NewSingleHostReverseProxy(&url.URL{
-			Scheme: "http",
-			Host:   "localhost:5173",
-		})
-		se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
-			proxy.ServeHTTP(e.Response, e.Request)
-			return nil
-		})
-	default:
-		// parse app url
-		parsedURL, err := url.Parse(h.appURL)
-		if err != nil {
-			return err
-		}
-		// fix base paths in html if using subpath
-		basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
-		indexFile, _ := fs.ReadFile(site.DistDirFS, "index.html")
-		indexContent := strings.ReplaceAll(string(indexFile), "./", basePath)
-		indexContent = strings.Replace(indexContent, "{{V}}", beszel.Version, 1)
-		indexContent = strings.Replace(indexContent, "{{HUB_URL}}", h.appURL, 1)
-		// set up static asset serving
-		staticPaths := [2]string{"/static/", "/assets/"}
-		serveStatic := apis.Static(site.DistDirFS, false)
-		// get CSP configuration
-		csp, cspExists := GetEnv("CSP")
-		// add route
-		se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
-			// serve static assets if path is in staticPaths
-			for i := range staticPaths {
-				if strings.Contains(e.Request.URL.Path, staticPaths[i]) {
-					e.Response.Header().Set("Cache-Control", "public, max-age=2592000")
-					return serveStatic(e)
-				}
-			}
-			if cspExists {
-				e.Response.Header().Del("X-Frame-Options")
-				e.Response.Header().Set("Content-Security-Policy", csp)
-			}
-			return e.HTML(http.StatusOK, indexContent)
-		})
-	}
-	return nil
-}
-
 // registerCronJobs sets up scheduled tasks
 func (h *Hub) registerCronJobs(_ *core.ServeEvent) error {
 	// delete old system_stats and alerts_history records once every hour
@@ -222,6 +173,37 @@ func (h *Hub) registerCronJobs(_ *core.ServeEvent) error {
 	return nil
 }
 
+// custom middlewares
+func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
+	// authorizes request with user matching the provided email
+	authorizeRequestWithEmail := func(e *core.RequestEvent, email string) (err error) {
+		if e.Auth != nil || email == "" {
+			return e.Next()
+		}
+		isAuthRefresh := e.Request.URL.Path == "/api/collections/users/auth-refresh" && e.Request.Method == http.MethodPost
+		e.Auth, err = e.App.FindFirstRecordByData("users", "email", email)
+		if err != nil || !isAuthRefresh {
+			return e.Next()
+		}
+		// auth refresh endpoint, make sure token is set in header
+		token, _ := e.Auth.NewAuthToken()
+		e.Request.Header.Set("Authorization", token)
+		return e.Next()
+	}
+	// authenticate with trusted header
+	if autoLogin, _ := GetEnv("AUTO_LOGIN"); autoLogin != "" {
+		se.Router.BindFunc(func(e *core.RequestEvent) error {
+			return authorizeRequestWithEmail(e, autoLogin)
+		})
+	}
+	// authenticate with trusted header
+	if trustedHeader, _ := GetEnv("TRUSTED_AUTH_HEADER"); trustedHeader != "" {
+		se.Router.BindFunc(func(e *core.RequestEvent) error {
+			return authorizeRequestWithEmail(e, e.Request.Header.Get(trustedHeader))
+		})
+	}
+}
+
 // custom api routes
 func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
 	// auth protected routes

internal/hub/hub_test.go

@@ -4,9 +4,6 @@
 package hub_test
 
 import (
-	beszelTests "beszel/internal/tests"
-	"testing"
-
 	"bytes"
 	"crypto/ed25519"
 	"encoding/json"
@@ -16,6 +13,10 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/migrations"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
 
 	"github.com/pocketbase/pocketbase/core"
 	pbTests "github.com/pocketbase/pocketbase/tests"
@@ -534,6 +535,115 @@ func TestApiRoutesAuthentication(t *testing.T) {
 	}
 }
 
+func TestFirstUserCreation(t *testing.T) {
+	t.Run("CreateUserEndpoint available when no users exist", func(t *testing.T) {
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		defer hub.Cleanup()
+
+		hub.StartHub()
+
+		testAppFactoryExisting := func(t testing.TB) *pbTests.TestApp {
+			return hub.TestApp
+		}
+
+		scenarios := []beszelTests.ApiScenario{
+			{
+				Name:   "POST /create-user - should be available when no users exist",
+				Method: http.MethodPost,
+				URL:    "/api/beszel/create-user",
+				Body: jsonReader(map[string]any{
+					"email":    "firstuser@example.com",
+					"password": "password123",
+				}),
+				ExpectedStatus:  200,
+				ExpectedContent: []string{"User created"},
+				TestAppFactory:  testAppFactoryExisting,
+				BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+					userCount, err := hub.CountRecords("users")
+					require.NoError(t, err)
+					require.Zero(t, userCount, "Should start with no users")
+					superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+					require.NoError(t, err)
+					require.EqualValues(t, 1, len(superusers), "Should start with one temporary superuser")
+					require.EqualValues(t, migrations.TempAdminEmail, superusers[0].GetString("email"), "Should have created one temporary superuser")
+				},
+				AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+					userCount, err := hub.CountRecords("users")
+					require.NoError(t, err)
+					require.EqualValues(t, 1, userCount, "Should have created one user")
+					superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+					require.NoError(t, err)
+					require.EqualValues(t, 1, len(superusers), "Should have created one superuser")
+					require.EqualValues(t, "firstuser@example.com", superusers[0].GetString("email"), "Should have created one superuser")
+				},
+			},
+			{
+				Name:   "POST /create-user - should not be available when users exist",
+				Method: http.MethodPost,
+				URL:    "/api/beszel/create-user",
+				Body: jsonReader(map[string]any{
+					"email":    "firstuser@example.com",
+					"password": "password123",
+				}),
+				ExpectedStatus:  404,
+				ExpectedContent: []string{"wasn't found"},
+				TestAppFactory:  testAppFactoryExisting,
+			},
+		}
+
+		for _, scenario := range scenarios {
+			scenario.Test(t)
+		}
+	})
+
+	t.Run("CreateUserEndpoint not available when USER_EMAIL, USER_PASSWORD are set", func(t *testing.T) {
+		os.Setenv("BESZEL_HUB_USER_EMAIL", "me@example.com")
+		os.Setenv("BESZEL_HUB_USER_PASSWORD", "password123")
+		defer os.Unsetenv("BESZEL_HUB_USER_EMAIL")
+		defer os.Unsetenv("BESZEL_HUB_USER_PASSWORD")
+
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		defer hub.Cleanup()
+
+		hub.StartHub()
+
+		testAppFactory := func(t testing.TB) *pbTests.TestApp {
+			return hub.TestApp
+		}
+
+		scenario := beszelTests.ApiScenario{
+			Name:            "POST /create-user - should not be available when USER_EMAIL, USER_PASSWORD are set",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/create-user",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"wasn't found"},
+			TestAppFactory:  testAppFactory,
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				users, err := hub.FindAllRecords("users")
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(users), "Should start with one user")
+				require.EqualValues(t, "me@example.com", users[0].GetString("email"), "Should have created one user")
+				superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(superusers), "Should start with one superuser")
+				require.EqualValues(t, "me@example.com", superusers[0].GetString("email"), "Should have created one superuser")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				users, err := hub.FindAllRecords("users")
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(users), "Should still have one user")
+				require.EqualValues(t, "me@example.com", users[0].GetString("email"), "Should have created one user")
+				superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(superusers), "Should still have one superuser")
+				require.EqualValues(t, "me@example.com", superusers[0].GetString("email"), "Should have created one superuser")
+			},
+		}
+
+		scenario.Test(t)
+	})
+}
+
 func TestCreateUserEndpointAvailability(t *testing.T) {
 	t.Run("CreateUserEndpoint available when no users exist", func(t *testing.T) {
 		hub, _ := beszelTests.NewTestHub(t.TempDir())
@@ -601,3 +711,117 @@ func TestCreateUserEndpointAvailability(t *testing.T) {
 		scenario.Test(t)
 	})
 }
+
+func TestAutoLoginMiddleware(t *testing.T) {
+	var hubs []*beszelTests.TestHub
+
+	defer func() {
+		defer os.Unsetenv("AUTO_LOGIN")
+		for _, hub := range hubs {
+			hub.Cleanup()
+		}
+	}()
+
+	os.Setenv("AUTO_LOGIN", "user@test.com")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		hubs = append(hubs, hub)
+		hub.StartHub()
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		{
+			Name:            "GET /getkey - without auto login should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /getkey - with auto login should fail if no matching user",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /getkey - with auto login should succeed",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"key\":", "\"v\":"},
+			TestAppFactory:  testAppFactory,
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.CreateUser(app, "user@test.com", "password123")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestTrustedHeaderMiddleware(t *testing.T) {
+	var hubs []*beszelTests.TestHub
+
+	defer func() {
+		defer os.Unsetenv("TRUSTED_AUTH_HEADER")
+		for _, hub := range hubs {
+			hub.Cleanup()
+		}
+	}()
+
+	os.Setenv("TRUSTED_AUTH_HEADER", "X-Beszel-Trusted")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		hubs = append(hubs, hub)
+		hub.StartHub()
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		{
+			Name:            "GET /getkey - without trusted header should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /getkey - with trusted header should fail if no matching user",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/getkey",
+			Headers: map[string]string{
+				"X-Beszel-Trusted": "user@test.com",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /getkey - with trusted header should succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/getkey",
+			Headers: map[string]string{
+				"X-Beszel-Trusted": "user@test.com",
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"key\":", "\"v\":"},
+			TestAppFactory:  testAppFactory,
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.CreateUser(app, "user@test.com", "password123")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

internal/hub/hub_test_helpers.go

@@ -3,7 +3,7 @@
 
 package hub
 
-import "beszel/internal/hub/systems"
+import "github.com/henrygd/beszel/internal/hub/systems"
 
 // TESTING ONLY: GetSystemManager returns the system manager
 func (h *Hub) GetSystemManager() *systems.SystemManager {

internal/hub/server_development.go

@@ -0,0 +1,82 @@
+//go:build development
+
+package hub
+
+import (
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+
+	"github.com/henrygd/beszel"
+
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/osutils"
+)
+
+// Wraps http.RoundTripper to modify dev proxy HTML responses
+type responseModifier struct {
+	transport http.RoundTripper
+	hub       *Hub
+}
+
+func (rm *responseModifier) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := rm.transport.RoundTrip(req)
+	if err != nil {
+		return resp, err
+	}
+	// Only modify HTML responses
+	contentType := resp.Header.Get("Content-Type")
+	if !strings.Contains(contentType, "text/html") {
+		return resp, nil
+	}
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return resp, err
+	}
+	resp.Body.Close()
+	// Create a new response with the modified body
+	modifiedBody := rm.modifyHTML(string(body))
+	resp.Body = io.NopCloser(strings.NewReader(modifiedBody))
+	resp.ContentLength = int64(len(modifiedBody))
+	resp.Header.Set("Content-Length", fmt.Sprintf("%d", len(modifiedBody)))
+
+	return resp, nil
+}
+
+func (rm *responseModifier) modifyHTML(html string) string {
+	parsedURL, err := url.Parse(rm.hub.appURL)
+	if err != nil {
+		return html
+	}
+	// fix base paths in html if using subpath
+	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
+	html = strings.ReplaceAll(html, "./", basePath)
+	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
+	html = strings.Replace(html, "{{HUB_URL}}", rm.hub.appURL, 1)
+	return html
+}
+
+// startServer sets up the development server for Beszel
+func (h *Hub) startServer(se *core.ServeEvent) error {
+	slog.Info("starting server", "appURL", h.appURL)
+	proxy := httputil.NewSingleHostReverseProxy(&url.URL{
+		Scheme: "http",
+		Host:   "localhost:5173",
+	})
+
+	proxy.Transport = &responseModifier{
+		transport: http.DefaultTransport,
+		hub:       h,
+	}
+
+	se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
+		proxy.ServeHTTP(e.Response, e.Request)
+		return nil
+	})
+	_ = osutils.LaunchURL(h.appURL)
+	return nil
+}

internal/hub/server_production.go

@@ -0,0 +1,52 @@
+//go:build !development
+
+package hub
+
+import (
+	"io/fs"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/site"
+
+	"github.com/pocketbase/pocketbase/apis"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// startServer sets up the production server for Beszel
+func (h *Hub) startServer(se *core.ServeEvent) error {
+	// parse app url
+	parsedURL, err := url.Parse(h.appURL)
+	if err != nil {
+		return err
+	}
+	// fix base paths in html if using subpath
+	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
+	indexFile, _ := fs.ReadFile(site.DistDirFS, "index.html")
+	html := strings.ReplaceAll(string(indexFile), "./", basePath)
+	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
+	html = strings.Replace(html, "{{HUB_URL}}", h.appURL, 1)
+	// set up static asset serving
+	staticPaths := [2]string{"/static/", "/assets/"}
+	serveStatic := apis.Static(site.DistDirFS, false)
+	// get CSP configuration
+	csp, cspExists := GetEnv("CSP")
+	// add route
+	se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
+		// serve static assets if path is in staticPaths
+		for i := range staticPaths {
+			if strings.Contains(e.Request.URL.Path, staticPaths[i]) {
+				e.Response.Header().Set("Cache-Control", "public, max-age=2592000")
+				return serveStatic(e)
+			}
+		}
+		if cspExists {
+			e.Response.Header().Del("X-Frame-Options")
+			e.Response.Header().Set("Content-Security-Policy", csp)
+		}
+		return e.HTML(http.StatusOK, html)
+	})
+	return nil
+}

internal/hub/systems/system.go

@@ -1,9 +1,6 @@
 package systems
 
 import (
-	"beszel"
-	"beszel/internal/entities/system"
-	"beszel/internal/hub/ws"
 	"context"
 	"encoding/json"
 	"errors"
@@ -13,6 +10,12 @@ import (
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel/internal/hub/ws"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/henrygd/beszel"
+
 	"github.com/blang/semver"
 	"github.com/fxamacker/cbor/v2"
 	"github.com/pocketbase/pocketbase/core"

internal/hub/systems/system_manager.go

@@ -1,14 +1,18 @@
 package systems
 
 import (
-	"beszel"
-	"beszel/internal/common"
-	"beszel/internal/entities/system"
-	"beszel/internal/hub/ws"
 	"errors"
 	"fmt"
 	"time"
 
+	"github.com/henrygd/beszel/internal/hub/ws"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/henrygd/beszel/internal/common"
+
+	"github.com/henrygd/beszel"
+
 	"github.com/blang/semver"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/store"
@@ -30,10 +34,8 @@ const (
 	sessionTimeout = 4 * time.Second
 )
 
-var (
-	// errSystemExists is returned when attempting to add a system that already exists
-	errSystemExists = errors.New("system exists")
-)
+// errSystemExists is returned when attempting to add a system that already exists
+var errSystemExists = errors.New("system exists")
 
 // SystemManager manages a collection of monitored systems and their connections.
 // It handles system lifecycle, status updates, and maintains both SSH and WebSocket connections.

internal/hub/systems/systems_test.go

@@ -4,16 +4,17 @@
 package systems_test
 
 import (
-	"beszel/internal/entities/container"
-	"beszel/internal/entities/system"
-	"beszel/internal/hub/systems"
-	"beszel/internal/tests"
 	"fmt"
 	"sync"
 	"testing"
 	"testing/synctest"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/hub/systems"
+	"github.com/henrygd/beszel/internal/tests"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

internal/hub/systems/systems_test_helpers.go

@@ -4,9 +4,10 @@
 package systems
 
 import (
-	entities "beszel/internal/entities/system"
 	"context"
 	"fmt"
+
+	entities "github.com/henrygd/beszel/internal/entities/system"
 )
 
 // TESTING ONLY: GetSystemCount returns the number of systems in the store
@@ -100,3 +101,10 @@ func (sm *SystemManager) SetSystemStatusInDB(systemID string, status string) boo
 
 	return true
 }
+
+// TESTING ONLY: RemoveAllSystems removes all systems from the store
+func (sm *SystemManager) RemoveAllSystems() {
+	for _, system := range sm.systems.GetAll() {
+		sm.RemoveSystem(system.Id)
+	}
+}

internal/hub/update.go

@@ -1,17 +1,17 @@
 package hub
 
 import (
-	"beszel/internal/ghupdate"
 	"fmt"
 	"log"
 	"os"
 	"os/exec"
 
+	"github.com/henrygd/beszel/internal/ghupdate"
 	"github.com/spf13/cobra"
 )
 
 // Update updates beszel to the latest version
-func Update(_ *cobra.Command, _ []string) {
+func Update(cmd *cobra.Command, _ []string) {
 	dataDir := os.TempDir()
 
 	// set dataDir to ./beszel_data if it exists
@@ -19,9 +19,13 @@ func Update(_ *cobra.Command, _ []string) {
 		dataDir = "./beszel_data"
 	}
 
+	// Check if china-mirrors flag is set
+	useMirror, _ := cmd.Flags().GetBool("china-mirrors")
+
 	updated, err := ghupdate.Update(ghupdate.Config{
 		ArchiveExecutable: "beszel",
 		DataDir:           dataDir,
+		UseMirror:         useMirror,
 	})
 	if err != nil {
 		log.Fatal(err)
@@ -30,6 +34,14 @@ func Update(_ *cobra.Command, _ []string) {
 		return
 	}
 
+	// make sure the file is executable
+	exePath, err := os.Executable()
+	if err == nil {
+		if err := os.Chmod(exePath, 0755); err != nil {
+			fmt.Printf("Warning: failed to set executable permissions: %v\n", err)
+		}
+	}
+
 	// Try to restart the service if it's running
 	restartService()
 }
@@ -41,13 +53,13 @@ func restartService() {
 		// Check if beszel service exists and is active
 		cmd := exec.Command("systemctl", "is-active", "beszel.service")
 		if err := cmd.Run(); err == nil {
-			fmt.Println("Restarting beszel service...")
+			ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel service...")
 			restartCmd := exec.Command("systemctl", "restart", "beszel.service")
 			if err := restartCmd.Run(); err != nil {
-				fmt.Printf("Warning: Failed to restart service: %v\n", err)
-				fmt.Println("Please restart the service manually: sudo systemctl restart beszel")
+				ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: Failed to restart service: %v\n", err)
+				ghupdate.ColorPrint(ghupdate.ColorYellow, "Please restart the service manually: sudo systemctl restart beszel")
 			} else {
-				fmt.Println("Service restarted successfully")
+				ghupdate.ColorPrint(ghupdate.ColorGreen, "Service restarted successfully")
 			}
 			return
 		}
@@ -57,17 +69,17 @@ func restartService() {
 	if _, err := exec.LookPath("rc-service"); err == nil {
 		cmd := exec.Command("rc-service", "beszel", "status")
 		if err := cmd.Run(); err == nil {
-			fmt.Println("Restarting beszel service...")
+			ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel service...")
 			restartCmd := exec.Command("rc-service", "beszel", "restart")
 			if err := restartCmd.Run(); err != nil {
-				fmt.Printf("Warning: Failed to restart service: %v\n", err)
-				fmt.Println("Please restart the service manually: sudo rc-service beszel restart")
+				ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: Failed to restart service: %v\n", err)
+				ghupdate.ColorPrint(ghupdate.ColorYellow, "Please restart the service manually: sudo rc-service beszel restart")
 			} else {
-				fmt.Println("Service restarted successfully")
+				ghupdate.ColorPrint(ghupdate.ColorGreen, "Service restarted successfully")
 			}
 			return
 		}
 	}
 
-	fmt.Println("Note: Service restart not attempted. If running as a service, restart manually.")
+	ghupdate.ColorPrint(ghupdate.ColorYellow, "Service restart not attempted. If running as a service, restart manually.")
 }

internal/hub/ws/ws.go

@@ -1,12 +1,14 @@
 package ws
 
 import (
-	"beszel/internal/common"
-	"beszel/internal/entities/system"
 	"errors"
 	"time"
 	"weak"
 
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/henrygd/beszel/internal/common"
+
 	"github.com/fxamacker/cbor/v2"
 	"github.com/lxzan/gws"
 	"golang.org/x/crypto/ssh"

internal/hub/ws/ws_test.go

@@ -4,11 +4,12 @@
 package ws
 
 import (
-	"beszel/internal/common"
 	"crypto/ed25519"
 	"testing"
 	"time"
 
+	"github.com/henrygd/beszel/internal/common"
+
 	"github.com/fxamacker/cbor/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

internal/migrations/initial-settings.go

@@ -0,0 +1,71 @@
+package migrations
+
+import (
+	"os"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+const (
+	TempAdminEmail = "_@b.b"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		// initial settings
+		settings := app.Settings()
+		settings.Meta.AppName = "Beszel"
+		settings.Meta.HideControls = true
+		settings.Logs.MinLevel = 4
+		if err := app.Save(settings); err != nil {
+			return err
+		}
+
+		// create superuser
+		superuserCollection, _ := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+		superUser := core.NewRecord(superuserCollection)
+
+		// set email
+		email, _ := GetEnv("USER_EMAIL")
+		password, _ := GetEnv("USER_PASSWORD")
+		didProvideUserDetails := email != "" && password != ""
+
+		// set superuser email
+		if email == "" {
+			email = TempAdminEmail
+		}
+		superUser.SetEmail(email)
+
+		// set superuser password
+		if password != "" {
+			superUser.SetPassword(password)
+		} else {
+			superUser.SetRandomPassword()
+		}
+
+		// if user details are provided, we create a regular user as well
+		if didProvideUserDetails {
+			usersCollection, _ := app.FindCollectionByNameOrId("users")
+			user := core.NewRecord(usersCollection)
+			user.SetEmail(email)
+			user.SetPassword(password)
+			user.SetVerified(true)
+			err := app.Save(user)
+			if err != nil {
+				return err
+			}
+		}
+
+		return app.Save(superUser)
+	}, nil)
+}
+
+// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
+func GetEnv(key string) (value string, exists bool) {
+	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
+		return value, exists
+	}
+	// Fallback to the old unprefixed key
+	return os.LookupEnv(key)
+}

internal/records/records.go

@@ -2,8 +2,6 @@
 package records
 
 import (
-	"beszel/internal/entities/container"
-	"beszel/internal/entities/system"
 	"encoding/json"
 	"fmt"
 	"log"
@@ -11,6 +9,9 @@ import (
 	"strings"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
@@ -39,12 +40,14 @@ type StatsRecord struct {
 }
 
 // global variables for reusing allocations
-var statsRecord StatsRecord
-var containerStats []container.Stats
-var sumStats system.Stats
-var tempStats system.Stats
-var queryParams = make(dbx.Params, 1)
-var containerSums = make(map[string]*container.Stats)
+var (
+	statsRecord    StatsRecord
+	containerStats []container.Stats
+	sumStats       system.Stats
+	tempStats      system.Stats
+	queryParams    = make(dbx.Params, 1)
+	containerSums  = make(map[string]*container.Stats)
+)
 
 // Create longer records by averaging shorter records
 func (rm *RecordManager) CreateLongerRecords() {
@@ -214,6 +217,7 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		sum.Battery[1] = stats.Battery[1]
 		// Set peak values
 		sum.MaxCpu = max(sum.MaxCpu, stats.MaxCpu, stats.Cpu)
+		sum.MaxMem = max(sum.MaxMem, stats.MaxMem, stats.MemUsed)
 		sum.MaxNetworkSent = max(sum.MaxNetworkSent, stats.MaxNetworkSent, stats.NetworkSent)
 		sum.MaxNetworkRecv = max(sum.MaxNetworkRecv, stats.MaxNetworkRecv, stats.NetworkRecv)
 		sum.MaxDiskReadPs = max(sum.MaxDiskReadPs, stats.MaxDiskReadPs, stats.DiskReadPs)
@@ -221,6 +225,19 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		sum.MaxBandwidth[0] = max(sum.MaxBandwidth[0], stats.MaxBandwidth[0], stats.Bandwidth[0])
 		sum.MaxBandwidth[1] = max(sum.MaxBandwidth[1], stats.MaxBandwidth[1], stats.Bandwidth[1])
 
+		// Accumulate network interfaces
+		if sum.NetworkInterfaces == nil {
+			sum.NetworkInterfaces = make(map[string][4]uint64, len(stats.NetworkInterfaces))
+		}
+		for key, value := range stats.NetworkInterfaces {
+			sum.NetworkInterfaces[key] = [4]uint64{
+				sum.NetworkInterfaces[key][0] + value[0],
+				sum.NetworkInterfaces[key][1] + value[1],
+				max(sum.NetworkInterfaces[key][2], value[2]),
+				max(sum.NetworkInterfaces[key][3], value[3]),
+			}
+		}
+
 		// Accumulate temperatures
 		if stats.Temperatures != nil {
 			if sum.Temperatures == nil {
@@ -295,6 +312,19 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		sum.Bandwidth[0] = sum.Bandwidth[0] / uint64(count)
 		sum.Bandwidth[1] = sum.Bandwidth[1] / uint64(count)
 		sum.Battery[0] = uint8(batterySum / int(count))
+
+		// Average network interfaces
+		if sum.NetworkInterfaces != nil {
+			for key := range sum.NetworkInterfaces {
+				sum.NetworkInterfaces[key] = [4]uint64{
+					sum.NetworkInterfaces[key][0] / uint64(count),
+					sum.NetworkInterfaces[key][1] / uint64(count),
+					sum.NetworkInterfaces[key][2],
+					sum.NetworkInterfaces[key][3],
+				}
+			}
+		}
+
 		// Average temperatures
 		if sum.Temperatures != nil && tempCount > 0 {
 			for key := range sum.Temperatures {

internal/records/records_test.go

@@ -4,12 +4,13 @@
 package records_test
 
 import (
-	"beszel/internal/records"
-	"beszel/internal/tests"
 	"fmt"
 	"testing"
 	"time"
 
+	"github.com/henrygd/beszel/internal/records"
+	"github.com/henrygd/beszel/internal/tests"
+
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/types"
@@ -174,7 +175,7 @@ func TestDeleteOldSystemStats(t *testing.T) {
 	}
 
 	// Run deletion
-	err = records.TestDeleteOldSystemStats(hub)
+	err = records.DeleteOldSystemStats(hub)
 	require.NoError(t, err)
 
 	// Verify results
@@ -267,7 +268,7 @@ func TestDeleteOldAlertsHistory(t *testing.T) {
 			assert.Equal(t, int64(tc.alertCount), countBefore, "Initial count should match")
 
 			// Run deletion
-			err = records.TestDeleteOldAlertsHistory(hub, tc.countToKeep, tc.countBeforeDeletion)
+			err = records.DeleteOldAlertsHistory(hub, tc.countToKeep, tc.countBeforeDeletion)
 			require.NoError(t, err)
 
 			// Count after deletion
@@ -331,7 +332,7 @@ func TestDeleteOldAlertsHistoryEdgeCases(t *testing.T) {
 		}
 
 		// Should not error and should not delete anything
-		err = records.TestDeleteOldAlertsHistory(hub, 10, 20)
+		err = records.DeleteOldAlertsHistory(hub, 10, 20)
 		require.NoError(t, err)
 
 		count, err := hub.CountRecords("alerts_history")
@@ -345,7 +346,7 @@ func TestDeleteOldAlertsHistoryEdgeCases(t *testing.T) {
 		require.NoError(t, err)
 
 		// Should not error with empty table
-		err = records.TestDeleteOldAlertsHistory(hub, 10, 20)
+		err = records.DeleteOldAlertsHistory(hub, 10, 20)
 		require.NoError(t, err)
 	})
 }
@@ -375,7 +376,7 @@ func TestTwoDecimals(t *testing.T) {
 	}
 
 	for _, tc := range testCases {
-		result := records.TestTwoDecimals(tc.input)
+		result := records.TwoDecimals(tc.input)
 		assert.InDelta(t, tc.expected, result, 0.02, "twoDecimals(%f) should equal %f", tc.input, tc.expected)
 	}
 }

internal/records/records_test_helpers.go

@@ -0,0 +1,23 @@
+//go:build testing
+// +build testing
+
+package records
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// DeleteOldSystemStats exposes deleteOldSystemStats for testing
+func DeleteOldSystemStats(app core.App) error {
+	return deleteOldSystemStats(app)
+}
+
+// DeleteOldAlertsHistory exposes deleteOldAlertsHistory for testing
+func DeleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
+	return deleteOldAlertsHistory(app, countToKeep, countBeforeDeletion)
+}
+
+// TwoDecimals exposes twoDecimals for testing
+func TwoDecimals(value float64) float64 {
+	return twoDecimals(value)
+}