version 5.1.1

Thought for 1s

.gitea/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
           TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
           TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
         run: |
-          twine upload --repository-url https://git.wrede.ca/api/packages/andreas/pypi dist/*
+          python -m twine upload --repository-url https://git.wrede.ca/api/packages/andreas/pypi dist/*
 
       - name: Create release
         uses: actions/gitea-release-action@v1

.gitignore

@@ -11,3 +11,4 @@ dist/
 *.egg-info/
 ssl/
 uv.lock
+.hb.yaml

.hb.yaml

@@ -1,255 +0,0 @@
-#name: "w02"
-hb_port: 50003   
-hbd_host: ''
-#logfile: "/home/andreas/public_html/messages/andreas"
-logfile: "/home/andreas/logs/heartbeat/heartbeat.log"
-#logfile: "/Users/andreas/public_html/messages/andreas"
-logfmt: "msg"
-grace: 40
-interval: 10
-autosave_interval: 300  # Autosave interval in seconds (default: 5 minutes)
-
-# Notification Channels - Define notification providers centrally
-# Each channel has a type (pushover, email, signal, mattermost) and type-specific configuration
-notification_channels:
-
-  pushover_standard:
-    type: pushover
-    token: ac7NLX2rPjXFareeDgLpXNoDf4iFmf
-    user: uDhH33UjQQDYtNzJb1ThRiWb9ingGK
-
-  signal_andreas:
-    type: signal
-    cli_path: /usr/local/bin/signal-cli
-    user: +14168226179
-    recipient: +14168226179
-  
-  email_andreas:
-    type: email
-    recipients: [aew.hbd.notify@wrede.ca]
-    sender: aew.hbd@wrede.ca
-    smtp_server: smtp.fastmail.com
-    smtp_port: 587
-    smtp_user: andreas@wrede.ca
-    smtp_password: pvtvefyp5gbhnch2
-  
-  # Example additional channels (commented out)
-  # pushover_urgent:
-  #   type: pushover
-  #   token: your-app-token
-  #   user: your-user-key
-  #
-  mattermost_devops:
-    type: mattermost
-    host: mattermost.example.com
-    token: webhook-token
-    channel: devops-alerts
-    username: heartbeat-bot
-    icon: https://example.com/heartbeat-icon.png
-
-# Default notification channels (used if host doesn't specify channels)
-default_notification_channels: [pushover_standard]
-
-# Host definitions - combines threshold mapping, watch status, DNS updates, and notifications
-hosts:
-  wentworth:
-    threshold_config: default
-    watch: true
-    notification_channels: [pushover_standard]
-    dyndns: false
-  
-  y:
-    threshold_config: default
-    watch: true
-    notification_channels: [pushover_standard]
-    dyndns: false
-  
-  winter:
-    threshold_config: default
-    watch: true
-    notification_channels: [pushover_standard]
-    dyndns: false
-  
-  wally:
-    threshold_config: freebsd_server
-    watch: false
-    notification_channels: [pushover_standard]
-    dyndns: false
-  
-  eris:
-    threshold_config: truenas_server
-    watch: false
-    notification_channels: [pushover_standard]
-    dyndns: false
-  
-  haschloss:
-    threshold_config: default
-    watch: false
-    dyndns: true
-  
-  wayback:
-    threshold_config: default
-    watch: false
-    notification_channels: [pushover_standard]
-    dyndns: true
-  
-  wertvoll:
-    threshold_config: default
-    watch: false
-    notification_channels: [pushover_standard]
-    dyndns: true
-  
-  weekend:
-    threshold_config: freebsd_server
-    watch: false
-    notification_channels: [pushover_standard]
-    dyndns: true
-  
-  cotgate:
-    threshold_config: default
-    watch: false
-    dyndns: true
-  
-  rvgate:
-    threshold_config: default
-    watch: false
-    dyndns: true
-  
-  draper:
-    threshold_config: default
-    watch: false
-    notification_channels: [pushover_standard]
-    dyndns: true
-
-# Hosts to drop/ignore
-drophosts: {"unknown", "wookie15", "wort"}
-
-nsupdate_bin: "/usr/local/bin/nsupdate"
-
-dyndomains: {"wrede.org"}
-
-ws_port: 50005
-# wss_port: 50006  # Commented out - use plain WebSocket instead of secure WSS
-# cert_path: "/usr/local/etc/letsencrypt/live/hbd.wrede.ca/"
-# cert_path: "test/"
-# CERT_PATH = "./test/"
-# wss_pem: "fullchain.pem"
-# wss_key: "privkey.pem"
-
-journal_enabled: true                    # Enable/disable journaling
-journal_dir: /home/andreas/logs/heartbeat         # Journal directory
-journal_file: messages.journal           # Base filename
-journal_max_size: 104857600             # Max size (100MB default)
-journal_max_backups: 10                 # Number of backups to keep
-
-threshold_configs:
-  default:
-    thresholds:
-      cpu_monitor:
-        cpu_percent:
-          warning: 80.0
-          critical: 90.0
-      memory_monitor:
-        percent:
-          warning: 85.0
-          critical: 95.0
-      disk_monitor:
-        partitions:
-          /:
-            percent:
-              warning: 85.0
-              critical: 90.0
-      rtt:
-        warning: 200
-        critical: 250.0
-
-
-  freebsd_server:
-    thresholds:
-      cpu_monitor:
-        cpu_percent:
-          warning: 80.0
-          critical: 90.0
-      memory_monitor:
-        memory_percent:
-          warning: 97.0
-          critical: 100.0
-      disk_monitor:
-        partitions:
-          /:
-            percent:
-              warning: 85.0
-              critical: 90.0
-      nagios_runner:
-   #     overall_status_code:
-   #       warning: 1
-   #       critical: 2
-   #       operator: ">="
-        load_status:
-          warning: WARNING
-          critical: CRITICAL
-          operator: "=="
-        ups_load:
-          display: "load to high: {ups_output}"
-          warning: 70
-          critical: 80
-          operator: ">="
-        ups_status_code:
-          display: "{ups_output}"
-          warning: 1
-          critical: 2
-          operator: ">="
-        nextcloud_apps_status_code:
-          display: "{nextcloud_apps_output}"
-          warning: 1
-          critical: 2
-          operator: ">="
-      rtt:
-        warning: 200
-        critical: 250.0
-
-  truenas_server:
-    thresholds:
-      cpu_monitor:
-        cpu_percent:
-          warning: 80.0
-          critical: 90.0
-      memory_monitor:
-        percent:
-          warning: 3.0
-          critical: 95.0
-      disk_monitor:
-        partitions:
-          /:
-            percent:
-              warning: 85.0
-              critical: 90.0
-      nagios_runner:
-   #     overall_status_code:
-   #       warning: 1
-   #       critical: 2
-   #       operator: ">="
-        load_status:
-          warning: WARNING
-          critical: CRITICAL
-          operator: "=="
-        ups_load:
-          display: "load to high: {ups_output}"
-          WARNING: 70
-          CRITICAL: 80
-          OPERATOR: ">="
-        ups_status_code:
-          DISPLAY: "{ups_output}"
-          warning: 1
-          critical: 2
-          operator: ">="
-        nextcloud_apps_status_code:
-          display: "{nextcloud_apps_output}"
-          warning: 1
-          critical: 2
-          operator: ">="
-      rtt:
-        warning: 120
-        critical: 250.0
-
-

.vscode/launch.json

@@ -4,12 +4,13 @@
   // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
   "version": "0.2.0",
   "configurations": [
+
     {
       "name": "Python: Run hbd (module)",
       "type": "debugpy",
       "request": "launch",
       "module": "hbd.server.cli",
-      "args": ["-c", "/home/andreas/git/heartbeat/.hb.yaml", "-f", "-v", "-x", "-x", "-x", "-x"],
+      "args": ["-c", "~/.hb.yaml", "-f", "-v"],
       "cwd": "${workspaceFolder}",
       "env": {
         "PYTHONPATH": "${workspaceFolder}"
@@ -28,14 +29,14 @@
       ]
     },
     {
-      "name": "Python: Run hbd with debugpy (listen)",
+      "name": "Python: Run hbc (module)",
       "type": "debugpy",
       "request": "launch",
-      "module": "debugpy",
-      "args": ["--listen", "5678", "--wait-for-client", "-m", "hbd.server.cli", "-c", ".hb.yaml", "-f", "-v"],
+      "module": "hbd.client.main",
+      "args": ["-c", "~/.hbc.yaml",  "-v", "winter"],
+      "cwd": "${workspaceFolder}",
       "env": { "PYTHONPATH": "${workspaceFolder}" },
       "console": "integratedTerminal",
-      "justMyCode": false
     }
   ]
 }

README.md

@@ -11,8 +11,13 @@ A lightweight daemon that listens for UDP heartbeat messages and acts on them: k
 - Queue DNS updates via `nsupdate` and run them in a background thread ✅
 - WebSocket API for live updates (hosts & messages) ✅
 - Notification pipeline (email, Pushover, Mattermost, Signal) ✅
+- **User management & access control** ✅
+  - Optional user accounts with bcrypt-style password hashing (stdlib only)
+  - Per-host roles: owner, manager, monitor
+  - Session-based auth with cookie support (browser login page included)
+  - Backwards compatible: no auth required when no users are configured
 - **HTTP API & Web UI** ✅
-  - REST API for plugin data, alerts, and host information
+  - REST API for plugin data, alerts, host information, and user management
   - Live dashboard with WebSocket updates
   - Interactive plugin metrics visualization
   - Alerts dashboard with filtering and summaries
@@ -71,7 +76,7 @@ See [docs/NAGIOS_INTEGRATION.md](docs/NAGIOS_INTEGRATION.md) for complete integr
 ### Creating Custom Plugins
 
 ```python
-from hbd.plugin import MonitorPlugin
+from hbd.client.plugin import MonitorPlugin
 
 class DiskMonitorPlugin(MonitorPlugin):
     name = "disk_monitor"
@@ -84,7 +89,7 @@ class DiskMonitorPlugin(MonitorPlugin):
         }
 ```
 
-Place plugins in `hbd/plugins/` and they'll be automatically discovered and loaded by the client.
+Place plugins in `hbd/client/plugins/` and they'll be automatically discovered and loaded by the client.
 
 ---
 
@@ -266,20 +271,63 @@ See [docs/THRESHOLD_ALERTING.md](docs/THRESHOLD_ALERTING.md) for comprehensive d
 
 ---
 
+## 👥 User Management
+
+Heartbeat supports optional user accounts with role-based access control per host.
+
+### Roles
+
+- **monitor** — view status, plugin data, alerts
+- **manager** — monitor + queue commands, trigger DNS, queue upgrades
+- **owner** — manager + drop host, transfer ownership, update access
+- **admin** (user flag) — owner-level access on every host
+
+When no users are configured the server runs in **unauthenticated mode** — all existing behaviour is unchanged.
+
+### Quick setup
+
+```yaml
+users:
+  alice:
+    full_name: Alice Smith
+    password: pbkdf2:sha256:...    # hbd passwd alice
+    admin: true
+
+default_owner: alice
+
+hosts:
+  webserver01:
+    owner: alice
+    managers: [bob]
+    monitors: [carol]
+```
+
+```bash
+# Generate a password hash
+hbd passwd alice
+```
+
+Browser users are redirected to `/login` automatically. The session cookie is set on login, so `fetch()` calls from dashboards work without any JavaScript changes.
+
+See [docs/USERS.md](docs/USERS.md) for complete user management documentation.
+
+---
+
 ## 🌐 HTTP API & Web UI
 
 Heartbeat includes a built-in HTTP/WebSocket server that provides both a REST API and web-based dashboards for monitoring and visualization.
 
 ### Features
 
-- **REST API**: JSON endpoints for accessing plugin data, alerts, and host information
+- **User auth**: Optional session-based authentication with per-host role enforcement
+- **REST API**: JSON endpoints for accessing plugin data, alerts, host information, and user management
 - **Live Dashboard**: Real-time WebSocket-powered host status view
 - **Plugin Metrics**: Interactive visualization of all plugin data with auto-refresh
 - **Alerts Dashboard**: Comprehensive alert monitoring with filtering and summaries
-- **CORS Support**: Configurable for integration with external applications
 
 ### Web Dashboards
 
+- **Login** (`/login`): Browser login form (shown automatically when auth is configured)
 - **Live View** (`/live`): Real-time host connectivity, latency, and messages
 - **Plugin Metrics** (`/plugins`): Browse and visualize metrics from all plugins
 - **Alerts Dashboard** (`/alerts`): Monitor active alerts with severity filtering
@@ -287,56 +335,29 @@ Heartbeat includes a built-in HTTP/WebSocket server that provides both a REST AP
 ### API Endpoints
 
 ```bash
+# Log in (when auth is configured)
+TOKEN=$(curl -s -X POST http://localhost:50004/api/0/auth/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"alice","password":"secret"}' | jq -r .token)
+AUTH="-H \"Authorization: Bearer $TOKEN\""
+
 # List all monitored hosts
-curl http://localhost:50004/api/0/hosts
+curl $AUTH http://localhost:50004/api/0/hosts
 
 # Get all plugin data for a host
-curl http://localhost:50004/api/0/hosts/webserver01/plugins
+curl $AUTH http://localhost:50004/api/0/hosts/webserver01/plugins
 
 # Get detailed plugin history (last 50 samples)
-curl http://localhost:50004/api/0/hosts/webserver01/plugins/cpu_monitor?limit=50
+curl $AUTH "http://localhost:50004/api/0/hosts/webserver01/plugins/cpu_monitor?limit=50"
 
 # Get alert states for a specific host
-curl http://localhost:50004/api/0/hosts/webserver01/alerts
+curl $AUTH http://localhost:50004/api/0/hosts/webserver01/alerts
 
 # Get all active alerts across all hosts
-curl http://localhost:50004/api/0/alerts
-```
+curl $AUTH http://localhost:50004/api/0/alerts
 
-### Integration Examples
-
-**Python Client:**
-```python
-import requests
-
-# Monitor for critical alerts
-response = requests.get('http://localhost:50004/api/0/alerts')
-alerts = response.json()
-
-if alerts['summary']['critical'] > 0:
-    print(f"⚠️ {alerts['summary']['critical']} CRITICAL alerts!")
-    for alert in alerts['alerts']:
-        if alert['level'] == 'CRITICAL':
-            print(f"  {alert['hostname']}: {alert['metric_path']} = {alert['last_value']}")
-```
-
-**Bash Monitoring Script:**
-```bash
-#!/bin/bash
-# Check for critical alerts
-CRITICAL=$(curl -s http://localhost:50004/api/0/alerts | jq '.summary.critical')
-if [ "$CRITICAL" -gt 0 ]; then
-    echo "CRITICAL: $CRITICAL critical alerts detected!"
-    # Send notification
-fi
-```
-
-### Demo & Testing
-
-Run the API demo script to test all endpoints:
-
-```bash
-python3 scripts/demo_http_api.py
+# View/update host access roles
+curl $AUTH http://localhost:50004/api/0/hosts/webserver01/access
 ```
 
 See [docs/HTTP_API.md](docs/HTTP_API.md) for complete API documentation including response formats, error handling, and integration examples.
@@ -347,7 +368,7 @@ See [docs/HTTP_API.md](docs/HTTP_API.md) for complete API documentation includin
 
 Prerequisites:
 
-- Python 3.10+ (project uses language features from recent Python)
+- Python 3.11+ (project uses language features from recent Python)
 - `nsupdate` (for DNS updates) if using dynamic DNS
 
 Install dependencies (recommended into a venv):
@@ -368,7 +389,7 @@ hbd -c .hb.yaml -f -v
 You can also run it directly via the package entrypoint after installation:
 
 ```bash
-python -m hbd.cli -c /path/to/config.yaml
+python -m hbd.server.cli -c /path/to/config.yaml
 ```
 
 ### Running the Client
@@ -376,14 +397,23 @@ python -m hbd.cli -c /path/to/config.yaml
 The heartbeat client (`hbc`) sends periodic heartbeats and plugin data to the server:
 
 ```bash
-# Basic usage pointing to server
-python -m hbd.hbc --server your-server.example.com
+# Basic usage pointing to server (host is a positional argument)
+hbc your-server.example.com
 
-# With custom configuration
-python -m hbd.hbc --server 192.168.1.100 --port 50003 --interval 30
+# Run as daemon with a config file
+hbc -d -c /etc/hbc.yaml your-server.example.com
 
-# Run with specific plugins enabled/disabled
-python -m hbd.hbc --server hbd.local --disable-plugin os_info
+# Send a one-off boot message
+hbc --boot your-server.example.com
+
+# Verbose output
+hbc -v your-server.example.com
+```
+
+You can also run it via the module entrypoint:
+
+```bash
+python -m hbd.client.main your-server.example.com
 ```
 
 Client configuration can also be specified in YAML:
@@ -417,30 +447,29 @@ This repository includes a ready-to-use `.vscode/launch.json` with configuration
 
 - Ensure the **Python** extension is installed and select the project `.venv` as the interpreter (bottom-left of VS Code).
 - Use **F5** and pick one of these configurations from the Run view:
-  - **Python: Run hbd (module)** — runs `hbd.cli` as a module and sets `PYTHONPATH` to the workspace root (recommended).
+  - **Python: Run hbd (module)** — runs `hbd.server.cli` as a module and sets `PYTHONPATH` to the workspace root (recommended).
   - **Python: Run hbd with debugpy (listen)** — launches `debugpy` and `hbd` together; useful when you want the process to listen for a debugger.
   - **Python: Attach (localhost:5678)** — attach the debugger to a running process started with `debugpy`.
 
 To start `hbd` manually and wait for the debugger to attach, run:
 
 ```bash
-PYTHONPATH=. python -m debugpy --listen 5678 --wait-for-client -m hbd.cli -c .hb.yaml -f -v
+PYTHONPATH=. python -m debugpy --listen 5678 --wait-for-client -m hbd.server.cli -c .hb.yaml -f -v
 ```
 
-Set breakpoints in modules such as `hbd/udp.py`, `hbd/dns.py`, or `hbd/server.py`, and use the **Attach** configuration to connect. Use `justMyCode: false` if you need to step into third-party code.
+Set breakpoints in modules such as `hbd/server/udp.py`, `hbd/server/dns.py`, or `hbd/server/main.py`, and use the **Attach** configuration to connect. Use `justMyCode: false` if you need to step into third-party code.
 
 ---
 
 ## 🛠 Configuration
 
-`hbd` reads YAML configuration (optional). If `PyYAML` is not installed, built-in defaults are used. Example configuration keys (see `hbd/config.py`):
+`hbd` reads YAML configuration (optional). If `PyYAML` is not installed, built-in defaults are used. Example configuration keys (see `hbd/server/config.py`):
 
 - `hb_port`: UDP port to listen for heartbeats (default: 50003)
 - `hbd_port`: internal control port (default: 50004)
 - `hbd_host`: bind address for HTTP/WSS
 - `pickfile`: path for persisted state
 - `logfile`: path to log file
-- `logfmt`: `text` or `msg`
 - `pushsrv`: push service (`pushover`|`mattermost`|`all`)
 - `interval` / `grace`: heartbeat timing configuration
 - `dyndomains`: list of dyndomains to update via `nsupdate`
@@ -452,6 +481,8 @@ Set breakpoints in modules such as `hbd/udp.py`, `hbd/dns.py`, or `hbd/server.py
 - `cert_path`: directory where TLS certificate and key are looked up (default: /usr/local/etc/ssl/)
 - `wss_pem`: filename for the certificate chain (default: fullchain.pem)
 - `wss_key`: filename for the private key (default: privkey.pem)
+- `users`: mapping of username → user attributes (full_name, avatar, password, admin, notification_channels)
+- `default_owner`: username that owns hosts with no explicit owner (falls back to first admin user)
 
 Example `.hb.yaml` (minimal):
 
@@ -464,29 +495,39 @@ nsupdate_bin: /usr/bin/nsupdate
 pushsrv: pushover
 ```
 
-> Tip: `config.DEFAULTS` in `hbd/config.py` contains the canonical defaults and accepted configuration keys.
+> Tip: `SERVER_DEFAULTS` in `hbd/server/config.py` contains the canonical defaults and accepted configuration keys.
 
 ---
 
 ## 🔧 Architecture & Modules
 
-- `hbd.proto` — serialization/deserialization of heartbeat messages (supports compressed payloads and plugin data)
-- `hbd.udp` — UDP parsing and `handle_datagram` implementation (main state machine)
-- `hbd.dns` — `create_nsupdate_payload`, `nsupdate`, and an asyncio DNS worker (`start_dns_worker`).
-  The DNS worker now runs as an `asyncio` task and the package exposes a
-  small thread-safe bridge so legacy synchronous code can `put()` updates
-  into the queue; there is no longer a permanently-blocking background
-  `threading.Thread`.
-- `hbd.notify` — email and push notification helpers
-- `hbd.ws` — WebSocket server and thread-safe broadcast helpers
-- `hbd.http` — HTTP handler factory for the status UI/API
-- `hbd.journal` — message journal with size-based log rotation and backup management
-- `hbd.plugin` — plugin framework with base classes, registry, and dynamic loader
-- `hbd.plugins/` — built-in plugins (os_info, cpu_monitor, memory_monitor, disk_monitor, network_monitor, filesystem_info, nagios_runner)
-- `hbd.hbc` — heartbeat client that sends heartbeats and plugin data to server
-- `hbd.utils` — small utility helpers (`shortname`, `dur`, `initlog`)
-- `hbd.cli` — CLI entrypoint and argument parsing
-- `hbd.server` — async orchestration to run UDP/HTTP/WSS components
+The package is organized into three subpackages:
+
+**`hbd.common`** — shared code used by both client and server:
+- `hbd.common.proto` — serialization/deserialization of heartbeat messages (supports compressed payloads and plugin data)
+- `hbd.common.utils` — small utility helpers (`shortname`, `dur`, `initlog`)
+
+**`hbd.server`** — the heartbeat daemon (`hbd`):
+- `hbd.server.cli` — CLI entrypoint and argument parsing
+- `hbd.server.main` — async orchestration to run UDP/HTTP/WSS components
+- `hbd.server.udp` — UDP parsing and `handle_datagram` implementation (main state machine)
+- `hbd.server.dns` — `create_nsupdate_payload`, `nsupdate`, and an asyncio DNS worker (`start_dns_worker`).
+  The DNS worker runs as an `asyncio` task and the package exposes a small thread-safe bridge
+  so legacy synchronous code can `put()` updates into the queue.
+- `hbd.server.notify` — email and push notification helpers
+- `hbd.server.ws` — WebSocket server and thread-safe broadcast helpers
+- `hbd.server.http` — HTTP handler factory for the status UI/API
+- `hbd.server.journal` — message journal with size-based log rotation and backup management
+- `hbd.server.threshold` — threshold alerting engine
+- `hbd.server.monitor` — host state monitoring
+- `hbd.server.hbdclass` — `Host` class and shared server state
+- `hbd.server.config` — configuration loader and defaults
+
+**`hbd.client`** — the heartbeat client (`hbc`):
+- `hbd.client.main` — client entrypoint; sends heartbeats and plugin data to the server
+- `hbd.client.plugin` — plugin framework with base classes, registry, and dynamic loader
+- `hbd.client.plugins/` — built-in plugins (os_info, cpu_monitor, memory_monitor, disk_monitor, network_monitor, filesystem_info, nagios_runner)
+- `hbd.client.config` — client configuration loader
 
 This modular layout makes the code easier to test and maintain.
 
@@ -494,12 +535,12 @@ This modular layout makes the code easier to test and maintain.
 
 - The main runtime is asyncio-based. Services (UDP listener, HTTP server, WebSocket server, monitor, and DNS worker) run as asyncio tasks.
 - On SIGINT/SIGTERM the server triggers a graceful shutdown: it cancels active tasks, signals the DNS worker via a sentinel, and cleans up resources before exit.
-- The DNS update worker is implemented as an `asyncio` task; synchronous producers can still enqueue DNS updates via a small thread-safe bridge available at `hbd.hbdclass.Host.dnsQ`.
+- The DNS update worker is implemented as an `asyncio` task; synchronous producers can still enqueue DNS updates via a small thread-safe bridge available at `hbd.server.hbdclass.Host.dnsQ`.
 
 **Templates & Static Files**
 
-- Template files are located under `hbd/templates` by default. The HTTP server resolves templates relative to the `hbd` package but the path can be overridden with the `templates_dir` config key.
-- Static assets (CSS/JS/images) are served from `hbd/static` via the `/static/<path>` HTTP route. Place your static files in that directory or configure the HTTP server as needed.
+- Template files are located under `hbd/server/templates`. The HTTP server resolves templates relative to the `hbd.server` package but the path can be overridden with the `templates_dir` config key.
+- Static assets (CSS/JS/images) are served from `hbd/server/static` via the `/static/<path>` HTTP route.
 
 ---
 

REFACTORING.md

@@ -59,7 +59,7 @@ Server-specific defaults:
 - `hb_port`: Port to listen for heartbeats (default: 50003)
 - `hbd_port`: HTTP API port (default: 50004)
 - `ws_port`: WebSocket port (default: 50005)
-- `logfile`, `logfmt`: Logging configuration
+- `logfile`: Log file path
 - `pushsrv`, `pushover_token`, etc.: Notification settings
 - `watchhosts`, `dyndnshosts`: Host monitoring
 - `smtpserver`, etc.: Email settings

async_sms_send.py

@@ -0,0 +1,40 @@
+async def send_sms(hass, user, password, sender_did, call):
+    """Send SMS message using multipart form-data like MMS."""
+    _LOGGER = logging.getLogger(__name__)
+    recipient = call.data.get("recipient")
+    message = call.data.get("message")
+
+    if not recipient or not message:
+        _LOGGER.error("Recipient or message missing.")
+        return
+
+    # Build form data dictionary
+    form_data = {
+        'api_username': str(user),
+        'api_password': str(password),
+        'did': str(sender_did),
+        'dst': str(recipient),
+        'message': str(message),
+        'method': 'sendSMS'
+    }
+
+    async with aiohttp.ClientSession() as session:
+        with aiohttp.MultipartWriter("form-data") as mp:
+            for key, value in form_data.items():
+                part = mp.append(value)
+                part.set_content_disposition('form-data', name=key)
+
+            _LOGGER.error("voipms_sms: sending SMS: %s", mp)
+            async with session.post(REST_ENDPOINT, data=mp) as response:
+                response_text = await response.text()
+                if response.status == 200:
+                    response_json = json.loads(response_text)
+                    if response_json['status'] == "success": 
+                        _LOGGER.info("voipms_sms: SMS sent successfully: %s", response_text)
+                    else:
+                        _LOGGER.error("voipms_sms: SMS not sent: %s", response_text)
+                else:
+                    _LOGGER.error("voipms_sms: Failed to send SMS. Status: %s, Response: %s", response.status, response_text)
+
+
+

docs/CONFIG_RELOAD.md

@@ -81,7 +81,6 @@ The following settings **cannot** be reloaded and require a service restart:
 
 - **Logging**
   - `logfile` - Log file path
-  - `logfmt` - Log format
 
 - **Journal Settings**
   - `journal_enabled` - Enable/disable journaling

docs/HTTP_API.md

@@ -15,12 +15,49 @@ Default port is `50004` (configurable via `hbd_port` in configuration).
 
 ---
 
+## Authentication
+
+When [user accounts are configured](USERS.md), every request must be authenticated.
+
+- **Browser requests** to HTML pages are redirected to `/login` automatically.  JavaScript `fetch()` calls on the dashboards send the session cookie automatically — no JS changes are needed.
+- **API / programmatic requests** must include the token in an `Authorization: Bearer <token>` header or an `X-Auth-Token` header.
+
+Unauthenticated API requests receive `401 Unauthorized`.  When no users are configured the server runs in unauthenticated mode and all endpoints are open.
+
+### Login
+
+```bash
+TOKEN=$(curl -s -X POST http://localhost:50004/api/0/auth/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"alice","password":"secret"}' | jq -r .token)
+
+curl -H "Authorization: Bearer $TOKEN" http://localhost:50004/api/0/hosts
+```
+
+See [User Management](USERS.md) for full authentication documentation.
+
+---
+
 ## API Endpoints
 
+### Authentication
+
+| Method | Path | Description | Auth required |
+|--------|------|-------------|---------------|
+| `POST` | `/api/0/auth/login` | Obtain session token | No |
+| `POST` | `/api/0/auth/logout` | Invalidate session | Token |
+
+### Users
+
+| Method | Path | Description | Role |
+|--------|------|-------------|------|
+| `GET` | `/api/0/users` | List all users | Admin |
+| `GET` | `/api/0/users/me` | Own profile | Authenticated |
+
 ### Host Management
 
 #### GET /api/0/hosts
-Get list of all monitored hosts with their state information.
+Get list of all monitored hosts with their state information.  When auth is enabled, only hosts the caller has at least **monitor** access to are returned.
 
 **Response:**
 ```json
@@ -28,6 +65,9 @@ Get list of all monitored hosts with their state information.
   {
     "name": "webserver01",
     "dyn": false,
+    "owner": "alice",
+    "managers": ["bob"],
+    "monitors": ["carol"],
     "connections": [...]
   }
 ]
@@ -137,6 +177,32 @@ curl http://localhost:50004/api/0/hosts/database01/plugins/disk_monitor
 
 ---
 
+### Host Access
+
+#### GET /api/0/hosts/{hostname}/access
+Get owner/managers/monitors for a host. Requires **monitor** role or higher.
+
+**Response:**
+```json
+{
+  "owner": "alice",
+  "managers": ["bob"],
+  "monitors": ["carol"]
+}
+```
+
+#### PUT /api/0/hosts/{hostname}/access
+Update owner/managers/monitors. Requires **owner** role or admin.
+
+**Request body** (all fields optional):
+```json
+{ "owner": "bob", "managers": ["carol"], "monitors": [] }
+```
+
+Changes take effect immediately but are not written back to the config file. Update the config file and send `SIGHUP` to make them permanent.
+
+---
+
 ### Alert Endpoints
 
 #### GET /api/0/hosts/{hostname}/alerts
@@ -226,6 +292,16 @@ curl http://localhost:50004/api/0/alerts | jq .
 
 ## Web UI Pages
 
+### Login
+**URL:** `/login`
+
+Shown automatically when a browser request is made without a valid session (when users are configured). After successful login the browser is redirected to the originally requested page.
+
+### Logout
+**URL:** `/logout`
+
+Clears the session cookie and redirects to `/login`.
+
 ### Live Dashboard
 **URL:** `/live`
 
@@ -288,7 +364,13 @@ Comprehensive alert monitoring:
 #!/bin/bash
 # Check for critical alerts and send notification
 
-RESPONSE=$(curl -s http://localhost:50004/api/0/alerts)
+# Log in first (when auth is configured)
+TOKEN=$(curl -s -X POST http://localhost:50004/api/0/auth/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"monitor","password":"secret"}' | jq -r .token)
+AUTH="-H \"Authorization: Bearer $TOKEN\""
+
+RESPONSE=$(curl -s $AUTH http://localhost:50004/api/0/alerts)
 CRITICAL_COUNT=$(echo "$RESPONSE" | jq '.summary.critical')
 
 if [ "$CRITICAL_COUNT" -gt 0 ]; then
@@ -305,8 +387,16 @@ fi
 import requests
 import json
 
+BASE = 'http://localhost:50004'
+
+# Log in (skip if auth not configured)
+resp = requests.post(f'{BASE}/api/0/auth/login',
+                     json={"username": "alice", "password": "secret"})
+token = resp.json().get("token")
+headers = {"Authorization": f"Bearer {token}"} if token else {}
+
 # Get all plugin data for a host
-response = requests.get('http://localhost:50004/api/0/hosts/webserver01/plugins')
+response = requests.get(f'{BASE}/api/0/hosts/webserver01/plugins', headers=headers)
 data = response.json()
 
 print(f"Host: {data['hostname']}")
@@ -318,7 +408,7 @@ for plugin, info in data['plugins'].items():
         print(f"  {metric}: {value}")
 
 # Check for alerts
-response = requests.get('http://localhost:50004/api/0/alerts')
+response = requests.get(f'{BASE}/api/0/alerts', headers=headers)
 alerts = response.json()
 
 if alerts['summary']['critical'] > 0:
@@ -389,6 +479,8 @@ API errors return appropriate HTTP status codes with JSON:
 **Common Status Codes:**
 - `200 OK` - Success
 - `400 Bad Request` - Invalid parameters
+- `401 Unauthorized` - Missing or invalid session token
+- `403 Forbidden` - Authenticated but insufficient role
 - `404 Not Found` - Resource not found
 - `500 Internal Server Error` - Server error
 
@@ -506,6 +598,14 @@ for route in list(app.router.routes()):
 
 ## Troubleshooting
 
+### API Returns 401
+- Auth is configured — include `Authorization: Bearer <token>` header
+- Token may have expired (24 h TTL) — log in again
+
+### API Returns 403
+- Authenticated user lacks the required role for this host/action
+- Check host's `owner`, `managers`, `monitors` config
+
 ### API Returns 404
 - Verify hostname in URL matches actual host name
 - Check host is sending heartbeats: `curl http://localhost:50004/api/0/hosts`
@@ -525,6 +625,7 @@ for route in list(app.router.routes()):
 
 ## See Also
 
+- [User Management](USERS.md)
 - [Plugin Development Guide](PLUGIN_DEVELOPMENT.md)
 - [Threshold Alerting Documentation](THRESHOLD_ALERTING.md)
 - [Message Journal Documentation](MESSAGE_JOURNAL.md)

docs/NOTIFICATIONS.md

@@ -2,532 +2,294 @@
 
 ## Overview
 
-The Heartbeat Monitoring System includes a flexible notification system that can send alerts through multiple channels including Email, Pushover, Signal, and Mattermost. The system supports centralized channel definitions with per-host routing, allowing fine-grained control over notification delivery.
+Notifications are dispatched to the **owner and managers** of a host, each via their own configured notification channels. Channel definitions are global; users reference them by name. No users configured → no notifications sent.
 
 ## Architecture
 
-### Components
+```
+Alert event (udp.py / threshold.py)
+  └─ notify.send_notification(host_name, Notification)
+       ├─ look up host.owner + host.managers
+       ├─ for each user → user.notification_channels
+       └─ for each channel → _dispatch_to_channel (filtered by min_level)
+```
 
-1. **Notification Channels** (`notification_channels` in config)
-   - Centralized definitions of notification providers
-   - Each channel has a type and type-specific credentials
-   - Reusable across multiple hosts
-
-2. **Channel Dispatcher** (`hbd/server/notify.py`)
-   - `pushmsg_for_host(hostname, message)`: Main entry point for host-specific notifications
-   - `_dispatch_to_channel(channel_name, channel_config, message)`: Routes to specific provider
-   - Provider functions: `pushover()`, `pushsignal()`, `pushmattermost()`, `send_email()`
-
-3. **Configuration Utilities** (`hbd/server/config.py`)
-   - `get_notification_channels_for_host(config, hostname)`: Retrieves channel names for a host
-   - `get_notification_channels_config(config, hostname)`: Retrieves full channel configurations
-   - `get_channel_config(config, channel_name)`: Gets configuration for a specific channel
-
-4. **Integration Points**
-   - **Threshold alerts**: `threshold.py` calls `notify_mod.pushmsg_for_host()`
-   - **Heartbeat events**: `udp.py` calls `notify_mod.pushmsg_for_host()` for boot/shutdown/overdue
-   - **Custom alerts**: Any code can call `notify_mod.pushmsg_for_host(hostname, message)`
+Every notification carries:
+- **title** — `[LEVEL] hostname` (e.g. `[CRITICAL] webserver01`)
+- **body** — detail message (metric value, threshold, duration)
+- **url** — link to the plugin metrics page (`{base_url}/plugins#{hostname}`)
+- **level** — `RECOVER | WARNING | CRITICAL | INFO`
 
 ## Configuration
 
-### Centralized Channel Definitions
+### Base URL
 
-Define notification channels once in your configuration file:
+Set `base_url` so notification links point to your hbd instance:
+
+```yaml
+base_url: https://hbd.example.com
+```
+
+### Global channel definitions
+
+Define channels once; reference them by name from user configs:
 
 ```yaml
 notification_channels:
-  # Signal notifications
-  signal_ops:
-    type: signal
-    cli_path: /usr/local/bin/signal-cli
-    user: +1234567890        # Your Signal number
-    recipient: +1234567890   # Recipient number
 
-  signal_oncall:
-    type: signal
-    cli_path: /usr/local/bin/signal-cli
-    user: +1234567890
-    recipient: +0987654321   # Different recipient
+  pushover_ops:
+    type: pushover
+    token: your-app-token
+    user: your-user-key
+    min_level: WARNING        # optional, default: WARNING
 
-  # Email notifications
   email_ops:
     type: email
-    recipients:
-      - ops@example.com
-      - alerts@example.com
-    sender: heartbeat@example.com
+    recipients: [ops@example.com]
+    sender: hbd@example.com
     smtp_server: smtp.example.com
     smtp_port: 587
-    smtp_user: heartbeat@example.com
-    smtp_password: your-smtp-password
+    smtp_user: hbd@example.com
+    smtp_password: secret
+    min_level: WARNING
 
-  email_devteam:
-    type: email
-    recipients: [dev-alerts@example.com]
-    sender: heartbeat-dev@example.com
-    smtp_server: smtp.example.com
-    smtp_port: 587
-    smtp_user: heartbeat-dev@example.com
-    smtp_password: your-smtp-password
+  matrix_oncall:
+    type: matrix
+    homeserver: https://matrix.example.org
+    access_token: syt_xxx
+    room_id: "!abc:matrix.example.org"
+    min_level: CRITICAL       # only send critical alerts to this room
 
-  # Pushover notifications
-  pushover_urgent:
-    type: pushover
-    token: your-pushover-app-token
-    user: your-pushover-user-key
+  sms_oncall:
+    type: sms_voipms
+    api_user: me@example.com
+    api_password: secret
+    did: "5551234567"         # your voip.ms DID number
+    dst: "5559876543"         # destination number
+    min_level: CRITICAL
 
-  pushover_normal:
-    type: pushover
-    token: your-pushover-app-token
-    user: another-user-key
-  
-  # Mattermost notifications
-  mattermost_devops:
-    type: mattermost
-    host: mattermost.example.com
-    token: your-webhook-token
-    channel: devops-alerts
-    username: heartbeat-bot
-    icon: https://example.com/heartbeat-icon.png
-```
-
-### Default Notification Channels
-
-Specify default channels for hosts that don't have specific channel assignments:
-
-```yaml
-default_notification_channels:
-  - email_ops
-  - mattermost_devops
-```
-
-Hosts without `notification_channels` defined will use these defaults.
-
-### Per-Host Channel Assignment
-
-Assign specific channels to each host in the `hosts` section:
-
-```yaml
-hosts:
-  # Critical production web server - multiple channels for redundancy
-  prod-web-01:
-    threshold_config: high_sensitivity
-    watch: true
-    notification_channels:
-      - signal_oncall        # Immediate mobile notification
-      - pushover_urgent      # Secondary mobile notification
-      - email_ops            # Email for record keeping
-    dyndns: false
-  
-  # Database server - ops team notifications only
-  prod-db-01:
-    threshold_config: database
-    watch: true
-    notification_channels:
-      - signal_ops
-      - email_ops
-    dyndns: false
-  
-  # Development server - email only, no urgent notifications
-  dev-server-01:
-    threshold_config: low_sensitivity
-    watch: false
-    notification_channels:
-      - email_devteam
-    dyndns: false
-  
-  # Test server - uses default_notification_channels
-  test-server-01:
-    threshold_config: default
-    watch: false
-    dyndns: false
-    # No notification_channels specified = uses default_notification_channels
-```
-
-## Channel Types
-
-### Email
-
-Sends notifications via SMTP.
-
-**Configuration fields:**
-```yaml
-type: email
-recipients: [email1@example.com, email2@example.com]  # Required: List of recipients
-sender: heartbeat@example.com                         # Required: From address
-smtp_server: smtp.example.com                         # Required: SMTP server hostname
-smtp_port: 587                                        # Optional: Default 587
-smtp_user: heartbeat@example.com                      # Optional: For authenticated SMTP
-smtp_password: your-password                          # Optional: For authenticated SMTP
-```
-
-**Features:**
-- Supports multiple recipients
-- TLS/STARTTLS support on port 587
-- Authenticated and unauthenticated SMTP
-
-**Example:**
-```yaml
-notification_channels:
-  email_critical:
-    type: email
-    recipients: [admin@example.com, oncall@example.com]
-    sender: alerts@example.com
-    smtp_server: smtp.fastmail.com
-    smtp_port: 587
-    smtp_user: alerts@example.com
-    smtp_password: app-specific-password
-```
-
-### Pushover
-
-Sends push notifications to mobile devices via Pushover API.
-
-**Configuration fields:**
-```yaml
-type: pushover
-token: your-application-token    # Required: Your Pushover app token
-user: your-user-key              # Required: Recipient's user key
-```
-
-**Features:**
-- Instant mobile push notifications
-- Works on iOS and Android
-- Supports delivery confirmations
-
-**Setup:**
-1. Create a Pushover account at https://pushover.net
-2. Create an application to get your app token
-3. Note your user key from your account dashboard
-
-**Example:**
-```yaml
-notification_channels:
-  pushover_admin:
-    type: pushover
-    token: azGDORePK8gMaC0QOYAMyEEuzJnyUi
-    user: uQiRzpo4DXghDmr9QzzfQu27cmVRsG
-```
-
-### Signal
-
-Sends notifications via Signal messenger using signal-cli.
-
-**Configuration fields:**
-```yaml
-type: signal
-cli_path: /usr/local/bin/signal-cli    # Optional: Path to signal-cli binary
-user: +1234567890                       # Required: Your Signal phone number
-recipient: +0987654321                  # Required: Recipient phone number
-```
-
-**Prerequisites:**
-1. Install signal-cli: https://github.com/AsamK/signal-cli
-2. Register signal-cli with your phone number:
-   ```bash
-   signal-cli -u +1234567890 register
-   signal-cli -u +1234567890 verify CODE
-   ```
-3. Ensure signal-cli is in PATH or specify full path in config
-
-**Features:**
-- End-to-end encrypted messaging
-- Works without phone being online
-- No API fees or rate limits
-
-**Example:**
-```yaml
-notification_channels:
-  signal_admin:
+  signal_ops:
     type: signal
     cli_path: /usr/local/bin/signal-cli
     user: +12025551234
     recipient: +12025559999
-```
 
-### Mattermost
-
-Sends notifications to Mattermost team chat via incoming webhooks.
-
-**Configuration fields:**
-```yaml
-type: mattermost
-host: mattermost.example.com           # Required: Mattermost server hostname
-token: your-webhook-token               # Required: Incoming webhook token
-channel: channel-name                   # Required: Target channel name
-username: heartbeat-bot                 # Optional: Bot display name
-icon: https://example.com/icon.png      # Optional: Bot icon URL
-```
-
-**Prerequisites:**
-1. Enable incoming webhooks in Mattermost
-2. Create an incoming webhook for your team
-3. Note the webhook token from the webhook URL
-
-**Features:**
-- Team-wide visibility
-- Rich formatting support
-- Message threading
-
-**Example:**
-```yaml
-notification_channels:
-  mattermost_ops:
+  mattermost_devops:
     type: mattermost
-    host: chat.example.com
-    token: abc123def456ghi789
-    channel: infrastructure-alerts
-    username: heartbeat-monitor
-    icon: https://example.com/heartbeat-icon.png
+    host: mattermost.example.com
+    token: webhook-token
+    channel: devops-alerts
+    username: heartbeat-bot
 ```
 
-## Notification Events
+### Users with notification channels
 
-The system sends notifications for various events:
+Each user lists which global channels they receive notifications on:
 
-### Threshold Alerts
+```yaml
+users:
+  alice:
+    full_name: Alice Smith
+    password: pbkdf2:sha256:...
+    admin: true
+    notification_channels: [pushover_ops, email_ops]
 
-When monitored metrics exceed configured thresholds:
-
-- **State changes**: OK → WARNING, WARNING → CRITICAL, CRITICAL → OK
-- **Format**: `{LEVEL}: {hostname} - {metric_path} = {value} {threshold_info}`
-- **Example**: `CRITICAL: prod-web-01 - cpu_monitor.cpu_percent = 95.2 (threshold: > 90.0)`
-- **Re-notifications**: Periodic reminders for ongoing alerts (default: hourly)
-
-### Heartbeat Events
-
-Host lifecycle events:
-
-- **Host boot**: `{hostname} booted`
-- **Host shutdown**: `{hostname} {connection_type} shutdown`
-- **Host recovery**: `{hostname} {connection_type} is back`
-- **Connection issues**: `{hostname} {message}`
-- **Host overdue**: `{hostname} {connection_type} overdue`
-
-Only hosts with `watch: true` send heartbeat event notifications.
-
-### Custom Alerts
-
-Application code can send custom notifications:
-
-```python
-from hbd.server import notify as notify_mod
-
-# Send to host-specific channels
-notify_mod.pushmsg_for_host("prod-web-01", "Custom alert message")
-
-# Send using global config
-notify_mod.pushmsg_from_config("Global notification")
-
-# Send to specific config
-notify_mod.pushmsg(custom_config_dict, "Targeted notification")
+  bob:
+    full_name: Bob Jones
+    password: pbkdf2:sha256:...
+    notification_channels: [sms_oncall, matrix_oncall]
 ```
 
-## Design Principles
+### Host access — owner and managers
 
-The notification system follows these core principles:
-
-- **Centralization**: Define notification providers once, reference them by name
-- **Flexibility**: Each host can use different channels for different notification needs
-- **Redundancy**: Critical hosts can specify multiple channels for failover
-- **Clarity**: Clean separation between channel definition and channel assignment
-- **Type Safety**: Provider-specific validation at configuration time
-
-## Best Practices
-
-### Channel Organization
-
-- **Create purpose-specific channels**: `email_ops`, `signal_oncall`, `pushover_urgent`
-- **Separate by team/role**: `email_devteam`, `signal_dbateam`, `mattermost_security`
-- **Use descriptive names**: Channel names appear in logs and debugging
-
-### Redundancy
-
-For critical hosts, use multiple notification channels:
+Notifications for a host go to its owner and all managers:
 
 ```yaml
 hosts:
-  critical-db:
-    notification_channels:
-      - signal_oncall      # Primary: Mobile alert
-      - pushover_urgent    # Backup: Different mobile platform
-      - email_ops          # Tertiary: Email for record-keeping
+  webserver01:
+    owner: alice             # receives all notifications for this host
+    managers: [bob]          # also receives notifications
+    threshold_config: default
+    watch: true              # bold in dashboard (cosmetic only)
+    dyndns: false
+
+  dbserver01:
+    owner: alice
+    managers: [bob]
+    threshold_config: database
+    dyndns: false
 ```
 
-### Notification Fatigue Prevention
+`watch: true` only affects display (bold name in the live dashboard). Notifications are now controlled entirely by owner/managers.
 
-- **Use `watch: false`** for non-critical hosts
-- **Configure appropriate thresholds** to avoid false positives
-- **Set different channels for different severities**
-- **Use `default_notification_channels`** for baseline, add more for critical systems
+## Channel Types
 
-### Security
+### `min_level` filtering
 
-- **Protect credentials**: Use file permissions to protect config files with passwords/tokens
-- **Rotate tokens**: Periodically rotate API tokens and passwords
-- **Use app-specific passwords**: For email, use app-specific passwords instead of main account password
-- **Separate accounts**: Consider separate notification accounts for different environments (prod vs dev)
+Every channel accepts an optional `min_level` field:
 
-### Testing
+| Value | Channels receive |
+|---|---|
+| `WARNING` (default) | WARNING, CRITICAL, RECOVER |
+| `CRITICAL` | CRITICAL only (and RECOVER) |
 
-Test notification channels before relying on them:
+`RECOVER` is always passed through — you don't want to miss a recovery.
 
+### pushover
+
+Sends push notifications via [Pushover](https://pushover.net). Includes title, body, and a clickable URL.
+
+```yaml
+type: pushover
+token: your-app-token     # Required: Pushover application token
+user: your-user-key       # Required: Recipient's user key
+min_level: WARNING
+```
+
+### email
+
+Sends via SMTP. Subject = title, body = message + URL on final line.
+
+```yaml
+type: email
+recipients: [ops@example.com, oncall@example.com]
+sender: hbd@example.com
+smtp_server: smtp.example.com
+smtp_port: 587             # 587 = STARTTLS (default), 465 = SSL
+smtp_user: hbd@example.com
+smtp_password: secret
+min_level: WARNING
+```
+
+### matrix
+
+Sends a formatted HTML message to a Matrix room via [matrix-nio](https://github.com/poljar/matrix-nio).
+
+```yaml
+type: matrix
+homeserver: https://matrix.example.org
+access_token: syt_xxx      # Bot account access token
+room_id: "!abc:matrix.example.org"
+min_level: WARNING
+```
+
+**Setup:**
+1. Create a bot Matrix account
+2. Obtain its access token (Element → Settings → Help & About → Access Token)
+3. Invite the bot to the target room and note the room ID
+
+### sms_voipms
+
+Sends SMS via the [voip.ms REST API](https://voip.ms/api/v1/rest.php). Message is truncated to 160 characters.
+
+```yaml
+type: sms_voipms
+api_user: me@example.com   # voip.ms account email
+api_password: secret       # voip.ms API password
+did: "5551234567"          # Your voip.ms DID (sending number)
+dst: "5559876543"          # Destination number
+min_level: CRITICAL
+```
+
+### signal
+
+Sends via [signal-cli](https://github.com/AsamK/signal-cli).
+
+```yaml
+type: signal
+cli_path: /usr/local/bin/signal-cli
+user: +12025551234         # Your registered Signal number
+recipient: +12025559999    # Recipient number
+min_level: WARNING
+```
+
+**Setup:**
 ```bash
-# Test signal-cli directly
-signal-cli -u +1234567890 send -m "Test message" +0987654321
-
-# Test SMTP
-echo "Test" | mail -s "Test Subject" admin@example.com
-
-# Test through heartbeat system (Python REPL)
-from hbd.server import notify as notify_mod, config as config_mod
-cfg = config_mod.load_config(".hb.yaml")
-notify_mod.setup(cfg)
-notify_mod.pushmsg_for_host("test-host", "Test notification")
+signal-cli -u +12025551234 register
+signal-cli -u +12025551234 verify CODE
 ```
 
+### mattermost
+
+Sends via Mattermost incoming webhook. Message is formatted as Markdown.
+
+```yaml
+type: mattermost
+host: mattermost.example.com
+token: your-webhook-token
+channel: devops-alerts
+username: heartbeat-bot    # Optional: display name
+icon: https://…/icon.png   # Optional: bot icon URL
+min_level: WARNING
+```
+
+## Notification events
+
+| Source | Level | Title example | Body example |
+|---|---|---|---|
+| Host overdue | CRITICAL | `[CRITICAL] webserver01` | `IPv4 overdue` |
+| Host recover | RECOVER | `[RECOVER] webserver01` | `IPv4 back after being overdue for 5:23` |
+| Host boot | INFO | `[INFO] webserver01` | `webserver01 booted` |
+| Host shutdown | INFO | `[INFO] webserver01` | `IPv4 shutdown` |
+| Threshold breach | WARNING/CRITICAL | `[CRITICAL] webserver01` | `cpu_percent = 95.2 (threshold: > 90.0)` |
+| Threshold reminder | CRITICAL | `[REMINDER/CRITICAL] webserver01` | `REMINDER (CRITICAL): … ongoing for 3600s` |
+| Connection issue | WARNING | `[WARNING] webserver01` | `new address detected …` |
+
+Reminder notifications (re-notify) are sent only for CRITICAL level alerts.
+
+## API reference
+
+### `send_notification(host_name, notif) -> dict`
+
+Main entry point. Dispatches to owner + managers.
+
+```python
+from hbd.server.notify import send_notification, Notification
+
+send_notification(
+    "webserver01",
+    Notification(
+        title="[CRITICAL] webserver01",
+        body="cpu_percent = 95.2 (threshold: > 90.0)",
+        level="CRITICAL",
+        url="https://hbd.example.com/plugins#webserver01",
+    ),
+)
+```
+
+Returns `{channel_name: bool}` for each channel dispatched.
+
+### `setup(cfg, loop=None)`
+
+Called once at startup from `main.py`. Pass the running asyncio event loop so Matrix sends work correctly.
+
 ## Troubleshooting
 
-### Notifications Not Sending
+**No notifications sent:**
+- Check that users are configured (`users:` section in yaml)
+- Check that the host has an `owner` or `managers` set
+- Check that users have `notification_channels` listed
+- Check that the channel names in user config match keys under `notification_channels:`
 
-1. **Check logs**: Look for "Failed to send notification" errors
-2. **Verify host is watched**: Ensure `watch: true` in host definition
-3. **Check channel configuration**: Verify credentials and settings
-4. **Test channel directly**: Use command-line tools to test provider
-5. **Check network**: Ensure server can reach notification endpoints
+**min_level filtering too aggressive:**
+- Default is `WARNING` — both WARNING and CRITICAL are sent
+- Set `min_level: WARNING` explicitly if you were expecting warnings but set CRITICAL
 
-### Signal Issues
+**Matrix sends time out:**
+- Verify the access token is valid and the bot is in the room
+- `matrix-nio` must be installed: `pip install matrix-nio`
 
-- **signal-cli not found**: Specify full path in `cli_path`
-- **Not registered**: Run `signal-cli -u +NUMBER register` and verify
-- **Trust issues**: Run `signal-cli -u +NUMBER receive` to sync trust store
-- **Recipient not found**: Ensure recipient is in your Signal contacts
+**voip.ms SMS fails:**
+- Enable the API in your voip.ms account (Account → API)
+- Verify the DID is SMS-capable in your voip.ms account
 
-### Email Issues
+**Signal not found:**
+- Specify full `cli_path`
+- Run `signal-cli -u +NUMBER receive` to sync trust store
 
-- **Authentication failed**: Check SMTP username/password
-- **TLS errors**: Verify SMTP port (587 for STARTTLS, 465 for SSL)
-- **Relay denied**: Ensure SMTP server allows relay from your IP
-- **Timeout**: Check firewall rules for SMTP ports
+**Email authentication failed:**
+- Use app-specific passwords for Gmail/Fastmail
+- Verify port: 587 for STARTTLS, 465 for SSL
 
-### Pushover Issues
-
-- **Invalid token/user**: Verify token and user key from Pushover dashboard
-- **API rate limits**: Pushover has monthly message limits on free tier
-- **HTTP errors**: Check Pushover API status page
-
-### Mattermost Issues
-
-- **Webhook not found**: Verify webhook token and ensure webhook is enabled
-- **Channel not found**: Check channel name spelling and permissions
-- **Driver import error**: Install mattermostdriver: `pip install mattermostdriver`
-
-## API Reference
-
-### Main Functions
-
-#### `pushmsg_for_host(hostname: str, msg: str, debug: int = 0) -> dict`
-
-Send notification to host-specific channels.
-
-**Parameters:**
-- `hostname`: Name of the host (used to look up notification channels)
-- `msg`: Message to send
-- `debug`: Debug level (0=no debug, 1+=debug output)
-
-**Returns:** Dictionary of results per channel: `{"signal_ops": True, "email_ops": False}`
-
-**Example:**
-```python
-from hbd.server import notify as notify_mod
-
-notify_mod.pushmsg_for_host("prod-web-01", "Server CPU at 95%")
-```
-
-**Behavior:**
-1. Looks up notification channels configured for the host
-2. If no host-specific channels, uses `default_notification_channels`
-3. Dispatches to each channel in parallel
-4. Returns dict of results keyed by channel name
-5. Logs success/failure for each channel
-
-## Examples
-
-### Complete Configuration Example
-
-```yaml
-# Notification channel definitions
-notification_channels:
-  signal_oncall:
-    type: signal
-    cli_path: /usr/local/bin/signal-cli
-    user: +12025551234
-    recipient: +12025555678
-  
-  email_ops:
-    type: email
-    recipients: [ops@example.com, alerts@example.com]
-    sender: heartbeat@example.com
-    smtp_server: smtp.fastmail.com
-    smtp_port: 587
-    smtp_user: heartbeat@example.com
-    smtp_password: app-password-here
-
-# Default channels
-default_notification_channels: [email_ops]
-
-# Host definitions with channel assignments
-hosts:
-  prod-web-01:
-    threshold_config: high_sensitivity
-    watch: true
-    notification_channels: [signal_oncall, email_ops]
-    dyndns: false
-  
-  dev-server-01:
-    threshold_config: low_sensitivity
-    watch: false
-    notification_channels: [email_ops]
-    dyndns: false
-```
-
-### Multiple Environments Example
-
-```yaml
-notification_channels:
-  # Production channels
-  signal_prod_oncall:
-    type: signal
-    user: +12025551234
-    recipient: +12025551111  # On-call phone
-  
-  email_prod_ops:
-    type: email
-    recipients: [prod-ops@example.com]
-    sender: prod-heartbeat@example.com
-    smtp_server: smtp.example.com
-  
-  # Staging channels
-  email_staging:
-    type: email
-    recipients: [staging-alerts@example.com]
-    sender: staging-heartbeat@example.com
-    smtp_server: smtp.example.com
-  
-  # Development channels
-  mattermost_dev:
-    type: mattermost
-    host: chat.example.com
-    token: dev-webhook-token
-    channel: dev-alerts
-
-hosts:
-  prod-api-01:
-    notification_channels: [signal_prod_oncall, email_prod_ops]
-  
-  staging-api-01:
-    notification_channels: [email_staging]
-  
-  dev-api-01:
-    notification_channels: [mattermost_dev]
-```
+**Pushover `400` errors:**
+- Double-check `token` (app) and `user` (user key) — they are different values

docs/USERS.md

@@ -0,0 +1,242 @@
+# User Management
+
+Heartbeat supports optional user accounts with role-based access control per host. When no users are configured the server runs in **unauthenticated mode** — all existing behaviour is unchanged.
+
+---
+
+## Overview
+
+Users are defined in the server config file. Each host can have an **owner**, zero or more **managers**, and zero or more **monitors**. A **default owner** catches any host that does not name an explicit owner.
+
+### Roles
+
+| Role | Inherits | Permissions |
+|------|----------|-------------|
+| **monitor** | — | View host status, plugin data, alerts; acknowledge alerts they were notified for |
+| **manager** | monitor | + Queue commands (`/c`), trigger DNS re-registration (`/n`), queue upgrades (`/u`); add/remove monitors |
+| **owner** | manager | + Drop host (`/d`); add/remove managers; transfer ownership; update host access |
+| **admin** *(flag)* | owner on all hosts | Full access to every host and the user list |
+
+`admin` is a flag on the user, not a per-host role. An admin user has owner-level access on every host without being listed as owner/manager/monitor.
+
+---
+
+## Configuration
+
+### Defining users
+
+```yaml
+users:
+  andreas:
+    full_name: Andreas Wrede
+    avatar: /path/to/avatar.png   # file path, URL, or base64 data URI (optional)
+    password: pbkdf2:sha256:...   # generated with: hbd passwd andreas
+    admin: true                   # optional — grants server-wide owner access
+
+  bob:
+    full_name: Bob Smith
+    password: pbkdf2:sha256:...
+    notification_channels: [pushover_standard]
+
+  carol:
+    full_name: Carol Jones
+    password: pbkdf2:sha256:...
+
+default_owner: andreas            # owns hosts with no explicit owner
+                                  # falls back to the first admin user if omitted
+```
+
+### Assigning roles to hosts
+
+```yaml
+hosts:
+  webserver01:
+    owner: andreas
+    managers: [bob]
+    monitors: [carol]
+    threshold_config: default
+    watch: true
+    notification_channels: [pushover_standard]
+
+  unattended-host:              # no owner → owned by default_owner
+    threshold_config: default
+    watch: true
+```
+
+### Generating a password hash
+
+```bash
+hbd passwd andreas
+```
+
+Enter and confirm the password when prompted. Paste the printed hash into the config file under the user's `password` key.
+
+You can also generate a hash non-interactively from Python:
+
+```python
+from hbd.server.users import hash_password
+print(hash_password("mysecret"))
+```
+
+Passwords are stored as PBKDF2-HMAC-SHA256 hashes (260 000 iterations). No third-party libraries are required — only Python's standard `hashlib`.
+
+---
+
+## Authentication
+
+When at least one user is defined, every request must be authenticated. Unauthenticated requests to HTML pages are redirected to `/login`; unauthenticated API requests receive `401 Unauthorized`.
+
+### Browser login
+
+Navigate to any page — you will be redirected to `/login` automatically. After submitting valid credentials the server sets an `hbd_session` cookie (HttpOnly, SameSite=Lax, 24 h lifetime). All subsequent requests, including JavaScript `fetch()` calls on the dashboards, carry the cookie automatically.
+
+To log out, visit `/logout`.
+
+### API / programmatic login
+
+```bash
+# Log in and capture the token
+TOKEN=$(curl -s -X POST http://localhost:50004/api/0/auth/login \
+  -H 'Content-Type: application/json' \
+  -d '{"username":"andreas","password":"mysecret"}' | jq -r .token)
+
+# Use the token in subsequent requests
+curl -H "Authorization: Bearer $TOKEN" http://localhost:50004/api/0/hosts
+```
+
+The token is identical to the session cookie value — both mechanisms work simultaneously.
+
+```bash
+# Log out
+curl -s -X POST http://localhost:50004/api/0/auth/logout \
+  -H "Authorization: Bearer $TOKEN"
+```
+
+---
+
+## API Endpoints
+
+### Authentication
+
+#### POST /api/0/auth/login
+Obtain a session token.
+
+**Request body:**
+```json
+{ "username": "andreas", "password": "mysecret" }
+```
+
+**Response:**
+```json
+{ "token": "<opaque-hex-token>", "username": "andreas" }
+```
+Also sets the `hbd_session` cookie for browser clients.
+
+**Status codes:** `200 OK`, `401 Unauthorized`, `404` (auth not configured)
+
+---
+
+#### POST /api/0/auth/logout
+Invalidate the current session.
+
+**Headers:** `Authorization: Bearer <token>` or cookie
+
+**Response:** `{ "success": true }`
+
+---
+
+### Users
+
+#### GET /api/0/users
+List all users. **Admin only.**
+
+**Response:**
+```json
+[
+  { "username": "andreas", "full_name": "Andreas Wrede", "avatar": "", "admin": true, "notification_channels": [] },
+  { "username": "bob",     "full_name": "Bob Smith",     "avatar": "", "admin": false, "notification_channels": ["pushover_standard"] }
+]
+```
+
+---
+
+#### GET /api/0/users/me
+Return the currently authenticated user's profile.
+
+**Response:**
+```json
+{ "username": "carol", "full_name": "Carol Jones", "avatar": "", "admin": false, "notification_channels": [] }
+```
+
+---
+
+### Host Access
+
+#### GET /api/0/hosts/{hostname}/access
+Return owner/managers/monitors for a host. Requires at least **monitor** role.
+
+**Response:**
+```json
+{
+  "owner": "andreas",
+  "managers": ["bob"],
+  "monitors": ["carol"]
+}
+```
+
+---
+
+#### PUT /api/0/hosts/{hostname}/access
+Update owner/managers/monitors. Requires **owner** role or admin.
+
+**Request body** (all fields optional):
+```json
+{
+  "owner": "bob",
+  "managers": ["carol"],
+  "monitors": []
+}
+```
+
+Changes take effect immediately in memory. They are not written back to the config file — reload (`SIGHUP`) will re-apply config values. To make changes permanent, update the config file.
+
+---
+
+## Host visibility
+
+When users are configured, `GET /api/0/hosts` only returns hosts the authenticated user has at least monitor access to. Admins see all hosts.
+
+---
+
+## Config reload
+
+On `SIGHUP`, the server reloads the config file, re-loads the user registry, and re-applies `owner`/`managers`/`monitors` from config to all known hosts. Existing sessions remain valid after a reload.
+
+---
+
+## No-auth mode
+
+If `users:` is absent or empty, the server starts in **unauthenticated mode**:
+
+- No login required — all pages and API endpoints are accessible without credentials.
+- All permission checks pass unconditionally.
+- `/login`, `/logout`, and the auth/user API endpoints return `404`.
+
+This preserves full backwards compatibility with existing deployments.
+
+---
+
+## Security notes
+
+- Session tokens are 64-character cryptographically random hex strings (`secrets.token_hex(32)`).
+- Sessions expire after 24 hours (configurable via `users_mod.SESSION_TTL`).
+- Cookies are `HttpOnly` and `SameSite=Lax` — they are not accessible to JavaScript and are not sent on cross-site requests.
+- The HTTP API does not yet enforce TLS. For production use, place hbd behind a TLS-terminating reverse proxy (nginx, Caddy, etc.) or enable WSS.
+
+---
+
+## See Also
+
+- [HTTP API Documentation](HTTP_API.md)
+- [Notifications](NOTIFICATIONS.md)
+- Configuration example: `hbd/config_example.yaml`

hbd/Plan.md

@@ -1,9 +1,21 @@
-Plan
+Plan the following changes, ask questions to clarify before implementing
 
-Heartbeat is a client/server based network monitor and host observer.  hbd, the server portion receives heartbeat and state messages from clients and maintaines state and hisgtory of the informations it receives.
+Re-factor the notification system:
+- use available libraries for pushover, matrix, email and sms notifications.
+- notifications have a title/subject:  alert_type (recover/warning/critical), a body (info from threshold check) and a link to the host plugin metrix page
+- define a list of notification channels for each user
+- notifications are dispatched to users that are listed as managers for the host
 
-hbc, the client portion gathers information on various aspects of the
-system it is running on, and sends it to hbd. Initially this info is basic, like OS make and version, hardware info (CPU type, memory and disks), fileystem info and some resource info. hbc/hbd support a plugin system to extend the info gathered and stored.
 
-hbd also can send notification based on missed hbc updates, and on violation of pre-set limits for various state paramaters.
 
+1 - correct
+2 - for now channels are defined globaly 
+3 - matrix-nio)sounds good, homeserver URL, access token, room ID per channel?
+4 - use the REST api provided by https://voip.ms/api/v1/rest.php
+5 - The page does not exist yet, point at the host tab in the /plugins
+6 - per-channel minimum severity is a good idea, go fo it
+7 - yes
+
+1 - use base_url, there might not have been any incoming requests yet
+2 - use same asyncio loop for matrix-nio
+3 - for now, just silently do nothing

hbd/__init__.py

@@ -14,4 +14,4 @@ Install options:
 """
 
 __all__ = ["__version__"]
-__version__ = "5.0.10"
+__version__ = "5.1.1"

hbd/client/config.py

@@ -2,6 +2,9 @@
 
 import logging
 import os
+import logging
+
+logger = logging.getLogger(__name__)
 
 try:
     import yaml
@@ -30,18 +33,19 @@ def load_config(path=None):
     If YAML is not available or the file does not exist, defaults are returned.
     
     Args:
-        path: Path to YAML config file (default: ~/.hb.yaml)
+        path: Path to YAML config file (default: ~/.hbc.yaml)
         
     Returns:
         Dictionary with configuration
     """
     cfg = CLIENT_DEFAULTS.copy()
     if not path:
-        # default path (~/.hb.yaml)
-        path = os.path.join(os.path.expanduser("~"), ".hb.yaml")
+        # default path (~/.hbc.yaml)
+        path = os.path.join(os.path.expanduser("~"), ".hbc.yaml")
 
     if os.path.exists(path):
         if yaml:
+            logger.info("Loading configuration from %s", path)
             with open(path) as fh:
                 data = yaml.safe_load(fh)
             # Merge YAML data with defaults
@@ -50,5 +54,5 @@ def load_config(path=None):
                 cfg[k] = v
         else:
             # yaml not installed: do not attempt to parse; user must ensure defaults
-            pass
+            logger.warning("PyYAML not available - cannot load config from %s, using defaults", path)
     return cfg

hbd/client/main.py

@@ -644,13 +644,10 @@ def main(argv=None):
     parser = build_parser()
     args = parser.parse_args(argv)
     
-    # Load config
-    config = load_config(args.configfile)
-    
     # Setup logging
-    log_level = logging.INFO
+    log_level = logging.WARNING
     if args.verbose:
-        log_level = logging.DEBUG
+        log_level = logging.INFO
     if args.debug:
         log_level = logging.DEBUG
     
@@ -660,6 +657,9 @@ def main(argv=None):
         datefmt="%Y-%m-%d %H:%M:%S"
     )
 
+    # Load config
+    config = load_config(args.configfile)
+    
     # Daemonize if requested
     if args.daemon:
         print("Daemonizing...")

hbd/client/plugin.py

@@ -311,7 +311,10 @@ class PluginLoader:
             return 0
         
         loaded_count = 0
-        plugin_config = config or {}
+        raw_config = config or {}
+        # Per-plugin config lives under the 'plugins' key; fall back to top-level
+        # for backwards compatibility.
+        plugin_config = raw_config.get("plugins", raw_config)
         
         # Scan for Python files
         for plugin_file in directory.glob("*.py"):

hbd/client/plugins/nagios_runner.py

@@ -81,7 +81,7 @@ class NagiosRunnerPlugin(MonitorPlugin):
         
         # Validate commands
         if not self.commands:
-            self.logger.warning(
+            self.logger.info(
                 "No Nagios commands configured. Add 'nagios_runner.commands' to config."
             )
     
@@ -94,7 +94,7 @@ class NagiosRunnerPlugin(MonitorPlugin):
         self.logger.info(f"Initializing {self.name} plugin")
         
         if not self.commands:
-            self.logger.error("No Nagios commands configured")
+            self.logger.info("No Nagios commands configured")
             return False
         
         self.logger.info(f"Configured to run {len(self.commands)} Nagios plugin(s)")

hbd/client/plugins/os_info.py

@@ -48,6 +48,7 @@ class OSInfoPlugin(InfoPlugin):
             Dictionary with OS details
         """
         try:
+            from hbd import __version__ as hbc_version
             data = {
                 "system": platform.system(),  # e.g., "Linux", "Darwin", "Windows"
                 "node": platform.node(),  # hostname
@@ -58,6 +59,7 @@ class OSInfoPlugin(InfoPlugin):
                 "architecture": platform.architecture()[0],  # e.g., "64bit"
                 "python_version": platform.python_version(),
                 "python_implementation": platform.python_implementation(),
+                "hbc_version": hbc_version,
             }
             
             # Add Linux-specific distribution info

hbd/client/plugins/ping_monitor.py

@@ -0,0 +1,151 @@
+"""Ping Monitor Plugin for Heartbeat.
+
+Pings one or more hosts and reports round-trip time.  Results are sent as
+plugin metrics so the server-side threshold system can raise WARNING/CRITICAL
+alerts using the same RTT threshold configuration format used for heartbeat RTT.
+
+Example configuration in ~/.hbc.yaml (or the plugins section of ~/.hb.yaml):
+
+```yaml
+plugins:
+  ping_monitor:
+    interval: 60          # ping every 60 seconds (default)
+    count: 3              # ICMP packets per ping run (default 3)
+    timeout: 5            # seconds before a host is considered unreachable (default 5)
+    hosts:
+      8.8.8.8:
+        warning: 20.0     # ms
+        critical: 100.0   # ms
+      192.168.1.1:
+        warning: 5.0
+        critical: 20.0
+```
+
+Reported metrics per host (metric key uses the hostname with dots/colons replaced
+by underscores so it is a valid identifier):
+
+  ping.<hostname>.rtt_avg   – average RTT in ms  (float, or inf if unreachable)
+  ping.<hostname>.rtt_min   – minimum RTT in ms
+  ping.<hostname>.rtt_max   – maximum RTT in ms
+  ping.<hostname>.loss      – packet loss percentage (0–100)
+
+Server-side threshold config example:
+
+```yaml
+threshold_configs:
+  default:
+    thresholds:
+      ping_monitor:
+        8_8_8_8_rtt_avg:
+          warning: 20.0
+          critical: 100.0
+```
+"""
+
+import asyncio
+import re
+import sys
+from typing import Any, Dict, Optional
+
+from hbd.client.plugin import MonitorPlugin
+
+
+def _host_key(host: str) -> str:
+    """Convert a hostname/IP to a safe metric key (replace . and : with _)."""
+    return re.sub(r"[^a-zA-Z0-9_]", "_", host)
+
+
+class PingMonitorPlugin(MonitorPlugin):
+    """Ping one or more configured hosts and report RTT metrics."""
+
+    name = "ping_monitor"
+    version = "1.0.0"
+    description = "ICMP ping latency monitoring"
+    interval = 60
+
+    def __init__(self, config: Optional[Dict[str, Any]] = None):
+        super().__init__(config)
+        cfg = config or {}
+        self.interval = cfg.get("interval", 60)
+        self.count = int(cfg.get("count", 3))
+        self.timeout = int(cfg.get("timeout", 5))
+        # hosts: dict of {hostname: {warning: x, critical: y}} or list of hostnames
+        raw_hosts = cfg.get("hosts", {})
+        if isinstance(raw_hosts, list):
+            self.hosts = {h: {} for h in raw_hosts}
+        else:
+            self.hosts = dict(raw_hosts)
+
+    async def initialize(self) -> bool:
+        if not self.hosts:
+            self.logger.warning("ping_monitor: no hosts configured, plugin disabled")
+            return False
+        self.logger.info(
+            "ping_monitor initialized: %d host(s), interval=%ds, count=%d, timeout=%ds",
+            len(self.hosts), self.interval, self.count, self.timeout,
+        )
+        return True
+
+    async def _ping(self, host: str) -> Dict[str, float]:
+        """Run a system ping command and return rtt_min/avg/max/loss."""
+        if sys.platform == "win32":
+            cmd = ["ping", "-n", str(self.count), "-w", str(self.timeout * 1000), host]
+        else:
+            cmd = ["ping", "-c", str(self.count), "-W", str(self.timeout), host]
+
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                *cmd,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+            )
+            stdout, _ = await asyncio.wait_for(
+                proc.communicate(),
+                timeout=self.timeout * self.count + 2,
+            )
+            output = stdout.decode(errors="replace")
+        except (asyncio.TimeoutError, FileNotFoundError, OSError) as e:
+            self.logger.warning("ping_monitor: ping failed for %s: %s", host, e)
+            return {"rtt_min": float("inf"), "rtt_avg": float("inf"),
+                    "rtt_max": float("inf"), "loss": 100.0}
+
+        # Parse packet loss
+        loss = 100.0
+        loss_match = re.search(r"(\d+(?:\.\d+)?)\s*%\s*packet\s*loss", output)
+        if loss_match:
+            loss = float(loss_match.group(1))
+
+        # Parse rtt min/avg/max — Linux: "rtt min/avg/max/mdev = x/x/x/x ms"
+        #                          macOS: "round-trip min/avg/max/stddev = x/x/x/x ms"
+        rtt_match = re.search(
+            r"(?:rtt|round-trip)\s+min/avg/max/\S+\s*=\s*([\d.]+)/([\d.]+)/([\d.]+)",
+            output,
+        )
+        if rtt_match:
+            return {
+                "rtt_min": float(rtt_match.group(1)),
+                "rtt_avg": float(rtt_match.group(2)),
+                "rtt_max": float(rtt_match.group(3)),
+                "loss": loss,
+            }
+
+        # Host unreachable or all packets lost
+        return {"rtt_min": float("inf"), "rtt_avg": float("inf"),
+                "rtt_max": float("inf"), "loss": loss}
+
+    async def _collect_metrics(self) -> Dict[str, Any]:
+        data: Dict[str, Any] = {}
+        tasks = {host: asyncio.create_task(self._ping(host)) for host in self.hosts}
+        for host, task in tasks.items():
+            try:
+                result = await task
+            except Exception as e:
+                self.logger.error("ping_monitor: error pinging %s: %s", host, e)
+                result = {"rtt_min": float("inf"), "rtt_avg": float("inf"),
+                          "rtt_max": float("inf"), "loss": 100.0}
+            key = _host_key(host)
+            for metric, value in result.items():
+                data[f"{key}_{metric}"] = value
+            status = "unreachable" if result["loss"] == 100.0 else f"{result['rtt_avg']:.1f}ms"
+            self.logger.debug("ping_monitor: %s -> %s", host, status)
+        return data

hbd/server/cli.py

@@ -1,6 +1,8 @@
 """Command line interface for hbd package."""
 
 import argparse
+import getpass
+import sys
 
 from .config import load_config
 from .main import run as run_server
@@ -14,26 +16,273 @@ def build_parser():
         description="HeartBeatDaemon - Wait for heartbeat messages and act on them (or their absence)",
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
-    parser.add_argument(
-        "-c", "--config", dest="configfile", help="Config file path (YAML)"
-    )
-    parser.add_argument(
-        "-f", "--foreground", action="store_true", help="Run in foreground"
-    )
+
+    subparsers = parser.add_subparsers(dest="command")
+
+    # --- serve (default) ---
+    serve_p = subparsers.add_parser("serve", help="Start the hbd server (default)")
+    serve_p.add_argument("-c", "--config", dest="configfile", help="Config file path (YAML)")
+    serve_p.add_argument("-f", "--foreground", action="store_true", help="Run in foreground")
+    serve_p.add_argument("-v", "--verbose", action="store_true", help="Verbose output")
+    serve_p.add_argument("-p", "--pushsrv", dest="pushsrv", choices=PUSHSRVS,
+                         help="Push service to use")
+    serve_p.add_argument("-x", "--debug", action="count", default=0, help="Increase debug level")
+
+    # Legacy top-level flags (no subcommand) — kept for backward compatibility
+    parser.add_argument("-c", "--config", dest="configfile", help="Config file path (YAML)")
+    parser.add_argument("-f", "--foreground", action="store_true", help="Run in foreground")
     parser.add_argument("-v", "--verbose", action="store_true", help="Verbose output")
-    parser.add_argument(
-        "-p", "--pushsrv", dest="pushsrv", choices=PUSHSRVS, help="Push service to use"
+    parser.add_argument("-p", "--pushsrv", dest="pushsrv", choices=PUSHSRVS,
+                        help="Push service to use")
+    parser.add_argument("-x", "--debug", action="count", default=0, help="Increase debug level")
+
+    # --- passwd ---
+    passwd_p = subparsers.add_parser(
+        "passwd",
+        help="Generate a password hash for use in the config file",
     )
-    parser.add_argument(
-        "-x", "--debug", action="count", default=0, help="Increase debug level"
+    passwd_p.add_argument(
+        "username",
+        nargs="?",
+        help="Username (informational only, for display)",
     )
+
+    # --- notify ---
+    notify_p = subparsers.add_parser(
+        "notify",
+        help="Send a test message via a configured notification channel",
+    )
+    notify_p.add_argument("-c", "--config", dest="configfile", help="Config file path (YAML)")
+    notify_p.add_argument(
+        "channel",
+        help="Channel name as defined in notification_channels",
+    )
+    notify_p.add_argument(
+        "message",
+        nargs="?",
+        default="Test notification from hbd",
+        help="Message body (default: 'Test notification from hbd')",
+    )
+    notify_p.add_argument(
+        "--level",
+        default="WARNING",
+        choices=["INFO", "WARNING", "CRITICAL", "RECOVER"],
+        help="Notification level (default: WARNING)",
+    )
+    notify_p.add_argument(
+        "--title",
+        default=None,
+        help="Notification title (default: '[LEVEL] test')",
+    )
+
+    # --- stop ---
+    stop_p = subparsers.add_parser("stop", help="Stop the running hbd instance")
+    stop_p.add_argument("-c", "--config", dest="configfile", help="Config file path (YAML)")
+
+    # --- reload ---
+    reload_p = subparsers.add_parser("reload", help="Reload configuration (SIGHUP)")
+    reload_p.add_argument("-c", "--config", dest="configfile", help="Config file path (YAML)")
+
+    # --- restart ---
+    restart_p = subparsers.add_parser("restart", help="Restart the running hbd instance")
+    restart_p.add_argument("-c", "--config", dest="configfile", help="Config file path (YAML)")
+    restart_p.add_argument("-f", "--foreground", action="store_true", help="Run in foreground after restart")
+    restart_p.add_argument("-v", "--verbose", action="store_true", help="Verbose output after restart")
+
     return parser
 
 
+def cmd_passwd(args):
+    """Interactive password hash generator."""
+    from .users import hash_password
+
+    username = args.username or ""
+    prompt = f"New password for {username}: " if username else "New password: "
+    while True:
+        pw = getpass.getpass(prompt)
+        if not pw:
+            print("Password must not be empty.", file=sys.stderr)
+            continue
+        pw2 = getpass.getpass("Confirm password: ")
+        if pw != pw2:
+            print("Passwords do not match, try again.", file=sys.stderr)
+            continue
+        break
+
+    hashed = hash_password(pw)
+    if username:
+        print(f"\nAdd the following to your config under users: -> {username}:")
+    else:
+        print("\nPassword hash (paste into config file under the user's 'password' key):")
+    print(f"  password: {hashed}")
+
+
+def cmd_notify(args):
+    """Send a test message via a single notification channel."""
+    from .config import load_config
+    from .notify import Notification, _dispatch_to_channel, setup
+
+    config = load_config(args.configfile)
+    setup(config)
+
+    channels = config.get("notification_channels", {})
+    if args.channel not in channels:
+        available = ", ".join(channels.keys()) if channels else "(none)"
+        print(f"Error: channel '{args.channel}' not found in notification_channels.", file=sys.stderr)
+        print(f"Available channels: {available}", file=sys.stderr)
+        sys.exit(1)
+
+    channel_cfg = channels[args.channel]
+    level = args.level.upper()
+    title = args.title or f"[{level}] test"
+    base_url = config.get("base_url", "").rstrip("/")
+
+    notif = Notification(
+        title=title,
+        body=args.message,
+        level=level,
+        url=f"{base_url}/plugins" if base_url else "",
+    )
+
+    # Bypass min_level for explicit test sends; run async channels directly
+    import asyncio
+    ch_type = channel_cfg.get("type", "")
+    print(f"Sending via {args.channel} ({ch_type}): {title} — {args.message}")
+
+    if ch_type in ("matrix", "sms_voipms"):
+        from .notify import _send_matrix_async, _send_sms_voipms_async
+        driver_async = _send_matrix_async if ch_type == "matrix" else _send_sms_voipms_async
+        ok = asyncio.run(driver_async(channel_cfg, notif))
+    else:
+        from .notify import _DRIVERS
+        driver = _DRIVERS.get(ch_type)
+        if driver is None:
+            print(f"Error: unknown channel type '{ch_type}'", file=sys.stderr)
+            sys.exit(1)
+        ok = driver(channel_cfg, notif)
+
+    if ok:
+        print("OK")
+    else:
+        print("FAILED — check logs for details", file=sys.stderr)
+        sys.exit(1)
+
+
+def _read_pid(configfile) -> int | None:
+    """Return the PID from the pidfile, or None if not found / not running."""
+    import os
+    config = load_config(configfile)
+    pidfile = config.get("pidfile", "")
+    if not pidfile:
+        print("Error: no pidfile configured.", file=sys.stderr)
+        return None
+    try:
+        with open(pidfile) as f:
+            pid = int(f.read().strip())
+        # Verify process is actually running
+        os.kill(pid, 0)
+        return pid
+    except FileNotFoundError:
+        print(f"PID file not found ({pidfile}). Is hbd running?", file=sys.stderr)
+        return None
+    except ProcessLookupError:
+        print(f"PID file exists but process {pid} is not running.", file=sys.stderr)
+        return None
+    except Exception as e:
+        print(f"Error reading pidfile: {e}", file=sys.stderr)
+        return None
+
+
+def cmd_stop(args):
+    import os, signal as _signal, time
+    pid = _read_pid(args.configfile)
+    if pid is None:
+        sys.exit(1)
+    print(f"Stopping hbd (pid {pid})...")
+    os.kill(pid, _signal.SIGTERM)
+    # Wait up to 10 s for the process to exit
+    for _ in range(20):
+        time.sleep(0.5)
+        try:
+            os.kill(pid, 0)
+        except ProcessLookupError:
+            print("hbd stopped.")
+            return
+    print("Warning: hbd did not stop within 10 seconds.", file=sys.stderr)
+    sys.exit(1)
+
+
+def cmd_reload(args):
+    import os, signal as _signal
+    pid = _read_pid(args.configfile)
+    if pid is None:
+        sys.exit(1)
+    print(f"Sending SIGHUP to hbd (pid {pid})...")
+    os.kill(pid, _signal.SIGHUP)
+    print("Reload signal sent.")
+
+
+def cmd_restart(args):
+    import os, signal as _signal, time, subprocess
+    pid = _read_pid(args.configfile)
+    if pid is not None:
+        print(f"Stopping hbd (pid {pid})...")
+        os.kill(pid, _signal.SIGTERM)
+        for _ in range(20):
+            time.sleep(0.5)
+            try:
+                os.kill(pid, 0)
+            except ProcessLookupError:
+                print("hbd stopped.")
+                break
+        else:
+            print("Warning: hbd did not stop within 10 seconds.", file=sys.stderr)
+            sys.exit(1)
+    else:
+        print("hbd does not appear to be running — starting fresh.")
+
+    # Re-launch hbd with the same config
+    cmd = [sys.executable, "-m", "hbd.server.cli", "serve"]
+    if args.configfile:
+        cmd += ["-c", args.configfile]
+    if getattr(args, "foreground", False):
+        cmd += ["-f"]
+    if getattr(args, "verbose", False):
+        cmd += ["-v"]
+
+    if getattr(args, "foreground", False):
+        # Run in foreground — replace current process
+        os.execv(sys.executable, cmd)
+    else:
+        subprocess.Popen(cmd, start_new_session=True)
+        print("hbd restarted.")
+
+
 def main(argv=None):
     parser = build_parser()
     args = parser.parse_args(argv)
 
+    if args.command == "passwd":
+        cmd_passwd(args)
+        return
+
+    if args.command == "notify":
+        cmd_notify(args)
+        return
+
+    if args.command == "stop":
+        cmd_stop(args)
+        return
+
+    if args.command == "reload":
+        cmd_reload(args)
+        return
+
+    if args.command == "restart":
+        cmd_restart(args)
+        return
+
+    # Default: run the server (supports both `hbd serve ...` and `hbd ...`)
     config = load_config(args.configfile)
 
     # Apply CLI overrides

hbd/server/config.py

@@ -16,24 +16,26 @@ SERVER_DEFAULTS = {
     "hbd_host": "",             # Bind address (empty = all interfaces)
 
     # Persistence
-    "pickfile": "/tmp/hb.pick",
+    "pickfile": os.path.join(os.path.expanduser("~"), ".hb.pick"),  # File to store host state between restarts
+    "pidfile": os.path.join(os.path.expanduser("~"), ".hb.pid"),    # PID file for stop/restart/reload
 
     # Logging
-    "logfile": "/var/log/heartbeat.log",
-    "logfmt": "text",           # text or msg or json
-    
+    "logfile": os.path.join(os.path.expanduser("~"), ".hb.log"),
     # Notification channels
     "notification_channels": {},  # Named channels with type and credentials
-    "default_notification_channels": [],  # Default channels if host doesn't specify
+    "base_url": "",               # Base URL for notification links (e.g. https://hbd.example.com)
 
     # Monitoring settings
     "interval": 20,             # Expected heartbeat interval (for server checks)
     "grace": 2,                 # Grace multiplier (interval * grace = timeout)
     "threshold_renotify_interval": 3600,  # Seconds between threshold re-notifications
 
+    # User management
+    "users": {},                # username -> {full_name, avatar, password, admin, notification_channels}
+    "default_owner": None,      # Username that owns hosts with no explicit owner
+
     # Host management
-    "hosts": {},                # New unified host definitions (optional)
-    "watchhosts": [],           # Hosts to monitor and notify about (legacy)
+    "hosts": {},                # Unified host definitions
     "dyndnshosts": [],          # Hosts with dynamic DNS (legacy)
     "drophosts": [],            # Hosts to ignore
     "dyndomains": ["wrede.org"],
@@ -65,6 +67,38 @@ SERVER_DEFAULTS = {
     "thresholds": {},
 }
 
+THRESHOLD_DEFAULTS = {
+    'thresholds': {
+        'cpu_monitor': {
+            'cpu_percent': {
+                'warning': 80.0, 
+                'critical': 90.0
+                }
+            },
+            'memory_monitor': {
+                'percent': {
+                    'warning': 85.0,
+                    'critical': 95.0
+                }
+            },
+            'disk_monitor': {
+                'partitions': {
+                    '/': {
+                        'percent': {
+                            'warning': 85.0,
+                            'critical': 90.0
+                        }
+                    }
+                }
+            },
+            'rtt': {
+                'warning': 200,
+                'critical': 250.0,
+                'count': 3  # Optional: number of consecutive breaches before alerting
+            }
+        }
+    }
+
 
 def load_config(path=None):
     """Load configuration from a YAML file and merge with server defaults.
@@ -182,34 +216,18 @@ class ReloadableConfig:
 
 
 def get_watchhosts(config):
-    """Extract watchhosts from config, supporting both new and legacy formats.
-    
-    Args:
-        config: Configuration dictionary
+    """Extract watched hostnames from config (hosts with watch: true).
 
     Returns:
         List of hostnames to watch
     """
     watchhosts = []
-    
-    # New format: hosts section with watch attribute
-    if "hosts" in config:
-        hosts_config = config["hosts"]
-        if isinstance(hosts_config, dict):
-            for host_name, host_attrs in hosts_config.items():
-                if isinstance(host_attrs, dict) and host_attrs.get("watch", False):
-                    watchhosts.append(host_name)
-    
-    # Legacy format: watchhosts list
-    if "watchhosts" in config:
-        legacy_watchhosts = config.get("watchhosts", [])
-        if isinstance(legacy_watchhosts, (list, set)):
-            watchhosts.extend(legacy_watchhosts)
-        elif isinstance(legacy_watchhosts, dict):
-            # Old dict format: {"host1": {attrs}, "host2": {attrs}}
-            watchhosts.extend(legacy_watchhosts.keys())
-    
-    return list(set(watchhosts))  # Remove duplicates
+    hosts_config = config.get("hosts", {})
+    if isinstance(hosts_config, dict):
+        for host_name, host_attrs in hosts_config.items():
+            if isinstance(host_attrs, dict) and host_attrs.get("watch", False):
+                watchhosts.append(host_name)
+    return watchhosts
 
 
 def get_dyndnshosts(config):
@@ -241,100 +259,62 @@ def get_dyndnshosts(config):
 
 
 def get_host_config(config, hostname):
-    """Get configuration for a specific host.
-    
-    Args:
-        config: Configuration dictionary
-        hostname: Host name
+    """Get configuration for a specific host from the hosts section.
 
     Returns:
         Dictionary with host attributes or empty dict
     """
-    if "hosts" in config:
-        hosts_config = config.get("hosts", {})
-        if isinstance(hosts_config, dict) and hostname in hosts_config:
-            return hosts_config[hostname] if isinstance(hosts_config[hostname], dict) else {}
-    
-    # Check legacy watchhosts for notification settings
-    if "watchhosts" in config:
-        watchhosts = config.get("watchhosts", {})
-        if isinstance(watchhosts, dict) and hostname in watchhosts:
-            legacy_attrs = watchhosts[hostname]
-            if isinstance(legacy_attrs, dict):
-                # Convert legacy format to new format
-                return {
-                    "watch": True,
-                    "notify": legacy_attrs.get("notify"),
-                    "notify_src": legacy_attrs.get("src"),
-                }
-    
+    hosts_config = config.get("hosts", {})
+    if isinstance(hosts_config, dict) and hostname in hosts_config:
+        val = hosts_config[hostname]
+        return val if isinstance(val, dict) else {}
     return {}
 
 
-def get_notification_channels_for_host(config, hostname):
-    """Get notification channels configured for a specific host.
+# ---------------------------------------------------------------------------
+# User / host-access helpers
+# ---------------------------------------------------------------------------
 
-    Args:
-        config: Configuration dictionary
-        hostname: Host name
-        
-    Returns:
-        List of channel names to use for this host
-    """
-    host_config = get_host_config(config, hostname)
-    
-    # Check if host specifies notification channels
-    channels = host_config.get("notification_channels", [])
-    if channels:
-        if isinstance(channels, str):
-            return [channels]
-        elif isinstance(channels, list):
-            return channels
-    
-    # Fall back to default channels
-    default_channels = config.get("default_notification_channels", [])
-    if default_channels:
-        if isinstance(default_channels, str):
-            return [default_channels]
-        elif isinstance(default_channels, list):
-            return default_channels
-    
-    # No channels configured, return empty list (will use legacy global config)
-    return []
-
-
-def get_channel_config(config, channel_name):
-    """Get configuration for a specific notification channel.
-    
-    Args:
-        config: Configuration dictionary
-        channel_name: Name of the notification channel
-        
-    Returns:
-        Dictionary with channel configuration or None if not found
-    """
-    channels = config.get("notification_channels", {})
-    if isinstance(channels, dict) and channel_name in channels:
-        return channels[channel_name]
+def get_default_owner(config) -> str | None:
+    """Return the configured default_owner username, or the first admin user, or None."""
+    explicit = config.get("default_owner")
+    if explicit:
+        return explicit
+    # Fall back to first admin user found in config
+    users_cfg = config.get("users", {})
+    if isinstance(users_cfg, dict):
+        for username, attrs in users_cfg.items():
+            if isinstance(attrs, dict) and attrs.get("admin", False):
+                return username
     return None
 
 
-def get_notification_channels_config(config, hostname):
-    """Get list of notification channel configurations for a host.
+def get_host_access(config, hostname) -> dict:
+    """Return the access dict for *hostname*: owner, managers, monitors.
 
-    Args:
-        config: Configuration dictionary
-        hostname: Host name
+    Falls back to default_owner for hosts without an explicit owner.
 
     Returns:
-        List of (channel_name, channel_config) tuples
+        {
+            "owner": str | None,
+            "managers": list[str],
+            "monitors": list[str],
+        }
     """
-    channel_names = get_notification_channels_for_host(config, hostname)
+    host_cfg = get_host_config(config, hostname)
 
-    channels = []
-    for channel_name in channel_names:
-        channel_config = get_channel_config(config, channel_name)
-        if channel_config and channel_config.get("type"):
-            channels.append((channel_name, channel_config))
+    owner = host_cfg.get("owner") or get_default_owner(config)
 
-    return channels
+    managers = host_cfg.get("managers", [])
+    if isinstance(managers, str):
+        managers = [managers]
+
+    monitors = host_cfg.get("monitors", [])
+    if isinstance(monitors, str):
+        monitors = [monitors]
+
+    return {
+        "owner": owner,
+        "managers": list(managers),
+        "monitors": list(monitors),
+    }

hbd/server/hbdclass.py

@@ -297,6 +297,10 @@ class Host:
         self.plugin_retention = 100  # Keep last N samples per plugin
         # Alert state tracking: {metric_path: AlertState}
         self.alert_states = {}
+        # User access control
+        self.owner: str | None = None       # username of owner
+        self.managers: list = []            # usernames with manager role
+        self.monitors: list = []            # usernames with monitor role
 
     def statedict(self):
         d = {}
@@ -413,6 +417,19 @@ class Host:
         ddict["alert_critical_unacked"] = critical_unacked
         ddict["alert_critical_acked"] = critical_acked
 
+        # User access
+        ddict["owner"] = getattr(self, "owner", None)
+        ddict["managers"] = list(getattr(self, "managers", []))
+        ddict["monitors"] = list(getattr(self, "monitors", []))
+
+        # hbc version from latest os_info plugin data
+        hbc_version = None
+        latest_os = self.get_latest_plugin_data("os_info")
+        if latest_os:
+            _, os_data = latest_os
+            hbc_version = os_data.get("hbc_version")
+        ddict["hbc_version"] = hbc_version
+
         return ddict
 
     def jsons(self):
@@ -458,6 +475,13 @@ class Host:
             self.plugin_retention = 100
         if not hasattr(self, "alert_states"):
             self.alert_states = {}
+        # User access fields (added in user-management feature)
+        if not hasattr(self, "owner"):
+            self.owner = None
+        if not hasattr(self, "managers"):
+            self.managers = []
+        if not hasattr(self, "monitors"):
+            self.monitors = []
 
         pass
 
@@ -517,6 +541,32 @@ class Host:
         """
         return self.plugin_data
 
+    # ------------------------------------------------------------------
+    # User-role helpers
+    # ------------------------------------------------------------------
+
+    def apply_access(self, owner, managers, monitors):
+        """Set owner/managers/monitors on this host (called from config load)."""
+        self.owner = owner
+        self.managers = list(managers)
+        self.monitors = list(monitors)
+
+    def is_owner(self, username: str) -> bool:
+        return self.owner == username
+
+    def is_manager(self, username: str) -> bool:
+        return username in self.managers or self.is_owner(username)
+
+    def is_monitor(self, username: str) -> bool:
+        return username in self.monitors or self.is_manager(username)
+
+    def access_dict(self) -> dict:
+        return {
+            "owner": self.owner,
+            "managers": list(self.managers),
+            "monitors": list(self.monitors),
+        }
+
     hostfields_long = [
         "name",
         "IPv4.addr",

hbd/server/http.py

@@ -10,6 +10,9 @@ from aiohttp import web
 import jinja2
 from . import data
 from . import notify as notify_mod
+from . import settings as settings_mod
+from . import users as users_mod
+from . import ws as ws_mod
 
 logger = logging.getLogger(__name__)
 
@@ -20,6 +23,78 @@ def _render_template(html_str: str, **context) -> str:
     return tmpl.render(**context)
 
 
+# ---------------------------------------------------------------------------
+# Auth helpers
+# ---------------------------------------------------------------------------
+
+SESSION_COOKIE = "hbd_session"
+
+
+def _get_token(request) -> str:
+    """Extract session token from Bearer header, X-Auth-Token header, or cookie."""
+    auth = request.headers.get("Authorization", "")
+    if auth.lower().startswith("bearer "):
+        return auth[7:].strip()
+    header_token = request.headers.get("X-Auth-Token", "").strip()
+    if header_token:
+        return header_token
+    return request.cookies.get(SESSION_COOKIE, "")
+
+
+def _current_user(request):
+    """Return the authenticated User, or None when auth is not enabled."""
+    if not users_mod.users_enabled():
+        return None  # unauthenticated mode — all access allowed
+    return users_mod.get_session_user(_get_token(request))
+
+
+def _require_auth(request):
+    """Return (user, None) or (None, error Response)."""
+    if not users_mod.users_enabled():
+        return None, None
+    user = users_mod.get_session_user(_get_token(request))
+    if user is None:
+        return None, web.json_response({"error": "Unauthorized"}, status=401)
+    return user, None
+
+
+def _require_auth_redirect(request):
+    """Like _require_auth but returns a redirect to /login for browser requests."""
+    if not users_mod.users_enabled():
+        return None, None
+    user = users_mod.get_session_user(_get_token(request))
+    if user is None:
+        raise web.HTTPFound("/login")
+    return user, None
+
+
+def _can_view_host(user, host) -> bool:
+    """Return True if *user* may see *host* (monitor or higher, or no auth)."""
+    if user is None:
+        return True
+    if user.admin:
+        return True
+    return host.is_monitor(user.username)
+
+
+def _can_operate_host(user, host) -> bool:
+    """Manager-level: queue commands, DNS, upgrade."""
+    if user is None:
+        return True
+    if user.admin:
+        return True
+    return host.is_manager(user.username)
+
+
+def _can_own_host(user, host) -> bool:
+    """Owner-level: drop host, transfer ownership."""
+    if user is None:
+        return True
+    if user.admin:
+        return True
+    return host.is_owner(user.username)
+
+
 async def start(
     host: str,
     port: int,
@@ -37,7 +112,8 @@ async def start(
     """
     get_now = get_now or (lambda: time.time())
 
-    async def index(request):
+    async def old_index(request):
+        _require_auth_redirect(request)
         res = []
         res.append('<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">')
         res.append("<html>")
@@ -62,7 +138,15 @@ async def start(
         return web.Response(text=body, content_type="text/html")
 
     async def api_hosts(request):
-        lst = [hbdclass.Host.hosts[h].jsons() for h in hbdclass.Host.hosts]
+        user, err = _require_auth(request)
+        if err:
+            return err
+        hosts = [
+            hbdclass.Host.hosts[h]
+            for h in hbdclass.Host.hosts
+            if _can_view_host(user, hbdclass.Host.hosts[h])
+        ]
+        lst = [h.jsons() for h in hosts]
         return web.json_response(json.loads("[" + ",".join(lst) + "]"))
 
     async def api_messages(request):
@@ -70,6 +154,9 @@ async def start(
         return web.json_response(lst)
 
     async def cmd(request):
+        user, err = _require_auth(request)
+        if err:
+            return err
         qa = request.rel_url.query
         uname = qa.get("h")
         ucmd = qa.get("c")
@@ -77,34 +164,50 @@ async def start(
             return web.Response(status=400, text="need h= and c= arguments")
         if uname not in hbdclass.Host.hosts:
             return web.Response(status=400, text=f"h={uname} not found")
-        hbdclass.Host.hosts[uname].cmds.append(
-            ("CMD", {"cmd": urllib.parse.unquote(ucmd)})
-        )
+        host = hbdclass.Host.hosts[uname]
+        if not _can_operate_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
+        host.cmds.append(("CMD", {"cmd": urllib.parse.unquote(ucmd)}))
         return web.Response(text=f"cmd {uname} queued")
 
     async def drop(request):
+        user, err = _require_auth(request)
+        if err:
+            return err
         qa = request.rel_url.query
         uname = qa.get("h")
         if not uname:
             return web.Response(status=400, text="need h= argument")
         if uname not in hbdclass.Host.hosts:
             return web.Response(status=400, text=f"h={uname} not found")
+        host = hbdclass.Host.hosts[uname]
+        if not _can_own_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
         eventlog(uname, "INFO", "dropped")
         del hbdclass.Host.hosts[uname]
         return web.Response(text="Done")
 
     async def register(request):
+        user, err = _require_auth(request)
+        if err:
+            return err
         qa = request.rel_url.query
         uname = qa.get("h")
         if not uname:
             return web.Response(status=400, text="need h= argument")
         if uname not in hbdclass.Host.hosts:
             return web.Response(status=400, text=f"h={uname} not found")
-        ll = hbdclass.Host.hosts[uname].registerDns()
+        host = hbdclass.Host.hosts[uname]
+        if not _can_operate_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
+        ll = host.registerDns()
         eventlog(uname, "INFO", ll)
         return web.Response(text=str(ll))
 
     async def update(request):
+        user, err = _require_auth(request)
+        if err:
+            return err
         qa = request.rel_url.query
         uname = urllib.parse.unquote(qa.get("h", ""))
         ucode = qa.get("c")
@@ -118,16 +221,21 @@ async def start(
             names = [n for n in hbdclass.Host.hosts]
         out = []
         for n in names:
-            err = None
+            host = hbdclass.Host.hosts[n]
+            if not _can_operate_host(user, host):
+                out.append(f"update skipped for {n}: Forbidden")
+                continue
+            op_err = None
             try:
                 r = {"csum": None, "code": ucode}
-                hbdclass.Host.hosts[n].cmds.append(("UPD", r))
+                host.cmds.append(("UPD", r))
             except Exception as e:
-                err = str(e)
-            out.append(f"update started for {n}: {err if err else 'OK'}")
+                op_err = str(e)
+            out.append(f"update started for {n}: {op_err if op_err else 'OK'}")
         return web.Response(text="\n".join(out))
 
     async def live(request):
+        current_user, _ = _require_auth_redirect(request)
         # render template from hbd/templates/live.html using Jinja2
         # Resolve templates directory relative to the hbd package
         pkg_dir = os.path.dirname(__file__)
@@ -135,11 +243,12 @@ async def start(
         env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_dir))
         host = config.get("hb_host", "localhost")
         extra_scripts = config.get("http_extra_scripts", "")
-        host = request.host.split(":")[0]
-        if config.get("wss_port"):
-            heartbeat_ws_url = f"wss://{host}:{config['wss_port']}/hbd"
-        else:
-            heartbeat_ws_url = f"ws://{host}:{config.get('ws_port', 50005)}/hbd"
+        host = request.host  # includes port if non-standard
+        forwarded_proto = request.headers.get("X-Forwarded-Proto", "")
+        is_secure = request.secure or forwarded_proto.lower() == "https"
+        scheme = "wss" if is_secure else "ws"
+        heartbeat_ws_url = f"{scheme}://{host}/ws"
+        from hbd import __version__ as hbd_version
         tmpl = env.get_template("live.html")
         body = tmpl.render(
             title="Heartbeat",
@@ -147,10 +256,13 @@ async def start(
             request=request,
             heartbeat_ws_url=heartbeat_ws_url,
             extra_scripts=extra_scripts,
+            hbd_version=hbd_version,
             hosts=[
                 hbdclass.Host.hosts[h].stateinfo() for h in sorted(hbdclass.Host.hosts)
             ],
             messages=data.msgs[-30:],
+            current_user=current_user.to_dict() if current_user else None,
+            active_page="live",
         )
         return web.Response(text=body, content_type="text/html")
 
@@ -185,15 +297,17 @@ async def start(
 
     async def api_host_plugins(request):
         """Get all plugin data for a specific host."""
+        user, err = _require_auth(request)
+        if err:
+            return err
         hostname = request.match_info.get("hostname")
         
         if hostname not in hbdclass.Host.hosts:
-            return web.json_response(
-                {"error": f"Host '{hostname}' not found"},
-                status=404
-            )
+            return web.json_response({"error": f"Host '{hostname}' not found"}, status=404)
 
         host = hbdclass.Host.hosts[hostname]
+        if not _can_view_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
 
         # Get plugin data with most recent sample for each plugin
         plugins_summary = {}
@@ -214,16 +328,18 @@ async def start(
 
     async def api_host_plugin_detail(request):
         """Get detailed data for a specific plugin on a host."""
+        user, err = _require_auth(request)
+        if err:
+            return err
         hostname = request.match_info.get("hostname")
         plugin_name = request.match_info.get("plugin_name")
 
         if hostname not in hbdclass.Host.hosts:
-            return web.json_response(
-                {"error": f"Host '{hostname}' not found"},
-                status=404
-            )
+            return web.json_response({"error": f"Host '{hostname}' not found"}, status=404)
 
         host = hbdclass.Host.hosts[hostname]
+        if not _can_view_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
         
         # Get limit from query parameter
         limit = request.rel_url.query.get("limit", "10")
@@ -259,15 +375,17 @@ async def start(
 
     async def api_host_alerts(request):
         """Get alert states for a specific host."""
+        user, err = _require_auth(request)
+        if err:
+            return err
         hostname = request.match_info.get("hostname")
 
         if hostname not in hbdclass.Host.hosts:
-            return web.json_response(
-                {"error": f"Host '{hostname}' not found"},
-                status=404
-            )
+            return web.json_response({"error": f"Host '{hostname}' not found"}, status=404)
 
         host = hbdclass.Host.hosts[hostname]
+        if not _can_view_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
         
         # Get alert states
         alerts = []
@@ -287,9 +405,14 @@ async def start(
 
     async def api_all_alerts(request):
         """Get all active alerts across all hosts."""
+        user, err = _require_auth(request)
+        if err:
+            return err
         all_alerts = []
 
         for hostname, host in hbdclass.Host.hosts.items():
+            if not _can_view_host(user, host):
+                continue
             if threshold_checker:
                 active_alerts = threshold_checker.get_active_alerts(host.alert_states)
             else:
@@ -326,6 +449,9 @@ async def start(
     
     async def api_acknowledge_alert(request):
         """Acknowledge an alert to stop reminder notifications."""
+        user, err = _require_auth(request)
+        if err:
+            return err
         try:
             data = await request.json()
         except Exception:
@@ -350,6 +476,8 @@ async def start(
             )
         
         host = hbdclass.Host.hosts[hostname]
+        if not _can_view_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
 
         if metric_path not in host.alert_states:
             return web.json_response(
@@ -373,14 +501,17 @@ async def start(
 
     async def plugins_page(request):
         """Render the plugin metrics visualization page."""
+        current_user, _ = _require_auth_redirect(request)
         pkg_dir = os.path.dirname(__file__)
         templates_dir = config.get("templates_dir", os.path.join(pkg_dir, "templates"))
         env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_dir))
 
-        # Collect all hosts with plugin data
+        # Collect all hosts with plugin data (filtered by visibility)
         hosts_with_plugins = []
         for hostname in sorted(hbdclass.Host.hosts.keys()):
             host = hbdclass.Host.hosts[hostname]
+            if not _can_view_host(current_user, host):
+                continue
             if host.plugin_data:
                 hosts_with_plugins.append({
                     "name": hostname,
@@ -392,11 +523,14 @@ async def start(
             title="Plugin Metrics - Heartbeat",
             header="Plugin Metrics",
             hosts=hosts_with_plugins,
+            current_user=current_user.to_dict() if current_user else None,
+            active_page="plugins",
         )
         return web.Response(text=body, content_type="text/html")
 
     async def alerts_page(request):
         """Render the alerts dashboard page."""
+        current_user, _ = _require_auth_redirect(request)
         pkg_dir = os.path.dirname(__file__)
         templates_dir = config.get("templates_dir", os.path.join(pkg_dir, "templates"))
         env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_dir))
@@ -405,18 +539,322 @@ async def start(
         body = tmpl.render(
             title="Alerts Dashboard - Heartbeat",
             header="Alerts Dashboard",
+            current_user=current_user.to_dict() if current_user else None,
+            active_page="alerts",
+        )
+        return web.Response(text=body, content_type="text/html")
+
+    # -------------------------------------------------------------------------
+    # Auth endpoints
+    # -------------------------------------------------------------------------
+
+    async def api_login(request):
+        """POST /api/0/auth/login  {username, password} -> {token}
+        Also sets an hbd_session cookie for browser clients.
+        """
+        if not users_mod.users_enabled():
+            return web.json_response({"error": "Auth not configured"}, status=404)
+        try:
+            body = await request.json()
+        except Exception:
+            return web.json_response({"error": "Invalid JSON"}, status=400)
+        username = body.get("username", "")
+        password = body.get("password", "")
+        user = users_mod.authenticate(username, password)
+        if user is None:
+            return web.json_response({"error": "Invalid credentials"}, status=401)
+        token = users_mod.create_session(username)
+        resp = web.json_response({"token": token, "username": username})
+        resp.set_cookie(
+            SESSION_COOKIE,
+            token,
+            max_age=users_mod.SESSION_TTL,
+            httponly=True,
+            samesite="Lax",
+        )
+        return resp
+
+    async def login_page(request):
+        """GET /login — show login form; POST /login — process and redirect."""
+        if not users_mod.users_enabled():
+            raise web.HTTPFound("/")
+
+        error = ""
+        if request.method == "POST":
+            form = await request.post()
+            username = form.get("username", "")
+            password = form.get("password", "")
+            user = users_mod.authenticate(username, password)
+            if user:
+                token = users_mod.create_session(username)
+                redirect_to = request.rel_url.query.get("next", "/")
+                resp = web.HTTPFound(redirect_to)
+                resp.set_cookie(
+                    SESSION_COOKIE,
+                    token,
+                    max_age=users_mod.SESSION_TTL,
+                    httponly=True,
+                    samesite="Lax",
+                )
+                raise resp
+            error = "Invalid username or password."
+
+        html = f"""<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Heartbeat — Login</title>
+  <style>
+    body {{ font-family: sans-serif; background: #f5f5f5; display: flex;
+            justify-content: center; align-items: center; height: 100vh; margin: 0; }}
+    .box {{ background: #fff; padding: 2em 2.5em; border-radius: 8px;
+             box-shadow: 0 2px 12px rgba(0,0,0,.15); min-width: 300px; }}
+    h2 {{ margin: 0 0 1.2em; color: #333; font-size: 1.4em; }}
+    label {{ display: block; margin-bottom: .3em; font-size: .9em; color: #555; }}
+    input {{ width: 100%; padding: .5em .7em; border: 1px solid #ccc;
+              border-radius: 4px; font-size: 1em; box-sizing: border-box; }}
+    button {{ margin-top: 1.2em; width: 100%; padding: .6em; background: #0066cc;
+               color: #fff; border: none; border-radius: 4px; font-size: 1em; cursor: pointer; }}
+    button:hover {{ background: #0055aa; }}
+    .error {{ color: #c00; font-size: .9em; margin-bottom: .8em; }}
+    .field {{ margin-bottom: .9em; }}
+  </style>
+</head>
+<body>
+  <div class="box">
+    <h2>Heartbeat</h2>
+    {'<p class="error">' + error + '</p>' if error else ''}
+    <form method="post">
+      <div class="field"><label>Username</label><input name="username" autofocus></div>
+      <div class="field"><label>Password</label><input name="password" type="password"></div>
+      <button type="submit">Sign in</button>
+    </form>
+  </div>
+</body>
+</html>"""
+        return web.Response(text=html, content_type="text/html")
+
+    async def web_logout(request):
+        """GET /logout — clear session cookie and redirect to /login."""
+        token = request.cookies.get(SESSION_COOKIE, "")
+        users_mod.delete_session(token)
+        resp = web.HTTPFound("/login")
+        resp.del_cookie(SESSION_COOKIE)
+        raise resp
+
+    async def api_logout(request):
+        """POST /api/0/auth/logout"""
+        token = _get_token(request)
+        users_mod.delete_session(token)
+        resp = web.json_response({"success": True})
+        resp.del_cookie(SESSION_COOKIE)
+        return resp
+
+    # -------------------------------------------------------------------------
+    # User endpoints
+    # -------------------------------------------------------------------------
+
+    async def api_user_avatar(request):
+        """GET /api/0/users/{username}/avatar — serve a local avatar file.
+
+        Only reachable when the user's avatar config value starts with '/'.
+        Falls back to 404 for external URLs (the browser fetches those directly).
+        """
+        user, err = _require_auth(request)
+        if err:
+            return err
+        username = request.match_info.get("username")
+        target_user = users_mod.get_user(username)
+        if target_user is None:
+            return web.Response(status=404, text="User not found")
+        if not target_user.avatar_is_local():
+            return web.Response(status=404, text="No local avatar configured")
+        path = target_user.avatar
+        if not os.path.isfile(path):
+            return web.Response(status=404, text="Avatar file not found")
+        # Infer content-type from extension
+        ext = os.path.splitext(path)[1].lower()
+        mime = {
+            ".png": "image/png",
+            ".jpg": "image/jpeg",
+            ".jpeg": "image/jpeg",
+            ".gif": "image/gif",
+            ".webp": "image/webp",
+            ".svg": "image/svg+xml",
+        }.get(ext, "application/octet-stream")
+        return web.FileResponse(path=path, headers={"Content-Type": mime})
+
+    async def api_users(request):
+        """GET /api/0/users — admin only."""
+        user, err = _require_auth(request)
+        if err:
+            return err
+        if users_mod.users_enabled() and (user is None or not user.admin):
+            return web.json_response({"error": "Forbidden"}, status=403)
+        return web.json_response([u.to_dict() for u in users_mod.users.values()])
+
+    async def api_user_self(request):
+        """GET /api/0/users/me — own profile."""
+        user, err = _require_auth(request)
+        if err:
+            return err
+        if user is None:
+            return web.json_response({"error": "Auth not configured"}, status=404)
+        return web.json_response(user.to_dict())
+
+    # -------------------------------------------------------------------------
+    # Host access endpoints
+    # -------------------------------------------------------------------------
+
+    async def api_host_access_get(request):
+        """GET /api/0/hosts/{hostname}/access"""
+        user, err = _require_auth(request)
+        if err:
+            return err
+        hostname = request.match_info.get("hostname")
+        if hostname not in hbdclass.Host.hosts:
+            return web.json_response({"error": f"Host '{hostname}' not found"}, status=404)
+        host = hbdclass.Host.hosts[hostname]
+        if not _can_view_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
+        return web.json_response(host.access_dict())
+
+    async def api_host_access_put(request):
+        """PUT /api/0/hosts/{hostname}/access  — owner or admin only.
+
+        Body: {owner?: str, managers?: [str], monitors?: [str]}
+        """
+        user, err = _require_auth(request)
+        if err:
+            return err
+        hostname = request.match_info.get("hostname")
+        if hostname not in hbdclass.Host.hosts:
+            return web.json_response({"error": f"Host '{hostname}' not found"}, status=404)
+        host = hbdclass.Host.hosts[hostname]
+        if not _can_own_host(user, host):
+            return web.json_response({"error": "Forbidden"}, status=403)
+        try:
+            body = await request.json()
+        except Exception:
+            return web.json_response({"error": "Invalid JSON"}, status=400)
+
+        if "owner" in body:
+            host.owner = body["owner"] or None
+        if "managers" in body:
+            host.managers = list(body["managers"])
+        if "monitors" in body:
+            host.monitors = list(body["monitors"])
+
+        return web.json_response(host.access_dict())
+
+    # -------------------------------------------------------------------------
+    # User profile page
+    # -------------------------------------------------------------------------
+
+    async def profile_page(request):
+        """GET /profile — current user's settings and host access summary."""
+        current_user, _ = _require_auth_redirect(request)
+        pkg_dir = os.path.dirname(__file__)
+        templates_dir = config.get("templates_dir", os.path.join(pkg_dir, "templates"))
+        env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_dir))
+
+        # Build host access summary for this user.
+        # Merge live hosts with config-only hosts (not yet seen) so the profile
+        # reflects the config file immediately after a reload.
+        from . import config as config_mod
+        owned, managed, monitored = [], [], []
+        if current_user:
+            # Collect all known hostnames: live + configured
+            cfg_hostnames = set(config.get("hosts", {}).keys())
+            live_hostnames = set(hbdclass.Host.hosts.keys())
+            all_hostnames = sorted(cfg_hostnames | live_hostnames)
+
+            for hostname in all_hostnames:
+                live_host = hbdclass.Host.hosts.get(hostname)
+                if live_host is not None:
+                    # Use live object — it has apply_access already called
+                    is_own = live_host.is_owner(current_user.username)
+                    is_mgr = not is_own and live_host.is_manager(current_user.username)
+                    is_mon = not is_own and not is_mgr and live_host.is_monitor(current_user.username)
+                else:
+                    # Config-only host — read access directly from config
+                    access = config_mod.get_host_access(config, hostname)
+                    is_own = access["owner"] == current_user.username
+                    is_mgr = current_user.username in access["managers"]
+                    is_mon = current_user.username in access["monitors"]
+
+                if is_own:
+                    owned.append(hostname)
+                elif is_mgr:
+                    managed.append(hostname)
+                elif is_mon:
+                    monitored.append(hostname)
+
+
+        # Resolve notification channel configs for display
+        notif_channels = []
+        if current_user:
+            for ch_name in (current_user.notification_channels or []):
+                ch_cfg = config.get("notification_channels", {}).get(ch_name, {})
+                notif_channels.append({"name": ch_name, "type": ch_cfg.get("type", "")})
+
+        tmpl = env.get_template("profile.html")
+        body = tmpl.render(
+            title="Profile - Heartbeat",
+            header="My Profile",
+            current_user=current_user.to_dict() if current_user else None,
+            owned_hosts=owned,
+            managed_hosts=managed,
+            monitored_hosts=monitored,
+            notification_channels=notif_channels,
+            active_page="profile",
+        )
+        return web.Response(text=body, content_type="text/html")
+
+    # -------------------------------------------------------------------------
+    # Settings page (admin only)
+    # -------------------------------------------------------------------------
+
+    async def settings_page(request):
+        """GET /settings — read-only view of the current server configuration."""
+        current_user, _ = _require_auth_redirect(request)
+        if current_user and not current_user.admin:
+            raise web.HTTPForbidden(reason="Admin access required")
+        pkg_dir = os.path.dirname(__file__)
+        templates_dir = config.get("templates_dir", os.path.join(pkg_dir, "templates"))
+        env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_dir))
+        tmpl = env.get_template("settings.html")
+        body = tmpl.render(
+            title="Settings - Heartbeat",
+            sections=settings_mod.get_settings_sections(config),
+            current_user=current_user.to_dict() if current_user else None,
+            active_page="settings",
         )
         return web.Response(text=body, content_type="text/html")
 
     app = web.Application()
     app.add_routes(
         [
-            web.get("/", index),
+            web.get("/", live),
+            web.get("/old", old_index),
+            # Auth
+            web.get("/login", login_page),
+            web.post("/login", login_page),
+            web.get("/logout", web_logout),
+            web.post("/api/0/auth/login", api_login),
+            web.post("/api/0/auth/logout", api_logout),
+            # Users
+            web.get("/api/0/users", api_users),
+            web.get("/api/0/users/me", api_user_self),
+            web.get("/api/0/users/{username}/avatar", api_user_avatar),
+            # Hosts
             web.get("/api/0/hosts", api_hosts),
             web.get("/api/0/messages", api_messages),
             web.get("/api/0/hosts/{hostname}/plugins", api_host_plugins),
             web.get("/api/0/hosts/{hostname}/plugins/{plugin_name}", api_host_plugin_detail),
             web.get("/api/0/hosts/{hostname}/alerts", api_host_alerts),
+            web.get("/api/0/hosts/{hostname}/access", api_host_access_get),
+            web.put("/api/0/hosts/{hostname}/access", api_host_access_put),
             web.get("/api/0/alerts", api_all_alerts),
             web.post("/api/0/alerts/acknowledge", api_acknowledge_alert),
             web.get("/c", cmd),
@@ -426,8 +864,11 @@ async def start(
             web.get("/live", live),
             web.get("/plugins", plugins_page),
             web.get("/alerts", alerts_page),
+            web.get("/profile", profile_page),
+            web.get("/settings", settings_page),
             web.get("/static/{path:.*}", static),
             web.get("/favicon.ico", favicon),
+            web.get("/ws", ws_mod.handler),
         ]
     )
 
@@ -436,8 +877,7 @@ async def start(
     site = web.TCPSite(runner, host, port)
     await site.start()
 
-    if verbose:
-        print(f"HTTP server started on {host}:{port}")
+    logger.info(f"HTTP server started on {host}:{port}")
 
     try:
         await asyncio.Future()

hbd/server/main.py

@@ -15,6 +15,7 @@ from . import hbdclass
 from . import ws as ws_mod
 from . import notify as notify_mod
 from . import data
+from . import users as users_mod
 
 logger = logging.getLogger(__name__)
 msg_to_websockets = ws_mod.broadcast
@@ -26,6 +27,7 @@ def save_state(config, hbdclass):
     """Save current state to pickle file. Safe to call at any time."""
     import pickle
     import os
+    from . import users as users_mod
 
     # Clear timer references before pickling (they can't be serialized)
     for hostname, host in list(hbdclass.Host.hosts.items()):
@@ -47,6 +49,7 @@ def save_state(config, hbdclass):
             pick = pickle.Pickler(pickf)
             pick.dump(hbdclass.Host.hosts)
             pick.dump(data.msgs)
+            pick.dump(users_mod.save_sessions())
         os.replace(tmpfile, pickfile)
     except Exception as e:
         logger.error("Failed to save state: %s", e)
@@ -85,6 +88,19 @@ async def reload_configuration(config_obj, config_path, components):
         # Update notify module
         notify_mod.reload_config(new_config)
 
+        # Reload users
+        users_mod.load_users(new_config)
+
+        # Re-apply host attributes from updated config to all known hosts
+        from . import config as config_mod
+        dyndnshosts = config_mod.get_dyndnshosts(new_config)
+        watchhosts = config_mod.get_watchhosts(new_config)
+        for hostname, host in hbdclass.Host.hosts.items():
+            host.dyn = hostname in dyndnshosts
+            host.watched = hostname in watchhosts
+            access = config_mod.get_host_access(new_config, hostname)
+            host.apply_access(access["owner"], access["managers"], access["monitors"])
+
         # Reload threshold checker
         if 'threshold_checker' in components:
             components['threshold_checker'].reload(new_config)
@@ -116,6 +132,10 @@ async def reload_configuration(config_obj, config_path, components):
 
 
 async def _run_async(config, config_path=None):
+    from .config import ReloadableConfig
+    if not isinstance(config, ReloadableConfig):
+        config = ReloadableConfig(config, config_path)
+
     loop = asyncio.get_running_loop()
     shutdown_event = asyncio.Event()
     reload_event = asyncio.Event()
@@ -142,7 +162,7 @@ async def _run_async(config, config_path=None):
     from . import journal as journal_mod
     from . import threshold as threshold_mod
 
-    notify_mod.setup(config)
+    notify_mod.setup(config, loop=loop)
     
     # Initialize message journal
     msg_journal = journal_mod.get_journal(config)
@@ -177,14 +197,14 @@ async def _run_async(config, config_path=None):
     sock.bind(bind_addr)
     logger.info("Starting UDP server on %s:%s", *bind_addr)
 
-    # Try to enable kernel receive timestamps (Linux SO_TIMESTAMPNS).
+    # Try to enable kernel receive timestamps (Linux SO_TIMESTAMP).
     # If supported, read datagrams via recvmsg() so RTT uses the kernel
     # timestamp rather than the time.time() call after asyncio scheduling.
     use_kernel_ts = udp.enable_kernel_timestamps(sock)
     if use_kernel_ts:
-        logger.info("SO_TIMESTAMPNS enabled: using kernel receive timestamps for RTT")
+        logger.info("SO_TIMESTAMP enabled: using kernel receive timestamps for RTT")
     else:
-        logger.info("SO_TIMESTAMPNS not available: using time.time() for RTT")
+        logger.info("SO_TIMESTAMP not available: using time.time() for RTT")
 
     def udp_handler(msg, addr, transport, recv_ts=None):
         ctx = dict(
@@ -255,45 +275,17 @@ async def _run_async(config, config_path=None):
     except Exception as e:
         logger.exception("dns worker failed to start: %s", e)
 
-    # Start the websocket servers as a background task
-    if config.get("wss_port", None):
-        ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        ssl_path = config.get("cert_path", "")
-        wss_pem = ssl_path + config.get("wss_pem", "")
-        wss_key = ssl_path + config.get("wss_key", "")
-        try:
-            ssl_context.load_cert_chain(wss_pem, keyfile=wss_key)
-        except FileNotFoundError:
-            logger.error("error: missing SSL keys %s or %s", wss_pem, wss_key)
-            sys.exit(1)
-        logger.info(
-            "Starting secure WebSocket server on port %s with cert %s",
-            config.get("wss_port", None),
-            wss_pem,
-        )
-    else:
-        ssl_context = None
-
-    try:
-        ws_port = config.get("ws_port", 50005)
-        logger.info("Starting WebSocket server on port %s", ws_port)
-        ws_task = asyncio.create_task(
-            ws_mod.start(
-                host=config.get("hbd_host", ""),
-                ws_port=ws_port,
-                wss_port=config.get("wss_port", None),
-                ssl_context=ssl_context,
-                get_hosts=lambda: [
-                    hbdclass.Host.hosts[h].stateinfo()
-                    for h in sorted(hbdclass.Host.hosts)
-                ],
-#                get_msgs=lambda: msgs,
-                config=config,
-            )
-        )
-        logger.info("WebSocket task started")
-    except Exception as e:
-        logger.exception("websocket server failed to start: %s", e)
+    # Register WebSocket state — connections are now served through /ws on the HTTP port
+    ws_task = None
+    ws_mod.setup(
+        loop=loop,
+        get_hosts=lambda: [
+            hbdclass.Host.hosts[h].stateinfo()
+            for h in sorted(hbdclass.Host.hosts)
+        ],
+        verbose=config.get("verbose", False),
+    )
+    logger.info("WebSocket handler registered on /ws (HTTP port %s)", config.get("hbd_port", 50004))
 
     # Periodic autosave task
     autosave_interval = config.get("autosave_interval", 300)  # default: 5 minutes
@@ -355,7 +347,7 @@ async def _run_async(config, config_path=None):
         except Exception as e:
             logger.warning("Error closing UDP transport: %s", e)
 
-        tasks_to_cancel = [http_task, ws_task, autosave]
+        tasks_to_cancel = [http_task, autosave]
         for task in tasks_to_cancel:
             if task:
                 try:
@@ -406,6 +398,13 @@ async def _run_async(config, config_path=None):
         except Exception as e:
             logger.warning("Error stopping DNS worker: %s", e)
 
+        # Save state (hosts + sessions) on clean shutdown
+        try:
+            save_state(config, hbdclass)
+            logger.info("State saved on shutdown")
+        except Exception as e:
+            logger.warning("Error saving state on shutdown: %s", e)
+
         logger.info("All tasks cancelled")
 
 
@@ -414,6 +413,7 @@ def load_pickled_hosts(config, hbdclass):
     import os
     import pickle
     from . import config as config_mod
+    from . import users as users_mod
 
     pickfile = config.get("pickfile", "hbd.pickle")
     dyndnshosts = config_mod.get_dyndnshosts(config)
@@ -427,6 +427,10 @@ def load_pickled_hosts(config, hbdclass):
         try:
             hbdclass.Host.hosts = pick.load()
             data.msgs = pick.load()
+            try:
+                users_mod.load_sessions(pick.load())
+            except Exception:
+                pass  # older pickle without sessions — fine
             pickf.close()
         except Exception as e:
             logger.exception("load pickled failed: %s", e)
@@ -436,6 +440,10 @@ def load_pickled_hosts(config, hbdclass):
             hbdclass.Host.hosts[h].dyn = h in dyndnshosts
             hbdclass.Host.hosts[h].watched = h in watchhosts
             hbdclass.Host.hosts[h].fixup()
+            access = config_mod.get_host_access(config, h)
+            hbdclass.Host.hosts[h].apply_access(
+                access["owner"], access["managers"], access["monitors"]
+            )
         for h in drophosts:
             if h in hbdclass.Host.hosts:
                 del hbdclass.Host.hosts[h]
@@ -457,12 +465,26 @@ def run(config, config_path=None):
     """
     import os
 
-    logging.basicConfig(
-        level=logging.DEBUG if config.get("debug", 0) > 0 else logging.INFO
-    )
+    log_level = logging.WARNING
+    if config.get("verbose", False):
+        log_level = logging.INFO
+    if config.get("debug", 0) > 0:
+        log_level = logging.DEBUG
+    logging.basicConfig(level=log_level)
     load_pickled_hosts(config, hbdclass)
 
     notify_mod.initlog(logfile=config.get("logfile", "messages.log"))
+    users_mod.load_users(config)
+
+    # Write pidfile
+    pidfile = config.get("pidfile", "")
+    if pidfile:
+        try:
+            with open(pidfile, "w") as f:
+                f.write(str(os.getpid()))
+        except Exception as e:
+            logger.warning("Failed to write pidfile %s: %s", pidfile, e)
+
     eventlog(None, "INFO", f"hbd version {__version__} starting up")
     
     if config_path:
@@ -485,6 +507,12 @@ def run(config, config_path=None):
         logger.info("hbd shutdown complete")
         eventlog(None, "INFO", f"hbd version {__version__} shutdown")
         notify_mod.closelog()
+        # Remove pidfile
+        if pidfile:
+            try:
+                os.unlink(pidfile)
+            except Exception:
+                pass
         # Explicitly close the loop
         try:
             # Cancel all remaining tasks

hbd/server/notify.py

@@ -1,37 +1,106 @@
-"""Notification helpers: email, pushover, mattermost, signal and dispatcher."""
+"""Notification helpers: email, pushover, matrix, mattermost, signal, sms and dispatcher.
 
+Channel types supported:
+  pushover      - Pushover app notifications
+  email         - SMTP email
+  matrix        - Matrix (via matrix-nio)
+  mattermost    - Mattermost webhook
+  signal        - Signal via signal-cli subprocess
+  sms_voipms    - SMS via voip.ms REST API
+
+Each channel can specify ``min_level: WARNING|CRITICAL`` (default: WARNING).
+
+Notifications are dispatched to the owner + managers of the host, each via
+their own ``notification_channels`` list.  When no users are configured the
+server runs silently (no notifications sent).
+"""
+
+import asyncio
+import asyncio
 import logging
-from typing import Optional
-import http.client
-import urllib.parse
-import subprocess
 import smtplib
+import subprocess
 import time
 import sys
+from dataclasses import dataclass, field
+from typing import Optional
+
 from . import data
 from . import ws as ws_mod
-from . import main as main_mod
 
-DEFAULT_PUSHPROVIDERS = ["all", "pushover", "mattermost", "signal"]
-msg_to_websockets = ws_mod.broadcast
-
-# module-level configuration set via setup()
-_config = {}
 logger = logging.getLogger(__name__)
 
+logger = logging.getLogger(__name__)
+
+msg_to_websockets = ws_mod.broadcast
+
+# Module-level state set via setup()
+_config: dict = {}
+_loop: Optional[asyncio.AbstractEventLoop] = None
+
+# Tracks which channels fired a WARNING/CRITICAL per host.
+# {host_name: set of channel_names}  — used to route RECOVER to the same channels.
+_alerted_channels: dict = {}
+
 logf = None
 
+
+# ---------------------------------------------------------------------------
+# Level ordering
+# ---------------------------------------------------------------------------
+
+_LEVEL_ORDER = {"RECOVER": 0, "INFO": 0, "WARNING": 1, "CRITICAL": 2}
+
+def _level_value(level: str) -> int:
+    return _LEVEL_ORDER.get(level.upper(), 0)
+
+
+# ---------------------------------------------------------------------------
+# Notification dataclass
+# ---------------------------------------------------------------------------
+
+@dataclass
+class Notification:
+    """Structured notification payload."""
+    title: str          # e.g. "[CRITICAL] webserver01"
+    body: str           # detail message
+    level: str          # RECOVER | WARNING | CRITICAL | INFO
+    url: str = ""       # link to plugin metrics page
+
+
+# ---------------------------------------------------------------------------
+# Module setup
+# ---------------------------------------------------------------------------
+
+def setup(cfg: dict, loop: Optional[asyncio.AbstractEventLoop] = None):
+    """Initialize notifier from configuration dict and event loop."""
+    global _config, _loop
+    _config = dict(cfg)
+    if loop is not None:
+        _loop = loop
+
+
+def reload_config(cfg: dict):
+    """Reload notification configuration on SIGHUP."""
+    global _config
+    _config = dict(cfg)
+    logger.info("Notification configuration reloaded")
+
+
+# ---------------------------------------------------------------------------
+# Event log (websocket + file + in-memory)
+# ---------------------------------------------------------------------------
+
 def initlog(logfile):
     global logf
     try:
         logf = open(logfile, "a+")
     except Exception as e:
-        import sys
-
         print("cannot open logfile %s, using STDERR: %s" % (logfile, e))
         logf = sys.stderr
     return logf
 
+
 def closelog():
     global logf
     if logf and logf != sys.stderr:
@@ -40,6 +109,7 @@ def closelog():
         except Exception:
             pass
 
+
 def eventlog(host, lvl, m, service=None):
     ts = time.time()
     s = f"{time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(ts))} {lvl} "
@@ -56,91 +126,29 @@ def eventlog(host, lvl, m, service=None):
             logger.warning("failed to write to logfile: %s", e)
     msg_to_websockets("message", s)
 
-def setup(cfg: dict):
-    """Initialize notifier defaults from a configuration dict."""
-    global _config
-    _config = dict(cfg)
 
+# ---------------------------------------------------------------------------
+# Low-level channel drivers
+# ---------------------------------------------------------------------------
 
-def reload_config(cfg: dict):
-    """Reload notification configuration.
-    
-    This function updates the module-level notification configuration
-    during runtime config reloads.
-    
-    Args:
-        cfg: New configuration dictionary
-    """
-    global _config
-    _config = dict(cfg)
-    logger.info("Notification configuration reloaded")
-
-
-def send_email(toaddrs, smtpserver, sender, subject, body, debug=0):
-    """Send a plain email via SMTP. Returns True on success."""
-    try:
-        smtpport = _config.get("smtpport", 587)
-        server = smtplib.SMTP(smtpserver, smtpport)
-        if debug > 0:
-            server.set_debuglevel(1)
-        if smtpport == 587:
-            server.starttls()
-            server.ehlo()
-            smtpuser = _config.get("smtpuser", None)
-            smtppassword = _config.get("smtppassword", None)
-            if smtpuser and smtppassword:
-                server.login(smtpuser, smtppassword)
-        server.sendmail(sender, toaddrs, body)
-    except Exception as e:
-        logger.warning("email send failed: %s", e)
-        try:
-            server.quit()
-        except Exception:
-            pass
+def _send_pushover(channel_cfg: dict, notif: Notification) -> bool:
+    import http.client
+    import urllib.parse
+    token = channel_cfg.get("token", "")
+    user = channel_cfg.get("user", "")
+    if not token or not user:
+        logger.warning("pushover: missing token or user")
         return False
-    try:
-        server.quit()
-    except Exception:
-        pass
-    return True
-
-
-def email(subject: str, msg: str, debug: int = 0) -> bool:
-    """Convenience wrapper exposed to the rest of the application.
-
-    Uses module-level configuration to supply recipient list, smtp server
-    and sender address.
-    """
-    toaddrs = _config.get("toemail")
-    fromemail = _config.get("fromemail")
-    smtpserver = _config.get("smtpserver")
-    if not toaddrs or not fromemail or not smtpserver:
-        logger.warning(
-            "email config incomplete: toemail=%s, fromemail=%s, smtpserver=%s",
-            toaddrs,
-            fromemail,
-            smtpserver,
-        )
-        return False
-    date = time.strftime("%a, %d %b %Y %H:%M:%S %z", time.localtime())
-    body = "To: %s\nFrom: %s\nSubject: %s\nDate: %s\n\n%s" % (
-        toaddrs[0] if toaddrs else "",
-        fromemail,
-        subject,
-        date,
-        msg,
-    )
-    return send_email(toaddrs, smtpserver, fromemail, subject, body, debug=debug)
-
-
-def pushover(token: str, user: str, msg: str, debug: int = 0) -> bool:
-    """Send message via Pushover API."""
+    params: dict = {"token": token, "user": user, "title": notif.title, "message": notif.body}
+    if notif.url:
+        params["url"] = notif.url
+        params["url_title"] = "Plugin metrics"
     conn = http.client.HTTPSConnection("api.pushover.net:443")
     try:
         conn.request(
             "POST",
             "/1/messages.json",
-            urllib.parse.urlencode({"token": token, "user": user, "message": msg}),
+            urllib.parse.urlencode(params),
             {"Content-type": "application/x-www-form-urlencoded"},
         )
         r = conn.getresponse()
@@ -151,176 +159,346 @@ def pushover(token: str, user: str, msg: str, debug: int = 0) -> bool:
         return False
 
 
-def pushmattermost(
-    host: str,
-    token: str,
-    channel: str,
-    msg: str,
-    username: str = "hbd",
-    icon: Optional[str] = None,
-    debug: int = 0,
-) -> bool:
-    """Send a message to Mattermost via simple webhook driver if available.
+def _send_email(channel_cfg: dict, notif: Notification) -> bool:
+    recipients = channel_cfg.get("recipients", [])
+    sender = channel_cfg.get("sender", "")
+    smtp_server = channel_cfg.get("smtp_server", "")
+    smtp_port = channel_cfg.get("smtp_port", 587)
+    smtp_user = channel_cfg.get("smtp_user")
+    smtp_password = channel_cfg.get("smtp_password")
 
-    This helper tries to import mattermostdriver.Driver and uses webhooks if present.
-    If the import fails it returns False.
-    """
+    if not recipients or not sender or not smtp_server:
+        logger.warning("email: missing recipients, sender, or smtp_server")
+        return False
+
+    date = time.strftime("%a, %d %b %Y %H:%M:%S %z", time.localtime())
+    body_text = notif.body
+    if notif.url:
+        body_text += f"\n\n{notif.url}"
+    raw = "To: %s\nFrom: %s\nSubject: %s\nDate: %s\n\n%s" % (
+        recipients[0] if isinstance(recipients, list) else recipients,
+        sender,
+        notif.title,
+        date,
+        body_text,
+    )
+    try:
+        server = smtplib.SMTP(smtp_server, smtp_port)
+        if smtp_port == 587:
+            server.starttls()
+            server.ehlo()
+            if smtp_user and smtp_password:
+                server.login(smtp_user, smtp_password)
+        server.sendmail(sender, recipients, raw)
+        server.quit()
+        return True
+    except Exception as e:
+        logger.warning("email send failed: %s", e)
+        try:
+            server.quit()
+        except Exception:
+            pass
+        return False
+
+
+def _send_mattermost(channel_cfg: dict, notif: Notification) -> bool:
     try:
         from mattermostdriver import Driver
-    except Exception:
+    except ImportError:
+        logger.error("mattermostdriver not installed")
         return False
+    host = channel_cfg.get("host", "")
+    token = channel_cfg.get("token", "")
+    channel = channel_cfg.get("channel", "")
+    if not host or not token or not channel:
+        logger.warning("mattermost: missing host, token, or channel")
+        return False
+    text = f"**{notif.title}**\n{notif.body}"
+    if notif.url:
+        text += f"\n[Plugin metrics]({notif.url})"
     ses = {"url": host, "scheme": "http", "basepath": "/api/v4", "port": 8065}
     mm = Driver(ses)
-    payload = {"text": msg, "channel": channel, "username": username}
+    payload: dict = {"text": text, "channel": channel, "username": channel_cfg.get("username", "hbd")}
+    icon = channel_cfg.get("icon")
     if icon:
         payload["icon_url"] = icon
     try:
         rc = mm.webhooks.call_webhook(token, payload)
-        logger.debug("mattermost rc: %s", rc)
         return bool(rc is None or rc == "")
     except Exception as e:
         logger.error("mattermost error: %s", e)
         return False
 
 
-def pushsignal(
-    signal_cli_bin: str, user: str, recipient: str, msg: str, debug: int = 0
-) -> bool:
-    """Send a message via signal-cli (requires local installation).
-
-    Uses subprocess to call signal-cli. Returns True if the command succeeded.
-    """
-    CLI = [signal_cli_bin, "-u", user, "send", "-m", msg, recipient]
-    logger.debug("signal cli: %s", CLI)
+def _send_signal(channel_cfg: dict, notif: Notification) -> bool:
+    cli = channel_cfg.get("cli_path", "/usr/local/bin/signal-cli")
+    user = channel_cfg.get("user", "")
+    recipient = channel_cfg.get("recipient", "")
+    if not user or not recipient:
+        logger.warning("signal: missing user or recipient")
+        return False
+    msg = f"{notif.title}\n{notif.body}"
+    if notif.url:
+        msg += f"\n{notif.url}"
     try:
-        res = subprocess.run(CLI, capture_output=True)
+        res = subprocess.run([cli, "-u", user, "send", "-m", msg, recipient], capture_output=True)
         if res.returncode != 0:
-            logger.error("signal failed: %s".res.stderr.decode())
+            logger.error("signal failed: %s", res.stderr.decode())
             return False
-        logger.debug("signal sent: %s", res.stdout.decode())
         return True
     except Exception as e:
         logger.exception("signal exception: %s", e)
         return False
 
 
-def _dispatch_to_channel(channel_name: str, channel_config: dict, msg: str, debug: int = 0) -> bool:
-    """Dispatch a message to a specific notification channel.
+async def _send_sms_voipms_async(channel_cfg: dict, notif: Notification) -> bool:
+    """Send SMS via voip.ms REST API using multipart form-data POST."""
+    import json
+    import aiohttp
 
-    Args:
-        channel_name: Name of the channel (for logging)
-        channel_config: Channel configuration dictionary with 'type' and type-specific fields
-        msg: Message to send
-        debug: Debug level
+    api_user = channel_cfg.get("api_user", "")
+    api_password = channel_cfg.get("api_password", "")
+    did = channel_cfg.get("did", "")
+    dst = channel_cfg.get("dst", "")
+    if not api_user or not api_password or not did or not dst:
+        logger.warning("sms_voipms: missing api_user, api_password, did, or dst")
+        return False
 
-    Returns:
-        True if notification sent successfully, False otherwise
-    """
-    channel_type = channel_config.get("type")
+    # SMS body: title + body, truncated to 160 chars
+    text = f"{notif.title}: {notif.body}"
+    if len(text) > 160:
+        text = text[:157] + "..."
 
-    if channel_type == "pushover":
-        return pushover(
-            channel_config.get("token", ""),
-            channel_config.get("user", ""),
-            msg,
-            debug=debug
-        )
+    form_data = {
+        "api_username": api_user,
+        "api_password": api_password,
+        "method": "sendSMS",
+        "did": did,
+        "dst": dst,
+        "message": text,
+    }
 
-    elif channel_type == "email":
-        # Build email from channel config
-        recipients = channel_config.get("recipients", [])
-        sender = channel_config.get("sender", "")
-        smtp_server = channel_config.get("smtp_server", "")
-        smtp_port = channel_config.get("smtp_port", 587)
-        smtp_user = channel_config.get("smtp_user")
-        smtp_password = channel_config.get("smtp_password")
-        
-        if not recipients or not sender or not smtp_server:
-            logger.warning(
-                "Email channel '%s' missing required fields: recipients=%s, sender=%s, smtp_server=%s",
-                channel_name, recipients, sender, smtp_server
-            )
-            return False
-        
-        # Temporarily update _config for email() function
-        old_config = dict(_config)
-        _config["toemail"] = recipients
-        _config["fromemail"] = sender
-        _config["smtpserver"] = smtp_server
-        _config["smtpport"] = smtp_port
-        if smtp_user:
-            _config["smtpuser"] = smtp_user
-        if smtp_password:
-            _config["smtppassword"] = smtp_password
-        
-        result = email("Heartbeat notification", msg, debug=debug)
-        
-        # Restore config
-        _config.clear()
-        _config.update(old_config)
-        
-        return result
-    
-    elif channel_type == "signal":
-        return pushsignal(
-            channel_config.get("cli_path", "/usr/local/bin/signal-cli"),
-            channel_config.get("user", ""),
-            channel_config.get("recipient", ""),
-            msg,
-            debug=debug
-        )
-    
-    elif channel_type == "mattermost":
-        return pushmattermost(
-            channel_config.get("host", ""),
-            channel_config.get("token", ""),
-            channel_config.get("channel", ""),
-            msg,
-            username=channel_config.get("username", "hbd"),
-            icon=channel_config.get("icon"),
-            debug=debug
-        )
-    
-    else:
-        logger.warning("Unknown channel type '%s' for channel '%s'", channel_type, channel_name)
+    try:
+        async with aiohttp.ClientSession() as session:
+            with aiohttp.MultipartWriter("form-data") as mp:
+                for key, value in form_data.items():
+                    part = mp.append(value)
+                    part.set_content_disposition("form-data", name=key)
+            async with session.post("https://voip.ms/api/v1/rest.php", data=mp) as resp:
+                body = await resp.text()
+                if resp.status != 200:
+                    logger.error("sms_voipms HTTP %s: %s", resp.status, body)
+                    return False
+                result = json.loads(body)
+                if result.get("status") == "success":
+                    return True
+                logger.error("sms_voipms error: %s", result.get("status"))
+                return False
+    except Exception as e:
+        logger.error("sms_voipms exception: %s", e)
         return False
 
 
-def pushmsg_for_host(hostname: str, msg: str, debug: int = 0) -> dict:
-    """Send notification for a specific host using its configured channels.
+def _send_sms_voipms(channel_cfg: dict, notif: Notification) -> bool:
+    """Dispatch voip.ms SMS send onto the shared event loop."""
+    if _loop is None:
+        logger.warning("sms_voipms: event loop not available")
+        return False
+    future = asyncio.run_coroutine_threadsafe(_send_sms_voipms_async(channel_cfg, notif), _loop)
+    try:
+        return future.result(timeout=15)
+    except Exception as e:
+        logger.error("sms_voipms send timed out or failed: %s", e)
+        return False
 
-    This function looks up the host's notification channels from the config
-    and sends the message to those channels.
 
-    Args:
-        hostname: Name of the host to send notification for
-        msg: Message to send
-        debug: Debug level
+async def _send_matrix_async(channel_cfg: dict, notif: Notification) -> bool:
+    """Send a Matrix message using matrix-nio."""
+    try:
+        from nio import AsyncClient, RoomMessageText  # noqa: F401
+    except ImportError:
+        logger.error("matrix-nio not installed; pip install matrix-nio")
+        return False
 
-    Returns:
-        Dictionary of results per channel: {"channel_name": True/False}
+    from nio import AsyncClient
+    homeserver = channel_cfg.get("homeserver", "")
+    access_token = channel_cfg.get("access_token", "")
+    room_id = channel_cfg.get("room_id", "")
+    if not homeserver or not access_token or not room_id:
+        logger.warning("matrix: missing homeserver, access_token, or room_id")
+        return False
+
+    text = f"{notif.title}\n{notif.body}"
+    if notif.url:
+        text += f"\n{notif.url}"
+    html = f"<strong>{notif.title}</strong><br>{notif.body}"
+    if notif.url:
+        html += f'<br><a href="{notif.url}">Plugin metrics</a>'
+
+    client = AsyncClient(homeserver)
+    client.access_token = access_token
+    try:
+        from nio import RoomSendResponse
+        content = {
+            "msgtype": "m.text",
+            "body": text,
+            "format": "org.matrix.custom.html",
+            "formatted_body": html,
+        }
+        resp = await client.room_send(room_id, "m.room.message", content)
+        if hasattr(resp, "event_id"):
+            return True
+        logger.error("matrix send failed: %s", resp)
+        return False
+    except Exception as e:
+        logger.error("matrix exception: %s", e)
+        return False
+    finally:
+        await client.close()
+
+
+def _send_matrix(channel_cfg: dict, notif: Notification) -> bool:
+    """Dispatch matrix send onto the shared event loop."""
+    if _loop is None:
+        logger.warning("matrix: event loop not available")
+        return False
+    future = asyncio.run_coroutine_threadsafe(_send_matrix_async(channel_cfg, notif), _loop)
+    try:
+        return future.result(timeout=15)
+    except Exception as e:
+        logger.error("matrix send timed out or failed: %s", e)
+        return False
+
+
+# ---------------------------------------------------------------------------
+# Channel dispatcher
+# ---------------------------------------------------------------------------
+
+_DRIVERS = {
+    "pushover": _send_pushover,
+    "email": _send_email,
+    "mattermost": _send_mattermost,
+    "signal": _send_signal,
+    "sms_voipms": _send_sms_voipms,
+    "matrix": _send_matrix,
+}
+
+
+def _dispatch_to_channel(channel_name: str, channel_cfg: dict, notif: Notification) -> bool:
+    """Send *notif* to a single named channel, honouring min_level."""
+    min_level = channel_cfg.get("min_level", "WARNING").upper()
+    if _level_value(notif.level) < _level_value(min_level):
+        logger.debug(
+            "channel '%s': skipping level %s (min_level=%s)", channel_name, notif.level, min_level
+        )
+        return True  # not an error — filtered intentionally
+
+    ch_type = channel_cfg.get("type", "")
+    driver = _DRIVERS.get(ch_type)
+    if driver is None:
+        logger.warning("unknown channel type '%s' for channel '%s'", ch_type, channel_name)
+        return False
+    return driver(channel_cfg, notif)
+
+
+# ---------------------------------------------------------------------------
+# Central dispatch function
+# ---------------------------------------------------------------------------
+
+def _build_url(host_name: str) -> str:
+    base_url = _config.get("base_url", "").rstrip("/")
+    if not base_url:
+        return ""
+    return f"{base_url}/plugins#{host_name}"
+
+
+def send_notification(host_name: str, notif: Notification) -> dict:
+    """Dispatch *notif* to all managers/owner of *host_name*.
+
+    Looks up the host's owner + managers, resolves each user's
+    notification_channels, and dispatches.  Silently does nothing if
+    no users are configured.
+
+    Returns a dict of {channel_name: bool} results.
     """
-    from . import config as config_mod
+    from . import users as users_mod
+    from . import hbdclass
 
-    # Get notification channels for this host
-    channels = config_mod.get_notification_channels_config(_config, hostname)
-    
-    if not channels:
-        logger.warning("No notification channels configured for host '%s'", hostname)
+    if not users_mod.users_enabled():
         return {}
 
-    # Dispatch to each channel
-    results = {}
-    for channel_name, channel_config in channels:
-        try:
-            success = _dispatch_to_channel(channel_name, channel_config, msg, debug=debug)
-            results[channel_name] = success
-            if success:
-                logger.info("Notification sent to channel '%s': %s", channel_name, msg)
-            else:
-                logger.warning("Failed to send notification to channel '%s'", channel_name)
-        except Exception as e:
-            logger.error("Error sending to channel '%s': %s", channel_name, e)
-            results[channel_name] = False
+    # Collect recipient usernames: owner + managers
+    host = hbdclass.Host.hosts.get(host_name)
+    if host is None:
+        logger.debug("send_notification: host '%s' not found", host_name)
+        return {}
+
+    recipients: set[str] = set()
+    owner = getattr(host, "owner", None)
+    if owner:
+        recipients.add(owner)
+    for m in getattr(host, "managers", []):
+        recipients.add(m)
+
+    if not recipients:
+        logger.debug("send_notification: no owner/managers for '%s'", host_name)
+        return {}
+
+    # Fill url if not already set
+    if not notif.url:
+        notif.url = _build_url(host_name)
+
+    global_channels: dict = _config.get("notification_channels", {})
+    results: dict = {}
+    level = notif.level.upper()
+    is_alert = level in ("WARNING", "CRITICAL")
+    is_recover = level in ("RECOVER",)
+
+    # For RECOVER: send to every channel that previously fired an alert for this host,
+    # regardless of that channel's min_level.
+    if is_recover and host_name in _alerted_channels:
+        for channel_name in list(_alerted_channels[host_name]):
+            channel_cfg = global_channels.get(channel_name)
+            if not channel_cfg:
+                continue
+            try:
+                ch_type = channel_cfg.get("type", "")
+                driver = _DRIVERS.get(ch_type)
+                if driver:
+                    ok = driver(channel_cfg, notif)
+                    results[channel_name] = ok
+                    if ok:
+                        logger.info("recover sent to channel '%s': %s", channel_name, notif.title)
+            except Exception as e:
+                logger.error("error sending recover to channel '%s': %s", channel_name, e)
+        # Clear the alerted set once recovery is delivered
+        del _alerted_channels[host_name]
+        return results
+
+    for username in recipients:
+        user = users_mod.get_user(username)
+        if user is None:
+            logger.debug("send_notification: user '%s' not found", username)
+            continue
+        for channel_name in user.notification_channels:
+            if channel_name in results:
+                continue  # already dispatched to this channel this notification
+            channel_cfg = global_channels.get(channel_name)
+            if not channel_cfg:
+                logger.warning("channel '%s' not defined in notification_channels", channel_name)
+                results[channel_name] = False
+                continue
+            try:
+                ok = _dispatch_to_channel(channel_name, channel_cfg, notif)
+                results[channel_name] = ok
+                if ok:
+                    logger.info("notification sent to channel '%s': %s", channel_name, notif.title)
+                    if is_alert:
+                        _alerted_channels.setdefault(host_name, set()).add(channel_name)
+                else:
+                    logger.warning("failed to send notification to channel '%s'", channel_name)
+            except Exception as e:
+                logger.error("error sending to channel '%s': %s", channel_name, e)
+                results[channel_name] = False
 
     return results

hbd/server/settings.py

@@ -0,0 +1,328 @@
+"""Settings descriptor: maps config keys to display metadata.
+
+``get_settings_sections(config)`` returns an ordered list of sections, each
+containing a list of field descriptors.  The template iterates this structure
+generically, so adding editability later is a matter of:
+
+  1. Setting ``"editable": True`` on a field.
+  2. Adding the matching ``<input>``/``<select>`` in the template
+     (guided by ``"type"``).
+  3. Wiring a POST handler in http.py.
+
+Field descriptor keys
+---------------------
+key         str   Config key (for future form POST matching)
+label       str   Human-readable label
+description str   One-line help text shown below the value
+value       any   Sanitized display value (secrets replaced with "•••")
+type        str   One of: text | number | port | boolean | path | duration |
+                  list | secret | size | select
+editable    bool  Reserved for future use — currently always False
+sensitive   bool  True when the raw value must never be shown
+"""
+
+# Credential field names that should always be masked.
+_SECRET_KEYS = frozenset({
+    "password", "token", "user_key", "api_key", "secret",
+    "smtp_password", "smtp_user",
+})
+
+_CHANNEL_TYPE_LABELS = {
+    "pushover":   "Pushover",
+    "email":      "E-mail",
+    "signal":     "Signal",
+    "mattermost": "Mattermost",
+}
+
+
+def _mask(value):
+    """Return a masked placeholder for sensitive values."""
+    if not value:
+        return ""
+    return "•••"
+
+
+def _fmt_size(n):
+    """Format a byte count as a human-readable string."""
+    try:
+        n = int(n)
+    except (TypeError, ValueError):
+        return str(n)
+    for unit in ("B", "KB", "MB", "GB"):
+        if n < 1024:
+            return f"{n} {unit}"
+        n //= 1024
+    return f"{n} TB"
+
+
+def _fmt_duration(seconds):
+    """Format seconds into a human-readable duration string."""
+    try:
+        s = int(seconds)
+    except (TypeError, ValueError):
+        return str(seconds)
+    if s < 60:
+        return f"{s}s"
+    if s < 3600:
+        m, sec = divmod(s, 60)
+        return f"{m}m {sec}s" if sec else f"{m}m"
+    h, rem = divmod(s, 3600)
+    m = rem // 60
+    return f"{h}h {m}m" if m else f"{h}h"
+
+
+def _sanitize_channel(name, cfg):
+    """Return a sanitized copy of a notification channel config."""
+    result = {}
+    for k, v in cfg.items():
+        if k in _SECRET_KEYS:
+            result[k] = _mask(v)
+        elif isinstance(v, list):
+            result[k] = v
+        else:
+            result[k] = v
+    return result
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+def get_settings_sections(config: dict) -> list:
+    """Return ordered list of setting sections for the settings page.
+
+    Each section:
+        {
+            "title": str,
+            "description": str,
+            "fields": [ field_descriptor, ... ]
+        }
+
+    Each field_descriptor:
+        {
+            "key":         str,
+            "label":       str,
+            "description": str,
+            "value":       display_value,
+            "raw":         raw_config_value,   # None for sensitive
+            "type":        str,
+            "editable":    bool,
+            "sensitive":   bool,
+        }
+    """
+    def field(key, label, ftype, description="", editable=False, sensitive=False):
+        raw = config.get(key)
+        if sensitive:
+            display = _mask(raw)
+            raw_out = None
+        elif ftype == "size":
+            display = _fmt_size(raw)
+            raw_out = raw
+        elif ftype == "duration":
+            display = _fmt_duration(raw)
+            raw_out = raw
+        elif ftype == "boolean":
+            display = bool(raw)
+            raw_out = raw
+        elif ftype == "list":
+            val = raw or []
+            display = list(val) if not isinstance(val, list) else val
+            raw_out = display
+        else:
+            display = raw if raw is not None else ""
+            raw_out = raw
+        return {
+            "key": key,
+            "label": label,
+            "description": description,
+            "value": display,
+            "raw": raw_out,
+            "type": ftype,
+            "editable": editable,
+            "sensitive": sensitive,
+        }
+
+    # ---- Notification channels (complex, built separately) ----------------
+    notif_channels = []
+    for ch_name, ch_cfg in (config.get("notification_channels") or {}).items():
+        if not isinstance(ch_cfg, dict):
+            continue
+        ch_type = ch_cfg.get("type", "")
+        fields = []
+        for k, v in ch_cfg.items():
+            if k == "type":
+                continue
+            sensitive = k in _SECRET_KEYS
+            fields.append({
+                "key": k,
+                "label": k.replace("_", " ").title(),
+                "value": _mask(v) if sensitive else (
+                    ", ".join(v) if isinstance(v, list) else str(v)
+                ),
+                "sensitive": sensitive,
+            })
+        notif_channels.append({
+            "name": ch_name,
+            "type": ch_type,
+            "type_label": _CHANNEL_TYPE_LABELS.get(ch_type, ch_type.title()),
+            "fields": fields,
+        })
+
+    # ---- Users (show metadata only, never password hashes) ----------------
+    users_list = []
+    for username, attrs in (config.get("users") or {}).items():
+        if not isinstance(attrs, dict):
+            continue
+        users_list.append({
+            "username": username,
+            "full_name": attrs.get("full_name", ""),
+            "admin": bool(attrs.get("admin", False)),
+            "avatar": attrs.get("avatar", ""),
+            "notification_channels": attrs.get("notification_channels", []),
+        })
+
+    # ---- Hosts summary ----------------------------------------------------
+    hosts_list = []
+    for hname, hcfg in (config.get("hosts") or {}).items():
+        if not isinstance(hcfg, dict):
+            continue
+        hosts_list.append({
+            "name": hname,
+            "watch": bool(hcfg.get("watch", False)),
+            "dyndns": bool(hcfg.get("dyndns", False)),
+            "owner": hcfg.get("owner", ""),
+            "managers": hcfg.get("managers", []),
+            "monitors": hcfg.get("monitors", []),
+            "threshold_config": hcfg.get("threshold_config", ""),
+            "notification_channels": hcfg.get("notification_channels", []),
+        })
+
+    return [
+        {
+            "id": "network",
+            "title": "Network",
+            "description": "Ports and bind addresses for all server sockets.",
+            "fields": [
+                field("hb_port",  "Heartbeat UDP port",  "port",
+                      "UDP port the server listens on for heartbeat datagrams."),
+                field("hbd_host", "HTTP bind address",   "text",
+                      "Interface to bind the HTTP server to. Empty = all interfaces."),
+                field("hbd_port", "HTTP API port",       "port",
+                      "TCP port for the HTTP API and web UI."),
+                field("ws_port",  "WebSocket port",      "port",
+                      "TCP port for the plain WebSocket server."),
+                field("wss_port", "Secure WebSocket port", "port",
+                      "TCP port for WSS (TLS WebSocket). Leave empty to disable."),
+            ],
+        },
+        {
+            "id": "tls",
+            "title": "TLS / WebSocket Security",
+            "description": "Certificate paths used when wss_port is set.",
+            "fields": [
+                field("cert_path", "Certificate directory", "path",
+                      "Directory containing the TLS certificate and key files."),
+                field("wss_pem",   "Certificate file",     "text",
+                      "Filename of the TLS certificate chain (PEM format)."),
+                field("wss_key",   "Key file",             "text",
+                      "Filename of the TLS private key (PEM format)."),
+            ],
+        },
+        {
+            "id": "monitoring",
+            "title": "Monitoring",
+            "description": "Heartbeat timing and alert re-notification behaviour.",
+            "fields": [
+                field("interval",  "Heartbeat interval", "duration",
+                      "Expected time between heartbeat messages from each client."),
+                field("grace",     "Grace multiplier",   "number",
+                      "A host is marked overdue after interval × grace seconds of silence."),
+                field("threshold_renotify_interval", "Re-notify interval", "duration",
+                      "How often to re-send notifications for ongoing threshold alerts."),
+                field("autosave_interval", "Autosave interval", "duration",
+                      "How often the server saves its state to disk."),
+            ],
+        },
+        {
+            "id": "persistence",
+            "title": "Persistence & Logging",
+            "description": "State file and event log settings.",
+            "fields": [
+                field("pickfile", "State file",   "path",
+                      "Path to the pickle file used to persist host state across restarts."),
+                field("logfile",  "Event log",    "path",
+                      "Path to the event log file."),
+            ],
+        },
+        {
+            "id": "journal",
+            "title": "Message Journal",
+            "description": "All received heartbeat and plugin messages are journalled here.",
+            "fields": [
+                field("journal_enabled",     "Enabled",          "boolean",
+                      "Turn journalling on or off."),
+                field("journal_dir",         "Journal directory","path",
+                      "Directory where journal files are written."),
+                field("journal_file",        "Journal filename", "text",
+                      "Base filename for the journal (rotated copies get a numeric suffix)."),
+                field("journal_max_size",    "Max file size",    "size",
+                      "Rotate the journal when it exceeds this size."),
+                field("journal_max_backups", "Backup count",     "number",
+                      "Number of rotated journal files to keep."),
+            ],
+        },
+        {
+            "id": "dns",
+            "title": "Dynamic DNS",
+            "description": "nsupdate-based DNS registration for dynamic hosts.",
+            "fields": [
+                field("nsupdate_bin", "nsupdate binary", "path",
+                      "Full path to the nsupdate executable."),
+                field("dyndomains",   "Dynamic domains", "list",
+                      "DNS zones managed by nsupdate for dynamic hosts."),
+                field("drophosts",    "Drop hosts",      "list",
+                      "Hostnames to silently ignore — no state, no alerts."),
+            ],
+        },
+        {
+            "id": "users",
+            "title": "Users",
+            "description": "Accounts defined in the config file. Password hashes are never shown.",
+            "users": users_list,
+            "fields": [
+                field("default_owner", "Default owner", "text",
+                      "Username that owns hosts with no explicit owner. "
+                      "Falls back to the first admin user."),
+            ],
+        },
+        {
+            "id": "channels",
+            "title": "Notification Channels",
+            "description": "Named notification providers. Credentials are masked.",
+            "channels": notif_channels,
+            "fields": [
+                field("default_notification_channels", "Default channels", "list",
+                      "Channels used when a host does not specify its own."),
+            ],
+        },
+        {
+            "id": "hosts",
+            "title": "Hosts",
+            "description": "Host definitions loaded from the config file.",
+            "hosts": hosts_list,
+            "fields": [],
+        },
+        {
+            "id": "runtime",
+            "title": "Runtime",
+            "description": "Flags set at startup (require restart to change).",
+            "fields": [
+                field("foreground", "Foreground mode", "boolean",
+                      "Run in the foreground instead of daemonising."),
+                field("verbose",    "Verbose logging",  "boolean",
+                      "Enable verbose log output."),
+                field("debug",      "Debug level",      "number",
+                      "0 = off. Higher values increase log verbosity."),
+            ],
+        },
+    ]

hbd/server/static/style.css

@@ -140,3 +140,68 @@
       float: left;
   }
 
+/* ── Responsive / mobile ── */
+
+/* Suppress the global transition on mobile to avoid sluggish feel */
+@media (max-width: 640px) {
+  * { transition: none !important; }
+
+  html, body {
+    overflow: auto;
+    height: auto;
+    font-size: 16px;          /* prevent iOS auto-zoom on inputs */
+  }
+
+  /* Pages that use flex-column full-viewport layout need to relax on mobile */
+  body[style*="height: 100vh"],
+  body {
+    height: auto !important;
+    min-height: 100vh;
+  }
+
+  /* Containers: full width, no fixed heights */
+  .container {
+    max-width: 100% !important;
+    max-height: none !important;
+    overflow: visible !important;
+    padding: 8px !important;
+  }
+
+  /* Log section: fixed reasonable height instead of flex-grow */
+  .log-section {
+    flex: none !important;
+    max-height: 40vh !important;
+    overflow-y: auto !important;
+  }
+
+  /* Table section: allow vertical scroll, cap height */
+  .table-section {
+    max-height: 55vh !important;
+    overflow-y: auto !important;
+    overflow-x: auto !important;
+    padding: 8px !important;
+  }
+
+  /* Slightly larger tap targets in tables */
+  #ntable td, #ntable th {
+    padding: 4px 6px !important;
+    font-size: 0.82em !important;
+  }
+
+  /* Cards on plugin/alerts pages */
+  .host-card, .alert-card, .card {
+    padding: 10px !important;
+    margin-bottom: 8px !important;
+  }
+
+  /* Settings page tables */
+  table { width: 100%; }
+
+  h1 { font-size: 1.2em !important; }
+  h2 { font-size: 1em !important; }
+}
+
+/* Suppress nav-username text on very narrow screens — avatar/initials is enough */
+@media (max-width: 400px) {
+  .nav-username { display: none; }
+}

hbd/server/templates/alerts.html

@@ -8,30 +8,6 @@
       background: #f5f5f5;
     }
 
-    .nav {
-      background: #fff;
-      padding: 15px;
-      margin-bottom: 20px;
-      box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-      border-radius: 4px;
-    }
-
-    .nav a {
-      margin-right: 20px;
-      text-decoration: none;
-      color: #0066cc;
-      font-weight: 500;
-    }
-
-    .nav a:hover {
-      text-decoration: underline;
-    }
-
-    .nav a.active {
-      color: #333;
-      font-weight: bold;
-    }
-
     .container {
       max-width: 1400px;
       margin: 0 auto;
@@ -48,55 +24,40 @@
     }
 
     .summary-cards {
-      display: grid;
-      grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
-      gap: 20px;
-      margin-bottom: 30px;
+      display: flex;
+      flex-wrap: wrap;
+      gap: 10px;
+      margin-bottom: 16px;
     }
 
     .summary-card {
       background: white;
-      border-radius: 8px;
-      padding: 20px;
-      box-shadow: 0 2px 8px rgba(0,0,0,0.1);
-      text-align: center;
+      border-radius: 6px;
+      padding: 6px 14px;
+      box-shadow: 0 1px 4px rgba(0,0,0,0.1);
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      border-left: 4px solid #ddd;
     }
 
-    .summary-card.critical {
-      border-left: 5px solid #f44336;
-    }
-
-    .summary-card.warning {
-      border-left: 5px solid #ff9800;
-    }
-
-    .summary-card.ok {
-      border-left: 5px solid #4caf50;
-    }
+    .summary-card.critical { border-left-color: #f44336; }
+    .summary-card.warning  { border-left-color: #ff9800; }
+    .summary-card.ok       { border-left-color: #4caf50; }
 
     .summary-number {
-      font-size: 3em;
+      font-size: 1.4em;
       font-weight: bold;
-      margin: 10px 0;
+      line-height: 1;
     }
 
-    .summary-number.critical {
-      color: #f44336;
-    }
-
-    .summary-number.warning {
-      color: #ff9800;
-    }
-
-    .summary-number.ok {
-      color: #4caf50;
-    }
+    .summary-number.critical { color: #f44336; }
+    .summary-number.warning  { color: #ff9800; }
+    .summary-number.ok       { color: #4caf50; }
 
     .summary-label {
       color: #666;
-      text-transform: uppercase;
-      font-size: 0.9em;
-      letter-spacing: 1px;
+      font-size: 0.85em;
     }
 
     .filters {
@@ -327,11 +288,7 @@
   </style>
 
   <body>
-    <div class="nav">
-      <a href="/live">Live Dashboard</a>
-      <a href="/plugins">Plugin Metrics</a>
-      <a href="/alerts" class="active">Alerts</a>
-    </div>
+    {% include 'nav.html' %}
 
     <div class="container">
       <h1>{{ header }}</h1>

hbd/server/templates/head.html

@@ -1,7 +1,99 @@
 <head>
     <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="stylesheet" href="/static/style.css" type="text/css" />
     <link rel="icon" href="/static/images/favicon.ico" sizes="32x32" />
     <title>{{ title }}</title>
-    <script src="{{ extra_scripts }}"></script>
+    {% if extra_scripts %}<script src="{{ extra_scripts }}"></script>{% endif %}
+    <style>
+      /* Navigation bar — shared across all pages */
+      .nav {
+        background: #fff;
+        padding: 10px 15px;
+        margin-bottom: 10px;
+        box-shadow: 0 2px 4px rgba(0,0,0,.1);
+        border-radius: 4px;
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        flex-wrap: wrap;
+        gap: 8px;
+      }
+      .nav-links { display: flex; align-items: center; flex-wrap: wrap; gap: 4px; }
+      .nav a {
+        margin-right: 20px;
+        text-decoration: none;
+        color: #0066cc;
+        font-weight: 500;
+        font-size: 0.9em;
+      }
+      .nav a:hover { text-decoration: underline; }
+      .nav a.active { color: #333; font-weight: bold; }
+      .nav-user {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+        text-decoration: none;
+        color: #333;
+        font-size: 0.9em;
+        font-weight: 500;
+        padding: 4px 8px;
+        border-radius: 20px;
+        transition: background 0.15s;
+      }
+      .nav-user:hover { background: #f0f4ff; text-decoration: none; }
+      .nav-avatar {
+        width: 28px; height: 28px;
+        border-radius: 50%;
+        object-fit: cover;
+        flex-shrink: 0;
+      }
+      .nav-initials {
+        width: 28px; height: 28px;
+        border-radius: 50%;
+        background: #0066cc;
+        color: #fff;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        font-size: 0.75em;
+        font-weight: 700;
+        flex-shrink: 0;
+      }
+
+      /* ── Mobile nav: hamburger toggle ── */
+      .nav-hamburger {
+        display: none;
+        flex-direction: column;
+        justify-content: space-between;
+        width: 26px; height: 20px;
+        cursor: pointer;
+        flex-shrink: 0;
+        background: none;
+        border: none;
+        padding: 0;
+      }
+      .nav-hamburger span {
+        display: block;
+        height: 3px;
+        background: #555;
+        border-radius: 2px;
+      }
+
+      @media (max-width: 640px) {
+        .nav-hamburger { display: flex; }
+        .nav-links {
+          display: none;
+          width: 100%;
+          flex-direction: column;
+          align-items: flex-start;
+          padding-top: 8px;
+          border-top: 1px solid #eee;
+          order: 3;
+        }
+        .nav-links.nav-open { display: flex; }
+        .nav-links a { margin-right: 0; padding: 6px 0; font-size: 1em; }
+      }
+    </style>
+    <script src="static/sorttable.js"></script> 
 </head>

hbd/server/templates/live.html

@@ -4,42 +4,46 @@
 
   <style>
     body {
-      margin: 10px;
+      display: flex;
+      flex-direction: column;
+      height: 100vh;
+      box-sizing: border-box;
+      padding: 10px;
+      margin: 0;
       background: #f5f5f5;
       overflow: hidden;
     }
 
-    .nav {
-      background: #fff;
-      padding: 10px 15px;
-      margin-bottom: 10px;
-      box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-      border-radius: 4px;
-    }
-
-    .nav a {
-      margin-right: 20px;
-      text-decoration: none;
-      color: #0066cc;
-      font-weight: 500;
-      font-size: 0.9em;
-    }
-
-    .nav a:hover {
-      text-decoration: underline;
-    }
-
-    .nav a.active {
-      color: #333;
-      font-weight: bold;
+    @media (max-width: 640px) {
+      body {
+        height: auto;
+        min-height: 100vh;
+        overflow: auto;
+        flex-direction: column;
+      }
+      .container {
+        max-height: none;
+        overflow: visible;
+      }
+      .table-section {
+        max-height: 55vh;
+      }
+      .log-section {
+        flex: none;
+        max-height: 40vh;
+      }
     }
 
     .container {
+      flex: 1;
+      min-height: 0;
       max-width: 1600px;
+      width: 100%;
       margin: 0 auto;
-      max-height: calc(100vh - 120px);
-      overflow-y: auto;
-      padding-right: 10px;
+      display: flex;
+      flex-direction: column;
+      gap: 15px;
+      overflow: hidden;
     }
 
     h1 {
@@ -75,14 +79,18 @@
       border-radius: 6px;
       padding: 15px;
       box-shadow: 0 1px 4px rgba(0,0,0,0.1);
+      overflow-x: auto;
+      overflow-y: auto;
+      max-height: 60vh;
     }
 
     .log-section {
+      flex: 1;
+      min-height: 0;
       background: white;
       border-radius: 6px;
       padding: 15px;
       box-shadow: 0 1px 4px rgba(0,0,0,0.1);
-      max-height: 400px;
       overflow-y: auto;
     }
 
@@ -96,7 +104,8 @@
     #ntable th {
       border: 1px solid #e0e0e0;
       text-align: left;
-      padding: 8px 10px;
+      padding: 2px 4px;
+      white-space: nowrap;
     }
 
     #ntable tr:nth-child(even) {
@@ -107,8 +116,24 @@
       background-color: #e3f2fd;
     }
 
+    #ntable tbody tr.row-warning {
+      background-color: #fff8c5;
+    }
+
+    #ntable tbody tr.row-critical {
+      background-color: #fde8e8;
+    }
+
+    #ntable tbody tr.row-warning:hover {
+      background-color: #fff0a0;
+    }
+
+    #ntable tbody tr.row-critical:hover {
+      background-color: #f9c8c8;
+    }
+
     #ntable th {
-      padding: 12px 10px;
+      padding: 6px 8px;
       background-color: #2196f3;
       color: white;
       font-weight: 600;
@@ -137,24 +162,20 @@
     }
 
     /* Scrollbar styling */
-    .container::-webkit-scrollbar,
     .log-section::-webkit-scrollbar {
       width: 8px;
     }
 
-    .container::-webkit-scrollbar-track,
     .log-section::-webkit-scrollbar-track {
       background: #f1f1f1;
       border-radius: 4px;
     }
 
-    .container::-webkit-scrollbar-thumb,
     .log-section::-webkit-scrollbar-thumb {
       background: #888;
       border-radius: 4px;
     }
 
-    .container::-webkit-scrollbar-thumb:hover,
     .log-section::-webkit-scrollbar-thumb:hover {
       background: #555;
     }
@@ -162,7 +183,7 @@
     /* Message styling */
     #messages {
       font-size: 0.85em;
-      line-height: 1.6;
+      line-height: 1.0;
     }
 
     #messages div {
@@ -224,15 +245,37 @@
     var nTable = document;
     var name_idx = {};
     var c = 0;
+    var HBD_VERSION = "{{ hbd_version }}";
+
+    function hostNameHtml(data) {
+      var nameHtml = data.name;
+      if (!data.hbc_version || data.hbc_version !== HBD_VERSION) {
+        nameHtml += ' 🥀';
+      }
+      return data.dyn ? '<b>' + nameHtml + '</b>' : nameHtml;
+    }
 
     function setup() {
       name_idx = {};
       nTable = document.getElementById("ntable");
       for (var i = 0, row; (row = nTable.rows[i]); i++) {
         if (i == 0) continue;
-        name = nTable.rows[i].cells[0].innerText;
+        var cell = nTable.rows[i].cells[0];
+        var name = cell.dataset.name || cell.innerText.replace(/\s*🥀\s*$/, '').trim();
         name_idx[name] = nTable.rows[i];
-        /* console.log("name_Id[" + name + "]: " + name_idx[name].innerText); */
+      }
+    }
+
+    function updateRowAlert(row, data) {
+      var criticalUnacked = data.alert_critical_unacked || 0;
+      var criticalAcked = data.alert_critical_acked || 0;
+      var warningUnacked = data.alert_warning_unacked || 0;
+      var warningAcked = data.alert_warning_acked || 0;
+      row.classList.remove('row-warning', 'row-critical');
+      if (criticalUnacked > 0 || criticalAcked > 0) {
+        row.classList.add('row-critical');
+      } else if (warningUnacked > 0 || warningAcked > 0) {
+        row.classList.add('row-warning');
       }
     }
 
@@ -270,11 +313,8 @@
       row.appendChild(c_ipv6state);
       row.appendChild(c_ipv6latency);
       row.appendChild(c_ipv6statets);
-      if (data.dyn) {
-        c_name.innerHTML = "<b>" + data.name + "</b>";
-      } else {
-        c_name.innerHTML = data.name;
-      }
+      c_name.dataset.name = data.name;
+      c_name.innerHTML = hostNameHtml(data);
       
       // Set alert counts in "x/y" format (unacked/acked)
       var warningUnacked = data.alert_warning_unacked || 0;
@@ -303,12 +343,31 @@
       var table = document.getElementById("ntablebody"); // find table to append to
       table.appendChild(row); // append row to table
       name_idx[c_name] = row;
+      updateRowAlert(row, data);
     }
 
     function formatTS(ts) {
-      const milliseconds = ts * 1000;
-      const dateObject = new Date(milliseconds);
-      return dateObject.toLocaleString("de-DE");
+      const now = new Date();
+      const d = new Date(ts * 1000);
+
+      const pad = n => String(n).padStart(2, '0');
+      const timeStr = `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
+
+      // Same calendar day → show time only
+      if (d.toDateString() === now.toDateString()) {
+        return timeStr;
+      }
+
+      // Within 8 days → show "-X d hh:mm:ss"
+      const todayStart = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+      const dStart = new Date(d.getFullYear(), d.getMonth(), d.getDate());
+      const diffDays = Math.round((todayStart - dStart) / 86400000);
+      if (diffDays < 8) {
+        return `-${diffDays}d ${timeStr}`;
+      }
+
+      // Older → date only
+      return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
     }
 
     function update_table(data) {
@@ -317,6 +376,11 @@
         setup();
       }
       
+      // Update name cell (version indicator)
+      var nameCell = name_idx[data.name].cells[0];
+      nameCell.dataset.name = data.name;
+      nameCell.innerHTML = hostNameHtml(data);
+
       // Update warning and critical counts in "x/y" format (unacked/acked)
       var warningUnacked = data.alert_warning_unacked || 0;
       var warningAcked = data.alert_warning_acked || 0;
@@ -364,6 +428,7 @@
         name_idx[data.name].cells[4 + i * 4].innerHTML = state;
         name_idx[data.name].cells[5 + i * 4].innerHTML = latency;
       }
+      updateRowAlert(name_idx[data.name], data);
     }
 
     function WS_Connect() {
@@ -419,11 +484,7 @@
     WS_Connect();
   </script>
   <body>
-    <div class="nav">
-      <a href="/live" class="active">Live Dashboard</a>
-      <a href="/plugins">Plugin Metrics</a>
-      <a href="/alerts">Alerts</a>
-    </div>
+    {% include 'nav.html' %}
 
     {% include 'menu.html' %}
 
@@ -450,8 +511,8 @@
           </thead>
           <tbody id="ntablebody">
             {% for host in hosts %}
-            <tr>
-              <td>{{ host.name }}</td>
+            <tr class="{% if host.alert_critical_unacked > 0 or host.alert_critical_acked > 0 %}row-critical{% elif host.alert_warning_unacked > 0 or host.alert_warning_acked > 0 %}row-warning{% endif %}">
+              <td data-name="{{ host.name }}">{{ host.name }}{% if not host.hbc_version or host.hbc_version != hbd_version %} 🥀{% endif %}</td>
               <td style="text-align: center; color: #ff9800; font-weight: bold;">
                 {%- set warning_unacked = host.alert_warning_unacked -%}
                 {%- set warning_acked = host.alert_warning_acked -%}

hbd/server/templates/menu.html

@@ -1,3 +1,2 @@
 <!-- <label for="drawer-toggle" id="drawer-toggle-label"></label>
 s<header>{{ header }}</header> -->
-

hbd/server/templates/nav.html

@@ -0,0 +1,35 @@
+<div class="nav">
+  <button class="nav-hamburger" id="nav-hamburger-btn" aria-label="Menu" aria-expanded="false">
+    <span></span><span></span><span></span>
+  </button>
+  <div class="nav-links" id="nav-links">
+    <a href="/live"{% if active_page == "live" %} class="active"{% endif %}>Live Dashboard</a>
+    <a href="/plugins"{% if active_page == "plugins" %} class="active"{% endif %}>Plugin Metrics</a>
+    <a href="/alerts"{% if active_page == "alerts" %} class="active"{% endif %}>Alerts</a>
+    {% if current_user and current_user.admin %}
+    <a href="/settings"{% if active_page == "settings" %} class="active"{% endif %}>Settings</a>
+    {% endif %}
+  </div>
+  {% if current_user %}
+  <a href="/profile" class="nav-user{% if active_page == 'profile' %} active{% endif %}" title="{{ current_user.full_name or current_user.username }}">
+    {% if current_user.avatar %}
+    <img class="nav-avatar" src="{{ current_user.avatar_url }}" alt="{{ current_user.full_name or current_user.username }}">
+    {% else %}
+    <span class="nav-initials">{{ (current_user.full_name or current_user.username)[:1] | upper }}</span>
+    {% endif %}
+    <span class="nav-username">{{ current_user.full_name or current_user.username }}</span>
+  </a>
+  {% endif %}
+</div>
+<script>
+  (function() {
+    var btn = document.getElementById('nav-hamburger-btn');
+    var links = document.getElementById('nav-links');
+    if (btn && links) {
+      btn.addEventListener('click', function() {
+        var open = links.classList.toggle('nav-open');
+        btn.setAttribute('aria-expanded', open ? 'true' : 'false');
+      });
+    }
+  })();
+</script>

hbd/server/templates/plugins.html

@@ -9,31 +9,6 @@
       overflow: hidden;
     }
 
-    .nav {
-      background: #fff;
-      padding: 10px 15px;
-      margin-bottom: 10px;
-      box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-      border-radius: 4px;
-    }
-
-    .nav a {
-      margin-right: 20px;
-      text-decoration: none;
-      color: #0066cc;
-      font-weight: 500;
-      font-size: 0.9em;
-    }
-
-    .nav a:hover {
-      text-decoration: underline;
-    }
-
-    .nav a.active {
-      color: #333;
-      font-weight: bold;
-    }
-
     .container {
       max-width: 1400px;
       margin: 0 auto;
@@ -357,11 +332,7 @@
   </style>
 
   <body>
-    <div class="nav">
-      <a href="/live">Live Dashboard</a>
-      <a href="/plugins" class="active">Plugin Metrics</a>
-      <a href="/alerts">Alerts</a>
-    </div>
+    {% include 'nav.html' %}
 
     <div class="container">
       <h1>{{ header }}</h1>

hbd/server/templates/profile.html

@@ -0,0 +1,338 @@
+<!DOCTYPE html>
+<html>
+  {% include 'head.html' %}
+
+  <style>
+    html, body {
+      overflow: visible;
+    }
+
+    body {
+      margin: 20px;
+      background: #f5f5f5;
+      font-family: 'Segoe UI', system-ui, sans-serif;
+    }
+
+    .container {
+      max-width: 900px;
+      margin: 0 auto;
+    }
+
+    h1 {
+      color: #333;
+      margin-bottom: 4px;
+      font-size: 1.5em;
+    }
+
+    .subtitle {
+      color: #666;
+      margin-bottom: 24px;
+      font-size: 0.9em;
+    }
+
+    /* ---- Profile card ---- */
+    .profile-card {
+      background: #fff;
+      border-radius: 8px;
+      box-shadow: 0 1px 6px rgba(0,0,0,0.1);
+      padding: 28px 32px;
+      margin-bottom: 24px;
+      display: flex;
+      align-items: center;
+      gap: 28px;
+    }
+
+    .avatar-large {
+      width: 80px;
+      height: 80px;
+      border-radius: 50%;
+      object-fit: cover;
+      flex-shrink: 0;
+      box-shadow: 0 2px 8px rgba(0,0,0,0.15);
+    }
+
+    .avatar-initials-large {
+      width: 80px;
+      height: 80px;
+      border-radius: 50%;
+      background: #0066cc;
+      color: #fff;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 2em;
+      font-weight: 700;
+      flex-shrink: 0;
+      box-shadow: 0 2px 8px rgba(0,0,0,0.15);
+    }
+
+    .profile-info { flex: 1; }
+
+    .profile-name {
+      font-size: 1.4em;
+      font-weight: 700;
+      color: #222;
+      margin-bottom: 4px;
+    }
+
+    .profile-username {
+      font-size: 0.9em;
+      color: #666;
+      margin-bottom: 10px;
+    }
+
+    .badge {
+      display: inline-block;
+      padding: 2px 10px;
+      border-radius: 12px;
+      font-size: 0.78em;
+      font-weight: 600;
+      text-transform: uppercase;
+      letter-spacing: 0.4px;
+    }
+
+    .badge-admin { background: #e8f0fe; color: #1a73e8; }
+    .badge-user  { background: #f1f3f4; color: #555; }
+
+    .profile-logout {
+      margin-top: 14px;
+    }
+
+    .btn-logout {
+      display: inline-block;
+      padding: 6px 16px;
+      border-radius: 4px;
+      background: #f44336;
+      color: #fff;
+      font-size: 0.85em;
+      font-weight: 500;
+      text-decoration: none;
+      transition: background 0.15s;
+    }
+    .btn-logout:hover { background: #d32f2f; text-decoration: none; }
+
+    /* ---- Section cards ---- */
+    .section {
+      background: #fff;
+      border-radius: 8px;
+      box-shadow: 0 1px 6px rgba(0,0,0,0.1);
+      padding: 20px 24px;
+      margin-bottom: 20px;
+    }
+
+    .section h2 {
+      font-size: 1em;
+      font-weight: 700;
+      color: #333;
+      margin: 0 0 16px;
+      padding-bottom: 10px;
+      border-bottom: 1px solid #eee;
+      text-transform: uppercase;
+      letter-spacing: 0.5px;
+    }
+
+    /* ---- Settings rows ---- */
+    .settings-row {
+      display: flex;
+      align-items: baseline;
+      padding: 8px 0;
+      border-bottom: 1px solid #f5f5f5;
+      font-size: 0.9em;
+    }
+    .settings-row:last-child { border-bottom: none; }
+
+    .settings-label {
+      width: 180px;
+      flex-shrink: 0;
+      color: #666;
+      font-size: 0.88em;
+    }
+
+    .settings-value { color: #222; }
+
+    .settings-empty { color: #aaa; font-style: italic; }
+
+    /* ---- Host lists ---- */
+    .host-grid {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 8px;
+    }
+
+    .host-chip {
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
+      padding: 4px 12px;
+      border-radius: 16px;
+      font-size: 0.85em;
+      font-weight: 500;
+      text-decoration: none;
+    }
+
+    .host-chip.owner   { background: #e8f5e9; color: #2e7d32; }
+    .host-chip.manager { background: #e3f2fd; color: #1565c0; }
+    .host-chip.monitor { background: #f3e5f5; color: #6a1b9a; }
+
+    .host-chip-dot {
+      width: 7px; height: 7px; border-radius: 50%;
+    }
+    .owner   .host-chip-dot { background: #2e7d32; }
+    .manager .host-chip-dot { background: #1565c0; }
+    .monitor .host-chip-dot { background: #6a1b9a; }
+
+    .no-hosts {
+      color: #aaa;
+      font-size: 0.9em;
+      font-style: italic;
+    }
+
+    /* ---- Notification channels ---- */
+    .channel-row {
+      display: flex;
+      align-items: center;
+      gap: 10px;
+      padding: 6px 0;
+      border-bottom: 1px solid #f5f5f5;
+      font-size: 0.9em;
+    }
+    .channel-row:last-child { border-bottom: none; }
+
+    .channel-type {
+      display: inline-block;
+      padding: 2px 8px;
+      border-radius: 10px;
+      font-size: 0.78em;
+      font-weight: 600;
+      text-transform: uppercase;
+      background: #f1f3f4;
+      color: #555;
+      min-width: 70px;
+      text-align: center;
+    }
+
+    .channel-name { color: #333; }
+  </style>
+
+  <body>
+    {% include 'nav.html' %}
+
+    <div class="container">
+      <h1>{{ header }}</h1>
+      <p class="subtitle">Your account settings and host access</p>
+
+      <!-- Profile card -->
+      <div class="profile-card">
+        {% if current_user and current_user.avatar %}
+        <img class="avatar-large" src="{{ current_user.avatar_url }}" alt="">
+        {% else %}
+        <div class="avatar-initials-large">
+          {{ ((current_user.full_name if current_user else '') or (current_user.username if current_user else '?'))[:1] | upper }}
+        </div>
+        {% endif %}
+
+        <div class="profile-info">
+          <div class="profile-name">{{ current_user.full_name if current_user and current_user.full_name else (current_user.username if current_user else '—') }}</div>
+          <div class="profile-username">@{{ current_user.username if current_user else '—' }}</div>
+          {% if current_user and current_user.admin %}
+          <span class="badge badge-admin">Admin</span>
+          {% else %}
+          <span class="badge badge-user">User</span>
+          {% endif %}
+          <div class="profile-logout">
+            <a href="/logout" class="btn-logout">Sign out</a>
+          </div>
+        </div>
+      </div>
+
+      <!-- Account settings -->
+      <div class="section">
+        <h2>Account</h2>
+        <div class="settings-row">
+          <span class="settings-label">Username</span>
+          <span class="settings-value">{{ current_user.username if current_user else '—' }}</span>
+        </div>
+        <div class="settings-row">
+          <span class="settings-label">Full name</span>
+          {% if current_user and current_user.full_name %}
+          <span class="settings-value">{{ current_user.full_name }}</span>
+          {% else %}
+          <span class="settings-empty">Not set</span>
+          {% endif %}
+        </div>
+        <div class="settings-row">
+          <span class="settings-label">Role</span>
+          <span class="settings-value">{{ 'Administrator' if current_user and current_user.admin else 'User' }}</span>
+        </div>
+        <div class="settings-row">
+          <span class="settings-label">Avatar</span>
+          {% if current_user and current_user.avatar %}
+          <span class="settings-value" style="word-break:break-all;">{{ current_user.avatar }}</span>
+          {% else %}
+          <span class="settings-empty">Not set (initials used)</span>
+          {% endif %}
+        </div>
+      </div>
+
+      <!-- Notification channels -->
+      <div class="section">
+        <h2>Notification Channels</h2>
+        {% if notification_channels %}
+        {% for ch in notification_channels %}
+        <div class="channel-row">
+          <span class="channel-type">{{ ch.type }}</span>
+          <span class="channel-name">{{ ch.name }}</span>
+        </div>
+        {% endfor %}
+        {% else %}
+        <span class="no-hosts">No personal notification channels configured.</span>
+        {% endif %}
+      </div>
+
+      <!-- Host access -->
+      <div class="section">
+        <h2>Host Access</h2>
+
+        <div class="settings-row" style="align-items: flex-start; padding-bottom: 14px;">
+          <span class="settings-label" style="padding-top: 2px;">Owner</span>
+          <div class="host-grid">
+            {% if owned_hosts %}
+            {% for h in owned_hosts %}
+            <span class="host-chip owner"><span class="host-chip-dot"></span>{{ h }}</span>
+            {% endfor %}
+            {% else %}
+            <span class="no-hosts">None</span>
+            {% endif %}
+          </div>
+        </div>
+
+        <div class="settings-row" style="align-items: flex-start; padding-bottom: 14px;">
+          <span class="settings-label" style="padding-top: 2px;">Manager</span>
+          <div class="host-grid">
+            {% if managed_hosts %}
+            {% for h in managed_hosts %}
+            <span class="host-chip manager"><span class="host-chip-dot"></span>{{ h }}</span>
+            {% endfor %}
+            {% else %}
+            <span class="no-hosts">None</span>
+            {% endif %}
+          </div>
+        </div>
+
+        <div class="settings-row" style="align-items: flex-start; padding-bottom: 4px;">
+          <span class="settings-label" style="padding-top: 2px;">Monitor</span>
+          <div class="host-grid">
+            {% if monitored_hosts %}
+            {% for h in monitored_hosts %}
+            <span class="host-chip monitor"><span class="host-chip-dot"></span>{{ h }}</span>
+            {% endfor %}
+            {% else %}
+            <span class="no-hosts">None</span>
+            {% endif %}
+          </div>
+        </div>
+      </div>
+
+    </div>
+  </body>
+</html>

hbd/server/templates/settings.html

@@ -0,0 +1,499 @@
+<!DOCTYPE html>
+<html>
+  {% include 'head.html' %}
+
+  <style>
+    html, body {
+      overflow: visible;
+    }
+
+    body {
+      margin: 20px;
+      background: #f5f5f5;
+      font-family: 'Segoe UI', system-ui, sans-serif;
+    }
+
+    .container {
+      max-width: 960px;
+      margin: 0 auto;
+    }
+
+    h1 { color: #333; margin-bottom: 4px; font-size: 1.5em; }
+    .subtitle { color: #666; margin-bottom: 24px; font-size: 0.9em; }
+
+    /* ---- Sidebar + content layout ---- */
+    .settings-layout {
+      display: flex;
+      gap: 24px;
+      align-items: flex-start;
+    }
+
+    .settings-sidebar {
+      width: 180px;
+      flex-shrink: 0;
+      position: sticky;
+      top: 20px;
+    }
+
+    .sidebar-nav a {
+      display: block;
+      padding: 6px 10px;
+      border-radius: 4px;
+      text-decoration: none;
+      font-size: 0.85em;
+      color: #444;
+      margin-bottom: 2px;
+      transition: background 0.1s, color 0.1s;
+    }
+    .sidebar-nav a:hover { background: #e8eaf6; color: #1a237e; }
+    .sidebar-nav a.active { background: #e3f2fd; color: #0066cc; font-weight: 600; }
+
+    .settings-main { flex: 1; min-width: 0; }
+
+    /* ---- Section card ---- */
+    .section {
+      background: #fff;
+      border-radius: 8px;
+      box-shadow: 0 1px 4px rgba(0,0,0,.08);
+      margin-bottom: 24px;
+      overflow: hidden;
+    }
+
+    .section-header {
+      padding: 14px 20px 12px;
+      border-bottom: 1px solid #eee;
+    }
+
+    .section-title {
+      font-size: 0.95em;
+      font-weight: 700;
+      color: #222;
+      text-transform: uppercase;
+      letter-spacing: 0.5px;
+      margin: 0 0 3px;
+    }
+
+    .section-desc {
+      font-size: 0.82em;
+      color: #888;
+      margin: 0;
+    }
+
+    /* ---- Field rows ---- */
+    .field-row {
+      display: flex;
+      align-items: baseline;
+      padding: 10px 20px;
+      border-bottom: 1px solid #f5f5f5;
+      gap: 16px;
+    }
+    .field-row:last-child { border-bottom: none; }
+
+    .field-label {
+      width: 200px;
+      flex-shrink: 0;
+      font-size: 0.88em;
+      font-weight: 500;
+      color: #444;
+    }
+
+    .field-body { flex: 1; min-width: 0; }
+
+    .field-value {
+      font-size: 0.9em;
+      color: #222;
+      word-break: break-all;
+    }
+
+    .field-desc {
+      font-size: 0.78em;
+      color: #999;
+      margin-top: 2px;
+    }
+
+    /* ---- Value type renderers ---- */
+    .val-boolean {
+      display: inline-block;
+      padding: 2px 9px;
+      border-radius: 10px;
+      font-size: 0.8em;
+      font-weight: 600;
+    }
+    .val-boolean.on  { background: #e8f5e9; color: #2e7d32; }
+    .val-boolean.off { background: #fce4ec; color: #c62828; }
+
+    .val-masked {
+      font-family: monospace;
+      color: #bbb;
+      letter-spacing: 2px;
+    }
+
+    .val-list { display: flex; flex-wrap: wrap; gap: 5px; }
+    .val-tag {
+      display: inline-block;
+      padding: 2px 9px;
+      background: #e8eaf6;
+      color: #283593;
+      border-radius: 10px;
+      font-size: 0.8em;
+    }
+    .val-empty { color: #ccc; font-style: italic; font-size: 0.88em; }
+
+    /* ---- Users table ---- */
+    .mini-table {
+      width: 100%;
+      border-collapse: collapse;
+      font-size: 0.875em;
+    }
+    .mini-table th {
+      background: #f5f5f5;
+      padding: 7px 12px;
+      text-align: left;
+      font-weight: 600;
+      color: #555;
+      font-size: 0.82em;
+      text-transform: uppercase;
+      letter-spacing: 0.4px;
+      border-bottom: 1px solid #e0e0e0;
+    }
+    .mini-table td {
+      padding: 7px 12px;
+      border-bottom: 1px solid #f0f0f0;
+      color: #333;
+      vertical-align: middle;
+    }
+    .mini-table tbody tr:last-child td { border-bottom: none; }
+    .mini-table tbody tr:hover { background: #fafafa; }
+
+    .badge {
+      display: inline-block;
+      padding: 1px 8px;
+      border-radius: 10px;
+      font-size: 0.75em;
+      font-weight: 600;
+    }
+    .badge-admin { background: #e8f0fe; color: #1a73e8; }
+    .badge-user  { background: #f1f3f4; color: #666; }
+
+    /* ---- Notification channels ---- */
+    .channel-card {
+      border: 1px solid #e8eaf6;
+      border-radius: 6px;
+      margin: 12px 20px;
+      overflow: hidden;
+    }
+
+    .channel-header {
+      display: flex;
+      align-items: center;
+      gap: 10px;
+      padding: 9px 14px;
+      background: #f8f9ff;
+      border-bottom: 1px solid #e8eaf6;
+    }
+
+    .channel-name-text { font-weight: 600; font-size: 0.9em; color: #222; }
+
+    .ch-type-badge {
+      padding: 2px 8px;
+      border-radius: 8px;
+      font-size: 0.75em;
+      font-weight: 600;
+      background: #e8eaf6;
+      color: #3949ab;
+    }
+
+    .channel-fields { padding: 6px 0; }
+
+    .channel-field {
+      display: flex;
+      padding: 5px 14px;
+      font-size: 0.85em;
+      border-bottom: 1px solid #f5f5f5;
+      gap: 12px;
+    }
+    .channel-field:last-child { border-bottom: none; }
+    .channel-field-label { width: 130px; flex-shrink: 0; color: #777; }
+    .channel-field-value { color: #333; word-break: break-all; }
+
+    /* ---- Hosts table ---- */
+    /* ---- Mobile: collapsible sidebar ---- */
+    .sidebar-toggle {
+      display: none;
+      width: 100%;
+      padding: 8px 12px;
+      background: #e8eaf6;
+      border: none;
+      border-radius: 6px;
+      font-size: 0.9em;
+      font-weight: 600;
+      color: #283593;
+      cursor: pointer;
+      text-align: left;
+      margin-bottom: 16px;
+    }
+    .sidebar-toggle::after { content: ' ▾'; float: right; }
+    .sidebar-toggle.open::after { content: ' ▴'; }
+
+    @media (max-width: 640px) {
+      .sidebar-toggle { display: block; }
+
+      .settings-layout { flex-direction: column; gap: 0; }
+
+      .settings-sidebar {
+        width: 100%;
+        position: static;
+        margin-bottom: 0;
+      }
+
+      .sidebar-nav {
+        display: none;
+        background: white;
+        border-radius: 6px;
+        box-shadow: 0 1px 4px rgba(0,0,0,.1);
+        margin-bottom: 16px;
+        padding: 4px 0;
+      }
+      .sidebar-nav.open { display: block; }
+      .sidebar-nav a { padding: 10px 16px; font-size: 1em; }
+
+      .field-row { flex-direction: column; gap: 4px; }
+      .field-label { width: 100%; font-size: 0.82em; color: #888; }
+    }
+    .host-bool { text-align: center; }
+    .dot-yes { color: #2e7d32; font-size: 1.1em; }
+    .dot-no  { color: #ddd;    font-size: 1.1em; }
+  </style>
+
+  <body>
+    {% include 'nav.html' %}
+
+    <div class="container">
+      <h1>Settings</h1>
+      <p class="subtitle">Current server configuration — read from the config file at startup.</p>
+
+      <div class="settings-layout">
+
+        <!-- Sidebar navigation -->
+        <nav class="settings-sidebar">
+          <button class="sidebar-toggle" id="sidebar-toggle" aria-expanded="false">Sections</button>
+          <div class="sidebar-nav" id="sidebar-nav">
+            {% for section in sections %}
+            <a href="#{{ section.id }}" onclick="closeSidebar()">{{ section.title }}</a>
+            {% endfor %}
+          </div>
+        </nav>
+
+        <!-- Main content -->
+        <div class="settings-main">
+          {% for section in sections %}
+          <div class="section" id="{{ section.id }}">
+            <div class="section-header">
+              <p class="section-title">{{ section.title }}</p>
+              {% if section.description %}<p class="section-desc">{{ section.description }}</p>{% endif %}
+            </div>
+
+            {# ---- Standard field rows ---- #}
+            {% for f in section.fields %}
+            <div class="field-row">
+              <div class="field-label">{{ f.label }}</div>
+              <div class="field-body">
+                {% if f.sensitive %}
+                  <div class="field-value"><span class="val-masked">••••••••</span></div>
+                {% elif f.type == "boolean" %}
+                  <div class="field-value">
+                    <span class="val-boolean {{ 'on' if f.value else 'off' }}">
+                      {{ 'Enabled' if f.value else 'Disabled' }}
+                    </span>
+                  </div>
+                {% elif f.type == "list" %}
+                  <div class="field-value">
+                    {% if f.value %}
+                    <span class="val-list">
+                      {% for item in f.value %}<span class="val-tag">{{ item }}</span>{% endfor %}
+                    </span>
+                    {% else %}
+                    <span class="val-empty">None</span>
+                    {% endif %}
+                  </div>
+                {% elif f.value is none or f.value == "" %}
+                  <div class="field-value"><span class="val-empty">Not set</span></div>
+                {% else %}
+                  <div class="field-value">{{ f.value }}</div>
+                {% endif %}
+                {% if f.description %}
+                <div class="field-desc">{{ f.description }}</div>
+                {% endif %}
+              </div>
+            </div>
+            {% endfor %}
+
+            {# ---- Users section ---- #}
+            {% if section.id == "users" and section.users %}
+            <div style="padding: 0 0 4px;">
+              <table class="mini-table">
+                <thead>
+                  <tr>
+                    <th>Username</th>
+                    <th>Full Name</th>
+                    <th>Role</th>
+                    <th>Avatar</th>
+                    <th>Channels</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {% for u in section.users %}
+                  <tr>
+                    <td><strong>{{ u.username }}</strong></td>
+                    <td>{{ u.full_name or '—' }}</td>
+                    <td>
+                      {% if u.admin %}
+                      <span class="badge badge-admin">Admin</span>
+                      {% else %}
+                      <span class="badge badge-user">User</span>
+                      {% endif %}
+                    </td>
+                    <td style="font-size:0.8em; color:#888;">
+                      {% if u.avatar %}{{ u.avatar }}{% else %}—{% endif %}
+                    </td>
+                    <td>
+                      {% if u.notification_channels %}
+                      <span class="val-list">
+                        {% for ch in u.notification_channels %}
+                        <span class="val-tag">{{ ch }}</span>
+                        {% endfor %}
+                      </span>
+                      {% else %}—{% endif %}
+                    </td>
+                  </tr>
+                  {% endfor %}
+                </tbody>
+              </table>
+            </div>
+            {% endif %}
+
+            {# ---- Notification channels section ---- #}
+            {% if section.id == "channels" %}
+            {% for ch in section.channels %}
+            <div class="channel-card">
+              <div class="channel-header">
+                <span class="channel-name-text">{{ ch.name }}</span>
+                <span class="ch-type-badge">{{ ch.type_label }}</span>
+              </div>
+              <div class="channel-fields">
+                {% for cf in ch.fields %}
+                <div class="channel-field">
+                  <span class="channel-field-label">{{ cf.label }}</span>
+                  <span class="channel-field-value">
+                    {% if cf.sensitive %}
+                    <span class="val-masked">••••••••</span>
+                    {% elif cf.value is iterable and cf.value is not string %}
+                    {{ cf.value | join(', ') }}
+                    {% else %}
+                    {{ cf.value }}
+                    {% endif %}
+                  </span>
+                </div>
+                {% endfor %}
+              </div>
+            </div>
+            {% endfor %}
+            {% if not section.channels %}
+            <div class="field-row"><span class="val-empty">No notification channels configured.</span></div>
+            {% endif %}
+            {% endif %}
+
+            {# ---- Hosts section ---- #}
+            {% if section.id == "hosts" %}
+            {% if section.hosts %}
+            <div style="overflow-x: auto;">
+              <table class="mini-table">
+                <thead>
+                  <tr>
+                    <th>Host</th>
+                    <th>Watch</th>
+                    <th>DynDNS</th>
+                    <th>Owner</th>
+                    <th>Threshold config</th>
+                    <th>Channels</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {% for h in section.hosts %}
+                  <tr>
+                    <td><strong>{{ h.name }}</strong></td>
+                    <td class="host-bool">
+                      <span class="{{ 'dot-yes' if h.watch else 'dot-no' }}">●</span>
+                    </td>
+                    <td class="host-bool">
+                      <span class="{{ 'dot-yes' if h.dyndns else 'dot-no' }}">●</span>
+                    </td>
+                    <td>{{ h.owner or '—' }}</td>
+                    <td>{{ h.threshold_config or '—' }}</td>
+                    <td>
+                      {% if h.notification_channels %}
+                      <span class="val-list">
+                        {% for ch in h.notification_channels %}
+                        <span class="val-tag">{{ ch }}</span>
+                        {% endfor %}
+                      </span>
+                      {% else %}—{% endif %}
+                    </td>
+                  </tr>
+                  {% endfor %}
+                </tbody>
+              </table>
+            </div>
+            {% else %}
+            <div class="field-row"><span class="val-empty">No hosts defined in config.</span></div>
+            {% endif %}
+            {% endif %}
+
+          </div>{# /section #}
+          {% endfor %}
+        </div>{# /settings-main #}
+      </div>{# /settings-layout #}
+    </div>{# /container #}
+
+    <script>
+      // Highlight sidebar link for the section currently in view
+      const sections = document.querySelectorAll('.section');
+      const navLinks = document.querySelectorAll('.sidebar-nav a');
+
+      const observer = new IntersectionObserver(entries => {
+        entries.forEach(entry => {
+          if (entry.isIntersecting) {
+            const id = entry.target.id;
+            navLinks.forEach(a => {
+              a.classList.toggle('active', a.getAttribute('href') === '#' + id);
+            });
+          }
+        });
+      }, { threshold: 0.25 });
+
+      sections.forEach(s => observer.observe(s));
+
+      // Collapsible sidebar on mobile
+      var sidebarToggle = document.getElementById('sidebar-toggle');
+      var sidebarNav = document.getElementById('sidebar-nav');
+      if (sidebarToggle && sidebarNav) {
+        sidebarToggle.addEventListener('click', function() {
+          var open = sidebarNav.classList.toggle('open');
+          sidebarToggle.classList.toggle('open', open);
+          sidebarToggle.setAttribute('aria-expanded', open ? 'true' : 'false');
+        });
+      }
+    </script>
+    <script>
+      function closeSidebar() {
+        var sidebarNav = document.getElementById('sidebar-nav');
+        var sidebarToggle = document.getElementById('sidebar-toggle');
+        if (sidebarNav) { sidebarNav.classList.remove('open'); }
+        if (sidebarToggle) {
+          sidebarToggle.classList.remove('open');
+          sidebarToggle.setAttribute('aria-expanded', 'false');
+        }
+      }
+    </script>
+  </body>
+</html>

hbd/server/threshold.py

@@ -14,6 +14,7 @@ import time
 from enum import Enum
 from typing import Dict, Any, Optional, Tuple, Callable
 from . import notify as notify_mod
+from .config import THRESHOLD_DEFAULTS
 
 logger = logging.getLogger(__name__)
 eventlog = notify_mod.eventlog
@@ -58,6 +59,7 @@ class AlertState:
         self.formatted_message = None  # Formatted display message for UI
         self.acknowledged = False  # Whether alert has been acknowledged
         self.acknowledged_at = None  # Timestamp when acknowledged
+        self.consecutive_count = 0  # Consecutive exceedances while still OK (for count gating)
     
     def update(
         self, 
@@ -118,8 +120,11 @@ class AlertState:
         
         # Helper to sanitize numeric values for JSON (handle inf/nan)
         def sanitize_value(val):
-            if isinstance(val, float) and (math.isinf(val) or math.isnan(val)):
-                return None
+            if isinstance(val, float):
+                if math.isinf(val):
+                    return "overdue"
+                if math.isnan(val):
+                    return None
             return val
         
         result = {
@@ -146,6 +151,12 @@ class AlertState:
         
         return result
     
+    def __setstate__(self, state):
+        """Restore from pickle, backfilling fields added after the pickle was written."""
+        self.__dict__.update(state)
+        if not hasattr(self, 'consecutive_count'):
+            self.consecutive_count = 0
+
     def acknowledge(self):
         """Acknowledge this alert to stop reminder notifications."""
         self.acknowledged = True
@@ -167,6 +178,7 @@ class ThresholdConfig:
         operator: str = ">",
         hysteresis: float = 0.0,
         enabled: bool = True,
+        count: int = 1,
     ):
         """
         Initialize threshold configuration.
@@ -178,6 +190,7 @@ class ThresholdConfig:
             operator: Comparison operator (>, >=, <, <=, ==, !=)
             hysteresis: Hysteresis percentage to prevent flapping (0.0-1.0)
             enabled: Whether this threshold is enabled
+            count: Number of consecutive exceedances required before alerting (default 1)
         """
         self.metric_path = metric_path
         self.warning = warning
@@ -185,6 +198,7 @@ class ThresholdConfig:
         self.enabled = enabled
         self.hysteresis = hysteresis
         self.display = display
+        self.count = max(1, int(count))
         
         # Parse operator
         try:
@@ -391,8 +405,28 @@ class ThresholdChecker:
             logger.info("No threshold configurations defined")
             return
 
-        # Parse each named configuration
+        # Build effective_defaults: THRESHOLD_DEFAULTS merged with the 'default' config (if present).
+        # All other configs inherit any metric not explicitly defined from effective_defaults.
+        effective_defaults: Dict[str, ThresholdConfig] = {}
+        for plugin_name, plugin_thresholds in THRESHOLD_DEFAULTS.get("thresholds", {}).items():
+            if isinstance(plugin_thresholds, dict):
+                self._parse_plugin_thresholds(plugin_name, plugin_thresholds, target_dict=effective_defaults)
+
+        if "default" in threshold_configs:
+            default_data = threshold_configs["default"]
+            if isinstance(default_data, dict) and "thresholds" in default_data:
+                for plugin_name, plugin_thresholds in default_data["thresholds"].items():
+                    if isinstance(plugin_thresholds, dict):
+                        self._parse_plugin_thresholds(plugin_name, plugin_thresholds, target_dict=effective_defaults)
+
+        self.threshold_configs["default"] = dict(effective_defaults)
+        logger.info("Registered 'default' threshold config with %d metrics", len(effective_defaults))
+
+        # Parse each named configuration, seeding it with effective_defaults first
         for config_name, config_data in threshold_configs.items():
+            if config_name == "default":
+                continue  # already handled above
+
             if not isinstance(config_data, dict):
                 logger.warning("Invalid threshold config '%s', skipping", config_name)
                 continue
@@ -402,7 +436,7 @@ class ThresholdChecker:
                 continue
 
             logger.info("Parsing threshold configuration: %s", config_name)
-            self.threshold_configs[config_name] = {}
+            self.threshold_configs[config_name] = dict(effective_defaults)
 
             thresholds_config = config_data["thresholds"]
             for plugin_name, plugin_thresholds in thresholds_config.items():
@@ -600,6 +634,7 @@ class ThresholdChecker:
         hysteresis = rtt_thresholds.get("hysteresis", 0.1)  # 10% default
         enabled = rtt_thresholds.get("enabled", True)
         display = rtt_thresholds.get("display")
+        count = rtt_thresholds.get("count", 1)
 
         if warning is None and critical is None:
             logger.warning("No RTT thresholds defined, skipping")
@@ -612,14 +647,16 @@ class ThresholdChecker:
             operator=operator,
             hysteresis=hysteresis,
             enabled=enabled,
-            display=display
+            display=display,
+            count=count,
         )
 
         target_dict[metric_path] = threshold
         logger.debug(
-            "Registered RTT threshold: warn=%s ms, crit=%s ms",
+            "Registered RTT threshold: warn=%s ms, crit=%s ms, count=%d",
             warning,
-            critical
+            critical,
+            count,
         )
     
     def get_thresholds_for_host(self, host_name: str) -> Dict[str, ThresholdConfig]:
@@ -692,6 +729,26 @@ class ThresholdChecker:
             alert_state.level
         )
 
+        # Apply consecutive-count gating: when currently OK, require threshold.count
+        # consecutive exceedances before escalating to WARNING/CRITICAL.
+        if new_level == AlertLevel.OK:
+            # Value is fine (or recovered) — reset the pending counter immediately.
+            alert_state.consecutive_count = 0
+        elif alert_state.level == AlertLevel.OK and new_level != AlertLevel.OK:
+            # First time we exceed while still OK: count up.
+            alert_state.consecutive_count += 1
+            if alert_state.consecutive_count < threshold.count:
+                logger.debug(
+                    "RTT threshold exceeded %d/%d consecutive times for %s on %s",
+                    alert_state.consecutive_count,
+                    threshold.count,
+                    metric_path,
+                    host_name,
+                )
+                return None
+            # Count reached — fire the alert and reset the counter.
+            alert_state.consecutive_count = 0
+
         # Determine which threshold was exceeded
         threshold_value = None
         if new_level == AlertLevel.CRITICAL and threshold.critical is not None:
@@ -884,48 +941,50 @@ class ThresholdChecker:
         # Format operator symbol
         op_symbol = threshold.operator.value
         
+        # Use a display-friendly value (inf is the sentinel for "overdue")
+        import math
+        display_value = "overdue" if isinstance(value, float) and math.isinf(value) else value
+
         # Format message
         if new_level == AlertLevel.OK:
             lvl = "RECOVERED"
-            message = f"{metric_path} = {value} ({old_level.name} -> OK)"
+            message = f"{metric_path} = {display_value} ({old_level.name} -> OK)"
         elif new_level == AlertLevel.WARNING:
             lvl = "WARNING"
             if threshold_value is not None:
-                # Use display format string
                 threshold_info = self._format_display(
                     threshold.display,
-                    value=value,
+                    value=display_value,
                     threshold_value=threshold_value,
                     op_symbol=op_symbol,
                     plugin_data=plugin_data
                 )
-                message = f"{metric_path} = {value} {threshold_info}"
+                message = f"{metric_path} = {display_value} {threshold_info}"
             else:
-                message = f"{metric_path} = {value}"
+                message = f"{metric_path} = {display_value}"
         elif new_level == AlertLevel.CRITICAL:
             lvl = "CRITICAL"
             if threshold_value is not None:
-                # Use display format string
                 threshold_info = self._format_display(
                     threshold.display,
-                    value=value,
+                    value=display_value,
                     threshold_value=threshold_value,
                     op_symbol=op_symbol,
                     plugin_data=plugin_data
                 )
-                message = f"{metric_path} = {value} {threshold_info}"
+                message = f"{metric_path} = {display_value} {threshold_info}"
             else:
-                message = f"{metric_path} = {value}"
+                message = f"{metric_path} = {display_value}"
         else:
             lvl = "UNKNOWN"
-            message = f"{metric_path} = {value}"
+            message = f"{metric_path} = {display_value}"
         
         # Return the formatted threshold info for storing in AlertState
         formatted_threshold_msg = None
         if threshold_value is not None and new_level != AlertLevel.OK:
             formatted_threshold_msg = self._format_display(
                 threshold.display,
-                value=value,
+                value=display_value,
                 threshold_value=threshold_value,
                 op_symbol=op_symbol,
                 plugin_data=plugin_data
@@ -944,9 +1003,15 @@ class ThresholdChecker:
         value: Any,
     ):
         """Send notification and log to journal/eventlog."""
-        # Send notification using host-specific channels
         try:
-            notify_mod.pushmsg_for_host(host_name, f"{lvl}: {host_name} - {message}")
+            notify_mod.send_notification(
+                host_name,
+                notify_mod.Notification(
+                    title=f"[{lvl}] {host_name}",
+                    body=message,
+                    level=lvl,
+                ),
+            )
             logger.info("Notification sent: %s", message)
         except Exception as e:
             logger.error("Failed to send notification: %s", e)
@@ -1037,7 +1102,7 @@ class ThresholdChecker:
             threshold: Threshold configuration
             plugin_data: Optional dictionary of all plugin data fields
         """
-        if alert_state.level == AlertLevel.OK:
+        if alert_state.level != AlertLevel.CRITICAL:
             return
 
         # Skip reminders if alert has been acknowledged
@@ -1078,9 +1143,15 @@ class ThresholdChecker:
             else:
                 message = f"REMINDER ({alert_state.level.name}): {host_name} - {metric_path} = {value} (ongoing for {int(now - alert_state.since)}s)"
             
-            # Send re-notification using host-specific channels
             try:
-                notify_mod.pushmsg_for_host(host_name, message)
+                notify_mod.send_notification(
+                    host_name,
+                    notify_mod.Notification(
+                        title=f"[REMINDER/{alert_state.level.name}] {host_name}",
+                        body=message,
+                        level=alert_state.level.name,
+                    ),
+                )
                 alert_state.last_notification = now
                 alert_state.notification_count += 1
                 logger.info("Re-notification sent: %s", message)

hbd/server/udp.py

@@ -7,6 +7,8 @@ import time
 import zlib
 import logging
 
+from platform import system as platform_system
+
 from ..common.proto import stodict, oldmtodict
 from ..common.utils import dur
 from . import notify as notify_mod
@@ -16,9 +18,18 @@ eventlog = notify_mod.eventlog
 
 # SO_TIMESTAMP: kernel attaches a struct timeval to each received datagram.
 # Supported on Linux, FreeBSD, and macOS.  The constant is not exposed by
-# Python's socket module on all platforms, so fall back to the Linux value (29)
-# when absent.
-_SO_TIMESTAMP = getattr(socket, 'SO_TIMESTAMP', 29)
+# Python's socket module on all platforms 
+platform = platform_system()
+if platform == "Darwin":
+    _SO_TIMESTAMP = 1024  # SO_TIMESTAMP on macOS (not in Python's socket module)
+elif platform == "Linux":
+    _SO_TIMESTAMP = 29  # Linux value (not in older Python versions)
+elif platform == "FreeBSD":
+     _SO_TIMESTAMP = 32  # FreeBSD value (not in older Python versions)
+else:
+    logger.warning("SO_TIMESTAMP may not be supported on this platform (%s)", platform)
+    _SO_TIMESTAMP = None
+
 # struct timeval uses two native C longs: tv_sec and tv_usec
 _TIMEVAL = struct.Struct('@ll')
 
@@ -160,7 +171,7 @@ def dicttos(ID, d):
 DROPOVERDUE = 7 * 24 * 3600  # seconds before an overdue host becomes UNKNOWN
 
 
-def _make_timer_callbacks(uname, host, watchhosts, ctx):
+def _make_timer_callbacks(uname, host, ctx):
     """Return (on_overdue, on_unknown) async callbacks for connection timer logic.
 
     Captured values are bound at call time so callbacks are safe to use in loops.
@@ -180,9 +191,11 @@ def _make_timer_callbacks(uname, host, watchhosts, ctx):
         now = time.time()
         connection.newstate(connection.__class__.OVERDUE, now, cfg.get("grace", 2))
         msg = f"{connection.afam} overdue"
-        eventlog(uname, "CRITICAL" if uname in watchhosts else "WARNING", msg)
-        if uname in watchhosts:
-            notify_mod.pushmsg_for_host(uname, f"{uname} {msg}")
+        eventlog(uname, "CRITICAL", msg)
+        notify_mod.send_notification(
+            uname,
+            notify_mod.Notification(title=f"[CRITICAL] {uname}", body=msg, level="CRITICAL"),
+        )
         if threshold_checker:
             threshold_checker.check_value(
                 host_name=uname,
@@ -207,8 +220,6 @@ def restore_connection_timers(hbdclass, ctx):
     now = time.time()
     cfg = ctx.get("config", {})
     grace = cfg.get("grace", 2)
-    from . import config as config_mod
-    watchhosts = config_mod.get_watchhosts(cfg)
 
     restored = 0
     for uname, host in list(hbdclass.Host.hosts.items()):
@@ -218,15 +229,19 @@ def restore_connection_timers(hbdclass, ctx):
             if state == hbdclass.Connection.DOWN:
                 continue
 
-            on_overdue, on_unknown = _make_timer_callbacks(uname, host, watchhosts, ctx)
+            on_overdue, on_unknown = _make_timer_callbacks(uname, host, ctx)
 
             if state == hbdclass.Connection.UP and interval > 0:
                 elapsed = now - conn.lastbeat
-                remaining = max(1.0, (interval + grace) - elapsed)
+                # Give hosts one full (interval + grace) of extra time on startup
+                # so hosts that were silent while hbd was down are not immediately
+                # flagged as overdue before they have a chance to check in.
+                startup_grace = interval + grace
+                remaining = max(startup_grace, 2 * startup_grace - elapsed)
                 conn.reset_overdue_timer(remaining, on_overdue)
                 logger.debug(
-                    "Restored UP timer %s/%s: %.0fs remaining (elapsed %.0fs)",
-                    uname, afam, remaining, elapsed,
+                    "Restored UP timer %s/%s: %.0fs remaining (elapsed %.0fs, startup grace %.0fs)",
+                    uname, afam, remaining, elapsed, startup_grace,
                 )
                 restored += 1
 
@@ -297,6 +312,9 @@ def handle_datagram(msg: dict, addr, transport, ctx: dict):
         # Use new config function to check dyndns
         dyndnshosts = config_mod.get_dyndnshosts(cfg)
         host.dyn = uname in dyndnshosts
+        # Apply user-access settings from config
+        access = config_mod.get_host_access(cfg, uname)
+        host.apply_access(access["owner"], access["managers"], access["monitors"])
         if verbose:
             print(("XX: New host, num now %s" % (len(hbdcls.Host.hosts))))
         newh = True
@@ -304,9 +322,6 @@ def handle_datagram(msg: dict, addr, transport, ctx: dict):
         host = hbdcls.Host.hosts[uname]
         newh = False
     
-    # Get watchhosts once for use throughout message handling
-    watchhosts = config_mod.get_watchhosts(cfg)
-
     cid = msg.get("id", 0)
     try:
         rtt = float(msg.get("rtt"))
@@ -372,8 +387,10 @@ def handle_datagram(msg: dict, addr, transport, ctx: dict):
 
     if res:
         eventlog(uname, "WARNING", res)
-        if uname in watchhosts:
-            notify_mod.pushmsg_for_host(uname, "%s %s" % (host.name, res))
+        notify_mod.send_notification(
+            uname,
+            notify_mod.Notification(title=f"[WARNING] {uname}", body=res, level="WARNING"),
+        )
 
     interval = int(msg.get("interval", 0) or 0)
     shutdown = msg.get("shutdown", 0)
@@ -383,24 +400,28 @@ def handle_datagram(msg: dict, addr, transport, ctx: dict):
 
     if boot:
         eventlog(uname, "INFO", "booted")
-        if uname in watchhosts:
-            m = "%s booted" % (host.name)
-            notify_mod.pushmsg_for_host(uname, m)
+        notify_mod.send_notification(
+            uname,
+            notify_mod.Notification(title=f"[INFO] {uname}", body=f"{host.name} booted", level="INFO"),
+        )
     if message:
         eventlog(uname, "INFO", "msg: %s" % message, service=service)
-        if uname in watchhosts:
-            notify_mod.pushmsg_for_host(uname, message)
 
     if conn.getstate() != hbdcls.Connection.UP:
         lasts = conn.state
         d = conn.newstate(hbdcls.Connection.UP, now)
-        if d == 0 or lasts == "unknown":
-            m = "%s is up" % (conn.afam)
-        else:
-            m = "%s back after being %s for %s" % (conn.afam, lasts, dur(d))
-        eventlog(uname, "RECOVER", m)
-        if uname in watchhosts:
-            notify_mod.pushmsg_for_host(uname, "%s %s is back" % (uname, conn.afam))
+        # Don't log/notify RECOVER for a brand-new host seen for the first time —
+        # it was never down, it just hasn't been seen before.
+        if not newh:
+            if d == 0 or lasts == "unknown":
+                m = "%s is up" % (conn.afam)
+            else:
+                m = "%s back after being %s for %s" % (conn.afam, lasts, dur(d))
+            eventlog(uname, "RECOVER", m)
+            notify_mod.send_notification(
+                uname,
+                notify_mod.Notification(title=f"[RECOVER] {uname}", body=m, level="RECOVER"),
+            )
 
     if boot or newh:
         host.upcount = host.doesack
@@ -408,9 +429,12 @@ def handle_datagram(msg: dict, addr, transport, ctx: dict):
         host.upcount += 1
 
     if shutdown:
-        eventlog(uname, "INFO", "%s shutdown" % conn.afam)
-        if uname in watchhosts:
-            notify_mod.pushmsg_for_host(uname, "%s %s shutdown" % (uname, conn.afam))
+        m = "%s shutdown" % conn.afam
+        eventlog(uname, "INFO", m)
+        notify_mod.send_notification(
+            uname,
+            notify_mod.Notification(title=f"[INFO] {uname}", body=m, level="INFO"),
+        )
         conn.newstate(hbdcls.Connection.DOWN, now)
 
     if interval > 0:
@@ -421,7 +445,7 @@ def handle_datagram(msg: dict, addr, transport, ctx: dict):
     if interval > 0 and conn.getstate() != hbdcls.Connection.DOWN:
         grace = cfg.get("grace", 2)
         timeout_seconds = interval + grace
-        on_overdue, _ = _make_timer_callbacks(uname, host, watchhosts, ctx)
+        on_overdue, _ = _make_timer_callbacks(uname, host, ctx)
         conn.reset_overdue_timer(timeout_seconds, on_overdue)
     
     # Check RTT thresholds using the threshold checker

hbd/server/users.py

@@ -0,0 +1,242 @@
+"""User management: loading, authentication, and session tracking.
+
+Users are defined in the config file under the ``users`` key:
+
+    users:
+      alice:
+        full_name: Alice Smith
+        avatar: /path/to/avatar.png   # file path, URL, or base64 data URI
+        password: pbkdf2:sha256:...   # generated with: hbd passwd
+        admin: true                   # optional server-level admin
+        notification_channels: [pushover_standard]
+
+Roles are assigned per-host:
+
+    hosts:
+      webserver01:
+        owner: alice
+        managers: [bob]
+        monitors: [carol]
+
+If no users are defined the server runs in unauthenticated mode (backwards
+compatible).  When users are defined every API call must carry a valid session
+token in an ``Authorization: Bearer <token>`` or ``X-Auth-Token`` header,
+obtained via ``POST /api/0/auth/login``.
+"""
+
+import hashlib
+import hmac
+import logging
+import secrets
+import time
+
+logger = logging.getLogger(__name__)
+
+# Session lifetime in seconds (24 hours).
+SESSION_TTL = 86400
+
+# Global session store: token -> {"username": str, "expires": float, "created": float}
+_sessions: dict = {}
+
+
+# ---------------------------------------------------------------------------
+# User class
+# ---------------------------------------------------------------------------
+
+class User:
+    def __init__(
+        self,
+        username: str,
+        full_name: str = "",
+        avatar: str = "",
+        password_hash: str = "",
+        admin: bool = False,
+        notification_channels: list | None = None,
+    ):
+        self.username = username
+        self.full_name = full_name
+        self.avatar = avatar
+        self.password_hash = password_hash
+        self.admin = admin
+        self.notification_channels: list = notification_channels or []
+
+    def check_password(self, password: str) -> bool:
+        if not self.password_hash:
+            return False
+        return _verify_password(password, self.password_hash)
+
+    def avatar_is_local(self) -> bool:
+        """Return True when the avatar is a local filesystem path (starts with '/')."""
+        return bool(self.avatar and self.avatar.startswith("/"))
+
+    def avatar_url(self) -> str:
+        """Return the URL to use as an <img src>.
+
+        Local file paths are served via the /api/0/users/{username}/avatar
+        endpoint.  External URLs and data URIs are returned as-is.
+        """
+        if self.avatar_is_local():
+            return f"/api/0/users/{self.username}/avatar"
+        return self.avatar
+
+    def to_dict(self) -> dict:
+        return {
+            "username": self.username,
+            "full_name": self.full_name,
+            "avatar": self.avatar,
+            "avatar_url": self.avatar_url(),
+            "admin": self.admin,
+            "notification_channels": self.notification_channels,
+        }
+
+
+# ---------------------------------------------------------------------------
+# Password hashing  (PBKDF2-HMAC-SHA256, stdlib only)
+# ---------------------------------------------------------------------------
+
+def hash_password(password: str) -> str:
+    """Return a storable hash for *password*.
+
+    Format: ``pbkdf2:sha256:<iterations>:<salt>:<hex-digest>``
+
+    Use this to generate the ``password`` value in the config file::
+
+        python -c "from hbd.server.users import hash_password; print(hash_password('secret'))"
+
+    Or via the CLI::
+
+        hbd passwd
+    """
+    salt = secrets.token_hex(16)
+    iterations = 260_000
+    dk = hashlib.pbkdf2_hmac(
+        "sha256", password.encode("utf-8"), salt.encode("utf-8"), iterations
+    )
+    return f"pbkdf2:sha256:{iterations}:{salt}:{dk.hex()}"
+
+
+def _verify_password(password: str, stored_hash: str) -> bool:
+    """Return True if *password* matches *stored_hash*."""
+    try:
+        parts = stored_hash.split(":")
+        if len(parts) != 5 or parts[0] != "pbkdf2" or parts[1] != "sha256":
+            return False
+        _, _, iterations_str, salt, expected_hex = parts
+        iterations = int(iterations_str)
+        dk = hashlib.pbkdf2_hmac(
+            "sha256", password.encode("utf-8"), salt.encode("utf-8"), iterations
+        )
+        return hmac.compare_digest(dk.hex(), expected_hex)
+    except Exception:
+        return False
+
+
+# ---------------------------------------------------------------------------
+# Global user registry
+# ---------------------------------------------------------------------------
+
+# username -> User
+users: dict = {}
+
+
+def load_users(config: dict) -> dict:
+    """Populate the global user registry from *config*.
+
+    Called once at startup and again on SIGHUP config reload.
+    Returns the new ``users`` dict.
+    """
+    global users
+    users_cfg = config.get("users", {})
+    if not isinstance(users_cfg, dict):
+        users = {}
+        return users
+
+    result: dict = {}
+    for username, attrs in users_cfg.items():
+        if not isinstance(attrs, dict):
+            logger.warning("Skipping user %r: expected a mapping", username)
+            continue
+        result[username] = User(
+            username=username,
+            full_name=attrs.get("full_name", ""),
+            avatar=attrs.get("avatar", ""),
+            password_hash=attrs.get("password", ""),
+            admin=bool(attrs.get("admin", False)),
+            notification_channels=attrs.get("notification_channels", []),
+        )
+
+    users = result
+    logger.info("Loaded %d user(s) from config", len(users))
+    return users
+
+
+def users_enabled() -> bool:
+    """Return True if at least one user is configured (auth-required mode)."""
+    return bool(users)
+
+
+def get_user(username: str) -> "User | None":
+    return users.get(username)
+
+
+def authenticate(username: str, password: str) -> "User | None":
+    """Return the User if credentials are valid, else None."""
+    user = users.get(username)
+    if user and user.check_password(password):
+        return user
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Session management
+# ---------------------------------------------------------------------------
+
+def create_session(username: str) -> str:
+    """Create a new session for *username* and return the opaque token."""
+    _purge_expired_sessions()
+    token = secrets.token_hex(32)
+    _sessions[token] = {
+        "username": username,
+        "expires": time.time() + SESSION_TTL,
+        "created": time.time(),
+    }
+    return token
+
+
+def get_session_user(token: str) -> "User | None":
+    """Return the User for a valid *token*, or None if missing/expired."""
+    if not token:
+        return None
+    session = _sessions.get(token)
+    if not session:
+        return None
+    if session["expires"] < time.time():
+        del _sessions[token]
+        return None
+    return get_user(session["username"])
+
+
+def delete_session(token: str) -> None:
+    """Invalidate *token* (logout)."""
+    _sessions.pop(token, None)
+
+
+def _purge_expired_sessions() -> None:
+    now = time.time()
+    expired = [t for t, s in list(_sessions.items()) if s["expires"] < now]
+    for t in expired:
+        del _sessions[t]
+
+
+def save_sessions() -> dict:
+    """Return a snapshot of non-expired sessions suitable for pickling."""
+    _purge_expired_sessions()
+    return dict(_sessions)
+
+
+def load_sessions(snapshot: dict) -> None:
+    """Restore sessions from a pickled snapshot, dropping any that have expired."""
+    global _sessions
+    now = time.time()
+    _sessions = {t: s for t, s in snapshot.items() if s.get("expires", 0) > now}
+    logger.debug("Restored %d session(s) from pickle", len(_sessions))

hbd/server/ws.py

@@ -1,7 +1,8 @@
-"""WebSocket server and broadcast helpers for hbd.
+"""WebSocket handler and broadcast helpers for hbd.
 
-Provides an asyncio-based WebSocket server and a thread-safe broadcast
-function that other threads or synchronous code can call.
+WebSocket connections are served through the regular HTTP port via the
+/ws route registered in http.py (aiohttp WebSocketResponse upgrade).
+The separate standalone WebSocket server on ws_port is no longer used.
 """
 
 import asyncio
@@ -10,147 +11,99 @@ import logging
 from typing import Callable, Iterable, Optional
 from . import data
 
-import websockets
-
 logger = logging.getLogger(__name__)
-logger.setLevel(logging.INFO)
-_connections = set()
+
+_connections: set = set()
 _loop: Optional[asyncio.AbstractEventLoop] = None
 _get_hosts: Optional[Callable[[], Iterable]] = None
-#_get_msgs: Optional[Callable[[], Iterable]] = None
-_verbose = False
+_verbose: bool = False
 
 
-async def _handler(websocket, path=None):
-    _connections.add(websocket)
-    remote_address = websocket.remote_address
-    if path is None:
-        path = getattr(websocket, "path", None)
-    logger.info("WebSocket connection from %s: %s", remote_address, path)
-    try:
-        # send initial hosts
-        if _get_hosts:
-            try:
-                hosts = list(_get_hosts())
-                logger.debug("Sending %d hosts to new WebSocket client", len(hosts))
-                for h in hosts:
-                    jmsg = json.dumps({"type": "host", "data": h})
-                    await websocket.send(jmsg)
-            except Exception as e:
-                logger.error("Error sending initial hosts: %s", e, exc_info=True)
-        # send recent messages
-        if data.msgs:
-            try:
-#                msgs = list(_get_msgs())[-100:]
-                logger.debug("Sending %d recent messages to new WebSocket client", len(data.msgs))
-                for m in data.msgs:
-                    jmsg = json.dumps({"type": "message", "data": m})
-                    await websocket.send(jmsg)
-            except Exception as e:
-                logger.error("Error sending initial messages: %s", e, exc_info=True)
-
-        # keep connection open until client disconnects
-        async for _ in websocket:
-            # we don't expect meaningful incoming messages besides the initial
-            # client 'hello' that some clients send; ignore for now
-            if _verbose:
-                logger.debug("received ws data: %s", _)
-
-    except (
-        websockets.exceptions.ConnectionClosedOK,
-        websockets.exceptions.ConnectionClosedError,
-    ) as e:
-        logger.info("WebSocket closed from %s: %r", remote_address, e)
-    except Exception as e:
-        logger.exception("WebSocket handler exception from %s: %s", remote_address, e)
-    finally:
-        logger.debug("Removing WebSocket connection from %s", remote_address)
-        _connections.discard(websocket)
-
-
-async def start(
-    host: str,
-    ws_port: int,
-    wss_port: Optional[int] = None,
-    ssl_context=None,
-    get_hosts: Optional[Callable] = None,
-#    get_msgs: Optional[Callable] = None,
-    config: dict = {},
+def setup(
+    loop: asyncio.AbstractEventLoop,
+    get_hosts: Optional[Callable[[], Iterable]] = None,
+    verbose: bool = False,
 ):
-    """Start WebSocket servers and block until cancelled.
+    """Register the running loop and initial-state callback.
 
-    This is intended to be awaited inside the main asyncio event loop.
-    If `wss_port` and `ssl_context` are provided, a WSS server will also be
-    started.
+    Call this once from _run_async before starting the HTTP server.
     """
     global _loop, _get_hosts, _verbose
-    _loop = asyncio.get_running_loop()
+    _loop = loop
     _get_hosts = get_hosts
-    _verbose = config.get("verbose", False),
-    _debug = config.get("debug", 0),
+    _verbose = verbose
 
-    # Start servers and keep the server objects for clean shutdown
-    running_servers = []
-    ws_server = await websockets.serve(_handler, host, ws_port)
-    running_servers.append(ws_server)
-    if wss_port and ssl_context:
-        wss_server = await websockets.serve(_handler, host, wss_port, ssl=ssl_context)
-        running_servers.append(wss_server)
 
-    logger.info(
-        "WebSocket server(s) started on port %s (wss %s)", ws_port, wss_port
-    )
+async def handler(request):
+    """aiohttp WebSocket upgrade handler — register as GET /ws."""
+    from aiohttp import web
+
+    ws = web.WebSocketResponse()
+    await ws.prepare(request)
+
+    _connections.add(ws)
+    remote = request.remote
+    logger.info("WebSocket connected from %s", remote)
 
     try:
-        # Block until cancelled
-        await asyncio.Future()
-    except asyncio.CancelledError:
-        pass
+        # Send current host state to the new client
+        if _get_hosts:
+            try:
+                for h in list(_get_hosts()):
+                    await ws.send_str(json.dumps({"type": "host", "data": h}))
+            except Exception as e:
+                logger.error("Error sending initial hosts: %s", e)
+
+        # Send recent messages
+        if data.msgs:
+            try:
+                for m in data.msgs:
+                    await ws.send_str(json.dumps({"type": "message", "data": m}))
+            except Exception as e:
+                logger.error("Error sending initial messages: %s", e)
+
+        # Keep connection open, ignore incoming frames
+        async for msg in ws:
+            from aiohttp import WSMsgType
+            if msg.type == WSMsgType.TEXT:
+                if _verbose:
+                    logger.debug("ws recv from %s: %s", remote, msg.data)
+            elif msg.type in (WSMsgType.ERROR, WSMsgType.CLOSE):
+                break
+
+    except Exception as e:
+        logger.exception("WebSocket handler error from %s: %s", remote, e)
     finally:
-        # Close all active browser connections so their handler coroutines exit
-        active = list(_connections)
-        if active:
-            logger.info("Closing %d active WebSocket connection(s)...", len(active))
-            await asyncio.gather(
-                *[ws.close() for ws in active],
-                return_exceptions=True,
-            )
-        # Stop the listening servers and wait for all handlers to finish
-        for srv in running_servers:
-            srv.close()
-        await asyncio.gather(
-            *[srv.wait_closed() for srv in running_servers],
-            return_exceptions=True,
-        )
-        logger.info("WebSocket server(s) stopped")
+        _connections.discard(ws)
+        logger.info("WebSocket disconnected from %s", remote)
+
+    return ws
 
 
-def broadcast(typ: str, data) -> bool:
-    """Thread-safe broadcast helper.
+def broadcast(typ: str, payload) -> bool:
+    """Thread-safe broadcast to all connected WebSocket clients.
 
-    Schedules coroutine(s) on the running loop to send message to all
-    connected websockets. Returns False if server was not running.
+    Can be called from any thread; schedules sends on the event loop.
+    Returns False if the loop is not running yet.
     """
     if not _loop:
         return False
-    jmsg = json.dumps({"type": typ, "data": data})
-    to_close = []
-    for ws in list(_connections):
-        if ws.state != websockets.protocol.State.OPEN:
-            to_close.append(ws)
-            continue
-        try:
-            asyncio.run_coroutine_threadsafe(ws.send(jmsg), _loop)
-        except Exception:
-            to_close.append(ws)
-            logger.debug("ws.send exception: closed")
-    for ws in to_close:
-        try:
-            asyncio.run_coroutine_threadsafe(ws.wait_closed(), _loop)
-        except Exception:
-            pass
-        if ws in _connections:
-            _connections.remove(ws)
+    jmsg = json.dumps({"type": typ, "data": payload})
+
+    async def _send_all():
+        dead = set()
+        for ws in list(_connections):
+            try:
+                if not ws.closed:
+                    await ws.send_str(jmsg)
+                else:
+                    dead.add(ws)
+            except Exception:
+                dead.add(ws)
+        for ws in dead:
+            _connections.discard(ws)
+
+    asyncio.run_coroutine_threadsafe(_send_all(), _loop)
     return True
 
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hbd"
-version = "5.0.10"
+version = "5.1.1"
 description = "Heartbeat monitoring system — client (hbc) and server (hbd)"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -31,6 +31,7 @@ server = [
   "mattermostdriver>=7.3.0",
   "aiohttp>=3.11",
   "Jinja2>=3.1.6",
+  "matrix-nio>=0.24",
 ]
 
 # Install both client and server

scripts/install.sh

@@ -1,15 +1,58 @@
 #!/bin/sh
 
-# install hbd/hbc from wheel and create symlinks for hbd and hbc in ~/bin
+# install the heartbeat client, hbc. The server is installed when the arg 'server' is passed 
+# install the heartbeat client, hbc. The server is installed when the arg 'server' is passed 
+# to the script. The script will install the heartbeat tools in a python 
+# virtual environment in ~/venvs/hbd. The hbd and hbc commands will be
+# installed from the wheel and symlinked to ~/bin/hbd and ~/bin/hbc,
+# respectively. If the virtual environment already exists, it will be
+# reused. The script will also remove any existing symlinks for hbd and hbc
+# in ~/bin before creating new ones.
+
+
+# hbd/hbc from wheel and create symlinks for hbd and hbc in ~/bin
 
 set -e
-if [ ! -d  ~/venvs/hbd ]; then
-    mkdir -p ~/venvs
-    python3 -m venv ~/venvs/hbd --system-site-packages
+what=$1
+
+if [ -d /homeassistant ]; then
+    echo "cannot install in HA, run \"docker exec -it homeassistant $0 $@\""
+    exit 1
+fi
+if [ -d /config ]; then
+    echo "Installing on HA"
+    where="/config/bin"
+    venv="/config/venvs"
+else
+    if [ ! -d ~/.local/bin ] && [ ! -d ~/bin ]; then
+        echo "No suitable bin directory found in PATH, please add either ~/.local/bin or ~/bin to your PATH"
+        exit 1
+    fi
+    for where in ~/bin ~/.local/bin; do
+        if echo ":$PATH:" | grep -q ":$where:" ; then
+            break
+        fi
+    done
+    venv="~/venvs"
+fi
+python3 -m pip --version > /dev/null 2>&1 || { echo "pip is not installed, please install pip for python3"; exit 1; }
+
+if [ "$what" = "server" ]; then
+    echo "Installing heartbeat server (hbd)"
+else
+    what="client"
+    echo "Installing heartbeat client (hbc)"
+fi
+if [ ! -d  $venv/hbd ]; then
+    mkdir -p $venv
+    python3 -m venv $venv/hbd --system-site-packages
+fi
+. $venv/hbd/bin/activate
+pip install --index-url https://git.wrede.ca/api/packages/andreas/pypi/simple/ --extra-index-url https://pypi.org/simple hbd[$what]
+if [ "$what" = "server" ]; then
+    rm -f ~$where/hbd
+    ln -sf $(which hbd) $where/hbd
+else
+    rm -f $where/hbc
+    ln -sf $(which hbc) $where/hbc
 fi
-. ~/venvs/hbd/bin/activate
-pip install 'git+ssh://git@git.wrede.ca/andreas/heartbeat.git'
-rm -f ~/bin/hbd
-rm -f ~/bin/hbc
-ln -sf $(which hbd) ~/bin/hbd
-ln -sf $(which hbc) ~/bin/hbc