Polish KarlDNS production UI and docs

router_dyndns/app.py

@@ -11,7 +11,7 @@ from fastapi import FastAPI
 from starlette.concurrency import run_in_threadpool
 from starlette.middleware.trustedhost import TrustedHostMiddleware
 
-from .ddns_dns import DnsConfigurationError, DnsProviderError, delete_dns_records, publish_dns
+from .ddns_dns import DnsConfigurationError, DnsProviderError, DnsReconciliationError, delete_dns_records, publish_dns
 from .ddns_models import DdnsSettings, UpdateResult
 from .ddns_service import DdnsService
 from .ddns_store import DdnsStore
@@ -23,6 +23,7 @@ __all__ = [
     "DdnsStore",
     "DnsConfigurationError",
     "DnsProviderError",
+    "DnsReconciliationError",
     "UpdateResult",
     "delete_dns_records",
     "make_app",
@@ -33,7 +34,7 @@ __all__ = [
 OPENAPI_TAGS = [
     {
         "name": "hostnames",
-        "description": "Create provider-owned or verified custom DynDNS hostnames.",
+        "description": "Create KarlDNS hostnames or hostnames under verified domains.",
     },
     {
         "name": "domains",
@@ -45,7 +46,7 @@ OPENAPI_TAGS = [
     },
     {
         "name": "management",
-        "description": "Bearer-link JSON management for generated hostnames. Dashboard passwords protect only the web dashboard, not these API routes.",
+        "description": "API management through private dashboard links. Dashboard passwords protect only the web dashboard, not these API routes.",
     },
 ]
 
@@ -142,6 +143,7 @@ async def _run_cleanup_if_due(store: DdnsStore, settings: DdnsSettings) -> None:
         )
     except Exception as exc:
         LOGGER.exception("Scheduled cleanup failed")
+        await run_in_threadpool(store.increment_metric, "cleanup_errors_total")
         await run_in_threadpool(
             store.complete_scheduled_task,
             CLEANUP_TASK_NAME,
@@ -157,4 +159,5 @@ async def _run_cleanup_if_due(store: DdnsStore, settings: DdnsSettings) -> None:
         True,
         "",
     )
+    await run_in_threadpool(store.increment_metric, "cleanup_success_total")
     await run_in_threadpool(store.optimize)

router_dyndns/assets/bootstrap-subset.css

@@ -0,0 +1 @@
+:root{--bs-body-color:#000;--bs-body-bg:#fff;--bs-border-color:#e5e5e5;--bs-secondary-color:#737373}[data-bs-theme="dark"]{--bs-body-color:#f5f5f5;--bs-body-bg:#0f0f0f;--bs-border-color:rgba(255,255,255,.16);--bs-secondary-color:#a3a3a3}html{-webkit-text-size-adjust:100%}body{margin:0}button,input,select{margin:0;font:inherit}button,select{text-transform:none}button:not(:disabled),[type="button"]:not(:disabled),[type="submit"]:not(:disabled){cursor:pointer}a{color:inherit}img,svg{vertical-align:middle}code,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace}pre{margin:0}.container{width:100%;margin-right:auto;margin-left:auto;padding-right:12px;padding-left:12px}.row{display:flex;flex-wrap:wrap;margin-right:calc(-.5 * var(--bs-gutter-x,0));margin-left:calc(-.5 * var(--bs-gutter-x,0));margin-top:calc(-1 * var(--bs-gutter-y,0))}.row>*{width:100%;max-width:100%;padding-right:calc(var(--bs-gutter-x,0) * .5);padding-left:calc(var(--bs-gutter-x,0) * .5);margin-top:var(--bs-gutter-y,0)}.col-6{flex:0 0 auto;width:50%}.col-12{flex:0 0 auto;width:100%}@media (min-width:768px){.col-md-6{flex:0 0 auto;width:50%}.align-items-md-center{align-items:center!important}.flex-md-row{flex-direction:row!important}}@media (min-width:992px){.col-lg-3{flex:0 0 auto;width:25%}.col-lg-5{flex:0 0 auto;width:41.666667%}.col-lg-6{flex:0 0 auto;width:50%}.col-lg-7{flex:0 0 auto;width:58.333333%}.flex-lg-row{flex-direction:row!important}}@media (min-width:1200px){.col-xl-3{flex:0 0 auto;width:25%}}.g-3{--bs-gutter-x:16px;--bs-gutter-y:16px}.g-4{--bs-gutter-x:24px;--bs-gutter-y:24px}.d-flex{display:flex!important}.d-grid{display:grid!important}.flex-row{flex-direction:row!important}.flex-column{flex-direction:column!important}.flex-wrap{flex-wrap:wrap!important}.flex-shrink-0{flex-shrink:0!important}.align-items-center{align-items:center!important}.align-items-start{align-items:flex-start!important}.align-items-stretch{align-items:stretch!important}.align-self-start{align-self:flex-start!important}.justify-content-between{justify-content:space-between!important}.justify-content-center{justify-content:center!important}.justify-content-end{justify-content:flex-end!important}@media (min-width:576px){.navbar-expand-sm{flex-wrap:nowrap;justify-content:flex-start}.gap-sm-3{gap:16px!important}}.gap-2{gap:8px!important}.gap-3{gap:16px!important}.gap-4{gap:24px!important}.m-0{margin:0!important}.mx-auto{margin-right:auto!important;margin-left:auto!important}.ms-auto{margin-left:auto!important}.my-0{margin-top:0!important;margin-bottom:0!important}.my-3{margin-top:16px!important;margin-bottom:16px!important}.mt-1{margin-top:4px!important}.mt-2{margin-top:8px!important}.mt-3{margin-top:16px!important}.mt-4{margin-top:24px!important}.mb-0{margin-bottom:0!important}.mb-1{margin-bottom:4px!important}.mb-2{margin-bottom:8px!important}.mb-3{margin-bottom:16px!important}.mb-4{margin-bottom:24px!important}.p-0{padding:0!important}.p-4{padding:24px!important}.px-0{padding-right:0!important;padding-left:0!important}.px-2{padding-right:8px!important;padding-left:8px!important}.px-3{padding-right:16px!important;padding-left:16px!important}.py-2{padding-top:8px!important;padding-bottom:8px!important}.w-100{width:100%!important}.h-100{height:100%!important}.text-center{text-align:center!important}.text-start{text-align:left!important}.text-nowrap{white-space:nowrap!important}.text-truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.text-secondary{color:var(--bs-secondary-color)!important}.text-danger{color:var(--rp-danger)!important}.small{font-size:.875em!important}.h5{font-size:1.25rem}.opacity-75{opacity:.75!important}.rounded{border-radius:12px!important}.rounded-0{border-radius:0!important}.rounded-circle{border-radius:50%!important}.rounded-pill{border-radius:9999px!important}.border{border:1px solid var(--bs-border-color)!important}.border-top{border-top:1px solid var(--bs-border-color)!important}.border-start-0{border-left:0!important}.border-end-0{border-right:0!important}.nav{display:flex;flex-wrap:wrap;padding-left:0;margin-bottom:0;list-style:none}.navbar{position:relative;display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between}.navbar-brand{display:inline-block;padding-top:5px;padding-bottom:5px;margin-right:16px;text-decoration:none;white-space:nowrap}.navbar-nav{display:flex;flex-direction:column;padding-left:0;margin-bottom:0;list-style:none}.navbar-text{padding-top:8px;padding-bottom:8px}.nav-link{display:block;padding:8px;text-decoration:none}.btn{--bs-btn-color:#000;--bs-btn-bg:transparent;--bs-btn-border-color:transparent;--bs-btn-hover-color:var(--bs-btn-color);--bs-btn-hover-bg:var(--bs-btn-bg);--bs-btn-hover-border-color:var(--bs-btn-border-color);--bs-btn-active-color:var(--bs-btn-hover-color);--bs-btn-active-bg:var(--bs-btn-hover-bg);--bs-btn-active-border-color:var(--bs-btn-hover-border-color);color:var(--bs-btn-color);background-color:var(--bs-btn-bg);border:1px solid var(--bLine truncated

router_dyndns/cli.py

@@ -9,18 +9,18 @@ def main() -> None:
     parser = argparse.ArgumentParser(prog="karldns")
     subparsers = parser.add_subparsers(dest="command", required=True)
 
-    render_url = subparsers.add_parser("render-fritz-url", help="Render a FRITZ!Box custom DynDNS update URL.")
-    render_url.add_argument("--base-url", required=True, help="Public base URL of this DDNS service.")
+    render_url = subparsers.add_parser("render-fritz-url", help="Print a FRITZ!Box DynDNS update URL.")
+    render_url.add_argument("--base-url", required=True, help="Public KarlDNS URL.")
     render_url.add_argument("--host", required=True, help="DNS hostname configured in FRITZ!Box.")
     render_url.add_argument("--include-ipv6", action="store_true")
 
-    serve = subparsers.add_parser("serve", help="Run the DDNS HTTP service.")
+    serve = subparsers.add_parser("serve", help="Run the KarlDNS web service.")
     serve.add_argument("--host", default="0.0.0.0")
     serve.add_argument("--port", type=int, default=8080)
     serve.add_argument(
         "--access-log",
         action="store_true",
-        help="Enable Uvicorn access logs. Disabled by default because update URLs are bearer secrets.",
+        help="Enable redacted request logs. Raw web-server access logs stay off because private URLs are secrets.",
     )
 
     args = parser.parse_args()
@@ -31,8 +31,10 @@ def main() -> None:
 
         settings = DdnsSettings.from_env()
         if not settings.admin_password:
-            raise SystemExit("DDNS_ADMIN_PASSWORD must be set.")
-        uvicorn.run(make_app(settings), host=args.host, port=args.port, access_log=args.access_log)
+            raise SystemExit("Set DDNS_ADMIN_PASSWORD before starting KarlDNS.")
+        if args.access_log:
+            settings = settings.model_copy(update={"redacted_access_log": True})
+        uvicorn.run(make_app(settings), host=args.host, port=args.port, access_log=False)
 
 
 def _render_fritz_url(base_url: str, host: str, include_ipv6: bool) -> str:

router_dyndns/config.py

@@ -39,6 +39,8 @@ def settings_from_env() -> DdnsSettings:
             "DDNS_DASHBOARD_STAY_UNLOCKED_SECONDS",
             30 * 24 * 60 * 60,
         ),
+        dashboard_cookie_secret=os.getenv("DDNS_DASHBOARD_COOKIE_SECRET", ""),
+        redacted_access_log=_env_flag("DDNS_REDACTED_ACCESS_LOG"),
         ttl=_env_int("DDNS_TTL", 60),
     )
 

router_dyndns/ddns.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 from .app import make_app
-from .ddns_dns import DnsConfigurationError, DnsProviderError, delete_dns_records, publish_dns
+from .ddns_dns import DnsConfigurationError, DnsProviderError, DnsReconciliationError, delete_dns_records, publish_dns
 from .ddns_models import DdnsSettings, UpdateResult
 from .ddns_store import DdnsStore
 
@@ -10,6 +10,7 @@ __all__ = [
     "DdnsStore",
     "DnsConfigurationError",
     "DnsProviderError",
+    "DnsReconciliationError",
     "UpdateResult",
     "delete_dns_records",
     "make_app",

router_dyndns/ddns_dns.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from .dns import (
     DnsConfigurationError,
     DnsProviderError,
+    DnsReconciliationError,
     delete_cloudflare_records,
     delete_dns_records,
     delete_rfc2136_records,
@@ -16,6 +17,7 @@ from .dns import (
 __all__ = [
     "DnsConfigurationError",
     "DnsProviderError",
+    "DnsReconciliationError",
     "delete_cloudflare_records",
     "delete_dns_records",
     "delete_rfc2136_records",

router_dyndns/ddns_models.py

@@ -5,10 +5,12 @@ import urllib.parse
 from dataclasses import dataclass
 from pathlib import Path
 
-from pydantic import BaseModel, Field, field_validator
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 
 class DdnsSettings(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     database_path: Path = Field(default=Path("ddns.sqlite3"))
     shared_secret: str = Field(default="")
     admin_password: str = Field(default="")
@@ -37,6 +39,8 @@ class DdnsSettings(BaseModel):
     cleanup_interval_seconds: int = Field(default=3600, ge=1, le=24 * 60 * 60)
     dashboard_unlock_seconds: int = Field(default=24 * 60 * 60, ge=60, le=30 * 24 * 60 * 60)
     dashboard_stay_unlocked_seconds: int = Field(default=30 * 24 * 60 * 60, ge=60, le=30 * 24 * 60 * 60)
+    dashboard_cookie_secret: str = Field(default="")
+    redacted_access_log: bool = Field(default=False)
     ttl: int = Field(default=60, ge=60, le=86400)
 
     @field_validator("public_base_url")
@@ -61,16 +65,22 @@ class DdnsSettings(BaseModel):
             raise ValueError("admin_path may only contain URL-safe path characters")
         reserved_paths = {
             "/accounts",
+            "/admin.css",
+            "/admin-tables.js",
             "/api",
             "/app.js",
             "/claim",
+            "/clipboard.js",
             "/d",
             "/docs",
             "/favicon.ico",
             "/healthz",
             "/install.sh",
             "/ip",
+            "/bootstrap-subset.css",
             "/logo.png",
+            "/logo-nav.webp",
+            "/logo.webp",
             "/m",
             "/magic",
             "/nic",
@@ -78,7 +88,11 @@ class DdnsSettings(BaseModel):
             "/privacy",
             "/redoc",
             "/robots.txt",
+            "/sitemap.xml",
             "/site.webmanifest",
+            "/social-preview.png",
+            "/social-preview.webp",
+            "/theme.js",
             "/u",
             "/uninstall.sh",
         }
@@ -104,6 +118,10 @@ class DdnsSettings(BaseModel):
             return
         if len(self.admin_password) < 16:
             raise RuntimeError("DDNS_ADMIN_PASSWORD must be at least 16 characters when DDNS_REQUIRE_DNS_PROVIDER=1")
+        if len(self.dashboard_cookie_secret or self.admin_password) < 32:
+            raise RuntimeError(
+                "DDNS_DASHBOARD_COOKIE_SECRET or DDNS_ADMIN_PASSWORD must be at least 32 characters for dashboard cookie signing when DDNS_REQUIRE_DNS_PROVIDER=1"
+            )
         if not self.hostname_suffix:
             raise RuntimeError("DDNS_HOSTNAME_SUFFIX is required when DDNS_REQUIRE_DNS_PROVIDER=1")
         if not self.effective_trusted_hosts:

router_dyndns/ddns_security.py

@@ -53,17 +53,31 @@ def sign_dashboard_unlock_cookie(
     hostname: str,
     management_slug: str,
     password_hash: str,
+    signing_secret: str,
     max_age_seconds: int,
     now: int | None = None,
 ) -> str:
     timestamp = int(time.time() if now is None else now)
     bounded_max_age = _bounded_dashboard_unlock_seconds(max_age_seconds)
-    signature = _dashboard_unlock_signature(hostname, management_slug, password_hash, timestamp, bounded_max_age)
-    return f"v2:{timestamp}:{bounded_max_age}:{signature}"
+    signature = _dashboard_unlock_signature(
+        hostname,
+        management_slug,
+        password_hash,
+        signing_secret,
+        timestamp,
+        bounded_max_age,
+    )
+    return f"v3:{timestamp}:{bounded_max_age}:{signature}"
 
 
-def verify_dashboard_unlock_cookie(hostname: str, management_slug: str, password_hash: str | None, cookie_value: str | None) -> bool:
-    if not password_hash or not cookie_value:
+def verify_dashboard_unlock_cookie(
+    hostname: str,
+    management_slug: str,
+    password_hash: str | None,
+    signing_secret: str,
+    cookie_value: str | None,
+) -> bool:
+    if not password_hash or not signing_secret or not cookie_value:
         return False
     try:
         version, raw_timestamp, raw_max_age, supplied = cookie_value.split(":", 3)
@@ -71,12 +85,19 @@ def verify_dashboard_unlock_cookie(hostname: str, management_slug: str, password
         max_age_seconds = _bounded_dashboard_unlock_seconds(int(raw_max_age))
     except ValueError:
         return False
-    if version != "v2":
+    if version != "v3":
         return False
     now = int(time.time())
     if timestamp > now + 60 or now - timestamp > max_age_seconds:
         return False
-    expected = _dashboard_unlock_signature(hostname, management_slug, password_hash, timestamp, max_age_seconds)
+    expected = _dashboard_unlock_signature(
+        hostname,
+        management_slug,
+        password_hash,
+        signing_secret,
+        timestamp,
+        max_age_seconds,
+    )
     return hmac.compare_digest(supplied, expected)
 
 
@@ -84,11 +105,16 @@ def _dashboard_unlock_signature(
     hostname: str,
     management_slug: str,
     password_hash: str,
+    signing_secret: str,
     timestamp: int,
     max_age_seconds: int,
 ) -> str:
-    payload = f"{hostname}\0{management_slug}\0{timestamp}\0{max_age_seconds}".encode()
-    return hmac.new(password_hash.encode(), payload, hashlib.sha256).hexdigest()
+    payload = f"{hostname}\0{management_slug}\0{password_hash}\0{timestamp}\0{max_age_seconds}".encode()
+    return hmac.new(signing_secret.encode(), payload, hashlib.sha256).hexdigest()
+
+
+def dashboard_cookie_signing_secret(settings: DdnsSettings) -> str:
+    return settings.dashboard_cookie_secret or settings.admin_password
 
 
 def dashboard_csrf_token(management_slug: str, account: dict[str, str | int | None]) -> str:

router_dyndns/ddns_service.py

@@ -6,16 +6,17 @@ import re
 import secrets
 import sqlite3
 import threading
+import time
 import urllib.parse
 from dataclasses import dataclass
 
 from fastapi import HTTPException, Request
 
-from .ddns_dns import DnsProviderError, delete_dns_records, dns_backend_configured, publish_dns
+from .ddns_dns import DnsProviderError, DnsReconciliationError, delete_dns_records, dns_backend_configured, publish_dns
 from .ddns_models import DdnsSettings, UpdateResult
 from .ddns_security import client_ip
 from .ddns_store import DdnsStore
-from .event_statuses import DNS_DELETE_FAILED, DNS_FAILED, UNCHANGED, UPDATED
+from .event_statuses import DNS_DELETE_FAILED, DNS_FAILED, DNS_RECONCILE_FAILED, UNCHANGED, UPDATED
 
 LOGGER = logging.getLogger(__name__)
 
@@ -121,36 +122,75 @@ class DdnsService:
         myipv6: str | None,
         ip6addr: str | None,
     ) -> UpdateOutcome:
+        started_at = time.perf_counter()
+        is_success = False
+        is_dns_failure = False
+        is_reconcile_failure = False
+        is_bad_ip = False
         source_ip = client_ip(request, self.settings)
-        ipv4, ipv6, update_ipv4, update_ipv6 = parse_update_ips(
-            source_ip,
-            myip,
-            ipaddr,
-            myipv6,
-            ip6addr,
-        )
-        lock = self._lock_for(hostname)
-        with lock:
-            planned = self.store.preview_update(hostname, ipv4, ipv6, update_ipv4=update_ipv4, update_ipv6=update_ipv6)
-            if planned.changed:
-                try:
-                    publish_dns(planned, self.settings)
-                except DnsProviderError as exc:
-                    LOGGER.warning(
-                        "DNS publish failed for hostname=%s update_ipv4=%s update_ipv6=%s error_type=%s",
-                        hostname,
-                        planned.update_ipv4,
-                        planned.update_ipv6,
-                        type(exc).__name__,
-                    )
-                    self.store.log_update_event(hostname, ipv4, ipv6, DNS_FAILED, f"{type(exc).__name__}: {exc}", source_ip)
-                    raise
-                result = self.store.commit_update_result(planned)
-                self.store.log_update_event(hostname, result.ipv4, result.ipv6, UPDATED, "ok", source_ip)
-            else:
-                result = planned
-                self.store.log_update_rollup(hostname, result.ipv4, result.ipv6, UNCHANGED, "ok", source_ip)
-        return UpdateOutcome(result=result, source_ip=source_ip)
+        try:
+            ipv4, ipv6, update_ipv4, update_ipv6 = parse_update_ips(
+                source_ip,
+                myip,
+                ipaddr,
+                myipv6,
+                ip6addr,
+            )
+            lock = self._lock_for(hostname)
+            with lock:
+                planned = self.store.preview_update(hostname, ipv4, ipv6, update_ipv4=update_ipv4, update_ipv6=update_ipv6)
+                if planned.changed:
+                    try:
+                        publish_dns(planned, self.settings)
+                    except DnsReconciliationError as exc:
+                        is_reconcile_failure = True
+                        LOGGER.warning(
+                            "DNS reconciliation failed for hostname=%s update_ipv4=%s update_ipv6=%s error_type=%s",
+                            hostname,
+                            planned.update_ipv4,
+                            planned.update_ipv6,
+                            type(exc).__name__,
+                        )
+                        self.store.log_update_event(
+                            hostname,
+                            ipv4,
+                            ipv6,
+                            DNS_RECONCILE_FAILED,
+                            f"{type(exc).__name__}: {exc}",
+                            source_ip,
+                        )
+                        raise
+                    except DnsProviderError as exc:
+                        is_dns_failure = True
+                        LOGGER.warning(
+                            "DNS publish failed for hostname=%s update_ipv4=%s update_ipv6=%s error_type=%s",
+                            hostname,
+                            planned.update_ipv4,
+                            planned.update_ipv6,
+                            type(exc).__name__,
+                        )
+                        self.store.log_update_event(hostname, ipv4, ipv6, DNS_FAILED, f"{type(exc).__name__}: {exc}", source_ip)
+                        raise
+                    result = self.store.commit_update_result(planned)
+                    is_success = True
+                    self.store.log_update_event(hostname, result.ipv4, result.ipv6, UPDATED, "ok", source_ip)
+                else:
+                    result = planned
+                    is_success = True
+                    self.store.log_update_rollup(hostname, result.ipv4, result.ipv6, UNCHANGED, "ok", source_ip)
+            return UpdateOutcome(result=result, source_ip=source_ip)
+        except BadIpError:
+            is_bad_ip = True
+            raise
+        finally:
+            elapsed_ms = (time.perf_counter() - started_at) * 1000
+            self.store.record_update_metrics(
+                elapsed_ms,
+                is_success=is_success,
+                is_dns_failure=is_dns_failure,
+                is_reconcile_failure=is_reconcile_failure,
+                is_bad_ip=is_bad_ip,
+            )
 
     def fritz_update_url(self, account: dict[str, str]) -> str:
         base = self.settings.public_base_url.rstrip("/")
@@ -275,14 +315,21 @@ def normalize_hostname(value: str, settings: DdnsSettings, expand_suffix: bool =
     suffix = settings.hostname_suffix.strip().lower().strip(".")
     if expand_suffix and suffix and "." not in hostname:
         hostname = f"{hostname}.{suffix}"
-    label = r"[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?"
-    if not re.fullmatch(rf"{label}(\.{label})+", hostname):
+    if not _valid_domain_name(hostname):
         return ""
     return hostname
 
 
 def normalize_domain(value: str) -> str:
-    return normalize_hostname(value, DdnsSettings(), expand_suffix=False)
+    domain = value.strip().lower().rstrip(".")
+    if not _valid_domain_name(domain):
+        return ""
+    return domain
+
+
+def _valid_domain_name(value: str) -> bool:
+    label = r"[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?"
+    return bool(re.fullmatch(rf"{label}(\.{label})+", value))
 
 
 def dns_txt_contains(name: str, expected: str) -> bool:

router_dyndns/dns/__init__.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 from .base import (
     DnsConfigurationError,
     DnsProviderError,
+    DnsReconciliationError,
     delete_dns_records,
     dns_backend_configured,
     publish_dns,
@@ -14,6 +15,7 @@ from .rfc2136 import delete_rfc2136_records, publish_rfc2136
 __all__ = [
     "DnsConfigurationError",
     "DnsProviderError",
+    "DnsReconciliationError",
     "delete_cloudflare_records",
     "delete_dns_records",
     "delete_rfc2136_records",

router_dyndns/dns/base.py

@@ -9,6 +9,10 @@ class DnsProviderError(RuntimeError):
     """Raised for expected DNS provider publish/delete failures."""
 
 
+class DnsReconciliationError(DnsProviderError):
+    """Raised when provider read-back does not match the requested DNS state."""
+
+
 class DnsConfigurationError(RuntimeError):
     """Raised when DNS provider settings are invalid at startup."""
 

router_dyndns/dns/cloudflare.py

@@ -6,7 +6,7 @@ import urllib.parse
 import urllib.request
 
 from ..ddns_models import DdnsSettings, UpdateResult
-from .base import DnsProviderError
+from .base import DnsProviderError, DnsReconciliationError
 
 
 def publish_cloudflare(result: UpdateResult, settings: DdnsSettings) -> None:
@@ -45,6 +45,7 @@ def _cloudflare_upsert_record(settings: DdnsSettings, hostname: str, record_type
         _cloudflare_request(settings, f"/dns_records/{record['id']}", method="PATCH", payload=payload)
     else:
         _cloudflare_request(settings, "/dns_records", method="POST", payload=payload)
+    _cloudflare_reconcile_record(settings, hostname, record_type, value)
 
 
 def _cloudflare_find_record(settings: DdnsSettings, hostname: str, record_type: str) -> dict[str, str] | None:
@@ -54,6 +55,14 @@ def _cloudflare_find_record(settings: DdnsSettings, hostname: str, record_type:
     return records[0] if records else None
 
 
+def _cloudflare_reconcile_record(settings: DdnsSettings, hostname: str, record_type: str, value: str) -> None:
+    record = _cloudflare_find_record(settings, hostname, record_type)
+    if not record:
+        raise DnsReconciliationError(f"Cloudflare {record_type} record was not visible after publish")
+    if record.get("content") != value:
+        raise DnsReconciliationError(f"Cloudflare {record_type} record did not match requested content after publish")
+
+
 def _cloudflare_request(
     settings: DdnsSettings,
     path: str,

router_dyndns/event_statuses.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 DNS_DELETE_FAILED = "dns_delete_failed"
 DNS_FAILED = "dns_failed"
+DNS_RECONCILE_FAILED = "dns_reconcile_failed"
 UPDATED = "updated"
 UNCHANGED = "unchanged"
 

router_dyndns/routers/admin.py

@@ -19,6 +19,7 @@ from ..web.templates import _copy_row
 from ..web.templates_admin import _admin_secret_panel, _render_admin_page
 
 ADMIN_TABLE_LIMIT = 100
+ADMIN_JSON_OFFSET_CAP = 10_000
 
 
 def make_router(admin_path: str = "/admin") -> APIRouter:
@@ -42,6 +43,7 @@ def make_router(admin_path: str = "/admin") -> APIRouter:
             store.list_cleanup_runs(limit=ADMIN_TABLE_LIMIT, offset=table_offsets.get("cleanup_runs", 0)),
             store.list_scheduled_tasks(),
             store.list_update_events(ADMIN_TABLE_LIMIT, offset=table_offsets.get("update_events", 0)),
+            store.get_service_metrics(),
             {
                 "accounts": store.count_accounts(),
                 "domain_challenges": store.count_domain_challenges(),
@@ -131,7 +133,7 @@ def make_router(admin_path: str = "/admin") -> APIRouter:
                 "router update URL rotated by admin",
                 client_ip(request, settings),
             )
-            notice = _admin_secret_panel("Update URL rotated", [_copy_row("Update-URL:", service.fritz_update_url(rotated))]) if rotated else None
+            notice = _admin_secret_panel("Update URL changed", [_copy_row("Update-URL:", service.fritz_update_url(rotated))]) if rotated else None
         elif action == "management":
             rotated = await run_in_threadpool(store.rotate_management_slug, hostname)
             await run_in_threadpool(
@@ -143,7 +145,7 @@ def make_router(admin_path: str = "/admin") -> APIRouter:
                 "management URL rotated by admin",
                 client_ip(request, settings),
             )
-            notice = _admin_secret_panel("Private status page rotated", [_copy_row("Private status page:", service.magic_management_url(rotated))]) if rotated else None
+            notice = _admin_secret_panel("Dashboard link changed", [_copy_row("Private dashboard:", service.magic_management_url(rotated))]) if rotated else None
         elif action == "password":
             rotated = await run_in_threadpool(store.rotate_password, hostname)
             await run_in_threadpool(
@@ -157,10 +159,10 @@ def make_router(admin_path: str = "/admin") -> APIRouter:
             )
             if rotated:
                 notice = _admin_secret_panel(
-                    "Router password rotated",
+                    "Router password changed",
                     [
                         _copy_row("Domainnamen:", str(rotated["hostname"]), "Public"),
-                        _copy_row("One-box update URL:", service.credentialed_update_url(rotated), "Secret"),
+                        _copy_row("Full update URL:", service.credentialed_update_url(rotated), "Secret"),
                         _copy_row("Benutzername (optional):", str(rotated["username"]), "Public"),
                         _copy_row("Kennwort (optional):", str(rotated["password"]), "Secret"),
                     ],
@@ -187,7 +189,7 @@ def make_router(admin_path: str = "/admin") -> APIRouter:
             settings.cleanup_event_history_hours,
         )
         notice = _admin_secret_panel(
-            "Cleanup completed",
+            "Cleanup done",
             [
                 _copy_row("Domain claims removed", str(result["domain_challenges"])),
                 _copy_row("Unused hostnames removed", str(result["unused_accounts"])),
@@ -202,7 +204,7 @@ def make_router(admin_path: str = "/admin") -> APIRouter:
         store: StoreDep,
         _: None = Depends(authenticate_admin),
         limit: int = Query(100, ge=1, le=500),
-        offset: int = Query(0, ge=0),
+        offset: int = Query(0, ge=0, le=ADMIN_JSON_OFFSET_CAP),
     ) -> dict[str, object]:
         return {
             "items": store.list_records_page(limit=limit, offset=offset),
@@ -216,12 +218,16 @@ def make_router(admin_path: str = "/admin") -> APIRouter:
         store: StoreDep,
         _: None = Depends(authenticate_admin),
         limit: int = Query(100, ge=1, le=500),
-        offset: int = Query(0, ge=0),
+        offset: int = Query(0, ge=0, le=ADMIN_JSON_OFFSET_CAP),
+        before: str | None = Query(None, max_length=64),
     ) -> dict[str, object]:
+        items = store.list_update_events_before(limit=limit, before=before) if before else store.list_update_events_page(limit=limit, offset=offset)
+        next_before = str(items[-1]["created_at"]) if len(items) == limit and items[-1].get("created_at") else None
         return {
-            "items": store.list_update_events_page(limit=limit, offset=offset),
+            "items": items,
             "limit": limit,
             "offset": offset,
+            "next_before": next_before,
             "total": store.count_update_events(),
         }
 

router_dyndns/routers/api.py

@@ -22,6 +22,7 @@ from ..schemas import (
     _credentials_response,
     _managed_record,
 )
+from .path_params import ManagementSlugPath, UpdateSlugPath
 
 router = APIRouter(prefix="/api/v1")
 
@@ -30,7 +31,7 @@ router = APIRouter(prefix="/api/v1")
     "/hostnames/magic",
     response_model=HostnameCredentials,
     status_code=status.HTTP_201_CREATED,
-    summary="Generate a provider-owned DynDNS hostname",
+    summary="Create a KarlDNS hostname",
     tags=["hostnames"],
     responses={500: {"model": ErrorResponse}},
 )
@@ -42,12 +43,12 @@ async def create_magic_hostname(payload: MagicHostnameRequest, service: ServiceD
 @router.get(
     "/management/{management_slug}",
     response_model=ManagedRecord,
-    summary="Read a hostname by magic management link",
-    description="Uses the secret bearer management slug. Dashboard passwords protect only the web dashboard and are not required for this JSON API route.",
+    summary="Read a hostname by private dashboard link",
+    description="Uses the private dashboard link secret. Dashboard passwords protect only the web dashboard, not this API endpoint.",
     tags=["management"],
     responses={404: {"model": ErrorResponse}},
 )
-async def read_managed_hostname(management_slug: str, store: StoreDep, service: ServiceDep) -> ManagedRecord:
+async def read_managed_hostname(management_slug: ManagementSlugPath, store: StoreDep, service: ServiceDep) -> ManagedRecord:
     account = await run_in_threadpool(store.get_account_by_management_slug, management_slug)
     if not account or account["disabled"]:
         raise HTTPException(status_code=404, detail="not found")
@@ -57,12 +58,12 @@ async def read_managed_hostname(management_slug: str, store: StoreDep, service:
 @router.delete(
     "/management/{management_slug}",
     status_code=status.HTTP_204_NO_CONTENT,
-    summary="Delete a hostname by magic management link",
-    description="Uses the secret bearer management slug. Dashboard passwords protect only the web dashboard and are not required for this JSON API route.",
+    summary="Delete a hostname by private dashboard link",
+    description="Uses the private dashboard link secret. Dashboard passwords protect only the web dashboard, not this API endpoint.",
     tags=["management"],
     responses={404: {"model": ErrorResponse}, 500: {"model": ErrorResponse}},
 )
-async def delete_managed_hostname(management_slug: str, store: StoreDep, service: ServiceDep) -> Response:
+async def delete_managed_hostname(management_slug: ManagementSlugPath, store: StoreDep, service: ServiceDep) -> Response:
     account = await run_in_threadpool(store.get_account_by_management_slug, management_slug)
     if not account or account["disabled"]:
         raise HTTPException(status_code=404, detail="not found")
@@ -70,7 +71,7 @@ async def delete_managed_hostname(management_slug: str, store: StoreDep, service
     try:
         await run_in_threadpool(service.delete_account, hostname, "api")
     except DnsProviderError as exc:
-        raise HTTPException(status_code=500, detail="DNS delete failed; hostname was not deleted") from exc
+        raise HTTPException(status_code=500, detail="DNS delete failed. Hostname was not deleted.") from exc
     return Response(status_code=status.HTTP_204_NO_CONTENT)
 
 
@@ -116,7 +117,7 @@ async def verify_domain(payload: VerifyDomainRequest, service: ServiceDep) -> Ve
     return VerifyDomainResponse(
         domain=domain,
         verified=True,
-        message="domain verified",
+        message="Domain verified",
         claim_secret=payload.claim_secret,
     )
 
@@ -125,7 +126,7 @@ async def verify_domain(payload: VerifyDomainRequest, service: ServiceDep) -> Ve
     "/hostnames/custom",
     response_model=HostnameCredentials,
     status_code=status.HTTP_201_CREATED,
-    summary="Generate credentials for a verified custom hostname",
+    summary="Create a hostname for a verified domain",
     tags=["hostnames"],
     responses={400: {"model": ErrorResponse}, 403: {"model": ErrorResponse}, 409: {"model": ErrorResponse}},
 )
@@ -147,7 +148,7 @@ async def create_custom_hostname(payload: CustomHostnameRequest, service: Servic
     responses={404: {"model": ErrorResponse}, 500: {"model": ErrorResponse}},
 )
 async def update_hostname(
-    update_slug: str,
+    update_slug: UpdateSlugPath,
     request: Request,
     store: StoreDep,
     service: ServiceDep,
@@ -174,6 +175,6 @@ async def update_hostname(
     except BadIpError as exc:
         raise HTTPException(status_code=400, detail=str(exc)) from exc
     except DnsProviderError as exc:
-        raise HTTPException(status_code=500, detail="DNS publish failed") from exc
+        raise HTTPException(status_code=500, detail="DNS update failed") from exc
     result = outcome.result
     return RouterUpdateResponse(status="good" if result.changed else "nochg", hostname=hostname, ip=result.ipv4 or result.ipv6 or "")

router_dyndns/routers/assets.py

@@ -5,13 +5,13 @@ from pathlib import Path
 from fastapi import APIRouter, Response
 from fastapi.responses import FileResponse, RedirectResponse
 
-from ..web.styles import APP_CSS
+from ..web.styles import ADMIN_CSS, BASE_CSS
 
 ASSET_DIR = Path(__file__).parents[1] / "assets"
 router = APIRouter(include_in_schema=False)
-ASSET_CACHE_HEADERS = {"Cache-Control": "public, max-age=3600"}
+ASSET_CACHE_HEADERS = {"Cache-Control": "public, max-age=31536000, immutable"}
 
-APP_JS = """
+THEME_JS = """
 (() => {
   const media = window.matchMedia("(prefers-color-scheme: dark)");
   const storageKey = "karldns-theme";
@@ -30,8 +30,9 @@ APP_JS = """
   };
   const syncToggle = (theme) => {
     document.querySelectorAll("[data-theme-toggle]").forEach((button) => {
-      button.textContent = theme === "dark" ? "Dark" : "Light";
-      button.setAttribute("aria-label", `Switch to ${theme === "dark" ? "light" : "dark"} theme`);
+      const nextTheme = theme === "dark" ? "light" : "dark";
+      button.dataset.themeNext = nextTheme;
+      button.setAttribute("aria-label", `Switch to ${nextTheme.toLowerCase()} theme`);
     });
   };
   const applyTheme = (requestedTheme = storedTheme() || systemTheme()) => {
@@ -54,7 +55,10 @@ APP_JS = """
     applyTheme(nextTheme);
   });
 })();
+""".strip()
 
+
+CLIPBOARD_JS = """
 document.addEventListener("click", async (event) => {
   const toggle = event.target.closest("[data-secret-toggle]");
   if (toggle) {
@@ -87,7 +91,10 @@ document.addEventListener("click", async (event) => {
     }, 1200);
   } catch (_) {}
 });
+""".strip()
 
+
+ADMIN_TABLES_JS = """
 document.querySelectorAll("[data-admin-table]").forEach((tableShell) => {
   const table = tableShell.querySelector("table");
   const tbody = tableShell.querySelector("tbody");
@@ -176,10 +183,22 @@ document.querySelectorAll("[data-admin-table]").forEach((tableShell) => {
 """.strip()
 
 
+def _minify_css(css: str) -> str:
+    return " ".join(css.split()).replace(" {", "{").replace("{ ", "{").replace("; ", ";").replace(": ", ":").replace(", ", ",").replace(" }", "}").replace(";}", "}")
+
+
+MINIFIED_BASE_CSS = _minify_css(BASE_CSS)
+MINIFIED_ADMIN_CSS = _minify_css(ADMIN_CSS)
+
+
 @router.get("/favicon.ico")
 def favicon() -> FileResponse:
     return FileResponse(ASSET_DIR / "favicon.ico", media_type="image/x-icon", headers=ASSET_CACHE_HEADERS)
 
+@router.get("/bootstrap-subset.css")
+def bootstrap_subset_css() -> FileResponse:
+    return FileResponse(ASSET_DIR / "bootstrap-subset.css", media_type="text/css", headers=ASSET_CACHE_HEADERS)
+
 @router.get("/favicon-16x16.png")
 def favicon_16_png() -> FileResponse:
     return FileResponse(ASSET_DIR / "favicon-16x16.png", media_type="image/png", headers=ASSET_CACHE_HEADERS)
@@ -196,6 +215,14 @@ def apple_touch_icon_png() -> FileResponse:
 def logo_png() -> FileResponse:
     return FileResponse(ASSET_DIR / "logo.png", media_type="image/png", headers=ASSET_CACHE_HEADERS)
 
+@router.get("/logo.webp")
+def logo_webp() -> FileResponse:
+    return FileResponse(ASSET_DIR / "logo.webp", media_type="image/webp", headers=ASSET_CACHE_HEADERS)
+
+@router.get("/logo-nav.webp")
+def logo_nav_webp() -> FileResponse:
+    return FileResponse(ASSET_DIR / "logo-nav.webp", media_type="image/webp", headers=ASSET_CACHE_HEADERS)
+
 @router.get("/logo-192.png")
 def logo_192_png() -> FileResponse:
     return FileResponse(ASSET_DIR / "logo-192.png", media_type="image/png", headers=ASSET_CACHE_HEADERS)
@@ -204,6 +231,14 @@ def logo_192_png() -> FileResponse:
 def logo_512_png() -> FileResponse:
     return FileResponse(ASSET_DIR / "logo-512.png", media_type="image/png", headers=ASSET_CACHE_HEADERS)
 
+@router.get("/social-preview.png")
+def social_preview_png() -> FileResponse:
+    return FileResponse(ASSET_DIR / "social-preview.png", media_type="image/png", headers=ASSET_CACHE_HEADERS)
+
+@router.get("/social-preview.webp")
+def social_preview_webp() -> FileResponse:
+    return FileResponse(ASSET_DIR / "social-preview.webp", media_type="image/webp", headers=ASSET_CACHE_HEADERS)
+
 @router.get("/site.webmanifest")
 def site_webmanifest() -> Response:
     return Response(
@@ -211,7 +246,7 @@ def site_webmanifest() -> Response:
 {
   "name": "KarlDNS",
   "short_name": "KarlDNS",
-  "description": "Accountless Dynamic DNS for routers and home labs.",
+  "description": "Private update links for routers.",
   "start_url": "/",
   "scope": "/",
   "display": "standalone",
@@ -227,14 +262,29 @@ def site_webmanifest() -> Response:
         headers=ASSET_CACHE_HEADERS,
     )
 
-@router.get("/app.js")
-def app_js() -> Response:
-    return Response(APP_JS, media_type="application/javascript", headers=ASSET_CACHE_HEADERS)
+@router.get("/theme.js")
+def theme_js() -> Response:
+    return Response(THEME_JS, media_type="application/javascript", headers=ASSET_CACHE_HEADERS)
+
+
+@router.get("/clipboard.js")
+def clipboard_js() -> Response:
+    return Response(CLIPBOARD_JS, media_type="application/javascript", headers=ASSET_CACHE_HEADERS)
+
+
+@router.get("/admin-tables.js")
+def admin_tables_js() -> Response:
+    return Response(ADMIN_TABLES_JS, media_type="application/javascript", headers=ASSET_CACHE_HEADERS)
 
 
 @router.get("/app.css")
 def app_css() -> Response:
-    return Response(APP_CSS, media_type="text/css", headers=ASSET_CACHE_HEADERS)
+    return Response(MINIFIED_BASE_CSS, media_type="text/css", headers=ASSET_CACHE_HEADERS)
+
+
+@router.get("/admin.css")
+def admin_css() -> Response:
+    return Response(MINIFIED_ADMIN_CSS, media_type="text/css", headers=ASSET_CACHE_HEADERS)
 
 
 @router.get("/install.sh")

router_dyndns/routers/management.py

@@ -26,6 +26,7 @@ from .management_shared import (
     locked_management_response,
     render_management_page_async,
 )
+from .path_params import ManagementSlugPath
 
 router = APIRouter()
 router.include_router(management_passwords.router)
@@ -33,24 +34,24 @@ router.include_router(management_domains.router)
 
 
 @router.get("/m/{management_slug}", response_class=HTMLResponse, include_in_schema=False)
-def manage_magic(management_slug: str, request: Request, settings: SettingsDep, store: StoreDep, service: ServiceDep) -> str:
+def manage_magic(management_slug: ManagementSlugPath, request: Request, settings: SettingsDep, store: StoreDep, service: ServiceDep) -> str:
     account = get_active_management_account(store, management_slug)
     csrf_token = dashboard_csrf_token(management_slug, account)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return _render_management_unlock_page(management_slug, account, csrf_token)
     return _render_management_page(service, settings, management_slug, account, csrf_token)
 
 
 @router.post("/m/{management_slug}/rotate", response_class=HTMLResponse, include_in_schema=False)
 async def rotate_magic_credentials(
-    management_slug: str,
+    management_slug: ManagementSlugPath,
     request: Request,
     settings: SettingsDep,
     store: StoreDep,
     service: ServiceDep,
 ) -> str:
     account = await get_active_management_account_async(store, management_slug)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return locked_management_response(management_slug, account)
     form = await request_form(request, settings)
     require_dashboard_csrf(management_slug, account, first_form_value(form, "csrf"))
@@ -75,7 +76,7 @@ async def rotate_magic_credentials(
             management_slug,
             rotated,
             dashboard_csrf_token(management_slug, rotated),
-            message="Update-URL rotated.",
+            message="Update URL changed. Update your router now.",
         )
     if action == "password":
         rotated = await run_in_threadpool(store.rotate_password, hostname)
@@ -97,16 +98,16 @@ async def rotate_magic_credentials(
             management_slug,
             rotated,
             dashboard_csrf_token(management_slug, rotated),
-            message="Router credentials rotated. Copy the new password now.",
+            message="Router password changed. Copy it now.",
             created_account=rotated,
         )
     raise _bad_rotation_action()
 
 
 @router.post("/m/{management_slug}/delete", include_in_schema=False)
-async def delete_magic(management_slug: str, request: Request, settings: SettingsDep, store: StoreDep, service: ServiceDep) -> Response:
+async def delete_magic(management_slug: ManagementSlugPath, request: Request, settings: SettingsDep, store: StoreDep, service: ServiceDep) -> Response:
     account = await get_active_management_account_async(store, management_slug)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return HTMLResponse(_render_management_unlock_page(management_slug, account, dashboard_csrf_token(management_slug, account)), status_code=401)
     form = await request_form(request, settings)
     require_dashboard_csrf(management_slug, account, first_form_value(form, "csrf"))
@@ -114,7 +115,7 @@ async def delete_magic(management_slug: str, request: Request, settings: Setting
     try:
         await run_in_threadpool(service.delete_account, hostname, "management-link")
     except DnsProviderError:
-        return PlainTextResponse("DNS delete failed; hostname was not deleted", status_code=500)
+        return PlainTextResponse("DNS delete failed. Hostname was not deleted.", status_code=500)
     await run_in_threadpool(
         store.log_update_event,
         hostname,
@@ -126,7 +127,7 @@ async def delete_magic(management_slug: str, request: Request, settings: Setting
     )
     return HTMLResponse(
         _page(
-            "DynDNS deleted",
+            "Hostname deleted",
             trusted(
                 """
             <main>

router_dyndns/routers/management_domains.py

@@ -23,12 +23,13 @@ from .management_shared import (
     locked_management_response,
     render_management_page_async,
 )
+from .path_params import ClaimSecretPath, ManagementSlugPath
 
 router = APIRouter()
 
 
 @router.get("/d/{claim_secret}", response_class=HTMLResponse, include_in_schema=False)
-async def manage_domain_claim(claim_secret: str, settings: SettingsDep, store: StoreDep, service: ServiceDep) -> str:
+async def manage_domain_claim(claim_secret: ClaimSecretPath, settings: SettingsDep, store: StoreDep, service: ServiceDep) -> str:
     challenge = await run_in_threadpool(store.get_domain_challenge_by_secret, claim_secret)
     if not challenge:
         raise HTTPException(status_code=404, detail="not found")
@@ -37,14 +38,14 @@ async def manage_domain_claim(claim_secret: str, settings: SettingsDep, store: S
 
 @router.post("/m/{management_slug}/domains/request", response_class=HTMLResponse, include_in_schema=False)
 async def request_dashboard_domain(
-    management_slug: str,
+    management_slug: ManagementSlugPath,
     request: Request,
     settings: SettingsDep,
     store: StoreDep,
     service: ServiceDep,
 ) -> str:
     account = await get_active_management_account_async(store, management_slug)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return locked_management_response(management_slug, account)
     form = await request_form(request, settings)
     require_dashboard_csrf(management_slug, account, first_form_value(form, "csrf"))
@@ -71,28 +72,28 @@ async def request_dashboard_domain(
         management_slug,
         account,
         dashboard_csrf_token(management_slug, account),
-        message="Domain claim created. Add the TXT record, then verify it.",
+        message="Claim created. Add the TXT record, then verify it.",
         challenge=challenge,
     )
 
 
 @router.post("/m/{management_slug}/domains/verify", response_class=HTMLResponse, include_in_schema=False)
 async def verify_dashboard_domain(
-    management_slug: str,
+    management_slug: ManagementSlugPath,
     request: Request,
     settings: SettingsDep,
     store: StoreDep,
     service: ServiceDep,
 ) -> str:
     account = await get_active_management_account_async(store, management_slug)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return locked_management_response(management_slug, account)
     form = await request_form(request, settings)
     require_dashboard_csrf(management_slug, account, first_form_value(form, "csrf"))
     domain = normalize_domain(first_form_value(form, "domain"))
     claim_secret = first_form_value(form, "claim_secret")
     found, challenge = await run_in_threadpool(service.verify_domain, domain, claim_secret, str(account["hostname"]))
-    message = "Domain verified. You can now create a custom hostname." if found else "TXT record not found yet. DNS propagation can take a few minutes."
+    message = "Domain verified. You can create a hostname now." if found else "TXT record not found yet. Try again in a few minutes."
     await run_in_threadpool(
         store.log_update_event,
         str(account["hostname"]),
@@ -115,14 +116,14 @@ async def verify_dashboard_domain(
 
 @router.post("/m/{management_slug}/domains/hostnames", response_class=HTMLResponse, include_in_schema=False)
 async def create_dashboard_custom_hostname(
-    management_slug: str,
+    management_slug: ManagementSlugPath,
     request: Request,
     settings: SettingsDep,
     store: StoreDep,
     service: ServiceDep,
 ) -> str:
     account = await get_active_management_account_async(store, management_slug)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return locked_management_response(management_slug, account)
     form = await request_form(request, settings)
     require_dashboard_csrf(management_slug, account, first_form_value(form, "csrf"))
@@ -148,6 +149,6 @@ async def create_dashboard_custom_hostname(
         management_slug,
         account,
         dashboard_csrf_token(management_slug, account),
-        message="Custom hostname created. Copy these router settings now.",
+        message="Hostname created. Copy these router settings now.",
         created_account=created,
     )

router_dyndns/routers/management_passwords.py

@@ -18,12 +18,13 @@ from .management_shared import (
     set_unlock_cookie,
     unlock_cookie_seconds,
 )
+from .path_params import ManagementSlugPath
 
 router = APIRouter()
 
 
 @router.post("/m/{management_slug}/unlock", include_in_schema=False)
-async def unlock_magic(management_slug: str, request: Request, settings: SettingsDep, store: StoreDep) -> Response:
+async def unlock_magic(management_slug: ManagementSlugPath, request: Request, settings: SettingsDep, store: StoreDep) -> Response:
     account = await get_active_management_account_async(store, management_slug)
     if not account.get("dashboard_password_hash"):
         return RedirectResponse(f"/m/{management_slug}", status_code=303)
@@ -34,7 +35,7 @@ async def unlock_magic(management_slug: str, request: Request, settings: Setting
     is_valid = await run_in_threadpool(store.verify_dashboard_password, hostname, password)
     if not is_valid:
         return HTMLResponse(
-            _render_management_unlock_page(management_slug, account, dashboard_csrf_token(management_slug, account), "Incorrect dashboard password."),
+            _render_management_unlock_page(management_slug, account, dashboard_csrf_token(management_slug, account), "Incorrect password."),
             status_code=401,
         )
     response = RedirectResponse(f"/m/{management_slug}", status_code=303)
@@ -50,14 +51,14 @@ async def unlock_magic(management_slug: str, request: Request, settings: Setting
 
 @router.post("/m/{management_slug}/password", include_in_schema=False)
 async def set_dashboard_password(
-    management_slug: str,
+    management_slug: ManagementSlugPath,
     request: Request,
     settings: SettingsDep,
     store: StoreDep,
     service: ServiceDep,
 ) -> Response:
     account = await get_active_management_account_async(store, management_slug)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return HTMLResponse(_render_management_unlock_page(management_slug, account, dashboard_csrf_token(management_slug, account)), status_code=401)
     form = await request_form(request, settings)
     require_dashboard_csrf(management_slug, account, first_form_value(form, "csrf"))
@@ -69,7 +70,7 @@ async def set_dashboard_password(
             first_form_value(form, "current_dashboard_password"),
         )
         if not is_current:
-            return await management_error_response_async(service, settings, management_slug, account, "Current dashboard password is incorrect.")
+            return await management_error_response_async(service, settings, management_slug, account, "Current password is incorrect.")
     password = first_form_value(form, "dashboard_password")
     confirm = first_form_value(form, "dashboard_password_confirm")
     if len(password) < 8:
@@ -79,7 +80,7 @@ async def set_dashboard_password(
             management_slug,
             account,
             dashboard_csrf_token(management_slug, account),
-            message="Dashboard password must be at least 8 characters.",
+            message="Password must be at least 8 characters.",
         )
         return HTMLResponse(page, status_code=400)
     if password != confirm:
@@ -89,7 +90,7 @@ async def set_dashboard_password(
             management_slug,
             account,
             dashboard_csrf_token(management_slug, account),
-            message="Dashboard password confirmation did not match.",
+            message="The passwords do not match.",
         )
         return HTMLResponse(page, status_code=400)
     had_password = bool(account.get("dashboard_password_hash"))
@@ -111,14 +112,14 @@ async def set_dashboard_password(
 
 @router.post("/m/{management_slug}/password/remove", include_in_schema=False)
 async def remove_dashboard_password(
-    management_slug: str,
+    management_slug: ManagementSlugPath,
     request: Request,
     settings: SettingsDep,
     store: StoreDep,
     service: ServiceDep,
 ) -> Response:
     account = await get_active_management_account_async(store, management_slug)
-    if not has_management_access(request, management_slug, account):
+    if not has_management_access(request, settings, management_slug, account):
         return HTMLResponse(_render_management_unlock_page(management_slug, account, dashboard_csrf_token(management_slug, account)), status_code=401)
     form = await request_form(request, settings)
     require_dashboard_csrf(management_slug, account, first_form_value(form, "csrf"))
@@ -130,7 +131,7 @@ async def remove_dashboard_password(
             first_form_value(form, "current_dashboard_password"),
         )
         if not is_current:
-            return await management_error_response_async(service, settings, management_slug, account, "Current dashboard password is incorrect.")
+            return await management_error_response_async(service, settings, management_slug, account, "Current password is incorrect.")
     await run_in_threadpool(store.clear_dashboard_password, hostname)
     await run_in_threadpool(
         store.log_update_event,

router_dyndns/routers/management_shared.py

@@ -7,6 +7,7 @@ from starlette.concurrency import run_in_threadpool
 from ..ddns_models import DdnsSettings
 from ..ddns_security import (
     DASHBOARD_UNLOCK_COOKIE,
+    dashboard_cookie_signing_secret,
     dashboard_csrf_token,
     sign_dashboard_unlock_cookie,
     verify_dashboard_unlock_cookie,
@@ -30,7 +31,7 @@ async def get_active_management_account_async(store: DdnsStore, management_slug:
     return await run_in_threadpool(get_active_management_account, store, management_slug)
 
 
-def has_management_access(request: Request, management_slug: str, account: ManagementAccount) -> bool:
+def has_management_access(request: Request, settings: DdnsSettings, management_slug: str, account: ManagementAccount) -> bool:
     password_hash = account.get("dashboard_password_hash")
     if not password_hash:
         return True
@@ -38,6 +39,7 @@ def has_management_access(request: Request, management_slug: str, account: Manag
         str(account["hostname"]),
         management_slug,
         str(password_hash),
+        dashboard_cookie_signing_secret(settings),
         request.cookies.get(DASHBOARD_UNLOCK_COOKIE),
     )
 
@@ -100,11 +102,18 @@ def set_unlock_cookie(
     max_age_seconds: int,
 ) -> None:
     password_hash = account.get("dashboard_password_hash")
-    if not password_hash:
+    signing_secret = dashboard_cookie_signing_secret(settings)
+    if not password_hash or not signing_secret:
         return
     response.set_cookie(
         DASHBOARD_UNLOCK_COOKIE,
-        sign_dashboard_unlock_cookie(str(account["hostname"]), management_slug, str(password_hash), max_age_seconds),
+        sign_dashboard_unlock_cookie(
+            str(account["hostname"]),
+            management_slug,
+            str(password_hash),
+            signing_secret,
+            max_age_seconds,
+        ),
         max_age=max_age_seconds,
         path=f"/m/{management_slug}",
         httponly=True,

router_dyndns/routers/path_params.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import Path
+
+TOKEN_URLSAFE_PATTERN = r"^[A-Za-z0-9_-]+$"
+TOKEN_MIN_LENGTH = 32
+TOKEN_MAX_LENGTH = 128
+
+UpdateSlugPath = Annotated[
+    str,
+    Path(
+        min_length=TOKEN_MIN_LENGTH,
+        max_length=TOKEN_MAX_LENGTH,
+        pattern=TOKEN_URLSAFE_PATTERN,
+        description="Private update URL value.",
+    ),
+]
+ManagementSlugPath = Annotated[
+    str,
+    Path(
+        min_length=TOKEN_MIN_LENGTH,
+        max_length=TOKEN_MAX_LENGTH,
+        pattern=TOKEN_URLSAFE_PATTERN,
+        description="Private dashboard URL value.",
+    ),
+]
+ClaimSecretPath = Annotated[
+    str,
+    Path(
+        min_length=TOKEN_MIN_LENGTH,
+        max_length=TOKEN_MAX_LENGTH,
+        pattern=TOKEN_URLSAFE_PATTERN,
+        description="Private domain claim value.",
+    ),
+]

router_dyndns/routers/public.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import sqlite3
 
 from fastapi import APIRouter, HTTPException, Request
-from fastapi.responses import HTMLResponse, PlainTextResponse, RedirectResponse
+from fastapi.responses import HTMLResponse, PlainTextResponse, RedirectResponse, Response
 from starlette.concurrency import run_in_threadpool
 
 from ..ddns_security import client_ip
@@ -52,9 +52,9 @@ async def verify_domain(request: Request, settings: SettingsDep, service: Servic
     claim_secret = first_form_value(form, "claim_secret")
     found, challenge = await run_in_threadpool(service.verify_domain, domain, claim_secret)
     if not found:
-        message = "TXT record not found yet. DNS propagation can take a few minutes."
+        message = "TXT record not found yet. Try again in a few minutes."
         return _render_public_home(service, settings, None, message, challenge)
-    return _render_public_home(service, settings, None, "Domain verified. You can now create a hostname under it.", challenge)
+    return _render_public_home(service, settings, None, "Domain verified. You can create a hostname now.", challenge)
 
 
 @router.post("/accounts", response_class=HTMLResponse, include_in_schema=False)
@@ -85,5 +85,47 @@ def visible_ip(request: Request, settings: SettingsDep) -> str:
 
 
 @router.get("/privacy", response_class=HTMLResponse, include_in_schema=False)
-def privacy() -> str:
-    return _render_privacy_page()
+def privacy(settings: SettingsDep) -> str:
+    return _render_privacy_page(settings)
+
+
+@router.get("/robots.txt", response_class=PlainTextResponse, include_in_schema=False)
+def robots_txt(settings: SettingsDep) -> str:
+    base_url = settings.public_base_url.rstrip("/")
+    admin_path = settings.admin_path.rstrip("/")
+    return "\n".join(
+        [
+            "User-agent: *",
+            f"Disallow: {admin_path}/",
+            "Disallow: /m/",
+            "Disallow: /d/",
+            "Disallow: /u/",
+            "Disallow: /nic/",
+            "Disallow: /api/",
+            "Disallow: /docs",
+            "Disallow: /redoc",
+            "Disallow: /openapi.json",
+            f"Sitemap: {base_url}/sitemap.xml",
+            "",
+        ]
+    )
+
+
+@router.get("/sitemap.xml", include_in_schema=False)
+def sitemap_xml(settings: SettingsDep) -> Response:
+    base_url = settings.public_base_url.rstrip("/")
+    body = f"""<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url>
+    <loc>{base_url}/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>1.0</priority>
+  </url>
+  <url>
+    <loc>{base_url}/privacy</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.3</priority>
+  </url>
+</urlset>
+"""
+    return Response(body, media_type="application/xml")

router_dyndns/routers/updates.py

@@ -6,13 +6,14 @@ from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from fastapi.responses import PlainTextResponse
 
 from ..dependencies import ServiceDep, SettingsDep, StoreDep, apply_update_response, authenticate_update
+from .path_params import UpdateSlugPath
 
 router = APIRouter()
 
 
 @router.get("/u/{update_slug}", response_class=PlainTextResponse, response_model=None)
 def slug_update(
-    update_slug: str,
+    update_slug: UpdateSlugPath,
     request: Request,
     store: StoreDep,
     service: ServiceDep,

router_dyndns/schemas.py

@@ -17,17 +17,17 @@ class HostnameCredentials(BaseModel):
     hostname: str
     username: str
     password: str = Field(description="Secret router password. Store it now; it is not recoverable later.")
-    update_url: str = Field(description="Secret bearer update URL for router DynDNS updates.")
+    update_url: str = Field(description="Secret update URL for router DynDNS updates.")
     credentialed_update_url: str = Field(
-        description="Secret update URL with router credentials embedded in the query string."
+        description="Secret full update URL with router username and password included."
     )
-    management_url: str = Field(description="Secret bearer management URL for reading or deleting this hostname.")
+    management_url: str = Field(description="Secret dashboard URL for reading or deleting this hostname.")
 
 
 class ManagedRecord(BaseModel):
     hostname: str
     username: str
-    update_url: str = Field(description="Secret bearer update URL for router DynDNS updates.")
+    update_url: str = Field(description="Secret update URL for router DynDNS updates.")
     ipv4: str | None = None
     ipv6: str | None = None
     updated_at: str | None = None
@@ -43,7 +43,7 @@ class DomainChallengeResponse(BaseModel):
     domain: str
     txt_name: str
     txt_value: str
-    claim_secret: str = Field(description="Secret bearer token for returning to and verifying this domain claim.")
+    claim_secret: str = Field(description="Secret value used to return to and verify this domain claim.")
 
 
 class VerifyDomainRequest(BaseModel):
@@ -57,7 +57,7 @@ class VerifyDomainResponse(BaseModel):
     domain: str
     verified: bool
     message: str
-    claim_secret: str = Field(description="Secret bearer token for continuing this domain claim flow.")
+    claim_secret: str = Field(description="Secret value used to continue this domain claim flow.")
 
 
 class CustomHostnameRequest(BaseModel):

router_dyndns/store/__init__.py

@@ -8,13 +8,14 @@ from time import monotonic
 
 from .accounts import AccountsMixin
 from .domains import DomainsMixin
+from .metrics import MetricsMixin
 from .rate_limit import RateLimitCleanupMixin
 from .records import RecordsEventsMixin
 from .scheduler import SchedulerMixin
 from .schema import connect_database, initialize_schema
 
 
-class DdnsStore(AccountsMixin, DomainsMixin, RecordsEventsMixin, RateLimitCleanupMixin, SchedulerMixin):
+class DdnsStore(AccountsMixin, DomainsMixin, MetricsMixin, RecordsEventsMixin, RateLimitCleanupMixin, SchedulerMixin):
     def __init__(self, database_path: Path) -> None:
         self.database_path = database_path
         self._connections = threading.local()

router_dyndns/store/accounts.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 
 import re
 import secrets
-import sqlite3
 from datetime import UTC, datetime
 
 from ..ddns_security import hash_lookup_token, hash_secret, verify_secret
@@ -36,7 +35,6 @@ class AccountsMixin:
 
     def list_accounts(self, limit: int = 100, offset: int = 0) -> list[AccountRow]:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             rows = conn.execute(
                 """
             SELECT accounts.hostname, accounts.username, accounts.update_slug,
@@ -57,7 +55,6 @@ class AccountsMixin:
 
     def get_account_by_hostname(self, hostname: str) -> AccountRow | None:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             account = conn.execute(
                 """
                 SELECT accounts.hostname, accounts.username, accounts.update_slug, accounts.dashboard_password_hash,
@@ -72,7 +69,6 @@ class AccountsMixin:
 
     def get_account_by_slug(self, update_slug: str) -> AccountRow | None:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             account = conn.execute(
                 """
                 SELECT hostname, username, token_hash, update_slug, disabled FROM accounts
@@ -84,7 +80,6 @@ class AccountsMixin:
 
     def get_account_by_management_slug(self, management_slug: str) -> AccountRow | None:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             account = conn.execute(
                 """
                 SELECT accounts.hostname, accounts.username, accounts.update_slug, accounts.dashboard_password_hash,
@@ -101,7 +96,6 @@ class AccountsMixin:
         if not username or not token:
             return False
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             account = conn.execute(
                 """
                 SELECT token_hash, disabled FROM accounts
@@ -162,7 +156,6 @@ class AccountsMixin:
         if not password:
             return False
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             account = conn.execute(
                 """
                 SELECT dashboard_password_hash, disabled FROM accounts

router_dyndns/store/domains.py

@@ -47,7 +47,6 @@ class DomainsMixin:
         now = datetime.now(UTC).isoformat()
         claim_hash = hash_lookup_token(claim_secret)
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             sql = "SELECT domain, token, owner_hostname, verified_at FROM domain_challenges WHERE domain = ? AND claim_hash = ?"
             params = [domain, claim_hash]
             if owner_hostname is not None:
@@ -76,7 +75,6 @@ class DomainsMixin:
         owner_hostname: str | None = None,
     ) -> DomainChallengeRow | None:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             sql = "SELECT domain, token, owner_hostname, verified_at FROM domain_challenges WHERE domain = ?"
             params = [domain]
             if claim_secret is not None:
@@ -90,7 +88,6 @@ class DomainsMixin:
 
     def get_domain_challenge_by_secret(self, claim_secret: str) -> DomainChallengeRow | None:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             challenge = conn.execute(
                 "SELECT domain, token, owner_hostname, verified_at FROM domain_challenges WHERE claim_hash = ?",
                 (hash_lookup_token(claim_secret),),
@@ -103,7 +100,6 @@ class DomainsMixin:
 
     def list_domain_challenges(self, limit: int = 100, offset: int = 0) -> list[DomainChallengeRow]:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             rows = conn.execute(
                 """
                 SELECT domain, owner_hostname, created_at, verified_at

router_dyndns/store/metrics.py

@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+
+class MetricsMixin:
+    def increment_metric(self, name: str, amount: float = 1.0) -> None:
+        now = datetime.now(UTC).isoformat()
+        with self.connect() as conn:
+            conn.execute(
+                """
+                INSERT INTO service_metrics(name, value, updated_at)
+                VALUES (?, ?, ?)
+                ON CONFLICT(name) DO UPDATE SET
+                  value=value + excluded.value,
+                  updated_at=excluded.updated_at
+                """,
+                (name, amount, now),
+            )
+
+    def set_metric(self, name: str, value: float) -> None:
+        now = datetime.now(UTC).isoformat()
+        with self.connect() as conn:
+            conn.execute(
+                """
+                INSERT INTO service_metrics(name, value, updated_at)
+                VALUES (?, ?, ?)
+                ON CONFLICT(name) DO UPDATE SET
+                  value=excluded.value,
+                  updated_at=excluded.updated_at
+                """,
+                (name, value, now),
+            )
+
+    def get_service_metrics(self) -> dict[str, float]:
+        with self.connect() as conn:
+            rows = conn.execute("SELECT name, value FROM service_metrics").fetchall()
+        return {str(row["name"]): float(row["value"]) for row in rows}
+
+    def record_update_metrics(
+        self,
+        latency_ms: float,
+        *,
+        is_success: bool = False,
+        is_dns_failure: bool = False,
+        is_reconcile_failure: bool = False,
+        is_bad_ip: bool = False,
+    ) -> None:
+        increments = {
+            "update_requests_total": 1,
+            "update_latency_ms_total": latency_ms,
+            "update_latency_samples_total": 1,
+        }
+        if is_success:
+            increments["update_success_total"] = 1
+        if is_dns_failure:
+            increments["dns_failures_total"] = 1
+        if is_reconcile_failure:
+            increments["dns_reconcile_failures_total"] = 1
+        if is_bad_ip:
+            increments["bad_ip_total"] = 1
+
+        now = datetime.now(UTC).isoformat()
+        with self.connect() as conn:
+            conn.executemany(
+                """
+                INSERT INTO service_metrics(name, value, updated_at)
+                VALUES (?, ?, ?)
+                ON CONFLICT(name) DO UPDATE SET
+                  value=value + excluded.value,
+                  updated_at=excluded.updated_at
+                """,
+                [(name, value, now) for name, value in increments.items()],
+            )
+            conn.execute(
+                """
+                INSERT INTO service_metrics(name, value, updated_at)
+                VALUES ('last_update_latency_ms', ?, ?)
+                ON CONFLICT(name) DO UPDATE SET
+                  value=excluded.value,
+                  updated_at=excluded.updated_at
+                """,
+                (latency_ms, now),
+            )

router_dyndns/store/rate_limit.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-import sqlite3
 import time
 from datetime import UTC, datetime, timedelta
 
@@ -12,7 +11,6 @@ RATE_LIMIT_FLUSH_SECONDS = 10.0
 class RateLimitCleanupMixin:
     def list_cleanup_runs(self, limit: int = 20, offset: int = 0) -> list[CleanupRunRow]:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             rows = conn.execute(
                 """
                 SELECT created_at, domain_challenges_deleted, unused_accounts_deleted

router_dyndns/store/records.py

@@ -18,7 +18,6 @@ class RecordsEventsMixin:
     ) -> UpdateResult:
         now = datetime.now(UTC).isoformat()
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             existing = conn.execute("SELECT ipv4, ipv6 FROM records WHERE hostname = ?", (hostname,)).fetchone()
             current_ipv4 = existing["ipv4"] if existing else None
             current_ipv6 = existing["ipv6"] if existing else None
@@ -70,7 +69,6 @@ class RecordsEventsMixin:
         update_ipv6: bool = True,
     ) -> UpdateResult:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             existing = conn.execute("SELECT ipv4, ipv6 FROM records WHERE hostname = ?", (hostname,)).fetchone()
         current_ipv4 = existing["ipv4"] if existing else None
         current_ipv6 = existing["ipv6"] if existing else None
@@ -91,7 +89,6 @@ class RecordsEventsMixin:
 
     def list_records_page(self, limit: int = 100, offset: int = 0) -> list[dict[str, str | None]]:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             rows = conn.execute(
                 """
                 SELECT hostname, ipv4, ipv6, updated_at
@@ -154,28 +151,45 @@ class RecordsEventsMixin:
         return self.list_update_events_page(limit=limit, offset=offset)
 
     def list_update_events_page(self, limit: int = 100, offset: int = 0) -> list[UpdateEventRow]:
-        source_limit = limit + offset
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
-            event_rows = conn.execute(
+            rows = conn.execute(
                 """
-                SELECT hostname, ipv4, ipv6, status, detail, source_ip, created_at, 1 AS count
-                FROM update_events
+                SELECT hostname, ipv4, ipv6, status, detail, source_ip, created_at, count
+                FROM (
+                    SELECT hostname, ipv4, ipv6, status, detail, source_ip, created_at, 1 AS count
+                    FROM update_events
+                    UNION ALL
+                    SELECT hostname, ipv4, ipv6, status, detail, source_ip, last_seen_at AS created_at, count
+                    FROM update_event_rollups
+                )
                 ORDER BY created_at DESC
                 LIMIT ? OFFSET ?
                 """,
-                (source_limit, 0),
+                (limit, offset),
             ).fetchall()
-            rollup_rows = conn.execute(
-                """
-                SELECT hostname, ipv4, ipv6, status, detail, source_ip, last_seen_at AS created_at, count
-                FROM update_event_rollups
-                ORDER BY last_seen_at DESC
-                LIMIT ? OFFSET ?
+        return [dict(row) for row in rows]
+
+    def list_update_events_before(self, limit: int = 100, before: str | None = None) -> list[UpdateEventRow]:
+        where_clause = "WHERE created_at < ?" if before else ""
+        params: tuple[object, ...] = (before, limit) if before else (limit,)
+        with self.connect() as conn:
+            rows = conn.execute(
+                f"""
+                SELECT hostname, ipv4, ipv6, status, detail, source_ip, created_at, count
+                FROM (
+                    SELECT hostname, ipv4, ipv6, status, detail, source_ip, created_at, 1 AS count
+                    FROM update_events
+                    UNION ALL
+                    SELECT hostname, ipv4, ipv6, status, detail, source_ip, last_seen_at AS created_at, count
+                    FROM update_event_rollups
+                )
+                {where_clause}
+                ORDER BY created_at DESC
+                LIMIT ?
                 """,
-                (source_limit, 0),
+                params,
             ).fetchall()
-        return _merge_event_rows(event_rows, rollup_rows, limit, offset)
+        return [dict(row) for row in rows]
 
     def count_update_events(self) -> int:
         with self.connect() as conn:
@@ -185,7 +199,6 @@ class RecordsEventsMixin:
 
     def list_update_events_for_hostname(self, hostname: str, limit: int = 25) -> list[UpdateEventRow]:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             event_rows = conn.execute(
                 """
                 SELECT hostname, ipv4, ipv6, status, detail, source_ip, created_at, 1 AS count

router_dyndns/store/scheduler.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-import sqlite3
 from datetime import UTC, datetime, timedelta
 
 from .types import ScheduledTaskRow
@@ -87,7 +86,6 @@ class SchedulerMixin:
 
     def list_scheduled_tasks(self) -> list[ScheduledTaskRow]:
         with self.connect() as conn:
-            conn.row_factory = sqlite3.Row
             rows = conn.execute(
                 """
                 SELECT name, interval_seconds, next_run_at, lease_owner, lease_expires_at,

router_dyndns/store/schema.py

@@ -17,6 +17,7 @@ def connect_database(database_path: Path) -> sqlite3.Connection:
     if str(database_path) != ":memory:":
         database_path.parent.mkdir(parents=True, exist_ok=True)
     conn = sqlite3.connect(database_path, check_same_thread=False)
+    conn.row_factory = sqlite3.Row
     configure_connection(conn)
     return conn
 
@@ -129,6 +130,15 @@ def initialize_schema(conn: sqlite3.Connection) -> None:
         """
     )
     conn.execute("CREATE INDEX IF NOT EXISTS idx_rate_limits_window ON rate_limits(window)")
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS service_metrics (
+          name TEXT PRIMARY KEY,
+          value REAL NOT NULL,
+          updated_at TEXT NOT NULL
+        )
+        """
+    )
     conn.execute(
         """
         CREATE TABLE IF NOT EXISTS accounts (

router_dyndns/web/security_headers.py

@@ -1,5 +1,8 @@
 from __future__ import annotations
 
+import logging
+import time
+
 from fastapi import FastAPI, Request
 from fastapi.responses import PlainTextResponse
 from starlette.concurrency import run_in_threadpool
@@ -9,6 +12,8 @@ from ..ddns_models import DdnsSettings
 from ..ddns_security import client_ip, is_rate_limited_path, rate_limit_bucket
 from ..ddns_store import DdnsStore
 
+ACCESS_LOGGER = logging.getLogger("router_dyndns.access")
+
 
 class RequestBodyTooLargeError(Exception):
     pass
@@ -46,6 +51,7 @@ class RequestBodyLimitMiddleware:
 def install_security_middleware(app: FastAPI, settings: DdnsSettings, store: DdnsStore) -> None:
     @app.middleware("http")
     async def security_middleware(request: Request, call_next):
+        started_at = time.perf_counter()
         try:
             content_length = int(request.headers.get("content-length", "0") or "0")
         except ValueError:
@@ -62,12 +68,15 @@ def install_security_middleware(app: FastAPI, settings: DdnsSettings, store: Ddn
             key = f"{client_ip(request, settings)}:{rate_limit_bucket(request.url.path)}"
             allowed = await run_in_threadpool(store.allow_rate_limit, key, limit)
             if not allowed:
+                await run_in_threadpool(store.increment_metric, "rate_limit_hits_total")
                 return PlainTextResponse("rate limit exceeded", status_code=429)
 
         response = await call_next(request)
         if is_secret_response(request):
             response.headers["Cache-Control"] = "no-store"
             response.headers["Pragma"] = "no-cache"
+        if is_noindex_response(request):
+            response.headers["X-Robots-Tag"] = "noindex, nofollow"
         response.headers["X-Content-Type-Options"] = "nosniff"
         response.headers["X-Frame-Options"] = "DENY"
         response.headers["Referrer-Policy"] = "same-origin"
@@ -75,6 +84,15 @@ def install_security_middleware(app: FastAPI, settings: DdnsSettings, store: Ddn
         response.headers["Content-Security-Policy"] = content_security_policy(request.url.path)
         if settings.public_base_url.startswith("https://"):
             response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        if settings.redacted_access_log:
+            elapsed_ms = (time.perf_counter() - started_at) * 1000
+            ACCESS_LOGGER.info(
+                "%s %s status=%s duration_ms=%.2f",
+                request.method,
+                redacted_access_path(request.url.path),
+                response.status_code,
+                elapsed_ms,
+            )
         return response
 
 
@@ -96,6 +114,17 @@ def is_secret_response(request: Request) -> bool:
     return (request.method == "POST" and path in {"/magic", "/request-domain", "/verify-domain", "/accounts"}) or path == "/nic/update"
 
 
+def is_noindex_response(request: Request) -> bool:
+    path = request.url.path
+    if request.method != "GET":
+        return True
+    if path in {"/docs", "/redoc", "/openapi.json", "/healthz", "/ip"}:
+        return True
+    if path.startswith(("/api/", "/m/", "/d/", "/u/", "/nic/")):
+        return True
+    return is_admin_path(path, request.app.state.settings)
+
+
 def content_security_policy(path: str) -> str:
     if path in {"/docs", "/redoc", "/openapi.json"}:
         return (
@@ -108,13 +137,30 @@ def content_security_policy(path: str) -> str:
             "form-action 'self'; "
             "frame-ancestors 'none'"
         )
+    script_src = "script-src 'self' 'unsafe-inline'; " if path in {"/", "/privacy"} else "script-src 'self'; "
     return (
         "default-src 'self'; "
-        "script-src 'self'; "
-        "style-src 'self' https://cdn.jsdelivr.net; "
+        f"{script_src}"
+        "style-src 'self'; "
         "img-src 'self' data:; "
-        "font-src 'self' https://cdn.jsdelivr.net; "
+        "font-src 'self'; "
         "connect-src 'self'; "
         "form-action 'self'; "
         "frame-ancestors 'none'"
     )
+
+
+def redacted_access_path(path: str) -> str:
+    secret_prefixes = {
+        "/u": "/u/<secret>",
+        "/m": "/m/<secret>",
+        "/d": "/d/<secret>",
+        "/api/v1/updates": "/api/v1/updates/<secret>",
+        "/api/v1/management": "/api/v1/management/<secret>",
+    }
+    for prefix, replacement in secret_prefixes.items():
+        if path == prefix or path.startswith(f"{prefix}/"):
+            return replacement
+    if path == "/nic/update":
+        return "/nic/update?<redacted>"
+    return path

router_dyndns/web/styles.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-APP_CSS = """
+BASE_CSS = """
 :root {
   color-scheme: light;
   --bs-primary: #000000;
@@ -70,6 +70,10 @@ body {
   font: 400 16px/1.5 ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
 }
 
+code {
+  color: var(--rp-ink);
+}
+
 .justify-items-center {
   justify-items: center;
 }
@@ -158,7 +162,29 @@ body {
 }
 
 .theme-toggle {
-  min-width: 58px;
+  align-items: center;
+  aspect-ratio: 1;
+  display: inline-flex;
+  justify-content: center;
+  min-height: 40px;
+  min-width: 40px;
+  padding: 0;
+}
+
+.theme-icon {
+  display: block;
+}
+
+.theme-icon-sun {
+  display: none;
+}
+
+[data-bs-theme="dark"] .theme-icon-moon {
+  display: none;
+}
+
+[data-bs-theme="dark"] .theme-icon-sun {
+  display: block;
 }
 
 .hero-band {
@@ -367,9 +393,9 @@ input:focus,
 }
 
 .btn-sm {
-  min-width: 34px;
-  min-height: 34px;
-  padding-inline: 14px;
+  min-width: 40px;
+  min-height: 40px;
+  padding-inline: 16px;
   border-radius: 9999px;
 }
 
@@ -424,9 +450,13 @@ select:focus-visible {
 .btn-outline-danger {
   --bs-btn-color: var(--rp-danger);
   --bs-btn-border-color: var(--rp-line);
+  --bs-btn-bg: var(--rp-field);
   --bs-btn-hover-color: #ffffff;
   --bs-btn-hover-bg: var(--rp-danger);
   --bs-btn-hover-border-color: var(--rp-danger);
+  --bs-btn-active-color: #ffffff;
+  --bs-btn-active-bg: var(--rp-danger);
+  --bs-btn-active-border-color: var(--rp-danger);
 }
 
 .text-primary {
@@ -461,6 +491,10 @@ select:focus-visible {
   border-radius: 12px;
 }
 
+.alert code {
+  color: var(--rp-ink);
+}
+
 .copy-field {
   min-width: 0;
   max-width: 100%;
@@ -538,53 +572,6 @@ select:focus-visible {
   font: inherit;
 }
 
-.admin-table-scroll {
-  max-height: 560px;
-  overflow: auto;
-  background: var(--rp-surface);
-  border-color: var(--rp-line) !important;
-  border-radius: 16px !important;
-  -webkit-overflow-scrolling: touch;
-}
-
-.admin-table-scroll thead th {
-  position: sticky;
-  top: 0;
-  z-index: 1;
-  background: var(--rp-surface-alt);
-}
-
-.table-page-size {
-  width: auto;
-  min-width: 76px;
-}
-
-.admin-table-shell .form-control {
-  max-width: 360px;
-}
-
-.status-table-shell {
-  max-width: 100%;
-  border: 1px solid var(--rp-line);
-  border-radius: 16px;
-  background: var(--rp-surface);
-}
-
-.pagination {
-  --bs-pagination-color: var(--rp-muted);
-  --bs-pagination-bg: var(--rp-surface);
-  --bs-pagination-border-color: var(--rp-line);
-  --bs-pagination-hover-color: var(--rp-ink);
-  --bs-pagination-hover-bg: var(--rp-field);
-  --bs-pagination-hover-border-color: var(--rp-line);
-  --bs-pagination-active-color: #ffffff;
-  --bs-pagination-active-bg: #000000;
-  --bs-pagination-active-border-color: #000000;
-  --bs-pagination-disabled-color: var(--rp-mute);
-  --bs-pagination-disabled-bg: var(--rp-surface);
-  --bs-pagination-disabled-border-color: var(--rp-line);
-}
-
 .site-footer {
   padding: 32px 0;
   background: var(--rp-canvas);
@@ -594,64 +581,6 @@ select:focus-visible {
   color: var(--rp-ink) !important;
 }
 
-table {
-  width: 100%;
-  border-collapse: collapse;
-  font-size: 14px;
-  font-variant-numeric: tabular-nums;
-  color: var(--rp-ink);
-}
-
-.table {
-  --bs-table-bg: transparent;
-  --bs-table-color: var(--rp-ink);
-  --bs-table-border-color: var(--rp-soft-line);
-  --bs-table-hover-bg: var(--rp-field);
-  margin-bottom: 0;
-}
-
-th,
-td {
-  border-bottom: 1px solid var(--rp-soft-line);
-  padding: 14px 10px;
-  text-align: left;
-  white-space: nowrap;
-}
-
-td {
-  max-width: 38rem;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.status-table {
-  min-width: min(100%, 420px);
-}
-
-.status-table th,
-.status-table td {
-  white-space: normal;
-  overflow-wrap: anywhere;
-}
-
-tr:last-child th,
-tr:last-child td {
-  border-bottom: 0;
-}
-
-th {
-  color: var(--rp-muted);
-  font-size: 12px;
-  font-weight: 600;
-  background: var(--rp-surface-alt);
-}
-
-.empty {
-  color: var(--rp-muted);
-  text-align: center;
-  padding: 28px;
-}
-
 @media (max-width: 860px) {
   .section,
   .hero-band {
@@ -750,6 +679,146 @@ th {
     border-radius: 0 0 14px 14px;
   }
 
+  h1 {
+    font-size: 28px;
+    line-height: 1.15;
+  }
+
+  h2 {
+    font-size: 24px;
+  }
+}
+""".strip()
+
+
+ADMIN_CSS = """
+.metric-card {
+  display: grid;
+  gap: 6px;
+  padding: 16px;
+  border: 1px solid var(--rp-line);
+  border-radius: 16px;
+  background: var(--rp-surface);
+}
+
+.metric-card span {
+  color: var(--rp-muted);
+  font-size: 13px;
+  font-weight: 500;
+}
+
+.metric-card strong {
+  color: var(--rp-ink);
+  font-size: 20px;
+  font-weight: 600;
+}
+
+.admin-table-scroll {
+  max-height: 560px;
+  overflow: auto;
+  background: var(--rp-surface);
+  border-color: var(--rp-line) !important;
+  border-radius: 16px !important;
+  -webkit-overflow-scrolling: touch;
+}
+
+.admin-table-scroll thead th {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  background: var(--rp-surface-alt);
+}
+
+.table-page-size {
+  width: auto;
+  min-width: 76px;
+}
+
+.admin-table-shell .form-control {
+  max-width: 360px;
+}
+
+.status-table-shell {
+  max-width: 100%;
+  border: 1px solid var(--rp-line);
+  border-radius: 16px;
+  background: var(--rp-surface);
+}
+
+.pagination {
+  --bs-pagination-color: var(--rp-muted);
+  --bs-pagination-bg: var(--rp-surface);
+  --bs-pagination-border-color: var(--rp-line);
+  --bs-pagination-hover-color: var(--rp-ink);
+  --bs-pagination-hover-bg: var(--rp-field);
+  --bs-pagination-hover-border-color: var(--rp-line);
+  --bs-pagination-active-color: #ffffff;
+  --bs-pagination-active-bg: #000000;
+  --bs-pagination-active-border-color: #000000;
+  --bs-pagination-disabled-color: var(--rp-mute);
+  --bs-pagination-disabled-bg: var(--rp-surface);
+  --bs-pagination-disabled-border-color: var(--rp-line);
+}
+
+table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 14px;
+  font-variant-numeric: tabular-nums;
+  color: var(--rp-ink);
+}
+
+.table {
+  --bs-table-bg: transparent;
+  --bs-table-color: var(--rp-ink);
+  --bs-table-border-color: var(--rp-soft-line);
+  --bs-table-hover-bg: var(--rp-field);
+  margin-bottom: 0;
+}
+
+th,
+td {
+  border-bottom: 1px solid var(--rp-soft-line);
+  padding: 14px 10px;
+  text-align: left;
+  white-space: nowrap;
+}
+
+td {
+  max-width: 38rem;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.status-table {
+  min-width: min(100%, 420px);
+}
+
+.status-table th,
+.status-table td {
+  white-space: normal;
+  overflow-wrap: anywhere;
+}
+
+tr:last-child th,
+tr:last-child td {
+  border-bottom: 0;
+}
+
+th {
+  color: var(--rp-muted);
+  font-size: 12px;
+  font-weight: 600;
+  background: var(--rp-surface-alt);
+}
+
+.empty {
+  color: var(--rp-muted);
+  text-align: center;
+  padding: 28px;
+}
+
+@media (max-width: 860px) {
   .admin-table-shell .form-control {
     max-width: none;
   }
@@ -767,14 +836,5 @@ th {
   td {
     padding: 12px 9px;
   }
-
-  h1 {
-    font-size: 28px;
-    line-height: 1.15;
-  }
-
-  h2 {
-    font-size: 24px;
-  }
 }
 """.strip()

router_dyndns/web/templates.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import json
+
 from .html_utils import SafeHtml, attr, escape, join_html, trusted
 
 
@@ -9,14 +11,22 @@ def _top_nav(label: str | None = None, links: SafeHtml | None = None) -> SafeHtm
         account_html = f'<span class="navbar-text nav-label text-truncate">{escape(label)}</span>'
     if links is None:
         links = trusted('<a class="nav-link px-0" href="/docs">Docs</a><a class="nav-link px-0" href="/redoc">API</a>')
-        account_html += '<a class="btn btn-sm btn-primary rounded-pill" href="/#create">Generate</a>'
-    theme_toggle = '<button type="button" class="btn btn-sm btn-light theme-toggle" data-theme-toggle aria-label="Switch color theme">Light</button>'
+    theme_toggle = """
+      <button type="button" class="btn btn-sm btn-light theme-toggle" data-theme-toggle aria-label="Switch to dark theme">
+        <svg class="theme-icon theme-icon-moon" aria-hidden="true" width="16" height="16" viewBox="0 0 16 16" fill="currentColor">
+          <path d="M6 0a6.8 6.8 0 0 0-.8 3.2A7 7 0 0 0 12.2 10a6.8 6.8 0 0 0 3-.7A8 8 0 1 1 6 0Z"/>
+        </svg>
+        <svg class="theme-icon theme-icon-sun" aria-hidden="true" width="16" height="16" viewBox="0 0 16 16" fill="currentColor">
+          <path d="M8 11.2A3.2 3.2 0 1 0 8 4.8a3.2 3.2 0 0 0 0 6.4Zm0-9.8a.7.7 0 0 1-.7-.7V.2a.7.7 0 0 1 1.4 0v.5a.7.7 0 0 1-.7.7Zm0 14.6a.7.7 0 0 1-.7-.7v-.5a.7.7 0 1 1 1.4 0v.5a.7.7 0 0 1-.7.7ZM1.4 8a.7.7 0 0 1-.7.7H.2a.7.7 0 0 1 0-1.4h.5a.7.7 0 0 1 .7.7Zm14.6 0a.7.7 0 0 1-.7.7h-.5a.7.7 0 1 1 0-1.4h.5a.7.7 0 0 1 .7.7ZM3.3 3.3a.7.7 0 0 1-1 0L2 3a.7.7 0 0 1 1-1l.3.3a.7.7 0 0 1 0 1Zm10.7 10.7a.7.7 0 0 1-1 0l-.3-.3a.7.7 0 1 1 1-1l.3.3a.7.7 0 0 1 0 1Zm-10.7-1a.7.7 0 0 1 0 1l-.3.3a.7.7 0 1 1-1-1l.3-.3a.7.7 0 0 1 1 0ZM14 2a.7.7 0 0 1 0 1l-.3.3a.7.7 0 1 1-1-1L13 2a.7.7 0 0 1 1 0Z"/>
+        </svg>
+      </button>
+    """
     return trusted(
         f"""
         <a class="skip-link" href="#main">Skip to content</a>
         <nav class="navbar navbar-expand-sm site-nav" aria-label="Main navigation">
           <div class="container">
-            <a class="navbar-brand brand" href="/"><img src="/logo.png" alt="" width="28" height="28">KarlDNS</a>
+            <a class="navbar-brand brand" href="/"><img src="/logo-nav.webp?v=3" alt="" width="28" height="28" decoding="async">KarlDNS</a>
             <div class="navbar-nav site-nav-actions ms-auto flex-row align-items-center justify-content-end gap-2 gap-sm-3">
               {links}
               {account_html}
@@ -71,7 +81,7 @@ def _manual_update_commands(update_url: str) -> str:
         [
             f"curl -sS '{update_base}?myip=203.0.113.10'",
             f"curl -sS '{update_base}?myipv6=2001:db8::10'",
-            f"curl -sS '{update_base}'",
+            f"curl -sS '{update_base}'  # use request IP",
         ]
     )
 
@@ -83,10 +93,10 @@ def _manual_update_panel(commands: str) -> SafeHtml:
         <div class="card card-body gap-3 mt-4">
           <div>
             <h3>Manual updates</h3>
-            <p class="section-copy">FRITZ!Box replaces <code>&lt;ipaddr&gt;</code> and <code>&lt;ip6addr&gt;</code>, then sends a GET request to the Update-URL. Scripts and other routers can do the same with curl. If no IP parameter is sent, KarlDNS uses the request source IP.</p>
+            <p class="section-copy">FRITZ!Box fills in the IP placeholders automatically. Scripts can use curl. If no IP is sent, KarlDNS uses the request IP.</p>
           </div>
           <pre class="manual-code mb-0"><code>{safe_commands}</code></pre>
-          {_copy_button("Copy curl examples", commands)}
+          {_copy_button("Copy curl", commands)}
         </div>
         """
     )
@@ -107,7 +117,7 @@ def _fritzbox_fields(
         f"Kennwort: {password}",
     ]
     if management_url:
-        lines.append(f"Private status page: {management_url}")
+        lines.append(f"Private dashboard: {management_url}")
     return "\n".join(lines)
 
 
@@ -115,9 +125,9 @@ def _secret_notice() -> SafeHtml:
     return trusted(
         """
         <div class="alert alert-info my-3 py-2 small" role="note">
-          <strong>Public:</strong> Domainnamen and CNAME target can be shared in DNS.
-          <strong>Secret:</strong> Update-URL, one-box update URL, optional Kennwort, private dashboard URL, and domain claim links control the hostname.
-          Secrets are hidden by default on screen; Copy still copies the real value.
+          <strong>Public:</strong> Domain name and CNAME target can be shared.
+          <strong>Secret:</strong> Update URLs, router password, dashboard link, and claim links can update or manage this hostname.
+          Secrets are hidden on screen. Copy still copies the real value.
         </div>
         """
     )
@@ -127,7 +137,7 @@ def _one_time_secret_notice() -> SafeHtml:
     return trusted(
         """
         <div class="alert alert-warning my-3 py-2 small" role="alert">
-          Copy the router password and one-box update URL now. They are only shown when generated or rotated and are not recoverable from the dashboard later.
+          Copy the router password and full update URL now. They are only shown when created or rotated.
         </div>
         """
     )
@@ -165,9 +175,55 @@ def _site_footer() -> SafeHtml:
     )
 
 
-def _page(title: str, body: SafeHtml) -> str:
+def _page(
+    title: str,
+    body: SafeHtml,
+    extra_styles: SafeHtml | None = None,
+    extra_scripts: SafeHtml | None = None,
+    description: str = "KarlDNS is a small self-hosted Dynamic DNS service for FRITZ!Box routers, Linux cron jobs, and home networks.",
+    preload_logo: bool = False,
+    canonical_url: str | None = None,
+    image_url: str | None = None,
+    image_alt: str | None = None,
+    structured_data: dict[str, object] | None = None,
+) -> str:
     if not isinstance(body, SafeHtml):
         raise TypeError("body must be a SafeHtml fragment built by a template helper")
+    extra_styles_html = extra_styles or trusted("")
+    extra_scripts_html = extra_scripts or trusted("")
+    preload_logo_html = trusted('<link rel="preload" as="image" href="/logo.webp?v=3" type="image/webp">') if preload_logo else trusted("")
+    canonical_html = trusted(f'<link rel="canonical" href="{attr(canonical_url)}">') if canonical_url else trusted("")
+    social_url = canonical_url or ""
+    social_image = image_url or ""
+    social_html = trusted("")
+    if social_url:
+        social_card = "summary_large_image" if social_image else "summary"
+        social_image_alt = image_alt or title
+        social_image_html = f"""
+        <meta property="og:image" content="{attr(social_image)}">
+        <meta property="og:image:width" content="1200">
+        <meta property="og:image:height" content="630">
+        <meta property="og:image:alt" content="{attr(social_image_alt)}">
+        <meta name="twitter:image" content="{attr(social_image)}">
+        <meta name="twitter:image:alt" content="{attr(social_image_alt)}">
+        """ if social_image else ""
+        social_html = trusted(f"""
+        <meta property="og:type" content="website">
+        <meta property="og:title" content="{attr(title)}">
+        <meta property="og:description" content="{attr(description)}">
+        <meta property="og:url" content="{attr(social_url)}">
+        {social_image_html}
+        <meta name="twitter:card" content="{attr(social_card)}">
+        <meta name="twitter:title" content="{attr(title)}">
+        <meta name="twitter:description" content="{attr(description)}">
+        """)
+    structured_data_html = trusted("")
+    if structured_data:
+        structured_data_html = trusted(
+            '<script type="application/ld+json">'
+            + escape(json.dumps(structured_data, ensure_ascii=False, separators=(",", ":")))
+            + "</script>"
+        )
     return f"""
     <!doctype html>
     <html lang="en">
@@ -175,15 +231,23 @@ def _page(title: str, body: SafeHtml) -> str:
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width, initial-scale=1">
         <meta name="theme-color" content="#ffffff">
+        <meta name="description" content="{attr(description)}">
+        {canonical_html}
+        {social_html}
         <title>{escape(title)}</title>
         <link rel="icon" href="/favicon.ico" sizes="any">
         <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
         <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
         <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
         <link rel="manifest" href="/site.webmanifest">
-        <script src="/app.js" defer></script>
-        <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB" crossorigin="anonymous">
-        <link href="/app.css" rel="stylesheet">
+        {preload_logo_html}
+        <script src="/theme.js?v=2"></script>
+        <script src="/clipboard.js?v=2" defer></script>
+        {extra_scripts_html}
+        <link href="/bootstrap-subset.css?v=3" rel="stylesheet">
+        <link href="/app.css?v=2" rel="stylesheet">
+        {extra_styles_html}
+        {structured_data_html}
       </head>
       <body>{body}{_site_footer()}</body>
     </html>

router_dyndns/web/templates_admin.py

@@ -11,10 +11,8 @@ from .templates_admin_tables import (
     _account_row,
     _admin_table_pagination,
     _admin_table_toolbar,
-    _cleanup_row,
     _domain_claim_row,
     _event_row,
-    _scheduled_task_row,
 )
 
 
@@ -24,7 +22,7 @@ def _admin_secret_panel(title: str, rows: list[SafeHtml]) -> SafeHtml:
       <div class="container">
         <p class="eyebrow">Admin action</p>
         <h2>{escape(title)}</h2>
-        <p class="section-copy">Copy this now. Secret values are only shown in this response.</p>
+        <p class="section-copy">Copy these values now. Secret values are only shown once.</p>
         <div class="d-grid gap-2">
           {"".join(rows)}
         </div>
@@ -40,6 +38,7 @@ def _render_admin_page(
     cleanup_runs: list[dict[str, str | int]],
     scheduled_tasks: list[dict[str, str | int | None]],
     update_events: list[dict[str, str | int | None]],
+    service_metrics: dict[str, float],
     table_counts: dict[str, int],
     table_offsets: dict[str, int],
     table_limit: int,
@@ -56,19 +55,13 @@ def _render_admin_page(
     domain_rows = "\n".join(_domain_claim_row(challenge) for challenge in domain_challenges) or """
       <tr class="empty-row"><td colspan="5" class="empty">No domain claims yet.</td></tr>
     """
-    cleanup_rows = "\n".join(_cleanup_row(run) for run in cleanup_runs) or """
-      <tr class="empty-row"><td colspan="3" class="empty">No cleanup runs yet.</td></tr>
-    """
-    scheduled_task_rows = "\n".join(_scheduled_task_row(task) for task in scheduled_tasks) or """
-      <tr class="empty-row"><td colspan="6" class="empty">No scheduled tasks yet.</td></tr>
-    """
     event_rows = "\n".join(_event_row(event) for event in update_events) or """
       <tr class="empty-row"><td colspan="7" class="empty">No update events yet.</td></tr>
     """
     accounts_count = escape(table_counts.get("accounts", len(accounts)))
     domain_count = escape(table_counts.get("domain_challenges", len(domain_challenges)))
-    cleanup_count = escape(table_counts.get("cleanup_runs", len(cleanup_runs)))
     event_count = escape(table_counts.get("update_events", len(update_events)))
+    metrics_html = _metrics_panel(service_metrics)
     account_pager = _server_page_links(admin_path, "accounts_offset", table_offsets.get("accounts", 0), table_limit, table_counts.get("accounts", 0))
     domain_pager = _server_page_links(
         admin_path,
@@ -77,18 +70,18 @@ def _render_admin_page(
         table_limit,
         table_counts.get("domain_challenges", 0),
     )
-    cleanup_pager = _server_page_links(admin_path, "cleanup_runs_offset", table_offsets.get("cleanup_runs", 0), table_limit, table_counts.get("cleanup_runs", 0))
     event_pager = _server_page_links(admin_path, "update_events_offset", table_offsets.get("update_events", 0), table_limit, table_counts.get("update_events", 0))
+    cleanup_panel = _cleanup_panel(settings, cleanup_runs, scheduled_tasks, safe_admin_path, csrf)
     return _page(
         "KarlDNS Admin",
         trusted(f"""
         <main id="main">
-          {_top_nav("Operator console", trusted(f'<a class="nav-link px-0" href="{safe_records_path}">Records</a><a class="nav-link px-0" href="{safe_events_path}">Events</a>'))}
+          {_top_nav("Operator", trusted(f'<a class="nav-link px-0" href="{safe_records_path}">Records</a><a class="nav-link px-0" href="{safe_events_path}">Events</a>'))}
           <section class="section admin-heading">
             <div class="container">
-              <p class="eyebrow">KarlDNS aktiv</p>
+              <p class="eyebrow">KarlDNS</p>
               <h1>Operator console</h1>
-              <p class="lead">Inspect hostnames, verify domain claims, rotate links, run cleanup, and review router update events.</p>
+              <p class="lead">Review hostnames, domain checks, updates, cleanup, and secret changes.</p>
             </div>
           </section>
 
@@ -96,17 +89,15 @@ def _render_admin_page(
 
           <section class="section">
             <div class="container">
-              <div class="row g-4 align-items-start">
-              <div class="col-lg-7">
-                <p class="eyebrow">Service health</p>
-                <h2>Scheduled cleanup</h2>
-                <p class="section-copy">Cleanup runs every {escape(settings.cleanup_interval_seconds)} seconds. It removes unverified domain claims after {escape(settings.cleanup_challenge_hours)} hours and never-used generated hostnames after {escape(settings.cleanup_unused_account_hours)} hours.</p>
-                <p class="section-copy">The scheduler state is stored in SQLite. Multiple app workers coordinate with a database lease, so only one worker runs a due cleanup task.</p>
+              <div class="d-flex align-items-md-center justify-content-between gap-4 flex-column flex-md-row mb-4">
+                <div>
+                  <p class="eyebrow">Service health</p>
+                  <h2>Service status</h2>
+                </div>
               </div>
-              <form method="post" action="{safe_admin_path}/cleanup" class="col-lg-5 card card-body gap-3" aria-label="Run cleanup now">
-                <input type="hidden" name="csrf" value="{csrf}">
-                <button type="submit" class="btn btn-primary rounded-pill">Run cleanup now</button>
-              </form>
+              {cleanup_panel}
+              <div class="mt-4">
+                {metrics_html}
               </div>
             </div>
           </section>
@@ -116,15 +107,15 @@ def _render_admin_page(
               <div class="d-flex align-items-md-center justify-content-between gap-4 flex-column flex-md-row">
                 <div>
                   <p class="eyebrow">Hostnames</p>
-                  <h2>Active credentials</h2>
-                  <p class="section-copy mb-0">Showing up to {escape(len(accounts))} of {accounts_count} hostnames.</p>
+                  <h2>Hostnames</h2>
+                  <p class="section-copy mb-0">Showing {escape(len(accounts))} of {accounts_count}.</p>
                 </div>
               </div>
               {_admin_table_toolbar("hostnames", "Search hostnames")}
               <div class="table-responsive border rounded admin-table-scroll">
                 <table class="table mb-0">
                   <thead>
-                    <tr><th>Domain</th><th>User</th><th>IPv4</th><th>IPv6</th><th>Updated</th><th>Links</th><th></th></tr>
+                    <tr><th scope="col">Domain</th><th scope="col">User</th><th scope="col">IPv4</th><th scope="col">IPv6</th><th scope="col">Updated</th><th scope="col">Links</th><th scope="col">Actions</th></tr>
                   </thead>
                   <tbody>{rows}</tbody>
                 </table>
@@ -139,14 +130,14 @@ def _render_admin_page(
               <div class="d-flex align-items-md-center justify-content-between gap-4 flex-column flex-md-row">
                 <div>
                   <p class="eyebrow">Domain claims</p>
-                  <h2>Verification lifecycle</h2>
-                  <p class="section-copy mb-0">Showing up to {escape(len(domain_challenges))} of {domain_count} claims.</p>
+                  <h2>Domain verification</h2>
+                  <p class="section-copy mb-0">Showing {escape(len(domain_challenges))} of {domain_count}.</p>
                 </div>
               </div>
               {_admin_table_toolbar("domain-claims", "Search domain claims")}
               <div class="table-responsive border rounded admin-table-scroll">
                 <table class="table mb-0">
-                  <thead><tr><th>Domain</th><th>Owner dashboard</th><th>Status</th><th>Created</th><th>Verified</th></tr></thead>
+                  <thead><tr><th scope="col">Domain</th><th scope="col">Owner dashboard</th><th scope="col">Status</th><th scope="col">Created</th><th scope="col">Verified</th></tr></thead>
                   <tbody>{domain_rows}</tbody>
                 </table>
               </div>
@@ -155,52 +146,19 @@ def _render_admin_page(
             </div>
           </section>
 
-          <section class="section">
-            <div class="container">
-              <div class="d-flex align-items-md-center justify-content-between gap-4 flex-column flex-md-row">
-                <div>
-                  <p class="eyebrow">Cleanup</p>
-                  <h2>Scheduler state</h2>
-                </div>
-              </div>
-              <div class="table-responsive border rounded admin-table-scroll mb-4">
-                <table class="table mb-0">
-                  <thead><tr><th>Task</th><th>Status</th><th>Next run</th><th>Lease expires</th><th>Last finished</th><th>Last error</th></tr></thead>
-                  <tbody>{scheduled_task_rows}</tbody>
-                </table>
-              </div>
-              <div class="d-flex align-items-md-center justify-content-between gap-4 flex-column flex-md-row">
-                <div>
-                  <p class="eyebrow">Cleanup</p>
-                  <h2>Recent runs</h2>
-                  <p class="section-copy mb-0">Showing up to {escape(len(cleanup_runs))} of {cleanup_count} runs.</p>
-                </div>
-              </div>
-              {_admin_table_toolbar("cleanup-runs", "Search cleanup runs")}
-              <div class="table-responsive border rounded admin-table-scroll">
-                <table class="table mb-0">
-                  <thead><tr><th>Time</th><th>Domain claims removed</th><th>Unused hostnames removed</th></tr></thead>
-                  <tbody>{cleanup_rows}</tbody>
-                </table>
-              </div>
-              {_admin_table_pagination()}
-              {cleanup_pager}
-            </div>
-          </section>
-
           <section class="section">
             <div class="container">
               <div class="d-flex align-items-md-center justify-content-between gap-4 flex-column flex-md-row">
                 <div>
                   <p class="eyebrow">Updates</p>
-                  <h2>Recent events</h2>
-                  <p class="section-copy mb-0">Showing up to {escape(len(update_events))} of {event_count} event rows. Repeated unchanged polls are aggregated.</p>
+                  <h2>Update events</h2>
+                  <p class="section-copy mb-0">Showing {escape(len(update_events))} of {event_count}. Repeated checks with no IP change are grouped.</p>
                 </div>
               </div>
               {_admin_table_toolbar("update-events", "Search update events")}
               <div class="table-responsive border rounded admin-table-scroll">
                 <table class="table mb-0">
-                  <thead><tr><th>Time</th><th>Domain</th><th>Status</th><th>IPv4</th><th>IPv6</th><th>Count</th><th>Detail</th></tr></thead>
+                  <thead><tr><th scope="col">Time</th><th scope="col">Domain</th><th scope="col">Status</th><th scope="col">IPv4</th><th scope="col">IPv6</th><th scope="col">Count</th><th scope="col">Detail</th></tr></thead>
                   <tbody>{event_rows}</tbody>
                 </table>
               </div>
@@ -210,6 +168,8 @@ def _render_admin_page(
           </section>
         </main>
         """),
+        extra_styles=trusted('<link href="/admin.css?v=2" rel="stylesheet">'),
+        extra_scripts=trusted('<script src="/admin-tables.js?v=2" defer></script>'),
     )
 
 
@@ -227,7 +187,103 @@ def _server_page_links(admin_path: str, offset_name: str, offset: int, limit: in
     return trusted(f"""
       <nav class="d-flex align-items-center justify-content-end gap-2 mt-3" aria-label="Server-side table pages">
         <span class="small text-secondary">{escape(start)}-{escape(end)} of {escape(total)}</span>
-        <a class="btn btn-sm btn-light rounded-pill{previous_disabled}" href="{previous_href}" aria-disabled="{str(offset <= 0).lower()}">Previous server page</a>
-        <a class="btn btn-sm btn-light rounded-pill{next_disabled}" href="{next_href}" aria-disabled="{str(next_offset >= total).lower()}">Next server page</a>
+        <a class="btn btn-sm btn-light rounded-pill{previous_disabled}" href="{previous_href}" aria-disabled="{str(offset <= 0).lower()}">Previous</a>
+        <a class="btn btn-sm btn-light rounded-pill{next_disabled}" href="{next_href}" aria-disabled="{str(next_offset >= total).lower()}">Next</a>
       </nav>
     """)
+
+
+def _cleanup_panel(
+    settings: DdnsSettings,
+    cleanup_runs: list[dict[str, str | int]],
+    scheduled_tasks: list[dict[str, str | int | None]],
+    safe_admin_path: str,
+    csrf: str,
+) -> SafeHtml:
+    task = next((item for item in scheduled_tasks if item.get("name") == "cleanup"), scheduled_tasks[0] if scheduled_tasks else {})
+    last_run = task.get("last_finished_at") or (cleanup_runs[0].get("created_at") if cleanup_runs else None)
+    next_run = task.get("next_run_at")
+    status = task.get("last_status") or "pending"
+    last_error = task.get("last_error") or ""
+    interval = task.get("interval_seconds") or settings.cleanup_interval_seconds
+    last_cleanup = cleanup_runs[0] if cleanup_runs else {}
+    domains_removed = last_cleanup.get("domain_challenges_deleted", 0)
+    accounts_removed = last_cleanup.get("unused_accounts_deleted", 0)
+    error_html = (
+        trusted(f'<p class="small text-danger mb-0">Last error: {escape(last_error)}</p>')
+        if last_error
+        else trusted("")
+    )
+    cards = [
+        ("Interval", f"*/{interval}s"),
+        ("Last run", str(last_run or "Never")),
+        ("Next run", str(next_run or "Pending")),
+        ("Status", str(status)),
+    ]
+    card_html = "\n".join(
+        f"""
+        <div class="col-12 col-md-6 col-xl-3">
+          <div class="metric-card h-100">
+            <span>{escape(label)}</span>
+            <strong>{escape(value)}</strong>
+          </div>
+        </div>
+        """
+        for label, value in cards
+    )
+    return trusted(f"""
+      <div class="card flat-card">
+        <div class="card-body p-4">
+          <div class="d-flex align-items-start justify-content-between gap-3 flex-column flex-lg-row">
+            <div>
+              <h3 class="h5 mb-2">Cleanup</h3>
+              <p class="section-copy mb-1">Last cleanup removed {escape(domains_removed)} domain claims and {escape(accounts_removed)} unused hostnames.</p>
+              {error_html}
+            </div>
+            <form method="post" action="{safe_admin_path}/cleanup" aria-label="Run cleanup now">
+              <input type="hidden" name="csrf" value="{csrf}">
+              <button type="submit" class="btn btn-primary rounded-pill">Run now</button>
+            </form>
+          </div>
+          <div class="row g-3 mt-3">
+            {card_html}
+          </div>
+        </div>
+      </div>
+    """)
+
+
+def _metrics_panel(metrics: dict[str, float]) -> SafeHtml:
+    samples = metrics.get("update_latency_samples_total", 0)
+    average_latency = metrics.get("update_latency_ms_total", 0) / samples if samples else 0
+    items = [
+        ("Updates", _metric_int(metrics.get("update_requests_total", 0))),
+        ("Updated", _metric_int(metrics.get("update_success_total", 0))),
+        ("DNS failures", _metric_int(metrics.get("dns_failures_total", 0))),
+        ("DNS check failures", _metric_int(metrics.get("dns_reconcile_failures_total", 0))),
+        ("Blocked requests", _metric_int(metrics.get("rate_limit_hits_total", 0))),
+        ("Average update time", f"{average_latency:.1f} ms"),
+        ("Last update time", f"{metrics.get('last_update_latency_ms', 0):.1f} ms"),
+        ("Cleanup ok/errors", f"{_metric_int(metrics.get('cleanup_success_total', 0))}/{_metric_int(metrics.get('cleanup_errors_total', 0))}"),
+    ]
+    cards = "\n".join(
+        f"""
+        <div class="col-6 col-lg-3">
+          <div class="metric-card h-100">
+            <span>{escape(label)}</span>
+            <strong>{escape(value)}</strong>
+          </div>
+        </div>
+        """
+        for label, value in items
+    )
+    return trusted(f"""
+      <div class="mt-4">
+        <p class="eyebrow">Metrics</p>
+        <div class="row g-3 mt-1">{cards}</div>
+      </div>
+    """)
+
+
+def _metric_int(value: float) -> str:
+    return str(int(value))

router_dyndns/web/templates_admin_tables.py

@@ -17,16 +17,16 @@ def _account_row(account: dict[str, str | int | None], csrf: str = "", admin_pat
           <form method="post" action="{safe_admin_path}/accounts/rotate" class="d-flex gap-2 flex-wrap">
             <input type="hidden" name="csrf" value="{attr(csrf)}">
             <input type="hidden" name="hostname" value="{hostname}">
-            <button name="action" value="update" class="btn btn-sm btn-light px-3" title="Rotate update URL" aria-label="Rotate update URL for {hostname}">Update URL</button>
-            <button name="action" value="management" class="btn btn-sm btn-light px-3" title="Rotate management link" aria-label="Rotate management link for {hostname}">Manage link</button>
-            <button name="action" value="password" class="btn btn-sm btn-light px-3" title="Rotate router password" aria-label="Rotate router password for {hostname}">Password</button>
+            <button name="action" value="update" class="btn btn-sm btn-light px-3" title="Create a new update URL" aria-label="New update URL for {hostname}">New update URL</button>
+            <button name="action" value="management" class="btn btn-sm btn-light px-3" title="Create a new dashboard link" aria-label="New dashboard link for {hostname}">New dashboard link</button>
+            <button name="action" value="password" class="btn btn-sm btn-light px-3" title="Create a new router password" aria-label="New password for {hostname}">New password</button>
           </form>
         </td>
         <td>
           <form method="post" action="{safe_admin_path}/accounts/delete">
             <input type="hidden" name="csrf" value="{attr(csrf)}">
             <input type="hidden" name="hostname" value="{hostname}">
-            <button class="btn btn-sm btn-light px-2 text-danger" title="Delete hostname" aria-label="Delete {hostname}">x</button>
+            <button class="btn btn-sm btn-outline-danger px-2" title="Delete hostname" aria-label="Delete {hostname}">Delete</button>
           </form>
         </td>
       </tr>

router_dyndns/web/templates_management.py

@@ -57,10 +57,10 @@ def _render_management_page(
           {_top_nav()}
           <section class="hero-band compact">
             <div class="container text-center d-grid justify-items-center gap-3">
-              <p class="eyebrow">Magic management</p>
+              <p class="eyebrow">Dashboard</p>
               <h1>{hostname}</h1>
-              <p class="lead">Anyone with this link can manage or delete this hostname. Keep it private.</p>
-              <a class="btn btn-outline-primary rounded-pill" href="/">Back home</a>
+              <p class="lead">This private link can manage this hostname. Keep it safe.</p>
+              <a class="btn btn-outline-primary rounded-pill" href="/">Home</a>
             </div>
           </section>
           {message_html}
@@ -71,12 +71,12 @@ def _render_management_page(
               <div class="col-lg-6">
                 <p class="eyebrow">Router settings</p>
                 <h2>Router update settings</h2>
-                <p class="section-copy">Use the Update-URL directly if your router only has one URL field. Separate Benutzername and Kennwort values are optional compatibility fields. If you use your own DNS name, point it at this hostname with a CNAME.</p>
+                <p class="section-copy">Use the Update-URL if your router has one URL field. Username and password are only for routers that require them. For your own subdomain, create a CNAME to this hostname.</p>
                 {_one_time_secret_notice()}
                 {_secret_notice()}
                 <div class="d-flex gap-2 flex-wrap mt-3">
-                  {_copy_button("Copy complete FRITZ!Box fields", fritzbox_fields)}
-                  {_copy_button("Copy CNAME record", cname_record)}
+                  {_copy_button("Copy router fields", fritzbox_fields)}
+                  {_copy_button("Copy CNAME", cname_record)}
                 </div>
               </div>
               <div class="col-lg-6 d-grid gap-2">
@@ -91,19 +91,19 @@ def _render_management_page(
               <div class="card card-body gap-3 mt-4">
                 <div>
                   <p class="eyebrow">Actions</p>
-                  <h3>Rotate dashboard secrets</h3>
-                  <p class="section-copy">Rotate the URL used by routers, or issue a new router password for compatibility clients. Update your router after rotating.</p>
+                  <h3>Replace router secrets</h3>
+                  <p class="section-copy">Create a new update URL or router password. Update your router after changing either one.</p>
                 </div>
                 <div class="d-flex gap-2 flex-wrap">
                   <form method="post" action="/m/{attr(management_slug)}/rotate">
                     <input type="hidden" name="csrf" value="{attr(csrf_token)}">
                     <input type="hidden" name="action" value="update">
-                    <button class="btn btn-outline-primary rounded-pill" type="submit">Rotate Update-URL</button>
+                    <button class="btn btn-outline-primary rounded-pill" type="submit">New update URL</button>
                   </form>
                   <form method="post" action="/m/{attr(management_slug)}/rotate">
                     <input type="hidden" name="csrf" value="{attr(csrf_token)}">
                     <input type="hidden" name="action" value="password">
-                    <button class="btn btn-outline-primary rounded-pill" type="submit">Rotate router credentials</button>
+                    <button class="btn btn-outline-primary rounded-pill" type="submit">New password</button>
                   </form>
                 </div>
               </div>
@@ -134,7 +134,7 @@ def _render_management_page(
                 <div>
                   <p class="eyebrow">History</p>
                   <h2>Router updates</h2>
-                  <p class="section-copy">Recent IP changes and failed DNS publishes for this hostname.</p>
+                  <p class="section-copy">Recent IP changes and failed updates for this hostname.</p>
                 </div>
               </div>
               <div class="table-responsive border rounded admin-table-scroll">
@@ -148,7 +148,7 @@ def _render_management_page(
           <section class="section danger-section">
             <div class="container d-flex align-items-md-center justify-content-between gap-4 flex-column flex-md-row">
               <div>
-                <p class="eyebrow">Danger zone</p>
+                <p class="eyebrow">Delete</p>
                 <h2>Delete hostname</h2>
                 <p class="section-copy">This removes the hostname and DNS records. The router update URL will stop working.</p>
               </div>
@@ -160,6 +160,7 @@ def _render_management_page(
           </section>
         </main>
         """),
+        extra_styles=trusted('<link href="/admin.css?v=2" rel="stylesheet">'),
     )
 
 def _management_message(message: str | None) -> SafeHtml:
@@ -176,22 +177,22 @@ def _management_message(message: str | None) -> SafeHtml:
 
 def _dashboard_password_panel(management_slug: str, csrf_token: str, password_enabled: bool) -> SafeHtml:
     password_status = "Enabled" if password_enabled else "Not enabled"
-    password_action = "Change dashboard password" if password_enabled else "Set dashboard password"
+    password_action = "Change password" if password_enabled else "Set password"
     remove_form = ""
     if password_enabled:
         remove_form = f"""
           <form class="card card-body gap-3" method="post" action="/m/{attr(management_slug)}/password/remove">
             <input type="hidden" name="csrf" value="{attr(csrf_token)}">
-            <label class="form-label" for="dashboard-remove-current-password">Current dashboard password</label>
+            <label class="form-label" for="dashboard-remove-current-password">Current password</label>
             <input class="form-control" id="dashboard-remove-current-password" name="current_dashboard_password" type="password" autocomplete="current-password" required>
-            <button class="btn btn-outline-danger rounded-pill" type="submit">Remove dashboard password</button>
+            <button class="btn btn-outline-danger rounded-pill" type="submit">Remove password</button>
           </form>
         """
     current_password_field = ""
     if password_enabled:
         current_password_field = """
                   <div>
-                    <label class="form-label" for="dashboard-current-password">Current dashboard password</label>
+                    <label class="form-label" for="dashboard-current-password">Current password</label>
                     <input class="form-control" id="dashboard-current-password" name="current_dashboard_password" type="password" autocomplete="current-password" required>
                   </div>
         """
@@ -203,7 +204,7 @@ def _dashboard_password_panel(management_slug: str, csrf_token: str, password_en
               <div class="col-lg-5">
                 <p class="eyebrow">Dashboard password</p>
                 <h2>Password protection</h2>
-                <p class="section-copy">Status: {escape(password_status)}. This protects this management dashboard only. Router update URLs continue to work normally.</p>
+                <p class="section-copy">Status: {escape(password_status)}. This password protects only this dashboard. Router updates still work.</p>
               </div>
               <div class="col-lg-7 d-grid gap-3">
                 <form class="card card-body gap-3" method="post" action="/m/{attr(management_slug)}/password">
@@ -249,7 +250,7 @@ def _render_management_unlock_page(
             <div class="container text-center d-grid justify-items-center gap-3">
               <p class="eyebrow">Dashboard locked</p>
               <h1>{hostname}</h1>
-              <p class="lead">Enter the dashboard password to manage this hostname.</p>
+              <p class="lead">Enter the dashboard password for this hostname.</p>
             </div>
           </section>
           <section class="section">
@@ -263,9 +264,9 @@ def _render_management_unlock_page(
                 </div>
                 <label class="form-check d-flex align-items-center gap-2">
                   <input class="form-check-input" type="checkbox" name="stay_unlocked" value="1">
-                  <span class="form-check-label">Stay unlocked for 30 days on this browser</span>
+                  <span class="form-check-label">Remember this browser for 30 days</span>
                 </label>
-                <button class="btn btn-primary rounded-pill" type="submit">Unlock dashboard</button>
+                <button class="btn btn-primary rounded-pill" type="submit">Unlock</button>
               </form>
             </div>
           </section>
@@ -285,15 +286,15 @@ def _management_domain_claim_panel(
         <div class="card card-body gap-3">
           <div>
             <p class="eyebrow">Custom domain</p>
-            <h2>Claim a domain</h2>
-            <p class="section-copy">Create a TXT challenge, verify it from this dashboard, then create router credentials for a hostname under that verified domain.</p>
+            <h2>Use your domain</h2>
+            <p class="section-copy">Create a TXT record, verify it here, then create a hostname under that domain.</p>
           </div>
           <form method="post" action="/m/{attr(management_slug)}/domains/request" class="d-grid gap-3" aria-label="Create dashboard domain claim">
             <input type="hidden" name="csrf" value="{attr(csrf_token)}">
             <label>Domain
               <input class="form-control" name="domain" placeholder="example.com" autocomplete="off" autocapitalize="none" spellcheck="false" required>
             </label>
-            <button type="submit" class="btn btn-primary rounded-pill">Create domain claim</button>
+            <button type="submit" class="btn btn-primary rounded-pill">Create claim</button>
           </form>
         </div>
         """
@@ -312,7 +313,7 @@ def _management_domain_claim_panel(
     verification_name = service.verification_name(domain)
     token = str(challenge["token"])
     claim_url = service.domain_claim_url(challenge)
-    status = "Verified" if challenge.get("verified_at") else "Waiting for TXT verification"
+    status = "Verified" if challenge.get("verified_at") else "Waiting for TXT"
     txt_bundle = f"TXT name: {verification_name}\nTXT value: {token}"
     create_hostname = _management_custom_hostname_form(management_slug, claim_secret, csrf_token) if challenge.get("verified_at") else trusted("")
     return trusted(
@@ -325,11 +326,11 @@ def _management_domain_claim_panel(
                 <p class="eyebrow">Domain claim</p>
                 <h2>{escape(domain)}</h2>
                 <p class="section-copy">Status: {escape(status)}</p>
-                <p class="small text-secondary mb-0">This claim belongs to this dashboard. Another dashboard cannot verify or use it.</p>
+                <p class="small text-secondary mb-0">This claim belongs to this dashboard. Other dashboards cannot use it.</p>
               </div>
-              <div class="alert alert-info mb-0 py-2 small">TXT name and value are public DNS records. The claim secret and private claim link are secrets.</div>
+              <div class="alert alert-info mb-0 py-2 small">TXT name and value are public. Claim secret and private claim link are secret.</div>
               <div class="d-flex gap-2 flex-wrap">
-                {_copy_button("Copy TXT record", txt_bundle)}
+                {_copy_button("Copy TXT", txt_bundle)}
               </div>
               <div class="d-grid gap-2">
                 {_copy_row("TXT name", verification_name, "Public")}
@@ -341,7 +342,7 @@ def _management_domain_claim_panel(
                 <input type="hidden" name="csrf" value="{attr(csrf_token)}">
                 <input type="hidden" name="domain" value="{attr(domain)}">
                 <input type="hidden" name="claim_secret" value="{attr(claim_secret)}">
-                <button type="submit" class="btn btn-primary rounded-pill">Verify claim</button>
+                <button type="submit" class="btn btn-primary rounded-pill">Verify</button>
               </form>
               {create_hostname}
             </div>
@@ -358,10 +359,10 @@ def _management_custom_hostname_form(management_slug: str, claim_secret: str, cs
         <form method="post" action="/m/{attr(management_slug)}/domains/hostnames" class="d-grid gap-3" aria-label="Create verified custom hostname">
           {csrf_field}
           <input type="hidden" name="claim_secret" value="{attr(claim_secret)}">
-          <label>Custom hostname
+          <label>Hostname
             <input class="form-control" name="hostname" placeholder="home.example.com" autocomplete="off" autocapitalize="none" spellcheck="false" required>
           </label>
-          <button type="submit" class="btn btn-primary rounded-pill">Create custom hostname</button>
+          <button type="submit" class="btn btn-primary rounded-pill">Create hostname</button>
         </form>
         """
     )

router_dyndns/web/templates_public.py

@@ -14,11 +14,13 @@ def _render_public_home(
     message: str | None,
     challenge: dict[str, str | None] | None = None,
 ) -> str:
+    base_url = settings.public_base_url.rstrip("/")
     suffix = escape(settings.hostname_suffix or "your DynDNS domain")
-    demo_update_url = escape(f"{settings.public_base_url.rstrip('/')}/u/<secret>?myip=<ipaddr>")
+    demo_update_url = escape(f"{base_url}/u/<secret>?myip=<ipaddr>")
     created_html = _credentials_panel(service, created_account)
     message_html = _message_band(message) if message and not challenge else ""
     challenge_html = _custom_domain_flow(service, challenge, message)
+    description = "KarlDNS is a free self-hosted Dynamic DNS service for FRITZ!Box routers, custom domains, Linux cron jobs, and home networks."
     return _page(
         "KarlDNS",
         trusted(f"""
@@ -26,15 +28,15 @@ def _render_public_home(
           {_top_nav()}
           <section class="hero-band">
             <div class="container text-center d-grid justify-items-center gap-3">
-              <img class="hero-logo" src="/logo.png" alt="" width="80" height="80">
-              <h1>KarlDNS for home routers.</h1>
+              <img class="hero-logo" src="/logo.webp?v=3" alt="" width="80" height="80" decoding="async" fetchpriority="high">
+              <h1>Dynamic DNS for home routers.</h1>
               <div class="install-pill mx-auto">
                 <code>{demo_update_url}</code>
               </div>
-              <p class="lead">Generate one secret update URL under {suffix}. Paste it into your router, script it with curl, or point your own subdomain at it with a CNAME.</p>
+              <p class="lead">KarlDNS gives you a private DynDNS update URL under {suffix}. Add it to your router, or use it from a script.</p>
               <div class="d-flex gap-2 flex-wrap justify-content-center mt-2">
-                <a class="btn btn-primary rounded-pill" href="#create">Generate hostname</a>
-                <a class="btn btn-outline-primary rounded-pill" href="#manual-updates">See curl flow</a>
+                <a class="btn btn-primary rounded-pill" href="#create">Create hostname</a>
+                <a class="btn btn-outline-primary rounded-pill" href="#manual-updates">Manual updates</a>
               </div>
             </div>
           </section>
@@ -43,31 +45,31 @@ def _render_public_home(
           <section class="section" id="create">
             <div class="container narrow">
               <div class="text-center mb-4">
-                <p class="eyebrow">Choose your hostname</p>
-                <h2>No account. No login.</h2>
-                <p class="section-copy mx-auto">Use a generated KarlDNS hostname immediately, or verify your own domain with a DNS TXT record.</p>
+                <p class="eyebrow">Hostname</p>
+                <h2>No account needed.</h2>
+                <p class="section-copy mx-auto">Use a KarlDNS hostname now, or verify your own domain when you need it.</p>
               </div>
               <div class="row g-4 align-items-stretch">
                 <div class="col-lg-6">
                   <div class="card card-body h-100 gap-3">
-                    <p class="eyebrow">Use our domain</p>
-                    <h3>Generate a KarlDNS hostname</h3>
-                    <p class="section-copy mb-0">KarlDNS generates the hostname, secret update URL, and optional router compatibility credentials automatically.</p>
+                    <p class="eyebrow">KarlDNS domain</p>
+                    <h3>Create a hostname</h3>
+                    <p class="section-copy mb-0">You get a hostname, a private update URL, and router fields if your router needs them.</p>
                     <form method="post" action="/magic" class="d-grid gap-3" aria-label="Create a generated DynDNS hostname">
-                      <button type="submit" class="btn btn-primary rounded-pill">Generate hostname</button>
+                      <button type="submit" class="btn btn-primary rounded-pill">Create hostname</button>
                     </form>
                   </div>
                 </div>
                 <div class="col-lg-6">
                   <div class="card card-body h-100 gap-3">
                     <p class="eyebrow">Use your own domain</p>
-                    <h3>Verify DNS ownership</h3>
-                    <p class="section-copy mb-0">Add one TXT record so KarlDNS can confirm you control the domain before it publishes A/AAAA records there.</p>
+                    <h3>Verify your domain</h3>
+                    <p class="section-copy mb-0">Add one TXT record first. KarlDNS only updates domains it can verify.</p>
                     <form method="post" action="/request-domain" class="d-grid gap-3" aria-label="Request a custom domain TXT challenge">
                       <label>Domain
                         <input class="form-control" name="domain" placeholder="example.com" autocomplete="off" autocapitalize="none" spellcheck="false" required>
                       </label>
-                      <button type="submit" class="btn btn-primary rounded-pill">Create TXT challenge</button>
+                      <button type="submit" class="btn btn-primary rounded-pill">Create TXT record</button>
                     </form>
                   </div>
                 </div>
@@ -80,8 +82,8 @@ def _render_public_home(
           </section>
           <section class="section" id="manual-updates">
             <div class="container narrow text-center">
-              <h2>Update from anything that can send GET.</h2>
-              <p class="lead mx-auto mt-3">Use FRITZ!Box placeholders, curl, cron, Home Assistant, OpenWrt, pfSense, OPNsense, UniFi, MikroTik, or your own automation.</p>
+              <h2>Update from a router or script.</h2>
+              <p class="lead mx-auto mt-3">Works with FRITZ!Box, curl, cron, Home Assistant, OpenWrt, pfSense, OPNsense, UniFi, MikroTik, and custom tools.</p>
               <div class="terminal-card text-start mt-4">
                 <code># explicit IPv4</code>
                 <code>curl -sS 'https://karldns.de/u/&lt;secret&gt;?myip=203.0.113.10'</code>
@@ -94,9 +96,33 @@ def _render_public_home(
           {challenge_html}
         </main>
         """),
+        description=description,
+        preload_logo=True,
+        canonical_url=f"{base_url}/",
+        image_url=f"{base_url}/social-preview.png",
+        image_alt="KarlDNS landing page with private Dynamic DNS update URL",
+        structured_data={
+            "@context": "https://schema.org",
+            "@type": "SoftwareApplication",
+            "name": "KarlDNS",
+            "applicationCategory": "NetworkingApplication",
+            "operatingSystem": "Linux",
+            "url": f"{base_url}/",
+            "description": description,
+            "image": f"{base_url}/social-preview.png",
+            "offers": {"@type": "Offer", "price": "0", "priceCurrency": "EUR"},
+            "featureList": [
+                "Dynamic DNS for FRITZ!Box routers",
+                "Accountless private update URLs",
+                "Custom domain TXT verification",
+                "Linux cron updater",
+            ],
+        },
     )
 
-def _render_privacy_page() -> str:
+def _render_privacy_page(settings: DdnsSettings) -> str:
+    base_url = settings.public_base_url.rstrip("/")
+    description = "Privacy and legal information for KarlDNS, including stored hostnames, update links, DNS verification records, IP history, and cleanup behavior."
     return _page(
         "Legal and Privacy",
         trusted(f"""
@@ -105,23 +131,23 @@ def _render_privacy_page() -> str:
           <section class="hero-band compact">
             <div class="container text-center d-grid justify-items-center gap-3">
               <p class="eyebrow">Legal and privacy</p>
-              <h1>KarlDNS keeps accountless DynDNS simple.</h1>
-              <p class="lead">This page explains the basic data handled by this self-hosted service. Configure your own imprint, controller details, and jurisdiction-specific terms before offering it publicly.</p>
+              <h1>Privacy basics.</h1>
+              <p class="lead">KarlDNS stores only the data needed to keep your hostname updated.</p>
             </div>
           </section>
           <section class="section">
             <div class="container narrow d-grid gap-4">
               <div>
                 <h2>Data processed</h2>
-                <p class="section-copy">KarlDNS stores generated hostnames, public DNS target names, update slugs, hashed management tokens, hashed router passwords, DNS TXT verification challenges, IP update history, timestamps, and operational events needed to run Dynamic DNS.</p>
+                <p class="section-copy">KarlDNS stores hostnames, update links, protected dashboard tokens, protected router passwords, TXT verification records, recent IP history, timestamps, and service events.</p>
               </div>
               <div>
                 <h2>Secrets</h2>
-                <p class="section-copy">Private management links, update URLs, router passwords, and one-box update URLs are bearer secrets. Anyone with them can update or manage the related hostname. Passwords and management lookup values are not stored in recoverable plaintext.</p>
+                <p class="section-copy">Dashboard links, update URLs, router passwords, full update URLs, and claim links are secrets. Anyone with them may update or manage the hostname. Passwords and dashboard lookup values are not stored as readable text.</p>
               </div>
               <div>
                 <h2>Logs and retention</h2>
-                <p class="section-copy">The service keeps recent update events for troubleshooting and runs cleanup jobs for abandoned setup flows and unused hostnames. Server and reverse-proxy logs may also contain IP addresses and request metadata depending on your deployment.</p>
+                <p class="section-copy">KarlDNS keeps recent update events for troubleshooting. Cleanup removes abandoned setup records and unused hostnames. Server logs may also include IP addresses and request details.</p>
               </div>
               <div>
                 <h2>Contact</h2>
@@ -131,4 +157,20 @@ def _render_privacy_page() -> str:
           </section>
         </main>
         """),
+        description=description,
+        canonical_url=f"{base_url}/privacy",
+        image_url=f"{base_url}/social-preview.png",
+        image_alt="KarlDNS legal and privacy information",
+        structured_data={
+            "@context": "https://schema.org",
+            "@type": "WebPage",
+            "name": "KarlDNS Legal and Privacy",
+            "url": f"{base_url}/privacy",
+            "description": description,
+            "isPartOf": {
+                "@type": "WebSite",
+                "name": "KarlDNS",
+                "url": f"{base_url}/",
+            },
+        },
     )

router_dyndns/web/templates_public_sections.py

@@ -25,8 +25,8 @@ def _linux_installer_section() -> SafeHtml:
           <div class="container narrow">
             <div class="text-center mb-4">
               <p class="eyebrow">Linux cron updater</p>
-              <h2>Install and uninstall should be boring.</h2>
-              <p class="section-copy mx-auto">For a Linux server, Proxmox host, NAS, or home-lab box that is always on, the installer creates a hostname if needed, installs the updater, schedules cron, runs the first update, and prints the private dashboard URL.</p>
+              <h2>Linux updater.</h2>
+              <p class="section-copy mx-auto">Run this on a Linux box that is always on. It creates a hostname, installs the updater, schedules it, and prints your private dashboard link.</p>
             </div>
             <div class="card card-body gap-3">
               <div class="terminal-card">
@@ -39,11 +39,11 @@ def _linux_installer_section() -> SafeHtml:
                 {_copy_button("Copy all commands", all_commands)}
               </div>
               <div class="alert alert-info my-0 py-2 small" role="note">
-                Uninstall keeps the private config by default because it may contain your only local copy of the update and dashboard URLs. Use <code>--delete-config</code> for a clean wipe.
+                Uninstall keeps your private URLs by default. Use <code>--delete-config</code> only when you want to remove everything.
               </div>
               <div>
-                <h3>Without sudo</h3>
-                <p class="section-copy">User mode writes to <code>~/.local/bin</code>, <code>~/.config/karldns</code>, and your user crontab.</p>
+                <h3>User install</h3>
+                <p class="section-copy">Use this when you do not want a system-wide install.</p>
               </div>
               <div class="terminal-card">
                 <code>{escape(user_install)}</code>
@@ -69,7 +69,7 @@ def _custom_domain_flow(service: DdnsService, challenge: dict[str, str | None] |
     claim_secret = attr(challenge.get("claim_secret") or "")
     verification_name = service.verification_name(str(challenge["domain"]))
     claim_url = service.domain_claim_url(challenge)
-    status = escape(message or "Add this TXT record at your DNS provider, then check when it has propagated.")
+    status = escape(message or "Add this TXT record at your DNS provider, then check again. DNS can take a few minutes.")
     txt_bundle = f"TXT name: {verification_name}\nTXT value: {token}"
     challenge_html = trusted(
         f"""
@@ -78,8 +78,8 @@ def _custom_domain_flow(service: DdnsService, challenge: dict[str, str | None] |
             <span class="badge text-bg-primary rounded-circle align-self-start">1</span>
             <h3>Add the TXT record</h3>
             <p class="small text-secondary mb-0 mt-2">{status}</p>
-            <div class="alert alert-info mb-0 py-2 small">TXT name and value are public DNS records. The private claim link is secret.</div>
-            {_copy_button("Copy TXT record", txt_bundle)}
+            <div class="alert alert-info mb-0 py-2 small">TXT name and value are public. The private claim link is secret.</div>
+            {_copy_button("Copy TXT", txt_bundle)}
             {_copy_row("TXT name", verification_name, "Public")}
             {_copy_row("TXT value", token, "Public")}
             {_copy_row("Private claim link", claim_url, "Secret")}
@@ -99,9 +99,9 @@ def _custom_domain_flow(service: DdnsService, challenge: dict[str, str | None] |
         <section class="section" id="custom-domain">
           <div class="container narrow">
             <div class="text-center">
-              <p class="eyebrow">Direct custom-domain publishing</p>
-              <h2>Verify DNS ownership</h2>
-              <p class="section-copy mx-auto">Use this only when KarlDNS should publish A/AAAA records directly inside your domain. If you just want your own subdomain, generate a hostname above and create a CNAME to it.</p>
+              <p class="eyebrow">Custom domain</p>
+              <h2>Verify your domain</h2>
+              <p class="section-copy mx-auto">Use this when KarlDNS should update records inside your domain. For a simpler setup, create a KarlDNS hostname and point a CNAME to it.</p>
             </div>
             <div class="row g-3 mt-4 justify-content-center">
               {challenge_html}
@@ -129,24 +129,24 @@ def _credentials_panel(service: DdnsService, created_account: dict[str, str] | N
         f"""
         <section class="section success-section">
           <div class="container">
-            <p class="eyebrow">Hostname generated</p>
+            <p class="eyebrow">Hostname ready</p>
             <h2>{escape(hostname)}</h2>
-            <p class="section-copy">Use the Update-URL directly. The separate Benutzername and Kennwort values are optional compatibility fields for routers that require them.</p>
+            <p class="section-copy">Use the Update-URL directly. Username and password are only for routers that require separate fields.</p>
             {_one_time_secret_notice()}
             {_secret_notice()}
             <div class="d-flex gap-2 flex-wrap my-3">
-              {_copy_button("Copy complete FRITZ!Box fields", fritzbox_fields)}
-              {_copy_button("Copy one-box update URL", credentialed_update_url)}
-              {_copy_button("Copy CNAME record", cname_record)}
+              {_copy_button("Copy router fields", fritzbox_fields)}
+              {_copy_button("Copy full URL", credentialed_update_url)}
+              {_copy_button("Copy CNAME", cname_record)}
             </div>
             <div class="d-grid gap-2">
               {_copy_row("Update-URL:", update_url, "Secret")}
-              {_copy_row("One-box update URL:", credentialed_update_url, "Secret")}
+              {_copy_row("Full update URL:", credentialed_update_url, "Secret")}
               {_copy_row("Domainnamen:", hostname, "Public")}
               {_copy_row("CNAME target:", hostname, "Public")}
               {_copy_row("Benutzername (optional):", username, "Public")}
               {_copy_row("Kennwort (optional):", password, "Secret")}
-              {_copy_row("Private status page:", management_url, "Secret")}
+              {_copy_row("Private dashboard:", management_url, "Secret")}
             </div>
             {_manual_update_panel(manual_commands)}
           </div>
@@ -161,15 +161,15 @@ def _custom_hostname_form(claim_secret: str) -> SafeHtml:
         <div class="col-lg-5">
           <div class="card card-body h-100 gap-3">
             <span class="badge text-bg-primary rounded-circle align-self-start">2</span>
-            <h3>Create router hostname</h3>
+            <h3>Create hostname</h3>
             <form method="post" action="/accounts" class="d-grid gap-3" aria-label="Create custom-domain router credentials">
               <input type="hidden" name="mode" value="custom">
               <input type="hidden" name="claim_secret" value="{claim_secret}">
               <label>Verified hostname
                 <input class="form-control" name="hostname" placeholder="home.example.com" autocomplete="off" autocapitalize="none" spellcheck="false" required>
               </label>
-              <p class="section-copy mb-0">Router compatibility credentials are generated automatically after creation.</p>
-              <button type="submit" class="btn btn-primary rounded-pill">Create credentials</button>
+              <p class="section-copy mb-0">Router fields are created after this step.</p>
+              <button type="submit" class="btn btn-primary rounded-pill">Create hostname</button>
             </form>
           </div>
         </div>
@@ -183,8 +183,8 @@ def _locked_custom_hostname_card() -> SafeHtml:
         <div class="col-lg-5">
           <div class="card card-body h-100 gap-3 opacity-75">
             <span class="badge text-bg-primary rounded-circle align-self-start">2</span>
-            <h3>Create router hostname</h3>
-            <p class="small text-secondary mb-0 mt-2">This unlocks after the TXT record is visible in public DNS.</p>
+            <h3>Create hostname</h3>
+            <p class="small text-secondary mb-0 mt-2">Available after KarlDNS can see the TXT record.</p>
           </div>
         </div>
         """