server.go

package api

import (
	"context"
	cryptoRand "crypto/rand"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/exec"
	"path/filepath"
	"regexp"
	"sort"
	"strconv"
	"strings"
	"time"

	"github.com/flatrun/agent/internal/audit"
	"github.com/flatrun/agent/internal/auth"
	"github.com/flatrun/agent/internal/backup"
	"github.com/flatrun/agent/internal/certs"
	"github.com/flatrun/agent/internal/credentials"
	"github.com/flatrun/agent/internal/database"
	"github.com/flatrun/agent/internal/dns"
	"github.com/flatrun/agent/internal/docker"
	"github.com/flatrun/agent/internal/files"
	"github.com/flatrun/agent/internal/infra"
	"github.com/flatrun/agent/internal/networks"
	"github.com/flatrun/agent/internal/proxy"
	"github.com/flatrun/agent/internal/scheduler"
	"github.com/flatrun/agent/internal/security"
	"github.com/flatrun/agent/internal/system"
	"github.com/flatrun/agent/internal/traffic"
	"github.com/flatrun/agent/pkg/config"
	"github.com/flatrun/agent/pkg/models"
	"github.com/flatrun/agent/pkg/plugins"
	dnsPlugins "github.com/flatrun/agent/pkg/plugins/dns"
	"github.com/flatrun/agent/pkg/subdomain"
	"github.com/flatrun/agent/pkg/version"
	"github.com/flatrun/agent/templates"
	"github.com/gin-gonic/gin"
	"github.com/google/uuid"
	"gopkg.in/yaml.v3"
)

type Server struct {
	config             *config.Config
	configPath         string
	router             *gin.Engine
	server             *http.Server
	manager            *docker.Manager
	certsDiscovery     *certs.Discovery
	networksManager    *networks.Manager
	pluginRegistry     *plugins.Registry
	authMiddleware     *auth.Middleware
	authManager        *auth.Manager
	proxyOrchestrator  *proxy.Orchestrator
	filesManager       *files.Manager
	servicesManager    *system.ServicesManager
	databaseManager    *database.Manager
	infraManager       *infra.Manager
	credentialsManager *credentials.Manager
	securityManager    *security.Manager
	trafficManager     *traffic.Manager
	backupManager      *backup.Manager
	schedulerManager   *scheduler.Manager
	auditManager       *audit.Manager
	auditMiddleware    *audit.Middleware
	powerDNSManager    *dns.PowerDNSManager
}

func New(cfg *config.Config, configPath string) *Server {
	if cfg.Logging.Level == "debug" {
		gin.SetMode(gin.DebugMode)
	} else {
		gin.SetMode(gin.ReleaseMode)
	}

	router := gin.Default()

	if cfg.API.EnableCORS {
		router.Use(corsMiddleware(cfg.API.AllowedOrigins))
	}

	manager := docker.NewManager(cfg.DeploymentsPath)
	certsDiscovery := certs.NewDiscovery(cfg.DeploymentsPath)
	networksManager := networks.NewManager()
	pluginsDir := filepath.Join(cfg.DeploymentsPath, ".flatrun", "plugins")
	pluginRegistry := plugins.NewRegistry(pluginsDir)
	_ = pluginRegistry.LoadFromDisk()
	authMiddleware := auth.NewMiddleware(&cfg.Auth)

	var authManager *auth.Manager
	if authMgr, authErr := auth.NewManager(cfg.DeploymentsPath, &cfg.Auth); authErr != nil {
		log.Printf("Warning: Failed to initialize auth manager: %v", authErr)
	} else {
		authManager = authMgr
		authMiddleware.SetManager(authManager)
	}

	proxyOrchestrator := proxy.NewOrchestrator(cfg)
	filesManager := files.NewManager(cfg.DeploymentsPath)
	servicesManager := system.NewServicesManager()
	databaseManager := database.NewManager()
	infraManager := infra.NewManager(cfg)
	credentialsManager := credentials.NewManager(cfg.DeploymentsPath)

	var securityManager *security.Manager
	if cfg.Security.Enabled {
		var err error
		securityManager, err = security.NewManager(cfg.DeploymentsPath)
		if err != nil {
			log.Printf("Warning: Failed to initialize security manager: %v", err)
		} else {
			// Apply detection thresholds from config
			securityManager.SetDetectorThresholds(
				cfg.Security.RateThreshold,
				cfg.Security.NotFoundThreshold,
				cfg.Security.AuthFailureThreshold,
				cfg.Security.UniquePathsThreshold,
				cfg.Security.RepeatedHitsThreshold,
				cfg.Security.DetectionWindow,
			)
			nginxConfigPath := cfg.Nginx.ConfigPath
			if nginxConfigPath == "" {
				nginxConfigPath = filepath.Join(cfg.DeploymentsPath, "nginx", "conf.d")
			}
			if err := securityManager.InitNginxConfigs(nginxConfigPath); err != nil {
				log.Printf("Warning: Failed to initialize security nginx configs: %v", err)
			}
			// Add Docker gateway IP to whitelist
			gatewayIP := infraManager.GetDockerHostIP()
			if err := securityManager.AddDockerGatewayToWhitelist(gatewayIP); err != nil {
				log.Printf("Warning: Failed to add Docker gateway to whitelist: %v", err)
			}
		}
	}

	var trafficManager *traffic.Manager
	trafficManager, err := traffic.NewManager(cfg.DeploymentsPath, 7)
	if err != nil {
		log.Printf("Warning: Failed to initialize traffic manager: %v", err)
	}

	var backupManager *backup.Manager
	backupManager, err = backup.NewManager(cfg.DeploymentsPath)
	if err != nil {
		log.Printf("Warning: Failed to initialize backup manager: %v", err)
	}

	var auditManager *audit.Manager
	var auditMiddleware *audit.Middleware
	if cfg.Audit.Enabled {
		auditConfig := &audit.Config{
			Enabled:            cfg.Audit.Enabled,
			RetentionDays:      cfg.Audit.RetentionDays,
			CaptureRequestBody: cfg.Audit.CaptureRequestBody,
			ExcludedPaths:      cfg.Audit.ExcludedPaths,
			SensitiveFields:    cfg.Audit.SensitiveFields,
			CleanupInterval:    cfg.Audit.CleanupInterval,
		}
		auditManager, err = audit.NewManager(cfg.DeploymentsPath, auditConfig)
		if err != nil {
			log.Printf("Warning: Failed to initialize audit manager: %v", err)
		} else {
			auditMiddleware = audit.NewMiddleware(auditManager)
		}
	}

	powerDNSManager := dns.NewPowerDNSManager(cfg)

	s := &Server{
		config:             cfg,
		configPath:         configPath,
		router:             router,
		manager:            manager,
		certsDiscovery:     certsDiscovery,
		networksManager:    networksManager,
		pluginRegistry:     pluginRegistry,
		authMiddleware:     authMiddleware,
		authManager:        authManager,
		proxyOrchestrator:  proxyOrchestrator,
		filesManager:       filesManager,
		servicesManager:    servicesManager,
		databaseManager:    databaseManager,
		infraManager:       infraManager,
		credentialsManager: credentialsManager,
		securityManager:    securityManager,
		trafficManager:     trafficManager,
		backupManager:      backupManager,
		auditManager:       auditManager,
		auditMiddleware:    auditMiddleware,
		powerDNSManager:    powerDNSManager,
	}

	if backupManager != nil {
		executor := scheduler.NewExecutor(backupManager, manager)
		schedulerManager, err := scheduler.NewManager(cfg.DeploymentsPath, executor)
		if err != nil {
			log.Printf("Warning: Failed to initialize scheduler manager: %v", err)
		} else {
			s.schedulerManager = schedulerManager
			schedulerManager.Start()
		}
	}

	s.setupRoutes()

	return s
}

func (s *Server) setupRoutes() {
	api := s.router.Group("/api")
	{
		api.GET("/health", s.healthCheck)
		api.GET("/auth/status", s.authMiddleware.GetAuthStatus)
		api.POST("/auth/login", s.authMiddleware.Login)
		api.GET("/auth/validate", s.authMiddleware.ValidateToken)

		// WebSocket endpoint handles its own auth via first-message
		api.GET("/containers/:id/exec", s.containerExec)

		protected := api.Group("")
		protected.Use(s.authMiddleware.RequireAuth())
		if s.auditMiddleware != nil {
			protected.Use(s.auditMiddleware.Capture())
		}
		{
			// Deployment endpoints
			protected.GET("/deployments", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.listDeployments)
			protected.GET("/deployments/:name", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeployment)
			protected.POST("/deployments", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.createDeployment)
			protected.PUT("/deployments/:name", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.updateDeployment)
			protected.PUT("/deployments/:name/metadata", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.updateDeploymentMetadata)
			protected.DELETE("/deployments/:name", s.authMiddleware.RequirePermission(auth.PermDeploymentsDelete), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelAdmin), s.deleteDeployment)
			protected.POST("/deployments/:name/start", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.startDeployment)
			protected.POST("/deployments/:name/stop", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.stopDeployment)
			protected.POST("/deployments/:name/restart", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.restartDeployment)
			protected.POST("/deployments/:name/rebuild", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.rebuildDeployment)
			protected.POST("/deployments/:name/pull", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.pullDeploymentImage)
			protected.GET("/deployments/:name/images", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentImages)
			protected.POST("/deployments/:name/actions/:actionId", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.executeQuickAction)
			protected.GET("/deployments/:name/logs", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentLogs)
			protected.GET("/deployments/:name/compose", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentCompose)

			// Network endpoints
			protected.GET("/networks", s.authMiddleware.RequirePermission(auth.PermNetworksRead), s.listNetworks)
			protected.POST("/networks", s.authMiddleware.RequirePermission(auth.PermNetworksWrite), s.createNetwork)
			protected.DELETE("/networks/:name", s.authMiddleware.RequirePermission(auth.PermNetworksDelete), s.deleteNetwork)
			protected.POST("/networks/:name/connect", s.authMiddleware.RequirePermission(auth.PermNetworksWrite), s.connectContainer)
			protected.POST("/networks/:name/disconnect", s.authMiddleware.RequirePermission(auth.PermNetworksWrite), s.disconnectContainer)

			// Certificate endpoints
			protected.GET("/certificates", s.authMiddleware.RequirePermission(auth.PermCertificatesRead), s.listCertificates)
			protected.POST("/certificates", s.authMiddleware.RequirePermission(auth.PermCertificatesWrite), s.requestCertificate)
			protected.POST("/certificates/renew", s.authMiddleware.RequirePermission(auth.PermCertificatesWrite), s.renewCertificates)
			protected.DELETE("/certificates/:domain", s.authMiddleware.RequirePermission(auth.PermCertificatesDelete), s.deleteCertificate)

			// Proxy endpoints
			protected.GET("/proxy/status/:name", s.authMiddleware.RequirePermission(auth.PermCertificatesRead), s.getProxyStatus)
			protected.POST("/proxy/setup/:name", s.authMiddleware.RequirePermission(auth.PermCertificatesWrite), s.setupProxy)
			protected.DELETE("/proxy/:name", s.authMiddleware.RequirePermission(auth.PermCertificatesDelete), s.teardownProxy)
			protected.GET("/proxy/vhosts", s.authMiddleware.RequirePermission(auth.PermCertificatesRead), s.listVirtualHosts)
			protected.POST("/proxy/sync", s.authMiddleware.RequirePermission(auth.PermCertificatesWrite), s.syncAllProxies)
			protected.POST("/deployments/:name/ssl/disable", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.disableSSL)

			// Domain endpoints
			protected.GET("/deployments/:name/domains", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.listDomains)
			protected.POST("/deployments/:name/domains", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.addDomain)
			protected.PUT("/deployments/:name/domains/:domainId", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.updateDomain)
			protected.DELETE("/deployments/:name/domains/:domainId", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.deleteDomain)

			// Settings endpoints
			protected.GET("/settings", s.authMiddleware.RequirePermission(auth.PermSettingsRead), s.getSettings)
			protected.PUT("/settings", s.authMiddleware.RequirePermission(auth.PermSettingsWrite), s.updateSettings)
			protected.PUT("/settings/security", s.authMiddleware.RequirePermission(auth.PermSettingsWrite), s.updateSecuritySettings)

			// Compose, stats, subdomain (deployment-scoped)
			protected.GET("/subdomain/generate", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.generateSubdomain)
			protected.POST("/compose/update", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.updateCompose)
			protected.GET("/stats", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.getSystemStats)

			// Template and plugin endpoints
			protected.GET("/plugins", s.authMiddleware.RequirePermission(auth.PermTemplatesRead), s.listPlugins)
			protected.GET("/plugins/:name", s.authMiddleware.RequirePermission(auth.PermTemplatesRead), s.getPlugin)
			protected.POST("/plugins/:name/deployments", s.authMiddleware.RequirePermission(auth.PermTemplatesWrite), s.createPluginDeployment)
			protected.GET("/templates", s.authMiddleware.RequirePermission(auth.PermTemplatesRead), s.listTemplates)
			protected.GET("/templates/categories", s.authMiddleware.RequirePermission(auth.PermTemplatesRead), s.getTemplateCategories)
			protected.POST("/templates/refresh", s.authMiddleware.RequirePermission(auth.PermTemplatesWrite), s.refreshTemplates)
			protected.GET("/templates/:id/compose", s.authMiddleware.RequirePermission(auth.PermTemplatesRead), s.getTemplateCompose)
			protected.POST("/templates/:id/generate", s.authMiddleware.RequirePermission(auth.PermTemplatesWrite), s.generateTemplateCompose)

			// Container endpoints
			protected.GET("/containers", s.authMiddleware.RequirePermission(auth.PermContainersRead), s.listContainers)
			protected.POST("/containers/:id/start", s.authMiddleware.RequirePermission(auth.PermContainersWrite), s.startContainer)
			protected.POST("/containers/:id/stop", s.authMiddleware.RequirePermission(auth.PermContainersWrite), s.stopContainer)
			protected.POST("/containers/:id/restart", s.authMiddleware.RequirePermission(auth.PermContainersWrite), s.restartContainer)
			protected.DELETE("/containers/:id", s.authMiddleware.RequirePermission(auth.PermContainersDelete), s.removeContainer)
			protected.GET("/containers/:id/logs", s.authMiddleware.RequirePermission(auth.PermContainersRead), s.getContainerLogs)
			protected.GET("/containers/:id/stats", s.authMiddleware.RequirePermission(auth.PermContainersRead), s.getContainerStats)
			protected.GET("/containers/stats", s.authMiddleware.RequirePermission(auth.PermContainersRead), s.getAllContainerStats)
			protected.POST("/containers/:id/exec", s.authMiddleware.RequirePermission(auth.PermContainersWrite), s.containerExecHTTP)
			protected.GET("/deployments/:name/stats", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentContainerStats)

			// Image endpoints
			protected.GET("/images", s.authMiddleware.RequirePermission(auth.PermImagesRead), s.listImages)
			protected.DELETE("/images/:id", s.authMiddleware.RequirePermission(auth.PermImagesDelete), s.removeImage)
			protected.POST("/images/pull", s.authMiddleware.RequirePermission(auth.PermImagesWrite), s.pullImage)

			// Volume endpoints
			protected.GET("/volumes", s.authMiddleware.RequirePermission(auth.PermVolumesRead), s.listVolumes)
			protected.POST("/volumes", s.authMiddleware.RequirePermission(auth.PermVolumesWrite), s.createVolume)
			protected.DELETE("/volumes/:name", s.authMiddleware.RequirePermission(auth.PermVolumesDelete), s.removeVolume)
			protected.POST("/volumes/prune", s.authMiddleware.RequirePermission(auth.PermVolumesWrite), s.pruneVolumes)

			// Port endpoints
			protected.GET("/ports", s.authMiddleware.RequirePermission(auth.PermSystemRead), s.listPorts)
			protected.POST("/ports/:pid/kill", s.authMiddleware.RequirePermission(auth.PermSystemWrite), s.killProcess)

			// System service endpoints
			protected.GET("/system/services", s.authMiddleware.RequirePermission(auth.PermSystemRead), s.listSystemServices)
			protected.POST("/system/services/:name/start", s.authMiddleware.RequirePermission(auth.PermSystemWrite), s.startSystemService)
			protected.POST("/system/services/:name/stop", s.authMiddleware.RequirePermission(auth.PermSystemWrite), s.stopSystemService)
			protected.POST("/system/services/:name/restart", s.authMiddleware.RequirePermission(auth.PermSystemWrite), s.restartSystemService)

			// Deployment file endpoints
			protected.GET("/deployments/:name/files", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.listDeploymentFiles)
			protected.GET("/deployments/:name/files/*path", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentFile)
			protected.POST("/deployments/:name/files/*path", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.uploadDeploymentFile)
			protected.DELETE("/deployments/:name/files/*path", s.authMiddleware.RequirePermission(auth.PermDeploymentsDelete), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelAdmin), s.deleteDeploymentFile)
			protected.POST("/deployments/:name/mkdir/*path", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.createDeploymentDir)
			protected.GET("/deployments/:name/files-info", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentFilesInfo)

			// Deployment environment endpoints
			protected.GET("/deployments/:name/env", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentEnv)
			protected.PUT("/deployments/:name/env", s.authMiddleware.RequirePermission(auth.PermDeploymentsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.updateDeploymentEnv)

			// Database endpoints
			protected.POST("/databases/test", s.authMiddleware.RequirePermission(auth.PermDatabasesRead), s.testDatabaseConnection)
			protected.POST("/databases/list", s.authMiddleware.RequirePermission(auth.PermDatabasesRead), s.listDatabasesInServer)
			protected.POST("/databases/tables", s.authMiddleware.RequirePermission(auth.PermDatabasesRead), s.listDatabaseTables)
			protected.POST("/databases/tables/data", s.authMiddleware.RequirePermission(auth.PermDatabasesRead), s.queryTableData)
			protected.POST("/databases/tables/schema", s.authMiddleware.RequirePermission(auth.PermDatabasesRead), s.describeTable)
			protected.POST("/databases/query", s.authMiddleware.RequirePermission(auth.PermDatabasesWrite), s.executeDatabaseQuery)
			protected.POST("/databases/users", s.authMiddleware.RequirePermission(auth.PermDatabasesRead), s.listDatabaseUsers)
			protected.POST("/databases/users/by-database", s.authMiddleware.RequirePermission(auth.PermDatabasesRead), s.listUsersByDatabase)
			protected.POST("/databases/create", s.authMiddleware.RequirePermission(auth.PermDatabasesWrite), s.createDatabaseInServer)
			protected.POST("/databases/delete", s.authMiddleware.RequirePermission(auth.PermDatabasesWrite), s.deleteDatabaseInServer)
			protected.POST("/databases/users/create", s.authMiddleware.RequirePermission(auth.PermDatabasesWrite), s.createDatabaseUser)
			protected.POST("/databases/users/delete", s.authMiddleware.RequirePermission(auth.PermDatabasesWrite), s.deleteDatabaseUser)
			protected.POST("/databases/privileges/grant", s.authMiddleware.RequirePermission(auth.PermDatabasesWrite), s.grantDatabasePrivileges)

			// Infrastructure endpoints
			protected.GET("/infrastructure", s.authMiddleware.RequirePermission(auth.PermInfrastructureRead), s.listInfrastructure)
			protected.GET("/infrastructure/stats", s.authMiddleware.RequirePermission(auth.PermInfrastructureRead), s.getInfraStats)
			protected.GET("/infrastructure/:name", s.authMiddleware.RequirePermission(auth.PermInfrastructureRead), s.getInfraService)
			protected.POST("/infrastructure/:name/start", s.authMiddleware.RequirePermission(auth.PermInfrastructureWrite), s.startInfraService)
			protected.POST("/infrastructure/:name/stop", s.authMiddleware.RequirePermission(auth.PermInfrastructureWrite), s.stopInfraService)
			protected.POST("/infrastructure/:name/restart", s.authMiddleware.RequirePermission(auth.PermInfrastructureWrite), s.restartInfraService)
			protected.GET("/infrastructure/:name/logs", s.authMiddleware.RequirePermission(auth.PermInfrastructureRead), s.getInfraServiceLogs)
			protected.POST("/infrastructure/migrate/:name", s.authMiddleware.RequirePermission(auth.PermInfrastructureWrite), s.migrateToInfrastructure)

			// Registry endpoints
			protected.GET("/registries", s.authMiddleware.RequirePermission(auth.PermRegistriesRead), s.listRegistryTypes)
			protected.GET("/registries/:slug", s.authMiddleware.RequirePermission(auth.PermRegistriesRead), s.getRegistryType)
			protected.POST("/registries", s.authMiddleware.RequirePermission(auth.PermRegistriesWrite), s.createRegistryType)
			protected.PUT("/registries/:slug", s.authMiddleware.RequirePermission(auth.PermRegistriesWrite), s.updateRegistryType)
			protected.DELETE("/registries/:slug", s.authMiddleware.RequirePermission(auth.PermRegistriesDelete), s.deleteRegistryType)

			// Credential endpoints
			protected.GET("/credentials", s.authMiddleware.RequirePermission(auth.PermRegistriesRead), s.listCredentials)
			protected.GET("/credentials/:id", s.authMiddleware.RequirePermission(auth.PermRegistriesRead), s.getCredential)
			protected.POST("/credentials", s.authMiddleware.RequirePermission(auth.PermRegistriesWrite), s.createCredential)
			protected.PUT("/credentials/:id", s.authMiddleware.RequirePermission(auth.PermRegistriesWrite), s.updateCredential)
			protected.DELETE("/credentials/:id", s.authMiddleware.RequirePermission(auth.PermRegistriesDelete), s.deleteCredential)
			protected.POST("/credentials/:id/test", s.authMiddleware.RequirePermission(auth.PermRegistriesRead), s.testCredential)

			// Security endpoints
			protected.GET("/security/stats", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.getSecurityStats)
			protected.GET("/security/events", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.listSecurityEvents)
			protected.GET("/security/events/:id", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.getSecurityEvent)
			protected.POST("/security/cleanup", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.cleanupSecurityEvents)
			protected.GET("/security/blocked-ips", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.listBlockedIPs)
			protected.POST("/security/blocked-ips", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.blockIP)
			protected.DELETE("/security/blocked-ips/:ip", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.unblockIP)
			protected.GET("/security/ips/:ip/events", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.getEventsByIP)
			protected.GET("/security/protected-routes", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.listProtectedRoutes)
			protected.POST("/security/protected-routes", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.addProtectedRoute)
			protected.PUT("/security/protected-routes/:id", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.updateProtectedRoute)
			protected.DELETE("/security/protected-routes/:id", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.deleteProtectedRoute)
			protected.GET("/security/whitelist", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.listWhitelist)
			protected.POST("/security/whitelist", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.addWhitelistEntry)
			protected.DELETE("/security/whitelist/:id", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.removeWhitelistEntry)
			protected.GET("/security/realtime-capture", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.getRealtimeCaptureStatus)
			protected.PUT("/security/realtime-capture", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.setRealtimeCaptureStatus)
			protected.GET("/security/health", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.getSecurityHealth)
			protected.POST("/security/refresh", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.refreshSecurityScripts)
			protected.GET("/deployments/:name/security", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentSecurity)
			protected.PUT("/deployments/:name/security", s.authMiddleware.RequirePermission(auth.PermSecurityWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.updateDeploymentSecurity)
			protected.GET("/deployments/:name/security/events", s.authMiddleware.RequirePermission(auth.PermSecurityRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentSecurityEvents)

			// Traffic endpoints
			protected.GET("/traffic/logs", s.authMiddleware.RequirePermission(auth.PermTrafficRead), s.getTrafficLogs)
			protected.GET("/traffic/stats", s.authMiddleware.RequirePermission(auth.PermTrafficRead), s.getTrafficStats)
			protected.GET("/traffic/unknown-domains", s.authMiddleware.RequirePermission(auth.PermTrafficRead), s.getUnknownDomainStats)
			protected.POST("/traffic/cleanup", s.authMiddleware.RequirePermission(auth.PermTrafficWrite), s.cleanupTrafficLogs)
			protected.GET("/deployments/:name/traffic", s.authMiddleware.RequirePermission(auth.PermDeploymentsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentTrafficStats)

			// Backup endpoints
			protected.GET("/backups", s.authMiddleware.RequirePermission(auth.PermBackupsRead), s.listBackups)
			protected.GET("/backups/:id", s.authMiddleware.RequirePermission(auth.PermBackupsRead), s.getBackup)
			protected.POST("/backups", s.authMiddleware.RequirePermission(auth.PermBackupsWrite), s.createBackup)
			protected.DELETE("/backups/:id", s.authMiddleware.RequirePermission(auth.PermBackupsDelete), s.deleteBackup)
			protected.GET("/backups/:id/download", s.authMiddleware.RequirePermission(auth.PermBackupsRead), s.downloadBackup)
			protected.GET("/deployments/:name/backups", s.authMiddleware.RequirePermission(auth.PermBackupsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.listDeploymentBackups)
			protected.POST("/deployments/:name/backups", s.authMiddleware.RequirePermission(auth.PermBackupsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.createDeploymentBackup)
			protected.GET("/deployments/:name/backup-config", s.authMiddleware.RequirePermission(auth.PermBackupsRead), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelRead), s.getDeploymentBackupConfig)
			protected.PUT("/deployments/:name/backup-config", s.authMiddleware.RequirePermission(auth.PermBackupsWrite), s.authMiddleware.RequireDeploymentAccess(auth.AccessLevelWrite), s.updateDeploymentBackupConfig)
			protected.POST("/backups/:id/restore", s.authMiddleware.RequirePermission(auth.PermBackupsWrite), s.restoreBackup)
			protected.GET("/backups/jobs", s.authMiddleware.RequirePermission(auth.PermBackupsRead), s.listBackupJobs)
			protected.GET("/backups/jobs/:id", s.authMiddleware.RequirePermission(auth.PermBackupsRead), s.getBackupJob)

			// Scheduler endpoints
			protected.GET("/scheduler/tasks", s.authMiddleware.RequirePermission(auth.PermSchedulerRead), s.listScheduledTasks)
			protected.GET("/scheduler/tasks/:id", s.authMiddleware.RequirePermission(auth.PermSchedulerRead), s.getScheduledTask)
			protected.POST("/scheduler/tasks", s.authMiddleware.RequirePermission(auth.PermSchedulerWrite), s.createScheduledTask)
			protected.PUT("/scheduler/tasks/:id", s.authMiddleware.RequirePermission(auth.PermSchedulerWrite), s.updateScheduledTask)
			protected.DELETE("/scheduler/tasks/:id", s.authMiddleware.RequirePermission(auth.PermSchedulerDelete), s.deleteScheduledTask)
			protected.POST("/scheduler/tasks/:id/run", s.authMiddleware.RequirePermission(auth.PermSchedulerWrite), s.runTaskNow)
			protected.GET("/scheduler/tasks/:id/executions", s.authMiddleware.RequirePermission(auth.PermSchedulerRead), s.getTaskExecutions)
			protected.GET("/scheduler/executions", s.authMiddleware.RequirePermission(auth.PermSchedulerRead), s.getRecentExecutions)

			// Audit endpoints
			protected.GET("/audit/events", s.authMiddleware.RequirePermission(auth.PermAuditRead), s.listAuditEvents)
			protected.GET("/audit/events/:id", s.authMiddleware.RequirePermission(auth.PermAuditRead), s.getAuditEvent)
			protected.GET("/audit/stats", s.authMiddleware.RequirePermission(auth.PermAuditRead), s.getAuditStats)
			protected.POST("/audit/export", s.authMiddleware.RequirePermission(auth.PermAuditRead), s.exportAuditEvents)
			protected.DELETE("/audit/cleanup", s.authMiddleware.RequirePermission(auth.PermSettingsWrite), s.cleanupAuditEvents)

			// User management endpoints (require auth manager)
			if s.authManager != nil {
				// Current user endpoints (any authenticated user)
				protected.GET("/users/me", s.getCurrentUser)
				protected.PUT("/users/me", s.updateCurrentUser)
				protected.PUT("/users/me/password", s.updateCurrentUserPassword)

				// User management (admin only)
				usersGroup := protected.Group("/users")
				usersGroup.Use(s.authMiddleware.RequirePermission(auth.PermUsersRead))
				{
					usersGroup.GET("", s.listUsers)
					usersGroup.GET("/:id", s.getUser)
					usersGroup.POST("", s.authMiddleware.RequirePermission(auth.PermUsersWrite), s.createUser)
					usersGroup.PUT("/:id", s.authMiddleware.RequirePermission(auth.PermUsersWrite), s.updateUser)
					usersGroup.DELETE("/:id", s.authMiddleware.RequirePermission(auth.PermUsersDelete), s.deleteUser)

					// User deployment access
					usersGroup.GET("/:id/deployments", s.getUserDeployments)
					usersGroup.POST("/:id/deployments", s.authMiddleware.RequirePermission(auth.PermUsersWrite), s.assignUserDeployment)
					usersGroup.PUT("/:id/deployments/:name", s.authMiddleware.RequirePermission(auth.PermUsersWrite), s.updateUserDeployment)
					usersGroup.DELETE("/:id/deployments/:name", s.authMiddleware.RequirePermission(auth.PermUsersWrite), s.removeUserDeployment)
				}

				// API key management
				apiKeysGroup := protected.Group("/apikeys")
				apiKeysGroup.Use(s.authMiddleware.RequirePermission(auth.PermAPIKeysRead))
				{
					apiKeysGroup.GET("", s.listAPIKeys)
					apiKeysGroup.GET("/:id", s.getAPIKey)
					apiKeysGroup.POST("", s.authMiddleware.RequirePermission(auth.PermAPIKeysWrite), s.createAPIKey)
					apiKeysGroup.DELETE("/:id", s.authMiddleware.RequirePermission(auth.PermAPIKeysDelete), s.deleteAPIKey)
					apiKeysGroup.POST("/:id/revoke", s.authMiddleware.RequirePermission(auth.PermAPIKeysDelete), s.revokeAPIKey)
				}

				// Get users with access to a deployment
				protected.GET("/deployments/:name/users", s.authMiddleware.RequirePermission(auth.PermUsersRead), s.getDeploymentUsers)
			}

			// DNS plugin routes
			dnsGroup := protected.Group("/dns")
			dnsGroup.Use(s.authMiddleware.RequirePermission(auth.PermDNSRead))
			{
				dnsGroup.GET("/providers", s.listDNSProviders)

				// Register DNS plugin routes
				_ = dnsPlugins.NewCloudflarePlugin().RegisterRoutes(dnsGroup)
				_ = dnsPlugins.NewRoute53Plugin().RegisterRoutes(dnsGroup)
				_ = dnsPlugins.NewDigitalOceanPlugin().RegisterRoutes(dnsGroup)
				_ = dnsPlugins.NewHetznerPlugin().RegisterRoutes(dnsGroup)

				// PowerDNS routes
				NewPowerDNSHandlers(s.powerDNSManager).RegisterRoutes(protected)
			}
		}

		// Ingest endpoints (no auth - called by nginx Lua)
		api.POST("/security/events/ingest", s.ingestSecurityEvent)
		api.POST("/traffic/ingest", s.ingestTrafficLog)

		// Internal nginx endpoints - token-authenticated
		api.GET("/_internal/blocked-ips", s.listBlockedIPsInternal)
		api.GET("/_internal/whitelist", s.listWhitelistInternal)
	}
}

func (s *Server) Start() error {
	addr := fmt.Sprintf("%s:%d", s.config.API.Host, s.config.API.Port)

	s.server = &http.Server{
		Addr:    addr,
		Handler: s.router,
	}

	return s.server.ListenAndServe()
}

func (s *Server) Stop() error {
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()
	return s.server.Shutdown(ctx)
}

func (s *Server) healthCheck(c *gin.Context) {
	c.JSON(http.StatusOK, gin.H{
		"status":  "healthy",
		"agent":   "flatrun",
		"version": version.Get(),
	})
}

func (s *Server) listDeployments(c *gin.Context) {
	deployments, err := s.manager.ListDeployments()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	actor := auth.GetActorFromContext(c)
	if actor != nil && actor.Role != auth.RoleAdmin {
		var filtered []models.Deployment
		for _, d := range deployments {
			if actor.CanAccessDeployment(d.Name, auth.AccessLevelRead) {
				filtered = append(filtered, d)
			}
		}
		deployments = filtered
	}

	c.JSON(http.StatusOK, gin.H{
		"deployments": deployments,
		"path":        s.manager.BasePath(),
	})
}

func (s *Server) getDeployment(c *gin.Context) {
	name := c.Param("name")

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Deployment not found",
		})
		return
	}

	composeContent, composeFilename, _ := s.manager.GetComposeFile(name)
	proxyStatus := s.proxyOrchestrator.GetDeploymentProxyStatus(deployment)

	c.JSON(http.StatusOK, gin.H{
		"deployment":       deployment,
		"compose_content":  composeContent,
		"compose_filename": composeFilename,
		"proxy_status":     proxyStatus,
	})
}

type DatabaseConfigRequest struct {
	Alias             string `json:"alias"`
	Type              string `json:"type"`
	Mode              string `json:"mode"`
	Service           string `json:"service,omitempty"`
	ExistingContainer string `json:"existing_container,omitempty"`
	ExternalHost      string `json:"external_host,omitempty"`
	ExternalPort      int    `json:"external_port,omitempty"`
	DatabaseName      string `json:"database_name,omitempty"`
	Username          string `json:"username,omitempty"`
	Password          string `json:"password,omitempty"`
	EnvPrefix         string `json:"env_prefix,omitempty"`
}

func (d *DatabaseConfigRequest) Validate() error {
	validTypes := map[string]bool{
		"mysql": true, "postgres": true, "mariadb": true,
		"mongodb": true, "redis": true,
	}
	if !validTypes[d.Type] {
		return fmt.Errorf("invalid database type: %s (must be mysql, postgres, mariadb, mongodb, or redis)", d.Type)
	}

	validModes := map[string]bool{
		"shared": true, "create": true, "existing": true, "external": true,
	}
	if !validModes[d.Mode] {
		return fmt.Errorf("invalid database mode: %s (must be shared, create, existing, or external)", d.Mode)
	}

	switch d.Mode {
	case "existing":
		if d.ExistingContainer == "" {
			return fmt.Errorf("existing_container is required for mode 'existing'")
		}
	case "external":
		if d.ExternalHost == "" {
			return fmt.Errorf("external_host is required for mode 'external'")
		}
		if d.ExternalPort <= 0 {
			return fmt.Errorf("external_port must be a positive integer for mode 'external'")
		}
	}

	return nil
}

func (s *Server) createDeployment(c *gin.Context) {
	var req struct {
		Name                      string                  `json:"name" binding:"required"`
		ComposeContent            string                  `json:"compose_content"`
		TemplateID                string                  `json:"template_id,omitempty"`
		Metadata                  *models.ServiceMetadata `json:"metadata,omitempty"`
		EnvVars                   []EnvVar                `json:"env_vars,omitempty"`
		AutoStart                 bool                    `json:"auto_start"`
		UseSharedDatabase         bool                    `json:"use_shared_database"`
		ExistingDatabaseContainer string                  `json:"existing_database_container,omitempty"`
		Databases                 []DatabaseConfigRequest `json:"databases,omitempty"`
		RegistryCredential        *struct {
			CredentialID   string `json:"credential_id,omitempty"`
			Username       string `json:"username,omitempty"`
			Password       string `json:"password,omitempty"`
			SaveCredential bool   `json:"save_credential,omitempty"`
			CredentialName string `json:"credential_name,omitempty"`
		} `json:"registry_credential,omitempty"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if req.ComposeContent == "" {
		generated, err := s.generateComposeContent(req.Name, req.TemplateID)
		if err != nil {
			c.JSON(http.StatusBadRequest, gin.H{
				"error": "compose_content is required when template cannot be resolved: " + err.Error(),
			})
			return
		}
		req.ComposeContent = generated
	}

	if err := s.validateComposeContent(req.ComposeContent, req.Name); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": "Invalid compose content: " + err.Error(),
		})
		return
	}

	// Ensure container name is set for proxy DNS resolution
	if content, err := docker.EnsureContainerName(req.ComposeContent, req.Name); err == nil {
		req.ComposeContent = content
	}

	// Add proxy network if expose is enabled
	proxyNetworkName := s.config.Infrastructure.DefaultProxyNetwork
	if req.Metadata != nil && req.Metadata.Networking.Expose && proxyNetworkName != "" {
		if err := s.networksManager.EnsureNetwork(proxyNetworkName); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": "Failed to ensure proxy network exists: " + err.Error(),
			})
			return
		}
		req.ComposeContent = s.addProxyNetwork(req.ComposeContent)
		if err := s.networksManager.EnsureContainerOnNetwork(proxyNetworkName, s.config.Nginx.ContainerName); err != nil {
			log.Printf("Warning: failed to ensure nginx on network %s: %v", proxyNetworkName, err)
		}
	}

	// Add shared database network if using shared database
	if req.UseSharedDatabase && s.config.Infrastructure.Database.Enabled {
		dbNetworkName := s.config.Infrastructure.DefaultDatabaseNetwork
		if dbNetworkName == "" {
			dbNetworkName = "database"
		}
		if err := s.networksManager.EnsureNetwork(dbNetworkName); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": "Failed to ensure database network exists: " + err.Error(),
			})
			return
		}
		req.ComposeContent = s.addDatabaseNetwork(req.ComposeContent)
	}

	// Add existing database container's network
	if req.ExistingDatabaseContainer != "" {
		req.ComposeContent = s.addContainerNetwork(req.ComposeContent, req.ExistingDatabaseContainer)
	}

	if err := s.manager.CreateDeployment(req.Name, req.ComposeContent); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	if s.authManager != nil {
		actor := auth.GetActorFromContext(c)
		if actor != nil && actor.User != nil && actor.Role != auth.RoleAdmin {
			_ = s.authManager.AssignDeployment(actor.User.ID, req.Name, auth.AccessLevelAdmin, actor.User.ID)
		}
	}

	var dbEnvVars []EnvVar
	var databaseConfigs []models.DatabaseConfig

	if len(req.Databases) > 0 {
		for i, dbReq := range req.Databases {
			if err := dbReq.Validate(); err != nil {
				c.JSON(http.StatusBadRequest, gin.H{
					"error": fmt.Sprintf("invalid database configuration at index %d: %s", i, err.Error()),
				})
				return
			}
		}

		envVars, configs, err := s.createDatabasesForDeployment(req.Name, req.Databases)
		if err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": "Deployment created but failed to create databases: " + err.Error(),
			})
			return
		}
		dbEnvVars = envVars
		databaseConfigs = configs
	} else if req.UseSharedDatabase && s.config.Infrastructure.Database.Enabled {
		dbResult, err := s.createDatabaseForDeployment(req.Name)
		if err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": "Deployment created but failed to create database: " + err.Error(),
			})
			return
		}
		dbEnvVars = dbResult
		databaseConfigs = []models.DatabaseConfig{{
			ID:       "primary",
			Alias:    "primary",
			Type:     s.config.Infrastructure.Database.Type,
			Mode:     "shared",
			IsShared: true,
		}}
	}

	allEnvVars := append(req.EnvVars, dbEnvVars...)
	if len(allEnvVars) > 0 {
		if err := s.writeEnvFile(req.Name, allEnvVars); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": "Deployment created but failed to write .env file: " + err.Error(),
			})
			return
		}
	}

	if req.TemplateID != "" {
		s.processTemplateFiles(req.Name, req.TemplateID, allEnvVars)
		s.applyTemplateMountOwnership(req.Name, req.TemplateID)
	}

	if req.Metadata != nil {
		if len(databaseConfigs) > 0 {
			req.Metadata.Databases = databaseConfigs
		}
		if err := s.manager.SaveMetadata(req.Name, req.Metadata); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": "Deployment created but failed to save metadata: " + err.Error(),
			})
			return
		}
	}

	var registryLoginError string
	var credentialID string
	if req.RegistryCredential != nil {
		var username, password string

		if req.RegistryCredential.CredentialID != "" {
			credentialID = req.RegistryCredential.CredentialID
			cred, err := s.credentialsManager.GetCredential(req.RegistryCredential.CredentialID)
			if err != nil {
				registryLoginError = "Failed to load credential: " + err.Error()
				log.Printf("Warning: failed to load credential %s: %v", req.RegistryCredential.CredentialID, err)
			} else {
				username = cred.Username
				password = cred.Password
			}
		} else if req.RegistryCredential.Username != "" && req.RegistryCredential.Password != "" {
			username = req.RegistryCredential.Username
			password = req.RegistryCredential.Password

			if req.RegistryCredential.SaveCredential && req.RegistryCredential.CredentialName != "" {
				newCred, err := s.credentialsManager.CreateCredential(
					req.RegistryCredential.CredentialName,
					"docker-hub",
					username,
					password,
					"",
					true,
				)
				if err != nil {
					log.Printf("Warning: failed to save credential: %v", err)
				} else {
					credentialID = newCred.ID
				}
			}
		}

		if username != "" && password != "" && registryLoginError == "" {
			if err := credentials.DockerLogin("", username, password); err != nil {
				registryLoginError = err.Error()
				log.Printf("Warning: registry login failed: %v", err)
			}
		}
	}

	if credentialID != "" && req.Metadata != nil {
		req.Metadata.CredentialID = credentialID
		if err := s.manager.SaveMetadata(req.Name, req.Metadata); err != nil {
			log.Printf("Warning: failed to update metadata with credential ID: %v", err)
		}
	}

	var startOutput string
	var startError string
	if req.AutoStart {
		output, err := s.manager.StartDeployment(req.Name)
		startOutput = output
		if err != nil {
			startError = err.Error()
		}
	}

	var proxyResult *proxy.SetupResult
	if req.Metadata != nil {
		log.Printf("Deployment %s: metadata.networking.expose=%v, domain=%s",
			req.Name, req.Metadata.Networking.Expose, req.Metadata.Networking.Domain)
	} else {
		log.Printf("Deployment %s: no metadata provided", req.Name)
	}

	if req.Metadata != nil && req.Metadata.Networking.Expose {
		deployment, err := s.manager.GetDeployment(req.Name)
		if err != nil {
			log.Printf("Warning: failed to get deployment for proxy setup: %v", err)
		} else {
			log.Printf("Setting up proxy for deployment %s with domain %s",
				deployment.Name, deployment.Metadata.Networking.Domain)
			proxyResult, err = s.setupProxyWithRetry(deployment, 3)
			if err != nil {
				log.Printf("Warning: failed to setup proxy for deployment after retries: %v", err)
			} else {
				log.Printf("Proxy setup result for %s: success=%v, virtual_host_created=%v, cert_requested=%v",
					deployment.Name, proxyResult.Success, proxyResult.VirtualHostCreated, proxyResult.CertificateRequested)
			}
		}
	}

	c.JSON(http.StatusCreated, gin.H{
		"message":              "Deployment created",
		"name":                 req.Name,
		"proxy_result":         proxyResult,
		"auto_started":         req.AutoStart,
		"start_output":         startOutput,
		"start_error":          startError,
		"registry_login_error": registryLoginError,
	})
}

type EnvVar struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

func (s *Server) createDatabaseForDeployment(deploymentName string) ([]EnvVar, error) {
	dbConfig := s.config.Infrastructure.Database
	dbName := strings.ReplaceAll(deploymentName, "-", "_") + "_db"
	dbUser := strings.ReplaceAll(deploymentName, "-", "_") + "_user"
	dbPassword := generateRandomPassword(16)

	connConfig := &database.ConnectionConfig{
		Type:      dbConfig.Type,
		Host:      dbConfig.Host,
		Port:      dbConfig.Port,
		Username:  dbConfig.RootUser,
		Password:  dbConfig.RootPassword,
		Container: dbConfig.Container,
	}

	if err := s.databaseManager.CreateDatabase(connConfig, dbName); err != nil {
		return nil, fmt.Errorf("failed to create database: %w", err)
	}

	if err := s.databaseManager.CreateUser(connConfig, dbUser, dbPassword, "%"); err != nil {
		return nil, fmt.Errorf("failed to create user: %w", err)
	}

	if err := s.databaseManager.GrantPrivileges(connConfig, dbUser, dbName, "%"); err != nil {
		return nil, fmt.Errorf("failed to grant privileges: %w", err)
	}

	dbHost := dbConfig.Host
	if dbHost == "" {
		dbHost = dbConfig.Container
	}

	envVars := []EnvVar{
		{Key: "DB_HOST", Value: dbHost},
		{Key: "DB_PORT", Value: fmt.Sprintf("%d", dbConfig.Port)},
		{Key: "DB_DATABASE", Value: dbName},
		{Key: "DB_USERNAME", Value: dbUser},
		{Key: "DB_PASSWORD", Value: dbPassword},
	}

	var databaseURL string
	switch dbConfig.Type {
	case "mysql", "mariadb":
		databaseURL = fmt.Sprintf("mysql://%s:%s@%s:%d/%s", dbUser, dbPassword, dbHost, dbConfig.Port, dbName)
	case "postgres":
		databaseURL = fmt.Sprintf("postgres://%s:%s@%s:%d/%s", dbUser, dbPassword, dbHost, dbConfig.Port, dbName)
	}
	envVars = append(envVars, EnvVar{Key: "DATABASE_URL", Value: databaseURL})

	return envVars, nil
}

func (s *Server) createDatabasesForDeployment(deploymentName string, databases []DatabaseConfigRequest) ([]EnvVar, []models.DatabaseConfig, error) {
	var allEnvVars []EnvVar
	var configs []models.DatabaseConfig
	isFirst := true

	for i, dbReq := range databases {
		alias := dbReq.Alias
		if alias == "" {
			if isFirst {
				alias = "primary"
			} else {
				alias = fmt.Sprintf("db%d", i+1)
			}
		}

		envPrefix := dbReq.EnvPrefix
		if envPrefix == "" {
			envPrefix = strings.ToUpper(alias)
		}

		config := models.DatabaseConfig{
			ID:        fmt.Sprintf("%s-%s", deploymentName, alias),
			Alias:     alias,
			Type:      dbReq.Type,
			Mode:      dbReq.Mode,
			Service:   dbReq.Service,
			EnvPrefix: envPrefix,
		}

		var envVars []EnvVar

		switch dbReq.Mode {
		case "shared":
			if !s.config.Infrastructure.Database.Enabled {
				continue
			}
			dbConfig := s.config.Infrastructure.Database
			dbName := strings.ReplaceAll(deploymentName, "-", "_") + "_" + alias + "_db"
			dbUser := strings.ReplaceAll(deploymentName, "-", "_") + "_" + alias + "_user"
			dbPassword := generateRandomPassword(16)

			connConfig := &database.ConnectionConfig{
				Type:      dbConfig.Type,
				Host:      dbConfig.Host,
				Port:      dbConfig.Port,
				Username:  dbConfig.RootUser,
				Password:  dbConfig.RootPassword,
				Container: dbConfig.Container,
			}

			if err := s.databaseManager.CreateDatabase(connConfig, dbName); err != nil {
				return nil, nil, fmt.Errorf("failed to create database %s: %w", alias, err)
			}

			if err := s.databaseManager.CreateUser(connConfig, dbUser, dbPassword, "%"); err != nil {
				return nil, nil, fmt.Errorf("failed to create user for %s: %w", alias, err)
			}

			if err := s.databaseManager.GrantPrivileges(connConfig, dbUser, dbName, "%"); err != nil {
				return nil, nil, fmt.Errorf("failed to grant privileges for %s: %w", alias, err)
			}

			dbHost := dbConfig.Host
			if dbHost == "" {
				dbHost = dbConfig.Container
			}

			config.Host = dbHost
			config.Port = dbConfig.Port
			config.Container = dbConfig.Container
			config.DatabaseName = dbName
			config.Username = dbUser
			config.IsShared = true

			envVars = s.generateDatabaseEnvVars(envPrefix, dbHost, dbConfig.Port, dbName, dbUser, dbPassword, dbConfig.Type, isFirst)

		case "existing":
			config.Container = dbReq.ExistingContainer
			config.Host = dbReq.ExistingContainer
			if dbReq.DatabaseName != "" {
				config.DatabaseName = dbReq.DatabaseName
			}
			if dbReq.Username != "" {
				config.Username = dbReq.Username
			}

		case "external":
			config.Host = dbReq.ExternalHost
			config.Port = dbReq.ExternalPort
			if dbReq.DatabaseName != "" {
				config.DatabaseName = dbReq.DatabaseName
			}
			if dbReq.Username != "" {
				config.Username = dbReq.Username
			}
			if dbReq.Password != "" {
				envVars = s.generateDatabaseEnvVars(envPrefix, dbReq.ExternalHost, dbReq.ExternalPort, dbReq.DatabaseName, dbReq.Username, dbReq.Password, dbReq.Type, isFirst)
			}
		}

		allEnvVars = append(allEnvVars, envVars...)
		configs = append(configs, config)
		isFirst = false
	}

	return allEnvVars, configs, nil
}

func (s *Server) generateDatabaseEnvVars(prefix string, host string, port int, dbName, username, password, dbType string, includeLegacy bool) []EnvVar {
	var envVars []EnvVar

	envVars = append(envVars,
		EnvVar{Key: prefix + "_HOST", Value: host},
		EnvVar{Key: prefix + "_PORT", Value: fmt.Sprintf("%d", port)},
		EnvVar{Key: prefix + "_DATABASE", Value: dbName},
		EnvVar{Key: prefix + "_USERNAME", Value: username},
		EnvVar{Key: prefix + "_PASSWORD", Value: password},
	)

	var databaseURL string
	switch dbType {
	case "mysql", "mariadb":
		databaseURL = fmt.Sprintf("mysql://%s:%s@%s:%d/%s", username, password, host, port, dbName)
	case "postgres":
		databaseURL = fmt.Sprintf("postgres://%s:%s@%s:%d/%s", username, password, host, port, dbName)
	case "mongodb":
		databaseURL = fmt.Sprintf("mongodb://%s:%s@%s:%d/%s", username, password, host, port, dbName)
	case "redis":
		if password != "" {
			databaseURL = fmt.Sprintf("redis://:%s@%s:%d", password, host, port)
		} else {
			databaseURL = fmt.Sprintf("redis://%s:%d", host, port)
		}
	}
	if databaseURL != "" {
		envVars = append(envVars, EnvVar{Key: prefix + "_URL", Value: databaseURL})
	}

	if includeLegacy {
		envVars = append(envVars,
			EnvVar{Key: "DB_HOST", Value: host},
			EnvVar{Key: "DB_PORT", Value: fmt.Sprintf("%d", port)},
			EnvVar{Key: "DB_DATABASE", Value: dbName},
			EnvVar{Key: "DB_USERNAME", Value: username},
			EnvVar{Key: "DB_PASSWORD", Value: password},
		)
		if databaseURL != "" {
			envVars = append(envVars, EnvVar{Key: "DATABASE_URL", Value: databaseURL})
		}
	}

	return envVars
}

func (s *Server) writeEnvFile(deploymentName string, envVars []EnvVar) error {
	deploymentPath := filepath.Join(s.config.DeploymentsPath, deploymentName)
	envFilePath := filepath.Join(deploymentPath, ".env.flatrun")

	var content strings.Builder
	for _, env := range envVars {
		if env.Key != "" {
			content.WriteString(fmt.Sprintf("%s=%s\n", env.Key, env.Value))
		}
	}

	return os.WriteFile(envFilePath, []byte(content.String()), 0600)
}

func (s *Server) deleteDatabaseForDeployment(deploymentName string) error {
	dbConfig := s.config.Infrastructure.Database
	dbName := strings.ReplaceAll(deploymentName, "-", "_") + "_db"
	dbUser := strings.ReplaceAll(deploymentName, "-", "_") + "_user"

	connConfig := &database.ConnectionConfig{
		Type:      dbConfig.Type,
		Host:      dbConfig.Host,
		Port:      dbConfig.Port,
		Username:  dbConfig.RootUser,
		Password:  dbConfig.RootPassword,
		Container: dbConfig.Container,
	}

	if err := s.databaseManager.RevokePrivileges(connConfig, dbUser, dbName); err != nil {
		log.Printf("Warning: failed to revoke privileges for %s: %v", dbUser, err)
	}

	if err := s.databaseManager.DropUser(connConfig, dbUser); err != nil {
		log.Printf("Warning: failed to drop user %s: %v", dbUser, err)
	}

	if err := s.databaseManager.DropDatabase(connConfig, dbName); err != nil {
		return fmt.Errorf("failed to drop database: %w", err)
	}

	return nil
}

func (s *Server) deleteDatabaseByAlias(deploymentName, alias string) error {
	dbConfig := s.config.Infrastructure.Database
	dbName := strings.ReplaceAll(deploymentName, "-", "_") + "_" + alias + "_db"
	dbUser := strings.ReplaceAll(deploymentName, "-", "_") + "_" + alias + "_user"

	connConfig := &database.ConnectionConfig{
		Type:      dbConfig.Type,
		Host:      dbConfig.Host,
		Port:      dbConfig.Port,
		Username:  dbConfig.RootUser,
		Password:  dbConfig.RootPassword,
		Container: dbConfig.Container,
	}

	if err := s.databaseManager.RevokePrivileges(connConfig, dbUser, dbName); err != nil {
		log.Printf("Warning: failed to revoke privileges for %s: %v", dbUser, err)
	}

	if err := s.databaseManager.DropUser(connConfig, dbUser); err != nil {
		log.Printf("Warning: failed to drop user %s: %v", dbUser, err)
	}

	if err := s.databaseManager.DropDatabase(connConfig, dbName); err != nil {
		return fmt.Errorf("failed to drop database %s: %w", alias, err)
	}

	return nil
}

func (s *Server) getDeploymentEnv(c *gin.Context) {
	name := c.Param("name")
	deploymentPath := filepath.Join(s.config.DeploymentsPath, name)
	envFilePath := filepath.Join(deploymentPath, ".env.flatrun")

	content, err := os.ReadFile(envFilePath)
	if err != nil {
		if os.IsNotExist(err) {
			c.JSON(http.StatusOK, gin.H{"env_vars": []EnvVar{}})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
		return
	}

	envVars := parseEnvContent(string(content))
	c.JSON(http.StatusOK, gin.H{"env_vars": envVars})
}

func (s *Server) updateDeploymentEnv(c *gin.Context) {
	name := c.Param("name")

	var req struct {
		EnvVars []EnvVar `json:"env_vars"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	if err := s.writeEnvFile(name, req.EnvVars); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
		return
	}

	c.JSON(http.StatusOK, gin.H{"message": "Environment variables updated"})
}

func parseEnvContent(content string) []EnvVar {
	var envVars []EnvVar
	lines := strings.Split(content, "\n")
	for _, line := range lines {
		line = strings.TrimSpace(line)
		if line == "" || strings.HasPrefix(line, "#") {
			continue
		}
		eqIndex := strings.Index(line, "=")
		if eqIndex == -1 {
			continue
		}
		key := strings.TrimSpace(line[:eqIndex])
		value := strings.TrimSpace(line[eqIndex+1:])
		if key != "" {
			envVars = append(envVars, EnvVar{Key: key, Value: value})
		}
	}
	return envVars
}

func generateRandomPassword(length int) string {
	const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
	b := make([]byte, length)
	if _, err := cryptoRand.Read(b); err != nil {
		return ""
	}
	for i := range b {
		b[i] = charset[int(b[i])%len(charset)]
	}
	return string(b)
}

func (s *Server) updateDeployment(c *gin.Context) {
	name := c.Param("name")

	var req struct {
		ComposeContent string `json:"compose_content" binding:"required"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.manager.UpdateDeployment(name, req.ComposeContent); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Deployment updated",
		"name":    name,
	})
}

func (s *Server) updateDeploymentMetadata(c *gin.Context) {
	name := c.Param("name")

	bodyBytes, err := c.GetRawData()
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": "Failed to read request body",
		})
		return
	}

	var sentFields map[string]json.RawMessage
	if err := json.Unmarshal(bodyBytes, &sentFields); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	var incoming models.ServiceMetadata
	if err := json.Unmarshal(bodyBytes, &incoming); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Deployment not found",
		})
		return
	}

	metadata := mergeMetadata(deployment.Metadata, &incoming, sentFields)

	if err := s.manager.SaveMetadata(name, metadata); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	deployment.Metadata = metadata

	var proxyResult *proxy.SetupResult
	if metadata.Networking.Expose {
		proxyResult, _ = s.proxyOrchestrator.SetupDeployment(deployment)
	} else {
		_ = s.proxyOrchestrator.TeardownDeployment(name)
	}

	c.JSON(http.StatusOK, gin.H{
		"message":      "Metadata updated",
		"name":         name,
		"proxy_result": proxyResult,
	})
}

func mergeMetadata(existing, incoming *models.ServiceMetadata, sentFields map[string]json.RawMessage) *models.ServiceMetadata {
	if existing == nil {
		return incoming
	}
	if incoming == nil {
		return existing
	}

	merged := *existing

	if _, ok := sentFields["name"]; ok {
		merged.Name = incoming.Name
	}
	if _, ok := sentFields["type"]; ok {
		merged.Type = incoming.Type
	}
	if _, ok := sentFields["credential_id"]; ok {
		merged.CredentialID = incoming.CredentialID
	}
	if _, ok := sentFields["networking"]; ok {
		merged.Networking = incoming.Networking
	}
	if _, ok := sentFields["ssl"]; ok {
		merged.SSL = incoming.SSL
	}
	if _, ok := sentFields["healthcheck"]; ok {
		merged.HealthCheck = incoming.HealthCheck
	}
	if _, ok := sentFields["quick_actions"]; ok {
		merged.QuickActions = incoming.QuickActions
	}
	if _, ok := sentFields["security"]; ok {
		merged.Security = incoming.Security
	}
	if _, ok := sentFields["backup"]; ok {
		merged.Backup = incoming.Backup
	}

	return &merged
}

func (s *Server) deleteDeployment(c *gin.Context) {
	name := c.Param("name")

	deleteSSL := c.DefaultQuery("delete_ssl", "true") == "true"
	deleteDatabase := c.DefaultQuery("delete_database", "false") == "true"
	deleteVhost := c.DefaultQuery("delete_vhost", "true") == "true"

	deployment, _ := s.manager.GetDeployment(name)

	var deletedItems []string

	if deleteVhost {
		if err := s.proxyOrchestrator.TeardownDeployment(name); err != nil {
			log.Printf("Warning: failed to teardown proxy for %s: %v", name, err)
		} else {
			deletedItems = append(deletedItems, "virtual_host")
		}
	}

	if deployment != nil && deployment.Metadata != nil && deleteSSL {
		domainsToDelete := deployment.Metadata.GetUniqueDomainNames()
		if len(domainsToDelete) == 0 && deployment.Metadata.Networking.Domain != "" {
			domainsToDelete = []string{deployment.Metadata.Networking.Domain}
		}

		for _, domain := range domainsToDelete {
			if err := s.proxyOrchestrator.SSLManager().DeleteCertificate(domain); err != nil {
				log.Printf("Warning: failed to delete SSL certificate for %s: %v", domain, err)
			} else {
				deletedItems = append(deletedItems, fmt.Sprintf("ssl_certificate:%s", domain))
			}
		}
	}

	if deleteDatabase && s.config.Infrastructure.Database.Enabled {
		if deployment != nil && deployment.Metadata != nil && len(deployment.Metadata.Databases) > 0 {
			for _, dbConfig := range deployment.Metadata.Databases {
				if dbConfig.IsShared {
					if err := s.deleteDatabaseByAlias(name, dbConfig.Alias); err != nil {
						log.Printf("Warning: failed to delete database %s for %s: %v", dbConfig.Alias, name, err)
					} else {
						deletedItems = append(deletedItems, fmt.Sprintf("database:%s", dbConfig.Alias))
					}
				}
			}
		} else {
			if err := s.deleteDatabaseForDeployment(name); err != nil {
				log.Printf("Warning: failed to delete database for %s: %v", name, err)
			} else {
				deletedItems = append(deletedItems, "database")
			}
		}
	}

	if err := s.manager.DeleteDeployment(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":       "Deployment deleted",
		"name":          name,
		"deleted_items": deletedItems,
	})
}

func (s *Server) startDeployment(c *gin.Context) {
	name := c.Param("name")

	output, err := s.manager.StartDeployment(name)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error":  err.Error(),
			"output": output,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Deployment started",
		"name":    name,
		"output":  output,
	})
}

func (s *Server) stopDeployment(c *gin.Context) {
	name := c.Param("name")

	output, err := s.manager.StopDeployment(name)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error":  err.Error(),
			"output": output,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Deployment stopped",
		"name":    name,
		"output":  output,
	})
}

func (s *Server) restartDeployment(c *gin.Context) {
	name := c.Param("name")

	output, err := s.manager.RestartDeployment(name)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error":  err.Error(),
			"output": output,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Deployment restarted",
		"name":    name,
		"output":  output,
	})
}

func (s *Server) rebuildDeployment(c *gin.Context) {
	name := c.Param("name")

	output, err := s.manager.RebuildDeployment(name)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error":  err.Error(),
			"output": output,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Deployment rebuilt",
		"name":    name,
		"output":  output,
	})
}

func (s *Server) pullDeploymentImage(c *gin.Context) {
	name := c.Param("name")

	var req struct {
		OnlyLatest bool `json:"only_latest"`
	}
	_ = c.ShouldBindJSON(&req)

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Deployment not found: " + err.Error(),
		})
		return
	}

	if deployment.Metadata != nil && deployment.Metadata.CredentialID != "" {
		cred, err := s.credentialsManager.GetCredential(deployment.Metadata.CredentialID)
		if err != nil {
			log.Printf("Warning: failed to load credential %s for pull: %v", deployment.Metadata.CredentialID, err)
		} else {
			if err := credentials.DockerLogin("", cred.Username, cred.Password); err != nil {
				log.Printf("Warning: registry login failed for pull: %v", err)
			}
		}
	}

	output, err := s.manager.PullDeployment(name, req.OnlyLatest)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error":  err.Error(),
			"output": output,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Images pulled successfully",
		"name":    name,
		"output":  output,
	})
}

func (s *Server) getDeploymentImages(c *gin.Context) {
	name := c.Param("name")

	images, err := s.manager.GetDeploymentImages(name)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"images": images,
	})
}

func (s *Server) executeQuickAction(c *gin.Context) {
	name := c.Param("name")
	actionID := c.Param("actionId")

	output, err := s.manager.ExecuteQuickAction(name, actionID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error":  err.Error(),
			"output": output,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":   "Action executed successfully",
		"action_id": actionID,
		"output":    output,
	})
}

func (s *Server) getDeploymentLogs(c *gin.Context) {
	name := c.Param("name")

	tailStr := c.DefaultQuery("tail", "100")
	tail, err := strconv.Atoi(tailStr)
	if err != nil {
		tail = 100
	}

	logs, err := s.manager.GetDeploymentLogs(name, tail)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"name": name,
		"logs": logs,
	})
}

func (s *Server) getDeploymentCompose(c *gin.Context) {
	name := c.Param("name")

	content, filename, err := s.manager.GetComposeFile(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"name":     name,
		"content":  content,
		"filename": filename,
	})
}

func (s *Server) listNetworks(c *gin.Context) {
	networks, err := s.networksManager.ListNetworks()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"networks": networks,
	})
}

func (s *Server) createNetwork(c *gin.Context) {
	var req struct {
		Name   string            `json:"name" binding:"required"`
		Driver string            `json:"driver"`
		Labels map[string]string `json:"labels"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if req.Driver == "" {
		req.Driver = "bridge"
	}

	if err := s.networksManager.CreateNetwork(req.Name, req.Driver, req.Labels); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusCreated, gin.H{
		"message": "Network created",
		"name":    req.Name,
	})
}

func (s *Server) deleteNetwork(c *gin.Context) {
	name := c.Param("name")

	if err := s.networksManager.DeleteNetwork(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Network deleted",
		"name":    name,
	})
}

func (s *Server) connectContainer(c *gin.Context) {
	networkName := c.Param("name")

	var req struct {
		Container string `json:"container" binding:"required"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.networksManager.ConnectContainer(networkName, req.Container); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":   "Container connected",
		"network":   networkName,
		"container": req.Container,
	})
}

func (s *Server) disconnectContainer(c *gin.Context) {
	networkName := c.Param("name")

	var req struct {
		Container string `json:"container" binding:"required"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.networksManager.DisconnectContainer(networkName, req.Container); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":   "Container disconnected",
		"network":   networkName,
		"container": req.Container,
	})
}

func (s *Server) getSettings(c *gin.Context) {
	c.JSON(http.StatusOK, gin.H{
		"settings": gin.H{
			"deployments_path": s.config.DeploymentsPath,
			"api_port":         s.config.API.Port,
			"enable_cors":      s.config.API.EnableCORS,
			"allowed_origins":  s.config.API.AllowedOrigins,
			"domain": gin.H{
				"default_domain":  s.config.Domain.DefaultDomain,
				"auto_subdomain":  s.config.Domain.AutoSubdomain,
				"auto_ssl":        s.config.Domain.AutoSSL,
				"subdomain_style": s.config.Domain.SubdomainStyle,
			},
			"nginx": gin.H{
				"enabled":                s.config.Nginx.Enabled,
				"image":                  s.config.Nginx.Image,
				"container_name":         s.config.Nginx.ContainerName,
				"config_path":            s.config.Nginx.ConfigPath,
				"reload_command":         s.config.Nginx.ReloadCommand,
				"external":               s.config.Nginx.External,
				"reject_unknown_domains": s.config.Nginx.RejectUnknownDomains,
			},
			"certbot": gin.H{
				"enabled":      s.config.Certbot.Enabled,
				"image":        s.config.Certbot.Image,
				"email":        s.config.Certbot.Email,
				"staging":      s.config.Certbot.Staging,
				"certs_path":   s.config.Certbot.CertsPath,
				"webroot_path": s.config.Certbot.WebrootPath,
				"dns_provider": s.config.Certbot.DNSProvider,
			},
			"infrastructure": gin.H{
				"default_proxy_network":    s.config.Infrastructure.DefaultProxyNetwork,
				"default_database_network": s.config.Infrastructure.DefaultDatabaseNetwork,
				"database": gin.H{
					"enabled":   s.config.Infrastructure.Database.Enabled,
					"type":      s.config.Infrastructure.Database.Type,
					"container": s.config.Infrastructure.Database.Container,
					"host":      s.config.Infrastructure.Database.Host,
					"port":      s.config.Infrastructure.Database.Port,
				},
				"redis": gin.H{
					"enabled":   s.config.Infrastructure.Redis.Enabled,
					"container": s.config.Infrastructure.Redis.Container,
					"host":      s.config.Infrastructure.Redis.Host,
					"port":      s.config.Infrastructure.Redis.Port,
				},
			},
			"security": gin.H{
				"enabled":              s.config.Security.Enabled,
				"realtime_capture":     s.config.Security.RealtimeCapture,
				"scan_interval":        s.config.Security.ScanInterval.String(),
				"retention_days":       s.config.Security.RetentionDays,
				"rate_threshold":       s.config.Security.RateThreshold,
				"auto_block_enabled":   s.config.Security.AutoBlockEnabled,
				"auto_block_threshold": s.config.Security.AutoBlockThreshold,
				"auto_block_duration":  s.config.Security.AutoBlockDuration.String(),
			},
		},
	})
}

func (s *Server) updateSettings(c *gin.Context) {
	var req struct {
		Domain *struct {
			DefaultDomain  string `json:"default_domain"`
			AutoSubdomain  bool   `json:"auto_subdomain"`
			AutoSSL        bool   `json:"auto_ssl"`
			SubdomainStyle string `json:"subdomain_style"`
		} `json:"domain,omitempty"`
		Nginx *struct {
			Enabled              bool   `json:"enabled"`
			Image                string `json:"image"`
			ContainerName        string `json:"container_name"`
			ConfigPath           string `json:"config_path"`
			ReloadCommand        string `json:"reload_command"`
			External             bool   `json:"external"`
			RejectUnknownDomains *bool  `json:"reject_unknown_domains"`
		} `json:"nginx,omitempty"`
		Certbot *struct {
			Enabled     bool   `json:"enabled"`
			Image       string `json:"image"`
			Email       string `json:"email"`
			Staging     bool   `json:"staging"`
			CertsPath   string `json:"certs_path"`
			WebrootPath string `json:"webroot_path"`
			DNSProvider string `json:"dns_provider"`
		} `json:"certbot,omitempty"`
		Infrastructure *struct {
			DefaultProxyNetwork    string `json:"default_proxy_network"`
			DefaultDatabaseNetwork string `json:"default_database_network"`
			Database               *struct {
				Enabled      bool   `json:"enabled"`
				Type         string `json:"type"`
				Container    string `json:"container"`
				Host         string `json:"host"`
				Port         int    `json:"port"`
				RootUser     string `json:"root_user"`
				RootPassword string `json:"root_password"`
			} `json:"database,omitempty"`
			Redis *struct {
				Enabled   bool   `json:"enabled"`
				Container string `json:"container"`
				Host      string `json:"host"`
				Port      int    `json:"port"`
				Password  string `json:"password"`
			} `json:"redis,omitempty"`
		} `json:"infrastructure,omitempty"`
		Security *struct {
			Enabled            bool   `json:"enabled"`
			RealtimeCapture    bool   `json:"realtime_capture"`
			ScanInterval       string `json:"scan_interval"`
			RetentionDays      int    `json:"retention_days"`
			RateThreshold      int    `json:"rate_threshold"`
			AutoBlockEnabled   bool   `json:"auto_block_enabled"`
			AutoBlockThreshold int    `json:"auto_block_threshold"`
			AutoBlockDuration  string `json:"auto_block_duration"`
		} `json:"security,omitempty"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	if req.Domain != nil {
		s.config.Domain.DefaultDomain = req.Domain.DefaultDomain
		s.config.Domain.AutoSubdomain = req.Domain.AutoSubdomain
		s.config.Domain.AutoSSL = req.Domain.AutoSSL
		if req.Domain.SubdomainStyle != "" {
			s.config.Domain.SubdomainStyle = req.Domain.SubdomainStyle
		}
	}

	if req.Nginx != nil {
		s.config.Nginx.Enabled = req.Nginx.Enabled
		s.config.Nginx.External = req.Nginx.External
		if req.Nginx.Image != "" {
			s.config.Nginx.Image = req.Nginx.Image
		}
		if req.Nginx.ContainerName != "" {
			s.config.Nginx.ContainerName = req.Nginx.ContainerName
		}
		if req.Nginx.ConfigPath != "" {
			s.config.Nginx.ConfigPath = req.Nginx.ConfigPath
		}
		if req.Nginx.ReloadCommand != "" {
			s.config.Nginx.ReloadCommand = req.Nginx.ReloadCommand
		}
		if req.Nginx.RejectUnknownDomains != nil {
			s.config.Nginx.RejectUnknownDomains = *req.Nginx.RejectUnknownDomains
		}
	}

	if req.Certbot != nil {
		s.config.Certbot.Enabled = req.Certbot.Enabled
		s.config.Certbot.Staging = req.Certbot.Staging
		if req.Certbot.Image != "" {
			s.config.Certbot.Image = req.Certbot.Image
		}
		if req.Certbot.Email != "" {
			s.config.Certbot.Email = req.Certbot.Email
		}
		if req.Certbot.CertsPath != "" {
			s.config.Certbot.CertsPath = req.Certbot.CertsPath
		}
		if req.Certbot.WebrootPath != "" {
			s.config.Certbot.WebrootPath = req.Certbot.WebrootPath
		}
		if req.Certbot.DNSProvider != "" {
			s.config.Certbot.DNSProvider = req.Certbot.DNSProvider
		}
	}

	if req.Infrastructure != nil {
		if req.Infrastructure.DefaultProxyNetwork != "" {
			s.config.Infrastructure.DefaultProxyNetwork = req.Infrastructure.DefaultProxyNetwork
		}
		if req.Infrastructure.DefaultDatabaseNetwork != "" {
			s.config.Infrastructure.DefaultDatabaseNetwork = req.Infrastructure.DefaultDatabaseNetwork
		}
		if req.Infrastructure.Database != nil {
			s.config.Infrastructure.Database.Enabled = req.Infrastructure.Database.Enabled
			s.config.Infrastructure.Database.Type = req.Infrastructure.Database.Type
			s.config.Infrastructure.Database.Container = req.Infrastructure.Database.Container
			s.config.Infrastructure.Database.Host = req.Infrastructure.Database.Host
			if req.Infrastructure.Database.Port > 0 {
				s.config.Infrastructure.Database.Port = req.Infrastructure.Database.Port
			}
			if req.Infrastructure.Database.RootUser != "" {
				s.config.Infrastructure.Database.RootUser = req.Infrastructure.Database.RootUser
			}
			if req.Infrastructure.Database.RootPassword != "" {
				s.config.Infrastructure.Database.RootPassword = req.Infrastructure.Database.RootPassword
			}
		}
		if req.Infrastructure.Redis != nil {
			s.config.Infrastructure.Redis.Enabled = req.Infrastructure.Redis.Enabled
			s.config.Infrastructure.Redis.Container = req.Infrastructure.Redis.Container
			s.config.Infrastructure.Redis.Host = req.Infrastructure.Redis.Host
			if req.Infrastructure.Redis.Port > 0 {
				s.config.Infrastructure.Redis.Port = req.Infrastructure.Redis.Port
			}
			if req.Infrastructure.Redis.Password != "" {
				s.config.Infrastructure.Redis.Password = req.Infrastructure.Redis.Password
			}
		}
	}

	if req.Security != nil {
		prevEnabled := s.config.Security.Enabled
		prevRealtimeCapture := s.config.Security.RealtimeCapture
		s.config.Security.Enabled = req.Security.Enabled
		s.config.Security.RealtimeCapture = req.Security.RealtimeCapture
		s.config.Security.AutoBlockEnabled = req.Security.AutoBlockEnabled
		if req.Security.RetentionDays > 0 {
			s.config.Security.RetentionDays = req.Security.RetentionDays
		}
		if req.Security.RateThreshold > 0 {
			s.config.Security.RateThreshold = req.Security.RateThreshold
		}
		if req.Security.AutoBlockThreshold > 0 {
			s.config.Security.AutoBlockThreshold = req.Security.AutoBlockThreshold
		}
		if req.Security.ScanInterval != "" {
			if d, err := time.ParseDuration(req.Security.ScanInterval); err == nil {
				s.config.Security.ScanInterval = d
			}
		}
		if req.Security.AutoBlockDuration != "" {
			if d, err := time.ParseDuration(req.Security.AutoBlockDuration); err == nil {
				s.config.Security.AutoBlockDuration = d
			}
		}
		if prevRealtimeCapture != s.config.Security.RealtimeCapture || prevEnabled != s.config.Security.Enabled {
			if err := s.infraManager.SetNginxRealtimeCapture(s.config.Security.RealtimeCapture && s.config.Security.Enabled); err != nil {
				log.Printf("Warning: failed to update nginx realtime capture: %v", err)
			}
		}
	}

	s.infraManager.UpdateConfig(s.config)
	s.proxyOrchestrator.UpdateConfig(s.config)

	if s.configPath != "" {
		if err := config.Save(s.config, s.configPath); err != nil {
			log.Printf("Warning: failed to persist config: %v", err)
		}
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Settings updated",
		"settings": gin.H{
			"domain": gin.H{
				"default_domain":  s.config.Domain.DefaultDomain,
				"auto_subdomain":  s.config.Domain.AutoSubdomain,
				"auto_ssl":        s.config.Domain.AutoSSL,
				"subdomain_style": s.config.Domain.SubdomainStyle,
			},
			"nginx": gin.H{
				"enabled":                s.config.Nginx.Enabled,
				"image":                  s.config.Nginx.Image,
				"container_name":         s.config.Nginx.ContainerName,
				"config_path":            s.config.Nginx.ConfigPath,
				"reload_command":         s.config.Nginx.ReloadCommand,
				"external":               s.config.Nginx.External,
				"reject_unknown_domains": s.config.Nginx.RejectUnknownDomains,
			},
			"certbot": gin.H{
				"enabled":      s.config.Certbot.Enabled,
				"image":        s.config.Certbot.Image,
				"email":        s.config.Certbot.Email,
				"staging":      s.config.Certbot.Staging,
				"certs_path":   s.config.Certbot.CertsPath,
				"webroot_path": s.config.Certbot.WebrootPath,
				"dns_provider": s.config.Certbot.DNSProvider,
			},
			"infrastructure": gin.H{
				"default_proxy_network":    s.config.Infrastructure.DefaultProxyNetwork,
				"default_database_network": s.config.Infrastructure.DefaultDatabaseNetwork,
				"database": gin.H{
					"enabled":   s.config.Infrastructure.Database.Enabled,
					"type":      s.config.Infrastructure.Database.Type,
					"container": s.config.Infrastructure.Database.Container,
					"host":      s.config.Infrastructure.Database.Host,
					"port":      s.config.Infrastructure.Database.Port,
				},
				"redis": gin.H{
					"enabled":   s.config.Infrastructure.Redis.Enabled,
					"container": s.config.Infrastructure.Redis.Container,
					"host":      s.config.Infrastructure.Redis.Host,
					"port":      s.config.Infrastructure.Redis.Port,
				},
			},
			"security": gin.H{
				"enabled":              s.config.Security.Enabled,
				"realtime_capture":     s.config.Security.RealtimeCapture,
				"scan_interval":        s.config.Security.ScanInterval.String(),
				"retention_days":       s.config.Security.RetentionDays,
				"rate_threshold":       s.config.Security.RateThreshold,
				"auto_block_enabled":   s.config.Security.AutoBlockEnabled,
				"auto_block_threshold": s.config.Security.AutoBlockThreshold,
				"auto_block_duration":  s.config.Security.AutoBlockDuration.String(),
			},
		},
	})
}

func (s *Server) generateSubdomain(c *gin.Context) {
	gen := subdomain.NewGenerator(s.config.Domain.SubdomainStyle)

	subdomainName := gen.Generate()
	fullDomain := ""
	if s.config.Domain.DefaultDomain != "" {
		fullDomain = gen.GenerateForDomain(s.config.Domain.DefaultDomain)
	}

	c.JSON(http.StatusOK, gin.H{
		"subdomain":      subdomainName,
		"full_domain":    fullDomain,
		"default_domain": s.config.Domain.DefaultDomain,
		"auto_ssl":       s.config.Domain.AutoSSL,
	})
}

func (s *Server) listPlugins(c *gin.Context) {
	pluginList := s.pluginRegistry.List()

	c.JSON(http.StatusOK, gin.H{
		"plugins": pluginList,
	})
}

func (s *Server) getPlugin(c *gin.Context) {
	name := c.Param("name")

	plugin, exists := s.pluginRegistry.Get(name)
	if !exists {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Plugin not found",
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"plugin": plugin.Info(),
	})
}

func (s *Server) createPluginDeployment(c *gin.Context) {
	pluginName := c.Param("name")

	plugin, exists := s.pluginRegistry.Get(pluginName)
	if !exists {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Plugin not found",
		})
		return
	}

	deploymentPlugin, ok := plugin.(plugins.DeploymentPlugin)
	if !ok {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": "Plugin does not support deployments",
		})
		return
	}

	var req struct {
		Name   string                 `json:"name" binding:"required"`
		Config map[string]interface{} `json:"config"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	result, err := deploymentPlugin.CreateDeployment(req.Name, req.Config)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	if s.authManager != nil {
		actor := auth.GetActorFromContext(c)
		if actor != nil && actor.User != nil && actor.Role != auth.RoleAdmin {
			_ = s.authManager.AssignDeployment(actor.User.ID, req.Name, auth.AccessLevelAdmin, actor.User.ID)
		}
	}

	c.JSON(http.StatusCreated, gin.H{
		"message":    "Deployment created",
		"deployment": result,
	})
}

type TemplateFile struct {
	Path    string `json:"path" yaml:"path"`
	Content string `json:"content" yaml:"content"`
}

type TemplateMetadata struct {
	Name          string          `yaml:"name"`
	Description   string          `yaml:"description"`
	Icon          string          `yaml:"icon"`
	Logo          string          `yaml:"logo"`
	Category      string          `yaml:"category"`
	Priority      int             `yaml:"priority"`
	ContainerPort int             `yaml:"container_port"`
	Mounts        []TemplateMount `yaml:"mounts"`
	Files         []TemplateFile  `yaml:"files"`
}

type TemplateMount struct {
	ID             string   `json:"id" yaml:"id"`
	Name           string   `json:"name" yaml:"name"`
	ContainerPath  string   `json:"container_path" yaml:"container_path"`
	Description    string   `json:"description" yaml:"description"`
	Type           string   `json:"type" yaml:"type"`
	Required       bool     `json:"required" yaml:"required"`
	User           string   `json:"user,omitempty" yaml:"user,omitempty"`
	Subdirectories []string `json:"subdirectories,omitempty" yaml:"subdirectories,omitempty"`
}

type Template struct {
	ID            string          `json:"id"`
	Name          string          `json:"name" yaml:"name"`
	Description   string          `json:"description" yaml:"description"`
	Icon          string          `json:"icon" yaml:"icon"`
	Logo          string          `json:"logo" yaml:"logo"`
	Category      string          `json:"category" yaml:"category"`
	Priority      int             `json:"priority" yaml:"priority"`
	ContainerPort int             `json:"container_port" yaml:"container_port"`
	Mounts        []TemplateMount `json:"mounts" yaml:"mounts"`
	Files         []TemplateFile  `json:"files" yaml:"files"`
	Content       string          `json:"content"`
}

func (s *Server) listTemplates(c *gin.Context) {
	templatesDir := filepath.Join(s.config.DeploymentsPath, ".flatrun", "templates")

	if err := os.MkdirAll(templatesDir, 0755); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": "Failed to create templates directory",
		})
		return
	}

	s.ensureBuiltinTemplates(templatesDir)

	var templateList []Template

	entries, err := os.ReadDir(templatesDir)
	if err != nil {
		c.JSON(http.StatusOK, gin.H{
			"templates": templateList,
		})
		return
	}

	for _, entry := range entries {
		if !entry.IsDir() {
			continue
		}

		templateID := entry.Name()
		templatePath := filepath.Join(templatesDir, templateID)

		metadataPath := filepath.Join(templatePath, "metadata.yml")
		composePath := filepath.Join(templatePath, "docker-compose.yml")

		composeContent, err := os.ReadFile(composePath)
		if err != nil {
			continue
		}

		var metadata TemplateMetadata
		metadataContent, err := os.ReadFile(metadataPath)
		if err == nil {
			_ = yaml.Unmarshal(metadataContent, &metadata)
		}

		if metadata.Name == "" {
			metadata.Name = toTitleCase(strings.ReplaceAll(templateID, "-", " "))
		}
		if metadata.Icon == "" {
			metadata.Icon = "pi pi-box"
		}
		if metadata.Category == "" {
			metadata.Category = "general"
		}

		templateList = append(templateList, Template{
			ID:            templateID,
			Name:          metadata.Name,
			Description:   metadata.Description,
			Icon:          metadata.Icon,
			Logo:          metadata.Logo,
			Category:      metadata.Category,
			Priority:      metadata.Priority,
			ContainerPort: metadata.ContainerPort,
			Mounts:        metadata.Mounts,
			Files:         metadata.Files,
			Content:       string(composeContent),
		})
	}

	sort.Slice(templateList, func(i, j int) bool {
		return templateList[i].Priority > templateList[j].Priority
	})

	c.JSON(http.StatusOK, gin.H{
		"templates": templateList,
	})
}

func (s *Server) refreshTemplates(c *gin.Context) {
	templatesDir := filepath.Join(s.config.DeploymentsPath, ".flatrun", "templates")

	builtinList, err := templates.List()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": "Failed to list builtin templates",
		})
		return
	}

	for _, tmplID := range builtinList {
		templatePath := filepath.Join(templatesDir, tmplID)

		if err := os.MkdirAll(templatePath, 0755); err != nil {
			continue
		}

		metadataContent, err := templates.GetMetadata(tmplID)
		if err == nil {
			_ = os.WriteFile(filepath.Join(templatePath, "metadata.yml"), metadataContent, 0644)
		}

		composeContent, err := templates.GetCompose(tmplID)
		if err == nil {
			_ = os.WriteFile(filepath.Join(templatePath, "docker-compose.yml"), composeContent, 0644)
		}
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Templates refreshed",
		"count":   len(builtinList),
	})
}

func (s *Server) getTemplateCategories(c *gin.Context) {
	c.JSON(http.StatusOK, gin.H{
		"categories": templates.GetCategories(),
	})
}

func (s *Server) getTemplateCompose(c *gin.Context) {
	templateID := c.Param("id")
	name := c.DefaultQuery("name", "my-app")

	content, err := s.generateComposeContent(name, templateID)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"template_id": templateID,
		"name":        name,
		"content":     content,
	})
}

type MountSelection struct {
	ID      string `json:"id"`
	Enabled bool   `json:"enabled"`
	Type    string `json:"type"`
}

type ComposeGenerateRequest struct {
	Name          string           `json:"name" binding:"required"`
	ContainerPort int              `json:"container_port"`
	MapPorts      bool             `json:"map_ports"`
	HostPort      string           `json:"host_port"`
	Mounts        []MountSelection `json:"mounts"`
}

type PortConfig struct {
	ContainerPort int    `json:"container_port"`
	HostPort      string `json:"host_port"`
}

type ComposeUpdateRequest struct {
	Content  string           `json:"content" binding:"required"`
	Ports    []PortConfig     `json:"ports"`
	Mounts   []MountSelection `json:"mounts"`
	Database *DatabaseConfig  `json:"database,omitempty"`
}

type DatabaseConfig struct {
	Type              string `json:"type"`
	Mode              string `json:"mode"`
	Name              string `json:"name"`
	User              string `json:"user"`
	Password          string `json:"password"`
	RootPassword      string `json:"root_password"`
	ExistingContainer string `json:"existing_container"`
	ExternalHost      string `json:"external_host"`
	ExternalPort      string `json:"external_port"`
}

func (s *Server) generateTemplateCompose(c *gin.Context) {
	templateID := c.Param("id")

	var req ComposeGenerateRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	content, err := s.generateComposeWithOptions(templateID, &req)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"template_id":    templateID,
		"name":           req.Name,
		"content":        content,
		"container_port": req.ContainerPort,
		"map_ports":      req.MapPorts,
		"host_port":      req.HostPort,
	})
}

func (s *Server) updateCompose(c *gin.Context) {
	var req ComposeUpdateRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	content := req.Content

	if len(req.Ports) == 0 {
		req.Ports = []PortConfig{{ContainerPort: 80, HostPort: ""}}
	}

	content = s.updateComposePorts(content, req.Ports)

	if req.Database != nil && req.Database.Type != "" && req.Database.Type != "none" {
		content = s.updateComposeDatabase(content, req.Database)
	}

	c.JSON(http.StatusOK, gin.H{
		"content": content,
	})
}

func (s *Server) updateComposePorts(content string, ports []PortConfig) string {
	var compose map[string]interface{}
	if err := yaml.Unmarshal([]byte(content), &compose); err != nil {
		return content
	}

	services, ok := compose["services"].(map[string]interface{})
	if !ok {
		return content
	}

	for _, svc := range services {
		service, ok := svc.(map[string]interface{})
		if !ok {
			continue
		}

		delete(service, "expose")
		delete(service, "ports")

		var exposeList []string
		var portsList []string

		for _, p := range ports {
			if p.HostPort != "" {
				portsList = append(portsList, fmt.Sprintf("%s:%d", p.HostPort, p.ContainerPort))
			} else {
				exposeList = append(exposeList, fmt.Sprintf("%d", p.ContainerPort))
			}
		}

		if len(portsList) > 0 {
			service["ports"] = portsList
		}
		if len(exposeList) > 0 {
			service["expose"] = exposeList
		}
		break
	}

	out, err := yaml.Marshal(compose)
	if err != nil {
		return content
	}

	return string(out)
}

func (s *Server) updateComposeDatabase(content string, db *DatabaseConfig) string {
	var compose map[string]interface{}
	if err := yaml.Unmarshal([]byte(content), &compose); err != nil {
		return content
	}

	services, ok := compose["services"].(map[string]interface{})
	if !ok {
		return content
	}

	if db.Mode == "create" {
		dbService := s.createDatabaseService(db)
		if dbService != nil {
			services["db"] = dbService

			volumes, _ := compose["volumes"].(map[string]interface{})
			if volumes == nil {
				volumes = make(map[string]interface{})
			}
			volumes["db_data"] = nil
			compose["volumes"] = volumes
		}
	}

	result, err := yaml.Marshal(compose)
	if err != nil {
		return content
	}
	return string(result)
}

func (s *Server) createDatabaseService(db *DatabaseConfig) map[string]interface{} {
	var image string
	var envVars map[string]string
	var volumePath string

	dbName := db.Name
	if dbName == "" {
		dbName = "app_db"
	}
	dbUser := db.User
	if dbUser == "" {
		dbUser = "app"
	}
	rootPassword := db.RootPassword
	if rootPassword == "" {
		rootPassword = db.Password
	}

	switch db.Type {
	case "mysql":
		image = "mysql:8"
		volumePath = "/var/lib/mysql"
		envVars = map[string]string{
			"MYSQL_ROOT_PASSWORD": rootPassword,
			"MYSQL_DATABASE":      dbName,
			"MYSQL_USER":          dbUser,
			"MYSQL_PASSWORD":      db.Password,
		}
	case "mariadb":
		image = "mariadb:10"
		volumePath = "/var/lib/mysql"
		envVars = map[string]string{
			"MYSQL_ROOT_PASSWORD": rootPassword,
			"MYSQL_DATABASE":      dbName,
			"MYSQL_USER":          dbUser,
			"MYSQL_PASSWORD":      db.Password,
		}
	case "postgres":
		image = "postgres:15"
		volumePath = "/var/lib/postgresql/data"
		envVars = map[string]string{
			"POSTGRES_DB":       dbName,
			"POSTGRES_USER":     dbUser,
			"POSTGRES_PASSWORD": db.Password,
		}
	case "mongodb":
		image = "mongo:6"
		volumePath = "/data/db"
		envVars = map[string]string{
			"MONGO_INITDB_ROOT_USERNAME": dbUser,
			"MONGO_INITDB_ROOT_PASSWORD": db.Password,
			"MONGO_INITDB_DATABASE":      dbName,
		}
	default:
		return nil
	}

	networkName := s.config.Infrastructure.DefaultDatabaseNetwork
	if networkName == "" {
		networkName = "database"
	}

	return map[string]interface{}{
		"image":       image,
		"environment": envVars,
		"volumes":     []string{"db_data:" + volumePath},
		"networks":    []string{networkName},
		"restart":     "unless-stopped",
	}
}

func (s *Server) generateComposeWithOptions(templateID string, opts *ComposeGenerateRequest) (string, error) {
	if templateID == "" || templateID == "custom" {
		return s.generateCustomCompose(opts)
	}

	templatesDir := filepath.Join(s.config.DeploymentsPath, ".flatrun", "templates")

	composeBytes, err := templates.GetCompose(templateID)
	if err != nil {
		composePath := filepath.Join(templatesDir, templateID, "docker-compose.yml")
		composeBytes, err = os.ReadFile(composePath)
		if err != nil {
			return s.generateCustomCompose(opts)
		}
	}

	content := string(composeBytes)

	content = strings.ReplaceAll(content, "${NAME}", opts.Name)

	networkName := s.config.Infrastructure.DefaultProxyNetwork
	content = strings.ReplaceAll(content, "${PROXY_NETWORK}", networkName)
	content = replaceHardcodedNetwork(content, "proxy", networkName)

	var metadata TemplateMetadata
	metadataPath := filepath.Join(templatesDir, templateID, "metadata.yml")
	metadataContent, err := os.ReadFile(metadataPath)
	if err == nil {
		_ = yaml.Unmarshal(metadataContent, &metadata)
	}

	if opts.MapPorts && opts.HostPort != "" {
		containerPort := opts.ContainerPort
		if containerPort == 0 && metadata.ContainerPort > 0 {
			containerPort = metadata.ContainerPort
		}
		if containerPort == 0 {
			containerPort = 80
		}

		exposePattern := fmt.Sprintf(`expose:\s*\n\s*-\s*["']?%d["']?`, containerPort)
		re := regexp.MustCompile(exposePattern)
		portMapping := fmt.Sprintf("ports:\n      - \"%s:%d\"", opts.HostPort, containerPort)
		content = re.ReplaceAllString(content, portMapping)
	}

	if len(opts.Mounts) > 0 && len(metadata.Mounts) > 0 {
		content = s.injectMounts(content, opts.Mounts, metadata.Mounts)
	}

	return content, nil
}

func (s *Server) injectMounts(content string, selections []MountSelection, available []TemplateMount) string {
	mountMap := make(map[string]TemplateMount)
	for _, m := range available {
		mountMap[m.ID] = m
	}

	var newVolumes []string
	for _, sel := range selections {
		if !sel.Enabled {
			continue
		}
		mount, ok := mountMap[sel.ID]
		if !ok {
			continue
		}

		var hostPath string
		if sel.Type == "volume" {
			hostPath = sel.ID + "_data"
		} else {
			hostPath = "./" + sel.ID
		}
		newVolumes = append(newVolumes, fmt.Sprintf("%s:%s", hostPath, mount.ContainerPath))
	}

	if len(newVolumes) == 0 {
		return content
	}

	var compose map[string]interface{}
	if err := yaml.Unmarshal([]byte(content), &compose); err != nil {
		return content
	}

	services, ok := compose["services"].(map[string]interface{})
	if !ok {
		return content
	}

	for serviceName, serviceData := range services {
		service, ok := serviceData.(map[string]interface{})
		if !ok {
			continue
		}

		existingByContainerPath := make(map[string]int)
		var volumesList []string

		if v, ok := service["volumes"].([]interface{}); ok {
			for _, vol := range v {
				if vs, ok := vol.(string); ok {
					containerPath := extractContainerPath(vs)
					existingByContainerPath[containerPath] = len(volumesList)
					volumesList = append(volumesList, vs)
				}
			}
		}

		for _, vol := range newVolumes {
			containerPath := extractContainerPath(vol)
			if idx, exists := existingByContainerPath[containerPath]; exists {
				if hasVolumeOptions(vol) && !hasVolumeOptions(volumesList[idx]) {
					volumesList[idx] = vol
				}
			} else {
				existingByContainerPath[containerPath] = len(volumesList)
				volumesList = append(volumesList, vol)
			}
		}

		service["volumes"] = volumesList
		services[serviceName] = service
		break
	}

	compose["services"] = services

	result, err := yaml.Marshal(compose)
	if err != nil {
		return content
	}

	return string(result)
}

func extractContainerPath(volume string) string {
	parts := strings.Split(volume, ":")
	if len(parts) >= 2 {
		return parts[1]
	}
	return volume
}

func hasVolumeOptions(volume string) bool {
	return len(strings.Split(volume, ":")) >= 3
}

func (s *Server) generateCustomCompose(opts *ComposeGenerateRequest) (string, error) {
	networkName := s.config.Infrastructure.DefaultProxyNetwork

	containerPort := opts.ContainerPort
	if containerPort == 0 {
		containerPort = 80
	}

	portConfig := fmt.Sprintf("expose:\n      - \"%d\"", containerPort)
	if opts.MapPorts && opts.HostPort != "" {
		portConfig = fmt.Sprintf("ports:\n      - \"%s:%d\"", opts.HostPort, containerPort)
	}

	content := fmt.Sprintf(`name: %s
services:
  app:
    image: nginx:alpine
    container_name: %s
    %s
    networks:
      - %s
    restart: unless-stopped

networks:
  %s:
    external: true
`, opts.Name, opts.Name, portConfig, networkName, networkName)

	return content, nil
}

type composeFile struct {
	Name     string                    `yaml:"name"`
	Services map[string]composeService `yaml:"services"`
	Networks map[string]composeNetwork `yaml:"networks"`
	Volumes  map[string]interface{}    `yaml:"volumes"`
}

type composeService struct {
	Image         string      `yaml:"image"`
	ContainerName string      `yaml:"container_name"`
	Ports         interface{} `yaml:"ports"`
	Expose        interface{} `yaml:"expose"`
	Networks      interface{} `yaml:"networks"`
	Volumes       interface{} `yaml:"volumes"`
	Environment   interface{} `yaml:"environment"`
	EnvFile       interface{} `yaml:"env_file"`
}

type composeNetwork struct {
	External bool   `yaml:"external"`
	Name     string `yaml:"name"`
}

func (s *Server) validateComposeContent(content, deploymentName string) error {
	var compose composeFile
	if err := yaml.Unmarshal([]byte(content), &compose); err != nil {
		return fmt.Errorf("invalid YAML syntax: %w", err)
	}

	if len(compose.Services) == 0 {
		return fmt.Errorf("compose file must define at least one service")
	}

	expectedNetwork := s.config.Infrastructure.DefaultProxyNetwork

	for serviceName, service := range compose.Services {
		if service.Image == "" {
			return fmt.Errorf("service '%s' must have an image defined", serviceName)
		}

		hasExpectedNetwork := false
		networkNames := extractNetworkNames(service.Networks)
		for _, net := range networkNames {
			if net == expectedNetwork {
				hasExpectedNetwork = true
				break
			}
		}
		if !hasExpectedNetwork && len(networkNames) > 0 {
			log.Printf("Warning: service '%s' does not use the configured proxy network '%s'", serviceName, expectedNetwork)
		}
	}

	if len(compose.Networks) > 0 {
		if netConfig, ok := compose.Networks[expectedNetwork]; ok {
			if !netConfig.External {
				return fmt.Errorf("network '%s' must be marked as external", expectedNetwork)
			}
		}
	}

	return nil
}

func extractNetworkNames(networks interface{}) []string {
	if networks == nil {
		return nil
	}

	switch v := networks.(type) {
	case []interface{}:
		var names []string
		for _, n := range v {
			if name, ok := n.(string); ok {
				names = append(names, name)
			}
		}
		return names
	case []string:
		return v
	case map[string]interface{}:
		var names []string
		for name := range v {
			names = append(names, name)
		}
		return names
	default:
		return nil
	}
}

func (s *Server) ensureBuiltinTemplates(templatesDir string) {
	builtinList, err := templates.List()
	if err != nil {
		return
	}

	for _, tmplID := range builtinList {
		templatePath := filepath.Join(templatesDir, tmplID)
		composePath := filepath.Join(templatePath, "docker-compose.yml")

		if _, err := os.Stat(composePath); err == nil {
			continue
		}

		if err := os.MkdirAll(templatePath, 0755); err != nil {
			continue
		}

		metadataContent, err := templates.GetMetadata(tmplID)
		if err == nil {
			_ = os.WriteFile(filepath.Join(templatePath, "metadata.yml"), metadataContent, 0644)
		}

		composeContent, err := templates.GetCompose(tmplID)
		if err == nil {
			_ = os.WriteFile(composePath, composeContent, 0644)
		}
	}
}

func (s *Server) generateComposeContent(name, templateID string) (string, error) {
	if templateID == "" {
		templateID = "static"
	}

	composeBytes, err := templates.GetCompose(templateID)
	if err != nil {
		templatesDir := filepath.Join(s.config.DeploymentsPath, ".flatrun", "templates")
		composePath := filepath.Join(templatesDir, templateID, "docker-compose.yml")
		composeBytes, err = os.ReadFile(composePath)
		if err != nil {
			return "", fmt.Errorf("template '%s' not found", templateID)
		}
	}

	content := string(composeBytes)

	content = strings.ReplaceAll(content, "${NAME}", name)

	networkName := s.config.Infrastructure.DefaultProxyNetwork
	content = strings.ReplaceAll(content, "${PROXY_NETWORK}", networkName)

	content = replaceHardcodedNetwork(content, "proxy", networkName)

	return content, nil
}

func replaceHardcodedNetwork(content, oldNetwork, newNetwork string) string {
	if oldNetwork == newNetwork {
		return content
	}

	lines := strings.Split(content, "\n")
	var result []string
	inNetworks := false
	inServicesNetworks := false
	indentLevel := 0

	for _, line := range lines {
		trimmed := strings.TrimSpace(line)
		currentIndent := len(line) - len(strings.TrimLeft(line, " \t"))

		if trimmed == "networks:" {
			if currentIndent == 0 {
				inNetworks = true
				indentLevel = currentIndent
			} else {
				inServicesNetworks = true
				indentLevel = currentIndent
			}
			result = append(result, line)
			continue
		}

		if inNetworks && currentIndent > indentLevel {
			if strings.HasPrefix(trimmed, oldNetwork+":") {
				line = strings.Replace(line, oldNetwork+":", newNetwork+":", 1)
			}
		} else if inNetworks && currentIndent <= indentLevel && trimmed != "" {
			inNetworks = false
		}

		if inServicesNetworks && currentIndent > indentLevel {
			if trimmed == "- "+oldNetwork {
				line = strings.Replace(line, "- "+oldNetwork, "- "+newNetwork, 1)
			}
		} else if inServicesNetworks && currentIndent <= indentLevel && trimmed != "" {
			inServicesNetworks = false
		}

		result = append(result, line)
	}

	return strings.Join(result, "\n")
}

// getContainerNetworks returns the networks a container is connected to
func (s *Server) getContainerNetworks(containerName string) ([]string, error) {
	cmd := exec.Command("docker", "inspect", "--format", "{{json .NetworkSettings.Networks}}", containerName)
	output, err := cmd.Output()
	if err != nil {
		return nil, err
	}

	var networks map[string]interface{}
	if err := json.Unmarshal(output, &networks); err != nil {
		return nil, err
	}

	var result []string
	for name := range networks {
		result = append(result, name)
	}
	return result, nil
}

// addDatabaseNetwork adds the configured shared database network to a compose file
func (s *Server) addDatabaseNetwork(content string) string {
	dbNetworkName := s.config.Infrastructure.DefaultDatabaseNetwork
	if dbNetworkName == "" {
		dbNetworkName = "database"
	}
	result, err := docker.AddNetworkToCompose(content, dbNetworkName)
	if err != nil {
		return content
	}
	return result
}

// addProxyNetwork adds the configured proxy network to a compose file
func (s *Server) addProxyNetwork(content string) string {
	result, err := docker.AddNetworkToCompose(content, s.config.Infrastructure.DefaultProxyNetwork)
	if err != nil {
		return content
	}
	return result
}

// addContainerNetwork finds and adds the network of a specific container to a compose file
func (s *Server) addContainerNetwork(content string, containerName string) string {
	networks, err := s.getContainerNetworks(containerName)
	if err != nil || len(networks) == 0 {
		return content
	}
	// Add the first non-bridge network, or first network if all are bridge
	for _, net := range networks {
		if net != "bridge" && net != "host" && net != "none" {
			result, err := docker.AddNetworkToCompose(content, net)
			if err != nil {
				return content
			}
			return result
		}
	}
	result, err := docker.AddNetworkToCompose(content, networks[0])
	if err != nil {
		return content
	}
	return result
}

func (s *Server) processTemplateFiles(deploymentName, templateID string, envVars []EnvVar) {
	templatesDir := filepath.Join(s.config.DeploymentsPath, ".flatrun", "templates")
	metadataPath := filepath.Join(templatesDir, templateID, "metadata.yml")

	metadataContent, err := os.ReadFile(metadataPath)
	if err != nil {
		return
	}

	var metadata TemplateMetadata
	if err := yaml.Unmarshal(metadataContent, &metadata); err != nil {
		return
	}

	if len(metadata.Files) == 0 {
		return
	}

	deploymentDir := filepath.Join(s.config.DeploymentsPath, deploymentName)

	for _, file := range metadata.Files {
		content := strings.ReplaceAll(file.Content, "${NAME}", deploymentName)

		for _, env := range envVars {
			placeholder := "${" + env.Key + "}"
			content = strings.ReplaceAll(content, placeholder, env.Value)
		}

		filePath := filepath.Join(deploymentDir, file.Path)
		fileDir := filepath.Dir(filePath)

		if err := os.MkdirAll(fileDir, 0755); err != nil {
			continue
		}

		_ = os.WriteFile(filePath, []byte(content), 0644)
	}
}

func (s *Server) applyTemplateMountOwnership(deploymentName, templateID string) {
	templatesDir := filepath.Join(s.config.DeploymentsPath, ".flatrun", "templates")
	metadataPath := filepath.Join(templatesDir, templateID, "metadata.yml")

	metadataContent, err := os.ReadFile(metadataPath)
	if err != nil {
		return
	}

	var metadata TemplateMetadata
	if err := yaml.Unmarshal(metadataContent, &metadata); err != nil {
		return
	}

	if len(metadata.Mounts) == 0 {
		return
	}

	var mounts []docker.MountOwnership
	for _, m := range metadata.Mounts {
		if m.Type != "file" {
			continue
		}
		hostPath := "./" + m.ID
		mounts = append(mounts, docker.MountOwnership{
			HostPath:       hostPath,
			User:           m.User,
			Subdirectories: m.Subdirectories,
		})
	}

	if len(mounts) > 0 {
		if err := s.manager.ApplyMountOwnership(deploymentName, mounts); err != nil {
			log.Printf("Warning: failed to apply mount ownership for %s: %v", deploymentName, err)
		}
	}
}

func (s *Server) listCertificates(c *gin.Context) {
	certificates, err := s.proxyOrchestrator.ListCertificates()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"certificates": certificates,
	})
}

func (s *Server) requestCertificate(c *gin.Context) {
	var req struct {
		Domain string `json:"domain" binding:"required"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	result, err := s.proxyOrchestrator.RequestCertificate(req.Domain)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusCreated, gin.H{
		"message": "Certificate requested",
		"result":  result,
	})
}

func (s *Server) renewCertificates(c *gin.Context) {
	result, err := s.proxyOrchestrator.RenewCertificates()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Renewal completed",
		"result":  result,
	})
}

func (s *Server) deleteCertificate(c *gin.Context) {
	domain := c.Param("domain")
	force := c.DefaultQuery("force", "false") == "true"

	vhosts := s.proxyOrchestrator.NginxManager().GetVhostsUsingSSLDomain(domain)
	if len(vhosts) > 0 && !force {
		c.JSON(http.StatusConflict, gin.H{
			"error":  "Certificate is in use by virtual hosts",
			"vhosts": vhosts,
			"hint":   "Disable SSL for these deployments first, or use ?force=true to delete anyway",
		})
		return
	}

	if err := s.proxyOrchestrator.SSLManager().DeleteCertificate(domain); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Certificate deleted",
		"domain":  domain,
	})
}

func (s *Server) getProxyStatus(c *gin.Context) {
	name := c.Param("name")

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Deployment not found",
		})
		return
	}

	status := s.proxyOrchestrator.GetDeploymentProxyStatus(deployment)

	c.JSON(http.StatusOK, gin.H{
		"status": status,
	})
}

func (s *Server) setupProxy(c *gin.Context) {
	name := c.Param("name")

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Deployment not found",
		})
		return
	}

	result, err := s.proxyOrchestrator.SetupDeployment(deployment)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Proxy setup completed",
		"result":  result,
	})
}

func (s *Server) teardownProxy(c *gin.Context) {
	name := c.Param("name")

	if err := s.proxyOrchestrator.TeardownDeployment(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Proxy removed",
		"name":    name,
	})
}

func (s *Server) disableSSL(c *gin.Context) {
	name := c.Param("name")

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Deployment not found",
		})
		return
	}

	if deployment.Metadata == nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": "Deployment has no metadata configured",
		})
		return
	}

	deployment.Metadata.SSL.Enabled = false
	deployment.Metadata.SSL.AutoCert = false

	if err := s.manager.SaveMetadata(name, deployment.Metadata); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": "Failed to save metadata: " + err.Error(),
		})
		return
	}

	if err := s.proxyOrchestrator.NginxManager().UpdateVirtualHost(deployment); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": "Failed to update virtual host: " + err.Error(),
		})
		return
	}

	if err := s.proxyOrchestrator.NginxManager().TestConfig(); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": "Nginx config test failed: " + err.Error(),
		})
		return
	}

	if err := s.proxyOrchestrator.NginxManager().Reload(); err != nil {
		log.Printf("Warning: failed to reload nginx: %v", err)
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "SSL disabled for deployment",
		"name":    name,
	})
}

func (s *Server) listVirtualHosts(c *gin.Context) {
	vhosts, err := s.proxyOrchestrator.ListVirtualHosts()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"virtual_hosts": vhosts,
	})
}

type ProxySyncResult struct {
	Name    string `json:"name"`
	Domain  string `json:"domain"`
	Success bool   `json:"success"`
	Message string `json:"message,omitempty"`
	Created bool   `json:"created"`
}

func (s *Server) syncAllProxies(c *gin.Context) {
	deployments, err := s.manager.ListDeployments()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	existingVhosts, err := s.proxyOrchestrator.ListVirtualHosts()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": "Failed to list virtual hosts: " + err.Error(),
		})
		return
	}

	vhostMap := make(map[string]bool)
	for _, vhost := range existingVhosts {
		vhostMap[vhost.Name] = true
	}

	var results []ProxySyncResult
	var synced, skipped, failed int

	for _, deployment := range deployments {
		if deployment.Metadata == nil || !deployment.Metadata.Networking.Expose {
			continue
		}

		domain := deployment.Metadata.Networking.Domain
		if domain == "" {
			continue
		}

		if vhostMap[domain] {
			skipped++
			results = append(results, ProxySyncResult{
				Name:    deployment.Name,
				Domain:  domain,
				Success: true,
				Message: "Already exists",
				Created: false,
			})
			continue
		}

		result, err := s.proxyOrchestrator.SetupDeployment(&deployment)
		if err != nil {
			failed++
			results = append(results, ProxySyncResult{
				Name:    deployment.Name,
				Domain:  domain,
				Success: false,
				Message: err.Error(),
				Created: false,
			})
			continue
		}

		if result.VirtualHostCreated {
			synced++
			results = append(results, ProxySyncResult{
				Name:    deployment.Name,
				Domain:  domain,
				Success: true,
				Message: "Created",
				Created: true,
			})
		} else {
			skipped++
			results = append(results, ProxySyncResult{
				Name:    deployment.Name,
				Domain:  domain,
				Success: true,
				Message: "Setup completed but vhost already existed",
				Created: false,
			})
		}
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Proxy sync completed",
		"synced":  synced,
		"skipped": skipped,
		"failed":  failed,
		"total":   len(results),
		"results": results,
	})
}

func (s *Server) setupProxyWithRetry(deployment *models.Deployment, maxRetries int) (*proxy.SetupResult, error) {
	var lastErr error
	for i := 0; i < maxRetries; i++ {
		result, err := s.proxyOrchestrator.SetupDeployment(deployment)
		if err == nil {
			return result, nil
		}
		lastErr = err
		log.Printf("Proxy setup attempt %d/%d for %s failed: %v", i+1, maxRetries, deployment.Name, err)
		if i < maxRetries-1 {
			time.Sleep(time.Duration(i+1) * 2 * time.Second)
		}
	}
	return nil, lastErr
}

func (s *Server) listDomains(c *gin.Context) {
	name := c.Param("name")
	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
		return
	}

	if deployment.Metadata == nil {
		c.JSON(http.StatusOK, gin.H{"domains": []models.DomainConfig{}})
		return
	}

	domains := deployment.Metadata.GetDomains()
	c.JSON(http.StatusOK, gin.H{"domains": domains})
}

func (s *Server) addDomain(c *gin.Context) {
	name := c.Param("name")
	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
		return
	}

	var domain models.DomainConfig
	if err := c.ShouldBindJSON(&domain); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid domain data: " + err.Error()})
		return
	}

	if domain.Domain == "" {
		c.JSON(http.StatusBadRequest, gin.H{"error": "Domain is required"})
		return
	}

	if domain.ID == "" {
		domain.ID = generateDomainID()
	}

	if deployment.Metadata == nil {
		deployment.Metadata = &models.ServiceMetadata{}
	}

	if len(deployment.Metadata.Domains) == 0 && deployment.Metadata.Networking.Expose {
		existingDomain := models.DomainConfig{
			ID:            "default",
			Service:       deployment.Metadata.Name,
			ContainerPort: deployment.Metadata.Networking.ContainerPort,
			Domain:        deployment.Metadata.Networking.Domain,
			SSL:           deployment.Metadata.SSL,
		}
		deployment.Metadata.Domains = []models.DomainConfig{existingDomain}
	}

	for _, existing := range deployment.Metadata.Domains {
		if existing.Domain == domain.Domain && existing.PathPrefix == domain.PathPrefix {
			c.JSON(http.StatusConflict, gin.H{
				"error": fmt.Sprintf("Domain %s%s already exists", domain.Domain, domain.PathPrefix),
			})
			return
		}
	}

	deployment.Metadata.Domains = append(deployment.Metadata.Domains, domain)

	if err := s.manager.SaveMetadata(name, deployment.Metadata); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to save domain: " + err.Error()})
		return
	}

	var result *proxy.SetupResult
	if s.proxyOrchestrator != nil {
		var err error
		result, err = s.proxyOrchestrator.SetupDeployment(deployment)
		if err != nil {
			c.JSON(http.StatusConflict, gin.H{"error": "Failed to configure proxy: " + err.Error()})
			return
		}
	}

	c.JSON(http.StatusCreated, gin.H{
		"message":      "Domain added successfully",
		"domain":       domain,
		"proxy_result": result,
	})
}

func (s *Server) updateDomain(c *gin.Context) {
	name := c.Param("name")
	domainID := c.Param("domainId")

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
		return
	}

	if deployment.Metadata == nil || len(deployment.Metadata.Domains) == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "Domain not found"})
		return
	}

	var updatedDomain models.DomainConfig
	if err := c.ShouldBindJSON(&updatedDomain); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid domain data: " + err.Error()})
		return
	}

	found := false
	for i, d := range deployment.Metadata.Domains {
		if d.ID == domainID {
			updatedDomain.ID = domainID
			deployment.Metadata.Domains[i] = updatedDomain
			found = true
			break
		}
	}

	if !found {
		c.JSON(http.StatusNotFound, gin.H{"error": "Domain not found"})
		return
	}

	if err := s.manager.SaveMetadata(name, deployment.Metadata); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to save domain: " + err.Error()})
		return
	}

	result, err := s.proxyOrchestrator.SetupDeployment(deployment)
	if err != nil {
		c.JSON(http.StatusConflict, gin.H{"error": "Failed to configure proxy: " + err.Error()})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":      "Domain updated successfully",
		"domain":       updatedDomain,
		"proxy_result": result,
	})
}

func (s *Server) deleteDomain(c *gin.Context) {
	name := c.Param("name")
	domainID := c.Param("domainId")

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
		return
	}

	if deployment.Metadata == nil {
		c.JSON(http.StatusNotFound, gin.H{"error": "Domain not found"})
		return
	}

	// Handle legacy "default" domain from networking config
	if domainID == "default" && len(deployment.Metadata.Domains) == 0 {
		if !deployment.Metadata.Networking.Expose || deployment.Metadata.Networking.Domain == "" {
			c.JSON(http.StatusNotFound, gin.H{"error": "Domain not found"})
			return
		}
		// Clear the legacy networking config
		deployment.Metadata.Networking.Expose = false
		deployment.Metadata.Networking.Domain = ""
		deployment.Metadata.SSL.Enabled = false
		deployment.Metadata.SSL.AutoCert = false

		if err := s.manager.SaveMetadata(name, deployment.Metadata); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to save metadata: " + err.Error()})
			return
		}

		if s.proxyOrchestrator != nil {
			if err := s.proxyOrchestrator.TeardownDeployment(name); err != nil {
				log.Printf("Warning: failed to teardown proxy for %s: %v", name, err)
			}
		}

		c.JSON(http.StatusOK, gin.H{"message": "Domain deleted successfully"})
		return
	}

	if len(deployment.Metadata.Domains) == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "Domain not found"})
		return
	}

	found := false
	newDomains := make([]models.DomainConfig, 0)
	for _, d := range deployment.Metadata.Domains {
		if d.ID == domainID {
			found = true
			continue
		}
		newDomains = append(newDomains, d)
	}

	if !found {
		c.JSON(http.StatusNotFound, gin.H{"error": "Domain not found"})
		return
	}

	if len(newDomains) == 0 {
		deployment.Metadata.Domains = nil
	} else {
		deployment.Metadata.Domains = newDomains
	}

	if err := s.manager.SaveMetadata(name, deployment.Metadata); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to save metadata: " + err.Error()})
		return
	}

	if s.proxyOrchestrator != nil {
		if len(newDomains) == 0 {
			if deployment.Metadata.Networking.Expose {
				if _, err := s.proxyOrchestrator.SetupDeployment(deployment); err != nil {
					log.Printf("Warning: failed to setup legacy proxy for %s: %v", name, err)
				}
			} else {
				if err := s.proxyOrchestrator.TeardownDeployment(name); err != nil {
					log.Printf("Warning: failed to teardown proxy for %s: %v", name, err)
				}
			}
		} else {
			if _, err := s.proxyOrchestrator.SetupDeployment(deployment); err != nil {
				log.Printf("Warning: failed to update proxy for %s: %v", name, err)
			}
		}
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Domain deleted successfully",
	})
}

func generateDomainID() string {
	return uuid.New().String()
}

func (s *Server) getSystemStats(c *gin.Context) {
	deployments, err := s.manager.ListDeployments()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	actor := auth.GetActorFromContext(c)
	if actor != nil && actor.Role != auth.RoleAdmin {
		var filtered []models.Deployment
		for _, d := range deployments {
			if actor.CanAccessDeployment(d.Name, auth.AccessLevelRead) {
				filtered = append(filtered, d)
			}
		}
		deployments = filtered
	}

	depStats := gin.H{
		"total_deployments": len(deployments),
		"running":           0,
		"stopped":           0,
		"error":             0,
		"unknown":           0,
	}
	for _, d := range deployments {
		switch d.Status {
		case "running":
			depStats["running"] = depStats["running"].(int) + 1
		case "stopped":
			depStats["stopped"] = depStats["stopped"].(int) + 1
		case "error":
			depStats["error"] = depStats["error"].(int) + 1
		default:
			depStats["unknown"] = depStats["unknown"].(int) + 1
		}
	}

	containerStats, _ := s.networksManager.GetContainerStats()
	imageStats, _ := s.networksManager.GetImageStats()
	volumeStats, _ := s.networksManager.GetVolumeStats()

	var networkCount, portCount int
	if networks, err := s.networksManager.ListNetworks(); err == nil {
		networkCount = len(networks)
	}
	if containers, err := s.networksManager.ListContainers(); err == nil {
		for _, container := range containers {
			portCount += len(container.Ports)
		}
	}

	systemStats, _ := system.GetSystemStats()

	c.JSON(http.StatusOK, gin.H{
		"deployments": depStats,
		"containers":  containerStats,
		"images":      imageStats,
		"volumes":     volumeStats,
		"networks":    gin.H{"total": networkCount},
		"ports":       gin.H{"total": portCount},
		"system":      systemStats,
	})
}

func (s *Server) listContainers(c *gin.Context) {
	containers, err := s.networksManager.ListContainers()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"containers": containers,
	})
}

func (s *Server) startContainer(c *gin.Context) {
	id := c.Param("id")

	if err := s.networksManager.StartContainer(id); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Container started",
		"id":      id,
	})
}

func (s *Server) stopContainer(c *gin.Context) {
	id := c.Param("id")

	if err := s.networksManager.StopContainer(id); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Container stopped",
		"id":      id,
	})
}

func (s *Server) restartContainer(c *gin.Context) {
	id := c.Param("id")

	if err := s.networksManager.RestartContainer(id); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Container restarted",
		"id":      id,
	})
}

func (s *Server) removeContainer(c *gin.Context) {
	id := c.Param("id")

	if err := s.networksManager.RemoveContainer(id); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Container removed",
		"id":      id,
	})
}

func (s *Server) getContainerLogs(c *gin.Context) {
	id := c.Param("id")

	tailStr := c.DefaultQuery("tail", "100")
	tail, err := strconv.Atoi(tailStr)
	if err != nil {
		tail = 100
	}

	logs, err := s.networksManager.GetContainerLogs(id, tail)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"id":   id,
		"logs": logs,
	})
}

func (s *Server) getContainerStats(c *gin.Context) {
	id := c.Param("id")

	stats, err := docker.GetContainerStats(id)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"stats": stats,
	})
}

func (s *Server) getAllContainerStats(c *gin.Context) {
	stats, err := docker.GetAllContainerStats()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"stats": stats,
	})
}

func (s *Server) getDeploymentContainerStats(c *gin.Context) {
	name := c.Param("name")

	if _, err := s.manager.GetDeployment(name); err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "deployment not found",
		})
		return
	}

	stats, _ := docker.GetDeploymentStats(name)
	if stats == nil {
		stats = []docker.ContainerStats{}
	}

	var totalCPU, totalMemPercent float64
	var totalMemUsage, totalMemLimit uint64
	for _, s := range stats {
		totalCPU += s.CPUPercent
		totalMemPercent += s.MemoryPercent
		totalMemUsage += s.MemoryUsage
		totalMemLimit += s.MemoryLimit
	}

	c.JSON(http.StatusOK, gin.H{
		"deployment": name,
		"services":   stats,
		"summary": gin.H{
			"cpu_percent":    totalCPU,
			"memory_percent": totalMemPercent,
			"memory_usage":   totalMemUsage,
			"memory_limit":   totalMemLimit,
		},
	})
}

func (s *Server) listImages(c *gin.Context) {
	images, err := s.networksManager.ListImages()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"images": images,
	})
}

func (s *Server) removeImage(c *gin.Context) {
	id := c.Param("id")

	if err := s.networksManager.RemoveImage(id); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Image removed",
		"id":      id,
	})
}

func (s *Server) pullImage(c *gin.Context) {
	var req struct {
		Name         string `json:"name" binding:"required"`
		CredentialID string `json:"credential_id"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	var cred *models.RegistryCredential
	var err error

	if req.CredentialID != "" {
		cred, err = s.credentialsManager.GetCredential(req.CredentialID)
		if err != nil {
			c.JSON(http.StatusBadRequest, gin.H{
				"error": "Invalid credential_id: " + err.Error(),
			})
			return
		}
	} else {
		cred = s.credentialsManager.FindCredentialForImage(req.Name)
	}

	if cred != nil {
		if err := credentials.PullImageWithAuth(req.Name, cred); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": err.Error(),
			})
			return
		}
	} else {
		if err := s.networksManager.PullImage(req.Name); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": err.Error(),
			})
			return
		}
	}

	c.JSON(http.StatusOK, gin.H{
		"message":         "Image pulled",
		"name":            req.Name,
		"used_credential": cred != nil,
	})
}

func (s *Server) listVolumes(c *gin.Context) {
	volumes, err := s.networksManager.ListVolumes()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"volumes": volumes,
	})
}

func (s *Server) createVolume(c *gin.Context) {
	var req struct {
		Name   string            `json:"name" binding:"required"`
		Driver string            `json:"driver"`
		Labels map[string]string `json:"labels"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if req.Driver == "" {
		req.Driver = "local"
	}

	if err := s.networksManager.CreateVolume(req.Name, req.Driver, req.Labels); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusCreated, gin.H{
		"message": "Volume created",
		"name":    req.Name,
	})
}

func (s *Server) removeVolume(c *gin.Context) {
	name := c.Param("name")

	if err := s.networksManager.RemoveVolume(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Volume removed",
		"name":    name,
	})
}

func (s *Server) pruneVolumes(c *gin.Context) {
	count, err := s.networksManager.PruneVolumes()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Unused volumes pruned",
		"count":   count,
	})
}

func (s *Server) listPorts(c *gin.Context) {
	ports, err := s.networksManager.ListPorts()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"ports": ports,
	})
}

func (s *Server) killProcess(c *gin.Context) {
	pidStr := c.Param("pid")
	pid, err := strconv.Atoi(pidStr)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": "Invalid PID",
		})
		return
	}

	if err := s.networksManager.KillProcess(pid); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Process killed",
		"pid":     pid,
	})
}

func toTitleCase(s string) string {
	words := strings.Fields(s)
	for i, word := range words {
		if len(word) > 0 {
			words[i] = strings.ToUpper(string(word[0])) + strings.ToLower(word[1:])
		}
	}
	return strings.Join(words, " ")
}

func corsMiddleware(allowedOrigins []string) gin.HandlerFunc {
	return func(c *gin.Context) {
		origin := c.Request.Header.Get("Origin")

		for _, allowed := range allowedOrigins {
			if origin == allowed || allowed == "*" {
				c.Writer.Header().Set("Access-Control-Allow-Origin", origin)
				break
			}
		}

		c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
		c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With")
		c.Writer.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS, GET, PUT, DELETE")

		if c.Request.Method == "OPTIONS" {
			c.AbortWithStatus(204)
			return
		}

		c.Next()
	}
}

func (s *Server) listDeploymentFiles(c *gin.Context) {
	name := c.Param("name")
	path := c.DefaultQuery("path", "/")

	filesList, err := s.filesManager.ListFiles(name, path)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"files": filesList,
		"path":  path,
	})
}

func (s *Server) getDeploymentFile(c *gin.Context) {
	name := c.Param("name")
	path := c.Param("path")

	if c.Query("info") == "true" {
		info, err := s.filesManager.GetFileInfo(name, path)
		if err != nil {
			c.JSON(http.StatusNotFound, gin.H{
				"error": err.Error(),
			})
			return
		}
		c.JSON(http.StatusOK, info)
		return
	}

	if c.Query("list") == "true" {
		filesList, err := s.filesManager.ListFiles(name, path)
		if err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"error": err.Error(),
			})
			return
		}
		c.JSON(http.StatusOK, gin.H{
			"files": filesList,
			"path":  path,
		})
		return
	}

	file, info, err := s.filesManager.ReadFile(name, path)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": err.Error(),
		})
		return
	}
	defer file.Close()

	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=%s", info.Name))
	c.Header("Content-Length", fmt.Sprintf("%d", info.Size))
	c.DataFromReader(http.StatusOK, info.Size, "application/octet-stream", file, nil)
}

func (s *Server) uploadDeploymentFile(c *gin.Context) {
	name := c.Param("name")
	path := c.Param("path")

	file, _, err := c.Request.FormFile("file")
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": "No file provided",
		})
		return
	}
	defer file.Close()

	if err := s.filesManager.WriteFile(name, path, file); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	info, _ := s.filesManager.GetFileInfo(name, path)
	c.JSON(http.StatusOK, gin.H{
		"message": "File uploaded successfully",
		"file":    info,
	})
}

func (s *Server) deleteDeploymentFile(c *gin.Context) {
	name := c.Param("name")
	path := c.Param("path")

	if err := s.filesManager.DeleteFile(name, path); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Deleted successfully",
	})
}

func (s *Server) createDeploymentDir(c *gin.Context) {
	name := c.Param("name")
	path := c.Param("path")

	if err := s.filesManager.CreateDirectory(name, path); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	info, _ := s.filesManager.GetFileInfo(name, path)
	c.JSON(http.StatusOK, gin.H{
		"message":   "Directory created",
		"directory": info,
	})
}

func (s *Server) getDeploymentFilesInfo(c *gin.Context) {
	name := c.Param("name")

	usage, err := s.filesManager.GetDiskUsage(name)
	if err != nil {
		usage = 0
	}

	mountPath, _ := s.filesManager.GetMountPath(name, "/")

	c.JSON(http.StatusOK, gin.H{
		"deployment": name,
		"disk_usage": usage,
		"mount_path": mountPath,
	})
}

func (s *Server) listSystemServices(c *gin.Context) {
	services, err := s.servicesManager.ListServices()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"services": services,
	})
}

func (s *Server) startSystemService(c *gin.Context) {
	name := c.Param("name")

	if err := s.servicesManager.StartService(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Service started",
		"name":    name,
	})
}

func (s *Server) stopSystemService(c *gin.Context) {
	name := c.Param("name")

	if err := s.servicesManager.StopService(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Service stopped",
		"name":    name,
	})
}

func (s *Server) restartSystemService(c *gin.Context) {
	name := c.Param("name")

	if err := s.servicesManager.RestartService(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Service restarted",
		"name":    name,
	})
}

func (s *Server) testDatabaseConnection(c *gin.Context) {
	var cfg database.ConnectionConfig
	if err := c.ShouldBindJSON(&cfg); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.databaseManager.TestConnection(&cfg); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error":   err.Error(),
			"success": false,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"success": true,
		"message": "Connection successful",
	})
}

func (s *Server) listDatabasesInServer(c *gin.Context) {
	var cfg database.ConnectionConfig
	if err := c.ShouldBindJSON(&cfg); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	databases, err := s.databaseManager.ListDatabases(&cfg)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"databases": databases,
	})
}

func (s *Server) listDatabaseTables(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		Database string `json:"database" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	tables, err := s.databaseManager.ListTables(&req.ConnectionConfig, req.Database)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"tables": tables,
	})
}

func (s *Server) listDatabaseUsers(c *gin.Context) {
	var cfg database.ConnectionConfig
	if err := c.ShouldBindJSON(&cfg); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	users, err := s.databaseManager.ListUsers(&cfg)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"users": users,
	})
}

func (s *Server) listUsersByDatabase(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		Database string `json:"database" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	users, err := s.databaseManager.ListDatabaseUsers(&req.ConnectionConfig, req.Database)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"users": users,
	})
}

func (s *Server) createDatabaseInServer(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		DbName string `json:"db_name" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.databaseManager.CreateDatabase(&req.ConnectionConfig, req.DbName); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusCreated, gin.H{
		"message": "Database created",
		"name":    req.DbName,
	})
}

func (s *Server) createDatabaseUser(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		TargetUsername string `json:"target_username" binding:"required"`
		TargetPassword string `json:"target_password" binding:"required"`
		TargetHost     string `json:"target_host"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.databaseManager.CreateUser(&req.ConnectionConfig, req.TargetUsername, req.TargetPassword, req.TargetHost); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusCreated, gin.H{
		"message":  "User created",
		"username": req.TargetUsername,
	})
}

func (s *Server) grantDatabasePrivileges(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		TargetUsername string `json:"target_username" binding:"required"`
		TargetDatabase string `json:"target_database" binding:"required"`
		TargetHost     string `json:"target_host"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.databaseManager.GrantPrivileges(&req.ConnectionConfig, req.TargetUsername, req.TargetDatabase, req.TargetHost); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":  "Privileges granted",
		"username": req.TargetUsername,
		"database": req.TargetDatabase,
	})
}

func (s *Server) deleteDatabaseInServer(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		DbName string `json:"db_name" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.databaseManager.DeleteDatabase(&req.ConnectionConfig, req.DbName); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Database deleted",
		"name":    req.DbName,
	})
}

func (s *Server) deleteDatabaseUser(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		TargetUsername string `json:"target_username" binding:"required"`
		TargetHost     string `json:"target_host"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	if err := s.databaseManager.DeleteUser(&req.ConnectionConfig, req.TargetUsername, req.TargetHost); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":  "User deleted",
		"username": req.TargetUsername,
	})
}

func (s *Server) queryTableData(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		Database string `json:"database" binding:"required"`
		Table    string `json:"table" binding:"required"`
		Limit    int    `json:"limit"`
		Offset   int    `json:"offset"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	result, err := s.databaseManager.QueryTable(&req.ConnectionConfig, req.Database, req.Table, req.Limit, req.Offset)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, result)
}

func (s *Server) describeTable(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		Database string `json:"database" binding:"required"`
		Table    string `json:"table" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	schema, err := s.databaseManager.DescribeTable(&req.ConnectionConfig, req.Database, req.Table)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, schema)
}

func (s *Server) executeDatabaseQuery(c *gin.Context) {
	var req struct {
		database.ConnectionConfig
		Database string `json:"database" binding:"required"`
		Query    string `json:"query" binding:"required"`
	}
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	result, err := s.databaseManager.ExecuteQuery(&req.ConnectionConfig, req.Database, req.Query)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, result)
}

func (s *Server) listInfrastructure(c *gin.Context) {
	services, err := s.infraManager.ListServices()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	infraDeployments, err := s.manager.ListInfrastructure()
	if err == nil {
		existingNames := make(map[string]bool)
		for _, svc := range services {
			existingNames[svc.Name] = true
		}

		for _, dep := range infraDeployments {
			if existingNames[dep.Name] {
				continue
			}
			depType := "infrastructure"
			if dep.Metadata != nil && dep.Metadata.Type != "" {
				depType = dep.Metadata.Type
			}
			services = append(services, models.InfraService{
				Name:    dep.Name,
				Type:    depType,
				Status:  dep.Status,
				Managed: true,
			})
		}
	}

	c.JSON(http.StatusOK, gin.H{
		"services": services,
	})
}

func (s *Server) getInfraService(c *gin.Context) {
	name := c.Param("name")

	service, err := s.infraManager.GetService(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"service": service,
	})
}

func (s *Server) startInfraService(c *gin.Context) {
	name := c.Param("name")

	if err := s.infraManager.StartService(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Service started",
		"name":    name,
	})
}

func (s *Server) stopInfraService(c *gin.Context) {
	name := c.Param("name")

	if err := s.infraManager.StopService(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Service stopped",
		"name":    name,
	})
}

func (s *Server) restartInfraService(c *gin.Context) {
	name := c.Param("name")

	if err := s.infraManager.RestartService(name); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Service restarted",
		"name":    name,
	})
}

func (s *Server) getInfraServiceLogs(c *gin.Context) {
	name := c.Param("name")

	tailStr := c.DefaultQuery("tail", "100")
	tail, err := strconv.Atoi(tailStr)
	if err != nil {
		tail = 100
	}

	logs, err := s.infraManager.GetServiceLogs(name, tail)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"name": name,
		"logs": logs,
	})
}

func (s *Server) getInfraStats(c *gin.Context) {
	stats, err := s.infraManager.GetStats()
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"stats": stats,
	})
}

func (s *Server) migrateToInfrastructure(c *gin.Context) {
	name := c.Param("name")

	deployment, err := s.manager.GetDeployment(name)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": "Deployment not found",
		})
		return
	}

	metadata := deployment.Metadata
	if metadata == nil {
		metadata = &models.ServiceMetadata{
			Name: name,
		}
	}
	metadata.Type = "infrastructure"

	if err := s.manager.SaveMetadata(name, metadata); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Deployment marked as infrastructure",
		"name":    name,
	})
}

func (s *Server) listRegistryTypes(c *gin.Context) {
	types := s.credentialsManager.ListRegistryTypes()
	c.JSON(http.StatusOK, gin.H{
		"registry_types": types,
	})
}

func (s *Server) getRegistryType(c *gin.Context) {
	slug := c.Param("slug")

	rt, err := s.credentialsManager.GetRegistryType(slug)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"registry_type": rt,
	})
}

func (s *Server) createRegistryType(c *gin.Context) {
	var req struct {
		Name        string   `json:"name" binding:"required"`
		URLPatterns []string `json:"url_patterns" binding:"required"`
		AuthType    string   `json:"auth_type"`
		LoginURL    string   `json:"login_url"`
		DocsURL     string   `json:"docs_url"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	authType := models.AuthTypeBasic
	if req.AuthType == "token" {
		authType = models.AuthTypeToken
	}

	rt, err := s.credentialsManager.CreateRegistryType(req.Name, req.URLPatterns, authType, req.LoginURL, req.DocsURL)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusCreated, gin.H{
		"message":       "Registry type created",
		"registry_type": rt,
	})
}

func (s *Server) updateRegistryType(c *gin.Context) {
	slug := c.Param("slug")

	var req struct {
		Name        string   `json:"name"`
		URLPatterns []string `json:"url_patterns"`
		AuthType    string   `json:"auth_type"`
		LoginURL    string   `json:"login_url"`
		DocsURL     string   `json:"docs_url"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	var authType models.AuthType
	if req.AuthType == "basic" {
		authType = models.AuthTypeBasic
	} else if req.AuthType == "token" {
		authType = models.AuthTypeToken
	}

	rt, err := s.credentialsManager.UpdateRegistryType(slug, req.Name, req.URLPatterns, authType, req.LoginURL, req.DocsURL)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message":       "Registry type updated",
		"registry_type": rt,
	})
}

func (s *Server) deleteRegistryType(c *gin.Context) {
	slug := c.Param("slug")

	if err := s.credentialsManager.DeleteRegistryType(slug); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Registry type deleted",
		"slug":    slug,
	})
}

func (s *Server) listCredentials(c *gin.Context) {
	creds := s.credentialsManager.ListCredentials()
	c.JSON(http.StatusOK, gin.H{
		"credentials": creds,
	})
}

func (s *Server) getCredential(c *gin.Context) {
	id := c.Param("id")

	cred, err := s.credentialsManager.GetCredential(id)
	if err != nil {
		c.JSON(http.StatusNotFound, gin.H{
			"error": err.Error(),
		})
		return
	}

	rt, _ := s.credentialsManager.GetRegistryType(cred.RegistryTypeSlug)

	c.JSON(http.StatusOK, gin.H{
		"credential": models.RegistryCredentialWithType{
			RegistryCredential: *cred,
			RegistryType:       rt,
		},
	})
}

func (s *Server) createCredential(c *gin.Context) {
	var req struct {
		Name             string `json:"name" binding:"required"`
		RegistryTypeSlug string `json:"registry_type_slug" binding:"required"`
		Username         string `json:"username" binding:"required"`
		Password         string `json:"password" binding:"required"`
		Email            string `json:"email"`
		IsDefault        bool   `json:"is_default"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	cred, err := s.credentialsManager.CreateCredential(req.Name, req.RegistryTypeSlug, req.Username, req.Password, req.Email, req.IsDefault)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	rt, _ := s.credentialsManager.GetRegistryType(cred.RegistryTypeSlug)

	c.JSON(http.StatusCreated, gin.H{
		"message": "Credential created",
		"credential": models.RegistryCredentialWithType{
			RegistryCredential: *cred,
			RegistryType:       rt,
		},
	})
}

func (s *Server) updateCredential(c *gin.Context) {
	id := c.Param("id")

	var req struct {
		Name      string `json:"name"`
		Username  string `json:"username"`
		Password  string `json:"password"`
		Email     string `json:"email"`
		IsDefault *bool  `json:"is_default"`
	}

	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	cred, err := s.credentialsManager.UpdateCredential(id, req.Name, req.Username, req.Password, req.Email, req.IsDefault)
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	rt, _ := s.credentialsManager.GetRegistryType(cred.RegistryTypeSlug)

	c.JSON(http.StatusOK, gin.H{
		"message": "Credential updated",
		"credential": models.RegistryCredentialWithType{
			RegistryCredential: *cred,
			RegistryType:       rt,
		},
	})
}

func (s *Server) deleteCredential(c *gin.Context) {
	id := c.Param("id")

	if err := s.credentialsManager.DeleteCredential(id); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error": err.Error(),
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Credential deleted",
		"id":      id,
	})
}

func (s *Server) testCredential(c *gin.Context) {
	id := c.Param("id")

	if err := s.credentialsManager.TestCredential(id); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{
			"error":   err.Error(),
			"success": false,
		})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"message": "Credential test successful",
		"success": true,
	})
}