delete all (remote) backups when server is deleted

Co-authored-by: Boy132 <mail@boy132.de>

app/Console/Commands/Egg/UpdateEggIndexCommand.php

@@ -13,7 +13,7 @@ class UpdateEggIndexCommand extends Command
     public function handle(): int
     {
         try {
-            $data = Http::timeout(5)->connectTimeout(1)->get('https://raw.githubusercontent.com/pelican-eggs/pelican-eggs.github.io/refs/heads/main/content/pelican.json')->throw()->json();
+            $data = Http::timeout(5)->connectTimeout(1)->get(config('panel.cdn.egg_index_url'))->throw()->json();
         } catch (Exception $exception) {
             $this->error($exception->getMessage());
 

app/Enums/RolePermissionModels.php

@@ -6,6 +6,7 @@ enum RolePermissionModels: string
 {
     case ApiKey = 'apiKey';
     case Allocation = 'allocation';
+    case BackupHost = 'backupHost';
     case DatabaseHost = 'databaseHost';
     case Database = 'database';
     case Egg = 'egg';

app/Enums/SubuserPermission.php

@@ -50,6 +50,9 @@ enum SubuserPermission: string
 
     case ActivityRead = 'activity.read';
 
+    case MountRead = 'mount.read';
+    case MountUpdate = 'mount.update';
+
     case StartupRead = 'startup.read';
     case StartupUpdate = 'startup.update';
     case StartupDockerImage = 'startup.docker-image';
@@ -57,6 +60,7 @@ enum SubuserPermission: string
     case SettingsRename = 'settings.rename';
     case SettingsDescription = 'settings.description';
     case SettingsReinstall = 'settings.reinstall';
+    case SettingsChangeIcon = 'settings.change-icon';
 
     /** @return string[] */
     public function split(): array
@@ -84,6 +88,7 @@ enum SubuserPermission: string
             'schedule' => TablerIcon::Clock,
             'settings' => TablerIcon::Settings,
             'activity' => TablerIcon::Stack,
+            'mount' => TablerIcon::LayersLinked,
             default => null,
         };
     }

app/Events/User/Deleting.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Events\User;
+
+use App\Events\Event;
+use App\Models\User;
+use Illuminate\Queue\SerializesModels;
+
+class Deleting extends Event
+{
+    use SerializesModels;
+
+    /**
+     * Create a new event instance.
+     */
+    public function __construct(public User $user) {}
+}

app/Events/User/PasswordChanged.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Events\User;
+
+use App\Models\User;
+use Illuminate\Foundation\Events\Dispatchable;
+
+final class PasswordChanged
+{
+    use Dispatchable;
+
+    public function __construct(public readonly User $user) {}
+}

app/Extensions/BackupAdapter/BackupAdapterSchemaInterface.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Extensions\BackupAdapter;
+
+use App\Models\Backup;
+use App\Models\User;
+use Filament\Schemas\Components\Component;
+
+interface BackupAdapterSchemaInterface
+{
+    public function getId(): string;
+
+    public function getName(): string;
+
+    public function createBackup(Backup $backup): void;
+
+    public function deleteBackup(Backup $backup): void;
+
+    public function getDownloadLink(Backup $backup, User $user): string;
+
+    /** @return Component[] */
+    public function getConfigurationForm(): array;
+}

app/Extensions/BackupAdapter/BackupAdapterService.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Extensions\BackupAdapter;
+
+class BackupAdapterService
+{
+    /** @var array<string, BackupAdapterSchemaInterface> */
+    private array $schemas = [];
+
+    /** @return BackupAdapterSchemaInterface[] */
+    public function getAll(): array
+    {
+        return $this->schemas;
+    }
+
+    public function get(string $id): ?BackupAdapterSchemaInterface
+    {
+        return array_get($this->schemas, $id);
+    }
+
+    public function register(BackupAdapterSchemaInterface $schema): void
+    {
+        if (array_key_exists($schema->getId(), $this->schemas)) {
+            return;
+        }
+
+        $this->schemas[$schema->getId()] = $schema;
+    }
+
+    /** @return array<string, string> */
+    public function getMappings(): array
+    {
+        return collect($this->schemas)->mapWithKeys(fn ($schema) => [$schema->getId() => $schema->getName()])->all();
+    }
+}

app/Extensions/BackupAdapter/Schemas/BackupAdapterSchema.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Extensions\BackupAdapter\Schemas;
+
+use App\Extensions\BackupAdapter\BackupAdapterSchemaInterface;
+use Illuminate\Support\Str;
+
+abstract class BackupAdapterSchema implements BackupAdapterSchemaInterface
+{
+    public function getName(): string
+    {
+        return Str::title($this->getId());
+    }
+}

app/Extensions/BackupAdapter/Schemas/S3BackupSchema.php

@@ -0,0 +1,207 @@
+<?php
+
+namespace App\Extensions\BackupAdapter\Schemas;
+
+use App\Enums\TablerIcon;
+use App\Http\Controllers\Api\Remote\Backups\BackupRemoteUploadController;
+use App\Models\Backup;
+use App\Models\BackupHost;
+use App\Models\User;
+use App\Repositories\Daemon\DaemonBackupRepository;
+use Aws\S3\S3Client;
+use Carbon\CarbonImmutable;
+use Exception;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Component;
+use Filament\Schemas\Components\StateCasts\BooleanStateCast;
+use Illuminate\Support\Arr;
+
+final class S3BackupSchema extends BackupAdapterSchema
+{
+    public function __construct(private readonly DaemonBackupRepository $repository) {}
+
+    private function createClient(BackupHost $backupHost): S3Client
+    {
+        $config = $backupHost->configuration;
+        $config['version'] = 'latest';
+
+        if (!empty($config['key']) && !empty($config['secret'])) {
+            $config['credentials'] = Arr::only($config, ['key', 'secret', 'token']);
+        }
+
+        return new S3Client($config);
+    }
+
+    public function getId(): string
+    {
+        return 's3';
+    }
+
+    public function createBackup(Backup $backup): void
+    {
+        $this->repository->setServer($backup->server)->create($backup);
+    }
+
+    public function deleteBackup(Backup $backup): void
+    {
+        $client = $this->createClient($backup->backupHost);
+
+        $client->deleteObject([
+            'Bucket' => $backup->backupHost->configuration['bucket'],
+            'Key' => "{$backup->server->uuid}/$backup->uuid.tar.gz",
+        ]);
+    }
+
+    public function getDownloadLink(Backup $backup, User $user): string
+    {
+        $client = $this->createClient($backup->backupHost);
+
+        $request = $client->createPresignedRequest(
+            $client->getCommand('GetObject', [
+                'Bucket' => $backup->backupHost->configuration['bucket'],
+                'Key' => "{$backup->server->uuid}/$backup->uuid.tar.gz",
+                'ContentType' => 'application/x-gzip',
+            ]),
+            CarbonImmutable::now()->addMinutes(5)
+        );
+
+        return $request->getUri()->__toString();
+    }
+
+    /** @return Component[] */
+    public function getConfigurationForm(): array
+    {
+        return [
+            TextInput::make('configuration.region')
+                ->label(trans('admin/setting.backup.s3.default_region'))
+                ->required(),
+            TextInput::make('configuration.key')
+                ->label(trans('admin/setting.backup.s3.access_key'))
+                ->required(),
+            TextInput::make('configuration.secret')
+                ->label(trans('admin/setting.backup.s3.secret_key'))
+                ->required(),
+            TextInput::make('configuration.bucket')
+                ->label(trans('admin/setting.backup.s3.bucket'))
+                ->required(),
+            TextInput::make('configuration.endpoint')
+                ->label(trans('admin/setting.backup.s3.endpoint'))
+                ->required(),
+            Toggle::make('configuration.use_path_style_endpoint')
+                ->label(trans('admin/setting.backup.s3.use_path_style_endpoint'))
+                ->inline(false)
+                ->onIcon(TablerIcon::Check)
+                ->offIcon(TablerIcon::X)
+                ->onColor('success')
+                ->offColor('danger')
+                ->live()
+                ->stateCast(new BooleanStateCast(false)),
+        ];
+    }
+
+    /** @return array{parts: string[], part_size: int} */
+    public function getUploadParts(Backup $backup, int $size): array
+    {
+        $expires = CarbonImmutable::now()->addMinutes(config('backups.presigned_url_lifespan', 60));
+
+        // Params for generating the presigned urls
+        $params = [
+            'Bucket' => $backup->backupHost->configuration['bucket'],
+            'Key' => "{$backup->server->uuid}/$backup->uuid.tar.gz",
+            'ContentType' => 'application/x-gzip',
+        ];
+
+        $storageClass = $backup->backupHost->configuration['storage_class'];
+        if (!is_null($storageClass)) {
+            $params['StorageClass'] = $storageClass;
+        }
+
+        $client = $this->createClient($backup->backupHost);
+
+        // Execute the CreateMultipartUpload request
+        $result = $client->execute($client->getCommand('CreateMultipartUpload', $params));
+
+        // Get the UploadId from the CreateMultipartUpload request, this is needed to create
+        // the other presigned urls.
+        $params['UploadId'] = $result->get('UploadId');
+
+        // Retrieve configured part size
+        $maxPartSize = config('backups.max_part_size', BackupRemoteUploadController::DEFAULT_MAX_PART_SIZE);
+        if ($maxPartSize <= 0) {
+            $maxPartSize = BackupRemoteUploadController::DEFAULT_MAX_PART_SIZE;
+        }
+
+        // Create as many UploadPart presigned urls as needed
+        $parts = [];
+        for ($i = 0; $i < ($size / $maxPartSize); $i++) {
+            $parts[] = $client->createPresignedRequest(
+                $client->getCommand('UploadPart', array_merge($params, ['PartNumber' => $i + 1])),
+                $expires
+            )->getUri()->__toString();
+        }
+
+        // Set the upload_id on the backup in the database.
+        $backup->update(['upload_id' => $params['UploadId']]);
+
+        return [
+            'parts' => $parts,
+            'part_size' => $maxPartSize,
+        ];
+    }
+
+    /**
+     * Marks a multipart upload in a given S3-compatible instance as failed or successful for the given backup.
+     *
+     * @param  ?array<array{int, etag: string, part_number: string}>  $parts
+     *
+     * @throws Exception
+     */
+    public function completeMultipartUpload(Backup $backup, bool $successful, ?array $parts): void
+    {
+        // This should never really happen, but if it does don't let us fall victim to Amazon's
+        // wildly fun error messaging. Just stop the process right here.
+        if (empty($backup->upload_id)) {
+            // A failed backup doesn't need to error here, this can happen if the backup encounters
+            // an error before we even start the upload. AWS gives you tooling to clear these failed
+            // multipart uploads as needed too.
+            if (!$successful) {
+                return;
+            }
+
+            throw new Exception('Cannot complete backup request: no upload_id present on model.');
+        }
+
+        $params = [
+            'Bucket' => $backup->backupHost->configuration['bucket'],
+            'Key' => "{$backup->server->uuid}/$backup->uuid.tar.gz",
+            'UploadId' => $backup->upload_id,
+        ];
+
+        $client = $this->createClient($backup->backupHost);
+
+        if (!$successful) {
+            $client->execute($client->getCommand('AbortMultipartUpload', $params));
+
+            return;
+        }
+
+        // Otherwise send a CompleteMultipartUpload request.
+        $params['MultipartUpload'] = [
+            'Parts' => [],
+        ];
+
+        if (is_null($parts)) {
+            $params['MultipartUpload']['Parts'] = $client->execute($client->getCommand('ListParts', $params))['Parts'];
+        } else {
+            foreach ($parts as $part) {
+                $params['MultipartUpload']['Parts'][] = [
+                    'ETag' => $part['etag'],
+                    'PartNumber' => $part['part_number'],
+                ];
+            }
+        }
+
+        $client->execute($client->getCommand('CompleteMultipartUpload', $params));
+    }
+}

app/Extensions/BackupAdapter/Schemas/WingsBackupSchema.php

@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Extensions\BackupAdapter\Schemas;
+
+use App\Models\Backup;
+use App\Models\User;
+use App\Repositories\Daemon\DaemonBackupRepository;
+use App\Services\Nodes\NodeJWTService;
+use Carbon\CarbonImmutable;
+use Exception;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Component;
+use Illuminate\Http\Response;
+
+final class WingsBackupSchema extends BackupAdapterSchema
+{
+    public function __construct(private readonly DaemonBackupRepository $repository, private readonly NodeJWTService $jwtService) {}
+
+    public function getId(): string
+    {
+        return 'wings';
+    }
+
+    public function createBackup(Backup $backup): void
+    {
+        $this->repository->setServer($backup->server)->create($backup);
+    }
+
+    /** @throws Exception */
+    public function deleteBackup(Backup $backup): void
+    {
+        try {
+            $this->repository->setServer($backup->server)->delete($backup);
+        } catch (Exception $exception) {
+            // Don't fail the request if the Daemon responds with a 404, just assume the backup
+            // doesn't actually exist and remove its reference from the Panel as well.
+            if ($exception->getCode() !== Response::HTTP_NOT_FOUND) {
+                throw $exception;
+            }
+        }
+    }
+
+    public function getDownloadLink(Backup $backup, User $user): string
+    {
+        $token = $this->jwtService
+            ->setExpiresAt(CarbonImmutable::now()->addMinutes(15))
+            ->setUser($user)
+            ->setClaims([
+                'backup_uuid' => $backup->uuid,
+                'server_uuid' => $backup->server->uuid,
+            ])
+            ->handle($backup->server->node, $user->id . $backup->server->uuid);
+
+        return $backup->server->node->getConnectionAddress() . '/download/backup?token=' . $token->toString();
+    }
+
+    /** @return Component[] */
+    public function getConfigurationForm(): array
+    {
+        return [
+            TextEntry::make(trans('admin/backuphost.no_configuration')),
+        ];
+    }
+}

app/Extensions/Backups/BackupManager.php

@@ -1,177 +0,0 @@
-<?php
-
-namespace App\Extensions\Backups;
-
-use App\Extensions\Filesystem\S3Filesystem;
-use Aws\S3\S3Client;
-use Closure;
-use Illuminate\Foundation\Application;
-use Illuminate\Support\Arr;
-use Illuminate\Support\Str;
-use InvalidArgumentException;
-use League\Flysystem\FilesystemAdapter;
-use League\Flysystem\InMemory\InMemoryFilesystemAdapter;
-use Webmozart\Assert\Assert;
-
-class BackupManager
-{
-    /**
-     * The array of resolved backup drivers.
-     *
-     * @var array<string, FilesystemAdapter>
-     */
-    protected array $adapters = [];
-
-    /**
-     * The registered custom driver creators.
-     *
-     * @var array<string, callable>
-     */
-    protected array $customCreators;
-
-    public function __construct(protected Application $app) {}
-
-    /**
-     * Returns a backup adapter instance.
-     */
-    public function adapter(?string $name = null): FilesystemAdapter
-    {
-        return $this->get($name ?: $this->getDefaultAdapter());
-    }
-
-    /**
-     * Set the given backup adapter instance.
-     */
-    public function set(string $name, FilesystemAdapter $disk): self
-    {
-        $this->adapters[$name] = $disk;
-
-        return $this;
-    }
-
-    /**
-     * Gets a backup adapter.
-     */
-    protected function get(string $name): FilesystemAdapter
-    {
-        return $this->adapters[$name] = $this->resolve($name);
-    }
-
-    /**
-     * Resolve the given backup disk.
-     */
-    protected function resolve(string $name): FilesystemAdapter
-    {
-        $config = $this->getConfig($name);
-
-        if (empty($config['adapter'])) {
-            throw new InvalidArgumentException("Backup disk [$name] does not have a configured adapter.");
-        }
-
-        $adapter = $config['adapter'];
-
-        if (isset($this->customCreators[$name])) {
-            return $this->callCustomCreator($config);
-        }
-
-        $adapterMethod = 'create' . Str::studly($adapter) . 'Adapter';
-        if (method_exists($this, $adapterMethod)) {
-            $instance = $this->{$adapterMethod}($config);
-
-            Assert::isInstanceOf($instance, FilesystemAdapter::class);
-
-            return $instance;
-        }
-
-        throw new InvalidArgumentException("Adapter [$adapter] is not supported.");
-    }
-
-    /**
-     * Calls a custom creator for a given adapter type.
-     *
-     * @param  array{adapter: string}  $config
-     */
-    protected function callCustomCreator(array $config): mixed
-    {
-        return $this->customCreators[$config['adapter']]($this->app, $config);
-    }
-
-    /**
-     * Creates a new daemon adapter.
-     *
-     * @param  array<string, string>  $config
-     */
-    public function createWingsAdapter(array $config): FilesystemAdapter
-    {
-        return new InMemoryFilesystemAdapter();
-    }
-
-    /**
-     * Creates a new S3 adapter.
-     *
-     * @param  array<string, string>  $config
-     */
-    public function createS3Adapter(array $config): FilesystemAdapter
-    {
-        $config['version'] = 'latest';
-
-        if (!empty($config['key']) && !empty($config['secret'])) {
-            $config['credentials'] = Arr::only($config, ['key', 'secret', 'token']);
-        }
-
-        $client = new S3Client($config);
-
-        return new S3Filesystem($client, $config['bucket'], $config['prefix'] ?? '', $config['options'] ?? []);
-    }
-
-    /**
-     * Returns the configuration associated with a given backup type.
-     *
-     * @return array<mixed>
-     */
-    protected function getConfig(string $name): array
-    {
-        return config("backups.disks.$name") ?: [];
-    }
-
-    /**
-     * Get the default backup driver name.
-     */
-    public function getDefaultAdapter(): string
-    {
-        return config('backups.default');
-    }
-
-    /**
-     * Set the default session driver name.
-     */
-    public function setDefaultAdapter(string $name): void
-    {
-        config()->set('backups.default', $name);
-    }
-
-    /**
-     * Unset the given adapter instances.
-     *
-     * @param  string|string[]  $adapter
-     */
-    public function forget(array|string $adapter): self
-    {
-        $adapters = &$this->adapters;
-        foreach ((array) $adapter as $adapterName) {
-            unset($adapters[$adapterName]);
-        }
-
-        return $this;
-    }
-
-    /**
-     * Register a custom adapter creator closure.
-     */
-    public function extend(string $adapter, Closure $callback): self
-    {
-        $this->customCreators[$adapter] = $callback;
-
-        return $this;
-    }
-}

app/Extensions/Filesystem/S3Filesystem.php

@@ -1,38 +0,0 @@
-<?php
-
-namespace App\Extensions\Filesystem;
-
-use Aws\S3\S3ClientInterface;
-use League\Flysystem\AwsS3V3\AwsS3V3Adapter;
-
-class S3Filesystem extends AwsS3V3Adapter
-{
-    /**
-     * @param  array<mixed>  $options
-     */
-    public function __construct(
-        private S3ClientInterface $client,
-        private string $bucket,
-        string $prefix = '',
-        array $options = [],
-    ) {
-        parent::__construct(
-            $client,
-            $bucket,
-            $prefix,
-            null,
-            null,
-            $options,
-        );
-    }
-
-    public function getClient(): S3ClientInterface
-    {
-        return $this->client;
-    }
-
-    public function getBucket(): string
-    {
-        return $this->bucket;
-    }
-}

app/Extensions/Tasks/Schemas/CreateBackupSchema.php

@@ -8,7 +8,7 @@ use App\Services\Backups\InitiateBackupService;
 
 final class CreateBackupSchema extends TaskSchema
 {
-    public function __construct(private InitiateBackupService $backupService) {}
+    public function __construct(private InitiateBackupService $initiateService) {}
 
     public function getId(): string
     {
@@ -17,7 +17,7 @@ final class CreateBackupSchema extends TaskSchema
 
     public function runTask(Task $task): void
     {
-        $this->backupService->setIgnoredFiles(explode(PHP_EOL, $task->payload))->handle($task->server, null, true);
+        $this->initiateService->setIgnoredFiles(explode(PHP_EOL, $task->payload))->handle($task->server, null, true);
     }
 
     public function canCreate(Schedule $schedule): bool

app/Filament/Admin/Pages/Settings.php

@@ -6,7 +6,6 @@ use App\Enums\TablerIcon;
 use App\Extensions\Avatar\AvatarService;
 use App\Extensions\Captcha\CaptchaService;
 use App\Extensions\OAuth\OAuthService;
-use App\Models\Backup;
 use App\Notifications\MailTested;
 use App\Traits\EnvironmentWriterTrait;
 use App\Traits\Filament\CanCustomizeHeaderActions;
@@ -490,16 +489,6 @@ class Settings extends Page implements HasSchemas
     private function backupSettings(): array
     {
         return [
-            ToggleButtons::make('APP_BACKUP_DRIVER')
-                ->label(trans('admin/setting.backup.backup_driver'))
-                ->columnSpanFull()
-                ->inline()
-                ->options([
-                    Backup::ADAPTER_DAEMON => 'Wings',
-                    Backup::ADAPTER_AWS_S3 => 'S3',
-                ])
-                ->live()
-                ->default(env('APP_BACKUP_DRIVER', config('backups.default'))),
             Section::make(trans('admin/setting.backup.throttle'))
                 ->description(trans('admin/setting.backup.throttle_help'))
                 ->columns()
@@ -519,41 +508,6 @@ class Settings extends Page implements HasSchemas
                         ->suffix('Seconds')
                         ->default(config('backups.throttles.period')),
                 ]),
-            Section::make(trans('admin/setting.backup.s3.s3_title'))
-                ->columns()
-                ->visible(fn (Get $get) => $get('APP_BACKUP_DRIVER') === Backup::ADAPTER_AWS_S3)
-                ->schema([
-                    TextInput::make('AWS_DEFAULT_REGION')
-                        ->label(trans('admin/setting.backup.s3.default_region'))
-                        ->required()
-                        ->default(config('backups.disks.s3.region')),
-                    TextInput::make('AWS_ACCESS_KEY_ID')
-                        ->label(trans('admin/setting.backup.s3.access_key'))
-                        ->required()
-                        ->default(config('backups.disks.s3.key')),
-                    TextInput::make('AWS_SECRET_ACCESS_KEY')
-                        ->label(trans('admin/setting.backup.s3.secret_key'))
-                        ->required()
-                        ->default(config('backups.disks.s3.secret')),
-                    TextInput::make('AWS_BACKUPS_BUCKET')
-                        ->label(trans('admin/setting.backup.s3.bucket'))
-                        ->required()
-                        ->default(config('backups.disks.s3.bucket')),
-                    TextInput::make('AWS_ENDPOINT')
-                        ->label(trans('admin/setting.backup.s3.endpoint'))
-                        ->required()
-                        ->default(config('backups.disks.s3.endpoint')),
-                    Toggle::make('AWS_USE_PATH_STYLE_ENDPOINT')
-                        ->label(trans('admin/setting.backup.s3.use_path_style_endpoint'))
-                        ->inline(false)
-                        ->onIcon(TablerIcon::Check)
-                        ->offIcon(TablerIcon::X)
-                        ->onColor('success')
-                        ->offColor('danger')
-                        ->live()
-                        ->stateCast(new BooleanStateCast(false))
-                        ->default(env('AWS_USE_PATH_STYLE_ENDPOINT', config('backups.disks.s3.use_path_style_endpoint'))),
-                ]),
         ];
     }
 

app/Filament/Admin/Resources/BackupHosts/BackupHostResource.php

@@ -0,0 +1,162 @@
+<?php
+
+namespace App\Filament\Admin\Resources\BackupHosts;
+
+use App\Enums\TablerIcon;
+use App\Extensions\BackupAdapter\BackupAdapterService;
+use App\Filament\Admin\Resources\BackupHosts\Pages\CreateBackupHost;
+use App\Filament\Admin\Resources\BackupHosts\Pages\EditBackupHost;
+use App\Filament\Admin\Resources\BackupHosts\Pages\ListBackupHosts;
+use App\Filament\Admin\Resources\BackupHosts\Pages\ViewBackupHost;
+use App\Filament\Admin\Resources\BackupHosts\RelationManagers\BackupsRelationManager;
+use App\Models\BackupHost;
+use App\Traits\Filament\CanCustomizePages;
+use App\Traits\Filament\CanCustomizeRelations;
+use App\Traits\Filament\CanModifyForm;
+use App\Traits\Filament\CanModifyTable;
+use BackedEnum;
+use Exception;
+use Filament\Actions\CreateAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ViewAction;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\Pages\PageRegistration;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Components\Utilities\Get;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class BackupHostResource extends Resource
+{
+    use CanCustomizePages;
+    use CanCustomizeRelations;
+    use CanModifyForm;
+    use CanModifyTable;
+
+    protected static ?string $model = BackupHost::class;
+
+    protected static string|BackedEnum|null $navigationIcon = TablerIcon::FileZip;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    public static function getNavigationBadge(): ?string
+    {
+        return (string) static::getEloquentQuery()->count() ?: null;
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return static::getPluralModelLabel();
+    }
+
+    public static function getModelLabel(): string
+    {
+        return trans_choice('admin/backuphost.model_label', 1);
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return trans_choice('admin/backuphost.model_label', 2);
+    }
+
+    public static function getNavigationGroup(): ?string
+    {
+        return trans('admin/dashboard.advanced');
+    }
+
+    /** @throws Exception */
+    public static function defaultTable(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('name')
+                    ->label(trans('admin/backuphost.name')),
+                TextColumn::make('schema')
+                    ->label(trans('admin/backuphost.schema'))
+                    ->badge(),
+                TextColumn::make('backups_count')
+                    ->counts('backups')
+                    ->label(trans('admin/backuphost.backups')),
+                TextColumn::make('nodes.name')
+                    ->badge()
+                    ->placeholder(trans('admin/backuphost.all_nodes')),
+            ])
+            ->recordActions([
+                ViewAction::make()
+                    ->hidden(fn ($record) => static::getEditAuthorizationResponse($record)->allowed()),
+                EditAction::make(),
+            ])
+            ->toolbarActions([
+                CreateAction::make(),
+            ])
+            ->emptyStateIcon(TablerIcon::FileZip)
+            ->emptyStateDescription(trans('admin/backuphost.local_backups_only'))
+            ->emptyStateHeading(trans('admin/backuphost.no_backup_hosts'));
+    }
+
+    /** @throws Exception */
+    public static function defaultForm(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                TextInput::make('name')
+                    ->label(trans('admin/backuphost.name'))
+                    ->required(),
+                Select::make('schema')
+                    ->label(trans('admin/backuphost.schema'))
+                    ->required()
+                    ->selectablePlaceholder(false)
+                    ->searchable()
+                    ->options(fn (BackupAdapterService $service) => $service->getMappings())
+                    ->live(onBlur: true),
+                Select::make('node_ids')
+                    ->label(trans('admin/backuphost.linked_nodes'))
+                    ->multiple()
+                    ->searchable()
+                    ->preload()
+                    ->relationship('nodes', 'name', fn (Builder $query) => $query->whereIn('nodes.id', user()?->accessibleNodes()->pluck('id'))),
+                Section::make(trans('admin/backuphost.configuration'))
+                    ->columnSpanFull()
+                    ->columns()
+                    ->schema(function (?BackupHost $backupHost, Get $get, BackupAdapterService $service) {
+                        $schema = $get('schema') ?? $backupHost?->schema;
+
+                        if (!$schema) {
+                            return [];
+                        }
+
+                        $schema = $service->get($schema);
+
+                        if ($schema) {
+                            return $schema->getConfigurationForm();
+                        }
+
+                        return [];
+                    }),
+            ]);
+    }
+
+    /** @return class-string<RelationManager>[] */
+    public static function getDefaultRelations(): array
+    {
+        return [
+            BackupsRelationManager::class,
+        ];
+    }
+
+    /** @return array<string, PageRegistration> */
+    public static function getDefaultPages(): array
+    {
+        return [
+            'index' => ListBackupHosts::route('/'),
+            'create' => CreateBackupHost::route('/create'),
+            'view' => ViewBackupHost::route('/{record}'),
+            'edit' => EditBackupHost::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Admin/Resources/BackupHosts/Pages/CreateBackupHost.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Filament\Admin\Resources\BackupHosts\Pages;
+
+use App\Filament\Admin\Resources\BackupHosts\BackupHostResource;
+use App\Traits\Filament\CanCustomizeHeaderActions;
+use App\Traits\Filament\CanCustomizeHeaderWidgets;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateBackupHost extends CreateRecord
+{
+    use CanCustomizeHeaderActions;
+    use CanCustomizeHeaderWidgets;
+
+    protected static string $resource = BackupHostResource::class;
+
+    protected static bool $canCreateAnother = false;
+}

app/Filament/Admin/Resources/BackupHosts/Pages/EditBackupHost.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Filament\Admin\Resources\BackupHosts\Pages;
+
+use App\Enums\TablerIcon;
+use App\Filament\Admin\Resources\BackupHosts\BackupHostResource;
+use App\Models\BackupHost;
+use App\Traits\Filament\CanCustomizeHeaderActions;
+use App\Traits\Filament\CanCustomizeHeaderWidgets;
+use Filament\Actions\Action;
+use Filament\Actions\ActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditBackupHost extends EditRecord
+{
+    use CanCustomizeHeaderActions;
+    use CanCustomizeHeaderWidgets;
+
+    protected static string $resource = BackupHostResource::class;
+
+    /** @return array<Action|ActionGroup> */
+    protected function getDefaultHeaderActions(): array
+    {
+        return [
+            DeleteAction::make()
+                ->label(fn (BackupHost $backupHost) => $backupHost->backups()->count() > 0 ? trans('admin/backuphost.delete_help') : trans('filament-actions::delete.single.modal.actions.delete.label'))
+                ->disabled(fn (BackupHost $backupHost) => $backupHost->backups()->count() > 0)
+                ->hidden(fn () => BackupHost::count() === 1),
+            Action::make('save')
+                ->hiddenLabel()
+                ->action('save')
+                ->keyBindings(['mod+s'])
+                ->tooltip(trans('filament-panels::resources/pages/edit-record.form.actions.save.label'))
+                ->icon(TablerIcon::DeviceFloppy),
+        ];
+    }
+
+    protected function getFormActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Admin/Resources/BackupHosts/Pages/ListBackupHosts.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Filament\Admin\Resources\BackupHosts\Pages;
+
+use App\Filament\Admin\Resources\BackupHosts\BackupHostResource;
+use App\Traits\Filament\CanCustomizeHeaderActions;
+use App\Traits\Filament\CanCustomizeHeaderWidgets;
+use Filament\Resources\Pages\ListRecords;
+
+class ListBackupHosts extends ListRecords
+{
+    use CanCustomizeHeaderActions;
+    use CanCustomizeHeaderWidgets;
+
+    protected static string $resource = BackupHostResource::class;
+}

app/Filament/Admin/Resources/BackupHosts/Pages/ViewBackupHost.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Filament\Admin\Resources\BackupHosts\Pages;
+
+use App\Filament\Admin\Resources\BackupHosts\BackupHostResource;
+use App\Traits\Filament\CanCustomizeHeaderActions;
+use App\Traits\Filament\CanCustomizeHeaderWidgets;
+use Filament\Actions\Action;
+use Filament\Actions\ActionGroup;
+use Filament\Actions\EditAction;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewBackupHost extends ViewRecord
+{
+    use CanCustomizeHeaderActions;
+    use CanCustomizeHeaderWidgets;
+
+    protected static string $resource = BackupHostResource::class;
+
+    /** @return array<Action|ActionGroup> */
+    protected function getDefaultHeaderActions(): array
+    {
+        return [
+            EditAction::make(),
+        ];
+    }
+}

app/Filament/Admin/Resources/BackupHosts/RelationManagers/BackupsRelationManager.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Filament\Admin\Resources\BackupHosts\RelationManagers;
+
+use App\Enums\TablerIcon;
+use App\Filament\Components\Tables\Columns\BytesColumn;
+use App\Filament\Components\Tables\Columns\DateTimeColumn;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+
+class BackupsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'backups';
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('name')
+            ->heading(null)
+            ->columns([
+                TextColumn::make('name')
+                    ->label(trans('server/backup.actions.create.name'))
+                    ->searchable(),
+                BytesColumn::make('bytes')
+                    ->label(trans('server/backup.size')),
+                DateTimeColumn::make('created_at')
+                    ->label(trans('server/backup.created_at'))
+                    ->since()
+                    ->sortable(),
+                TextColumn::make('status')
+                    ->label(trans('server/backup.status'))
+                    ->badge(),
+                IconColumn::make('is_locked')
+                    ->label(trans('server/backup.is_locked'))
+                    ->visibleFrom('md')
+                    ->trueIcon(TablerIcon::Lock)
+                    ->falseIcon(TablerIcon::LockOpen),
+            ]);
+    }
+}

app/Filament/Admin/Resources/Eggs/Pages/EditEgg.php

@@ -5,8 +5,10 @@ namespace App\Filament\Admin\Resources\Eggs\Pages;
 use App\Enums\EditorLanguages;
 use App\Enums\TablerIcon;
 use App\Filament\Admin\Resources\Eggs\EggResource;
+use App\Filament\Components\Actions\DeleteIcon;
 use App\Filament\Components\Actions\ExportEggAction;
 use App\Filament\Components\Actions\ImportEggAction;
+use App\Filament\Components\Actions\UploadIcon;
 use App\Filament\Components\Forms\Fields\CopyFrom;
 use App\Filament\Components\Forms\Fields\MonacoEditor;
 use App\Models\Egg;
@@ -14,12 +16,10 @@ use App\Models\EggVariable;
 use App\Traits\Filament\CanCustomizeHeaderActions;
 use App\Traits\Filament\CanCustomizeHeaderWidgets;
 use App\Traits\Filament\CanCustomizeTabs;
-use Exception;
 use Filament\Actions\Action;
 use Filament\Actions\ActionGroup;
 use Filament\Actions\DeleteAction;
 use Filament\Forms\Components\Checkbox;
-use Filament\Forms\Components\FileUpload;
 use Filament\Forms\Components\Hidden;
 use Filament\Forms\Components\KeyValue;
 use Filament\Forms\Components\Repeater;
@@ -28,11 +28,8 @@ use Filament\Forms\Components\TagsInput;
 use Filament\Forms\Components\Textarea;
 use Filament\Forms\Components\TextInput;
 use Filament\Forms\Components\Toggle;
-use Filament\Infolists\Components\TextEntry;
-use Filament\Notifications\Notification;
 use Filament\Resources\Pages\EditRecord;
 use Filament\Schemas\Components\Fieldset;
-use Filament\Schemas\Components\Flex;
 use Filament\Schemas\Components\Grid;
 use Filament\Schemas\Components\Image;
 use Filament\Schemas\Components\Tabs;
@@ -40,10 +37,7 @@ use Filament\Schemas\Components\Tabs\Tab;
 use Filament\Schemas\Components\Utilities\Get;
 use Filament\Schemas\Components\Utilities\Set;
 use Filament\Schemas\Schema;
-use Filament\Support\Enums\IconSize;
-use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\Rules\Unique;
-use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
 
 class EditEgg extends EditRecord
 {
@@ -74,163 +68,17 @@ class EditEgg extends EditRecord
                 ->icon(TablerIcon::Egg)
                 ->schema([
                     Grid::make(2)
-                        ->columnSpan(1)
+                        ->columnStart(1)
                         ->schema([
-                            Image::make('', '')
-                                ->hidden(fn ($record) => !$record->image)
-                                ->url(fn ($record) => $record->image)
-                                ->alt('')
-                                ->alignJustify()
+                            Image::make('', 'icon')
+                                ->hidden(fn ($record) => !$record->icon)
+                                ->url(fn ($record) => $record->icon)
                                 ->imageSize(150)
-                                ->columnSpanFull(),
-                            Flex::make([
-                                Action::make('uploadImage')
-                                    ->hiddenLabel()
-                                    ->tooltip(trans('admin/egg.import.import_image'))
-                                    ->iconSize(IconSize::Large)
-                                    ->icon(TablerIcon::PhotoUp)
-                                    ->modal()
-                                    ->modalHeading('')
-                                    ->modalSubmitActionLabel(trans('admin/egg.import.import_image'))
-                                    ->schema([
-                                        Tabs::make()
-                                            ->contained(false)
-                                            ->tabs([
-                                                Tab::make(trans('admin/egg.import.url'))
-                                                    ->schema([
-                                                        Hidden::make('imageUrl'),
-                                                        Hidden::make('imageExtension'),
-                                                        TextInput::make('image_url')
-                                                            ->label(trans('admin/egg.import.image_url'))
-                                                            ->reactive()
-                                                            ->autocomplete(false)
-                                                            ->debounce(500)
-                                                            ->afterStateUpdated(function ($state, Set $set) {
-                                                                if (!$state) {
-                                                                    $set('image_url_error', null);
-                                                                    $set('imageUrl', null);
-                                                                    $set('imageExtension', null);
-
-                                                                    return;
-                                                                }
-
-                                                                try {
-                                                                    if (!filter_var($state, FILTER_VALIDATE_URL)) {
-                                                                        throw new Exception(trans('admin/egg.import.invalid_url'));
-                                                                    }
-
-                                                                    $extension = strtolower(pathinfo(parse_url($state, PHP_URL_PATH), PATHINFO_EXTENSION));
-
-                                                                    if (!array_key_exists($extension, Egg::IMAGE_FORMATS)) {
-                                                                        throw new Exception(trans('admin/egg.import.unsupported_format', ['format' => implode(', ', array_keys(Egg::IMAGE_FORMATS))]));
-                                                                    }
-
-                                                                    $host = parse_url($state, PHP_URL_HOST);
-                                                                    $ip = gethostbyname($host);
-
-                                                                    if (
-                                                                        filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false
-                                                                    ) {
-                                                                        throw new Exception(trans('admin/egg.import.no_local_ip'));
-                                                                    }
-
-                                                                    $set('imageUrl', $state);
-                                                                    $set('imageExtension', $extension);
-                                                                    $set('image_url_error', null);
-
-                                                                } catch (Exception $e) {
-                                                                    $set('image_url_error', $e->getMessage());
-                                                                    $set('imageUrl', null);
-                                                                    $set('imageExtension', null);
-                                                                }
-                                                            }),
-                                                        TextEntry::make('image_url_error')
-                                                            ->hiddenLabel()
-                                                            ->visible(fn ($get) => $get('image_url_error') !== null)
-                                                            ->afterStateHydrated(fn ($set, $get) => $get('image_url_error')),
-                                                        Image::make(fn (Get $get) => $get('image_url'), '')
-                                                            ->imageSize(150)
-                                                            ->visible(fn ($get) => $get('image_url') && !$get('image_url_error'))
-                                                            ->alignCenter(),
-                                                    ]),
-                                                Tab::make(trans('admin/egg.import.file'))
-                                                    ->schema([
-                                                        FileUpload::make('image')
-                                                            ->hiddenLabel()
-                                                            ->previewable()
-                                                            ->openable(false)
-                                                            ->downloadable(false)
-                                                            ->maxSize(256)
-                                                            ->maxFiles(1)
-                                                            ->columnSpanFull()
-                                                            ->alignCenter()
-                                                            ->imageEditor()
-                                                            ->image()
-                                                            ->disk('public')
-                                                            ->directory(Egg::ICON_STORAGE_PATH)
-                                                            ->acceptedFileTypes([
-                                                                'image/png',
-                                                                'image/jpeg',
-                                                                'image/webp',
-                                                                'image/svg+xml',
-                                                            ])
-                                                            ->getUploadedFileNameForStorageUsing(function (TemporaryUploadedFile $file, $record) {
-                                                                return $record->uuid . '.' . $file->getClientOriginalExtension();
-                                                            }),
-                                                    ]),
-                                            ]),
-                                    ])
-                                    ->action(function (array $data, $record): void {
-                                        if (!empty($data['imageUrl']) && !empty($data['imageExtension'])) {
-                                            $this->saveImageFromUrl($data['imageUrl'], $data['imageExtension'], $record);
-
-                                            Notification::make()
-                                                ->title(trans('admin/egg.import.image_updated'))
-                                                ->success()
-                                                ->send();
-
-                                            return;
-                                        }
-
-                                        if (!empty($data['image'])) {
-                                            Notification::make()
-                                                ->title(trans('admin/egg.import.image_updated'))
-                                                ->success()
-                                                ->send();
-
-                                            return;
-                                        }
-
-                                        if (empty($data['imageUrl']) && empty($data['image'])) {
-                                            Notification::make()
-                                                ->title(trans('admin/egg.import.no_image'))
-                                                ->warning()
-                                                ->send();
-                                        }
-                                    }),
-                                Action::make('delete_image')
-                                    ->visible(fn ($record) => $record->image)
-                                    ->hiddenLabel()
-                                    ->tooltip(trans('admin/egg.import.delete_image'))
-                                    ->icon(TablerIcon::Trash)
-                                    ->iconSize(IconSize::Large)
-                                    ->color('danger')
-                                    ->action(function ($record) {
-                                        foreach (array_keys(Egg::IMAGE_FORMATS) as $ext) {
-                                            $path = Egg::ICON_STORAGE_PATH . "/$record->uuid.$ext";
-                                            if (Storage::disk('public')->exists($path)) {
-                                                Storage::disk('public')->delete($path);
-                                            }
-                                        }
-
-                                        Notification::make()
-                                            ->title(trans('admin/egg.import.image_deleted'))
-                                            ->success()
-                                            ->send();
-
-                                        $record->refresh();
-                                    }),
-                            ]),
+                                ->columnSpanFull()
+                                ->alignJustify(),
+                            UploadIcon::make(),
+                            DeleteIcon::make()
+                                ->iconStoragePath(Egg::getIconStoragePath()),
                         ]),
                     TextInput::make('name')
                         ->label(trans('admin/egg.name'))
@@ -469,39 +317,6 @@ class EditEgg extends EditRecord
         $this->fillForm();
     }
 
-    /**
-     * Save an image from URL download to a file.
-     *
-     * @throws Exception
-     */
-    private function saveImageFromUrl(string $imageUrl, string $extension, Egg $egg): void
-    {
-        $context = stream_context_create([
-            'http' => ['timeout' => 3],
-            'https' => [
-                'timeout' => 3,
-                'verify_peer' => true,
-                'verify_peer_name' => true,
-            ],
-        ]);
-
-        $normalizedExtension = match ($extension) {
-            'svg+xml', 'svg' => 'svg',
-            'jpeg', 'jpg' => 'jpg',
-            'png' => 'png',
-            'webp' => 'webp',
-            default => throw new Exception(trans('admin/egg.import.unknown_extension')),
-        };
-
-        $data = @file_get_contents($imageUrl, false, $context, 0, 1048576); // 1024KB
-
-        if (empty($data)) {
-            throw new Exception(trans('admin/egg.import.invalid_url'));
-        }
-
-        Storage::disk('public')->put(Egg::ICON_STORAGE_PATH . "/$egg->uuid.$normalizedExtension", $data);
-    }
-
     protected function getFormActions(): array
     {
         return [];

app/Filament/Admin/Resources/Eggs/Pages/ListEggs.php

@@ -38,6 +38,8 @@ class ListEggs extends ListRecords
      */
     public function table(Table $table): Table
     {
+        $defaultEggIcon = 'data:image/svg+xml;base64,' . base64_encode(file_get_contents(public_path('pelican.svg')));
+
         return $table
             ->searchable(true)
             ->defaultPaginationPageOption(25)
@@ -45,13 +47,11 @@ class ListEggs extends ListRecords
                 TextColumn::make('id')
                     ->label('Id')
                     ->hidden(),
-                ImageColumn::make('image')
+                ImageColumn::make('icon')
                     ->label('')
                     ->alignCenter()
                     ->circular()
-                    ->getStateUsing(fn ($record) => $record->image
-                        ? $record->image
-                        : 'data:image/svg+xml;base64,' . base64_encode(file_get_contents(public_path('pelican.svg')))),
+                    ->getStateUsing(fn (Egg $record) => $record->icon ?: $defaultEggIcon),
                 TextColumn::make('name')
                     ->label(trans('admin/egg.name'))
                     ->description(fn ($record): ?string => (strlen($record->description) > 120) ? substr($record->description, 0, 120).'...' : $record->description)

app/Filament/Admin/Resources/Mounts/MountResource.php

@@ -95,6 +95,12 @@ class MountResource extends Resource
                     ->icon(fn ($state) => $state ? TablerIcon::WritingOff : TablerIcon::Writing)
                     ->color(fn ($state) => $state ? 'success' : 'warning')
                     ->formatStateUsing(fn ($state) => $state ? trans('admin/mount.toggles.read_only') : trans('admin/mount.toggles.writable')),
+                TextColumn::make('user_mountable')
+                    ->label(trans('admin/mount.table.user_mountable'))
+                    ->badge()
+                    ->icon(fn ($state) => $state ? TablerIcon::User : TablerIcon::UserOff)
+                    ->color(fn ($state) => $state ? 'success' : 'warning')
+                    ->formatStateUsing(fn ($state) => $state ? trans('admin/mount.toggles.user_mountable') : trans('admin/mount.toggles.not_user_mountable')),
             ])
             ->recordActions([
                 ViewAction::make()
@@ -124,7 +130,8 @@ class MountResource extends Resource
                         ->label(trans('admin/mount.name'))
                         ->required()
                         ->helperText(trans('admin/mount.name_help'))
-                        ->maxLength(64),
+                        ->maxLength(64)
+                        ->columnSpanFull(),
                     ToggleButtons::make('read_only')
                         ->label(trans('admin/mount.read_only'))
                         ->helperText(trans('admin/mount.read_only_help'))
@@ -143,6 +150,24 @@ class MountResource extends Resource
                         ])
                         ->inline()
                         ->default(false),
+                    ToggleButtons::make('user_mountable')
+                        ->label(trans('admin/mount.user_mountable'))
+                        ->helperText(trans('admin/mount.user_mountable_help'))
+                        ->stateCast(new BooleanStateCast(false, true))
+                        ->options([
+                            false => trans('admin/mount.toggles.not_user_mountable'),
+                            true => trans('admin/mount.toggles.user_mountable'),
+                        ])
+                        ->icons([
+                            false => TablerIcon::UserOff,
+                            true => TablerIcon::User,
+                        ])
+                        ->colors([
+                            false => 'warning',
+                            true => 'success',
+                        ])
+                        ->inline()
+                        ->default(true),
                     TextInput::make('source')
                         ->label(trans('admin/mount.source'))
                         ->required()

app/Filament/Admin/Resources/Mounts/Pages/CreateMount.php

@@ -42,7 +42,6 @@ class CreateMount extends CreateRecord
     protected function handleRecordCreation(array $data): Model
     {
         $data['uuid'] ??= Str::uuid()->toString();
-        $data['user_mountable'] = 1;
 
         return parent::handleRecordCreation($data);
     }

app/Filament/Admin/Resources/Servers/Pages/EditServer.php

@@ -4,15 +4,17 @@ namespace App\Filament\Admin\Resources\Servers\Pages;
 
 use App\Enums\SuspendAction;
 use App\Enums\TablerIcon;
+use App\Extensions\BackupAdapter\BackupAdapterService;
+use App\Extensions\BackupAdapter\Schemas\WingsBackupSchema;
 use App\Filament\Admin\Resources\Servers\ServerResource;
-use App\Filament\Components\Actions\DeleteServerIcon;
+use App\Filament\Components\Actions\DeleteIcon;
 use App\Filament\Components\Actions\PreviewStartupAction;
+use App\Filament\Components\Actions\UploadIcon;
 use App\Filament\Components\Forms\Fields\MonacoEditor;
 use App\Filament\Components\Forms\Fields\StartupVariable;
 use App\Filament\Components\StateCasts\ServerConditionStateCast;
 use App\Filament\Server\Pages\Console;
 use App\Models\Allocation;
-use App\Models\Backup;
 use App\Models\Egg;
 use App\Models\Server;
 use App\Models\User;
@@ -31,7 +33,6 @@ use Exception;
 use Filament\Actions\Action;
 use Filament\Actions\ActionGroup;
 use Filament\Forms\Components\CheckboxList;
-use Filament\Forms\Components\FileUpload;
 use Filament\Forms\Components\Hidden;
 use Filament\Forms\Components\KeyValue;
 use Filament\Forms\Components\Repeater;
@@ -41,7 +42,6 @@ use Filament\Forms\Components\Textarea;
 use Filament\Forms\Components\TextInput;
 use Filament\Forms\Components\Toggle;
 use Filament\Forms\Components\ToggleButtons;
-use Filament\Infolists\Components\TextEntry;
 use Filament\Notifications\Notification;
 use Filament\Resources\Pages\EditRecord;
 use Filament\Schemas\Components\Actions;
@@ -60,9 +60,7 @@ use Filament\Support\Enums\Alignment;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Support\Arr;
-use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\HtmlString;
-use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
 use LogicException;
 use Random\RandomException;
 
@@ -111,141 +109,18 @@ class EditServer extends EditRecord
                 ->icon(TablerIcon::InfoCircle)
                 ->schema([
                     Grid::make()
-                        ->columns(2)
                         ->columnStart(1)
                         ->schema([
                             Image::make('', 'icon')
-                                ->hidden(fn ($record) => !$record->icon && !$record->egg->image)
-                                ->url(fn ($record) => $record->icon ?: $record->egg->image)
+                                ->hidden(fn ($record) => !$record->icon && !$record->egg->icon)
+                                ->url(fn ($record) => $record->icon ?: $record->egg->icon)
                                 ->tooltip(fn ($record) => $record->icon ? '' : trans('server/setting.server_info.icon.tooltip'))
-                                ->columnSpan(2)
+                                ->imageSize(150)
+                                ->columnSpanFull()
                                 ->alignJustify(),
-                            Action::make('uploadIcon')
-                                ->hiddenLabel()
-                                ->icon(TablerIcon::PhotoUp)
-                                ->tooltip(trans('admin/server.import_image'))
-                                ->modal()
-                                ->modalSubmitActionLabel(trans('server/setting.server_info.icon.upload'))
-                                ->schema([
-                                    Tabs::make()
-                                        ->contained(false)
-                                        ->tabs([
-                                            Tab::make(trans('admin/egg.import.url'))
-                                                ->schema([
-                                                    Hidden::make('imageUrl'),
-                                                    Hidden::make('imageExtension'),
-                                                    TextInput::make('image_url')
-                                                        ->label(trans('admin/egg.import.image_url'))
-                                                        ->reactive()
-                                                        ->autocomplete(false)
-                                                        ->debounce(500)
-                                                        ->afterStateUpdated(function ($state, Set $set) {
-                                                            if (!$state) {
-                                                                $set('image_url_error', null);
-                                                                $set('imageUrl', null);
-                                                                $set('imageExtension', null);
-
-                                                                return;
-                                                            }
-
-                                                            try {
-                                                                if (!in_array(parse_url($state, PHP_URL_SCHEME), ['http', 'https'], true)) {
-                                                                    throw new Exception(trans('admin/egg.import.invalid_url'));
-                                                                }
-
-                                                                if (!filter_var($state, FILTER_VALIDATE_URL)) {
-                                                                    throw new Exception(trans('admin/egg.import.invalid_url'));
-                                                                }
-
-                                                                $extension = strtolower(pathinfo(parse_url($state, PHP_URL_PATH), PATHINFO_EXTENSION));
-
-                                                                if (!array_key_exists($extension, Server::IMAGE_FORMATS)) {
-                                                                    throw new Exception(trans('admin/egg.import.unsupported_format', ['format' => implode(', ', array_keys(Server::IMAGE_FORMATS))]));
-                                                                }
-
-                                                                $host = parse_url($state, PHP_URL_HOST);
-                                                                $ip = gethostbyname($host);
-
-                                                                if (
-                                                                    filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false
-                                                                ) {
-                                                                    throw new Exception(trans('admin/egg.import.no_local_ip'));
-                                                                }
-
-                                                                $set('imageUrl', $state);
-                                                                $set('imageExtension', $extension);
-                                                                $set('image_url_error', null);
-
-                                                            } catch (Exception $e) {
-                                                                $set('image_url_error', $e->getMessage());
-                                                                $set('imageUrl', null);
-                                                                $set('imageExtension', null);
-                                                            }
-                                                        }),
-                                                    TextEntry::make('image_url_error')
-                                                        ->hiddenLabel()
-                                                        ->visible(fn (Get $get) => $get('image_url_error') !== null)
-                                                        ->afterStateHydrated(fn (Get $get) => $get('image_url_error')),
-                                                    Image::make(fn (Get $get) => $get('image_url'), '')
-                                                        ->imageSize(150)
-                                                        ->visible(fn (Get $get) => $get('image_url') && !$get('image_url_error'))
-                                                        ->alignCenter(),
-                                                ]),
-                                            Tab::make(trans('admin/egg.import.file'))
-                                                ->schema([
-                                                    FileUpload::make('image')
-                                                        ->hiddenLabel()
-                                                        ->previewable()
-                                                        ->openable(false)
-                                                        ->downloadable(false)
-                                                        ->maxSize(256)
-                                                        ->maxFiles(1)
-                                                        ->columnSpanFull()
-                                                        ->alignCenter()
-                                                        ->imageEditor()
-                                                        ->image()
-                                                        ->disk('public')
-                                                        ->directory(Server::ICON_STORAGE_PATH)
-                                                        ->acceptedFileTypes([
-                                                            'image/png',
-                                                            'image/jpeg',
-                                                            'image/webp',
-                                                            'image/svg+xml',
-                                                        ])
-                                                        ->getUploadedFileNameForStorageUsing(function (TemporaryUploadedFile $file, $record) {
-                                                            return $record->uuid . '.' . $file->getClientOriginalExtension();
-                                                        }),
-                                                ]),
-                                        ]),
-                                ])
-                                ->action(function (array $data, $record): void {
-                                    if (!empty($data['imageUrl']) && !empty($data['imageExtension'])) {
-                                        $this->saveIconFromUrl($data['imageUrl'], $data['imageExtension'], $record);
-                                        Notification::make()
-                                            ->title(trans('server/setting.server_info.icon.updated'))
-                                            ->success()
-                                            ->send();
-
-                                        return;
-                                    }
-
-                                    if (!empty($data['image'])) {
-                                        Notification::make()
-                                            ->title(trans('server/setting.server_info.icon.updated'))
-                                            ->success()
-                                            ->send();
-
-                                        return;
-                                    }
-
-                                    if (empty($data['imageUrl']) && empty($data['image'])) {
-                                        Notification::make()
-                                            ->title(trans('admin/egg.import.no_image'))
-                                            ->warning()
-                                            ->send();
-                                    }
-                                }),
-                            DeleteServerIcon::make(),
+                            UploadIcon::make(),
+                            DeleteIcon::make()
+                                ->iconStoragePath(Server::getIconStoragePath()),
                         ]),
                     Grid::make()
                         ->columns(3)
@@ -976,16 +851,20 @@ class EditServer extends EditRecord
                                             ->disabled(fn (Server $server) => user()?->accessibleNodes()->count() <= 1 || $server->isInConflictState())
                                             ->modalHeading(trans('admin/server.transfer'))
                                             ->schema($this->transferServer())
-                                            ->action(function (TransferServerService $transfer, Server $server, $data) {
+                                            ->action(function (TransferServerService $transfer, BackupAdapterService $backupService, Server $server, $data) {
                                                 try {
                                                     $selectedBackupUuids = Arr::get($data, 'backups', []);
                                                     $transfer->handle($server, Arr::get($data, 'node_id'), Arr::get($data, 'allocation_id'), Arr::get($data, 'allocation_additional', []), $selectedBackupUuids);
 
                                                     $server->backups
                                                         ->whereNotIn('uuid', $selectedBackupUuids)
-                                                        ->where('disk', Backup::ADAPTER_DAEMON)
-                                                        ->each(function ($backup) {
-                                                            $backup->delete();
+                                                        ->each(function ($backup) use ($backupService) {
+                                                            $schema = $backupService->get($backup->backupHost->schema);
+
+                                                            // Wings backups that aren't transferred only need to be delete on the panel, wings will cleanup the backup files automatically
+                                                            if ($schema instanceof WingsBackupSchema) {
+                                                                $backup->delete();
+                                                            }
                                                         });
 
                                                     Notification::make()
@@ -1077,17 +956,17 @@ class EditServer extends EditRecord
                 ->placeholder(trans('admin/server.select_additional')),
             Grid::make()
                 ->columnSpanFull()
-                ->schema([
+                ->schema(fn (BackupAdapterService $backupService) => [
                     CheckboxList::make('backups')
                         ->label(trans('admin/server.backups'))
                         ->bulkToggleable()
-                        ->options(fn (Server $server) => $server->backups->where('disk', Backup::ADAPTER_DAEMON)->mapWithKeys(fn ($backup) => [$backup->uuid => $backup->name]))
-                        ->columns(fn (Server $record) => (int) ceil($record->backups->where('disk', Backup::ADAPTER_DAEMON)->count() / 4)),
+                        ->options(fn (Server $server) => $server->backups->filter(fn ($backup) => $backupService->get($backup->backupHost->schema) instanceof WingsBackupSchema)->mapWithKeys(fn ($backup) => [$backup->uuid => $backup->name]))
+                        ->columns(fn (Server $record) => (int) ceil($record->backups->filter(fn ($backup) => $backupService->get($backup->backupHost->schema) instanceof WingsBackupSchema)->count() / 4)),
                     Text::make('backup_helper')
                         ->columnSpanFull()
                         ->content(trans('admin/server.warning_backups')),
                 ])
-                ->hidden(fn (Server $server) => $server->backups->where('disk', Backup::ADAPTER_DAEMON)->count() === 0),
+                ->hidden(fn (Server $server, BackupAdapterService $backupService) => $server->backups->filter(fn ($backup) => $backupService->get($backup->backupHost->schema) instanceof WingsBackupSchema)->count() === 0),
         ];
     }
 
@@ -1202,37 +1081,4 @@ class EditServer extends EditRecord
     {
         return null;
     }
-
-    /**
-     * Save an icon from URL download to a file.
-     *
-     * @throws Exception
-     */
-    private function saveIconFromUrl(string $imageUrl, string $extension, Server $server): void
-    {
-        $context = stream_context_create([
-            'http' => ['timeout' => 3],
-            'https' => [
-                'timeout' => 3,
-                'verify_peer' => true,
-                'verify_peer_name' => true,
-            ],
-        ]);
-
-        $normalizedExtension = match ($extension) {
-            'svg+xml', 'svg' => 'svg',
-            'jpeg', 'jpg' => 'jpg',
-            'png' => 'png',
-            'webp' => 'webp',
-            default => throw new Exception(trans('admin/egg.import.unknown_extension')),
-        };
-
-        $data = @file_get_contents($imageUrl, false, $context, 0, 262144); //256KB
-
-        if (empty($data)) {
-            throw new Exception(trans('admin/egg.import.invalid_url'));
-        }
-
-        Storage::disk('public')->put(Server::ICON_STORAGE_PATH . "/$server->uuid.$normalizedExtension", $data);
-    }
 }

app/Filament/App/Resources/Servers/Pages/ListServers.php

@@ -70,7 +70,7 @@ class ListServers extends ListRecords
             ImageColumn::make('icon')
                 ->label('')
                 ->imageSize(46)
-                ->state(fn (Server $server) => $server->icon ?: $server->egg->image),
+                ->state(fn (Server $server) => $server->icon ?: $server->egg->icon),
             TextColumn::make('condition')
                 ->label(trans('server/dashboard.status'))
                 ->badge()
@@ -81,7 +81,8 @@ class ListServers extends ListRecords
                 ->label(trans('server/dashboard.title'))
                 ->description(fn (Server $server) => $server->description)
                 ->grow()
-                ->searchable(),
+                ->searchable()
+                ->sortable(),
             TextColumn::make('allocation.address')
                 ->label('')
                 ->badge()

app/Filament/Components/Actions/DeleteIcon.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Filament\Components\Actions;
+
+use App\Enums\TablerIcon;
+use App\Models\Traits\HasIcon;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Illuminate\Support\Facades\Storage;
+
+class DeleteIcon extends Action
+{
+    /** @var string[] */
+    protected ?array $iconFormats = null;
+
+    protected ?string $iconStoragePath = null;
+
+    public static function getDefaultName(): ?string
+    {
+        return 'delete_icon';
+    }
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->visible(fn ($record) => $record->icon);
+
+        $this->hiddenLabel();
+
+        $this->tooltip(trans('admin/egg.import.delete_icon'));
+
+        $this->icon(TablerIcon::Trash);
+
+        $this->color('danger');
+
+        $this->action(function ($record) {
+            foreach ($this->getIconFormats() as $ext) {
+                $path = $this->getIconStoragePath() . "/$record->uuid.$ext";
+                if (Storage::disk('public')->exists($path)) {
+                    Storage::disk('public')->delete($path);
+                }
+            }
+
+            Notification::make()
+                ->title(trans('admin/egg.import.icon_deleted'))
+                ->success()
+                ->send();
+
+            $record->refresh();
+        });
+    }
+
+    /** @param string[] $iconFormats */
+    public function iconFormats(?array $iconFormats): static
+    {
+        $this->iconFormats = $iconFormats;
+
+        return $this;
+    }
+
+    public function iconStoragePath(?string $iconStoragePath): static
+    {
+        $this->iconStoragePath = $iconStoragePath;
+
+        return $this;
+    }
+
+    /** @return string[] */
+    public function getIconFormats(): array
+    {
+        return $this->iconFormats ?? array_keys(HasIcon::$iconFormats);
+    }
+
+    public function getIconStoragePath(): ?string
+    {
+        return $this->iconStoragePath;
+    }
+}

app/Filament/Components/Actions/DeleteServerIcon.php

@@ -1,48 +0,0 @@
-<?php
-
-namespace App\Filament\Components\Actions;
-
-use App\Enums\TablerIcon;
-use App\Models\Server;
-use Filament\Actions\Action;
-use Filament\Notifications\Notification;
-use Illuminate\Support\Facades\Storage;
-
-class DeleteServerIcon extends Action
-{
-    public static function getDefaultName(): ?string
-    {
-        return 'delete_icon';
-    }
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-
-        $this->visible(fn ($record) => $record->icon);
-
-        $this->hiddenLabel();
-
-        $this->tooltip(trans('admin/server.import_image'));
-
-        $this->icon(TablerIcon::Trash);
-
-        $this->color('danger');
-
-        $this->action(function ($record) {
-            foreach (array_keys(Server::IMAGE_FORMATS) as $ext) {
-                $path = Server::ICON_STORAGE_PATH . "/$record->uuid.$ext";
-                if (Storage::disk('public')->exists($path)) {
-                    Storage::disk('public')->delete($path);
-                }
-            }
-
-            Notification::make()
-                ->title(trans('server/setting.server_info.icon.deleted'))
-                ->success()
-                ->send();
-
-            $record->refresh();
-        });
-    }
-}

app/Filament/Components/Actions/UploadIcon.php

@@ -0,0 +1,164 @@
+<?php
+
+namespace App\Filament\Components\Actions;
+
+use App\Enums\TablerIcon;
+use App\Models\Traits\HasIcon;
+use Exception;
+use Filament\Actions\Action;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\TextInput;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Notifications\Notification;
+use Filament\Schemas\Components\Image;
+use Filament\Schemas\Components\Tabs;
+use Filament\Schemas\Components\Tabs\Tab;
+use Filament\Schemas\Components\Utilities\Get;
+use Filament\Schemas\Components\Utilities\Set;
+use Illuminate\Support\Facades\Http;
+use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
+
+class UploadIcon extends Action
+{
+    /** @var string[] */
+    protected ?array $iconFormats = null;
+
+    public static function getDefaultName(): ?string
+    {
+        return 'upload_icon';
+    }
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->hiddenLabel();
+
+        $this->tooltip(trans('admin/egg.import.import_icon'));
+
+        $this->icon(TablerIcon::PhotoUp);
+
+        $this->modal();
+
+        $this->modalHeading('');
+
+        $this->modalSubmitActionLabel(trans('admin/egg.import.import_icon'));
+
+        $this->schema([
+            Tabs::make()
+                ->contained(false)
+                ->tabs([
+                    Tab::make(trans('admin/egg.import.url'))
+                        ->schema([
+                            TextInput::make('icon_url')
+                                ->label(trans('admin/egg.import.icon_url'))
+                                ->reactive()
+                                ->autocomplete(false)
+                                ->debounce(500)
+                                ->afterStateUpdated(function ($state, Set $set) {
+                                    if (!$state) {
+                                        $set('icon_url_error', null);
+
+                                        return;
+                                    }
+
+                                    try {
+                                        $this->validateIconUrl($state);
+
+                                        $set('icon_url_error', null);
+                                    } catch (Exception $exception) {
+                                        $set('icon_url_error', $exception->getMessage());
+                                    }
+                                }),
+                            TextEntry::make('icon_url_error')
+                                ->hiddenLabel()
+                                ->visible(fn (Get $get) => $get('icon_url_error') !== null)
+                                ->afterStateHydrated(fn (Get $get) => $get('icon_url_error')),
+                            Image::make(fn (Get $get) => $get('icon_url'), '')
+                                ->imageSize(150)
+                                ->visible(fn (Get $get) => $get('icon_url') && !$get('icon_url_error'))
+                                ->alignCenter(),
+                        ]),
+                    Tab::make(trans('admin/egg.import.file'))
+                        ->schema([
+                            FileUpload::make('icon')
+                                ->hiddenLabel()
+                                ->previewable()
+                                ->openable(false)
+                                ->downloadable(false)
+                                ->maxSize(256)
+                                ->maxFiles(1)
+                                ->columnSpanFull()
+                                ->alignCenter()
+                                ->imageEditor()
+                                ->image()
+                                ->acceptedFileTypes(fn () => $this->getIconFormats())
+                                ->saveUploadedFileUsing(fn (TemporaryUploadedFile $file, $record) => $record->writeIcon($file->getClientOriginalExtension(), $file->getContent())),
+                        ]),
+                ]),
+        ]);
+
+        $this->action(function (array $data, $record) {
+            if (!empty($data['icon_url'])) {
+                $this->validateIconUrl($data['icon_url']);
+
+                $content = Http::timeout(5)->connectTimeout(1)->withoutRedirecting()->get($data['icon_url'])->body();
+
+                if (empty($content)) {
+                    throw new Exception(trans('admin/egg.import.invalid_url'));
+                }
+
+                $extension = strtolower(pathinfo(parse_url($data['icon_url'], PHP_URL_PATH), PATHINFO_EXTENSION));
+
+                $record->writeIcon($extension, $content);
+
+                Notification::make()
+                    ->title(trans('admin/egg.import.icon_updated'))
+                    ->success()
+                    ->send();
+            } elseif (!empty($data['icon'])) {
+                Notification::make()
+                    ->title(trans('admin/egg.import.icon_updated'))
+                    ->success()
+                    ->send();
+            } else {
+                Notification::make()
+                    ->title(trans('admin/egg.import.no_icon'))
+                    ->warning()
+                    ->send();
+            }
+        });
+    }
+
+    protected function validateIconUrl(string $url): void
+    {
+        if (!in_array(parse_url($url, PHP_URL_SCHEME), ['http', 'https'], true)) {
+            throw new Exception(trans('admin/egg.import.invalid_url'));
+        }
+
+        if (!filter_var($url, FILTER_VALIDATE_URL)) {
+            throw new Exception(trans('admin/egg.import.invalid_url'));
+        }
+
+        $host = parse_url($url, PHP_URL_HOST);
+        $ip = gethostbyname($host);
+
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
+            throw new Exception(trans('admin/egg.import.no_local_ip'));
+        }
+    }
+
+    /** @param string[] $iconFormats */
+    public function iconFormats(?array $iconFormats): static
+    {
+        $this->iconFormats = $iconFormats;
+
+        return $this;
+    }
+
+    /** @return string[] */
+    public function getIconFormats(): array
+    {
+        return $this->iconFormats ?? array_values(HasIcon::$iconFormats);
+    }
+}

app/Filament/Components/Forms/Fields/StartupVariable.php

@@ -49,7 +49,7 @@ class StartupVariable extends Field
 
         $this->hintIcon(TablerIcon::Code, fn (StartupVariable $component) => implode('|', $component->getVariableRules()));
 
-        $this->helperText(fn (StartupVariable $component) => !$component->getVariableDesc() ? '—' : $component->getVariableDesc());
+        $this->helperText(fn (StartupVariable $component) => $component->getVariableDesc());
 
         $this->rules(fn (StartupVariable $component) => $component->getVariableRules());
 
@@ -70,7 +70,7 @@ class StartupVariable extends Field
             ],
             StartupVariableType::Toggle => [
                 ...parent::getDefaultStateCasts(),
-                new BooleanStateCast(false),
+                new BooleanStateCast(false, true),
             ],
             default => parent::getDefaultStateCasts()
         };

app/Filament/Server/Pages/Mounts.php

@@ -0,0 +1,114 @@
+<?php
+
+namespace App\Filament\Server\Pages;
+
+use App\Enums\SubuserPermission;
+use App\Enums\TablerIcon;
+use App\Facades\Activity;
+use App\Models\Mount;
+use App\Models\Server;
+use BackedEnum;
+use Exception;
+use Filament\Facades\Filament;
+use Filament\Forms\Components\CheckboxList;
+use Filament\Notifications\Notification;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\HtmlString;
+
+class Mounts extends ServerFormPage
+{
+    protected static string|BackedEnum|null $navigationIcon = TablerIcon::LayersLinked;
+
+    protected static ?int $navigationSort = 9;
+
+    public static function canAccess(): bool
+    {
+        return parent::canAccess() && user()?->can(SubuserPermission::MountRead, Filament::getTenant());
+    }
+
+    protected function authorizeAccess(): void
+    {
+        abort_unless(user()?->can(SubuserPermission::MountRead, Filament::getTenant()), 403);
+    }
+
+    protected function fillForm(): void
+    {
+        $this->form->fill([
+            'mounts' => $this->getRecord()->mounts->pluck('id')->toArray(),
+        ]);
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        $server = $this->getRecord();
+
+        $allowedMounts = Mount::query()
+            ->where('user_mountable', true)
+            ->where(function ($query) use ($server) {
+                $query->whereDoesntHave('nodes')
+                    ->orWhereHas('nodes', fn ($q) => $q->where('nodes.id', $server->node_id));
+            })
+            ->where(function ($query) use ($server) {
+                $query->whereDoesntHave('eggs')
+                    ->orWhereHas('eggs', fn ($q) => $q->where('eggs.id', $server->egg_id));
+            })
+            ->get();
+
+        return parent::form($schema)
+            ->components([
+                Section::make([
+                    CheckboxList::make('mounts')
+                        ->label(trans('server/mount.description'))
+                        ->relationship('mounts')
+                        ->options(fn () => $allowedMounts->mapWithKeys(fn (Mount $mount) => [$mount->id => $mount->name]))
+                        ->descriptions(fn () => $allowedMounts->mapWithKeys(fn (Mount $mount) => [$mount->id => new HtmlString(str("$mount->source -> $mount->target")->stripTags() . ($mount->description ? '<br>' . str($mount->description)->stripTags() : ''))]))
+                        ->helperText(fn () => $allowedMounts->isEmpty() ? trans('server/mount.no_mounts') : null)
+                        ->disabled(fn (Server $server) => !user()?->can(SubuserPermission::MountUpdate, $server))
+                        ->bulkToggleable()
+                        ->live()
+                        ->afterStateUpdated(function ($state) {
+                            $this->save();
+                        })
+                        ->columnSpanFull(),
+                ]),
+            ]);
+    }
+
+    public function save(): void
+    {
+        abort_unless(user()?->can(SubuserPermission::MountUpdate, $this->getRecord()), 403);
+
+        try {
+            $this->form->getState();
+            $this->form->saveRelationships();
+
+            Activity::event('server:mount.update')
+                ->log();
+
+            Notification::make()
+                ->title(trans('server/mount.notification_updated'))
+                ->body(trans('server/mount.notification_updated_body'))
+                ->success()
+                ->send();
+        } catch (Exception $exception) {
+            report($exception);
+
+            Notification::make()
+                ->title(trans('server/mount.notification_failed'))
+                ->body($exception->getMessage())
+                ->danger()
+                ->send();
+        }
+    }
+
+    public function getTitle(): string
+    {
+        return trans('server/mount.title');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return trans('server/mount.title');
+    }
+}

app/Filament/Server/Pages/Settings.php

@@ -5,14 +5,13 @@ namespace App\Filament\Server\Pages;
 use App\Enums\SubuserPermission;
 use App\Enums\TablerIcon;
 use App\Facades\Activity;
-use App\Filament\Components\Actions\DeleteServerIcon;
+use App\Filament\Components\Actions\DeleteIcon;
+use App\Filament\Components\Actions\UploadIcon;
 use App\Models\Server;
 use App\Services\Servers\ReinstallServerService;
 use BackedEnum;
 use Exception;
 use Filament\Actions\Action;
-use Filament\Forms\Components\FileUpload;
-use Filament\Forms\Components\Hidden;
 use Filament\Forms\Components\Textarea;
 use Filament\Forms\Components\TextInput;
 use Filament\Infolists\Components\TextEntry;
@@ -21,20 +20,14 @@ use Filament\Schemas\Components\Fieldset;
 use Filament\Schemas\Components\Grid;
 use Filament\Schemas\Components\Image;
 use Filament\Schemas\Components\Section;
-use Filament\Schemas\Components\Tabs;
-use Filament\Schemas\Components\Tabs\Tab;
-use Filament\Schemas\Components\Utilities\Get;
-use Filament\Schemas\Components\Utilities\Set;
 use Filament\Schemas\Schema;
 use Filament\Support\Enums\Alignment;
-use Illuminate\Support\Facades\Storage;
-use Livewire\Features\SupportFileUploads\TemporaryUploadedFile;
 
 class Settings extends ServerFormPage
 {
     protected static string|BackedEnum|null $navigationIcon = TablerIcon::Settings;
 
-    protected static ?int $navigationSort = 10;
+    protected static ?int $navigationSort = 11;
 
     /**
      * @throws Exception
@@ -79,140 +72,20 @@ class Settings extends ServerFormPage
                                             ->afterStateUpdated(fn ($state, Server $server) => $this->updateDescription($state ?? '', $server)),
                                     ]),
                                 Grid::make()
-                                    ->columns(2)
                                     ->columnStart(6)
                                     ->schema([
                                         Image::make('', 'icon')
-                                            ->hidden(fn ($record) => !$record->icon && !$record->egg->image)
-                                            ->url(fn ($record) => $record->icon ?: $record->egg->image)
+                                            ->hidden(fn ($record) => !$record->icon && !$record->egg->icon)
+                                            ->url(fn ($record) => $record->icon ?: $record->egg->icon)
                                             ->tooltip(fn ($record) => $record->icon ? '' : trans('server/setting.server_info.icon.tooltip'))
-                                            ->columnSpan(2)
+                                            ->imageSize(150)
+                                            ->columnSpanFull()
                                             ->alignJustify(),
-                                        Action::make('uploadIcon')
-                                            ->hiddenLabel()
-                                            ->tooltip(trans('admin/server.import_image'))
-                                            ->icon(TablerIcon::PhotoUp)
-                                            ->modal()
-                                            ->modalSubmitActionLabel(trans('server/setting.server_info.icon.upload'))
-                                            ->schema([
-                                                Tabs::make()
-                                                    ->contained(false)
-                                                    ->tabs([
-                                                        Tab::make(trans('admin/egg.import.url'))
-                                                            ->schema([
-                                                                Hidden::make('imageUrl'),
-                                                                Hidden::make('imageExtension'),
-                                                                TextInput::make('image_url')
-                                                                    ->label(trans('admin/egg.import.image_url'))
-                                                                    ->reactive()
-                                                                    ->autocomplete(false)
-                                                                    ->debounce(500)
-                                                                    ->afterStateUpdated(function ($state, Set $set) {
-                                                                        if (!$state) {
-                                                                            $set('image_url_error', null);
-                                                                            $set('imageUrl', null);
-                                                                            $set('imageExtension', null);
-
-                                                                            return;
-                                                                        }
-
-                                                                        try {
-                                                                            if (!in_array(parse_url($state, PHP_URL_SCHEME), ['http', 'https'], true)) {
-                                                                                throw new Exception(trans('admin/egg.import.invalid_url'));
-                                                                            }
-
-                                                                            if (!filter_var($state, FILTER_VALIDATE_URL)) {
-                                                                                throw new Exception(trans('admin/egg.import.invalid_url'));
-                                                                            }
-
-                                                                            $extension = strtolower(pathinfo(parse_url($state, PHP_URL_PATH), PATHINFO_EXTENSION));
-
-                                                                            if (!array_key_exists($extension, Server::IMAGE_FORMATS)) {
-                                                                                throw new Exception(trans('admin/egg.import.unsupported_format', ['format' => implode(', ', array_keys(Server::IMAGE_FORMATS))]));
-                                                                            }
-
-                                                                            $host = parse_url($state, PHP_URL_HOST);
-                                                                            $ip = gethostbyname($host);
-
-                                                                            if (
-                                                                                filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false
-                                                                            ) {
-                                                                                throw new Exception(trans('admin/egg.import.no_local_ip'));
-                                                                            }
-
-                                                                            $set('imageUrl', $state);
-                                                                            $set('imageExtension', $extension);
-                                                                            $set('image_url_error', null);
-
-                                                                        } catch (Exception $e) {
-                                                                            $set('image_url_error', $e->getMessage());
-                                                                            $set('imageUrl', null);
-                                                                            $set('imageExtension', null);
-                                                                        }
-                                                                    }),
-                                                                TextEntry::make('image_url_error')
-                                                                    ->hiddenLabel()
-                                                                    ->visible(fn (Get $get) => $get('image_url_error') !== null)
-                                                                    ->afterStateHydrated(fn (Get $get) => $get('image_url_error')),
-                                                                Image::make(fn (Get $get) => $get('image_url'), '')
-                                                                    ->imageSize(150)
-                                                                    ->visible(fn (Get $get) => $get('image_url') && !$get('image_url_error'))
-                                                                    ->alignCenter(),
-                                                            ]),
-                                                        Tab::make(trans('admin/egg.import.file'))
-                                                            ->schema([
-                                                                FileUpload::make('image')
-                                                                    ->hiddenLabel()
-                                                                    ->previewable()
-                                                                    ->openable(false)
-                                                                    ->downloadable(false)
-                                                                    ->maxSize(256)
-                                                                    ->maxFiles(1)
-                                                                    ->columnSpanFull()
-                                                                    ->alignCenter()
-                                                                    ->imageEditor()
-                                                                    ->image()
-                                                                    ->disk('public')
-                                                                    ->directory(Server::ICON_STORAGE_PATH)
-                                                                    ->acceptedFileTypes([
-                                                                        'image/png',
-                                                                        'image/jpeg',
-                                                                        'image/webp',
-                                                                        'image/svg+xml',
-                                                                    ])
-                                                                    ->getUploadedFileNameForStorageUsing(function (TemporaryUploadedFile $file, $record) {
-                                                                        return $record->uuid . '.' . $file->getClientOriginalExtension();
-                                                                    }),
-                                                            ]),
-                                                    ]),
-                                            ])
-                                            ->action(function (array $data, $record): void {
-
-                                                if (!empty($data['imageUrl']) && !empty($data['imageExtension'])) {
-                                                    $this->saveIconFromUrl($data['imageUrl'], $data['imageExtension'], $record);
-                                                    Notification::make()
-                                                        ->title(trans('server/setting.server_info.icon.updated'))
-                                                        ->success()
-                                                        ->send();
-
-                                                    return;
-                                                }
-
-                                                if (!empty($data['image'])) {
-                                                    Notification::make()
-                                                        ->title(trans('server/setting.server_info.icon.updated'))
-                                                        ->success()
-                                                        ->send();
-                                                }
-
-                                                if (empty($data['imageUrl']) && empty($data['image'])) {
-                                                    Notification::make()
-                                                        ->title(trans('admin/egg.import.no_image'))
-                                                        ->warning()
-                                                        ->send();
-                                                }
-                                            }),
-                                        DeleteServerIcon::make(),
+                                        UploadIcon::make()
+                                            ->authorize(fn (Server $server) => user()?->can(SubuserPermission::SettingsChangeIcon, $server)),
+                                        DeleteIcon::make()
+                                            ->iconStoragePath(Server::getIconStoragePath())
+                                            ->authorize(fn (Server $server) => user()?->can(SubuserPermission::SettingsChangeIcon, $server)),
                                     ]),
                                 TextInput::make('uuid')
                                     ->label(trans('server/setting.server_info.uuid'))
@@ -446,39 +319,6 @@ class Settings extends ServerFormPage
         }
     }
 
-    /**
-     * Save an icon from URL download to a file.
-     *
-     * @throws Exception
-     */
-    private function saveIconFromUrl(string $imageUrl, string $extension, Server $server): void
-    {
-        $context = stream_context_create([
-            'http' => ['timeout' => 3],
-            'https' => [
-                'timeout' => 3,
-                'verify_peer' => true,
-                'verify_peer_name' => true,
-            ],
-        ]);
-
-        $normalizedExtension = match ($extension) {
-            'svg+xml', 'svg' => 'svg',
-            'jpeg', 'jpg' => 'jpg',
-            'png' => 'png',
-            'webp' => 'webp',
-            default => throw new Exception(trans('admin/egg.import.unknown_extension')),
-        };
-
-        $data = @file_get_contents($imageUrl, false, $context, 0, 262144); //256KB
-
-        if (empty($data)) {
-            throw new Exception(trans('admin/egg.import.invalid_url'));
-        }
-
-        Storage::disk('public')->put(Server::ICON_STORAGE_PATH . "/$server->uuid.$normalizedExtension", $data);
-    }
-
     public function getTitle(): string
     {
         return trans('server/setting.title');

app/Filament/Server/Pages/Startup.php

@@ -28,7 +28,7 @@ class Startup extends ServerFormPage
 {
     protected static string|BackedEnum|null $navigationIcon = TablerIcon::PlayerPlay;
 
-    protected static ?int $navigationSort = 9;
+    protected static ?int $navigationSort = 10;
 
     /**
      * @throws Exception
@@ -149,12 +149,16 @@ class Startup extends ServerFormPage
         return parent::canAccess() && user()?->can(SubuserPermission::StartupRead, Filament::getTenant());
     }
 
-    public function update(?string $state, ServerVariable $serverVariable): void
+    public function update(null|string|bool $state, ServerVariable $serverVariable): void
     {
         if (!$serverVariable->variable->user_editable) {
             return;
         }
 
+        if (is_bool($state)) {
+            $state = $state ? '1' : '0';
+        }
+
         $original = $serverVariable->variable_value;
 
         try {

app/Filament/Server/Resources/Backups/BackupResource.php

@@ -170,7 +170,7 @@ class BackupResource extends Resource
                         ->color('primary')
                         ->icon(TablerIcon::Download)
                         ->authorize(fn () => user()?->can(SubuserPermission::BackupDownload, $server))
-                        ->url(fn (DownloadLinkService $downloadLinkService, Backup $backup, Request $request) => $downloadLinkService->handle($backup, $request->user()), true)
+                        ->url(fn (DownloadLinkService $downloadLinkService, Backup $backup) => $downloadLinkService->handle($backup, user()), true)
                         ->visible(fn (Backup $backup) => $backup->status === BackupStatus::Successful),
                     Action::make('exclude_restore')
                         ->label(trans('server/backup.actions.restore.title'))
@@ -207,17 +207,13 @@ class BackupResource extends Resource
                                 ->property(['name' => $backup->name, 'truncate' => $data['truncate']]);
 
                             $log->transaction(function () use ($downloadLinkService, $daemonRepository, $backup, $server, $data) {
-                                // If the backup is for an S3 file we need to generate a unique Download link for
-                                // it that will allow daemon to actually access the file.
-                                if ($backup->disk === Backup::ADAPTER_AWS_S3) {
-                                    $url = $downloadLinkService->handle($backup, user());
-                                }
+                                $url = $downloadLinkService->handle($backup, user());
 
                                 // Update the status right away for the server so that we know not to allow certain
                                 // actions against it via the Panel API.
                                 $server->update(['status' => ServerState::RestoringBackup]);
 
-                                $daemonRepository->setServer($server)->restore($backup, $url ?? null, $data['truncate']);
+                                $daemonRepository->setServer($server)->restore($backup, $url, $data['truncate']);
                             });
 
                             return Notification::make()

app/Filament/Server/Resources/Subusers/SubuserResource.php

@@ -79,15 +79,15 @@ class SubuserResource extends Resource
 
             foreach ($data['permissions'] as $permission) {
                 $options[$permission] = str($permission)->headline();
-                $descriptions[$permission] = trans('server/user.permissions.' . $data['name'] . '_' . str($permission)->replace('-', '_'));
+                $descriptions[$permission] = trans($data['translation_prefix']. '.' . $data['name'] . '_' . str($permission)->replace('-', '_'));
                 $permissionsArray[$data['name']][] = $permission;
             }
 
             $tabs[] = Tab::make($data['name'])
-                ->label(str($data['name'])->headline())
+                ->label(trans($data['translation_prefix']. '.' . $data['name'] . '_title'))
                 ->schema([
                     Section::make()
-                        ->description(trans('server/user.permissions.' . $data['name'] . '_desc'))
+                        ->description(trans($data['translation_prefix']. '.' . $data['name'] . '_desc'))
                         ->icon($data['icon'])
                         ->contained(false)
                         ->schema([

app/Http/Controllers/Api/Client/AccountController.php

@@ -13,10 +13,17 @@ use Illuminate\Auth\SessionGuard;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
+use Illuminate\Support\Facades\RateLimiter;
+use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
 use Throwable;
 
 class AccountController extends ClientApiController
 {
+    /**
+     * The number of seconds that must elapse before the email change throttle resets.
+     */
+    private const EMAIL_UPDATE_THROTTLE = 60 * 60 * 24;
+
     /**
      * AccountController constructor.
      */
@@ -63,10 +70,22 @@ class AccountController extends ClientApiController
      */
     public function updateEmail(UpdateEmailRequest $request): JsonResponse
     {
-        $original = $request->user()->email;
-        $this->updateService->handle($request->user(), $request->validated());
+        $user = $request->user();
+
+        // Only allow a user to change their email three times in the span
+        // of 24 hours. This prevents malicious users from trying to find
+        // existing accounts in the system by constantly changing their email.
+        if (RateLimiter::tooManyAttempts($key = "user:update-email:{$user->uuid}", 3)) {
+            throw new TooManyRequestsHttpException(message: 'Your email address has been changed too many times today. Please try again later.');
+        }
+
+        $original = $user->email;
+
+        if (mb_strtolower($original) !== mb_strtolower($request->validated('email'))) {
+            RateLimiter::hit($key, self::EMAIL_UPDATE_THROTTLE);
+
+            $this->updateService->handle($user, $request->validated());
 
-        if ($original !== $request->input('email')) {
             Activity::event('user:account.email-changed')
                 ->property(['old' => $original, 'new' => $request->input('email')])
                 ->log();
@@ -85,7 +104,9 @@ class AccountController extends ClientApiController
      */
     public function updatePassword(UpdatePasswordRequest $request): JsonResponse
     {
-        $user = $this->updateService->handle($request->user(), $request->validated());
+        $user = Activity::event('user:account.password-changed')->transaction(function () use ($request) {
+            return $this->updateService->handle($request->user(), $request->validated());
+        });
 
         $guard = $this->manager->guard();
         // If you do not update the user in the session you'll end up working with a
@@ -98,8 +119,6 @@ class AccountController extends ClientApiController
             $guard->logoutOtherDevices($request->input('password'));
         }
 
-        Activity::event('user:account.password-changed')->log();
-
         return new JsonResponse([], Response::HTTP_NO_CONTENT);
     }
 }

app/Http/Controllers/Api/Client/Servers/BackupController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\Api\Client\Servers;
 
 use App\Enums\ServerState;
 use App\Enums\SubuserPermission;
+use App\Extensions\BackupAdapter\BackupAdapterService;
 use App\Facades\Activity;
 use App\Http\Controllers\Api\Client\ClientApiController;
 use App\Http\Requests\Api\Client\Servers\Backups\RenameBackupRequest;
@@ -33,6 +34,7 @@ class BackupController extends ClientApiController
         private readonly DeleteBackupService $deleteBackupService,
         private readonly InitiateBackupService $initiateBackupService,
         private readonly DownloadLinkService $downloadLinkService,
+        private readonly BackupAdapterService $backupService
     ) {
         parent::__construct();
     }
@@ -87,7 +89,7 @@ class BackupController extends ClientApiController
         }
 
         $backup = Activity::event('server:backup.start')->transaction(function ($log) use ($action, $server, $request) {
-            $server->backups()->lockForUpdate();
+            $server->backups()->lockForUpdate()->count();
 
             $backup = $action->handle($server, $request->input('name'));
 
@@ -191,7 +193,8 @@ class BackupController extends ClientApiController
             throw new AuthorizationException();
         }
 
-        if ($backup->disk !== Backup::ADAPTER_AWS_S3 && $backup->disk !== Backup::ADAPTER_DAEMON) {
+        $schema = $this->backupService->get($backup->backupHost->schema);
+        if (!$schema) {
             throw new BadRequestHttpException('The backup requested references an unknown disk driver type and cannot be downloaded.');
         }
 
@@ -264,17 +267,13 @@ class BackupController extends ClientApiController
             ->property(['name' => $backup->name, 'truncate' => $request->input('truncate')]);
 
         $log->transaction(function () use ($backup, $server, $request) {
-            // If the backup is for an S3 file we need to generate a unique Download link for
-            // it that will allow daemon to actually access the file.
-            if ($backup->disk === Backup::ADAPTER_AWS_S3) {
-                $url = $this->downloadLinkService->handle($backup, $request->user());
-            }
+            $url = $this->downloadLinkService->handle($backup, $request->user());
 
             // Update the status right away for the server so that we know not to allow certain
             // actions against it via the Panel API.
             $server->update(['status' => ServerState::RestoringBackup]);
 
-            $this->daemonRepository->setServer($server)->restore($backup, $url ?? null, $request->input('truncate'));
+            $this->daemonRepository->setServer($server)->restore($backup, $url, $request->input('truncate'));
         });
 
         return new JsonResponse([], JsonResponse::HTTP_NO_CONTENT);

app/Http/Controllers/Api/Client/Servers/DatabaseController.php

@@ -60,7 +60,7 @@ class DatabaseController extends ClientApiController
     public function store(StoreDatabaseRequest $request, Server $server): array
     {
         $database = Activity::event('server:database.create')->transaction(function ($log) use ($request, $server) {
-            $server->databases()->lockForUpdate();
+            $server->databases()->lockForUpdate()->count();
 
             $database = $this->deployDatabaseService->handle($server, $request->validated());
 
@@ -87,15 +87,12 @@ class DatabaseController extends ClientApiController
      */
     public function rotatePassword(RotatePasswordRequest $request, Server $server, Database $database): array
     {
-        $this->managementService->rotatePassword($database);
-        $database->refresh();
-
         Activity::event('server:database.rotate-password')
             ->subject($database)
             ->property('name', $database->database)
-            ->log();
+            ->transaction(fn () => $this->managementService->rotatePassword($database));
 
-        return $this->fractal->item($database)
+        return $this->fractal->item($database->refresh())
             ->parseIncludes(['password'])
             ->transformWith($this->getTransformer(DatabaseTransformer::class))
             ->toArray();

app/Http/Controllers/Api/Client/Servers/StartupController.php

@@ -87,13 +87,13 @@ class StartupController extends ClientApiController
 
         $startup = $this->startupCommandService->handle($server);
 
-        if ($variable->env_variable !== $request->input('value')) {
+        if ($original !== $request->input('value')) {
             Activity::event('server:startup.edit')
                 ->subject($variable)
                 ->property([
                     'variable' => $variable->env_variable,
                     'old' => $original,
-                    'new' => $request->input('value'),
+                    'new' => $request->input('value') ?? '',
                 ])
                 ->log();
         }

app/Http/Controllers/Api/Remote/Backups/BackupRemoteUploadController.php

@@ -3,20 +3,16 @@
 namespace App\Http\Controllers\Api\Remote\Backups;
 
 use App\Exceptions\Http\HttpForbiddenException;
-use App\Extensions\Backups\BackupManager;
-use App\Extensions\Filesystem\S3Filesystem;
+use App\Extensions\BackupAdapter\BackupAdapterService;
+use App\Extensions\BackupAdapter\Schemas\S3BackupSchema;
 use App\Http\Controllers\Controller;
 use App\Models\Backup;
 use App\Models\Node;
-use App\Models\Server;
-use Carbon\CarbonImmutable;
-use Exception;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\HttpKernel\Exception\ConflictHttpException;
-use Throwable;
 
 class BackupRemoteUploadController extends Controller
 {
@@ -25,117 +21,45 @@ class BackupRemoteUploadController extends Controller
     /**
      * BackupRemoteUploadController constructor.
      */
-    public function __construct(private BackupManager $backupManager) {}
+    public function __construct(private BackupAdapterService $backupService) {}
 
     /**
      * Returns the required presigned urls to upload a backup to S3 cloud storage.
      *
-     * @throws Exception
-     * @throws Throwable
+     * @throws BadRequestHttpException
      * @throws ModelNotFoundException
+     * @throws HttpForbiddenException
+     * @throws ConflictHttpException
      */
     public function __invoke(Request $request, string $backup): JsonResponse
     {
-        // Get the node associated with the request.
         /** @var Node $node */
         $node = $request->attributes->get('node');
 
-        // Get the size query parameter.
         $size = (int) $request->query('size');
         if (empty($size)) {
             throw new BadRequestHttpException('A non-empty "size" query parameter must be provided.');
         }
 
-        /** @var Backup $model */
-        $model = Backup::query()
-            ->where('uuid', $backup)
-            ->firstOrFail();
+        $backup = Backup::where('uuid', $backup)->firstOrFail();
 
         // Check that the backup is "owned" by the node making the request. This avoids other nodes
         // from messing with backups that they don't own.
-        /** @var Server $server */
-        $server = $model->server;
-        if ($server->node_id !== $node->id) {
-            throw new HttpForbiddenException('You do not have permission to access that backup.');
+        if ($backup->server->node_id !== $node->id) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
         }
 
-        // Prevent backups that have already been completed from trying to
-        // be uploaded again.
-        if (!is_null($model->completed_at)) {
+        // Prevent backups that have already been completed from trying to be uploaded again.
+        if (!is_null($backup->completed_at)) {
             throw new ConflictHttpException('This backup is already in a completed state.');
         }
 
-        // Ensure we are using the S3 adapter.
-        $adapter = $this->backupManager->adapter();
-        if (!$adapter instanceof S3Filesystem) {
-            throw new BadRequestHttpException('The configured backup adapter is not an S3 compatible adapter.');
+        // Ensure we are using the S3 schema.
+        $schema = $this->backupService->get($backup->backupHost->schema);
+        if (!$schema instanceof S3BackupSchema) {
+            throw new BadRequestHttpException('The configured backup schema is not an S3 compatible.');
         }
 
-        // The path where backup will be uploaded to
-        $path = sprintf('%s/%s.tar.gz', $model->server->uuid, $model->uuid);
-
-        // Get the S3 client
-        $client = $adapter->getClient();
-        $expires = CarbonImmutable::now()->addMinutes(config('backups.presigned_url_lifespan', 60));
-
-        // Params for generating the presigned urls
-        $params = [
-            'Bucket' => $adapter->getBucket(),
-            'Key' => $path,
-            'ContentType' => 'application/x-gzip',
-        ];
-
-        $storageClass = config('backups.disks.s3.storage_class');
-        if (!is_null($storageClass)) {
-            $params['StorageClass'] = $storageClass;
-        }
-
-        // Execute the CreateMultipartUpload request
-        $result = $client->execute($client->getCommand('CreateMultipartUpload', $params));
-
-        // Get the UploadId from the CreateMultipartUpload request, this is needed to create
-        // the other presigned urls.
-        $params['UploadId'] = $result->get('UploadId');
-
-        // Retrieve configured part size
-        $maxPartSize = $this->getConfiguredMaxPartSize();
-
-        // Create as many UploadPart presigned urls as needed
-        $parts = [];
-        for ($i = 0; $i < ($size / $maxPartSize); $i++) {
-            $parts[] = $client->createPresignedRequest(
-                $client->getCommand('UploadPart', array_merge($params, ['PartNumber' => $i + 1])),
-                $expires
-            )->getUri()->__toString();
-        }
-
-        // Set the upload_id on the backup in the database.
-        $model->update(['upload_id' => $params['UploadId']]);
-
-        return new JsonResponse([
-            'parts' => $parts,
-            'part_size' => $maxPartSize,
-        ]);
-    }
-
-    /**
-     * Get the configured maximum size of a single part in the multipart upload.
-     *
-     * The function tries to retrieve a configured value from the configuration.
-     * If no value is specified, a fallback value will be used.
-     *
-     * Note if the received config cannot be converted to int (0), is zero or is negative,
-     * the fallback value will be used too.
-     *
-     * The fallback value is {@see BackupRemoteUploadController::DEFAULT_MAX_PART_SIZE}.
-     */
-    private function getConfiguredMaxPartSize(): int
-    {
-        $maxPartSize = config('backups.max_part_size', self::DEFAULT_MAX_PART_SIZE);
-        if ($maxPartSize <= 0) {
-            $maxPartSize = self::DEFAULT_MAX_PART_SIZE;
-        }
-
-        return $maxPartSize;
+        return new JsonResponse($schema->getUploadParts($backup, $size));
     }
 }

app/Http/Controllers/Api/Remote/Backups/BackupStatusController.php

@@ -2,10 +2,9 @@
 
 namespace App\Http\Controllers\Api\Remote\Backups;
 
-use App\Exceptions\DisplayException;
 use App\Exceptions\Http\HttpForbiddenException;
-use App\Extensions\Backups\BackupManager;
-use App\Extensions\Filesystem\S3Filesystem;
+use App\Extensions\BackupAdapter\BackupAdapterService;
+use App\Extensions\BackupAdapter\Schemas\S3BackupSchema;
 use App\Facades\Activity;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Api\Remote\ReportBackupCompleteRequest;
@@ -13,7 +12,6 @@ use App\Models\Backup;
 use App\Models\Node;
 use App\Models\Server;
 use Carbon\CarbonImmutable;
-use Exception;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
@@ -24,7 +22,7 @@ class BackupStatusController extends Controller
     /**
      * BackupStatusController constructor.
      */
-    public function __construct(private BackupManager $backupManager) {}
+    public function __construct(private BackupAdapterService $backupService) {}
 
     /**
      * Handles updating the state of a backup.
@@ -47,7 +45,7 @@ class BackupStatusController extends Controller
         /** @var Server $server */
         $server = $model->server;
         if ($server->node_id !== $node->id) {
-            throw new HttpForbiddenException('You do not have permission to access that backup.');
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
         }
 
         if ($model->is_successful) {
@@ -73,9 +71,9 @@ class BackupStatusController extends Controller
 
             // Check if we are using the s3 backup adapter. If so, make sure we mark the backup as
             // being completed in S3 correctly.
-            $adapter = $this->backupManager->adapter();
-            if ($adapter instanceof S3Filesystem) {
-                $this->completeMultipartUpload($model, $adapter, $successful, $request->input('parts'));
+            $schema = $this->backupService->get($model->backupHost->schema);
+            if ($schema instanceof S3BackupSchema) {
+                $schema->completeMultipartUpload($model, $successful, $request->input('parts'));
             }
         });
 
@@ -97,6 +95,11 @@ class BackupStatusController extends Controller
         /** @var Backup $model */
         $model = Backup::query()->where('uuid', $backup)->firstOrFail();
 
+        $node = $request->attributes->get('node');
+        if (!$model->server->node->is($node)) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
         $model->server->update(['status' => null]);
 
         Activity::event($request->boolean('successful') ? 'server:backup.restore-complete' : 'server.backup.restore-failed')
@@ -106,59 +109,4 @@ class BackupStatusController extends Controller
 
         return new JsonResponse([], JsonResponse::HTTP_NO_CONTENT);
     }
-
-    /**
-     * Marks a multipart upload in a given S3-compatible instance as failed or successful for the given backup.
-     *
-     * @param  ?array<array{int, etag: string, part_number: string}>  $parts
-     *
-     * @throws Exception
-     * @throws DisplayException
-     */
-    protected function completeMultipartUpload(Backup $backup, S3Filesystem $adapter, bool $successful, ?array $parts): void
-    {
-        // This should never really happen, but if it does don't let us fall victim to Amazon's
-        // wildly fun error messaging. Just stop the process right here.
-        if (empty($backup->upload_id)) {
-            // A failed backup doesn't need to error here, this can happen if the backup encounters
-            // an error before we even start the upload. AWS gives you tooling to clear these failed
-            // multipart uploads as needed too.
-            if (!$successful) {
-                return;
-            }
-
-            throw new DisplayException('Cannot complete backup request: no upload_id present on model.');
-        }
-
-        $params = [
-            'Bucket' => $adapter->getBucket(),
-            'Key' => sprintf('%s/%s.tar.gz', $backup->server->uuid, $backup->uuid),
-            'UploadId' => $backup->upload_id,
-        ];
-
-        $client = $adapter->getClient();
-        if (!$successful) {
-            $client->execute($client->getCommand('AbortMultipartUpload', $params));
-
-            return;
-        }
-
-        // Otherwise send a CompleteMultipartUpload request.
-        $params['MultipartUpload'] = [
-            'Parts' => [],
-        ];
-
-        if (is_null($parts)) {
-            $params['MultipartUpload']['Parts'] = $client->execute($client->getCommand('ListParts', $params))['Parts'];
-        } else {
-            foreach ($parts as $part) {
-                $params['MultipartUpload']['Parts'][] = [
-                    'ETag' => $part['etag'],
-                    'PartNumber' => $part['part_number'],
-                ];
-            }
-        }
-
-        $client->execute($client->getCommand('CompleteMultipartUpload', $params));
-    }
 }

app/Http/Controllers/Api/Remote/Servers/ServerContainersController.php

@@ -3,18 +3,23 @@
 namespace App\Http\Controllers\Api\Remote\Servers;
 
 use App\Enums\ContainerStatus;
+use App\Exceptions\Http\HttpForbiddenException;
 use App\Http\Controllers\Controller;
-use App\Http\Requests\Api\Remote\ServerRequest;
 use App\Models\Server;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 
 class ServerContainersController extends Controller
 {
     /**
      * Updates the server container's status on the Panel
      */
-    public function status(ServerRequest $request, Server $server): JsonResponse
+    public function status(Request $request, Server $server): JsonResponse
     {
+        if (!$server->node->is($request->attributes->get('node'))) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
         $status = ContainerStatus::tryFrom($request->json('data.new_state')) ?? ContainerStatus::Missing;
 
         cache()->put("servers.$server->uuid.status", $status, now()->addHour());

app/Http/Controllers/Api/Remote/Servers/ServerDetailsController.php

@@ -3,9 +3,9 @@
 namespace App\Http\Controllers\Api\Remote\Servers;
 
 use App\Enums\ServerState;
+use App\Exceptions\Http\HttpForbiddenException;
 use App\Facades\Activity;
 use App\Http\Controllers\Controller;
-use App\Http\Requests\Api\Remote\ServerRequest;
 use App\Http\Resources\Daemon\ServerConfigurationCollection;
 use App\Models\ActivityLog;
 use App\Models\Backup;
@@ -17,6 +17,7 @@ use Illuminate\Database\ConnectionInterface;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Throwable;
+use Webmozart\Assert\Assert;
 
 class ServerDetailsController extends Controller
 {
@@ -33,8 +34,21 @@ class ServerDetailsController extends Controller
      * Returns details about the server that allows daemon to self-recover and ensure
      * that the state of the server matches the Panel at all times.
      */
-    public function __invoke(ServerRequest $request, Server $server): JsonResponse
+    public function __invoke(Request $request, Server $server): JsonResponse
     {
+        Assert::isInstanceOf($node = $request->attributes->get('node'), Node::class);
+
+        $transfer = $server->transfer;
+
+        // If the server is being transferred allow either node to request information about
+        // the server. If the server is not being transferred only the target node is allowed
+        // to fetch these details.
+        $valid = $transfer ? $node->id === $transfer->old_node || $node->id === $transfer->new_node : $node->id === $server->node_id;
+
+        if (!$valid) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
         return new JsonResponse([
             'settings' => $this->configurationStructureService->handle($server),
             'process_configuration' => $this->eggConfigurationService->handle($server),

app/Http/Controllers/Api/Remote/Servers/ServerInstallController.php

@@ -4,12 +4,13 @@ namespace App\Http\Controllers\Api\Remote\Servers;
 
 use App\Enums\ServerState;
 use App\Events\Server\Installed as ServerInstalled;
+use App\Exceptions\Http\HttpForbiddenException;
 use App\Exceptions\Model\DataValidationException;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Api\Remote\InstallationDataRequest;
-use App\Http\Requests\Api\Remote\ServerRequest;
 use App\Models\Server;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 
 class ServerInstallController extends Controller
@@ -17,12 +18,18 @@ class ServerInstallController extends Controller
     /**
      * Returns installation information for a server.
      */
-    public function index(ServerRequest $request, Server $server): JsonResponse
+    public function index(Request $request, Server $server): JsonResponse
     {
+        if (!$server->node->is($request->attributes->get('node'))) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
+        $egg = $server->egg;
+
         return new JsonResponse([
-            'container_image' => $server->egg->copy_script_container,
-            'entrypoint' => $server->egg->copy_script_entry,
-            'script' => $server->egg->copy_script_install,
+            'container_image' => $egg->copy_script_container,
+            'entrypoint' => $egg->copy_script_entry,
+            'script' => $egg->copy_script_install,
         ]);
     }
 
@@ -35,6 +42,10 @@ class ServerInstallController extends Controller
     {
         $status = null;
 
+        if (!$server->node->is($request->attributes->get('node'))) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
         $successful = $request->boolean('successful');
 
         // Make sure the type of failure is accurate

app/Http/Controllers/Api/Remote/Servers/ServerTransferController.php

@@ -2,17 +2,20 @@
 
 namespace App\Http\Controllers\Api\Remote\Servers;
 
+use App\Exceptions\Http\HttpForbiddenException;
 use App\Http\Controllers\Controller;
-use App\Http\Requests\Api\Remote\ServerRequest;
 use App\Models\Allocation;
+use App\Models\Node;
 use App\Models\Server;
 use App\Repositories\Daemon\DaemonServerRepository;
 use Illuminate\Database\ConnectionInterface;
 use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Symfony\Component\HttpKernel\Exception\ConflictHttpException;
 use Throwable;
+use Webmozart\Assert\Assert;
 
 class ServerTransferController extends Controller
 {
@@ -29,13 +32,22 @@ class ServerTransferController extends Controller
      *
      * @throws Throwable
      */
-    public function failure(ServerRequest $request, Server $server): JsonResponse
+    public function failure(Request $request, Server $server): JsonResponse
     {
         $transfer = $server->transfer;
         if (is_null($transfer)) {
             throw new ConflictHttpException('Server is not being transferred.');
         }
 
+        /* @var Node $node */
+        Assert::isInstanceOf($node = $request->attributes->get('node'), Node::class);
+
+        // Either node can tell the panel that the transfer has failed. Only the new node
+        // can tell the panel that it was successful.
+        if (!$node->is($transfer->newNode) && !$node->is($transfer->oldNode)) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
         $this->connection->transaction(function () use ($transfer) {
             $transfer->forceFill(['successful' => false])->saveOrFail();
 
@@ -53,13 +65,22 @@ class ServerTransferController extends Controller
      *
      * @throws Throwable
      */
-    public function success(ServerRequest $request, Server $server): JsonResponse
+    public function success(Request $request, Server $server): JsonResponse
     {
         $transfer = $server->transfer;
         if (is_null($transfer)) {
             throw new ConflictHttpException('Server is not being transferred.');
         }
 
+        /* @var Node $node */
+        Assert::isInstanceOf($node = $request->attributes->get('node'), Node::class);
+
+        // Only the new node communicates a successful state to the panel, so we should
+        // not allow the old node to hit this endpoint.
+        if (!$node->is($transfer->newNode)) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
         /** @var Server $server */
         $server = $this->connection->transaction(function () use ($server, $transfer) {
             $data = [];

app/Http/Middleware/SetSecurityHeaders.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+class SetSecurityHeaders
+{
+    /**
+     * Ideally we move away from X-Frame-Options/X-XSS-Protection and implement a
+     * proper standard CSP, but I can guarantee that will break for a lot of folks
+     * using custom plugins and who knows what image embeds.
+     *
+     * We'll circle back to that at a later date when it can be more fully controlled
+     * by the admin to support those cases without too much trouble.
+     *
+     * @var array<string, string>
+     */
+    protected static array $headers = [
+        'X-Frame-Options' => 'DENY',
+        'X-Content-Type-Options' => 'nosniff',
+        'X-XSS-Protection' => '1; mode=block',
+        'Referrer-Policy' => 'no-referrer-when-downgrade',
+    ];
+
+    /**
+     * Enforces some basic security headers on all responses returned by the software.
+     * If a header has already been set in another location within the code it will be
+     * skipped over here.
+     *
+     * @param  (\Closure(mixed): Response)  $next
+     */
+    public function handle(Request $request, \Closure $next): mixed
+    {
+        $response = $next($request);
+
+        foreach (static::$headers as $key => $value) {
+            if (!$response->headers->has($key)) {
+                $response->headers->set($key, $value);
+            }
+        }
+
+        return $response;
+    }
+}

app/Http/Requests/Api/Remote/InstallationDataRequest.php

@@ -2,8 +2,15 @@
 
 namespace App\Http\Requests\Api\Remote;
 
-class InstallationDataRequest extends ServerRequest
+use Illuminate\Foundation\Http\FormRequest;
+
+class InstallationDataRequest extends FormRequest
 {
+    public function authorize(): bool
+    {
+        return true;
+    }
+
     /**
      * @return array<string, string|string[]>
      */

app/Http/Requests/Api/Remote/ReportBackupCompleteRequest.php

@@ -3,7 +3,6 @@
 namespace App\Http\Requests\Api\Remote;
 
 use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Validation\Rule;
 
 class ReportBackupCompleteRequest extends FormRequest
 {
@@ -11,37 +10,13 @@ class ReportBackupCompleteRequest extends FormRequest
     public function rules(): array
     {
         return [
-            'successful' => [
-                'required',
-                'boolean',
-            ],
-            'checksum' => [
-                'nullable',
-                'string',
-                Rule::requiredIf(fn () => $this->boolean('successful')),
-            ],
-            'checksum_type' => [
-                'nullable',
-                'string',
-                Rule::requiredIf(fn () => $this->boolean('successful')),
-            ],
-            'size' => [
-                'nullable',
-                'numeric',
-                Rule::requiredIf(fn () => $this->boolean('successful')),
-            ],
-            'parts' => [
-                'nullable',
-                'array',
-            ],
-            'parts.*.etag' => [
-                'required',
-                'string',
-            ],
-            'parts.*.part_number' => [
-                'required',
-                'numeric',
-            ],
+            'successful' => 'required|boolean',
+            'checksum' => 'nullable|string|required_if:successful,true',
+            'checksum_type' => 'nullable|string|required_if:successful,true',
+            'size' => 'nullable|numeric|required_if:successful,true',
+            'parts' => 'nullable|array',
+            'parts.*.etag' => 'required|string',
+            'parts.*.part_number' => 'required|numeric',
         ];
     }
 }

app/Http/Requests/Api/Remote/ServerRequest.php

@@ -1,29 +0,0 @@
-<?php
-
-namespace App\Http\Requests\Api\Remote;
-
-use App\Models\Node;
-use App\Models\Server;
-use Illuminate\Foundation\Http\FormRequest;
-
-class ServerRequest extends FormRequest
-{
-    public function authorize(): bool
-    {
-        /** @var Node $node */
-        $node = $this->attributes->get('node');
-
-        /** @var ?Server $server */
-        $server = $this->route()->parameter('server');
-
-        if ($server) {
-            if ($server->transfer) {
-                return $server->transfer->old_node === $node->id || $server->transfer->new_node === $node->id;
-            }
-
-            return $server->node_id === $node->id;
-        }
-
-        return false;
-    }
-}

app/Http/Requests/Api/Remote/SftpAuthenticationFormRequest.php

@@ -3,7 +3,6 @@
 namespace App\Http\Requests\Api\Remote;
 
 use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Validation\Rule;
 
 class SftpAuthenticationFormRequest extends FormRequest
 {
@@ -23,10 +22,7 @@ class SftpAuthenticationFormRequest extends FormRequest
     public function rules(): array
     {
         return [
-            'type' => [
-                'nullable',
-                Rule::in(['password', 'public_key']),
-            ],
+            'type' => ['nullable', 'in:password,public_key'],
             'username' => ['required', 'string'],
             'password' => ['required', 'string'],
         ];

app/Jobs/Job.php

@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Jobs;
-
-use Illuminate\Bus\Queueable;
-
-abstract class Job
-{
-    /*
-    |--------------------------------------------------------------------------
-    | Queueable Jobs
-    |--------------------------------------------------------------------------
-    |
-    | This job base class provides a central location to place any logic that
-    | is shared across all of your jobs. The trait included with the class
-    | provides access to the "onQueue" and "delay" queue helper methods.
-    |
-    */
-
-    use Queueable;
-}

app/Jobs/RevokeSftpAccessJob.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Node;
+use App\Models\Server;
+use App\Repositories\Daemon\DaemonServerRepository;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+use Illuminate\Http\Client\ConnectionException;
+use Illuminate\Queue\Attributes\DeleteWhenMissingModels;
+use Illuminate\Queue\Attributes\WithoutRelations;
+
+/**
+ * Revokes all SFTP access for a user on a given node or for a specific server.
+ */
+#[DeleteWhenMissingModels]
+class RevokeSftpAccessJob implements ShouldBeUnique, ShouldQueue
+{
+    use Queueable;
+
+    public int $tries = 3;
+
+    public int $maxExceptions = 1;
+
+    public function __construct(
+        public readonly string $user,
+        #[WithoutRelations]
+        public readonly Server|Node $target,
+    ) {}
+
+    public function uniqueId(): string
+    {
+        $target = $this->target instanceof Node ? "node:{$this->target->uuid}" : "server:{$this->target->uuid}";
+
+        return "revoke-sftp:{$this->user}:{$target}";
+    }
+
+    public function handle(DaemonServerRepository $repository): void
+    {
+        try {
+            if ($this->target instanceof Server) {
+                $repository->setServer($this->target)->deauthorize($this->user);
+            } else {
+                $repository->setNode($this->target)->deauthorize($this->user);
+            }
+        } catch (ConnectionException) {
+            // Keep retrying this job with a longer and longer backoff until we hit three
+            // attempts at which point we stop and will assume the node is fully offline
+            // and we are just wasting time.
+            $this->release($this->attempts() * 10);
+        }
+    }
+}

app/Jobs/Schedule/RunTaskJob.php

@@ -7,6 +7,7 @@ use App\Jobs\Job;
 use App\Models\Task;
 use Carbon\CarbonImmutable;
 use Exception;
+use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Queue\InteractsWithQueue;
@@ -14,9 +15,10 @@ use Illuminate\Queue\SerializesModels;
 use InvalidArgumentException;
 use Throwable;
 
-class RunTaskJob extends Job implements ShouldQueue
+class RunTaskJob implements ShouldQueue
 {
     use InteractsWithQueue;
+    use Queueable;
     use SerializesModels;
 
     /**

app/Listeners/RevocationListener.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Listeners;
+
+use App\Events\User\Deleting;
+use App\Events\User\PasswordChanged;
+use App\Jobs\RevokeSftpAccessJob;
+use App\Models\Node;
+use Illuminate\Database\Eloquent\Collection;
+
+class RevocationListener
+{
+    public function handle(Deleting|PasswordChanged $event): void
+    {
+        $user = $event->user;
+
+        // Look at all of the nodes that a user is associated with and trigger a job
+        // that disconnects them from websockets and SFTP.
+        Node::query()
+            ->whereIn('nodes.id', $user->directAccessibleServers()->select('servers.node_id')->distinct())
+            ->chunk(50, function (Collection $nodes) use ($user) {
+                $nodes->each(fn (Node $node) => RevokeSftpAccessJob::dispatch($user->uuid, $node));
+            });
+    }
+}

app/Models/Backup.php

@@ -20,7 +20,8 @@ use Illuminate\Database\Query\Builder;
  * @property string $uuid
  * @property string $name
  * @property string[] $ignored_files
- * @property string $disk
+ * @property int $backup_host_id
+ * @property BackupHost $backupHost
  * @property string|null $checksum
  * @property int $bytes
  * @property CarbonImmutable|null $completed_at
@@ -65,10 +66,6 @@ class Backup extends Model implements Validatable
 
     public const RESOURCE_NAME = 'backup';
 
-    public const ADAPTER_DAEMON = 'wings';
-
-    public const ADAPTER_AWS_S3 = 's3';
-
     protected $attributes = [
         'is_successful' => false,
         'is_locked' => false,
@@ -87,7 +84,7 @@ class Backup extends Model implements Validatable
         'is_locked' => ['boolean'],
         'name' => ['required', 'string'],
         'ignored_files' => ['array'],
-        'disk' => ['required', 'string'],
+        'backup_host_id' => ['required', 'numeric', 'exists:backup_hosts,id'],
         'checksum' => ['nullable', 'string'],
         'bytes' => ['numeric'],
         'upload_id' => ['nullable', 'string'],
@@ -120,6 +117,11 @@ class Backup extends Model implements Validatable
         return $this->belongsTo(Server::class);
     }
 
+    public function backupHost(): BelongsTo
+    {
+        return $this->belongsTo(BackupHost::class);
+    }
+
     /**
      * @param  Builder  $query
      * @return BackupQueryBuilder<Model>

app/Models/BackupHost.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Models;
+
+use App\Contracts\Validatable;
+use App\Traits\HasValidation;
+use Carbon\CarbonImmutable;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+/**
+ * @property int $id
+ * @property string $name
+ * @property string $schema
+ * @property array<string, mixed> $configuration
+ * @property CarbonImmutable $created_at
+ * @property CarbonImmutable $updated_at
+ * @property Collection|Node[] $nodes
+ * @property int|null $nodes_count
+ * @property Collection|Backup[] $backups
+ * @property int|null $backups_count
+ */
+class BackupHost extends Model implements Validatable
+{
+    use HasFactory;
+    use HasValidation;
+
+    public const RESOURCE_NAME = 'backup_host';
+
+    protected $fillable = [
+        'name',
+        'schema',
+        'configuration',
+    ];
+
+    /** @var array<array-key, string[]> */
+    public static array $validationRules = [
+        'name' => ['required', 'string', 'max:255'],
+        'schema' => ['required', 'string', 'max:255'],
+        'configuration' => ['nullable', 'array'],
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'configuration' => 'array',
+        ];
+    }
+
+    public function nodes(): BelongsToMany
+    {
+        return $this->belongsToMany(Node::class);
+    }
+
+    public function backups(): HasMany
+    {
+        return $this->hasMany(Backup::class);
+    }
+}

app/Models/Egg.php

@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Contracts\Validatable;
 use App\Exceptions\Service\Egg\HasChildrenException;
 use App\Exceptions\Service\HasActiveServersException;
+use App\Models\Traits\HasIcon;
 use App\Traits\HasValidation;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +14,6 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\MorphToMany;
 use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
 
 /**
@@ -47,7 +47,7 @@ use Illuminate\Support\Str;
  * @property-read string $copy_script_container
  * @property-read string $copy_script_entry
  * @property-read string|null $copy_script_install
- * @property-read string|null $image
+ * @property-read string|null $icon
  * @property-read string|null $inherit_config_files
  * @property-read string|null $inherit_config_logs
  * @property-read string|null $inherit_config_startup
@@ -94,6 +94,7 @@ use Illuminate\Support\Str;
 class Egg extends Model implements Validatable
 {
     use HasFactory;
+    use HasIcon;
     use HasValidation;
 
     /**
@@ -107,22 +108,6 @@ class Egg extends Model implements Validatable
      */
     public const EXPORT_VERSION = 'PLCN_v3';
 
-    /**
-     * Path to store egg icons relative to storage path.
-     */
-    public const ICON_STORAGE_PATH = 'icons/egg';
-
-    /**
-     * Supported image formats: file extension => MIME type
-     */
-    public const IMAGE_FORMATS = [
-        'png' => 'image/png',
-        'jpg' => 'image/jpeg',
-        'jpeg' => 'image/jpeg',
-        'webp' => 'image/webp',
-        'svg' => 'image/svg+xml',
-    ];
-
     /**
      * Fields that are not mass assignable.
      */
@@ -377,16 +362,4 @@ class Egg extends Model implements Validatable
     {
         return str($this->name)->kebab()->lower()->trim()->split('/[^\w\-]/')->join('');
     }
-
-    public function getImageAttribute(): ?string
-    {
-        foreach (array_keys(static::IMAGE_FORMATS) as $ext) {
-            $path = static::ICON_STORAGE_PATH . "/$this->uuid.$ext";
-            if (Storage::disk('public')->exists($path)) {
-                return Storage::disk('public')->url($path);
-            }
-        }
-
-        return null;
-    }
 }

app/Models/Node.php

@@ -61,6 +61,8 @@ use Symfony\Component\Yaml\Yaml;
  * @property-read int|null $roles_count
  * @property-read Collection<int, Server> $servers
  * @property-read int|null $servers_count
+ * @property-read Collection<int, BackupHost> $backupHosts
+ * @property-read int|null $backup_hosts_count
  *
  * @method static \Database\Factories\NodeFactory factory($count = null, $state = [])
  * @method static \Illuminate\Database\Eloquent\Builder<static>|Node newModelQuery()
@@ -308,14 +310,17 @@ class Node extends Model implements Validatable
         return $this->hasMany(Allocation::class);
     }
 
-    /**
-     * @return BelongsToMany<DatabaseHost, $this>
-     */
+    /** @return BelongsToMany<DatabaseHost, $this> */
     public function databaseHosts(): BelongsToMany
     {
         return $this->belongsToMany(DatabaseHost::class);
     }
 
+    public function backupHosts(): BelongsToMany
+    {
+        return $this->belongsToMany(BackupHost::class);
+    }
+
     public function roles(): HasManyThrough
     {
         return $this->hasManyThrough(Role::class, NodeRole::class, 'node_id', 'id', 'id', 'role_id');

app/Models/Server.php

@@ -7,10 +7,12 @@ use App\Enums\ContainerStatus;
 use App\Enums\ServerResourceType;
 use App\Enums\ServerState;
 use App\Exceptions\Http\Server\ServerStateConflictException;
+use App\Models\Traits\HasIcon;
 use App\Repositories\Daemon\DaemonServerRepository;
 use App\Services\Subusers\SubuserDeletionService;
 use App\Traits\HasValidation;
 use Carbon\CarbonInterface;
+use Exception;
 use Filament\Models\Contracts\HasAvatar;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -29,7 +31,6 @@ use Illuminate\Notifications\Notifiable;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Http;
-use Illuminate\Support\Facades\Storage;
 use Psr\Http\Message\ResponseInterface;
 
 /**
@@ -129,6 +130,7 @@ use Psr\Http\Message\ResponseInterface;
 class Server extends Model implements HasAvatar, Validatable
 {
     use HasFactory;
+    use HasIcon;
     use HasValidation;
     use Notifiable;
 
@@ -138,22 +140,6 @@ class Server extends Model implements HasAvatar, Validatable
      */
     public const RESOURCE_NAME = 'server';
 
-    /**
-     * Path to store server icons relative to storage path.
-     */
-    public const ICON_STORAGE_PATH = 'icons/server';
-
-    /**
-     * Supported image formats: file extension => MIME type
-     */
-    public const IMAGE_FORMATS = [
-        'png' => 'image/png',
-        'jpg' => 'image/jpeg',
-        'jpeg' => 'image/jpeg',
-        'webp' => 'image/webp',
-        'svg' => 'image/svg+xml',
-    ];
-
     /**
      * Default values when creating the model. We want to switch to disabling OOM killer
      * on server instances unless the user specifies otherwise in the request.
@@ -527,20 +513,8 @@ class Server extends Model implements HasAvatar, Validatable
         );
     }
 
-    public function getIconAttribute(): ?string
-    {
-        foreach (array_keys(static::IMAGE_FORMATS) as $ext) {
-            $path = static::ICON_STORAGE_PATH . "/$this->uuid.$ext";
-            if (Storage::disk('public')->exists($path)) {
-                return Storage::disk('public')->url($path);
-            }
-        }
-
-        return null;
-    }
-
     public function getFilamentAvatarUrl(): ?string
     {
-        return $this->icon ?? $this->egg->image;
+        return $this->icon ?? $this->egg->icon;
     }
 }

app/Models/ServerTransfer.php

@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Contracts\Validatable;
 use App\Traits\HasValidation;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasOne;
@@ -44,6 +45,7 @@ use Illuminate\Support\Carbon;
  */
 class ServerTransfer extends Model implements Validatable
 {
+    use HasFactory;
     use HasValidation;
 
     /**

app/Models/Subuser.php

@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Contracts\Validatable;
 use App\Enums\SubuserPermission;
 use App\Traits\HasValidation;
+use BackedEnum;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
@@ -44,17 +45,21 @@ class Subuser extends Model implements Validatable
      */
     public const RESOURCE_NAME = 'server_subuser';
 
-    /** @var array<string, array{name: string, hidden: ?bool, icon: ?string, permissions: string[]}> */
+    /** @var array<string, array{name: string, hidden: ?bool, icon: null|string|BackedEnum, translation_prefix: ?string, permissions: string[]}> */
     protected static array $customPermissions = [];
 
     /** @param string[] $permissions */
-    public static function registerCustomPermissions(string $name, array $permissions, ?string $icon = null, ?bool $hidden = null): void
+    public static function registerCustomPermissions(string $name, array $permissions, ?string $translationPrefix = null, null|string|BackedEnum $icon = null, ?bool $hidden = null): void
     {
         $customPermission = static::$customPermissions[$name] ?? [];
 
         $customPermission['name'] = $name;
         $customPermission['permissions'] = array_merge($customPermission['permissions'] ?? [], $permissions);
 
+        if (!is_null($translationPrefix)) {
+            $customPermission['translation_prefix'] = $translationPrefix;
+        }
+
         if (!is_null($icon)) {
             $customPermission['icon'] = $icon;
         }
@@ -104,7 +109,7 @@ class Subuser extends Model implements Validatable
         return $this->belongsTo(User::class);
     }
 
-    /** @return array<array{name: string, hidden: bool, icon: string, permissions: string[]}> */
+    /** @return array<array{name: string, hidden: bool, icon: null|string|BackedEnum, translation_prefix: string, permissions: string[]}> */
     public static function allPermissionData(): array
     {
         $allPermissions = [];
@@ -117,6 +122,7 @@ class Subuser extends Model implements Validatable
                 'hidden' => $subuserPermission->isHidden(),
                 'icon' => $subuserPermission->getIcon(),
                 'permissions' => array_merge($allPermissions[$group]['permissions'] ?? [], [$permission]),
+                'translation_prefix' => 'server/user.permissions',
             ];
         }
 
@@ -130,6 +136,7 @@ class Subuser extends Model implements Validatable
                 'hidden' => $customPermission['hidden'] ?? $groupData['hidden'] ?? false,
                 'icon' => $customPermission['icon'] ?? $groupData['icon'],
                 'permissions' => array_unique(array_merge($groupData['permissions'] ?? [], $customPermission['permissions'])),
+                'translation_prefix' => $customPermission['translation_prefix'] ?? $groupData['translation_prefix'] ?? 'server/user.permissions',
             ];
 
             $allPermissions[$name] = $groupData;

app/Models/Traits/HasIcon.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Models\Traits;
+
+use App\Models\Model;
+use Exception;
+use Illuminate\Support\Facades\Storage;
+
+/**
+ * @mixin Model
+ */
+trait HasIcon
+{
+    /**
+     * Supported icon formats: file extension => MIME type
+     *
+     * @var array<string, string>
+     */
+    public static array $iconFormats = [
+        'png' => 'image/png',
+        'jpg' => 'image/jpeg',
+        'webp' => 'image/webp',
+    ];
+
+    public static function getIconStoragePath(): string
+    {
+        return 'icons/' . static::RESOURCE_NAME;
+    }
+
+    public function getIconAttribute(): ?string
+    {
+        foreach (array_keys(static::$iconFormats) as $ext) {
+            $path = $this->getIconStoragePath() . "/$this->uuid.$ext";
+            if (Storage::disk('public')->exists($path)) {
+                return Storage::disk('public')->url($path);
+            }
+        }
+
+        return null;
+    }
+
+    public function writeIcon(string $extension, string $data): string
+    {
+        $normalizedExtension = match (strtolower($extension)) {
+            'jpeg', 'jpg' => 'jpg',
+            'png' => 'png',
+            'webp' => 'webp',
+            default => null,
+        };
+
+        if (is_null($normalizedExtension)) {
+            throw new Exception(trans('admin/egg.import.unknown_extension', ['extension' => $extension]));
+        }
+
+        $fileName = static::getIconStoragePath() . "/$this->uuid.$normalizedExtension";
+
+        if (!Storage::disk('public')->put($fileName, $data)) {
+            throw new Exception(trans('admin/egg.import.could_not_write'));
+        }
+
+        foreach (['png', 'jpg', 'jpeg', 'webp', 'svg'] as $ext) {
+            if ($ext === $normalizedExtension) {
+                continue;
+            }
+
+            $path = static::getIconStoragePath() . "/$this->uuid.$ext";
+            if (Storage::disk('public')->exists($path)) {
+                Storage::disk('public')->delete($path);
+            }
+        }
+
+        return $fileName;
+    }
+}

app/Models/User.php

@@ -5,6 +5,7 @@ namespace App\Models;
 use App\Contracts\Validatable;
 use App\Enums\CustomizationKey;
 use App\Enums\SubuserPermission;
+use App\Events\User\Deleting;
 use App\Exceptions\DisplayException;
 use App\Extensions\Avatar\AvatarService;
 use App\Models\Traits\HasAccessTokens;
@@ -225,6 +226,8 @@ class User extends Model implements AuthenticatableContract, AuthorizableContrac
             throw_if($user->servers()->count() > 0, new DisplayException(trans('exceptions.users.has_servers')));
 
             throw_if(request()->user()?->id === $user->id, new DisplayException(trans('exceptions.users.is_self')));
+
+            event(new Deleting($user));
         });
     }
 

app/Policies/BackupHostPolicy.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\BackupHost;
+use App\Models\User;
+
+class BackupHostPolicy
+{
+    use DefaultAdminPolicies;
+
+    protected string $modelName = 'backupHost';
+
+    public function before(User $user, string $ability, string|BackupHost $backupHost): ?bool
+    {
+        // For "viewAny" the $backupHost param is the class name
+        if (is_string($backupHost)) {
+            return null;
+        }
+
+        foreach ($backupHost->nodes as $node) {
+            if (!$user->canTarget($node)) {
+                return false;
+            }
+        }
+
+        return null;
+    }
+}

app/Providers/AppServiceProvider.php

@@ -117,8 +117,6 @@ class AppServiceProvider extends ServiceProvider
             'Up-to-Date' => $versionService->isLatestPanel() ? '<fg=green;options=bold>Yes</>' : '<fg=red;options=bold>No</>',
         ]);
 
-        AboutCommand::add('Drivers', 'Backups', config('backups.default'));
-
         AboutCommand::add('Environment', 'Installation Directory', base_path());
     }
 

app/Providers/BackupsServiceProvider.php

@@ -1,28 +0,0 @@
-<?php
-
-namespace App\Providers;
-
-use App\Extensions\Backups\BackupManager;
-use Illuminate\Contracts\Support\DeferrableProvider;
-use Illuminate\Support\ServiceProvider;
-
-class BackupsServiceProvider extends ServiceProvider implements DeferrableProvider
-{
-    /**
-     * Register the S3 backup disk.
-     */
-    public function register(): void
-    {
-        $this->app->singleton(BackupManager::class, function ($app) {
-            return new BackupManager($app);
-        });
-    }
-
-    /**
-     * @return class-string[]
-     */
-    public function provides(): array
-    {
-        return [BackupManager::class];
-    }
-}

app/Providers/Extensions/BackupAdapterServiceProvider.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Providers\Extensions;
+
+use App\Extensions\BackupAdapter\BackupAdapterService;
+use App\Extensions\BackupAdapter\Schemas\S3BackupSchema;
+use App\Extensions\BackupAdapter\Schemas\WingsBackupSchema;
+use App\Repositories\Daemon\DaemonBackupRepository;
+use App\Services\Nodes\NodeJWTService;
+use Illuminate\Support\ServiceProvider;
+
+class BackupAdapterServiceProvider extends ServiceProvider
+{
+    public function register(): void
+    {
+        $this->app->singleton(BackupAdapterService::class, function ($app) {
+            $service = new BackupAdapterService();
+
+            // Default Backup adapter providers
+            $service->register(new WingsBackupSchema($app->make(DaemonBackupRepository::class), $app->make(NodeJWTService::class)));
+            $service->register(new S3BackupSchema($app->make(DaemonBackupRepository::class)));
+
+            return $service;
+        });
+    }
+}

app/Providers/Filament/PanelProvider.php

@@ -7,6 +7,7 @@ use App\Filament\Pages\Auth\EditProfile;
 use App\Filament\Pages\Auth\Login;
 use App\Http\Middleware\LanguageMiddleware;
 use App\Http\Middleware\RequireTwoFactorAuthentication;
+use App\Http\Middleware\SetSecurityHeaders;
 use Filament\Actions\Action;
 use Filament\Auth\MultiFactor\App\AppAuthentication;
 use Filament\Auth\MultiFactor\Email\EmailAuthentication;
@@ -70,6 +71,7 @@ abstract class PanelProvider extends BasePanelProvider
                 DisableBladeIconComponents::class,
                 DispatchServingFilamentEvent::class,
                 LanguageMiddleware::class,
+                SetSecurityHeaders::class,
             ])
             ->authMiddleware([
                 Authenticate::class,

app/Repositories/Daemon/DaemonBackupRepository.php

@@ -8,28 +8,16 @@ use Illuminate\Http\Client\Response;
 
 class DaemonBackupRepository extends DaemonRepository
 {
-    protected ?string $adapter;
-
-    /**
-     * Sets the backup adapter for this execution instance.
-     */
-    public function setBackupAdapter(string $adapter): self
-    {
-        $this->adapter = $adapter;
-
-        return $this;
-    }
-
     /**
      * Tells the remote Daemon to begin generating a backup for the server.
      *
      * @throws ConnectionException
      */
-    public function backup(Backup $backup): Response
+    public function create(Backup $backup): Response
     {
         return $this->getHttpClient()->post("/api/servers/{$this->server->uuid}/backup",
             [
-                'adapter' => $this->adapter ?? config('backups.default'),
+                'adapter' => $backup->backupHost->schema,
                 'uuid' => $backup->uuid,
                 'ignore' => implode("\n", $backup->ignored_files),
             ]
@@ -45,7 +33,7 @@ class DaemonBackupRepository extends DaemonRepository
     {
         return $this->getHttpClient()->post("/api/servers/{$this->server->uuid}/backup/$backup->uuid/restore",
             [
-                'adapter' => $backup->disk,
+                'adapter' => $backup->backupHost->schema,
                 'truncate_directory' => $truncate,
                 'download_url' => $url ?? '',
             ]

app/Repositories/Daemon/DaemonServerRepository.php

@@ -147,7 +147,7 @@ class DaemonServerRepository extends DaemonRepository
     }
 
     /**
-     * Deauthorizes a user (disconnects websockets and SFTP) on the Wings instance for the server.
+     * Deauthorizes a user (disconnects websockets and SFTP) on the Wings instance for the server (or all servers of a node).
      *
      * @throws ConnectionException
      */
@@ -156,7 +156,7 @@ class DaemonServerRepository extends DaemonRepository
         $this->getHttpClient()->post('/api/deauthorize-user', [
             'json' => [
                 'user' => $user,
-                'servers' => [$this->server->uuid],
+                'servers' => $this->server ? [$this->server->uuid] : [],
             ],
         ]);
     }

app/Services/Allocations/FindAssignableAllocationService.php

@@ -56,6 +56,7 @@ class FindAssignableAllocationService
         // those belonging to the current server (making it impossible to find unassigned ones)
         /** @var Allocation|null $allocation */
         $allocation = Allocation::withoutGlobalScopes()
+            ->lockForUpdate()
             ->where('node_id', $server->node_id)
             ->when($server->allocation, function ($query) use ($server) {
                 $query->where('ip', $server->allocation->ip);
@@ -125,6 +126,7 @@ class FindAssignableAllocationService
 
         /** @var Allocation $allocation */
         $allocation = Allocation::withoutGlobalScopes()
+            ->lockForUpdate()
             ->where('node_id', $server->node_id)
             ->where('ip', $server->allocation->ip)
             ->where('port', $port)

app/Services/Backups/DeleteBackupService.php

@@ -3,23 +3,15 @@
 namespace App\Services\Backups;
 
 use App\Exceptions\Service\Backup\BackupLockedException;
-use App\Extensions\Backups\BackupManager;
-use App\Extensions\Filesystem\S3Filesystem;
+use App\Extensions\BackupAdapter\BackupAdapterService;
 use App\Models\Backup;
-use App\Repositories\Daemon\DaemonBackupRepository;
-use Aws\S3\S3Client;
 use Exception;
 use Illuminate\Database\ConnectionInterface;
-use Illuminate\Http\Response;
 use Throwable;
 
 class DeleteBackupService
 {
-    public function __construct(
-        private ConnectionInterface $connection,
-        private BackupManager $manager,
-        private DaemonBackupRepository $daemonBackupRepository
-    ) {}
+    public function __construct(private readonly ConnectionInterface $connection, private readonly BackupAdapterService $backupService) {}
 
     /**
      * Deletes a backup from the system. If the backup is stored in S3 a request
@@ -39,47 +31,15 @@ class DeleteBackupService
             throw new BackupLockedException();
         }
 
-        if ($backup->disk === Backup::ADAPTER_AWS_S3) {
-            $this->deleteFromS3($backup);
-
-            return;
+        $schema = $this->backupService->get($backup->backupHost->schema);
+        if (!$schema) {
+            throw new Exception('Backup has unknown backup adapter.');
         }
 
-        $this->connection->transaction(function () use ($backup) {
-            try {
-                $this->daemonBackupRepository->setServer($backup->server)->delete($backup);
-            } catch (Exception $exception) {
-                // Don't fail the request if the Daemon responds with a 404, just assume the backup
-                // doesn't actually exist and remove its reference from the Panel as well.
-                if ($exception->getCode() !== Response::HTTP_NOT_FOUND) {
-                    throw $exception;
-                }
-            }
+        $this->connection->transaction(function () use ($schema, $backup) {
+            $schema->deleteBackup($backup);
 
             $backup->delete();
         });
     }
-
-    /**
-     * Deletes a backup from an S3 disk.
-     *
-     * @throws Throwable
-     */
-    protected function deleteFromS3(Backup $backup): void
-    {
-        $this->connection->transaction(function () use ($backup) {
-            $backup->delete();
-
-            /** @var S3Filesystem $adapter */
-            $adapter = $this->manager->adapter(Backup::ADAPTER_AWS_S3);
-
-            /** @var S3Client $client */
-            $client = $adapter->getClient();
-
-            $client->deleteObject([
-                'Bucket' => $adapter->getBucket(),
-                'Key' => sprintf('%s/%s.tar.gz', $backup->server->uuid, $backup->uuid),
-            ]);
-        });
-    }
 }

app/Services/Backups/DownloadLinkService.php

@@ -2,60 +2,28 @@
 
 namespace App\Services\Backups;
 
-use App\Extensions\Backups\BackupManager;
-use App\Extensions\Filesystem\S3Filesystem;
+use App\Extensions\BackupAdapter\BackupAdapterService;
 use App\Models\Backup;
 use App\Models\User;
-use App\Services\Nodes\NodeJWTService;
-use Carbon\CarbonImmutable;
+use Exception;
 
 class DownloadLinkService
 {
-    /**
-     * DownloadLinkService constructor.
-     */
-    public function __construct(private BackupManager $backupManager, private NodeJWTService $jwtService) {}
+    public function __construct(private readonly BackupAdapterService $backupService) {}
 
     /**
      * Returns the URL that allows for a backup to be downloaded by an individual
      * user, or by the daemon control software.
+     *
+     * @throws Exception
      */
     public function handle(Backup $backup, User $user): string
     {
-        if ($backup->disk === Backup::ADAPTER_AWS_S3) {
-            return $this->getS3BackupUrl($backup);
+        $schema = $this->backupService->get($backup->backupHost->schema);
+        if (!$schema) {
+            throw new Exception('Backup has unknown backup adapter.');
         }
 
-        $token = $this->jwtService
-            ->setExpiresAt(CarbonImmutable::now()->addMinutes(15))
-            ->setUser($user)
-            ->setClaims([
-                'backup_uuid' => $backup->uuid,
-                'server_uuid' => $backup->server->uuid,
-            ])
-            ->handle($backup->server->node, $user->id . $backup->server->uuid);
-
-        return sprintf('%s/download/backup?token=%s', $backup->server->node->getConnectionAddress(), $token->toString());
-    }
-
-    /**
-     * Returns a signed URL that allows us to download a file directly out of a non-public
-     * S3 bucket by using a signed URL.
-     */
-    protected function getS3BackupUrl(Backup $backup): string
-    {
-        /** @var S3Filesystem $adapter */
-        $adapter = $this->backupManager->adapter(Backup::ADAPTER_AWS_S3);
-
-        $request = $adapter->getClient()->createPresignedRequest(
-            $adapter->getClient()->getCommand('GetObject', [
-                'Bucket' => $adapter->getBucket(),
-                'Key' => sprintf('%s/%s.tar.gz', $backup->server->uuid, $backup->uuid),
-                'ContentType' => 'application/x-gzip',
-            ]),
-            CarbonImmutable::now()->addMinutes(5)
-        );
-
-        return $request->getUri()->__toString();
+        return $schema->getDownloadLink($backup, $user);
     }
 }

app/Services/Backups/InitiateBackupService.php

@@ -3,10 +3,11 @@
 namespace App\Services\Backups;
 
 use App\Exceptions\Service\Backup\TooManyBackupsException;
-use App\Extensions\Backups\BackupManager;
+use App\Extensions\BackupAdapter\BackupAdapterService;
 use App\Models\Backup;
+use App\Models\BackupHost;
 use App\Models\Server;
-use App\Repositories\Daemon\DaemonBackupRepository;
+use Exception;
 use Illuminate\Database\ConnectionInterface;
 use Ramsey\Uuid\Uuid;
 use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
@@ -25,9 +26,8 @@ class InitiateBackupService
      */
     public function __construct(
         private readonly ConnectionInterface $connection,
-        private readonly DaemonBackupRepository $daemonBackupRepository,
         private readonly DeleteBackupService $deleteBackupService,
-        private readonly BackupManager $backupManager
+        private readonly BackupAdapterService $backupService
     ) {}
 
     /**
@@ -110,20 +110,28 @@ class InitiateBackupService
             $this->deleteBackupService->handle($oldest);
         }
 
-        return $this->connection->transaction(function () use ($server, $name) {
-            /** @var Backup $backup */
-            $backup = Backup::query()->create([
+        // TODO: select backup host via frontend
+        $backupHost = $server->node->backupHosts()->first();
+        if (!$backupHost) {
+            $backupHost = BackupHost::doesntHave('nodes')->firstOrFail();
+        }
+
+        $schema = $this->backupService->get($backupHost->schema);
+        if (!$schema) {
+            throw new Exception('Backup host has unknown backup adapter.');
+        }
+
+        return $this->connection->transaction(function () use ($backupHost, $schema, $server, $name) {
+            $backup = Backup::create([
                 'server_id' => $server->id,
                 'uuid' => Uuid::uuid4()->toString(),
                 'name' => trim($name) ?: sprintf('Backup at %s', now()->toDateTimeString()),
                 'ignored_files' => array_values($this->ignoredFiles ?? []),
-                'disk' => $this->backupManager->getDefaultAdapter(),
+                'backup_host_id' => $backupHost->id,
                 'is_locked' => $this->isLocked,
             ]);
 
-            $this->daemonBackupRepository->setServer($server)
-                ->setBackupAdapter($this->backupManager->getDefaultAdapter())
-                ->backup($backup);
+            $schema->createBackup($backup);
 
             return $backup;
         });

app/Services/Eggs/Sharing/EggExporterService.php

@@ -18,7 +18,7 @@ class EggExporterService
     public function handle(int $egg, EggFormat $format): string
     {
         $egg = Egg::with(['scriptFrom', 'configFrom', 'variables'])->findOrFail($egg);
-        $imageBase64 = $this->getEggImageAsBase64($egg);
+        $iconBase64 = $this->getEggIconAsBase64($egg);
 
         $struct = [
             '_comment' => 'DO NOT EDIT: FILE GENERATED AUTOMATICALLY BY PANEL',
@@ -31,7 +31,7 @@ class EggExporterService
             'author' => $egg->author,
             'uuid' => $egg->uuid,
             'description' => $egg->description,
-            'image' => $imageBase64,
+            'icon' => $iconBase64,
             'tags' => $egg->tags,
             'features' => $egg->features,
             'docker_images' => $egg->docker_images,
@@ -63,16 +63,14 @@ class EggExporterService
     }
 
     /**
-     * Get the egg image as base64 for export.
+     * Get the egg icon as base64 for export.
      */
-    private function getEggImageAsBase64(Egg $egg): ?string
+    private function getEggIconAsBase64(Egg $egg): ?string
     {
-        foreach (array_keys(Egg::IMAGE_FORMATS) as $ext) {
-            $path = Egg::ICON_STORAGE_PATH . "/$egg->uuid.$ext";
+        foreach (Egg::$iconFormats as $ext => $mimeType) {
+            $path = Egg::getIconStoragePath() . "/$egg->uuid.$ext";
 
             if (Storage::disk('public')->exists($path)) {
-                $mimeType = Egg::IMAGE_FORMATS[$ext];
-
                 return 'data:' . $mimeType . ';base64,' . base64_encode(Storage::disk('public')->get($path));
             }
         }

app/Services/Eggs/Sharing/EggImporterService.php

@@ -6,12 +6,12 @@ use App\Enums\EggFormat;
 use App\Exceptions\Service\InvalidFileUploadException;
 use App\Models\Egg;
 use App\Models\EggVariable;
+use Exception;
 use Illuminate\Database\ConnectionInterface;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Http;
-use Illuminate\Support\Facades\Storage;
 use JsonException;
 use Ramsey\Uuid\Uuid;
 use stdClass;
@@ -223,6 +223,11 @@ class EggImporterService
             }
         }
 
+        if (!empty($parsed['image']) && str_starts_with($parsed['image'], 'data:')) {
+            $parsed['icon'] = $parsed['image'];
+            unset($parsed['image']);
+        }
+
         return $parsed;
     }
 
@@ -231,9 +236,9 @@ class EggImporterService
      */
     protected function fillFromParsed(Egg $model, array $parsed): Egg
     {
-        // Handle image data if present
-        if (!empty($parsed['image']) && str_starts_with($parsed['image'], 'data:')) {
-            $this->saveEggImageFromBase64($parsed['image'], $model);
+        // Handle icon data if present
+        if (!empty($parsed['icon']) && str_starts_with($parsed['icon'], 'data:')) {
+            $this->saveEggIconFromBase64($parsed['icon'], $model);
         }
 
         return $model->forceFill([
@@ -256,34 +261,24 @@ class EggImporterService
     }
 
     /**
-     * Save an egg image from base64 data to a file.
+     * Save an egg icon from base64 data to a file.
      */
-    private function saveEggImageFromBase64(string $base64String, Egg $egg): void
+    private function saveEggIconFromBase64(string $base64String, Egg $egg): void
     {
         if (!preg_match('/^data:image\/([\w+]+);base64,(.+)$/', $base64String, $matches)) {
             return;
         }
 
-        $extension = strtolower($matches[1]);
-        $data = base64_decode($matches[2]);
+        try {
+            $extension = strtolower($matches[1]);
+            $data = base64_decode($matches[2]);
 
-        if (!$data) {
-            return;
+            if ($data) {
+                $egg->writeIcon($extension, $data);
+            }
+        } catch (Exception $exception) {
+            report($exception);
         }
-
-        $normalizedExtension = match ($extension) {
-            'svg+xml', 'svg' => 'svg',
-            'jpeg', 'jpg' => 'jpg',
-            'png' => 'png',
-            'webp' => 'webp',
-            default => null,
-        };
-
-        if (is_null($normalizedExtension)) {
-            return;
-        }
-
-        Storage::disk('public')->put(Egg::ICON_STORAGE_PATH . "/$egg->uuid.$normalizedExtension", $data);
     }
 
     /**

app/Services/Nodes/NodeUpdateService.php

@@ -40,6 +40,7 @@ class NodeUpdateService
             /** @var Node $updated */
             $updated = $node->replicate();
             $updated->exists = true;
+            $data = array_merge($data, ['created_at' => $node->created_at, 'updated_at' => now()]);
             $updated->forceFill($data)->save();
             try {
                 $node->fqdn = $updated->fqdn;

app/Services/Servers/DetailsModificationService.php

@@ -2,11 +2,10 @@
 
 namespace App\Services\Servers;
 
+use App\Jobs\RevokeSftpAccessJob;
 use App\Models\Server;
-use App\Repositories\Daemon\DaemonServerRepository;
 use App\Traits\Services\ReturnsUpdatedModels;
 use Illuminate\Database\ConnectionInterface;
-use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Support\Arr;
 use Throwable;
 
@@ -17,7 +16,7 @@ class DetailsModificationService
     /**
      * DetailsModificationService constructor.
      */
-    public function __construct(private ConnectionInterface $connection, private DaemonServerRepository $serverRepository) {}
+    public function __construct(private ConnectionInterface $connection) {}
 
     /**
      * Update the details for a single server instance.
@@ -34,7 +33,7 @@ class DetailsModificationService
     public function handle(Server $server, array $data): Server
     {
         return $this->connection->transaction(function () use ($data, $server) {
-            $owner = $server->owner_id;
+            $oldOwner = $server->user;
 
             $server->forceFill([
                 'external_id' => Arr::get($data, 'external_id'),
@@ -46,14 +45,8 @@ class DetailsModificationService
             // If the owner_id value is changed we need to revoke any tokens that exist for the server
             // on the daemon instance so that the old owner no longer has any permission to access the
             // websockets.
-            if ($server->owner_id !== $owner) {
-                try {
-                    $this->serverRepository->setServer($server)->deauthorize($server->user->uuid);
-                } catch (ConnectionException) {
-                    // Do nothing. A failure here is not ideal, but it is likely to be caused by daemon
-                    // being offline, or in an entirely broken state. Remember, these tokens reset every
-                    // few minutes by default, we're just trying to help it along a little quicker.
-                }
+            if ($server->owner_id !== $oldOwner->id) {
+                RevokeSftpAccessJob::dispatch($oldOwner->uuid, $server);
             }
 
             return $server;

app/Services/Servers/ServerDeletionService.php

@@ -3,6 +3,8 @@
 namespace App\Services\Servers;
 
 use App\Exceptions\DisplayException;
+use App\Extensions\BackupAdapter\BackupAdapterService;
+use App\Extensions\BackupAdapter\Schemas\WingsBackupSchema;
 use App\Models\Server;
 use App\Repositories\Daemon\DaemonServerRepository;
 use App\Services\Databases\DatabaseManagementService;
@@ -22,7 +24,8 @@ class ServerDeletionService
     public function __construct(
         private ConnectionInterface $connection,
         private DaemonServerRepository $daemonServerRepository,
-        private DatabaseManagementService $databaseManagementService
+        private DatabaseManagementService $databaseManagementService,
+        private BackupAdapterService $backupService
     ) {}
 
     /**
@@ -78,6 +81,26 @@ class ServerDeletionService
                 }
             }
 
+            foreach ($server->backups as $backup) {
+                try {
+                    $schema = $this->backupService->get($backup->backupHost->schema);
+
+                    if ($schema) {
+                        if ($schema instanceof WingsBackupSchema) {
+                            // Local wings backups are already deleted by the daemon
+                        } else {
+                            $schema->deleteBackup($backup);
+                        }
+                    }
+                } catch (Exception $exception) {
+                    if (!$this->force) {
+                        throw $exception;
+                    }
+
+                    logger()->warning($exception);
+                }
+            }
+
             $server->allocations()->update([
                 'server_id' => null,
                 'notes' => null,

app/Services/Servers/TransferServerService.php

@@ -2,6 +2,8 @@
 
 namespace App\Services\Servers;
 
+use App\Extensions\BackupAdapter\BackupAdapterService;
+use App\Extensions\BackupAdapter\Schemas\WingsBackupSchema;
 use App\Models\Allocation;
 use App\Models\Backup;
 use App\Models\Node;
@@ -20,19 +22,23 @@ class TransferServerService
      * TransferService constructor.
      */
     public function __construct(
-        private ConnectionInterface $connection,
-        private NodeJWTService $nodeJWTService,
+        private readonly ConnectionInterface $connection,
+        private readonly NodeJWTService $nodeJWTService,
+        private readonly BackupAdapterService $backupService
     ) {}
 
-    /**
-     * @param  string[]  $backup_uuids
-     */
+    /** @param  string[]  $backup_uuids */ // TODO: add backup uuids to ServerTransfer model
     private function notify(ServerTransfer $transfer, UnencryptedToken $token, array $backup_uuids = []): void
     {
-        $backups = [];
-        if (config('backups.default') === Backup::ADAPTER_DAEMON) {
-            $backups = $backup_uuids;
-        }
+        // Make sure only wings backups of the current server are forwarded in the wings request
+        $backups = Backup::where('server_id', $transfer->server_id)
+            ->whereIn('uuid', $backup_uuids)
+            ->with('backupHost')
+            ->get()
+            ->filter(fn (Backup $backup) => $this->backupService->get($backup->backupHost->schema) instanceof WingsBackupSchema)
+            ->pluck('uuid')
+            ->all();
+
         Http::daemon($transfer->oldNode)->post("/api/servers/{$transfer->server->uuid}/transfer", [
             'url' => $transfer->newNode->getConnectionAddress() . '/api/transfers',
             'token' => 'Bearer ' . $token->toString(),
@@ -48,11 +54,11 @@ class TransferServerService
      * Starts a transfer of a server to a new node.
      *
      * @param  int[]  $additional_allocations
-     * @param  string[]  $backup_uuid
+     * @param  string[]  $backup_uuids
      *
      * @throws Throwable
      */
-    public function handle(Server $server, int $node_id, ?int $allocation_id = null, ?array $additional_allocations = [], ?array $backup_uuid = []): bool
+    public function handle(Server $server, int $node_id, ?int $allocation_id = null, ?array $additional_allocations = [], array $backup_uuids = []): bool
     {
         $additional_allocations = array_map(intval(...), $additional_allocations);
 
@@ -103,7 +109,7 @@ class TransferServerService
             ->handle($transfer->newNode, $server->uuid, 'sha256');
 
         // Notify the source node of the pending outgoing transfer.
-        $this->notify($transfer, $token, $backup_uuid);
+        $this->notify($transfer, $token, $backup_uuids);
 
         return true;
     }

app/Services/Subusers/SubuserDeletionService.php

@@ -4,17 +4,12 @@ namespace App\Services\Subusers;
 
 use App\Events\Server\SubUserRemoved;
 use App\Facades\Activity;
+use App\Jobs\RevokeSftpAccessJob;
 use App\Models\Server;
 use App\Models\Subuser;
-use App\Repositories\Daemon\DaemonServerRepository;
-use Illuminate\Http\Client\ConnectionException;
 
 class SubuserDeletionService
 {
-    public function __construct(
-        private DaemonServerRepository $serverRepository,
-    ) {}
-
     public function handle(Subuser $subuser, Server $server): void
     {
         $log = Activity::event('server:subuser.delete')
@@ -27,14 +22,7 @@ class SubuserDeletionService
 
             event(new SubUserRemoved($subuser->server, $subuser->user));
 
-            try {
-                $this->serverRepository->setServer($server)->deauthorize($subuser->user->uuid);
-            } catch (ConnectionException $exception) {
-                // Don't block this request if we can't connect to the daemon instance.
-                logger()->warning($exception, ['user_id' => $subuser->user_id, 'server_id' => $server->id]);
-
-                $instance->property('revoked', false);
-            }
+            RevokeSftpAccessJob::dispatch($subuser->user->uuid, $server);
         });
     }
 }

app/Services/Subusers/SubuserUpdateService.php

@@ -4,17 +4,12 @@ namespace App\Services\Subusers;
 
 use App\Enums\SubuserPermission;
 use App\Facades\Activity;
+use App\Jobs\RevokeSftpAccessJob;
 use App\Models\Server;
 use App\Models\Subuser;
-use App\Repositories\Daemon\DaemonServerRepository;
-use Illuminate\Http\Client\ConnectionException;
 
 class SubuserUpdateService
 {
-    public function __construct(
-        private DaemonServerRepository $serverRepository,
-    ) {}
-
     /**
      * @param  string[]  $permissions
      */
@@ -42,18 +37,10 @@ class SubuserUpdateService
         // Only update the database and hit up the daemon instance to invalidate JTI's if the permissions
         // have actually changed for the user.
         if ($cleanedPermissions !== $current) {
-            $log->transaction(function ($instance) use ($subuser, $cleanedPermissions, $server) {
+            $log->transaction(function () use ($subuser, $cleanedPermissions, $server) {
                 $subuser->update(['permissions' => $cleanedPermissions]);
 
-                try {
-                    $this->serverRepository->setServer($server)->deauthorize($subuser->user->uuid);
-                } catch (ConnectionException $exception) {
-                    // Don't block this request if we can't connect to the daemon instance. Chances are it is
-                    // offline and the token will be invalid once daemon boots back.
-                    logger()->warning($exception, ['user_id' => $subuser->user_id, 'server_id' => $server->id]);
-
-                    $instance->property('revoked', false);
-                }
+                RevokeSftpAccessJob::dispatch($subuser->user->uuid, $server);
             });
         }
 

app/Services/Users/UserUpdateService.php

@@ -2,6 +2,7 @@
 
 namespace App\Services\Users;
 
+use App\Events\User\PasswordChanged;
 use App\Models\User;
 use App\Traits\Services\HasUserLevels;
 use Illuminate\Contracts\Hashing\Hasher;
@@ -30,6 +31,10 @@ class UserUpdateService
 
         $user->forceFill($data)->saveOrFail();
 
+        if (isset($data['password'])) {
+            PasswordChanged::dispatch($user);
+        }
+
         return $user->refresh();
     }
 }

app/Transformers/Api/Application/EggTransformer.php

@@ -46,10 +46,10 @@ class EggTransformer extends BaseTransformer
             'name' => $model->name,
             'author' => $model->author,
             'description' => $model->description,
-            'image' => $model->image,
+            'icon' => $model->icon,
             'features' => $model->features,
             'tags' => $model->tags,
-            'docker_image' => Arr::first($model->docker_images, default: ''), // docker_images, use startup_commands
+            'docker_image' => Arr::first($model->docker_images, default: ''), // deprecated, use docker_images
             'docker_images' => $model->docker_images,
             'config' => [
                 'files' => $files,

bootstrap/app.php

@@ -12,6 +12,7 @@ use App\Http\Middleware\EnsureStatefulRequests;
 use App\Http\Middleware\LanguageMiddleware;
 use App\Http\Middleware\MaintenanceMiddleware;
 use App\Http\Middleware\RedirectIfAuthenticated;
+use App\Http\Middleware\SetSecurityHeaders;
 use App\Http\Middleware\VerifyCsrfToken;
 use Illuminate\Contracts\Debug\ExceptionHandler;
 use Illuminate\Foundation\Application;
@@ -28,7 +29,10 @@ return Application::configure(basePath: dirname(__DIR__))
     ->withMiddleware(function (Middleware $middleware) {
         $middleware->redirectGuestsTo(fn () => route('filament.app.auth.login'));
 
-        $middleware->web(LanguageMiddleware::class);
+        $middleware->web([
+            LanguageMiddleware::class,
+            SetSecurityHeaders::class,
+        ]);
 
         $middleware->api([
             EnsureStatefulRequests::class,

bootstrap/providers.php

@@ -2,9 +2,9 @@
 
 use App\Providers\ActivityLogServiceProvider;
 use App\Providers\AppServiceProvider;
-use App\Providers\BackupsServiceProvider;
 use App\Providers\EventServiceProvider;
 use App\Providers\Extensions\AvatarServiceProvider;
+use App\Providers\Extensions\BackupAdapterServiceProvider;
 use App\Providers\Extensions\CaptchaServiceProvider;
 use App\Providers\Extensions\FeatureServiceProvider;
 use App\Providers\Extensions\OAuthServiceProvider;
@@ -19,9 +19,9 @@ use SocialiteProviders\Manager\ServiceProvider;
 return [
     ActivityLogServiceProvider::class,
     AppServiceProvider::class,
-    BackupsServiceProvider::class,
     EventServiceProvider::class,
     AvatarServiceProvider::class,
+    BackupAdapterServiceProvider::class,
     CaptchaServiceProvider::class,
     FeatureServiceProvider::class,
     OAuthServiceProvider::class,

composer.json

@@ -15,7 +15,7 @@
         "filament/filament": "^4.8",
         "gboquizosanchez/filament-log-viewer": "^2.2",
         "guzzlehttp/guzzle": "^7.10",
-        "laravel/framework": "^12.54",
+        "laravel/framework": "^12.56",
         "laravel/helpers": "^1.8",
         "laravel/sanctum": "^4.3",
         "laravel/socialite": "^5.25",
@@ -35,7 +35,7 @@
         "spatie/laravel-data": "^4.20",
         "spatie/laravel-fractal": "^6.4",
         "spatie/laravel-health": "^1.39",
-        "spatie/laravel-permission": "^6.24",
+        "spatie/laravel-permission": "^6.25",
         "spatie/laravel-query-builder": "^6.4",
         "spatie/temporary-directory": "^2.3",
         "symfony/http-client": "^7.4",
@@ -45,7 +45,7 @@
         "webmozart/assert": "^1.12"
     },
     "require-dev": {
-        "barryvdh/laravel-ide-helper": "^3.6",
+        "barryvdh/laravel-ide-helper": "^3.7",
         "fakerphp/faker": "^1.24",
         "larastan/larastan": "^3.9",
         "laravel/pail": "^1.2.6",
@@ -97,4 +97,4 @@
     },
     "minimum-stability": "stable",
     "prefer-stable": true
-}
+}

config/backups.php

@@ -4,11 +4,6 @@ use App\Http\Controllers\Api\Remote\Backups\BackupRemoteUploadController;
 use App\Models\Backup;
 
 return [
-    // The backup driver to use for this Panel instance. All client generated server backups
-    // will be stored in this location by default. It is possible to change this once backups
-    // have been made, without losing data.
-    'default' => env('APP_BACKUP_DRIVER', Backup::ADAPTER_DAEMON),
-
     // This value is used to determine the lifespan of UploadPart presigned urls that daemon
     // uses to upload backups to S3 storage.  Value is in minutes, so this would default to an hour.
     'presigned_url_lifespan' => (int) env('BACKUP_PRESIGNED_URL_LIFESPAN', 60),
@@ -31,37 +26,4 @@ return [
         'limit' => (int) env('BACKUP_THROTTLE_LIMIT', 2),
         'period' => (int) env('BACKUP_THROTTLE_PERIOD', 600),
     ],
-
-    'disks' => [
-        // There is no configuration for the local disk for Daemon. That configuration
-        // is determined by the Daemon configuration, and not the Panel.
-        'wings' => [
-            'adapter' => Backup::ADAPTER_DAEMON,
-        ],
-
-        // Configuration for storing backups in Amazon S3. This uses the same credentials
-        // specified in filesystems.php but does include some more specific settings for
-        // backups, notably bucket, location, and use_accelerate_endpoint.
-        's3' => [
-            'adapter' => Backup::ADAPTER_AWS_S3,
-
-            'region' => env('AWS_DEFAULT_REGION'),
-            'key' => env('AWS_ACCESS_KEY_ID'),
-            'secret' => env('AWS_SECRET_ACCESS_KEY'),
-
-            // The S3 bucket to use for backups.
-            'bucket' => env('AWS_BACKUPS_BUCKET'),
-
-            // The location within the S3 bucket where backups will be stored. Backups
-            // are stored within a folder using the server's UUID as the name. Each
-            // backup for that server lives within that folder.
-            'prefix' => env('AWS_BACKUPS_BUCKET') ?? '',
-
-            'endpoint' => env('AWS_ENDPOINT'),
-            'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
-            'use_accelerate_endpoint' => env('AWS_BACKUPS_USE_ACCELERATE', false),
-
-            'storage_class' => env('AWS_BACKUPS_STORAGE_CLASS'),
-        ],
-    ],
 ];

config/http.php

@@ -13,9 +13,9 @@ return [
     */
     'rate_limit' => [
         'client_period' => 1,
-        'client' => env('APP_API_CLIENT_RATELIMIT', 120),
+        'client' => env('APP_API_CLIENT_RATELIMIT', 256),
 
         'application_period' => 1,
-        'application' => env('APP_API_APPLICATION_RATELIMIT', 240),
+        'application' => env('APP_API_APPLICATION_RATELIMIT', 256),
     ],
 ];

config/panel.php

@@ -18,6 +18,7 @@ return [
 
     'cdn' => [
         'cache_time' => 60,
+        'egg_index_url' => env('PANEL_EGG_INDEX_URL', 'https://raw.githubusercontent.com/pelican-eggs/pelican-eggs.github.io/refs/heads/main/content/pelican.json'),
     ],
 
     'client_features' => [

database/Factories/BackupFactory.php

@@ -24,7 +24,6 @@ class BackupFactory extends Factory
         return [
             'uuid' => Uuid::uuid4()->toString(),
             'name' => $this->faker->sentence(),
-            'disk' => Backup::ADAPTER_DAEMON,
             'is_successful' => true,
             'created_at' => CarbonImmutable::now(),
             'completed_at' => CarbonImmutable::now(),

database/Factories/BackupHostFactory.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\BackupHost;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+class BackupHostFactory extends Factory
+{
+    /**
+     * The name of the factory's corresponding model.
+     *
+     * @var string
+     */
+    protected $model = BackupHost::class;
+
+    /**
+     * Define the model's default state.
+     */
+    public function definition(): array
+    {
+        return [
+            'name' => $this->faker->colorName(),
+            'schema' => 'wings',
+            'configuration' => null,
+        ];
+    }
+}

database/Factories/ServerTransferFactory.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\ServerTransfer;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+class ServerTransferFactory extends Factory
+{
+    /**
+     * The name of the factory's corresponding model.
+     *
+     * @var string
+     */
+    protected $model = ServerTransfer::class;
+
+    /**
+     * Define the model's default state.
+     */
+    public function definition(): array
+    {
+        return [
+            'old_additional_allocations' => [],
+            'new_additional_allocations' => [],
+            'successful' => null,
+            'archived' => false,
+        ];
+    }
+}

database/migrations/2025_12_13_000000_convert_base64_images_to_files.php

@@ -18,14 +18,14 @@ return new class extends Migration
         $eggs = DB::table('eggs')->whereNotNull('image')->get();
         foreach ($eggs as $egg) {
             if (!empty($egg->image) && str_starts_with($egg->image, 'data:')) {
-                $this->convertBase64ToFile($egg->image, $egg->uuid, Egg::ICON_STORAGE_PATH);
+                $this->convertBase64ToFile($egg->image, $egg->uuid, Egg::getIconStoragePath());
             }
         }
 
         $servers = DB::table('servers')->whereNotNull('icon')->get();
         foreach ($servers as $server) {
             if (!empty($server->icon) && str_starts_with($server->icon, 'data:')) {
-                $this->convertBase64ToFile($server->icon, $server->uuid, Server::ICON_STORAGE_PATH);
+                $this->convertBase64ToFile($server->icon, $server->uuid, Server::getIconStoragePath());
             }
         }
 

database/migrations/2026_01_16_081858_create_backup_hosts_table.php

@@ -0,0 +1,85 @@
+<?php
+
+use App\Models\BackupHost;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('backup_hosts', function (Blueprint $table) {
+            $table->increments('id');
+            $table->string('name');
+            $table->string('schema');
+            $table->json('configuration')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('backup_host_node', function (Blueprint $table) {
+            $table->unsignedInteger('node_id');
+            $table->foreign('node_id')->references('id')->on('nodes')->cascadeOnDelete();
+
+            $table->unsignedInteger('backup_host_id');
+            $table->foreign('backup_host_id')->references('id')->on('backup_hosts')->cascadeOnDelete();
+
+            $table->timestamps();
+
+            $table->unique(['node_id']);
+        });
+
+        Schema::table('backups', function (Blueprint $table) {
+            $table->unsignedInteger('backup_host_id')->after('disk');
+            $table->foreign('backup_host_id')->references('id')->on('backup_hosts');
+
+            $table->dropColumn('disk');
+        });
+
+        $oldDriver = env('APP_BACKUP_DRIVER', 'wings');
+
+        $oldConfiguration = null;
+        if ($oldDriver === 's3') {
+            $oldConfiguration = [
+                'region' => env('AWS_DEFAULT_REGION'),
+                'key' => env('AWS_ACCESS_KEY_ID'),
+                'secret' => env('AWS_SECRET_ACCESS_KEY'),
+                'bucket' => env('AWS_BACKUPS_BUCKET'),
+                'prefix' => env('AWS_BACKUPS_BUCKET', ''),
+                'endpoint' => env('AWS_ENDPOINT'),
+                'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
+                'use_accelerate_endpoint' => env('AWS_BACKUPS_USE_ACCELERATE', false),
+                'storage_class' => env('AWS_BACKUPS_STORAGE_CLASS'),
+            ];
+        }
+
+        $backupHost = BackupHost::create([
+            'name' => $oldDriver === 's3' ? 'Remote' : 'Local',
+            'schema' => $oldDriver,
+            'configuration' => $oldConfiguration,
+        ]);
+
+        DB::table('backups')->update(['backup_host_id' => $backupHost->id]);
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('backups', function (Blueprint $table) {
+            $table->string('disk')->after('backup_host_id');
+
+            $table->dropForeign(['backup_host_id']);
+            $table->dropColumn('backup_host_id');
+        });
+
+        Schema::dropIfExists('backup_hosts');
+
+        Schema::dropIfExists('backup_host_node');
+    }
+};

docker/entrypoint.sh

@@ -31,7 +31,7 @@ else
     echo "Generated app key written to .env file"
   else
     echo "APP_KEY exists in environment, using that."
-    echo "APP_KEY=$APP_KEY" > /pelican-data/.env
+    echo "APP_KEY=${APP_KEY}" > /pelican-data/.env
   fi
 
   # enable installer
@@ -47,7 +47,7 @@ if [ "${APP_INSTALLED}" = "true" ];  then
   if [ "${DB_CONNECTION}" != "sqlite" ]; then
     # check for DB up before starting the panel
     echo "Checking database status."
-    until nc -z -v -w30 $DB_HOST $DB_PORT
+    until nc -z -v -w30 "${DB_HOST}" "${DB_PORT}"
     do
       echo "Waiting for database connection..."
       # wait for 1 seconds before check again
@@ -59,6 +59,8 @@ if [ "${APP_INSTALLED}" = "true" ];  then
   
   # run migration
   php artisan migrate --force
+
+  php artisan p:plugin:composer
 fi
 
 echo "Optimizing Filament"

lang/en/activity.php

@@ -120,6 +120,9 @@ return [
             'update' => 'Updated the subuser permissions for <b>:email</b>',
             'delete' => 'Removed <b>:email</b> as a subuser',
         ],
+        'mount' => [
+            'update' => 'Updated the mounts for the server',
+        ],
         'crashed' => 'Server crashed',
     ],
 ];

lang/en/admin/backuphost.php

@@ -0,0 +1,14 @@
+<?php
+
+return [
+    'model_label' => 'Backup Host|Backup Hosts',
+    'name' => 'Name',
+    'schema' => 'Schema',
+    'backups' => 'Backups',
+    'linked_nodes' => 'Linked Nodes',
+    'all_nodes' => 'All Nodes',
+    'configuration' => 'Configuration',
+    'no_configuration' => 'No additional configuration required',
+    'no_backup_hosts' => 'No Backup Hosts',
+    'local_backups_only' => 'All backups will be created locally on the respective node',
+];

lang/en/admin/egg.php

@@ -13,9 +13,8 @@ return [
     'import' => [
         'file' => 'File',
         'url' => 'URL',
-        'image_url' => 'Image URL',
-        'image_error' => 'Could not fetch image',
-        'image_too_large' => 'Image too large. Limit is 1024KB',
+        'icon_url' => 'Icon URL',
+        'icon_error' => 'Could not fetch icon',
         'egg_help' => 'This should be the raw .json/.yaml file',
         'url_help' => 'URLs must point directly to the raw .json/.yaml file',
         'add_url' => 'New URL',
@@ -26,15 +25,16 @@ return [
         'failed_import_eggs' => 'Failed: :eggs',
         'github' => 'GitHub',
         'refresh' => 'Refresh',
-        'import_image' => 'Import Image',
-        'delete_image' => 'Delete Image',
+        'import_icon' => 'Import Icon',
+        'delete_icon' => 'Delete Icon',
         'no_local_ip' => 'Local IP Addresses are not allowed',
         'unsupported_format' => 'Unsupported Format. Supported Formats: :formats',
         'invalid_url' => 'The provided URL is invalid',
-        'unknown_extension' => 'Unknown image extension',
-        'image_deleted' => 'Image Deleted',
-        'no_image' => 'No Image Provided',
-        'image_updated' => 'Image Updated',
+        'unknown_extension' => 'Unknown icon extension (:extension)',
+        'could_not_write' => 'Could not write icon to disk',
+        'icon_deleted' => 'Icon Deleted',
+        'no_icon' => 'No Icon Provided',
+        'icon_updated' => 'Icon Updated',
     ],
     'export' => [
         'modal' => 'How would you like to export :egg ?',