commit c284a9f7cfa7c2277f3ac4d0d65406bdc526bab8
Author: monoadmin <monoadmin@pathcore.org>
Date:   Fri Apr 10 15:36:35 2026 -0700

    Initial commit

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..806a4d4
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,8 @@
+# Docker backup configuration
+# Copy to .env and fill in your values
+
+# Backup destination (local path or remote)
+BACKUP_DEST=/backups
+
+# Optional: notification webhook (e.g. Slack, Discord)
+NOTIFY_WEBHOOK=
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..487dd4c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,23 @@
+# Environment variables
+.env
+.env.*
+!.env.example
+
+# Dependencies
+node_modules/
+vendor/
+
+# Build output
+.next/
+dist/
+build/
+*.pyc
+__pycache__/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+
diff --git a/docker_backup.py b/docker_backup.py
new file mode 100755
index 0000000..14f470a
--- /dev/null
+++ b/docker_backup.py
@@ -0,0 +1,463 @@
+#!/usr/bin/env python3
+"""
+Docker Backup/Restore Tool
+Backup and restore containers (config + volumes) across multiple Docker hosts.
+"""
+
+import argparse
+import json
+import os
+import sys
+import tarfile
+import tempfile
+import time
+from datetime import datetime
+from io import BytesIO
+from pathlib import Path
+
+import docker
+from docker.errors import DockerException, NotFound, APIError
+from rich.console import Console
+from rich.table import Table
+from rich import print as rprint
+
+console = Console()
+
+# ── Host connection helpers ──────────────────────────────────────────────────
+
+def connect(host: str) -> docker.DockerClient:
+    """Connect to a Docker host. 'local' uses the default socket."""
+    try:
+        if host in ("local", "unix:///var/run/docker.sock", ""):
+            client = docker.from_env()
+        elif host.startswith("ssh://"):
+            client = docker.DockerClient(base_url=host, use_ssh_client=True)
+        else:
+            # tcp:// or host:port shorthand
+            if not host.startswith("tcp://") and "://" not in host:
+                host = f"tcp://{host}"
+            client = docker.DockerClient(base_url=host)
+        client.ping()
+        return client
+    except DockerException as e:
+        console.print(f"[red]Cannot connect to {host}: {e}[/red]")
+        sys.exit(1)
+
+
+# ── Backup ───────────────────────────────────────────────────────────────────
+
+def backup_container(client: docker.DockerClient, container_name: str,
+                     output_dir: Path, save_image: bool = False):
+    """
+    Backup a single container to output_dir/<container_name>_<timestamp>.tar
+    Contents:
+      config.json   — full docker inspect output
+      volumes/      — one .tar per named/anonymous volume
+      image.tar     — saved image (optional, can be large)
+    """
+    try:
+        container = client.containers.get(container_name)
+    except NotFound:
+        console.print(f"[red]Container not found: {container_name}[/red]")
+        sys.exit(1)
+
+    ts = datetime.now().strftime("%Y%m%d_%H%M%S")
+    safe_name = container.name.lstrip("/").replace("/", "_")
+    out_file = output_dir / f"{safe_name}_{ts}.tar"
+
+    console.print(f"Backing up [cyan]{container.name}[/cyan] → [green]{out_file}[/green]")
+
+    inspect = client.api.inspect_container(container.id)
+
+    with tarfile.open(out_file, "w") as tar:
+
+        # 1. config.json
+        config_bytes = json.dumps(inspect, indent=2).encode()
+        info = tarfile.TarInfo(name="config.json")
+        info.size = len(config_bytes)
+        info.mtime = int(time.time())
+        tar.addfile(info, BytesIO(config_bytes))
+        console.print("  [dim]✓ config.json[/dim]")
+
+        # 2. Volumes
+        mounts = inspect.get("Mounts", [])
+        for mount in mounts:
+            mtype = mount.get("Type", "")
+            if mtype not in ("volume", "bind"):
+                continue
+
+            if mtype == "volume":
+                vol_name = mount.get("Name", "")
+                dest = mount.get("Destination", "")
+                label = vol_name or dest.replace("/", "_")
+            else:
+                src = mount.get("Source", "")
+                label = src.replace("/", "_").lstrip("_")
+                dest = src
+
+            archive_name = f"volumes/{label}.tar"
+            console.print(f"  [dim]Archiving volume: {label} ({dest})[/dim]")
+
+            try:
+                # Use docker cp stream to get volume data
+                stream, _ = client.api.get_archive(container.id, dest)
+                vol_data = b"".join(stream)
+                vol_info = tarfile.TarInfo(name=archive_name)
+                vol_info.size = len(vol_data)
+                vol_info.mtime = int(time.time())
+                tar.addfile(vol_info, BytesIO(vol_data))
+                console.print(f"  [dim]✓ {archive_name} ({len(vol_data)//1024} KB)[/dim]")
+            except (APIError, Exception) as e:
+                console.print(f"  [yellow]⚠ Could not archive {label}: {e}[/yellow]")
+
+        # 3. Image (optional)
+        if save_image:
+            image_tag = inspect["Config"].get("Image", "")
+            console.print(f"  [dim]Saving image: {image_tag} (may take a while)…[/dim]")
+            try:
+                image = client.images.get(image_tag)
+                img_data = b"".join(image.save())
+                img_info = tarfile.TarInfo(name="image.tar")
+                img_info.size = len(img_data)
+                img_info.mtime = int(time.time())
+                tar.addfile(img_info, BytesIO(img_data))
+                console.print(f"  [dim]✓ image.tar ({len(img_data)//1024//1024} MB)[/dim]")
+            except Exception as e:
+                console.print(f"  [yellow]⚠ Could not save image: {e}[/yellow]")
+
+    console.print(f"[green]✓ Backup complete:[/green] {out_file}")
+    return out_file
+
+
+# ── Restore ──────────────────────────────────────────────────────────────────
+
+def restore_container(client: docker.DockerClient, backup_file: Path,
+                      new_name: str | None = None, start: bool = False,
+                      load_image: bool = False):
+    """
+    Restore a container from a backup .tar produced by backup_container().
+    """
+    console.print(f"Restoring from [cyan]{backup_file}[/cyan]")
+
+    with tarfile.open(backup_file, "r") as tar:
+        # 1. Read config
+        config_member = tar.getmember("config.json")
+        config = json.loads(tar.extractfile(config_member).read())
+
+    orig_name = config["Name"].lstrip("/")
+    container_name = new_name or orig_name
+    image_name = config["Config"]["Image"]
+
+    console.print(f"  Original name : [cyan]{orig_name}[/cyan]")
+    console.print(f"  Restore as    : [cyan]{container_name}[/cyan]")
+    console.print(f"  Image         : [cyan]{image_name}[/cyan]")
+
+    # 2. Optionally load image from backup
+    if load_image:
+        with tarfile.open(backup_file, "r") as tar:
+            try:
+                img_member = tar.getmember("image.tar")
+                console.print("  [dim]Loading image from backup…[/dim]")
+                img_data = tar.extractfile(img_member).read()
+                client.images.load(img_data)
+                console.print("  [dim]✓ Image loaded[/dim]")
+            except KeyError:
+                console.print("  [yellow]⚠ No image.tar in backup, skipping load[/yellow]")
+
+    # 3. Pull image if not present
+    try:
+        client.images.get(image_name)
+        console.print(f"  [dim]✓ Image {image_name} already present[/dim]")
+    except NotFound:
+        console.print(f"  [dim]Pulling {image_name}…[/dim]")
+        try:
+            client.images.pull(image_name)
+        except Exception as e:
+            console.print(f"  [red]Cannot pull image: {e}[/red]")
+            sys.exit(1)
+
+    # 4. Check for name collision
+    try:
+        existing = client.containers.get(container_name)
+        console.print(f"  [yellow]Container {container_name} already exists (id={existing.short_id})[/yellow]")
+        answer = input("  Remove existing container? [y/N] ").strip().lower()
+        if answer == "y":
+            existing.remove(force=True)
+        else:
+            console.print("[red]Restore aborted.[/red]")
+            sys.exit(1)
+    except NotFound:
+        pass
+
+    # 5. Recreate volumes and restore data
+    with tarfile.open(backup_file, "r") as tar:
+        volume_members = [m for m in tar.getmembers()
+                          if m.name.startswith("volumes/") and m.name.endswith(".tar")]
+
+    mounts = config.get("Mounts", [])
+    vol_map: dict[str, str] = {}  # label -> actual volume name or bind path
+
+    for mount in mounts:
+        mtype = mount.get("Type", "")
+        dest = mount.get("Destination", "")
+        if mtype == "volume":
+            vol_name = mount.get("Name", "")
+            label = vol_name or dest.replace("/", "_")
+        else:
+            src = mount.get("Source", "")
+            label = src.replace("/", "_").lstrip("_")
+            vol_map[label] = src
+            continue  # bind mounts: path must exist on target host
+
+        # Create volume if missing
+        try:
+            client.volumes.get(vol_name)
+            console.print(f"  [dim]Volume {vol_name} already exists[/dim]")
+        except NotFound:
+            client.volumes.create(name=vol_name)
+            console.print(f"  [dim]✓ Created volume {vol_name}[/dim]")
+        vol_map[label] = vol_name
+
+    # Restore volume data via a temporary Alpine container
+    with tarfile.open(backup_file, "r") as tar:
+        for vmember in volume_members:
+            label = vmember.name[len("volumes/"):-len(".tar")]
+            if label not in vol_map:
+                console.print(f"  [yellow]⚠ No matching mount for volume backup: {label}[/yellow]")
+                continue
+
+            vol_name = vol_map[label]
+            dest_path = next(
+                (m["Destination"] for m in mounts
+                 if (m.get("Name") == vol_name or
+                     m.get("Source", "").replace("/", "_").lstrip("_") == label)),
+                None
+            )
+            if not dest_path:
+                continue
+
+            console.print(f"  [dim]Restoring volume data: {vol_name} → {dest_path}[/dim]")
+            vol_data = tar.extractfile(vmember).read()
+
+            # Spin up temp container with the volume mounted, restore via tar stream
+            if vol_map[label] == vol_name:
+                volumes_arg = {vol_name: {"bind": "/restore_target", "mode": "rw"}}
+            else:
+                volumes_arg = {vol_name: {"bind": "/restore_target", "mode": "rw"}}
+
+            try:
+                restore_ctr = client.containers.run(
+                    "alpine",
+                    command="sh -c 'cd /restore_target && tar xf /tmp/vol.tar --strip-components=1'",
+                    volumes=volumes_arg,
+                    detach=True,
+                    remove=False,
+                )
+                # Upload the tar to the temp container
+                client.api.put_archive(restore_ctr.id, "/tmp", vol_data)
+                restore_ctr.wait()
+                restore_ctr.remove()
+                console.print(f"  [dim]✓ Volume data restored: {vol_name}[/dim]")
+            except Exception as e:
+                console.print(f"  [yellow]⚠ Could not restore volume data for {vol_name}: {e}[/yellow]")
+
+    # 6. Rebuild container create kwargs from inspect
+    cfg = config["Config"]
+    host_cfg = config["HostConfig"]
+
+    create_kwargs: dict = {
+        "image": image_name,
+        "name": container_name,
+        "command": cfg.get("Cmd"),
+        "entrypoint": cfg.get("Entrypoint"),
+        "environment": cfg.get("Env") or [],
+        "working_dir": cfg.get("WorkingDir") or None,
+        "user": cfg.get("User") or None,
+        "hostname": cfg.get("Hostname") or None,
+        "domainname": cfg.get("Domainname") or None,
+        "labels": cfg.get("Labels") or {},
+        "tty": cfg.get("Tty", False),
+        "stdin_open": cfg.get("OpenStdin", False),
+    }
+
+    # Ports
+    exposed = cfg.get("ExposedPorts") or {}
+    port_bindings = host_cfg.get("PortBindings") or {}
+    if exposed or port_bindings:
+        ports = {}
+        for port_proto in exposed:
+            bindings = port_bindings.get(port_proto)
+            if bindings:
+                host_ports = [b.get("HostPort") for b in bindings if b.get("HostPort")]
+                ports[port_proto] = host_ports or None
+            else:
+                ports[port_proto] = None
+        create_kwargs["ports"] = ports
+
+    # Restart policy
+    restart = host_cfg.get("RestartPolicy", {})
+    if restart.get("Name"):
+        create_kwargs["restart_policy"] = {
+            "Name": restart["Name"],
+            "MaximumRetryCount": restart.get("MaximumRetryCount", 0),
+        }
+
+    # Network mode
+    net_mode = host_cfg.get("NetworkMode", "default")
+    if net_mode not in ("default", "bridge"):
+        create_kwargs["network_mode"] = net_mode
+
+    # Volumes mounts
+    volume_binds = []
+    for mount in mounts:
+        mtype = mount.get("Type", "")
+        dest = mount.get("Destination", "")
+        mode = "rw" if not mount.get("RW") is False else "ro"
+        if mtype == "volume":
+            volume_binds.append(f"{mount['Name']}:{dest}:{mode}")
+        elif mtype == "bind":
+            volume_binds.append(f"{mount['Source']}:{dest}:{mode}")
+    if volume_binds:
+        create_kwargs["volumes"] = volume_binds
+
+    # Extra host config fields
+    if host_cfg.get("Privileged"):
+        create_kwargs["privileged"] = True
+    if host_cfg.get("NetworkMode") == "host":
+        create_kwargs["network_mode"] = "host"
+    cap_add = host_cfg.get("CapAdd") or []
+    if cap_add:
+        create_kwargs["cap_add"] = cap_add
+    devices = host_cfg.get("Devices") or []
+    if devices:
+        create_kwargs["devices"] = [
+            f"{d['PathOnHost']}:{d['PathInContainer']}:{d['CgroupPermissions']}"
+            for d in devices
+        ]
+
+    # 7. Create container
+    try:
+        ctr = client.containers.create(**{k: v for k, v in create_kwargs.items() if v is not None})
+        console.print(f"[green]✓ Container created:[/green] {ctr.name} ({ctr.short_id})")
+    except Exception as e:
+        console.print(f"[red]Failed to create container: {e}[/red]")
+        sys.exit(1)
+
+    if start:
+        ctr.start()
+        console.print(f"[green]✓ Container started[/green]")
+
+    return ctr
+
+
+# ── List ─────────────────────────────────────────────────────────────────────
+
+def list_containers(hosts: list[str], all_containers: bool = False):
+    table = Table(title="Docker Containers")
+    table.add_column("Host", style="cyan")
+    table.add_column("Name", style="white")
+    table.add_column("Image", style="dim")
+    table.add_column("Status", style="green")
+    table.add_column("Ports", style="dim")
+
+    for host in hosts:
+        client = connect(host)
+        label = host
+        try:
+            containers = client.containers.list(all=all_containers)
+            for c in containers:
+                ports = ", ".join(
+                    f"{v[0]['HostPort']}→{k}" if v else k
+                    for k, v in (c.ports or {}).items()
+                ) or "-"
+                status = c.status
+                color = "green" if status == "running" else "yellow"
+                table.add_row(label, c.name, c.image.tags[0] if c.image.tags else c.image.short_id,
+                              f"[{color}]{status}[/{color}]", ports)
+                label = ""  # only show host label on first row
+        except Exception as e:
+            table.add_row(host, f"[red]ERROR: {e}[/red]", "", "", "")
+
+    console.print(table)
+
+
+# ── CLI ──────────────────────────────────────────────────────────────────────
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Backup and restore Docker containers across multiple hosts.",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  # List containers on multiple hosts
+  docker_backup.py list --host local --host tcp://192.168.1.10:2375
+
+  # Backup a container on a remote host
+  docker_backup.py backup myapp --host tcp://192.168.1.10:2375 --output /backups
+
+  # Backup with image saved
+  docker_backup.py backup myapp --host local --save-image
+
+  # Restore to a different host (pull image from registry)
+  docker_backup.py restore /backups/myapp_20240101_120000.tar --host tcp://192.168.1.20:2375
+
+  # Restore with a new name and auto-start
+  docker_backup.py restore /backups/myapp_20240101_120000.tar --name myapp2 --start
+
+  # Restore using image from backup file (no registry needed)
+  docker_backup.py restore /backups/myapp_20240101_120000.tar --load-image --start
+        """
+    )
+
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    # list
+    p_list = sub.add_parser("list", help="List containers across hosts")
+    p_list.add_argument("--host", action="append", default=[], dest="hosts",
+                        metavar="HOST", help="Docker host (repeatable). Use 'local' for local socket.")
+    p_list.add_argument("-a", "--all", action="store_true", help="Show stopped containers too")
+
+    # backup
+    p_back = sub.add_parser("backup", help="Backup a container")
+    p_back.add_argument("container", help="Container name or ID")
+    p_back.add_argument("--host", default="local", metavar="HOST",
+                        help="Docker host (default: local)")
+    p_back.add_argument("--output", "-o", default=".", metavar="DIR",
+                        help="Output directory (default: current dir)")
+    p_back.add_argument("--save-image", action="store_true",
+                        help="Also save the container image into the backup (large!)")
+
+    # restore
+    p_rest = sub.add_parser("restore", help="Restore a container from backup")
+    p_rest.add_argument("backup", help="Path to the backup .tar file")
+    p_rest.add_argument("--host", default="local", metavar="HOST",
+                        help="Docker host to restore to (default: local)")
+    p_rest.add_argument("--name", metavar="NAME",
+                        help="Override container name (default: original name)")
+    p_rest.add_argument("--start", action="store_true",
+                        help="Start the container after restoring")
+    p_rest.add_argument("--load-image", action="store_true",
+                        help="Load image from backup instead of pulling from registry")
+
+    args = parser.parse_args()
+
+    if args.command == "list":
+        hosts = args.hosts or ["local"]
+        list_containers(hosts, all_containers=args.all)
+
+    elif args.command == "backup":
+        client = connect(args.host)
+        output_dir = Path(args.output)
+        output_dir.mkdir(parents=True, exist_ok=True)
+        backup_container(client, args.container, output_dir, save_image=args.save_image)
+
+    elif args.command == "restore":
+        client = connect(args.host)
+        restore_container(client, Path(args.backup),
+                          new_name=args.name,
+                          start=args.start,
+                          load_image=args.load_image)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/install.sh b/install.sh
new file mode 100755
index 0000000..c837634
--- /dev/null
+++ b/install.sh
@@ -0,0 +1,100 @@
+#!/bin/bash
+set -e
+
+APP_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WEBAPP_DIR="$APP_DIR/webapp"
+SERVICE_NAME="docker-backup"
+SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"
+PYTHON="$(which python3)"
+PORT="${PORT:-5999}"
+BIND="${BIND:-0.0.0.0}"
+
+# ── Colours ───────────────────────────────────────────────────────────────────
+GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; NC='\033[0m'
+ok()   { echo -e "${GREEN}✓${NC} $*"; }
+warn() { echo -e "${YELLOW}⚠${NC}  $*"; }
+die()  { echo -e "${RED}✗${NC}  $*"; exit 1; }
+step() { echo -e "\n${YELLOW}▶${NC}  $*"; }
+
+echo ""
+echo "  Docker Backup — Install"
+echo "  ───────────────────────"
+
+# ── Root check ────────────────────────────────────────────────────────────────
+[[ $EUID -ne 0 ]] && die "Run as root (sudo $0)"
+
+# ── Python deps ───────────────────────────────────────────────────────────────
+step "Checking Python dependencies…"
+PIP="$(which pip3 2>/dev/null || which pip 2>/dev/null || echo 'python3 -m pip')"
+MISSING=()
+for pkg in docker flask rich apscheduler paramiko; do
+    python3 -c "import $pkg" 2>/dev/null && ok "$pkg" || MISSING+=("$pkg")
+done
+
+if [[ ${#MISSING[@]} -gt 0 ]]; then
+    echo "  Installing: ${MISSING[*]}"
+    $PIP install --quiet --break-system-packages "${MISSING[@]}" 2>/dev/null || \
+    $PIP install --quiet "${MISSING[@]}" && ok "Packages installed"
+fi
+
+# ── Backup dir ────────────────────────────────────────────────────────────────
+step "Creating backup directory…"
+BACKUP_DIR="$WEBAPP_DIR/backups"
+mkdir -p "$BACKUP_DIR"
+ok "$BACKUP_DIR"
+
+# ── Systemd service ───────────────────────────────────────────────────────────
+step "Writing systemd service: $SERVICE_FILE"
+
+cat > "$SERVICE_FILE" <<EOF
+[Unit]
+Description=Docker Backup Web UI
+After=network.target docker.service
+Wants=docker.service
+
+[Service]
+Type=simple
+ExecStart=${PYTHON} ${WEBAPP_DIR}/app.py --host ${BIND} --port ${PORT}
+WorkingDirectory=${WEBAPP_DIR}
+Restart=always
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=${SERVICE_NAME}
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+ok "Service file written"
+
+# ── Enable & start ────────────────────────────────────────────────────────────
+step "Enabling and starting service…"
+systemctl daemon-reload
+systemctl enable "$SERVICE_NAME"
+systemctl restart "$SERVICE_NAME"
+
+# Wait a moment then check status
+sleep 2
+if systemctl is-active --quiet "$SERVICE_NAME"; then
+    ok "Service is running"
+else
+    warn "Service may have failed — check: journalctl -u $SERVICE_NAME -n 30"
+fi
+
+# ── Summary ───────────────────────────────────────────────────────────────────
+HOST_IP=$(hostname -I | awk '{print $1}')
+echo ""
+echo "  ┌──────────────────────────────────────────────┐"
+echo "  │  Docker Backup UI is running                 │"
+echo "  │                                              │"
+printf "  │  Local:   http://localhost:%-19s│\n" "${PORT}"
+printf "  │  Network: http://%-27s│\n" "${HOST_IP}:${PORT}"
+echo "  │                                              │"
+echo "  │  Manage service:                             │"
+echo "  │    systemctl status  $SERVICE_NAME           │"
+echo "  │    systemctl stop    $SERVICE_NAME           │"
+echo "  │    systemctl restart $SERVICE_NAME           │"
+echo "  │    journalctl -u     $SERVICE_NAME -f        │"
+echo "  └──────────────────────────────────────────────┘"
+echo ""
diff --git a/webapp/.secret_key b/webapp/.secret_key
new file mode 100644
index 0000000..f218c3a
--- /dev/null
+++ b/webapp/.secret_key
@@ -0,0 +1 @@
+ba0e6899ed5beaa803976a8e1068df03270fc67aae10560be81f937e0adc0664
\ No newline at end of file
diff --git a/webapp/app.py b/webapp/app.py
new file mode 100644
index 0000000..e619474
--- /dev/null
+++ b/webapp/app.py
@@ -0,0 +1,859 @@
+#!/usr/bin/env python3
+"""Docker Backup Web UI"""
+
+import json
+import os
+import secrets
+import sys
+import tarfile
+import threading
+import time
+import uuid
+from datetime import datetime
+from functools import wraps
+from pathlib import Path
+
+import docker
+from apscheduler.schedulers.background import BackgroundScheduler
+from apscheduler.triggers.cron import CronTrigger
+from docker.errors import NotFound, APIError
+from flask import Flask, Response, jsonify, render_template, request, session, stream_with_context
+from werkzeug.security import check_password_hash, generate_password_hash
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+app = Flask(__name__)
+
+# ── Secret key (stable across restarts) ──────────────────────────────────────
+_KEY_FILE = Path(__file__).parent / ".secret_key"
+if _KEY_FILE.exists():
+    app.secret_key = _KEY_FILE.read_text().strip()
+else:
+    _key = secrets.token_hex(32)
+    _KEY_FILE.write_text(_key)
+    app.secret_key = _key
+
+CONFIG_FILE = Path(__file__).parent / "config.json"
+DEFAULT_CONFIG = {
+    "hosts": ["local"],
+    "backup_dir": str(Path(__file__).parent / "backups"),
+    "auth": {},
+    "schedules": [],
+}
+
+jobs: dict[str, dict] = {}
+jobs_lock = threading.Lock()
+
+CRON_ALIASES = {
+    "hourly":  "0 * * * *",
+    "daily":   "0 2 * * *",
+    "weekly":  "0 2 * * 0",
+    "monthly": "0 2 1 * *",
+}
+
+
+# ── Config ────────────────────────────────────────────────────────────────────
+
+def load_config() -> dict:
+    if CONFIG_FILE.exists():
+        data = json.loads(CONFIG_FILE.read_text())
+        # Back-fill missing keys
+        for k, v in DEFAULT_CONFIG.items():
+            data.setdefault(k, v)
+        return data
+    return DEFAULT_CONFIG.copy()
+
+
+def save_config(cfg: dict):
+    CONFIG_FILE.write_text(json.dumps(cfg, indent=2))
+
+
+# ── Auth ──────────────────────────────────────────────────────────────────────
+
+def auth_enabled() -> bool:
+    return bool(load_config().get("auth", {}).get("password_hash"))
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if auth_enabled() and not session.get("authenticated"):
+            if request.is_json or request.path.startswith("/api/"):
+                return jsonify({"error": "unauthorized"}), 401
+            return jsonify({"error": "unauthorized"}), 401
+        return f(*args, **kwargs)
+    return decorated
+
+
+@app.route("/api/auth/status")
+def api_auth_status():
+    return jsonify({
+        "enabled": auth_enabled(),
+        "authenticated": session.get("authenticated", False),
+        "username": load_config().get("auth", {}).get("username", ""),
+    })
+
+
+@app.route("/api/auth/login", methods=["POST"])
+def api_auth_login():
+    data = request.json or {}
+    cfg = load_config()
+    auth = cfg.get("auth", {})
+    if not auth.get("password_hash"):
+        return jsonify({"error": "Auth not configured"}), 400
+    if data.get("username") != auth.get("username"):
+        return jsonify({"error": "Invalid credentials"}), 401
+    if not check_password_hash(auth["password_hash"], data.get("password", "")):
+        return jsonify({"error": "Invalid credentials"}), 401
+    session["authenticated"] = True
+    session.permanent = True
+    return jsonify({"ok": True})
+
+
+@app.route("/api/auth/logout", methods=["POST"])
+def api_auth_logout():
+    session.clear()
+    return jsonify({"ok": True})
+
+
+@app.route("/api/auth/setup", methods=["POST"])
+def api_auth_setup():
+    cfg = load_config()
+    auth = cfg.get("auth", {})
+    data = request.json or {}
+    # If auth already configured, require current password
+    if auth.get("password_hash"):
+        if not session.get("authenticated"):
+            return jsonify({"error": "unauthorized"}), 401
+    username = data.get("username", "").strip()
+    password = data.get("password", "")
+    if not username or not password:
+        return jsonify({"error": "username and password required"}), 400
+    if len(password) < 6:
+        return jsonify({"error": "password must be at least 6 characters"}), 400
+    cfg["auth"] = {
+        "username": username,
+        "password_hash": generate_password_hash(password),
+    }
+    save_config(cfg)
+    session["authenticated"] = True
+    return jsonify({"ok": True})
+
+
+@app.route("/api/auth/disable", methods=["POST"])
+@login_required
+def api_auth_disable():
+    cfg = load_config()
+    cfg["auth"] = {}
+    save_config(cfg)
+    session.clear()
+    return jsonify({"ok": True})
+
+
+# ── Job helpers ───────────────────────────────────────────────────────────────
+
+def new_job(label: str) -> str:
+    jid = str(uuid.uuid4())[:8]
+    with jobs_lock:
+        jobs[jid] = {"id": jid, "label": label, "status": "running",
+                     "logs": [], "created": datetime.now().isoformat()}
+    return jid
+
+
+def job_log(jid: str, msg: str):
+    with jobs_lock:
+        if jid in jobs:
+            jobs[jid]["logs"].append(msg)
+
+
+def job_done(jid: str, error: str | None = None):
+    with jobs_lock:
+        if jid in jobs:
+            jobs[jid]["status"] = "error" if error else "done"
+            if error:
+                jobs[jid]["logs"].append(f"ERROR: {error}")
+            jobs[jid]["logs"].append("[DONE]")
+
+
+# ── Docker client helper ──────────────────────────────────────────────────────
+
+def make_client(host: str) -> docker.DockerClient:
+    if host in ("local", ""):
+        return docker.from_env()
+    url = host if "://" in host else f"tcp://{host}"
+    return docker.DockerClient(base_url=url, use_ssh_client=host.startswith("ssh://"))
+
+
+# ── Retention ─────────────────────────────────────────────────────────────────
+
+def apply_retention(backup_dir: Path, container_name: str,
+                    keep_count: int | None, keep_days: int | None) -> int:
+    safe = container_name.lstrip("/").replace("/", "_")
+    files = sorted(backup_dir.glob(f"{safe}_*.tar"),
+                   key=lambda x: x.stat().st_mtime, reverse=True)
+    to_delete: set[Path] = set()
+    if keep_days and keep_days > 0:
+        cutoff = time.time() - keep_days * 86400
+        to_delete.update(f for f in files if f.stat().st_mtime < cutoff)
+    if keep_count and keep_count > 0:
+        to_delete.update(files[keep_count:])
+    for f in to_delete:
+        try:
+            f.unlink()
+        except Exception:
+            pass
+    return len(to_delete)
+
+
+# ── Backup worker ─────────────────────────────────────────────────────────────
+
+def _run_backup(jid: str, host: str, container_name: str,
+                backup_dir: str, save_image: bool, pre_hook: str = "",
+                retention_count: int | None = None, retention_days: int | None = None):
+    from io import BytesIO
+    try:
+        client = make_client(host)
+        client.ping()
+        job_log(jid, f"Connected to {host}")
+
+        try:
+            container = client.containers.get(container_name)
+        except NotFound:
+            job_done(jid, f"Container not found: {container_name}")
+            return
+
+        # Pre-hook
+        if pre_hook and pre_hook.strip():
+            job_log(jid, f"Running pre-hook: {pre_hook}")
+            try:
+                result = container.exec_run(["sh", "-c", pre_hook],
+                                            stdout=True, stderr=True)
+                output = result.output.decode(errors="replace").strip()
+                if result.exit_code != 0:
+                    job_log(jid, f"⚠ Pre-hook exited {result.exit_code}: {output}")
+                else:
+                    job_log(jid, f"✓ Pre-hook OK{': ' + output[:200] if output else ''}")
+            except Exception as e:
+                job_log(jid, f"⚠ Pre-hook failed: {e}")
+
+        ts = datetime.now().strftime("%Y%m%d_%H%M%S")
+        safe_name = container.name.lstrip("/").replace("/", "_")
+        out_file = Path(backup_dir) / f"{safe_name}_{ts}.tar"
+        Path(backup_dir).mkdir(parents=True, exist_ok=True)
+
+        inspect = client.api.inspect_container(container.id)
+        job_log(jid, f"Backing up: {container.name}")
+
+        with tarfile.open(out_file, "w") as tar:
+            config_bytes = json.dumps(inspect, indent=2).encode()
+            info = tarfile.TarInfo(name="config.json")
+            info.size = len(config_bytes)
+            info.mtime = int(time.time())
+            tar.addfile(info, BytesIO(config_bytes))
+            job_log(jid, "✓ config.json")
+
+            for mount in inspect.get("Mounts", []):
+                mtype = mount.get("Type", "")
+                if mtype not in ("volume", "bind"):
+                    continue
+                dest = mount.get("Destination", "")
+                if mtype == "volume":
+                    label = mount.get("Name") or dest.replace("/", "_")
+                else:
+                    label = mount.get("Source", "").replace("/", "_").lstrip("_")
+
+                archive_name = f"volumes/{label}.tar"
+                job_log(jid, f"Archiving volume: {label} ({dest})")
+                try:
+                    stream, _ = client.api.get_archive(container.id, dest)
+                    vol_data = b"".join(stream)
+                    vi = tarfile.TarInfo(name=archive_name)
+                    vi.size = len(vol_data)
+                    vi.mtime = int(time.time())
+                    tar.addfile(vi, BytesIO(vol_data))
+                    job_log(jid, f"✓ {archive_name} ({len(vol_data)//1024} KB)")
+                except Exception as e:
+                    job_log(jid, f"⚠ Could not archive {label}: {e}")
+
+            if save_image:
+                image_tag = inspect["Config"].get("Image", "")
+                job_log(jid, f"Saving image: {image_tag}…")
+                try:
+                    img_data = b"".join(client.images.get(image_tag).save())
+                    ii = tarfile.TarInfo(name="image.tar")
+                    ii.size = len(img_data)
+                    ii.mtime = int(time.time())
+                    tar.addfile(ii, BytesIO(img_data))
+                    job_log(jid, f"✓ image.tar ({len(img_data)//1024//1024} MB)")
+                except Exception as e:
+                    job_log(jid, f"⚠ Image save failed: {e}")
+
+        job_log(jid, f"✓ Saved: {out_file.name}")
+
+        # Retention
+        if retention_count or retention_days:
+            deleted = apply_retention(Path(backup_dir), container.name,
+                                      retention_count, retention_days)
+            if deleted:
+                job_log(jid, f"Retention: removed {deleted} old backup(s)")
+
+        job_done(jid)
+    except Exception as e:
+        job_done(jid, str(e))
+
+
+# ── Restore worker ────────────────────────────────────────────────────────────
+
+def _run_restore(jid: str, host: str, backup_path: str,
+                 new_name: str | None, start: bool, load_image: bool):
+    from io import BytesIO
+    try:
+        client = make_client(host)
+        client.ping()
+        job_log(jid, f"Connected to {host}")
+
+        bp = Path(backup_path)
+        if not bp.exists():
+            job_done(jid, f"File not found: {backup_path}")
+            return
+
+        with tarfile.open(bp, "r") as tar:
+            config = json.loads(tar.extractfile("config.json").read())
+
+        orig_name = config["Name"].lstrip("/")
+        container_name = new_name or orig_name
+        image_name = config["Config"]["Image"]
+        job_log(jid, f"Restoring '{orig_name}' → '{container_name}' (image: {image_name})")
+
+        if load_image:
+            with tarfile.open(bp, "r") as tar:
+                try:
+                    img_data = tar.extractfile("image.tar").read()
+                    job_log(jid, "Loading image from backup…")
+                    client.images.load(img_data)
+                    job_log(jid, "✓ Image loaded")
+                except KeyError:
+                    job_log(jid, "⚠ No image.tar in backup — will pull")
+
+        try:
+            client.images.get(image_name)
+            job_log(jid, f"✓ Image {image_name} present")
+        except NotFound:
+            job_log(jid, f"Pulling {image_name}…")
+            client.images.pull(image_name)
+            job_log(jid, f"✓ Pulled {image_name}")
+
+        try:
+            existing = client.containers.get(container_name)
+            job_log(jid, f"Removing existing container {container_name}")
+            existing.remove(force=True)
+        except NotFound:
+            pass
+
+        mounts = config.get("Mounts", [])
+        vol_data_map: dict[str, bytes] = {}
+        with tarfile.open(bp, "r") as tar:
+            for m in tar.getmembers():
+                if m.name.startswith("volumes/") and m.name.endswith(".tar"):
+                    label = m.name[len("volumes/"):-len(".tar")]
+                    vol_data_map[label] = tar.extractfile(m).read()
+
+        for mount in mounts:
+            if mount.get("Type") != "volume":
+                continue
+            vol_name = mount.get("Name", "")
+            dest = mount.get("Destination", "")
+            label = vol_name or dest.replace("/", "_")
+            try:
+                client.volumes.get(vol_name)
+                job_log(jid, f"Volume {vol_name} exists")
+            except NotFound:
+                client.volumes.create(name=vol_name)
+                job_log(jid, f"✓ Created volume {vol_name}")
+
+            if label in vol_data_map:
+                job_log(jid, f"Restoring volume data: {vol_name}")
+                try:
+                    rc = client.containers.run(
+                        "alpine",
+                        command="sh -c 'cd /t && tar xf /tmp/vol.tar --strip-components=1'",
+                        volumes={vol_name: {"bind": "/t", "mode": "rw"}},
+                        detach=True, remove=False,
+                    )
+                    client.api.put_archive(rc.id, "/tmp", vol_data_map[label])
+                    rc.wait()
+                    rc.remove()
+                    job_log(jid, f"✓ Volume restored: {vol_name}")
+                except Exception as e:
+                    job_log(jid, f"⚠ Volume restore failed {vol_name}: {e}")
+
+        cfg_c = config["Config"]
+        hcfg = config["HostConfig"]
+        kwargs: dict = {
+            "image": image_name, "name": container_name,
+            "command": cfg_c.get("Cmd"), "entrypoint": cfg_c.get("Entrypoint"),
+            "environment": cfg_c.get("Env") or [],
+            "working_dir": cfg_c.get("WorkingDir") or None,
+            "user": cfg_c.get("User") or None,
+            "hostname": cfg_c.get("Hostname") or None,
+            "labels": cfg_c.get("Labels") or {},
+            "tty": cfg_c.get("Tty", False),
+            "stdin_open": cfg_c.get("OpenStdin", False),
+        }
+        exposed = cfg_c.get("ExposedPorts") or {}
+        port_bindings = hcfg.get("PortBindings") or {}
+        if exposed or port_bindings:
+            ports = {}
+            for pp in exposed:
+                binds = port_bindings.get(pp)
+                ports[pp] = [b["HostPort"] for b in binds if b.get("HostPort")] if binds else None
+            kwargs["ports"] = ports
+        restart = hcfg.get("RestartPolicy", {})
+        if restart.get("Name"):
+            kwargs["restart_policy"] = {"Name": restart["Name"],
+                                         "MaximumRetryCount": restart.get("MaximumRetryCount", 0)}
+        net_mode = hcfg.get("NetworkMode", "default")
+        if net_mode not in ("default", "bridge"):
+            kwargs["network_mode"] = net_mode
+        vol_binds = []
+        for m in mounts:
+            dest = m.get("Destination", "")
+            mode = "rw" if m.get("RW") is not False else "ro"
+            if m.get("Type") == "volume":
+                vol_binds.append(f"{m['Name']}:{dest}:{mode}")
+            elif m.get("Type") == "bind":
+                vol_binds.append(f"{m['Source']}:{dest}:{mode}")
+        if vol_binds:
+            kwargs["volumes"] = vol_binds
+        if hcfg.get("Privileged"):
+            kwargs["privileged"] = True
+        if hcfg.get("CapAdd"):
+            kwargs["cap_add"] = hcfg["CapAdd"]
+
+        ctr = client.containers.create(**{k: v for k, v in kwargs.items() if v is not None})
+        job_log(jid, f"✓ Container created: {ctr.name} ({ctr.short_id})")
+        if start:
+            ctr.start()
+            job_log(jid, "✓ Container started")
+        job_done(jid)
+    except Exception as e:
+        job_done(jid, str(e))
+
+
+# ── Scheduler ─────────────────────────────────────────────────────────────────
+
+scheduler = BackgroundScheduler(timezone="UTC")
+scheduler.start()
+
+
+def run_scheduled_backup(schedule_id: str):
+    cfg = load_config()
+    sched = next((s for s in cfg.get("schedules", []) if s["id"] == schedule_id), None)
+    if not sched or not sched.get("enabled", True):
+        return
+
+    backup_dir = cfg["backup_dir"]
+    host        = sched["host"]
+    container   = sched["container"]
+    save_image  = sched.get("save_image", False)
+    pre_hook    = sched.get("pre_hook", "")
+    r_count     = sched.get("retention_count") or None
+    r_days      = sched.get("retention_days") or None
+
+    jid = new_job(f"[Scheduled] {container} on {host}")
+
+    def worker():
+        _run_backup(jid, host, container, backup_dir, save_image,
+                    pre_hook=pre_hook, retention_count=r_count, retention_days=r_days)
+        status = jobs.get(jid, {}).get("status", "unknown")
+        cfg2 = load_config()
+        for s in cfg2.get("schedules", []):
+            if s["id"] == schedule_id:
+                s["last_run"] = datetime.now().isoformat()
+                s["last_status"] = status
+                break
+        save_config(cfg2)
+
+    threading.Thread(target=worker, daemon=True).start()
+    return jid
+
+
+def _cron_kwargs(expr: str) -> dict:
+    expr = CRON_ALIASES.get(expr.lower(), expr)
+    parts = expr.split()
+    if len(parts) != 5:
+        raise ValueError(f"Invalid cron: {expr}")
+    minute, hour, day, month, dow = parts
+    return dict(minute=minute, hour=hour, day=day, month=month, day_of_week=dow)
+
+
+def _register_schedule(sched: dict):
+    try:
+        kwargs = _cron_kwargs(sched["cron"])
+        scheduler.add_job(run_scheduled_backup, CronTrigger(**kwargs),
+                          id=sched["id"], args=[sched["id"]], replace_existing=True)
+    except Exception as e:
+        print(f"Warning: schedule {sched['id']} not registered: {e}")
+
+
+def _unregister_schedule(schedule_id: str):
+    try:
+        scheduler.remove_job(schedule_id)
+    except Exception:
+        pass
+
+
+# Load existing schedules on startup
+for _s in load_config().get("schedules", []):
+    if _s.get("enabled", True):
+        _register_schedule(_s)
+
+
+# ── Routes: main page ─────────────────────────────────────────────────────────
+
+@app.route("/")
+def index():
+    return render_template("index.html")
+
+
+# ── Routes: config ────────────────────────────────────────────────────────────
+
+@app.route("/api/config", methods=["GET", "POST"])
+@login_required
+def api_config():
+    if request.method == "POST":
+        cfg = load_config()
+        data = request.json or {}
+        if "backup_dir" in data:
+            cfg["backup_dir"] = data["backup_dir"]
+        save_config(cfg)
+        return jsonify(cfg)
+    cfg = load_config()
+    cfg.pop("auth", None)   # never send password hash to browser
+    return jsonify(cfg)
+
+
+# ── Routes: hosts ─────────────────────────────────────────────────────────────
+
+@app.route("/api/hosts")
+@login_required
+def api_hosts_list():
+    cfg = load_config()
+    result = []
+    for host in cfg["hosts"]:
+        try:
+            c = make_client(host)
+            c.ping()
+            info = c.info()
+            result.append({"host": host, "ok": True,
+                            "name": info.get("Name", ""),
+                            "version": info.get("ServerVersion", ""),
+                            "containers": info.get("Containers", 0)})
+        except Exception as e:
+            result.append({"host": host, "ok": False, "error": str(e)})
+    return jsonify(result)
+
+
+@app.route("/api/hosts", methods=["POST"])
+@login_required
+def api_hosts_add():
+    host = (request.json or {}).get("host", "").strip()
+    if not host:
+        return jsonify({"error": "host required"}), 400
+    cfg = load_config()
+    if host not in cfg["hosts"]:
+        cfg["hosts"].append(host)
+        save_config(cfg)
+    return jsonify(cfg)
+
+
+@app.route("/api/hosts/<path:host>", methods=["DELETE"])
+@login_required
+def api_hosts_delete(host):
+    cfg = load_config()
+    cfg["hosts"] = [h for h in cfg["hosts"] if h != host]
+    save_config(cfg)
+    return jsonify(cfg)
+
+
+# ── Routes: containers ────────────────────────────────────────────────────────
+
+@app.route("/api/containers")
+@login_required
+def api_containers():
+    cfg = load_config()
+    show_all = request.args.get("all", "false").lower() == "true"
+    host_filter = request.args.get("host")
+    hosts = [host_filter] if host_filter else cfg["hosts"]
+    result = []
+    for host in hosts:
+        try:
+            client = make_client(host)
+            for c in client.containers.list(all=show_all):
+                ports = {k: v[0]["HostPort"] if v else None for k, v in (c.ports or {}).items()}
+                result.append({"host": host, "id": c.short_id, "name": c.name,
+                                "image": c.image.tags[0] if c.image.tags else c.image.short_id,
+                                "status": c.status, "ports": ports})
+        except Exception as e:
+            result.append({"host": host, "id": None, "name": None,
+                           "image": None, "status": "error", "error": str(e)})
+    return jsonify(result)
+
+
+# ── Routes: backups ───────────────────────────────────────────────────────────
+
+@app.route("/api/backups")
+@login_required
+def api_backups():
+    cfg = load_config()
+    backup_dir = Path(cfg["backup_dir"])
+    if not backup_dir.exists():
+        return jsonify([])
+    result = []
+    for f in sorted(backup_dir.glob("*.tar"), key=lambda x: x.stat().st_mtime, reverse=True):
+        stat = f.stat()
+        try:
+            with tarfile.open(f, "r") as tar:
+                members = tar.getmembers()
+                config = json.loads(tar.extractfile("config.json").read())
+            orig_name = config["Name"].lstrip("/")
+            image = config["Config"]["Image"]
+            has_image = any(m.name == "image.tar" for m in members)
+            volumes = [m.name[len("volumes/"):-len(".tar")]
+                       for m in members
+                       if m.name.startswith("volumes/") and m.name.endswith(".tar")]
+        except Exception:
+            orig_name = f.stem
+            image = "unknown"
+            has_image = False
+            volumes = []
+        result.append({
+            "file": f.name, "path": str(f),
+            "size_mb": round(stat.st_size / 1024 / 1024, 1),
+            "mtime": datetime.fromtimestamp(stat.st_mtime).isoformat(),
+            "container": orig_name, "image": image,
+            "has_image": has_image, "volumes": volumes,
+        })
+    return jsonify(result)
+
+
+@app.route("/api/backups/<path:filename>", methods=["DELETE"])
+@login_required
+def api_backup_delete(filename):
+    cfg = load_config()
+    path = Path(cfg["backup_dir"]) / filename
+    if not path.exists():
+        return jsonify({"error": "not found"}), 404
+    path.unlink()
+    return jsonify({"ok": True})
+
+
+# ── Routes: backup / restore / bulk ──────────────────────────────────────────
+
+@app.route("/api/backup", methods=["POST"])
+@login_required
+def api_backup_start():
+    data = request.json or {}
+    host       = data.get("host", "local")
+    container  = data.get("container")
+    save_image = data.get("save_image", False)
+    pre_hook   = data.get("pre_hook", "")
+    r_count    = data.get("retention_count") or None
+    r_days     = data.get("retention_days") or None
+    if not container:
+        return jsonify({"error": "container required"}), 400
+    cfg = load_config()
+    jid = new_job(f"Backup {container} on {host}")
+    threading.Thread(target=_run_backup,
+                     args=(jid, host, container, cfg["backup_dir"],
+                           save_image, pre_hook, r_count, r_days),
+                     daemon=True).start()
+    return jsonify({"job_id": jid})
+
+
+@app.route("/api/bulk-backup", methods=["POST"])
+@login_required
+def api_bulk_backup():
+    data = request.json or {}
+    host       = data.get("host", "local")
+    save_image = data.get("save_image", False)
+    pre_hook   = data.get("pre_hook", "")
+    try:
+        client = make_client(host)
+        client.ping()
+        containers = client.containers.list(all=False)  # running only
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    if not containers:
+        return jsonify({"error": "No running containers on host"}), 400
+    cfg = load_config()
+    job_ids = []
+    for c in containers:
+        jid = new_job(f"Bulk: {c.name} on {host}")
+        threading.Thread(target=_run_backup,
+                         args=(jid, host, c.name, cfg["backup_dir"],
+                               save_image, pre_hook),
+                         daemon=True).start()
+        job_ids.append({"job_id": jid, "container": c.name})
+    return jsonify({"jobs": job_ids})
+
+
+@app.route("/api/restore", methods=["POST"])
+@login_required
+def api_restore_start():
+    data = request.json or {}
+    host        = data.get("host", "local")
+    backup_path = data.get("backup_path")
+    new_name    = data.get("new_name") or None
+    start       = data.get("start", False)
+    load_image  = data.get("load_image", False)
+    if not backup_path:
+        return jsonify({"error": "backup_path required"}), 400
+    jid = new_job(f"Restore {Path(backup_path).name} → {host}")
+    threading.Thread(target=_run_restore,
+                     args=(jid, host, backup_path, new_name, start, load_image),
+                     daemon=True).start()
+    return jsonify({"job_id": jid})
+
+
+# ── Routes: schedules ─────────────────────────────────────────────────────────
+
+@app.route("/api/schedules")
+@login_required
+def api_schedules_list():
+    cfg = load_config()
+    schedules = cfg.get("schedules", [])
+    # Attach next_run from scheduler
+    for s in schedules:
+        job = scheduler.get_job(s["id"])
+        s["next_run"] = job.next_run_time.isoformat() if (job and job.next_run_time) else None
+    return jsonify(schedules)
+
+
+@app.route("/api/schedules", methods=["POST"])
+@login_required
+def api_schedules_create():
+    data = request.json or {}
+    required = ("host", "container", "cron")
+    if not all(data.get(k) for k in required):
+        return jsonify({"error": "host, container, cron required"}), 400
+    # Validate cron
+    try:
+        _cron_kwargs(data["cron"])
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 400
+
+    sched = {
+        "id":              str(uuid.uuid4())[:8],
+        "host":            data["host"],
+        "container":       data["container"],
+        "cron":            data["cron"],
+        "pre_hook":        data.get("pre_hook", ""),
+        "save_image":      data.get("save_image", False),
+        "retention_count": data.get("retention_count") or None,
+        "retention_days":  data.get("retention_days") or None,
+        "enabled":         data.get("enabled", True),
+        "last_run":        None,
+        "last_status":     None,
+    }
+    cfg = load_config()
+    cfg.setdefault("schedules", []).append(sched)
+    save_config(cfg)
+    if sched["enabled"]:
+        _register_schedule(sched)
+    return jsonify(sched), 201
+
+
+@app.route("/api/schedules/<sid>", methods=["PUT"])
+@login_required
+def api_schedules_update(sid):
+    data = request.json or {}
+    cfg = load_config()
+    schedules = cfg.get("schedules", [])
+    sched = next((s for s in schedules if s["id"] == sid), None)
+    if not sched:
+        return jsonify({"error": "not found"}), 404
+    updatable = ("host", "container", "cron", "pre_hook", "save_image",
+                 "retention_count", "retention_days", "enabled")
+    for k in updatable:
+        if k in data:
+            sched[k] = data[k]
+    if "cron" in data:
+        try:
+            _cron_kwargs(sched["cron"])
+        except ValueError as e:
+            return jsonify({"error": str(e)}), 400
+    save_config(cfg)
+    _unregister_schedule(sid)
+    if sched.get("enabled", True):
+        _register_schedule(sched)
+    return jsonify(sched)
+
+
+@app.route("/api/schedules/<sid>", methods=["DELETE"])
+@login_required
+def api_schedules_delete(sid):
+    cfg = load_config()
+    cfg["schedules"] = [s for s in cfg.get("schedules", []) if s["id"] != sid]
+    save_config(cfg)
+    _unregister_schedule(sid)
+    return jsonify({"ok": True})
+
+
+@app.route("/api/schedules/<sid>/run", methods=["POST"])
+@login_required
+def api_schedules_run_now(sid):
+    jid = run_scheduled_backup(sid)
+    if not jid:
+        return jsonify({"error": "schedule not found or disabled"}), 404
+    return jsonify({"job_id": jid})
+
+
+# ── Routes: jobs ──────────────────────────────────────────────────────────────
+
+@app.route("/api/jobs")
+@login_required
+def api_jobs():
+    with jobs_lock:
+        return jsonify(list(jobs.values()))
+
+
+@app.route("/api/jobs/<jid>/stream")
+def api_job_stream(jid):
+    # Auth check without decorator (SSE doesn't send JSON)
+    if auth_enabled() and not session.get("authenticated"):
+        return Response("data: unauthorized\n\n", mimetype="text/event-stream", status=401)
+
+    def generate():
+        last = 0
+        while True:
+            with jobs_lock:
+                job = jobs.get(jid)
+            if not job:
+                yield f"data: Job {jid} not found\n\n"
+                break
+            logs = job["logs"]
+            while last < len(logs):
+                line = logs[last].replace("\n", " ")
+                yield f"data: {line}\n\n"
+                last += 1
+                if line == "[DONE]":
+                    return
+            if job["status"] in ("done", "error"):
+                break
+            time.sleep(0.15)
+
+    return Response(stream_with_context(generate()),
+                    mimetype="text/event-stream",
+                    headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"})
+
+
+if __name__ == "__main__":
+    import argparse
+    p = argparse.ArgumentParser()
+    p.add_argument("--host", default="0.0.0.0")
+    p.add_argument("--port", type=int, default=5999)
+    p.add_argument("--debug", action="store_true")
+    args = p.parse_args()
+    print(f"Docker Backup UI → http://{args.host}:{args.port}")
+    app.run(host=args.host, port=args.port, debug=args.debug)
diff --git a/webapp/start.sh b/webapp/start.sh
new file mode 100755
index 0000000..094a92f
--- /dev/null
+++ b/webapp/start.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# Start Docker Backup Web UI
+cd "$(dirname "$0")"
+exec python3 app.py "$@"
diff --git a/webapp/templates/index.html b/webapp/templates/index.html
new file mode 100644
index 0000000..63143fe
--- /dev/null
+++ b/webapp/templates/index.html
@@ -0,0 +1,1109 @@
+<!DOCTYPE html>
+<html lang="en" data-bs-theme="dark">
+<head>
+  <meta charset="UTF-8"/>
+  <meta name="viewport" content="width=device-width, initial-scale=1"/>
+  <title>Docker Backup</title>
+  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css"/>
+  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.min.css"/>
+  <style>
+    body { background:#0d1117; color:#c9d1d9; }
+    .sidebar { width:220px; min-height:100vh; background:#161b22; border-right:1px solid #30363d; flex-shrink:0; }
+    .sidebar .nav-link { color:#8b949e; border-radius:6px; padding:8px 14px; }
+    .sidebar .nav-link:hover, .sidebar .nav-link.active { background:#21262d; color:#f0f6fc; }
+    .sidebar .nav-link i { width:20px; text-align:center; margin-right:8px; }
+    .main { flex:1; padding:24px; min-width:0; overflow-x:hidden; }
+    .card { background:#161b22; border:1px solid #30363d; border-radius:8px; }
+    .card-header { background:#21262d; border-bottom:1px solid #30363d; font-weight:600; }
+    .table { --bs-table-bg:transparent; }
+    .table th { color:#8b949e; font-weight:500; border-color:#30363d; font-size:.78rem; text-transform:uppercase; letter-spacing:.05em; }
+    .table td { border-color:#30363d; vertical-align:middle; }
+    .badge-running { background:#1f6feb22; color:#58a6ff; border:1px solid #1f6feb55; }
+    .badge-exited  { background:#21262d; color:#8b949e; border:1px solid #30363d; }
+    .badge-error   { background:#da363622; color:#f85149; border:1px solid #da363655; }
+    .badge-paused  { background:#9e6a0322; color:#d29922; border:1px solid #9e6a0355; }
+    .badge-done    { background:#23863622; color:#3fb950; border:1px solid #23863655; }
+    .host-pill { background:#0d419d22; color:#79c0ff; border:1px solid #1f6feb44;
+                 font-size:.72rem; padding:2px 8px; border-radius:20px; white-space:nowrap; }
+    .btn-xs { padding:2px 8px; font-size:.75rem; }
+    .log-box { background:#0d1117; border:1px solid #30363d; border-radius:6px;
+               font-family:monospace; font-size:.78rem; overflow-y:auto; padding:10px;
+               color:#e6edf3; white-space:pre-wrap; }
+    .modal-content { background:#161b22; border:1px solid #30363d; }
+    .modal-header, .modal-footer { border-color:#30363d; }
+    .form-control, .form-select, .input-group-text {
+      background:#0d1117; border-color:#30363d; color:#c9d1d9; }
+    .form-control:focus, .form-select:focus {
+      background:#0d1117; border-color:#58a6ff; color:#c9d1d9; box-shadow:none; }
+    .form-control:read-only { color:#8b949e; }
+    .form-check-input { background-color:#21262d; border-color:#30363d; }
+    .section { display:none; }
+    .section.active { display:block; }
+    .empty-state { text-align:center; padding:48px; color:#484f58; }
+    .empty-state i { font-size:3rem; display:block; margin-bottom:12px; }
+    .stat-card { background:#21262d; border:1px solid #30363d; border-radius:8px; padding:16px 20px; }
+    .stat-card .num { font-size:1.8rem; font-weight:700; color:#f0f6fc; }
+    .stat-card .lbl { font-size:.78rem; color:#8b949e; margin-top:2px; }
+    .host-card { background:#21262d; border:1px solid #30363d; border-radius:8px;
+                 padding:12px 16px; display:flex; align-items:center; gap:12px; }
+    .dot { width:9px; height:9px; border-radius:50%; flex-shrink:0; }
+    .dot.ok { background:#3fb950; }
+    .dot.err { background:#f85149; }
+    .spin { display:inline-block; width:8px; height:8px; background:#58a6ff;
+            border-radius:50%; animation:pulse 1s infinite; }
+    @keyframes pulse { 0%,100%{opacity:1} 50%{opacity:.3} }
+    .cron-label { font-size:.72rem; color:#8b949e; }
+    /* Login overlay */
+    #login-overlay { position:fixed; inset:0; background:#0d1117; z-index:9999;
+                     display:flex; align-items:center; justify-content:center; }
+    #login-overlay.d-none { display:none !important; }
+    .login-box { background:#161b22; border:1px solid #30363d; border-radius:12px;
+                 padding:32px; width:360px; }
+    #login-error { display:none; }
+  </style>
+</head>
+<body>
+
+<!-- Login Overlay -->
+<div id="login-overlay" class="d-none">
+  <div class="login-box">
+    <div class="d-flex align-items-center gap-2 mb-4">
+      <i class="bi bi-box-seam-fill text-primary fs-4"></i>
+      <span class="fw-bold fs-5 text-light">Docker Backup</span>
+    </div>
+    <p class="text-muted small mb-4">Sign in to continue</p>
+    <div class="mb-3">
+      <label class="form-label text-muted small">Username</label>
+      <input type="text" class="form-control" id="login-user" autocomplete="username"/>
+    </div>
+    <div class="mb-4">
+      <label class="form-label text-muted small">Password</label>
+      <input type="password" class="form-control" id="login-pass" autocomplete="current-password"/>
+    </div>
+    <div id="login-error" class="alert alert-danger py-2 small mb-3"></div>
+    <button class="btn btn-primary w-100" onclick="doLogin()">Sign in</button>
+  </div>
+</div>
+
+<div class="d-flex" id="app">
+
+  <!-- Sidebar -->
+  <nav class="sidebar d-flex flex-column p-3 gap-1">
+    <div class="d-flex align-items-center gap-2 mb-4 px-2">
+      <i class="bi bi-box-seam-fill text-primary fs-5"></i>
+      <span class="fw-bold text-light">Docker Backup</span>
+    </div>
+    <a href="#" class="nav-link active" data-section="dashboard"><i class="bi bi-grid-1x2"></i>Dashboard</a>
+    <a href="#" class="nav-link" data-section="containers"><i class="bi bi-box"></i>Containers</a>
+    <a href="#" class="nav-link" data-section="backups"><i class="bi bi-archive"></i>Backups</a>
+    <a href="#" class="nav-link" data-section="schedules">
+      <i class="bi bi-calendar-check"></i>Schedules
+      <span id="sched-badge" class="badge bg-primary ms-1 d-none">0</span>
+    </a>
+    <a href="#" class="nav-link" data-section="settings"><i class="bi bi-gear"></i>Settings</a>
+    <div class="mt-auto d-flex flex-column gap-1">
+      <a href="#" class="nav-link" data-section="jobs">
+        <i class="bi bi-list-task"></i>Jobs
+        <span id="jobs-badge" class="badge bg-warning text-dark ms-1 d-none">0</span>
+      </a>
+      <a href="#" class="nav-link text-muted" id="logout-btn" style="display:none!important">
+        <i class="bi bi-box-arrow-right"></i>Sign out
+      </a>
+    </div>
+  </nav>
+
+  <!-- Main -->
+  <main class="main">
+
+    <!-- Dashboard -->
+    <div id="section-dashboard" class="section active">
+      <h5 class="mb-4 text-light">Dashboard</h5>
+      <div class="row g-3 mb-4">
+        <div class="col-6 col-md-3"><div class="stat-card"><div class="num" id="stat-hosts">–</div><div class="lbl"><i class="bi bi-hdd-network me-1"></i>Hosts</div></div></div>
+        <div class="col-6 col-md-3"><div class="stat-card"><div class="num" id="stat-running">–</div><div class="lbl"><i class="bi bi-play-circle me-1"></i>Running</div></div></div>
+        <div class="col-6 col-md-3"><div class="stat-card"><div class="num" id="stat-backups">–</div><div class="lbl"><i class="bi bi-archive me-1"></i>Backups</div></div></div>
+        <div class="col-6 col-md-3"><div class="stat-card"><div class="num" id="stat-size">–</div><div class="lbl"><i class="bi bi-hdd me-1"></i>Total Size</div></div></div>
+      </div>
+      <div class="row g-3">
+        <div class="col-12 col-md-6">
+          <div class="card h-100">
+            <div class="card-header px-3 py-2">Hosts</div>
+            <div class="card-body p-3" id="dash-hosts"></div>
+          </div>
+        </div>
+        <div class="col-12 col-md-6">
+          <div class="card h-100">
+            <div class="card-header px-3 py-2">Recent Backups</div>
+            <div class="card-body p-0" id="dash-recent"></div>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <!-- Containers -->
+    <div id="section-containers" class="section">
+      <div class="d-flex align-items-center justify-content-between mb-4 flex-wrap gap-2">
+        <h5 class="mb-0 text-light">Containers</h5>
+        <div class="d-flex gap-2 align-items-center flex-wrap">
+          <div class="form-check form-switch mb-0">
+            <input class="form-check-input" type="checkbox" id="show-all-toggle">
+            <label class="form-check-label text-muted small" for="show-all-toggle">Show stopped</label>
+          </div>
+          <button class="btn btn-outline-secondary btn-sm" onclick="loadContainers()">
+            <i class="bi bi-arrow-clockwise"></i>
+          </button>
+        </div>
+      </div>
+      <div id="containers-wrap"></div>
+    </div>
+
+    <!-- Backups -->
+    <div id="section-backups" class="section">
+      <div class="d-flex align-items-center justify-content-between mb-4">
+        <h5 class="mb-0 text-light">Backups</h5>
+        <button class="btn btn-outline-secondary btn-sm" onclick="loadBackups()">
+          <i class="bi bi-arrow-clockwise"></i>
+        </button>
+      </div>
+      <div class="card">
+        <div class="card-body p-0">
+          <table class="table table-hover mb-0">
+            <thead><tr>
+              <th class="ps-3">Container</th><th>Image</th><th>Date</th>
+              <th>Size</th><th>Volumes</th><th class="pe-3"></th>
+            </tr></thead>
+            <tbody id="backups-tbody"></tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+
+    <!-- Schedules -->
+    <div id="section-schedules" class="section">
+      <div class="d-flex align-items-center justify-content-between mb-4">
+        <h5 class="mb-0 text-light">Schedules</h5>
+        <button class="btn btn-primary btn-sm" onclick="openScheduleModal()">
+          <i class="bi bi-plus-lg me-1"></i>Add Schedule
+        </button>
+      </div>
+      <div class="card">
+        <div class="card-body p-0">
+          <table class="table table-hover mb-0">
+            <thead><tr>
+              <th class="ps-3">Container</th><th>Host</th><th>Schedule</th>
+              <th>Pre-hook</th><th>Retention</th><th>Last Run</th><th>Next Run</th><th class="pe-3"></th>
+            </tr></thead>
+            <tbody id="schedules-tbody"></tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+
+    <!-- Settings -->
+    <div id="section-settings" class="section">
+      <h5 class="mb-4 text-light">Settings</h5>
+      <div class="row g-4">
+        <div class="col-12 col-lg-6">
+          <div class="card">
+            <div class="card-header px-3 py-2">Docker Hosts</div>
+            <div class="card-body p-3">
+              <div id="settings-hosts" class="d-flex flex-column gap-2 mb-3"></div>
+              <div class="input-group">
+                <input type="text" class="form-control" id="new-host-input"
+                       placeholder="tcp://host:2375 or ssh://user@host"/>
+                <button class="btn btn-primary" onclick="addHost()"><i class="bi bi-plus-lg"></i></button>
+              </div>
+              <div class="form-text text-muted mt-1">Use <code>local</code> for local socket.</div>
+            </div>
+          </div>
+        </div>
+        <div class="col-12 col-lg-6">
+          <div class="card">
+            <div class="card-header px-3 py-2">Backup Storage</div>
+            <div class="card-body p-3">
+              <label class="form-label text-muted small">Backup Directory</label>
+              <div class="input-group">
+                <input type="text" class="form-control" id="backup-dir-input"/>
+                <button class="btn btn-primary" onclick="saveBackupDir()">Save</button>
+              </div>
+            </div>
+          </div>
+        </div>
+        <div class="col-12 col-lg-6">
+          <div class="card">
+            <div class="card-header px-3 py-2">Authentication</div>
+            <div class="card-body p-3">
+              <div id="auth-status-msg" class="small text-muted mb-3"></div>
+              <div class="mb-2">
+                <label class="form-label text-muted small">Username</label>
+                <input type="text" class="form-control" id="auth-user"/>
+              </div>
+              <div class="mb-3">
+                <label class="form-label text-muted small">Password <span class="text-muted">(min 6 chars)</span></label>
+                <input type="password" class="form-control" id="auth-pass"/>
+              </div>
+              <div class="d-flex gap-2">
+                <button class="btn btn-primary btn-sm" onclick="saveAuth()">
+                  <i class="bi bi-shield-check me-1"></i>Set Password
+                </button>
+                <button class="btn btn-outline-danger btn-sm" id="auth-disable-btn"
+                        onclick="disableAuth()" style="display:none">
+                  <i class="bi bi-shield-x me-1"></i>Disable Auth
+                </button>
+              </div>
+              <div id="auth-msg" class="small mt-2"></div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+
+    <!-- Jobs -->
+    <div id="section-jobs" class="section">
+      <div class="d-flex align-items-center justify-content-between mb-4">
+        <h5 class="mb-0 text-light">Jobs</h5>
+        <button class="btn btn-outline-secondary btn-sm" onclick="loadJobs()">
+          <i class="bi bi-arrow-clockwise"></i>
+        </button>
+      </div>
+      <div id="jobs-list"></div>
+    </div>
+
+  </main>
+</div>
+
+<!-- Backup Modal -->
+<div class="modal fade" id="backupModal" tabindex="-1">
+  <div class="modal-dialog">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title"><i class="bi bi-archive me-2"></i>Backup Container</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <div class="mb-3">
+          <label class="form-label text-muted small">Container</label>
+          <input type="text" class="form-control" id="bk-container" readonly/>
+        </div>
+        <div class="mb-3">
+          <label class="form-label text-muted small">Host</label>
+          <input type="text" class="form-control" id="bk-host" readonly/>
+        </div>
+        <div class="mb-3">
+          <label class="form-label text-muted small">Pre-backup Hook <span class="text-muted">(runs inside container)</span></label>
+          <input type="text" class="form-control font-monospace" id="bk-prehook"
+                 placeholder="e.g. pg_dump -U postgres mydb > /tmp/dump.sql"/>
+        </div>
+        <div class="row g-2 mb-3">
+          <div class="col">
+            <label class="form-label text-muted small">Keep last N backups <span class="text-muted">(0=off)</span></label>
+            <input type="number" class="form-control" id="bk-keep-count" value="0" min="0"/>
+          </div>
+          <div class="col">
+            <label class="form-label text-muted small">Delete after N days <span class="text-muted">(0=off)</span></label>
+            <input type="number" class="form-control" id="bk-keep-days" value="0" min="0"/>
+          </div>
+        </div>
+        <div class="form-check form-switch mb-3">
+          <input class="form-check-input" type="checkbox" id="bk-save-image"/>
+          <label class="form-check-label small" for="bk-save-image">
+            Include image in backup <span class="text-muted">(large, but works without registry)</span>
+          </label>
+        </div>
+        <div id="bk-log-wrap" class="d-none">
+          <div id="bk-log" class="log-box" style="height:180px;"></div>
+        </div>
+      </div>
+      <div class="modal-footer">
+        <button class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+        <button class="btn btn-primary" id="bk-btn" onclick="startBackup()">
+          <i class="bi bi-archive me-1"></i>Start Backup
+        </button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- Bulk Backup Modal -->
+<div class="modal fade" id="bulkModal" tabindex="-1">
+  <div class="modal-dialog">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title"><i class="bi bi-boxes me-2"></i>Bulk Backup — <span id="bulk-host-title"></span></h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <p class="text-muted small">Backs up every running container on this host as a separate backup file.</p>
+        <div id="bulk-container-list" class="mb-3 d-flex flex-column gap-1"></div>
+        <div class="mb-3">
+          <label class="form-label text-muted small">Pre-backup Hook <span class="text-muted">(runs inside each container)</span></label>
+          <input type="text" class="form-control font-monospace" id="bulk-prehook" placeholder="optional"/>
+        </div>
+        <div class="form-check form-switch">
+          <input class="form-check-input" type="checkbox" id="bulk-save-image"/>
+          <label class="form-check-label small" for="bulk-save-image">Include images</label>
+        </div>
+        <div id="bulk-log-wrap" class="mt-3 d-none">
+          <div id="bulk-log" class="log-box" style="height:160px;"></div>
+        </div>
+      </div>
+      <div class="modal-footer">
+        <button class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+        <button class="btn btn-primary" id="bulk-btn" onclick="startBulkBackup()">
+          <i class="bi bi-boxes me-1"></i>Backup All
+        </button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- Restore Modal -->
+<div class="modal fade" id="restoreModal" tabindex="-1">
+  <div class="modal-dialog">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title"><i class="bi bi-arrow-counterclockwise me-2"></i>Restore Container</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <div class="mb-3">
+          <label class="form-label text-muted small">Backup File</label>
+          <input type="text" class="form-control" id="rs-file" readonly/>
+        </div>
+        <div class="mb-3">
+          <label class="form-label text-muted small">Target Host</label>
+          <select class="form-select" id="rs-host"></select>
+        </div>
+        <div class="mb-3">
+          <label class="form-label text-muted small">Container Name <span class="text-muted">(blank = original)</span></label>
+          <input type="text" class="form-control" id="rs-name"/>
+        </div>
+        <div class="d-flex gap-4 mb-3">
+          <div class="form-check form-switch">
+            <input class="form-check-input" type="checkbox" id="rs-start"/>
+            <label class="form-check-label small" for="rs-start">Start after restore</label>
+          </div>
+          <div class="form-check form-switch">
+            <input class="form-check-input" type="checkbox" id="rs-load-image"/>
+            <label class="form-check-label small" for="rs-load-image">Load image from backup</label>
+          </div>
+        </div>
+        <div id="rs-log-wrap" class="d-none">
+          <div id="rs-log" class="log-box" style="height:180px;"></div>
+        </div>
+      </div>
+      <div class="modal-footer">
+        <button class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+        <button class="btn btn-success" id="rs-btn" onclick="startRestore()">
+          <i class="bi bi-arrow-counterclockwise me-1"></i>Restore
+        </button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- Schedule Modal -->
+<div class="modal fade" id="scheduleModal" tabindex="-1">
+  <div class="modal-dialog">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="sched-modal-title"><i class="bi bi-calendar-check me-2"></i>Schedule Backup</h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <div class="row g-3 mb-3">
+          <div class="col">
+            <label class="form-label text-muted small">Host</label>
+            <select class="form-select" id="sm-host" onchange="loadHostContainers()"></select>
+          </div>
+          <div class="col">
+            <label class="form-label text-muted small">Container</label>
+            <input type="text" class="form-control" id="sm-container" list="sm-containers-list" placeholder="container name"/>
+            <datalist id="sm-containers-list"></datalist>
+          </div>
+        </div>
+        <div class="mb-3">
+          <label class="form-label text-muted small">Schedule</label>
+          <div class="d-flex gap-2">
+            <select class="form-select" id="sm-cron-preset" onchange="cronPresetChange()" style="width:140px;flex-shrink:0">
+              <option value="hourly">Hourly</option>
+              <option value="daily" selected>Daily (2am)</option>
+              <option value="weekly">Weekly (Sun)</option>
+              <option value="monthly">Monthly</option>
+              <option value="custom">Custom…</option>
+            </select>
+            <input type="text" class="form-control font-monospace d-none" id="sm-cron-custom"
+                   placeholder="0 2 * * *" title="minute hour day month day_of_week"/>
+          </div>
+          <div class="form-text text-muted" id="sm-cron-hint">Runs at 02:00 UTC every day</div>
+        </div>
+        <div class="mb-3">
+          <label class="form-label text-muted small">Pre-backup Hook <span class="text-muted">(runs inside container)</span></label>
+          <input type="text" class="form-control font-monospace" id="sm-prehook"
+                 placeholder="e.g. pg_dump -U postgres mydb > /tmp/dump.sql"/>
+        </div>
+        <div class="row g-2 mb-3">
+          <div class="col">
+            <label class="form-label text-muted small">Keep last N</label>
+            <input type="number" class="form-control" id="sm-keep-count" value="7" min="0"/>
+          </div>
+          <div class="col">
+            <label class="form-label text-muted small">Delete after N days</label>
+            <input type="number" class="form-control" id="sm-keep-days" value="30" min="0"/>
+          </div>
+        </div>
+        <div class="d-flex gap-4">
+          <div class="form-check form-switch">
+            <input class="form-check-input" type="checkbox" id="sm-save-image"/>
+            <label class="form-check-label small" for="sm-save-image">Include image</label>
+          </div>
+          <div class="form-check form-switch">
+            <input class="form-check-input" type="checkbox" id="sm-enabled" checked/>
+            <label class="form-check-label small" for="sm-enabled">Enabled</label>
+          </div>
+        </div>
+      </div>
+      <div class="modal-footer">
+        <button class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+        <button class="btn btn-primary" onclick="saveSchedule()">
+          <i class="bi bi-check-lg me-1"></i>Save Schedule
+        </button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
+<script>
+
+// ── Auth ──────────────────────────────────────────────────────────────────────
+async function checkAuth() {
+  const r = await fetch('/api/auth/status');
+  const s = await r.json();
+  if (s.enabled && !s.authenticated) {
+    showLogin();
+  } else {
+    hideLogin();
+    if (s.enabled) {
+      document.getElementById('logout-btn').style.display = '';
+    }
+  }
+}
+
+function showLogin() {
+  document.getElementById('login-overlay').classList.remove('d-none');
+  setTimeout(() => document.getElementById('login-user').focus(), 100);
+}
+function hideLogin() {
+  document.getElementById('login-overlay').classList.add('d-none');
+}
+
+async function doLogin() {
+  const user = document.getElementById('login-user').value;
+  const pass = document.getElementById('login-pass').value;
+  const err  = document.getElementById('login-error');
+  const res  = await fetch('/api/auth/login', {
+    method:'POST', headers:{'Content-Type':'application/json'},
+    body: JSON.stringify({username: user, password: pass})
+  });
+  const data = await res.json();
+  if (data.ok) {
+    hideLogin();
+    document.getElementById('logout-btn').style.display = '';
+    loadDashboard();
+  } else {
+    err.textContent = data.error || 'Invalid credentials';
+    err.style.display = 'block';
+  }
+}
+document.getElementById('login-pass').addEventListener('keydown', e => {
+  if (e.key === 'Enter') doLogin();
+});
+
+document.getElementById('logout-btn').addEventListener('click', async e => {
+  e.preventDefault();
+  await fetch('/api/auth/logout', {method:'POST'});
+  document.getElementById('logout-btn').style.display = 'none';
+  showLogin();
+});
+
+// ── API helper ────────────────────────────────────────────────────────────────
+async function api(url, opts={}) {
+  const r = await fetch(url, { headers:{'Content-Type':'application/json'}, ...opts });
+  if (r.status === 401) { showLogin(); throw new Error('Unauthorized'); }
+  return r.json();
+}
+
+// ── Navigation ────────────────────────────────────────────────────────────────
+document.querySelectorAll('.nav-link[data-section]').forEach(link => {
+  link.addEventListener('click', e => {
+    e.preventDefault();
+    document.querySelectorAll('.nav-link').forEach(l => l.classList.remove('active'));
+    link.classList.add('active');
+    const sec = link.dataset.section;
+    document.querySelectorAll('.section').forEach(s => s.classList.remove('active'));
+    document.getElementById('section-' + sec).classList.add('active');
+    ({ dashboard: loadDashboard, containers: loadContainers, backups: loadBackups,
+       schedules: loadSchedules, settings: loadSettings, jobs: loadJobs })[sec]?.();
+  });
+});
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+const esc = s => String(s||'').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+const fmtDate = iso => iso ? new Date(iso).toLocaleString() : '–';
+const fmtSize = mb => mb >= 1024 ? (mb/1024).toFixed(1)+' GB' : mb+' MB';
+const statusBadge = s => {
+  const cls = {running:'badge-running',exited:'badge-exited',error:'badge-error',paused:'badge-paused'}[s]||'badge-exited';
+  return `<span class="badge ${cls}">${s}</span>`;
+};
+const cronHints = {
+  hourly:'Every hour at :00', daily:'Every day at 02:00 UTC',
+  weekly:'Every Sunday at 02:00 UTC', monthly:'1st of each month at 02:00 UTC'
+};
+
+// ── Dashboard ─────────────────────────────────────────────────────────────────
+async function loadDashboard() {
+  const [hosts, containers, backups] = await Promise.all([
+    api('/api/hosts'), api('/api/containers?all=true'), api('/api/backups')
+  ]);
+  document.getElementById('stat-hosts').textContent = hosts.length;
+  document.getElementById('stat-running').textContent = containers.filter(c=>c.status==='running').length;
+  document.getElementById('stat-backups').textContent = backups.length;
+  document.getElementById('stat-size').textContent = fmtSize(backups.reduce((a,b)=>a+b.size_mb,0));
+
+  const hl = document.getElementById('dash-hosts');
+  hl.innerHTML = hosts.length ? hosts.map(h=>`
+    <div class="host-card mb-2">
+      <div class="dot ${h.ok?'ok':'err'}"></div>
+      <div class="flex-grow-1">
+        <div class="fw-semibold text-light small">${esc(h.host)}</div>
+        ${h.ok ? `<div class="text-muted" style="font-size:.72rem">${esc(h.name)} · Docker ${esc(h.version)} · ${h.containers} containers</div>`
+               : `<div class="text-danger" style="font-size:.72rem">${esc(h.error)}</div>`}
+      </div>
+    </div>`).join('') : '<div class="empty-state"><i class="bi bi-hdd-network"></i>No hosts</div>';
+
+  const rb = document.getElementById('dash-recent');
+  rb.innerHTML = backups.length ? `<table class="table table-hover mb-0"><tbody>${
+    backups.slice(0,6).map(b=>`<tr>
+      <td class="ps-3 text-light small fw-semibold">${esc(b.container)}</td>
+      <td class="text-muted small">${fmtDate(b.mtime)}</td>
+      <td class="text-muted small pe-3">${fmtSize(b.size_mb)}</td>
+    </tr>`).join('')
+  }</tbody></table>` : '<div class="empty-state"><i class="bi bi-archive"></i>No backups yet</div>';
+}
+
+// ── Containers ────────────────────────────────────────────────────────────────
+async function loadContainers() {
+  const all = document.getElementById('show-all-toggle').checked;
+  const wrap = document.getElementById('containers-wrap');
+  wrap.innerHTML = '<div class="text-muted text-center py-4">Loading…</div>';
+  const data = await api('/api/containers?all=' + all);
+
+  // Group by host
+  const byHost = {};
+  for (const c of data) {
+    (byHost[c.host] = byHost[c.host] || []).push(c);
+  }
+
+  if (!Object.keys(byHost).length) {
+    wrap.innerHTML = '<div class="empty-state"><i class="bi bi-box"></i>No containers</div>';
+    return;
+  }
+
+  wrap.innerHTML = Object.entries(byHost).map(([host, ctrs]) => `
+    <div class="card mb-3">
+      <div class="card-header px-3 py-2 d-flex align-items-center justify-content-between">
+        <span><span class="host-pill me-2">${esc(host)}</span>${ctrs.length} container${ctrs.length!==1?'s':''}</span>
+        <button class="btn btn-outline-primary btn-xs" onclick="openBulkModal('${esc(host)}')">
+          <i class="bi bi-boxes me-1"></i>Backup All
+        </button>
+      </div>
+      <div class="card-body p-0">
+        <table class="table table-hover mb-0">
+          <thead><tr>
+            <th class="ps-3">Name</th><th>Image</th><th>Status</th><th>Ports</th><th class="pe-3"></th>
+          </tr></thead>
+          <tbody>
+            ${ctrs.map(c => {
+              if (!c.id) return `<tr><td colspan="5" class="ps-3 text-danger small">${esc(c.error)}</td></tr>`;
+              const ports = Object.entries(c.ports||{}).map(([k,v])=>v?`${v}→${k}`:k).join(', ') || '–';
+              return `<tr>
+                <td class="ps-3 fw-semibold text-light">${esc(c.name)}</td>
+                <td class="text-muted small">${esc(c.image)}</td>
+                <td>${statusBadge(c.status)}</td>
+                <td class="text-muted small">${esc(ports)}</td>
+                <td class="pe-3 text-end">
+                  <button class="btn btn-outline-secondary btn-xs me-1"
+                    onclick="openScheduleModal('${esc(c.name)}','${esc(host)}')">
+                    <i class="bi bi-calendar-check"></i>
+                  </button>
+                  <button class="btn btn-outline-primary btn-xs"
+                    onclick="openBackupModal('${esc(c.name)}','${esc(host)}')">
+                    <i class="bi bi-archive"></i> Backup
+                  </button>
+                </td>
+              </tr>`;
+            }).join('')}
+          </tbody>
+        </table>
+      </div>
+    </div>`).join('');
+}
+document.getElementById('show-all-toggle').addEventListener('change', loadContainers);
+
+// ── Backups ───────────────────────────────────────────────────────────────────
+async function loadBackups() {
+  const tbody = document.getElementById('backups-tbody');
+  tbody.innerHTML = '<tr><td colspan="6" class="text-center text-muted py-4">Loading…</td></tr>';
+  const data = await api('/api/backups');
+  if (!data.length) {
+    tbody.innerHTML = '<tr><td colspan="6"><div class="empty-state"><i class="bi bi-archive"></i>No backups</div></td></tr>';
+    return;
+  }
+  tbody.innerHTML = data.map(b=>`
+    <tr>
+      <td class="ps-3">
+        <div class="fw-semibold text-light">${esc(b.container)}</div>
+        <div class="text-muted" style="font-size:.7rem">${esc(b.file)}</div>
+      </td>
+      <td class="text-muted small">${esc(b.image)}</td>
+      <td class="text-muted small">${fmtDate(b.mtime)}</td>
+      <td class="text-muted small">${fmtSize(b.size_mb)}</td>
+      <td class="text-muted small">
+        ${b.volumes.map(v=>`<span class="badge bg-secondary me-1">${esc(v)}</span>`).join('')||'–'}
+        ${b.has_image?'<span class="badge" style="background:#1f6feb33;color:#79c0ff">+image</span>':''}
+      </td>
+      <td class="pe-3 text-end">
+        <button class="btn btn-outline-success btn-xs me-1"
+          onclick="openRestoreModal('${esc(b.path)}','${esc(b.container)}')">
+          <i class="bi bi-arrow-counterclockwise"></i> Restore
+        </button>
+        <button class="btn btn-outline-danger btn-xs" onclick="deleteBackup('${esc(b.file)}',this)">
+          <i class="bi bi-trash"></i>
+        </button>
+      </td>
+    </tr>`).join('');
+}
+
+async function deleteBackup(file, btn) {
+  if (!confirm(`Delete backup: ${file}?`)) return;
+  btn.disabled = true;
+  await api('/api/backups/' + encodeURIComponent(file), {method:'DELETE'});
+  loadBackups();
+}
+
+// ── Schedules ─────────────────────────────────────────────────────────────────
+async function loadSchedules() {
+  const tbody = document.getElementById('schedules-tbody');
+  tbody.innerHTML = '<tr><td colspan="8" class="text-center text-muted py-4">Loading…</td></tr>';
+  const data = await api('/api/schedules');
+
+  const badge = document.getElementById('sched-badge');
+  badge.textContent = data.length;
+  data.length ? badge.classList.remove('d-none') : badge.classList.add('d-none');
+
+  if (!data.length) {
+    tbody.innerHTML = '<tr><td colspan="8"><div class="empty-state"><i class="bi bi-calendar-check"></i>No schedules yet</div></td></tr>';
+    return;
+  }
+
+  tbody.innerHTML = data.map(s => {
+    const lastStatus = s.last_status === 'done'
+      ? '<span class="badge badge-done">OK</span>'
+      : s.last_status === 'error'
+      ? '<span class="badge badge-error">Failed</span>' : '';
+    const retention = [
+      s.retention_count ? `Last ${s.retention_count}` : '',
+      s.retention_days  ? `${s.retention_days}d` : ''
+    ].filter(Boolean).join(' / ') || '–';
+    const cronDisplay = Object.keys(cronHints).includes(s.cron.toLowerCase())
+      ? s.cron : `<code>${esc(s.cron)}</code>`;
+    return `
+    <tr class="${s.enabled?'':'opacity-50'}">
+      <td class="ps-3 fw-semibold text-light">${esc(s.container)}</td>
+      <td><span class="host-pill">${esc(s.host)}</span></td>
+      <td>
+        <div>${cronDisplay}</div>
+        <div class="cron-label">${esc(cronHints[s.cron.toLowerCase()]||'')}</div>
+      </td>
+      <td class="text-muted small">${s.pre_hook ? `<code>${esc(s.pre_hook.substring(0,40))}${s.pre_hook.length>40?'…':''}</code>` : '–'}</td>
+      <td class="text-muted small">${esc(retention)}</td>
+      <td class="text-muted small">${s.last_run ? fmtDate(s.last_run) : '–'} ${lastStatus}</td>
+      <td class="text-muted small">${fmtDate(s.next_run)}</td>
+      <td class="pe-3 text-end">
+        <button class="btn btn-outline-secondary btn-xs me-1" title="Run now"
+          onclick="runScheduleNow('${s.id}')"><i class="bi bi-play-fill"></i></button>
+        <button class="btn btn-outline-warning btn-xs me-1" title="${s.enabled?'Disable':'Enable'}"
+          onclick="toggleSchedule('${s.id}',${!s.enabled})">
+          <i class="bi bi-${s.enabled?'pause':'play'}-fill"></i></button>
+        <button class="btn btn-outline-secondary btn-xs me-1" title="Edit"
+          onclick="editSchedule(${JSON.stringify(esc(JSON.stringify(s)))})">
+          <i class="bi bi-pencil"></i></button>
+        <button class="btn btn-outline-danger btn-xs" title="Delete"
+          onclick="deleteSchedule('${s.id}',this)"><i class="bi bi-trash"></i></button>
+      </td>
+    </tr>`;
+  }).join('');
+}
+
+async function runScheduleNow(id) {
+  const res = await api(`/api/schedules/${id}/run`, {method:'POST'});
+  if (res.job_id) {
+    showToast(`Job started: ${res.job_id}`);
+    navigate('jobs');
+  }
+}
+
+async function toggleSchedule(id, enabled) {
+  await api(`/api/schedules/${id}`, {method:'PUT', body: JSON.stringify({enabled})});
+  loadSchedules();
+}
+
+async function deleteSchedule(id, btn) {
+  if (!confirm('Delete this schedule?')) return;
+  btn.disabled = true;
+  await api(`/api/schedules/${id}`, {method:'DELETE'});
+  loadSchedules();
+}
+
+// schedule modal state
+let editingScheduleId = null;
+
+function openScheduleModal(container='', host='') {
+  editingScheduleId = null;
+  document.getElementById('sched-modal-title').innerHTML = '<i class="bi bi-calendar-check me-2"></i>Add Schedule';
+  document.getElementById('sm-container').value = container;
+  document.getElementById('sm-prehook').value = '';
+  document.getElementById('sm-keep-count').value = 7;
+  document.getElementById('sm-keep-days').value = 30;
+  document.getElementById('sm-save-image').checked = false;
+  document.getElementById('sm-enabled').checked = true;
+  document.getElementById('sm-cron-preset').value = 'daily';
+  document.getElementById('sm-cron-custom').classList.add('d-none');
+  document.getElementById('sm-cron-hint').textContent = cronHints.daily;
+  // Populate host dropdown
+  api('/api/hosts').then(hosts => {
+    const sel = document.getElementById('sm-host');
+    sel.innerHTML = hosts.map(h=>`<option value="${esc(h.host)}" ${h.host===host?'selected':''}>${esc(h.host)}</option>`).join('');
+    if (host) loadHostContainers();
+  });
+  new bootstrap.Modal(document.getElementById('scheduleModal')).show();
+}
+
+function editSchedule(escapedJson) {
+  const s = JSON.parse(unescapeHtml(escapedJson));
+  editingScheduleId = s.id;
+  document.getElementById('sched-modal-title').innerHTML = '<i class="bi bi-pencil me-2"></i>Edit Schedule';
+  document.getElementById('sm-container').value = s.container;
+  document.getElementById('sm-prehook').value = s.pre_hook || '';
+  document.getElementById('sm-keep-count').value = s.retention_count || 0;
+  document.getElementById('sm-keep-days').value = s.retention_days || 0;
+  document.getElementById('sm-save-image').checked = s.save_image || false;
+  document.getElementById('sm-enabled').checked = s.enabled !== false;
+  const presets = ['hourly','daily','weekly','monthly'];
+  const preset = presets.includes(s.cron.toLowerCase()) ? s.cron.toLowerCase() : 'custom';
+  document.getElementById('sm-cron-preset').value = preset;
+  document.getElementById('sm-cron-custom').value = s.cron;
+  document.getElementById('sm-cron-custom').classList.toggle('d-none', preset !== 'custom');
+  document.getElementById('sm-cron-hint').textContent = cronHints[preset] || s.cron;
+  api('/api/hosts').then(hosts => {
+    const sel = document.getElementById('sm-host');
+    sel.innerHTML = hosts.map(h=>`<option value="${esc(h.host)}" ${h.host===s.host?'selected':''}>${esc(h.host)}</option>`).join('');
+    loadHostContainers();
+  });
+  new bootstrap.Modal(document.getElementById('scheduleModal')).show();
+}
+
+function unescapeHtml(s) {
+  const t = document.createElement('textarea'); t.innerHTML = s; return t.value;
+}
+
+async function loadHostContainers() {
+  const host = document.getElementById('sm-host').value;
+  const dl = document.getElementById('sm-containers-list');
+  try {
+    const ctrs = await api(`/api/containers?host=${encodeURIComponent(host)}&all=true`);
+    dl.innerHTML = ctrs.filter(c=>c.name).map(c=>`<option value="${esc(c.name)}">`).join('');
+  } catch(e) {}
+}
+
+function cronPresetChange() {
+  const val = document.getElementById('sm-cron-preset').value;
+  const custom = document.getElementById('sm-cron-custom');
+  custom.classList.toggle('d-none', val !== 'custom');
+  document.getElementById('sm-cron-hint').textContent = cronHints[val] || '';
+}
+
+async function saveSchedule() {
+  const preset = document.getElementById('sm-cron-preset').value;
+  const cron = preset === 'custom'
+    ? document.getElementById('sm-cron-custom').value.trim()
+    : preset;
+  const body = {
+    host:            document.getElementById('sm-host').value,
+    container:       document.getElementById('sm-container').value.trim(),
+    cron,
+    pre_hook:        document.getElementById('sm-prehook').value.trim(),
+    save_image:      document.getElementById('sm-save-image').checked,
+    retention_count: parseInt(document.getElementById('sm-keep-count').value)||null,
+    retention_days:  parseInt(document.getElementById('sm-keep-days').value)||null,
+    enabled:         document.getElementById('sm-enabled').checked,
+  };
+  if (!body.container) { alert('Container name is required'); return; }
+  try {
+    if (editingScheduleId) {
+      await api(`/api/schedules/${editingScheduleId}`, {method:'PUT', body:JSON.stringify(body)});
+    } else {
+      await api('/api/schedules', {method:'POST', body:JSON.stringify(body)});
+    }
+    bootstrap.Modal.getInstance(document.getElementById('scheduleModal')).hide();
+    loadSchedules();
+  } catch(e) { alert('Error saving schedule: ' + e.message); }
+}
+
+// ── Settings ──────────────────────────────────────────────────────────────────
+async function loadSettings() {
+  const [cfg, hosts, authStatus] = await Promise.all([
+    api('/api/config'), api('/api/hosts'), fetch('/api/auth/status').then(r=>r.json())
+  ]);
+  document.getElementById('backup-dir-input').value = cfg.backup_dir || '';
+  const el = document.getElementById('settings-hosts');
+  el.innerHTML = hosts.map(h=>`
+    <div class="d-flex align-items-center gap-2 p-2 rounded" style="background:#21262d">
+      <div class="dot ${h.ok?'ok':'err'}"></div>
+      <div class="flex-grow-1 small">
+        <span class="text-light">${esc(h.host)}</span>
+        ${h.ok?`<span class="text-muted ms-2 small">${esc(h.name)} · ${esc(h.version)}</span>`
+              :`<span class="text-danger ms-2 small">${esc(h.error||'')}</span>`}
+      </div>
+      ${h.host!=='local'?`<button class="btn btn-outline-danger btn-xs" onclick="removeHost('${esc(h.host)}')">
+        <i class="bi bi-x"></i></button>`:''}
+    </div>`).join('') || '<div class="text-muted small">No hosts</div>';
+
+  const authMsg = document.getElementById('auth-status-msg');
+  authMsg.textContent = authStatus.enabled
+    ? `Auth enabled — logged in as ${authStatus.username}`
+    : 'Auth is disabled — the UI is publicly accessible.';
+  document.getElementById('auth-disable-btn').style.display = authStatus.enabled ? '' : 'none';
+}
+
+async function addHost() {
+  const input = document.getElementById('new-host-input');
+  const host = input.value.trim();
+  if (!host) return;
+  await api('/api/hosts', {method:'POST', body:JSON.stringify({host})});
+  input.value = '';
+  loadSettings();
+}
+async function removeHost(host) {
+  if (!confirm(`Remove host: ${host}?`)) return;
+  await api('/api/hosts/'+encodeURIComponent(host), {method:'DELETE'});
+  loadSettings();
+}
+async function saveBackupDir() {
+  const dir = document.getElementById('backup-dir-input').value.trim();
+  if (!dir) return;
+  await api('/api/config', {method:'POST', body:JSON.stringify({backup_dir:dir})});
+  showToast('Backup directory saved');
+}
+async function saveAuth() {
+  const user = document.getElementById('auth-user').value.trim();
+  const pass = document.getElementById('auth-pass').value;
+  const msg  = document.getElementById('auth-msg');
+  const res  = await api('/api/auth/setup', {method:'POST', body:JSON.stringify({username:user, password:pass})});
+  if (res.ok) {
+    msg.innerHTML = '<span class="text-success">✓ Authentication enabled</span>';
+    document.getElementById('logout-btn').style.display = '';
+    loadSettings();
+  } else {
+    msg.innerHTML = `<span class="text-danger">${esc(res.error)}</span>`;
+  }
+}
+async function disableAuth() {
+  if (!confirm('Disable authentication? The UI will be publicly accessible.')) return;
+  const res = await api('/api/auth/disable', {method:'POST'});
+  if (res.ok) { loadSettings(); document.getElementById('logout-btn').style.display='none'; }
+}
+document.getElementById('new-host-input').addEventListener('keydown', e => {
+  if (e.key === 'Enter') addHost();
+});
+
+// ── Jobs ──────────────────────────────────────────────────────────────────────
+async function loadJobs() {
+  const data = await api('/api/jobs');
+  const el = document.getElementById('jobs-list');
+  if (!data.length) {
+    el.innerHTML = '<div class="empty-state"><i class="bi bi-list-task"></i>No jobs yet</div>';
+    return;
+  }
+  el.innerHTML = data.slice().reverse().map(j=>{
+    const icon = j.status==='running' ? '<span class="spin"></span>'
+               : j.status==='done'    ? '<i class="bi bi-check-circle-fill text-success"></i>'
+               :                        '<i class="bi bi-x-circle-fill text-danger"></i>';
+    const logs = j.logs.filter(l=>l!=='[DONE]').join('\n');
+    return `<div class="card">
+      <div class="card-header px-3 py-2 d-flex align-items-center gap-2">
+        ${icon}
+        <span class="flex-grow-1 small">${esc(j.label)}</span>
+        <span class="text-muted" style="font-size:.72rem">${fmtDate(j.created)}</span>
+      </div>
+      <pre class="mb-0 px-3 py-2" style="font-size:.75rem;color:#8b949e;max-height:160px;overflow-y:auto;background:transparent;white-space:pre-wrap">${esc(logs)}</pre>
+    </div>`;
+  }).join('');
+
+  const running = data.filter(j=>j.status==='running').length;
+  const badge = document.getElementById('jobs-badge');
+  running ? (badge.textContent=running, badge.classList.remove('d-none')) : badge.classList.add('d-none');
+}
+
+// Auto-refresh jobs badge
+setInterval(async ()=>{
+  try {
+    const data = await api('/api/jobs');
+    const running = data.filter(j=>j.status==='running').length;
+    const b = document.getElementById('jobs-badge');
+    running ? (b.textContent=running, b.classList.remove('d-none')) : b.classList.add('d-none');
+  } catch(e){}
+}, 3000);
+
+// ── Backup Modal ──────────────────────────────────────────────────────────────
+function openBackupModal(container, host) {
+  document.getElementById('bk-container').value = container;
+  document.getElementById('bk-host').value = host;
+  document.getElementById('bk-prehook').value = '';
+  document.getElementById('bk-keep-count').value = 0;
+  document.getElementById('bk-keep-days').value = 0;
+  document.getElementById('bk-save-image').checked = false;
+  document.getElementById('bk-log-wrap').classList.add('d-none');
+  document.getElementById('bk-log').textContent = '';
+  document.getElementById('bk-btn').disabled = false;
+  new bootstrap.Modal(document.getElementById('backupModal')).show();
+}
+
+async function startBackup() {
+  const btn = document.getElementById('bk-btn');
+  btn.disabled = true;
+  const logWrap = document.getElementById('bk-log-wrap');
+  const logEl   = document.getElementById('bk-log');
+  logWrap.classList.remove('d-none');
+  logEl.textContent = '';
+  const res = await api('/api/backup', {method:'POST', body:JSON.stringify({
+    container:       document.getElementById('bk-container').value,
+    host:            document.getElementById('bk-host').value,
+    pre_hook:        document.getElementById('bk-prehook').value.trim(),
+    save_image:      document.getElementById('bk-save-image').checked,
+    retention_count: parseInt(document.getElementById('bk-keep-count').value)||null,
+    retention_days:  parseInt(document.getElementById('bk-keep-days').value)||null,
+  })});
+  if (res.error) { logEl.textContent='Error: '+res.error; return; }
+  streamJob(res.job_id, logEl, () => loadDashboard());
+}
+
+// ── Bulk Backup Modal ─────────────────────────────────────────────────────────
+let _bulkHost = '';
+async function openBulkModal(host) {
+  _bulkHost = host;
+  document.getElementById('bulk-host-title').textContent = host;
+  document.getElementById('bulk-prehook').value = '';
+  document.getElementById('bulk-save-image').checked = false;
+  document.getElementById('bulk-log-wrap').classList.add('d-none');
+  document.getElementById('bulk-log').textContent = '';
+  document.getElementById('bulk-btn').disabled = false;
+
+  const listEl = document.getElementById('bulk-container-list');
+  listEl.innerHTML = '<div class="text-muted small">Loading containers…</div>';
+  const ctrs = await api(`/api/containers?host=${encodeURIComponent(host)}`);
+  const running = ctrs.filter(c=>c.status==='running');
+  listEl.innerHTML = running.length
+    ? running.map(c=>`<div class="d-flex align-items-center gap-2 text-light small">
+        <i class="bi bi-box text-muted"></i>${esc(c.name)}
+        <span class="text-muted ms-auto">${esc(c.image)}</span>
+      </div>`).join('')
+    : '<div class="text-warning small">No running containers</div>';
+
+  new bootstrap.Modal(document.getElementById('bulkModal')).show();
+}
+
+async function startBulkBackup() {
+  const btn    = document.getElementById('bulk-btn');
+  const logEl  = document.getElementById('bulk-log');
+  const logWrap= document.getElementById('bulk-log-wrap');
+  btn.disabled = true;
+  logWrap.classList.remove('d-none');
+  logEl.textContent = '';
+
+  const res = await api('/api/bulk-backup', {method:'POST', body:JSON.stringify({
+    host:       _bulkHost,
+    pre_hook:   document.getElementById('bulk-prehook').value.trim(),
+    save_image: document.getElementById('bulk-save-image').checked,
+  })});
+  if (res.error) { logEl.textContent='Error: '+res.error; return; }
+
+  logEl.textContent = `Started ${res.jobs.length} backup job(s):\n`;
+  res.jobs.forEach(j => { logEl.textContent += `  ${j.container} → job ${j.job_id}\n`; });
+  logEl.textContent += '\nMonitor progress in Jobs →';
+}
+
+// ── Restore Modal ─────────────────────────────────────────────────────────────
+async function openRestoreModal(path, containerName) {
+  document.getElementById('rs-file').value = path;
+  document.getElementById('rs-name').placeholder = containerName + ' (original)';
+  document.getElementById('rs-name').value = '';
+  document.getElementById('rs-start').checked = false;
+  document.getElementById('rs-load-image').checked = false;
+  document.getElementById('rs-log-wrap').classList.add('d-none');
+  document.getElementById('rs-log').textContent = '';
+  document.getElementById('rs-btn').disabled = false;
+  const hosts = await api('/api/hosts');
+  const sel = document.getElementById('rs-host');
+  sel.innerHTML = hosts.map(h=>`<option value="${esc(h.host)}">${esc(h.host)}${h.ok?' ✓':' ✗'}</option>`).join('');
+  new bootstrap.Modal(document.getElementById('restoreModal')).show();
+}
+
+async function startRestore() {
+  const btn   = document.getElementById('rs-btn');
+  const logEl = document.getElementById('rs-log');
+  btn.disabled = true;
+  document.getElementById('rs-log-wrap').classList.remove('d-none');
+  logEl.textContent = '';
+  const res = await api('/api/restore', {method:'POST', body:JSON.stringify({
+    backup_path: document.getElementById('rs-file').value,
+    host:        document.getElementById('rs-host').value,
+    new_name:    document.getElementById('rs-name').value.trim()||null,
+    start:       document.getElementById('rs-start').checked,
+    load_image:  document.getElementById('rs-load-image').checked,
+  })});
+  if (res.error) { logEl.textContent='Error: '+res.error; return; }
+  streamJob(res.job_id, logEl, () => loadContainers());
+}
+
+// ── SSE Log Stream ────────────────────────────────────────────────────────────
+function streamJob(jobId, logEl, onDone) {
+  const es = new EventSource('/api/jobs/'+jobId+'/stream');
+  es.onmessage = e => {
+    if (e.data==='[DONE]') { es.close(); onDone?.(); return; }
+    logEl.textContent += e.data+'\n';
+    logEl.scrollTop = logEl.scrollHeight;
+  };
+  es.onerror = () => es.close();
+}
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+function navigate(section) {
+  document.querySelector(`.nav-link[data-section="${section}"]`).click();
+}
+
+function showToast(msg) {
+  const t = document.createElement('div');
+  t.className = 'position-fixed bottom-0 end-0 m-3 alert alert-success py-2 px-3 small';
+  t.style.zIndex = 9000;
+  t.textContent = msg;
+  document.body.appendChild(t);
+  setTimeout(()=>t.remove(), 3000);
+}
+
+// ── Init ──────────────────────────────────────────────────────────────────────
+checkAuth().then(loadDashboard);
+</script>
+</body>
+</html>