Initial commit

webapp/app.py

@@ -0,0 +1,859 @@
+#!/usr/bin/env python3
+"""Docker Backup Web UI"""
+
+import json
+import os
+import secrets
+import sys
+import tarfile
+import threading
+import time
+import uuid
+from datetime import datetime
+from functools import wraps
+from pathlib import Path
+
+import docker
+from apscheduler.schedulers.background import BackgroundScheduler
+from apscheduler.triggers.cron import CronTrigger
+from docker.errors import NotFound, APIError
+from flask import Flask, Response, jsonify, render_template, request, session, stream_with_context
+from werkzeug.security import check_password_hash, generate_password_hash
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+app = Flask(__name__)
+
+# ── Secret key (stable across restarts) ──────────────────────────────────────
+_KEY_FILE = Path(__file__).parent / ".secret_key"
+if _KEY_FILE.exists():
+    app.secret_key = _KEY_FILE.read_text().strip()
+else:
+    _key = secrets.token_hex(32)
+    _KEY_FILE.write_text(_key)
+    app.secret_key = _key
+
+CONFIG_FILE = Path(__file__).parent / "config.json"
+DEFAULT_CONFIG = {
+    "hosts": ["local"],
+    "backup_dir": str(Path(__file__).parent / "backups"),
+    "auth": {},
+    "schedules": [],
+}
+
+jobs: dict[str, dict] = {}
+jobs_lock = threading.Lock()
+
+CRON_ALIASES = {
+    "hourly":  "0 * * * *",
+    "daily":   "0 2 * * *",
+    "weekly":  "0 2 * * 0",
+    "monthly": "0 2 1 * *",
+}
+
+
+# ── Config ────────────────────────────────────────────────────────────────────
+
+def load_config() -> dict:
+    if CONFIG_FILE.exists():
+        data = json.loads(CONFIG_FILE.read_text())
+        # Back-fill missing keys
+        for k, v in DEFAULT_CONFIG.items():
+            data.setdefault(k, v)
+        return data
+    return DEFAULT_CONFIG.copy()
+
+
+def save_config(cfg: dict):
+    CONFIG_FILE.write_text(json.dumps(cfg, indent=2))
+
+
+# ── Auth ──────────────────────────────────────────────────────────────────────
+
+def auth_enabled() -> bool:
+    return bool(load_config().get("auth", {}).get("password_hash"))
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if auth_enabled() and not session.get("authenticated"):
+            if request.is_json or request.path.startswith("/api/"):
+                return jsonify({"error": "unauthorized"}), 401
+            return jsonify({"error": "unauthorized"}), 401
+        return f(*args, **kwargs)
+    return decorated
+
+
+@app.route("/api/auth/status")
+def api_auth_status():
+    return jsonify({
+        "enabled": auth_enabled(),
+        "authenticated": session.get("authenticated", False),
+        "username": load_config().get("auth", {}).get("username", ""),
+    })
+
+
+@app.route("/api/auth/login", methods=["POST"])
+def api_auth_login():
+    data = request.json or {}
+    cfg = load_config()
+    auth = cfg.get("auth", {})
+    if not auth.get("password_hash"):
+        return jsonify({"error": "Auth not configured"}), 400
+    if data.get("username") != auth.get("username"):
+        return jsonify({"error": "Invalid credentials"}), 401
+    if not check_password_hash(auth["password_hash"], data.get("password", "")):
+        return jsonify({"error": "Invalid credentials"}), 401
+    session["authenticated"] = True
+    session.permanent = True
+    return jsonify({"ok": True})
+
+
+@app.route("/api/auth/logout", methods=["POST"])
+def api_auth_logout():
+    session.clear()
+    return jsonify({"ok": True})
+
+
+@app.route("/api/auth/setup", methods=["POST"])
+def api_auth_setup():
+    cfg = load_config()
+    auth = cfg.get("auth", {})
+    data = request.json or {}
+    # If auth already configured, require current password
+    if auth.get("password_hash"):
+        if not session.get("authenticated"):
+            return jsonify({"error": "unauthorized"}), 401
+    username = data.get("username", "").strip()
+    password = data.get("password", "")
+    if not username or not password:
+        return jsonify({"error": "username and password required"}), 400
+    if len(password) < 6:
+        return jsonify({"error": "password must be at least 6 characters"}), 400
+    cfg["auth"] = {
+        "username": username,
+        "password_hash": generate_password_hash(password),
+    }
+    save_config(cfg)
+    session["authenticated"] = True
+    return jsonify({"ok": True})
+
+
+@app.route("/api/auth/disable", methods=["POST"])
+@login_required
+def api_auth_disable():
+    cfg = load_config()
+    cfg["auth"] = {}
+    save_config(cfg)
+    session.clear()
+    return jsonify({"ok": True})
+
+
+# ── Job helpers ───────────────────────────────────────────────────────────────
+
+def new_job(label: str) -> str:
+    jid = str(uuid.uuid4())[:8]
+    with jobs_lock:
+        jobs[jid] = {"id": jid, "label": label, "status": "running",
+                     "logs": [], "created": datetime.now().isoformat()}
+    return jid
+
+
+def job_log(jid: str, msg: str):
+    with jobs_lock:
+        if jid in jobs:
+            jobs[jid]["logs"].append(msg)
+
+
+def job_done(jid: str, error: str | None = None):
+    with jobs_lock:
+        if jid in jobs:
+            jobs[jid]["status"] = "error" if error else "done"
+            if error:
+                jobs[jid]["logs"].append(f"ERROR: {error}")
+            jobs[jid]["logs"].append("[DONE]")
+
+
+# ── Docker client helper ──────────────────────────────────────────────────────
+
+def make_client(host: str) -> docker.DockerClient:
+    if host in ("local", ""):
+        return docker.from_env()
+    url = host if "://" in host else f"tcp://{host}"
+    return docker.DockerClient(base_url=url, use_ssh_client=host.startswith("ssh://"))
+
+
+# ── Retention ─────────────────────────────────────────────────────────────────
+
+def apply_retention(backup_dir: Path, container_name: str,
+                    keep_count: int | None, keep_days: int | None) -> int:
+    safe = container_name.lstrip("/").replace("/", "_")
+    files = sorted(backup_dir.glob(f"{safe}_*.tar"),
+                   key=lambda x: x.stat().st_mtime, reverse=True)
+    to_delete: set[Path] = set()
+    if keep_days and keep_days > 0:
+        cutoff = time.time() - keep_days * 86400
+        to_delete.update(f for f in files if f.stat().st_mtime < cutoff)
+    if keep_count and keep_count > 0:
+        to_delete.update(files[keep_count:])
+    for f in to_delete:
+        try:
+            f.unlink()
+        except Exception:
+            pass
+    return len(to_delete)
+
+
+# ── Backup worker ─────────────────────────────────────────────────────────────
+
+def _run_backup(jid: str, host: str, container_name: str,
+                backup_dir: str, save_image: bool, pre_hook: str = "",
+                retention_count: int | None = None, retention_days: int | None = None):
+    from io import BytesIO
+    try:
+        client = make_client(host)
+        client.ping()
+        job_log(jid, f"Connected to {host}")
+
+        try:
+            container = client.containers.get(container_name)
+        except NotFound:
+            job_done(jid, f"Container not found: {container_name}")
+            return
+
+        # Pre-hook
+        if pre_hook and pre_hook.strip():
+            job_log(jid, f"Running pre-hook: {pre_hook}")
+            try:
+                result = container.exec_run(["sh", "-c", pre_hook],
+                                            stdout=True, stderr=True)
+                output = result.output.decode(errors="replace").strip()
+                if result.exit_code != 0:
+                    job_log(jid, f"⚠ Pre-hook exited {result.exit_code}: {output}")
+                else:
+                    job_log(jid, f"✓ Pre-hook OK{': ' + output[:200] if output else ''}")
+            except Exception as e:
+                job_log(jid, f"⚠ Pre-hook failed: {e}")
+
+        ts = datetime.now().strftime("%Y%m%d_%H%M%S")
+        safe_name = container.name.lstrip("/").replace("/", "_")
+        out_file = Path(backup_dir) / f"{safe_name}_{ts}.tar"
+        Path(backup_dir).mkdir(parents=True, exist_ok=True)
+
+        inspect = client.api.inspect_container(container.id)
+        job_log(jid, f"Backing up: {container.name}")
+
+        with tarfile.open(out_file, "w") as tar:
+            config_bytes = json.dumps(inspect, indent=2).encode()
+            info = tarfile.TarInfo(name="config.json")
+            info.size = len(config_bytes)
+            info.mtime = int(time.time())
+            tar.addfile(info, BytesIO(config_bytes))
+            job_log(jid, "✓ config.json")
+
+            for mount in inspect.get("Mounts", []):
+                mtype = mount.get("Type", "")
+                if mtype not in ("volume", "bind"):
+                    continue
+                dest = mount.get("Destination", "")
+                if mtype == "volume":
+                    label = mount.get("Name") or dest.replace("/", "_")
+                else:
+                    label = mount.get("Source", "").replace("/", "_").lstrip("_")
+
+                archive_name = f"volumes/{label}.tar"
+                job_log(jid, f"Archiving volume: {label} ({dest})")
+                try:
+                    stream, _ = client.api.get_archive(container.id, dest)
+                    vol_data = b"".join(stream)
+                    vi = tarfile.TarInfo(name=archive_name)
+                    vi.size = len(vol_data)
+                    vi.mtime = int(time.time())
+                    tar.addfile(vi, BytesIO(vol_data))
+                    job_log(jid, f"✓ {archive_name} ({len(vol_data)//1024} KB)")
+                except Exception as e:
+                    job_log(jid, f"⚠ Could not archive {label}: {e}")
+
+            if save_image:
+                image_tag = inspect["Config"].get("Image", "")
+                job_log(jid, f"Saving image: {image_tag}…")
+                try:
+                    img_data = b"".join(client.images.get(image_tag).save())
+                    ii = tarfile.TarInfo(name="image.tar")
+                    ii.size = len(img_data)
+                    ii.mtime = int(time.time())
+                    tar.addfile(ii, BytesIO(img_data))
+                    job_log(jid, f"✓ image.tar ({len(img_data)//1024//1024} MB)")
+                except Exception as e:
+                    job_log(jid, f"⚠ Image save failed: {e}")
+
+        job_log(jid, f"✓ Saved: {out_file.name}")
+
+        # Retention
+        if retention_count or retention_days:
+            deleted = apply_retention(Path(backup_dir), container.name,
+                                      retention_count, retention_days)
+            if deleted:
+                job_log(jid, f"Retention: removed {deleted} old backup(s)")
+
+        job_done(jid)
+    except Exception as e:
+        job_done(jid, str(e))
+
+
+# ── Restore worker ────────────────────────────────────────────────────────────
+
+def _run_restore(jid: str, host: str, backup_path: str,
+                 new_name: str | None, start: bool, load_image: bool):
+    from io import BytesIO
+    try:
+        client = make_client(host)
+        client.ping()
+        job_log(jid, f"Connected to {host}")
+
+        bp = Path(backup_path)
+        if not bp.exists():
+            job_done(jid, f"File not found: {backup_path}")
+            return
+
+        with tarfile.open(bp, "r") as tar:
+            config = json.loads(tar.extractfile("config.json").read())
+
+        orig_name = config["Name"].lstrip("/")
+        container_name = new_name or orig_name
+        image_name = config["Config"]["Image"]
+        job_log(jid, f"Restoring '{orig_name}' → '{container_name}' (image: {image_name})")
+
+        if load_image:
+            with tarfile.open(bp, "r") as tar:
+                try:
+                    img_data = tar.extractfile("image.tar").read()
+                    job_log(jid, "Loading image from backup…")
+                    client.images.load(img_data)
+                    job_log(jid, "✓ Image loaded")
+                except KeyError:
+                    job_log(jid, "⚠ No image.tar in backup — will pull")
+
+        try:
+            client.images.get(image_name)
+            job_log(jid, f"✓ Image {image_name} present")
+        except NotFound:
+            job_log(jid, f"Pulling {image_name}…")
+            client.images.pull(image_name)
+            job_log(jid, f"✓ Pulled {image_name}")
+
+        try:
+            existing = client.containers.get(container_name)
+            job_log(jid, f"Removing existing container {container_name}")
+            existing.remove(force=True)
+        except NotFound:
+            pass
+
+        mounts = config.get("Mounts", [])
+        vol_data_map: dict[str, bytes] = {}
+        with tarfile.open(bp, "r") as tar:
+            for m in tar.getmembers():
+                if m.name.startswith("volumes/") and m.name.endswith(".tar"):
+                    label = m.name[len("volumes/"):-len(".tar")]
+                    vol_data_map[label] = tar.extractfile(m).read()
+
+        for mount in mounts:
+            if mount.get("Type") != "volume":
+                continue
+            vol_name = mount.get("Name", "")
+            dest = mount.get("Destination", "")
+            label = vol_name or dest.replace("/", "_")
+            try:
+                client.volumes.get(vol_name)
+                job_log(jid, f"Volume {vol_name} exists")
+            except NotFound:
+                client.volumes.create(name=vol_name)
+                job_log(jid, f"✓ Created volume {vol_name}")
+
+            if label in vol_data_map:
+                job_log(jid, f"Restoring volume data: {vol_name}")
+                try:
+                    rc = client.containers.run(
+                        "alpine",
+                        command="sh -c 'cd /t && tar xf /tmp/vol.tar --strip-components=1'",
+                        volumes={vol_name: {"bind": "/t", "mode": "rw"}},
+                        detach=True, remove=False,
+                    )
+                    client.api.put_archive(rc.id, "/tmp", vol_data_map[label])
+                    rc.wait()
+                    rc.remove()
+                    job_log(jid, f"✓ Volume restored: {vol_name}")
+                except Exception as e:
+                    job_log(jid, f"⚠ Volume restore failed {vol_name}: {e}")
+
+        cfg_c = config["Config"]
+        hcfg = config["HostConfig"]
+        kwargs: dict = {
+            "image": image_name, "name": container_name,
+            "command": cfg_c.get("Cmd"), "entrypoint": cfg_c.get("Entrypoint"),
+            "environment": cfg_c.get("Env") or [],
+            "working_dir": cfg_c.get("WorkingDir") or None,
+            "user": cfg_c.get("User") or None,
+            "hostname": cfg_c.get("Hostname") or None,
+            "labels": cfg_c.get("Labels") or {},
+            "tty": cfg_c.get("Tty", False),
+            "stdin_open": cfg_c.get("OpenStdin", False),
+        }
+        exposed = cfg_c.get("ExposedPorts") or {}
+        port_bindings = hcfg.get("PortBindings") or {}
+        if exposed or port_bindings:
+            ports = {}
+            for pp in exposed:
+                binds = port_bindings.get(pp)
+                ports[pp] = [b["HostPort"] for b in binds if b.get("HostPort")] if binds else None
+            kwargs["ports"] = ports
+        restart = hcfg.get("RestartPolicy", {})
+        if restart.get("Name"):
+            kwargs["restart_policy"] = {"Name": restart["Name"],
+                                         "MaximumRetryCount": restart.get("MaximumRetryCount", 0)}
+        net_mode = hcfg.get("NetworkMode", "default")
+        if net_mode not in ("default", "bridge"):
+            kwargs["network_mode"] = net_mode
+        vol_binds = []
+        for m in mounts:
+            dest = m.get("Destination", "")
+            mode = "rw" if m.get("RW") is not False else "ro"
+            if m.get("Type") == "volume":
+                vol_binds.append(f"{m['Name']}:{dest}:{mode}")
+            elif m.get("Type") == "bind":
+                vol_binds.append(f"{m['Source']}:{dest}:{mode}")
+        if vol_binds:
+            kwargs["volumes"] = vol_binds
+        if hcfg.get("Privileged"):
+            kwargs["privileged"] = True
+        if hcfg.get("CapAdd"):
+            kwargs["cap_add"] = hcfg["CapAdd"]
+
+        ctr = client.containers.create(**{k: v for k, v in kwargs.items() if v is not None})
+        job_log(jid, f"✓ Container created: {ctr.name} ({ctr.short_id})")
+        if start:
+            ctr.start()
+            job_log(jid, "✓ Container started")
+        job_done(jid)
+    except Exception as e:
+        job_done(jid, str(e))
+
+
+# ── Scheduler ─────────────────────────────────────────────────────────────────
+
+scheduler = BackgroundScheduler(timezone="UTC")
+scheduler.start()
+
+
+def run_scheduled_backup(schedule_id: str):
+    cfg = load_config()
+    sched = next((s for s in cfg.get("schedules", []) if s["id"] == schedule_id), None)
+    if not sched or not sched.get("enabled", True):
+        return
+
+    backup_dir = cfg["backup_dir"]
+    host        = sched["host"]
+    container   = sched["container"]
+    save_image  = sched.get("save_image", False)
+    pre_hook    = sched.get("pre_hook", "")
+    r_count     = sched.get("retention_count") or None
+    r_days      = sched.get("retention_days") or None
+
+    jid = new_job(f"[Scheduled] {container} on {host}")
+
+    def worker():
+        _run_backup(jid, host, container, backup_dir, save_image,
+                    pre_hook=pre_hook, retention_count=r_count, retention_days=r_days)
+        status = jobs.get(jid, {}).get("status", "unknown")
+        cfg2 = load_config()
+        for s in cfg2.get("schedules", []):
+            if s["id"] == schedule_id:
+                s["last_run"] = datetime.now().isoformat()
+                s["last_status"] = status
+                break
+        save_config(cfg2)
+
+    threading.Thread(target=worker, daemon=True).start()
+    return jid
+
+
+def _cron_kwargs(expr: str) -> dict:
+    expr = CRON_ALIASES.get(expr.lower(), expr)
+    parts = expr.split()
+    if len(parts) != 5:
+        raise ValueError(f"Invalid cron: {expr}")
+    minute, hour, day, month, dow = parts
+    return dict(minute=minute, hour=hour, day=day, month=month, day_of_week=dow)
+
+
+def _register_schedule(sched: dict):
+    try:
+        kwargs = _cron_kwargs(sched["cron"])
+        scheduler.add_job(run_scheduled_backup, CronTrigger(**kwargs),
+                          id=sched["id"], args=[sched["id"]], replace_existing=True)
+    except Exception as e:
+        print(f"Warning: schedule {sched['id']} not registered: {e}")
+
+
+def _unregister_schedule(schedule_id: str):
+    try:
+        scheduler.remove_job(schedule_id)
+    except Exception:
+        pass
+
+
+# Load existing schedules on startup
+for _s in load_config().get("schedules", []):
+    if _s.get("enabled", True):
+        _register_schedule(_s)
+
+
+# ── Routes: main page ─────────────────────────────────────────────────────────
+
+@app.route("/")
+def index():
+    return render_template("index.html")
+
+
+# ── Routes: config ────────────────────────────────────────────────────────────
+
+@app.route("/api/config", methods=["GET", "POST"])
+@login_required
+def api_config():
+    if request.method == "POST":
+        cfg = load_config()
+        data = request.json or {}
+        if "backup_dir" in data:
+            cfg["backup_dir"] = data["backup_dir"]
+        save_config(cfg)
+        return jsonify(cfg)
+    cfg = load_config()
+    cfg.pop("auth", None)   # never send password hash to browser
+    return jsonify(cfg)
+
+
+# ── Routes: hosts ─────────────────────────────────────────────────────────────
+
+@app.route("/api/hosts")
+@login_required
+def api_hosts_list():
+    cfg = load_config()
+    result = []
+    for host in cfg["hosts"]:
+        try:
+            c = make_client(host)
+            c.ping()
+            info = c.info()
+            result.append({"host": host, "ok": True,
+                            "name": info.get("Name", ""),
+                            "version": info.get("ServerVersion", ""),
+                            "containers": info.get("Containers", 0)})
+        except Exception as e:
+            result.append({"host": host, "ok": False, "error": str(e)})
+    return jsonify(result)
+
+
+@app.route("/api/hosts", methods=["POST"])
+@login_required
+def api_hosts_add():
+    host = (request.json or {}).get("host", "").strip()
+    if not host:
+        return jsonify({"error": "host required"}), 400
+    cfg = load_config()
+    if host not in cfg["hosts"]:
+        cfg["hosts"].append(host)
+        save_config(cfg)
+    return jsonify(cfg)
+
+
+@app.route("/api/hosts/<path:host>", methods=["DELETE"])
+@login_required
+def api_hosts_delete(host):
+    cfg = load_config()
+    cfg["hosts"] = [h for h in cfg["hosts"] if h != host]
+    save_config(cfg)
+    return jsonify(cfg)
+
+
+# ── Routes: containers ────────────────────────────────────────────────────────
+
+@app.route("/api/containers")
+@login_required
+def api_containers():
+    cfg = load_config()
+    show_all = request.args.get("all", "false").lower() == "true"
+    host_filter = request.args.get("host")
+    hosts = [host_filter] if host_filter else cfg["hosts"]
+    result = []
+    for host in hosts:
+        try:
+            client = make_client(host)
+            for c in client.containers.list(all=show_all):
+                ports = {k: v[0]["HostPort"] if v else None for k, v in (c.ports or {}).items()}
+                result.append({"host": host, "id": c.short_id, "name": c.name,
+                                "image": c.image.tags[0] if c.image.tags else c.image.short_id,
+                                "status": c.status, "ports": ports})
+        except Exception as e:
+            result.append({"host": host, "id": None, "name": None,
+                           "image": None, "status": "error", "error": str(e)})
+    return jsonify(result)
+
+
+# ── Routes: backups ───────────────────────────────────────────────────────────
+
+@app.route("/api/backups")
+@login_required
+def api_backups():
+    cfg = load_config()
+    backup_dir = Path(cfg["backup_dir"])
+    if not backup_dir.exists():
+        return jsonify([])
+    result = []
+    for f in sorted(backup_dir.glob("*.tar"), key=lambda x: x.stat().st_mtime, reverse=True):
+        stat = f.stat()
+        try:
+            with tarfile.open(f, "r") as tar:
+                members = tar.getmembers()
+                config = json.loads(tar.extractfile("config.json").read())
+            orig_name = config["Name"].lstrip("/")
+            image = config["Config"]["Image"]
+            has_image = any(m.name == "image.tar" for m in members)
+            volumes = [m.name[len("volumes/"):-len(".tar")]
+                       for m in members
+                       if m.name.startswith("volumes/") and m.name.endswith(".tar")]
+        except Exception:
+            orig_name = f.stem
+            image = "unknown"
+            has_image = False
+            volumes = []
+        result.append({
+            "file": f.name, "path": str(f),
+            "size_mb": round(stat.st_size / 1024 / 1024, 1),
+            "mtime": datetime.fromtimestamp(stat.st_mtime).isoformat(),
+            "container": orig_name, "image": image,
+            "has_image": has_image, "volumes": volumes,
+        })
+    return jsonify(result)
+
+
+@app.route("/api/backups/<path:filename>", methods=["DELETE"])
+@login_required
+def api_backup_delete(filename):
+    cfg = load_config()
+    path = Path(cfg["backup_dir"]) / filename
+    if not path.exists():
+        return jsonify({"error": "not found"}), 404
+    path.unlink()
+    return jsonify({"ok": True})
+
+
+# ── Routes: backup / restore / bulk ──────────────────────────────────────────
+
+@app.route("/api/backup", methods=["POST"])
+@login_required
+def api_backup_start():
+    data = request.json or {}
+    host       = data.get("host", "local")
+    container  = data.get("container")
+    save_image = data.get("save_image", False)
+    pre_hook   = data.get("pre_hook", "")
+    r_count    = data.get("retention_count") or None
+    r_days     = data.get("retention_days") or None
+    if not container:
+        return jsonify({"error": "container required"}), 400
+    cfg = load_config()
+    jid = new_job(f"Backup {container} on {host}")
+    threading.Thread(target=_run_backup,
+                     args=(jid, host, container, cfg["backup_dir"],
+                           save_image, pre_hook, r_count, r_days),
+                     daemon=True).start()
+    return jsonify({"job_id": jid})
+
+
+@app.route("/api/bulk-backup", methods=["POST"])
+@login_required
+def api_bulk_backup():
+    data = request.json or {}
+    host       = data.get("host", "local")
+    save_image = data.get("save_image", False)
+    pre_hook   = data.get("pre_hook", "")
+    try:
+        client = make_client(host)
+        client.ping()
+        containers = client.containers.list(all=False)  # running only
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+    if not containers:
+        return jsonify({"error": "No running containers on host"}), 400
+    cfg = load_config()
+    job_ids = []
+    for c in containers:
+        jid = new_job(f"Bulk: {c.name} on {host}")
+        threading.Thread(target=_run_backup,
+                         args=(jid, host, c.name, cfg["backup_dir"],
+                               save_image, pre_hook),
+                         daemon=True).start()
+        job_ids.append({"job_id": jid, "container": c.name})
+    return jsonify({"jobs": job_ids})
+
+
+@app.route("/api/restore", methods=["POST"])
+@login_required
+def api_restore_start():
+    data = request.json or {}
+    host        = data.get("host", "local")
+    backup_path = data.get("backup_path")
+    new_name    = data.get("new_name") or None
+    start       = data.get("start", False)
+    load_image  = data.get("load_image", False)
+    if not backup_path:
+        return jsonify({"error": "backup_path required"}), 400
+    jid = new_job(f"Restore {Path(backup_path).name} → {host}")
+    threading.Thread(target=_run_restore,
+                     args=(jid, host, backup_path, new_name, start, load_image),
+                     daemon=True).start()
+    return jsonify({"job_id": jid})
+
+
+# ── Routes: schedules ─────────────────────────────────────────────────────────
+
+@app.route("/api/schedules")
+@login_required
+def api_schedules_list():
+    cfg = load_config()
+    schedules = cfg.get("schedules", [])
+    # Attach next_run from scheduler
+    for s in schedules:
+        job = scheduler.get_job(s["id"])
+        s["next_run"] = job.next_run_time.isoformat() if (job and job.next_run_time) else None
+    return jsonify(schedules)
+
+
+@app.route("/api/schedules", methods=["POST"])
+@login_required
+def api_schedules_create():
+    data = request.json or {}
+    required = ("host", "container", "cron")
+    if not all(data.get(k) for k in required):
+        return jsonify({"error": "host, container, cron required"}), 400
+    # Validate cron
+    try:
+        _cron_kwargs(data["cron"])
+    except ValueError as e:
+        return jsonify({"error": str(e)}), 400
+
+    sched = {
+        "id":              str(uuid.uuid4())[:8],
+        "host":            data["host"],
+        "container":       data["container"],
+        "cron":            data["cron"],
+        "pre_hook":        data.get("pre_hook", ""),
+        "save_image":      data.get("save_image", False),
+        "retention_count": data.get("retention_count") or None,
+        "retention_days":  data.get("retention_days") or None,
+        "enabled":         data.get("enabled", True),
+        "last_run":        None,
+        "last_status":     None,
+    }
+    cfg = load_config()
+    cfg.setdefault("schedules", []).append(sched)
+    save_config(cfg)
+    if sched["enabled"]:
+        _register_schedule(sched)
+    return jsonify(sched), 201
+
+
+@app.route("/api/schedules/<sid>", methods=["PUT"])
+@login_required
+def api_schedules_update(sid):
+    data = request.json or {}
+    cfg = load_config()
+    schedules = cfg.get("schedules", [])
+    sched = next((s for s in schedules if s["id"] == sid), None)
+    if not sched:
+        return jsonify({"error": "not found"}), 404
+    updatable = ("host", "container", "cron", "pre_hook", "save_image",
+                 "retention_count", "retention_days", "enabled")
+    for k in updatable:
+        if k in data:
+            sched[k] = data[k]
+    if "cron" in data:
+        try:
+            _cron_kwargs(sched["cron"])
+        except ValueError as e:
+            return jsonify({"error": str(e)}), 400
+    save_config(cfg)
+    _unregister_schedule(sid)
+    if sched.get("enabled", True):
+        _register_schedule(sched)
+    return jsonify(sched)
+
+
+@app.route("/api/schedules/<sid>", methods=["DELETE"])
+@login_required
+def api_schedules_delete(sid):
+    cfg = load_config()
+    cfg["schedules"] = [s for s in cfg.get("schedules", []) if s["id"] != sid]
+    save_config(cfg)
+    _unregister_schedule(sid)
+    return jsonify({"ok": True})
+
+
+@app.route("/api/schedules/<sid>/run", methods=["POST"])
+@login_required
+def api_schedules_run_now(sid):
+    jid = run_scheduled_backup(sid)
+    if not jid:
+        return jsonify({"error": "schedule not found or disabled"}), 404
+    return jsonify({"job_id": jid})
+
+
+# ── Routes: jobs ──────────────────────────────────────────────────────────────
+
+@app.route("/api/jobs")
+@login_required
+def api_jobs():
+    with jobs_lock:
+        return jsonify(list(jobs.values()))
+
+
+@app.route("/api/jobs/<jid>/stream")
+def api_job_stream(jid):
+    # Auth check without decorator (SSE doesn't send JSON)
+    if auth_enabled() and not session.get("authenticated"):
+        return Response("data: unauthorized\n\n", mimetype="text/event-stream", status=401)
+
+    def generate():
+        last = 0
+        while True:
+            with jobs_lock:
+                job = jobs.get(jid)
+            if not job:
+                yield f"data: Job {jid} not found\n\n"
+                break
+            logs = job["logs"]
+            while last < len(logs):
+                line = logs[last].replace("\n", " ")
+                yield f"data: {line}\n\n"
+                last += 1
+                if line == "[DONE]":
+                    return
+            if job["status"] in ("done", "error"):
+                break
+            time.sleep(0.15)
+
+    return Response(stream_with_context(generate()),
+                    mimetype="text/event-stream",
+                    headers={"Cache-Control": "no-cache", "X-Accel-Buffering": "no"})
+
+
+if __name__ == "__main__":
+    import argparse
+    p = argparse.ArgumentParser()
+    p.add_argument("--host", default="0.0.0.0")
+    p.add_argument("--port", type=int, default=5999)
+    p.add_argument("--debug", action="store_true")
+    args = p.parse_args()
+    print(f"Docker Backup UI → http://{args.host}:{args.port}")
+    app.run(host=args.host, port=args.port, debug=args.debug)