Merge branch 'develop' into develop

2026-09-20 08:45:24 +01:00 · 2026-06-04 15:06:42 +02:00
parent 6629abed32 33ef7c859e
commit a457fe4d96
84 changed files with 2939 additions and 2805 deletions
@@ -0,0 +1,31 @@
+<!-- WARNING: Any PR without a description will be closed. The title is not enough! -->
+
+<!-- ANOTHER WARNING: Don't go creating a duplicate PR! Check that someone hasn't already created something that tackles your fix and if so, help them first -->
+
+## Why
+
+<!-- Provide a brief description of WHY you are making your changes -->
+
+<!-- Consider if you are changing the API, then go in to detail why and/or if
+you change will break API for existing users -->
+
+## Type of Change
+
+<!-- Mark the relevant options with an "x" -->
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation update
+- [ ] Code refactoring
+- [ ] API changes
+- [ ] Performance improvement
+- [ ] Test addition or update
+
+## AI Usage
+
+<!-- Mark the relevant options with an "x" -->
+
+- [ ] AI was used to write this
+- [ ] AI was used to review this
+
@@ -8,3 +8,5 @@ test/node_modules
 */node_modules
 docker/dev/dnsrouter-config.json.tmp
 docker/dev/resolv.conf
+.claude
+
@@ -1 +1 @@
-2.14.0
+2.15.1
@@ -1,7 +1,7 @@
 <p align="center">
 	<img src="https://nginxproxymanager.com/github.png">
 	<br><br>
-	<img src="https://img.shields.io/badge/version-2.14.0-green.svg?style=for-the-badge">
+	<img src="https://img.shields.io/badge/version-2.15.1-green.svg?style=for-the-badge">
 	<a href="https://hub.docker.com/repository/docker/jc21/nginx-proxy-manager">
 		<img src="https://img.shields.io/docker/stars/jc21/nginx-proxy-manager.svg?style=for-the-badge">
 	</a>
@@ -10,7 +10,7 @@
 	</a>
 </p>

-This project comes as a pre-built docker image that enables you to easily forward to your websites
+This project comes as a pre-built Docker image that enables you to easily forward to your websites
 running at home or otherwise, including free SSL, without having to know too much about Nginx or Letsencrypt.

 - [Quick Setup](#quick-setup)
@@ -20,9 +20,9 @@ running at home or otherwise, including free SSL, without having to know too muc
 ## Project Goal

 I created this project to fill a personal need to provide users with an easy way to accomplish reverse
-proxying hosts with SSL termination and it had to be so easy that a monkey could do it. This goal hasn't changed.
-While there might be advanced options they are optional and the project should be as simple as possible
-so that the barrier for entry here is low.
+proxying hosts with SSL termination, and it had to be so easy that a monkey could do it. This goal hasn't changed.
+While there might be advanced options, they are optional, and the project should be as simple as possible
+so that the barrier to entry here is low.

 <a href="https://www.buymeacoffee.com/jc21" target="_blank"><img src="http://public.jc21.com/github/by-me-a-coffee.png" alt="Buy Me A Coffee" style="height: 51px !important;width: 217px !important;" ></a>

@@ -30,11 +30,11 @@ so that the barrier for entry here is low.
 ## Features

 - Beautiful and Secure Admin Interface based on [Tabler](https://tabler.github.io/)
- Easily create forwarding domains, redirections, streams and 404 hosts without knowing anything about Nginx
+- Easily create forwarding domains, redirections, streams, and 404 hosts without knowing anything about Nginx
 - Free SSL using Let's Encrypt or provide your own custom SSL certificates
 - Access Lists and basic HTTP Authentication for your hosts
 - Advanced Nginx configuration available for super users
- User management, permissions and audit log
+- User management, permissions, and audit log

 ::: warning
 `armv7` is no longer supported in version 2.14+. This is due to Nodejs dropping support for armhf. Please
@@ -43,15 +43,15 @@ use the `2.13.7` image tag if this applies to you.

 ## Hosting your home network

-I won't go in to too much detail here but here are the basics for someone new to this self-hosted world.
+I won't go into too much detail here, but here are the basics for someone new to this self-hosted world.

 1. Your home router will have a Port Forwarding section somewhere. Log in and find it
-2. Add port forwarding for port 80 and 443 to the server hosting this project
+2. Add port forwarding for ports 80 and 443 to the server hosting this project
 3. Configure your domain name details to point to your home, either with a static ip or a service like
   - DuckDNS
   - [Amazon Route53](https://github.com/jc21/route53-ddns)
   - [Cloudflare](https://github.com/jc21/cloudflare-ddns)
-4. Use the Nginx Proxy Manager as your gateway to forward to your other web based services
+4. Use the Nginx Proxy Manager as your gateway to forward to your other web-based services

 ## Quick Setup

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest stable release receives security updates.
+Older versions are not actively maintained.
+
+| Version | Supported |
+| ------- | --------- |
+| 2.15.x (latest) | :white_check_mark: |
+| < 2.15.0 | :x: |
+
+Docker images: `jc21/nginx-proxy-manager:latest`, `jc21/nginx-proxy-manager:2`
+
+See all releases: https://github.com/NginxProxyManager/nginx-proxy-manager/releases
+
+## Reporting a Vulnerability
+
+**Do NOT open a public GitHub Issue to report a security vulnerability.**
+
+Use GitHub's private vulnerability reporting:
+https://github.com/NginxProxyManager/nginx-proxy-manager/security/advisories/new
+
+Please include:
+- Affected version (Docker image tag or release)
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+Once a fix is available, a public GitHub Security Advisory will be published.
@@ -62,7 +62,7 @@ app.use("/", mainRoutes);
 app.use((err, req, res, _) => {
 	const payload = {
 		error: {
-			code: err.status,
+			code: err.status || 500,
 			message: err.public ? err.message : "Internal Error",
 		},
 	};
@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.4.5/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.4.15/schema.json",
    "vcs": {
        "enabled": true,
        "clientKind": "git",
@@ -133,7 +133,7 @@
 		"full_plugin_name": "dns-desec",
 		"name": "deSEC",
 		"package_name": "certbot-dns-desec",
-		"version": "~=1.2.1"
+		"version": "~=1.3.2"
 	},
 	"digitalocean": {
 		"credentials": "dns_digitalocean_token = 0000111122223333444455556666777788889999aaaabbbbccccddddeeeeffff",
@@ -232,12 +232,12 @@
 		"version": "~=0.1.0"
 	},
 	"eurodns": {
-		"credentials": "dns_eurodns_applicationId = myuser\ndns_eurodns_apiKey = mysecretpassword\ndns_eurodns_endpoint = https://rest-api.eurodns.com/user-api-gateway/proxy",
+		"credentials": "dns_eurodns_applicationId = myuser\ndns_eurodns_apiKey = mysecretpassword\ndns_eurodns_endpoint = https://rest-api.eurodns.com/dns-zones/",
 		"dependencies": "",
 		"full_plugin_name": "dns-eurodns",
 		"name": "EuroDNS",
 		"package_name": "certbot-dns-eurodns",
-		"version": "~=0.0.4"
+		"version": "~=1.8.2"
 	},
 	"firstdomains": {
 		"credentials": "dns_firstdomains_username = myremoteuser\ndns_firstdomains_password = verysecureremoteuserpassword",
@@ -335,6 +335,14 @@
 		"package_name": "certbot-dns-hetzner-cloud",
 		"version": "~=1.0.4"
 	},
+	"hostinger": {
+		"credentials": "dns_hostinger_api_token = 0123456789abcdef0123456789abcdef",
+		"dependencies": "",
+		"full_plugin_name": "dns-hostinger",
+		"name": "Hostinger.com",
+		"package_name": "certbot-dns-hostinger",
+		"version": "~=0.1.3"
+	},
 	"hostingnl": {
 		"credentials": "dns_hostingnl_api_key = 0123456789abcdef0123456789abcdef",
 		"dependencies": "",
@@ -351,6 +359,14 @@
 		"package_name": "certbot-dns-hover",
 		"version": "~=1.2.1"
 	},
+	"hosterby": {
+  		"credentials": "dns_hosterby_access_key = YOUR_ACCESS_KEY\ndns_hosterby_secret_key = YOUR_SECRET_KEY",
+  		"dependencies": "",
+  		"full_plugin_name": "dns-hosterby",
+  		"name": "hoster.by",
+  		"package_name": "certbot-dns-hosterby",
+  		"version": "~=0.1.0"
+	},
 	"infomaniak": {
 		"credentials": "dns_infomaniak_token = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
 		"dependencies": "",
@@ -537,7 +553,7 @@
 	},
 	"powerdns": {
 		"credentials": "dns_powerdns_api_url = https://api.mypowerdns.example.org\ndns_powerdns_api_key = AbCbASsd!@34",
-		"dependencies": "PyYAML==5.3.1",
+		"dependencies": "acme=={{certbot-version}}",
 		"full_plugin_name": "dns-powerdns",
 		"name": "PowerDNS",
 		"package_name": "certbot-dns-powerdns",
@@ -662,5 +678,13 @@
 		"name": "ZoneEdit",
 		"package_name": "certbot-dns-zoneedit",
 		"version": "~=0.3.2"
+	},
+		"rcode0": {
+		"credentials": "dns_rcode0_api_key = acme_0123456789abcdef0123456789abcdef01234567",
+		"dependencies": "",
+		"full_plugin_name": "dns-rcode0",
+		"name": "RcodeZero",
+		"package_name": "certbot-dns-rcode0",
+		"version": "~=0.0.0.2"
 	}
 }
@@ -48,20 +48,17 @@ const internalAccessList = {
 			return true;
 		});

-		// Clients
-		data.clients?.map((client) => {
-			promises.push(
-				accessListClientModel.query().insert({
-					access_list_id: row.id,
-					address: client.address,
-					directive: client.directive,
-				}),
-			);
-			return true;
-		});
-
 		await Promise.all(promises);

+		// Clients
+		for (const client of data.clients ?? []) {
+			await accessListClientModel.query().insert({
+				access_list_id: row.id,
+				address: client.address,
+				directive: client.directive,
+			});
+		}
+
 		// re-fetch with expansions
 		const freshRow = await internalAccessList.get(
 			access,
@@ -154,25 +151,17 @@ const internalAccessList = {

 		// Check for clients and add/update/remove them
 		if (typeof data.clients !== "undefined" && data.clients) {
-			const clientPromises = [];
-			data.clients.map((client) => {
-				if (client.address) {
-					clientPromises.push(
-						accessListClientModel.query().insert({
-							access_list_id: data.id,
-							address: client.address,
-							directive: client.directive,
-						}),
-					);
-				}
-				return true;
-			});
-
 			const query = accessListClientModel.query().delete().where("access_list_id", data.id);
 			await query;
-			// Add new clitens
-			if (clientPromises.length) {
-				await Promise.all(clientPromises);
+
+			for (const client of data.clients) {
+				if (client.address) {
+					await accessListClientModel.query().insert({
+						access_list_id: data.id,
+						address: client.address,
+						directive: client.directive,
+					});
+				}
 			}
 		}

@@ -241,7 +230,7 @@ const internalAccessList = {

 		let row = await query.then(utils.omitRow(omissions()));

-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(thisData.id);
 		}
 		if (!skipMasking && typeof row.items !== "undefined" && row.items) {
@@ -268,7 +257,7 @@ const internalAccessList = {
 			expand: ["proxy_hosts", "items", "clients"],
 		});

-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import https from "node:https";
 import path from "path";
-import archiver from "archiver";
+import { ZipArchive } from "archiver";
 import _ from "lodash";
 import moment from "moment";
 import { ProxyAgent } from "proxy-agent";
@@ -66,7 +66,7 @@ const internalCertificate = {
 				.andWhere("provider", "letsencrypt")
 				.andWhere("expires_on", "<", expirationThreshold)
 				.then((certificates) => {
-					if (!certificates || !certificates.length) {
+					if (!certificates?.length) {
 						return null;
 					}

@@ -143,7 +143,7 @@ const internalCertificate = {
 				await internalCertificate.disableInUseHosts(inUseResult);

 				const user = await userModel.query().where("is_deleted", 0).andWhere("id", data.owner_user_id).first();
-				if (!user || !user.email) {
+				if (!user?.email) {
 					throw new error.ValidationError(
 						"A valid email address must be set on your user account to use Let's Encrypt",
 					);
@@ -305,7 +305,7 @@ const internalCertificate = {
 		}

 		const row = await query.then(utils.omitRow(omissions()));
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new error.ItemNotFoundError(data.id);
 		}
 		// Custom omissions
@@ -370,7 +370,7 @@ const internalCertificate = {
 	 * @returns {Promise}
 	 */
 	zipFiles: async (source, out) => {
-		const archive = archiver("zip", { zlib: { level: 9 } });
+		const archive = new ZipArchive({ zlib: { level: 9 } });
 		const stream = fs.createWriteStream(out);

 		return new Promise((resolve, reject) => {
@@ -397,7 +397,7 @@ const internalCertificate = {
 		await access.can("certificates:delete", data.id);
 		const row = await internalCertificate.get(access, { id: data.id });

-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new error.ItemNotFoundError(data.id);
 		}

@@ -614,7 +614,7 @@ const internalCertificate = {
 		const certificate = await internalCertificate.update(access, {
 			id: data.id,
 			expires_on: moment(validations.certificate.dates.to, "X").format("YYYY-MM-DD HH:mm:ss"),
-			domain_names: [validations.certificate.cn],
+			domain_names: validations.certificate.cn ? [validations.certificate.cn] : [],
 			meta: _.clone(row.meta), // Prevent the update method from changing this value that we'll use later
 		});

@@ -683,13 +683,15 @@ const internalCertificate = {

 		try {
 			const result = await utils.execFile("openssl", ["x509", "-in", certificateFile, "-subject", "-noout"]);
+
 			// Examples:
 			// subject=CN = *.jc21.com
 			// subject=CN = something.example.com
-			const regex = /(?:subject=)?[^=]+=\s+(\S+)/gim;
+			// subject=CN=*.jc21.com
+			const regex = /(?:subject=)?[^=]+=\s*(\S+)/gim;
 			const match = regex.exec(result);
 			if (match && typeof match[1] !== "undefined") {
-				certData.cn = match[1];
+				certData.cn = match[1].trim();
 			}

 			const result2 = await utils.execFile("openssl", ["x509", "-in", certificateFile, "-issuer", "-noout"]);
@@ -779,6 +781,7 @@ const internalCertificate = {

 		const args = [
 			"certonly",
+			"-n", // non-interactive
 			"--config",
 			letsencryptConfig,
 			"--work-dir",
@@ -834,6 +837,7 @@ const internalCertificate = {

 		const args = [
 			"certonly",
+			"-n", // non-interactive
 			"--config",
 			letsencryptConfig,
 			"--work-dir",
@@ -206,7 +206,7 @@ const internalDeadHost = {
 		}

 		const row = await query.then(utils.omitRow(omissions()));
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 		// Custom omissions
@@ -226,7 +226,7 @@ const internalDeadHost = {
 	delete: async (access, data) => {
 		await access.can("dead_hosts:delete", data.id)
 		const row = await internalDeadHost.get(access, { id: data.id });
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}

@@ -264,7 +264,7 @@ const internalDeadHost = {
 			id: data.id,
 			expand: ["certificate", "owner"],
 		});
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 		if (row.enabled) {
@@ -303,7 +303,7 @@ const internalDeadHost = {
 	disable: async (access, data) => {
 		await access.can("dead_hosts:update", data.id)
 		const row = await internalDeadHost.get(access, { id: data.id });
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 		if (!row.enabled) {
@@ -253,7 +253,7 @@ const internalProxyHost = {
 				return query.then(utils.omitRow(omissions()));
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				const thisRow = internalHost.cleanRowCertificateMeta(row);
@@ -279,7 +279,7 @@ const internalProxyHost = {
 				return internalProxyHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}

@@ -327,7 +327,7 @@ const internalProxyHost = {
 				});
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (row.enabled) {
@@ -375,7 +375,7 @@ const internalProxyHost = {
 				return internalProxyHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (!row.enabled) {
@@ -251,7 +251,7 @@ const internalRedirectionHost = {
 			})
 			.then((row) => {
 				let thisRow = row;
-				if (!thisRow || !thisRow.id) {
+				if (!thisRow?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				thisRow = internalHost.cleanRowCertificateMeta(thisRow);
@@ -277,7 +277,7 @@ const internalRedirectionHost = {
 				return internalRedirectionHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}

@@ -325,7 +325,7 @@ const internalRedirectionHost = {
 				});
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (row.enabled) {
@@ -373,7 +373,7 @@ const internalRedirectionHost = {
 				return internalRedirectionHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (!row.enabled) {
@@ -200,7 +200,7 @@ const internalStream = {
 			})
 			.then((row) => {
 				let thisRow = row;
-				if (!thisRow || !thisRow.id) {
+				if (!thisRow?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				thisRow = internalHost.cleanRowCertificateMeta(thisRow);
@@ -226,7 +226,7 @@ const internalStream = {
 				return internalStream.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}

@@ -274,7 +274,7 @@ const internalStream = {
 				});
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (row.enabled) {
@@ -322,7 +322,7 @@ const internalStream = {
 				return internalStream.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (!row.enabled) {
@@ -87,7 +87,13 @@ const internalUser = {
 		}

 		return access
-			.can("users:update", data.id)
+			.can("users:permissions", data.id)
+			.catch(() => {
+				delete data.roles;
+			})
+			.then(() => {
+				return access.can("users:update", data.id);
+			})
 			.then(() => {
 				// Make sure that the user being updated doesn't change their email to another user that is already using it
 				// 1. get user we want to update
@@ -171,7 +177,7 @@ const internalUser = {
 				return query.then(utils.omitRow(omissions()));
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				// Custom omissions
@@ -4,8 +4,6 @@ import { certbot as logger } from "../logger.js";
 import errs from "./error.js";
 import utils from "./utils.js";

-const CERTBOT_VERSION_REPLACEMENT = "$(certbot --version | grep -Eo '[0-9](\\.[0-9]+)+')";
-
 /**
 * Installs a cerbot plugin given the key for the object from
 * ../certbot/dns-plugins.json
@@ -15,24 +13,32 @@ const CERTBOT_VERSION_REPLACEMENT = "$(certbot --version | grep -Eo '[0-9](\\.[0
 */
 const installPlugin = async (pluginKey) => {
 	if (typeof dnsPlugins[pluginKey] === "undefined") {
-		// throw Error(`Certbot plugin ${pluginKey} not found`);
 		throw new errs.ItemNotFoundError(pluginKey);
 	}

 	const plugin = dnsPlugins[pluginKey];
 	logger.start(`Installing ${pluginKey}...`);

-	plugin.version = plugin.version.replace(/{{certbot-version}}/g, CERTBOT_VERSION_REPLACEMENT);
-	plugin.dependencies = plugin.dependencies.replace(/{{certbot-version}}/g, CERTBOT_VERSION_REPLACEMENT);
+	plugin.version = plugin.version.replace(/{{certbot-version}}/g, process.env.CERTBOT_VERSION);
+	plugin.dependencies = plugin.dependencies.replace(/{{certbot-version}}/g, process.env.CERTBOT_VERSION);

-	// SETUPTOOLS_USE_DISTUTILS is required for certbot plugins to install correctly
-	// in new versions of Python
-	let env = Object.assign({}, process.env, { SETUPTOOLS_USE_DISTUTILS: "stdlib" });
+	// SETUPTOOLS_USE_DISTUTILS=local uses setuptools' own bundled distutils.
+	// "stdlib" breaks Python 3.13+ where distutils was removed from the standard library.
+	let env = Object.assign({}, process.env, { SETUPTOOLS_USE_DISTUTILS: "local" });
 	if (typeof plugin.env === "object") {
 		env = Object.assign(env, plugin.env);
 	}

-	const cmd = `. /opt/certbot/bin/activate && pip install --no-cache-dir ${plugin.dependencies} ${plugin.package_name}${plugin.version}  && deactivate`;
+	const quotedDeps = plugin.dependencies.trim()
+		? plugin.dependencies
+				.trim()
+				.split(/\s+/)
+				.filter(Boolean)
+				.map((d) => `'${d}'`)
+				.join(" ")
+		: "";
+
+	const cmd = `. /opt/certbot/bin/activate && pip install --no-cache-dir ${quotedDeps} '${plugin.package_name}${plugin.version}' && deactivate`;
 	return utils
 		.exec(cmd, { env })
 		.then((result) => {
@@ -73,9 +79,7 @@ const installPlugins = async (pluginKeys) => {
 			})
 			.end(() => {
 				if (hasErrors) {
-					reject(
-						new errs.CommandError("Some plugins failed to install. Please check the logs above", 1),
-					);
+					reject(new errs.CommandError("Some plugins failed to install. Please check the logs above", 1));
 				} else {
 					resolve();
 				}
@@ -83,4 +87,4 @@ const installPlugins = async (pluginKeys) => {
 	});
 };

-export { installPlugins, installPlugin };
+export { installPlugin, installPlugins };
@@ -211,7 +211,7 @@ const isPostgres = () => {
 };

 /**
- * Are we running in debug mdoe?
+ * Are we running in debug mode?
 *
 * @returns {boolean}
 */
@@ -3,7 +3,7 @@ export default (req, res, next) => {
 		res.set({
 			"Access-Control-Allow-Origin": req.headers.origin,
 			"Access-Control-Allow-Credentials": true,
-			"Access-Control-Allow-Methods": "OPTIONS, GET, POST",
+			"Access-Control-Allow-Methods": "OPTIONS, GET, POST, PUT, DELETE",
 			"Access-Control-Allow-Headers":
 				"Content-Type, Cache-Control, Pragma, Expires, Authorization, X-Dataset-Total, X-Dataset-Offset, X-Dataset-Limit",
 			"Access-Control-Max-Age": 5 * 60,
@@ -0,0 +1,7 @@
+import chalk from "chalk";
+import { debug, express as logger } from "../../logger.js";
+
+export default (req, _res, next) => {
+	debug(logger, `[${chalk.yellow(req.method.toUpperCase())}] ${chalk.green(req.path)}`);
+	next();
+};
@@ -3,14 +3,12 @@ import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Liquid } from "liquidjs";
 import _ from "lodash";
-import { debug, global as logger } from "../logger.js";
 import errs from "./error.js";

 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

 const exec = async (cmd, options = {}) => {
-	debug(logger, "CMD:", cmd);
 	const { stdout, stderr } = await new Promise((resolve, reject) => {
 		const child = nodeExec(cmd, options, (isError, stdout, stderr) => {
 			if (isError) {
@@ -34,7 +32,6 @@ const exec = async (cmd, options = {}) => {
 * @returns {Promise}
 */
 const execFile = (cmd, args, options) => {
-	debug(logger, `CMD: ${cmd} ${args ? args.join(" ") : ""}`);
 	const opts = options || {};

 	return new Promise((resolve, reject) => {
@@ -10,7 +10,7 @@ const migrateName = "trust_forwarded_proto";
 * @param   {Object} knex
 * @returns {Promise}
 */
-const up = function (knex) {
+const up = (knex) => {
    logger.info(`[${migrateName}] Migrating Up...`);

    return knex.schema
@@ -28,7 +28,7 @@ const up = function (knex) {
 * @param   {Object} knex
 * @returns {Promise}
 */
-const down = function (knex) {
+const down = (knex) => {
    logger.info(`[${migrateName}] Migrating Down...`);

    return knex.schema
@@ -15,6 +15,16 @@ Model.knex(db());

 const boolFields = ["is_deleted"];

+const cleanDomainNames = (domainNames) => {
+	// Sort domain_names
+	if (typeof domainNames !== "undefined") {
+		const newDomainNames = domainNames.filter((name) => name != null);
+		newDomainNames.sort();
+		return newDomainNames;
+	}
+	return [];
+};
+
 class Certificate extends Model {
 	$beforeInsert() {
 		this.created_on = now();
@@ -26,7 +36,9 @@ class Certificate extends Model {
 		}

 		// Default for domain_names
-		if (typeof this.domain_names === "undefined") {
+		if (typeof this.domain_names !== "undefined") {
+			this.domain_names = cleanDomainNames(this.domain_names);
+		} else {
 			this.domain_names = [];
 		}

@@ -34,16 +46,12 @@ class Certificate extends Model {
 		if (typeof this.meta === "undefined") {
 			this.meta = {};
 		}
-
-		this.domain_names.sort();
 	}

 	$beforeUpdate() {
 		this.modified_on = now();
-
-		// Sort domain_names
 		if (typeof this.domain_names !== "undefined") {
-			this.domain_names.sort();
+			this.domain_names = cleanDomainNames(this.domain_names);
 		}
 	}

@@ -13,37 +13,37 @@
 		"regenerate-config": "node scripts/regenerate-config"
 	},
 	"dependencies": {
-		"@apidevtools/json-schema-ref-parser": "^15.3.1",
-		"ajv": "^8.18.0",
-		"archiver": "^7.0.1",
+		"@apidevtools/json-schema-ref-parser": "^15.3.5",
+		"ajv": "^8.20.0",
+		"archiver": "^8.0.0",
 		"batchflow": "^0.4.0",
 		"bcrypt": "^6.0.0",
-		"better-sqlite3": "^12.6.2",
+		"better-sqlite3": "^12.10.0",
 		"body-parser": "^2.2.2",
+		"chalk": "5.6.2",
 		"compression": "^1.8.1",
 		"express": "^5.2.1",
 		"express-fileupload": "^1.5.2",
 		"gravatar": "^1.8.2",
 		"jsonwebtoken": "^9.0.3",
-		"knex": "3.1.0",
-		"liquidjs": "10.24.0",
-		"lodash": "^4.17.23",
+		"knex": "3.2.10",
+		"liquidjs": "10.27.0",
+		"lodash": "^4.18.1",
 		"moment": "^2.30.1",
-		"mysql2": "^3.18.2",
+		"mysql2": "^3.22.3",
 		"node-rsa": "^1.1.1",
 		"objection": "3.1.5",
-		"otplib": "^13.3.0",
+		"otplib": "^13.4.0",
 		"path": "^0.12.7",
-		"pg": "^8.19.0",
-		"proxy-agent": "^6.5.0",
+		"pg": "^8.21.0",
+		"proxy-agent": "^8.0.1",
 		"signale": "1.4.0",
-		"sqlite3": "^5.1.7",
+		"sqlite3": "^6.0.1",
 		"temp-write": "^6.0.1"
 	},
 	"devDependencies": {
 		"@apidevtools/swagger-parser": "^12.1.0",
-		"@biomejs/biome": "^2.4.5",
-		"chalk": "5.6.2",
+		"@biomejs/biome": "^2.4.15",
 		"nodemon": "^3.1.14"
 	},
 	"signale": {
@@ -0,0 +1,59 @@
+import express from "express";
+import dnsPlugins from "../certbot/dns-plugins.json" with { type: "json" };
+import { installPlugin } from "../lib/certbot.js";
+import { debug, express as logger } from "../logger.js";
+
+const router = express.Router({
+	caseSensitive: true,
+	strict: true,
+	mergeParams: true,
+});
+
+/**
+ * ONLY AVAILABLE IN CI ENVIRONMENT!
+ */
+
+/**
+ * /api/ci/certbot-plugins
+ */
+router
+	.route("/certbot-plugins")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+
+	// Return all certbot plugins
+	.get(async (_req, res, _next) => {
+		res.status(200).send(dnsPlugins);
+	});
+
+/**
+ * /api/ci/certbot-plugins/{plugin}
+ */
+router
+	.route("/certbot-plugins/:plugin")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+
+	// Install a certbot plugin
+	.post(async (req, res, next) => {
+		try {
+			const pluginName = req.params.plugin;
+			// check if plugin exists
+			if (!dnsPlugins[pluginName]) {
+				return res.status(404).send({
+					error: "Plugin not found",
+				});
+			}
+
+			await installPlugin(pluginName);
+			res.status(200).send(true);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+		return;
+	});
+
+export default router;
@@ -1,8 +1,11 @@
 import express from "express";
+import { isCI } from "../lib/config.js";
 import errs from "../lib/error.js";
+import logRequest from "../lib/express/log-request.js";
 import pjson from "../package.json" with { type: "json" };
 import { isSetup } from "../setup.js";
 import auditLogRoutes from "./audit-log.js";
+import ciRoutes from "./ci.js";
 import accessListsRoutes from "./nginx/access_lists.js";
 import certificatesHostsRoutes from "./nginx/certificates.js";
 import deadHostsRoutes from "./nginx/dead_hosts.js";
@@ -22,6 +25,8 @@ const router = express.Router({
 	mergeParams: true,
 });

+router.use(logRequest);
+
 /**
 * Health Check
 * GET /api
@@ -55,6 +60,11 @@ router.use("/nginx/streams", streamsRoutes);
 router.use("/nginx/access-lists", accessListsRoutes);
 router.use("/nginx/certificates", certificatesHostsRoutes);

+// Only include CI routes if we're in a CI environment
+if (isCI()) {
+	router.use("/ci", ciRoutes);
+}
+
 /**
 * API 404 for all other routes
 *
@@ -18,7 +18,7 @@ router
 	/**
 	 * GET /schema
 	 */
-	.get(async (req, res) => {
+	.get(async (req, res, next) => {
 		try {
 			const swaggerJSON = await getCompiledSchema();

@@ -10,11 +10,13 @@

    {% endif %}

+    {% if access_list.clients.length > 0 %}
    # Access Rules: {{ access_list.clients | size }} total
    {% for client in access_list.clients %}
    {{client | nginxAccessRule}}
    {% endfor %}
    deny all;
+    {% endif %}

    # Access checks must...
    {% if access_list.satisfy_any == 1 or access_list.satisfy_any == true %}
@@ -5,8 +5,8 @@
 {% if enabled %}
 {% if tcp_forwarding == 1 or tcp_forwarding == true -%}
 server {
-  listen {{ incoming_port }} {%- if certificate %} ssl {%- endif %};
-  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} {%- if certificate %} ssl {%- endif %};
+  listen {{ incoming_port }} reuseport {%- if certificate %} ssl {%- endif %};
+  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} reuseport {%- if certificate %} ssl {%- endif %};

  {%- include "_certificates_stream.conf" %}

@@ -23,8 +23,8 @@ server {

 {% if udp_forwarding == 1 or udp_forwarding == true -%}
 server {
-  listen {{ incoming_port }} udp;
-  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} udp;
+  listen {{ incoming_port }} udp reuseport;
+  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} udp reuseport;

  proxy_pass {{ forwarding_host }}:{{ forwarding_port }};

@@ -3,8 +3,9 @@

 # This file assumes that the frontend has been built using ./scripts/frontend-build

+ARG BASE_IMAGE=nginxproxymanager/nginx-full:certbot-node
 FROM nginxproxymanager/testca AS testca
-FROM nginxproxymanager/nginx-full:certbot-node
+FROM $BASE_IMAGE

 ARG TARGETPLATFORM
 ARG BUILD_VERSION
@@ -38,15 +39,17 @@ EXPOSE 80 81 443

 COPY backend       /app
 COPY frontend/dist /app/frontend
+COPY docker/rootfs /
+
+# Copy test CA cert for use in container and add to trusted certs from a self-signed CA
+COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager.crt
+WORKDIR /etc/ssl/certs
+RUN ln -s NginxProxyManager.crt 1d0e3f10.0 && update-ca-certificates

 WORKDIR /app
 RUN yarn install \
 	&& yarn cache clean

-# add late to limit cache-busting by modifications
-COPY docker/rootfs /
-COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager.crt
-
 # Remove frontend service not required for prod, dev nginx config as well
 RUN rm -rf /etc/s6-overlay/s6-rc.d/user/contents.d/frontend /etc/nginx/conf.d/dev.conf \
 	&& chmod 644 /etc/logrotate.d/nginx-proxy-manager
@@ -20,10 +20,10 @@ RUN echo "fs.file-max = 65535" > /etc/sysctl.conf \

 # Task
 WORKDIR /usr
-RUN curl -sL https://taskfile.dev/install.sh | sh
-WORKDIR /root
+RUN curl -sL 'https://taskfile.dev/install.sh' | sh

 COPY rootfs /
+
 COPY scripts/install-s6 /tmp/install-s6
 RUN rm -f /etc/nginx/conf.d/production.conf \
 	&& chmod 644 /etc/logrotate.d/nginx-proxy-manager \
@@ -31,8 +31,12 @@ RUN rm -f /etc/nginx/conf.d/production.conf \
 	&& rm -f /tmp/install-s6 \
 	&& chmod 644 -R /root/.cache

-# Certs for testing purposes
+# Copy test CA cert for use in container and add to trusted certs from a self-signed CA
 COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager.crt
+WORKDIR /etc/ssl/certs
+RUN ln -s NginxProxyManager.crt 1d0e3f10.0 && update-ca-certificates
+
+WORKDIR /root

 EXPOSE 80 81 443
 ENTRYPOINT [ "/init" ]
@@ -0,0 +1,13 @@
+# WARNING: This is a CI docker-compose file used for building and testing of the entire app, it should not be used for production.
+services:
+  cypress:
+    environment:
+      CYPRESS_stack: "sqlite"
+    command: cypress run --browser chrome --config-file=cypress/config/ci.mjs --expose grepTags="@isolated"
+
+  fullstack:
+    environment:
+      DB_SQLITE_FILE: "/data/mydb.sqlite"
+      PUID: 1000
+      PGID: 1000
+      DISABLE_IPV6: "true"
@@ -1,9 +1,12 @@
 # WARNING: This is a CI docker-compose file used for building and testing of the entire app, it should not be used for production.
 services:
+  cypress:
+    environment:
+      CYPRESS_stack: "sqlite"

  fullstack:
    environment:
-      DB_SQLITE_FILE: '/data/mydb.sqlite'
+      DB_SQLITE_FILE: "/data/mydb.sqlite"
      PUID: 1000
      PGID: 1000
-      DISABLE_IPV6: 'true'
+      DISABLE_IPV6: "true"
@@ -39,7 +39,7 @@ services:
          - website3.example.com

  stepca:
-    image: jc21/testca
+    image: nginxproxymanager/testca
    volumes:
      - "./dev/resolv.conf:/etc/resolv.conf:ro"
      - "/etc/localtime:/etc/localtime:ro"
@@ -109,7 +109,7 @@ services:
      - "cypress_logs:/test/results"
      - "./dev/resolv.conf:/etc/resolv.conf:ro"
      - "/etc/localtime:/etc/localtime:ro"
-    command: cypress run --browser chrome --config-file=cypress/config/ci.mjs
+    command: cypress run --browser chrome --config-file=cypress/config/ci.mjs --expose grepTags="-@isolated"
    networks:
      - fulltest

@@ -94,7 +94,7 @@ services:
          - pgdb.internal

  stepca:
-    image: jc21/testca
+    image: nginxproxymanager/testca
    container_name: npm2dev.stepca
    volumes:
      - "./dev/resolv.conf:/etc/resolv.conf:ro"
@@ -11,11 +11,11 @@ log_info 'Starting backend ...'

 if [ "${DEVELOPMENT:-}" = 'true' ]; then
 	s6-setuidgid "$PUID:$PGID" yarn install
-	exec s6-setuidgid "$PUID:$PGID" bash -c "export HOME=$NPMHOME;node --max_old_space_size=250 --abort_on_uncaught_exception node_modules/nodemon/bin/nodemon.js"
+	exec s6-setuidgid "$PUID:$PGID" bash -c "export HOME=$NPMHOME;export CERTBOT_VERSION=$CERTBOT_VERSION;node --max_old_space_size=250 --abort_on_uncaught_exception node_modules/nodemon/bin/nodemon.js"
 else
 	while :
 	do
-		s6-setuidgid "$PUID:$PGID" bash -c "export HOME=$NPMHOME;node --abort_on_uncaught_exception --max_old_space_size=250 index.js"
+		s6-setuidgid "$PUID:$PGID" bash -c "export HOME=$NPMHOME;export CERTBOT_VERSION=$CERTBOT_VERSION;node --abort_on_uncaught_exception --max_old_space_size=250 index.js"
 		sleep 1
 	done
 fi
@@ -8,6 +8,10 @@ set -e

 log_info 'IPv6 ...'

+is_mounted() {
+	awk -v p="$1" '$5 == p { found=1 } END { exit !found }' /proc/self/mountinfo
+}
+
 process_folder () {
 	FILES=$(find "$1" -type f -name "*.conf")
 	SED_REGEX=
@@ -26,7 +30,10 @@ process_folder () {
 	do
 		echo "- ${FILE}"
 		TMPFILE="${FILE}.tmp"
-		if sed -E "$SED_REGEX" "$FILE" > "$TMPFILE" && [ -s "$TMPFILE" ]; then
+
+		if is_mounted "${FILE}"; then
+			echo "WARNING: skipping ${FILE} — mounted file" >&2
+		elif sed -E "$SED_REGEX" "$FILE" > "$TMPFILE" && [ -s "$TMPFILE" ]; then
 			mv "$TMPFILE" "$FILE"
 		else
 			echo "WARNING: skipping ${FILE} — sed produced empty output" >&2
@@ -21,6 +21,10 @@ NPMGROUP=npm
 NPMHOME=/tmp/npmuserhome
 export NPMUSER NPMGROUP NPMHOME

+# Query the certbot version just once and use it elsewhere
+CERTBOT_VERSION="$(certbot --version | grep -Eo '[0-9](\.[0-9]+)+')"
+export CERTBOT_VERSION
+
 if [[ "$PUID" -ne '0' ]] && [ "$PGID" = '0' ]; then
 	# set group id to same as user id,
 	# the user probably forgot to specify the group id and
@@ -8,7 +8,7 @@ BLUE='\E[1;34m'
 GREEN='\E[1;32m'
 RESET='\E[0m'

-S6_OVERLAY_VERSION=3.2.1.0
+S6_OVERLAY_VERSION=3.2.3.0
 TARGETPLATFORM=${1:-linux/amd64}

 # Determine the correct binary file for the architecture given
@@ -1,4 +1,4 @@
-import { defineConfig, type DefaultTheme } from 'vitepress';
+import { defineConfig } from "vitepress";

 // https://vitepress.dev/reference/site-config
 export default defineConfig({
@@ -6,56 +6,101 @@ export default defineConfig({
 	description: "Expose your services easily and securely",
 	head: [
 		["link", { rel: "icon", href: "/icon.png" }],
-		["meta", { name: "description", content: "Docker container and built in Web Application for managing Nginx proxy hosts with a simple, powerful interface, providing free SSL support via Let's Encrypt" }],
+		[
+			"meta",
+			{
+				name: "description",
+				content:
+					"Docker container and built in Web Application for managing Nginx proxy hosts with a simple, powerful interface, providing free SSL support via Let's Encrypt",
+			},
+		],
 		["meta", { property: "og:title", content: "Nginx Proxy Manager" }],
-		["meta", { property: "og:description", content: "Docker container and built in Web Application for managing Nginx proxy hosts with a simple, powerful interface, providing free SSL support via Let's Encrypt"}],
+		[
+			"meta",
+			{
+				property: "og:description",
+				content:
+					"Docker container and built in Web Application for managing Nginx proxy hosts with a simple, powerful interface, providing free SSL support via Let's Encrypt",
+			},
+		],
 		["meta", { property: "og:type", content: "website" }],
 		["meta", { property: "og:url", content: "https://nginxproxymanager.com/" }],
-		["meta", { property: "og:image", content: "https://nginxproxymanager.com/icon.png" }],
-		["meta", { name: "twitter:card", content: "summary"}],
-		["meta", { name: "twitter:title", content: "Nginx Proxy Manager"}],
-		["meta", { name: "twitter:description", content: "Docker container and built in Web Application for managing Nginx proxy hosts with a simple, powerful interface, providing free SSL support via Let's Encrypt"}],
-		["meta", { name: "twitter:image", content: "https://nginxproxymanager.com/icon.png"}],
-		["meta", { name: "twitter:alt", content: "Nginx Proxy Manager"}],
+		[
+			"meta",
+			{
+				property: "og:image",
+				content: "https://nginxproxymanager.com/icon.png",
+			},
+		],
+		["meta", { name: "twitter:card", content: "summary" }],
+		["meta", { name: "twitter:title", content: "Nginx Proxy Manager" }],
+		[
+			"meta",
+			{
+				name: "twitter:description",
+				content:
+					"Docker container and built in Web Application for managing Nginx proxy hosts with a simple, powerful interface, providing free SSL support via Let's Encrypt",
+			},
+		],
+		[
+			"meta",
+			{
+				name: "twitter:image",
+				content: "https://nginxproxymanager.com/icon.png",
+			},
+		],
+		["meta", { name: "twitter:alt", content: "Nginx Proxy Manager" }],
 		// GA
-		['script', { async: 'true', src: 'https://www.googletagmanager.com/gtag/js?id=G-TXT8F5WY5B'}],
-		['script', {}, "window.dataLayer = window.dataLayer || [];\nfunction gtag(){dataLayer.push(arguments);}\ngtag('js', new Date());\ngtag('config', 'G-TXT8F5WY5B');"],
+		[
+			"script",
+			{
+				async: "true",
+				src: "https://www.googletagmanager.com/gtag/js?id=G-TXT8F5WY5B",
+			},
+		],
+		[
+			"script",
+			{},
+			"window.dataLayer = window.dataLayer || [];\nfunction gtag(){dataLayer.push(arguments);}\ngtag('js', new Date());\ngtag('config', 'G-TXT8F5WY5B');",
+		],
 	],
 	sitemap: {
-		hostname: 'https://nginxproxymanager.com'
+		hostname: "https://nginxproxymanager.com",
 	},
 	metaChunk: true,
-	srcDir: './src',
-	outDir: './dist',
+	srcDir: "./src",
+	outDir: "./dist",
 	themeConfig: {
 		// https://vitepress.dev/reference/default-theme-config
-		logo: { src: '/logo.svg', width: 24, height: 24 },
-		nav: [
-			{ text: 'Setup', link: '/setup/' },
-		],
+		logo: { src: "/logo.svg", width: 24, height: 24 },
+		nav: [{ text: "Setup", link: "/setup/" }],
 		sidebar: [
 			{
 				items: [
 					// { text: 'Home', link: '/' },
-					{ text: 'Guide', link: '/guide/' },
-					{ text: 'Screenshots', link: '/screenshots/' },
-					{ text: 'Setup Instructions', link: '/setup/' },
-					{ text: 'Advanced Configuration', link: '/advanced-config/' },
-					{ text: 'Upgrading', link: '/upgrading/' },
-					{ text: 'Frequently Asked Questions', link: '/faq/' },
-					{ text: 'Third Party', link: '/third-party/' },
-				]
-			}
+					{ text: "Guide", link: "/guide/" },
+					{ text: "Screenshots", link: "/screenshots/" },
+					{ text: "Setup Instructions", link: "/setup/" },
+					{ text: "Advanced Configuration", link: "/advanced-config/" },
+					{ text: "Upgrading", link: "/upgrading/" },
+					{ text: "Frequently Asked Questions", link: "/faq/" },
+					{ text: "Certbot", link: "/certbot/" },
+					{ text: "Third Party", link: "/third-party/" },
+				],
+			},
 		],
 		socialLinks: [
-			{ icon: 'github', link: 'https://github.com/NginxProxyManager/nginx-proxy-manager' }
+			{
+				icon: "github",
+				link: "https://github.com/NginxProxyManager/nginx-proxy-manager",
+			},
 		],
 		search: {
-			provider: 'local'
+			provider: "local",
 		},
 		footer: {
-			message: 'Released under the MIT License.',
-			copyright: 'Copyright © 2016-present jc21.com'
-		}
-	}
+			message: "Released under the MIT License.",
+			copyright: "Copyright © 2016-present jc21.com",
+		},
+	},
 });
@@ -0,0 +1,38 @@
+---
+outline: deep
+---
+
+## Certbot DNS plugins in Nginx Proxy Manager
+
+Nginx Proxy Manager uses Certbot to issue and renew Let’s Encrypt certificates.
+
+When you request a certificate using a DNS challenge, Nginx Proxy Manager installs
+the corresponding Certbot DNS plugin for the provider you selected. The available
+providers and package versions are defined in
+⁠[certbot-dns-plugins.json](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/backend/certbot/dns-plugins.json).
+
+## Important limitations
+
+DNS plugins are maintained independently from Certbot and from Nginx Proxy Manager. As a result:
+- Some plugins may lag behind current Certbot or dependency versions.
+- A plugin may install package versions that conflict with other Certbot components.
+- Support quality varies between providers, and not every plugin is regularly tested in Nginx Proxy Manager.
+
+::: warning
+Using more than one DNS provider in the same Nginx Proxy Manager instance may introduce Python
+dependency conflicts between Certbot plugins.
+:::
+
+## If a DNS plugin does not work
+
+1. Check the Nginx Proxy Manager container logs for Certbot or Python package installation errors.
+2. Identify the plugin package and version defined for your provider in
+⁠[certbot-dns-plugins.json](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/backend/certbot/dns-plugins.json).
+3. Check [PyPI](https://pypi.org/) or the plugin project for a newer compatible release.
+4. If needed, update the plugin definition, including any required dependency pins.
+5. Submitting a pull request and CI will build a testable docker image for you.
+
+## File reference
+
+Use this file when reviewing or updating provider definitions:
+- ⁠[certbot-dns-plugins.json](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/backend/certbot/dns-plugins.json)
@@ -150,7 +150,7 @@ services:
      POSTGRES_PASSWORD: 'npmpass'
      POSTGRES_DB: 'npm'
    volumes:
-      - ./postgresql:/var/lib/postgresql
+      - ./postgres_data:/var/lib/postgresql/data
 ```

 ::: warning
@@ -14,7 +14,9 @@ Known integrations:
 - [Proxmox Scripts](https://github.com/ej52/proxmox-scripts/tree/main/apps/nginx-proxy-manager)
 - [Proxmox VE Helper-Scripts](https://community-scripts.github.io/ProxmoxVE/scripts?id=nginxproxymanager)
 - [nginxproxymanagerGraf](https://github.com/ma-karai/nginxproxymanagerGraf)
+- [selfhosting.sh Nginx Proxy Manager Guide](https://selfhosting.sh/apps/nginx-proxy-manager/) - Complete Docker Compose setup guide with SSL configuration, access lists, and proxy host management.
+- [NPM Auth Gateway](https://github.com/Mark0025/npm-auth-gateway) — User-level access control with auto IP whitelisting via auth providers. [Details](/third-party/npm-auth-gateway)


 If you would like your integration of NPM listed, please open a
-[Github issue](https://github.com/NginxProxyManager/nginx-proxy-manager/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=)
+[Github issue](https://github.com/NginxProxyManager/nginx-proxy-manager/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=)
@@ -0,0 +1,83 @@
+---
+outline: deep
+---
+
+# NPM Auth Gateway
+
+User-level access control for Nginx Proxy Manager with auto IP whitelisting.
+
+**Repository:** [github.com/Mark0025/npm-auth-gateway](https://github.com/Mark0025/npm-auth-gateway)
+
+## What It Does
+
+NPM Auth Gateway is a companion app that adds user management on top of NPM's access list system. Instead of manually adding IPs to access lists, users log in through an auth provider and their IP is automatically whitelisted on the access lists they've been assigned to.
+
+NPM remains fully in control — the gateway only reads and writes through NPM's REST API. All access enforcement stays in NPM's nginx config.
+
+## The Problem It Solves
+
+- **Manual IP management** — every time a user needs access, an admin manually adds their IP to an access list
+- **IP changes** — mobile users, VPNs, and travel mean IPs change constantly
+- **No user visibility** — access lists contain IPs, but there's no record of who each IP belongs to
+- **Scaling** — managing 10+ users across multiple access lists gets tedious
+
+## How It Works
+
+```
+Browser → NPM (SSL) → Auth Gateway → Auth Provider
+                                          ↓
+                                    NPM REST API (:81)
+                                    auto-add IP to access lists
+```
+
+1. Admin creates a user by email
+2. Admin assigns access — a table of proxy hosts with checkboxes showing which hosts each access list protects
+3. User logs in → IP detected → automatically added to their assigned NPM access lists
+4. User's IP changes → they log in again → new IP auto-added
+5. Admin revokes access → user's IPs removed from all access lists
+
+## Key Features
+
+- **Auto IP whitelisting** on login
+- **Per-host access control** with checkboxes (not abstract groups)
+- **Admin/user roles** — admin sees everything, users see only their assigned hosts
+- **Personalized dashboard** — users see their services as clickable cards
+- **Login logging** with IP history per user
+- **One-click revoke** — removes user's IPs from all access lists
+- **Searchable tables** for proxy hosts and users
+- **Survives gateway failure** — NPM keeps enforcing existing whitelists
+
+## Architecture
+
+| Responsibility | Who Handles It |
+|---|---|
+| SSL termination | **NPM** |
+| Proxy host configuration | **NPM** |
+| Access list enforcement | **NPM** |
+| IP whitelisting | **NPM** |
+| User identity | **Auth Provider** |
+| User → access list mapping | **Gateway** |
+| Auto IP whitelisting | **Gateway** |
+
+**No database required.** NPM stores all proxy/ACL config. User metadata lives in the auth provider. Zero state duplication.
+
+## NPM API Endpoints Used
+
+| Endpoint | Purpose |
+|---|---|
+| `POST /api/tokens` | Authentication |
+| `GET /api/nginx/proxy-hosts` | List proxy hosts |
+| `GET /api/nginx/access-lists` | List access lists |
+| `PUT /api/nginx/access-lists/:id` | Update access list IPs |
+| `POST /api/nginx/access-lists` | Create access list |
+| `GET /api/nginx/certificates` | List SSL certificates |
+
+## Setup
+
+See the [repository README](https://github.com/Mark0025/npm-auth-gateway) for Docker deployment instructions.
+
+## Tech Stack
+
+Next.js / React / TypeScript / Docker
+
+The auth provider is swappable — the proof of concept uses Clerk, but any OIDC provider works (Auth0, Keycloak, Authentik, etc.).
@@ -957,11 +957,6 @@ nanoid@^3.3.11:
  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.11.tgz#4f4f112cefbe303202f2199838128936266d185b"
  integrity sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==

-nanoid@^3.3.7:
-  version "3.3.8"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.8.tgz#b1be3030bee36aaff18bacb375e5cce521684baf"
-  integrity sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==
-
 oniguruma-to-es@^3.1.0:
  version "3.1.1"
  resolved "https://registry.yarnpkg.com/oniguruma-to-es/-/oniguruma-to-es-3.1.1.tgz#480e4bac4d3bc9439ac0d2124f0725e7a0d76d17"
@@ -976,29 +971,15 @@ perfect-debounce@^1.0.0:
  resolved "https://registry.yarnpkg.com/perfect-debounce/-/perfect-debounce-1.0.0.tgz#9c2e8bc30b169cc984a58b7d5b28049839591d2a"
  integrity sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==

-picocolors@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/picocolors/-/picocolors-1.1.0.tgz#5358b76a78cde483ba5cef6a9dc9671440b27d59"
-  integrity sha512-TQ92mBOW0l3LeMeyLV6mzy/kWr8lkd/hp3mTg7wYK7zJhuBStmGMBG0BdeDZS/dZx1IukaX6Bk11zcln25o1Aw==
-
 picocolors@^1.1.1:
  version "1.1.1"
  resolved "https://registry.yarnpkg.com/picocolors/-/picocolors-1.1.1.tgz#3d321af3eab939b083c8f929a1d12cda81c26b6b"
  integrity sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==

-postcss@^8.4.43:
-  version "8.4.47"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.4.47.tgz#5bf6c9a010f3e724c503bf03ef7947dcb0fea365"
-  integrity sha512-56rxCq7G/XfB4EkXq9Egn5GCqugWvDFjafDOThIdMBsI15iqPqR5r15TfSr1YPYeEI19YeaXMCbY6u88Y76GLQ==
-  dependencies:
-    nanoid "^3.3.7"
-    picocolors "^1.1.0"
-    source-map-js "^1.2.1"
-
-postcss@^8.5.6:
-  version "8.5.6"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.6.tgz#2825006615a619b4f62a9e7426cc120b349a8f3c"
-  integrity sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==
+postcss@^8.4.43, postcss@^8.5.6:
+  version "8.5.14"
+  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.14.tgz#a66c2d7808fadf69ebb5b84a03f8bafd76c4919c"
+  integrity sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==
  dependencies:
    nanoid "^3.3.11"
    picocolors "^1.1.1"
@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.4.5/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.4.15/schema.json",
    "vcs": {
        "enabled": true,
        "clientKind": "git",
@@ -13,6 +13,7 @@ const allLocales = [
  ["es", "es-ES"],
  ["et", "et-EE"],
  ["fr", "fr-FR"],
+  ["ga", "ga-IE"],
  ["it", "it-IT"],
  ["ja", "ja-JP"],
  ["nl", "nl-NL"],
@@ -17,50 +17,50 @@
 	},
 	"dependencies": {
 		"@tabler/core": "^1.4.0",
-		"@tabler/icons-react": "^3.38.0",
-		"@tanstack/react-query": "^5.90.21",
+		"@tabler/icons-react": "^3.44.0",
+		"@tanstack/react-query": "^5.101.0",
 		"@tanstack/react-table": "^8.21.3",
 		"@uiw/react-textarea-code-editor": "^3.1.1",
 		"classnames": "^2.5.1",
-		"country-flag-icons": "^1.6.15",
-		"date-fns": "^4.1.0",
+		"country-flag-icons": "^1.6.17",
+		"date-fns": "^4.4.0",
 		"ez-modal-react": "^1.0.5",
 		"formik": "^2.4.9",
 		"generate-password-browser": "^1.1.0",
 		"humps": "^2.0.1",
-		"query-string": "^9.3.1",
-		"react": "^19.2.4",
+		"query-string": "^9.4.0",
+		"react": "^19.2.7",
 		"react-bootstrap": "^2.10.10",
-		"react-dom": "^19.2.4",
-		"react-intl": "^8.1.3",
+		"react-dom": "^19.2.7",
+		"react-intl": "^10.1.11",
 		"react-markdown": "^10.1.0",
-		"react-router-dom": "^7.13.1",
+		"react-router-dom": "^7.16.0",
 		"react-select": "^5.10.2",
-		"react-toastify": "^11.0.5",
-		"rooks": "^9.5.0"
+		"react-toastify": "^11.1.0",
+		"rooks": "^9.8.0"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.4.5",
-		"@formatjs/cli": "^6.13.0",
-		"@tanstack/react-query-devtools": "^5.91.3",
+		"@biomejs/biome": "^2.4.15",
+		"@formatjs/cli": "^6.16.6",
+		"@tanstack/react-query-devtools": "^5.100.14",
 		"@testing-library/dom": "^10.4.1",
 		"@testing-library/jest-dom": "^6.9.1",
 		"@testing-library/react": "^16.3.2",
 		"@types/country-flag-icons": "^1.2.2",
 		"@types/humps": "^2.0.6",
-		"@types/react": "^19.2.14",
+		"@types/node": "^25.9.1",
+		"@types/react": "^19.2.16",
 		"@types/react-dom": "^19.2.3",
 		"@types/react-table": "^7.7.20",
-		"@vitejs/plugin-react": "^5.1.4",
-		"happy-dom": "^20.8.3",
-		"postcss": "^8.5.8",
+		"@vitejs/plugin-react": "^6.0.2",
+		"happy-dom": "^20.9.0",
+		"postcss": "^8.5.15",
 		"postcss-simple-vars": "^7.0.1",
-		"sass": "^1.97.3",
-		"tmp": "^0.2.5",
-		"typescript": "5.9.3",
-		"vite": "^7.3.1",
-		"vite-plugin-checker": "^0.12.0",
-		"vite-tsconfig-paths": "^6.1.1",
-		"vitest": "^4.0.18"
+		"sass": "^1.100.0",
+		"tmp": "^0.2.7",
+		"typescript": "6.0.3",
+		"vite": "^8.0.16",
+		"vite-plugin-checker": "^0.14.1",
+		"vitest": "^4.1.8"
 	}
 }
@@ -34,7 +34,7 @@ export function SiteFooter() {
 					<div className="col-12 col-lg-auto mt-3 mt-lg-0">
 						<ul className="list-inline list-inline-dots mb-0">
 							<li className="list-inline-item">
-								© 2025{" "}
+								© 2026{" "}
 								<a href="https://jc21.com" rel="noreferrer" target="_blank" className="link-secondary">
 									jc21.com
 								</a>
@@ -26,6 +26,7 @@ const DomainLink = ({ domain, color }: { domain?: string; color?: string }) => {
 				key={domain}
 				href={`http://${domain}`}
 				target="_blank"
+				rel="noopener"
 				onClick={onClick}
 				className={cn("badge", color ? `bg-${color}-lt` : null, "domain-name", "me-2")}
 			>
@@ -1,3 +1,5 @@
+import { IconArrowsSort, IconChevronDown, IconChevronUp } from "@tabler/icons-react";
+import { flexRender } from "@tanstack/react-table";
 import type { TableLayoutProps } from "src/components";

 function TableHeader<T>(props: TableLayoutProps<T>) {
@@ -11,9 +13,34 @@ function TableHeader<T>(props: TableLayoutProps<T>) {
 					{headerGroup.headers.map((header: any) => {
 						const { column } = header;
 						const { className } = (column.columnDef.meta as any) ?? {};
+						const canSort = column.getCanSort();
+						const sortDir = column.getIsSorted();
+
+						const headerContent = header.isPlaceholder
+							? null
+							: typeof column.columnDef.header === "string"
+								? column.columnDef.header
+								: flexRender(column.columnDef.header, header.getContext());
+
+						const sortIcon = canSort ? (
+							sortDir === "asc" ? (
+								<IconChevronUp size={14} className="ms-1" />
+							) : sortDir === "desc" ? (
+								<IconChevronDown size={14} className="ms-1" />
+							) : (
+								<IconArrowsSort size={14} className="ms-1 opacity-50" />
+							)
+						) : null;
+
 						return (
-							<th key={header.id} className={className}>
-								{typeof column.columnDef.header === "string" ? `${column.columnDef.header}` : null}
+							<th
+								key={header.id}
+								className={className}
+								onClick={canSort ? column.getToggleSortingHandler() : undefined}
+								style={canSort ? { cursor: "pointer", userSelect: "none" } : undefined}
+							>
+								{headerContent}
+								{sortIcon}
 							</th>
 						);
 					})}
@@ -72,6 +72,7 @@ const getFlagCodeForLocale = (locale?: string) => {
    vi: "vn", // Vietnam
    ko: "kr", // Korea
    cs: "cz", // Czechia
+    ga: "ie", // Ireland (Irish)
  };

  if (specialCases[thisLocale]) {
@@ -1,4 +1,4 @@
-import { formatDateTime } from "src/locale";
+import { formatDateTime, getFlagCodeForLocale } from "src/locale";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";

 describe("DateFormatter", () => {
@@ -72,3 +72,28 @@ describe("DateFormatter", () => {
 		expect(text).toBe("-100");
 	});
 });
+
+describe("getFlagCodeForLocale", () => {
+	it("returns correct flag code for standard locales", () => {
+		expect(getFlagCodeForLocale("en-US")).toBe("EN");
+		expect(getFlagCodeForLocale("de-DE")).toBe("DE");
+		expect(getFlagCodeForLocale("fr-FR")).toBe("FR");
+	});
+
+	it("returns correct flag code for special-case locales", () => {
+		expect(getFlagCodeForLocale("ja-JP")).toBe("JP");
+		expect(getFlagCodeForLocale("zh-CN")).toBe("CN");
+		expect(getFlagCodeForLocale("vi-VN")).toBe("VN");
+		expect(getFlagCodeForLocale("ko-KR")).toBe("KR");
+		expect(getFlagCodeForLocale("cs-CZ")).toBe("CZ");
+	});
+
+	it("returns IE (Ireland) for Irish locale, not GA (Gabon)", () => {
+		expect(getFlagCodeForLocale("ga-IE")).toBe("IE");
+	});
+
+	it("falls back to EN when no locale is provided", () => {
+		expect(getFlagCodeForLocale()).toBe("EN");
+		expect(getFlagCodeForLocale(undefined)).toBe("EN");
+	});
+});
@@ -1,4 +1,61 @@
 {
+	"2fa.backup-codes-remaining": {
+		"defaultMessage": "Codes de secours restants : {count}"
+	},
+	"2fa.backup-warning": {
+		"defaultMessage": "Sauvegardez ces codes de secours dans un endroit sûr. Chaque code ne peut être utilisé qu'une seule fois."
+	},
+	"2fa.disable": {
+		"defaultMessage": "Désactiver l'authentification à deux facteurs"
+	},
+	"2fa.disable-confirm": {
+		"defaultMessage": "Désactiver la 2FA"
+	},
+	"2fa.disable-warning": {
+		"defaultMessage": "La désactivation de l'authentification à deux facteurs rendra votre compte moins sécurisé."
+	},
+	"2fa.disabled": {
+		"defaultMessage": "Désactivée"
+	},
+	"2fa.done": {
+		"defaultMessage": "J'ai sauvegardé mes codes de secours"
+	},
+	"2fa.enable": {
+		"defaultMessage": "Activer l'authentification à deux facteurs"
+	},
+	"2fa.enabled": {
+		"defaultMessage": "Activée"
+	},
+	"2fa.enter-code": {
+		"defaultMessage": "Entrez le code de vérification"
+	},
+	"2fa.enter-code-disable": {
+		"defaultMessage": "Entrez le code de vérification pour désactiver"
+	},
+	"2fa.regenerate": {
+		"defaultMessage": "Régénérer"
+	},
+	"2fa.regenerate-backup": {
+		"defaultMessage": "Régénérer les codes de secours"
+	},
+	"2fa.regenerate-instructions": {
+		"defaultMessage": "Entrez un code de vérification pour générer de nouveaux codes de secours. Vos anciens codes seront invalidés."
+	},
+	"2fa.secret-key": {
+		"defaultMessage": "Clé secrète"
+	},
+	"2fa.setup-instructions": {
+		"defaultMessage": "Scannez ce QR code avec votre application d'authentification, ou entrez la clé secrète manuellement."
+	},
+	"2fa.status": {
+		"defaultMessage": "Statut"
+	},
+	"2fa.title": {
+		"defaultMessage": "Authentification à deux facteurs"
+	},
+	"2fa.verify-enable": {
+		"defaultMessage": "Vérifier et activer"
+	},
 	"access-list": {
 		"defaultMessage": "Liste d'accès"
 	},
@@ -23,6 +80,9 @@
 	"access-list.public.subtitle": {
 		"defaultMessage": "Aucune authentification de base requise"
 	},
+	"access-list.rule-source.placeholder": {
+		"defaultMessage": "192.168.1.100 ou 192.168.1.0/24 ou 2001:0db8::/32"
+	},
 	"access-list.satisfy-any": {
 		"defaultMessage": "Valide n'importe quelle règle"
 	},
@@ -38,12 +98,18 @@
 	"action.add-location": {
 		"defaultMessage": "Ajouter localisation"
 	},
+	"action.allow": {
+		"defaultMessage": "Autoriser"
+	},
 	"action.close": {
 		"defaultMessage": "Fermer"
 	},
 	"action.delete": {
 		"defaultMessage": "Supprimer"
 	},
+	"action.deny": {
+		"defaultMessage": "Refuser"
+	},
 	"action.disable": {
 		"defaultMessage": "Désactiver"
 	},
@@ -68,6 +134,9 @@
 	"auditlogs": {
 		"defaultMessage": "Journaux d'audit"
 	},
+	"auto": {
+		"defaultMessage": "Auto"
+	},
 	"cancel": {
 		"defaultMessage": "Annuler"
 	},
@@ -128,6 +197,9 @@
 	"certificates.dns.provider": {
 		"defaultMessage": "Fournisseur DNS"
 	},
+	"certificates.dns.provider.placeholder": {
+		"defaultMessage": "Sélectionner un fournisseur..."
+	},
 	"certificates.dns.warning": {
 		"defaultMessage": "Cette section requiert une certaine connaissance de Certbot et de ses plugins DNS. Veuillez consulter la documentation des plugins correspondants."
 	},
@@ -155,6 +227,18 @@
 	"certificates.http.warning": {
 		"defaultMessage": "Ces domaines doivent déjà être configurés pour pointer vers cette installation."
 	},
+	"certificates.key-type": {
+		"defaultMessage": "Type de clé"
+	},
+	"certificates.key-type-description": {
+		"defaultMessage": "RSA est largement répandu, ECDSA est plus rapide et plus sécurisé, mais peut ne pas être supporté par les systèmes plus anciens"
+	},
+	"certificates.key-type-ecdsa": {
+		"defaultMessage": "ECDSA 256"
+	},
+	"certificates.key-type-rsa": {
+		"defaultMessage": "RSA 2048"
+	},
 	"certificates.request.subtitle": {
 		"defaultMessage": "avec Let's Encrypt"
 	},
@@ -180,7 +264,7 @@
 		"defaultMessage": "Détails"
 	},
 	"column.email": {
-		"defaultMessage": "eMail"
+		"defaultMessage": "e-mail"
 	},
 	"column.event": {
 		"defaultMessage": "Évènement"
@@ -263,6 +347,9 @@
 	"domain-names.wildcards-not-supported": {
 		"defaultMessage": "Les Wildcards ne sont pas prises en charge par cette autorité de certification."
 	},
+	"domains.advanced": {
+		"defaultMessage": "Avancé"
+	},
 	"domains.force-ssl": {
 		"defaultMessage": "Forcer SSL"
 	},
@@ -275,11 +362,14 @@
 	"domains.http2-support": {
 		"defaultMessage": "Prise en charge de HTTP/2"
 	},
+	"domains.trust-forwarded-proto": {
+		"defaultMessage": "Faire confiance aux en-têtes Forwarded Proto en amont"
+	},
 	"domains.use-dns": {
 		"defaultMessage": "Utiliser le challenge DNS"
 	},
 	"email-address": {
-		"defaultMessage": "Adresse eMail"
+		"defaultMessage": "Adresse e-mail"
 	},
 	"empty-search": {
 		"defaultMessage": "Aucun résultat trouvé"
@@ -297,13 +387,13 @@
 		"defaultMessage": "Les noms d'utilisateurs autorisés doivent être uniques"
 	},
 	"error.invalid-auth": {
-		"defaultMessage": "Adresse eMail ou mot de passe invalide"
+		"defaultMessage": "Adresse e-mail ou mot de passe invalide"
 	},
 	"error.invalid-domain": {
 		"defaultMessage": "Domaine invalide : {domain}"
 	},
 	"error.invalid-email": {
-		"defaultMessage": "Adresse eMail invalide"
+		"defaultMessage": "Adresse e-mail invalide"
 	},
 	"error.max-character-length": {
 		"defaultMessage": "La longueur maximale est {max} caractère{max, plural, one {} other {s}}"
@@ -371,6 +461,21 @@
 	"loading": {
 		"defaultMessage": "Chargement…"
 	},
+	"login.2fa-code": {
+		"defaultMessage": "Code de vérification"
+	},
+	"login.2fa-code-placeholder": {
+		"defaultMessage": "Entrez le code"
+	},
+	"login.2fa-description": {
+		"defaultMessage": "Entrez le code depuis votre application d'authentification"
+	},
+	"login.2fa-title": {
+		"defaultMessage": "Authentification à deux facteurs"
+	},
+	"login.2fa-verify": {
+		"defaultMessage": "Vérifier"
+	},
 	"login.title": {
 		"defaultMessage": "Connectez-vous à votre compte"
 	},
@@ -518,6 +623,24 @@
 	"redirection-hosts.count": {
 		"defaultMessage": "{count} {count, plural, one {Hôte de redirection} other {Hôtes de redirection}}"
 	},
+	"redirection-hosts.http-code.300": {
+		"defaultMessage": "300 Choix multiples"
+	},
+	"redirection-hosts.http-code.301": {
+		"defaultMessage": "301 Déplacé définitivement"
+	},
+	"redirection-hosts.http-code.302": {
+		"defaultMessage": "302 Déplacé temporairement"
+	},
+	"redirection-hosts.http-code.303": {
+		"defaultMessage": "303 Voir autre"
+	},
+	"redirection-hosts.http-code.307": {
+		"defaultMessage": "307 Redirection temporaire"
+	},
+	"redirection-hosts.http-code.308": {
+		"defaultMessage": "308 Redirection permanente"
+	},
 	"role.admin": {
 		"defaultMessage": "Administrateur"
 	},
@@ -575,6 +698,9 @@
 	"stream.forward-host": {
 		"defaultMessage": "Hôte destinataire"
 	},
+	"stream.forward-host.placeholder": {
+		"defaultMessage": "example.com ou 10.0.0.1 ou 2001:db8:3333:4444:5555:6666:7777:8888"
+	},
 	"stream.incoming-port": {
 		"defaultMessage": "Port d'entrée"
 	},
@@ -638,6 +764,9 @@
 	"user.switch-light": {
 		"defaultMessage": "Passer au mode Lumineux"
 	},
+	"user.two-factor": {
+		"defaultMessage": "Auth. à deux facteurs"
+	},
 	"username": {
 		"defaultMessage": "Nom d'utilisateur"
 	},
@@ -8,7 +8,7 @@
  "locale-et-EE": {
    "defaultMessage": "Eesti"
  },
-  "locale-ie-GA": {
+  "locale-ga-IE": {
    "defaultMessage": "Gaeilge"
  },
  "locale-de-DE": {
@@ -1,4 +1,61 @@
 {
+	"2fa.backup-codes-remaining": {
+		"defaultMessage": "Resterende back-upcodes: {count}"
+	},
+	"2fa.backup-warning": {
+		"defaultMessage": "Bewaar deze back-upcodes op een veilige plaats. Elke code kan slechts één keer worden gebruikt."
+	},
+	"2fa.disable": {
+		"defaultMessage": "Tweefactorauthenticatie uitschakelen"
+	},
+	"2fa.disable-confirm": {
+		"defaultMessage": "2FA uitschakelen"
+	},
+	"2fa.disable-warning": {
+		"defaultMessage": "Als je tweefactorauthenticatie uitschakelt, wordt je account minder beveiligd."
+	},
+	"2fa.disabled": {
+		"defaultMessage": "Uitgeschakeld"
+	},
+	"2fa.done": {
+		"defaultMessage": "Ik heb mijn back-upcodes opgeslagen"
+	},
+	"2fa.enable": {
+		"defaultMessage": "Tweefactorauthenticatie inschakelen"
+	},
+	"2fa.enabled": {
+		"defaultMessage": "Ingeschakeld"
+	},
+	"2fa.enter-code": {
+		"defaultMessage": "Verificatiecode invoeren"
+	},
+	"2fa.enter-code-disable": {
+		"defaultMessage": "Verificatiecode invoeren om uit te schakelen"
+	},
+	"2fa.regenerate": {
+		"defaultMessage": "Opnieuw genereren"
+	},
+	"2fa.regenerate-backup": {
+		"defaultMessage": "Back-upcodes opnieuw genereren"
+	},
+	"2fa.regenerate-instructions": {
+		"defaultMessage": "Voer een verificatiecode in om nieuwe back-upcodes te genereren. Oude codes worden ongeldig gemaakt."
+	},
+	"2fa.secret-key": {
+		"defaultMessage": "Geheime sleutel"
+	},
+	"2fa.setup-instructions": {
+		"defaultMessage": "Scan deze QR-code met je authenticator-app, of voer de code handmatig in."
+	},
+	"2fa.status": {
+		"defaultMessage": "Status"
+	},
+	"2fa.title": {
+		"defaultMessage": "Tweefactorauthenticatie"
+	},
+	"2fa.verify-enable": {
+		"defaultMessage": "Verifiëren en inschakelen"
+	},
 	"access-list": {
 		"defaultMessage": "Toegangslijst"
 	},
@@ -12,10 +69,10 @@
 		"defaultMessage": "Als er minimaal 1 regel bestaat, wordt deze regel als laatste toegevoegd"
 	},
 	"access-list.help.rules-order": {
-		"defaultMessage": "Onthoud dat de regels van boven naar beneden worden toegevoegd."
+		"defaultMessage": "Houd er rekening mee dat de regels worden toegepast in de volgorde waarin ze zijn gedefinieerd."
 	},
 	"access-list.pass-auth": {
-		"defaultMessage": "Pass Auth to Upstream"
+		"defaultMessage": "Authenticatie naar upstream doorgeven"
 	},
 	"access-list.public": {
 		"defaultMessage": "Publiekelijk toegankelijk"
@@ -23,6 +80,9 @@
 	"access-list.public.subtitle": {
 		"defaultMessage": "Geen basisautentificatie vereist"
 	},
+	"access-list.rule-source.placeholder": {
+		"defaultMessage": "192.168.1.100 of 192.168.1.0/24 of 2001:0db8::/32"
+	},
 	"access-list.satisfy-any": {
 		"defaultMessage": "Voldoe aan elke"
 	},
@@ -36,7 +96,10 @@
 		"defaultMessage": "Toevoegen"
 	},
 	"action.add-location": {
-		"defaultMessage": "Locatie Toevoegen"
+		"defaultMessage": "Locatie toevoegen"
+	},
+	"action.allow": {
+		"defaultMessage": "Toestaan"
 	},
 	"action.close": {
 		"defaultMessage": "Sluiten"
@@ -44,30 +107,36 @@
 	"action.delete": {
 		"defaultMessage": "Verwijderen"
 	},
+	"action.deny": {
+		"defaultMessage": "Afwijzen"
+	},
 	"action.disable": {
-		"defaultMessage": "Uitzetten"
+		"defaultMessage": "Uitschakelen"
 	},
 	"action.download": {
-		"defaultMessage": "Download"
+		"defaultMessage": "Downloaden"
 	},
 	"action.edit": {
 		"defaultMessage": "Bewerken"
 	},
 	"action.enable": {
-		"defaultMessage": "Aanzetten"
+		"defaultMessage": "Inschakelen"
 	},
 	"action.permissions": {
-		"defaultMessage": "Rechten"
+		"defaultMessage": "Machtigingen"
 	},
 	"action.renew": {
 		"defaultMessage": "Vernieuwen"
 	},
 	"action.view-details": {
-		"defaultMessage": "Bekijk Details"
+		"defaultMessage": "Details weergeven"
 	},
 	"auditlogs": {
 		"defaultMessage": "Logboeken"
 	},
+	"auto": {
+		"defaultMessage": "Autom."
+	},
 	"cancel": {
 		"defaultMessage": "Annuleren"
 	},
@@ -78,13 +147,13 @@
 		"defaultMessage": "Certificaat"
 	},
 	"certificate.custom-certificate-key": {
-		"defaultMessage": "Certificaat Sleutel"
+		"defaultMessage": "Certificaatsleutel"
 	},
 	"certificate.custom-intermediate": {
-		"defaultMessage": "Intermediate Certificaat"
+		"defaultMessage": "Intermediate certificaat"
 	},
 	"certificate.in-use": {
-		"defaultMessage": "In Gebruik"
+		"defaultMessage": "In gebruik"
 	},
 	"certificate.none.subtitle": {
 		"defaultMessage": "Geen certificaat toegewezen"
@@ -96,58 +165,61 @@
 		"defaultMessage": "Geen"
 	},
 	"certificate.not-in-use": {
-		"defaultMessage": "Niet Gebruikt"
+		"defaultMessage": "Niet gebruikt"
 	},
 	"certificate.renew": {
-		"defaultMessage": "Certificaat Vernieuwen"
+		"defaultMessage": "Certificaat vernieuwen"
 	},
 	"certificates": {
 		"defaultMessage": "Certificaten"
 	},
 	"certificates.custom": {
-		"defaultMessage": "Aangepast Certificaat"
+		"defaultMessage": "Aangepast certificaat"
 	},
 	"certificates.custom.warning": {
-		"defaultMessage": "Sleutels met een wachtzin zijn niet ondersteund."
+		"defaultMessage": "Sleutels met een wachtwoordzin zijn niet ondersteund."
 	},
 	"certificates.dns.credentials": {
-		"defaultMessage": "Credentials File Content"
+		"defaultMessage": "Inloggegevens bestandsinhoud"
 	},
 	"certificates.dns.credentials-note": {
-		"defaultMessage": "Deze plugin vereist een configuratiebestand met een API token of andere gegevens van de provider."
+		"defaultMessage": "Deze plugin vereist een configuratiebestand met een API-token of andere gegevens van je aanbieder."
 	},
 	"certificates.dns.credentials-warning": {
-		"defaultMessage": "Deze data zal worden opgeslagen als plaintext in de database en in een bestand!"
+		"defaultMessage": "Deze gegevens worden opgeslagen als plaintext in de database en in een bestand!"
 	},
 	"certificates.dns.propagation-seconds": {
 		"defaultMessage": "Verwerkingstijd (seconden)"
 	},
 	"certificates.dns.propagation-seconds-note": {
-		"defaultMessage": "Laat leeg om de standaardwaarde van de plugin te gebruiken. Aantal seconden om te wachten op DNS propagatie."
+		"defaultMessage": "Laat leeg om de standaardwaarde van de plugin te gebruiken. Aantal seconden om te wachten op DNS-propagatie."
 	},
 	"certificates.dns.provider": {
-		"defaultMessage": "DNS Provider"
+		"defaultMessage": "DNS-aanbieder"
+	},
+	"certificates.dns.provider.placeholder": {
+		"defaultMessage": "Kies een aanbieder..."
 	},
 	"certificates.dns.warning": {
 		"defaultMessage": "Deze sectie vereist wat informatie over Certbot en zijn DNS plugins. Gebruik de documentatie van de bijbehorende plugins."
 	},
 	"certificates.http.reachability-404": {
-		"defaultMessage": "Er is een server gevonden op deze domeinnaam, maar dat lijkt niet Nginx Proxy Manager te zijn. Zorg ervoor dat je domein naar het IP waar je NPM instance draait wijst."
+		"defaultMessage": "Er is een server gevonden op deze domeinnaam, maar dat lijkt niet Nginx Proxy Manager te zijn. Zorg ervoor dat je domein verwijst naar het IP waar je NPM-instantie draait."
 	},
 	"certificates.http.reachability-failed-to-check": {
 		"defaultMessage": "Bereikbaarheid kan niet worden bepaald door een communicatiefout met site24x7.com."
 	},
 	"certificates.http.reachability-not-resolved": {
-		"defaultMessage": "Er is geen server beschikbaar op dit domein. Zorg ervoor dat je domein bestaat en naar het IP waar je NPM instance draait wijst en eventueel port 80 wordt doorgegeven in je router."
+		"defaultMessage": "Er is geen server beschikbaar op dit domein. Zorg ervoor dat je domein bestaat en verwijst naar het IP waar je NPM-instantie draait en eventueel port 80 wordt doorgestuurd in je router."
 	},
 	"certificates.http.reachability-ok": {
-		"defaultMessage": "Jouw server is bereikbaar en certificaten kunnen worden aangemaakt."
+		"defaultMessage": "Je server is bereikbaar en certificaten kunnen worden aangemaakt."
 	},
 	"certificates.http.reachability-other": {
-		"defaultMessage": "Er is een server gevonden op deze domeinnaam, maar heeft een onverwachte statuscode ({code}) teruggegeven. Is dat de NPM server? Zorg ervoor dat je domein naar het IP waar je NPM instance draait wijst."
+		"defaultMessage": "Er is een server gevonden op deze domeinnaam, maar heeft een onverwachte statuscode ({code}) teruggegeven. Is dat de NPM-server? Zorg ervoor dat je domein verwijst naar het IP waar jouw NPM-instantie draait."
 	},
 	"certificates.http.reachability-wrong-data": {
-		"defaultMessage": "Er is een server gevonden op deze domeinnaam, maar heeft een onverwachte gegevens teruggegeven. Is dat de NPM server? Zorg ervoor dat je domein naar het IP waar je NPM instance draait wijst."
+		"defaultMessage": "Er is een server gevonden op deze domeinnaam, maar heeft een onverwachte gegevens teruggegeven. Is dat de NPM-server? Zorg ervoor dat je domein verwijst naar het IP waar jouw NPM-instantie draait."
 	},
 	"certificates.http.test-results": {
 		"defaultMessage": "Testresultaten"
@@ -159,7 +231,7 @@
 		"defaultMessage": "Sleuteltype"
 	},
 	"certificates.key-type-description": {
-		"defaultMessage": "RSA is breed compatibel, ECDSA is sneller en veiliger maar wordt mogelijk niet ondersteund door oudere systemen"
+		"defaultMessage": "RSA is algemeen toepasbaar, ECDSA is sneller en veiliger maar wordt mogelijk niet ondersteund door oudere systemen"
 	},
 	"certificates.key-type-ecdsa": {
 		"defaultMessage": "ECDSA 256"
@@ -171,19 +243,19 @@
 		"defaultMessage": "met Let's Encrypt"
 	},
 	"certificates.request.title": {
-		"defaultMessage": "Vraag een nieuwe Certificaat aan"
+		"defaultMessage": "Vraag een nieuw certificaat aan"
 	},
 	"column.access": {
 		"defaultMessage": "Toegang"
 	},
 	"column.authorization": {
-		"defaultMessage": "Authorizatie"
+		"defaultMessage": "Authorisatie"
 	},
 	"column.authorizations": {
-		"defaultMessage": "Authorizaties"
+		"defaultMessage": "Authorisaties"
 	},
 	"column.custom-locations": {
-		"defaultMessage": "Aangepaste Locaties"
+		"defaultMessage": "Aangepaste locaties"
 	},
 	"column.destination": {
 		"defaultMessage": "Doel"
@@ -192,7 +264,7 @@
 		"defaultMessage": "Details"
 	},
 	"column.email": {
-		"defaultMessage": "Email"
+		"defaultMessage": "E-mail"
 	},
 	"column.event": {
 		"defaultMessage": "Gebeurtenis"
@@ -201,10 +273,10 @@
 		"defaultMessage": "Verloopt"
 	},
 	"column.http-code": {
-		"defaultMessage": "HTTP Code"
+		"defaultMessage": "HTTP-code"
 	},
 	"column.incoming-port": {
-		"defaultMessage": "Inkomende Poort"
+		"defaultMessage": "Inkomende poort"
 	},
 	"column.name": {
 		"defaultMessage": "Naam"
@@ -213,7 +285,7 @@
 		"defaultMessage": "Protocol"
 	},
 	"column.provider": {
-		"defaultMessage": "Provider"
+		"defaultMessage": "Aanbieder"
 	},
 	"column.roles": {
 		"defaultMessage": "Rollen"
@@ -222,7 +294,7 @@
 		"defaultMessage": "Regels"
 	},
 	"column.satisfy": {
-		"defaultMessage": "Vervul"
+		"defaultMessage": "Vervullen"
 	},
 	"column.satisfy-all": {
 		"defaultMessage": "Alle"
@@ -249,16 +321,16 @@
 		"defaultMessage": "Dashboard"
 	},
 	"dead-host": {
-		"defaultMessage": "404 Host"
+		"defaultMessage": "404-Host"
 	},
 	"dead-hosts": {
-		"defaultMessage": "404 Hosts"
+		"defaultMessage": "404-Hosts"
 	},
 	"dead-hosts.count": {
-		"defaultMessage": "{count} {count, plural, one {404 Host} other {404 Hosts}}"
+		"defaultMessage": "{count} {count, plural, one {404-Host} other {404-Hosts}}"
 	},
 	"disabled": {
-		"defaultMessage": "Uitgezet"
+		"defaultMessage": "Uitgeschakeld"
 	},
 	"domain-names": {
 		"defaultMessage": "Domeinnamen"
@@ -275,20 +347,26 @@
 	"domain-names.wildcards-not-supported": {
 		"defaultMessage": "Wildcards zijn niet ondersteund voor deze CA"
 	},
+	"domains.advanced": {
+		"defaultMessage": "Geavanceerd"
+	},
 	"domains.force-ssl": {
-		"defaultMessage": "Forceer SSL"
+		"defaultMessage": "SSL forceren"
 	},
 	"domains.hsts-enabled": {
-		"defaultMessage": "HSTS Aangezet"
+		"defaultMessage": "HSTS ingeschakeld"
 	},
 	"domains.hsts-subdomains": {
-		"defaultMessage": "HSTS Subdomein"
+		"defaultMessage": "HSTS-subdomein"
 	},
 	"domains.http2-support": {
-		"defaultMessage": "HTTP/2 Ondersteuning"
+		"defaultMessage": "HTTP/2-ondersteuning"
+	},
+	"domains.trust-forwarded-proto": {
+		"defaultMessage": "Forwarded-Proto-headers van upstream vertrouwen"
 	},
 	"domains.use-dns": {
-		"defaultMessage": "Gebruik DNS Challenge"
+		"defaultMessage": "DNS-challenge gebruiken"
 	},
 	"email-address": {
 		"defaultMessage": "E-mailadres"
@@ -297,19 +375,19 @@
 		"defaultMessage": "Geen resultaten gevonden"
 	},
 	"empty-subtitle": {
-		"defaultMessage": "Waarom niet een maken?"
+		"defaultMessage": "Waarom maak je er geen aan?"
 	},
 	"enabled": {
 		"defaultMessage": "Aangezet"
 	},
 	"error.access.at-least-one": {
-		"defaultMessage": "Minimaal één authorizatie- of één toegangsregel is vereist"
+		"defaultMessage": "Minstens één authorisatie- of één toegangsregel is vereist"
 	},
 	"error.access.duplicate-usernames": {
 		"defaultMessage": "Gebruikersnamen moeten uniek zijn"
 	},
 	"error.invalid-auth": {
-		"defaultMessage": "Ongeldige email of wachtwoord"
+		"defaultMessage": "Ongeldig e-mail of wachtwoord"
 	},
 	"error.invalid-domain": {
 		"defaultMessage": "Ongeldige domeinnaam: {domain}"
@@ -318,19 +396,19 @@
 		"defaultMessage": "Ongeldig e-mailadres"
 	},
 	"error.max-character-length": {
-		"defaultMessage": "Maximale lengte is {max} karakter{max, plural, one {} other {s}}"
+		"defaultMessage": "Maximale lengte is {max} teken{max, plural, one {} other {s}}"
 	},
 	"error.max-domains": {
 		"defaultMessage": "Te veel domeinnamen, max is {max}"
 	},
 	"error.maximum": {
-		"defaultMessage": "Maximale is {max}"
+		"defaultMessage": "Maximum is {max}"
 	},
 	"error.min-character-length": {
-		"defaultMessage": "Minimale lengte is {min} karakter{min, plural, one {} other {s}}"
+		"defaultMessage": "Minimale lengte is {min} teken{min, plural, one {} other {s}}"
 	},
 	"error.minimum": {
-		"defaultMessage": "Minimale is {min}"
+		"defaultMessage": "Minimum is {min}"
 	},
 	"error.passwords-must-match": {
 		"defaultMessage": "Wachtwoorden moeten overeenkomen"
@@ -345,22 +423,22 @@
 		"defaultMessage": "Maak een Fork op Github"
 	},
 	"host.flags.block-exploits": {
-		"defaultMessage": "Blokkeer Veelvoorkomende Kwetsbaarheden"
+		"defaultMessage": "Veelvoorkomende kwetsbaarheden blokkeren"
 	},
 	"host.flags.cache-assets": {
-		"defaultMessage": "Cache Assets"
+		"defaultMessage": "Assets opslaan"
 	},
 	"host.flags.preserve-path": {
-		"defaultMessage": "Pad Behouden"
+		"defaultMessage": "Pad behouden"
 	},
 	"host.flags.protocols": {
 		"defaultMessage": "Protocollen"
 	},
 	"host.flags.websockets-upgrade": {
-		"defaultMessage": "Websockets Ondersteuning"
+		"defaultMessage": "Websockets-ondersteuning"
 	},
 	"host.forward-port": {
-		"defaultMessage": "Poort Doorsturen"
+		"defaultMessage": "Poort doorsturen"
 	},
 	"host.forward-scheme": {
 		"defaultMessage": "Schema"
@@ -383,17 +461,32 @@
 	"loading": {
 		"defaultMessage": "Laden…"
 	},
+	"login.2fa-code": {
+		"defaultMessage": "Verificatiecode"
+	},
+	"login.2fa-code-placeholder": {
+		"defaultMessage": "Code invoeren"
+	},
+	"login.2fa-description": {
+		"defaultMessage": "Voer de code in vanuit je Authenticator-app"
+	},
+	"login.2fa-title": {
+		"defaultMessage": "Tweefactorauthenticatie"
+	},
+	"login.2fa-verify": {
+		"defaultMessage": "Verifiëren"
+	},
 	"login.title": {
-		"defaultMessage": "Inloggen"
+		"defaultMessage": "Log in op je account"
 	},
 	"nginx-config.label": {
-		"defaultMessage": "Aangepaste Nginx Configuratie"
+		"defaultMessage": "Aangepaste Nginx-configuratie"
 	},
 	"nginx-config.placeholder": {
-		"defaultMessage": "# Voeg jouw aangepaste Nginx configuratie hier op eigen risico toe!"
+		"defaultMessage": "# Voer hier je aangepaste Nginx-configuratie in op eigen risico!"
 	},
 	"no-permission-error": {
-		"defaultMessage": "Jij hebt geen toegang om dit te bekijken."
+		"defaultMessage": "Je hebt geen toegang om dit te bekijken."
 	},
 	"notfound.action": {
 		"defaultMessage": "Thuis"
@@ -411,10 +504,10 @@
 		"defaultMessage": "{object} is verwijderd"
 	},
 	"notification.object-disabled": {
-		"defaultMessage": "{object} is uitgezet"
+		"defaultMessage": "{object} is uitgeschakeld"
 	},
 	"notification.object-enabled": {
-		"defaultMessage": "{object} is aangezet"
+		"defaultMessage": "{object} is ingeschakeld"
 	},
 	"notification.object-renewed": {
 		"defaultMessage": "{object} is vernieuwd"
@@ -429,16 +522,16 @@
 		"defaultMessage": "{object} #{id}"
 	},
 	"object.add": {
-		"defaultMessage": "Voeg {object} toe"
+		"defaultMessage": "{object} toevoegen"
 	},
 	"object.delete": {
-		"defaultMessage": "Verwijder {object}"
+		"defaultMessage": "{object} verwijderen"
 	},
 	"object.delete.content": {
 		"defaultMessage": "Weet je zeker dat je {object} wilt verwijderen?"
 	},
 	"object.edit": {
-		"defaultMessage": "Bewerk {object}"
+		"defaultMessage": "{object} bewerken"
 	},
 	"object.empty": {
 		"defaultMessage": "Er zijn geen {objects}"
@@ -450,10 +543,10 @@
 		"defaultMessage": "{object} is verwijderd"
 	},
 	"object.event.disabled": {
-		"defaultMessage": "{object} is uitgezet"
+		"defaultMessage": "{object} is uitgeschakeld"
 	},
 	"object.event.enabled": {
-		"defaultMessage": "{object} is aangezet"
+		"defaultMessage": "{object} is ingeschakeld"
 	},
 	"object.event.renewed": {
 		"defaultMessage": "{object} is vernieuwd"
@@ -477,37 +570,37 @@
 		"defaultMessage": "Willekeurig wachtwoord genereren"
 	},
 	"password.hide": {
-		"defaultMessage": "Wachtwoord Verbergen"
+		"defaultMessage": "Wachtwoord verbergen"
 	},
 	"password.show": {
-		"defaultMessage": "Toon Wachtwoord"
+		"defaultMessage": "Wachtwoord weergeven"
 	},
 	"permissions.hidden": {
 		"defaultMessage": "Verborgen"
 	},
 	"permissions.manage": {
-		"defaultMessage": "Beheer"
+		"defaultMessage": "Beheren"
 	},
 	"permissions.view": {
-		"defaultMessage": "Alleen Bekijken"
+		"defaultMessage": "Alleen weergeven"
 	},
 	"permissions.visibility.all": {
-		"defaultMessage": "Alle Items"
+		"defaultMessage": "Alle items"
 	},
 	"permissions.visibility.title": {
-		"defaultMessage": "Item Zichtbaarheid"
+		"defaultMessage": "Zichtbaarheid"
 	},
 	"permissions.visibility.user": {
-		"defaultMessage": "Alleen Aangemaakte Items"
+		"defaultMessage": "Alleen aangemaakte items"
 	},
 	"proxy-host": {
-		"defaultMessage": "Proxy Host"
+		"defaultMessage": "Proxyhost"
 	},
 	"proxy-host.forward-host": {
 		"defaultMessage": "Hostname / IP Doorsturen"
 	},
 	"proxy-hosts": {
-		"defaultMessage": "Proxy Hosts"
+		"defaultMessage": "Proxyhosts"
 	},
 	"proxy-hosts.count": {
 		"defaultMessage": "{count} {count, plural, one {Proxy Host} other {Proxy Hosts}}"
@@ -516,25 +609,43 @@
 		"defaultMessage": "Openbaar"
 	},
 	"redirection-host": {
-		"defaultMessage": "Redirection Host"
+		"defaultMessage": "Omleidingshost"
 	},
 	"redirection-host.forward-domain": {
 		"defaultMessage": "Doorgestuurd Domein"
 	},
 	"redirection-host.forward-http-code": {
-		"defaultMessage": "HTTP Code"
+		"defaultMessage": "HTTP-code"
 	},
 	"redirection-hosts": {
-		"defaultMessage": "Redirection Hosts"
+		"defaultMessage": "Omgeleide Hosts"
 	},
 	"redirection-hosts.count": {
-		"defaultMessage": "{count} {count, plural, one {Redirection Host} other {Redirection Hosts}}"
+		"defaultMessage": "{count} {count, plural, one {Omgeleide Host} other {Omgeleide Hosts}}"
+	},
+	"redirection-hosts.http-code.300": {
+		"defaultMessage": "300 Meerkeuze"
+	},
+	"redirection-hosts.http-code.301": {
+		"defaultMessage": "301 Definitief verplaatst"
+	},
+	"redirection-hosts.http-code.302": {
+		"defaultMessage": "302 Tijdelijk verplaatst"
+	},
+	"redirection-hosts.http-code.303": {
+		"defaultMessage": "303 Zie andere"
+	},
+	"redirection-hosts.http-code.307": {
+		"defaultMessage": "307 Tijdelijke omleiding"
+	},
+	"redirection-hosts.http-code.308": {
+		"defaultMessage": "308 Definitieve omleiding"
 	},
 	"role.admin": {
 		"defaultMessage": "Beheerder"
 	},
 	"role.standard-user": {
-		"defaultMessage": "Standaard Gebruiker"
+		"defaultMessage": "Standaardgebruiker"
 	},
 	"save": {
 		"defaultMessage": "Opslaan"
@@ -546,31 +657,31 @@
 		"defaultMessage": "Instellingen"
 	},
 	"settings.default-site": {
-		"defaultMessage": "Standaard Site"
+		"defaultMessage": "Standaardbestemming"
 	},
 	"settings.default-site.404": {
-		"defaultMessage": "404 Pagina"
+		"defaultMessage": "404-pagina"
 	},
 	"settings.default-site.444": {
-		"defaultMessage": "Geen Antwoord (444)"
+		"defaultMessage": "Geen reactie (444)"
 	},
 	"settings.default-site.congratulations": {
 		"defaultMessage": "Felicitatiepagina"
 	},
 	"settings.default-site.description": {
-		"defaultMessage": "Wat te tonen als Nginx een onbekende Host ontvangt"
+		"defaultMessage": "Wat als Nginx een onbekende Host ontvangt?"
 	},
 	"settings.default-site.html": {
 		"defaultMessage": "Aangepaste HTML"
 	},
 	"settings.default-site.html.placeholder": {
-		"defaultMessage": "<!-- Plaats jouw aangepaste HTML hier -->"
+		"defaultMessage": "<!-- Voer hier je aangepaste HTML in -->"
 	},
 	"settings.default-site.redirect": {
-		"defaultMessage": "Omleiding"
+		"defaultMessage": "Omleiden"
 	},
 	"setup.preamble": {
-		"defaultMessage": "Begin met het aanmaken van je beheerder account."
+		"defaultMessage": "Begin met het aanmaken van jouw beheerderaccount."
 	},
 	"setup.title": {
 		"defaultMessage": "Welkom!"
@@ -579,16 +690,19 @@
 		"defaultMessage": "Inloggen"
 	},
 	"ssl-certificate": {
-		"defaultMessage": "SSL Certificaten"
+		"defaultMessage": "SSL-certificaat"
 	},
 	"stream": {
 		"defaultMessage": "Stream"
 	},
 	"stream.forward-host": {
-		"defaultMessage": "Doorgestuurde Host"
+		"defaultMessage": "Doelhost"
+	},
+	"stream.forward-host.placeholder": {
+		"defaultMessage": "voorbeeld.nl of 10.0.0.1 of 2001:db8:3333:4444:5555:6666:7777:8888"
 	},
 	"stream.incoming-port": {
-		"defaultMessage": "Inkomende Poort"
+		"defaultMessage": "Inkomende poort"
 	},
 	"streams": {
 		"defaultMessage": "Streams"
@@ -603,28 +717,28 @@
 		"defaultMessage": "UDP"
 	},
 	"test": {
-		"defaultMessage": "Test"
+		"defaultMessage": "Testen"
 	},
 	"update-available": {
-		"defaultMessage": "Update Beschikbaar: {latestVersion}"
+		"defaultMessage": "Update beschikbaar: {latestVersion}"
 	},
 	"user": {
 		"defaultMessage": "Gebruiker"
 	},
 	"user.change-password": {
-		"defaultMessage": "Verander Wachtwoord"
+		"defaultMessage": "Wachtwoord wijzigen"
 	},
 	"user.confirm-password": {
-		"defaultMessage": "Bevestig Wachtwoord"
+		"defaultMessage": "Wachtwoord bevestigen"
 	},
 	"user.current-password": {
-		"defaultMessage": "Huidig Wachtwoord"
+		"defaultMessage": "Huidig wachtwoord"
 	},
 	"user.edit-profile": {
-		"defaultMessage": "Profiel Bewerken"
+		"defaultMessage": "Profiel bewerken"
 	},
 	"user.full-name": {
-		"defaultMessage": "Volledige Naam"
+		"defaultMessage": "Volledige naam"
 	},
 	"user.login-as": {
 		"defaultMessage": "Inloggen als {name}"
@@ -633,22 +747,25 @@
 		"defaultMessage": "Uitloggen"
 	},
 	"user.new-password": {
-		"defaultMessage": "Nieuw Wachtwoord"
+		"defaultMessage": "Nieuw wachtwoord"
 	},
 	"user.nickname": {
 		"defaultMessage": "Bijnaam"
 	},
 	"user.set-password": {
-		"defaultMessage": "Zet Wachtwoord"
+		"defaultMessage": "Wachtwoord instellen"
 	},
 	"user.set-permissions": {
-		"defaultMessage": "Zet machtigingen voor {name}"
+		"defaultMessage": "Machtigingen instellen voor {name}"
 	},
 	"user.switch-dark": {
-		"defaultMessage": "Verander naar donkere modus"
+		"defaultMessage": "Donkere modus inschakelen"
 	},
 	"user.switch-light": {
-		"defaultMessage": "Verander naar lichte modus"
+		"defaultMessage": "Lichte modus inschakelen"
+	},
+	"user.two-factor": {
+		"defaultMessage": "Tweefactorauthenticatie"
 	},
 	"username": {
 		"defaultMessage": "Gebruikersnaam"
@@ -1,4 +1,61 @@
 {
+	"2fa.backup-codes-remaining": {
+		"defaultMessage": "Осталось резервных кодов: {count}"
+	},
+	"2fa.backup-warning": {
+		"defaultMessage": "Сохраните коды в надежном месте. Они одноразовые."
+	},
+	"2fa.disable": {
+		"defaultMessage": "Выключить двухфакторную аутентификацию"
+	},
+	"2fa.disable-confirm": {
+		"defaultMessage": "Выключить 2FA"
+	},
+	"2fa.disable-warning": {
+		"defaultMessage": "Выключение двухфакторной аутентификации снизит защиту вашего аккаунта."
+	},
+	"2fa.disabled": {
+		"defaultMessage": "Выключена"
+	},
+	"2fa.done": {
+		"defaultMessage": "Я сохранил резервные коды"
+	},
+	"2fa.enable": {
+		"defaultMessage": "Включить двухфакторную аутентификацию"
+	},
+	"2fa.enabled": {
+		"defaultMessage": "Включена"
+	},
+	"2fa.enter-code": {
+		"defaultMessage": "Введите код проверки"
+	},
+	"2fa.enter-code-disable": {
+		"defaultMessage": "Введите код проверки для выключения"
+	},
+	"2fa.regenerate": {
+		"defaultMessage": "Перевыпустить"
+	},
+	"2fa.regenerate-backup": {
+		"defaultMessage": "Перевыпустить резервные коды"
+	},
+	"2fa.regenerate-instructions": {
+		"defaultMessage": "Введите код проверки, чтобы создать новые резервные коды. Прежние перестанут работать."
+	},
+	"2fa.secret-key": {
+		"defaultMessage": "Секретный ключ"
+	},
+	"2fa.setup-instructions": {
+		"defaultMessage": "Отсканируйте QR-код приложением или введите ключ настройки вручную."
+	},
+	"2fa.status": {
+		"defaultMessage": "Статус"
+	},
+	"2fa.title": {
+		"defaultMessage": "Двухфакторная аутентификация"
+	},
+	"2fa.verify-enable": {
+		"defaultMessage": "Проверить и включить"
+	},
 	"access-list": {
 		"defaultMessage": "Список доступа"
 	},
@@ -15,14 +72,17 @@
 		"defaultMessage": "Обратите внимание: разрешающие и запрещающие директивы применяются в порядке их определения."
 	},
 	"access-list.pass-auth": {
-		"defaultMessage": "Передавать авторизацию на upstream-сервер"
+		"defaultMessage": "Проксировать авторизацию"
 	},
 	"access-list.public": {
-		"defaultMessage": "Общедоступный"
+		"defaultMessage": "Публичный"
 	},
 	"access-list.public.subtitle": {
 		"defaultMessage": "Без аутентификации"
 	},
+	"access-list.rule-source.placeholder": {
+		"defaultMessage": "192.168.1.100 или 192.168.1.0/24 или 2001:0db8::/32"
+	},
 	"access-list.satisfy-any": {
 		"defaultMessage": "Любое совпадение"
 	},
@@ -38,12 +98,18 @@
 	"action.add-location": {
 		"defaultMessage": "Добавить маршрут"
 	},
+	"action.allow": {
+		"defaultMessage": "Разрешить"
+	},
 	"action.close": {
 		"defaultMessage": "Закрыть"
 	},
 	"action.delete": {
 		"defaultMessage": "Удалить"
 	},
+	"action.deny": {
+		"defaultMessage": "Запретить"
+	},
 	"action.disable": {
 		"defaultMessage": "Выключить"
 	},
@@ -68,6 +134,9 @@
 	"auditlogs": {
 		"defaultMessage": "Журнал аудита"
 	},
+	"auto": {
+		"defaultMessage": "Авто"
+	},
 	"cancel": {
 		"defaultMessage": "Отменить"
 	},
@@ -128,6 +197,9 @@
 	"certificates.dns.provider": {
 		"defaultMessage": "DNS-провайдер"
 	},
+	"certificates.dns.provider.placeholder": {
+		"defaultMessage": "Выберите провайдера..."
+	},
 	"certificates.dns.warning": {
 		"defaultMessage": "Этот раздел требует знаний о Certbot и его DNS-плагинах. Пожалуйста, обратитесь к документации соответствующих плагинов."
 	},
@@ -275,6 +347,9 @@
 	"domain-names.wildcards-not-supported": {
 		"defaultMessage": "Подстановочные домены не поддерживаются этим центром сертификации"
 	},
+	"domains.advanced": {
+		"defaultMessage": "Расширенные"
+	},
 	"domains.force-ssl": {
 		"defaultMessage": "Всегда SSL"
 	},
@@ -287,6 +362,9 @@
 	"domains.http2-support": {
 		"defaultMessage": "Поддержка HTTP/2"
 	},
+	"domains.trust-forwarded-proto": {
+		"defaultMessage": "Доверять X-Forwarded-Proto"
+	},
 	"domains.use-dns": {
 		"defaultMessage": "Проверка через DNS"
 	},
@@ -360,7 +438,7 @@
 		"defaultMessage": "Поддержка WebSocket"
 	},
 	"host.forward-port": {
-		"defaultMessage": "Порт перенаправления"
+		"defaultMessage": "Целевой порт"
 	},
 	"host.forward-scheme": {
 		"defaultMessage": "Схема"
@@ -383,6 +461,21 @@
 	"loading": {
 		"defaultMessage": "Загрузка…"
 	},
+	"login.2fa-code": {
+		"defaultMessage": "Код проверки"
+	},
+	"login.2fa-code-placeholder": {
+		"defaultMessage": "Введите код"
+	},
+	"login.2fa-description": {
+		"defaultMessage": "Введите код из приложения для аутентификации"
+	},
+	"login.2fa-title": {
+		"defaultMessage": "Двухфакторная аутентификация"
+	},
+	"login.2fa-verify": {
+		"defaultMessage": "Проверить"
+	},
 	"login.title": {
 		"defaultMessage": "Авторизация"
 	},
@@ -504,7 +597,7 @@
 		"defaultMessage": "Прокси-хост"
 	},
 	"proxy-host.forward-host": {
-		"defaultMessage": "Хост / IP перенаправления"
+		"defaultMessage": "Целевой хост"
 	},
 	"proxy-hosts": {
 		"defaultMessage": "Прокси-хосты"
@@ -513,13 +606,13 @@
 		"defaultMessage": "{count} {count, plural, one {прокси-хост} few {прокси-хоста} many {прокси-хостов} other {прокси-хоста}}"
 	},
 	"public": {
-		"defaultMessage": "Общедоступный"
+		"defaultMessage": "Публичный"
 	},
 	"redirection-host": {
 		"defaultMessage": "Редирект-хост"
 	},
 	"redirection-host.forward-domain": {
-		"defaultMessage": "Домен перенаправления"
+		"defaultMessage": "Целевой домен"
 	},
 	"redirection-host.forward-http-code": {
 		"defaultMessage": "HTTP-код"
@@ -530,6 +623,24 @@
 	"redirection-hosts.count": {
 		"defaultMessage": "{count} {count, plural, one {редирект-хост} few {редирект-хоста} many {редирект-хостов} other {редирект-хоста}}"
 	},
+	"redirection-hosts.http-code.300": {
+		"defaultMessage": "300 Множественный выбор"
+	},
+	"redirection-hosts.http-code.301": {
+		"defaultMessage": "301 Ресурс перемещен навсегда"
+	},
+	"redirection-hosts.http-code.302": {
+		"defaultMessage": "302 Ресурс временно перемещен"
+	},
+	"redirection-hosts.http-code.303": {
+		"defaultMessage": "303 Смотрите другой ресурс"
+	},
+	"redirection-hosts.http-code.307": {
+		"defaultMessage": "307 Временное перенаправление"
+	},
+	"redirection-hosts.http-code.308": {
+		"defaultMessage": "308 Ресурс перемещен навсегда"
+	},
 	"role.admin": {
 		"defaultMessage": "Администратор"
 	},
@@ -585,7 +696,10 @@
 		"defaultMessage": "Поток"
 	},
 	"stream.forward-host": {
-		"defaultMessage": "Хост перенаправления"
+		"defaultMessage": "Целевой хост"
+	},
+	"stream.forward-host.placeholder": {
+		"defaultMessage": "example.com или 10.0.0.1 или 2001:db8:3333:4444:5555:6666:7777:8888"
 	},
 	"stream.incoming-port": {
 		"defaultMessage": "Входящий порт"
@@ -605,6 +719,9 @@
 	"test": {
 		"defaultMessage": "Проверить"
 	},
+	"update-available": {
+		"defaultMessage": "Доступно обновление: {latestVersion}"
+	},
 	"user": {
 		"defaultMessage": "Пользователь"
 	},
@@ -647,6 +764,9 @@
 	"user.switch-light": {
 		"defaultMessage": "Включить светлую тему"
 	},
+	"user.two-factor": {
+		"defaultMessage": "Настроить 2FA"
+	},
 	"username": {
 		"defaultMessage": "Имя пользователя"
 	},
@@ -1,6 +1,12 @@
 import { IconDotsVertical, IconEdit, IconPower, IconTrash } from "@tabler/icons-react";
-import { createColumnHelper, getCoreRowModel, useReactTable } from "@tanstack/react-table";
-import { useMemo } from "react";
+import {
+	createColumnHelper,
+	getCoreRowModel,
+	getSortedRowModel,
+	type SortingState,
+	useReactTable,
+} from "@tanstack/react-table";
+import { useMemo, useState } from "react";
 import type { DeadHost } from "src/api/backend";
 import {
 	CertificateFormatter,
@@ -29,6 +35,7 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 		() => [
 			columnHelper.accessor((row: any) => row.owner, {
 				id: "owner",
+				enableSorting: false,
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <GravatarFormatter url={value ? value.avatar : ""} name={value ? value.name : ""} />;
@@ -40,6 +47,11 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			columnHelper.accessor((row: any) => row, {
 				id: "domainNames",
 				header: intl.formatMessage({ id: "column.source" }),
+				sortingFn: (a, b) => {
+					const aVal = a.original.domainNames?.[0] ?? "";
+					const bVal = b.original.domainNames?.[0] ?? "";
+					return aVal.localeCompare(bVal);
+				},
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <DomainsFormatter domains={value.domainNames} createdOn={value.createdOn} />;
@@ -47,6 +59,7 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			}),
 			columnHelper.accessor((row: any) => row.certificate, {
 				id: "certificate",
+				enableSorting: false,
 				header: intl.formatMessage({ id: "column.ssl" }),
 				cell: (info: any) => {
 					return <CertificateFormatter certificate={info.getValue()} />;
@@ -128,10 +141,15 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 		[columnHelper, onDelete, onEdit, onDisableToggle],
 	);

+	const [sorting, setSorting] = useState<SortingState>([]);
+
 	const tableInstance = useReactTable<DeadHost>({
 		columns,
 		data,
+		state: { sorting },
+		onSortingChange: setSorting,
 		getCoreRowModel: getCoreRowModel(),
+		getSortedRowModel: getSortedRowModel(),
 		rowCount: data.length,
 		meta: {
 			isFetching,
@@ -1,6 +1,12 @@
 import { IconDotsVertical, IconEdit, IconPower, IconTrash } from "@tabler/icons-react";
-import { createColumnHelper, getCoreRowModel, useReactTable } from "@tanstack/react-table";
-import { useMemo } from "react";
+import {
+	createColumnHelper,
+	getCoreRowModel,
+	getSortedRowModel,
+	type SortingState,
+	useReactTable,
+} from "@tanstack/react-table";
+import { useMemo, useState } from "react";
 import type { ProxyHost } from "src/api/backend";
 import {
 	AccessListFormatter,
@@ -30,6 +36,7 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 		() => [
 			columnHelper.accessor((row: any) => row.owner, {
 				id: "owner",
+				enableSorting: false,
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <GravatarFormatter url={value ? value.avatar : ""} name={value ? value.name : ""} />;
@@ -41,6 +48,11 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			columnHelper.accessor((row: any) => row, {
 				id: "domainNames",
 				header: intl.formatMessage({ id: "column.source" }),
+				sortingFn: (a, b) => {
+					const aVal = a.original.domainNames?.[0] ?? "";
+					const bVal = b.original.domainNames?.[0] ?? "";
+					return aVal.localeCompare(bVal);
+				},
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <DomainsFormatter domains={value.domainNames} createdOn={value.createdOn} />;
@@ -49,6 +61,11 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			columnHelper.accessor((row: any) => row, {
 				id: "forwardHost",
 				header: intl.formatMessage({ id: "column.destination" }),
+				sortingFn: (a, b) => {
+					const aVal = `${a.original.forwardHost}:${a.original.forwardPort}`;
+					const bVal = `${b.original.forwardHost}:${b.original.forwardPort}`;
+					return aVal.localeCompare(bVal);
+				},
 				cell: (info: any) => {
 					const value = info.getValue();
 					return `${value.forwardScheme}://${value.forwardHost}:${value.forwardPort}`;
@@ -56,6 +73,7 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			}),
 			columnHelper.accessor((row: any) => row.certificate, {
 				id: "certificate",
+				enableSorting: false,
 				header: intl.formatMessage({ id: "column.ssl" }),
 				cell: (info: any) => {
 					return <CertificateFormatter certificate={info.getValue()} />;
@@ -63,6 +81,7 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			}),
 			columnHelper.accessor((row: any) => row.accessList, {
 				id: "accessList",
+				enableSorting: false,
 				header: intl.formatMessage({ id: "column.access" }),
 				cell: (info: any) => {
 					return <AccessListFormatter access={info.getValue()} />;
@@ -144,10 +163,15 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 		[columnHelper, onEdit, onDisableToggle, onDelete],
 	);

+	const [sorting, setSorting] = useState<SortingState>([]);
+
 	const tableInstance = useReactTable<ProxyHost>({
 		columns,
 		data,
+		state: { sorting },
+		onSortingChange: setSorting,
 		getCoreRowModel: getCoreRowModel(),
+		getSortedRowModel: getSortedRowModel(),
 		rowCount: data.length,
 		meta: {
 			isFetching,
@@ -99,14 +99,27 @@ export default function TableWrapper() {
 					isFiltered={!!search}
 					isFetching={isFetching}
 					onEdit={(id: number) => showProxyHostModal(id)}
-					onDelete={(id: number) =>
+					onDelete={(id: number) => {
+						const host = data?.find((h) => h.id === id);
 						showDeleteConfirmModal({
 							title: <T id="object.delete" tData={{ object: "proxy-host" }} />,
 							onConfirm: () => handleDelete(id),
 							invalidations: [["proxy-hosts"], ["proxy-host", id]],
-							children: <T id="object.delete.content" tData={{ object: "proxy-host" }} />,
-						})
-					}
+							children: (
+								<>
+									<T id="object.delete.content" tData={{ object: "proxy-host" }} />
+									{host?.domainNames?.length ? (
+										<div className="mt-2 fw-bold text-break">{host.domainNames.join(", ")}</div>
+									) : null}
+									{host?.forwardHost ? (
+										<div className="mt-1 text-muted small">
+											({host.forwardScheme}://{host.forwardHost}:{host.forwardPort})
+										</div>
+									) : null}
+								</>
+							),
+						});
+					}}
 					onDisableToggle={handleDisableToggle}
 					onNew={() => showProxyHostModal("new")}
 				/>
@@ -1,6 +1,12 @@
 import { IconDotsVertical, IconEdit, IconPower, IconTrash } from "@tabler/icons-react";
-import { createColumnHelper, getCoreRowModel, useReactTable } from "@tanstack/react-table";
-import { useMemo } from "react";
+import {
+	createColumnHelper,
+	getCoreRowModel,
+	getSortedRowModel,
+	type SortingState,
+	useReactTable,
+} from "@tanstack/react-table";
+import { useMemo, useState } from "react";
 import type { RedirectionHost } from "src/api/backend";
 import {
 	CertificateFormatter,
@@ -29,6 +35,7 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 		() => [
 			columnHelper.accessor((row: any) => row.owner, {
 				id: "owner",
+				enableSorting: false,
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <GravatarFormatter url={value ? value.avatar : ""} name={value ? value.name : ""} />;
@@ -40,6 +47,11 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			columnHelper.accessor((row: any) => row, {
 				id: "domainNames",
 				header: intl.formatMessage({ id: "column.source" }),
+				sortingFn: (a, b) => {
+					const aVal = a.original.domainNames?.[0] ?? "";
+					const bVal = b.original.domainNames?.[0] ?? "";
+					return aVal.localeCompare(bVal);
+				},
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <DomainsFormatter domains={value.domainNames} createdOn={value.createdOn} />;
@@ -68,6 +80,7 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 			}),
 			columnHelper.accessor((row: any) => row.certificate, {
 				id: "certificate",
+				enableSorting: false,
 				header: intl.formatMessage({ id: "column.ssl" }),
 				cell: (info: any) => {
 					return <CertificateFormatter certificate={info.getValue()} />;
@@ -149,10 +162,15 @@ export default function Table({ data, isFetching, onEdit, onDelete, onDisableTog
 		[columnHelper, onEdit, onDisableToggle, onDelete],
 	);

+	const [sorting, setSorting] = useState<SortingState>([]);
+
 	const tableInstance = useReactTable<RedirectionHost>({
 		columns,
 		data,
+		state: { sorting },
+		onSortingChange: setSorting,
 		getCoreRowModel: getCoreRowModel(),
+		getSortedRowModel: getSortedRowModel(),
 		rowCount: data.length,
 		meta: {
 			isFetching,
@@ -1,6 +1,12 @@
 import { IconDotsVertical, IconEdit, IconPower, IconTrash } from "@tabler/icons-react";
-import { createColumnHelper, getCoreRowModel, useReactTable } from "@tanstack/react-table";
-import { useMemo } from "react";
+import {
+	createColumnHelper,
+	getCoreRowModel,
+	getSortedRowModel,
+	type SortingState,
+	useReactTable,
+} from "@tanstack/react-table";
+import { useMemo, useState } from "react";
 import type { Stream } from "src/api/backend";
 import {
 	CertificateFormatter,
@@ -29,6 +35,7 @@ export default function Table({ data, isFetching, isFiltered, onEdit, onDelete,
 		() => [
 			columnHelper.accessor((row: any) => row.owner, {
 				id: "owner",
+				enableSorting: false,
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <GravatarFormatter url={value ? value.avatar : ""} name={value ? value.name : ""} />;
@@ -40,6 +47,7 @@ export default function Table({ data, isFetching, isFiltered, onEdit, onDelete,
 			columnHelper.accessor((row: any) => row, {
 				id: "incomingPort",
 				header: intl.formatMessage({ id: "column.incoming-port" }),
+				sortingFn: (a, b) => (a.original.incomingPort ?? 0) - (b.original.incomingPort ?? 0),
 				cell: (info: any) => {
 					const value = info.getValue();
 					return <ValueWithDateFormatter value={value.incomingPort} createdOn={value.createdOn} />;
@@ -48,6 +56,11 @@ export default function Table({ data, isFetching, isFiltered, onEdit, onDelete,
 			columnHelper.accessor((row: any) => row, {
 				id: "forwardHttpCode",
 				header: intl.formatMessage({ id: "column.destination" }),
+				sortingFn: (a, b) => {
+					const aVal = `${a.original.forwardingHost}:${a.original.forwardingPort}`;
+					const bVal = `${b.original.forwardingHost}:${b.original.forwardingPort}`;
+					return aVal.localeCompare(bVal);
+				},
 				cell: (info: any) => {
 					const value = info.getValue();
 					return `${value.forwardingHost}:${value.forwardingPort}`;
@@ -55,6 +68,7 @@ export default function Table({ data, isFetching, isFiltered, onEdit, onDelete,
 			}),
 			columnHelper.accessor((row: any) => row, {
 				id: "tcpForwarding",
+				enableSorting: false,
 				header: intl.formatMessage({ id: "column.protocol" }),
 				cell: (info: any) => {
 					const value = info.getValue();
@@ -76,6 +90,7 @@ export default function Table({ data, isFetching, isFiltered, onEdit, onDelete,
 			}),
 			columnHelper.accessor((row: any) => row.certificate, {
 				id: "certificate",
+				enableSorting: false,
 				header: intl.formatMessage({ id: "column.ssl" }),
 				cell: (info: any) => {
 					return <CertificateFormatter certificate={info.getValue()} />;
@@ -130,7 +145,7 @@ export default function Table({ data, isFetching, isFiltered, onEdit, onDelete,
 										}}
 									>
 										<IconPower size={16} />
-										<T id="action.disable" />
+										<T id={info.row.original.enabled ? "action.disable" : "action.enable"} />
 									</a>
 									<div className="dropdown-divider" />
 									<a
@@ -157,10 +172,15 @@ export default function Table({ data, isFetching, isFiltered, onEdit, onDelete,
 		[columnHelper, onEdit, onDisableToggle, onDelete],
 	);

+	const [sorting, setSorting] = useState<SortingState>([]);
+
 	const tableInstance = useReactTable<Stream>({
 		columns,
 		data,
+		state: { sorting },
+		onSortingChange: setSorting,
 		getCoreRowModel: getCoreRowModel(),
+		getSortedRowModel: getSortedRowModel(),
 		rowCount: data.length,
 		meta: {
 			isFetching,
@@ -7,9 +7,11 @@
 			"DOM",
 			"DOM.Iterable"
 		],
+		"types": [
+			"node"
+		],
 		"module": "ESNext",
 		"skipLibCheck": true,
-		"baseUrl": ".",
 		/* Bundler mode */
 		"moduleResolution": "bundler",
 		"allowImportingTsExtensions": true,
@@ -1,7 +1,6 @@
 import react from "@vitejs/plugin-react";
 import { defineConfig } from "vite";
 import checker from "vite-plugin-checker";
-import tsconfigPaths from "vite-tsconfig-paths";
 import "vitest/config";
 import { execFile } from "node:child_process";

@@ -45,8 +44,10 @@ export default defineConfig({
 			// e.g. use TypeScript check
 			typescript: true,
 		}),
-		tsconfigPaths(),
 	],
+	resolve: {
+		tsconfigPaths: true,
+	},
 	server: {
 		host: true,
 		port: 5173,
@@ -52,7 +52,7 @@ jq --arg a "$PDNS_IP" '.servers[0].upstreams[1].upstream = $a' "$LOCAL_DNSROUTER

 docker compose up -d dnsrouter
 DNSROUTER_IP=$(get_container_ip "dnsrouter")
-echo -e "${BLUE}❯ ${YELLOW}DNS Router IP is ${DNSROUTER_IP}"
+echo -e "${BLUE}❯ ${YELLOW}DNS Router IP is ${DNSROUTER_IP}${RESET}"

 if [ "${DNSROUTER_IP:-}" = "" ]; then
 	echo -e "${RED}❯ ERROR: DNS Router IP is not set${RESET}"
@@ -76,7 +76,8 @@ bash "$DIR/../wait-healthy" "$(docker compose ps --all -q fullstack)" 120

 # Run tests
 rm -rf "$DIR/../../test/results"
-docker compose up --build cypress
+docker compose build cypress
+docker compose up cypress

 # Get results
 docker cp -L "$(docker compose ps --all -q cypress):/test/results" "$DIR/../../test/"
@@ -88,4 +89,3 @@ if [ "$2" = "cleanup" ]; then
 fi

 echo -e "${BLUE}❯ ${GREEN}Fullstack cypress testing complete${RESET}"
-
@@ -1,4 +1,4 @@
-FROM cypress/included:15.11.0
+FROM cypress/included:15.15.0

 # Disable Cypress CLI colors
 ENV FORCE_COLOR=0
@@ -2,6 +2,7 @@ import { defineConfig } from 'cypress';
 import pluginSetup from '../plugins/index.mjs';

 export default defineConfig({
+	allowCypressEnv: false,
 	requestTimeout: 30000,
 	defaultCommandTimeout: 20000,
 	reporter: "cypress-multi-reporters",
@@ -2,6 +2,7 @@ import { defineConfig } from 'cypress';
 import pluginSetup from '../plugins/index.mjs';

 export default defineConfig({
+	allowCypressEnv: false,
 	requestTimeout: 30000,
 	defaultCommandTimeout: 20000,
 	reporter: "cypress-multi-reporters",
@@ -0,0 +1,28 @@
+/// <reference types="cypress" />
+
+// Only tested once in the sqlite stack
+
+describe('CertbotPlugins', { tags: '@isolated' }, () => {
+	it('Should install all certbot plugins', () => {
+		cy.env(['stack']).then(({ stack }) => {
+			cy.log(`CertbotPlugins.cy.js - Running tests for stack: ${stack}`);
+			if (stack === 'sqlite') {
+				cy.task('backendApiGet', {
+					path:  '/api/ci/certbot-plugins',
+				}).then((data) => {
+					expect(data).to.be.an('object');
+
+					// Install each plugin
+					for (const plugin of Object.keys(data)) {
+						cy.log(`Installing plugin: ${plugin}`);
+						cy.task('backendApiPost', {
+							path: `/api/ci/certbot-plugins/${plugin}`,
+						}).then((result) => {
+							expect(result).to.be.true;
+						});
+					}
+				});
+			}
+		});
+	});
+});
@@ -4,7 +4,16 @@ describe('Certificates endpoints', () => {
 	let token;
 	let certID;

+	const certFile = 'test.example.com.pem';
+	const keyFile = 'test.example.com-key.pem';
+
 	before(() => {
+		cy.createCustomCerts({
+			domain: 'test.example.com',
+			certFile,
+			keyFile,
+		})
+
 		cy.resetUsers();
 		cy.getToken().then((tok) => {
 			token = tok;
@@ -16,8 +25,8 @@ describe('Certificates endpoints', () => {
 			token: token,
 			path:  '/api/nginx/certificates/validate',
 			files:  {
-				certificate: 'test.example.com.pem',
-				certificate_key: 'test.example.com-key.pem',
+				certificate: certFile,
+				certificate_key: keyFile,
 			},
 		}).then((data) => {
 			cy.validateSwaggerSchema('post', 200, '/nginx/certificates/validate', data);
@@ -45,8 +54,8 @@ describe('Certificates endpoints', () => {
 				token: token,
 				path:  `/api/nginx/certificates/${certID}/upload`,
 				files:  {
-					certificate: 'test.example.com.pem',
-					certificate_key: 'test.example.com-key.pem',
+					certificate: certFile,
+					certificate_key: keyFile,
 				},
 			}).then((data) => {
 				cy.validateSwaggerSchema('post', 200, '/nginx/certificates/{certID}/upload', data);
@@ -1,65 +0,0 @@
-/// <reference types="cypress" />
-
-describe('LDAP with Authentik', () => {
-	let _token;
-	if (Cypress.env('skipStackCheck') === 'true' || Cypress.env('stack') === 'postgres') {
-
-		before(() => {
-			cy.resetUsers();
-			cy.getToken().then((tok) => {
-				_token = tok;
-
-				// cy.task('backendApiPut', {
-				// 	token: token,
-				// 	path:  '/api/settings/ldap-auth',
-				// 	data:  {
-				// 		value: {
-				// 			host: 'authentik-ldap:3389',
-				// 			base_dn: 'ou=users,DC=ldap,DC=goauthentik,DC=io',
-				// 			user_dn: 'cn={{USERNAME}},ou=users,DC=ldap,DC=goauthentik,DC=io',
-				// 			email_property: 'mail',
-				// 			name_property: 'sn',
-				// 			self_filter: '(&(cn={{USERNAME}})(ak-active=TRUE))',
-				// 			auto_create_user: true
-				// 		}
-				// 	}
-				// }).then((data) => {
-				// 	cy.validateSwaggerSchema('put', 200, '/settings/{name}', data);
-				// 	expect(data.result).to.have.property('id');
-				// 	expect(data.result.id).to.be.greaterThan(0);
-				// });
-
-				// cy.task('backendApiPut', {
-				// 	token: token,
-				// 	path:  '/api/settings/auth-methods',
-				// 	data:  {
-				// 		value: [
-				// 			'local',
-				// 			'ldap'
-				// 		]
-				// 	}
-				// }).then((data) => {
-				// 	cy.validateSwaggerSchema('put', 200, '/settings/{name}', data);
-				// 	expect(data.result).to.have.property('id');
-				// 	expect(data.result.id).to.be.greaterThan(0);
-				// });
-			});
-		});
-
-		it.skip('Should log in with LDAP', () => {
-			// cy.task('backendApiPost', {
-			// 	token: token,
-			// 	path:  '/api/auth',
-			// 	data:  {
-			// 		// Authentik LDAP creds:
-			// 		type: 'ldap',
-			// 		identity: 'cypress',
-			// 		secret: 'fqXBfUYqHvYqiwBHWW7f'
-			// 	}
-			// }).then((data) => {
-			// 	cy.validateSwaggerSchema('post', 200, '/auth', data);
-			// 	expect(data.result).to.have.property('token');
-			// });
-		});
-	}
-});
@@ -1,97 +0,0 @@
-/// <reference types="cypress" />
-
-describe('OAuth with Authentik', () => {
-	let _token;
-	if (Cypress.env('skipStackCheck') === 'true' || Cypress.env('stack') === 'postgres') {
-
-		before(() => {
-			cy.getToken().then((tok) => {
-				_token = tok;
-
-				// cy.task('backendApiPut', {
-				// 	token: token,
-				// 	path:  '/api/settings/oauth-auth',
-				// 	data:  {
-				// 		value: {
-				// 			client_id: '7iO2AvuUp9JxiSVkCcjiIbQn4mHmUMBj7yU8EjqU',
-				// 			client_secret: 'VUMZzaGTrmXJ8PLksyqzyZ6lrtz04VvejFhPMBP9hGZNCMrn2LLBanySs4ta7XGrDr05xexPyZT1XThaf4ubg00WqvHRVvlu4Naa1aMootNmSRx3VAk6RSslUJmGyHzq',
-				// 			authorization_url: 'http://authentik:9000/application/o/authorize/',
-				// 			resource_url: 'http://authentik:9000/application/o/userinfo/',
-				// 			token_url: 'http://authentik:9000/application/o/token/',
-				// 			logout_url: 'http://authentik:9000/application/o/npm/end-session/',
-				// 			identifier: 'preferred_username',
-				// 			scopes: [],
-				// 			auto_create_user: true
-				// 		}
-				// 	}
-				// }).then((data) => {
-				// 	cy.validateSwaggerSchema('put', 200, '/settings/{name}', data);
-				// 	expect(data.result).to.have.property('id');
-				// 	expect(data.result.id).to.be.greaterThan(0);
-				// });
-
-				// cy.task('backendApiPut', {
-				// 	token: token,
-				// 	path:  '/api/settings/auth-methods',
-				// 	data:  {
-				// 		value: [
-				// 			'local',
-				// 			'oauth'
-				// 		]
-				// 	}
-				// }).then((data) => {
-				// 	cy.validateSwaggerSchema('put', 200, '/settings/{name}', data);
-				// 	expect(data.result).to.have.property('id');
-				// 	expect(data.result.id).to.be.greaterThan(0);
-				// });
-			});
-		});
-
-		it.skip('Should log in with OAuth', () => {
-			// cy.task('backendApiGet', {
-			// 	path:  '/oauth/login?redirect_base=' + encodeURI(Cypress.config('baseUrl')),
-			// }).then((data) => {
-			// 	expect(data).to.have.property('result');
-
-			// 	cy.origin('http://authentik:9000', {args: data.result}, (url) => {
-			// 		cy.visit(url);
-			// 		cy.get('ak-flow-executor')
-			// 		.shadow()
-			// 		.find('ak-stage-identification')
-			// 		.shadow()
-			// 		.find('input[name="uidField"]', { visible: true })
-			// 		.type('cypress');
-
-			// 	cy.get('ak-flow-executor')
-			// 		.shadow()
-			// 		.find('ak-stage-identification')
-			// 		.shadow()
-			// 		.find('button[type="submit"]', { visible: true })
-			// 		.click();
-
-			// 	cy.get('ak-flow-executor')
-			// 		.shadow()
-			// 		.find('ak-stage-password')
-			// 		.shadow()
-			// 		.find('input[name="password"]', { visible: true })
-			// 		.type('fqXBfUYqHvYqiwBHWW7f');
-
-			// 	cy.get('ak-flow-executor')
-			// 		.shadow()
-			// 		.find('ak-stage-password')
-			// 		.shadow()
-			// 		.find('button[type="submit"]', { visible: true })
-			// 		.click();
-			// 	})
-
-			// 	// we should be logged in
-			// 	cy.get('#root p.chakra-text')
-			// 		.first()
-			// 		.should('have.text', 'Nginx Proxy Manager');
-
-			// 	// logout:
-			// 	cy.clearLocalStorage();
-			// });
-		});
-	}
-});
@@ -3,7 +3,16 @@
 describe('Streams', () => {
 	let token;

+	const certFile = 'website1.pem';
+	const keyFile = 'website1.key.pem';
+
 	before(() => {
+		cy.createCustomCerts({
+			domain: 'website1.example.com',
+			certFile,
+			keyFile,
+		})
+
 		cy.resetUsers();
 		cy.getToken().then((tok) => {
 			token = tok;
@@ -22,15 +31,6 @@ describe('Streams', () => {
 			});
 		});

-		// Create a custom cert pair
-		cy.exec('mkcert -cert-file=/test/cypress/fixtures/website1.pem -key-file=/test/cypress/fixtures/website1.key.pem website1.example.com').then((result) => {
-			expect(result.exitCode).to.eq(0);
-			// Install CA
-			cy.exec('mkcert -install').then((result) => {
-				expect(result.exitCode).to.eq(0);
-			});
-		});
-
 		cy.exec('rm -f /test/results/testssl.json');
 	});

@@ -134,8 +134,8 @@ describe('Streams', () => {
 				token: token,
 				path:  `/api/nginx/certificates/${certID}/upload`,
 				files:  {
-					certificate: 'website1.pem',
-					certificate_key: 'website1.key.pem',
+					certificate: certFile,
+					certificate_key: keyFile,
 				},
 			}).then((data) => {
 				cy.validateSwaggerSchema('post', 200, '/nginx/certificates/{certID}/upload', data);
@@ -0,0 +1 @@
+*.pem
@@ -1,28 +0,0 @@
-----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC1n9j9C5Bes1nd
-qACDckERauxXVNKCnUlUM1buGBx1xc+j2e2Ar23wUJJuWBY18VfT8yqfqVDktO2w
-rbmvZvLuPmXePOKbIKS+XXh+2NG9L5bDG9rwGFCRXnbQj+GWCdMfzx14+CR1IHge
-Yz6Cv/Si2/LJPCh/CoBfM4hUQJON3lxAWrWBpdbZnKYMrxuPBRfW9OuzTbCVXToQ
-oxRAHiOR9081Xn1WeoKr7kVBIa5UphlvWXa12w1YmUwJu7YndnJGIavLWeNCVc7Z
-Eo+nS8Wr/4QWicatIWZXpVaEOPhRoeplQDxNWg5b/Q26rYoVd7PrCmRs7sVcH79X
-zGONeH1PAgMBAAECggEAANb3Wtwl07pCjRrMvc7WbC0xYIn82yu8/g2qtjkYUJcU
-ia5lQbYN7RGCS85Oc/tkq48xQEG5JQWNH8b918jDEMTrFab0aUEyYcru1q9L8PL6
-YHaNgZSrMrDcHcS8h0QOXNRJT5jeGkiHJaTR0irvB526tqF3knbK9yW22KTfycUe
-a0Z9voKn5xRk1DCbHi/nk2EpT7xnjeQeLFaTIRXbS68omkr4YGhwWm5OizoyEGZu
-W0Zum5BkQyMr6kor3wdxOTG97ske2rcyvvHi+ErnwL0xBv0qY0Dhe8DpuXpDezqw
-o72yY8h31Fu84i7sAj24YuE5Df8DozItFXQpkgbQ6QKBgQDPrufhvIFm2S/MzBdW
-H8JxY7CJlJPyxOvc1NIl9RczQGAQR90kx52cgIcuIGEG6/wJ/xnGfMmW40F0DnQ+
-N+oLgB9SFxeLkRb7s9Z/8N3uIN8JJFYcerEOiRQeN2BXEEWJ7bUThNtsVrAcKoUh
-ELsDmnHW/3V+GKwhd0vpk842+wKBgQDf4PGLG9PTE5tlAoyHFodJRd2RhTJQkwsU
-MDNjLJ+KecLv+Nl+QiJhoflG1ccqtSFlBSCG067CDQ5LV0xm3mLJ7pfJoMgjcq31
-qjEmX4Ls91GuVOPtbwst3yFKjsHaSoKB5fBvWRcKFpBUezM7Qcw2JP3+dQT+bQIq
-cMTkRWDSvQKBgQDOdCQFDjxg/lR7NQOZ1PaZe61aBz5P3pxNqa7ClvMaOsuEQ7w9
-vMYcdtRq8TsjA2JImbSI0TIg8gb2FQxPcYwTJKl+FICOeIwtaSg5hTtJZpnxX5LO
-utTaC0DZjNkTk5RdOdWA8tihyUdGqKoxJY2TVmwGe2rUEDjFB++J4inkEwKBgB6V
-g0nmtkxanFrzOzFlMXwgEEHF+Xaqb9QFNa/xs6XeNnREAapO7JV75Cr6H2hFMFe1
-mJjyqCgYUoCWX3iaHtLJRnEkBtNY4kzyQB6m46LtsnnnXO/dwKA2oDyoPfFNRoDq
-YatEd3JIXNU9s2T/+x7WdOBjKhh72dTkbPFmTPDdAoGAU6rlPBevqOFdObYxdPq8
-EQWu44xqky3Mf5sBpOwtu6rqCYuziLiN7K4sjN5GD5mb1cEU+oS92ZiNcUQ7MFXk
-8yTYZ7U0VcXyAcpYreWwE8thmb0BohJBr+Mp3wLTx32x0HKdO6vpUa0d35LUTUmM
-RrKmPK/msHKK/sVHiL+NFqo=
-----END PRIVATE KEY-----
@@ -1,26 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIEYDCCAsigAwIBAgIRAPoSC0hvitb26ODMlsH6YbowDQYJKoZIhvcNAQELBQAw
-gZExHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTEzMDEGA1UECwwqamN1
-cm5vd0BKYW1pZXMtTGFwdG9wLmxvY2FsIChKYW1pZSBDdXJub3cpMTowOAYDVQQD
-DDFta2NlcnQgamN1cm5vd0BKYW1pZXMtTGFwdG9wLmxvY2FsIChKYW1pZSBDdXJu
-b3cpMB4XDTI0MTAwOTA3MjIxN1oXDTI3MDEwOTA3MjIxN1owXjEnMCUGA1UEChMe
-bWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMTMwMQYDVQQLDCpqY3Vybm93
-QEphbWllcy1MYXB0b3AubG9jYWwgKEphbWllIEN1cm5vdykwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQC1n9j9C5Bes1ndqACDckERauxXVNKCnUlUM1bu
-GBx1xc+j2e2Ar23wUJJuWBY18VfT8yqfqVDktO2wrbmvZvLuPmXePOKbIKS+XXh+
-2NG9L5bDG9rwGFCRXnbQj+GWCdMfzx14+CR1IHgeYz6Cv/Si2/LJPCh/CoBfM4hU
-QJON3lxAWrWBpdbZnKYMrxuPBRfW9OuzTbCVXToQoxRAHiOR9081Xn1WeoKr7kVB
-Ia5UphlvWXa12w1YmUwJu7YndnJGIavLWeNCVc7ZEo+nS8Wr/4QWicatIWZXpVaE
-OPhRoeplQDxNWg5b/Q26rYoVd7PrCmRs7sVcH79XzGONeH1PAgMBAAGjZTBjMA4G
-A1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAfBgNVHSMEGDAWgBSB
-/vfmBUd4W7CvyEMl7YpMVQs8vTAbBgNVHREEFDASghB0ZXN0LmV4YW1wbGUuY29t
-MA0GCSqGSIb3DQEBCwUAA4IBgQASwON/jPAHzcARSenY0ZGY1m5OVTYoQ/JWH0oy
-l8SyFCQFEXt7UHDD/eTtLT0vMyc190nP57P8lTnZGf7hSinZz1B1d6V4cmzxpk0s
-VXZT+irL6bJVJoMBHRpllKAhGULIo33baTrWFKA0oBuWx4AevSWKcLW5j87kEawn
-ATCuMQ1I3ifR1mSlB7X8fb+vF+571q0NGuB3a42j6rdtXJ6SmH4+9B4qO0sfHDNt
-IImpLCH/tycDpcYrGSCn1QrekFG1bSEh+Bb9i8rqMDSDsYrTFPZTuOQ3EtjGni9u
-m+rEP3OyJg+md8c+0LVP7/UU4QWWnw3/Wolo5kSCxE8vNTFqi4GhVbdLnUtcIdTV
-XxuR6cKyW87Snj1a0nG76ZLclt/akxDhtzqeV60BO0p8pmiev8frp+E94wFNYCmp
-1cr3CnMEGRaficLSDFC6EBENzlZW2BQT6OMIV+g0NBgSyQe39s2zcdEl5+SzDVuw
-hp8bJUp/QN7pnOVCDbjTQ+HVMXw=
-----END CERTIFICATE-----
@@ -1,3 +1,4 @@
+import { plugin as cypressGrepPlugin } from "@cypress/grep/plugin";
 import { SwaggerValidation } from "@jc21/cypress-swagger-validation";
 import chalk from "chalk";
 import backendTask from "./backendApi/task.mjs";
@@ -11,6 +12,8 @@ export default (on, config) => {
 		);
 	}

+	cypressGrepPlugin(config);
+
 	// Plugin Events
 	on("task", SwaggerValidation(config));
 	on("task", backendTask(config));
@@ -22,6 +25,11 @@ export default (on, config) => {
 			return null;
 		},
 	});
+	on("task", {
+		getFixturesFolder() {
+			return config.fixturesFolder;
+		},
+	});

 	return config;
 };
@@ -48,14 +48,16 @@ Cypress.Commands.add("validateSwaggerFile", (url, savePath) => {
 * @param {*}       data          The API response data to check against the swagger schema
 */
 Cypress.Commands.add('validateSwaggerSchema', (method, code, path, data) => {
-	cy.task('validateSwaggerSchema', {
-		file:           Cypress.env('swaggerBase'),
-		endpoint:       path,
-		method:         method,
-		statusCode:     code,
-		responseSchema: data,
-		verbose:        true
-	}).should('equal', null);
+	cy.env(['swaggerBase']).then(({ swaggerBase }) => {
+		cy.task('validateSwaggerSchema', {
+			file:           swaggerBase,
+			endpoint:       path,
+			method:         method,
+			statusCode:     code,
+			responseSchema: data,
+			verbose:        true
+		}).should('equal', null);
+	});
 });

 Cypress.Commands.add('createInitialUser', (defaultUser) => {
@@ -151,3 +153,32 @@ Cypress.Commands.add('waitForCertificateStatus', (token, certID, expected, timeo
 		interval: 5000
 	});
 });
+
+// Creates CA files for testing, if they already exist they will be deleted
+// and recreated with the same content. This is to ensure that the files exist
+// for testing and are in a known state.
+Cypress.Commands.add('createCustomCerts', ({domain, certFile, keyFile}) => {
+	domain = domain || 'website1.example.com';
+	certFile = certFile || 'website1.pem';
+	keyFile = keyFile || 'website1.key.pem';
+
+	return cy.task('getFixturesFolder').then((fixturesFolder) => {
+		const fullCertFile = `${fixturesFolder}/${certFile}`;
+		const fullKeyFile = `${fixturesFolder}/${keyFile}`;
+		const cmd = `mkcert -cert-file="${fullCertFile}" -key-file="${fullKeyFile}" "${domain}"`;
+		cy.log(`Creating custom certs with command: ${cmd}`);
+		return cy.exec(cmd).then((result) => {
+			cy.log(`mkcert output:\n${JSON.stringify(result)}`);
+			expect(result.exitCode).to.eq(0);
+			return cy.exec('mkcert -install').then((result2) => {
+				cy.log(`mkcert install output:\n${JSON.stringify(result2)}`);
+				expect(result2.exitCode).to.eq(0);
+			}).then(() => {
+				return cy.wrap({
+					certFile: fullCertFile,
+					keyFile: fullKeyFile,
+				});
+			});
+		});
+	});
+});
@@ -1,6 +1,10 @@
-import './commands.mjs';
+import "./commands.mjs";

-Cypress.on('uncaught:exception', (/*err, runnable*/) => {
+import { register as registerCypressGrep } from "@cypress/grep";
+
+registerCypressGrep();
+
+Cypress.on("uncaught:exception", (/*err, runnable*/) => {
 	// returning false here prevents Cypress from
 	// failing the test
 	return false;
@@ -0,0 +1,100 @@
+import fs from "node:fs";
+import FormData from "form-data";
+import Client from "./client.mjs";
+import logger from "./logger.mjs";
+
+export default (config) => {
+	logger("Client Ready using", config.baseUrl);
+
+	return {
+		/**
+		 * @param   {object}    options
+		 * @param   {string}    options.path         API path
+		 * @param   {string}    [options.token]      JWT
+		 * @param   {bool}      [options.returnOnError] If true, will return instead of throwing errors
+		 * @returns {string}
+		 */
+		backendApiGet: (options) => {
+			const api = new Client(config);
+			api.setToken(options.token);
+			return api.request("get", options.path, options.returnOnError || false);
+		},
+
+		/**
+		 * @param   {object}    options
+		 * @param   {string}    options.token        JWT
+		 * @param   {string}    options.path         API path
+		 * @param   {object}    options.data
+		 * @param   {bool}      [options.returnOnError] If true, will return instead of throwing errors
+		 * @returns {string}
+		 */
+		backendApiPost: (options) => {
+			const api = new Client(config);
+			api.setToken(options.token);
+			return api.request(
+				"post",
+				options.path,
+				options.returnOnError || false,
+				options.data,
+			);
+		},
+
+		/**
+		 * @param   {object}    options
+		 * @param   {string}    options.token        JWT
+		 * @param   {string}    options.path         API path
+		 * @param   {object}    options.files
+		 * @param   {bool}      [options.returnOnError] If true, will return instead of throwing errors
+		 * @returns {string}
+		 */
+		backendApiPostFiles: (options) => {
+			const api = new Client(config);
+			api.setToken(options.token);
+
+			const form = new FormData();
+			for (const [key, value] of Object.entries(options.files)) {
+				form.append(
+					key,
+					fs.createReadStream(`${config.fixturesFolder}/${value}`),
+				);
+			}
+			return api.postForm(options.path, form, options.returnOnError || false);
+		},
+
+		/**
+		 * @param   {object}    options
+		 * @param   {string}    options.token        JWT
+		 * @param   {string}    options.path         API path
+		 * @param   {object}    options.data
+		 * @param   {bool}      [options.returnOnError] If true, will return instead of throwing errors
+		 * @returns {string}
+		 */
+		backendApiPut: (options) => {
+			const api = new Client(config);
+			api.setToken(options.token);
+			return api.request(
+				"put",
+				options.path,
+				options.returnOnError || false,
+				options.data,
+			);
+		},
+
+		/**
+		 * @param   {object}    options
+		 * @param   {string}    options.token        JWT
+		 * @param   {string}    options.path         API path
+		 * @param   {bool}      [options.returnOnError] If true, will return instead of throwing errors
+		 * @returns {string}
+		 */
+		backendApiDelete: (options) => {
+			const api = new Client(config);
+			api.setToken(options.token);
+			return api.request(
+				"delete",
+				options.path,
+				options.returnOnError || false,
+			);
+		},
+	};
+};
@@ -4,19 +4,20 @@
 	"description": "",
 	"main": "index.js",
 	"dependencies": {
+		"@cypress/grep": "^6.0.0",
 		"@jc21/cypress-swagger-validation": "^0.3.2",
-		"@quobix/vacuum": "^0.24.0",
-		"axios": "^1.13.6",
+		"@quobix/vacuum": "^0.26.4",
+		"axios": "^1.16.0",
 		"chalk": "^5.6.2",
-		"cypress": "^15.11.0",
+		"cypress": "^15.15.0",
 		"cypress-multi-reporters": "^2.0.5",
 		"cypress-wait-until": "^3.0.2",
-		"eslint": "^10.0.2",
+		"eslint": "^10.3.0",
 		"eslint-plugin-align-assignments": "^1.1.2",
-		"eslint-plugin-chai-friendly": "^1.1.0",
-		"eslint-plugin-cypress": "^6.1.0",
+		"eslint-plugin-chai-friendly": "^1.2.0",
+		"eslint-plugin-cypress": "^6.4.1",
 		"form-data": "^4.0.5",
-		"lodash": "^4.17.23",
+		"lodash": "^4.18.1",
 		"mocha": "^11.7.5",
 		"mocha-junit-reporter": "^2.2.1"
 	},
@@ -1 +1 @@
 .14.0
 .15.1