Phase 3: env masking, image updates, port conflicts, resources, templates (0.3.0)

Backend:
- update_service: registry manifest digest check (Docker Hub/ghcr/lscr/private
  v2 token auth) vs local RepoDigests; in-memory cache + background loop
- port_service: parse compose ports, check /proc/net/tcp[6] + docker bindings
- template_service + bundled templates (jellyfin/vaultwarden/uptime-kuma/
  paperless-ngx/gitea) with {{VAR}} placeholders; custom templates in DB
- compose_edit set_resources (deploy.resources.limits/reservations)
- routers: images, ports, templates, editor/set-resources
- Template model; background update task wired into lifespan

Frontend:
- EnvEditor (table + raw, sensitive masking, quick-insert)
- Images page + UpdateBadge + dashboard 'updates available' banner
- PortConflictDialog pre-deploy check on Deploy
- ResourcePanel (CPU/RAM sliders) as editor Limits tab
- Templates page with per-variable instantiate form

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/routers/editor.py

@@ -36,6 +36,15 @@ class PrivilegedBody(BaseModel):
     value: bool
 
 
+class ResourcesBody(BaseModel):
+    yaml: str
+    service: str
+    cpus: float | None = None
+    memory: str | None = None
+    cpus_reserve: float | None = None
+    memory_reserve: str | None = None
+
+
 def _run(fn, *args) -> dict:
     try:
         return {"yaml": fn(*args)}
@@ -74,3 +83,20 @@ def remove_device(body: DeviceBody, _user: User = Depends(get_current_user)) ->
 @router.post("/set-privileged")
 def set_privileged(body: PrivilegedBody, _user: User = Depends(get_current_user)) -> dict:
     return _run(edit.set_privileged, body.yaml, body.service, body.value)
+
+
+@router.post("/set-resources")
+def set_resources(body: ResourcesBody, _user: User = Depends(get_current_user)) -> dict:
+    try:
+        return {
+            "yaml": edit.set_resources(
+                body.yaml,
+                body.service,
+                cpus=body.cpus,
+                memory=body.memory,
+                cpus_reserve=body.cpus_reserve,
+                memory_reserve=body.memory_reserve,
+            )
+        }
+    except edit.EditError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc

backend/routers/images.py

@@ -0,0 +1,64 @@
+"""Image listing + update-check endpoints."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends
+
+from auth import get_current_user, require_admin
+from docker_client import DockerError, get_client, safe_call
+from models.user import User
+from services import update_service
+
+router = APIRouter(prefix="/api/images", tags=["images"])
+
+COMPOSE_PROJECT_LABEL = "com.docker.compose.project"
+
+
+@router.get("")
+def list_images(_user: User = Depends(get_current_user)) -> list[dict]:
+    try:
+        client = get_client()
+        images = safe_call(client.images.list)
+        containers = safe_call(client.containers.list, all=True)
+    except DockerError:
+        return []
+
+    # Map image ref -> stacks using it.
+    usage: dict[str, set[str]] = {}
+    for c in containers:
+        ref = c.attrs.get("Config", {}).get("Image")
+        stack = c.labels.get(COMPOSE_PROJECT_LABEL)
+        if ref:
+            usage.setdefault(ref, set())
+            if stack:
+                usage[ref].add(stack)
+
+    cache = update_service.get_cache()
+    result = []
+    for img in images:
+        tags = img.tags or []
+        if not tags:
+            continue
+        for tag in tags:
+            upd = cache.get(tag)
+            result.append(
+                {
+                    "id": img.short_id,
+                    "tag": tag,
+                    "size": img.attrs.get("Size", 0),
+                    "created": img.attrs.get("Created"),
+                    "stacks": sorted(usage.get(tag, set())),
+                    "update": upd,
+                }
+            )
+    result.sort(key=lambda r: r["tag"])
+    return result
+
+
+@router.get("/updates")
+def updates(_user: User = Depends(get_current_user)) -> dict:
+    return update_service.get_cache()
+
+
+@router.post("/check")
+async def check(_user: User = Depends(require_admin)) -> dict:
+    return await update_service.check_all()

backend/routers/ports.py

@@ -0,0 +1,21 @@
+"""Port conflict detection endpoint."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+
+from auth import get_current_user
+from models.user import User
+from services import port_service
+
+router = APIRouter(prefix="/api/ports", tags=["ports"])
+
+
+class ConflictBody(BaseModel):
+    yaml: str
+    ignore_stack: str | None = None
+
+
+@router.post("/conflicts")
+def conflicts(body: ConflictBody, _user: User = Depends(get_current_user)) -> dict:
+    return {"conflicts": port_service.detect_conflicts(body.yaml, body.ignore_stack)}

backend/routers/templates.py

@@ -0,0 +1,99 @@
+"""Template library endpoints."""
+from __future__ import annotations
+
+import os
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from sqlmodel import Session
+
+from auth import get_current_user, require_admin
+from database import get_session
+from models.stack import Stack
+from models.template import TemplateInstantiateRequest, TemplateSaveRequest
+from models.user import User
+from services import audit_service, compose_service, template_service
+
+router = APIRouter(prefix="/api/templates", tags=["templates"])
+
+
+def _ip(request: Request) -> str:
+    return request.client.host if request.client else "unknown"
+
+
+@router.get("")
+def list_templates(
+    session: Session = Depends(get_session),
+    _user: User = Depends(get_current_user),
+) -> list[dict]:
+    return template_service.list_templates(session)
+
+
+@router.get("/{template_id}")
+def get_template(
+    template_id: str,
+    session: Session = Depends(get_session),
+    _user: User = Depends(get_current_user),
+) -> dict:
+    tpl = template_service.get_template(session, template_id)
+    if not tpl:
+        raise HTTPException(status_code=404, detail="Template not found")
+    return tpl
+
+
+@router.post("")
+def save_template(
+    body: TemplateSaveRequest,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    tpl = template_service.save_custom(
+        session, body.name, body.yaml, body.description or "", body.tags
+    )
+    audit_service.record(
+        session, user=user.username, action="template.save", target=tpl.slug, ip=_ip(request)
+    )
+    return {"id": f"custom:{tpl.slug}", "name": tpl.name}
+
+
+@router.delete("/custom/{slug}")
+def delete_template(
+    slug: str,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    if not template_service.delete_custom(session, slug):
+        raise HTTPException(status_code=404, detail="Custom template not found")
+    audit_service.record(
+        session, user=user.username, action="template.delete", target=slug, ip=_ip(request)
+    )
+    return {"ok": True}
+
+
+@router.post("/{template_id}/instantiate", status_code=201)
+def instantiate(
+    template_id: str,
+    body: TemplateInstantiateRequest,
+    request: Request,
+    session: Session = Depends(get_session),
+    user: User = Depends(require_admin),
+) -> dict:
+    tpl = template_service.get_template(session, template_id)
+    if not tpl:
+        raise HTTPException(status_code=404, detail="Template not found")
+
+    stack_id = compose_service.slugify(body.name)
+    if session.get(Stack, stack_id) or os.path.isdir(compose_service.stack_dir(stack_id)):
+        raise HTTPException(status_code=409, detail=f"Stack '{stack_id}' already exists")
+
+    rendered = template_service.render(tpl["yaml"], body.values)
+    compose_service.write_compose(stack_id, rendered)
+    stack = Stack(id=stack_id, name=body.name, description=tpl.get("description"))
+    session.add(stack)
+    session.commit()
+    audit_service.record(
+        session, user=user.username, action="template.instantiate",
+        target=stack_id, detail=template_id, ip=_ip(request),
+    )
+    return {"id": stack_id, "name": body.name}