Monitor: card icons + status accent borders

varaverk.css: .vv-ico — icon wrapper (inline-flex, opacity 0.38, flex-shrink:0) .vv-accent-ok/warn/err — left border colour overrides for state cards Smooth 0.5s transition on border-left-color for all monitor cards monitor.php: All 14 card headers now have inline SVG icons: System (existing server), Power (existing bolt), CPU (chip+pins), Memory (RAM stick), Network (switch tree), Scripts (terminal), Fallback (shield), Partner (two servers linked), Containers (layers), GPU (PCIe card), Transcode (film→encode→strip), Streams (play ▶), Watchdog (eye), Parity (✓ circle), Pools (cylinder), Array (drive stack) Status accent borders applied by JS after each render: Fallback — ok:NORMAL, err:FAILOVER, warn:NO_INTERNET/DARK Partner — ok:any remote online, warn:all offline Watchdog — ok:healthy, err:reboots/OOM/daemon, warn:other issues Array — ok:STARTED, err:any other state
Revert "git_pull_execute: GitHub fallback when GITEA_REPO_PATH is empty"
2026-05-30 17:08:59 -04:00 · 2026-05-30 16:56:49 -04:00 · 2026-05-30 16:55:25 -04:00 · 2026-05-30 16:51:18 -04:00 · 2026-05-30 16:26:51 -04:00 · 2026-05-30 16:22:54 -04:00
20 changed files with 1597 additions and 1491 deletions
@@ -0,0 +1,17 @@
 # ── Personal configuration — never push to public repo ────────────────────────
 # These contain API keys, passwords, SSH paths, personal hostnames.
 # Templates (*.template) are safe and remain tracked.
 Configurations/host*.conf
 Configurations/master.conf
 Configurations/*.bak
 # ── Runtime state, data, logs ─────────────────────────────────────────────────
 data/
 *.log
 *.lock
 # ── OS / editor ───────────────────────────────────────────────────────────────
 .DS_Store
 *.swp
 *~
 .vscode/
@@ -0,0 +1,457 @@
 #!/bin/bash
 # ==============================================================================================
 # ========================== HOSTN CONFIGURATION — (hostname) ==================================
 # ==============================================================================================
 # HOSTN-specific variables — credentials, container names, share paths, failover lists.
 # Sourced after master.conf — values here extend shared profile arrays and add HOSTN-specific
 # identity, credentials, and container configuration.
 #
 # Sparse checkout (git) ensures other hosts never receive this file.
 #
 # DO NOT put shared config here — thresholds, toggles, profiles belong in master.conf.
 # DO NOT put other hosts' variables here — they belong in their own host*.conf files.
 #
 # ── HOW TO USE THIS TEMPLATE ──────────────────────────────────────────────────────────────────
 # This file was generated by the Varaverk first-run wizard.
 # Fill in the sections that apply to your setup — leave unused sections empty.
 # All scripts self-guard against empty values — safe to leave sections blank until needed.
 #
 # ── INDEX ─────────────────────────────────────────────────────────────────────────────────────
 #
 #   ── IDENTITY & CONNECTIVITY ────────────────────────────────────────────────────────────────
 #   IDENTITY                hostname, SSH key
 #   EMBY                    container name, URL, API key
 #   NOTIFICATIONS           Discord webhook
 #   PARTNERSHIP             auth containers, backup paths
 #
 #   ── RSYNC ──────────────────────────────────────────────────────────────────────────────────
 #   DAILY SYNC SHARES       media shares this host owns and pushes
 #   WEEKLY SYNC SHARES      appdata shares synced weekly
 #   CRITICAL SYNC SHARES    appdata shares synced every 30 minutes
 #   HOSTN RSYNC PROFILE     host-specific appdata sync profile
 #
 #   ── DOCKER ─────────────────────────────────────────────────────────────────────────────────
 #   DOCKER DAILY RESTART    containers restarted daily
 #   DOCKER WEEKLY RESTART   containers restarted weekly
 #   DOCKER WATCHDOG         memory limits, health URLs, required containers
 #   DOCKER NETWORK CONNECT  networks and containers for array start
 #
 #   ── FALLBACK ───────────────────────────────────────────────────────────────────────────────
 #   DDNS                    DDNS containers managed by this host
 #   INTERNET LOSS           containers stopped when internet is lost
 #   FALLBACK TIERS          what this host runs for the remote per tier
 #   TIER DELAYS             delays before each tier activates
 #   RSYNC WRITEBACK         appdata synced back on handback
 #
 #   ── MEDIA ──────────────────────────────────────────────────────────────────────────────────
 #   MEDIA PERMISSIONS       share list for permissions script
 #   MEDIA CLEANER           folder lists for media_cleaner.sh
 #
 #   ── MONITORS ───────────────────────────────────────────────────────────────────────────────
 #   CERTIFICATE MONITOR     domains checked for SSL expiry
 #   SMART HEALTH            drives to skip in SMART monitoring
 #   ZFS REPORT              pools to exclude from ZFS health report
 #
 #   ── TRANSCODES ─────────────────────────────────────────────────────────────────────────────
 #   TRANSCODES              ramdisk size, thresholds, SSD path, server array
 #
 #   ── ARR STACK ──────────────────────────────────────────────────────────────────────────────
 #   DOWNLOADERS             slskd, SABnzbd, qBittorrent credentials and URLs
 #   LIDARR / SONARR / RADARR  URL, API key, path map
 #   ARR RECOVERY            per-arr recovery toggles
 #
 #   ── SYSTEM WATCHDOG ────────────────────────────────────────────────────────────────────────
 #   SYSTEM WATCHDOG         per-host check toggles and NIC configuration
 #
 #   ── RESOURCE MANAGER ───────────────────────────────────────────────────────────────────────
 #   RESOURCE MANAGER        containers paused/stopped under memory pressure
 #
 # ==============================================================================================
 # ==============================================================================================
 # ── IDENTITY & CONNECTIVITY ───────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Identity ━━━
 # HOSTN hostname lives in master.conf (not a credential — safe for all servers).
 # SSH key used for all server-to-server operations — rsync, failover, conf sync.
 # Convention: /root/.ssh/<hostname-lowercase-no-unraid-prefix>_rsync_automation
 # Must be in /root/.ssh/ and authorised in the partner's /root/.ssh/authorized_keys.
 # Run Partnership/ssh_setup.sh to generate the key and copy it to the partner.
    HOSTN_SSH_KEY=""    # e.g. /root/.ssh/myserver_rsync_automation
    HOSTN_OWNER=""      # short identifier for this server (e.g. myserver)
    HOSTN_OWNER_EMAIL=""
 # ━━━ Unraid API ━━━
 # Used by the Varaverk plugin to query this server's Unraid GraphQL API.
 # Generate in Unraid: Settings → Management Access → API Keys → + New Key
    HOSTN_UNRAID_API_KEY=""
 # ━━━ Emby ━━━
    HOSTN_EMBY_CONTAINER="Emby"
    HOSTN_EMBY_URL="http://localhost:8096"
    HOSTN_EMBY_API_KEY=""   # Emby Dashboard → API Keys → + New Key
 # ━━━ Jellyfin ━━━
    HOSTN_JELLYFIN_CONTAINER="Jellyfin"
    HOSTN_JELLYFIN_URL="http://localhost:8095"
    HOSTN_JELLYFIN_API_KEY=""   # Jellyfin Dashboard → Administration → API Keys
 # ━━━ Gitea ━━━
 # Personal access token for gitea_ssh_setup.sh.
 # Create in Gitea: Settings → Applications → Generate Token → scope: write:user
    HOSTN_GITEA_API_TOKEN=""
 # ━━━ Notifications ━━━
 # Discord webhook — leave blank to disable.
    HOSTN_DISCORD_WEBHOOK=""
 # ━━━ Partnership ━━━
 # Auth containers reconfigured on onboard/offboard.
 # Format: "ContainerName|WebUIPort"
    HOSTN_PARTNERSHIP_AUTH_WEBUIS=(
        # "NginxProxyManager|81"
        # "Authelia|9091"
    )
 # XML templates pushed to mirror during onboard — auth stack.
 # Dependencies (databases) must come before apps that depend on them.
    HOSTN_PARTNERSHIP_AUTH_STACK=(
        # "my-Authelia.xml"
        # "my-NginxProxyManager.xml"
    )
 # XML templates pushed to mirror during onboard — arr stack.
    HOSTN_PARTNERSHIP_ARR_STACK=(
        # "my-Sonarr.xml"
        # "my-Radarr.xml"
    )
 # Paths the partner should collect during the grace window after offboard.
    HOSTN_PARTNERSHIP_MIRROR_BACKUPS=(
        # "/mnt/user/appdata-Fallback/Partner-Emby"
    )
 # Containers parked on this server when partnership is active.
    HOSTN_PARTNERSHIP_OWN_CONTAINERS=(
        # "Emby"
    )
 # Emby admin provisioning — owner controls whether Emby is shared.
    HOSTN_PARTNERSHIP_PROVISION_EMBY_ADMIN=false
    HOSTN_PARTNERSHIP_EMBY_PORT=8096
    HOSTN_PARTNERSHIP_EMBY_ADMIN_USER=""
    HOSTN_PARTNERSHIP_EMBY_ADMIN_PASS=""
 # ==============================================================================================
 # ── RSYNC ─────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Daily Sync Shares ━━━
 # Media shares this host pushes to all other nodes every night.
 # Uses DEFAULT_RSYNC_OPTS from master.conf — no profile needed.
    HOSTN_DAILY_SYNC_SHARES=(
        # /mnt/user/Movies
        # /mnt/user/Tv_Shows
        # /mnt/user/Music
    )
 # ━━━ Weekly Sync Shares ━━━
 # Appdata shares synced during the weekly maintenance window.
 # Profiles (emby, critical-data) drive container stops — define in master.conf.
    HOSTN_WEEKLY_SYNC_SHARES=(
        # "/mnt/user/Media_Server/Emby"              # emby profile
        # "/mnt/user/appdata-Fallback/Critical-Data" # critical-data profile
    )
 # ━━━ Intermediate Sync Shares ━━━
 # Shares synced every 4 hours. Leave empty to skip mid-day rsync.
    HOSTN_INTERMEDIATE_SYNC_SHARES=(
        # Add shares here to enable mid-day rsync
    )
 # ━━━ Critical Sync Shares ━━━
 # Appdata shares synced every 30 minutes.
 # Format: "/path/to/share" or "/path/to/share|profile-name"
    HOSTN_CRITICAL_SYNC_SHARES=(
        # "/mnt/user/appdata-Fallback/Critical-Data|critical-fallback"
        # "/mnt/user/Media_Server/Emby|emby-fallback"
    )
 # ━━━ Backup Verify ━━━
 # Leave empty to use HOSTN_DAILY_SYNC_SHARES automatically.
    HOSTN_BACKUP_VERIFY_SHARES=(
        # leave empty to use HOSTN_DAILY_SYNC_SHARES automatically
    )
 # ━━━ HOSTN Rsync Profile — hostn-appdata ━━━
 # Host-specific appdata sync profile.
    PROFILE_RSYNC_OPTS[hostn-appdata]="-av --info=progress2 --bwlimit=${PROFILE_BW_LIMIT[hostn-appdata]:-8000}"
    PROFILE_BW_LIMIT[hostn-appdata]=8000
    PROFILE_RETRY_COUNT[hostn-appdata]=3
    PROFILE_SLEEP[hostn-appdata]=300
    PROFILE_CRITICAL_CONTAINER_NAMES[hostn-appdata]=""
    PROFILE_DELAYED_CONTAINERS[hostn-appdata]=""
    PROFILE_CONTAINER_DELAY[hostn-appdata]=5
    PROFILE_EXCLUDE_DIRS[hostn-appdata]="logs *.tmp"
 # ==============================================================================================
 # ── DOCKER ────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Docker Daily Restart ━━━
    HOSTN_DAILY_RESTART_CONTAINERS=(
        # "NginxProxyManager"
        # "Authelia"
    )
 # ━━━ Docker Weekly Restart ━━━
    HOSTN_WEEKLY_RESTART_CONTAINERS=(
        # "NextCloud"
        # "AdGuard-Home"
    )
 # ━━━ Docker Watchdog ━━━
 # Memory hard limits in MB — immediate restart if exceeded.
 # 20GB=20480  16GB=16384  8GB=8192  4GB=4096  2GB=2048  1GB=1024
    declare -A HOSTN_WATCHDOG_CONTAINERS=(
        # ["Emby"]=18432
    )
 # HTTP health check URLs — checked every cycle.
    declare -A HOSTN_WATCHDOG_CONTAINER_URLS=(
        # ["Emby"]="http://localhost:8096"
    )
 # Required containers — must always be running.
    HOSTN_WATCHDOG_REQUIRED_CONTAINERS=(
        # "NginxProxyManager"
        # "Authelia"
    )
 # Containers to skip in Tier 2 global scan.
    HOSTN_WATCHDOG_SCAN_IGNORE=(
        # "my-occasional-container"
    )
 # Dependency ordering — skip restarting a container if its dependency is also down.
    declare -A HOSTN_WATCHDOG_DEPENDENCIES=(
        # ["Authelia"]="Mariadb Redis-Authelia"
    )
 # Per-container appdata growth suppress ceilings in MB.
    declare -A HOSTN_WATCHDOG_APPDATA_SIZES=(
        # ["Tdarr"]="25600"
    )
 # ━━━ Network Watchdog ━━━
    HOSTN_NETWORK_WATCHDOG_DDNS_DOMAIN=""       # e.g. myserver.com
    HOSTN_NETWORK_WATCHDOG_DDNS_CONTAINER=""    # e.g. MyServer.com
    HOSTN_NETWORK_WATCHDOG_NPM_URL=""           # e.g. https://myserver.com
 # ━━━ Docker Network Connect ━━━
    HOSTN_NETWORK_CONNECT_CONTAINERS=(
        # "memcached"
    )
    HOSTN_NETWORK_CONNECT_NETWORKS=(
        # "high-availability"
    )
 # ==============================================================================================
 # ── FALLBACK ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ DDNS ━━━
 # DDNS containers this host manages.
    HOSTN_DDNS_CONTAINERS=(
        # "MyServer.com"
    )
 # ━━━ Internet Loss ━━━
 # Containers stopped immediately when internet is lost.
    FALLBACK_HOSTN_STOP_ON_NO_NET=(
        # "MyServer.com"
    )
 # ━━━ Fallback Tiers — HOSTN Runs for Partner ━━━
 # Containers this host starts when the partner goes down.
 # Replace REMOTE_ID below with the actual remote host ID (HOST1, HOST2, etc.)
    FALLBACK_HOSTN_COVERS_REMOTE_ID_TIER1=(
        # "Partner-DDNS-Container"
    )
    FALLBACK_HOSTN_COVERS_REMOTE_ID_TIER2=(
        # "container-placeholder"
    )
    FALLBACK_HOSTN_COVERS_REMOTE_ID_TIER3=(
        # "container-placeholder"
    )
    FALLBACK_HOSTN_COVERS_REMOTE_ID_TIER4=(
        # "container-placeholder"
    )
 # ━━━ Tier Delays — Partner's Containers on this Host ━━━
 # How long the partner must be down before each tier activates here — in minutes.
 # Replace REMOTE_ID with the actual remote host ID (HOST1, HOST2, etc.)
    REMOTE_ID_TIER2_DELAY=240           # 4 hours
    REMOTE_ID_TIER3_DELAY=720           # 12 hours
    REMOTE_ID_TIER4_DELAY=1440          # 24 hours
 # ━━━ Rsync Writeback ━━━
    HOSTN_TIER1_WRITEBACK_DELAY=60      # skip Emby writeback if outage under 1hr
    FALLBACK_HOSTN_WRITEBACK_TIER1=(
        # "/mnt/user/Media_Server/Emby"
    )
    FALLBACK_HOSTN_WRITEBACK_TIER2=(
        # "/mnt/user/appdata-Fallback/Important-Data"
    )
    FALLBACK_HOSTN_WRITEBACK_TIER3=(
        # "location-placeholder"
    )
    FALLBACK_HOSTN_WRITEBACK_TIER4=(
        # "/mnt/user/appdata-Fallback/Arrs_Stack"
    )
 # ==============================================================================================
 # ── MEDIA ─────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Media Permissions ━━━
    HOSTN_MEDIA_PERMISSION_SHARES=(
        # /mnt/user/Movies
        # /mnt/user/Tv_Shows
        # /mnt/user/Music
        # /mnt/user/Downloads
    )
 # ━━━ Media Cleaner ━━━
    HOSTN_ANIME_CLEAN_FOLDERS=(
        # /mnt/user/Anime_Movies
        # /mnt/user/Anime_Shows
    )
    HOSTN_MEDIA_CLEAN_FOLDERS=(
        # /mnt/user/Movies
        # /mnt/user/Tv_Shows
    )
 # ==============================================================================================
 # ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Certificate Monitor ━━━
    HOSTN_CERT_MONITOR_DOMAINS=(
        # "myserver.com"
    )
 # ━━━ SMART Health ━━━
    HOSTN_SMART_IGNORE_DRIVES=(
        "sda"   # boot USB — SMART not meaningful on flash drives
    )
 # ━━━ ZFS Report ━━━
    HOSTN_ZFS_REPORT_IGNORE_POOLS=(
        # "disk5"
    )
 # ==============================================================================================
 # ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
    HOSTN_RAMDISK_SIZE="10G"
    HOSTN_RAMDISK_WARN_GB=8.5
    HOSTN_RAMDISK_LOW_GB=7
    HOSTN_TRANSCODE_SSD="/mnt/cache/Temp_Storage/Emby/Transcodes/"
    HOSTN_TRANSCODE_SERVERS=(
        "${HOSTN_EMBY_CONTAINER}|${HOSTN_EMBY_URL}|${HOSTN_EMBY_API_KEY}|emby"
    )
 # ==============================================================================================
 # ── ARR STACK ─────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Downloaders ━━━
    HOSTN_SLSKD_URL="http://localhost:8980"
    HOSTN_SLSKD_API_KEY=""
    HOSTN_SLSKD_FAILED_IMPORTS_DIR=""
    HOSTN_SABNZBD_URL="http://localhost:8180"
    HOSTN_SABNZBD_API_KEY=""
    HOSTN_QBIT_URL="http://localhost:8080"
    HOSTN_QBIT_USERNAME="admin"
    HOSTN_QBIT_PASSWORD=""
 # ━━━ Lidarr ━━━
    HOSTN_LIDARR_URL="http://localhost:8686"
    HOSTN_LIDARR_API_KEY=""
    HOSTN_LIDARR_MUSIC_ROOT="/mnt/user/Music"
    HOSTN_FANART_API_KEY=""
    HOSTN_LASTFM_API_KEY=""
    declare -A HOSTN_LIDARR_PATH_MAP=(
        # ["/music"]="/mnt/user/Music"
    )
 # ━━━ Sonarr ━━━
    HOSTN_SONARR_URL="http://localhost:8989"
    HOSTN_SONARR_API_KEY=""
    HOSTN_SONARR_TV_ROOT="/mnt/user/Tv_Shows"
    declare -A HOSTN_SONARR_PATH_MAP=(
        # ["/tv"]="/mnt/user/Tv_Shows"
    )
 # ━━━ Radarr ━━━
    HOSTN_RADARR_URL="http://localhost:7878"
    HOSTN_RADARR_API_KEY=""
    HOSTN_RADARR_MOVIE_ROOT="/mnt/user/Movies"
    declare -A HOSTN_RADARR_PATH_MAP=(
        # ["/movies"]="/mnt/user/Movies"
    )
 # ━━━ Arr Recovery Toggles ━━━
    HOSTN_LIDARR_RECOVERY=false
    HOSTN_SONARR_RECOVERY=true
    HOSTN_RADARR_RECOVERY=true
 # ==============================================================================================
 # ── SYSTEM WATCHDOG ───────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
    HOSTN_SYS_WATCHDOG_CHECK_DOCKER=true
    HOSTN_SYS_WATCHDOG_CHECK_ROOTFS=true
    HOSTN_SYS_WATCHDOG_CHECK_RAM=true
    HOSTN_SYS_WATCHDOG_CHECK_LOAD=true
    HOSTN_SYS_WATCHDOG_CHECK_TEMP=true
    HOSTN_SYS_WATCHDOG_CHECK_ZOMBIES=true
    HOSTN_SYS_WATCHDOG_CHECK_LOG=true
    HOSTN_SYS_WATCHDOG_CHECK_TMP=true
    HOSTN_SYS_WATCHDOG_CHECK_FD=true
    HOSTN_SYS_WATCHDOG_CHECK_RUNAWAY=true
    HOSTN_SYS_WATCHDOG_NIC=""   # e.g. eth0 — for network monitoring
 # ==============================================================================================
 # ── RESOURCE MANAGER ──────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
    HOSTN_RW_PAUSE_CONTAINERS=(
        # "Tdarr"
        # "LidaTube"
    )
    HOSTN_RW_STOP_CONTAINERS=(
        # "Tdarr"
    )
@@ -1,775 +0,0 @@
 #!/bin/bash
 # ==============================================================================================
 # ========================== HOST1 CONFIGURATION — unRAID-Gmer4Lfe ============================
 # ==============================================================================================
 # HOST1-specific variables — credentials, container names, share paths, failover lists.
 # Sourced after master.conf — values here extend shared profile arrays and add HOST1-specific
 # identity, credentials, and container configuration.
 #
 # Sparse checkout (git) ensures HOST2 never receives this file.
 # HOST2 never sees HOST1 credentials — clean separation at the file level.
 #
 # DO NOT put shared config here — thresholds, toggles, profiles belong in master.conf.
 # DO NOT put HOST2 variables here — they belong in host2.conf.
 #
 # ── INDEX ─────────────────────────────────────────────────────────────────────────────────────
 #
 #   ── IDENTITY & CONNECTIVITY ────────────────────────────────────────────────────────────────
 #   IDENTITY                hostname, SSH key
 #   EMBY                    container name, URL, API key
 #   NOTIFICATIONS           Discord webhook
 #   PARTNERSHIP             auth containers, backup paths
 #
 #   ── RSYNC ──────────────────────────────────────────────────────────────────────────────────
 #   DAILY SYNC SHARES       media shares HOST1 owns and pushes to HOST2
 #   WEEKLY SYNC SHARES      appdata shares synced weekly (Sunday 2:30am)
 #   CRITICAL SYNC SHARES    appdata shares synced every 30 minutes
 #   BACKUP VERIFY           shares for checksum verification against remote
 #   HOST1 RSYNC PROFILE     host1-appdata profile for HOST1-specific appdata syncs
 #
 #   ── DOCKER ─────────────────────────────────────────────────────────────────────────────────
 #   DOCKER DAILY RESTART    containers restarted daily
 #   DOCKER WEEKLY RESTART   containers restarted weekly
 #   DOCKER WATCHDOG         memory limits, health URLs, required containers, ignore list
 #   DOCKER NETWORK CONNECT  networks and containers for docker_network_connect.sh
 #
 #   ── FALLBACK ───────────────────────────────────────────────────────────────────────────────
 #   DDNS                    DDNS containers managed by HOST1
 #   INTERNET LOSS           containers stopped when internet is lost
 #   FALLBACK TIERS          what HOST1 runs for HOST2 per tier
 #   TIER DELAYS             how long HOST1 must be down before each tier activates on HOST2
 #   RSYNC WRITEBACK         HOST1 appdata synced back on handback
 #
 #   ── MEDIA ──────────────────────────────────────────────────────────────────────────────────
 #   MEDIA PERMISSIONS       share list for media_shares_permissions.sh
 #   MEDIA CLEANER           folder lists for media_cleaner.sh
 #
 #   ── MONITORS ───────────────────────────────────────────────────────────────────────────────
 #   CERTIFICATE MONITOR     domains checked for SSL expiry
 #   SMART HEALTH            drives to skip in SMART monitoring
 #   ZFS REPORT              pools to exclude from ZFS health report
 #
 #   ── TRANSCODES ─────────────────────────────────────────────────────────────────────────────
 #   TRANSCODES              ramdisk size, thresholds, SSD path, server array
 #
 #   ── ARR STACK ──────────────────────────────────────────────────────────────────────────────
 #   DOWNLOADERS             slskd, SABnzbd, qBittorrent credentials and URLs
 #   LIDARR                  URL, API key, path map
 #   SONARR                  URL, API key, path map
 #   RADARR                  URL, API key, path map
 #   ARR RECOVERY            per-arr recovery toggles
 #
 #   ── SYSTEM WATCHDOG ────────────────────────────────────────────────────────────────────────
 #   SYSTEM WATCHDOG         per-host check toggles and NIC configuration
 #
 #   ── RESOURCE MANAGER ───────────────────────────────────────────────────────────────────────
 #   RESOURCE MANAGER        containers paused/stopped under memory pressure
 #
 # ==============================================================================================
 # ==============================================================================================
 # ── IDENTITY & CONNECTIVITY ───────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Identity ━━━
 # HOST1 hostname lives in master.conf (not a credential — safe for all servers).
 # SSH key used for all server-to-server operations — rsync, failover container commands.
 # Must be in /root/.ssh/ and authorised in HOST2's /root/.ssh/authorized_keys.
    HOST1_SSH_KEY="/root/.ssh/gmer4lfe_rsync_automation"
    HOST1_OWNER="gmer4lfe"
    HOST1_OWNER_EMAIL="gmer4lfe@gmail.com"
 # ━━━ Unraid API ━━━
 # Local API key used by the Varaverk plugin to query this server's Unraid GraphQL API.
 # Used for remote host monitoring in the partner card — HOST2 uses HOST2_UNRAID_API_KEY.
 # Generate in Unraid: Settings → Management Access → API Keys → + New Key
    HOST1_UNRAID_API_KEY="8282344978921ef157abf11e0e9f59bc89201f621ccf3bf2c5333b6a13fdde6e"
 # ━━━ Emby ━━━
 # Referenced by transcode_manager.sh, emby_session_report.sh, emby_database_repair.sh,
 # weekly_sync_maintenance.sh, and HOST1_TRANSCODE_SERVERS below.
 # API key: Emby Dashboard → API Keys → + New Key
    HOST1_EMBY_CONTAINER="Emby"
    HOST1_EMBY_URL="http://localhost:8096"
    HOST1_EMBY_API_KEY="0c27448d93a7431f9ac63569f7655829"
 # ━━━ Jellyfin ━━━
 # API key: Jellyfin Dashboard → Administration → API Keys → + New Key
    HOST1_JELLYFIN_CONTAINER="Jellyfin"
    HOST1_JELLYFIN_URL="http://localhost:8095"
    HOST1_JELLYFIN_API_KEY="4e820e7df74c4933acec212b1996314e"
 # ━━━ Gitea ━━━
 # Personal access token for gitea_ssh_setup.sh — registers this server's SSH public key
 # with Gitea so git operations use key auth instead of passwords.
 # Create in Gitea: Settings → Applications → Generate Token → scope: write:user
    HOST1_GITEA_API_TOKEN=""
 # ━━━ Notifications ━━━
 # Discord webhook — leave blank to disable.
 # Per-host so HOST1 and HOST2 can post to different channels or only one server notifies.
    HOST1_DISCORD_WEBHOOK=""
 # ━━━ Partnership ━━━
 # HOST1 is always the owner (source of truth) unless --transfer has been run.
 # See README-Partnership.md and master.conf PARTNERSHIP section for full lifecycle docs.
 # Auth containers reconfigured on onboard/offboard.
 # Format: "ContainerName|WebUIPort"
 # On onboard → WebUI pointed at owner's Tailscale IP (mirror clicks NPM, gets owner's auth)
 # On offboard → WebUI pointed back at localhost
    HOST1_PARTNERSHIP_AUTH_WEBUIS=(
        "NginxProxyManager|81"
        "Lldap-Gmer4Lfe|17170"
        "Authelia|9091"
        "Authelia-Secondary|9092"
    )
 # XML templates (from this server's templates-user/) pushed to mirror during onboard.
 # These become the mirror's active auth stack, backed by the rsync-synced appdata.
 # Update filename if Lldap is renamed to drop the host suffix.
    HOST1_PARTNERSHIP_AUTH_STACK=(
        # Dependencies first — Mariadb/Redis must be healthy before Authelia starts
        "my-Mariadb-Authelia.xml"
        "my-Mariadb-Authelia-Secondary.xml"
        "my-Redis-Authelia.xml"
        "my-Redis-Authelia-Secondary.xml"
        # Auth apps — deployed after their deps are confirmed healthy
        "my-Authelia.xml"
        "my-Authelia-Secondary.xml"
        "my-NginxProxyManager.xml"
        "my-Lldap-Gmer4Lfe.xml"
        # Source of truth — must be available on HOST2 independently of the auth stack
        "my-Gitea.xml"
    )
 # XML templates pushed to mirror for the arr stack during onboard.
 # Deps (e.g. databases) first if any — same ordering rule as auth stack.
    HOST1_PARTNERSHIP_ARR_STACK=(
        # "my-Sonarr.xml"
        # "my-Radarr.xml"
        # "my-Lidarr.xml"
        # "my-Prowlarr.xml"
        # "my-Bazarr.xml"
    )
 # Paths HOST2 should collect during the grace window after offboard.
 # Notified on offboard — no auto-deletion, HOST2 must collect manually within PARTNERSHIP_GRACE_HOURS.
    HOST1_PARTNERSHIP_MIRROR_BACKUPS=(
        # "/mnt/user/appdata-Fallback/Jayred365-Emby"
    )
 # Containers parked on this server when partnership is active.
 # Stopped on onboard (owner deploys its stack instead), restarted on offboard.
    HOST1_PARTNERSHIP_OWN_CONTAINERS=(
        # "Emby"
        # "NginxProxyManager"
    )
 # Emby admin provisioning — toggle is owner-only, credentials are per-host.
 # Owner enables/disables the feature. Each host sets the account they want on the shared Emby.
 # On onboard: owner reads mirror's HOST*_PARTNERSHIP_EMBY_ADMIN_* and creates that account.
 # On offboard: account is deleted. Username collision → onboard exits with error.
    HOST1_PARTNERSHIP_PROVISION_EMBY_ADMIN=false   # owner controls whether Emby is shared
    HOST1_PARTNERSHIP_EMBY_PORT=8096
    HOST1_PARTNERSHIP_EMBY_ADMIN_USER=""            # this server's desired Emby username
    HOST1_PARTNERSHIP_EMBY_ADMIN_PASS=""            # this server's desired Emby password
 # ==============================================================================================
 # ── RSYNC ─────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Daily Sync Shares ━━━
 # Shares HOST1 pushes to all other nodes every night (1am via daily_sync_maintenance.sh).
 # Mesh model: every node pushes every media share — no ownership, no mirrors.
 # arr_sync ensures all arr libraries converge (union). rsync spreads files (additive, no --delete).
 # arr_cleanup removes true orphans based on local arr state.
 # Any node can download content to any share — it propagates to all nodes on the next cycle.
 # Nextcloud is intentionally one-directional (HOST1→HOST2 offsite backup — not arr-managed).
 # Uses DEFAULT_RSYNC_OPTS from master.conf — no profile needed.
 # For shares needing container stops or custom options — add a profile in master.conf.
    HOST1_DAILY_SYNC_SHARES=(
        /mnt/user/Books
        /mnt/user/Intros
        /mnt/user/Kids_Movies
        /mnt/user/Kids_Tv_Shows
        /mnt/user/Movies
        /mnt/user/Music
        /mnt/user/Music_Videos
        /mnt/user/Nextcloud
        /mnt/user/stand-up_comedy
        /mnt/user/Sports
        /mnt/user/Tv_Shows
        /mnt/user/Anime_Shows-Old
        /mnt/user/Anime_Movies-Old
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Shows
    )
 # Personal encrypted shares — synced for offsite backup, independent of media shares.
 # ZFS encrypted at dataset level — remote receives encrypted blocks, cannot read content.
 # See README-Rsync_Setup.md for ZFS encryption setup before uncommenting.
    HOST1_PERSONAL_SHARES=(
        # /mnt/user/HOST1-Personal     # uncomment after creating encrypted dataset
    )
 # ━━━ Weekly Sync Shares ━━━
 # Appdata shares synced during the weekly maintenance window (Sunday 2:30am).
 # Containers stopped both sides before sync — full clean state guaranteed.
 # Profiles drive container stops, excludes, and options — configured in master.conf RSYNC section.
 # Order matters — Emby first (larger transfer), then Critical-Data (auth stack).
    HOST1_WEEKLY_SYNC_SHARES=(
        "/mnt/user/Media_Server/Emby"               # emby profile — full clean mirror
        "/mnt/user/appdata-Fallback/Critical-Data"  # critical-data profile — auth stack
    )
 # ━━━ Intermediate Sync Shares ━━━
 # Shares synced every 4 hours by intermediate_sync_maintenance.sh.
 # Uses DEFAULT_RSYNC_OPTS (no --delete) — for sub-daily propagation of metadata or watch state.
 # Full media share sync stays in the daily window. Leave empty to skip mid-day rsync entirely.
    HOST1_INTERMEDIATE_SYNC_SHARES=(
        # Add shares here to enable mid-day rsync
        # Example: "/mnt/user/Emby_Metadata"
    )
 # ━━━ Critical Sync Shares ━━━
 # Appdata shares synced every 30 minutes by critical_sync_maintenance.sh.
 # Format: "/path/to/share" or "/path/to/share|profile-name"
 # Order matters — Critical-Data first (auth stack), then Emby dirty sync.
    HOST1_CRITICAL_SYNC_SHARES=(
        "/mnt/user/appdata-Fallback/Critical-Data|critical-fallback"  # auth dirty sync — stays running
        "/mnt/user/Media_Server/Emby|emby-fallback"                   # Emby dirty sync — stays running
    )
 # ━━━ Backup Verify ━━━
 # Shares verified by backup_verify.sh — random file checksum comparison against remote.
 # Leave empty to use HOST1_DAILY_SYNC_SHARES automatically.
 # Sample size and minimum file size defined in master.conf.
    HOST1_BACKUP_VERIFY_SHARES=(
        # leave empty to use HOST1_DAILY_SYNC_SHARES automatically
    )
 # ━━━ HOST1 Rsync Profile — host1-appdata ━━━
 # HOST1-specific appdata sync profile — extends the shared PROFILE_* arrays in master.conf.
 # Use for appdata unique to HOST1 (Organizrv2, VaultWarden, UptimeKuma etc.)
 # Shared appdata (auth stack, Emby) use dedicated profiles defined in master.conf.
 # Run manually: bash Rsync/rsync.sh /mnt/user/appdata-Fallback/HOST1-Appdata --profile=host1-appdata
    PROFILE_RSYNC_OPTS[host1-appdata]="-av --info=progress2 --bwlimit=${PROFILE_BW_LIMIT[host1-appdata]:-8000}"
    PROFILE_BW_LIMIT[host1-appdata]=8000
    PROFILE_RETRY_COUNT[host1-appdata]=3
    PROFILE_SLEEP[host1-appdata]=300
    PROFILE_CRITICAL_CONTAINER_NAMES[host1-appdata]="Organizrv2-Gmer4Lfe UptimeKuma-Gmer4Lfe VaultWarden-Gmer4Lfe"
    PROFILE_DELAYED_CONTAINERS[host1-appdata]=""
    PROFILE_CONTAINER_DELAY[host1-appdata]=5
    PROFILE_EXCLUDE_DIRS[host1-appdata]="logs *.tmp"
 # ==============================================================================================
 # ── DOCKER ────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Docker Daily Restart ━━━
 # Containers restarted every day via DAILY_MAINTENANCE_SCRIPTS.
 # Dispatcharr degrades over time without restart — daily is intentional, not just housekeeping.
 # Order matters — auth stack first, then media services.
    HOST1_DAILY_RESTART_CONTAINERS=(
        "NginxProxyManager"
        "Lldap-Gmer4Lfe"
        "Authelia"
        "Authelia-Secondary"
        "Dispatcharr-Iptv-Users"
        "Dispatcharr"               # Live TV scheduler — degrades without daily restart
        "Dispatcharr-Basic"
        "ErsatzTV-Emby"
        "Slskd"                     # Soulseek connection drops after extended uptime; restart refreshes share index
    )
 # ━━━ Docker Weekly Restart ━━━
 # Less critical services restarted weekly via WEEKLY_MAINTENANCE_SCRIPTS (Sunday 2:30am).
 # Containers already stopped for weekly sync — restart adds zero extra downtime.
    HOST1_WEEKLY_RESTART_CONTAINERS=(
        "NextCloud"
        "Organizrv2-Gmer4Lfe"
        "AdGuard-Home"
        "Immich-Gmer4Lfe"
    )
 # ━━━ Docker Watchdog ━━━
 # Per-HOST1 container configuration for docker_watchdog.sh.
 # Shared thresholds and toggles live in master.conf.
 # Memory hard limits in MB — immediate restart if exceeded.
 # Set at "container is clearly broken" not "container is busy".
 # 20GB=20480  18GB=18432  16GB=16384  12GB=12288  8GB=8192  4GB=4096  2GB=2048  1GB=1024
    declare -A HOST1_WATCHDOG_CONTAINERS=(
        ["Emby"]=18432              # 18GB — large library + active transcodes
        ["LidaTube"]=6144           # 6GB  — memory leak over time
        ["Tdarr"]=6144              # 6GB  — encoding is memory intensive
        ["Code-Server"]=1024        # 1GB  — should never need more
    )
 # HTTP health check URLs — checked every cycle, strike system before restart.
 # Only add containers with a meaningful web interface to check.
    declare -A HOST1_WATCHDOG_CONTAINER_URLS=(
        ["Emby"]="http://localhost:8096"
    )
 # Required containers — must always be running on HOST1.
 # Strike system before restart — repeated failures go on skip list, auto-clears on recovery.
 # Listed in dependency order — dependencies before dependents.
    HOST1_WATCHDOG_REQUIRED_CONTAINERS=(
        "NginxProxyManager"
        "Lldap-Gmer4Lfe"
        "Mariadb-Authelia"
        "Mariadb-Authelia-Secondary"
        "Redis-Authelia"
        "Redis-Authelia-Secondary"
        "Authelia"
        "Authelia-Secondary"
    )
 # Containers to skip in Tier 2 global scan — legitimately stopped or frequently restarting.
 # Watchdog leaves these alone entirely — no restart attempts, no crash loop tracking.
    HOST1_WATCHDOG_SCAN_IGNORE=(
        "DashGate"
        "PIA-WG-Config-Generator"
        "Aperture"
        "Aperture-Kids"
        "pgvector-18-Apeture-Kids"
        "Pgvector18-Aperture"
    )
 # Dependency ordering — skip restarting a container if its dependency is also down.
 # Prevents watchdog from restarting Authelia before Mariadb is back up.
 # SPACE-SEPARATED STRINGS — converted to array at runtime.
    declare -A HOST1_WATCHDOG_DEPENDENCIES=(
        ["Authelia"]="Mariadb-Authelia Redis-Authelia"
        ["Authelia-Secondary"]="Mariadb-Authelia Redis-Authelia-Secondary"
        ["NextCloud"]="Postgres-NextCloud"
    )
 # Per-container appdata growth suppress ceilings in MB.
 # ONLY needed in specific cases — growth rate detection covers all containers automatically.
 # Use this when a container legitimately has large stable data and you want to guarantee
 # it never triggers a false-positive growth alert. Growth warnings are suppressed while the
 # container's dir stays below this ceiling; above it, warnings resume as normal.
 # 50GB=51200  25GB=25600  20GB=20480  15GB=15360  10GB=10240  5GB=5120
    declare -A HOST1_WATCHDOG_APPDATA_SIZES=(
        ["Tdarr"]="25600"       # 25GB — transcode cache grows legitimately during active jobs
        ["7dtd"]="20480"        # 20GB — game server world data, expected to be large
    )
 # ━━━ Network Watchdog ━━━
 # Host-specific connectivity config for Watchdogs/System/network_watchdog.sh.
    HOST1_NETWORK_WATCHDOG_DDNS_DOMAIN="gmer4lfe.com"
    HOST1_NETWORK_WATCHDOG_DDNS_CONTAINER="Gmer4Lfe.com"
    HOST1_NETWORK_WATCHDOG_NPM_URL="https://gmer4lfe.com"
 # ━━━ Docker Network Connect ━━━
 # Containers connected to custom networks at array start by docker_network_connect.sh.
 # Networks created if they don't exist — idempotent, safe to re-run.
    HOST1_NETWORK_CONNECT_CONTAINERS=(
        "memcached"
        "Npm-CrowdSec"
    )
    HOST1_NETWORK_CONNECT_NETWORKS=(
        "high-availability"
    )
 # ==============================================================================================
 # ── FALLBACK ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ DDNS ━━━
 # DDNS containers HOST1 manages — started/stopped by fallback.sh per DDNS absolute rules:
 #   Internet loss → stop immediately
 #   Failover → HOST2 starts HOST1's DDNS as Tier 1 (before any other containers)
 #   Handback → stop HOST1's DDNS on HOST2 → rsync → start containers → start local DDNS last
    HOST1_DDNS_CONTAINERS=(
        "Gmer4Lfe.com"
    )
 # ━━━ Internet Loss ━━━
 # Containers stopped immediately on HOST1 when internet connection is lost.
 # Prevents external-facing services from operating without connectivity.
    FALLBACK_HOST1_STOP_ON_NO_NET=(
        "Gmer4Lfe.com"
    )
 # ━━━ Fallback Tiers — HOST1 Runs for HOST2 ━━━
 # Containers HOST1 starts when HOST2 goes down.
 # Tier 1 is always immediate — vital services cannot wait.
 # Higher tiers activate after HOST2_TIER*_DELAY minutes (set in host2.conf).
    FALLBACK_HOST1_COVERS_HOST2_TIER1=(
        "Gmer4Lfe.us"
        "VaultWarden-Jayred365"
    )
    FALLBACK_HOST1_COVERS_HOST2_TIER2=(
        # "container-placeholder"
    )
    FALLBACK_HOST1_COVERS_HOST2_TIER3=(
        # "container-placeholder"
    )
    FALLBACK_HOST1_COVERS_HOST2_TIER4=(
        # "container-placeholder"
    )
 # ━━━ Tier Delays — HOST1's Containers on HOST2 ━━━
 # How long HOST1 must be down before each tier activates on HOST2 — in minutes.
 # Tier 1 is always immediate — no delay var needed.
    HOST1_TIER2_DELAY=240           # 4 hours  — NextCloud, Immich
    HOST1_TIER3_DELAY=720           # 12 hours — secondary services
    HOST1_TIER4_DELAY=1440          # 24 hours — arrs + downloaders
 # ━━━ Rsync Writeback — HOST1 Appdata Back on Handback ━━━
 # Syncs HOST1 appdata BACK to HOST1 when it comes back online after a failover.
 # Containers stopped before writeback — clean source, no competing writes.
 #
 # HOST1_TIER1_WRITEBACK_DELAY: short outages skip Tier 1 writeback — primary state
 # is more reliable than dirty sync data for brief outages.
    HOST1_TIER1_WRITEBACK_DELAY=60  # skip Emby writeback if outage under 1hr
 # Tier 4 automatically syncs HOST1_DAILY_SYNC_SHARES — only list paths NOT in that array.
    FALLBACK_HOST1_WRITEBACK_TIER1=(
        "/mnt/user/Media_Server/Emby"               # watch states built up during outage
    )
    FALLBACK_HOST1_WRITEBACK_TIER2=(
        "/mnt/user/appdata-Fallback/Important-Data" # NextCloud + Postgres — files added during outage
    )
    FALLBACK_HOST1_WRITEBACK_TIER3=(
        # "location-placeholder"
    )
    FALLBACK_HOST1_WRITEBACK_TIER4=(
        "/mnt/user/appdata-Fallback/Arrs_Stack"     # arr databases — downloads queued during outage
    )
 # ==============================================================================================
 # ── MEDIA ─────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Media Permissions ━━━
 # Shares that media_shares_permissions.sh applies PERMISSIONS_MODE and PERMISSIONS_OWNER to.
 # Runs first in DAILY_MAINTENANCE_SCRIPTS — arr cleanup depends on correct ownership.
    HOST1_MEDIA_PERMISSION_SHARES=(
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Movies-Old
        /mnt/user/Anime_Shows
        /mnt/user/Anime_Shows-Old
        /mnt/user/appcache
        /mnt/user/Books
        /mnt/user/Downloads
        /mnt/user/Games
        /mnt/user/Intros
        /mnt/user/Kids_Movies
        /mnt/user/Kids_Tv_Shows
        /mnt/user/Movie_Recordings
        /mnt/user/Movies
        /mnt/user/Music
        /mnt/user/Music_Videos
        /mnt/user/Photo
        /mnt/user/Sports
        /mnt/user/stand-up_comedy
        /mnt/user/Temp_Storage
        /mnt/user/Tv_Recordings
        /mnt/user/Tv_Shows
        /mnt/user/YouTube
    )
 # ━━━ Media Cleaner ━━━
 # Folder lists for media_cleaner.sh — two profiles: anime and media.
 # File patterns shared across all servers — defined in master.conf.
 # Called via DAILY_MAINTENANCE_SCRIPTS. Run manually: Media/media_cleaner.sh anime|media
    HOST1_ANIME_CLEAN_FOLDERS=(
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Movies-Old
        /mnt/user/Anime_Shows
        /mnt/user/Anime_Shows-Old
    )
    HOST1_MEDIA_CLEAN_FOLDERS=(
        /mnt/user/Kids_Movies
        /mnt/user/Kids_Tv_Shows
        /mnt/user/Movies
        /mnt/user/Music
        /mnt/user/Sports
        /mnt/user/stand-up_comedy
        /mnt/user/Tv_Shows
    )
 # ==============================================================================================
 # ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Certificate Monitor ━━━
 # Domains checked via direct openssl connection — not relying on NPM's certificate state.
 # Checks the actual certificate served, not what NPM thinks it has.
 # Thresholds (CERT_WARN_DAYS, CERT_CRIT_DAYS) defined in master.conf.
    HOST1_CERT_MONITOR_DOMAINS=(
        "Gmer4Lfe.com"
        "Gmer4Lfe.us"
    )
 # ━━━ SMART Health ━━━
 # Drives skipped in SMART attribute monitoring — hardware is server-specific.
 # Thresholds read from dynamix.cfg at runtime — fallbacks in master.conf.
    HOST1_SMART_IGNORE_DRIVES=(
        "sda"                       # boot USB — SMART not meaningful on flash drives
    )
 # ━━━ ZFS Report ━━━
 # Pools excluded from the weekly ZFS health report — reduces noise from single-disk array pools.
 # These are individual array disks formatted as ZFS — converting to XFS over time via unBalance.
 # Pool health thresholds defined in master.conf.
    HOST1_ZFS_REPORT_IGNORE_POOLS=(
        "disk5"
        "disk6"
        "disk8"
        "disk9"
        "disk10"
    )
 # ==============================================================================================
 # ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Ramdisk size ceiling — tmpfs only uses RAM actually needed, not the full size upfront.
 # Real-world: 9 streams peaked at ~5.5GB — 10G gives generous headroom on 128GB RAM.
    HOST1_RAMDISK_SIZE="10G"
 # Usage thresholds — coupled to HOST1_RAMDISK_SIZE, adjust all three together if size changes.
 # Hysteresis gap (8.5 - 7 = 1.5GB) prevents flip-flop between ramdisk and SSD.
    HOST1_RAMDISK_WARN_GB=8.5      # flip to SSD when ramdisk usage reaches this
    HOST1_RAMDISK_LOW_GB=7         # flip back to ramdisk when usage drops to this
 # SSD fallback path — where transcodes land when ramdisk exceeds HOST1_RAMDISK_WARN_GB.
 # Must be on cache pool — array disks too slow for active transcode writes.
    HOST1_TRANSCODE_SSD="/mnt/cache/Temp_Storage/Emby/Transcodes/"
 # Media servers sharing the ramdisk transcode space on HOST1.
 # Format: "ContainerName|URL|APIKey|Type" — Type: emby | jellyfin | plex
 # Entries with placeholder API keys are skipped automatically.
 # ⚠️ Tdarr does NOT belong here — keep Tdarr on SSD, not ramdisk.
    HOST1_TRANSCODE_SERVERS=(
        "${HOST1_EMBY_CONTAINER}|${HOST1_EMBY_URL}|${HOST1_EMBY_API_KEY}|emby"
        "${HOST1_JELLYFIN_CONTAINER}|${HOST1_JELLYFIN_URL}|${HOST1_JELLYFIN_API_KEY}|jellyfin"
    )
 # ==============================================================================================
 # ── ARR STACK ─────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Used by arr cleanup scripts and arrs_failed_stalled_recovery.sh.
 # detect_hosts() selects HOST1 vars when running on HOST1.
 #
 # PATH MAPS — container path → host path translation.
 # Arr stores file paths using container-internal paths — scripts need host paths to scan.
 # Add one entry per root folder in arr Settings → Media Management → Root Folders.
 # ━━━ Downloaders ━━━
 # Used by downloaders_reset.sh — runs every 30min via CRITICAL_MAINTENANCE_SCRIPTS.
 # Clears stuck states, purges old history, prepares each client for a clean cycle.
 # slskd — clears stuck searches, dead transfers, purges expired failed imports.
 # SLSKD_FAILED_IMPORTS_DIR: where Soularr moves albums Lidarr rejected.
    HOST1_SLSKD_URL="http://localhost:8980"
    HOST1_SLSKD_API_KEY="4bF9kL2mNpQrT7vWxYz1A3dEgHjKoRsU"
    HOST1_SLSKD_FAILED_IMPORTS_DIR="/mnt/user/Temp_Storage/Slskd/completed/failed_imports"
 # SABnzbd
    HOST1_SABNZBD_URL="http://localhost:8180"
    HOST1_SABNZBD_API_KEY="8bfefe41d83b4d50883e32859b55ca9a"
 # qBittorrent — deleteFiles=false removes torrent from qBit but leaves files on disk.
 # Radarr/Sonarr manage actual files independently.
    HOST1_QBIT_URL="http://localhost:8080"
    HOST1_QBIT_USERNAME="root"
    HOST1_QBIT_PASSWORD="Stay0utD!ck"
 # ━━━ Lidarr — HOST1 only ━━━
 # HOST2 does not run Lidarr — HOST1_LIDARR_RECOVERY flag handles the exit cleanly.
    HOST1_LIDARR_URL="http://localhost:8686"
    HOST1_LIDARR_API_KEY="b2977e71ef074bc0a0529d9fcce3b2dc"
    HOST1_LIDARR_MUSIC_ROOT="/mnt/user/Music-New"
    HOST1_FANART_API_KEY="Yd7147a43b692df0b364b94dc47efb81"
    HOST1_LASTFM_API_KEY="be6dc169c33ae263e690c30d18b7491d"
    declare -A HOST1_LIDARR_PATH_MAP=(
        ["/ext-music"]="/mnt/user/Music-New"
    )
 # ━━━ Sonarr ━━━
    HOST1_SONARR_URL="http://localhost:8989"
    HOST1_SONARR_API_KEY="130decd3db5b4c25afad64864cd03f9f"
    HOST1_SONARR_TV_ROOT="/mnt/user/Tv_Shows"
 # Note: stand-up_comedy in both Sonarr + Radarr — TV specials and movie specials, one folder
    declare -A HOST1_SONARR_PATH_MAP=(
        ["/tv"]="/mnt/user/Tv_Shows"
        ["/ext-standup-comedy"]="/mnt/user/stand-up_comedy"
        ["/kids tv"]="/mnt/user/Kids_Tv_Shows"
        ["/ext-anime-shows"]="/mnt/user/Anime_Shows-Old"
    )
 # ━━━ Radarr ━━━
    HOST1_RADARR_URL="http://localhost:7878"
    HOST1_RADARR_API_KEY="d43a3ec6cf1549edb4af0cc63f98b2a9"
    HOST1_TMDB_API_KEY="3dac5e2e49b5540472d2eafec4f01260"
    HOST1_RADARR_MOVIES_ROOT="/mnt/user/Movies"
 # Note: stand-up_comedy in both Radarr + Sonarr — movie specials and TV specials, one folder
    declare -A HOST1_RADARR_PATH_MAP=(
        ["/movies"]="/mnt/user/Movies"
        ["/kids movies"]="/mnt/user/Kids_Movies"
        ["/ext-stand-up-comedy"]="/mnt/user/stand-up_comedy"
        ["/anime-movies"]="/mnt/user/Anime_Movies-Old"
    )
 # ━━━ Arr Recovery Toggles ━━━
 # false = skip that arr on this host — exits cleanly without error
    HOST1_SONARR_RECOVERY=true
    HOST1_RADARR_RECOVERY=true
    HOST1_LIDARR_RECOVERY=true      # HOST1 only — exits cleanly on HOST2
 # ==============================================================================================
 # ── SYSTEM WATCHDOG ───────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Per-host check toggles and NIC config for system_watchdog.sh.
 # Aliased by detect_hosts() — script uses unprefixed SYS_WATCHDOG_* names.
 # HOST1: TR1950X 128GB — full media server, active transcoding, ZFS cache pools.
 #
 # Three-tier response — all critical checks enabled by default on HOST1:
 #   Tier 1 (bypass strikes, reboot now):  docker daemon, rootfs full, kernel oops, FD, /boot
 #   Tier 2 (bypass strikes with OOM):     RAM critical + OOM kills in cycle
 #   Tier 3 (standard strike system):      everything else
 #
 # RAM tiers, OOM limits, and reboot loop settings in master.conf System Watchdog section.
 # ━━━ Primary NIC ━━━
 # Network interface for NIC state check — verify with: ip link show | grep "^[0-9]"
 # Common values: eth0, bond0, br0, eno1
    HOST1_SYS_WATCHDOG_NIC="eth0"
 # ━━━ Tier 1 — Critical Checks ━━━
 # These bypass the strike system — a single hit triggers immediate reboot.
 # Disabling any of these is not recommended — they protect against acute system failure.
 # Docker daemon unresponsive → try restart, reboot if restart fails.
 # Without a working daemon docker_watchdog.sh is blind and containers cannot be managed.
    HOST1_SYS_WATCHDOG_CHECK_DOCKER_DAEMON=true
 # rootfs at critical threshold (ROOTFS_CRITICAL_PCT=99) → reboot immediately.
 # At 99% rootfs writes fail silently — logs stop, Docker errors out, SSH may stop working.
 # Standard 95% threshold still uses strike system — only 99%+ is critical tier.
    HOST1_SYS_WATCHDOG_CHECK_ROOTFS=true
 # Kernel BUG/Oops in dmesg delta since last cycle → reboot immediately.
 # A kernel oops means the kernel ran with a corrupted state — stability is not guaranteed.
    HOST1_SYS_WATCHDOG_CHECK_KERNEL_OOPS=true
 # File descriptor exhaustion at FD_CRITICAL_PCT (95%) → reboot immediately.
 # At 95% FD: new connections fail, Docker can't spawn processes, SSH drops.
    HOST1_SYS_WATCHDOG_CHECK_FD=true
 # /boot read-only detected → reboot immediately.
 # Unexpected read-only /boot means state files and config writes are silently failing.
 # Fallback state, watchdog reboot log, and lock files all go stale silently.
    HOST1_SYS_WATCHDOG_CHECK_BOOT=true
 # ━━━ Tier 2 — Urgent OOM Check ━━━
 # Bypass strikes when RAM is critically low AND OOM kill rate confirms active crisis.
 # Both must be enabled for Tier 2 bypass to function — disable either to always use strikes.
 # Track kernel OOM kills each cycle via /proc/vmstat oom_kill delta.
 # Also provides diagnostic context in reboot messages (which processes were killed).
    HOST1_SYS_WATCHDOG_CHECK_OOM=true
 # Free RAM check — required for both Tier 2 bypass and RAM tier logic.
 # Tiers: MEM_WARN_GB(10) → notify | MEM_SHUTDOWN_GB(6) → stop containers | MEM_GB(4) → strikes
    HOST1_SYS_WATCHDOG_CHECK_RAM=true
 # ━━━ Tier 3 — Standard Checks (strike system) ━━━
 # Each check must fail SYS_WATCHDOG_STRIKE_LIMIT consecutive cycles before action is taken.
 # Single spikes are ignored — sustained problems trigger reboot.
 # /var/log filesystem usage above SYS_WATCHDOG_LOG_PCT.
 # Log spam (Docker log storms, syslog loops) fills rootfs — indicates something broken.
    HOST1_SYS_WATCHDOG_CHECK_LOG=true
 # ZFS ARC memory pinned above SYS_WATCHDOG_ARC_PINNED_PCT after cache drop.
 # Enabled on HOST1 — ZFS cache pools actively used. Disable on hosts without ZFS.
    HOST1_SYS_WATCHDOG_CHECK_ARC=true
 # CPU temperature above SYS_WATCHDOG_CPU_TEMP_MAX (95°C).
 # Sustained high temp causes kernel throttling or panic. Requires lm-sensors.
    HOST1_SYS_WATCHDOG_CHECK_CPU_TEMP=true
 # Load average above SYS_WATCHDOG_LOAD_MULTIPLIER × core count.
 # DISABLED on HOST1 — Tdarr and Emby cause legitimate sustained load spikes during encoding.
 # Enable on idle servers or adjust SYS_WATCHDOG_LOAD_MULTIPLIER if load is always high.
    HOST1_SYS_WATCHDOG_CHECK_LOAD=false
 # Zombie process count above SYS_WATCHDOG_ZOMBIE_LIMIT (50).
 # Large zombie counts indicate serious process management failure — something is stuck.
    HOST1_SYS_WATCHDOG_CHECK_ZOMBIES=true
 # Check docker_watchdog.sh persistent skip list — required containers on skip list.
 # Cross-watchdog coordination: if docker_watchdog gave up, system_watchdog escalates.
 # ENABLED — HOST1 fully built and operational, skip list is meaningful.
    HOST1_SYS_WATCHDOG_CHECK_CONTAINERS=true
 # /tmp filesystem usage above SYS_WATCHDOG_TMP_PCT with auto-clear attempt.
 # Script tries to clear aged /tmp files first — only strikes if clear fails.
 # Lock files, rsync temp files, and Docker ops use /tmp — 100% means lock failures.
    HOST1_SYS_WATCHDOG_CHECK_TMP=true
 # Array disk error count delta in /proc/mdstat — accumulating errors = disk failing now.
 # Triggers on SYS_WATCHDOG_MDSTAT_ERROR_LIMIT new errors in one cycle.
    HOST1_SYS_WATCHDOG_CHECK_MDSTAT=true
 # Primary NIC operstate — detects NIC going down (physical or driver failure).
 # Uses HOST1_SYS_WATCHDOG_NIC above. Strike system — brief flaps don't trigger reboot.
    HOST1_SYS_WATCHDOG_CHECK_NETWORK=true
 # sshd running check — attempts restart before escalating.
 # sshd down = no remote access. Script tries rc.sshd start, notifies, strikes on failure.
    HOST1_SYS_WATCHDOG_CHECK_SSHD=true
 # Runaway process detection — single process above SYS_WATCHDOG_RUNAWAY_CPU_PCT sustained.
 # DISABLED — Tdarr encoding and Emby transcoding legitimately peg CPU for extended periods.
 # Enable only if HOST1 has no CPU-intensive workloads.
    HOST1_SYS_WATCHDOG_CHECK_RUNAWAY=false
 # ==============================================================================================
 # ── RESOURCE MANAGER ──────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Containers to manage under pressure — see master.conf RW_CRITICAL_CONTAINERS for exclusions.
 # docker pause at medium pressure (RAM < RW_RAM_MEDIUM_GB or load > medium threshold)
 # Suspended in-place — instant to pause/unpause, no state lost, no restart delay.
    HOST1_RW_PAUSE_CONTAINERS=(
        "Huntarr"                       # arr search automation — safe to suspend
        "Cleanuparr"                    # download cleanup — safe to suspend
        "Healarr"                       # arr health checks — safe to suspend
        "Soularr"                       # Slskd automation — background only
        "ChannelTube"                   # YouTube archiver — background only
        "Pinchflat"                     # YouTube archiver — background only
    )
 # docker stop at hard pressure (RAM < RW_RAM_HARD_GB)
 # Full stop — these are optional/heavy services that free significant RAM when stopped.
 # resource_watchdog.sh restarts them when pressure fully clears (RAM >= RW_RAM_RECOVER_GB).
    HOST1_RW_STOP_CONTAINERS=(
        "LocalAI"                       # GPU/CPU heavy — largest RAM consumer when idle
        "7DaysToDie"                    # game server — optional
        "V-Rising"                      # game server — optional
        "Code-Server"                   # IDE — not needed during pressure events
    )
 # ==============================================================================================
 # ──────────────────────── End Of HOST1 Variables ──────────────────────────────────────────────
 # ==============================================================================================
@@ -1,644 +0,0 @@
 #!/bin/bash
 # ==============================================================================================
 # ========================== HOST2 CONFIGURATION — unRAID-Jayred365 ===========================
 # ==============================================================================================
 # HOST2-specific variables — credentials, container names, share paths, failover lists.
 # Sourced after master.conf — values here extend shared profile arrays and add HOST2-specific
 # identity, credentials, and container configuration.
 #
 # Sparse checkout (git) ensures HOST1 never receives this file.
 # HOST1 never sees HOST2 credentials — clean separation at the file level.
 #
 # DO NOT put shared config here — thresholds, toggles, profiles belong in master.conf.
 # DO NOT put HOST1 variables here — they belong in host1.conf.
 #
 # ── STATUS ────────────────────────────────────────────────────────────────────────────────────
 # HOST2 is currently being rebuilt — most sections scaffolded, fill in when back online.
 # When ready: set FALLBACK_ENABLED=true and DAILY_RSYNC_ENABLED=true in master.conf.
 #
 # ── INDEX ─────────────────────────────────────────────────────────────────────────────────────
 #
 #   ── IDENTITY & CONNECTIVITY ────────────────────────────────────────────────────────────────
 #   IDENTITY                hostname, SSH key
 #   EMBY                    container name, URL, API key
 #   NOTIFICATIONS           Discord webhook
 #   PARTNERSHIP             auth containers, backup paths
 #
 #   ── RSYNC ──────────────────────────────────────────────────────────────────────────────────
 #   DAILY SYNC SHARES       media shares HOST2 owns and pushes to HOST1
 #   WEEKLY SYNC SHARES      appdata shares synced weekly (Sunday 2:30am)
 #   CRITICAL SYNC SHARES    appdata shares synced every 30 minutes
 #   BACKUP VERIFY           shares for checksum verification against remote
 #   HOST2 RSYNC PROFILE     host2-appdata profile for HOST2-specific appdata syncs
 #
 #   ── DOCKER ─────────────────────────────────────────────────────────────────────────────────
 #   DOCKER DAILY RESTART    containers restarted daily
 #   DOCKER WEEKLY RESTART   containers restarted weekly
 #   DOCKER WATCHDOG         memory limits, health URLs, required containers, ignore list
 #   DOCKER NETWORK CONNECT  networks and containers for docker_network_connect.sh
 #
 #   ── FALLBACK ───────────────────────────────────────────────────────────────────────────────
 #   DDNS                    DDNS containers managed by HOST2
 #   INTERNET LOSS           containers stopped when internet is lost
 #   FALLBACK TIERS          what HOST2 runs for HOST1 per tier
 #   TIER DELAYS             how long HOST2 must be down before each tier activates on HOST1
 #   RSYNC WRITEBACK         HOST2 appdata synced back on handback
 #
 #   ── MEDIA ──────────────────────────────────────────────────────────────────────────────────
 #   MEDIA PERMISSIONS       share list for media_shares_permissions.sh
 #   MEDIA CLEANER           folder lists for media_cleaner.sh
 #
 #   ── MONITORS ───────────────────────────────────────────────────────────────────────────────
 #   CERTIFICATE MONITOR     domains checked for SSL expiry
 #   SMART HEALTH            drives to skip in SMART monitoring
 #   ZFS REPORT              pools to exclude from ZFS health report
 #
 #   ── TRANSCODES ─────────────────────────────────────────────────────────────────────────────
 #   TRANSCODES              ramdisk size, thresholds, SSD path, server array
 #
 #   ── ARR STACK ──────────────────────────────────────────────────────────────────────────────
 #   SONARR                  URL, API key, path map
 #   RADARR                  URL, API key, path map
 #   ARR RECOVERY            per-arr recovery toggles (no Lidarr on HOST2)
 #
 #   ── SYSTEM WATCHDOG ────────────────────────────────────────────────────────────────────────
 #   SYSTEM WATCHDOG         per-host check toggles and NIC configuration
 #
 #   ── RESOURCE MANAGER ───────────────────────────────────────────────────────────────────────
 #   RESOURCE MANAGER        containers paused/stopped under memory pressure
 #
 # ==============================================================================================
 # ==============================================================================================
 # ── IDENTITY & CONNECTIVITY ───────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Identity ━━━
 # HOST2 hostname lives in master.conf (not a credential — safe for all servers).
 # SSH key used for all server-to-server operations — rsync, failover container commands.
 # Must be in /root/.ssh/ and authorised in HOST1's /root/.ssh/authorized_keys.
    HOST2_SSH_KEY="/root/.ssh/Jayred365-rsync-key"
    HOST2_OWNER="jayred365"
    HOST2_OWNER_EMAIL=""              # fill in when HOST2 is back online
 # ━━━ Unraid API ━━━
 # Generate in Unraid: Settings → Management Access → API Keys → + New Key
    HOST2_UNRAID_API_KEY="2bdf5119d61eefa3023434748bd1c171bd23dc0b2ebc8586e24abe07df986acc"
 # ━━━ Emby ━━━
 # Referenced by transcode_manager.sh, emby_session_report.sh, emby_database_repair.sh,
 # weekly_sync_maintenance.sh, and HOST2_TRANSCODE_SERVERS below.
 # API key: Emby Dashboard → API Keys → + New Key
    HOST2_EMBY_CONTAINER="Emby-Jayred365"
    HOST2_EMBY_URL="http://localhost:8096"
    HOST2_EMBY_API_KEY="your-host2-emby-api-key"
 # ━━━ Jellyfin ━━━
 # API key: Jellyfin Dashboard → Administration → API Keys → + New Key
    HOST2_JELLYFIN_CONTAINER="Jellyfin"
    HOST2_JELLYFIN_URL="http://localhost:8095"
    HOST2_JELLYFIN_API_KEY="956d0168987f4e4680626653abb080f0"
 # ━━━ Notifications ━━━
 # Discord webhook — leave blank to disable.
 # Per-host so HOST1 and HOST2 can post to different channels or only one server notifies.
    HOST2_DISCORD_WEBHOOK=""
 # ━━━ Partnership ━━━
 # HOST2 is the mirror — HOST1 is always the owner unless --transfer has been run.
 # See README-Partnership.md and master.conf PARTNERSHIP section for full lifecycle docs.
 # Auth containers reconfigured on onboard/offboard.
 # Format: "ContainerName|WebUIPort"
 # On onboard → WebUI pointed at owner's Tailscale IP (mirror clicks NPM, gets owner's auth)
 # On offboard → WebUI pointed back at localhost
    HOST2_PARTNERSHIP_AUTH_WEBUIS=(
        # fill in when HOST2 is back online
        # "NginxProxyManager|81"
    )
 # Containers to stop on this server before the owner deploys the auth stack during onboard.
 # List whatever auth/proxy containers are currently running here.
    HOST2_PARTNERSHIP_REPLACE_CONTAINERS=(
        "NginxProxyManager"
        "Authelia"
        "Authelia-Secondary"
        "Mariadb-Authelia"
        "Mariadb-Authelia-Secondary"
        "Redis-Authelia"
        "Redis-Authelia-Secondary"
        "Lldap"
    )
 # Arr containers to stop on this server before the owner deploys the arr stack during onboard.
    HOST2_PARTNERSHIP_ARR_REPLACE_CONTAINERS=(
        # "Sonarr"
        # "Radarr"
        # "Lidarr"
        # "Prowlarr"
        # "Bazarr"
    )
 # Paths HOST1 should collect during the grace window after offboard.
 # Notified on offboard — no auto-deletion, HOST1 must collect manually within PARTNERSHIP_GRACE_HOURS.
    HOST2_PARTNERSHIP_MIRROR_BACKUPS=(
        # fill in when HOST2 is back online
    )
 # Containers parked on this server when partnership is active.
 # Stopped on onboard (owner deploys its stack instead), restarted on offboard.
    HOST2_PARTNERSHIP_OWN_CONTAINERS=(
        # "Emby"
        # "NginxProxyManager"
    )
 # This server's desired Emby admin account on the shared Emby instance.
 # Set these — owner reads them during --onboard to create the account.
    HOST2_PARTNERSHIP_EMBY_ADMIN_USER=""            # desired Emby username
    HOST2_PARTNERSHIP_EMBY_ADMIN_PASS=""            # desired Emby password
 # ==============================================================================================
 # ── RSYNC ─────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Daily Sync Shares ━━━
 # Shares HOST2 pushes to all other nodes every night (1am via daily_sync_maintenance.sh).
 # Mesh model: every node pushes every media share — no ownership, no mirrors.
 # arr_sync ensures all arr libraries converge (union). rsync spreads files (additive, no --delete).
 # arr_cleanup removes true orphans based on local arr state.
 # Any node can download content to any share — it propagates to all nodes on the next cycle.
 # Nextcloud excluded — personal data, not arr-managed, synced HOST1→HOST2 only as offsite backup.
 # Uses DEFAULT_RSYNC_OPTS from master.conf — no profile needed.
 # For shares needing container stops or custom options — add a profile in master.conf.
    HOST2_DAILY_SYNC_SHARES=(
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Shows
        /mnt/user/Books
        /mnt/user/Intros
        /mnt/user/Kids_Movies
        /mnt/user/Kids_Tv_Shows
        /mnt/user/Movies
        /mnt/user/Music
        /mnt/user/Music_Videos
        /mnt/user/stand-up_comedy
        /mnt/user/Sports
        /mnt/user/Tv_Shows
        /mnt/user/Anime_Shows-Old
        /mnt/user/Anime_Movies-Old
    )
 # Personal encrypted shares — synced for offsite backup, independent of media shares.
 # ZFS encrypted at dataset level — remote receives encrypted blocks, cannot read content.
 # See README-Rsync_Setup.md for ZFS encryption setup before uncommenting.
    HOST2_PERSONAL_SHARES=(
        # /mnt/user/HOST2-Personal     # uncomment after creating encrypted dataset
    )
 # ━━━ Weekly Sync Shares ━━━
 # Appdata shares synced during the weekly maintenance window (Sunday 2:30am).
 # Containers stopped both sides before sync — full clean state guaranteed.
 # Profiles drive container stops, excludes, and options — configured in master.conf RSYNC section.
    HOST2_WEEKLY_SYNC_SHARES=(
        # fill in when HOST2 is back online
        # "/mnt/user/Media_Server/Emby"
        # "/mnt/user/appdata-Fallback/Critical-Data"
    )
 # ━━━ Intermediate Sync Shares ━━━
 # Shares synced every 4 hours by intermediate_sync_maintenance.sh.
 # Uses DEFAULT_RSYNC_OPTS (no --delete) — for sub-daily propagation of metadata or watch state.
 # Full media share sync stays in the daily window. Leave empty to skip mid-day rsync entirely.
    HOST2_INTERMEDIATE_SYNC_SHARES=(
        # fill in when HOST2 is back online
        # Example: "/mnt/user/Emby_Metadata"
    )
 # ━━━ Critical Sync Shares ━━━
 # Appdata shares synced every 30 minutes by critical_sync_maintenance.sh.
 # Format: "/path/to/share" or "/path/to/share|profile-name"
    HOST2_CRITICAL_SYNC_SHARES=(
        # fill in when HOST2 is back online
        # "/mnt/user/appdata-Fallback/Critical-Data|critical-fallback"
        # "/mnt/user/Media_Server/Emby|emby-fallback"
    )
 # ━━━ Backup Verify ━━━
 # Shares verified by backup_verify.sh — random file checksum comparison against remote.
 # Leave empty to use HOST2_DAILY_SYNC_SHARES automatically.
 # Sample size and minimum file size defined in master.conf.
    HOST2_BACKUP_VERIFY_SHARES=(
        # leave empty to use HOST2_DAILY_SYNC_SHARES automatically
    )
 # ━━━ HOST2 Rsync Profile — host2-appdata ━━━
 # HOST2-specific appdata sync profile — extends the shared PROFILE_* arrays in master.conf.
 # Use for appdata unique to HOST2.
 # Shared appdata (auth stack, Emby) use dedicated profiles defined in master.conf.
 # Run manually: bash Rsync/rsync.sh /mnt/user/appdata-Fallback/HOST2-Appdata --profile=host2-appdata
    PROFILE_RSYNC_OPTS[host2-appdata]="-av --info=progress2 --bwlimit=${PROFILE_BW_LIMIT[host2-appdata]:-8000}"
    PROFILE_BW_LIMIT[host2-appdata]=8000
    PROFILE_RETRY_COUNT[host2-appdata]=3
    PROFILE_SLEEP[host2-appdata]=300
    PROFILE_CRITICAL_CONTAINER_NAMES[host2-appdata]=""     # fill in when HOST2 is back online
    PROFILE_DELAYED_CONTAINERS[host2-appdata]=""
    PROFILE_CONTAINER_DELAY[host2-appdata]=5
    PROFILE_EXCLUDE_DIRS[host2-appdata]="logs *.tmp"
 # ==============================================================================================
 # ── DOCKER ────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Docker Daily Restart ━━━
 # Containers restarted every day via DAILY_MAINTENANCE_SCRIPTS.
 # Fill in when HOST2 is back online — add containers that degrade without daily restart.
    HOST2_DAILY_RESTART_CONTAINERS=(
        "NginxProxyManager"
        # add HOST2 daily restart containers here
    )
 # ━━━ Docker Weekly Restart ━━━
 # Less critical services restarted weekly via WEEKLY_MAINTENANCE_SCRIPTS (Sunday 2:30am).
 # Containers already stopped for weekly sync — restart adds zero extra downtime.
    HOST2_WEEKLY_RESTART_CONTAINERS=(
        # add HOST2 weekly restart containers here
    )
 # ━━━ Docker Watchdog ━━━
 # Per-HOST2 container configuration for docker_watchdog.sh.
 # Shared thresholds and toggles live in master.conf.
 # Memory hard limits in MB — immediate restart if exceeded.
 # Set at "container is clearly broken" not "container is busy".
 # 20GB=20480  16GB=16384  12GB=12288  10GB=10240  8GB=8192  4GB=4096  2GB=2048  1GB=1024
    declare -A HOST2_WATCHDOG_CONTAINERS=(
        ["Emby"]=16384              # fill in correct limit when HOST2 is back online
    )
 # HTTP health check URLs — checked every cycle, strike system before restart.
 # Only add containers with a meaningful web interface to check.
    declare -A HOST2_WATCHDOG_CONTAINER_URLS=(
        ["Emby"]="http://localhost:8096"
    )
 # Required containers — must always be running on HOST2.
 # Strike system before restart — repeated failures go on skip list, auto-clears on recovery.
 # Listed in dependency order — dependencies before dependents.
    HOST2_WATCHDOG_REQUIRED_CONTAINERS=(
        "NginxProxyManager"
        # add HOST2 required containers here when back online
    )
 # Containers to skip in Tier 2 global scan — legitimately stopped or frequently restarting.
 # Watchdog leaves these alone entirely — no restart attempts, no crash loop tracking.
    HOST2_WATCHDOG_SCAN_IGNORE=(
        # add HOST2 scan ignore containers here when back online
    )
 # Dependency ordering — skip restarting a container if its dependency is also down.
 # Prevents watchdog from restarting dependent services before their dependencies are up.
 # SPACE-SEPARATED STRINGS — converted to array at runtime.
    declare -A HOST2_WATCHDOG_DEPENDENCIES=(
        # add HOST2 dependencies here when containers are defined
        # ["Authelia"]="Mariadb-Authelia Redis-Authelia"
    )
 # Per-container appdata growth suppress ceilings in MB.
 # ONLY needed in specific cases — growth rate detection covers all containers automatically.
 # Use when a container legitimately has large stable data and you want to suppress false-positive
 # growth alerts. Add entries here only when a container triggers warnings it shouldn't.
    declare -A HOST2_WATCHDOG_APPDATA_SIZES=(
        # add HOST2 suppress entries here only as needed
    )
 # ━━━ Docker Network Connect ━━━
 # Containers connected to custom networks at array start by docker_network_connect.sh.
 # Networks created if they don't exist — idempotent, safe to re-run.
    HOST2_NETWORK_CONNECT_CONTAINERS=(
        # fill in when HOST2 is back online
    )
    HOST2_NETWORK_CONNECT_NETWORKS=(
        # fill in when HOST2 is back online
    )
 # ==============================================================================================
 # ── FALLBACK ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ DDNS ━━━
 # DDNS containers HOST2 manages — started/stopped by fallback.sh per DDNS absolute rules:
 #   Internet loss → stop immediately
 #   Failover → HOST1 starts HOST2's DDNS as Tier 1 (before any other containers)
 #   Handback → stop HOST2's DDNS on HOST1 → rsync → start containers → start local DDNS last
    HOST2_DDNS_CONTAINERS=(
        "Gmer4Lfe.us"
    )
 # ━━━ Internet Loss ━━━
 # Containers stopped immediately on HOST2 when internet connection is lost.
 # Prevents external-facing services from operating without connectivity.
    FALLBACK_HOST2_STOP_ON_NO_NET=(
        "Gmer4Lfe.us"
    )
 # ━━━ Fallback Tiers — HOST2 Runs for HOST1 ━━━
 # Containers HOST2 starts when HOST1 goes down.
 # Tier 1 is always immediate — vital services cannot wait.
 # Higher tiers activate after HOST1_TIER*_DELAY minutes (set in host1.conf).
    FALLBACK_HOST2_COVERS_HOST1_TIER1=(
        "Gmer4Lfe.com"
        "Gitea"                 # source of truth — must be reachable even when HOST1 auth stack is down
        "Emby"
        "VaultWarden-Gmer4Lfe"
        "Dispatcharr"
        "Dispatcharr-Basic"
        "Dispatcharr-Iptv-Users"
        "ErsatzTV-Emby"
    )
    FALLBACK_HOST2_COVERS_HOST1_TIER2=(
        "Postgres-NextCloud"
        "NextCloud"
        "PostgreSQL_Immich"
        "Immich-Gmer4Lfe"
    )
    FALLBACK_HOST2_COVERS_HOST1_TIER3=(
        "Gitea"
    )
    FALLBACK_HOST2_COVERS_HOST1_TIER4=(
        "Sonarr"
        "Radarr"
        "Lidarr"
        "Readarr"
        "Prowlarr"
        "Bazarr"
        "SABnzbd-Gmer4Lfe"
        "Qbittorrent-Gmer4Lfe"
        "LidaTube"
        "Pinchflat"
        "ChannelTube"
    )
 # ━━━ Tier Delays — HOST2's Containers on HOST1 ━━━
 # How long HOST2 must be down before each tier activates on HOST1 — in minutes.
 # Tier 1 is always immediate — no delay var needed.
    HOST2_TIER2_DELAY=240           # 4 hours  — productivity services
    HOST2_TIER3_DELAY=720           # 12 hours — secondary services
    HOST2_TIER4_DELAY=1440          # 24 hours — arrs + downloaders
 # ━━━ Rsync Writeback — HOST2 Appdata Back on Handback ━━━
 # Syncs HOST2 appdata BACK to HOST2 when it comes back online after a failover.
 # Containers stopped before writeback — clean source, no competing writes.
 #
 # HOST2_TIER1_WRITEBACK_DELAY: short outages skip Tier 1 writeback — primary state
 # is more reliable than dirty sync data for brief outages.
    HOST2_TIER1_WRITEBACK_DELAY=60  # skip writeback if outage under 1hr
 # Tier 4 automatically syncs HOST2_DAILY_SYNC_SHARES — only list paths NOT in that array.
    FALLBACK_HOST2_WRITEBACK_TIER1=(
        # "/mnt/user/appdata-Fallback/Jayred365-Emby"
    )
    FALLBACK_HOST2_WRITEBACK_TIER2=(
        # "/mnt/user/appdata-Fallback/Jayred365-Important"
    )
    FALLBACK_HOST2_WRITEBACK_TIER3=(
        # "location-placeholder"
    )
    FALLBACK_HOST2_WRITEBACK_TIER4=(
        "/mnt/user/appdata-Fallback/Arrs_Stack"     # arr databases — downloads queued during outage
    )
 # ==============================================================================================
 # ── MEDIA ─────────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Media Permissions ━━━
 # Shares that media_shares_permissions.sh applies PERMISSIONS_MODE and PERMISSIONS_OWNER to.
 # Runs first in DAILY_MAINTENANCE_SCRIPTS — arr cleanup depends on correct ownership.
    HOST2_MEDIA_PERMISSION_SHARES=(
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Shows
    )
 # ━━━ Media Cleaner ━━━
 # Folder lists for media_cleaner.sh — two profiles: anime and media.
 # File patterns shared across all servers — defined in master.conf.
 # Called via DAILY_MAINTENANCE_SCRIPTS. Run manually: Media/media_cleaner.sh anime|media
    HOST2_ANIME_CLEAN_FOLDERS=(
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Shows
    )
    HOST2_MEDIA_CLEAN_FOLDERS=(
        # fill in when HOST2 is back online
    )
 # ==============================================================================================
 # ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # ━━━ Certificate Monitor ━━━
 # Domains checked via direct openssl connection — not relying on NPM's certificate state.
 # Checks the actual certificate served, not what NPM thinks it has.
 # Thresholds (CERT_WARN_DAYS, CERT_CRIT_DAYS) defined in master.conf.
    HOST2_CERT_MONITOR_DOMAINS=(
        # fill in when HOST2 is back online
    )
 # ━━━ SMART Health ━━━
 # Drives skipped in SMART attribute monitoring — hardware is server-specific.
 # Thresholds read from dynamix.cfg at runtime — fallbacks in master.conf.
    HOST2_SMART_IGNORE_DRIVES=(
        "sda"                       # boot USB — SMART not meaningful on flash drives
    )
 # ━━━ ZFS Report ━━━
 # Pools excluded from the weekly ZFS health report — reduces noise from single-disk array pools.
 # Pool health thresholds defined in master.conf.
    HOST2_ZFS_REPORT_IGNORE_POOLS=(
        # fill in when HOST2 is back online
    )
 # ==============================================================================================
 # ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Ramdisk size ceiling — tmpfs only uses RAM actually needed, not the full size upfront.
 # Adjust HOST2_RAMDISK_WARN_GB and HOST2_RAMDISK_LOW_GB together if this changes.
    HOST2_RAMDISK_SIZE="8G"
 # Usage thresholds — coupled to HOST2_RAMDISK_SIZE, adjust all three together if size changes.
 # Hysteresis gap (6.8 - 5.5 = 1.3GB) prevents flip-flop between ramdisk and SSD.
    HOST2_RAMDISK_WARN_GB=6.8      # flip to SSD when ramdisk usage reaches this
    HOST2_RAMDISK_LOW_GB=5.5       # flip back to ramdisk when usage drops to this
 # SSD fallback path — where transcodes land when ramdisk exceeds HOST2_RAMDISK_WARN_GB.
 # Must be on cache pool — array disks too slow for active transcode writes.
    HOST2_TRANSCODE_SSD="/mnt/cache/Temp_Storage/Emby/Transcodes/"
 # Media servers sharing the ramdisk transcode space on HOST2.
 # Format: "ContainerName|URL|APIKey|Type" — Type: emby | jellyfin | plex
 # Entries with placeholder API keys are skipped automatically.
 # ⚠️ Tdarr does NOT belong here — keep Tdarr on SSD, not ramdisk.
    HOST2_TRANSCODE_SERVERS=(
        "${HOST2_EMBY_CONTAINER}|${HOST2_EMBY_URL}|${HOST2_EMBY_API_KEY}|emby"
        "${HOST2_JELLYFIN_CONTAINER}|${HOST2_JELLYFIN_URL}|${HOST2_JELLYFIN_API_KEY}|jellyfin"
    )
 # ==============================================================================================
 # ── ARR STACK ─────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Used by arr cleanup scripts and arrs_failed_stalled_recovery.sh.
 # detect_hosts() selects HOST2 vars when running on HOST2.
 # Lidarr does not run on HOST2 — HOST1_LIDARR_RECOVERY flag handles the exit cleanly.
 #
 # PATH MAPS — container path → host path translation.
 # Arr stores file paths using container-internal paths — scripts need host paths to scan.
 # Add one entry per root folder in arr Settings → Media Management → Root Folders.
    HOST2_FANART_API_KEY="Yd7147a43b692df0b364b94dc47efb81"
    HOST2_LASTFM_API_KEY="be6dc169c33ae263e690c30d18b7491d"
 # ━━━ Sonarr ━━━
    HOST2_SONARR_URL="http://localhost:8989"
    HOST2_SONARR_API_KEY="130decd3db5b4c25afad64864cd03f9f"
    HOST2_SONARR_TV_ROOT="/mnt/user/Anime_Shows"
    declare -A HOST2_SONARR_PATH_MAP=(
        # fill in when HOST2 is back online
        # ["/tv"]="/mnt/user/Anime_Shows"
    )
 # ━━━ Radarr ━━━
    HOST2_RADARR_URL="http://localhost:7878"
    HOST2_RADARR_API_KEY="d43a3ec6cf1549edb4af0cc63f98b2a9"
    HOST2_RADARR_MOVIES_ROOT="/mnt/user/Anime_Movies"
    declare -A HOST2_RADARR_PATH_MAP=(
        # fill in when HOST2 is back online
        # ["/anime-movies"]="/mnt/user/Anime_Movies"
    )
 # ━━━ Arr Recovery Toggles ━━━
 # false = skip that arr on this host — exits cleanly without error
    HOST2_SONARR_RECOVERY=true
    HOST2_RADARR_RECOVERY=true
    # HOST2_LIDARR_RECOVERY not set — Lidarr does not run on HOST2
 # ==============================================================================================
 # ── SYSTEM WATCHDOG ───────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Per-host check toggles and NIC config for system_watchdog.sh.
 # Aliased by detect_hosts() — script uses unprefixed SYS_WATCHDOG_* names.
 # HOST2: i5 10th gen 64GB — being rebuilt, lighter workload, no ZFS cache pools.
 #
 # Conservative defaults during rebuild — re-enable checks as HOST2 stabilises.
 # Three-tier response — all critical checks enabled regardless of rebuild state:
 #   Tier 1 (bypass strikes, reboot now):  docker daemon, rootfs full, kernel oops, FD, /boot
 #   Tier 2 (bypass strikes with OOM):     RAM critical + OOM kills in cycle
 #   Tier 3 (standard strike system):      selectively disabled during rebuild
 #
 # RAM tiers, OOM limits, and reboot loop settings in master.conf System Watchdog section.
 # ━━━ Primary NIC ━━━
 # Network interface for NIC state check — verify with: ip link show | grep "^[0-9]"
 # Common values: eth0, bond0, br0, eno1
    HOST2_SYS_WATCHDOG_NIC="eth0"
 # ━━━ Tier 1 — Critical Checks ━━━
 # All critical checks always enabled — these protect against acute failure regardless of
 # rebuild state. Disabling any is not recommended.
 # Docker daemon unresponsive → try restart, reboot if restart fails.
    HOST2_SYS_WATCHDOG_CHECK_DOCKER_DAEMON=true
 # rootfs at critical threshold (ROOTFS_CRITICAL_PCT=99) → reboot immediately.
    HOST2_SYS_WATCHDOG_CHECK_ROOTFS=true
 # Kernel BUG/Oops in dmesg delta since last cycle → reboot immediately.
    HOST2_SYS_WATCHDOG_CHECK_KERNEL_OOPS=true
 # File descriptor exhaustion at FD_CRITICAL_PCT (95%) → reboot immediately.
    HOST2_SYS_WATCHDOG_CHECK_FD=true
 # /boot read-only detected → reboot immediately.
    HOST2_SYS_WATCHDOG_CHECK_BOOT=true
 # ━━━ Tier 2 — Urgent OOM Check ━━━
 # Both must be enabled for Tier 2 bypass to function.
 # Track kernel OOM kills each cycle via /proc/vmstat oom_kill delta.
    HOST2_SYS_WATCHDOG_CHECK_OOM=true
 # Free RAM check — 64GB RAM on HOST2, tiers adjusted relative to HOST1.
 # Update master.conf SYS_WATCHDOG_MEM_* thresholds if HOST2 needs different values.
 # Currently inheriting shared master.conf values — may want lower thresholds on 64GB.
    HOST2_SYS_WATCHDOG_CHECK_RAM=true
 # ━━━ Tier 3 — Standard Checks (strike system) ━━━
 # Several checks disabled during rebuild — enable progressively as HOST2 stabilises.
 # Each check must fail SYS_WATCHDOG_STRIKE_LIMIT consecutive cycles before action.
 # /var/log filesystem usage above SYS_WATCHDOG_LOG_PCT.
    HOST2_SYS_WATCHDOG_CHECK_LOG=true
 # ZFS ARC memory check.
 # DISABLED — HOST2 has no ZFS cache pools. Enable if ZFS pools are added later.
    HOST2_SYS_WATCHDOG_CHECK_ARC=false
 # CPU temperature above SYS_WATCHDOG_CPU_TEMP_MAX (95°C).
    HOST2_SYS_WATCHDOG_CHECK_CPU_TEMP=true
 # Load average above SYS_WATCHDOG_LOAD_MULTIPLIER × core count.
 # DISABLED — rebuild operations cause legitimate load spikes. Enable after rebuild.
    HOST2_SYS_WATCHDOG_CHECK_LOAD=false
 # Zombie process count above SYS_WATCHDOG_ZOMBIE_LIMIT (50).
    HOST2_SYS_WATCHDOG_CHECK_ZOMBIES=true
 # docker_watchdog.sh persistent skip list check.
 # DISABLED during rebuild — skip list may be unreliable mid-rebuild, avoid false reboots.
 # Enable once HOST2 is fully operational and docker_watchdog.sh is running stably.
    HOST2_SYS_WATCHDOG_CHECK_CONTAINERS=false
 # /tmp filesystem usage with auto-clear attempt.
    HOST2_SYS_WATCHDOG_CHECK_TMP=true
 # Array disk error count delta in /proc/mdstat.
    HOST2_SYS_WATCHDOG_CHECK_MDSTAT=true
 # Primary NIC operstate — uses HOST2_SYS_WATCHDOG_NIC above.
    HOST2_SYS_WATCHDOG_CHECK_NETWORK=true
 # sshd running check — restart attempt before escalating.
    HOST2_SYS_WATCHDOG_CHECK_SSHD=true
 # Runaway process detection.
 # DISABLED — rebuild workloads may legitimately peg CPU. Enable after rebuild.
    HOST2_SYS_WATCHDOG_CHECK_RUNAWAY=false
 # ==============================================================================================
 # ── RESOURCE MANAGER ──────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 # Containers to manage under pressure — see master.conf RW_CRITICAL_CONTAINERS for exclusions.
 # docker pause at medium pressure (RAM < RW_RAM_MEDIUM_GB or load > medium threshold)
 # Suspended in-place — instant to pause/unpause, no state lost, no restart delay.
    HOST2_RW_PAUSE_CONTAINERS=(
        # fill in when HOST2 is back online
    )
 # docker stop at hard pressure (RAM < RW_RAM_HARD_GB)
 # Full stop — these are optional/heavy services that free significant RAM when stopped.
 # resource_watchdog.sh restarts them when pressure fully clears (RAM >= RW_RAM_RECOVER_GB).
    HOST2_RW_STOP_CONTAINERS=(
        # fill in when HOST2 is back online
    )
 # ==============================================================================================
 # ──────────────────────── End Of HOST2 Variables ──────────────────────────────────────────────
 # ==============================================================================================
@@ -105,8 +105,8 @@
 # detect_hosts() in common.sh matches the local hostname against these to set MY_ID / REMOTE_ID.
 # Tailscale IP resolution uses these names — no hardcoded IPs needed.
 # To add a new server: add HOST3="unRAID-NewServer" here + create host3.conf.
-    HOST1="unRAID-Gmer4Lfe"
+    HOST1=""    # this server's Unraid hostname — must match exactly (case-sensitive)
-    HOST2="unRAID-Jayred365"
+    HOST2=""    # partner server hostname — leave blank if running standalone
 # ==============================================================================================
 # ── SHARED HOST CONFIGURATION ─────────────────────────────────────────────────────────────────
@@ -248,7 +248,7 @@
 # Detects Gitea container location at runtime — works through failover automatically.
 # Falls back to GITEA_DOMAIN if local and Tailscale both fail.
    GITEA_CONTAINER="Gitea"
-    GITEA_REPO_PATH="FailedProxy/Varaverk.git"
+    GITEA_REPO_PATH=""                  # e.g. YourUser/Varaverk.git
    GITEA_DOMAIN=""                         # e.g. git.yourdomain.com — requires NPM + DNS
    TARGET_DIR="/mnt/user/appdata/Varaverk"
    GITEA_SSH_KEY="/root/.ssh/unraid_gitea"
@@ -462,9 +462,9 @@
 #   → Run individual: bash Rsync/rsync.sh /mnt/user/Movies
 #   → When ready: INTERMEDIATE_RSYNC_ENABLED=true  DAILY_RSYNC_ENABLED=true
    RSYNC_ENABLED=true                  # Tier 1 — global gate, overrides everything below
-    CRITICAL_RSYNC_ENABLED=false        # Tier 2 — disabled during HOST2 rebuild, re-enable when ready
+    CRITICAL_RSYNC_ENABLED=true         # Tier 2 — critical_sync_maintenance.sh rsync section
    INTERMEDIATE_RSYNC_ENABLED=true     # Tier 2 — intermediate_sync_maintenance.sh rsync section
-    DAILY_RSYNC_ENABLED=false           # Tier 2 — HOST2 rebuild in progress, re-enable when ready
+    DAILY_RSYNC_ENABLED=true            # Tier 2 — daily_sync_maintenance.sh rsync section
    WEEKLY_RSYNC_ENABLED=true           # Tier 2 — weekly_sync_maintenance.sh rsync section
    FALLBACK_RSYNC_ENABLED=true         # Tier 2 — fallback.sh writeback jobs on handback
@@ -563,9 +563,9 @@
 # SPACE-SEPARATED STRINGS — converted to array at runtime
    declare -A PROFILE_CRITICAL_CONTAINER_NAMES=(
        [arrs_stack]="Sonarr Lidarr Readarr Radarr Prowlarr Bazarr Pinchflat"
-        [critical-data]="Mariadb-Authelia Mariadb-Authelia-Secondary Redis-Authelia Redis-Authelia-Secondary Lldap-Gmer4Lfe NginxProxyManager Authelia Authelia-Secondary"
+        [critical-data]=""              # e.g. "Mariadb Authelia Redis NginxProxyManager"
        [critical-fallback]=""      # dirty sync — auth stays running both sides
-        [important-data]="Postgres-NextCloud NextCloud"
+        [important-data]=""             # e.g. "Postgres NextCloud"
        [emby]="Emby"
        [emby-fallback]=""          # dirty sync — Emby stays running both sides
    )
@@ -574,7 +574,7 @@
 # SPACE-SEPARATED STRINGS — converted to array at runtime
    declare -A PROFILE_DELAYED_CONTAINERS=(
        [arrs_stack]=""
-        [critical-data]="Authelia Authelia-Secondary"   # wait for Mariadb + Redis
+        [critical-data]=""              # e.g. "Authelia" — containers that need a delay after db starts
        [critical-fallback]=""
        [important-data]="NextCloud"                    # wait for Postgres
        [emby]=""
@@ -607,7 +607,7 @@
 # Used by dirty sync profiles (critical-fallback, emby-fallback) so remote picks up changes.
 # SPACE-SEPARATED STRINGS — converted to array at runtime
    declare -A PROFILE_REMOTE_RESTART_CONTAINERS=(
-        [critical-fallback]="NginxProxyManager Authelia Authelia-Secondary Lldap-Gmer4Lfe Mariadb-Authelia Mariadb-Authelia-Secondary Redis-Authelia Redis-Authelia-Secondary"
+        [critical-fallback]=""          # containers to restart on remote after dirty sync
        [emby-fallback]="Emby"
    )
@@ -635,7 +635,7 @@
    FALLBACK_CHECK_INTERVAL=30      # seconds between fallback state checks
    FALLBACK_HANDBACK_STRIKES=3     # consecutive healthy checks before initiating handback (3×30s = 90s)
    FALLBACK_STATE_FILE="/boot/config/fallback_state.db"
-    FALLBACK_ENABLED=true           # HOST2 back online
+    FALLBACK_ENABLED=false          # set true once both servers are configured and paired
                                    # false = suppresses "not running" warnings in status scripts
    FALLBACK_PARTNERSHIP_REQUIRED=true          # gate fallback on an active partnership
                                                # false = standalone mode, no partnership dependency
@@ -28,6 +28,7 @@
 #   Step 6: Deploy arr stack     — push arr XMLs, pull images, create + start on mirror
 #   Step 7: Partnership onboard  — configure WebUIs → owner IP, write state, FolderView3, Emby
 #   Step 8: Arr bootstrap        — bidirectional library sync (arr_sync.sh)
 #   Step 9: Conf push            — push master.conf + setup state to all listed hosts
 #
 # ==============================================================================================
 # DESIGN PRINCIPLES
@@ -486,6 +487,7 @@ ARR_DEPLOYED=0
 ARR_FAILED=0
 ONBOARD_OK=false
 ARR_SYNC_OK=false
 MASTER_PUSH_OK=false
 # ── Step 1: SSH ───────────────────────────────────────────────────────────────────────────────
 echo "━━━ Step 1/8 — SSH Key Setup ━━━"
@@ -614,6 +616,42 @@ else
    warn "Re-run Media/arr_sync.sh once all arr containers are live"
 fi
 # ── Step 9: Push master.conf to all listed hosts ──────────────────────────────────────────────
 # SSH is now established and all partners have the plugin installed.
 # Push the authoritative master.conf so every listed host is in sync immediately.
 echo ""
 echo "━━━ $ICON_GEAR Step 9/9 — master.conf Push ━━━"
 if [[ "$ONBOARD_OK" == false ]]; then
    warn "Skipping — onboard did not complete"
 elif [[ "$DRY_RUN" == true ]]; then
    warn "DRY RUN — would push master.conf to all listed hosts"
    MASTER_PUSH_OK=true
 elif ! command -v php &>/dev/null; then
    warn "php not available — push master.conf manually via Scheduler → master.conf → Save Conf"
 else
    push_output=$(php -r "
 require_once '/usr/local/emhttp/plugins/varaverk/include/config.php';
 \$results = vv_push_master_conf();
 vv_push_setup_state();
 if (empty(\$results)) { echo 'no remote hosts'; exit(0); }
 \$failed = 0;
 foreach (\$results as \$r) {
    echo \$r['host'] . ': ' . (\$r['ok'] ? 'pushed' : 'FAILED — ' . \$r['error']) . PHP_EOL;
    if (!\$r['ok']) \$failed++;
 }
 exit(\$failed > 0 ? 1 : 0);
 " 2>/dev/null)
    push_rc=$?
    echo "$push_output"
    if [[ $push_rc -eq 0 ]]; then
        echo "master.conf sync complete ✅"
        MASTER_PUSH_OK=true
    else
        warn "master.conf push had failures — retry via Scheduler → master.conf → Save Conf"
    fi
 fi
 # ── Summary ───────────────────────────────────────────────────────────────────────────────────
 END=$(date +%s)
 echo ""
@@ -633,6 +671,7 @@ echo "  Step 5 — Stop arr:      $(_skip "$SKIP_ARR_STACK"   "$STEP_STOP_ARR_OK
 echo "  Step 6 — Arr stack:     $( [[ "$SKIP_ARR_STACK" == true ]] && echo "skipped" || echo "${ARR_DEPLOYED} deployed, ${ARR_FAILED} failed" )"
 echo "  Step 7 — Onboard:       $(_ok "$ONBOARD_OK")"
 echo "  Step 8 — Arr bootstrap: $( [[ "$SKIP_ARR_SYNC" == true || "$ONBOARD_OK" == false ]] && echo "skipped" || echo "$(_ok "$ARR_SYNC_OK")" )"
 echo "  Step 9 — Conf push:     $( [[ "$ONBOARD_OK" == false ]] && echo "skipped" || echo "$(_ok "$MASTER_PUSH_OK")" )"
 echo ""
 if [[ "$ONBOARD_OK" == true ]]; then
@@ -294,8 +294,8 @@ if [[ "$DRY_RUN" == false ]]; then
    scp -i "$SSH_KEY" \
        -o ConnectTimeout="$SSH_TIMEOUT" \
        -o StrictHostKeyChecking=no \
-        "$SCRIPTS_ROOT/master.conf" \
+        "$SCRIPTS_ROOT/Configurations/master.conf" \
-        "root@${MIRROR_IP}:/mnt/user/appdata/Varaverk/master.conf" 2>/dev/null && \
+        "root@${MIRROR_IP}:/mnt/user/appdata/Varaverk/Configurations/master.conf" 2>/dev/null && \
        log "master.conf pushed to $NEW_OWNER ✅" || \
        error "Failed to push master.conf to $NEW_OWNER — set PARTNERSHIP_OWNER_HOST=\"$NEW_OWNER_ID\" manually"
 else
@@ -7,6 +7,21 @@ $plugin  = 'varaverk';
 $docroot = $docroot ?? $_SERVER['DOCUMENT_ROOT'] ?: '/usr/local/emhttp';
 $pluginDir = "$docroot/plugins/$plugin";
 require_once "$pluginDir/include/config.php";
 // First-run check — show setup wizard if HOST1 is blank OR local host.conf is missing
 $_master = vv_read_conf_raw('master.conf');
 preg_match('/^\s*HOST1\s*=\s*"([^"]*)"/m', $_master, $_h1m);
 $_host1_blank  = empty(trim($_h1m[1] ?? ''));
 $_my_hostid    = vv_detect_host();
 $_conf_missing = $_my_hostid !== 'unknown'
    && !file_exists(CONF_DIR . '/' . $_my_hostid . '.conf');
 if ($_host1_blank || $_conf_missing) {
    include "$pluginDir/pages/setup.php";
    return;
 }
 unset($_master, $_h1m, $_host1_blank, $_my_hostid, $_conf_missing);
 // Determine active tab
 $tab = $_GET['tab'] ?? 'monitor';
 $validTabs = ['monitor', 'scheduler', 'docker', 'watchdog', 'partnership', 'fallback', 'arrs'];
@@ -25,6 +40,12 @@ $tabLabels = ['monitor' => 'Monitor', 'scheduler' => 'Scheduler', 'docker' => 'D
        <?= $tabLabels[$t] ?? ucfirst($t) ?>
      </a>
    <?php endforeach; ?>
    <a href="https://github.com/FailedProxy/Varaverk" target="_blank"
       style="margin-left:auto;padding:0 10px;font-size:10px;color:#333;text-decoration:none;
              display:flex;align-items:center;letter-spacing:.03em;"
       title="GitHub — source, issues, changelog">
      ⎋ GitHub
    </a>
  </div>
  <!-- Tab content -->
@@ -0,0 +1,38 @@
 Menu="OtherSettings"
 Title="Varaverk"
 Icon="varaverk.png"
 ---
 <?php
 $cfg         = parse_plugin_cfg('varaverk');
 $scripts_dir = $cfg['SCRIPTS_DIR'] ?? '/mnt/user/appdata/Varaverk';
 ?>
 <form markdown="1" name="varaverk_settings" method="POST" action="/update.php" target="progressFrame">
 <input type="hidden" name="#file" value="varaverk/varaverk.cfg">
 _(Scripts directory)_:
 : <input type="text" name="SCRIPTS_DIR" maxlength="255" value="<?=htmlspecialchars($scripts_dir)?>">
 > Path where Varaverk is installed. Changing this only affects the plugin UI — update any scripts that reference the old path manually.
 &nbsp;
 : <input type="submit" value="_(Apply)_">
 </form>
 <div style="margin-top:24px;padding-top:16px;border-top:1px solid #2a2a2a;font-family:monospace;font-size:11px;color:#444;">
  <a href="https://github.com/FailedProxy/Varaverk" target="_blank"
     style="color:#555;text-decoration:none;">
    ⎋ github.com/FailedProxy/Varaverk
  </a>
  &nbsp;·&nbsp;
  <a href="https://github.com/FailedProxy/Varaverk/issues" target="_blank"
     style="color:#555;text-decoration:none;">
    Issues
  </a>
  &nbsp;·&nbsp;
  <a href="https://github.com/FailedProxy/Varaverk/blob/main/CHANGELOG.md" target="_blank"
     style="color:#555;text-decoration:none;">
    Changelog
  </a>
 </div>
@@ -22,7 +22,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        echo json_encode(['ok' => false, 'error' => 'Not allowed']);
        exit;
    }
-    echo json_encode(['ok' => vv_write_conf_raw($file, $content)]);
+    $written = vv_write_conf_raw($file, $content);
    $push    = [];
    if ($written && $file === 'master.conf') {
        $push = vv_push_master_conf();
        vv_push_setup_state();
    }
    echo json_encode(['ok' => $written, 'push' => $push]);
    exit;
 }
@@ -0,0 +1,159 @@
 <?php
 header('Content-Type: application/json');
 require_once dirname(__DIR__) . '/include/config.php';
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    echo json_encode(['ok' => false, 'error' => 'Method not allowed']);
    exit;
 }
 $action = trim($_POST['action'] ?? 'save');
 // ── HOST2 pull: pull master.conf from HOST1 via SSH ──────────────────────────────────────────
 if ($action === 'pull') {
    $host1Hostname = trim($_POST['host1_hostname'] ?? '');
    $mySlot        = trim($_POST['my_slot'] ?? 'host2');
    $myHostname    = trim($_POST['my_hostname'] ?? '');
    if (!$host1Hostname) {
        echo json_encode(['ok' => false, 'error' => 'HOST1 hostname required']);
        exit;
    }
    if (!preg_match('/^host\d+$/', $mySlot)) {
        echo json_encode(['ok' => false, 'error' => 'Invalid slot']);
        exit;
    }
    $hostId    = strtoupper($mySlot);
    $hostIdLow = strtolower($mySlot);
    // Derive SSH key path from this server's hostname
    $sshOwner = strtolower(preg_replace('/^unraid-/i', '', $myHostname ?: vv_get_hostname()));
    $sshKey   = '/root/.ssh/' . $sshOwner . '_rsync_automation';
    if (!file_exists($sshKey)) {
        echo json_encode(['ok' => false, 'error' =>
            "SSH key not found at $sshKey — run Partnership/ssh_setup.sh first"]);
        exit;
    }
    // Resolve HOST1 Tailscale IP
    $ip = trim(shell_exec('tailscale ip -4 ' . escapeshellarg($host1Hostname) . ' 2>/dev/null') ?: '');
    if (!$ip) {
        echo json_encode(['ok' => false, 'error' =>
            "Cannot resolve Tailscale IP for $host1Hostname — is Tailscale running on both servers?"]);
        exit;
    }
    // Get HOST1's SCRIPTS_DIR from their varaverk.cfg
    $sshBase   = 'ssh -i ' . escapeshellarg($sshKey)
               . ' -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@' . $ip;
    $remoteCfg = trim(shell_exec($sshBase . ' "grep SCRIPTS_DIR /boot/config/plugins/varaverk/varaverk.cfg 2>/dev/null"') ?: '');
    preg_match('/SCRIPTS_DIR\s*=\s*["\']?([^"\']+)["\']?/', $remoteCfg, $sm);
    $remoteConf = rtrim($sm[1] ?? '/mnt/user/appdata/Varaverk', '/') . '/Configurations';
    // SCP master.conf from HOST1
    $localMaster = CONF_DIR . '/master.conf';
    $src  = escapeshellarg('root@' . $ip . ':' . $remoteConf . '/master.conf');
    $cmd  = 'scp -i ' . escapeshellarg($sshKey)
          . ' -o ConnectTimeout=10 -o StrictHostKeyChecking=no'
          . ' ' . $src . ' ' . escapeshellarg($localMaster) . ' 2>&1';
    exec($cmd, $out, $rc);
    if ($rc !== 0) {
        echo json_encode(['ok' => false, 'error' =>
            'SCP failed: ' . implode('; ', $out) .
            ' — ensure your SSH key is authorised on HOST1 (run Partnership/ssh_setup.sh)']);
        exit;
    }
    // Create host conf from template if it doesn't exist
    $confFile = $hostIdLow . '.conf';
    if (!file_exists(CONF_DIR . '/' . $confFile)) {
        $template = @file_get_contents(CONF_DIR . '/host.conf.template') ?: '';
        if ($template) {
            $hostname   = $myHostname ?: vv_get_hostname();
            $sshKeyPath = $sshKey;
            $conf = str_replace('HOSTN', $hostId,    $template);
            $conf = str_replace('hostn', $hostIdLow, $conf);
            $conf = preg_replace('/^(\s*' . $hostId . '_SSH_KEY\s*=\s*)""/m',
                '${1}"' . $sshKeyPath . '"', $conf);
            vv_write_conf_raw($confFile, $conf);
        }
    }
    echo json_encode(['ok' => true, 'host_id' => $hostId, 'conf_file' => $confFile,
                      'redirect' => '?tab=scheduler&vv_setup=' . $confFile]);
    exit;
 }
 // ── Default action: save (HOST1 first-run wizard) ────────────────────────────────────────────
 $host1      = trim($_POST['host1']      ?? '');
 $host2      = trim($_POST['host2']      ?? '');
 $mySlot     = trim($_POST['my_slot']    ?? 'host1');
 $myHostname = trim($_POST['my_hostname'] ?? '');
 if (empty($host1)) {
    echo json_encode(['ok' => false, 'error' => 'HOST1 hostname is required']);
    exit;
 }
 if (!preg_match('/^host\d+$/', $mySlot)) {
    echo json_encode(['ok' => false, 'error' => 'Invalid slot']);
    exit;
 }
 // Write HOST1 / HOST2 into master.conf
 $master = vv_read_conf_raw('master.conf');
 if ($master === '') {
    echo json_encode(['ok' => false, 'error' => 'master.conf not found — check SCRIPTS_DIR in varaverk.cfg']);
    exit;
 }
 $master = preg_replace('/^(\s*HOST1\s*=\s*).*$/m', '${1}"' . addslashes($host1) . '"', $master);
 $master = preg_replace('/^(\s*HOST2\s*=\s*).*$/m', '${1}"' . addslashes($host2) . '"', $master);
 $slotNum = (int) preg_replace('/\D/', '', $mySlot);
 if ($slotNum > 2 && !empty($myHostname)) {
    $hostKey = 'HOST' . $slotNum;
    if (!preg_match('/^\s*' . $hostKey . '\s*=/m', $master)) {
        $master = preg_replace('/^(\s*HOST2\s*=.*$)/m',
            '$1' . "\n    {$hostKey}=\"" . addslashes($myHostname) . '"', $master);
    } else {
        $master = preg_replace('/^(\s*' . $hostKey . '\s*=\s*).*$/m',
            '${1}"' . addslashes($myHostname) . '"', $master);
    }
 }
 if (!vv_write_conf_raw('master.conf', $master)) {
    echo json_encode(['ok' => false, 'error' => 'Failed to write master.conf']);
    exit;
 }
 // Create host*.conf from template
 $hostId    = strtoupper($mySlot);
 $hostIdLow = strtolower($mySlot);
 $confFile  = $hostIdLow . '.conf';
 if (!file_exists(CONF_DIR . '/' . $confFile)) {
    $template = @file_get_contents(CONF_DIR . '/host.conf.template') ?: '';
    if ($template) {
        $sshOwner   = strtolower(preg_replace('/^unraid-/i', '', $myHostname));
        $sshKeyPath = '/root/.ssh/' . $sshOwner . '_rsync_automation';
        $conf = str_replace('HOSTN', $hostId,    $template);
        $conf = str_replace('hostn', $hostIdLow, $conf);
        $conf = preg_replace('/^(\s*' . $hostId . '_SSH_KEY\s*=\s*)""/m',
            '${1}"' . $sshKeyPath . '"', $conf);
        if (!vv_write_conf_raw($confFile, $conf)) {
            echo json_encode(['ok' => false, 'error' => "Failed to write $confFile"]);
            exit;
        }
    }
 }
 // Write setup state file — lets partner servers know HOST1 is configured
 vv_setup_state_write(['host1_hostname' => $host1]);
 echo json_encode([
    'ok'       => true,
    'host_id'  => $hostId,
    'redirect' => '?tab=scheduler&vv_setup=master.conf',
 ]);
@@ -27,6 +27,15 @@
 .vv-card:hover .vv-card-cog { color: #4a4a4a; }
 .vv-card-cog:hover { color: #aaa !important; background: #333; }
 /* Card header icon wrapper */
 .vv-ico { display:inline-flex; align-items:center; opacity:0.38; flex-shrink:0; }
 /* Status accent — left border colour for state-driven cards */
 .vv-accent-ok   { border-left-color: #2a5a2a !important; }
 .vv-accent-warn { border-left-color: #5a4000 !important; }
 .vv-accent-err  { border-left-color: #5a1e1e !important; }
 #vv-monitor .vv-card { transition: border-left-color 0.5s; }
 /* Status banner — coloured strip at top of card body */
 .vv-banner { border-radius: 4px; padding: 5px 10px; margin-bottom: 10px;
             display: flex; align-items: center; justify-content: space-between;
@@ -572,7 +572,11 @@ function vv_remote_hosts_stats(): array {
    foreach ($hostIds as $id) {
        if (strtolower($id) === strtolower($myHost)) continue;
        $key = $vars[strtoupper($id) . '_UNRAID_API_KEY'] ?? '';
-        if (!$key) continue;
+        if (!$key) {
            $results[$id] = ['available' => false, 'no_api_key' => true,
                             'host_id' => $id, 'hostname' => $vars[$id]];
            continue;
        }
        $cacheFile = "/tmp/vv_remote_{$id}.json";
        if (file_exists($cacheFile) && (time() - filemtime($cacheFile)) < 30) {
@@ -10,6 +10,118 @@ define('CONF_DIR',    SCRIPTS_DIR . '/Configurations');
 define('LOG_DIR',     '/var/log/varaverk');
 unset($_vv_cfg);
 const VV_SETUP_STATE_FILE = '/boot/config/varaverk_setup.db';
 // Read the setup state file into a key=>value array.
 function vv_setup_state_read(): array {
    $out = [];
    foreach (file(VV_SETUP_STATE_FILE) ?: [] as $line) {
        [$k, $v] = explode('=', trim($line), 2) + ['', ''];
        if ($k !== '') $out[$k] = $v;
    }
    return $out;
 }
 // Write the setup state file (creates or overwrites).
 function vv_setup_state_write(array $data): void {
    $content = '';
    foreach ($data as $k => $v) $content .= "$k=$v\n";
    file_put_contents(VV_SETUP_STATE_FILE, $content);
 }
 // Push the setup state file to all remote hosts via scp.
 // Unlike master.conf push, this does NOT require the plugin to be installed on the remote —
 // it only needs SSH to be reachable, and pushes to /boot/config/ (always available).
 function vv_push_setup_state(): void {
    if (!file_exists(VV_SETUP_STATE_FILE)) return;
    $myHostId = vv_detect_host();
    $vars     = vv_conf_vars();
    $sshKey   = $vars[strtoupper($myHostId) . '_SSH_KEY'] ?? '';
    if (!$sshKey || !file_exists($sshKey)) return;
    $master = vv_read_conf_raw('master.conf');
    preg_match_all('/^\s*(HOST\d+)(?:_NAME)?\s*=\s*["\']?(\S+?)["\']?\s*$/m', $master, $m);
    $seen = [];
    foreach ($m[1] as $i => $hostKey) {
        $hostId = strtolower($hostKey);
        if ($hostId === $myHostId || isset($seen[$hostId])) continue;
        $seen[$hostId] = true;
        $hostname = trim($m[2][$i]);
        if (!$hostname) continue;
        $ip = vv_resolve_tailscale_ip($hostname);
        if (!$ip) continue;
        $sshBase = 'ssh -i ' . escapeshellarg($sshKey)
                 . ' -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@' . $ip;
        // Ensure the target dir exists (it always should on Unraid, but be safe)
        shell_exec($sshBase . ' "mkdir -p /boot/config" 2>/dev/null');
        $dest = escapeshellarg('root@' . $ip . ':/boot/config/varaverk_setup.db');
        exec('scp -i ' . escapeshellarg($sshKey)
            . ' -o ConnectTimeout=10 -o StrictHostKeyChecking=no'
            . ' ' . escapeshellarg(VV_SETUP_STATE_FILE) . ' ' . $dest . ' 2>&1');
    }
 }
 // Push master.conf to all remote hosts via scp after a local save.
 // Returns one result entry per remote found in master.conf.
 // Silently returns [] on non-owner hosts (no SSH key, no remote access).
 function vv_push_master_conf(): array {
    $myHostId = vv_detect_host();
    $vars     = vv_conf_vars();
    $sshKey   = $vars[strtoupper($myHostId) . '_SSH_KEY'] ?? '';
    if (!$sshKey || !file_exists($sshKey)) return [];
    $localPath = CONF_DIR . '/master.conf';
    $master    = vv_read_conf_raw('master.conf');
    preg_match_all('/^\s*(HOST\d+)(?:_NAME)?\s*=\s*["\']?(\S+?)["\']?\s*$/m', $master, $m);
    $results = [];
    $seen    = [];
    foreach ($m[1] as $i => $hostKey) {
        $hostId = strtolower($hostKey);
        if ($hostId === $myHostId || isset($seen[$hostId])) continue;
        $seen[$hostId] = true;
        $hostname = trim($m[2][$i]);
        $ip = vv_resolve_tailscale_ip($hostname);
        if (!$ip) {
            $results[] = ['host' => $hostKey, 'ok' => false, 'ready' => false, 'error' => 'Tailscale IP not found'];
            continue;
        }
        // Single SSH call: get remote SCRIPTS_DIR and verify plugin is installed,
        // Configurations/ exists, and master.conf is already present.
        // Any missing piece means the remote isn't ready — skip rather than push blind.
        $sshBase  = 'ssh -i ' . escapeshellarg($sshKey)
                  . ' -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@' . $ip;
        $probe    = trim(shell_exec(
            $sshBase . ' "cfg=$(grep SCRIPTS_DIR /boot/config/plugins/varaverk/varaverk.cfg 2>/dev/null)'
            . ' && sd=$(echo \"$cfg\" | grep -oP \'(?<=SCRIPTS_DIR=\")[^\"]+\')'
            . ' && test -d \"${sd}/Configurations\"'
            . ' && test -f \"${sd}/Configurations/master.conf\"'
            . ' && echo \"$sd\""'
        ) ?: '');
        if ($probe === '') {
            $results[] = ['host' => $hostKey, 'ok' => false, 'ready' => false,
                          'error' => 'plugin not installed, dir missing, or master.conf absent — skipped'];
            continue;
        }
        $remoteConf = rtrim($probe, '/') . '/Configurations';
        $dest = escapeshellarg('root@' . $ip . ':' . $remoteConf . '/master.conf');
        $cmd  = 'scp -i ' . escapeshellarg($sshKey)
              . ' -o ConnectTimeout=10 -o StrictHostKeyChecking=no'
              . ' ' . escapeshellarg($localPath) . ' ' . $dest . ' 2>&1';
        exec($cmd, $out, $rc);
        $results[] = [
            'host'  => $hostKey,
            'ok'    => $rc === 0,
            'error' => $rc !== 0 ? implode('; ', $out) : '',
        ];
    }
    return $results;
 }
 function vv_get_hostname(): string {
    return trim(shell_exec('hostname -s') ?: '');
 }
@@ -17,6 +17,7 @@ require_once __DIR__ . '/config.php';
 // ── Fallback tracking ─────────────────────────────────────────────────────────
 function &_vv_api_fallbacks(): array { static $f = []; return $f; }
 function &_vv_api_key_missing(): bool { static $m = false; return $m; }
 function vv_api_record_fallback(string $fn): void {
    $f   = &_vv_api_fallbacks();
@@ -27,6 +28,7 @@ function vv_api_get_status(): array {
    $fallbacks = array_unique(_vv_api_fallbacks());
    return [
        'available'   => empty($fallbacks),
        'key_missing' => _vv_api_key_missing(),
        'fallbacks'   => $fallbacks,
    ];
 }
@@ -43,7 +45,12 @@ function vv_api_data(): ?array {
    $hostId = vv_detect_host();
    $vars   = vv_conf_vars();
    $key    = $vars[strtoupper($hostId) . '_UNRAID_API_KEY'] ?? '';
-    if (!$key) { $cache = null; return null; }
+    if (!$key) {
        $m = &_vv_api_key_missing();
        $m = true;
        $cache = null;
        return null;
    }
    // Fields verified against live schema introspection (2026-05-29).
    // array.parities / .disks / .caches are SEPARATE lists — .disks is DATA only.
@@ -1,10 +1,6 @@
 <?php require_once dirname(__DIR__) . '/include/monitor.php'; ?>
-<div id="vv-api-banner" style="display:none;background:#1a1200;border:1px solid #3a2800;border-radius:4px;
+<div id="vv-api-banner" style="display:none;border-radius:4px;padding:5px 10px;margin-bottom:8px;font-size:11px;"></div>
  padding:5px 10px;margin-bottom:8px;font-size:11px;color:#ff9800;">
  ⚠ Unraid API unavailable — using local reads. Check API key in host conf.
  <span id="vv-api-fallback-list" style="color:#666;margin-left:6px;"></span>
 </div>
 <div id="vv-monitor" style="display:grid;grid-template-columns:repeat(8,1fr);gap:12px;width:100%;box-sizing:border-box;">
@@ -15,8 +11,8 @@
    <div class="vv-card" id="vv-ups-card" style="grid-column:span 1;">
      <h3>
-        <span style="display:flex;align-items:center;gap:6px;">
+        <span style="display:flex;align-items:center;gap:5px;">
-          <svg width="9" height="15" viewBox="0 0 11 18" fill="none" style="opacity:0.4;flex-shrink:0;margin-bottom:1px;">
+          <svg width="9" height="14" viewBox="0 0 11 18" fill="none" style="opacity:0.4;flex-shrink:0;">
            <polygon points="9,0 2,10 6,10 3,18 11,6 6,6 8,0" fill="#ff9800"/>
          </svg>Power
        </span>
@@ -26,39 +22,76 @@
    </div>
    <div class="vv-card" id="vv-cpu" style="grid-column:span 2;">
-      <h3><span id="vv-cpu-title">CPU</span><a href="/Settings/CPUset" target="_blank" class="vv-card-cog" title="CPU Settings">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round"><rect x="3" y="3" width="6" height="6" rx="0.8"/><line x1="4.5" y1="3" x2="4.5" y2="1.2"/><line x1="7.5" y1="3" x2="7.5" y2="1.2"/><line x1="4.5" y1="9" x2="4.5" y2="10.8"/><line x1="7.5" y1="9" x2="7.5" y2="10.8"/><line x1="3" y1="4.5" x2="1.2" y2="4.5"/><line x1="3" y1="7.5" x2="1.2" y2="7.5"/><line x1="9" y1="4.5" x2="10.8" y2="4.5"/><line x1="9" y1="7.5" x2="10.8" y2="7.5"/></svg></span>
          <span id="vv-cpu-title">CPU</span>
        </span>
        <a href="/Settings/CPUset" target="_blank" class="vv-card-cog" title="CPU Settings">⚙</a>
      </h3>
      <div id="vv-cpu-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-memory" style="grid-column:span 2;">
-      <h3>Memory<a href="/" target="_blank" class="vv-card-cog" title="Dashboard">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="14" height="8" viewBox="0 0 14 8" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round"><rect x="0.6" y="2.5" width="12.8" height="3" rx="0.5"/><line x1="3" y1="2.5" x2="3" y2="0.8"/><line x1="5.5" y1="2.5" x2="5.5" y2="0.8"/><line x1="8" y1="2.5" x2="8" y2="0.8"/><line x1="10.5" y1="2.5" x2="10.5" y2="0.8"/><line x1="3" y1="5.5" x2="3" y2="7.2"/><line x1="5.5" y1="5.5" x2="5.5" y2="7.2"/><line x1="8" y1="5.5" x2="8" y2="7.2"/><line x1="10.5" y1="5.5" x2="10.5" y2="7.2"/></svg></span>
          Memory
        </span>
        <a href="/" target="_blank" class="vv-card-cog" title="Dashboard">⚙</a>
      </h3>
      <div id="vv-memory-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-network" style="grid-column:span 2;">
-      <h3>Network<a href="/Settings/NetworkSettings" target="_blank" class="vv-card-cog" title="Network Settings">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="13" height="12" viewBox="0 0 13 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round"><rect x="4.5" y="0.5" width="4" height="3" rx="0.7"/><rect x="0.5" y="8" width="4" height="3" rx="0.7"/><rect x="8.5" y="8" width="4" height="3" rx="0.7"/><line x1="6.5" y1="3.5" x2="6.5" y2="6"/><line x1="6.5" y1="6" x2="2.5" y2="6"/><line x1="2.5" y1="6" x2="2.5" y2="8"/><line x1="6.5" y1="6" x2="10.5" y2="6"/><line x1="10.5" y1="6" x2="10.5" y2="8"/></svg></span>
          Network
        </span>
        <a href="/Settings/NetworkSettings" target="_blank" class="vv-card-cog" title="Network Settings">⚙</a>
      </h3>
      <div id="vv-network-body">Loading...</div>
    </div>
    <!-- Row 2: Scripts | Fallback | Partner | Containers & VMs -->
    <div class="vv-card" id="vv-scripts-card" style="grid-column:span 1;">
-      <h3>Scripts<a href="/Apps/plugin_userscripts" target="_blank" class="vv-card-cog" title="User Scripts">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"><rect x="1" y="1" width="10" height="10" rx="1.5"/><line x1="1" y1="4.5" x2="11" y2="4.5"/><polyline points="3.5,7 5,8 3.5,9"/><line x1="6" y1="9" x2="8.5" y2="9"/></svg></span>
          Scripts
        </span>
        <a href="/Apps/plugin_userscripts" target="_blank" class="vv-card-cog" title="User Scripts">⚙</a>
      </h3>
      <div id="vv-scripts-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-fallback" style="grid-column:span 1;">
-      <h3>Fallback</h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="10" height="12" viewBox="0 0 10 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"><path d="M5 0.8L9.2 2.8V6.2C9.2 9 5 11.2 5 11.2C5 11.2 0.8 9 0.8 6.2V2.8Z"/></svg></span>
          Fallback
        </span>
      </h3>
      <div id="vv-fallback-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-partner" style="grid-column:span 2;">
-      <h3>Partner</h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="14" height="10" viewBox="0 0 14 10" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round"><rect x="0.5" y="1.5" width="4" height="7" rx="0.8"/><rect x="9.5" y="1.5" width="4" height="7" rx="0.8"/><line x1="4.5" y1="5" x2="9.5" y2="5"/><circle cx="7" cy="5" r="1" fill="#888" stroke="none"/></svg></span>
          Partner
        </span>
      </h3>
      <div id="vv-partner-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-docker-folders" style="grid-column:span 4;">
      <h3>
-        <span>Containers &amp; VMs <span id="vv-docker-count" style="font-size:10px;color:#4a4a4a;font-weight:400;text-transform:none;letter-spacing:0;margin-left:2px;"></span></span>
+        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="14" height="10" viewBox="0 0 14 10" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"><rect x="1" y="0.5" width="12" height="2.5" rx="0.5"/><rect x="1" y="3.8" width="12" height="2.5" rx="0.5"/><rect x="1" y="7" width="12" height="2.5" rx="0.5"/></svg></span>
          Containers &amp; VMs <span id="vv-docker-count" style="font-size:10px;color:#4a4a4a;font-weight:400;text-transform:none;letter-spacing:0;margin-left:2px;"></span>
        </span>
        <a href="/Docker" target="_blank" class="vv-card-cog" title="Docker">⚙</a>
      </h3>
      <div id="vv-docker-folders-body">Loading...</div>
@@ -66,38 +99,77 @@
    <!-- Row 3: GPU | Transcode | Streams -->
    <div class="vv-card" id="vv-gpu-card" style="grid-column:span 2;">
-      <h3>GPU<a href="/" target="_blank" class="vv-card-cog" title="Dashboard">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="15" height="10" viewBox="0 0 16 10" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"><rect x="0.8" y="0.8" width="14.4" height="7" rx="1.2"/><rect x="2.5" y="2.5" width="3.5" height="3.5" rx="0.5"/><line x1="8" y1="3" x2="13" y2="3"/><line x1="8" y1="5" x2="11" y2="5"/><rect x="3" y="7.8" width="2" height="1.8" rx="0.3" stroke="none" fill="#666"/><rect x="6.5" y="7.8" width="2" height="1.8" rx="0.3" stroke="none" fill="#666"/><rect x="10" y="7.8" width="2" height="1.8" rx="0.3" stroke="none" fill="#666"/></svg></span>
          GPU
        </span>
        <a href="/" target="_blank" class="vv-card-cog" title="Dashboard">⚙</a>
      </h3>
      <div id="vv-gpu-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-transcode" style="grid-column:span 2;">
-      <h3>Transcode</h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="14" height="12" viewBox="0 0 14 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"><rect x="0.5" y="1" width="4" height="10" rx="0.8"/><line x1="0.5" y1="3.5" x2="2.3" y2="3.5"/><line x1="0.5" y1="8.5" x2="2.3" y2="8.5"/><line x1="2.7" y1="3.5" x2="4.5" y2="3.5"/><line x1="2.7" y1="8.5" x2="4.5" y2="8.5"/><line x1="6" y1="6" x2="9.5" y2="6"/><polyline points="8.2,4.3 10.2,6 8.2,7.7"/><rect x="11" y="1" width="2.5" height="10" rx="0.5"/></svg></span>
          Transcode
        </span>
      </h3>
      <div id="vv-transcode-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-streams" style="grid-column:span 4;">
-      <h3>Streams</h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="11" height="12" viewBox="0 0 11 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"><polygon points="1.5,1 1.5,11 10,6"/></svg></span>
          Streams
        </span>
      </h3>
      <div id="vv-streams-body">Loading...</div>
    </div>
    <!-- Row 4: Watchdog | Parity | Pools | Array -->
    <div class="vv-card" id="vv-watchdog-card" style="grid-column:span 1;">
-      <h3>Watchdog</h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="14" height="9" viewBox="0 0 14 8" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round"><path d="M1 4C3.2 1 5 0.5 7 0.5C9 0.5 10.8 1 13 4C10.8 7 9 7.5 7 7.5C5 7.5 3.2 7 1 4Z"/><circle cx="7" cy="4" r="1.5"/></svg></span>
          Watchdog
        </span>
      </h3>
      <div id="vv-watchdog-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-parity-card" style="grid-column:span 1;">
-      <h3>Parity<a href="/Main" target="_blank" class="vv-card-cog" title="Array Management">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round"><circle cx="6" cy="6" r="5"/><polyline points="3.5,6 5.5,8 8.5,4"/></svg></span>
          Parity
        </span>
        <a href="/Main" target="_blank" class="vv-card-cog" title="Array Management">⚙</a>
      </h3>
      <div id="vv-parity-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-storage-card" style="grid-column:3/span 2;">
-      <h3>Pools<a href="/Main" target="_blank" class="vv-card-cog" title="Array Management">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="12" height="12" viewBox="0 0 12 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round"><ellipse cx="6" cy="3" rx="4.5" ry="1.5"/><line x1="1.5" y1="3" x2="1.5" y2="9"/><line x1="10.5" y1="3" x2="10.5" y2="9"/><ellipse cx="6" cy="9" rx="4.5" ry="1.5"/></svg></span>
          Pools
        </span>
        <a href="/Main" target="_blank" class="vv-card-cog" title="Array Management">⚙</a>
      </h3>
      <div id="vv-storage-body">Loading...</div>
    </div>
    <div class="vv-card" id="vv-array-card" style="grid-column:5/span 4;">
-      <h3><span id="vv-array-title">Array</span><a href="/Main" target="_blank" class="vv-card-cog" title="Array Management">⚙</a></h3>
+      <h3>
        <span style="display:flex;align-items:center;gap:5px;">
          <span class="vv-ico"><svg width="14" height="12" viewBox="0 0 14 12" fill="none" stroke="#aaa" stroke-width="1.1" stroke-linecap="round"><rect x="0.7" y="0.7" width="12.6" height="3" rx="0.8"/><rect x="0.7" y="4.5" width="12.6" height="3" rx="0.8"/><rect x="0.7" y="8.3" width="12.6" height="3" rx="0.8"/><circle cx="11.5" cy="2.2" r="0.8" fill="#888" stroke="none"/><circle cx="11.5" cy="6" r="0.8" fill="#888" stroke="none"/><circle cx="11.5" cy="9.8" r="0.8" fill="#888" stroke="none"/></svg></span>
          <span id="vv-array-title">Array</span>
        </span>
        <a href="/Main" target="_blank" class="vv-card-cog" title="Array Management">⚙</a>
      </h3>
      <div id="vv-array-body">Loading...</div>
    </div>
@@ -467,10 +539,21 @@ function vvPollMonitor() {
      const apiStatus = d._api_status ?? {};
      const banner    = document.getElementById('vv-api-banner');
      if (banner) {
-        const hasFallbacks = apiStatus.fallbacks && apiStatus.fallbacks.length > 0;
+        const fallbacks = apiStatus.fallbacks ?? [];
-        banner.style.display = hasFallbacks ? '' : 'none';
+        if (fallbacks.length === 0) {
-        const listEl = document.getElementById('vv-api-fallback-list');
+          banner.style.display = 'none';
-        if (listEl && hasFallbacks) listEl.textContent = '(' + apiStatus.fallbacks.join(', ') + ')';
+        } else if (apiStatus.key_missing) {
          // Key not configured — informational, not alarming
          Object.assign(banner.style, {display:'', background:'#111', border:'1px solid #2a2a2a', color:'#555'});
          banner.textContent = 'API key not configured — add HOST' +
            (typeof vvLocalHostConf !== 'undefined' ? vvLocalHostConf.replace(/\D/g,'') : '1') +
            '_UNRAID_API_KEY in Scheduler → host conf to enable enhanced monitoring.';
        } else {
          // Key present but API unreachable — genuine problem
          Object.assign(banner.style, {display:'', background:'#1a1200', border:'1px solid #3a2800', color:'#ff9800'});
          banner.innerHTML = '⚠ Unraid API unreachable — using local reads. Check API key in host conf.' +
            (fallbacks.length ? ' <span style="color:#666">(' + fallbacks.join(', ') + ')</span>' : '');
        }
      }
      // ── Thresholds (from dynamix.cfg via backend) ────────────────────────────
@@ -579,6 +662,8 @@ function vvPollMonitor() {
            <span style="color:#444;">Uptime</span>
            <span style="color:#555;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;">${uptimeStr}</span>
          </div>${verWarn}`;
        } else if (rs && rs.no_api_key) {
          statsHtml = `<div style="font-size:10px;color:#444;margin-top:4px;">API key not configured — complete Onboard to enable</div>`;
        } else if (rs && !rs.available) {
          statsHtml = `<div style="font-size:10px;color:#444;margin-top:4px;">API unreachable</div>`;
        }
@@ -596,6 +681,16 @@ function vvPollMonitor() {
        </div>`;
      });
      document.getElementById('vv-partner-body').innerHTML = ptHtml;
      (function() {
        const c = document.getElementById('vv-partner');
        if (!c) return;
        const remotes = ptHosts.filter(h => !h.is_me);
        c.classList.remove('vv-accent-ok','vv-accent-warn');
        if (remotes.length) {
          if (remotes.some(h => h.online)) c.classList.add('vv-accent-ok');
          else c.classList.add('vv-accent-warn');
        }
      })();
      // ── Fallback ──────────────────────────────────────────────────────────────
      const fb      = d.fallback ?? {};
@@ -636,6 +731,14 @@ function vvPollMonitor() {
        fbHtml += `<div style="font-size:10px;color:#333;">No containers active</div>`;
      }
      document.getElementById('vv-fallback-body').innerHTML = fbHtml;
      (function() {
        const c = document.getElementById('vv-fallback');
        if (!c) return;
        c.classList.remove('vv-accent-ok','vv-accent-warn','vv-accent-err');
        if (state === 'NORMAL') c.classList.add('vv-accent-ok');
        else if (state === 'FAILOVER') c.classList.add('vv-accent-err');
        else if (state !== 'UNKNOWN') c.classList.add('vv-accent-warn');
      })();
      // ── CPU ─────────────────────────────────────────────────────────────────
      const cpu = d.cpu ?? {};
@@ -951,6 +1054,13 @@ function vvPollMonitor() {
        }
        el.innerHTML = html;
        const wdCard = document.getElementById('vv-watchdog-card');
        if (wdCard) {
          wdCard.classList.remove('vv-accent-ok','vv-accent-warn','vv-accent-err');
          if (healthy) wdCard.classList.add('vv-accent-ok');
          else if (reboots > 0 || oom > 0 || daemonHit) wdCard.classList.add('vv-accent-err');
          else wdCard.classList.add('vv-accent-warn');
        }
      })();
@@ -990,6 +1100,13 @@ function vvPollMonitor() {
      } else {
        document.getElementById('vv-array-body').innerHTML = '<p style="color:#555;font-style:italic;font-size:12px;">No array disks</p>';
      }
      (function() {
        const c = document.getElementById('vv-array-card');
        if (!c) return;
        c.classList.remove('vv-accent-ok','vv-accent-err');
        if (sys.array_state === 'STARTED') c.classList.add('vv-accent-ok');
        else if (sys.array_state && sys.array_state !== 'UNKNOWN') c.classList.add('vv-accent-err');
      })();
      // ── GPU ─────────────────────────────────────────────────────────────────
      const gpu     = d.gpu ?? {};
@@ -24,6 +24,14 @@
 .vv-pt-action-btn.info { background:#1a2a3a; color:#7ab; border:1px solid #2e4a6b; }
 .vv-pt-action-btn:disabled { opacity:0.4; cursor:default; }
 .vv-pt-transfer-note { font-size:10px; color:#555; margin-top:6px; font-family:monospace; }
 .vv-pt-onboard-highlight {
  box-shadow: 0 0 0 2px #4a8, 0 0 12px rgba(100,200,120,.25) !important;
  animation: vvOnboardPulse 1.4s ease-in-out 4;
 }
@keyframes vvOnboardPulse {
  0%,100% { box-shadow: 0 0 0 2px #4a8, 0 0 8px rgba(100,200,120,.2); }
  50%     { box-shadow: 0 0 0 4px #4a8, 0 0 18px rgba(100,200,120,.45); }
 }
 </style>
 <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:12px;padding:0 2px;">
@@ -199,11 +207,15 @@ function _renderActions(nodes, cfg) {
  const remoteOpts = remotes.map(n =>
    `<option value="${n.slot}">${n.id} — ${n.hostname}</option>`).join('');
  const hasPartner = remotes.length > 0 && remotes.some(n => n.hostname);
  let html = '<div class="vv-pt-actions">';
-  // Onboard
+  // Onboard — disabled until a partner hostname is configured in master.conf
  html += `<button class="vv-pt-action-btn run" onclick="vvPtOnboard(this)"
-    title="Run partnership_onboard.sh — auto-detects role (run on mirror first, then owner)">
+    ${!hasPartner ? 'disabled title="Add partner hostname to master.conf first (Scheduler → master.conf)"' :
                    'title="Run partnership_onboard.sh — auto-detects role (run on mirror first, then owner)"'}
    ${!hasPartner ? 'style="opacity:.35;cursor:default;"' : ''}>
    ▶ Onboard
  </button>`;
@@ -215,6 +227,18 @@ function _renderActions(nodes, cfg) {
  html += '</div>';
  // Contextual note under actions
  if (!hasPartner) {
    html += `<div style="font-size:11px;color:#444;margin-top:8px;">
      No partner hostname configured. Edit master.conf (Scheduler tab) and set HOST2.
    </div>`;
  } else if (!cfg.enabled) {
    html += `<div style="font-size:11px;color:#555;margin-top:8px;">
      Onboard will generate your SSH key, exchange it with the partner, and establish the partnership.
      Run on the mirror (HOST2) first, then on the owner (HOST1).
    </div>`;
  }
  // Transfer — show manual command, too destructive to one-click
  if (cfg.enabled && isOwner) {
    const confirmStr = 'i-understand-this-transfers-ownership';
@@ -249,6 +273,15 @@ function _render(data) {
  // Actions
  document.getElementById('vv-pt-actions-body').innerHTML = _renderActions(nodes, cfg);
  // Highlight Onboard button when arriving from first-run wizard
  if (new URLSearchParams(location.search).get('vv_onboard') === '1') {
    const onboardBtn = document.querySelector('#vv-pt-actions-body .vv-pt-action-btn.run');
    if (onboardBtn) {
      onboardBtn.classList.add('vv-pt-onboard-highlight');
      setTimeout(() => onboardBtn.scrollIntoView({behavior: 'smooth', block: 'center'}), 200);
    }
  }
  // Timestamp
  const ts = data.ts ? new Date(data.ts * 1000).toLocaleString([],
    {month:'numeric',day:'numeric',year:'numeric',hour:'2-digit',minute:'2-digit',second:'2-digit'}) : '';
@@ -1,5 +1,12 @@
 <?php
 require_once dirname(__DIR__) . '/include/scheduler.php';
 // Setup mode — auto-open a conf file and force the editing sequence
 $vv_setup_conf = preg_match('/^[\w.]+\.conf$/', $_GET['vv_setup'] ?? '')
    ? $_GET['vv_setup'] : '';
 $_vv_my_host       = vv_detect_host();
 $_vv_local_host_conf = ($_vv_my_host !== 'unknown') ? $_vv_my_host . '.conf' : 'host1.conf';
 $tree    = vv_job_tree();
 $customs = vv_custom_scripts();
 $tools   = vv_tools_scripts();
@@ -416,18 +423,6 @@ $runningScripts = array_unique($runningScripts);
                    style="display:none;margin-left:auto;">&#8635; Git Pull</button>
          </div>
          <!-- Plugin settings row (Advanced mode only) -->
          <div class="vv-nb-settings vv-adv-only" style="display:none">
            <span style="color:#555;font-size:11px;white-space:nowrap;">Scripts dir:</span>
            <input type="text" id="vv-scripts-dir" value="<?= htmlspecialchars(SCRIPTS_DIR) ?>"
                   style="flex:1;min-width:180px;background:#111;border:1px solid #333;color:#aaa;
                          padding:2px 6px;border-radius:3px;font-family:monospace;font-size:11px;">
            <button type="button" onclick="vvSaveSettings()"
                    style="padding:2px 10px;background:#252525;border:1px solid #444;color:#aaa;
                           border-radius:3px;cursor:pointer;font-size:11px;white-space:nowrap;">Save</button>
            <span id="vv-settings-status" style="font-size:11px;color:#666;"></span>
          </div>
          <!-- ── How do I use this (pinned) ── -->
          <div class="vv-sug-block vv-info-block" id="vv-how-to-use" data-save-key="how-to-use">
            <div class="vv-sug-header" onclick="vvToggleSug(this)">
@@ -953,6 +948,17 @@ let vvSelectedRow   = null;
 let vvCurrentSiId   = null;
 let vvCurrentSiHdr  = null;
 // Setup mode — injected by PHP when navigating from the first-run wizard
 let vvSetupConf      = <?= json_encode($vv_setup_conf) ?>;
 const vvLocalHostConf = <?= json_encode($_vv_local_host_conf) ?>;
 if (vvSetupConf) {
  // Auto-open the setup conf file once the page is ready
  document.addEventListener('DOMContentLoaded', () => {
    setTimeout(() => vvLoadRawConf(vvSetupConf), 150);
  });
 }
 function vvEscHtml(s) {
  return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
 }
@@ -966,16 +972,6 @@ function vvPost(url, data) {
  }).then(r => r.json());
 }
 function vvSaveSettings() {
  const dir    = document.getElementById('vv-scripts-dir').value.trim();
  const status = document.getElementById('vv-settings-status');
  if (!dir) { status.textContent = '✗ Path required'; return; }
  status.textContent = 'Saving…';
  vvPost('/plugins/varaverk/api/settings.php', {scripts_dir: dir})
    .then(d => { status.textContent = d.ok ? '✓ Saved — reload to apply' : '✗ ' + (d.error ?? 'Error'); })
    .catch(() => { status.textContent = '✗ Request failed'; });
 }
 function vvFitRight() {
  const right = document.getElementById('vv-sched-right');
  if (!right.classList.contains('vv-panel-visible')) return;
@@ -2607,7 +2603,7 @@ function vvShowRawConfMode(title) {
 function vvSaveRawConf() {
  if (!vvRawConfFile) return;
-  if (!confirm('Save changes to "' + vvRawConfFile + '"?')) return;
+  if (!vvSetupConf && !confirm('Save changes to "' + vvRawConfFile + '"?')) return;
  const content = document.getElementById('vv-editor-body').value;
  const btn     = document.getElementById('vv-save-rawconf-btn');
  btn.disabled    = true;
@@ -2615,13 +2611,42 @@ function vvSaveRawConf() {
  vvPost('/plugins/varaverk/api/rawconf.php', {file: vvRawConfFile, content})
    .then(d => {
      btn.disabled = false;
-      if (d.ok) {
+      if (!d.ok) {
        btn.textContent = '✓ Saved';
        setTimeout(() => { btn.textContent = 'Save Conf'; }, 2500);
      } else {
        btn.textContent = 'Save Conf';
        alert('Save failed: ' + (d.error ?? 'Unknown error'));
        return;
      }
      // Setup mode: forced editing sequence
      if (vvSetupConf) {
        if (vvRawConfFile === 'master.conf') {
          // master.conf saved → open host conf next
          btn.textContent = '✓ Saved — opening ' + vvLocalHostConf + '…';
          vvSetupConf = vvLocalHostConf;
          history.replaceState(null, '', location.pathname + '?tab=scheduler&vv_setup=' + encodeURIComponent(vvLocalHostConf));
          setTimeout(() => vvLoadRawConf(vvLocalHostConf), 400);
        } else {
          // Host conf saved → go to Partnership so SSH keys get set up
          vvSetupConf = '';
          btn.textContent = '✓ Done — opening Partnership…';
          setTimeout(() => { window.location.href = location.pathname + '?tab=partnership&vv_onboard=1'; }, 800);
        }
        return;
      }
      // Normal save: show push status
      // ready:false = partner not set up yet (pre-onboard) — treat as silent, not an error
      const push       = d.push ?? [];
      const synced     = push.filter(p => p.ok);
      const realFailed = push.filter(p => !p.ok && p.ready !== false);
      if (realFailed.length > 0) {
        btn.textContent = '✓ Saved · push failed: ' + realFailed.map(p => p.host).join(', ');
      } else if (synced.length > 0) {
        btn.textContent = '✓ Saved · synced to ' + synced.map(p => p.host).join(', ');
      } else {
        btn.textContent = '✓ Saved';
      }
      setTimeout(() => { btn.textContent = 'Save Conf'; }, 3500);
    })
    .catch(() => { btn.disabled = false; btn.textContent = 'Save Conf'; });
 }
@@ -0,0 +1,258 @@
 <?php
 // First-run setup wizard.
 // HOST1 path: blank master.conf → fill hostnames → write master.conf + host1.conf → scheduler.
 // HOST2 path: state file present → pull master.conf from HOST1 → fill host2.conf → scheduler.
 $detectedHostname = trim(shell_exec('hostname -s') ?: '');
 // Check for setup state file pushed by HOST1
 $setupState   = vv_setup_state_read();
 $host1FromState = $setupState['host1_hostname'] ?? '';
 // Determine if HOST2 scenario: state file present but master.conf has blank HOST1
 $_master    = vv_read_conf_raw('master.conf');
 preg_match('/^\s*HOST1\s*=\s*"([^"]*)"/m', $_master, $_h1m);
 $masterHost1 = trim($_h1m[1] ?? '');
 // Determine local host slot (if master.conf has hostnames, we may already know)
 $isHost2Flow = !empty($host1FromState) && empty($masterHost1);
 // If master.conf has HOST1/HOST2 filled but local host.conf is missing:
 // This is the "master was pushed, just need the local conf" scenario
 $myHostId    = vv_detect_host();  // may be 'host2' if master.conf was already pushed
 $confMissing = $myHostId !== 'unknown' && !file_exists(CONF_DIR . '/' . $myHostId . '.conf');
 $isConfOnlyFlow = !empty($masterHost1) && $confMissing;
 ?>
 <link rel="stylesheet" href="/plugins/varaverk/css/varaverk.css">
 <style>
 #vv-setup {
  max-width: 560px;
  margin: 48px auto 0;
  background: #141414;
  border: 1px solid #2a2a2a;
  border-radius: 6px;
  padding: 36px 40px 40px;
  font-family: monospace;
  color: #ccc;
 }
 #vv-setup h1 { margin: 0 0 6px; font-size: 18px; color: #e0e0e0; font-weight: normal; letter-spacing: .04em; }
 #vv-setup .vv-setup-sub { font-size: 12px; color: #555; margin-bottom: 32px; }
 #vv-setup .vv-setup-field { margin-bottom: 20px; }
 #vv-setup label { display: block; font-size: 11px; color: #888; margin-bottom: 6px; text-transform: uppercase; letter-spacing: .06em; }
 #vv-setup input[type=text] { width: 100%; box-sizing: border-box; background: #0d0d0d; border: 1px solid #333; color: #ddd; padding: 7px 10px; border-radius: 3px; font-family: monospace; font-size: 13px; }
 #vv-setup input[type=text]:focus { outline: none; border-color: #555; }
 #vv-setup .vv-setup-hint { font-size: 11px; color: #555; margin-top: 5px; }
 #vv-setup .vv-setup-role { display: flex; gap: 10px; margin-bottom: 24px; }
 #vv-setup .vv-setup-role-btn { flex: 1; padding: 10px 0; background: #1a1a1a; border: 1px solid #333; border-radius: 3px; color: #888; font-family: monospace; font-size: 12px; cursor: pointer; text-align: center; transition: border-color .15s, color .15s; }
 #vv-setup .vv-setup-role-btn.active { border-color: #555; color: #ccc; background: #222; }
 #vv-setup .vv-setup-conditional { display: none; }
 #vv-setup .vv-setup-conditional.visible { display: block; }
 #vv-setup hr.vv-setup-divider { border: none; border-top: 1px solid #222; margin: 24px 0; }
 #vv-setup-btn { width: 100%; padding: 10px; background: #1e1e1e; border: 1px solid #444; color: #ccc; font-family: monospace; font-size: 13px; border-radius: 3px; cursor: pointer; letter-spacing: .03em; }
 #vv-setup-btn:hover { border-color: #666; color: #eee; }
 #vv-setup-btn:disabled { opacity: .45; cursor: default; }
 #vv-setup-status { margin-top: 12px; font-size: 12px; color: #666; text-align: center; min-height: 16px; }
 #vv-setup-status.ok  { color: #4a8; }
 #vv-setup-status.err { color: #a44; }
 .vv-setup-info-box { background: #0d0d0d; border: 1px solid #2a2a2a; border-radius: 3px; padding: 12px 14px; margin-bottom: 24px; font-size: 12px; color: #777; line-height: 1.6; }
 .vv-setup-info-box strong { color: #aaa; }
 </style>
 <div id="vv-setup">
 <?php if ($isConfOnlyFlow): ?>
  <!-- master.conf was pushed by HOST1, just need local host.conf -->
  <?php $slotLabel = strtoupper($myHostId); ?>
  <h1>⬡ Varaverk — <?= htmlspecialchars($slotLabel) ?> Setup</h1>
  <div class="vv-setup-sub">master.conf received from HOST1. Create your local configuration to continue.</div>
  <div class="vv-setup-info-box">
    <strong>HOST1:</strong> <?= htmlspecialchars($masterHost1) ?><br>
    <strong>This server:</strong> <?= htmlspecialchars($detectedHostname) ?> → <?= htmlspecialchars($slotLabel) ?><br>
    <strong>Creating:</strong> <?= htmlspecialchars($myHostId) ?>.conf
  </div>
  <button id="vv-setup-btn" onclick="vvDoConfOnly()">Create <?= htmlspecialchars($myHostId) ?>.conf and continue →</button>
  <div id="vv-setup-status"></div>
  <script>
  function vvDoConfOnly() {
    const btn    = document.getElementById('vv-setup-btn');
    const status = document.getElementById('vv-setup-status');
    btn.disabled = true; btn.textContent = 'Creating…';
    const params = new URLSearchParams({
      csrf_token: typeof csrf_token !== 'undefined' ? csrf_token : '',
      action: 'save',
      host1: <?= json_encode($masterHost1) ?>,
      host2: <?= json_encode(trim(preg_match('/^\s*HOST2\s*=\s*"([^"]*)"/m', $_master, $m2) ? $m2[1] : '')) ?>,
      my_slot: <?= json_encode($myHostId) ?>,
      my_hostname: <?= json_encode($detectedHostname) ?>,
    });
    fetch('/plugins/varaverk/api/setup.php', {
      method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: params
    }).then(r => r.json()).then(d => {
      if (d.ok) {
        status.textContent = '✓ Created — loading…'; status.className = 'ok';
        setTimeout(() => { window.location.href = '?tab=scheduler&vv_setup=' + encodeURIComponent(<?= json_encode($myHostId . '.conf') ?>); }, 600);
      } else {
        btn.disabled = false; btn.textContent = 'Create <?= htmlspecialchars($myHostId) ?>.conf and continue →';
        status.textContent = '✗ ' + (d.error ?? 'Error'); status.className = 'err';
      }
    }).catch(() => { btn.disabled = false; btn.textContent = 'Create <?= htmlspecialchars($myHostId) ?>.conf and continue →'; status.textContent = '✗ Request failed'; status.className = 'err'; });
  }
  </script>
 <?php elseif ($isHost2Flow): ?>
  <!-- State file present, master.conf blank — HOST2 pull flow -->
  <h1>⬡ Varaverk — Partner Setup</h1>
  <div class="vv-setup-sub">HOST1 has been configured. Pull their settings to continue.</div>
  <div class="vv-setup-info-box">
    <strong>HOST1 detected:</strong> <?= htmlspecialchars($host1FromState) ?><br>
    This server will pull master.conf from HOST1 via Tailscale + SSH.<br>
    <span style="color:#555">Requires SSH keys to be exchanged first (Partnership/ssh_setup.sh).</span>
  </div>
  <div class="vv-setup-field">
    <label>This server's hostname</label>
    <input type="text" id="vv-hostname" value="<?= htmlspecialchars($detectedHostname) ?>" autocomplete="off" spellcheck="false">
    <div class="vv-setup-hint">Must match Settings → Identification exactly</div>
  </div>
  <div class="vv-setup-field">
    <label>Your slot</label>
    <select id="vv-partner-slot" style="width:100%;box-sizing:border-box;background:#0d0d0d;border:1px solid #333;color:#ddd;padding:7px 10px;border-radius:3px;font-family:monospace;font-size:13px;">
      <option value="host2">HOST2</option>
      <option value="host3">HOST3</option>
      <option value="host4">HOST4</option>
    </select>
  </div>
  <button id="vv-setup-btn" onclick="vvDoPull()">Pull configuration from HOST1 →</button>
  <div id="vv-setup-status"></div>
  <script>
  function vvDoPull() {
    const btn      = document.getElementById('vv-setup-btn');
    const status   = document.getElementById('vv-setup-status');
    const hostname = document.getElementById('vv-hostname').value.trim();
    const slot     = document.getElementById('vv-partner-slot').value;
    if (!hostname) { status.textContent = '✗ Hostname required'; status.className = 'err'; return; }
    btn.disabled = true; btn.textContent = 'Pulling…';
    const params = new URLSearchParams({
      csrf_token: typeof csrf_token !== 'undefined' ? csrf_token : '',
      action: 'pull',
      host1_hostname: <?= json_encode($host1FromState) ?>,
      my_slot: slot,
      my_hostname: hostname,
    });
    fetch('/plugins/varaverk/api/setup.php', {
      method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: params
    }).then(r => r.json()).then(d => {
      if (d.ok) {
        status.textContent = '✓ Configuration pulled — loading…'; status.className = 'ok';
        setTimeout(() => { window.location.href = d.redirect ?? '?tab=scheduler'; }, 600);
      } else {
        btn.disabled = false; btn.textContent = 'Pull configuration from HOST1 →';
        status.textContent = '✗ ' + (d.error ?? 'Error'); status.className = 'err';
      }
    }).catch(() => { btn.disabled = false; btn.textContent = 'Pull configuration from HOST1 →'; status.textContent = '✗ Request failed'; status.className = 'err'; });
  }
  </script>
 <?php else: ?>
  <!-- Standard first-run: no state file, blank master.conf -->
  <h1>⬡ Varaverk — First Run</h1>
  <div class="vv-setup-sub">Set up your server identity before the plugin can start.</div>
  <div class="vv-setup-field">
    <label>This server's hostname</label>
    <input type="text" id="vv-hostname" value="<?= htmlspecialchars($detectedHostname) ?>" placeholder="unRAID-MyServer" autocomplete="off" spellcheck="false">
    <div class="vv-setup-hint">Must match Settings → Identification exactly (case-sensitive)</div>
  </div>
  <hr class="vv-setup-divider">
  <label style="margin-bottom:10px;display:block;">Server role</label>
  <div class="vv-setup-role">
    <div class="vv-setup-role-btn active" id="vv-role-primary" onclick="vvSetRole('primary')">
      Primary<br><span style="color:#555;font-size:10px;">HOST1 · first to be set up</span>
    </div>
    <div class="vv-setup-role-btn" id="vv-role-partner" onclick="vvSetRole('partner')">
      Partner<br><span style="color:#555;font-size:10px;">HOST2+ · joining an existing primary</span>
    </div>
  </div>
  <div class="vv-setup-conditional" id="vv-cond-primary">
    <div class="vv-setup-field">
      <label>Partner's hostname <span style="color:#444">(optional — can fill in later)</span></label>
      <input type="text" id="vv-partner-hostname" value="" placeholder="unRAID-PartnerServer" autocomplete="off" spellcheck="false">
    </div>
  </div>
  <div class="vv-setup-conditional" id="vv-cond-partner">
    <div class="vv-setup-field">
      <label>Primary server's hostname <span style="color:#a44">*required</span></label>
      <input type="text" id="vv-primary-hostname" value="" placeholder="unRAID-PrimaryServer" autocomplete="off" spellcheck="false">
    </div>
    <div class="vv-setup-field">
      <label>Your slot</label>
      <select id="vv-partner-slot" style="width:100%;box-sizing:border-box;background:#0d0d0d;border:1px solid #333;color:#ddd;padding:7px 10px;border-radius:3px;font-family:monospace;font-size:13px;">
        <option value="host2">HOST2</option>
        <option value="host3">HOST3</option>
        <option value="host4">HOST4</option>
      </select>
    </div>
  </div>
  <button id="vv-setup-btn" onclick="vvDoSetup()">Save and continue →</button>
  <div id="vv-setup-status"></div>
  <script>
  let vvRole = 'primary';
  function vvSetRole(role) {
    vvRole = role;
    document.getElementById('vv-role-primary').classList.toggle('active', role === 'primary');
    document.getElementById('vv-role-partner').classList.toggle('active', role === 'partner');
    document.getElementById('vv-cond-primary').classList.toggle('visible', role === 'primary');
    document.getElementById('vv-cond-partner').classList.toggle('visible', role === 'partner');
  }
  function vvDoSetup() {
    const hostname = document.getElementById('vv-hostname').value.trim();
    const status   = document.getElementById('vv-setup-status');
    const btn      = document.getElementById('vv-setup-btn');
    if (!hostname) { status.textContent = '✗ Hostname is required'; status.className = 'err'; return; }
    let host1 = '', host2 = '', mySlot = 'host1';
    if (vvRole === 'primary') {
      host1 = hostname;
      host2 = document.getElementById('vv-partner-hostname').value.trim();
      mySlot = 'host1';
    } else {
      const primary = document.getElementById('vv-primary-hostname').value.trim();
      if (!primary) { status.textContent = '✗ Primary hostname required'; status.className = 'err'; return; }
      mySlot = document.getElementById('vv-partner-slot').value;
      host1  = primary;
      if (mySlot === 'host2') host2 = hostname;
    }
    btn.disabled = true; btn.textContent = 'Saving…';
    const params = new URLSearchParams({
      csrf_token: typeof csrf_token !== 'undefined' ? csrf_token : '',
      action: 'save', host1, host2, my_slot: mySlot, my_hostname: hostname,
    });
    fetch('/plugins/varaverk/api/setup.php', {
      method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: params
    }).then(r => r.json()).then(d => {
      if (d.ok) {
        status.textContent = '✓ Saved — loading…'; status.className = 'ok';
        setTimeout(() => { window.location.href = d.redirect ?? '?tab=scheduler&vv_setup=master.conf'; }, 600);
      } else {
        btn.disabled = false; btn.textContent = 'Save and continue →';
        status.textContent = '✗ ' + (d.error ?? 'Error'); status.className = 'err';
      }
    }).catch(() => { btn.disabled = false; btn.textContent = 'Save and continue →'; status.textContent = '✗ Request failed'; status.className = 'err'; });
  }
  </script>
 <?php endif; ?>
 </div>
@@ -0,0 +1,223 @@
 <?xml version='1.0' standalone='yes'?>
 <!DOCTYPE PLUGIN [
 <!ENTITY name    "varaverk">
 <!ENTITY author  "gmer4lfe">
 <!ENTITY version "2026.05.30">
 <!ENTITY launch  "varaverk/monitor">
 <!ENTITY github  "https://github.com/FailedProxy/Varaverk">
 <!ENTITY branch  "main">
 <!ENTITY cfgdir  "/boot/config/plugins/varaverk">
 <!ENTITY plugdir "/usr/local/emhttp/plugins/varaverk">
 ]>
 <PLUGIN name="&name;" author="&author;" version="&version;" launch="&launch;"
        support="https://github.com/FailedProxy/Varaverk/issues"
        icon="/plugins/varaverk/icons/varaverk.png">
 <CHANGES>
 ###2026.05.30
 - First-run setup wizard: auto-detects hostname, creates master.conf + host conf from templates
 - Scheduler setup mode: after wizard, master.conf and host conf open sequentially with forced save flow
 - Partnership tab: Onboard button highlighted on arrival from wizard; disabled until partner is configured
 - HOST2 install paths: state-file pull, master.conf push detection, conf-only flow
 - Onboard Step 9: master.conf automatically pushed to all listed hosts on onboard completion
 - Graceful pre-onboard state: neutral banners instead of error warnings before SSH is configured
 - GitHub link in tab bar and Settings page; Community Apps support URL
 ###2026.05.28
 - Initial release: Monitor, Scheduler, Docker, Watchdog, Partnership, Fallback, Arrs tabs
 - Mutual container fallback with tiered escalation and strike-confirmed handback
 - Partnership lifecycle: onboard, offboard, transfer
 - Rsync profile system with per-share container stops and writeback
 - Watchdog: Tier 1 (explicit) + Tier 2 (global scan) container monitoring
 - master.conf push-on-save to all configured partners via SSH
 </CHANGES>
 <!--
  ── Install / Update ────────────────────────────────────────────────────────────
  Runs on first install and on every plugin update.
  Clones the repo on fresh install; pulls latest on update.
  Array must be started — appdata must be available.
  ────────────────────────────────────────────────────────────────────────────────
 -->
 <FILE Name="&cfgdir;/install.sh" Run="/bin/bash" Method="install update">
 <INLINE>
 <![CDATA[
 #!/bin/bash
 PLUGIN="varaverk"
 GITHUB="https://github.com/FailedProxy/Varaverk"
 BRANCH="main"
 CFG_DIR="/boot/config/plugins/$PLUGIN"
 CFG_FILE="$CFG_DIR/varaverk.cfg"
 WEB_DIR="/usr/local/emhttp/plugins/$PLUGIN"
 LOG="$CFG_DIR/install.log"
 mkdir -p "$CFG_DIR"
 log() { echo "[$(date '+%H:%M:%S')] $*" | tee -a "$LOG"; }
 log "=== Varaverk install/update ==="
 # Unraid only
 if [[ ! -f /etc/unraid-version ]]; then
    log "ERROR: not running on Unraid — aborting"
    exit 1
 fi
 # Read SCRIPTS_DIR from cfg if present
 if [[ -f "$CFG_FILE" ]]; then
    _sd=$(grep -oP '(?<=SCRIPTS_DIR=")[^"]+' "$CFG_FILE" 2>/dev/null)
    [[ -n "$_sd" ]] && SCRIPTS_DIR="$_sd"
 fi
 SCRIPTS_DIR="${SCRIPTS_DIR:-/mnt/user/appdata/Varaverk}"
 CONF_DIR="$SCRIPTS_DIR/Configurations"
 # Array must be started — appdata must be available
 if ! df --output=fstype /mnt/user 2>/dev/null | grep -q 'shfs'; then
    log "Array not started — cannot install to appdata"
    log "Start the array then reinstall, or wait for next boot"
    exit 0
 fi
 # Clone or update repo
 if [[ ! -d "$SCRIPTS_DIR/.git" ]]; then
    log "Cloning $GITHUB ($BRANCH) → $SCRIPTS_DIR"
    if ! git clone --branch "$BRANCH" "$GITHUB" "$SCRIPTS_DIR" >> "$LOG" 2>&1; then
        log "ERROR: git clone failed — check internet access and GitHub URL"
        exit 1
    fi
    log "Clone complete"
 else
    log "Updating repo in $SCRIPTS_DIR"
    git -C "$SCRIPTS_DIR" pull --ff-only origin "$BRANCH" >> "$LOG" 2>&1 \
        && log "Pull complete" \
        || log "WARNING: git pull failed — repo may have local modifications"
 fi
 # Sanity check — Plugin/unraid must exist after clone
 if [[ ! -d "$SCRIPTS_DIR/Plugin/unraid" ]]; then
    log "ERROR: Plugin/unraid not found in cloned repo — unexpected repo structure"
    exit 1
 fi
 # Symlink web files
 if [[ -L "$WEB_DIR" ]]; then
    rm "$WEB_DIR"
 elif [[ -d "$WEB_DIR" ]]; then
    log "WARNING: $WEB_DIR is a real directory — not replacing (remove manually if needed)"
 fi
 if [[ ! -e "$WEB_DIR" ]]; then
    ln -s "$SCRIPTS_DIR/Plugin/unraid" "$WEB_DIR"
    log "Symlinked: $WEB_DIR → $SCRIPTS_DIR/Plugin/unraid"
 fi
 # Write varaverk.cfg if not present
 if [[ ! -f "$CFG_FILE" ]]; then
    printf 'SCRIPTS_DIR="%s"\n' "$SCRIPTS_DIR" > "$CFG_FILE"
    log "Created varaverk.cfg (SCRIPTS_DIR=$SCRIPTS_DIR)"
 fi
 # Create Configurations dir if git clone didn't
 mkdir -p "$CONF_DIR"
 # Bootstrap master.conf from template on first install
 if [[ ! -f "$CONF_DIR/master.conf" ]]; then
    if [[ -f "$SCRIPTS_DIR/Configurations/master.conf.template" ]]; then
        cp "$SCRIPTS_DIR/Configurations/master.conf.template" "$CONF_DIR/master.conf"
        log "Created master.conf from template — fill in HOST1 and HOST2 to continue"
    else
        log "WARNING: master.conf.template not found — master.conf not created"
    fi
 fi
 log "Install complete — open Varaverk in Unraid to complete setup"
 log "→ Plugins → Varaverk  (or navigate to Settings → Utilities → Varaverk)"
 ]]>
 </INLINE>
 </FILE>
 <!--
  ── Boot (every boot) ───────────────────────────────────────────────────────────
  Fast idempotent check — recreates the web symlink if it disappeared.
  No git operations. Safe to run before the array is fully started.
  ────────────────────────────────────────────────────────────────────────────────
 -->
 <FILE Name="&cfgdir;/boot.sh" Run="/bin/bash">
 <INLINE>
 <![CDATA[
 #!/bin/bash
 PLUGIN="varaverk"
 CFG_FILE="/boot/config/plugins/$PLUGIN/varaverk.cfg"
 WEB_DIR="/usr/local/emhttp/plugins/$PLUGIN"
 # Read SCRIPTS_DIR
 if [[ -f "$CFG_FILE" ]]; then
    _sd=$(grep -oP '(?<=SCRIPTS_DIR=")[^"]+' "$CFG_FILE" 2>/dev/null)
 fi
 SCRIPTS_DIR="${_sd:-/mnt/user/appdata/Varaverk}"
 # Only act if source exists (array started) and symlink is missing
 if [[ -d "$SCRIPTS_DIR/Plugin/unraid" ]] && [[ ! -e "$WEB_DIR" ]]; then
    [[ -L "$WEB_DIR" ]] && rm "$WEB_DIR"
    ln -s "$SCRIPTS_DIR/Plugin/unraid" "$WEB_DIR"
 fi
 ]]>
 </INLINE>
 </FILE>
 <!--
  ── Remove ──────────────────────────────────────────────────────────────────────
  Removes the web symlink. Scripts and conf in appdata are left intact.
  ────────────────────────────────────────────────────────────────────────────────
 -->
 <FILE Name="&cfgdir;/remove.sh" Run="/bin/bash" Method="remove">
 <INLINE>
 <![CDATA[
 #!/bin/bash
 PLUGIN="varaverk"
 CFG_DIR="/boot/config/plugins/$PLUGIN"
 CFG_FILE="$CFG_DIR/varaverk.cfg"
 CRON_FILE="$CFG_DIR/varaverk.cron"
 WEB_DIR="/usr/local/emhttp/plugins/$PLUGIN"
 log() { echo "[Varaverk remove] $*"; }
 # Read SCRIPTS_DIR so we can locate running scripts
 if [[ -f "$CFG_FILE" ]]; then
    _sd=$(grep -oP '(?<=SCRIPTS_DIR=")[^"]+' "$CFG_FILE" 2>/dev/null)
 fi
 SCRIPTS_DIR="${_sd:-/mnt/user/appdata/Varaverk}"
 # ── Stop continuous background scripts ───────────────────────────────────────
 # fallback.sh manages its own lock — use --stop for clean shutdown
 if [[ -f "$SCRIPTS_DIR/Fallback/fallback.sh" ]]; then
    bash "$SCRIPTS_DIR/Fallback/fallback.sh" --stop 2>/dev/null && \
        log "fallback.sh stopped" || true
 fi
 # Kill any remaining Varaverk background processes (watchdog orchestrator, etc.)
 pkill -f "run_job.sh" 2>/dev/null || true
 pkill -f "watchdog_orchestrator.sh" 2>/dev/null || true
 # ── Remove cron entries ───────────────────────────────────────────────────────
 if [[ -f "$CRON_FILE" ]]; then
    rm -f "$CRON_FILE"
    /usr/local/sbin/update_cron 2>/dev/null || true
    log "Cron entries removed"
 fi
 # Remove legacy direct cron file if it exists
 rm -f /etc/cron.d/varaverk
 # ── Remove web symlink ────────────────────────────────────────────────────────
 [[ -L "$WEB_DIR" ]] && rm -f "$WEB_DIR" && log "Web symlink removed"
 # ── Remove plugin config from flash ──────────────────────────────────────────
 rm -rf "$CFG_DIR"
 log "Plugin config removed from flash"
 log "Done. Scripts and conf in $SCRIPTS_DIR are preserved."
 log "To fully remove: delete $SCRIPTS_DIR manually."
 ]]>
 </INLINE>
 </FILE>
 </PLUGIN>
Author	SHA1	Message	Date
Gmer4Lfe	d56b02e410	Monitor: card icons + status accent borders varaverk.css: .vv-ico — icon wrapper (inline-flex, opacity 0.38, flex-shrink:0) .vv-accent-ok/warn/err — left border colour overrides for state cards Smooth 0.5s transition on border-left-color for all monitor cards monitor.php: All 14 card headers now have inline SVG icons: System (existing server), Power (existing bolt), CPU (chip+pins), Memory (RAM stick), Network (switch tree), Scripts (terminal), Fallback (shield), Partner (two servers linked), Containers (layers), GPU (PCIe card), Transcode (film→encode→strip), Streams (play ▶), Watchdog (eye), Parity (✓ circle), Pools (cylinder), Array (drive stack) Status accent borders applied by JS after each render: Fallback — ok:NORMAL, err:FAILOVER, warn:NO_INTERNET/DARK Partner — ok:any remote online, warn:all offline Watchdog — ok:healthy, err:reboots/OOM/daemon, warn:other issues Array — ok:STARTED, err:any other state	2026-05-30 17:08:59 -04:00
Gmer4Lfe	da3d402f1a	Revert "git_pull_execute: GitHub fallback when GITEA_REPO_PATH is empty" This reverts commit `9a26478498`.	2026-05-30 16:56:49 -04:00
Gmer4Lfe	9a26478498	git_pull_execute: GitHub fallback when GITEA_REPO_PATH is empty End users leave GITEA_REPO_PATH="" in master.conf (template default). Before hitting any Gitea detection logic, the script now checks for this and does git pull --ff-only origin main directly — origin is already GitHub since the .plg cloned from there. Sparse checkout skipped on this path: conf files are gitignored so nothing sensitive is in the repo to exclude. Developer path (GITEA_REPO_PATH configured) is completely unchanged.	2026-05-30 16:55:25 -04:00
Gmer4Lfe	5edb32f48d	Deployment: gitignore, remove script, version bump to 2026.05.30 .gitignore: Excludes Configurations/host.conf + master.conf (personal credentials) and Configurations/.bak, data/, .log, .lock. Templates remain tracked. Files stay on disk — only untracked from git. Plugin/varaverk.plg: Version: 2026.05.28 → 2026.05.30 <CHANGES>: proper changelog entries for both releases covering wizard, setup flow, Partnership highlights, HOST2 paths, onboard Step 9, pre-onboard graceful state, GitHub links. Remove script: stops fallback.sh cleanly (--stop), kills watchdog orchestrator, removes cron file + calls update_cron, removes web symlink and plugin flash dir. Preserves appdata with clear message.	2026-05-30 16:51:18 -04:00
Gmer4Lfe	7e01f6d3db	Differentiate API key missing vs API unreachable in monitor banner unraid_api.php: track key_missing separately from general fallbacks. vv_api_data() sets key_missing=true when HOST*_UNRAID_API_KEY is empty. vv_api_get_status() includes key_missing in the status payload. monitor.php: two distinct banner states instead of one orange warning. key_missing → subtle dark/grey note: "API key not configured — add HOST1_UNRAID_API_KEY in Scheduler → host conf to enable enhanced monitoring" key present but unreachable → existing orange ⚠ with fallback list. No banner at all when API is working correctly.	2026-05-30 16:26:51 -04:00
Gmer4Lfe	10fc703e57	Add GitHub link, fix Settings page, direct users to setup on install Plugin/varaverk.plg: - Add support="https://github.com/FailedProxy/Varaverk/issues" - Install completion log now says "open Varaverk to complete setup" with navigation hint — user lands on wizard automatically Plugin/unraid/VaraverkSettings.page: - Fix stale SCRIPTS_DIR default (unraid_scripts → Varaverk) - Add GitHub / Issues / Changelog links at bottom of settings page Plugin/unraid/Varaverk.page: - Small "⎋ GitHub" link right-aligned in the tab bar links to github.com/FailedProxy/Varaverk in a new tab	2026-05-30 16:22:54 -04:00
Gmer4Lfe	d09ea11694	Onboard Step 9: push master.conf to all listed hosts on completion After Step 8 (arr bootstrap), owner calls vv_push_master_conf() and vv_push_setup_state() via php -r. SSH is established at this point so the probe passes and all listed hosts get the authoritative master.conf immediately — no manual save required. Skipped if onboard failed, dry-run mode, or php unavailable (with fallback instruction). Result shown in onboard summary as Step 9.	2026-05-30 16:14:07 -04:00
Gmer4Lfe	0121462576	Graceful degradation before partnership/SSH is set up Fix 1 — Monitor partner card (common.php + monitor.php): vv_remote_hosts_stats() no longer skips hosts with no API key. Returns no_api_key:true entry instead. Monitor JS renders "API key not configured — complete Onboard to enable" instead of a blank space. Fix 2 — rawconf push not alarming pre-onboard (config.php + scheduler.php): Probe failures (Tailscale not found, plugin not installed) now carry ready:false. JS treats ready:false results silently — button shows "✓ Saved" not "push failed: HOST2" before SSH is set up. Only genuine post-onboard failures (ready not false) show as errors. Fix 3 — Partnership Onboard button (partnership.php): Disabled with tooltip when no partner hostname is in master.conf. When partner configured but not onboarded, adds explanation note: "Onboard will generate your SSH key, exchange it with the partner..." No partner configured: "Edit master.conf and set HOST2."	2026-05-30 16:01:44 -04:00
Gmer4Lfe	974e3cf2cf	Setup: all hosts land on Partnership after conf setup, not just HOST1	2026-05-30 15:53:52 -04:00
Gmer4Lfe	64f2c89a40	Setup mode: HOST1 lands on Partnership with Onboard highlighted scheduler.php: after host1.conf save in setup mode, redirect to ?tab=partnership&vv_onboard=1 instead of Monitor. HOST2+ still redirects to Monitor (they don't manage the partnership). partnership.php: detects vv_onboard=1 URL param after actions render. Adds pulse animation + box-shadow to the Onboard button and scrolls it into view. One-shot — gone when user navigates away.	2026-05-30 15:52:41 -04:00
Gmer4Lfe	af89258bbd	Setup wizard: full first-run flow for HOST1 and HOST2 Varaverk.page: also shows wizard when local host.conf is missing (handles master.conf pushed by HOST1 before HOST2 installs plugin). pages/setup.php: three wizard flows - Standard: blank master.conf, fill hostnames, redirect to scheduler - Host2/state file: state file detected, pull master.conf from HOST1 via SSH - Conf-only: master.conf already filled (was pushed), just create local host.conf api/setup.php: - save action: writes master.conf + host.conf, creates varaverk_setup.db state file, redirects to ?tab=scheduler&vv_setup=master.conf - pull action: resolves HOST1 Tailscale IP, queries HOST1 SCRIPTS_DIR, SCPs master.conf, creates local host.conf, redirects to ?tab=scheduler&vv_setup=hostN.conf include/config.php: vv_setup_state_read/write/push helpers. vv_push_setup_state() pushes varaverk_setup.db to /boot/config/ on all known remotes — no plugin-readiness probe needed (flash is always accessible). api/rawconf.php: calls vv_push_setup_state() alongside master.conf push. pages/scheduler.php: setup mode via ?vv_setup=<conf> URL param. Auto-opens the specified conf file on page load (DOMContentLoaded). vvSaveRawConf: in setup mode, skips confirm dialog and forces sequence: master.conf save → auto-open hostN.conf hostN.conf save → redirect to Monitor (setup complete)	2026-05-30 15:43:04 -04:00
Gmer4Lfe	1e9681a71e	Add first-run wizard, host.conf template, fix GitHub URL Plugin/varaverk.plg: URL updated to github.com/FailedProxy/Varaverk Configurations/host.conf.template: Full host conf structure with HOSTN/hostn placeholders. All personal values blank, all sections documented. Covers identity, rsync, docker, fallback, media, monitors, transcodes, arrs, system watchdog, resource manager. Varaverk.page: checks if HOST1 is blank before rendering tabs. If blank → shows setup wizard, returns early (tabs never render). pages/setup.php: first-run wizard UI. Auto-populates hostname from hostname -s. Role selection: primary (HOST1) or partner (HOST2+). Partner slot selector for HOST3+. api/setup.php: handles wizard form POST. Writes HOST1/HOST2 (and HOST3+) into master.conf preserving all other content. Creates host.conf from template with HOSTN/hostn replaced and SSH key path pre-filled from hostname convention. Never overwrites an existing host.conf.	2026-05-30 15:22:46 -04:00
Gmer4Lfe	6549ed0301	Add .plg install script and master.conf.template Plugin/varaverk.plg: - Method="install update": git clone (fresh) or pull (update) Validates Unraid, checks array is started via shfs mount, clones to SCRIPTS_DIR (read from varaverk.cfg, default /mnt/user/appdata/Varaverk), creates Plugin/unraid symlink, inits varaverk.cfg, bootstraps master.conf from template on first install. - Every boot: lightweight boot.sh recreates symlink if missing (no git ops). - Method="remove": removes web symlink, leaves appdata intact. Configurations/master.conf.template: - Full master.conf with personal values blanked: HOST1/HOST2 empty, GITEA_REPO_PATH empty, personal container names in profiles cleared, FALLBACK_ENABLED=false, CRITICAL/DAILY rsync defaults corrected to true. New users fill in HOST1, HOST2, then proceed to partnership setup.	2026-05-30 15:15:40 -04:00
Gmer4Lfe	5ebf1fc96f	Add failsafes to vv_push_master_conf before SCPing Single SSH probe per remote checks all three conditions in one call: - plugin cfg exists (varaverk.cfg present with SCRIPTS_DIR) - Configurations/ dir exists at that path - master.conf already present on remote Any failure skips that host entirely rather than pushing blind. Uses the discovered SCRIPTS_DIR as the SCP destination, not ours.	2026-05-30 14:43:37 -04:00
Gmer4Lfe	b5d7413d88	Query remote SCRIPTS_DIR before SCPing master.conf Instead of assuming the remote uses the same appdata path as the local host, SSH-grep their varaverk.cfg first and SCP to their actual Configurations/ dir. Falls back to /mnt/user/appdata/Varaverk if the plugin isn't installed or the file can't be read.	2026-05-30 14:37:47 -04:00
Gmer4Lfe	da0c303f22	Push master.conf to all partners immediately on raw-editor save vv_push_master_conf() in config.php: finds all remote HOST* entries, resolves Tailscale IPs, SCPs master.conf to each. rawconf.php calls it after a successful write when file=master.conf. Scheduler save button shows sync status: "✓ Saved · synced to HOST2" or "✓ Saved · push failed: HOST2" on error. Also fix path bug in partnership_transfer.sh — was SCPing to appdata root instead of Configurations/.	2026-05-30 14:21:02 -04:00
Gmer4Lfe	26f3778786	Remove redundant Scripts dir field from Scheduler tab VaraverkSettings.page (Settings → Other Settings) now owns SCRIPTS_DIR. The inline Advanced-mode field and vvSaveSettings() in the Scheduler tab were a second path to the same write — removed.	2026-05-30 14:06:28 -04:00