feat(ui): settings menu restructure, git branch dropdown, and repo cleanup

.gitignore

@@ -69,5 +69,20 @@ PROJECT_SUMMARY.md
 QUICKSTART.md
 VS_CODE_SETUP.md
 
+# Gemini / Antigravity
+.gemini/
+
 # Windows artifacts
 nul
+
+# Debug / temp files (generated during development & testing)
+out.txt
+containers.txt
+helper.txt
+logs.txt
+port.txt
+env.txt
+network.txt
+update_helper.txt
+state.txt
+hostpath.txt

app/routers/settings.py

@@ -334,6 +334,19 @@ async def get_version(
     return result
 
 
+@router.get("/branches")
+async def get_branches(
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    """Return a list of available branches from the configured git remote."""
+    config = get_system_config(db)
+    if not config or not config.git_repo_url:
+        return []
+    branches = await update_service.get_remote_branches(config)
+    return branches
+
+
 @router.post("/update")
 async def trigger_update(
     current_user: User = Depends(get_current_user),

app/services/update_service.py

@@ -5,6 +5,7 @@ import logging
 import os
 import shutil
 import subprocess
+import httpx
 from datetime import datetime
 from pathlib import Path
 from typing import Any
@@ -130,6 +131,42 @@ async def check_for_updates(config: Any) -> dict:
         }
 
 
+async def get_remote_branches(config: Any) -> list[str]:
+    """Query the Gitea API for available branches on the configured repository.
+    
+    Returns a list of branch names (e.g., ['main', 'unstable', 'development']).
+    If the repository URL is not configured or an error occurs, returns an empty list.
+    """
+    if not config.git_repo_url:
+        return []
+
+    repo_url = config.git_repo_url.rstrip("/")
+    parts = repo_url.split("/")
+    if len(parts) < 5:
+        return []
+
+    base_url = "/".join(parts[:-2])
+    owner = parts[-2]
+    repo = parts[-1]
+    branches_api = f"{base_url}/api/v1/repos/{owner}/{repo}/branches?limit=100"
+
+    headers = {}
+    if config.git_token:
+        headers["Authorization"] = f"token {config.git_token}"
+
+    try:
+        async with httpx.AsyncClient(timeout=10) as client:
+            resp = await client.get(branches_api, headers=headers)
+            if resp.status_code == 200:
+                data = resp.json()
+                if isinstance(data, list):
+                    return [branch.get("name") for branch in data if "name" in branch]
+    except Exception as exc:
+        logger.error("Error fetching branches: %s", exc)
+        
+    return []
+
+
 def backup_database(db_path: str) -> str:
     """Create a timestamped backup of the SQLite database.
 
@@ -299,10 +336,10 @@ def trigger_update(config: Any, db_path: str) -> dict:
     own_image = "netbirdmsp-appliance-netbird-msp-appliance:latest"
 
     helper_cmd = [
-        "docker", "run", "-d",
+        "docker", "run", "--rm", "-d", "--privileged",
         "--name", "msp-updater",
-        "-v", "/var/run/docker.sock:/var/run/docker.sock",
-        "-v", f"{host_source_dir}:{host_source_dir}:ro",
+        "-v", "/var/run/docker.sock:/var/run/docker.sock:z",
+        "-v", f"{host_source_dir}:{host_source_dir}:ro,z",
         *env_flags,
         own_image,
         "sh", "-c",

containers.txt

@@ -1,8 +0,0 @@
-msp-updater	Exited (2) 11 seconds ago	netbirdmsp-appliance-netbird-msp-appliance:latest	15 seconds ago
-netbird-msp-appliance	Up 6 minutes (healthy)	07c60529cf9f	6 minutes ago
-netbird-kunde1-caddy	Up 2 hours	caddy:2-alpine	3 hours ago
-netbird-kunde1-signal	Up 2 hours	netbirdio/signal:latest	3 hours ago
-netbird-kunde1-dashboard	Up 2 hours	netbirdio/dashboard:latest	3 hours ago
-netbird-kunde1-relay	Up 2 hours	netbirdio/relay:latest	3 hours ago
-netbird-kunde1-management	Up 2 hours	netbirdio/management:latest	3 hours ago
-docker-socket-proxy	Up 2 hours	tecnativa/docker-socket-proxy:latest	3 days ago

helper.txt

@@ -1 +0,0 @@
-Error response from daemon: No such container: msp-updater

logs.txt

@@ -1,40 +0,0 @@
-INFO:     Application startup complete.
-INFO:     Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)
-INFO:     127.0.0.1:60204 - "GET /api/health HTTP/1.1" 200 OK
-INFO:     127.0.0.1:37702 - "GET /api/health HTTP/1.1" 200 OK
-INFO:     127.0.0.1:34872 - "GET /api/health HTTP/1.1" 200 OK
-INFO:     127.0.0.1:49808 - "GET /api/health HTTP/1.1" 200 OK
-2026-02-22 14:16:10,300 [INFO] httpx: HTTP Request: GET https://git.0x26.ch/api/v1/repos/BurgerGames/NetBirdMSP-Appliance/branches/unstable "HTTP/1.1 200 OK"
-2026-02-22 14:16:10,306 [INFO] httpx: HTTP Request: GET https://git.0x26.ch/api/v1/repos/BurgerGames/NetBirdMSP-Appliance/tags?limit=1 "HTTP/1.1 200 OK"
-INFO:     172.18.0.1:53698 - "GET /api/settings/version HTTP/1.1" 200 OK
-2026-02-22 14:16:13,790 [INFO] httpx: HTTP Request: GET https://git.0x26.ch/api/v1/repos/BurgerGames/NetBirdMSP-Appliance/branches/unstable "HTTP/1.1 200 OK"
-2026-02-22 14:16:13,796 [INFO] httpx: HTTP Request: GET https://git.0x26.ch/api/v1/repos/BurgerGames/NetBirdMSP-Appliance/tags?limit=1 "HTTP/1.1 200 OK"
-INFO:     172.18.0.1:53698 - "GET /api/settings/version HTTP/1.1" 200 OK
-INFO:     127.0.0.1:55164 - "GET /api/health HTTP/1.1" 200 OK
-INFO:     172.18.0.1:55590 - "GET / HTTP/1.1" 200 OK
-INFO:     172.18.0.1:55590 - "GET /js/app.js HTTP/1.1" 304 Not Modified
-INFO:     172.18.0.1:55590 - "GET /lang/en.json HTTP/1.1" 304 Not Modified
-INFO:     172.18.0.1:55590 - "GET /lang/de.json HTTP/1.1" 304 Not Modified
-INFO:     172.18.0.1:55590 - "GET /favicon.ico HTTP/1.1" 404 Not Found
-INFO:     172.18.0.1:55590 - "GET /api/settings/branding HTTP/1.1" 200 OK
-INFO:     172.18.0.1:55590 - "GET /api/auth/azure/config HTTP/1.1" 200 OK
-INFO:     172.18.0.1:55590 - "GET /api/auth/me HTTP/1.1" 200 OK
-INFO:     172.18.0.1:55590 - "GET /api/monitoring/status HTTP/1.1" 200 OK
-INFO:     172.18.0.1:55588 - "GET /api/customers?page=1&per_page=25 HTTP/1.1" 200 OK
-INFO:     172.18.0.1:37544 - "GET /api/settings/system HTTP/1.1" 200 OK
-INFO:     172.18.0.1:37544 - "GET /api/auth/mfa/status HTTP/1.1" 200 OK
-2026-02-22 14:16:58,896 [INFO] httpx: HTTP Request: GET https://git.0x26.ch/api/v1/repos/BurgerGames/NetBirdMSP-Appliance/branches/unstable "HTTP/1.1 200 OK"
-2026-02-22 14:16:58,906 [INFO] httpx: HTTP Request: GET https://git.0x26.ch/api/v1/repos/BurgerGames/NetBirdMSP-Appliance/tags?limit=1 "HTTP/1.1 200 OK"
-INFO:     172.18.0.1:37552 - "GET /api/settings/version HTTP/1.1" 200 OK
-INFO:     127.0.0.1:57972 - "GET /api/health HTTP/1.1" 200 OK
-INFO:     127.0.0.1:59030 - "GET /api/health HTTP/1.1" 200 OK
-2026-02-22 14:17:44,793 [INFO] app.services.update_service: Database backed up to /app/backups/netbird_msp_20260222_141744.db
-2026-02-22 14:17:45,142 [INFO] app.services.update_service: git pull succeeded: Already up to date.
-2026-02-22 14:17:45,160 [INFO] app.services.update_service: Rebuilding with GIT_TAG=alpha-1.5 GIT_COMMIT=94d0b98 GIT_BRANCH=unstable
-2026-02-22 14:17:45,160 [INFO] app.services.update_service: Phase A: building new image …
-2026-02-22 14:20:39,486 [INFO] app.services.update_service: Phase A complete — image built successfully.
-2026-02-22 14:20:39,507 [INFO] app.services.update_service: Host source directory: /home/sascha/NetBirdMSP-Appliance
-2026-02-22 14:20:40,068 [INFO] app.services.update_service: Phase B: updater container started — this container will restart in ~5s.
-2026-02-22 14:20:40,069 [INFO] app.routers.settings: Update triggered by admin.
-INFO:     172.18.0.1:51826 - "POST /api/settings/update HTTP/1.1" 200 OK
-INFO:     127.0.0.1:36054 - "GET /api/health HTTP/1.1" 200 OK

out.txt

@@ -1,10 +0,0 @@
-[unstable 94d0b98] alpha-1.5: trigger update
-remote: 
-remote: Create a new pull request for 'unstable':        
-remote:   https://git.0x26.ch/BurgerGames/NetBirdMSP-Appliance/pulls/new/unstable        
-remote: 
-remote: .. Processing 2 references        
-remote: Processed 2 references in total        
-To https://git.0x26.ch/BurgerGames/NetBirdMSP-Appliance.git
-   2780b06..94d0b98  unstable -> unstable
- * [new tag]         alpha-1.5 -> alpha-1.5

port.txt

@@ -1,2 +0,0 @@
-8000/tcp -> 0.0.0.0:8000
-8000/tcp -> [::]:8000

static/js/app.js

@@ -366,7 +366,7 @@ function logout() {
                 'Content-Type': 'application/json',
                 'Authorization': `Bearer ${authToken}`,
             },
-        }).catch(() => {});
+        }).catch(() => { });
     }
     authToken = null;
     currentUser = null;
@@ -511,7 +511,7 @@ function showNewCustomerModal() {
     // Update subdomain suffix
     api('GET', '/settings/system').then(cfg => {
         document.getElementById('cust-subdomain-suffix').textContent = `.${cfg.base_domain || 'domain.com'}`;
-    }).catch(() => {});
+    }).catch(() => { });
 
     const modalEl = document.getElementById('customer-modal');
     const modal = bootstrap.Modal.getOrCreateInstance(modalEl);
@@ -872,6 +872,9 @@ async function loadSettings() {
     } catch (err) {
         showSettingsAlert('danger', t('errors.failedToLoadSettings', { error: err.message }));
     }
+
+    // Automatically fetch branches once the base config is populated
+    await loadGitBranches();
 }
 
 function updateLogoPreview(logoPath) {
@@ -1183,6 +1186,42 @@ async function testLdapConnection() {
     }
 }
 
+async function loadGitBranches() {
+    const branchSelect = document.getElementById('cfg-git-branch');
+    const currentVal = branchSelect.value;
+
+    // Disable mapping while loading
+    branchSelect.disabled = true;
+    branchSelect.innerHTML = `<option value="${currentVal}">${currentVal} (Loading...)</option>`;
+
+    try {
+        const branches = await api('GET', '/settings/branches');
+        branchSelect.innerHTML = '';
+
+        // Always ensure the currently saved branch is an option
+        if (currentVal && !branches.includes(currentVal)) {
+            branches.unshift(currentVal);
+        }
+
+        if (branches.length === 0) {
+            branchSelect.innerHTML = `<option value="main">main</option>`;
+        } else {
+            branches.forEach(b => {
+                const opt = document.createElement('option');
+                opt.value = b;
+                opt.textContent = b;
+                if (b === currentVal) opt.selected = true;
+                branchSelect.appendChild(opt);
+            });
+        }
+    } catch (err) {
+        showSettingsAlert('warning', `Failed to load branches: ${err.message}`);
+        branchSelect.innerHTML = `<option value="${currentVal}">${currentVal}</option>`;
+    } finally {
+        branchSelect.disabled = false;
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Update / Version Management
 // ---------------------------------------------------------------------------
@@ -1219,12 +1258,12 @@ async function loadVersionInfo() {
 
         let html = `<div class="row g-3">
             <div class="col-md-6">
-                <div class="border rounded p-3">
+                <div class="border rounded p-3 h-100">
                     <div class="text-muted small mb-1">${t('settings.currentVersion')}</div>
                     <div class="fw-bold fs-5">${esc(currentTag || currentCommit)}</div>
                     ${currentTag ? `<div class="text-muted small font-monospace">${t('settings.commitHash')}: ${esc(currentCommit)}</div>` : ''}
                     <div class="text-muted small">${t('settings.branch')}: <strong>${esc(current.branch || 'unknown')}</strong></div>
-                    <div class="text-muted small">${esc(current.date || '')}</div>
+                    <div class="text-muted small mt-2"><i class="bi bi-clock me-1"></i>${formatDate(current.date)}</div>
                 </div>
             </div>`;
 
@@ -1235,17 +1274,17 @@ async function loadVersionInfo() {
                 ? `<span class="badge bg-warning text-dark ms-1">${t('settings.updateAvailable')}</span>`
                 : `<span class="badge bg-success ms-1">${t('settings.upToDate')}</span>`;
             html += `<div class="col-md-6">
-                <div class="border rounded p-3 ${needsUpdate ? 'border-warning' : ''}">
+                <div class="border rounded p-3 h-100 ${needsUpdate ? 'border-warning' : ''}">
                     <div class="text-muted small mb-1">${t('settings.latestVersion')} ${badge}</div>
                     <div class="fw-bold fs-5">${esc(latestTag || latestCommit)}</div>
                     ${latestTag ? `<div class="text-muted small font-monospace">${t('settings.commitHash')}: ${esc(latestCommit)}</div>` : ''}
                     <div class="text-muted small">${t('settings.branch')}: <strong>${esc(latest.branch || 'unknown')}</strong></div>
-                    <div class="text-muted small">${esc(latest.message || '')}</div>
-                    <div class="text-muted small">${esc(latest.date || '')}</div>
+                    <div class="text-muted small mt-2"><i class="bi bi-clock me-1"></i>${formatDate(latest.date)}</div>
+                    ${latest.message ? `<div class="text-muted small mt-1 border-top pt-1 text-truncate" title="${esc(latest.message)}"><i class="bi bi-chat-text me-1"></i>${esc(latest.message)}</div>` : ''}
                 </div>
             </div>`;
         } else if (data.error) {
-            html += `<div class="col-md-6"><div class="alert alert-warning mb-0">${esc(data.error)}</div></div>`;
+            html += `<div class="col-md-6"><div class="alert alert-warning h-100 mb-0">${esc(data.error)}</div></div>`;
         }
         html += '</div>';
 

static/lang/de.json

@@ -93,16 +93,19 @@
   },
   "settings": {
     "title": "Systemeinstellungen",
-    "tabSystem": "Systemkonfiguration",
-    "tabNpm": "NPM Integration",
-    "tabImages": "Docker Images",
+    "tabSystem": "NetBird MSP System",
+    "tabNpm": "NPM Proxy",
+    "tabImages": "NetBird Docker Images",
     "tabBranding": "Branding",
     "tabUsers": "Benutzer",
     "tabAzure": "Azure AD",
     "tabDns": "Windows DNS",
     "tabLdap": "LDAP / AD",
-    "tabUpdate": "Updates",
+    "tabUpdate": "NetBird MSP Updates",
     "tabSecurity": "Sicherheit",
+    "groupUsers": "Benutzerverwaltung",
+    "groupSystem": "Systemkonfiguration",
+    "groupExternal": "Umsysteme",
     "baseDomain": "Basis-Domain",
     "baseDomainPlaceholder": "ihredomain.com",
     "baseDomainHint": "Kunden erhalten Subdomains: kunde.ihredomain.com",

static/lang/en.json

@@ -114,16 +114,19 @@
   },
   "settings": {
     "title": "System Settings",
-    "tabSystem": "System Configuration",
-    "tabNpm": "NPM Integration",
-    "tabImages": "Docker Images",
+    "tabSystem": "NetBird MSP System",
+    "tabNpm": "NPM Proxy",
+    "tabImages": "NetBird Docker Images",
     "tabBranding": "Branding",
     "tabUsers": "Users",
     "tabAzure": "Azure AD",
     "tabDns": "Windows DNS",
     "tabLdap": "LDAP / AD",
-    "tabUpdate": "Updates",
+    "tabUpdate": "NetBird MSP Updates",
     "tabSecurity": "Security",
+    "groupUsers": "User Management",
+    "groupSystem": "System Configuration",
+    "groupExternal": "External Systems",
     "baseDomain": "Base Domain",
     "baseDomainPlaceholder": "yourdomain.com",
     "baseDomainHint": "Customers get subdomains: customer.yourdomain.com",

update_helper.txt

@@ -1 +0,0 @@
-sh: 1: cannot create /home/sascha/NetBirdMSP-Appliance/app/backups/updater.log: Directory nonexistent