Addition of the nginx forwarding

Web/modules/database/user.py

@@ -54,10 +54,34 @@ def _clean_name_fragment(value):
     return cleaned
 
 
-def _get_tenant_db(client):
+def _get_tenant_db(client, tenant_id=None):
     """Return the current tenant database for the request, or fall back to default."""
     try:
         from tenant import get_tenant_db
+        if tenant_id is None:
+            return get_tenant_db(client)
+
+        tenant_id = str(tenant_id).strip()
+        if tenant_id:
+            try:
+                from tenant import get_tenant_config
+
+                config = get_tenant_config(tenant_id)
+                if isinstance(config, dict):
+                    explicit_db = config.get('db') or config.get('db_name')
+                    if explicit_db:
+                        db_name = str(explicit_db).strip()
+                        if db_name and not db_name.startswith('inventar_'):
+                            db_name = f'inventar_{db_name}'
+                        if db_name:
+                            return client[db_name]
+            except Exception:
+                pass
+
+            sanitized = ''.join(c for c in tenant_id.lower() if c.isalnum() or c == '_')
+            if sanitized:
+                return client[f'inventar_{sanitized}']
+
         return get_tenant_db(client)
     except Exception:
         return client[cfg.MONGODB_DB]
@@ -479,8 +503,45 @@ def check_nm_pwd(username, password):
             query = {'$or': [{'Username': username}, {'username': username}]}
             user_record_fallback = users.find_one(query)
             if user_record_fallback is None:
-                logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
-                return None
+                if db_name != cfg.MONGODB_DB:
+                    default_users = client[cfg.MONGODB_DB]['users']
+                    user_record_fallback = default_users.find_one(
+                        {'$or': [
+                            {'Username': dp.encrypt_text(username)},
+                            {'username': dp.encrypt_text(username)},
+                            {'Username': username},
+                            {'username': username},
+                        ]}
+                    )
+                    if user_record_fallback is not None:
+                        migrated_record = dict(user_record_fallback)
+                        migrated_record.pop('_id', None)
+                        users.replace_one(
+                            {'$or': [
+                                {'Username': migrated_record.get('Username')},
+                                {'username': migrated_record.get('username')},
+                            ]},
+                            migrated_record,
+                            upsert=True,
+                        )
+                        logger.warning(
+                            "Tenant user %r migrated from default DB %r to tenant DB %r.",
+                            dp.encrypt_text(username),
+                            cfg.MONGODB_DB,
+                            db_name,
+                        )
+                        user_record = users.find_one(
+                            {'$or': [
+                                {'Username': migrated_record.get('Username')},
+                                {'username': migrated_record.get('username')},
+                            ]}
+                        ) or migrated_record
+                    else:
+                        logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                        return None
+                else:
+                    logger.warning("Kein Benutzer für %r in DB %r gefunden.", dp.encrypt_text(username), db_name)
+                    return None
             else:
                 user_record = user_record_fallback
 
@@ -497,6 +558,59 @@ def check_nm_pwd(username, password):
     finally:
         client.close()
 
+def add_admin(
+    username,
+    password,
+    name='',
+    last_name='',
+    is_student=False,
+    permission_preset='full_access',
+    action_permissions=None,
+    page_permissions=None,
+    tenant_id=None,
+):
+    """
+    Add a new user to the database.
+    """
+    if not check_password_strength(password):
+        return False
+
+    client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+    try:
+        db = _get_tenant_db(client, tenant_id)
+        users = db['users']
+
+        permission_defaults = build_default_permission_payload(permission_preset)
+
+        if isinstance(action_permissions, dict):
+            for key, value in action_permissions.items():
+                permission_defaults['actions'][str(key)] = bool(value)
+
+        if isinstance(page_permissions, dict):
+            for key, value in page_permissions.items():
+                permission_defaults['pages'][str(key)] = bool(value)
+
+        safe_name = name.strip() if name else ''
+        safe_last_name = last_name.strip() if last_name else ''
+
+        user_doc = {
+            'Username': username,
+            'Password': hashing(password),
+            'Admin': True,
+            'active_ausleihung': None,
+            'name': dp.encrypt_text(safe_name) if safe_name else '',
+            'last_name': dp.encrypt_text(safe_last_name) if safe_last_name else '',
+            'IsStudent': bool(is_student),
+            'PermissionPreset': permission_defaults['preset'],
+            'ActionPermissions': permission_defaults['actions'],
+            'PagePermissions': permission_defaults['pages'],
+        }
+
+        users.insert_one(user_doc)
+        return True
+    finally:
+        client.close()
+
 
 def add_user(
     username,
@@ -509,6 +623,7 @@ def add_user(
     permission_preset='standard_user',
     action_permissions=None,
     page_permissions=None,
+    tenant_id=None,
 ):
     """
     Add a new user to the database.
@@ -518,7 +633,7 @@ def add_user(
 
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
     try:
-        db = _get_tenant_db(client)
+        db = _get_tenant_db(client, tenant_id)
         users = db['users']
 
         permission_defaults = build_default_permission_payload(permission_preset)

Web/templates/student_cards_admin.html

@@ -229,7 +229,7 @@
 <div class="container">
     <div class="student-card-header">
         <div>
-            <h1>📚 Bibliotheksausweise (Bibliotek)</h1>
+            <h1>📚 Bibliotheksausweise (Bibliothek)</h1>
         </div>
         <div class="export-buttons">
             <a href="{{ url_for('student_card_barcode_download') }}" class="btn-print" style="background: #28a745;">📥 Alle Ausweise (PDF)</a>

Web/templates/tutorial.html

@@ -280,7 +280,7 @@
         <button type="button" data-target-step="0">1. Startseite</button>
         <button type="button" data-target-step="1">2. {{ 'Artikel erfassen' if is_admin else 'Artikel finden' }}</button>
         {% if library_module_enabled %}
-        <button type="button" data-target-step="2">3. Bibliotek</button>
+        <button type="button" data-target-step="2">3. Bibliothek</button>
         {% endif %}
         <button type="button" data-target-step="{{ '3' if library_module_enabled else '2' }}">4. Alltag</button>
       </div>
@@ -341,7 +341,7 @@
 
       {% if library_module_enabled %}
       <article class="workflow-step" data-step-index="2" data-step-key="library">
-        <h3>Bibliotek-Bereich</h3>
+        <h3>Bibliothek-Bereich</h3>
         <p>Dieser Bereich ist speziell für Bücher und Medienausleihe.</p>
         <ul>
           {% if is_admin %}
@@ -358,7 +358,7 @@
         </ul>
 
         <div class="tutorial-actions">
-          <a class="btn btn-outline-primary btn-sm" href="{{ url_for('library_view') }}">Zur Bibliotek</a>
+          <a class="btn btn-outline-primary btn-sm" href="{{ url_for('library_view') }}">Zur Bibliothek</a>
           {% if is_admin %}
           <a class="btn btn-outline-secondary btn-sm" href="{{ url_for('library_loans_admin') }}">Ausleihen ansehen</a>
           {% endif %}

Web/tenant.py

@@ -166,6 +166,11 @@ def _find_registered_tenant_id(candidate):
     return None
 
 
+def _resolve_registered_tenant_id(candidate):
+    """Return the canonical registered tenant id for a candidate, or None."""
+    return _find_registered_tenant_id(candidate)
+
+
 def _is_ip_host(hostname):
     hostname = str(hostname or '').strip()
     if not hostname:
@@ -185,6 +190,8 @@ def get_tenant_config(tenant_id=None):
         ctx = get_tenant_context()
         tenant_id = ctx.tenant_id if ctx and ctx.tenant_id else 'default'
 
+    tenant_id = _resolve_registered_tenant_id(tenant_id) or tenant_id
+
     if tenant_id in TENANT_REGISTRY:
         return TENANT_REGISTRY[tenant_id] or {}
         
@@ -481,20 +488,22 @@ class TenantContext:
             or request.args.get('tenantId', '').strip()
         )
         if tenant_from_query:
-            matched_tenant = _find_registered_tenant_id(tenant_from_query) or tenant_from_query
-            self.tenant_id = matched_tenant
-            self.config = get_tenant_config(matched_tenant)
-            session['tenant_id'] = matched_tenant
-            return self._get_db_name(matched_tenant)
+            matched_tenant = _resolve_registered_tenant_id(tenant_from_query)
+            if matched_tenant:
+                self.tenant_id = matched_tenant
+                self.config = get_tenant_config(matched_tenant)
+                session['tenant_id'] = matched_tenant
+                return self._get_db_name(matched_tenant)
 
         # Priority 1: X-Tenant-ID header (for testing/internal APIs)
         tenant_from_header = request.headers.get('X-Tenant-ID', '').strip()
         if tenant_from_header:
-            matched_tenant = _find_registered_tenant_id(tenant_from_header) or tenant_from_header
-            self.tenant_id = matched_tenant
-            self.config = get_tenant_config(matched_tenant)
-            session['tenant_id'] = matched_tenant
-            return self._get_db_name(matched_tenant)
+            matched_tenant = _resolve_registered_tenant_id(tenant_from_header)
+            if matched_tenant:
+                self.tenant_id = matched_tenant
+                self.config = get_tenant_config(matched_tenant)
+                session['tenant_id'] = matched_tenant
+                return self._get_db_name(matched_tenant)
 
         # Priority 2: Port/host based tenant mapping
         host_candidates = _request_host_candidates()
@@ -544,11 +553,11 @@ class TenantContext:
                 if len(parts) >= 2:
                     potential_subdomain = parts[0]
                     if potential_subdomain not in ('www', 'api', 'admin', 'app', 'mail'):
-                        matched_tenant = _find_registered_tenant_id(potential_subdomain)
+                        matched_tenant = _resolve_registered_tenant_id(potential_subdomain)
                         if not matched_tenant and potential_subdomain.startswith('school'):
-                            matched_tenant = _find_registered_tenant_id('schule' + potential_subdomain[len('school'):])
+                            matched_tenant = _resolve_registered_tenant_id('schule' + potential_subdomain[len('school'):])
                         elif not matched_tenant and potential_subdomain.startswith('schule'):
-                            matched_tenant = _find_registered_tenant_id('school' + potential_subdomain[len('schule'):])
+                            matched_tenant = _resolve_registered_tenant_id('school' + potential_subdomain[len('schule'):])
                         if matched_tenant:
                             self.subdomain = potential_subdomain
                             self.tenant_id = matched_tenant
@@ -565,12 +574,21 @@ class TenantContext:
         # Priority 4: sticky tenant from the authenticated session
         session_tenant = session.get('tenant_id', '').strip() if session.get('tenant_id') else ''
         if session_tenant:
-            self.tenant_id = session_tenant
-            self.config = get_tenant_config(session_tenant)
+            matched_tenant = _resolve_registered_tenant_id(session_tenant)
+            if matched_tenant:
+                self.tenant_id = matched_tenant
+                self.config = get_tenant_config(matched_tenant)
+                session['tenant_id'] = matched_tenant
+                logger.info(
+                    f"Tenant resolution by session: host={primary_host} tenant={matched_tenant} config={self.config}"
+                )
+                return self._get_db_name(matched_tenant)
+            session.pop('tenant_id', None)
             logger.info(
-                f"Tenant resolution by session: host={primary_host} tenant={session_tenant} config={self.config}"
+                "Discarded stale tenant session reference: host=%s tenant=%s",
+                primary_host,
+                session_tenant,
             )
-            return self._get_db_name(session_tenant)
 
         # Fallback to default tenant if no tenant identifier found.
         # If no explicit 'default' tenant config exists, use configured MongoDB DB.

manage-tenant.sh

@@ -12,6 +12,250 @@ fi
 # Resolve script directory so config paths are deterministic even when called via sudo
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CONFIG_FILE="$SCRIPT_DIR/config.json"
+NGINX_DOMAIN_BASE="${INVENTAR_TENANT_DOMAIN_BASE:-invario-software.de}"
+NGINX_PROXY_HOST="${INVENTAR_NGINX_PROXY_HOST:-172.17.0.1}"
+NGINX_SITES_AVAILABLE="${INVENTAR_NGINX_SITES_AVAILABLE:-/etc/nginx/sites-available}"
+NGINX_SITES_ENABLED="${INVENTAR_NGINX_SITES_ENABLED:-/etc/nginx/sites-enabled}"
+NGINX_SITE_PREFIX="${INVENTAR_NGINX_SITE_PREFIX:-inventarsystem}"
+CERTBOT_EMAIL="${INVENTAR_CERTBOT_EMAIL:-}"
+
+tenant_domain() {
+    printf '%s.%s' "$1" "$NGINX_DOMAIN_BASE"
+}
+
+tenant_nginx_site_path() {
+    printf '%s/%s-%s.conf' "$NGINX_SITES_AVAILABLE" "$NGINX_SITE_PREFIX" "$1"
+}
+
+tenant_nginx_enabled_path() {
+    printf '%s/%s-%s.conf' "$NGINX_SITES_ENABLED" "$NGINX_SITE_PREFIX" "$1"
+}
+
+run_host_command() {
+    if [ "$(id -u)" -eq 0 ]; then
+        "$@"
+    elif command -v sudo >/dev/null 2>&1; then
+        sudo "$@"
+    else
+        return 127
+    fi
+}
+
+reload_host_nginx() {
+    if command -v nginx >/dev/null 2>&1 || command -v sudo >/dev/null 2>&1; then
+        if ! run_host_command nginx -t; then
+            echo "Warning: nginx configuration test failed; skipping reload."
+            return 1
+        fi
+
+        if command -v systemctl >/dev/null 2>&1; then
+            if ! run_host_command systemctl reload nginx; then
+                echo "Warning: systemctl reload nginx failed."
+                return 1
+            fi
+        else
+            if ! run_host_command nginx -s reload; then
+                echo "Warning: nginx reload failed."
+                return 1
+            fi
+        fi
+    fi
+}
+
+write_tenant_nginx_config() {
+    local tenant_id="$1"
+    local port="$2"
+    local domain site_path enabled_path
+
+    domain="$(tenant_domain "$tenant_id")"
+    site_path="$(tenant_nginx_site_path "$tenant_id")"
+    enabled_path="$(tenant_nginx_enabled_path "$tenant_id")"
+
+    if [ -z "$port" ]; then
+        echo "Warning: No port configured for tenant '$tenant_id'; skipping nginx vhost creation."
+        return 0
+    fi
+
+    if ! run_host_command mkdir -p "$NGINX_SITES_AVAILABLE" "$NGINX_SITES_ENABLED"; then
+        echo "Warning: Unable to prepare nginx site directories; skipping reverse-proxy setup."
+        return 0
+    fi
+
+    local have_cert=false
+
+    if [ -f "/etc/letsencrypt/live/$domain/fullchain.pem" ] && [ -f "/etc/letsencrypt/live/$domain/privkey.pem" ]; then
+        have_cert=true
+    else
+        if [ "$(id -u)" -eq 0 ]; then
+            cat > "$site_path" <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+EOF
+        else
+            sudo tee "$site_path" >/dev/null <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+EOF
+        fi
+
+        if ! run_host_command ln -sfn "$site_path" "$enabled_path"; then
+            echo "Warning: Could not enable nginx site for tenant '$tenant_id'."
+            return 1
+        fi
+
+        if ! reload_host_nginx; then
+            echo "Warning: Initial nginx reload failed for tenant '$tenant_id'."
+        fi
+
+        if command -v certbot >/dev/null 2>&1 || command -v sudo >/dev/null 2>&1; then
+            local certbot_args=(certbot --nginx --non-interactive --agree-tos -d "$domain")
+            if [ -n "$CERTBOT_EMAIL" ]; then
+                certbot_args+=(--email "$CERTBOT_EMAIL")
+            else
+                certbot_args+=(--register-unsafely-without-email)
+            fi
+
+            if ! run_host_command "${certbot_args[@]}"; then
+                echo "Warning: certbot failed for tenant '$tenant_id'; keeping HTTP-only vhost for now."
+                return 1
+            fi
+
+            have_cert=true
+        fi
+    fi
+
+    if [ "$have_cert" != true ]; then
+        echo "Warning: No TLS certificate available for tenant '$tenant_id'; leaving HTTP-only nginx config in place."
+        return 1
+    fi
+
+    if [ "$(id -u)" -eq 0 ]; then
+        cat > "$site_path" <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+
+# Gezielte HTTP zu HTTPS Weiterleitung für $tenant_id
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    return 301 https://$domain\$request_uri;
+}
+EOF
+    else
+        sudo tee "$site_path" >/dev/null <<EOF
+# ==========================================
+#  INVENTARSYSTEM ($tenant_id)
+# ==========================================
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $domain;
+    client_max_body_size 100M;
+
+    ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
+
+    location / {
+        proxy_pass http://$NGINX_PROXY_HOST:$port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+}
+
+# Gezielte HTTP zu HTTPS Weiterleitung für $tenant_id
+server {
+    listen 80;
+    listen [::]:80;
+    server_name $domain;
+    return 301 https://$domain\$request_uri;
+}
+EOF
+    fi
+
+    if ! run_host_command ln -sfn "$site_path" "$enabled_path"; then
+        echo "Warning: Could not enable nginx site for tenant '$tenant_id'."
+        return 1
+    fi
+
+    if ! reload_host_nginx; then
+        echo "Warning: nginx reload after tenant '$tenant_id' configuration update failed."
+        return 1
+    fi
+}
+
+remove_tenant_nginx_config() {
+    local tenant_id="$1"
+    local domain site_path enabled_path
+
+    domain="$(tenant_domain "$tenant_id")"
+    site_path="$(tenant_nginx_site_path "$tenant_id")"
+    enabled_path="$(tenant_nginx_enabled_path "$tenant_id")"
+
+    if [ -f "$enabled_path" ] || [ -L "$enabled_path" ]; then
+        run_host_command rm -f "$enabled_path" || true
+    fi
+
+    if [ -f "$site_path" ]; then
+        run_host_command rm -f "$site_path" || true
+    fi
+
+    if command -v certbot >/dev/null 2>&1 || command -v sudo >/dev/null 2>&1; then
+        run_host_command certbot delete --cert-name "$domain" --non-interactive >/dev/null 2>&1 || true
+    fi
+
+    reload_host_nginx || true
+}
 
 ensure_runtime_config_json() {
     local config_path backup_path
@@ -206,67 +450,30 @@ import Web.modules.database.user as us
 tenant_id = sys.argv[1].lower()
 mode = sys.argv[2]
 sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
-db_name = f"inventar_{sanitized}"
-client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
+db_name = f"inventar_{sanitized}" if sanitized else settings.MONGODB_DB
+
+client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
 db = client[db_name]
-
-pw_bytes = "admin123".encode("utf-8")
-random_salt = os.urandom(16)
-hashed = hashlib.scrypt(pw_bytes, salt=random_salt, n=16384, r=8, p=1)
-hashed_pw_string = f"v1${random_salt.hex()}${hashed.hex()}"
-
-action_permissions = {
-    "can_borrow": True,
-    "can_insert": True,
-    "can_edit": True,
-    "can_delete": True,
-    "can_manage_users": True,
-    "can_manage_settings": True,
-    "can_view_logs": True,
+users = db["users"]
+permission_defaults = us.build_default_permission_payload("full_access")
+admin_doc = {
+    "Username": "admin",
+    "Password": us.hashing("admin123"),
+    "Admin": True,
+    "active_ausleihung": None,
+    "name": dp.encrypt_text("admin"),
+    "last_name": dp.encrypt_text("admin"),
+    "IsStudent": False,
+    "PermissionPreset": permission_defaults["preset"],
+    "ActionPermissions": permission_defaults["actions"],
+    "PagePermissions": permission_defaults["pages"],
 }
-
-page_permissions = {
-    "home": True,
-    "tutorial_page": True,
-    "my_borrowed_items": True,
-    "notifications_view": True,
-    "impressum": True,
-    "license": True,
-    "library_view": True,
-    "terminplan": True,
-    "home_admin": True,
-    "upload_admin": True,
-    "library_admin": True,
-    "admin_borrowings": True,
-    "library_loans_admin": True,
-    "admin_damaged_items": True,
-    "admin_audit_dashboard": True,
-    "logs": True,
-    "manage_filters": True,
-    "manage_locations": True,
-}
-
-if db.users.count_documents({"username": dp.encrypt_text("admin")}) == 0:
-    db.users.insert_one({
-        "Username":  dp.encrypt_text("admin"),
-        "Password": hashed_pw_string,
-        "Admin": True,
-        "active_ausleihung": None,
-        "name": dp.encrypt_text("Admin"),
-        "last_name": dp.encrypt_text("User"),
-        "IsStudent": False,
-        "PermissionPreset": "full_access",
-        "ActionPermissions": action_permissions,
-        "PagePermissions": page_permissions,
-    })
-    print("User correctly added")
-
-if db.users.count_documents({"Username": dp.encrypt_text("admin")}) == 0:
-    us.add_user("admin", "admin123", "admin", "admin", permission_preset='full_access')
-    us.make_admin("admin")
-    print("Fallback successfully applied")
+users.replace_one({"Username": "admin"}, admin_doc, upsert=True)
+print("Fallback successfully applied")
 
 if mode == "trial":
+    client = MongoClient(settings.MONGODB_HOST, settings.MONGODB_PORT)
+    db = client[db_name]
     db.settings.update_one(
         {"setting_type": "tenant_trial"},
         {"$set": {
@@ -279,6 +486,8 @@ if mode == "trial":
         upsert=True,
     )
 
+client.close()
+
 print(f"Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123")
 PY
 }
@@ -540,15 +749,18 @@ ${YELLOW}Nutzung:${RESET} $0 <befehl> [tenant_id] [optionen]
 
 ${BLUE}${BOLD}VERFÜGBARE BEFEHLE:${RESET}
   ${GREEN}add${RESET} <tenant_id> [port]
-    Legt einen neuen Tenant an, registriert den Port und initialisiert 
-    die MongoDB-Datenbank mit einem Standard-Admin (${YELLOW}admin / admin123${RESET}).
+        Legt einen neuen Tenant an, registriert den Port, richtet den nginx-Host
+        für ${YELLOW}<tenant_id>.invario-software.de${RESET} ein und initialisiert
+        die MongoDB-Datenbank mit einem Standard-Admin (${YELLOW}admin / admin123${RESET}).
 
   ${GREEN}trial${RESET} <tenant_id> [port] [tage]
     Erstellt einen temporären Test-Tenant. Standardlaufzeit: 7 Tage.
-    Läuft automatisch ab und löscht sich selbst.
+        Läuft automatisch ab, löscht sich selbst und bekommt die gleiche nginx/
+        Certbot-Anbindung wie ein normaler Tenant.
 
   ${GREEN}remove${RESET} [-y|--yes] <tenant_id>
-    Löscht einen Tenant, seine Konfiguration, Ports und die Datenbank.
+        Löscht einen Tenant, seine Konfiguration, Ports, nginx-VHost und das
+        zugehörige Let's-Encrypt-Zertifikat sowie die Datenbank.
     Nutze ${RED}-y${RESET}, um die Bestätigungsabfrage zu überspringen.
 
   ${GREEN}restart-tenant${RESET} <tenant_id>
@@ -609,11 +821,16 @@ case "$COMMAND" in
             register_tenant_port "$TENANT_ID" "$PORT_ARG"
             update_runtime_ports "$PORT_ARG"
             sync_tenant_port_map
+            if ! write_tenant_nginx_config "$TENANT_ID" "$PORT_ARG"; then
+                echo "Warning: nginx/certbot provisioning for '$TENANT_ID' could not be completed automatically."
+            fi
             if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
                 restart_app_container
             fi
         fi
 
+        
+
         echo "Adding new tenant '$TENANT_ID'..."
         echo "Initializing database for $TENANT_ID..."
         initialize_tenant_database "$TENANT_ID" "standard"
@@ -638,6 +855,9 @@ case "$COMMAND" in
             register_tenant_port "$TENANT_ID" "$PORT_ARG"
             update_runtime_ports "$PORT_ARG"
             sync_tenant_port_map
+            if ! write_tenant_nginx_config "$TENANT_ID" "$PORT_ARG"; then
+                echo "Warning: nginx/certbot provisioning for trial tenant '$TENANT_ID' could not be completed automatically."
+            fi
         fi
 
         write_trial_tenant_config "$TENANT_ID" "$PORT_ARG" "$DAYS_ARG"
@@ -650,11 +870,11 @@ case "$COMMAND" in
         initialize_tenant_database "$TENANT_ID" "trial"
         echo "Trial tenant '$TENANT_ID' successfully configured. It will expire after $DAYS_ARG day(s) and self-delete."
         ;;
-    
+
     remove)
         FORCE_REMOVE=false
         TENANT_ARG="${2:-}"
-        
+
         if [ "$TENANT_ARG" = "--yes" ] || [ "$TENANT_ARG" = "-y" ]; then
             FORCE_REMOVE=true
             TENANT_ID="${3:-}"
@@ -679,40 +899,31 @@ case "$COMMAND" in
         echo "Removing tenant '$TENANT_ID'..."
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         port_to_remove=""
-        
+
         if [ -n "$APP_CONTAINER" ]; then
-            # Zuerst die Datenbank via PyMongo hart droppen (Erzwungenes Löschen)
-            port_to_remove="$(docker exec "$APP_CONTAINER" python3 - "$TENANT_ID" <<'PY'
-import sys, re
-sys.path.insert(0, '/app')
-sys.path.insert(0, '/app/Web')
-from tenant import delete_tenant, get_tenant_config
-from Web.modules.database import settings
-from pymongo import MongoClient
+            # MongoDB-Datenbank via PyMongo direkt im Container droppen
+            docker exec -i "$APP_CONTAINER" python3 -c '
+    import sys, os
+    try:
+        import pymongo
+        tenant_id = sys.argv[1]
+        mongo_uri = os.environ.get("MONGO_URI", "mongodb://localhost:27017/")
+        client = pymongo.MongoClient(mongo_uri, serverSelectionTimeoutMS=2000)
+        db_name = f"inventar_{tenant_id}"
+        if db_name in client.list_database_names():
+            client.drop_database(db_name)
+            print(f"Dropped database: {db_name}")
+    except Exception as e:
+        print(f"Error dropping database: {e}", file=sys.stderr)
+    ' "$TENANT_ID" > /dev/null 2>&1
 
-tenant_id = sys.argv[1]
-tenant_cfg = get_tenant_config(tenant_id)
-port = tenant_cfg.get('port')
+            # Konfiguration und Port via Host-Funktion bereinigen und Port ermitteln
+            if port_to_remove="$(remove_tenant_port "$TENANT_ID" 2>/dev/null)"; then
+                :
+            else
+                port_to_remove=""
+            fi
 
-# Datenbanknamen exakt rekonstruieren
-sanitized = "".join(c for c in tenant_id if c.isalnum() or c == "_")
-db_name = f"inventar_{sanitized}"
-
-try:
-    client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-    client.drop_database(db_name)
-    print(f"MongoDB database '{db_name}' dropped successfully.", file=sys.stderr)
-except Exception as e:
-    print(f"Warning: Could not drop database '{db_name}': {e}", file=sys.stderr)
-
-if not delete_tenant(tenant_id):
-    print(f'Error: failed to delete tenant {tenant_id}', file=sys.stderr)
-    sys.exit(1)
-
-if port is not None:
-    print(port)
-PY
-            )"
             echo "Tenant '$TENANT_ID' database and config removed."
         else
             echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
@@ -726,6 +937,7 @@ PY
         if [ -n "$port_to_remove" ]; then
             remove_runtime_port "$port_to_remove"
         fi
+        remove_tenant_nginx_config "$TENANT_ID"
         sync_tenant_port_map
         if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
             restart_app_container
@@ -735,7 +947,7 @@ PY
         else
             echo "Removed tenant '$TENANT_ID'. No port mapping was present."
         fi
-        ;;
+    ;;
 
     restart-tenant)
         TENANT_ID="${2:-}"