Add missing Nginx configuration for SSL and proxy settings

Co-authored-by: Copilot <copilot@github.com>

.docker-build.env

@@ -1,4 +1,4 @@
 NUITKA_BUILD=0
 INVENTAR_HTTP_PORT=80
-INVENTAR_HTTPS_PORT=443
-INVENTAR_APP_IMAGE=ghcr.io/aiirondev/inventarsystem:latest
+INVENTAR_HTTPS_PORT=8000
+INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:latest

MULTITENANT_INTEGRATION.md

@@ -322,6 +322,32 @@ INVENTAR_WORKER_CONNECTIONS=100
 
 ---
 
+## Schul-Konfiguration pro Tenant
+
+Die Datei `config.json` unterstützt jetzt einen `tenants`-Block. Damit kann jede Schule eigene Modul-Schalter bekommen, ohne dass das ganze System global umgestellt werden muss.
+
+```json
+{
+    "tenants": {
+        "schule1": {
+            "modules": {
+                "library": { "enabled": true },
+                "student_cards": { "enabled": false }
+            }
+        },
+        "schule2": {
+            "modules": {
+                "library": { "enabled": false }
+            }
+        }
+    }
+}
+```
+
+Wenn ein Request über Subdomain oder `X-Tenant-ID` aufgelöst wird, liest die App diese Werte automatisch aus und blendet die Bibliothek bzw. andere Module nur für diesen Tenant ein oder aus.
+
+---
+
 ## Support & Debugging
 
 **Fragen?**

Web/app.py

@@ -339,6 +339,28 @@ def _enforce_user_permissions():
     return None
 
 
+@app.before_request
+def _enforce_active_session_user():
+    endpoint = request.endpoint or ''
+    if endpoint == 'static' or endpoint.startswith('static'):
+        return None
+
+    username = session.get('username')
+    if not username:
+        return None
+
+    user = us.get_user(username)
+    if user:
+        return None
+
+    session.clear()
+    if request.path.startswith('/api/') or request.is_json:
+        return jsonify({'ok': False, 'message': 'Sitzung ungültig. Bitte erneut anmelden.'}), 401
+
+    flash('Ihre Sitzung ist nicht mehr gültig. Bitte erneut anmelden.', 'error')
+    return redirect(url_for('login'))
+
+
 def _get_asset_version():
     """Return a cache-busting asset version tied to deployment state."""
     env_version = os.getenv('INVENTAR_ASSET_VERSION', '').strip()
@@ -1291,9 +1313,17 @@ def _initialize_scheduler():
                 if lock_age > 300:  # 5 minutes - indicates a stale lock from a previous container run
                     os.remove(scheduler_lock_path)
                     app.logger.info(f"Removed stale scheduler lock file (age: {lock_age:.0f}s)")
-        except Exception:
-            pass  # If we can't clean up, continue anyway
-        
+        except Exception as e:
+            app.logger.warning(f"Could not clean up scheduler lock file: {e}")
+
+        # Always try to remove lock file on startup (extra safety)
+        try:
+            if os.path.exists(scheduler_lock_path):
+                os.remove(scheduler_lock_path)
+                app.logger.info("Scheduler lock file removed on startup.")
+        except Exception as e:
+            app.logger.warning(f"Could not remove scheduler lock file on startup: {e}")
+
         try:
             # Try to create the lock file - only succeeds if it doesn't exist
             lock_fd = os.open(scheduler_lock_path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
@@ -1302,7 +1332,7 @@ def _initialize_scheduler():
         except FileExistsError:
             should_start = False
             app.logger.warning("Scheduler lock exists - another process is already running the scheduler")
-        
+
         if should_start:
             scheduler.add_job(func=create_daily_backup, trigger="interval", hours=cfg.BACKUP_INTERVAL_HOURS)
             scheduler.add_job(func=update_appointment_statuses, trigger="interval", minutes=cfg.SCHEDULER_INTERVAL_MIN)
@@ -10784,6 +10814,10 @@ def get_optimal_image_quality(img, target_size_kb=80):
 # PUSH NOTIFICATION API ENDPOINTS
 # ============================================================================
 
+@app.route('/health')
+def health_check():
+    return 'OK', 200
+
 @app.route('/api/push/subscribe', methods=['POST'])
 def subscribe_to_push():
     """

Web/flask.log

@@ -1 +0,0 @@
-[2026-04-19 20:20:39,502] ERROR in app: Error during scheduler shutdown: name '__file__' is not defined

Web/requirements.txt

@@ -13,5 +13,6 @@ redis
 reportlab
 python-barcode
 openpyxl
-cryptography
+cryptography>=42.0.0
 pywebpush
+py-vapid>=1.9.0

Web/settings.py

@@ -157,8 +157,36 @@ SSL_KEY = _get(_conf, ['ssl', 'key'], DEFAULTS['ssl']['key'])
 SCHOOL_PERIODS = _get(_conf, ['schoolPeriods'], DEFAULTS['schoolPeriods'])
 
 # Optional feature modules
-LIBRARY_MODULE_ENABLED = bool(_get(_conf, ['modules', 'library', 'enabled'], DEFAULTS['modules']['library']['enabled']))
-STUDENT_CARDS_MODULE_ENABLED = bool(_get(_conf, ['modules', 'student_cards', 'enabled'], DEFAULTS['modules']['student_cards']['enabled']))
+TENANT_CONFIGS = _get(_conf, ['tenants'], {})
+
+
+class _TenantAwareBool:
+    def __init__(self, module_name, default):
+        self.module_name = module_name
+        self.default = bool(default)
+
+    def resolve(self):
+        try:
+            from tenant import is_tenant_module_enabled
+            return bool(is_tenant_module_enabled(self.module_name, default=self.default))
+        except Exception:
+            return self.default
+
+    def __bool__(self):
+        return self.resolve()
+
+    def __int__(self):
+        return int(self.resolve())
+
+    def __str__(self):
+        return 'True' if self.resolve() else 'False'
+
+    def __repr__(self):
+        return f"_TenantAwareBool(module_name={self.module_name!r}, value={self.resolve()!r})"
+
+
+LIBRARY_MODULE_ENABLED = _TenantAwareBool('library', _get(_conf, ['modules', 'library', 'enabled'], DEFAULTS['modules']['library']['enabled']))
+STUDENT_CARDS_MODULE_ENABLED = _TenantAwareBool('student_cards', _get(_conf, ['modules', 'student_cards', 'enabled'], DEFAULTS['modules']['student_cards']['enabled']))
 STUDENT_DEFAULT_BORROW_DAYS = int(_get(_conf, ['modules', 'student_cards', 'default_borrow_days'], DEFAULTS['modules']['student_cards']['default_borrow_days']))
 STUDENT_MAX_BORROW_DAYS = int(_get(_conf, ['modules', 'student_cards', 'max_borrow_days'], DEFAULTS['modules']['student_cards']['max_borrow_days']))
 

Web/static/css/styles.css

@@ -34,6 +34,25 @@
     --ui-shadow-md: 0 10px 24px rgba(0, 0, 0, 0.5);
 }
 
+/* Safe Area Support for iPad notches, Dynamic Island, and rounded corners */
+html {
+    /* Ensure viewport-fit is respected */
+    viewport-fit: cover;
+}
+
+body {
+    /* Respect safe areas on mobile devices */
+    position: relative;
+}
+
+/* Future-proof: Support for various viewport and safe-area features */
+@supports (padding: max(0px)) {
+    body {
+        /* Ensure body padding never conflicts with safe areas */
+        padding: 0;
+    }
+}
+
 /* Make inputs visible in dark mode */
 :root[data-theme="dark"] input, 
 :root[data-theme="dark"] select, 
@@ -172,11 +191,16 @@ select:focus {
     box-shadow: none;
     -webkit-backdrop-filter: blur(10px);
     backdrop-filter: blur(10px);
+    /* Safe area insets for iPad notches and Dynamic Island */
+    padding-left: env(safe-area-inset-left, 0);
+    padding-right: env(safe-area-inset-right, 0);
 }
 
 .navbar-brand {
     font-weight: 800;
     letter-spacing: 0.02em;
+    /* Prevent navbar brand from extending into unsafe areas */
+    word-break: break-word;
 }
 
 @media (max-width: 900px) {
@@ -190,6 +214,41 @@ select:focus {
     }
 }
 
+/* Mobile and tablet safe area handling for navbar */
+@media (max-width: 992px) {
+    .navbar {
+        /* Ensure navbar spans full width but respects safe areas */
+        width: 100vw;
+        margin-left: calc(-50vw + 50%);
+        /* Safe area padding is already handled by navbar class */
+    }
+    
+    .navbar .container-fluid {
+        width: 100%;
+        box-sizing: border-box;
+        /* Ensure padding accounts for safe areas on small screens */
+        padding-left: max(env(safe-area-inset-left, 0), 12px);
+        padding-right: max(env(safe-area-inset-right, 0), 12px);
+    }
+    
+    .navbar-collapse {
+        /* Ensure collapsed navbar respects safe areas */
+        padding-left: env(safe-area-inset-left, 0);
+        padding-right: env(safe-area-inset-right, 0);
+    }
+}
+
+/* iPad-specific landscape and portrait handling */
+@media (max-height: 600px) and (orientation: landscape) {
+    .navbar {
+        padding-top: max(env(safe-area-inset-top, 0), 4px);
+    }
+    
+    .navbar .container-fluid {
+        padding-bottom: 4px;
+    }
+}
+
 /* Edit and generate buttons with theme-aware text for better visibility */
 .edit-button, .duplicate-button, .generate-qr-button {
     color: var(--ui-text) !important; /* Override any existing color */

Web/templates/base.html

@@ -169,31 +169,87 @@
             background-color: var(--module-primary-color) !important;
             position: sticky;
             top: 0;
-            padding-top: env(safe-area-inset-top, 0); /* iOS Safe Area */
+            /* iOS Safe Area insets for notches and rounded corners */
+            padding-top: env(safe-area-inset-top, 0);
+            padding-left: env(safe-area-inset-left, 0);
+            padding-right: env(safe-area-inset-right, 0);
             z-index: 1900;
         }
 
         .navbar .container-fluid {
-            gap: 10px;
-            padding-bottom: env(safe-area-inset-bottom, 0); /* Fallback */
+            gap: 8px;
+            /* Ensure container respects safe areas on all sides */
+            padding-left: max(env(safe-area-inset-left, 0), 12px);
+            padding-right: max(env(safe-area-inset-right, 0), 12px);
+            padding-bottom: env(safe-area-inset-bottom, 0);
         }
         
         .navbar-brand {
             font-weight: bold;
-            font-size: 1.4rem;
+            font-size: 1.3rem;
+            padding-right: 10px;
+            white-space: nowrap;
+            flex-shrink: 0;
         }
         
         .navbar-brand::before {
             content: attr(data-icon);
-            margin-right: 8px;
+            margin-right: 6px;
         }
 
         .navbar-nav .nav-link {
-            font-size: 1rem;
+            font-size: 0.95rem;
             font-weight: 600;
-            padding: 0.6rem 0.85rem;
-            border-radius: 8px;
+            padding: 0.5rem 0.75rem;
+            border-radius: 6px;
             transition: padding .18s ease, font-size .18s ease;
+            white-space: nowrap;
+        }
+
+        /* iPad/Tablet responsive adjustments */
+        @media (max-width: 1024px) {
+            .navbar .container-fluid {
+                gap: 6px;
+                padding-left: max(env(safe-area-inset-left, 0), 10px);
+                padding-right: max(env(safe-area-inset-right, 0), 10px);
+            }
+            
+            .navbar-brand {
+                font-size: 1.1rem;
+                padding-right: 8px;
+            }
+            
+            .navbar-brand::before {
+                margin-right: 4px;
+            }
+
+            .navbar-nav .nav-link {
+                font-size: 0.85rem;
+                padding: 0.45rem 0.6rem;
+            }
+        }
+
+        /* Small phones responsive adjustments */
+        @media (max-width: 576px) {
+            .navbar .container-fluid {
+                gap: 4px;
+                padding-left: max(env(safe-area-inset-left, 0), 8px);
+                padding-right: max(env(safe-area-inset-right, 0), 8px);
+            }
+            
+            .navbar-brand {
+                font-size: 0.95rem;
+                padding-right: 6px;
+            }
+            
+            .navbar-brand::before {
+                display: none;
+            }
+
+            .navbar-nav .nav-link {
+                font-size: 0.75rem;
+                padding: 0.4rem 0.5rem;
+            }
         }
 
         .navbar.nav-compact .navbar-brand {
@@ -250,6 +306,7 @@
             align-items: center;
             margin-right: 10px;
             width: min(420px, 42vw);
+            min-width: 0;
         }
 
         .function-search-form {
@@ -257,10 +314,13 @@
             display: flex;
             gap: 6px;
             align-items: center;
+            min-width: 0;
         }
 
         .function-search-input {
-            width: 100%;
+            flex: 1 1 auto;
+            width: auto;
+            min-width: 0;
             min-height: 38px;
             border-radius: 10px;
             border: 1px solid rgba(255, 255, 255, 0.3);
@@ -281,6 +341,7 @@
         }
 
         .function-search-btn {
+            flex: 0 0 auto;
             min-height: 38px;
             border-radius: 10px;
             border: 1px solid rgba(255, 255, 255, 0.45);
@@ -483,9 +544,48 @@
                 margin-top: 4px;
             }
 
+            .navbar-collapse {
+                width: 100%;
+            }
+
+            .navbar-collapse > .d-flex {
+                width: 100%;
+                flex-direction: column;
+                align-items: stretch;
+                gap: 8px;
+            }
+
             .function-search-wrap {
                 width: 100%;
+                max-width: 100%;
                 margin: 8px 0 10px;
+                flex: 1 1 100%;
+            }
+
+            .function-search-form {
+                width: 100%;
+                max-width: 100%;
+                flex-wrap: nowrap;
+            }
+
+            .function-search-input {
+                width: auto;
+                min-width: 0;
+                flex: 1 1 auto;
+            }
+
+            .function-search-btn {
+                flex: 0 0 auto;
+                white-space: nowrap;
+            }
+
+            .navbar-text {
+                margin-right: 0 !important;
+                width: 100%;
+            }
+
+            .user-menu-wrap {
+                align-self: flex-start;
             }
 
             .navbar-nav .nav-item {
@@ -857,12 +957,12 @@
                     {% endif %}
                     {% if 'username' in session %}
                     {% if current_permissions.pages.get('my_borrowed_items', True) %}
-                    <li class="nav-item" data-nav-fixed="true">
+                    <li class="nav-item">
                         <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Ausleihen</a>
                     </li>
                     {% endif %}
                     {% if current_permissions.pages.get('tutorial_page', True) %}
-                    <li class="nav-item" data-nav-fixed="true">
+                    <li class="nav-item">
                         <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
                     </li>
                     {% endif %}
@@ -872,9 +972,7 @@
                         <a class="nav-link nav-priority-link {% if current_path == url_for('upload_admin') %}nav-active{% endif %}" href="{{ url_for('upload_admin') }}">➕ Hochladen</a>
                     </li>
                     {% endif %}
-                    
-
-                    <li class="nav-item">
+                    <li class="nav-item" data-nav-fixed="true">
                         <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
                             <span class="theme-icon-light" style="display: none;">☀️</span>
                             <span class="theme-icon-dark" style="display: none;">🌙</span>
@@ -886,15 +984,6 @@
                             Mehr Optionen
                         </a>
                         <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invMoreDropdown">
-                            {% if 'username' in session %}
-                            {% if current_permissions.pages.get('my_borrowed_items', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('my_borrowed_items') }}">Meine Ausleihen</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('tutorial_page', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
-                            {% endif %}
-                            <li><hr class="dropdown-divider"></li>
-                            {% endif %}
                             {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
                             <li><h6 class="dropdown-header">Verwaltung</h6></li>
                             {% if current_permissions.pages.get('manage_filters', True) %}
@@ -987,12 +1076,12 @@
                     {% endif %}
                     {% if 'username' in session %}
                     {% if current_permissions.pages.get('my_borrowed_items', True) %}
-                    <li class="nav-item" data-nav-fixed="true">
+                    <li class="nav-item">
                         <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Medien</a>
                     </li>
                     {% endif %}
                     {% if current_permissions.pages.get('tutorial_page', True) %}
-                    <li class="nav-item" data-nav-fixed="true">
+                    <li class="nav-item">
                         <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
                     </li>
                     {% endif %}
@@ -1002,9 +1091,7 @@
                         <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}">📖 Hochladen</a>
                     </li>
                     {% endif %}
-                    
-
-                    <li class="nav-item">
+                    <li class="nav-item" data-nav-fixed="true">
                         <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
                             <span class="theme-icon-light" style="display: none;">☀️</span>
                             <span class="theme-icon-dark" style="display: none;">🌙</span>
@@ -1016,15 +1103,6 @@
                             Mehr Optionen
                         </a>
                         <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libMoreDropdown">
-                            {% if 'username' in session %}
-                            {% if current_permissions.pages.get('my_borrowed_items', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('my_borrowed_items') }}">Meine Medien</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('tutorial_page', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('tutorial_page') }}">Tutorial</a></li>
-                            {% endif %}
-                            <li><hr class="dropdown-divider"></li>
-                            {% endif %}
                             {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
                             <li><h6 class="dropdown-header">Bibliotheks-Verwaltung</h6></li>
                             {% if current_permissions.pages.get('library_loans_admin', True) %}
@@ -1602,8 +1680,15 @@
             const libraryNavList = document.getElementById('libraryNavList');
             const libNavOverflowAnchor = document.getElementById('lib-nav-overflow-anchor');
 
-            function initNavbarOverflow(navList, navOverflowAnchor) {
-                if (!navList || !navOverflowAnchor) return;
+            function initNavbarOverflow(navList, navOverflowAnchor, options) {
+                if (!navList) return;
+
+                const moreToggleId = options && options.moreToggleId ? options.moreToggleId : '';
+                const moreToggle = moreToggleId ? document.getElementById(moreToggleId) : null;
+                const moreControlItem = moreToggle ? moreToggle.closest('li.nav-item.dropdown') : null;
+                const moreMenu = moreControlItem ? moreControlItem.querySelector(':scope > ul.dropdown-menu') : null;
+                const moreLabelDefault = moreToggle ? moreToggle.textContent.trim() : 'Mehr Optionen';
+                const moreMenuOriginal = moreMenu ? moreMenu.innerHTML : '';
 
                 const navRoot = navList.closest('nav.navbar');
                 const navCollapse = navList.closest('.navbar-collapse');
@@ -1631,45 +1716,35 @@
                     return Array.from(navList.children).filter(function(li){
                         if (!(li instanceof HTMLElement)) return false;
                         if (!li.classList.contains('nav-item')) return false;
-                        if (li.id === navOverflowAnchor.id) return false;
+                        if (navOverflowAnchor && li.id === navOverflowAnchor.id) return false;
                         if (li.dataset.overflowControl === 'true') return false;
                         if (li.dataset.navFixed === 'true') return false;
+                        if (moreControlItem && li === moreControlItem) return false;
                         return li.style.display !== 'none';
                     });
                 }
 
                 function clearOverflowControls() {
-                    if (!navList) return;
-                    navList.querySelectorAll('[data-overflow-control="true"]').forEach(function(node){
-                        node.remove();
-                    });
+                    if (!moreMenu) return;
+                    moreMenu.innerHTML = moreMenuOriginal;
+                    if (moreControlItem) {
+                        moreControlItem.style.display = '';
+                    }
+                    if (moreToggle) {
+                        moreToggle.textContent = moreLabelDefault;
+                    }
                 }
 
                 function restoreAllNavItems() {
                     if (!navList) return;
                     navList.querySelectorAll('li.nav-item').forEach(function(li){
-                        if (li.id === navOverflowAnchor.id) return;
+                        if (navOverflowAnchor && li.id === navOverflowAnchor.id) return;
                         if (li.dataset.overflowControl === 'true') return;
                         li.style.display = '';
                     });
                     clearOverflowControls();
                 }
 
-                function createOverflowControl() {
-                    const li = document.createElement('li');
-                    li.className = 'nav-item dropdown';
-                    li.dataset.overflowControl = 'true';
-
-                    const toggleId = navOverflowAnchor.id + '-toggle';
-                    const menuId = navOverflowAnchor.id + '-menu';
-
-                    li.innerHTML =
-                        '<a class="nav-link dropdown-toggle" href="#" id="' + toggleId + '" role="button" data-bs-toggle="dropdown" aria-expanded="false" aria-controls="' + menuId + '">⋮ Weitere</a>' +
-                        '<ul class="dropdown-menu" aria-labelledby="' + toggleId + '" id="' + menuId + '"></ul>';
-
-                    return li;
-                }
-
                 function getNavCandidatePriority(item) {
                     if (!(item instanceof HTMLElement)) {
                         return -1;
@@ -1752,33 +1827,70 @@
 
                 function rebuildOverflowControl(hiddenSources) {
                     clearOverflowControls();
-                    if (!navList || !navOverflowAnchor || hiddenSources.length === 0) return;
-
-                    const control = createOverflowControl();
-                    const menu = control.querySelector('ul.dropdown-menu');
-                    const controlLink = control.querySelector(':scope > a.nav-link');
-                    if (controlLink) {
-                        controlLink.textContent = '⋮ Weitere (' + hiddenSources.length + ')';
-                    }
+                    if (!moreMenu || hiddenSources.length === 0) return;
 
+                    const overflowFragment = document.createDocumentFragment();
                     hiddenSources.forEach(function(source){
-                        appendSourceToOverflowMenu(source, menu);
+                        appendSourceToOverflowMenu(source, overflowFragment);
                     });
 
-                    const trailingDivider = menu.querySelector('li:last-child .dropdown-divider');
-                    if (trailingDivider) {
+                    const overflowWrap = document.createElement('div');
+                    overflowWrap.appendChild(overflowFragment);
+                    const trailingDivider = overflowWrap.querySelector('li:last-child .dropdown-divider');
+                    if (trailingDivider && trailingDivider.parentElement) {
                         trailingDivider.parentElement.remove();
                     }
 
-                    navList.insertBefore(control, navOverflowAnchor);
+                    const overflowEntries = Array.from(overflowWrap.childNodes);
+                    if (overflowEntries.length > 0) {
+                        const marker = document.createElement('li');
+                        marker.innerHTML = '<h6 class="dropdown-header">Ausgeblendete Navigation</h6>';
+                        const firstExistingNode = moreMenu.firstChild;
+                        moreMenu.insertBefore(marker, firstExistingNode);
+
+                        let insertAfter = marker;
+                        overflowEntries.forEach(function(node){
+                            moreMenu.insertBefore(node, insertAfter.nextSibling);
+                            insertAfter = node;
+                        });
+
+                        const divider = document.createElement('li');
+                        divider.innerHTML = '<hr class="dropdown-divider">';
+                        moreMenu.insertBefore(divider, insertAfter.nextSibling);
+
+                        if (moreToggle) {
+                            moreToggle.textContent = moreLabelDefault + ' (' + hiddenSources.length + ')';
+                        }
+                    }
+
+                    if (moreControlItem) {
+                        moreControlItem.style.display = '';
+                    }
                 }
 
                 function adaptNavbarByWidth() {
-                    if (!navList || !navOverflowAnchor) return;
+                    if (!navList) return;
+
+                    const isMobileViewport = window.matchMedia('(max-width: 991.98px)').matches;
+
+                    function isNavOverflowing(bufferPx) {
+                        const buffer = typeof bufferPx === 'number' ? bufferPx : 0;
+                        const collapseOverflow = navCollapse ? (navCollapse.scrollWidth > (navCollapse.clientWidth - buffer)) : false;
+                        const containerOverflow = navContainer ? (navContainer.scrollWidth > (navContainer.clientWidth - buffer)) : false;
+                        const listOverflow = navList.scrollWidth > (navList.clientWidth - buffer);
+                        return collapseOverflow || containerOverflow || listOverflow;
+                    }
 
                     applyCompactMode();
 
-                    if (window.innerWidth < 992) {
+                    // Desktop/tablet-large: keep complete navigation visible.
+                    if (!isMobileViewport) {
+                        restoreAllNavItems();
+                        return;
+                    }
+
+                    // Mobile menu is collapsed: avoid hiding links preemptively.
+                    if (navCollapse && !navCollapse.classList.contains('show')) {
                         restoreAllNavItems();
                         return;
                     }
@@ -1787,8 +1899,9 @@
 
                     const hiddenSources = [];
                     let candidates = collectTopLevelNavSources();
+                    const overflowBuffer = 12;
 
-                    while (navList.scrollWidth > navList.clientWidth && candidates.length > 0) {
+                    while (isNavOverflowing(overflowBuffer) && candidates.length > 0) {
                         const toHide = pickNextNavItemToHide(candidates);
                         if (!toHide) {
                             break;
@@ -1800,8 +1913,9 @@
 
                     rebuildOverflowControl(hiddenSources);
 
+                    // One final pass in case the overflow menu label/count itself changed row width.
                     candidates = collectTopLevelNavSources();
-                    while (navList.scrollWidth > navList.clientWidth && candidates.length > 0) {
+                    while (isNavOverflowing(overflowBuffer) && candidates.length > 0) {
                         const toHide = pickNextNavItemToHide(candidates);
                         if (!toHide) {
                             break;
@@ -1839,12 +1953,12 @@
 
             // Initialize overflow control for inventory navbar
             if (navList && navOverflowAnchor) {
-                initNavbarOverflow(navList, navOverflowAnchor);
+                initNavbarOverflow(navList, navOverflowAnchor, { moreToggleId: 'invMoreDropdown' });
             }
 
             // Initialize overflow control for library navbar
             if (libraryNavList && libNavOverflowAnchor) {
-                initNavbarOverflow(libraryNavList, libNavOverflowAnchor);
+                initNavbarOverflow(libraryNavList, libNavOverflowAnchor, { moreToggleId: 'libMoreDropdown' });
             }
         })();
     </script>

Web/templates/library.html

@@ -208,12 +208,23 @@
 <script>
 // View mode persistence
 const LIBRARY_VIEW_MODE_KEY = 'inventarLibraryViewMode';
+const MOBILE_LIBRARY_MAX_WIDTH = 900;
+const MOBILE_LIBRARY_MIN_ITEMS = 24;
+
+function isMobileViewport() {
+    return window.matchMedia(`(max-width: ${MOBILE_LIBRARY_MAX_WIDTH}px)`).matches;
+}
 
 function setViewMode(mode) {
     localStorage.setItem(LIBRARY_VIEW_MODE_KEY, mode);
     const container = document.getElementById('itemsContainer');
     const tableHeader = document.getElementById('tableHeader');
-    const items = container.querySelectorAll('.item-card');
+    const renderedItems = Array.from(container.querySelectorAll('.item-card'));
+    const virtualizationState = window.mobileLibraryVirtualizationState || null;
+    const detachedItems = virtualizationState && virtualizationState.active && Array.isArray(virtualizationState.items)
+        ? virtualizationState.items.filter(item => !container.contains(item))
+        : [];
+    const items = [...renderedItems, ...detachedItems.filter(item => !container.contains(item))];
     
     items.forEach(item => {
         const cardContent = item.querySelector('.item-content.card-mode');
@@ -236,6 +247,229 @@ function setViewMode(mode) {
     document.getElementById('viewModeToggle').classList.toggle('open', mode === 'table');
 }
 
+function initMobileWindowedLibraryLoading() {
+    const container = document.getElementById('itemsContainer');
+    if (!container) {
+        return;
+    }
+
+    if (!window.mobileLibraryVirtualizationState) {
+        window.mobileLibraryVirtualizationState = {
+            active: false,
+            items: [],
+            topSpacer: null,
+            bottomSpacer: null,
+            averageItemHeight: Math.max(Math.round(window.innerHeight * 0.35), 230),
+            lastStart: -1,
+            lastEnd: -1,
+            framePending: false,
+            scrollListener: null,
+            resizeListener: null,
+            initialized: false
+        };
+    }
+    const state = window.mobileLibraryVirtualizationState;
+
+    function restoreAllImages() {
+        state.items.forEach(item => {
+            const image = item.querySelector('img.item-image');
+            if (!image) {
+                return;
+            }
+
+            const originalSrc = image.dataset.mobileSrc || '';
+            if (!image.getAttribute('src') && originalSrc) {
+                image.setAttribute('src', originalSrc);
+            }
+        });
+    }
+
+    function updateImageMemory(startIndex, endIndex) {
+        const imageBuffer = 4;
+        state.items.forEach((item, index) => {
+            const image = item.querySelector('img.item-image');
+            if (!image) {
+                return;
+            }
+
+            if (!image.dataset.mobileSrc) {
+                image.dataset.mobileSrc = image.getAttribute('src') || '';
+            }
+            image.loading = 'lazy';
+            image.decoding = 'async';
+
+            const shouldKeepLoaded = index >= startIndex - imageBuffer && index < endIndex + imageBuffer;
+            if (shouldKeepLoaded) {
+                if (!image.getAttribute('src') && image.dataset.mobileSrc) {
+                    image.setAttribute('src', image.dataset.mobileSrc);
+                }
+                return;
+            }
+
+            if (image.getAttribute('src')) {
+                image.removeAttribute('src');
+            }
+        });
+    }
+
+    function renderVisibleWindow() {
+        if (!state.active || !state.topSpacer || !state.bottomSpacer) {
+            return;
+        }
+
+        const viewportHeight = window.innerHeight || 800;
+        const scrollTop = window.scrollY || window.pageYOffset || 0;
+        const renderBuffer = viewportHeight * 1.5;
+
+        let startIndex = Math.max(0, Math.floor((scrollTop - renderBuffer) / state.averageItemHeight));
+        let endIndex = Math.min(state.items.length, Math.ceil((scrollTop + viewportHeight + renderBuffer) / state.averageItemHeight));
+
+        if (endIndex - startIndex < 14) {
+            endIndex = Math.min(state.items.length, startIndex + 14);
+        }
+
+        if (startIndex === state.lastStart && endIndex === state.lastEnd) {
+            return;
+        }
+
+        state.lastStart = startIndex;
+        state.lastEnd = endIndex;
+
+        while (state.topSpacer.nextSibling && state.topSpacer.nextSibling !== state.bottomSpacer) {
+            state.topSpacer.nextSibling.remove();
+        }
+
+        const fragment = document.createDocumentFragment();
+        for (let index = startIndex; index < endIndex; index += 1) {
+            fragment.appendChild(state.items[index]);
+        }
+        container.insertBefore(fragment, state.bottomSpacer);
+
+        let measuredHeightSum = 0;
+        let measuredCount = 0;
+        for (let index = startIndex; index < endIndex; index += 1) {
+            const height = state.items[index].getBoundingClientRect().height;
+            if (height > 0) {
+                measuredHeightSum += height;
+                measuredCount += 1;
+            }
+        }
+
+        if (measuredCount > 0) {
+            const measuredAverage = measuredHeightSum / measuredCount;
+            state.averageItemHeight = Math.round((state.averageItemHeight * 3 + measuredAverage) / 4);
+        }
+
+        state.topSpacer.style.height = `${Math.max(0, startIndex * state.averageItemHeight)}px`;
+        state.bottomSpacer.style.height = `${Math.max(0, (state.items.length - endIndex) * state.averageItemHeight)}px`;
+        updateImageMemory(startIndex, endIndex);
+    }
+
+    function scheduleWindowRender() {
+        if (!state.active || state.framePending) {
+            return;
+        }
+        state.framePending = true;
+        requestAnimationFrame(() => {
+            state.framePending = false;
+            renderVisibleWindow();
+        });
+    }
+
+    function activateVirtualization() {
+        if (state.active) {
+            return;
+        }
+
+        if (!Array.isArray(state.items) || state.items.length === 0) {
+            state.items = Array.from(container.querySelectorAll('.library-item'));
+        }
+        if (state.items.length <= MOBILE_LIBRARY_MIN_ITEMS) {
+            return;
+        }
+
+        state.topSpacer = document.createElement('div');
+        state.topSpacer.className = 'mobile-window-spacer top';
+        state.bottomSpacer = document.createElement('div');
+        state.bottomSpacer.className = 'mobile-window-spacer bottom';
+
+        state.items.forEach(item => item.remove());
+        container.appendChild(state.topSpacer);
+        container.appendChild(state.bottomSpacer);
+
+        state.lastStart = -1;
+        state.lastEnd = -1;
+        state.framePending = false;
+        state.active = true;
+
+        if (!state.scrollListener) {
+            state.scrollListener = () => scheduleWindowRender();
+            window.addEventListener('scroll', state.scrollListener, { passive: true });
+        }
+
+        scheduleWindowRender();
+    }
+
+    function deactivateVirtualization() {
+        if (!state.active) {
+            if (!Array.isArray(state.items) || state.items.length === 0) {
+                state.items = Array.from(container.querySelectorAll('.library-item'));
+            }
+            return;
+        }
+
+        if (state.scrollListener) {
+            window.removeEventListener('scroll', state.scrollListener);
+            state.scrollListener = null;
+        }
+
+        if (state.topSpacer && state.topSpacer.parentNode === container) {
+            state.topSpacer.remove();
+        }
+        if (state.bottomSpacer && state.bottomSpacer.parentNode === container) {
+            state.bottomSpacer.remove();
+        }
+
+        const fragment = document.createDocumentFragment();
+        state.items.forEach(item => fragment.appendChild(item));
+        container.appendChild(fragment);
+
+        restoreAllImages();
+
+        state.topSpacer = null;
+        state.bottomSpacer = null;
+        state.lastStart = -1;
+        state.lastEnd = -1;
+        state.framePending = false;
+        state.active = false;
+
+        const currentMode = localStorage.getItem(LIBRARY_VIEW_MODE_KEY) || 'card';
+        setViewMode(currentMode);
+    }
+
+    function syncVirtualizationWithViewport() {
+        if (!Array.isArray(state.items) || state.items.length === 0) {
+            state.items = Array.from(container.querySelectorAll('.library-item'));
+        }
+
+        const shouldVirtualize = isMobileViewport() && state.items.length > MOBILE_LIBRARY_MIN_ITEMS;
+        if (shouldVirtualize) {
+            activateVirtualization();
+            scheduleWindowRender();
+        } else {
+            deactivateVirtualization();
+        }
+    }
+
+    if (!state.initialized) {
+        state.resizeListener = () => syncVirtualizationWithViewport();
+        window.addEventListener('resize', state.resizeListener, { passive: true });
+        state.initialized = true;
+    }
+
+    syncVirtualizationWithViewport();
+}
+
 // Initialize view mode
 document.addEventListener('DOMContentLoaded', function() {
     const savedMode = localStorage.getItem(LIBRARY_VIEW_MODE_KEY) || 'card';
@@ -311,6 +545,8 @@ document.addEventListener('DOMContentLoaded', function() {
             if (e.target === this) this.style.display = 'none';
         });
     });
+
+    initMobileWindowedLibraryLoading();
 });
 
 function displayLibraryItemDetail(item) {

Web/tenant.py

@@ -10,11 +10,43 @@ Each tenant can support up to 20+ users with isolated data and resource pools.
 from flask import request, g, has_request_context
 from functools import wraps
 import logging
+import settings as cfg
 
 logger = logging.getLogger(__name__)
 
 # Tenant registry: maps subdomain/tenant_id to database name
 TENANT_REGISTRY = {}
+if isinstance(getattr(cfg, 'TENANT_CONFIGS', None), dict):
+    TENANT_REGISTRY.update(cfg.TENANT_CONFIGS)
+
+
+def _get_nested_value(source, path, default=None):
+    current = source
+    for key in path:
+        if isinstance(current, dict) and key in current:
+            current = current[key]
+        else:
+            return default
+    return current
+
+
+def get_tenant_config(tenant_id=None):
+    """Return the registered config for a tenant, falling back to default."""
+    if tenant_id is None:
+        ctx = get_tenant_context()
+        tenant_id = ctx.tenant_id if ctx and ctx.tenant_id else 'default'
+
+    if tenant_id in TENANT_REGISTRY:
+        return TENANT_REGISTRY[tenant_id] or {}
+
+    return TENANT_REGISTRY.get('default', {}) or {}
+
+
+def is_tenant_module_enabled(module_name, tenant_id=None, default=False):
+    """Resolve whether a feature module is enabled for the current tenant."""
+    config = get_tenant_config(tenant_id)
+    enabled = _get_nested_value(config, ['modules', module_name, 'enabled'], default)
+    return bool(enabled)
 
 
 class TenantContext:
@@ -27,6 +59,7 @@ class TenantContext:
         self.tenant_id = None
         self.db_name = None
         self.subdomain = None
+        self.config = {}
 
     def resolve_tenant(self):
         """
@@ -40,6 +73,7 @@ class TenantContext:
         tenant_from_header = request.headers.get('X-Tenant-ID', '').strip()
         if tenant_from_header:
             self.tenant_id = tenant_from_header
+            self.config = get_tenant_config(tenant_from_header)
             return self._get_db_name(tenant_from_header)
 
         # Priority 2: Subdomain extraction
@@ -56,10 +90,12 @@ class TenantContext:
             if potential_subdomain not in ('www', 'api', 'admin', 'app', 'mail'):
                 self.subdomain = potential_subdomain
                 self.tenant_id = potential_subdomain
+                self.config = get_tenant_config(potential_subdomain)
                 return self._get_db_name(potential_subdomain)
 
         # Fallback to default tenant if no subdomain detected
         self.tenant_id = 'default'
+        self.config = get_tenant_config('default')
         return self._get_db_name('default')
 
     def _get_db_name(self, tenant_id):

backup.sh

@@ -33,11 +33,12 @@ LOG_FILE="${LOG_FILE:-$LOG_DIR/backup.log}"
 COMPRESSION_LEVEL="${COMPRESSION_LEVEL:-9}"
 KEEP_DAYS="${KEEP_DAYS:-7}"
 MIN_KEEP="${MIN_KEEP:-7}"
-DB_NAME="${DB_NAME:-Inventarsystem}"
+DB_NAME="${DB_NAME:-inventar_default}"
 MONGO_URI="${MONGO_URI:-mongodb://localhost:27017/}"
 INVOICE_KEEP_DAYS="${INVOICE_KEEP_DAYS:-3650}"
 INVOICE_ARCHIVE_DIR="${INVOICE_ARCHIVE_DIR:-$BACKUP_BASE_DIR/invoice-archive}"
 BACKUP_MODE="${BACKUP_MODE:-auto}"
+COMPOSE_FILE="${COMPOSE_FILE:-docker-compose-multitenant.yml}"
 DOCKER_AVAILABLE=0
 DOCKER_COMPOSE_CMD=()
 USE_NULL_OUTPUT=false
@@ -58,6 +59,8 @@ Options:
     --keep-days <N>                   Age-based retention in days (default: $KEEP_DAYS; 0 disables age filter)
     --min-keep <N>                    Always keep at least this many backups (default: $MIN_KEEP)
     --mode <auto|host|docker>         Backup mode (default: $BACKUP_MODE)
+    --multitenant                     Use docker-compose-multitenant.yml (default)
+    --singletenant                    Use docker-compose.yml
   -h|--help                         Show this help and exit
 EOF
 }
@@ -87,6 +90,10 @@ while [[ $# -gt 0 ]]; do
             MIN_KEEP="$2"; shift 2;;
         --mode)
             BACKUP_MODE="$2"; shift 2;;
+        --multitenant)
+            COMPOSE_FILE="docker-compose-multitenant.yml"; shift;;
+        --singletenant)
+            COMPOSE_FILE="docker-compose.yml"; shift;;
         -h|--help)
             usage; exit 0;;
         *)
@@ -102,12 +109,12 @@ log_message() {
 init_docker_compose() {
     if docker compose version >/dev/null 2>&1; then
         DOCKER_AVAILABLE=1
-        DOCKER_COMPOSE_CMD=(docker compose -f "$PROJECT_DIR/docker-compose.yml")
+        DOCKER_COMPOSE_CMD=(docker compose -f "$PROJECT_DIR/$COMPOSE_FILE")
         return 0
     fi
     if sudo docker compose version >/dev/null 2>&1; then
         DOCKER_AVAILABLE=1
-        DOCKER_COMPOSE_CMD=(sudo docker compose -f "$PROJECT_DIR/docker-compose.yml")
+        DOCKER_COMPOSE_CMD=(sudo docker compose -f "$PROJECT_DIR/$COMPOSE_FILE")
         return 0
     fi
 

config.json

@@ -1,9 +1,9 @@
 {
     "dbg": false,
     "key": "InventarsystemSecureKey2026XYZ789abcdef012",
-    "ver": "0.0.2",
+    "ver": "0.6.44",
     "host": "0.0.0.0",
-    "port": 443,
+    "port": 8000,
 
     "mongodb": {
         "host": "localhost",
@@ -50,6 +50,8 @@
         }
     },
 
+    "tenants": {},
+
     "allowed_extensions": [
         "png", "jpg", "jpeg", "gif",
         "hevc", "heif",

docker-compose-multitenant.yml

@@ -9,6 +9,20 @@
 #   docker-compose -f docker-compose-multitenant.yml up -d --scale app=10
 
 services:
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    container_name: cloudflared
+    restart: unless-stopped
+    command: tunnel run homeserver  # 'homeserver' must match your tunnel name
+    volumes:
+      - ./docker/cloudflared/config.yml:/etc/cloudflared/config.yml:ro
+      - /etc/cloudflared/credentials.json:/etc/cloudflared/credentials.json:ro
+    depends_on:
+      nginx:
+        condition: service_started
+    networks:
+      - inventar-net
+
   # Management Container for multi-tenant scripts
   tenant-manager:
     image: docker:cli
@@ -32,9 +46,9 @@ services:
         condition: service_started
     ports:
       - "${INVENTAR_HTTP_PORT:-80}:80"
-      - "${INVENTAR_HTTPS_PORT:-443}:443"
+      - "${INVENTAR_HTTPS_PORT:-8000}:8000"
     volumes:
-      - ./docker/nginx/multitenant.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./docker/nginx/multitenant.conf:/etc/nginx/conf.d/default.conf
       - ./certs:/etc/nginx/certs:ro
       - ./docker/nginx/acme:/etc/nginx/acme:ro
     networks:
@@ -69,9 +83,8 @@ services:
     image: mongo:7.0
     container_name: inventarsystem-mongodb
     restart: unless-stopped
-    command: mongod --wiredTigerCacheSizeGB 2 --journal --dbPath /data/db
-    ports:
-      - "27017:27017"
+    expose:
+      - "27017"
     volumes:
       - mongodb_data:/data/db
       - ./docker/mongo:/docker-entrypoint-initdb.d:ro
@@ -92,6 +105,8 @@ services:
       args:
         PYTHON_VERSION: "3.13"
         OPTIMIZATION_LEVEL: 2
+    working_dir: /app/Web
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
@@ -106,7 +121,6 @@ services:
       - "8000"
     volumes:
       - ./config.json:/app/config.json:ro
-      - ./Web:/app/Web:ro
       - app_uploads:/app/Web/uploads:cached
       - app_thumbnails:/app/Web/thumbnails:cached
       - app_previews:/app/Web/previews:cached
@@ -191,9 +205,6 @@ volumes:
 networks:
   inventar-net:
     driver: bridge
-    ipam:
-      config:
-        - subnet: 172.20.0.0/16
 
 # Scale guidance:
 # 1 tenant (20 users): 1 app instance + redis + mongodb = ~500MB

docker-compose.yml

@@ -1,87 +1,41 @@
+version: "3.8"
+
 services:
-  nginx:
-    image: nginx:1.27-alpine
-    container_name: inventarsystem-nginx
+  app:
+    build: .
+    container_name: inventory-app
     restart: unless-stopped
+    environment:
+      - MONGO_URL=mongodb://mongodb:27017/inventar
+      - REDIS_URL=redis://redis:6379
+      - BASE_URL=https://inventar.maximiliangruendinger.de #alle öffentliche subdomains
     depends_on:
-      app:
-        condition: service_started
-    ports:
-      - "${INVENTAR_HTTP_PORT:-80}:80"
-      - "${INVENTAR_HTTPS_PORT:-443}:443"
-    volumes:
-      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
-      - ./certs:/etc/nginx/certs:ro
+      - mongodb
+      - redis
 
   mongodb:
-    image: mongo:7.0
-    container_name: inventarsystem-mongodb
+    image: mongo:latest
+    container_name: mongodb
     restart: unless-stopped
     volumes:
-      - mongodb_data:/data/db
-    healthcheck:
-      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
+      - mongo_data:/data/db
 
   redis:
-    image: redis:7-alpine
-    container_name: inventarsystem-redis
+    image: redis:alpine
+    container_name: redis
     restart: unless-stopped
-    command: ["redis-server", "--appendonly", "yes", "--save", "60", "1000"]
-    volumes:
-      - redis_data:/data
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 3s
-      retries: 10
 
-  app:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    container_name: inventarsystem-app
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    container_name: cloudflared
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    depends_on:
-      mongodb:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    environment:
-      INVENTAR_MONGODB_HOST: mongodb
-      INVENTAR_MONGODB_PORT: "27017"
-      INVENTAR_MONGODB_DB: Inventarsystem
-      INVENTAR_REDIS_HOST: redis
-      INVENTAR_REDIS_PORT: "6379"
-      INVENTAR_REDIS_CACHE_DB: "1"
-      INVENTAR_NOTIFICATION_STATUS_CACHE_TTL: "8"
-      INVENTAR_BACKUP_FOLDER: /data/backups
-      INVENTAR_LOGS_FOLDER: /data/logs
-      INVENTAR_DELETED_ARCHIVE_FOLDER: /data/deleted-archives
-    expose:
-      - "8000"
+    # Der Tunnel-Name 'homeserver' muss zu deiner credentials.json passen
+    command: tunnel run homeserver
     volumes:
-      - ./config.json:/app/config.json:ro
-      - ./Web:/app/Web:ro
-      - app_uploads:/app/Web/uploads
-      - app_thumbnails:/app/Web/thumbnails
-      - app_previews:/app/Web/previews
-      - app_qrcodes:/app/Web/QRCodes
-      - app_backups:/data/backups
-      - app_logs:/data/logs
-      - app_deleted_archives:/data/deleted-archives
+      - ./config.yml:/etc/cloudflared/config.yml
+      - ./credentials.json:/etc/cloudflared/credentials.json
+    depends_on:
+      - app
 
 volumes:
-  mongodb_data:
-  app_uploads:
-  app_thumbnails:
-  app_previews:
-  app_qrcodes:
-  app_backups:
-  app_logs:
-  app_deleted_archives:
-  redis_data:
+  mongo_data:

docker/cloudflared/config.yml

@@ -0,0 +1,8 @@
+tunnel: homeserver
+credentials-file: /etc/cloudflared/credentials.json
+
+ingress:
+  - service: https://nginx:443
+    originRequest:
+      noTLSVerify: true
+  - service: http_status:404

docker/nginx/multitenant.conf

@@ -37,7 +37,8 @@ upstream inventar_backend {
 
 # Main HTTPS server block
 server {
-    listen 443 ssl http2;
+    listen 443 ssl;
+    http2 on;
     server_name ~^(?<tenant>[a-z0-9-]+)?\.?example\.com$;
 
     # SSL Configuration (wildcard certificate)
@@ -75,9 +76,9 @@ server {
                application/x-javascript application/xml+rss application/json;
     gzip_comp_level 5;
 
-    # Access/Error logs with tenant in filename
-    access_log /var/log/nginx/inventar_access_${tenant}.log combined buffer=32k;
-    error_log /var/log/nginx/inventar_error_${tenant}.log warn;
+    # Access/Error logs
+    access_log /var/log/nginx/inventar_access.log combined buffer=32k;
+    error_log /var/log/nginx/inventar_error.log warn;
 
     # Root location - proxy to app with tenant context
     location / {

install.sh

@@ -22,6 +22,7 @@ LEGACY_BACKUP_ARCHIVE=""
 CLEANUP_OLD_SERVICES=true
 CLEANUP_OLD_REMOVE_CRON=false
 TMP_DIR=""
+COMPOSE_FILE="docker-compose-multitenant.yml"
 
 cleanup_tmp_dir() {
     if [ -n "${TMP_DIR:-}" ] && [ -d "$TMP_DIR" ]; then
@@ -50,14 +51,13 @@ refresh_start_script_from_main() {
 pin_compose_app_image() {
     local tag="$1"
     local compose_file
-    compose_file="$PROJECT_DIR/docker-compose.yml"
 
-    if [ ! -f "$compose_file" ]; then
-        echo "Warning: $compose_file not found; cannot pin app image"
-        return 0
-    fi
+    for compose_file in "$PROJECT_DIR/docker-compose-multitenant.yml" "$PROJECT_DIR/docker-compose.yml"; do
+        if [ ! -f "$compose_file" ]; then
+            continue
+        fi
 
-    python3 - <<'PY' "$compose_file" "$tag"
+        python3 - <<'PY' "$compose_file" "$tag"
 import re
 import sys
 
@@ -151,6 +151,8 @@ if in_app_service and build_found and app_service_indent is not None:
 with open(compose_file, "w", encoding="utf-8") as f:
     f.writelines(out)
 PY
+
+    done
 }
 
 install_docker_if_missing() {
@@ -173,6 +175,8 @@ Options:
   --remove-legacy-system        Remove old host MongoDB/system after successful import
     --skip-cleanup-old            Do not run cleanup-old.sh after install
     --cleanup-old-remove-cron     Also remove matching cron entries during old-system cleanup
+    --multitenant                Use docker-compose-multitenant.yml (default)
+    --singletenant               Use docker-compose.yml
   --legacy-db-name <name>       Legacy database name (default: $LEGACY_DB_NAME)
   --legacy-mongo-uri <uri>      Legacy Mongo URI (default: $LEGACY_MONGO_URI)
   --legacy-system-dir <path>    Optional old system directory to remove after migration
@@ -199,6 +203,14 @@ parse_args() {
                 CLEANUP_OLD_REMOVE_CRON=true
                 shift
                 ;;
+            --multitenant)
+                COMPOSE_FILE="docker-compose-multitenant.yml"
+                shift
+                ;;
+            --singletenant)
+                COMPOSE_FILE="docker-compose.yml"
+                shift
+                ;;
             --legacy-db-name)
                 LEGACY_DB_NAME="$2"
                 shift 2
@@ -280,14 +292,21 @@ backup_legacy_database() {
 
 restore_legacy_backup_into_docker() {
     local i
+    local compose_path
 
     if [ "$MIGRATE_LEGACY_DB" != "true" ] || [ -z "$LEGACY_BACKUP_ARCHIVE" ]; then
         return 0
     fi
 
+    compose_path="$PROJECT_DIR/$COMPOSE_FILE"
+    if [ ! -f "$compose_path" ]; then
+        echo "Error: compose file not found: $compose_path"
+        exit 1
+    fi
+
     echo "Waiting for Docker MongoDB to become ready..."
     for i in $(seq 1 60); do
-        if sudo docker compose -f "$PROJECT_DIR/docker-compose.yml" exec -T mongodb mongosh --quiet --eval "db.adminCommand({ping:1}).ok" >/dev/null 2>&1; then
+        if sudo docker compose -f "$compose_path" exec -T mongodb mongosh --quiet --eval "db.adminCommand({ping:1}).ok" >/dev/null 2>&1; then
             break
         fi
         sleep 2
@@ -299,7 +318,7 @@ restore_legacy_backup_into_docker() {
     fi
 
     echo "Importing legacy backup into Docker MongoDB..."
-    sudo docker compose -f "$PROJECT_DIR/docker-compose.yml" exec -T mongodb mongorestore --archive --gzip --drop --nsInclude "${LEGACY_DB_NAME}.*" < "$LEGACY_BACKUP_ARCHIVE"
+    sudo docker compose -f "$compose_path" exec -T mongodb mongorestore --archive --gzip --drop --nsInclude "${LEGACY_DB_NAME}.*" < "$LEGACY_BACKUP_ARCHIVE"
     echo "Legacy DB import completed."
 }
 

manage-tenant.sh

@@ -48,11 +48,12 @@ case "$COMMAND" in
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         if [ -n "$APP_CONTAINER" ]; then
             docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient
+import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient; import hashlib
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
 db = client[f'{settings.MONGODB_DB}_{sys.argv[1]}']
-db.users.insert_one({'username': 'admin', 'password': 'hashed_password_here', 'role': 'admin'})
-print(f'Tenant {sys.argv[1]} database initialized.')
+hashed_pw = hashlib.sha512('admin123'.encode()).hexdigest()
+db.users.insert_one({'Username': 'admin', 'Password': hashed_pw, 'Role': 'admin', 'Name': 'Admin', 'Nachname': 'User'})
+print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123')
 " "$TENANT_ID"
             echo "Tenant '$TENANT_ID' successfully added. Ready to use."
         else

requirements.txt

@@ -12,5 +12,6 @@ redis
 reportlab
 python-barcode
 openpyxl
-cryptography
+cryptography>=42.0.0
 pywebpush
+py-vapid>=1.9.0

restart.sh

@@ -1,7 +1,14 @@
 #!/bin/bash
+
+# Nur die App neu bauen und starten, ohne den Tunnel oder die DB zu killen
+docker compose up -d --build app
+
+# Optional: Alles aufräumen, was nicht mehr gebraucht wird
+docker image prune -f
+
 set -euo pipefail
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
-"$SCRIPT_DIR/stop.sh"
-"$SCRIPT_DIR/start.sh"
+"$SCRIPT_DIR/stop.sh" "$@"
+"$SCRIPT_DIR/start.sh" "$@"

restore.sh

@@ -6,12 +6,13 @@ LOG_DIR="$SCRIPT_DIR/logs"
 LOG_FILE="$LOG_DIR/restore.log"
 WORK_DIR="$(mktemp -d /tmp/inventarsystem-restore-XXXXXX)"
 
-DB_NAME="${INVENTAR_MONGODB_DB:-Inventarsystem}"
+DB_NAME="${INVENTAR_MONGODB_DB:-inventar_default}"
 SOURCE_PATH=""
 BACKUP_DATE=""
 DROP_DATABASE=false
 RESTART_SERVICES=false
 STAGED_PATH=""
+COMPOSE_FILE="docker-compose-multitenant.yml"
 
 BACKUP_ROOT_LOCAL="$SCRIPT_DIR/backups"
 BACKUP_ROOT_SYSTEM="/var/backups"
@@ -56,6 +57,8 @@ Options:
                           - latest: newest from local/system backup roots
   --drop-database         Drop target DB before import (recommended for full restore)
   --restart-services      Restart stack after restore
+    --multitenant           Use docker-compose-multitenant.yml (default)
+    --singletenant          Use docker-compose.yml
   --list                  List detected backup candidates
   --help                  Show this help
 
@@ -68,12 +71,12 @@ EOF
 
 setup_compose() {
     if docker compose version >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
-        DOCKER_COMPOSE=(docker compose)
+        DOCKER_COMPOSE=(docker compose -f "$SCRIPT_DIR/$COMPOSE_FILE")
         return 0
     fi
 
     if [ -n "$SUDO" ] && $SUDO docker compose version >/dev/null 2>&1 && $SUDO docker info >/dev/null 2>&1; then
-        DOCKER_COMPOSE=($SUDO docker compose)
+        DOCKER_COMPOSE=($SUDO docker compose -f "$SCRIPT_DIR/$COMPOSE_FILE")
         return 0
     fi
 
@@ -459,6 +462,14 @@ parse_args() {
                 RESTART_SERVICES=true
                 shift
                 ;;
+            --multitenant)
+                COMPOSE_FILE="docker-compose-multitenant.yml"
+                shift
+                ;;
+            --singletenant)
+                COMPOSE_FILE="docker-compose.yml"
+                shift
+                ;;
             --list)
                 list_backups
                 exit 0

start.sh

@@ -7,6 +7,7 @@ cd "$SCRIPT_DIR"
 ENV_FILE="$SCRIPT_DIR/.docker-build.env"
 APP_IMAGE_REPO="ghcr.io/aiirondev/legendary-octo-garbanzo"
 DIST_DIR="$SCRIPT_DIR/dist"
+RUNTIME_COMPOSE_OVERRIDE_FILE="$SCRIPT_DIR/.docker-compose.runtime.override.yml"
 
 SUDO=""
 if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
@@ -14,10 +15,13 @@ if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
 fi
 
 NUITKA_BUILD_VALUE="0"
-HTTP_PORT_VALUE="80"
-HTTPS_PORT_VALUE="443"
+HTTP_PORT_VALUE="8001"
+HTTPS_PORT_VALUE="8443"
 CRON_SETUP_VALUE="${INVENTAR_SETUP_CRON:-1}"
 APP_IMAGE_VALUE="${INVENTAR_APP_IMAGE:-$APP_IMAGE_REPO:latest}"
+COMPOSE_FILE="docker-compose-multitenant.yml"
+COMPOSE_PROFILES_VALUE=""
+MIN_DOCKER_FREE_MB="${INVENTAR_MIN_DOCKER_FREE_MB:-1024}"
 
 usage() {
     cat <<EOF
@@ -26,6 +30,8 @@ Usage: $0 [options]
 Options:
   --no-cron         Do not create or update cron jobs
   --with-cron       Create/update cron jobs (default)
+  --multitenant     Use the multi-tenant architecture deployment
+    --singletenant    Use the legacy single-tenant compose deployment
   -h, --help        Show this help message
 EOF
 }
@@ -41,6 +47,14 @@ parse_args() {
                 CRON_SETUP_VALUE="1"
                 shift
                 ;;
+            --multitenant)
+                COMPOSE_FILE="docker-compose-multitenant.yml"
+                shift
+                ;;
+            --singletenant)
+                COMPOSE_FILE="docker-compose.yml"
+                shift
+                ;;
             -h|--help)
                 usage
                 exit 0
@@ -427,6 +441,16 @@ resolve_app_image() {
     fi
 }
 
+configure_cloudflared_profile() {
+    if [ -f /etc/cloudflared/credentials.json ]; then
+        COMPOSE_PROFILES_VALUE="cloudflare"
+        echo "Cloudflared tunnel: enabled (homeserver)"
+    else
+        COMPOSE_PROFILES_VALUE=""
+        echo "Cloudflared tunnel: disabled (missing /etc/cloudflared/credentials.json)"
+    fi
+}
+
 port_in_use() {
     local port="$1"
 
@@ -450,7 +474,7 @@ stack_owns_host_port() {
     local container_port="$2"
     local mapped_port
 
-    mapped_port="$(docker compose --env-file "$ENV_FILE" port nginx "$container_port" 2>/dev/null | tail -n1 || true)"
+    mapped_port="$(docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" port nginx "$container_port" 2>/dev/null | tail -n1 || true)"
     if [ -z "$mapped_port" ]; then
         return 1
     fi
@@ -493,20 +517,20 @@ configure_host_ports() {
         requested_http="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ' || true)"
     fi
     if [ -z "$requested_http" ]; then
-        requested_http="80"
+        requested_http="8001"
     fi
 
     if stack_owns_host_port "$requested_http" "80"; then
         HTTP_PORT_VALUE="$requested_http"
     elif port_in_use "$requested_http"; then
-        stop_host_nginx_services || true
+        
 
         if ! port_in_use "$requested_http"; then
             HTTP_PORT_VALUE="$requested_http"
             echo "Freed HTTP port $requested_http by stopping host nginx service"
         else
             HTTP_PORT_VALUE="$(find_free_port 8080)"
-            echo "HTTP port 80 is in use. Using fallback HTTP port: $HTTP_PORT_VALUE"
+            echo "HTTP port is in use. Using fallback HTTP port: $HTTP_PORT_VALUE"
         fi
     else
         HTTP_PORT_VALUE="$requested_http"
@@ -518,13 +542,13 @@ configure_host_ports() {
     fi
 
     if [ -z "$requested_https" ]; then
-        requested_https="443"
+        requested_https="8443"
     fi
 
     if stack_owns_host_port "$requested_https" "443"; then
         HTTPS_PORT_VALUE="$requested_https"
     elif port_in_use "$requested_https"; then
-        stop_host_nginx_services || true
+        
 
         if ! port_in_use "$requested_https"; then
             HTTPS_PORT_VALUE="$requested_https"
@@ -533,12 +557,43 @@ configure_host_ports() {
         fi
 
         HTTPS_PORT_VALUE="$(find_free_port 8443)"
-        echo "HTTPS port 443 is in use. Using fallback HTTPS port: $HTTPS_PORT_VALUE"
+        echo "HTTPS port is in use. Using fallback HTTPS port: $HTTPS_PORT_VALUE"
     else
         HTTPS_PORT_VALUE="$requested_https"
     fi
 }
 
+ensure_min_docker_disk_space() {
+    local docker_root available_kb available_mb
+
+    if ! command -v df >/dev/null 2>&1; then
+        return 0
+    fi
+
+    docker_root="$(docker info --format '{{.DockerRootDir}}' 2>/dev/null || true)"
+    if [ -z "$docker_root" ]; then
+        docker_root="/var/lib/docker"
+    fi
+
+    if [ ! -d "$docker_root" ]; then
+        return 0
+    fi
+
+    available_kb="$(df -Pk "$docker_root" 2>/dev/null | awk 'NR==2 {print $4}' || true)"
+    if [ -z "$available_kb" ]; then
+        return 0
+    fi
+
+    available_mb=$((available_kb / 1024))
+
+    if [ "$available_mb" -lt "$MIN_DOCKER_FREE_MB" ]; then
+        echo "Error: low disk space in Docker data root ($docker_root)."
+        echo "Available: ${available_mb} MB; required minimum: ${MIN_DOCKER_FREE_MB} MB"
+        echo "MongoDB may fail with 'No space left on device'. Free space and retry."
+        exit 1
+    fi
+}
+
 write_env_file() {
     cat > "$ENV_FILE" <<EOF
 NUITKA_BUILD=$NUITKA_BUILD_VALUE
@@ -548,9 +603,24 @@ INVENTAR_APP_IMAGE=$APP_IMAGE_VALUE
 EOF
 }
 
+write_runtime_compose_override() {
+    cat > "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+services:
+  app:
+    working_dir: /app/Web
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
+    image: ${APP_IMAGE_VALUE}
+    build: null
+EOF
+}
+
 verify_stack_health() {
     local compose_args running_services retry_count=0
-    compose_args=(--env-file "$ENV_FILE")
+    compose_args=(-f "$COMPOSE_FILE")
+    if [ -f "$RUNTIME_COMPOSE_OVERRIDE_FILE" ]; then
+        compose_args+=(-f "$RUNTIME_COMPOSE_OVERRIDE_FILE")
+    fi
+    compose_args+=(--env-file "$ENV_FILE")
 
     # Try health check with optional restart on first failure
     while [[ $retry_count -lt 2 ]]; do
@@ -561,7 +631,7 @@ verify_stack_health() {
                printf '%s\n' "$running_services" | grep -Fxq nginx && \
                printf '%s\n' "$running_services" | grep -Fxq mongodb; then
                 if docker compose "${compose_args[@]}" exec -T app python3 -c "import flask, pymongo" >/dev/null 2>&1; then
-                    if curl -kfsS "https://127.0.0.1:$HTTPS_PORT_VALUE" >/dev/null 2>&1; then
+                    if curl -kfsSL "https://127.0.0.1:$HTTPS_PORT_VALUE/health" >/dev/null 2>&1; then
                         echo "Health check passed."
                         return 0
                     fi
@@ -600,12 +670,27 @@ ensure_runtime_config_json
 setup_scheduled_jobs
 configure_nuitka_mode
 resolve_app_image
+configure_cloudflared_profile
 configure_host_ports
+ensure_min_docker_disk_space
 ensure_app_image_loaded
 write_env_file
+write_runtime_compose_override
 
 echo "Starting Inventarsystem Docker stack (app + mongodb)..."
-docker compose --env-file "$ENV_FILE" up -d --remove-orphans
+compose_up_args=(-f "$COMPOSE_FILE")
+if [ -f "$RUNTIME_COMPOSE_OVERRIDE_FILE" ]; then
+    compose_up_args+=(-f "$RUNTIME_COMPOSE_OVERRIDE_FILE")
+fi
+compose_up_args+=(--env-file "$ENV_FILE")
+if [ -n "$COMPOSE_PROFILES_VALUE" ]; then
+    export COMPOSE_PROFILES="$COMPOSE_PROFILES_VALUE"
+fi
+if ! docker compose "${compose_up_args[@]}" up -d --remove-orphans; then
+    echo "Docker Compose startup failed once. Waiting briefly and retrying..."
+    sleep 5
+    docker compose "${compose_up_args[@]}" up -d --remove-orphans
+fi
 
 verify_stack_health
 

stop.sh

@@ -4,12 +4,30 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT_DIR"
 
+COMPOSE_FILE="docker-compose-multitenant.yml"
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --multitenant)
+            COMPOSE_FILE="docker-compose-multitenant.yml"
+            shift
+            ;;
+        --singletenant)
+            COMPOSE_FILE="docker-compose.yml"
+            shift
+            ;;
+        *)
+            shift
+            ;;
+    esac
+done
+
 if ! command -v docker >/dev/null 2>&1; then
     echo "Error: docker command not found. Install Docker first."
     exit 1
 fi
 
 echo "Stopping Inventarsystem Docker stack..."
-docker compose down
+docker compose -f "$COMPOSE_FILE" down
 
 echo "Stack stopped."

update.sh

@@ -15,6 +15,9 @@ APP_IMAGE_ASSET_PREFIX="inventarsystem-image-"
 ENV_FILE="$PROJECT_DIR/.docker-build.env"
 APP_IMAGE_REPO="ghcr.io/aiirondev/legendary-octo-garbanzo"
 DIST_DIR="$PROJECT_DIR/dist"
+COMPOSE_FILE="docker-compose-multitenant.yml"
+MIN_ROOT_FREE_MB="${INVENTAR_MIN_ROOT_FREE_MB:-2048}"
+DIST_KEEP_COUNT="${INVENTAR_DIST_KEEP_COUNT:-2}"
 
 mkdir -p "$LOG_DIR"
 chmod 777 "$LOG_DIR" 2>/dev/null || true
@@ -148,6 +151,100 @@ EOF
     fi
 }
 
+ensure_min_root_disk_space() {
+    local available_kb available_mb
+
+    if ! command -v df >/dev/null 2>&1; then
+        return 0
+    fi
+
+    available_kb="$(df -Pk "$PROJECT_DIR" 2>/dev/null | awk 'NR==2 {print $4}' || true)"
+    if [ -z "$available_kb" ]; then
+        return 0
+    fi
+
+    available_mb=$((available_kb / 1024))
+    if [ "$available_mb" -lt "$MIN_ROOT_FREE_MB" ]; then
+        log_message "ERROR: Low disk space on filesystem containing $PROJECT_DIR"
+        log_message "Available: ${available_mb} MB; required minimum: ${MIN_ROOT_FREE_MB} MB"
+        log_message "Free disk space and rerun update."
+        exit 1
+    fi
+}
+
+cleanup_old_dist_artifacts() {
+    local keep_count
+    keep_count="$DIST_KEEP_COUNT"
+
+    if [ ! -d "$DIST_DIR" ]; then
+        return 0
+    fi
+
+    if ! [[ "$keep_count" =~ ^[0-9]+$ ]]; then
+        keep_count=2
+    fi
+
+    mapfile -t archives < <(find "$DIST_DIR" -maxdepth 1 -type f \( -name 'inventarsystem-image-*.tar.gz' -o -name 'inventarsystem-image-*.tar' \) -printf '%T@ %p\n' | sort -nr | awk '{print $2}')
+    if [ "${#archives[@]}" -le "$keep_count" ]; then
+        return 0
+    fi
+
+    local index old_archive deleted=0
+    for (( index=keep_count; index<${#archives[@]}; index++ )); do
+        old_archive="${archives[$index]}"
+        if rm -f "$old_archive"; then
+            deleted=$((deleted + 1))
+        fi
+    done
+
+    if [ "$deleted" -gt 0 ]; then
+        log_message "Cleaned up $deleted old dist image archive(s)"
+    fi
+}
+
+cleanup_docker_dangling_images() {
+    if docker image prune -f >> "$LOG_FILE" 2>&1; then
+        log_message "Cleaned up dangling Docker images"
+    else
+        log_message "WARNING: Could not prune dangling Docker images"
+    fi
+}
+
+usage() {
+    cat <<EOF
+Usage: $0 [options]
+
+Options:
+  --multitenant      Use docker-compose-multitenant.yml (default)
+  --singletenant     Use docker-compose.yml
+  -h, --help         Show this help message
+EOF
+}
+
+parse_args() {
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --multitenant)
+                COMPOSE_FILE="docker-compose-multitenant.yml"
+                shift
+                ;;
+            --singletenant)
+                COMPOSE_FILE="docker-compose.yml"
+                shift
+                ;;
+            -h|--help)
+                usage
+                exit 0
+                ;;
+            *)
+                log_message "ERROR: Unknown option: $1"
+                usage
+                exit 2
+                ;;
+        esac
+    done
+}
+
 archive_logs() {
     log_message "Checking for monthly log archival..."
     if [ -x "$PROJECT_DIR/archive-logs.sh" ]; then
@@ -360,6 +457,13 @@ deploy() {
     local tag="$1"
     local meta_file="$2"
     local app_image="${APP_IMAGE_REPO}:${tag}"
+    local compose_path
+
+    compose_path="$PROJECT_DIR/$COMPOSE_FILE"
+    if [ ! -f "$compose_path" ]; then
+        log_message "ERROR: compose file not found: $compose_path"
+        exit 1
+    fi
 
     cd "$PROJECT_DIR"
     if [ ! -f "$ENV_FILE" ]; then
@@ -385,15 +489,15 @@ EOF
         fi
     fi
 
-    docker compose --env-file "$ENV_FILE" pull nginx mongodb >> "$LOG_FILE" 2>&1
-    docker compose --env-file "$ENV_FILE" up -d --remove-orphans >> "$LOG_FILE" 2>&1
+    docker compose -f "$compose_path" --env-file "$ENV_FILE" pull nginx mongodb >> "$LOG_FILE" 2>&1
+    docker compose -f "$compose_path" --env-file "$ENV_FILE" up -d --remove-orphans >> "$LOG_FILE" 2>&1
     docker tag "$app_image" "$APP_IMAGE_REPO:latest" >> "$LOG_FILE" 2>&1 || true
 }
 
 verify_stack_health() {
     local compose_args running_services
     local https_port
-    compose_args=(--env-file "$ENV_FILE")
+    compose_args=(-f "$PROJECT_DIR/$COMPOSE_FILE" --env-file "$ENV_FILE")
     https_port="$(awk -F= '/^INVENTAR_HTTPS_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ')"
     if [ -z "$https_port" ]; then
         https_port="443"
@@ -404,8 +508,8 @@ verify_stack_health() {
         if printf '%s\n' "$running_services" | grep -Fxq app && \
            printf '%s\n' "$running_services" | grep -Fxq nginx && \
            printf '%s\n' "$running_services" | grep -Fxq mongodb; then
-            # Primary check: HTTP endpoint responds (most reliable)
-            if curl -kfsS "https://127.0.0.1:$https_port" >/dev/null 2>&1; then
+            # Primary check: health endpoint responds (most reliable)
+            if curl -kfsSL "https://127.0.0.1:$https_port/health" >/dev/null 2>&1; then
                 return 0
             fi
         fi
@@ -417,7 +521,29 @@ verify_stack_health() {
     return 1
 }
 
+cleanup_server_space() {
+    log_message "Running server cleanup before update..."
+    # Remove unused Docker objects
+    if docker system prune -af --volumes >> "$LOG_FILE" 2>&1; then
+        log_message "Docker system pruned (all unused images, containers, volumes, networks)"
+    else
+        log_message "WARNING: Docker system prune failed"
+    fi
+    # Clean up old dist artifacts
+    cleanup_old_dist_artifacts
+    # Clean up log files older than 7 days
+    if find "$LOG_DIR" -type f -name '*.log' -mtime +7 -exec rm -f {} +; then
+        log_message "Old log files (older than 7 days) cleaned up"
+    else
+        log_message "WARNING: Failed to clean up old log files"
+    fi
+}
+
 main() {
+    parse_args "$@"
+
+    cleanup_server_space
+
     ensure_runtime_dependencies
     ensure_tls_certificates
     ensure_nginx_config_mount_source
@@ -427,6 +553,7 @@ main() {
     require_cmd docker
     require_cmd python3
 
+    ensure_min_root_disk_space
     archive_logs
     create_backup
 
@@ -514,6 +641,8 @@ main() {
     fi
 
     echo "$latest_tag" > "$STATE_FILE"
+    cleanup_old_dist_artifacts
+    cleanup_docker_dangling_images
     log_message "Update completed successfully to release $latest_tag"
 }