fix(ui): adjust navbar styles for improved layout and visibility

Co-authored-by: Copilot <copilot@github.com>

.docker-build.env

@@ -1,4 +1,12 @@
 NUITKA_BUILD=0
-INVENTAR_HTTP_PORT=80
-INVENTAR_HTTPS_PORT=8000
+INVENTAR_HTTP_PORT=10000
+INVENTAR_HTTP_PORTS=10000
 INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:latest
+INVENTAR_APP_CPUS=1.0
+INVENTAR_APP_MEM_LIMIT=384m
+INVENTAR_APP_MEM_SWAP_LIMIT=768m
+INVENTAR_WORKERS=4
+INVENTAR_THREADS=2
+INVENTAR_WORKER_TIMEOUT=30
+INVENTAR_WORKER_CONNECTIONS=100
+

.docker-compose.runtime.override.yml

@@ -0,0 +1,8 @@
+services:
+  app:
+    working_dir: /app/Web
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "4", "--threads", "2", "--timeout", "30", "--graceful-timeout", "20", "--worker-connections", "100", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
+    image: ghcr.io/aiirondev/legendary-octo-garbanzo:latest
+    build: null
+    ports:
+      - "10000:8000"

.github/workflows/release-docker.yml

@@ -158,42 +158,17 @@ jobs:
       - name: Create release-only docker bundle
         run: |
           mkdir -p release-bundle
-          mkdir -p release-bundle/docker/nginx
           cat > release-bundle/docker-compose.yml <<EOF
           services:
-            nginx:
-              image: nginx:1.27-alpine
-              container_name: inventarsystem-nginx
-              restart: unless-stopped
-              depends_on:
-                - app
-              ports:
-                - "${INVENTAR_HTTP_PORT:-80}:80"
-                - "${INVENTAR_HTTPS_PORT:-443}:443"
-              volumes:
-                - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
-                - ./certs:/etc/nginx/certs:ro
-
-            mongodb:
-              image: mongo:7.0
-              container_name: inventarsystem-mongodb
-              restart: unless-stopped
-              volumes:
-                - mongodb_data:/data/db
-              healthcheck:
-                test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
-                interval: 10s
-                timeout: 5s
-                retries: 10
-
             app:
-              image: ${INVENTAR_APP_IMAGE:-ghcr.io/aiirondev/legendary-octo-garbanzo:latest}
-              pull_policy: never
+              image: ${INVENTAR_APP_IMAGE:-ghcr.io/aiirondev/legendary-octo-garbanzo:${{ steps.meta.outputs.tag }}}
               container_name: inventarsystem-app
               restart: unless-stopped
+              ports:
+                - "${INVENTAR_HTTP_PORT:-10000}:8000"
               depends_on:
-                mongodb:
-                  condition: service_healthy
+                - mongodb
+                - redis
               environment:
                 INVENTAR_MONGODB_HOST: mongodb
                 INVENTAR_MONGODB_PORT: "27017"
@@ -211,6 +186,33 @@ jobs:
                 - app_backups:/data/backups
                 - app_logs:/data/logs
 
+            mongodb:
+              image: mongo:7.0
+              container_name: inventarsystem-mongodb
+              restart: unless-stopped
+              volumes:
+                - mongodb_data:/data/db
+              healthcheck:
+                test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
+                interval: 10s
+                timeout: 5s
+                retries: 10
+
+            redis:
+              image: redis:7-alpine
+              container_name: inventarsystem-redis
+              restart: unless-stopped
+              command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
+              ports:
+                - "6379:6379"
+              volumes:
+                - redis_data:/data
+              healthcheck:
+                test: ["CMD", "redis-cli", "ping"]
+                interval: 10s
+                timeout: 5s
+                retries: 5
+
           volumes:
             mongodb_data:
             app_uploads:
@@ -219,26 +221,24 @@ jobs:
             app_qrcodes:
             app_backups:
             app_logs:
+            redis_data:
           EOF
 
-          cp docker/nginx/default.conf release-bundle/docker/nginx/default.conf
           cp start.sh release-bundle/start.sh
           cp stop.sh release-bundle/stop.sh
           cp restart.sh release-bundle/restart.sh
           cp backup.sh release-bundle/backup.sh
           cp config.json release-bundle/config.json
           cp update.sh release-bundle/update.sh
-          cp init-admin.sh release-bundle/init-admin.sh
-          
+
           # Multitenant scripts & docs
           cp docker-compose-multitenant.yml release-bundle/docker-compose-multitenant.yml
-          cp docker/nginx/multitenant.conf release-bundle/docker/nginx/multitenant.conf
           cp manage-tenant.sh release-bundle/manage-tenant.sh
           cp run-tenant-cmd.sh release-bundle/run-tenant-cmd.sh
           cp MULTITENANT_DEPLOYMENT.md release-bundle/MULTITENANT_DEPLOYMENT.md
           cp MULTITENANT_PYTHON_API.md release-bundle/MULTITENANT_PYTHON_API.md
 
-          chmod +x release-bundle/start.sh release-bundle/stop.sh release-bundle/restart.sh release-bundle/backup.sh release-bundle/update.sh release-bundle/init-admin.sh release-bundle/manage-tenant.sh release-bundle/run-tenant-cmd.sh
+          chmod +x release-bundle/start.sh release-bundle/stop.sh release-bundle/restart.sh release-bundle/backup.sh release-bundle/update.sh release-bundle/manage-tenant.sh release-bundle/run-tenant-cmd.sh
           tar -czf inventarsystem-docker-bundle.tar.gz -C release-bundle .
 
       - name: Create or update GitHub Release

Backup-DB.py

@@ -1,134 +0,0 @@
-'''
-   Copyright 2025-2026 AIIrondev
-
-   Licensed under the Inventarsystem EULA (Endbenutzer-Lizenzvertrag).
-   See Legal/LICENSE for the full license text.
-   Unauthorized commercial use, SaaS hosting, or removal of branding is prohibited.
-   For commercial licensing inquiries: https://github.com/AIIrondev
-'''
-"""
-Backup-DB.py
-
-Usage:
-    python Backup-DB.py \
-        --uri mongodb://user:pass@host:port/ \
-        --db my_database \
-        --out /path/to/backup_folder
-"""
-import os
-import csv
-import sys
-import argparse
-from datetime import datetime
-from pymongo import MongoClient
-
-
-def parse_args():
-    parser = argparse.ArgumentParser(
-        description="Backup a MongoDB database to CSV files (one per collection)."
-    )
-    parser.add_argument(
-        "--uri", "-u",
-        required=True,
-        help="MongoDB URI, e.g. mongodb://user:pass@host:port/"
-    )
-    parser.add_argument(
-        "--db", "-d",
-        required=True,
-        help="Name of the database to back up"
-    )
-    parser.add_argument(
-        "--out", "-o",
-        default=f"mongo_backup_{datetime.now().strftime('%Y%m%d_%H%M%S')}",
-        help="Output directory (will be created if it doesn't exist)"
-    )
-    return parser.parse_args()
-
-
-def flatten_dict(d, parent_key="", sep="."):
-    """
-    Flatten nested dicts into a single level, concatenating keys with sep.
-    Lists are left as-is (converted to string later).
-    """
-    items = {}
-    for k, v in d.items():
-        new_key = f"{parent_key}{sep}{k}" if parent_key else k
-        if isinstance(v, dict):
-            items.update(flatten_dict(v, new_key, sep=sep))
-        else:
-            items[new_key] = v
-    return items
-
-
-def export_collection(db, coll_name, out_dir):
-    coll = db[coll_name]
-    cursor = coll.find()
-    docs = list(cursor)
-    if not docs:
-        print(f"[{coll_name}] No documents found, skipping.")
-        return
-
-    # Flatten and collect all keys
-    all_keys = set()
-    flat_docs = []
-    for doc in docs:
-        # Convert ObjectId and other non-serializable types
-        doc = {k: str(v) for k, v in doc.items()}
-        flat = flatten_dict(doc)
-        flat_docs.append(flat)
-        all_keys.update(flat.keys())
-
-    out_file = os.path.join(out_dir, f"{coll_name}.csv")
-    with open(out_file, "w", newline="", encoding="utf-8") as csvfile:
-        writer = csv.DictWriter(csvfile, fieldnames=sorted(all_keys))
-        writer.writeheader()
-        for flat in flat_docs:
-            writer.writerow(flat)
-
-    print(f"[{coll_name}] Exported {len(flat_docs)} docs → {out_file}")
-
-
-def main():
-    args = parse_args()
-
-    # Create output directory
-    try:
-        os.makedirs(args.out, exist_ok=True)
-        print(f"Backing up database '{args.db}' → '{args.out}'")
-    except PermissionError:
-        print(f"Error: Permission denied when creating directory {args.out}")
-        print("Try running with sudo or to a different output directory")
-        return 1
-
-    # Verify write permissions
-    test_file = os.path.join(args.out, ".write_test")
-    try:
-        with open(test_file, 'w') as f:
-            f.write("test")
-        os.remove(test_file)
-    except (IOError, PermissionError) as e:
-        print(f"Error: Cannot write to output directory {args.out}")
-        print(f"Reason: {str(e)}")
-        print("Try running with sudo or to a different output directory")
-        return 1
-
-    try:
-        # Connect to MongoDB
-        client = MongoClient(args.uri)
-        # Test connection
-        client.server_info()
-        db = client[args.db]
-
-        # Export each collection
-        for coll_name in db.list_collection_names():
-            export_collection(db, coll_name, args.out)
-
-        print("Backup complete.")
-        return 0
-    except Exception as e:
-        print(f"Error: {str(e)}")
-        return 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

Backup-Invoices.py

@@ -1,177 +0,0 @@
-#!/usr/bin/env python3
-"""
-Backup-Invoices.py
-
-Exports all invoice records stored in ausleihungen.InvoiceData to dedicated
-archive files (JSONL + CSV + metadata).
-
-Usage:
-    python Backup-Invoices.py \
-        --uri mongodb://localhost:27017/ \
-        --db Inventarsystem \
-        --out /var/backups/invoice-archive/invoices-2026-04-06_12-00-00
-"""
-
-import argparse
-import csv
-import json
-import os
-import sys
-from datetime import datetime
-
-from bson import ObjectId
-from pymongo import MongoClient
-
-
-def parse_args():
-    parser = argparse.ArgumentParser(
-        description="Export invoice records from ausleihungen to JSONL and CSV."
-    )
-    parser.add_argument("--uri", "-u", required=True, help="MongoDB URI")
-    parser.add_argument("--db", "-d", required=True, help="MongoDB database name")
-    parser.add_argument(
-        "--out",
-        "-o",
-        required=True,
-        help=(
-            "Output file base path without extension, e.g. "
-            "/var/backups/invoice-archive/invoices-2026-04-06_12-00-00"
-        ),
-    )
-    return parser.parse_args()
-
-
-def to_jsonable(value):
-    if isinstance(value, ObjectId):
-        return str(value)
-    if isinstance(value, datetime):
-        return value.isoformat()
-    if isinstance(value, dict):
-        return {k: to_jsonable(v) for k, v in value.items()}
-    if isinstance(value, list):
-        return [to_jsonable(v) for v in value]
-    return value
-
-
-def flatten_dict(data, parent_key="", sep="."):
-    items = {}
-    for key, value in data.items():
-        new_key = f"{parent_key}{sep}{key}" if parent_key else str(key)
-        if isinstance(value, dict):
-            items.update(flatten_dict(value, new_key, sep=sep))
-        elif isinstance(value, list):
-            items[new_key] = json.dumps(value, ensure_ascii=False)
-        else:
-            items[new_key] = value
-    return items
-
-
-def normalize_invoice_record(doc):
-    invoice_data = doc.get("InvoiceData") or {}
-    record = {
-        "borrow_id": str(doc.get("_id", "")),
-        "borrow_status": doc.get("Status", ""),
-        "borrow_user": doc.get("User", ""),
-        "borrow_item": doc.get("Item", ""),
-        "borrow_start": doc.get("Start"),
-        "borrow_end": doc.get("End"),
-        "invoice_number": invoice_data.get("invoice_number", ""),
-        "invoice_amount": invoice_data.get("amount"),
-        "invoice_amount_text": invoice_data.get("amount_text", ""),
-        "invoice_damage_reason": invoice_data.get("damage_reason", ""),
-        "invoice_created_at": invoice_data.get("created_at"),
-        "invoice_created_by": invoice_data.get("created_by", ""),
-        "invoice_borrower": invoice_data.get("borrower", ""),
-        "invoice_item_id": invoice_data.get("item_id", ""),
-        "invoice_item_name": invoice_data.get("item_name", ""),
-        "invoice_item_code": invoice_data.get("item_code", ""),
-        "invoice_mark_destroyed": invoice_data.get("mark_destroyed", False),
-        "invoice_status_before": invoice_data.get("status_before_invoice", ""),
-        "invoice_raw": invoice_data,
-    }
-    return to_jsonable(record)
-
-
-def write_jsonl(path, records):
-    with open(path, "w", encoding="utf-8") as handle:
-        for row in records:
-            handle.write(json.dumps(row, ensure_ascii=False) + "\n")
-
-
-def write_csv(path, records):
-    if not records:
-        with open(path, "w", encoding="utf-8", newline="") as handle:
-            writer = csv.writer(handle)
-            writer.writerow(["info"])
-            writer.writerow(["no invoice records found"])
-        return
-
-    flat_records = [flatten_dict(row) for row in records]
-    fieldnames = sorted({key for row in flat_records for key in row.keys()})
-
-    with open(path, "w", encoding="utf-8", newline="") as handle:
-        writer = csv.DictWriter(handle, fieldnames=fieldnames)
-        writer.writeheader()
-        for row in flat_records:
-            writer.writerow(row)
-
-
-def write_metadata(path, db_name, out_base, count):
-    payload = {
-        "db": db_name,
-        "exported_at": datetime.utcnow().isoformat() + "Z",
-        "record_count": count,
-        "files": {
-            "jsonl": out_base + ".jsonl",
-            "csv": out_base + ".csv",
-        },
-        "schema_note": "Source is ausleihungen.InvoiceData",
-    }
-    with open(path, "w", encoding="utf-8") as handle:
-        json.dump(payload, handle, ensure_ascii=False, indent=2)
-
-
-def main():
-    args = parse_args()
-    out_base = args.out
-    out_dir = os.path.dirname(out_base) or "."
-
-    try:
-        os.makedirs(out_dir, exist_ok=True)
-    except Exception as exc:
-        print(f"Error: cannot create output directory {out_dir}: {exc}")
-        return 1
-
-    client = None
-    try:
-        client = MongoClient(args.uri)
-        client.server_info()
-        db = client[args.db]
-        ausleihungen = db["ausleihungen"]
-
-        cursor = ausleihungen.find({"InvoiceData": {"$exists": True, "$ne": None}})
-        records = [normalize_invoice_record(doc) for doc in cursor]
-
-        jsonl_path = out_base + ".jsonl"
-        csv_path = out_base + ".csv"
-        meta_path = out_base + ".meta.json"
-
-        write_jsonl(jsonl_path, records)
-        write_csv(csv_path, records)
-        write_metadata(meta_path, args.db, out_base, len(records))
-
-        print(f"Invoice backup complete: {len(records)} records")
-        print(f"JSONL: {jsonl_path}")
-        print(f"CSV:   {csv_path}")
-        print(f"META:  {meta_path}")
-        return 0
-    except Exception as exc:
-        print(f"Error: {exc}")
-        return 1
-    finally:
-        if client:
-            client.close()
-
-
-if __name__ == "__main__":
-    sys.exit(main())

MULTITENANT_DEPLOYMENT.md

@@ -14,7 +14,7 @@ Die optimierte Multi-Tenant-Architektur unterstützt **mehrere isolierte Instanz
 └─────────────────────────────────────────────────────────────┘
               ↓               ↓               ↓
     ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
-    │  App :8001   │ │  App :8002   │ │  App :8003   │
+    │  App :10000  │ │  App :10002  │ │  App :10004  │
     │ schule1      │ │ schule2      │ │ schule3      │
     │ Tenant: t1   │ │ Tenant: t2   │ │ Tenant: t3   │
     │ 20 Users     │ │ 20 Users     │ │ 20 Users     │

README.md

@@ -45,8 +45,6 @@ Das Inventarsystem stellt folgende Wartungsskripte bereit:
 | `stop.sh` | Dienste stoppen |
 | `restart.sh` | Dienste neu starten |
 | `build-nuitka.sh` | Standalone-Build der App mit Nuitka erstellen |
-| `init-admin.sh` | Initialisiert Admin-User wenn DB leer ist |
-| `create-user.sh` | Erstellt neue User per Kommandozeile |
 | `Backup-DB.py` | Manuelles DB-Backup |
 | `restore.sh` | Backup wiederherstellen |
 | `manage-version.sh` | Versionssteuerung |
@@ -163,7 +161,7 @@ sudo ./install.sh --cleanup-old-remove-cron
 
 Das System läuft produktiv Docker-first. Deployments und Updates erfolgen über Release-Artefakte (Build-only), nicht über Quellcode-Pulls.
 
-- Laufzeit-Stack: [docker-compose.yml](docker-compose.yml)
+- Laufzeit-Stack: [docker-compose-multitenant.yml](docker-compose-multitenant.yml)
 - Build-Pipeline: [Dockerfile](Dockerfile)
 - Release-Pipeline: [.github/workflows/release-docker.yml](.github/workflows/release-docker.yml)
 - Frontend/Reverse Proxy: Nginx (Container)
@@ -237,7 +235,7 @@ docker compose logs -f nginx
 
 ### Persistente Daten
 
-Die Volumes sind in [docker-compose.yml](docker-compose.yml) definiert:
+Die Volumes sind in [docker-compose-multitenant.yml](docker-compose-multitenant.yml) definiert:
 
 - MongoDB Daten
 - Uploads / Thumbnails / Previews / QRCodes
@@ -286,27 +284,19 @@ https://[SERVER-IP]
 
 Wenn die Datenbank leer ist (beim ersten Start), erstellen Sie einen Admin-User:
 
-**Option 1: Automatisiert beim Start**
-```bash
-./init-admin.sh
-```
-
-Mit benutzerdefinierten Daten:
-```bash
-./init-admin.sh myadmin mypassword123 Max Mustermann
-```
-
-**Option 2: Interaktiv**
+**Option 1: Interaktiv**
 ```bash
 cd Web && python3 generate_user.py
 ```
 
-**Option 3: Per Kommandozeile**
+**Option 2: Multitenant-Tenant erstellen**
 ```bash
-./create-user.sh admin password123456 Admin User --admin
+sudo ./manage-tenant.sh add <tenant-name> <port>
 ```
 
-**Option 4: Direkt in MongoDB (Notlösung)**
+Dieser Weg erzeugt beim Anlegen eines neuen Tenants einen Standard-Admin für den Tenant.
+
+**Option 3: Direkt in MongoDB (Notlösung)**
 ```bash
 docker exec inventarsystem-mongodb mongosh --eval "
 db.users.insertOne({

Web/app.py

@@ -50,6 +50,7 @@ import socket
 import io
 import html
 import logging
+from logging.handlers import RotatingFileHandler
 import secrets
 import importlib
 try:
@@ -76,10 +77,19 @@ from data_protection import (
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 import settings as cfg
 from settings import MongoClient
+from tenant import get_tenant_context
 
 
 app = Flask(__name__, static_folder='static')  # Correctly set static folder
-app.logger.setLevel(logging.WARNING)
+app.logger.setLevel(logging.DEBUG)
+if not os.path.exists(cfg.LOGS_FOLDER):
+    os.makedirs(cfg.LOGS_FOLDER, exist_ok=True)
+log_file_path = os.path.join(cfg.LOGS_FOLDER, 'application.log')
+file_handler = RotatingFileHandler(log_file_path, maxBytes=10 * 1024 * 1024, backupCount=5, encoding='utf-8')
+file_handler.setLevel(logging.DEBUG)
+file_handler.setFormatter(logging.Formatter('%(asctime)s %(levelname)s %(name)s %(message)s'))
+app.logger.handlers = []
+app.logger.addHandler(file_handler)
 app.secret_key = cfg.SECRET_KEY
 app.debug = cfg.DEBUG
 app.config['UPLOAD_FOLDER'] = cfg.UPLOAD_FOLDER
@@ -391,12 +401,60 @@ def _is_library_module_path(path):
     )
     return path.startswith(library_prefixes)
 
+def _is_inventory_module_path(path):
+    """Return True when the current request path belongs to the inventory module."""
+    if not path:
+        return False
+        
+    if path == '/' or path.startswith('/home'):
+        return True
+
+    inventory_prefixes = (
+        '/scanner',
+        '/inventory',
+        '/upload_admin',
+        '/manage_filters',
+        '/manage_locations',
+        '/admin_borrowings',
+        '/admin_damaged_items',
+        '/admin/borrowings',
+        '/admin/damaged_items',
+        '/terminplan',
+    )
+    return path.startswith(inventory_prefixes)
+
+@app.before_request
+def _enforce_module_access():
+    endpoint = request.endpoint or ''
+    if endpoint == 'static' or endpoint.startswith('static') or request.path.startswith('/api/'):
+        return None
+    
+    if not cfg.LIBRARY_MODULE_ENABLED and _is_library_module_path(request.path):
+        return "Bibliotheks-Modul ist deaktiviert.", 403
+    
+    if not cfg.INVENTORY_MODULE_ENABLED and _is_inventory_module_path(request.path):
+        return "Inventar-Modul ist deaktiviert.", 403
 
 def _get_current_module(path):
     """Resolve the active UI module for navbar separation."""
+    
     if cfg.LIBRARY_MODULE_ENABLED and _is_library_module_path(path):
+        session['last_module'] = 'library'
         return 'library'
-    return 'inventory'
+    if cfg.INVENTORY_MODULE_ENABLED and _is_inventory_module_path(path):
+        session['last_module'] = 'inventory'
+        return 'inventory'
+        
+    last_module = session.get('last_module')
+    if last_module == 'library' and cfg.LIBRARY_MODULE_ENABLED:
+        return 'library'
+    if last_module == 'inventory' and cfg.INVENTORY_MODULE_ENABLED:
+        return 'inventory'
+        
+    # Default fallback: prefer inventory if enabled, otherwise library, else inventory
+    if cfg.INVENTORY_MODULE_ENABLED:
+        return 'inventory'
+    return 'library' if cfg.LIBRARY_MODULE_ENABLED else 'inventory'
 
 
 def _get_current_user_permissions():
@@ -1092,6 +1150,15 @@ def inject_version():
                 client.close()
 
     current_module = _get_current_module(request.path)
+    current_tenant_db = MONGODB_DB
+    current_tenant_id = None
+    try:
+        ctx = get_tenant_context()
+        if ctx:
+            current_tenant_db = ctx.db_name or current_tenant_db
+            current_tenant_id = ctx.tenant_id
+    except Exception:
+        current_tenant_db = MONGODB_DB
 
     return {
         'APP_VERSION': APP_VERSION,
@@ -1099,11 +1166,14 @@ def inject_version():
         'csrf_token': csrf_token,
         'CURRENT_MODULE': current_module,
         'school_periods': SCHOOL_PERIODS,
+        'inventory_module_enabled': cfg.INVENTORY_MODULE_ENABLED,
         'library_module_enabled': cfg.LIBRARY_MODULE_ENABLED,
         'student_cards_module_enabled': cfg.STUDENT_CARDS_MODULE_ENABLED,
         'is_admin': is_admin,
         'unread_notification_count': unread_notification_count,
         'current_permissions': current_permissions,
+        'current_tenant_db': current_tenant_db,
+        'current_tenant_id': current_tenant_id,
         'permission_action_options': PERMISSION_ACTION_OPTIONS,
         'permission_page_options': PERMISSION_PAGE_OPTIONS,
         'permission_presets': us.get_permission_preset_definitions(),
@@ -2720,6 +2790,13 @@ def home():
     if 'username' not in session:
         flash('Bitte mit registriertem Konto anmelden!', 'error')
         return redirect(url_for('login'))
+        
+    if not cfg.INVENTORY_MODULE_ENABLED:
+        if cfg.LIBRARY_MODULE_ENABLED:
+            return redirect(url_for('library_view'))
+        else:
+            return "Weder Inventar- noch Bibliotheks-Modul sind aktiviert.", 403
+
     elif not us.check_admin(session['username']):
         return render_template(
             'main.html',
@@ -2752,6 +2829,13 @@ def home_admin():
     if 'username' not in session:
         flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adrrese zu nutzen, versuchen sie es erneut nach dem sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error')
         return redirect(url_for('login'))
+        
+    if not cfg.INVENTORY_MODULE_ENABLED:
+        if cfg.LIBRARY_MODULE_ENABLED:
+            return redirect(url_for('library_admin'))
+        else:
+            return "Weder Inventar- noch Bibliotheks-Modul sind aktiviert.", 403
+
     if not us.check_admin(session['username']):
         flash('Ihnen ist es nicht gestattet auf dieser Internetanwendung, die eben besuchte Adrrese zu nutzen, versuchen sie es erneut nach dem sie sich mit einem berechtigten Nutzer angemeldet haben!', 'error')
         return redirect(url_for('login'))
@@ -4036,13 +4120,22 @@ def login():
     if request.method == 'POST':
         username = request.form['username']
         password = request.form['password']
+        ctx = get_tenant_context()
+        current_tenant_id = ctx.tenant_id if ctx else None
+        current_tenant_db = ctx.db_name if ctx else cfg.MONGODB_DB
+        app.logger.info(f"Login attempt: username={username!r} tenant={current_tenant_id or 'default'} db={current_tenant_db} host={request.host} ip={request.remote_addr}")
+        app.logger.info(f"Debug login context: headers={dict(request.headers)} tenant_config={ctx.config if ctx else None} remote_addr={request.remote_addr} host={request.host}")
+        app.logger.info(f"Raw login payload: username={username!r} password={password!r}")
+        app.logger.info(f"Active MongoDB config: uri={getattr(cfg, 'MONGODB_URI', None)!r} host={cfg.MONGODB_HOST!r} port={cfg.MONGODB_PORT!r} default_db={cfg.MONGODB_DB!r}")
         if not username or not password:
+            app.logger.warning(f"Login blocked: missing credentials tenant={current_tenant_id or 'default'} host={request.host} ip={request.remote_addr}")
             flash('Bitte alle Felder ausfüllen', 'error')
             return redirect(url_for('login'))
         
         user = us.check_nm_pwd(username, password)
 
         if user:
+            app.logger.info(f"Login success: username={username!r} tenant={current_tenant_id or 'default'} db={current_tenant_db} host={request.host} ip={request.remote_addr}")
             session['username'] = username
             is_admin_user = bool(user.get('Admin', False))
             session['admin'] = is_admin_user
@@ -4063,6 +4156,7 @@ def login():
             else:
                 return redirect(url_for('home'))
         else:
+            app.logger.warning(f"Login failed: username={username!r} tenant={current_tenant_id or 'default'} db={current_tenant_db} host={request.host} ip={request.remote_addr}")
             flash('Ungültige Anmeldedaten', 'error')
             get_flashed_messages()
     return render_template('login.html')
@@ -6587,11 +6681,15 @@ def zurueckgeben(id):
 def get_filter():
     """
     API endpoint to retrieve available item filters/categories.
-    
+
     Returns:
-        dict: Dictionary of available filters
+        dict: Dictionary of available filters by filter field
     """
-    return it.get_filters()
+    return jsonify({
+        'filter1': it.get_primary_filters(),
+        'filter2': it.get_secondary_filters(),
+        'filter3': it.get_tertiary_filters(),
+    })
     
 
 @app.route('/get_ausleihung_by_item/<id>')
@@ -7116,7 +7214,7 @@ def register():
             name = (request.form.get('name') or '').strip()
             last_name = (request.form.get('last-name') or '').strip()
 
-            # Always generate username from abbreviation logic and auto-extend on collisions.
+            # Generate a username from the first 2 letters of first and last name.
             username = us.build_unique_username_from_name(name, last_name)
             
             permission_preset = (request.form.get('permission_preset') or 'standard_user').strip()

Web/backup_invoices.py

@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+import argparse
+import csv
+import datetime
+import json
+import os
+import sys
+
+try:
+    from bson import json_util
+except ImportError:
+    json_util = None
+
+try:
+    from pymongo import MongoClient
+except ImportError:
+    print('Error: pymongo is required to run invoice backups.', file=sys.stderr)
+    sys.exit(1)
+
+SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+CONFIG_PATH = os.path.normpath(os.path.join(SCRIPT_DIR, '..', 'config.json'))
+
+DEFAULT_ARCHIVE_DIR = '/var/backups/invoice-archive'
+DEFAULT_KEEP_DAYS = 3650
+
+
+def load_config():
+    config = {}
+    try:
+        with open(CONFIG_PATH, 'r', encoding='utf-8') as f:
+            config = json.load(f)
+    except Exception:
+        pass
+    return config
+
+
+def resolve_mongo_settings(args):
+    config = load_config()
+    mongodb = config.get('mongodb', {}) if isinstance(config, dict) else {}
+
+    host = os.getenv('INVENTAR_MONGODB_HOST') or args.mongo_host or mongodb.get('host') or 'localhost'
+    port = os.getenv('INVENTAR_MONGODB_PORT') or args.mongo_port or mongodb.get('port') or 27017
+    db_name = os.getenv('INVENTAR_MONGODB_DB') or args.db_name or mongodb.get('db') or 'Inventarsystem'
+    uri = args.mongo_uri
+
+    if isinstance(port, str) and port.strip().isdigit():
+        port = int(port.strip())
+
+    return host, int(port), db_name, uri
+
+
+def format_csv_value(value):
+    if value is None:
+        return ''
+    if isinstance(value, bool):
+        return 'true' if value else 'false'
+    if isinstance(value, (int, float)):
+        return str(value)
+    if isinstance(value, datetime.datetime):
+        return value.isoformat()
+    if isinstance(value, (list, dict)):
+        return json.dumps(value, ensure_ascii=False)
+    return str(value)
+
+
+def normalize_doc_for_json(doc):
+    if json_util is not None:
+        return json.loads(json_util.dumps(doc, default=json_util.default))
+    return doc
+
+
+def build_csv_row(document):
+    invoice_data = document.get('InvoiceData') or {}
+    corrections = document.get('InvoiceCorrections') or []
+    return {
+        'invoice_number': invoice_data.get('invoice_number', ''),
+        'borrow_id': str(document.get('_id', '')),
+        'status_before_invoice': invoice_data.get('status_before_invoice', '') or document.get('Status', ''),
+        'borrower': document.get('User', '') or invoice_data.get('borrower', ''),
+        'item': document.get('Item', ''),
+        'amount': invoice_data.get('amount', ''),
+        'currency': invoice_data.get('currency', 'EUR'),
+        'created_at': format_csv_value(invoice_data.get('created_at')),
+        'paid': invoice_data.get('paid', False),
+        'paid_at': format_csv_value(invoice_data.get('paid_at')),
+        'invoice_reason': invoice_data.get('damage_reason', ''),
+        'corrections_count': len(corrections) if isinstance(corrections, list) else 0,
+        'corrections': json.dumps(corrections, ensure_ascii=False) if corrections else '',
+    }
+
+
+def write_jsonl(path, cursor):
+    with open(path, 'w', encoding='utf-8') as f:
+        for document in cursor:
+            if json_util is not None:
+                line = json_util.dumps(document, default=json_util.default)
+            else:
+                line = json.dumps(document, default=str, ensure_ascii=False)
+            f.write(line + '\n')
+
+
+def write_csv(path, cursor):
+    fieldnames = [
+        'invoice_number',
+        'borrow_id',
+        'status_before_invoice',
+        'borrower',
+        'item',
+        'amount',
+        'currency',
+        'created_at',
+        'paid',
+        'paid_at',
+        'invoice_reason',
+        'corrections_count',
+        'corrections',
+    ]
+    with open(path, 'w', encoding='utf-8', newline='') as f:
+        writer = csv.DictWriter(f, fieldnames=fieldnames)
+        writer.writeheader()
+        for document in cursor:
+            writer.writerow({k: format_csv_value(v) for k, v in build_csv_row(document).items()})
+
+
+def write_meta(path, metadata):
+    with open(path, 'w', encoding='utf-8') as f:
+        json.dump(metadata, f, ensure_ascii=False, indent=2)
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(description='Create a legal invoice archive backup from the MongoDB invoice records.')
+    parser.add_argument('--archive-dir', required=True, help='Directory to write archive files into')
+    parser.add_argument('--base-name', default=None, help='Base filename prefix for archive files')
+    parser.add_argument('--mongo-host', default=None, help='MongoDB host override')
+    parser.add_argument('--mongo-port', type=int, default=None, help='MongoDB port override')
+    parser.add_argument('--db-name', default=None, help='MongoDB database name override')
+    parser.add_argument('--mongo-uri', default=None, help='MongoDB connection URI override')
+    return parser.parse_args()
+
+
+def main():
+    args = parse_args()
+    archive_dir = os.path.abspath(args.archive_dir)
+    os.makedirs(archive_dir, exist_ok=True)
+
+    base_name = args.base_name or f'invoices-{datetime.datetime.now().strftime("%Y-%m-%d_%H-%M-%S")}'
+    jsonl_path = os.path.join(archive_dir, f'{base_name}.jsonl')
+    csv_path = os.path.join(archive_dir, f'{base_name}.csv')
+    meta_path = os.path.join(archive_dir, f'{base_name}.meta.json')
+
+    host, port, db_name, uri = resolve_mongo_settings(args)
+    if uri:
+        client = MongoClient(uri)
+    else:
+        client = MongoClient(host, port)
+
+    try:
+        db = client[db_name]
+        collection = db['ausleihungen']
+        query = {'InvoiceData.invoice_number': {'$exists': True, '$ne': ''}}
+        projection = {'InvoiceData': 1, 'InvoiceCorrections': 1, 'User': 1, 'Item': 1, 'Status': 1}
+        cursor = collection.find(query, projection)
+
+        docs = list(cursor)
+        if not docs:
+            print('No invoice records found. No archive written.')
+            return 0
+
+        write_jsonl(jsonl_path, docs)
+        write_csv(csv_path, docs)
+
+        metadata = {
+            'generated_at': datetime.datetime.now(datetime.timezone.utc).isoformat(),
+            'invoice_count': len(docs),
+            'archive_files': [os.path.basename(jsonl_path), os.path.basename(csv_path), os.path.basename(meta_path)],
+            'mongo_db': db_name,
+            'mongo_host': host,
+            'mongo_port': port,
+            'query': query,
+        }
+        write_meta(meta_path, metadata)
+
+        print(f'Wrote invoice archive: {jsonl_path}')
+        print(f'Wrote invoice archive CSV: {csv_path}')
+        print(f'Wrote metadata: {meta_path}')
+        return 0
+    finally:
+        client.close()
+
+if __name__ == '__main__':
+    sys.exit(main())

Web/push_notifications.py

@@ -6,13 +6,13 @@ Handles Web Push notifications for users via Service Workers
 import os
 import json
 import datetime
-from pymongo import MongoClient
 from bson import ObjectId
 import requests
 import hashlib
 import logging
 
 import settings as cfg
+from settings import MongoClient
 
 logger = logging.getLogger(__name__)
 

Web/settings.py

@@ -14,6 +14,7 @@ import os
 import json
 import atexit
 from threading import Lock
+from flask import has_request_context
 from pymongo import MongoClient as _PyMongoClient
 
 # Base directory of this Web package
@@ -73,6 +74,9 @@ DEFAULTS = {
         "10": {"start": "16:00", "end": "16:45", "label": "10. Stunde (16:00 - 16:45)"}
     },
     'modules': {
+        'inventory': {
+            'enabled': True
+        },
         'library': {
             'enabled': False
         },
@@ -130,11 +134,15 @@ PORT = _get(_conf, ['port'], DEFAULTS['port'])
 MONGODB_HOST = _get(_conf, ['mongodb', 'host'], DEFAULTS['mongodb']['host'])
 MONGODB_PORT = _get(_conf, ['mongodb', 'port'], DEFAULTS['mongodb']['port'])
 MONGODB_DB = _get(_conf, ['mongodb', 'db'], DEFAULTS['mongodb']['db'])
+MONGODB_URI = _get(_conf, ['mongodb', 'uri'], '')
 
 # Optional environment overrides for containerized/runtime deployments.
 MONGODB_HOST = os.getenv('INVENTAR_MONGODB_HOST', MONGODB_HOST)
 MONGODB_PORT = int(os.getenv('INVENTAR_MONGODB_PORT', str(MONGODB_PORT)))
 MONGODB_DB = os.getenv('INVENTAR_MONGODB_DB', MONGODB_DB)
+MONGODB_URI = os.getenv('INVENTAR_MONGODB_URI', os.getenv('MONGO_URI', MONGODB_URI))
+if isinstance(MONGODB_URI, str):
+    MONGODB_URI = MONGODB_URI.strip() or None
 MONGODB_MAX_POOL_SIZE = _get_int_env('INVENTAR_MONGODB_MAX_POOL_SIZE', 20)
 MONGODB_MIN_POOL_SIZE = _get_int_env('INVENTAR_MONGODB_MIN_POOL_SIZE', 0)
 MONGODB_MAX_IDLE_TIME_MS = _get_int_env('INVENTAR_MONGODB_MAX_IDLE_TIME_MS', 300000)
@@ -185,6 +193,7 @@ class _TenantAwareBool:
         return f"_TenantAwareBool(module_name={self.module_name!r}, value={self.resolve()!r})"
 
 
+INVENTORY_MODULE_ENABLED = _TenantAwareBool('inventory', _get(_conf, ['modules', 'inventory', 'enabled'], DEFAULTS['modules']['inventory']['enabled']))
 LIBRARY_MODULE_ENABLED = _TenantAwareBool('library', _get(_conf, ['modules', 'library', 'enabled'], DEFAULTS['modules']['library']['enabled']))
 STUDENT_CARDS_MODULE_ENABLED = _TenantAwareBool('student_cards', _get(_conf, ['modules', 'student_cards', 'enabled'], DEFAULTS['modules']['student_cards']['enabled']))
 STUDENT_DEFAULT_BORROW_DAYS = int(_get(_conf, ['modules', 'student_cards', 'default_borrow_days'], DEFAULTS['modules']['student_cards']['default_borrow_days']))
@@ -250,8 +259,29 @@ class _MongoClientProxy:
         return getattr(self._client, name)
 
     def __getitem__(self, name):
+        if has_request_context():
+            try:
+                from tenant import get_tenant_context
+                ctx = get_tenant_context()
+                if ctx and ctx.db_name:
+                    if name == MONGODB_DB or name == MONGODB_DB.lower() or name == 'inventar_default':
+                        return self._client[ctx.db_name]
+            except Exception:
+                pass
         return self._client[name]
 
+    def get_database(self, name=None, *args, **kwargs):
+        if has_request_context():
+            try:
+                from tenant import get_tenant_context
+                ctx = get_tenant_context()
+                if ctx and ctx.db_name:
+                    if name is None or name == MONGODB_DB or name == MONGODB_DB.lower() or name == 'inventar_default':
+                        return self._client.get_database(ctx.db_name, *args, **kwargs)
+            except Exception:
+                pass
+        return self._client.get_database(name, *args, **kwargs)
+
     def __enter__(self):
         return self
 
@@ -296,7 +326,9 @@ def MongoClient(*args, **kwargs):
     }
     client_kwargs.update(kwargs)
 
-    if len(args) >= 2 and not explicit_host and not explicit_port:
+    if MONGODB_URI and len(args) == 0 and not explicit_host and not explicit_port:
+        mongo_args = (MONGODB_URI,)
+    elif len(args) >= 2 and not explicit_host and not explicit_port:
         mongo_args = args
     else:
         mongo_args = (host, port)

Web/templates/base.html

@@ -176,6 +176,13 @@
             z-index: 1900;
         }
 
+        #loginNavbar {
+            padding-top: 0;
+            padding-bottom: 0;
+            min-height: 56px;
+            overflow: visible;
+        }
+
         .navbar .container-fluid {
             gap: 8px;
             /* Ensure container respects safe areas on all sides */
@@ -183,6 +190,13 @@
             padding-right: max(env(safe-area-inset-right, 0), 12px);
             padding-bottom: env(safe-area-inset-bottom, 0);
         }
+
+        #loginNavbar .container-fluid {
+            padding-top: 4px;
+            padding-bottom: 4px;
+            align-items: center;
+            min-height: 56px;
+        }
         
         .navbar-brand {
             font-weight: bold;
@@ -191,6 +205,38 @@
             white-space: nowrap;
             flex-shrink: 0;
         }
+
+        #loginNavbar .navbar-brand {
+            padding-right: 0;
+        }
+
+        #loginNavbar .navbar-brand::before {
+            content: none;
+            margin-right: 0;
+        }
+
+        #loginNavbar .invario-logo {
+            display: block;
+            height: 94px;
+            width: auto;
+            max-width: min(75vw, 460px);
+            object-fit: contain;
+            filter: none;
+            margin-top: 0;
+            margin-bottom: 0;
+            transform: translateY(28px);
+        }
+
+        .navbar-text.tenant-badge {
+            font-size: 0.82rem;
+            color: rgba(255,255,255,0.9);
+            background: rgba(255,255,255,0.12);
+            border: 1px solid rgba(255,255,255,0.18);
+            padding: 0.25rem 0.55rem;
+            border-radius: 999px;
+            white-space: nowrap;
+            margin-right: 0.75rem;
+        }
         
         .navbar-brand::before {
             content: attr(data-icon);
@@ -206,6 +252,82 @@
             white-space: nowrap;
         }
 
+        body.tutorial-tooltips-active [data-tutorial-tip] {
+            position: relative;
+            border-radius: 10px;
+            outline: 1px dashed rgba(59, 130, 246, 0.35);
+            outline-offset: 2px;
+            cursor: help;
+        }
+
+        body.tutorial-tooltips-active [data-tutorial-tip]::before {
+            content: '💡';
+            position: absolute;
+            top: 50%;
+            right: -26px;
+            transform: translateY(-50%);
+            width: 20px;
+            height: 20px;
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            border-radius: 999px;
+            background: rgba(59, 130, 246, 0.15);
+            color: #0f172a;
+            font-size: 0.75rem;
+            pointer-events: none;
+        }
+
+        body.tutorial-tooltips-active [data-tutorial-tip]::after {
+            content: attr(data-tutorial-tip);
+            position: absolute;
+            top: calc(100% + 10px);
+            left: 50%;
+            transform: translateX(-50%) translateY(6px);
+            min-width: 220px;
+            max-width: 280px;
+            padding: 10px 12px;
+            border-radius: 14px;
+            background: rgba(15, 23, 42, 0.92);
+            color: #f8fafc;
+            font-size: 0.9rem;
+            line-height: 1.4;
+            text-align: left;
+            opacity: 0;
+            visibility: hidden;
+            pointer-events: none;
+            box-shadow: 0 24px 48px rgba(15, 23, 42, 0.22);
+            z-index: 9999;
+            white-space: normal;
+        }
+
+        body.tutorial-tooltips-active [data-tutorial-tip]:hover::after {
+            opacity: 1;
+            visibility: visible;
+            transform: translateX(-50%) translateY(10px);
+        }
+
+        .tutorial-tooltip-indicator {
+            position: fixed;
+            top: 92px;
+            right: 16px;
+            z-index: 2000;
+            display: none;
+            align-items: center;
+            gap: 10px;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: rgba(56, 189, 248, 0.12);
+            border: 1px solid rgba(56, 189, 248, 0.25);
+            color: #0f172a;
+            font-size: 0.95rem;
+            box-shadow: 0 10px 30px rgba(15, 23, 42, 0.12);
+        }
+
+        body.tutorial-tooltips-active .tutorial-tooltip-indicator {
+            display: inline-flex;
+        }
+
         /* iPad/Tablet responsive adjustments */
         @media (max-width: 1024px) {
             .navbar .container-fluid {
@@ -250,6 +372,14 @@
                 font-size: 0.75rem;
                 padding: 0.4rem 0.5rem;
             }
+
+            #loginNavbar .invario-logo {
+                height: 74px;
+                max-width: 80vw;
+                margin-top: 0;
+                margin-bottom: 0;
+                transform: translateY(20px);
+            }
         }
 
         .navbar.nav-compact .navbar-brand {
@@ -923,14 +1053,18 @@
     <div class="module-selector-bar" id="moduleBar">
         <span class="module-label">Module:</span>
         <div class="module-tabs">
+            {% if inventory_module_enabled %}
             <a href="{{ url_for('home') }}" 
                class="module-tab {% if CURRENT_MODULE == 'inventory' %}active{% endif %}" 
                id="inventoryModule" 
                data-module="inventory">
                📦 Inventarsystem
             </a>
-            {% if library_module_enabled %}
+            {% endif %}
+            {% if inventory_module_enabled and library_module_enabled %}
             <div class="module-separator"></div>
+            {% endif %}
+            {% if library_module_enabled %}
             <a href="{{ url_for('library_view') }}" 
                class="module-tab {% if CURRENT_MODULE == 'library' %}active{% endif %}" 
                id="libraryModule" 
@@ -941,231 +1075,250 @@
         </div>
     </div>
     {% endif %}
-    {% if CURRENT_MODULE != 'library' %}
-    <nav class="navbar navbar-expand-lg navbar-dark" id="inventoryNavbar">
-        <div class="container-fluid">
-            <a class="navbar-brand" href="{{ url_for('home') }}" data-icon="📦">Inventarsystem</a>
-            <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#inventoryNavContent">
-                <span class="navbar-toggler-icon"></span>
-            </button>
-            <div class="collapse navbar-collapse" id="inventoryNavContent">
-                <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="inventoryNavList">
-                    {% if current_permissions.pages.get('home', True) %}
-                    <li class="nav-item" data-nav-fixed="true">
-                        <a class="nav-link {% if current_path == url_for('home') %}nav-active{% endif %}" href="{{ url_for('home') }}">Artikel</a>
-                    </li>
-                    {% endif %}
-                    {% if 'username' in session %}
-                    {% if current_permissions.pages.get('my_borrowed_items', True) %}
-                    <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Ausleihen</a>
-                    </li>
-                    {% endif %}
-                    {% if current_permissions.pages.get('tutorial_page', True) %}
-                    <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
-                    </li>
-                    {% endif %}
-                    {% endif %}
-                    {% if 'username' in session and current_permissions.pages.get('upload_admin', True) and current_permissions.actions.get('can_insert', True) %}
-                    <li class="nav-item">
-                        <a class="nav-link nav-priority-link {% if current_path == url_for('upload_admin') %}nav-active{% endif %}" href="{{ url_for('upload_admin') }}">➕ Hochladen</a>
-                    </li>
-                    {% endif %}
-                    <li class="nav-item" data-nav-fixed="true">
-                        <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
-                            <span class="theme-icon-light" style="display: none;">☀️</span>
-                            <span class="theme-icon-dark" style="display: none;">🌙</span>
-                        </button>
-                    </li>
-
-                    <li class="nav-item dropdown ms-lg-auto">
-                        <a class="nav-link dropdown-toggle" href="#" id="invMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">
-                            Mehr Optionen
-                        </a>
-                        <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invMoreDropdown">
-                            {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
-                            <li><h6 class="dropdown-header">Verwaltung</h6></li>
-                            {% if current_permissions.pages.get('manage_filters', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('manage_filters') }}">Filter verwalten</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('manage_locations', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('manage_locations') }}">Orte verwalten</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('admin_borrowings', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('admin_borrowings') }}">Ausleihen</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('admin_damaged_items', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('admin_damaged_items') }}">Defekte Items</a></li>
-                            {% endif %}
-                            {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('admin_audit_dashboard', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
-                            {% endif %}
-                            {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('logs', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('logs') }}">Logs</a></li>
-                            {% endif %}
-                            <li><hr class="dropdown-divider"></li>
-                            {% if current_permissions.actions.get('can_manage_users', True) %}
-                            <li><h6 class="dropdown-header">System</h6></li>
-                            {% if current_permissions.pages.get('user_del', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('register', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
-                            {% endif %}
-                            <li><hr class="dropdown-divider"></li>
-                            {% endif %}
-                            {% endif %}
-                            <li><a class="dropdown-item" href="{{ url_for('impressum') }}">Impressum</a></li>
-                            <li><a class="dropdown-item" href="{{ url_for('license') }}">Lizenz</a></li>
-                        </ul>
-                    </li>
-                    <li class="nav-item d-none" id="inv-nav-overflow-anchor" aria-hidden="true"></li>
-                </ul>
-                <div class="d-flex">
-                    {% if 'username' in session %}
-                        <div class="function-search-wrap">
-                            <form class="function-search-form" data-function-search="true">
-                                <input
-                                    class="function-search-input"
-                                    type="search"
-                                    name="function_search"
-                                    placeholder="Funktion suchen..."
-                                    list="function-search-options"
-                                    autocomplete="off"
-                                >
-                                <button class="function-search-btn" type="submit">Los</button>
-                            </form>
-                        </div>
-                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
-                        <div class="dropdown me-2 user-menu-wrap">
-                            <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="invUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
-                                👤
-                                <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
+        {% if 'username' in session %}
+    {% if CURRENT_MODULE != 'library' and inventory_module_enabled %}
+        <nav class="navbar navbar-expand-lg navbar-dark" id="inventoryNavbar">
+            <div class="container-fluid">
+                <a class="navbar-brand" href="{{ url_for('home') }}" data-icon="📦">Inventarsystem</a>
+                <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#inventoryNavContent">
+                    <span class="navbar-toggler-icon"></span>
+                </button>
+                <div class="collapse navbar-collapse" id="inventoryNavContent">
+                    <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="inventoryNavList">
+                        {% if current_permissions.pages.get('home', True) %}
+                        <li class="nav-item" data-nav-fixed="true">
+                            <a class="nav-link {% if current_path == url_for('home') %}nav-active{% endif %}" href="{{ url_for('home') }}" data-tutorial-tip="Starten Sie hier mit dem Materialbestand und suchen Sie nach Artikeln.">Artikel</a>
+                        </li>
+                        {% endif %}
+                        {% if 'username' in session %}
+                        {% if current_permissions.pages.get('my_borrowed_items', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}" data-tutorial-tip="Ihre aktuellen Ausleihen und Rückgaben finden Sie hier.">Meine Ausleihen</a>
+                        </li>
+                        {% endif %}
+                        {% if current_permissions.pages.get('tutorial_page', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}" data-tutorial-tip="Öffnen Sie das Tutorial, um das System Schritt für Schritt kennenzulernen.">Tutorial</a>
+                        </li>
+                        {% endif %}
+                        {% endif %}
+                        {% if 'username' in session and current_permissions.pages.get('upload_admin', True) and current_permissions.actions.get('can_insert', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link nav-priority-link {% if current_path == url_for('upload_admin') %}nav-active{% endif %}" href="{{ url_for('upload_admin') }}" data-tutorial-tip="Hier können Sie neue Artikel ins Inventar einpflegen.">➕ Hochladen</a>
+                        </li>
+                        {% endif %}
+                        <li class="nav-item" data-nav-fixed="true">
+                            <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
+                                <span class="theme-icon-light" style="display: none;">☀️</span>
+                                <span class="theme-icon-dark" style="display: none;">🌙</span>
                             </button>
-                            <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
-                                {% if current_permissions.pages.get('notifications_view', True) %}
-                                <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
+                        </li>
+
+                        <li class="nav-item dropdown ms-lg-auto">
+                            <a class="nav-link dropdown-toggle" href="#" id="invMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">
+                                Mehr Optionen
+                            </a>
+                            <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invMoreDropdown">
+                                {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
+                                <li><h6 class="dropdown-header">Verwaltung</h6></li>
+                                {% if current_permissions.pages.get('manage_filters', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('manage_filters') }}">Filter verwalten</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('manage_locations', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('manage_locations') }}">Orte verwalten</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_borrowings', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_borrowings') }}">Ausleihen</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_damaged_items', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_damaged_items') }}">Defekte Items</a></li>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('admin_audit_dashboard', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_audit_dashboard') }}">Audit Dashboard</a></li>
+                                {% endif %}
+                                {% if current_permissions.actions.get('can_view_logs', True) and current_permissions.pages.get('logs', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('logs') }}">Logs</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
-                                <li><a class="dropdown-item" href="{{ url_for('change_password') }}">Passwort ändern</a></li>
-                                <li><hr class="dropdown-divider"></li>
-                                <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
-                            </ul>
-                        </div>
-                    {% endif %}
-                </div>
-            </div>
-        </div>
-    </nav>
-    {% endif %}
-
-    {% if library_module_enabled and CURRENT_MODULE == 'library' %}
-    <nav class="navbar navbar-expand-lg navbar-dark" id="libraryNavbar">
-        <div class="container-fluid">
-            <a class="navbar-brand" href="{{ url_for('library_view') }}" data-icon="📚">Bibliothek</a>
-            <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#libraryNavContent">
-                <span class="navbar-toggler-icon"></span>
-            </button>
-            <div class="collapse navbar-collapse" id="libraryNavContent">
-                <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="libraryNavList">
-                    {% if current_permissions.pages.get('library_view', True) %}
-                    <li class="nav-item" data-nav-fixed="true">
-                        <a class="nav-link {% if current_path == url_for('library_view') %}nav-active{% endif %}" href="{{ url_for('library_view') }}">Medien</a>
-                    </li>
-                    {% endif %}
-                    {% if 'username' in session %}
-                    {% if current_permissions.pages.get('my_borrowed_items', True) %}
-                    <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}">Meine Medien</a>
-                    </li>
-                    {% endif %}
-                    {% if current_permissions.pages.get('tutorial_page', True) %}
-                    <li class="nav-item">
-                        <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}">Tutorial</a>
-                    </li>
-                    {% endif %}
-                    {% endif %}
-                    {% if 'username' in session and current_permissions.actions.get('can_insert', True) and current_permissions.pages.get('library_admin', True) %}
-                    <li class="nav-item">
-                        <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}">📖 Hochladen</a>
-                    </li>
-                    {% endif %}
-                    <li class="nav-item" data-nav-fixed="true">
-                        <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
-                            <span class="theme-icon-light" style="display: none;">☀️</span>
-                            <span class="theme-icon-dark" style="display: none;">🌙</span>
-                        </button>
-                    </li>
-
-                    <li class="nav-item dropdown ms-lg-auto">
-                        <a class="nav-link dropdown-toggle" href="#" id="libMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">
-                            Mehr Optionen
-                        </a>
-                        <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libMoreDropdown">
-                            {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
-                            <li><h6 class="dropdown-header">Bibliotheks-Verwaltung</h6></li>
-                            {% if current_permissions.pages.get('library_loans_admin', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('library_loans_admin') }}">Ausleihen</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('admin_damaged_items', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('admin_damaged_items') }}">Defekte Items</a></li>
-                            {% endif %}
-                            {% if student_cards_module_enabled %}
-                            <li><a class="dropdown-item" href="{{ url_for('student_cards_admin') }}">Bibliotheksausweis</a></li>
-                            {% endif %}
-                            <li><hr class="dropdown-divider"></li>
-                            {% if current_permissions.actions.get('can_manage_users', True) %}
-                            <li><h6 class="dropdown-header">System</h6></li>
-                            {% if current_permissions.pages.get('user_del', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
-                            {% endif %}
-                            {% if current_permissions.pages.get('register', True) %}
-                            <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
-                            {% endif %}
-                            <li><hr class="dropdown-divider"></li>
-                            {% endif %}
-                            {% endif %}
-                            <li><a class="dropdown-item" href="{{ url_for('impressum') }}">Impressum</a></li>
-                            <li><a class="dropdown-item" href="{{ url_for('license') }}">Lizenz</a></li>
-                        </ul>
-                    </li>
-                    <li class="nav-item d-none" id="lib-nav-overflow-anchor" aria-hidden="true"></li>
-                </ul>
-                <div class="d-flex">
-                    {% if 'username' in session %}
-                        <div class="function-search-wrap">
-                            <form class="function-search-form" data-function-search="true">
-                                <input
-                                    class="function-search-input"
-                                    type="search"
-                                    name="function_search"
-                                    placeholder="Funktion suchen..."
-                                    list="function-search-options"
-                                    autocomplete="off"
-                                >
-                                <button class="function-search-btn" type="submit">Los</button>
-                            </form>
-                        </div>
-                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
-                        <div class="dropdown me-2 user-menu-wrap">
-                            <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="libUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
-                                👤
-                                <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
-                            </button>
-                            <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libUserMenuDropdown">
-                                {% if current_permissions.pages.get('notifications_view', True) %}
-                                <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
+                                {% if current_permissions.actions.get('can_manage_users', True) %}
+                                <li><h6 class="dropdown-header">System</h6></li>
+                                {% if current_permissions.pages.get('user_del', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('register', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
                                 {% endif %}
                                 <li><hr class="dropdown-divider"></li>
-                                <li><a class="dropdown-item" href="{{ url_for('change_password') }}">Passwort ändern</a></li>
-                                <li><hr class="dropdown-divider"></li>
-                                <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                                {% endif %}
+                                {% endif %}
+                                <li><a class="dropdown-item" href="{{ url_for('impressum') }}">Impressum</a></li>
+                                <li><a class="dropdown-item" href="{{ url_for('license') }}">Lizenz</a></li>
                             </ul>
-                        </div>
-                    {% endif %}
+                        </li>
+                        <li class="nav-item d-none" id="inv-nav-overflow-anchor" aria-hidden="true"></li>
+                    </ul>
+                    <div class="d-flex">
+                        {% if 'username' in session %}
+                            <div class="function-search-wrap">
+                                <form class="function-search-form" data-function-search="true">
+                                    <input
+                                        class="function-search-input"
+                                        type="search"
+                                        name="function_search"
+                                        placeholder="Funktion suchen..."
+                                        list="function-search-options"
+                                        autocomplete="off"
+                                    >
+                                    <button class="function-search-btn" type="submit">Los</button>
+                                </form>
+                            </div>
+                            {% if current_tenant_db %}
+                            <span class="navbar-text tenant-badge" title="Aktive Tenant-Datenbank">{{ current_tenant_db }}</span>
+                        {% endif %}
+                        <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
+                            <div class="dropdown me-2 user-menu-wrap">
+                                <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="invUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
+                                    👤
+                                    <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
+                                </button>
+                                <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="invUserMenuDropdown">
+                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
+                                    {% endif %}
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('change_password') }}">Passwort ändern</a></li>
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                                </ul>
+                            </div>
+                        {% endif %}
+                    </div>
                 </div>
             </div>
+        </nav>
+        {% endif %}
+
+        {% if library_module_enabled and CURRENT_MODULE == 'library' %}
+        <nav class="navbar navbar-expand-lg navbar-dark" id="libraryNavbar">
+            <div class="container-fluid">
+                <a class="navbar-brand" href="{{ url_for('library_view') }}" data-icon="📚">Bibliothek</a>
+                <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#libraryNavContent">
+                    <span class="navbar-toggler-icon"></span>
+                </button>
+                <div class="collapse navbar-collapse" id="libraryNavContent">
+                    <ul class="navbar-nav me-auto mb-2 mb-lg-0" id="libraryNavList">
+                        {% if current_permissions.pages.get('library_view', True) %}
+                        <li class="nav-item" data-nav-fixed="true">
+                            <a class="nav-link {% if current_path == url_for('library_view') %}nav-active{% endif %}" href="{{ url_for('library_view') }}" data-tutorial-tip="Die Bibliothek zeigt Ihnen alle Medien und verfügbaren Bücher.">Medien</a>
+                        </li>
+                        {% endif %}
+                        {% if 'username' in session %}
+                        {% if current_permissions.pages.get('my_borrowed_items', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link quick-link-pill {% if current_path == url_for('my_borrowed_items') %}nav-active{% endif %}" href="{{ url_for('my_borrowed_items') }}" data-tutorial-tip="Hier sehen Sie Ihre bibliotheksbezogenen Ausleihen.">Meine Medien</a>
+                        </li>
+                        {% endif %}
+                        {% if current_permissions.pages.get('tutorial_page', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link quick-link-pill {% if current_path == url_for('tutorial_page') %}nav-active{% endif %}" href="{{ url_for('tutorial_page') }}" data-tutorial-tip="Nutzen Sie das Tutorial, um die Bibliotheksfunktionen kennenzulernen.">Tutorial</a>
+                        </li>
+                        {% endif %}
+                        {% endif %}
+                        {% if 'username' in session and current_permissions.actions.get('can_insert', True) and current_permissions.pages.get('library_admin', True) %}
+                        <li class="nav-item">
+                            <a class="nav-link nav-priority-link {% if current_path == url_for('library_admin') %}nav-active{% endif %}" href="{{ url_for('library_admin') }}" data-tutorial-tip="Neue Bibliotheksmedien können hier aufgenommen werden.">📖 Hochladen</a>
+                        </li>
+                        {% endif %}
+                        <li class="nav-item" data-nav-fixed="true">
+                            <button id="themeToggleBtn" class="btn btn-link nav-link px-3" aria-label="Dark Mode umschalten" title="Theme umschalten">
+                                <span class="theme-icon-light" style="display: none;">☀️</span>
+                                <span class="theme-icon-dark" style="display: none;">🌙</span>
+                            </button>
+                        </li>
+
+                        <li class="nav-item dropdown ms-lg-auto">
+                            <a class="nav-link dropdown-toggle" href="#" id="libMoreDropdown" role="button" data-bs-toggle="dropdown" aria-expanded="false" title="Weitere Optionen">
+                                Mehr Optionen
+                            </a>
+                            <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libMoreDropdown">
+                                {% if 'username' in session and (session.get('admin', False) or is_admin) and current_permissions.actions.get('can_manage_settings', True) %}
+                                <li><h6 class="dropdown-header">Bibliotheks-Verwaltung</h6></li>
+                                {% if current_permissions.pages.get('library_loans_admin', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('library_loans_admin') }}">Ausleihen</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('admin_damaged_items', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('admin_damaged_items') }}">Defekte Items</a></li>
+                                {% endif %}
+                                {% if student_cards_module_enabled %}
+                                <li><a class="dropdown-item" href="{{ url_for('student_cards_admin') }}">Bibliotheksausweis</a></li>
+                                {% endif %}
+                                <li><hr class="dropdown-divider"></li>
+                                {% if current_permissions.actions.get('can_manage_users', True) %}
+                                <li><h6 class="dropdown-header">System</h6></li>
+                                {% if current_permissions.pages.get('user_del', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('user_del') }}">Benutzer verwalten</a></li>
+                                {% endif %}
+                                {% if current_permissions.pages.get('register', True) %}
+                                <li><a class="dropdown-item" href="{{ url_for('register') }}">Neuer Benutzer</a></li>
+                                {% endif %}
+                                <li><hr class="dropdown-divider"></li>
+                                {% endif %}
+                                {% endif %}
+                                <li><a class="dropdown-item" href="{{ url_for('impressum') }}">Impressum</a></li>
+                                <li><a class="dropdown-item" href="{{ url_for('license') }}">Lizenz</a></li>
+                            </ul>
+                        </li>
+                        <li class="nav-item d-none" id="lib-nav-overflow-anchor" aria-hidden="true"></li>
+                    </ul>
+                    <div class="d-flex">
+                        {% if 'username' in session %}
+                            <div class="function-search-wrap">
+                                <form class="function-search-form" data-function-search="true">
+                                    <input
+                                        class="function-search-input"
+                                        type="search"
+                                        name="function_search"
+                                        placeholder="Funktion suchen..."
+                                        list="function-search-options"
+                                        autocomplete="off"
+                                    >
+                                    <button class="function-search-btn" type="submit">Los</button>
+                                </form>
+                            </div>
+                            <span class="navbar-text text-light me-3">{{ session['username'] }}</span>
+                            <div class="dropdown me-2 user-menu-wrap">
+                                <button class="btn btn-secondary dropdown-toggle user-menu-btn" type="button" id="libUserMenuDropdown" data-bs-toggle="dropdown" aria-expanded="false" data-notification-button="true">
+                                    👤
+                                    <span class="user-notification-dot {% if unread_notification_count and unread_notification_count > 0 %}visible{% endif %}" aria-hidden="true"></span>
+                                </button>
+                                <ul class="dropdown-menu dropdown-menu-end" aria-labelledby="libUserMenuDropdown">
+                                    {% if current_permissions.pages.get('notifications_view', True) %}
+                                    <li><a class="dropdown-item" href="{{ url_for('notifications_view') }}">Benachrichtigungen</a></li>
+                                    {% endif %}
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('change_password') }}">Passwort ändern</a></li>
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li><a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a></li>
+                                </ul>
+                            </div>
+                        {% endif %}
+                    </div>
+                </div>
+            </div>
+        </nav>
+        {% endif %}
+
+    {% else %}
+    <nav class="navbar navbar-expand-lg navbar-dark" id="loginNavbar">
+        <div class="container-fluid">
+            <a class="navbar-brand py-0" href="{{ url_for('home') }}">
+                <img src="{{ url_for('static', filename='img/invario-logo.png') }}" alt="Invario" class="invario-logo">
+            </a>
+            <ul class="navbar-nav ms-auto mb-2 mb-lg-0">
+                <li class="nav-item">
+                    <a class="nav-link" href="{{ url_for('impressum') }}">Impressum</a>
+                </li>
+            </ul>
         </div>
     </nav>
     {% endif %}
@@ -1999,6 +2152,28 @@
             });
         });
     </script>
+    <script>
+        (function () {
+            const username = {{ (session['username'] if 'username' in session else '')|tojson }};
+            const tooltipModeKey = username ? ('inventarsystem_tutorial_tooltips_enabled_' + username) : 'inventarsystem_tutorial_tooltips_enabled';
+            const enabled = localStorage.getItem(tooltipModeKey) === '1';
+
+            function applyTooltipMode(active) {
+                document.body.classList.toggle('tutorial-tooltips-active', active);
+                let indicator = document.getElementById('tutorialTooltipIndicator');
+                if (!indicator) {
+                    indicator = document.createElement('div');
+                    indicator.id = 'tutorialTooltipIndicator';
+                    indicator.className = 'tutorial-tooltip-indicator';
+                    indicator.textContent = 'Tutorial-Modus aktiv: Tooltips sind eingeschaltet';
+                    document.body.appendChild(indicator);
+                }
+                indicator.style.display = active ? 'inline-flex' : 'none';
+            }
+
+            applyTooltipMode(enabled);
+        })();
+    </script>
 
 </body>
 </html>

Web/templates/login.html

@@ -14,6 +14,15 @@
 <div class="row justify-content-center">
     <div class="col-md-6">
         <h2 class="text-center">Login</h2>
+        {% if current_tenant_id or current_tenant_db %}
+        <div class="alert alert-info text-center small mb-4" role="alert">
+            {% if current_tenant_id %}
+                Aktiver Tenant: <strong>{{ current_tenant_id }}</strong> &middot; Datenbank: <strong>{{ current_tenant_db }}</strong>
+            {% else %}
+                Aktive Datenbank: <strong>{{ current_tenant_db }}</strong>
+            {% endif %}
+        </div>
+        {% endif %}
         <form method="POST" action="{{ url_for('login') }}">
             <div class="mb-3">
                 <label for="username" class="form-label">Username</label>

Web/templates/main.html

@@ -665,18 +665,30 @@
         // Set up schedule form submission
         setupScheduleFormSubmission();
         
-        // Fetch user status to get current username
-        fetch('/user_status')
-            .then(response => response.json())
-            .then(data => {
-                currentUsername = data.username;
+        // Fetch user status to get current username and full filter lists
+        Promise.all([
+            fetch('/user_status').then(response => response.json()),
+            fetch('/get_filter').then(response => response.json()),
+        ])
+            .then(([userData, filterData]) => {
+                currentUsername = userData.username;
+                if (filterData.filter1) {
+                    allFilter1Values = new Set(filterData.filter1.filter(value => value && typeof value === 'string' && value.trim() !== ''));
+                }
+                if (filterData.filter2) {
+                    allFilter2Values = new Set(filterData.filter2.filter(value => value && typeof value === 'string' && value.trim() !== ''));
+                }
+                if (filterData.filter3) {
+                    allFilter3Values = new Set(filterData.filter3.filter(value => value && typeof value === 'string' && value.trim() !== ''));
+                }
+
                 // Now load items with username information
                 loadItems();
                 // Setup card images display after a short delay to ensure items are loaded
                 setTimeout(setupCardImagesDisplay, 500);
             })
             .catch(error => {
-                console.error('Error fetching user status:', error);
+                console.error('Error fetching user status or filters:', error);
                 loadItems(); // Load items anyway in case of error
             });
 
@@ -721,6 +733,10 @@
         filter3: []
     };
 
+    let allFilter1Values = new Set();
+    let allFilter2Values = new Set();
+    let allFilter3Values = new Set();
+
     // Add this line to define allItems globally
     let allItems = [];
 
@@ -1083,10 +1099,10 @@
                     }
                 });
                 
-                // Populate filter options
-                populateFilterOptions('filter1-options', [...filter1Values].sort(), 1);
-                populateFilterOptions('filter2-options', [...filter2Values].sort(), 2);
-                populateFilterOptions('filter3-options', [...filter3Values].sort(), 3);
+                // Populate filter options using server-provided full filter lists when available.
+                populateFilterOptions('filter1-options', allFilter1Values.size ? [...allFilter1Values].sort() : [...filter1Values].sort(), 1);
+                populateFilterOptions('filter2-options', allFilter2Values.size ? [...allFilter2Values].sort() : [...filter2Values].sort(), 2);
+                populateFilterOptions('filter3-options', allFilter3Values.size ? [...allFilter3Values].sort() : [...filter3Values].sort(), 3);
                 
                 // Start display from leftmost position on full reload only.
                 if (!append) {

Web/templates/tutorial.html

@@ -189,6 +189,38 @@
     font-size: 1rem;
   }
 
+  .tutorial-tooltip-toggle {
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+    margin-top: 20px;
+    padding: 16px;
+    border-radius: 18px;
+    background: rgba(224, 242, 254, 0.9);
+    border: 1px solid #bae6fd;
+  }
+
+  .tutorial-tooltip-toggle label {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    font-weight: 700;
+    color: #0f172a;
+  }
+
+  .tutorial-tooltip-toggle input[type="checkbox"] {
+    width: 20px;
+    height: 20px;
+    accent-color: #2563eb;
+  }
+
+  .tooltip-description {
+    margin: 0;
+    color: #475569;
+    font-size: 0.95rem;
+    line-height: 1.5;
+  }
+
   .workflow-controls {
     display: flex;
     gap: 8px;
@@ -230,6 +262,13 @@
       <span class="tutorial-pill">Format: Ruhig und geführt</span>
       <span class="tutorial-pill">Benutzer: {{ username }}</span>
     </div>
+    <div class="tutorial-tooltip-toggle">
+      <label for="toggleTutorialTooltips">
+        <input type="checkbox" id="toggleTutorialTooltips" />
+        Tutorial-Tooltips für das gesamte System aktivieren
+      </label>
+      <p class="tooltip-description">Wenn aktiviert, erscheinen auf allen Seiten erklärende Hinweise und Icons für die wichtigsten Navigationselemente.</p>
+    </div>
   </section>
 
   <div class="tutorial-grid">
@@ -438,8 +477,32 @@
       renderStep();
     });
 
+    const tooltipToggle = document.getElementById('toggleTutorialTooltips');
+    const tooltipModeKey = 'inventarsystem_tutorial_tooltips_enabled_{{ username }}';
+
+    function setTooltipMode(enabled) {
+      localStorage.setItem(tooltipModeKey, enabled ? '1' : '0');
+      document.body.classList.toggle('tutorial-tooltips-active', enabled);
+    }
+
+    function loadTooltipMode() {
+      const saved = localStorage.getItem(tooltipModeKey);
+      const enabled = saved === '1';
+      if (tooltipToggle) {
+        tooltipToggle.checked = enabled;
+      }
+      setTooltipMode(enabled);
+    }
+
+    if (tooltipToggle) {
+      tooltipToggle.addEventListener('change', function () {
+        setTooltipMode(this.checked);
+      });
+    }
+
     loadState();
     renderStep();
+    loadTooltipMode();
   })();
 </script>
 {% endblock %}

Web/tenant.py

@@ -10,7 +10,10 @@ Each tenant can support up to 20+ users with isolated data and resource pools.
 from flask import request, g, has_request_context
 from functools import wraps
 import logging
+import os
+import re
 import settings as cfg
+from settings import MongoClient
 
 logger = logging.getLogger(__name__)
 
@@ -30,6 +33,61 @@ def _get_nested_value(source, path, default=None):
     return current
 
 
+def _parse_tenant_db_map():
+    mapping = {}
+    raw_map = os.getenv('INVENTAR_TENANT_DB_MAP', '').strip()
+    if not raw_map:
+        return mapping
+
+    for mapping_pair in re.split(r'[;,\s]+', raw_map):
+        if '=' not in mapping_pair:
+            continue
+        key, value = mapping_pair.split('=', 1)
+        mapping[key.strip()] = value.strip()
+
+    return mapping
+
+
+def _parse_port_from_host(host):
+    """Parse host header and return (hostname, port) when a numeric port is present."""
+    if host.startswith('['):
+        # IPv6 with port: [::1]:10000
+        if ']:' in host:
+            host_part, _, port_part = host.rpartition(']:')
+            return host_part + ']', port_part
+        return host, None
+
+    if host.count(':') == 1:
+        hostname, port = host.split(':', 1)
+        if port.isdigit():
+            return hostname, port
+
+    return host, None
+
+
+def _tenant_id_for_port(port):
+    """Map a host port to a registered tenant ID via tenant configs or env overrides."""
+    for tenant_id, config in TENANT_REGISTRY.items():
+        if isinstance(config, dict) and config.get('port') is not None:
+            try:
+                configured_port = str(int(config.get('port')))
+            except (TypeError, ValueError):
+                continue
+            if configured_port == str(port):
+                return tenant_id
+
+    port_map = os.getenv('INVENTAR_TENANT_PORT_MAP', '').strip()
+    if port_map:
+        for mapping in re.split(r'[;,\s]+', port_map):
+            if '=' not in mapping:
+                continue
+            key, value = mapping.split('=', 1)
+            if key.strip() == str(port):
+                return value.strip()
+
+    return None
+
+
 def get_tenant_config(tenant_id=None):
     """Return the registered config for a tenant, falling back to default."""
     if tenant_id is None:
@@ -42,6 +100,52 @@ def get_tenant_config(tenant_id=None):
     return TENANT_REGISTRY.get('default', {}) or {}
 
 
+def _normalize_db_name(db_name):
+    if not db_name:
+        return None
+    db_name = str(db_name).strip()
+    if db_name and not db_name.startswith('inventar_'):
+        db_name = f'inventar_{db_name}'
+    return db_name
+
+
+def _tenant_db_aliases(tenant_id):
+    aliases = []
+    env_map = _parse_tenant_db_map()
+    if tenant_id in env_map:
+        aliases.append(env_map[tenant_id])
+
+    if tenant_id.lower().startswith('schule'):
+        aliases.append(tenant_id.lower().replace('schule', 'school', 1))
+    elif tenant_id.lower().startswith('school'):
+        aliases.append(tenant_id.lower().replace('school', 'schule', 1))
+
+    return [alias for alias in aliases if alias]
+
+
+def _resolve_db_alias(tenant_id, db_name):
+    try:
+        client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
+        available_databases = client.list_database_names()
+        if db_name in available_databases:
+            return db_name
+
+        for alias in _tenant_db_aliases(tenant_id):
+            candidate = _normalize_db_name(alias)
+            if candidate in available_databases:
+                logger.warning(
+                    "Tenant DB fallback applied for tenant %r: %r -> %r",
+                    tenant_id,
+                    db_name,
+                    candidate,
+                )
+                return candidate
+    except Exception as exc:
+        logger.exception("Tenant DB alias resolution failed for %r: %s", tenant_id, exc)
+
+    return db_name
+
+
 def is_tenant_module_enabled(module_name, tenant_id=None, default=False):
     """Resolve whether a feature module is enabled for the current tenant."""
     config = get_tenant_config(tenant_id)
@@ -52,19 +156,20 @@ def is_tenant_module_enabled(module_name, tenant_id=None, default=False):
 class TenantContext:
     """
     Manages current tenant context for request lifecycle.
-    Automatically resolves tenant from subdomain or request header.
+    Automatically resolves tenant from port, header, or subdomain.
     """
 
     def __init__(self):
         self.tenant_id = None
         self.db_name = None
         self.subdomain = None
+        self.port = None
         self.config = {}
 
     def resolve_tenant(self):
         """
         Resolve tenant from request context.
-        Priority: Header > Subdomain > Default
+        Priority: Header > Port mapping > Subdomain > Default
         """
         if not has_request_context():
             return None
@@ -76,8 +181,23 @@ class TenantContext:
             self.config = get_tenant_config(tenant_from_header)
             return self._get_db_name(tenant_from_header)
 
-        # Priority 2: Subdomain extraction
+        # Priority 2: Port-based tenant mapping
         host = request.host.lower()
+        _, port = _parse_port_from_host(host)
+        self.port = port
+        logger.info(f"Tenant resolution start: request.host={host} request.headers={dict(request.headers)}")
+        if port:
+            tenant_from_port = _tenant_id_for_port(port)
+            if tenant_from_port:
+                self.tenant_id = tenant_from_port
+                self.config = get_tenant_config(tenant_from_port)
+                logger.info(
+                    f"Tenant resolution by port: host={host} port={port} tenant={tenant_from_port} config={self.config}"
+                )
+                return self._get_db_name(tenant_from_port)
+            logger.info(f"Tenant port not mapped: host={host} port={port}")
+
+        # Priority 3: Subdomain extraction
         parts = host.split('.')
 
         # Extract subdomain from host
@@ -91,21 +211,40 @@ class TenantContext:
                 self.subdomain = potential_subdomain
                 self.tenant_id = potential_subdomain
                 self.config = get_tenant_config(potential_subdomain)
+                logger.info(
+                    f"Tenant resolution by subdomain: host={host} tenant={potential_subdomain} config={self.config}"
+                )
                 return self._get_db_name(potential_subdomain)
+            logger.info(f"Tenant subdomain ignored: {potential_subdomain}")
 
-        # Fallback to default tenant if no subdomain detected
-        self.tenant_id = 'default'
-        self.config = get_tenant_config('default')
-        return self._get_db_name('default')
+        # Fallback to default tenant if no tenant identifier found.
+        # If no explicit 'default' tenant config exists, use configured MongoDB DB.
+        if 'default' in TENANT_REGISTRY:
+            self.tenant_id = 'default'
+            self.config = get_tenant_config('default')
+            return self._get_db_name('default')
+
+        self.tenant_id = None
+        self.config = {}
+        self.db_name = cfg.MONGODB_DB
+        return self.db_name
 
     def _get_db_name(self, tenant_id):
         """
         Get MongoDB database name for tenant.
-        Format: inventar_<tenant_id>
+        Format: inventar_<tenant_id> unless tenant config overrides it.
         """
-        # Sanitize tenant_id for MongoDB database name
-        sanitized = ''.join(c if c.isalnum() or c == '_' else '' for c in tenant_id.lower())
-        db_name = f"inventar_{sanitized}"
+        explicit_db = None
+        if isinstance(self.config, dict):
+            explicit_db = self.config.get('db') or self.config.get('db_name')
+
+        if explicit_db:
+            db_name = _normalize_db_name(explicit_db)
+        else:
+            sanitized = ''.join(c if c.isalnum() or c == '_' else '' for c in tenant_id.lower())
+            db_name = f"inventar_{sanitized}"
+
+        db_name = _resolve_db_alias(tenant_id, db_name)
         self.db_name = db_name
         return db_name
 
@@ -161,8 +300,8 @@ def get_tenant_db(mongo_client):
     ctx = get_tenant_context()
     if ctx:
         return ctx.get_database(mongo_client)
-    # Fallback to default database
-    return mongo_client['inventar_default']
+    # Fallback to configured default database
+    return mongo_client[cfg.MONGODB_DB]
 
 
 def register_tenant(tenant_id, config=None):

Web/user.py

@@ -12,11 +12,18 @@ Provides methods for creating, validating, and retrieving user information.
 '''
 import hashlib
 import copy
+import logging
 import re
+import secrets
+import string
 from bson.objectid import ObjectId
 import settings as cfg
 from settings import MongoClient
 
+logger = logging.getLogger('app')
+logger.setLevel(logging.DEBUG)
+logger.propagate = True
+
 
 def normalize_student_card_id(card_id):
     """Normalize student card IDs for reliable lookup."""
@@ -43,24 +50,33 @@ def _clean_name_fragment(value):
     return cleaned
 
 
+def _get_tenant_db(client):
+    """Return the current tenant database for the request, or fall back to default."""
+    try:
+        from tenant import get_tenant_db
+        return get_tenant_db(client)
+    except Exception:
+        return client[cfg.MONGODB_DB]
+
+
 def build_name_synonym(first_name, last_name=''):
-    """Build a deterministic, non-personalized short alias like 'SimFri'."""
+    """Build a deterministic, non-personalized short alias from 2 letters each."""
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
 
     if first and last:
-        return (first[:3] + last[:3]).title()
+        return (first[:2] + last[:2]).title()
 
     combined = (first + last)
     if not combined:
         return 'User'
-    return combined[:6].title()
+    return combined[:4].title()
 
 
 def build_username_from_name(first_name, last_name=''):
     """
     Build a deterministic username abbreviation from first and last name.
-    Uses the same short alias logic (e.g. SimFri) and stores it lowercase.
+    Uses 2 letters from each name and stores it lowercase.
     
     Args:
         first_name (str): First name
@@ -75,32 +91,23 @@ def build_username_from_name(first_name, last_name=''):
 
 def build_unique_username_from_name(first_name, last_name=''):
     """
-    Build a unique username based on the abbreviation logic.
-    If a collision occurs, increase the username by one additional letter
-    from the combined cleaned name until it is unique.
+    Build a unique username from the first 2 letters of the first name and
+    the first 2 letters of the last name.
     """
     first = _clean_name_fragment(first_name)
     last = _clean_name_fragment(last_name)
-    combined = (first + last).lower()
+    base_username = (first[:2] + last[:2]).lower()
 
-    base_username = build_username_from_name(first_name, last_name)
-    if not combined:
-        combined = base_username or 'user'
+    if not base_username:
+        base_username = 'user'
 
-    start_len = len(base_username) if base_username else min(6, len(combined))
-    start_len = max(1, min(start_len, len(combined)))
+    if not get_user(base_username):
+        return base_username
 
-    # Main strategy: take one more letter on each collision.
-    for length in range(start_len, len(combined) + 1):
-        candidate = combined[:length]
-        if not get_user(candidate):
-            return candidate
-
-    # Fallback if full combined name is already taken repeatedly.
     suffix = 2
-    while get_user(f"{combined}{suffix}"):
+    while get_user(f"{base_username}{suffix}"):
         suffix += 1
-    return f"{combined}{suffix}"
+    return f"{base_username}{suffix}"
 
 
 ACTION_PERMISSION_KEYS = (
@@ -310,7 +317,7 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
     }
 
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     result = users.update_one({'Username': username}, {'$set': update_data})
 
@@ -325,7 +332,7 @@ def update_user_permissions(username, preset_key, action_permissions=None, page_
 def get_favorites(username):
     """Return a list of favorite item ObjectId strings for the user."""
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username}) or users.find_one({'username': username})
     client.close()
@@ -339,7 +346,7 @@ def add_favorite(username, item_id):
     """Add an item to user's favorites (idempotent)."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
             {'$or': [{'Username': username}, {'username': username}]},
@@ -354,7 +361,7 @@ def remove_favorite(username, item_id):
     """Remove an item from user's favorites."""
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         users.update_one(
             {'$or': [{'Username': username}, {'username': username}]},
@@ -417,13 +424,81 @@ def check_nm_pwd(username, password):
     Returns:
         dict: User document if credentials are valid, None otherwise
     """
+    db_name = cfg.MONGODB_DB
+    tenant_db = None
+    ctx = None
+    try:
+        from tenant import get_tenant_context
+        ctx = get_tenant_context()
+        if ctx and ctx.tenant_id:
+            tenant_db = ctx.db_name or ctx.resolve_tenant()
+            db_name = tenant_db
+    except Exception as exc:
+        logger.exception(f"Failed to resolve tenant context in check_nm_pwd: {exc}")
+
+    logger.info(
+        "check_nm_pwd start: username=%r tenant=%r db=%r host=%r port=%r uri=%r",
+        username,
+        ctx.tenant_id if ctx else None,
+        db_name,
+        cfg.MONGODB_HOST,
+        cfg.MONGODB_PORT,
+        getattr(cfg, 'MONGODB_URI', None),
+    )
+
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
-    users = db['users']
-    hashed_password = hashlib.sha512(password.encode()).hexdigest()
-    user = users.find_one({'Username': username, 'Password': hashed_password})
-    client.close()
-    return user
+    try:
+        hashed_password = hashing(password)
+        logger.info("check_nm_pwd password hash for username=%r: %s", username, hashed_password)
+        available_dbs = []
+        try:
+            available_dbs = client.list_database_names()
+            logger.debug("MongoDB connected. Available databases=%s", available_dbs)
+        except Exception as exc:
+            logger.exception("Unable to list MongoDB databases: %s", exc)
+
+        db = client[db_name]
+        try:
+            existing_collections = db.list_collection_names()
+        except Exception as exc:
+            logger.exception("Unable to list collections for db=%r: %s", db_name, exc)
+            existing_collections = []
+        logger.debug("Tenant db=%r collections=%s", db_name, existing_collections)
+
+        users = db['users']
+        query = {'$or': [{'Username': username}, {'username': username}]}
+        logger.debug("Running user lookup on %r: %s", db_name, query)
+        user_record = users.find_one(query)
+
+        if user_record is None:
+            logger.warning("No user document found in db=%r for username=%r", db_name, username)
+            if db_name not in available_dbs:
+                logger.warning("Tenant database %r is missing from available MongoDB databases", db_name)
+            if 'users' not in existing_collections:
+                logger.warning("Tenant database %r has no users collection", db_name)
+            return None
+
+        logger.info("Found user document for username=%r in db=%r: %s", username, db_name, user_record)
+        stored_password = user_record.get('Password') or user_record.get('password')
+        if stored_password is None:
+            logger.warning("User document for username=%r in db=%r has no password field", username, db_name)
+            return None
+
+        if stored_password != hashed_password:
+            logger.warning(
+                "Password mismatch for username=%r in db=%r: provided_hash=%s stored_hash=%s",
+                username,
+                db_name,
+                hashed_password,
+                stored_password,
+            )
+            return None
+
+        return user_record
+    finally:
+        client.close()
+
+    return None
 
 
 def add_user(
@@ -449,7 +524,7 @@ def add_user(
         bool: True if user was added successfully, False if password was too weak
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     if not check_password_strength(password):
         return False
@@ -471,7 +546,7 @@ def add_user(
         'Admin': False,
         'active_ausleihung': None,
         'name': name_alias,
-        'last_name': '',
+        'last_name': last_name.strip() if last_name else '',
         'IsStudent': bool(is_student),
         'PermissionPreset': permission_defaults['preset'],
         'ActionPermissions': permission_defaults['actions'],
@@ -499,7 +574,7 @@ def student_card_exists(student_card_id):
     if not normalized:
         return False
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     exists = users.find_one({'StudentCardId': normalized}) is not None
     client.close()
@@ -512,7 +587,7 @@ def get_user_by_student_card(student_card_id):
     if not normalized:
         return None
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     found_user = users.find_one({'StudentCardId': normalized})
     client.close()
@@ -530,11 +605,13 @@ def make_admin(username):
         bool: True if user was promoted successfully
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
-    users.update_one({'Username': username}, {'$set': {'Admin': True}})
+    result = users.update_one({'Username': username}, {'$set': {'Admin': True}})
+    if result.matched_count == 0:
+        result = users.update_one({'username': username}, {'$set': {'Admin': True}})
     client.close()
-    return True
+    return result.matched_count > 0
 
 def remove_admin(username):
     """
@@ -547,11 +624,13 @@ def remove_admin(username):
         bool: True if user was demoted successfully
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
-    users.update_one({'Username': username}, {'$set': {'Admin': False}})
+    result = users.update_one({'Username': username}, {'$set': {'Admin': False}})
+    if result.matched_count == 0:
+        result = users.update_one({'username': username}, {'$set': {'Admin': False}})
     client.close()
-    return True
+    return result.matched_count > 0
 
 def get_user(username):
     """
@@ -564,11 +643,31 @@ def get_user(username):
         dict: User document or None if not found
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
-    users = db['users']
-    users_return = users.find_one({'Username': username})
-    client.close()
-    return users_return
+    try:
+        def find_in_db(database_name):
+            db = client[database_name]
+            users = db['users']
+            return users.find_one({'Username': username}) or users.find_one({'username': username})
+
+        # Try current tenant first when available
+        try:
+            from tenant import get_tenant_context
+            ctx = get_tenant_context()
+            if ctx and ctx.db_name:
+                user = find_in_db(ctx.db_name)
+                if user:
+                    return user
+        except Exception:
+            pass
+
+        # Fallback to default configured database
+        user = find_in_db(cfg.MONGODB_DB)
+        if user:
+            return user
+
+        return None
+    finally:
+        client.close()
 
 
 def check_admin(username):
@@ -581,12 +680,8 @@ def check_admin(username):
     Returns:
         bool: True if user is an administrator, False otherwise
     """
-    client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
-    users = db['users']
-    user = users.find_one({'Username': username})
-    client.close()
-    return user and user.get('Admin', False)
+    user = get_user(username)
+    return bool(user and user.get('Admin', False))
 
 
 def update_active_ausleihung(username, id_item, ausleihung):
@@ -602,7 +697,7 @@ def update_active_ausleihung(username, id_item, ausleihung):
         bool: True if successful
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     users.update_one({'Username': username}, {'$set': {'active_ausleihung': {'Item': id_item, 'Ausleihung': ausleihung}}})
     client.close()
@@ -620,7 +715,7 @@ def get_active_ausleihung(username):
         dict: Active borrowing information or None
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username})
     return user['active_ausleihung']
@@ -638,7 +733,7 @@ def has_active_borrowing(username):
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         
         user = users.find_one({'username': username})
@@ -669,14 +764,14 @@ def delete_user(username):
         bool: True if user was deleted successfully, False otherwise
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     result = users.delete_one({'username': username})
     client.close()
     if result.deleted_count == 0:
         # Try with different field name
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         result = users.delete_one({'Username': username})
         client.close()
@@ -698,7 +793,7 @@ def update_active_borrowing(username, item_id, status):
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         result = users.update_one(
             {'username': username}, 
@@ -731,7 +826,7 @@ def get_name(username):
         str: String of name
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username})
     name = user.get("name")
@@ -746,7 +841,7 @@ def get_last_name(username):
         str: String of last_name
     """
     client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
+    db = _get_tenant_db(client)
     users = db['users']
     user = users.find_one({'Username': username})
     name = user.get("last_name")
@@ -763,7 +858,7 @@ def get_all_users():
     """
     try:
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         all_users = list(users.find())
         client.close()
@@ -787,7 +882,7 @@ def update_password(username, new_password):
             return False
             
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         
         # Hash the new password
@@ -820,7 +915,7 @@ def update_user_name(username, name, last_name):
     try:
         name_alias = build_name_synonym(name, last_name)
         client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        db = client[cfg.MONGODB_DB]
+        db = _get_tenant_db(client)
         users = db['users']
         
         result = users.update_one(

Web/verify_audit_chain.py

@@ -4,9 +4,8 @@
 import json
 import sys
 
-from pymongo import MongoClient
-
 import settings as cfg
+from settings import MongoClient
 import audit_log as al
 
 

archive-logs.sh

@@ -1,144 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Monthly log archival script for Inventarsystem
-# Runs on first day of month during automatic update
-# Compresses logs to tar.gz, stores for up to 1 year, removes uncompressed originals
-
-PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-LOG_DIR="$PROJECT_DIR/logs"
-ARCHIVE_BASE_DIR="$PROJECT_DIR/backups/logs_archive"
-LOG_ARCHIVE_FILE="$LOG_DIR/archive-logs.log"
-GUARD_FILE="$PROJECT_DIR/.last-log-archive"
-COMPRESSION_LEVEL="${COMPRESSION_LEVEL:-9}"
-
-# Ensure archive base directory exists
-mkdir -p "$ARCHIVE_BASE_DIR"
-chmod 755 "$ARCHIVE_BASE_DIR" 2>/dev/null || true
-
-log_message() {
-    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_ARCHIVE_FILE"
-}
-
-should_archive_logs() {
-    local today month_day guard_date
-    
-    today="$(date +%Y-%m-%d)"
-    month_day="$(date +%d)"
-    
-    # Only run on first day of month
-    if [ "$month_day" != "01" ]; then
-        return 1
-    fi
-    
-    # Check if we already ran today
-    if [ -f "$GUARD_FILE" ]; then
-        guard_date="$(cat "$GUARD_FILE" 2>/dev/null || echo '')"
-        if [ "$guard_date" = "$today" ]; then
-            log_message "Log archive already executed today ($today). Skipping."
-            return 1
-        fi
-    fi
-    
-    return 0
-}
-
-archive_application_logs() {
-    local archive_name archive_path retention_days cleanup_count deleted_count
-    
-    if [ ! -d "$LOG_DIR" ] || [ -z "$(find "$LOG_DIR" -maxdepth 1 -type f -name '*.log' 2>/dev/null)" ]; then
-        log_message "No log files found in $LOG_DIR. Nothing to archive."
-        return 0
-    fi
-    
-    archive_name="inventar_logs_$(date +%Y-%m-01_%H%M%S)"
-    archive_path="$ARCHIVE_BASE_DIR/${archive_name}.tar.gz"
-    
-    log_message "Starting monthly log archival..."
-    log_message "Archive destination: $archive_path"
-    
-    # Create temporary directory for prepping files
-    local tmp_prep_dir
-    tmp_prep_dir="$(mktemp -d)"
-    trap 'rm -rf "${tmp_prep_dir:-}"' RETURN
-    
-    # Copy log files to temp directory (excluding archive log itself during copy)
-    if ! find "$LOG_DIR" -maxdepth 1 -type f -name '*.log' ! -name 'archive-logs.log' -exec cp {} "$tmp_prep_dir/" \; 2>/dev/null; then
-        log_message "WARNING: Could not copy all log files to temp directory"
-    fi
-    
-    # Create tar.gz archive
-    if tar -czf "$archive_path" -C "$tmp_prep_dir" . 2>/dev/null; then
-        log_message "Log archive created successfully: $archive_path"
-        log_message "Archive size: $(du -h "$archive_path" | cut -f1)"
-    else
-        log_message "ERROR: Failed to create log archive"
-        return 1
-    fi
-    
-    # Remove uncompressed log files (keep archive-logs.log for continuity)
-    log_message "Removing uncompressed log files..."
-    local files_removed=0
-    while IFS= read -r log_file; do
-        if [ "$log_file" != "$LOG_ARCHIVE_FILE" ]; then
-            rm -f "$log_file" && ((++files_removed)) || true
-        fi
-    done < <(find "$LOG_DIR" -maxdepth 1 -type f -name '*.log')
-    log_message "Removed $files_removed uncompressed log file(s)"
-    
-    trap - RETURN
-}
-
-cleanup_old_archives() {
-    local retention_days cleanup_count deleted_count total_archives
-    
-    retention_days="365"
-    
-    # Find and remove archives older than 1 year
-    log_message "Cleaning up archives older than $retention_days days..."
-    
-    total_archives="$(find "$ARCHIVE_BASE_DIR" -maxdepth 1 -type f -name '*.tar.gz' 2>/dev/null | wc -l)"
-    deleted_count="0"
-    
-    find "$ARCHIVE_BASE_DIR" -maxdepth 1 -type f -name '*.tar.gz' -mtime +$retention_days | while read -r old_archive; do
-        log_message "Removing old archive: $old_archive"
-        rm -f "$old_archive"
-        ((++deleted_count)) || true
-    done 2>/dev/null || true
-    
-    # Count deleted (safer approach)
-    local current_archives
-    current_archives="$(find "$ARCHIVE_BASE_DIR" -maxdepth 1 -type f -name '*.tar.gz' 2>/dev/null | wc -l)"
-    deleted_count="$((total_archives - current_archives))"
-    
-    if [ "$deleted_count" -gt 0 ]; then
-        log_message "Deleted $deleted_count old archive(s); kept $current_archives"
-    else
-        log_message "No old archives to delete (total: $total_archives)"
-    fi
-}
-
-main() {
-    if ! should_archive_logs; then
-        return 0
-    fi
-    
-    log_message "=== Monthly log archival started ==="
-    
-    archive_application_logs || {
-        log_message "ERROR: Log archival failed"
-        return 1
-    }
-    
-    cleanup_old_archives || {
-        log_message "WARNING: Archive cleanup encountered issues"
-    }
-    
-    # Update guard file with today's date
-    date +%Y-%m-%d > "$GUARD_FILE"
-    
-    log_message "=== Monthly log archival completed successfully ==="
-    return 0
-}
-
-main "$@"

backup.sh

@@ -1,536 +1,161 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# ========================================================
-# Inventarsystem backup helper
-# - Creates a dated backup folder/archive under /var/backups (by default)
-# - Exports MongoDB via run-backup.sh into mongodb_backup/
-# - Cleans up backups older than KEEP_DAYS
-#
-# Options:
-#   --dest|--out|--backup-dir <dir>   Destination base directory (default: /var/backups)
-#   --db|--db-name <name>             MongoDB database name (default: Inventarsystem)
-#   --uri|--mongo-uri <uri>           MongoDB URI (default: mongodb://localhost:27017/)
-#   --invoice-archive-dir <dir>       Invoice archive directory (default: <dest>/invoice-archive)
-#   --invoice-keep-days <N>           Retention for invoice archive in days (default: 3650)
-#   --log <file>                      Log file (default: ./logs/backup.log)
-#   --no-compress                     Disable compression (keeps directory instead of .tar.gz)
-#   --compress-level <0-9>            Compression level flag (only 0 is special here)
-#   --keep-days <N>                   Age-based retention in days (default: 7; 0 disables age filter)
-#   --min-keep <N>                    Always keep at least N most recent backups (default: 7)
-#   --mode <auto|host|docker>         Backup mode (default: auto)
-#   -h|--help                         Show help
-# ========================================================
-
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_DIR="${PROJECT_DIR:-$SCRIPT_DIR}"
-# Default destination now /var/backups; override with --dest or BACKUP_BASE_DIR env
-BACKUP_BASE_DIR="${BACKUP_BASE_DIR:-/var/backups}"
-LOG_DIR="$PROJECT_DIR/logs"
-# Create only the log directory here; backup dir is created later with sudo if needed
-mkdir -p "$LOG_DIR"
-LOG_FILE="${LOG_FILE:-$LOG_DIR/backup.log}"
-COMPRESSION_LEVEL="${COMPRESSION_LEVEL:-9}"
-KEEP_DAYS="${KEEP_DAYS:-7}"
-MIN_KEEP="${MIN_KEEP:-7}"
-DB_NAME="${DB_NAME:-inventar_default}"
-MONGO_URI="${MONGO_URI:-mongodb://localhost:27017/}"
-INVOICE_KEEP_DAYS="${INVOICE_KEEP_DAYS:-3650}"
-INVOICE_ARCHIVE_DIR="${INVOICE_ARCHIVE_DIR:-$BACKUP_BASE_DIR/invoice-archive}"
-BACKUP_MODE="${BACKUP_MODE:-auto}"
-COMPOSE_FILE="${COMPOSE_FILE:-docker-compose-multitenant.yml}"
-DOCKER_AVAILABLE=0
-DOCKER_COMPOSE_CMD=()
-USE_NULL_OUTPUT=false
+COMPOSE_FILE="docker-compose-multitenant.yml"
+INVOICE_ARCHIVE_DIR="${INVOICE_ARCHIVE_DIR:-/var/backups/invoice-archive}"
+KEEP_DAYS="${INVOICE_KEEP_DAYS:-3650}"
+MODE="auto"
+BASE_NAME=""
 
 usage() {
     cat <<EOF
-Usage: $(basename "$0") [options]
+Usage: $0 [options]
 
 Options:
-  --dest|--out|--backup-dir <dir>   Destination base directory (default: $BACKUP_BASE_DIR)
-  --db|--db-name <name>             MongoDB database name (default: $DB_NAME)
-  --uri|--mongo-uri <uri>           MongoDB URI (default: $MONGO_URI)
-    --invoice-archive-dir <dir>       Invoice archive directory (default: $INVOICE_ARCHIVE_DIR)
-    --invoice-keep-days <N>           Retention for invoice archive in days (default: $INVOICE_KEEP_DAYS)
-  --log <file>                      Log file (default: $LOG_FILE)
-  --no-compress                     Disable compression (keeps directory instead of .tar.gz)
-  --compress-level <0-9>            Compression level flag (only 0 is special here)
-    --keep-days <N>                   Age-based retention in days (default: $KEEP_DAYS; 0 disables age filter)
-    --min-keep <N>                    Always keep at least this many backups (default: $MIN_KEEP)
-    --mode <auto|host|docker>         Backup mode (default: $BACKUP_MODE)
-    --multitenant                     Use docker-compose-multitenant.yml (default)
-    --singletenant                    Use docker-compose.yml
-  -h|--help                         Show this help and exit
+  --invoice-archive-dir DIR   Directory for invoice archive files
+                              (default: $INVOICE_ARCHIVE_DIR)
+  --invoice-keep-days N       Remove archived invoice files older than N days
+                              (default: $KEEP_DAYS)
+  --mode auto|docker|host     Backup mode (default: auto)
+  --base-name NAME            Base filename prefix for archive files
+  -h, --help                  Show this help message
 EOF
 }
 
-# Parse CLI arguments
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --dest|--out|--backup-dir)
-            BACKUP_BASE_DIR="$2"; shift 2;;
-        --db|--db-name)
-            DB_NAME="$2"; shift 2;;
-        --uri|--mongo-uri)
-            MONGO_URI="$2"; shift 2;;
-        --invoice-archive-dir)
-            INVOICE_ARCHIVE_DIR="$2"; shift 2;;
-        --invoice-keep-days)
-            INVOICE_KEEP_DAYS="$2"; shift 2;;
-        --log)
-            LOG_FILE="$2"; shift 2;;
-        --no-compress)
-            COMPRESSION_LEVEL=0; shift;;
-        --compress-level)
-            COMPRESSION_LEVEL="${2:-6}"; shift 2;;
-        --keep-days)
-            KEEP_DAYS="$2"; shift 2;;
-        --min-keep)
-            MIN_KEEP="$2"; shift 2;;
-        --mode)
-            BACKUP_MODE="$2"; shift 2;;
-        --multitenant)
-            COMPOSE_FILE="docker-compose-multitenant.yml"; shift;;
-        --singletenant)
-            COMPOSE_FILE="docker-compose.yml"; shift;;
-        -h|--help)
-            usage; exit 0;;
-        *)
-            echo "Unknown option: $1" >&2; usage; exit 2;;
-    esac
-done
-
-# Function to log messages
-log_message() {
-    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" 2>/dev/null || echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
+parse_args() {
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --invoice-archive-dir)
+                INVOICE_ARCHIVE_DIR="$2"
+                shift 2
+                ;;
+            --invoice-keep-days)
+                KEEP_DAYS="$2"
+                shift 2
+                ;;
+            --mode)
+                MODE="$2"
+                shift 2
+                ;;
+            --base-name)
+                BASE_NAME="$2"
+                shift 2
+                ;;
+            -h|--help)
+                usage
+                exit 0
+                ;;
+            *)
+                echo "Error: unknown option '$1'" >&2
+                usage
+                exit 2
+                ;;
+        esac
+    done
 }
 
-init_docker_compose() {
-    if docker compose version >/dev/null 2>&1; then
-        DOCKER_AVAILABLE=1
-        DOCKER_COMPOSE_CMD=(docker compose -f "$PROJECT_DIR/$COMPOSE_FILE")
-        return 0
-    fi
-    if sudo docker compose version >/dev/null 2>&1; then
-        DOCKER_AVAILABLE=1
-        DOCKER_COMPOSE_CMD=(sudo docker compose -f "$PROJECT_DIR/$COMPOSE_FILE")
-        return 0
-    fi
-
-    DOCKER_AVAILABLE=0
-    DOCKER_COMPOSE_CMD=()
-    return 1
+ensure_directory() {
+    mkdir -p "$INVOICE_ARCHIVE_DIR"
 }
 
-compose_cmd() {
-    if [ "$DOCKER_AVAILABLE" -ne 1 ]; then
+cleanup_old_archives() {
+    if [[ -n "$KEEP_DAYS" ]]; then
+        find "$INVOICE_ARCHIVE_DIR" -maxdepth 1 -type f \( -name 'invoices-*.jsonl' -o -name 'invoices-*.csv' -o -name 'invoices-*.meta.json' \) -mtime +"$KEEP_DAYS" -print -delete || true
+    fi
+}
+
+host_backup() {
+    if ! command -v python3 >/dev/null 2>&1; then
         return 1
     fi
-    "${DOCKER_COMPOSE_CMD[@]}" "$@"
-}
-
-try_backup_db_docker() {
-    local out_dir="$1"
-    local stamp
-    stamp="$(date +"%Y-%m-%d_%H-%M-%S")"
-    local archive_path="$out_dir/mongodb-${stamp}.archive.gz"
-
-    [ "$DOCKER_AVAILABLE" -eq 1 ] || return 1
-
-    log_message "Attempting Docker-based MongoDB backup..."
-    compose_cmd up -d mongodb >/dev/null 2>&1 || return 1
-    if ! compose_cmd ps --status running mongodb | grep -q mongodb; then
+    if ! python3 -c 'import pymongo' >/dev/null 2>&1; then
         return 1
     fi
 
-    if compose_cmd exec -T mongodb sh -c "mongodump --archive --gzip --db '$DB_NAME'" > "$archive_path"; then
-        log_message "Docker DB backup successful: $archive_path"
-        return 0
-    fi
-    return 1
+    python3 "$SCRIPT_DIR/Web/backup_invoices.py" \
+        --archive-dir "$INVOICE_ARCHIVE_DIR" \
+        --base-name "$BASE_NAME"
 }
 
-try_backup_invoices_docker() {
-    local archive_base="$1"
-    [ "$DOCKER_AVAILABLE" -eq 1 ] || return 1
-
-    local tmp_base
-    tmp_base="/tmp/$(basename "$archive_base")"
-
-    log_message "Attempting Docker-based invoice archive export..."
-    compose_cmd up -d mongodb app >/dev/null 2>&1 || return 1
-    if ! compose_cmd ps --status running app | grep -q app; then
+docker_backup() {
+    if ! command -v docker >/dev/null 2>&1; then
+        return 1
+    fi
+    if ! docker compose -f "$COMPOSE_FILE" ps -q app >/dev/null 2>&1; then
         return 1
     fi
 
-    local app_cid
-    app_cid="$(compose_cmd ps -q app)"
-    [ -n "$app_cid" ] || return 1
-
-    if ! sudo docker cp "$PROJECT_DIR/Backup-Invoices.py" "$app_cid:/tmp/Backup-Invoices.py" >/dev/null 2>&1; then
+    local app_container
+    app_container="$(docker compose -f "$COMPOSE_FILE" ps -q app | tr -d '[:space:]')"
+    if [[ -z "$app_container" ]]; then
         return 1
     fi
 
-    if ! compose_cmd exec -T app python /tmp/Backup-Invoices.py \
-        --uri "mongodb://mongodb:27017/" \
-        --db "$DB_NAME" \
-        --out "$tmp_base" >/dev/null 2>&1; then
-        return 1
-    fi
-
-    sudo docker cp "$app_cid:${tmp_base}.jsonl" "${archive_base}.jsonl" >/dev/null 2>&1 || return 1
-    sudo docker cp "$app_cid:${tmp_base}.csv" "${archive_base}.csv" >/dev/null 2>&1 || return 1
-    sudo docker cp "$app_cid:${tmp_base}.meta.json" "${archive_base}.meta.json" >/dev/null 2>&1 || return 1
-
-    compose_cmd exec -T app sh -c "rm -f /tmp/Backup-Invoices.py ${tmp_base}.jsonl ${tmp_base}.csv ${tmp_base}.meta.json" >/dev/null 2>&1 || true
-    return 0
-}
-
-backup_invoices_archive() {
-    log_message "Starting invoice archive export..."
-
-    # Ensure archive dir exists and is writable
-    if [ ! -d "$INVOICE_ARCHIVE_DIR" ]; then
-        sudo mkdir -p "$INVOICE_ARCHIVE_DIR"
-        sudo chmod 755 "$INVOICE_ARCHIVE_DIR"
-    fi
-
     local timestamp
-    timestamp="$(date +"%Y-%m-%d_%H-%M-%S")"
-    local archive_base
-    archive_base="$INVOICE_ARCHIVE_DIR/invoices-$timestamp"
+    timestamp="$(date +'%Y-%m-%d_%H-%M-%S')"
+    local output_dir
+    local remote_base
 
-    local py_exec
-    if [ -x "$PROJECT_DIR/.venv/bin/python" ]; then
-        py_exec="$PROJECT_DIR/.venv/bin/python"
-    else
-        py_exec="python3"
-    fi
+    output_dir="/tmp/invoice_archive_${timestamp}"
+    remote_base="${output_dir}/${BASE_NAME}"
 
-    local host_invoice_ok=0
-    local prefer_docker_invoice=0
-    if [ "$BACKUP_MODE" = "auto" ] && [ "$DOCKER_AVAILABLE" -eq 1 ] && [ "$MONGO_URI" = "mongodb://localhost:27017/" ]; then
-        prefer_docker_invoice=1
-        log_message "Auto mode: preferring Docker invoice archive export"
-    fi
+    docker compose -f "$COMPOSE_FILE" exec -T app mkdir -p "$output_dir"
+    docker compose -f "$COMPOSE_FILE" exec -T app python3 /app/Web/backup_invoices.py \
+        --archive-dir "$output_dir" \
+        --base-name "$BASE_NAME"
 
-    if [ "$BACKUP_MODE" != "docker" ] && [ "$prefer_docker_invoice" -ne 1 ]; then
-        if [ "${USE_NULL_OUTPUT:-false}" = true ]; then
-            if sudo -E "$py_exec" "$PROJECT_DIR/Backup-Invoices.py" --uri "$MONGO_URI" --db "$DB_NAME" --out "$archive_base" > /dev/null 2>&1; then
-                host_invoice_ok=1
-            fi
-        else
-            if sudo -E "$py_exec" "$PROJECT_DIR/Backup-Invoices.py" --uri "$MONGO_URI" --db "$DB_NAME" --out "$archive_base" >> "$PROJECT_DIR/logs/Backup_db.log" 2>&1; then
-                host_invoice_ok=1
-            fi
-        fi
-    fi
+    mkdir -p "$INVOICE_ARCHIVE_DIR"
+    docker cp "$app_container":"${remote_base}.jsonl" "$INVOICE_ARCHIVE_DIR/"
+    docker cp "$app_container":"${remote_base}.csv" "$INVOICE_ARCHIVE_DIR/"
+    docker cp "$app_container":"${remote_base}.meta.json" "$INVOICE_ARCHIVE_DIR/"
 
-    if [ "$host_invoice_ok" -ne 1 ]; then
-        if [ "$BACKUP_MODE" = "host" ]; then
-            log_message "ERROR: Failed to export invoice archive in host mode"
-            return 1
-        fi
-        if ! try_backup_invoices_docker "$archive_base"; then
-            log_message "ERROR: Failed to export invoice archive"
-            return 1
-        fi
-    fi
-
-    sudo chmod 640 "$archive_base".jsonl "$archive_base".csv "$archive_base".meta.json 2>/dev/null || true
-    log_message "Invoice archive written: $archive_base.(jsonl|csv|meta.json)"
-
-    # Retention cleanup for invoice archive (default: 10 years)
-    if [ "$INVOICE_KEEP_DAYS" -gt 0 ]; then
-        local deleted_count=0
-        while IFS= read -r old_file; do
-            [ -z "$old_file" ] && continue
-            if sudo rm -f "$old_file"; then
-                deleted_count=$((deleted_count + 1))
-            fi
-        done < <(find "$INVOICE_ARCHIVE_DIR" -maxdepth 1 -type f \
-            \( -name 'invoices-*.jsonl' -o -name 'invoices-*.csv' -o -name 'invoices-*.meta.json' \) \
-            -mtime +"$INVOICE_KEEP_DAYS" -print 2>/dev/null)
-
-        log_message "Invoice archive cleanup complete (retention: $INVOICE_KEEP_DAYS days, deleted files: $deleted_count)"
-    fi
-
-    return 0
+    docker compose -f "$COMPOSE_FILE" exec -T app rm -rf "$output_dir"
 }
 
-# Function to create backup
-create_backup() {
-    log_message "Starting backup process..."
-    
-    # Create date-formatted directory name
-    CURRENT_DATE=$(date +"%Y-%m-%d")
-    BACKUP_NAME="Inventarsystem-$CURRENT_DATE"
-    BACKUP_DIR="$BACKUP_BASE_DIR/$BACKUP_NAME"
-    BACKUP_ARCHIVE="$BACKUP_BASE_DIR/$BACKUP_NAME.tar.gz"
-    
-    # Create backup directory if it doesn't exist
-    if [ ! -d "$BACKUP_BASE_DIR" ]; then
-        sudo mkdir -p "$BACKUP_BASE_DIR"
-        sudo chmod 755 "$BACKUP_BASE_DIR"
-    fi
-    
-    # Remove existing backup with same date if it exists
-    if [ -d "$BACKUP_DIR" ]; then
-        log_message "Removing existing backup directory at $BACKUP_DIR"
-        sudo rm -rf "$BACKUP_DIR"
-    fi
-    
-    if [ -f "$BACKUP_ARCHIVE" ]; then
-        log_message "Removing existing backup archive at $BACKUP_ARCHIVE"
-        sudo rm -f "$BACKUP_ARCHIVE"
-    fi
-    
-    # Create a temporary directory for backup
-    log_message "Creating backup at $BACKUP_DIR"
-    sudo mkdir -p "$BACKUP_DIR"
-    # Copy project files excluding the backups directory itself (and optionally the venv)
-    if command -v rsync >/dev/null 2>&1; then
-        sudo rsync -a \
-            --exclude='backups' \
-            --exclude='.venv' \
-            "$PROJECT_DIR"/ "$BACKUP_DIR"/
-    else
-        # Fallback to cp while skipping the backups directory
-        for entry in "$PROJECT_DIR"/*; do
-            name=$(basename "$entry")
-            [[ "$name" == "backups" || "$name" == ".venv" ]] && continue
-            sudo cp -r "$entry" "$BACKUP_DIR/"
-        done
-    fi
-    
-    # Create database backup
-    log_message "Running database backup..."
-    # Create mongodb_backup directory with appropriate permissions first
-    sudo mkdir -p "$BACKUP_DIR/mongodb_backup"
-    sudo chmod 755 "$BACKUP_DIR/mongodb_backup"
-
-    # Run database backup with our helper script
-    log_message "Executing database backup script..."
-    db_backup_ok=0
-    use_host_db_backup=1
-    if [ "$BACKUP_MODE" = "docker" ]; then
-        use_host_db_backup=0
-    elif [ "$BACKUP_MODE" = "auto" ] && [ "$DOCKER_AVAILABLE" -eq 1 ] && [ "$MONGO_URI" = "mongodb://localhost:27017/" ]; then
-        use_host_db_backup=0
-        log_message "Auto mode: preferring Docker DB backup"
+main() {
+    if [[ -z "$BASE_NAME" ]]; then
+        BASE_NAME="invoices-$(date +'%Y-%m-%d_%H-%M-%S')"
     fi
 
-    if [ "$use_host_db_backup" -eq 1 ]; then
-        # Create Backup_db.log and ensure it's writable only when host mode is used
-        touch "$PROJECT_DIR/logs/Backup_db.log" 2>/dev/null
-        chmod 666 "$PROJECT_DIR/logs/Backup_db.log" 2>/dev/null || {
-            log_message "WARNING: Failed to set permissions on Backup_db.log. Trying with sudo..."
-            sudo touch "$PROJECT_DIR/logs/Backup_db.log" 2>/dev/null
-            sudo chmod 666 "$PROJECT_DIR/logs/Backup_db.log" 2>/dev/null || {
-                log_message "WARNING: Failed to create writable Backup_db.log. Redirecting output to /dev/null instead."
-                USE_NULL_OUTPUT=true
-            }
-        }
+    ensure_directory
 
-        # Install pymongo only for host backups
-        log_message "Checking pymongo installation..."
-        if ! python3 -c "import pymongo" &>/dev/null; then
-            log_message "Installing pymongo..."
-            if [ -f "$PROJECT_DIR/.venv/bin/pip" ]; then
-                if [ "$USE_NULL_OUTPUT" = true ]; then
-                    "$PROJECT_DIR/.venv/bin/pip" install pymongo==4.6.3 > /dev/null 2>&1 || true
-                else
-                    "$PROJECT_DIR/.venv/bin/pip" install pymongo==4.6.3 >> "$PROJECT_DIR/logs/Backup_db.log" 2>&1 || true
-                fi
+    case "$MODE" in
+        auto)
+            if docker_backup; then
+                cleanup_old_archives
+                return 0
             fi
-            if ! python3 -c "import pymongo" &>/dev/null; then
-                if [ "$USE_NULL_OUTPUT" = true ]; then
-                    pip3 install pymongo==4.6.3 > /dev/null 2>&1 || true
-                else
-                    pip3 install pymongo==4.6.3 >> "$PROJECT_DIR/logs/Backup_db.log" 2>&1 || true
-                fi
+            if host_backup; then
+                cleanup_old_archives
+                return 0
             fi
-        fi
-
-        if [ "${USE_NULL_OUTPUT:-false}" = true ]; then
-            sudo -E "$PROJECT_DIR/run-backup.sh" --db "$DB_NAME" --uri "$MONGO_URI" --out "$BACKUP_DIR/mongodb_backup" > /dev/null 2>&1 && db_backup_ok=1 || {
-                log_message "ERROR: Failed to backup database with original path"
-                
-                # Try an alternative approach - use a temporary directory
-                log_message "Attempting backup via temporary directory..."
-                tmp_backup_dir="/tmp/mongodb_backup_$$"
-                mkdir -p "$tmp_backup_dir"
-                
-                "$PROJECT_DIR/run-backup.sh" --db "$DB_NAME" --uri "$MONGO_URI" --out "$tmp_backup_dir" > /dev/null 2>&1 && {
-                    # Copy temporary backup files to the actual backup directory
-                    log_message "Copying backup files from temporary directory..."
-                    cp -r "$tmp_backup_dir"/* "$BACKUP_DIR/mongodb_backup/"
-                    db_backup_ok=1
-                } || {
-                    log_message "ERROR: All attempts to backup database failed"
-                }
-            }
-        else
-            sudo -E "$PROJECT_DIR/run-backup.sh" --db "$DB_NAME" --uri "$MONGO_URI" --out "$BACKUP_DIR/mongodb_backup" >> "$PROJECT_DIR/logs/Backup_db.log" 2>&1 && db_backup_ok=1 || {
-                log_message "ERROR: Failed to backup database with original path"
-                
-                # Try an alternative approach - use a temporary directory
-                log_message "Attempting backup via temporary directory..."
-                tmp_backup_dir="/tmp/mongodb_backup_$$"
-                mkdir -p "$tmp_backup_dir"
-                
-                "$PROJECT_DIR/run-backup.sh" --db "$DB_NAME" --uri "$MONGO_URI" --out "$tmp_backup_dir" >> "$PROJECT_DIR/logs/Backup_db.log" 2>&1 && {
-                    # Copy temporary backup files to the actual backup directory
-                    log_message "Copying backup files from temporary directory..."
-                    cp -r "$tmp_backup_dir"/* "$BACKUP_DIR/mongodb_backup/"
-                    db_backup_ok=1
-                } || {
-                    log_message "ERROR: All attempts to backup database failed"
-                }
-            }
-        fi
-    else
-        log_message "Docker mode selected: skipping host DB backup step"
-    fi
-
-    # Auto-fallback for docker-first environments
-    if [ "$db_backup_ok" -ne 1 ] && [ "$BACKUP_MODE" != "host" ]; then
-        if try_backup_db_docker "$BACKUP_DIR/mongodb_backup"; then
-            db_backup_ok=1
-        fi
-    fi
-    
-    # Check if any CSV files were created during backup
-    if ! find "$BACKUP_DIR/mongodb_backup" -name "*.csv" -quit; then
-        log_message "WARNING: No CSV files found in backup directory"
-        
-        # If we used a temporary directory earlier and it still exists, try to use its contents
-        if [ -d "$tmp_backup_dir" ]; then
-            log_message "Backup created in temporary directory, moving to backup location..."
-            sudo cp -r "$tmp_backup_dir"/* "$BACKUP_DIR/mongodb_backup/" 
-            rm -rf "$tmp_backup_dir"
-        fi
-    fi
-    
-    # Reset to more restrictive permissions after backup completes
-    sudo chmod -R 755 "$BACKUP_DIR/mongodb_backup"
-    
-    # Verify that backup files were created
-    csv_count=$(find "$BACKUP_DIR/mongodb_backup" -name "*.csv" 2>/dev/null | wc -l)
-    archive_count=$(find "$BACKUP_DIR/mongodb_backup" -name "*.archive.gz" 2>/dev/null | wc -l)
-    if [ "$csv_count" -gt 0 ] || [ "$archive_count" -gt 0 ]; then
-        log_message "Database backup successful: ${csv_count} CSV collection(s), ${archive_count} archive file(s)"
-    else
-        log_message "WARNING: No database backup files found in backup directory"
-    fi
-
-    # Export legal invoice archive separately with long retention
-    backup_invoices_archive || log_message "WARNING: Invoice archive export failed"
-    
-    # Compress the backup
-    if [ "$COMPRESSION_LEVEL" -gt 0 ]; then
-        log_message "Compressing backup with level $COMPRESSION_LEVEL..."
-        
-        # Create compressed archive with pigz when available, otherwise gzip.
-        if command -v pigz >/dev/null 2>&1; then
-            gzip_cmd="pigz -${COMPRESSION_LEVEL}"
-        else
-            gzip_cmd="gzip -${COMPRESSION_LEVEL}"
-        fi
-        if tar --help 2>/dev/null | grep -q -- "--use-compress-program"; then
-            sudo tar -cf "$BACKUP_ARCHIVE" -I "$gzip_cmd" -C "$BACKUP_BASE_DIR" "$BACKUP_NAME" || {
-                log_message "ERROR: Failed to compress backup (tar -I)"
-                return 1
-            }
-        else
-            GZIP="-${COMPRESSION_LEVEL}" sudo -E tar -czf "$BACKUP_ARCHIVE" -C "$BACKUP_BASE_DIR" "$BACKUP_NAME" || {
-                log_message "ERROR: Failed to compress backup (tar + GZIP env)"
-                return 1
-            }
-    fi
-        
-        # Remove uncompressed directory after successful compression
-        if [ -f "$BACKUP_ARCHIVE" ]; then
-            log_message "Backup compressed successfully to $BACKUP_ARCHIVE"
-            log_message "Removing uncompressed backup directory"
-            sudo rm -rf "$BACKUP_DIR"
-        else
-            log_message "ERROR: Compressed backup file not found"
+            echo "Error: could not perform invoice backup in auto mode. Docker or host Python with pymongo is required." >&2
             return 1
-        fi
-    else
-        log_message "Compression disabled, keeping uncompressed backup"
-    fi
-    
-    # Set appropriate permissions
-    if [ "$COMPRESSION_LEVEL" -gt 0 ]; then
-        sudo chmod 644 "$BACKUP_ARCHIVE"
-    else
-        sudo chmod -R 755 "$BACKUP_DIR"
-    fi
-    
-    # Clean up old backups: age-based filter plus minimum keep safeguard
-    log_message "Cleaning up old backups (keep at least $MIN_KEEP; days>$KEEP_DAYS)..."
-    # Build list of all backup artifacts (files and directories) sorted newest first
-    mapfile -t ALL_BACKUPS < <(find "$BACKUP_BASE_DIR" -maxdepth 1 \
-        \( -type f -name "Inventarsystem-*.tar.gz" -o -type d -name "Inventarsystem-*" \) \
-        -printf '%T@\t%p\n' 2>/dev/null | sort -nr | awk -F '\t' '{print $2}')
-    TOTAL=${#ALL_BACKUPS[@]}
-    if (( TOTAL > MIN_KEEP )); then
-        # Determine deletion candidates by age (if KEEP_DAYS>0), otherwise all except the newest MIN_KEEP
-        if (( KEEP_DAYS > 0 )); then
-            mapfile -t AGE_CANDIDATES < <(find "$BACKUP_BASE_DIR" -maxdepth 1 \
-                \( -type f -name "Inventarsystem-*.tar.gz" -o -type d -name "Inventarsystem-*" \) \
-                -mtime +"$KEEP_DAYS" -printf '%T@\t%p\n' 2>/dev/null | sort -n | awk -F '\t' '{print $2}')
-        else
-            AGE_CANDIDATES=()
-            # If no age filter, consider everything except the newest MIN_KEEP as candidates (oldest first)
-            if (( TOTAL > MIN_KEEP )); then
-                # Reverse ALL_BACKUPS to get oldest first
-                for ((i=TOTAL-1; i>=MIN_KEEP; i--)); do AGE_CANDIDATES+=("${ALL_BACKUPS[$i]}"); done
+            ;;
+        docker)
+            if docker_backup; then
+                cleanup_old_archives
+                return 0
             fi
-        fi
-
-        # Protect the newest MIN_KEEP backups overall
-        ALLOWED_DELETE=$(( TOTAL - MIN_KEEP ))
-        DELETED=0
-        for path in "${AGE_CANDIDATES[@]:-}"; do
-            (( DELETED >= ALLOWED_DELETE )) && break
-            if [ -z "$path" ]; then continue; fi
-            if [ -f "$path" ]; then
-                sudo rm -f "$path" && ((DELETED++))
-            elif [ -d "$path" ]; then
-                sudo rm -rf "$path" && ((DELETED++))
+            echo "Error: docker backup failed or app container is unavailable." >&2
+            return 1
+            ;;
+        host)
+            if host_backup; then
+                cleanup_old_archives
+                return 0
             fi
-        done
-        log_message "Deleted $DELETED old backup(s); kept $(( TOTAL - DELETED ))"
-    else
-        log_message "No cleanup needed (total backups: $TOTAL <= min-keep: $MIN_KEEP)"
-    fi
-    
-    log_message "Backup completed successfully"
-    return 0
+            echo "Error: host backup failed. Ensure python3 and pymongo are installed." >&2
+            return 1
+            ;;
+        *)
+            echo "Error: unsupported mode '$MODE'" >&2
+            usage
+            return 2
+            ;;
+    esac
 }
 
-# Main
-log_message "Backup destination: $BACKUP_BASE_DIR"
-log_message "Database: $DB_NAME | URI: $MONGO_URI | Keep days: $KEEP_DAYS | Min keep: $MIN_KEEP | Compression: ${COMPRESSION_LEVEL}"
-log_message "Invoice archive: $INVOICE_ARCHIVE_DIR | Invoice retention days: $INVOICE_KEEP_DAYS"
-log_message "Backup mode: $BACKUP_MODE"
-
-if [[ "$BACKUP_MODE" != "auto" && "$BACKUP_MODE" != "host" && "$BACKUP_MODE" != "docker" ]]; then
-    log_message "ERROR: Invalid --mode value '$BACKUP_MODE' (allowed: auto, host, docker)"
-    exit 2
-fi
-
-init_docker_compose || true
-
-if create_backup; then
-    ART_DATE="$(date +"%Y-%m-%d")"
-    if [[ "$COMPRESSION_LEVEL" -gt 0 ]]; then
-        echo "$BACKUP_BASE_DIR/Inventarsystem-$ART_DATE.tar.gz"
-    else
-        echo "$BACKUP_BASE_DIR/Inventarsystem-$ART_DATE"
-    fi
-fi
+parse_args "$@"
+main

cleanup-old.sh

@@ -1,218 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_DIR="$SCRIPT_DIR"
-ADMIN_PROJECT_DIR="${ADMIN_PROJECT_DIR:-$(dirname "$PROJECT_DIR")/admin_Inventarsystem}"
-
-DRY_RUN=0
-REMOVE_CRON=0
-KEEP_AUTOSTART=0
-
-SERVICES=(
-    "inventarsystem-gunicorn.service"
-    "admin-inventarsystem-gunicorn.service"
-    "admin-inventarsystem-nginx.service"
-)
-
-SOCKETS=(
-    "/tmp/inventarsystem.sock"
-    "/tmp/admin-inventarsystem.sock"
-)
-
-PROCESS_PATTERNS=(
-    "$PROJECT_DIR/.venv/bin/gunicorn app:app"
-    "$ADMIN_PROJECT_DIR/.venv/bin/gunicorn app:app"
-)
-
-CRON_FILTER_PATTERNS=(
-    "$PROJECT_DIR/update.sh"
-    "$PROJECT_DIR/backup-docker.sh"
-    "$ADMIN_PROJECT_DIR/update.sh"
-    "$ADMIN_PROJECT_DIR/backup-docker.sh"
-)
-
-usage() {
-    cat <<EOF
-Usage: $0 [options]
-
-Options:
-  --remove-cron       Remove matching cron entries for old systems
-  --keep-autostart    Stop services but do not disable autostart
-  --dry-run           Show actions without executing
-  -h, --help          Show this help message
-EOF
-}
-
-log() {
-    echo "[cleanup-old] $*"
-}
-
-run_cmd() {
-    if [ "$DRY_RUN" -eq 1 ]; then
-        echo "[dry-run] $*"
-    else
-        "$@"
-    fi
-}
-
-run_cmd_sudo() {
-    if [ "$(id -u)" -eq 0 ]; then
-        run_cmd "$@"
-    else
-        run_cmd sudo "$@"
-    fi
-}
-
-parse_args() {
-    while [[ $# -gt 0 ]]; do
-        case "$1" in
-            --remove-cron)
-                REMOVE_CRON=1
-                shift
-                ;;
-            --keep-autostart)
-                KEEP_AUTOSTART=1
-                shift
-                ;;
-            --dry-run)
-                DRY_RUN=1
-                shift
-                ;;
-            -h|--help)
-                usage
-                exit 0
-                ;;
-            *)
-                echo "Error: unknown option '$1'"
-                usage
-                exit 2
-                ;;
-        esac
-    done
-}
-
-service_exists() {
-    local service="$1"
-    systemctl list-unit-files --type=service --no-legend --no-pager 2>/dev/null | awk '{print $1}' | grep -Fxq "$service"
-}
-
-stop_services() {
-    if ! command -v systemctl >/dev/null 2>&1; then
-        log "systemctl not available, skipping service cleanup"
-        return 0
-    fi
-
-    local service
-    for service in "${SERVICES[@]}"; do
-        if ! service_exists "$service"; then
-            log "Service not found: $service"
-            continue
-        fi
-
-        log "Stopping $service"
-        run_cmd_sudo systemctl stop "$service" || true
-
-        if [ "$KEEP_AUTOSTART" -eq 0 ]; then
-            log "Disabling autostart for $service"
-            run_cmd_sudo systemctl disable "$service" || true
-        fi
-    done
-}
-
-kill_leftover_processes() {
-    local pattern
-    for pattern in "${PROCESS_PATTERNS[@]}"; do
-        log "Terminating processes matching: $pattern"
-        run_cmd_sudo pkill -TERM -f "$pattern" || true
-    done
-
-    if [ "$DRY_RUN" -eq 0 ]; then
-        sleep 2
-    fi
-
-    for pattern in "${PROCESS_PATTERNS[@]}"; do
-        run_cmd_sudo pkill -KILL -f "$pattern" || true
-    done
-}
-
-remove_stale_sockets() {
-    local socket_path
-    for socket_path in "${SOCKETS[@]}"; do
-        if [ -e "$socket_path" ]; then
-            log "Removing stale socket/file: $socket_path"
-            run_cmd_sudo rm -f "$socket_path"
-        else
-            log "Socket/file not present: $socket_path"
-        fi
-    done
-}
-
-remove_cron_entries() {
-    if ! command -v crontab >/dev/null 2>&1; then
-        log "crontab not available, skipping cron cleanup"
-        return 0
-    fi
-
-    local tmp_file
-    tmp_file="$(mktemp)"
-
-    if [ "$(id -u)" -eq 0 ]; then
-        (crontab -l 2>/dev/null || true) > "$tmp_file"
-    else
-        (sudo crontab -l 2>/dev/null || true) > "$tmp_file"
-    fi
-
-    local pattern
-    for pattern in "${CRON_FILTER_PATTERNS[@]}"; do
-        if [ "$DRY_RUN" -eq 1 ]; then
-            echo "[dry-run] would remove cron lines containing: $pattern"
-        else
-            grep -vF "$pattern" "$tmp_file" > "${tmp_file}.new" || true
-            mv "${tmp_file}.new" "$tmp_file"
-        fi
-    done
-
-    if [ "$DRY_RUN" -eq 0 ]; then
-        if [ "$(id -u)" -eq 0 ]; then
-            crontab "$tmp_file"
-        else
-            sudo crontab "$tmp_file"
-        fi
-    fi
-
-    rm -f "$tmp_file"
-    log "Cron cleanup finished"
-}
-
-status_report() {
-    log "Remaining matching processes:"
-    ps -eo pid,ppid,cmd --sort=start_time | grep -E "Inventarsystem/.venv/bin/gunicorn|admin_Inventarsystem/.venv/bin/gunicorn" | grep -v grep || echo "none"
-
-    log "Socket status:"
-    local socket_path
-    for socket_path in "${SOCKETS[@]}"; do
-        if [ -e "$socket_path" ]; then
-            echo "exists: $socket_path"
-        else
-            echo "missing: $socket_path"
-        fi
-    done
-}
-
-main() {
-    parse_args "$@"
-
-    stop_services
-    kill_leftover_processes
-    remove_stale_sockets
-
-    if [ "$REMOVE_CRON" -eq 1 ]; then
-        remove_cron_entries
-    fi
-
-    status_report
-    log "Cleanup complete"
-}
-
-main "$@"

config.json

@@ -4,42 +4,44 @@
     "ver": "0.6.44",
     "host": "0.0.0.0",
     "port": 8000,
-
     "mongodb": {
         "host": "localhost",
         "port": 27017,
         "db": "Inventarsystem"
     },
-
     "scheduler": {
         "enabled": true,
         "interval_minutes": 1,
         "backup_interval_hours": 24
     },
-
     "ssl": {
         "enabled": true,
         "cert": "Web/certs/cert.pem",
         "key": "Web/certs/key.pem"
     },
-
     "images": {
-        "thumbnail_size": [150, 150],
-        "preview_size": [400, 400]
+        "thumbnail_size": [
+            150,
+            150
+        ],
+        "preview_size": [
+            400,
+            400
+        ]
     },
-
     "upload": {
         "max_size_mb": 10,
         "image_max_size_mb": 15,
         "video_max_size_mb": 100
     },
-
     "paths": {
         "backups": "backups",
         "logs": "logs"
     },
-
     "modules": {
+        "inventory": {
+            "enabled": true
+        },
         "library": {
             "enabled": true
         },
@@ -49,27 +51,83 @@
             "max_borrow_days": 365
         }
     },
-
-    "tenants": {},
-
+    "tenants": {
+    },
     "allowed_extensions": [
-        "png", "jpg", "jpeg", "gif",
-        "hevc", "heif",
-        "mp4", "mov", "avi", "mkv", "webm",
-        "mp3", "wav", "ogg", "flac", "aac", "m4a", "opus",
-        "pdf", "docx", "xlsx", "pptx", "txt"
+        "png",
+        "jpg",
+        "jpeg",
+        "gif",
+        "hevc",
+        "heif",
+        "mp4",
+        "mov",
+        "avi",
+        "mkv",
+        "webm",
+        "mp3",
+        "wav",
+        "ogg",
+        "flac",
+        "aac",
+        "m4a",
+        "opus",
+        "pdf",
+        "docx",
+        "xlsx",
+        "pptx",
+        "txt"
     ],
-
     "schoolPeriods": {
-        "1":  { "start": "08:00", "end": "08:45", "label": "1. Stunde (08:00 - 08:45)" },
-        "2":  { "start": "08:45", "end": "09:30", "label": "2. Stunde (08:45 - 09:30)" },
-        "3":  { "start": "09:45", "end": "10:30", "label": "3. Stunde (09:45 - 10:30)" },
-        "4":  { "start": "10:30", "end": "11:15", "label": "4. Stunde (10:30 - 11:15)" },
-        "5":  { "start": "11:30", "end": "12:15", "label": "5. Stunde (11:30 - 12:15)" },
-        "6":  { "start": "12:15", "end": "13:00", "label": "6. Stunde (12:15 - 13:00)" },
-        "7":  { "start": "13:30", "end": "14:15", "label": "7. Stunde (13:30 - 14:15)" },
-        "8":  { "start": "14:15", "end": "15:00", "label": "8. Stunde (14:15 - 15:00)" },
-        "9":  { "start": "15:15", "end": "16:00", "label": "9. Stunde (15:15 - 16:00)" },
-        "10": { "start": "16:00", "end": "16:45", "label": "10. Stunde (16:00 - 16:45)" }
+        "1": {
+            "start": "08:00",
+            "end": "08:45",
+            "label": "1. Stunde (08:00 - 08:45)"
+        },
+        "2": {
+            "start": "08:45",
+            "end": "09:30",
+            "label": "2. Stunde (08:45 - 09:30)"
+        },
+        "3": {
+            "start": "09:45",
+            "end": "10:30",
+            "label": "3. Stunde (09:45 - 10:30)"
+        },
+        "4": {
+            "start": "10:30",
+            "end": "11:15",
+            "label": "4. Stunde (10:30 - 11:15)"
+        },
+        "5": {
+            "start": "11:30",
+            "end": "12:15",
+            "label": "5. Stunde (11:30 - 12:15)"
+        },
+        "6": {
+            "start": "12:15",
+            "end": "13:00",
+            "label": "6. Stunde (12:15 - 13:00)"
+        },
+        "7": {
+            "start": "13:30",
+            "end": "14:15",
+            "label": "7. Stunde (13:30 - 14:15)"
+        },
+        "8": {
+            "start": "14:15",
+            "end": "15:00",
+            "label": "8. Stunde (14:15 - 15:00)"
+        },
+        "9": {
+            "start": "15:15",
+            "end": "16:00",
+            "label": "9. Stunde (15:15 - 16:00)"
+        },
+        "10": {
+            "start": "16:00",
+            "end": "16:45",
+            "label": "10. Stunde (16:00 - 16:45)"
+        }
     }
-}
+}

config.yml

@@ -1,13 +0,0 @@
-tunnel: homeserver
-credentials-file: /etc/cloudflared/credentials.json
-
-ingress:
-  # Repo 1: Inventar
-  - hostname: inventar.maximiliangruendinger.de
-    service: http://inventory-app:3000
-
-  # Repo 2: Key-Service (Buchung)
-  - hostname: booking.maximiliangruendinger.de
-    service: http://key-service-app:8080 
-
-  - service: http_status:404

debug_booking.py

@@ -1,74 +0,0 @@
-#!/usr/bin/env python3
-"""
-Debug script to check why planned bookings are not being activated
-"""
-import sys
-import os
-import datetime
-sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'Web'))
-
-from pymongo import MongoClient
-import settings as cfg
-import ausleihung as au
-
-def check_bookings():
-    """Check all planned bookings and their status"""
-    client = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-    db = client[cfg.MONGODB_DB]
-    ausleihungen = db['ausleihungen']
-    
-    # Get all planned bookings
-    planned = list(ausleihungen.find({'Status': 'planned'}))
-    
-    print(f"\n📊 Gefundene GEPLANTE Ausleihen: {len(planned)}\n")
-    print("=" * 100)
-    
-    current_time = datetime.datetime.now()
-    print(f"⏰ Aktuelle Zeit: {current_time}\n")
-    
-    for booking in planned:
-        booking_id = str(booking['_id'])
-        user = booking.get('User', 'N/A')
-        item = booking.get('Item', 'N/A')
-        start = booking.get('Start')
-        end = booking.get('End')
-        period = booking.get('Period')
-        status = booking.get('Status')
-        
-        print(f"\n🔹 Ausleihe ID: {booking_id}")
-        print(f"   Benutzer: {user}")
-        print(f"   Item: {item}")
-        print(f"   Status: {status}")
-        print(f"   Schulstunde/Periode: {period}")
-        print(f"   Start: {start} (Typ: {type(start).__name__})")
-        print(f"   Ende: {end} (Typ: {type(end).__name__})")
-        
-        # Check current status
-        current_status = au.get_current_status(booking, log_changes=False)
-        print(f"   ✓ Berechneter Status: {current_status}")
-        
-        if current_status != status:
-            print(f"   ⚠️  STATUS STIMMT NICHT ÜBEREIN! Sollte sein: {current_status}")
-        
-        # Check time comparison
-        if start:
-            time_diff = (current_time - start).total_seconds()
-            if time_diff < 0:
-                print(f"   ⏳ Startet in: {abs(time_diff) / 60:.1f} Minuten")
-            elif time_diff < 3600:
-                print(f"   ✓ Sollte JETZT AKTIV sein! ({time_diff / 60:.1f} Minuten vorbei)")
-            else:
-                print(f"   ✓ Sollte schon {time_diff / 3600:.1f} Stunden aktiv sein!")
-    
-    print("\n" + "=" * 100)
-    
-    # Check active bookings too
-    active = list(ausleihungen.find({'Status': 'active'}))
-    print(f"\n✓ AKTIVE Ausleihen: {len(active)}")
-    for booking in active:
-        print(f"  - {booking.get('User', 'N/A')}: {booking.get('Item', 'N/A')} (Periode: {booking.get('Period')})")
-    
-    client.close()
-
-if __name__ == '__main__':
-    check_bookings()

docker-compose-multitenant.yml

@@ -1,33 +1,17 @@
 # Multi-Tenant Optimized Docker Compose
-# Supports running multiple isolated app instances per subdomain
+# Supports running multiple isolated app instances with direct Docker host port binding
 # Each instance: ~50MB base + 20-30MB per 20 users
 # 
 # Usage:
 #   docker-compose -f docker-compose-multitenant.yml up -d
 #
-# Scale example: To support 10 tenants with 20 users each:
-#   docker-compose -f docker-compose-multitenant.yml up -d --scale app=10
+# Example: Start the stack and expose the app on host port 10000
+#   INVENTAR_HTTP_PORT=10000 docker-compose -f docker-compose-multitenant.yml up -d
 
 services:
-  cloudflared:
-    image: cloudflare/cloudflared:latest
-    container_name: cloudflared
-    restart: unless-stopped
-    profiles:
-      - cloudflare
-    command: ["--config", "/etc/cloudflared/config.yml", "tunnel", "run"]
-    volumes:
-      - ./docker/cloudflared/config.yml:/etc/cloudflared/config.yml:ro
-      - /etc/cloudflared/credentials.json:/etc/cloudflared/credentials.json:ro
-    depends_on:
-      nginx:
-        condition: service_started
-    networks:
-      - inventar-net
-
   # Management Container for multi-tenant scripts
   tenant-manager:
-    image: docker:cli
+    image: python:3.12-alpine
     container_name: tenant-manager
     restart: "no"
     profiles:
@@ -35,34 +19,8 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - .:/workspace
-    entrypoint: ["sh", "-c", "cd /workspace && ./manage-tenant.sh \"$$@\"", "--"]
-
-  nginx:
-    image: nginx:1.27-alpine
-    container_name: inventarsystem-nginx
-    restart: unless-stopped
-    depends_on:
-      app:
-        condition: service_started
-      redis:
-        condition: service_started
-    ports:
-      - "${INVENTAR_HTTP_PORT:-80}:80"
-      - "${INVENTAR_HTTPS_PORT:-8000}:8000"
-    volumes:
-      - ./docker/nginx/multitenant.conf:/etc/nginx/conf.d/default.conf
-      - ./certs:/etc/nginx/certs:ro
-      - ./docker/nginx/acme:/etc/nginx/acme:ro
-    networks:
-      - inventar-net
-    healthcheck:
-      test: ["CMD", "wget", "-q", "-O-", "http://localhost/health"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    environment:
-      NGINX_WORKER_PROCESSES: auto
-      NGINX_WORKER_CONNECTIONS: 1024
+    entrypoint: >
+      sh -c "apk add --no-cache bash docker-cli docker-cli-compose && cd /workspace && ./manage-tenant.sh \"$$@\"" --
 
   redis:
     image: redis:7-alpine
@@ -117,6 +75,8 @@ services:
         condition: service_healthy
       redis:
         condition: service_healthy
+    ports:
+      - "${INVENTAR_HTTP_PORT:-10000}:8000"
     networks:
       - inventar-net
     expose:
@@ -140,6 +100,7 @@ services:
       INVENTAR_REDIS_HOST: redis
       INVENTAR_REDIS_PORT: "6379"
       INVENTAR_REDIS_DB: "0"
+      INVENTAR_TENANT_PORT_MAP: "${INVENTAR_TENANT_PORT_MAP:-}"
       
       # Storage Configuration
       INVENTAR_BACKUP_FOLDER: /data/backups
@@ -147,11 +108,16 @@ services:
       INVENTAR_DELETED_ARCHIVE_FOLDER: /data/deleted-archives
       
       # Performance Tuning
-      INVENTAR_WORKER_CLASS: gevent
-      INVENTAR_WORKERS: "4"
-      INVENTAR_THREADS: "2"
-      INVENTAR_WORKER_TIMEOUT: "30"
-      INVENTAR_WORKER_CONNECTIONS: "100"
+      INVENTAR_WORKER_CLASS: ${INVENTAR_WORKER_CLASS:-gevent}
+      INVENTAR_WORKERS: "${INVENTAR_WORKERS:-4}"
+      INVENTAR_THREADS: "${INVENTAR_THREADS:-2}"
+      INVENTAR_WORKER_TIMEOUT: "${INVENTAR_WORKER_TIMEOUT:-30}"
+      INVENTAR_WORKER_CONNECTIONS: "${INVENTAR_WORKER_CONNECTIONS:-100}"
+      
+      # Auto-scaled runtime settings
+      INVENTAR_APP_CPUS: ${INVENTAR_APP_CPUS:-1.0}
+      INVENTAR_APP_MEM_LIMIT: ${INVENTAR_APP_MEM_LIMIT:-256m}
+      INVENTAR_APP_MEM_SWAP_LIMIT: ${INVENTAR_APP_MEM_SWAP_LIMIT:-512m}
       
       # Multi-Tenant
       INVENTAR_MULTITENANT_ENABLED: "true"
@@ -172,9 +138,9 @@ services:
     # Resource Limits (per instance)
     # With 10 instances: each gets ~150MB, totaling ~1.5GB
     # Adjust based on server resources
-    mem_limit: 256m
-    memswap_limit: 512m
-    cpus: "1.0"
+    mem_limit: "${INVENTAR_APP_MEM_LIMIT:-256m}"
+    memswap_limit: "${INVENTAR_APP_MEM_SWAP_LIMIT:-512m}"
+    cpus: "${INVENTAR_APP_CPUS:-1.0}"
     
     # Health check for load balancer
     healthcheck:

init-admin.sh

@@ -1,57 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Initialize first admin user if database is empty
-# Usage: ./init-admin.sh [username] [password] [first_name] [last_name]
-# Default: admin / admin123456 / Admin / User
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-cd "$SCRIPT_DIR"
-
-USERNAME="${1:-admin}"
-PASSWORD="${2:-admin123456}"
-FIRST_NAME="${3:-Admin}"
-LAST_NAME="${4:-User}"
-
-# Wait for MongoDB to be ready
-echo "Waiting for MongoDB to be ready..."
-for i in {1..30}; do
-    if docker exec inventarsystem-mongodb mongosh --eval "db.adminCommand('ping')" >/dev/null 2>&1; then
-        echo "MongoDB is ready."
-        break
-    fi
-    if [ $i -eq 30 ]; then
-        echo "Error: MongoDB did not start in time."
-        exit 1
-    fi
-    sleep 1
-done
-
-# Check if any users already exist
-USER_COUNT=$(docker exec inventarsystem-mongodb mongosh --quiet --eval "db.users.countDocuments({})" Inventarsystem 2>/dev/null || echo "0")
-
-if [ "$USER_COUNT" -eq 0 ]; then
-    echo "Database is empty. Creating initial admin user: $USERNAME"
-    
-    # Hash the password
-    PASSWORD_HASH=$(python3 -c "import hashlib; print(hashlib.sha512(b'$PASSWORD').hexdigest())")
-    
-    # Insert admin user
-    docker exec inventarsystem-mongodb mongosh --eval "
-    db.users.insertOne({
-      Username: '$USERNAME',
-      Password: '$PASSWORD_HASH',
-      Admin: true,
-      active_ausleihung: null,
-      name: '$FIRST_NAME',
-      last_name: '$LAST_NAME',
-      favorites: []
-    })
-    " Inventarsystem
-    
-    echo "✓ Admin user '$USERNAME' created successfully."
-    echo "  Username: $USERNAME"
-    echo "  Password: $PASSWORD"
-else
-    echo "Database already has $USER_COUNT user(s). Skipping initialization."
-fi

install.sh

@@ -176,7 +176,6 @@ Options:
     --skip-cleanup-old            Do not run cleanup-old.sh after install
     --cleanup-old-remove-cron     Also remove matching cron entries during old-system cleanup
     --multitenant                Use docker-compose-multitenant.yml (default)
-    --singletenant               Use docker-compose.yml
   --legacy-db-name <name>       Legacy database name (default: $LEGACY_DB_NAME)
   --legacy-mongo-uri <uri>      Legacy Mongo URI (default: $LEGACY_MONGO_URI)
   --legacy-system-dir <path>    Optional old system directory to remove after migration
@@ -207,10 +206,6 @@ parse_args() {
                 COMPOSE_FILE="docker-compose-multitenant.yml"
                 shift
                 ;;
-            --singletenant)
-                COMPOSE_FILE="docker-compose.yml"
-                shift
-                ;;
             --legacy-db-name)
                 LEGACY_DB_NAME="$2"
                 shift 2
@@ -473,8 +468,8 @@ EOF
     if [ ! -f "$PROJECT_DIR/.docker-build.env" ]; then
         cat > "$TMP_DIR/.docker-build.env" <<EOF
 NUITKA_BUILD=0
-INVENTAR_HTTP_PORT=80
-INVENTAR_HTTPS_PORT=443
+INVENTAR_HTTP_PORT=10000
+INVENTAR_HTTPS_PORT=10001
 INVENTAR_APP_IMAGE=ghcr.io/aiirondev/legendary-octo-garbanzo:$tag
 EOF
         sudo install -m 644 "$TMP_DIR/.docker-build.env" "$PROJECT_DIR/.docker-build.env"

manage-tenant.sh

@@ -1,4 +1,6 @@
-#!/bin/sh
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
 # Script to manage multitenant deployment
 # Allows adding, removing, and restarting tenants without downtime for others
 
@@ -7,52 +9,377 @@ if [ ! -f "docker-compose-multitenant.yml" ]; then
     exit 1
 fi
 
+CONFIG_FILE="$PWD/config.json"
+
 show_help() {
     echo "Usage: ./manage-tenant.sh [COMMAND] [OPTIONS]"
     echo ""
     echo "Commands:"
-    echo "  add <tenant_id>       Add a new tenant (initializes database)"
-    echo "  remove <tenant_id>    Remove a tenant completely (deletes data!)"
-    echo "  restart-tenant <id>   'Restart' a single tenant (clears cache/sessions)"
-    echo "  restart-all           Restart all application containers (zero-downtime reload)"
-    echo "  list                  List active tenants"
+    echo "  add <tenant_id> [port]       Add a new tenant (initializes database)"
+    echo "  remove <tenant_id>           Remove a tenant completely (deletes data!)"
+    echo "  restart-tenant <id>          'Restart' a single tenant (clears cache/sessions)"
+    echo "  restart-all                  Restart all application containers (zero-downtime reload)"
+    echo "  list                         List active tenants"
+    echo "  module <tenant_id> <module>=<on|off>... Enable/disable modules for a tenant"
+    echo "  -h, --help                   Show this help message"
     echo ""
     echo "Examples:"
-    echo "  ./manage-tenant.sh add school_a"
+    echo "  ./manage-tenant.sh add school_a 10001"
     echo "  ./manage-tenant.sh remove test_tenant"
+    echo "  ./manage-tenant.sh module school_a inventory=off library=on"
     echo "  ./manage-tenant.sh restart-all"
+    echo "  ./manage-tenant.sh -h"
     exit 1
 }
 
-if [ -z "$1" ]; then
+register_tenant_port() {
+    local tenant_id="$1"
+    local port="$2"
+
+    if python3 - <<'PY' "$CONFIG_FILE" "$tenant_id" "$port"
+import json, sys, os
+path, tenant_id, port_str = sys.argv[1], sys.argv[2], sys.argv[3]
+if not os.path.isfile(path):
+    print(f"Error: config file not found: {path}", file=sys.stderr)
+    sys.exit(1)
+with open(path, 'r', encoding='utf-8') as f:
+    cfg = json.load(f)
+tenants = cfg.get('tenants')
+if tenants is None or not isinstance(tenants, dict):
+    tenants = {}
+for tid, conf in tenants.items():
+    if isinstance(conf, dict) and str(conf.get('port')) == port_str and tid != tenant_id:
+        print(f"Error: port {port_str} is already mapped to tenant {tid}", file=sys.stderr)
+        sys.exit(2)
+existing = tenants.get(tenant_id)
+if existing is None or not isinstance(existing, dict):
+    existing = {}
+existing['port'] = int(port_str)
+tenants[tenant_id] = existing
+cfg['tenants'] = tenants
+with open(path, 'w', encoding='utf-8') as f:
+    json.dump(cfg, f, indent=4, ensure_ascii=False)
+print(f"Registered tenant port {port_str} for {tenant_id}")
+PY
+    then
+        echo "Tenant $tenant_id port $port registered in config.json"
+    else
+        echo "Failed to register tenant port $port for $tenant_id"
+        exit 1
+    fi
+}
+
+update_runtime_ports() {
+    local new_port="$1"
+    local env_file="$PWD/.docker-build.env"
+    local current_ports=""
+    local port_list=()
+    local unique_ports=()
+    local first_port=""
+    if [ -n "$new_port" ]; then
+        if [ -f "$env_file" ]; then
+            current_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
+            if [ -z "$current_ports" ]; then
+                current_ports="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
+            fi
+        fi
+
+        if [ -n "$current_ports" ]; then
+            IFS=',' read -r -a port_list <<<"${current_ports// /,}"
+        fi
+        port_list+=("$new_port")
+
+        for port in "${port_list[@]}"; do
+            if [ -n "$port" ] && ! printf '%s\n' "${unique_ports[@]}" | grep -qx "$port"; then
+                unique_ports+=("$port")
+            fi
+        done
+
+        if [ ${#unique_ports[@]} -eq 0 ]; then
+            unique_ports=("$new_port")
+        fi
+
+        first_port="${unique_ports[0]}"
+        local ports_csv
+        ports_csv="$(IFS=,; echo "${unique_ports[*]}")"
+
+        if [ ! -f "$env_file" ]; then
+            cat > "$env_file" <<EOF
+NUITKA_BUILD=0
+INVENTAR_HTTP_PORT=$first_port
+INVENTAR_HTTP_PORTS=$ports_csv
+EOF
+        else
+            if grep -q '^INVENTAR_HTTP_PORTS=' "$env_file" 2>/dev/null; then
+                sed -i "s|^INVENTAR_HTTP_PORTS=.*|INVENTAR_HTTP_PORTS=$ports_csv|" "$env_file"
+            else
+                printf '\nINVENTAR_HTTP_PORTS=%s\n' "$ports_csv" >> "$env_file"
+            fi
+            if grep -q '^INVENTAR_HTTP_PORT=' "$env_file" 2>/dev/null; then
+                sed -i "s|^INVENTAR_HTTP_PORT=.*|INVENTAR_HTTP_PORT=$first_port|" "$env_file"
+            else
+                printf '\nINVENTAR_HTTP_PORT=%s\n' "$first_port" >> "$env_file"
+            fi
+        fi
+
+        echo "Updated runtime env ports: $ports_csv"
+    fi
+}
+
+sync_tenant_port_map() {
+    local config_path="$CONFIG_FILE"
+    local env_file="$PWD/.docker-build.env"
+    local tenant_port_map
+
+    tenant_port_map="$(python3 - <<'PY' "$config_path"
+import json, os, sys
+path = sys.argv[1]
+if not os.path.isfile(path):
+    sys.exit(1)
+with open(path, 'r', encoding='utf-8') as f:
+    cfg = json.load(f)
+tenants = cfg.get('tenants', {})
+if not isinstance(tenants, dict):
+    sys.exit(0)
+entries = []
+for tenant_id, conf in sorted(tenants.items()):
+    if isinstance(conf, dict):
+        port = conf.get('port')
+        if isinstance(port, (int, float)) or (isinstance(port, str) and str(port).strip().isdigit()):
+            entries.append(f"{int(port)}={tenant_id}")
+print(','.join(entries))
+PY
+)"
+
+    if [ -z "$tenant_port_map" ]; then
+        if [ -f "$env_file" ]; then
+            sed -i '/^INVENTAR_TENANT_PORT_MAP=/d' "$env_file"
+        fi
+        return 0
+    fi
+
+    if [ ! -f "$env_file" ]; then
+        cat > "$env_file" <<EOF
+NUITKA_BUILD=0
+INVENTAR_TENANT_PORT_MAP=$tenant_port_map
+EOF
+        return 0
+    fi
+
+    if grep -q '^INVENTAR_TENANT_PORT_MAP=' "$env_file" 2>/dev/null; then
+        sed -i "s|^INVENTAR_TENANT_PORT_MAP=.*|INVENTAR_TENANT_PORT_MAP=$tenant_port_map|" "$env_file"
+    else
+        printf '\nINVENTAR_TENANT_PORT_MAP=%s\n' "$tenant_port_map" >> "$env_file"
+    fi
+}
+
+restart_app_container() {
+    local env_file="$PWD/.docker-build.env"
+    local compose_args=()
+    
+    # If HOST_WORKDIR is set (called from container), use absolute paths so docker daemon resolves them correctly
+    if [ -n "$HOST_WORKDIR" ]; then
+        compose_args+=( -f "$(readlink -f "$HOST_WORKDIR/docker-compose-multitenant.yml")" )
+        if [ -f "$HOST_WORKDIR/.docker-compose.runtime.override.yml" ]; then
+            compose_args+=( -f "$(readlink -f "$HOST_WORKDIR/.docker-compose.runtime.override.yml")" )
+        fi
+        if [ -f "$HOST_WORKDIR/.docker-build.env" ]; then
+            compose_args+=( --env-file "$(readlink -f "$HOST_WORKDIR/.docker-build.env")" )
+        fi
+    else
+        # Normal case: called directly from host
+        compose_args+=( -f "$PWD/docker-compose-multitenant.yml" )
+        if [ -f "$PWD/.docker-compose.runtime.override.yml" ]; then
+            compose_args+=( -f "$PWD/.docker-compose.runtime.override.yml" )
+        fi
+        if [ -f "$env_file" ]; then
+            compose_args+=( --env-file "$env_file" )
+        fi
+    fi
+    
+    # Pass along COMPOSE_PROJECT_NAME if set so the internal docker-compose sees it
+    if [ -n "$COMPOSE_PROJECT_NAME" ]; then
+        compose_args=( -p "$COMPOSE_PROJECT_NAME" "${compose_args[@]}" )
+    fi
+
+    echo "Restarting app container to apply tenant configuration changes..."
+    docker compose "${compose_args[@]}" up -d --no-build --force-recreate app
+}
+
+remove_tenant_port() {
+    local tenant_id="$1"
+    local config_path="$CONFIG_FILE"
+    local port
+
+    port="$(python3 - "$config_path" "$tenant_id" <<'PY'
+import json, sys, os
+path, tenant_id = sys.argv[1], sys.argv[2]
+if not os.path.isfile(path):
+    sys.exit(1)
+with open(path, 'r', encoding='utf-8') as f:
+    cfg = json.load(f)
+tenants = cfg.get('tenants', {})
+if not isinstance(tenants, dict) or tenant_id not in tenants or not isinstance(tenants[tenant_id], dict):
+    sys.exit(2)
+removed = tenants.pop(tenant_id, None)
+cfg['tenants'] = tenants
+with open(path, 'w', encoding='utf-8') as f:
+    json.dump(cfg, f, indent=4, ensure_ascii=False)
+if removed is not None:
+    port = removed.get('port')
+    if port is not None:
+        print(port)
+PY
+)"
+
+    local status=$?
+    if [ $status -eq 1 ]; then
+        echo "Error: config file not found: $config_path"
+        return 1
+    fi
+    if [ $status -eq 2 ]; then
+        return 2
+    fi
+
+    if [ -n "$port" ]; then
+        echo "$port"
+    fi
+    return 0
+}
+
+remove_runtime_port() {
+    local removed_port="$1"
+    local env_file="$PWD/.docker-build.env"
+    local current_ports=""
+    local port_list=()
+    local new_ports=()
+    local first_port=""
+
+    if [ ! -f "$env_file" ]; then
+        return 0
+    fi
+
+    current_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
+    if [ -z "$current_ports" ]; then
+        current_ports="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2; exit}' "$env_file" | tr -d ' ' || true)"
+    fi
+
+    if [ -z "$current_ports" ]; then
+        return 0
+    fi
+
+    IFS=',' read -r -a port_list <<<"${current_ports// /,}"
+    for port in "${port_list[@]}"; do
+        if [ -n "$port" ] && [ "$port" != "$removed_port" ]; then
+            new_ports+=("$port")
+        fi
+    done
+
+    if [ ${#new_ports[@]} -eq 0 ]; then
+        sed -i '/^INVENTAR_HTTP_PORTS=/d;/^INVENTAR_HTTP_PORT=/d' "$env_file"
+        return 0
+    fi
+
+    first_port="${new_ports[0]}"
+    local ports_csv="$(IFS=,; echo "${new_ports[*]}")"
+
+    if grep -q '^INVENTAR_HTTP_PORTS=' "$env_file" 2>/dev/null; then
+        sed -i "s|^INVENTAR_HTTP_PORTS=.*|INVENTAR_HTTP_PORTS=$ports_csv|" "$env_file"
+    else
+        printf '\nINVENTAR_HTTP_PORTS=%s\n' "$ports_csv" >> "$env_file"
+    fi
+
+    if grep -q '^INVENTAR_HTTP_PORT=' "$env_file" 2>/dev/null; then
+        sed -i "s|^INVENTAR_HTTP_PORT=.*|INVENTAR_HTTP_PORT=$first_port|" "$env_file"
+    else
+        printf '\nINVENTAR_HTTP_PORT=%s\n' "$first_port" >> "$env_file"
+    fi
+}
+
+if [ -z "${1:-}" ]; then
     show_help
 fi
 
-COMMAND=$1
-TENANT_ID=$2
+COMMAND="$1"
+TENANT_ID="${2:-}"
 
 case "$COMMAND" in
+    -h|--help)
+        show_help
+        ;;
     add)
         if [ -z "$TENANT_ID" ]; then
             echo "Error: Please provide a tenant_id."
             exit 1
         fi
-        echo "Adding new tenant '$TENANT_ID'..."
-        # Add Nginx configuration
-        if [ -f "docker/nginx/multitenant.conf" ]; then
-            echo "Assuming dynamic routing based on subdomain ($TENANT_ID)..."
+
+        PORT_ARG="$3"
+        if [ -n "$PORT_ARG" ]; then
+            if ! printf '%s\n' "$PORT_ARG" | grep -qE '^[0-9]+$'; then
+                echo "Error: Port must be a numeric value."
+                exit 1
+            fi
+            register_tenant_port "$TENANT_ID" "$PORT_ARG"
+            update_runtime_ports "$PORT_ARG"
+            sync_tenant_port_map
+            if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
+                restart_app_container
+            fi
         fi
-        
+
+        echo "Adding new tenant '$TENANT_ID'..."
         # Initialize tenant database via Python inside container
         echo "Initializing database for $TENANT_ID..."
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         if [ -n "$APP_CONTAINER" ]; then
             docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient; import hashlib
+import sys, re; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient; import hashlib
+tenant_id = sys.argv[1].lower()
+sanitized = ''.join(c for c in tenant_id if c.isalnum() or c == '_')
+db_name = f'inventar_{sanitized}'
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-db = client[f'{settings.MONGODB_DB}_{sys.argv[1]}']
+db = client[db_name]
 hashed_pw = hashlib.sha512('admin123'.encode()).hexdigest()
-db.users.insert_one({'Username': 'admin', 'Password': hashed_pw, 'Role': 'admin', 'Name': 'Admin', 'Nachname': 'User'})
+if db.users.count_documents({'Username': 'admin'}) == 0:
+    db.users.insert_one({
+        'Username': 'admin',
+        'Password': hashed_pw,
+        'Admin': True,
+        'active_ausleihung': None,
+        'name': 'Admin',
+        'last_name': 'User',
+        'IsStudent': False,
+        'PermissionPreset': 'full_access',
+        'ActionPermissions': {
+            'can_borrow': True,
+            'can_insert': True,
+            'can_edit': True,
+            'can_delete': True,
+            'can_manage_users': True,
+            'can_manage_settings': True,
+            'can_view_logs': True,
+        },
+        'PagePermissions': {
+            'home': True,
+            'tutorial_page': True,
+            'my_borrowed_items': True,
+            'notifications_view': True,
+            'impressum': True,
+            'license': True,
+            'library_view': True,
+            'terminplan': True,
+            'home_admin': True,
+            'upload_admin': True,
+            'library_admin': True,
+            'admin_borrowings': True,
+            'library_loans_admin': True,
+            'admin_damaged_items': True,
+            'admin_audit_dashboard': True,
+            'logs': True,
+            'manage_filters': True,
+            'manage_locations': True,
+        },
+    })
 print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin123')
 " "$TENANT_ID"
             echo "Tenant '$TENANT_ID' successfully added. Ready to use."
@@ -74,14 +401,36 @@ print(f'Tenant {sys.argv[1]} database initialized. Default admin: admin / admin1
             APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
             if [ -n "$APP_CONTAINER" ]; then
                 docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient
+import sys; sys.path.insert(0, '/app/Web'); from tenant import TenantContext; import settings; from pymongo import MongoClient
+ctx = TenantContext()
+db_name = ctx._get_db_name(sys.argv[1])
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-client.drop_database(f'{settings.MONGODB_DB}_{sys.argv[1]}')
+client.drop_database(db_name)
 print(f'Database for tenant {sys.argv[1]} dropped.')
 " "$TENANT_ID"
-                echo "Tenant '$TENANT_ID' removed successfully."
+                echo "Tenant '$TENANT_ID' database removed."
             else
-                echo "Error: Application container not running."
+                echo "Warning: Application container not running. Tenant database may still exist in MongoDB."
+            fi
+
+            port_to_remove=""
+            if port_to_remove="$(remove_tenant_port "$TENANT_ID" 2>/dev/null)"; then
+                if [ -n "$port_to_remove" ]; then
+                    remove_runtime_port "$port_to_remove"
+                    sync_tenant_port_map
+                    if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
+                        restart_app_container
+                    fi
+                    echo "Removed tenant '$TENANT_ID' from config.json and cleaned runtime port $port_to_remove."
+                else
+                    sync_tenant_port_map
+                    if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
+                        restart_app_container
+                    fi
+                    echo "Removed tenant '$TENANT_ID' from config.json. No port mapping was present."
+                fi
+            else
+                echo "Warning: tenant '$TENANT_ID' was not configured in config.json or could not be removed."
             fi
         else
             echo "Removal canceled."
@@ -118,22 +467,104 @@ print(f'Tenant {sys.argv[1]} session cache cleared. Tenant restarted.')
         ;;
         
     list)
-        echo "Listing active tenants (Databases):"
+        echo "Listing configured tenants (config.json):"
+        if [ -f "$CONFIG_FILE" ]; then
+            python3 - "$CONFIG_FILE" <<'PY'
+import json, sys
+path = sys.argv[1]
+with open(path, 'r', encoding='utf-8') as f:
+    cfg = json.load(f)
+tenants = cfg.get('tenants', {})
+if isinstance(tenants, dict) and tenants:
+    for tid, conf in tenants.items():
+        port = conf.get('port') if isinstance(conf, dict) else None
+        if port is not None:
+            print(f'- {tid} (port {port})')
+        else:
+            print(f'- {tid}')
+else:
+    print('  (no tenants configured)')
+PY
+        else
+            echo "  (config.json not found)"
+        fi
+
+        echo ""
+        echo "Listing active tenant databases (MongoDB):"
         APP_CONTAINER=$(docker ps -qf "name=app" | head -n 1)
         if [ -n "$APP_CONTAINER" ]; then
-             docker exec $APP_CONTAINER python3 -c "
-import sys; sys.path.insert(0, '/app/Web'); import settings; from pymongo import MongoClient
+             docker exec -i "$APP_CONTAINER" python3 - <<'PY'
+import sys
+sys.path.insert(0, '/app/Web')
+import settings
+from pymongo import MongoClient
 client = MongoClient(settings.MONGODB_HOST, int(settings.MONGODB_PORT))
-prefix = f'{settings.MONGODB_DB}_'
+prefix = 'inventar_'
 dbs = [d for d in client.list_database_names() if d.startswith(prefix)]
-for db in dbs:
-    print(f'- {db.replace(prefix, \"\")}')
-"
+if dbs:
+    for db in dbs:
+        print(f'- {db.replace(prefix, "")}')
+else:
+    print('  (no tenant databases found)')
+PY
         else
             echo "Error: Application container not running."
         fi
         ;;
 
+    module)
+        if [ -z "$TENANT_ID" ] || [ -z "${3:-}" ]; then
+            echo "Error: Usage: manage-tenant.sh module <tenant_id> <module_name>=<on|off> [...]"
+            exit 1
+        fi
+        
+        # Pass all remaining arguments to python script
+        shift 2
+        
+        if python3 - "$CONFIG_FILE" "$TENANT_ID" "$@" <<'PY'
+import json, sys, os
+path = sys.argv[1]
+tenant_id = sys.argv[2]
+module_args = sys.argv[3:]
+
+if not os.path.isfile(path):
+    print(f"Error: config file not found: {path}", file=sys.stderr)
+    sys.exit(1)
+
+with open(path, 'r', encoding='utf-8') as f:
+    cfg = json.load(f)
+
+tenants = cfg.setdefault('tenants', {})
+tenant_cfg = tenants.setdefault(tenant_id, {})
+if 'port' not in tenant_cfg:
+    print(f"Warning: Tenant {tenant_id} doesn't have a port mapping in config.json.", file=sys.stderr)
+
+modules = tenant_cfg.setdefault('modules', {})
+
+for arg in module_args:
+    if '=' not in arg:
+        print(f"Warning: Ignoring invalid argument format '{arg}'. Expected name=on|off.", file=sys.stderr)
+        continue
+    mod_name, state_str = arg.split('=', 1)
+    state = str(state_str).lower() in ('on', '1', 'true', 'yes')
+    module_cfg = modules.setdefault(mod_name, {})
+    module_cfg['enabled'] = state
+    print(f"Module '{mod_name}' set to '{'on' if state else 'off'}' for tenant '{tenant_id}'.")
+
+with open(path, 'w', encoding='utf-8') as f:
+    json.dump(cfg, f, indent=4, ensure_ascii=False)
+PY
+        then
+            echo "Module configurations updated successfully."
+            if [ -n "$(docker ps -qf 'name=app' | head -n 1)" ]; then
+                restart_app_container
+            fi
+        else
+            echo "Failed to update module configuration."
+            exit 1
+        fi
+        ;;
+
     *)
         echo "Unknown command: $COMMAND"
         show_help

manage-version.sh

@@ -1,337 +0,0 @@
-#!/bin/bash
-
-# Standalone version manager for this repo
-# Supports pinning to a commit/tag/branch, one-time use, clearing the lock,
-# applying the lock, listing refs, and showing status. Optional restart.
-
-set -euo pipefail
-
-PROJECT_DIR="$(dirname "$(readlink -f "$0")")"
-cd "$PROJECT_DIR"
-
-LOCK_FILE="$PROJECT_DIR/.version-lock"
-RESTART=false
-FORCE=false
-BACKUP_BASE_DIR="/var/backups"
-LOG_DIR="$PROJECT_DIR/logs"
-VM_LOG="$LOG_DIR/version_manager.log"
-
-# Directories/files to preserve across version switches
-# Data paths we want to restore from backup after a version switch
-DATA_PATHS=(
-  "certs"
-  "Images"
-  "logs"
-  "Web/uploads"
-  "Web/thumbnails"
-  "Web/QRCodes"
-  "Web/previews"
-)
-
-# Ensure log directory exists
-mkdir -p "$LOG_DIR" >/dev/null 2>&1 || true
-chmod 777 "$LOG_DIR" >/dev/null 2>&1 || true
-
-log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$VM_LOG"; }
-err() { echo "ERROR: $*" | tee -a "$VM_LOG" >&2; }
-
-usage() {
-  cat <<USAGE
-Usage:
-  $0 pin <ref> [--restart] [--force]     Persistently lock to a commit/tag/branch and deploy it
-  $0 use <ref> [--restart] [--force]     Use ref once (no persistence) and deploy it
-  $0 clear [--restart] [--force]         Remove lock, switch back to main, pull latest
-  $0 apply [--restart] [--force]         Re-apply the current lock (if any)
-  $0 status                               Show current commit and lock state
-  $0 list [--tags|--commits]              List tags or recent commits (default: tags)
-
-Notes:
-  - <ref> can be a tag name, branch name, or full/short commit hash
-  - --restart calls ./restart.sh after switching
-  - --force discards local changes (git reset --hard) if needed
-USAGE
-}
-
-ensure_git_ready() {
-  # Avoid "dubious ownership" errors
-  git config --global --add safe.directory "$PROJECT_DIR" >/dev/null 2>&1 || true
-  # Fetch refs and tags
-  git fetch --all --tags --prune
-}
-
-ensure_clean_or_force() {
-  if ! git diff --quiet || ! git diff --cached --quiet; then
-    if [ "$FORCE" = true ]; then
-      log "Discarding local changes (force)"
-      git reset --hard
-      git clean -fdx >/dev/null 2>&1 || true
-    else
-      err "Working tree has local changes. Re-run with --force to discard."
-      exit 2
-    fi
-  fi
-}
-
-restart_if_requested() {
-  if [ "$RESTART" = true ]; then
-    if [ -x "$PROJECT_DIR/restart.sh" ]; then
-      log "Restarting services..."
-      "$PROJECT_DIR/restart.sh"
-    else
-      log "restart.sh not found or not executable; skipping restart"
-    fi
-  fi
-}
-
-# Create a full backup before switching versions (files + DB CSVs)
-LAST_BACKUP_ARCHIVE=""
-LAST_BACKUP_DIRNAME=""
-create_pre_switch_backup() {
-  local ts backup_name backup_dir backup_archive
-  ts=$(date +"%Y-%m-%d_%H-%M-%S")
-  backup_name="Inventarsystem-pre-switch-$ts"
-  backup_dir="$BACKUP_BASE_DIR/$backup_name"
-  backup_archive="$BACKUP_BASE_DIR/$backup_name.tar.gz"
-
-  log "Creating pre-switch backup at $backup_archive"
-  sudo mkdir -p "$backup_dir" || { err "Failed to create backup directory"; return 1; }
-
-  # Copy project files (exclude .venv to reduce size, keep .git for reference)
-  log "Copying project files to backup directory..."
-  sudo rsync -a --delete \
-    --exclude='.venv' \
-    --exclude='__pycache__' \
-    --exclude='*.pyc' \
-    "$PROJECT_DIR/" "$backup_dir/" || log "Warning: rsync file copy encountered issues"
-
-  # Database CSV backup using existing helper
-  log "Backing up MongoDB to CSVs..."
-  sudo mkdir -p "$backup_dir/mongodb_backup" || true
-  if [ -x "$PROJECT_DIR/run-backup.sh" ]; then
-    if sudo -E "$PROJECT_DIR/run-backup.sh" --db Inventarsystem --uri mongodb://localhost:27017/ --out "$backup_dir/mongodb_backup" >> "$VM_LOG" 2>&1; then
-      log "Database backup completed"
-    else
-      err "Database backup failed; continuing with file backup only"
-    fi
-  else
-    log "run-backup.sh not found; skipping DB backup"
-  fi
-
-  # Compress backup
-  log "Compressing backup archive..."
-  if sudo tar -czf "$backup_archive" -C "$BACKUP_BASE_DIR" "$backup_name"; then
-    log "Backup archived to $backup_archive"
-    sudo rm -rf "$backup_dir" || true
-    # Set readable permissions
-    sudo chmod 644 "$backup_archive" || true
-    # Export for subsequent restore step
-    LAST_BACKUP_ARCHIVE="$backup_archive"
-    LAST_BACKUP_DIRNAME="$backup_name"
-  else
-    err "Failed to create compressed backup archive"
-    return 1
-  fi
-}
-
-# Restore key data from the backup archive into current working tree
-restore_from_backup_archive() {
-  if [ -z "$LAST_BACKUP_ARCHIVE" ] || [ ! -f "$LAST_BACKUP_ARCHIVE" ]; then
-    log "No backup archive available to restore data from; skipping data restore"
-    return 0
-  fi
-  local tmpdir
-  tmpdir=$(mktemp -d /tmp/inventarsystem_restore_XXXXXX)
-  log "Extracting backup archive $LAST_BACKUP_ARCHIVE to $tmpdir"
-  if ! sudo tar -xzf "$LAST_BACKUP_ARCHIVE" -C "$tmpdir"; then
-    err "Failed to extract backup archive; skipping data restore"
-    rm -rf "$tmpdir" || true
-    return 1
-  fi
-  local src_root="$tmpdir/$LAST_BACKUP_DIRNAME"
-  # Some backups might extract without top-level dir; fallback
-  if [ ! -d "$src_root" ]; then
-    src_root="$tmpdir"
-  fi
-  log "Restoring data directories from backup..."
-  for rel in "${DATA_PATHS[@]}"; do
-    if [ -e "$src_root/$rel" ]; then
-      mkdir -p "$PROJECT_DIR/$(dirname "$rel")" 2>/dev/null || true
-      rsync -a "$src_root/$rel" "$PROJECT_DIR/$(dirname "$rel")/" >> "$VM_LOG" 2>&1 || log "Warning: failed to restore $rel"
-      log "Restored: $rel"
-    else
-      log "Not in backup (skipped): $rel"
-    fi
-  done
-  rm -rf "$tmpdir" || true
-}
-
-# Ensure permissions on critical data directories
-ensure_permissions() {
-  # Logs should be writable
-  mkdir -p "$PROJECT_DIR/logs" && chmod 777 "$PROJECT_DIR/logs" 2>/dev/null || true
-  # Web data directories readable/executable by server
-  for d in "$PROJECT_DIR/Web/uploads" "$PROJECT_DIR/Web/thumbnails" "$PROJECT_DIR/Web/QRCodes" "$PROJECT_DIR/Web/previews" "$PROJECT_DIR/Images"; do
-    [ -d "$d" ] && chmod -R 755 "$d" 2>/dev/null || true
-  done
-  # SSL cert perms (key must be 600)
-  if [ -f "$PROJECT_DIR/certs/inventarsystem.key" ]; then
-    chmod 600 "$PROJECT_DIR/certs/inventarsystem.key" 2>/dev/null || true
-  fi
-}
-
-checkout_ref() {
-  local ref="$1"
-
-  # Try tag
-  if git show-ref --verify --quiet "refs/tags/$ref"; then
-    git checkout -B locked-tag-"$ref" "tags/$ref"
-    return 0
-  fi
-  # Try remote branch
-  if git show-ref --verify --quiet "refs/remotes/origin/$ref"; then
-    git checkout -B locked-branch-"$ref" "origin/$ref"
-    return 0
-  fi
-  # Try local branch
-  if git show-ref --verify --quiet "refs/heads/$ref"; then
-    git checkout "$ref"
-    return 0
-  fi
-  # Try commit-ish
-  if git rev-parse --verify --quiet "$ref^{commit}" >/dev/null; then
-    git checkout -B locked-commit "$ref"
-    return 0
-  fi
-
-  err "Could not resolve ref '$ref' to tag/branch/commit"
-  exit 3
-}
-
-deploy_main_latest() {
-  ensure_clean_or_force
-  if git show-ref --verify --quiet refs/heads/main; then
-    git checkout main
-  else
-    git checkout -B main origin/main
-  fi
-  git pull --ff-only
-}
-
-cmd_status() {
-  local head_commit
-  head_commit=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")
-  echo "Current commit: $head_commit"
-  if [ -f "$LOCK_FILE" ]; then
-    echo "Version lock: $(cat "$LOCK_FILE")"
-  else
-    echo "Version lock: none (tracking main)"
-  fi
-}
-
-cmd_list() {
-  local mode="tags"
-  for a in "$@"; do
-    case "$a" in
-      --tags) mode="tags" ;;
-      --commits) mode="commits" ;;
-    esac
-  done
-  ensure_git_ready
-  if [ "$mode" = "tags" ]; then
-    git tag --list | sort -V
-  else
-    git --no-pager log --oneline -n 30
-  fi
-}
-
-cmd_pin() {
-  local ref="$1"
-  ensure_git_ready
-  # Always produce a backup before switching
-  create_pre_switch_backup || log "Backup step had issues; proceeding with caution"
-  ensure_clean_or_force
-  echo "$ref" > "$LOCK_FILE"
-  checkout_ref "$ref"
-  # Restore data from the backup archive
-  restore_from_backup_archive
-  ensure_permissions
-  log "Pinned to: $ref (commit $(git rev-parse --short HEAD))"
-  restart_if_requested
-}
-
-cmd_use() {
-  local ref="$1"
-  ensure_git_ready
-  create_pre_switch_backup || log "Backup step had issues; proceeding with caution"
-  ensure_clean_or_force
-  checkout_ref "$ref"
-  restore_from_backup_archive
-  ensure_permissions
-  log "Using (one-time): $ref (commit $(git rev-parse --short HEAD))"
-  restart_if_requested
-}
-
-cmd_clear() {
-  ensure_git_ready
-  create_pre_switch_backup || log "Backup step had issues; proceeding with caution"
-  [ -f "$LOCK_FILE" ] && rm -f "$LOCK_FILE"
-  deploy_main_latest
-  restore_from_backup_archive
-  ensure_permissions
-  log "Cleared version lock; now on main @ $(git rev-parse --short HEAD)"
-  restart_if_requested
-}
-
-cmd_apply() {
-  ensure_git_ready
-  create_pre_switch_backup || log "Backup step had issues; proceeding with caution"
-  if [ -f "$LOCK_FILE" ]; then
-    ensure_clean_or_force
-    local ref
-    ref=$(cat "$LOCK_FILE")
-    checkout_ref "$ref"
-    log "Applied lock: $ref (commit $(git rev-parse --short HEAD))"
-  else
-    log "No lock present; keeping main"
-    deploy_main_latest
-  fi
-  restore_from_backup_archive
-  ensure_permissions
-  restart_if_requested
-}
-
-# Parse global flags that can appear after subcommand too
-parse_tail_flags() {
-  for a in "$@"; do
-    case "$a" in
-      --restart) RESTART=true ;;
-      --force)   FORCE=true ;;
-    esac
-  done
-}
-
-main() {
-  local cmd="${1:-}"; shift || true
-  case "$cmd" in
-    pin)
-      [ $# -ge 1 ] || { usage; exit 1; }
-      local ref="$1"; shift; parse_tail_flags "$@"; cmd_pin "$ref" ;;
-    use)
-      [ $# -ge 1 ] || { usage; exit 1; }
-      local ref="$1"; shift; parse_tail_flags "$@"; cmd_use "$ref" ;;
-    clear)
-      parse_tail_flags "$@"; cmd_clear ;;
-    apply)
-      parse_tail_flags "$@"; cmd_apply ;;
-    status)
-      cmd_status ;;
-    list)
-      cmd_list "$@" ;;
-    --help|-h|help|"")
-      usage ;;
-    *)
-      err "Unknown command: $cmd"; usage; exit 1 ;;
-  esac
-}
-
-main "$@"

migrate-to-multitenant.sh

@@ -1,426 +0,0 @@
-#!/bin/bash
-
-##############################################################################
-# Multi-Tenant Migration Script
-#
-# Automatisierte Konvertierung einer Single-Instance App zu Multi-Tenant
-# Führt folgende Operationen durch:
-# 1. Backup der Original-Dateien
-# 2. Import von Tenant-Modulen
-# 3. Anpassung von app.py
-# 4. Konfiguration von Redis
-# 5. Validierung
-#
-# Usage: bash migrate-to-multitenant.sh [dry-run]
-##############################################################################
-
-set -e
-
-# Farben für Terminal Output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WEB_DIR="$PROJECT_ROOT/Web"
-BACKUP_DIR="$PROJECT_ROOT/.migration-backup-$(date +%Y%m%d-%H%M%S)"
-DRY_RUN="${1:-}"
-
-log_info() {
-    echo -e "${BLUE}[INFO]${NC} $1"
-}
-
-log_success() {
-    echo -e "${GREEN}[✓]${NC} $1"
-}
-
-log_warning() {
-    echo -e "${YELLOW}[WARN]${NC} $1"
-}
-
-log_error() {
-    echo -e "${RED}[ERROR]${NC} $1"
-}
-
-check_prerequisites() {
-    log_info "Checking prerequisites..."
-    
-    # Check Python
-    if ! command -v python3 &> /dev/null; then
-        log_error "Python 3 not found"
-        return 1
-    fi
-    log_success "Python 3 found: $(python3 --version)"
-    
-    # Check Docker
-    if ! command -v docker &> /dev/null; then
-        log_warning "Docker not found (will be needed for deployment)"
-    else
-        log_success "Docker found: $(docker --version)"
-    fi
-    
-    # Check Flask app
-    if [[ ! -f "$WEB_DIR/app.py" ]]; then
-        log_error "Web/app.py not found"
-        return 1
-    fi
-    log_success "Flask app found at $WEB_DIR/app.py"
-    
-    return 0
-}
-
-create_backups() {
-    log_info "Creating backups..."
-    
-    if [[ "$DRY_RUN" == "dry-run" ]]; then
-        log_info "[DRY-RUN] Would backup to: $BACKUP_DIR"
-        return 0
-    fi
-    
-    mkdir -p "$BACKUP_DIR"
-    
-    # Backup critical files
-    cp "$WEB_DIR/app.py" "$BACKUP_DIR/app.py.bak"
-    cp "$WEB_DIR/settings.py" "$BACKUP_DIR/settings.py.bak" 2>/dev/null || true
-    cp "docker-compose.yml" "$BACKUP_DIR/docker-compose.yml.bak" 2>/dev/null || true
-    
-    log_success "Backups created at: $BACKUP_DIR"
-}
-
-check_tenant_modules() {
-    log_info "Checking tenant modules..."
-    
-    local missing=0
-    
-    for module in tenant session_manager query_cache; do
-        if [[ ! -f "$WEB_DIR/${module}.py" ]]; then
-            log_warning "Missing module: $WEB_DIR/${module}.py"
-            ((missing++))
-        else
-            log_success "Module found: $module.py"
-        fi
-    done
-    
-    if [[ $missing -gt 0 ]]; then
-        log_error "Missing $missing required modules. Ensure they are created first."
-        return 1
-    fi
-    
-    return 0
-}
-
-check_docker_files() {
-    log_info "Checking Docker configuration files..."
-    
-    local missing=0
-    
-    if [[ ! -f "docker-compose-multitenant.yml" ]]; then
-        log_warning "Missing docker-compose-multitenant.yml"
-        ((missing++))
-    else
-        log_success "docker-compose-multitenant.yml found"
-    fi
-    
-    if [[ ! -f "docker/nginx/multitenant.conf" ]]; then
-        log_warning "Missing docker/nginx/multitenant.conf"
-        ((missing++))
-    else
-        log_success "docker/nginx/multitenant.conf found"
-    fi
-    
-    if [[ $missing -gt 0 ]]; then
-        log_warning "Missing $missing Docker files (needed for deployment)"
-    fi
-    
-    return 0
-}
-
-update_app_py() {
-    log_info "Updating app.py with Multi-Tenant imports..."
-    
-    if [[ "$DRY_RUN" == "dry-run" ]]; then
-        log_info "[DRY-RUN] Would add Multi-Tenant imports to app.py"
-        return 0
-    fi
-    
-    # Check if already updated
-    if grep -q "from tenant import" "$WEB_DIR/app.py"; then
-        log_warning "app.py already contains Multi-Tenant imports (skipping)"
-        return 0
-    fi
-    
-    # Add imports after other data_protection imports
-    local imports_section=$(python3 -c "
-import re
-with open('$WEB_DIR/app.py', 'r') as f:
-    content = f.read()
-
-# Find the line after data_protection imports
-if 'from data_protection import' in content:
-    lines = content.split('\n')
-    for i, line in enumerate(lines):
-        if 'from data_protection import' in line:
-            # Find the end of this import block
-            j = i + 1
-            while j < len(lines) and (lines[j].startswith('    ') or lines[j].strip() == ''):
-                j += 1
-            # Insert new imports before settings import
-            print(j)
-            break
-else:
-    print(-1)
-" 2>/dev/null)
-    
-    if [[ $imports_section -eq -1 ]]; then
-        log_warning "Could not find insertion point for Multi-Tenant imports"
-        log_info "Please manually add the following imports to app.py:"
-        cat << 'EOF'
-
-# Multi-Tenant Imports
-from tenant import get_tenant_context, require_tenant, get_tenant_db
-from session_manager import create_redis_session_interface
-from query_cache import get_cache_manager, cached_query, invalidate_cache
-EOF
-        return 1
-    fi
-    
-    log_success "Multi-Tenant imports prepared"
-    return 0
-}
-
-update_requirements() {
-    log_info "Checking requirements.txt for Redis..."
-    
-    if [[ "$DRY_RUN" == "dry-run" ]]; then
-        log_info "[DRY-RUN] Would update requirements.txt"
-        return 0
-    fi
-    
-    # Check both root and Web/requirements.txt
-    for req_file in requirements.txt Web/requirements.txt; do
-        if [[ -f "$req_file" ]]; then
-            if ! grep -q "^redis" "$req_file"; then
-                log_info "Adding redis to $req_file..."
-                echo "redis>=7.0.0" >> "$req_file"
-                log_success "Added redis to $req_file"
-            else
-                log_success "$req_file already has redis"
-            fi
-        fi
-    done
-    
-    return 0
-}
-
-generate_migration_guide() {
-    log_info "Generating migration guide..."
-    
-    cat > "$BACKUP_DIR/MIGRATION_NOTES.md" << 'EOF'
-# Multi-Tenant Migration Checklist
-
-## Automated Steps Completed
-- [x] Backup created
-- [x] Tenant modules verified
-- [x] Docker files prepared
-- [x] app.py imports prepared
-- [x] requirements.txt updated
-
-## Manual Steps Required
-
-### 1. Update app.py Configuration (5 min)
-
-Add after `app = Flask(...)`:
-```python
-# Multi-Tenant Configuration
-if os.getenv('INVENTAR_SESSION_BACKEND') == 'redis':
-    try:
-        app.session_interface = create_redis_session_interface(app)
-        app.logger.info("Redis session backend enabled")
-    except Exception as e:
-        app.logger.warning(f"Redis session backend failed: {e}")
-```
-
-### 2. Add Health Check Endpoint (5 min)
-
-Add this route:
-```python
-@app.route('/health')
-def health_check():
-    try:
-        mongo = MongoClient(cfg.MONGODB_HOST, cfg.MONGODB_PORT)
-        mongo.admin.command('ping')
-        return {'status': 'healthy'}, 200
-    except Exception as e:
-        return {'status': 'unhealthy'}, 503
-```
-
-### 3. Update Database Access (10-30 min)
-
-Change existing routes to use:
-```python
-@require_tenant
-def your_route():
-    db = get_tenant_db(MongoClient(...))
-    # Use db as usual
-```
-
-### 4. Setup DNS (5 min)
-
-Create wildcard DNS record:
-```
-*.example.com IN A your-server-ip
-```
-
-### 5. Create SSL Certificate (10 min)
-
-```bash
-# Let's Encrypt (recommended)
-sudo certbot certonly --manual --preferred-challenges dns \
-    -d "*.example.com" -d "example.com"
-
-# Copy to certs folder
-cp /etc/letsencrypt/live/example.com/fullchain.pem certs/inventarsystem.crt
-cp /etc/letsencrypt/live/example.com/privkey.pem certs/inventarsystem.key
-```
-
-### 6. Deploy Multi-Tenant
-
-```bash
-# Install dependencies
-pip install -r requirements.txt
-
-# Start Multi-Tenant deployment
-docker-compose -f docker-compose-multitenant.yml up -d
-
-# Test
-curl https://test.example.com/health
-```
-
-### 7. Verify (5 min)
-
-```bash
-# Check logs
-docker-compose logs app
-
-# Verify each tenant
-curl https://schule1.example.com/debug/tenant
-curl https://schule2.example.com/debug/tenant
-
-# Cache stats
-curl https://schule1.example.com/debug/cache-stats
-```
-
-## Rollback Plan
-
-If something goes wrong:
-
-1. Stop Multi-Tenant deployment
-   ```bash
-   docker-compose -f docker-compose-multitenant.yml down
-   ```
-
-2. Restore from backup
-   ```bash
-   cp .migration-backup-*/app.py Web/app.py
-   cp .migration-backup-*/settings.py Web/settings.py
-   ```
-
-3. Restart original deployment
-   ```bash
-   docker-compose up -d
-   ```
-
-## Performance Expectations
-
-- Memory per instance: 100-150MB (was 200MB)
-- Response time: -30% (Redis caching)
-- Max concurrent users: 3x increase
-- Database load: -70% (query caching)
-
-## Support
-
-- Check logs: `docker-compose -f docker-compose-multitenant.yml logs -f app`
-- Debug tenant: `curl https://your-tenant.com/debug/tenant`
-- See MULTITENANT_DEPLOYMENT.md for detailed guide
-EOF
-
-    log_success "Migration guide created at: $BACKUP_DIR/MIGRATION_NOTES.md"
-}
-
-validate_setup() {
-    log_info "Validating setup..."
-    
-    # Check Python syntax of tenant modules
-    for module in tenant session_manager query_cache; do
-        module_file="$WEB_DIR/${module}.py"
-        if [[ -f "$module_file" ]]; then
-            if python3 -m py_compile "$module_file" 2>/dev/null; then
-                log_success "Module syntax valid: $module.py"
-            else
-                log_error "Syntax error in $module.py"
-                return 1
-            fi
-        fi
-    done
-    
-    return 0
-}
-
-print_summary() {
-    cat << EOF
-
-${GREEN}═══════════════════════════════════════════════════════════${NC}
-${GREEN}  Multi-Tenant Migration Summary${NC}
-${GREEN}═══════════════════════════════════════════════════════════${NC}
-
-${GREEN}✓ Prerequisites checked${NC}
-${GREEN}✓ Backups created${NC}
-${GREEN}✓ Tenant modules verified${NC}
-${GREEN}✓ Docker files prepared${NC}
-${GREEN}✓ app.py imports prepared${NC}
-${GREEN}✓ requirements.txt updated${NC}
-
-${YELLOW}Next Steps:${NC}
-1. Review migration guide: $BACKUP_DIR/MIGRATION_NOTES.md
-2. Manually update app.py (see guide above)
-3. Setup DNS wildcard record
-4. Create SSL certificate
-5. Deploy: docker-compose -f docker-compose-multitenant.yml up -d
-
-${BLUE}Documentation:${NC}
-- MULTITENANT_DEPLOYMENT.md - Complete deployment guide
-- MULTITENANT_INTEGRATION.md - Code integration examples
-- $BACKUP_DIR/MIGRATION_NOTES.md - Step-by-step checklist
-
-${GREEN}═══════════════════════════════════════════════════════════${NC}
-
-EOF
-}
-
-main() {
-    log_info "Multi-Tenant Migration Starting..."
-    
-    if [[ "$DRY_RUN" == "dry-run" ]]; then
-        log_warning "Running in DRY-RUN mode - no changes will be made"
-    fi
-    
-    check_prerequisites || exit 1
-    create_backups
-    check_tenant_modules || exit 1
-    check_docker_files
-    update_app_py || true
-    update_requirements
-    validate_setup || exit 1
-    generate_migration_guide
-    
-    print_summary
-    
-    if [[ "$DRY_RUN" == "dry-run" ]]; then
-        log_warning "DRY-RUN completed - no changes were made"
-        log_info "Run without 'dry-run' parameter to execute migration"
-    fi
-}
-
-main "$@"

rebuild-venv.sh

@@ -1,119 +0,0 @@
-#!/bin/bash
-
-# This script completely rebuilds the virtual environment
-# It should be run as root/sudo
-
-# Get the script directory
-SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
-VENV_DIR="$SCRIPT_DIR/.venv"
-BACKUP_DIR="$SCRIPT_DIR/.venv_backup_$(date +%Y%m%d%H%M%S)"
-
-# Function to log messages
-log_message() {
-    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
-}
-
-log_message "Starting virtual environment rebuild"
-
-# Backup existing virtual environment if it exists
-if [ -d "$VENV_DIR" ]; then
-    log_message "Backing up existing virtual environment to $BACKUP_DIR"
-    mv "$VENV_DIR" "$BACKUP_DIR" || {
-        log_message "ERROR: Failed to backup existing virtual environment. Proceeding without backup."
-        rm -rf "$VENV_DIR"
-    }
-fi
-
-# Create logs directory with proper permissions
-log_message "Ensuring logs directory exists with proper permissions"
-mkdir -p "$SCRIPT_DIR/logs"
-chmod 777 "$SCRIPT_DIR/logs" || log_message "WARNING: Could not set permissions on logs directory"
-
-# Create a new virtual environment
-log_message "Creating new virtual environment"
-python3 -m venv "$VENV_DIR" || {
-    log_message "ERROR: Failed to create virtual environment. Trying with system packages..."
-    python3 -m venv "$VENV_DIR" --system-site-packages || {
-        log_message "ERROR: Failed to create virtual environment even with system packages. Exiting."
-        exit 1
-    }
-}
-
-# Set proper permissions
-log_message "Setting permissions for new virtual environment"
-chmod -R 755 "$VENV_DIR" || log_message "WARNING: Could not set permissions on virtual environment"
-find "$VENV_DIR" -type d -exec chmod 755 {} \; 2>/dev/null
-find "$VENV_DIR/bin" -type f -exec chmod +x {} \; 2>/dev/null
-
-# Activate the virtual environment
-log_message "Activating virtual environment"
-source "$VENV_DIR/bin/activate" || {
-    log_message "ERROR: Failed to activate virtual environment"
-    exit 1
-}
-
-# Install packages
-log_message "Upgrading pip"
-pip install --upgrade pip || log_message "WARNING: Failed to upgrade pip"
-
-log_message "Installing pymongo"
-# First ensure bson is removed to avoid conflicts
-pip uninstall -y bson || log_message "WARNING: Failed to uninstall bson (may not exist)"
-# Check if bson directory exists after uninstall and remove it if necessary
-if [ -d "$VENV_DIR/lib/python3.12/site-packages/bson" ]; then
-    log_message "Force removing bson directory"
-    rm -rf "$VENV_DIR/lib/python3.12/site-packages/bson"
-fi
-# Now install pymongo
-pip install pymongo==4.6.3 || log_message "WARNING: Failed to install pymongo"
-# Verify pymongo installation
-python -c "import pymongo; print(f'PyMongo version: {pymongo.__version__}')" && log_message "✓ PyMongo installed correctly" || log_message "WARNING: PyMongo verification failed"
-
-# Install other requirements if they exist
-if [ -f "$SCRIPT_DIR/requirements.txt" ]; then
-    log_message "Installing packages from requirements.txt (excluding bson)"
-    # Create a modified requirements file without bson
-    grep -v "^bson" "$SCRIPT_DIR/requirements.txt" > "$SCRIPT_DIR/requirements_filtered.txt"
-    # Also remove pymongo since we already installed it
-    grep -v "^pymongo" "$SCRIPT_DIR/requirements_filtered.txt" > "$SCRIPT_DIR/requirements_no_conflicts.txt"
-    pip install -r "$SCRIPT_DIR/requirements_no_conflicts.txt" || log_message "WARNING: Failed to install some packages from requirements.txt"
-    rm -f "$SCRIPT_DIR/requirements_filtered.txt" "$SCRIPT_DIR/requirements_no_conflicts.txt"
-    
-    log_message "Verifying pymongo installation after package installation..."
-    # Check if the bson directory from the standalone package still exists and remove it
-    if [ -d "$VENV_DIR/lib/python3.12/site-packages/bson" ]; then
-        log_message "Found standalone bson package, removing it..."
-        rm -rf "$VENV_DIR/lib/python3.12/site-packages/bson"
-        # Reinstall pymongo to ensure it's correctly configured
-        pip install --force-reinstall pymongo==4.6.3
-    fi
-else
-    log_message "No requirements.txt found, installing essential packages manually"
-    pip install flask werkzeug gunicorn pillow qrcode apscheduler python-dateutil pytz requests || {
-        log_message "WARNING: Failed to install some essential packages"
-    }
-fi
-
-# Deactivate virtual environment
-deactivate
-
-# Verify the virtual environment works correctly
-log_message "Verifying virtual environment..."
-if "$VENV_DIR/bin/python" -c "import pymongo, flask, gunicorn, requests, PIL, apscheduler; exit(0)" 2>/dev/null; then
-    log_message "✓ Virtual environment verification successful"
-    
-    # Clean up backup if everything works
-    if [ -d "$BACKUP_DIR" ]; then
-        log_message "Removing backup virtual environment since verification was successful"
-        rm -rf "$BACKUP_DIR"
-        log_message "✓ Backup environment removed"
-    fi
-else
-    log_message "WARNING: Virtual environment verification failed"
-    log_message "Keeping backup at $BACKUP_DIR in case it's needed for recovery"
-fi
-
-log_message "Virtual environment rebuild complete"
-log_message "You can now run the restart.sh script"
-
-exit 0

restart.sh

@@ -1,14 +1,107 @@
-#!/bin/bash
-
-# Nur die App neu bauen und starten, ohne den Tunnel oder die DB zu killen
-docker compose up -d --build app
-
-# Optional: Alles aufräumen, was nicht mehr gebraucht wird
-docker image prune -f
-
+#!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+cd "$SCRIPT_DIR"
 
-"$SCRIPT_DIR/stop.sh" "$@"
-"$SCRIPT_DIR/start.sh" "$@"
+COMPOSE_FILE="docker-compose-multitenant.yml"
+ENV_FILE="$SCRIPT_DIR/.docker-build.env"
+RUNTIME_COMPOSE_OVERRIDE_FILE="$SCRIPT_DIR/.docker-compose.runtime.override.yml"
+
+parse_port_list() {
+    local raw="$1"
+    local port
+    local ports=()
+    raw="${raw//,/ }"
+    for port in $raw; do
+        port="${port//[[:space:]]/}"
+        if [ -n "$port" ] && printf '%s\n' "$port" | grep -qE '^[0-9]+$'; then
+            ports+=("$port")
+        fi
+    done
+    printf '%s\n' "${ports[@]}"
+}
+
+write_runtime_override() {
+    local current_ports=""
+    local app_image=""
+    local ports=()
+
+    if [ -f "$ENV_FILE" ]; then
+        app_image="$(awk -F= '/^INVENTAR_APP_IMAGE=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        current_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        if [ -z "$current_ports" ]; then
+            current_ports="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        fi
+    fi
+
+    if [ -n "$app_image" ]; then
+        if [ -n "$current_ports" ]; then
+            mapfile -t ports < <(parse_port_list "$current_ports")
+        fi
+
+        cat > "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+services:
+  app:
+    image: $app_image
+    build: null
+EOF
+        if [ ${#ports[@]} -gt 0 ]; then
+            cat >> "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+    ports:
+EOF
+            for port in "${ports[@]}"; do
+                if [ -n "$port" ]; then
+                    cat >> "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+      - "$port:8000"
+EOF
+                fi
+            done
+        fi
+    else
+        rm -f "$RUNTIME_COMPOSE_OVERRIDE_FILE"
+    fi
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --multitenant)
+            COMPOSE_FILE="docker-compose-multitenant.yml"
+            shift
+            ;;
+        *)
+            shift
+            ;;
+    esac
+done
+
+if ! command -v docker >/dev/null 2>&1; then
+    echo "Error: docker command not found. Install Docker first."
+    exit 1
+fi
+
+echo "Rebuilding and/or restarting app container using $COMPOSE_FILE..."
+write_runtime_override
+compose_args=(-f "$COMPOSE_FILE")
+if [ -f "$RUNTIME_COMPOSE_OVERRIDE_FILE" ]; then
+    compose_args+=( -f "$RUNTIME_COMPOSE_OVERRIDE_FILE" )
+fi
+if [ -f "$ENV_FILE" ]; then
+    compose_args+=( --env-file "$ENV_FILE" )
+fi
+
+if [ -f "$SCRIPT_DIR/Dockerfile" ]; then
+    docker compose "${compose_args[@]}" up -d --build --force-recreate app
+else
+    echo "Warning: Dockerfile not found in $SCRIPT_DIR. Skipping build and restarting existing app container."
+    if ! docker compose "${compose_args[@]}" up -d --no-build --force-recreate app; then
+        echo "Warning: app image not found or not available locally. Attempting docker compose pull app..."
+        docker compose "${compose_args[@]}" pull app
+        docker compose "${compose_args[@]}" up -d --no-build --force-recreate app
+    fi
+fi
+
+echo "Cleaning up unused Docker images..."
+docker image prune -f
+
+echo "App restart complete."

restore.sh

@@ -1,538 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-LOG_DIR="$SCRIPT_DIR/logs"
-LOG_FILE="$LOG_DIR/restore.log"
-WORK_DIR="$(mktemp -d /tmp/inventarsystem-restore-XXXXXX)"
-
-DB_NAME="${INVENTAR_MONGODB_DB:-inventar_default}"
-SOURCE_PATH=""
-BACKUP_DATE=""
-DROP_DATABASE=false
-RESTART_SERVICES=false
-STAGED_PATH=""
-COMPOSE_FILE="docker-compose-multitenant.yml"
-
-BACKUP_ROOT_LOCAL="$SCRIPT_DIR/backups"
-BACKUP_ROOT_SYSTEM="/var/backups"
-
-SUDO=""
-if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
-    SUDO="sudo"
-fi
-
-DOCKER_COMPOSE=()
-
-cleanup() {
-    rm -rf "$WORK_DIR" >/dev/null 2>&1 || true
-}
-trap cleanup EXIT
-
-mkdir -p "$LOG_DIR"
-
-log() {
-    local msg="$1"
-    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $msg" | tee -a "$LOG_FILE"
-}
-
-show_help() {
-    cat <<EOF
-Inventarsystem Restore / Porting Tool (Docker-first)
-
-Usage:
-  $0 --source <path> [options]
-  $0 --date <YYYY-MM-DD|latest> [options]
-  $0 --list
-
-Options:
-  --source <path>         Backup source path.
-                          Supported:
-                          - old folder with CSV files
-                          - old Inventarsystem-*.tar.gz backup
-                          - new mongodb-*.archive.gz backup
-                          - folder containing mongodb-*.archive.gz
-  --date <value>          Resolve source from known backup locations.
-                          - YYYY-MM-DD: checks backups/YYYY-MM-DD and /var/backups/Inventarsystem-YYYY-MM-DD(.tar.gz)
-                          - latest: newest from local/system backup roots
-  --drop-database         Drop target DB before import (recommended for full restore)
-  --restart-services      Restart stack after restore
-    --multitenant           Use docker-compose-multitenant.yml (default)
-    --singletenant          Use docker-compose.yml
-  --list                  List detected backup candidates
-  --help                  Show this help
-
-Notes:
-  - Always restores into current DB name: $DB_NAME
-  - Supports both legacy CSV and new archive backups
-  - Normalizes collection names to current structure (users, items, ausleihungen, filter_presets, settings)
-EOF
-}
-
-setup_compose() {
-    if docker compose version >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
-        DOCKER_COMPOSE=(docker compose -f "$SCRIPT_DIR/$COMPOSE_FILE")
-        return 0
-    fi
-
-    if [ -n "$SUDO" ] && $SUDO docker compose version >/dev/null 2>&1 && $SUDO docker info >/dev/null 2>&1; then
-        DOCKER_COMPOSE=($SUDO docker compose -f "$SCRIPT_DIR/$COMPOSE_FILE")
-        return 0
-    fi
-
-    log "ERROR: docker compose is not available"
-    exit 1
-}
-
-compose() {
-    "${DOCKER_COMPOSE[@]}" "$@"
-}
-
-list_backups() {
-    echo "Detected backup candidates:"
-
-    if [ -d "$BACKUP_ROOT_LOCAL" ]; then
-        find "$BACKUP_ROOT_LOCAL" -maxdepth 2 \( -type d -name "20*" -o -type f -name "*.archive.gz" -o -type f -name "Inventarsystem-*.tar.gz" \) 2>/dev/null | sort
-    fi
-
-    if [ -d "$BACKUP_ROOT_SYSTEM" ]; then
-        find "$BACKUP_ROOT_SYSTEM" -maxdepth 1 \( -type d -name "Inventarsystem-*" -o -type f -name "Inventarsystem-*.tar.gz" \) 2>/dev/null | sort
-    fi
-}
-
-resolve_latest_source() {
-    local latest
-    latest="$({
-        if [ -d "$BACKUP_ROOT_LOCAL" ]; then
-            find "$BACKUP_ROOT_LOCAL" -maxdepth 2 \( -type d -name "20*" -o -type f -name "*.archive.gz" -o -type f -name "Inventarsystem-*.tar.gz" \) -printf '%T@ %p\n' 2>/dev/null
-        fi
-        if [ -d "$BACKUP_ROOT_SYSTEM" ]; then
-            find "$BACKUP_ROOT_SYSTEM" -maxdepth 1 \( -type d -name "Inventarsystem-*" -o -type f -name "Inventarsystem-*.tar.gz" \) -printf '%T@ %p\n' 2>/dev/null
-        fi
-    } | sort -nr | head -n1 | cut -d' ' -f2-)"
-
-    if [ -z "$latest" ]; then
-        log "ERROR: no backup candidates found"
-        exit 1
-    fi
-
-    SOURCE_PATH="$latest"
-}
-
-resolve_date_source() {
-    local d="$1"
-
-    if [ "$d" = "latest" ]; then
-        resolve_latest_source
-        return
-    fi
-
-    local p1="$BACKUP_ROOT_LOCAL/$d"
-    local p2="$BACKUP_ROOT_SYSTEM/Inventarsystem-$d"
-    local p3="$BACKUP_ROOT_SYSTEM/Inventarsystem-$d.tar.gz"
-
-    if [ -e "$p1" ]; then
-        SOURCE_PATH="$p1"
-    elif [ -e "$p2" ]; then
-        SOURCE_PATH="$p2"
-    elif [ -e "$p3" ]; then
-        SOURCE_PATH="$p3"
-    else
-        log "ERROR: no backup found for date $d"
-        exit 1
-    fi
-}
-
-ensure_stack() {
-    log "Ensuring mongodb/app services are running..."
-    compose up -d mongodb app >/dev/null
-
-    if ! compose ps --status running mongodb | grep -q mongodb; then
-        log "ERROR: mongodb container is not running"
-        exit 1
-    fi
-
-    if ! compose ps --status running app | grep -q app; then
-        log "ERROR: app container is not running"
-        exit 1
-    fi
-}
-
-stage_source() {
-    local src="$1"
-
-    if [ ! -e "$src" ]; then
-        log "ERROR: source path does not exist: $src"
-        exit 1
-    fi
-
-    if [ -f "$src" ] && [[ "$src" == *.tar.gz ]]; then
-        log "Extracting tar backup: $src"
-        tar -xzf "$src" -C "$WORK_DIR"
-        STAGED_PATH="$WORK_DIR"
-        return
-    fi
-
-    if [ -f "$src" ]; then
-        cp -f "$src" "$WORK_DIR/"
-        STAGED_PATH="$WORK_DIR"
-        return
-    fi
-
-    if [ -d "$src" ]; then
-        STAGED_PATH="$src"
-        return
-    fi
-
-    log "ERROR: unsupported source type: $src"
-    exit 1
-}
-
-find_archive_file() {
-    local root="$1"
-    find "$root" -type f \( -name "*.archive.gz" -o -name "*.archive" \) 2>/dev/null | head -n1 || true
-}
-
-find_best_csv_dir() {
-    local root="$1"
-    local best_dir=""
-    local best_count=0
-
-    while IFS= read -r dir; do
-        [ -z "$dir" ] && continue
-        local count
-        count="$(find "$dir" -maxdepth 1 -type f -name '*.csv' | wc -l | tr -d ' ')"
-        if [ "$count" -gt "$best_count" ]; then
-            best_count="$count"
-            best_dir="$dir"
-        fi
-    done < <(find "$root" -type f -name '*.csv' -printf '%h\n' 2>/dev/null | sort -u)
-
-    if [ "$best_count" -gt 0 ]; then
-        echo "$best_dir"
-    fi
-}
-
-normalize_structure() {
-    local py="$WORK_DIR/normalize_db.py"
-
-    cat > "$py" <<'PY'
-from pymongo import MongoClient
-import os
-
-db_name = os.getenv("DB_NAME", "Inventarsystem")
-host = os.getenv("INVENTAR_MONGODB_HOST", "mongodb")
-port = int(os.getenv("INVENTAR_MONGODB_PORT", "27017"))
-
-client = MongoClient(host, port)
-db = client[db_name]
-
-rename_map = {
-    "user": "users",
-    "item": "items",
-    "ausleihung": "ausleihungen",
-    "filter_preset": "filter_presets",
-    "preset": "filter_presets",
-    "setting": "settings",
-}
-
-for old, new in rename_map.items():
-    if old not in db.list_collection_names():
-        continue
-
-    if new not in db.list_collection_names():
-        db[old].rename(new)
-        print(f"Renamed collection {old} -> {new}")
-        continue
-
-    moved = 0
-    for doc in db[old].find({}):
-        db[new].insert_one(doc)
-        moved += 1
-    db[old].drop()
-    print(f"Merged {moved} docs from {old} into {new}")
-
-print("Final collections:", sorted(db.list_collection_names()))
-PY
-
-    local app_cid
-    app_cid="$(compose ps -q app)"
-
-    $SUDO docker cp "$py" "$app_cid:/tmp/normalize_db.py"
-    compose exec -T app env DB_NAME="$DB_NAME" python /tmp/normalize_db.py
-}
-
-import_archive() {
-    local archive_file="$1"
-    local mongo_cid
-
-    mongo_cid="$(compose ps -q mongodb)"
-    if [ -z "$mongo_cid" ]; then
-        log "ERROR: could not resolve mongodb container id"
-        exit 1
-    fi
-
-    log "Importing archive backup: $archive_file"
-    $SUDO docker cp "$archive_file" "$mongo_cid:/tmp/restore.archive.gz"
-
-    local drop_flag=""
-    if [ "$DROP_DATABASE" = true ]; then
-        drop_flag="--drop"
-    fi
-
-    compose exec -T mongodb sh -lc "mongorestore --archive=/tmp/restore.archive.gz --gzip $drop_flag"
-    compose exec -T mongodb rm -f /tmp/restore.archive.gz >/dev/null 2>&1 || true
-
-    normalize_structure
-}
-
-import_csv() {
-    local csv_dir="$1"
-    local app_cid py
-
-    app_cid="$(compose ps -q app)"
-    if [ -z "$app_cid" ]; then
-        log "ERROR: could not resolve app container id"
-        exit 1
-    fi
-
-    log "Importing CSV backup directory: $csv_dir"
-    compose exec -T app sh -lc "rm -rf /tmp/restore_csv && mkdir -p /tmp/restore_csv"
-    $SUDO docker cp "$csv_dir/." "$app_cid:/tmp/restore_csv"
-
-    py="$WORK_DIR/import_csv.py"
-    cat > "$py" <<'PY'
-import os
-import csv
-import ast
-import re
-from pymongo import MongoClient
-from bson.objectid import ObjectId
-
-DB_NAME = os.getenv("DB_NAME", "Inventarsystem")
-CSV_DIR = os.getenv("CSV_DIR", "/tmp/restore_csv")
-DROP_DATABASE = os.getenv("DROP_DATABASE", "false").lower() == "true"
-HOST = os.getenv("INVENTAR_MONGODB_HOST", "mongodb")
-PORT = int(os.getenv("INVENTAR_MONGODB_PORT", "27017"))
-
-COLLECTION_MAP = {
-    "users": "users",
-    "user": "users",
-    "items": "items",
-    "item": "items",
-    "ausleihungen": "ausleihungen",
-    "ausleihung": "ausleihungen",
-    "filter_presets": "filter_presets",
-    "filter_preset": "filter_presets",
-    "settings": "settings",
-    "setting": "settings",
-}
-
-BOOL_FIELDS = {"Admin", "Verfuegbar", "enabled"}
-INT_FIELDS = {"Anschaffungskosten", "filter_num"}
-OID_LIKE_FIELDS = {"_id", "Item"}
-
-client = MongoClient(HOST, PORT)
-db = client[DB_NAME]
-
-if DROP_DATABASE:
-    client.drop_database(DB_NAME)
-    db = client[DB_NAME]
-
-
-def parse_scalar(key, value):
-    if value is None:
-        return None
-
-    value = value.strip()
-    if value == "":
-        return None
-
-    if key in BOOL_FIELDS:
-        lowered = value.lower()
-        if lowered == "true":
-            return True
-        if lowered == "false":
-            return False
-
-    if key in INT_FIELDS:
-        try:
-            return int(value)
-        except Exception:
-            pass
-
-    if key in OID_LIKE_FIELDS and re.fullmatch(r"[0-9a-fA-F]{24}", value):
-        return ObjectId(value)
-
-    if value.startswith("[") and value.endswith("]"):
-        try:
-            return ast.literal_eval(value)
-        except Exception:
-            pass
-
-    return value
-
-
-def load_csv_file(csv_path):
-    docs = []
-    with open(csv_path, "r", newline="", encoding="utf-8") as f:
-        reader = csv.DictReader(f)
-        for row in reader:
-            doc = {}
-            for key, value in row.items():
-                doc[key] = parse_scalar(key, value)
-            docs.append(doc)
-    return docs
-
-
-csv_files = [
-    os.path.join(CSV_DIR, f)
-    for f in sorted(os.listdir(CSV_DIR))
-    if f.endswith(".csv")
-]
-
-if not csv_files:
-    raise SystemExit(f"No CSV files found in {CSV_DIR}")
-
-for csv_file in csv_files:
-    base = os.path.splitext(os.path.basename(csv_file))[0]
-    coll = COLLECTION_MAP.get(base, base)
-
-    docs = load_csv_file(csv_file)
-    db[coll].drop()
-    if docs:
-        db[coll].insert_many(docs)
-    print(f"Imported {len(docs)} docs into {coll} from {os.path.basename(csv_file)}")
-
-print("Collections after CSV import:", sorted(db.list_collection_names()))
-PY
-
-    $SUDO docker cp "$py" "$app_cid:/tmp/import_csv.py"
-    compose exec -T app env DB_NAME="$DB_NAME" CSV_DIR="/tmp/restore_csv" DROP_DATABASE="$DROP_DATABASE" python /tmp/import_csv.py
-
-    normalize_structure
-}
-
-print_counts() {
-    local py="$WORK_DIR/print_counts.py"
-
-    cat > "$py" <<'PY'
-from pymongo import MongoClient
-import os
-
-db_name = os.getenv("DB_NAME", "Inventarsystem")
-host = os.getenv("INVENTAR_MONGODB_HOST", "mongodb")
-port = int(os.getenv("INVENTAR_MONGODB_PORT", "27017"))
-
-client = MongoClient(host, port)
-db = client[db_name]
-
-for name in ["users", "items", "ausleihungen", "filter_presets", "settings"]:
-    try:
-        count = db[name].count_documents({})
-    except Exception:
-        count = -1
-    print(f"{name}: {count}")
-PY
-
-    local app_cid
-    app_cid="$(compose ps -q app)"
-    $SUDO docker cp "$py" "$app_cid:/tmp/print_counts.py"
-
-    log "Post-restore collection counts:"
-    compose exec -T app env DB_NAME="$DB_NAME" python /tmp/print_counts.py | tee -a "$LOG_FILE"
-}
-
-parse_args() {
-    while [ "$#" -gt 0 ]; do
-        case "$1" in
-            --source)
-                SOURCE_PATH="${2:-}"
-                shift 2
-                ;;
-            --date)
-                BACKUP_DATE="${2:-}"
-                shift 2
-                ;;
-            --drop-database)
-                DROP_DATABASE=true
-                shift
-                ;;
-            --restart-services)
-                RESTART_SERVICES=true
-                shift
-                ;;
-            --multitenant)
-                COMPOSE_FILE="docker-compose-multitenant.yml"
-                shift
-                ;;
-            --singletenant)
-                COMPOSE_FILE="docker-compose.yml"
-                shift
-                ;;
-            --list)
-                list_backups
-                exit 0
-                ;;
-            --help)
-                show_help
-                exit 0
-                ;;
-            *)
-                echo "Unknown argument: $1"
-                show_help
-                exit 1
-                ;;
-        esac
-    done
-}
-
-main() {
-    parse_args "$@"
-    setup_compose
-
-    if [ -n "$SOURCE_PATH" ] && [ -n "$BACKUP_DATE" ]; then
-        log "ERROR: use either --source or --date, not both"
-        exit 1
-    fi
-
-    if [ -z "$SOURCE_PATH" ] && [ -n "$BACKUP_DATE" ]; then
-        resolve_date_source "$BACKUP_DATE"
-    fi
-
-    if [ -z "$SOURCE_PATH" ]; then
-        log "ERROR: provide --source <path> or --date <YYYY-MM-DD|latest>"
-        show_help
-        exit 1
-    fi
-
-    ensure_stack
-
-    local staged archive_file csv_dir
-    stage_source "$SOURCE_PATH"
-    staged="$STAGED_PATH"
-    archive_file="$(find_archive_file "$staged")"
-
-    if [ -n "$archive_file" ]; then
-        import_archive "$archive_file"
-        print_counts
-    else
-        csv_dir="$(find_best_csv_dir "$staged")"
-        if [ -z "$csv_dir" ]; then
-            log "ERROR: no supported backup data found under: $SOURCE_PATH"
-            log "Expected either *.archive.gz or CSV files"
-            exit 1
-        fi
-        import_csv "$csv_dir"
-        print_counts
-    fi
-
-    if [ "$RESTART_SERVICES" = true ]; then
-        log "Restarting services..."
-        "$SCRIPT_DIR/restart.sh"
-    fi
-
-    log "Restore completed successfully into DB: $DB_NAME"
-}
-
-main "$@"

run-backup.sh

@@ -1,47 +1,4 @@
-#!/bin/bash
-# Helper script to run the backup with proper Python environment
-
-# Get the script directory
-SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
-
-# Default values if no arguments provided
-if [ $# -eq 0 ]; then
-    # Define default values
-    DB="Inventarsystem"
-    URI="mongodb://localhost:27017/"
-    OUT="$SCRIPT_DIR/backups/$(date +%Y-%m-%d)"
-    
-    echo "No arguments provided. Using defaults:"
-    echo "  --uri $URI"
-    echo "  --db $DB"
-    echo "  --out $OUT"
-    
-    # Create output directory if it doesn't exist
-    mkdir -p "$OUT"
-    
-    # Set the arguments
-    ARGS="--uri $URI --db $DB --out $OUT"
-else
-    # Use provided arguments
-    ARGS="$@"
-fi
-
-# Check if we're in a virtual environment
-if [ -f "$SCRIPT_DIR/.venv/bin/python" ]; then
-    # Check if we have execute permissions for the virtual environment Python
-    if [ -x "$SCRIPT_DIR/.venv/bin/python" ]; then
-        # Use the virtual environment's Python
-        "$SCRIPT_DIR/.venv/bin/python" "$SCRIPT_DIR/Backup-DB.py" $ARGS || {
-            echo "Failed to execute with virtual environment Python. Trying system Python..."
-            python3 "$SCRIPT_DIR/Backup-DB.py" $ARGS
-        }
-    else
-        echo "Virtual environment found but Python is not executable. Using system Python instead."
-        echo "To fix virtual environment permissions, run: sudo ./rebuild-venv.sh"
-        python3 "$SCRIPT_DIR/Backup-DB.py" $ARGS
-    fi
-else
-    # Use system Python
-    echo "No virtual environment found. Using system Python."
-    python3 "$SCRIPT_DIR/Backup-DB.py" $ARGS
-fi
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+exec "$SCRIPT_DIR/backup.sh" "$@"

run-tenant-cmd.sh

@@ -1,3 +1,5 @@
 #!/bin/bash
 # Wrapper to run tenant management fully containerized via docker-compose
-docker compose -f docker-compose-multitenant.yml --profile tools run --rm tenant-manager "$@"
+PROJECT_NAME=${COMPOSE_PROJECT_NAME:-$(basename "$PWD" | tr '[:upper:]' '[:lower:]')}
+# Pass the absolute working directory to the container so docker compose can resolve paths correctly
+docker compose -f docker-compose-multitenant.yml --profile tools run --rm -e COMPOSE_PROJECT_NAME="$PROJECT_NAME" -e HOST_WORKDIR="$PWD" tenant-manager "$@"

start.sh

@@ -14,9 +14,15 @@ if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
     SUDO="sudo"
 fi
 
+IS_ROOT="false"
+if [ "$(id -u)" -eq 0 ]; then
+    IS_ROOT="true"
+fi
+
 NUITKA_BUILD_VALUE="0"
-HTTP_PORT_VALUE="8001"
-HTTPS_PORT_VALUE="8443"
+HTTP_PORT_VALUE="10000"
+HTTP_PORTS_VALUE=""
+DEFAULT_TENANT_PORT_START="${INVENTAR_TENANT_PORT_START:-10000}"
 CRON_SETUP_VALUE="${INVENTAR_SETUP_CRON:-1}"
 APP_IMAGE_VALUE="${INVENTAR_APP_IMAGE:-$APP_IMAGE_REPO:latest}"
 COMPOSE_FILE="docker-compose-multitenant.yml"
@@ -31,7 +37,6 @@ Options:
   --no-cron         Do not create or update cron jobs
   --with-cron       Create/update cron jobs (default)
   --multitenant     Use the multi-tenant architecture deployment
-    --singletenant    Use the legacy single-tenant compose deployment
   -h, --help        Show this help message
 EOF
 }
@@ -51,10 +56,6 @@ parse_args() {
                 COMPOSE_FILE="docker-compose-multitenant.yml"
                 shift
                 ;;
-            --singletenant)
-                COMPOSE_FILE="docker-compose.yml"
-                shift
-                ;;
             -h|--help)
                 usage
                 exit 0
@@ -114,7 +115,11 @@ ensure_runtime_dependencies() {
     local missing=()
 
     if ! command -v docker >/dev/null 2>&1; then
-        install_docker_engine
+        if [ "$IS_ROOT" = "true" ]; then
+            install_docker_engine
+        else
+            missing+=(docker)
+        fi
     fi
 
     if ! docker compose version >/dev/null 2>&1; then
@@ -138,14 +143,20 @@ ensure_runtime_dependencies() {
     fi
 
     if [ "${#missing[@]}" -gt 0 ]; then
-        echo "Installing missing dependencies: ${missing[*]}"
-        apt_install "${missing[@]}"
+        if [ "$IS_ROOT" = "true" ]; then
+            echo "Installing missing dependencies: ${missing[*]}"
+            apt_install "${missing[@]}"
+        else
+            echo "ERROR: Missing dependencies: ${missing[*]}"
+            echo "Please install the missing tools or run this script as root."
+            exit 1
+        fi
     fi
 
-    if command -v systemctl >/dev/null 2>&1; then
-        $SUDO systemctl enable --now docker >/dev/null 2>&1 || true
+    if [ "$IS_ROOT" = "true" ] && command -v systemctl >/dev/null 2>&1; then
+        systemctl enable --now docker >/dev/null 2>&1 || true
         if cron_setup_enabled; then
-            $SUDO systemctl enable --now cron >/dev/null 2>&1 || true
+            systemctl enable --now cron >/dev/null 2>&1 || true
         fi
     fi
 }
@@ -158,6 +169,11 @@ setup_boot_autostart_service() {
         return 0
     fi
 
+    if [ "$IS_ROOT" != "true" ]; then
+        echo "Skipping systemd autostart setup when not running as root."
+        return 0
+    fi
+
     if ! command -v systemctl >/dev/null 2>&1; then
         return 0
     fi
@@ -199,6 +215,11 @@ setup_scheduled_jobs() {
         return 0
     fi
 
+    if [ "$IS_ROOT" != "true" ]; then
+        echo "Skipping cron job setup when not running as root."
+        return 0
+    fi
+
     if ! command -v crontab >/dev/null 2>&1; then
         echo "Warning: crontab not available, skipping nightly update setup"
         return 0
@@ -209,101 +230,17 @@ setup_scheduled_jobs() {
     backup_line="30 2 * * * cd $SCRIPT_DIR && ./backup.sh --mode auto >> $SCRIPT_DIR/logs/backup.log 2>&1"
 
     local existing_cron
-    if [ "$(id -u)" -eq 0 ]; then
-        existing_cron="$(crontab -l 2>/dev/null || true)"
-        {
-            printf '%s\n' "$existing_cron" | grep -vF "$SCRIPT_DIR/update.sh" | grep -vF "$SCRIPT_DIR/backup-docker.sh" | grep -vF "$SCRIPT_DIR/backup.sh" || true
-            echo "$backup_line"
-            echo "$update_line"
-        } | crontab -
-    else
-        existing_cron="$($SUDO crontab -l 2>/dev/null || true)"
-        {
-            printf '%s\n' "$existing_cron" | grep -vF "$SCRIPT_DIR/update.sh" | grep -vF "$SCRIPT_DIR/backup-docker.sh" | grep -vF "$SCRIPT_DIR/backup.sh" || true
-            echo "$backup_line"
-            echo "$update_line"
-        } | $SUDO crontab -
-    fi
+    existing_cron="$(crontab -l 2>/dev/null || true)"
+    {
+        printf '%s\n' "$existing_cron" | grep -vF "$SCRIPT_DIR/update.sh" | grep -vF "$SCRIPT_DIR/backup-docker.sh" | grep -vF "$SCRIPT_DIR/backup.sh" || true
+        echo "$backup_line"
+        echo "$update_line"
+    } | crontab -
 
     echo "Nightly backup scheduled at 02:30"
     echo "Nightly auto-update scheduled at 03:00"
 }
 
-ensure_tls_certificates() {
-    local cert_dir cert_path key_path cn
-    cert_dir="$SCRIPT_DIR/certs"
-    cert_path="$cert_dir/inventarsystem.crt"
-    key_path="$cert_dir/inventarsystem.key"
-
-    mkdir -p "$cert_dir"
-
-    if [ -f "$cert_path" ] && [ -f "$key_path" ]; then
-        return 0
-    fi
-
-    cn="${TLS_CN:-localhost}"
-    echo "No TLS certificates found. Generating self-signed certificate for CN=$cn"
-
-    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-        -keyout "$key_path" \
-        -out "$cert_path" \
-        -subj "/C=DE/ST=NA/L=NA/O=Inventarsystem/OU=IT/CN=$cn" >/dev/null 2>&1
-
-    chmod 600 "$key_path"
-    chmod 644 "$cert_path"
-}
-
-ensure_nginx_config_mount_source() {
-    local nginx_dir config_path backup_path
-    nginx_dir="$SCRIPT_DIR/docker/nginx"
-    config_path="$nginx_dir/default.conf"
-
-    mkdir -p "$nginx_dir"
-
-    if [ -d "$config_path" ]; then
-        backup_path="${config_path}.dir.$(date +%Y%m%d-%H%M%S).bak"
-        mv "$config_path" "$backup_path"
-        echo "Warning: moved unexpected directory $config_path to $backup_path"
-    fi
-
-    if [ ! -f "$config_path" ]; then
-        cat > "$config_path" <<'EOF'
-server {
-    listen 80;
-    server_name _;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    server_name _;
-
-    ssl_certificate /etc/nginx/certs/inventarsystem.crt;
-    ssl_certificate_key /etc/nginx/certs/inventarsystem.key;
-
-    client_max_body_size 50M;
-
-    location / {
-        proxy_pass http://app:8000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 300;
-    }
-
-    error_page 500 502 503 504 /50x.html;
-    location = /50x.html {
-        default_type text/html;
-        return 200 '<!doctype html><html><head><meta charset="utf-8"><title>Server Error</title></head><body><h1>Server Error</h1><p>The service is temporarily unavailable.</p></body></html>';
-    }
-}
-EOF
-        echo "Recreated missing nginx config at $config_path"
-    fi
-}
-
 ensure_runtime_config_json() {
         local config_path backup_path
         config_path="$SCRIPT_DIR/config.json"
@@ -320,7 +257,7 @@ ensure_runtime_config_json() {
     "ver": "2.6.5",
     "dbg": false,
     "host": "0.0.0.0",
-    "port": 443,
+    "port": 8000,
     "mongodb": {
         "host": "mongodb",
         "port": 27017,
@@ -441,16 +378,6 @@ resolve_app_image() {
     fi
 }
 
-configure_cloudflared_profile() {
-    if [ -f /etc/cloudflared/credentials.json ]; then
-        COMPOSE_PROFILES_VALUE="cloudflare"
-        echo "Cloudflared tunnel: enabled (homeserver)"
-    else
-        COMPOSE_PROFILES_VALUE=""
-        echo "Cloudflared tunnel: disabled (missing /etc/cloudflared/credentials.json)"
-    fi
-}
-
 port_in_use() {
     local port="$1"
 
@@ -469,97 +396,75 @@ find_free_port() {
     echo "$port"
 }
 
-stack_owns_host_port() {
-    local requested_port="$1"
-    local container_port="$2"
-    local mapped_port
-
-    mapped_port="$(docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" port nginx "$container_port" 2>/dev/null | tail -n1 || true)"
-    if [ -z "$mapped_port" ]; then
-        return 1
-    fi
-
-    mapped_port="${mapped_port##*:}"
-    [ "$mapped_port" = "$requested_port" ]
-}
-
-stop_host_nginx_services() {
-    local stopped_any=false
-    local service_name
-
-    if ! command -v systemctl >/dev/null 2>&1; then
-        return 1
-    fi
-
-    while IFS= read -r service_name; do
-        [ -z "$service_name" ] && continue
-        echo "Stopping host service $service_name to free web ports..."
-        $SUDO systemctl stop "$service_name" >/dev/null 2>&1 || true
-        stopped_any=true
-    done < <(systemctl list-units --type=service --state=active --no-pager 2>/dev/null | awk '{print $1}' | grep -E '(^nginx\.service$|nginx)' || true)
-
-    if [ "$stopped_any" = true ]; then
-        sleep 2
-    fi
-
-    if [ "$stopped_any" = true ]; then
-        return 0
-    fi
-
-    return 1
+parse_port_list() {
+    local raw="$1"
+    local port
+    local ports=()
+    raw="${raw//,/ }"
+    for port in $raw; do
+        port="${port//[[:space:]]/}"
+        if [ -n "$port" ] && printf '%s\n' "$port" | grep -qE '^[0-9]+$'; then
+            ports+=("$port")
+        fi
+    done
+    printf '%s\n' "${ports[@]}"
 }
 
 configure_host_ports() {
-    local requested_http requested_https
+    local requested_http
+    local requested_ports
+    local ports=()
+    local occupied_ports=()
 
     requested_http=""
+    requested_ports=""
     if [ -f "$ENV_FILE" ]; then
         requested_http="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ' || true)"
-    fi
-    if [ -z "$requested_http" ]; then
-        requested_http="8001"
+        requested_ports="$(awk -F= '/^INVENTAR_HTTP_PORTS=/{print $2}' "$ENV_FILE" | tr -d ' ' || true)"
     fi
 
-    if stack_owns_host_port "$requested_http" "80"; then
-        HTTP_PORT_VALUE="$requested_http"
-    elif port_in_use "$requested_http"; then
-        
+    if [ -n "${INVENTAR_HTTP_PORTS:-}" ]; then
+        requested_ports="$INVENTAR_HTTP_PORTS"
+    fi
 
-        if ! port_in_use "$requested_http"; then
-            HTTP_PORT_VALUE="$requested_http"
-            echo "Freed HTTP port $requested_http by stopping host nginx service"
-        else
-            HTTP_PORT_VALUE="$(find_free_port 8080)"
-            echo "HTTP port is in use. Using fallback HTTP port: $HTTP_PORT_VALUE"
+    if [ -n "${INVENTAR_HTTP_PORT:-}" ] && [ -z "$requested_ports" ]; then
+        requested_ports="$INVENTAR_HTTP_PORT"
+    fi
+
+    if [ -n "$requested_ports" ]; then
+        mapfile -t ports < <(parse_port_list "$requested_ports")
+    fi
+
+    if [ ${#ports[@]} -gt 0 ]; then
+        HTTP_PORTS_VALUE="${ports[*]}"
+        HTTP_PORT_VALUE="${ports[0]}"
+
+        for port in "${ports[@]}"; do
+            if port_in_use "$port"; then
+                occupied_ports+=("$port")
+            fi
+        done
+
+        if [ ${#occupied_ports[@]} -gt 0 ]; then
+            if [ ${#ports[@]} -eq 1 ]; then
+                HTTP_PORT_VALUE="$(find_free_port "$DEFAULT_TENANT_PORT_START")"
+                echo "Host port ${ports[0]} is already occupied. Assigned new tenant port: $HTTP_PORT_VALUE"
+                HTTP_PORTS_VALUE="$HTTP_PORT_VALUE"
+            else
+                echo "Error: requested host port(s) already in use: ${occupied_ports[*]}"
+                echo "Remove the occupied port(s) from INVENTAR_HTTP_PORTS or stop the conflicting service."
+                exit 1
+            fi
         fi
     else
-        HTTP_PORT_VALUE="$requested_http"
-    fi
+        HTTP_PORT_VALUE="$DEFAULT_TENANT_PORT_START"
+        HTTP_PORTS_VALUE="$HTTP_PORT_VALUE"
 
-    requested_https=""
-    if [ -f "$ENV_FILE" ]; then
-        requested_https="$(awk -F= '/^INVENTAR_HTTPS_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ' || true)"
-    fi
-
-    if [ -z "$requested_https" ]; then
-        requested_https="8443"
-    fi
-
-    if stack_owns_host_port "$requested_https" "443"; then
-        HTTPS_PORT_VALUE="$requested_https"
-    elif port_in_use "$requested_https"; then
-        
-
-        if ! port_in_use "$requested_https"; then
-            HTTPS_PORT_VALUE="$requested_https"
-            echo "Freed HTTPS port $requested_https by stopping host nginx service"
-            return
+        if port_in_use "$HTTP_PORT_VALUE"; then
+            HTTP_PORT_VALUE="$(find_free_port "$DEFAULT_TENANT_PORT_START")"
+            echo "Host port $DEFAULT_TENANT_PORT_START is already occupied. Assigned new tenant port: $HTTP_PORT_VALUE"
+            HTTP_PORTS_VALUE="$HTTP_PORT_VALUE"
         fi
-
-        HTTPS_PORT_VALUE="$(find_free_port 8443)"
-        echo "HTTPS port is in use. Using fallback HTTPS port: $HTTPS_PORT_VALUE"
-    else
-        HTTPS_PORT_VALUE="$requested_https"
     fi
 }
 
@@ -594,12 +499,71 @@ ensure_min_docker_disk_space() {
     fi
 }
 
+detect_server_capacity() {
+    local cpus mem_kb mem_gb app_workers app_cpus app_mem app_mem_swap
+
+    cpus="$(nproc 2>/dev/null || echo 1)"
+    mem_kb="$(awk '/MemAvailable:/ {print $2; exit}' /proc/meminfo 2>/dev/null || awk '/MemTotal:/ {print $2; exit}' /proc/meminfo || echo 0)"
+    mem_gb=$(( (mem_kb + 1024*1024 - 1) / (1024*1024) ))
+
+    if [ "$cpus" -ge 8 ] && [ "$mem_gb" -ge 16 ]; then
+        app_workers=8
+        app_cpus="2.0"
+        app_mem="512m"
+        app_mem_swap="1024m"
+    elif [ "$cpus" -ge 4 ] && [ "$mem_gb" -ge 8 ]; then
+        app_workers=4
+        app_cpus="1.0"
+        app_mem="384m"
+        app_mem_swap="768m"
+    elif [ "$cpus" -ge 2 ] && [ "$mem_gb" -ge 4 ]; then
+        app_workers=2
+        app_cpus="0.75"
+        app_mem="320m"
+        app_mem_swap="640m"
+    else
+        app_workers=1
+        app_cpus="0.5"
+        app_mem="256m"
+        app_mem_swap="512m"
+    fi
+
+    if [ -f "$ENV_FILE" ]; then
+        local env_app_cpus env_app_mem env_app_mem_swap env_workers
+        env_app_cpus="$(awk -F= '/^INVENTAR_APP_CPUS=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        env_app_mem="$(awk -F= '/^INVENTAR_APP_MEM_LIMIT=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        env_app_mem_swap="$(awk -F= '/^INVENTAR_APP_MEM_SWAP_LIMIT=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+        env_workers="$(awk -F= '/^INVENTAR_WORKERS=/{print $2; exit}' "$ENV_FILE" | tr -d ' ' || true)"
+
+        [ -n "$env_app_cpus" ] && app_cpus="$env_app_cpus"
+        [ -n "$env_app_mem" ] && app_mem="$env_app_mem"
+        [ -n "$env_app_mem_swap" ] && app_mem_swap="$env_app_mem_swap"
+        [ -n "$env_workers" ] && app_workers="$env_workers"
+    fi
+
+    INVENTAR_APP_CPUS="${INVENTAR_APP_CPUS:-$app_cpus}"
+    INVENTAR_APP_MEM_LIMIT="${INVENTAR_APP_MEM_LIMIT:-$app_mem}"
+    INVENTAR_APP_MEM_SWAP_LIMIT="${INVENTAR_APP_MEM_SWAP_LIMIT:-$app_mem_swap}"
+    INVENTAR_WORKERS="${INVENTAR_WORKERS:-$app_workers}"
+    INVENTAR_THREADS="${INVENTAR_THREADS:-2}"
+
+    echo "Detected host capacity: CPUs=$cpus, RAM=${mem_gb}GB"
+    echo "Configured app runtime: INVENTAR_WORKERS=$INVENTAR_WORKERS, INVENTAR_APP_CPUS=$INVENTAR_APP_CPUS, INVENTAR_APP_MEM_LIMIT=$INVENTAR_APP_MEM_LIMIT"
+}
+
 write_env_file() {
     cat > "$ENV_FILE" <<EOF
 NUITKA_BUILD=$NUITKA_BUILD_VALUE
 INVENTAR_HTTP_PORT=$HTTP_PORT_VALUE
-INVENTAR_HTTPS_PORT=$HTTPS_PORT_VALUE
+INVENTAR_HTTP_PORTS=${HTTP_PORTS_VALUE// /,}
 INVENTAR_APP_IMAGE=$APP_IMAGE_VALUE
+INVENTAR_APP_CPUS=$INVENTAR_APP_CPUS
+INVENTAR_APP_MEM_LIMIT=$INVENTAR_APP_MEM_LIMIT
+INVENTAR_APP_MEM_SWAP_LIMIT=$INVENTAR_APP_MEM_SWAP_LIMIT
+INVENTAR_WORKERS=$INVENTAR_WORKERS
+INVENTAR_THREADS=$INVENTAR_THREADS
+INVENTAR_WORKER_TIMEOUT=${INVENTAR_WORKER_TIMEOUT:-30}
+INVENTAR_WORKER_CONNECTIONS=${INVENTAR_WORKER_CONNECTIONS:-100}
 EOF
 }
 
@@ -608,10 +572,29 @@ write_runtime_compose_override() {
 services:
   app:
     working_dir: /app/Web
-    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "${INVENTAR_WORKERS:-2}", "--threads", "${INVENTAR_THREADS:-2}", "--timeout", "${INVENTAR_WORKER_TIMEOUT:-30}", "--graceful-timeout", "20", "--worker-connections", "${INVENTAR_WORKER_CONNECTIONS:-100}", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
     image: ${APP_IMAGE_VALUE}
     build: null
 EOF
+
+    if [ -n "$HTTP_PORTS_VALUE" ]; then
+        local ports_array
+        local ports_list
+        ports_list="${HTTP_PORTS_VALUE//,/ }"
+        read -r -a ports_array <<<"$ports_list"
+        if [ "${#ports_array[@]}" -gt 0 ]; then
+            cat >> "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+    ports:
+EOF
+            for port in "${ports_array[@]}"; do
+                if [ -n "$port" ]; then
+                    cat >> "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
+      - "$port:8000"
+EOF
+                fi
+            done
+        fi
+    fi
 }
 
 verify_stack_health() {
@@ -628,10 +611,10 @@ verify_stack_health() {
         for _ in $(seq 1 60); do
             running_services="$(docker compose "${compose_args[@]}" ps --status running --services 2>/dev/null || true)"
             if printf '%s\n' "$running_services" | grep -Fxq app && \
-               printf '%s\n' "$running_services" | grep -Fxq nginx && \
+               printf '%s\n' "$running_services" | grep -Fxq redis && \
                printf '%s\n' "$running_services" | grep -Fxq mongodb; then
                 if docker compose "${compose_args[@]}" exec -T app python3 -c "import flask, pymongo" >/dev/null 2>&1; then
-                    if curl -kfsS "https://127.0.0.1:$HTTPS_PORT_VALUE" >/dev/null 2>&1; then
+                    if curl -fsS "http://127.0.0.1:$HTTP_PORT_VALUE/health" >/dev/null 2>&1; then
                         echo "Health check passed."
                         return 0
                     fi
@@ -644,8 +627,8 @@ verify_stack_health() {
         if [[ $retry_count -eq 0 ]]; then
             echo "Health check failed. Attempting to restart containers..."
             docker compose "${compose_args[@]}" ps || true
-            docker compose "${compose_args[@]}" logs --tail=120 app nginx mongodb || true
-            docker compose "${compose_args[@]}" restart app nginx mongodb
+            docker compose "${compose_args[@]}" logs --tail=120 app redis mongodb || true
+            docker compose "${compose_args[@]}" restart app redis mongodb
             sleep 3
             ((retry_count++))
         else
@@ -656,7 +639,7 @@ verify_stack_health() {
     # Final failure
     echo "Error: stack health check failed after restart attempt."
     docker compose "${compose_args[@]}" ps || true
-    docker compose "${compose_args[@]}" logs --tail=120 app nginx mongodb || true
+    docker compose "${compose_args[@]}" logs --tail=120 app redis mongodb || true
     return 1
 }
 
@@ -664,15 +647,13 @@ parse_args "$@"
 
 ensure_runtime_dependencies
 setup_boot_autostart_service
-ensure_tls_certificates
-ensure_nginx_config_mount_source
 ensure_runtime_config_json
 setup_scheduled_jobs
 configure_nuitka_mode
 resolve_app_image
-configure_cloudflared_profile
 configure_host_ports
 ensure_min_docker_disk_space
+detect_server_capacity
 ensure_app_image_loaded
 write_env_file
 write_runtime_compose_override
@@ -695,4 +676,4 @@ fi
 verify_stack_health
 
 echo "Stack started."
-echo "Open: https://<server-ip>:$HTTPS_PORT_VALUE"
+echo "Open: http://<server-ip>:$HTTP_PORT_VALUE"

stop.sh

@@ -12,10 +12,6 @@ while [[ $# -gt 0 ]]; do
             COMPOSE_FILE="docker-compose-multitenant.yml"
             shift
             ;;
-        --singletenant)
-            COMPOSE_FILE="docker-compose.yml"
-            shift
-            ;;
         *)
             shift
             ;;

update.sh

@@ -38,6 +38,11 @@ if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
     SUDO="sudo"
 fi
 
+IS_ROOT="false"
+if [ "$(id -u)" -eq 0 ]; then
+    IS_ROOT="true"
+fi
+
 apt_install() {
     $SUDO apt-get update -y
     $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$@"
@@ -47,7 +52,7 @@ ensure_runtime_dependencies() {
     local missing=()
 
     if ! command -v docker >/dev/null 2>&1; then
-        missing+=(docker.io)
+        missing+=(docker)
     fi
 
     if ! docker compose version >/dev/null 2>&1; then
@@ -67,63 +72,21 @@ ensure_runtime_dependencies() {
     fi
 
     if [ "${#missing[@]}" -gt 0 ]; then
-        log_message "Installing missing dependencies: ${missing[*]}"
-        apt_install "${missing[@]}"
+        if [ "$IS_ROOT" = "true" ]; then
+            log_message "Installing missing dependencies: ${missing[*]}"
+            apt_install "${missing[@]}"
+        else
+            log_message "ERROR: Missing dependencies: ${missing[*]}"
+            log_message "Install the missing tools manually or re-run as root."
+            exit 1
+        fi
     fi
 
-    if command -v systemctl >/dev/null 2>&1; then
-        $SUDO systemctl enable --now docker >/dev/null 2>&1 || true
+    if [ "$IS_ROOT" = "true" ] && command -v systemctl >/dev/null 2>&1; then
+        systemctl enable --now docker >/dev/null 2>&1 || true
     fi
 }
 
-ensure_tls_certificates() {
-    local cert_dir cert_path key_path cn
-    cert_dir="$PROJECT_DIR/certs"
-    cert_path="$cert_dir/inventarsystem.crt"
-    key_path="$cert_dir/inventarsystem.key"
-
-    mkdir -p "$cert_dir"
-
-    if [ -f "$cert_path" ] && [ -f "$key_path" ]; then
-        return 0
-    fi
-
-    cn="${TLS_CN:-localhost}"
-    log_message "No TLS certificates found. Generating self-signed certificate for CN=$cn"
-
-    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-        -keyout "$key_path" \
-        -out "$cert_path" \
-        -subj "/C=DE/ST=NA/L=NA/O=Inventarsystem/OU=IT/CN=$cn" >/dev/null 2>&1
-
-    chmod 600 "$key_path"
-    chmod 644 "$cert_path"
-}
-
-ensure_nginx_config_mount_source() {
-    local nginx_dir config_path backup_path
-    nginx_dir="$PROJECT_DIR/docker/nginx"
-    config_path="$nginx_dir/default.conf"
-
-    mkdir -p "$nginx_dir"
-
-    if [ -d "$config_path" ]; then
-        backup_path="${config_path}.dir.$(date +%Y%m%d-%H%M%S).bak"
-        mv "$config_path" "$backup_path"
-        log_message "WARNING: Moved unexpected directory $config_path to $backup_path"
-    fi
-
-    if [ ! -f "$config_path" ]; then
-        cat > "$config_path" <<'EOF'
-    fi
-}
-
-server() {
-    listen 80;
-    server_name _;
-    return 301 https://$host$request_uri;
-}
-
 ensure_min_root_disk_space() {
     local available_kb available_mb
 
@@ -183,43 +146,12 @@ cleanup_docker_dangling_images() {
     fi
 }
 
-server {
-    listen 443 ssl;
-    server_name _;
-
-    ssl_certificate /etc/nginx/certs/inventarsystem.crt;
-    ssl_certificate_key /etc/nginx/certs/inventarsystem.key;
-
-    client_max_body_size 50M;
-
-    location / {
-        proxy_pass http://app:8000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 300;
-    }
-
-    error_page 500 502 503 504 /50x.html;
-    location = /50x.html {
-        default_type text/html;
-        return 200 '<!doctype html><html><head><meta charset="utf-8"><title>Server Error</title></head><body><h1>Server Error</h1><p>The service is temporarily unavailable.</p></body></html>';
-    }
-}
-EOF
-        log_message "Recreated missing nginx config at $config_path"
-    fi
-}
-
 usage() {
     cat <<EOF
 Usage: $0 [options]
 
 Options:
   --multitenant      Use docker-compose-multitenant.yml (default)
-  --singletenant     Use docker-compose.yml
   -h, --help         Show this help message
 EOF
 }
@@ -231,10 +163,6 @@ parse_args() {
                 COMPOSE_FILE="docker-compose-multitenant.yml"
                 shift
                 ;;
-            --singletenant)
-                COMPOSE_FILE="docker-compose.yml"
-                shift
-                ;;
             -h|--help)
                 usage
                 exit 0
@@ -411,9 +339,7 @@ download_and_extract_bundle() {
     tar -xzf "$archive" -C "$tmp_dir"
 
     # The bundle must contain docker deployment files only.
-    mkdir -p "$PROJECT_DIR/docker/nginx"
     cp -f "$tmp_dir/docker-compose.yml" "$PROJECT_DIR/docker-compose.yml"
-    cp -f "$tmp_dir/docker/nginx/default.conf" "$PROJECT_DIR/docker/nginx/default.conf"
     cp -f "$tmp_dir/start.sh" "$PROJECT_DIR/start.sh"
     cp -f "$tmp_dir/stop.sh" "$PROJECT_DIR/stop.sh"
 
@@ -429,9 +355,6 @@ download_and_extract_bundle() {
     if [ -f "$tmp_dir/docker-compose-multitenant.yml" ]; then
         cp -f "$tmp_dir/docker-compose-multitenant.yml" "$PROJECT_DIR/docker-compose-multitenant.yml"
     fi
-    if [ -f "$tmp_dir/docker/nginx/multitenant.conf" ]; then
-        cp -f "$tmp_dir/docker/nginx/multitenant.conf" "$PROJECT_DIR/docker/nginx/multitenant.conf"
-    fi
     if [ -f "$tmp_dir/manage-tenant.sh" ]; then
         cp -f "$tmp_dir/manage-tenant.sh" "$PROJECT_DIR/manage-tenant.sh"
     fi
@@ -445,7 +368,7 @@ download_and_extract_bundle() {
     done
 
     # Ensure executable permissions on all copied scripts
-    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/init-admin.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true 2>/dev/null || true
+    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true 2>/dev/null || true
     chmod +x "$PROJECT_DIR"/manage-tenant.sh "$PROJECT_DIR"/run-tenant-cmd.sh 2>/dev/null || true
 
     if [ ! -f "$PROJECT_DIR/config.json" ] && [ -f "$tmp_dir/config.json" ]; then
@@ -453,7 +376,7 @@ download_and_extract_bundle() {
         log_message "Installed default config.json from release bundle"
     fi
 
-    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/init-admin.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true
+    chmod +x "$PROJECT_DIR/start.sh" "$PROJECT_DIR/stop.sh" "$PROJECT_DIR/restart.sh" "$PROJECT_DIR/update.sh" "$PROJECT_DIR/backup.sh" "$PROJECT_DIR/manage-tenant.sh" "$PROJECT_DIR/run-tenant-cmd.sh" 2>/dev/null || true
 }
 
 deploy() {
@@ -472,8 +395,7 @@ deploy() {
     if [ ! -f "$ENV_FILE" ]; then
         cat > "$ENV_FILE" <<EOF
 NUITKA_BUILD=0
-INVENTAR_HTTP_PORT=80
-INVENTAR_HTTPS_PORT=443
+INVENTAR_HTTP_PORT=10000
 INVENTAR_APP_IMAGE=$app_image
 EOF
     elif grep -q '^INVENTAR_APP_IMAGE=' "$ENV_FILE"; then
@@ -492,27 +414,27 @@ EOF
         fi
     fi
 
-    docker compose -f "$compose_path" --env-file "$ENV_FILE" pull nginx mongodb >> "$LOG_FILE" 2>&1
+    docker compose -f "$compose_path" --env-file "$ENV_FILE" pull app mongodb >> "$LOG_FILE" 2>&1
     docker compose -f "$compose_path" --env-file "$ENV_FILE" up -d --remove-orphans >> "$LOG_FILE" 2>&1
     docker tag "$app_image" "$APP_IMAGE_REPO:latest" >> "$LOG_FILE" 2>&1 || true
 }
 
 verify_stack_health() {
     local compose_args running_services
-    local https_port
+    local http_port
     compose_args=(-f "$PROJECT_DIR/$COMPOSE_FILE" --env-file "$ENV_FILE")
-    https_port="$(awk -F= '/^INVENTAR_HTTPS_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ')"
-    if [ -z "$https_port" ]; then
-        https_port="443"
+    http_port="$(awk -F= '/^INVENTAR_HTTP_PORT=/{print $2}' "$ENV_FILE" | tr -d ' ')"
+    if [ -z "$http_port" ]; then
+        http_port="10000"
     fi
 
     for _ in $(seq 1 60); do
         running_services="$(docker compose "${compose_args[@]}" ps --status running --services 2>/dev/null || true)"
         if printf '%s\n' "$running_services" | grep -Fxq app && \
-           printf '%s\n' "$running_services" | grep -Fxq nginx && \
+           printf '%s\n' "$running_services" | grep -Fxq redis && \
            printf '%s\n' "$running_services" | grep -Fxq mongodb; then
-            # Primary check: HTTP endpoint responds (most reliable)
-            if curl -kfsS "https://127.0.0.1:$https_port" >/dev/null 2>&1; then
+            # Primary check: health endpoint responds (most reliable)
+            if curl -fsS "http://127.0.0.1:$http_port/health" >/dev/null 2>&1; then
                 return 0
             fi
         fi
@@ -520,7 +442,7 @@ verify_stack_health() {
     done
 
     docker compose "${compose_args[@]}" ps >> "$LOG_FILE" 2>&1 || true
-    docker compose "${compose_args[@]}" logs --tail=120 app nginx mongodb >> "$LOG_FILE" 2>&1 || true
+    docker compose "${compose_args[@]}" logs --tail=120 app redis mongodb >> "$LOG_FILE" 2>&1 || true
     return 1
 }
 
@@ -548,8 +470,6 @@ main() {
     cleanup_server_space
 
     ensure_runtime_dependencies
-    ensure_tls_certificates
-    ensure_nginx_config_mount_source
 
     require_cmd curl
     require_cmd tar