Initial project structure with documentation

2026-01-30 18:00:41 +01:00 · 2026-01-30 18:00:41 +01:00 · c363351483
commit c363351483
parent 406ed2c158
64 changed files with 15227 additions and 2567 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -0,0 +1,14 @@
 __pycache__
 *.pyc
 *.pyo
 *.pyd
 .Python
 .env
 .venv
 venv/
 data/*.db
 logs/*.log
 .git
 .gitignore
 .DS_Store
 *.md
--- a/.env.example
+++ b/.env.example
@ -0,0 +1,95 @@
 # Container Spawner Konfiguration
 # Kopiere diese Datei nach .env und passe die Werte an
 # cp .env.example .env
 # ============================================================
 # PFLICHT - Diese Werte MUESSEN angepasst werden
 # ============================================================
 # Flask Session Secret - Generiere mit:
 # python3 -c "import secrets; print(secrets.token_hex(32))"
 SECRET_KEY=HIER_DEINEN_GEHEIMEN_SCHLUESSEL_EINTRAGEN
 # Deine Domain (z.B. example.com, wieland.org)
 BASE_DOMAIN=example.com
 # Subdomain fuer den Spawner (z.B. coder -> coder.example.com)
 SPAWNER_SUBDOMAIN=coder
 # Name des Traefik-Netzwerks (muss existieren oder wird erstellt)
 TRAEFIK_NETWORK=web
 # ============================================================
 # TRAEFIK - Anpassen an deine Traefik-Konfiguration
 # ============================================================
 # Name des Traefik Certificate Resolvers (aus deiner traefik.yml)
 # Typische Namen: lets-encrypt, letsencrypt, hetzner, cloudflare, default
 TRAEFIK_CERTRESOLVER=lets-encrypt
 # Traefik Entrypoint fuer HTTPS (Standard: websecure)
 TRAEFIK_ENTRYPOINT=websecure
 # ============================================================
 # DOCKER - Normalerweise keine Aenderung noetig
 # ============================================================
 # Docker Socket Pfad (Standard fuer Linux)
 # Fuer Windows: npipe:////./pipe/docker_engine
 # Fuer TCP: tcp://localhost:2375
 DOCKER_HOST=unix:///var/run/docker.sock
 # Docker-Image fuer User-Container
 # Verfuegbare Templates:
 #   - user-service-template:latest  (nginx, einfache Willkommensseite)
 #   - user-template-next:latest     (Next.js, moderne React-App)
 USER_TEMPLATE_IMAGE=user-service-template:latest
 # ============================================================
 # RESSOURCEN - Container-Limits
 # ============================================================
 # RAM-Limit pro User-Container
 DEFAULT_MEMORY_LIMIT=512m
 # CPU-Quota (50000 = 0.5 CPU, 100000 = 1 CPU)
 DEFAULT_CPU_QUOTA=50000
 # ============================================================
 # JWT - Authentifizierung
 # ============================================================
 # JWT Secret (verwendet SECRET_KEY wenn nicht gesetzt)
 # JWT_SECRET_KEY=
 # JWT Token Gueltigkeitsdauer in Sekunden (Standard: 1 Stunde)
 JWT_ACCESS_TOKEN_EXPIRES=3600
 # ============================================================
 # CORS - Cross-Origin Resource Sharing
 # ============================================================
 # CORS erlaubte Origins (kommasepariert)
 # WICHTIG: Wird automatisch aus SPAWNER_SUBDOMAIN und BASE_DOMAIN generiert
 # Nur setzen wenn du zusaetzliche Origins brauchst
 # CORS_ORIGINS=https://coder.example.com,http://localhost:3000
 # ============================================================
 # OPTIONAL - Logging und Debugging
 # ============================================================
 # Spawner-Port (intern, nur fuer direkten Zugriff)
 SPAWNER_PORT=5000
 # Log-Level (DEBUG, INFO, WARNING, ERROR)
 LOG_LEVEL=INFO
 # Container-Timeout in Sekunden (fuer Auto-Shutdown, noch nicht implementiert)
 CONTAINER_IDLE_TIMEOUT=3600
 # ============================================================
 # PRODUKTION - Erweiterte Einstellungen
 # ============================================================
 # PostgreSQL statt SQLite (empfohlen fuer Produktion)
 # DATABASE_URL=postgresql://spawner:password@postgres:5432/spawner
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,174 @@
 # ============================================================
 # Container Spawner - .gitignore
 # ============================================================
 # ============================================================
 # Umgebung und Secrets
 # ============================================================
 .env
 .env.local
 .env.*.local
 !.env.example
 # ============================================================
 # Python
 # ============================================================
 __pycache__/
 *.py[cod]
 *$py.class
 *.so
 .Python
 build/
 develop-eggs/
 dist/
 downloads/
 eggs/
 .eggs/
 lib/
 lib64/
 parts/
 sdist/
 var/
 wheels/
 *.egg-info/
 .installed.cfg
 *.egg
 # Virtual Environments
 venv/
 .venv/
 ENV/
 env/
 # PyInstaller
 *.manifest
 *.spec
 # Pytest
 .pytest_cache/
 .coverage
 htmlcov/
 # mypy
 .mypy_cache/
 # ============================================================
 # Node.js / Next.js
 # ============================================================
 node_modules/
 .next/
 out/
 .pnp
 .pnp.js
 .yarn/install-state.gz
 # Build Output
 build/
 dist/
 # Package Manager Logs
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 pnpm-debug.log*
 .npm/
 # Lock Files (optional - auskommentieren wenn gewuenscht)
 # package-lock.json
 # yarn.lock
 # pnpm-lock.yaml
 # TypeScript
 *.tsbuildinfo
 # Vercel
 .vercel/
 # ============================================================
 # Generierte Daten (Server)
 # ============================================================
 data/
 logs/
 *.db
 *.sqlite
 *.sqlite3
 # Backups
 *.bak
 *.backup
 backup-*.db
 # ============================================================
 # IDE / Editoren
 # ============================================================
 .idea/
 .vscode/
 *.swp
 *.swo
 *~
 .project
 .classpath
 .settings/
 *.sublime-project
 *.sublime-workspace
 # ============================================================
 # Betriebssystem
 # ============================================================
 .DS_Store
 .DS_Store?
 ._*
 .Spotlight-V100
 .Trashes
 ehthumbs.db
 Thumbs.db
 desktop.ini
 # ============================================================
 # Logs und temporaere Dateien
 # ============================================================
 *.log
 *.tmp
 *.temp
 *.cache
 # ============================================================
 # Sicherheit
 # ============================================================
 *.pem
 *.key
 *.crt
 *.p12
 *.pfx
 secrets/
 credentials/
 # ============================================================
 # Docker (nur generierte Dateien)
 # ============================================================
 # Keine Docker-Dateien ignorieren - diese werden benoetigt
 # Aber lokale Override-Dateien ignorieren
 docker-compose.override.yml
 docker-compose.local.yml
 # ============================================================
 # Test und Coverage
 # ============================================================
 coverage/
 .nyc_output/
 test-results/
 junit.xml
 # ============================================================
 # Projekt-spezifisch
 # ============================================================
 # CLAUDE.md enthaelt projektspezifische Instruktionen fuer Claude Code
 # Kann bei Bedarf auskommentiert werden um es zu behalten
 CLAUDE.md
 # ============================================================
 # Misc
 # ============================================================
 *.pid
 *.seed
 *.pid.lock
--- a/29
+++ b/29
@ -0,0 +1,29 @@
 FROM python:3.11-slim
 WORKDIR /app
 # System-Dependencies
 RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        curl \
        ca-certificates && \
    rm -rf /var/lib/apt/lists/*
 # Python-Dependencies
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 # Application-Code
 COPY . .
 # Daten-Verzeichnisse
 RUN mkdir -p /app/data /app/logs && \
    chmod 755 /app/data /app/logs
 EXPOSE 5000
 # Health-Check
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:5000/health || exit 1
 CMD ["python", "app.py"]
--- a/README.md
+++ b/README.md
--- a/api.py
+++ b/api.py
@ -0,0 +1,251 @@
 from flask import Blueprint, jsonify, request, current_app
 from flask_jwt_extended import (
    create_access_token,
    jwt_required,
    get_jwt_identity,
    get_jwt
 )
 from datetime import timedelta
 from models import db, User
 from container_manager import ContainerManager
 api_bp = Blueprint('api', __name__, url_prefix='/api')
 # Token-Blacklist für Logout
 token_blacklist = set()
@api_bp.route('/auth/login', methods=['POST'])
 def api_login():
    """API-Login - gibt JWT-Token zurück"""
    data = request.get_json()
    if not data:
        return jsonify({'error': 'Keine Daten übermittelt'}), 400
    username = data.get('username')
    password = data.get('password')
    if not username or not password:
        return jsonify({'error': 'Username und Passwort erforderlich'}), 400
    user = User.query.filter_by(username=username).first()
    if not user or not user.check_password(password):
        return jsonify({'error': 'Ungültige Anmeldedaten'}), 401
    # Container spawnen wenn noch nicht vorhanden
    if not user.container_id:
        try:
            container_mgr = ContainerManager()
            container_id, port = container_mgr.spawn_container(user.id, user.username)
            user.container_id = container_id
            user.container_port = port
            db.session.commit()
        except Exception as e:
            current_app.logger.error(f"Container-Start fehlgeschlagen: {str(e)}")
            return jsonify({'error': f'Container-Start fehlgeschlagen: {str(e)}'}), 500
    # JWT-Token erstellen
    expires = timedelta(seconds=current_app.config.get('JWT_ACCESS_TOKEN_EXPIRES', 3600))
    access_token = create_access_token(
        identity=str(user.id),
        expires_delta=expires,
        additional_claims={'username': user.username}
    )
    return jsonify({
        'access_token': access_token,
        'token_type': 'Bearer',
        'expires_in': int(expires.total_seconds()),
        'user': {
            'id': user.id,
            'username': user.username,
            'email': user.email
        }
    }), 200
@api_bp.route('/auth/signup', methods=['POST'])
 def api_signup():
    """API-Registrierung - erstellt User, spawnt Container, gibt JWT zurück"""
    data = request.get_json()
    if not data:
        return jsonify({'error': 'Keine Daten übermittelt'}), 400
    username = data.get('username')
    email = data.get('email')
    password = data.get('password')
    if not username or not email or not password:
        return jsonify({'error': 'Username, Email und Passwort erforderlich'}), 400
    # Validierung
    if len(username) < 3:
        return jsonify({'error': 'Username muss mindestens 3 Zeichen lang sein'}), 400
    if len(password) < 6:
        return jsonify({'error': 'Passwort muss mindestens 6 Zeichen lang sein'}), 400
    # Prüfe ob User existiert
    if User.query.filter_by(username=username).first():
        return jsonify({'error': 'Username bereits vergeben'}), 409
    if User.query.filter_by(email=email).first():
        return jsonify({'error': 'Email bereits registriert'}), 409
    # Neuen User anlegen
    user = User(username=username, email=email)
    user.set_password(password)
    db.session.add(user)
    db.session.commit()
    # Container spawnen
    try:
        container_mgr = ContainerManager()
        container_id, port = container_mgr.spawn_container(user.id, user.username)
        user.container_id = container_id
        user.container_port = port
        db.session.commit()
    except Exception as e:
        db.session.delete(user)
        db.session.commit()
        current_app.logger.error(f"Registrierung fehlgeschlagen: {str(e)}")
        return jsonify({'error': f'Container-Erstellung fehlgeschlagen: {str(e)}'}), 500
    # JWT-Token erstellen
    expires = timedelta(seconds=current_app.config.get('JWT_ACCESS_TOKEN_EXPIRES', 3600))
    access_token = create_access_token(
        identity=str(user.id),
        expires_delta=expires,
        additional_claims={'username': user.username}
    )
    return jsonify({
        'access_token': access_token,
        'token_type': 'Bearer',
        'expires_in': int(expires.total_seconds()),
        'user': {
            'id': user.id,
            'username': user.username,
            'email': user.email
        }
    }), 201
@api_bp.route('/auth/logout', methods=['POST'])
@jwt_required()
 def api_logout():
    """API-Logout - invalidiert Token"""
    jti = get_jwt()['jti']
    token_blacklist.add(jti)
    return jsonify({'message': 'Erfolgreich abgemeldet'}), 200
@api_bp.route('/user/me', methods=['GET'])
@jwt_required()
 def api_user_me():
    """Gibt aktuellen User und Container-Info zurück"""
    user_id = get_jwt_identity()
    user = User.query.get(int(user_id))
    if not user:
        return jsonify({'error': 'User nicht gefunden'}), 404
    # Service-URL berechnen
    scheme = current_app.config['PREFERRED_URL_SCHEME']
    spawner_domain = f"{current_app.config['SPAWNER_SUBDOMAIN']}.{current_app.config['BASE_DOMAIN']}"
    service_url = f"{scheme}://{spawner_domain}/{user.username}"
    # Container-Status abrufen
    container_status = 'unknown'
    if user.container_id:
        try:
            container_mgr = ContainerManager()
            container_status = container_mgr.get_container_status(user.container_id)
        except Exception:
            container_status = 'error'
    return jsonify({
        'user': {
            'id': user.id,
            'username': user.username,
            'email': user.email,
            'created_at': user.created_at.isoformat() if user.created_at else None
        },
        'container': {
            'id': user.container_id,
            'port': user.container_port,
            'status': container_status,
            'service_url': service_url
        }
    }), 200
@api_bp.route('/container/status', methods=['GET'])
@jwt_required()
 def api_container_status():
    """Gibt Container-Status zurück"""
    user_id = get_jwt_identity()
    user = User.query.get(int(user_id))
    if not user:
        return jsonify({'error': 'User nicht gefunden'}), 404
    container_status = 'no_container'
    if user.container_id:
        try:
            container_mgr = ContainerManager()
            container_status = container_mgr.get_container_status(user.container_id)
        except Exception as e:
            container_status = f'error: {str(e)}'
    return jsonify({
        'container_id': user.container_id,
        'status': container_status
    }), 200
@api_bp.route('/container/restart', methods=['POST'])
@jwt_required()
 def api_container_restart():
    """Startet Container neu"""
    user_id = get_jwt_identity()
    user = User.query.get(int(user_id))
    if not user:
        return jsonify({'error': 'User nicht gefunden'}), 404
    container_mgr = ContainerManager()
    # Alten Container stoppen falls vorhanden
    if user.container_id:
        try:
            container_mgr.stop_container(user.container_id)
            container_mgr.remove_container(user.container_id)
        except Exception as e:
            current_app.logger.warning(f"Alter Container konnte nicht gestoppt werden: {str(e)}")
    # Neuen Container starten
    try:
        container_id, port = container_mgr.spawn_container(user.id, user.username)
        user.container_id = container_id
        user.container_port = port
        db.session.commit()
        return jsonify({
            'message': 'Container erfolgreich neugestartet',
            'container_id': container_id,
            'status': 'running'
        }), 200
    except Exception as e:
        current_app.logger.error(f"Container-Restart fehlgeschlagen: {str(e)}")
        return jsonify({'error': f'Container-Restart fehlgeschlagen: {str(e)}'}), 500
 def check_if_token_revoked(jwt_header, jwt_payload):
    """Callback für flask-jwt-extended um revoked Tokens zu prüfen"""
    jti = jwt_payload['jti']
    return jti in token_blacklist
--- a/app.py
+++ b/app.py
@ -0,0 +1,158 @@
 from flask import Flask, render_template, redirect, url_for, jsonify
 from flask_login import LoginManager, login_required, current_user
 from flask_jwt_extended import JWTManager
 from flask_cors import CORS
 from sqlalchemy import text
 from models import db, User
 from auth import auth_bp
 from api import api_bp, check_if_token_revoked
 from config import Config
 from container_manager import ContainerManager
 # Flask-App initialisieren
 app = Flask(__name__)
 app.config.from_object(Config)
 # Datenbank initialisieren
 db.init_app(app)
 # CORS initialisieren
 CORS(app, resources={
    r"/api/*": {
        "origins": app.config.get('CORS_ORIGINS', ['http://localhost:3000']),
        "methods": ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
        "allow_headers": ["Content-Type", "Authorization"],
        "supports_credentials": True
    }
 })
 # JWT initialisieren
 jwt = JWTManager(app)
@jwt.token_in_blocklist_loader
 def check_if_token_in_blocklist(jwt_header, jwt_payload):
    return check_if_token_revoked(jwt_header, jwt_payload)
@jwt.expired_token_loader
 def expired_token_callback(jwt_header, jwt_payload):
    return jsonify({'error': 'Token abgelaufen'}), 401
@jwt.invalid_token_loader
 def invalid_token_callback(error):
    return jsonify({'error': 'Ungültiger Token'}), 401
@jwt.unauthorized_loader
 def missing_token_callback(error):
    return jsonify({'error': 'Authentifizierung erforderlich'}), 401
 # Flask-Login initialisieren
 login_manager = LoginManager()
 login_manager.init_app(app)
 login_manager.login_view = 'auth.login'
 login_manager.login_message = 'Bitte melde dich an, um auf diese Seite zuzugreifen.'
 login_manager.login_message_category = 'error'
 # Blueprints registrieren
 app.register_blueprint(auth_bp)
 app.register_blueprint(api_bp)
@login_manager.user_loader
 def load_user(user_id):
    """Lädt User für Flask-Login"""
    return User.query.get(int(user_id))
@app.route('/')
 def index():
    """Startseite - Redirect zu Dashboard oder Login"""
    if current_user.is_authenticated:
        return redirect(url_for('dashboard'))
    return redirect(url_for('auth.login'))
@app.route('/dashboard')
@login_required
 def dashboard():
    """Dashboard - zeigt Container-Status und Service-URL"""
    container_mgr = ContainerManager()
    container_status = 'unknown'
    if current_user.container_id:
        container_status = container_mgr.get_container_status(current_user.container_id)
    # Service-URL für den User (pfad-basiert)
    scheme = app.config['PREFERRED_URL_SCHEME']
    spawner_domain = f"{app.config['SPAWNER_SUBDOMAIN']}.{app.config['BASE_DOMAIN']}"
    service_url = f"{scheme}://{spawner_domain}/{current_user.username}"
    return render_template('dashboard.html',
                         user=current_user,
                         service_url=service_url,
                         container_status=container_status)
@app.route('/container/restart')
@login_required
 def restart_container():
    """Startet Container des Users neu"""
    container_mgr = ContainerManager()
    # Alten Container stoppen falls vorhanden
    if current_user.container_id:
        container_mgr.stop_container(current_user.container_id)
        container_mgr.remove_container(current_user.container_id)
    # Neuen Container starten
    try:
        container_id, port = container_mgr.spawn_container(current_user.id, current_user.username)
        current_user.container_id = container_id
        current_user.container_port = port
        db.session.commit()
    except Exception as e:
        app.logger.error(f"Container-Restart fehlgeschlagen: {str(e)}")
    return redirect(url_for('dashboard'))
@app.route('/health')
 def health():
    """Health-Check für Docker und Monitoring"""
    db_status = 'ok'
    docker_status = 'warning'
    try:
        # DB-Check (KRITISCH)
        db.session.execute(text('SELECT 1'))
    except Exception as e:
        db_status = f'error: {str(e)}'
        app.logger.error(f"Database health check failed: {str(e)}")
    try:
        # Docker-Check (OPTIONAL)
        container_mgr = ContainerManager()
        container_mgr._get_client().ping()
        docker_status = 'ok'
    except Exception as e:
        docker_status = f'warning: {str(e)}'
        app.logger.warning(f"Docker health check failed (non-critical): {str(e)}")
    # Status 503 nur wenn DATABASE down ist, nicht wenn Docker down ist
    status_code = 200 if db_status == 'ok' else 503
    response = {
        'status': 'healthy' if status_code == 200 else 'unhealthy',
        'database': db_status,
        'docker': docker_status,
        'version': '1.0.0'
    }
    if status_code != 200:
        app.logger.error(f"Health check CRITICAL: {response}")
    else:
        app.logger.info(f"Health check OK")
    return response, status_code
 # Datenbank-Tabellen erstellen beim ersten Start
 with app.app_context():
    db.create_all()
    app.logger.info('Datenbank-Tabellen erstellt')
 if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=False)
--- a/auth.py
+++ b/auth.py
@ -0,0 +1,87 @@
 from flask import Blueprint, render_template, redirect, url_for, request, flash
 from flask_login import login_user, logout_user, login_required, current_user
 from models import db, User
 from container_manager import ContainerManager
 auth_bp = Blueprint('auth', __name__)
@auth_bp.route('/login', methods=['GET', 'POST'])
 def login():
    """User-Login"""
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        user = User.query.filter_by(username=username).first()
        if user and user.check_password(password):
            login_user(user)
            # Container spawnen wenn noch nicht vorhanden
            if not user.container_id:
                try:
                    container_mgr = ContainerManager()
                    container_id, port = container_mgr.spawn_container(user.id, user.username)
                    user.container_id = container_id
                    user.container_port = port
                    db.session.commit()
                except Exception as e:
                    flash(f'Container-Start fehlgeschlagen: {str(e)}', 'error')
                    return redirect(url_for('auth.login'))
            flash('Login erfolgreich!', 'success')
            return redirect(url_for('dashboard'))
        else:
            flash('Ungültige Anmeldedaten', 'error')
    return render_template('login.html')
@auth_bp.route('/signup', methods=['GET', 'POST'])
 def signup():
    """User-Registrierung"""
    if request.method == 'POST':
        username = request.form.get('username')
        email = request.form.get('email')
        password = request.form.get('password')
        # Prüfe ob User existiert
        if User.query.filter_by(username=username).first():
            flash('Username bereits vergeben', 'error')
            return redirect(url_for('auth.signup'))
        if User.query.filter_by(email=email).first():
            flash('Email bereits registriert', 'error')
            return redirect(url_for('auth.signup'))
        # Neuen User anlegen
        user = User(username=username, email=email)
        user.set_password(password)
        db.session.add(user)
        db.session.commit()
        # Container aus Template bauen und starten
        try:
            container_mgr = ContainerManager()
            container_id, port = container_mgr.spawn_container(user.id, user.username)
            user.container_id = container_id
            user.container_port = port
            db.session.commit()
            flash('Registrierung erfolgreich! Container wird gestartet...', 'success')
            login_user(user)
            return redirect(url_for('dashboard'))
        except Exception as e:
            db.session.delete(user)
            db.session.commit()
            flash(f'Registrierung fehlgeschlagen: {str(e)}', 'error')
    return render_template('signup.html')
@auth_bp.route('/logout')
@login_required
 def logout():
    """User-Logout"""
    logout_user()
    flash('Erfolgreich abgemeldet', 'success')
    return redirect(url_for('auth.login'))
--- a/config.py
+++ b/config.py
@ -0,0 +1,113 @@
 import os
 from dotenv import load_dotenv
 load_dotenv()
 class Config:
    # ========================================
    # Sicherheit
    # ========================================
    SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production')
    # JWT-Konfiguration
    JWT_SECRET_KEY = os.getenv('JWT_SECRET_KEY', SECRET_KEY)
    JWT_ACCESS_TOKEN_EXPIRES = int(os.getenv('JWT_ACCESS_TOKEN_EXPIRES', 3600))  # 1 Stunde
    JWT_TOKEN_LOCATION = ['headers']
    JWT_HEADER_NAME = 'Authorization'
    JWT_HEADER_TYPE = 'Bearer'
    # CORS-Konfiguration
    CORS_ORIGINS = os.getenv('CORS_ORIGINS', 'http://localhost:3000').split(',')
    # Session-Sicherheit
    SESSION_COOKIE_SECURE = os.getenv('BASE_DOMAIN', 'localhost') != 'localhost'
    SESSION_COOKIE_HTTPONLY = True
    SESSION_COOKIE_SAMESITE = 'Lax'
    PERMANENT_SESSION_LIFETIME = 3600  # 1 Stunde
    # ========================================
    # Datenbank
    # ========================================
    SQLALCHEMY_DATABASE_URI = os.getenv(
        'DATABASE_URL',
        'sqlite:////app/data/users.db'  # 4 slashes: sqlite:// + /app/data/users.db
    )
    SQLALCHEMY_TRACK_MODIFICATIONS = False
    # ========================================
    # Docker-Konfiguration
    # ========================================
    DOCKER_SOCKET = os.getenv('DOCKER_SOCKET', 'unix://var/run/docker.sock')
    USER_TEMPLATE_IMAGE = os.getenv('USER_TEMPLATE_IMAGE', 'user-service-template:latest')
    # ========================================
    # Traefik/Domain-Konfiguration
    # ========================================
    BASE_DOMAIN = os.getenv('BASE_DOMAIN', 'localhost')
    SPAWNER_SUBDOMAIN = os.getenv('SPAWNER_SUBDOMAIN', 'spawner')
    TRAEFIK_NETWORK = os.getenv('TRAEFIK_NETWORK', 'web')
    TRAEFIK_CERTRESOLVER = os.getenv('TRAEFIK_CERTRESOLVER', 'lets-encrypt')
    TRAEFIK_ENTRYPOINT = os.getenv('TRAEFIK_ENTRYPOINT', 'websecure')
    # Vollständige Spawner-URL
    SPAWNER_URL = f"{SPAWNER_SUBDOMAIN}.{BASE_DOMAIN}"
    # ========================================
    # Application-Settings
    # ========================================
    # HTTPS automatisch für Nicht-Localhost
    PREFERRED_URL_SCHEME = 'https' if BASE_DOMAIN != 'localhost' else 'http'
    # Spawner-Port (nur für Debugging wichtig)
    SPAWNER_PORT = int(os.getenv('SPAWNER_PORT', 5000))
    # ========================================
    # Optionale Einstellungen
    # ========================================
    # Logging
    LOG_LEVEL = os.getenv('LOG_LEVEL', 'INFO')
    LOG_FILE = os.getenv('LOG_FILE', '/app/logs/spawner.log')
    # Container-Limits (für container_manager.py)
    DEFAULT_MEMORY_LIMIT = os.getenv('DEFAULT_MEMORY_LIMIT', '512m')
    DEFAULT_CPU_QUOTA = int(os.getenv('DEFAULT_CPU_QUOTA', 50000))  # 0.5 CPU
    # Container-Cleanup
    CONTAINER_IDLE_TIMEOUT = int(os.getenv('CONTAINER_IDLE_TIMEOUT', 3600))  # 1h in Sekunden
 class DevelopmentConfig(Config):
    """Konfiguration für Entwicklung"""
    DEBUG = True
    TESTING = False
 class ProductionConfig(Config):
    """Konfiguration für Produktion"""
    DEBUG = False
    TESTING = False
    # Strikte Session-Sicherheit
    SESSION_COOKIE_SECURE = True
    # Optional: PostgreSQL statt SQLite
    # SQLALCHEMY_DATABASE_URI = os.getenv(
    #     'DATABASE_URL',
    #     'postgresql://spawner:password@postgres:5432/spawner'
    # )
 class TestingConfig(Config):
    """Konfiguration für Tests"""
    TESTING = True
    SQLALCHEMY_DATABASE_URI = 'sqlite:///:memory:'
    WTF_CSRF_ENABLED = False
 # Config-Dict für einfaches Laden
 config = {
    'development': DevelopmentConfig,
    'production': ProductionConfig,
    'testing': TestingConfig,
    'default': DevelopmentConfig
 }
--- a/container_manager.py
+++ b/container_manager.py
@ -0,0 +1,128 @@
 import requests_unixsocket
 import docker
 from config import Config
 class ContainerManager:
    def __init__(self):
        self.client = None
    def _get_client(self):
        """Lazy initialization of Docker client"""
        if self.client is None:
            try:
                # Nutze from_env() - DOCKER_HOST aus Umgebungsvariable
                self.client = docker.from_env()
            except Exception as e:
                raise Exception(f"Docker connection failed: {str(e)}")
        return self.client
    def spawn_container(self, user_id, username):
        """Spawnt einen neuen Container für den User"""
        try:
            existing = self._get_user_container(username)
            if existing and existing.status == 'running':
                return existing.id, self._get_container_port(existing)
            # Pfad-basiertes Routing: User unter coder.wieland.org/username
            base_host = f"{Config.SPAWNER_SUBDOMAIN}.{Config.BASE_DOMAIN}"
            # Labels vorbereiten
            labels = {
                'traefik.enable': 'true',
                'traefik.docker.network': Config.TRAEFIK_NETWORK,
                # HTTPS Router mit PathPrefix
                f'traefik.http.routers.user{user_id}.rule':
                    f'Host(`{base_host}`) && PathPrefix(`/{username}`)',
                f'traefik.http.routers.user{user_id}.entrypoints': Config.TRAEFIK_ENTRYPOINT,
                f'traefik.http.routers.user{user_id}.priority': '100',
                # StripPrefix Middleware - entfernt /{username} bevor Container Request erhält
                f'traefik.http.routers.user{user_id}.middlewares': f'user{user_id}-strip',
                f'traefik.http.middlewares.user{user_id}-strip.stripprefix.prefixes': f'/{username}',
                # TLS für HTTPS
                f'traefik.http.routers.user{user_id}.tls': 'true',
                f'traefik.http.routers.user{user_id}.tls.certresolver': Config.TRAEFIK_CERTRESOLVER,
                # Service
                f'traefik.http.services.user{user_id}.loadbalancer.server.port': '8080',
                # Metadata
                'spawner.user_id': str(user_id),
                'spawner.username': username,
                'spawner.managed': 'true'
            }
            # Logging: Traefik-Labels ausgeben
            print(f"[SPAWNER] Creating container user-{username}-{user_id}")
            print(f"[SPAWNER] Traefik Labels:")
            for key, value in labels.items():
                if 'traefik' in key:
                    print(f"[SPAWNER]   {key}: {value}")
            container = self._get_client().containers.run(
                Config.USER_TEMPLATE_IMAGE,
                name=f"user-{username}-{user_id}",
                detach=True,
                network=Config.TRAEFIK_NETWORK,
                labels=labels,
                environment={
                    'USER_ID': str(user_id),
                    'USERNAME': username
                },
                restart_policy={'Name': 'unless-stopped'},
                mem_limit=Config.DEFAULT_MEMORY_LIMIT,
                cpu_quota=Config.DEFAULT_CPU_QUOTA
            )
            print(f"[SPAWNER] Container created: {container.id[:12]}")
            print(f"[SPAWNER] URL: https://{base_host}/{username}")
            return container.id, 8080
        except docker.errors.ImageNotFound as e:
            error_msg = f"Template-Image '{Config.USER_TEMPLATE_IMAGE}' nicht gefunden"
            print(f"[SPAWNER] ERROR: {error_msg}")
            raise Exception(error_msg)
        except docker.errors.APIError as e:
            error_msg = f"Docker API Fehler: {str(e)}"
            print(f"[SPAWNER] ERROR: {error_msg}")
            raise Exception(error_msg)
        except Exception as e:
            print(f"[SPAWNER] ERROR: {str(e)}")
            raise
    def stop_container(self, container_id):
        """Stoppt einen User-Container"""
        try:
            container = self._get_client().containers.get(container_id)
            container.stop(timeout=10)
            return True
        except docker.errors.NotFound:
            return False
    def remove_container(self, container_id):
        """Entfernt einen User-Container komplett"""
        try:
            container = self._get_client().containers.get(container_id)
            container.remove(force=True)
            return True
        except docker.errors.NotFound:
            return False
    def get_container_status(self, container_id):
        """Gibt Status eines Containers zurück"""
        try:
            container = self._get_client().containers.get(container_id)
            return container.status
        except docker.errors.NotFound:
            return 'not_found'
    def _get_user_container(self, username):
        """Findet existierenden Container für User"""
        filters = {'label': f'spawner.username={username}'}
        containers = self._get_client().containers.list(all=True, filters=filters)
        return containers[0] if containers else None
    def _get_container_port(self, container):
        """Extrahiert Port aus Container-Config"""
        return 8080
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -0,0 +1,119 @@
 version: '3.8'
 services:
  # Flask API Backend
  spawner:
    build: .
    container_name: spawner
    restart: unless-stopped
    env_file:
      - .env
    ports:
      - "5000:5000"  # Optional: Direktzugriff für Debugging
    volumes:
      # Docker-Socket für Container-Management
      - /var/run/docker.sock:/var/run/docker.sock:rw
      # Persistente Daten
      - ./data:/app/data
      # Logs
      - ./logs:/app/logs
    environment:
      # Aus .env-Datei
      - SECRET_KEY=${SECRET_KEY}
      - JWT_SECRET_KEY=${JWT_SECRET_KEY:-${SECRET_KEY}}
      - BASE_DOMAIN=${BASE_DOMAIN}
      - TRAEFIK_NETWORK=${TRAEFIK_NETWORK}
      - USER_TEMPLATE_IMAGE=${USER_TEMPLATE_IMAGE:-user-service-template:latest}
      - SPAWNER_SUBDOMAIN=${SPAWNER_SUBDOMAIN:-coder}
      - CORS_ORIGINS=https://${SPAWNER_SUBDOMAIN:-coder}.${BASE_DOMAIN},http://localhost:3000
      # Traefik-Konfiguration
      - TRAEFIK_CERTRESOLVER=${TRAEFIK_CERTRESOLVER:-lets-encrypt}
      - TRAEFIK_ENTRYPOINT=${TRAEFIK_ENTRYPOINT:-websecure}
      # Docker-Verbindung
      - DOCKER_HOST=${DOCKER_HOST:-unix:///var/run/docker.sock}
    networks:
      - web
    labels:
      # Traefik aktivieren
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      # API-Router (hoehere Prioritaet fuer /api/*)
      - "traefik.http.routers.spawner-api.rule=Host(`${SPAWNER_SUBDOMAIN:-coder}.${BASE_DOMAIN}`) && PathPrefix(`/api`)"
      - "traefik.http.routers.spawner-api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
      - "traefik.http.routers.spawner-api.tls.certresolver=${TRAEFIK_CERTRESOLVER:-lets-encrypt}"
      - "traefik.http.routers.spawner-api.priority=200"
      - "traefik.http.routers.spawner-api.service=spawner-api-service"
      - "traefik.http.services.spawner-api-service.loadbalancer.server.port=5000"
      # Legacy-Router fuer alte Flask-Templates (niedrige Prioritaet)
      - "traefik.http.routers.spawner-legacy.rule=Host(`${SPAWNER_SUBDOMAIN:-coder}.${BASE_DOMAIN}`) && (PathPrefix(`/login`) || PathPrefix(`/signup`) || PathPrefix(`/logout`) || PathPrefix(`/dashboard`) || PathPrefix(`/container`) || PathPrefix(`/health`))"
      - "traefik.http.routers.spawner-legacy.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
      - "traefik.http.routers.spawner-legacy.tls.certresolver=${TRAEFIK_CERTRESOLVER:-lets-encrypt}"
      - "traefik.http.routers.spawner-legacy.priority=100"
      - "traefik.http.routers.spawner-legacy.service=spawner-api-service"
      # Metadata
      - "spawner.managed=true"
      - "spawner.version=2.0.0"
      - "spawner.type=api-service"
    # Health-Check
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
  # Next.js Frontend
  frontend:
    build: ./frontend
    container_name: spawner-frontend
    restart: unless-stopped
    environment:
      - NEXT_PUBLIC_API_URL=
    networks:
      - web
    labels:
      # Traefik aktivieren
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      # Frontend-Router (niedrigere Prioritaet - Catch-All)
      - "traefik.http.routers.spawner-frontend.rule=Host(`${SPAWNER_SUBDOMAIN:-coder}.${BASE_DOMAIN}`)"
      - "traefik.http.routers.spawner-frontend.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
      - "traefik.http.routers.spawner-frontend.tls.certresolver=${TRAEFIK_CERTRESOLVER:-lets-encrypt}"
      - "traefik.http.routers.spawner-frontend.priority=50"
      - "traefik.http.routers.spawner-frontend.service=spawner-frontend-service"
      - "traefik.http.services.spawner-frontend-service.loadbalancer.server.port=3000"
      # Metadata
      - "spawner.managed=true"
      - "spawner.version=2.0.0"
      - "spawner.type=frontend-service"
    # Health-Check
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    depends_on:
      - spawner
 # Externes Netzwerk (von deinem Traefik bereits vorhanden)
 networks:
  web:
    external: true
--- a/docs/README.md
+++ b/docs/README.md
@ -0,0 +1,44 @@
 # Container Spawner - Dokumentation
 Willkommen zur Dokumentation des Container Spawner Projekts.
 ## Inhaltsverzeichnis
 | Dokument | Beschreibung |
 |----------|--------------|
 | [Installation](install/README.md) | Neu- und Update-Installation, Umgebungsvariablen |
 | [Architektur](architecture/README.md) | Vollstaendige technische Dokumentation |
 | [Sicherheit](security/README.md) | Sicherheitsrisiken und Gegenmassnahmen |
 | [Versionen](versions/README.md) | Versionierung und Changelog |
 | [Bekannte Bugs](bugs/README.md) | Bekannte Probleme und Workarounds |
 | [Best Practices](dos-n-donts/README.md) | Dos and Don'ts fuer Produktion |
 ## Schnellnavigation
 ### Fuer Einsteiger
 1. [Voraussetzungen](install/README.md#voraussetzungen) pruefen
 2. [Neuinstallation](install/README.md#neuinstallation) durchfuehren
 3. [Konfiguration](install/README.md#umgebungsvariablen) anpassen
 ### Fuer Entwickler
 - [Architektur-Uebersicht](architecture/README.md#architektur)
 - [Komponenten im Detail](architecture/README.md#komponenten-im-detail)
 - [Traefik-Integration](architecture/README.md#traefik-integration)
 ### Fuer Administratoren
 - [Sicherheits-Checkliste](security/README.md)
 - [Produktions-Empfehlungen](dos-n-donts/README.md)
 - [Troubleshooting](architecture/README.md#troubleshooting)
 ## Projekt-Links
 - **Repository**: https://gitea.iotxs.de/RainerWieland/spawner
 - **Issue Tracker**: https://gitea.iotxs.de/RainerWieland/spawner/issues
 ---
 **Aktuelle Version**: 0.1.0
 **Letzte Aktualisierung**: Januar 2026
--- a/docs/architecture/README.md
+++ b/docs/architecture/README.md
--- a/docs/bugs/README.md
+++ b/docs/bugs/README.md
@ -0,0 +1,248 @@
 # Bekannte Bugs und Limitationen
 Aktuelle bekannte Probleme und moegliche Workarounds.
 ## Inhaltsverzeichnis
 - [Bekannte Limitationen](#bekannte-limitationen)
 - [Bekannte Bugs](#bekannte-bugs)
 - [Workarounds](#workarounds)
 - [Issue Tracker](#issue-tracker)
 ---
 ## Bekannte Limitationen
 ### Container Auto-Shutdown nicht implementiert
 **Status**: Geplant fuer v0.2.0
 **Beschreibung**: Die Variable `CONTAINER_IDLE_TIMEOUT` ist definiert, aber die Logik zum automatischen Stoppen inaktiver Container fehlt noch.
 **Auswirkung**: Container laufen unbegrenzt weiter, auch bei Inaktivitaet.
 **Workaround**: Manuelles Aufraumen mit Cron-Job:
 ```bash
 # cleanup-idle.sh
 #!/bin/bash
 # Container die aelter als 24h sind und keinen Traffic haben
 docker ps --filter 'label=spawner.managed=true' \
    --format '{{.ID}} {{.RunningFor}}' | \
    grep -E 'days|weeks' | \
    awk '{print $1}' | \
    xargs -r docker stop
 ```
 ---
 ### Keine Volume-Persistenz
 **Status**: Geplant fuer v0.2.0
 **Beschreibung**: User-Daten in Containern gehen bei Neustart verloren.
 **Auswirkung**: Alle Dateien die ein User im Container erstellt werden bei Restart geloescht.
 **Workaround**: Volume-Mounts manuell in `container_manager.py` hinzufuegen:
 ```python
 # In spawn_container()
 volumes = {
    f'/data/users/{username}': {
        'bind': '/app/data',
        'mode': 'rw'
    }
 }
 ```
 ---
 ### Kein Multi-Template-Support
 **Status**: Geplant fuer v1.0.0
 **Beschreibung**: Alle User erhalten das gleiche Container-Template.
 **Auswirkung**: Keine Moeglichkeit verschiedene Umgebungen anzubieten (z.B. Python, Node.js).
 **Workaround**: Mehrere Spawner-Instanzen mit unterschiedlichen `USER_TEMPLATE_IMAGE` Werten.
 ---
 ### Minimale Input-Validierung
 **Status**: Bekannt
 **Beschreibung**: Username und Email werden nur minimal validiert.
 **Auswirkung**: Potenzielle Injection-Risiken bei speziellen Zeichen.
 **Workaround**: Siehe [Sicherheits-Dokumentation](../security/README.md#input-validierung)
 ---
 ### Kein Rate-Limiting
 **Status**: Geplant fuer v1.0.0
 **Beschreibung**: Keine Begrenzung von Login-Versuchen oder API-Aufrufen.
 **Auswirkung**: Anfaellig fuer Brute-Force-Angriffe.
 **Workaround**: Rate-Limiting via Traefik:
 ```yaml
 # In docker-compose.yml Labels
 labels:
  - "traefik.http.middlewares.ratelimit.ratelimit.average=10"
  - "traefik.http.middlewares.ratelimit.ratelimit.burst=20"
  - "traefik.http.routers.spawner.middlewares=ratelimit"
 ```
 ---
 ### Kein Admin-Dashboard
 **Status**: Geplant fuer v0.2.0
 **Beschreibung**: Keine Web-UI zum Verwalten von Usern und Containern.
 **Workaround**: Direkte Datenbank-/Docker-Befehle:
 ```bash
 # User auflisten
 docker exec spawner sqlite3 /app/data/users.db "SELECT id, username, email FROM user"
 # Container auflisten
 docker ps --filter 'label=spawner.managed=true'
 # Container eines Users stoppen
 docker stop user-<username>-<id>
 ```
 ---
 ## Bekannte Bugs
 ### BUG-001: Health-Check schlaegt bei erstem Start fehl
 **Schweregrad**: Niedrig
 **Beschreibung**: Der Health-Check kann beim allerersten Start fehlschlagen, bevor die Datenbank initialisiert ist.
 **Schritte zum Reproduzieren**:
 1. Frische Installation ohne existierende DB
 2. `docker-compose up -d`
 3. Sofortiger Health-Check: `curl http://localhost:5000/health`
 **Erwartetes Verhalten**: 200 OK
 **Tatsaechliches Verhalten**: 503 oder Connection Refused
 **Workaround**: 5-10 Sekunden warten nach Start.
 **Status**: Akzeptiert (normales Verhalten bei Kaltstart)
 ---
 ### BUG-002: Container-Neustart loescht Container-ID nicht bei Fehler
 **Schweregrad**: Mittel
 **Beschreibung**: Wenn ein Container-Spawn fehlschlaegt, bleibt die alte Container-ID im User-Record.
 **Schritte zum Reproduzieren**:
 1. User hat laufenden Container
 2. Admin loescht Container manuell: `docker rm -f user-xxx`
 3. User klickt "Neustart" im Dashboard
 4. Spawn schlaegt fehl (z.B. Image nicht gefunden)
 5. Container-ID zeigt auf nicht-existierenden Container
 **Workaround**: Container-ID manuell zuruecksetzen:
 ```bash
 docker exec spawner sqlite3 /app/data/users.db \
    "UPDATE user SET container_id=NULL WHERE username='<username>'"
 ```
 **Status**: Fix geplant
 ---
 ## Workarounds
 ### Alle User-Container auflisten
 ```bash
 docker ps --filter 'label=spawner.managed=true' \
    --format 'table {{.Names}}\t{{.Status}}\t{{.RunningFor}}'
 ```
 ### Container-Ressourcen pruefen
 ```bash
 docker stats --filter 'label=spawner.managed=true' --no-stream
 ```
 ### Verwaiste Container aufraumen
 ```bash
 # Container ohne zugehoerigen User finden
 for container in $(docker ps -q --filter 'label=spawner.managed=true'); do
    username=$(docker inspect $container --format '{{index .Config.Labels "spawner.username"}}')
    exists=$(docker exec spawner sqlite3 /app/data/users.db \
        "SELECT COUNT(*) FROM user WHERE username='$username'")
    if [ "$exists" = "0" ]; then
        echo "Verwaist: $container ($username)"
        # docker rm -f $container  # Zum Loeschen auskommentieren
    fi
 done
 ```
 ### Datenbank-Backup manuell erstellen
 ```bash
 docker exec spawner sqlite3 /app/data/users.db ".backup '/app/data/backup-$(date +%Y%m%d).db'"
 docker cp spawner:/app/data/backup-*.db ./backups/
 ```
 ---
 ## Issue Tracker
 Neue Bugs oder Feature-Requests bitte hier melden:
 **Repository Issues**: https://gitea.iotxs.de/RainerWieland/spawner/issues
 ### Issue erstellen - Vorlage
 ```markdown
 ## Beschreibung
 [Kurze Beschreibung des Problems]
 ## Schritte zum Reproduzieren
 1. [Erster Schritt]
 2. [Zweiter Schritt]
 3. [...]
 ## Erwartetes Verhalten
 [Was sollte passieren]
 ## Tatsaechliches Verhalten
 [Was passiert stattdessen]
 ## Umgebung
 - Spawner Version: [z.B. 0.1.0]
 - Docker Version: [z.B. 24.0.5]
 - OS: [z.B. Ubuntu 22.04]
 ## Logs
 \`\`\`
 [Relevante Log-Ausgaben]
 \`\`\`
 ```
 ---
 Zurueck zur [Dokumentations-Uebersicht](../README.md)
--- a/docs/dos-n-donts/README.md
+++ b/docs/dos-n-donts/README.md
@ -0,0 +1,411 @@
 # Best Practices - Dos and Don'ts
 Empfehlungen fuer den sicheren und effizienten Betrieb des Container Spawners.
 ## Inhaltsverzeichnis
 - [Produktions-Checkliste](#produktions-checkliste)
 - [Dos - Empfohlene Praktiken](#dos---empfohlene-praktiken)
 - [Don'ts - Zu vermeiden](#donts---zu-vermeiden)
 - [Haeufige Fehler](#haeufige-fehler)
 ---
 ## Produktions-Checkliste
 ### Vor dem Go-Live
 | Kategorie | Aufgabe | Status |
 |-----------|---------|--------|
 | **Sicherheit** | SECRET_KEY generiert (min. 32 Bytes) | [ ] |
 | | `.env` nicht im Repository | [ ] |
 | | HTTPS aktiviert | [ ] |
 | | Docker Socket Proxy konfiguriert | [ ] |
 | **Konfiguration** | BASE_DOMAIN korrekt | [ ] |
 | | TRAEFIK_NETWORK existiert | [ ] |
 | | Resource-Limits angemessen | [ ] |
 | **Infrastruktur** | DNS-Eintraege (Wildcard) | [ ] |
 | | Traefik laeuft stabil | [ ] |
 | | Firewall konfiguriert | [ ] |
 | **Monitoring** | Health-Check funktioniert | [ ] |
 | | Logs werden geschrieben | [ ] |
 | | Backup-Strategie | [ ] |
 | **Testing** | Login/Signup funktioniert | [ ] |
 | | Container wird erstellt | [ ] |
 | | Subdomain erreichbar | [ ] |
 ---
 ## Dos - Empfohlene Praktiken
 ### Konfiguration
 **DO: SECRET_KEY sicher generieren**
 ```bash
 # Guter Key (32 Bytes = 64 Hex-Zeichen)
 python3 -c "import secrets; print(secrets.token_hex(32))"
 ```
 **DO: Umgebungsvariablen fuer sensible Daten**
 ```bash
 # In .env (nie committen!)
 SECRET_KEY=abc123...
 DATABASE_URL=postgresql://...
 ```
 **DO: Resource-Limits setzen**
 ```bash
 # In .env
 DEFAULT_MEMORY_LIMIT=512m
 DEFAULT_CPU_QUOTA=50000
 ```
 ---
 ### Deployment
 **DO: Docker Compose fuer Orchestrierung**
 ```bash
 # Nicht einzelne docker run Befehle
 docker-compose up -d
 docker-compose logs -f
 docker-compose down
 ```
 **DO: Images taggen**
 ```bash
 # Versionierte Tags statt :latest in Produktion
 docker build -t spawner:0.1.0 .
 docker build -t spawner:latest .
 ```
 **DO: Health-Checks nutzen**
 ```yaml
 healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
  interval: 30s
  timeout: 10s
  retries: 3
 ```
 ---
 ### Monitoring
 **DO: Logs zentralisieren**
 ```yaml
 # docker-compose.yml
 logging:
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "3"
 ```
 **DO: Regelmaessige Backups**
 ```bash
 # Cronjob fuer taegliches Backup
 0 2 * * * /pfad/zu/spawner/backup.sh
 ```
 **DO: Disk-Space ueberwachen**
 ```bash
 # Docker-Ressourcen pruefen
 docker system df
 docker system prune -f  # Vorsicht in Produktion!
 ```
 ---
 ### Sicherheit
 **DO: HTTPS erzwingen**
 ```yaml
 # Traefik-Labels
 - "traefik.http.routers.spawner.entrypoints=websecure"
 - "traefik.http.routers.spawner.tls=true"
 ```
 **DO: Minimale Berechtigungen**
 ```yaml
 # Docker Socket Proxy statt direktem Zugriff
 DOCKER_HOST: tcp://docker-proxy:2375
 ```
 **DO: Container als Non-Root**
 ```dockerfile
 # Im User-Template
 USER nginx
 # oder
 RUN useradd -m appuser && chown -R appuser /app
 USER appuser
 ```
 ---
 ## Don'ts - Zu vermeiden
 ### Konfiguration
 **DON'T: Hardcoded Secrets**
 ```python
 # NIEMALS!
 SECRET_KEY = "supersecret123"
 ```
 **DON'T: Debug-Mode in Produktion**
 ```python
 # NIEMALS in Produktion!
 app.run(debug=True)
 FLASK_DEBUG=1
 ```
 **DON'T: Schwache Keys**
 ```bash
 # ZU KURZ / ZU EINFACH
 SECRET_KEY=test
 SECRET_KEY=12345
 ```
 ---
 ### Deployment
 **DON'T: Manuelles Container-Management**
 ```bash
 # Vermeiden - besser docker-compose
 docker run -d --name spawner ...
 docker stop spawner
 docker rm spawner
 ```
 **DON'T: Unversionierte Images in Produktion**
 ```bash
 # Vermeiden
 USER_TEMPLATE_IMAGE=user-service-template:latest
 # Besser
 USER_TEMPLATE_IMAGE=user-service-template:0.1.0
 ```
 **DON'T: Ohne Health-Checks deployen**
 ---
 ### Sicherheit
 **DON'T: Docker Socket direkt exponieren**
 ```yaml
 # NIEMALS!
 ports:
  - "2375:2375"  # Docker API oeffentlich
 ```
 **DON'T: .env committen**
 ```bash
 # .gitignore MUSS enthalten:
 .env
 *.db
 ```
 **DON'T: Container ohne Resource-Limits**
 ```python
 # Vermeiden - DoS-Risiko
 container = client.containers.run(image)
 # Besser
 container = client.containers.run(
    image,
    mem_limit='512m',
    cpu_quota=50000
 )
 ```
 **DON'T: Root-Container in Produktion**
 ---
 ### Wartung
 **DON'T: Logs ignorieren**
 ```bash
 # Regelmaessig pruefen!
 docker-compose logs --tail=100 spawner
 ```
 **DON'T: Backups vergessen**
 **DON'T: Updates aufschieben**
 ```bash
 # Regelmaessig aktualisieren
 git pull origin main
 docker-compose build
 docker-compose up -d
 ```
 ---
 ## Haeufige Fehler
 ### 1. "Connection refused" beim Health-Check
 **Ursache**: Container noch nicht bereit
 **Loesung**: Warten oder start_period erhoehen:
 ```yaml
 healthcheck:
  start_period: 30s
 ```
 ---
 ### 2. "Network not found"
 **Ursache**: Traefik-Netzwerk existiert nicht
 **Loesung**:
 ```bash
 docker network create web
 # Oder TRAEFIK_NETWORK in .env anpassen
 ```
 ---
 ### 3. "Permission denied" bei Docker Socket
 **Ursache**: Spawner-Container hat keinen Zugriff
 **Loesung**:
 ```yaml
 volumes:
  - /var/run/docker.sock:/var/run/docker.sock:rw
 ```
 Oder Docker-Gruppe:
 ```bash
 sudo usermod -aG docker $USER
 ```
 ---
 ### 4. "Image not found"
 **Ursache**: User-Template nicht gebaut
 **Loesung**:
 ```bash
 docker build -t user-service-template:latest ./user-template/
 ```
 ---
 ### 5. Subdomain nicht erreichbar
 **Ursache**: DNS oder Traefik-Konfiguration
 **Diagnose**:
 ```bash
 # DNS pruefen
 nslookup username.example.com
 # Traefik-Routes pruefen (Dashboard)
 # Container-Labels pruefen
 docker inspect user-xxx | jq '.[0].Config.Labels'
 ```
 ---
 ### 6. "Database locked"
 **Ursache**: SQLite-Konkurrenzzugriff
 **Loesung fuer Produktion**: PostgreSQL verwenden:
 ```bash
 DATABASE_URL=postgresql://spawner:pass@postgres:5432/spawner
 ```
 ---
 ### 7. Container startet, aber Service nicht erreichbar
 **Ursache**: Falscher Port in Labels
 **Loesung**: Port in `container_manager.py` pruefen:
 ```python
 # Muss mit EXPOSE im Dockerfile uebereinstimmen
 f'traefik.http.services.user{user_id}.loadbalancer.server.port': '8080'
 ```
 ---
 ## Quick Reference
 ### Nuetzliche Befehle
 ```bash
 # Status
 docker-compose ps
 docker ps --filter 'label=spawner.managed=true'
 # Logs
 docker-compose logs -f spawner
 docker logs user-xxx-1
 # Neustart
 docker-compose restart spawner
 # Komplett neu
 docker-compose down
 docker-compose up -d --build
 # Cleanup
 docker system prune -f
 docker volume prune -f
 ```
 ### Debugging
 ```bash
 # In Container einsteigen
 docker exec -it spawner bash
 # Python-Shell
 docker exec -it spawner python
 # Datenbank
 docker exec spawner sqlite3 /app/data/users.db ".tables"
 ```
 ---
 Zurueck zur [Dokumentations-Uebersicht](../README.md)
--- a/docs/images/info.png
+++ b/docs/images/info.png
--- a/docs/images/spawner-logo.png
+++ b/docs/images/spawner-logo.png
--- a/docs/install/README.md
+++ b/docs/install/README.md
@ -0,0 +1,350 @@
 # Installation
 Anleitung zur Installation und Aktualisierung des Container Spawner.
 ## Inhaltsverzeichnis
 - [Voraussetzungen](#voraussetzungen)
 - [Neuinstallation](#neuinstallation)
 - [Update/Upgrade](#updateupgrade)
 - [Umgebungsvariablen](#umgebungsvariablen)
 - [Manuelle Installation](#manuelle-installation)
 - [Troubleshooting](#troubleshooting)
 ---
 ## Voraussetzungen
 ### Hardware
 | Komponente | Minimum | Empfohlen |
 |------------|---------|-----------|
 | RAM | 2 GB | 4+ GB |
 | Disk | 20 GB | 50+ GB |
 | CPU | 2 Cores | 4+ Cores |
 ### Software
 - **Docker**: Version 20.10+
 - **Docker Compose**: Version 2.0+
 - **Git**: Fuer Repository-Clone
 - **Traefik**: Version 2.x oder 3.x (laufend)
 - **curl** oder **wget**: Fuer Installationsskript
 ### Netzwerk
 - **Port 5000**: Spawner-Service (intern)
 - **Port 80/443**: Traefik Entrypoints
 - **Docker-Netzwerk**: Traefik-Netzwerk muss existieren (Standard: `web`)
 - **DNS**: Wildcard-DNS fuer Subdomains oder manuelle Eintraege
 ---
 ## Neuinstallation
 ### Schnellstart (Ein-Befehl-Installation)
 ```bash
 # In ein leeres Verzeichnis wechseln
 mkdir spawner && cd spawner
 # Installationsskript ausfuehren
 curl -sSL https://gitea.iotxs.de/RainerWieland/spawner/raw/branch/main/install.sh | bash
 ```
 Das Skript erkennt automatisch, dass keine `.env` existiert und:
 1. Laedt `.env.example` herunter
 2. Gibt Anweisungen zur Konfiguration
 ### Konfiguration anpassen
 ```bash
 # Vorlage kopieren
 cp .env.example .env
 # Werte anpassen
 nano .env
 ```
 **Wichtig**: Mindestens diese Werte anpassen:
 ```bash
 # Secret-Key generieren
 python3 -c "import secrets; print(secrets.token_hex(32))"
 # In .env eintragen:
 SECRET_KEY=<generierter-key>
 BASE_DOMAIN=deine-domain.de
 SPAWNER_SUBDOMAIN=coder
 TRAEFIK_NETWORK=web  # Name deines Traefik-Netzwerks
 ```
 ### Installation abschliessen
 ```bash
 bash install.sh
 ```
 Das Skript:
 1. Klont das Repository
 2. Erstellt Verzeichnisse und setzt Berechtigungen (`data/`, `logs/`, `.env`)
 3. Prueft/erstellt Docker-Netzwerk
 4. Baut alle Docker-Images
 5. Startet die Container
 ---
 ## Update/Upgrade
 ### Automatisches Update
 ```bash
 cd /pfad/zu/spawner
 bash install.sh
 ```
 Das Skript erkennt automatisch ein bestehendes Git-Repository und:
 1. Holt neueste Aenderungen (`git pull`)
 2. Prueft/aktualisiert Verzeichnisrechte
 3. Baut Images neu
 4. Startet Container neu
 ### Manuelles Update
 ```bash
 cd /pfad/zu/spawner
 # Aenderungen holen
 git fetch origin
 git pull origin main
 # Images neu bauen
 docker-compose down
 docker build --no-cache -t user-service-template:latest ./user-template/
 docker-compose build
 # Container starten
 docker-compose up -d
 ```
 ### Rollback
 ```bash
 # Zu spezifischer Version zurueck
 git checkout v0.1.0
 docker-compose down
 docker-compose build
 docker-compose up -d
 ```
 ---
 ## Umgebungsvariablen
 ### Pflicht-Variablen
 | Variable | Beschreibung | Beispiel |
 |----------|--------------|----------|
 | `SECRET_KEY` | Flask Session Secret | `python3 -c "import secrets; print(secrets.token_hex(32))"` |
 | `BASE_DOMAIN` | Haupt-Domain | `example.com` |
 | `SPAWNER_SUBDOMAIN` | Subdomain fuer Spawner-UI | `coder` |
 | `TRAEFIK_NETWORK` | Docker-Netzwerk fuer Traefik | `web` |
 ### Traefik-Variablen
 | Variable | Standard | Beschreibung |
 |----------|----------|--------------|
 | `TRAEFIK_CERTRESOLVER` | `lets-encrypt` | Name des Certificate Resolvers aus traefik.yml |
 | `TRAEFIK_ENTRYPOINT` | `websecure` | HTTPS Entrypoint Name |
 ### Optionale Variablen
 | Variable | Standard | Beschreibung |
 |----------|----------|--------------|
 | `USER_TEMPLATE_IMAGE` | `user-service-template:latest` | Docker-Image fuer User-Container |
 | `DEFAULT_MEMORY_LIMIT` | `512m` | RAM-Limit pro Container |
 | `DEFAULT_CPU_QUOTA` | `50000` | CPU-Quota (50000 = 0.5 CPU) |
 | `SPAWNER_PORT` | `5000` | Interner Port des Spawners |
 | `LOG_LEVEL` | `INFO` | Log-Level (DEBUG, INFO, WARNING, ERROR) |
 | `JWT_ACCESS_TOKEN_EXPIRES` | `3600` | JWT Token Gueltigkeitsdauer (Sekunden) |
 | `CONTAINER_IDLE_TIMEOUT` | `3600` | Timeout in Sekunden (noch nicht implementiert) |
 ### User-Templates
 Es stehen zwei Templates fuer User-Container zur Verfuegung:
 | Image | Verzeichnis | Beschreibung |
 |-------|-------------|--------------|
 | `user-service-template:latest` | `user-template/` | Einfache nginx-Willkommensseite (Standard) |
 | `user-template-next:latest` | `user-template-next/` | Moderne Next.js React-Anwendung |
 Um ein anderes Template zu verwenden, aendere `USER_TEMPLATE_IMAGE` in `.env`:
 ```bash
 USER_TEMPLATE_IMAGE=user-template-next:latest
 ```
 ### Produktions-Variablen
 | Variable | Beschreibung |
 |----------|--------------|
 | `DATABASE_URL` | PostgreSQL-Verbindung (statt SQLite) |
 | `JWT_SECRET_KEY` | Separater JWT-Secret |
 | `CORS_ORIGINS` | Erlaubte CORS-Origins |
 | `DOCKER_HOST` | Docker Socket Pfad (Standard: unix:///var/run/docker.sock) |
 ---
 ## Manuelle Installation
 Falls das Installationsskript nicht verwendet werden kann:
 ```bash
 # 1. Repository klonen
 git clone https://gitea.iotxs.de/RainerWieland/spawner.git
 cd spawner
 # 2. Konfiguration erstellen
 cp .env.example .env
 nano .env  # Werte anpassen
 # 3. Verzeichnisse und Rechte setzen
 mkdir -p data logs
 chmod 755 data logs
 chmod 600 .env
 # 4. Docker-Netzwerk pruefen
 docker network ls | grep web
 # Falls nicht vorhanden:
 docker network create web
 # 5. User-Template Images bauen
 docker build -t user-service-template:latest ./user-template/
 docker build -t user-template-next:latest ./user-template-next/  # Optional
 # 6. Spawner bauen und starten
 docker-compose build
 docker-compose up -d
 # 7. Logs pruefen
 docker-compose logs -f spawner
 ```
 ---
 ## Troubleshooting
 ### Spawner startet nicht
 ```bash
 # Logs pruefen
 docker-compose logs spawner
 # Health-Check
 curl http://localhost:5000/health
 ```
 **Haeufige Ursachen**:
 - `.env` fehlt oder hat falsche Werte
 - Docker-Socket nicht gemountet
 - Netzwerk existiert nicht
 ### Container wird nicht erstellt
 ```bash
 # Docker-Verbindung testen
 docker ps
 # Template-Image pruefen
 docker images | grep user-service-template
 ```
 **Haeufige Ursachen**:
 - Template-Image nicht gebaut
 - Netzwerk-Name falsch in `.env`
 ### Traefik routet nicht
 ```bash
 # Traefik-Dashboard pruefen (falls aktiviert)
 # Container-Labels pruefen
 docker inspect spawner | jq '.[0].Config.Labels'
 # Netzwerk-Verbindung pruefen
 docker network inspect web | grep spawner
 ```
 **Haeufige Ursachen**:
 - Container nicht im Traefik-Netzwerk
 - Labels falsch konfiguriert
 - DNS nicht konfiguriert
 ### Datenbank-Fehler
 ```bash
 # In Container einsteigen
 docker exec -it spawner bash
 # DB manuell initialisieren
 python -c "from app import app, db; app.app_context().push(); db.create_all()"
 ```
 ---
 ## Verzeichnisrechte
 Das Installationsskript setzt die Berechtigungen automatisch. Bei manueller Installation muessen diese selbst gesetzt werden.
 ### Vom Skript automatisch gesetzt
 | Pfad | Berechtigung | Zweck |
 |------|--------------|-------|
 | `./data/` | `755` | SQLite-Datenbank |
 | `./logs/` | `755` | Log-Dateien |
 | `./.env` | `600` | Sensible Konfiguration (nur Owner) |
 | `./install.sh` | `+x` | Ausfuehrbar |
 ### Vom System benoetigt
 | Pfad | Berechtigung | Zweck |
 |------|--------------|-------|
 | `/var/run/docker.sock` | `rw` | Docker-API-Zugriff |
 ### Manuelle Rechte setzen
 ```bash
 # Verzeichnisse erstellen
 mkdir -p data logs
 # Berechtigungen setzen
 chmod 755 data logs
 chmod 600 .env
 chmod +x install.sh
 ```
 ### Non-Root Container
 Falls der Spawner-Container als non-root User laeuft, muessen die Verzeichnisse fuer diesen beschreibbar sein:
 ```bash
 # Option 1: Volle Schreibrechte (einfach, aber weniger sicher)
 chmod 777 data logs
 # Option 2: Owner auf Container-UID setzen (empfohlen)
 # UID des Container-Users ermitteln und setzen
 chown 1000:1000 data logs
 ```
 ### Synology NAS Hinweis
 Auf Synology NAS (DSM) kann es noetig sein, die Verzeichnisse dem Docker-User zuzuweisen:
 ```bash
 # Als root auf der Synology
 chown -R 1000:1000 /volume1/docker/spawner/data
 chown -R 1000:1000 /volume1/docker/spawner/logs
 ```
 ---
 Zurueck zur [Dokumentations-Uebersicht](../README.md)
--- a/docs/security/README.md
+++ b/docs/security/README.md
@ -0,0 +1,312 @@
 # Sicherheit
 Sicherheitsrisiken und Gegenmassnahmen fuer den Container Spawner.
 ## Inhaltsverzeichnis
 - [Docker Socket Risiko](#docker-socket-risiko)
 - [Container Isolation](#container-isolation)
 - [Session-Sicherheit](#session-sicherheit)
 - [Input-Validierung](#input-validierung)
 - [Secrets Management](#secrets-management)
 - [Netzwerksicherheit](#netzwerksicherheit)
 - [Sicherheits-Checkliste](#sicherheits-checkliste)
 ---
 ## Docker Socket Risiko
 ### Problem
 Der Spawner benoetigt Zugriff auf `/var/run/docker.sock` um Container zu erstellen. Dies entspricht Root-Privilegien auf dem Host-System.
 ### Risiken
 - Ein kompromittierter Spawner kann alle Container kontrollieren
 - Potenzieller Container-Escape moeglich
 - Zugriff auf Host-Dateisystem via Volume-Mounts
 ### Gegenmassnahmen
 **Option 1: Docker Socket Proxy (Empfohlen fuer Produktion)**
 ```yaml
 services:
  docker-proxy:
    image: tecnativa/docker-socket-proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      CONTAINERS: 1    # Container-Operationen erlauben
      NETWORKS: 1      # Netzwerk-Operationen erlauben
      SERVICES: 0      # Swarm-Services blockieren
      SWARM: 0         # Swarm-Operationen blockieren
      VOLUMES: 0       # Volume-Operationen blockieren
      IMAGES: 1        # Image-Operationen erlauben
    networks:
      - internal
  spawner:
    environment:
      DOCKER_HOST: tcp://docker-proxy:2375
    networks:
      - internal
      - web
 networks:
  internal:
    internal: true  # Kein externer Zugriff
 ```
 **Option 2: Minimale Permissions**
 ```bash
 # User-Namespace aktivieren (in /etc/docker/daemon.json)
 {
  "userns-remap": "default"
 }
 ```
 ---
 ## Container Isolation
 ### Aktuelle Massnahmen
 | Massnahme | Status | Beschreibung |
 |-----------|--------|--------------|
 | Memory-Limit | Aktiv | Standard 512m pro Container |
 | CPU-Quota | Aktiv | Standard 0.5 CPU pro Container |
 | Restart-Policy | Aktiv | `unless-stopped` |
 | Network-Isolation | Teilweise | Alle im gleichen Traefik-Netzwerk |
 ### Empfehlungen
 **Read-Only Filesystem**
 ```python
 # In container_manager.py
 container = client.containers.run(
    read_only=True,
    tmpfs={'/tmp': 'size=100M,noexec'}
 )
 ```
 **Security Options**
 ```python
 container = client.containers.run(
    security_opt=['no-new-privileges:true'],
    cap_drop=['ALL'],
    cap_add=['NET_BIND_SERVICE']  # Nur wenn noetig
 )
 ```
 **Separate Netzwerke pro User** (Fuer hohe Isolation)
 ```python
 # Dediziertes Netzwerk pro User
 user_network = f"user-{username}-network"
 client.networks.create(user_network, driver='bridge', internal=True)
 ```
 ---
 ## Session-Sicherheit
 ### Aktuelle Konfiguration
 ```python
 SESSION_COOKIE_SECURE = True       # Nur HTTPS (Produktion)
 SESSION_COOKIE_HTTPONLY = True     # Kein JavaScript-Zugriff
 SESSION_COOKIE_SAMESITE = 'Lax'    # CSRF-Schutz
 PERMANENT_SESSION_LIFETIME = 3600  # 1h Timeout
 ```
 ### Empfehlungen
 - **SECRET_KEY**: Mindestens 32 Bytes, zufaellig generiert
 - **HTTPS erzwingen**: Immer in Produktion
 - **Session-Rotation**: Nach Login neue Session-ID
 ```python
 # Session-Rotation nach Login
 from flask import session
 session.regenerate()
 ```
 ---
 ## Input-Validierung
 ### Aktuelle Risiken
 - Username wird direkt in Container-Namen verwendet
 - Minimale Validierung bei Registrierung
 ### Empfohlene Validierung
 ```python
 import re
 def validate_username(username):
    """Validiert Username gegen Injection-Angriffe"""
    if not username:
        return False, "Username erforderlich"
    if len(username) < 3 or len(username) > 20:
        return False, "Username muss 3-20 Zeichen lang sein"
    if not re.match(r'^[a-zA-Z0-9_]+$', username):
        return False, "Nur Buchstaben, Zahlen und Unterstriche erlaubt"
    # Reservierte Namen
    reserved = ['admin', 'root', 'system', 'spawner', 'traefik']
    if username.lower() in reserved:
        return False, "Dieser Username ist reserviert"
    return True, None
 # Container-Name sicher erstellen
 def safe_container_name(username, user_id):
    """Erstellt sicheren Container-Namen"""
    safe_name = re.sub(r'[^a-zA-Z0-9_-]', '', username)
    return f"user-{safe_name}-{user_id}"
 ```
 ---
 ## Secrets Management
 ### Entwicklung vs. Produktion
 | Umgebung | Methode |
 |----------|---------|
 | Entwicklung | `.env` Datei (nie committen!) |
 | Produktion | Docker Secrets oder Vault |
 ### Docker Secrets (Produktion)
 ```bash
 # Secret erstellen
 echo "supersecretkey" | docker secret create flask_secret -
 # In docker-compose.yml
 services:
  spawner:
    secrets:
      - flask_secret
    environment:
      SECRET_KEY_FILE: /run/secrets/flask_secret
 secrets:
  flask_secret:
    external: true
 ```
 ### Environment-Variable Sicherheit
 ```bash
 # .env NIEMALS committen
 echo ".env" >> .gitignore
 # Sensible Werte nicht in Logs
 LOG_LEVEL=INFO  # Nicht DEBUG in Produktion
 ```
 ---
 ## Netzwerksicherheit
 ### Traefik-Konfiguration
 **HTTPS erzwingen**
 ```yaml
 # In container_manager.py Labels
 labels={
    'traefik.http.routers.user{id}.entrypoints': 'websecure',
    'traefik.http.routers.user{id}.tls': 'true',
    'traefik.http.routers.user{id}.tls.certresolver': 'letsencrypt',
    # HTTP zu HTTPS Redirect
    'traefik.http.middlewares.redirect-https.redirectscheme.scheme': 'https',
    'traefik.http.routers.user{id}-http.middlewares': 'redirect-https'
 }
 ```
 **Rate-Limiting via Traefik**
 ```yaml
 labels={
    'traefik.http.middlewares.ratelimit.ratelimit.average': '100',
    'traefik.http.middlewares.ratelimit.ratelimit.burst': '50',
    'traefik.http.routers.spawner.middlewares': 'ratelimit'
 }
 ```
 ### Firewall-Empfehlungen
 ```bash
 # Nur Traefik-Ports oeffentlich
 ufw allow 80/tcp
 ufw allow 443/tcp
 # Docker-Socket NIE oeffentlich!
 # Port 5000 nur intern (ueber Traefik)
 ```
 ---
 ## Sicherheits-Checkliste
 ### Vor Go-Live
 - [ ] SECRET_KEY generiert (32+ Bytes)
 - [ ] `.env` nicht im Repository
 - [ ] HTTPS konfiguriert und getestet
 - [ ] Docker Socket Proxy aktiviert (Produktion)
 - [ ] Resource-Limits angemessen
 - [ ] Input-Validierung implementiert
 - [ ] Rate-Limiting aktiv
 - [ ] Logs auf sensible Daten geprueft
 - [ ] Backup-Strategie implementiert
 ### Regelmaessig pruefen
 - [ ] Container auf Vulnerabilities scannen
 - [ ] Dependencies aktualisieren
 - [ ] Logs auf verdaechtige Aktivitaeten pruefen
 - [ ] Unbefugte Container entfernen
 ### Vulnerability Scanning
 ```bash
 # Mit Trivy scannen
 docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
    aquasec/trivy image spawner:latest
 docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
    aquasec/trivy image user-service-template:latest
 ```
 ---
 ## Incident Response
 ### Bei Verdacht auf Kompromittierung
 1. **Spawner stoppen**: `docker-compose down`
 2. **Alle User-Container stoppen**: `docker stop $(docker ps -q --filter 'label=spawner.managed=true')`
 3. **Logs sichern**: `docker-compose logs > incident-logs.txt`
 4. **Secrets rotieren**: Neue SECRET_KEY generieren
 5. **Analyse durchfuehren**
 6. **Behobene Version deployen**
 ### Kontakt
 Bei Sicherheitsproblemen: Issue im Repository erstellen (privat falls sensibel)
 ---
 Zurueck zur [Dokumentations-Uebersicht](../README.md)
--- a/docs/versions/CHANGELOG.md
+++ b/docs/versions/CHANGELOG.md
@ -0,0 +1,63 @@
 # Changelog
 Alle nennenswerten Aenderungen werden in dieser Datei dokumentiert.
 Das Format basiert auf [Keep a Changelog](https://keepachangelog.com/de/1.0.0/).
 ---
 ## [Unreleased]
 ### Hinzugefuegt
 - Dokumentationsstruktur mit mehreren Kategorien
 - Automatisches Installationsskript (`install.sh`)
 - `.env.example` Vorlage
 ### Geaendert
 - `doc/` Verzeichnis umbenannt zu `docs/`
 - README.md ueberarbeitet mit Schnellstart-Anleitung
 ---
 ## [0.1.0] - 2026-01-30
 ### Hinzugefuegt
 - Flask-Anwendung mit User-Management
 - Docker-Container-Spawning pro User
 - Traefik-Integration via Labels
 - SQLite-Datenbank fuer User-Daten
 - Next.js Frontend
 - REST-API fuer Container-Management
 - User-Template (nginx-basiert)
 - Health-Check Endpoint
 - Docker-Compose Setup
 ### Sicherheit
 - Passwort-Hashing mit Werkzeug
 - Session-Cookies mit HttpOnly/Secure
 - Resource-Limits fuer Container
 ---
 ## [0.0.1] - 2026-01-27
 ### Hinzugefuegt
 - Initiales Projekt-Setup
 - Grundlegende Dokumentation
 ---
 ## Legende
 - **Hinzugefuegt**: Neue Features
 - **Geaendert**: Aenderungen an bestehenden Features
 - **Veraltet**: Features die bald entfernt werden
 - **Entfernt**: Entfernte Features
 - **Behoben**: Bugfixes
 - **Sicherheit**: Sicherheitsrelevante Aenderungen
 ---
 [Unreleased]: https://gitea.iotxs.de/RainerWieland/spawner/compare/v0.1.0...HEAD
 [0.1.0]: https://gitea.iotxs.de/RainerWieland/spawner/releases/tag/v0.1.0
 [0.0.1]: https://gitea.iotxs.de/RainerWieland/spawner/releases/tag/v0.0.1
--- a/docs/versions/README.md
+++ b/docs/versions/README.md
@ -0,0 +1,68 @@
 # Versionierung
 Dieses Projekt verwendet [Semantic Versioning](https://semver.org/lang/de/).
 ## Aktuelle Version
 **Version**: 0.1.0 (Entwicklung)
 **Release-Datum**: Januar 2026
 **Status**: Alpha
 ## Versionierungsschema
 ```
 MAJOR.MINOR.PATCH
 MAJOR: Inkompatible API-Aenderungen
 MINOR: Neue Features (rueckwaertskompatibel)
 PATCH: Bugfixes (rueckwaertskompatibel)
 ```
 ### Pre-Release Versionen
 - `0.x.x` - Entwicklungsphase, API kann sich aendern
 - `1.0.0` - Erstes stabiles Release
 ## Changelog
 Siehe [CHANGELOG.md](CHANGELOG.md) fuer detaillierte Aenderungen.
 ## Upgrade-Pfade
 ### Von 0.0.x auf 0.1.0
 Keine Breaking Changes. Einfaches Update moeglich:
 ```bash
 bash install.sh
 ```
 ## Git-Tags
 Releases werden mit Git-Tags markiert:
 ```bash
 # Alle Tags anzeigen
 git tag -l
 # Zu spezifischer Version wechseln
 git checkout v0.1.0
 ```
 ## Geplante Features
 ### Version 0.2.0 (geplant)
 - [ ] Container Auto-Shutdown nach Inaktivitaet
 - [ ] Volume-Persistenz fuer User-Daten
 - [ ] Admin-Dashboard
 ### Version 1.0.0 (geplant)
 - [ ] Multi-Template-Support
 - [ ] API-Rate-Limiting
 - [ ] PostgreSQL-Support (Standard)
 ---
 Zurueck zur [Dokumentations-Uebersicht](../README.md)
--- a/frontend/.env.example
+++ b/frontend/.env.example
@ -0,0 +1,5 @@
 # API-URL (leer lassen für lokale Entwicklung mit Proxy)
 NEXT_PUBLIC_API_URL=
 # Fuer Produktion:
 # NEXT_PUBLIC_API_URL=https://coder.wieland.org
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@ -0,0 +1,35 @@
 # Dependencies
 /node_modules
 /.pnp
 .pnp.js
 .yarn/install-state.gz
 # Testing
 /coverage
 # Next.js
 /.next/
 /out/
 # Production
 /build
 # Misc
 .DS_Store
 *.pem
 # Debug
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 # Local env files
 .env*.local
 .env
 # Vercel
 .vercel
 # TypeScript
 *.tsbuildinfo
 next-env.d.ts
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@ -0,0 +1,40 @@
 # Build stage
 FROM node:20-alpine AS builder
 WORKDIR /app
 # Dependencies
 COPY package.json package-lock.json* ./
 RUN npm ci
 # Source code
 COPY . .
 # Build
 ENV NEXT_TELEMETRY_DISABLED=1
 RUN npm run build
 # Production stage
 FROM node:20-alpine AS runner
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
 # Copy standalone build
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 USER nextjs
 EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 CMD ["node", "server.js"]
--- a/frontend/next.config.mjs
+++ b/frontend/next.config.mjs
@ -0,0 +1,16 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
  output: 'standalone',
  async rewrites() {
    return [
      {
        source: '/api/:path*',
        destination: process.env.NEXT_PUBLIC_API_URL
          ? `${process.env.NEXT_PUBLIC_API_URL}/api/:path*`
          : 'http://localhost:5000/api/:path*',
      },
    ];
  },
 };
 export default nextConfig;
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
--- a/frontend/package.json
+++ b/frontend/package.json
@ -0,0 +1,36 @@
 {
  "name": "container-spawner-frontend",
  "version": "1.0.0",
  "private": true,
  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "next start",
    "lint": "next lint"
  },
  "dependencies": {
    "next": "14.2.5",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "class-variance-authority": "^0.7.0",
    "clsx": "^2.1.1",
    "tailwind-merge": "^2.4.0",
    "lucide-react": "^0.408.0",
    "@radix-ui/react-slot": "^1.1.0",
    "@radix-ui/react-label": "^2.1.0",
    "@radix-ui/react-separator": "^1.1.0",
    "@radix-ui/react-avatar": "^1.1.0",
    "@radix-ui/react-dropdown-menu": "^2.1.1"
  },
  "devDependencies": {
    "@types/node": "^20.14.10",
    "@types/react": "^18.3.3",
    "@types/react-dom": "^18.3.0",
    "autoprefixer": "^10.4.19",
    "eslint": "^8.57.0",
    "eslint-config-next": "14.2.5",
    "postcss": "^8.4.39",
    "tailwindcss": "^3.4.6",
    "typescript": "^5.5.3"
  }
 }
--- a/frontend/postcss.config.mjs
+++ b/frontend/postcss.config.mjs
@ -0,0 +1,9 @@
 /** @type {import('postcss-load-config').Config} */
 const config = {
  plugins: {
    tailwindcss: {},
    autoprefixer: {},
  },
 };
 export default config;
--- a/frontend/public/.gitkeep
+++ b/frontend/public/.gitkeep
--- a/frontend/src/app/dashboard/page.tsx
+++ b/frontend/src/app/dashboard/page.tsx
@ -0,0 +1,314 @@
 "use client";
 import { useState, useEffect, useCallback } from "react";
 import { useRouter } from "next/navigation";
 import { useAuth } from "@/hooks/use-auth";
 import { api, UserResponse } from "@/lib/api";
 import { Button } from "@/components/ui/button";
 import {
  Card,
  CardContent,
  CardDescription,
  CardHeader,
  CardTitle,
 } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
 import { Separator } from "@/components/ui/separator";
 import { Avatar, AvatarFallback } from "@/components/ui/avatar";
 import {
  Container,
  ExternalLink,
  RefreshCw,
  LogOut,
  Loader2,
  CheckCircle2,
  XCircle,
  AlertCircle,
 } from "lucide-react";
 export default function DashboardPage() {
  const { user, logout, isLoading: authLoading } = useAuth();
  const router = useRouter();
  const [userData, setUserData] = useState<UserResponse | null>(null);
  const [isRefreshing, setIsRefreshing] = useState(false);
  const [isRestarting, setIsRestarting] = useState(false);
  const [error, setError] = useState("");
  const fetchUserData = useCallback(async () => {
    const { data, error } = await api.getUser();
    if (data) {
      setUserData(data);
    } else if (error) {
      setError(error);
    }
  }, []);
  useEffect(() => {
    if (!authLoading && !user) {
      router.replace("/login");
    } else if (user) {
      fetchUserData();
    }
  }, [user, authLoading, router, fetchUserData]);
  const handleRefresh = async () => {
    setIsRefreshing(true);
    await fetchUserData();
    setIsRefreshing(false);
  };
  const handleRestart = async () => {
    setIsRestarting(true);
    setError("");
    const { data, error } = await api.restartContainer();
    if (error) {
      setError(error);
    } else {
      await fetchUserData();
    }
    setIsRestarting(false);
  };
  const handleLogout = async () => {
    await logout();
    router.push("/login");
  };
  const getStatusBadge = (status: string) => {
    switch (status) {
      case "running":
        return (
          <Badge variant="success" className="gap-1">
            <CheckCircle2 className="h-3 w-3" />
            Lauft
          </Badge>
        );
      case "exited":
      case "stopped":
        return (
          <Badge variant="destructive" className="gap-1">
            <XCircle className="h-3 w-3" />
            Gestoppt
          </Badge>
        );
      case "no_container":
        return (
          <Badge variant="warning" className="gap-1">
            <AlertCircle className="h-3 w-3" />
            Kein Container
          </Badge>
        );
      default:
        return (
          <Badge variant="secondary" className="gap-1">
            <AlertCircle className="h-3 w-3" />
            {status}
          </Badge>
        );
    }
  };
  if (authLoading || !user) {
    return (
      <div className="flex min-h-screen items-center justify-center">
        <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
      </div>
    );
  }
  return (
    <div className="min-h-screen bg-muted/50">
      {/* Header */}
      <header className="border-b bg-background">
        <div className="container mx-auto flex h-16 items-center justify-between px-4">
          <div className="flex items-center gap-2">
            <Container className="h-6 w-6 text-primary" />
            <span className="text-lg font-semibold">Container Spawner</span>
          </div>
          <div className="flex items-center gap-4">
            <div className="flex items-center gap-2">
              <Avatar className="h-8 w-8">
                <AvatarFallback className="text-xs">
                  {user.username.slice(0, 2).toUpperCase()}
                </AvatarFallback>
              </Avatar>
              <span className="text-sm font-medium">{user.username}</span>
            </div>
            <Button variant="ghost" size="sm" onClick={handleLogout}>
              <LogOut className="mr-2 h-4 w-4" />
              Abmelden
            </Button>
          </div>
        </div>
      </header>
      {/* Main Content */}
      <main className="container mx-auto p-4 md:p-8">
        <div className="mb-8">
          <h1 className="text-3xl font-bold">Dashboard</h1>
          <p className="text-muted-foreground">
            Verwalte deinen personlichen Container
          </p>
        </div>
        {error && (
          <div className="mb-6 rounded-md bg-destructive/10 p-4 text-sm text-destructive">
            {error}
          </div>
        )}
        <div className="grid gap-6 md:grid-cols-2">
          {/* Container Status Card */}
          <Card>
            <CardHeader>
              <CardTitle className="flex items-center gap-2">
                <Container className="h-5 w-5" />
                Container Status
              </CardTitle>
              <CardDescription>
                Informationen zu deinem personlichen Container
              </CardDescription>
            </CardHeader>
            <CardContent className="space-y-4">
              <div className="flex items-center justify-between">
                <span className="text-sm text-muted-foreground">Status</span>
                {userData ? (
                  getStatusBadge(userData.container.status)
                ) : (
                  <Loader2 className="h-4 w-4 animate-spin" />
                )}
              </div>
              <Separator />
              <div className="flex items-center justify-between">
                <span className="text-sm text-muted-foreground">
                  Container ID
                </span>
                <code className="rounded bg-muted px-2 py-1 text-xs">
                  {userData?.container.id?.slice(0, 12) || "-"}
                </code>
              </div>
              <Separator />
              <div className="flex gap-2">
                <Button
                  variant="outline"
                  size="sm"
                  onClick={handleRefresh}
                  disabled={isRefreshing}
                >
                  {isRefreshing ? (
                    <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                  ) : (
                    <RefreshCw className="mr-2 h-4 w-4" />
                  )}
                  Aktualisieren
                </Button>
                <Button
                  variant="default"
                  size="sm"
                  onClick={handleRestart}
                  disabled={isRestarting}
                >
                  {isRestarting ? (
                    <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                  ) : (
                    <RefreshCw className="mr-2 h-4 w-4" />
                  )}
                  Neu starten
                </Button>
              </div>
            </CardContent>
          </Card>
          {/* Service URL Card */}
          <Card>
            <CardHeader>
              <CardTitle className="flex items-center gap-2">
                <ExternalLink className="h-5 w-5" />
                Dein Service
              </CardTitle>
              <CardDescription>
                Zugriff auf deinen personlichen Bereich
              </CardDescription>
            </CardHeader>
            <CardContent className="space-y-4">
              <div className="rounded-md border bg-muted/50 p-4">
                <p className="mb-2 text-sm text-muted-foreground">
                  Deine Service-URL:
                </p>
                {userData?.container.service_url ? (
                  <a
                    href={userData.container.service_url}
                    target="_blank"
                    rel="noopener noreferrer"
                    className="flex items-center gap-2 text-primary hover:underline"
                  >
                    {userData.container.service_url}
                    <ExternalLink className="h-4 w-4" />
                  </a>
                ) : (
                  <span className="text-muted-foreground">Laden...</span>
                )}
              </div>
              <Button
                className="w-full"
                asChild
                disabled={
                  !userData?.container.service_url ||
                  userData?.container.status !== "running"
                }
              >
                <a
                  href={userData?.container.service_url || "#"}
                  target="_blank"
                  rel="noopener noreferrer"
                >
                  <ExternalLink className="mr-2 h-4 w-4" />
                  Service offnen
                </a>
              </Button>
              {userData?.container.status !== "running" && (
                <p className="text-center text-sm text-muted-foreground">
                  Container muss laufen, um den Service zu nutzen
                </p>
              )}
            </CardContent>
          </Card>
          {/* User Info Card */}
          <Card className="md:col-span-2">
            <CardHeader>
              <CardTitle>Kontoinformationen</CardTitle>
              <CardDescription>Deine personlichen Daten</CardDescription>
            </CardHeader>
            <CardContent>
              <div className="grid gap-4 md:grid-cols-3">
                <div>
                  <p className="text-sm text-muted-foreground">Benutzername</p>
                  <p className="font-medium">{user.username}</p>
                </div>
                <div>
                  <p className="text-sm text-muted-foreground">E-Mail</p>
                  <p className="font-medium">{user.email}</p>
                </div>
                <div>
                  <p className="text-sm text-muted-foreground">Registriert</p>
                  <p className="font-medium">
                    {userData?.user.created_at
                      ? new Date(userData.user.created_at).toLocaleDateString(
                          "de-DE"
                        )
                      : "-"}
                  </p>
                </div>
              </div>
            </CardContent>
          </Card>
        </div>
      </main>
    </div>
  );
 }
--- a/frontend/src/app/globals.css
+++ b/frontend/src/app/globals.css
@ -0,0 +1,59 @@
@tailwind base;
@tailwind components;
@tailwind utilities;
@layer base {
  :root {
    --background: 0 0% 100%;
    --foreground: 222.2 84% 4.9%;
    --card: 0 0% 100%;
    --card-foreground: 222.2 84% 4.9%;
    --popover: 0 0% 100%;
    --popover-foreground: 222.2 84% 4.9%;
    --primary: 222.2 47.4% 11.2%;
    --primary-foreground: 210 40% 98%;
    --secondary: 210 40% 96.1%;
    --secondary-foreground: 222.2 47.4% 11.2%;
    --muted: 210 40% 96.1%;
    --muted-foreground: 215.4 16.3% 46.9%;
    --accent: 210 40% 96.1%;
    --accent-foreground: 222.2 47.4% 11.2%;
    --destructive: 0 84.2% 60.2%;
    --destructive-foreground: 210 40% 98%;
    --border: 214.3 31.8% 91.4%;
    --input: 214.3 31.8% 91.4%;
    --ring: 222.2 84% 4.9%;
    --radius: 0.5rem;
  }
  .dark {
    --background: 222.2 84% 4.9%;
    --foreground: 210 40% 98%;
    --card: 222.2 84% 4.9%;
    --card-foreground: 210 40% 98%;
    --popover: 222.2 84% 4.9%;
    --popover-foreground: 210 40% 98%;
    --primary: 210 40% 98%;
    --primary-foreground: 222.2 47.4% 11.2%;
    --secondary: 217.2 32.6% 17.5%;
    --secondary-foreground: 210 40% 98%;
    --muted: 217.2 32.6% 17.5%;
    --muted-foreground: 215 20.2% 65.1%;
    --accent: 217.2 32.6% 17.5%;
    --accent-foreground: 210 40% 98%;
    --destructive: 0 62.8% 30.6%;
    --destructive-foreground: 210 40% 98%;
    --border: 217.2 32.6% 17.5%;
    --input: 217.2 32.6% 17.5%;
    --ring: 212.7 26.8% 83.9%;
  }
 }
@layer base {
  * {
    @apply border-border;
  }
  body {
    @apply bg-background text-foreground;
  }
 }
--- a/frontend/src/app/layout.tsx
+++ b/frontend/src/app/layout.tsx
@ -0,0 +1,25 @@
 import type { Metadata } from "next";
 import { Inter } from "next/font/google";
 import "./globals.css";
 import { AuthProvider } from "@/hooks/use-auth";
 const inter = Inter({ subsets: ["latin"] });
 export const metadata: Metadata = {
  title: "Container Spawner",
  description: "Dein persönlicher Container-Service",
 };
 export default function RootLayout({
  children,
 }: Readonly<{
  children: React.ReactNode;
 }>) {
  return (
    <html lang="de">
      <body className={inter.className}>
        <AuthProvider>{children}</AuthProvider>
      </body>
    </html>
  );
 }
--- a/frontend/src/app/login/page.tsx
+++ b/frontend/src/app/login/page.tsx
@ -0,0 +1,121 @@
 "use client";
 import { useState, useEffect } from "react";
 import { useRouter } from "next/navigation";
 import Link from "next/link";
 import { useAuth } from "@/hooks/use-auth";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import {
  Card,
  CardContent,
  CardDescription,
  CardHeader,
  CardTitle,
 } from "@/components/ui/card";
 import { Container, Loader2 } from "lucide-react";
 export default function LoginPage() {
  const [username, setUsername] = useState("");
  const [password, setPassword] = useState("");
  const [error, setError] = useState("");
  const [isSubmitting, setIsSubmitting] = useState(false);
  const { login, user, isLoading } = useAuth();
  const router = useRouter();
  useEffect(() => {
    if (!isLoading && user) {
      router.replace("/dashboard");
    }
  }, [user, isLoading, router]);
  const handleSubmit = async (e: React.FormEvent) => {
    e.preventDefault();
    setError("");
    setIsSubmitting(true);
    const result = await login(username, password);
    if (result.success) {
      router.push("/dashboard");
    } else {
      setError(result.error || "Login fehlgeschlagen");
      setIsSubmitting(false);
    }
  };
  if (isLoading) {
    return (
      <div className="flex min-h-screen items-center justify-center">
        <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
      </div>
    );
  }
  return (
    <div className="flex min-h-screen flex-col items-center justify-center bg-muted/50 p-4">
      <Card className="w-full max-w-md">
        <CardHeader className="space-y-1 text-center">
          <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-primary">
            <Container className="h-6 w-6 text-primary-foreground" />
          </div>
          <CardTitle className="text-2xl font-bold">Willkommen</CardTitle>
          <CardDescription>
            Melde dich an, um auf deinen Container zuzugreifen
          </CardDescription>
        </CardHeader>
        <CardContent>
          <form onSubmit={handleSubmit} className="space-y-4">
            {error && (
              <div className="rounded-md bg-destructive/10 p-3 text-sm text-destructive">
                {error}
              </div>
            )}
            <div className="space-y-2">
              <Label htmlFor="username">Benutzername</Label>
              <Input
                id="username"
                type="text"
                placeholder="dein-username"
                value={username}
                onChange={(e) => setUsername(e.target.value)}
                required
                disabled={isSubmitting}
              />
            </div>
            <div className="space-y-2">
              <Label htmlFor="password">Passwort</Label>
              <Input
                id="password"
                type="password"
                placeholder="••••••••"
                value={password}
                onChange={(e) => setPassword(e.target.value)}
                required
                disabled={isSubmitting}
              />
            </div>
            <Button type="submit" className="w-full" disabled={isSubmitting}>
              {isSubmitting ? (
                <>
                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                  Anmelden...
                </>
              ) : (
                "Anmelden"
              )}
            </Button>
          </form>
          <div className="mt-6 text-center text-sm">
            Noch kein Konto?{" "}
            <Link href="/signup" className="text-primary hover:underline">
              Registrieren
            </Link>
          </div>
        </CardContent>
      </Card>
    </div>
  );
 }
--- a/frontend/src/app/page.tsx
+++ b/frontend/src/app/page.tsx
@ -0,0 +1,26 @@
 "use client";
 import { useEffect } from "react";
 import { useRouter } from "next/navigation";
 import { useAuth } from "@/hooks/use-auth";
 export default function Home() {
  const { user, isLoading } = useAuth();
  const router = useRouter();
  useEffect(() => {
    if (!isLoading) {
      if (user) {
        router.replace("/dashboard");
      } else {
        router.replace("/login");
      }
    }
  }, [user, isLoading, router]);
  return (
    <div className="flex min-h-screen items-center justify-center">
      <div className="animate-pulse text-muted-foreground">Laden...</div>
    </div>
  );
 }
--- a/frontend/src/app/signup/page.tsx
+++ b/frontend/src/app/signup/page.tsx
@ -0,0 +1,166 @@
 "use client";
 import { useState, useEffect } from "react";
 import { useRouter } from "next/navigation";
 import Link from "next/link";
 import { useAuth } from "@/hooks/use-auth";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import {
  Card,
  CardContent,
  CardDescription,
  CardHeader,
  CardTitle,
 } from "@/components/ui/card";
 import { Container, Loader2 } from "lucide-react";
 export default function SignupPage() {
  const [username, setUsername] = useState("");
  const [email, setEmail] = useState("");
  const [password, setPassword] = useState("");
  const [confirmPassword, setConfirmPassword] = useState("");
  const [error, setError] = useState("");
  const [isSubmitting, setIsSubmitting] = useState(false);
  const { signup, user, isLoading } = useAuth();
  const router = useRouter();
  useEffect(() => {
    if (!isLoading && user) {
      router.replace("/dashboard");
    }
  }, [user, isLoading, router]);
  const handleSubmit = async (e: React.FormEvent) => {
    e.preventDefault();
    setError("");
    if (password !== confirmPassword) {
      setError("Passworter stimmen nicht uberein");
      return;
    }
    if (password.length < 6) {
      setError("Passwort muss mindestens 6 Zeichen lang sein");
      return;
    }
    if (username.length < 3) {
      setError("Benutzername muss mindestens 3 Zeichen lang sein");
      return;
    }
    setIsSubmitting(true);
    const result = await signup(username, email, password);
    if (result.success) {
      router.push("/dashboard");
    } else {
      setError(result.error || "Registrierung fehlgeschlagen");
      setIsSubmitting(false);
    }
  };
  if (isLoading) {
    return (
      <div className="flex min-h-screen items-center justify-center">
        <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
      </div>
    );
  }
  return (
    <div className="flex min-h-screen flex-col items-center justify-center bg-muted/50 p-4">
      <Card className="w-full max-w-md">
        <CardHeader className="space-y-1 text-center">
          <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-primary">
            <Container className="h-6 w-6 text-primary-foreground" />
          </div>
          <CardTitle className="text-2xl font-bold">Konto erstellen</CardTitle>
          <CardDescription>
            Registriere dich, um deinen eigenen Container zu erhalten
          </CardDescription>
        </CardHeader>
        <CardContent>
          <form onSubmit={handleSubmit} className="space-y-4">
            {error && (
              <div className="rounded-md bg-destructive/10 p-3 text-sm text-destructive">
                {error}
              </div>
            )}
            <div className="space-y-2">
              <Label htmlFor="username">Benutzername</Label>
              <Input
                id="username"
                type="text"
                placeholder="dein-username"
                value={username}
                onChange={(e) => setUsername(e.target.value)}
                required
                disabled={isSubmitting}
              />
              <p className="text-xs text-muted-foreground">
                Dieser wird Teil deiner Service-URL
              </p>
            </div>
            <div className="space-y-2">
              <Label htmlFor="email">E-Mail</Label>
              <Input
                id="email"
                type="email"
                placeholder="name@beispiel.de"
                value={email}
                onChange={(e) => setEmail(e.target.value)}
                required
                disabled={isSubmitting}
              />
            </div>
            <div className="space-y-2">
              <Label htmlFor="password">Passwort</Label>
              <Input
                id="password"
                type="password"
                placeholder="••••••••"
                value={password}
                onChange={(e) => setPassword(e.target.value)}
                required
                disabled={isSubmitting}
              />
            </div>
            <div className="space-y-2">
              <Label htmlFor="confirmPassword">Passwort bestatigen</Label>
              <Input
                id="confirmPassword"
                type="password"
                placeholder="••••••••"
                value={confirmPassword}
                onChange={(e) => setConfirmPassword(e.target.value)}
                required
                disabled={isSubmitting}
              />
            </div>
            <Button type="submit" className="w-full" disabled={isSubmitting}>
              {isSubmitting ? (
                <>
                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
                  Container wird erstellt...
                </>
              ) : (
                "Registrieren"
              )}
            </Button>
          </form>
          <div className="mt-6 text-center text-sm">
            Bereits ein Konto?{" "}
            <Link href="/login" className="text-primary hover:underline">
              Anmelden
            </Link>
          </div>
        </CardContent>
      </Card>
    </div>
  );
 }
--- a/frontend/src/components/ui/avatar.tsx
+++ b/frontend/src/components/ui/avatar.tsx
@ -0,0 +1,50 @@
 "use client";
 import * as React from "react";
 import * as AvatarPrimitive from "@radix-ui/react-avatar";
 import { cn } from "@/lib/utils";
 const Avatar = React.forwardRef<
  React.ElementRef<typeof AvatarPrimitive.Root>,
  React.ComponentPropsWithoutRef<typeof AvatarPrimitive.Root>
 >(({ className, ...props }, ref) => (
  <AvatarPrimitive.Root
    ref={ref}
    className={cn(
      "relative flex h-10 w-10 shrink-0 overflow-hidden rounded-full",
      className
    )}
    {...props}
  />
 ));
 Avatar.displayName = AvatarPrimitive.Root.displayName;
 const AvatarImage = React.forwardRef<
  React.ElementRef<typeof AvatarPrimitive.Image>,
  React.ComponentPropsWithoutRef<typeof AvatarPrimitive.Image>
 >(({ className, ...props }, ref) => (
  <AvatarPrimitive.Image
    ref={ref}
    className={cn("aspect-square h-full w-full", className)}
    {...props}
  />
 ));
 AvatarImage.displayName = AvatarPrimitive.Image.displayName;
 const AvatarFallback = React.forwardRef<
  React.ElementRef<typeof AvatarPrimitive.Fallback>,
  React.ComponentPropsWithoutRef<typeof AvatarPrimitive.Fallback>
 >(({ className, ...props }, ref) => (
  <AvatarPrimitive.Fallback
    ref={ref}
    className={cn(
      "flex h-full w-full items-center justify-center rounded-full bg-muted",
      className
    )}
    {...props}
  />
 ));
 AvatarFallback.displayName = AvatarPrimitive.Fallback.displayName;
 export { Avatar, AvatarImage, AvatarFallback };
--- a/frontend/src/components/ui/badge.tsx
+++ b/frontend/src/components/ui/badge.tsx
@ -0,0 +1,40 @@
 import * as React from "react";
 import { cva, type VariantProps } from "class-variance-authority";
 import { cn } from "@/lib/utils";
 const badgeVariants = cva(
  "inline-flex items-center rounded-full border px-2.5 py-0.5 text-xs font-semibold transition-colors focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2",
  {
    variants: {
      variant: {
        default:
          "border-transparent bg-primary text-primary-foreground hover:bg-primary/80",
        secondary:
          "border-transparent bg-secondary text-secondary-foreground hover:bg-secondary/80",
        destructive:
          "border-transparent bg-destructive text-destructive-foreground hover:bg-destructive/80",
        outline: "text-foreground",
        success:
          "border-transparent bg-green-500 text-white hover:bg-green-500/80",
        warning:
          "border-transparent bg-yellow-500 text-white hover:bg-yellow-500/80",
      },
    },
    defaultVariants: {
      variant: "default",
    },
  }
 );
 export interface BadgeProps
  extends React.HTMLAttributes<HTMLDivElement>,
    VariantProps<typeof badgeVariants> {}
 function Badge({ className, variant, ...props }: BadgeProps) {
  return (
    <div className={cn(badgeVariants({ variant }), className)} {...props} />
  );
 }
 export { Badge, badgeVariants };
--- a/frontend/src/components/ui/button.tsx
+++ b/frontend/src/components/ui/button.tsx
@ -0,0 +1,56 @@
 import * as React from "react";
 import { Slot } from "@radix-ui/react-slot";
 import { cva, type VariantProps } from "class-variance-authority";
 import { cn } from "@/lib/utils";
 const buttonVariants = cva(
  "inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
  {
    variants: {
      variant: {
        default: "bg-primary text-primary-foreground hover:bg-primary/90",
        destructive:
          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
        outline:
          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
        secondary:
          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
        ghost: "hover:bg-accent hover:text-accent-foreground",
        link: "text-primary underline-offset-4 hover:underline",
      },
      size: {
        default: "h-10 px-4 py-2",
        sm: "h-9 rounded-md px-3",
        lg: "h-11 rounded-md px-8",
        icon: "h-10 w-10",
      },
    },
    defaultVariants: {
      variant: "default",
      size: "default",
    },
  }
 );
 export interface ButtonProps
  extends React.ButtonHTMLAttributes<HTMLButtonElement>,
    VariantProps<typeof buttonVariants> {
  asChild?: boolean;
 }
 const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
  ({ className, variant, size, asChild = false, ...props }, ref) => {
    const Comp = asChild ? Slot : "button";
    return (
      <Comp
        className={cn(buttonVariants({ variant, size, className }))}
        ref={ref}
        {...props}
      />
    );
  }
 );
 Button.displayName = "Button";
 export { Button, buttonVariants };
--- a/frontend/src/components/ui/card.tsx
+++ b/frontend/src/components/ui/card.tsx
@ -0,0 +1,79 @@
 import * as React from "react";
 import { cn } from "@/lib/utils";
 const Card = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div
    ref={ref}
    className={cn(
      "rounded-lg border bg-card text-card-foreground shadow-sm",
      className
    )}
    {...props}
  />
 ));
 Card.displayName = "Card";
 const CardHeader = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div
    ref={ref}
    className={cn("flex flex-col space-y-1.5 p-6", className)}
    {...props}
  />
 ));
 CardHeader.displayName = "CardHeader";
 const CardTitle = React.forwardRef<
  HTMLParagraphElement,
  React.HTMLAttributes<HTMLHeadingElement>
 >(({ className, ...props }, ref) => (
  <h3
    ref={ref}
    className={cn(
      "text-2xl font-semibold leading-none tracking-tight",
      className
    )}
    {...props}
  />
 ));
 CardTitle.displayName = "CardTitle";
 const CardDescription = React.forwardRef<
  HTMLParagraphElement,
  React.HTMLAttributes<HTMLParagraphElement>
 >(({ className, ...props }, ref) => (
  <p
    ref={ref}
    className={cn("text-sm text-muted-foreground", className)}
    {...props}
  />
 ));
 CardDescription.displayName = "CardDescription";
 const CardContent = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div ref={ref} className={cn("p-6 pt-0", className)} {...props} />
 ));
 CardContent.displayName = "CardContent";
 const CardFooter = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div
    ref={ref}
    className={cn("flex items-center p-6 pt-0", className)}
    {...props}
  />
 ));
 CardFooter.displayName = "CardFooter";
 export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent };
--- a/frontend/src/components/ui/input.tsx
+++ b/frontend/src/components/ui/input.tsx
@ -0,0 +1,25 @@
 import * as React from "react";
 import { cn } from "@/lib/utils";
 export interface InputProps
  extends React.InputHTMLAttributes<HTMLInputElement> {}
 const Input = React.forwardRef<HTMLInputElement, InputProps>(
  ({ className, type, ...props }, ref) => {
    return (
      <input
        type={type}
        className={cn(
          "flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background file:border-0 file:bg-transparent file:text-sm file:font-medium placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-50",
          className
        )}
        ref={ref}
        {...props}
      />
    );
  }
 );
 Input.displayName = "Input";
 export { Input };
--- a/frontend/src/components/ui/label.tsx
+++ b/frontend/src/components/ui/label.tsx
@ -0,0 +1,26 @@
 "use client";
 import * as React from "react";
 import * as LabelPrimitive from "@radix-ui/react-label";
 import { cva, type VariantProps } from "class-variance-authority";
 import { cn } from "@/lib/utils";
 const labelVariants = cva(
  "text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
 );
 const Label = React.forwardRef<
  React.ElementRef<typeof LabelPrimitive.Root>,
  React.ComponentPropsWithoutRef<typeof LabelPrimitive.Root> &
    VariantProps<typeof labelVariants>
 >(({ className, ...props }, ref) => (
  <LabelPrimitive.Root
    ref={ref}
    className={cn(labelVariants(), className)}
    {...props}
  />
 ));
 Label.displayName = LabelPrimitive.Root.displayName;
 export { Label };
--- a/frontend/src/components/ui/separator.tsx
+++ b/frontend/src/components/ui/separator.tsx
@ -0,0 +1,31 @@
 "use client";
 import * as React from "react";
 import * as SeparatorPrimitive from "@radix-ui/react-separator";
 import { cn } from "@/lib/utils";
 const Separator = React.forwardRef<
  React.ElementRef<typeof SeparatorPrimitive.Root>,
  React.ComponentPropsWithoutRef<typeof SeparatorPrimitive.Root>
 >(
  (
    { className, orientation = "horizontal", decorative = true, ...props },
    ref
  ) => (
    <SeparatorPrimitive.Root
      ref={ref}
      decorative={decorative}
      orientation={orientation}
      className={cn(
        "shrink-0 bg-border",
        orientation === "horizontal" ? "h-[1px] w-full" : "h-full w-[1px]",
        className
      )}
      {...props}
    />
  )
 );
 Separator.displayName = SeparatorPrimitive.Root.displayName;
 export { Separator };
--- a/frontend/src/hooks/use-auth.tsx
+++ b/frontend/src/hooks/use-auth.tsx
@ -0,0 +1,129 @@
 "use client";
 import {
  createContext,
  useContext,
  useState,
  useEffect,
  ReactNode,
 } from "react";
 import { api, LoginResponse, UserResponse } from "@/lib/api";
 interface User {
  id: number;
  username: string;
  email: string;
 }
 interface AuthContextType {
  user: User | null;
  token: string | null;
  isLoading: boolean;
  login: (
    username: string,
    password: string
  ) => Promise<{ success: boolean; error?: string }>;
  signup: (
    username: string,
    email: string,
    password: string
  ) => Promise<{ success: boolean; error?: string }>;
  logout: () => Promise<void>;
  refreshUser: () => Promise<void>;
 }
 const AuthContext = createContext<AuthContextType | undefined>(undefined);
 export function AuthProvider({ children }: { children: ReactNode }) {
  const [user, setUser] = useState<User | null>(null);
  const [token, setToken] = useState<string | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  useEffect(() => {
    const storedToken = localStorage.getItem("token");
    if (storedToken) {
      setToken(storedToken);
      fetchUser(storedToken);
    } else {
      setIsLoading(false);
    }
  }, []);
  const fetchUser = async (accessToken?: string) => {
    const currentToken = accessToken || token;
    if (!currentToken) {
      setIsLoading(false);
      return;
    }
    const { data, error } = await api.getUser();
    if (data && !error) {
      setUser(data.user);
    } else {
      localStorage.removeItem("token");
      setToken(null);
      setUser(null);
    }
    setIsLoading(false);
  };
  const login = async (
    username: string,
    password: string
  ): Promise<{ success: boolean; error?: string }> => {
    const { data, error } = await api.login(username, password);
    if (error || !data) {
      return { success: false, error: error || "Login fehlgeschlagen" };
    }
    localStorage.setItem("token", data.access_token);
    setToken(data.access_token);
    setUser(data.user);
    return { success: true };
  };
  const signup = async (
    username: string,
    email: string,
    password: string
  ): Promise<{ success: boolean; error?: string }> => {
    const { data, error } = await api.signup(username, email, password);
    if (error || !data) {
      return { success: false, error: error || "Registrierung fehlgeschlagen" };
    }
    localStorage.setItem("token", data.access_token);
    setToken(data.access_token);
    setUser(data.user);
    return { success: true };
  };
  const logout = async () => {
    await api.logout();
    localStorage.removeItem("token");
    setToken(null);
    setUser(null);
  };
  const refreshUser = async () => {
    await fetchUser();
  };
  return (
    <AuthContext.Provider
      value={{ user, token, isLoading, login, signup, logout, refreshUser }}
    >
      {children}
    </AuthContext.Provider>
  );
 }
 export function useAuth() {
  const context = useContext(AuthContext);
  if (context === undefined) {
    throw new Error("useAuth must be used within an AuthProvider");
  }
  return context;
 }
--- a/frontend/tailwind.config.ts
+++ b/frontend/tailwind.config.ts
@ -0,0 +1,57 @@
 import type { Config } from "tailwindcss";
 const config: Config = {
  darkMode: ["class"],
  content: [
    "./src/pages/**/*.{js,ts,jsx,tsx,mdx}",
    "./src/components/**/*.{js,ts,jsx,tsx,mdx}",
    "./src/app/**/*.{js,ts,jsx,tsx,mdx}",
  ],
  theme: {
    extend: {
      colors: {
        border: "hsl(var(--border))",
        input: "hsl(var(--input))",
        ring: "hsl(var(--ring))",
        background: "hsl(var(--background))",
        foreground: "hsl(var(--foreground))",
        primary: {
          DEFAULT: "hsl(var(--primary))",
          foreground: "hsl(var(--primary-foreground))",
        },
        secondary: {
          DEFAULT: "hsl(var(--secondary))",
          foreground: "hsl(var(--secondary-foreground))",
        },
        destructive: {
          DEFAULT: "hsl(var(--destructive))",
          foreground: "hsl(var(--destructive-foreground))",
        },
        muted: {
          DEFAULT: "hsl(var(--muted))",
          foreground: "hsl(var(--muted-foreground))",
        },
        accent: {
          DEFAULT: "hsl(var(--accent))",
          foreground: "hsl(var(--accent-foreground))",
        },
        popover: {
          DEFAULT: "hsl(var(--popover))",
          foreground: "hsl(var(--popover-foreground))",
        },
        card: {
          DEFAULT: "hsl(var(--card))",
          foreground: "hsl(var(--card-foreground))",
        },
      },
      borderRadius: {
        lg: "var(--radius)",
        md: "calc(var(--radius) - 2px)",
        sm: "calc(var(--radius) - 4px)",
      },
    },
  },
  plugins: [],
 };
 export default config;
--- a/frontend/tsconfig.json
+++ b/frontend/tsconfig.json
@ -0,0 +1,26 @@
 {
  "compilerOptions": {
    "lib": ["dom", "dom.iterable", "esnext"],
    "allowJs": true,
    "skipLibCheck": true,
    "strict": true,
    "noEmit": true,
    "esModuleInterop": true,
    "module": "esnext",
    "moduleResolution": "bundler",
    "resolveJsonModule": true,
    "isolatedModules": true,
    "jsx": "preserve",
    "incremental": true,
    "plugins": [
      {
        "name": "next"
      }
    ],
    "paths": {
      "@/*": ["./src/*"]
    }
  },
  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
  "exclude": ["node_modules"]
 }
--- a/install.sh
+++ b/install.sh
@ -0,0 +1,313 @@
 #!/bin/bash
 set -e
 # ============================================================
 # Container Spawner - Installationsskript
 # https://gitea.iotxs.de/RainerWieland/spawner
 # ============================================================
 REPO_URL="https://gitea.iotxs.de/RainerWieland/spawner.git"
 RAW_URL="https://gitea.iotxs.de/RainerWieland/spawner/raw/branch/main"
 INSTALL_DIR="${PWD}"
 VERSION="0.1.0"
 # Farben fuer Output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 NC='\033[0m' # No Color
 echo ""
 echo "============================================================"
 echo "  Container Spawner Installation v${VERSION}"
 echo "============================================================"
 echo ""
 # ============================================================
 # 1. Pruefe .env
 # ============================================================
 if [ ! -f "${INSTALL_DIR}/.env" ]; then
    echo -e "${YELLOW}HINWEIS: Keine .env-Datei gefunden!${NC}"
    echo ""
    # Erstelle .env.example aus Repository
    echo "Lade .env.example herunter..."
    if command -v curl >/dev/null 2>&1; then
        curl -sSL "${RAW_URL}/.env.example" -o "${INSTALL_DIR}/.env.example"
    elif command -v wget >/dev/null 2>&1; then
        wget -q "${RAW_URL}/.env.example" -O "${INSTALL_DIR}/.env.example"
    else
        echo -e "${RED}Fehler: Weder curl noch wget gefunden!${NC}"
        exit 1
    fi
    echo -e "${GREEN}Vorlage erstellt: .env.example${NC}"
    echo ""
    echo "Naechste Schritte:"
    echo "  1. Kopiere die Vorlage:  cp .env.example .env"
    echo "  2. Passe die Werte an:   nano .env"
    echo "     - SECRET_KEY generieren (siehe Kommentar in .env)"
    echo "     - BASE_DOMAIN setzen"
    echo "     - TRAEFIK_NETWORK pruefen"
    echo "  3. Fuehre erneut aus:    bash install.sh"
    echo ""
    exit 0
 fi
 echo -e "${GREEN}.env-Datei gefunden${NC}"
 # Lade .env Variablen
 set -a
 source "${INSTALL_DIR}/.env"
 set +a
 # ============================================================
 # 2. Pruefe Voraussetzungen
 # ============================================================
 echo ""
 echo "Pruefe Voraussetzungen..."
 # Docker
 if ! command -v docker >/dev/null 2>&1; then
    echo -e "${RED}Fehler: Docker nicht gefunden!${NC}"
    echo "Installiere Docker: https://docs.docker.com/get-docker/"
    exit 1
 fi
 echo -e "  Docker:         ${GREEN}OK${NC}"
 # Docker Compose
 if command -v docker-compose >/dev/null 2>&1; then
    COMPOSE_CMD="docker-compose"
 elif docker compose version >/dev/null 2>&1; then
    COMPOSE_CMD="docker compose"
 else
    echo -e "${RED}Fehler: docker-compose nicht gefunden!${NC}"
    exit 1
 fi
 echo -e "  Docker Compose: ${GREEN}OK${NC} (${COMPOSE_CMD})"
 # Git
 if ! command -v git >/dev/null 2>&1; then
    echo -e "${RED}Fehler: Git nicht gefunden!${NC}"
    exit 1
 fi
 echo -e "  Git:            ${GREEN}OK${NC}"
 # ============================================================
 # 3. Pruefe ob bereits installiert (Update vs. Neuinstallation)
 # ============================================================
 echo ""
 if [ -d "${INSTALL_DIR}/.git" ]; then
    echo -e "${YELLOW}Update erkannt - hole neueste Aenderungen...${NC}"
    # Sichere lokale Aenderungen
    if ! git diff --quiet 2>/dev/null; then
        echo "Lokale Aenderungen gefunden, erstelle Stash..."
        git stash
    fi
    git fetch origin
    git pull origin main
    echo -e "${GREEN}Repository aktualisiert${NC}"
 else
    echo "Neuinstallation - klone Repository..."
    # Temporaeres Verzeichnis fuer Clone
    TEMP_DIR=$(mktemp -d)
    git clone "${REPO_URL}" "${TEMP_DIR}"
    # Kopiere Dateien (ueberschreibt nicht .env)
    shopt -s dotglob
    for item in "${TEMP_DIR}"/*; do
        basename_item=$(basename "$item")
        if [ "$basename_item" != ".env" ] && [ "$basename_item" != ".git" ]; then
            cp -r "$item" "${INSTALL_DIR}/"
        fi
    done
    # .git Verzeichnis kopieren fuer Updates
    cp -r "${TEMP_DIR}/.git" "${INSTALL_DIR}/"
    rm -rf "${TEMP_DIR}"
    echo -e "${GREEN}Repository geklont${NC}"
 fi
 # ============================================================
 # 4. Verzeichnisse und Rechte setzen
 # ============================================================
 echo ""
 echo "Setze Verzeichnisse und Berechtigungen..."
 # Verzeichnisse erstellen falls nicht vorhanden
 mkdir -p "${INSTALL_DIR}/data"
 mkdir -p "${INSTALL_DIR}/logs"
 # Berechtigungen setzen (rwx fuer Owner, rx fuer Group/Other)
 chmod 755 "${INSTALL_DIR}/data"
 chmod 755 "${INSTALL_DIR}/logs"
 # Fuer Docker: Verzeichnisse muessen vom Container beschreibbar sein
 # Option 1: Wenn Container als root laeuft (Standard) - 755 reicht
 # Option 2: Wenn Container als non-root laeuft - 777 oder chown noetig
 # Pruefen ob wir als root laufen (fuer chown)
 if [ "$(id -u)" = "0" ]; then
    # Als root: Owner auf aktuellen User setzen (oder Docker-User)
    # Standard: belassen wie es ist (root kann alles)
    echo -e "  data/:  ${GREEN}OK${NC} (755, root)"
    echo -e "  logs/:  ${GREEN}OK${NC} (755, root)"
 else
    # Als normaler User: Verzeichnisse muessen beschreibbar sein
    # Docker-Container laeuft meist als root, daher 755 ausreichend
    # Falls Container als non-root laeuft, auf 777 setzen:
    # chmod 777 "${INSTALL_DIR}/data" "${INSTALL_DIR}/logs"
    echo -e "  data/:  ${GREEN}OK${NC} (755)"
    echo -e "  logs/:  ${GREEN}OK${NC} (755)"
 fi
 # .env Datei schuetzen (nur Owner kann lesen/schreiben)
 if [ -f "${INSTALL_DIR}/.env" ]; then
    chmod 600 "${INSTALL_DIR}/.env"
    echo -e "  .env:   ${GREEN}OK${NC} (600, nur Owner)"
 fi
 # install.sh ausfuehrbar machen
 if [ -f "${INSTALL_DIR}/install.sh" ]; then
    chmod +x "${INSTALL_DIR}/install.sh"
 fi
 # ============================================================
 # 5. Docker-Netzwerk pruefen/erstellen
 # ============================================================
 echo ""
 NETWORK="${TRAEFIK_NETWORK:-web}"
 echo "Pruefe Docker-Netzwerk: ${NETWORK}"
 if docker network inspect "${NETWORK}" >/dev/null 2>&1; then
    echo -e "  Netzwerk '${NETWORK}': ${GREEN}existiert${NC}"
 else
    echo -e "  ${YELLOW}Netzwerk '${NETWORK}' nicht gefunden - erstelle...${NC}"
    docker network create "${NETWORK}"
    echo -e "  Netzwerk '${NETWORK}': ${GREEN}erstellt${NC}"
 fi
 # ============================================================
 # 6. Docker-Images bauen
 # ============================================================
 echo ""
 echo "Baue Docker-Images..."
 # Stoppe laufende Container
 ${COMPOSE_CMD} down 2>/dev/null || true
 # User-Template Image bauen (fuer User-Container)
 if [ -d "${INSTALL_DIR}/user-template" ]; then
    echo "  [1/4] Baue user-service-template (User-Container)..."
    if docker build --no-cache -t user-service-template:latest "${INSTALL_DIR}/user-template/" > /dev/null 2>&1; then
        echo -e "  user-service-template: ${GREEN}OK${NC}"
    else
        echo -e "  user-service-template: ${RED}FEHLER${NC}"
        echo "  Versuche mit detaillierter Ausgabe..."
        docker build --no-cache -t user-service-template:latest "${INSTALL_DIR}/user-template/"
        exit 1
    fi
 fi
 # User-Template-Next Image bauen (alternatives Template, optional)
 if [ -d "${INSTALL_DIR}/user-template-next" ]; then
    echo "  [2/4] Baue user-template-next (alternatives Template)..."
    if docker build -t user-template-next:latest "${INSTALL_DIR}/user-template-next/" > /dev/null 2>&1; then
        echo -e "  user-template-next: ${GREEN}OK${NC}"
    else
        echo -e "  user-template-next: ${YELLOW}WARNUNG - Build fehlgeschlagen (optional)${NC}"
    fi
 fi
 # Spawner Backend Image bauen
 echo "  [3/4] Baue Spawner API (Flask Backend)..."
 if docker build -t spawner:latest "${INSTALL_DIR}/" > /dev/null 2>&1; then
    echo -e "  spawner-api: ${GREEN}OK${NC}"
 else
    echo -e "  spawner-api: ${RED}FEHLER${NC}"
    docker build -t spawner:latest "${INSTALL_DIR}/"
    exit 1
 fi
 # Frontend Image bauen
 if [ -d "${INSTALL_DIR}/frontend" ]; then
    echo "  [4/4] Baue Frontend (Next.js)..."
    echo "        Dies kann einige Minuten dauern (npm install + build)..."
    if docker build -t spawner-frontend:latest "${INSTALL_DIR}/frontend/" 2>&1 | grep -E "(error|Error|ERROR)" > /dev/null; then
        echo -e "  spawner-frontend: ${RED}FEHLER${NC}"
        echo "  Versuche mit detaillierter Ausgabe..."
        docker build -t spawner-frontend:latest "${INSTALL_DIR}/frontend/"
        exit 1
    else
        docker build -t spawner-frontend:latest "${INSTALL_DIR}/frontend/" > /dev/null 2>&1
        echo -e "  spawner-frontend: ${GREEN}OK${NC}"
    fi
 fi
 echo ""
 echo "Alle Images erfolgreich gebaut."
 # ============================================================
 # 7. Container starten
 # ============================================================
 echo ""
 echo "Starte Container..."
 ${COMPOSE_CMD} up -d
 # Warte auf Health-Check
 echo ""
 echo "Warte auf Spawner-Start..."
 sleep 5
 # Health-Check fuer API
 SPAWNER_URL="http://localhost:${SPAWNER_PORT:-5000}/health"
 if curl -sf "${SPAWNER_URL}" >/dev/null 2>&1; then
    echo -e "  API Health-Check:      ${GREEN}OK${NC}"
 else
    echo -e "  API Health-Check:      ${YELLOW}Noch nicht bereit (normal beim ersten Start)${NC}"
 fi
 # Health-Check fuer Frontend
 if curl -sf "http://localhost:3000/" >/dev/null 2>&1; then
    echo -e "  Frontend Health-Check: ${GREEN}OK${NC}"
 else
    echo -e "  Frontend Health-Check: ${YELLOW}Noch nicht bereit (normal beim ersten Start)${NC}"
 fi
 # ============================================================
 # 8. Fertig
 # ============================================================
 echo ""
 echo "============================================================"
 echo -e "  ${GREEN}Installation abgeschlossen!${NC}"
 echo "============================================================"
 echo ""
 # URLs anzeigen
 SCHEME="https"
 if [ "${BASE_DOMAIN:-localhost}" = "localhost" ]; then
    SCHEME="http"
 fi
 FULL_URL="${SCHEME}://${SPAWNER_SUBDOMAIN:-coder}.${BASE_DOMAIN:-localhost}"
 echo "Zugriff:"
 echo "  Frontend:    ${FULL_URL}"
 echo "  API:         ${FULL_URL}/api"
 echo "  Health:      ${FULL_URL}/health"
 echo ""
 echo "Lokaler Zugriff (ohne Traefik):"
 echo "  API:         http://localhost:${SPAWNER_PORT:-5000}"
 echo "  Frontend:    http://localhost:3000"
 echo ""
 echo "Nuetzliche Befehle:"
 echo "  Status:      ${COMPOSE_CMD} ps"
 echo "  Logs API:    ${COMPOSE_CMD} logs -f spawner"
 echo "  Logs FE:     ${COMPOSE_CMD} logs -f frontend"
 echo "  Neustart:    ${COMPOSE_CMD} restart"
 echo "  Stoppen:     ${COMPOSE_CMD} down"
 echo ""
--- a/models.py
+++ b/models.py
@ -0,0 +1,21 @@
 from flask_sqlalchemy import SQLAlchemy
 from flask_login import UserMixin
 from werkzeug.security import generate_password_hash, check_password_hash
 from datetime import datetime
 db = SQLAlchemy()
 class User(UserMixin, db.Model):
    id = db.Column(db.Integer, primary_key=True)
    username = db.Column(db.String(80), unique=True, nullable=False)
    email = db.Column(db.String(120), unique=True, nullable=False)
    password_hash = db.Column(db.String(200), nullable=False)
    container_id = db.Column(db.String(100), nullable=True)
    container_port = db.Column(db.Integer, nullable=True)
    created_at = db.Column(db.DateTime, default=datetime.utcnow)
    def set_password(self, password):
        self.password_hash = generate_password_hash(password)
    def check_password(self, password):
        return check_password_hash(self.password_hash, password)
--- a/requirements.txt
+++ b/requirements.txt
@ -0,0 +1,12 @@
 flask==3.0.0
 flask-login==0.6.3
 flask-sqlalchemy==3.1.1
 flask-jwt-extended==4.6.0
 flask-cors==4.0.0
 werkzeug==3.0.1
 docker==6.1.0
 requests==2.28.0
 urllib3==1.26.12
 requests-unixsocket>=0.3.0
 PyJWT==2.8.0
 python-dotenv==1.0.0
--- a/user-template-next/.gitignore
+++ b/user-template-next/.gitignore
@ -0,0 +1,32 @@
 # Dependencies
 /node_modules
 /.pnp
 .pnp.js
 .yarn/install-state.gz
 # Testing
 /coverage
 # Next.js
 /.next/
 /out/
 # Production
 /build
 # Misc
 .DS_Store
 *.pem
 # Debug
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 # Local env files
 .env*.local
 .env
 # TypeScript
 *.tsbuildinfo
 next-env.d.ts
--- a/user-template-next/Dockerfile
+++ b/user-template-next/Dockerfile
@ -0,0 +1,30 @@
 # Build stage
 FROM node:20-alpine AS builder
 WORKDIR /app
 COPY package.json package-lock.json* ./
 RUN npm ci
 COPY . .
 RUN npm run build
 # Production stage - serve static files with nginx
 FROM nginx:alpine
 # Copy static export
 COPY --from=builder /app/out /usr/share/nginx/html
 # Nginx config for SPA
 RUN echo 'server { \
    listen 8080; \
    root /usr/share/nginx/html; \
    index index.html; \
    location / { \
        try_files $uri $uri/ /index.html; \
    } \
 }' > /etc/nginx/conf.d/default.conf
 EXPOSE 8080
 CMD ["nginx", "-g", "daemon off;"]
--- a/user-template-next/next.config.mjs
+++ b/user-template-next/next.config.mjs
@ -0,0 +1,10 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
  output: 'export',
  trailingSlash: true,
  images: {
    unoptimized: true,
  },
 };
 export default nextConfig;
--- a/user-template-next/package.json
+++ b/user-template-next/package.json
@ -0,0 +1,32 @@
 {
  "name": "user-template",
  "version": "1.0.0",
  "private": true,
  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "next start",
    "lint": "next lint"
  },
  "dependencies": {
    "next": "14.2.5",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "class-variance-authority": "^0.7.0",
    "clsx": "^2.1.1",
    "tailwind-merge": "^2.4.0",
    "lucide-react": "^0.408.0",
    "@radix-ui/react-slot": "^1.1.0"
  },
  "devDependencies": {
    "@types/node": "^20.14.10",
    "@types/react": "^18.3.3",
    "@types/react-dom": "^18.3.0",
    "autoprefixer": "^10.4.19",
    "eslint": "^8.57.0",
    "eslint-config-next": "14.2.5",
    "postcss": "^8.4.39",
    "tailwindcss": "^3.4.6",
    "typescript": "^5.5.3"
  }
 }
--- a/user-template-next/postcss.config.mjs
+++ b/user-template-next/postcss.config.mjs
@ -0,0 +1,9 @@
 /** @type {import('postcss-load-config').Config} */
 const config = {
  plugins: {
    tailwindcss: {},
    autoprefixer: {},
  },
 };
 export default config;
--- a/user-template-next/src/app/globals.css
+++ b/user-template-next/src/app/globals.css
@ -0,0 +1,51 @@
@tailwind base;
@tailwind components;
@tailwind utilities;
@layer base {
  :root {
    --background: 0 0% 100%;
    --foreground: 222.2 84% 4.9%;
    --card: 0 0% 100%;
    --card-foreground: 222.2 84% 4.9%;
    --primary: 221.2 83.2% 53.3%;
    --primary-foreground: 210 40% 98%;
    --secondary: 210 40% 96.1%;
    --secondary-foreground: 222.2 47.4% 11.2%;
    --muted: 210 40% 96.1%;
    --muted-foreground: 215.4 16.3% 46.9%;
    --accent: 210 40% 96.1%;
    --accent-foreground: 222.2 47.4% 11.2%;
    --border: 214.3 31.8% 91.4%;
    --input: 214.3 31.8% 91.4%;
    --ring: 221.2 83.2% 53.3%;
    --radius: 0.5rem;
  }
  .dark {
    --background: 222.2 84% 4.9%;
    --foreground: 210 40% 98%;
    --card: 222.2 84% 4.9%;
    --card-foreground: 210 40% 98%;
    --primary: 217.2 91.2% 59.8%;
    --primary-foreground: 222.2 47.4% 11.2%;
    --secondary: 217.2 32.6% 17.5%;
    --secondary-foreground: 210 40% 98%;
    --muted: 217.2 32.6% 17.5%;
    --muted-foreground: 215 20.2% 65.1%;
    --accent: 217.2 32.6% 17.5%;
    --accent-foreground: 210 40% 98%;
    --border: 217.2 32.6% 17.5%;
    --input: 217.2 32.6% 17.5%;
    --ring: 224.3 76.3% 48%;
  }
 }
@layer base {
  * {
    @apply border-border;
  }
  body {
    @apply bg-background text-foreground;
  }
 }
--- a/user-template-next/src/app/layout.tsx
+++ b/user-template-next/src/app/layout.tsx
@ -0,0 +1,22 @@
 import type { Metadata } from "next";
 import { Inter } from "next/font/google";
 import "./globals.css";
 const inter = Inter({ subsets: ["latin"] });
 export const metadata: Metadata = {
  title: "Mein Container",
  description: "Dein persoenlicher Container-Bereich",
 };
 export default function RootLayout({
  children,
 }: Readonly<{
  children: React.ReactNode;
 }>) {
  return (
    <html lang="de">
      <body className={inter.className}>{children}</body>
    </html>
  );
 }
--- a/user-template-next/src/app/page.tsx
+++ b/user-template-next/src/app/page.tsx
@ -0,0 +1,133 @@
 import {
  Card,
  CardContent,
  CardDescription,
  CardHeader,
  CardTitle,
 } from "@/components/ui/card";
 import { Button } from "@/components/ui/button";
 import { Container, Rocket, Code, Terminal } from "lucide-react";
 export default function Home() {
  return (
    <div className="min-h-screen bg-gradient-to-b from-background to-muted/50">
      {/* Header */}
      <header className="border-b bg-background/80 backdrop-blur-sm">
        <div className="container mx-auto flex h-16 items-center px-4">
          <div className="flex items-center gap-2">
            <Container className="h-6 w-6 text-primary" />
            <span className="text-lg font-semibold">Mein Container</span>
          </div>
        </div>
      </header>
      {/* Hero Section */}
      <main className="container mx-auto px-4 py-16">
        <div className="mx-auto max-w-3xl text-center">
          <div className="mb-6 inline-flex h-16 w-16 items-center justify-center rounded-full bg-primary/10">
            <Rocket className="h-8 w-8 text-primary" />
          </div>
          <h1 className="mb-4 text-4xl font-bold tracking-tight sm:text-5xl">
            Willkommen in deinem Container!
          </h1>
          <p className="mb-8 text-lg text-muted-foreground">
            Dies ist dein persoenlicher Bereich. Du kannst diese Seite anpassen
            und eigene Anwendungen deployen.
          </p>
        </div>
        {/* Feature Cards */}
        <div className="mx-auto mt-16 grid max-w-4xl gap-6 md:grid-cols-2">
          <Card>
            <CardHeader>
              <div className="mb-2 flex h-10 w-10 items-center justify-center rounded-lg bg-primary/10">
                <Code className="h-5 w-5 text-primary" />
              </div>
              <CardTitle>Entwicklung</CardTitle>
              <CardDescription>
                Starte hier mit deiner eigenen Anwendung
              </CardDescription>
            </CardHeader>
            <CardContent>
              <p className="text-sm text-muted-foreground">
                Dieses Template basiert auf Next.js und React. Du kannst es
                anpassen oder komplett ersetzen.
              </p>
            </CardContent>
          </Card>
          <Card>
            <CardHeader>
              <div className="mb-2 flex h-10 w-10 items-center justify-center rounded-lg bg-primary/10">
                <Terminal className="h-5 w-5 text-primary" />
              </div>
              <CardTitle>Technologie</CardTitle>
              <CardDescription>Moderne Tools fuer moderne Apps</CardDescription>
            </CardHeader>
            <CardContent>
              <ul className="space-y-2 text-sm text-muted-foreground">
                <li className="flex items-center gap-2">
                  <span className="h-1.5 w-1.5 rounded-full bg-primary" />
                  Next.js 14 mit App Router
                </li>
                <li className="flex items-center gap-2">
                  <span className="h-1.5 w-1.5 rounded-full bg-primary" />
                  TypeScript fuer Typsicherheit
                </li>
                <li className="flex items-center gap-2">
                  <span className="h-1.5 w-1.5 rounded-full bg-primary" />
                  Tailwind CSS fuer Styling
                </li>
                <li className="flex items-center gap-2">
                  <span className="h-1.5 w-1.5 rounded-full bg-primary" />
                  shadcn/ui Komponenten
                </li>
              </ul>
            </CardContent>
          </Card>
        </div>
        {/* CTA Section */}
        <div className="mx-auto mt-16 max-w-xl text-center">
          <Card className="bg-primary/5 border-primary/20">
            <CardContent className="pt-6">
              <h2 className="mb-2 text-xl font-semibold">Bereit loszulegen?</h2>
              <p className="mb-4 text-sm text-muted-foreground">
                Bearbeite die Dateien im Container, um diese Seite anzupassen.
              </p>
              <div className="flex justify-center gap-2">
                <Button variant="outline" asChild>
                  <a
                    href="https://nextjs.org/docs"
                    target="_blank"
                    rel="noopener noreferrer"
                  >
                    Next.js Docs
                  </a>
                </Button>
                <Button variant="outline" asChild>
                  <a
                    href="https://ui.shadcn.com"
                    target="_blank"
                    rel="noopener noreferrer"
                  >
                    shadcn/ui
                  </a>
                </Button>
              </div>
            </CardContent>
          </Card>
        </div>
      </main>
      {/* Footer */}
      <footer className="border-t mt-16">
        <div className="container mx-auto flex h-16 items-center justify-center px-4">
          <p className="text-sm text-muted-foreground">
            Container Spawner - Dein persoenlicher Entwicklungsbereich
          </p>
        </div>
      </footer>
    </div>
  );
 }
--- a/user-template-next/src/components/ui/button.tsx
+++ b/user-template-next/src/components/ui/button.tsx
@ -0,0 +1,56 @@
 import * as React from "react";
 import { Slot } from "@radix-ui/react-slot";
 import { cva, type VariantProps } from "class-variance-authority";
 import { cn } from "@/lib/utils";
 const buttonVariants = cva(
  "inline-flex items-center justify-center whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50",
  {
    variants: {
      variant: {
        default: "bg-primary text-primary-foreground hover:bg-primary/90",
        destructive:
          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
        outline:
          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
        secondary:
          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
        ghost: "hover:bg-accent hover:text-accent-foreground",
        link: "text-primary underline-offset-4 hover:underline",
      },
      size: {
        default: "h-10 px-4 py-2",
        sm: "h-9 rounded-md px-3",
        lg: "h-11 rounded-md px-8",
        icon: "h-10 w-10",
      },
    },
    defaultVariants: {
      variant: "default",
      size: "default",
    },
  }
 );
 export interface ButtonProps
  extends React.ButtonHTMLAttributes<HTMLButtonElement>,
    VariantProps<typeof buttonVariants> {
  asChild?: boolean;
 }
 const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
  ({ className, variant, size, asChild = false, ...props }, ref) => {
    const Comp = asChild ? Slot : "button";
    return (
      <Comp
        className={cn(buttonVariants({ variant, size, className }))}
        ref={ref}
        {...props}
      />
    );
  }
 );
 Button.displayName = "Button";
 export { Button, buttonVariants };
--- a/user-template-next/src/components/ui/card.tsx
+++ b/user-template-next/src/components/ui/card.tsx
@ -0,0 +1,79 @@
 import * as React from "react";
 import { cn } from "@/lib/utils";
 const Card = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div
    ref={ref}
    className={cn(
      "rounded-lg border bg-card text-card-foreground shadow-sm",
      className
    )}
    {...props}
  />
 ));
 Card.displayName = "Card";
 const CardHeader = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div
    ref={ref}
    className={cn("flex flex-col space-y-1.5 p-6", className)}
    {...props}
  />
 ));
 CardHeader.displayName = "CardHeader";
 const CardTitle = React.forwardRef<
  HTMLParagraphElement,
  React.HTMLAttributes<HTMLHeadingElement>
 >(({ className, ...props }, ref) => (
  <h3
    ref={ref}
    className={cn(
      "text-2xl font-semibold leading-none tracking-tight",
      className
    )}
    {...props}
  />
 ));
 CardTitle.displayName = "CardTitle";
 const CardDescription = React.forwardRef<
  HTMLParagraphElement,
  React.HTMLAttributes<HTMLParagraphElement>
 >(({ className, ...props }, ref) => (
  <p
    ref={ref}
    className={cn("text-sm text-muted-foreground", className)}
    {...props}
  />
 ));
 CardDescription.displayName = "CardDescription";
 const CardContent = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div ref={ref} className={cn("p-6 pt-0", className)} {...props} />
 ));
 CardContent.displayName = "CardContent";
 const CardFooter = React.forwardRef<
  HTMLDivElement,
  React.HTMLAttributes<HTMLDivElement>
 >(({ className, ...props }, ref) => (
  <div
    ref={ref}
    className={cn("flex items-center p-6 pt-0", className)}
    {...props}
  />
 ));
 CardFooter.displayName = "CardFooter";
 export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent };
--- a/user-template-next/tailwind.config.ts
+++ b/user-template-next/tailwind.config.ts
@ -0,0 +1,49 @@
 import type { Config } from "tailwindcss";
 const config: Config = {
  darkMode: ["class"],
  content: [
    "./src/pages/**/*.{js,ts,jsx,tsx,mdx}",
    "./src/components/**/*.{js,ts,jsx,tsx,mdx}",
    "./src/app/**/*.{js,ts,jsx,tsx,mdx}",
  ],
  theme: {
    extend: {
      colors: {
        border: "hsl(var(--border))",
        input: "hsl(var(--input))",
        ring: "hsl(var(--ring))",
        background: "hsl(var(--background))",
        foreground: "hsl(var(--foreground))",
        primary: {
          DEFAULT: "hsl(var(--primary))",
          foreground: "hsl(var(--primary-foreground))",
        },
        secondary: {
          DEFAULT: "hsl(var(--secondary))",
          foreground: "hsl(var(--secondary-foreground))",
        },
        muted: {
          DEFAULT: "hsl(var(--muted))",
          foreground: "hsl(var(--muted-foreground))",
        },
        accent: {
          DEFAULT: "hsl(var(--accent))",
          foreground: "hsl(var(--accent-foreground))",
        },
        card: {
          DEFAULT: "hsl(var(--card))",
          foreground: "hsl(var(--card-foreground))",
        },
      },
      borderRadius: {
        lg: "var(--radius)",
        md: "calc(var(--radius) - 2px)",
        sm: "calc(var(--radius) - 4px)",
      },
    },
  },
  plugins: [],
 };
 export default config;
--- a/user-template-next/tsconfig.json
+++ b/user-template-next/tsconfig.json
@ -0,0 +1,26 @@
 {
  "compilerOptions": {
    "lib": ["dom", "dom.iterable", "esnext"],
    "allowJs": true,
    "skipLibCheck": true,
    "strict": true,
    "noEmit": true,
    "esModuleInterop": true,
    "module": "esnext",
    "moduleResolution": "bundler",
    "resolveJsonModule": true,
    "isolatedModules": true,
    "jsx": "preserve",
    "incremental": true,
    "plugins": [
      {
        "name": "next"
      }
    ],
    "paths": {
      "@/*": ["./src/*"]
    }
  },
  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
  "exclude": ["node_modules"]
 }
--- a/user-template/Dockerfile
+++ b/user-template/Dockerfile
@ -0,0 +1,23 @@
 FROM nginxinc/nginx-unprivileged:alpine
 # Wechsel zu root um Pakete zu installieren
 USER root
 # gettext für envsubst installieren
 RUN apk add --no-cache gettext
 # HTML-Template kopieren
 COPY index.html /usr/share/nginx/html/index.html.template
 # Nginx-Konfiguration kopieren
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 # Entrypoint Script kopieren und executable machen
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh && \
    chmod 777 /usr/share/nginx/html
 EXPOSE 8080
 # Entrypoint Script starten (läuft als root, startet Nginx)
 ENTRYPOINT ["/entrypoint.sh"]
--- a/user-template/entrypoint.sh
+++ b/user-template/entrypoint.sh
@ -0,0 +1,8 @@
 #!/bin/sh
 set -e
 # Umgebungsvariablen in die HTML-Datei einfügen
 envsubst < /usr/share/nginx/html/index.html.template > /usr/share/nginx/html/index.html
 # Nginx starten
 exec nginx -g "daemon off;"
--- a/user-template/index.html
+++ b/user-template/index.html
--- a/user-template/nginx.conf
+++ b/user-template/nginx.conf
@ -0,0 +1,15 @@
 server {
    listen 8080;
    server_name _;
    # Root-Verzeichnis
    root /usr/share/nginx/html;
    # Alle Anfragen einfach auf root Location
    location / {
        try_files $uri $uri/ /index.html;
    }
    # Error pages
    error_page 404 /index.html;
 }