chore: bump version to 1.0.22

fix: relax password requirements and improve password UI
- Reduce minimum password length from 12 to 8 characters - Make special characters optional for gallery passwords - Lower strength requirement from score 3 to 1 for galleries - Add eye icon toggle for password visibility on each field - Remove redundant 'Show passwords' checkbox - Add translation for password security requirements error - Update both English and German translations This allows users to use simpler passwords like 'Sommer2025\!' for events while maintaining security through other measures like expiration dates. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-14 12:10:51 +00:00 · 2025-07-14 14:06:18 +02:00 · 2025-07-14 11:13:23 +00:00 · 2025-07-14 13:09:24 +02:00 · 2025-07-14 10:08:49 +00:00 · 2025-07-14 12:04:57 +02:00
37 changed files with 4551 additions and 115 deletions
@@ -0,0 +1,286 @@
+# Security Scan Report - Wedding Photo Sharing Application
+**Date**: July 13, 2025  
+**Scanner**: Claude Security Audit with --security --validate flags  
+**Overall Risk Level**: MEDIUM-HIGH  
+
+## Executive Summary
+
+The wedding photo sharing application demonstrates strong security fundamentals with comprehensive input validation, proper authentication mechanisms, and good file security practices. However, several critical issues require immediate attention, particularly around hardcoded secrets, token storage, and Content Security Policy configuration.
+
+### Security Score: 6.5/10
+
+**Strengths**: Excellent input validation, parameterized queries, file security, rate limiting  
+**Critical Issues**: Hardcoded JWT secrets, localStorage token storage, weak CSP, console logging in production
+
+---
+
+## 🔴 CRITICAL FINDINGS (Immediate Action Required)
+
+### 1. Hardcoded JWT Secret in Development
+- **Location**: Backend `.env` file
+- **Risk**: Token forgery, authentication bypass
+- **Impact**: Complete authentication compromise
+- **Remediation**: 
+  ```bash
+  # Generate secure secret
+  openssl rand -base64 32
+  # Never commit to repository
+  echo ".env" >> .gitignore
+  ```
+
+### 2. Gallery Tokens in localStorage
+- **Location**: Frontend `api.ts` and auth contexts
+- **Risk**: XSS token theft
+- **Impact**: Gallery access compromise
+- **Remediation**: Move to httpOnly cookies:
+  ```typescript
+  Cookies.set(`gallery_token_${slug}`, token, {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict'
+  });
+  ```
+
+### 3. Weak Content Security Policy
+- **Location**: Frontend `nginx.conf`
+- **Risk**: XSS, code injection
+- **Current**: `unsafe-inline` and `unsafe-eval` allowed
+- **Remediation**: Implement strict CSP (see detailed recommendations below)
+
+---
+
+## 🟠 HIGH SEVERITY FINDINGS
+
+### 1. Console Logging in Production
+- **Locations**: 61 instances across frontend
+- **Risk**: Information disclosure
+- **Impact**: Leaking sensitive data, debugging info
+- **Remediation**: Implement environment-aware logging
+
+### 2. Token Revocation Vulnerability
+- **Location**: Backend `tokenRevocation.js`
+- **Risk**: Token manipulation
+- **Impact**: Bypass revocation checks
+- **Remediation**: Verify token signature before decoding
+
+### 3. Source Maps in Production
+- **Location**: Frontend build configuration
+- **Risk**: Source code exposure
+- **Impact**: Reveals application structure
+- **Remediation**: Disable in production builds
+
+### 4. Missing Security Headers
+- **Location**: nginx configuration
+- **Missing**: HSTS, Permissions-Policy
+- **Impact**: Various client-side attacks
+- **Remediation**: Add comprehensive security headers
+
+---
+
+## 🟡 MEDIUM SEVERITY FINDINGS
+
+### 1. Rate Limiting Bypass Potential
+- **Location**: Backend rate limiter
+- **Risk**: DoS attacks
+- **Current**: JWT validation in rate limiter
+- **Remediation**: Use IP-based limiting only
+
+### 2. Incomplete SQL Injection Protection
+- **Location**: Complex dashboard queries
+- **Risk**: Potential injection in edge cases
+- **Current**: Mostly parameterized
+- **Remediation**: Use query builder exclusively
+
+### 3. Session Management
+- **Issue**: No gallery token invalidation on password change
+- **Risk**: Persistent access after compromise
+- **Remediation**: Implement token revocation
+
+### 4. Path Traversal in Gallery Slugs
+- **Location**: Frontend gallery routes
+- **Risk**: Directory traversal attempts
+- **Remediation**: Validate and sanitize slugs
+
+---
+
+## 🟢 LOW SEVERITY FINDINGS
+
+### 1. Verbose Error Messages
+- **Location**: Multiple API endpoints
+- **Risk**: Information disclosure
+- **Remediation**: Generic client errors, detailed server logs
+
+### 2. Weak Gallery Passwords
+- **Current**: zxcvbn score 2/4 allowed
+- **Risk**: Brute force attacks
+- **Remediation**: Increase to score 3/4
+
+### 3. Missing File Size Validation
+- **Location**: Frontend upload components
+- **Risk**: DoS via large uploads
+- **Remediation**: Add client-side size checks
+
+---
+
+## ✅ SECURITY STRENGTHS
+
+### Authentication & Authorization
+- JWT with proper expiration (24h/7d)
+- Token type validation
+- IP tracking and validation
+- Password change detection
+- Token revocation system
+- Bcrypt with 12 rounds
+- zxcvbn password strength checking
+
+### Input Validation & SQL Security
+- express-validator on all endpoints
+- Parameterized queries via Knex
+- SQL injection protection utilities
+- Path traversal prevention
+- Comprehensive input sanitization
+
+### File Security
+- Magic number verification
+- MIME type validation
+- Safe filename generation
+- Directory traversal protection
+- File extension whitelist
+
+### Rate Limiting & DoS Protection
+- General: 100 req/15min
+- Auth endpoints: 5 req/15min
+- Account lockout after failed attempts
+- Suspicious activity detection
+
+### Frontend Security
+- React's built-in XSS protection
+- DOMPurify for HTML content
+- No eval() or innerHTML usage
+- Proper error boundaries
+- ReCAPTCHA integration
+
+---
+
+## 📊 DEPENDENCY ANALYSIS
+
+### Current Status
+- **Backend**: 0 vulnerabilities (691 packages)
+- **Frontend**: 0 vulnerabilities (434 packages)
+
+### Recommended Updates
+1. **bcrypt** 5.1.1 → 6.0.0 (performance, compatibility)
+2. **helmet** 7.2.0 → 8.1.0 (new security features)
+3. **@tiptap** 2.x → 3.x (security improvements)
+
+### Supply Chain Assessment
+- All major dependencies from trusted sources
+- No typosquatting detected
+- Regular maintenance observed
+- MIT/ISC/Apache licenses only
+
+---
+
+## 🛠️ REMEDIATION PLAN
+
+### Phase 1: Critical (Within 24 hours)
+1. Replace hardcoded JWT secret with secure random value
+2. Move gallery tokens from localStorage to httpOnly cookies
+3. Implement strict CSP without unsafe-eval
+4. Remove or wrap console.log statements
+
+### Phase 2: High Priority (Within 1 week)
+1. Disable source maps in production
+2. Add missing security headers (HSTS, Permissions-Policy)
+3. Fix token revocation vulnerability
+4. Update critical dependencies (bcrypt, helmet)
+
+### Phase 3: Medium Priority (Within 1 month)
+1. Implement comprehensive logging strategy
+2. Add gallery slug validation
+3. Enhance rate limiting logic
+4. Implement session invalidation on password change
+
+### Phase 4: Ongoing
+1. Weekly dependency scanning
+2. Implement security testing in CI/CD
+3. Regular penetration testing
+4. Security awareness training
+
+---
+
+## 🔒 RECOMMENDED CSP CONFIGURATION
+
+```nginx
+add_header Content-Security-Policy "
+  default-src 'self';
+  script-src 'self' 'nonce-{RANDOM}' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/;
+  style-src 'self' 'unsafe-inline';
+  img-src 'self' data: blob: https:;
+  font-src 'self';
+  connect-src 'self' https://analytics.domain.com;
+  frame-src https://www.google.com/recaptcha/;
+  object-src 'none';
+  base-uri 'self';
+  form-action 'self';
+  frame-ancestors 'none';
+  upgrade-insecure-requests;
+" always;
+```
+
+---
+
+## 🚀 SECURITY IMPROVEMENTS ROADMAP
+
+### Immediate Implementation
+```bash
+# 1. Generate secure secrets
+openssl rand -base64 32 > jwt-secret.txt
+
+# 2. Update dependencies
+cd backend && npm install bcrypt@^6.0.0 helmet@^8.1.0
+cd ../frontend && npm update
+
+# 3. Add security scanning
+npm install -D npm-audit-resolver
+```
+
+### CI/CD Integration
+```yaml
+# Add to CI pipeline
+- name: Security Scan
+  run: |
+    npm audit --audit-level=moderate
+    npm run test:security
+```
+
+### Monitoring & Alerting
+1. Implement fail2ban for repeated auth failures
+2. Set up log analysis for suspicious patterns
+3. Configure alerts for security events
+4. Regular vulnerability scanning
+
+---
+
+## 📋 COMPLIANCE CHECKLIST
+
+- [ ] OWASP Top 10 addressed
+- [ ] GDPR compliance (data minimization, right to erasure)
+- [ ] Security headers implemented
+- [ ] Dependency scanning automated
+- [ ] Incident response plan documented
+- [ ] Security documentation maintained
+- [ ] Regular security reviews scheduled
+
+---
+
+## 🎯 CONCLUSION
+
+The wedding photo sharing application has a solid security foundation with excellent input validation and authentication mechanisms. However, operational security practices need immediate attention. The critical issues around secret management and token storage must be addressed before production deployment.
+
+Implementing the recommended fixes will raise the security score from 6.5/10 to approximately 8.5/10, providing a robust and secure platform for wedding photo sharing.
+
+---
+
+*Generated by Claude Security Scanner v1.0*  
+*Next scan recommended: After Phase 1 remediation completion*
@@ -0,0 +1,92 @@
+# Deployment Guide - Traefik Production Setup
+
+## Overview
+
+This guide explains how to deploy PicPeak with an external Traefik reverse proxy for production use.
+
+## Fixed Issues
+
+1. **Database Migration**: Added missing `created_at` column to `email_queue` table
+2. **502 Bad Gateway**: Properly configured Traefik routing and backend accessibility
+3. **Health Checks**: Fixed health check endpoint imports and paths
+
+## Deployment Steps
+
+### 1. Update Environment Variables
+
+Ensure your `.env` file has the correct URLs:
+```bash
+ADMIN_URL=https://picpeak.nothaft.cloud
+FRONTEND_URL=https://picpeak.nothaft.cloud
+```
+
+### 2. Build Images
+
+```bash
+# Build backend image
+docker build -t picpeak-backend:latest ./backend
+
+# Build frontend image  
+docker build -t picpeak-frontend:latest ./frontend \
+  --build-arg VITE_API_URL=/api \
+  --build-arg VITE_UMAMI_URL=${VITE_UMAMI_URL} \
+  --build-arg VITE_UMAMI_WEBSITE_ID=${VITE_UMAMI_WEBSITE_ID}
+```
+
+### 3. Deploy with Traefik
+
+Use the new Traefik-specific compose file:
+```bash
+docker-compose -f docker-compose.traefik.yml up -d
+```
+
+### 4. Verify Deployment
+
+Check that all services are healthy:
+```bash
+# Check container status
+docker-compose -f docker-compose.traefik.yml ps
+
+# Check backend health
+curl https://picpeak.nothaft.cloud/api/health
+
+# Check logs
+docker-compose -f docker-compose.traefik.yml logs -f backend
+```
+
+## Key Differences from Standard Deployment
+
+1. **No Internal Nginx**: Traefik handles all routing externally
+2. **API Path Stripping**: Traefik strips `/api` prefix when forwarding to backend
+3. **Network Configuration**: Services join external `traefik` network
+4. **Health Checks**: Backend exposes `/health` endpoint (not `/api/health`)
+
+## Why CI/CD Tests Pass But Production Fails
+
+CI/CD tests typically:
+- Use in-memory or temporary databases with fresh migrations
+- Don't test through reverse proxy (direct API calls)
+- Don't run background services (email processor, etc.)
+- Have different network configurations
+
+Production environment has:
+- Persistent database that may have migration state issues
+- Reverse proxy routing complexity
+- All background services running
+- Different security and network constraints
+
+## Troubleshooting
+
+### 502 Bad Gateway
+- Check Traefik network connectivity: `docker network ls`
+- Verify backend is in traefik network: `docker inspect picpeak-backend`
+- Check Traefik logs: `docker logs traefik`
+
+### Database Issues
+- Connect to database: `docker exec -it picpeak-db psql -U picpeak`
+- Check migration status: `SELECT * FROM migrations;`
+- Run migrations manually: `docker exec -it picpeak-backend npm run migrate:safe`
+
+### Email Service Errors
+- Check email queue: `SELECT * FROM email_queue ORDER BY created_at DESC LIMIT 10;`
+- Monitor email processor: `docker logs picpeak-backend | grep "email"`
@@ -0,0 +1,134 @@
+# Traefik Troubleshooting Guide
+
+## Common Issues and Solutions
+
+### 1. 404 Errors on API Routes
+
+**Problem**: Getting 404 errors when accessing `/api/*` routes
+
+**Causes**:
+- Traefik routing rules not properly configured
+- Backend container not healthy
+- Path stripping not working correctly
+
+**Solutions**:
+
+1. **Check container health**:
+```bash
+docker ps # Check if backend is running
+docker logs picpeak-backend # Check for startup errors
+```
+
+2. **Test backend directly**:
+```bash
+# Access backend container
+docker exec -it picpeak-backend sh
+
+# Test health endpoint
+wget -O- http://localhost:3000/health
+
+# Test public settings endpoint
+wget -O- http://localhost:3000/public/settings
+```
+
+3. **Check Traefik routing**:
+```bash
+# Check if routes are registered in Traefik
+curl https://traefik.yourdomain.com/api/http/routers | jq '.[] | select(.rule | contains("picpeak"))'
+```
+
+### 2. Backend Not Accessible Through Traefik
+
+**Key Configuration Points**:
+
+1. **Traefik Labels** (in deploy section):
+   - `traefik.enable=true` - Enable Traefik for this container
+   - `traefik.docker.network=proxy` - Specify which network Traefik should use
+   - `traefik.http.routers.picpeak-backend.priority=100` - Higher priority for API routes
+
+2. **Path Stripping**:
+   - Frontend expects `/api/*` but backend serves routes without `/api` prefix
+   - Middleware strips `/api` before forwarding to backend
+
+3. **Network Configuration**:
+   - Backend must be in both `picpeak` (internal) and `proxy` (Traefik) networks
+
+### 3. Environment Variable Issues
+
+**Critical Variables**:
+- `ADMIN_URL` and `FRONTEND_URL` must match your actual domain
+- These affect CORS configuration
+
+**Example .env**:
+```env
+# URLs
+ADMIN_URL=https://picpeak.local.nothaft.cloud
+FRONTEND_URL=https://picpeak.local.nothaft.cloud
+
+# Database
+DB_USER=picpeak
+DB_PASSWORD=your_secure_password
+DB_NAME=picpeak
+
+# JWT
+JWT_SECRET=your_secure_jwt_secret
+
+# Email (optional)
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=true
+SMTP_USER=noreply@example.com
+SMTP_PASS=smtp_password
+EMAIL_FROM=noreply@example.com
+```
+
+### 4. Debugging Steps
+
+1. **Check if backend is receiving requests**:
+```bash
+# Watch backend logs
+docker logs -f picpeak-backend
+
+# Look for incoming requests when you try to access the admin page
+```
+
+2. **Test API routes directly**:
+```bash
+# From outside
+curl -v https://picpeak.local.nothaft.cloud/api/public/settings
+
+# Should see backend logs if request reaches container
+```
+
+3. **Verify Traefik middleware**:
+```bash
+# Check if stripprefix middleware exists
+curl https://traefik.yourdomain.com/api/http/middlewares | jq '.[] | select(.name | contains("picpeak"))'
+```
+
+### 5. Quick Fix Checklist
+
+- [ ] Backend container is healthy (`docker ps`)
+- [ ] Backend is in both networks (`docker inspect picpeak-backend | grep -A 20 Networks`)
+- [ ] Traefik labels use correct network (`traefik.docker.network=proxy`)
+- [ ] Priority is set correctly (backend: 100, frontend: 10)
+- [ ] ADMIN_URL and FRONTEND_URL match your domain
+- [ ] Database is accessible from backend
+- [ ] Migrations have run successfully
+
+### 6. Alternative Testing
+
+If Traefik routing is problematic, test backend directly:
+
+```bash
+# Port forward to test backend directly
+docker run --rm -it --network picpeak alpine/curl curl http://backend:3000/health
+
+# Or expose backend port temporarily
+docker run -d --name picpeak-backend-test \
+  --network picpeak \
+  -p 3001:3000 \
+  registry.local.nothaft.cloud/picpeak-backend:latest
+```
+
+Then access http://localhost:3001/health to verify backend is working.
@@ -0,0 +1,22 @@
+{
+  "auditReportVersion": 2,
+  "vulnerabilities": {},
+  "metadata": {
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 0,
+      "high": 0,
+      "critical": 0,
+      "total": 0
+    },
+    "dependencies": {
+      "prod": 329,
+      "dev": 307,
+      "optional": 54,
+      "peer": 1,
+      "peerOptional": 0,
+      "total": 690
+    }
+  }
+}
@@ -32,15 +32,27 @@ const config = {
      user: process.env.DB_USER || 'picpeak',
      password: process.env.DB_PASSWORD,
      database: process.env.DB_NAME || 'picpeak',
-      ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false
+      ssl: process.env.DB_SSL === 'true' ? { rejectUnauthorized: false } : false,
+      // Connection stability settings
+      connectionTimeoutMillis: 30000,
+      idleTimeoutMillis: 30000,
+      keepAlive: true,
+      keepAliveInitialDelayMillis: 0
    },
    pool: {
      min: 2,
-      max: 10
+      max: 10,
+      acquireTimeoutMillis: 30000,
+      createTimeoutMillis: 30000,
+      idleTimeoutMillis: 30000,
+      reapIntervalMillis: 1000,
+      createRetryIntervalMillis: 200,
+      propagateCreateError: false
    },
    migrations: {
      directory: './migrations'
-    }
+    },
+    acquireConnectionTimeout: 60000
  }
 };

@@ -0,0 +1,23 @@
+exports.up = async function(knex) {
+  // Check if created_at column already exists
+  const hasCreatedAt = await knex.schema.hasColumn('email_queue', 'created_at');
+  
+  if (!hasCreatedAt) {
+    await knex.schema.table('email_queue', (table) => {
+      table.datetime('created_at').defaultTo(knex.fn.now());
+    });
+    
+    // Update existing rows to have a created_at value based on scheduled_at
+    await knex('email_queue')
+      .whereNull('created_at')
+      .update({
+        created_at: knex.ref('scheduled_at')
+      });
+  }
+};
+
+exports.down = async function(knex) {
+  await knex.schema.table('email_queue', (table) => {
+    table.dropColumn('created_at');
+  });
+};
@@ -0,0 +1,35 @@
+exports.up = async function(knex) {
+  // Check current column structure
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  
+  if (hasSubjectEn && !hasSubject) {
+    // The language migration was applied, need to add back basic columns
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.string('subject');
+      table.text('body_html');
+      table.text('body_text');
+    });
+    
+    // Copy English values to the basic columns
+    await knex('email_templates').update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+  }
+};
+
+exports.down = async function(knex) {
+  // Check if we have the basic columns
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  
+  if (hasSubject && hasSubjectEn) {
+    await knex.schema.alterTable('email_templates', function(table) {
+      table.dropColumn('subject');
+      table.dropColumn('body_html');
+      table.dropColumn('body_text');
+    });
+  }
+};
@@ -0,0 +1,91 @@
+exports.up = async function(knex) {
+  // Check if we have the default email templates
+  const templates = await knex('email_templates').select('template_key');
+  const existingKeys = templates.map(t => t.template_key);
+  
+  // Check which columns exist in the table
+  const hasSubjectEn = await knex.schema.hasColumn('email_templates', 'subject_en');
+  const hasSubject = await knex.schema.hasColumn('email_templates', 'subject');
+  
+  // Determine which columns to use based on schema
+  const subjectCol = hasSubjectEn ? 'subject_en' : 'subject';
+  const bodyHtmlCol = hasSubjectEn ? 'body_html_en' : 'body_html';
+  const bodyTextCol = hasSubjectEn ? 'body_text_en' : 'body_text';
+  
+  const defaultTemplates = [
+    {
+      template_key: 'gallery_created',
+      [subjectCol]: 'Your Photo Gallery is Ready!',
+      [bodyHtmlCol]: `<h2>Gallery Created Successfully</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been created successfully!</p>
+<p><strong>Gallery Details:</strong></p>
+<ul>
+  <li>Event Date: {{event_date}}</li>
+  <li>Gallery Link: {{gallery_link}}</li>
+  <li>Password: {{gallery_password}}</li>
+  <li>Expires: {{expiry_date}}</li>
+</ul>
+<p>Share this link and password with your guests to allow them to view and download photos.</p>`,
+      [bodyTextCol]: 'Gallery Created Successfully\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been created successfully!',
+      variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+    },
+    {
+      template_key: 'expiration_warning',
+      [subjectCol]: 'Your Photo Gallery Expires Soon',
+      [bodyHtmlCol]: `<h2>Gallery Expiring Soon</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p>
+<p>After expiration, the gallery will be archived and no longer accessible to guests.</p>
+<p><a href="{{gallery_link}}">Visit Gallery</a></p>`,
+      [bodyTextCol]: 'Gallery Expiring Soon\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" will expire in {{days_remaining}} days.',
+      variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+    },
+    {
+      template_key: 'gallery_expired',
+      [subjectCol]: 'Your Photo Gallery Has Expired',
+      [bodyHtmlCol]: `<h2>Gallery Expired</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has expired and been archived.</p>
+<p>The photos are safely stored in our archive system. If you need access to the archived photos, please contact support.</p>`,
+      [bodyTextCol]: 'Gallery Expired\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has expired and been archived.',
+      variables: JSON.stringify(['host_name', 'event_name'])
+    },
+    {
+      template_key: 'archive_complete',
+      [subjectCol]: 'Gallery Archive Complete',
+      [bodyHtmlCol]: `<h2>Archive Complete</h2>
+<p>Dear {{host_name}},</p>
+<p>Your photo gallery "{{event_name}}" has been successfully archived.</p>
+<p>Archive size: {{archive_size}}</p>
+<p>The archive is stored securely and can be retrieved if needed.</p>`,
+      [bodyTextCol]: 'Archive Complete\n\nDear {{host_name}},\n\nYour photo gallery "{{event_name}}" has been successfully archived.',
+      variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+    }
+  ];
+  
+  // Insert missing templates
+  for (const template of defaultTemplates) {
+    if (!existingKeys.includes(template.template_key)) {
+      // If we have language columns, also set German versions with same content
+      if (hasSubjectEn) {
+        template.subject_de = template[subjectCol];
+        template.body_html_de = template[bodyHtmlCol];
+        template.body_text_de = template[bodyTextCol];
+        
+        // Also ensure we have the basic columns if they exist
+        if (hasSubject) {
+          template.subject = template[subjectCol];
+          template.body_html = template[bodyHtmlCol];
+          template.body_text = template[bodyTextCol];
+        }
+      }
+      
+      await knex('email_templates').insert(template);
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Don't remove templates on rollback as they might have been customized
+};
@@ -0,0 +1,121 @@
+exports.up = async function(knex) {
+  // Check if CMS pages already exist
+  const impressumExists = await knex('cms_pages')
+    .where('slug', 'impressum')
+    .first();
+    
+  const datenschutzExists = await knex('cms_pages')
+    .where('slug', 'datenschutz')
+    .first();
+  
+  const pagesToInsert = [];
+  
+  // Add Impressum page if it doesn't exist
+  if (!impressumExists) {
+    pagesToInsert.push({
+      slug: 'impressum',
+      title_en: 'Legal Notice',
+      title_de: 'Impressum',
+      content_en: `<h1>Legal Notice</h1>
+<p>Information according to § 5 TMG</p>
+
+<h2>Responsible for content</h2>
+<p>[Your Name]<br>
+[Your Address]<br>
+[Postal Code City]</p>
+
+<h2>Contact</h2>
+<p>Email: [Your Email Address]<br>
+Phone: [Your Phone Number]</p>
+
+<h2>Disclaimer</h2>
+<h3>Liability for content</h3>
+<p>The contents of our pages were created with great care. However, we cannot guarantee the accuracy, completeness and timeliness of the content.</p>
+
+<h3>Liability for links</h3>
+<p>Our website contains links to external third-party websites over whose content we have no influence. Therefore, we cannot accept any liability for this third-party content.</p>`,
+      content_de: `<h1>Impressum</h1>
+<p>Angaben gemäß § 5 TMG</p>
+
+<h2>Verantwortlich für den Inhalt</h2>
+<p>[Ihr Name]<br>
+[Ihre Adresse]<br>
+[PLZ Ort]</p>
+
+<h2>Kontakt</h2>
+<p>E-Mail: [Ihre E-Mail-Adresse]<br>
+Telefon: [Ihre Telefonnummer]</p>
+
+<h2>Haftungsausschluss</h2>
+<h3>Haftung für Inhalte</h3>
+<p>Die Inhalte unserer Seiten wurden mit größter Sorgfalt erstellt. Für die Richtigkeit, Vollständigkeit und Aktualität der Inhalte können wir jedoch keine Gewähr übernehmen.</p>
+
+<h3>Haftung für Links</h3>
+<p>Unser Angebot enthält Links zu externen Webseiten Dritter, auf deren Inhalte wir keinen Einfluss haben. Deshalb können wir für diese fremden Inhalte auch keine Gewähr übernehmen.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Add Datenschutz page if it doesn't exist
+  if (!datenschutzExists) {
+    pagesToInsert.push({
+      slug: 'datenschutz',
+      title_en: 'Privacy Policy',
+      title_de: 'Datenschutzerklärung',
+      content_en: `<h1>Privacy Policy</h1>
+
+<h2>1. Privacy at a Glance</h2>
+<h3>General Information</h3>
+<p>The following information provides a simple overview of what happens to your personal data when you visit this website.</p>
+
+<h3>Data Collection on This Website</h3>
+<p><strong>Who is responsible for data collection on this website?</strong></p>
+<p>Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice of this website.</p>
+
+<p><strong>How do we collect your data?</strong></p>
+<p>Your data is collected when you provide it to us. This could be data that you enter into a contact form, for example.</p>
+
+<p><strong>What do we use your data for?</strong></p>
+<p>Some of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior.</p>
+
+<h2>2. Hosting</h2>
+<p>This website is hosted externally. The personal data collected on this website is stored on the servers of the host.</p>
+
+<h2>3. General Information and Mandatory Information</h2>
+<h3>Data Protection</h3>
+<p>The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.</p>`,
+      content_de: `<h1>Datenschutzerklärung</h1>
+
+<h2>1. Datenschutz auf einen Blick</h2>
+<h3>Allgemeine Hinweise</h3>
+<p>Die folgenden Hinweise geben einen einfachen Überblick darüber, was mit Ihren personenbezogenen Daten passiert, wenn Sie diese Website besuchen.</p>
+
+<h3>Datenerfassung auf dieser Website</h3>
+<p><strong>Wer ist verantwortlich für die Datenerfassung auf dieser Website?</strong></p>
+<p>Die Datenverarbeitung auf dieser Website erfolgt durch den Websitebetreiber. Dessen Kontaktdaten können Sie dem Impressum dieser Website entnehmen.</p>
+
+<p><strong>Wie erfassen wir Ihre Daten?</strong></p>
+<p>Ihre Daten werden zum einen dadurch erhoben, dass Sie uns diese mitteilen. Hierbei kann es sich z.B. um Daten handeln, die Sie in ein Kontaktformular eingeben.</p>
+
+<p><strong>Wofür nutzen wir Ihre Daten?</strong></p>
+<p>Ein Teil der Daten wird erhoben, um eine fehlerfreie Bereitstellung der Website zu gewährleisten. Andere Daten können zur Analyse Ihres Nutzerverhaltens verwendet werden.</p>
+
+<h2>2. Hosting</h2>
+<p>Diese Website wird extern gehostet. Die personenbezogenen Daten, die auf dieser Website erfasst werden, werden auf den Servern des Hosters gespeichert.</p>
+
+<h2>3. Allgemeine Hinweise und Pflichtinformationen</h2>
+<h3>Datenschutz</h3>
+<p>Die Betreiber dieser Seiten nehmen den Schutz Ihrer persönlichen Daten sehr ernst. Wir behandeln Ihre personenbezogenen Daten vertraulich und entsprechend der gesetzlichen Datenschutzvorschriften sowie dieser Datenschutzerklärung.</p>`,
+      updated_at: new Date()
+    });
+  }
+  
+  // Insert pages if any need to be added
+  if (pagesToInsert.length > 0) {
+    await knex('cms_pages').insert(pagesToInsert);
+  }
+};
+
+exports.down = async function(knex) {
+  // Don't remove CMS pages on rollback as they might have been customized
+};
@@ -0,0 +1,68 @@
+exports.up = async function(knex) {
+  console.log('Fixing JSON columns in database...');
+  
+  // Fix email_templates variables column
+  const templates = await knex('email_templates').select('id', 'template_key', 'variables');
+  
+  for (const template of templates) {
+    if (template.variables && typeof template.variables === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(template.variables);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in email template ${template.template_key}`);
+        // Attempt to fix common issues
+        let fixed = template.variables;
+        
+        // If it looks like an array but isn't valid JSON, try to fix it
+        if (fixed.startsWith('[') && fixed.endsWith(']')) {
+          // Extract the content and properly format it
+          const content = fixed.slice(1, -1);
+          const items = content.split(',').map(item => item.trim().replace(/['"]/g, ''));
+          fixed = JSON.stringify(items);
+        } else {
+          // Default to empty array if we can't fix it
+          fixed = JSON.stringify([]);
+        }
+        
+        await knex('email_templates')
+          .where('id', template.id)
+          .update({ variables: fixed });
+      }
+    } else if (!template.variables) {
+      // Set default empty array for null values
+      await knex('email_templates')
+        .where('id', template.id)
+        .update({ variables: JSON.stringify([]) });
+    }
+  }
+  
+  // Fix activity_logs metadata column
+  const activities = await knex('activity_logs').select('id', 'metadata');
+  
+  for (const activity of activities) {
+    if (activity.metadata && typeof activity.metadata === 'string') {
+      try {
+        // Check if it's already valid JSON
+        JSON.parse(activity.metadata);
+      } catch (e) {
+        console.log(`Fixing invalid JSON in activity log ${activity.id}`);
+        // Default to empty object if we can't parse it
+        await knex('activity_logs')
+          .where('id', activity.id)
+          .update({ metadata: JSON.stringify({}) });
+      }
+    } else if (!activity.metadata) {
+      // Set default empty object for null values
+      await knex('activity_logs')
+        .where('id', activity.id)
+        .update({ metadata: JSON.stringify({}) });
+    }
+  }
+  
+  console.log('JSON columns fixed successfully');
+};
+
+exports.down = async function(knex) {
+  // No rollback needed - data fixes only
+};
@@ -1,12 +1,12 @@
 {
  "name": "picpeak-backend",
-  "version": "1.0.12",
+  "version": "1.0.22",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "picpeak-backend",
-      "version": "1.0.12",
+      "version": "1.0.22",
      "dependencies": {
        "adm-zip": "^0.5.16",
        "archiver": "^5.3.1",
@@ -1,6 +1,6 @@
 {
  "name": "picpeak-backend",
-  "version": "1.0.12",
+  "version": "1.0.22",
  "description": "Backend for PicPeak event photo sharing platform",
  "main": "server.js",
  "scripts": {
@@ -0,0 +1,60 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkDatabaseIssues() {
+  console.log('Checking database issues...\n');
+  
+  try {
+    // Check email_templates table structure
+    console.log('1. Checking email_templates table structure:');
+    const emailTemplateColumns = await db('email_templates').columnInfo();
+    console.log('Columns:', Object.keys(emailTemplateColumns));
+    
+    // Check if any templates exist
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    // Check for specific template
+    const galleryCreatedTemplate = await db('email_templates')
+      .where('template_key', 'gallery_created')
+      .first();
+    console.log('gallery_created template exists:', !!galleryCreatedTemplate);
+    
+    // Check activity_logs table
+    console.log('\n2. Checking activity_logs table:');
+    const activityLogColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityLogColumns));
+    
+    // Check migrations table
+    console.log('\n3. Checking migrations status:');
+    const migrations = await db('migrations')
+      .orderBy('id', 'desc')
+      .limit(10);
+    console.log('Latest migrations:');
+    migrations.forEach(m => console.log(`  - ${m.filename}`));
+    
+    // Test a simple query from notifications route
+    console.log('\n4. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      console.log(`Found ${notifications.length} notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+checkDatabaseIssues();
@@ -0,0 +1,92 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function debugEndpoints() {
+  console.log('Debugging 500 errors...\n');
+  
+  try {
+    // Test email templates query
+    console.log('1. Testing email templates query:');
+    try {
+      const templates = await db('email_templates')
+        .select('*')
+        .orderBy('template_key');
+      
+      console.log(`Found ${templates.length} templates`);
+      if (templates.length > 0) {
+        console.log('First template columns:', Object.keys(templates[0]));
+        console.log('Template keys:', templates.map(t => t.template_key));
+      }
+    } catch (error) {
+      console.error('Email templates query failed:', error.message);
+      console.error('Error code:', error.code);
+    }
+    
+    // Test notifications query
+    console.log('\n2. Testing notifications query:');
+    try {
+      const notifications = await db('activity_logs')
+        .select(
+          'activity_logs.*',
+          'events.event_name'
+        )
+        .leftJoin('events', 'activity_logs.event_id', 'events.id')
+        .whereNull('activity_logs.read_at')
+        .orderBy('activity_logs.created_at', 'desc')
+        .limit(5);
+      
+      console.log(`Found ${notifications.length} unread notifications`);
+    } catch (error) {
+      console.error('Notifications query failed:', error.message);
+      console.error('Error code:', error.code);
+      
+      // Check if it's a column issue
+      if (error.message.includes('column')) {
+        console.log('\nChecking activity_logs columns:');
+        const columns = await db('activity_logs').columnInfo();
+        console.log('Columns:', Object.keys(columns));
+      }
+    }
+    
+    // Test specific template query
+    console.log('\n3. Testing specific template query (gallery_created):');
+    try {
+      const template = await db('email_templates')
+        .where('template_key', 'gallery_created')
+        .first();
+      
+      if (template) {
+        console.log('Template found:', template.template_key);
+        console.log('Has subject_en?', template.subject_en !== undefined);
+        console.log('Has subject?', template.subject !== undefined);
+      } else {
+        console.log('Template not found');
+      }
+    } catch (error) {
+      console.error('Template query failed:', error.message);
+    }
+    
+    // Check CMS pages
+    console.log('\n4. Checking CMS pages:');
+    try {
+      const pages = await db('cms_pages')
+        .select('slug', 'title', 'is_published')
+        .orderBy('slug');
+      
+      console.log(`Found ${pages.length} CMS pages:`);
+      pages.forEach(page => {
+        console.log(`  - ${page.slug}: ${page.title} (published: ${page.is_published})`);
+      });
+    } catch (error) {
+      console.error('CMS pages query failed:', error.message);
+    }
+    
+  } catch (error) {
+    console.error('General error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+debugEndpoints();
@@ -0,0 +1,145 @@
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function fixProductionIssues() {
+  console.log('Fixing production database issues...\n');
+  
+  try {
+    // 1. Check and fix email_templates structure
+    console.log('1. Checking email_templates structure:');
+    const emailColumns = await db('email_templates').columnInfo();
+    console.log('Current columns:', Object.keys(emailColumns));
+    
+    // Check if we need to add basic columns back
+    const hasSubject = 'subject' in emailColumns;
+    const hasSubjectEn = 'subject_en' in emailColumns;
+    
+    if (hasSubjectEn && !hasSubject) {
+      console.log('Adding basic columns back to email_templates...');
+      await db.schema.alterTable('email_templates', (table) => {
+        table.string('subject');
+        table.text('body_html');
+        table.text('body_text');
+      });
+      
+      // Copy values from _en columns
+      await db('email_templates').update({
+        subject: db.raw('subject_en'),
+        body_html: db.raw('body_html_en'),
+        body_text: db.raw('body_text_en')
+      });
+      console.log('Basic columns added successfully');
+    }
+    
+    // 2. Ensure default templates exist
+    console.log('\n2. Checking email templates:');
+    const templateCount = await db('email_templates').count('* as count');
+    console.log('Template count:', templateCount[0].count);
+    
+    if (templateCount[0].count === 0) {
+      console.log('No templates found, inserting defaults...');
+      const defaultTemplates = [
+        {
+          template_key: 'gallery_created',
+          subject: 'Your Photo Gallery is Ready!',
+          body_html: '<h2>Gallery Created Successfully</h2>...',
+          body_text: 'Gallery Created Successfully...',
+          variables: JSON.stringify(['host_name', 'event_name', 'event_date', 'gallery_link', 'gallery_password', 'expiry_date'])
+        },
+        {
+          template_key: 'expiration_warning',
+          subject: 'Your Photo Gallery Expires Soon',
+          body_html: '<h2>Gallery Expiring Soon</h2>...',
+          body_text: 'Gallery Expiring Soon...',
+          variables: JSON.stringify(['host_name', 'event_name', 'days_remaining', 'gallery_link'])
+        },
+        {
+          template_key: 'gallery_expired',
+          subject: 'Your Photo Gallery Has Expired',
+          body_html: '<h2>Gallery Expired</h2>...',
+          body_text: 'Gallery Expired...',
+          variables: JSON.stringify(['host_name', 'event_name'])
+        },
+        {
+          template_key: 'archive_complete',
+          subject: 'Gallery Archive Complete',
+          body_html: '<h2>Archive Complete</h2>...',
+          body_text: 'Archive Complete...',
+          variables: JSON.stringify(['host_name', 'event_name', 'archive_size'])
+        }
+      ];
+      
+      for (const template of defaultTemplates) {
+        // Add language columns if they exist
+        if (hasSubjectEn) {
+          template.subject_en = template.subject;
+          template.body_html_en = template.body_html;
+          template.body_text_en = template.body_text;
+          template.subject_de = template.subject;
+          template.body_html_de = template.body_html;
+          template.body_text_de = template.body_text;
+        }
+        
+        await db('email_templates').insert(template);
+      }
+      console.log('Default templates inserted');
+    }
+    
+    // 3. Check activity_logs structure
+    console.log('\n3. Checking activity_logs structure:');
+    const activityColumns = await db('activity_logs').columnInfo();
+    console.log('Columns:', Object.keys(activityColumns));
+    
+    // Check if read_at exists
+    if (!('read_at' in activityColumns)) {
+      console.log('Adding read_at column to activity_logs...');
+      await db.schema.alterTable('activity_logs', (table) => {
+        table.datetime('read_at').nullable();
+      });
+      console.log('read_at column added');
+    }
+    
+    // 4. Check and add CMS pages
+    console.log('\n4. Checking CMS pages:');
+    const cmsColumns = await db('cms_pages').columnInfo();
+    console.log('CMS columns:', Object.keys(cmsColumns));
+    
+    const impressum = await db('cms_pages').where('slug', 'impressum').first();
+    const datenschutz = await db('cms_pages').where('slug', 'datenschutz').first();
+    
+    if (!impressum) {
+      console.log('Adding Impressum page...');
+      await db('cms_pages').insert({
+        slug: 'impressum',
+        title_en: 'Legal Notice',
+        title_de: 'Impressum',
+        content_en: '<h1>Legal Notice</h1><p>Your legal information here...</p>',
+        content_de: '<h1>Impressum</h1><p>Ihre rechtlichen Informationen hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    if (!datenschutz) {
+      console.log('Adding Datenschutz page...');
+      await db('cms_pages').insert({
+        slug: 'datenschutz',
+        title_en: 'Privacy Policy',
+        title_de: 'Datenschutzerklärung',
+        content_en: '<h1>Privacy Policy</h1><p>Your privacy policy here...</p>',
+        content_de: '<h1>Datenschutzerklärung</h1><p>Ihre Datenschutzerklärung hier...</p>',
+        updated_at: new Date()
+      });
+    }
+    
+    console.log('\n✅ All fixes applied successfully!');
+    
+  } catch (error) {
+    console.error('Error fixing issues:', error);
+    console.error('Stack:', error.stack);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+fixProductionIssues();
@@ -10,7 +10,7 @@ const cors = require('cors');
 const rateLimit = require('express-rate-limit');
 const jwt = require('jsonwebtoken');
 const path = require('path');
-const { initializeDatabase } = require('./src/database/db');
+const { initializeDatabase, db } = require('./src/database/db');
 const { startFileWatcher } = require('./src/services/fileWatcher');
 const { startExpirationChecker } = require('./src/services/expirationChecker');
 const { initializeTransporter, startEmailQueueProcessor } = require('./src/services/emailProcessor');
@@ -28,6 +28,10 @@ const adminAuthRoutes = require('./src/routes/adminAuth');
 const app = express();
 const PORT = process.env.PORT || 3000;

+// Trust proxy headers (required for Traefik/nginx)
+// Set to specific number of proxies or loopback to be more secure
+app.set('trust proxy', 'loopback, linklocal, uniquelocal');
+
 // Security middleware with custom CSP
 app.use(helmet({
  contentSecurityPolicy: {
@@ -152,7 +156,7 @@ app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, se
 app.use('/uploads', setCorsHeaders, secureStatic(path.join(__dirname, 'storage/uploads')));

 // Health check endpoint
-app.get('/api/health', async (req, res) => {
+app.get('/health', async (req, res) => {
  try {
    // Check database connectivity
    await db.raw('SELECT 1');
@@ -0,0 +1,132 @@
+const knex = require('knex');
+const knexConfig = require('../../knexfile');
+const logger = require('../utils/logger');
+
+class ConnectionManager {
+  constructor() {
+    this.db = null;
+    this.reconnectAttempts = 0;
+    this.maxReconnectAttempts = 10;
+    this.reconnectDelay = 5000; // 5 seconds
+    this.isReconnecting = false;
+  }
+
+  async initialize() {
+    try {
+      this.db = knex(knexConfig);
+      
+      // Test the connection
+      await this.db.raw('SELECT 1');
+      logger.info('Database connection established successfully');
+      
+      // Set up connection error handling
+      this.setupErrorHandling();
+      
+      this.reconnectAttempts = 0;
+      return this.db;
+    } catch (error) {
+      logger.error('Failed to initialize database connection:', error);
+      throw error;
+    }
+  }
+
+  setupErrorHandling() {
+    if (!this.db) return;
+
+    // Handle connection errors
+    this.db.on('error', async (error) => {
+      logger.error('Database connection error:', error);
+      
+      if (this.shouldReconnect(error)) {
+        await this.reconnect();
+      }
+    });
+  }
+
+  shouldReconnect(error) {
+    const reconnectableErrors = [
+      'ECONNREFUSED',
+      'ETIMEDOUT',
+      'ECONNRESET',
+      'Connection terminated unexpectedly',
+      'Connection terminated'
+    ];
+    
+    return reconnectableErrors.some(msg => 
+      error.code === msg || error.message?.includes(msg)
+    );
+  }
+
+  async reconnect() {
+    if (this.isReconnecting) {
+      logger.info('Already attempting to reconnect...');
+      return;
+    }
+
+    this.isReconnecting = true;
+    
+    while (this.reconnectAttempts < this.maxReconnectAttempts) {
+      this.reconnectAttempts++;
+      
+      logger.info(`Attempting to reconnect to database (attempt ${this.reconnectAttempts}/${this.maxReconnectAttempts})...`);
+      
+      try {
+        // Destroy the old connection pool
+        if (this.db) {
+          await this.db.destroy();
+        }
+        
+        // Create new connection
+        await this.initialize();
+        
+        logger.info('Successfully reconnected to database');
+        this.isReconnecting = false;
+        return;
+      } catch (error) {
+        logger.error(`Reconnection attempt ${this.reconnectAttempts} failed:`, error.message);
+        
+        if (this.reconnectAttempts < this.maxReconnectAttempts) {
+          await new Promise(resolve => setTimeout(resolve, this.reconnectDelay));
+        }
+      }
+    }
+    
+    this.isReconnecting = false;
+    logger.error('Failed to reconnect to database after maximum attempts');
+    
+    // In production, you might want to alert monitoring systems or restart the process
+    if (process.env.NODE_ENV === 'production') {
+      logger.error('Exiting process due to database connection failure');
+      process.exit(1);
+    }
+  }
+
+  getConnection() {
+    if (!this.db) {
+      throw new Error('Database connection not initialized');
+    }
+    return this.db;
+  }
+
+  async healthCheck() {
+    try {
+      await this.db.raw('SELECT 1');
+      return { healthy: true };
+    } catch (error) {
+      logger.error('Database health check failed:', error);
+      return { healthy: false, error: error.message };
+    }
+  }
+
+  async destroy() {
+    if (this.db) {
+      await this.db.destroy();
+      this.db = null;
+    }
+  }
+}
+
+// Create singleton instance
+const connectionManager = new ConnectionManager();
+
+module.exports = connectionManager;
@@ -1,6 +1,7 @@
 const knex = require('knex');
 const knexConfig = require('../../knexfile');

+// Create database connection with built-in retry logic
 const db = knex(knexConfig);

 async function initializeDatabase() {
@@ -5,6 +5,36 @@ let maintenanceMode = false;
 let lastCheck = 0;
 const CACHE_DURATION = 60000; // 1 minute

+// Retry configuration for database queries
+const MAX_RETRIES = 3;
+const RETRY_DELAY = 1000; // 1 second
+
+async function queryWithRetry(queryFn, retries = MAX_RETRIES) {
+  for (let i = 0; i < retries; i++) {
+    try {
+      return await queryFn();
+    } catch (error) {
+      if (i === retries - 1) {
+        throw error;
+      }
+      
+      // Check if it's a connection error that might benefit from retry
+      const isConnectionError = 
+        error.message?.includes('Connection terminated') ||
+        error.message?.includes('ECONNREFUSED') ||
+        error.message?.includes('ETIMEDOUT') ||
+        error.code === 'ECONNRESET';
+      
+      if (isConnectionError) {
+        console.warn(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAY));
+      } else {
+        throw error; // Don't retry non-connection errors
+      }
+    }
+  }
+}
+
 async function checkMaintenanceMode() {
  const now = Date.now();
  
@@ -14,18 +44,21 @@ async function checkMaintenanceMode() {
  }
  
  try {
-    const setting = await db('app_settings')
-      .where('setting_key', 'general_maintenance_mode')
-      .where('setting_type', 'general')
-      .first();
+    const setting = await queryWithRetry(async () => {
+      return await db('app_settings')
+        .where('setting_key', 'general_maintenance_mode')
+        .where('setting_type', 'general')
+        .first();
+    });
    
    maintenanceMode = setting ? (setting.setting_value === 'true' || setting.setting_value === true) : false;
    lastCheck = now;
    
    return maintenanceMode;
  } catch (error) {
-    console.error('Error checking maintenance mode:', error);
-    return false;
+    console.error('Error checking maintenance mode after retries:', error.message);
+    // Return cached value or false if no cache
+    return maintenanceMode;
  }
 }

@@ -52,14 +85,19 @@ async function maintenanceMiddleware(req, res, next) {
    return next();
  }
  
-  const inMaintenance = await checkMaintenanceMode();
-  
-  if (inMaintenance && !isAdminRoute) {
-    return res.status(503).json({
-      error: 'Service Unavailable',
-      message: 'The system is currently undergoing maintenance. Please try again later.',
-      maintenance: true
-    });
+  try {
+    const inMaintenance = await checkMaintenanceMode();
+    
+    if (inMaintenance && !isAdminRoute) {
+      return res.status(503).json({
+        error: 'Service Unavailable',
+        message: 'The system is currently undergoing maintenance. Please try again later.',
+        maintenance: true
+      });
+    }
+  } catch (error) {
+    // If we can't check maintenance mode, allow the request to proceed
+    console.error('Failed to check maintenance mode, allowing request:', error.message);
  }
  
  next();
@@ -7,6 +7,11 @@ const sessions = new Map();
 // Default session timeout (60 minutes)
 const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;

+// Cache for session timeout setting
+let cachedTimeout = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 5 * 60 * 1000; // 5 minutes
+
 // Clean up expired sessions every 5 minutes
 setInterval(() => {
  const now = Date.now();
@@ -18,20 +23,46 @@ setInterval(() => {
 }, 5 * 60 * 1000);

 async function getSessionTimeout() {
+  const now = Date.now();
+  
+  // Return cached value if still valid
+  if (cachedTimeout && now < cacheExpiry) {
+    return cachedTimeout;
+  }
+  
  try {
    const setting = await db('app_settings')
      .where('setting_key', 'security_session_timeout_minutes')
-      .first();
+      .first()
+      .timeout(5000); // 5 second timeout
    
    if (setting && setting.setting_value) {
-      const minutes = parseInt(JSON.parse(setting.setting_value));
-      return minutes * 60 * 1000; // Convert to milliseconds
+      let value = setting.setting_value;
+      // Handle both string and object values
+      if (typeof value === 'string') {
+        try {
+          value = JSON.parse(value);
+        } catch (e) {
+          // If it's not JSON, try to parse as number directly
+          value = parseInt(value);
+        }
+      }
+      const minutes = parseInt(value);
+      if (!isNaN(minutes) && minutes > 0) {
+        cachedTimeout = minutes * 60 * 1000; // Convert to milliseconds
+        cacheExpiry = now + CACHE_DURATION;
+        return cachedTimeout;
+      }
    }
  } catch (error) {
-    console.error('Error getting session timeout:', error);
+    // Only log if it's not a connection error (to avoid spam)
+    if (error.code !== 'ECONNRESET' && !error.message?.includes('Connection terminated')) {
+      console.error('Error getting session timeout:', error.message);
+    }
  }
  
-  return DEFAULT_SESSION_TIMEOUT;
+  // Use cached value if available, otherwise default
+  return cachedTimeout || DEFAULT_SESSION_TIMEOUT;
 }

 async function sessionTimeoutMiddleware(req, res, next) {
@@ -122,7 +122,16 @@ router.get('/activity', adminAuth, async (req, res) => {
      actorType: activity.actor_type,
      actorName: activity.actor_name,
      eventName: activity.event_name,
-      metadata: activity.metadata ? JSON.parse(activity.metadata) : {},
+      metadata: (() => {
+        try {
+          if (!activity.metadata) return {};
+          if (typeof activity.metadata === 'object') return activity.metadata;
+          return JSON.parse(activity.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for activity:', activity.id, e.message);
+          return {};
+        }
+      })(),
      createdAt: activity.created_at
    }));

@@ -112,17 +112,44 @@ router.post('/test', adminAuth, async (req, res) => {
      return res.status(400).json({ error: 'Email configuration not found. Please configure SMTP settings first.' });
    }

-    // Create transporter
-    const transporter = nodemailer.createTransport({
+    // Validate SMTP configuration
+    if (!config.smtp_host || !config.smtp_port) {
+      return res.status(400).json({ 
+        error: 'Incomplete email configuration',
+        details: 'SMTP host and port are required'
+      });
+    }
+    
+    // Check if password might be masked (this shouldn't happen when fetching from DB)
+    if (config.smtp_pass === '********') {
+      return res.status(400).json({
+        error: 'Invalid email configuration',
+        details: 'SMTP password appears to be masked. Please reconfigure your email settings.'
+      });
+    }
+
+    // Create transporter with detailed logging
+    const transportConfig = {
      host: config.smtp_host,
-      port: config.smtp_port,
-      secure: config.smtp_secure,
-      auth: config.smtp_user ? {
+      port: parseInt(config.smtp_port),
+      secure: config.smtp_secure === true || config.smtp_secure === 1,
+      auth: config.smtp_user && config.smtp_pass ? {
        user: config.smtp_user,
        pass: config.smtp_pass
-      } : undefined
+      } : undefined,
+      logger: process.env.NODE_ENV === 'development',
+      debug: process.env.NODE_ENV === 'development'
+    };
+
+    console.log('Creating email transporter with config:', {
+      host: transportConfig.host,
+      port: transportConfig.port,
+      secure: transportConfig.secure,
+      auth: transportConfig.auth ? 'configured' : 'none'
    });

+    const transporter = nodemailer.createTransport(transportConfig);
+
    // Send test email
    await transporter.sendMail({
      from: `${config.from_name} <${config.from_email}>`,
@@ -145,9 +172,27 @@ router.post('/test', adminAuth, async (req, res) => {
    res.json({ message: 'Test email sent successfully' });
  } catch (error) {
    console.error('Test email error:', error);
+    console.error('Error stack:', error.stack);
+    
+    // Provide more specific error messages
+    let errorMessage = 'Failed to send test email';
+    let details = error.message;
+    
+    if (error.code === 'ECONNREFUSED') {
+      errorMessage = 'Failed to connect to SMTP server';
+      details = 'Please check your SMTP host and port settings';
+    } else if (error.code === 'EAUTH') {
+      errorMessage = 'SMTP authentication failed';
+      details = 'Please check your SMTP username and password';
+    } else if (error.code === 'ESOCKET') {
+      errorMessage = 'Network error';
+      details = 'Could not establish connection to SMTP server';
+    }
+    
    res.status(500).json({ 
-      error: 'Failed to send test email',
-      details: error.message 
+      error: errorMessage,
+      details: details,
+      code: error.code
    });
  }
 });
@@ -160,20 +205,44 @@ router.get('/templates', adminAuth, async (req, res) => {
      .orderBy('template_key');

    // Parse variables JSON and format for multi-language support
-    const formattedTemplates = templates.map(template => ({
-      id: template.id,
-      template_key: template.template_key,
-      // English versions
-      subject_en: template.subject_en || template.subject,
-      body_html_en: template.body_html_en || template.body_html,
-      body_text_en: template.body_text_en || template.body_text,
-      // German versions
-      subject_de: template.subject_de || template.subject_en || template.subject,
-      body_html_de: template.body_html_de || template.body_html_en || template.body_html,
-      body_text_de: template.body_text_de || template.body_text_en || template.body_text,
-      variables: template.variables ? JSON.parse(template.variables) : [],
-      updated_at: template.updated_at
-    }));
+    const formattedTemplates = templates.map(template => {
+      const result = {
+        id: template.id,
+        template_key: template.template_key,
+        variables: (() => {
+        try {
+          if (!template.variables) return [];
+          if (typeof template.variables === 'object') return template.variables;
+          return JSON.parse(template.variables);
+        } catch (e) {
+          console.warn('Failed to parse variables for template:', template.template_key, e.message);
+          return [];
+        }
+      })(),
+        updated_at: template.updated_at
+      };
+      
+      // Handle both old and new schema formats
+      if (template.subject_en !== undefined) {
+        // New schema with language columns
+        result.subject_en = template.subject_en;
+        result.body_html_en = template.body_html_en;
+        result.body_text_en = template.body_text_en;
+        result.subject_de = template.subject_de;
+        result.body_html_de = template.body_html_de;
+        result.body_text_de = template.body_text_de;
+      } else {
+        // Old schema - use basic columns for both languages
+        result.subject_en = template.subject;
+        result.body_html_en = template.body_html;
+        result.body_text_en = template.body_text;
+        result.subject_de = template.subject;
+        result.body_html_de = template.body_html;
+        result.body_text_de = template.body_text;
+      }
+      
+      return result;
+    });

    res.json(formattedTemplates);
  } catch (error) {
@@ -193,20 +262,43 @@ router.get('/templates/:key', adminAuth, async (req, res) => {
      return res.status(404).json({ error: 'Template not found' });
    }

-    res.json({
+    // Handle both old and new schema formats
+    const response = {
      id: template.id,
      template_key: template.template_key,
-      // English versions
-      subject_en: template.subject_en || template.subject,
-      body_html_en: template.body_html_en || template.body_html,
-      body_text_en: template.body_text_en || template.body_text,
-      // German versions
-      subject_de: template.subject_de || template.subject_en || template.subject,
-      body_html_de: template.body_html_de || template.body_html_en || template.body_html,
-      body_text_de: template.body_text_de || template.body_text_en || template.body_text,
-      variables: template.variables ? JSON.parse(template.variables) : [],
+      variables: (() => {
+        try {
+          if (!template.variables) return [];
+          if (typeof template.variables === 'object') return template.variables;
+          return JSON.parse(template.variables);
+        } catch (e) {
+          console.warn('Failed to parse variables for template:', template.template_key, e.message);
+          return [];
+        }
+      })(),
      updated_at: template.updated_at
-    });
+    };
+    
+    // Check which columns exist and use them appropriately
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      response.subject_en = template.subject_en;
+      response.body_html_en = template.body_html_en;
+      response.body_text_en = template.body_text_en;
+      response.subject_de = template.subject_de;
+      response.body_html_de = template.body_html_de;
+      response.body_text_de = template.body_text_de;
+    } else {
+      // Old schema - use basic columns for both languages
+      response.subject_en = template.subject;
+      response.body_html_en = template.body_html;
+      response.body_text_en = template.body_text;
+      response.subject_de = template.subject;
+      response.body_html_de = template.body_html;
+      response.body_text_de = template.body_text;
+    }
+    
+    res.json(response);
  } catch (error) {
    console.error('Email template fetch error:', error);
    res.status(500).json({ error: 'Failed to fetch email template' });
@@ -237,13 +329,39 @@ router.put('/templates/:key', [
      updated_at: new Date()
    };

-    // Only update provided fields
-    if (subject_en !== undefined) updateData.subject_en = subject_en;
-    if (subject_de !== undefined) updateData.subject_de = subject_de;
-    if (body_html_en !== undefined) updateData.body_html_en = body_html_en;
-    if (body_html_de !== undefined) updateData.body_html_de = body_html_de;
-    if (body_text_en !== undefined) updateData.body_text_en = body_text_en || '';
-    if (body_text_de !== undefined) updateData.body_text_de = body_text_de || '';
+    // Check which columns exist in the database
+    const template = await db('email_templates')
+      .where('template_key', req.params.key)
+      .first();
+      
+    if (!template) {
+      return res.status(404).json({ error: 'Template not found' });
+    }
+
+    // Determine schema type and update accordingly
+    if (template.subject_en !== undefined) {
+      // New schema with language columns
+      if (subject_en !== undefined) updateData.subject_en = subject_en;
+      if (subject_de !== undefined) updateData.subject_de = subject_de;
+      if (body_html_en !== undefined) updateData.body_html_en = body_html_en;
+      if (body_html_de !== undefined) updateData.body_html_de = body_html_de;
+      if (body_text_en !== undefined) updateData.body_text_en = body_text_en || '';
+      if (body_text_de !== undefined) updateData.body_text_de = body_text_de || '';
+      
+      // Also update basic columns if they exist
+      if (template.subject !== undefined) {
+        updateData.subject = subject_en || updateData.subject_en;
+        updateData.body_html = body_html_en || updateData.body_html_en;
+        updateData.body_text = body_text_en || updateData.body_text_en || '';
+      }
+    } else {
+      // Old schema - only update basic columns
+      if (subject_en !== undefined) {
+        updateData.subject = subject_en;
+        updateData.body_html = body_html_en;
+        updateData.body_text = body_text_en || '';
+      }
+    }

    const updated = await db('email_templates')
      .where('template_key', req.params.key)
@@ -32,7 +32,16 @@ router.get('/', adminAuth, async (req, res) => {
      actorName: notification.actor_name,
      eventName: notification.event_name,
      eventId: notification.event_id,
-      metadata: notification.metadata ? JSON.parse(notification.metadata) : {},
+      metadata: (() => {
+        try {
+          if (!notification.metadata) return {};
+          if (typeof notification.metadata === 'object') return notification.metadata;
+          return JSON.parse(notification.metadata);
+        } catch (e) {
+          console.warn('Failed to parse metadata for notification:', notification.id, e.message);
+          return {};
+        }
+      })(),
      createdAt: notification.created_at,
      readAt: notification.read_at,
      isRead: !!notification.read_at
@@ -91,9 +100,13 @@ router.put('/read-all', adminAuth, async (req, res) => {
 // Delete old notifications (older than 30 days and read)
 router.delete('/clear-old', adminAuth, async (req, res) => {
  try {
+    // Use database-agnostic date calculation
+    const thirtyDaysAgo = new Date();
+    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+    
    const deletedCount = await db('activity_logs')
      .whereNotNull('read_at')
-      .where('created_at', '<', db.raw("datetime('now', '-30 days')"))
+      .where('created_at', '<', thirtyDaysAgo)
      .delete();

    res.json({ 
@@ -35,14 +35,30 @@ router.get('/version', adminAuth, async (req, res) => {
 // Get comprehensive system status
 router.get('/status', adminAuth, async (req, res) => {
  try {
-    // Database size
-    const dbPath = path.join(__dirname, '../../data/photo_sharing.db');
+    // Database size - check if PostgreSQL or SQLite
    let dbSize = 0;
-    try {
-      const stats = await fs.stat(dbPath);
-      dbSize = stats.size;
-    } catch (error) {
-      console.error('Error getting database size:', error);
+    const dbClient = process.env.DATABASE_CLIENT || 'sqlite3';
+    
+    if (dbClient === 'pg') {
+      // PostgreSQL - query database size
+      try {
+        const dbName = process.env.DB_NAME || 'picpeak';
+        const result = await db.raw(`
+          SELECT pg_database_size(?) as size
+        `, [dbName]);
+        dbSize = result.rows[0]?.size || 0;
+      } catch (error) {
+        console.error('Error getting PostgreSQL database size:', error);
+      }
+    } else {
+      // SQLite - check file size
+      const dbPath = path.join(__dirname, '../../data/photo_sharing.db');
+      try {
+        const stats = await fs.stat(dbPath);
+        dbSize = stats.size;
+      } catch (error) {
+        console.error('Error getting SQLite database size:', error);
+      }
    }

    // Count various entities
@@ -8,13 +8,13 @@ const logger = require('./logger');

 // Configuration
 const PASSWORD_CONFIG = {
-  minLength: 12,
+  minLength: 8, // Reduced from 12 to 8 for better usability
  requireUppercase: true,
  requireLowercase: true,
  requireNumbers: true,
-  requireSpecialChars: true,
+  requireSpecialChars: false, // Made optional for gallery passwords
  preventCommonPasswords: true,
-  minStrengthScore: 3, // zxcvbn score (0-4, where 3 is "good")
+  minStrengthScore: 2, // Reduced from 3 to 2 (moderate strength)
  bcryptRounds: parseInt(process.env.BCRYPT_ROUNDS) || 12 // Configurable, default 12
 };

@@ -137,18 +137,15 @@ function validatePasswordInContext(password, context, userData = {}) {
      }
    }
  } else if (context === 'gallery') {
-    // Gallery passwords can be slightly less strict
-    // but still need to be secure
-    if (result.score < 2) {
+    // Gallery passwords can be more lenient for user convenience
+    // Allow passwords with score >= 1 (weak but acceptable)
+    if (result.score < 1) {
      result.valid = false;
-      result.errors.push('Gallery passwords must have moderate strength or better');
+      result.errors.push('Password is too simple. Please add more complexity');
    }
    
-    // Check password doesn't contain event name
-    if (userData.eventName && password.toLowerCase().includes(userData.eventName.toLowerCase())) {
-      result.valid = false;
-      result.errors.push('Password must not contain the event name');
-    }
+    // Don't check for event name in password - allow date-based passwords
+    // This allows passwords like "Sommer2025!" which users prefer
  }
  
  return result;
@@ -0,0 +1,110 @@
+version: '3.8'
+services:
+  backend:
+    image: 'registry.local.nothaft.cloud/picpeak-backend:latest'
+    restart: unless-stopped
+    environment:
+      - NODE_ENV=production
+      - DATABASE_CLIENT=pg
+      - DB_HOST=db
+      - DB_PORT=5432
+      - DB_USER=${DB_USER:-picpeak}
+      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_NAME=${DB_NAME:-picpeak}
+      - PORT=3000
+      - JWT_SECRET=${JWT_SECRET}
+      - ADMIN_URL=https://picpeak.local.nothaft.cloud
+      - FRONTEND_URL=https://picpeak.local.nothaft.cloud
+      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_PORT=${SMTP_PORT}
+      - SMTP_SECURE=${SMTP_SECURE}
+      - SMTP_USER=${SMTP_USER}
+      - SMTP_PASS=${SMTP_PASS}
+      - EMAIL_FROM=${EMAIL_FROM}
+      - UMAMI_URL=${UMAMI_URL}
+      - UMAMI_WEBSITE_ID=${UMAMI_WEBSITE_ID}
+      - STORAGE_PATH=/app/storage
+      - EVENTS_PATH=/app/storage/events
+      - ARCHIVE_PATH=/app/storage/events/archived
+    volumes:
+      - '/mnt/DockerMount/picpeak/storage:/app/storage'
+      - '/mnt/DockerMount/picpeak/data:/app/data'
+      - '/mnt/DockerMount/picpeak/logs:/app/logs'
+    networks:
+      - picpeak
+      - proxy
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=proxy
+        # Backend API routing WITHOUT path stripping
+        - 'traefik.http.routers.picpeak-backend.rule=(Host(`picpeak.nothaft.cloud`) || Host(`picpeak.local.nothaft.cloud`)) && PathPrefix(`/api`)'
+        - traefik.http.routers.picpeak-backend.entrypoints=https
+        - traefik.http.routers.picpeak-backend.tls.certresolver=dns
+        - traefik.http.services.picpeak-backend.loadbalancer.server.port=3000
+        # Remove the stripprefix middleware - backend expects /api prefix
+        # - traefik.http.middlewares.picpeak-stripprefix.stripprefix.prefixes=/api
+        # - traefik.http.routers.picpeak-backend.middlewares=picpeak-stripprefix
+        - traefik.http.routers.picpeak-backend.priority=100
+        - homepage.group=Public Services
+        - homepage.name=PicPeak Backend
+        - homepage.icon=mdi-api
+        - 'homepage.href=https://picpeak.local.nothaft.cloud/api/health'
+        - homepage.description=PicPeak API Backend
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    depends_on:
+      - db
+
+  frontend:
+    image: 'registry.local.nothaft.cloud/picpeak-frontend:latest'
+    restart: unless-stopped
+    depends_on:
+      - backend
+    networks:
+      - picpeak
+      - proxy
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=proxy
+        - traefik.http.routers.picpeak.rule=Host(`picpeak.nothaft.cloud`) || Host(`picpeak.local.nothaft.cloud`)
+        - traefik.http.routers.picpeak.entrypoints=https
+        - traefik.http.routers.picpeak.tls.certresolver=dns
+        - traefik.http.services.picpeak.loadbalancer.server.port=80
+        - traefik.http.routers.picpeak.priority=10
+        - homepage.group=Public Services
+        - homepage.name=PicPeak
+        - homepage.icon=mdi-photo
+        - 'homepage.href=https://picpeak.local.nothaft.cloud/'
+        - homepage.description=Photo Sharing System
+
+  db:
+    image: 'postgres:14-alpine'
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=${DB_USER:-picpeak}
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+      - POSTGRES_DB=${DB_NAME:-picpeak}
+      - POSTGRES_HOST_AUTH_METHOD=${PG_AUTH_METHOD:-scram-sha-256}
+      - POSTGRES_INITDB_ARGS=${PG_INIT_ARGS:---auth-host=scram-sha-256 --auth-local=trust}
+    volumes:
+      - '/mnt/DockerMount/picpeak/db:/var/lib/postgresql/data'
+    networks:
+      - picpeak
+    command: ${PG_COMMANDS:-postgres -c ssl=off}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-picpeak}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+networks:
+  proxy:
+    external: true
+  picpeak:
+    driver: bridge
@@ -0,0 +1,131 @@
+version: '3.8'
+services:
+  backend:
+    image: 'registry.local.nothaft.cloud/picpeak-backend:latest'
+    restart: unless-stopped
+    environment:
+      - NODE_ENV=production
+      - DATABASE_CLIENT=pg
+      - DB_HOST=db
+      - DB_PORT=5432
+      - DB_USER=${DB_USER:-picpeak}
+      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_NAME=${DB_NAME:-picpeak}
+      - PORT=3000
+      - JWT_SECRET=${JWT_SECRET}
+      - ADMIN_URL=https://picpeak.local.nothaft.cloud
+      - FRONTEND_URL=https://picpeak.local.nothaft.cloud
+      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_PORT=${SMTP_PORT}
+      - SMTP_SECURE=${SMTP_SECURE}
+      - SMTP_USER=${SMTP_USER}
+      - SMTP_PASS=${SMTP_PASS}
+      - EMAIL_FROM=${EMAIL_FROM}
+      - UMAMI_URL=${UMAMI_URL}
+      - UMAMI_WEBSITE_ID=${UMAMI_WEBSITE_ID}
+      - STORAGE_PATH=/app/storage
+      - EVENTS_PATH=/app/storage/events
+      - ARCHIVE_PATH=/app/storage/events/archived
+    volumes:
+      - '/mnt/DockerMount/picpeak/storage:/app/storage'
+      - '/mnt/DockerMount/picpeak/data:/app/data'
+      - '/mnt/DockerMount/picpeak/logs:/app/logs'
+    networks:
+      - picpeak
+      - proxy
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=proxy
+        # Backend API routing
+        - 'traefik.http.routers.picpeak-backend.rule=(Host(`picpeak.nothaft.cloud`) || Host(`picpeak.local.nothaft.cloud`)) && PathPrefix(`/api`)'
+        - traefik.http.routers.picpeak-backend.entrypoints=https
+        - traefik.http.routers.picpeak-backend.tls=true
+        - traefik.http.routers.picpeak-backend.tls.certresolver=dns
+        - traefik.http.services.picpeak-backend.loadbalancer.server.port=3000
+        # Strip /api prefix when forwarding to backend
+        - traefik.http.middlewares.picpeak-stripprefix.stripprefix.prefixes=/api
+        - traefik.http.routers.picpeak-backend.middlewares=picpeak-stripprefix
+        # Higher priority for API routes
+        - traefik.http.routers.picpeak-backend.priority=100
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    depends_on:
+      - db
+
+  frontend:
+    image: 'registry.local.nothaft.cloud/picpeak-frontend:latest'
+    restart: unless-stopped
+    depends_on:
+      - backend
+    networks:
+      - picpeak
+      - proxy
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=proxy
+        # Frontend routing (catch-all for non-API routes)
+        - traefik.http.routers.picpeak.rule=Host(`picpeak.nothaft.cloud`) || Host(`picpeak.local.nothaft.cloud`)
+        - traefik.http.routers.picpeak.entrypoints=https
+        - traefik.http.routers.picpeak.tls=true
+        - traefik.http.routers.picpeak.tls.certresolver=dns
+        - traefik.http.services.picpeak.loadbalancer.server.port=80
+        # Lower priority than backend to ensure /api routes go to backend
+        - traefik.http.routers.picpeak.priority=10
+
+  db:
+    image: 'postgres:14-alpine'
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=${DB_USER:-picpeak}
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+      - POSTGRES_DB=${DB_NAME:-picpeak}
+      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
+      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=trust
+    volumes:
+      - '/mnt/DockerMount/picpeak/db:/var/lib/postgresql/data'
+      # Mount init script to create umami database
+      - ./docker/postgres-init:/docker-entrypoint-initdb.d:ro
+    networks:
+      - picpeak
+    command: postgres -c ssl=off
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-picpeak}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # Optional: Umami analytics
+  umami:
+    image: ghcr.io/umami-software/umami:postgresql-latest
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgresql://${DB_USER:-picpeak}:${DB_PASSWORD}@db:5432/umami
+      DATABASE_TYPE: postgresql
+      HASH_SALT: ${UMAMI_HASH_SALT}
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - picpeak
+      - proxy
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=proxy
+        - traefik.http.routers.picpeak-umami.rule=Host(`analytics.picpeak.local.nothaft.cloud`)
+        - traefik.http.routers.picpeak-umami.entrypoints=https
+        - traefik.http.routers.picpeak-umami.tls=true
+        - traefik.http.routers.picpeak-umami.tls.certresolver=dns
+        - traefik.http.services.picpeak-umami.loadbalancer.server.port=3000
+
+networks:
+  proxy:
+    external: true
+  picpeak:
+    driver: bridge
@@ -0,0 +1,147 @@
+# docker-compose.traefik.yml - Production configuration for external Traefik
+version: '3.8'
+
+services:
+  backend:
+    image: picpeak-backend:latest
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    depends_on:
+      - db
+    environment:
+      - NODE_ENV=production
+      - PORT=3000
+      - JWT_SECRET=${JWT_SECRET}
+      - ADMIN_URL=https://picpeak.nothaft.cloud
+      - FRONTEND_URL=https://picpeak.nothaft.cloud
+      # Database
+      - DATABASE_CLIENT=pg
+      - DB_HOST=db
+      - DB_PORT=5432
+      - DB_USER=${DB_USER:-picpeak}
+      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_NAME=${DB_NAME:-picpeak}
+      # Email
+      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_PORT=${SMTP_PORT}
+      - SMTP_SECURE=${SMTP_SECURE}
+      - SMTP_USER=${SMTP_USER}
+      - SMTP_PASS=${SMTP_PASS}
+      - EMAIL_FROM=${EMAIL_FROM}
+      # Analytics
+      - UMAMI_URL=${UMAMI_URL}
+      - UMAMI_WEBSITE_ID=${UMAMI_WEBSITE_ID}
+      # Storage paths
+      - STORAGE_PATH=/app/storage
+      - EVENTS_PATH=/app/storage/events
+      - ARCHIVE_PATH=/app/storage/events/archived
+    volumes:
+      - ./storage:/app/storage
+      - ./data:/app/data
+      - ./logs:/app/logs
+    networks:
+      - picpeak
+      - traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      # Backend API routing
+      - "traefik.http.routers.picpeak-backend.rule=Host(`picpeak.nothaft.cloud`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.picpeak-backend.entrypoints=websecure"
+      - "traefik.http.routers.picpeak-backend.tls=true"
+      - "traefik.http.routers.picpeak-backend.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak-backend.loadbalancer.server.port=3000"
+      # Strip /api prefix when forwarding to backend
+      - "traefik.http.middlewares.picpeak-stripprefix.stripprefix.prefixes=/api"
+      - "traefik.http.routers.picpeak-backend.middlewares=picpeak-stripprefix"
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+  frontend:
+    image: picpeak-frontend:latest
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile
+      args:
+        - VITE_API_URL=/api
+        - VITE_UMAMI_URL=${VITE_UMAMI_URL}
+        - VITE_UMAMI_WEBSITE_ID=${VITE_UMAMI_WEBSITE_ID}
+    restart: unless-stopped
+    depends_on:
+      - backend
+    networks:
+      - picpeak
+      - traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      # Frontend routing (catch-all for non-API routes)
+      - "traefik.http.routers.picpeak-frontend.rule=Host(`picpeak.nothaft.cloud`)"
+      - "traefik.http.routers.picpeak-frontend.entrypoints=websecure"
+      - "traefik.http.routers.picpeak-frontend.tls=true"
+      - "traefik.http.routers.picpeak-frontend.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak-frontend.loadbalancer.server.port=80"
+      # Lower priority than backend to ensure /api routes go to backend
+      - "traefik.http.routers.picpeak-frontend.priority=1"
+
+  db:
+    image: postgres:14-alpine
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=${DB_USER:-picpeak}
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+      - POSTGRES_DB=${DB_NAME:-picpeak}
+      # Allow connections from any host with password authentication
+      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
+      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=trust
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      # Mount init script to create umami database
+      - ./docker/postgres-init:/docker-entrypoint-initdb.d
+    networks:
+      - picpeak
+    # Allow connections without SSL requirement from Docker network
+    command: postgres -c ssl=off
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-picpeak}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  umami:
+    image: ghcr.io/umami-software/umami:postgresql-latest
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: postgresql://${DB_USER:-picpeak}:${DB_PASSWORD}@db:5432/umami
+      DATABASE_TYPE: postgresql
+      HASH_SALT: ${UMAMI_HASH_SALT}
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - picpeak
+      - traefik
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik"
+      # Umami analytics routing
+      - "traefik.http.routers.picpeak-umami.rule=Host(`analytics.picpeak.nothaft.cloud`)"
+      - "traefik.http.routers.picpeak-umami.entrypoints=websecure"
+      - "traefik.http.routers.picpeak-umami.tls=true"
+      - "traefik.http.routers.picpeak-umami.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak-umami.loadbalancer.server.port=3000"
+
+networks:
+  picpeak:
+    driver: bridge
+  traefik:
+    external: true
+
+volumes:
+  postgres_data:
@@ -0,0 +1,8 @@
+-- Create umami database if it doesn't exist
+-- This runs as the postgres superuser during initialization
+
+SELECT 'CREATE DATABASE umami'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'umami')\gexec
+
+-- Grant all privileges on umami database to the application user
+GRANT ALL PRIVILEGES ON DATABASE umami TO "${POSTGRES_USER}";
@@ -0,0 +1,22 @@
+{
+  "auditReportVersion": 2,
+  "vulnerabilities": {},
+  "metadata": {
+    "vulnerabilities": {
+      "info": 0,
+      "low": 0,
+      "moderate": 0,
+      "high": 0,
+      "critical": 0,
+      "total": 0
+    },
+    "dependencies": {
+      "prod": 136,
+      "dev": 298,
+      "optional": 47,
+      "peer": 0,
+      "peerOptional": 0,
+      "total": 433
+    }
+  }
+}
@@ -1,12 +1,12 @@
 {
  "name": "picpeak-frontend",
-  "version": "1.0.12",
+  "version": "1.0.22",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "picpeak-frontend",
-      "version": "1.0.12",
+      "version": "1.0.22",
      "dependencies": {
        "@tanstack/react-query": "^5.0.0",
        "@tiptap/extension-link": "^2.25.0",
@@ -1,7 +1,7 @@
 {
  "name": "picpeak-frontend",
  "private": true,
-  "version": "1.0.12",
+  "version": "1.0.22",
  "type": "module",
  "scripts": {
    "dev": "vite",
@@ -872,6 +872,7 @@
    "passwordRequired": "Passwort ist erforderlich",
    "passwordMinLength": "Passwort muss mindestens 6 Zeichen lang sein",
    "passwordsDoNotMatch": "Passwörter stimmen nicht überein",
+    "passwordSecurityRequirements": "Passwort erfüllt nicht die Sicherheitsanforderungen",
    "expirationRange": "Ablauf muss zwischen 1 und 365 Tagen liegen"
  },
  "maintenance": {
@@ -792,6 +792,7 @@
    "passwordRequired": "Password is required",
    "passwordMinLength": "Password must be at least 6 characters",
    "passwordsDoNotMatch": "Passwords do not match",
+    "passwordSecurityRequirements": "Password does not meet security requirements",
    "expirationRange": "Expiration must be between 1 and 365 days"
  },
  "legal": {
@@ -7,7 +7,9 @@ import {
  Clock,
  ArrowLeft,
  Info,
-  Upload
+  Upload,
+  Eye,
+  EyeOff
 } from 'lucide-react';
 import { format, addDays } from 'date-fns';
 import { toast } from 'react-toastify';
@@ -168,7 +170,13 @@ export const CreateEventPage: React.FC = () => {
        toast.error(t('errors.sessionExpired'));
        navigate('/admin/login');
      } else {
-        toast.error(error.response?.data?.error || t('errors.failedToCreateEvent'));
+        const errorMessage = error.response?.data?.error;
+        // Check if it's the password security requirements error
+        if (errorMessage === 'Password does not meet security requirements') {
+          toast.error(t('validation.passwordSecurityRequirements'));
+        } else {
+          toast.error(errorMessage || t('errors.failedToCreateEvent'));
+        }
      }
    },
  });
@@ -405,7 +413,20 @@ export const CreateEventPage: React.FC = () => {
                  error={errors.password}
                  placeholder={t('events.enterPassword')}
                  leftIcon={<Lock className="w-5 h-5 text-neutral-400" />}
+                  className="pr-10"
                />
+                <button
+                  type="button"
+                  onClick={() => setShowPassword(!showPassword)}
+                  className="absolute inset-y-0 right-0 pr-3 flex items-center"
+                  style={{ top: errors.password ? '0' : '0' }}
+                >
+                  {showPassword ? (
+                    <EyeOff className="w-5 h-5 text-neutral-400 hover:text-neutral-600" />
+                  ) : (
+                    <Eye className="w-5 h-5 text-neutral-400 hover:text-neutral-600" />
+                  )}
+                </button>
              </div>
            </div>

@@ -414,29 +435,32 @@ export const CreateEventPage: React.FC = () => {
              <label htmlFor="confirm_password" className="block text-sm font-medium text-neutral-700 mb-1">
                {t('events.confirmPassword')}
              </label>
-              <Input
-                id="confirm_password"
-                type={showPassword ? 'text' : 'password'}
-                value={formData.confirm_password}
-                onChange={handleInputChange('confirm_password')}
-                error={errors.confirm_password}
-                placeholder={t('events.confirmPasswordPlaceholder')}
-                leftIcon={<Lock className="w-5 h-5 text-neutral-400" />}
-              />
+              <div className="relative">
+                <Input
+                  id="confirm_password"
+                  type={showPassword ? 'text' : 'password'}
+                  value={formData.confirm_password}
+                  onChange={handleInputChange('confirm_password')}
+                  error={errors.confirm_password}
+                  placeholder={t('events.confirmPasswordPlaceholder')}
+                  leftIcon={<Lock className="w-5 h-5 text-neutral-400" />}
+                  className="pr-10"
+                />
+                <button
+                  type="button"
+                  onClick={() => setShowPassword(!showPassword)}
+                  className="absolute inset-y-0 right-0 pr-3 flex items-center"
+                  style={{ top: errors.confirm_password ? '0' : '0' }}
+                >
+                  {showPassword ? (
+                    <EyeOff className="w-5 h-5 text-neutral-400 hover:text-neutral-600" />
+                  ) : (
+                    <Eye className="w-5 h-5 text-neutral-400 hover:text-neutral-600" />
+                  )}
+                </button>
+              </div>
            </div>
          </div>
-
-          <div className="mt-4">
-            <label className="flex items-center">
-              <input
-                type="checkbox"
-                checked={showPassword}
-                onChange={(e) => setShowPassword(e.target.checked)}
-                className="w-4 h-4 text-primary-600 border-neutral-300 rounded focus:ring-primary-500"
-              />
-              <span className="ml-2 text-sm text-neutral-700">{t('events.showPasswords')}</span>
-            </label>
-          </div>
        </Card>

        {/* Gallery Settings */}
Author	SHA1	Message	Date
Gitea Actions Bot	237a3332cc	chore: bump version to 1.0.22 continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build is passing Details	2025-07-14 12:10:51 +00:00
paul	e2d0a83d51	fix: relax password requirements and improve password UI Test and Lint / backend-test (push) Successful in 1m9s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m13s Details Version and Release / version-bump (push) Successful in 35s Details Version and Release / trigger-drone (push) Successful in 3s Details - Reduce minimum password length from 12 to 8 characters - Make special characters optional for gallery passwords - Lower strength requirement from score 3 to 1 for galleries - Add eye icon toggle for password visibility on each field - Remove redundant 'Show passwords' checkbox - Add translation for password security requirements error - Update both English and German translations This allows users to use simpler passwords like 'Sommer2025\!' for events while maintaining security through other measures like expiration dates. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 14:06:18 +02:00
Gitea Actions Bot	c546657285	chore: bump version to 1.0.21 continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build is passing Details	2025-07-14 11:13:23 +00:00
paul	e8d5ee1a7b	fix: multiple production issues with PostgreSQL and connection handling Test and Lint / backend-test (push) Successful in 1m7s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m11s Details Version and Release / version-bump (push) Successful in 36s Details Version and Release / trigger-drone (push) Successful in 3s Details - Fix trust proxy to use specific values instead of permissive 'true' - Fix clear old notifications to use database-agnostic date calculation - Fix database size check to support both PostgreSQL and SQLite - Add caching and better error handling for session timeout queries - Add query timeout to prevent hanging connections - Improve JSON parsing error handling for setting values These fixes address: - ERR_ERL_PERMISSIVE_TRUST_PROXY warning - PostgreSQL datetime function errors - ENOENT errors looking for SQLite file in PostgreSQL deployment - Connection terminated errors for session timeout checks 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 13:09:24 +02:00
Gitea Actions Bot	1761ebd531	chore: bump version to 1.0.20 continuous-integration/drone/push Build is passing Details continuous-integration/drone/tag Build is passing Details	2025-07-14 10:08:49 +00:00
paul	5e5e98601f	fix: improve email test endpoint error handling Test and Lint / backend-test (push) Successful in 1m10s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m6s Details Version and Release / version-bump (push) Successful in 32s Details Version and Release / trigger-drone (push) Successful in 3s Details - Add detailed validation for SMTP configuration - Add specific error messages for common SMTP issues (connection, auth, network) - Add logging to help debug email configuration issues - Check for masked passwords that shouldn't be used for sending - Parse smtp_port as integer and handle boolean smtp_secure properly This helps identify the exact cause of email sending failures instead of generic 500 errors. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 12:04:57 +02:00
Gitea Actions Bot	1cda80792b	chore: bump version to 1.0.19 continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build is passing Details	2025-07-14 09:02:17 +00:00
paul	8740d5e618	fix: dashboard activity endpoint JSON parsing error Test and Lint / backend-test (push) Successful in 1m4s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m26s Details Version and Release / version-bump (push) Successful in 31s Details Version and Release / trigger-drone (push) Successful in 3s Details - Add safe JSON parsing for activity metadata in dashboard endpoint - Handle cases where PostgreSQL returns JSON columns as objects - Prevent 500 errors when metadata contains invalid JSON 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 10:58:12 +02:00
Gitea Actions Bot	a619d52d17	chore: bump version to 1.0.18 continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build is passing Details	2025-07-14 08:46:37 +00:00
paul	dd8cc14d30	fix: production JSON parsing errors and trust proxy issue Test and Lint / backend-test (push) Successful in 1m3s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m16s Details Version and Release / version-bump (push) Successful in 33s Details Version and Release / trigger-drone (push) Successful in 3s Details - Set Express to trust proxy headers for proper IP detection with Traefik - Add safe JSON parsing for email template variables and activity log metadata - Create migration to fix invalid JSON data in database - Add error handling to prevent JSON.parse crashes This fixes the 500 errors caused by invalid JSON data and the trust proxy warning from express-rate-limit when running behind Traefik. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 10:42:41 +02:00
Gitea Actions Bot	3b7d723c2a	chore: bump version to 1.0.17 continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build is passing Details	2025-07-14 08:18:38 +00:00
paul	dc6252ff56	fix: complete email template and CMS page fixes for production Test and Lint / backend-test (push) Successful in 1m8s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m7s Details Version and Release / version-bump (push) Successful in 34s Details Version and Release / trigger-drone (push) Successful in 4s Details - Fix email templates list endpoint to handle both schema variations - Add migration for default CMS pages with language-specific columns - Create debug script to identify 500 error causes - Update CMS migration to use correct column names (title_en/de, content_en/de) 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 10:14:44 +02:00
Gitea Actions Bot	1d4e79a4f9	chore: bump version to 1.0.16 continuous-integration/drone/tag Build is passing Details continuous-integration/drone/push Build is passing Details	2025-07-14 08:02:15 +00:00
paul	0b0e3e22d2	fix: handle email templates schema variations in production Test and Lint / backend-test (push) Successful in 1m11s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m20s Details Version and Release / version-bump (push) Successful in 34s Details Version and Release / trigger-drone (push) Successful in 3s Details - Update migration to detect and handle both old and new email template schemas - Fix migration to insert into correct columns based on existing schema - Update adminEmail routes to handle both schema formats gracefully - Add proper fallbacks for German language columns This ensures the application works whether the language migration has been applied or not, preventing null constraint violations. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 09:58:06 +02:00
Gitea Actions Bot	f22e3c133f	chore: bump version to 1.0.15 continuous-integration/drone/push Build is passing Details continuous-integration/drone/tag Build is passing Details	2025-07-14 07:53:34 +00:00
paul	64c0a58f78	fix: database migration and routing issues for production Test and Lint / backend-test (push) Successful in 1m19s Details Test and Lint / frontend-test (push) Successful in 2m20s Details continuous-integration/drone/push Build is passing Details Version and Release / version-bump (push) Successful in 38s Details Version and Release / trigger-drone (push) Successful in 3s Details - Add migration to fix email_templates column structure after language migration - Add migration to ensure default email templates exist - Create diagnostic script to check database issues - Fix docker-compose configuration for proper routing without path stripping The backend expects routes with /api prefix, so removing the stripprefix middleware allows proper routing to work. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 09:49:11 +02:00
Gitea Actions Bot	4182089c17	chore: bump version to 1.0.14 continuous-integration/drone/push Build is passing Details continuous-integration/drone/tag Build is passing Details	2025-07-14 07:24:51 +00:00
paul	cecf773fb7	fix: database connection stability issues in production Test and Lint / backend-test (push) Successful in 1m9s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m10s Details Version and Release / version-bump (push) Successful in 32s Details Version and Release / trigger-drone (push) Successful in 3s Details - Add robust connection pool configuration with timeouts and retry settings - Implement retry logic in maintenance middleware for connection errors - Increase connection stability with keepAlive and proper timeout values - Handle "Connection terminated unexpectedly" errors gracefully This prevents 503 errors when the database connection is temporarily interrupted and ensures the application can recover from transient connection issues. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 09:20:51 +02:00
Gitea Actions Bot	973af17b85	chore: bump version to 1.0.13 continuous-integration/drone/push Build is passing Details continuous-integration/drone/tag Build is passing Details	2025-07-14 06:45:13 +00:00
paul	6c3e88a588	fix: production deployment issues with Traefik and database migrations Test and Lint / backend-test (push) Successful in 1m8s Details continuous-integration/drone/push Build is passing Details Test and Lint / frontend-test (push) Successful in 2m8s Details Version and Release / version-bump (push) Successful in 32s Details Version and Release / trigger-drone (push) Successful in 2s Details - Add missing created_at column to email_queue table - Fix 502 Bad Gateway errors with proper Traefik routing configuration - Create docker-compose.traefik.yml for external Traefik deployment - Fix health check endpoint path for API path stripping - Add PostgreSQL init script for Umami database creation - Add comprehensive deployment guide for Traefik setup The backend now properly handles /api prefix stripping by Traefik and migrations run safely in production environments with existing schemas. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-14 08:41:11 +02:00