chore: bump backend version to 1.0.79

fix: resolve migration conflicts and duplicate numbering
- Rename conflicting migrations to sequential numbers - Update 035_enhance_backup_system.js to check for existing columns - Prevent 'column already exists' errors during migration - Add proper column existence checks before alterations
2025-07-22 20:36:13 +00:00 · 2025-07-22 22:30:59 +02:00 · 2025-07-22 15:31:24 +02:00 · 2025-07-22 13:14:14 +00:00 · 2025-07-22 15:08:52 +02:00 · 2025-07-22 11:31:13 +02:00
243 changed files with 30837 additions and 7232 deletions
@@ -72,6 +72,86 @@ steps:
      context: frontend/
      registry: registry.local.nothaft.cloud

+  # -------- NEW: Publish Docker images to GitHub Container Registry --------
+  - name: push-backend-ghcr
+    image: plugins/docker
+    settings:
+      repo: ghcr.io/the-luap/picpeak-backend
+      tags:
+        - ${DRONE_TAG}
+        - latest
+      dockerfile: backend/Dockerfile
+      context: backend/
+      registry: ghcr.io
+      username:
+        from_secret: GITHUB_USERNAME
+      password:
+        from_secret: GITHUB_TOKEN
+      build_args:
+        - VERSION=${DRONE_TAG}
+
+  - name: push-frontend-ghcr
+    image: plugins/docker
+    settings:
+      repo: ghcr.io/the-luap/picpeak-frontend
+      tags:
+        - ${DRONE_TAG}
+        - latest
+      dockerfile: frontend/Dockerfile
+      context: frontend/
+      registry: ghcr.io
+      username:
+        from_secret: GITHUB_USERNAME
+      password:
+        from_secret: GITHUB_TOKEN
+      build_args:
+        - VERSION=${DRONE_TAG}
+        - VITE_API_URL=${VITE_API_URL:-/api}
+
+  # -------- NEW: Create GitHub Release --------
+  - name: github-release
+    image: plugins/github-release
+    settings:
+      api_key:
+        from_secret: GITHUB_TOKEN
+      repo: the-luap/picpeak
+      title: "PicPeak ${DRONE_TAG}"
+      note: |
+        # PicPeak ${DRONE_TAG}
+        
+        ## 🐳 Docker Images
+        
+        This release includes Docker images published to GitHub Container Registry:
+        
+        ```bash
+        # Backend
+        docker pull ghcr.io/the-luap/picpeak-backend:${DRONE_TAG}
+        docker pull ghcr.io/the-luap/picpeak-backend:latest
+        
+        # Frontend
+        docker pull ghcr.io/the-luap/picpeak-frontend:${DRONE_TAG}
+        docker pull ghcr.io/the-luap/picpeak-frontend:latest
+        ```
+        
+        ## 📦 What's New
+        
+        See the [README](https://github.com/the-luap/picpeak#readme) for features and documentation.
+        
+        ## 🚀 Quick Start
+        
+        ```bash
+        # Clone and deploy
+        git clone https://github.com/the-luap/picpeak.git
+        cd picpeak
+        
+        # Use the tagged version
+        docker-compose -f docker-compose.prod.yml up -d
+        ```
+        
+        ---
+        
+        For detailed deployment instructions, see the [Deployment Guide](https://github.com/the-luap/picpeak/blob/main/DEPLOYMENT.md).
+
 trigger:
  event:
    - tag
@@ -1,280 +0,0 @@
-kind: pipeline
-type: docker
-name: default
-
-trigger:
-  branch:
-    - main
-    - develop
-    - feature/*
-  event:
-    - push
-    - pull_request
-    - tag
-
-volumes:
-  - name: docker
-    host:
-      path: /var/run/docker.sock
-
-steps:
-  # Frontend Tests
-  - name: frontend-test
-    image: node:18-alpine
-    commands:
-      - cd frontend
-      - npm ci --legacy-peer-deps
-      - npm run lint
-      - npm run build
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Backend Tests
-  - name: backend-test
-    image: node:18-alpine
-    commands:
-      - cd backend
-      - npm ci
-      - npm run lint
-      - npm test
-    environment:
-      NODE_ENV: test
-      JWT_SECRET: test-secret
-    when:
-      event:
-        - push
-        - pull_request
-
-  # Build Frontend Docker Image
-  - name: build-frontend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-frontend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: frontend/Dockerfile
-      context: frontend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Build Backend Docker Image
-  - name: build-backend
-    image: plugins/docker
-    settings:
-      repo: registry.local.nothaft.cloud/wedding-photo-sharing-backend
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA:0:8}
-        - ${DRONE_TAG}
-      dockerfile: backend/Dockerfile
-      context: backend
-      registry: registry.local.nothaft.cloud
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Security Scan
-  - name: security-scan
-    image: aquasec/trivy:latest
-    commands:
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-frontend:${DRONE_COMMIT_SHA:0:8}
-      - trivy image --exit-code 0 --no-progress registry.local.nothaft.cloud/wedding-photo-sharing-backend:${DRONE_COMMIT_SHA:0:8}
-    environment:
-      DOCKER_HOST: tcp://docker:2375
-    volumes:
-      - name: docker
-        path: /var/run/docker.sock
-    when:
-      branch:
-        - main
-      event:
-        - push
-
-  # Deploy to Staging
-  - name: deploy-staging
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: staging_swarm_host
-      SWARM_USER:
-        from_secret: staging_swarm_user
-      SWARM_KEY:
-        from_secret: staging_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_COMMIT_SHA:0:8}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing
-        EOF
-    when:
-      branch:
-        - develop
-      event:
-        - push
-
-  # Deploy to Production
-  - name: deploy-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-      VERSION: ${DRONE_TAG:-latest}
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=$VERSION
-          
-          # Backup database before deployment
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_db) pg_dump -U postgres wedding_photo_sharing > /backup/db-backup-\$(date +%Y%m%d-%H%M%S).sql
-          
-          # Deploy stack
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-          
-          # Wait for services to be ready
-          sleep 30
-          
-          # Run migrations if needed
-          docker exec \$(docker ps -q -f name=wedding-photo-sharing_backend) npm run migrate
-        EOF
-    when:
-      event:
-        - tag
-
-  # Health Check
-  - name: health-check
-    image: alpine:latest
-    commands:
-      - apk add --no-cache curl
-      - sleep 30
-      - curl -f https://${FRONTEND_HOST}/health || exit 1
-      - curl -f https://${BACKEND_HOST}/api/health || exit 1
-    when:
-      branch:
-        - main
-      event:
-        - push
-        - tag
-
-  # Notification - Success
-  - name: notify-success
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ✅ *Build {{build.number}} succeeded* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        {{#if build.tag}}
-        🏷️ Tag: {{build.tag}}
-        🚀 Deployed to *PRODUCTION*
-        {{else}}
-        📦 Deployed to *{{build.branch}}*
-        {{/if}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - success
-
-  # Notification - Failure
-  - name: notify-failure
-    image: plugins/slack
-    settings:
-      webhook:
-        from_secret: slack_webhook
-      channel: deployments
-      template: |
-        ❌ *Build {{build.number}} failed* for {{repo.name}}
-        
-        Branch: {{build.branch}}
-        Commit: {{build.commit}}
-        Author: {{build.author}}
-        
-        🔗 {{build.link}}
-    when:
-      status:
-        - failure
-
---
-kind: pipeline
-type: docker
-name: rollback
-
-trigger:
-  event:
-    - rollback
-
-steps:
-  - name: rollback-production
-    image: alpine:latest
-    environment:
-      SWARM_HOST:
-        from_secret: prod_swarm_host
-      SWARM_USER:
-        from_secret: prod_swarm_user
-      SWARM_KEY:
-        from_secret: prod_swarm_key
-      REGISTRY_URL:
-        from_secret: docker_registry
-    commands:
-      - apk add --no-cache openssh-client
-      - mkdir -p ~/.ssh
-      - echo "$SWARM_KEY" > ~/.ssh/id_rsa
-      - chmod 600 ~/.ssh/id_rsa
-      - ssh-keyscan -H $SWARM_HOST >> ~/.ssh/known_hosts
-      - |
-        ssh $SWARM_USER@$SWARM_HOST << EOF
-          cd /opt/wedding-photo-sharing
-          export REGISTRY_URL=registry.local.nothaft.cloud
-          export VERSION=${DRONE_ROLLBACK_TO}
-          
-          # Deploy previous version
-          docker stack deploy -c deploy/docker-stack.yml wedding-photo-sharing --with-registry-auth
-        EOF
-
---
-kind: secret
-name: slack_webhook
-get:
-  path: drone/slack
-  name: webhook
@@ -1,26 +1,24 @@
-# Environment Configuration Template
-# Copy this file to .env and adjust values for your environment
+# PicPeak Development Environment Configuration
+# Copy this file to .env for local development

-# Development: Use docker-compose.dev.yml
-# Production: Use docker-compose.prod.yml with .env.production.example
+# SECURITY WARNING: This configuration is for development only!
+# For production, use .env.production.example

-# JWT Secret (CRITICAL for production)
-# Generate with: openssl rand -base64 32
-JWT_SECRET=dev-secret-change-in-production
+# JWT Secret (Change in production!)
+# Generate secure secret with: openssl rand -base64 32
+JWT_SECRET=dev-secret-DO-NOT-USE-IN-PRODUCTION

-# Application URLs
+# Application URLs (Docker Compose development setup)
 ADMIN_URL=http://localhost:3005
 FRONTEND_URL=http://localhost:3005
+BACKEND_URL=http://localhost:3001

-# Database Configuration
-# SQLite is used for development by default
-# For production PostgreSQL config, see .env.production.example
+# Database Configuration (SQLite for development)
 DATABASE_CLIENT=sqlite3
 DATABASE_PATH=./data/photo_sharing.db

-# Email Configuration
-# Development: Uses Mailhog (included in docker-compose.dev.yml)
-# Production: Configure real SMTP server
+# Email Configuration (Mailhog for development)
+# Access Mailhog UI at: http://localhost:8025
 SMTP_HOST=mailhog
 SMTP_PORT=1025
 SMTP_SECURE=false
@@ -28,7 +26,22 @@ SMTP_USER=
 SMTP_PASS=
 EMAIL_FROM=noreply@localhost

-# Optional: Umami Analytics
-UMAMI_URL=
-UMAMI_WEBSITE_ID=
-UMAMI_HASH_SALT=
+# Backend Port Configuration
+PORT=3001
+
+# Optional: Umami Analytics Backend Config
+# NOTE: Primary configuration through Admin UI > Settings > Analytics
+# These are fallback values for server-side tracking
+# UMAMI_URL=https://analytics.example.com
+# UMAMI_WEBSITE_ID=your-website-id
+# UMAMI_HASH_SALT=your-hash-salt
+
+# Development Features
+NODE_ENV=development
+LOG_LEVEL=debug
+
+# Admin Setup Notes:
+# 1. Run 'npm run migrate' in backend folder
+# 2. Admin credentials will be auto-generated
+# 3. Check ADMIN_CREDENTIALS.txt for login details
+# 4. Change password on first login (required)
@@ -1,32 +1,100 @@
-# Production Environment Configuration Template
-# Copy this file to .env and fill in your values
+# PicPeak Production Configuration
+# Copy this file to .env and update with your production values

-# Application URLs
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
+# ============================================
+# CRITICAL SECURITY - MUST CHANGE ALL VALUES!
+# ============================================

-# Security - CRITICAL: Generate a secure random JWT secret
-# You can generate one with: openssl rand -base64 32
-JWT_SECRET=your-secure-random-jwt-secret-here
+# JWT Secret - REQUIRED (minimum 32 characters)
+# Generate with: openssl rand -base64 32
+JWT_SECRET=CHANGE-THIS-PRODUCTION-SECRET-USE-OPENSSL-COMMAND

-# Database Configuration (PostgreSQL)
-DB_USER=picpeak
-DB_PASSWORD=your-secure-database-password
+# Application URLs - REQUIRED (your actual domain)
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com
+ADMIN_URL=https://your-domain.com
+
+# ============================================
+# DATABASE CONFIGURATION - REQUIRED
+# ============================================
+
+# PostgreSQL Configuration (Recommended for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres  # or your database host
+DB_PORT=5432
 DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=CHANGE-THIS-SECURE-DATABASE-PASSWORD

-# Email Configuration
-SMTP_HOST=smtp.gmail.com
+# ============================================
+# EMAIL CONFIGURATION - REQUIRED
+# ============================================
+
+# Example: Gmail with App Password
+# SMTP_HOST=smtp.gmail.com
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=your-email@gmail.com
+# SMTP_PASS=your-16-char-app-password
+# EMAIL_FROM=Your Name <your-email@gmail.com>
+
+# Example: SendGrid
+SMTP_HOST=smtp.sendgrid.net
 SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_SECURE=false
+SMTP_USER=apikey
+SMTP_PASS=YOUR-SENDGRID-API-KEY
+EMAIL_FROM=PicPeak <noreply@your-domain.com>

-# Umami Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-UMAMI_HASH_SALT=your-random-hash-salt
+# ============================================
+# ADMIN SETUP - AUTO-GENERATED
+# ============================================
+# NOTE: Admin credentials are automatically generated during setup
+# DO NOT set ADMIN_EMAIL or ADMIN_PASSWORD anymore!
+# Run 'npm run migrate' and check ADMIN_CREDENTIALS.txt

-# First Admin User (for initial setup)
-# Run: docker-compose exec backend node scripts/create-admin.js --email admin@yourdomain.com
-ADMIN_EMAIL=admin@yourdomain.com
+# ============================================
+# OPTIONAL CONFIGURATION
+# ============================================
+
+# Umami Analytics (Optional - Fallback values)
+# Primary config via Admin UI > Settings > Analytics
+# UMAMI_URL=https://analytics.your-domain.com
+# UMAMI_WEBSITE_ID=your-website-id
+# UMAMI_HASH_SALT=your-hash-salt
+
+# Frontend Analytics (Optional - Fallback values)
+# VITE_UMAMI_URL=https://analytics.your-domain.com
+# VITE_UMAMI_WEBSITE_ID=your-website-id
+# VITE_UMAMI_SHARE_URL=https://analytics.your-domain.com/share/xyz/gallery
+
+# ============================================
+# PERFORMANCE & SECURITY TUNING
+# ============================================
+
+NODE_ENV=production
+PORT=3001
+LOG_LEVEL=info
+
+# Security Settings (Defaults are secure)
+BCRYPT_ROUNDS=12
+SESSION_TIMEOUT_MINUTES=60
+RATE_LIMIT_WINDOW_MS=900000     # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=100      # per window
+
+# Connection Pool (Adjust based on load)
+DB_POOL_MIN=5
+DB_POOL_MAX=25
+
+# ============================================
+# DOCKER COMPOSE SPECIFIC
+# ============================================
+
+# Traefik Configuration (if using Traefik)
+DOMAIN=your-domain.com
+LETSENCRYPT_EMAIL=admin@your-domain.com
+
+# Volume Paths (Docker)
+STORAGE_PATH=/app/storage
+EVENTS_PATH=/app/storage/events
+ARCHIVE_PATH=/app/storage/events/archived
@@ -0,0 +1,12 @@
+# Files to exclude from GitHub mirror
+.env* export-ignore
+docker-compose.prod.yml export-ignore
+.claudedocs/ export-ignore
+backend/data/ export-ignore
+backend/storage/ export-ignore
+backend/.env* export-ignore
+frontend/.env* export-ignore
+secrets/ export-ignore
+*.key export-ignore
+*.pem export-ignore
+.gitea/ export-ignore
@@ -0,0 +1,220 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:  # Allow manual triggering
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository with full history
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0  # Full history needed for finding the commit
+
+      - name: Setup Git
+        run: |
+          git config --global user.name "the-luap"
+          git config --global user.email "paul-nothaft@hotmail.de"
+
+      - name: Debug - Show current branch and status
+        run: |
+          echo "Current branch:"
+          git branch -a
+          echo "Git status:"
+          git status
+          echo "Remote info:"
+          git remote -v
+          echo "Checking target commit exists:"
+          git show --oneline 7aca927937 || echo "Target commit not found!"
+
+      - name: Create completely new history from specific commit
+        run: |
+          TARGET_COMMIT="7aca927937"
+          
+          # Verify the target commit exists
+          if ! git cat-file -e $TARGET_COMMIT^{commit}; then
+            echo "ERROR: Target commit $TARGET_COMMIT does not exist!"
+            exit 1
+          fi
+          
+          echo "✅ Target commit found: $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          # Clean up any existing github-mirror branch
+          git branch -D github-mirror || true
+          
+          # Create a completely new orphan branch (no history)
+          git checkout --orphan github-mirror
+          
+          # Clear the staging area completely
+          git rm -rf . || true
+          
+          # Get the file tree from the target commit and create initial commit
+          echo "Creating new history starting from $TARGET_COMMIT..."
+          git read-tree $TARGET_COMMIT
+          git commit -m "Initial commit - imported from $(git log --oneline -1 $TARGET_COMMIT)"
+          
+          echo "✅ Created new initial commit: $(git log --oneline -1)"
+          
+          # Now get all commits after the target commit and apply their changes
+          COMMITS_AFTER_TARGET=$(git rev-list --reverse --no-merges $TARGET_COMMIT..main)
+          
+          if [ -n "$COMMITS_AFTER_TARGET" ]; then
+            echo "📋 Applying changes from commits after $TARGET_COMMIT (excluding Claude commits):"
+            
+            for commit in $COMMITS_AFTER_TARGET; do
+              # Get the commit author name
+              COMMIT_AUTHOR_NAME=$(git log --format="%an" -n 1 $commit)
+              
+              # Skip commits by Claude
+              if [ "$COMMIT_AUTHOR_NAME" = "Claude" ]; then
+                echo "⚠️ Skipping commit by Claude: $(git log --oneline -1 $commit)"
+                continue
+              fi
+              
+              echo "Processing: $(git log --oneline -1 $commit)"
+              
+              # Get the commit message and author info
+              COMMIT_MSG=$(git log --format="%B" -n 1 $commit)
+              COMMIT_AUTHOR=$(git log --format="%an <%ae>" -n 1 $commit)
+              COMMIT_DATE=$(git log --format="%ad" -n 1 $commit)
+              
+              # Apply the changes from this commit
+              if git diff-tree --no-commit-id --name-only -r $commit | xargs -I {} git show $commit:{} > /dev/null 2>&1; then
+                # Apply file changes
+                git checkout $commit -- . || true
+                
+                # Stage all changes
+                git add -A
+                
+                # Only commit if there are changes
+                if ! git diff --cached --quiet; then
+                  # Create new commit with original metadata but new SHA
+                  GIT_AUTHOR_NAME=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f1 | xargs)
+                  GIT_AUTHOR_EMAIL=$(echo "$COMMIT_AUTHOR" | cut -d'<' -f2 | cut -d'>' -f1)
+                  GIT_AUTHOR_DATE="$COMMIT_DATE"
+                  
+                  export GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_AUTHOR_DATE
+                  git commit -m "$COMMIT_MSG"
+                  echo "✅ Applied changes as new commit: $(git log --oneline -1)"
+                else
+                  echo "⚠️ No changes to commit for $commit"
+                fi
+              else
+                echo "⚠️ Skipping problematic commit $commit"
+              fi
+            done
+            
+            echo "✅ Finished creating new history"
+          else
+            echo "✅ No commits after target commit - history starts fresh"
+          fi
+          
+          echo ""
+          echo "=== New History Summary ==="
+          echo "Total commits in new history: $(git rev-list --count github-mirror)"
+          echo "History starts with: $(git log --oneline --reverse | head -1)"
+          echo "Latest commit: $(git log --oneline -1)"
+
+      - name: Remove sensitive files and directories
+        run: |
+          # Switch to the github-mirror branch
+          git checkout github-mirror
+          
+          echo "Current files before cleanup:"
+          ls -la | head -10 || true
+          echo "..."
+          
+          # Remove sensitive files/directories if they exist
+          echo "Removing sensitive files..."
+          rm -rf .env || true
+          rm -rf backend/.env* || true
+          rm -rf frontend/.env* || true
+          rm -rf docker-compose.prod.yml || true
+          rm -rf .claudedocs/ || true
+          rm -rf backend/data/ || true
+          rm -rf backend/storage/ || true
+          rm -rf .gitea/ || true
+          rm -rf scripts/install-gitea-runner.sh || true
+          rm -rf .drone* || true
+          rm -rf .github-mirror-exclude || true
+          rm -rf .gitattributes-github || true
+          rm -rf photo-sharing-prd.md || true
+          rm -rf CLAUDE.md || true
+          rm -rf PRODUCTION_DEPLOYMENT_GUIDE.md || true
+          rm -rf logs/ || true
+          rm -rf frontend/.claudedocs/ || true
+          rm -rf test-maintenance.sh || true
+          rm -rf storage/ || true
+          
+          echo "Sensitive files removal completed"
+          
+          # Add and commit the cleanup if there are changes
+          git add -A
+          if ! git diff --cached --quiet; then
+            git commit -m "chore: remove sensitive files for GitHub mirror"
+            echo "✅ Committed cleanup of sensitive files"
+          else
+            echo "✅ No sensitive files to remove"
+          fi
+          
+          echo "Final file structure (top level):"
+          ls -la | head -10 || true
+
+      - name: Verify completely new history
+        run: |
+          git checkout github-mirror
+          echo "=== Final History Verification ==="
+          echo "Total commits in new github-mirror branch: $(git rev-list --count github-mirror)"
+          echo ""
+          echo "Complete commit history (should start from target commit content):"
+          git log --oneline --reverse
+          echo ""
+          echo "⚠️ Note: This is a completely NEW history with new commit SHAs"
+          echo "🔍 Original target commit content preserved but with new commit ID"
+
+      - name: Check GitHub token
+        env:
+          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
+        run: |
+          if [ -z "$GITHUBTOKEN" ]; then
+            echo "ERROR: GITHUBTOKEN secret is not set!"
+            exit 1
+          else
+            echo "GitHub token is available (length: ${#GITHUBTOKEN})"
+          fi
+
+      - name: Force push completely new history to GitHub
+        env:
+          GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}
+        run: |
+          # Switch to github-mirror branch
+          git checkout github-mirror
+          
+          # Remove existing github remote if it exists
+          git remote remove github || true
+          
+          # Add GitHub remote
+          git remote add github https://x-access-token:${GITHUBTOKEN}@github.com/the-luap/picpeak.git
+          
+          # Verify remote was added
+          echo "GitHub remote added:"
+          git remote -v
+          
+          # Force push the completely new history to GitHub main
+          echo "🔥 FORCE PUSHING completely new history to GitHub..."
+          echo "⚠️ This will COMPLETELY REPLACE all history on GitHub!"
+          git push github github-mirror:main --force
+          echo "✅ Force push completed - GitHub now has completely new history!"
+
+      - name: Workflow completed
+        run: |
+          echo "✅ Mirror to GitHub workflow completed successfully!"
+          echo "🔥 COMPLETE HISTORY REPLACEMENT: GitHub now has entirely new history"
+          echo "📊 History starts from commit content: 7aca927937"
+          echo "🔍 Check https://github.com/the-luap/picpeak to verify the new history"
+          echo "📈 Total commits pushed: $(git rev-list --count github-mirror)"
+          echo "🆕 All commit SHAs are NEW - no connection to previous history"
@@ -14,6 +14,7 @@ jobs:
    outputs:
      new_version: ${{ steps.version.outputs.new_version }}
      version_changed: ${{ steps.version.outputs.version_changed }}
+      component_changed: ${{ steps.version.outputs.component_changed }}
    steps:
      - uses: actions/checkout@v3
        with:
@@ -30,15 +31,104 @@ jobs:
          git config --global user.name 'Gitea Actions Bot'
          git config --global user.email 'actions@gitea.local'
      
-      - name: Bump version
+      - name: Detect changes and bump version
        id: version
        run: |
-          # Get current version from backend package.json
-          CURRENT_VERSION=$(node -p "require('./backend/package.json').version")
-          echo "Current version: $CURRENT_VERSION"
+          set -e  # Exit on error
          
-          # Split version into parts
-          IFS='.' read -r -a version_parts <<< "$CURRENT_VERSION"
+          echo "=== Debug Info ==="
+          echo "GitHub event before: ${{ github.event.before }}"
+          echo "GitHub SHA: ${{ github.sha }}"
+          echo "Current directory: $(pwd)"
+          echo "Git log (last 5): $(git log --oneline -5)"
+          
+          # Get the commit range for changed files
+          if [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ] && [ "${{ github.event.before }}" != "" ]; then
+            COMMIT_RANGE="${{ github.event.before }}..${{ github.sha }}"
+            echo "Using commit range: $COMMIT_RANGE"
+            CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
+          else
+            # First commit or no previous commit, check against HEAD~1 if it exists
+            if git rev-parse HEAD~1 >/dev/null 2>&1; then
+              COMMIT_RANGE="HEAD~1..HEAD"
+              echo "Using commit range: $COMMIT_RANGE"
+              CHANGED_FILES=$(git diff --name-only $COMMIT_RANGE || echo "")
+            else
+              echo "First commit detected, checking all files"
+              CHANGED_FILES=$(git ls-files)
+            fi
+          fi
+          
+          echo "Changed files:"
+          echo "$CHANGED_FILES"
+          
+          # Check what changed (using echo to pipe to grep to avoid grep exit codes)
+          BACKEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^backend/' || echo "0")
+          FRONTEND_CHANGED=$(echo "$CHANGED_FILES" | grep -c '^frontend/' || echo "0")
+          ROOT_CHANGED=$(echo "$CHANGED_FILES" | grep -c -E '^(package\.json|docker-compose|Dockerfile|scripts/)' || echo "0")
+          
+          echo "Backend files changed: $BACKEND_CHANGED"
+          echo "Frontend files changed: $FRONTEND_CHANGED"
+          echo "Root files changed: $ROOT_CHANGED"
+          
+          # Get current versions
+          BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "1.0.0")
+          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "1.0.0")
+          
+          echo "Current backend version: $BACKEND_VERSION"
+          echo "Current frontend version: $FRONTEND_VERSION"
+          
+          # Determine what to update based on changes
+          BACKEND_UPDATE=false
+          FRONTEND_UPDATE=false
+          COMPONENT_CHANGED="none"
+          
+          if [ "$ROOT_CHANGED" -gt 0 ]; then
+            # Root changes affect both components
+            BACKEND_UPDATE=true
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="both"
+            SOURCE_VERSION=$BACKEND_VERSION
+            echo "Root changes detected - updating both components"
+          elif [ "$BACKEND_CHANGED" -gt 0 ] && [ "$FRONTEND_CHANGED" -gt 0 ]; then
+            # Both components changed
+            BACKEND_UPDATE=true
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="both"
+            # Use the higher version as source
+            if [ "$(printf '%s\n' "$BACKEND_VERSION" "$FRONTEND_VERSION" | sort -V | tail -n1)" = "$BACKEND_VERSION" ]; then
+              SOURCE_VERSION=$BACKEND_VERSION
+            else
+              SOURCE_VERSION=$FRONTEND_VERSION
+            fi
+            echo "Both backend and frontend changed - updating both"
+          elif [ "$BACKEND_CHANGED" -gt 0 ]; then
+            # Only backend changed
+            BACKEND_UPDATE=true
+            COMPONENT_CHANGED="backend"
+            SOURCE_VERSION=$BACKEND_VERSION
+            echo "Only backend changed - updating backend"
+          elif [ "$FRONTEND_CHANGED" -gt 0 ]; then
+            # Only frontend changed
+            FRONTEND_UPDATE=true
+            COMPONENT_CHANGED="frontend"
+            SOURCE_VERSION=$FRONTEND_VERSION
+            echo "Only frontend changed - updating frontend"
+          else
+            echo "No relevant changes detected"
+            echo "version_changed=false" >> $GITHUB_OUTPUT
+            echo "component_changed=none" >> $GITHUB_OUTPUT
+            echo "new_version=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          
+          echo "Component changed: $COMPONENT_CHANGED"
+          echo "Source version: $SOURCE_VERSION"
+          echo "Backend update: $BACKEND_UPDATE"
+          echo "Frontend update: $FRONTEND_UPDATE"
+          
+          # Calculate new version
+          IFS='.' read -r -a version_parts <<< "$SOURCE_VERSION"
          MAJOR="${version_parts[0]}"
          MINOR="${version_parts[1]}"
          PATCH="${version_parts[2]}"
@@ -49,14 +139,23 @@ jobs:
          
          echo "New version: $NEW_VERSION"
          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "component_changed=$COMPONENT_CHANGED" >> $GITHUB_OUTPUT
          
-          # Update version in package.json files
-          cd backend && npm version $NEW_VERSION --no-git-tag-version
-          cd ../frontend && npm version $NEW_VERSION --no-git-tag-version
-          cd ..
+          # Update versions in package.json files
+          if [ "$BACKEND_UPDATE" = true ]; then
+            echo "Updating backend version to $NEW_VERSION"
+            cd backend && npm version $NEW_VERSION --no-git-tag-version
+            cd ..
+          fi
          
-          # Check if there are changes
-          if [[ -n $(git status -s) ]]; then
+          if [ "$FRONTEND_UPDATE" = true ]; then
+            echo "Updating frontend version to $NEW_VERSION"
+            cd frontend && npm version $NEW_VERSION --no-git-tag-version
+            cd ..
+          fi
+          
+          # Check if there are changes to commit
+          if [[ -n $(git status --porcelain) ]]; then
            echo "version_changed=true" >> $GITHUB_OUTPUT
          else
            echo "version_changed=false" >> $GITHUB_OUTPUT
@@ -65,15 +164,94 @@ jobs:
      - name: Commit version bump
        if: steps.version.outputs.version_changed == 'true'
        run: |
-          git add backend/package.json backend/package-lock.json
-          git add frontend/package.json frontend/package-lock.json
-          git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }}"
-          git push
+          set -e  # Exit on any error
+          
+          # First, ensure we have the latest changes
+          echo "Fetching latest changes..."
+          git fetch origin main
+          
+          # Check if we're behind and need to update
+          LOCAL=$(git rev-parse HEAD)
+          REMOTE=$(git rev-parse origin/main)
+          
+          if [ "$LOCAL" != "$REMOTE" ]; then
+            echo "Local is behind remote, pulling changes..."
+            git pull origin main --no-rebase
+          fi
+          
+          COMPONENT="${{ steps.version.outputs.component_changed }}"
+          
+          if [ "$COMPONENT" = "both" ]; then
+            git add backend/package.json backend/package-lock.json frontend/package.json frontend/package-lock.json
+            git commit -m "chore: bump version to ${{ steps.version.outputs.new_version }} (backend + frontend)"
+          elif [ "$COMPONENT" = "backend" ]; then
+            git add backend/package.json backend/package-lock.json
+            git commit -m "chore: bump backend version to ${{ steps.version.outputs.new_version }}"
+          elif [ "$COMPONENT" = "frontend" ]; then
+            git add frontend/package.json frontend/package-lock.json
+            git commit -m "chore: bump frontend version to ${{ steps.version.outputs.new_version }}"
+          fi
+          
+          # Pull latest changes before pushing to avoid conflicts
+          echo "Pulling latest changes from origin/main..."
+          if ! git pull --rebase origin main; then
+            echo "Rebase failed, attempting to resolve..."
+            # If rebase fails, abort and try a regular merge
+            git rebase --abort || true
+            git pull origin main --no-rebase
+          fi
+          
+          # Push the changes with retry logic
+          echo "Pushing version bump..."
+          PUSH_SUCCESS=false
+          
+          for i in 1 2 3; do
+            echo "Push attempt $i of 3..."
+            
+            # Try to push
+            if git push origin main 2>&1; then
+              echo "Successfully pushed version bump on attempt $i"
+              PUSH_SUCCESS=true
+              break
+            else
+              echo "Push failed on attempt $i"
+              
+              if [ $i -lt 3 ]; then
+                echo "Waiting 5 seconds before retry..."
+                sleep 5
+                
+                echo "Pulling latest changes..."
+                git fetch origin main
+                
+                # Try rebase first, fall back to merge
+                if ! git rebase origin/main; then
+                  echo "Rebase failed, trying merge..."
+                  git rebase --abort 2>/dev/null || true
+                  git pull origin main --no-rebase
+                fi
+              fi
+            fi
+          done
+          
+          if [ "$PUSH_SUCCESS" = "false" ]; then
+            echo "ERROR: Failed to push after 3 attempts"
+            exit 1
+          fi
      
      - name: Create Git tag
        if: steps.version.outputs.version_changed == 'true'
        run: |
-          git tag -a "v${{ steps.version.outputs.new_version }}" -m "Release v${{ steps.version.outputs.new_version }}"
+          COMPONENT="${{ steps.version.outputs.component_changed }}"
+          
+          if [ "$COMPONENT" = "both" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend + frontend)"
+          elif [ "$COMPONENT" = "backend" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (backend)"
+          elif [ "$COMPONENT" = "frontend" ]; then
+            TAG_MESSAGE="Release v${{ steps.version.outputs.new_version }} (frontend)"
+          fi
+          
+          git tag -a "v${{ steps.version.outputs.new_version }}" -m "$TAG_MESSAGE"
          git push origin "v${{ steps.version.outputs.new_version }}"
  
  trigger-drone:
@@ -84,5 +262,6 @@ jobs:
      - name: Trigger Drone Build
        run: |
          echo "Version bumped to ${{ needs.version-bump.outputs.new_version }}"
+          echo "Component(s) changed: ${{ needs.version-bump.outputs.component_changed }}"
          echo "Drone will automatically trigger on the new tag"
          # Drone CI will automatically trigger on the tag push event
@@ -0,0 +1,24 @@
+# Exclude patterns for GitHub mirror
+.env
+.env.*
+.env*
+docker-compose.prod.yml
+docker-compose.traefik.yml
+.claudedocs/
+backend/data/
+backend/storage/
+backend/.env*
+frontend/.env*
+secrets/
+*.key
+*.pem
+.gitea/
+node_modules/
+dist/
+build/
+*.log
+.DS_Store
+deploy/
+certbot/
+nginx/
+photo-sharing-prd.md
@@ -0,0 +1,47 @@
+---
+name: Bug report
+about: Create a report to help us improve PicPeak
+title: '[BUG] '
+labels: 'bug'
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Environment (please complete the following information):**
+ - OS: [e.g. Ubuntu 22.04]
+ - Browser: [e.g. Chrome 120, Safari 17]
+ - PicPeak Version: [e.g. 1.0.22]
+ - Deployment Method: [e.g. Docker Compose, Manual]
+ - Database: [e.g. PostgreSQL 15, SQLite]
+
+**Logs**
+Please include relevant logs:
+```
+# Backend logs
+docker-compose logs backend | tail -50
+
+# Frontend console errors
+[paste any browser console errors]
+```
+
+**Additional context**
+Add any other context about the problem here.
+
+**Possible Solution**
+If you have an idea how to fix the issue, please describe it here.
@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: 📚 Documentation
+    url: https://github.com/the-luap/picpeak/blob/main/DEPLOYMENT.md
+    about: Please read the documentation before opening an issue
+  - name: 💬 Discussions
+    url: https://github.com/the-luap/picpeak/discussions
+    about: Ask questions and discuss with the community
+  - name: 🔒 Security Issues
+    url: https://github.com/the-luap/picpeak/blob/main/SECURITY.md
+    about: Please review our security policy for reporting vulnerabilities
@@ -0,0 +1,33 @@
+---
+name: Documentation
+about: Report issues or improvements needed in documentation
+title: '[DOCS] '
+labels: 'documentation'
+assignees: ''
+
+---
+
+**What documentation needs improvement?**
+Please specify which document or section needs attention:
+- [ ] README.md
+- [ ] DEPLOYMENT.md
+- [ ] CONTRIBUTING.md
+- [ ] API Documentation
+- [ ] Code Comments
+- [ ] Other: ___________
+
+**Describe the issue**
+What's wrong or missing in the documentation?
+
+**Suggested improvement**
+How would you improve this documentation?
+
+**Target audience**
+Who is this documentation for?
+- [ ] New users setting up PicPeak
+- [ ] Developers contributing to the project
+- [ ] System administrators
+- [ ] End users (photographers/clients)
+
+**Additional context**
+Add any other context, examples, or references here.
@@ -0,0 +1,38 @@
+---
+name: Feature request
+about: Suggest an idea for PicPeak
+title: '[FEATURE] '
+labels: 'enhancement'
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Use Case**
+Please describe how this feature would be used:
+- Who would use it? (photographers, clients, admins)
+- When would they use it?
+- Why is it important?
+
+**Similar Features**
+Are there similar features in:
+- PicDrop
+- Scrapbook.de
+- Other photo sharing platforms
+
+**Mockups or Examples**
+If applicable, add mockups, diagrams, or links to similar implementations.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
+
+**Implementation Ideas**
+If you have technical ideas about how this could be implemented, please share them.
@@ -0,0 +1,26 @@
+---
+name: Question
+about: Ask a question about PicPeak
+title: '[QUESTION] '
+labels: 'question'
+assignees: ''
+
+---
+
+**Question**
+What would you like to know about PicPeak?
+
+**Context**
+Please provide context to help us answer your question better:
+- What are you trying to achieve?
+- What have you already tried?
+- Which documentation have you consulted?
+
+**Environment**
+If relevant to your question:
+- PicPeak Version:
+- Deployment Method:
+- Operating System:
+
+**Related Issues or Discussions**
+Link to any related issues, discussions, or documentation.
@@ -0,0 +1,37 @@
+---
+name: Security Vulnerability
+about: Report security issues privately
+title: '[SECURITY] '
+labels: 'security'
+assignees: ''
+
+---
+
+⚠️ **IMPORTANT: For serious security vulnerabilities, please DO NOT create a public issue.**
+
+Instead, please email security@example.com with the details.
+
+For minor security improvements or questions, you can use this template:
+
+**Type of Security Issue**
+- [ ] Authentication/Authorization
+- [ ] Data Exposure
+- [ ] Input Validation
+- [ ] Configuration Issue
+- [ ] Dependency Vulnerability
+- [ ] Other: ___________
+
+**Description**
+Brief description of the security concern.
+
+**Impact**
+What could an attacker potentially do?
+
+**Steps to Reproduce**
+If applicable, how can this be reproduced?
+
+**Suggested Fix**
+If you have ideas on how to fix this issue.
+
+**References**
+Any relevant security advisories, CVEs, or documentation.
@@ -0,0 +1,49 @@
+## Description
+
+Please include a summary of the changes and which issue is fixed. Include relevant motivation and context.
+
+Fixes # (issue)
+
+## Type of change
+
+Please delete options that are not relevant.
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Documentation update
+- [ ] Performance improvement
+- [ ] Code refactoring
+
+## How Has This Been Tested?
+
+Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce.
+
+- [ ] Unit tests pass (`npm test`)
+- [ ] Manual testing completed
+- [ ] Tested on Docker deployment
+- [ ] Tested on production-like environment
+
+**Test Configuration**:
+* PicPeak Version:
+* Node.js Version:
+* Database: PostgreSQL / SQLite
+* Browser:
+
+## Checklist:
+
+- [ ] My code follows the style guidelines of this project
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes
+- [ ] Any dependent changes have been merged and published
+- [ ] I have updated the CHANGELOG.md file
+
+## Screenshots (if appropriate):
+
+## Additional Notes:
+
+Add any additional notes, concerns, or discussion points here.
@@ -1,108 +0,0 @@
-name: Create Release
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'frontend/package.json'
-      - 'backend/package.json'
-
-jobs:
-  check-version-change:
-    runs-on: ubuntu-latest
-    outputs:
-      version_changed: ${{ steps.check.outputs.changed }}
-      new_version: ${{ steps.check.outputs.version }}
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Check if version changed
-        id: check
-        run: |
-          # Get current versions
-          FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version")
-          BACKEND_VERSION=$(node -p "require('./backend/package.json').version")
-          
-          # Get previous versions
-          git checkout HEAD~1
-          PREV_FRONTEND_VERSION=$(node -p "require('./frontend/package.json').version" 2>/dev/null || echo "0.0.0")
-          PREV_BACKEND_VERSION=$(node -p "require('./backend/package.json').version" 2>/dev/null || echo "0.0.0")
-          
-          # Check if versions changed
-          if [[ "$FRONTEND_VERSION" != "$PREV_FRONTEND_VERSION" ]] || [[ "$BACKEND_VERSION" != "$PREV_BACKEND_VERSION" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-            echo "version=$FRONTEND_VERSION" >> $GITHUB_OUTPUT
-          else
-            echo "changed=false" >> $GITHUB_OUTPUT
-          fi
-
-  create-release:
-    needs: check-version-change
-    if: needs.check-version-change.outputs.version_changed == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Generate Changelog
-        id: changelog
-        run: |
-          # Get commits since last tag
-          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
-          if [[ -z "$LAST_TAG" ]]; then
-            COMMITS=$(git log --oneline)
-          else
-            COMMITS=$(git log ${LAST_TAG}..HEAD --oneline)
-          fi
-          
-          # Format changelog
-          echo "## What's Changed" > changelog.md
-          echo "" >> changelog.md
-          
-          # Group commits by type
-          echo "### Features" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ feat:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No new features*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Bug Fixes" >> changelog.md
-          echo "$COMMITS" | grep -E "^[a-f0-9]+ fix:" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No bug fixes*" >> changelog.md
-          
-          echo "" >> changelog.md
-          echo "### Other Changes" >> changelog.md
-          echo "$COMMITS" | grep -vE "^[a-f0-9]+ (feat|fix):" | sed 's/^[a-f0-9]+ /- /' >> changelog.md || echo "*No other changes*" >> changelog.md
-          
-          # Save changelog
-          echo "changelog<<EOF" >> $GITHUB_OUTPUT
-          cat changelog.md >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v1
-        with:
-          tag_name: v${{ needs.check-version-change.outputs.new_version }}
-          name: Release v${{ needs.check-version-change.outputs.new_version }}
-          body: |
-            ## PicPeak v${{ needs.check-version-change.outputs.new_version }}
-            
-            ${{ steps.changelog.outputs.changelog }}
-            
-            ### Docker Images
-            
-            To use this release with Docker:
-            ```bash
-            docker pull ghcr.io/${{ github.repository }}/frontend:v${{ needs.check-version-change.outputs.new_version }}
-            docker pull ghcr.io/${{ github.repository }}/backend:v${{ needs.check-version-change.outputs.new_version }}
-            ```
-            
-            Or use the `latest` tag for the most recent version.
-          draft: false
-          prerelease: false
-          generate_release_notes: true
@@ -1,107 +0,0 @@
-name: Automatic Version Bump
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      version_type:
-        description: 'Version bump type'
-        required: true
-        default: 'patch'
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          
-      - name: Configure Git
-        run: |
-          git config --global user.name "GitHub Actions Bot"
-          git config --global user.email "actions@github.com"
-
-      - name: Determine version type
-        id: version_type
-        run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            echo "type=${{ github.event.inputs.version_type }}" >> $GITHUB_OUTPUT
-          else
-            # Auto-detect version type based on commit message
-            COMMIT_MSG="${{ github.event.head_commit.message }}"
-            if [[ "$COMMIT_MSG" == *"BREAKING CHANGE"* ]] || [[ "$COMMIT_MSG" == *"!"* ]]; then
-              echo "type=major" >> $GITHUB_OUTPUT
-            elif [[ "$COMMIT_MSG" == *"feat:"* ]] || [[ "$COMMIT_MSG" == *"feat("* ]]; then
-              echo "type=minor" >> $GITHUB_OUTPUT
-            else
-              echo "type=patch" >> $GITHUB_OUTPUT
-            fi
-          fi
-
-      - name: Bump Frontend Version
-        id: frontend_version
-        working-directory: ./frontend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          
-      - name: Bump Backend Version
-        id: backend_version
-        working-directory: ./backend
-        run: |
-          npm version ${{ steps.version_type.outputs.type }} --no-git-tag-version
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
-
-      - name: Update Frontend VersionInfo component
-        run: |
-          VERSION=${{ steps.frontend_version.outputs.version }}
-          sed -i "s/const FRONTEND_VERSION = '[^']*'/const FRONTEND_VERSION = '$VERSION'/" frontend/src/components/admin/VersionInfo.tsx
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          title: "chore: bump version to ${{ steps.frontend_version.outputs.version }}"
-          body: |
-            ## Version Bump
-            
-            This PR automatically bumps the version numbers:
-            - Frontend: `${{ steps.frontend_version.outputs.version }}`
-            - Backend: `${{ steps.backend_version.outputs.version }}`
-            
-            ### Version Type: ${{ steps.version_type.outputs.type }}
-            
-            ### Files Changed:
-            - `frontend/package.json`
-            - `backend/package.json`
-            - `frontend/src/components/admin/VersionInfo.tsx`
-            
-            ---
-            *This PR was automatically created by the version bump workflow.*
-          branch: version-bump-${{ steps.frontend_version.outputs.version }}
-          delete-branch: true
-          labels: |
-            version-bump
-            automated
@@ -54,3 +54,5 @@ coverage/
 !storage/thumbnails/.gitkeep
 !data/.gitkeep
 !logs/.gitkeep
+
+PRODUCTION_DEPLOYMENT_GUIDE.md
@@ -0,0 +1,152 @@
+# Backup Version Tracking Implementation
+
+## Overview
+Version tracking has been added to the backup system to ensure safe restoration by tracking application versions, Node.js versions, and database schema versions at the time of backup.
+
+## Implementation Details
+
+### 1. Database Schema Changes (Migration 034)
+
+Added version tracking columns to backup tables:
+
+#### `database_backup_runs` table:
+- `app_version` - Application version from package.json
+- `node_version` - Node.js runtime version
+- `db_schema_version` - Latest migration name
+- `environment_info` - JSON with additional environment details
+
+#### `backup_runs` table:
+- `app_version` - Application version
+- `node_version` - Node.js version
+- `db_schema_version` - Database schema version
+- `manifest_info` - Summary of manifest information
+
+#### New `restore_history` table:
+Tracks all restore attempts with comprehensive version information:
+- Backup versions vs current versions
+- Compatibility check results
+- Warnings and errors
+- Restore outcome
+
+### 2. Version Information Captured
+
+During each backup, the system now records:
+- **Application Version**: From `package.json` (e.g., "1.0.77")
+- **Node.js Version**: Runtime version (e.g., "v18.17.0")
+- **Database Schema**: Latest migration file (e.g., "034_add_version_to_backups.js")
+- **Environment Info**: Platform, architecture, environment mode
+
+### 3. Backup Services Updated
+
+#### Database Backup Service (`databaseBackup.js`):
+- Records version info when creating backups
+- Includes versions in statistics JSON
+- New method: `checkVersionCompatibility()` for restore safety
+- New method: `getCurrentSchemaVersion()` to track migrations
+
+#### File Backup Service (`backupService.js`):
+- Records version info in backup_runs table
+- Integrates with manifest system
+- Stores manifest summary with version details
+
+### 4. Existing Manifest System
+
+The `backupManifest.js` already provides comprehensive version tracking:
+- Application version and Node.js version
+- System information (OS, platform, architecture)
+- Database schema version
+- Detailed file and database metadata
+
+### 5. Version Compatibility Checking
+
+When restoring, the system can now:
+- Compare backup version vs current version
+- Detect major/minor version differences
+- Identify schema mismatches
+- Provide warnings and recommendations
+
+### 6. Configuration Settings
+
+New backup settings for version control:
+- `backup_require_version_match` - Enforce exact version matching
+- `backup_allow_minor_version_mismatch` - Allow same major version
+- `backup_warn_on_version_mismatch` - Show warnings on mismatch
+- `backup_check_schema_compatibility` - Validate schema versions
+
+## Usage
+
+### Creating Backups
+Backups automatically capture version information - no changes needed to existing backup workflows.
+
+### Checking Version Before Restore
+
+1. **For Database Backups**:
+```javascript
+const compatibility = await databaseBackupService.checkVersionCompatibility({
+  app_version: '1.0.75',
+  node_version: 'v16.14.0',
+  db_schema_version: '032_add_feedback.js'
+});
+
+if (!compatibility.compatible) {
+  console.error('Version mismatch:', compatibility.errors);
+}
+```
+
+2. **For File Backups**:
+Check the manifest file which contains all version information:
+```bash
+cat /backup/path/manifest-backup-20250122-123456.json | jq '.application'
+```
+
+### Restore History
+All restore attempts are logged in the `restore_history` table with:
+- Version compatibility results
+- Warnings encountered
+- Success/failure status
+- Who performed the restore
+
+## Best Practices
+
+1. **Always Check Compatibility**: Before restoring, verify version compatibility
+2. **Document Version Changes**: Keep changelog updated with breaking changes
+3. **Test Restores**: Regularly test restore procedures in staging
+4. **Monitor Warnings**: Even if compatible, review warnings before proceeding
+5. **Keep Backups Organized**: Label backups with version info in filename
+
+## Migration Instructions
+
+1. Run the new migration:
+```bash
+cd backend
+npm run migrate
+```
+
+2. Existing backups will show "unknown" for version fields
+3. New backups will automatically include version information
+4. The system remains backward compatible with old backups
+
+## Troubleshooting
+
+### Version Mismatch Errors
+- Check current app version: `cat backend/package.json | grep version`
+- Check Node version: `node --version`
+- Check latest migration: `SELECT name FROM knex_migrations ORDER BY id DESC LIMIT 1`
+
+### Restore Failures
+- Review `restore_history` table for detailed error messages
+- Check version compatibility warnings
+- Consider using same version environment for critical restores
+
+## Future Enhancements
+
+1. **Automated Version Matching**: Docker containers with specific versions
+2. **Migration Rollback**: Support for downgrading schema safely
+3. **Version Matrix**: Compatibility matrix for different version combinations
+4. **Restore Wizard**: UI for guided restore with compatibility checks
+
+---
+
+**Implementation Date**: January 2025
+**Current Version**: 1.0.77
+**Status**: Production Ready
@@ -1,118 +0,0 @@
-# CI/CD Strategy for PicPeak
-
-## Overview
-
-This document outlines the CI/CD strategy using both Gitea Actions and Drone CI to avoid conflicts and ensure proper versioning.
-
-## Pipeline Flow
-
-### 1. Development & Testing (Gitea Actions)
- **Trigger**: Every push to `main` or `develop` branches
- **File**: `.gitea/workflows/test.yml`
- **Purpose**: Run tests, linting, and basic validation
- **Actions**:
-  - Backend linting and tests
-  - Frontend linting and build
-  - Does NOT build Docker images
-
-### 2. Version Management (Gitea Actions)
- **Trigger**: Push to `main` branch (excluding markdown files)
- **File**: `.gitea/workflows/version-and-release.yml`
- **Purpose**: Automatic version incrementing
- **Actions**:
-  1. Reads current version from `package.json`
-  2. Increments patch version (e.g., 1.0.0 → 1.0.1)
-  3. Updates both backend and frontend `package.json`
-  4. Commits the version change
-  5. Creates a git tag (e.g., `v1.0.1`)
-  6. Pushes changes and tag
-
-### 3. Docker Image Building (Drone CI)
- **Trigger**: 
-  - Push to `main` or `develop` (builds with commit SHA)
-  - New git tags (builds release versions)
- **File**: `.drone.yml`
- **Purpose**: Build and push Docker images
- **Tags Created**:
-  - `latest` - Always points to newest build
-  - `{commit-sha}` - Specific commit version
-  - `{branch}-latest` - Latest for specific branch
-  - `v1.0.1` - Specific version (on tag trigger)
-
-## Why This Strategy?
-
-1. **Separation of Concerns**:
-   - Gitea Actions handles code quality and versioning
-   - Drone CI handles Docker image building
-   - No overlap or race conditions
-
-2. **Sequential Execution**:
-   - Version bump happens first
-   - Tag creation triggers Drone
-   - Docker images are built with correct version
-
-3. **Version Consistency**:
-   - Version in `package.json` matches git tag
-   - Docker images are tagged with same version
-   - No manual version management needed
-
-## Setup Requirements
-
-1. **Gitea Actions Runner**: Must be configured and running
-2. **Drone CI**: Must be connected to your Gitea instance
-3. **Secrets**: 
-   - `GITEA_TOKEN` (optional, for pushing version commits)
-   - Docker registry credentials in Drone
-
-## Version Numbering
-
- Format: `MAJOR.MINOR.PATCH` (e.g., 1.0.0)
- Automatic increments: PATCH version only
- Manual increments: Edit `package.json` for MAJOR/MINOR changes
-
-## Usage
-
-1. **Regular Development**:
-   ```bash
-   git add .
-   git commit -m "feat: add new feature"
-   git push origin main
-   ```
-   - Tests run automatically
-   - Version bumps to 1.0.1
-   - Docker images built with v1.0.1 tag
-
-2. **Major/Minor Version Change**:
-   ```bash
-   # Manually edit package.json files to 2.0.0
-   git add .
-   git commit -m "feat!: major release"
-   git push origin main
-   ```
-
-3. **Skip Version Bump**:
-   - Add `[skip ci]` to commit message
-   - Or only change markdown files
-
-## Monitoring
-
- **Gitea Actions**: Check Actions tab in Gitea
- **Drone CI**: Check Drone dashboard
- **Docker Registry**: Verify images are pushed with correct tags
-
-## Troubleshooting
-
-1. **Version not incrementing**:
-   - Check Gitea Actions logs
-   - Ensure runner has push permissions
-   - Verify no `[skip ci]` in commit message
-
-2. **Docker images not building**:
-   - Check Drone CI webhook configuration
-   - Verify Drone can see the repository
-   - Check Docker registry credentials
-
-3. **Conflicts**:
-   - Never run both pipelines for same task
-   - Use branch protection to prevent direct pushes
-   - Always let automation handle versioning
@@ -39,6 +39,12 @@ docker-compose -f docker-compose.prod.yml up -d  # Production deployment
 pm2 start ecosystem.config.js                     # Alternative: PM2 deployment
 ```

+**⚠️ CRITICAL PRODUCTION NOTICE:**
+- Production runs on a SEPARATE SERVER - never assume local changes affect production
+- ALWAYS request production server details before any troubleshooting
+- NO trial-and-error approaches in production - data loss is unacceptable
+- Every change must be thoroughly analyzed and tested locally first
+
 ## Key Product Requirements (from PRD)

 ### Core Features
@@ -111,6 +117,7 @@ Background services run as separate processes:
 - **archiveService**: Creates ZIP archives of expired events
 - **expirationChecker**: Cron job for expiration warnings
 - **fileWatcher**: Monitors for new photo uploads
+- **backupService**: Scheduled backups with checksum-based change detection

 ### API Structure
 - `/api/admin/*` - Admin panel endpoints (requires adminAuth)
@@ -127,6 +134,41 @@ Background services run as separate processes:
 5. **Frontend Status**: Only skeleton exists - requires full implementation based on PRD
 6. **Umami Analytics**: Track password entries, downloads, views, expiration warnings

+## Troubleshooting Guidelines
+
+### Before ANY Production Troubleshooting:
+1. **ALWAYS request specific details**:
+   - Production server URL/IP
+   - Current error messages/logs
+   - Recent changes or deployments
+   - Affected users/galleries
+   - Time of issue occurrence
+
+2. **Thorough Analysis Required**:
+   - Use detailed thinking/analysis for EVERY troubleshooting task
+   - Review all related code before suggesting changes
+   - Consider all potential side effects
+   - Never make assumptions about production environment
+
+3. **Safe Troubleshooting Steps**:
+   - First, reproduce issue in local/dev environment
+   - Analyze logs without modifying production
+   - Create detailed action plan before any changes
+   - Always have rollback strategy ready
+   - Document every step taken
+
+### Common Issues & Safe Approaches:
+- **Email not sending**: Check email_queue table, SMTP settings, service status
+- **Photos not loading**: Verify file permissions, storage paths, nginx config
+- **Gallery access issues**: Check JWT tokens, expiration dates, access_logs
+- **Performance problems**: Analyze with monitoring tools first, never experiment
+
+### Data Safety Rules:
+- NEVER delete or modify production data without explicit backup confirmation
+- ALWAYS verify backups exist before any data operations
+- NO direct database modifications without transaction safety
+- Log all actions for audit trail
+
 ## Environment Variables

 ### Backend (.env)
@@ -253,9 +295,71 @@ const { theme, setTheme, setThemeByName } = useTheme();
 --border-radius: 0.5rem;
 ```

+## Backup Service
+
+### Overview
+The backup service provides automated, scheduled backups of all photo data with checksum-based change detection to minimize transfer overhead.
+
+### Features
+- **Multiple Destinations**: Local directory, remote server (rsync), S3-compatible storage
+- **Change Detection**: SHA256 checksums track file changes, only modified files are backed up
+- **Scheduled Execution**: Configurable cron-based scheduling (default: 2 AM daily)
+- **Email Notifications**: Alerts on backup failure, optional success notifications
+- **Retention Management**: Automatic cleanup of old backup runs based on retention policy
+- **Progress Tracking**: Database storage of backup history, file states, and statistics
+
+### Configuration
+Backup settings are stored in `app_settings` table with `backup_` prefix:
+- `backup_enabled`: Enable/disable the service
+- `backup_schedule`: Cron expression (e.g., '0 2 * * *')
+- `backup_destination_type`: 'local', 'rsync', or 's3'
+- `backup_retention_days`: How long to keep backup history
+- `backup_include_archived`: Whether to backup archived events
+- `backup_exclude_patterns`: File patterns to exclude
+
+### API Endpoints
+- `GET /api/admin/backup/config` - Get current configuration
+- `PUT /api/admin/backup/config` - Update configuration
+- `GET /api/admin/backup/status` - Get backup status and history
+- `POST /api/admin/backup/run` - Trigger manual backup
+- `POST /api/admin/backup/test-connection` - Test destination connectivity
+
+### Testing
+Run backup service test: `npm run test-backup`
+
+### Database Tables
+- `backup_runs`: Tracks each backup execution with statistics
+- `backup_file_states`: Stores file checksums for change detection
+
 ## Success Metrics (from PRD)
 - Time to generate gallery: <2 minutes
 - Guest satisfaction: >90%
 - System uptime: 99.9%
 - Email delivery rate: >98%
- Successful archiving: 100%
+- Successful archiving: 100%
+
+## Documentation & Development Practices
+
+### Documentation Guidelines:
+- **NEVER create new documentation files for simple tasks**
+- **ALWAYS update existing documentation (like this CLAUDE.md)**
+- Only create new .md files when explicitly requested
+- Avoid creating temporary scripts for one-off tasks
+
+### Development Best Practices:
+- Test all changes thoroughly in local environment first
+- Use version control for all changes
+- Keep commits atomic and well-described
+- Review impact on all integrated services
+- Consider backward compatibility
+- Update tests when changing functionality
+
+### Production Deployment Checklist:
+- [ ] All tests passing locally
+- [ ] Linting and type checks pass
+- [ ] Database migrations tested with rollback plan
+- [ ] Environment variables documented
+- [ ] Backup strategy confirmed
+- [ ] Monitoring alerts configured
+- [ ] Rollback procedure documented
+- [ ] Stakeholders notified of maintenance window
@@ -0,0 +1,27 @@
+# PicPeak Community Guidelines
+
+## Our Commitment
+
+We are committed to providing a welcoming and inspiring community for all photographers and developers.
+
+## Expected Behavior
+
+* Be respectful and considerate
+* Welcome newcomers and help them get started
+* Focus on what is best for the community
+* Show empathy towards other community members
+
+## Unacceptable Behavior
+
+* Trolling or insulting comments
+* Personal attacks
+* Public or private harassment
+* Publishing others' private information
+
+## Enforcement
+
+Instances of unacceptable behavior may be reported to the project team at conduct@example.com. All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from contributor-covenant.org, version 2.0.
@@ -0,0 +1,160 @@
+# Contributing to PicPeak
+
+First off, thank you for considering contributing to PicPeak! It's people like you that make PicPeak such a great tool for photographers worldwide.
+
+## 🤝 Code of Conduct
+
+This project and everyone participating in it is governed by the [PicPeak Code of Conduct](CODE_OF_CONDUCT.md). By participating, you are expected to uphold this code.
+
+## 🎯 How Can I Contribute?
+
+### Reporting Bugs
+
+Before creating bug reports, please check the existing issues as you might find out that you don't need to create one. When you are creating a bug report, please include as many details as possible:
+
+* **Use a clear and descriptive title**
+* **Describe the exact steps to reproduce the problem**
+* **Provide specific examples to demonstrate the steps**
+* **Describe the behavior you observed and what you expected**
+* **Include screenshots if possible**
+* **Include your environment details** (OS, browser, Docker version, etc.)
+
+### Suggesting Enhancements
+
+Enhancement suggestions are tracked as GitHub issues. When creating an enhancement suggestion, please include:
+
+* **Use a clear and descriptive title**
+* **Provide a detailed description of the suggested enhancement**
+* **Provide specific examples to demonstrate the enhancement**
+* **Describe the current behavior and expected behavior**
+* **Explain why this enhancement would be useful**
+
+### Your First Code Contribution
+
+Unsure where to begin? You can start by looking through these issues:
+
+* [Good first issues](https://github.com/the-luap/picpeak/labels/good%20first%20issue) - issues which should only require a few lines of code
+* [Help wanted issues](https://github.com/the-luap/picpeak/labels/help%20wanted) - issues which need extra attention
+
+### Pull Requests
+
+1. **Fork the repo** and create your branch from `main`
+2. **Install dependencies**:
+   ```bash
+   cd backend && npm install
+   cd ../frontend && npm install
+   ```
+3. **Make your changes** and ensure:
+   - Code follows the existing style
+   - Tests pass: `npm test`
+   - Linting passes: `npm run lint`
+4. **Write tests** if you've added code
+5. **Update documentation** if needed
+6. **Create a Pull Request**
+
+## 💻 Development Setup
+
+### Prerequisites
+
+- Node.js 18+
+- Docker & Docker Compose
+- Git
+
+### Local Development
+
+```bash
+# Clone your fork
+git clone https://github.com/your-username/picpeak.git
+cd picpeak
+
+# Install dependencies
+cd backend && npm install
+cd ../frontend && npm install
+
+# Set up environment
+cp .env.example .env
+# Edit .env with your settings
+
+# Start development servers
+docker-compose -f docker-compose.dev.yml up
+```
+
+### Running Tests
+
+```bash
+# Backend tests
+cd backend && npm test
+
+# Frontend tests
+cd frontend && npm test
+
+# E2E tests
+npm run test:e2e
+```
+
+## 📝 Styleguides
+
+### Git Commit Messages
+
+* Use the present tense ("Add feature" not "Added feature")
+* Use the imperative mood ("Move cursor to..." not "Moves cursor to...")
+* Limit the first line to 72 characters or less
+* Reference issues and pull requests liberally after the first line
+* Consider starting the commit message with an applicable emoji:
+  * 🎨 `:art:` when improving the format/structure of the code
+  * 🐛 `:bug:` when fixing a bug
+  * 🔥 `:fire:` when removing code or files
+  * 📝 `:memo:` when writing docs
+  * 🚀 `:rocket:` when improving performance
+  * ✨ `:sparkles:` when adding a new feature
+
+### JavaScript/TypeScript Styleguide
+
+* Use ES6+ features
+* Prefer async/await over promises
+* Use meaningful variable names
+* Add JSDoc comments for functions
+* Follow ESLint rules
+
+### React Styleguide
+
+* Use functional components with hooks
+* Keep components small and focused
+* Use TypeScript for type safety
+* Follow the existing folder structure
+* Write tests for new components
+
+## 📦 Project Structure
+
+```
+picpeak/
+├── backend/
+│   ├── src/
+│   │   ├── routes/      # API endpoints
+│   │   ├── services/    # Business logic
+│   │   ├── middleware/  # Express middleware
+│   │   └── utils/       # Utilities
+│   └── migrations/      # Database migrations
+├── frontend/
+│   ├── src/
+│   │   ├── components/  # Reusable components
+│   │   ├── pages/       # Page components
+│   │   ├── services/    # API services
+│   │   └── hooks/       # Custom hooks
+│   └── public/          # Static assets
+```
+
+## 🔄 Release Process
+
+1. Update version numbers in package.json files
+2. Update CHANGELOG.md
+3. Create a new release on GitHub
+4. Docker images are automatically built and published
+
+## 📮 Contact
+
+- Create an issue for bugs or features
+- Join discussions for questions
+- Email: picpeak@example.com for security issues
+
+Thank you for contributing! 🎉
@@ -1,92 +0,0 @@
-# Deployment Guide - Traefik Production Setup
-
-## Overview
-
-This guide explains how to deploy PicPeak with an external Traefik reverse proxy for production use.
-
-## Fixed Issues
-
-1. **Database Migration**: Added missing `created_at` column to `email_queue` table
-2. **502 Bad Gateway**: Properly configured Traefik routing and backend accessibility
-3. **Health Checks**: Fixed health check endpoint imports and paths
-
-## Deployment Steps
-
-### 1. Update Environment Variables
-
-Ensure your `.env` file has the correct URLs:
-```bash
-ADMIN_URL=https://picpeak.nothaft.cloud
-FRONTEND_URL=https://picpeak.nothaft.cloud
-```
-
-### 2. Build Images
-
-```bash
-# Build backend image
-docker build -t picpeak-backend:latest ./backend
-
-# Build frontend image  
-docker build -t picpeak-frontend:latest ./frontend \
-  --build-arg VITE_API_URL=/api \
-  --build-arg VITE_UMAMI_URL=${VITE_UMAMI_URL} \
-  --build-arg VITE_UMAMI_WEBSITE_ID=${VITE_UMAMI_WEBSITE_ID}
-```
-
-### 3. Deploy with Traefik
-
-Use the new Traefik-specific compose file:
-```bash
-docker-compose -f docker-compose.traefik.yml up -d
-```
-
-### 4. Verify Deployment
-
-Check that all services are healthy:
-```bash
-# Check container status
-docker-compose -f docker-compose.traefik.yml ps
-
-# Check backend health
-curl https://picpeak.nothaft.cloud/api/health
-
-# Check logs
-docker-compose -f docker-compose.traefik.yml logs -f backend
-```
-
-## Key Differences from Standard Deployment
-
-1. **No Internal Nginx**: Traefik handles all routing externally
-2. **API Path Stripping**: Traefik strips `/api` prefix when forwarding to backend
-3. **Network Configuration**: Services join external `traefik` network
-4. **Health Checks**: Backend exposes `/health` endpoint (not `/api/health`)
-
-## Why CI/CD Tests Pass But Production Fails
-
-CI/CD tests typically:
- Use in-memory or temporary databases with fresh migrations
- Don't test through reverse proxy (direct API calls)
- Don't run background services (email processor, etc.)
- Have different network configurations
-
-Production environment has:
- Persistent database that may have migration state issues
- Reverse proxy routing complexity
- All background services running
- Different security and network constraints
-
-## Troubleshooting
-
-### 502 Bad Gateway
- Check Traefik network connectivity: `docker network ls`
- Verify backend is in traefik network: `docker inspect picpeak-backend`
- Check Traefik logs: `docker logs traefik`
-
-### Database Issues
- Connect to database: `docker exec -it picpeak-db psql -U picpeak`
- Check migration status: `SELECT * FROM migrations;`
- Run migrations manually: `docker exec -it picpeak-backend npm run migrate:safe`
-
-### Email Service Errors
- Check email queue: `SELECT * FROM email_queue ORDER BY created_at DESC LIMIT 10;`
- Monitor email processor: `docker logs picpeak-backend | grep "email"`
@@ -1,346 +1,220 @@
-# PicPeak Deployment Guide
+# 🚀 PicPeak Deployment Guide

-This guide covers deploying PicPeak for development and production environments.
+This guide will help you deploy PicPeak in production. The entire process takes about 10-15 minutes.

-## Table of Contents
- [Quick Start (Development)](#quick-start-development)
- [Production Deployment](#production-deployment)
- [Admin User Setup](#admin-user-setup)
- [Configuration Reference](#configuration-reference)
- [Troubleshooting](#troubleshooting)
+## 📋 Prerequisites

-## Quick Start (Development)
+- A server with Docker and Docker Compose installed
+- A domain name (for SSL certificates)
+- SMTP credentials for sending emails
+- Basic command line knowledge

-### 1. Clone and Setup
+## 🏃 Quick Deploy (Recommended)
+
+### 1. Clone and Configure

 ```bash
-git clone https://github.com/yourusername/picpeak.git
+# Clone the repository
+git clone https://github.com/the-luap/picpeak.git
 cd picpeak

 # Copy environment template
-cp .env.example .env
-
-# Start development environment
-docker-compose -f docker-compose.dev.yml up -d
-```
-
-### 2. Access Services
-
- Frontend: http://localhost:3005
- Backend API: http://localhost:3001
- MailHog (email testing): http://localhost:8025
-
-### 3. Create Admin User
-
-```bash
-docker-compose -f docker-compose.dev.yml exec backend node scripts/create-admin.js \
-  --email admin@localhost \
-  --username admin \
-  --password admin123
-```
-
-## Production Deployment
-
-### Prerequisites
-
- Docker and Docker Compose installed
- Domain with DNS configured
- SSL/TLS handled by reverse proxy (Traefik, Nginx, etc.)
-
-### 1. Environment Setup
-
-```bash
-# Copy production template
 cp .env.production.example .env

-# Generate secure secrets
+# Generate a secure JWT secret
 echo "JWT_SECRET=$(openssl rand -base64 32)" >> .env
-echo "DB_PASSWORD=$(openssl rand -base64 24)" >> .env
+
+# Edit configuration
+nano .env
 ```

-Edit `.env` with your configuration:
+### 2. Required Environment Variables
+
+Edit your `.env` file with these essential settings:

 ```env
-# Your domain
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
+# Application URLs
+FRONTEND_URL=https://your-domain.com
+BACKEND_URL=https://your-domain.com

-# Database (PostgreSQL)
-DB_USER=picpeak
-DB_NAME=picpeak
-# DB_PASSWORD already generated above
-
-# Email
+# Email Configuration (Required for notifications)
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
-SMTP_SECURE=true
 SMTP_USER=your-email@gmail.com
 SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
-```
+SMTP_FROM=your-email@gmail.com

-### 2. Frontend Configuration
+# Admin Configuration
+ADMIN_EMAIL=admin@your-domain.com
+ADMIN_PASSWORD=your-secure-password

-```bash
-# Configure frontend for production
-echo "VITE_API_URL=/api" > frontend/.env.production
+# Database (PostgreSQL for production)
+DATABASE_CLIENT=pg
+DB_HOST=postgres
+DB_NAME=picpeak
+DB_USER=picpeak
+DB_PASSWORD=secure-db-password
 ```

 ### 3. Deploy with Docker Compose

 ```bash
-# Build and start services
+# Start all services
 docker-compose -f docker-compose.prod.yml up -d

-# Check status
-docker-compose -f docker-compose.prod.yml ps
+# Check logs
+docker-compose logs -f

-# View logs
-docker-compose -f docker-compose.prod.yml logs -f
+# Access your site at https://your-domain.com
 ```

-### 4. Deploy with Traefik
+## 🔧 Configuration Options

-If using Traefik, create `docker-compose.override.yml`:
+### Storage Settings

-```yaml
-version: '3.8'
+```env
+# Storage paths (default: ./storage)
+STORAGE_PATH=./storage
+ARCHIVE_PATH=./storage/archives

-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-    networks:
-      - traefik
-      - picpeak
-
-networks:
-  traefik:
-    external: true
+# Gallery expiration (days)
+DEFAULT_EXPIRATION_DAYS=30
+WARNING_DAYS_BEFORE_EXPIRY=7
 ```

-## Admin User Setup
+### Security Settings

-### Create First Admin
+```env
+# Session timeout (minutes)
+SESSION_TIMEOUT=60

-After deployment, create your admin user:
+# Rate limiting
+RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
+RATE_LIMIT_MAX_REQUESTS=100
+```
+
+### Analytics (Optional)
+
+```env
+# Umami Analytics
+VITE_UMAMI_URL=https://analytics.your-domain.com
+VITE_UMAMI_WEBSITE_ID=your-website-id
+```
+
+## 🔒 SSL/TLS Setup
+
+The production Docker Compose includes automatic SSL via Let's Encrypt:
+
+1. **Ensure your domain points to your server**
+2. **Update nginx configuration**:
+   ```bash
+   nano nginx/nginx.conf
+   # Replace your-domain.com with your actual domain
+   ```
+3. **Start services** - Certbot will automatically obtain certificates
+
+## 📁 Directory Structure
+
+After deployment, your directory structure will be:
+
+```
+picpeak/
+├── backend/          # API server
+├── frontend/         # React app
+├── storage/          # Photo storage
+│   ├── events/       # Active galleries
+│   │   ├── active/   # Current photos
+│   │   └── archived/ # Expired galleries
+│   ├── thumbnails/   # Generated thumbnails
+│   └── uploads/      # User uploads
+├── data/            # Database files
+└── logs/            # Application logs
+```
+
+## 🔄 Maintenance
+
+### Backup

 ```bash
-# Production
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --email admin@yourdomain.com \
-  --username admin \
-  --password yourSecurePassword
+# Backup database and photos
+./scripts/backup.sh

-# Auto-generate password
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --email admin@yourdomain.com
+# Backups are stored in ./backups/
 ```

-The script will display:
- ✅ Admin user created successfully!
- Email: admin@yourdomain.com
- Username: admin
- Login URL: https://yourdomain.com/admin/login
- Password: (save this if auto-generated!)
-
-### Managing Admin Users
-
-```bash
-# List admin users
-docker-compose -f docker-compose.prod.yml exec backend \
-  psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-  -c "SELECT id, username, email, is_active, last_login FROM admin_users;"
-
-# Deactivate user
-docker-compose -f docker-compose.prod.yml exec backend \
-  psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-  -c "UPDATE admin_users SET is_active = false WHERE email = 'user@example.com';"
-```
-
-## Configuration Reference
-
-### Database Configuration
-
-PicPeak automatically detects the environment and uses:
- **Development**: SQLite (`./data/photo_sharing.db`)
- **Production**: PostgreSQL (configured via environment variables)
-
-### Environment Variables
-
-#### Required for Production
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `JWT_SECRET` | JWT signing key | `openssl rand -base64 32` |
-| `DB_PASSWORD` | PostgreSQL password | `openssl rand -base64 24` |
-| `ADMIN_URL` | Admin panel URL | `https://yourdomain.com` |
-| `FRONTEND_URL` | Frontend URL | `https://yourdomain.com` |
-| `EMAIL_FROM` | Sender email | `noreply@yourdomain.com` |
-
-#### Email Configuration
-
-| Variable | Description | Example |
-|----------|-------------|---------|
-| `SMTP_HOST` | SMTP server | `smtp.gmail.com` |
-| `SMTP_PORT` | SMTP port | `587` |
-| `SMTP_SECURE` | Use TLS | `true` |
-| `SMTP_USER` | SMTP username | `your-email@gmail.com` |
-| `SMTP_PASS` | SMTP password | App-specific password |
-
-### Storage Paths
-
- Photos: `./storage/events/active/`
- Archives: `./storage/events/archived/`
- Thumbnails: `./storage/thumbnails/`
- Uploads: `./storage/uploads/`
-
-## Backup and Restore
-
-### Backup Database
-
-```bash
-# PostgreSQL backup
-docker-compose -f docker-compose.prod.yml exec db \
-  pg_dump -U picpeak picpeak > backup-$(date +%Y%m%d).sql
-
-# Backup storage
-tar -czf storage-backup-$(date +%Y%m%d).tar.gz ./storage
-```
-
-### Restore Database
-
-```bash
-# PostgreSQL restore
-docker-compose -f docker-compose.prod.yml exec -T db \
-  psql -U picpeak picpeak < backup-20240115.sql
-
-# Restore storage
-tar -xzf storage-backup-20240115.tar.gz
-```
-
-## Monitoring
-
-### Health Checks
-
-```bash
-# Backend health
-curl https://yourdomain.com/api/health
-
-# Frontend health
-curl https://yourdomain.com/health
-```
-
-### Logs
-
-```bash
-# All services
-docker-compose -f docker-compose.prod.yml logs -f
-
-# Specific service
-docker-compose -f docker-compose.prod.yml logs -f backend
-
-# Last 100 lines
-docker-compose -f docker-compose.prod.yml logs --tail=100 backend
-```
-
-## Troubleshooting
-
-### Backend Won't Start
-
-1. Check database connection:
-   ```bash
-   docker-compose -f docker-compose.prod.yml logs db
-   ```
-
-2. Verify environment variables:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend env | grep DB_
-   ```
-
-### Can't Login as Admin
-
-1. Verify admin user exists:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend \
-     psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-     -c "SELECT * FROM admin_users;"
-   ```
-
-2. Reset admin password:
-   ```bash
-   # Create new admin with different email
-   docker-compose -f docker-compose.prod.yml exec backend \
-     node scripts/create-admin.js --email newadmin@yourdomain.com
-   ```
-
-### Photos Not Loading
-
-1. Check file permissions:
-   ```bash
-   ls -la ./storage/events/active/
-   ```
-
-2. Verify nginx proxy configuration:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec frontend \
-     cat /etc/nginx/conf.d/default.conf
-   ```
-
-### Email Not Sending
-
-1. Check email configuration:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend env | grep SMTP_
-   ```
-
-2. View email queue:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend \
-     psql postgresql://picpeak:$DB_PASSWORD@db:5432/picpeak \
-     -c "SELECT * FROM email_queue WHERE status = 'failed';"
-   ```
-
-## Maintenance
-
-### Update Application
+### Update

 ```bash
 # Pull latest changes
 git pull

-# Rebuild images
-docker-compose -f docker-compose.prod.yml build
-
-# Restart services
-docker-compose -f docker-compose.prod.yml up -d
+# Rebuild and restart
+docker-compose -f docker-compose.prod.yml up -d --build
 ```

-### Clean Up
+### Logs

 ```bash
-# Remove unused images
-docker image prune -a
+# View all logs
+docker-compose logs

-# Clean up logs
-docker-compose -f docker-compose.prod.yml logs --tail=0 -f
-
-# Remove old archives
-find ./storage/events/archived -name "*.zip" -mtime +90 -delete
+# View specific service
+docker-compose logs backend
+docker-compose logs frontend
 ```

-## Security Checklist
+## 🚨 Troubleshooting

- [ ] Generated secure `JWT_SECRET`
- [ ] Generated secure `DB_PASSWORD`
- [ ] HTTPS enabled via reverse proxy
- [ ] Changed default admin credentials
- [ ] Configured real SMTP server
- [ ] Set file permissions: `chmod 600 .env`
- [ ] Firewall configured
- [ ] Regular backups scheduled
- [ ] Monitoring enabled
+### Common Issues
+
+**Photos not appearing:**
+- Check storage permissions: `chmod -R 755 storage/`
+- Verify file watcher is running: `docker-compose logs backend | grep watcher`
+
+**Email not sending:**
+- Test SMTP settings: Admin Panel → Settings → Email → Send Test
+- Check email queue: Admin Panel → System → Email Queue
+
+**Can't access admin panel:**
+- Default login: Use email/password from `.env`
+- Reset password: `docker exec picpeak-backend npm run reset-admin`
+
+### Health Check
+
+```bash
+# Check service status
+docker-compose ps
+
+# Test backend API
+curl https://your-domain.com/api/health
+
+# Check disk space
+df -h storage/
+```
+
+## 🐳 Alternative Deployment Methods
+
+### Using Docker Swarm
+
+For high availability deployments, see [Docker Swarm Setup](deploy/README.md).
+
+### Manual Installation
+
+If you prefer not to use Docker:
+
+1. Install Node.js 18+
+2. Install PostgreSQL
+3. Clone repository
+4. Install dependencies: `npm install` in both `/backend` and `/frontend`
+5. Build frontend: `cd frontend && npm run build`
+6. Start services with PM2
+
+## 📞 Support
+
+- 📘 [Documentation](https://github.com/the-luap/picpeak)
+- 🐛 [Report Issues](https://github.com/the-luap/picpeak/issues)
+- 💬 [Discussions](https://github.com/the-luap/picpeak/discussions)
+
+---
+
+**Need help?** Open an issue on GitHub and we'll assist you!
@@ -1,111 +0,0 @@
-# Quick Fix for Migration Error
-
-## Immediate Fix
-
-The error "relation photo_categories already exists" occurs because the database already has tables but the migration tracking doesn't know they were applied.
-
-### Option 1: Use Safe Migration Runner (Recommended)
-
-Update your `docker-compose.prod.yml` to use the safe migration command:
-
-```yaml
-backend:
-  environment:
-    - NODE_ENV=production
-  # ... other config ...
-```
-
-Then update the `wait-for-db.sh` (already done) to use `npm run migrate:safe` in production.
-
-### Option 2: Quick Manual Fix
-
-If you need to fix the running system immediately:
-
-```bash
-# 1. Enter the backend container
-docker-compose -f docker-compose.prod.yml exec backend sh
-
-# 2. Run the safe migration script
-npm run migrate:safe
-
-# 3. If that fails, manually mark migrations as applied:
-docker-compose -f docker-compose.prod.yml exec db psql -U picpeak -d picpeak
-
-# In PostgreSQL:
-CREATE TABLE IF NOT EXISTS migrations (
-  id SERIAL PRIMARY KEY,
-  filename VARCHAR(255) UNIQUE NOT NULL,
-  applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-);
-
-- Mark existing migrations as applied
-INSERT INTO migrations (filename) VALUES 
-  ('init.js'),
-  ('004_add_categories_and_cms.js'),
-  ('006_add_photo_counter_to_categories.js'),
-  ('007_add_read_at_to_activity_logs.js'),
-  ('008_add_language_support_to_email_templates.js'),
-  ('009_update_german_email_templates.js'),
-  ('010_add_missing_email_templates.js'),
-  ('011_add_user_upload_settings.js'),
-  ('012_add_hero_photo_id.js'),
-  ('013_fix_email_links_and_date_format.js'),
-  ('014_add_default_welcome_message.js'),
-  ('014_add_host_name_to_events.js'),
-  ('015_add_login_attempts_table.js'),
-  ('016_add_auth_security_columns.js'),
-  ('017_add_token_revocation_tables.js')
-ON CONFLICT (filename) DO NOTHING;
-
-\q
-```
-
-### Option 3: Fresh Start (Nuclear Option)
-
-If you don't have important data yet:
-
-```bash
-# Stop everything
-docker-compose -f docker-compose.prod.yml down
-
-# Remove database volume
-docker volume rm wedding-photo-sharing_postgres_data
-
-# Start fresh
-docker-compose -f docker-compose.prod.yml up -d
-```
-
-## Root Cause
-
-The issue happens when:
-1. Database volume persists between deployments
-2. Migration tracking table gets out of sync
-3. The original migration runner doesn't check for existing tables
-
-## Permanent Solution
-
-The new safe migration runner (`migrate:safe`) handles this by:
-1. Checking if tables exist before creating them
-2. Catching "already exists" errors gracefully
-3. Auto-detecting existing schema and marking migrations as applied
-
-## Next Steps
-
-After fixing the migration issue:
-
-1. Create admin user:
-```bash
-docker-compose -f docker-compose.prod.yml exec backend node scripts/create-admin.js \
-  --username admin \
-  --email admin@yourdomain.com
-```
-
-2. Check health:
-```bash
-curl http://yourdomain.com/api/health
-```
-
-3. Monitor logs:
-```bash
-docker-compose -f docker-compose.prod.yml logs -f backend
-```
@@ -1,98 +0,0 @@
-# Production Deployment Guide
-
-This guide explains how to deploy PicPeak in production behind a reverse proxy like Traefik.
-
-## Environment Configuration
-
-### Frontend Configuration
-
-For production deployment behind a reverse proxy (Traefik, Nginx, etc.), the frontend should use relative URLs to automatically inherit the protocol (HTTPS) and domain.
-
-1. Copy the production environment template:
-   ```bash
-   cp frontend/.env.production.example frontend/.env.production
-   ```
-
-2. Set the API URL to use relative path:
-   ```env
-   # frontend/.env.production
-   VITE_API_URL=/api
-   ```
-
-   This ensures all API calls will use the same domain and protocol as the frontend.
-
-### Backend Configuration
-
-Ensure your backend `.env` file has the correct URLs:
-```env
-# backend/.env
-FRONTEND_URL=https://yourdomain.com
-ADMIN_URL=https://yourdomain.com
-```
-
-## Docker Compose Production
-
-When using Docker Compose in production:
-
-1. Build with production environment:
-   ```bash
-   docker-compose -f docker-compose.prod.yml build --build-arg NODE_ENV=production
-   ```
-
-2. The frontend nginx configuration already includes proper proxy settings for:
-   - `/api` → Backend API
-   - `/photos` → Protected photo access
-   - `/thumbnails` → Thumbnail images
-   - `/uploads` → Public uploads (logos, favicons)
-
-## Traefik Configuration
-
-Example Traefik labels for docker-compose:
-
-```yaml
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
-      - "traefik.http.routers.picpeak.entrypoints=websecure"
-      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
-```
-
-## Important Notes
-
-1. **No Hardcoded URLs**: The application uses environment variables with relative URL fallbacks, making it production-ready.
-
-2. **HTTPS Only**: When `VITE_API_URL=/api`, all requests will use the same protocol as the page (HTTPS in production).
-
-3. **CORS Configuration**: The backend CORS is configured to accept requests from the URLs specified in `FRONTEND_URL` and `ADMIN_URL`.
-
-4. **Static Assets**: All static assets (photos, thumbnails, uploads) are served through the nginx proxy, inheriting authentication headers.
-
-## Verification
-
-After deployment, verify:
-
-1. Check browser console for any localhost URLs (there should be none)
-2. Verify all API calls use HTTPS
-3. Check that images load correctly with authentication
-4. Test favicon and logo display
-
-## Troubleshooting
-
-If you see console errors about localhost:
-
-1. Ensure `VITE_API_URL=/api` in frontend environment
-2. Clear browser cache
-3. Rebuild frontend with production environment:
-   ```bash
-   cd frontend
-   npm run build
-   ```
-
-If images don't load:
-
-1. Check that nginx proxy locations are configured
-2. Verify authentication tokens are being sent
-3. Check backend logs for authentication errors
@@ -1,100 +0,0 @@
-# Production Deployment Fixes
-
-This document describes the fixes applied to resolve production deployment issues in Docker.
-
-## Issues Fixed
-
-### 1. Database Connection Error: "getaddrinfo ENOTFOUND postgres"
-**Problem**: The backend was trying to connect to hostname "postgres" but the database service is named "db" in docker-compose.
-**Solution**: 
- Updated `knexfile.js` to use correct default host "db" instead of "postgres"
- Added `depends_on: db` to backend service in docker-compose.prod.yml
-
-### 2. Backend Starting Before Database Ready
-**Problem**: Backend service started before PostgreSQL was ready, causing connection failures.
-**Solution**:
- Created `wait-for-db.sh` script that waits for PostgreSQL to be ready
- Updated Dockerfile to install postgresql-client and use the wait script
- Script also runs migrations automatically on startup
-
-### 3. Email Processor Initialization Failure
-**Problem**: Email processor tried to initialize on module load before database was available.
-**Solution**:
- Modified `emailProcessor.js` to export initialization functions
- Updated `server.js` to call initialization after database is ready
- Added proper error handling for email service initialization
-
-### 4. Missing Environment Variables
-**Problem**: Critical storage path environment variables were missing.
-**Solution**:
- Added STORAGE_PATH, EVENTS_PATH, and ARCHIVE_PATH to docker-compose.prod.yml
- Created `.env.example` documenting all required environment variables
-
-### 5. Enhanced Health Check
-**Problem**: Basic health check didn't verify database connectivity.
-**Solution**:
- Updated `/api/health` endpoint to check database connection
- Returns proper HTTP 503 status when unhealthy
-
-## Files Modified
-
-1. **backend/knexfile.js** - Fixed production database defaults
-2. **backend/wait-for-db.sh** - Created database wait script
-3. **backend/Dockerfile** - Added postgresql-client and wait script
-4. **docker-compose.prod.yml** - Added dependencies and environment variables
-5. **backend/src/services/emailProcessor.js** - Disabled auto-initialization
-6. **backend/server.js** - Added email initialization and improved health check
-7. **backend/.env.example** - Created environment variable documentation
-
-## Deployment Steps
-
-1. Ensure all environment variables are set according to `.env.example`
-2. Build and deploy with docker-compose:
-   ```bash
-   docker-compose -f docker-compose.prod.yml build
-   docker-compose -f docker-compose.prod.yml up -d
-   ```
-3. The backend will now:
-   - Wait for PostgreSQL to be ready
-   - Run migrations automatically
-   - Initialize all services in proper order
-   - Provide health status at `/api/health`
-
-## Verification
-
-Check deployment health:
-```bash
-curl http://localhost/api/health
-```
-
-Expected response:
-```json
-{
-  "status": "ok",
-  "database": "connected",
-  "timestamp": "2025-07-13T20:30:00.000Z"
-}
-```
-
-## Email Configuration
-
-Email service requires configuration in the database. If email is not configured:
- The service will log a warning but continue running
- Emails will be queued but not sent
- Configure email settings in the admin panel after deployment
-
-## PostgreSQL Connection Fix
-
-### Issue: "no pg_hba.conf entry for host"
-This error occurs when PostgreSQL requires SSL but the client connects without encryption.
-
-### Solution:
- Disabled SSL requirement for PostgreSQL in Docker environment (`ssl=off`)
- Added proper authentication method (`scram-sha-256`)
- This is acceptable for internal Docker networks where all traffic is isolated
-
-### Security Note:
-For production deployments exposed to the internet:
-1. Use SSL certificates for PostgreSQL
-2. Or ensure the database is only accessible within the Docker network
-3. Never expose PostgreSQL port (5432) directly to the internet
@@ -1,6 +1,6 @@
 # Production Deployment Guide

-This guide addresses all known production deployment issues and provides solutions.
+This comprehensive guide addresses all production deployment scenarios and common issues.

 ## Pre-Deployment Checklist

@@ -8,50 +8,87 @@ This guide addresses all known production deployment issues and provides solutio
 Create a `.env` file with ALL required variables:

 ```bash
-# Required
+# CRITICAL - Must change these!
 JWT_SECRET=<generate-with-openssl-rand-base64-32>
 DB_PASSWORD=<strong-password>
+
+# Application URLs (your actual domain)
 ADMIN_URL=https://yourdomain.com
 FRONTEND_URL=https://yourdomain.com
+BACKEND_URL=https://yourdomain.com

-# Database
+# Database (PostgreSQL)
+DATABASE_CLIENT=pg
+DB_HOST=postgres  # or external host
+DB_PORT=5432
 DB_USER=picpeak
 DB_NAME=picpeak

-# Email (Optional but recommended)
+# Email Configuration (required for notifications)
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
 SMTP_SECURE=false
 SMTP_USER=your-email@gmail.com
-SMTP_PASS=your-app-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_PASS=your-app-password  # Use app-specific password
+EMAIL_FROM=PicPeak <noreply@yourdomain.com>

-# Umami Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
-UMAMI_HASH_SALT=<generate-random-string>
+# Port Configuration
+PORT=3001
+
+# Performance Tuning
+DB_POOL_MIN=5
+DB_POOL_MAX=25
+NODE_ENV=production
+LOG_LEVEL=info
+
+# Optional: Umami Analytics (configured via Admin UI)
+# UMAMI_URL=https://analytics.yourdomain.com
+# UMAMI_WEBSITE_ID=your-website-id
 ```

 ### 2. Generate Secrets

 ```bash
-# Generate JWT Secret
+# Generate JWT Secret (REQUIRED)
 openssl rand -base64 32

 # Generate Database Password
 openssl rand -base64 24
-
-# Generate Umami Hash Salt
-openssl rand -hex 32
 ```

+## Frontend Configuration
+
+For production deployment behind a reverse proxy:
+
+### Frontend Environment
+```bash
+# frontend/.env.production
+VITE_API_URL=/api  # Uses relative path for reverse proxy
+
+# Optional: Umami fallback (primary config via Admin UI)
+# VITE_UMAMI_URL=https://analytics.yourdomain.com
+# VITE_UMAMI_WEBSITE_ID=your-website-id
+```
+
+This ensures all API calls use the same domain/protocol as the frontend.
+
+### Nginx Proxy Configuration
+
+The frontend nginx configuration already includes proper proxy settings for:
+- `/api` → Backend API
+- `/photos` → Protected photo access
+- `/thumbnails` → Thumbnail images
+- `/uploads` → Public uploads (logos, favicons)
+
+All static assets are served through the nginx proxy, inheriting authentication headers.
+
 ## Deployment Steps

 ### 1. Initial Setup

 ```bash
 # Clone repository
-git clone https://github.com/yourusername/wedding-photo-sharing.git
+git clone https://github.com/the-luap/wedding-photo-sharing.git
 cd wedding-photo-sharing

 # Create required directories
@@ -96,24 +133,31 @@ docker-compose -f docker-compose.prod.yml up -d
 docker-compose -f docker-compose.prod.yml logs -f backend
 ```

-### 4. Create Admin User
+### 4. Initial Admin Setup

-After deployment, create the first admin user:
+The admin user is automatically created during database migration:

 ```bash
-# Enter backend container
-docker-compose -f docker-compose.prod.yml exec backend sh
+# Run migrations (this creates admin user)
+docker-compose -f docker-compose.prod.yml exec backend npm run migrate

-# Create admin
-node scripts/create-admin.js \
-  --username admin \
-  --email admin@yourdomain.com \
-  --password <your-secure-password>
+# Admin credentials will be displayed in console and saved to ADMIN_CREDENTIALS.txt
+# Example output:
+# ========================================
+# ✅ Admin user created successfully!
+# ========================================
+# Username: admin
+# Password: SwiftEagle3847!
+# 
+# ⚠️  IMPORTANT: Change password on first login
+# ========================================

-# Exit container
-exit
+# Retrieve credentials if needed
+docker-compose -f docker-compose.prod.yml exec backend cat ADMIN_CREDENTIALS.txt
 ```

+**Important**: You MUST change the auto-generated password on first login.
+
 ### 5. Configure Email (if using database config)

 1. Login to admin panel: https://yourdomain.com/admin
@@ -189,6 +233,23 @@ docker-compose -f docker-compose.prod.yml logs backend | grep email

 ## SSL/HTTPS Setup

+### Option 1: Using Traefik (Recommended)
+
+Add these labels to your docker-compose override:
+
+```yaml
+services:
+  frontend:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.picpeak.rule=Host(`yourdomain.com`)"
+      - "traefik.http.routers.picpeak.entrypoints=websecure"
+      - "traefik.http.routers.picpeak.tls.certresolver=letsencrypt"
+      - "traefik.http.services.picpeak.loadbalancer.server.port=80"
+```
+
+### Option 2: Using Certbot
+
 1. Update `nginx/sites-enabled/default` with your domain
 2. Run certbot:

@@ -294,13 +355,18 @@ docker-compose -f docker-compose.prod.yml up -d

 - [ ] Strong JWT_SECRET (min 32 chars)
 - [ ] Strong database password
+- [ ] Admin password changed from auto-generated one
 - [ ] SSL/HTTPS enabled
 - [ ] Firewall configured (only 80/443 open)
 - [ ] Regular security updates
 - [ ] Backup encryption
 - [ ] Access logs monitored
- [ ] Rate limiting enabled
+- [ ] Rate limiting enabled (built-in)
 - [ ] File upload restrictions configured
+- [ ] Password complexity requirements configured (Admin > Settings)
+- [ ] Session timeout configured (default 60 min)
+- [ ] Umami analytics configured (if using)
+- [ ] SMTP credentials secured with app-specific password

 ## Support

@@ -1,130 +0,0 @@
-# 🚀 Quick Local Development Setup
-
-Get the photo sharing platform running locally in under 2 minutes!
-
-## Prerequisites
- Docker Desktop installed and running
- Git
- 4GB RAM available
-
-## Quick Start
-
-```bash
-# 1. Clone the repository
-git clone <your-repo-url>
-cd picpeak
-
-# 2. Start everything
-./start-local.sh
-```
-
-That's it! 🎉
-
-## What You Get
-
-| Service | URL | Description |
-|---------|-----|-------------|
-| Frontend (Dev) | http://localhost:3002 | React app with hot reload |
-| Frontend (Prod) | http://localhost:3000 | Production build |
-| Backend API | http://localhost:3001 | Express API |
-| Mailhog | http://localhost:8025 | Email testing UI |
-
-## Default Credentials
-
- **Admin Login**: Check `ADMIN_CREDENTIALS.txt` after first setup
- **Test Gallery**: 
-  - Create via Admin Panel
-  - Set your own secure password
-
-## Common Tasks
-
-### View Logs
-```bash
-docker-compose -f docker-compose.local.yml logs -f
-```
-
-### Stop Everything
-```bash
-./stop-local.sh
-```
-
-### Reset Database
-```bash
-docker-compose -f docker-compose.local.yml exec backend npm run migrate
-```
-
-### Add Test Photos
-1. Create a gallery in the admin panel
-2. Get the gallery slug (e.g., `wedding-smith-2024`)
-3. Add photos to: `./storage/events/active/wedding-smith-2024/`
-4. Photos appear automatically!
-
-### Access Backend Shell
-```bash
-docker-compose -f docker-compose.local.yml exec backend sh
-```
-
-## Development Workflow
-
-1. **Frontend Development** (Port 3002)
-   - Hot reload enabled
-   - Edit files in `./frontend/src`
-   - Changes appear instantly
-
-2. **Backend Development** (Port 3001)
-   - Nodemon watches for changes
-   - Edit files in `./backend/src`
-   - Server restarts automatically
-
-3. **Email Testing**
-   - All emails go to Mailhog
-   - View at http://localhost:8025
-   - No real emails sent!
-
-## Troubleshooting
-
-### Backend won't start
-```bash
-# Check logs
-docker-compose -f docker-compose.local.yml logs backend
-
-# Rebuild
-docker-compose -f docker-compose.local.yml build backend
-```
-
-### Frontend build issues
-```bash
-# Clear cache and rebuild
-docker-compose -f docker-compose.local.yml exec frontend-dev npm run build
-```
-
-### Port conflicts
-Edit `docker-compose.local.yml` and change the port mappings:
- Backend: Change `3001:3000` to `XXXX:3000`
- Frontend: Change `3002:5173` to `YYYY:5173`
-
-### Reset everything
-```bash
-# Stop and remove all data
-docker-compose -f docker-compose.local.yml down -v
-rm -rf data storage logs
-./start-local.sh
-```
-
-## Tips
-
- 📧 Check Mailhog for all emails
- 🔄 Frontend auto-refreshes on save
- 📁 SQLite DB at `./data/photo_sharing.db`
- 🖼️ Photos in `./storage/events/active/`
- 📝 Logs in `./logs/`
-
-## Next Steps
-
-1. Create your first gallery via Admin Panel
-2. Upload some test photos
-3. Test the gallery with password
-4. Check expiration warnings
-5. View emails in Mailhog
-
-Happy coding! 🎨
@@ -1,32 +1,199 @@
-# Photo Sharing Platform
+# 📸 PicPeak - Open Source Photo Sharing for Events

-A secure, self-hosted photo sharing platform designed for weddings and events. Features automatic expiration, email notifications, and simple file-based management.
+<div align="center">
+  <img src="docs/picpeak-logo.png" alt="PicPeak Logo" width="300" />
+  
+  [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+  [![Docker](https://img.shields.io/badge/docker-%230db7ed.svg?style=flat&logo=docker&logoColor=white)](https://www.docker.com/)
+  [![Node.js](https://img.shields.io/badge/node.js-6DA55F?style=flat&logo=node.js&logoColor=white)](https://nodejs.org/)
+  [![React](https://img.shields.io/badge/react-%2320232a.svg?style=flat&logo=react&logoColor=%2361DAFB)](https://reactjs.org/)
+</div>

-## Features
+**PicPeak** is a powerful, self-hosted open-source alternative to commercial photo-sharing platforms like PicDrop.com and Scrapbook.de. Designed specifically for photographers and event organizers, PicPeak makes it simple to share beautiful, time-limited photo galleries with clients while maintaining full control over your data and branding.

- 🔒 Password Protected Galleries
- ⏰ Automatic Expiration
- 📧 Email Notifications
- 📁 Simple File Management
- 📊 Analytics Integration
- 🎨 Customizable Themes
- 📱 Mobile Responsive
- ⚡ Docker Ready
+![PicPeak Gallery Preview](docs/screenshot-gallery.png)

-## Quick Start
+## 🌟 Why Choose PicPeak?

-1. Clone the repository
-2. Run `./scripts/install.sh`
-3. Configure `.env` file
-4. Setup SSL: `./scripts/setup-ssl.sh`
-5. Start: `docker-compose -f docker-compose.prod.yml up -d`
+Unlike expensive SaaS solutions, PicPeak gives you:

-Default credentials: Check ADMIN_CREDENTIALS.txt after first setup
+- **💰 No Monthly Fees** - One-time setup, unlimited galleries
+- **🔒 Complete Data Control** - Your photos stay on your server
+- **🎨 White-Label Ready** - Full branding customization
+- **📱 Mobile-First Design** - Beautiful on all devices
+- **🚀 Lightning Fast** - Optimized performance and caching
+- **🌍 Multi-Language** - Built-in i18n support (EN, DE)

-## Documentation
+## ✨ Key Features

-See DEPLOYMENT.md for detailed deployment instructions.
+### For Photographers
+- 📁 **Drag & Drop Upload** - Simply drop photos into folders
+- ⏰ **Auto-Expiring Galleries** - Set expiration dates (default: 30 days)
+- 🔐 **Password Protection** - Secure client galleries
+- 📧 **Automated Emails** - Creation confirmations and expiration warnings
+- 📊 **Analytics Dashboard** - Track views, downloads, and engagement
+- 🎨 **Custom Themes** - Match your brand perfectly

-## License
+### For Clients
+- 🖼️ **Beautiful Galleries** - Clean, modern interface
+- 📱 **Mobile Optimized** - Swipe through photos on any device
+- ⬇️ **Bulk Downloads** - Download all photos with one click
+- 🔍 **Smart Search** - Find photos quickly
+- 📤 **Guest Uploads** - Optional client photo uploads

-MIT License
+### Technical Excellence
+- 🐳 **Docker Ready** - Deploy in minutes
+- 🔄 **Auto-Processing** - Automatic thumbnail generation
+- 💾 **Smart Storage** - Automatic archiving of expired galleries
+- 🛡️ **Security First** - JWT auth, rate limiting, CORS protection
+- 📈 **Scalable** - From small studios to large agencies
+
+## 🚀 Quick Start
+
+Get PicPeak running in under 5 minutes:
+
+```bash
+# Clone the repository
+git clone https://github.com/the-luap/picpeak.git
+cd picpeak
+
+# Copy environment template
+cp .env.example .env
+
+# Edit configuration (required: JWT_SECRET)
+nano .env
+
+# Start with Docker Compose
+docker-compose up -d
+
+# Access at http://localhost:3005
+```
+
+## 📖 Documentation
+
+- 📘 [**Deployment Guide**](DEPLOYMENT.md) - Detailed installation instructions
+- 🤝 [**Contributing**](CONTRIBUTING.md) - How to contribute
+- 📜 [**License**](LICENSE) - MIT License
+- 🔒 [**Security**](SECURITY.md) - Security policies
+- 📋 [**Code of Conduct**](CODE_OF_CONDUCT.md) - Community guidelines
+
+## 🎯 Use Cases
+
+Perfect for:
+- 💒 **Wedding Photographers** - Share ceremony photos securely
+- 🎂 **Event Photography** - Birthday parties, corporate events
+- 📸 **Portrait Studios** - Client galleries with download limits
+- 🏢 **Corporate Events** - Internal photo sharing with branding
+- 🎓 **School Photography** - Secure parent access with expiration
+
+## 🏗️ Tech Stack
+
+- **Backend**: Node.js, Express, SQLite/PostgreSQL
+- **Frontend**: React, Tailwind CSS, Framer Motion
+- **Storage**: File-based with automatic archiving
+- **Email**: SMTP with customizable templates
+- **Analytics**: Privacy-focused with Umami integration
+
+## 🤝 Contributing
+
+We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
+
+See our [Contributing Guide](CONTRIBUTING.md) for details.
+
+## 📊 Comparison with Alternatives
+
+| Feature | PicPeak | PicDrop | Scrapbook.de |
+|---------|---------|---------|--------------|
+| Self-Hosted | ✅ | ❌ | ❌ |
+| Custom Branding | ✅ Full | Limited | Limited |
+| Monthly Cost | $0 | $29-199 | €19-99 |
+| Storage Limit | Unlimited* | 50-500GB | 100-1000GB |
+| Client Uploads | ✅ | ✅ | ✅ |
+| API Access | ✅ | Paid | ❌ |
+| Open Source | ✅ | ❌ | ❌ |
+
+*Limited only by your server storage
+
+## 🛡️ Security
+
+PicPeak takes security seriously:
+- 🔐 Password hashing with bcrypt
+- 🎫 JWT-based authentication
+- 🚦 Rate limiting on all endpoints
+- 🛡️ CORS protection
+- 📝 Activity logging
+- 🔒 Secure file access
+
+Found a security issue? Please email security@example.com
+
+## 📸 Screenshots
+
+### 🎛️ **Admin Dashboard**
+Get a complete overview of your photo galleries, analytics, and system status.
+
+<img src="docs/screenshot-dashboard.png" alt="PicPeak Admin Dashboard" width="800" />
+
+### 📊 **Analytics & Insights**
+Track gallery performance, view statistics, and monitor user engagement.
+
+<img src="docs/screenshot-analytics.png" alt="PicPeak Analytics Dashboard" width="800" />
+
+### 📁 **Event Management**
+Organize and manage your photo galleries with intuitive event management tools.
+
+<img src="docs/screenshots-events.png" alt="PicPeak Events Management" width="800" />
+
+### ✨ **Key Interface Highlights**
+
+<details>
+<summary>👆 Click to see more interface details</summary>
+
+#### What makes PicPeak's interface special:
+
+- **🎨 Clean Design**: Modern, photographer-friendly interface
+- **📱 Responsive**: Perfect on desktop, tablet, and mobile
+- **⚡ Fast Loading**: Optimized for quick photo browsing
+- **🔒 Secure Access**: Password-protected galleries with expiration
+- **📤 Easy Uploads**: Drag & drop functionality for effortless photo management
+- **🎯 Client-Focused**: Intuitive gallery experience for your clients
+
+</details>
+
+## 🗺️ Roadmap
+
+We're constantly improving PicPeak and welcome contributions from our community! If you have ideas for new features or want to help implement existing ones, please open an issue or submit a pull request. Your contributions help make PicPeak better for everyone.
+
+| Feature | Description | Priority | Status |
+|---------|-------------|----------|---------|
+| **Backup & Restore** | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | ✅ Implemented |
+| **Gallery Templates** | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
+| **Face Recognition** | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
+| **Gallery Feedback** | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | 🔄 Open |
+| **Video Support** | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
+
+**Status Legend:** ✅ Implemented | 🚧 In Progress | 🔄 Open | 📋 Planned
+
+## 🙏 Acknowledgments
+
+PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible.
+
+## 📄 License
+
+PicPeak is released under the [MIT License](LICENSE). Use it freely for personal or commercial projects.
+
+## 🚀 Ready to Get Started?
+
+1. ⭐ **Star this repository** to show your support
+2. 📖 Read the [Deployment Guide](DEPLOYMENT.md)
+3. 🐛 Report issues or request features
+4. 🤝 Join our community and contribute!
+
+---
+
+<p align="center">
+  Made with ❤️ by photographers, for photographers
+  <br>
+  <a href="https://github.com/the-luap/picpeak">GitHub</a> •
+  <a href="DEPLOYMENT.md">Documentation</a> •
+  <a href="https://github.com/the-luap/picpeak/issues">Support</a>
+</p>
@@ -0,0 +1,85 @@
+# Security Policy
+
+## Supported Versions
+
+We release patches for security vulnerabilities. Currently supported versions:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x.x   | :white_check_mark: |
+| < 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of PicPeak seriously. If you have discovered a security vulnerability, please follow these steps:
+
+### 1. **Do NOT create a public GitHub issue**
+
+### 2. Email us at security@example.com with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### 3. You can expect:
+- Acknowledgment within 48 hours
+- Regular updates on our progress
+- Credit in the fix announcement (unless you prefer to remain anonymous)
+
+## Security Measures
+
+PicPeak implements several security measures:
+
+### Authentication & Authorization
+- JWT-based authentication with secure token storage
+- bcrypt password hashing with configurable rounds
+- Role-based access control for admin functions
+- Session timeout management
+
+### Input Validation
+- All user inputs are validated and sanitized
+- SQL injection prevention through parameterized queries
+- XSS protection via Content Security Policy
+- File upload restrictions and validation
+
+### Rate Limiting
+- API rate limiting to prevent abuse
+- Brute force protection on authentication endpoints
+- Configurable limits per endpoint
+
+### Data Protection
+- HTTPS enforcement in production
+- Secure cookie settings
+- CORS configuration
+- Sensitive data encryption
+
+### Infrastructure
+- Regular dependency updates
+- Security headers (HSTS, X-Frame-Options, etc.)
+- Activity logging for audit trails
+- Automated backups
+
+## Best Practices for Deployment
+
+1. **Always use HTTPS** in production
+2. **Change default passwords** immediately
+3. **Keep dependencies updated** regularly
+4. **Configure firewall rules** appropriately
+5. **Monitor logs** for suspicious activity
+6. **Backup regularly** and test restoration
+
+## Vulnerability Disclosure
+
+We believe in responsible disclosure. Once a vulnerability is fixed:
+
+1. We'll publish a security advisory
+2. Credit researchers (with permission)
+3. Detail the impact and mitigation steps
+4. Release patches for all supported versions
+
+## Contact
+
+- Security issues: security@example.com
+- General support: https://github.com/the-luap/picpeak/issues
+
+Thank you for helping keep PicPeak and its users safe!
@@ -1,252 +0,0 @@
-# PicPeak - Complete Setup Guide
-
-## Repository Created Successfully! 🎉
-
-Your PicPeak repository has been created at:
-**https://gitea.nothaft.cloud/paul/picpeak**
-
-## What's Been Created
-
-I've uploaded the core files needed to run the application:
-
-### ✅ Created Files:
- `.gitignore` - Git ignore rules
- `.dockerignore` - Docker ignore rules
- `.env.example` - Environment configuration template
- `docker-compose.yml` - Development Docker setup
- `docker-compose.prod.yml` - Production Docker setup
- `backend/` - Core backend files including:
-  - `package.json` - Dependencies
-  - `server.js` - Main server file
-  - `Dockerfile` - Backend container config
-  - Core routes and services
- `setup-remaining-files.sh` - Script to create remaining files
-
-## Next Steps to Complete Setup
-
-### 1. Clone the Repository
-```bash
-git clone https://gitea.local.nothaft.cloud/paul/picpeak.git
-cd picpeak
-```
-
-### 2. Run the Setup Script
-```bash
-chmod +x setup-remaining-files.sh
-./setup-remaining-files.sh
-```
-
-This will create all remaining directories and files needed.
-
-### 3. Create Critical Service Files
-
-Due to the large number of files, I've created the most important ones. You'll need to add these remaining backend services:
-
-#### backend/src/services/expirationChecker.js
-```javascript
-const cron = require('node-cron');
-const { db } = require('../database/db');
-const { archiveEvent } = require('./archiveService');
-const logger = require('../utils/logger');
-
-function startExpirationChecker() {
-  // Check every hour for expired events
-  cron.schedule('0 * * * *', async () => {
-    await checkExpirations();
-  });
-  
-  logger.info('Expiration checker started');
-}
-
-async function checkExpirations() {
-  try {
-    const now = new Date();
-    const warningDate = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
-    
-    // Check for events needing warning emails
-    const eventsNeedingWarning = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', warningDate)
-      .where('expires_at', '>', now);
-    
-    for (const event of eventsNeedingWarning) {
-      const existingWarning = await db('email_queue')
-        .where('event_id', event.id)
-        .where('email_type', 'warning')
-        .first();
-      
-      if (!existingWarning) {
-        await queueExpirationWarning(event);
-      }
-    }
-    
-    // Check for expired events
-    const expiredEvents = await db('events')
-      .where('is_active', true)
-      .where('is_archived', false)
-      .where('expires_at', '<=', now);
-    
-    for (const event of expiredEvents) {
-      await handleExpiredEvent(event);
-    }
-    
-  } catch (error) {
-    logger.error('Error checking expirations:', error);
-  }
-}
-
-async function queueExpirationWarning(event) {
-  const daysRemaining = Math.ceil((new Date(event.expires_at) - new Date()) / (1000 * 60 * 60 * 24));
-  
-  await db('email_queue').insert({
-    event_id: event.id,
-    recipient_email: event.host_email,
-    email_type: 'warning',
-    email_data: JSON.stringify({
-      event_name: event.event_name,
-      days_remaining: daysRemaining,
-      share_link: event.share_link
-    })
-  });
-  
-  logger.info(`Queued expiration warning for event ${event.slug}`);
-}
-
-async function handleExpiredEvent(event) {
-  try {
-    await db('events').where('id', event.id).update({ is_active: false });
-    
-    await db('email_queue').insert([
-      {
-        event_id: event.id,
-        recipient_email: event.host_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name
-        })
-      },
-      {
-        event_id: event.id,
-        recipient_email: event.admin_email,
-        email_type: 'expiration',
-        email_data: JSON.stringify({
-          event_name: event.event_name,
-          event_slug: event.slug
-        })
-      }
-    ]);
-    
-    await archiveEvent(event);
-    
-    logger.info(`Handled expiration for event ${event.slug}`);
-  } catch (error) {
-    logger.error(`Error handling expired event ${event.slug}:`, error);
-  }
-}
-
-module.exports = { startExpirationChecker };
-```
-
-### 4. Create Frontend Files
-
-The frontend needs these key files in `frontend/src/`:
-
-#### App.js
-```javascript
-import React from 'react';
-import { Routes, Route, Navigate } from 'react-router-dom';
-import { AuthProvider } from './contexts/AuthContext';
-import ProtectedRoute from './components/ProtectedRoute';
-
-// Pages
-import Login from './pages/Login';
-import Gallery from './pages/Gallery';
-import AdminLogin from './pages/admin/Login';
-import AdminDashboard from './pages/admin/Dashboard';
-
-function App() {
-  return (
-    <AuthProvider>
-      <Routes>
-        <Route path="/" element={<Navigate to="/gallery" />} />
-        <Route path="/gallery/:slug/:token?" element={<Gallery />} />
-        <Route path="/login/:slug" element={<Login />} />
-        <Route path="/admin/login" element={<AdminLogin />} />
-        <Route path="/admin" element={
-          <ProtectedRoute>
-            <AdminDashboard />
-          </ProtectedRoute>
-        } />
-      </Routes>
-    </AuthProvider>
-  );
-}
-
-export default App;
-```
-
-### 5. Install Dependencies
-
-```bash
-# Backend
-cd backend
-npm install
-
-# Frontend
-cd ../frontend
-npm install
-```
-
-### 6. Configure Environment
-
-Copy `.env.example` to `.env` and update with your settings:
-```bash
-cp .env.example .env
-nano .env
-```
-
-### 7. Start Development Environment
-
-```bash
-# From root directory
-docker-compose up
-```
-
- Backend: http://localhost:3000
- Frontend: http://localhost:3001
- MailHog: http://localhost:8025
-
-## Key Features Implemented
-
- ✅ Password-protected galleries
- ✅ Automatic expiration with email warnings
- ✅ File-based photo management
- ✅ ZIP archiving on expiration
- ✅ Separate admin and public interfaces
- ✅ Email notifications at all stages
- ✅ Mobile-responsive design
- ✅ Docker deployment ready
-
-## Production Deployment
-
-1. Update `.env` with production values
-2. Run `./scripts/install.sh` on your server
-3. Configure SSL with `./scripts/setup-ssl.sh`
-4. Start with `docker-compose -f docker-compose.prod.yml up -d`
-
-## Need Help?
-
-The complete implementation includes:
- Backend API with all routes
- React frontend with admin panel
- Email service with templates
- Automatic file watching
- Expiration checking
- Archive service
- Docker configuration
- Deployment scripts
-
-All core functionality from your PRD has been implemented. You may need to create some additional UI components based on your specific design preferences.
-
-Default admin credentials: **admin / admin123** (change immediately!)
@@ -1,47 +0,0 @@
-# TODO - Open Items Before Release
-
-## Priority Items
-
- [ ] **Gallery Mobile View** 
-  - Logout button should only show logo icon (no text)
-  - If photo upload is enabled, move upload button inside menu (not on top bar)
-  - Top bar should show: logo (left), gallery title (center), event date + expiration date
-
- [ ] **Gallery Preview** 
-  - Preview should correctly reflect the selected grid layout style
-  - Add grid style selector above current top bar
-  - Selector should match the style of event template settings grid selector
-
- [ ] **Hero Grid Layout** 
-  - Top bar: only menu and logout buttons
-  - Title + logo displayed centered on hero photo
-  - Event date and expiration date also on hero photo
-  - No logo/title in top bar
-
- [ ] **Logo Testing** - Test new PicPeak logos across all grid styles
-
- [ ] **Welcome Message** 
-  - Add welcome message to email template when creating new event
-  - Use as personal message in the email
-
- [ ] **Gallery Upload Function**
-  - Fix scrolling in upload popup when multiple images selected
-  - Save/Cancel buttons unreachable due to incorrect scroll formatting
-
- [ ] **Watermarks** - Test watermark functionality, styling, and image application
-
- [ ] **Dashboard Activities** - Remove "show all" link from latest activities widget
-
- [ ] **Security Audit** - Perform security review and code audit
-
- [ ] **Drone CI/CD** - Update drone.yaml configuration
-
- [ ] **Version Management** - Implement automatic version updates on commits/builds
-
-## Completed Items
-
-_(Move completed items here with date)_
-
---
-
-Last updated: 2025-07-10
@@ -1,280 +0,0 @@
-# Traefik Deployment Guide
-
-This guide explains how to deploy the PicPeak application with Traefik as the reverse proxy.
-
-## Overview
-
-The application consists of:
- **Frontend**: React app served by nginx (port 80)
- **Backend**: Node.js API (port 3000)
- **Database**: PostgreSQL (port 5432, internal only)
-
-## Traefik Configuration
-
-### 1. Docker Labels for Traefik
-
-Add these labels to your `docker-compose.prod.yml` services:
-
-```yaml
-services:
-  frontend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-frontend.rule=Host(`picpeak.yourdomain.com`)"
-      - "traefik.http.routers.picpeak-frontend.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-frontend.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-frontend.loadbalancer.server.port=80"
-      # Priority for catch-all route
-      - "traefik.http.routers.picpeak-frontend.priority=1"
-
-  backend:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-api.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/api`)"
-      - "traefik.http.routers.picpeak-api.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-api.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-api.loadbalancer.server.port=3000"
-      # Higher priority for API routes
-      - "traefik.http.routers.picpeak-api.priority=10"
-      
-      # Additional routes for backend static files
-      - "traefik.http.routers.picpeak-uploads.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/uploads`)"
-      - "traefik.http.routers.picpeak-uploads.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-uploads.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-uploads.service=picpeak-api"
-      - "traefik.http.routers.picpeak-uploads.priority=10"
-      
-      - "traefik.http.routers.picpeak-images.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/images`)"
-      - "traefik.http.routers.picpeak-images.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-images.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-images.service=picpeak-api"
-      - "traefik.http.routers.picpeak-images.priority=10"
-```
-
-### 2. Network Configuration
-
-Ensure your services are on the Traefik network:
-
-```yaml
-networks:
-  picpeak:
-    external: false
-  traefik:
-    external: true
-
-services:
-  frontend:
-    networks:
-      - picpeak
-      - traefik
-      
-  backend:
-    networks:
-      - picpeak
-      - traefik
-      
-  db:
-    networks:
-      - picpeak  # Don't expose to traefik
-```
-
-### 3. Remove Nginx Service
-
-Since you're using Traefik, remove the nginx service from `docker-compose.prod.yml`:
-
-```yaml
-# Remove this entire service:
-# nginx:
-#   image: nginx:alpine
-#   ...
-```
-
-## Frontend Configuration
-
-The frontend is built with the API URL set to `/api`. This is important because:
-
-1. All API calls will be relative to the same domain
-2. Traefik will route `/api/*` to the backend service
-3. No CORS issues since everything is on the same domain
-
-## Environment Variables
-
-Ensure these are set correctly:
-
-```bash
-# Backend needs to know the public URLs
-ADMIN_URL=https://picpeak.yourdomain.com
-FRONTEND_URL=https://picpeak.yourdomain.com
-
-# Backend API is accessed via /api path
-API_URL=https://picpeak.yourdomain.com/api
-```
-
-## Complete Example
-
-Here's a complete `docker-compose.prod.yml` for Traefik:
-
-```yaml
-version: '3.8'
-
-networks:
-  picpeak:
-    external: false
-  traefik:
-    external: true
-
-services:
-  backend:
-    image: picpeak-backend:latest
-    build:
-      context: ./backend
-      dockerfile: Dockerfile
-    restart: unless-stopped
-    depends_on:
-      - db
-    environment:
-      - NODE_ENV=production
-      - PORT=3000
-      - JWT_SECRET=${JWT_SECRET}
-      - ADMIN_URL=https://picpeak.yourdomain.com
-      - FRONTEND_URL=https://picpeak.yourdomain.com
-      - DATABASE_CLIENT=pg
-      - DB_HOST=db
-      - DB_PORT=5432
-      - DB_USER=${DB_USER:-picpeak}
-      - DB_PASSWORD=${DB_PASSWORD}
-      - DB_NAME=${DB_NAME:-picpeak}
-      - SMTP_HOST=${SMTP_HOST}
-      - SMTP_PORT=${SMTP_PORT}
-      - SMTP_SECURE=${SMTP_SECURE}
-      - SMTP_USER=${SMTP_USER}
-      - SMTP_PASS=${SMTP_PASS}
-      - EMAIL_FROM=${EMAIL_FROM}
-      - STORAGE_PATH=/app/storage
-      - EVENTS_PATH=/app/storage/events
-      - ARCHIVE_PATH=/app/storage/events/archived
-    volumes:
-      - ./storage:/app/storage
-      - ./data:/app/data
-      - ./logs:/app/logs
-    networks:
-      - picpeak
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-api.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/api`)"
-      - "traefik.http.routers.picpeak-api.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-api.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-api.loadbalancer.server.port=3000"
-      - "traefik.http.routers.picpeak-api.priority=10"
-      
-      - "traefik.http.routers.picpeak-uploads.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/uploads`)"
-      - "traefik.http.routers.picpeak-uploads.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-uploads.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-uploads.service=picpeak-api"
-      - "traefik.http.routers.picpeak-uploads.priority=10"
-      
-      - "traefik.http.routers.picpeak-images.rule=Host(`picpeak.yourdomain.com`) && PathPrefix(`/images`)"
-      - "traefik.http.routers.picpeak-images.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-images.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.picpeak-images.service=picpeak-api"
-      - "traefik.http.routers.picpeak-images.priority=10"
-
-  frontend:
-    image: picpeak-frontend:latest
-    build:
-      context: ./frontend
-      dockerfile: Dockerfile
-      args:
-        - VITE_API_URL=/api
-    restart: unless-stopped
-    depends_on:
-      - backend
-    networks:
-      - picpeak
-      - traefik
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.picpeak-frontend.rule=Host(`picpeak.yourdomain.com`)"
-      - "traefik.http.routers.picpeak-frontend.entrypoints=websecure"
-      - "traefik.http.routers.picpeak-frontend.tls.certresolver=letsencrypt"
-      - "traefik.http.services.picpeak-frontend.loadbalancer.server.port=80"
-      - "traefik.http.routers.picpeak-frontend.priority=1"
-
-  db:
-    image: postgres:14-alpine
-    restart: unless-stopped
-    environment:
-      - POSTGRES_USER=${DB_USER:-picpeak}
-      - POSTGRES_PASSWORD=${DB_PASSWORD}
-      - POSTGRES_DB=${DB_NAME:-picpeak}
-      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
-      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=trust
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    networks:
-      - picpeak
-    command: postgres -c ssl=off
-
-volumes:
-  postgres_data:
-```
-
-## Troubleshooting
-
-### 502 Bad Gateway Errors
-
-1. **Check if backend is running**:
-   ```bash
-   docker-compose -f docker-compose.prod.yml ps
-   docker-compose -f docker-compose.prod.yml logs backend
-   ```
-
-2. **Verify Traefik can reach the backend**:
-   - Ensure both services are on the same Docker network
-   - Check Traefik logs: `docker logs traefik`
-
-3. **Check backend health**:
-   ```bash
-   docker-compose -f docker-compose.prod.yml exec backend curl http://localhost:3000/api/health
-   ```
-
-### Frontend Can't Reach API
-
-1. **Verify API paths don't have double `/api`**:
-   - Frontend should call `/auth/admin/login`, not `/api/auth/admin/login`
-   - The base URL in axios should be `/api`
-
-2. **Check browser console for actual URLs being called**
-
-3. **Ensure Traefik routing rules are correct**:
-   - API routes should have higher priority than frontend catch-all
-
-### CORS Issues
-
-Should not occur since everything is on the same domain. If you see CORS errors:
-1. Check that `FRONTEND_URL` and `ADMIN_URL` match your actual domain
-2. Ensure you're not mixing HTTP and HTTPS
-
-## Testing the Setup
-
-1. **Test API directly**:
-   ```bash
-   curl https://picpeak.yourdomain.com/api/health
-   ```
-
-2. **Test frontend**:
-   ```bash
-   curl https://picpeak.yourdomain.com/
-   ```
-
-3. **Test admin login**:
-   - Navigate to https://picpeak.yourdomain.com/admin/login
-   - Check browser console for any errors
-
-## Important Notes
-
-1. **SSL/TLS**: Traefik handles SSL termination, so the backend doesn't need SSL
-2. **Port Exposure**: Don't expose backend ports directly - let Traefik handle routing
-3. **Health Checks**: Configure Traefik health checks for better reliability
-4. **Rate Limiting**: Consider adding Traefik rate limiting middleware for API routes
@@ -1,134 +0,0 @@
-# Traefik Troubleshooting Guide
-
-## Common Issues and Solutions
-
-### 1. 404 Errors on API Routes
-
-**Problem**: Getting 404 errors when accessing `/api/*` routes
-
-**Causes**:
- Traefik routing rules not properly configured
- Backend container not healthy
- Path stripping not working correctly
-
-**Solutions**:
-
-1. **Check container health**:
-```bash
-docker ps # Check if backend is running
-docker logs picpeak-backend # Check for startup errors
-```
-
-2. **Test backend directly**:
-```bash
-# Access backend container
-docker exec -it picpeak-backend sh
-
-# Test health endpoint
-wget -O- http://localhost:3000/health
-
-# Test public settings endpoint
-wget -O- http://localhost:3000/public/settings
-```
-
-3. **Check Traefik routing**:
-```bash
-# Check if routes are registered in Traefik
-curl https://traefik.yourdomain.com/api/http/routers | jq '.[] | select(.rule | contains("picpeak"))'
-```
-
-### 2. Backend Not Accessible Through Traefik
-
-**Key Configuration Points**:
-
-1. **Traefik Labels** (in deploy section):
-   - `traefik.enable=true` - Enable Traefik for this container
-   - `traefik.docker.network=proxy` - Specify which network Traefik should use
-   - `traefik.http.routers.picpeak-backend.priority=100` - Higher priority for API routes
-
-2. **Path Stripping**:
-   - Frontend expects `/api/*` but backend serves routes without `/api` prefix
-   - Middleware strips `/api` before forwarding to backend
-
-3. **Network Configuration**:
-   - Backend must be in both `picpeak` (internal) and `proxy` (Traefik) networks
-
-### 3. Environment Variable Issues
-
-**Critical Variables**:
- `ADMIN_URL` and `FRONTEND_URL` must match your actual domain
- These affect CORS configuration
-
-**Example .env**:
-```env
-# URLs
-ADMIN_URL=https://picpeak.local.nothaft.cloud
-FRONTEND_URL=https://picpeak.local.nothaft.cloud
-
-# Database
-DB_USER=picpeak
-DB_PASSWORD=your_secure_password
-DB_NAME=picpeak
-
-# JWT
-JWT_SECRET=your_secure_jwt_secret
-
-# Email (optional)
-SMTP_HOST=smtp.example.com
-SMTP_PORT=587
-SMTP_SECURE=true
-SMTP_USER=noreply@example.com
-SMTP_PASS=smtp_password
-EMAIL_FROM=noreply@example.com
-```
-
-### 4. Debugging Steps
-
-1. **Check if backend is receiving requests**:
-```bash
-# Watch backend logs
-docker logs -f picpeak-backend
-
-# Look for incoming requests when you try to access the admin page
-```
-
-2. **Test API routes directly**:
-```bash
-# From outside
-curl -v https://picpeak.local.nothaft.cloud/api/public/settings
-
-# Should see backend logs if request reaches container
-```
-
-3. **Verify Traefik middleware**:
-```bash
-# Check if stripprefix middleware exists
-curl https://traefik.yourdomain.com/api/http/middlewares | jq '.[] | select(.name | contains("picpeak"))'
-```
-
-### 5. Quick Fix Checklist
-
- [ ] Backend container is healthy (`docker ps`)
- [ ] Backend is in both networks (`docker inspect picpeak-backend | grep -A 20 Networks`)
- [ ] Traefik labels use correct network (`traefik.docker.network=proxy`)
- [ ] Priority is set correctly (backend: 100, frontend: 10)
- [ ] ADMIN_URL and FRONTEND_URL match your domain
- [ ] Database is accessible from backend
- [ ] Migrations have run successfully
-
-### 6. Alternative Testing
-
-If Traefik routing is problematic, test backend directly:
-
-```bash
-# Port forward to test backend directly
-docker run --rm -it --network picpeak alpine/curl curl http://backend:3000/health
-
-# Or expose backend port temporarily
-docker run -d --name picpeak-backend-test \
-  --network picpeak \
-  -p 3001:3000 \
-  registry.local.nothaft.cloud/picpeak-backend:latest
-```
-
-Then access http://localhost:3001/health to verify backend is working.
@@ -3,39 +3,56 @@

 # Application
 NODE_ENV=production
-PORT=3000
+PORT=3001

 # Security
-JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long
+# Generate with: openssl rand -base64 32
+JWT_SECRET=your-very-secure-jwt-secret-at-least-32-characters-long-example123456

-# URLs
-ADMIN_URL=https://yourdomain.com
-FRONTEND_URL=https://yourdomain.com
+# URLs (adjust for your domain)
+ADMIN_URL=https://photos.example.com
+FRONTEND_URL=https://photos.example.com

 # Database Configuration
 DATABASE_CLIENT=pg
-DB_HOST=db
+DB_HOST=localhost
 DB_PORT=5432
 DB_USER=picpeak
-DB_PASSWORD=your-secure-database-password
+DB_PASSWORD=your-secure-database-password-change-this
 DB_NAME=picpeak

-# Email Configuration
-SMTP_HOST=smtp.example.com
+# Email Configuration (Examples for common providers)
+# Gmail example:
+# SMTP_HOST=smtp.gmail.com
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=your-email@gmail.com
+# SMTP_PASS=your-app-specific-password
+
+# SendGrid example:
+SMTP_HOST=smtp.sendgrid.net
 SMTP_PORT=587
 SMTP_SECURE=false
-SMTP_USER=your-smtp-username
-SMTP_PASS=your-smtp-password
-EMAIL_FROM=noreply@yourdomain.com
+SMTP_USER=apikey
+SMTP_PASS=your-sendgrid-api-key
+EMAIL_FROM=noreply@example.com

-# Storage Paths (Docker)
+# Storage Paths
+# Docker deployment:
 STORAGE_PATH=/app/storage
 EVENTS_PATH=/app/storage/events
 ARCHIVE_PATH=/app/storage/events/archived

-# Analytics (Optional)
-UMAMI_URL=https://analytics.yourdomain.com
-UMAMI_WEBSITE_ID=your-website-id
+# Local development:
+# STORAGE_PATH=./storage
+# EVENTS_PATH=./storage/events
+# ARCHIVE_PATH=./storage/events/archived
+
+# Analytics Backend Configuration (OPTIONAL)
+# Used for server-side tracking only
+# Primary configuration should be done through Admin UI > Settings > Analytics
+# UMAMI_URL=https://analytics.example.com
+# UMAMI_WEBSITE_ID=b4d3c2a1-5678-90ab-cdef-1234567890ab

 # Logging
 LOG_LEVEL=info
@@ -1,5 +1,8 @@
 FROM node:18-alpine AS builder

+# Add build argument for cache busting
+ARG CACHEBUST=1
+
 WORKDIR /app

 # Copy package files
@@ -0,0 +1,229 @@
+# Enhanced Backup System Test Suite
+
+This directory contains comprehensive tests for the enhanced backup system with S3 support.
+
+## Test Structure
+
+### Unit Tests
+- `services/backupService.enhanced.test.js` - Unit tests for the enhanced backup service
+  - Configuration management
+  - S3 backup functionality
+  - Manifest generation
+  - Error handling and recovery
+  - Backward compatibility (local and rsync)
+  - Service lifecycle management
+
+### Integration Tests
+- `integration/backup-s3.test.js` - Integration tests for S3 backups
+  - Real S3/MinIO connection tests
+  - Full backup process with actual files
+  - Incremental backup verification
+  - Manifest storage and retrieval
+  - Error recovery scenarios
+
+### Manual Integration Test Script
+- `../scripts/test-backup-integration.js` - Comprehensive manual testing script
+  - Can test against MinIO, AWS S3, or any S3-compatible service
+  - Tests all backup types (S3, local, rsync)
+  - Performance testing with large files
+  - Detailed progress reporting
+
+## Running Tests
+
+### Prerequisites
+
+1. **For Unit Tests**: No special setup required, all dependencies are mocked.
+
+2. **For Integration Tests**: Requires a running S3-compatible service (MinIO recommended)
+   ```bash
+   # Start MinIO using Docker
+   docker run -d \
+     -p 9000:9000 \
+     -p 9001:9001 \
+     --name minio-test \
+     -e MINIO_ROOT_USER=minioadmin \
+     -e MINIO_ROOT_PASSWORD=minioadmin \
+     minio/minio server /data --console-address ":9001"
+   ```
+
+3. **Environment Variables** (for integration tests):
+   ```bash
+   # Optional - defaults work with local MinIO
+   export TEST_S3_ENDPOINT=http://localhost:9000
+   export TEST_S3_ACCESS_KEY=minioadmin
+   export TEST_S3_SECRET_KEY=minioadmin
+   
+   # Skip S3 tests if no S3 service available
+   export SKIP_S3_TESTS=true
+   ```
+
+### Running Unit Tests
+
+```bash
+# Run all backup service tests
+npm test -- __tests__/services/backupService.enhanced.test.js
+
+# Run specific test suite
+npm test -- __tests__/services/backupService.enhanced.test.js -t "S3 Backup Functionality"
+
+# Run with coverage
+npm test -- --coverage __tests__/services/backupService.enhanced.test.js
+```
+
+### Running Integration Tests
+
+```bash
+# Ensure MinIO is running first!
+
+# Run S3 integration tests
+npm test -- __tests__/integration/backup-s3.test.js
+
+# Run with verbose output
+npm test -- __tests__/integration/backup-s3.test.js --verbose
+
+# Skip S3 tests if needed
+SKIP_S3_TESTS=true npm test -- __tests__/integration/backup-s3.test.js
+```
+
+### Running Manual Integration Tests
+
+```bash
+# Test with local MinIO (default)
+node scripts/test-backup-integration.js
+
+# Test with AWS S3
+node scripts/test-backup-integration.js \
+  --endpoint https://s3.amazonaws.com \
+  --access-key YOUR_ACCESS_KEY \
+  --secret-key YOUR_SECRET_KEY \
+  --bucket your-test-bucket
+
+# Test local backup
+node scripts/test-backup-integration.js --type local
+
+# Test with cleanup after completion
+node scripts/test-backup-integration.js --cleanup
+
+# Verbose output
+node scripts/test-backup-integration.js --verbose
+```
+
+## Test Coverage
+
+The test suite covers:
+
+### Configuration
+- ✅ Database configuration retrieval
+- ✅ JSON parsing and error handling
+- ✅ Configuration validation
+- ✅ Required field validation
+
+### S3 Functionality
+- ✅ S3 client initialization
+- ✅ Connection testing
+- ✅ File upload with progress tracking
+- ✅ Large file handling (multipart upload)
+- ✅ Metadata and custom headers
+- ✅ Error handling and retries
+
+### Backup Process
+- ✅ Full backup execution
+- ✅ Incremental backup (changed files only)
+- ✅ File checksum calculation and comparison
+- ✅ Database backup inclusion
+- ✅ Archive inclusion toggle
+- ✅ File size limits
+
+### Manifest Generation
+- ✅ Full manifest generation
+- ✅ Incremental manifest with parent reference
+- ✅ JSON and YAML format support
+- ✅ Manifest validation
+- ✅ S3 manifest storage and retrieval
+- ✅ Checksum verification
+
+### Error Handling
+- ✅ S3 connection failures
+- ✅ File read errors
+- ✅ Individual file failure recovery
+- ✅ Retry logic with exponential backoff
+- ✅ Email notifications on failure
+- ✅ Concurrent backup prevention
+
+### Backward Compatibility
+- ✅ Local directory backup
+- ✅ Rsync backup
+- ✅ Existing manifest format support
+
+### Service Management
+- ✅ Cron job scheduling
+- ✅ Service start/stop
+- ✅ Manual backup triggering
+- ✅ Backup history and status
+
+## Mock Setup
+
+The unit tests use comprehensive mocking:
+
+```javascript
+// Database mocking
+jest.mock('../../src/database/db');
+
+// S3 client mocking
+jest.mock('../../src/services/storage/s3Storage');
+
+// File system mocking
+const mockFs = require('mock-fs');
+
+// Cron job mocking
+jest.mock('node-cron');
+```
+
+## CI/CD Integration
+
+To run tests in CI/CD pipeline:
+
+```yaml
+# Example GitHub Actions
+- name: Run Unit Tests
+  run: npm test -- __tests__/services/backupService.enhanced.test.js
+
+- name: Start MinIO
+  run: |
+    docker run -d \
+      -p 9000:9000 \
+      --name minio-test \
+      -e MINIO_ROOT_USER=minioadmin \
+      -e MINIO_ROOT_PASSWORD=minioadmin \
+      minio/minio server /data
+
+- name: Run Integration Tests
+  run: npm test -- __tests__/integration/backup-s3.test.js
+```
+
+## Debugging Tests
+
+```bash
+# Run tests in debug mode
+node --inspect-brk ./node_modules/.bin/jest __tests__/services/backupService.enhanced.test.js
+
+# Run single test with console output
+npm test -- __tests__/services/backupService.enhanced.test.js -t "should perform S3 backup" --verbose
+```
+
+## Performance Considerations
+
+- Integration tests create real files and S3 objects
+- Each test run creates a unique S3 bucket to avoid conflicts
+- Cleanup is automatic but can be disabled for debugging
+- Large file tests (10MB+) are included but can be slow
+
+## Adding New Tests
+
+When adding new backup features:
+
+1. Add unit tests to `backupService.enhanced.test.js`
+2. Add integration tests to `backup-s3.test.js` if S3-specific
+3. Update manual test script for comprehensive testing
+4. Ensure mocks are properly configured
+5. Document any new environment requirements
@@ -0,0 +1,506 @@
+const { describe, it, expect, jest, beforeAll, afterAll, beforeEach, afterEach } = require('@jest/globals');
+const { S3Client, CreateBucketCommand, DeleteBucketCommand, ListObjectsV2Command, DeleteObjectsCommand } = require('@aws-sdk/client-s3');
+const path = require('path');
+const fs = require('fs').promises;
+const crypto = require('crypto');
+
+// Load services
+const backupService = require('../../src/services/backupService');
+const S3StorageAdapter = require('../../src/services/storage/s3Storage');
+const { db, initialize: initDb } = require('../../src/database/db');
+const logger = require('../../src/utils/logger');
+
+// Test configuration
+const TEST_CONFIG = {
+  endpoint: process.env.TEST_S3_ENDPOINT || 'http://localhost:9000',
+  accessKeyId: process.env.TEST_S3_ACCESS_KEY || 'minioadmin',
+  secretAccessKey: process.env.TEST_S3_SECRET_KEY || 'minioadmin',
+  bucket: 'test-backup-bucket-' + Date.now(),
+  region: 'us-east-1'
+};
+
+describe('S3 Backup Integration Tests', () => {
+  let s3Client;
+  let testStoragePath;
+  let originalEnv;
+
+  beforeAll(async () => {
+    // Skip if no S3 endpoint configured
+    if (process.env.SKIP_S3_TESTS === 'true') {
+      console.log('Skipping S3 integration tests (SKIP_S3_TESTS=true)');
+      return;
+    }
+
+    // Save original environment
+    originalEnv = { ...process.env };
+
+    // Initialize S3 client for test setup
+    s3Client = new S3Client({
+      endpoint: TEST_CONFIG.endpoint,
+      region: TEST_CONFIG.region,
+      credentials: {
+        accessKeyId: TEST_CONFIG.accessKeyId,
+        secretAccessKey: TEST_CONFIG.secretAccessKey
+      },
+      forcePathStyle: true
+    });
+
+    // Create test bucket
+    try {
+      await s3Client.send(new CreateBucketCommand({ Bucket: TEST_CONFIG.bucket }));
+      console.log(`Created test bucket: ${TEST_CONFIG.bucket}`);
+    } catch (error) {
+      if (error.name !== 'BucketAlreadyOwnedByYou') {
+        console.error('Failed to create test bucket:', error);
+        throw error;
+      }
+    }
+
+    // Initialize database
+    await initDb();
+    await db.migrate.latest();
+
+    // Create test storage directory
+    testStoragePath = path.join(__dirname, '../fixtures/test-storage');
+    await fs.mkdir(testStoragePath, { recursive: true });
+    process.env.STORAGE_PATH = testStoragePath;
+
+    // Set up test data
+    await setupTestData();
+
+    // Mock logger to reduce noise
+    logger.info = jest.fn();
+    logger.debug = jest.fn();
+    logger.warn = jest.fn();
+    logger.error = jest.fn();
+  });
+
+  afterAll(async () => {
+    if (process.env.SKIP_S3_TESTS === 'true') return;
+
+    try {
+      // Clean up S3 bucket
+      await cleanupS3Bucket();
+      await s3Client.send(new DeleteBucketCommand({ Bucket: TEST_CONFIG.bucket }));
+      console.log(`Deleted test bucket: ${TEST_CONFIG.bucket}`);
+    } catch (error) {
+      console.error('Failed to cleanup S3 bucket:', error);
+    }
+
+    // Clean up test storage
+    await fs.rm(testStoragePath, { recursive: true, force: true });
+
+    // Restore environment
+    process.env = originalEnv;
+
+    // Close database
+    await db.destroy();
+  });
+
+  beforeEach(async () => {
+    if (process.env.SKIP_S3_TESTS === 'true') {
+      return;
+    }
+
+    // Clean backup tables
+    await db('backup_runs').del();
+    await db('backup_file_states').del();
+    await db('database_backup_runs').del();
+
+    // Configure S3 backup settings
+    await configureS3Backup();
+  });
+
+  afterEach(async () => {
+    if (process.env.SKIP_S3_TESTS === 'true') return;
+
+    // Clean up S3 objects created during test
+    await cleanupS3Bucket();
+  });
+
+  describe('S3 Connection and Configuration', () => {
+    it('should successfully connect to S3-compatible storage', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      const s3Adapter = new S3StorageAdapter({
+        ...TEST_CONFIG,
+        bucket: TEST_CONFIG.bucket,
+        forcePathStyle: true,
+        sslEnabled: false
+      });
+
+      const connected = await s3Adapter.testConnection();
+      expect(connected).toBe(true);
+    });
+
+    it('should validate S3 configuration before backup', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Remove required configuration
+      await db('app_settings')
+        .where('setting_key', 'backup_s3_secret_key')
+        .del();
+
+      await backupService.runBackup();
+
+      const lastRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(lastRun.status).toBe('failed');
+      expect(lastRun.error_message).toContain('S3 backup configuration incomplete');
+    });
+  });
+
+  describe('Full S3 Backup Process', () => {
+    it('should perform complete S3 backup with all file types', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Run backup
+      await backupService.runBackup();
+
+      // Verify backup run completed
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(backupRun.status).toBe('completed');
+      expect(backupRun.files_backed_up).toBeGreaterThan(0);
+      expect(backupRun.total_size_bytes).toBeGreaterThan(0);
+
+      // Verify files in S3
+      const s3Objects = await listS3Objects();
+      expect(s3Objects.length).toBeGreaterThan(0);
+
+      // Check for expected file types
+      const hasPhotos = s3Objects.some(obj => obj.Key.includes('events/active'));
+      const hasThumbnails = s3Objects.some(obj => obj.Key.includes('thumbnails'));
+      const hasManifest = s3Objects.some(obj => obj.Key.includes('backup-manifest'));
+      const hasSummary = s3Objects.some(obj => obj.Key.includes('backup-summary.json'));
+
+      expect(hasPhotos).toBe(true);
+      expect(hasThumbnails).toBe(true);
+      expect(hasManifest).toBe(true);
+      expect(hasSummary).toBe(true);
+    });
+
+    it('should handle large file uploads with multipart', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Create a large test file (15MB)
+      const largeFilePath = path.join(testStoragePath, 'events/active/large-photo.jpg');
+      const largeFileSize = 15 * 1024 * 1024; // 15MB
+      const largeFileContent = Buffer.alloc(largeFileSize, 'x');
+      await fs.writeFile(largeFilePath, largeFileContent);
+
+      // Run backup
+      await backupService.runBackup();
+
+      // Verify large file was uploaded
+      const s3Objects = await listS3Objects();
+      const largeFileUploaded = s3Objects.some(obj => 
+        obj.Key.includes('large-photo.jpg') && obj.Size === largeFileSize
+      );
+
+      expect(largeFileUploaded).toBe(true);
+    });
+
+    it('should include database backup when available', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Create a mock database backup
+      const dbBackupPath = path.join(testStoragePath, 'backups/db-backup.sql');
+      await fs.mkdir(path.dirname(dbBackupPath), { recursive: true });
+      await fs.writeFile(dbBackupPath, 'CREATE TABLE test (id INT);');
+
+      // Record database backup
+      await db('database_backup_runs').insert({
+        started_at: new Date(),
+        completed_at: new Date(),
+        status: 'completed',
+        backup_type: 'sqlite',
+        file_path: dbBackupPath,
+        file_size_bytes: 100,
+        checksum: 'test123',
+        statistics: JSON.stringify({ tables: {} }),
+        table_checksums: JSON.stringify({})
+      });
+
+      // Configure to include database
+      await db('app_settings')
+        .where('setting_key', 'backup_include_database')
+        .update({ setting_value: 'true' });
+
+      // Run backup
+      await backupService.runBackup();
+
+      // Verify database backup in S3
+      const s3Objects = await listS3Objects();
+      const hasDbBackup = s3Objects.some(obj => obj.Key.includes('database/db-backup.sql'));
+      expect(hasDbBackup).toBe(true);
+    });
+  });
+
+  describe('Incremental Backup', () => {
+    it('should only upload changed files in incremental backup', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // First backup - full
+      await backupService.runBackup();
+
+      const firstRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      const firstObjectCount = (await listS3Objects()).length;
+
+      // Wait a moment to ensure different timestamps
+      await new Promise(resolve => setTimeout(resolve, 100));
+
+      // Modify one file
+      const modifiedFile = path.join(testStoragePath, 'events/active/event1/photo1.jpg');
+      await fs.writeFile(modifiedFile, 'modified content');
+
+      // Second backup - incremental
+      await backupService.runBackup();
+
+      const secondRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(secondRun.id).not.toBe(firstRun.id);
+      expect(secondRun.files_backed_up).toBe(1); // Only modified file
+
+      // Check manifest indicates incremental
+      if (secondRun.manifest_path) {
+        const manifest = await backupService.getBackupManifest(secondRun.id);
+        expect(manifest.manifest.incremental).toBeDefined();
+        expect(manifest.manifest.incremental.modified_files_count).toBe(1);
+      }
+    });
+
+    it('should track file states across backups', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      await backupService.runBackup();
+
+      // Check file states are recorded
+      const fileStates = await db('backup_file_states').select('*');
+      expect(fileStates.length).toBeGreaterThan(0);
+
+      // Verify checksums are stored
+      const hasChecksums = fileStates.every(state => state.checksum !== null);
+      expect(hasChecksums).toBe(true);
+    });
+  });
+
+  describe('S3 Manifest Storage', () => {
+    it('should upload manifest to S3 and retrieve it', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Configure YAML manifest format
+      await db('app_settings')
+        .where('setting_key', 'backup_manifest_format')
+        .update({ setting_value: '"yaml"' });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(backupRun.manifest_path).toMatch(/^s3:\/\//);
+
+      // Retrieve manifest
+      const { manifest, summary } = await backupService.getBackupManifest(backupRun.id);
+
+      expect(manifest).toBeDefined();
+      expect(manifest.backup.id).toBeDefined();
+      expect(summary).toContain('BACKUP MANIFEST SUMMARY');
+    });
+
+    it('should validate manifest integrity', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      const validationResult = await backupService.validateBackupManifest(backupRun.manifest_path);
+
+      expect(validationResult.valid).toBe(true);
+      expect(validationResult.manifest).toBeDefined();
+    });
+  });
+
+  describe('Error Recovery', () => {
+    it('should handle S3 connection failures gracefully', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Configure with invalid endpoint
+      await db('app_settings')
+        .where('setting_key', 'backup_s3_endpoint')
+        .update({ setting_value: '"http://invalid-endpoint:9999"' });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      expect(backupRun.status).toBe('failed');
+      expect(backupRun.error_message).toBeDefined();
+    });
+
+    it('should continue backup despite individual file failures', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Create a file that will be deleted during backup
+      const tempFile = path.join(testStoragePath, 'events/active/temp.jpg');
+      await fs.writeFile(tempFile, 'temporary');
+
+      // Mock file deletion during backup
+      const originalUpload = S3StorageAdapter.prototype.upload;
+      let callCount = 0;
+      S3StorageAdapter.prototype.upload = jest.fn(async function(localPath, s3Key, options) {
+        callCount++;
+        if (callCount === 2) {
+          // Delete the temp file to cause an error
+          await fs.unlink(tempFile).catch(() => {});
+        }
+        return originalUpload.call(this, localPath, s3Key, options);
+      });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      // Should complete despite one file error
+      expect(backupRun.status).toBe('completed');
+      expect(backupRun.files_backed_up).toBeGreaterThan(0);
+
+      // Restore original method
+      S3StorageAdapter.prototype.upload = originalUpload;
+    });
+
+    it('should retry failed uploads with exponential backoff', async () => {
+      if (process.env.SKIP_S3_TESTS === 'true') return;
+
+      // Mock S3 upload to fail twice then succeed
+      const originalUpload = S3StorageAdapter.prototype.upload;
+      let attemptCount = 0;
+      S3StorageAdapter.prototype.upload = jest.fn(async function(localPath, s3Key, options) {
+        attemptCount++;
+        if (attemptCount <= 2) {
+          const error = new Error('Network timeout');
+          error.code = 'ETIMEDOUT';
+          throw error;
+        }
+        return originalUpload.call(this, localPath, s3Key, options);
+      });
+
+      await backupService.runBackup();
+
+      const backupRun = await db('backup_runs')
+        .orderBy('started_at', 'desc')
+        .first();
+
+      // Should succeed after retries
+      expect(backupRun.status).toBe('completed');
+      expect(attemptCount).toBeGreaterThan(2);
+
+      // Restore original method
+      S3StorageAdapter.prototype.upload = originalUpload;
+    });
+  });
+
+  // Helper functions
+
+  async function setupTestData() {
+    // Create test directory structure
+    const dirs = [
+      'events/active/event1',
+      'events/active/event2',
+      'events/archived',
+      'thumbnails',
+      'uploads'
+    ];
+
+    for (const dir of dirs) {
+      await fs.mkdir(path.join(testStoragePath, dir), { recursive: true });
+    }
+
+    // Create test files
+    const files = [
+      { path: 'events/active/event1/photo1.jpg', content: 'photo1 content' },
+      { path: 'events/active/event1/photo2.jpg', content: 'photo2 content' },
+      { path: 'events/active/event2/photo3.jpg', content: 'photo3 content' },
+      { path: 'events/archived/old-event.zip', content: 'archived content' },
+      { path: 'thumbnails/thumb1.jpg', content: 'thumbnail content' },
+      { path: 'uploads/logo.png', content: 'logo content' }
+    ];
+
+    for (const file of files) {
+      await fs.writeFile(
+        path.join(testStoragePath, file.path),
+        file.content
+      );
+    }
+  }
+
+  async function configureS3Backup() {
+    const settings = [
+      { setting_key: 'backup_enabled', setting_value: 'true' },
+      { setting_key: 'backup_destination_type', setting_value: '"s3"' },
+      { setting_key: 'backup_s3_bucket', setting_value: `"${TEST_CONFIG.bucket}"` },
+      { setting_key: 'backup_s3_region', setting_value: `"${TEST_CONFIG.region}"` },
+      { setting_key: 'backup_s3_endpoint', setting_value: `"${TEST_CONFIG.endpoint}"` },
+      { setting_key: 'backup_s3_access_key', setting_value: `"${TEST_CONFIG.accessKeyId}"` },
+      { setting_key: 'backup_s3_secret_key', setting_value: `"${TEST_CONFIG.secretAccessKey}"` },
+      { setting_key: 'backup_s3_force_path_style', setting_value: 'true' },
+      { setting_key: 'backup_s3_ssl_enabled', setting_value: 'false' },
+      { setting_key: 'backup_include_archived', setting_value: 'true' },
+      { setting_key: 'backup_incremental', setting_value: 'true' },
+      { setting_key: 'backup_max_file_size_mb', setting_value: '100' }
+    ];
+
+    for (const setting of settings) {
+      await db('app_settings')
+        .insert({
+          setting_type: 'backup',
+          ...setting,
+          created_at: new Date(),
+          updated_at: new Date()
+        })
+        .onConflict(['setting_type', 'setting_key'])
+        .merge();
+    }
+  }
+
+  async function listS3Objects() {
+    const response = await s3Client.send(new ListObjectsV2Command({
+      Bucket: TEST_CONFIG.bucket
+    }));
+    return response.Contents || [];
+  }
+
+  async function cleanupS3Bucket() {
+    try {
+      const objects = await listS3Objects();
+      if (objects.length > 0) {
+        await s3Client.send(new DeleteObjectsCommand({
+          Bucket: TEST_CONFIG.bucket,
+          Delete: {
+            Objects: objects.map(obj => ({ Key: obj.Key }))
+          }
+        }));
+      }
+    } catch (error) {
+      console.error('Failed to cleanup S3 objects:', error);
+    }
+  }
+});
@@ -0,0 +1,751 @@
+const { describe, it, expect, jest, beforeEach, afterEach } = require('@jest/globals');
+const mockFs = require('mock-fs');
+const path = require('path');
+const crypto = require('crypto');
+const { EventEmitter } = require('events');
+
+// Mock dependencies before requiring the module
+jest.mock('../../src/database/db');
+jest.mock('../../src/utils/logger');
+jest.mock('../../src/services/emailProcessor');
+jest.mock('node-cron');
+jest.mock('../../src/services/backupManifest');
+jest.mock('../../src/services/storage/s3Storage');
+
+const backupService = require('../../src/services/backupService');
+const { db } = require('../../src/database/db');
+const logger = require('../../src/utils/logger');
+const { queueEmail } = require('../../src/services/emailProcessor');
+const cron = require('node-cron');
+const backupManifest = require('../../src/services/backupManifest');
+const S3StorageAdapter = require('../../src/services/storage/s3Storage');
+
+describe('Enhanced Backup Service Tests', () => {
+  let mockDb;
+  let mockS3Client;
+  let mockCronJob;
+
+  beforeEach(() => {
+    // Reset all mocks
+    jest.clearAllMocks();
+    
+    // Mock database
+    mockDb = {
+      select: jest.fn().mockReturnThis(),
+      where: jest.fn().mockReturnThis(),
+      orderBy: jest.fn().mockReturnThis(),
+      limit: jest.fn().mockReturnThis(),
+      first: jest.fn(),
+      insert: jest.fn(),
+      update: jest.fn(),
+      delete: jest.fn()
+    };
+    db.mockReturnValue(mockDb);
+    
+    // Mock cron job
+    mockCronJob = {
+      stop: jest.fn()
+    };
+    cron.schedule.mockReturnValue(mockCronJob);
+    
+    // Mock S3 client
+    mockS3Client = {
+      testConnection: jest.fn().mockResolvedValue(true),
+      upload: jest.fn().mockResolvedValue({ Location: 's3://bucket/key' }),
+      uploadStream: jest.fn().mockResolvedValue({ Location: 's3://bucket/key' }),
+      download: jest.fn().mockResolvedValue(),
+      exists: jest.fn().mockResolvedValue(false),
+      delete: jest.fn().mockResolvedValue(),
+      list: jest.fn().mockResolvedValue({ Contents: [] })
+    };
+    S3StorageAdapter.mockImplementation(() => mockS3Client);
+    
+    // Mock backup manifest
+    backupManifest.generateManifest = jest.fn().mockResolvedValue({
+      backup: { id: 'test-backup-123' },
+      version: '2.0'
+    });
+    backupManifest.saveManifest = jest.fn().mockResolvedValue('/path/to/manifest.json');
+    backupManifest.loadManifest = jest.fn().mockResolvedValue({});
+    backupManifest.validateManifest = jest.fn();
+    backupManifest.generateSummaryReport = jest.fn().mockReturnValue('Summary report');
+    
+    // Mock logger
+    logger.info = jest.fn();
+    logger.error = jest.fn();
+    logger.warn = jest.fn();
+    logger.debug = jest.fn();
+  });
+
+  afterEach(() => {
+    mockFs.restore();
+  });
+
+  describe('getBackupConfig', () => {
+    it('should retrieve and parse backup configuration from database', async () => {
+      const mockSettings = [
+        { setting_key: 'backup_enabled', setting_value: 'true' },
+        { setting_key: 'backup_destination_type', setting_value: '"s3"' },
+        { setting_key: 'backup_s3_bucket', setting_value: '"test-bucket"' },
+        { setting_key: 'backup_retention_days', setting_value: '30' }
+      ];
+      
+      mockDb.select.mockResolvedValue(mockSettings);
+      
+      const config = await backupService.getBackupConfig();
+      
+      expect(config).toEqual({
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_retention_days: 30
+      });
+      
+      expect(db).toHaveBeenCalledWith('app_settings');
+      expect(mockDb.where).toHaveBeenCalledWith('setting_type', 'backup');
+    });
+
+    it('should handle JSON parse errors gracefully', async () => {
+      const mockSettings = [
+        { setting_key: 'backup_enabled', setting_value: 'invalid-json' }
+      ];
+      
+      mockDb.select.mockResolvedValue(mockSettings);
+      
+      const config = await backupService.getBackupConfig();
+      
+      expect(config).toEqual({
+        backup_enabled: 'invalid-json'
+      });
+    });
+
+    it('should return null on database error', async () => {
+      mockDb.select.mockRejectedValue(new Error('Database error'));
+      
+      const config = await backupService.getBackupConfig();
+      
+      expect(config).toBeNull();
+      expect(logger.error).toHaveBeenCalled();
+    });
+  });
+
+  describe('S3 Backup Functionality', () => {
+    beforeEach(() => {
+      // Mock file system
+      mockFs({
+        '/storage/events/active/event1': {
+          'photo1.jpg': Buffer.from('photo1 content'),
+          'photo2.jpg': Buffer.from('photo2 content')
+        },
+        '/storage/events/archived/event2.zip': Buffer.from('archived content'),
+        '/storage/thumbnails': {
+          'thumb1.jpg': Buffer.from('thumb1 content')
+        },
+        '/storage/uploads': {
+          'logo.png': Buffer.from('logo content')
+        }
+      });
+      
+      process.env.STORAGE_PATH = '/storage';
+    });
+
+    it('should perform S3 backup with correct configuration', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_region: 'us-east-1',
+        backup_s3_endpoint: 'https://s3.amazonaws.com',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_include_archived: true,
+        backup_max_file_size_mb: 100
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.where.mockReturnThis();
+      mockDb.first.mockResolvedValue(null);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      jest.spyOn(backupService, 'getDatabaseBackupInfo').mockResolvedValue({
+        type: 'sqlite',
+        backupFile: null,
+        hasChanged: true
+      });
+      
+      await backupService.runBackup();
+      
+      expect(S3StorageAdapter).toHaveBeenCalledWith({
+        bucket: 'test-bucket',
+        region: 'us-east-1',
+        endpoint: 'https://s3.amazonaws.com',
+        accessKeyId: 'test-key',
+        secretAccessKey: 'test-secret',
+        forcePathStyle: false,
+        sslEnabled: true,
+        maxRetries: 3,
+        retryDelay: 1000
+      });
+      
+      expect(mockS3Client.testConnection).toHaveBeenCalled();
+      expect(mockS3Client.upload).toHaveBeenCalled();
+    });
+
+    it('should handle S3 upload failures gracefully', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockS3Client.testConnection.mockRejectedValue(new Error('Connection failed'));
+      
+      await backupService.runBackup();
+      
+      expect(logger.error).toHaveBeenCalledWith('S3 backup failed:', expect.any(Error));
+      expect(mockDb.update).toHaveBeenCalledWith(expect.objectContaining({
+        status: 'failed',
+        error_message: expect.stringContaining('Connection failed')
+      }));
+    });
+
+    it('should skip unchanged files in incremental backup', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_incremental: true
+      };
+      
+      // Mock existing file state
+      mockDb.first.mockImplementation((query) => {
+        if (query === undefined) {
+          return Promise.resolve({
+            file_path: 'events/active/event1/photo1.jpg',
+            checksum: crypto.createHash('sha256').update('photo1 content').digest('hex')
+          });
+        }
+        return Promise.resolve(null);
+      });
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      await backupService.runBackup();
+      
+      // Should skip unchanged file
+      const uploadCalls = mockS3Client.upload.mock.calls;
+      const photo1Uploaded = uploadCalls.some(call => 
+        call[1].includes('photo1.jpg')
+      );
+      expect(photo1Uploaded).toBe(false);
+    });
+
+    it('should include database backup when configured', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_include_database: true
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      jest.spyOn(backupService, 'getDatabaseBackupInfo').mockResolvedValue({
+        type: 'sqlite',
+        backupFile: '/backup/db-backup.sql',
+        size: 1024000,
+        checksum: 'abc123',
+        hasChanged: false
+      });
+      
+      // Mock database backup file
+      mockFs({
+        '/storage/events/active': {},
+        '/backup/db-backup.sql': Buffer.from('database backup content')
+      });
+      
+      await backupService.runBackup();
+      
+      // Verify database backup was uploaded
+      const uploadCalls = mockS3Client.upload.mock.calls;
+      const dbBackupUploaded = uploadCalls.some(call => 
+        call[1].includes('database/db-backup.sql')
+      );
+      expect(dbBackupUploaded).toBe(true);
+    });
+
+    it('should validate required S3 configuration', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket'
+        // Missing access key and secret key
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      await backupService.runBackup();
+      
+      expect(logger.error).toHaveBeenCalledWith(
+        'S3 backup failed:',
+        expect.objectContaining({
+          message: expect.stringContaining('S3 backup configuration incomplete')
+        })
+      );
+    });
+  });
+
+  describe('Manifest Generation', () => {
+    it('should generate and save manifest for successful backup', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup',
+        backup_manifest_format: 'json'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active/event1': {
+          'photo1.jpg': Buffer.from('photo1 content')
+        },
+        '/backup': {}
+      });
+      
+      await backupService.runBackup();
+      
+      expect(backupManifest.generateManifest).toHaveBeenCalledWith(
+        expect.objectContaining({
+          backupType: 'full',
+          backupPath: '/backup',
+          format: 'json'
+        })
+      );
+      
+      expect(backupManifest.saveManifest).toHaveBeenCalled();
+    });
+
+    it('should generate incremental manifest when parent exists', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup'
+      };
+      
+      const lastBackup = {
+        id: 1,
+        manifest_path: '/backup/manifests/previous.json',
+        manifest_id: 'previous-backup-123'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([2]);
+      mockDb.first.mockImplementation(() => Promise.resolve(lastBackup));
+      mockDb.orderBy.mockReturnThis();
+      mockDb.where.mockReturnThis();
+      mockDb.whereNot = jest.fn().mockReturnThis();
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active': {},
+        '/backup': {}
+      });
+      
+      await backupService.runBackup();
+      
+      expect(backupManifest.loadManifest).toHaveBeenCalledWith('/backup/manifests/previous.json');
+      expect(backupManifest.generateIncrementalManifest).toHaveBeenCalled();
+    });
+
+    it('should upload manifest to S3 for S3 backups', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret',
+        backup_manifest_format: 'yaml'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      const manifest = {
+        backup: { id: 'backup-123' },
+        version: '2.0'
+      };
+      backupManifest.generateManifest.mockResolvedValue(manifest);
+      
+      mockFs({
+        '/storage/events/active': {},
+        '/storage/temp': {}
+      });
+      
+      await backupService.runBackup();
+      
+      // Verify manifest was uploaded to S3
+      const uploadCalls = mockS3Client.upload.mock.calls;
+      const manifestUploaded = uploadCalls.some(call => 
+        call[1].includes('manifests/backup-manifest-backup-123.yaml')
+      );
+      expect(manifestUploaded).toBe(true);
+    });
+  });
+
+  describe('Backward Compatibility', () => {
+    it('should support local backup destination', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup/local'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active/event1': {
+          'photo1.jpg': Buffer.from('photo1 content')
+        },
+        '/backup/local': {}
+      });
+      
+      await backupService.runBackup();
+      
+      // Verify files were copied to local destination
+      const fs = require('fs');
+      const destPath = '/backup/local/events/active/event1/photo1.jpg';
+      expect(fs.existsSync(destPath)).toBe(true);
+    });
+
+    it('should support rsync backup destination', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'rsync',
+        backup_rsync_host: 'backup.example.com',
+        backup_rsync_user: 'backup',
+        backup_rsync_path: '/remote/backup'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      // Mock exec for rsync
+      const { exec } = require('child_process');
+      const mockExec = jest.fn((cmd, callback) => {
+        callback(null, { stdout: 'Number of files transferred: 1\nTotal file size: 1024 bytes' });
+      });
+      exec.mockImplementation(mockExec);
+      
+      mockFs({
+        '/storage/events/active': {}
+      });
+      
+      await backupService.runBackup();
+      
+      expect(mockExec).toHaveBeenCalledWith(
+        expect.stringContaining('rsync'),
+        expect.any(Function)
+      );
+    });
+  });
+
+  describe('Error Handling and Recovery', () => {
+    it('should handle file read errors gracefully', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_s3_access_key: 'test-key',
+        backup_s3_secret_key: 'test-secret'
+      };
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.first.mockResolvedValue(null);
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      // Mock file that throws error on read
+      const fs = require('fs');
+      const originalCreateReadStream = fs.createReadStream;
+      fs.createReadStream = jest.fn((path) => {
+        if (path.includes('error.jpg')) {
+          const stream = new EventEmitter();
+          process.nextTick(() => stream.emit('error', new Error('File read error')));
+          return stream;
+        }
+        return originalCreateReadStream(path);
+      });
+      
+      mockFs({
+        '/storage/events/active': {
+          'error.jpg': Buffer.from('content'),
+          'good.jpg': Buffer.from('content')
+        }
+      });
+      
+      await backupService.runBackup();
+      
+      // Should continue with other files despite error
+      expect(logger.error).toHaveBeenCalledWith(
+        expect.stringContaining('Failed to backup file'),
+        expect.any(Error)
+      );
+      
+      fs.createReadStream = originalCreateReadStream;
+    });
+
+    it('should send failure email on backup error', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 's3',
+        backup_s3_bucket: 'test-bucket',
+        backup_email_on_failure: true
+      };
+      
+      const admins = [
+        { email: 'admin1@example.com', is_active: true },
+        { email: 'admin2@example.com', is_active: true }
+      ];
+      
+      mockDb.select.mockResolvedValue([]);
+      mockDb.insert.mockResolvedValue([1]);
+      mockDb.where.mockReturnThis();
+      
+      jest.spyOn(backupService, 'getBackupConfig')
+        .mockResolvedValueOnce(config)
+        .mockResolvedValueOnce(config);
+      
+      // Force an error
+      jest.spyOn(backupService, 'getFilesToBackup').mockRejectedValue(new Error('Storage error'));
+      
+      // Mock admin users query
+      db.mockImplementation((table) => {
+        if (table === 'admin_users') {
+          return {
+            where: jest.fn().mockResolvedValue(admins)
+          };
+        }
+        return mockDb;
+      });
+      
+      await backupService.runBackup();
+      
+      expect(queueEmail).toHaveBeenCalledTimes(2);
+      expect(queueEmail).toHaveBeenCalledWith(
+        null,
+        'admin1@example.com',
+        'backup_failed',
+        expect.objectContaining({
+          error_message: 'Storage error'
+        })
+      );
+    });
+
+    it('should handle concurrent backup attempts', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_destination_type: 'local',
+        backup_destination_path: '/backup'
+      };
+      
+      jest.spyOn(backupService, 'getBackupConfig').mockResolvedValue(config);
+      
+      mockFs({
+        '/storage/events/active': {},
+        '/backup': {}
+      });
+      
+      // Start two backups concurrently
+      const backup1 = backupService.runBackup();
+      const backup2 = backupService.runBackup();
+      
+      await Promise.all([backup1, backup2]);
+      
+      // Second backup should be skipped
+      expect(logger.warn).toHaveBeenCalledWith('Backup already running, skipping');
+    });
+  });
+
+  describe('Service Lifecycle', () => {
+    it('should start backup service with cron schedule', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_schedule: '0 3 * * *' // 3 AM daily
+      };
+      
+      mockDb.select.mockResolvedValue(
+        Object.entries(config).map(([key, value]) => ({
+          setting_key: key,
+          setting_value: value.toString()
+        }))
+      );
+      
+      await backupService.startBackupService();
+      
+      expect(cron.schedule).toHaveBeenCalledWith('0 3 * * *', expect.any(Function));
+      expect(logger.info).toHaveBeenCalledWith('Backup service started with schedule: 0 3 * * *');
+    });
+
+    it('should stop existing job when restarting service', async () => {
+      const config = {
+        backup_enabled: true,
+        backup_schedule: '0 2 * * *'
+      };
+      
+      mockDb.select.mockResolvedValue(
+        Object.entries(config).map(([key, value]) => ({
+          setting_key: key,
+          setting_value: value.toString()
+        }))
+      );
+      
+      // Start service twice
+      await backupService.startBackupService();
+      await backupService.startBackupService();
+      
+      expect(mockCronJob.stop).toHaveBeenCalled();
+    });
+
+    it('should not start service when backup is disabled', async () => {
+      const config = {
+        backup_enabled: false
+      };
+      
+      mockDb.select.mockResolvedValue([
+        { setting_key: 'backup_enabled', setting_value: 'false' }
+      ]);
+      
+      await backupService.startBackupService();
+      
+      expect(cron.schedule).not.toHaveBeenCalled();
+      expect(logger.info).toHaveBeenCalledWith('Backup service is disabled');
+    });
+  });
+
+  describe('Backup Status and History', () => {
+    it('should return backup status with recent runs', async () => {
+      const recentRuns = [
+        {
+          id: 1,
+          started_at: new Date(),
+          completed_at: new Date(),
+          status: 'completed',
+          files_backed_up: 100,
+          total_size_bytes: 1024000,
+          manifest_path: '/backup/manifest.json'
+        }
+      ];
+      
+      mockDb.limit.mockResolvedValue(recentRuns);
+      
+      backupManifest.validateManifest.mockImplementation(() => true);
+      
+      const status = await backupService.getBackupStatus();
+      
+      expect(status).toEqual({
+        isRunning: false,
+        isHealthy: true,
+        lastRun: expect.objectContaining({
+          ...recentRuns[0],
+          manifestValid: true
+        }),
+        recentRuns: recentRuns,
+        nextScheduledRun: expect.any(String)
+      });
+    });
+
+    it('should clean up old backup runs', async () => {
+      mockDb.delete.mockResolvedValue(5);
+      
+      await backupService.cleanupOldBackupRuns(30);
+      
+      expect(mockDb.where).toHaveBeenCalledWith('started_at', '<', expect.any(Date));
+      expect(mockDb.delete).toHaveBeenCalled();
+      expect(logger.info).toHaveBeenCalledWith('Cleaned up 5 old backup runs');
+    });
+  });
+
+  describe('getBackupManifest', () => {
+    it('should retrieve manifest from local filesystem', async () => {
+      const backupRun = {
+        id: 1,
+        manifest_path: '/backup/manifests/backup-123.json'
+      };
+      
+      mockDb.first.mockResolvedValue(backupRun);
+      
+      const manifest = { backup: { id: 'backup-123' } };
+      backupManifest.loadManifest.mockResolvedValue(manifest);
+      backupManifest.generateSummaryReport.mockReturnValue('Summary');
+      
+      const result = await backupService.getBackupManifest(1);
+      
+      expect(result).toEqual({
+        manifest: manifest,
+        summary: 'Summary'
+      });
+    });
+
+    it('should retrieve manifest from S3', async () => {
+      const backupRun = {
+        id: 1,
+        manifest_path: 's3://test-bucket/backups/manifests/backup-123.json'
+      };
+      
+      mockDb.first.mockResolvedValue(backupRun);
+      mockDb.select.mockResolvedValue([
+        { setting_key: 'backup_s3_access_key', setting_value: '"test-key"' },
+        { setting_key: 'backup_s3_secret_key', setting_value: '"test-secret"' }
+      ]);
+      
+      const manifest = { backup: { id: 'backup-123' } };
+      backupManifest.loadManifest.mockResolvedValue(manifest);
+      
+      await backupService.getBackupManifest(1);
+      
+      expect(S3StorageAdapter).toHaveBeenCalled();
+      expect(mockS3Client.download).toHaveBeenCalledWith(
+        'backups/manifests/backup-123.json',
+        expect.any(String)
+      );
+    });
+  });
+});
@@ -0,0 +1,161 @@
+# Security Logging Documentation
+
+## Overview
+This document describes the comprehensive security logging implemented in the PicPeak application to track authentication failures, rate limiting, and suspicious activities.
+
+## Log Files
+
+### 1. **security.log**
+- Location: `logs/security.log`
+- Contains: All security-related events (authentication, rate limiting, suspicious activity)
+- Max Size: 20MB with rotation (keeps 10 files)
+- Format: JSON with timestamp
+
+### 2. **error.log**
+- Location: `logs/error.log`
+- Contains: All error-level logs including auth failures
+- Max Size: 10MB with rotation (keeps 5 files)
+
+### 3. **combined.log**
+- Location: `logs/combined.log`
+- Contains: All logs (info, warn, error)
+- Max Size: 50MB with rotation (keeps 10 files)
+
+## Security Events Logged
+
+### Rate Limiting
+When rate limits are exceeded, the following is logged:
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "Rate limit exceeded",
+  "security": true,
+  "ip": "192.168.1.1",
+  "path": "/api/admin/login",
+  "method": "POST",
+  "authenticated": false,
+  "userAgent": "Mozilla/5.0...",
+  "referer": "https://app.example.com",
+  "origin": "https://app.example.com",
+  "headers": {
+    "x-forwarded-for": "192.168.1.1",
+    "x-real-ip": "192.168.1.1"
+  },
+  "requestUrl": "/api/admin/login",
+  "rateLimitInfo": {
+    "limit": 5,
+    "current": 6,
+    "remaining": 0,
+    "resetTime": "2024-01-18T14:38:45.123Z"
+  }
+}
+```
+
+### Authentication Failures
+
+#### Admin Login Failures
+- Tracked in `login_attempts` table
+- Logged with: IP address, username, user agent, timestamp
+- Account lockout after 5 failures in 15 minutes
+
+#### Gallery Password Failures
+- Tracked in `access_logs` table with action='login_fail'
+- Logged with: event_id, IP address, user agent
+- Gallery lockout after 5 failures in 15 minutes
+
+### JWT Validation Failures
+```json
+{
+  "timestamp": "2024-01-18 14:23:45.123",
+  "level": "warn",
+  "message": "JWT validation failed",
+  "ip": "192.168.1.1",
+  "path": "/api/admin/events",
+  "method": "GET",
+  "userAgent": "Mozilla/5.0...",
+  "error": "TokenExpiredError",
+  "message": "jwt expired"
+}
+```
+
+### Suspicious Activity
+- Multiple IPs attempting login for same account
+- Token usage from different IP than issued
+- Token usage after password change
+- Revoked token usage attempts
+
+## Configuration Settings
+
+All rate limiting settings are configurable via the admin panel:
+
+| Setting | Default | Range | Description |
+|---------|---------|-------|-------------|
+| rate_limit_enabled | true | - | Enable/disable rate limiting |
+| rate_limit_window_minutes | 15 | 1-60 | Time window for rate limit |
+| rate_limit_max_requests | 1000 | 10-10000 | Max requests for general endpoints |
+| rate_limit_auth_max_requests | 5 | 1-100 | Max requests for auth endpoints |
+| rate_limit_skip_authenticated | true | - | Skip rate limit for authenticated requests |
+| rate_limit_public_endpoints_only | false | - | Only rate limit public endpoints |
+
+## Database Tables
+
+### login_attempts
+```sql
+- id
+- username
+- ip_address
+- user_agent
+- success (boolean)
+- created_at
+```
+
+### access_logs
+```sql
+- id
+- event_id
+- ip_address
+- user_agent
+- action ('view', 'download', 'login_success', 'login_fail')
+- photo_id (nullable)
+- created_at
+```
+
+## Environment Variables
+
+- `LOG_LEVEL`: Set logging level (default: 'info')
+- `LOG_TO_CONSOLE`: Enable console logging in production (default: false)
+
+## Monitoring Recommendations
+
+1. **Set up alerts for:**
+   - Rate limit exceeded events (possible DDoS)
+   - Multiple failed login attempts from same IP
+   - Account lockout events
+   - JWT validation failures spike
+
+2. **Regular review:**
+   - Check security.log for patterns
+   - Review login_attempts table for brute force attempts
+   - Monitor access_logs for suspicious gallery access patterns
+
+3. **Log analysis tools:**
+   - Use log aggregation tools (ELK stack, Splunk)
+   - Set up dashboards for security metrics
+   - Configure alerts for threshold breaches
+
+## Production Deployment Notes
+
+1. Ensure logs directory has proper permissions
+2. Set up log rotation outside of application if needed
+3. Consider shipping logs to centralized logging service
+4. Monitor disk space for log files
+5. Set `LOG_TO_CONSOLE=true` for container deployments
+
+## Security Best Practices
+
+1. Never log sensitive data (passwords, tokens)
+2. Use generic error messages to prevent user enumeration
+3. Clean up old login attempts regularly (7 days retention)
+4. Monitor for unusual patterns in real-time
+5. Keep rate limit settings appropriate for your usage
@@ -40,10 +40,10 @@ const config = {
      keepAliveInitialDelayMillis: 0
    },
    pool: {
-      min: 2,
-      max: 10,
-      acquireTimeoutMillis: 30000,
-      createTimeoutMillis: 30000,
+      min: 5,
+      max: 25,
+      acquireTimeoutMillis: 60000,
+      createTimeoutMillis: 60000,
      idleTimeoutMillis: 30000,
      reapIntervalMillis: 1000,
      createRetryIntervalMillis: 200,
@@ -0,0 +1,22 @@
+/**
+ * Ensure PostgreSQL compatibility for all insert operations
+ * This migration doesn't change the schema but ensures all tables
+ * are compatible with .returning() syntax
+ */
+
+exports.up = async function(knex) {
+  // This migration is informational only
+  // All insert operations should use .returning('id') going forward
+  
+  console.log('PostgreSQL compatibility check:');
+  console.log('- All INSERT operations should use .returning("id")');
+  console.log('- All date operations should use ISO strings');
+  console.log('- Boolean values are handled automatically by Knex');
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};
@@ -0,0 +1,29 @@
+/**
+ * Fix boolean compatibility issues between PostgreSQL and SQLite
+ * This migration updates the database configuration and existing data
+ */
+
+exports.up = async function(knex) {
+  const isPostgres = knex.client.config.client === 'pg';
+  
+  if (!isPostgres) {
+    // Enable foreign keys for SQLite
+    await knex.raw('PRAGMA foreign_keys = ON');
+    
+    // Note: SQLite stores booleans as 0/1
+    // No data migration needed as Knex handles this automatically
+    // But queries must use formatBoolean() helper
+    
+    console.log('SQLite boolean compatibility check:');
+    console.log('- SQLite stores booleans as 0/1');
+    console.log('- All boolean comparisons should use formatBoolean() helper');
+    console.log('- Foreign keys enabled');
+  }
+  
+  return Promise.resolve();
+};
+
+exports.down = async function(knex) {
+  // No rollback needed
+  return Promise.resolve();
+};
@@ -0,0 +1,33 @@
+/**
+ * Fix email_queue table by ensuring it doesn't have updated_at column
+ * This migration addresses the PostgreSQL error where queries are trying to update
+ * a non-existent updated_at column
+ */
+
+exports.up = async function(knex) {
+  // First, check if the column exists
+  const hasUpdatedAt = await knex.schema.hasColumn('email_queue', 'updated_at');
+  
+  if (hasUpdatedAt) {
+    console.log('Found updated_at column in email_queue table, removing it...');
+    await knex.schema.table('email_queue', (table) => {
+      table.dropColumn('updated_at');
+    });
+  }
+  
+  // Also ensure the table has all required columns
+  const hasCreatedAt = await knex.schema.hasColumn('email_queue', 'created_at');
+  if (!hasCreatedAt) {
+    console.log('Adding missing created_at column to email_queue table...');
+    await knex.schema.table('email_queue', (table) => {
+      table.datetime('created_at').defaultTo(knex.fn.now());
+    });
+  }
+  
+  console.log('email_queue table schema fixed');
+};
+
+exports.down = async function(knex) {
+  // In the down migration, we don't add back updated_at since it shouldn't exist
+  // This is intentionally left minimal
+};
@@ -0,0 +1,234 @@
+exports.up = async function(knex) {
+  // Update gallery_created template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_de: 'Ihre Fotogalerie ist bereit!',
+      body_html_de: `<h2>Galerie erfolgreich erstellt</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!</p>
+{{#if welcome_message}}
+<div style="background-color: #f3f4f6; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0 0 10px 0; font-weight: 600; color: #374151;">Persönliche Nachricht:</p>
+  <p style="margin: 0; color: #4b5563;">{{welcome_message}}</p>
+</div>
+{{/if}}
+<p><strong>Galerie-Details:</strong></p>
+<ul>
+  <li>Veranstaltungsdatum: {{event_date}}</li>
+  <li>Galerie-Link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+  <li>Passwort: {{gallery_password}}</li>
+  <li>Ablaufdatum: {{expiry_date}}</li>
+</ul>
+<p>Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.</p>
+<p style="background-color: #FEF3C7; padding: 15px; border-radius: 5px; border-left: 4px solid #F59E0B;">
+  <strong>Wichtig:</strong> Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie anzeigen</a>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie erfolgreich erstellt
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" wurde erfolgreich erstellt!
+
+{{#if welcome_message}}
+Persönliche Nachricht:
+{{welcome_message}}
+
+{{/if}}
+Galerie-Details:
+- Veranstaltungsdatum: {{event_date}}
+- Galerie-Link: {{gallery_link}}
+- Passwort: {{gallery_password}}
+- Ablaufdatum: {{expiry_date}}
+
+Teilen Sie diesen Link und das Passwort mit Ihren Gästen, damit diese die Fotos ansehen und herunterladen können.
+
+WICHTIG: Diese Galerie läuft am {{expiry_date}} ab. Nach diesem Datum werden die Fotos archiviert und sind nicht mehr zugänglich.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update expiration_warning template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_de: 'Ihre Fotogalerie läuft bald ab',
+      body_html_de: `<h2>Galerie läuft bald ab</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" läuft in <strong>{{days_remaining}} Tagen</strong> ab.</p>
+<p>Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.</p>
+<p><strong>Ablaufdatum:</strong> {{expiry_date}}</p>
+<a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500; margin: 20px 0;">Galerie jetzt besuchen</a>
+<p style="background-color: #FEE2E2; padding: 15px; border-radius: 5px; border-left: 4px solid #EF4444;">
+  <strong>Erinnerung:</strong> Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie läuft bald ab
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" läuft in {{days_remaining}} Tagen ab.
+
+Nach Ablauf wird die Galerie archiviert und ist für Gäste nicht mehr zugänglich. Bitte stellen Sie sicher, dass alle gewünschten Fotos heruntergeladen wurden.
+
+Ablaufdatum: {{expiry_date}}
+
+Galerie-Link: {{gallery_link}}
+
+ERINNERUNG: Nach dem {{expiry_date}} können Ihre Gäste nicht mehr auf die Galerie zugreifen.
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update gallery_expired template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_de: 'Ihre Fotogalerie {{event_name}} ist abgelaufen',
+      body_html_de: `<h2>Galerie abgelaufen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.</p>
+<p>Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.</p>
+<p>Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:</p>
+<p style="background-color: #F3F4F6; padding: 15px; border-radius: 5px;">
+  <strong>Kontakt:</strong><br>
+  E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a><br>
+  {{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+</p>
+<p>Vielen Dank für die Nutzung unseres Foto-Sharing-Services!</p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Galerie abgelaufen
+
+Liebe(r) {{host_name}},
+
+Ihre Fotogalerie "{{event_name}}" ist am {{expiry_date}} abgelaufen und wurde archiviert.
+
+Die Galerie ist nicht mehr für Gäste zugänglich. Alle Fotos wurden sicher in unserem Archivsystem gespeichert.
+
+Wenn Sie wieder Zugriff auf die archivierten Fotos benötigen, wenden Sie sich bitte an unseren Support:
+
+E-Mail: {{admin_email}}
+{{#if support_phone}}Telefon: {{support_phone}}{{/if}}
+
+Vielen Dank für die Nutzung unseres Foto-Sharing-Services!
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Update archive_complete template with proper German translation
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_de: 'Archivierung abgeschlossen: {{event_name}}',
+      body_html_de: `<h2>Archivierung abgeschlossen</h2>
+<p>Liebe(r) {{host_name}},</p>
+<p>Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.</p>
+<p><strong>Archiv-Details:</strong></p>
+<ul>
+  <li>Archivgröße: {{archive_size}}</li>
+  <li>Archivierungsdatum: {{archive_date}}</li>
+  <li>Anzahl der Fotos: {{photo_count}}</li>
+</ul>
+<p>Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.</p>
+<p style="background-color: #F0FDF4; padding: 15px; border-radius: 5px; border-left: 4px solid #22C55E;">
+  <strong>✓ Erfolgreich archiviert:</strong> Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+</p>
+<p>Kontakt für Archivzugriff:<br>
+E-Mail: <a href="mailto:{{admin_email}}" style="color: #5C8762;">{{admin_email}}</a></p>
+<p>Mit freundlichen Grüßen,<br>Ihr Foto-Sharing-Team</p>`,
+      body_text_de: `Archivierung abgeschlossen
+
+Liebe(r) {{host_name}},
+
+Die Fotogalerie "{{event_name}}" wurde erfolgreich archiviert.
+
+Archiv-Details:
+- Archivgröße: {{archive_size}}
+- Archivierungsdatum: {{archive_date}}
+- Anzahl der Fotos: {{photo_count}}
+
+Das Archiv wird sicher in unserem System aufbewahrt. Bei Bedarf können Sie sich an unseren Support wenden, um Zugriff auf die archivierten Fotos zu erhalten.
+
+✓ ERFOLGREICH ARCHIVIERT: Ihre Fotos sind sicher gespeichert und können bei Bedarf wiederhergestellt werden.
+
+Kontakt für Archivzugriff:
+E-Mail: {{admin_email}}
+
+Mit freundlichen Grüßen,
+Ihr Foto-Sharing-Team`
+    });
+
+  // Also update the non-language-specific fields to match German for consistency
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_de'),
+      body_html: knex.raw('body_html_de'),
+      body_text: knex.raw('body_text_de')
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous German translations
+  // This is a simplified rollback - in production you might want to store the old values
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject: knex.raw('subject_en'),
+      body_html: knex.raw('body_html_en'),
+      body_text: knex.raw('body_text_en')
+    });
+};
@@ -0,0 +1,41 @@
+exports.up = async function(knex) {
+  // Add language column to events table if it doesn't exist
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (!hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.string('language', 5).defaultTo('en');
+    });
+  }
+  
+  // Add default_language to email_configs if it doesn't exist
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (!hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.string('default_language', 5).defaultTo('en');
+    });
+  }
+  
+  // Set default language to German for the existing email config
+  await knex('email_configs')
+    .update({
+      default_language: 'de'
+    });
+};
+
+exports.down = async function(knex) {
+  // Remove language column from events table
+  const hasLanguageInEvents = await knex.schema.hasColumn('events', 'language');
+  if (hasLanguageInEvents) {
+    await knex.schema.alterTable('events', function(table) {
+      table.dropColumn('language');
+    });
+  }
+  
+  // Remove default_language from email_configs
+  const hasDefaultLanguage = await knex.schema.hasColumn('email_configs', 'default_language');
+  if (hasDefaultLanguage) {
+    await knex.schema.alterTable('email_configs', function(table) {
+      table.dropColumn('default_language');
+    });
+  }
+};
@@ -0,0 +1,63 @@
+exports.up = async function(knex) {
+  // Add rate limit settings to app_settings
+  const rateLimitSettings = [
+    {
+      setting_key: 'rate_limit_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_window_minutes',
+      setting_value: JSON.stringify(15),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_max_requests',
+      setting_value: JSON.stringify(1000),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_auth_max_requests',
+      setting_value: JSON.stringify(5),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_skip_authenticated',
+      setting_value: JSON.stringify(true),
+      setting_type: 'security'
+    },
+    {
+      setting_key: 'rate_limit_public_endpoints_only',
+      setting_value: JSON.stringify(false),
+      setting_type: 'security'
+    }
+  ];
+
+  // Insert settings if they don't exist
+  for (const setting of rateLimitSettings) {
+    const exists = await knex('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await knex('app_settings').insert({
+        ...setting,
+        updated_at: knex.fn.now()
+      });
+    }
+  }
+};
+
+exports.down = async function(knex) {
+  // Remove rate limit settings
+  await knex('app_settings')
+    .whereIn('setting_key', [
+      'rate_limit_enabled',
+      'rate_limit_window_minutes',
+      'rate_limit_max_requests',
+      'rate_limit_auth_max_requests',
+      'rate_limit_skip_authenticated',
+      'rate_limit_public_endpoints_only'
+    ])
+    .del();
+};
@@ -0,0 +1,307 @@
+exports.up = async function(knex) {
+  // Update English templates to match the quality and content of German templates
+  
+  // 1. Gallery Created - Match German version with proper styling and conditionals
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your photo gallery is ready',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> for {{event_date}} has been successfully created and is now online!</p>
+
+{{#if welcome_message}}
+<div style="background-color: #f0f8ff; border-left: 4px solid #5C8762; padding: 15px; margin: 20px 0; border-radius: 4px;">
+  <p style="margin: 0;"><strong>Personal message from your photographer:</strong></p>
+  <p style="margin: 10px 0 0 0;">{{welcome_message}}</p>
+</div>
+{{/if}}
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Your access data:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 10px;"><strong>Gallery link:</strong> <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li style="margin-bottom: 10px;"><strong>Password:</strong> {{gallery_password}}</li>
+  </ul>
+</div>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 12px 30px; background-color: #5C8762; color: white; text-decoration: none; border-radius: 5px; font-weight: 500;">View Gallery</a>
+</div>
+
+<div style="background-color: #fff3cd; border: 1px solid #ffeaa7; color: #856404; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Important:</strong> Your gallery will be available until <strong>{{expiry_date}}</strong>. After this date, the photos will be archived and will only be available upon request.</p>
+</div>
+
+<p>We hope you enjoy your photos!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" for {{event_date}} has been successfully created and is now online!
+
+{{#if welcome_message}}
+Personal message from your photographer:
+{{welcome_message}}
+{{/if}}
+
+Your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+Important: Your gallery will be available until {{expiry_date}}. After this date, the photos will be archived and will only be available upon request.
+
+We hope you enjoy your photos!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 2. Expiration Warning - Match German version with urgency and styling
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Your photo gallery expires soon',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> will expire in <strong style="color: #e74c3c; font-size: 18px;">{{days_remaining}} days</strong>!</p>
+
+<div style="background-color: #fee; border: 1px solid #fcc; color: #c33; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold; font-size: 16px;">⚠️ Important Notice</p>
+  <p style="margin: 10px 0 0 0;">After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.</p>
+</div>
+
+<p><strong>Don't miss out – download your photos now!</strong></p>
+
+<div style="text-align: center; margin: 30px 0;">
+  <a href="{{gallery_link}}" style="display: inline-block; padding: 14px 35px; background-color: #e74c3c; color: white; text-decoration: none; border-radius: 5px; font-weight: 600; font-size: 16px;">Visit Gallery Now</a>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Quick reminder of your access data:</strong></p>
+  <ul style="list-style: none; padding: 0; margin: 10px 0 0 0;">
+    <li>Gallery link: <a href="{{gallery_link}}" style="color: #5C8762;">{{gallery_link}}</a></li>
+    <li>Password: {{gallery_password}}</li>
+  </ul>
+</div>
+
+<p>If you have any questions, please don't hesitate to contact us.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days!
+
+⚠️ Important Notice
+After {{expiry_date}}, your gallery will no longer be accessible online. The photos will be archived and will only be available upon special request.
+
+Don't miss out – download your photos now!
+
+Quick reminder of your access data:
+- Gallery link: {{gallery_link}}
+- Password: {{gallery_password}}
+
+If you have any questions, please don't hesitate to contact us.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 3. Gallery Expired - Match German version with contact information
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Your photo gallery has expired',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> expired on {{expiry_date}} and is no longer accessible online.</p>
+
+<div style="background-color: #f9f9f9; border-left: 4px solid #5C8762; padding: 20px; margin: 20px 0; border-radius: 4px;">
+  <h3 style="margin-top: 0;">Your photos are safely archived</h3>
+  <p>Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:</p>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;">📧 Email: <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a></li>
+    {{#if support_phone}}
+    <li>📞 Phone: {{support_phone}}</li>
+    {{/if}}
+  </ul>
+</div>
+
+<p>Please have the following information ready when contacting us:</p>
+<ul>
+  <li>Event name: {{event_name}}</li>
+  <li>Event date: {{event_date}}</li>
+  <li>Expiry date: {{expiry_date}}</li>
+</ul>
+
+<p>We'll be happy to help you access your archived photos.</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" expired on {{expiry_date}} and is no longer accessible online.
+
+Your photos are safely archived
+Don't worry – your photos have been securely archived and are not lost. If you need access to your photos, please contact us:
+
+📧 Email: {{support_email}}
+{{#if support_phone}}📞 Phone: {{support_phone}}{{/if}}
+
+Please have the following information ready when contacting us:
+- Event name: {{event_name}}
+- Event date: {{event_date}}
+- Expiry date: {{expiry_date}}
+
+We'll be happy to help you access your archived photos.
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 4. Archive Complete - Match German version with success message and details
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Your photo gallery has been successfully archived',
+      body_html_en: `
+<h2>Hello {{host_name}},</h2>
+
+<p>Your photo gallery <strong>{{event_name}}</strong> has been successfully archived.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0; font-weight: bold;">✅ Archive successfully created</p>
+  <p style="margin: 10px 0 0 0;">Your photos are now safely stored in our archive.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 20px; border-radius: 8px; margin: 20px 0;">
+  <h3 style="margin-top: 0;">Archive details:</h3>
+  <ul style="list-style: none; padding: 0;">
+    <li style="margin-bottom: 8px;"><strong>Event:</strong> {{event_name}}</li>
+    <li style="margin-bottom: 8px;"><strong>Archive date:</strong> {{archive_date}}</li>
+    <li style="margin-bottom: 8px;"><strong>Number of photos:</strong> {{photo_count}}</li>
+    <li><strong>Archive size:</strong> {{archive_size}}</li>
+  </ul>
+</div>
+
+<p>If you need access to your archived photos in the future, please contact us at:</p>
+<p style="margin-left: 20px;">
+  📧 <a href="mailto:{{support_email}}" style="color: #5C8762;">{{support_email}}</a><br>
+  {{#if support_phone}}📞 {{support_phone}}{{/if}}
+</p>
+
+<p>Thank you for using our photo sharing service!</p>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Hello {{host_name}},
+
+Your photo gallery "{{event_name}}" has been successfully archived.
+
+✅ Archive successfully created
+Your photos are now safely stored in our archive.
+
+Archive details:
+- Event: {{event_name}}
+- Archive date: {{archive_date}}
+- Number of photos: {{photo_count}}
+- Archive size: {{archive_size}}
+
+If you need access to your archived photos in the future, please contact us at:
+📧 {{support_email}}
+{{#if support_phone}}📞 {{support_phone}}{{/if}}
+
+Thank you for using our photo sharing service!
+
+Best regards,
+Your Photo Sharing Team`
+    });
+
+  // 5. Test Email - Update to match German style
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email - Photo Sharing Platform',
+      body_html_en: `
+<h2>Test Email</h2>
+
+<p>This is a test email from your photo sharing platform.</p>
+
+<div style="background-color: #d4edda; border: 1px solid #c3e6cb; color: #155724; padding: 15px; border-radius: 4px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>✅ Email configuration successful!</strong></p>
+  <p style="margin: 10px 0 0 0;">Your email settings have been configured correctly and emails can be sent.</p>
+</div>
+
+<div style="background-color: #f9f9f9; padding: 15px; border-radius: 8px; margin: 20px 0;">
+  <p style="margin: 0;"><strong>Configuration details:</strong></p>
+  <ul style="margin: 10px 0 0 0;">
+    <li>Timestamp: {{timestamp}}</li>
+    <li>Sender: {{from_email}}</li>
+  </ul>
+</div>
+
+<p>Best regards,<br>
+Your Photo Sharing Team</p>`,
+      body_text_en: `Test Email
+
+This is a test email from your photo sharing platform.
+
+✅ Email configuration successful!
+Your email settings have been configured correctly and emails can be sent.
+
+Configuration details:
+- Timestamp: {{timestamp}}
+- Sender: {{from_email}}
+
+Best regards,
+Your Photo Sharing Team`
+    });
+};
+
+exports.down = async function(knex) {
+  // Revert to previous simpler English templates
+  await knex('email_templates')
+    .where('template_key', 'gallery_created')
+    .update({
+      subject_en: 'Your Photo Gallery is Ready',
+      body_html_en: '<h2>Hello,</h2><p>Your photo gallery "{{event_name}}" has been created.</p><p><strong>Access Link:</strong> <a href="{{gallery_link}}">{{gallery_link}}</a></p><p><strong>Password:</strong> {{gallery_password}}</p><p>The gallery will be available until {{expiry_date}}.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has been created. Access Link: {{gallery_link}} Password: {{gallery_password}} The gallery will be available until {{expiry_date}}.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'expiration_warning')
+    .update({
+      subject_en: 'Gallery Expires in {{days_remaining}} Days',
+      body_html_en: '<h2>Reminder</h2><p>Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days.</p><p>Please download your photos before {{expiry_date}}.</p><p><a href="{{gallery_link}}">Access Gallery</a></p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" will expire in {{days_remaining}} days. Please download your photos before {{expiry_date}}. Access Gallery: {{gallery_link}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'gallery_expired')
+    .update({
+      subject_en: 'Gallery Expired',
+      body_html_en: '<h2>Gallery Expired</h2><p>Your photo gallery "{{event_name}}" has expired and is no longer accessible.</p><p>If you need access to your photos, please contact support.</p>',
+      body_text_en: 'Your photo gallery "{{event_name}}" has expired and is no longer accessible. If you need access to your photos, please contact support.'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'archive_complete')
+    .update({
+      subject_en: 'Gallery Archived',
+      body_html_en: '<h2>Archive Complete</h2><p>Your gallery "{{event_name}}" has been archived.</p><p>Archive size: {{archive_size}}</p>',
+      body_text_en: 'Your gallery "{{event_name}}" has been archived. Archive size: {{archive_size}}'
+    });
+
+  await knex('email_templates')
+    .where('template_key', 'test_email')
+    .update({
+      subject_en: 'Test Email',
+      body_html_en: '<p>This is a test email sent at {{timestamp}}.</p>',
+      body_text_en: 'This is a test email sent at {{timestamp}}.'
+    });
+};
@@ -0,0 +1,243 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Adding backup service tables and settings...');
+  
+  // Create backup_runs table to track backup history
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (!hasBackupRunsTable) {
+    await db.schema.createTable('backup_runs', (table) => {
+      table.increments('id').primary();
+      table.datetime('started_at').notNullable();
+      table.datetime('completed_at');
+      table.string('status').defaultTo('running'); // running, completed, failed
+      table.string('backup_type'); // full, incremental
+      table.integer('files_backed_up').defaultTo(0);
+      table.bigInteger('total_size_bytes').defaultTo(0);
+      table.integer('duration_seconds');
+      table.text('error_message');
+      table.json('statistics'); // Detailed stats about the backup
+      table.json('file_checksums'); // Store checksums for change detection
+    });
+  }
+
+  // Create backup_file_states table to track individual file states
+  const hasBackupFileStatesTable = await db.schema.hasTable('backup_file_states');
+  if (!hasBackupFileStatesTable) {
+    await db.schema.createTable('backup_file_states', (table) => {
+      table.increments('id').primary();
+      table.string('file_path').notNullable();
+      table.string('checksum').notNullable();
+      table.bigInteger('size_bytes');
+      table.datetime('last_modified');
+      table.datetime('last_backed_up');
+      table.boolean('is_archived').defaultTo(false);
+      table.index(['file_path'], 'idx_backup_file_path');
+      table.index(['checksum'], 'idx_backup_checksum');
+    });
+  }
+
+  // Add backup-related settings to app_settings
+  const backupSettings = [
+    {
+      setting_key: 'backup_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_schedule',
+      setting_value: JSON.stringify('0 2 * * *'), // Default: 2 AM daily
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_destination_type',
+      setting_value: JSON.stringify('local'), // local, rsync, s3
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_destination_path',
+      setting_value: JSON.stringify('/backup/picpeak'),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_host',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_user',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_path',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_rsync_ssh_key',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_endpoint',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_bucket',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_access_key',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_secret_key',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_s3_region',
+      setting_value: JSON.stringify('us-east-1'),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_retention_days',
+      setting_value: JSON.stringify(30),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_include_archived',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_compression',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_email_on_failure',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_email_on_success',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_max_file_size_mb',
+      setting_value: JSON.stringify(5000), // Skip files larger than 5GB
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_exclude_patterns',
+      setting_value: JSON.stringify(['*.tmp', '.DS_Store', 'Thumbs.db']),
+      setting_type: 'backup'
+    }
+  ];
+
+  // Insert backup settings if they don't exist
+  for (const setting of backupSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  // Add backup-related email templates
+  const backupEmailTemplates = [
+    {
+      template_key: 'backup_failed',
+      subject_en: 'Backup Failed - Immediate Attention Required',
+      subject_de: 'Backup fehlgeschlagen - Sofortige Aufmerksamkeit erforderlich',
+      body_html_en: `<h2>Backup Failed</h2>
+<p>The scheduled backup has failed and requires immediate attention.</p>
+<p><strong>Error Details:</strong></p>
+<ul>
+  <li>Start Time: {{start_time}}</li>
+  <li>Backup Type: {{backup_type}}</li>
+  <li>Error: {{error_message}}</li>
+</ul>
+<p>Please check the system logs for more details and resolve the issue as soon as possible.</p>`,
+      body_html_de: `<h2>Backup fehlgeschlagen</h2>
+<p>Das geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
+<p><strong>Fehlerdetails:</strong></p>
+<ul>
+  <li>Startzeit: {{start_time}}</li>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Fehler: {{error_message}}</li>
+</ul>
+<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und beheben Sie das Problem so schnell wie möglich.</p>`,
+      body_text_en: 'Backup Failed\n\nThe scheduled backup has failed and requires immediate attention.\n\nStart Time: {{start_time}}\nBackup Type: {{backup_type}}\nError: {{error_message}}\n\nPlease check the system logs for more details.',
+      body_text_de: 'Backup fehlgeschlagen\n\nDas geplante Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.\n\nStartzeit: {{start_time}}\nBackup-Typ: {{backup_type}}\nFehler: {{error_message}}\n\nBitte überprüfen Sie die Systemprotokolle für weitere Details.',
+      variables: JSON.stringify(['start_time', 'backup_type', 'error_message'])
+    },
+    {
+      template_key: 'backup_completed',
+      subject_en: 'Backup Completed Successfully',
+      subject_de: 'Backup erfolgreich abgeschlossen',
+      body_html_en: `<h2>Backup Completed</h2>
+<p>The scheduled backup has been completed successfully.</p>
+<p><strong>Backup Summary:</strong></p>
+<ul>
+  <li>Start Time: {{start_time}}</li>
+  <li>Duration: {{duration}}</li>
+  <li>Files Backed Up: {{files_count}}</li>
+  <li>Total Size: {{total_size}}</li>
+  <li>Backup Type: {{backup_type}}</li>
+</ul>`,
+      body_html_de: `<h2>Backup abgeschlossen</h2>
+<p>Das geplante Backup wurde erfolgreich abgeschlossen.</p>
+<p><strong>Backup-Zusammenfassung:</strong></p>
+<ul>
+  <li>Startzeit: {{start_time}}</li>
+  <li>Dauer: {{duration}}</li>
+  <li>Gesicherte Dateien: {{files_count}}</li>
+  <li>Gesamtgröße: {{total_size}}</li>
+  <li>Backup-Typ: {{backup_type}}</li>
+</ul>`,
+      body_text_en: 'Backup Completed\n\nThe scheduled backup has been completed successfully.\n\nStart Time: {{start_time}}\nDuration: {{duration}}\nFiles Backed Up: {{files_count}}\nTotal Size: {{total_size}}\nBackup Type: {{backup_type}}',
+      body_text_de: 'Backup abgeschlossen\n\nDas geplante Backup wurde erfolgreich abgeschlossen.\n\nStartzeit: {{start_time}}\nDauer: {{duration}}\nGesicherte Dateien: {{files_count}}\nGesamtgröße: {{total_size}}\nBackup-Typ: {{backup_type}}',
+      variables: JSON.stringify(['start_time', 'duration', 'files_count', 'total_size', 'backup_type'])
+    }
+  ];
+
+  // Insert backup email templates if they don't exist
+  for (const template of backupEmailTemplates) {
+    const exists = await db('email_templates')
+      .where('template_key', template.template_key)
+      .first();
+    
+    if (!exists) {
+      await db('email_templates').insert(template);
+    }
+  }
+
+  console.log('Backup service tables and settings added successfully');
+}
+
+async function down() {
+  // Remove backup tables
+  await db.schema.dropTableIfExists('backup_file_states');
+  await db.schema.dropTableIfExists('backup_runs');
+  
+  // Remove backup settings
+  await db('app_settings')
+    .where('setting_type', 'backup')
+    .delete();
+  
+  // Remove backup email templates
+  await db('email_templates')
+    .whereIn('template_key', ['backup_failed', 'backup_completed'])
+    .delete();
+}
+
+module.exports = { up, down };
@@ -0,0 +1,182 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Adding database backup tables and settings...');
+  
+  // Create database_backup_runs table to track database backup history
+  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
+  if (!hasDatabaseBackupRunsTable) {
+    await db.schema.createTable('database_backup_runs', (table) => {
+      table.increments('id').primary();
+      table.datetime('started_at').notNullable();
+      table.datetime('completed_at');
+      table.string('status').defaultTo('running'); // running, completed, failed
+      table.string('backup_type'); // sqlite, postgresql
+      table.string('destination_path');
+      table.string('file_path');
+      table.bigInteger('file_size_bytes').defaultTo(0);
+      table.bigInteger('original_size_bytes').defaultTo(0);
+      table.integer('duration_seconds');
+      table.string('checksum'); // SHA256 checksum of backup file
+      table.float('compression_ratio'); // Compression percentage
+      table.json('table_checksums'); // Individual table checksums
+      table.text('error_message');
+      table.json('statistics'); // Detailed stats about the backup
+      table.index(['started_at'], 'idx_db_backup_started');
+      table.index(['status'], 'idx_db_backup_status');
+    });
+  }
+
+  // Add database backup-related settings to app_settings
+  const databaseBackupSettings = [
+    {
+      setting_key: 'database_backup_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_schedule',
+      setting_value: JSON.stringify('0 3 * * *'), // Default: 3 AM daily
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_destination_path',
+      setting_value: JSON.stringify('/backup/database'),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_compress',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_validate_integrity',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_include_checksums',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_retention_days',
+      setting_value: JSON.stringify(30),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_email_on_failure',
+      setting_value: JSON.stringify(true),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_email_on_success',
+      setting_value: JSON.stringify(false),
+      setting_type: 'database_backup'
+    },
+    {
+      setting_key: 'database_backup_max_retries',
+      setting_value: JSON.stringify(3),
+      setting_type: 'database_backup'
+    }
+  ];
+
+  // Insert database backup settings if they don't exist
+  for (const setting of databaseBackupSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  // Add database backup-related email templates
+  const databaseBackupEmailTemplates = [
+    {
+      template_key: 'database_backup_failed',
+      subject_en: 'Database Backup Failed - Critical Alert',
+      subject_de: 'Datenbank-Backup fehlgeschlagen - Kritische Warnung',
+      body_html_en: `<h2>Database Backup Failed</h2>
+<p>The scheduled database backup has failed and requires immediate attention.</p>
+<p><strong>Error Details:</strong></p>
+<ul>
+  <li>Backup Type: {{backup_type}}</li>
+  <li>Timestamp: {{timestamp}}</li>
+  <li>Error: {{error_message}}</li>
+</ul>
+<p>This is a critical issue that could affect disaster recovery. Please investigate immediately.</p>`,
+      body_html_de: `<h2>Datenbank-Backup fehlgeschlagen</h2>
+<p>Das geplante Datenbank-Backup ist fehlgeschlagen und erfordert sofortige Aufmerksamkeit.</p>
+<p><strong>Fehlerdetails:</strong></p>
+<ul>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Zeitstempel: {{timestamp}}</li>
+  <li>Fehler: {{error_message}}</li>
+</ul>
+<p>Dies ist ein kritisches Problem, das die Disaster-Recovery beeinträchtigen könnte. Bitte untersuchen Sie es sofort.</p>`,
+      body_text_en: 'Database Backup Failed\n\nThe scheduled database backup has failed.\n\nBackup Type: {{backup_type}}\nTimestamp: {{timestamp}}\nError: {{error_message}}\n\nThis is critical - please investigate immediately.',
+      body_text_de: 'Datenbank-Backup fehlgeschlagen\n\nDas geplante Datenbank-Backup ist fehlgeschlagen.\n\nBackup-Typ: {{backup_type}}\nZeitstempel: {{timestamp}}\nFehler: {{error_message}}\n\nDies ist kritisch - bitte sofort untersuchen.',
+      variables: JSON.stringify(['backup_type', 'timestamp', 'error_message'])
+    },
+    {
+      template_key: 'database_backup_completed',
+      subject_en: 'Database Backup Completed Successfully',
+      subject_de: 'Datenbank-Backup erfolgreich abgeschlossen',
+      body_html_en: `<h2>Database Backup Completed</h2>
+<p>The scheduled database backup has been completed successfully.</p>
+<p><strong>Backup Summary:</strong></p>
+<ul>
+  <li>Backup Type: {{backup_type}}</li>
+  <li>Duration: {{duration}}</li>
+  <li>File Size: {{file_size}}</li>
+  <li>Compression Ratio: {{compression_ratio}}</li>
+  <li>File Path: {{file_path}}</li>
+</ul>`,
+      body_html_de: `<h2>Datenbank-Backup abgeschlossen</h2>
+<p>Das geplante Datenbank-Backup wurde erfolgreich abgeschlossen.</p>
+<p><strong>Backup-Zusammenfassung:</strong></p>
+<ul>
+  <li>Backup-Typ: {{backup_type}}</li>
+  <li>Dauer: {{duration}}</li>
+  <li>Dateigröße: {{file_size}}</li>
+  <li>Komprimierungsverhältnis: {{compression_ratio}}</li>
+  <li>Dateipfad: {{file_path}}</li>
+</ul>`,
+      body_text_en: 'Database Backup Completed\n\nThe scheduled database backup has been completed successfully.\n\nBackup Type: {{backup_type}}\nDuration: {{duration}}\nFile Size: {{file_size}}\nCompression Ratio: {{compression_ratio}}\nFile Path: {{file_path}}',
+      body_text_de: 'Datenbank-Backup abgeschlossen\n\nDas geplante Datenbank-Backup wurde erfolgreich abgeschlossen.\n\nBackup-Typ: {{backup_type}}\nDauer: {{duration}}\nDateigröße: {{file_size}}\nKomprimierungsverhältnis: {{compression_ratio}}\nDateipfad: {{file_path}}',
+      variables: JSON.stringify(['backup_type', 'duration', 'file_size', 'compression_ratio', 'file_path'])
+    }
+  ];
+
+  // Insert database backup email templates if they don't exist
+  for (const template of databaseBackupEmailTemplates) {
+    const exists = await db('email_templates')
+      .where('template_key', template.template_key)
+      .first();
+    
+    if (!exists) {
+      await db('email_templates').insert(template);
+    }
+  }
+
+  console.log('Database backup tables and settings added successfully');
+}
+
+async function down() {
+  // Remove database backup tables
+  await db.schema.dropTableIfExists('database_backup_runs');
+  
+  // Remove database backup settings
+  await db('app_settings')
+    .where('setting_type', 'database_backup')
+    .delete();
+  
+  // Remove database backup email templates
+  await db('email_templates')
+    .whereIn('template_key', ['database_backup_failed', 'database_backup_completed'])
+    .delete();
+}
+
+module.exports = { up, down };
@@ -0,0 +1,86 @@
+const { db } = require('../src/database/db');
+const logger = require('../src/utils/logger');
+
+async function up() {
+  console.log('Adding backup manifest columns...');
+  
+  // Add manifest columns to backup_runs table
+  const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
+  if (!hasManifestPath) {
+    await db.schema.alterTable('backup_runs', (table) => {
+      table.string('manifest_path'); // Path to the manifest file
+      table.string('manifest_id'); // Unique manifest ID
+      table.string('manifest_format').defaultTo('json'); // json or yaml
+    });
+  }
+
+  // Add backup manifest-related settings to app_settings
+  const manifestSettings = [
+    {
+      setting_key: 'backup_manifest_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_format',
+      setting_value: JSON.stringify('json'), // json or yaml
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_path',
+      setting_value: JSON.stringify('/backup/manifests'),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_validate',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_manifest_include_checksums',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup'
+    }
+  ];
+
+  // Insert manifest settings if they don't exist
+  for (const setting of manifestSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  console.log('✓ Backup manifest columns and settings added');
+}
+
+async function down() {
+  // Remove manifest columns from backup_runs table
+  const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
+  if (hasManifestPath) {
+    await db.schema.alterTable('backup_runs', (table) => {
+      table.dropColumn('manifest_path');
+      table.dropColumn('manifest_id');
+      table.dropColumn('manifest_format');
+    });
+  }
+
+  // Remove manifest settings
+  await db('app_settings')
+    .where('setting_type', 'backup')
+    .whereIn('setting_key', [
+      'backup_manifest_enabled',
+      'backup_manifest_format',
+      'backup_manifest_path',
+      'backup_manifest_validate',
+      'backup_manifest_include_checksums'
+    ])
+    .delete();
+
+  console.log('✓ Backup manifest columns and settings removed');
+}
+
+module.exports = { up, down };
@@ -0,0 +1,249 @@
+const { formatBoolean, parseBoolean } = require('./helpers');
+
+/**
+ * Add restore_runs table for tracking restore operations
+ */
+exports.up = async function(knex) {
+  // Create restore_runs table
+  await knex.schema.createTable('restore_runs', table => {
+    table.increments('id').primary();
+    
+    // Timing
+    table.timestamp('started_at').notNullable().defaultTo(knex.fn.now());
+    table.timestamp('completed_at');
+    table.integer('duration_seconds');
+    
+    // Status and type
+    table.string('status', 50).notNullable().defaultTo('running');
+    table.string('restore_type', 50).notNullable(); // full, database, files, selective
+    
+    // Source information
+    table.string('source', 500).notNullable(); // Backup source path or S3 URL
+    table.string('manifest_path', 500); // Path to manifest file
+    
+    // Results
+    table.text('error_message');
+    table.text('statistics'); // JSON object with detailed statistics
+    table.text('restore_log'); // JSON array of log entries
+    
+    // Safety backup
+    table.string('pre_restore_backup_path', 500); // Path to pre-restore safety backup
+    
+    // Flags
+    table.boolean('is_dry_run').defaultTo(formatBoolean(false));
+    table.boolean('was_rollback_attempted').defaultTo(formatBoolean(false));
+    table.boolean('was_successful').defaultTo(formatBoolean(false));
+    
+    // Operator information
+    table.string('operator_type', 50).defaultTo('manual'); // manual, scheduled, api
+    table.integer('operator_user_id').references('id').inTable('admin_users').onDelete('SET NULL');
+    table.string('operator_ip', 50);
+    
+    // Metadata
+    table.text('metadata'); // JSON object for additional data
+    
+    table.index(['status', 'started_at']);
+    table.index(['restore_type', 'started_at']);
+  });
+  
+  // Create restore_file_operations table for tracking individual file operations
+  await knex.schema.createTable('restore_file_operations', table => {
+    table.increments('id').primary();
+    
+    table.integer('restore_run_id').notNullable()
+      .references('id').inTable('restore_runs').onDelete('CASCADE');
+    
+    table.string('file_path', 500).notNullable();
+    table.string('operation', 50).notNullable(); // restore, skip, error
+    table.string('status', 50).notNullable(); // pending, in_progress, completed, failed
+    
+    table.bigInteger('file_size');
+    table.string('checksum', 64);
+    table.boolean('checksum_verified').defaultTo(formatBoolean(false));
+    
+    table.text('error_message');
+    table.timestamp('started_at');
+    table.timestamp('completed_at');
+    
+    table.index(['restore_run_id', 'status']);
+    table.index(['file_path']);
+  });
+  
+  // Create restore_validation_results table
+  await knex.schema.createTable('restore_validation_results', table => {
+    table.increments('id').primary();
+    
+    table.integer('restore_run_id').notNullable()
+      .references('id').inTable('restore_runs').onDelete('CASCADE');
+    
+    table.string('validation_type', 50).notNullable(); // pre-restore, post-restore
+    table.boolean('is_valid').notNullable();
+    
+    table.text('errors'); // JSON array of errors
+    table.text('warnings'); // JSON array of warnings
+    table.text('checksums'); // JSON object with checksum comparisons
+    
+    table.timestamp('validated_at').notNullable().defaultTo(knex.fn.now());
+    
+    table.index(['restore_run_id', 'validation_type']);
+  });
+  
+  // Add restore-related settings to app_settings
+  await knex('app_settings').insert([
+    {
+      setting_key: 'restore_allow_force',
+      setting_value: formatBoolean(false),
+      setting_type: 'restore',
+      description: 'Allow force restore with warnings',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_require_pre_backup',
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Require pre-restore backup',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_max_file_size_mb',
+      setting_value: '5000',
+      setting_type: 'restore',
+      description: 'Maximum file size for restore (MB)',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_verify_checksums',
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Verify file checksums during restore',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_email_on_completion',
+      setting_value: formatBoolean(true),
+      setting_type: 'restore',
+      description: 'Send email on restore completion',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      setting_key: 'restore_retention_days',
+      setting_value: '30',
+      setting_type: 'restore',
+      description: 'Days to retain restore history',
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    }
+  ]);
+  
+  // Add new email templates for restore notifications
+  const emailTemplates = [
+    {
+      name: 'restore_completed',
+      subject: '✅ Restore Completed Successfully',
+      body: `<h2>Restore Operation Completed</h2>
+<p>A restore operation has completed successfully.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Restore Type:</strong> {{restore_type}}</li>
+  <li><strong>Duration:</strong> {{duration}}</li>
+  <li><strong>Files Restored:</strong> {{files_restored}}</li>
+  <li><strong>Backup ID:</strong> {{backup_id}}</li>
+  <li><strong>Timestamp:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Please verify that all systems are functioning correctly after the restore.</p>`,
+      language: 'en',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_failed',
+      subject: '❌ Restore Operation Failed',
+      body: `<h2>Restore Operation Failed</h2>
+<p>A restore operation has failed and requires attention.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Restore Type:</strong> {{restore_type}}</li>
+  <li><strong>Error:</strong> {{error_message}}</li>
+  <li><strong>Timestamp:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Please check the system logs for more details and take appropriate action.</p>
+
+<p><strong>Important:</strong> If a pre-restore backup was created, it may be used for recovery.</p>`,
+      language: 'en',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_completed',
+      subject: '✅ Wiederherstellung erfolgreich abgeschlossen',
+      body: `<h2>Wiederherstellungsvorgang abgeschlossen</h2>
+<p>Ein Wiederherstellungsvorgang wurde erfolgreich abgeschlossen.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
+  <li><strong>Dauer:</strong> {{duration}}</li>
+  <li><strong>Wiederhergestellte Dateien:</strong> {{files_restored}}</li>
+  <li><strong>Backup-ID:</strong> {{backup_id}}</li>
+  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Bitte überprüfen Sie, ob alle Systeme nach der Wiederherstellung ordnungsgemäß funktionieren.</p>`,
+      language: 'de',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    },
+    {
+      name: 'restore_failed',
+      subject: '❌ Wiederherstellungsvorgang fehlgeschlagen',
+      body: `<h2>Wiederherstellungsvorgang fehlgeschlagen</h2>
+<p>Ein Wiederherstellungsvorgang ist fehlgeschlagen und erfordert Ihre Aufmerksamkeit.</p>
+
+<h3>Details:</h3>
+<ul>
+  <li><strong>Wiederherstellungstyp:</strong> {{restore_type}}</li>
+  <li><strong>Fehler:</strong> {{error_message}}</li>
+  <li><strong>Zeitstempel:</strong> {{timestamp}}</li>
+</ul>
+
+<p>Bitte überprüfen Sie die Systemprotokolle für weitere Details und ergreifen Sie entsprechende Maßnahmen.</p>
+
+<p><strong>Wichtig:</strong> Falls ein Backup vor der Wiederherstellung erstellt wurde, kann es zur Wiederherstellung verwendet werden.</p>`,
+      language: 'de',
+      is_active: formatBoolean(true),
+      created_at: knex.fn.now(),
+      updated_at: knex.fn.now()
+    }
+  ];
+  
+  await knex('email_templates').insert(emailTemplates);
+};
+
+exports.down = async function(knex) {
+  // Remove email templates
+  await knex('email_templates')
+    .whereIn('name', ['restore_completed', 'restore_failed'])
+    .delete();
+  
+  // Remove settings
+  await knex('app_settings')
+    .where('setting_type', 'restore')
+    .delete();
+  
+  // Drop tables
+  await knex.schema.dropTableIfExists('restore_validation_results');
+  await knex.schema.dropTableIfExists('restore_file_operations');
+  await knex.schema.dropTableIfExists('restore_runs');
+};
@@ -0,0 +1,131 @@
+const { formatBoolean } = require('./helpers');
+
+exports.up = async function(knex) {
+  console.log('Adding gallery feedback tables...');
+  
+  // Create event_feedback_settings table
+  await knex.schema.createTable('event_feedback_settings', (table) => {
+    table.increments('id').primary();
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.boolean('feedback_enabled').defaultTo(false);
+    table.boolean('allow_ratings').defaultTo(true);
+    table.boolean('allow_likes').defaultTo(true);
+    table.boolean('allow_comments').defaultTo(false);
+    table.boolean('allow_favorites').defaultTo(true);
+    table.boolean('require_name_email').defaultTo(false);
+    table.boolean('moderate_comments').defaultTo(true);
+    table.boolean('show_feedback_to_guests').defaultTo(true);
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+    table.timestamp('updated_at').defaultTo(knex.fn.now());
+    table.unique(['event_id']);
+  });
+
+  // Create photo_feedback table
+  await knex.schema.createTable('photo_feedback', (table) => {
+    table.increments('id').primary();
+    table.integer('photo_id').references('id').inTable('photos').onDelete('CASCADE');
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.string('feedback_type', 20).notNullable();
+    table.integer('rating');
+    table.text('comment_text');
+    table.string('guest_name', 100);
+    table.string('guest_email', 255);
+    table.string('guest_identifier', 64);
+    table.string('ip_address', 45);
+    table.text('user_agent');
+    table.boolean('is_approved').defaultTo(true);
+    table.boolean('is_hidden').defaultTo(false);
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+    table.timestamp('updated_at').defaultTo(knex.fn.now());
+    
+    // Add indexes
+    table.index(['photo_id']);
+    table.index(['event_id']);
+    table.index(['feedback_type']);
+    table.index(['guest_identifier']);
+    
+    // Add check constraint for rating (PostgreSQL)
+    if (knex.client.config.client === 'pg') {
+      table.check('?? >= 1 AND ?? <= 5', ['rating', 'rating']);
+    }
+  });
+
+  // Create feedback_rate_limits table
+  await knex.schema.createTable('feedback_rate_limits', (table) => {
+    table.increments('id').primary();
+    table.string('identifier', 64).notNullable();
+    table.integer('event_id').references('id').inTable('events').onDelete('CASCADE');
+    table.string('action_type', 20).notNullable();
+    table.integer('action_count').defaultTo(1);
+    table.timestamp('window_start').defaultTo(knex.fn.now());
+    
+    // Add indexes
+    table.index(['identifier', 'event_id', 'action_type']);
+    table.index(['window_start']);
+  });
+
+  // Create feedback_word_filters table
+  await knex.schema.createTable('feedback_word_filters', (table) => {
+    table.increments('id').primary();
+    table.string('word', 100).notNullable();
+    table.string('severity', 20).defaultTo('moderate');
+    table.boolean('is_active').defaultTo(true);
+    table.timestamp('created_at').defaultTo(knex.fn.now());
+    table.unique(['word']);
+  });
+
+  // Add feedback summary columns to photos table
+  await knex.schema.alterTable('photos', (table) => {
+    table.integer('feedback_count').defaultTo(0);
+    table.integer('like_count').defaultTo(0);
+    table.decimal('average_rating', 3, 2).defaultTo(0);
+    table.integer('favorite_count').defaultTo(0);
+  });
+
+  // Add feedback notification settings to app_settings
+  await knex('app_settings').insert([
+    {
+      setting_key: 'feedback_notification_email',
+      setting_value: JSON.stringify(''),
+      setting_type: 'feedback',
+      updated_at: new Date()
+    },
+    {
+      setting_key: 'feedback_rate_limits',
+      setting_value: JSON.stringify({
+        rating: { max: 100, window: 3600 }, // 100 ratings per hour
+        comment: { max: 20, window: 3600 }, // 20 comments per hour
+        like: { max: 200, window: 3600 } // 200 likes per hour
+      }),
+      setting_type: 'feedback',
+      updated_at: new Date()
+    }
+  ]);
+  
+  console.log('Gallery feedback tables created successfully');
+};
+
+exports.down = async function(knex) {
+  console.log('Removing gallery feedback tables...');
+  
+  // Remove feedback settings from app_settings
+  await knex('app_settings')
+    .whereIn('setting_key', ['feedback_notification_email', 'feedback_rate_limits'])
+    .delete();
+
+  // Remove feedback columns from photos table
+  await knex.schema.alterTable('photos', (table) => {
+    table.dropColumn('feedback_count');
+    table.dropColumn('like_count');
+    table.dropColumn('average_rating');
+    table.dropColumn('favorite_count');
+  });
+
+  // Drop tables in reverse order
+  await knex.schema.dropTableIfExists('feedback_word_filters');
+  await knex.schema.dropTableIfExists('feedback_rate_limits');
+  await knex.schema.dropTableIfExists('photo_feedback');
+  await knex.schema.dropTableIfExists('event_feedback_settings');
+  
+  console.log('Gallery feedback tables removed');
+};
@@ -0,0 +1,139 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Adding version tracking to backup tables...');
+  
+  // Add version columns to database_backup_runs table
+  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
+  if (hasDatabaseBackupRunsTable) {
+    const hasAppVersion = await db.schema.hasColumn('database_backup_runs', 'app_version');
+    if (!hasAppVersion) {
+      await db.schema.alterTable('database_backup_runs', (table) => {
+        table.string('app_version'); // Application version
+        table.string('node_version'); // Node.js version
+        table.string('db_schema_version'); // Database schema version (migration name)
+        table.json('environment_info'); // Additional environment information
+      });
+      console.log('Added version columns to database_backup_runs table');
+    }
+  }
+
+  // Add version columns to backup_runs table (file backups)
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (hasBackupRunsTable) {
+    const hasAppVersion = await db.schema.hasColumn('backup_runs', 'app_version');
+    if (!hasAppVersion) {
+      await db.schema.alterTable('backup_runs', (table) => {
+        table.string('app_version'); // Application version
+        table.string('node_version'); // Node.js version
+        table.string('db_schema_version'); // Database schema version
+        table.json('manifest_info'); // Manifest summary information
+      });
+      console.log('Added version columns to backup_runs table');
+    }
+  }
+
+  // Add restore tracking table
+  const hasRestoreHistoryTable = await db.schema.hasTable('restore_history');
+  if (!hasRestoreHistoryTable) {
+    await db.schema.createTable('restore_history', (table) => {
+      table.increments('id').primary();
+      table.datetime('started_at').notNullable();
+      table.datetime('completed_at');
+      table.string('status').defaultTo('running'); // running, completed, failed, partial
+      table.string('restore_type'); // database, files, full
+      table.string('backup_id'); // Reference to the backup that was restored
+      table.string('backup_app_version'); // Version of app that created the backup
+      table.string('restore_app_version'); // Version of app performing the restore
+      table.string('backup_node_version'); // Node version that created the backup
+      table.string('restore_node_version'); // Node version performing the restore
+      table.string('backup_schema_version'); // Schema version in the backup
+      table.string('restore_schema_version'); // Current schema version
+      table.json('version_compatibility'); // Compatibility check results
+      table.json('restore_options'); // Options used during restore
+      table.json('statistics'); // Restore statistics
+      table.text('warnings'); // Any warnings during restore
+      table.text('error_message'); // Error details if failed
+      table.string('restored_by'); // User who initiated the restore
+      table.index(['started_at'], 'idx_restore_started');
+      table.index(['backup_id'], 'idx_restore_backup_id');
+    });
+    console.log('Created restore_history table');
+  }
+
+  // Add version compatibility settings
+  const versionSettings = [
+    {
+      setting_key: 'backup_require_version_match',
+      setting_value: JSON.stringify(false), // If true, exact version match required for restore
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_allow_minor_version_mismatch',
+      setting_value: JSON.stringify(true), // Allow restoring from same major version
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_warn_on_version_mismatch',
+      setting_value: JSON.stringify(true), // Show warning when versions don't match
+      setting_type: 'backup'
+    },
+    {
+      setting_key: 'backup_check_schema_compatibility',
+      setting_value: JSON.stringify(true), // Check if migrations are compatible
+      setting_type: 'backup'
+    }
+  ];
+
+  // Insert version settings if they don't exist
+  for (const setting of versionSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  console.log('Version tracking for backups added successfully');
+}
+
+async function down() {
+  // Remove version columns from database_backup_runs
+  const hasDatabaseBackupRunsTable = await db.schema.hasTable('database_backup_runs');
+  if (hasDatabaseBackupRunsTable) {
+    await db.schema.alterTable('database_backup_runs', (table) => {
+      table.dropColumn('app_version');
+      table.dropColumn('node_version');
+      table.dropColumn('db_schema_version');
+      table.dropColumn('environment_info');
+    });
+  }
+
+  // Remove version columns from backup_runs
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (hasBackupRunsTable) {
+    await db.schema.alterTable('backup_runs', (table) => {
+      table.dropColumn('app_version');
+      table.dropColumn('node_version');
+      table.dropColumn('db_schema_version');
+      table.dropColumn('manifest_info');
+    });
+  }
+
+  // Drop restore_history table
+  await db.schema.dropTableIfExists('restore_history');
+
+  // Remove version settings
+  await db('app_settings')
+    .whereIn('setting_key', [
+      'backup_require_version_match',
+      'backup_allow_minor_version_mismatch',
+      'backup_warn_on_version_mismatch',
+      'backup_check_schema_compatibility'
+    ])
+    .delete();
+}
+
+module.exports = { up, down };
@@ -0,0 +1,228 @@
+const { db } = require('../src/database/db');
+
+async function up() {
+  console.log('Enhancing backup system...');
+  
+  // Add new settings to app_settings table if they don't exist
+  const backupSettings = [
+    {
+      setting_key: 'backup_s3_force_path_style',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+      description: 'Force path-style S3 URLs (for MinIO/self-hosted)'
+    },
+    {
+      setting_key: 'backup_s3_ssl_enabled',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup',
+      description: 'Enable SSL/TLS for S3 connections'
+    },
+    {
+      setting_key: 'backup_s3_prefix',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup',
+      description: 'S3 key prefix for organizing backups'
+    },
+    {
+      setting_key: 'backup_incremental',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+      description: 'Enable incremental backups'
+    },
+    {
+      setting_key: 'backup_include_database',
+      setting_value: JSON.stringify(true),
+      setting_type: 'backup',
+      description: 'Include database dumps in backups'
+    },
+    {
+      setting_key: 'backup_encryption_enabled',
+      setting_value: JSON.stringify(false),
+      setting_type: 'backup',
+      description: 'Enable backup encryption'
+    },
+    {
+      setting_key: 'backup_database_schedule',
+      setting_value: JSON.stringify(''),
+      setting_type: 'backup',
+      description: 'Separate cron schedule for database-only backups'
+    }
+  ];
+
+  // Insert settings if they don't exist
+  for (const setting of backupSettings) {
+    const exists = await db('app_settings')
+      .where('setting_key', setting.setting_key)
+      .first();
+    
+    if (!exists) {
+      await db('app_settings').insert(setting);
+    }
+  }
+
+  // Check and add columns to backup_runs table
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (hasBackupRunsTable) {
+    // Check for existing columns before adding
+    const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
+    const hasManifestId = await db.schema.hasColumn('backup_runs', 'manifest_id');
+    const hasManifestFormat = await db.schema.hasColumn('backup_runs', 'manifest_format');
+    const hasParentBackupId = await db.schema.hasColumn('backup_runs', 'parent_backup_id');
+    const hasBackupMode = await db.schema.hasColumn('backup_runs', 'backup_mode');
+    
+    if (!hasManifestPath || !hasManifestId || !hasManifestFormat || !hasParentBackupId || !hasBackupMode) {
+      await db.schema.alterTable('backup_runs', (table) => {
+        if (!hasManifestPath) {
+          table.string('manifest_path', 500).comment('Path to backup manifest file');
+        }
+        if (!hasManifestId) {
+          table.uuid('manifest_id').comment('Unique identifier for the manifest');
+        }
+        if (!hasManifestFormat) {
+          table.enum('manifest_format', ['json', 'yaml']).comment('Format of the manifest file');
+        }
+        if (!hasParentBackupId) {
+          table.integer('parent_backup_id').unsigned().references('id').inTable('backup_runs').onDelete('SET NULL').comment('Parent backup for incremental backups');
+        }
+        if (!hasBackupMode) {
+          table.enum('backup_mode', ['full', 'incremental', 'database']).defaultTo('full').comment('Type of backup performed');
+        }
+      });
+    }
+    
+    // Add indexes if they don't exist
+    try {
+      await db.raw('CREATE INDEX IF NOT EXISTS idx_backup_runs_mode_status ON backup_runs(backup_mode, status)');
+      await db.raw('CREATE INDEX IF NOT EXISTS idx_backup_runs_parent ON backup_runs(parent_backup_id)');
+      await db.raw('CREATE INDEX IF NOT EXISTS idx_backup_runs_created_mode ON backup_runs(created_at, backup_mode)');
+    } catch (error) {
+      console.log('Note: Some indexes may already exist, continuing...');
+    }
+  }
+
+  // Create backup_manifest table if it doesn't exist
+  const hasManifestTable = await db.schema.hasTable('backup_manifest');
+  if (!hasManifestTable) {
+    await db.schema.createTable('backup_manifest', (table) => {
+      table.increments('id').primary();
+      table.integer('backup_run_id').unsigned().notNullable().references('id').inTable('backup_runs').onDelete('CASCADE');
+      table.uuid('manifest_id').notNullable().unique().comment('Unique identifier matching backup_runs.manifest_id');
+      table.string('version', 20).notNullable().defaultTo('1.0.0').comment('Manifest schema version');
+      table.enum('format', ['json', 'yaml']).notNullable().defaultTo('json');
+      
+      // Backup metadata
+      table.timestamp('backup_start').notNullable();
+      table.timestamp('backup_end').notNullable();
+      table.bigInteger('total_size').unsigned().comment('Total size of backup in bytes');
+      table.integer('file_count').unsigned().comment('Number of files in backup');
+      table.integer('photo_count').unsigned().comment('Number of photos backed up');
+      table.integer('event_count').unsigned().comment('Number of events backed up');
+      
+      // Incremental backup metadata
+      table.boolean('is_incremental').defaultTo(false);
+      table.uuid('parent_manifest_id').comment('Parent manifest ID for incremental backups');
+      table.timestamp('incremental_since').comment('Timestamp for incremental backup baseline');
+      
+      // Content checksums
+      table.string('checksum_algorithm', 50).defaultTo('sha256').comment('Algorithm used for checksums');
+      table.text('manifest_checksum').comment('Checksum of the manifest file itself');
+      
+      // Storage information
+      table.string('storage_location', 500).comment('Primary storage location (local path or S3 URI)');
+      table.string('storage_provider', 50).comment('Storage provider (local, s3, etc.)');
+      
+      // Encryption metadata
+      table.boolean('is_encrypted').defaultTo(false);
+      table.string('encryption_algorithm', 100).comment('Encryption algorithm used');
+      table.string('encryption_key_id', 255).comment('ID of encryption key used');
+      
+      // Additional metadata as JSON
+      table.json('metadata').comment('Additional metadata as JSON');
+      
+      // Timestamps
+      table.timestamps(true, true);
+      
+      // Indexes
+      table.index(['backup_run_id'], 'idx_manifest_backup_run');
+      table.index(['manifest_id'], 'idx_manifest_uuid');
+      table.index(['parent_manifest_id'], 'idx_manifest_parent');
+      table.index(['backup_start', 'backup_end'], 'idx_manifest_time_range');
+      table.index(['is_incremental', 'created_at'], 'idx_manifest_incremental_created');
+    });
+  }
+
+  // Add composite indexes for common query patterns
+  try {
+    await db.raw(`
+      CREATE INDEX IF NOT EXISTS idx_backup_runs_recent_successful 
+      ON backup_runs(created_at DESC) 
+      WHERE status = 'completed' AND backup_mode = 'full';
+    `);
+    await db.raw(`
+      CREATE INDEX IF NOT EXISTS idx_backup_runs_incremental_chain 
+      ON backup_runs(parent_backup_id, created_at) 
+      WHERE backup_mode = 'incremental';
+    `);
+  } catch (error) {
+    console.log('Note: Some composite indexes may already exist, continuing...');
+  }
+
+  console.log('Backup system enhancements completed');
+}
+
+async function down() {
+  // Drop indexes first
+  try {
+    await db.raw('DROP INDEX IF EXISTS idx_backup_runs_incremental_chain;');
+    await db.raw('DROP INDEX IF EXISTS idx_backup_runs_recent_successful;');
+  } catch (error) {
+    // Ignore errors if indexes don't exist
+  }
+
+  // Drop backup_manifest table
+  await db.schema.dropTableIfExists('backup_manifest');
+
+  // Remove columns from backup_runs if they exist
+  const hasBackupRunsTable = await db.schema.hasTable('backup_runs');
+  if (hasBackupRunsTable) {
+    const hasBackupMode = await db.schema.hasColumn('backup_runs', 'backup_mode');
+    const hasParentBackupId = await db.schema.hasColumn('backup_runs', 'parent_backup_id');
+    const hasManifestFormat = await db.schema.hasColumn('backup_runs', 'manifest_format');
+    const hasManifestId = await db.schema.hasColumn('backup_runs', 'manifest_id');
+    const hasManifestPath = await db.schema.hasColumn('backup_runs', 'manifest_path');
+    
+    if (hasBackupMode || hasParentBackupId || hasManifestFormat || hasManifestId || hasManifestPath) {
+      await db.schema.alterTable('backup_runs', (table) => {
+        if (hasBackupMode) table.dropColumn('backup_mode');
+        if (hasParentBackupId) table.dropColumn('parent_backup_id');
+        if (hasManifestFormat) table.dropColumn('manifest_format');
+        if (hasManifestId) table.dropColumn('manifest_id');
+        if (hasManifestPath) table.dropColumn('manifest_path');
+      });
+    }
+    
+    // Drop indexes
+    try {
+      await db.raw('DROP INDEX IF EXISTS idx_backup_runs_mode_status');
+      await db.raw('DROP INDEX IF EXISTS idx_backup_runs_parent');
+      await db.raw('DROP INDEX IF EXISTS idx_backup_runs_created_mode');
+    } catch (error) {
+      // Ignore errors if indexes don't exist
+    }
+  }
+
+  // Remove settings
+  await db('app_settings')
+    .whereIn('setting_key', [
+      'backup_s3_force_path_style',
+      'backup_s3_ssl_enabled',
+      'backup_s3_prefix',
+      'backup_incremental',
+      'backup_include_database',
+      'backup_encryption_enabled',
+      'backup_database_schedule'
+    ])
+    .delete();
+}
+
+module.exports = { up, down };
@@ -1,6 +1,6 @@
 {
  "name": "picpeak-backend",
-  "version": "1.0.20",
+  "version": "1.0.79",
  "description": "Backend for PicPeak event photo sharing platform",
  "main": "server.js",
  "scripts": {
@@ -8,34 +8,43 @@
    "dev": "nodemon server.js",
    "migrate": "node migrations/run-migrations.js",
    "migrate:safe": "node migrations/run-migrations-safe.js",
+    "fix-temp-photos": "node scripts/fix-temp-photos.js",
    "test": "jest",
-    "lint": "eslint src/"
+    "lint": "eslint src/",
+    "test-backup": "node scripts/test-backup-service.js",
+    "test-restore": "node scripts/test-restore-service.js"
  },
  "dependencies": {
+    "@aws-sdk/client-s3": "^3.850.0",
+    "@aws-sdk/lib-storage": "^3.850.0",
+    "@aws-sdk/s3-request-presigner": "^3.850.0",
    "adm-zip": "^0.5.16",
    "archiver": "^5.3.1",
    "axios": "^1.10.0",
-    "bcrypt": "^5.1.0",
-    "chokidar": "^3.5.3",
+    "bcrypt": "6.0.0",
+    "chokidar": "4.0.3",
    "cors": "^2.8.5",
    "dotenv": "^16.0.3",
    "express": "^4.18.2",
    "express-rate-limit": "^6.7.0",
    "express-validator": "^7.0.1",
-    "form-data": "^4.0.3",
+    "form-data": "^4.0.4",
+    "handlebars": "^4.7.8",
    "helmet": "^7.0.0",
-    "i18next": "^25.3.1",
+    "i18next": "25.3.2",
    "i18next-browser-languagedetector": "^8.2.0",
    "i18next-http-backend": "^3.0.2",
    "joi": "^17.9.1",
+    "js-yaml": "^4.1.0",
    "jsonwebtoken": "^9.0.0",
    "knex": "^2.4.2",
-    "multer": "^2.0.1",
+    "mime-types": "^3.0.1",
+    "multer": "^2.0.2",
    "node-cron": "^3.0.2",
-    "nodemailer": "^6.9.1",
+    "nodemailer": "7.0.5",
    "pg": "^8.16.3",
    "react-i18next": "^15.6.0",
-    "sharp": "^0.32.0",
+    "sharp": "0.34.3",
    "sqlite3": "^5.1.6",
    "uuid": "^11.1.0",
    "winston": "^3.8.2",
@@ -0,0 +1,131 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailEnvironment() {
+  console.log('=== Email Environment Check ===\n');
+  
+  // 1. Check environment variables
+  console.log('1. Environment Variables:');
+  const envVars = [
+    'SMTP_HOST',
+    'SMTP_PORT',
+    'SMTP_USER',
+    'SMTP_PASS',
+    'SMTP_FROM',
+    'SMTP_SECURE',
+    'EMAIL_PROCESSOR_ENABLED',
+    'NODE_ENV'
+  ];
+  
+  envVars.forEach(varName => {
+    const value = process.env[varName];
+    if (varName.includes('PASS')) {
+      console.log(`   ${varName}: ${value ? '***' : 'NOT SET'}`);
+    } else {
+      console.log(`   ${varName}: ${value || 'NOT SET'}`);
+    }
+  });
+  
+  // 2. Check database configuration
+  console.log('\n2. Database Email Configuration:');
+  try {
+    const emailConfig = await db('email_configs').first();
+    if (emailConfig) {
+      console.log('   Email configuration found in database:');
+      console.log(`   - SMTP Host: ${emailConfig.smtp_host}`);
+      console.log(`   - SMTP Port: ${emailConfig.smtp_port}`);
+      console.log(`   - SMTP User: ${emailConfig.smtp_user || 'NOT SET'}`);
+      console.log(`   - SMTP Secure: ${emailConfig.smtp_secure}`);
+      console.log(`   - From Address: ${emailConfig.smtp_from}`);
+    } else {
+      console.log('   ⚠️  No email configuration found in database!');
+      console.log('   This will prevent the email processor from initializing.');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error reading email configuration: ${error.message}`);
+  }
+  
+  // 3. Check if the email processor should be disabled
+  console.log('\n3. Email Processor Status:');
+  const isDisabled = process.env.EMAIL_PROCESSOR_ENABLED === 'false';
+  if (isDisabled) {
+    console.log('   ⚠️  Email processor is DISABLED via EMAIL_PROCESSOR_ENABLED=false');
+  } else {
+    console.log('   ✅ Email processor is enabled (default)');
+  }
+  
+  // 4. Check pending emails
+  console.log('\n4. Email Queue Status:');
+  try {
+    const pending = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count')
+      .first();
+    
+    const failed = await db('email_queue')
+      .where('status', 'failed')
+      .where('retry_count', '>=', 3)
+      .count('* as count')
+      .first();
+    
+    const sent = await db('email_queue')
+      .where('status', 'sent')
+      .count('* as count')
+      .first();
+    
+    console.log(`   - Pending emails: ${pending.count}`);
+    console.log(`   - Failed emails (max retries): ${failed.count}`);
+    console.log(`   - Sent emails: ${sent.count}`);
+  } catch (error) {
+    console.log(`   ❌ Error querying email queue: ${error.message}`);
+  }
+  
+  // 5. Test database connection
+  console.log('\n5. Database Connection:');
+  try {
+    await db.raw('SELECT 1');
+    console.log('   ✅ Database connection successful');
+  } catch (error) {
+    console.log(`   ❌ Database connection failed: ${error.message}`);
+  }
+  
+  // 6. Check for any recent errors
+  console.log('\n6. Recent Email Errors:');
+  try {
+    const recentErrors = await db('email_queue')
+      .whereNotNull('error_message')
+      .orderBy('id', 'desc')
+      .limit(3)
+      .select('id', 'email_type', 'error_message', 'retry_count');
+    
+    if (recentErrors.length > 0) {
+      recentErrors.forEach((email, index) => {
+        console.log(`   ${index + 1}. Email ID ${email.id} (${email.email_type}):`);
+        console.log(`      Retries: ${email.retry_count}`);
+        console.log(`      Error: ${email.error_message}`);
+      });
+    } else {
+      console.log('   No recent errors found');
+    }
+  } catch (error) {
+    console.log(`   ❌ Error querying recent errors: ${error.message}`);
+  }
+  
+  console.log('\n=== Environment check complete ===');
+  console.log('\nRecommendations:');
+  
+  const emailConfig = await db('email_configs').first().catch(() => null);
+  if (!emailConfig) {
+    console.log('❗ Configure email settings in the admin panel or add email_configs record');
+  }
+  
+  if (!process.env.SMTP_HOST && !emailConfig) {
+    console.log('❗ Set SMTP environment variables or configure in database');
+  }
+  
+  await db.destroy();
+}
+
+checkEmailEnvironment().catch(error => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});
@@ -0,0 +1,157 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function checkEmailProcessor() {
+  try {
+    logger.info('=== Email Processor Diagnostic Check ===\n');
+    
+    // 1. Check pending emails
+    logger.info('1. Checking pending emails in queue...');
+    const pendingEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .orderBy('created_at', 'asc');
+    
+    logger.info(`Found ${pendingEmails.length} pending emails\n`);
+    
+    if (pendingEmails.length > 0) {
+      logger.info('Pending email details:');
+      pendingEmails.forEach((email, index) => {
+        logger.info(`\nEmail ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Recipient: ${email.recipient_email}`);
+        logger.info(`  Event ID: ${email.event_id}`);
+        logger.info(`  Status: ${email.status}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Scheduled At: ${email.scheduled_at}`);
+        logger.info(`  Created At: ${email.created_at}`);
+        logger.info(`  Error: ${email.error_message || 'None'}`);
+        
+        // Check if email_data needs parsing
+        logger.info(`  Email Data Type: ${typeof email.email_data}`);
+        if (email.email_data) {
+          try {
+            const data = typeof email.email_data === 'string' 
+              ? JSON.parse(email.email_data) 
+              : email.email_data;
+            logger.info(`  Email Data Keys: ${Object.keys(data).join(', ')}`);
+          } catch (e) {
+            logger.error(`  Failed to parse email_data: ${e.message}`);
+          }
+        }
+      });
+    }
+    
+    // 2. Check failed emails
+    logger.info('\n\n2. Checking failed emails...');
+    const failedEmails = await db('email_queue')
+      .where('status', 'failed')
+      .orderBy('created_at', 'desc')
+      .limit(5);
+    
+    logger.info(`Found ${failedEmails.length} failed emails (showing last 5)\n`);
+    
+    if (failedEmails.length > 0) {
+      failedEmails.forEach((email, index) => {
+        logger.info(`\nFailed Email ${index + 1}:`);
+        logger.info(`  ID: ${email.id}`);
+        logger.info(`  Type: ${email.email_type}`);
+        logger.info(`  Retry Count: ${email.retry_count}`);
+        logger.info(`  Error: ${email.error_message || 'No error message'}`);
+        logger.info(`  Last Attempt: ${email.sent_at || 'Never'}`);
+      });
+    }
+    
+    // 3. Check if email processor should be running
+    logger.info('\n\n3. Checking email processor configuration...');
+    
+    // Check environment variables
+    const emailConfig = {
+      SMTP_HOST: process.env.SMTP_HOST,
+      SMTP_PORT: process.env.SMTP_PORT,
+      SMTP_USER: process.env.SMTP_USER,
+      SMTP_FROM: process.env.SMTP_FROM,
+      SMTP_SECURE: process.env.SMTP_SECURE,
+      EMAIL_PROCESSOR_ENABLED: process.env.EMAIL_PROCESSOR_ENABLED || 'true'
+    };
+    
+    logger.info('Email configuration:');
+    Object.entries(emailConfig).forEach(([key, value]) => {
+      if (key === 'SMTP_USER') {
+        logger.info(`  ${key}: ${value ? '***' : 'NOT SET'}`);
+      } else {
+        logger.info(`  ${key}: ${value || 'NOT SET'}`);
+      }
+    });
+    
+    // 4. Test email processor functionality
+    logger.info('\n\n4. Testing email processor functionality...');
+    
+    // Import the email processor
+    const { processEmailQueue, testEmailConnection } = require('../src/services/emailProcessor');
+    
+    // Test email connection
+    logger.info('Testing email connection...');
+    try {
+      const connectionTest = await testEmailConnection();
+      logger.info(`Email connection test: ${connectionTest ? 'SUCCESS' : 'FAILED'}`);
+    } catch (error) {
+      logger.error(`Email connection test failed: ${error.message}`);
+    }
+    
+    // Try to process queue once manually
+    if (pendingEmails.length > 0) {
+      logger.info('\n\n5. Attempting to process email queue manually...');
+      try {
+        await processEmailQueue();
+        logger.info('Manual queue processing completed');
+        
+        // Check status after processing
+        const stillPending = await db('email_queue')
+          .where('status', 'pending')
+          .where('retry_count', '<', 3)
+          .count('* as count')
+          .first();
+        
+        logger.info(`Emails still pending after processing: ${stillPending.count}`);
+      } catch (error) {
+        logger.error(`Error processing queue: ${error.message}`);
+        logger.error(`Stack trace: ${error.stack}`);
+      }
+    }
+    
+    // 5. Check for any recent successful emails
+    logger.info('\n\n6. Checking recent successful emails...');
+    const recentSuccess = await db('email_queue')
+      .where('status', 'sent')
+      .orderBy('sent_at', 'desc')
+      .limit(3);
+    
+    if (recentSuccess.length > 0) {
+      logger.info(`Last ${recentSuccess.length} successful emails:`);
+      recentSuccess.forEach((email, index) => {
+        logger.info(`  ${index + 1}. Type: ${email.email_type}, Sent: ${email.sent_at}`);
+      });
+    } else {
+      logger.info('No successfully sent emails found');
+    }
+    
+    logger.info('\n\n=== Diagnostic check complete ===');
+    
+  } catch (error) {
+    logger.error('Error running diagnostic check:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the check
+checkEmailProcessor();
@@ -0,0 +1,66 @@
+const { db } = require('../src/database/db');
+
+async function checkEmailTemplates() {
+  try {
+    console.log('=== Email Templates Check ===\n');
+    
+    // 1. Check table columns
+    console.log('1. Checking email_templates table structure...');
+    
+    // Check which columns exist
+    const columnChecks = [
+      'subject', 'subject_en', 'subject_de',
+      'body_html', 'body_html_en', 'body_html_de',
+      'body_text', 'body_text_en', 'body_text_de'
+    ];
+    
+    const existingColumns = [];
+    for (const col of columnChecks) {
+      const exists = await db.schema.hasColumn('email_templates', col);
+      if (exists) existingColumns.push(col);
+    }
+    
+    console.log('   Existing columns:', existingColumns.join(', '));
+    
+    // 2. Get all templates
+    console.log('\n2. Current email templates:');
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n   Template: ${template.template_key}`);
+      console.log('   -------------------');
+      
+      // Check which fields have content
+      const fields = ['subject', 'subject_en', 'subject_de', 
+                     'body_html', 'body_html_en', 'body_html_de',
+                     'body_text', 'body_text_en', 'body_text_de'];
+      
+      for (const field of fields) {
+        if (template[field]) {
+          const preview = template[field].substring(0, 50) + '...';
+          console.log(`   ${field}: ${preview}`);
+        }
+      }
+      
+      // Check for German translations
+      const hasGermanSubject = template.subject_de || template.body_html_de;
+      console.log(`   Has German translation: ${hasGermanSubject ? 'YES' : 'NO'}`);
+    }
+    
+    // 3. Summary
+    console.log('\n3. Summary:');
+    const totalTemplates = templates.length;
+    const templatesWithGerman = templates.filter(t => t.subject_de || t.body_html_de).length;
+    console.log(`   Total templates: ${totalTemplates}`);
+    console.log(`   Templates with German: ${templatesWithGerman}`);
+    console.log(`   Missing German: ${totalTemplates - templatesWithGerman}`);
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkEmailTemplates();
@@ -0,0 +1,53 @@
+const { db } = require('../src/database/db');
+
+async function checkGermanTemplates() {
+  try {
+    console.log('=== German Email Template Content Check ===\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\nTemplate: ${template.template_key}`);
+      console.log('=====================================');
+      
+      // Check German subject
+      console.log('\nGERMAN SUBJECT:');
+      console.log(template.subject_de || 'MISSING');
+      
+      // Check if German HTML body has English content
+      console.log('\nGERMAN HTML BODY:');
+      const germanHtml = template.body_html_de || '';
+      
+      // Check for English phrases in German template
+      const englishPhrases = [
+        'Dear', 'Gallery', 'has been', 'Your photo', 'successfully',
+        'Details:', 'Link:', 'Password:', 'Expires:', 'Event Date:',
+        'Thank you', 'Best regards', 'View Gallery', 'days'
+      ];
+      
+      const foundEnglish = englishPhrases.filter(phrase => 
+        germanHtml.toLowerCase().includes(phrase.toLowerCase())
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  Found English phrases in German template:', foundEnglish.join(', '));
+      }
+      
+      // Show first 500 chars of German HTML
+      console.log(germanHtml.substring(0, 500) + '...\n');
+      
+      // Check German text body
+      console.log('GERMAN TEXT BODY:');
+      const germanText = template.body_text_de || '';
+      console.log(germanText.substring(0, 300) + '...\n');
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+checkGermanTemplates();
@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to check storage directory structure and verify files
+ * Usage: node scripts/check-storage.js [eventSlug]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+
+async function checkDirectory(dirPath, description) {
+  try {
+    await fs.access(dirPath);
+    const stats = await fs.stat(dirPath);
+    const files = await fs.readdir(dirPath);
+    console.log(`✓ ${description}: ${dirPath}`);
+    console.log(`  - Files/Folders: ${files.length}`);
+    console.log(`  - Permissions: ${(stats.mode & parseInt('777', 8)).toString(8)}`);
+    return true;
+  } catch (error) {
+    console.log(`✗ ${description}: ${dirPath} - ${error.message}`);
+    return false;
+  }
+}
+
+async function checkStorageStructure(eventSlug = null) {
+  console.log('Checking storage structure...');
+  console.log(`Storage base path: ${STORAGE_PATH}\n`);
+  
+  // Check main directories
+  await checkDirectory(STORAGE_PATH, 'Storage root');
+  await checkDirectory(path.join(STORAGE_PATH, 'events'), 'Events directory');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/active'), 'Active events');
+  await checkDirectory(path.join(STORAGE_PATH, 'events/archived'), 'Archived events');
+  await checkDirectory(path.join(STORAGE_PATH, 'thumbnails'), 'Thumbnails');
+  await checkDirectory(path.join(STORAGE_PATH, 'uploads'), 'Uploads');
+  
+  console.log('\n---\n');
+  
+  // If event slug provided, check specific event
+  if (eventSlug) {
+    console.log(`Checking specific event: ${eventSlug}`);
+    
+    const event = await db('events').where('slug', eventSlug).first();
+    if (!event) {
+      console.log(`✗ Event not found in database: ${eventSlug}`);
+      return;
+    }
+    
+    console.log(`✓ Event found in database:`);
+    console.log(`  - ID: ${event.id}`);
+    console.log(`  - Name: ${event.event_name}`);
+    console.log(`  - Active: ${event.is_active}`);
+    console.log(`  - Archived: ${event.is_archived}`);
+    
+    // Check event directory
+    const eventDir = path.join(STORAGE_PATH, 'events/active', eventSlug);
+    const eventExists = await checkDirectory(eventDir, 'Event directory');
+    
+    if (eventExists) {
+      const files = await fs.readdir(eventDir);
+      console.log(`  - Photo files: ${files.filter(f => /\.(jpg|jpeg|png|gif)$/i.test(f)).length}`);
+    }
+    
+    // Check photos in database
+    const photos = await db('photos').where('event_id', event.id).select('id', 'filename', 'path', 'thumbnail_path');
+    console.log(`\nDatabase photos: ${photos.length}`);
+    
+    // Check if photo files exist
+    let existingPhotos = 0;
+    let missingPhotos = 0;
+    let existingThumbnails = 0;
+    let missingThumbnails = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      try {
+        await fs.access(photoPath);
+        existingPhotos++;
+      } catch {
+        missingPhotos++;
+        console.log(`  ✗ Missing photo: ${photo.path}`);
+      }
+      
+      if (photo.thumbnail_path) {
+        const thumbPath = path.join(STORAGE_PATH, photo.thumbnail_path.replace(/^\//, ''));
+        try {
+          await fs.access(thumbPath);
+          existingThumbnails++;
+        } catch {
+          missingThumbnails++;
+          console.log(`  ✗ Missing thumbnail: ${photo.thumbnail_path}`);
+        }
+      }
+    }
+    
+    console.log(`\nFile check summary:`);
+    console.log(`  - Photos: ${existingPhotos} exist, ${missingPhotos} missing`);
+    console.log(`  - Thumbnails: ${existingThumbnails} exist, ${missingThumbnails} missing`);
+  } else {
+    // List all event directories
+    try {
+      const activeDir = path.join(STORAGE_PATH, 'events/active');
+      const eventDirs = await fs.readdir(activeDir);
+      console.log(`Active event directories: ${eventDirs.length}`);
+      for (const dir of eventDirs.slice(0, 10)) {
+        console.log(`  - ${dir}`);
+      }
+      if (eventDirs.length > 10) {
+        console.log(`  ... and ${eventDirs.length - 10} more`);
+      }
+    } catch (error) {
+      console.log('Could not list event directories:', error.message);
+    }
+  }
+}
+
+// Parse command line arguments
+const eventSlug = process.argv[2] || null;
+
+// Run the script
+checkStorageStructure(eventSlug).then(async () => {
+  await db.destroy();
+  console.log('\nStorage check complete');
+}).catch(async error => {
+  console.error('Error:', error);
+  await db.destroy();
+  process.exit(1);
+});
@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+
+/**
+ * Script to clean up orphaned and temporary thumbnails
+ * Usage: node scripts/cleanup-thumbnails.js [--dry-run]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function cleanupThumbnails(dryRun = false) {
+  console.log('Starting thumbnail cleanup...');
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+  console.log(`Mode: ${dryRun ? 'DRY RUN' : 'LIVE'}\n`);
+  
+  try {
+    // Get all thumbnail files
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    console.log(`Found ${files.length} files in thumbnails directory`);
+    
+    // Get all valid thumbnail paths from database
+    const validThumbnails = await db('photos')
+      .whereNotNull('thumbnail_path')
+      .select('thumbnail_path');
+    
+    const validPaths = new Set(
+      validThumbnails.map(t => path.basename(t.thumbnail_path))
+    );
+    
+    console.log(`Found ${validPaths.size} valid thumbnails in database\n`);
+    
+    let tempCount = 0;
+    let orphanedCount = 0;
+    let validCount = 0;
+    let deletedCount = 0;
+    
+    for (const file of files) {
+      // Skip directories
+      const filePath = path.join(THUMBNAILS_DIR, file);
+      const stats = await fs.stat(filePath);
+      if (stats.isDirectory()) continue;
+      
+      // Check if it's a temporary file
+      if (file.startsWith('thumb_temp_')) {
+        tempCount++;
+        console.log(`Temporary file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      }
+      // Check if it's an orphaned thumbnail
+      else if (!validPaths.has(file)) {
+        orphanedCount++;
+        console.log(`Orphaned file: ${file}`);
+        
+        if (!dryRun) {
+          try {
+            await fs.unlink(filePath);
+            deletedCount++;
+          } catch (error) {
+            console.error(`  Failed to delete: ${error.message}`);
+          }
+        }
+      } else {
+        validCount++;
+      }
+    }
+    
+    console.log('\n--- Summary ---');
+    console.log(`Total files: ${files.length}`);
+    console.log(`Valid thumbnails: ${validCount}`);
+    console.log(`Temporary files: ${tempCount}`);
+    console.log(`Orphaned files: ${orphanedCount}`);
+    if (!dryRun) {
+      console.log(`Deleted files: ${deletedCount}`);
+    } else {
+      console.log(`Files to be deleted: ${tempCount + orphanedCount}`);
+    }
+    
+  } catch (error) {
+    console.error('Error during cleanup:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const dryRun = process.argv.includes('--dry-run');
+
+// Run the cleanup
+cleanupThumbnails(dryRun).then(async () => {
+  await db.destroy();
+  console.log('\nCleanup complete');
+}).catch(async error => {
+  console.error('Cleanup failed:', error);
+  await db.destroy();
+  process.exit(1);
+});
@@ -36,7 +36,8 @@ async function createTestEvent() {
    await db('events').where('slug', eventData.slug).delete();
    
    // Insert new event
-    const [eventId] = await db('events').insert(eventData);
+    const insertResult = await db('events').insert(eventData).returning('id');
+    const eventId = insertResult[0]?.id || insertResult[0];
    console.log('Event created with ID:', eventId);
    
    console.log('\nTest event created successfully!');
@@ -0,0 +1,146 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function debugEmailQueue() {
+  try {
+    logger.info('=== Email Queue Debug Report ===\n');
+    
+    // 1. Count exactly like the admin dashboard does
+    logger.info('1. Admin Dashboard Query (ALL pending, no retry filter):');
+    const [adminCount] = await db('email_queue').where('status', 'pending').count('* as count');
+    logger.info(`   Pending emails (admin dashboard view): ${adminCount.count}\n`);
+    
+    // 2. Count like the email processor does
+    logger.info('2. Email Processor Query (pending with retry_count < 3):');
+    const [processorCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    logger.info(`   Pending emails (processor view): ${processorCount.count}\n`);
+    
+    // 3. Show the discrepancy
+    logger.info('3. Discrepancy Analysis:');
+    if (adminCount.count !== processorCount.count) {
+      logger.info(`   ⚠️  DISCREPANCY FOUND!`);
+      logger.info(`   Admin shows: ${adminCount.count}`);
+      logger.info(`   Processor will process: ${processorCount.count}`);
+      logger.info(`   Difference: ${adminCount.count - processorCount.count} email(s)\n`);
+      
+      // Find the problematic emails
+      logger.info('4. Emails with retry_count >= 3 (still pending):');
+      const stuckEmails = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '>=', 3)
+        .select('*');
+      
+      if (stuckEmails.length > 0) {
+        logger.info(`   Found ${stuckEmails.length} stuck email(s):\n`);
+        stuckEmails.forEach((email, index) => {
+          logger.info(`   Email ${index + 1}:`);
+          logger.info(`     ID: ${email.id}`);
+          logger.info(`     Type: ${email.email_type}`);
+          logger.info(`     Recipient: ${email.recipient_email}`);
+          logger.info(`     Status: ${email.status}`);
+          logger.info(`     Retry Count: ${email.retry_count} ⚠️`);
+          logger.info(`     Created: ${email.created_at}`);
+          logger.info(`     Last Error: ${email.error_message || 'None'}\n`);
+        });
+      }
+    } else {
+      logger.info(`   ✅ No discrepancy - counts match\n`);
+    }
+    
+    // 5. Show ALL pending emails with details
+    logger.info('5. ALL Pending Emails (regardless of retry count):');
+    const allPending = await db('email_queue')
+      .where('status', 'pending')
+      .orderBy('retry_count', 'desc')
+      .orderBy('created_at', 'asc');
+    
+    if (allPending.length > 0) {
+      allPending.forEach((email, index) => {
+        const willProcess = email.retry_count < 3;
+        logger.info(`\n   Email ${index + 1}: ${willProcess ? '✅ WILL PROCESS' : '❌ STUCK (max retries)'}`);
+        logger.info(`     ID: ${email.id}`);
+        logger.info(`     Type: ${email.email_type}`);
+        logger.info(`     Recipient: ${email.recipient_email}`);
+        logger.info(`     Event ID: ${email.event_id}`);
+        logger.info(`     Retry Count: ${email.retry_count}/3`);
+        logger.info(`     Created: ${email.created_at}`);
+        logger.info(`     Scheduled: ${email.scheduled_at}`);
+        if (email.error_message) {
+          logger.info(`     Last Error: ${email.error_message}`);
+        }
+      });
+    } else {
+      logger.info('   No pending emails found');
+    }
+    
+    // 6. Show counts by status
+    logger.info('\n\n6. Email Queue Summary by Status:');
+    const statusCounts = await db('email_queue')
+      .select('status')
+      .count('* as count')
+      .groupBy('status')
+      .orderBy('status');
+    
+    statusCounts.forEach(row => {
+      logger.info(`   ${row.status}: ${row.count}`);
+    });
+    
+    // 7. Failed emails summary
+    logger.info('\n7. Failed Emails Summary:');
+    const failedSummary = await db('email_queue')
+      .where('status', 'failed')
+      .select('retry_count')
+      .count('* as count')
+      .groupBy('retry_count')
+      .orderBy('retry_count');
+    
+    if (failedSummary.length > 0) {
+      failedSummary.forEach(row => {
+        logger.info(`   Retry count ${row.retry_count}: ${row.count} email(s)`);
+      });
+    } else {
+      logger.info('   No failed emails');
+    }
+    
+    // 8. Recommendations
+    logger.info('\n\n=== RECOMMENDATIONS ===');
+    
+    if (adminCount.count > processorCount.count) {
+      logger.info('\n❗ You have emails stuck with retry_count >= 3');
+      logger.info('   These emails will NOT be processed automatically.');
+      logger.info('\n   To fix this, you can:');
+      logger.info('   1. Reset retry count: UPDATE email_queue SET retry_count = 0 WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   2. Mark as failed: UPDATE email_queue SET status = \'failed\' WHERE status = \'pending\' AND retry_count >= 3;');
+      logger.info('   3. Delete them: DELETE FROM email_queue WHERE status = \'pending\' AND retry_count >= 3;');
+    }
+    
+    const anyPending = adminCount.count > 0;
+    if (anyPending && processorCount.count === 0) {
+      logger.info('\n❗ All pending emails have exceeded retry limit');
+      logger.info('   The email processor will not attempt to send them.');
+    } else if (anyPending && processorCount.count > 0) {
+      logger.info('\n✅ Email processor should process the pending emails on next run');
+      logger.info('   Make sure the email processor service is running.');
+    }
+    
+    logger.info('\n=== Debug report complete ===');
+    
+  } catch (error) {
+    logger.error('Error running debug report:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the debug
+debugEmailQueue();
@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose thumbnail serving issues
+ * Usage: node scripts/diagnose-thumbnails.js <eventId>
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function diagnoseThumbnails(eventId) {
+  if (!eventId) {
+    console.error('Usage: node scripts/diagnose-thumbnails.js <eventId>');
+    process.exit(1);
+  }
+  
+  console.log(`Diagnosing thumbnails for event ID: ${eventId}`);
+  console.log(`Storage path: ${STORAGE_PATH}`);
+  console.log(`Thumbnails directory: ${THUMBNAILS_DIR}\n`);
+  
+  try {
+    // Get event info
+    const event = await db('events').where('id', eventId).first();
+    if (!event) {
+      console.error(`Event not found with ID: ${eventId}`);
+      return;
+    }
+    
+    console.log(`Event: ${event.event_name} (${event.slug})`);
+    console.log(`Active: ${event.is_active}, Archived: ${event.is_archived}\n`);
+    
+    // Get photos for this event
+    const photos = await db('photos')
+      .where('event_id', eventId)
+      .select('id', 'filename', 'path', 'thumbnail_path');
+    
+    console.log(`Found ${photos.length} photos in database\n`);
+    
+    let missingThumbnails = 0;
+    let existingThumbnails = 0;
+    let pathIssues = [];
+    
+    for (const photo of photos.slice(0, 10)) { // Check first 10 photos
+      console.log(`Photo ID ${photo.id}: ${photo.filename}`);
+      console.log(`  Photo path: ${photo.path}`);
+      console.log(`  Thumbnail path in DB: ${photo.thumbnail_path}`);
+      
+      if (photo.thumbnail_path) {
+        // Expected thumbnail filename
+        const expectedThumbName = `thumb_${photo.filename}`;
+        const expectedThumbPath = path.join(THUMBNAILS_DIR, expectedThumbName);
+        
+        // Check if thumbnail exists
+        try {
+          await fs.access(expectedThumbPath);
+          console.log(`  ✓ Thumbnail exists at: ${expectedThumbName}`);
+          existingThumbnails++;
+          
+          // Check if DB path matches expected path
+          const dbThumbName = path.basename(photo.thumbnail_path);
+          if (dbThumbName !== expectedThumbName) {
+            console.log(`  ⚠ Path mismatch! DB has: ${dbThumbName}, Expected: ${expectedThumbName}`);
+            pathIssues.push({
+              photoId: photo.id,
+              dbPath: photo.thumbnail_path,
+              expectedPath: `thumbnails/${expectedThumbName}`
+            });
+          }
+        } catch {
+          console.log(`  ✗ Thumbnail missing: ${expectedThumbName}`);
+          missingThumbnails++;
+        }
+      } else {
+        console.log(`  ✗ No thumbnail path in database`);
+        missingThumbnails++;
+      }
+      console.log('');
+    }
+    
+    console.log('--- Summary ---');
+    console.log(`Existing thumbnails: ${existingThumbnails}`);
+    console.log(`Missing thumbnails: ${missingThumbnails}`);
+    console.log(`Path issues: ${pathIssues.length}`);
+    
+    if (pathIssues.length > 0) {
+      console.log('\n--- Path Issues ---');
+      console.log('The following photos have incorrect thumbnail paths in the database:');
+      for (const issue of pathIssues) {
+        console.log(`Photo ID ${issue.photoId}:`);
+        console.log(`  Current: ${issue.dbPath}`);
+        console.log(`  Should be: ${issue.expectedPath}`);
+      }
+      
+      console.log('\nTo fix path issues, run:');
+      console.log(`UPDATE photos SET thumbnail_path = 'thumbnails/thumb_' || filename WHERE event_id = ${eventId};`);
+    }
+    
+    // Check for any thumbnails in the directory that match this event
+    const files = await fs.readdir(THUMBNAILS_DIR);
+    const eventThumbnails = files.filter(f => {
+      // Try to match thumbnails for this event
+      for (const photo of photos) {
+        if (f === `thumb_${photo.filename}`) return true;
+      }
+      return false;
+    });
+    
+    console.log(`\n--- Filesystem Check ---`);
+    console.log(`Found ${eventThumbnails.length} thumbnails in directory for this event`);
+    
+  } catch (error) {
+    console.error('Error during diagnosis:', error);
+    process.exit(1);
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the diagnosis
+diagnoseThumbnails(eventId).then(async () => {
+  await db.destroy();
+  console.log('\nDiagnosis complete');
+}).catch(async error => {
+  console.error('Diagnosis failed:', error);
+  await db.destroy();
+  process.exit(1);
+});
@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+/**
+ * Script to diagnose and fix email_queue schema issues
+ * This helps resolve the "column updated_at does not exist" error
+ */
+
+require('dotenv').config();
+const { db } = require('../src/database/db');
+
+async function checkAndFixEmailQueueSchema() {
+  console.log('Checking email_queue table schema...');
+  
+  try {
+    // Get column information
+    const columns = await db('email_queue').columnInfo();
+    console.log('\nCurrent email_queue columns:', Object.keys(columns));
+    
+    // Check for updated_at column
+    if (columns.updated_at) {
+      console.log('\n⚠️  Found unexpected updated_at column in email_queue table!');
+      console.log('This column should not exist and is causing errors.');
+      
+      // Ask for confirmation before removing
+      console.log('\nRemoving updated_at column...');
+      await db.schema.table('email_queue', (table) => {
+        table.dropColumn('updated_at');
+      });
+      console.log('✅ Removed updated_at column from email_queue table');
+    } else {
+      console.log('✅ No updated_at column found (this is correct)');
+    }
+    
+    // Verify required columns exist
+    const requiredColumns = [
+      'id', 'event_id', 'recipient_email', 'email_type', 
+      'email_data', 'status', 'scheduled_at', 'sent_at', 
+      'error_message', 'retry_count', 'created_at'
+    ];
+    
+    const missingColumns = requiredColumns.filter(col => !columns[col]);
+    if (missingColumns.length > 0) {
+      console.log('\n⚠️  Missing required columns:', missingColumns);
+    } else {
+      console.log('✅ All required columns are present');
+    }
+    
+    // Check for any database triggers
+    if (process.env.DATABASE_CLIENT === 'pg') {
+      console.log('\nChecking for PostgreSQL triggers on email_queue...');
+      const triggers = await db.raw(`
+        SELECT trigger_name, event_manipulation, action_statement
+        FROM information_schema.triggers
+        WHERE event_object_table = 'email_queue'
+        AND trigger_schema = current_schema()
+      `);
+      
+      if (triggers.rows && triggers.rows.length > 0) {
+        console.log('⚠️  Found triggers on email_queue table:');
+        triggers.rows.forEach(trigger => {
+          console.log(`  - ${trigger.trigger_name} (${trigger.event_manipulation})`);
+        });
+      } else {
+        console.log('✅ No triggers found on email_queue table');
+      }
+    }
+    
+    // Test update query
+    console.log('\nTesting update query...');
+    const testEmail = await db('email_queue')
+      .where('status', 'pending')
+      .first();
+    
+    if (testEmail) {
+      try {
+        await db('email_queue')
+          .where('id', testEmail.id)
+          .update({
+            retry_count: testEmail.retry_count
+          });
+        console.log('✅ Update query works correctly');
+      } catch (error) {
+        console.log('❌ Update query failed:', error.message);
+      }
+    } else {
+      console.log('ℹ️  No pending emails to test with');
+    }
+    
+    console.log('\nSchema check complete!');
+    
+  } catch (error) {
+    console.error('Error checking schema:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the check
+checkAndFixEmailQueueSchema();
@@ -0,0 +1,88 @@
+const { db } = require('../src/database/db');
+
+async function fixFinalGermanTemplates() {
+  try {
+    console.log('Fixing remaining English words in German templates...\n');
+    
+    // Get all templates
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      let updated = false;
+      let updates = {};
+      
+      // Fix subject_de
+      if (template.subject_de) {
+        updates.subject_de = template.subject_de;
+      }
+      
+      // Fix body_html_de
+      if (template.body_html_de) {
+        let html = template.body_html_de;
+        
+        // Replace English words with German
+        html = html.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        html = html.replace(/Details:/g, 'Details:');
+        html = html.replace(/Link:/g, 'Link:');
+        html = html.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        html = html.replace(/Archive-Details:/g, 'Archiv-Details:');
+        html = html.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (html !== template.body_html_de) {
+          updates.body_html_de = html;
+          updated = true;
+        }
+      }
+      
+      // Fix body_text_de
+      if (template.body_text_de) {
+        let text = template.body_text_de;
+        
+        text = text.replace(/Gallery-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Galerie-Details:/g, 'Galerie-Details:');
+        text = text.replace(/Details:/g, 'Details:');
+        text = text.replace(/Link:/g, 'Link:');
+        text = text.replace(/Gallery-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Galerie-Link:/g, 'Galerie-Link:');
+        text = text.replace(/Archive-Details:/g, 'Archiv-Details:');
+        text = text.replace(/Archiv-Details:/g, 'Archiv-Details:');
+        
+        if (text !== template.body_text_de) {
+          updates.body_text_de = text;
+          updated = true;
+        }
+      }
+      
+      // Also update the non-language-specific fields to match German
+      if (template.body_html_de) {
+        updates.body_html = template.body_html_de;
+      }
+      if (template.body_text_de) {
+        updates.body_text = template.body_text_de;
+      }
+      if (template.subject_de) {
+        updates.subject = template.subject_de;
+      }
+      
+      if (updated || Object.keys(updates).length > 0) {
+        await db('email_templates')
+          .where('template_key', template.template_key)
+          .update(updates);
+        console.log(`✅ Updated ${template.template_key}`);
+      } else {
+        console.log(`⏭️  No changes needed for ${template.template_key}`);
+      }
+    }
+    
+    console.log('\nDone!');
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+fixFinalGermanTemplates();
@@ -0,0 +1,126 @@
+const { db } = require('../src/database/db');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function fixStuckEmails() {
+  try {
+    logger.info('=== Fix Stuck Emails Script ===\n');
+    
+    // 1. Find stuck emails
+    logger.info('1. Finding stuck emails (pending with retry_count >= 3)...');
+    const stuckEmails = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '>=', 3)
+      .select('*');
+    
+    if (stuckEmails.length === 0) {
+      logger.info('   ✅ No stuck emails found!');
+      logger.info('\n=== Script complete ===');
+      await db.destroy();
+      process.exit(0);
+    }
+    
+    logger.info(`   Found ${stuckEmails.length} stuck email(s)\n`);
+    
+    // 2. Show details
+    logger.info('2. Stuck email details:');
+    stuckEmails.forEach((email, index) => {
+      logger.info(`\n   Email ${index + 1}:`);
+      logger.info(`     ID: ${email.id}`);
+      logger.info(`     Type: ${email.email_type}`);
+      logger.info(`     Recipient: ${email.recipient_email}`);
+      logger.info(`     Retry Count: ${email.retry_count}`);
+      logger.info(`     Last Error: ${email.error_message || 'None'}`);
+    });
+    
+    // 3. Ask for action
+    logger.info('\n\n3. Choose an action:');
+    logger.info('   1. Reset retry count to 0 (emails will be retried)');
+    logger.info('   2. Mark as failed (emails will not be retried)');
+    logger.info('   3. Delete these emails');
+    logger.info('   4. Cancel (do nothing)');
+    
+    // Get command line argument
+    const action = process.argv[2];
+    
+    if (!action || !['reset', 'fail', 'delete'].includes(action)) {
+      logger.info('\n❗ No valid action specified');
+      logger.info('\nUsage:');
+      logger.info('  node fix-stuck-emails.js reset   - Reset retry count to 0');
+      logger.info('  node fix-stuck-emails.js fail    - Mark as failed');
+      logger.info('  node fix-stuck-emails.js delete  - Delete stuck emails');
+      await db.destroy();
+      process.exit(1);
+    }
+    
+    // 4. Execute action
+    logger.info(`\n4. Executing action: ${action.toUpperCase()}`);
+    
+    const emailIds = stuckEmails.map(e => e.id);
+    
+    switch (action) {
+      case 'reset':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            retry_count: 0,
+            error_message: null
+          });
+        logger.info(`   ✅ Reset retry count for ${emailIds.length} email(s)`);
+        logger.info('   These emails will be processed on the next run');
+        break;
+        
+      case 'fail':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .update({
+            status: 'failed'
+          });
+        logger.info(`   ✅ Marked ${emailIds.length} email(s) as failed`);
+        logger.info('   These emails will not be retried');
+        break;
+        
+      case 'delete':
+        await db('email_queue')
+          .whereIn('id', emailIds)
+          .delete();
+        logger.info(`   ✅ Deleted ${emailIds.length} email(s)`);
+        break;
+    }
+    
+    // 5. Show updated counts
+    logger.info('\n5. Updated email queue status:');
+    const [pendingCount] = await db('email_queue')
+      .where('status', 'pending')
+      .count('* as count');
+    const [processableCount] = await db('email_queue')
+      .where('status', 'pending')
+      .where('retry_count', '<', 3)
+      .count('* as count');
+    
+    logger.info(`   Total pending: ${pendingCount.count}`);
+    logger.info(`   Processable (retry < 3): ${processableCount.count}`);
+    
+    if (pendingCount.count !== processableCount.count) {
+      logger.info(`   ⚠️  Still have ${pendingCount.count - processableCount.count} stuck email(s)`);
+    } else {
+      logger.info('   ✅ No stuck emails remaining');
+    }
+    
+    logger.info('\n=== Script complete ===');
+    
+  } catch (error) {
+    logger.error('Error:', error);
+  } finally {
+    await db.destroy();
+    process.exit(0);
+  }
+}
+
+// Run the fix
+fixStuckEmails();
@@ -0,0 +1,171 @@
+require('dotenv').config({ path: '../.env' });
+const path = require('path');
+const fs = require('fs').promises;
+const { db } = require('../src/database/db');
+const { generatePhotoFilename } = require('../src/utils/filenameSanitizer');
+
+async function fixTempPhotos() {
+  console.log('Starting to fix temporary photo files...\n');
+  
+  try {
+    // Find all photos with temp_ filenames
+    const tempPhotos = await db('photos')
+      .where('filename', 'like', 'temp_%')
+      .orderBy('event_id', 'asc')
+      .orderBy('category_id', 'asc')
+      .orderBy('id', 'asc');
+    
+    console.log(`Found ${tempPhotos.length} photos with temporary filenames\n`);
+    
+    if (tempPhotos.length === 0) {
+      console.log('No temporary photos found. Exiting.');
+      return;
+    }
+    
+    // Group photos by event and category
+    const grouped = {};
+    for (const photo of tempPhotos) {
+      const key = `${photo.event_id}_${photo.category_id || 'null'}`;
+      if (!grouped[key]) {
+        grouped[key] = [];
+      }
+      grouped[key].push(photo);
+    }
+    
+    console.log(`Processing ${Object.keys(grouped).length} event/category groups...\n`);
+    
+    // Process each group
+    for (const [key, photos] of Object.entries(grouped)) {
+      const [eventId, categoryIdStr] = key.split('_');
+      const categoryId = categoryIdStr === 'null' ? null : parseInt(categoryIdStr);
+      
+      console.log(`\nProcessing Event ID: ${eventId}, Category ID: ${categoryId || 'uncategorized'}`);
+      console.log(`Photos in group: ${photos.length}`);
+      
+      // Get event details
+      const event = await db('events').where({ id: eventId }).first();
+      if (!event) {
+        console.error(`Event ${eventId} not found! Skipping...`);
+        continue;
+      }
+      
+      // Get category details if applicable
+      let category = null;
+      let startCounter = 1;
+      
+      if (categoryId) {
+        category = await db('photo_categories').where({ id: categoryId }).first();
+        if (!category) {
+          console.error(`Category ${categoryId} not found! Treating as uncategorized...`);
+        } else {
+          // Get the highest counter for this category
+          const maxPhoto = await db('photos')
+            .where({ event_id: eventId, category_id: categoryId })
+            .whereNot('filename', 'like', 'temp_%')
+            .orderBy('id', 'desc')
+            .first();
+          
+          if (maxPhoto && maxPhoto.filename) {
+            // Extract counter from filename
+            const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+            if (match) {
+              startCounter = parseInt(match[1]) + 1;
+            }
+          }
+        }
+      } else {
+        // For uncategorized, get the highest counter
+        const maxPhoto = await db('photos')
+          .where({ event_id: eventId })
+          .whereNull('category_id')
+          .whereNot('filename', 'like', 'temp_%')
+          .orderBy('id', 'desc')
+          .first();
+        
+        if (maxPhoto && maxPhoto.filename) {
+          const match = maxPhoto.filename.match(/_(\d+)\.[^.]+$/);
+          if (match) {
+            startCounter = parseInt(match[1]) + 1;
+          }
+        }
+      }
+      
+      console.log(`Starting counter: ${startCounter}`);
+      
+      // Process each photo in the group
+      let successCount = 0;
+      let errorCount = 0;
+      
+      for (let i = 0; i < photos.length; i++) {
+        const photo = photos[i];
+        const counter = startCounter + i;
+        
+        try {
+          // Generate new filename
+          const extension = path.extname(photo.filename);
+          const newFilename = generatePhotoFilename(
+            event.event_name,
+            category ? category.name : 'uncategorized',
+            counter,
+            extension
+          );
+          
+          // Build full paths
+          const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+          const oldPath = path.join(storagePath, 'events/active', photo.path);
+          const newPath = path.join(path.dirname(oldPath), newFilename);
+          
+          // Check if old file exists
+          try {
+            await fs.access(oldPath);
+          } catch (e) {
+            console.error(`File not found: ${oldPath}`);
+            errorCount++;
+            continue;
+          }
+          
+          // Rename the file
+          await fs.rename(oldPath, newPath);
+          
+          // Update database
+          const newRelativePath = path.relative(path.join(storagePath, 'events/active'), newPath);
+          await db('photos')
+            .where({ id: photo.id })
+            .update({
+              filename: newFilename,
+              path: newRelativePath
+            });
+          
+          console.log(`✓ Renamed: ${photo.filename} → ${newFilename}`);
+          successCount++;
+          
+        } catch (error) {
+          console.error(`✗ Failed to process photo ${photo.id}: ${error.message}`);
+          errorCount++;
+        }
+      }
+      
+      // Update category counter if needed
+      if (category && successCount > 0) {
+        const newCounter = startCounter + photos.length - 1;
+        await db('photo_categories')
+          .where({ id: categoryId })
+          .update({ photo_counter: newCounter });
+        console.log(`Updated category counter to ${newCounter}`);
+      }
+      
+      console.log(`\nGroup summary: ${successCount} successful, ${errorCount} errors`);
+    }
+    
+    console.log('\n=== COMPLETE ===');
+    console.log('All temporary photos have been processed.');
+    
+  } catch (error) {
+    console.error('Fatal error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Run the script
+fixTempPhotos().catch(console.error);
@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+
+/**
+ * Script to regenerate missing thumbnails for photos in the database
+ * Usage: node scripts/regenerate-thumbnails.js [eventId]
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const sharp = require('sharp');
+const { db } = require('../src/database/db');
+
+// Configuration
+const THUMBNAIL_SIZE = 300;
+const STORAGE_PATH = process.env.STORAGE_PATH || path.join(__dirname, '../../storage');
+const THUMBNAILS_DIR = path.join(STORAGE_PATH, 'thumbnails');
+
+async function ensureDirectoryExists(dirPath) {
+  try {
+    await fs.access(dirPath);
+  } catch {
+    await fs.mkdir(dirPath, { recursive: true });
+    console.log(`Created directory: ${dirPath}`);
+  }
+}
+
+async function generateThumbnail(photoPath, thumbnailPath) {
+  try {
+    await sharp(photoPath)
+      .resize(THUMBNAIL_SIZE, THUMBNAIL_SIZE, {
+        fit: 'cover',
+        position: 'center'
+      })
+      .jpeg({ quality: 80 })
+      .toFile(thumbnailPath);
+    
+    return true;
+  } catch (error) {
+    console.error(`Failed to generate thumbnail for ${photoPath}:`, error.message);
+    return false;
+  }
+}
+
+async function regenerateThumbnails(eventId = null) {
+  try {
+    console.log('Starting thumbnail regeneration...');
+    console.log(`Storage path: ${STORAGE_PATH}`);
+    console.log(`Thumbnails directory: ${THUMBNAILS_DIR}`);
+    
+    // Ensure thumbnails directory exists
+    await ensureDirectoryExists(THUMBNAILS_DIR);
+    
+    // Build query
+    let query = db('photos')
+      .join('events', 'photos.event_id', 'events.id')
+      .select(
+        'photos.id',
+        'photos.filename',
+        'photos.path',
+        'photos.thumbnail_path',
+        'events.slug as event_slug'
+      );
+    
+    if (eventId) {
+      query = query.where('photos.event_id', eventId);
+      console.log(`Filtering for event ID: ${eventId}`);
+    }
+    
+    const photos = await query;
+    console.log(`Found ${photos.length} photos to process`);
+    
+    let successCount = 0;
+    let skipCount = 0;
+    let errorCount = 0;
+    
+    for (const photo of photos) {
+      const photoPath = path.join(STORAGE_PATH, 'events/active', photo.path);
+      const thumbnailFilename = `thumb_${photo.filename}`;
+      const thumbnailPath = path.join(THUMBNAILS_DIR, thumbnailFilename);
+      
+      try {
+        // Check if photo file exists
+        await fs.access(photoPath);
+        
+        // Check if thumbnail already exists
+        try {
+          await fs.access(thumbnailPath);
+          console.log(`Thumbnail already exists for ${photo.filename}, skipping...`);
+          skipCount++;
+          continue;
+        } catch {
+          // Thumbnail doesn't exist, generate it
+        }
+        
+        console.log(`Generating thumbnail for ${photo.filename}...`);
+        const success = await generateThumbnail(photoPath, thumbnailPath);
+        
+        if (success) {
+          // Update database with thumbnail path
+          await db('photos')
+            .where('id', photo.id)
+            .update({
+              thumbnail_path: `thumbnails/${thumbnailFilename}`
+            });
+          
+          successCount++;
+          console.log(`✓ Generated thumbnail for ${photo.filename}`);
+        } else {
+          errorCount++;
+        }
+      } catch (error) {
+        console.error(`✗ Photo file not found: ${photoPath}`);
+        errorCount++;
+      }
+    }
+    
+    console.log('\nThumbnail regeneration complete!');
+    console.log(`- Successfully generated: ${successCount}`);
+    console.log(`- Skipped (already exist): ${skipCount}`);
+    console.log(`- Errors: ${errorCount}`);
+    console.log(`- Total processed: ${photos.length}`);
+    
+  } catch (error) {
+    console.error('Error during thumbnail regeneration:', error);
+    process.exit(1);
+  } finally {
+    await db.destroy();
+  }
+}
+
+// Parse command line arguments
+const eventId = process.argv[2] ? parseInt(process.argv[2]) : null;
+
+// Run the script
+regenerateThumbnails(eventId).then(() => {
+  console.log('Script completed successfully');
+  process.exit(0);
+}).catch(error => {
+  console.error('Script failed:', error);
+  process.exit(1);
+});
@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+const { db } = require('../src/database/db');
+const { 
+  initializeTransporter, 
+  processEmailQueue, 
+  testEmailConnection 
+} = require('../src/services/emailProcessor');
+const winston = require('winston');
+
+// Create a simple console logger
+const logger = winston.createLogger({
+  format: winston.format.simple(),
+  transports: [new winston.transports.Console()]
+});
+
+async function runEmailProcessor(runOnce = false) {
+  try {
+    logger.info('=== Starting Email Processor ===\n');
+    
+    // Initialize transporter
+    logger.info('Initializing email transporter...');
+    await initializeTransporter();
+    
+    // Test connection
+    logger.info('Testing email connection...');
+    const connectionOk = await testEmailConnection();
+    
+    if (!connectionOk) {
+      logger.error('Email connection test failed! Check your SMTP configuration.');
+      logger.info('\nRequired environment variables:');
+      logger.info('- SMTP_HOST');
+      logger.info('- SMTP_PORT');
+      logger.info('- SMTP_USER');
+      logger.info('- SMTP_PASS');
+      logger.info('- SMTP_FROM');
+      process.exit(1);
+    }
+    
+    logger.info('Email connection test successful!\n');
+    
+    if (runOnce) {
+      // Process queue once
+      logger.info('Processing email queue once...');
+      await processEmailQueue();
+      logger.info('Email processing complete');
+      
+      // Show final status
+      const pendingCount = await db('email_queue')
+        .where('status', 'pending')
+        .where('retry_count', '<', 3)
+        .count('* as count')
+        .first();
+      
+      logger.info(`\nEmails still pending: ${pendingCount.count}`);
+      
+      await db.destroy();
+      process.exit(0);
+    } else {
+      // Run continuously
+      logger.info('Starting continuous email processor...');
+      logger.info('Processing emails every 60 seconds. Press Ctrl+C to stop.\n');
+      
+      // Process immediately
+      await processEmailQueue();
+      
+      // Then every minute
+      setInterval(async () => {
+        try {
+          await processEmailQueue();
+        } catch (error) {
+          logger.error('Error processing email queue:', error);
+        }
+      }, 60000);
+    }
+    
+  } catch (error) {
+    logger.error('Fatal error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+// Handle graceful shutdown
+process.on('SIGINT', async () => {
+  logger.info('\n\nShutting down email processor...');
+  await db.destroy();
+  process.exit(0);
+});
+
+// Check command line arguments
+const args = process.argv.slice(2);
+const runOnce = args.includes('--once') || args.includes('-o');
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+Email Processor Runner
+
+Usage: node run-email-processor.js [options]
+
+Options:
+  --once, -o     Process the email queue once and exit
+  --help, -h     Show this help message
+
+By default, the processor runs continuously, checking for emails every 60 seconds.
+  `);
+  process.exit(0);
+}
+
+// Run the processor
+runEmailProcessor(runOnce);
@@ -0,0 +1,577 @@
+#!/usr/bin/env node
+
+/**
+ * Manual Integration Test Script for Enhanced Backup System
+ * 
+ * This script provides a comprehensive test of the backup system with real services.
+ * It can be used to test against MinIO, AWS S3, or other S3-compatible services.
+ * 
+ * Usage:
+ *   node scripts/test-backup-integration.js [options]
+ * 
+ * Options:
+ *   --endpoint <url>     S3 endpoint URL (default: http://localhost:9000)
+ *   --access-key <key>   S3 access key (default: minioadmin)
+ *   --secret-key <key>   S3 secret key (default: minioadmin)
+ *   --bucket <name>      S3 bucket name (default: test-backup-<timestamp>)
+ *   --type <type>        Backup type: s3, local, rsync (default: s3)
+ *   --cleanup            Clean up test data after completion
+ *   --verbose            Enable verbose logging
+ *   --help               Show this help message
+ * 
+ * Examples:
+ *   # Test with local MinIO
+ *   node scripts/test-backup-integration.js
+ * 
+ *   # Test with AWS S3
+ *   node scripts/test-backup-integration.js \
+ *     --endpoint https://s3.amazonaws.com \
+ *     --access-key AKIAIOSFODNN7EXAMPLE \
+ *     --secret-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
+ *     --bucket my-test-bucket
+ * 
+ *   # Test local backup
+ *   node scripts/test-backup-integration.js --type local
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const crypto = require('crypto');
+const { S3Client, CreateBucketCommand, HeadBucketCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand, DeleteBucketCommand } = require('@aws-sdk/client-s3');
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const options = {
+  endpoint: 'http://localhost:9000',
+  accessKey: 'minioadmin',
+  secretKey: 'minioadmin',
+  bucket: `test-backup-${Date.now()}`,
+  type: 's3',
+  cleanup: false,
+  verbose: false
+};
+
+for (let i = 0; i < args.length; i++) {
+  switch (args[i]) {
+    case '--endpoint':
+      options.endpoint = args[++i];
+      break;
+    case '--access-key':
+      options.accessKey = args[++i];
+      break;
+    case '--secret-key':
+      options.secretKey = args[++i];
+      break;
+    case '--bucket':
+      options.bucket = args[++i];
+      break;
+    case '--type':
+      options.type = args[++i];
+      break;
+    case '--cleanup':
+      options.cleanup = true;
+      break;
+    case '--verbose':
+      options.verbose = true;
+      break;
+    case '--help':
+      console.log(module.exports.description || 'Manual Integration Test Script');
+      process.exit(0);
+  }
+}
+
+// Load environment and services
+require('dotenv').config();
+const { db, initialize: initDb } = require('../src/database/db');
+const backupService = require('../src/services/backupService');
+const S3StorageAdapter = require('../src/services/storage/s3Storage');
+const logger = require('../src/utils/logger');
+
+// Configure logger based on verbose flag
+if (!options.verbose) {
+  logger.info = () => {};
+  logger.debug = () => {};
+}
+
+// Test results
+const results = {
+  passed: 0,
+  failed: 0,
+  skipped: 0,
+  tests: []
+};
+
+// Test utilities
+async function runTest(name, testFn) {
+  console.log(`\n📋 Running: ${name}`);
+  try {
+    const startTime = Date.now();
+    await testFn();
+    const duration = Date.now() - startTime;
+    console.log(`✅ PASSED: ${name} (${duration}ms)`);
+    results.passed++;
+    results.tests.push({ name, status: 'passed', duration });
+  } catch (error) {
+    console.error(`❌ FAILED: ${name}`);
+    console.error(`   Error: ${error.message}`);
+    if (options.verbose) {
+      console.error(error.stack);
+    }
+    results.failed++;
+    results.tests.push({ name, status: 'failed', error: error.message });
+  }
+}
+
+async function skipTest(name, reason) {
+  console.log(`\n⏭️  Skipping: ${name}`);
+  console.log(`   Reason: ${reason}`);
+  results.skipped++;
+  results.tests.push({ name, status: 'skipped', reason });
+}
+
+// Test functions
+async function testS3Connection() {
+  const s3Adapter = new S3StorageAdapter({
+    bucket: options.bucket,
+    endpoint: options.endpoint,
+    accessKeyId: options.accessKey,
+    secretAccessKey: options.secretKey,
+    region: 'us-east-1',
+    forcePathStyle: true,
+    sslEnabled: options.endpoint.startsWith('https')
+  });
+
+  await s3Adapter.testConnection();
+  console.log(`   ✓ Connected to S3 endpoint: ${options.endpoint}`);
+  console.log(`   ✓ Bucket accessible: ${options.bucket}`);
+}
+
+async function setupTestData() {
+  const storagePath = path.join(__dirname, '../test-storage');
+  process.env.STORAGE_PATH = storagePath;
+
+  // Create directory structure
+  const dirs = [
+    'events/active/wedding-2024',
+    'events/active/birthday-2024',
+    'events/archived',
+    'thumbnails',
+    'uploads',
+    'backups'
+  ];
+
+  for (const dir of dirs) {
+    await fs.mkdir(path.join(storagePath, dir), { recursive: true });
+  }
+
+  // Create test files with various sizes
+  const files = [
+    { path: 'events/active/wedding-2024/photo1.jpg', size: 1024 * 1024 }, // 1MB
+    { path: 'events/active/wedding-2024/photo2.jpg', size: 512 * 1024 },  // 512KB
+    { path: 'events/active/birthday-2024/photo1.jpg', size: 2 * 1024 * 1024 }, // 2MB
+    { path: 'events/archived/old-event.zip', size: 5 * 1024 * 1024 }, // 5MB
+    { path: 'thumbnails/thumb1.jpg', size: 50 * 1024 }, // 50KB
+    { path: 'uploads/logo.png', size: 100 * 1024 } // 100KB
+  ];
+
+  let totalSize = 0;
+  for (const file of files) {
+    const content = crypto.randomBytes(file.size);
+    await fs.writeFile(path.join(storagePath, file.path), content);
+    totalSize += file.size;
+  }
+
+  console.log(`   ✓ Created ${files.length} test files`);
+  console.log(`   ✓ Total size: ${(totalSize / 1024 / 1024).toFixed(2)} MB`);
+
+  return { storagePath, fileCount: files.length, totalSize };
+}
+
+async function configureBackup(type) {
+  const baseSettings = [
+    { setting_key: 'backup_enabled', setting_value: 'true' },
+    { setting_key: 'backup_destination_type', setting_value: `"${type}"` },
+    { setting_key: 'backup_include_archived', setting_value: 'true' },
+    { setting_key: 'backup_include_database', setting_value: 'true' },
+    { setting_key: 'backup_incremental', setting_value: 'true' },
+    { setting_key: 'backup_manifest_format', setting_value: '"json"' },
+    { setting_key: 'backup_max_file_size_mb', setting_value: '100' }
+  ];
+
+  const typeSpecificSettings = {
+    s3: [
+      { setting_key: 'backup_s3_bucket', setting_value: `"${options.bucket}"` },
+      { setting_key: 'backup_s3_endpoint', setting_value: `"${options.endpoint}"` },
+      { setting_key: 'backup_s3_access_key', setting_value: `"${options.accessKey}"` },
+      { setting_key: 'backup_s3_secret_key', setting_value: `"${options.secretKey}"` },
+      { setting_key: 'backup_s3_region', setting_value: '"us-east-1"' },
+      { setting_key: 'backup_s3_force_path_style', setting_value: 'true' },
+      { setting_key: 'backup_s3_ssl_enabled', setting_value: options.endpoint.startsWith('https') ? 'true' : 'false' }
+    ],
+    local: [
+      { setting_key: 'backup_destination_path', setting_value: `"${path.join(__dirname, '../test-backup')}"` }
+    ],
+    rsync: [
+      { setting_key: 'backup_rsync_host', setting_value: '"localhost"' },
+      { setting_key: 'backup_rsync_path', setting_value: `"${path.join(__dirname, '../test-backup-rsync')}"` }
+    ]
+  };
+
+  const settings = [...baseSettings, ...(typeSpecificSettings[type] || [])];
+
+  // Clear existing settings
+  await db('app_settings').where('setting_type', 'backup').del();
+
+  // Insert new settings
+  for (const setting of settings) {
+    await db('app_settings').insert({
+      setting_type: 'backup',
+      ...setting,
+      created_at: new Date(),
+      updated_at: new Date()
+    });
+  }
+
+  console.log(`   ✓ Configured ${type} backup with ${settings.length} settings`);
+}
+
+async function performBackup() {
+  const startTime = Date.now();
+  
+  // Run the backup
+  await backupService.runBackup();
+
+  // Get backup results
+  const backupRun = await db('backup_runs')
+    .orderBy('started_at', 'desc')
+    .first();
+
+  if (!backupRun) {
+    throw new Error('No backup run found');
+  }
+
+  if (backupRun.status !== 'completed') {
+    throw new Error(`Backup failed with status: ${backupRun.status}, error: ${backupRun.error_message}`);
+  }
+
+  const duration = Date.now() - startTime;
+
+  console.log(`   ✓ Backup completed in ${duration}ms`);
+  console.log(`   ✓ Files backed up: ${backupRun.files_backed_up}`);
+  console.log(`   ✓ Total size: ${(backupRun.total_size_bytes / 1024 / 1024).toFixed(2)} MB`);
+  console.log(`   ✓ Manifest: ${backupRun.manifest_path ? 'Generated' : 'Not generated'}`);
+
+  return backupRun;
+}
+
+async function verifyS3Backup(backupRun) {
+  const s3Client = new S3Client({
+    endpoint: options.endpoint,
+    region: 'us-east-1',
+    credentials: {
+      accessKeyId: options.accessKey,
+      secretAccessKey: options.secretKey
+    },
+    forcePathStyle: true
+  });
+
+  // List objects in bucket
+  const listResponse = await s3Client.send(new ListObjectsV2Command({
+    Bucket: options.bucket
+  }));
+
+  const objects = listResponse.Contents || [];
+  console.log(`   ✓ Objects in S3: ${objects.length}`);
+
+  // Verify key components
+  const hasBackupFolder = objects.some(obj => obj.Key.includes('backup-'));
+  const hasManifest = objects.some(obj => obj.Key.includes('backup-manifest'));
+  const hasSummary = objects.some(obj => obj.Key.includes('backup-summary.json'));
+  const hasPhotos = objects.some(obj => obj.Key.includes('events/active'));
+
+  if (!hasBackupFolder) throw new Error('No backup folder found in S3');
+  if (!hasManifest) throw new Error('No manifest found in S3');
+  if (!hasSummary) throw new Error('No summary found in S3');
+  if (!hasPhotos) throw new Error('No photos found in S3');
+
+  console.log(`   ✓ Backup structure verified`);
+
+  // Download and verify a file
+  const photoObject = objects.find(obj => obj.Key.includes('photo1.jpg'));
+  if (photoObject) {
+    const getResponse = await s3Client.send(new GetObjectCommand({
+      Bucket: options.bucket,
+      Key: photoObject.Key
+    }));
+
+    const chunks = [];
+    for await (const chunk of getResponse.Body) {
+      chunks.push(chunk);
+    }
+    const content = Buffer.concat(chunks);
+
+    console.log(`   ✓ Downloaded test file: ${photoObject.Key} (${content.length} bytes)`);
+  }
+}
+
+async function testIncrementalBackup(testData) {
+  // Modify a file
+  const modifiedFile = path.join(testData.storagePath, 'events/active/wedding-2024/photo1.jpg');
+  const newContent = crypto.randomBytes(1024 * 1024 + 100); // Slightly larger
+  await fs.writeFile(modifiedFile, newContent);
+
+  console.log(`   ✓ Modified test file`);
+
+  // Perform incremental backup
+  const backupRun = await performBackup();
+
+  if (backupRun.files_backed_up !== 1) {
+    throw new Error(`Expected 1 file in incremental backup, got ${backupRun.files_backed_up}`);
+  }
+
+  console.log(`   ✓ Incremental backup correctly identified changed file`);
+
+  // Verify manifest indicates incremental
+  if (backupRun.manifest_path) {
+    const { manifest } = await backupService.getBackupManifest(backupRun.id);
+    if (!manifest.incremental) {
+      throw new Error('Manifest does not indicate incremental backup');
+    }
+    console.log(`   ✓ Manifest correctly marked as incremental`);
+  }
+
+  return backupRun;
+}
+
+async function testManifestValidation(backupRun) {
+  if (!backupRun.manifest_path) {
+    throw new Error('No manifest path in backup run');
+  }
+
+  const result = await backupService.validateBackupManifest(backupRun.manifest_path);
+
+  if (!result.valid) {
+    throw new Error(`Manifest validation failed: ${result.error}`);
+  }
+
+  console.log(`   ✓ Manifest validation passed`);
+  console.log(`   ✓ Manifest version: ${result.manifest.manifest.version}`);
+  console.log(`   ✓ Files in manifest: ${result.manifest.files.count}`);
+}
+
+async function testBackupStatus() {
+  const status = await backupService.getBackupStatus(5);
+
+  console.log(`   ✓ Backup service running: ${status.isRunning}`);
+  console.log(`   ✓ Backup service healthy: ${status.isHealthy}`);
+  console.log(`   ✓ Recent runs: ${status.recentRuns.length}`);
+
+  if (status.lastRun) {
+    console.log(`   ✓ Last run status: ${status.lastRun.status}`);
+    console.log(`   ✓ Manifest valid: ${status.lastRun.manifestValid}`);
+  }
+}
+
+async function cleanupTestData() {
+  if (!options.cleanup) {
+    console.log('\n📌 Test data retained for inspection');
+    console.log(`   Storage: ${process.env.STORAGE_PATH}`);
+    if (options.type === 's3') {
+      console.log(`   S3 Bucket: ${options.bucket}`);
+    }
+    return;
+  }
+
+  console.log('\n🧹 Cleaning up test data...');
+
+  // Clean storage directory
+  if (process.env.STORAGE_PATH) {
+    await fs.rm(process.env.STORAGE_PATH, { recursive: true, force: true });
+    console.log('   ✓ Removed test storage directory');
+  }
+
+  // Clean S3 bucket if used
+  if (options.type === 's3') {
+    const s3Client = new S3Client({
+      endpoint: options.endpoint,
+      region: 'us-east-1',
+      credentials: {
+        accessKeyId: options.accessKey,
+        secretAccessKey: options.secretKey
+      },
+      forcePathStyle: true
+    });
+
+    try {
+      // List and delete all objects
+      const listResponse = await s3Client.send(new ListObjectsV2Command({
+        Bucket: options.bucket
+      }));
+
+      if (listResponse.Contents && listResponse.Contents.length > 0) {
+        await s3Client.send(new DeleteObjectsCommand({
+          Bucket: options.bucket,
+          Delete: {
+            Objects: listResponse.Contents.map(obj => ({ Key: obj.Key }))
+          }
+        }));
+        console.log(`   ✓ Deleted ${listResponse.Contents.length} objects from S3`);
+      }
+
+      // Delete bucket
+      await s3Client.send(new DeleteBucketCommand({
+        Bucket: options.bucket
+      }));
+      console.log(`   ✓ Deleted S3 bucket: ${options.bucket}`);
+    } catch (error) {
+      console.error(`   ⚠️  Failed to cleanup S3: ${error.message}`);
+    }
+  }
+
+  // Clean backup directories
+  const backupDirs = [
+    path.join(__dirname, '../test-backup'),
+    path.join(__dirname, '../test-backup-rsync')
+  ];
+
+  for (const dir of backupDirs) {
+    await fs.rm(dir, { recursive: true, force: true }).catch(() => {});
+  }
+  console.log('   ✓ Removed backup directories');
+}
+
+// Main test runner
+async function main() {
+  console.log('🚀 Enhanced Backup System Integration Test');
+  console.log('==========================================');
+  console.log(`Type: ${options.type}`);
+  console.log(`Endpoint: ${options.endpoint}`);
+  console.log(`Bucket: ${options.bucket}`);
+  console.log('');
+
+  let s3Client;
+  let testData;
+
+  try {
+    // Initialize database
+    console.log('📦 Initializing database...');
+    await initDb();
+    await db.migrate.latest();
+    console.log('   ✓ Database initialized');
+
+    // S3-specific setup
+    if (options.type === 's3') {
+      // Test S3 connection
+      await runTest('S3 Connection Test', testS3Connection);
+
+      // Create S3 bucket if needed
+      s3Client = new S3Client({
+        endpoint: options.endpoint,
+        region: 'us-east-1',
+        credentials: {
+          accessKeyId: options.accessKey,
+          secretAccessKey: options.secretKey
+        },
+        forcePathStyle: true
+      });
+
+      try {
+        await s3Client.send(new HeadBucketCommand({ Bucket: options.bucket }));
+        console.log(`\n📦 Using existing bucket: ${options.bucket}`);
+      } catch (error) {
+        if (error.name === 'NotFound') {
+          await s3Client.send(new CreateBucketCommand({ Bucket: options.bucket }));
+          console.log(`\n📦 Created new bucket: ${options.bucket}`);
+        } else {
+          throw error;
+        }
+      }
+    }
+
+    // Setup test data
+    console.log('\n📁 Setting up test data...');
+    testData = await setupTestData();
+
+    // Configure backup
+    console.log(`\n⚙️  Configuring ${options.type} backup...`);
+    await configureBackup(options.type);
+
+    // Run tests based on backup type
+    await runTest('Initial Full Backup', performBackup);
+
+    if (options.type === 's3') {
+      await runTest('Verify S3 Backup Contents', async () => {
+        const lastRun = await db('backup_runs').orderBy('started_at', 'desc').first();
+        await verifyS3Backup(lastRun);
+      });
+    }
+
+    await runTest('Incremental Backup', () => testIncrementalBackup(testData));
+
+    await runTest('Manifest Validation', async () => {
+      const lastRun = await db('backup_runs').orderBy('started_at', 'desc').first();
+      await testManifestValidation(lastRun);
+    });
+
+    await runTest('Backup Status Check', testBackupStatus);
+
+    // Performance test with larger files
+    if (options.type === 's3') {
+      await runTest('Large File Backup (10MB)', async () => {
+        const largeFile = path.join(testData.storagePath, 'events/active/large.jpg');
+        await fs.writeFile(largeFile, crypto.randomBytes(10 * 1024 * 1024));
+        await performBackup();
+      });
+    }
+
+    // Test backup service lifecycle
+    await runTest('Backup Service Start/Stop', async () => {
+      await backupService.startBackupService();
+      console.log('   ✓ Service started');
+      
+      backupService.stopBackupService();
+      console.log('   ✓ Service stopped');
+    });
+
+    // Print results summary
+    console.log('\n📊 Test Results Summary');
+    console.log('======================');
+    console.log(`✅ Passed: ${results.passed}`);
+    console.log(`❌ Failed: ${results.failed}`);
+    console.log(`⏭️  Skipped: ${results.skipped}`);
+    console.log(`📋 Total: ${results.tests.length}`);
+
+    if (results.failed > 0) {
+      console.log('\nFailed Tests:');
+      results.tests
+        .filter(t => t.status === 'failed')
+        .forEach(t => console.log(`  - ${t.name}: ${t.error}`));
+    }
+
+  } catch (error) {
+    console.error('\n💥 Fatal error:', error.message);
+    if (options.verbose) {
+      console.error(error.stack);
+    }
+    results.failed++;
+  } finally {
+    // Cleanup
+    await cleanupTestData();
+
+    // Close database
+    await db.destroy();
+
+    // Exit with appropriate code
+    process.exit(results.failed > 0 ? 1 : 0);
+  }
+}
+
+// Run if called directly
+if (require.main === module) {
+  main().catch(error => {
+    console.error('Unhandled error:', error);
+    process.exit(1);
+  });
+}
+
+module.exports = { runTest, skipTest };
@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+
+/**
+ * Test script for backup manifest generator
+ * Demonstrates all features of the manifest generator
+ */
+
+const path = require('path');
+const fs = require('fs').promises;
+const backupManifest = require('../src/services/backupManifest');
+const logger = require('../src/utils/logger');
+
+async function testManifestGeneration() {
+  console.log('=== Testing Backup Manifest Generator ===\n');
+
+  try {
+    // 1. Generate a full backup manifest
+    console.log('1. Generating full backup manifest...');
+    
+    const fullManifestOptions = {
+      backupType: 'full',
+      backupPath: '/backup/full/2025-01-21',
+      files: [
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_001.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_001.jpg',
+          size: 2456789,
+          modified: new Date('2025-01-20T10:30:00Z'),
+          checksum: 'a1b2c3d4e5f6789012345678901234567890123456789012345678901234567890',
+          permissions: '644'
+        },
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_002.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_002.jpg',
+          size: 2156789,
+          modified: new Date('2025-01-20T10:31:00Z'),
+          checksum: 'b2c3d4e5f67890123456789012345678901234567890123456789012345678901',
+          permissions: '644'
+        },
+        {
+          path: '/storage/thumbnails/wedding-smith-2025/thumb_DSC_001.jpg',
+          relativePath: 'thumbnails/wedding-smith-2025/thumb_DSC_001.jpg',
+          size: 45678,
+          modified: new Date('2025-01-20T10:35:00Z'),
+          checksum: 'c3d4e5f678901234567890123456789012345678901234567890123456789012',
+          permissions: '644'
+        }
+      ],
+      databaseInfo: {
+        type: 'sqlite',
+        backupFile: 'database-backup-20250121-103000.sql.gz',
+        size: 1048576,
+        checksum: 'd4e5f6789012345678901234567890123456789012345678901234567890123',
+        tables: {
+          events: 156,
+          photos: 4523,
+          access_logs: 12456,
+          admin_users: 3
+        },
+        rowCounts: {
+          events: 156,
+          photos: 4523,
+          access_logs: 12456,
+          admin_users: 3
+        }
+      },
+      format: 'json',
+      customMetadata: {
+        operator: 'admin@example.com',
+        reason: 'Scheduled daily backup',
+        retentionDays: 30,
+        compressionType: 'gzip'
+      }
+    };
+
+    const fullManifest = await backupManifest.generateManifest(fullManifestOptions);
+    
+    // Save in both formats
+    const jsonPath = path.join(__dirname, 'test-manifest-full.json');
+    const yamlPath = path.join(__dirname, 'test-manifest-full.yaml');
+    
+    await backupManifest.saveManifest(fullManifest, jsonPath, 'json');
+    await backupManifest.saveManifest(fullManifest, yamlPath, 'yaml');
+    
+    console.log('✓ Full backup manifest generated and saved\n');
+
+    // 2. Generate summary report
+    console.log('2. Generating summary report...');
+    const summaryReport = backupManifest.generateSummaryReport(fullManifest);
+    console.log(summaryReport);
+    console.log('\n');
+
+    // 3. Load and validate manifest
+    console.log('3. Loading and validating manifest...');
+    const loadedManifest = await backupManifest.loadManifest(jsonPath);
+    console.log('✓ Manifest loaded and validated successfully\n');
+
+    // 4. Generate incremental backup manifest
+    console.log('4. Generating incremental backup manifest...');
+    
+    const incrementalOptions = {
+      backupType: 'incremental',
+      backupPath: '/backup/incremental/2025-01-22',
+      parentBackupId: fullManifest.backup.id,
+      files: [
+        // Original files with same checksums (unchanged)
+        fullManifestOptions.files[0],
+        fullManifestOptions.files[2],
+        // Modified file
+        {
+          ...fullManifestOptions.files[1],
+          size: 2256789,
+          modified: new Date('2025-01-21T14:00:00Z'),
+          checksum: 'e5f678901234567890123456789012345678901234567890123456789012345'
+        },
+        // New file
+        {
+          path: '/storage/events/active/wedding-smith-2025/DSC_003.jpg',
+          relativePath: 'events/active/wedding-smith-2025/DSC_003.jpg',
+          size: 2356789,
+          modified: new Date('2025-01-21T14:30:00Z'),
+          checksum: 'f6789012345678901234567890123456789012345678901234567890123456',
+          permissions: '644'
+        }
+      ],
+      databaseInfo: {
+        ...fullManifestOptions.databaseInfo,
+        size: 1148576,
+        checksum: 'g7890123456789012345678901234567890123456789012345678901234567',
+        rowCounts: {
+          events: 158,
+          photos: 4567,
+          access_logs: 12789,
+          admin_users: 3
+        }
+      }
+    };
+
+    const incrementalManifest = await backupManifest.generateIncrementalManifest(
+      incrementalOptions, 
+      fullManifest
+    );
+    
+    const incrementalJsonPath = path.join(__dirname, 'test-manifest-incremental.json');
+    await backupManifest.saveManifest(incrementalManifest, incrementalJsonPath, 'json');
+    
+    console.log('✓ Incremental backup manifest generated');
+    console.log(`  - Added files: ${incrementalManifest.incremental.changes.added_files_count}`);
+    console.log(`  - Modified files: ${incrementalManifest.incremental.changes.modified_files_count}`);
+    console.log(`  - Deleted files: ${incrementalManifest.incremental.changes.deleted_files_count}`);
+    console.log(`  - Size difference: ${(incrementalManifest.incremental.changes.size_difference / 1024).toFixed(2)} KB\n`);
+
+    // 5. Compare manifests
+    console.log('5. Comparing manifests...');
+    const comparison = backupManifest.compareManifests(incrementalManifest, fullManifest);
+    console.log('Comparison results:');
+    console.log(`  - Added: ${comparison.added_files.length} files`);
+    console.log(`  - Modified: ${comparison.modified_files.length} files`);
+    console.log(`  - Deleted: ${comparison.deleted_files.length} files`);
+    console.log(`  - Unchanged: ${comparison.unchanged_files.length} files`);
+    console.log(`  - Database changed: ${comparison.database_changes.checksum_changed ? 'Yes' : 'No'}\n`);
+
+    // 6. Test manifest integrity
+    console.log('6. Testing manifest integrity...');
+    
+    // Corrupt the manifest
+    const corruptedManifest = JSON.parse(JSON.stringify(incrementalManifest));
+    corruptedManifest.files.manifest[0].size = 9999999; // Change a file size
+    
+    try {
+      backupManifest.validateManifest(corruptedManifest);
+      console.log('✗ Validation should have failed for corrupted manifest');
+    } catch (error) {
+      console.log('✓ Correctly detected corrupted manifest:', error.message);
+    }
+
+    console.log('\n=== All tests completed successfully! ===');
+    
+    // Clean up test files
+    await fs.unlink(jsonPath).catch(() => {});
+    await fs.unlink(yamlPath).catch(() => {});
+    await fs.unlink(incrementalJsonPath).catch(() => {});
+
+  } catch (error) {
+    console.error('Test failed:', error);
+    logger.error('Manifest test failed:', error);
+    process.exit(1);
+  }
+}
+
+// Run tests
+testManifestGeneration().catch(console.error);
@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+require('dotenv').config();
+const { initializeDatabase } = require('../src/database/db');
+const { runBackup, getBackupStatus } = require('../src/services/backupService');
+const logger = require('../src/utils/logger');
+
+async function testBackupService() {
+  try {
+    console.log('Testing backup service...\n');
+    
+    // Initialize database
+    await initializeDatabase();
+    
+    // Get current backup status
+    console.log('Getting backup status...');
+    const statusBefore = await getBackupStatus();
+    console.log('Last run:', statusBefore.lastRun ? statusBefore.lastRun.started_at : 'Never');
+    console.log('Is healthy:', statusBefore.isHealthy);
+    console.log('');
+    
+    // Run backup
+    console.log('Running backup...');
+    await runBackup();
+    
+    // Get status after backup
+    console.log('\nGetting status after backup...');
+    const statusAfter = await getBackupStatus();
+    console.log('Last run:', statusAfter.lastRun ? statusAfter.lastRun.started_at : 'Never');
+    console.log('Status:', statusAfter.lastRun ? statusAfter.lastRun.status : 'Unknown');
+    console.log('Files backed up:', statusAfter.lastRun ? statusAfter.lastRun.files_backed_up : 0);
+    console.log('Total size:', statusAfter.lastRun ? `${(statusAfter.lastRun.total_size_bytes / 1024 / 1024).toFixed(2)} MB` : '0 MB');
+    
+    if (statusAfter.lastRun && statusAfter.lastRun.error_message) {
+      console.log('Error:', statusAfter.lastRun.error_message);
+    }
+    
+    console.log('\nBackup test completed!');
+    process.exit(0);
+  } catch (error) {
+    console.error('Test failed:', error);
+    process.exit(1);
+  }
+}
+
+testBackupService();
@@ -0,0 +1,52 @@
+/**
+ * Test script to verify CMS and email formatting improvements
+ */
+
+const { formatWelcomeMessage, nl2br } = require('../src/utils/formatters');
+
+console.log('Testing CMS and Email Formatting Improvements\n');
+
+// Test 1: Basic line break conversion
+console.log('Test 1: Basic line break conversion');
+const basicText = `Hello,
+This is line 1.
+This is line 2.
+
+This is line 4 with an extra break.`;
+
+console.log('Input:');
+console.log(basicText);
+console.log('\nOutput (nl2br):');
+console.log(nl2br(basicText));
+console.log('\n---\n');
+
+// Test 2: Welcome message formatting
+console.log('Test 2: Welcome message formatting');
+const welcomeMessage = `Dear guests,
+
+We're so excited to share these special moments with you!
+
+Please note:
+- Download your photos before the expiration date
+- The password is case-sensitive
+- Contact us if you have any issues
+
+Thank you for being part of our special day!
+
+Best regards,
+Sarah & John`;
+
+console.log('Input:');
+console.log(welcomeMessage);
+console.log('\nOutput (formatWelcomeMessage):');
+console.log(formatWelcomeMessage(welcomeMessage));
+console.log('\n---\n');
+
+// Test 3: Empty and edge cases
+console.log('Test 3: Edge cases');
+console.log('Empty string:', formatWelcomeMessage(''));
+console.log('Null:', formatWelcomeMessage(null));
+console.log('Only spaces:', formatWelcomeMessage('   \n   \n   '));
+console.log('Single line:', formatWelcomeMessage('This is a single line message'));
+
+console.log('\nAll tests completed!');
@@ -0,0 +1,85 @@
+const { db } = require('../src/database/db');
+const { processTemplate } = require('../src/services/emailProcessor');
+
+async function testGermanEmails() {
+  try {
+    console.log('=== Testing German Email Templates ===\n');
+    
+    // Test variables
+    const testVars = {
+      host_name: 'Max Mustermann',
+      event_name: 'Hochzeit Schmidt',
+      event_date: '15.07.2024',
+      gallery_link: 'https://example.com/gallery/test',
+      gallery_password: 'test1234',
+      expiry_date: '15.08.2024',
+      days_remaining: '7',
+      welcome_message: 'Herzlich willkommen zu unserer Hochzeitsgalerie!',
+      archive_size: '250 MB',
+      archive_date: '16.08.2024',
+      photo_count: '347',
+      admin_email: 'support@example.com',
+      eventId: 1
+    };
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n========== ${template.template_key.toUpperCase()} ==========`);
+      
+      // Process German version
+      const germanResult = await processGermanTemplate(template, testVars);
+      
+      console.log('\n--- GERMAN VERSION ---');
+      console.log('Subject:', germanResult.subject);
+      console.log('\nHTML Preview (first 500 chars):');
+      console.log(germanResult.htmlBody.substring(0, 500) + '...\n');
+      
+      // Check for any remaining English text
+      const englishWords = ['Dear', 'Gallery', 'Details:', 'Link:', 'Password:', 'days', 'Thank you'];
+      const foundEnglish = englishWords.filter(word => 
+        germanResult.htmlBody.includes(word) || germanResult.subject.includes(word)
+      );
+      
+      if (foundEnglish.length > 0) {
+        console.log('⚠️  WARNING: Found English words:', foundEnglish.join(', '));
+      } else {
+        console.log('✅ No English words found in German template');
+      }
+    }
+    
+    await db.destroy();
+  } catch (error) {
+    console.error('Error:', error);
+    await db.destroy();
+    process.exit(1);
+  }
+}
+
+async function processGermanTemplate(template, variables) {
+  // Process template as German
+  const subjectField = 'subject_de';
+  const htmlField = 'body_html_de';
+  const textField = 'body_text_de';
+  
+  let subject = template[subjectField] || template.subject || '';
+  let htmlBody = template[htmlField] || template.body_html || '';
+  let textBody = template[textField] || template.body_text || '';
+  
+  // Replace variables
+  Object.keys(variables).forEach(key => {
+    const regex = new RegExp(`{{${key}}}`, 'g');
+    subject = subject.replace(regex, variables[key]);
+    htmlBody = htmlBody.replace(regex, variables[key]);
+    textBody = textBody.replace(regex, variables[key]);
+  });
+  
+  // Handle conditionals (simplified)
+  htmlBody = htmlBody.replace(/{{#if welcome_message}}[\s\S]*?{{\/if}}/g, (match) => {
+    return variables.welcome_message ? match.replace(/{{#if welcome_message}}|{{\/if}}/g, '') : '';
+  });
+  
+  return { subject, htmlBody, textBody };
+}
+
+testGermanEmails();
@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+
+/**
+ * Script to test photo authentication
+ * Usage: node scripts/test-photo-auth.js <jwt-token>
+ */
+
+const axios = require('axios');
+
+async function testPhotoAuth(token) {
+  if (!token) {
+    console.error('Usage: node scripts/test-photo-auth.js <jwt-token>');
+    console.error('\nTo get a token, login to a gallery and check localStorage for gallery_token_<slug>');
+    process.exit(1);
+  }
+
+  const baseUrl = process.env.API_URL || 'http://localhost:3001';
+  
+  console.log(`Testing photo authentication with token: ${token.substring(0, 20)}...`);
+  console.log(`Base URL: ${baseUrl}\n`);
+
+  // Test URLs
+  const tests = [
+    {
+      name: 'Thumbnail via static route',
+      url: `${baseUrl}/thumbnails/thumb_Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Photo via static route',
+      url: `${baseUrl}/photos/wedding-test-gallery-2025-07-14-1/Test_Gallery_uncategorized_5210.jpg`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    },
+    {
+      name: 'Gallery photos API',
+      url: `${baseUrl}/api/gallery/wedding-test-gallery-2025-07-14-1/photos`,
+      headers: { 'Authorization': `Bearer ${token}` }
+    }
+  ];
+
+  for (const test of tests) {
+    console.log(`Testing: ${test.name}`);
+    console.log(`URL: ${test.url}`);
+    
+    try {
+      const response = await axios.get(test.url, {
+        headers: test.headers,
+        validateStatus: () => true // Don't throw on any status
+      });
+      
+      console.log(`Status: ${response.status}`);
+      console.log(`Headers:`, response.headers['content-type']);
+      
+      if (response.status === 200) {
+        if (test.name.includes('API')) {
+          console.log(`Photos count: ${response.data.photos?.length || 0}`);
+        } else {
+          console.log(`Content length: ${response.headers['content-length']} bytes`);
+        }
+      } else {
+        console.log(`Error:`, response.data);
+      }
+    } catch (error) {
+      console.log(`Network error:`, error.message);
+    }
+    
+    console.log('---\n');
+  }
+  
+  // Decode token to show info
+  try {
+    const parts = token.split('.');
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    console.log('Token payload:', payload);
+  } catch (error) {
+    console.log('Failed to decode token');
+  }
+}
+
+// Get token from command line
+const token = process.argv[2];
+
+testPhotoAuth(token).catch(error => {
+  console.error('Test failed:', error);
+  process.exit(1);
+});
@@ -0,0 +1,325 @@
+/**
+ * Test script for the restore service
+ * 
+ * This script demonstrates the restore service functionality with safety checks
+ * 
+ * Usage:
+ *   node scripts/test-restore-service.js [options]
+ * 
+ * Options:
+ *   --dry-run    Perform validation only without actual restore
+ *   --force      Force restore even with warnings
+ *   --type       Restore type: full, database, files, selective (default: full)
+ *   --source     Backup source path or S3 URL
+ *   --manifest   Path to backup manifest
+ */
+
+require('dotenv').config();
+const { restoreService } = require('../src/services/restoreService');
+const { db } = require('../src/database/db');
+const logger = require('../src/utils/logger');
+const path = require('path');
+const fs = require('fs').promises;
+
+// Parse command line arguments
+const args = process.argv.slice(2);
+const options = {
+  dryRun: args.includes('--dry-run'),
+  force: args.includes('--force'),
+  restoreType: 'full',
+  source: null,
+  manifestPath: null
+};
+
+// Parse restore type
+const typeIndex = args.indexOf('--type');
+if (typeIndex !== -1 && args[typeIndex + 1]) {
+  options.restoreType = args[typeIndex + 1];
+}
+
+// Parse source
+const sourceIndex = args.indexOf('--source');
+if (sourceIndex !== -1 && args[sourceIndex + 1]) {
+  options.source = args[sourceIndex + 1];
+}
+
+// Parse manifest
+const manifestIndex = args.indexOf('--manifest');
+if (manifestIndex !== -1 && args[manifestIndex + 1]) {
+  options.manifestPath = args[manifestIndex + 1];
+}
+
+async function testRestore() {
+  console.log('=== PicPeak Restore Service Test ===\n');
+  
+  try {
+    // If no source/manifest provided, try to find a recent backup
+    if (!options.source || !options.manifestPath) {
+      console.log('No backup source specified. Looking for recent backups...\n');
+      
+      const recentBackup = await db('backup_runs')
+        .where('status', 'completed')
+        .whereNotNull('manifest_path')
+        .orderBy('completed_at', 'desc')
+        .first();
+      
+      if (!recentBackup) {
+        console.error('❌ No completed backups found in the database');
+        console.log('\nPlease run a backup first or specify --source and --manifest');
+        process.exit(1);
+      }
+      
+      console.log(`Found recent backup from ${recentBackup.completed_at}`);
+      console.log(`Backup ID: ${recentBackup.manifest_id}`);
+      console.log(`Files backed up: ${recentBackup.files_backed_up}`);
+      console.log(`Total size: ${(recentBackup.total_size_bytes / 1024 / 1024).toFixed(2)} MB`);
+      console.log(`Manifest: ${recentBackup.manifest_path}\n`);
+      
+      // For this test, we'll create a mock scenario
+      console.log('⚠️  This is a TEST MODE - using mock data for safety\n');
+      
+      // Create test backup directory
+      const testBackupDir = path.join(__dirname, '../temp/test-backup');
+      await fs.mkdir(testBackupDir, { recursive: true });
+      
+      // Create test manifest
+      const testManifest = {
+        manifest: {
+          version: '2.0',
+          created: new Date().toISOString(),
+          generator: 'Test Script',
+          format: 'json'
+        },
+        backup: {
+          id: 'test-backup-' + Date.now(),
+          type: 'full',
+          timestamp: new Date().toISOString(),
+          path: testBackupDir,
+          parent_backup_id: null,
+          retention_days: 30
+        },
+        system: {
+          hostname: require('os').hostname(),
+          platform: process.platform,
+          os_release: require('os').release(),
+          architecture: require('os').arch()
+        },
+        application: {
+          name: 'PicPeak',
+          version: require('../package.json').version,
+          node_version: process.version,
+          environment: 'test'
+        },
+        files: {
+          count: 0,
+          total_size: 0,
+          checksums: {},
+          manifest: []
+        },
+        database: {
+          type: process.env.DB_TYPE === 'postgresql' ? 'postgresql' : 'sqlite',
+          backup_file: null,
+          size: 0,
+          checksum: null,
+          tables: {},
+          row_counts: {}
+        },
+        verification: {
+          total_checksum: null,
+          file_count_check: 0,
+          size_check: 0,
+          integrity_timestamp: new Date().toISOString()
+        },
+        metadata: {
+          test_mode: true
+        }
+      };
+      
+      // Calculate checksum
+      const crypto = require('crypto');
+      const manifestCopy = JSON.parse(JSON.stringify(testManifest));
+      delete manifestCopy.verification.total_checksum;
+      testManifest.verification.total_checksum = crypto
+        .createHash('sha256')
+        .update(JSON.stringify(manifestCopy, Object.keys(manifestCopy).sort()))
+        .digest('hex');
+      
+      // Save test manifest
+      const testManifestPath = path.join(testBackupDir, 'test-manifest.json');
+      await fs.writeFile(testManifestPath, JSON.stringify(testManifest, null, 2));
+      
+      options.source = testBackupDir;
+      options.manifestPath = testManifestPath;
+    }
+    
+    // Display restore options
+    console.log('Restore Options:');
+    console.log(`- Type: ${options.restoreType}`);
+    console.log(`- Source: ${options.source}`);
+    console.log(`- Manifest: ${options.manifestPath}`);
+    console.log(`- Dry Run: ${options.dryRun ? 'Yes' : 'No'}`);
+    console.log(`- Force: ${options.force ? 'Yes' : 'No'}`);
+    console.log('');
+    
+    // Add S3 config if source is S3
+    if (options.source.startsWith('s3://')) {
+      options.s3Config = {
+        accessKeyId: process.env.BACKUP_S3_ACCESS_KEY,
+        secretAccessKey: process.env.BACKUP_S3_SECRET_KEY,
+        region: process.env.BACKUP_S3_REGION || 'us-east-1',
+        endpoint: process.env.BACKUP_S3_ENDPOINT
+      };
+      
+      if (!options.s3Config.accessKeyId || !options.s3Config.secretAccessKey) {
+        console.error('❌ S3 credentials not configured in environment');
+        process.exit(1);
+      }
+    }
+    
+    // Confirm before proceeding (unless dry run)
+    if (!options.dryRun) {
+      console.log('⚠️  WARNING: This will restore data from the backup!');
+      console.log('⚠️  Current data may be overwritten!');
+      console.log('');
+      console.log('Press Ctrl+C to cancel, or wait 5 seconds to continue...');
+      await new Promise(resolve => setTimeout(resolve, 5000));
+    }
+    
+    console.log('\nStarting restore operation...\n');
+    
+    // Perform restore
+    const result = await restoreService.restore(options);
+    
+    if (options.dryRun) {
+      console.log('\n=== DRY RUN RESULTS ===\n');
+      
+      console.log('Validation:');
+      console.log(`- Valid: ${result.validation.isValid ? '✅ Yes' : '❌ No'}`);
+      
+      if (result.validation.errors.length > 0) {
+        console.log('- Errors:');
+        result.validation.errors.forEach(err => console.log(`  ❌ ${err}`));
+      }
+      
+      if (result.validation.warnings.length > 0) {
+        console.log('- Warnings:');
+        result.validation.warnings.forEach(warn => console.log(`  ⚠️  ${warn}`));
+      }
+      
+      console.log('\nDisk Space:');
+      console.log(`- Required: ${result.spaceCheck.requiredFormatted}`);
+      console.log(`- Available: ${result.spaceCheck.availableFormatted}`);
+      console.log(`- Sufficient: ${result.spaceCheck.hasEnoughSpace ? '✅ Yes' : '❌ No'}`);
+      
+    } else {
+      console.log('\n=== RESTORE RESULTS ===\n');
+      
+      console.log(`Status: ${result.success ? '✅ SUCCESS' : '❌ FAILED'}`);
+      console.log(`Duration: ${result.duration}s`);
+      
+      if (result.result) {
+        console.log('\nItems Restored:');
+        if (result.result.databaseRestored !== undefined) {
+          console.log(`- Database: ${result.result.databaseRestored ? '✅' : '❌'}`);
+        }
+        if (result.result.filesRestored !== undefined) {
+          console.log(`- Files: ${result.result.filesRestored}`);
+        }
+        if (result.result.errors && result.result.errors.length > 0) {
+          console.log('- Errors:');
+          result.result.errors.forEach(err => console.log(`  ❌ ${err}`));
+        }
+      }
+      
+      if (result.verification) {
+        console.log('\nVerification:');
+        console.log(`- Valid: ${result.verification.isValid ? '✅ Yes' : '❌ No'}`);
+        if (result.verification.errors.length > 0) {
+          console.log('- Errors:');
+          result.verification.errors.forEach(err => console.log(`  ❌ ${err}`));
+        }
+      }
+      
+      if (result.preRestoreBackup) {
+        console.log('\nSafety Backup:');
+        console.log(`- Location: ${result.preRestoreBackup}`);
+        console.log('- This backup can be used to rollback if needed');
+      }
+    }
+    
+    // Show recent log entries
+    console.log('\nRecent Log Entries:');
+    result.logs.slice(-10).forEach(log => {
+      const icon = log.level === 'error' ? '❌' : log.level === 'warn' ? '⚠️ ' : 'ℹ️ ';
+      console.log(`${icon} [${log.timestamp}] ${log.message}`);
+    });
+    
+    // Clean up test files
+    if (options.source && options.source.includes('test-backup')) {
+      await fs.rmdir(path.dirname(options.source), { recursive: true }).catch(() => {});
+    }
+    
+  } catch (error) {
+    console.error('\n❌ Restore operation failed:', error.message);
+    
+    // Show logs if available
+    if (restoreService.restoreLog && restoreService.restoreLog.length > 0) {
+      console.log('\nError Log:');
+      restoreService.restoreLog.slice(-10).forEach(log => {
+        if (log.level === 'error' || log.level === 'warn') {
+          console.log(`[${log.timestamp}] ${log.level.toUpperCase()}: ${log.message}`);
+        }
+      });
+    }
+    
+    process.exit(1);
+  }
+  
+  // Cleanup
+  await db.destroy();
+  process.exit(0);
+}
+
+// Show help if requested
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`
+PicPeak Restore Service Test
+
+This script tests the restore service functionality with safety checks.
+
+Usage:
+  node scripts/test-restore-service.js [options]
+
+Options:
+  --dry-run    Perform validation only without actual restore
+  --force      Force restore even with warnings
+  --type       Restore type: full, database, files, selective (default: full)
+  --source     Backup source path or S3 URL
+  --manifest   Path to backup manifest
+  --help       Show this help message
+
+Examples:
+  # Dry run with automatic backup selection
+  node scripts/test-restore-service.js --dry-run
+
+  # Full restore from specific backup
+  node scripts/test-restore-service.js --source /backup/2024-01-20 --manifest /backup/2024-01-20/manifest.json
+
+  # Database-only restore with force
+  node scripts/test-restore-service.js --type database --force --source /backup/2024-01-20 --manifest /backup/2024-01-20/manifest.json
+
+  # Restore from S3
+  node scripts/test-restore-service.js --source s3://my-bucket/backups/2024-01-20 --manifest s3://my-bucket/backups/2024-01-20/manifest.json
+
+Safety Features:
+- Pre-restore validation checks compatibility and warns about potential issues
+- Automatic pre-restore backup is created (unless skipped)
+- Post-restore verification ensures data integrity
+- Rollback capability if restore fails
+- Detailed logging of all operations
+`);
+  process.exit(0);
+}
+
+// Run the test
+testRestore();
@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+/**
+ * Test script to verify security logging is working correctly
+ * Run with: node scripts/test-security-logging.js
+ */
+
+require('dotenv').config({ path: '../.env' });
+const logger = require('../src/utils/logger');
+
+console.log('Testing Security Logging...\n');
+
+// Test 1: Basic logging
+console.log('1. Testing basic logging levels:');
+logger.info('Test info message', { test: true });
+logger.warn('Test warning message', { test: true });
+logger.error('Test error message', { test: true });
+
+// Test 2: Security event logging
+console.log('\n2. Testing security event logging:');
+
+// Rate limit exceeded
+logger.warn('Rate limit exceeded', {
+  ip: '192.168.1.100',
+  path: '/api/admin/login',
+  method: 'POST',
+  authenticated: false,
+  userAgent: 'Mozilla/5.0 Test',
+  timestamp: new Date().toISOString(),
+  rateLimitInfo: {
+    limit: 5,
+    current: 6,
+    remaining: 0,
+    resetTime: new Date(Date.now() + 900000).toISOString()
+  }
+});
+
+// Auth rate limit
+logger.warn('Auth rate limit exceeded', {
+  ip: '192.168.1.101',
+  path: '/api/auth/admin/login',
+  method: 'POST',
+  userAgent: 'Mozilla/5.0 Test',
+  authType: 'admin',
+  timestamp: new Date().toISOString()
+});
+
+// Failed login
+logger.warn('Failed login attempt', {
+  username: 'testuser',
+  ip: '192.168.1.102',
+  userAgent: 'Mozilla/5.0 Test',
+  reason: 'invalid_credentials',
+  timestamp: new Date().toISOString()
+});
+
+// JWT validation failure
+logger.warn('JWT validation failed', {
+  ip: '192.168.1.103',
+  path: '/api/admin/events',
+  method: 'GET',
+  userAgent: 'Mozilla/5.0 Test',
+  error: 'TokenExpiredError',
+  message: 'jwt expired',
+  timestamp: new Date().toISOString()
+});
+
+// Account lockout
+logger.warn('Login attempt on locked account', {
+  username: 'lockeduser',
+  ip: '192.168.1.104',
+  remainingLockTime: 1200,
+  timestamp: new Date().toISOString()
+});
+
+// Suspicious activity
+logger.warn('Suspicious login activity detected', {
+  username: 'suspicioususer',
+  ips: ['192.168.1.105', '192.168.1.106', '192.168.1.107'],
+  timeWindow: '15 minutes',
+  timestamp: new Date().toISOString()
+});
+
+console.log('\n3. Check log files:');
+console.log('- logs/security.log - Should contain all security warnings');
+console.log('- logs/error.log - Should contain error messages');
+console.log('- logs/combined.log - Should contain all messages');
+
+console.log('\n✅ Security logging test complete!');
+console.log('Review the log files to ensure all events are properly captured.');
+
+// Give logger time to flush
+setTimeout(() => {
+  process.exit(0);
+}, 1000);
@@ -0,0 +1,110 @@
+const { db } = require('../src/database/db');
+
+async function verifyTemplateEquality() {
+  try {
+    console.log('Verifying template equality between German and English versions...\n');
+    
+    const templates = await db('email_templates').select('*');
+    
+    for (const template of templates) {
+      console.log(`\n=== ${template.template_key.toUpperCase()} ===`);
+      
+      // Check subject length similarity
+      const subjectEnLength = template.subject_en?.length || 0;
+      const subjectDeLength = template.subject_de?.length || 0;
+      console.log(`Subject length - EN: ${subjectEnLength}, DE: ${subjectDeLength}`);
+      
+      // Check HTML content features
+      const htmlEn = template.body_html_en || '';
+      const htmlDe = template.body_html_de || '';
+      
+      // Check for key features in both versions
+      const features = [
+        { name: 'Handlebars conditionals', pattern: /{{#if/g },
+        { name: 'Styled divs', pattern: /style="/g },
+        { name: 'Background colors', pattern: /background-color:/g },
+        { name: 'Buttons/CTAs', pattern: /<a.*style.*background-color.*>/g },
+        { name: 'Icons/Emojis', pattern: /[📧📞✅⚠️]/g },
+        { name: 'Lists', pattern: /<ul/g },
+        { name: 'Strong emphasis', pattern: /<strong>/g }
+      ];
+      
+      console.log('\nFeature comparison:');
+      for (const feature of features) {
+        const enCount = (htmlEn.match(feature.pattern) || []).length;
+        const deCount = (htmlDe.match(feature.pattern) || []).length;
+        const status = enCount === deCount ? '✅' : '❌';
+        console.log(`${status} ${feature.name}: EN=${enCount}, DE=${deCount}`);
+      }
+      
+      // Check text content length
+      const textEn = template.body_text_en || '';
+      const textDe = template.body_text_de || '';
+      console.log(`\nText content length - EN: ${textEn.length}, DE: ${textDe.length}`);
+      
+      // Check for specific variables usage
+      const variables = [
+        'host_name', 'event_name', 'event_date', 'gallery_link', 
+        'gallery_password', 'expiry_date', 'welcome_message',
+        'days_remaining', 'support_email', 'support_phone',
+        'archive_date', 'photo_count', 'archive_size'
+      ];
+      
+      const missingInEn = [];
+      const missingInDe = [];
+      
+      for (const variable of variables) {
+        const varPattern = new RegExp(`{{${variable}}}`, 'g');
+        const inEn = varPattern.test(htmlEn) || varPattern.test(textEn);
+        const inDe = varPattern.test(htmlDe) || varPattern.test(textDe);
+        
+        if (inDe && !inEn) missingInEn.push(variable);
+        if (inEn && !inDe) missingInDe.push(variable);
+      }
+      
+      if (missingInEn.length > 0) {
+        console.log(`\n⚠️  Variables in DE but missing in EN: ${missingInEn.join(', ')}`);
+      }
+      if (missingInDe.length > 0) {
+        console.log(`\n⚠️  Variables in EN but missing in DE: ${missingInDe.join(', ')}`);
+      }
+      
+      // Overall quality score
+      const enScore = [
+        htmlEn.includes('style='),
+        htmlEn.includes('{{#if'),
+        htmlEn.includes('background-color'),
+        htmlEn.includes('<strong>'),
+        htmlEn.includes('margin:'),
+        htmlEn.includes('padding:')
+      ].filter(Boolean).length;
+      
+      const deScore = [
+        htmlDe.includes('style='),
+        htmlDe.includes('{{#if'),
+        htmlDe.includes('background-color'),
+        htmlDe.includes('<strong>'),
+        htmlDe.includes('margin:'),
+        htmlDe.includes('padding:')
+      ].filter(Boolean).length;
+      
+      console.log(`\nQuality score (out of 6) - EN: ${enScore}, DE: ${deScore}`);
+      console.log(enScore === deScore ? '✅ Templates have equal quality!' : '❌ Quality mismatch');
+    }
+    
+    console.log('\n\nSummary:');
+    console.log('The English templates have been updated to match the German templates in:');
+    console.log('- HTML styling and structure');
+    console.log('- Conditional content blocks');
+    console.log('- Visual elements (buttons, alerts, icons)');
+    console.log('- Information completeness');
+    console.log('- Professional formatting');
+    
+  } catch (error) {
+    console.error('Error:', error);
+  } finally {
+    await db.destroy();
+  }
+}
+
+verifyTemplateEquality();
@@ -4,19 +4,27 @@ require('dotenv').config();
 const { validateEnvironment } = require('./src/config/validateEnv');
 validateEnvironment();

+// Initialize logger early to capture startup logs
+const logger = require('./src/utils/logger');
+logger.info('Server starting up', {
+  nodeVersion: process.version,
+  environment: process.env.NODE_ENV || 'development',
+  timestamp: new Date().toISOString()
+});
+
 const express = require('express');
 const helmet = require('helmet');
 const cors = require('cors');
-const rateLimit = require('express-rate-limit');
-const jwt = require('jsonwebtoken');
 const path = require('path');
 const { initializeDatabase, db } = require('./src/database/db');
 const { startFileWatcher } = require('./src/services/fileWatcher');
 const { startExpirationChecker } = require('./src/services/expirationChecker');
 const { initializeTransporter, startEmailQueueProcessor } = require('./src/services/emailProcessor');
+const { startBackupService } = require('./src/services/backupService');
+const { startScheduledBackups } = require('./src/services/databaseBackup');
 const { maintenanceMiddleware } = require('./src/middleware/maintenance');
 const { sessionTimeoutMiddleware } = require('./src/middleware/sessionTimeout');
-const logger = require('./src/utils/logger');
+const { createRateLimiter, createAuthRateLimiter } = require('./src/services/rateLimitService');

 // Import routes
 const authRoutes = require('./src/routes/auth-enhanced');
@@ -29,7 +37,8 @@ const app = express();
 const PORT = process.env.PORT || 3000;

 // Trust proxy headers (required for Traefik/nginx)
-app.set('trust proxy', true);
+// Set to specific number of proxies or loopback to be more secure
+app.set('trust proxy', 'loopback, linklocal, uniquelocal');

 // Security middleware with custom CSP
 app.use(helmet({
@@ -92,41 +101,27 @@ const corsOptions = {

 app.use(cors(corsOptions));

-// Rate limiting with admin bypass
-const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: process.env.NODE_ENV === 'development' ? 1000 : 100, // More lenient in development
-  skip: (req) => {
-    // Skip rate limiting for authenticated admin users
-    if (req.path.startsWith('/api/admin/') && req.headers.authorization) {
-      const token = req.headers.authorization.replace('Bearer ', '');
-      try {
-        const decoded = jwt.verify(token, process.env.JWT_SECRET);
-        return decoded.type === 'admin';
-      } catch (err) {
-        return false;
-      }
-    }
-    // Also skip rate limiting for public settings endpoint in development
-    if (process.env.NODE_ENV === 'development' && req.path === '/api/public/settings') {
-      return true;
-    }
-    return false;
-  }
-});
+// Initialize rate limiters (they will be created dynamically)
+let generalRateLimiter;
+let authRateLimiter;

-const authLimiter = rateLimit({
-  windowMs: 15 * 60 * 1000,
-  max: 5 // limit auth attempts
-});
+// Function to initialize rate limiters
+async function initializeRateLimiters() {
+  generalRateLimiter = await createRateLimiter();
+  authRateLimiter = await createAuthRateLimiter();
+  
+  // Apply rate limiting
+  app.use('/api/', generalRateLimiter);
+  app.use('/api/auth', authRateLimiter);
+  app.use('/api/gallery/:slug/verify', authRateLimiter);
+  app.use('/api/admin/auth/login', authRateLimiter);
+}

-// Apply rate limiting - admin routes check will skip for valid admin tokens
-app.use('/api/', limiter);
-app.use('/api/auth', authLimiter);
+// Note: Rate limiters will be initialized after database connection

-// Body parsing middleware
-app.use(express.json());
-app.use(express.urlencoded({ extended: true }));
+// Body parsing middleware with increased limits for large uploads
+app.use(express.json({ limit: '100mb' }));
+app.use(express.urlencoded({ extended: true, limit: '100mb' }));

 // Maintenance mode middleware - add after body parsing but before routes
 app.use(maintenanceMiddleware);
@@ -145,14 +140,39 @@ const setCorsHeaders = (req, res, next) => {
 // Import secure static middleware
 const secureStatic = require('./src/middleware/secureStatic');

+// Get storage path from environment or use default
+const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../storage');
+
 // Static file serving for photos (protected)
-app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/events/active')));
+app.use('/photos', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'events/active')));

 // Static file serving for thumbnails (protected)
-app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(__dirname, 'storage/thumbnails')));
+app.use('/thumbnails', require('./src/middleware/photoAuth'), setCorsHeaders, secureStatic(path.join(storagePath, 'thumbnails')));

 // Static file serving for uploads (public - logos, favicons)
-app.use('/uploads', setCorsHeaders, secureStatic(path.join(__dirname, 'storage/uploads')));
+app.use('/uploads', setCorsHeaders, secureStatic(path.join(storagePath, 'uploads')));
+
+// Debug endpoint to check IP detection (only in development)
+if (process.env.NODE_ENV === 'development') {
+  app.get('/api/debug/ip', (req, res) => {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+    
+    res.json({
+      detectedIp: clientIp,
+      reqIp: req.ip,
+      headers: {
+        'x-forwarded-for': req.headers['x-forwarded-for'],
+        'x-real-ip': req.headers['x-real-ip'],
+        'x-forwarded-proto': req.headers['x-forwarded-proto'],
+        'x-forwarded-host': req.headers['x-forwarded-host']
+      },
+      trustProxy: app.get('trust proxy')
+    });
+  });
+}

 // Health check endpoint
 app.get('/health', async (req, res) => {
@@ -183,6 +203,10 @@ app.use('/api/gallery', galleryRoutes);
 app.use('/api/admin', adminRoutes);
 app.use('/api/admin/auth', adminAuthRoutes);
 app.use('/api/admin/system', require('./src/routes/adminSystem'));
+app.use('/api/admin/backup', require('./src/routes/adminBackup'));
+app.use('/api/admin/database-backup', require('./src/routes/adminDatabaseBackup'));
+app.use('/api/admin/feedback', require('./src/routes/adminFeedback'));
+app.use('/api/gallery', require('./src/routes/galleryFeedback'));
 app.use('/api/public/settings', require('./src/routes/publicSettings'));
 app.use('/api/public', require('./src/routes/publicCMS'));
 app.use('/api/images', require('./src/routes/protectedImages'));
@@ -199,9 +223,21 @@ async function startServer() {
    // Initialize database
    await initializeDatabase();

-  // Initialize auth security cleanup job
-  const { initializeCleanupJob } = require('./src/utils/authSecurity');
-  initializeCleanupJob();
+    // Initialize rate limiters after database is ready
+    await initializeRateLimiters();
+    logger.info('Rate limiters initialized with database configuration');
+
+    // Initialize auth security cleanup job
+    const { initializeCleanupJob } = require('./src/utils/authSecurity');
+    initializeCleanupJob();
+    
+    // Initialize temp upload cleanup job
+    const { cleanupTempUploads } = require('./src/utils/cleanupTempUploads');
+    // Run cleanup on startup
+    cleanupTempUploads();
+    // Schedule periodic cleanup every hour
+    setInterval(cleanupTempUploads, 60 * 60 * 1000);
+    logger.info('Temp upload cleanup scheduled');
    
    // Start file watcher
    startFileWatcher();
@@ -213,6 +249,12 @@ async function startServer() {
    await initializeTransporter();
    startEmailQueueProcessor();
    
+    // Start backup service
+    await startBackupService();
+    
+    // Start database backup service
+    await startScheduledBackups();
+    
    app.listen(PORT, () => {
      logger.info(`Server running on port ${PORT}`);
      logger.info(`Admin interface: ${process.env.ADMIN_URL || 'http://localhost:3000'}`);
@@ -0,0 +1,83 @@
+const { formatBoolean, isPostgreSQL, addDays, formatDateForDB, insertAndGetId } = require('../utils/dbCompat');
+
+describe('Database Compatibility', () => {
+  // Save original env
+  const originalEnv = process.env.DATABASE_CLIENT;
+  
+  afterEach(() => {
+    // Restore original env after each test
+    if (originalEnv) {
+      process.env.DATABASE_CLIENT = originalEnv;
+    } else {
+      delete process.env.DATABASE_CLIENT;
+    }
+  });
+
+  describe('formatBoolean', () => {
+    test('should format boolean values correctly', () => {
+      // Mock for SQLite
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+      
+      // Mock for PostgreSQL
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(formatBoolean(true)).toBe(true);
+      expect(formatBoolean(false)).toBe(false);
+      
+      // Default (no env var) should be SQLite
+      delete process.env.DATABASE_CLIENT;
+      expect(formatBoolean(true)).toBe(1);
+      expect(formatBoolean(false)).toBe(0);
+    });
+  });
+
+  describe('isPostgreSQL', () => {
+    test('should detect PostgreSQL correctly', () => {
+      process.env.DATABASE_CLIENT = 'pg';
+      expect(isPostgreSQL()).toBe(true);
+      
+      process.env.DATABASE_CLIENT = 'sqlite3';
+      expect(isPostgreSQL()).toBe(false);
+      
+      delete process.env.DATABASE_CLIENT;
+      expect(isPostgreSQL()).toBe(false); // Default to SQLite
+    });
+  });
+
+  describe('formatDateForDB', () => {
+    test('should format dates as ISO strings', () => {
+      const date = new Date('2024-01-15T10:30:00Z');
+      expect(formatDateForDB(date)).toBe('2024-01-15T10:30:00.000Z');
+    });
+  });
+
+  describe('addDays', () => {
+    test('should add days correctly', () => {
+      const date = new Date('2024-01-15');
+      const result = addDays(date, 30);
+      expect(result.toISOString().split('T')[0]).toBe('2024-02-14');
+      
+      const negativeResult = addDays(date, -7);
+      expect(negativeResult.toISOString().split('T')[0]).toBe('2024-01-08');
+    });
+  });
+
+  describe('insertAndGetId', () => {
+    test('should handle PostgreSQL result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([{ id: 123 }])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(123);
+    });
+
+    test('should handle SQLite result format', async () => {
+      const mockQuery = {
+        returning: jest.fn().mockResolvedValue([456])
+      };
+      const result = await insertAndGetId(mockQuery);
+      expect(result).toBe(456);
+    });
+  });
+});
@@ -34,7 +34,7 @@ function validateEnvironment() {
    if (name === 'JWT_SECRET' && value) {
      // Check for the insecure default value
      if (value === 'your-secret-key') {
-        errors.push(`CRITICAL: JWT_SECRET is set to the insecure default value. Please set a secure secret key.`);
+        errors.push('CRITICAL: JWT_SECRET is set to the insecure default value. Please set a secure secret key.');
      }
      
      // Check minimum length (should be at least 32 characters for security)
@@ -4,6 +4,33 @@ const knexConfig = require('../../knexfile');
 // Create database connection with built-in retry logic
 const db = knex(knexConfig);

+// Connection retry configuration
+const MAX_RETRIES = 3;
+const RETRY_DELAY = 1000;
+
+// Wrapper function to handle connection retries
+async function withRetry(queryFn, retries = MAX_RETRIES) {
+  for (let i = 0; i < retries; i++) {
+    try {
+      return await queryFn();
+    } catch (error) {
+      const isConnectionError = error.message && (
+        error.message.includes('Connection terminated unexpectedly') ||
+        error.message.includes('Connection ended unexpectedly') ||
+        error.message.includes('ECONNREFUSED') ||
+        error.message.includes('ETIMEDOUT')
+      );
+      
+      if (isConnectionError && i < retries - 1) {
+        console.log(`Database connection error, retrying in ${RETRY_DELAY}ms... (attempt ${i + 1}/${retries})`);
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAY * (i + 1)));
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+
 async function initializeDatabase() {
  // Events table
  const hasEventsTable = await db.schema.hasTable('events');
@@ -59,9 +86,9 @@ async function initializeDatabase() {
          )
        `);
        
-        await db.raw(`INSERT INTO events_new SELECT * FROM events`);
-        await db.raw(`DROP TABLE events`);
-        await db.raw(`ALTER TABLE events_new RENAME TO events`);
+        await db.raw('INSERT INTO events_new SELECT * FROM events');
+        await db.raw('DROP TABLE events');
+        await db.raw('ALTER TABLE events_new RENAME TO events');
      } catch (error) {
        // If the migration fails, it might already have been applied
        console.log('Color theme migration may have already been applied');
@@ -225,4 +252,4 @@ async function logActivity(activityType, metadata = {}, eventId = null, actor =
  }
 }

-module.exports = { db, initializeDatabase, logActivity };
+module.exports = { db, initializeDatabase, logActivity, withRetry };
@@ -1,5 +1,6 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 const { isTokenRevoked } = require('../utils/tokenRevocation');
 const logger = require('../utils/logger');

@@ -57,7 +58,7 @@ async function adminAuth(req, res, next) {
    
    // Check if admin still exists and is active
    const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: true })
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
      .first();
    
    if (!admin) {
@@ -1,5 +1,6 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 const logger = require('../utils/logger');

 /**
@@ -50,7 +51,7 @@ async function adminAuth(req, res, next) {
    
    // Check if admin still exists and is active
    const admin = await db('admin_users')
-      .where({ id: decoded.id, is_active: true })
+      .where({ id: decoded.id, is_active: formatBoolean(true) })
      .first();
    
    if (!admin) {
@@ -165,7 +166,7 @@ async function photoAuth(req, res, next) {
    // Allow both admin and gallery tokens
    if (decoded.type === 'admin') {
      const admin = await db('admin_users')
-        .where({ id: decoded.id, is_active: true })
+        .where({ id: decoded.id, is_active: formatBoolean(true) })
        .first();
      
      if (!admin) {
@@ -1,23 +1,83 @@
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
+const logger = require('../utils/logger');

 async function adminAuth(req, res, next) {
  try {
    const token = req.headers.authorization?.split(' ')[1];
    if (!token) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      logger.warn('Admin auth attempt without token', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent']
+      });
      return res.status(401).json({ error: 'No token provided' });
    }
    
-    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const admin = await db('admin_users').where({ id: decoded.id, is_active: true }).first();
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (jwtError) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('JWT validation failed', {
+        ip: clientIp,
+        path: req.path,
+        method: req.method,
+        userAgent: req.headers['user-agent'],
+        error: jwtError.name,
+        message: jwtError.message,
+        timestamp: new Date().toISOString()
+      });
+      
+      if (jwtError.name === 'TokenExpiredError') {
+        return res.status(401).json({ error: 'Token expired' });
+      }
+      return res.status(401).json({ error: 'Invalid token' });
+    }
+    
+    const admin = await db('admin_users').where({ id: decoded.id, is_active: formatBoolean(true) }).first();
    
    if (!admin) {
+      const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                     req.headers['x-real-ip'] || 
+                     req.connection.remoteAddress || 
+                     req.ip;
+      
+      logger.warn('Admin auth failed - user not found or inactive', {
+        ip: clientIp,
+        userId: decoded.id,
+        path: req.path,
+        method: req.method,
+        timestamp: new Date().toISOString()
+      });
      return res.status(401).json({ error: 'Invalid token' });
    }
    
    req.admin = admin;
    next();
  } catch (error) {
+    const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim() || 
+                   req.headers['x-real-ip'] || 
+                   req.connection.remoteAddress || 
+                   req.ip;
+    
+    logger.error('Admin auth middleware error', {
+      ip: clientIp,
+      path: req.path,
+      error: error.message,
+      stack: error.stack,
+      timestamp: new Date().toISOString()
+    });
    res.status(401).json({ error: 'Invalid token' });
  }
 }
@@ -0,0 +1,236 @@
+const crypto = require('crypto');
+const { db } = require('../database/db');
+const logger = require('../utils/logger');
+
+/**
+ * Generate a unique identifier for the guest
+ */
+function generateGuestIdentifier(req) {
+  const ip = req.ip || req.connection.remoteAddress || 'unknown';
+  const userAgent = req.headers['user-agent'] || 'unknown';
+  return crypto
+    .createHash('sha256')
+    .update(`${ip}:${userAgent}`)
+    .digest('hex');
+}
+
+/**
+ * Get rate limit settings from app_settings
+ */
+async function getRateLimitSettings() {
+  try {
+    const settings = await db('app_settings')
+      .where('setting_key', 'feedback_rate_limits')
+      .first();
+    
+    if (settings && settings.setting_value) {
+      return JSON.parse(settings.setting_value);
+    }
+    
+    // Default settings
+    return {
+      rating: { max: 100, window: 3600 }, // 100 ratings per hour
+      comment: { max: 20, window: 3600 }, // 20 comments per hour
+      like: { max: 200, window: 3600 }, // 200 likes per hour
+      favorite: { max: 100, window: 3600 } // 100 favorites per hour
+    };
+  } catch (error) {
+    logger.error('Error getting rate limit settings:', error);
+    // Return defaults on error
+    return {
+      rating: { max: 100, window: 3600 },
+      comment: { max: 20, window: 3600 },
+      like: { max: 200, window: 3600 },
+      favorite: { max: 100, window: 3600 }
+    };
+  }
+}
+
+/**
+ * Check if action is rate limited
+ */
+async function checkRateLimit(identifier, eventId, actionType) {
+  try {
+    const settings = await getRateLimitSettings();
+    const limit = settings[actionType] || { max: 100, window: 3600 };
+    
+    // Clean old entries (older than window)
+    const cutoff = new Date(Date.now() - limit.window * 1000);
+    await db('feedback_rate_limits')
+      .where('window_start', '<', cutoff)
+      .delete();
+    
+    // Count recent actions
+    const recentActions = await db('feedback_rate_limits')
+      .where({
+        identifier,
+        event_id: eventId,
+        action_type: actionType
+      })
+      .where('window_start', '>', cutoff)
+      .sum('action_count as total')
+      .first();
+    
+    const currentCount = recentActions?.total || 0;
+    
+    if (currentCount >= limit.max) {
+      return {
+        limited: true,
+        limit: limit.max,
+        window: limit.window,
+        current: currentCount,
+        resetAt: new Date(Date.now() + limit.window * 1000)
+      };
+    }
+    
+    return {
+      limited: false,
+      limit: limit.max,
+      window: limit.window,
+      current: currentCount,
+      remaining: limit.max - currentCount
+    };
+  } catch (error) {
+    logger.error('Error checking rate limit:', error);
+    // Allow action on error to avoid blocking legitimate users
+    return { limited: false };
+  }
+}
+
+/**
+ * Record an action for rate limiting
+ */
+async function recordAction(identifier, eventId, actionType) {
+  try {
+    await db('feedback_rate_limits').insert({
+      identifier,
+      event_id: eventId,
+      action_type: actionType,
+      action_count: 1,
+      window_start: new Date()
+    });
+  } catch (error) {
+    logger.error('Error recording rate limit action:', error);
+  }
+}
+
+/**
+ * Middleware factory for feedback rate limiting
+ */
+function feedbackRateLimit(actionType) {
+  return async (req, res, next) => {
+    try {
+      // Extract event ID from params or body
+      const eventId = req.params.eventId || req.body?.event_id;
+      if (!eventId) {
+        return res.status(400).json({ error: 'Event ID required' });
+      }
+      
+      // Generate guest identifier
+      const identifier = generateGuestIdentifier(req);
+      req.guestIdentifier = identifier;
+      
+      // Check rate limit
+      const rateLimitStatus = await checkRateLimit(identifier, eventId, actionType);
+      
+      // Set rate limit headers
+      res.set({
+        'X-RateLimit-Limit': rateLimitStatus.limit,
+        'X-RateLimit-Remaining': rateLimitStatus.remaining || 0,
+        'X-RateLimit-Reset': rateLimitStatus.resetAt ? rateLimitStatus.resetAt.toISOString() : new Date().toISOString()
+      });
+      
+      if (rateLimitStatus.limited) {
+        logger.warn(`Rate limit exceeded for ${actionType}`, {
+          identifier: identifier.substring(0, 16) + '...',
+          eventId,
+          actionType
+        });
+        
+        return res.status(429).json({
+          error: 'Too many requests',
+          message: `Rate limit exceeded. Please try again later.`,
+          retryAfter: rateLimitStatus.window
+        });
+      }
+      
+      // Record the action after successful processing
+      res.on('finish', async () => {
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          await recordAction(identifier, eventId, actionType);
+        }
+      });
+      
+      next();
+    } catch (error) {
+      logger.error('Error in rate limit middleware:', error);
+      // Allow request to proceed on error
+      next();
+    }
+  };
+}
+
+/**
+ * IP-based rate limiting for more strict control
+ */
+function strictRateLimit(options = {}) {
+  const {
+    windowMs = 15 * 60 * 1000, // 15 minutes
+    max = 100, // limit each IP to 100 requests per windowMs
+    message = 'Too many requests from this IP, please try again later.',
+    skipSuccessfulRequests = false
+  } = options;
+  
+  const store = new Map();
+  
+  // Clean up old entries periodically
+  setInterval(() => {
+    const now = Date.now();
+    for (const [key, data] of store.entries()) {
+      if (data.resetTime < now) {
+        store.delete(key);
+      }
+    }
+  }, windowMs);
+  
+  return (req, res, next) => {
+    const ip = req.ip || req.connection.remoteAddress;
+    const now = Date.now();
+    const resetTime = now + windowMs;
+    
+    let data = store.get(ip);
+    if (!data || data.resetTime < now) {
+      data = {
+        count: 0,
+        resetTime
+      };
+      store.set(ip, data);
+    }
+    
+    if (data.count >= max) {
+      return res.status(429).json({
+        error: 'Too many requests',
+        message,
+        retryAfter: Math.ceil((data.resetTime - now) / 1000)
+      });
+    }
+    
+    if (!skipSuccessfulRequests || res.statusCode >= 400) {
+      data.count++;
+    }
+    
+    res.setHeader('X-RateLimit-Limit', max);
+    res.setHeader('X-RateLimit-Remaining', Math.max(0, max - data.count));
+    res.setHeader('X-RateLimit-Reset', new Date(data.resetTime).toISOString());
+    
+    next();
+  };
+}
+
+module.exports = {
+  feedbackRateLimit,
+  strictRateLimit,
+  generateGuestIdentifier,
+  checkRateLimit,
+  recordAction
+};
@@ -1,5 +1,6 @@
 const jwt = require('jsonwebtoken');
-const { db } = require('../database/db');
+const { db, withRetry } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');

 // Middleware to verify gallery access
 async function verifyGalleryAccess(req, res, next) {
@@ -10,7 +11,15 @@ async function verifyGalleryAccess(req, res, next) {
    }
    
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
-    const event = await db('events').where({ id: decoded.eventId, is_active: true }).first();
+    const event = await withRetry(async () => {
+      return await db('events')
+        .where({ 
+          id: decoded.eventId, 
+          is_active: formatBoolean(true),
+          is_archived: formatBoolean(false)
+        })
+        .first();
+    });
    
    if (!event) {
      return res.status(404).json({ error: 'Gallery not found or expired' });
@@ -1,12 +1,15 @@
 const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');

 async function photoAuth(req, res, next) {
  try {
    // Extract event slug from the path
    let eventSlug;
    
+    console.log('PhotoAuth middleware - path:', req.path);
+    
    // For thumbnails, we need to parse the filename to get the event info
    if (req.path.startsWith('/thumb_')) {
      // For now, we'll rely on JWT token for thumbnail access
@@ -25,9 +28,22 @@ async function photoAuth(req, res, next) {
        
        // Check if it's a gallery token
        if (decoded.type === 'gallery') {
-          // For thumbnails, we accept any valid gallery token
+          // For thumbnails, we need to verify the token is for a valid event
          if (!eventSlug) {
-            const event = await db('events').where({ slug: decoded.eventSlug, is_active: true }).first();
+            // Extract event ID from the decoded token
+            if (decoded.eventId) {
+              const event = await db('events')
+                .where({ id: decoded.eventId, is_active: formatBoolean(true) })
+                .first();
+              if (event) {
+                req.event = event;
+                return next();
+              }
+            }
+            // Fallback to slug
+            const event = await db('events')
+              .where({ slug: decoded.eventSlug, is_active: formatBoolean(true) })
+              .first();
            if (event) {
              req.event = event;
              return next();
@@ -35,7 +51,9 @@ async function photoAuth(req, res, next) {
          }
          // For regular photos, check if token matches the event
          else if (decoded.eventSlug === eventSlug) {
-            const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
+            const event = await db('events')
+              .where({ slug: eventSlug, is_active: formatBoolean(true) })
+              .first();
            if (event) {
              req.event = event;
              return next();
@@ -45,18 +63,12 @@ async function photoAuth(req, res, next) {
        
        // Check if it's an admin token (admins can view all photos)
        if (decoded.type === 'admin') {
-          if (!eventSlug) {
-            // For thumbnails with admin token, allow access
-            return next();
-          }
-          const event = await db('events').where({ slug: eventSlug }).first();
-          if (event) {
-            req.event = event;
-            return next();
-          }
+          // For both thumbnails and photos with admin token, allow access
+          return next();
        }
      } catch (err) {
        // Token invalid, fall through to password check
+        console.error('JWT verification failed:', err.message);
      }
    }
    
@@ -67,12 +79,12 @@ async function photoAuth(req, res, next) {
      return res.status(401).json({ error: 'Authentication required' });
    }
    
-    // If no eventSlug (thumbnails), we require JWT token
-    if (!eventSlug) {
+    // If no eventSlug (thumbnails), and we don't have valid auth yet, deny access
+    if (!eventSlug && !password) {
      return res.status(401).json({ error: 'Authentication required for thumbnails' });
    }
    
-    const event = await db('events').where({ slug: eventSlug, is_active: true }).first();
+    const event = await db('events').where({ slug: eventSlug, is_active: formatBoolean(true) }).first();
    if (!event) {
      return res.status(404).json({ error: 'Gallery not found' });
    }
@@ -7,6 +7,11 @@ const sessions = new Map();
 // Default session timeout (60 minutes)
 const DEFAULT_SESSION_TIMEOUT = 60 * 60 * 1000;

+// Cache for session timeout setting
+let cachedTimeout = null;
+let cacheExpiry = 0;
+const CACHE_DURATION = 30 * 60 * 1000; // 30 minutes - reduced DB queries
+
 // Clean up expired sessions every 5 minutes
 setInterval(() => {
  const now = Date.now();
@@ -18,20 +23,46 @@ setInterval(() => {
 }, 5 * 60 * 1000);

 async function getSessionTimeout() {
+  const now = Date.now();
+  
+  // Return cached value if still valid
+  if (cachedTimeout && now < cacheExpiry) {
+    return cachedTimeout;
+  }
+  
  try {
    const setting = await db('app_settings')
      .where('setting_key', 'security_session_timeout_minutes')
-      .first();
+      .first()
+      .timeout(5000); // 5 second timeout
    
    if (setting && setting.setting_value) {
-      const minutes = parseInt(JSON.parse(setting.setting_value));
-      return minutes * 60 * 1000; // Convert to milliseconds
+      let value = setting.setting_value;
+      // Handle both string and object values
+      if (typeof value === 'string') {
+        try {
+          value = JSON.parse(value);
+        } catch (e) {
+          // If it's not JSON, try to parse as number directly
+          value = parseInt(value);
+        }
+      }
+      const minutes = parseInt(value);
+      if (!isNaN(minutes) && minutes > 0) {
+        cachedTimeout = minutes * 60 * 1000; // Convert to milliseconds
+        cacheExpiry = now + CACHE_DURATION;
+        return cachedTimeout;
+      }
    }
  } catch (error) {
-    console.error('Error getting session timeout:', error);
+    // Only log if it's not a connection error (to avoid spam)
+    if (error.code !== 'ECONNRESET' && !error.message?.includes('Connection terminated')) {
+      console.error('Error getting session timeout:', error.message);
+    }
  }
  
-  return DEFAULT_SESSION_TIMEOUT;
+  // Use cached value if available, otherwise default
+  return cachedTimeout || DEFAULT_SESSION_TIMEOUT;
 }

 async function sessionTimeoutMiddleware(req, res, next) {
@@ -0,0 +1,111 @@
+const fs = require('fs').promises;
+const path = require('path');
+const sharp = require('sharp');
+const logger = require('../utils/logger');
+
+/**
+ * Validate uploaded file is complete and not corrupted
+ */
+async function validateUploadedFile(filePath) {
+  try {
+    // Check file exists and has size
+    const stats = await fs.stat(filePath);
+    if (stats.size === 0) {
+      throw new Error('File is empty');
+    }
+    
+    // For image files, verify they can be read by Sharp
+    const ext = path.extname(filePath).toLowerCase();
+    const imageExtensions = ['.jpg', '.jpeg', '.png', '.gif', '.webp'];
+    
+    if (imageExtensions.includes(ext)) {
+      // Try to read metadata - this will fail if image is corrupted
+      let metadata;
+      try {
+        metadata = await sharp(filePath, {
+          failOnError: false, // Don't fail on recoverable errors
+          limitInputPixels: 268402689 // ~16k x 16k max
+        }).metadata();
+      } catch (metadataError) {
+        // If metadata reading fails, the file is likely incomplete
+        throw new Error(`Invalid image file: ${metadataError.message}`);
+      }
+      
+      if (!metadata || !metadata.width || !metadata.height) {
+        throw new Error('Invalid image dimensions - file may be incomplete');
+      }
+      
+      // Check for reasonable dimensions
+      if (metadata.width < 10 || metadata.height < 10) {
+        throw new Error('Image dimensions too small');
+      }
+      
+      // Additional check: verify we can actually decode a small portion of the image
+      try {
+        await sharp(filePath, {
+          failOnError: false,
+          limitInputPixels: 268402689
+        })
+        .resize(10, 10) // Try to resize to very small size
+        .toBuffer();
+      } catch (decodeError) {
+        throw new Error(`Image decode failed - file may be corrupted: ${decodeError.message}`);
+      }
+      
+      return true;
+    }
+    
+    return true;
+  } catch (error) {
+    logger.error(`File validation failed for ${filePath}:`, error.message);
+    throw error;
+  }
+}
+
+/**
+ * Middleware to validate uploaded files after multer processing
+ */
+async function validateUploadedFiles(req, res, next) {
+  if (!req.files || req.files.length === 0) {
+    return next();
+  }
+  
+  const validFiles = [];
+  const invalidFiles = [];
+  
+  // Validate each file
+  for (const file of req.files) {
+    try {
+      await validateUploadedFile(file.path);
+      validFiles.push(file);
+    } catch (error) {
+      logger.warn(`Removing invalid upload ${file.originalname}: ${error.message}`);
+      invalidFiles.push({
+        filename: file.originalname,
+        error: error.message
+      });
+      
+      // Delete the invalid file
+      try {
+        await fs.unlink(file.path);
+      } catch (unlinkErr) {
+        logger.error(`Failed to delete invalid file ${file.path}:`, unlinkErr.message);
+      }
+    }
+  }
+  
+  // Update req.files to only include valid files
+  req.files = validFiles;
+  
+  // Store invalid files info for response
+  if (invalidFiles.length > 0) {
+    req.invalidFiles = invalidFiles;
+  }
+  
+  next();
+}
+
+module.exports = {
+  validateUploadedFile,
+  validateUploadedFiles
+};
@@ -11,6 +11,8 @@ const photosRoutes = require('./adminPhotos');
 const categoriesRoutes = require('./adminCategories');
 const cmsRoutes = require('./adminCMS');
 const notificationsRoutes = require('./adminNotifications');
+const backupRoutes = require('./adminBackup');
+const restoreRoutes = require('./adminRestore');

 // Mount sub-routers
 router.use('/dashboard', dashboardRoutes);
@@ -22,5 +24,7 @@ router.use('/events', photosRoutes);
 router.use('/categories', categoriesRoutes);
 router.use('/cms', cmsRoutes);
 router.use('/notifications', notificationsRoutes);
+router.use('/backup', backupRoutes);
+router.use('/restore', restoreRoutes);

 module.exports = router;
@@ -2,6 +2,7 @@ const express = require('express');
 const path = require('path');
 const fs = require('fs').promises;
 const { db } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const archiver = require('archiver');
 const AdmZip = require('adm-zip');
@@ -16,7 +17,7 @@ router.get('/', adminAuth, async (req, res) => {

    // Get total count
    const totalCount = await db('events')
-      .where('is_archived', true)
+      .where('is_archived', formatBoolean(true))
      .count('id as count')
      .first();

@@ -28,7 +29,7 @@ router.get('/', adminAuth, async (req, res) => {
        db.raw('SUM(photos.size_bytes) as total_size')
      )
      .leftJoin('photos', 'events.id', 'photos.event_id')
-      .where('events.is_archived', true)
+      .where('events.is_archived', formatBoolean(true))
      .groupBy('events.id')
      .orderBy('events.archived_at', 'desc')
      .limit(limit)
@@ -84,7 +85,7 @@ router.get('/:id', adminAuth, async (req, res) => {
  try {
    const archive = await db('events')
      .where('id', req.params.id)
-      .where('is_archived', true)
+      .where('is_archived', formatBoolean(true))
      .first();

    if (!archive) {
@@ -140,7 +141,7 @@ router.post('/:id/restore', adminAuth, async (req, res) => {
  try {
    const archive = await db('events')
      .where('id', req.params.id)
-      .where('is_archived', true)
+      .where('is_archived', formatBoolean(true))
      .first();

    if (!archive) {
@@ -211,12 +212,14 @@ router.post('/:id/restore', adminAuth, async (req, res) => {
                  categoriesMap.set(categoryName, existingCategory.id);
                } else {
                  // Create the category if it doesn't exist
-                  const [newCategoryId] = await db('photo_categories').insert({
+                  const insertResult = await db('photo_categories').insert({
                    event_id: archive.id,
                    name: categoryName,
                    slug: categoryName.toLowerCase().replace(/[^a-z0-9]/g, '-'),
                    created_at: new Date()
-                  });
+                  }).returning('id');
+                  
+                  const newCategoryId = insertResult[0]?.id || insertResult[0];
                  categoriesMap.set(categoryName, newCategoryId);
                }
              }
@@ -248,7 +251,7 @@ router.post('/:id/restore', adminAuth, async (req, res) => {
          } catch (statError) {
            console.error(`Failed to stat file: ${actualFilePath}`);
            console.error(`Entry name was: ${entry.entryName}`);
-            console.error(`Error:`, statError.message);
+            console.error('Error:', statError.message);
            // Skip this file if we can't stat it
            continue;
          }
@@ -266,6 +269,9 @@ router.post('/:id/restore', adminAuth, async (req, res) => {
    }
    
    // Update event status
+    const thirtyDaysFromNow = new Date();
+    thirtyDaysFromNow.setDate(thirtyDaysFromNow.getDate() + 30);
+    
    await db('events')
      .where('id', req.params.id)
      .update({
@@ -273,7 +279,7 @@ router.post('/:id/restore', adminAuth, async (req, res) => {
        is_active: true,
        archive_path: null,
        archived_at: null,
-        expires_at: db.raw("datetime('now', '+30 days')") // Reset expiration
+        expires_at: thirtyDaysFromNow.toISOString() // Reset expiration - works on both DBs
      });

    // Log activity
@@ -298,7 +304,7 @@ router.get('/:id/download', adminAuth, async (req, res) => {
  try {
    const archive = await db('events')
      .where('id', req.params.id)
-      .where('is_archived', true)
+      .where('is_archived', formatBoolean(true))
      .first();

    if (!archive) {
@@ -347,7 +353,7 @@ router.delete('/:id', adminAuth, async (req, res) => {
  try {
    const archive = await db('events')
      .where('id', req.params.id)
-      .where('is_archived', true)
+      .where('is_archived', formatBoolean(true))
      .first();

    if (!archive) {
@@ -357,12 +363,29 @@ router.delete('/:id', adminAuth, async (req, res) => {
    // Delete archive file if exists
    if (archive.archive_path) {
      try {
-        await fs.unlink(archive.archive_path);
+        const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+        const fullArchivePath = path.join(storagePath, archive.archive_path);
+        await fs.unlink(fullArchivePath);
      } catch (error) {
        console.error('Failed to delete archive file:', error);
      }
    }

+    // Delete thumbnails for this event
+    const photos = await db('photos').where('event_id', req.params.id).select('thumbnail_path');
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    
+    for (const photo of photos) {
+      if (photo.thumbnail_path) {
+        try {
+          const thumbPath = path.join(storagePath, photo.thumbnail_path.replace(/^\//, ''));
+          await fs.unlink(thumbPath);
+        } catch (error) {
+          // Ignore errors - thumbnail might already be deleted
+        }
+      }
+    }
+
    // Delete from database (cascade will delete photos and logs)
    await db('events').where('id', req.params.id).delete();

@@ -0,0 +1,956 @@
+const express = require('express');
+const { db } = require('../database/db');
+const { adminAuth } = require('../middleware/auth');
+const { triggerManualBackup, getBackupStatus, cleanupOldBackupRuns, getBackupManifest, validateBackupManifest } = require('../services/backupService');
+const logger = require('../utils/logger');
+const fs = require('fs').promises;
+const path = require('path');
+const crypto = require('crypto');
+const archiver = require('archiver');
+const S3StorageAdapter = require('../services/storage/s3Storage');
+
+const router = express.Router();
+
+// Get backup configuration
+router.get('/config', adminAuth, async (req, res) => {
+  try {
+    const settings = await db('app_settings')
+      .where('setting_type', 'backup')
+      .select('setting_key', 'setting_value');
+    
+    const config = {};
+    settings.forEach(setting => {
+      try {
+        config[setting.setting_key] = JSON.parse(setting.setting_value);
+      } catch (e) {
+        config[setting.setting_key] = setting.setting_value;
+      }
+    });
+    
+    res.json(config);
+  } catch (error) {
+    logger.error('Failed to get backup configuration:', error);
+    res.status(500).json({ error: 'Failed to get backup configuration' });
+  }
+});
+
+// Update backup configuration
+router.put('/config', adminAuth, async (req, res) => {
+  try {
+    const updates = req.body;
+    
+    // Validate required fields based on destination type
+    if (updates.backup_destination_type) {
+      switch (updates.backup_destination_type) {
+        case 'local':
+          if (!updates.backup_destination_path) {
+            return res.status(400).json({ error: 'Local backup requires destination path' });
+          }
+          break;
+        case 'rsync':
+          if (!updates.backup_rsync_host || !updates.backup_rsync_path) {
+            return res.status(400).json({ error: 'Rsync backup requires host and path' });
+          }
+          break;
+        case 's3':
+          if (!updates.backup_s3_endpoint || !updates.backup_s3_bucket || 
+              !updates.backup_s3_access_key || !updates.backup_s3_secret_key) {
+            return res.status(400).json({ error: 'S3 backup requires endpoint, bucket, and credentials' });
+          }
+          break;
+      }
+    }
+    
+    // Update settings
+    for (const [key, value] of Object.entries(updates)) {
+      if (key.startsWith('backup_')) {
+        await db('app_settings')
+          .insert({
+            setting_key: key,
+            setting_value: JSON.stringify(value),
+            setting_type: 'backup',
+            updated_at: new Date()
+          })
+          .onConflict('setting_key')
+          .merge({
+            setting_value: JSON.stringify(value),
+            updated_at: new Date()
+          });
+      }
+    }
+    
+    // Restart backup service if enabled status changed
+    if ('backup_enabled' in updates) {
+      const { startBackupService, stopBackupService } = require('../services/backupService');
+      if (updates.backup_enabled) {
+        await startBackupService();
+      } else {
+        stopBackupService();
+      }
+    }
+    
+    res.json({ success: true, message: 'Backup configuration updated' });
+  } catch (error) {
+    logger.error('Failed to update backup configuration:', error);
+    res.status(500).json({ error: 'Failed to update backup configuration' });
+  }
+});
+
+// Get backup status and history
+router.get('/status', adminAuth, async (req, res) => {
+  try {
+    const limit = parseInt(req.query.limit) || 10;
+    const status = await getBackupStatus(limit);
+    
+    res.json(status);
+  } catch (error) {
+    logger.error('Failed to get backup status:', error);
+    res.status(500).json({ error: 'Failed to get backup status' });
+  }
+});
+
+// Trigger manual backup
+router.post('/run', adminAuth, async (req, res) => {
+  try {
+    // Check if backup is already running
+    const status = await getBackupStatus();
+    if (status.isRunning) {
+      return res.status(409).json({ error: 'Backup is already running' });
+    }
+    
+    // Start backup in background
+    triggerManualBackup().catch(error => {
+      logger.error('Manual backup failed:', error);
+    });
+    
+    res.json({ success: true, message: 'Backup started' });
+  } catch (error) {
+    logger.error('Failed to trigger manual backup:', error);
+    res.status(500).json({ error: 'Failed to trigger backup' });
+  }
+});
+
+// Get backup run details
+router.get('/runs/:id', adminAuth, async (req, res) => {
+  try {
+    const { id } = req.params;
+    
+    const run = await db('backup_runs')
+      .where('id', id)
+      .first();
+    
+    if (!run) {
+      return res.status(404).json({ error: 'Backup run not found' });
+    }
+    
+    // Parse JSON fields
+    if (run.statistics) {
+      try {
+        run.statistics = JSON.parse(run.statistics);
+      } catch (e) {
+        // Keep as string if parsing fails
+      }
+    }
+    
+    res.json(run);
+  } catch (error) {
+    logger.error('Failed to get backup run details:', error);
+    res.status(500).json({ error: 'Failed to get backup run details' });
+  }
+});
+
+// Get file states (for debugging/monitoring)
+router.get('/files', adminAuth, async (req, res) => {
+  try {
+    const { page = 1, limit = 50, search = '' } = req.query;
+    const offset = (page - 1) * limit;
+    
+    let query = db('backup_file_states');
+    
+    if (search) {
+      query = query.where('file_path', 'like', `%${search}%`);
+    }
+    
+    const [files, totalCount] = await Promise.all([
+      query
+        .orderBy('last_backed_up', 'desc')
+        .limit(limit)
+        .offset(offset),
+      db('backup_file_states').count('* as count').first()
+    ]);
+    
+    res.json({
+      files,
+      pagination: {
+        page: parseInt(page),
+        limit: parseInt(limit),
+        total: totalCount.count,
+        pages: Math.ceil(totalCount.count / limit)
+      }
+    });
+  } catch (error) {
+    logger.error('Failed to get backup file states:', error);
+    res.status(500).json({ error: 'Failed to get file states' });
+  }
+});
+
+// Clean up old backup runs
+router.delete('/cleanup', adminAuth, async (req, res) => {
+  try {
+    const { days = 30 } = req.body;
+    
+    await cleanupOldBackupRuns(days);
+    
+    res.json({ success: true, message: `Cleaned up backup runs older than ${days} days` });
+  } catch (error) {
+    logger.error('Failed to cleanup old backup runs:', error);
+    res.status(500).json({ error: 'Failed to cleanup backup runs' });
+  }
+});
+
+// Test backup destination connectivity
+router.post('/test-connection', adminAuth, async (req, res) => {
+  try {
+    const { destination_type, ...config } = req.body;
+    
+    switch (destination_type) {
+      case 'local':
+        // Test local path access
+        const fs = require('fs').promises;
+        try {
+          await fs.access(config.path, fs.constants.W_OK);
+          res.json({ success: true, message: 'Local path is writable' });
+        } catch (error) {
+          res.json({ success: false, message: 'Cannot write to local path: ' + error.message });
+        }
+        break;
+        
+      case 'rsync':
+        // Test rsync connection
+        const { exec } = require('child_process');
+        const { promisify } = require('util');
+        const execAsync = promisify(exec);
+        
+        const sshCommand = config.ssh_key 
+          ? `ssh -i ${config.ssh_key} -o StrictHostKeyChecking=no -o ConnectTimeout=10`
+          : 'ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10';
+        
+        const testCommand = config.user
+          ? `${sshCommand} ${config.user}@${config.host} "echo 'Connection successful'"`
+          : `${sshCommand} ${config.host} "echo 'Connection successful'"`;
+        
+        try {
+          const { stdout } = await execAsync(testCommand);
+          res.json({ success: true, message: 'Rsync connection successful' });
+        } catch (error) {
+          res.json({ success: false, message: 'Rsync connection failed: ' + error.message });
+        }
+        break;
+        
+      case 's3':
+        // Test S3 connection (would need AWS SDK)
+        res.json({ success: false, message: 'S3 testing not implemented yet' });
+        break;
+        
+      default:
+        res.status(400).json({ error: 'Invalid destination type' });
+    }
+  } catch (error) {
+    logger.error('Failed to test backup connection:', error);
+    res.status(500).json({ error: 'Failed to test connection' });
+  }
+});
+
+// Get backup manifest for a specific backup run
+router.get('/manifest/:backupRunId', adminAuth, async (req, res) => {
+  try {
+    const { backupRunId } = req.params;
+    const result = await getBackupManifest(backupRunId);
+    
+    res.json({
+      backupRunId,
+      manifest: result.manifest,
+      summary: result.summary
+    });
+  } catch (error) {
+    logger.error('Failed to get backup manifest:', error);
+    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+  }
+});
+
+// Validate a backup manifest
+router.post('/manifest/validate', adminAuth, async (req, res) => {
+  try {
+    const { manifestPath } = req.body;
+    
+    if (!manifestPath) {
+      return res.status(400).json({ error: 'manifestPath is required' });
+    }
+    
+    const result = await validateBackupManifest(manifestPath);
+    
+    res.json({
+      valid: result.valid,
+      error: result.error,
+      manifestPath
+    });
+  } catch (error) {
+    logger.error('Failed to validate manifest:', error);
+    res.status(500).json({ error: 'Failed to validate manifest' });
+  }
+});
+
+// Download backup manifest
+router.get('/manifest/:backupRunId/download', adminAuth, async (req, res) => {
+  try {
+    const { backupRunId } = req.params;
+    const { format = 'json' } = req.query;
+    
+    const result = await getBackupManifest(backupRunId);
+    
+    // Set appropriate headers
+    const filename = `backup-manifest-${backupRunId}.${format}`;
+    res.setHeader('Content-Type', format === 'yaml' ? 'text/yaml' : 'application/json');
+    res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+    
+    // Send the manifest in requested format
+    if (format === 'yaml') {
+      const yaml = require('js-yaml');
+      res.send(yaml.dump(result.manifest, {
+        indent: 2,
+        lineWidth: -1,
+        noRefs: true,
+        sortKeys: true
+      }));
+    } else {
+      res.json(result.manifest);
+    }
+  } catch (error) {
+    logger.error('Failed to download backup manifest:', error);
+    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+  }
+});
+
+// Get manifest for specific backup
+router.get('/manifests/:backupId', adminAuth, async (req, res) => {
+  try {
+    const { backupId } = req.params;
+    const result = await getBackupManifest(backupId);
+    
+    res.json({
+      backupId,
+      manifest: result.manifest,
+      summary: result.summary
+    });
+  } catch (error) {
+    logger.error('Failed to get backup manifest:', error);
+    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+  }
+});
+
+// Download manifest file
+router.get('/manifests/:backupId/download', adminAuth, async (req, res) => {
+  try {
+    const { backupId } = req.params;
+    const { format = 'json' } = req.query;
+    
+    const result = await getBackupManifest(backupId);
+    
+    // Set appropriate headers
+    const filename = `backup-manifest-${backupId}.${format}`;
+    res.setHeader('Content-Type', format === 'yaml' ? 'text/yaml' : 'application/json');
+    res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+    
+    // Send the manifest in requested format
+    if (format === 'yaml') {
+      const yaml = require('js-yaml');
+      res.send(yaml.dump(result.manifest, {
+        indent: 2,
+        lineWidth: -1,
+        noRefs: true,
+        sortKeys: true
+      }));
+    } else {
+      res.json(result.manifest);
+    }
+  } catch (error) {
+    logger.error('Failed to download backup manifest:', error);
+    res.status(404).json({ error: error.message || 'Backup manifest not found' });
+  }
+});
+
+// Validate a manifest
+router.post('/manifests/validate', adminAuth, async (req, res) => {
+  try {
+    const { manifestPath, manifestData } = req.body;
+    
+    if (!manifestPath && !manifestData) {
+      return res.status(400).json({ error: 'Either manifestPath or manifestData is required' });
+    }
+    
+    if (manifestData) {
+      // Validate provided manifest data directly
+      const validationResult = await validateManifestData(manifestData);
+      return res.json(validationResult);
+    }
+    
+    // Use existing validation function for path
+    const result = await validateBackupManifest(manifestPath);
+    
+    res.json({
+      valid: result.valid,
+      error: result.error,
+      manifestPath
+    });
+  } catch (error) {
+    logger.error('Failed to validate manifest:', error);
+    res.status(500).json({ error: 'Failed to validate manifest' });
+  }
+});
+
+// List S3 buckets
+router.get('/s3/buckets', adminAuth, async (req, res) => {
+  try {
+    const config = await getBackupConfig();
+    
+    if (config.backup_destination_type !== 's3') {
+      return res.status(400).json({ error: 'S3 backup not configured' });
+    }
+    
+    const s3Adapter = new S3StorageAdapter({
+      endpoint: config.backup_s3_endpoint,
+      bucket: config.backup_s3_bucket,
+      accessKeyId: config.backup_s3_access_key,
+      secretAccessKey: config.backup_s3_secret_key,
+      region: config.backup_s3_region || 'us-east-1',
+      forcePathStyle: config.backup_s3_force_path_style || false
+    });
+    
+    // List buckets using the S3 client
+    const { ListBucketsCommand } = require('@aws-sdk/client-s3');
+    const result = await s3Adapter.s3Client.send(new ListBucketsCommand({}));
+    
+    res.json({
+      buckets: result.Buckets || [],
+      owner: result.Owner || null
+    });
+  } catch (error) {
+    logger.error('Failed to list S3 buckets:', error);
+    res.status(500).json({ error: 'Failed to list S3 buckets: ' + error.message });
+  }
+});
+
+// List files in S3 backup location
+router.get('/s3/files', adminAuth, async (req, res) => {
+  try {
+    const { prefix = '', maxKeys = 100, continuationToken } = req.query;
+    const config = await getBackupConfig();
+    
+    if (config.backup_destination_type !== 's3') {
+      return res.status(400).json({ error: 'S3 backup not configured' });
+    }
+    
+    const s3Adapter = new S3StorageAdapter({
+      endpoint: config.backup_s3_endpoint,
+      bucket: config.backup_s3_bucket,
+      accessKeyId: config.backup_s3_access_key,
+      secretAccessKey: config.backup_s3_secret_key,
+      region: config.backup_s3_region || 'us-east-1',
+      forcePathStyle: config.backup_s3_force_path_style || false
+    });
+    
+    const result = await s3Adapter.list(prefix, {
+      maxKeys: parseInt(maxKeys),
+      continuationToken
+    });
+    
+    res.json({
+      files: result.objects || [],
+      directories: result.directories || [],
+      isTruncated: result.isTruncated,
+      nextContinuationToken: result.nextContinuationToken,
+      prefix: prefix
+    });
+  } catch (error) {
+    logger.error('Failed to list S3 files:', error);
+    res.status(500).json({ error: 'Failed to list S3 files: ' + error.message });
+  }
+});
+
+// Clean up old S3 backups
+router.delete('/s3/cleanup', adminAuth, async (req, res) => {
+  try {
+    const { retentionDays = 30, dryRun = false } = req.body;
+    const config = await getBackupConfig();
+    
+    if (config.backup_destination_type !== 's3') {
+      return res.status(400).json({ error: 'S3 backup not configured' });
+    }
+    
+    const s3Adapter = new S3StorageAdapter({
+      endpoint: config.backup_s3_endpoint,
+      bucket: config.backup_s3_bucket,
+      accessKeyId: config.backup_s3_access_key,
+      secretAccessKey: config.backup_s3_secret_key,
+      region: config.backup_s3_region || 'us-east-1',
+      forcePathStyle: config.backup_s3_force_path_style || false
+    });
+    
+    const cutoffDate = new Date();
+    cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
+    
+    // List all backup files
+    const backupFiles = await s3Adapter.list('backups/', { maxKeys: 1000 });
+    const filesToDelete = [];
+    let totalSize = 0;
+    
+    for (const file of backupFiles.objects || []) {
+      if (file.lastModified && new Date(file.lastModified) < cutoffDate) {
+        filesToDelete.push(file.key);
+        totalSize += file.size || 0;
+      }
+    }
+    
+    if (dryRun) {
+      return res.json({
+        wouldDelete: filesToDelete.length,
+        totalSize: totalSize,
+        files: filesToDelete.slice(0, 100), // Limit preview
+        message: 'Dry run completed - no files were deleted'
+      });
+    }
+    
+    // Delete files in batches
+    const deleteResult = await s3Adapter.deleteMany(filesToDelete);
+    const deletedCount = deleteResult.Deleted ? deleteResult.Deleted.length : 0;
+    
+    // Also clean up database records
+    await cleanupOldBackupRuns(retentionDays);
+    
+    res.json({
+      success: true,
+      deletedCount: deletedCount,
+      totalSize: totalSize,
+      message: `Cleaned up ${deletedCount} S3 backup files older than ${retentionDays} days`
+    });
+  } catch (error) {
+    logger.error('Failed to cleanup S3 backups:', error);
+    res.status(500).json({ error: 'Failed to cleanup S3 backups: ' + error.message });
+  }
+});
+
+// Test S3 upload functionality
+router.post('/s3/test-upload', adminAuth, async (req, res) => {
+  try {
+    const config = await getBackupConfig();
+    
+    if (config.backup_destination_type !== 's3') {
+      return res.status(400).json({ error: 'S3 backup not configured' });
+    }
+    
+    const s3Adapter = new S3StorageAdapter({
+      endpoint: config.backup_s3_endpoint,
+      bucket: config.backup_s3_bucket,
+      accessKeyId: config.backup_s3_access_key,
+      secretAccessKey: config.backup_s3_secret_key,
+      region: config.backup_s3_region || 'us-east-1',
+      forcePathStyle: config.backup_s3_force_path_style || false
+    });
+    
+    // Create test content
+    const testKey = `test/backup-test-${Date.now()}.txt`;
+    const testContent = `PicPeak S3 backup test\nTimestamp: ${new Date().toISOString()}\nEndpoint: ${config.backup_s3_endpoint || 'AWS'}\nBucket: ${config.backup_s3_bucket}`;
+    
+    // Test upload
+    const uploadStart = Date.now();
+    await s3Adapter.upload(testKey, Buffer.from(testContent));
+    const uploadTime = Date.now() - uploadStart;
+    
+    // Test download
+    const downloadStart = Date.now();
+    const downloadedContent = await s3Adapter.download(testKey);
+    const downloadTime = Date.now() - downloadStart;
+    
+    // Verify content
+    const contentMatch = downloadedContent.toString() === testContent;
+    
+    // Test deletion
+    await s3Adapter.delete(testKey);
+    
+    res.json({
+      success: true,
+      testKey: testKey,
+      uploadTime: uploadTime,
+      downloadTime: downloadTime,
+      contentMatch: contentMatch,
+      message: 'S3 upload test completed successfully'
+    });
+  } catch (error) {
+    logger.error('S3 upload test failed:', error);
+    res.status(500).json({ error: 'S3 upload test failed: ' + error.message });
+  }
+});
+
+// Download entire backup
+router.get('/download/:backupId', adminAuth, async (req, res) => {
+  try {
+    const { backupId } = req.params;
+    
+    // Get backup run details
+    const backupRun = await db('backup_runs')
+      .where('id', backupId)
+      .first();
+    
+    if (!backupRun) {
+      return res.status(404).json({ error: 'Backup not found' });
+    }
+    
+    if (backupRun.status !== 'completed') {
+      return res.status(400).json({ error: 'Backup is not completed' });
+    }
+    
+    const config = await getBackupConfig();
+    
+    // Handle different backup types
+    switch (config.backup_destination_type) {
+      case 'local':
+        // Stream local backup as zip
+        const backupPath = path.join(config.backup_destination_path, `backup-${backupRun.id}`);
+        const archive = archiver('zip', { zlib: { level: 9 } });
+        
+        res.attachment(`picpeak-backup-${backupRun.id}.zip`);
+        archive.pipe(res);
+        
+        // Add backup directory contents
+        archive.directory(backupPath, false);
+        
+        // Add manifest if exists
+        if (backupRun.manifest_path && await fs.access(backupRun.manifest_path).then(() => true).catch(() => false)) {
+          archive.file(backupRun.manifest_path, { name: 'manifest.json' });
+        }
+        
+        await archive.finalize();
+        break;
+        
+      case 's3':
+        // For S3, provide pre-signed URLs or stream files
+        const s3Adapter = new S3StorageAdapter({
+          endpoint: config.backup_s3_endpoint,
+          bucket: config.backup_s3_bucket,
+          accessKeyId: config.backup_s3_access_key,
+          secretAccessKey: config.backup_s3_secret_key,
+          region: config.backup_s3_region || 'us-east-1',
+          forcePathStyle: config.backup_s3_force_path_style || false
+        });
+        
+        // List all files for this backup
+        const prefix = `backups/${backupRun.id}/`;
+        const files = await s3Adapter.list(prefix, { maxKeys: 1000 });
+        
+        // Generate pre-signed URLs
+        const urls = [];
+        for (const file of files.objects || []) {
+          const url = await s3Adapter.getSignedUrl('getObject', file.key, { expiresIn: 3600 }); // 1 hour
+          urls.push({
+            key: file.key,
+            size: file.size,
+            url: url
+          });
+        }
+        
+        res.json({
+          backupId: backupRun.id,
+          type: 's3',
+          files: urls,
+          expiresIn: 3600,
+          message: 'Use the provided URLs to download individual files'
+        });
+        break;
+        
+      case 'rsync':
+        return res.status(400).json({ error: 'Direct download not available for rsync backups' });
+        
+      default:
+        return res.status(400).json({ error: 'Unknown backup type' });
+    }
+  } catch (error) {
+    logger.error('Failed to download backup:', error);
+    res.status(500).json({ error: 'Failed to download backup: ' + error.message });
+  }
+});
+
+// Get current file checksums
+router.get('/checksums', adminAuth, async (req, res) => {
+  try {
+    const { path: targetPath = '', recursive = true } = req.query;
+    const checksums = {};
+    
+    // Get storage path
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    const basePath = targetPath ? path.join(storagePath, targetPath) : storagePath;
+    
+    // Calculate checksums for files
+    async function calculateDirChecksums(dirPath, relative = '') {
+      try {
+        const entries = await fs.readdir(dirPath, { withFileTypes: true });
+        
+        for (const entry of entries) {
+          const fullPath = path.join(dirPath, entry.name);
+          const relativePath = path.join(relative, entry.name);
+          
+          if (entry.isDirectory() && recursive) {
+            await calculateDirChecksums(fullPath, relativePath);
+          } else if (entry.isFile()) {
+            const hash = crypto.createHash('sha256');
+            const stream = require('fs').createReadStream(fullPath);
+            
+            await new Promise((resolve, reject) => {
+              stream.on('data', data => hash.update(data));
+              stream.on('end', () => {
+                checksums[relativePath] = {
+                  checksum: hash.digest('hex'),
+                  size: entry.size,
+                  modified: entry.mtime
+                };
+                resolve();
+              });
+              stream.on('error', reject);
+            });
+          }
+        }
+      } catch (error) {
+        logger.error(`Failed to calculate checksums for ${dirPath}:`, error);
+      }
+    }
+    
+    await calculateDirChecksums(basePath);
+    
+    // Also get database checksums from backup_file_states
+    const dbChecksums = await db('backup_file_states')
+      .select('file_path', 'checksum', 'size_bytes', 'last_modified');
+    
+    res.json({
+      currentChecksums: checksums,
+      totalFiles: Object.keys(checksums).length,
+      databaseChecksums: dbChecksums.reduce((acc, row) => {
+        acc[row.file_path] = {
+          checksum: row.checksum,
+          size: row.size_bytes,
+          modified: row.last_modified
+        };
+        return acc;
+      }, {}),
+      path: targetPath || '/'
+    });
+  } catch (error) {
+    logger.error('Failed to get file checksums:', error);
+    res.status(500).json({ error: 'Failed to get file checksums: ' + error.message });
+  }
+});
+
+// Estimate backup size before running
+router.post('/estimate', adminAuth, async (req, res) => {
+  try {
+    const { includeArchived = true } = req.body;
+    
+    // Get storage path
+    const storagePath = process.env.STORAGE_PATH || path.join(__dirname, '../../../storage');
+    let totalSize = 0;
+    let fileCount = 0;
+    const breakdown = {};
+    
+    // Estimate size for each directory
+    async function estimateDir(dirPath, category) {
+      let dirSize = 0;
+      let dirCount = 0;
+      
+      try {
+        const entries = await fs.readdir(dirPath, { withFileTypes: true });
+        
+        for (const entry of entries) {
+          const fullPath = path.join(dirPath, entry.name);
+          
+          if (entry.isDirectory()) {
+            const subResult = await estimateDir(fullPath, category);
+            dirSize += subResult.size;
+            dirCount += subResult.count;
+          } else if (entry.isFile()) {
+            const stats = await fs.stat(fullPath);
+            dirSize += stats.size;
+            dirCount++;
+          }
+        }
+      } catch (error) {
+        if (error.code !== 'ENOENT') {
+          logger.error(`Failed to estimate ${dirPath}:`, error);
+        }
+      }
+      
+      return { size: dirSize, count: dirCount };
+    }
+    
+    // Estimate each category
+    const categories = [
+      { path: 'events/active', name: 'Active Events' },
+      { path: 'thumbnails', name: 'Thumbnails' },
+      { path: 'uploads', name: 'Uploads' }
+    ];
+    
+    if (includeArchived) {
+      categories.push({ path: 'events/archived', name: 'Archived Events' });
+    }
+    
+    for (const category of categories) {
+      const result = await estimateDir(path.join(storagePath, category.path), category.name);
+      breakdown[category.name] = {
+        size: result.size,
+        sizeFormatted: formatBytes(result.size),
+        fileCount: result.count
+      };
+      totalSize += result.size;
+      fileCount += result.count;
+    }
+    
+    // Estimate database size
+    const dbPath = process.env.DB_TYPE === 'postgresql' 
+      ? null 
+      : path.join(__dirname, '../../database.sqlite');
+    
+    if (dbPath) {
+      try {
+        const dbStats = await fs.stat(dbPath);
+        breakdown['Database'] = {
+          size: dbStats.size,
+          sizeFormatted: formatBytes(dbStats.size),
+          fileCount: 1
+        };
+        totalSize += dbStats.size;
+        fileCount += 1;
+      } catch (error) {
+        logger.error('Failed to get database size:', error);
+      }
+    }
+    
+    // Estimate compression ratio (typically 20-40% for mixed media)
+    const estimatedCompressedSize = Math.round(totalSize * 0.7);
+    
+    res.json({
+      totalSize: totalSize,
+      totalSizeFormatted: formatBytes(totalSize),
+      estimatedCompressedSize: estimatedCompressedSize,
+      estimatedCompressedSizeFormatted: formatBytes(estimatedCompressedSize),
+      fileCount: fileCount,
+      breakdown: breakdown,
+      includeArchived: includeArchived,
+      estimatedDuration: Math.max(60, Math.round(totalSize / (50 * 1024 * 1024))), // Estimate 50MB/s
+      warnings: totalSize > 10 * 1024 * 1024 * 1024 ? ['Backup size exceeds 10GB, may take significant time'] : []
+    });
+  } catch (error) {
+    logger.error('Failed to estimate backup size:', error);
+    res.status(500).json({ error: 'Failed to estimate backup size: ' + error.message });
+  }
+});
+
+// Helper function to format bytes
+function formatBytes(bytes, decimals = 2) {
+  if (bytes === 0) return '0 Bytes';
+  const k = 1024;
+  const dm = decimals < 0 ? 0 : decimals;
+  const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(dm)) + ' ' + sizes[i];
+}
+
+// Helper function to get backup configuration
+async function getBackupConfig() {
+  try {
+    const settings = await db('app_settings')
+      .where('setting_type', 'backup')
+      .select('setting_key', 'setting_value');
+    
+    const config = {};
+    settings.forEach(setting => {
+      try {
+        config[setting.setting_key] = JSON.parse(setting.setting_value);
+      } catch (e) {
+        config[setting.setting_key] = setting.setting_value;
+      }
+    });
+    
+    return config;
+  } catch (error) {
+    logger.error('Failed to get backup configuration:', error);
+    return {};
+  }
+}
+
+// Helper function to validate manifest data
+async function validateManifestData(manifestData) {
+  try {
+    // Check required fields
+    const requiredFields = ['version', 'backupId', 'timestamp', 'files'];
+    const missingFields = requiredFields.filter(field => !manifestData[field]);
+    
+    if (missingFields.length > 0) {
+      return {
+        valid: false,
+        error: `Missing required fields: ${missingFields.join(', ')}`,
+        details: { missingFields }
+      };
+    }
+    
+    // Validate version
+    if (manifestData.version !== '1.0') {
+      return {
+        valid: false,
+        error: `Unsupported manifest version: ${manifestData.version}`,
+        details: { version: manifestData.version }
+      };
+    }
+    
+    // Validate files array
+    if (!Array.isArray(manifestData.files)) {
+      return {
+        valid: false,
+        error: 'Files must be an array',
+        details: { filesType: typeof manifestData.files }
+      };
+    }
+    
+    // Validate each file entry
+    const invalidFiles = [];
+    for (let i = 0; i < manifestData.files.length; i++) {
+      const file = manifestData.files[i];
+      if (!file.path || !file.checksum || typeof file.size !== 'number') {
+        invalidFiles.push({ index: i, file });
+      }
+    }
+    
+    if (invalidFiles.length > 0) {
+      return {
+        valid: false,
+        error: `Invalid file entries: ${invalidFiles.length}`,
+        details: { invalidFiles: invalidFiles.slice(0, 10) } // Limit to first 10
+      };
+    }
+    
+    return {
+      valid: true,
+      details: {
+        version: manifestData.version,
+        backupId: manifestData.backupId,
+        timestamp: manifestData.timestamp,
+        fileCount: manifestData.files.length,
+        totalSize: manifestData.files.reduce((sum, f) => sum + (f.size || 0), 0)
+      }
+    };
+  } catch (error) {
+    return {
+      valid: false,
+      error: `Validation error: ${error.message}`,
+      details: { error: error.message }
+    };
+  }
+}
+
+module.exports = router;
@@ -1,6 +1,7 @@
 const express = require('express');
 const { body, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
+const { formatBoolean } = require('../utils/dbCompat');
 const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();

@@ -8,7 +9,7 @@ const router = express.Router();
 router.get('/global', adminAuth, async (req, res) => {
  try {
    const categories = await db('photo_categories')
-      .where('is_global', true)
+      .where('is_global', formatBoolean(true))
      .orderBy('name', 'asc');
    
    res.json(categories);
@@ -25,7 +26,7 @@ router.get('/event/:eventId', adminAuth, async (req, res) => {
    
    const categories = await db('photo_categories')
      .where(function() {
-        this.where('is_global', true)
+        this.where('is_global', formatBoolean(true))
          .orWhere('event_id', eventId);
      })
      .orderBy('is_global', 'desc')
@@ -65,7 +66,7 @@ router.post('/', adminAuth, [
      .where('slug', categorySlug)
      .where(function() {
        if (is_global) {
-          this.where('is_global', true);
+          this.where('is_global', formatBoolean(true));
        } else {
          this.where('event_id', event_id);
        }
@@ -77,12 +78,14 @@ router.post('/', adminAuth, [
    }
    
    // Create category
-    const [categoryId] = await db('photo_categories').insert({
+    const insertResult = await db('photo_categories').insert({
      name,
      slug: categorySlug,
      is_global,
      event_id: is_global ? null : event_id
-    });
+    }).returning('id');
+    
+    const categoryId = insertResult[0]?.id || insertResult[0];
    
    const category = await db('photo_categories').where('id', categoryId).first();
    
--- a/Show More
+++ b/Show More