feat: Fix permission and env errors, add loggings, socket perm args

feat: implement Dockerfile and service scripts for yanpm-agent
feat: add agent module with Nginx service commands and routes
2025-12-21 18:52:26 +08:00 · 2025-12-21 17:51:43 +08:00 · 2025-12-21 15:32:42 +08:00 · 2025-12-20 19:01:04 +08:00 · 2025-12-20 18:48:35 +08:00 · 2025-12-20 18:23:43 +08:00
101 changed files with 7551 additions and 132 deletions
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -67,6 +67,34 @@ jobs:
      - name: Check code formatting
        run: cargo fmt --all -- --check

+  lint-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'pnpm'
+          cache-dependency-path: apps/frontend/pnpm-lock.yaml
+
+      - name: Install frontend dependencies
+        run: |
+          cd apps/frontend
+          pnpm install
+      
+      - name: Run frontend linter
+        run: |
+          cd apps/frontend
+          pnpm lint
+
  test-frontend:
    runs-on: ubuntu-latest
    steps:
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,3 +1,12 @@
 {
-  "cSpell.words": ["YANPM"]
+  "cSpell.words": ["chrono", "jsonwebtoken", "oneshot", "utoipa", "YANPM"],
+  "sqltools.useNodeRuntime": true,
+  "sqltools.connections": [
+    {
+      "previewLimit": 50,
+      "driver": "SQLite",
+      "database": "${workspaceFolder:yet-another-nginx-proxy-manager}/apps/container/generated/sqlite/sqlite.db",
+      "name": "YANPM"
+    }
+  ]
 }
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -93,6 +93,18 @@ dependencies = [
 "windows-sys 0.60.2",
 ]

+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+]
+
 [[package]]
 name = "arraydeque"
 version = "0.5.1"
@@ -212,6 +224,28 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "axum-extra"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbfe9f610fe4e99cf0cfcd03ccf8c63c28c616fe714d80475ef731f3b13dd21b"
+dependencies = [
+ "axum",
+ "axum-core",
+ "bytes",
+ "cookie",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
 [[package]]
 name = "axum-macros"
 version = "0.5.0"
@@ -223,6 +257,12 @@ dependencies = [
 "syn 2.0.110",
 ]

+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -282,6 +322,15 @@ dependencies = [
 "wyz",
 ]

+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -440,6 +489,16 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "chrono-tz"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6139a8597ed92cf816dfb33f5dd6cf0bb93a6adc938f11039f371bc5bcd26c3"
+dependencies = [
+ "chrono",
+ "phf",
+]
+
 [[package]]
 name = "clap"
 version = "4.5.53"
@@ -580,6 +639,17 @@ dependencies = [
 "unicode-segmentation",
 ]

+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "percent-encoding",
+ "time",
+ "version_check",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -630,6 +700,17 @@ version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"

+[[package]]
+name = "croner"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aa42bcd3d846ebf66e15bd528d1087f75d1c6c1c66ebff626178a106353c576"
+dependencies = [
+ "chrono",
+ "derive_builder",
+ "strum",
+]
+
 [[package]]
 name = "crossbeam-queue"
 version = "0.3.12"
@@ -651,6 +732,18 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"

+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -661,6 +754,33 @@ dependencies = [
 "typenum",
 ]

+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.110",
+]
+
 [[package]]
 name = "darling"
 version = "0.20.11"
@@ -691,6 +811,7 @@ dependencies = [
 "ident_case",
 "proc-macro2",
 "quote",
+ "strsim",
 "syn 2.0.110",
 ]

@@ -765,6 +886,37 @@ dependencies = [
 "serde_core",
 ]

+[[package]]
+name = "derive_builder"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+dependencies = [
+ "derive_builder_macro",
+]
+
+[[package]]
+name = "derive_builder_core"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+dependencies = [
+ "darling 0.20.11",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.110",
+]
+
+[[package]]
+name = "derive_builder_macro"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+dependencies = [
+ "derive_builder_core",
+ "syn 2.0.110",
+]
+
 [[package]]
 name = "derive_more"
 version = "2.0.1"
@@ -841,6 +993,44 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"

+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "serde",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "either"
 version = "1.15.0"
@@ -850,6 +1040,27 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "hkdf",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -925,6 +1136,22 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"

+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "filetime"
 version = "0.2.26"
@@ -1104,6 +1331,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
 "typenum",
 "version_check",
+ "zeroize",
 ]

 [[package]]
@@ -1135,6 +1363,17 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"

+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "h2"
 version = "0.4.12"
@@ -1288,9 +1527,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"

 [[package]]
 name = "hyper"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1744436df46f0bde35af3eda22aeaba453aada65d8f1c171cd8a5f59030bd69f"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -1612,6 +1851,29 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "jsonwebtoken"
+version = "10.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c76e1c7d7df3e34443b3621b459b066a7b79644f059fc8b2db7070c825fd417e"
+dependencies = [
+ "base64 0.22.1",
+ "ed25519-dalek",
+ "getrandom 0.2.16",
+ "hmac",
+ "js-sys",
+ "p256",
+ "p384",
+ "pem",
+ "rand 0.8.5",
+ "rsa",
+ "serde",
+ "serde_json",
+ "sha2",
+ "signature",
+ "simple_asn1",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -1797,7 +2059,7 @@ dependencies = [
 "num-integer",
 "num-iter",
 "num-traits",
- "rand",
+ "rand 0.8.5",
 "smallvec",
 "zeroize",
 ]
@@ -1808,6 +2070,17 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"

+[[package]]
+name = "num-derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.110",
+]
+
 [[package]]
 name = "num-integer"
 version = "0.1.46"
@@ -1937,6 +2210,30 @@ dependencies = [
 "syn 2.0.110",
 ]

+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -1991,6 +2288,17 @@ dependencies = [
 "syn 2.0.110",
 ]

+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "path-clean"
 version = "1.0.1"
@@ -2003,6 +2311,16 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"

+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
 [[package]]
 name = "pem-rfc7468"
 version = "0.7.0"
@@ -2070,6 +2388,24 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "phf"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "913273894cec178f401a31ec4b656318d95473527be05c0752cc41cdc32be8b7"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06005508882fb681fd97892ecff4b7fd0fee13ef1aa569f8695dae7ab9099981"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.16"
@@ -2153,6 +2489,15 @@ dependencies = [
 "syn 2.0.110",
 ]

+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.4.0"
@@ -2254,8 +2599,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
 "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
 ]

 [[package]]
@@ -2265,7 +2620,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
 "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
 ]

 [[package]]
@@ -2277,6 +2642,15 @@ dependencies = [
 "getrandom 0.2.16",
 ]

+[[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.3.5"
@@ -2353,6 +2727,16 @@ dependencies = [
 "bytecheck",
 ]

+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -2423,7 +2807,7 @@ dependencies = [
 "num-traits",
 "pkcs1",
 "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
 "signature",
 "spki",
 "subtle",
@@ -2450,12 +2834,21 @@ dependencies = [
 "borsh",
 "bytes",
 "num-traits",
- "rand",
+ "rand 0.8.5",
 "rkyv",
 "serde",
 "serde_json",
 ]

+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.2"
@@ -2765,6 +3158,20 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"

+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.11.1"
@@ -2801,6 +3208,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -2987,7 +3400,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
 "digest",
- "rand_core",
+ "rand_core 0.6.4",
 ]

 [[package]]
@@ -2996,6 +3409,24 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"

+[[package]]
+name = "simple_asn1"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "297f631f50729c8c99b84667867963997ec0b50f32b2a7dbcab828ef0541e8bb"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "siphasher"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+
 [[package]]
 name = "slab"
 version = "0.4.11"
@@ -3164,7 +3595,7 @@ dependencies = [
 "memchr",
 "once_cell",
 "percent-encoding",
- "rand",
+ "rand 0.8.5",
 "rsa",
 "rust_decimal",
 "serde",
@@ -3208,7 +3639,7 @@ dependencies = [
 "memchr",
 "num-bigint",
 "once_cell",
- "rand",
+ "rand 0.8.5",
 "rust_decimal",
 "serde",
 "serde_json",
@@ -3307,6 +3738,21 @@ name = "strum"
 version = "0.27.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.110",
+]

 [[package]]
 name = "subtle"
@@ -3513,6 +3959,22 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "tokio-cron-scheduler"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f50e41f200fd8ed426489bd356910ede4f053e30cebfbd59ef0f856f0d7432a"
+dependencies = [
+ "chrono",
+ "chrono-tz",
+ "croner",
+ "num-derive",
+ "num-traits",
+ "tokio",
+ "tracing",
+ "uuid",
+]
+
 [[package]]
 name = "tokio-macros"
 version = "2.6.0"
@@ -3632,6 +4094,20 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags 2.10.0",
+ "bytes",
+ "http",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
@@ -3847,12 +4323,14 @@ dependencies = [

 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "e2e054861b4bd027cd373e18e8d8d8e6548085000e41290d95ce0c373a654b4a"
 dependencies = [
+ "getrandom 0.3.4",
 "js-sys",
- "serde",
+ "rand 0.9.2",
+ "serde_core",
 "wasm-bindgen",
 ]

@@ -4340,6 +4818,20 @@ dependencies = [
 "hashlink",
 ]

+[[package]]
+name = "yanpm-agent"
+version = "0.1.0"
+dependencies = [
+ "axum",
+ "clap",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-cron-scheduler",
+ "tracing",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "yansi"
 version = "1.0.1"
@@ -4350,13 +4842,16 @@ checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 name = "yet-another-nginx-proxy-manager"
 version = "0.1.0"
 dependencies = [
+ "argon2",
 "async-trait",
 "axum",
+ "axum-extra",
 "chrono",
 "clap",
 "config",
 "database",
 "include_dir",
+ "jsonwebtoken",
 "migration",
 "mime_guess",
 "once_cell",
@@ -4365,9 +4860,11 @@ dependencies = [
 "serde_json",
 "tokio",
 "tower",
+ "tower-http",
 "tracing",
 "tracing-subscriber",
 "utoipa",
+ "uuid",
 ]

 [[package]]
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,6 +3,7 @@ members = [
    "apps/api",
    "apps/container",
    "apps/cli",
+    "apps/agent",
    "public/shared",
    "public/database",
    "public/migration"
--- a/apps/agent/.gitignore
+++ b/apps/agent/.gitignore
@@ -0,0 +1 @@
+*.sock
--- a/apps/agent/Cargo.toml
+++ b/apps/agent/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "yanpm-agent"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+axum = { version = "0.8.7", features = ["form", "http1", "json", "matched-path", "original-uri", "query", "tokio", "tower-log", "tracing", "macros"] }
+tokio = { version = "1", features = ["fs", "io-util", "io-std", "macros", "net", "parking_lot", "process", "rt", "rt-multi-thread", "signal", "sync", "time", "tracing"] }
+tracing = { version = "0.1.41", features = ["std", "attributes"] }
+tracing-subscriber = { version = "0.3.20", features = ["smallvec", "fmt", "ansi", "tracing-log", "std", "json", "serde", "serde_json", "time", "tracing"] }
+serde_json = { version = "1.0.145", features = ["std"] }
+serde = { version = "1.0.228", features = ["std", "derive"] }
+tokio-cron-scheduler = { version = "0.15.1", features = ["signal"] }
+clap = { version = "4", features = ["derive"] }
--- a/apps/agent/Dockerfile
+++ b/apps/agent/Dockerfile
@@ -0,0 +1,58 @@
+FROM rust:1.92-alpine3.23 AS builder
+
+# Install build deps and binutils (for strip)
+RUN apk add --no-cache build-base musl-dev openssl-dev pkgconfig ca-certificates curl binutils
+WORKDIR /app
+
+# Copy manifest first to leverage Docker layer caching for dependencies
+COPY ./Cargo.toml ./
+RUN cargo fetch --locked || true
+
+COPY ./src ./src
+
+# Build the release binary and strip it to reduce size
+RUN cargo build --release --bin yanpm-agent && \
+  strip target/release/yanpm-agent || true
+
+FROM nginx:mainline-alpine3.23 AS base
+
+# Expose typical HTTP ports used by nginx
+EXPOSE 80 443
+
+ENV S6_KEEP_ENV=1
+ENV YANPM_AGENT_SOCK=/var/run/yanpm/yanpm-agent.sock
+ENV YANPM_NGINX_CONFIG_DIR=/etc/nginx/conf.d
+ENV YANPM_AGENT_SOCK_PERM=660
+
+WORKDIR /app
+
+# Install ca-certificates for TLS and minimal tools
+RUN apk add --no-cache ca-certificates curl
+
+# Install s6-overlay
+ENV S6_OVERLAY_VERSION=v3.2.1.0
+ADD https://github.com/just-containers/s6-overlay/releases/download/${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
+RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && rm /tmp/s6-overlay-noarch.tar.xz
+ADD https://github.com/just-containers/s6-overlay/releases/download/${S6_OVERLAY_VERSION}/s6-overlay-x86_64.tar.xz /tmp/s6-overlay.tar.xz
+RUN tar -C / -Jxpf /tmp/s6-overlay.tar.xz && rm /tmp/s6-overlay.tar.xz
+
+# Create non-root user for agent and set permissions
+RUN addgroup -S app && adduser -S -G app app
+
+# add user to nginx group to allow reading of nginx configs
+RUN adduser app nginx
+# create directory for yanpm agent socket
+RUN mkdir -p /var/run/yanpm && chown -R app:app /var/run/yanpm
+
+# Copy s6 service definitions (created in repo under s6/) into image
+COPY ./docker/s6/services.d /etc/services.d
+RUN chmod +x /etc/services.d/*/run
+
+COPY --from=builder /app/target/release/yanpm-agent ./yanpm-agent
+
+RUN chown -R app:app /app/yanpm-agent \
+  && chmod +x /app/yanpm-agent \
+  && chown app:app /app
+
+# s6-overlay provides /init as the init process
+ENTRYPOINT ["/init"]
--- a/apps/agent/docker/s6/services.d/agent/run
+++ b/apps/agent/docker/s6/services.d/agent/run
@@ -0,0 +1,5 @@
+#!/bin/sh
+# Run the agent as the unprivileged 'app' user
+cd /app
+echo "Starting yanpm-agent..."
+exec s6-setuidgid app ./yanpm-agent
--- a/apps/agent/docker/s6/services.d/nginx/run
+++ b/apps/agent/docker/s6/services.d/nginx/run
@@ -0,0 +1,3 @@
+#!/bin/sh
+# Run nginx in foreground (s6 will supervise it)
+exec nginx -g 'daemon off;'
--- a/apps/agent/src/commands.rs
+++ b/apps/agent/src/commands.rs
@@ -0,0 +1,292 @@
+mod reload;
+mod run;
+mod validate;
+mod write_config;
+
+use std::{
+    collections::HashMap,
+    sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    },
+};
+
+use tokio::sync::{Mutex, RwLock};
+use tokio_cron_scheduler::{Job, JobScheduler};
+use tracing::{error, info};
+
+use crate::commands::write_config::INTERNAL_CONFIG_FOLDER_NAME;
+
+const OLD_CONFIG_CLEANUP_THRESHOLD: u64 = 3600;
+
+pub struct NginxService {
+    // lock for nginx reload, and timestamp tracking
+    nginx_lock: Mutex<()>,
+    last_applied: AtomicU64,
+    // lock for write_config per (config_name, timestamp)
+    #[allow(clippy::type_complexity)]
+    write_config_lock: RwLock<HashMap<(String, u64), Arc<RwLock<()>>>>,
+    // commands
+    reload_cmd: Arc<reload::ReloadCommand>,
+    validate_cmd: Arc<validate::ValidateCommand>,
+    write_config_cmd: Arc<write_config::WriteConfigCommand>,
+}
+
+impl NginxService {
+    pub async fn new(
+        scheduler: Arc<JobScheduler>,
+        nginx_config_dir: std::path::PathBuf,
+    ) -> Result<Arc<Self>, Box<dyn std::error::Error + Send + Sync>> {
+        let nginx_service = Arc::new(NginxService {
+            nginx_lock: Mutex::new(()),
+            last_applied: AtomicU64::new(0),
+            write_config_lock: RwLock::new(HashMap::new()),
+            // commands
+            reload_cmd: Arc::new(reload::ReloadCommand::default()),
+            validate_cmd: Arc::new(validate::ValidateCommand::new(nginx_config_dir.clone())),
+            write_config_cmd: Arc::new(write_config::WriteConfigCommand::new(nginx_config_dir)),
+        });
+        let mut nginx_service_clone = nginx_service.clone();
+
+        scheduler
+            .clone()
+            // cleanup every 10 minutes
+            .add(Job::new_async("0 */10 * * * *", move |_uuid, _l| {
+                info!("Running nginx_service cleanup job");
+                let nginx_service_clone = nginx_service_clone.clone();
+                let job = Box::pin(async move {
+                    nginx_service_clone.cleanup_unused_lock().await;
+                });
+                info!("NginxService cleanup job completed");
+                job
+            })?)
+            .await?;
+
+        nginx_service_clone = nginx_service.clone();
+
+        scheduler
+            .clone()
+            // cleanup every hour
+            .add(Job::new_async("0 0 */1 * * *", move |_uuid, _l| {
+                info!("Running nginx_service old config cleanup job");
+                let nginx_service_clone = nginx_service_clone.clone();
+                let job = Box::pin(async move {
+                    nginx_service_clone.cleanup_old_configs().await;
+                });
+                info!("NginxService old config cleanup job completed");
+                job
+            })?)
+            .await?;
+
+        Ok(nginx_service)
+    }
+
+    pub async fn validate_and_reload(
+        &self,
+        config_name: &str,
+        timestamp: u64,
+    ) -> Result<(i32, String), Box<dyn std::error::Error + Send + Sync>> {
+        let cur = self.last_applied.load(Ordering::SeqCst);
+        if cur > timestamp {
+            return Err("Another operation is in progress with higher timestamp value".into());
+        }
+
+        // acquire write lock to update nginx_lock
+        let _nginx_guard = self.nginx_lock.lock().await;
+        // acquire write lock for this config+timestamp
+        let rw_lock = self.acquire_file_write_lock(config_name, timestamp).await;
+        let _guard = rw_lock.write().await;
+
+        match self
+            .reload_cmd
+            .validate_and_reload(config_name, timestamp, self.validate_cmd.clone())
+            .await
+        {
+            Ok((code, output)) => {
+                // update last_applied
+                self.last_applied.store(timestamp, Ordering::SeqCst);
+                Ok((code, output))
+            }
+            Err(e) => Err(e),
+        }
+    }
+
+    pub async fn write_config(
+        &self,
+        config_name: &str,
+        timestamp: u64,
+        content: &str,
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        let rw_lock = self.acquire_file_write_lock(config_name, timestamp).await;
+        let _guard = rw_lock.write().await;
+        // call the write_config command
+        self.write_config_cmd
+            .write_config(config_name, timestamp, content)
+            .await
+    }
+
+    pub async fn validate(
+        &self,
+        config_name: &str,
+        timestamp: u64,
+    ) -> Result<(i32, String), Box<dyn std::error::Error + Send + Sync>> {
+        self.validate_cmd.validate(config_name, timestamp).await
+    }
+
+    async fn cleanup_unused_lock(&self) {
+        let mut _write_lock = self.write_config_lock.write().await;
+        (*_write_lock).retain(|_, lock| {
+            // retain only locks that are currently held (readers or writers)
+            lock.try_write().is_err()
+        });
+    }
+
+    async fn cleanup_old_configs(&self) {
+        // list all files within nginx_config_dir/YANPM that is older than now - OLD_CONFIG_CLEANUP_THRESHOLD
+        let cutoff = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_secs()
+            - OLD_CONFIG_CLEANUP_THRESHOLD;
+
+        let nginx_config_dir = self.validate_cmd.nginx_config_dir();
+        let yanpm_dir = nginx_config_dir.join(INTERNAL_CONFIG_FOLDER_NAME);
+
+        let read_dir = match tokio::fs::read_dir(&yanpm_dir).await {
+            Ok(rd) => rd,
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                // directory does not exist, nothing to clean up
+                return;
+            }
+            Err(e) => {
+                error!(
+                    "Error reading {} config directory {}: {}",
+                    INTERNAL_CONFIG_FOLDER_NAME,
+                    yanpm_dir.display(),
+                    e
+                );
+                return;
+            }
+        };
+
+        tokio::pin!(read_dir);
+        while let Some(entry) = read_dir.next_entry().await.unwrap_or(None) {
+            let metadata = match entry.metadata().await {
+                Ok(md) => md,
+                Err(e) => {
+                    error!(
+                        "Error getting metadata for file {}: {}",
+                        entry.path().display(),
+                        e
+                    );
+                    continue;
+                }
+            };
+            if let Ok(modified) = metadata.modified()
+                && let Ok(duration) = modified.duration_since(std::time::UNIX_EPOCH)
+            {
+                let mtime_secs = duration.as_secs();
+                if mtime_secs < cutoff {
+                    // file is older than cutoff, remove it
+                    if let Err(e) = tokio::fs::remove_file(entry.path()).await {
+                        error!(
+                            "Error removing old config file {}: {}",
+                            entry.path().display(),
+                            e
+                        );
+                    } else {
+                        info!("Removed old config file {}", entry.path().display());
+                    }
+                }
+            }
+        }
+    }
+
+    async fn acquire_file_write_lock(&self, config_name: &str, timestamp: u64) -> Arc<RwLock<()>> {
+        let mut write_lock = self.write_config_lock.write().await;
+        write_lock
+            .entry((config_name.to_string(), timestamp))
+            .or_insert_with(|| Arc::new(RwLock::new(())))
+            .clone()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::error::Error;
+    use std::sync::Arc as StdArc;
+    use tokio::time::{Duration, sleep};
+
+    impl NginxService {
+        // Test helper that simulates a long-running reload without invoking external commands.
+        pub async fn test_simulated_reload(
+            &self,
+            config_name: &str,
+            timestamp: u64,
+            delay_ms: u64,
+        ) -> Result<(), Box<dyn Error + Send + Sync>> {
+            // pre-check
+            let cur = self.last_applied.load(Ordering::SeqCst);
+            if cur >= timestamp {
+                return Err("stale".into());
+            }
+
+            // acquire exclusive lock and re-check
+            let _nginx_guard = self.nginx_lock.lock().await;
+            let cur2 = self.last_applied.load(Ordering::SeqCst);
+            if cur2 >= timestamp {
+                return Err("stale".into());
+            }
+
+            // per-file lock
+            let rw_lock = self.acquire_file_write_lock(config_name, timestamp).await;
+            let _guard = rw_lock.write().await;
+
+            // simulate operation
+            sleep(Duration::from_millis(delay_ms)).await;
+
+            // on success update last_applied
+            let mut prev = self.last_applied.load(Ordering::SeqCst);
+            while prev < timestamp {
+                match self.last_applied.compare_exchange(
+                    prev,
+                    timestamp,
+                    Ordering::SeqCst,
+                    Ordering::SeqCst,
+                ) {
+                    Ok(_) => break,
+                    Err(next) => prev = next,
+                }
+            }
+
+            Ok(())
+        }
+    }
+
+    #[tokio::test]
+    async fn concurrent_stale_is_rejected() {
+        let scheduler = StdArc::new(JobScheduler::new().await.unwrap());
+        let svc = NginxService::new(scheduler.clone(), std::env::temp_dir())
+            .await
+            .unwrap();
+
+        let s1 = svc.clone();
+        let h1 = tokio::spawn(async move { s1.test_simulated_reload("cfg", 2, 200).await });
+
+        // let second start shortly after first so it will wait for the mutex
+        sleep(Duration::from_millis(20)).await;
+
+        let s2 = svc.clone();
+        let h2 = tokio::spawn(async move { s2.test_simulated_reload("cfg", 1, 10).await });
+
+        let r1 = h1.await.unwrap();
+        assert!(r1.is_ok(), "first (newer) task should succeed");
+
+        let r2 = h2.await.unwrap();
+        assert!(
+            r2.is_err(),
+            "second (older) task should be rejected as stale"
+        );
+    }
+}
--- a/apps/agent/src/commands/reload.rs
+++ b/apps/agent/src/commands/reload.rs
@@ -0,0 +1,98 @@
+use std::path::Path;
+use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use tokio::sync::Mutex;
+use tracing::error;
+
+use crate::commands::write_config::INTERNAL_CONFIG_FOLDER_NAME;
+use crate::commands::{run::run_cmd, validate::ValidateCommand};
+
+pub struct ReloadCommand {
+    is_reloading: Mutex<bool>,
+}
+
+struct ReloadResetGuard<'a> {
+    guard: tokio::sync::MutexGuard<'a, bool>,
+}
+
+impl<'a> Drop for ReloadResetGuard<'a> {
+    fn drop(&mut self) {
+        *self.guard = false;
+    }
+}
+
+impl Default for ReloadCommand {
+    fn default() -> Self {
+        Self {
+            is_reloading: Mutex::new(false),
+        }
+    }
+}
+
+impl ReloadCommand {
+    pub async fn validate_and_reload(
+        &self,
+        config_name: &str,
+        timestamp: u64,
+        validate_cmd: Arc<ValidateCommand>,
+    ) -> Result<(i32, String), Box<dyn std::error::Error + Send + Sync>> {
+        // ensure the written fragment exists
+        validate_cmd.validate(config_name, timestamp).await?;
+
+        // Now atomically swap the YANPM.conf symlink to point to the new fragment
+        // so nginx -t validates the composed main config. If validation fails,
+        // attempt to restore the previous symlink.
+        let filename = crate::commands::run::to_file_name(config_name, timestamp)?;
+        let nginx_dir = validate_cmd.nginx_config_dir();
+        let symlink_path = nginx_dir.join("YANPM.conf");
+        let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos();
+        let tmp_name = format!("YANPM.conf.tmp.{}.{}", std::process::id(), now);
+        let tmp_path = nginx_dir.join(&tmp_name);
+
+        // prepare relative target: INTERNAL_CONFIG_FOLDER_NAME/<filename>
+        let rel_target = Path::new(INTERNAL_CONFIG_FOLDER_NAME).join(&filename);
+
+        // read previous target if exists
+        let previous_target = std::fs::read_link(&symlink_path).ok();
+
+        // Acquire reload guard before mutating the symlink to avoid races
+        let reloading_lock = self.is_reloading.lock().await;
+        if *reloading_lock {
+            return Err("Reload already in progress".into());
+        }
+        // set flag to true and ensure it is reset on drop
+        let mut mut_guard = reloading_lock;
+        *mut_guard = true;
+        let _reset_guard = ReloadResetGuard { guard: mut_guard };
+
+        // create temporary symlink and atomically rename into place
+        std::os::unix::fs::symlink(&rel_target, &tmp_path)?;
+        tokio::fs::rename(&tmp_path, &symlink_path).await?;
+
+        // validate composed main config now that symlink points to new fragment
+        if let Err(e) = validate_cmd.validate_all().await {
+            // restore previous symlink state while still holding the guard
+            if let Some(prev) = previous_target {
+                let restore_tmp =
+                    nginx_dir.join(format!("YANPM.conf.restore.{}.{}", std::process::id(), now));
+                std::os::unix::fs::symlink(&prev, &restore_tmp)?;
+                if let Err(err) = tokio::fs::rename(&restore_tmp, &symlink_path).await {
+                    error!(
+                        "Failed to restore previous YANPM.conf symlink after validation error: {}",
+                        err
+                    );
+                }
+            } else if let Err(err) = tokio::fs::remove_file(&symlink_path).await {
+                error!(
+                    "Failed to remove YANPM.conf symlink after validation error: {}",
+                    err
+                );
+            }
+            return Err(e);
+        }
+
+        // reload the running nginx master process (no -c) so it reloads its configured main config
+        run_cmd("nginx", &["-s", "reload"], 10).await
+    }
+}
--- a/apps/agent/src/commands/run.rs
+++ b/apps/agent/src/commands/run.rs
@@ -0,0 +1,85 @@
+use std::time::Duration;
+
+use tokio::{process::Command, time::timeout};
+use tracing::error;
+
+pub fn to_file_name(
+    config_name: &str,
+    timestamp: u64,
+) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+    // reject empty or unsafe names to avoid path traversal or invalid filesystem chars
+    if config_name.is_empty() {
+        return Err("config_name is empty".into());
+    }
+    if config_name.len() > 255 {
+        return Err("config_name too long".into());
+    }
+    if config_name.contains('/') || config_name.contains('\\') || config_name.contains("..") {
+        return Err("config_name contains invalid path characters".into());
+    }
+    if !config_name
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || "-._".contains(c))
+    {
+        return Err("config_name contains invalid characters".into());
+    }
+
+    Ok(format!("{}_{}.conf", timestamp, config_name))
+}
+
+pub async fn run_cmd(
+    cmd: &str,
+    args: &[&str],
+    dur_s: u64,
+) -> Result<(i32, String), Box<dyn std::error::Error + Send + Sync>> {
+    let mut c = Command::new(cmd);
+    c.args(args);
+    let res = timeout(Duration::from_secs(dur_s), c.output()).await;
+    let out = match res {
+        Ok(Ok(out)) => out,
+        Ok(Err(e)) => return Err(Box::new(e)),
+        Err(_) => {
+            return Err(Box::new(std::io::Error::new(
+                std::io::ErrorKind::TimedOut,
+                "command timeout",
+            )));
+        }
+    };
+    let code = out.status.code().unwrap_or(-1);
+    let output = String::from_utf8_lossy(&[out.stdout, out.stderr].concat()).to_string();
+    if code != 0 {
+        error!("command failed ({}): {}", code, output);
+        return Err(format!("command failed ({}): {}", code, output).into());
+    }
+    Ok((code, output))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::to_file_name;
+
+    #[test]
+    fn to_file_name_valid() {
+        let res = to_file_name("myconf", 1234).expect("should succeed");
+        assert_eq!(res, "1234_myconf.conf");
+    }
+
+    #[test]
+    fn to_file_name_empty() {
+        assert!(to_file_name("", 1).is_err());
+    }
+
+    #[test]
+    fn to_file_name_invalid_chars() {
+        assert!(to_file_name("bad/name", 1).is_err());
+        assert!(to_file_name("bad\\name", 1).is_err());
+        assert!(to_file_name("bad..name", 1).is_err());
+        assert!(to_file_name("bad$name", 1).is_err());
+    }
+
+    #[test]
+    fn to_file_name_too_long() {
+        let long = "a".repeat(300);
+        assert!(to_file_name(&long, 1).is_err());
+    }
+}
--- a/apps/agent/src/commands/validate.rs
+++ b/apps/agent/src/commands/validate.rs
@@ -0,0 +1,47 @@
+use crate::commands::{run::run_cmd, write_config::INTERNAL_CONFIG_FOLDER_NAME};
+use std::path::PathBuf;
+
+pub struct ValidateCommand {
+    nginx_config_dir: PathBuf,
+}
+
+impl ValidateCommand {
+    pub fn new(nginx_config_dir: PathBuf) -> Self {
+        Self { nginx_config_dir }
+    }
+
+    pub fn nginx_config_dir(&self) -> PathBuf {
+        self.nginx_config_dir.clone()
+    }
+
+    pub async fn validate_all(
+        &self,
+    ) -> Result<(i32, String), Box<dyn std::error::Error + Send + Sync>> {
+        run_cmd("nginx", &["-t"], 10).await
+    }
+
+    pub async fn validate(
+        &self,
+        config_name: &str,
+        timestamp: u64,
+    ) -> Result<(i32, String), Box<dyn std::error::Error + Send + Sync>> {
+        let filename = crate::commands::run::to_file_name(config_name, timestamp)?;
+        // fragments are written into the YANPM subdirectory
+        let full_path = self
+            .nginx_config_dir
+            .join(INTERNAL_CONFIG_FOLDER_NAME)
+            .join(&filename);
+
+        // ensure the fragment file exists
+        if tokio::fs::metadata(&full_path).await.is_err() {
+            return Err(format!("Config file not found: {}", full_path.display()).into());
+        }
+
+        run_cmd(
+            "nginx",
+            &["-t", "-c", full_path.to_str().ok_or("invalid config path")?],
+            10,
+        )
+        .await
+    }
+}
--- a/apps/agent/src/commands/write_config.rs
+++ b/apps/agent/src/commands/write_config.rs
@@ -0,0 +1,131 @@
+use std::os::unix::fs::PermissionsExt;
+use std::path::PathBuf;
+use std::time::{SystemTime, UNIX_EPOCH};
+use tokio::io::AsyncWriteExt;
+
+use crate::commands::run::to_file_name;
+
+pub const INTERNAL_CONFIG_FOLDER_NAME: &str = "YANPM";
+const FILE_SIZE_LIMIT: usize = 10 * 1024 * 1024; // 10MB
+
+pub struct WriteConfigCommand {
+    nginx_config_dir: PathBuf,
+}
+
+impl WriteConfigCommand {
+    pub fn new(nginx_config_dir: PathBuf) -> Self {
+        Self { nginx_config_dir }
+    }
+    pub async fn write_config(
+        &self,
+        config_name: &str,
+        timestamp: u64,
+        content: &str,
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        let filename = to_file_name(config_name, timestamp)?;
+        let path = self.nginx_config_dir.clone();
+        // ensure main config dir exists
+        tokio::fs::create_dir_all(&path).await?;
+
+        // create YANPM subdir where fragment files live
+        let yanpm_dir = path.join(INTERNAL_CONFIG_FOLDER_NAME);
+        tokio::fs::create_dir_all(&yanpm_dir).await?;
+        let final_path = yanpm_dir.join(&filename);
+
+        // limit size to 10MB
+        if content.len() > FILE_SIZE_LIMIT {
+            return Err(format!(
+                "content exceeds {}MB size limit",
+                FILE_SIZE_LIMIT / (1024 * 1024)
+            )
+            .into());
+        }
+
+        // create a temporary filename in the same directory for atomic replace
+        let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos();
+        let tmp_filename = format!("{}.tmp.{}.{}", filename, std::process::id(), now);
+        // create tmp file in the same directory as final file to ensure atomic rename
+        let tmp_path = yanpm_dir.join(tmp_filename);
+
+        let mut file = tokio::fs::OpenOptions::new()
+            .create(true)
+            .write(true)
+            .truncate(true)
+            .open(&tmp_path)
+            .await?;
+        file.write_all(content.as_bytes()).await?;
+        // ensure data is flushed to disk; propagate errors
+        file.sync_all().await?;
+
+        // atomically move the tmp file into the YANPM dir
+        tokio::fs::rename(&tmp_path, &final_path).await?;
+
+        // set explicit permissions (rw-r-----)
+        tokio::fs::set_permissions(&final_path, std::fs::Permissions::from_mode(0o640)).await?;
+
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{INTERNAL_CONFIG_FOLDER_NAME, WriteConfigCommand};
+    use std::time::SystemTime;
+    use std::time::UNIX_EPOCH;
+
+    #[tokio::test]
+    async fn write_config_success_and_cleanup() {
+        let base = std::env::temp_dir().join(format!(
+            "yanpm_test_{}_{}",
+            std::process::id(),
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        // ensure clean
+        let _ = tokio::fs::remove_dir_all(&base).await;
+        let cmd = WriteConfigCommand::new(base.clone());
+
+        let config_name = "unittest";
+        let timestamp = 42u64;
+        let content = "hello world";
+
+        cmd.write_config(config_name, timestamp, content)
+            .await
+            .expect("write should succeed");
+
+        let filename = super::to_file_name(config_name, timestamp).unwrap();
+        let final_path = base.join(INTERNAL_CONFIG_FOLDER_NAME).join(&filename);
+        let data = tokio::fs::read_to_string(&final_path)
+            .await
+            .expect("file should exist");
+        assert_eq!(data, content);
+
+        // cleanup
+        tokio::fs::remove_dir_all(&base).await.expect("cleanup");
+    }
+
+    #[tokio::test]
+    async fn write_config_size_limit() {
+        let base = std::env::temp_dir().join(format!(
+            "yanpm_test_{}_{}",
+            std::process::id(),
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let _ = tokio::fs::remove_dir_all(&base).await;
+        let cmd = WriteConfigCommand::new(base.clone());
+
+        // exceed 10MB limit
+        let large = vec![b'a'; 10 * 1024 * 1024 + 1];
+        let large_str = String::from_utf8_lossy(&large).to_string();
+
+        let res = cmd.write_config("big", 1, &large_str).await;
+        assert!(res.is_err());
+
+        let _ = tokio::fs::remove_dir_all(&base).await;
+    }
+}
--- a/apps/agent/src/main.rs
+++ b/apps/agent/src/main.rs
@@ -0,0 +1,190 @@
+#![forbid(unsafe_code)]
+
+mod commands;
+mod routes;
+
+use axum::routing::get;
+use axum::{Router, routing::post};
+use clap::{Arg, Command};
+use std::os::unix::fs::PermissionsExt;
+use std::path::PathBuf;
+use std::sync::Arc;
+use tokio::net::UnixListener;
+use tracing::{error, info, warn};
+
+use crate::commands::NginxService;
+use crate::routes::{status, validate, validate_and_reload, write_config};
+
+const SOCK_ARG: &str = "sock";
+const NGINX_CONFIG_DIR_ARG: &str = "nginx_config_dir";
+const SOCK_PERM_ARG: &str = "sock_perm";
+const SOCK_ENV: &str = "YANPM_AGENT_SOCK";
+const SOCK_PERM_ENV: &str = "YANPM_AGENT_SOCK_PERM";
+const NGINX_CONFIG_DIR_ENV: &str = "YANPM_NGINX_CONFIG_DIR";
+const SOCK_DEFAULT: &str = "./yanpm-agent.sock";
+const NGINX_CONFIG_DIR_DEFAULT: &str = "/etc/nginx/conf.d";
+const SOCK_PERM_DEFAULT: &str = "660";
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    let subscriber = tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::INFO)
+        .with_target(false)
+        .with_level(true)
+        .with_timer(tracing_subscriber::fmt::time::SystemTime)
+        .finish();
+
+    tracing::subscriber::set_global_default(subscriber)
+        .expect("Failed to set global default subscriber");
+
+    let args = Command::new("yanpm-agent")
+        .arg(
+            Arg::new("sock")
+                .short('s')
+                .long("sock")
+                .value_name("SOCK_PATH")
+                .help("Unix socket path to bind the agent daemon to")
+                .required(false),
+        )
+        .arg(
+            Arg::new("nginx_config_dir")
+                .short('d')
+                .long("nginx-config-dir")
+                .value_name("NGINX_CONFIG_DIR")
+                .help("Directory where generated nginx config files will be written")
+                .required(false),
+        )
+        .arg(
+            Arg::new("sock_perm")
+                .long("sock-perm")
+                .value_name("SOCK_PERM")
+                .help("Permissions to set on the unix socket (in octal), e.g. 660")
+                .required(false),
+        )
+        .about("YANPM Agent Daemon")
+        .get_matches();
+
+    let (sock, nginx_config_dir, sock_perm) = get_args(&args).await?;
+
+    let path = PathBuf::from(&sock);
+    if let Some(dir) = path.parent() {
+        tokio::fs::create_dir_all(dir).await.unwrap_or_else(|err| {
+            error!(
+                "Warning: failed to create socket directory {}: {}",
+                dir.display(),
+                err
+            )
+        });
+        // permissive; set tighter perms in production via image/build steps
+        tokio::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o770))
+            .await
+            .unwrap_or_else(|err| {
+                error!(
+                    "Warning: failed to set permissions on socket directory {}: {}",
+                    dir.display(),
+                    err
+                )
+            });
+    }
+    // If an existing path exists at the socket location, ensure it's a socket
+    match tokio::fs::metadata(&path).await {
+        Ok(md) => {
+            use std::os::unix::fs::FileTypeExt;
+            if md.file_type().is_socket() {
+                tokio::fs::remove_file(&path).await.unwrap_or_else(|err| {
+                    error!(
+                        "Warning: failed to remove existing socket file {}: {}",
+                        path.display(),
+                        err
+                    )
+                });
+            } else {
+                return Err(
+                    format!("Socket path {} exists and is not a socket", path.display()).into(),
+                );
+            }
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => {
+            return Err(format!("Failed to stat socket path {}: {}", path.display(), e).into());
+        }
+    }
+
+    // bind using tokio's UnixListener (avoids converting a blocking std listener)
+    let listener = UnixListener::bind(&path).expect("Failed to bind to unix socket");
+    // set socket perms to sock_perm (best-effort)
+    if let Err(err) =
+        tokio::fs::set_permissions(&path, std::fs::Permissions::from_mode(sock_perm)).await
+    {
+        error!(
+            "Warning: failed to set permissions on socket {}: {}",
+            path.display(),
+            err
+        );
+    }
+
+    let scheduler = Arc::new(tokio_cron_scheduler::JobScheduler::new().await?);
+
+    let app = Router::new()
+        .route("/status", get(status))
+        .route("/validate_and_reload", post(validate_and_reload))
+        .route("/validate", post(validate))
+        .route("/write_config", post(write_config))
+        .with_state(NginxService::new(scheduler.clone(), PathBuf::from(nginx_config_dir)).await?);
+
+    scheduler.clone().start().await?;
+
+    info!("Starting yanpm-daemon on unix socket: {}", sock);
+    axum::serve::serve(listener, app)
+        .await
+        .expect("Failed to start axum server");
+
+    info!("Shutting down yanpm-daemon");
+    Ok(())
+}
+
+async fn get_args(
+    args: &clap::ArgMatches,
+) -> Result<(String, String, u32), Box<dyn std::error::Error + Send + Sync>> {
+    let sock = args
+        .get_one::<String>(SOCK_ARG)
+        .cloned()
+        .unwrap_or_else(|| std::env::var(SOCK_ENV).unwrap_or_else(|_| SOCK_DEFAULT.to_string()));
+    let nginx_config_dir = args
+        .get_one::<String>(NGINX_CONFIG_DIR_ARG)
+        .cloned()
+        .unwrap_or_else(|| {
+            std::env::var(NGINX_CONFIG_DIR_ENV)
+                .unwrap_or_else(|_| NGINX_CONFIG_DIR_DEFAULT.to_string())
+        });
+    let sock_perm = args
+        .get_one::<String>(SOCK_PERM_ARG)
+        .cloned()
+        .unwrap_or_else(|| {
+            std::env::var(SOCK_PERM_ENV).unwrap_or_else(|_| SOCK_PERM_DEFAULT.to_string())
+        });
+
+    if sock_perm.len() != 3 || !sock_perm.chars().all(|c| ('0'..='7').contains(&c)) {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!(
+                "Invalid socket permission string: {}. Must be a 3-digit octal number.",
+                sock_perm
+            ),
+        )
+        .into());
+    }
+
+    if sock_perm.chars().last().unwrap() > '0' {
+        warn!(
+            "Socket permission string {} allows others to access the socket. This may be a security risk.",
+            sock_perm
+        );
+    };
+
+    Ok((
+        sock,
+        nginx_config_dir,
+        u32::from_str_radix(&sock_perm, 8).expect("Failed to parse socket permission string"),
+    ))
+}
--- a/apps/agent/src/routes.rs
+++ b/apps/agent/src/routes.rs
@@ -0,0 +1,130 @@
+use axum::Json;
+use axum::extract::State;
+use axum::http::StatusCode;
+use axum::response::IntoResponse;
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, from_value};
+use std::sync::Arc;
+use tracing::warn;
+
+use crate::commands::NginxService;
+
+#[derive(Serialize)]
+pub struct StatusResp {
+    pub ok: bool,
+}
+
+pub async fn status() -> impl IntoResponse {
+    let resp = StatusResp { ok: true };
+    (axum::http::StatusCode::OK, axum::Json(resp))
+}
+
+#[derive(Serialize)]
+pub struct ValidateAndReloadResp {
+    pub rc: i32,
+    pub ro: String,
+}
+
+#[derive(Deserialize)]
+pub struct ValidateBody {
+    config_name: String,
+    timestamp: u64,
+}
+
+pub async fn validate(
+    State(nginx_controller): State<Arc<NginxService>>,
+    Json(payload): Json<Value>,
+) -> impl IntoResponse {
+    let params: ValidateBody = match from_value(payload) {
+        Ok(req) => req,
+        Err(e) => {
+            warn!("Invalid validate request: {}", e);
+            return (StatusCode::BAD_REQUEST).into_response();
+        }
+    };
+
+    let (_code, _output) = match nginx_controller
+        .validate(&params.config_name, params.timestamp)
+        .await
+    {
+        Ok(res) => res,
+        Err(e) => {
+            let resp = serde_json::json!({ "error": e.to_string() });
+            return (StatusCode::INTERNAL_SERVER_ERROR, axum::Json(resp)).into_response();
+        }
+    };
+
+    (axum::http::StatusCode::OK,).into_response()
+}
+
+#[derive(Deserialize)]
+pub struct ValidateAndReloadBody {
+    config_name: String,
+    timestamp: u64,
+}
+
+pub async fn validate_and_reload(
+    State(nginx_controller): State<Arc<NginxService>>,
+    Json(payload): Json<Value>,
+) -> impl IntoResponse {
+    let params: ValidateAndReloadBody = match from_value(payload) {
+        Ok(req) => req,
+        Err(e) => {
+            warn!("Invalid validate_and_reload request: {}", e);
+            return (StatusCode::BAD_REQUEST).into_response();
+        }
+    };
+
+    let (code, output) = match nginx_controller
+        .validate_and_reload(&params.config_name, params.timestamp)
+        .await
+    {
+        Ok(res) => res,
+        Err(e) => {
+            let resp = ValidateAndReloadResp {
+                rc: -1,
+                ro: e.to_string(),
+            };
+            return (StatusCode::INTERNAL_SERVER_ERROR, axum::Json(resp)).into_response();
+        }
+    };
+
+    let resp = ValidateAndReloadResp {
+        rc: code,
+        ro: output,
+    };
+    (axum::http::StatusCode::OK, axum::Json(resp)).into_response()
+}
+
+#[derive(Deserialize)]
+pub struct WriteConfigBody {
+    config_name: String,
+    timestamp: u64,
+    content: String,
+}
+
+pub async fn write_config(
+    State(nginx_controller): State<Arc<NginxService>>,
+    Json(payload): Json<Value>,
+) -> impl IntoResponse {
+    let body: WriteConfigBody = match from_value(payload) {
+        Ok(req) => req,
+        Err(e) => {
+            warn!("Invalid write_config request: {}", e);
+            return (StatusCode::BAD_REQUEST).into_response();
+        }
+    };
+
+    match nginx_controller
+        .write_config(&body.config_name, body.timestamp, &body.content)
+        .await
+    {
+        Ok(_) => (),
+        Err(e) => {
+            let resp = serde_json::json!({ "error": e.to_string() });
+            return (StatusCode::INTERNAL_SERVER_ERROR, axum::Json(resp)).into_response();
+        }
+    };
+
+    (axum::http::StatusCode::OK,).into_response()
+}
--- a/apps/api/Cargo.toml
+++ b/apps/api/Cargo.toml
@@ -8,6 +8,7 @@ database = { path = "../../public/database" }
 migration = { path = "../../public/migration" }

 axum = { version = "0.8.7", features = ["form", "http1", "http2", "json", "matched-path", "original-uri", "query", "tokio", "tower-log", "tracing", "macros"] }
+axum-extra = { version = "0.12.2", features = ["cookie"] }
 async-trait = { version = "0.1.89" }
 chrono = { version = "0.4.42", features = ["clock", "std", "oldtime", "wasmbind", "serde"] }
 config = { version = "0.15.19", features = ["toml", "json", "yaml", "ini", "ron", "json5", "convert-case", "async"] }
@@ -23,3 +24,8 @@ mime_guess = { version = "2.0.5" }
 utoipa = { version = "5.4.0", features = ["macros", "axum_extras", "chrono", "decimal", "uuid", "time", "openapi_extensions"] }
 clap = { version = "4.5.53" }
 once_cell = { version = "1.21.3" }
+argon2 = { version = "0.5.3", features = ["std"] }
+jsonwebtoken = { version = "10.2.0", features = ["rust_crypto"] }
+uuid = { version = "1.19.0", features = ["v4", "serde", "fast-rng"] }
+tower-http = { version = "0.6.8", features = ["cors"] }
+
--- a/apps/api/src/cmd/start_server.rs
+++ b/apps/api/src/cmd/start_server.rs
@@ -12,7 +12,14 @@ use crate::{
    configs::{ProgramSettings, get_program_settings, logging::LoggingSettings},
    log,
    routes::{self, AppService, AppState},
-    services::settings::SettingsService,
+    services::{
+        auth::{
+            authentication::{AuthenticationServiceImpl, strategies::password::PasswordStrategy},
+            user::UserServiceImpl,
+        },
+        server_state::ServerStateService,
+        settings::SettingsService,
+    },
    tasks,
 };

@@ -58,6 +65,9 @@ pub async fn start_server() {

    tasks::startup::run_startup_tasks(&settings)
        .await
+        .inspect_err(|err| {
+            tracing::error!("Failed to run startup tasks: {}", err);
+        })
        .expect("Failed to run startup tasks");

    // setup database connection pool
@@ -78,7 +88,23 @@ pub async fn start_server() {

    // build the axum app and run the server...
    info!("Starting application...");
-    let app: Router = routes::get_root_router(Arc::new(get_app_state(&db_connection)));
+    let mut app: Router = routes::get_root_router(
+        Arc::new(get_app_state(&db_connection, &settings)),
+        Arc::new(settings.server.cors.clone()),
+    );
+
+    if settings.server.serve_openapi {
+        info!("Enabling OpenAPI documentation endpoint at /openapi.json");
+        app = app.route(
+            "/openapi.json",
+            axum::routing::get(|| async {
+                use utoipa::OpenApi;
+                let doc = routes::ApiDoc::openapi();
+                doc.to_pretty_json()
+                    .expect("Failed to serialize OpenAPI doc to JSON")
+            }),
+        );
+    }

    let address = format!("{}:{}", settings.server.address, settings.server.port);
    info!("Starting server at http://{}", address);
@@ -115,11 +141,25 @@ fn get_global_tracing_subscriber_builder(
    }
 }

-fn get_app_state(db_connection: &Arc<sea_orm::DatabaseConnection>) -> AppState {
+fn get_app_state(
+    db_connection: &Arc<sea_orm::DatabaseConnection>,
+    settings: &ProgramSettings,
+) -> AppState {
    AppState {
        database_connection: db_connection.clone(),
+        config: Arc::new(settings.clone()),
        service: Arc::new(AppService {
+            server_state: Arc::new(ServerStateService::new(db_connection.clone())),
            settings: Arc::new(SettingsService::new(db_connection.clone())),
+            auth_state: routes::AuthState {
+                strategy: routes::AuthStrategy {
+                    password: Arc::new(PasswordStrategy::new(db_connection.clone())),
+                },
+                authentication: Arc::new(AuthenticationServiceImpl::new(
+                    settings.auth.jwt_secret.clone(),
+                )),
+            },
+            user: Arc::new(UserServiceImpl::new(db_connection.clone())),
        }),
    }
 }
--- a/apps/api/src/configs.rs
+++ b/apps/api/src/configs.rs
@@ -1,3 +1,4 @@
+pub mod auth;
 pub mod database;
 pub mod logging;
 pub mod server;
@@ -10,6 +11,8 @@ use tracing::{debug, error};
 pub trait FromConfig: Sized {
    fn from_config(config: &Config) -> Result<Self, String>;
    fn validate(&self) -> Result<(), String>;
+    #[cfg(test)]
+    fn mock() -> Self;
 }

 #[derive(Debug, Clone)]
@@ -17,6 +20,7 @@ pub struct ProgramSettings {
    pub logging: logging::LoggingSettings,
    pub database: database::DatabaseSettings,
    pub server: server::ServerSettings,
+    pub auth: auth::AuthSettings,
 }

 impl FromConfig for ProgramSettings {
@@ -25,6 +29,7 @@ impl FromConfig for ProgramSettings {
            logging: logging::LoggingSettings::from_config(_config)?,
            database: database::DatabaseSettings::from_config(_config)?,
            server: server::ServerSettings::from_config(_config)?,
+            auth: auth::AuthSettings::from_config(_config)?,
        };
        config.validate()?;
        Ok(config)
@@ -34,8 +39,19 @@ impl FromConfig for ProgramSettings {
        self.logging.validate()?;
        self.database.validate()?;
        self.server.validate()?;
+        self.auth.validate()?;
        Ok(())
    }
+
+    #[cfg(test)]
+    fn mock() -> Self {
+        ProgramSettings {
+            logging: logging::LoggingSettings::mock(),
+            database: database::DatabaseSettings::mock(),
+            server: server::ServerSettings::mock(),
+            auth: auth::AuthSettings::mock(),
+        }
+    }
 }

 pub fn get_program_settings() -> ProgramSettings {
--- a/apps/api/src/configs/auth.rs
+++ b/apps/api/src/configs/auth.rs
@@ -0,0 +1,60 @@
+use config::{Config, ConfigError};
+use tracing::warn;
+
+use crate::configs::key::{
+    AUTH_DEFAULT_ADMIN_PASSWORD_KEY, AUTH_DEFAULT_ADMIN_USERNAME_KEY, AUTH_JWT_SECRET_KEY,
+};
+
+use super::FromConfig;
+
+#[derive(Debug, Clone)]
+pub struct AuthSettings {
+    pub jwt_secret: Option<String>,
+    pub default_admin_username: Option<String>,
+    pub default_admin_password: Option<String>,
+}
+
+impl FromConfig for AuthSettings {
+    fn from_config(_config: &Config) -> Result<Self, String> {
+        Ok(AuthSettings {
+            jwt_secret: _config
+                .get_string(AUTH_JWT_SECRET_KEY)
+                .inspect_err(|err| {
+                    match err {
+                        ConfigError::NotFound(_) => {
+                            warn!(
+                                "{} not found in configuration, A random secret will be generated at runtime.",
+                                AUTH_JWT_SECRET_KEY
+                            );
+                        }
+                        _ => {
+                            warn!(
+                                "Failed to read {} from configuration, A random secret will be generated at runtime: {}",
+                                AUTH_JWT_SECRET_KEY, err
+                            );
+                        }
+                    };
+                })
+                .ok(),
+            default_admin_username: _config
+                .get_string(AUTH_DEFAULT_ADMIN_USERNAME_KEY)
+                .ok(),
+            default_admin_password: _config
+                .get_string(AUTH_DEFAULT_ADMIN_PASSWORD_KEY)
+                .ok(),
+        })
+    }
+
+    fn validate(&self) -> Result<(), String> {
+        Ok(())
+    }
+
+    #[cfg(test)]
+    fn mock() -> Self {
+        AuthSettings {
+            jwt_secret: Some("mock_jwt_secret".to_string()),
+            default_admin_username: Some("admin".to_string()),
+            default_admin_password: Some("password".to_string()),
+        }
+    }
+}
--- a/apps/api/src/configs/database.rs
+++ b/apps/api/src/configs/database.rs
@@ -50,4 +50,13 @@ impl FromConfig for DatabaseSettings {
    fn validate(&self) -> Result<(), String> {
        Ok(())
    }
+
+    #[cfg(test)]
+    fn mock() -> Self {
+        DatabaseSettings {
+            url: "sqlite::memory:".to_string(),
+            max_connections: 5,
+            migrate_on_startup: true,
+        }
+    }
 }
--- a/apps/api/src/configs/key.rs
+++ b/apps/api/src/configs/key.rs
@@ -3,7 +3,14 @@ pub(crate) const LOGGING_UTC_KEY: &str = "LOGGING.UTC";
 //
 pub(crate) const SERVER_ADDRESS_KEY: &str = "SERVER.ADDRESS";
 pub(crate) const SERVER_PORT_KEY: &str = "SERVER.PORT";
+pub(crate) const SERVER_SERVE_OPENAPI_KEY: &str = "SERVER.SERVE_OPENAPI";
+pub(crate) const SERVER_CORS_ALLOWED_ORIGINS_KEY: &str = "SERVER.CORS.ALLOWED_ORIGINS";
+pub(crate) const SERVER_COOKIES_SECURE_KEY: &str = "SERVER.COOKIES.SECURE";
 //
 pub(crate) const DATABASE_URL_KEY: &str = "DATABASE.URL";
 pub(crate) const DATABASE_MAX_CONNECTIONS_KEY: &str = "DATABASE.MAX_CONNECTIONS";
 pub(crate) const DATABASE_MIGRATE_ON_STARTUP_KEY: &str = "DATABASE.MIGRATION.MIGRATE_ON_STARTUP";
+//
+pub(crate) const AUTH_JWT_SECRET_KEY: &str = "AUTH.JWT_SECRET";
+pub(crate) const AUTH_DEFAULT_ADMIN_USERNAME_KEY: &str = "AUTH.DEFAULT_ADMIN_USERNAME";
+pub(crate) const AUTH_DEFAULT_ADMIN_PASSWORD_KEY: &str = "AUTH.DEFAULT_ADMIN_PASSWORD";
--- a/apps/api/src/configs/logging.rs
+++ b/apps/api/src/configs/logging.rs
@@ -49,4 +49,12 @@ impl FromConfig for LoggingSettings {
    fn validate(&self) -> Result<(), String> {
        Ok(())
    }
+
+    #[cfg(test)]
+    fn mock() -> Self {
+        LoggingSettings {
+            level: Level::INFO,
+            utc: false,
+        }
+    }
 }
--- a/apps/api/src/configs/server.rs
+++ b/apps/api/src/configs/server.rs
@@ -3,6 +3,10 @@ use std::net::IpAddr;
 use config::{Config, ConfigError};
 use tracing::warn;

+use crate::configs::key::{
+    SERVER_COOKIES_SECURE_KEY, SERVER_CORS_ALLOWED_ORIGINS_KEY, SERVER_SERVE_OPENAPI_KEY,
+};
+
 use super::{
    FromConfig,
    key::{SERVER_ADDRESS_KEY, SERVER_PORT_KEY},
@@ -12,6 +16,19 @@ use super::{
 pub struct ServerSettings {
    pub address: IpAddr,
    pub port: u16,
+    pub serve_openapi: bool,
+    pub cors: CORSSettings,
+    pub cookies: CookiesSettings,
+}
+
+#[derive(Debug, Clone)]
+pub struct CORSSettings {
+    pub allowed_origins: Vec<String>,
+}
+
+#[derive(Debug, Clone)]
+pub struct CookiesSettings {
+    pub secure: bool,
 }

 impl FromConfig for ServerSettings {
@@ -43,6 +60,53 @@ impl FromConfig for ServerSettings {
                );
                DEFAULT_PORT
            }) as u16,
+
+            serve_openapi: _config
+                .get_bool(SERVER_SERVE_OPENAPI_KEY)
+                .unwrap_or_else(|err| {
+                    const DEFAULT_SERVE_OPENAPI: bool = false;
+                    warn!(
+                        "{} not set or invalid in configuration, defaulting to {}. Error: {}",
+                        SERVER_SERVE_OPENAPI_KEY, DEFAULT_SERVE_OPENAPI, err
+                    );
+                    DEFAULT_SERVE_OPENAPI
+                }),
+
+            cors: CORSSettings {
+                allowed_origins: _config
+                    .get_array(SERVER_CORS_ALLOWED_ORIGINS_KEY)
+                    .unwrap_or_else(|_| vec![])
+                    .into_iter()
+                    .filter_map(|val| match val.into_string() {
+                        Ok(s) => Some(s),
+                        Err(e) => {
+                            warn!(
+                                "Invalid origin in {} configuration: {}",
+                                SERVER_CORS_ALLOWED_ORIGINS_KEY, e
+                            );
+                            None
+                        }
+                    })
+                    .collect(),
+            },
+
+            cookies: CookiesSettings {
+                secure: _config
+                    .get_bool(SERVER_COOKIES_SECURE_KEY)
+                    .inspect(|is_secure| {
+                        if !*is_secure {
+                            warn!("Cookie 'secure' flag is disabled; this is not recommended in production environments.");
+                        }
+                    })
+                    .unwrap_or_else(|err| {
+                        const DEFAULT_COOKIES_SECURE: bool = true;
+                        warn!(
+                            "{} not set or invalid in configuration, defaulting to {}. Error: {}",
+                            SERVER_COOKIES_SECURE_KEY, DEFAULT_COOKIES_SECURE, err
+                        );
+                        DEFAULT_COOKIES_SECURE
+                    }),
+            },
        })
    }

@@ -53,4 +117,17 @@ impl FromConfig for ServerSettings {
        }
        Ok(())
    }
+
+    #[cfg(test)]
+    fn mock() -> Self {
+        ServerSettings {
+            address: "0.0.0.0".parse().unwrap(),
+            port: 8080,
+            serve_openapi: false,
+            cors: CORSSettings {
+                allowed_origins: vec![],
+            },
+            cookies: CookiesSettings { secure: true },
+        }
+    }
 }
--- a/apps/api/src/errors/service_error.rs
+++ b/apps/api/src/errors/service_error.rs
@@ -1,15 +1,39 @@
-pub type ServiceError = Box<dyn std::error::Error + Send + Sync>;
+use sea_orm::DbErr;

-#[allow(dead_code)] // TODO: remove when used
-pub trait IntoServiceError {
-    fn into_service_error(self) -> ServiceError;
+#[derive(Debug)]
+pub enum ServiceError {
+    NotFound(String),
+    DatabaseError(String),
+    Unauthorized(String),
+    InternalError(String),
+    BadRequest(String),
 }

-impl<T> IntoServiceError for T
-where
-    T: std::error::Error + Send + Sync + 'static,
-{
-    fn into_service_error(self) -> ServiceError {
-        Box::new(self)
+impl From<Box<dyn std::error::Error + Send + Sync + 'static>> for ServiceError {
+    fn from(err: Box<dyn std::error::Error + Send + Sync + 'static>) -> Self {
+        ServiceError::InternalError(err.to_string())
+    }
+}
+
+impl std::fmt::Display for ServiceError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ServiceError::NotFound(msg) => write!(f, "Not Found: {}", msg),
+            ServiceError::DatabaseError(msg) => write!(f, "Database Error: {}", msg),
+            ServiceError::Unauthorized(msg) => write!(f, "Unauthorized: {}", msg),
+            ServiceError::InternalError(msg) => write!(f, "Internal Error: {}", msg),
+            ServiceError::BadRequest(msg) => write!(f, "Bad Request: {}", msg),
+        }
+    }
+}
+
+impl std::error::Error for ServiceError {}
+
+impl From<DbErr> for ServiceError {
+    fn from(err: DbErr) -> Self {
+        match err {
+            DbErr::RecordNotFound(msg) => ServiceError::NotFound(msg),
+            _ => ServiceError::DatabaseError(err.to_string()),
+        }
    }
 }
--- a/apps/api/src/helpers.rs
+++ b/apps/api/src/helpers.rs
@@ -0,0 +1,2 @@
+pub mod constants;
+pub mod database;
--- a/apps/api/src/helpers/constants.rs
+++ b/apps/api/src/helpers/constants.rs
@@ -0,0 +1,3 @@
+pub const ADMIN_INIT_SECRET_KEY: &str = "admin_init_secret";
+//
+pub const JWT_COOKIE_NAME: &str = "session_jwt";
--- a/apps/api/src/helpers/database.rs
+++ b/apps/api/src/helpers/database.rs
@@ -0,0 +1,13 @@
+#[macro_export]
+macro_rules! with_conn {
+    // Usage: with_conn!(&connection, tx_option, ident, |conn|-> { ... })
+    ($conn:expr, $tx:expr, $ident:ident, $body:block) => {{
+        if let Some(t) = &$tx {
+            let $ident = t;
+            $body
+        } else {
+            let $ident = &$conn;
+            $body
+        }
+    }};
+}
--- a/apps/api/src/main.rs
+++ b/apps/api/src/main.rs
@@ -1,6 +1,9 @@
+#![forbid(unsafe_code)]
+
 mod cmd;
 mod configs;
 mod errors;
+mod helpers;
 mod log;
 mod middlewares;
 mod routes;
--- a/apps/api/src/middlewares.rs
+++ b/apps/api/src/middlewares.rs
@@ -1,25 +1,60 @@
+pub mod request_info;
+pub mod require_auth;
+
+use std::{sync::Arc, time::Duration};
+
 use axum::{
    BoxError, Router,
    error_handling::HandleErrorLayer,
-    http::{Method, StatusCode, Uri},
+    http::{HeaderValue, Method, StatusCode, Uri},
 };
-use std::time::Duration;
 use tower::{ServiceBuilder, timeout::TimeoutLayer};
-
+use tower_http::cors::{AllowHeaders, AllowOrigin, CorsLayer};
 use tracing::warn;

+use crate::{configs::server::CORSSettings, routes::AppState};
+
 pub const TIMEOUT_DURATION_SECS: u64 = 30;

-pub fn apply_root_middleware(router: Router) -> Router {
+pub fn apply_root_middleware(
+    router: Router,
+    _state: Arc<AppState>,
+    cors_settings: Arc<CORSSettings>,
+) -> Router {
    let timeout_layer = TimeoutLayer::new(Duration::from_secs(TIMEOUT_DURATION_SECS));

    let service_builder = ServiceBuilder::new()
        .layer(HandleErrorLayer::new(handle_timeout_error))
-        .layer(timeout_layer);
+        .layer(timeout_layer)
+        .layer(get_cors_layer(cors_settings));

    router.layer(service_builder)
 }

+pub fn get_cors_layer(cors_settings: Arc<CORSSettings>) -> CorsLayer {
+    let mut cors_layer = CorsLayer::new()
+        .allow_credentials(true)
+        .allow_headers(AllowHeaders::mirror_request());
+
+    let allowed_origins = &cors_settings.allowed_origins;
+    if allowed_origins.contains(&"*".to_string()) {
+        cors_layer = cors_layer.allow_origin(AllowOrigin::mirror_request());
+        warn!(
+            "Wildcard origin is found in allowed origins. CORS is configured to allow requests from any origin. Only use this setting in development or if you understand the security implications."
+        );
+    } else {
+        for origin in allowed_origins {
+            if let Ok(header_value) = HeaderValue::from_str(origin) {
+                cors_layer = cors_layer.allow_origin(AllowOrigin::exact(header_value));
+            } else {
+                warn!("Invalid CORS origin: {}", origin);
+            }
+        }
+    }
+
+    cors_layer
+}
+
 pub async fn handle_timeout_error(
    method: Method,
    uri: Uri,
--- a/apps/api/src/middlewares/request_info.rs
+++ b/apps/api/src/middlewares/request_info.rs
@@ -0,0 +1,6 @@
+use uuid::Uuid;
+
+#[derive(Clone, Debug)]
+pub struct RequestInfo {
+    pub user_id: Option<Uuid>,
+}
--- a/apps/api/src/middlewares/require_auth.rs
+++ b/apps/api/src/middlewares/require_auth.rs
@@ -0,0 +1,70 @@
+use std::sync::Arc;
+
+use axum::{
+    extract::State,
+    http::{Request, StatusCode},
+    middleware::Next,
+    response::Response,
+};
+use axum_extra::extract::cookie::CookieJar;
+use tracing::debug;
+use uuid::Uuid;
+
+use crate::{
+    errors::service_error::ServiceError, helpers::constants::JWT_COOKIE_NAME,
+    middlewares::request_info::RequestInfo, routes::AppState,
+};
+
+pub async fn require_auth(
+    cookies: CookieJar,
+    State(state): State<Arc<AppState>>,
+    req: Request<axum::body::Body>,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    // get jwt from cookies
+    let auth_service = &state.service.auth_state.authentication;
+    let token = if let Some(cookie) = cookies.get(JWT_COOKIE_NAME) {
+        cookie.value().to_string()
+    } else {
+        debug!("No JWT cookie found. cookies: {:?}", cookies);
+        return handle_unauthenticated().await;
+    };
+
+    // validate jwt
+    let is_valid = auth_service.is_valid_jwt(&token, None).await;
+    let user_id = match is_valid {
+        Ok(Some(claims)) => claims
+            .sub
+            .parse::<Uuid>()
+            .map_err(|_| StatusCode::UNAUTHORIZED)?,
+        Ok(None) => return handle_unauthenticated().await,
+        Err(err) => {
+            tracing::error!("Error validating JWT: {}", err);
+            return Err(StatusCode::INTERNAL_SERVER_ERROR);
+        }
+    };
+
+    // ensure user exists
+    if let Err(err) = state.service.user.get_user_by_id(user_id, None).await {
+        match err {
+            ServiceError::NotFound(_) => return handle_unauthenticated().await,
+            _ => {
+                tracing::error!("Error fetching user by ID: {}", err);
+                return Err(StatusCode::INTERNAL_SERVER_ERROR);
+            }
+        }
+    }
+
+    let mut req = req;
+    let user = req
+        .extensions_mut()
+        .get_or_insert_with(|| RequestInfo { user_id: None });
+    user.user_id = Some(user_id);
+
+    Ok(next.run(req).await)
+}
+
+async fn handle_unauthenticated() -> Result<Response, StatusCode> {
+    // TODO: log unauthenticated access attempts
+    Err(StatusCode::UNAUTHORIZED)
+}
--- a/apps/api/src/routes.rs
+++ b/apps/api/src/routes.rs
@@ -8,35 +8,58 @@ use std::sync::Arc;
 use axum::{Extension, Router};
 use migration::sea_orm::DatabaseConnection;

-use crate::{middlewares, services::settings::SettingsStore};
+use crate::{
+    configs::{ProgramSettings, server::CORSSettings},
+    middlewares,
+    services::{
+        auth::{
+            authentication::{AuthenticationService, strategies::password::PasswordStrategy},
+            user::UserService,
+        },
+        server_state::ServerStateStore,
+        settings::SettingsStore,
+    },
+};

 #[derive(Clone)]
 pub struct AppState {
-    // TODO: remove dead_code allowances when fields are used
-    #[allow(dead_code)]
    pub database_connection: Arc<DatabaseConnection>,
-    // TODO: remove dead_code allowances when fields are used
-    #[allow(dead_code)]
    pub service: Arc<AppService>,
+    pub config: Arc<ProgramSettings>,
 }

 pub type ServiceState<T> = Arc<T>;

-pub struct AppService {
-    #[allow(dead_code)] // TODO: remove when used
-    pub settings: ServiceState<dyn SettingsStore>,
+pub struct AuthStrategy {
+    pub password: ServiceState<PasswordStrategy>,
 }

-pub fn get_root_router(state: impl Into<Arc<AppState>>) -> Router {
+pub struct AuthState {
+    pub strategy: AuthStrategy,
+    pub authentication: ServiceState<dyn AuthenticationService>,
+}
+
+pub struct AppService {
+    pub settings: ServiceState<dyn SettingsStore>,
+    pub auth_state: AuthState,
+    pub user: ServiceState<dyn UserService>,
+    pub server_state: ServiceState<dyn ServerStateStore>,
+}
+
+pub fn get_root_router(
+    state: impl Into<Arc<AppState>>,
+    cors_settings: Arc<CORSSettings>,
+) -> Router {
    let mut router = Router::new();
+    let state = state.into();

    router = router
-        .nest("/api", api::get_api_router())
+        .nest("/api", api::get_api_router(state.clone()))
        .merge(view::get_view_router());

-    router = middlewares::apply_root_middleware(router);
+    router = middlewares::apply_root_middleware(router, state.clone(), cors_settings);

-    router = router.layer(Extension(state.into()));
+    router = router.layer(Extension(state.clone()));

    router
 }
--- a/apps/api/src/routes/api.rs
+++ b/apps/api/src/routes/api.rs
@@ -1,13 +1,21 @@
+mod auth;
 mod health;
 mod openapi;
+mod restricted;
+
+use std::sync::Arc;
+
+use crate::routes::AppState;

 pub use self::openapi::ApiDoc;

 use axum::{Router, response::IntoResponse, routing::any};

-pub fn get_api_router() -> Router {
+pub fn get_api_router(state: Arc<AppState>) -> Router {
    Router::new()
-        .nest("/health", health::get_health_router())
+        .nest("/health", health::get_health_router(state.clone()))
+        .merge(auth::get_basic_auth_router(state.clone()))
+        .merge(restricted::get_restricted_router(state.clone()))
        // explicit fallback for unmatched API routes
        .route("/{*wildcard}", any(api_fallback_handler))
 }
--- a/apps/api/src/routes/api/auth.rs
+++ b/apps/api/src/routes/api/auth.rs
@@ -0,0 +1,15 @@
+pub mod init_admin;
+pub mod login;
+
+use std::sync::Arc;
+
+use axum::{Router, routing::post};
+
+use crate::routes::AppState;
+
+pub fn get_basic_auth_router(state: Arc<AppState>) -> Router {
+    Router::new()
+        .route("/auth/login", post(login::login))
+        .route("/auth/init_admin", post(init_admin::init_admin))
+        .with_state(state)
+}
--- a/apps/api/src/routes/api/auth/init_admin.rs
+++ b/apps/api/src/routes/api/auth/init_admin.rs
@@ -0,0 +1,143 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    extract::State,
+    http::StatusCode,
+    response::{IntoResponse, Response},
+};
+use database::generated::entities::user;
+use sea_orm::{ColumnTrait, EntityTrait, QueryFilter, TransactionTrait};
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, from_value};
+use tracing::{debug, error, info, warn};
+
+use crate::{
+    helpers::constants::ADMIN_INIT_SECRET_KEY,
+    routes::{AppState, api::openapi::tag::AUTH_TAG},
+    services::auth::user::NewUser,
+};
+
+/// Login request payload
+#[derive(Serialize, Deserialize, utoipa::ToSchema)]
+pub struct AdminInitRequest {
+    username: String,
+    password: String,
+    // The secret key required to initialize the admin user
+    setup_secret: String,
+}
+
+/// Initializes the admin user
+///
+/// Initializes the admin user if no admin user exists and the correct setup secret is provided.
+#[utoipa::path(
+        post,
+        path = "/api/auth/init_admin",
+        request_body = AdminInitRequest,
+        responses(
+            (status = 200, description = "Admin user initialized successfully"),
+            (status = 400, description = "Invalid request payload"),
+            (status = 401, description = "Unauthorized: Admin user already exists or invalid setup secret"),
+            (status = 500, description = "Internal server error"),
+        ),
+        tag = AUTH_TAG,
+    )]
+pub async fn init_admin(
+    State(state): State<Arc<AppState>>,
+    Json(payload): Json<Value>,
+) -> Response {
+    if user::Entity::find()
+        .filter(user::Column::IsAdmin.eq(true))
+        .filter(user::Column::IsActive.eq(true))
+        .one(state.database_connection.as_ref())
+        .await
+        .map_err(|err| {
+            error!("Failed to query for existing admin user: {}", err);
+            StatusCode::INTERNAL_SERVER_ERROR
+        })
+        .unwrap_or(None)
+        .is_some()
+    {
+        warn!("Admin user already exists. Skipping admin initialization.");
+        return (StatusCode::UNAUTHORIZED).into_response();
+    }
+
+    let init_request: AdminInitRequest = match from_value(payload) {
+        Ok(req) => req,
+        Err(e) => {
+            warn!("Invalid login request: {}", e);
+            return (StatusCode::BAD_REQUEST).into_response();
+        }
+    };
+
+    let admin_secret = match state
+        .service
+        .settings
+        .get_setting(ADMIN_INIT_SECRET_KEY)
+        .await
+    {
+        Ok(secret) => secret,
+        Err(e) => {
+            error!(
+                "Failed to retrieve admin initialization secret. Invalid internal state?: {}",
+                e
+            );
+            return (StatusCode::INTERNAL_SERVER_ERROR).into_response();
+        }
+    };
+
+    if init_request.setup_secret != admin_secret {
+        info!("{},{}", init_request.setup_secret, admin_secret);
+        warn!("Invalid admin initialization secret provided.");
+        return (StatusCode::UNAUTHORIZED).into_response();
+    }
+
+    let mut tx = match state.database_connection.begin().await {
+        Ok(tx) => tx,
+        Err(e) => {
+            error!("Failed to start transaction: {}", e);
+            return (StatusCode::INTERNAL_SERVER_ERROR).into_response();
+        }
+    };
+
+    let user = match state
+        .service
+        .user
+        .create_user(
+            NewUser {
+                username: init_request.username,
+                is_admin: true,
+            },
+            Some(&mut tx),
+        )
+        .await
+    {
+        Ok(user) => user,
+        Err(e) => {
+            error!("Failed to initialize admin user: {}", e);
+            return (StatusCode::INTERNAL_SERVER_ERROR).into_response();
+        }
+    };
+
+    debug!("Created admin user with ID: {}", user.id);
+    match state
+        .service
+        .auth_state
+        .strategy
+        .password
+        .create_identity(user.id, &init_request.password, Some(&mut tx))
+        .await
+    {
+        Ok(_) => {}
+        Err(e) => {
+            error!("Failed to create admin user identity: {}", e);
+            return (StatusCode::INTERNAL_SERVER_ERROR).into_response();
+        }
+    };
+
+    tx.commit().await.unwrap_or_else(|e| {
+        error!("Failed to commit transaction: {}", e);
+    });
+
+    (StatusCode::OK).into_response()
+}
--- a/apps/api/src/routes/api/auth/login.rs
+++ b/apps/api/src/routes/api/auth/login.rs
@@ -0,0 +1,107 @@
+use std::sync::Arc;
+
+use axum::{
+    Json,
+    body::Body,
+    extract::State,
+    http::{StatusCode, header::SET_COOKIE},
+    response::{IntoResponse, Response},
+};
+use serde::{Deserialize, Serialize};
+use serde_json::{Value, from_value};
+use tracing::{error, warn};
+
+use crate::{
+    helpers::constants::JWT_COOKIE_NAME,
+    routes::{AppState, api::openapi::tag::AUTH_TAG},
+};
+
+/// Login request payload
+#[derive(Serialize, Deserialize, utoipa::ToSchema)]
+pub struct LoginRequest {
+    username: String,
+    password: String,
+}
+
+/// Login endpoint
+///
+/// Authenticates a user and returns a JWT in an HttpOnly cookie.
+#[utoipa::path(
+        post,
+        path = "/api/auth/login",
+        request_body = LoginRequest,
+        responses(
+            (status = 200, description = "User authenticated successfully", body = ()),
+            (status = 401, description = "Authentication failed"),
+            (status = 500, description = "Internal server error"),
+        ),
+        tag = AUTH_TAG,
+    )]
+pub async fn login(State(state): State<Arc<AppState>>, Json(payload): Json<Value>) -> Response {
+    let login_request: LoginRequest = match from_value(payload) {
+        Ok(req) => req,
+        Err(e) => {
+            warn!("Invalid login request: {}", e);
+            return (StatusCode::BAD_REQUEST).into_response();
+        }
+    };
+
+    let user_id = match state
+        .service
+        .auth_state
+        .strategy
+        .password
+        .authenticate(&login_request.username, &login_request.password, None)
+        .await
+    {
+        Ok(user_id) => user_id,
+        Err(e) => {
+            warn!(
+                "Authentication failed for user {}: {}",
+                login_request.username, e
+            );
+            return (StatusCode::UNAUTHORIZED).into_response();
+        }
+    };
+
+    let (jwt, claims) = match state
+        .service
+        .auth_state
+        .authentication
+        .generate_jwt(user_id, 3600)
+        .await
+    {
+        Ok(token) => token,
+        Err(e) => {
+            error!("Error generating JWT for user {}: {}", user_id, e);
+            return (StatusCode::INTERNAL_SERVER_ERROR).into_response();
+        }
+    };
+
+    let response_builder = Response::builder()
+        .status(StatusCode::OK)
+        // add jwt as cookie
+        .header(
+            SET_COOKIE,
+            format!(
+                "{}={}; HttpOnly; Path=/; Max-Age={}; SameSite=Strict;{}",
+                JWT_COOKIE_NAME,
+                jwt,
+                claims.exp - claims.iat,
+                if state.config.server.cookies.secure {
+                    " Secure;"
+                } else {
+                    ""
+                }
+            ),
+        )
+        .body(Body::from(()));
+
+    match response_builder {
+        Ok(resp) => resp,
+        Err(e) => {
+            error!("Error building response: {}", e);
+            (StatusCode::INTERNAL_SERVER_ERROR).into_response()
+        }
+    }
+}
--- a/apps/api/src/routes/api/health.rs
+++ b/apps/api/src/routes/api/health.rs
@@ -5,8 +5,13 @@ use std::sync::Arc;

 use axum::{Router, routing::get};

-pub fn get_health_router() -> Router {
+use crate::routes::{AppState, api::health::state::AppStateWithHealth};
+
+pub fn get_health_router(app_state: Arc<AppState>) -> Router {
    Router::new()
        .route("/info", get(info::get_health_info))
-        .with_state(Arc::new(state::HealthState::default()))
+        .with_state(Arc::new(AppStateWithHealth {
+            app_state: app_state.clone(),
+            health_state: Arc::new(state::HealthState::default()),
+        }))
 }
--- a/apps/api/src/routes/api/health/info.rs
+++ b/apps/api/src/routes/api/health/info.rs
@@ -3,8 +3,9 @@ use std::sync::Arc;
 use axum::{Json, extract::State, http::StatusCode};
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
+use tracing::error;

-use crate::routes::api::{health::state::HealthState, openapi::tag::HEALTH_TAG};
+use crate::routes::api::{health::state::AppStateWithHealth, openapi::tag::HEALTH_TAG};

 const STATUS_HEALTHY: &str = "healthy";
 const STATUS_UNHEALTHY: &str = "unhealthy";
@@ -20,6 +21,8 @@ pub struct HealthInfo {
    pub up_since: DateTime<Utc>,
    /// List of error messages if unhealthy
    pub errors: Option<Vec<String>>,
+    /// Is initialized
+    pub is_initialized: bool,
 }

 /// Health check endpoint
@@ -35,12 +38,23 @@ pub struct HealthInfo {
        tag = HEALTH_TAG,
    )]
 pub async fn get_health_info(
-    State(state): State<Arc<HealthState>>,
+    State(app_state_with_health): State<Arc<AppStateWithHealth>>,
 ) -> (StatusCode, Json<HealthInfo>) {
    #[allow(unused_mut)]
    let mut errors = vec![];

    let is_healthy = errors.is_empty();
+    let health_state = &app_state_with_health.health_state;
+    let app_state = &app_state_with_health.app_state;
+
+    let is_initialized = match app_state.service.server_state.is_server_initialized().await {
+        Ok(initialized) => initialized,
+        Err(err) => {
+            errors.push("Failed to determine if server is initialized".to_string());
+            error!("Error checking server initialization status: {}", err);
+            false
+        }
+    };

    (
        if is_healthy {
@@ -55,14 +69,30 @@ pub async fn get_health_info(
                STATUS_UNHEALTHY.into()
            },
            version: env!("CARGO_PKG_VERSION").into(),
-            up_since: *state.get_start_at(),
+            up_since: *health_state.get_start_at(),
            errors: if is_healthy { None } else { Some(errors) },
+            is_initialized,
        }),
    )
 }

 #[cfg(test)]
 mod test {
+    use crate::configs::FromConfig;
+    use crate::{
+        routes::{AppState, api::health::state::HealthState},
+        services::{
+            auth::{
+                authentication::{
+                    AuthenticationServiceImpl, strategies::password::PasswordStrategy,
+                },
+                user::UserServiceImpl,
+            },
+            server_state::ServerStateService,
+            settings::SettingsService,
+        },
+    };
+
    use super::*;
    use axum::body::to_bytes;
    use axum::{
@@ -70,14 +100,39 @@ mod test {
        body::Body,
        http::{Request, StatusCode},
    };
+    use sea_orm::MockDatabase;
    use tower::ServiceExt;

    #[tokio::test]
    async fn test_get_health_info() {
        let health_state = Arc::new(HealthState::default());
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![Vec::<sea_orm::MockRow>::new()])
+            .into_connection();
+        let db = Arc::new(db);
+
+        let app_state = Arc::new(AppState {
+            database_connection: db.clone(),
+            config: Arc::new(crate::configs::ProgramSettings::mock()),
+            service: Arc::new(crate::routes::AppService {
+                settings: Arc::new(SettingsService::new(db.clone())),
+                auth_state: crate::routes::AuthState {
+                    strategy: crate::routes::AuthStrategy {
+                        password: Arc::new(PasswordStrategy::new(db.clone())),
+                    },
+                    authentication: Arc::new(AuthenticationServiceImpl::new(None)),
+                },
+                user: Arc::new(UserServiceImpl::new(db.clone())),
+                server_state: Arc::new(ServerStateService::new(db.clone())),
+            }),
+        });
+
        let app = Router::new()
            .route("/info", axum::routing::get(get_health_info))
-            .with_state(health_state);
+            .with_state(Arc::new(AppStateWithHealth {
+                app_state: app_state.clone(),
+                health_state: health_state.clone(),
+            }));

        let response = app
            .oneshot(Request::builder().uri("/info").body(Body::empty()).unwrap())
--- a/apps/api/src/routes/api/health/state.rs
+++ b/apps/api/src/routes/api/health/state.rs
@@ -1,5 +1,14 @@
+use std::sync::Arc;
+
 use chrono::{DateTime, Utc};

+use crate::routes::AppState;
+
+pub struct AppStateWithHealth {
+    pub app_state: Arc<AppState>,
+    pub health_state: Arc<HealthState>,
+}
+
 pub struct HealthState {
    start_at: DateTime<Utc>,
 }
--- a/apps/api/src/routes/api/openapi.rs
+++ b/apps/api/src/routes/api/openapi.rs
@@ -1,18 +1,32 @@
 pub mod tag {
    /// Health tag constant
    pub const HEALTH_TAG: &str = "Health";
+    pub const AUTH_TAG: &str = "Authentication";
+    pub const USER_TAG: &str = "User";
 }

 #[derive(utoipa::OpenApi)]
 #[openapi(
  paths(
-    crate::routes::api::health::info::get_health_info
+    crate::routes::api::health::info::get_health_info,
+    // Authentication paths
+    crate::routes::api::auth::login::login,
+    crate::routes::api::auth::init_admin::init_admin,
+    // User management paths
+    crate::routes::api::restricted::user::me::get_user_info,
  ),
  components(
-      schemas(crate::routes::api::health::info::HealthInfo) // Register any schemas used in your paths
+      schemas(crate::routes::api::health::info::HealthInfo),
+      // Authentication schemas
+      schemas(crate::routes::api::auth::login::LoginRequest),
+      schemas(crate::routes::api::auth::init_admin::AdminInitRequest),
+      // User management schemas
+      schemas(crate::routes::api::restricted::user::me::UserInfo),
  ),
  tags(
-      (name = tag::HEALTH_TAG, description = "Health information API")
+      (name = tag::HEALTH_TAG, description = "Health information API"),
+      (name = tag::AUTH_TAG, description = "Authentication API"),
+      (name = tag::USER_TAG, description = "User management API")
  )
 )]
 pub struct ApiDoc;
--- a/apps/api/src/routes/api/restricted.rs
+++ b/apps/api/src/routes/api/restricted.rs
@@ -0,0 +1,16 @@
+pub mod user;
+
+use std::sync::Arc;
+
+use axum::Router;
+
+use crate::{middlewares::require_auth::require_auth, routes::AppState};
+
+pub fn get_restricted_router(state: Arc<AppState>) -> Router {
+    Router::new()
+        .nest("/user", user::get_user_router(state.clone()))
+        .layer(axum::middleware::from_fn_with_state(
+            state.clone(),
+            require_auth,
+        ))
+}
--- a/apps/api/src/routes/api/restricted/user.rs
+++ b/apps/api/src/routes/api/restricted/user.rs
@@ -0,0 +1,13 @@
+pub mod me;
+
+use std::sync::Arc;
+
+use axum::Router;
+
+use crate::routes::AppState;
+
+pub fn get_user_router(state: Arc<AppState>) -> Router {
+    Router::new()
+        .route("/me", axum::routing::get(me::get_user_info))
+        .with_state(state)
+}
--- a/apps/api/src/routes/api/restricted/user/me.rs
+++ b/apps/api/src/routes/api/restricted/user/me.rs
@@ -0,0 +1,64 @@
+use std::sync::Arc;
+
+use axum::{
+    Extension, Json,
+    extract::State,
+    http::StatusCode,
+    response::{IntoResponse, Response},
+};
+use serde::{Deserialize, Serialize};
+use tracing::error;
+
+use crate::{
+    middlewares::request_info::RequestInfo,
+    routes::{AppState, api::openapi::tag::USER_TAG},
+};
+
+/// System health information
+#[derive(Serialize, Deserialize, utoipa::ToSchema)]
+pub struct UserInfo {
+    /// User ID
+    pub id: uuid::Uuid,
+    /// Username
+    pub username: String,
+}
+
+/// Get current user information
+///
+/// Returns the information of the currently authenticated user.
+#[utoipa::path(
+        get,
+        path = "/api/user/me",
+        responses(
+            (status = 200, description = "User information retrieved successfully", body = UserInfo),
+            (status = 401, description = "Unauthorized"),
+            (status = 500, description = "Internal server error"),
+        ),
+        tag = USER_TAG,
+    )]
+pub async fn get_user_info(
+    State(app_state): State<Arc<AppState>>,
+    request_info: Extension<Arc<RequestInfo>>,
+) -> Response {
+    let user_id = match request_info.user_id {
+        Some(id) => id,
+        None => {
+            error!("User ID not found in request info");
+            return (StatusCode::UNAUTHORIZED).into_response();
+        }
+    };
+
+    match app_state.service.user.get_user_by_id(user_id, None).await {
+        Ok(user) => {
+            let user_info = UserInfo {
+                id: user.id,
+                username: user.username,
+            };
+            (StatusCode::OK, Json(user_info)).into_response()
+        }
+        Err(err) => {
+            error!("Error fetching user info: {}", err);
+            (StatusCode::INTERNAL_SERVER_ERROR).into_response()
+        }
+    }
+}
--- a/apps/api/src/services.rs
+++ b/apps/api/src/services.rs
@@ -1 +1,3 @@
+pub mod auth;
+pub mod server_state;
 pub mod settings;
--- a/apps/api/src/services/auth.rs
+++ b/apps/api/src/services/auth.rs
@@ -0,0 +1,2 @@
+pub mod authentication;
+pub mod user;
--- a/apps/api/src/services/auth/authentication.rs
+++ b/apps/api/src/services/auth/authentication.rs
@@ -0,0 +1,289 @@
+pub mod strategies;
+
+use std::{collections::HashSet, sync::Arc};
+
+use argon2::password_hash::{SaltString, rand_core::OsRng};
+use jsonwebtoken::{
+    DecodingKey, EncodingKey, Header, Validation, decode, encode,
+    errors::ErrorKind::{ExpiredSignature, InvalidSignature, InvalidSubject, InvalidToken},
+};
+use sea_orm::prelude::Uuid;
+use serde::{Deserialize, Serialize};
+use tokio::sync::RwLock;
+
+use crate::errors::service_error::ServiceError;
+
+// Number of requests between invalidation cache cleanups
+#[allow(dead_code)] // TODO: remove when used
+const INVALIDATE_CACHE_CLEANUP_INTERVAL_REQUESTS: usize = 100; // Cleanup every 100 for invalidation checks
+
+#[derive(Serialize, Deserialize, Clone)]
+pub struct Claims {
+    // Subject - user ID
+    pub sub: String,
+    // Issued at as UNIX timestamp
+    pub iat: u64,
+    // Expiration time as UNIX timestamp
+    pub exp: u64,
+}
+
+#[async_trait::async_trait]
+pub trait AuthenticationService: Send + Sync {
+    async fn generate_jwt(
+        &self,
+        user_id: Uuid,
+        duration_secs: u64,
+    ) -> Result<(String, Claims), ServiceError>;
+    async fn is_valid_jwt(
+        &self,
+        token: &str,
+        target_sub: Option<String>,
+    ) -> Result<Option<Claims>, ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn parse_jwt(&self, token: &str) -> Result<Claims, ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn invalidate_jwt(&self, token: &str) -> Result<(), ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn refresh_jwt(&self, token: &str, duration_secs: u64) -> Result<String, ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn logout(&self, token: &str) -> Result<(), ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn cleanup_invalidation_cache(&self);
+}
+
+#[derive(Eq, Hash, PartialEq)]
+struct InvalidationEntry {
+    token: String,
+    invalidated_at: u64,
+    valid_until: u64,
+}
+
+pub struct AuthenticationServiceImpl {
+    secret: String,
+    #[allow(dead_code)] // TODO: remove when used
+    invalidation_cache: Arc<RwLock<HashSet<InvalidationEntry>>>,
+    #[allow(dead_code)] // TODO: remove when used
+    cache_cleanup_counter: Arc<RwLock<usize>>,
+}
+
+impl AuthenticationServiceImpl {
+    pub fn new(secret: Option<String>) -> Self {
+        let secret = secret.unwrap_or_else(|| {
+            // generate a random secret if none is provided
+            SaltString::generate(&mut OsRng).as_str().to_owned()
+        });
+
+        Self {
+            secret,
+            invalidation_cache: Arc::new(RwLock::new(HashSet::new())),
+            cache_cleanup_counter: Arc::new(RwLock::new(0)),
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl AuthenticationService for AuthenticationServiceImpl {
+    async fn generate_jwt(
+        &self,
+        user_id: Uuid,
+        duration_secs: u64,
+    ) -> Result<(String, Claims), ServiceError> {
+        let header = Header::default();
+        let expiration = chrono::Utc::now()
+            .checked_add_signed(chrono::Duration::seconds(duration_secs as i64))
+            .ok_or(ServiceError::InternalError(
+                "Invalid expiration time".into(),
+            ))?
+            .timestamp() as u64;
+        let claims = Claims {
+            sub: user_id.to_string(),
+            iat: chrono::Utc::now().timestamp() as u64,
+            exp: expiration,
+        };
+        let token = encode(
+            &header,
+            &claims,
+            &EncodingKey::from_secret(self.secret.as_ref()),
+        )
+        .map_err(|e| ServiceError::InternalError(format!("JWT generation error: {}", e)))?;
+        Ok((token, claims))
+    }
+
+    async fn is_valid_jwt(
+        &self,
+        token: &str,
+        target_sub: Option<String>,
+    ) -> Result<Option<Claims>, ServiceError> {
+        let mut validation = Validation::default();
+        // disable leeway for strict expiration checking
+        validation.leeway = 0;
+        if let Some(expected_sub) = target_sub {
+            validation.sub = Some(expected_sub);
+        }
+        let decoding_key = DecodingKey::from_secret(self.secret.as_ref());
+        match decode::<Claims>(token, &decoding_key, &validation) {
+            Ok(data) => Ok(Some(data.claims)),
+            Err(err) => match *err.kind() {
+                InvalidToken | InvalidSubject | ExpiredSignature | InvalidSignature => Ok(None),
+                _ => Err(ServiceError::InternalError(format!(
+                    "JWT validation error: {}",
+                    err
+                ))),
+            },
+        }
+    }
+
+    async fn parse_jwt(&self, token: &str) -> Result<Claims, ServiceError> {
+        let decoding_key = DecodingKey::from_secret(self.secret.as_ref());
+        let token_data = decode::<Claims>(token, &decoding_key, &Validation::default())
+            .map_err(|e| ServiceError::InternalError(format!("JWT parsing error: {}", e)))?;
+        Ok(token_data.claims)
+    }
+
+    async fn invalidate_jwt(&self, token: &str) -> Result<(), ServiceError> {
+        let claims = self.parse_jwt(token).await?;
+        let valid_until = claims.exp;
+        let invalidated_at = chrono::Utc::now().timestamp() as u64;
+        let entry = InvalidationEntry {
+            token: token.to_string(),
+            invalidated_at,
+            valid_until,
+        };
+
+        {
+            self.invalidation_cache.write().await.insert(entry);
+        }
+        //
+        if self.cache_cleanup_counter.read().await.wrapping_add(1)
+            % INVALIDATE_CACHE_CLEANUP_INTERVAL_REQUESTS
+            == 0
+        {
+            self.cleanup_invalidation_cache().await;
+        }
+        //
+        Ok(())
+    }
+
+    async fn refresh_jwt(&self, token: &str, duration_secs: u64) -> Result<String, ServiceError> {
+        let claims = self.parse_jwt(token).await?;
+        let user_id = Uuid::parse_str(&claims.sub).map_err(|e| {
+            ServiceError::InternalError(format!("Invalid user ID in JWT claims: {}", e))
+        })?;
+        let (new_token, _) = self.generate_jwt(user_id, duration_secs).await?;
+        Ok(new_token)
+    }
+
+    async fn logout(&self, token: &str) -> Result<(), ServiceError> {
+        self.invalidate_jwt(token).await
+    }
+
+    async fn cleanup_invalidation_cache(&self) {
+        let now = chrono::Utc::now().timestamp() as u64;
+        let mut cache = self.invalidation_cache.write().await;
+        cache.retain(|entry| entry.valid_until > now);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::time::{Duration, sleep};
+
+    #[tokio::test]
+    async fn test_jwt_generation_and_validation() {
+        let service = AuthenticationServiceImpl::new(Some("secret".to_string()));
+
+        let user_id = Uuid::new_v4();
+        let (token, _) = service
+            .generate_jwt(user_id, 60)
+            .await
+            .expect("generate jwt");
+
+        let valid = service
+            .is_valid_jwt(&token, None)
+            .await
+            .expect("validate jwt");
+        assert!(valid.is_some(), "Generated token should be valid");
+        let claims = service.parse_jwt(&token).await.expect("parse jwt");
+        assert_eq!(claims.sub, user_id.to_string());
+    }
+
+    #[tokio::test]
+    async fn test_jwt_validation_with_wrong_subject() {
+        let service = AuthenticationServiceImpl::new(Some("secret".to_string()));
+
+        let user_id = Uuid::new_v4();
+        let (token, _) = service.generate_jwt(user_id, 60).await.unwrap();
+
+        let other_sub = Uuid::new_v4().to_string();
+        let valid = service.is_valid_jwt(&token, Some(other_sub)).await.unwrap();
+        assert!(
+            valid.is_none(),
+            "Token should be invalid for a different subject"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_parse_jwt_invalid_token() {
+        let service = AuthenticationServiceImpl::new(Some("secret".to_string()));
+
+        let res = service.parse_jwt("not_a_token").await;
+        assert!(matches!(res, Err(ServiceError::InternalError(_))));
+    }
+
+    #[tokio::test]
+    async fn test_refresh_jwt() {
+        let service = AuthenticationServiceImpl::new(Some("secret".to_string()));
+
+        let user_id = Uuid::new_v4();
+        let (token, _) = service.generate_jwt(user_id, 60).await.unwrap();
+        let new_token = service.refresh_jwt(&token, 120).await.unwrap();
+
+        let claims = service.parse_jwt(&new_token).await.unwrap();
+        assert_eq!(claims.sub, user_id.to_string());
+        assert_eq!(claims.exp - claims.iat, 120);
+    }
+
+    #[tokio::test]
+    async fn test_is_valid_jwt_expired() {
+        let service = AuthenticationServiceImpl::new(Some("secret".to_string()));
+
+        let user_id = Uuid::new_v4();
+        let (token, claims) = service.generate_jwt(user_id, 1).await.unwrap();
+        sleep(Duration::from_secs(2)).await;
+
+        let valid = service.is_valid_jwt(&token, None).await.unwrap();
+        assert!(
+            valid.is_none(),
+            "Token should be expired and thus invalid. Current time: {:?}. Diff: {}",
+            chrono::Utc::now(),
+            chrono::Utc::now().timestamp() - claims.exp as i64
+        );
+    }
+
+    #[tokio::test]
+    async fn test_invalidate_and_cleanup() {
+        let service = AuthenticationServiceImpl::new(Some("secret".to_string()));
+
+        let user_id = Uuid::new_v4();
+        let (token, _) = service.generate_jwt(user_id, 1).await.unwrap();
+
+        service.invalidate_jwt(&token).await.unwrap();
+
+        // ensure entry is present
+        {
+            let cache = service.invalidation_cache.read().await;
+            assert!(cache.iter().any(|e| e.token == token));
+        }
+
+        // wait until token validity ends and cleanup
+        sleep(Duration::from_secs(2)).await;
+        service.cleanup_invalidation_cache().await;
+
+        let cache = service.invalidation_cache.read().await;
+        assert!(
+            cache.is_empty(),
+            "Cleanup should remove expired invalidation entries"
+        );
+    }
+}
--- a/apps/api/src/services/auth/authentication/strategies.rs
+++ b/apps/api/src/services/auth/authentication/strategies.rs
@@ -0,0 +1 @@
+pub mod password;
--- a/apps/api/src/services/auth/authentication/strategies/password.rs
+++ b/apps/api/src/services/auth/authentication/strategies/password.rs
@@ -0,0 +1,490 @@
+use std::sync::Arc;
+
+use crate::{errors::service_error::ServiceError, with_conn};
+use argon2::{
+    Argon2,
+    password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString, rand_core::OsRng},
+};
+use database::generated::entities::{user, user_identity};
+use sea_orm::{
+    ColumnTrait, DatabaseConnection, DatabaseTransaction, EntityTrait, IntoActiveModel,
+    QueryFilter, prelude::Uuid,
+};
+
+pub struct PasswordStrategy {
+    connection: Arc<DatabaseConnection>,
+}
+
+const MAX_PASSWORD_LENGTH: usize = 32;
+const PASSWORD_PROVIDER: &str = "password";
+
+impl PasswordStrategy {
+    pub fn new(connection: Arc<DatabaseConnection>) -> Self {
+        Self { connection }
+    }
+
+    pub async fn authenticate(
+        &self,
+        username: &str,
+        password: &str,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<Uuid, ServiceError> {
+        // Find user by username
+        let user = with_conn!(&*self.connection, tx, conn, {
+            user::Entity::find()
+                .filter(user::Column::Name.eq(username))
+                .one(*conn)
+                .await?
+                .ok_or_else(|| {
+                    ServiceError::Unauthorized("Invalid username or password".to_string())
+                })?
+        });
+        // Get user's identity
+        let identity = with_conn!(&*self.connection, tx, conn, {
+            user_identity::Entity::find()
+                .filter(user_identity::Column::UserId.eq(user.id))
+                .one(*conn)
+                .await?
+                .ok_or_else(|| {
+                    ServiceError::Unauthorized("Invalid username or password".to_string())
+                })?
+        });
+
+        // Check if revoked
+        if identity.is_revoked {
+            return Err(ServiceError::Unauthorized("Account is revoked".to_string()));
+        }
+
+        // Verify password
+        let password_hash = identity
+            .password_hash
+            .ok_or_else(|| ServiceError::InternalError("Invalid password hash".to_string()))?;
+        let parsed_hash = PasswordHash::new(&password_hash)
+            .map_err(|_| ServiceError::InternalError("Invalid password hash".to_string()))?;
+
+        Argon2::default()
+            .verify_password(password.as_bytes(), &parsed_hash)
+            .map_err(|_| ServiceError::Unauthorized("Invalid username or password".to_string()))?;
+
+        Ok(user.id)
+    }
+    #[allow(dead_code)] // TODO: remove when used
+    pub async fn revoke_identity(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<(), ServiceError> {
+        let mut identity = with_conn!(&*self.connection, tx, conn, {
+            user_identity::Entity::find()
+                .filter(user_identity::Column::UserId.eq(user_id))
+                .one(*conn)
+                .await?
+                .ok_or_else(|| ServiceError::NotFound("User identity not found".to_string()))?
+        });
+
+        identity.is_revoked = true;
+
+        with_conn!(&*self.connection, tx, conn, {
+            user_identity::Entity::update(identity.into_active_model())
+                .exec(*conn)
+                .await
+                .map_err(ServiceError::from)
+        })?;
+
+        Ok(())
+    }
+
+    pub async fn create_identity(
+        &self,
+        user_id: Uuid,
+        password: &str,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<(), ServiceError> {
+        Self::is_valid_password(password).map_err(ServiceError::BadRequest)?;
+
+        // If an identity already exists for this user/provider, treat as success.
+        // This also allows tests using MockDatabase to provide a query result
+        // for an existing identity without requiring an insert exec result.
+        let existing = with_conn!(&*self.connection, tx, conn, {
+            user_identity::Entity::find()
+                .filter(user_identity::Column::UserId.eq(user_id))
+                .filter(user_identity::Column::Provider.eq(PASSWORD_PROVIDER.to_string()))
+                .one(*conn)
+                .await?
+        });
+
+        if existing.is_some() {
+            return Err(ServiceError::BadRequest(
+                "Identity already exists".to_string(),
+            ));
+        }
+
+        let password_hash = Argon2::default()
+            .hash_password(password.as_bytes(), &SaltString::generate(&mut OsRng))
+            .map_err(|_| ServiceError::InternalError("Failed to hash password".to_string()))?
+            .to_string();
+
+        let new_identity = user_identity::ActiveModel {
+            id: sea_orm::ActiveValue::Set(Uuid::new_v4()),
+            user_id: sea_orm::ActiveValue::Set(user_id),
+            provider: sea_orm::ActiveValue::Set(PASSWORD_PROVIDER.to_string()),
+            password_hash: sea_orm::ActiveValue::Set(Some(password_hash)),
+            metadata: sea_orm::ActiveValue::Set(None),
+            is_revoked: sea_orm::ActiveValue::Set(false),
+            ..Default::default()
+        };
+
+        with_conn!(&*self.connection, tx, conn, {
+            user_identity::Entity::insert(new_identity)
+                .exec(*conn)
+                .await
+                .map_err(ServiceError::from)
+        })?;
+
+        Ok(())
+    }
+    #[allow(dead_code)] // TODO: remove when used
+    pub async fn update_password(
+        &self,
+        user_id: Uuid,
+        new_password: &str,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<(), ServiceError> {
+        Self::is_valid_password(new_password).map_err(ServiceError::BadRequest)?;
+
+        let password_hash = Argon2::default()
+            .hash_password(new_password.as_bytes(), &SaltString::generate(&mut OsRng))
+            .map_err(|_| ServiceError::InternalError("Failed to hash password".to_string()))?
+            .to_string();
+
+        let mut identity = with_conn!(&*self.connection, tx, conn, {
+            user_identity::Entity::find()
+                .filter(user_identity::Column::UserId.eq(user_id))
+                .one(*conn)
+                .await?
+                .ok_or_else(|| ServiceError::NotFound("User identity not found".to_string()))?
+        });
+
+        identity.password_hash = Some(password_hash);
+        identity.password_changed_at = Some(chrono::Utc::now());
+
+        with_conn!(&*self.connection, tx, conn, {
+            user_identity::Entity::update(identity.into_active_model())
+                .exec(*conn)
+                .await
+                .map_err(ServiceError::from)
+        })?;
+
+        Ok(())
+    }
+
+    fn is_valid_password(password: &str) -> Result<(), String> {
+        if password.is_empty() {
+            return Err("Password cannot be empty".to_string());
+        }
+        if password.len() > MAX_PASSWORD_LENGTH {
+            return Err(format!(
+                "Password cannot be longer than {} characters",
+                MAX_PASSWORD_LENGTH
+            ));
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use database::generated::entities::{user, user_identity};
+    use sea_orm::MockDatabase;
+
+    #[test]
+    fn ensure_send_sync() {
+        fn assert_send_sync<T: Send + Sync>() {}
+        assert_send_sync::<PasswordStrategy>();
+    }
+
+    #[test]
+    fn password_validation() {
+        let valid_password = "ValidPassword123!";
+        let long_password = "a".repeat(129);
+
+        assert!(PasswordStrategy::is_valid_password(valid_password).is_ok());
+        assert!(PasswordStrategy::is_valid_password(long_password.as_str()).is_err());
+    }
+
+    #[tokio::test]
+    async fn authenticate_user_not_found() {
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![Vec::<sea_orm::MockRow>::new()])
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy
+            .authenticate("nonexistent_user", "password", None)
+            .await;
+
+        assert!(matches!(result, Err(ServiceError::Unauthorized(_))));
+    }
+
+    #[tokio::test]
+    async fn authenticate_invalid_password() {
+        let user_id = Uuid::new_v4();
+        let password_hash = Argon2::default()
+            .hash_password(
+                "CorrectPassword".as_bytes(),
+                &SaltString::generate(&mut OsRng),
+            )
+            .unwrap()
+            .to_string();
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![vec![user::Model {
+                id: user_id,
+                name: "test_user".to_string(),
+                is_active: true,
+                is_admin: false,
+                created_at: chrono::Utc::now(),
+                updated_at: chrono::Utc::now(),
+                deleted_at: None,
+                last_login_at: None,
+            }]])
+            .append_query_results(vec![vec![user_identity::Model {
+                id: Uuid::new_v4(),
+                user_id,
+                email: None,
+                provider: PASSWORD_PROVIDER.to_string(),
+                password_hash: Some(password_hash),
+                metadata: None,
+                is_revoked: false,
+                revoked_at: None,
+                created_at: chrono::Utc::now(),
+                updated_at: chrono::Utc::now(),
+                password_changed_at: None,
+            }]])
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy
+            .authenticate("test_user", "InvalidPassword", None)
+            .await;
+
+        assert!(matches!(result, Err(ServiceError::Unauthorized(_))));
+    }
+
+    #[tokio::test]
+    async fn authenticate_success() {
+        let user_id = Uuid::new_v4();
+        let password_hash = Argon2::default()
+            .hash_password(
+                "CorrectPassword".as_bytes(),
+                &SaltString::generate(&mut OsRng),
+            )
+            .unwrap()
+            .to_string();
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![vec![user::Model {
+                id: user_id,
+                name: "test_user".to_string(),
+                is_active: true,
+                is_admin: false,
+                created_at: chrono::Utc::now(),
+                updated_at: chrono::Utc::now(),
+                deleted_at: None,
+                last_login_at: None,
+            }]])
+            .append_query_results(vec![vec![user_identity::Model {
+                id: Uuid::new_v4(),
+                user_id,
+                email: None,
+                provider: PASSWORD_PROVIDER.to_string(),
+                password_hash: Some(password_hash),
+                metadata: None,
+                is_revoked: false,
+                revoked_at: None,
+                created_at: chrono::Utc::now(),
+                updated_at: chrono::Utc::now(),
+                password_changed_at: None,
+            }]])
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy
+            .authenticate("test_user", "CorrectPassword", None)
+            .await;
+
+        assert!(matches!(result, Ok(id) if id == user_id));
+    }
+
+    #[tokio::test]
+    async fn revoke_identity_not_found() {
+        let user_id = Uuid::new_v4();
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![Vec::<sea_orm::MockRow>::new()])
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy.revoke_identity(user_id, None).await;
+
+        assert!(matches!(result, Err(ServiceError::NotFound(_))));
+    }
+
+    #[tokio::test]
+    async fn revoke_identity_success() {
+        let user_id = Uuid::new_v4();
+        let identity = user_identity::Model {
+            id: Uuid::new_v4(),
+            user_id,
+            email: None,
+            provider: PASSWORD_PROVIDER.to_string(),
+            password_hash: None,
+            metadata: None,
+            is_revoked: false,
+            revoked_at: None,
+            created_at: chrono::Utc::now(),
+            updated_at: chrono::Utc::now(),
+            password_changed_at: None,
+        };
+
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![
+                vec![identity.clone()],
+                vec![user_identity::Model {
+                    is_revoked: true,
+                    ..identity
+                }],
+            ])
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy.revoke_identity(user_id, None).await;
+
+        assert!(result.is_ok());
+    }
+
+    #[tokio::test]
+    async fn create_identity_invalid_password() {
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite).into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy.create_identity(Uuid::new_v4(), "", None).await;
+
+        assert!(matches!(result, Err(ServiceError::BadRequest(_))));
+    }
+
+    #[tokio::test]
+    async fn create_identity_success() {
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            // No existing identity
+            .append_query_results(vec![Vec::<sea_orm::MockRow>::new()])
+            // Insert exec result (mock exec result for insert)
+            .append_exec_results(vec![sea_orm::MockExecResult {
+                rows_affected: 1,
+                last_insert_id: 0,
+            }])
+            // Return inserted identity for any subsequent queries
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy
+            .create_identity(Uuid::new_v4(), "ValidPass1!", None)
+            .await;
+
+        assert!(
+            result.is_ok(),
+            "Failed to create identity, error: {:?}",
+            result.err()
+        );
+    }
+
+    #[tokio::test]
+    async fn create_identity_existing() {
+        let user_id = Uuid::new_v4();
+        let identity = user_identity::Model {
+            id: Uuid::new_v4(),
+            user_id,
+            email: None,
+            provider: PASSWORD_PROVIDER.to_string(),
+            password_hash: Some("hash".to_string()),
+            metadata: None,
+            is_revoked: false,
+            revoked_at: None,
+            created_at: chrono::Utc::now(),
+            updated_at: chrono::Utc::now(),
+            password_changed_at: None,
+        };
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![vec![identity]])
+            .into_connection();
+        let strategy = PasswordStrategy::new(Arc::new(db));
+        let result = strategy.create_identity(user_id, "ValidPass1!", None).await;
+        assert!(matches!(result, Err(ServiceError::BadRequest(_))));
+    }
+
+    #[tokio::test]
+    async fn update_password_not_found() {
+        let user_id = Uuid::new_v4();
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![Vec::<sea_orm::MockRow>::new()])
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy.update_password(user_id, "NewPass1!", None).await;
+
+        assert!(matches!(result, Err(ServiceError::NotFound(_))));
+    }
+
+    #[tokio::test]
+    async fn update_password_success() {
+        let user_id = Uuid::new_v4();
+        let identity = user_identity::Model {
+            id: Uuid::new_v4(),
+            user_id,
+            email: None,
+            provider: PASSWORD_PROVIDER.to_string(),
+            password_hash: Some("old_hash".to_string()),
+            metadata: None,
+            is_revoked: false,
+            revoked_at: None,
+            created_at: chrono::Utc::now(),
+            updated_at: chrono::Utc::now(),
+            password_changed_at: None,
+        };
+
+        let db = MockDatabase::new(sea_orm::DatabaseBackend::Sqlite)
+            .append_query_results(vec![
+                vec![identity],
+                vec![user_identity::Model {
+                    id: Uuid::new_v4(),
+                    user_id,
+                    email: None,
+                    provider: PASSWORD_PROVIDER.to_string(),
+                    password_hash: Some("new_hash".to_string()),
+                    metadata: None,
+                    is_revoked: false,
+                    revoked_at: None,
+                    created_at: chrono::Utc::now(),
+                    updated_at: chrono::Utc::now(),
+                    password_changed_at: None,
+                }],
+            ])
+            .into_connection();
+
+        let strategy = PasswordStrategy::new(Arc::new(db));
+
+        let result = strategy.update_password(user_id, "NewPass1!", None).await;
+
+        assert!(
+            result.is_ok(),
+            "Failed to update password, error: {:?}",
+            result.err()
+        );
+    }
+}
--- a/apps/api/src/services/auth/user.rs
+++ b/apps/api/src/services/auth/user.rs
@@ -0,0 +1,217 @@
+use std::sync::Arc;
+
+use database::generated::entities::user::{
+    self, ActiveModel as UserActiveModel, Model as UserModel,
+};
+use sea_orm::{
+    ActiveModelTrait, ActiveValue, ColumnTrait, DatabaseConnection, DatabaseTransaction, DbErr,
+    EntityTrait, IntoActiveModel, QueryFilter, prelude::Uuid,
+};
+
+use crate::{errors::service_error::ServiceError, with_conn};
+
+#[async_trait::async_trait]
+pub trait UserService: Send + Sync {
+    async fn get_user_by_id(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<User, ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn is_admin(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<bool, ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn user_exists(
+        &self,
+        username: &str,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<bool, ServiceError>;
+    async fn create_user(
+        &self,
+        user: NewUser,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<User, ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn update_user(
+        &self,
+        user_id: Uuid,
+        user: UpdateUser,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<User, ServiceError>;
+    #[allow(dead_code)] // TODO: remove when used
+    async fn delete_user(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<(), ServiceError>;
+}
+
+pub struct User {
+    pub id: Uuid,
+    pub username: String,
+    #[allow(dead_code)] // TODO: remove when used
+    pub is_admin: bool,
+}
+
+impl From<UserModel> for User {
+    fn from(model: UserModel) -> Self {
+        Self {
+            id: model.id,
+            username: model.name,
+            is_admin: model.is_admin,
+        }
+    }
+}
+
+pub struct NewUser {
+    pub username: String,
+    pub is_admin: bool,
+}
+
+pub struct UpdateUser {
+    #[allow(dead_code)] // TODO: remove when used
+    pub username: Option<String>,
+    #[allow(dead_code)] // TODO: remove when used
+    pub is_admin: Option<bool>,
+    #[allow(dead_code)] // TODO: remove when used
+    pub is_active: Option<bool>,
+}
+
+impl UpdateUser {
+    #[allow(dead_code)] // TODO: remove when used
+    fn apply_to_active_model(&self, model: &mut UserActiveModel) {
+        if let Some(username) = &self.username {
+            model.name = ActiveValue::Set(username.clone());
+        }
+        if let Some(is_admin) = self.is_admin {
+            model.is_admin = ActiveValue::Set(is_admin);
+        }
+        if let Some(is_active) = self.is_active {
+            model.is_active = ActiveValue::Set(is_active);
+        }
+    }
+}
+
+pub struct UserServiceImpl {
+    connection: Arc<DatabaseConnection>,
+}
+
+impl UserServiceImpl {
+    pub fn new(connection: Arc<DatabaseConnection>) -> Self {
+        Self { connection }
+    }
+
+    async fn get_user_by_id_from_db(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<UserModel, ServiceError> {
+        let user = with_conn!(&*self.connection, tx, conn, {
+            user::Entity::find_by_id(user_id).one(*conn).await
+        });
+
+        match user {
+            Err(err) => Err(ServiceError::from(err)),
+            Ok(None) => Err(ServiceError::NotFound(format!(
+                "User with id '{}' not found",
+                user_id
+            ))),
+            Ok(Some(record)) => Ok(record),
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl UserService for UserServiceImpl {
+    async fn get_user_by_id(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<User, ServiceError> {
+        let user = self.get_user_by_id_from_db(user_id, tx).await?;
+        Ok(User::from(user))
+    }
+
+    async fn is_admin(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<bool, ServiceError> {
+        let user = self.get_user_by_id(user_id, tx).await?;
+        Ok(user.is_admin)
+    }
+
+    async fn user_exists(
+        &self,
+        username: &str,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<bool, ServiceError> {
+        let user = with_conn!(&*self.connection, tx, conn, {
+            user::Entity::find()
+                .filter(user::Column::Name.eq(username))
+                .one(*conn)
+                .await
+        });
+
+        match user {
+            Err(err) => match err {
+                DbErr::RecordNotFound(_) => Ok(false),
+                _ => Err(ServiceError::from(err)),
+            },
+            Ok(None) => Ok(false),
+            Ok(Some(_)) => Ok(true),
+        }
+    }
+
+    async fn create_user(
+        &self,
+        user: NewUser,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<User, ServiceError> {
+        let user_active_model = UserActiveModel {
+            id: ActiveValue::Set(Uuid::new_v4()),
+            name: ActiveValue::Set(user.username),
+            is_admin: ActiveValue::Set(user.is_admin),
+            is_active: ActiveValue::Set(true),
+            ..Default::default()
+        };
+
+        let user_model = with_conn!(&*self.connection, tx, conn, {
+            user_active_model.insert(*conn).await
+        })?;
+
+        Ok(User::from(user_model))
+    }
+
+    async fn update_user(
+        &self,
+        user_id: Uuid,
+        update_user: UpdateUser,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<User, ServiceError> {
+        let existing_user = self.get_user_by_id_from_db(user_id, tx).await?;
+
+        let mut user_active_model = existing_user.into_active_model();
+        update_user.apply_to_active_model(&mut user_active_model);
+
+        let user_model = user_active_model.update(&*self.connection).await?;
+
+        Ok(User::from(user_model))
+    }
+
+    async fn delete_user(
+        &self,
+        user_id: Uuid,
+        tx: Option<&mut DatabaseTransaction>,
+    ) -> Result<(), ServiceError> {
+        let user = self.get_user_by_id_from_db(user_id, tx).await?;
+
+        let user_active_model = user.into_active_model();
+        user_active_model.delete(&*self.connection).await?;
+
+        Ok(())
+    }
+}
--- a/apps/api/src/services/server_state.rs
+++ b/apps/api/src/services/server_state.rs
@@ -0,0 +1,36 @@
+use std::sync::Arc;
+
+use sea_orm::{DatabaseConnection, prelude::*};
+
+use crate::errors::service_error::ServiceError;
+
+#[async_trait::async_trait]
+pub trait ServerStateStore: Send + Sync {
+    async fn is_server_initialized(&self) -> Result<bool, ServiceError>;
+}
+
+pub struct ServerStateService {
+    connection: Arc<DatabaseConnection>,
+}
+
+impl ServerStateService {
+    pub fn new(connection: Arc<DatabaseConnection>) -> Self {
+        Self { connection }
+    }
+}
+
+#[async_trait::async_trait]
+impl ServerStateStore for ServerStateService {
+    async fn is_server_initialized(&self) -> Result<bool, ServiceError> {
+        // For example, check if any admin user exists to determine if the server is initialized
+        let admin_exists = database::generated::entities::user::Entity::find()
+            .filter(database::generated::entities::user::Column::IsAdmin.eq(true))
+            .filter(database::generated::entities::user::Column::IsActive.eq(true))
+            .one(&*self.connection)
+            .await
+            .map_err(ServiceError::from)?
+            .is_some();
+
+        Ok(admin_exists)
+    }
+}
--- a/apps/api/src/services/settings.rs
+++ b/apps/api/src/services/settings.rs
@@ -7,18 +7,15 @@ use sea_orm::{
    IntoActiveModel, QueryFilter,
 };

-use crate::errors::service_error::{IntoServiceError, ServiceError};
+use crate::errors::service_error::ServiceError;

 #[async_trait::async_trait]
 pub trait SettingsStore: Send + Sync {
-    #[allow(dead_code)] // TODO: remove when used
    async fn get_setting(&self, key: &str) -> Result<String, ServiceError>;
-    #[allow(dead_code)] // TODO: remove when used
    async fn set_setting(&self, key: &str, value: String) -> Result<(), ServiceError>;
 }

 pub struct SettingsService {
-    #[allow(dead_code)] // TODO: remove when used
    connection: Arc<DatabaseConnection>,
 }

@@ -37,11 +34,11 @@ impl SettingsStore for SettingsService {
            .await;

        match setting {
-            Err(err) => Err(err.into_service_error()),
-            Ok(None) => Err(
-                DbErr::RecordNotFound(format!("Setting with key '{}' not found", key))
-                    .into_service_error(),
-            ),
+            Err(err) => Err(ServiceError::from(err)),
+            Ok(None) => Err(ServiceError::from(DbErr::RecordNotFound(format!(
+                "Setting with key '{}' not found",
+                key
+            )))),
            Ok(Some(record)) => Ok(record.value),
        }
    }
@@ -62,7 +59,7 @@ impl SettingsStore for SettingsService {
            new_record
                .insert(&*self.connection)
                .await
-                .map_err(|err| err.into_service_error())
+                .map_err(ServiceError::from)
        };

        match existing {
@@ -71,19 +68,20 @@ impl SettingsStore for SettingsService {
                    handle_not_found(key.to_string(), value).await?;
                }
                _ => {
-                    return Err(Box::new(err));
+                    return Err(ServiceError::from(err));
                }
            },
            Ok(None) => {
                handle_not_found(key.to_string(), value).await?;
            }
-            Ok(Some(mut record)) => {
-                record.value = value;
-                record
-                    .into_active_model()
+            Ok(Some(record)) => {
+                let mut record_active_model = record.into_active_model();
+                record_active_model.value = ActiveValue::Set(value);
+                record_active_model.updated_at = ActiveValue::Set(chrono::Utc::now());
+                record_active_model
                    .update(&*self.connection)
                    .await
-                    .map_err(|err| err.into_service_error())?;
+                    .map_err(ServiceError::from)?;
            }
        }

--- a/apps/api/src/tasks/startup.rs
+++ b/apps/api/src/tasks/startup.rs
@@ -1,25 +1,34 @@
-use migration::migrate_database;
-use tracing::{debug, info};
+mod db_migrate;
+mod init_admin;
+
+use std::sync::Arc;
+
+use sea_orm::ConnectOptions;
+use tracing::info;

 use crate::configs::ProgramSettings;
+use database::get_connection;

 pub async fn run_startup_tasks(config: &ProgramSettings) -> Result<(), Box<dyn std::error::Error>> {
    // Here you can add any startup tasks you want to run when the application starts.
    info!("Running startup tasks...");
+
+    let db_options = |options: &mut ConnectOptions| {
+        options.max_connections(config.database.max_connections);
+    };
+
+    let db_connection = Arc::new(
+        get_connection(&config.database.url, Some(db_options))
+            .await
+            .map_err(|err| format!("Failed to establish database connection: {}", err))?,
+    );
+
    if config.database.migrate_on_startup {
-        run_database_migrations(&config.database.url).await?;
+        db_migrate::run_database_migrations(&config.database.url).await?;
    } else {
        info!("Database migration on startup is disabled. Skipping migration.");
    }
+    init_admin::init_admin(config, db_connection.clone()).await?;

    Ok(())
 }
-
-async fn run_database_migrations(db_url: &str) -> Result<(), Box<dyn std::error::Error>> {
-    // Logic to run database migrations
-    info!("Running database migrations...");
-    debug!("Database URL: {}", db_url);
-    migrate_database(db_url).await.map_err(Box::new)?;
-    info!("Database migrations completed.");
-    Ok(())
-}
--- a/apps/api/src/tasks/startup/db_migrate.rs
+++ b/apps/api/src/tasks/startup/db_migrate.rs
@@ -0,0 +1,11 @@
+use migration::migrate_database;
+use tracing::{debug, info};
+
+pub async fn run_database_migrations(db_url: &str) -> Result<(), Box<dyn std::error::Error>> {
+    // Logic to run database migrations
+    info!("Running database migrations...");
+    debug!("Database URL: {}", db_url);
+    migrate_database(db_url).await.map_err(Box::new)?;
+    info!("Database migrations completed.");
+    Ok(())
+}
--- a/apps/api/src/tasks/startup/init_admin.rs
+++ b/apps/api/src/tasks/startup/init_admin.rs
@@ -0,0 +1,116 @@
+use std::sync::Arc;
+
+use argon2::password_hash::{SaltString, rand_core::OsRng};
+use database::generated::entities::user;
+use sea_orm::{ColumnTrait, DatabaseConnection, EntityTrait, QueryFilter, TransactionTrait};
+use tracing::{debug, info, warn};
+
+use crate::configs::ProgramSettings;
+use crate::helpers::constants::ADMIN_INIT_SECRET_KEY;
+use crate::services::{
+    auth::{
+        authentication::strategies::password::PasswordStrategy,
+        user::{NewUser, UserService, UserServiceImpl},
+    },
+    settings::{SettingsService, SettingsStore},
+};
+
+pub async fn init_admin(
+    config: &ProgramSettings,
+    db: Arc<DatabaseConnection>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    // if admin user already exists, skip
+    let admin_exists = user::Entity::find()
+        .filter(user::Column::IsAdmin.eq(true))
+        .filter(user::Column::IsActive.eq(true))
+        .one(db.as_ref())
+        .await
+        .map_err(|err| format!("Failed to query for existing admin user: {}", err))?
+        .is_some();
+
+    if admin_exists {
+        debug!("Admin user already exists. Skipping admin initialization.");
+        return Ok(());
+    }
+
+    // if config contains admin init settings, run admin init
+    if let (Some(username), Some(password)) = (
+        &config.auth.default_admin_username,
+        &config.auth.default_admin_password,
+    ) {
+        let r = _init_admin(username, password, db.clone()).await;
+        if let Err(e) = r {
+            warn!("Failed to initialize admin user: {}", e);
+            info!("Defaulting to manual creation from dashboard.");
+        } else {
+            return Ok(());
+        }
+    }
+    // else generate a random secret to be used when initializing admin from dashboard
+    let secret = generate_admin_init_secret(db.clone()).await?;
+    info!(
+        "Admin initialization secret generated. Use this secret to initialize the admin user from the dashboard: {}. This secret will only be shown once and is only valid until the admin user is created or the application is restarted.",
+        secret
+    );
+    Ok(())
+}
+
+async fn generate_admin_init_secret(
+    db: Arc<DatabaseConnection>,
+) -> Result<String, Box<dyn std::error::Error>> {
+    let secret = SaltString::generate(&mut OsRng).as_str().to_owned();
+
+    // Store the secret in a settings table
+    let setting = SettingsService::new(db.clone());
+    setting
+        .set_setting(ADMIN_INIT_SECRET_KEY, secret.clone())
+        .await
+        .map_err(|err| format!("Failed to store admin init secret: {}", err))?;
+
+    Ok(secret)
+}
+
+async fn _init_admin(
+    username: &str,
+    password: &str,
+    db: Arc<DatabaseConnection>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    info!("Initializing admin user...");
+    // Check if an admin user already exists
+    let admin_exists = user::Entity::find()
+        .filter(user::Column::IsAdmin.eq(true))
+        .one(db.as_ref())
+        .await?
+        .is_some();
+
+    if admin_exists {
+        debug!("Admin user already exists. Skipping initialization.");
+        return Ok(());
+    }
+    info!("No admin user found. Creating default admin user...");
+
+    let user_service = UserServiceImpl::new(db.clone());
+    let password_strategy = PasswordStrategy::new(db.clone());
+
+    let user = NewUser {
+        username: username.to_string(),
+        is_admin: true,
+    };
+
+    let mut tx = db.begin().await?;
+    // create user
+    let user = user_service.create_user(user, Some(&mut tx)).await?;
+    // create temporary password
+    password_strategy
+        .create_identity(user.id, password, Some(&mut tx))
+        .await?;
+    //
+    tx.commit().await?;
+
+    info!(
+        "Default admin user created successfully, username: {}",
+        username
+    );
+
+    Ok(())
+}
--- a/apps/api/swagger.json
+++ b/apps/api/swagger.json
@@ -9,6 +9,78 @@
    "version": "0.1.0"
  },
  "paths": {
+    "/api/auth/init_admin": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Initializes the admin user",
+        "description": "Initializes the admin user if no admin user exists and the correct setup secret is provided.",
+        "operationId": "init_admin",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminInitRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "Admin user initialized successfully"
+          },
+          "400": {
+            "description": "Invalid request payload"
+          },
+          "401": {
+            "description": "Unauthorized: Admin user already exists or invalid setup secret"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        }
+      }
+    },
+    "/api/auth/login": {
+      "post": {
+        "tags": [
+          "Authentication"
+        ],
+        "summary": "Login endpoint",
+        "description": "Authenticates a user and returns a JWT in an HttpOnly cookie.",
+        "operationId": "login",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LoginRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "User authenticated successfully",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "default": null
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authentication failed"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        }
+      }
+    },
    "/api/health/info": {
      "get": {
        "tags": [
@@ -33,17 +105,66 @@
          }
        }
      }
+    },
+    "/api/user/me": {
+      "get": {
+        "tags": [
+          "User"
+        ],
+        "summary": "Get current user information",
+        "description": "Returns the information of the currently authenticated user.",
+        "operationId": "get_user_info",
+        "responses": {
+          "200": {
+            "description": "User information retrieved successfully",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/UserInfo"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        }
+      }
    }
  },
  "components": {
    "schemas": {
+      "AdminInitRequest": {
+        "type": "object",
+        "description": "Login request payload",
+        "required": [
+          "username",
+          "password",
+          "setup_secret"
+        ],
+        "properties": {
+          "password": {
+            "type": "string"
+          },
+          "setup_secret": {
+            "type": "string"
+          },
+          "username": {
+            "type": "string"
+          }
+        }
+      },
      "HealthInfo": {
        "type": "object",
        "description": "System health information",
        "required": [
          "status",
          "version",
-          "up_since"
+          "up_since",
+          "is_initialized"
        ],
        "properties": {
          "errors": {
@@ -56,6 +177,10 @@
            },
            "description": "List of error messages if unhealthy"
          },
+          "is_initialized": {
+            "type": "boolean",
+            "description": "Is initialized"
+          },
          "status": {
            "type": "string",
            "description": "Health status: \"healthy\" or \"unhealthy\""
@@ -70,6 +195,41 @@
            "description": "Application version"
          }
        }
+      },
+      "LoginRequest": {
+        "type": "object",
+        "description": "Login request payload",
+        "required": [
+          "username",
+          "password"
+        ],
+        "properties": {
+          "password": {
+            "type": "string"
+          },
+          "username": {
+            "type": "string"
+          }
+        }
+      },
+      "UserInfo": {
+        "type": "object",
+        "description": "System health information",
+        "required": [
+          "id",
+          "username"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid",
+            "description": "User ID"
+          },
+          "username": {
+            "type": "string",
+            "description": "Username"
+          }
+        }
      }
    }
  },
@@ -77,6 +237,14 @@
    {
      "name": "Health",
      "description": "Health information API"
+    },
+    {
+      "name": "Authentication",
+      "description": "Authentication API"
+    },
+    {
+      "name": "User",
+      "description": "User management API"
    }
  ]
 }
--- a/apps/frontend/app/app.css
+++ b/apps/frontend/app/app.css
@@ -1,15 +1,9 @@
-@import "tailwindcss";
+@import 'tailwindcss';

@theme {
-  --font-sans: "Inter", ui-sans-serif, system-ui, sans-serif,
-    "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  --font-sans: 'Inter', ui-sans-serif, system-ui, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Noto Color Emoji';
 }

 html,
 body {
-  @apply bg-white dark:bg-gray-950;
-
-  @media (prefers-color-scheme: dark) {
-    color-scheme: dark;
-  }
 }
--- a/apps/frontend/app/components/Form/Button.tsx
+++ b/apps/frontend/app/components/Form/Button.tsx
@@ -0,0 +1,46 @@
+import { Button, type ButtonProps } from '@radix-ui/themes';
+import { LoaderCircle } from 'lucide-react';
+
+export type SubmitButtonProps = {
+  loading?: boolean;
+  label?:
+    | {
+        default?: string;
+        loading?: string;
+      }
+    | string;
+} & React.ButtonHTMLAttributes<HTMLButtonElement> &
+  ButtonProps;
+
+export function SubmitButton({ loading, label, ...props }: SubmitButtonProps) {
+  return (
+    <Button
+      type="submit"
+      disabled={loading}
+      style={{
+        padding: '10px 14px',
+        borderRadius: 6,
+        border: 'none',
+        backgroundColor: 'var(--iris-9)',
+      }}
+      size="3"
+      {...props}
+    >
+      {loading
+        ? typeof label === 'string'
+          ? label
+          : label?.loading ?? <LoaderCircle className="animate-spin" style={{ width: 24, height: 24, marginRight: 4, verticalAlign: 'middle', color: 'white' }} />
+        : typeof label === 'string'
+        ? label
+        : label?.default ?? 'Submit'}
+    </Button>
+  );
+}
+
+export function ResetButton(props: React.ButtonHTMLAttributes<HTMLButtonElement>) {
+  return (
+    <button type="reset" {...props} style={{ padding: '10px 14px', borderRadius: 6, border: '1px solid var(--gray-5)', background: 'white', ...props.style }}>
+      {props.children ?? 'Reset'}
+    </button>
+  );
+}
--- a/apps/frontend/app/components/Form/TextField.tsx
+++ b/apps/frontend/app/components/Form/TextField.tsx
@@ -0,0 +1,103 @@
+import type { AnyFieldMeta } from '@tanstack/react-form';
+import { LucideEye, LucideEyeClosed } from 'lucide-react';
+import { useCallback, useId, useState } from 'react';
+import { InfoIcon, type InfoIconProps } from '../info';
+import { Text } from '@radix-ui/themes';
+
+export type TextFieldProps = {
+  label?: string;
+  value?: string;
+  onChange?: (e: React.ChangeEvent<HTMLInputElement>) => void;
+  labelProps?: React.LabelHTMLAttributes<HTMLLabelElement>;
+  labelDivProps?: React.HTMLAttributes<HTMLDivElement>;
+  infoIconProps?: InfoIconProps;
+} & React.InputHTMLAttributes<HTMLInputElement> & {
+    type?: 'password';
+    showPasswordToggle?: boolean;
+  };
+
+export function TextField({ label, value, onChange, labelProps, labelDivProps, showPasswordToggle, infoIconProps, ...rest }: TextFieldProps) {
+  const id = useId();
+  const [isPasswordVisible, setIsPasswordVisible] = useState(false);
+  const handlePasswordVisibilitySet = useCallback(
+    (e: React.MouseEvent | React.TouchEvent, visible: boolean) => {
+      if (rest.type !== 'password') return;
+      e.preventDefault();
+      setIsPasswordVisible(() => visible);
+    },
+    [rest.type]
+  );
+
+  return (
+    <label htmlFor={id} style={{ display: 'block', marginBottom: 8 }} {...labelProps}>
+      {label && (
+        <div style={{ fontSize: 12, color: 'var(--gray-9)', marginBottom: 6, display: 'flex', alignItems: 'center' }} {...labelDivProps}>
+          {label}
+          {rest?.required && (
+            <Text size="3" style={{ color: 'var(--red-9)', marginLeft: 2 }}>
+              *
+            </Text>
+          )}
+          {infoIconProps && <InfoIcon {...infoIconProps} style={{ marginLeft: 4, verticalAlign: 'middle' }} />}
+        </div>
+      )}
+      <div style={{ position: 'relative', display: 'flex', alignItems: 'center', gap: 8 }}>
+        <input
+          {...rest}
+          type={rest.type === 'password' ? (isPasswordVisible && showPasswordToggle ? 'text' : 'password') : rest.type}
+          id={id}
+          value={value}
+          onChange={onChange}
+          style={{
+            width: '100%',
+            padding: '10px 12px',
+            borderRadius: 6,
+            border: '1px solid var(--gray-5)',
+            ...rest?.style,
+          }}
+        />
+
+        <div
+          style={{ position: 'absolute', right: 12 }}
+          onMouseDown={(e) => {
+            handlePasswordVisibilitySet(e, true);
+          }}
+          onMouseUp={(e) => {
+            handlePasswordVisibilitySet(e, false);
+          }}
+          onMouseLeave={(e) => {
+            handlePasswordVisibilitySet(e, false);
+          }}
+          onTouchStart={(e) => {
+            handlePasswordVisibilitySet(e, true);
+          }}
+          onTouchEnd={(e) => {
+            handlePasswordVisibilitySet(e, false);
+          }}
+        >
+          {showPasswordToggle ? isPasswordVisible ? <LucideEye size={16} /> : <LucideEyeClosed size={16} /> : null}
+        </div>
+      </div>
+    </label>
+  );
+}
+
+export type TextFieldErrorMessageProps = AnyFieldMeta & {
+  errorMessage?: string;
+};
+
+export function TextFieldErrorMessage({ isValid, errors, errorMessage }: TextFieldErrorMessageProps) {
+  return (
+    !isValid && (
+      <div
+        style={{
+          marginTop: 4,
+          fontSize: 12,
+          color: 'var(--red-9)',
+        }}
+      >
+        {errorMessage ?? errors?.reduce((msg, err) => msg + err.message + ' ', '')}
+      </div>
+    )
+  );
+}
--- a/apps/frontend/app/components/home/TablePlaceholder.tsx
+++ b/apps/frontend/app/components/home/TablePlaceholder.tsx
@@ -0,0 +1,27 @@
+import React from 'react';
+import { Flex, Text, Button, Separator, Box, Badge } from '@radix-ui/themes';
+
+export default function TablePlaceholder() {
+  return (
+    <Flex direction="column" gap="3" p="4">
+      <Flex justify="between" align="center">
+        <Text weight="bold">Proxy Hosts</Text>
+        <Button size="1">Add Host</Button>
+      </Flex>
+      <Separator size="4" />
+      {[1, 2, 3].map((i) => (
+        <Flex key={i} justify="between" align="center">
+          <Box>
+            <Text size="2" weight="bold" as="div">
+              {`host-${i}.example.com`}
+            </Text>
+            <Text size="1" color="gray">
+              {`http://10.0.0.${i}:8080`}
+            </Text>
+          </Box>
+          <Badge color="green">Online</Badge>
+        </Flex>
+      ))}
+    </Flex>
+  );
+}
--- a/apps/frontend/app/components/info.tsx
+++ b/apps/frontend/app/components/info.tsx
@@ -0,0 +1,59 @@
+import { Box } from '@radix-ui/themes';
+import { Info, type LucideProps } from 'lucide-react';
+import { Tooltip } from 'radix-ui';
+import type { PropsWithChildren } from 'react';
+
+export type InfoIconProps = PropsWithChildren<
+  {
+    tooltipContainerProps?: Omit<Tooltip.TooltipContentProps & React.RefAttributes<HTMLDivElement>, 'children'>;
+  } & Omit<LucideProps, 'ref'> &
+    React.RefAttributes<SVGSVGElement>
+>;
+
+export function InfoIcon({ tooltipContainerProps, children, ...iconProps }: InfoIconProps) {
+  return (
+    <Tooltip.Root>
+      <Tooltip.Trigger asChild>
+        <Info size={16} {...iconProps} />
+      </Tooltip.Trigger>
+      <Tooltip.Portal>
+        <Tooltip.Content
+          //
+          side="top"
+          align="center"
+          sideOffset={5}
+          alignOffset={0}
+          avoidCollisions={true}
+          style={{
+            color: 'black',
+            backgroundColor: 'white',
+            fontSize: 12,
+            boxShadow: '0 2px 10px rgba(0, 0, 0, 0.3)',
+            border: '1px solid var(--gray-5)',
+          }}
+          {...tooltipContainerProps}
+        >
+          {children}
+          <Tooltip.Arrow className="TooltipArrow" fill="white" />
+        </Tooltip.Content>
+      </Tooltip.Portal>
+    </Tooltip.Root>
+  );
+}
+
+export function TooltipContentContainer({ children, ...props }: React.HTMLAttributes<HTMLDivElement>) {
+  return (
+    <Box
+      style={{
+        padding: '8px 12px',
+        color: 'black',
+        backgroundColor: 'white',
+        borderRadius: 4,
+        fontSize: 12,
+      }}
+      {...props}
+    >
+      {children}
+    </Box>
+  );
+}
--- a/apps/frontend/app/components/layout/SidebarContent.tsx
+++ b/apps/frontend/app/components/layout/SidebarContent.tsx
@@ -0,0 +1,89 @@
+import type React from 'react';
+import { Box, Button, Flex, Heading, Separator, Text } from '@radix-ui/themes';
+import type { NavItem } from './types';
+import { Home, Globe, ArrowRight, Lock, Settings, User } from 'lucide-react';
+import { useLayout } from '../../providers/LayoutProvider';
+
+const navItems: { label: NavItem; icon: React.ReactNode }[] = [
+  { label: 'Dashboard', icon: <Home size={16} /> },
+  { label: 'Proxy Hosts', icon: <Globe size={16} /> },
+  { label: 'Redirection', icon: <ArrowRight size={16} /> },
+  { label: 'SSL', icon: <Lock size={16} /> },
+  { label: 'Settings', icon: <Settings size={16} /> },
+  { label: 'Profile', icon: <User size={16} /> },
+] as const;
+
+export function SidebarContent() {
+  const { activeTab, setActiveTab, setIsMobileMenuOpen } = useLayout();
+
+  return (
+    <Flex direction="column" gap="2" p="4" style={{ height: '100%' }}>
+      <Flex align="center" gap="2" mb="6" px="2">
+        <Box
+          style={{
+            width: 32,
+            height: 32,
+            backgroundColor: 'var(--iris-9)',
+            borderRadius: 'var(--radius-2)',
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'center',
+            color: 'white',
+            fontWeight: 'bold',
+          }}
+        >
+          Y
+        </Box>
+        <Heading size="4" weight="bold">
+          YANPM
+        </Heading>
+      </Flex>
+
+      <Flex direction="column" gap="1">
+        {navItems.map((item) => (
+          <Button
+            key={item.label}
+            variant={activeTab === item.label ? 'soft' : 'ghost'}
+            color={activeTab === item.label ? 'iris' : 'gray'}
+            onClick={() => {
+              setActiveTab(item.label);
+              setIsMobileMenuOpen(false);
+            }}
+            style={{ cursor: 'pointer', width: '100%', justifyContent: 'flex-start' }}
+          >
+            <Flex align="center" gap="3">
+              {item.icon}
+              <Text size="2" weight={activeTab === item.label ? 'bold' : 'medium'}>
+                {item.label}
+              </Text>
+            </Flex>
+          </Button>
+        ))}
+      </Flex>
+
+      <Box style={{ marginTop: 'auto' }} pt="4">
+        <Separator size="4" mb="4" />
+        <Flex align="center" gap="3" px="2">
+          <Box
+            style={{
+              width: 32,
+              height: 32,
+              backgroundColor: 'var(--gray-5)',
+              borderRadius: '50%',
+            }}
+          />
+          <Box>
+            <Text size="1" weight="bold" as="div">
+              Admin User
+            </Text>
+            <Text size="1" color="gray">
+              admin@example.com
+            </Text>
+          </Box>
+        </Flex>
+      </Box>
+    </Flex>
+  );
+}
+
+export default SidebarContent;
--- a/apps/frontend/app/components/layout/types.ts
+++ b/apps/frontend/app/components/layout/types.ts
@@ -0,0 +1 @@
+export type NavItem = 'Dashboard' | 'Proxy Hosts' | 'Redirection' | 'SSL' | 'Settings' | 'Profile';
--- a/apps/frontend/app/components/theme.tsx
+++ b/apps/frontend/app/components/theme.tsx
@@ -0,0 +1,16 @@
+import type React from 'react';
+import { Theme } from '@radix-ui/themes';
+
+export type AppThemeProps = {
+  children: React.ReactNode;
+};
+
+export function AppTheme({ children }: AppThemeProps) {
+  return (
+    <Theme accentColor="iris" grayColor="slate" panelBackground="translucent" radius="large">
+      {children}
+    </Theme>
+  );
+}
+
+export default AppTheme;
--- a/apps/frontend/app/empty-toastify.css
+++ b/apps/frontend/app/empty-toastify.css
@@ -0,0 +1 @@
+/* intentionally empty: used to stub react-toastify CSS in production builds */
--- a/apps/frontend/app/generated/api-client/api-client.ts
+++ b/apps/frontend/app/generated/api-client/api-client.ts
@@ -1,11 +1,15 @@
 export namespace Schemas {
  // <Schemas>
+  export type AdminInitRequest = { password: string; setup_secret: string; username: string };
  export type HealthInfo = {
    errors?: (Array<string> | null) | undefined;
+    is_initialized: boolean;
    status: string;
    up_since: string;
    version: string;
  };
+  export type LoginRequest = { password: string; username: string };
+  export type UserInfo = { id: string; username: string };

  // </Schemas>
 }
@@ -13,6 +17,24 @@ export namespace Schemas {
 export namespace Endpoints {
  // <Endpoints>

+  export type post_Init_admin = {
+    method: "POST";
+    path: "/api/auth/init_admin";
+    requestFormat: "json";
+    parameters: {
+      body: Schemas.AdminInitRequest;
+    };
+    responses: { 200: unknown; 400: unknown; 401: unknown; 500: unknown };
+  };
+  export type post_Login = {
+    method: "POST";
+    path: "/api/auth/login";
+    requestFormat: "json";
+    parameters: {
+      body: Schemas.LoginRequest;
+    };
+    responses: { 200: unknown; 401: unknown; 500: unknown };
+  };
  export type get_Get_health_info = {
    method: "GET";
    path: "/api/health/info";
@@ -20,20 +42,33 @@ export namespace Endpoints {
    parameters: never;
    responses: { 200: Schemas.HealthInfo; 404: unknown };
  };
+  export type get_Get_user_info = {
+    method: "GET";
+    path: "/api/user/me";
+    requestFormat: "json";
+    parameters: never;
+    responses: { 200: Schemas.UserInfo; 401: unknown; 500: unknown };
+  };

  // </Endpoints>
 }

 // <EndpointByMethod>
 export type EndpointByMethod = {
+  post: {
+    "/api/auth/init_admin": Endpoints.post_Init_admin;
+    "/api/auth/login": Endpoints.post_Login;
+  };
  get: {
    "/api/health/info": Endpoints.get_Get_health_info;
+    "/api/user/me": Endpoints.get_Get_user_info;
  };
 };

 // </EndpointByMethod>

 // <EndpointByMethod.Shorthands>
+export type PostEndpoints = EndpointByMethod["post"];
 export type GetEndpoints = EndpointByMethod["get"];
 // </EndpointByMethod.Shorthands>

@@ -267,6 +302,37 @@ export class ApiClient {
    return;
  };

+  // <ApiClient.post>
+  post<Path extends keyof PostEndpoints, TEndpoint extends PostEndpoints[Path]>(
+    path: Path,
+    ...params: MaybeOptionalArg<
+      TEndpoint extends { parameters: infer UParams }
+        ? NotNever<UParams> extends true
+          ? UParams & { overrides?: RequestInit; withResponse?: false; throwOnStatusError?: boolean }
+          : { overrides?: RequestInit; withResponse?: false; throwOnStatusError?: boolean }
+        : { overrides?: RequestInit; withResponse?: false; throwOnStatusError?: boolean }
+    >
+  ): Promise<Extract<InferResponseByStatus<TEndpoint, SuccessStatusCode>, { data: {} }>["data"]>;
+
+  post<Path extends keyof PostEndpoints, TEndpoint extends PostEndpoints[Path]>(
+    path: Path,
+    ...params: MaybeOptionalArg<
+      TEndpoint extends { parameters: infer UParams }
+        ? NotNever<UParams> extends true
+          ? UParams & { overrides?: RequestInit; withResponse?: true; throwOnStatusError?: boolean }
+          : { overrides?: RequestInit; withResponse?: true; throwOnStatusError?: boolean }
+        : { overrides?: RequestInit; withResponse?: true; throwOnStatusError?: boolean }
+    >
+  ): Promise<SafeApiResponse<TEndpoint>>;
+
+  post<Path extends keyof PostEndpoints, _TEndpoint extends PostEndpoints[Path]>(
+    path: Path,
+    ...params: MaybeOptionalArg<any>
+  ): Promise<any> {
+    return this.request("post", path, ...params);
+  }
+  // </ApiClient.post>
+
  // <ApiClient.get>
  get<Path extends keyof GetEndpoints, TEndpoint extends GetEndpoints[Path]>(
    path: Path,
--- a/apps/frontend/app/generated/api-client/tanstack-client.ts
+++ b/apps/frontend/app/generated/api-client/tanstack-client.ts
@@ -41,6 +41,7 @@ const createQueryKey = <TOptions extends EndpointParameters>(
 };

 // <EndpointByMethod.Shorthands>
+export type PostEndpoints = EndpointByMethod["post"];
 export type GetEndpoints = EndpointByMethod["get"];
 // </EndpointByMethod.Shorthands>

@@ -69,6 +70,36 @@ type InferResponseData<TEndpoint, TStatusCode> =
 export class TanstackQueryApiClient {
  constructor(public client: ApiClient) {}

+  // <ApiClient.post>
+  post<Path extends keyof PostEndpoints, TEndpoint extends PostEndpoints[Path]>(
+    path: Path,
+    ...params: MaybeOptionalArg<TEndpoint["parameters"]>
+  ) {
+    const queryKey = createQueryKey(path as string, params[0]);
+    const query = {
+      /** type-only property if you need easy access to the endpoint params */
+      "~endpoint": {} as TEndpoint,
+      queryKey,
+      queryFn: {} as "You need to pass .queryOptions to the useQuery hook",
+      queryOptions: queryOptions({
+        queryFn: async ({ queryKey, signal }) => {
+          const requestParams = {
+            ...(params[0] || {}),
+            ...(queryKey[0] || {}),
+            overrides: { signal },
+            withResponse: false as const,
+          };
+          const res = await this.client.post(path, requestParams as never);
+          return res as InferResponseData<TEndpoint, SuccessStatusCode>;
+        },
+        queryKey: queryKey,
+      }),
+    };
+
+    return query;
+  }
+  // </ApiClient.post>
+
  // <ApiClient.get>
  get<Path extends keyof GetEndpoints, TEndpoint extends GetEndpoints[Path]>(
    path: Path,
--- a/apps/frontend/app/hooks/ResponseHelper.tsx
+++ b/apps/frontend/app/hooks/ResponseHelper.tsx
@@ -0,0 +1,73 @@
+import { AxiosError } from 'axios';
+import { useLocation, useNavigate } from 'react-router';
+import { SearchParamKeys } from '../lib/constants';
+import { useQueryMessage } from './useQueryMessage';
+import { QueryMessageCode, QueryMessageType } from '../lib/QueryMessages';
+import { useCallback } from 'react';
+import { displayForbiddenErrorToast, displayNetworkErrorToast, displayUnexpectedErrorToast } from '../lib/toasts';
+
+export enum ResponseErrorToastId {
+  NetworkError = 'network-error',
+}
+
+export type DefaultResponseErrorHandlerOptions = {
+  disableUnauthorizedHandling?: boolean;
+  disableHandleUnexpectedErrors?: boolean;
+  disableIgnoreCanceledRequests?: boolean;
+};
+
+/**
+ *
+ * @param err error value
+ * @returns {boolean} true if the error was handled, false otherwise
+ */
+
+export function useResponseErrorHandler(): {
+  defaultResponseErrorHandler: typeof defaultResponseErrorHandler;
+} {
+  const navigate = useNavigate();
+  const location = useLocation();
+  const { toSearchParamQueryMessage } = useQueryMessage();
+
+  const defaultResponseErrorHandler = useCallback(
+    (err: unknown, options?: DefaultResponseErrorHandlerOptions): boolean => {
+      if (!(err instanceof AxiosError) && !options?.disableHandleUnexpectedErrors) {
+        displayUnexpectedErrorToast();
+        return true;
+      }
+
+      if (!(err instanceof AxiosError)) return false;
+
+      if (err.message === 'canceled') {
+        // request was aborted, ignore but return true to indicate it was handled
+        return !options?.disableIgnoreCanceledRequests;
+      }
+
+      if (err.message === 'Network Error') {
+        displayNetworkErrorToast();
+        return true;
+      }
+
+      // handle 401 Unauthorized globally
+      if (err.status === 401 && !options?.disableUnauthorizedHandling) {
+        // store current path for redirect after login
+        const currentPath = location.pathname + location.search;
+        const searchParam = new URLSearchParams();
+        searchParam.set(SearchParamKeys.Redirect, currentPath);
+        searchParam.set(SearchParamKeys.Message, toSearchParamQueryMessage(QueryMessageCode.SessionExpired, QueryMessageType.Info));
+        navigate(`/login?${searchParam.toString()}`);
+        return true;
+      }
+
+      if (err.status === 403) {
+        displayForbiddenErrorToast();
+        return true;
+      }
+
+      return false;
+    },
+    [location, navigate, toSearchParamQueryMessage]
+  );
+
+  return { defaultResponseErrorHandler };
+}
--- a/apps/frontend/app/hooks/ensureLoggedIn.tsx
+++ b/apps/frontend/app/hooks/ensureLoggedIn.tsx
@@ -0,0 +1,48 @@
+import { useEffect } from 'react';
+import { useNavigate } from 'react-router';
+import { useAuth } from '../providers/AuthProvider';
+import { useApi } from '../providers/ApiProvider';
+import { useQuery } from '@tanstack/react-query';
+import { useResponseErrorHandler } from './ResponseHelper';
+
+export type EnsureLoggedInResult = {
+  checking: boolean;
+  loggedIn: boolean;
+};
+
+export function useEnsureLoggedIn(): EnsureLoggedInResult {
+  const { user, setUser } = useAuth();
+  const navigate = useNavigate();
+  const { tanstackApiClient } = useApi();
+  const { defaultResponseErrorHandler } = useResponseErrorHandler();
+
+  const { queryOptions: currentUserQuery } = tanstackApiClient.get('/api/user/me');
+  const { isFetched, isPending } = useQuery({
+    ...currentUserQuery,
+    queryFn: async (...args) => {
+      try {
+        const data = await currentUserQuery.queryFn!(...args);
+        setUser({
+          id: data.id,
+          name: data.username,
+        });
+        return data;
+      } catch (error) {
+        if (defaultResponseErrorHandler(error)) return {} as never;
+        throw error;
+      }
+    },
+  });
+
+  useEffect(() => {
+    if (user) {
+      navigate('/', { replace: true });
+      return;
+    }
+  }, [user, setUser, navigate]);
+
+  return {
+    checking: isPending,
+    loggedIn: isFetched && !!user,
+  };
+}
--- a/apps/frontend/app/hooks/useQueryMessage.tsx
+++ b/apps/frontend/app/hooks/useQueryMessage.tsx
@@ -0,0 +1,111 @@
+import { useCallback, useEffect, useRef, type ReactNode } from 'react';
+import { useLocation, useSearchParams } from 'react-router';
+import { toast } from 'react-toastify/unstyled';
+import { SearchParamKeys } from '../lib/constants';
+import { CODE_TO_MESSAGE_MAP, QueryMessageCode, QueryMessageType } from '../lib/QueryMessages';
+
+type QueryMessageString = `${QueryMessageCode}__${QueryMessageType}`;
+
+export type QueryMessage = {
+  type: QueryMessageType;
+  code: QueryMessageCode;
+  message: ReactNode;
+};
+
+export type UseQueryMessageOptions = {
+  displayMessages?: boolean;
+};
+
+export type UseQueryMessageReturn = {
+  setQueryMessage: (messageCode: QueryMessageCode, messageType: QueryMessageType) => void;
+  clearQueryMessage: () => void;
+  toSearchParamQueryMessage: (message: QueryMessageCode, type: QueryMessageType) => QueryMessageString;
+};
+
+export function useQueryMessage(
+  { displayMessages }: UseQueryMessageOptions = {
+    displayMessages: true,
+  }
+): UseQueryMessageReturn {
+  const location = useLocation();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const messageStr = useRef<QueryMessageString | null>(null);
+
+  useEffect(() => {
+    // Reset messageStr when location changes to allow re-displaying the same message on navigation
+    messageStr.current = null;
+  }, [location.pathname]);
+
+  useEffect(() => {
+    const queryMessageStr = searchParams.get(SearchParamKeys.Message);
+    if (!(queryMessageStr && queryMessageStr !== messageStr.current)) return;
+    const [queryMessage, queryMessageString] = toQueryMessage(queryMessageStr) ?? [null, null];
+    if (!queryMessage) return;
+
+    messageStr.current = queryMessageString;
+    if (displayMessages) {
+      toast[queryMessage.type](queryMessage.message, {
+        position: 'top-center',
+        autoClose: 5000,
+        hideProgressBar: false,
+        closeOnClick: true,
+        pauseOnHover: true,
+        draggable: false,
+        progress: undefined,
+        theme: 'colored',
+        toastId: 'login-route-info-message',
+      });
+    }
+  }, [displayMessages, searchParams]);
+
+  const setQueryMessage = useCallback(
+    (messageCode: QueryMessageCode, messageType: QueryMessageType) => {
+      const queryMessageString: QueryMessageString = `${messageCode}__${messageType}`;
+      messageStr.current = queryMessageString;
+      setSearchParams((prev) => {
+        prev.set(SearchParamKeys.Message, queryMessageString);
+        return prev;
+      });
+    },
+    [setSearchParams]
+  );
+
+  const clearQueryMessage = useCallback(() => {
+    messageStr.current = null;
+    setSearchParams((prev) => {
+      prev.delete(SearchParamKeys.Message);
+      return prev;
+    });
+  }, [setSearchParams]);
+
+  const toSearchParamQueryMessage = useCallback((message: QueryMessageCode, type: QueryMessageType): QueryMessageString => {
+    return `${message}__${type}`;
+  }, []);
+
+  return {
+    setQueryMessage,
+    clearQueryMessage,
+    toSearchParamQueryMessage,
+  };
+}
+
+function isValidQueryMessageCode(code: string): code is QueryMessageCode {
+  return Object.values(QueryMessageCode).includes(code as QueryMessageCode);
+}
+
+function isValidQueryMessageType(type: string): type is QueryMessageType {
+  return Object.values(QueryMessageType).includes(type as QueryMessageType);
+}
+
+function toQueryMessage(value: string): [QueryMessage, QueryMessageString] | null {
+  const [code, type] = value.split('__');
+  if (!isValidQueryMessageCode(code) || !isValidQueryMessageType(type)) return null;
+  return [
+    {
+      code: code,
+      type: type,
+      message: CODE_TO_MESSAGE_MAP[code],
+    },
+    `${code}__${type}`,
+  ];
+}
--- a/apps/frontend/app/lib/QueryMessages.tsx
+++ b/apps/frontend/app/lib/QueryMessages.tsx
@@ -0,0 +1,20 @@
+import type { ReactNode } from 'react';
+
+export enum QueryMessageType {
+  Info = 'info',
+  Success = 'success',
+  Warning = 'warning',
+  Error = 'error',
+}
+
+export enum QueryMessageCode {
+  SessionExpired = 'SESSION_EXPIRED',
+  InitializationRequired = 'INITIALIZATION_REQUIRED',
+  InitializationSuccessful = 'INITIALIZATION_SUCCESSFUL',
+}
+
+export const CODE_TO_MESSAGE_MAP: Record<QueryMessageCode, ReactNode> = {
+  [QueryMessageCode.SessionExpired]: 'Your session has expired. Please log in again.',
+  [QueryMessageCode.InitializationRequired]: 'The application requires initialization. Please follow the setup instructions.',
+  [QueryMessageCode.InitializationSuccessful]: 'Initialization successful. Please log in.',
+} as const;
--- a/apps/frontend/app/lib/api.ts
+++ b/apps/frontend/app/lib/api.ts
@@ -65,7 +65,34 @@ function axiosResponseToFetchResponse(response: AxiosResponse): Response {
    }
  });

-  return new Response(response.data, {
+  // Normalize Axios response.data to a Fetch-compatible BodyInit
+  let body: BodyInit | null = null;
+  const data = response.data;
+
+  if (data == null) {
+    body = null;
+  } else if (
+    typeof data === 'string' ||
+    data instanceof Blob ||
+    data instanceof ArrayBuffer ||
+    ArrayBuffer.isView(data) ||
+    data instanceof FormData ||
+    data instanceof URLSearchParams
+  ) {
+    body = data as BodyInit;
+  } else {
+    try {
+      body = JSON.stringify(data);
+      if (!headers.has('content-type')) {
+        headers.set('content-type', 'application/json;charset=utf-8');
+      }
+    } catch {
+      console.warn('Failed to stringify response data as JSON, falling back to string conversion.');
+      body = String(data);
+    }
+  }
+
+  return new Response(body, {
    status: response.status,
    statusText: response.statusText,
    headers: headers,
--- a/apps/frontend/app/lib/constants.ts
+++ b/apps/frontend/app/lib/constants.ts
@@ -0,0 +1,4 @@
+export enum SearchParamKeys {
+  Redirect = 'redirect',
+  Message = 'message',
+}
--- a/apps/frontend/app/lib/toasts.tsx
+++ b/apps/frontend/app/lib/toasts.tsx
@@ -0,0 +1,64 @@
+import { toast, type ToastOptions } from 'react-toastify/unstyled';
+import { Text } from '@radix-ui/themes';
+import { ResponseErrorToastId } from '../hooks/ResponseHelper';
+
+export const displayUnexpectedErrorToast = (options: ToastOptions = {}) => {
+  toast.error(
+    <div>
+      <Text weight="bold">Unexpected Error:</Text>
+      <br /> An unexpected error occurred. Please try again later.
+    </div>,
+    {
+      position: 'top-center',
+      autoClose: false,
+      hideProgressBar: false,
+      closeOnClick: true,
+      pauseOnHover: true,
+      draggable: false,
+      progress: undefined,
+      theme: 'colored',
+      ...options,
+    }
+  );
+};
+
+export const displayNetworkErrorToast = (options: ToastOptions = {}) => {
+  toast.error(
+    <div>
+      <Text weight="bold">Network Error:</Text>
+      <br /> Unable to reach the server. Please check your internet connection and try again.
+    </div>,
+    {
+      toastId: ResponseErrorToastId.NetworkError,
+      position: 'top-center',
+      autoClose: false,
+      hideProgressBar: false,
+      closeOnClick: true,
+      pauseOnHover: true,
+      draggable: false,
+      progress: undefined,
+      theme: 'colored',
+      ...options,
+    }
+  );
+};
+
+export const displayForbiddenErrorToast = (options: ToastOptions = {}) => {
+  toast.error(
+    <div>
+      <Text weight="bold">Forbidden:</Text>
+      <br /> You do not have permission to perform this action.
+    </div>,
+    {
+      position: 'top-center',
+      autoClose: 5000,
+      hideProgressBar: false,
+      closeOnClick: true,
+      pauseOnHover: true,
+      draggable: false,
+      progress: undefined,
+      theme: 'colored',
+      ...options,
+    }
+  );
+};
--- a/apps/frontend/app/providers/ApiHealthProvider.tsx
+++ b/apps/frontend/app/providers/ApiHealthProvider.tsx
@@ -0,0 +1,56 @@
+import { useNavigate } from 'react-router';
+import { useQuery } from '@tanstack/react-query';
+import { createContext, use, type PropsWithChildren } from 'react';
+import { useApi } from './ApiProvider';
+import { useResponseErrorHandler } from '../hooks/ResponseHelper';
+import type { Schemas } from '../generated/api-client/api-client';
+
+export type HealthStatus = Schemas.HealthInfo;
+
+export type ApiHealthProviderProps = PropsWithChildren<object>;
+export type ApiHealthContextType = {
+  healthStatus: HealthStatus | undefined;
+};
+
+const ApiHealthContext = createContext<ApiHealthContextType | null>(null);
+
+export const ApiHealthProvider: React.FC<ApiHealthProviderProps> = ({ children }) => {
+  const navigate = useNavigate();
+  const { tanstackApiClient } = useApi();
+  const { defaultResponseErrorHandler } = useResponseErrorHandler();
+
+  const { queryOptions: healthInfoQuery } = tanstackApiClient.get('/api/health/info');
+  const { data } = useQuery({
+    ...healthInfoQuery,
+    queryFn: async (...args) => {
+      try {
+        const data = await healthInfoQuery.queryFn!(...args);
+        if (!data.is_initialized) {
+          navigate('/init');
+        }
+        return data;
+      } catch (error) {
+        if (defaultResponseErrorHandler(error)) return {} as never;
+        throw error;
+      }
+    },
+  });
+
+  return (
+    <ApiHealthContext
+      value={{
+        healthStatus: data,
+      }}
+    >
+      {children}
+    </ApiHealthContext>
+  );
+};
+
+export const useApiHealth = (): ApiHealthContextType => {
+  const context = use(ApiHealthContext);
+  if (!context) {
+    throw new Error('useApiHealth must be used within an ApiHealthProvider');
+  }
+  return context;
+};
--- a/apps/frontend/app/providers/ApiProvider.tsx
+++ b/apps/frontend/app/providers/ApiProvider.tsx
@@ -1,9 +1,9 @@
-import { createContext, use, useContext, type PropsWithChildren } from 'react';
+import { createContext, use, type PropsWithChildren } from 'react';
 import { createTanstackApi, createApi } from '../lib/api';
 import axios from 'axios';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';

-type ApiProviderProps = PropsWithChildren<{}>;
+type ApiProviderProps = PropsWithChildren<object>;
 type ApiContextType = {
  apiClient: ReturnType<typeof createApi>;
  tanstackApiClient: ReturnType<typeof createTanstackApi>;
@@ -34,8 +34,14 @@ export const ApiProvider: React.FC<ApiProviderProps> = ({ children }) => {
  const axiosInstance = axios.create({
    withCredentials: true,
  });
+
+  const internalAxiosInstance = axios.create({
+    withCredentials: true,
+  });
+
  const apiClient = createApi(axiosInstance);
-  const tanstackApiClient = createTanstackApi(axiosInstance);
+  const tanstackApiClient = createTanstackApi(internalAxiosInstance);
+
  return (
    <QueryClientProvider client={queryClient}>
      <ApiContext
--- a/apps/frontend/app/providers/AuthProvider.tsx
+++ b/apps/frontend/app/providers/AuthProvider.tsx
@@ -0,0 +1,47 @@
+import { createContext, use, useCallback, useState, type PropsWithChildren } from 'react';
+
+export type User = {
+  id: string;
+  name: string;
+};
+
+export type AuthProviderProps = PropsWithChildren<object>;
+export type AuthContextType = {
+  setUser: (user: User) => void;
+  logOut: () => void;
+  user: User | null;
+};
+
+const AuthContext = createContext<AuthContextType | null>(null);
+
+export const AuthProvider: React.FC<AuthProviderProps> = ({ children }) => {
+  const [user, setUserState] = useState<User | null>(null);
+
+  const setUser = useCallback((user: User) => {
+    setUserState(user);
+  }, []);
+
+  const logout = useCallback(() => {
+    setUserState(null);
+  }, []);
+
+  return (
+    <AuthContext
+      value={{
+        user: user,
+        logOut: logout,
+        setUser: setUser,
+      }}
+    >
+      {children}
+    </AuthContext>
+  );
+};
+
+export function useAuth() {
+  const context = use(AuthContext);
+  if (!context) {
+    throw new Error('useAuth must be used within a AuthProvider');
+  }
+  return context;
+}
--- a/apps/frontend/app/providers/FormProvider.tsx
+++ b/apps/frontend/app/providers/FormProvider.tsx
@@ -0,0 +1,18 @@
+import { createFormHook, createFormHookContexts } from '@tanstack/react-form';
+import { TextField, TextFieldErrorMessage } from '../components/Form/TextField';
+import { ResetButton, SubmitButton } from '../components/Form/Button';
+
+const { fieldContext, formContext } = createFormHookContexts();
+
+export const formHook = createFormHook({
+  fieldComponents: {
+    TextField,
+    TextFieldErrorMessage,
+  },
+  formComponents: {
+    SubmitButton,
+    ResetButton,
+  },
+  fieldContext,
+  formContext,
+});
--- a/apps/frontend/app/providers/LayoutProvider.tsx
+++ b/apps/frontend/app/providers/LayoutProvider.tsx
@@ -0,0 +1,38 @@
+import { createContext, use, useState, type PropsWithChildren } from 'react';
+import type { NavItem } from '../components/layout/types';
+
+type LayoutProviderProps = PropsWithChildren<object>;
+type LayoutContextType = {
+  activeTab: NavItem;
+  setActiveTab: (tab: NavItem) => void;
+  isMobileMenuOpen: boolean;
+  setIsMobileMenuOpen: (open: boolean) => void;
+};
+
+const LayoutContext = createContext<LayoutContextType | null>(null);
+
+export const LayoutProvider: React.FC<LayoutProviderProps> = ({ children }) => {
+  const [activeTab, setActiveTab] = useState<NavItem>('Dashboard');
+  const [isMobileMenuOpen, setIsMobileMenuOpen] = useState(false);
+
+  return (
+    <LayoutContext
+      value={{
+        activeTab,
+        setActiveTab,
+        isMobileMenuOpen,
+        setIsMobileMenuOpen,
+      }}
+    >
+      {children}
+    </LayoutContext>
+  );
+};
+
+export function useLayout() {
+  const context = use(LayoutContext);
+  if (!context) {
+    throw new Error('useLayout must be used within a LayoutProvider');
+  }
+  return context;
+}
--- a/apps/frontend/app/root.tsx
+++ b/apps/frontend/app/root.tsx
@@ -1,8 +1,18 @@
 import { isRouteErrorResponse, Links, Meta, Outlet, Scripts, ScrollRestoration } from 'react-router';
 import type { Route } from './+types/root';
+import '@radix-ui/themes/styles.css';
 import './app.css';
-import { Theme } from '@radix-ui/themes';
+// start: react-toastify special import
+// ! MUST use unstyled version for dev server build, styled version for production build is handled in vite.config.ts
+import { ToastContainer } from 'react-toastify/unstyled';
+import 'react-toastify/ReactToastify.css';
+// end: react-toastify special import
+import AppTheme from './components/theme';
 import { ApiProvider } from './providers/ApiProvider';
+import { LayoutProvider } from './providers/LayoutProvider';
+import { Tooltip } from 'radix-ui';
+import { AuthProvider } from './providers/AuthProvider';
+import { ApiHealthProvider } from './providers/ApiHealthProvider';

 export const links: Route.LinksFunction = () => [];

@@ -26,11 +36,23 @@ export function Layout({ children }: { children: React.ReactNode }) {

 export default function App() {
  return (
-    <Theme>
+    <>
+      <AppTheme>
        <ApiProvider>
+          <Tooltip.Provider delayDuration={250}>
+            <LayoutProvider>
+              <ApiHealthProvider>
+                <AuthProvider>
                  <Outlet />
+                </AuthProvider>
+              </ApiHealthProvider>
+            </LayoutProvider>
+          </Tooltip.Provider>
        </ApiProvider>
-    </Theme>
+      </AppTheme>
+
+      <ToastContainer />
+    </>
  );
 }

--- a/apps/frontend/app/routes.ts
+++ b/apps/frontend/app/routes.ts
@@ -1,7 +1,9 @@
-import { type RouteConfig, index, route } from '@react-router/dev/routes';
+import { type RouteConfig, index, layout, route } from '@react-router/dev/routes';

 export default [
-  index('routes/home.tsx'),
+  route('login', 'routes/auth/login.tsx'),
+  route('init', 'routes/init.tsx'),
+  layout('routes/layout.tsx', [index('routes/home.tsx')]),
  // catch-all 404 route
  route('*', 'routes/404.tsx'),
 ] satisfies RouteConfig;
--- a/apps/frontend/app/routes/auth/login.tsx
+++ b/apps/frontend/app/routes/auth/login.tsx
@@ -0,0 +1,153 @@
+import { Box, Container, Flex, Heading } from '@radix-ui/themes';
+import { useMutation } from '@tanstack/react-query';
+import { useLocation, useNavigate } from 'react-router';
+import { toast } from 'react-toastify/unstyled';
+import * as v from 'valibot';
+import { useResponseErrorHandler } from '../../hooks/ResponseHelper';
+import { useApi } from '../../providers/ApiProvider';
+import { formHook } from '../../providers/FormProvider';
+import type { Route } from './+types/login';
+import { SearchParamKeys } from '../../lib/constants';
+import { AxiosError } from 'axios';
+import { useQueryMessage } from '../../hooks/useQueryMessage';
+
+const loginFormSchema = v.object({
+  username: v.pipe(v.string(), v.trim(), v.minLength(1, 'Username is required')),
+  password: v.pipe(v.string(), v.minLength(1, 'Password is required')),
+});
+
+// eslint-disable-next-line no-empty-pattern
+export function meta({}: Route.MetaArgs): Route.MetaDescriptors {
+  return [{ title: 'Login | YANPM' }];
+}
+
+// TODO: remember me
+export default function LoginRoute() {
+  const navigate = useNavigate();
+  const location = useLocation();
+  const { tanstackApiClient } = useApi();
+  const { defaultResponseErrorHandler } = useResponseErrorHandler();
+  useQueryMessage();
+
+  const { mutateAsync: login, isPending } = useMutation({
+    ...tanstackApiClient.mutation('post', '/api/auth/login').mutationOptions,
+    onSuccess: async () => {
+      const searchParams = new URLSearchParams(location.search);
+      const redirectTo = searchParams.get(SearchParamKeys.Redirect);
+      if (redirectTo) {
+        navigate(redirectTo);
+        return;
+      }
+      navigate('/');
+    },
+    onError: (error) => {
+      if (defaultResponseErrorHandler(error, { disableUnauthorizedHandling: true })) return;
+      if (error instanceof AxiosError && error.status === 401) {
+        toast.error('Invalid username or password.', {
+          position: 'top-center',
+          autoClose: 5000,
+          hideProgressBar: false,
+          closeOnClick: true,
+          pauseOnHover: true,
+          draggable: false,
+          progress: undefined,
+          theme: 'colored',
+        });
+        return;
+      }
+      console.error('Login failed:', error);
+    },
+  });
+
+  const form = formHook.useAppForm({
+    defaultValues: {
+      username: '',
+      password: '',
+    },
+    validators: {
+      onBlur: loginFormSchema,
+      onSubmit: loginFormSchema,
+    },
+
+    onSubmit: async ({ value }) => {
+      toast.dismiss();
+      return await login({ body: { password: value.password, username: value.username } }).catch(() => {});
+    },
+  });
+
+  return (
+    <>
+      <Flex align="center" justify="center" style={{ minHeight: 'calc(100vh - 64px)' }}>
+        <Container size="3" p="0">
+          <Box
+            style={{
+              display: 'flex',
+              flexDirection: 'column',
+              maxWidth: 420,
+              margin: '40px auto',
+              backgroundColor: 'white',
+              padding: 24,
+              borderRadius: 8,
+              boxShadow: '0 6px 18px rgba(15,23,42,0.2)',
+            }}
+          >
+            <Heading size="6" style={{ marginBottom: 16, alignSelf: 'center' }}>
+              Sign In
+            </Heading>
+            <form
+              onSubmit={(e) => {
+                e.preventDefault();
+                form.handleSubmit();
+              }}
+            >
+              <form.AppField
+                name="username"
+                children={(field) => (
+                  <>
+                    <field.TextField
+                      label={'Username'}
+                      value={field.state.value}
+                      autoComplete="username"
+                      spellCheck={false}
+                      required
+                      onChange={(e) => field.handleChange(e.target.value)}
+                    />
+                    <field.TextFieldErrorMessage {...field.state.meta} />
+                  </>
+                )}
+              />
+
+              <form.AppField
+                name="password"
+                children={(field) => (
+                  <>
+                    <field.TextField
+                      label={'Password'}
+                      value={field.state.value}
+                      type="password"
+                      required
+                      autoComplete="current-password"
+                      onChange={(e) => field.handleChange(e.target.value)}
+                      showPasswordToggle
+                    />
+                    <field.TextFieldErrorMessage {...field.state.meta} />
+                  </>
+                )}
+              />
+
+              <div style={{ marginTop: 18, display: 'flex', gap: 8, justifySelf: 'center' }}>
+                <form.SubmitButton
+                  loading={isPending}
+                  label={{
+                    default: 'Sign In',
+                    loading: 'Signing In…',
+                  }}
+                />
+              </div>
+            </form>
+          </Box>
+        </Container>
+      </Flex>
+    </>
+  );
+}
--- a/apps/frontend/app/routes/home.tsx
+++ b/apps/frontend/app/routes/home.tsx
@@ -1,13 +1,75 @@
-import { Text } from '@radix-ui/themes';
+import { Box, Button, Card, Flex, Grid, Heading, Text } from '@radix-ui/themes';
 import type { Route } from './+types/home';
-import { useContext } from 'react';
-import { useApi } from '../providers/ApiProvider';
-import { useQuery } from '@tanstack/react-query';
+import TablePlaceholder from '../components/home/TablePlaceholder';
+import { useLayout } from '../providers/LayoutProvider';
+import { useEnsureLoggedIn } from '../hooks/ensureLoggedIn';

+// eslint-disable-next-line no-empty-pattern
 export function meta({}: Route.MetaArgs) {
-  return [{ title: 'YANPM' }, { name: 'description', content: 'Welcome to Yet Another Nginx Proxy Manager!' }];
+  return [{ title: 'Proxy Host Demo | YANPM' }, { name: 'description', content: 'Demo of the unified navigation paradigm.' }];
 }

-export default function Home() {
-  return <Text>Welcome to Yet Another Nginx Proxy Manager!</Text>;
+export default function ProxyHostDemo() {
+  useEnsureLoggedIn();
+  const { activeTab } = useLayout();
+  return (
+    <Box>
+      <Heading size="7" mb="1">
+        {activeTab}
+      </Heading>
+      <Text color="gray" mb="4" as="p">
+        This is the {activeTab.toLowerCase()} page demo.
+      </Text>
+
+      <Grid columns={{ initial: '1', sm: '2', lg: '3' }} gap="4">
+        <Card size="2">
+          <Flex direction="column" gap="2">
+            <Text size="2" weight="bold">
+              Status Overview
+            </Text>
+            <Text size="2" color="gray">
+              Everything is running smoothly in your {activeTab.toLowerCase()} section.
+            </Text>
+            <Button variant="surface" size="1" style={{ width: 'fit-content' }} mt="1">
+              View Details
+            </Button>
+          </Flex>
+        </Card>
+        <Card size="2">
+          <Flex direction="column" gap="2">
+            <Text size="2" weight="bold">
+              Recent Activity
+            </Text>
+            <Text size="2" color="gray">
+              No recent changes detected in the last 24 hours.
+            </Text>
+            <Button variant="surface" size="1" style={{ width: 'fit-content' }} mt="1">
+              Refresh
+            </Button>
+          </Flex>
+        </Card>
+        <Card size="2">
+          <Flex direction="column" gap="2">
+            <Text size="2" weight="bold">
+              Quick Actions
+            </Text>
+            <Text size="2" color="gray">
+              Common tasks related to {activeTab.toLowerCase()} are available here.
+            </Text>
+            <Button variant="solid" size="1" style={{ width: 'fit-content' }} mt="1">
+              Get Started
+            </Button>
+          </Flex>
+        </Card>
+      </Grid>
+
+      {activeTab === 'Proxy Hosts' && (
+        <Box mt="6">
+          <Card variant="surface">
+            <TablePlaceholder />
+          </Card>
+        </Box>
+      )}
+    </Box>
+  );
 }
--- a/apps/frontend/app/routes/init.tsx
+++ b/apps/frontend/app/routes/init.tsx
@@ -0,0 +1,161 @@
+import { Box, Container, Flex, Heading, Text } from '@radix-ui/themes';
+import { useMutation, useQuery } from '@tanstack/react-query';
+import { useNavigate } from 'react-router';
+import { toast } from 'react-toastify/unstyled';
+import * as v from 'valibot';
+import { useResponseErrorHandler } from '../hooks/ResponseHelper';
+import { useApi } from '../providers/ApiProvider';
+import { formHook } from '../providers/FormProvider';
+import { TooltipContentContainer } from '../components/info';
+import { SearchParamKeys } from '../lib/constants';
+import { useQueryMessage } from '../hooks/useQueryMessage';
+import { QueryMessageCode, QueryMessageType } from '../lib/QueryMessages';
+
+const initFormSchema = v.object({
+  username: v.pipe(v.string(), v.trim(), v.minLength(1, 'Username is required')),
+  password: v.pipe(v.string(), v.minLength(1, 'Password is required')),
+  setup_secret: v.pipe(v.string(), v.minLength(1, 'Setup secret is required')),
+});
+
+export default function InitRoute() {
+  const navigate = useNavigate();
+  const { tanstackApiClient } = useApi();
+  const { defaultResponseErrorHandler } = useResponseErrorHandler();
+  const { toSearchParamQueryMessage } = useQueryMessage();
+
+  const { mutateAsync: initAdmin, isPending } = useMutation({
+    ...tanstackApiClient.mutation('post', '/api/auth/init_admin').mutationOptions,
+    onSuccess: async () => {
+      const searchParams = new URLSearchParams();
+      searchParams.set(SearchParamKeys.Message, toSearchParamQueryMessage(QueryMessageCode.InitializationSuccessful, QueryMessageType.Success));
+      navigate(`/login?${searchParams.toString()}`);
+    },
+    onError: (error) => {
+      if (defaultResponseErrorHandler(error)) return;
+      console.error('Init failed:', error);
+    },
+  });
+
+  const { queryOptions: healthInfoQuery } = tanstackApiClient.get('/api/health/info');
+  useQuery({
+    ...healthInfoQuery,
+    queryFn: async (...args) => {
+      try {
+        const data = await healthInfoQuery.queryFn!(...args);
+        if (data.is_initialized) {
+          navigate('/login', { replace: true });
+          return data;
+        }
+        return data;
+      } catch (error) {
+        if (defaultResponseErrorHandler(error)) return {} as never;
+        throw error;
+      }
+    },
+  });
+
+  const form = formHook.useAppForm({
+    defaultValues: { username: '', password: '', setup_secret: '' },
+    validators: { onBlur: initFormSchema, onSubmit: initFormSchema },
+    onSubmit: async ({ value }) => {
+      toast.dismiss();
+      return await initAdmin({ body: { username: value.username, password: value.password, setup_secret: value.setup_secret } });
+    },
+  });
+
+  return (
+    <>
+      <Flex align="center" justify="center" style={{ minHeight: 'calc(100vh - 64px)' }}>
+        <Container size="3" p="0">
+          <Box
+            style={{
+              display: 'flex',
+              flexDirection: 'column',
+              maxWidth: 480,
+              margin: '40px auto',
+              backgroundColor: 'white',
+              padding: 24,
+              borderRadius: 8,
+              boxShadow: '0 6px 18px rgba(15,23,42,0.06)',
+            }}
+          >
+            <Heading size="6" style={{ marginBottom: 12, alignSelf: 'center' }}>
+              Initialize YANPM
+            </Heading>
+
+            <Heading size="3" style={{ marginBottom: 24, color: 'var(--gray-11)', alignSelf: 'center' }}>
+              Create the initial admin user
+            </Heading>
+            <form
+              onSubmit={(e) => {
+                e.preventDefault();
+                form.handleSubmit();
+              }}
+            >
+              <form.AppField
+                name="username"
+                children={(field) => (
+                  <>
+                    <field.TextField
+                      label="Username"
+                      value={field.state.value}
+                      autoComplete="username"
+                      spellCheck={false}
+                      required
+                      onChange={(e) => field.handleChange(e.target.value)}
+                    />
+                    <field.TextFieldErrorMessage {...field.state.meta} />
+                  </>
+                )}
+              />
+
+              <form.AppField
+                name="password"
+                children={(field) => (
+                  <>
+                    <field.TextField
+                      label="Password"
+                      value={field.state.value}
+                      type="password"
+                      required
+                      autoComplete="new-password"
+                      onChange={(e) => field.handleChange(e.target.value)}
+                      showPasswordToggle
+                    />
+                    <field.TextFieldErrorMessage {...field.state.meta} />
+                  </>
+                )}
+              />
+
+              <form.AppField
+                name="setup_secret"
+                children={(field) => (
+                  <>
+                    <field.TextField
+                      label="Setup Secret"
+                      value={field.state.value}
+                      required
+                      onChange={(e) => field.handleChange(e.target.value)}
+                      infoIconProps={{
+                        children: (
+                          <TooltipContentContainer>
+                            <Text>This secret is provided when the API server is first started. Refer to your server logs to find it.</Text>
+                          </TooltipContentContainer>
+                        ),
+                      }}
+                    />
+                    <field.TextFieldErrorMessage {...field.state.meta} />
+                  </>
+                )}
+              />
+
+              <div style={{ marginTop: 18, display: 'flex', gap: 8, justifySelf: 'center' }}>
+                <form.SubmitButton loading={isPending} label={{ default: 'Initialize' }} />
+              </div>
+            </form>
+          </Box>
+        </Container>
+      </Flex>
+    </>
+  );
+}
--- a/apps/frontend/app/routes/layout.tsx
+++ b/apps/frontend/app/routes/layout.tsx
@@ -0,0 +1,88 @@
+import { Flex, Box, Container, Dialog, Heading, IconButton, TextField } from '@radix-ui/themes';
+import SidebarContent from '../components/layout/SidebarContent';
+import { useLayout } from '../providers/LayoutProvider';
+import { Menu, Search, Bell } from 'lucide-react';
+import { Outlet } from 'react-router';
+
+export default function LayoutContainer() {
+  const { activeTab, isMobileMenuOpen, setIsMobileMenuOpen } = useLayout();
+  return (
+    <Flex style={{ minHeight: '100vh', backgroundColor: 'var(--gray-2)' }}>
+      {/* Desktop Sidebar */}
+      <Box
+        display={{ initial: 'none', md: 'block' }}
+        style={{
+          width: '260px',
+          backgroundColor: 'white',
+          borderRight: '1px solid var(--gray-4)',
+          position: 'sticky',
+          top: 0,
+          minHeight: '100vh',
+          overflowY: 'auto',
+        }}
+      >
+        <SidebarContent />
+      </Box>
+
+      {/* Main Content Area */}
+      <Box style={{ flex: 1, minWidth: 0 }}>
+        {' '}
+        {/* Top Header (Mobile & Desktop) */}
+        <Flex
+          align="center"
+          justify="between"
+          px="4"
+          style={{
+            height: '64px',
+            backgroundColor: 'white',
+            borderBottom: '1px solid var(--gray-4)',
+            position: 'sticky',
+            top: 0,
+            zIndex: 10,
+          }}
+        >
+          <Flex align="center" gap="3">
+            <Box display={{ md: 'none' }}>
+              <Dialog.Root open={isMobileMenuOpen} onOpenChange={setIsMobileMenuOpen}>
+                <Dialog.Trigger>
+                  <IconButton variant="ghost" color="gray">
+                    <Menu />
+                  </IconButton>
+                </Dialog.Trigger>
+                <Dialog.Content
+                  style={{
+                    position: 'fixed',
+                    left: 0,
+                    top: 0,
+                    bottom: 0,
+                    margin: 0,
+                    width: '280px',
+                    borderRadius: 0,
+                    padding: 0,
+                  }}
+                >
+                  <SidebarContent />
+                </Dialog.Content>
+              </Dialog.Root>
+            </Box>
+            <Heading size="4">{activeTab}</Heading>
+          </Flex>
+
+          <Flex align="center" gap="3">
+            <TextField.Root placeholder="Search..." size="2">
+              <TextField.Slot>
+                <Search />
+              </TextField.Slot>
+            </TextField.Root>
+            <IconButton variant="ghost" color="gray">
+              <Bell />
+            </IconButton>
+          </Flex>
+        </Flex>
+        <Container size="4" p="5" style={{ paddingTop: 20 }}>
+          <Outlet />
+        </Container>
+      </Box>
+    </Flex>
+  );
+}
--- a/apps/frontend/app/vite-env.d.ts
+++ b/apps/frontend/app/vite-env.d.ts
@@ -1,7 +1,6 @@
 interface ViteTypeOptions {
-  // By adding this line, you can make the type of ImportMetaEnv strict
-  // to disallow unknown keys.
-  // strictImportMetaEnv: unknown
+  // disallow unknown keys.
+  strictImportMetaEnv: unknown;
 }

 interface ImportMetaEnv {
--- a/apps/frontend/eslint.config.ts
+++ b/apps/frontend/eslint.config.ts
@@ -0,0 +1,42 @@
+import js from '@eslint/js';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+import pluginReact from 'eslint-plugin-react';
+import pluginReactHooks from 'eslint-plugin-react-hooks';
+
+export default tseslint.config(
+  {
+    // Ignore files and directories
+    ignores: ['node_modules', 'app/generated', 'build', '.react-router'],
+  },
+  js.configs.recommended,
+  ...tseslint.configs.recommended,
+  {
+    languageOptions: {
+      ecmaVersion: 2020,
+      globals: {
+        ...globals.browser,
+        ...globals.node,
+      },
+      parserOptions: {
+        project: ['./tsconfig.json', './tsconfig.node.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {},
+  },
+  {
+    ...pluginReact.configs.flat.recommended, // Enables core React rules
+    ...pluginReactHooks.configs.flat.recommended, // Enables React Hooks rules
+    languageOptions: {
+      parserOptions: {
+        ecmaFeatures: {
+          jsx: true,
+        },
+      },
+      globals: {
+        ...globals.browser,
+      },
+    },
+  }
+);
--- a/apps/frontend/package.json
+++ b/apps/frontend/package.json
@@ -7,32 +7,45 @@
    "dev": "react-router dev",
    "start": "react-router-serve ./build/server/index.js",
    "typecheck": "react-router typegen && tsc",
+    "lint": "eslint .",
    "test": "echo \"No tests specified\" && exit 0",
    "generate:openapi": "typed-openapi ../api/swagger.json --tanstack tanstack-client.ts -o ./app/generated/api-client/api-client.ts"
  },
  "dependencies": {
+    "@radix-ui/react-tooltip": "^1.2.8",
    "@radix-ui/themes": "^3.2.1",
    "@react-router/node": "^7.9.2",
    "@react-router/serve": "^7.9.2",
+    "@tanstack/react-form": "^1.27.5",
    "@tanstack/react-query": "^5.90.12",
    "axios": "^1.13.2",
+    "globals": "^16.5.0",
    "isbot": "^5.1.31",
+    "lucide-react": "^0.562.0",
    "radix-ui": "^1.4.3",
    "react": "^19.1.1",
    "react-dom": "^19.1.1",
-    "react-router": "^7.9.2"
+    "react-router": "^7.9.2",
+    "react-toastify": "^11.0.5",
+    "valibot": "^1.2.0"
  },
  "devDependencies": {
+    "@eslint/js": "^9.39.2",
    "@react-router/dev": "^7.9.2",
    "@tailwindcss/vite": "^4.1.13",
    "@types/node": "^22",
    "@types/react": "^19.1.13",
    "@types/react-dom": "^19.1.9",
    "dotenv": "^17.2.3",
+    "eslint": "^9.39.2",
+    "eslint-plugin-react": "^7.37.5",
+    "eslint-plugin-react-hooks": "^7.0.1",
    "tailwindcss": "^4.1.13",
    "typed-openapi": "^2.2.3",
    "typescript": "^5.9.2",
+    "typescript-eslint": "^8.50.0",
    "vite": "^7.1.7",
+    "vite-plugin-eslint": "^1.8.1",
    "vite-tsconfig-paths": "^5.1.4"
  }
 }
--- a/apps/frontend/pnpm-lock.yaml
+++ b/apps/frontend/pnpm-lock.yaml
--- a/apps/frontend/vite.config.ts
+++ b/apps/frontend/vite.config.ts
@@ -2,8 +2,37 @@ import { reactRouter } from '@react-router/dev/vite';
 import tailwindcss from '@tailwindcss/vite';
 import { defineConfig } from 'vite';
 import tsconfigPaths from 'vite-tsconfig-paths';
+// @ts-expect-error vite-plugin-eslint has no types
+import eslint from 'vite-plugin-eslint';

-export default defineConfig({
-  plugins: [tailwindcss(), reactRouter(), tsconfigPaths()],
+export default defineConfig(({ command }) => {
+  const isBuild = command === 'build';
+
+  return {
+    plugins: [
+      tailwindcss(),
+      reactRouter(),
+      tsconfigPaths(),
+      eslint({
+        failOnError: false,
+      }),
+    ],
+    resolve: {
+      alias: isBuild
+        ? [
+            {
+              // replace unstyled import with styled for SPA build
+              find: 'react-toastify/unstyled',
+              replacement: 'react-toastify',
+            },
+            {
+              // point to the empty CSS file to stub out the import during build, SPA build does not require extra CSS imports
+              find: 'react-toastify/ReactToastify.css',
+              replacement: '~/empty-toastify.css',
+            },
+          ]
+        : [],
+    },
    appType: 'spa',
+  };
 });
--- a/5
+++ b/5
@@ -48,6 +48,11 @@ generate-openapi:
  # Generate API client for frontend
  cd apps/frontend && \
  pnpm generate:openapi
+  # Generate OpenAPI spec for agent
+  cd apps/agent && \
+  cargo run -- --generate-openapi --openapi-output ./openapi.yaml
+  # TODO: Generate API client for agent in api
+

 generate-all: generate-entity generate-openapi

--- a/public/database/src/generated/entities/mod.rs
+++ b/public/database/src/generated/entities/mod.rs
@@ -4,3 +4,4 @@ pub mod prelude;

 pub mod config;
 pub mod user;
+pub mod user_identity;
--- a/public/database/src/generated/entities/prelude.rs
+++ b/public/database/src/generated/entities/prelude.rs
@@ -2,3 +2,4 @@

 pub use super::config::Entity as Config;
 pub use super::user::Entity as User;
+pub use super::user_identity::Entity as UserIdentity;
--- a/public/database/src/generated/entities/session.rs
+++ b/public/database/src/generated/entities/session.rs
@@ -0,0 +1,29 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 2.0.0-rc.18
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[sea_orm::model]
+#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "session")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    pub user_id: Uuid,
+    #[sea_orm(unique)]
+    pub refresh_token_hash: Option<String>,
+    pub expires_at: DateTimeUtc,
+    pub revoked_at: Option<DateTimeUtc>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    #[sea_orm(
+        belongs_to,
+        from = "user_id",
+        to = "id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    pub user: HasOne<super::user::Entity>,
+}
+
+impl ActiveModelBehavior for ActiveModel {}
--- a/public/database/src/generated/entities/user.rs
+++ b/public/database/src/generated/entities/user.rs
@@ -12,10 +12,13 @@ pub struct Model {
    #[sea_orm(unique)]
    pub name: String,
    pub is_admin: bool,
-    pub password_hash: String,
-    pub salt: String,
+    pub is_active: bool,
    pub created_at: DateTimeUtc,
    pub updated_at: DateTimeUtc,
+    pub last_login_at: Option<DateTimeUtc>,
+    pub deleted_at: Option<DateTimeUtc>,
+    #[sea_orm(has_many)]
+    pub user_identities: HasMany<super::user_identity::Entity>,
 }

 impl ActiveModelBehavior for ActiveModel {}
--- a/public/database/src/generated/entities/user_identity.rs
+++ b/public/database/src/generated/entities/user_identity.rs
@@ -0,0 +1,35 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 2.0.0-rc.18
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[sea_orm::model]
+#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "user_identity")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    #[sea_orm(unique_key = "provider")]
+    pub user_id: Uuid,
+    #[sea_orm(unique_key = "provider")]
+    pub provider: String,
+    pub email: Option<String>,
+    pub password_hash: Option<String>,
+    pub is_revoked: bool,
+    #[sea_orm(column_type = "JsonBinary", nullable)]
+    pub metadata: Option<Json>,
+    pub password_changed_at: Option<DateTimeUtc>,
+    pub revoked_at: Option<DateTimeUtc>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    #[sea_orm(
+        belongs_to,
+        from = "user_id",
+        to = "id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    pub user: HasOne<super::user::Entity>,
+}
+
+impl ActiveModelBehavior for ActiveModel {}
--- a/public/migration/src/lib.rs
+++ b/public/migration/src/lib.rs
@@ -10,8 +10,9 @@ pub struct Migrator;
 impl MigratorTrait for Migrator {
    fn migrations() -> Vec<Box<dyn MigrationTrait>> {
        vec![
-            Box::new(m20251011_000001_create_user_table::Migration),
-            Box::new(m20251011_000002_create_config_table::Migration),
+            Box::new(m20251011_000001_create_config_table::Migration),
+            Box::new(m20251011_000002_create_user_table::Migration),
+            Box::new(m20251011_000003_create_user_identity_table::Migration),
        ]
    }
 }
--- a/public/migration/src/migrations.rs
+++ b/public/migration/src/migrations.rs
@@ -1,2 +1,3 @@
-pub mod m20251011_000001_create_user_table;
-pub mod m20251011_000002_create_config_table;
+pub mod m20251011_000001_create_config_table;
+pub mod m20251011_000002_create_user_table;
+pub mod m20251011_000003_create_user_identity_table;
--- a/public/migration/src/migrations/m20251011_000001_create_config_table.rs
+++ b/public/migration/src/migrations/m20251011_000001_create_config_table.rs
--- a/public/migration/src/migrations/m20251011_000002_create_user_table.rs
+++ b/public/migration/src/migrations/m20251011_000002_create_user_table.rs
@@ -3,16 +3,19 @@ use sea_orm_migration::{prelude::*, schema::*};
 #[derive(DeriveMigrationName)]
 pub struct Migration;

+#[forbid(dead_code)]
 #[derive(DeriveIden)]
-enum User {
+pub enum User {
    Table,
    Id,
    //
    Name,
    IsAdmin,
-    PasswordHash,
-    Salt,
+    IsActive,
    //
+    LastLoginAt,
+    //
+    DeletedAt,
    CreatedAt,
    UpdatedAt,
 }
@@ -33,8 +36,12 @@ impl MigrationTrait for Migration {
                            .default(false)
                            .not_null(),
                    )
-                    .col(ColumnDef::new(User::PasswordHash).string().not_null())
-                    .col(ColumnDef::new(User::Salt).string().not_null())
+                    .col(
+                        ColumnDef::new(User::IsActive)
+                            .boolean()
+                            .default(true)
+                            .not_null(),
+                    )
                    .col(
                        ColumnDef::new(User::CreatedAt)
                            .timestamp()
@@ -47,6 +54,8 @@ impl MigrationTrait for Migration {
                            .default(SimpleExpr::Keyword(Keyword::CurrentTimestamp))
                            .not_null(),
                    )
+                    .col(ColumnDef::new(User::LastLoginAt).timestamp().null())
+                    .col(ColumnDef::new(User::DeletedAt).timestamp().null())
                    .to_owned(),
            )
            .await
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
GW_MC	b823fe6281	feat: Fix permission and env errors, add loggings, socket perm args	2025-12-21 18:52:26 +08:00
GW_MC	7781878c2d	feat: implement Dockerfile and service scripts for yanpm-agent	2025-12-21 17:51:43 +08:00
GW_MC	4ca59d2bb6	feat: add agent module with Nginx service commands and routes - Introduced a new agent module with commands for managing Nginx configurations. - Implemented `NginxService` for handling reload, validation, and configuration writing. - Added routes for status, validation, and configuration writing using Axum. - Created necessary command files: `reload.rs`, `run.rs`, `validate.rs`, `write_config.rs`. - Updated `Cargo.toml` and `Cargo.lock` to include new dependencies. - Added `.gitignore` for the agent module. - Updated `justfile` to include OpenAPI generation for the agent.	2025-12-21 15:32:42 +08:00
GW_MC	8334da8cf1	Merge pull request 'feature/frontend-login' (#10 ) from feature/frontend-login into master All checks were successful Test / test-frontend (push) Successful in 20s Details Test / lint-frontend (push) Successful in 23s Details Test / frontend-build (push) Successful in 27s Details Test / test (push) Successful in 45s Details Verify / verify-generated-code (push) Successful in 58s Details Verify / verify-openapi-spec (push) Successful in 58s Details Verify / verify-frontend-api-client (push) Successful in 19s Details Test / lint (push) Successful in 1m1s Details Reviewed-on: #10	2025-12-20 19:01:04 +08:00
GW_MC	dc7b70e039	Fix trailing whitespace All checks were successful Test / test-frontend (pull_request) Successful in 23s Details Test / lint-frontend (pull_request) Successful in 25s Details Test / frontend-build (pull_request) Successful in 29s Details Test / test (pull_request) Successful in 46s Details Verify / verify-generated-code (pull_request) Successful in 59s Details Verify / verify-openapi-spec (pull_request) Successful in 1m1s Details Verify / verify-frontend-api-client (pull_request) Successful in 20s Details Test / lint (pull_request) Successful in 1m3s Details	2025-12-20 18:48:35 +08:00
GW_MC	873b4a9d3a	refactor: remove dead code annotations from UserService and SettingsStore traits Some checks failed Test / test-frontend (pull_request) Successful in 21s Details Test / lint-frontend (pull_request) Successful in 25s Details Test / frontend-build (pull_request) Successful in 29s Details Test / test (pull_request) Successful in 46s Details Verify / verify-generated-code (pull_request) Successful in 1m0s Details Verify / verify-openapi-spec (pull_request) Successful in 1m0s Details Verify / verify-frontend-api-client (pull_request) Successful in 20s Details Test / lint (pull_request) Failing after 1m4s Details	2025-12-20 18:23:43 +08:00
GW_MC	596eb8faea	feat: add mock implementations for configuration settings and update AppState to include config	2025-12-20 18:22:33 +08:00
GW_MC	0cd6e837fc	fix: include InvalidSignature in JWT validation error handling	2025-12-20 18:21:54 +08:00
GW_MC	be63fcbc37	feat: fix incorrect JWT cookie key	2025-12-20 16:40:41 +08:00
GW_MC	3f252a8abd	feat: add required asterisk indicator to TextField component All checks were successful Test / test-frontend (pull_request) Successful in 22s Details Test / lint-frontend (pull_request) Successful in 25s Details Test / frontend-build (pull_request) Successful in 29s Details Verify / verify-generated-code (pull_request) Successful in 56s Details Test / test (pull_request) Successful in 46s Details Verify / verify-openapi-spec (pull_request) Successful in 57s Details Verify / verify-frontend-api-client (pull_request) Successful in 22s Details Test / lint (pull_request) Successful in 1m6s Details	2025-12-20 16:20:31 +08:00
GW_MC	0740072a60	Fix query message display code instead of message	2025-12-20 16:17:59 +08:00
GW_MC	ff752985c6	fix: update ESLint ignores to include 'build' and '.react-router' All checks were successful Test / test-frontend (pull_request) Successful in 30s Details Test / lint-frontend (pull_request) Successful in 33s Details Test / frontend-build (pull_request) Successful in 34s Details Verify / verify-generated-code (pull_request) Successful in 8m33s Details Verify / verify-openapi-spec (pull_request) Successful in 8m38s Details Verify / verify-frontend-api-client (pull_request) Successful in 22s Details Test / test (pull_request) Successful in 8m58s Details Test / lint (pull_request) Successful in 1m8s Details	2025-12-20 14:34:01 +08:00
GW_MC	feb5122843	reafctor toast messages into a single file	2025-12-20 14:32:42 +08:00
GW_MC	0260a03e1b	Refactor query message toast	2025-12-20 14:27:08 +08:00
GW_MC	a88e4d7274	feat: add React and React Hooks support to ESLint configuration	2025-12-20 13:17:09 +08:00
GW_MC	7d99a4852b	feat: implement authentication and health check providers with hooks for user management	2025-12-20 12:27:42 +08:00
GW_MC	e59e7ca4c8	feat: add user management API with endpoint to retrieve current user information	2025-12-20 12:27:10 +08:00
GW_MC	b0b765b8fa	feat: implement CORS support with configuration options and middleware integration	2025-12-19 21:34:12 +08:00
GW_MC	d861e0cd7d	Fix incorrect login fail handling	2025-12-19 21:20:54 +08:00
GW_MC	b2b1fbaf65	added init page	2025-12-19 21:16:52 +08:00
GW_MC	d1491b8d19	remove unused api interceptor	2025-12-19 21:16:31 +08:00
GW_MC	85e8668e34	Fix incorrect body data handling	2025-12-19 21:16:04 +08:00
GW_MC	a0a9584a4d	feat: add InfoIcon component with tooltip support and integrate into TextField	2025-12-19 20:08:39 +08:00
GW_MC	737797f6dd	feat: update SubmitButton component to support optional label properties and use Radix UI Button	2025-12-19 19:18:33 +08:00
GW_MC	1d1a469fe0	feat: add search parameter keys for redirect and message handling in login flow	2025-12-19 18:53:01 +08:00
GW_MC	227256e0e0	feat: implement frontend login functionality with form handling and error management	2025-12-19 18:33:34 +08:00
GW_MC	5060c84f28	added frontend linting workflow	2025-12-19 18:32:39 +08:00
GW_MC	903b7e6e5a	Add ESLint plugin to Vite configuration for improved linting support	2025-12-19 13:32:30 +08:00
GW_MC	c8b7d6e09c	Merge pull request 'feature/authentication service' (#9 ) from feature/authentication into master All checks were successful Test / test-frontend (push) Successful in 19s Details Test / frontend-build (push) Successful in 21s Details Verify / verify-generated-code (push) Successful in 58s Details Test / test (push) Successful in 46s Details Verify / verify-openapi-spec (push) Successful in 55s Details Verify / verify-frontend-api-client (push) Successful in 16s Details Test / lint (push) Successful in 59s Details Reviewed-on: #9	2025-12-19 12:24:45 +08:00
GW_MC	507b5f0e49	feat: enforce strict expiration checking for JWT and handle existing user identities in password strategy All checks were successful Test / test-frontend (pull_request) Successful in 20s Details Test / frontend-build (pull_request) Successful in 22s Details Verify / verify-generated-code (pull_request) Successful in 58s Details Test / test (pull_request) Successful in 47s Details Verify / verify-openapi-spec (pull_request) Successful in 57s Details Verify / verify-frontend-api-client (pull_request) Successful in 16s Details Test / lint (pull_request) Successful in 1m0s Details	2025-12-19 12:22:13 +08:00
GW_MC	ec81d3228b	fix clippy warnings Some checks failed Test / test-frontend (pull_request) Successful in 38s Details Test / frontend-build (pull_request) Successful in 40s Details Verify / verify-generated-code (pull_request) Successful in 9m2s Details Verify / verify-openapi-spec (pull_request) Successful in 8m43s Details Verify / verify-frontend-api-client (pull_request) Successful in 18s Details Test / test (pull_request) Failing after 8m56s Details Test / lint (pull_request) Successful in 1m9s Details	2025-12-19 10:25:55 +08:00
GW_MC	8111aaf672	feat: enhance health check with application state and initialization status	2025-12-19 10:25:22 +08:00
GW_MC	66b29b96ee	remove unused user service in auth_state	2025-12-18 22:21:15 +08:00
GW_MC	86fb222d18	added serving openapi options	2025-12-18 22:19:16 +08:00
GW_MC	08b1a055a4	feat: add admin user initialization endpoint with request handling	2025-12-18 22:10:50 +08:00
GW_MC	8f2193bed2	Fix invalid query for settings and users	2025-12-18 22:10:10 +08:00
GW_MC	ed4a091d6e	update swagger and api-client	2025-12-18 18:26:27 +08:00
GW_MC	ccd8bc7aa1	Include require auth middleware and login route	2025-12-18 18:26:10 +08:00
GW_MC	b0c11c7c67	feat: add admin initialization and database migration tasks	2025-12-15 15:54:52 +08:00
GW_MC	3354154b87	feat: implement authentication module with JWT support and user management	2025-12-15 15:54:16 +08:00
GW_MC	1233f3b736	fix: implement Display trait for ServiceError enum	2025-12-15 15:50:43 +08:00
GW_MC	b17d111c5d	remove unused session table	2025-12-15 14:20:28 +08:00
GW_MC	9447b64a76	feat: add argon2, jsonwebtoken, and update uuid dependencies	2025-12-07 21:35:50 +08:00
GW_MC	6cd37d6758	use ref of transaction	2025-12-07 21:35:10 +08:00
GW_MC	6a88e401f6	Add debug and BadRequest error	2025-12-07 21:33:01 +08:00
GW_MC	30e500ec44	Added macro for handling both transaction and pooled connection	2025-12-07 19:09:37 +08:00
GW_MC	e758452509	Include user table, identity and session table	2025-12-07 19:08:22 +08:00
GW_MC	9c139d6007	refactor: replace IntoServiceError trait with direct ServiceError conversions	2025-12-07 14:40:11 +08:00
GW_MC	ce404670d6	Merge pull request 'Basic Documentation' (#8 ) from documentation into master All checks were successful Verify / verify-generated-code (push) Successful in 53s Details Verify / verify-openapi-spec (push) Successful in 6s Details Verify / verify-frontend-api-client (push) Successful in 8s Details Test / test-frontend (push) Successful in 21s Details Test / frontend-build (push) Successful in 24s Details Test / lint (push) Successful in 1m9s Details Test / test (push) Successful in 1m14s Details Reviewed-on: #8	2025-12-05 22:50:20 +08:00
				`@@ -0,0 +1 @@`
				`export type NavItem = 'Dashboard' \| 'Proxy Hosts' \| 'Redirection' \| 'SSL' \| 'Settings' \| 'Profile';`
				`@@ -0,0 +1 @@`
				`/* intentionally empty: used to stub react-toastify CSS in production builds */`