Fix panel startup crash and remove move-connections feature (v2.5.9).

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -5,6 +5,9 @@ FROM python:3.12-slim
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     APP_PORT=5000 \
+    PORT=5000 \
+    PANEL_IN_DOCKER=1 \
+    PANEL_BEHIND_PROXY=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1
 
 WORKDIR /app
@@ -17,10 +20,11 @@ COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
+RUN chmod +x scripts/docker-entrypoint.sh
 
 EXPOSE 5000
 
-HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
-  CMD curl -fsS "http://127.0.0.1:${APP_PORT}/docs" >/dev/null || exit 1
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+  CMD curl -fsS "http://127.0.0.1:5000/health" >/dev/null || exit 1
 
-CMD ["python3", "app.py"]
+ENTRYPOINT ["/app/scripts/docker-entrypoint.sh"]

README.md

@@ -1,6 +1,6 @@
 # Amnezia Web Panel
 
-A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Hysteria 2**, **NaiveProxy**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
+A modern, high-performance web interface for managing **AmneziaWG**, **Classic WireGuard**, **Xray (XTLS-Reality)**, **Hysteria 2**, **NaiveProxy**, **Telemt (Telegram MTProxy)**, **Cloudflare WARP**, **NordVPN**, **AmneziaDNS**, **AdGuard Home**, **SOCKS5**, and **NGINX + Let's Encrypt** services on remote Ubuntu servers — from a single dashboard. Designed to provide a premium user experience with robust administrative capabilities.
 
 > ### 🔄 Compatibility with Official Amnezia Client
 > 
@@ -63,9 +63,10 @@ Configuration panel for system parameters and preferences:
     *   **Classic WireGuard**: Standard, high-performance WireGuard protocol for unmatched speed and broad device compatibility with traffic monitoring support.
     *   **Xray (XTLS-Reality)**: Stealthy protocol that masks VPN traffic as standard HTTPS browsing. Pinned to **Xray-core v26.x**; transparently reads both the **panel layout** (`meta.json` + `clientsTable.json`) and the **native Amnezia client layout** (`xray_*.key` files + `clientsTable`), so a node first installed via the official mobile/desktop app can be attached to the panel without re-installation.
     *   **Hysteria 2**: QUIC/HTTP3 proxy from [apernet/hysteria](https://github.com/apernet/hysteria) via `tobyxdd/hysteria:v2` — Let's Encrypt TLS, salamander obfuscation, password auth, `hy2://` share links. Per-server SSL domain/email defaults, renew from settings; install requires free TCP **80** and **443**.
-    *   **NaiveProxy**: HTTPS/HTTP2 camouflage proxy via [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) (Caddy + [klzgrad/forwardproxy](https://github.com/klzgrad/forwardproxy) naïve fork). ACME TLS on the domain, per-client basic auth, `naive+https://` share links. Requires free TCP **80** and **443**.
+    *   **NaiveProxy** (stable): HTTPS/HTTP2 camouflage proxy via [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) (Caddy + [klzgrad/forwardproxy](https://github.com/klzgrad/forwardproxy) naïve fork). ACME TLS on the domain, per-client basic auth, `naive+https://` share links. Requires free TCP **80** and **443**. **Use Karing** as the client — do **not** use v2rayN; other clients are untested.
     *   **Telemt (Telegram MTProxy)**: High-performance Telegram MTProxy with TLS emulation and comprehensive management (quotas, IP limits, real-time session tracking). Robust install path that auto-configures Docker's official apt/yum repository when needed.
     *   **Cloudflare WARP**: Add and manage WARP-powered connectivity from the panel for routing and network flexibility.
+    *   **NordVPN**: Connect/disconnect outbound NordVPN from Settings via the official CLI (optional country/city).
 *   **🛠 Services**:
     *   **AmneziaDNS**: Internal DNS resolver on a private docker network (`amnezia-dns-net`, IP `172.29.172.254`) to prevent DNS leaks and blockings.
     *   **AdGuard Home**: DNS-based ad blocker with a web admin UI. Two install modes: **Replace AmneziaDNS** (takes its IP, all VPN clients use AdGuard immediately) or **Side-by-side** (parallel deployment on `172.29.172.253`, web UI accessible only over the VPN by default). Optional opt-in checkboxes to expose the web UI / DoT / DoH on the host.
@@ -85,6 +86,11 @@ Configuration panel for system parameters and preferences:
 *   **🌐 Internationalization (i18n)**:
     *   Full support for **English**, **Russian**, **French**, **Chinese**, and **Persian**.
     *   Native **RTL (Right-to-Left)** support for Persian language.
+*   **🔄 Auto-update**:
+    *   Settings → About checks releases on [git.evilfox.cc](https://git.evilfox.cc/test2/Amnezia-Web-Panel-main) and can install the latest tag via git + restart (when the panel runs from a git checkout).
+*   **🌍 Tunnels & outbound VPN**:
+    *   **Cloudflare Quick Tunnel** and **ngrok** expose the local panel to the internet.
+    *   **Cloudflare WARP** and **NordVPN** route the host outbound (no public panel URL).
 *   **👥 Advanced User Management**:
     *   Role-based access (Admin, Support, Regular User).
     *   Traffic limits, status monitoring, and account expiration.
@@ -182,22 +188,48 @@ Mac
 ```bash
 cp .env.example .env
 # set SECRET_KEY and strong POSTGRES_PASSWORD in .env
+docker network inspect dokploy-network >/dev/null 2>&1 || docker network create dokploy-network
 docker compose up -d --build
 ```
 
 Panel: `http://localhost:5000` (or `APP_PORT` from `.env`).
 
+### Dokploy
+
+The compose file connects the panel to Dokploy's Traefik network (`dokploy-network`) and exposes the app on **container port 5000** (not 80).
+
+1. Deploy as **Docker Compose** from this repo (Dokploy creates `dokploy-network` automatically).
+2. In Dokploy → your app → **Domains**:
+   - **Service**: `amnezia_panel` (not `db`)
+   - **Container port**: `5000`
+   - **Path**: `/`
+3. Set env vars in Dokploy: `SECRET_KEY` (long random string), strong `POSTGRES_PASSWORD`.
+4. Redeploy after changing domains or env.
+
+If the domain shows **404 page not found** (plain text, Go-style), Traefik has no route to a healthy backend. After redeploying **v2.5.8+**, on the server run:
+
+```bash
+# 1) Panel must answer HTTP inside the container
+docker compose -p home-vpn-g6rfpd exec amnezia_panel curl -fsS http://127.0.0.1:5000/health
+
+# 2) Panel container must be on dokploy-network (required for Traefik)
+docker inspect "$(docker compose -p home-vpn-g6rfpd ps -q amnezia_panel)" \
+  --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}'
+```
+
+You should see `dokploy-network` in the network list. If it is missing, Dokploy cannot route the domain — redeploy with the latest `docker-compose.yml` or run `docker network connect dokploy-network <container>` and redeploy Traefik.
+
 | File | Purpose |
 | --- | --- |
 | `Dockerfile` | Production image (Python 3.12) |
-| `docker-compose.yml` | Panel + PostgreSQL with healthchecks |
+| `docker-compose.yml` | Panel + PostgreSQL with healthchecks, Dokploy/Traefik labels |
 | `.env.example` | Environment template |
 
 **Environment**
 
 | Variable | Default | Description |
 | --- | --- | --- |
-| `APP_PORT` | `5000` | Host port / in-container listen port |
+| `APP_PORT` / `PORT` | `5000` | Host port / in-container listen port |
 | `SECRET_KEY` | (random) | Session signing key — set in production |
 | `DATABASE_URL` | compose DSN | PostgreSQL connection string |
 | `POSTGRES_*` | `amnezia` | DB credentials for the `db` service |
@@ -222,6 +254,55 @@ GitHub Actions workflows in `.github/workflows/`:
 
 ## 📋 Fix / changelog (this fork)
 
+### v2.5.9
+*   **Remove move connections between servers** — feature rolled back; fixes startup crash (`ToggleConnectionRequest` was missing after v2.5.4).
+
+### v2.5.8
+*   **Docker/Dokploy: panel actually serves HTTP** — entrypoint waits for Postgres, runs `uvicorn` with proxy headers; SSL inside the container is forced off when `PANEL_IN_DOCKER` / `PANEL_BEHIND_PROXY` is set (fixes empty replies on port 5000 behind Traefik).
+
+### v2.5.7
+*   **Dokploy / Traefik 404 fix** — `docker-compose.yml` joins `dokploy-network`, Traefik labels point to port **5000**; removed fixed `container_name`; README Dokploy domain setup.
+
+### v2.5.6
+*   **Fix 404 after in-panel update (no tunnel)** — safer Docker restart, validate update before restart, friendly 404 page with panel link.
+
+### v2.5.5
+*   **Fix 404 after panel update** — correct tunnel/local port when `APP_PORT` is set (Docker), health check before reload, auto-restart quick tunnels after reboot, reliable archive download URLs.
+
+### v2.5.3
+*   **Fix gray Update panel button** — enabled by default; Docker installs allow in-container archive updates when `/app` is writable.
+
+### v2.5.2
+*   **Tunnels UI redesign** — Settings → Tunnels: grouped layout (public access / outbound VPN), provider cards, status pills, responsive grid.
+
+### v2.5.1
+*   **One-click panel update** — Settings → About → **Update panel**: downloads release ZIP from Gitea (or `git checkout` when `.git` exists), runs `pip install`, restarts.
+
+### v2.5.0
+*   **NordVPN in Tunnels** — connect/disconnect outbound NordVPN from Settings (official `nordvpn` CLI; optional country/city).
+
+### v2.4.0
+*   **Auto-update from Gitea**: Settings → About checks https://git.evilfox.cc/test2/Amnezia-Web-Panel-main releases and can install the latest tag via `git fetch` + checkout, then restart (git install only).
+
+### v2.3.0
+*   **Cascade removed** — double-VPN feature dropped from the panel (manager, API, UI, i18n).
+
+### v2.2.1
+*   **Cascade egress verify fix**: bind curl to ENTRY `awg0`/`wg0` IP (client-subnet policy route), not cascade peer Address.
+*   Soft-warn (no rollback) when policy route via `cascade` is OK but public-IP echo services fail.
+
+### v2.2.0
+*   **Cascade (double VPN) restored** — later removed in **v2.3.0**.
+*   Inspired by [ryderams/amneziawg-cascade](https://github.com/ryderams/amneziawg-cascade); logic ran over panel SSH (**no remote curl|bash**).
+
+### v2.1.0
+*   **NaiveProxy — stable**: production-ready install (Caddy + klzgrad/forwardproxy), share links always include `:443`.
+*   **Client notes (important)**:
+    *   **Do not use v2rayN** with NaiveProxy (broken DNS/IPv6 behaviour → latency −1 ms even when the server is fine).
+    *   **Karing** — confirmed working.
+    *   Other clients — untested / use at your own risk.
+*   Share-link and config UI hints updated accordingly.
+
 ### v2.0.0-beta
 *   **NaiveProxy** (Beta): install [klzgrad/naiveproxy](https://github.com/klzgrad/naiveproxy) server via Caddy + naïve [forwardproxy](https://github.com/klzgrad/forwardproxy) — domain TLS (ACME), per-client basic auth, `naive+https://` share links.
 *   Marketplace / server page / users / invites / Telegram / backups include NaiveProxy.
@@ -245,7 +326,7 @@ GitHub Actions workflows in `.github/workflows/`:
 ### v1.6.0
 *   **3x-ui multi-panel**: register several 3x-ui servers in Settings; pick a panel and load VLESS inbounds over its API when creating users/invites (share link comes from 3x-ui).
 *   **Docker / CI**: refreshed `Dockerfile` + compose, `.env.example`, CI checks, GHCR image workflow.
-*   **Cascade removed** for now (pending redesign — showed active while internet often did not work).
+*   **Cascade** was temporarily removed in this release (briefly restored in v2.2.x, removed again in **v2.3.0**).
 *   **WG/AWG backups**: ZIP export of client `.conf` + restore with loading feedback.
 *   **API performance**: in-memory data cache, faster server check/stats.
 *   **Share / guest**: one-tap “Copy key”.

app.py

@@ -29,7 +29,8 @@ from fastapi.responses import JSONResponse, RedirectResponse, HTMLResponse, Stre
 from starlette.background import BackgroundTask
 from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
-from fastapi import FastAPI, Request, Query, UploadFile, File
+from fastapi import FastAPI, Request, Query, UploadFile, File, HTTPException
+from starlette.exceptions import HTTPException as StarletteHTTPException
 from starlette.middleware.sessions import SessionMiddleware
 from pydantic import BaseModel
 from typing import Optional, List, Dict
@@ -46,6 +47,7 @@ from managers.awg_manager import AWGManager
 from managers.xray_manager import XrayManager
 from managers.wireguard_manager import WireGuardManager
 from managers.backup_manager import BackupManager
+from managers.update_manager import UpdateManager, version_gt, api_latest_url, repo_url
 import telegram_bot as tg_bot
 
 # Configure logging
@@ -101,9 +103,9 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.0.0-beta"
-RELEASES_REPO_URL = "https://git.evilfox.cc/test2/Amnezia-Web-Panel-main"
-RELEASES_API_LATEST = "https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest"
+CURRENT_VERSION = "v2.5.9"
+RELEASES_REPO_URL = repo_url()
+RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
 TUNNEL_STATE_FILE = os.environ.get('TUNNEL_STATE_FILE', os.path.join(application_path, 'tunnels_state.json'))
 
@@ -137,6 +139,7 @@ TUNNEL_RUNTIMES = {
 TUNNEL_LOCK = threading.Lock()
 TUNNEL_URL_RE = re.compile(r'https://[^\s"\']+')
 WARP_CLI_COMMAND = 'warp-cli.exe' if os.name == 'nt' else 'warp-cli'
+NORDVPN_CLI_COMMAND = 'nordvpn.exe' if os.name == 'nt' else 'nordvpn'
 
 
 
@@ -151,7 +154,7 @@ def load_translations():
             if f.endswith('.json'):
                 lang = f.split('.')[0]
                 try:
-                    with open(os.path.join(trans_dir, f), 'r', encoding='utf-8') as tf:
+                    with open(os.path.join(trans_dir, f), 'r', encoding='utf-8-sig') as tf:
                         TRANSLATIONS[lang] = json.load(tf)
                 except Exception as e:
                     logger.error(f"Error loading translation {f}: {e}")
@@ -222,12 +225,49 @@ def tpl(request, template, **kwargs):
     return templates.TemplateResponse(template, ctx)
 
 
+def get_panel_listen_port(data: Optional[dict] = None) -> int:
+    for env_key in ('APP_PORT', 'PORT'):
+        try:
+            env_port = int(os.environ.get(env_key, '0') or '0')
+        except ValueError:
+            env_port = 0
+        if env_port:
+            return env_port
+    if data is None:
+        data = load_data()
+    ssl_conf = data.get('settings', {}).get('ssl', {}) or {}
+    try:
+        return int(ssl_conf.get('panel_port', 5000) or 5000)
+    except (TypeError, ValueError):
+        return 5000
+
+
+def panel_ssl_active(data: Optional[dict] = None) -> bool:
+    # Behind Docker / reverse proxy TLS is always terminated outside the app.
+    if os.environ.get('PANEL_IN_DOCKER') == '1' or os.environ.get('PANEL_BEHIND_PROXY') == '1':
+        return False
+    if os.environ.get('APP_PORT') or os.environ.get('PORT'):
+        return False
+    if data is None:
+        data = load_data()
+    ssl_conf = data.get('settings', {}).get('ssl', {}) or {}
+    if not ssl_conf.get('enabled'):
+        return False
+    cert_path = ssl_conf.get('cert_path')
+    key_path = ssl_conf.get('key_path')
+    if ssl_conf.get('cert_text') or ssl_conf.get('key_text'):
+        return True
+    return bool(
+        cert_path and key_path
+        and os.path.exists(cert_path) and os.path.exists(key_path)
+    )
+
+
 def get_panel_local_url(request: Optional[Request] = None):
     data = load_data()
-    ssl_conf = data.get('settings', {}).get('ssl', {})
-    scheme = 'https' if ssl_conf.get('enabled') else 'http'
+    scheme = 'https' if panel_ssl_active(data) else 'http'
     host = '127.0.0.1'
-    port = ssl_conf.get('panel_port', 5000) or 5000
+    port = get_panel_listen_port(data)
     if request:
         scheme = request.url.scheme or scheme
         host = request.url.hostname or host
@@ -237,12 +277,59 @@ def get_panel_local_url(request: Optional[Request] = None):
 
 def get_panel_tunnel_target_url():
     data = load_data()
-    ssl_conf = data.get('settings', {}).get('ssl', {})
-    scheme = 'https' if ssl_conf.get('enabled') else 'http'
-    port = ssl_conf.get('panel_port', 5000) or 5000
+    scheme = 'https' if panel_ssl_active(data) else 'http'
+    port = get_panel_listen_port(data)
     return f"{scheme}://127.0.0.1:{port}"
 
 
+def get_panel_public_url(request: Optional[Request] = None) -> str:
+    if request is not None:
+        forwarded_proto = (request.headers.get('x-forwarded-proto') or '').split(',')[0].strip()
+        scheme = forwarded_proto or request.url.scheme or 'http'
+        host = (
+            (request.headers.get('x-forwarded-host') or '').split(',')[0].strip()
+            or request.headers.get('host')
+            or request.url.netloc
+        )
+        if host:
+            return f"{scheme}://{host}/"
+    return get_panel_local_url(request).rstrip('/') + '/'
+
+
+def enrich_update_result(request: Request, result: dict) -> dict:
+    result['panel_url'] = get_panel_public_url(request)
+    return result
+
+
+@app.exception_handler(StarletteHTTPException)
+async def custom_http_exception_handler(request: Request, exc: StarletteHTTPException):
+    if exc.status_code != 404:
+        detail = exc.detail if isinstance(exc.detail, str) else 'Error'
+        if request.url.path.startswith('/api/'):
+            return JSONResponse({'error': detail}, status_code=exc.status_code)
+        return HTMLResponse(f'<h1>{exc.status_code}</h1><p>{detail}</p>', status_code=exc.status_code)
+    if request.url.path.startswith('/api/') or 'application/json' in (request.headers.get('accept') or '').lower():
+        return JSONResponse({'error': 'Not found'}, status_code=404)
+    home = get_panel_public_url(request)
+    return HTMLResponse(
+        f'''<!DOCTYPE html><html><head><meta charset="utf-8"><title>Amnezia Panel</title></head>
+        <body style="font-family:sans-serif;max-width:520px;margin:3rem auto;padding:0 1rem;">
+        <h1>Страница не найдена</h1>
+        <p>Адрес <code>{request.url.path}</code> не существует в панели.</p>
+        <p>Если вы только что обновили панель, подождите 10–30 секунд и откройте:</p>
+        <p><a href="{home}">{home}</a></p>
+        <p><a href="/health">/health</a> — проверка, что панель запущена.</p>
+        </body></html>''',
+        status_code=404,
+    )
+
+
+@app.get('/health', include_in_schema=False)
+@app.get('/api/health', include_in_schema=False)
+async def health_check():
+    return {'status': 'ok', 'version': CURRENT_VERSION}
+
+
 def get_warp_cli_binary():
     found = shutil.which(WARP_CLI_COMMAND)
     if found:
@@ -372,6 +459,152 @@ def disable_warp():
     return get_warp_status()
 
 
+def get_nordvpn_cli_binary():
+    found = shutil.which(NORDVPN_CLI_COMMAND)
+    if found:
+        return found
+    if os.name == 'nt':
+        for base in (os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)')):
+            if not base:
+                continue
+            for sub in ('NordVPN', 'NordVPN NordSec'):
+                candidate = os.path.join(base, sub, 'nordvpn.exe')
+                if os.path.exists(candidate):
+                    return candidate
+    return None
+
+
+def is_nordvpn_cli_installed():
+    return bool(get_nordvpn_cli_binary())
+
+
+def _nordvpn_install_hint():
+    system = platform.system().lower()
+    if system == 'windows':
+        return (
+            'Install NordVPN from https://nordvpn.com/download/ or Microsoft Store, '
+            'then restart this panel.'
+        )
+    if system == 'darwin':
+        return 'Install NordVPN for macOS from https://nordvpn.com/download/, then restart this panel.'
+    return (
+        'Install NordVPN CLI: sh <(curl -sSf https://downloads.nordcdn.com/apps/linux/install.sh), '
+        'add your user to the nordvpn group, run nordvpn login, then restart this panel.'
+    )
+
+
+def run_nordvpn_cli(*args, timeout: int = 30):
+    binary = get_nordvpn_cli_binary()
+    if not binary:
+        raise RuntimeError(_nordvpn_install_hint())
+    creationflags = subprocess.CREATE_NO_WINDOW if os.name == 'nt' else 0
+    result = subprocess.run(
+        [binary, *args],
+        capture_output=True,
+        text=True,
+        encoding='utf-8',
+        errors='replace',
+        timeout=timeout,
+        creationflags=creationflags,
+    )
+    output = '\n'.join(part.strip() for part in (result.stdout, result.stderr) if part and part.strip())
+    if result.returncode != 0:
+        raise RuntimeError(output or f'nordvpn exited with code {result.returncode}')
+    return output
+
+
+def _parse_nordvpn_status(output: str):
+    lowered = (output or '').lower()
+    if 'not logged in' in lowered or 'login required' in lowered or 'please log in' in lowered:
+        return 'not_logged_in'
+    if 'disconnected' in lowered:
+        return 'disconnected'
+    if 'connecting' in lowered:
+        return 'connecting'
+    if 'connected' in lowered:
+        return 'connected'
+    if 'daemon' in lowered or 'nordvpnd' in lowered:
+        return 'service_unavailable'
+    return 'unknown'
+
+
+def _nordvpn_server_line(output: str) -> str:
+    for line in (output or '').splitlines():
+        stripped = line.strip()
+        if not stripped:
+            continue
+        low = stripped.lower()
+        if low.startswith('server:') or low.startswith('country:') or low.startswith('your new ip:'):
+            return stripped
+    return ''
+
+
+def get_nordvpn_status():
+    installed = is_nordvpn_cli_installed()
+    status = {
+        'installed': installed,
+        'running': False,
+        'connected': False,
+        'status': 'not_installed' if not installed else 'unknown',
+        'server': '',
+        'raw': '',
+        'last_error': '' if installed else _nordvpn_install_hint(),
+        'install_hint': _nordvpn_install_hint(),
+    }
+    if not installed:
+        return status
+    try:
+        output = run_nordvpn_cli('status', timeout=15)
+        parsed = _parse_nordvpn_status(output)
+        status.update({
+            'running': parsed in ('connected', 'connecting'),
+            'connected': parsed == 'connected',
+            'status': parsed,
+            'server': _nordvpn_server_line(output),
+            'raw': output,
+            'last_error': '',
+        })
+    except Exception as e:
+        status['last_error'] = str(e)
+        lowered = str(e).lower()
+        if 'not logged in' in lowered or 'login' in lowered:
+            status['status'] = 'not_logged_in'
+        elif 'daemon' in lowered or 'nordvpnd' in lowered or 'service' in lowered or 'permission' in lowered:
+            status['status'] = 'service_unavailable'
+        else:
+            status['status'] = 'error'
+    return status
+
+
+def enable_nordvpn(country: str = '', city: str = ''):
+    current = get_nordvpn_status()
+    if not current.get('installed'):
+        raise RuntimeError(current.get('install_hint') or _nordvpn_install_hint())
+    if current.get('status') == 'not_logged_in':
+        raise RuntimeError(
+            'NordVPN is not logged in. Run `nordvpn login` on this host (browser flow), then retry.'
+        )
+    args = ['connect']
+    country = (country or '').strip()
+    city = (city or '').strip()
+    if country and city:
+        args.extend([country, city])
+    elif country:
+        args.append(country)
+    run_nordvpn_cli(*args, timeout=45)
+    time.sleep(1)
+    return get_nordvpn_status()
+
+
+def disable_nordvpn():
+    current = get_nordvpn_status()
+    if not current.get('installed'):
+        raise RuntimeError(current.get('install_hint') or _nordvpn_install_hint())
+    run_nordvpn_cli('disconnect', timeout=30)
+    time.sleep(0.5)
+    return get_nordvpn_status()
+
+
 def get_tunnel_command_name(provider: str):
     if provider == 'cloudflare':
         return 'cloudflared.exe' if os.name == 'nt' else 'cloudflared'
@@ -1742,7 +1975,6 @@ class HysteriaSettingsRequest(BaseModel):
     email: Optional[str] = None
     renew_ssl: bool = False
 
-
 class ProtocolRequest(BaseModel):
     protocol: str = 'awg'
 
@@ -1993,6 +2225,16 @@ class TunnelStartRequest(BaseModel):
     authtoken: Optional[str] = None
 
 
+class ApplyUpdateRequest(BaseModel):
+    target_version: Optional[str] = None
+    allow_dirty: bool = False
+
+
+class NordvpnConnectRequest(BaseModel):
+    country: Optional[str] = ''
+    city: Optional[str] = ''
+
+
 # ======================== Startup ========================
 
 @app.on_event("startup")
@@ -2097,6 +2339,24 @@ async def startup():
         logger.info("Starting Telegram bot from saved settings...")
         tg_bot.launch_bot(tg_cfg['token'], load_data, generate_vpn_link, save_data)
 
+    # Reattach quick tunnels after panel restart so public URLs keep working.
+    try:
+        tunnel_state = await asyncio.to_thread(load_tunnel_state)
+        local_url = get_panel_tunnel_target_url()
+        for provider in ('cloudflare', 'ngrok'):
+            state = tunnel_state.get(provider) or {}
+            if not (state.get('public_url') or state.get('pid') or state.get('started_at')):
+                continue
+            if state.get('pid') and pid_is_running(state.get('pid')):
+                continue
+            try:
+                await asyncio.to_thread(start_tunnel, provider, local_url)
+                logger.info('Restarted %s tunnel after panel boot -> %s', provider, local_url)
+            except Exception as exc:
+                logger.warning('Could not restart %s tunnel after panel boot: %s', provider, exc)
+    except Exception as exc:
+        logger.warning('Tunnel auto-restart skipped: %s', exc)
+
 
 def _scrape_server_traffic(server, sid, my_conns):
     server_updates = []
@@ -2300,7 +2560,13 @@ async def server_detail(request: Request, server_id: int):
         return RedirectResponse(url='/')
     server = data['servers'][server_id]
     users_list = data.get('users', [])
-    return tpl(request, 'server.html', server=server, server_id=server_id, users=users_list, all_servers=data['servers'])
+    return tpl(
+        request,
+        'server.html',
+        server=server,
+        server_id=server_id,
+        users=users_list,
+    )
 
 
 @app.get('/users', response_class=HTMLResponse, tags=["System Templates"])
@@ -3231,6 +3497,7 @@ async def api_hysteria_update_settings(request: Request, server_id: int, req: Hy
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
+
 @app.post('/api/servers/{server_id}/uninstall', tags=["Protocols"])
 async def api_uninstall_protocol(request: Request, server_id: int, req: ProtocolRequest):
     if not _check_admin(request):
@@ -5459,11 +5726,11 @@ async def api_my_connection_config(request: Request, connection_id: str):
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
-@app.get('/settings', tags=["System Templates"])
+@app.get('/settings', response_class=HTMLResponse, tags=["System Templates"])
 async def settings_page(request: Request):
     user = _check_admin(request)
     if not user:
-        return RedirectResponse('/login')
+        return RedirectResponse('/login', status_code=302)
     data = load_data()
     from managers.xui_servers import list_xui_servers, public_server_view, ensure_xui_servers
     settings = data.setdefault('settings', {})
@@ -5498,6 +5765,8 @@ async def api_check_updates(request: Request):
     if not _check_admin(request):
         return JSONResponse({'error': 'Forbidden'}, status_code=403)
     try:
+        updater = UpdateManager(application_path, CURRENT_VERSION)
+        mode = updater.detect_mode()
         async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
             resp = await client.get(
                 RELEASES_API_LATEST,
@@ -5511,20 +5780,104 @@ async def api_check_updates(request: Request):
         data = resp.json() if resp.content else {}
         latest = (data.get('tag_name') or data.get('name') or '').strip()
         html_url = (data.get('html_url') or f'{RELEASES_REPO_URL}/releases').strip()
+        body = (data.get('body') or '')[:4000]
         current = CURRENT_VERSION
-        update_available = bool(latest) and latest != current
+        update_available = bool(latest) and version_gt(latest, current)
         return {
             'current_version': current,
             'latest_version': latest,
             'update_available': update_available,
             'html_url': html_url,
             'releases_url': f'{RELEASES_REPO_URL}/releases',
+            'body': body,
+            'can_auto_update': bool(mode.get('can_auto_update')),
+            'update_mode': mode.get('update_method') or mode.get('mode'),
+            'mode': mode,
         }
     except Exception as e:
         logger.exception('Error checking for updates')
         return JSONResponse({'error': str(e)}, status_code=502)
 
 
+async def _fetch_latest_release_tag() -> str:
+    async with httpx.AsyncClient(timeout=15.0, follow_redirects=True) as client:
+        resp = await client.get(RELEASES_API_LATEST, headers={'Accept': 'application/json'})
+    if resp.status_code >= 400:
+        raise RuntimeError(f'Release API returned HTTP {resp.status_code}')
+    data = resp.json() if resp.content else {}
+    return (data.get('tag_name') or data.get('name') or '').strip()
+
+
+@app.post('/api/settings/apply_update', tags=["Settings"])
+async def api_apply_update(request: Request, req: ApplyUpdateRequest):
+    """Install a release tag (git checkout or archive download) and restart the panel."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    updater = UpdateManager(application_path, CURRENT_VERSION)
+    target = (req.target_version or '').strip()
+    if not target:
+        try:
+            target = await _fetch_latest_release_tag()
+        except Exception as e:
+            logger.exception('Failed to resolve latest tag for apply_update')
+            return JSONResponse({'error': str(e)}, status_code=502)
+    if not target:
+        return JSONResponse({'error': 'No target version specified'}, status_code=400)
+
+    result = await asyncio.to_thread(
+        updater.apply_update,
+        target,
+        bool(req.allow_dirty),
+    )
+    if result.get('status') != 'success':
+        status_code = 409 if result.get('needs_confirm_dirty') else 500
+        return JSONResponse({'error': result.get('message') or 'Update failed', **result}, status_code=status_code)
+
+    if result.get('restart'):
+        UpdateManager.schedule_restart(application_path, 1.5)
+    return enrich_update_result(request, result)
+
+
+@app.post('/api/settings/upgrade_panel', tags=["Settings"])
+async def api_upgrade_panel(request: Request):
+    """One-click: fetch latest release, install if newer, restart."""
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    updater = UpdateManager(application_path, CURRENT_VERSION)
+    mode = updater.detect_mode()
+    if not mode.get('can_auto_update'):
+        return JSONResponse({
+            'error': (
+                'In-panel update is not available for this install. '
+                'Use git clone / writable app directory, or rebuild Docker on the host.'
+            ),
+            'mode': mode,
+        }, status_code=400)
+    try:
+        latest = await _fetch_latest_release_tag()
+    except Exception as e:
+        return JSONResponse({'error': str(e)}, status_code=502)
+    if not latest:
+        return JSONResponse({'error': 'Could not resolve latest release tag'}, status_code=502)
+    if not version_gt(latest, CURRENT_VERSION):
+        return {
+            'status': 'success',
+            'up_to_date': True,
+            'current_version': CURRENT_VERSION,
+            'latest_version': latest,
+            'message': 'Already on the latest version',
+        }
+
+    result = await asyncio.to_thread(updater.apply_update, latest, True)
+    if result.get('status') != 'success':
+        return JSONResponse({'error': result.get('message') or 'Update failed', **result}, status_code=500)
+    if result.get('restart'):
+        UpdateManager.schedule_restart(application_path, 1.5)
+    result['up_to_date'] = False
+    result['previous_version'] = CURRENT_VERSION
+    return enrich_update_result(request, result)
+
+
 @app.get('/api/settings/tunnels/status', tags=["Settings"])
 async def api_tunnels_status(request: Request):
     if not _check_admin(request):
@@ -5534,6 +5887,7 @@ async def api_tunnels_status(request: Request):
         'cloudflare': get_tunnel_status('cloudflare'),
         'ngrok': get_tunnel_status('ngrok'),
         'warp': get_warp_status(),
+        'nordvpn': get_nordvpn_status(),
     }
 
 
@@ -5619,6 +5973,28 @@ async def api_warp_disconnect(request: Request):
         return JSONResponse({'error': str(e)}, status_code=500)
 
 
+@app.post('/api/settings/nordvpn/connect', tags=["Settings"])
+async def api_nordvpn_connect(request: Request, req: NordvpnConnectRequest = NordvpnConnectRequest()):
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        return await asyncio.to_thread(enable_nordvpn, req.country or '', req.city or '')
+    except Exception as e:
+        logger.exception("Error connecting NordVPN")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
+@app.post('/api/settings/nordvpn/disconnect', tags=["Settings"])
+async def api_nordvpn_disconnect(request: Request):
+    if not _check_admin(request):
+        return JSONResponse({'error': 'Forbidden'}, status_code=403)
+    try:
+        return await asyncio.to_thread(disable_nordvpn)
+    except Exception as e:
+        logger.exception("Error disconnecting NordVPN")
+        return JSONResponse({'error': str(e)}, status_code=500)
+
+
 # @app.post('/api/settings/save')
 # async def api_save_settings(request: Request, body: SaveSettingsRequest):
 #     _check_admin(request)
@@ -6064,17 +6440,15 @@ if __name__ == '__main__':
                 with open(key_file, 'w') as f:
                     f.write(ssl_conf['key_text'].strip() + '\n')
 
-    try:
-        env_port = int(os.environ.get('APP_PORT', '0') or '0')
-    except ValueError:
-        env_port = 0
+    port = get_panel_listen_port(data)
     uvicorn_kwargs = {
         "app": app,
         "host": "0.0.0.0",
-        "port": env_port or ssl_conf.get('panel_port', 5000) or 5000,
+        "port": port,
     }
+    logger.info(f"Amnezia Web Panel {CURRENT_VERSION} listening on http://0.0.0.0:{port}")
     
-    if ssl_conf.get('enabled') and cert_file and key_file:
+    if panel_ssl_active(data) and cert_file and key_file:
         if os.path.exists(cert_file) and os.path.exists(key_file):
             logger.info(f"Starting panel with HTTPS enabled on domain: {ssl_conf.get('domain')} at port {uvicorn_kwargs['port']}")
             uvicorn_kwargs["ssl_certfile"] = cert_file

docker-compose.yml

@@ -1,16 +1,15 @@
 services:
   db:
     image: postgres:17
-    container_name: amnezia_panel_db
     environment:
       POSTGRES_USER: ${POSTGRES_USER:-amnezia}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-amnezia}
       POSTGRES_DB: ${POSTGRES_DB:-amnezia_panel}
     volumes:
       - amnezia_pgdata:/var/lib/postgresql/data
-    ports:
-      - "${POSTGRES_PORT:-5432}:5432"
     restart: unless-stopped
+    networks:
+      - internal
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-amnezia} -d ${POSTGRES_DB:-amnezia_panel}"]
       interval: 10s
@@ -23,7 +22,6 @@ services:
       context: .
       dockerfile: Dockerfile
     image: amnezia-panel:local
-    container_name: amnezia_panel
     depends_on:
       db:
         condition: service_healthy
@@ -33,15 +31,32 @@ services:
       DATABASE_URL: postgresql://${POSTGRES_USER:-amnezia}:${POSTGRES_PASSWORD:-amnezia}@db:5432/${POSTGRES_DB:-amnezia_panel}
       SECRET_KEY: ${SECRET_KEY:-}
       APP_PORT: "5000"
+      PORT: "5000"
+      PANEL_IN_DOCKER: "1"
+      PANEL_BEHIND_PROXY: "1"
     volumes:
       - amnezia_data:/app/data
     restart: unless-stopped
+    networks:
+      - internal
+      - dokploy-network
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=dokploy-network
+    expose:
+      - "5000"
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:5000/docs >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:5000/health >/dev/null || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 40s
+      start_period: 60s
+
+networks:
+  internal:
+  dokploy-network:
+    external: true
+    name: dokploy-network
 
 volumes:
   amnezia_data:

managers/naiveproxy_manager.py

@@ -232,9 +232,13 @@ class NaiveProxyManager:
             # Keep a non-shared bootstrap user so the proxy is never open
             auth_lines = [f'    basic_auth bootstrap {_rand_token(24)}']
         auth_block = '\n'.join(auth_lines)
+        # probe_resistance looks like a fake domain to browsers
         probe = (probe_path or _rand_token(12)).strip('/')
+        if '.' not in probe:
+            probe = f'{probe}.com'
         return f"""{{
   order forward_proxy before file_server
+  admin off
   log {{
     exclude http.log.error
   }}
@@ -242,16 +246,14 @@ class NaiveProxyManager:
 :443, {domain} {{
   tls {email}
   encode
-  route {{
-    forward_proxy {{
+  forward_proxy {{
 {auth_block}
-      hide_ip
-      hide_via
-      probe_resistance {probe}
-    }}
-    file_server {{
-      root /var/www/html
-    }}
+    hide_ip
+    hide_via
+    probe_resistance {probe}
+  }}
+  file_server {{
+    root /var/www/html
   }}
 }}
 """
@@ -398,13 +400,21 @@ CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile
             self._start_container()
 
     def _build_share_uri(self, domain, username, password, name, port=443):
+        """v2rayN / NekoRay / sing-box compatible share link.
+
+        Always include an explicit port — without `:443` v2rayN often treats
+        the port as empty/80 and shows «Свойство Порт недопустимо» / SSL errors.
+        """
+        # Keep credentials unescaped when alphanumeric (our generator); quote otherwise.
         user = quote(username or '', safe='')
         pw = quote(password or '', safe='')
-        host = domain or ''
+        host = (domain or '').strip().lower()
         port = int(port or 443)
-        authority = f'{user}:{pw}@{host}' if port == 443 else f'{user}:{pw}@{host}:{port}'
-        fragment = quote(name or 'naiveproxy', safe='')
-        return f'naive+https://{authority}#{fragment}'
+        if port < 1 or port > 65535:
+            port = 443
+        # Remark: ASCII-safe, no spaces that break some importers
+        remark = re.sub(r'[^\w.\-]+', '-', (name or 'naiveproxy').strip())[:48] or 'naiveproxy'
+        return f'naive+https://{user}:{pw}@{host}:{port}#{remark}'
 
     # ===================== INSTALL / REMOVE =====================
 

managers/update_manager.py

@@ -0,0 +1,452 @@
+"""Panel self-update from the EvilFox Gitea repository (git or release archive)."""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import urllib.error
+import urllib.request
+import zipfile
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+DEFAULT_REPO_URL = 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main'
+DEFAULT_GIT_URL = 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main.git'
+DEFAULT_API_LATEST = 'https://git.evilfox.cc/api/v1/repos/test2/Amnezia-Web-Panel-main/releases/latest'
+UPDATE_REMOTE = 'panel-update'
+
+ARCHIVE_SKIP_DIRS = frozenset({
+    '__pycache__', '.git', 'bin', 'data', 'node_modules', '.venv', 'venv', '.cursor',
+})
+ARCHIVE_SKIP_FILES = frozenset({
+    '.env', 'data.json', 'tunnels_state.json',
+})
+
+
+def _env(name: str, default: str) -> str:
+    return (os.environ.get(name) or default).strip()
+
+
+def repo_url() -> str:
+    return _env('PANEL_UPDATE_REPO_URL', DEFAULT_REPO_URL).rstrip('/')
+
+
+def git_url() -> str:
+    return _env('PANEL_UPDATE_GIT_URL', DEFAULT_GIT_URL)
+
+
+def api_latest_url() -> str:
+    return _env('PANEL_UPDATE_API_LATEST', DEFAULT_API_LATEST)
+
+
+def parse_version(value: str) -> tuple:
+    """Parse semver-ish tags like v2.3.0 / 2.3.0-beta into a comparable tuple."""
+    raw = (value or '').strip()
+    if not raw:
+        return (0, 0, 0, 1, '')
+    raw = raw.lstrip('vV')
+    main, _, pre = raw.partition('-')
+    parts = []
+    for piece in main.split('.'):
+        if piece.isdigit():
+            parts.append(int(piece))
+        else:
+            m = re.match(r'(\d+)', piece or '')
+            parts.append(int(m.group(1)) if m else 0)
+    while len(parts) < 3:
+        parts.append(0)
+    pre_rank = 0 if not pre else 1
+    return (parts[0], parts[1], parts[2], pre_rank, pre)
+
+
+def version_gt(a: str, b: str) -> bool:
+    return parse_version(a) > parse_version(b)
+
+
+def normalize_tag(value: str) -> str:
+    tag = (value or '').strip()
+    if not tag:
+        return ''
+    return tag if tag.startswith('v') else f'v{tag}'
+
+
+def _run(cmd: list, cwd: str, timeout: int = 120) -> tuple[int, str, str]:
+    try:
+        proc = subprocess.run(
+            cmd,
+            cwd=cwd,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            encoding='utf-8',
+            errors='replace',
+        )
+        return proc.returncode, (proc.stdout or '').strip(), (proc.stderr or '').strip()
+    except FileNotFoundError:
+        return 127, '', f'Command not found: {cmd[0]}'
+    except subprocess.TimeoutExpired:
+        return 124, '', f'Timeout running: {" ".join(cmd)}'
+
+
+class UpdateManager:
+    def __init__(self, app_root: str, current_version: str):
+        self.app_root = os.path.abspath(app_root)
+        self.current_version = current_version
+
+    def _in_docker(self) -> bool:
+        return os.path.exists('/.dockerenv') or os.environ.get('PANEL_IN_DOCKER') == '1'
+
+    def _docker_update_allowed(self) -> bool:
+        if os.environ.get('PANEL_UPDATE_DISABLE_DOCKER', '').strip().lower() in ('1', 'true', 'yes'):
+            return False
+        # In-container archive updates are allowed by default when /app is writable.
+        return True
+
+    def _app_root_writable(self) -> bool:
+        probe = os.path.join(self.app_root, '.panel_update_write_probe')
+        try:
+            with open(probe, 'w', encoding='utf-8') as fh:
+                fh.write('ok')
+            os.remove(probe)
+            return True
+        except OSError:
+            return False
+
+    def detect_mode(self) -> dict:
+        frozen = bool(getattr(sys, 'frozen', False))
+        in_docker = self._in_docker()
+        git_dir = os.path.join(self.app_root, '.git')
+        is_git = os.path.isdir(git_dir)
+        git_ok = False
+        if is_git and not frozen:
+            code, _, _ = _run(['git', '--version'], self.app_root, timeout=10)
+            git_ok = code == 0
+
+        writable = self._app_root_writable()
+        can_git = bool(git_ok and is_git and not frozen)
+        can_archive = bool(
+            writable
+            and not frozen
+            and (not in_docker or self._docker_update_allowed())
+        )
+        can_auto = can_git or can_archive
+
+        if can_git:
+            method = 'git'
+        elif can_archive:
+            method = 'archive'
+        elif in_docker:
+            method = 'docker'
+        elif frozen:
+            method = 'binary'
+        else:
+            method = 'manual'
+
+        return {
+            'mode': method,
+            'update_method': method,
+            'can_auto_update': can_auto,
+            'can_git_update': can_git,
+            'can_archive_update': can_archive,
+            'is_git': is_git,
+            'frozen': frozen,
+            'in_docker': in_docker,
+            'writable': writable,
+            'app_root': self.app_root,
+            'repo_url': repo_url(),
+            'git_url': git_url(),
+        }
+
+    def _ensure_update_remote(self) -> Optional[str]:
+        code, out, err = _run(['git', 'remote'], self.app_root, timeout=15)
+        if code != 0:
+            return err or out or 'git remote failed'
+        remotes = set((out or '').split())
+        target = git_url()
+        if UPDATE_REMOTE in remotes:
+            code, _, err = _run(
+                ['git', 'remote', 'set-url', UPDATE_REMOTE, target],
+                self.app_root,
+                timeout=15,
+            )
+        else:
+            code, _, err = _run(
+                ['git', 'remote', 'add', UPDATE_REMOTE, target],
+                self.app_root,
+                timeout=15,
+            )
+        if code != 0:
+            return err or 'Failed to configure update remote'
+        return None
+
+    def working_tree_dirty(self) -> bool:
+        code, out, _ = _run(['git', 'status', '--porcelain'], self.app_root, timeout=30)
+        return code == 0 and bool(out.strip())
+
+    def _pip_install(self) -> tuple[bool, str]:
+        req = os.path.join(self.app_root, 'requirements.txt')
+        if not os.path.isfile(req):
+            return True, ''
+        code_p, out_p, err_p = _run(
+            [sys.executable, '-m', 'pip', 'install', '-r', req],
+            self.app_root,
+            timeout=300,
+        )
+        log = (out_p or err_p or '')[:1500]
+        return code_p == 0, log
+
+    def _apply_git_update(self, target: str, allow_dirty: bool) -> dict:
+        if not allow_dirty and self.working_tree_dirty():
+            return {
+                'status': 'error',
+                'message': (
+                    'Working tree has local changes. Confirm update anyway to force checkout, '
+                    'or commit/stash changes first.'
+                ),
+                'needs_confirm_dirty': True,
+            }
+
+        err = self._ensure_update_remote()
+        if err:
+            return {'status': 'error', 'message': err}
+
+        code, out, stderr = _run(
+            ['git', 'fetch', '--tags', '--force', UPDATE_REMOTE],
+            self.app_root,
+            timeout=180,
+        )
+        if code != 0:
+            return {'status': 'error', 'message': f'git fetch failed: {stderr or out or code}'}
+
+        # Ensure tag is present locally
+        code, _, _ = _run(
+            ['git', 'rev-parse', '-q', '--verify', f'refs/tags/{target}'],
+            self.app_root,
+            timeout=15,
+        )
+        if code != 0:
+            _run(
+                ['git', 'fetch', '--depth', '1', UPDATE_REMOTE, f'refs/tags/{target}:refs/tags/{target}'],
+                self.app_root,
+                timeout=120,
+            )
+
+        checkout_ref = f'tags/{target}'
+        code, out, stderr = _run(
+            ['git', 'checkout', '--force', checkout_ref],
+            self.app_root,
+            timeout=60,
+        )
+        if code != 0:
+            code_m, out_m, err_m = _run(
+                ['git', 'checkout', '--force', '-B', 'main', f'{UPDATE_REMOTE}/main'],
+                self.app_root,
+                timeout=60,
+            )
+            if code_m != 0:
+                return {
+                    'status': 'error',
+                    'message': f'git checkout {target} failed: {stderr or out or err_m or out_m}',
+                }
+            checkout_ref = f'{UPDATE_REMOTE}/main'
+
+        ok, pip_log = self._pip_install()
+        if not ok:
+            return {
+                'status': 'error',
+                'message': f'pip install failed after checkout: {pip_log[:500]}',
+                'checkout': checkout_ref,
+                'method': 'git',
+            }
+
+        return {
+            'status': 'success',
+            'message': f'Updated to {target} via git. Panel will restart.',
+            'target_version': target,
+            'checkout': checkout_ref,
+            'pip': pip_log[:500],
+            'method': 'git',
+            'restart': True,
+        }
+
+    def _archive_urls(self, tag: str) -> list[str]:
+        urls: list[str] = []
+        api_base = api_latest_url().rsplit('/releases/latest', 1)[0]
+        for endpoint in (f'{api_base}/releases/tags/{tag}', api_latest_url()):
+            try:
+                req = urllib.request.Request(
+                    endpoint,
+                    headers={'Accept': 'application/json', 'User-Agent': 'Amnezia-Web-Panel-Updater'},
+                )
+                with urllib.request.urlopen(req, timeout=30) as resp:
+                    payload = json.loads(resp.read().decode('utf-8', errors='replace') or '{}')
+                zipball = (payload.get('zipball_url') or '').strip()
+                if zipball:
+                    urls.append(zipball)
+            except Exception:
+                pass
+        base = repo_url()
+        urls.extend([
+            f'{base}/archive/{tag}.zip',
+            f'{api_base}/archive/{tag}.zip',
+        ])
+        seen = set()
+        ordered: list[str] = []
+        for url in urls:
+            if url and url not in seen:
+                seen.add(url)
+                ordered.append(url)
+        return ordered
+
+    def _download_archive(self, tag: str, dest_path: str) -> None:
+        last_err = 'unknown error'
+        for url in self._archive_urls(tag):
+            try:
+                req = urllib.request.Request(url, headers={'User-Agent': 'Amnezia-Web-Panel-Updater'})
+                with urllib.request.urlopen(req, timeout=180) as resp:
+                    with open(dest_path, 'wb') as out:
+                        shutil.copyfileobj(resp, out)
+                if os.path.getsize(dest_path) > 1024:
+                    return
+                last_err = f'empty archive from {url}'
+            except urllib.error.HTTPError as e:
+                last_err = f'HTTP {e.code} for {url}'
+            except Exception as e:
+                last_err = str(e)
+        raise RuntimeError(f'Failed to download release archive: {last_err}')
+
+    @staticmethod
+    def _extract_zip_root(extract_dir: str) -> str:
+        entries = [e for e in os.listdir(extract_dir) if e not in ('.', '..')]
+        if len(entries) == 1:
+            only = os.path.join(extract_dir, entries[0])
+            if os.path.isdir(only):
+                return only
+        return extract_dir
+
+    def _verify_tree(self, root: str) -> Optional[str]:
+        app_py = os.path.join(root, 'app.py')
+        if not os.path.isfile(app_py):
+            return 'Release archive is missing app.py'
+        code, _, err = _run([sys.executable, '-m', 'py_compile', app_py], root, timeout=60)
+        if code != 0:
+            return f'Updated app.py failed validation: {err or code}'
+        return None
+
+    def _sync_tree(self, src_root: str) -> None:
+        for root, dirs, files in os.walk(src_root):
+            dirs[:] = [d for d in dirs if d not in ARCHIVE_SKIP_DIRS]
+            rel = os.path.relpath(root, src_root)
+            dest_root = self.app_root if rel in ('.', '') else os.path.join(self.app_root, rel)
+            os.makedirs(dest_root, exist_ok=True)
+            for fname in files:
+                if fname in ARCHIVE_SKIP_FILES:
+                    continue
+                src_file = os.path.join(root, fname)
+                dest_file = os.path.join(dest_root, fname)
+                shutil.copy2(src_file, dest_file)
+
+    def _apply_archive_update(self, target: str) -> dict:
+        tmpdir = tempfile.mkdtemp(prefix='panel-update-')
+        zip_path = os.path.join(tmpdir, f'{target}.zip')
+        extract_dir = os.path.join(tmpdir, 'extract')
+        try:
+            self._download_archive(target, zip_path)
+            os.makedirs(extract_dir, exist_ok=True)
+            with zipfile.ZipFile(zip_path, 'r') as zf:
+                zf.extractall(extract_dir)
+            src_root = self._extract_zip_root(extract_dir)
+            if not os.path.isdir(src_root):
+                return {'status': 'error', 'message': 'Invalid release archive layout'}
+            verify_err = self._verify_tree(src_root)
+            if verify_err:
+                return {'status': 'error', 'message': verify_err, 'method': 'archive'}
+            self._sync_tree(src_root)
+        except Exception as e:
+            return {'status': 'error', 'message': str(e), 'method': 'archive'}
+        finally:
+            shutil.rmtree(tmpdir, ignore_errors=True)
+
+        ok, pip_log = self._pip_install()
+        if not ok:
+            return {
+                'status': 'error',
+                'message': f'Files updated but pip install failed: {pip_log[:500]}',
+                'method': 'archive',
+            }
+
+        return {
+            'status': 'success',
+            'message': f'Updated to {target} from release archive. Panel will restart.',
+            'target_version': target,
+            'pip': pip_log[:500],
+            'method': 'archive',
+            'restart': True,
+        }
+
+    def apply_update(self, target_version: str, allow_dirty: bool = False) -> dict:
+        mode = self.detect_mode()
+        target = normalize_tag(target_version)
+        if not target or not re.match(r'^v\d+(\.\d+){0,3}([.-][\w.]+)?$', target):
+            return {'status': 'error', 'message': f'Invalid target version: {target_version}'}
+
+        if mode.get('can_git_update'):
+            return self._apply_git_update(target, allow_dirty)
+        if mode.get('can_archive_update'):
+            return self._apply_archive_update(target)
+
+        hint = (
+            'Cannot update from inside this install. '
+            'Use a git clone or writable source directory, or rebuild the Docker image on the host.'
+        )
+        if mode.get('in_docker'):
+            hint = (
+                'Docker image install: on the host run '
+                '`git pull && docker compose up -d --build` '
+                '(or set PANEL_UPDATE_ALLOW_DOCKER=1 if /app is bind-mounted).'
+            )
+        return {'status': 'error', 'message': hint, 'mode': mode}
+
+    @staticmethod
+    def schedule_restart(app_root: str, delay_sec: float = 1.5) -> None:
+        in_docker = os.path.exists('/.dockerenv') or os.environ.get('PANEL_IN_DOCKER') == '1'
+
+        def _restart():
+            time.sleep(max(0.5, float(delay_sec)))
+            cwd = os.path.abspath(app_root or os.getcwd())
+            argv = [sys.executable] + sys.argv
+            logger.info('Restarting panel after update: %s (cwd=%s, docker=%s)', argv, cwd, in_docker)
+            if in_docker:
+                # Let Docker restart policy bring the container back with updated /app files.
+                os._exit(0)
+            try:
+                os.chdir(cwd)
+                proc = subprocess.Popen(
+                    argv,
+                    cwd=cwd,
+                    start_new_session=True,
+                    close_fds=(os.name != 'nt'),
+                )
+                time.sleep(2.0)
+                if proc.poll() is None:
+                    logger.info('New panel process started (pid=%s), stopping old process', proc.pid)
+                    os._exit(0)
+            except Exception:
+                logger.exception('subprocess restart failed; trying execv')
+            try:
+                os.chdir(cwd)
+                os.execv(sys.executable, argv)
+            except Exception:
+                logger.exception('Failed to restart after update')
+                os._exit(1)
+
+        threading.Thread(target=_restart, name='panel-update-restart', daemon=False).start()

scripts/docker-entrypoint.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+set -e
+
+PORT="${PORT:-${APP_PORT:-5000}}"
+
+echo "Waiting for PostgreSQL at ${DATABASE_URL%%@*}@…"
+python3 - <<'PY'
+import os
+import sys
+import time
+
+url = os.environ.get("DATABASE_URL", "").strip()
+if not url:
+    print("DATABASE_URL is not set", file=sys.stderr)
+    sys.exit(1)
+
+import psycopg
+
+deadline = time.time() + 120
+last_err = None
+while time.time() < deadline:
+    try:
+        with psycopg.connect(url, connect_timeout=5):
+            break
+    except Exception as exc:
+        last_err = exc
+        time.sleep(2)
+else:
+    print(f"PostgreSQL not ready: {last_err}", file=sys.stderr)
+    sys.exit(1)
+PY
+
+echo "Starting Amnezia Web Panel on 0.0.0.0:${PORT}"
+exec uvicorn app:app \
+  --host 0.0.0.0 \
+  --port "${PORT}" \
+  --proxy-headers \
+  --forwarded-allow-ips='*'

static/css/style.css

@@ -1282,6 +1282,7 @@ a:hover {
     display: flex;
     align-items: center;
     justify-content: space-between;
+    gap: var(--space-sm);
     padding: var(--space-md) var(--space-lg);
     background: var(--bg-card);
     border: 1px solid var(--border-color);
@@ -1623,6 +1624,319 @@ a:hover {
     gap: var(--space-md);
 }
 
+/* ===== Tunnels (Settings) ===== */
+.tunnels-card .tunnels-header {
+    margin-bottom: var(--space-lg);
+}
+
+.tunnels-card .tunnels-header .card-title {
+    margin: 0;
+    display: flex;
+    align-items: center;
+    gap: var(--space-sm);
+}
+
+.tunnels-card .tunnels-subtitle {
+    margin: var(--space-xs) 0 0;
+    font-size: 0.875rem;
+    color: var(--text-secondary);
+    line-height: 1.45;
+}
+
+.tunnels-local {
+    display: flex;
+    align-items: center;
+    gap: var(--space-md);
+    padding: var(--space-md) var(--space-lg);
+    margin-bottom: var(--space-lg);
+    border-radius: var(--radius-md);
+    border: 1px solid var(--border-focus);
+    background: linear-gradient(135deg, rgba(139, 92, 246, 0.08), rgba(59, 130, 246, 0.06));
+    box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.04);
+}
+
+.tunnels-local-icon {
+    flex-shrink: 0;
+    width: 44px;
+    height: 44px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: var(--radius-md);
+    background: var(--accent-gradient);
+    font-size: 1.25rem;
+    box-shadow: var(--shadow-glow);
+}
+
+.tunnels-local-body {
+    flex: 1;
+    min-width: 0;
+}
+
+.tunnels-local-label {
+    font-size: 0.75rem;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    color: var(--text-muted);
+    margin-bottom: var(--space-xs);
+}
+
+.tunnels-local-url {
+    display: flex;
+    align-items: center;
+    gap: var(--space-sm);
+}
+
+.tunnels-local-url code {
+    flex: 1;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-size: 0.9rem;
+    color: var(--text-primary);
+    background: transparent;
+    padding: 0;
+}
+
+.tunnels-section {
+    margin-bottom: var(--space-lg);
+}
+
+.tunnels-section:last-of-type {
+    margin-bottom: var(--space-md);
+}
+
+.tunnels-section-title {
+    font-size: 0.7rem;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+    color: var(--text-muted);
+    margin: 0 0 var(--space-sm) var(--space-xs);
+}
+
+.tunnels-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+    gap: var(--space-md);
+}
+
+.tunnel-card {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-md);
+    padding: var(--space-md);
+    border-radius: var(--radius-md);
+    border: 1px solid var(--border-color);
+    background: var(--bg-primary);
+    transition: border-color var(--transition-base), box-shadow var(--transition-base);
+}
+
+.tunnel-card:hover {
+    border-color: var(--border-hover);
+}
+
+.tunnel-card--running {
+    border-color: var(--success-border);
+    box-shadow: 0 0 0 1px var(--success-border), inset 0 1px 0 rgba(34, 197, 94, 0.06);
+}
+
+.tunnel-card--connected {
+    border-color: var(--success-border);
+    box-shadow: 0 0 0 1px var(--success-border);
+}
+
+.tunnel-card-head {
+    display: flex;
+    align-items: flex-start;
+    gap: var(--space-md);
+}
+
+.tunnel-card-icon {
+    flex-shrink: 0;
+    width: 40px;
+    height: 40px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: var(--radius-sm);
+    font-size: 1.1rem;
+    font-weight: 700;
+    color: #fff;
+}
+
+.tunnel-card-icon--cloudflare { background: linear-gradient(135deg, #f38020, #faae40); }
+.tunnel-card-icon--ngrok { background: linear-gradient(135deg, #1f2d3d, #3d5a80); }
+.tunnel-card-icon--warp { background: linear-gradient(135deg, #f38020, #e85d04); }
+.tunnel-card-icon--nordvpn { background: linear-gradient(135deg, #4687ff, #2b4eff); }
+.tunnel-card-icon--local { background: var(--accent-gradient); }
+
+.tunnel-card-meta {
+    flex: 1;
+    min-width: 0;
+}
+
+.tunnel-card-title {
+    font-size: 0.95rem;
+    font-weight: 600;
+    margin: 0;
+    line-height: 1.3;
+}
+
+.tunnel-card-desc {
+    font-size: 0.78rem;
+    color: var(--text-muted);
+    margin: var(--space-xs) 0 0;
+    line-height: 1.4;
+}
+
+.tunnel-status-pill {
+    flex-shrink: 0;
+    font-size: 0.7rem;
+    font-weight: 600;
+    padding: 4px 10px;
+    border-radius: var(--radius-full);
+    white-space: nowrap;
+    background: rgba(255, 255, 255, 0.06);
+    color: var(--text-secondary);
+    border: 1px solid var(--border-color);
+}
+
+.tunnel-status-pill--ok {
+    background: var(--success-bg);
+    color: var(--success);
+    border-color: var(--success-border);
+}
+
+.tunnel-status-pill--info {
+    background: var(--info-bg);
+    color: var(--info);
+    border-color: rgba(59, 130, 246, 0.25);
+}
+
+.tunnel-card-body {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-sm);
+}
+
+.tunnel-url-box {
+    padding: var(--space-sm) var(--space-md);
+    border-radius: var(--radius-sm);
+    background: var(--bg-secondary);
+    border: 1px dashed var(--border-color);
+    font-size: 0.8rem;
+    color: var(--text-secondary);
+    line-height: 1.45;
+    min-height: 2.5rem;
+}
+
+.tunnel-url-box--empty {
+    font-style: italic;
+    color: var(--text-muted);
+}
+
+.tunnel-url-row {
+    display: flex;
+    align-items: center;
+    gap: var(--space-sm);
+    margin-top: var(--space-xs);
+}
+
+.tunnel-url-row:first-child {
+    margin-top: 0;
+}
+
+.tunnel-url-row code {
+    flex: 1;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-size: 0.8rem;
+    color: var(--text-accent);
+    background: transparent;
+    padding: 0;
+}
+
+.tunnel-status-line {
+    font-size: 0.82rem;
+    color: var(--text-secondary);
+    line-height: 1.45;
+}
+
+.tunnel-status-line--server {
+    font-family: ui-monospace, monospace;
+    font-size: 0.78rem;
+    color: var(--text-accent);
+    padding: var(--space-xs) var(--space-sm);
+    background: var(--bg-secondary);
+    border-radius: var(--radius-sm);
+}
+
+.tunnel-hint {
+    font-size: 0.75rem;
+    color: var(--text-muted);
+    line-height: 1.4;
+    margin: 0;
+}
+
+.tunnel-card-actions {
+    display: flex;
+    flex-wrap: wrap;
+    gap: var(--space-sm);
+    margin-top: auto;
+}
+
+.tunnel-card-actions .btn {
+    flex: 1;
+    min-width: 7rem;
+    justify-content: center;
+}
+
+.tunnel-card-actions--triple .btn {
+    min-width: 5.5rem;
+}
+
+.tunnel-nordvpn-fields {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: var(--space-sm);
+}
+
+.tunnels-footnote {
+    margin: var(--space-md) 0 0;
+    padding: var(--space-md);
+    border-radius: var(--radius-sm);
+    background: var(--bg-secondary);
+    border-left: 3px solid var(--accent);
+    font-size: 0.8rem;
+    color: var(--text-secondary);
+    line-height: 1.5;
+}
+
+@media (max-width: 640px) {
+    .tunnels-local {
+        flex-direction: column;
+        align-items: stretch;
+        text-align: center;
+    }
+
+    .tunnels-local-url {
+        flex-direction: column;
+    }
+
+    .tunnels-grid {
+        grid-template-columns: 1fr;
+    }
+
+    .tunnel-nordvpn-fields {
+        grid-template-columns: 1fr;
+    }
+}
+
 .mt-md {
     margin-top: var(--space-md);
 }

templates/server.html

@@ -1,4 +1,4 @@
-{% extends "base.html" %}
+{% extends "base.html" %}
 {% from "macros/icons.html" import icon %}
 
 {% block title_extra %} — {{ server.name }}{% endblock %}
@@ -325,10 +325,11 @@
             <div class="protocol-icon">{{ icon('link') }}</div>
             <div class="flex gap-sm" id="naiveproxy-ctrl" style="display:none!important;"></div>
         </div>
-        <div class="protocol-name">NaiveProxy</div>
-        <div class="protocol-desc">
-            {{ _('naiveproxy_desc') }}
-        </div>
+            <div class="protocol-name">NaiveProxy <span
+                style="font-size:0.65rem; background:var(--success, #16a34a); color:#fff; padding:2px 6px; border-radius:8px; vertical-align:middle;">STABLE</span></div>
+            <div class="protocol-desc">
+                {{ _('naiveproxy_desc') }}
+            </div>
         <div class="protocol-status" id="naiveproxy-status">
             <span class="badge badge-warn"><span class="badge-dot"></span> {{ _('not_checked') }}</span>
         </div>
@@ -743,6 +744,7 @@
                 </div>
                 <div class="form-hint">{{ _('naiveproxy_install_hint') }}</div>
                 <div class="form-hint" style="margin-top: var(--space-sm);">{{ _('naiveproxy_port_hint') }}</div>
+                <div class="form-hint" style="margin-top: var(--space-sm); padding: var(--space-sm) var(--space-md); border-radius: var(--radius-sm); background: rgba(234,179,8,0.12); border: 1px solid rgba(234,179,8,0.35);">{{ _('naiveproxy_client_hint') }}</div>
             </div>
 
             <div class="modal-footer">
@@ -986,6 +988,7 @@
         <div class="config-panel active" id="panel-conf">
             <div class="config-display">
                 <div class="config-text" id="configText"></div>
+                <div class="form-hint hidden" id="configClientHint" style="margin-top: var(--space-sm);"></div>
                 <div class="config-actions">
                     <button class="btn btn-secondary btn-sm" onclick="copyToClipboard(currentConfig)" style="flex:1">
                         {{ _('copy') }}
@@ -1097,7 +1100,7 @@
         { proto: 'xray', category: 'protocols', icon: 'zap', title: 'Xray (VLESS-Reality)', descKey: 'xray_desc' },
         { proto: 'telemt', category: 'protocols', icon: 'plane', title: 'Telemt (Telegram Proxy)', descKey: 'telemt_desc' },
         { proto: 'hysteria', category: 'protocols', icon: 'refresh', title: 'Hysteria 2', descKey: 'hysteria_desc' },
-        { proto: 'naiveproxy', category: 'protocols', icon: 'link', title: 'NaiveProxy', descKey: 'naiveproxy_desc' },
+        { proto: 'naiveproxy', category: 'protocols', icon: 'link', title: 'NaiveProxy', descKey: 'naiveproxy_desc', badge: 'STABLE' },
         { proto: 'wireguard', category: 'protocols', icon: 'lock', title: 'WireGuard', descKey: 'wireguard_desc' },
         { proto: 'dns', category: 'services', icon: 'search', title: 'AmneziaDNS', descKey: 'dns_desc' },
         { proto: 'adguard', category: 'services', icon: 'shield-check', title: 'AdGuard Home', descKey: 'adguard_desc' },
@@ -2840,6 +2843,16 @@
                 document.getElementById('configModalTitle').textContent = `${_('config')} — ${connName}`;
                 document.getElementById('configText').textContent = result.config;
                 document.getElementById('vpnLinkText').textContent = currentVpnLink;
+                const hintEl = document.getElementById('configClientHint');
+                if (hintEl) {
+                    if (protoBase(proto) === 'naiveproxy') {
+                        hintEl.textContent = _('naiveproxy_client_hint');
+                        hintEl.classList.remove('hidden');
+                    } else {
+                        hintEl.textContent = '';
+                        hintEl.classList.add('hidden');
+                    }
+                }
                 switchConfigTab('conf');
                 openModal('configModal');
                 generateQR(result.config);
@@ -2952,6 +2965,7 @@
     }
 
 
+
     // ========== Init ==========
     applyInstalledAppsVisibility();
     checkServer();

templates/settings.html

@@ -204,88 +204,147 @@
         </div>
 
         <!-- BLOCK Tunnels -->
-        <div class="card">
-            <h3 class="card-title" style="margin-bottom: var(--space-lg);">🌍 {{ _('tunnels_title') }}</h3>
-            <div style="display: flex; flex-direction: column; gap: var(--space-md);">
-                <div style="padding: var(--space-md); border: 1px solid var(--border-color); border-radius: var(--radius-md); background: var(--bg-primary);">
-                    <div style="display:flex; align-items:center; justify-content:space-between; gap:var(--space-md); margin-bottom: var(--space-sm);">
-                        <strong>{{ _('local_server') }}</strong>
-                        <span class="badge badge-info">{{ _('active') }}</span>
-                    </div>
-                    <div style="display:flex; gap:var(--space-sm); align-items:center;">
-                        <code id="localServerUrl" style="flex:1; min-width:0; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; color: var(--text-secondary);">{{ request.url.scheme }}://{{ request.url.netloc }}</code>
+        <div class="card tunnels-card">
+            <div class="tunnels-header">
+                <h3 class="card-title">🌍 {{ _('tunnels_title') }}</h3>
+                <p class="tunnels-subtitle">{{ _('tunnels_subtitle') }}</p>
+            </div>
+
+            <div class="tunnels-local">
+                <div class="tunnels-local-icon" aria-hidden="true">🏠</div>
+                <div class="tunnels-local-body">
+                    <div class="tunnels-local-label">{{ _('local_server') }}</div>
+                    <div class="tunnels-local-url">
+                        <code id="localServerUrl">{{ request.url.scheme }}://{{ request.url.netloc }}</code>
                         <button type="button" class="btn btn-secondary btn-sm" onclick="copyElementText('localServerUrl')">{{ _('copy') }}</button>
                     </div>
                 </div>
+                <span class="tunnel-status-pill tunnel-status-pill--ok">{{ _('active') }}</span>
+            </div>
 
-                <div class="tunnel-row" data-provider="cloudflare" style="padding: var(--space-md); border: 1px solid var(--border-color); border-radius: var(--radius-md); background: var(--bg-primary);">
-                    <div style="display:flex; align-items:center; justify-content:space-between; gap:var(--space-md); margin-bottom: var(--space-sm);">
-                        <strong>Cloudflare Quick Tunnel</strong>
-                        <span class="badge badge-secondary" id="cloudflareInstallBadge">{{ _('not_installed') }}</span>
-                    </div>
-                    <div id="cloudflarePublicUrls" class="form-hint" style="margin-bottom: var(--space-sm);">{{ _('tunnel_no_public_url') }}</div>
-                    <div style="display:grid; grid-template-columns: 1fr 1fr 1fr; gap: var(--space-sm);">
-                        <button type="button" class="btn btn-primary" id="cloudflareTunnelBtn" onclick="enableTunnel('cloudflare')">
-                            <span id="cloudflareTunnelBtnText">{{ _('tunnel_install_enable') }}</span>
-                            <div class="spinner hidden" id="cloudflareTunnelSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                        <button type="button" class="btn btn-secondary hidden" id="cloudflareStopBtn" onclick="stopTunnel('cloudflare')">
-                            <span id="cloudflareStopBtnText">{{ _('tunnel_stop') }}</span>
-                            <div class="spinner hidden" id="cloudflareStopSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                        <button type="button" class="btn btn-danger hidden" id="cloudflareDeleteBtn" onclick="deleteTunnel('cloudflare')">
-                            <span id="cloudflareDeleteBtnText">{{ _('tunnel_delete') }}</span>
-                            <div class="spinner hidden" id="cloudflareDeleteSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                    </div>
-                </div>
+            <div class="tunnels-section">
+                <h4 class="tunnels-section-title">{{ _('tunnels_section_inbound') }}</h4>
+                <div class="tunnels-grid">
+                    <article class="tunnel-card tunnel-row" data-provider="cloudflare" id="tunnelCard-cloudflare">
+                        <div class="tunnel-card-head">
+                            <div class="tunnel-card-icon tunnel-card-icon--cloudflare" aria-hidden="true">☁</div>
+                            <div class="tunnel-card-meta">
+                                <h5 class="tunnel-card-title">Cloudflare Quick Tunnel</h5>
+                                <p class="tunnel-card-desc">{{ _('tunnel_cloudflare_desc') }}</p>
+                            </div>
+                            <span class="tunnel-status-pill" id="cloudflareInstallBadge">{{ _('not_installed') }}</span>
+                        </div>
+                        <div class="tunnel-card-body">
+                            <div id="cloudflarePublicUrls" class="tunnel-url-box tunnel-url-box--empty">{{ _('tunnel_no_public_url') }}</div>
+                        </div>
+                        <div class="tunnel-card-actions tunnel-card-actions--triple">
+                            <button type="button" class="btn btn-primary btn-sm" id="cloudflareTunnelBtn" onclick="enableTunnel('cloudflare')">
+                                <span id="cloudflareTunnelBtnText">{{ _('tunnel_install_enable') }}</span>
+                                <div class="spinner hidden" id="cloudflareTunnelSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                            <button type="button" class="btn btn-secondary btn-sm hidden" id="cloudflareStopBtn" onclick="stopTunnel('cloudflare')">
+                                <span id="cloudflareStopBtnText">{{ _('tunnel_stop') }}</span>
+                                <div class="spinner hidden" id="cloudflareStopSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                            <button type="button" class="btn btn-danger btn-sm hidden" id="cloudflareDeleteBtn" onclick="deleteTunnel('cloudflare')">
+                                <span id="cloudflareDeleteBtnText">{{ _('tunnel_delete') }}</span>
+                                <div class="spinner hidden" id="cloudflareDeleteSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                        </div>
+                    </article>
 
-                <div class="tunnel-row" data-provider="ngrok" style="padding: var(--space-md); border: 1px solid var(--border-color); border-radius: var(--radius-md); background: var(--bg-primary);">
-                    <div style="display:flex; align-items:center; justify-content:space-between; gap:var(--space-md); margin-bottom: var(--space-sm);">
-                        <strong>ngrok Tunnel + Authtoken</strong>
-                        <span class="badge badge-secondary" id="ngrokInstallBadge">{{ _('not_installed') }}</span>
-                    </div>
-                    <div class="form-group" style="margin-bottom: var(--space-sm);">
-                        <input type="password" class="form-input" id="ngrokAuthtoken" placeholder="{{ _('ngrok_authtoken_placeholder') }}" autocomplete="off">
-                    </div>
-                    <div id="ngrokPublicUrls" class="form-hint" style="margin-bottom: var(--space-sm);">{{ _('tunnel_no_public_url') }}</div>
-                    <div style="display:grid; grid-template-columns: 1fr 1fr 1fr; gap: var(--space-sm);">
-                        <button type="button" class="btn btn-primary" id="ngrokTunnelBtn" onclick="enableTunnel('ngrok')">
-                            <span id="ngrokTunnelBtnText">{{ _('tunnel_install_enable') }}</span>
-                            <div class="spinner hidden" id="ngrokTunnelSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                        <button type="button" class="btn btn-secondary hidden" id="ngrokStopBtn" onclick="stopTunnel('ngrok')">
-                            <span id="ngrokStopBtnText">{{ _('tunnel_stop') }}</span>
-                            <div class="spinner hidden" id="ngrokStopSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                        <button type="button" class="btn btn-danger hidden" id="ngrokDeleteBtn" onclick="deleteTunnel('ngrok')">
-                            <span id="ngrokDeleteBtnText">{{ _('tunnel_delete') }}</span>
-                            <div class="spinner hidden" id="ngrokDeleteSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                    </div>
-                </div>
-
-
-                <div class="tunnel-row" data-provider="warp" style="padding: var(--space-md); border: 1px solid var(--border-color); border-radius: var(--radius-md); background: var(--bg-primary);">
-                    <div style="display:flex; align-items:center; justify-content:space-between; gap:var(--space-md); margin-bottom: var(--space-sm);">
-                        <strong>Cloudflare WARP</strong>
-                        <span class="badge badge-secondary" id="warpInstallBadge">{{ _('not_installed') }}</span>
-                    </div>
-                    <div id="warpStatusText" class="form-hint" style="margin-bottom: var(--space-sm);">{{ _('warp_status_unknown') }}</div>
-                    <div id="warpHintText" class="form-hint" style="margin-bottom: var(--space-sm);">{{ _('warp_hint') }}</div>
-                    <div style="display:grid; grid-template-columns: 1fr 1fr; gap: var(--space-sm);">
-                        <button type="button" class="btn btn-primary" id="warpConnectBtn" onclick="connectWarp()">
-                            <span id="warpConnectBtnText">{{ _('warp_connect') }}</span>
-                            <div class="spinner hidden" id="warpConnectSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                        <button type="button" class="btn btn-secondary hidden" id="warpDisconnectBtn" onclick="disconnectWarp()">
-                            <span id="warpDisconnectBtnText">{{ _('warp_disconnect') }}</span>
-                            <div class="spinner hidden" id="warpDisconnectSpinner" style="width:14px; height:14px;"></div>
-                        </button>
-                    </div>
+                    <article class="tunnel-card tunnel-row" data-provider="ngrok" id="tunnelCard-ngrok">
+                        <div class="tunnel-card-head">
+                            <div class="tunnel-card-icon tunnel-card-icon--ngrok" aria-hidden="true">N</div>
+                            <div class="tunnel-card-meta">
+                                <h5 class="tunnel-card-title">ngrok</h5>
+                                <p class="tunnel-card-desc">{{ _('tunnel_ngrok_desc') }}</p>
+                            </div>
+                            <span class="tunnel-status-pill" id="ngrokInstallBadge">{{ _('not_installed') }}</span>
+                        </div>
+                        <div class="tunnel-card-body">
+                            <input type="password" class="form-input" id="ngrokAuthtoken" placeholder="{{ _('ngrok_authtoken_placeholder') }}" autocomplete="off">
+                            <div id="ngrokPublicUrls" class="tunnel-url-box tunnel-url-box--empty">{{ _('tunnel_no_public_url') }}</div>
+                        </div>
+                        <div class="tunnel-card-actions tunnel-card-actions--triple">
+                            <button type="button" class="btn btn-primary btn-sm" id="ngrokTunnelBtn" onclick="enableTunnel('ngrok')">
+                                <span id="ngrokTunnelBtnText">{{ _('tunnel_install_enable') }}</span>
+                                <div class="spinner hidden" id="ngrokTunnelSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                            <button type="button" class="btn btn-secondary btn-sm hidden" id="ngrokStopBtn" onclick="stopTunnel('ngrok')">
+                                <span id="ngrokStopBtnText">{{ _('tunnel_stop') }}</span>
+                                <div class="spinner hidden" id="ngrokStopSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                            <button type="button" class="btn btn-danger btn-sm hidden" id="ngrokDeleteBtn" onclick="deleteTunnel('ngrok')">
+                                <span id="ngrokDeleteBtnText">{{ _('tunnel_delete') }}</span>
+                                <div class="spinner hidden" id="ngrokDeleteSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                        </div>
+                    </article>
                 </div>
             </div>
-            <p class="form-hint" style="margin-top: var(--space-md);">{{ _('tunnels_hint') }}</p>
+
+            <div class="tunnels-section">
+                <h4 class="tunnels-section-title">{{ _('tunnels_section_outbound') }}</h4>
+                <div class="tunnels-grid">
+                    <article class="tunnel-card tunnel-row" data-provider="warp" id="tunnelCard-warp">
+                        <div class="tunnel-card-head">
+                            <div class="tunnel-card-icon tunnel-card-icon--warp" aria-hidden="true">W</div>
+                            <div class="tunnel-card-meta">
+                                <h5 class="tunnel-card-title">Cloudflare WARP</h5>
+                                <p class="tunnel-card-desc">{{ _('tunnel_warp_desc') }}</p>
+                            </div>
+                            <span class="tunnel-status-pill" id="warpInstallBadge">{{ _('not_installed') }}</span>
+                        </div>
+                        <div class="tunnel-card-body">
+                            <p id="warpStatusText" class="tunnel-status-line">{{ _('warp_status_unknown') }}</p>
+                            <p id="warpHintText" class="tunnel-hint">{{ _('warp_hint') }}</p>
+                        </div>
+                        <div class="tunnel-card-actions">
+                            <button type="button" class="btn btn-primary btn-sm" id="warpConnectBtn" onclick="connectWarp()">
+                                <span id="warpConnectBtnText">{{ _('warp_connect') }}</span>
+                                <div class="spinner hidden" id="warpConnectSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                            <button type="button" class="btn btn-secondary btn-sm hidden" id="warpDisconnectBtn" onclick="disconnectWarp()">
+                                <span id="warpDisconnectBtnText">{{ _('warp_disconnect') }}</span>
+                                <div class="spinner hidden" id="warpDisconnectSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                        </div>
+                    </article>
+
+                    <article class="tunnel-card tunnel-row" data-provider="nordvpn" id="tunnelCard-nordvpn">
+                        <div class="tunnel-card-head">
+                            <div class="tunnel-card-icon tunnel-card-icon--nordvpn" aria-hidden="true">N</div>
+                            <div class="tunnel-card-meta">
+                                <h5 class="tunnel-card-title">NordVPN</h5>
+                                <p class="tunnel-card-desc">{{ _('tunnel_nordvpn_desc') }}</p>
+                            </div>
+                            <span class="tunnel-status-pill" id="nordvpnInstallBadge">{{ _('not_installed') }}</span>
+                        </div>
+                        <div class="tunnel-card-body">
+                            <p id="nordvpnStatusText" class="tunnel-status-line">{{ _('nordvpn_status_unknown') }}</p>
+                            <p id="nordvpnServerText" class="tunnel-status-line tunnel-status-line--server hidden"></p>
+                            <p id="nordvpnHintText" class="tunnel-hint">{{ _('nordvpn_hint') }}</p>
+                            <div class="tunnel-nordvpn-fields">
+                                <input type="text" class="form-input" id="nordvpnCountry" placeholder="{{ _('nordvpn_country_placeholder') }}" autocomplete="off">
+                                <input type="text" class="form-input" id="nordvpnCity" placeholder="{{ _('nordvpn_city_placeholder') }}" autocomplete="off">
+                            </div>
+                        </div>
+                        <div class="tunnel-card-actions">
+                            <button type="button" class="btn btn-primary btn-sm" id="nordvpnConnectBtn" onclick="connectNordvpn()">
+                                <span id="nordvpnConnectBtnText">{{ _('nordvpn_connect') }}</span>
+                                <div class="spinner hidden" id="nordvpnConnectSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                            <button type="button" class="btn btn-secondary btn-sm hidden" id="nordvpnDisconnectBtn" onclick="disconnectNordvpn()">
+                                <span id="nordvpnDisconnectBtnText">{{ _('nordvpn_disconnect') }}</span>
+                                <div class="spinner hidden" id="nordvpnDisconnectSpinner" style="width:14px; height:14px;"></div>
+                            </button>
+                        </div>
+                    </article>
+                </div>
+            </div>
+
+            <p class="tunnels-footnote">{{ _('tunnels_hint') }}</p>
         </div>
 
         <!-- BLOCK SSL/HTTPS -->
@@ -597,15 +656,24 @@
                     <!-- Updated via JS -->
                 </div>
 
-                <div style="display: flex; gap: var(--space-sm); margin-top: var(--space-sm);">
-                    <button type="button" class="btn btn-secondary" onclick="checkForUpdates()" id="checkUpdateBtn" style="flex:1;">
+                <div style="display: flex; gap: var(--space-sm); margin-top: var(--space-sm); flex-wrap: wrap;">
+                    <button type="button" class="btn btn-primary" onclick="upgradePanel()" id="upgradePanelBtn" style="flex:1; min-width:180px;">
+                        <span id="upgradePanelBtnText">⬆ {{ _('upgrade_panel') }}</span>
+                        <div class="spinner hidden" id="upgradePanelSpinner" style="width:14px; height:14px;"></div>
+                    </button>
+                    <button type="button" class="btn btn-secondary" onclick="checkForUpdates()" id="checkUpdateBtn" style="flex:1; min-width:140px;">
                         <span id="checkUpdateBtnText">🔄 {{ _('check_updates') }}</span>
                         <div class="spinner hidden" id="checkUpdateSpinner" style="width:14px; height:14px;"></div>
                     </button>
-                    <a href="https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases" target="_blank" class="btn btn-primary hidden" id="downloadUpdateBtn" style="flex:1; text-decoration: none; justify-content: center;">
+                    <button type="button" class="btn btn-secondary hidden" onclick="applyPanelUpdate()" id="applyUpdateBtn" style="flex:1; min-width:140px;">
+                        <span id="applyUpdateBtnText">⬆ {{ _('apply_update') }}</span>
+                        <div class="spinner hidden" id="applyUpdateSpinner" style="width:14px; height:14px;"></div>
+                    </button>
+                    <a href="https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases" target="_blank" class="btn btn-secondary hidden" id="downloadUpdateBtn" style="flex:1; min-width:140px; text-decoration: none; justify-content: center;">
                         ⬇️ {{ _('download_update') }}
                     </a>
                 </div>
+                <p class="form-hint" id="updateModeHint" style="margin:0;">{{ _('auto_update_hint') }}</p>
             </div>
         </div>
     </div>
@@ -916,31 +984,45 @@
         const el = document.getElementById(`${provider}PublicUrls`);
         if (!el) return;
         if (!urls || !urls.length) {
+            el.className = 'tunnel-url-box tunnel-url-box--empty';
             el.textContent = _('tunnel_no_public_url');
             return;
         }
+        el.className = 'tunnel-url-box';
         el.innerHTML = urls.map((url, idx) => `
-            <div style="display:flex; gap:var(--space-sm); align-items:center; margin-top:${idx ? 'var(--space-xs)' : '0'};">
-                <code id="${provider}PublicUrl${idx}" style="flex:1; min-width:0; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; color: var(--text-secondary);">${escapeHTML(url)}</code>
+            <div class="tunnel-url-row">
+                <code id="${provider}PublicUrl${idx}">${escapeHTML(url)}</code>
                 <button type="button" class="btn btn-secondary btn-sm" onclick="copyElementText('${provider}PublicUrl${idx}')">${_('copy')}</button>
             </div>
         `).join('');
     }
 
+    function setTunnelStatusPill(badge, { ok, info, text }) {
+        if (!badge) return;
+        badge.className = 'tunnel-status-pill' + (ok ? ' tunnel-status-pill--ok' : (info ? ' tunnel-status-pill--info' : ''));
+        badge.textContent = text;
+    }
+
     function updateTunnelProvider(provider, status) {
         const badge = document.getElementById(`${provider}InstallBadge`);
         const text = document.getElementById(`${provider}TunnelBtnText`);
         const startBtn = document.getElementById(`${provider}TunnelBtn`);
         const stopBtn = document.getElementById(`${provider}StopBtn`);
         const deleteBtn = document.getElementById(`${provider}DeleteBtn`);
+        const card = document.getElementById(`tunnelCard-${provider}`);
         if (!badge || !text) return;
 
-        badge.className = status.installed ? 'badge badge-success' : 'badge badge-secondary';
-        badge.textContent = status.installed ? _('installed') : _('not_installed');
-        text.textContent = status.running ? _('tunnel_running') : (status.installed ? _('tunnel_enable') : _('tunnel_install_enable'));
-        if (startBtn) startBtn.disabled = !!status.running;
-        if (stopBtn) stopBtn.classList.toggle('hidden', !status.running);
+        const running = !!status.running;
+        setTunnelStatusPill(badge, {
+            ok: running,
+            info: !running && status.installed,
+            text: running ? _('tunnel_running') : (status.installed ? _('installed') : _('not_installed')),
+        });
+        text.textContent = running ? _('tunnel_running') : (status.installed ? _('tunnel_enable') : _('tunnel_install_enable'));
+        if (startBtn) startBtn.disabled = running;
+        if (stopBtn) stopBtn.classList.toggle('hidden', !running);
         if (deleteBtn) deleteBtn.classList.toggle('hidden', !status.installed);
+        if (card) card.classList.toggle('tunnel-card--running', running);
         renderTunnelUrls(provider, status.public_urls || (status.public_url ? [status.public_url] : []));
     }
 
@@ -951,6 +1033,7 @@
             updateTunnelProvider('cloudflare', data.cloudflare || {});
             updateTunnelProvider('ngrok', data.ngrok || {});
             updateWarpStatus(data.warp || {});
+            updateNordvpnStatus(data.nordvpn || {});
         } catch (err) {
             showToast(`${_('error')}: ` + err.message, 'error');
         }
@@ -963,12 +1046,16 @@
         const connectBtn = document.getElementById('warpConnectBtn');
         const disconnectBtn = document.getElementById('warpDisconnectBtn');
         const connectText = document.getElementById('warpConnectBtnText');
+        const card = document.getElementById('tunnelCard-warp');
         if (!badge || !statusText || !connectBtn || !disconnectBtn || !connectText) return;
 
         const installed = !!status.installed;
         const connected = !!status.connected || status.status === 'connected';
-        badge.className = connected ? 'badge badge-success' : (installed ? 'badge badge-info' : 'badge badge-secondary');
-        badge.textContent = connected ? _('warp_connected') : (installed ? _('installed') : _('not_installed'));
+        setTunnelStatusPill(badge, {
+            ok: connected,
+            info: !connected && installed,
+            text: connected ? _('warp_connected') : (installed ? _('installed') : _('not_installed')),
+        });
 
         const statusKey = `warp_status_${status.status || 'unknown'}`;
         statusText.textContent = _(statusKey) || status.status || _('warp_status_unknown');
@@ -976,6 +1063,7 @@
         connectText.textContent = installed ? _('warp_connect') : _('warp_install_required');
         connectBtn.disabled = connected;
         disconnectBtn.classList.toggle('hidden', !connected);
+        if (card) card.classList.toggle('tunnel-card--connected', connected);
     }
 
     async function connectWarp() {
@@ -1020,6 +1108,86 @@
         }
     }
 
+    function updateNordvpnStatus(status) {
+        const badge = document.getElementById('nordvpnInstallBadge');
+        const statusText = document.getElementById('nordvpnStatusText');
+        const serverText = document.getElementById('nordvpnServerText');
+        const hintText = document.getElementById('nordvpnHintText');
+        const connectBtn = document.getElementById('nordvpnConnectBtn');
+        const disconnectBtn = document.getElementById('nordvpnDisconnectBtn');
+        const connectText = document.getElementById('nordvpnConnectBtnText');
+        const card = document.getElementById('tunnelCard-nordvpn');
+        if (!badge || !statusText || !connectBtn || !disconnectBtn || !connectText) return;
+
+        const installed = !!status.installed;
+        const connected = !!status.connected || status.status === 'connected';
+        setTunnelStatusPill(badge, {
+            ok: connected,
+            info: !connected && installed,
+            text: connected ? _('nordvpn_connected') : (installed ? _('installed') : _('not_installed')),
+        });
+
+        const statusKey = `nordvpn_status_${status.status || 'unknown'}`;
+        statusText.textContent = _(statusKey) || status.status || _('nordvpn_status_unknown');
+        if (serverText) {
+            const serverLine = status.server || '';
+            serverText.textContent = serverLine;
+            serverText.classList.toggle('hidden', !serverLine);
+        }
+        hintText.textContent = status.last_error || (installed ? _('nordvpn_hint') : (status.install_hint || _('nordvpn_install_hint')));
+        connectText.textContent = installed ? _('nordvpn_connect') : _('nordvpn_install_required');
+        connectBtn.disabled = connected;
+        disconnectBtn.classList.toggle('hidden', !connected);
+        if (card) card.classList.toggle('tunnel-card--connected', connected);
+    }
+
+    async function connectNordvpn() {
+        const btn = document.getElementById('nordvpnConnectBtn');
+        const spinner = document.getElementById('nordvpnConnectSpinner');
+        const text = document.getElementById('nordvpnConnectBtnText');
+        btn.disabled = true;
+        spinner.classList.remove('hidden');
+        text.textContent = _('loading');
+
+        try {
+            const country = (document.getElementById('nordvpnCountry') || {}).value || '';
+            const city = (document.getElementById('nordvpnCity') || {}).value || '';
+            const status = await apiCall('/api/settings/nordvpn/connect', 'POST', {
+                country: country.trim(),
+                city: city.trim(),
+            });
+            updateNordvpnStatus(status);
+            showToast(_('nordvpn_connected'), 'success');
+        } catch (err) {
+            showToast(`${_('error')}: ` + err.message, 'error');
+            await loadTunnelStatus();
+        } finally {
+            spinner.classList.add('hidden');
+        }
+    }
+
+    async function disconnectNordvpn() {
+        const btn = document.getElementById('nordvpnDisconnectBtn');
+        const spinner = document.getElementById('nordvpnDisconnectSpinner');
+        const text = document.getElementById('nordvpnDisconnectBtnText');
+        btn.disabled = true;
+        spinner.classList.remove('hidden');
+        text.textContent = _('loading');
+
+        try {
+            const status = await apiCall('/api/settings/nordvpn/disconnect', 'POST');
+            updateNordvpnStatus(status);
+            showToast(_('nordvpn_disconnected'), 'success');
+        } catch (err) {
+            showToast(`${_('error')}: ` + err.message, 'error');
+            await loadTunnelStatus();
+        } finally {
+            btn.disabled = false;
+            text.textContent = _('nordvpn_disconnect');
+            spinner.classList.add('hidden');
+        }
+    }
+
     async function enableTunnel(provider) {
         const btn = document.getElementById(`${provider}TunnelBtn`);
         const spinner = document.getElementById(`${provider}TunnelSpinner`);
@@ -1482,42 +1650,168 @@
         updateProtocolsForSync();
     }
 
-    async function checkForUpdates() {
+    let latestUpdateInfo = null;
+
+    async function checkForUpdates(silent) {
         const btn = document.getElementById('checkUpdateBtn');
         const text = document.getElementById('checkUpdateBtnText');
         const spinner = document.getElementById('checkUpdateSpinner');
         const statusDiv = document.getElementById('updateStatus');
         const downloadBtn = document.getElementById('downloadUpdateBtn');
-        
-        btn.disabled = true;
-        text.textContent = "{{ _('checking_updates')|default('Checking...') }}";
-        spinner.classList.remove('hidden');
+        const applyBtn = document.getElementById('applyUpdateBtn');
+        const modeHint = document.getElementById('updateModeHint');
+
+        if (!silent) {
+            btn.disabled = true;
+            text.textContent = "{{ _('checking_updates')|default('Checking...') }}";
+            spinner.classList.remove('hidden');
+        }
         statusDiv.classList.add('hidden');
         downloadBtn.classList.add('hidden');
+        applyBtn.classList.add('hidden');
 
         try {
             const data = await apiCall('/api/settings/check_updates');
+            latestUpdateInfo = data;
             const latestVersion = data.latest_version || '';
             statusDiv.classList.remove('hidden');
-            
+
+            if (modeHint) {
+                const method = data.update_mode || (data.mode && data.mode.update_method) || (data.mode && data.mode.mode) || '';
+                if (!data.can_auto_update) {
+                    if (method === 'docker') {
+                        modeHint.textContent = "{{ _('auto_update_docker')|default('Docker: on the host run git pull && docker compose up -d --build.') }}";
+                    } else {
+                        modeHint.textContent = "{{ _('auto_update_manual')|default('One-click update needs a writable install directory or git clone.') }}";
+                    }
+                } else if (method === 'archive') {
+                    modeHint.textContent = "{{ _('auto_update_archive')|default('One-click update downloads the release ZIP from git.evilfox.cc and restarts the panel.') }}";
+                } else {
+                    modeHint.textContent = "{{ _('auto_update_ready')|default('Git auto-update is available for this install.') }}";
+                }
+            }
+
+            const upgradeBtn = document.getElementById('upgradePanelBtn');
+            if (upgradeBtn) {
+                upgradeBtn.disabled = false;
+                upgradeBtn.title = data.can_auto_update ? '' : (modeHint ? modeHint.textContent : '');
+            }
+
             if (data.update_available && latestVersion) {
                 statusDiv.innerHTML = `<span style="color: var(--success); font-weight: bold;">{{ _('update_available')|default('Update available') }}: ${latestVersion}</span>`;
                 statusDiv.style.border = '1px solid var(--success)';
                 downloadBtn.href = data.html_url || data.releases_url || 'https://git.evilfox.cc/test2/Amnezia-Web-Panel-main/releases';
                 downloadBtn.classList.remove('hidden');
+                applyBtn.classList.remove('hidden');
             } else {
                 statusDiv.innerHTML = `<span style="color: var(--text-muted);">{{ _('up_to_date')|default('Up to date') }}</span>`;
                 statusDiv.style.border = '1px solid var(--border-color)';
             }
         } catch (err) {
-            showToast('Failed to check for updates: ' + err.message, 'error');
+            if (!silent) showToast('Failed to check for updates: ' + err.message, 'error');
         } finally {
-            btn.disabled = false;
-            text.textContent = "🔄 {{ _('check_updates')|default('Check for updates') }}";
-            spinner.classList.add('hidden');
+            if (!silent) {
+                btn.disabled = false;
+                text.textContent = "🔄 {{ _('check_updates')|default('Check for updates') }}";
+                spinner.classList.add('hidden');
+            }
         }
     }
 
+    async function waitForPanelRestart(timeoutMs = 120000, panelUrl) {
+        const base = String(panelUrl || window.location.origin || '').replace(/\/$/, '');
+        const started = Date.now();
+        while (Date.now() - started < timeoutMs) {
+            try {
+                const res = await fetch(`${base}/api/health`, { cache: 'no-store' });
+                if (res.ok) {
+                    window.location.href = base + '/';
+                    return true;
+                }
+            } catch (_) {}
+            await new Promise((resolve) => setTimeout(resolve, 2000));
+        }
+        const hint = base ? ` ${base}` : '';
+        showToast("{{ _('update_restart_timeout')|default('Panel did not come back in time. Refresh the page manually.') }}" + hint, 'error');
+        return false;
+    }
+
+    async function applyPanelUpdate() {
+        const applyBtn = document.getElementById('applyUpdateBtn');
+        const applyText = document.getElementById('applyUpdateBtnText');
+        const applySpinner = document.getElementById('applyUpdateSpinner');
+        const target = (latestUpdateInfo && latestUpdateInfo.latest_version) || '';
+        if (!target) {
+            showToast("{{ _('update_no_target')|default('No target version. Check for updates first.') }}", 'error');
+            return;
+        }
+        if (!confirm("{{ _('apply_update_confirm')|default('Install update from git.evilfox.cc and restart the panel?') }} " + target)) {
+            return;
+        }
+        applyBtn.disabled = true;
+        applyText.textContent = "{{ _('applying_update')|default('Updating…') }}";
+        applySpinner.classList.remove('hidden');
+        let restarting = false;
+        try {
+            const data = await apiCall('/api/settings/apply_update', 'POST', {
+                target_version: target,
+                allow_dirty: true,
+            });
+            showToast(data.message || "{{ _('update_restarting')|default('Updated. Restarting…') }}", 'success');
+            restarting = true;
+            applyText.textContent = "{{ _('update_waiting_restart')|default('Waiting for panel…') }}";
+            await waitForPanelRestart(120000, data.panel_url);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+        } finally {
+            if (!restarting) {
+                applyBtn.disabled = false;
+                applyText.textContent = "⬆ {{ _('apply_update')|default('Install update') }}";
+                applySpinner.classList.add('hidden');
+            }
+        }
+    }
+
+    async function upgradePanel() {
+        const btn = document.getElementById('upgradePanelBtn');
+        const text = document.getElementById('upgradePanelBtnText');
+        const spinner = document.getElementById('upgradePanelSpinner');
+        const latest = (latestUpdateInfo && latestUpdateInfo.latest_version) || '';
+        const confirmMsg = latest
+            ? ("{{ _('upgrade_panel_confirm')|default('Download and install') }} " + latest + "?")
+            : "{{ _('upgrade_panel_confirm_latest')|default('Check for updates and install the latest release?') }}";
+        if (!confirm(confirmMsg)) return;
+
+        btn.disabled = true;
+        spinner.classList.remove('hidden');
+        text.textContent = "{{ _('upgrade_panel_working')|default('Updating panel…') }}";
+        let restarting = false;
+        try {
+            const data = await apiCall('/api/settings/upgrade_panel', 'POST', {});
+            if (data.up_to_date) {
+                showToast("{{ _('upgrade_panel_up_to_date')|default('Already on the latest version') }}", 'info');
+                await checkForUpdates(true);
+                return;
+            }
+            showToast(data.message || "{{ _('update_restarting')|default('Updated. Restarting…') }}", 'success');
+            restarting = true;
+            text.textContent = "{{ _('update_waiting_restart')|default('Waiting for panel…') }}";
+            await waitForPanelRestart(120000, data.panel_url);
+        } catch (err) {
+            showToast(_('error') + ': ' + err.message, 'error');
+            await checkForUpdates(true);
+        } finally {
+            if (!restarting) {
+                btn.disabled = false;
+                spinner.classList.add('hidden');
+                text.textContent = "⬆ {{ _('upgrade_panel')|default('Update panel') }}";
+            }
+        }
+    }
+
+    // Auto-check once on Settings load
+    setTimeout(() => checkForUpdates(true), 800);
+
     /* ========== API Tokens ========== */
 
     function fmtTokenDate(iso) {