fix: move writeLogsToFile doc comment to correct position

The buildRegistryAuths function was inserted between the writeLogsToFile
doc comment and the writeLogsToFile function body, causing Go to treat
the writeLogsToFile comment as part of buildRegistryAuths godoc.

Move the writeLogsToFile comment to sit directly above its function,
and keep only the buildRegistryAuths comment above buildRegistryAuths.

.gitea/workflows/check.yml

@@ -13,4 +13,4 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4, 2024-10-13
 
       - name: Build (runs make check inside Dockerfile)
-        run: script/cibuild
+        run: docker build .

.golangci.yml

@@ -1,9 +1,5 @@
 version: "2"
 
-# Config schema uses the golangci-lint v2 layout (settings live under
-# linters.settings, not top-level linters-settings) so that the
-# thresholds below are actually applied by golangci-lint >= v2.
-
 run:
   timeout: 5m
   modules-download-mode: readonly
@@ -18,17 +14,19 @@ linters:
     - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
-  settings:
-    lll:
-      line-length: 88
-    funlen:
-      lines: 80
-      statements: 50
-    cyclop:
-      max-complexity: 15
-    dupl:
-      threshold: 100
+
+linters-settings:
+  lll:
+    line-length: 88
+  funlen:
+    lines: 80
+    statements: 50
+  cyclop:
+    max-complexity: 15
+  dupl:
+    threshold: 100
 
 issues:
+  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0

Dockerfile

@@ -1,6 +1,6 @@
 # Lint stage — fast feedback on formatting and lint issues
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+# golangci/golangci-lint:v2.10.1
+FROM golangci/golangci-lint@sha256:ea84d14c2fef724411be7dc45e09e6ef721d748315252b02df19a7e3113ee763 AS lint
 
 WORKDIR /src
 COPY go.mod go.sum ./

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all bootstrap setup build lint fmt fmt-check test check clean docker hooks
+.PHONY: all build lint fmt fmt-check test check clean docker hooks
 
 BINARY := upaasd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -7,37 +7,37 @@ LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
 
 all: check build
 
-bootstrap:
-	@script/bootstrap
-
-setup:
-	@script/setup
-
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/upaasd
 
 lint:
-	@script/lint
+	golangci-lint run --config .golangci.yml ./...
 
 fmt:
-	@script/fmt
+	gofmt -s -w .
+	goimports -w .
+	npx prettier --write --tab-width 4 static/js/*.js
 
 fmt-check:
-	@script/fmt-check
+	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
 
 test:
-	@script/test
+	go test -v -race -cover -timeout 30s ./...
 
 # Check runs all validation without making changes
 # Used by CI and Docker build - fails if anything is wrong
-check:
-	@script/check
+check: fmt-check lint test
+	@echo "==> All checks passed!"
 
 docker:
-	@script/docker
+	docker build .
 
 hooks:
-	@script/install-precommit
+	@echo "Installing pre-commit hook..."
+	@mkdir -p .git/hooks
+	@printf '#!/bin/sh\nmake check\n' > .git/hooks/pre-commit
+	@chmod +x .git/hooks/pre-commit
+	@echo "Pre-commit hook installed."
 
 clean:
 	rm -rf bin/

README.md

@@ -1,15 +1,15 @@
 # µPaaS by [@sneak](https://sneak.berlin)
 
-A simple self-hosted PaaS that auto-deploys Docker containers from Git repositories via webhooks from Gitea, GitHub, or GitLab.
+A simple self-hosted PaaS that auto-deploys Docker containers from Git repositories via Gitea webhooks.
 
 ## Features
 
 - Single admin user with argon2id password hashing
 - Per-app SSH keypairs for read-only deploy keys
-- Per-app UUID-based webhook URLs with auto-detection of Gitea, GitHub, and GitLab
+- Per-app UUID-based webhook URLs for Gitea integration
 - Branch filtering - only deploy on configured branch changes
 - Environment variables, labels, and volume mounts per app
-- CPU and memory resource limits per app
+- Private Docker registry authentication for base images
 - Docker builds via socket access
 - Notifications via ntfy and Slack-compatible webhooks
 - Simple server-rendered UI with Tailwind CSS
@@ -20,7 +20,7 @@ A simple self-hosted PaaS that auto-deploys Docker containers from Git repositor
 - Complex CI pipelines
 - Multiple container orchestration
 - SPA/API-first design
-- Support for non-push webhook events (e.g. issues, merge requests)
+- Support for non-Gitea webhooks
 
 ## Architecture
 
@@ -45,7 +45,7 @@ upaas/
 │   │   ├── auth/        # Authentication service
 │   │   ├── deploy/      # Deployment orchestration
 │   │   ├── notify/      # Notifications (ntfy, Slack)
-│   │   └── webhook/     # Webhook processing (Gitea, GitHub, GitLab)
+│   │   └── webhook/     # Gitea webhook processing
 │   └── ssh/             # SSH key generation
 ├── static/              # Embedded CSS/JS assets
 └── templates/           # Embedded HTML templates
@@ -100,31 +100,6 @@ chi Router ──► Middleware Stack ──► Handler
 - **Async deployments**: Webhook triggers deploy via goroutine with `context.WithoutCancel()`
 - **Embedded assets**: Templates and static files embedded via `//go:embed`
 
-## Entrypoints
-
-This repository adheres to the
-[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-standard: normalized scripts in `script/` are the entrypoints for the
-development workflow, and the Makefile targets are thin shims that call
-them. We provide:
-
-- `script/bootstrap` — install all dependencies (idempotent)
-- `script/setup` — make a fresh clone ready for development
-  (bootstrap, then install-precommit)
-- `script/projectname` — output the project name ("upaas")
-- `script/test` — run the test suite
-- `script/lint` — run golangci-lint
-- `script/fmt` — format all code (writes)
-- `script/fmt-check` — check formatting (read-only)
-- `script/check` — run test, lint, and fmt-check
-- `script/docker` — build the Docker image tagged via `script/projectname`
-- `script/cibuild` — CI entrypoint: `docker build .` (the Dockerfile
-  runs the checks, so a green build implies a green repo)
-- `script/precommit` — pre-commit checks (`go mod tidy` guard, then
-  `script/check`)
-- `script/install-precommit` — install the git pre-commit hook that
-  runs `script/precommit`
-
 ## Development
 
 ### Prerequisites
@@ -136,16 +111,14 @@ them. We provide:
 ### Commands
 
 ```bash
-make bootstrap # Install all dependencies (idempotent)
-make setup     # Bootstrap + install git pre-commit hook
 make fmt       # Format code
 make fmt-check # Check formatting (read-only, fails if unformatted)
 make lint      # Run comprehensive linting
 make test      # Run tests with race detection (30s timeout)
-make check     # Verify everything passes (test, lint, fmt-check)
+make check     # Verify everything passes (fmt-check, lint, test)
 make build     # Build binary
 make docker    # Build Docker image
-make hooks     # Install pre-commit hook (runs script/precommit)
+make hooks     # Install pre-commit hook (runs make check)
 ```
 
 ### Commit Requirements

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-02-22
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -34,46 +34,10 @@ style conventions are in separate documents:
   every file before committing. There are zero exceptions to this rule.
 
 - Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
-
-- Repos follow the
-  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-  pattern: the implementation of each Makefile target lives in an executable
-  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
-  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
-  `script/docker`), and the Makefile targets are thin shims that call them. The
-  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
-  minimal containers (e.g. alpine images have no bash); locate the repo root
-  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
-  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
-  for development after a fresh clone: runs `bootstrap`, then
-  `install-precommit`, plus any repo-specific initialization), `test`, and
-  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
-  assumes nothing is present: base tools come from nix, apt, brew, or apk
-  (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  release archive (never `curl | sh`), with bash installed as an explicit
-  prerequisite since nvm requires bash. yarn is then pinned via
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
-  must document the provided scripts in an **Entrypoints** section (see the
-  README requirements below).
+  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
+  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
+  `make hooks` (installs pre-commit hook). A model Makefile is at
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
 
 - Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
   instead of invoking the underlying tools directly. The Makefile is the single
@@ -93,83 +57,11 @@ style conventions are in separate documents:
   as a build step so the build fails if the branch is not green. For non-server
   repos, the Dockerfile should bring up a development environment and run
   `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
-
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
-
-    The standard pattern for a Go repo Dockerfile is:
-
-    ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
-    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
-    FROM golangci/golangci-lint@sha256:... AS lint
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make fmt-check
-    RUN make lint
-
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
-    WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make test
-
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
-
-    # Runtime stage
-    FROM alpine@sha256:...
-    COPY --from=builder /app /usr/local/bin/app
-    ENTRYPOINT ["app"]
-    ```
-
-    Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
-    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
-      create placeholder files so the embed directives resolve. Example:
-      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
+  stage before the final image is assembled.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
+  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
+  a successful build implies all checks pass.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -177,11 +69,9 @@ style conventions are in separate documents:
   Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
   HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
 
-- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
-  `script/install-precommit`; the Makefile must provide a `make hooks` target
-  that shims to it.
+- Pre-commit hook: `make check` if local testing is possible, otherwise
+  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
+  target to install the pre-commit hook.
 
 - All repos with software must have tests that run via the platform-standard
   test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
@@ -192,42 +82,6 @@ style conventions are in separate documents:
 - `make test` must complete in under 20 seconds. Add a 30-second timeout in the
   Makefile.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
-
-    ```makefile
-    test:
-    	@<test-command> || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  <test-command-with-v>; exit 1; }
-    ```
-
-    Go example:
-
-    ```makefile
-    test:
-    	@go test -timeout 30s -race -cover ./... || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
-    ```
-
-    Python example:
-
-    ```makefile
-    test:
-    	@python -m pytest || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  python -m pytest -v; exit 1; }
-    ```
-
-    The `exit 1` ensures the target always fails after a rerun — the first run
-    already proved the tests are broken, so the build must not pass even if a
-    flaky test happens to succeed on the second attempt. The rerun exists solely
-    for diagnostic output.
-
 - Docker builds must complete in under 5 minutes.
 
 - `make check` must not modify any files in the repo. Tests may use temporary
@@ -244,13 +98,6 @@ style conventions are in separate documents:
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
   a new repo.
 
-- **No build artifacts in version control.** Code-derived data (compiled
-  bundles, minified output, generated assets) must never be committed to the
-  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
-  should generate these at build time. Notable exception: Go protobuf generated
-  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
-  downloads code but does not execute code generation.
-
 - Never use `git add -A` or `git add .`. Always stage files explicitly by name.
 
 - Never force-push to `main`.
@@ -274,76 +121,12 @@ style conventions are in separate documents:
 - Dockerized web services listen on port 8080 by default, overridable with
   `PORT`.
 
-- **HTTP/web services must be hardened for production internet exposure before
-  tagging 1.0.** This means full compliance with security best practices
-  including, without limitation, all of the following:
-    - **Security headers** on every response:
-        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
-          and `includeSubDomains`.
-        - `Content-Security-Policy` (CSP) with a restrictive default policy
-          (`default-src 'self'` as a baseline, tightened per-resource as
-          needed). Never use `unsafe-inline` or `unsafe-eval` unless
-          unavoidable, and document the reason.
-        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
-          Prefer the `frame-ancestors` CSP directive as the primary control.
-        - `X-Content-Type-Options: nosniff`.
-        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
-        - `Permissions-Policy` restricting access to browser features the
-          application does not use (camera, microphone, geolocation, etc.).
-    - **Request and response limits:**
-        - Maximum request body size enforced on all endpoints (e.g. Go
-          `http.MaxBytesReader`). Choose a sane default per-route; never accept
-          unbounded input.
-        - Maximum response body size where applicable (e.g. paginated APIs).
-        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
-          against slowloris attacks.
-        - `WriteTimeout` on the `http.Server`.
-        - `IdleTimeout` on the `http.Server`.
-        - Per-handler execution time limits via `context.WithTimeout` or
-          chi/stdlib `middleware.Timeout`.
-    - **Authentication and session security:**
-        - Rate limiting on password-based authentication endpoints. API keys are
-          high-entropy and not susceptible to brute force, so they are exempt.
-        - CSRF tokens on all state-mutating HTML forms. API endpoints
-          authenticated via `Authorization` header (Bearer token, API key) are
-          exempt because the browser does not attach these automatically.
-        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
-          MD5, or SHA.
-        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
-          `Strict`) attributes.
-    - **Reverse proxy awareness:**
-        - True client IP detection when behind a reverse proxy
-          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
-          forwarded headers only from a configured set of trusted proxy
-          addresses — never trust `X-Forwarded-For` unconditionally.
-    - **CORS:**
-        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
-          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
-          only for public, unauthenticated read-only APIs.
-    - **Error handling:**
-        - Internal errors must never leak stack traces, SQL queries, file paths,
-          or other implementation details to the client. Return generic error
-          messages in production; detailed errors only when `DEBUG` is enabled.
-    - **TLS:**
-        - Services never terminate TLS directly. They are always deployed behind
-          a TLS-terminating reverse proxy. The service itself listens on plain
-          HTTP. However, HSTS headers and `Secure` cookie flags must still be
-          set by the application so that the browser enforces HTTPS end-to-end.
-
-    This list is non-exhaustive. Apply defense-in-depth: if a standard security
-    hardening measure exists for HTTP services and is not listed here, it is
-    still expected. When in doubt, harden.
-
 - `README.md` is the primary documentation. Required sections:
     - **Description**: First line must include the project name, purpose,
       category (web server, SPA, CLI tool, etc.), license, and author. Example:
       "µPaaS is an MIT-licensed Go web application by @sneak that receives
       git-frontend webhooks and deploys applications via Docker in realtime."
     - **Getting Started**: Copy-pasteable install/usage code block.
-    - **Entrypoints**: Opens by stating that the repo adheres to the
-      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-      standard (with that link), then documents each provided `script/`
-      entrypoint and its purpose.
     - **Rationale**: Why does this exist?
     - **Design**: How is the program structured?
     - **TODO**: Update meticulously, even between commits. When planning, put
@@ -362,13 +145,13 @@ style conventions are in separate documents:
 
 - Database migrations live in `internal/db/migrations/` and must be embedded in
   the binary.
-    - `000_migration.sql` — contains ONLY the creation of the migrations
-      tracking table itself. Nothing else.
-    - `001_schema.sql` — the full application schema.
-    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
-      There is no installed base to migrate. Edit `001_schema.sql` directly.
-    - **Post-1.0.0:** add new numbered migration files for each schema change.
-      Never edit existing migrations after release.
+  - `000_migration.sql` — contains ONLY the creation of the migrations tracking
+    table itself. Nothing else.
+  - `001_schema.sql` — the full application schema.
+  - **Pre-1.0.0:** never add additional migration files (002, 003, etc.). There
+    is no installed base to migrate. Edit `001_schema.sql` directly.
+  - **Post-1.0.0:** add new numbered migration files for each schema change.
+    Never edit existing migrations after release.
 
 - All repos should have an `.editorconfig` enforcing the project's indentation
   settings.
@@ -398,9 +181,6 @@ style conventions are in separate documents:
     - `README.md`, `.git`, `.gitignore`, `.editorconfig`
     - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
     - `Makefile`
-    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
-      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`)
     - `Dockerfile`, `.dockerignore`
     - `.gitea/workflows/check.yml`
     - Go: `go.mod`, `go.sum`, `.golangci.yml`

TODO.md

@@ -1,49 +0,0 @@
-# Workflow
-
-* branch (from `main`)
-* do the work in Next Step
-* move Next Step to the top of Completed Steps
-* move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
-* push
-
-# Status
-
-1.0+. Tagged 1.0.0 on 2026-02-26; 8 commits on main since. `make check`
-is green as of the golangci-lint v2.12.2 update.
-
-# Next Step
-
-Confirm `.gitea/workflows/check.yml` gates merges on `make check` so
-main cannot regress.
-
-# Completed Steps
-
-- 2026-08-07: Updated golangci-lint to v2.12.2 (canonical
-  `.golangci.yml`, `Dockerfile` lint stage pin, `script/bootstrap`
-  release-archive pins) and fixed all resulting lint findings (noctx,
-  gosec, goconst, lll, dupl, nolintlint); `make check` green.
-- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
-  Makefile shims, README Entrypoints section
-- 2026-03-11: Monolithic env var editing with bulk save (#158).
-- 2026-03-10: Webhook event history UI page (#164); added missing
-  Makefile docker and hooks targets plus test timeout (#159);
-  notification settings passed from create form (#160).
-- 2026-03-03: REPO_POLICIES compliance file set added (#155).
-- 2026-03-01: Module path changed to sneak.berlin/go/upaas (#143);
-  Dockerfile split into lint and build stages with forced lint
-  execution (#152, #154).
-- 2026-02-26: 1.0.0 tagged; dashboard CSRFField crash fixed (#146).
-- 1.0 audit bug fixes (#120-#125): deferred rollback on commit error,
-  deployment log size cap, error path rendering, docker-compose bind
-  mount, domain type refactor.
-- CI simplified to docker build only (#130).
-- 2025-12-29 onward: core PaaS built out: deploys with real-time build
-  log streaming, container start/stop/restart and logs, TCP/UDP port
-  mapping, Alpine.js UI, Slack notifications, ULID app IDs, session
-  handling.
-
-# Future Steps
-
-- Resume feature work only after main is green.

internal/config/config.go

@@ -45,7 +45,7 @@ type Config struct {
 	Port            int
 	Debug           bool
 	DataDir         string
-	HostDataDir     string // Host path for DataDir (Docker bind mounts in container)
+	HostDataDir     string // Host path for DataDir (for Docker bind mounts when running in container)
 	DockerHost      string
 	SentryDSN       string
 	MaintenanceMode bool

internal/database/database.go

@@ -178,8 +178,7 @@ func HashWebhookSecret(secret string) string {
 
 func (d *Database) backfillWebhookSecretHashes(ctx context.Context) error {
 	rows, err := d.database.QueryContext(ctx,
-		"SELECT id, webhook_secret FROM apps"+
-			" WHERE webhook_secret_hash = '' AND webhook_secret != ''")
+		"SELECT id, webhook_secret FROM apps WHERE webhook_secret_hash = '' AND webhook_secret != ''")
 	if err != nil {
 		return fmt.Errorf("querying apps for backfill: %w", err)
 	}

internal/database/migrations.go

@@ -2,80 +2,36 @@ package database
 
 import (
 	"context"
-	"database/sql"
 	"embed"
-	"errors"
 	"fmt"
 	"io/fs"
-	"log/slog"
 	"sort"
-	"strconv"
 	"strings"
 )
 
 //go:embed migrations/*.sql
 var migrationsFS embed.FS
 
-// bootstrapVersion is the migration that creates the schema_migrations
-// table itself. It is applied before the normal migration loop.
-const bootstrapVersion = 0
-
-// ErrInvalidMigrationFilename indicates a migration filename does not follow
-// the expected "<version>.sql" or "<version>_<description>.sql" pattern.
-var ErrInvalidMigrationFilename = errors.New("invalid migration filename")
-
-// ParseMigrationVersion extracts the numeric version prefix from a migration
-// filename. Filenames must follow the pattern "<version>.sql" or
-// "<version>_<description>.sql", where version is a zero-padded numeric
-// string (e.g. "001", "002"). Returns the version as an integer and an
-// error if the filename does not match the expected pattern.
-func ParseMigrationVersion(filename string) (int, error) {
-	name := strings.TrimSuffix(filename, ".sql")
-	if name == "" || name == filename {
-		return 0, fmt.Errorf(
-			"%w: %q has no .sql extension or is empty",
-			ErrInvalidMigrationFilename, filename,
+func (d *Database) migrate(ctx context.Context) error {
+	// Create migrations table if not exists
+	_, err := d.database.ExecContext(ctx, `
+		CREATE TABLE IF NOT EXISTS schema_migrations (
+			version TEXT PRIMARY KEY,
+			applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
 		)
-	}
-
-	// Split on underscore to separate version from description.
-	// If there's no underscore, the entire stem is the version.
-	versionStr, _, _ := strings.Cut(name, "_")
-
-	if versionStr == "" {
-		return 0, fmt.Errorf(
-			"%w: %q has empty version prefix",
-			ErrInvalidMigrationFilename, filename,
-		)
-	}
-
-	// Validate the version is purely numeric.
-	for _, ch := range versionStr {
-		if ch < '0' || ch > '9' {
-			return 0, fmt.Errorf(
-				"%w: %q version %q contains non-numeric character %q",
-				ErrInvalidMigrationFilename, filename, versionStr, string(ch),
-			)
-		}
-	}
-
-	version, err := strconv.Atoi(versionStr)
+	`)
 	if err != nil {
-		return 0, fmt.Errorf("%w: %q: %w", ErrInvalidMigrationFilename, filename, err)
+		return fmt.Errorf("failed to create migrations table: %w", err)
 	}
 
-	return version, nil
-}
-
-// collectMigrations reads the embedded migrations directory and returns
-// migration filenames sorted lexicographically.
-func collectMigrations() ([]string, error) {
+	// Get list of migration files
 	entries, err := fs.ReadDir(migrationsFS, "migrations")
 	if err != nil {
-		return nil, fmt.Errorf("failed to read migrations directory: %w", err)
+		return fmt.Errorf("failed to read migrations directory: %w", err)
 	}
 
-	var migrations []string
+	// Sort migrations by name
+	migrations := make([]string, 0, len(entries))
 
 	for _, entry := range entries {
 		if !entry.IsDir() && strings.HasSuffix(entry.Name(), ".sql") {
@@ -85,118 +41,54 @@ func collectMigrations() ([]string, error) {
 
 	sort.Strings(migrations)
 
-	return migrations, nil
-}
-
-// bootstrapMigrationsTable ensures the schema_migrations table exists by
-// applying 000_migration.sql if the table is missing.
-func bootstrapMigrationsTable(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	var tableExists int
-
-	err := db.QueryRowContext(ctx,
-		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='schema_migrations'",
-	).Scan(&tableExists)
-	if err != nil {
-		return fmt.Errorf("failed to check for migrations table: %w", err)
-	}
-
-	if tableExists == 0 {
-		return applyBootstrapMigration(ctx, db, log)
-	}
-
-	return nil
-}
-
-// applyBootstrapMigration reads and executes 000_migration.sql to create the
-// schema_migrations table on a fresh database.
-func applyBootstrapMigration(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	content, err := migrationsFS.ReadFile("migrations/000_migration.sql")
-	if err != nil {
-		return fmt.Errorf("failed to read bootstrap migration 000_migration.sql: %w", err)
-	}
-
-	if log != nil {
-		log.Info("applying bootstrap migration", "version", bootstrapVersion)
-	}
-
-	_, err = db.ExecContext(ctx, string(content))
-	if err != nil {
-		return fmt.Errorf("failed to apply bootstrap migration: %w", err)
-	}
-
-	return nil
-}
-
-// ApplyMigrations applies all pending migrations to db. An optional logger
-// may be provided for informational output; pass nil for silent operation.
-// This is exported so tests can apply the real schema without the full fx
-// lifecycle.
-func ApplyMigrations(ctx context.Context, db *sql.DB, log *slog.Logger) error {
-	bootstrapErr := bootstrapMigrationsTable(ctx, db, log)
-	if bootstrapErr != nil {
-		return bootstrapErr
-	}
-
-	migrations, err := collectMigrations()
-	if err != nil {
-		return err
-	}
-
+	// Apply each migration
 	for _, migration := range migrations {
-		version, parseErr := ParseMigrationVersion(migration)
-		if parseErr != nil {
-			return parseErr
-		}
-
-		// Check if already applied.
-		var count int
-
-		err = db.QueryRowContext(ctx,
-			"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
-			version,
-		).Scan(&count)
+		applied, err := d.isMigrationApplied(ctx, migration)
 		if err != nil {
 			return fmt.Errorf("failed to check migration %s: %w", migration, err)
 		}
 
-		if count > 0 {
-			if log != nil {
-				log.Debug("migration already applied", "version", version)
-			}
+		if applied {
+			d.log.Debug("migration already applied", "migration", migration)
 
 			continue
 		}
 
-		// Apply migration in a transaction.
-		applyErr := applyMigrationTx(ctx, db, migration, version)
-		if applyErr != nil {
-			return applyErr
+		err = d.applyMigration(ctx, migration)
+		if err != nil {
+			return fmt.Errorf("failed to apply migration %s: %w", migration, err)
 		}
 
-		if log != nil {
-			log.Info("migration applied", "version", version)
-		}
+		d.log.Info("migration applied", "migration", migration)
 	}
 
 	return nil
 }
 
-// applyMigrationTx reads and executes a migration file within a transaction,
-// recording the version in schema_migrations on success.
-func applyMigrationTx(
-	ctx context.Context,
-	db *sql.DB,
-	filename string,
-	version int,
-) error {
-	content, err := migrationsFS.ReadFile("migrations/" + filename)
+func (d *Database) isMigrationApplied(ctx context.Context, version string) (bool, error) {
+	var count int
+
+	err := d.database.QueryRowContext(
+		ctx,
+		"SELECT COUNT(*) FROM schema_migrations WHERE version = ?",
+		version,
+	).Scan(&count)
 	if err != nil {
-		return fmt.Errorf("failed to read migration %s: %w", filename, err)
+		return false, fmt.Errorf("failed to query migration status: %w", err)
 	}
 
-	transaction, err := db.BeginTx(ctx, nil)
+	return count > 0, nil
+}
+
+func (d *Database) applyMigration(ctx context.Context, filename string) error {
+	content, err := migrationsFS.ReadFile("migrations/" + filename)
 	if err != nil {
-		return fmt.Errorf("failed to begin transaction for migration %s: %w", filename, err)
+		return fmt.Errorf("failed to read migration file: %w", err)
+	}
+
+	transaction, err := d.database.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction: %w", err)
 	}
 
 	defer func() {
@@ -205,27 +97,26 @@ func applyMigrationTx(
 		}
 	}()
 
+	// Execute migration
 	_, err = transaction.ExecContext(ctx, string(content))
 	if err != nil {
-		return fmt.Errorf("failed to execute migration %s: %w", filename, err)
+		return fmt.Errorf("failed to execute migration: %w", err)
 	}
 
-	_, err = transaction.ExecContext(ctx,
+	// Record migration
+	_, err = transaction.ExecContext(
+		ctx,
 		"INSERT INTO schema_migrations (version) VALUES (?)",
-		version,
+		filename,
 	)
 	if err != nil {
-		return fmt.Errorf("failed to record migration %s: %w", filename, err)
+		return fmt.Errorf("failed to record migration: %w", err)
 	}
 
 	err = transaction.Commit()
 	if err != nil {
-		return fmt.Errorf("failed to commit migration %s: %w", filename, err)
+		return fmt.Errorf("failed to commit migration: %w", err)
 	}
 
 	return nil
 }
-
-func (d *Database) migrate(ctx context.Context) error {
-	return ApplyMigrations(ctx, d.database, d.log)
-}

internal/database/migrations/000_migration.sql

@@ -1,9 +0,0 @@
--- Migration 000: Schema migrations tracking table
--- Applied as a bootstrap step before the normal migration loop.
-
-CREATE TABLE IF NOT EXISTS schema_migrations (
-    version INTEGER PRIMARY KEY,
-    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
-);
-
-INSERT OR IGNORE INTO schema_migrations (version) VALUES (0);

internal/database/migrations/007_add_registry_credentials.sql

@@ -0,0 +1,11 @@
+-- Add registry credentials for private Docker registry authentication during builds
+CREATE TABLE registry_credentials (
+    id INTEGER PRIMARY KEY,
+    app_id TEXT NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
+    registry TEXT NOT NULL,
+    username TEXT NOT NULL,
+    password TEXT NOT NULL,
+    UNIQUE(app_id, registry)
+);
+
+CREATE INDEX idx_registry_credentials_app_id ON registry_credentials(app_id);

internal/database/migrations/007_add_resource_limits.sql

@@ -1,3 +0,0 @@
--- Add CPU and memory resource limits per app
-ALTER TABLE apps ADD COLUMN cpu_limit REAL;
-ALTER TABLE apps ADD COLUMN memory_limit INTEGER;

internal/database/migrations_test.go

@@ -1,117 +0,0 @@
-package database_test
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	_ "github.com/mattn/go-sqlite3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"sneak.berlin/go/upaas/internal/database"
-)
-
-func TestParseMigrationVersion(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		filename    string
-		wantVersion int
-		wantErr     bool
-	}{
-		{filename: "000_migration.sql", wantVersion: 0},
-		{filename: "001_initial.sql", wantVersion: 1},
-		{filename: "002_remove_container_id.sql", wantVersion: 2},
-		{filename: "007_add_resource_limits.sql", wantVersion: 7},
-		{filename: "100_large_version.sql", wantVersion: 100},
-		{filename: ".sql", wantErr: true},
-		{filename: "_foo.sql", wantErr: true},
-		{filename: "abc_foo.sql", wantErr: true},
-		{filename: "1a2_bad.sql", wantErr: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.filename, func(t *testing.T) {
-			t.Parallel()
-
-			version, err := database.ParseMigrationVersion(tt.filename)
-			if tt.wantErr {
-				assert.Error(t, err)
-
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tt.wantVersion, version)
-		})
-	}
-}
-
-func TestApplyMigrationsFreshDatabase(t *testing.T) {
-	t.Parallel()
-
-	db, err := sql.Open("sqlite3", ":memory:?_foreign_keys=on")
-	require.NoError(t, err)
-
-	defer func() { _ = db.Close() }()
-
-	ctx := context.Background()
-
-	err = database.ApplyMigrations(ctx, db, nil)
-	require.NoError(t, err)
-
-	// Verify schema_migrations table exists with INTEGER version column.
-	var version int
-
-	err = db.QueryRowContext(ctx,
-		"SELECT version FROM schema_migrations WHERE version = 0",
-	).Scan(&version)
-	require.NoError(t, err)
-	assert.Equal(t, 0, version)
-
-	// Verify that all migrations were recorded.
-	var count int
-
-	err = db.QueryRowContext(ctx,
-		"SELECT COUNT(*) FROM schema_migrations",
-	).Scan(&count)
-	require.NoError(t, err)
-	// 000 bootstrap + 001 through 007 = 8 entries.
-	assert.Equal(t, 8, count)
-
-	// Verify application tables were created by the migrations.
-	var tableCount int
-
-	err = db.QueryRowContext(ctx,
-		"SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='users'",
-	).Scan(&tableCount)
-	require.NoError(t, err)
-	assert.Equal(t, 1, tableCount)
-}
-
-func TestApplyMigrationsIdempotent(t *testing.T) {
-	t.Parallel()
-
-	db, err := sql.Open("sqlite3", ":memory:?_foreign_keys=on")
-	require.NoError(t, err)
-
-	defer func() { _ = db.Close() }()
-
-	ctx := context.Background()
-
-	// Apply twice — second run should be a no-op.
-	err = database.ApplyMigrations(ctx, db, nil)
-	require.NoError(t, err)
-
-	err = database.ApplyMigrations(ctx, db, nil)
-	require.NoError(t, err)
-
-	var count int
-
-	err = db.QueryRowContext(ctx,
-		"SELECT COUNT(*) FROM schema_migrations",
-	).Scan(&count)
-	require.NoError(t, err)
-	assert.Equal(t, 8, count)
-}

internal/docker/auth_test.go

@@ -0,0 +1,96 @@
+package docker //nolint:testpackage // tests unexported buildAuthConfigs
+
+import (
+	"testing"
+)
+
+func TestBuildAuthConfigsEmpty(t *testing.T) {
+	t.Parallel()
+
+	result := buildAuthConfigs(nil)
+	if len(result) != 0 {
+		t.Errorf("expected empty map, got %d entries", len(result))
+	}
+}
+
+func TestBuildAuthConfigsSingle(t *testing.T) {
+	t.Parallel()
+
+	auths := []RegistryAuth{
+		{
+			Registry: "registry.example.com",
+			Username: "user",
+			Password: "pass",
+		},
+	}
+
+	result := buildAuthConfigs(auths)
+
+	if len(result) != 1 {
+		t.Fatalf("expected 1 entry, got %d", len(result))
+	}
+
+	cfg, ok := result["registry.example.com"]
+	if !ok {
+		t.Fatal("expected registry.example.com key")
+	}
+
+	if cfg.Username != "user" {
+		t.Errorf("expected username 'user', got %q", cfg.Username)
+	}
+
+	if cfg.Password != "pass" {
+		t.Errorf("expected password 'pass', got %q", cfg.Password)
+	}
+
+	if cfg.ServerAddress != "registry.example.com" {
+		t.Errorf("expected server address 'registry.example.com', got %q", cfg.ServerAddress)
+	}
+}
+
+func TestBuildAuthConfigsMultiple(t *testing.T) {
+	t.Parallel()
+
+	auths := []RegistryAuth{
+		{Registry: "ghcr.io", Username: "ghuser", Password: "ghtoken"},
+		{Registry: "docker.io", Username: "dkuser", Password: "dktoken"},
+	}
+
+	result := buildAuthConfigs(auths)
+
+	if len(result) != 2 {
+		t.Fatalf("expected 2 entries, got %d", len(result))
+	}
+
+	ghcr := result["ghcr.io"]
+	if ghcr.Username != "ghuser" || ghcr.Password != "ghtoken" {
+		t.Errorf("unexpected ghcr.io config: %+v", ghcr)
+	}
+
+	dkr := result["docker.io"]
+	if dkr.Username != "dkuser" || dkr.Password != "dktoken" {
+		t.Errorf("unexpected docker.io config: %+v", dkr)
+	}
+}
+
+func TestRegistryAuthStruct(t *testing.T) {
+	t.Parallel()
+
+	auth := RegistryAuth{
+		Registry: "registry.example.com",
+		Username: "testuser",
+		Password: "testpass",
+	}
+
+	if auth.Registry != "registry.example.com" {
+		t.Errorf("expected registry 'registry.example.com', got %q", auth.Registry)
+	}
+
+	if auth.Username != "testuser" {
+		t.Errorf("expected username 'testuser', got %q", auth.Username)
+	}
+
+	if auth.Password != "testpass" {
+		t.Errorf("expected password 'testpass', got %q", auth.Password)
+	}
+}

internal/docker/client.go

@@ -20,6 +20,7 @@ import (
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/client"
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/go-connections/nat"
@@ -41,8 +42,7 @@ const stopTimeoutSeconds = 10
 
 // gitImage is the Docker image used for git operations.
 // alpine/git v2.47.2 - pulled 2025-12-30
-const gitImage = "alpine/git@sha256:" +
-	"d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8"
+const gitImage = "alpine/git@sha256:d86f367afb53d022acc4377741e7334bc20add161bb10234272b91b459b4b7d8"
 
 // ErrNotConnected is returned when Docker client is not connected.
 var ErrNotConnected = errors.New("docker client not connected")
@@ -106,12 +106,20 @@ func (c *Client) IsConnected() bool {
 	return c.docker != nil
 }
 
+// RegistryAuth contains authentication credentials for a Docker registry.
+type RegistryAuth struct {
+	Registry string
+	Username string
+	Password string //nolint:gosec // credential field required for registry auth
+}
+
 // BuildImageOptions contains options for building an image.
 type BuildImageOptions struct {
 	ContextDir     string
 	DockerfilePath string
 	Tags           []string
-	LogWriter      io.Writer // Optional writer for build output
+	LogWriter      io.Writer      // Optional writer for build output
+	RegistryAuths  []RegistryAuth // Optional registry credentials for pulling private base images
 }
 
 // BuildImage builds a Docker image from a context directory.
@@ -139,15 +147,13 @@ func (c *Client) BuildImage(
 
 // CreateContainerOptions contains options for creating a container.
 type CreateContainerOptions struct {
-	Name        string
-	Image       string
-	Env         map[string]string
-	Labels      map[string]string
-	Volumes     []VolumeMount
-	Ports       []PortMapping
-	Network     string
-	CPULimit    float64 // CPU cores (0.5 = half a core). 0 means unlimited.
-	MemoryLimit int64   // Memory in bytes. 0 means unlimited.
+	Name    string
+	Image   string
+	Env     map[string]string
+	Labels  map[string]string
+	Volumes []VolumeMount
+	Ports   []PortMapping
+	Network string
 }
 
 // VolumeMount represents a volume mount.
@@ -164,12 +170,19 @@ type PortMapping struct {
 	Protocol      string // "tcp" or "udp"
 }
 
-// nanoCPUsPerCPU is the number of NanoCPUs per CPU core.
-const nanoCPUsPerCPU = 1e9
+// buildAuthConfigs converts RegistryAuth slices into Docker's AuthConfigs map.
+func buildAuthConfigs(auths []RegistryAuth) map[string]registry.AuthConfig {
+	configs := make(map[string]registry.AuthConfig, len(auths))
 
-// cpuLimitToNanoCPUs converts a CPU limit (e.g. 0.5 cores) to Docker NanoCPUs.
-func cpuLimitToNanoCPUs(cpuLimit float64) int64 {
-	return int64(cpuLimit * nanoCPUsPerCPU)
+	for _, auth := range auths {
+		configs[auth.Registry] = registry.AuthConfig{
+			Username:      auth.Username,
+			Password:      auth.Password,
+			ServerAddress: auth.Registry,
+		}
+	}
+
+	return configs
 }
 
 // buildPortConfig converts port mappings to Docker port configuration.
@@ -196,48 +209,6 @@ func buildPortConfig(ports []PortMapping) (nat.PortSet, nat.PortMap) {
 	return exposedPorts, portBindings
 }
 
-// buildEnvSlice converts an env map to a Docker-compatible env slice.
-func buildEnvSlice(env map[string]string) []string {
-	envSlice := make([]string, 0, len(env))
-
-	for key, val := range env {
-		envSlice = append(envSlice, key+"="+val)
-	}
-
-	return envSlice
-}
-
-// buildMounts converts volume mounts to Docker mount configuration.
-func buildMounts(volumes []VolumeMount) []mount.Mount {
-	mounts := make([]mount.Mount, 0, len(volumes))
-
-	for _, vol := range volumes {
-		mounts = append(mounts, mount.Mount{
-			Type:     mount.TypeBind,
-			Source:   vol.HostPath,
-			Target:   vol.ContainerPath,
-			ReadOnly: vol.ReadOnly,
-		})
-	}
-
-	return mounts
-}
-
-// buildResources builds Docker resource constraints from container options.
-func buildResources(opts CreateContainerOptions) container.Resources {
-	resources := container.Resources{}
-
-	if opts.CPULimit > 0 {
-		resources.NanoCPUs = cpuLimitToNanoCPUs(opts.CPULimit)
-	}
-
-	if opts.MemoryLimit > 0 {
-		resources.Memory = opts.MemoryLimit
-	}
-
-	return resources
-}
-
 // CreateContainer creates a new container.
 func (c *Client) CreateContainer(
 	ctx context.Context,
@@ -249,20 +220,40 @@ func (c *Client) CreateContainer(
 
 	c.log.Info("creating container", "name", opts.Name, "image", opts.Image)
 
+	// Convert env map to slice
+	envSlice := make([]string, 0, len(opts.Env))
+
+	for key, val := range opts.Env {
+		envSlice = append(envSlice, key+"="+val)
+	}
+
+	// Convert volumes to mounts
+	mounts := make([]mount.Mount, 0, len(opts.Volumes))
+
+	for _, vol := range opts.Volumes {
+		mounts = append(mounts, mount.Mount{
+			Type:     mount.TypeBind,
+			Source:   vol.HostPath,
+			Target:   vol.ContainerPath,
+			ReadOnly: vol.ReadOnly,
+		})
+	}
+
+	// Convert ports to exposed ports and port bindings
 	exposedPorts, portBindings := buildPortConfig(opts.Ports)
 
+	// Create container
 	resp, err := c.docker.ContainerCreate(ctx,
 		&container.Config{
 			Image:        opts.Image,
-			Env:          buildEnvSlice(opts.Env),
+			Env:          envSlice,
 			Labels:       opts.Labels,
 			ExposedPorts: exposedPorts,
 		},
 		&container.HostConfig{
-			Mounts:       buildMounts(opts.Volumes),
+			Mounts:       mounts,
 			PortBindings: portBindings,
 			NetworkMode:  container.NetworkMode(opts.Network),
-			Resources:    buildResources(opts),
 			RestartPolicy: container.RestartPolicy{
 				Name: container.RestartPolicyUnlessStopped,
 			},
@@ -304,11 +295,7 @@ func (c *Client) StopContainer(ctx context.Context, containerID ContainerID) err
 
 	timeout := stopTimeoutSeconds
 
-	err := c.docker.ContainerStop(
-		ctx,
-		containerID.String(),
-		container.StopOptions{Timeout: &timeout},
-	)
+	err := c.docker.ContainerStop(ctx, containerID.String(), container.StopOptions{Timeout: &timeout})
 	if err != nil {
 		return fmt.Errorf("failed to stop container: %w", err)
 	}
@@ -328,11 +315,7 @@ func (c *Client) RemoveContainer(
 
 	c.log.Info("removing container", "id", containerID, "force", force)
 
-	err := c.docker.ContainerRemove(
-		ctx,
-		containerID.String(),
-		container.RemoveOptions{Force: force},
-	)
+	err := c.docker.ContainerRemove(ctx, containerID.String(), container.RemoveOptions{Force: force})
 	if err != nil {
 		return fmt.Errorf("failed to remove container: %w", err)
 	}
@@ -478,8 +461,7 @@ type CloneResult struct {
 	CommitSHA string // The HEAD commit SHA after clone/checkout
 }
 
-// CloneRepo clones a git repository using SSH and optionally checks out a
-// specific commit.
+// CloneRepo clones a git repository using SSH and optionally checks out a specific commit.
 // containerDir is the path inside the upaas container (for writing files).
 // hostDir is the corresponding path on the Docker host (for bind mounts).
 // If commitSHA is provided, that specific commit will be checked out.
@@ -555,12 +537,18 @@ func (c *Client) performBuild(
 	}()
 
 	// Build image
-	resp, err := c.docker.ImageBuild(ctx, tarArchive, dockertypes.ImageBuildOptions{
+	buildOpts := dockertypes.ImageBuildOptions{
 		Dockerfile: opts.DockerfilePath,
 		Tags:       opts.Tags,
 		Remove:     true,
 		NoCache:    false,
-	})
+	}
+
+	if len(opts.RegistryAuths) > 0 {
+		buildOpts.AuthConfigs = buildAuthConfigs(opts.RegistryAuths)
+	}
+
+	resp, err := c.docker.ImageBuild(ctx, tarArchive, buildOpts)
 	if err != nil {
 		return "", fmt.Errorf("failed to build image: %w", err)
 	}
@@ -594,13 +582,11 @@ func (c *Client) performBuild(
 // scannerInitialBufferSize is the initial buffer size for the build log scanner.
 const scannerInitialBufferSize = 64 * 1024 // 64KB
 
-// scannerMaxBufferSize is the max buffer size for build log lines
-// (base64 layers can be large).
+// scannerMaxBufferSize is the max buffer size for build log lines (base64 layers can be large).
 const scannerMaxBufferSize = 1024 * 1024 // 1MB
 
-// streamBuildOutput reads Docker build output line by line and writes to
-// stdout and optional log writer. Docker sends newline-delimited JSON, so
-// reading line by line ensures each log entry is written immediately.
+// streamBuildOutput reads Docker build output line by line and writes to stdout and optional log writer.
+// Docker sends newline-delimited JSON, so reading line by line ensures each log entry is written immediately.
 func (c *Client) streamBuildOutput(body io.Reader, logWriter io.Writer) error {
 	scanner := bufio.NewScanner(body)
 	buf := make([]byte, 0, scannerInitialBufferSize)
@@ -628,10 +614,7 @@ func (c *Client) streamBuildOutput(body io.Reader, logWriter io.Writer) error {
 	return nil
 }
 
-func (c *Client) performClone(
-	ctx context.Context,
-	cfg *cloneConfig,
-) (*CloneResult, error) {
+func (c *Client) performClone(ctx context.Context, cfg *cloneConfig) (*CloneResult, error) {
 	// Create work directory for clone destination
 	err := os.MkdirAll(cfg.containerDir, workDirPermissions)
 	if err != nil {
@@ -657,11 +640,7 @@ func (c *Client) performClone(
 	}
 
 	defer func() {
-		_ = c.docker.ContainerRemove(
-			ctx,
-			gitContainerID.String(),
-			container.RemoveOptions{Force: true},
-		)
+		_ = c.docker.ContainerRemove(ctx, gitContainerID.String(), container.RemoveOptions{Force: true})
 	}()
 
 	return c.runGitClone(ctx, gitContainerID)
@@ -699,8 +678,7 @@ func (c *Client) createGitContainer(
 	entrypoint := []string{}
 	cmd := []string{"sh", "-c", script}
 
-	// Use host paths for Docker bind mounts
-	// (Docker runs on the host, not in our container)
+	// Use host paths for Docker bind mounts (Docker runs on the host, not in our container)
 	resp, err := c.docker.ContainerCreate(ctx,
 		&container.Config{
 			Image:      gitImage,
@@ -731,20 +709,13 @@ func (c *Client) createGitContainer(
 	return ContainerID(resp.ID), nil
 }
 
-func (c *Client) runGitClone(
-	ctx context.Context,
-	containerID ContainerID,
-) (*CloneResult, error) {
+func (c *Client) runGitClone(ctx context.Context, containerID ContainerID) (*CloneResult, error) {
 	err := c.docker.ContainerStart(ctx, containerID.String(), container.StartOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("failed to start git container: %w", err)
 	}
 
-	statusCh, errCh := c.docker.ContainerWait(
-		ctx,
-		containerID.String(),
-		container.WaitConditionNotRunning,
-	)
+	statusCh, errCh := c.docker.ContainerWait(ctx, containerID.String(), container.WaitConditionNotRunning)
 
 	select {
 	case err := <-errCh:

internal/docker/resource_limits_test.go

@@ -1,31 +0,0 @@
-package docker //nolint:testpackage // tests unexported cpuLimitToNanoCPUs
-
-import (
-	"testing"
-)
-
-func TestCpuLimitToNanoCPUs(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		cpuLimit float64
-		expected int64
-	}{
-		{"one core", 1.0, 1_000_000_000},
-		{"half core", 0.5, 500_000_000},
-		{"two cores", 2.0, 2_000_000_000},
-		{"quarter core", 0.25, 250_000_000},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := cpuLimitToNanoCPUs(tt.cpuLimit)
-			if got != tt.expected {
-				t.Errorf("cpuLimitToNanoCPUs(%v) = %d, want %d", tt.cpuLimit, got, tt.expected)
-			}
-		})
-	}
-}

internal/docker/validation_test.go

@@ -6,14 +6,11 @@ import (
 	"testing"
 )
 
-// mainBranch is the branch name used across validation tests.
-const mainBranch = "main"
-
 func TestValidBranchRegex(t *testing.T) {
 	t.Parallel()
 
 	valid := []string{
-		mainBranch,
+		"main",
 		"develop",
 		"feature/my-feature",
 		"release-1.0",
@@ -73,7 +70,7 @@ func TestValidCommitSHARegex(t *testing.T) {
 	}
 }
 
-func TestCloneRepoRejectsInjection(t *testing.T) {
+func TestCloneRepoRejectsInjection(t *testing.T) { //nolint:funlen // table-driven test
 	t.Parallel()
 
 	c := &Client{
@@ -103,25 +100,25 @@ func TestCloneRepoRejectsInjection(t *testing.T) {
 		},
 		{
 			name:      "injection in commitSHA",
-			branch:    mainBranch,
+			branch:    "main",
 			commitSHA: "not-a-sha; rm -rf /",
 			wantErr:   ErrInvalidCommitSHA,
 		},
 		{
 			name:      "short SHA rejected",
-			branch:    mainBranch,
+			branch:    "main",
 			commitSHA: "abc123",
 			wantErr:   ErrInvalidCommitSHA,
 		},
 		{
 			name:      "valid inputs pass validation (hit NotConnected)",
-			branch:    mainBranch,
+			branch:    "main",
 			commitSHA: "abc123def456789012345678901234567890abcd",
 			wantErr:   ErrNotConnected,
 		},
 		{
 			name:    "valid branch no SHA passes validation (hit NotConnected)",
-			branch:  mainBranch,
+			branch:  "main",
 			wantErr: ErrNotConnected,
 		},
 	}

internal/handlers/api.go

@@ -84,7 +84,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		decodeErr := json.NewDecoder(request.Body).Decode(&req)
 		if decodeErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "invalid JSON body"},
+				map[string]string{"error": "invalid JSON body"},
 				http.StatusBadRequest)
 
 			return
@@ -95,7 +95,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 
 		if username == "" || credential == "" {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "username and password are required"},
+				map[string]string{"error": "username and password are required"},
 				http.StatusBadRequest)
 
 			return
@@ -104,7 +104,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		user, authErr := h.auth.Authenticate(request.Context(), username, credential)
 		if authErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "invalid credentials"},
+				map[string]string{"error": "invalid credentials"},
 				http.StatusUnauthorized)
 
 			return
@@ -114,7 +114,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 		if sessionErr != nil {
 			h.log.Error("api: failed to create session", "error", sessionErr)
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "failed to create session"},
+				map[string]string{"error": "failed to create session"},
 				http.StatusInternalServerError)
 
 			return
@@ -133,7 +133,7 @@ func (h *Handlers) HandleAPIListApps() http.HandlerFunc {
 		apps, err := h.appService.ListApps(request.Context())
 		if err != nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "failed to list apps"},
+				map[string]string{"error": "failed to list apps"},
 				http.StatusInternalServerError)
 
 			return
@@ -156,7 +156,7 @@ func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
 		application, err := h.appService.GetApp(request.Context(), appID)
 		if err != nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "internal server error"},
+				map[string]string{"error": "internal server error"},
 				http.StatusInternalServerError)
 
 			return
@@ -164,7 +164,7 @@ func (h *Handlers) HandleAPIGetApp() http.HandlerFunc {
 
 		if application == nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "app not found"},
+				map[string]string{"error": "app not found"},
 				http.StatusNotFound)
 
 			return
@@ -185,7 +185,7 @@ func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
 		application, err := h.appService.GetApp(request.Context(), appID)
 		if err != nil || application == nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "app not found"},
+				map[string]string{"error": "app not found"},
 				http.StatusNotFound)
 
 			return
@@ -205,7 +205,7 @@ func (h *Handlers) HandleAPIListDeployments() http.HandlerFunc {
 		)
 		if deployErr != nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "failed to list deployments"},
+				map[string]string{"error": "failed to list deployments"},
 				http.StatusInternalServerError)
 
 			return
@@ -231,7 +231,7 @@ func (h *Handlers) HandleAPIWhoAmI() http.HandlerFunc {
 		user, err := h.auth.GetCurrentUser(request.Context(), request)
 		if err != nil || user == nil {
 			h.respondJSON(writer, request,
-				map[string]string{jsonKeyError: "unauthorized"},
+				map[string]string{"error": "unauthorized"},
 				http.StatusUnauthorized)
 
 			return

internal/handlers/api_test.go

@@ -47,12 +47,7 @@ func setupAPITest(t *testing.T) (*testContext, []*http.Cookie) {
 	r := apiRouter(tc)
 
 	loginBody := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequestWithContext(
-		t.Context(),
-		http.MethodPost,
-		"/api/v1/login",
-		strings.NewReader(loginBody),
-	)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(loginBody))
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -75,7 +70,7 @@ func apiGet(
 ) *httptest.ResponseRecorder {
 	t.Helper()
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, path, nil)
+	req := httptest.NewRequest(http.MethodGet, path, nil)
 
 	for _, c := range cookies {
 		req.AddCookie(c)
@@ -100,12 +95,7 @@ func TestAPILoginSuccess(t *testing.T) {
 	r := apiRouter(tc)
 
 	body := `{"username":"admin","password":"password123"}`
-	req := httptest.NewRequestWithContext(
-		t.Context(),
-		http.MethodPost,
-		"/api/v1/login",
-		strings.NewReader(body),
-	)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -132,12 +122,7 @@ func TestAPILoginInvalidCredentials(t *testing.T) {
 	r := apiRouter(tc)
 
 	body := `{"username":"admin","password":"wrong"}`
-	req := httptest.NewRequestWithContext(
-		t.Context(),
-		http.MethodPost,
-		"/api/v1/login",
-		strings.NewReader(body),
-	)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -154,12 +139,7 @@ func TestAPILoginMissingFields(t *testing.T) {
 	r := apiRouter(tc)
 
 	body := `{"username":"","password":""}`
-	req := httptest.NewRequestWithContext(
-		t.Context(),
-		http.MethodPost,
-		"/api/v1/login",
-		strings.NewReader(body),
-	)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/login", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/json")
 
 	rr := httptest.NewRecorder()
@@ -175,9 +155,7 @@ func TestAPIRejectsUnauthenticated(t *testing.T) {
 
 	r := apiRouter(tc)
 
-	req := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/api/v1/apps", nil,
-	)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/apps", nil)
 	rr := httptest.NewRecorder()
 	r.ServeHTTP(rr, req)
 

internal/handlers/app.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -16,7 +15,6 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"sneak.berlin/go/upaas/internal/database"
 	"sneak.berlin/go/upaas/internal/models"
 	"sneak.berlin/go/upaas/internal/service/app"
 	"sneak.berlin/go/upaas/templates"
@@ -29,23 +27,6 @@ const (
 	deploymentsHistoryLimit = 50
 )
 
-// redirectToApp issues a SeeOther redirect to the page for the given
-// app ID, with an optional suffix such as "/deployments" or
-// "?success=updated". The ID is path-escaped so the target is always
-// a relative application URL.
-func redirectToApp(
-	writer http.ResponseWriter,
-	request *http.Request,
-	appID, suffix string,
-) {
-	http.Redirect(
-		writer,
-		request,
-		"/apps/"+url.PathEscape(appID)+suffix,
-		http.StatusSeeOther,
-	)
-}
-
 // HandleAppNew returns the new app form handler.
 func (h *Handlers) HandleAppNew() http.HandlerFunc {
 	tmpl := templates.GetParsed()
@@ -58,9 +39,7 @@ func (h *Handlers) HandleAppNew() http.HandlerFunc {
 }
 
 // HandleAppCreate handles app creation.
-//
-//nolint:funlen // validation adds necessary length
-func (h *Handlers) HandleAppCreate() http.HandlerFunc {
+func (h *Handlers) HandleAppCreate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -169,6 +148,7 @@ func (h *Handlers) HandleAppDetail() http.HandlerFunc {
 		labels, _ := application.GetLabels(request.Context())
 		volumes, _ := application.GetVolumes(request.Context())
 		ports, _ := application.GetPorts(request.Context())
+		registryCreds, _ := application.GetRegistryCredentials(request.Context())
 		deployments, _ := application.GetDeployments(
 			request.Context(),
 			recentDeploymentsLimit,
@@ -181,23 +161,20 @@ func (h *Handlers) HandleAppDetail() http.HandlerFunc {
 		}
 
 		webhookURL := "https://" + request.Host + "/webhook/" + application.WebhookSecret
-		deployKey := formatDeployKey(
-			application.SSHPublicKey,
-			application.CreatedAt,
-			application.Name,
-		)
+		deployKey := formatDeployKey(application.SSHPublicKey, application.CreatedAt, application.Name)
 
 		data := h.addGlobals(map[string]any{
-			dataKeyApp:         application,
-			"EnvVars":          envVars,
-			"Labels":           labels,
-			"Volumes":          volumes,
-			"Ports":            ports,
-			"Deployments":      deployments,
-			"LatestDeployment": latestDeployment,
-			"WebhookURL":       webhookURL,
-			"DeployKey":        deployKey,
-			"Success":          request.URL.Query().Get("success"),
+			"App":                 application,
+			"EnvVars":             envVars,
+			"Labels":              labels,
+			"Volumes":             volumes,
+			"Ports":               ports,
+			"RegistryCredentials": registryCreds,
+			"Deployments":         deployments,
+			"LatestDeployment":    latestDeployment,
+			"WebhookURL":          webhookURL,
+			"DeployKey":           deployKey,
+			"Success":             request.URL.Query().Get("success"),
 		}, request)
 
 		h.renderTemplate(writer, tmpl, "app_detail.html", data)
@@ -226,7 +203,7 @@ func (h *Handlers) HandleAppEdit() http.HandlerFunc {
 		}
 
 		data := h.addGlobals(map[string]any{
-			dataKeyApp: application,
+			"App": application,
 		}, request)
 
 		h.renderTemplate(writer, tmpl, "app_edit.html", data)
@@ -234,7 +211,7 @@ func (h *Handlers) HandleAppEdit() http.HandlerFunc {
 }
 
 // HandleAppUpdate handles app updates.
-func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
+func (h *Handlers) HandleAppUpdate() http.HandlerFunc { //nolint:funlen // validation adds necessary length
 	tmpl := templates.GetParsed()
 
 	return func(writer http.ResponseWriter, request *http.Request) {
@@ -259,8 +236,8 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
 		nameErr := validateAppName(newName)
 		if nameErr != nil {
 			data := h.addGlobals(map[string]any{
-				dataKeyApp:   application,
-				dataKeyError: "Invalid app name: " + nameErr.Error(),
+				"App":   application,
+				"Error": "Invalid app name: " + nameErr.Error(),
 			}, request)
 			h.renderTemplate(writer, tmpl, "app_edit.html", data)
 
@@ -270,8 +247,8 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
 		repoURLErr := validateRepoURL(request.FormValue("repo_url"))
 		if repoURLErr != nil {
 			data := h.addGlobals(map[string]any{
-				dataKeyApp:   application,
-				dataKeyError: "Invalid repository URL: " + repoURLErr.Error(),
+				"App":   application,
+				"Error": "Invalid repository URL: " + repoURLErr.Error(),
 			}, request)
 			h.renderTemplate(writer, tmpl, "app_edit.html", data)
 
@@ -282,19 +259,23 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
 		application.RepoURL = request.FormValue("repo_url")
 		application.Branch = request.FormValue("branch")
 		application.DockerfilePath = request.FormValue("dockerfile_path")
-		application.DockerNetwork = optionalNullString(request.FormValue("docker_network"))
-		application.NtfyTopic = optionalNullString(request.FormValue("ntfy_topic"))
-		application.SlackWebhook = optionalNullString(request.FormValue("slack_webhook"))
 
-		limitsErr := applyResourceLimits(application, request)
-		if limitsErr != "" {
-			data := h.addGlobals(map[string]any{
-				dataKeyApp:   application,
-				dataKeyError: limitsErr,
-			}, request)
-			h.renderTemplate(writer, tmpl, "app_edit.html", data)
+		if network := request.FormValue("docker_network"); network != "" {
+			application.DockerNetwork = sql.NullString{String: network, Valid: true}
+		} else {
+			application.DockerNetwork = sql.NullString{}
+		}
 
-			return
+		if ntfy := request.FormValue("ntfy_topic"); ntfy != "" {
+			application.NtfyTopic = sql.NullString{String: ntfy, Valid: true}
+		} else {
+			application.NtfyTopic = sql.NullString{}
+		}
+
+		if slack := request.FormValue("slack_webhook"); slack != "" {
+			application.SlackWebhook = sql.NullString{String: slack, Valid: true}
+		} else {
+			application.SlackWebhook = sql.NullString{}
 		}
 
 		saveErr := application.Save(request.Context())
@@ -302,15 +283,16 @@ func (h *Handlers) HandleAppUpdate() http.HandlerFunc {
 			h.log.Error("failed to update app", "error", saveErr)
 
 			data := h.addGlobals(map[string]any{
-				dataKeyApp:   application,
-				dataKeyError: "Failed to update app",
+				"App":   application,
+				"Error": "Failed to update app",
 			}, request)
 			h.renderTemplate(writer, tmpl, "app_edit.html", data)
 
 			return
 		}
 
-		redirectToApp(writer, request, application.ID, "?success=updated")
+		redirectURL := "/apps/" + application.ID + "?success=updated"
+		http.Redirect(writer, request, redirectURL, http.StatusSeeOther)
 	}
 }
 
@@ -395,7 +377,12 @@ func (h *Handlers) HandleAppDeploy() http.HandlerFunc {
 			}
 		}(deployCtx, application)
 
-		redirectToApp(writer, request, application.ID, "/deployments")
+		http.Redirect(
+			writer,
+			request,
+			"/apps/"+application.ID+"/deployments",
+			http.StatusSeeOther,
+		)
 	}
 }
 
@@ -416,7 +403,12 @@ func (h *Handlers) HandleCancelDeploy() http.HandlerFunc {
 			h.log.Info("deployment cancelled by user", "app", application.Name)
 		}
 
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(
+			writer,
+			request,
+			"/apps/"+application.ID,
+			http.StatusSeeOther,
+		)
 	}
 }
 
@@ -435,12 +427,12 @@ func (h *Handlers) HandleAppRollback() http.HandlerFunc {
 		rollbackErr := h.deploy.Rollback(request.Context(), application)
 		if rollbackErr != nil {
 			h.log.Error("rollback failed", "error", rollbackErr, "app", application.Name)
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 
 			return
 		}
 
-		redirectToApp(writer, request, application.ID, "?success=rolledback")
+		http.Redirect(writer, request, "/apps/"+application.ID+"?success=rolledback", http.StatusSeeOther)
 	}
 }
 
@@ -464,7 +456,7 @@ func (h *Handlers) HandleAppDeployments() http.HandlerFunc {
 		)
 
 		data := h.addGlobals(map[string]any{
-			dataKeyApp:    application,
+			"App":         application,
 			"Deployments": deployments,
 		}, request)
 
@@ -537,7 +529,7 @@ func (h *Handlers) HandleAppLogs() http.HandlerFunc {
 			return
 		}
 
-		_, _ = writer.Write([]byte(SanitizeLogs(logs))) // #nosec G705 -- output sanitized
+		_, _ = writer.Write([]byte(SanitizeLogs(logs))) // #nosec G705 -- logs sanitized, Content-Type is text/plain
 	}
 }
 
@@ -576,8 +568,8 @@ func (h *Handlers) HandleDeploymentLogsAPI() http.HandlerFunc {
 		}
 
 		response := map[string]any{
-			jsonKeyLogs:   logs,
-			jsonKeyStatus: deployment.Status,
+			"logs":   logs,
+			"status": deployment.Status,
 		}
 
 		_ = json.NewEncoder(writer).Encode(response)
@@ -620,7 +612,7 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 		}
 
 		// Check if file exists — logPath is constructed internally, not from user input
-		_, err := os.Stat(logPath) // #nosec G703 -- internal path, not user input
+		_, err := os.Stat(logPath) // #nosec G703 -- path from internal GetLogFilePath, not user input
 		if os.IsNotExist(err) {
 			http.NotFound(writer, request)
 
@@ -640,7 +632,7 @@ func (h *Handlers) HandleDeploymentLogDownload() http.HandlerFunc {
 		writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		writer.Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
 
-		http.ServeFile(writer, request, logPath) // #nosec G703 -- internal path
+		http.ServeFile(writer, request, logPath)
 	}
 }
 
@@ -664,8 +656,8 @@ func (h *Handlers) HandleContainerLogsAPI() http.HandlerFunc {
 		containerInfo, containerErr := h.docker.FindContainerByAppID(request.Context(), appID)
 		if containerErr != nil || containerInfo == nil {
 			response := map[string]any{
-				jsonKeyLogs:   "No container running\n",
-				jsonKeyStatus: "stopped",
+				"logs":   "No container running\n",
+				"status": "stopped",
 			}
 			_ = json.NewEncoder(writer).Encode(response)
 
@@ -685,8 +677,8 @@ func (h *Handlers) HandleContainerLogsAPI() http.HandlerFunc {
 			)
 
 			response := map[string]any{
-				jsonKeyLogs:   "Failed to fetch container logs\n",
-				jsonKeyStatus: "error",
+				"logs":   "Failed to fetch container logs\n",
+				"status": "error",
 			}
 			_ = json.NewEncoder(writer).Encode(response)
 
@@ -699,8 +691,8 @@ func (h *Handlers) HandleContainerLogsAPI() http.HandlerFunc {
 		}
 
 		response := map[string]any{
-			jsonKeyLogs:   SanitizeLogs(logs),
-			jsonKeyStatus: status,
+			"logs":   SanitizeLogs(logs),
+			"status": status,
 		}
 
 		_ = json.NewEncoder(writer).Encode(response)
@@ -734,7 +726,7 @@ func (h *Handlers) HandleAppStatusAPI() http.HandlerFunc {
 		}
 
 		response := map[string]any{
-			jsonKeyStatus:            string(application.Status),
+			"status":                 string(application.Status),
 			"latestDeploymentID":     latestDeploymentID,
 			"latestDeploymentStatus": latestDeploymentStatus,
 		}
@@ -771,7 +763,7 @@ func (h *Handlers) HandleRecentDeploymentsAPI() http.HandlerFunc {
 		for _, d := range deployments {
 			deploymentsData = append(deploymentsData, map[string]any{
 				"id":              d.ID,
-				jsonKeyStatus:     string(d.Status),
+				"status":          string(d.Status),
 				"duration":        d.Duration(),
 				"shortCommit":     d.ShortCommit(),
 				"finishedAtISO":   d.FinishedAtISO(),
@@ -813,7 +805,7 @@ func (h *Handlers) handleContainerAction(
 
 	containerInfo, containerErr := h.docker.FindContainerByAppID(ctx, appID)
 	if containerErr != nil || containerInfo == nil {
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 
 		return
 	}
@@ -846,7 +838,7 @@ func (h *Handlers) handleContainerAction(
 			"action", action, "app", application.Name, "container", containerID)
 	}
 
-	redirectToApp(writer, request, appID, "")
+	http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 }
 
 // HandleAppRestart handles restarting an app's container.
@@ -900,7 +892,7 @@ func (h *Handlers) addKeyValueToApp(
 	value := request.FormValue("value")
 
 	if key == "" || value == "" {
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 
 		return
 	}
@@ -910,7 +902,7 @@ func (h *Handlers) addKeyValueToApp(
 		h.log.Error("failed to add key-value pair", "error", saveErr)
 	}
 
-	redirectToApp(writer, request, application.ID, "")
+	http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 }
 
 // envPairJSON represents a key-value pair in the JSON request body.
@@ -971,7 +963,7 @@ func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 		decodeErr := json.NewDecoder(request.Body).Decode(&pairs)
 		if decodeErr != nil {
 			h.respondJSON(writer, request, map[string]string{
-				jsonKeyError: "invalid request body",
+				"error": "invalid request body",
 			}, http.StatusBadRequest)
 
 			return
@@ -980,7 +972,7 @@ func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 		modelPairs, validationErr := validateEnvPairs(pairs)
 		if validationErr != "" {
 			h.respondJSON(writer, request, map[string]string{
-				jsonKeyError: validationErr,
+				"error": validationErr,
 			}, http.StatusBadRequest)
 
 			return
@@ -992,7 +984,7 @@ func (h *Handlers) HandleEnvVarSave() http.HandlerFunc {
 		if replaceErr != nil {
 			h.log.Error("failed to replace env vars", "error", replaceErr)
 			h.respondJSON(writer, request, map[string]string{
-				jsonKeyError: "failed to save environment variables",
+				"error": "failed to save environment variables",
 			}, http.StatusInternalServerError)
 
 			return
@@ -1020,77 +1012,32 @@ func (h *Handlers) HandleLabelAdd() http.HandlerFunc {
 	}
 }
 
-// deleteAppResource handles deletion of an app-owned resource (label,
-// volume, or port) identified by an int64 URL parameter. The
-// deleteByID closure reports whether the resource was found to belong
-// to the app, and returns the deletion error if one occurred.
-func (h *Handlers) deleteAppResource(
-	writer http.ResponseWriter,
-	request *http.Request,
-	idParam, logName string,
-	deleteByID deleteByIDFunc,
-) {
-	appID := chi.URLParam(request, "id")
-	idStr := chi.URLParam(request, idParam)
-
-	id, parseErr := strconv.ParseInt(idStr, 10, 64)
-	if parseErr != nil {
-		http.NotFound(writer, request)
-
-		return
-	}
-
-	found, deleteErr := deleteByID(request.Context(), appID, id)
-	if !found {
-		http.NotFound(writer, request)
-
-		return
-	}
-
-	if deleteErr != nil {
-		h.log.Error("failed to delete "+logName, "error", deleteErr)
-	}
-
-	redirectToApp(writer, request, appID, "")
-}
-
-// deleteByIDFunc looks up an app-owned resource by ID and deletes it
-// when it belongs to the given app. It reports whether the resource
-// was found, and returns lookup or deletion errors.
-type deleteByIDFunc func(ctx context.Context, appID string, id int64) (bool, error)
-
-// makeDeleteByID builds a deleteByIDFunc from a model's find
-// function, its app-ID accessor, and its delete method.
-func makeDeleteByID[T any](
-	db *database.Database,
-	find func(context.Context, *database.Database, int64) (*T, error),
-	appIDOf func(*T) string,
-	del func(*T, context.Context) error,
-) deleteByIDFunc {
-	return func(ctx context.Context, appID string, id int64) (bool, error) {
-		resource, findErr := find(ctx, db, id)
-		if findErr != nil {
-			return false, findErr
-		}
-
-		if resource == nil || appIDOf(resource) != appID {
-			return false, nil
-		}
-
-		return true, del(resource, ctx)
-	}
-}
-
 // HandleLabelDelete handles deleting a label.
 func (h *Handlers) HandleLabelDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		h.deleteAppResource(
-			writer, request, "labelID", "label",
-			makeDeleteByID(h.db, models.FindLabel,
-				func(l *models.Label) string { return l.AppID },
-				(*models.Label).Delete,
-			),
-		)
+		appID := chi.URLParam(request, "id")
+		labelIDStr := chi.URLParam(request, "labelID")
+
+		labelID, parseErr := strconv.ParseInt(labelIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		label, findErr := models.FindLabel(request.Context(), h.db, labelID)
+		if findErr != nil || label == nil || label.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		deleteErr := label.Delete(request.Context())
+		if deleteErr != nil {
+			h.log.Error("failed to delete label", "error", deleteErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
 
@@ -1118,7 +1065,12 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 		readOnly := request.FormValue("readonly") == "1"
 
 		if hostPath == "" || containerPath == "" {
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(
+				writer,
+				request,
+				"/apps/"+application.ID,
+				http.StatusSeeOther,
+			)
 
 			return
 		}
@@ -1126,7 +1078,7 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 		pathErr := validateVolumePaths(hostPath, containerPath)
 		if pathErr != nil {
 			h.log.Error("invalid volume path", "error", pathErr)
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 
 			return
 		}
@@ -1142,20 +1094,36 @@ func (h *Handlers) HandleVolumeAdd() http.HandlerFunc {
 			h.log.Error("failed to add volume", "error", saveErr)
 		}
 
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 	}
 }
 
 // HandleVolumeDelete handles deleting a volume mount.
 func (h *Handlers) HandleVolumeDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		h.deleteAppResource(
-			writer, request, "volumeID", "volume",
-			makeDeleteByID(h.db, models.FindVolume,
-				func(v *models.Volume) string { return v.AppID },
-				(*models.Volume).Delete,
-			),
-		)
+		appID := chi.URLParam(request, "id")
+		volumeIDStr := chi.URLParam(request, "volumeID")
+
+		volumeID, parseErr := strconv.ParseInt(volumeIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		volume, findErr := models.FindVolume(request.Context(), h.db, volumeID)
+		if findErr != nil || volume == nil || volume.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		deleteErr := volume.Delete(request.Context())
+		if deleteErr != nil {
+			h.log.Error("failed to delete volume", "error", deleteErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
 
@@ -1183,7 +1151,7 @@ func (h *Handlers) HandlePortAdd() http.HandlerFunc {
 			request.FormValue("container_port"),
 		)
 		if !valid {
-			redirectToApp(writer, request, application.ID, "")
+			http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 
 			return
 		}
@@ -1204,7 +1172,7 @@ func (h *Handlers) HandlePortAdd() http.HandlerFunc {
 			h.log.Error("failed to save port", "error", saveErr)
 		}
 
-		redirectToApp(writer, request, application.ID, "")
+		http.Redirect(writer, request, "/apps/"+application.ID, http.StatusSeeOther)
 	}
 }
 
@@ -1228,13 +1196,29 @@ func parsePortValues(hostPortStr, containerPortStr string) (int, int, bool) {
 // HandlePortDelete handles deleting a port mapping.
 func (h *Handlers) HandlePortDelete() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
-		h.deleteAppResource(
-			writer, request, "portID", "port",
-			makeDeleteByID(h.db, models.FindPort,
-				func(p *models.Port) string { return p.AppID },
-				(*models.Port).Delete,
-			),
-		)
+		appID := chi.URLParam(request, "id")
+		portIDStr := chi.URLParam(request, "portID")
+
+		portID, parseErr := strconv.ParseInt(portIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		port, findErr := models.FindPort(request.Context(), h.db, portID)
+		if findErr != nil || port == nil || port.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		deleteErr := port.Delete(request.Context())
+		if deleteErr != nil {
+			h.log.Error("failed to delete port", "error", deleteErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
 
@@ -1296,7 +1280,7 @@ func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 		value := request.FormValue("value")
 
 		if key == "" || value == "" {
-			redirectToApp(writer, request, appID, "")
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 
 			return
 		}
@@ -1309,7 +1293,7 @@ func (h *Handlers) HandleLabelEdit() http.HandlerFunc {
 			h.log.Error("failed to update label", "error", saveErr)
 		}
 
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
 
@@ -1345,7 +1329,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 		readOnly := request.FormValue("readonly") == "1"
 
 		if hostPath == "" || containerPath == "" {
-			redirectToApp(writer, request, appID, "")
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 
 			return
 		}
@@ -1353,7 +1337,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 		pathErr := validateVolumePaths(hostPath, containerPath)
 		if pathErr != nil {
 			h.log.Error("invalid volume path", "error", pathErr)
-			redirectToApp(writer, request, appID, "")
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 
 			return
 		}
@@ -1367,7 +1351,7 @@ func (h *Handlers) HandleVolumeEdit() http.HandlerFunc {
 			h.log.Error("failed to update volume", "error", saveErr)
 		}
 
-		redirectToApp(writer, request, appID, "")
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
 	}
 }
 
@@ -1386,132 +1370,6 @@ func validateVolumePaths(hostPath, containerPath string) error {
 	return nil
 }
 
-// ErrInvalidMemoryFormat is returned when a memory limit string cannot be parsed.
-var ErrInvalidMemoryFormat = errors.New(
-	"must be a number with optional unit suffix (e.g. 256m, 1g, 512000000)",
-)
-
-// ErrNegativeValue is returned when a resource limit is negative.
-var ErrNegativeValue = errors.New("value must be positive")
-
-// Memory unit byte multipliers.
-const (
-	kilobyte = 1024
-	megabyte = 1024 * 1024
-	gigabyte = 1024 * 1024 * 1024
-)
-
-// optionalNullString converts a form value to a sql.NullString.
-// Returns a valid NullString if non-empty, invalid (NULL) if empty.
-func optionalNullString(s string) sql.NullString {
-	if s != "" {
-		return sql.NullString{String: s, Valid: true}
-	}
-
-	return sql.NullString{}
-}
-
-// applyResourceLimits parses CPU and memory limit form values and
-// applies them to the app. Returns an error message string if
-// validation fails, or empty string on success.
-func applyResourceLimits(application *models.App, request *http.Request) string {
-	cpuLimit, cpuErr := parseOptionalFloat64(request.FormValue("cpu_limit"))
-	if cpuErr != nil {
-		return "Invalid CPU limit: must be a positive number (e.g. 0.5, 1, 2)"
-	}
-
-	application.CPULimit = cpuLimit
-
-	memoryLimit, memErr := parseOptionalMemoryBytes(request.FormValue("memory_limit"))
-	if memErr != nil {
-		return "Invalid memory limit: " + memErr.Error()
-	}
-
-	application.MemoryLimit = memoryLimit
-
-	return ""
-}
-
-// memoryUnitMultiplier returns the byte multiplier for a memory unit suffix.
-// Returns 0 if the suffix is not recognized.
-func memoryUnitMultiplier(suffix byte) int64 {
-	switch suffix {
-	case 'k':
-		return kilobyte
-	case 'm':
-		return megabyte
-	case 'g':
-		return gigabyte
-	default:
-		return 0
-	}
-}
-
-// parseOptionalFloat64 parses an optional float64 form field.
-// Returns a valid NullFloat64 if the string is non-empty and parses
-// to a positive number.
-// Returns an empty NullFloat64 if the string is empty.
-// Returns an error if the string is non-empty but invalid or non-positive.
-func parseOptionalFloat64(s string) (sql.NullFloat64, error) {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return sql.NullFloat64{}, nil
-	}
-
-	val, err := strconv.ParseFloat(s, 64)
-	if err != nil {
-		return sql.NullFloat64{}, fmt.Errorf("invalid number: %w", err)
-	}
-
-	if val <= 0 {
-		return sql.NullFloat64{}, ErrNegativeValue
-	}
-
-	return sql.NullFloat64{Float64: val, Valid: true}, nil
-}
-
-// parseOptionalMemoryBytes parses an optional memory limit string into bytes.
-// Accepts plain bytes (e.g. "536870912") or suffixed values
-// (e.g. "512m", "1g", "256k").
-// Returns a valid NullInt64 with bytes if non-empty, empty NullInt64 if blank.
-func parseOptionalMemoryBytes(s string) (sql.NullInt64, error) {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return sql.NullInt64{}, nil
-	}
-
-	s = strings.ToLower(s)
-
-	// Check for unit suffix
-	multiplier := memoryUnitMultiplier(s[len(s)-1])
-	if multiplier > 0 {
-		numStr := s[:len(s)-1]
-
-		val, err := strconv.ParseFloat(numStr, 64)
-		if err != nil {
-			return sql.NullInt64{}, ErrInvalidMemoryFormat
-		}
-
-		if val <= 0 {
-			return sql.NullInt64{}, ErrNegativeValue
-		}
-
-		return sql.NullInt64{Int64: int64(val * float64(multiplier)), Valid: true}, nil
-	}
-
-	// Plain bytes
-	val, err := strconv.ParseInt(s, 10, 64)
-	if err != nil {
-		return sql.NullInt64{}, ErrInvalidMemoryFormat
-	}
-
-	if val <= 0 {
-		return sql.NullInt64{}, ErrNegativeValue
-	}
-
-	return sql.NullInt64{Int64: val, Valid: true}, nil
-}
-
 // formatDeployKey formats an SSH public key with a descriptive comment.
 // Format: ssh-ed25519 AAAA... upaas_2025-01-15_myapp
 func formatDeployKey(pubKey string, createdAt time.Time, appName string) string {
@@ -1526,3 +1384,126 @@ func formatDeployKey(pubKey string, createdAt time.Time, appName string) string
 
 	return parts[0] + " " + parts[1] + " " + comment
 }
+
+// HandleRegistryCredentialAdd handles adding a registry credential.
+func (h *Handlers) HandleRegistryCredentialAdd() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+
+		application, findErr := models.FindApp(request.Context(), h.db, appID)
+		if findErr != nil || application == nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		parseErr := request.ParseForm()
+		if parseErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		registryURL := strings.TrimSpace(request.FormValue("registry"))
+		username := strings.TrimSpace(request.FormValue("username"))
+		password := request.FormValue("password")
+
+		if registryURL == "" || username == "" || password == "" {
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		cred := models.NewRegistryCredential(h.db)
+		cred.AppID = appID
+		cred.Registry = registryURL
+		cred.Username = username
+		cred.Password = password
+
+		saveErr := cred.Save(request.Context())
+		if saveErr != nil {
+			h.log.Error("failed to save registry credential", "error", saveErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}
+
+// HandleRegistryCredentialEdit handles editing an existing registry credential.
+func (h *Handlers) HandleRegistryCredentialEdit() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+		credIDStr := chi.URLParam(request, "credID")
+
+		credID, parseErr := strconv.ParseInt(credIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		cred, findErr := models.FindRegistryCredential(request.Context(), h.db, credID)
+		if findErr != nil || cred == nil || cred.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		formErr := request.ParseForm()
+		if formErr != nil {
+			http.Error(writer, "Bad Request", http.StatusBadRequest)
+
+			return
+		}
+
+		registryURL := strings.TrimSpace(request.FormValue("registry"))
+		username := strings.TrimSpace(request.FormValue("username"))
+		password := request.FormValue("password")
+
+		if registryURL == "" || username == "" || password == "" {
+			http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+
+			return
+		}
+
+		cred.Registry = registryURL
+		cred.Username = username
+		cred.Password = password
+
+		saveErr := cred.Save(request.Context())
+		if saveErr != nil {
+			h.log.Error("failed to update registry credential", "error", saveErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}
+
+// HandleRegistryCredentialDelete handles deleting a registry credential.
+func (h *Handlers) HandleRegistryCredentialDelete() http.HandlerFunc {
+	return func(writer http.ResponseWriter, request *http.Request) {
+		appID := chi.URLParam(request, "id")
+		credIDStr := chi.URLParam(request, "credID")
+
+		credID, parseErr := strconv.ParseInt(credIDStr, 10, 64)
+		if parseErr != nil {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		cred, findErr := models.FindRegistryCredential(request.Context(), h.db, credID)
+		if findErr != nil || cred == nil || cred.AppID != appID {
+			http.NotFound(writer, request)
+
+			return
+		}
+
+		deleteErr := cred.Delete(request.Context())
+		if deleteErr != nil {
+			h.log.Error("failed to delete registry credential", "error", deleteErr)
+		}
+
+		http.Redirect(writer, request, "/apps/"+appID, http.StatusSeeOther)
+	}
+}

internal/handlers/app_name_validation_test.go

@@ -21,16 +21,8 @@ func TestValidateAppName(t *testing.T) {
 		{"empty", "", true},
 		{"single char", "a", true},
 		{"too long", "a" + string(make([]byte, 63)), true},
-		{
-			"exactly 63 chars",
-			"a23456789012345678901234567890123456789012345678901234567890123",
-			false,
-		},
-		{
-			"64 chars",
-			"a234567890123456789012345678901234567890123456789012345678901234",
-			true,
-		},
+		{"exactly 63 chars", "a23456789012345678901234567890123456789012345678901234567890123", false},
+		{"64 chars", "a234567890123456789012345678901234567890123456789012345678901234", true},
 		{"uppercase", "MyApp", true},
 		{"spaces", "my app", true},
 		{"starts with hyphen", "-myapp", true},

internal/handlers/handlers.go

@@ -22,19 +22,6 @@ import (
 	"sneak.berlin/go/upaas/templates"
 )
 
-// Template data keys shared across handlers.
-const (
-	dataKeyApp   = "App"
-	dataKeyError = "Error"
-)
-
-// JSON response keys shared across handlers.
-const (
-	jsonKeyError  = "error"
-	jsonKeyLogs   = "logs"
-	jsonKeyStatus = "status"
-)
-
 // Params contains dependencies for Handlers.
 type Params struct {
 	fx.In

internal/handlers/handlers_test.go

@@ -32,11 +32,6 @@ import (
 	"sneak.berlin/go/upaas/internal/service/webhook"
 )
 
-const (
-	branchMain  = "main"
-	paramSecret = "secret"
-)
-
 type testContext struct {
 	handlers   *handlers.Handlers
 	database   *database.Database
@@ -198,8 +193,7 @@ func TestHandleHealthCheck(t *testing.T) {
 
 		testCtx := setupTestHandlers(t)
 
-		request := httptest.NewRequestWithContext(
-			t.Context(),
+		request := httptest.NewRequest(
 			http.MethodGet,
 			"/.well-known/healthcheck.json",
 			nil,
@@ -216,26 +210,6 @@ func TestHandleHealthCheck(t *testing.T) {
 	})
 }
 
-// assertPageRenders serves a GET request for path with the given
-// handler and asserts a 200 response containing want.
-func assertPageRenders(
-	t *testing.T,
-	handler http.Handler,
-	path, want string,
-) {
-	t.Helper()
-
-	request := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, path, nil,
-	)
-	recorder := httptest.NewRecorder()
-
-	handler.ServeHTTP(recorder, request)
-
-	assert.Equal(t, http.StatusOK, recorder.Code)
-	assert.Contains(t, recorder.Body.String(), want)
-}
-
 func TestHandleSetupGET(t *testing.T) {
 	t.Parallel()
 
@@ -243,7 +217,15 @@ func TestHandleSetupGET(t *testing.T) {
 		t.Parallel()
 
 		testCtx := setupTestHandlers(t)
-		assertPageRenders(t, testCtx.handlers.HandleSetupGET(), "/setup", "setup")
+
+		request := httptest.NewRequest(http.MethodGet, "/setup", nil)
+		recorder := httptest.NewRecorder()
+
+		handler := testCtx.handlers.HandleSetupGET()
+		handler.ServeHTTP(recorder, request)
+
+		assert.Equal(t, http.StatusOK, recorder.Code)
+		assert.Contains(t, recorder.Body.String(), "setup")
 	})
 }
 
@@ -255,8 +237,7 @@ func createSetupFormRequest(
 	form.Set("password", password)
 	form.Set("password_confirm", confirm)
 
-	request := httptest.NewRequestWithContext(
-		context.Background(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/setup",
 		strings.NewReader(form.Encode()),
@@ -333,7 +314,15 @@ func TestHandleLoginGET(t *testing.T) {
 		t.Parallel()
 
 		testCtx := setupTestHandlers(t)
-		assertPageRenders(t, testCtx.handlers.HandleLoginGET(), "/login", "login")
+
+		request := httptest.NewRequest(http.MethodGet, "/login", nil)
+		recorder := httptest.NewRecorder()
+
+		handler := testCtx.handlers.HandleLoginGET()
+		handler.ServeHTTP(recorder, request)
+
+		assert.Equal(t, http.StatusOK, recorder.Code)
+		assert.Contains(t, recorder.Body.String(), "login")
 	})
 }
 
@@ -342,8 +331,7 @@ func createLoginFormRequest(username, password string) *http.Request {
 	form.Set("username", username)
 	form.Set("password", password)
 
-	request := httptest.NewRequestWithContext(
-		context.Background(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/login",
 		strings.NewReader(form.Encode()),
@@ -407,9 +395,7 @@ func TestHandleDashboard(t *testing.T) {
 
 		testCtx := setupTestHandlers(t)
 
-		request := httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, "/", nil,
-		)
+		request := httptest.NewRequest(http.MethodGet, "/", nil)
 		recorder := httptest.NewRecorder()
 
 		handler := testCtx.handlers.HandleDashboard()
@@ -427,9 +413,7 @@ func TestHandleDashboard(t *testing.T) {
 		// Create an app so the template iterates over AppStats and hits .CSRFField
 		createTestApp(t, testCtx, "csrf-test-app")
 
-		request := httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, "/", nil,
-		)
+		request := httptest.NewRequest(http.MethodGet, "/", nil)
 		recorder := httptest.NewRecorder()
 
 		handler := testCtx.handlers.HandleDashboard()
@@ -449,9 +433,7 @@ func TestHandleAppNew(t *testing.T) {
 
 		testCtx := setupTestHandlers(t)
 
-		request := httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, "/apps/new", nil,
-		)
+		request := httptest.NewRequest(http.MethodGet, "/apps/new", nil)
 		recorder := httptest.NewRecorder()
 
 		handler := testCtx.handlers.HandleAppNew()
@@ -490,7 +472,7 @@ func createTestApp(
 		app.CreateAppInput{
 			Name:    name,
 			RepoURL: "git@example.com:user/" + name + ".git",
-			Branch:  branchMain,
+			Branch:  "main",
 		},
 	)
 	require.NoError(t, err)
@@ -511,7 +493,7 @@ func TestHandleWebhookRejectsOversizedBody(t *testing.T) {
 		app.CreateAppInput{
 			Name:    "oversize-test-app",
 			RepoURL: "git@example.com:user/repo.git",
-			Branch:  branchMain,
+			Branch:  "main",
 		},
 	)
 	require.NoError(t, createErr)
@@ -519,15 +501,14 @@ func TestHandleWebhookRejectsOversizedBody(t *testing.T) {
 	// Create a body larger than 1MB - it should be silently truncated
 	// and the webhook should still process (or fail gracefully on parse)
 	largePayload := strings.Repeat("x", 2*1024*1024) // 2MB
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/webhook/"+createdApp.WebhookSecret,
 		strings.NewReader(largePayload),
 	)
 	request = addChiURLParams(
 		request,
-		map[string]string{paramSecret: createdApp.WebhookSecret},
+		map[string]string{"secret": createdApp.WebhookSecret},
 	)
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("X-Gitea-Event", "push")
@@ -563,8 +544,7 @@ func testOwnershipVerification(t *testing.T, cfg ownedResourceTestConfig) {
 
 	resourceID := cfg.createFn(t, testCtx, app1)
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		cfg.deletePath(app2.ID, resourceID),
 		nil,
@@ -603,8 +583,7 @@ func TestHandleEnvVarSaveBulk(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -646,8 +625,7 @@ func TestHandleEnvVarSaveAppNotFound(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/nonexistent-id/env",
 		strings.NewReader(body),
@@ -673,8 +651,7 @@ func TestHandleEnvVarSaveEmptyKeyRejected(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -696,14 +673,12 @@ func TestHandleEnvVarSaveDuplicateKeyRejected(t *testing.T) {
 	createdApp := createTestApp(t, testCtx, "envvar-dedup-app")
 
 	// Send two entries with the same key — should be rejected
-	body := `[{"key":"FOO","value":"first"},{"key":"BAR","value":"bar"},` +
-		`{"key":"FOO","value":"second"}]`
+	body := `[{"key":"FOO","value":"first"},{"key":"BAR","value":"bar"},{"key":"FOO","value":"second"}]`
 
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(body),
@@ -741,8 +716,7 @@ func TestHandleEnvVarSaveCrossAppIsolation(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+appA.ID+"/env",
 		strings.NewReader(body),
@@ -805,8 +779,7 @@ func TestHandleEnvVarSaveBodySizeLimit(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader(sb.String()),
@@ -875,8 +848,7 @@ func TestDeleteVolumeOwnershipVerification(t *testing.T) {
 	require.NoError(t, volume.Save(context.Background()))
 
 	// Try to delete app1's volume using app2's URL path
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+app2.ID+"/volumes/"+strconv.FormatInt(volume.ID, 10)+"/delete",
 		nil,
@@ -917,8 +889,7 @@ func TestDeletePortOwnershipVerification(t *testing.T) {
 	require.NoError(t, port.Save(context.Background()))
 
 	// Try to delete app1's port using app2's URL path
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+app2.ID+"/ports/"+strconv.FormatInt(port.ID, 10)+"/delete",
 		nil,
@@ -959,8 +930,7 @@ func TestHandleEnvVarSaveEmptyClears(t *testing.T) {
 	r := chi.NewRouter()
 	r.Post("/apps/{id}/env", testCtx.handlers.HandleEnvVarSave())
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/env",
 		strings.NewReader("[]"),
@@ -1009,8 +979,7 @@ func TestHandleVolumeAddValidatesPaths(t *testing.T) {
 			form.Set("host_path", tt.hostPath)
 			form.Set("container_path", tt.containerPath)
 
-			request := httptest.NewRequestWithContext(
-				t.Context(),
+			request := httptest.NewRequest(
 				http.MethodPost,
 				"/apps/"+createdApp.ID+"/volumes",
 				strings.NewReader(form.Encode()),
@@ -1047,8 +1016,7 @@ func TestHandleVolumeAddValidatesPaths(t *testing.T) {
 }
 
 // TestSetupRequiredExemptsHealthAndStaticAndAPI verifies that the SetupRequired
-// middleware allows /health, /s/*, and /api/* paths through even when setup is
-// required.
+// middleware allows /health, /s/*, and /api/* paths through even when setup is required.
 func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 	t.Parallel()
 
@@ -1064,21 +1032,13 @@ func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 
 	wrapped := mw(okHandler)
 
-	exemptPaths := []string{
-		"/health",
-		"/s/style.css",
-		"/s/js/app.js",
-		"/api/v1/apps",
-		"/api/v1/login",
-	}
+	exemptPaths := []string{"/health", "/s/style.css", "/s/js/app.js", "/api/v1/apps", "/api/v1/login"}
 
 	for _, path := range exemptPaths {
 		t.Run(path, func(t *testing.T) {
 			t.Parallel()
 
-			req := httptest.NewRequestWithContext(
-				t.Context(), http.MethodGet, path, nil,
-			)
+			req := httptest.NewRequest(http.MethodGet, path, nil)
 			rr := httptest.NewRecorder()
 			wrapped.ServeHTTP(rr, req)
 
@@ -1091,9 +1051,7 @@ func TestSetupRequiredExemptsHealthAndStaticAndAPI(t *testing.T) {
 	t.Run("non-exempt redirects", func(t *testing.T) {
 		t.Parallel()
 
-		req := httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, "/", nil,
-		)
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
 		rr := httptest.NewRecorder()
 		wrapped.ServeHTTP(rr, req)
 
@@ -1109,8 +1067,7 @@ func TestHandleCancelDeployRedirects(t *testing.T) {
 
 	createdApp := createTestApp(t, testCtx, "cancel-deploy-app")
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/"+createdApp.ID+"/deployments/cancel",
 		nil,
@@ -1130,8 +1087,7 @@ func TestHandleCancelDeployReturns404ForUnknownApp(t *testing.T) {
 
 	testCtx := setupTestHandlers(t)
 
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		"/apps/nonexistent/deployments/cancel",
 		nil,
@@ -1152,16 +1108,12 @@ func TestHandleWebhookReturns404ForUnknownSecret(t *testing.T) {
 
 	webhookURL := "/webhook/unknown-secret"
 	payload := `{"ref": "refs/heads/main"}`
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		webhookURL,
 		strings.NewReader(payload),
 	)
-	request = addChiURLParams(
-		request,
-		map[string]string{paramSecret: "unknown-secret"},
-	)
+	request = addChiURLParams(request, map[string]string{"secret": "unknown-secret"})
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("X-Gitea-Event", "push")
 
@@ -1184,22 +1136,21 @@ func TestHandleWebhookProcessesValidWebhook(t *testing.T) {
 		app.CreateAppInput{
 			Name:    "webhook-test-app",
 			RepoURL: "git@example.com:user/repo.git",
-			Branch:  branchMain,
+			Branch:  "main",
 		},
 	)
 	require.NoError(t, createErr)
 
 	payload := `{"ref": "refs/heads/main", "after": "abc123"}`
 	webhookURL := "/webhook/" + createdApp.WebhookSecret
-	request := httptest.NewRequestWithContext(
-		t.Context(),
+	request := httptest.NewRequest(
 		http.MethodPost,
 		webhookURL,
 		strings.NewReader(payload),
 	)
 	request = addChiURLParams(
 		request,
-		map[string]string{paramSecret: createdApp.WebhookSecret},
+		map[string]string{"secret": createdApp.WebhookSecret},
 	)
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("X-Gitea-Event", "push")

internal/handlers/render_template_test.go

@@ -16,9 +16,7 @@ func TestRenderTemplateBuffersOutput(t *testing.T) {
 	testCtx := setupTestHandlers(t)
 
 	// The setup page is simple and has no DB dependencies
-	request := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/setup", nil,
-	)
+	request := httptest.NewRequest(http.MethodGet, "/setup", nil)
 	recorder := httptest.NewRecorder()
 
 	handler := testCtx.handlers.HandleSetupGET()
@@ -41,7 +39,7 @@ func TestDashboardRenderTemplateBuffersOutput(t *testing.T) {
 
 	testCtx := setupTestHandlers(t)
 
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	request := httptest.NewRequest(http.MethodGet, "/", nil)
 	recorder := httptest.NewRecorder()
 
 	handler := testCtx.handlers.HandleDashboard()
@@ -61,9 +59,7 @@ func TestLoginRenderTemplateBuffersOutput(t *testing.T) {
 
 	testCtx := setupTestHandlers(t)
 
-	request := httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, "/login", nil,
-	)
+	request := httptest.NewRequest(http.MethodGet, "/login", nil)
 	recorder := httptest.NewRecorder()
 
 	handler := testCtx.handlers.HandleLoginGET()

internal/handlers/repo_url_validation.go

@@ -11,17 +11,13 @@ import (
 var (
 	errRepoURLEmpty   = errors.New("repository URL must not be empty")
 	errRepoURLScheme  = errors.New("file:// URLs are not allowed for security reasons")
-	errRepoURLInvalid = errors.New(
-		"repository URL must use https://, http://, ssh://, git://, " +
-			"or git@host:path format",
-	)
-	errRepoURLNoHost = errors.New("repository URL must include a host")
-	errRepoURLNoPath = errors.New("repository URL must include a path")
+	errRepoURLInvalid = errors.New("repository URL must use https://, http://, ssh://, git://, or git@host:path format")
+	errRepoURLNoHost  = errors.New("repository URL must include a host")
+	errRepoURLNoPath  = errors.New("repository URL must include a path")
 )
 
-// scpLikeRepoRe matches SCP-like git URLs: git@host:path
-// (e.g. git@github.com:user/repo.git). Only the "git" user is allowed,
-// as that is the standard for SSH deploy keys.
+// scpLikeRepoRe matches SCP-like git URLs: git@host:path (e.g. git@github.com:user/repo.git).
+// Only the "git" user is allowed, as that is the standard for SSH deploy keys.
 var scpLikeRepoRe = regexp.MustCompile(`^git@[a-zA-Z0-9._-]+:.+$`)
 
 // allowedRepoSchemes lists the URL schemes accepted for repository URLs.
@@ -34,8 +30,7 @@ var allowedRepoSchemes = map[string]bool{
 	"git":   true,
 }
 
-// validateRepoURL checks that the given repository URL is valid and
-// uses an allowed scheme.
+// validateRepoURL checks that the given repository URL is valid and uses an allowed scheme.
 func validateRepoURL(repoURL string) error {
 	if strings.TrimSpace(repoURL) == "" {
 		return errRepoURLEmpty

internal/handlers/repo_url_validation_test.go

@@ -22,11 +22,7 @@ func TestValidateRepoURL(t *testing.T) {
 		{name: "SCP-like URL", url: "git@github.com:user/repo.git", wantErr: false},
 		{name: "SCP-like with dots", url: "git@git.example.com:org/repo.git", wantErr: false},
 		{name: "https without .git", url: "https://github.com/user/repo", wantErr: false},
-		{
-			name:    "https with port",
-			url:     "https://git.example.com:8443/user/repo.git",
-			wantErr: false,
-		},
+		{name: "https with port", url: "https://git.example.com:8443/user/repo.git", wantErr: false},
 
 		// Invalid URLs
 		{name: "empty string", url: "", wantErr: true},
@@ -41,22 +37,10 @@ func TestValidateRepoURL(t *testing.T) {
 		{name: "no path https", url: "https://github.com", wantErr: true},
 		{name: "no path https trailing slash", url: "https://github.com/", wantErr: true},
 		{name: "SCP-like non-git user", url: "root@github.com:user/repo.git", wantErr: true},
-		{
-			name:    "SCP-like arbitrary user",
-			url:     "admin@github.com:user/repo.git",
-			wantErr: true,
-		},
+		{name: "SCP-like arbitrary user", url: "admin@github.com:user/repo.git", wantErr: true},
 		{name: "path traversal SCP", url: "git@github.com:../../etc/passwd", wantErr: true},
-		{
-			name:    "path traversal https",
-			url:     "https://github.com/user/../../../etc/passwd",
-			wantErr: true,
-		},
-		{
-			name:    "path traversal in middle",
-			url:     "https://github.com/user/repo/../secret",
-			wantErr: true,
-		},
+		{name: "path traversal https", url: "https://github.com/user/../../../etc/passwd", wantErr: true},
+		{name: "path traversal in middle", url: "https://github.com/user/repo/../secret", wantErr: true},
 	}
 
 	for _, tc := range tests {

internal/handlers/resource_limits_test.go

@@ -1,195 +0,0 @@
-package handlers //nolint:testpackage // tests unexported parsing functions
-
-import (
-	"database/sql"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseOptionalFloat64(t *testing.T) {
-	t.Parallel()
-
-	t.Run("empty string returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("whitespace only returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("   ")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("valid float", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("0.5")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.InDelta(t, 0.5, result.Float64, 0.001)
-	})
-
-	t.Run("valid integer", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalFloat64("2")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.InDelta(t, 2.0, result.Float64, 0.001)
-	})
-
-	t.Run("negative value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalFloat64("-1")
-		require.Error(t, err)
-	})
-
-	t.Run("zero value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalFloat64("0")
-		require.Error(t, err)
-	})
-
-	t.Run("non-numeric rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalFloat64("abc")
-		require.Error(t, err)
-	})
-}
-
-func TestParseOptionalMemoryBytes(t *testing.T) { //nolint:funlen // table-driven test
-	t.Parallel()
-
-	t.Run("empty string returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("whitespace only returns invalid", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("   ")
-		require.NoError(t, err)
-		assert.False(t, result.Valid)
-	})
-
-	t.Run("plain bytes", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("536870912")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(536870912), result.Int64)
-	})
-
-	t.Run("megabytes suffix", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("256m")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(256*1024*1024), result.Int64)
-	})
-
-	t.Run("megabytes suffix uppercase", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("256M")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(256*1024*1024), result.Int64)
-	})
-
-	t.Run("gigabytes suffix", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("1g")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(1024*1024*1024), result.Int64)
-	})
-
-	t.Run("kilobytes suffix", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("512k")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(512*1024), result.Int64)
-	})
-
-	t.Run("fractional gigabytes", func(t *testing.T) {
-		t.Parallel()
-
-		result, err := parseOptionalMemoryBytes("1.5g")
-		require.NoError(t, err)
-		assert.True(t, result.Valid)
-		assert.Equal(t, int64(1.5*1024*1024*1024), result.Int64)
-	})
-
-	t.Run("negative value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("-256m")
-		require.Error(t, err)
-	})
-
-	t.Run("zero value rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("0")
-		require.Error(t, err)
-	})
-
-	t.Run("invalid string rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("abc")
-		require.Error(t, err)
-	})
-
-	t.Run("negative plain bytes rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := parseOptionalMemoryBytes("-100")
-		require.Error(t, err)
-	})
-}
-
-func TestAppResourceLimitsRoundTrip(t *testing.T) {
-	t.Parallel()
-
-	// Test that parsing and formatting are consistent
-	tests := []struct {
-		input    string
-		expected sql.NullInt64
-		format   string
-	}{
-		{"256m", sql.NullInt64{Int64: 256 * 1024 * 1024, Valid: true}, "256m"},
-		{"1g", sql.NullInt64{Int64: 1024 * 1024 * 1024, Valid: true}, "1g"},
-		{"512k", sql.NullInt64{Int64: 512 * 1024, Valid: true}, "512k"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			t.Parallel()
-
-			result, err := parseOptionalMemoryBytes(tt.input)
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}

internal/handlers/sanitize.go

@@ -5,11 +5,8 @@ import (
 	"strings"
 )
 
-// ansiEscapePattern matches ANSI escape sequences (CSI, OSC, and
-// single-character escapes).
-var ansiEscapePattern = regexp.MustCompile(
-	`(\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[^[\]])`,
-)
+// ansiEscapePattern matches ANSI escape sequences (CSI, OSC, and single-character escapes).
+var ansiEscapePattern = regexp.MustCompile(`(\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[^[\]])`)
 
 // SanitizeLogs strips ANSI escape sequences and non-printable control characters
 // from container log output. Newlines (\n), carriage returns (\r), and tabs (\t)

internal/handlers/sanitize_test.go

@@ -6,7 +6,7 @@ import (
 	"sneak.berlin/go/upaas/internal/handlers"
 )
 
-func TestSanitizeLogs(t *testing.T) {
+func TestSanitizeLogs(t *testing.T) { //nolint:funlen // table-driven tests
 	t.Parallel()
 
 	tests := []struct {

internal/handlers/setup.go

@@ -55,8 +55,8 @@ func (h *Handlers) renderSetupError(
 	errorMsg string,
 ) {
 	data := h.addGlobals(map[string]any{
-		"Username":   username,
-		dataKeyError: errorMsg,
+		"Username": username,
+		"Error":    errorMsg,
 	}, request)
 	h.renderTemplate(writer, tmpl, "setup.html", data)
 }

internal/handlers/webhook.go

@@ -7,14 +7,12 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"sneak.berlin/go/upaas/internal/models"
-	"sneak.berlin/go/upaas/internal/service/webhook"
 )
 
 // maxWebhookBodySize is the maximum allowed size of a webhook request body (1MB).
 const maxWebhookBodySize = 1 << 20
 
-// HandleWebhook handles incoming webhooks from Gitea, GitHub, or GitLab.
-// The webhook source is auto-detected from HTTP headers.
+// HandleWebhook handles incoming Gitea webhooks.
 func (h *Handlers) HandleWebhook() http.HandlerFunc {
 	return func(writer http.ResponseWriter, request *http.Request) {
 		secret := chi.URLParam(request, "secret")
@@ -52,17 +50,16 @@ func (h *Handlers) HandleWebhook() http.HandlerFunc {
 			return
 		}
 
-		// Auto-detect webhook source from headers
-		source := webhook.DetectWebhookSource(request.Header)
-
-		// Extract event type based on detected source
-		eventType := webhook.DetectEventType(request.Header, source)
+		// Get event type from header
+		eventType := request.Header.Get("X-Gitea-Event")
+		if eventType == "" {
+			eventType = "push"
+		}
 
 		// Process webhook
 		webhookErr := h.webhook.HandleWebhook(
 			request.Context(),
 			application,
-			source,
 			eventType,
 			body,
 		)

internal/handlers/webhook_events.go

@@ -47,8 +47,8 @@ func (h *Handlers) HandleAppWebhookEvents() http.HandlerFunc {
 		}
 
 		data := h.addGlobals(map[string]any{
-			dataKeyApp: application,
-			"Events":   events,
+			"App":    application,
+			"Events": events,
 		}, request)
 
 		h.renderTemplate(writer, tmpl, "webhook_events.html", data)

internal/middleware/cors_test.go

@@ -24,30 +24,21 @@ func newCORSTestMiddleware(corsOrigins string) *Middleware {
 	}
 }
 
-// assertNoCORSHeaders runs a request with the given Origin header through
-// CORS middleware configured with corsOrigins and asserts that no
-// Access-Control-Allow-Origin header is set.
-func assertNoCORSHeaders(t *testing.T, corsOrigins, origin, msg string) {
-	t.Helper()
+func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
+	t.Parallel()
 
-	m := newCORSTestMiddleware(corsOrigins)
+	m := newCORSTestMiddleware("")
 	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
-	req.Header.Set("Origin", origin)
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "https://evil.com")
 
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
 
-	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"), msg)
-}
-
-func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
-	t.Parallel()
-
-	assertNoCORSHeaders(t, "", "https://evil.com",
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
 		"expected no CORS headers when no origins configured")
 }
 
@@ -59,7 +50,7 @@ func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	req.Header.Set("Origin", "https://app.example.com")
 
 	rec := httptest.NewRecorder()
@@ -74,6 +65,17 @@ func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
 func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
 	t.Parallel()
 
-	assertNoCORSHeaders(t, "https://app.example.com", "https://evil.com",
+	m := newCORSTestMiddleware("https://app.example.com")
+	handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "https://evil.com")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
 		"expected no CORS headers for non-matching origin")
 }

internal/middleware/middleware.go

@@ -370,9 +370,8 @@ func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
 	}
 }
 
-// APISessionAuth returns middleware that requires session authentication
-// for API routes. Unlike SessionAuth, it returns JSON 401 responses instead
-// of redirecting to /login.
+// APISessionAuth returns middleware that requires session authentication for API routes.
+// Unlike SessionAuth, it returns JSON 401 responses instead of redirecting to /login.
 func (m *Middleware) APISessionAuth() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(

internal/middleware/ratelimit_test.go

@@ -30,15 +30,13 @@ func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 
 	mw := newTestMiddleware(t)
 
-	handler := mw.LoginRateLimit()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		},
-	))
+	handler := mw.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
 
 	// First 5 requests should succeed (burst)
 	for i := range 5 {
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+		req := httptest.NewRequest(http.MethodPost, "/login", nil)
 		req.RemoteAddr = "192.168.1.1:12345"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
@@ -46,12 +44,11 @@ func TestLoginRateLimitAllowsUpToBurst(t *testing.T) {
 	}
 
 	// 6th request should be rate limited
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req := httptest.NewRequest(http.MethodPost, "/login", nil)
 	req.RemoteAddr = "192.168.1.1:12345"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
-	assert.Equal(t, http.StatusTooManyRequests, rec.Code,
-		"6th request should be rate limited")
+	assert.Equal(t, http.StatusTooManyRequests, rec.Code, "6th request should be rate limited")
 }
 
 //nolint:paralleltest // mutates global loginLimiter
@@ -60,29 +57,27 @@ func TestLoginRateLimitIsolatesIPs(t *testing.T) {
 
 	mw := newTestMiddleware(t)
 
-	handler := mw.LoginRateLimit()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		},
-	))
+	handler := mw.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
 
 	// Exhaust IP1's budget
 	for range 5 {
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
-		req.RemoteAddr = testProxyAddr
+		req := httptest.NewRequest(http.MethodPost, "/login", nil)
+		req.RemoteAddr = "10.0.0.1:1234"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
 	}
 
 	// IP1 should be blocked
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
-	req.RemoteAddr = testProxyAddr
+	req := httptest.NewRequest(http.MethodPost, "/login", nil)
+	req.RemoteAddr = "10.0.0.1:1234"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
 	assert.Equal(t, http.StatusTooManyRequests, rec.Code)
 
 	// IP2 should still work
-	req2 := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req2 := httptest.NewRequest(http.MethodPost, "/login", nil)
 	req2.RemoteAddr = "10.0.0.2:1234"
 	rec2 := httptest.NewRecorder()
 	handler.ServeHTTP(rec2, req2)
@@ -95,28 +90,25 @@ func TestLoginRateLimitReturns429Body(t *testing.T) {
 
 	mw := newTestMiddleware(t)
 
-	handler := mw.LoginRateLimit()(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusOK)
-		},
-	))
+	handler := mw.LoginRateLimit()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
 
 	// Exhaust burst
 	for range 5 {
-		req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+		req := httptest.NewRequest(http.MethodPost, "/login", nil)
 		req.RemoteAddr = "172.16.0.1:5555"
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
 	}
 
-	req := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/login", nil)
+	req := httptest.NewRequest(http.MethodPost, "/login", nil)
 	req.RemoteAddr = "172.16.0.1:5555"
 	rec := httptest.NewRecorder()
 	handler.ServeHTTP(rec, req)
 	assert.Equal(t, http.StatusTooManyRequests, rec.Code)
 	assert.Contains(t, rec.Body.String(), "Too Many Requests")
-	assert.NotEmpty(t, rec.Header().Get("Retry-After"),
-		"should include Retry-After header")
+	assert.NotEmpty(t, rec.Header().Get("Retry-After"), "should include Retry-After header")
 }
 
 func TestIPLimiterEvictsStaleEntries(t *testing.T) {

internal/middleware/realip_test.go

@@ -7,16 +7,6 @@ import (
 	"testing"
 )
 
-// Shared test addresses (also used by ratelimit_test.go).
-const (
-	testProxyAddr   = "10.0.0.1:1234"
-	testRealIP      = "203.0.113.5"
-	testXFFIP       = "198.51.100.1"
-	testPrivateIP   = "192.168.1.1"
-	testPublicIP    = "93.184.216.34"
-	testPublicDNSIP = "8.8.8.8"
-)
-
 func TestRealIP(t *testing.T) { //nolint:funlen // table-driven test
 	t.Parallel()
 
@@ -30,63 +20,63 @@ func TestRealIP(t *testing.T) { //nolint:funlen // table-driven test
 		// === Trusted proxy (RFC1918 / loopback) — headers ARE honoured ===
 		{
 			name:       "trusted: X-Real-IP from 10.x",
-			remoteAddr: testProxyAddr,
-			xRealIP:    testRealIP,
+			remoteAddr: "10.0.0.1:1234",
+			xRealIP:    "203.0.113.5",
 			xff:        "198.51.100.1, 10.0.0.1",
-			want:       testRealIP,
+			want:       "203.0.113.5",
 		},
 		{
 			name:       "trusted: XFF from 10.x when no X-Real-IP",
-			remoteAddr: testProxyAddr,
+			remoteAddr: "10.0.0.1:1234",
 			xff:        "198.51.100.1, 10.0.0.1",
-			want:       testXFFIP,
+			want:       "198.51.100.1",
 		},
 		{
 			name:       "trusted: XFF single IP from 10.x",
-			remoteAddr: testProxyAddr,
+			remoteAddr: "10.0.0.1:1234",
 			xff:        "203.0.113.10",
 			want:       "203.0.113.10",
 		},
 		{
 			name:       "trusted: falls back to RemoteAddr (192.168.x)",
 			remoteAddr: "192.168.1.1:5678",
-			want:       testPrivateIP,
+			want:       "192.168.1.1",
 		},
 		{
 			name:       "trusted: RemoteAddr without port",
-			remoteAddr: testPrivateIP,
-			want:       testPrivateIP,
+			remoteAddr: "192.168.1.1",
+			want:       "192.168.1.1",
 		},
 		{
 			name:       "trusted: X-Real-IP with whitespace from 10.x",
-			remoteAddr: testProxyAddr,
+			remoteAddr: "10.0.0.1:1234",
 			xRealIP:    "  203.0.113.5  ",
-			want:       testRealIP,
+			want:       "203.0.113.5",
 		},
 		{
 			name:       "trusted: XFF with whitespace from 10.x",
-			remoteAddr: testProxyAddr,
+			remoteAddr: "10.0.0.1:1234",
 			xff:        "  198.51.100.1 , 10.0.0.1",
-			want:       testXFFIP,
+			want:       "198.51.100.1",
 		},
 		{
 			name:       "trusted: empty X-Real-IP falls through to XFF from 10.x",
-			remoteAddr: testProxyAddr,
+			remoteAddr: "10.0.0.1:1234",
 			xRealIP:    "  ",
-			xff:        testXFFIP,
-			want:       testXFFIP,
+			xff:        "198.51.100.1",
+			want:       "198.51.100.1",
 		},
 		{
 			name:       "trusted: loopback honours X-Real-IP",
 			remoteAddr: "127.0.0.1:9999",
-			xRealIP:    testPublicIP,
-			want:       testPublicIP,
+			xRealIP:    "93.184.216.34",
+			want:       "93.184.216.34",
 		},
 		{
 			name:       "trusted: 172.16.x honours XFF",
 			remoteAddr: "172.16.0.1:4321",
-			xff:        testPublicDNSIP,
-			want:       testPublicDNSIP,
+			xff:        "8.8.8.8",
+			want:       "8.8.8.8",
 		},
 
 		// === Untrusted proxy (public IP) — headers IGNORED, use RemoteAddr ===
@@ -107,17 +97,17 @@ func TestRealIP(t *testing.T) { //nolint:funlen // table-driven test
 			remoteAddr: "8.8.8.8:443",
 			xRealIP:    "1.2.3.4",
 			xff:        "5.6.7.8",
-			want:       testPublicDNSIP,
+			want:       "8.8.8.8",
 		},
 		{
 			name:       "untrusted: no headers, public RemoteAddr",
 			remoteAddr: "93.184.216.34:8080",
-			want:       testPublicIP,
+			want:       "93.184.216.34",
 		},
 		{
 			name:       "untrusted: public RemoteAddr without port",
-			remoteAddr: testPublicIP,
-			want:       testPublicIP,
+			remoteAddr: "93.184.216.34",
+			want:       "93.184.216.34",
 		},
 	}
 
@@ -149,9 +139,7 @@ func TestIsTrustedProxy(t *testing.T) {
 
 	trusted := []string{"10.0.0.1", "10.255.255.255", "172.16.0.1", "172.31.255.255",
 		"192.168.0.1", "192.168.255.255", "127.0.0.1", "127.255.255.255", "::1"}
-	untrusted := []string{
-		testPublicDNSIP, "203.0.113.1", "172.32.0.1", "11.0.0.1", "2001:db8::1",
-	}
+	untrusted := []string{"8.8.8.8", "203.0.113.1", "172.32.0.1", "11.0.0.1", "2001:db8::1"}
 
 	for _, addr := range trusted {
 		ip := net.ParseIP(addr)

internal/models/app.go

@@ -14,8 +14,7 @@ import (
 const appColumns = `id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, cpu_limit, memory_limit,
-			created_at, updated_at`
+			previous_image_id, created_at, updated_at`
 
 // AppStatus represents the status of an app.
 type AppStatus string
@@ -48,8 +47,6 @@ type App struct {
 	DockerNetwork     sql.NullString
 	NtfyTopic         sql.NullString
 	SlackWebhook      sql.NullString
-	CPULimit          sql.NullFloat64
-	MemoryLimit       sql.NullInt64
 	CreatedAt         time.Time
 	UpdatedAt         time.Time
 }
@@ -122,6 +119,11 @@ func (a *App) GetWebhookEvents(
 	return FindWebhookEventsByAppID(ctx, a.db, a.ID, limit)
 }
 
+// GetRegistryCredentials returns all registry credentials for the app.
+func (a *App) GetRegistryCredentials(ctx context.Context) ([]*RegistryCredential, error) {
+	return FindRegistryCredentialsByAppID(ctx, a.db, a.ID)
+}
+
 func (a *App) exists(ctx context.Context) bool {
 	if a.ID == "" {
 		return false
@@ -145,14 +147,14 @@ func (a *App) insert(ctx context.Context) error {
 			id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, cpu_limit, memory_limit
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			previous_image_id
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 
 	_, err := a.db.Exec(ctx, query,
 		a.ID, a.Name, a.RepoURL, a.Branch, a.DockerfilePath, a.WebhookSecret,
 		a.SSHPrivateKey, a.SSHPublicKey, a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook, a.WebhookSecretHash,
-		a.PreviousImageID, a.CPULimit, a.MemoryLimit,
+		a.PreviousImageID,
 	)
 	if err != nil {
 		return err
@@ -168,7 +170,6 @@ func (a *App) update(ctx context.Context) error {
 			image_id = ?, status = ?,
 			docker_network = ?, ntfy_topic = ?, slack_webhook = ?,
 			previous_image_id = ?,
-			cpu_limit = ?, memory_limit = ?,
 			updated_at = CURRENT_TIMESTAMP
 		WHERE id = ?`
 
@@ -177,7 +178,6 @@ func (a *App) update(ctx context.Context) error {
 		a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook,
 		a.PreviousImageID,
-		a.CPULimit, a.MemoryLimit,
 		a.ID,
 	)
 
@@ -193,7 +193,6 @@ func (a *App) scan(row *sql.Row) error {
 		&a.DockerNetwork, &a.NtfyTopic, &a.SlackWebhook,
 		&a.WebhookSecretHash,
 		&a.PreviousImageID,
-		&a.CPULimit, &a.MemoryLimit,
 		&a.CreatedAt, &a.UpdatedAt,
 	)
 }
@@ -212,7 +211,6 @@ func scanApps(appDB *database.Database, rows *sql.Rows) ([]*App, error) {
 			&app.DockerNetwork, &app.NtfyTopic, &app.SlackWebhook,
 			&app.WebhookSecretHash,
 			&app.PreviousImageID,
-			&app.CPULimit, &app.MemoryLimit,
 			&app.CreatedAt, &app.UpdatedAt,
 		)
 		if scanErr != nil {

internal/models/env_var.go

@@ -93,41 +93,6 @@ func FindEnvVar(
 	return envVar, nil
 }
 
-// findAllByAppID loads all rows for an app, scanning each row into a
-// new model created by newFn. entity names the model in error messages.
-func findAllByAppID[T interface{ scanDest() []any }](
-	ctx context.Context,
-	db *database.Database,
-	query, appID, entity string,
-	newFn func(*database.Database) T,
-) ([]T, error) {
-	rows, err := db.Query(ctx, query, appID)
-	if err != nil {
-		return nil, fmt.Errorf("querying %s by app: %w", entity, err)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var items []T
-
-	for rows.Next() {
-		item := newFn(db)
-
-		scanErr := rows.Scan(item.scanDest()...)
-		if scanErr != nil {
-			return nil, scanErr
-		}
-
-		items = append(items, item)
-	}
-
-	return items, rows.Err()
-}
-
-func (e *EnvVar) scanDest() []any {
-	return []any{&e.ID, &e.AppID, &e.Key, &e.Value}
-}
-
 // FindEnvVarsByAppID finds all env vars for an app.
 func FindEnvVarsByAppID(
 	ctx context.Context,
@@ -138,7 +103,29 @@ func FindEnvVarsByAppID(
 		SELECT id, app_id, key, value FROM app_env_vars
 		WHERE app_id = ? ORDER BY key`
 
-	return findAllByAppID(ctx, db, query, appID, "env vars", NewEnvVar)
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying env vars by app: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var envVars []*EnvVar
+
+	for rows.Next() {
+		envVar := NewEnvVar(db)
+
+		scanErr := rows.Scan(
+			&envVar.ID, &envVar.AppID, &envVar.Key, &envVar.Value,
+		)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		envVars = append(envVars, envVar)
+	}
+
+	return envVars, rows.Err()
 }
 
 // EnvVarPair is a key-value pair for bulk env var operations.

internal/models/label.go

@@ -93,10 +93,6 @@ func FindLabel(
 	return label, nil
 }
 
-func (l *Label) scanDest() []any {
-	return []any{&l.ID, &l.AppID, &l.Key, &l.Value}
-}
-
 // FindLabelsByAppID finds all labels for an app.
 func FindLabelsByAppID(
 	ctx context.Context,
@@ -107,7 +103,27 @@ func FindLabelsByAppID(
 		SELECT id, app_id, key, value FROM app_labels
 		WHERE app_id = ? ORDER BY key`
 
-	return findAllByAppID(ctx, db, query, appID, "labels", NewLabel)
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying labels by app: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var labels []*Label
+
+	for rows.Next() {
+		label := NewLabel(db)
+
+		scanErr := rows.Scan(&label.ID, &label.AppID, &label.Key, &label.Value)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		labels = append(labels, label)
+	}
+
+	return labels, rows.Err()
 }
 
 // DeleteLabelsByAppID deletes all labels for an app.

internal/models/models_test.go

@@ -23,6 +23,7 @@ const (
 	testBranch    = "main"
 	testValue     = "value"
 	testEventType = "push"
+	testUser      = "user"
 )
 
 func setupTestDB(t *testing.T) (*database.Database, func()) {
@@ -317,54 +318,33 @@ func TestAllApps(t *testing.T) {
 
 // EnvVar Tests.
 
-// testKVCreateAndFind exercises the create-and-find round trip shared
-// by key-value models (env vars, labels).
-func testKVCreateAndFind[T any](
-	t *testing.T,
-	wantKey string,
-	create func(db *database.Database, appID string) (int64, error),
-	find func(context.Context, *database.Database, string) ([]T, error),
-	keyOf func(T) string,
-) {
-	t.Helper()
-
-	testDB, cleanup := setupTestDB(t)
-	defer cleanup()
-
-	// Create app first.
-	app := createTestApp(t, testDB)
-
-	id, err := create(testDB, app.ID)
-	require.NoError(t, err)
-	assert.NotZero(t, id)
-
-	found, err := find(context.Background(), testDB, app.ID)
-	require.NoError(t, err)
-	require.Len(t, found, 1)
-	assert.Equal(t, wantKey, keyOf(found[0]))
-}
-
-func saveTestEnvVar(db *database.Database, appID string) (int64, error) {
-	envVar := models.NewEnvVar(db)
-	envVar.AppID = appID
-	envVar.Key = "DATABASE_URL"
-	envVar.Value = "postgres://localhost/db"
-
-	err := envVar.Save(context.Background())
-
-	return envVar.ID, err
-}
-
 func TestEnvVarCRUD(t *testing.T) {
 	t.Parallel()
 
 	t.Run("creates and finds env vars", func(t *testing.T) {
 		t.Parallel()
 
-		testKVCreateAndFind(t, "DATABASE_URL", saveTestEnvVar,
-			models.FindEnvVarsByAppID,
-			func(e *models.EnvVar) string { return e.Key },
+		testDB, cleanup := setupTestDB(t)
+		defer cleanup()
+
+		// Create app first.
+		app := createTestApp(t, testDB)
+
+		envVar := models.NewEnvVar(testDB)
+		envVar.AppID = app.ID
+		envVar.Key = "DATABASE_URL"
+		envVar.Value = "postgres://localhost/db"
+
+		err := envVar.Save(context.Background())
+		require.NoError(t, err)
+		assert.NotZero(t, envVar.ID)
+
+		envVars, err := models.FindEnvVarsByAppID(
+			context.Background(), testDB, app.ID,
 		)
+		require.NoError(t, err)
+		require.Len(t, envVars, 1)
+		assert.Equal(t, "DATABASE_URL", envVars[0].Key)
 	})
 
 	t.Run("deletes env var", func(t *testing.T) {
@@ -396,27 +376,32 @@ func TestEnvVarCRUD(t *testing.T) {
 
 // Label Tests.
 
-func saveTestLabel(db *database.Database, appID string) (int64, error) {
-	label := models.NewLabel(db)
-	label.AppID = appID
-	label.Key = "traefik.enable"
-	label.Value = "true"
-
-	err := label.Save(context.Background())
-
-	return label.ID, err
-}
-
 func TestLabelCRUD(t *testing.T) {
 	t.Parallel()
 
 	t.Run("creates and finds labels", func(t *testing.T) {
 		t.Parallel()
 
-		testKVCreateAndFind(t, "traefik.enable", saveTestLabel,
-			models.FindLabelsByAppID,
-			func(l *models.Label) string { return l.Key },
+		testDB, cleanup := setupTestDB(t)
+		defer cleanup()
+
+		app := createTestApp(t, testDB)
+
+		label := models.NewLabel(testDB)
+		label.AppID = app.ID
+		label.Key = "traefik.enable"
+		label.Value = "true"
+
+		err := label.Save(context.Background())
+		require.NoError(t, err)
+		assert.NotZero(t, label.ID)
+
+		labels, err := models.FindLabelsByAppID(
+			context.Background(), testDB, app.ID,
 		)
+		require.NoError(t, err)
+		require.Len(t, labels, 1)
+		assert.Equal(t, "traefik.enable", labels[0].Key)
 	})
 }
 
@@ -585,9 +570,7 @@ func TestDeploymentFindByAppID(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	deployments, err := models.FindDeploymentsByAppID(
-		context.Background(), testDB, app.ID, 3,
-	)
+	deployments, err := models.FindDeploymentsByAppID(context.Background(), testDB, app.ID, 3)
 	require.NoError(t, err)
 	assert.Len(t, deployments, 3)
 }
@@ -722,8 +705,130 @@ func TestAppGetWebhookEvents(t *testing.T) {
 	assert.Len(t, events, 1)
 }
 
+// RegistryCredential Tests.
+
+func TestRegistryCredentialCreateAndFind(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "registry.example.com"
+	cred.Username = "myuser"
+	cred.Password = "mypassword"
+
+	err := cred.Save(context.Background())
+	require.NoError(t, err)
+	assert.NotZero(t, cred.ID)
+
+	creds, err := models.FindRegistryCredentialsByAppID(
+		context.Background(), testDB, app.ID,
+	)
+	require.NoError(t, err)
+	require.Len(t, creds, 1)
+	assert.Equal(t, "registry.example.com", creds[0].Registry)
+	assert.Equal(t, "myuser", creds[0].Username)
+	assert.Equal(t, "mypassword", creds[0].Password)
+}
+
+func TestRegistryCredentialUpdate(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "old.registry.com"
+	cred.Username = "olduser"
+	cred.Password = "oldpass"
+
+	err := cred.Save(context.Background())
+	require.NoError(t, err)
+
+	cred.Registry = "new.registry.com"
+	cred.Username = "newuser"
+	cred.Password = "newpass"
+
+	err = cred.Save(context.Background())
+	require.NoError(t, err)
+
+	found, err := models.FindRegistryCredential(context.Background(), testDB, cred.ID)
+	require.NoError(t, err)
+	require.NotNil(t, found)
+	assert.Equal(t, "new.registry.com", found.Registry)
+	assert.Equal(t, "newuser", found.Username)
+	assert.Equal(t, "newpass", found.Password)
+}
+
+func TestRegistryCredentialDelete(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "delete.registry.com"
+	cred.Username = testUser
+	cred.Password = "pass"
+
+	err := cred.Save(context.Background())
+	require.NoError(t, err)
+
+	err = cred.Delete(context.Background())
+	require.NoError(t, err)
+
+	creds, err := models.FindRegistryCredentialsByAppID(
+		context.Background(), testDB, app.ID,
+	)
+	require.NoError(t, err)
+	assert.Empty(t, creds)
+}
+
+func TestRegistryCredentialFindByIDNotFound(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	found, err := models.FindRegistryCredential(context.Background(), testDB, 99999)
+	require.NoError(t, err)
+	assert.Nil(t, found)
+}
+
+func TestAppGetRegistryCredentials(t *testing.T) {
+	t.Parallel()
+
+	testDB, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	app := createTestApp(t, testDB)
+
+	cred := models.NewRegistryCredential(testDB)
+	cred.AppID = app.ID
+	cred.Registry = "ghcr.io"
+	cred.Username = testUser
+	cred.Password = "token"
+	_ = cred.Save(context.Background())
+
+	creds, err := app.GetRegistryCredentials(context.Background())
+	require.NoError(t, err)
+	assert.Len(t, creds, 1)
+	assert.Equal(t, "ghcr.io", creds[0].Registry)
+}
+
 // Cascade Delete Tests.
 
+//nolint:funlen // Test function with many assertions - acceptable for integration tests
 func TestCascadeDelete(t *testing.T) {
 	t.Parallel()
 
@@ -766,6 +871,13 @@ func TestCascadeDelete(t *testing.T) {
 		deploy.Status = models.DeploymentStatusSuccess
 		_ = deploy.Save(context.Background())
 
+		regCred := models.NewRegistryCredential(testDB)
+		regCred.AppID = app.ID
+		regCred.Registry = "registry.example.com"
+		regCred.Username = testUser
+		regCred.Password = "pass"
+		_ = regCred.Save(context.Background())
+
 		// Delete app.
 		err := app.Delete(context.Background())
 		require.NoError(t, err)
@@ -795,97 +907,11 @@ func TestCascadeDelete(t *testing.T) {
 			context.Background(), testDB, app.ID, 10,
 		)
 		assert.Empty(t, deployments)
-	})
-}
 
-// Resource Limits Tests.
-
-//nolint:funlen // integration test with multiple subtests
-func TestAppResourceLimits(t *testing.T) {
-	t.Parallel()
-
-	t.Run("saves and loads CPU limit", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
-
-		err := app.Save(context.Background())
-		require.NoError(t, err)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.True(t, found.CPULimit.Valid)
-		assert.InDelta(t, 0.5, found.CPULimit.Float64, 0.001)
-	})
-
-	t.Run("saves and loads memory limit", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
-
-		err := app.Save(context.Background())
-		require.NoError(t, err)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.True(t, found.MemoryLimit.Valid)
-		assert.Equal(t, int64(536870912), found.MemoryLimit.Int64)
-	})
-
-	t.Run("null limits by default", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.False(t, found.CPULimit.Valid)
-		assert.False(t, found.MemoryLimit.Valid)
-	})
-
-	t.Run("clears limits when set to null", func(t *testing.T) {
-		t.Parallel()
-
-		testDB, cleanup := setupTestDB(t)
-		defer cleanup()
-
-		app := createTestApp(t, testDB)
-
-		// Set limits
-		app.CPULimit = sql.NullFloat64{Float64: 1.0, Valid: true}
-		app.MemoryLimit = sql.NullInt64{Int64: 1073741824, Valid: true} // 1g
-
-		err := app.Save(context.Background())
-		require.NoError(t, err)
-
-		// Clear limits
-		app.CPULimit = sql.NullFloat64{}
-		app.MemoryLimit = sql.NullInt64{}
-
-		err = app.Save(context.Background())
-		require.NoError(t, err)
-
-		found, err := models.FindApp(context.Background(), testDB, app.ID)
-		require.NoError(t, err)
-		require.NotNil(t, found)
-		assert.False(t, found.CPULimit.Valid)
-		assert.False(t, found.MemoryLimit.Valid)
+		regCreds, _ := models.FindRegistryCredentialsByAppID(
+			context.Background(), testDB, app.ID,
+		)
+		assert.Empty(t, regCreds)
 	})
 }
 

internal/models/port.go

@@ -112,12 +112,6 @@ func FindPort(
 	return port, nil
 }
 
-func (p *Port) scanDest() []any {
-	return []any{
-		&p.ID, &p.AppID, &p.HostPort, &p.ContainerPort, &p.Protocol,
-	}
-}
-
 // FindPortsByAppID finds all ports for an app.
 func FindPortsByAppID(
 	ctx context.Context,
@@ -128,7 +122,30 @@ func FindPortsByAppID(
 		SELECT id, app_id, host_port, container_port, protocol
 		FROM app_ports WHERE app_id = ? ORDER BY host_port`
 
-	return findAllByAppID(ctx, db, query, appID, "ports", NewPort)
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying ports by app: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var ports []*Port
+
+	for rows.Next() {
+		port := NewPort(db)
+
+		scanErr := rows.Scan(
+			&port.ID, &port.AppID, &port.HostPort,
+			&port.ContainerPort, &port.Protocol,
+		)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		ports = append(ports, port)
+	}
+
+	return ports, rows.Err()
 }
 
 // DeletePortsByAppID deletes all ports for an app.

internal/models/registry_credential.go

@@ -0,0 +1,130 @@
+package models
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"sneak.berlin/go/upaas/internal/database"
+)
+
+// RegistryCredential represents authentication credentials for a private Docker registry.
+type RegistryCredential struct {
+	db *database.Database
+
+	ID       int64
+	AppID    string
+	Registry string
+	Username string
+	Password string //nolint:gosec // credential field required for registry auth
+}
+
+// NewRegistryCredential creates a new RegistryCredential with a database reference.
+func NewRegistryCredential(db *database.Database) *RegistryCredential {
+	return &RegistryCredential{db: db}
+}
+
+// Save inserts or updates the registry credential in the database.
+func (r *RegistryCredential) Save(ctx context.Context) error {
+	if r.ID == 0 {
+		return r.insert(ctx)
+	}
+
+	return r.update(ctx)
+}
+
+// Delete removes the registry credential from the database.
+func (r *RegistryCredential) Delete(ctx context.Context) error {
+	_, err := r.db.Exec(ctx, "DELETE FROM registry_credentials WHERE id = ?", r.ID)
+
+	return err
+}
+
+func (r *RegistryCredential) insert(ctx context.Context) error {
+	query := "INSERT INTO registry_credentials (app_id, registry, username, password) VALUES (?, ?, ?, ?)"
+
+	result, err := r.db.Exec(ctx, query, r.AppID, r.Registry, r.Username, r.Password)
+	if err != nil {
+		return err
+	}
+
+	id, err := result.LastInsertId()
+	if err != nil {
+		return err
+	}
+
+	r.ID = id
+
+	return nil
+}
+
+func (r *RegistryCredential) update(ctx context.Context) error {
+	query := "UPDATE registry_credentials SET registry = ?, username = ?, password = ? WHERE id = ?"
+
+	_, err := r.db.Exec(ctx, query, r.Registry, r.Username, r.Password, r.ID)
+
+	return err
+}
+
+// FindRegistryCredential finds a registry credential by ID.
+//
+//nolint:nilnil // returning nil,nil is idiomatic for "not found" in Active Record
+func FindRegistryCredential(
+	ctx context.Context,
+	db *database.Database,
+	id int64,
+) (*RegistryCredential, error) {
+	cred := NewRegistryCredential(db)
+
+	row := db.QueryRow(ctx,
+		"SELECT id, app_id, registry, username, password FROM registry_credentials WHERE id = ?",
+		id,
+	)
+
+	err := row.Scan(&cred.ID, &cred.AppID, &cred.Registry, &cred.Username, &cred.Password)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("scanning registry credential: %w", err)
+	}
+
+	return cred, nil
+}
+
+// FindRegistryCredentialsByAppID finds all registry credentials for an app.
+func FindRegistryCredentialsByAppID(
+	ctx context.Context,
+	db *database.Database,
+	appID string,
+) ([]*RegistryCredential, error) {
+	query := `
+		SELECT id, app_id, registry, username, password FROM registry_credentials
+		WHERE app_id = ? ORDER BY registry`
+
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying registry credentials by app: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var creds []*RegistryCredential
+
+	for rows.Next() {
+		cred := NewRegistryCredential(db)
+
+		scanErr := rows.Scan(
+			&cred.ID, &cred.AppID, &cred.Registry, &cred.Username, &cred.Password,
+		)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		creds = append(creds, cred)
+	}
+
+	return creds, rows.Err()
+}

internal/models/volume.go

@@ -103,12 +103,6 @@ func FindVolume(
 	return vol, nil
 }
 
-func (v *Volume) scanDest() []any {
-	return []any{
-		&v.ID, &v.AppID, &v.HostPath, &v.ContainerPath, &v.ReadOnly,
-	}
-}
-
 // FindVolumesByAppID finds all volumes for an app.
 func FindVolumesByAppID(
 	ctx context.Context,
@@ -119,7 +113,30 @@ func FindVolumesByAppID(
 		SELECT id, app_id, host_path, container_path, readonly
 		FROM app_volumes WHERE app_id = ? ORDER BY container_path`
 
-	return findAllByAppID(ctx, db, query, appID, "volumes", NewVolume)
+	rows, err := db.Query(ctx, query, appID)
+	if err != nil {
+		return nil, fmt.Errorf("querying volumes by app: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	var volumes []*Volume
+
+	for rows.Next() {
+		vol := NewVolume(db)
+
+		scanErr := rows.Scan(
+			&vol.ID, &vol.AppID, &vol.HostPath,
+			&vol.ContainerPath, &vol.ReadOnly,
+		)
+		if scanErr != nil {
+			return nil, scanErr
+		}
+
+		volumes = append(volumes, vol)
+	}
+
+	return volumes, rows.Err()
 }
 
 // DeleteVolumesByAppID deletes all volumes for an app.

internal/server/routes.go

@@ -71,14 +71,8 @@ func (s *Server) SetupRoutes() {
 			r.Post("/apps/{id}/deployments/cancel", s.handlers.HandleCancelDeploy())
 			r.Get("/apps/{id}/deployments", s.handlers.HandleAppDeployments())
 			r.Get("/apps/{id}/webhooks", s.handlers.HandleAppWebhookEvents())
-			r.Get(
-				"/apps/{id}/deployments/{deploymentID}/logs",
-				s.handlers.HandleDeploymentLogsAPI(),
-			)
-			r.Get(
-				"/apps/{id}/deployments/{deploymentID}/download",
-				s.handlers.HandleDeploymentLogDownload(),
-			)
+			r.Get("/apps/{id}/deployments/{deploymentID}/logs", s.handlers.HandleDeploymentLogsAPI())
+			r.Get("/apps/{id}/deployments/{deploymentID}/download", s.handlers.HandleDeploymentLogDownload())
 			r.Get("/apps/{id}/logs", s.handlers.HandleAppLogs())
 			r.Get("/apps/{id}/container-logs", s.handlers.HandleContainerLogsAPI())
 			r.Get("/apps/{id}/status", s.handlers.HandleAppStatusAPI())
@@ -104,6 +98,11 @@ func (s *Server) SetupRoutes() {
 			// Ports
 			r.Post("/apps/{id}/ports", s.handlers.HandlePortAdd())
 			r.Post("/apps/{id}/ports/{portID}/delete", s.handlers.HandlePortDelete())
+
+			// Registry Credentials
+			r.Post("/apps/{id}/registry-credentials", s.handlers.HandleRegistryCredentialAdd())
+			r.Post("/apps/{id}/registry-credentials/{credID}/edit", s.handlers.HandleRegistryCredentialEdit())
+			r.Post("/apps/{id}/registry-credentials/{credID}/delete", s.handlers.HandleRegistryCredentialDelete())
 		})
 	})
 

internal/service/app/app_test.go

@@ -16,12 +16,6 @@ import (
 	"sneak.berlin/go/upaas/internal/service/app"
 )
 
-// testRepoURL is the default repository URL used across tests.
-const testRepoURL = "git@example.com:user/repo.git"
-
-// giteaRepoURL is the gitea repository URL used across tests.
-const giteaRepoURL = "git@gitea.example.com:user/repo.git"
-
 func setupTestService(t *testing.T) (*app.Service, func()) {
 	t.Helper()
 
@@ -64,8 +58,7 @@ func setupTestService(t *testing.T) (*app.Service, func()) {
 }
 
 // deleteItemTestHelper is a generic helper for testing delete operations.
-// It creates an app, adds an item, verifies it exists, deletes it, and
-// verifies it's gone.
+// It creates an app, adds an item, verifies it exists, deletes it, and verifies it's gone.
 func deleteItemTestHelper(
 	t *testing.T,
 	appName string,
@@ -80,7 +73,7 @@ func deleteItemTestHelper(
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    appName,
-		RepoURL: testRepoURL,
+		RepoURL: "git@example.com:user/repo.git",
 	})
 	require.NoError(t, err)
 
@@ -99,35 +92,6 @@ func deleteItemTestHelper(
 	assert.Equal(t, 0, count)
 }
 
-// runDeleteItemTest adapts typed list/delete callbacks so delete tests for
-// different item types can share deleteItemTestHelper.
-func runDeleteItemTest[T any](
-	t *testing.T,
-	appName string,
-	addItem func(ctx context.Context, svc *app.Service, appID string) error,
-	listItems func(ctx context.Context, application *models.App) ([]T, error),
-	deleteFirst func(ctx context.Context, svc *app.Service, item T) error,
-) {
-	t.Helper()
-
-	deleteItemTestHelper(t, appName,
-		addItem,
-		func(ctx context.Context, application *models.App) (int, error) {
-			items, err := listItems(ctx, application)
-
-			return len(items), err
-		},
-		func(ctx context.Context, svc *app.Service, application *models.App) error {
-			items, err := listItems(ctx, application)
-			if err != nil {
-				return err
-			}
-
-			return deleteFirst(ctx, svc, items[0])
-		},
-	)
-}
-
 func TestCreateAppWithGeneratedKeys(t *testing.T) {
 	t.Parallel()
 
@@ -136,7 +100,7 @@ func TestCreateAppWithGeneratedKeys(t *testing.T) {
 
 	input := app.CreateAppInput{
 		Name:           "test-app",
-		RepoURL:        giteaRepoURL,
+		RepoURL:        "git@gitea.example.com:user/repo.git",
 		Branch:         "main",
 		DockerfilePath: "Dockerfile",
 	}
@@ -146,7 +110,7 @@ func TestCreateAppWithGeneratedKeys(t *testing.T) {
 	require.NotNil(t, createdApp)
 
 	assert.Equal(t, "test-app", createdApp.Name)
-	assert.Equal(t, giteaRepoURL, createdApp.RepoURL)
+	assert.Equal(t, "git@gitea.example.com:user/repo.git", createdApp.RepoURL)
 	assert.Equal(t, "main", createdApp.Branch)
 	assert.Equal(t, "Dockerfile", createdApp.DockerfilePath)
 	assert.NotEmpty(t, createdApp.ID)
@@ -166,7 +130,7 @@ func TestCreateAppDefaults(t *testing.T) {
 
 	input := app.CreateAppInput{
 		Name:    "test-app-defaults",
-		RepoURL: giteaRepoURL,
+		RepoURL: "git@gitea.example.com:user/repo.git",
 	}
 
 	createdApp, err := svc.CreateApp(context.Background(), input)
@@ -184,7 +148,7 @@ func TestCreateAppOptionalFields(t *testing.T) {
 
 	input := app.CreateAppInput{
 		Name:          "test-app-full",
-		RepoURL:       giteaRepoURL,
+		RepoURL:       "git@gitea.example.com:user/repo.git",
 		Branch:        "develop",
 		DockerNetwork: "my-network",
 		NtfyTopic:     "https://ntfy.sh/my-topic",
@@ -212,7 +176,7 @@ func TestUpdateApp(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "original-name",
-			RepoURL: testRepoURL,
+			RepoURL: "git@example.com:user/repo.git",
 		})
 		require.NoError(t, err)
 
@@ -244,7 +208,7 @@ func TestUpdateApp(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:         "test-clear",
-			RepoURL:      testRepoURL,
+			RepoURL:      "git@example.com:user/repo.git",
 			NtfyTopic:    "https://ntfy.sh/topic",
 			SlackWebhook: "https://slack.com/hook",
 		})
@@ -252,7 +216,7 @@ func TestUpdateApp(testingT *testing.T) {
 
 		err = svc.UpdateApp(context.Background(), createdApp, app.UpdateAppInput{
 			Name:    "test-clear",
-			RepoURL: testRepoURL,
+			RepoURL: "git@example.com:user/repo.git",
 			Branch:  "main",
 		})
 		require.NoError(t, err)
@@ -276,7 +240,7 @@ func TestDeleteApp(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "to-delete",
-			RepoURL: testRepoURL,
+			RepoURL: "git@example.com:user/repo.git",
 		})
 		require.NoError(t, err)
 
@@ -300,7 +264,7 @@ func TestGetApp(testingT *testing.T) {
 
 		created, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "findable-app",
-			RepoURL: testRepoURL,
+			RepoURL: "git@example.com:user/repo.git",
 		})
 		require.NoError(t, err)
 
@@ -335,7 +299,7 @@ func TestGetAppByWebhookSecret(testingT *testing.T) {
 
 		created, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "webhook-app",
-			RepoURL: testRepoURL,
+			RepoURL: "git@example.com:user/repo.git",
 		})
 		require.NoError(t, err)
 
@@ -414,7 +378,7 @@ func TestEnvVarsAddAndRetrieve(t *testing.T) {
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    "env-test",
-		RepoURL: testRepoURL,
+		RepoURL: "git@example.com:user/repo.git",
 	})
 	require.NoError(t, err)
 
@@ -447,33 +411,29 @@ func TestEnvVarsAddAndRetrieve(t *testing.T) {
 	assert.Equal(t, "secret123", keys["API_KEY"])
 }
 
-// addDeletableEnvVar seeds the env var removed in the delete test.
-func addDeletableEnvVar(
-	ctx context.Context, svc *app.Service, appID string,
-) error {
-	return svc.AddEnvVar(ctx, appID, "TO_DELETE", "value")
-}
-
 func TestEnvVarsDelete(t *testing.T) {
 	t.Parallel()
 
-	runDeleteItemTest(t, "env-delete-test", addDeletableEnvVar,
-		func(ctx context.Context, application *models.App) ([]*models.EnvVar, error) {
-			return application.GetEnvVars(ctx)
+	deleteItemTestHelper(t, "env-delete-test",
+		func(ctx context.Context, svc *app.Service, appID string) error {
+			return svc.AddEnvVar(ctx, appID, "TO_DELETE", "value")
 		},
-		func(ctx context.Context, svc *app.Service, item *models.EnvVar) error {
-			return svc.DeleteEnvVar(ctx, item.ID)
+		func(ctx context.Context, application *models.App) (int, error) {
+			envVars, err := application.GetEnvVars(ctx)
+
+			return len(envVars), err
+		},
+		func(ctx context.Context, svc *app.Service, application *models.App) error {
+			envVars, err := application.GetEnvVars(ctx)
+			if err != nil {
+				return err
+			}
+
+			return svc.DeleteEnvVar(ctx, envVars[0].ID)
 		},
 	)
 }
 
-// addDeletableLabel seeds the label removed in the delete test.
-func addDeletableLabel(
-	ctx context.Context, svc *app.Service, appID string,
-) error {
-	return svc.AddLabel(ctx, appID, "to.delete", "value")
-}
-
 func TestLabels(testingT *testing.T) {
 	testingT.Parallel()
 
@@ -485,7 +445,7 @@ func TestLabels(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "label-test",
-			RepoURL: testRepoURL,
+			RepoURL: "git@example.com:user/repo.git",
 		})
 		require.NoError(t, err)
 
@@ -508,12 +468,22 @@ func TestLabels(testingT *testing.T) {
 	testingT.Run("deletes label", func(t *testing.T) {
 		t.Parallel()
 
-		runDeleteItemTest(t, "label-delete-test", addDeletableLabel,
-			func(ctx context.Context, application *models.App) ([]*models.Label, error) {
-				return application.GetLabels(ctx)
+		deleteItemTestHelper(t, "label-delete-test",
+			func(ctx context.Context, svc *app.Service, appID string) error {
+				return svc.AddLabel(ctx, appID, "to.delete", "value")
 			},
-			func(ctx context.Context, svc *app.Service, item *models.Label) error {
-				return svc.DeleteLabel(ctx, item.ID)
+			func(ctx context.Context, application *models.App) (int, error) {
+				labels, err := application.GetLabels(ctx)
+
+				return len(labels), err
+			},
+			func(ctx context.Context, svc *app.Service, application *models.App) error {
+				labels, err := application.GetLabels(ctx)
+				if err != nil {
+					return err
+				}
+
+				return svc.DeleteLabel(ctx, labels[0].ID)
 			},
 		)
 	})
@@ -527,7 +497,7 @@ func TestVolumesAddAndRetrieve(t *testing.T) {
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    "volume-test",
-		RepoURL: testRepoURL,
+		RepoURL: "git@example.com:user/repo.git",
 	})
 	require.NoError(t, err)
 
@@ -577,7 +547,7 @@ func TestVolumesDelete(t *testing.T) {
 
 	createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 		Name:    "volume-delete-test",
-		RepoURL: testRepoURL,
+		RepoURL: "git@example.com:user/repo.git",
 	})
 	require.NoError(t, err)
 
@@ -613,7 +583,7 @@ func TestUpdateAppStatus(testingT *testing.T) {
 
 		createdApp, err := svc.CreateApp(context.Background(), app.CreateAppInput{
 			Name:    "status-test",
-			RepoURL: testRepoURL,
+			RepoURL: "git@example.com:user/repo.git",
 		})
 		require.NoError(t, err)
 		assert.Equal(t, models.AppStatusPending, createdApp.Status)

internal/service/auth/auth_test.go

@@ -121,7 +121,7 @@ func getSessionCookie(t *testing.T, svc *auth.Service) *http.Cookie {
 	require.NoError(t, err)
 
 	recorder := httptest.NewRecorder()
-	request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
+	request := httptest.NewRequest(http.MethodGet, "/", nil)
 
 	err = svc.CreateSession(recorder, request, user)
 	require.NoError(t, err)
@@ -144,11 +144,7 @@ func TestSessionCookieSecureFlag(testingT *testing.T) {
 		svc := setupAuthService(t, false)
 		cookie := getSessionCookie(t, svc)
 		require.NotNil(t, cookie, "session cookie should exist")
-		assert.True(
-			t,
-			cookie.Secure,
-			"session cookie should have Secure flag in production mode",
-		)
+		assert.True(t, cookie.Secure, "session cookie should have Secure flag in production mode")
 	})
 }
 
@@ -328,12 +324,7 @@ func TestCreateUserRaceCondition(testingT *testing.T) {
 		}
 
 		assert.Equal(t, 1, successes, "exactly one goroutine should succeed")
-		assert.Equal(
-			t,
-			goroutines-1,
-			failures,
-			"all other goroutines should fail with ErrUserExists",
-		)
+		assert.Equal(t, goroutines-1, failures, "all other goroutines should fail with ErrUserExists")
 	})
 }
 
@@ -389,9 +380,7 @@ func TestDestroySessionMaxAge(testingT *testing.T) {
 		defer cleanup()
 
 		recorder := httptest.NewRecorder()
-		request := httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, "/", nil,
-		)
+		request := httptest.NewRequest(http.MethodGet, "/", nil)
 
 		err := svc.DestroySession(recorder, request)
 		require.NoError(t, err)

internal/service/deploy/deploy.go

@@ -66,8 +66,7 @@ const logFilePermissions = 0o640
 // logTimestampFormat is the format for log file timestamps.
 const logTimestampFormat = "20060102T150405Z"
 
-// logFileShortSHALength is the number of characters to use for commit SHA
-// in log filenames.
+// logFileShortSHALength is the number of characters to use for commit SHA in log filenames.
 const logFileShortSHALength = 12
 
 // dockerLogMessage represents a Docker build log message.
@@ -88,10 +87,7 @@ type deploymentLogWriter struct {
 	flushCtx   context.Context //nolint:containedctx // needed for async flush goroutine
 }
 
-func newDeploymentLogWriter(
-	ctx context.Context,
-	deployment *models.Deployment,
-) *deploymentLogWriter {
+func newDeploymentLogWriter(ctx context.Context, deployment *models.Deployment) *deploymentLogWriter {
 	w := &deploymentLogWriter{
 		deployment: deployment,
 		done:       make(chan struct{}),
@@ -261,10 +257,7 @@ func (svc *Service) GetBuildDir(appName string) string {
 
 // GetLogFilePath returns the path to the log file for a deployment.
 // Returns empty string if the path cannot be determined.
-func (svc *Service) GetLogFilePath(
-	app *models.App,
-	deployment *models.Deployment,
-) string {
+func (svc *Service) GetLogFilePath(app *models.App, deployment *models.Deployment) string {
 	hostname, err := os.Hostname()
 	if err != nil {
 		hostname = "unknown"
@@ -282,8 +275,7 @@ func (svc *Service) GetLogFilePath(
 	// Use started_at timestamp
 	timestamp := deployment.StartedAt.UTC().Format(logTimestampFormat)
 
-	// Build filename: appname_sha_timestamp.log.txt
-	// (or appname_timestamp.log.txt if no SHA)
+	// Build filename: appname_sha_timestamp.log.txt (or appname_timestamp.log.txt if no SHA)
 	var filename string
 	if sha != "" {
 		filename = fmt.Sprintf("%s_%s_%s.log.txt", app.Name, sha, timestamp)
@@ -316,8 +308,7 @@ func (svc *Service) CancelDeploy(appID string) bool {
 
 // Deploy deploys an app. If cancelExisting is true (e.g. webhook-triggered),
 // any in-progress deploy for the same app will be cancelled before starting.
-// If cancelExisting is false and a deploy is in progress,
-// ErrDeploymentInProgress is returned.
+// If cancelExisting is false and a deploy is in progress, ErrDeploymentInProgress is returned.
 func (svc *Service) Deploy(
 	ctx context.Context,
 	app *models.App,
@@ -351,8 +342,7 @@ func (svc *Service) Deploy(
 	// Fetch webhook event and create deployment record
 	webhookEvent := svc.fetchWebhookEvent(deployCtx, webhookEventID)
 
-	// Use a background context for DB operations that must complete
-	// regardless of cancellation
+	// Use a background context for DB operations that must complete regardless of cancellation
 	bgCtx := context.WithoutCancel(deployCtx)
 
 	deployment, err := svc.createDeploymentRecord(bgCtx, app, webhookEventID, webhookEvent)
@@ -411,10 +401,7 @@ func (svc *Service) createRollbackDeployment(
 		return nil, fmt.Errorf("failed to create rollback deployment: %w", saveErr)
 	}
 
-	_ = deployment.AppendLog(
-		ctx,
-		"Rolling back to previous image: "+app.PreviousImageID.String,
-	)
+	_ = deployment.AppendLog(ctx, "Rolling back to previous image: "+app.PreviousImageID.String)
 
 	return deployment, nil
 }
@@ -430,11 +417,7 @@ func (svc *Service) executeRollback(
 
 	svc.removeOldContainer(ctx, app, deployment)
 
-	rollbackOpts, err := svc.buildContainerOptions(
-		ctx,
-		app,
-		docker.ImageID(previousImageID),
-	)
+	rollbackOpts, err := svc.buildContainerOptions(ctx, app, docker.ImageID(previousImageID))
 	if err != nil {
 		svc.failDeployment(bgCtx, app, deployment, err)
 
@@ -443,12 +426,7 @@ func (svc *Service) executeRollback(
 
 	containerID, err := svc.docker.CreateContainer(ctx, rollbackOpts)
 	if err != nil {
-		svc.failDeployment(
-			bgCtx,
-			app,
-			deployment,
-			fmt.Errorf("failed to create rollback container: %w", err),
-		)
+		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to create rollback container: %w", err))
 
 		return fmt.Errorf("failed to create rollback container: %w", err)
 	}
@@ -458,12 +436,7 @@ func (svc *Service) executeRollback(
 
 	startErr := svc.docker.StartContainer(ctx, containerID)
 	if startErr != nil {
-		svc.failDeployment(
-			bgCtx,
-			app,
-			deployment,
-			fmt.Errorf("failed to start rollback container: %w", startErr),
-		)
+		svc.failDeployment(bgCtx, app, deployment, fmt.Errorf("failed to start rollback container: %w", startErr))
 
 		return fmt.Errorf("failed to start rollback container: %w", startErr)
 	}
@@ -722,11 +695,7 @@ func (svc *Service) cleanupCancelledDeploy(
 		if removeErr != nil {
 			svc.log.Error("failed to remove image from cancelled deploy",
 				"error", removeErr, "app", app.Name, "image", imageID)
-			_ = deployment.AppendLog(
-				ctx,
-				"WARNING: failed to clean up image "+
-					imageID.String()+": "+removeErr.Error(),
-			)
+			_ = deployment.AppendLog(ctx, "WARNING: failed to clean up image "+imageID.String()+": "+removeErr.Error())
 		} else {
 			svc.log.Info("cleaned up image from cancelled deploy",
 				"app", app.Name, "image", imageID)
@@ -861,6 +830,13 @@ func (svc *Service) buildImage(
 	logWriter := newDeploymentLogWriter(ctx, deployment)
 	defer logWriter.Close()
 
+	// Fetch registry credentials for private base images
+	registryAuths, err := svc.buildRegistryAuths(ctx, app)
+	if err != nil {
+		svc.log.Warn("failed to fetch registry credentials", "error", err, "app", app.Name)
+		// Continue without auth — public images will still work
+	}
+
 	// BuildImage creates a tar archive from the local filesystem,
 	// so it needs the container path where files exist, not the host path.
 	imageID, err := svc.docker.BuildImage(ctx, docker.BuildImageOptions{
@@ -868,6 +844,7 @@ func (svc *Service) buildImage(
 		DockerfilePath: app.DockerfilePath,
 		Tags:           []string{imageTag},
 		LogWriter:      logWriter,
+		RegistryAuths:  registryAuths,
 	})
 	if err != nil {
 		svc.notify.NotifyBuildFailed(ctx, app, deployment, err)
@@ -901,24 +878,14 @@ func (svc *Service) cloneRepository(
 
 	err := os.MkdirAll(appBuildsDir, buildsDirPermissions)
 	if err != nil {
-		svc.failDeployment(
-			ctx,
-			app,
-			deployment,
-			fmt.Errorf("failed to create builds dir: %w", err),
-		)
+		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to create builds dir: %w", err))
 
 		return "", nil, fmt.Errorf("failed to create builds dir: %w", err)
 	}
 
 	buildDir, err := os.MkdirTemp(appBuildsDir, fmt.Sprintf("%d-*", deployment.ID))
 	if err != nil {
-		svc.failDeployment(
-			ctx,
-			app,
-			deployment,
-			fmt.Errorf("failed to create temp dir: %w", err),
-		)
+		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to create temp dir: %w", err))
 
 		return "", nil, fmt.Errorf("failed to create temp dir: %w", err)
 	}
@@ -949,12 +916,7 @@ func (svc *Service) cloneRepository(
 	)
 	if cloneErr != nil {
 		cleanup()
-		svc.failDeployment(
-			ctx,
-			app,
-			deployment,
-			fmt.Errorf("failed to clone repo: %w", cloneErr),
-		)
+		svc.failDeployment(ctx, app, deployment, fmt.Errorf("failed to clone repo: %w", cloneErr))
 
 		return "", nil, fmt.Errorf("failed to clone repo: %w", cloneErr)
 	}
@@ -1140,28 +1102,14 @@ func (svc *Service) buildContainerOptions(
 		network = app.DockerNetwork.String
 	}
 
-	var cpuLimit float64
-
-	if app.CPULimit.Valid {
-		cpuLimit = app.CPULimit.Float64
-	}
-
-	var memoryLimit int64
-
-	if app.MemoryLimit.Valid {
-		memoryLimit = app.MemoryLimit.Int64
-	}
-
 	return docker.CreateContainerOptions{
-		Name:        "upaas-" + app.Name,
-		Image:       imageID.String(),
-		Env:         envMap,
-		Labels:      buildLabelMap(app, labels),
-		Volumes:     buildVolumeMounts(volumes),
-		Ports:       buildPortMappings(ports),
-		Network:     network,
-		CPULimit:    cpuLimit,
-		MemoryLimit: memoryLimit,
+		Name:    "upaas-" + app.Name,
+		Image:   imageID.String(),
+		Env:     envMap,
+		Labels:  buildLabelMap(app, labels),
+		Volumes: buildVolumeMounts(volumes),
+		Ports:   buildPortMappings(ports),
+		Network: network,
 	}, nil
 }
 
@@ -1287,6 +1235,34 @@ func (svc *Service) failDeployment(
 	_ = app.Save(ctx)
 }
 
+// buildRegistryAuths fetches registry credentials for an app and converts them
+// to Docker RegistryAuth objects for use during image builds.
+func (svc *Service) buildRegistryAuths(
+	ctx context.Context,
+	app *models.App,
+) ([]docker.RegistryAuth, error) {
+	creds, err := app.GetRegistryCredentials(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get registry credentials: %w", err)
+	}
+
+	if len(creds) == 0 {
+		return nil, nil
+	}
+
+	auths := make([]docker.RegistryAuth, 0, len(creds))
+
+	for _, cred := range creds {
+		auths = append(auths, docker.RegistryAuth{
+			Registry: cred.Registry,
+			Username: cred.Username,
+			Password: cred.Password,
+		})
+	}
+
+	return auths, nil
+}
+
 // writeLogsToFile writes the deployment logs to a file on disk.
 // Structure: DataDir/logs/<hostname>/<appname>/<appname>_<sha>_<timestamp>.log.txt
 func (svc *Service) writeLogsToFile(app *models.App, deployment *models.Deployment) {

internal/service/deploy/deploy_cleanup_test.go

@@ -32,10 +32,7 @@ func TestCleanupCancelledDeploy_RemovesBuildDir(t *testing.T) {
 	require.NoError(t, os.MkdirAll(deployDir, 0o750))
 
 	// Create a file inside to verify full removal
-	require.NoError(
-		t,
-		os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600),
-	)
+	require.NoError(t, os.WriteFile(filepath.Join(deployDir, "work"), []byte("test"), 0o600))
 
 	// Also create a dir for a different deployment (should NOT be removed)
 	otherDir := filepath.Join(buildDir, "99-xyz789")

internal/service/deploy/deploy_container_test.go

@@ -2,7 +2,6 @@ package deploy_test
 
 import (
 	"context"
-	"database/sql"
 	"log/slog"
 	"os"
 	"testing"
@@ -31,9 +30,7 @@ func TestBuildContainerOptionsUsesImageID(t *testing.T) {
 
 	const expectedImageID = docker.ImageID("sha256:abc123def456")
 
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, expectedImageID,
-	)
+	opts, err := svc.BuildContainerOptionsExported(context.Background(), app, expectedImageID)
 	if err != nil {
 		t.Fatalf("buildContainerOptions returned error: %v", err)
 	}
@@ -46,92 +43,3 @@ func TestBuildContainerOptionsUsesImageID(t *testing.T) {
 		t.Errorf("expected Name=%q, got %q", "upaas-myapp", opts.Name)
 	}
 }
-
-func TestBuildContainerOptionsNoResourceLimits(t *testing.T) {
-	t.Parallel()
-
-	db := database.NewTestDatabase(t)
-
-	app := models.NewApp(db)
-	app.Name = "nolimits"
-
-	err := app.Save(context.Background())
-	if err != nil {
-		t.Fatalf("failed to save app: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	svc := deploy.NewTestService(log)
-
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, docker.ImageID("test:latest"),
-	)
-	if err != nil {
-		t.Fatalf("buildContainerOptions returned error: %v", err)
-	}
-
-	if opts.CPULimit != 0 {
-		t.Errorf("expected CPULimit=0, got %v", opts.CPULimit)
-	}
-
-	if opts.MemoryLimit != 0 {
-		t.Errorf("expected MemoryLimit=0, got %v", opts.MemoryLimit)
-	}
-}
-
-// buildOptsForApp saves an app configured by setup and returns the container
-// options built for it.
-func buildOptsForApp(
-	t *testing.T,
-	name string,
-	setup func(app *models.App),
-) docker.CreateContainerOptions {
-	t.Helper()
-
-	db := database.NewTestDatabase(t)
-
-	app := models.NewApp(db)
-	app.Name = name
-	setup(app)
-
-	err := app.Save(context.Background())
-	if err != nil {
-		t.Fatalf("failed to save app: %v", err)
-	}
-
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	svc := deploy.NewTestService(log)
-
-	opts, err := svc.BuildContainerOptionsExported(
-		context.Background(), app, docker.ImageID("test:latest"),
-	)
-	if err != nil {
-		t.Fatalf("buildContainerOptions returned error: %v", err)
-	}
-
-	return opts
-}
-
-func TestBuildContainerOptionsCPULimit(t *testing.T) {
-	t.Parallel()
-
-	opts := buildOptsForApp(t, "cpulimit", func(app *models.App) {
-		app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
-	})
-
-	if opts.CPULimit != 0.5 {
-		t.Errorf("expected CPULimit=0.5, got %v", opts.CPULimit)
-	}
-}
-
-func TestBuildContainerOptionsMemoryLimit(t *testing.T) {
-	t.Parallel()
-
-	opts := buildOptsForApp(t, "memlimit", func(app *models.App) {
-		app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
-	})
-
-	if opts.MemoryLimit != 536870912 {
-		t.Errorf("expected MemoryLimit=536870912, got %v", opts.MemoryLimit)
-	}
-}

internal/service/deploy/export_test.go

@@ -26,11 +26,7 @@ func (svc *Service) CancelActiveDeploy(appID string) {
 }
 
 // RegisterActiveDeploy registers an active deploy for testing.
-func (svc *Service) RegisterActiveDeploy(
-	appID string,
-	cancel context.CancelFunc,
-	done chan struct{},
-) {
+func (svc *Service) RegisterActiveDeploy(appID string, cancel context.CancelFunc, done chan struct{}) {
 	svc.activeDeploys.Store(appID, &activeDeploy{cancel: cancel, done: done})
 }
 
@@ -45,11 +41,7 @@ func (svc *Service) UnlockApp(appID string) {
 }
 
 // NewTestServiceWithConfig creates a Service with config and docker client for testing.
-func NewTestServiceWithConfig(
-	log *slog.Logger,
-	cfg *config.Config,
-	dockerClient *docker.Client,
-) *Service {
+func NewTestServiceWithConfig(log *slog.Logger, cfg *config.Config, dockerClient *docker.Client) *Service {
 	return &Service{
 		log:    log,
 		config: cfg,

internal/service/notify/notify.go

@@ -159,8 +159,7 @@ func (svc *Service) NotifyDeployFailed(
 ) {
 	duration := time.Since(deployment.StartedAt)
 	title := "Deploy failed: " + app.Name
-	message := "Deployment failed after " + formatDuration(duration) +
-		": " + deployErr.Error()
+	message := "Deployment failed after " + formatDuration(duration) + ": " + deployErr.Error()
 
 	svc.sendNotifications(ctx, app, title, message, message, "error")
 }
@@ -267,8 +266,7 @@ func (svc *Service) sendNtfy(
 	request.Header.Set("Title", title)
 	request.Header.Set("Priority", svc.ntfyPriority(priority))
 
-	// #nosec G704 -- URL from validated config, not user input
-	resp, err := svc.client.Do(request)
+	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
 	if err != nil {
 		return fmt.Errorf("failed to send ntfy request: %w", err)
 	}
@@ -365,8 +363,7 @@ func (svc *Service) sendSlack(
 
 	request.Header.Set("Content-Type", "application/json")
 
-	// #nosec G704 -- URL from validated config, not user input
-	resp, err := svc.client.Do(request)
+	resp, err := svc.client.Do(request) // #nosec G704 -- URL from validated config, not user input
 	if err != nil {
 		return fmt.Errorf("failed to send slack request: %w", err)
 	}

internal/service/webhook/payloads.go

@@ -1,237 +0,0 @@
-package webhook
-
-import "encoding/json"
-
-// GiteaPushPayload represents a Gitea push webhook payload.
-//
-//nolint:tagliatelle // Field names match Gitea API (snake_case)
-type GiteaPushPayload struct {
-	Ref        string      `json:"ref"`
-	Before     string      `json:"before"`
-	After      string      `json:"after"`
-	CompareURL UnparsedURL `json:"compare_url"`
-	Repository struct {
-		FullName string      `json:"full_name"`
-		CloneURL UnparsedURL `json:"clone_url"`
-		SSHURL   string      `json:"ssh_url"`
-		HTMLURL  UnparsedURL `json:"html_url"`
-	} `json:"repository"`
-	Pusher struct {
-		Username string `json:"username"`
-		Email    string `json:"email"`
-	} `json:"pusher"`
-	Commits []struct {
-		ID      string      `json:"id"`
-		URL     UnparsedURL `json:"url"`
-		Message string      `json:"message"`
-		Author  struct {
-			Name  string `json:"name"`
-			Email string `json:"email"`
-		} `json:"author"`
-	} `json:"commits"`
-}
-
-// GitHubPushPayload represents a GitHub push webhook payload.
-//
-//nolint:tagliatelle // Field names match GitHub API (snake_case)
-type GitHubPushPayload struct {
-	Ref        string `json:"ref"`
-	Before     string `json:"before"`
-	After      string `json:"after"`
-	CompareURL string `json:"compare"`
-	Repository struct {
-		FullName string      `json:"full_name"`
-		CloneURL UnparsedURL `json:"clone_url"`
-		SSHURL   string      `json:"ssh_url"`
-		HTMLURL  UnparsedURL `json:"html_url"`
-	} `json:"repository"`
-	Pusher struct {
-		Name  string `json:"name"`
-		Email string `json:"email"`
-	} `json:"pusher"`
-	HeadCommit *struct {
-		ID      string      `json:"id"`
-		URL     UnparsedURL `json:"url"`
-		Message string      `json:"message"`
-	} `json:"head_commit"`
-	Commits []struct {
-		ID      string      `json:"id"`
-		URL     UnparsedURL `json:"url"`
-		Message string      `json:"message"`
-		Author  struct {
-			Name  string `json:"name"`
-			Email string `json:"email"`
-		} `json:"author"`
-	} `json:"commits"`
-}
-
-// GitLabPushPayload represents a GitLab push webhook payload.
-//
-//nolint:tagliatelle // Field names match GitLab API (snake_case)
-type GitLabPushPayload struct {
-	Ref       string `json:"ref"`
-	Before    string `json:"before"`
-	After     string `json:"after"`
-	UserName  string `json:"user_name"`
-	UserEmail string `json:"user_email"`
-	Project   struct {
-		PathWithNamespace string      `json:"path_with_namespace"`
-		GitHTTPURL        UnparsedURL `json:"git_http_url"`
-		GitSSHURL         string      `json:"git_ssh_url"`
-		WebURL            UnparsedURL `json:"web_url"`
-	} `json:"project"`
-	Commits []struct {
-		ID      string      `json:"id"`
-		URL     UnparsedURL `json:"url"`
-		Message string      `json:"message"`
-		Author  struct {
-			Name  string `json:"name"`
-			Email string `json:"email"`
-		} `json:"author"`
-	} `json:"commits"`
-}
-
-// ParsePushPayload parses a raw webhook payload into a normalized PushEvent
-// based on the detected webhook source. Returns an error if JSON unmarshaling
-// fails. For SourceUnknown, falls back to Gitea format for backward
-// compatibility.
-func ParsePushPayload(source Source, payload []byte) (*PushEvent, error) {
-	switch source {
-	case SourceGitHub:
-		return parsePush(payload, githubPushEvent)
-	case SourceGitLab:
-		return parsePush(payload, gitlabPushEvent)
-	case SourceGitea, SourceUnknown:
-		// Gitea and unknown both use Gitea format for backward compatibility.
-		return parsePush(payload, giteaPushEvent)
-	}
-
-	// Unreachable for known source values, but satisfies exhaustive checker.
-	return parsePush(payload, giteaPushEvent)
-}
-
-// parsePush unmarshals payload into P and converts it into a normalized
-// PushEvent via build.
-func parsePush[P any](payload []byte, build func(P) *PushEvent) (*PushEvent, error) {
-	var p P
-
-	unmarshalErr := json.Unmarshal(payload, &p)
-	if unmarshalErr != nil {
-		return nil, unmarshalErr
-	}
-
-	return build(p), nil
-}
-
-// basePushEvent builds a PushEvent populated with the fields shared by all
-// webhook sources.
-func basePushEvent(source Source, ref, before, after string) *PushEvent {
-	return &PushEvent{
-		Source: source,
-		Ref:    ref,
-		Before: before,
-		After:  after,
-		Branch: extractBranch(ref),
-	}
-}
-
-// giteaPushEvent converts a Gitea push payload to a normalized PushEvent.
-func giteaPushEvent(p GiteaPushPayload) *PushEvent {
-	event := basePushEvent(SourceGitea, p.Ref, p.Before, p.After)
-	event.RepoName = p.Repository.FullName
-	event.CloneURL = p.Repository.CloneURL
-	event.HTMLURL = p.Repository.HTMLURL
-	event.CommitURL = extractGiteaCommitURL(p)
-	event.Pusher = p.Pusher.Username
-
-	return event
-}
-
-// gitlabPushEvent converts a GitLab push payload to a normalized PushEvent.
-func gitlabPushEvent(p GitLabPushPayload) *PushEvent {
-	event := basePushEvent(SourceGitLab, p.Ref, p.Before, p.After)
-	event.RepoName = p.Project.PathWithNamespace
-	event.CloneURL = p.Project.GitHTTPURL
-	event.HTMLURL = p.Project.WebURL
-	event.CommitURL = extractGitLabCommitURL(p)
-	event.Pusher = p.UserName
-
-	return event
-}
-
-// githubPushEvent converts a GitHub push payload to a normalized PushEvent.
-func githubPushEvent(p GitHubPushPayload) *PushEvent {
-	event := basePushEvent(SourceGitHub, p.Ref, p.Before, p.After)
-	event.RepoName = p.Repository.FullName
-	event.CloneURL = p.Repository.CloneURL
-	event.HTMLURL = p.Repository.HTMLURL
-	event.CommitURL = extractGitHubCommitURL(p)
-	event.Pusher = p.Pusher.Name
-
-	return event
-}
-
-// extractBranch extracts the branch name from a git ref.
-func extractBranch(ref string) string {
-	// refs/heads/main -> main
-	const prefix = "refs/heads/"
-
-	if len(ref) >= len(prefix) && ref[:len(prefix)] == prefix {
-		return ref[len(prefix):]
-	}
-
-	return ref
-}
-
-// extractGiteaCommitURL extracts the commit URL from a Gitea push payload.
-// Prefers the URL from the head commit, falls back to constructing from repo URL.
-func extractGiteaCommitURL(payload GiteaPushPayload) UnparsedURL {
-	for _, commit := range payload.Commits {
-		if commit.ID == payload.After && commit.URL != "" {
-			return commit.URL
-		}
-	}
-
-	if payload.Repository.HTMLURL != "" && payload.After != "" {
-		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
-	}
-
-	return ""
-}
-
-// extractGitHubCommitURL extracts the commit URL from a GitHub push payload.
-// Prefers head_commit.url, then searches commits, then constructs from repo URL.
-func extractGitHubCommitURL(payload GitHubPushPayload) UnparsedURL {
-	if payload.HeadCommit != nil && payload.HeadCommit.URL != "" {
-		return payload.HeadCommit.URL
-	}
-
-	for _, commit := range payload.Commits {
-		if commit.ID == payload.After && commit.URL != "" {
-			return commit.URL
-		}
-	}
-
-	if payload.Repository.HTMLURL != "" && payload.After != "" {
-		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
-	}
-
-	return ""
-}
-
-// extractGitLabCommitURL extracts the commit URL from a GitLab push payload.
-// Prefers commit URL from the commits list, falls back to constructing from
-// project web URL.
-func extractGitLabCommitURL(payload GitLabPushPayload) UnparsedURL {
-	for _, commit := range payload.Commits {
-		if commit.ID == payload.After && commit.URL != "" {
-			return commit.URL
-		}
-	}
-
-	if payload.Project.WebURL != "" && payload.After != "" {
-		return UnparsedURL(payload.Project.WebURL.String() + "/-/commit/" + payload.After)
-	}
-
-	return ""
-}

internal/service/webhook/types.go

@@ -1,7 +1,5 @@
 package webhook
 
-import "net/http"
-
 // UnparsedURL is a URL stored as a plain string without parsing.
 // Use this instead of string when the value is known to be a URL
 // but should not be parsed into a net/url.URL (e.g. webhook URLs,
@@ -10,84 +8,3 @@ type UnparsedURL string
 
 // String implements the fmt.Stringer interface.
 func (u UnparsedURL) String() string { return string(u) }
-
-// Source identifies which git hosting platform sent the webhook.
-type Source string
-
-const (
-	// SourceGitea indicates the webhook was sent by a Gitea instance.
-	SourceGitea Source = "gitea"
-
-	// SourceGitHub indicates the webhook was sent by GitHub.
-	SourceGitHub Source = "github"
-
-	// SourceGitLab indicates the webhook was sent by a GitLab instance.
-	SourceGitLab Source = "gitlab"
-
-	// SourceUnknown indicates the webhook source could not be determined.
-	SourceUnknown Source = "unknown"
-)
-
-// String implements the fmt.Stringer interface.
-func (s Source) String() string { return string(s) }
-
-// DetectWebhookSource determines the webhook source from HTTP headers.
-// It checks for platform-specific event headers in this order:
-// Gitea (X-Gitea-Event), GitHub (X-GitHub-Event), GitLab (X-Gitlab-Event).
-// Returns SourceUnknown if no recognized header is found.
-func DetectWebhookSource(headers http.Header) Source {
-	if headers.Get("X-Gitea-Event") != "" {
-		return SourceGitea
-	}
-
-	if headers.Get("X-Github-Event") != "" {
-		return SourceGitHub
-	}
-
-	if headers.Get("X-Gitlab-Event") != "" {
-		return SourceGitLab
-	}
-
-	return SourceUnknown
-}
-
-// DetectEventType extracts the event type string from HTTP headers
-// based on the detected webhook source. Returns "push" as a fallback
-// when no event header is found.
-func DetectEventType(headers http.Header, source Source) string {
-	switch source {
-	case SourceGitea:
-		if v := headers.Get("X-Gitea-Event"); v != "" {
-			return v
-		}
-	case SourceGitHub:
-		if v := headers.Get("X-Github-Event"); v != "" {
-			return v
-		}
-	case SourceGitLab:
-		if v := headers.Get("X-Gitlab-Event"); v != "" {
-			return v
-		}
-	case SourceUnknown:
-		// Fall through to default
-	}
-
-	return "push"
-}
-
-// PushEvent is a normalized representation of a push webhook payload
-// from any supported source (Gitea, GitHub, GitLab). The webhook
-// service converts source-specific payloads into this format before
-// processing.
-type PushEvent struct {
-	Source    Source
-	Ref       string
-	Before    string
-	After     string
-	Branch    string
-	RepoName  string
-	CloneURL  UnparsedURL
-	HTMLURL   UnparsedURL
-	CommitURL UnparsedURL
-	Pusher    string
-}

internal/service/webhook/webhook.go

@@ -4,6 +4,7 @@ package webhook
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"log/slog"
 
@@ -43,46 +44,68 @@ func New(_ fx.Lifecycle, params ServiceParams) (*Service, error) {
 	}, nil
 }
 
-// HandleWebhook processes a webhook request from any supported source
-// (Gitea, GitHub, or GitLab). The source parameter determines which
-// payload format to use for parsing.
+// GiteaPushPayload represents a Gitea push webhook payload.
+//
+//nolint:tagliatelle // Field names match Gitea API (snake_case)
+type GiteaPushPayload struct {
+	Ref        string      `json:"ref"`
+	Before     string      `json:"before"`
+	After      string      `json:"after"`
+	CompareURL UnparsedURL `json:"compare_url"`
+	Repository struct {
+		FullName string      `json:"full_name"`
+		CloneURL UnparsedURL `json:"clone_url"`
+		SSHURL   string      `json:"ssh_url"`
+		HTMLURL  UnparsedURL `json:"html_url"`
+	} `json:"repository"`
+	Pusher struct {
+		Username string `json:"username"`
+		Email    string `json:"email"`
+	} `json:"pusher"`
+	Commits []struct {
+		ID      string      `json:"id"`
+		URL     UnparsedURL `json:"url"`
+		Message string      `json:"message"`
+		Author  struct {
+			Name  string `json:"name"`
+			Email string `json:"email"`
+		} `json:"author"`
+	} `json:"commits"`
+}
+
+// HandleWebhook processes a webhook request.
 func (svc *Service) HandleWebhook(
 	ctx context.Context,
 	app *models.App,
-	source Source,
 	eventType string,
 	payload []byte,
 ) error {
-	svc.log.Info("processing webhook",
-		"app", app.Name,
-		"source", source.String(),
-		"event", eventType,
-	)
+	svc.log.Info("processing webhook", "app", app.Name, "event", eventType)
 
-	// Parse payload into normalized push event
-	pushEvent, parseErr := ParsePushPayload(source, payload)
-	if parseErr != nil {
-		svc.log.Warn("failed to parse webhook payload",
-			"error", parseErr,
-			"source", source.String(),
-		)
-		// Continue with empty push event to still log the webhook
-		pushEvent = &PushEvent{Source: source}
+	// Parse payload
+	var pushPayload GiteaPushPayload
+
+	unmarshalErr := json.Unmarshal(payload, &pushPayload)
+	if unmarshalErr != nil {
+		svc.log.Warn("failed to parse webhook payload", "error", unmarshalErr)
+		// Continue anyway to log the event
 	}
 
+	// Extract branch from ref
+	branch := extractBranch(pushPayload.Ref)
+	commitSHA := pushPayload.After
+	commitURL := extractCommitURL(pushPayload)
+
 	// Check if branch matches
-	matched := pushEvent.Branch == app.Branch
+	matched := branch == app.Branch
 
 	// Create webhook event record
 	event := models.NewWebhookEvent(svc.db)
 	event.AppID = app.ID
 	event.EventType = eventType
-	event.Branch = pushEvent.Branch
-	event.CommitSHA = sql.NullString{String: pushEvent.After, Valid: pushEvent.After != ""}
-	event.CommitURL = sql.NullString{
-		String: pushEvent.CommitURL.String(),
-		Valid:  pushEvent.CommitURL != "",
-	}
+	event.Branch = branch
+	event.CommitSHA = sql.NullString{String: commitSHA, Valid: commitSHA != ""}
+	event.CommitURL = sql.NullString{String: commitURL.String(), Valid: commitURL != ""}
 	event.Payload = sql.NullString{String: string(payload), Valid: true}
 	event.Matched = matched
 	event.Processed = false
@@ -94,10 +117,9 @@ func (svc *Service) HandleWebhook(
 
 	svc.log.Info("webhook event recorded",
 		"app", app.Name,
-		"source", source.String(),
-		"branch", pushEvent.Branch,
+		"branch", branch,
 		"matched", matched,
-		"commit", pushEvent.After,
+		"commit", commitSHA,
 	)
 
 	// If branch matches, trigger deployment
@@ -132,3 +154,33 @@ func (svc *Service) triggerDeployment(
 		_ = event.Save(deployCtx)
 	}()
 }
+
+// extractBranch extracts the branch name from a git ref.
+func extractBranch(ref string) string {
+	// refs/heads/main -> main
+	const prefix = "refs/heads/"
+
+	if len(ref) >= len(prefix) && ref[:len(prefix)] == prefix {
+		return ref[len(prefix):]
+	}
+
+	return ref
+}
+
+// extractCommitURL extracts the commit URL from the webhook payload.
+// Prefers the URL from the head commit, falls back to constructing from repo URL.
+func extractCommitURL(payload GiteaPushPayload) UnparsedURL {
+	// Try to find the URL from the head commit (matching After SHA)
+	for _, commit := range payload.Commits {
+		if commit.ID == payload.After && commit.URL != "" {
+			return commit.URL
+		}
+	}
+
+	// Fall back to constructing URL from repo HTML URL
+	if payload.Repository.HTMLURL != "" && payload.After != "" {
+		return UnparsedURL(payload.Repository.HTMLURL.String() + "/commit/" + payload.After)
+	}
+
+	return ""
+}

script/bootstrap

@@ -1,121 +0,0 @@
-#!/bin/sh
-# script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go). golangci-lint is packaged in nix, brew, and apk; on apt
-# it is installed from a hash-verified GitHub release archive (never
-# curl | sh).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Pinned versions, 2026-08-07. Never "latest"; exact versions only.
-GOLANGCI_LINT_VERSION="2.12.2"
-# sha256 of golangci-lint-2.12.2-linux-<arch>.tar.gz release archives
-GOLANGCI_LINT_SHA256_AMD64="8df580d2670fed8fa984aac0507099af8df275e665215f5c7a2ae3943893a553"
-GOLANGCI_LINT_SHA256_ARM64="44cd40a8c76c86755375adfeea52cfd3533cb43d7bd647771e0ae065e166df3a"
-
-PKGMGR=""
-SUDO=""
-
-detect_pkgmgr() {
-    [ -n "$PKGMGR" ] && return 0
-    if command -v nix-env >/dev/null 2>&1; then
-        PKGMGR="nix"
-    elif command -v apt-get >/dev/null 2>&1; then
-        PKGMGR="apt"
-    elif command -v brew >/dev/null 2>&1; then
-        PKGMGR="brew"
-    elif command -v apk >/dev/null 2>&1; then
-        PKGMGR="apk"
-    else
-        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
-        exit 1
-    fi
-    if [ "$PKGMGR" = "apt" ]; then
-        export DEBIAN_FRONTEND=noninteractive
-        if [ "$(id -u)" != "0" ]; then
-            SUDO="sudo"
-        fi
-    fi
-}
-
-# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-pkg_install() {
-    detect_pkgmgr
-    case "$PKGMGR" in
-        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
-        brew) brew install "$3" ;;
-        apk) apk add --no-cache "$4" ;;
-    esac
-}
-
-missing() {
-    ! command -v "$1" >/dev/null 2>&1
-}
-
-# verify_sha256 <file> <expected-hash>
-verify_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
-    else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# apt has no golangci-lint package: install a pinned release archive
-# from GitHub, verified by hardcoded sha256 (never curl | sh).
-install_golangci_lint_release() {
-    case "$(uname -m)" in
-        x86_64) goarch="amd64"; sha="$GOLANGCI_LINT_SHA256_AMD64" ;;
-        aarch64|arm64) goarch="arm64"; sha="$GOLANGCI_LINT_SHA256_ARM64" ;;
-        *)
-            echo "bootstrap: unsupported architecture $(uname -m)" >&2
-            exit 1
-            ;;
-    esac
-    if missing curl; then pkg_install curl curl curl curl; fi
-    name="golangci-lint-${GOLANGCI_LINT_VERSION}-linux-${goarch}"
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/$name.tar.gz" \
-        "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/${name}.tar.gz"
-    verify_sha256 "$tmp/$name.tar.gz" "$sha"
-    tar -xzf "$tmp/$name.tar.gz" -C "$tmp"
-    $SUDO install -m 0755 "$tmp/$name/golangci-lint" /usr/local/bin/golangci-lint
-    rm -rf "$tmp"
-}
-
-ensure_golangci_lint() {
-    if ! missing golangci-lint; then return 0; fi
-    detect_pkgmgr
-    case "$PKGMGR" in
-        apt) install_golangci_lint_release ;;
-        *) pkg_install golangci-lint golangci-lint golangci-lint golangci-lint ;;
-    esac
-}
-
-main() {
-    cd "$ROOT"
-
-    # Base tooling
-    if missing git; then pkg_install git git git git; fi
-    if missing make; then pkg_install gnumake make make make; fi
-
-    # Go toolchain and linter
-    if missing go; then pkg_install go golang go go; fi
-    ensure_golangci_lint
-
-    go mod download
-
-    echo "bootstrap complete"
-}
-
-main "$@"

script/check

@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-# Generic: usually needs no adaptation.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
-    "$SCRIPT_DIR/fmt-check"
-}
-
-main "$@"

script/cibuild

@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs the checks
-# (make fmt-check, lint, test), so a successful build implies a green
-# repo. Generic: needs no adaptation. The Gitea workflow runs this on
-# push.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build .
-}
-
-main "$@"

script/docker

@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-# Generic: needs no adaptation.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/fmt

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/fmt: format all files (writes).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    gofmt -s -w .
-    goimports -w .
-    npx prettier --write --tab-width 4 static/js/*.js
-}
-
-main "$@"

script/fmt-check

@@ -1,17 +0,0 @@
-#!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    if [ -n "$(gofmt -l .)" ]; then
-        echo "Files not formatted:"
-        gofmt -l .
-        exit 1
-    fi
-}
-
-main "$@"

script/install-precommit

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/install-precommit: install the git pre-commit hook that runs
-# script/precommit. Our own extension to scripts-to-rule-them-all.
-# Generic: needs no adaptation.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
-    chmod +x .git/hooks/pre-commit
-    echo "pre-commit hook installed: runs script/precommit"
-}
-
-main "$@"

script/lint

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/lint: run the linter.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    golangci-lint run --config .golangci.yml ./...
-}
-
-main "$@"

script/precommit

@@ -1,21 +0,0 @@
-#!/bin/sh
-# script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all. Go repo
-# extras: go mod tidy must not change go.mod/go.sum.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    go mod tidy
-    git diff --exit-code -- go.mod go.sum || {
-        echo "precommit: go mod tidy changed go.mod/go.sum;" \
-            "stage the changes and retry" >&2
-        exit 1
-    }
-    "$SCRIPT_DIR/check"
-}
-
-main "$@"

script/projectname

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/projectname: output the name of this project. Our own
-# extension to scripts-to-rule-them-all. Other scripts that need the
-# name (e.g. script/docker) call this, so they can stay identical
-# across all repos.
-set -eu
-
-main() {
-    echo "upaas"
-}
-
-main "$@"

script/setup

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/setup: set up the repo for development after a fresh clone:
-# installs dependencies (script/bootstrap) and the git pre-commit hook.
-# Add any repo-specific initialization (db init, .env template) here.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/install-precommit"
-}
-
-main "$@"

script/test

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/test: run the test suite.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    go test -v -race -cover -timeout 30s ./...
-}
-
-main "$@"

templates/app_detail.html

@@ -154,6 +154,69 @@
         <div class="hidden">{{ .CSRFField }}</div>
     </div>
 
+    <!-- Registry Credentials -->
+    <div class="card p-6 mb-6">
+        <h2 class="section-title mb-4">Registry Credentials</h2>
+        <p class="text-sm text-gray-500 mb-3">Authenticate to private Docker registries when pulling base images during builds.</p>
+        {{if .RegistryCredentials}}
+        <div class="overflow-x-auto mb-4">
+            <table class="table">
+                <thead class="table-header">
+                    <tr>
+                        <th>Registry</th>
+                        <th>Username</th>
+                        <th>Password</th>
+                        <th class="text-right">Actions</th>
+                    </tr>
+                </thead>
+                <tbody class="table-body">
+                    {{range .RegistryCredentials}}
+                    <tr x-data="{ editing: false }">
+                        <template x-if="!editing">
+                            <td class="font-mono">{{.Registry}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="font-mono">{{.Username}}</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="font-mono text-gray-400">••••••••</td>
+                        </template>
+                        <template x-if="!editing">
+                            <td class="text-right">
+                                <button @click="editing = true" class="text-primary-600 hover:text-primary-800 text-sm mr-2">Edit</button>
+                                <form method="POST" action="/apps/{{$.App.ID}}/registry-credentials/{{.ID}}/delete" class="inline" x-data="confirmAction('Delete this registry credential?')" @submit="confirm($event)">
+                                    {{ $.CSRFField }}
+                                    <button type="submit" class="text-error-500 hover:text-error-700 text-sm">Delete</button>
+                                </form>
+                            </td>
+                        </template>
+                        <template x-if="editing">
+                            <td colspan="4">
+                                <form method="POST" action="/apps/{{$.App.ID}}/registry-credentials/{{.ID}}/edit" class="flex gap-2 items-center">
+                                    {{ $.CSRFField }}
+                                    <input type="text" name="registry" value="{{.Registry}}" required class="input flex-1 font-mono text-sm" placeholder="registry.example.com">
+                                    <input type="text" name="username" value="{{.Username}}" required class="input flex-1 font-mono text-sm" placeholder="username">
+                                    <input type="password" name="password" required class="input flex-1 font-mono text-sm" placeholder="password">
+                                    <button type="submit" class="btn-primary text-sm">Save</button>
+                                    <button type="button" @click="editing = false" class="text-gray-500 hover:text-gray-700 text-sm">Cancel</button>
+                                </form>
+                            </td>
+                        </template>
+                    </tr>
+                    {{end}}
+                </tbody>
+            </table>
+        </div>
+        {{end}}
+        <form method="POST" action="/apps/{{.App.ID}}/registry-credentials" class="flex flex-col sm:flex-row gap-2">
+            {{ .CSRFField }}
+            <input type="text" name="registry" placeholder="registry.example.com" required class="input flex-1 font-mono text-sm">
+            <input type="text" name="username" placeholder="username" required class="input flex-1 font-mono text-sm">
+            <input type="password" name="password" placeholder="password" required class="input flex-1 font-mono text-sm">
+            <button type="submit" class="btn-primary">Add</button>
+        </form>
+    </div>
+
     <!-- Labels -->
     <div class="card p-6 mb-6">
         <h2 class="section-title mb-4">Docker Labels</h2>

templates/app_edit.html

@@ -114,38 +114,6 @@
                 >
             </div>
 
-            <hr class="border-gray-200">
-
-            <h3 class="text-lg font-medium text-gray-900">Resource Limits</h3>
-
-            <div class="grid grid-cols-2 gap-4">
-                <div class="form-group">
-                    <label for="cpu_limit" class="label">CPU Limit (cores)</label>
-                    <input
-                        type="text"
-                        id="cpu_limit"
-                        name="cpu_limit"
-                        value="{{if .App.CPULimit.Valid}}{{.App.CPULimit.Float64}}{{end}}"
-                        class="input"
-                        placeholder="e.g. 0.5, 1, 2"
-                    >
-                    <p class="text-sm text-gray-500 mt-1">Number of CPU cores (e.g. 0.5 = half a core)</p>
-                </div>
-
-                <div class="form-group">
-                    <label for="memory_limit" class="label">Memory Limit</label>
-                    <input
-                        type="text"
-                        id="memory_limit"
-                        name="memory_limit"
-                        value="{{if .App.MemoryLimit.Valid}}{{formatMemoryBytes .App.MemoryLimit.Int64}}{{end}}"
-                        class="input"
-                        placeholder="e.g. 256m, 1g"
-                    >
-                    <p class="text-sm text-gray-500 mt-1">Memory with unit suffix (k, m, g) or plain bytes</p>
-                </div>
-            </div>
-
             <div class="flex justify-end gap-3 pt-4">
                 <a href="/apps/{{.App.ID}}" class="btn-secondary">Cancel</a>
                 <button type="submit" class="btn-primary">Save Changes</button>

templates/templates.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"html/template"
 	"io"
-	"strconv"
 	"sync"
 )
 
@@ -24,34 +23,6 @@ var (
 	templatesMutex sync.RWMutex
 )
 
-// templateFuncs returns the custom template function map.
-func templateFuncs() template.FuncMap {
-	return template.FuncMap{
-		"formatMemoryBytes": formatMemoryBytes,
-	}
-}
-
-// Memory unit constants.
-const (
-	memGigabyte = 1024 * 1024 * 1024
-	memMegabyte = 1024 * 1024
-	memKilobyte = 1024
-)
-
-// formatMemoryBytes formats bytes into a human-readable string with unit suffix.
-func formatMemoryBytes(bytes int64) string {
-	switch {
-	case bytes >= memGigabyte && bytes%memGigabyte == 0:
-		return strconv.FormatInt(bytes/memGigabyte, 10) + "g"
-	case bytes >= memMegabyte && bytes%memMegabyte == 0:
-		return strconv.FormatInt(bytes/memMegabyte, 10) + "m"
-	case bytes >= memKilobyte && bytes%memKilobyte == 0:
-		return strconv.FormatInt(bytes/memKilobyte, 10) + "k"
-	default:
-		return strconv.FormatInt(bytes, 10)
-	}
-}
-
 // initTemplates parses base template and creates cloned templates for each page.
 func initTemplates() {
 	templatesMutex.Lock()
@@ -61,10 +32,8 @@ func initTemplates() {
 		return
 	}
 
-	// Parse base template with shared components and custom functions
-	baseTemplate = template.Must(
-		template.New("base.html").Funcs(templateFuncs()).ParseFS(templatesRaw, "base.html"),
-	)
+	// Parse base template with shared components
+	baseTemplate = template.Must(template.ParseFS(templatesRaw, "base.html"))
 
 	// Pages that extend base
 	pages := []string{

templates/templates_test.go

@@ -1,34 +0,0 @@
-package templates //nolint:testpackage // tests unexported formatMemoryBytes
-
-import (
-	"testing"
-)
-
-func TestFormatMemoryBytes(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		bytes    int64
-		expected string
-	}{
-		{"gigabytes", 1024 * 1024 * 1024, "1g"},
-		{"two gigabytes", 2 * 1024 * 1024 * 1024, "2g"},
-		{"megabytes", 256 * 1024 * 1024, "256m"},
-		{"kilobytes", 512 * 1024, "512k"},
-		{"plain bytes", 12345, "12345"},
-		{"non-even megabytes", 256*1024*1024 + 1, "268435457"},
-		{"zero", 0, "0"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := formatMemoryBytes(tt.bytes)
-			if got != tt.expected {
-				t.Errorf("formatMemoryBytes(%d) = %q, want %q", tt.bytes, got, tt.expected)
-			}
-		})
-	}
-}