WP-00: project skeleton with three-level test harness

Cargo workspace (domain, application, infrastructure, api), axum health endpoint
with SPA fallback, Vue 3 + Tailwind frontend, Vitest, Playwright, Makefile,
Gitea Actions CI and README.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,12 @@
+# Backend configuration (copy to backend/.env for local development)
+DATABASE_URL=sqlite://data/monitoring.db?mode=rwc
+JWT_SECRET=change-me-to-a-long-random-string
+BIND=127.0.0.1:8080
+# Created on first start if no user exists
+BOOTSTRAP_ADMIN_EMAIL=admin@example.com
+BOOTSTRAP_ADMIN_PASSWORD=change-me-min-12-chars
+# Set to true behind HTTPS so the refresh cookie is marked Secure
+COOKIE_SECURE=false
+# Directory with the built frontend (served as SPA fallback)
+FRONTEND_DIR=../frontend/dist
+RUST_LOG=info,sqlx=warn

.gitea/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with: { components: rustfmt, clippy }
+      - uses: Swatinem/rust-cache@v2
+        with: { workspaces: backend }
+      - run: cd backend && cargo fmt --check && cargo clippy --workspace --all-targets -- -D warnings
+      - run: cd backend && cargo test --workspace
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: npm, cache-dependency-path: frontend/package-lock.json }
+      - run: cd frontend && npm ci
+      - run: cd frontend && npm run lint && npm run typecheck && npm test
+
+  ui:
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with: { workspaces: backend }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: npm, cache-dependency-path: frontend/package-lock.json }
+      - run: cd frontend && npm ci && npx playwright install --with-deps chromium
+      - run: cd frontend && npm run test:ui

.gitignore

@@ -16,3 +16,13 @@ target/
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
+
+# Node / frontend
+node_modules/
+frontend/dist/
+frontend/playwright-report/
+frontend/test-results/
+
+# Runtime
+data/
+.env

Makefile

@@ -0,0 +1,33 @@
+.PHONY: dev dev-backend dev-frontend build test test-backend test-frontend test-ui lint fmt
+
+dev: ## run backend + frontend dev servers
+	@$(MAKE) -j2 dev-backend dev-frontend
+
+dev-backend:
+	cd backend && cargo run -p api
+
+dev-frontend:
+	cd frontend && npm run dev
+
+build: ## production build: frontend into frontend/dist, backend release binary
+	cd frontend && npm ci && npm run build
+	cd backend && cargo build --release -p api
+
+test: test-backend test-frontend test-ui
+
+test-backend:
+	cd backend && cargo test --workspace
+
+test-frontend:
+	cd frontend && npm test
+
+test-ui:
+	cd frontend && npm run test:ui
+
+lint:
+	cd backend && cargo fmt --check && cargo clippy --workspace --all-targets -- -D warnings
+	cd frontend && npm run lint && npm run typecheck
+
+fmt:
+	cd backend && cargo fmt
+	cd frontend && npm run format

README.md

@@ -1,2 +1,45 @@
-# Infrastruktur-Monitoring-System
+# SoftVisor Infrastructure Monitoring System
 
+Web application to monitor and manage the SoftVisor Debian root server: OS/package updates,
+vulnerabilities, backups of the Gitea/Postgres workloads on microk8s, and user management.
+See [ROADMAP.md](ROADMAP.md) for the plan and [CLAUDE.md](CLAUDE.md) for the constraints.
+
+## Stack
+
+- Backend: Rust, axum, sqlx (SQLite), clean architecture in four crates (`backend/crates/*`)
+- Frontend: Vue 3 + TypeScript, Vite, Tailwind CSS, Pinia, Vue Router (`frontend/`)
+- Tests: `cargo test` (unit + integration), Vitest (components/stores), Playwright (UI)
+
+## Development
+
+Requirements: Rust stable, Node 22+, `make`.
+
+```bash
+cp .env.example backend/.env      # then edit JWT_SECRET and the bootstrap admin
+cd frontend && npm ci && npx playwright install chromium && cd ..
+make dev                          # backend on :8080, frontend on :5173 (proxies /api)
+```
+
+| Command              | What it does                                              |
+|----------------------|-----------------------------------------------------------|
+| `make test`          | backend, frontend unit and Playwright UI tests            |
+| `make test-backend`  | `cargo test --workspace`                                  |
+| `make test-frontend` | Vitest                                                    |
+| `make test-ui`       | Playwright (starts backend with in-memory DB + Vite)      |
+| `make lint`          | rustfmt, clippy, eslint, prettier, vue-tsc                |
+| `make build`         | production frontend build + release binary                |
+
+## TDD workflow
+
+Every feature starts with its tests:
+
+1. List the unit, integration and UI tests the feature needs.
+2. Write them so they fail (`backend/crates/*/src/**` unit tests, `backend/crates/api/tests/`
+   integration tests, `frontend/src/**/*.test.ts` and `frontend/e2e/*.spec.ts`).
+3. Implement the smallest code that makes them pass, then refactor.
+4. Commit and push.
+
+## First admin
+
+On start the backend creates an admin user from `BOOTSTRAP_ADMIN_EMAIL` /
+`BOOTSTRAP_ADMIN_PASSWORD` if no user exists yet.

ROADMAP.md

@@ -116,13 +116,13 @@ Each WP follows the same TDD sequence:
 - Cargo workspace with the four crates, `axum` hello endpoint, `/healthz`
 - Vue 3 + Vite + Tailwind + TypeScript + Pinia + Router scaffold
 - SQLite + `sqlx` migrations setup, config loading from env / `.env`
-- `justfile`/Makefile: `dev`, `build`, `test`, `lint` (clippy, rustfmt, eslint, prettier)
+- `Makefile`: `dev`, `build`, `test`, `lint` (clippy, rustfmt, eslint, prettier)
 - CI: GitHub/Gitea Actions running lint + test
 - Test harness: `cargo test` layout per crate, integration test helper (test app + temp
-  SQLite), Vitest + Vue Test Utils, Playwright with a `just test-ui` target; one sample test
+  SQLite), Vitest + Vue Test Utils, Playwright with a `make test-ui` target; one sample test
   of each kind runs in CI
 - README with dev setup and the TDD workflow
-- **Done when:** `just dev` serves frontend + backend, `just test` runs unit, integration
+- **Done when:** `make dev` serves frontend + backend, `make test` runs unit, integration
   and UI tests, CI green
 
 #### WP-01 Authentication & user management (M)
@@ -263,13 +263,13 @@ a regular user can log in with restricted rights. Everything else is navigation
 
 | WP | Scope in this milestone |
 |----|-------------------------|
-| WP-00 | Full scope: workspace, frontend scaffold, SQLite + migrations, `justfile`, CI, test harness (cargo test, Vitest, Playwright) |
+| WP-00 | Full scope: workspace, frontend scaffold, SQLite + migrations, `Makefile`, CI, test harness (cargo test, Vitest, Playwright) |
 | WP-01 | Full scope: Argon2id, JWT + rotating refresh cookie, roles, bootstrap admin, user CRUD UI, login page, route guards, rate limiting, auth audit log |
 | WP-02 (partial) | Only the application shell: sidebar navigation with placeholder pages, global error handling, toasts, loading/empty states. Secret storage, scheduler and SMTP stay in Milestone 2 |
 
 **Deliverables**
 
-- `just dev` starts backend + frontend; `just test` runs unit, integration and UI tests; CI green
+- `make dev` starts backend + frontend; `make test` runs unit, integration and UI tests; CI green
 - Login / logout / token refresh work end to end (Playwright flow)
 - Admin: list, create, edit, deactivate users, reset password
 - Non-admin: can log in, sees the shell, gets 403 on admin routes (API and UI)
@@ -308,22 +308,32 @@ WP-40, WP-41, WP-42.
 
 ## 5. Open questions (answer before the affected WP)
 
-The server is reachable via `ssh softvisor`. Questions 2, 3 and 6 can be answered by
+The server is reachable via `ssh softvisor` (as root). Findings from the inspection on
-inspecting the host directly (`/etc/os-release`, kubeconfig location, `kubectl get all -A`,
+2026-09-02, which answer questions 2, 3, 4 (partly), 6 and 10:
-`dpkg -l`, `snap list`) instead of asking.
+
+- Debian 12 (bookworm), kernel 6.1, ~433 dpkg packages, snaps: `microk8s`, `core20`, `snapd`
+- Kubernetes: **microk8s v1.32** (snap); kubectl via `/snap/bin/microk8s kubectl`;
+  kubeconfig at `/var/snap/microk8s/current/credentials/client.config` (group `microk8s`)
+- Namespaces: `gitea`, `cert-manager`, `ingress`, `metallb-system`, `inlets`
+- Gitea: `deployment/gitea` in ns `gitea`, PVC `gitea-shared-storage` (10Gi, hostpath);
+  Postgres: `statefulset/gitea-postgresql`, PVC `data-gitea-postgresql-0`; Valkey
+  `statefulset/gitea-valkey-primary`. Old unused PVCs from a former HA setup exist.
+  All PVCs use `microk8s-hostpath`, so backups can read data from the host filesystem.
+- Tools present: `smbclient`, `helm` (needs kubeconfig); **Trivy not installed**
+- Git remote is the company Gitea (`git.dev.softvisor.de`) → CI uses Gitea Actions
 
 | # | Question | Affects | Assumption if unanswered |
 |---|----------|---------|--------------------------|
 | 1 | Does the backend run directly on the Debian host (systemd) or inside the cluster? | WP-00, WP-11, WP-42 | Directly on the host as systemd service |
-| 2 | Kubernetes distribution (k3s, kubeadm, microk8s)? Path to kubeconfig? | WP-12 | k3s, `/etc/rancher/k3s/k3s.yaml` |
+| 2 | ~~Kubernetes distribution?~~ **Answered:** microk8s 1.32, kubeconfig `/var/snap/microk8s/current/credentials/client.config` | WP-12 | – |
-| 3 | How is Gitea deployed (Helm chart, plain manifests)? Namespace, PVC names, Postgres in-cluster or external? | WP-12, WP-31 | Helm chart in namespace `gitea`, Postgres as in-cluster StatefulSet |
+| 3 | ~~How is Gitea deployed?~~ **Answered:** ns `gitea`, `deployment/gitea` + PVC `gitea-shared-storage`, `statefulset/gitea-postgresql` + PVC `data-gitea-postgresql-0`, hostpath storage | WP-12, WP-31 | – |
-| 4 | Is Trivy acceptable as external dependency (installed on host)? | WP-20 | Yes |
+| 4 | Is Trivy acceptable as external dependency? It is **not yet installed** on the host | WP-20 | Yes, installed in WP-20 |
 | 5 | SMTP relay available for notifications? Sender address? | WP-02, WP-21 | Yes, configured via settings UI |
-| 6 | "Applications" beyond apt packages: are there non-apt installs (snap, binaries, Docker outside k8s) to inventory? | WP-10 | Only apt packages + k8s workloads |
+| 6 | ~~Non-apt installs?~~ **Answered:** snaps (`microk8s`, `core20`, `snapd`) and `/usr/local/bin/helm`; snaps will be inventoried in WP-10 | WP-10 | – |
 | 7 | Is unattended OS major-version upgrade (e.g. Debian 12 → 13) in scope, or only `apt` upgrades within a release? | WP-11 | Only in-release upgrades; major upgrade is documented, not automated |
 | 8 | Backup encryption required, or is transport encryption to the target enough? | WP-31 | Optional per strategy, off by default |
 | 9 | Should non-admin users be pure viewers or also able to trigger scans/backups? | WP-01 | Viewers only; all mutating actions are admin |
-| 10 | Git hosting for this project itself: GitHub or the company Gitea? (affects CI syntax) | WP-00 | Whatever `origin` points to; GitHub Actions syntax, which Gitea Actions also runs |
+| 10 | ~~Git hosting?~~ **Answered:** company Gitea → Gitea Actions (`.gitea/workflows`) | WP-00 | – |
 
 ---
 

backend/Cargo.toml

@@ -0,0 +1,39 @@
+[workspace]
+resolver = "2"
+members = ["crates/domain", "crates/application", "crates/infrastructure", "crates/api"]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2021"
+license = "Proprietary"
+
+[workspace.dependencies]
+domain = { path = "crates/domain" }
+application = { path = "crates/application" }
+infrastructure = { path = "crates/infrastructure" }
+
+anyhow = "1"
+async-trait = "0.1"
+axum = { version = "0.8", features = ["macros"] }
+base64 = "0.22"
+chrono = { version = "0.4", features = ["serde"] }
+dotenvy = "0.15"
+http-body-util = "0.1"
+jsonwebtoken = "9"
+argon2 = "0.5"
+rand = "0.8"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+sqlx = { version = "0.8", features = ["runtime-tokio", "sqlite", "chrono", "uuid", "migrate"] }
+thiserror = "2"
+tokio = { version = "1", features = ["full"] }
+tower = { version = "0.5", features = ["util"] }
+tower-http = { version = "0.6", features = ["fs", "trace", "cors"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+utoipa = { version = "5", features = ["axum_extras", "uuid", "chrono"] }
+uuid = { version = "1", features = ["v4", "serde"] }
+
+[workspace.lints.clippy]
+all = "warn"

backend/crates/api/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "api"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[[bin]]
+name = "monitoring-server"
+path = "src/main.rs"
+
+[dependencies]
+domain.workspace = true
+application.workspace = true
+infrastructure.workspace = true
+anyhow.workspace = true
+axum.workspace = true
+chrono.workspace = true
+dotenvy.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sqlx.workspace = true
+tokio.workspace = true
+tower-http.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+utoipa.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+http-body-util.workspace = true
+tower.workspace = true
+
+[lints]
+workspace = true

backend/crates/api/src/config.rs

@@ -0,0 +1,35 @@
+//! Runtime configuration read from environment variables (see `.env.example`).
+use std::net::SocketAddr;
+
+#[derive(Clone, Debug)]
+pub struct Config {
+    pub database_url: String,
+    pub jwt_secret: String,
+    pub bind: SocketAddr,
+    pub bootstrap_admin: Option<(String, String)>,
+    pub cookie_secure: bool,
+    pub frontend_dir: String,
+}
+
+impl Config {
+    pub fn from_env() -> anyhow::Result<Self> {
+        let env = |k: &str| std::env::var(k).ok().filter(|v| !v.is_empty());
+        let jwt_secret =
+            env("JWT_SECRET").ok_or_else(|| anyhow::anyhow!("JWT_SECRET is required"))?;
+        anyhow::ensure!(
+            jwt_secret.len() >= 32,
+            "JWT_SECRET must be at least 32 characters"
+        );
+        Ok(Self {
+            database_url: env("DATABASE_URL")
+                .unwrap_or_else(|| "sqlite://data/monitoring.db?mode=rwc".into()),
+            jwt_secret,
+            bind: env("BIND")
+                .unwrap_or_else(|| "127.0.0.1:8080".into())
+                .parse()?,
+            bootstrap_admin: env("BOOTSTRAP_ADMIN_EMAIL").zip(env("BOOTSTRAP_ADMIN_PASSWORD")),
+            cookie_secure: env("COOKIE_SECURE").is_some_and(|v| v == "true" || v == "1"),
+            frontend_dir: env("FRONTEND_DIR").unwrap_or_else(|| "../frontend/dist".into()),
+        })
+    }
+}

backend/crates/api/src/lib.rs

@@ -0,0 +1,28 @@
+//! HTTP API layer (axum). `build_app` is used by both the binary and the integration tests.
+pub mod config;
+pub mod test_support;
+
+use axum::{routing::get, Json, Router};
+use tower_http::services::{ServeDir, ServeFile};
+use tower_http::trace::TraceLayer;
+
+pub use config::Config;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub cfg: Config,
+}
+
+pub fn build_app(state: AppState) -> Router {
+    let index = format!("{}/index.html", state.cfg.frontend_dir);
+    let spa = ServeDir::new(&state.cfg.frontend_dir).not_found_service(ServeFile::new(index));
+    Router::new()
+        .route("/healthz", get(healthz))
+        .fallback_service(spa)
+        .layer(TraceLayer::new_for_http())
+        .with_state(state)
+}
+
+async fn healthz() -> Json<serde_json::Value> {
+    Json(serde_json::json!({ "status": "ok" }))
+}

backend/crates/api/src/main.rs

@@ -0,0 +1,15 @@
+use api::{build_app, AppState, Config};
+use tracing_subscriber::EnvFilter;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    let _ = dotenvy::dotenv();
+    tracing_subscriber::fmt()
+        .with_env_filter(EnvFilter::try_from_default_env().unwrap_or_else(|_| "info".into()))
+        .init();
+    let cfg = Config::from_env()?;
+    let listener = tokio::net::TcpListener::bind(cfg.bind).await?;
+    tracing::info!("listening on http://{}", cfg.bind);
+    axum::serve(listener, build_app(AppState { cfg })).await?;
+    Ok(())
+}

backend/crates/api/src/test_support.rs

@@ -0,0 +1,18 @@
+//! Helpers to build a fully wired app on an in-memory database for integration tests.
+use crate::{build_app, AppState, Config};
+use axum::Router;
+
+pub fn test_config() -> Config {
+    Config {
+        database_url: "sqlite::memory:".into(),
+        jwt_secret: "test-secret-test-secret-test-secret-1234".into(),
+        bind: "127.0.0.1:0".parse().unwrap(),
+        bootstrap_admin: None,
+        cookie_secure: false,
+        frontend_dir: "/nonexistent".into(),
+    }
+}
+
+pub async fn build_test_app() -> Router {
+    build_app(AppState { cfg: test_config() })
+}

backend/crates/api/tests/common/mod.rs

@@ -0,0 +1,89 @@
+//! Shared helpers for API integration tests: in-memory SQLite, request helpers.
+#![allow(dead_code)]
+
+use axum::body::Body;
+use axum::http::{header, Request, StatusCode};
+use axum::Router;
+use http_body_util::BodyExt;
+use tower::ServiceExt;
+
+pub struct Res {
+    pub status: StatusCode,
+    pub json: serde_json::Value,
+    pub headers: axum::http::HeaderMap,
+}
+
+pub async fn test_app() -> Router {
+    api::test_support::build_test_app().await
+}
+
+async fn send(app: &Router, req: Request<Body>) -> Res {
+    let res = app.clone().oneshot(req).await.unwrap();
+    let status = res.status();
+    let headers = res.headers().clone();
+    let bytes = res.into_body().collect().await.unwrap().to_bytes();
+    let json = serde_json::from_slice(&bytes).unwrap_or(serde_json::Value::Null);
+    Res {
+        status,
+        json,
+        headers,
+    }
+}
+
+fn with_auth(
+    mut b: axum::http::request::Builder,
+    token: Option<&str>,
+) -> axum::http::request::Builder {
+    if let Some(t) = token {
+        b = b.header(header::AUTHORIZATION, format!("Bearer {t}"));
+    }
+    b
+}
+
+pub async fn get(app: &Router, path: &str, token: Option<&str>) -> Res {
+    let req = with_auth(Request::get(path), token)
+        .body(Body::empty())
+        .unwrap();
+    send(app, req).await
+}
+
+pub async fn send_json(
+    app: &Router,
+    method: &str,
+    path: &str,
+    body: serde_json::Value,
+    token: Option<&str>,
+) -> Res {
+    let req = with_auth(Request::builder().method(method).uri(path), token)
+        .header(header::CONTENT_TYPE, "application/json")
+        .body(Body::from(body.to_string()))
+        .unwrap();
+    send(app, req).await
+}
+
+pub async fn post(app: &Router, path: &str, body: serde_json::Value, token: Option<&str>) -> Res {
+    send_json(app, "POST", path, body, token).await
+}
+
+pub async fn patch(app: &Router, path: &str, body: serde_json::Value, token: Option<&str>) -> Res {
+    send_json(app, "PATCH", path, body, token).await
+}
+
+/// POST with a `Cookie` header (used for refresh/logout which read the refresh cookie).
+pub async fn post_with_cookie(app: &Router, path: &str, cookie: &str) -> Res {
+    let req = Request::post(path)
+        .header(header::COOKIE, cookie)
+        .body(Body::empty())
+        .unwrap();
+    send(app, req).await
+}
+
+/// Extract `name=value` of a Set-Cookie header.
+pub fn cookie_value(res: &Res, name: &str) -> Option<String> {
+    res.headers
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .filter_map(|v| v.to_str().ok())
+        .find(|c| c.starts_with(&format!("{name}=")))
+        .map(|c| c.split(';').next().unwrap().to_string())
+}

backend/crates/api/tests/healthz.rs

@@ -0,0 +1,12 @@
+//! WP-00 sample integration test: the health endpoint answers 200 with `{"status":"ok"}`.
+mod common;
+
+use axum::http::StatusCode;
+
+#[tokio::test]
+async fn healthz_returns_ok() {
+    let app = common::test_app().await;
+    let res = common::get(&app, "/healthz", None).await;
+    assert_eq!(res.status, StatusCode::OK);
+    assert_eq!(res.json["status"], "ok");
+}

backend/crates/application/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "application"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+domain.workspace = true
+async-trait.workspace = true
+base64.workspace = true
+chrono.workspace = true
+rand.workspace = true
+sha2.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+tokio.workspace = true
+
+[lints]
+workspace = true

backend/crates/application/src/lib.rs

@@ -0,0 +1 @@
+//! application layer

backend/crates/domain/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "domain"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+async-trait.workspace = true
+chrono.workspace = true
+serde.workspace = true
+thiserror.workspace = true
+uuid.workspace = true
+
+[lints]
+workspace = true

backend/crates/domain/src/lib.rs

@@ -0,0 +1 @@
+//! domain layer

backend/crates/infrastructure/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "infrastructure"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+domain.workspace = true
+anyhow.workspace = true
+argon2.workspace = true
+async-trait.workspace = true
+chrono.workspace = true
+jsonwebtoken.workspace = true
+serde.workspace = true
+sqlx.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+tokio.workspace = true
+
+[lints]
+workspace = true

backend/crates/infrastructure/src/lib.rs

@@ -0,0 +1 @@
+//! infrastructure layer

frontend/.gitignore

@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?

frontend/.prettierrc

@@ -0,0 +1 @@
+{ "semi": false, "singleQuote": true, "printWidth": 100, "trailingComma": "all" }

frontend/.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["Vue.volar"]
+}

frontend/e2e/smoke.spec.ts

@@ -0,0 +1,7 @@
+import { test, expect } from '@playwright/test'
+
+test('app loads and shows backend health', async ({ page }) => {
+  await page.goto('/')
+  await expect(page.getByText('SoftVisor Monitoring')).toBeVisible()
+  await expect(page.getByTestId('backend-status')).toContainText('ok')
+})

frontend/eslint.config.js

@@ -0,0 +1,9 @@
+import pluginVue from 'eslint-plugin-vue'
+import { defineConfigWithVueTs, vueTsConfigs } from '@vue/eslint-config-typescript'
+
+export default defineConfigWithVueTs(
+  { ignores: ['dist/**', 'node_modules/**', 'playwright-report/**', 'test-results/**'] },
+  pluginVue.configs['flat/essential'],
+  vueTsConfigs.recommended,
+  { rules: { 'vue/multi-word-component-names': 'off' } },
+)

frontend/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>frontend</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

frontend/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "frontend",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc -b && vite build",
+    "preview": "vite preview",
+    "test": "vitest run",
+    "test:ui": "playwright test",
+    "lint": "eslint . && prettier --check src e2e",
+    "format": "prettier --write src e2e",
+    "typecheck": "vue-tsc -b"
+  },
+  "dependencies": {
+    "@tailwindcss/vite": "^4.3.3",
+    "pinia": "^4.0.3",
+    "tailwindcss": "^4.3.3",
+    "vue": "^3.5.41",
+    "vue-router": "^5.3.1"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.62.1",
+    "@types/node": "^24.13.3",
+    "@vitejs/plugin-vue": "^6.0.8",
+    "@vitest/coverage-v8": "^4.1.11",
+    "@vue/eslint-config-typescript": "^14.9.0",
+    "@vue/test-utils": "^2.5.0",
+    "@vue/tsconfig": "^0.9.1",
+    "eslint": "^10.9.1",
+    "eslint-plugin-vue": "^10.10.0",
+    "jsdom": "^29.1.1",
+    "prettier": "^3.9.6",
+    "typescript": "~6.0.2",
+    "vite": "^8.2.2",
+    "vitest": "^4.1.11",
+    "vue-tsc": "^3.3.11"
+  }
+}

frontend/playwright.config.ts

@@ -0,0 +1,30 @@
+import { defineConfig } from '@playwright/test'
+
+// UI tests run against the Vite dev server, which proxies /api to a backend started
+// with a throw-away SQLite database and a known bootstrap admin.
+export default defineConfig({
+  testDir: './e2e',
+  timeout: 30_000,
+  fullyParallel: false,
+  workers: 1,
+  reporter: 'list',
+  use: { baseURL: 'http://127.0.0.1:5173', trace: 'retain-on-failure' },
+  webServer: [
+    {
+      command: 'cargo run -q -p api',
+      cwd: '../backend',
+      url: 'http://127.0.0.1:8080/healthz',
+      reuseExistingServer: false,
+      timeout: 180_000,
+      env: {
+        DATABASE_URL: 'sqlite::memory:',
+        JWT_SECRET: 'e2e-test-secret-do-not-use-in-production',
+        BOOTSTRAP_ADMIN_EMAIL: 'admin@example.com',
+        BOOTSTRAP_ADMIN_PASSWORD: 'admin-password-123',
+        BIND: '127.0.0.1:8080',
+        RUST_LOG: 'warn',
+      },
+    },
+    { command: 'npm run dev', url: 'http://127.0.0.1:5173', reuseExistingServer: false, timeout: 60_000 },
+  ],
+})

frontend/public/icons.svg

@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <symbol id="bluesky-icon" viewBox="0 0 16 17">
+    <g clip-path="url(#bluesky-clip)"><path fill="#08060d" d="M7.75 7.735c-.693-1.348-2.58-3.86-4.334-5.097-1.68-1.187-2.32-.981-2.74-.79C.188 2.065.1 2.812.1 3.251s.241 3.602.398 4.13c.52 1.744 2.367 2.333 4.07 2.145-2.495.37-4.71 1.278-1.805 4.512 3.196 3.309 4.38-.71 4.987-2.746.608 2.036 1.307 5.91 4.93 2.746 2.72-2.746.747-4.143-1.747-4.512 1.702.189 3.55-.4 4.07-2.145.156-.528.397-3.691.397-4.13s-.088-1.186-.575-1.406c-.42-.19-1.06-.395-2.741.79-1.755 1.24-3.64 3.752-4.334 5.099"/></g>
+    <defs><clipPath id="bluesky-clip"><path fill="#fff" d="M.1.85h15.3v15.3H.1z"/></clipPath></defs>
+  </symbol>
+  <symbol id="discord-icon" viewBox="0 0 20 19">
+    <path fill="#08060d" d="M16.224 3.768a14.5 14.5 0 0 0-3.67-1.153c-.158.286-.343.67-.47.976a13.5 13.5 0 0 0-4.067 0c-.128-.306-.317-.69-.476-.976A14.4 14.4 0 0 0 3.868 3.77C1.546 7.28.916 10.703 1.231 14.077a14.7 14.7 0 0 0 4.5 2.306q.545-.748.965-1.587a9.5 9.5 0 0 1-1.518-.74q.191-.14.372-.293c2.927 1.369 6.107 1.369 8.999 0q.183.152.372.294-.723.437-1.52.74.418.838.963 1.588a14.6 14.6 0 0 0 4.504-2.308c.37-3.911-.63-7.302-2.644-10.309m-9.13 8.234c-.878 0-1.599-.82-1.599-1.82 0-.998.705-1.82 1.6-1.82.894 0 1.614.82 1.599 1.82.001 1-.705 1.82-1.6 1.82m5.91 0c-.878 0-1.599-.82-1.599-1.82 0-.998.705-1.82 1.6-1.82.893 0 1.614.82 1.599 1.82 0 1-.706 1.82-1.6 1.82"/>
+  </symbol>
+  <symbol id="documentation-icon" viewBox="0 0 21 20">
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="m15.5 13.333 1.533 1.322c.645.555.967.833.967 1.178s-.322.623-.967 1.179L15.5 18.333m-3.333-5-1.534 1.322c-.644.555-.966.833-.966 1.178s.322.623.966 1.179l1.534 1.321"/>
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M17.167 10.836v-4.32c0-1.41 0-2.117-.224-2.68-.359-.906-1.118-1.621-2.08-1.96-.599-.21-1.349-.21-2.848-.21-2.623 0-3.935 0-4.983.369-1.684.591-3.013 1.842-3.641 3.428C3 6.449 3 7.684 3 10.154v2.122c0 2.558 0 3.838.706 4.726q.306.383.713.671c.76.536 1.79.64 3.581.66"/>
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M3 10a2.78 2.78 0 0 1 2.778-2.778c.555 0 1.209.097 1.748-.047.48-.129.854-.503.982-.982.145-.54.048-1.194.048-1.749a2.78 2.78 0 0 1 2.777-2.777"/>
+  </symbol>
+  <symbol id="github-icon" viewBox="0 0 19 19">
+    <path fill="#08060d" fill-rule="evenodd" d="M9.356 1.85C5.05 1.85 1.57 5.356 1.57 9.694a7.84 7.84 0 0 0 5.324 7.44c.387.079.528-.168.528-.376 0-.182-.013-.805-.013-1.454-2.165.467-2.616-.935-2.616-.935-.349-.91-.864-1.143-.864-1.143-.71-.48.051-.48.051-.48.787.051 1.2.805 1.2.805.695 1.194 1.817.857 2.268.649.064-.507.27-.857.49-1.052-1.728-.182-3.545-.857-3.545-3.87 0-.857.31-1.558.8-2.104-.078-.195-.349-1 .077-2.078 0 0 .657-.208 2.14.805a7.5 7.5 0 0 1 1.946-.26c.657 0 1.328.092 1.946.26 1.483-1.013 2.14-.805 2.14-.805.426 1.078.155 1.883.078 2.078.502.546.799 1.247.799 2.104 0 3.013-1.818 3.675-3.558 3.87.284.247.528.714.528 1.454 0 1.052-.012 1.896-.012 2.156 0 .208.142.455.528.377a7.84 7.84 0 0 0 5.324-7.441c.013-4.338-3.48-7.844-7.773-7.844" clip-rule="evenodd"/>
+  </symbol>
+  <symbol id="social-icon" viewBox="0 0 20 20">
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M12.5 6.667a4.167 4.167 0 1 0-8.334 0 4.167 4.167 0 0 0 8.334 0"/>
+    <path fill="none" stroke="#aa3bff" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.35" d="M2.5 16.667a5.833 5.833 0 0 1 8.75-5.053m3.837.474.513 1.035c.07.144.257.282.414.309l.93.155c.596.1.736.536.307.965l-.723.73a.64.64 0 0 0-.152.531l.207.903c.164.715-.213.991-.84.618l-.872-.52a.63.63 0 0 0-.577 0l-.872.52c-.624.373-1.003.094-.84-.618l.207-.903a.64.64 0 0 0-.152-.532l-.723-.729c-.426-.43-.289-.864.306-.964l.93-.156a.64.64 0 0 0 .412-.31l.513-1.034c.28-.562.735-.562 1.012 0"/>
+  </symbol>
+  <symbol id="x-icon" viewBox="0 0 19 19">
+    <path fill="#08060d" fill-rule="evenodd" d="M1.893 1.98c.052.072 1.245 1.769 2.653 3.77l2.892 4.114c.183.261.333.48.333.486s-.068.089-.152.183l-.522.593-.765.867-3.597 4.087c-.375.426-.734.834-.798.905a1 1 0 0 0-.118.148c0 .01.236.017.664.017h.663l.729-.83c.4-.457.796-.906.879-.999a692 692 0 0 0 1.794-2.038c.034-.037.301-.34.594-.675l.551-.624.345-.392a7 7 0 0 1 .34-.374c.006 0 .93 1.306 2.052 2.903l2.084 2.965.045.063h2.275c1.87 0 2.273-.003 2.266-.021-.008-.02-1.098-1.572-3.894-5.547-2.013-2.862-2.28-3.246-2.273-3.266.008-.019.282-.332 2.085-2.38l2-2.274 1.567-1.782c.022-.028-.016-.03-.65-.03h-.674l-.3.342a871 871 0 0 1-1.782 2.025c-.067.075-.405.458-.75.852a100 100 0 0 1-.803.91c-.148.172-.299.344-.99 1.127-.304.343-.32.358-.345.327-.015-.019-.904-1.282-1.976-2.808L6.365 1.85H1.8zm1.782.91 8.078 11.294c.772 1.08 1.413 1.973 1.425 1.984.016.017.241.02 1.05.017l1.03-.004-2.694-3.766L7.796 5.75 5.722 2.852l-1.039-.004-1.039-.004z" clip-rule="evenodd"/>
+  </symbol>
+</svg>

frontend/src/App.vue

@@ -0,0 +1,5 @@
+<script setup lang="ts"></script>
+
+<template>
+  <RouterView />
+</template>

frontend/src/components/StatusBadge.test.ts

@@ -0,0 +1,14 @@
+import { mount } from '@vue/test-utils'
+import StatusBadge from './StatusBadge.vue'
+
+describe('StatusBadge', () => {
+  it('renders the label and an ok style', () => {
+    const w = mount(StatusBadge, { props: { status: 'ok', label: 'Backend' } })
+    expect(w.text()).toContain('Backend')
+    expect(w.classes().join(' ')).toContain('green')
+  })
+  it('renders an error style', () => {
+    const w = mount(StatusBadge, { props: { status: 'error', label: 'Backend' } })
+    expect(w.classes().join(' ')).toContain('red')
+  })
+})

frontend/src/components/StatusBadge.vue

@@ -0,0 +1,17 @@
+<script setup lang="ts">
+defineProps<{ status: 'ok' | 'error' | 'unknown'; label: string }>()
+const styles = {
+  ok: 'bg-green-100 text-green-800',
+  error: 'bg-red-100 text-red-800',
+  unknown: 'bg-gray-100 text-gray-700',
+}
+</script>
+
+<template>
+  <span
+    class="inline-flex items-center rounded-full px-2.5 py-0.5 text-xs font-medium"
+    :class="styles[status]"
+  >
+    {{ label }}
+  </span>
+</template>

frontend/src/main.ts

@@ -0,0 +1,7 @@
+import { createApp } from 'vue'
+import { createPinia } from 'pinia'
+import App from './App.vue'
+import { router } from './router'
+import './style.css'
+
+createApp(App).use(createPinia()).use(router).mount('#app')

frontend/src/pages/HealthPage.vue

@@ -0,0 +1,24 @@
+<script setup lang="ts">
+import { onMounted, ref } from 'vue'
+import StatusBadge from '../components/StatusBadge.vue'
+
+const status = ref<'ok' | 'error' | 'unknown'>('unknown')
+onMounted(async () => {
+  try {
+    const res = await fetch('/healthz')
+    status.value = res.ok ? 'ok' : 'error'
+  } catch {
+    status.value = 'error'
+  }
+})
+</script>
+
+<template>
+  <main class="mx-auto max-w-2xl p-8">
+    <h1 class="text-2xl font-semibold">SoftVisor Monitoring</h1>
+    <p class="mt-4 text-gray-600">
+      Backend:
+      <span data-testid="backend-status"><StatusBadge :status="status" :label="status" /></span>
+    </p>
+  </main>
+</template>

frontend/src/router.ts

@@ -0,0 +1,7 @@
+import { createRouter, createWebHistory } from 'vue-router'
+import HealthPage from './pages/HealthPage.vue'
+
+export const router = createRouter({
+  history: createWebHistory(),
+  routes: [{ path: '/', component: HealthPage }],
+})

frontend/src/style.css

@@ -0,0 +1 @@
+@import 'tailwindcss';

frontend/src/vite-env.d.ts

@@ -0,0 +1 @@
+/// <reference types="vite/client" />

frontend/tsconfig.app.json

@@ -0,0 +1,15 @@
+{
+  "extends": "@vue/tsconfig/tsconfig.dom.json",
+  "compilerOptions": {
+    "types": ["vitest/globals", "vite/client"],
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "allowArbitraryExtensions": true,
+
+    /* Linting */
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["src/**/*.ts", "src/**/*.tsx", "src/**/*.vue"]
+}

frontend/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.node.json" }
+  ]
+}

frontend/tsconfig.node.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "es2023",
+    "lib": ["ES2023"],
+    "types": ["node"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "module": "nodenext",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+
+    /* Linting */
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["vite.config.ts"]
+}

frontend/vite.config.ts

@@ -0,0 +1,18 @@
+/// <reference types="vitest/config" />
+import { defineConfig } from 'vite'
+import vue from '@vitejs/plugin-vue'
+import tailwindcss from '@tailwindcss/vite'
+
+export default defineConfig({
+  plugins: [vue(), tailwindcss()],
+  server: {
+    host: '127.0.0.1',
+    port: 5173,
+    proxy: { '/api': 'http://127.0.0.1:8080', '/healthz': 'http://127.0.0.1:8080' },
+  },
+  test: {
+    environment: 'jsdom',
+    include: ['src/**/*.test.ts'],
+    globals: true,
+  },
+})