feat: add combined docker+API service widgets for gitea/coolify/immich/n8n/umami/headscale

One new `service` widget type (nested discriminated union on `service`)
rather than six, so a single config entry shows both docker container
health and a service-specific stat (repo count, project list, photo
count, workflow count, active users, users/nodes) - avoiding the
overhead of configuring a docker widget and a separate service widget
per container. All six collectors hit the service's container name +
internal port directly on falcon_network, the same container-to-
container pattern just proven out for Traefik's own API, avoiding
vpn-only/hairpin-NAT entirely.

Also adds the public/private config split that was scoped in the
original project plan but never built: lib/config/public.ts strips
apiToken/apiKey/password fields before the config reaches the browser
via SSR or the WS config topic - required before any widget could
carry a real secret. Verified via a throwaway secret field that it's
absent from both the SSR HTML and the WS config:update frame.

Endpoint shapes verified live against the running gitea/coolify/immich/
n8n/umami/headscale containers before committing (unauthenticated
requests correctly 401/200 on every target route; gitea's
X-Total-Count header confirmed present).

.gitignore

@@ -23,6 +23,7 @@
 # misc
 .DS_Store
 *.pem
+.claude
 
 # debug
 npm-debug.log*

README.md

@@ -54,8 +54,8 @@ settings:
 
 theme:
   mode: dark              # dark | light | auto
-  variables:
+  # variables:             # override any --pn-* token from app/globals.css
-    --pn-accent: "#38bdf8"
+  #   --pn-accent: "#ff6b6b"
   # customCssPath: custom.css   # relative to config/, served at /api/theme/custom-css
 
 discovery:
@@ -87,9 +87,9 @@ reload; never exposed to the client. See `config/.env.example`.
 
 | `type`     | Required fields                    | Notes |
 |------------|-------------------------------------|-------|
-| `bookmark` | `name`, `href`                      | Static link card. Optional `description`. |
+| `bookmark` | `name`, `href`                      | Static link card. Optional `description`, `icon` (see below). |
 | `search`   | -                                    | Client-side search box. Optional `engines` (`duckduckgo`/`google`/`bing`, default `[duckduckgo]`), `defaultEngine`. |
-| `docker`   | `name`, `containerName`             | Status, uptime, CPU/mem, restart count via `dockerode`. Optional `href`, `showStats` (default `true`), `interval` (default `5s`). |
+| `docker`   | `name`, `containerName`             | Status, uptime, CPU/mem, restart count via `dockerode`. Optional `href`, `icon` (see below), `showStats` (default `true`), `interval` (default `5s`). |
 | `database` | `name`, `containerName`, `engine`   | Thin skin over the same Docker collector - `engine` is `postgres` or `redis`, used for icon/label only. `interval` default `10s`. |
 | `system`   | -                                    | Host CPU/mem/disk/network via `systeminformation`. Optional `name` (default `System`), `interval` (default `5s`). |
 | `http`     | `name`, `url`                        | HTTP health check with latency and consecutive-failure tracking. Optional `method` (default `GET`), `timeout` (default `5s`), `interval` (default `30s`), `expect.status` (default `200`). |
@@ -97,6 +97,14 @@ reload; never exposed to the client. See `config/.env.example`.
 
 `interval`/`timeout` values are duration strings: `500ms`, `5s`, `1m`, `1h`.
 
+`icon` on `docker`/`bookmark` widgets is a key into `lib/brand-icons.ts` (currently
+`traefik`, `coolify`, `gitea`, `docker`, `immich`, `n8n`, `passbolt`, `umami`,
+`postgresql`, `redis`, `headscale`), rendered monochrome so it doesn't compete
+with the accent color. `database` widgets pick their icon automatically from
+`engine`. Regenerate/extend the icon set with `python3 scripts/extract-brand-icons.py`
+after adding an entry to that script's `ICONS` map (path data comes from the
+CC0-licensed `simple-icons` package, bundled at build time - no runtime CDN calls).
+
 ### Auto-discovery
 
 With `discovery.docker.enabled: true`, PulseNode scans running containers

app/globals.css

@@ -1,44 +1,43 @@
 @import "tailwindcss";
 
 :root {
-  --pn-bg: #0a0e13;
+  --pn-bg: #1a1d1f;
-  --pn-surface: #10151c;
+  --pn-surface: #24282b;
-  --pn-surface-raised: #161d27;
+  --pn-surface-raised: #2b3033;
-  --pn-border: #232b38;
+  --pn-fg: #f2f4f5;
-  --pn-fg: #e8ecf1;
+  --pn-fg-muted: color-mix(in srgb, var(--pn-fg) 55%, transparent);
-  --pn-fg-muted: #7c8798;
+  --pn-border: color-mix(in srgb, var(--pn-fg) 14%, transparent);
-  --pn-accent: #3ee8a8;
+  --pn-accent: #39ff88;
-  --pn-radius: 0.75rem;
+  --pn-status-up: #39ff88;
-  --pn-status-up: #3ee8a8;
   --pn-status-down: #ff5f6d;
   --pn-status-degraded: #ffb84c;
+  --pn-shadow-sm: 0 0 0 1px var(--pn-border);
+  --pn-shadow-md: 0 0 0 1px var(--pn-border), 0 6px 18px rgba(0, 0, 0, 0.45);
 }
 
 :root[data-theme="light"] {
-  --pn-bg: #f6f7f5;
+  --pn-bg: #e9ebec;
-  --pn-surface: #ffffff;
+  --pn-surface: #f6f7f7;
-  --pn-surface-raised: #eef1ef;
+  --pn-surface-raised: #eceded;
-  --pn-border: #dde1de;
+  --pn-fg: #1e2224;
-  --pn-fg: #12181a;
+  --pn-accent: #339a5a;
-  --pn-fg-muted: #5c6b66;
+  --pn-status-up: #339a5a;
-  --pn-accent: #0e9f6e;
-  --pn-status-up: #0e9f6e;
   --pn-status-down: #dc2626;
   --pn-status-degraded: #d97706;
+  --pn-shadow-md: 0 0 0 1px var(--pn-border), 0 6px 18px rgba(30, 32, 45, 0.1);
 }
 
 @media (prefers-color-scheme: light) {
   :root:not([data-theme]) {
-    --pn-bg: #f6f7f5;
+    --pn-bg: #e9ebec;
-    --pn-surface: #ffffff;
+    --pn-surface: #f6f7f7;
-    --pn-surface-raised: #eef1ef;
+    --pn-surface-raised: #eceded;
-    --pn-border: #dde1de;
+    --pn-fg: #1e2224;
-    --pn-fg: #12181a;
+    --pn-accent: #339a5a;
-    --pn-fg-muted: #5c6b66;
+    --pn-status-up: #339a5a;
-    --pn-accent: #0e9f6e;
-    --pn-status-up: #0e9f6e;
     --pn-status-down: #dc2626;
     --pn-status-degraded: #d97706;
+    --pn-shadow-md: 0 0 0 1px var(--pn-border), 0 6px 18px rgba(30, 32, 45, 0.1);
   }
 }
 
@@ -53,7 +52,8 @@
   --color-status-up: var(--pn-status-up);
   --color-status-down: var(--pn-status-down);
   --color-status-degraded: var(--pn-status-degraded);
-  --radius-widget: var(--pn-radius);
+  --radius-md: 0.625rem;
+  --radius-lg: 1rem;
   --font-sans: var(--font-plex-sans);
   --font-mono: var(--font-plex-mono);
   --font-display: var(--font-space-grotesk);
@@ -64,6 +64,62 @@ body {
   color: var(--pn-fg);
 }
 
+/* Rules fade to transparent at both ends instead of stopping cleanly. */
+.pn-hr {
+  height: 1px;
+  flex: 1;
+  background: linear-gradient(
+    to right,
+    transparent,
+    var(--pn-border) 32px,
+    var(--pn-border) calc(100% - 32px),
+    transparent
+  );
+}
+
+.pn-card {
+  transition:
+    box-shadow 0.18s ease,
+    transform 0.18s ease,
+    background 0.3s ease,
+    border-color 0.3s ease;
+  box-shadow: var(--pn-shadow-sm);
+}
+.pn-card:hover {
+  transform: translateY(-2px);
+  box-shadow:
+    var(--pn-shadow-md),
+    0 0 0 1px color-mix(in srgb, var(--pn-accent) 35%, transparent);
+}
+
+@keyframes pn-toast-in {
+  from {
+    transform: translateY(12px);
+    opacity: 0;
+  }
+  to {
+    transform: translateY(0);
+    opacity: 1;
+  }
+}
+.pn-toast {
+  animation: pn-toast-in 0.28s ease;
+}
+
+@keyframes pn-spin-in {
+  from {
+    transform: rotate(-60deg) scale(0.6);
+    opacity: 0;
+  }
+  to {
+    transform: rotate(0) scale(1);
+    opacity: 1;
+  }
+}
+.pn-spin-in {
+  animation: pn-spin-in 0.35s ease;
+}
+
 @keyframes pulse-glow {
   0%,
   100% {
@@ -73,13 +129,32 @@ body {
     box-shadow: 0 0 0 4px color-mix(in srgb, var(--pn-status-up) 0%, transparent);
   }
 }
-
 .status-pulse {
   animation: pulse-glow 2s ease-in-out infinite;
 }
 
 @media (prefers-reduced-motion: reduce) {
-  .status-pulse {
+  .status-pulse,
+  .pn-toast,
+  .pn-spin-in {
     animation: none;
   }
 }
+
+.pn-bento {
+  display: grid;
+  grid-template-columns: repeat(12, 1fr);
+}
+
+@media (max-width: 860px) {
+  .pn-bento {
+    grid-template-columns: repeat(6, 1fr) !important;
+  }
+  .pn-bento > * {
+    grid-column: 1 / -1 !important;
+    grid-row: auto !important;
+  }
+  .pn-live-label {
+    display: none !important;
+  }
+}

app/icon.svg

@@ -0,0 +1,12 @@
+<svg width="32" height="32" viewBox="0 0 30 30" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <rect x="1" y="1" width="28" height="28" rx="8" fill="#2b3033" stroke="rgba(94,224,140,0.45)" />
+  <circle cx="15" cy="15" r="8" stroke="#5ee08c" stroke-width="1.5" />
+  <polyline
+    points="8,15 12,15 14,9 17,21 19,15 22,15"
+    fill="none"
+    stroke="#5ee08c"
+    stroke-width="1.6"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+  />
+</svg>

app/page.tsx

@@ -1,5 +1,6 @@
 import { ConfigError } from "@/lib/config/loader";
 import { effectiveConfigStore } from "@/lib/config/effective";
+import { toPublicConfig } from "@/lib/config/public";
 import { Dashboard } from "@/components/layout/Dashboard";
 
 export const dynamic = "force-dynamic";
@@ -12,13 +13,13 @@ export default function Home() {
     const message = err instanceof ConfigError ? err.message : "Unknown configuration error";
     return (
       <main className="mx-auto flex max-w-2xl flex-col gap-4 px-6 py-16">
-        <h1 className="text-lg font-semibold text-status-down">Configuration Error</h1>
+        <h1 className="font-display text-lg font-semibold text-status-down">Configuration Error</h1>
-        <pre className="rounded-[var(--radius-widget)] border border-status-down bg-surface p-4 text-sm whitespace-pre-wrap text-fg">
+        <pre className="rounded-lg border border-status-down bg-surface p-4 text-sm whitespace-pre-wrap text-fg">
           {message}
         </pre>
       </main>
     );
   }
 
-  return <Dashboard config={config} />;
+  return <Dashboard config={toPublicConfig(config)} />;
 }

components/layout/Dashboard.tsx

@@ -1,28 +1,48 @@
 "use client";
 
+import { Broadcast } from "@phosphor-icons/react/ssr";
 import type { Config } from "@/lib/config/schema";
-import { useConfigSubscription } from "@/lib/ws/client";
+import { useConfigSubscription, useConnectionStatus } from "@/lib/ws/client";
 import { GroupSection } from "./GroupSection";
 import { ThemeToggle } from "./ThemeToggle";
 import { PulseMark } from "./PulseMark";
+import { ToastStack } from "./Toast";
+
+function LiveIndicator() {
+  const status = useConnectionStatus();
+  const label = status === "connected" ? "live" : status === "reconnecting" ? "reconnecting…" : "connecting…";
+
+  return (
+    <div className="pn-live-label flex items-center gap-1.5 text-xs text-fg-muted">
+      <Broadcast size={15} className={status === "connected" ? "text-accent" : "text-status-degraded"} aria-hidden />
+      <span>{label}</span>
+    </div>
+  );
+}
 
 export function Dashboard({ config: initialConfig }: { config: Config }) {
   const config = useConfigSubscription(initialConfig);
 
   return (
-    <main className="mx-auto flex max-w-6xl flex-col gap-8 px-6 py-10">
+    <div className="relative min-h-screen">
-      <header className="flex items-center justify-between gap-4">
+      <div className="sticky top-0 z-20 border-b border-border bg-bg/70 backdrop-blur-lg">
-        <div className="flex items-center gap-3">
+        <div className="mx-auto flex max-w-6xl items-center gap-4 px-6 py-3">
-          <PulseMark />
+          <div className="mr-auto flex items-center gap-2.5">
-          <h1 className="font-display text-lg font-semibold tracking-tight text-fg">
+            <PulseMark size={30} />
-            {config.settings.title}
+            <span className="font-display text-lg font-semibold tracking-tight text-fg">
-          </h1>
+              {config.settings.title}
+            </span>
+          </div>
+          <LiveIndicator />
+          <ThemeToggle />
         </div>
-        <ThemeToggle />
+      </div>
-      </header>
+      <main className="mx-auto max-w-6xl px-6 pt-2 pb-20">
-      {config.groups.map((group, groupIndex) => (
+        {config.groups.map((group, groupIndex) => (
-        <GroupSection key={group.name} group={group} groupIndex={groupIndex} />
+          <GroupSection key={group.name} group={group} groupIndex={groupIndex} />
-      ))}
+        ))}
-    </main>
+      </main>
+      <ToastStack />
+    </div>
   );
 }

components/layout/GroupSection.tsx

@@ -4,11 +4,14 @@ import { widgetRegistry } from "@/components/widgets/registry";
 
 export function GroupSection({ group, groupIndex }: { group: Group; groupIndex: number }) {
   return (
-    <section className="flex flex-col gap-3">
+    <section className="mt-8 flex flex-col gap-4">
-      <h2 className="text-xs font-semibold tracking-wide text-fg-muted uppercase">
+      <div className="flex items-baseline gap-2.5">
-        {group.name}
+        <h6 className="m-0 text-xs font-semibold tracking-wide text-fg-muted uppercase">
-      </h2>
+          {group.name}
-      <div className="grid grid-cols-[repeat(auto-fill,minmax(220px,1fr))] gap-3">
+        </h6>
+        <div className="pn-hr" />
+      </div>
+      <div className="pn-bento gap-4">
         {group.widgets.map((widget, index) => {
           const Component = widgetRegistry[widget.type];
           const id = widgetId(groupIndex, index);

components/layout/PulseMark.tsx

@@ -1,18 +1,21 @@
-export function PulseMark() {
+export function PulseMark({ size = 30 }: { size?: number }) {
   return (
-    <svg
+    <svg width={size} height={size} viewBox="0 0 30 30" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
-      width="30"
+      <rect
-      height="16"
+        x="1"
-      viewBox="0 0 60 24"
+        y="1"
-      fill="none"
+        width="28"
-      xmlns="http://www.w3.org/2000/svg"
+        height="28"
-      aria-hidden="true"
+        rx="8"
-      className="text-accent"
+        fill="var(--pn-surface-raised)"
-    >
+        stroke="color-mix(in srgb, var(--pn-accent) 45%, transparent)"
-      <path
+      />
-        d="M0 12H11L15 5L20 19L24 12H33L37 8L41 12H60"
+      <circle cx="15" cy="15" r="8" stroke="var(--pn-accent)" strokeWidth="1.5" />
-        stroke="currentColor"
+      <polyline
-        strokeWidth="2.5"
+        points="8,15 12,15 14,9 17,21 19,15 22,15"
+        fill="none"
+        stroke="var(--pn-accent)"
+        strokeWidth="1.6"
         strokeLinecap="round"
         strokeLinejoin="round"
       />

components/layout/ThemeToggle.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
+import { MoonStars, Sun } from "@phosphor-icons/react/ssr";
 
 const STORAGE_KEY = "pulsenode-theme";
 
@@ -34,17 +35,19 @@ export function ThemeToggle() {
   }
 
   if (theme === null) {
-    return <div className="h-7 w-16 rounded-[var(--radius-widget)] border border-border bg-surface" />;
+    return <div className="h-9 w-9 rounded-md border border-border bg-surface" />;
   }
 
   return (
     <button
       type="button"
       onClick={toggle}
-      className="rounded-[var(--radius-widget)] border border-border bg-surface px-3 py-1.5 text-xs text-fg-muted transition-colors hover:text-fg"
+      className="flex h-9 w-9 items-center justify-center rounded-md border border-border bg-surface text-fg-muted transition-colors hover:text-fg"
       aria-label="Toggle color theme"
     >
-      {theme === "light" ? "Light" : "Dark"}
+      <span key={theme} className="pn-spin-in flex">
+        {theme === "dark" ? <MoonStars size={17} /> : <Sun size={17} />}
+      </span>
     </button>
   );
 }

components/layout/Toast.tsx

@@ -0,0 +1,28 @@
+"use client";
+
+import { CheckCircle, WarningCircle } from "@phosphor-icons/react/ssr";
+import { useConfigToasts } from "@/lib/ws/client";
+
+export function ToastStack() {
+  const toasts = useConfigToasts();
+
+  if (toasts.length === 0) return null;
+
+  return (
+    <div className="fixed right-6 bottom-6 z-50 flex flex-col gap-2">
+      {toasts.map((toast) => (
+        <div
+          key={toast.id}
+          className="pn-toast flex max-w-[340px] items-center gap-2.5 rounded-lg border border-border bg-surface px-3.5 py-3 shadow-[var(--pn-shadow-md)]"
+        >
+          {toast.tone === "ok" ? (
+            <CheckCircle size={20} className="shrink-0 text-accent" aria-hidden />
+          ) : (
+            <WarningCircle size={20} className="shrink-0 text-status-down" aria-hidden />
+          )}
+          <span className="text-[13px] text-fg">{toast.message}</span>
+        </div>
+      ))}
+    </div>
+  );
+}

components/widgets/BrandIcon.tsx

@@ -0,0 +1,13 @@
+import { BRAND_ICON_PATHS } from "@/lib/brand-icons";
+
+export function BrandIcon({ slug, size = 18 }: { slug?: string; size?: number }) {
+  if (!slug) return null;
+  const path = BRAND_ICON_PATHS[slug];
+  if (!path) return null;
+
+  return (
+    <svg width={size} height={size} viewBox="0 0 24 24" fill="currentColor" className="shrink-0 text-fg-muted" aria-hidden>
+      <path d={path} />
+    </svg>
+  );
+}

components/widgets/MetricBar.tsx

@@ -0,0 +1,16 @@
+export function MetricBar({ label, percent, detail }: { label: string; percent: number; detail: string }) {
+  return (
+    <div className="flex flex-1 flex-col gap-1">
+      <div className="flex items-center justify-between text-[11px] text-fg-muted">
+        <span>{label}</span>
+        <span className="font-mono tabular-nums text-fg">{detail}</span>
+      </div>
+      <div className="h-1 overflow-hidden rounded-full bg-surface-raised">
+        <div
+          className="h-full rounded-full bg-accent transition-[width] duration-500 ease-out"
+          style={{ width: `${Math.min(100, Math.max(0, percent))}%` }}
+        />
+      </div>
+    </div>
+  );
+}

components/widgets/StatusTag.tsx

@@ -0,0 +1,14 @@
+export function StatusTag({ children, tone = "accent" }: { children: React.ReactNode; tone?: "accent" | "down" | "degraded" | "neutral" }) {
+  const toneClass = {
+    accent: "bg-accent/15 text-accent border-accent/40",
+    down: "bg-status-down/15 text-status-down border-status-down/40",
+    degraded: "bg-status-degraded/15 text-status-degraded border-status-degraded/40",
+    neutral: "bg-surface-raised text-fg-muted border-border",
+  }[tone];
+
+  return (
+    <span className={`inline-flex items-center rounded-md border px-2 py-0.5 text-[11px] tracking-wide ${toneClass}`}>
+      {children}
+    </span>
+  );
+}

components/widgets/WidgetCard.tsx

@@ -0,0 +1,24 @@
+import type { CSSProperties, ReactNode } from "react";
+
+export const PN_CARD_CLASS = "pn-card flex flex-col gap-2 rounded-md border border-border bg-surface p-4";
+
+export function WidgetCard({
+  span = 3,
+  rowSpan,
+  children,
+}: {
+  span?: number;
+  rowSpan?: number;
+  children: ReactNode;
+}) {
+  const style: CSSProperties = {
+    gridColumn: `span ${span}`,
+    ...(rowSpan ? { gridRow: `span ${rowSpan}` } : {}),
+  };
+
+  return (
+    <div className={PN_CARD_CLASS} style={style}>
+      {children}
+    </div>
+  );
+}

components/widgets/bookmark/Widget.tsx

@@ -1,4 +1,7 @@
+import { ArrowUpRight } from "@phosphor-icons/react/ssr";
 import type { Widget } from "@/lib/config/schema";
+import { PN_CARD_CLASS } from "@/components/widgets/WidgetCard";
+import { BrandIcon } from "@/components/widgets/BrandIcon";
 
 type BookmarkWidget = Extract<Widget, { type: "bookmark" }>;
 
@@ -8,12 +11,15 @@ export function BookmarkWidget({ widget }: { widget: BookmarkWidget }) {
       href={widget.href}
       target="_blank"
       rel="noreferrer"
-      className="flex flex-col gap-1 rounded-[var(--radius-widget)] border border-border bg-surface p-4 transition-colors hover:border-accent"
+      className={`${PN_CARD_CLASS} text-inherit no-underline`}
+      style={{ gridColumn: "span 3" }}
     >
-      <span className="text-sm font-medium text-fg">{widget.name}</span>
+      <div className="flex items-center gap-2">
-      {widget.description && (
+        <BrandIcon slug={widget.icon} />
-        <span className="text-xs text-fg-muted">{widget.description}</span>
+        <span className="min-w-0 flex-1 truncate text-[15px] font-medium text-fg">{widget.name}</span>
-      )}
+        <ArrowUpRight size={16} className="shrink-0 text-accent" aria-hidden />
+      </div>
+      {widget.description && <span className="text-xs text-fg-muted">{widget.description}</span>}
     </a>
   );
 }

components/widgets/database/Widget.tsx

@@ -3,6 +3,8 @@
 import type { Widget } from "@/lib/config/schema";
 import { useWidgetSubscription } from "@/lib/ws/client";
 import { StatusDot } from "@/components/widgets/StatusDot";
+import { WidgetCard } from "@/components/widgets/WidgetCard";
+import { BrandIcon } from "@/components/widgets/BrandIcon";
 import { formatUptime } from "@/lib/format";
 
 type DatabaseWidget = Extract<Widget, { type: "database" }>;
@@ -12,24 +14,32 @@ const ENGINE_LABEL: Record<DatabaseWidget["engine"], string> = {
   redis: "Redis",
 };
 
+const ENGINE_ICON: Record<DatabaseWidget["engine"], string> = {
+  postgres: "postgresql",
+  redis: "redis",
+};
+
 export function DatabaseWidget({ widget, widgetId }: { widget: DatabaseWidget; widgetId: string }) {
   const result = useWidgetSubscription(widgetId);
   const data = result?.type === "database" ? result.data : null;
   const errorMessage = result?.type === "error" ? result.message : null;
 
   return (
-    <div className="flex flex-col gap-2 rounded-[var(--radius-widget)] border border-border bg-surface p-4">
+    <WidgetCard span={4}>
       <div className="flex items-center justify-between gap-2">
-        <span className="text-sm font-medium text-fg">{widget.name}</span>
+        <div className="flex min-w-0 items-center gap-2">
+          <BrandIcon slug={ENGINE_ICON[widget.engine]} />
+          <span className="truncate text-[15px] font-medium text-fg">{widget.name}</span>
+        </div>
         <StatusDot status={data?.status} health={data?.health} />
       </div>
-      <span className="text-xs text-fg-muted">{ENGINE_LABEL[widget.engine]}</span>
+      <span className="text-[11px] text-fg-muted">{ENGINE_LABEL[widget.engine]}</span>
       {errorMessage && <span className="text-xs text-status-down">{errorMessage}</span>}
       {data?.uptimeSeconds != null && (
-        <span className="text-xs text-fg-muted">
+        <span className="text-[11px] text-fg-muted">
-          Uptime: <span className="font-mono tabular-nums text-fg">{formatUptime(data.uptimeSeconds)}</span>
+          up <span className="font-mono tabular-nums text-fg">{formatUptime(data.uptimeSeconds)}</span>
         </span>
       )}
-    </div>
+    </WidgetCard>
   );
 }

components/widgets/docker/Widget.tsx

@@ -4,6 +4,9 @@ import type { Widget } from "@/lib/config/schema";
 import { useWidgetSubscription } from "@/lib/ws/client";
 import { StatusDot } from "@/components/widgets/StatusDot";
 import { SkeletonLines } from "@/components/widgets/Skeleton";
+import { WidgetCard } from "@/components/widgets/WidgetCard";
+import { MetricBar } from "@/components/widgets/MetricBar";
+import { BrandIcon } from "@/components/widgets/BrandIcon";
 import { formatBytes, formatUptime } from "@/lib/format";
 
 type DockerWidget = Extract<Widget, { type: "docker" }>;
@@ -12,54 +15,47 @@ export function DockerWidget({ widget, widgetId }: { widget: DockerWidget; widge
   const result = useWidgetSubscription(widgetId);
   const data = result?.type === "docker" ? result.data : null;
   const errorMessage = result?.type === "error" ? result.message : null;
+  const memPercent = data?.memUsageBytes != null && data.memLimitBytes ? (data.memUsageBytes / data.memLimitBytes) * 100 : null;
 
   return (
-    <div className="flex flex-col gap-2 rounded-[var(--radius-widget)] border border-border bg-surface p-4">
+    <WidgetCard span={4}>
       <div className="flex items-center justify-between gap-2">
-        {widget.href ? (
+        <div className="flex min-w-0 items-center gap-2">
-          <a
+          <BrandIcon slug={widget.icon} />
-            href={widget.href}
+          {widget.href ? (
-            target="_blank"
+            <a
-            rel="noreferrer"
+              href={widget.href}
-            className="text-sm font-medium text-fg hover:text-accent"
+              target="_blank"
-          >
+              rel="noreferrer"
-            {widget.name}
+              className="truncate text-[15px] font-medium text-fg hover:text-accent"
-          </a>
+            >
-        ) : (
+              {widget.name}
-          <span className="text-sm font-medium text-fg">{widget.name}</span>
+            </a>
-        )}
+          ) : (
+            <span className="truncate text-[15px] font-medium text-fg">{widget.name}</span>
+          )}
+        </div>
         <StatusDot status={data?.status} health={data?.health} />
       </div>
       {errorMessage && <span className="text-xs text-status-down">{errorMessage}</span>}
       {!result && !errorMessage && <SkeletonLines />}
       {data && (
-        <dl className="flex flex-col gap-1 text-xs text-fg-muted">
+        <>
-          {data.uptimeSeconds !== null && (
+          {widget.showStats && data.cpuPercent !== null && memPercent !== null && (
-            <div>
+            <div className="mt-0.5 flex gap-4">
-              Uptime: <span className="font-mono tabular-nums text-fg">{formatUptime(data.uptimeSeconds)}</span>
+              <MetricBar label="CPU" percent={data.cpuPercent} detail={`${data.cpuPercent.toFixed(1)}%`} />
+              <MetricBar label="MEM" percent={memPercent} detail={`${memPercent.toFixed(0)}%`} />
             </div>
           )}
-          {widget.showStats && data.cpuPercent !== null && (
+          <div className="flex items-center gap-3 text-[11px] text-fg-muted">
-            <div>
+            {data.uptimeSeconds !== null && <span>up {formatUptime(data.uptimeSeconds)}</span>}
-              CPU: <span className="font-mono tabular-nums text-fg">{data.cpuPercent.toFixed(1)}%</span>
+            {widget.showStats && data.memUsageBytes !== null && memPercent === null && (
-            </div>
+              <span className="font-mono tabular-nums">{formatBytes(data.memUsageBytes)}</span>
-          )}
+            )}
-          {widget.showStats && data.memUsageBytes !== null && (
+            {data.restartCount > 0 && <span>{data.restartCount} restarts</span>}
-            <div>
+          </div>
-              Mem:{" "}
+        </>
-              <span className="font-mono tabular-nums text-fg">
-                {formatBytes(data.memUsageBytes)}
-                {data.memLimitBytes ? ` / ${formatBytes(data.memLimitBytes)}` : ""}
-              </span>
-            </div>
-          )}
-          {data.restartCount > 0 && (
-            <div>
-              Restarts: <span className="font-mono tabular-nums text-fg">{data.restartCount}</span>
-            </div>
-          )}
-        </dl>
       )}
-    </div>
+    </WidgetCard>
   );
 }

components/widgets/http/Widget.tsx

@@ -1,45 +1,45 @@
 "use client";
 
+import { Globe, Timer } from "@phosphor-icons/react/ssr";
 import type { Widget } from "@/lib/config/schema";
 import { useWidgetSubscription } from "@/lib/ws/client";
 import { SkeletonLines } from "@/components/widgets/Skeleton";
+import { WidgetCard } from "@/components/widgets/WidgetCard";
+import { StatusTag } from "@/components/widgets/StatusTag";
 
 type HttpWidget = Extract<Widget, { type: "http" }>;
 
-function statusColor(up: boolean | undefined, consecutiveFailures: number): string {
+function statusTone(up: boolean | undefined, consecutiveFailures: number): "accent" | "down" | "degraded" | "neutral" {
-  if (up === undefined) return "bg-fg-muted";
+  if (up === undefined) return "neutral";
-  if (up) return "bg-status-up";
+  if (up) return "accent";
-  return consecutiveFailures > 2 ? "bg-status-down" : "bg-status-degraded";
+  return consecutiveFailures > 2 ? "down" : "degraded";
 }
 
 export function HttpWidget({ widget, widgetId }: { widget: HttpWidget; widgetId: string }) {
   const result = useWidgetSubscription(widgetId);
   const data = result?.type === "http" ? result.data : null;
   const errorMessage = result?.type === "error" ? result.message : null;
-  const pulse = data?.up ? "status-pulse" : "";
 
   return (
-    <div className="flex flex-col gap-2 rounded-[var(--radius-widget)] border border-border bg-surface p-4">
+    <WidgetCard span={3}>
-      <div className="flex items-center justify-between gap-2">
+      <div className="flex items-center gap-2.5">
-        <span className="text-sm font-medium text-fg">{widget.name}</span>
+        <Globe size={18} className="text-accent" aria-hidden />
-        <span
+        <span className="flex-1 text-[15px] font-medium text-fg">{widget.name}</span>
-          className={`h-2.5 w-2.5 shrink-0 rounded-full ${statusColor(data?.up, data?.consecutiveFailures ?? 0)} ${pulse}`}
+      </div>
-          title={data ? (data.up ? "up" : `down (${data.consecutiveFailures} checks failed)`) : "unknown"}
+      <div>
-        />
+        <StatusTag tone={statusTone(data?.up, data?.consecutiveFailures ?? 0)}>
+          {data ? (data.up ? `${data.statusCode ?? "up"}` : "down") : "…"}
+        </StatusTag>
       </div>
       {errorMessage && <span className="text-xs text-status-down">{errorMessage}</span>}
       {!result && !errorMessage && <SkeletonLines />}
       {data && (
-        <dl className="flex flex-col gap-1 text-xs text-fg-muted">
+        <div className="flex items-center gap-1.5 text-[11px] text-fg-muted">
-          <div>
+          <Timer size={12} aria-hidden />
-            Status: <span className="font-mono tabular-nums text-fg">{data.statusCode ?? "—"}</span>
+          <span className="font-mono tabular-nums text-fg">{data.latencyMs}ms</span> latency
-          </div>
+          {!data.up && data.error && <span className="text-status-down">{data.error}</span>}
-          <div>
+        </div>
-            Latency: <span className="font-mono tabular-nums text-fg">{data.latencyMs}ms</span>
-          </div>
-          {!data.up && data.error && <div className="text-status-down">{data.error}</div>}
-        </dl>
       )}
-    </div>
+    </WidgetCard>
   );
 }

components/widgets/registry.ts

@@ -7,6 +7,7 @@ import { DatabaseWidget } from "./database/Widget";
 import { SystemWidget } from "./system/Widget";
 import { HttpWidget } from "./http/Widget";
 import { TraefikWidget } from "./traefik/Widget";
+import { ServiceWidget } from "./service/Widget";
 
 type WidgetComponent<T extends Widget["type"]> = ComponentType<{
   widget: Extract<Widget, { type: T }>;
@@ -21,4 +22,5 @@ export const widgetRegistry: { [K in Widget["type"]]: WidgetComponent<K> } = {
   system: SystemWidget,
   http: HttpWidget,
   traefik: TraefikWidget,
+  service: ServiceWidget,
 };

components/widgets/search/Widget.tsx

@@ -2,6 +2,7 @@
 
 import { useState, type FormEvent } from "react";
 import type { SearchEngine, Widget } from "@/lib/config/schema";
+import { WidgetCard } from "@/components/widgets/WidgetCard";
 
 type SearchWidget = Extract<Widget, { type: "search" }>;
 
@@ -11,6 +12,12 @@ const ENGINE_URLS: Record<string, string> = {
   bing: "https://www.bing.com/search?q=",
 };
 
+const ENGINE_LABEL: Record<string, string> = {
+  duckduckgo: "DuckDuckGo",
+  google: "Google",
+  bing: "Bing",
+};
+
 export function SearchWidget({ widget }: { widget: SearchWidget }) {
   const [engine, setEngine] = useState(widget.defaultEngine ?? widget.engines[0]);
   const [query, setQuery] = useState("");
@@ -23,29 +30,39 @@ export function SearchWidget({ widget }: { widget: SearchWidget }) {
   }
 
   return (
-    <form
+    <WidgetCard span={4}>
-      onSubmit={handleSubmit}
+      <form onSubmit={handleSubmit} className="flex flex-1 flex-col justify-center gap-2">
-      className="flex items-center gap-2 rounded-[var(--radius-widget)] border border-border bg-surface p-2 sm:col-span-2"
+        <div className="text-[10px] tracking-[0.1em] text-accent uppercase">Search</div>
-    >
+        <input
-      {widget.engines.length > 1 && (
+          value={query}
-        <select
+          onChange={(event) => setQuery(event.target.value)}
-          value={engine}
+          placeholder="Search the web…"
-          onChange={(event) => setEngine(event.target.value as SearchEngine)}
+          autoComplete="off"
-          className="rounded bg-transparent text-xs text-fg-muted outline-none"
+          className="min-h-9 w-full rounded-md border border-border bg-bg px-2.5 py-1.5 text-sm text-fg outline-none placeholder:text-fg-muted focus-visible:border-accent"
-        >
+        />
-          {widget.engines.map((option) => (
+        {widget.engines.length > 1 && (
-            <option key={option} value={option}>
+          <div className="inline-flex self-start overflow-hidden rounded-md border border-border">
-              {option}
+            {widget.engines.map((option) => (
-            </option>
+              <label
-          ))}
+                key={option}
-        </select>
+                className={`cursor-pointer px-2.5 py-1 text-[12px] first:border-l-0 [&+label]:border-l [&+label]:border-border ${
-      )}
+                  option === engine ? "text-accent shadow-[inset_0_0_0_1px_var(--pn-accent)]" : "text-fg-muted"
-      <input
+                }`}
-        value={query}
+              >
-        onChange={(event) => setQuery(event.target.value)}
+                <input
-        placeholder="Search..."
+                  type="radio"
-        className="flex-1 bg-transparent text-sm text-fg outline-none placeholder:text-fg-muted"
+                  name="engine"
-      />
+                  value={option}
-    </form>
+                  checked={option === engine}
+                  onChange={() => setEngine(option as SearchEngine)}
+                  className="sr-only"
+                />
+                {ENGINE_LABEL[option] ?? option}
+              </label>
+            ))}
+          </div>
+        )}
+      </form>
+    </WidgetCard>
   );
 }

components/widgets/service/Widget.tsx

@@ -0,0 +1,90 @@
+"use client";
+
+import type { Widget } from "@/lib/config/schema";
+import { useWidgetSubscription } from "@/lib/ws/client";
+import { StatusDot } from "@/components/widgets/StatusDot";
+import { StatusTag } from "@/components/widgets/StatusTag";
+import { SkeletonLines } from "@/components/widgets/Skeleton";
+import { WidgetCard } from "@/components/widgets/WidgetCard";
+import { MetricBar } from "@/components/widgets/MetricBar";
+import { BrandIcon } from "@/components/widgets/BrandIcon";
+import { formatBytes, formatUptime } from "@/lib/format";
+
+type ServiceWidget = Extract<Widget, { type: "service" }>;
+
+export function ServiceWidget({ widget, widgetId }: { widget: ServiceWidget; widgetId: string }) {
+  const result = useWidgetSubscription(widgetId);
+  const data = result?.type === "service" ? result.data : null;
+  const errorMessage = result?.type === "error" ? result.message : null;
+  const memPercent =
+    data?.docker.memUsageBytes != null && data.docker.memLimitBytes
+      ? (data.docker.memUsageBytes / data.docker.memLimitBytes) * 100
+      : null;
+
+  return (
+    <WidgetCard span={4}>
+      <div className="flex items-center justify-between gap-2">
+        <div className="flex min-w-0 items-center gap-2">
+          <BrandIcon slug={widget.icon} />
+          {widget.href ? (
+            <a
+              href={widget.href}
+              target="_blank"
+              rel="noreferrer"
+              className="truncate text-[15px] font-medium text-fg hover:text-accent"
+            >
+              {widget.name}
+            </a>
+          ) : (
+            <span className="truncate text-[15px] font-medium text-fg">{widget.name}</span>
+          )}
+        </div>
+        <StatusDot status={data?.docker.status} health={data?.docker.health} />
+      </div>
+      {errorMessage && <span className="text-xs text-status-down">{errorMessage}</span>}
+      {!result && !errorMessage && <SkeletonLines count={3} />}
+      {data && (
+        <>
+          {data.stats.length > 0 && (
+            <div className="flex items-start gap-4">
+              {data.stats.map((stat, index) => (
+                <div
+                  key={stat.label}
+                  className={`flex flex-col gap-0.5 ${index > 0 ? "border-l border-border pl-4" : ""}`}
+                >
+                  <span className="font-mono text-2xl leading-none font-semibold tabular-nums text-accent">
+                    {stat.value}
+                  </span>
+                  <span className="text-[10px] tracking-wide text-fg-muted uppercase">{stat.label}</span>
+                </div>
+              ))}
+            </div>
+          )}
+          {data.detail && data.detail.length > 0 && (
+            <div className="flex flex-wrap gap-1.5">
+              {data.detail.map((entry) => (
+                <StatusTag key={entry} tone="neutral">
+                  {entry}
+                </StatusTag>
+              ))}
+            </div>
+          )}
+          {data.statError && <StatusTag tone="degraded">{data.statError}</StatusTag>}
+          {widget.showStats && data.docker.cpuPercent !== null && memPercent !== null && (
+            <div className="mt-0.5 flex gap-4">
+              <MetricBar label="CPU" percent={data.docker.cpuPercent} detail={`${data.docker.cpuPercent.toFixed(1)}%`} />
+              <MetricBar label="MEM" percent={memPercent} detail={`${memPercent.toFixed(0)}%`} />
+            </div>
+          )}
+          <div className="flex items-center gap-3 text-[11px] text-fg-muted">
+            {data.docker.uptimeSeconds !== null && <span>up {formatUptime(data.docker.uptimeSeconds)}</span>}
+            {widget.showStats && data.docker.memUsageBytes !== null && memPercent === null && (
+              <span className="font-mono tabular-nums">{formatBytes(data.docker.memUsageBytes)}</span>
+            )}
+            {data.docker.restartCount > 0 && <span>{data.docker.restartCount} restarts</span>}
+          </div>
+        </>
+      )}
+    </WidgetCard>
+  );
+}

components/widgets/system/Widget.tsx

@@ -3,6 +3,8 @@
 import type { Widget } from "@/lib/config/schema";
 import { useWidgetSubscription } from "@/lib/ws/client";
 import { SkeletonLines } from "@/components/widgets/Skeleton";
+import { WidgetCard } from "@/components/widgets/WidgetCard";
+import { MetricBar } from "@/components/widgets/MetricBar";
 import { formatBytes } from "@/lib/format";
 
 type SystemWidget = Extract<Widget, { type: "system" }>;
@@ -11,51 +13,39 @@ function usagePercent(used: number, total: number): number {
   return total > 0 ? Math.min(100, (used / total) * 100) : 0;
 }
 
-function UsageBar({ label, percent, detail }: { label: string; percent: number; detail: string }) {
-  return (
-    <div className="flex flex-col gap-1">
-      <div className="flex items-center justify-between text-xs text-fg-muted">
-        <span>{label}</span>
-        <span className="font-mono tabular-nums text-fg">{detail}</span>
-      </div>
-      <div className="h-1.5 w-full overflow-hidden rounded-full bg-surface-raised">
-        <div className="h-full rounded-full bg-accent" style={{ width: `${percent}%` }} />
-      </div>
-    </div>
-  );
-}
-
 export function SystemWidget({ widget, widgetId }: { widget: SystemWidget; widgetId: string }) {
   const result = useWidgetSubscription(widgetId);
   const data = result?.type === "system" ? result.data : null;
   const errorMessage = result?.type === "error" ? result.message : null;
 
   return (
-    <div className="flex flex-col gap-3 rounded-[var(--radius-widget)] border border-border bg-surface p-4 sm:col-span-2">
+    <WidgetCard span={5} rowSpan={2}>
-      <span className="text-sm font-medium text-fg">{widget.name}</span>
+      <div className="text-[10px] tracking-[0.1em] text-accent uppercase">System</div>
+      <span className="text-[15px] font-medium text-fg">{widget.name}</span>
       {errorMessage && <span className="text-xs text-status-down">{errorMessage}</span>}
       {!result && !errorMessage && <SkeletonLines count={3} />}
       {data && (
-        <div className="flex flex-col gap-2">
+        <div className="mt-1 flex flex-1 flex-col justify-between gap-3">
-          <UsageBar label="CPU" percent={data.cpuPercent} detail={`${data.cpuPercent.toFixed(1)}%`} />
+          <div className="flex flex-col gap-3">
-          <UsageBar
+            <MetricBar label="CPU" percent={data.cpuPercent} detail={`${data.cpuPercent.toFixed(1)}%`} />
-            label="Memory"
+            <MetricBar
-            percent={usagePercent(data.memUsedBytes, data.memTotalBytes)}
+              label="Memory"
-            detail={`${formatBytes(data.memUsedBytes)} / ${formatBytes(data.memTotalBytes)}`}
+              percent={usagePercent(data.memUsedBytes, data.memTotalBytes)}
-          />
+              detail={`${formatBytes(data.memUsedBytes)} / ${formatBytes(data.memTotalBytes)}`}
-          <UsageBar
+            />
-            label="Disk"
+            <MetricBar
-            percent={usagePercent(data.diskUsedBytes, data.diskTotalBytes)}
+              label="Disk"
-            detail={`${formatBytes(data.diskUsedBytes)} / ${formatBytes(data.diskTotalBytes)}`}
+              percent={usagePercent(data.diskUsedBytes, data.diskTotalBytes)}
-          />
+              detail={`${formatBytes(data.diskUsedBytes)} / ${formatBytes(data.diskTotalBytes)}`}
-          <div className="flex items-center justify-between text-xs text-fg-muted">
+            />
-            <span>Network</span>
+          </div>
+          <div className="flex items-center gap-1.5 text-[11px] text-fg-muted">
             <span className="font-mono tabular-nums text-fg">
               ↓ {formatBytes(data.netRxBytesPerSec)}/s · ↑ {formatBytes(data.netTxBytesPerSec)}/s
             </span>
           </div>
         </div>
       )}
-    </div>
+    </WidgetCard>
   );
 }

components/widgets/traefik/Widget.tsx

@@ -1,8 +1,10 @@
 "use client";
 
+import { Lock } from "@phosphor-icons/react/ssr";
 import type { Widget } from "@/lib/config/schema";
 import { useWidgetSubscription } from "@/lib/ws/client";
 import { SkeletonLines } from "@/components/widgets/Skeleton";
+import { WidgetCard } from "@/components/widgets/WidgetCard";
 
 type TraefikWidget = Extract<Widget, { type: "traefik" }>;
 
@@ -12,11 +14,11 @@ export function TraefikWidget({ widget, widgetId }: { widget: TraefikWidget; wid
   const errorMessage = result?.type === "error" ? result.message : null;
 
   return (
-    <div className="flex flex-col gap-3 rounded-[var(--radius-widget)] border border-border bg-surface p-4 sm:col-span-2">
+    <WidgetCard span={4}>
       <div className="flex items-center justify-between">
-        <span className="text-sm font-medium text-fg">{widget.name}</span>
+        <span className="text-[15px] font-medium text-fg">{widget.name}</span>
         {data && (
-          <span className="font-mono text-xs tabular-nums text-fg-muted">
+          <span className="font-mono text-[11px] tabular-nums text-fg-muted">
             {data.entrypoints.map((ep) => ep.address).join(" · ") || `${data.entrypoints.length} entrypoints`}
           </span>
         )}
@@ -24,27 +26,28 @@ export function TraefikWidget({ widget, widgetId }: { widget: TraefikWidget; wid
       {errorMessage && <span className="text-xs text-status-down">{errorMessage}</span>}
       {!result && !errorMessage && <SkeletonLines count={3} />}
       {data && (
-        <div className="flex flex-col gap-1">
+        <div className="flex flex-col">
           {data.routers.map((router) => (
-            <div key={router.name} className="flex items-center justify-between gap-2 text-xs">
+            <div key={router.name} className="flex items-center justify-between gap-2 border-t border-border py-1.5 text-[13px] first:border-t-0">
               <span className="truncate text-fg" title={router.rule}>
                 {router.name.replace(/@.*$/, "")}
               </span>
-              <span className="flex items-center gap-1 text-fg-muted">
+              <span className="flex items-center gap-1.5 text-[11px] text-fg-muted">
-                {router.tls && <span title="TLS enabled">🔒</span>}
+                {router.tls && <Lock size={11} aria-label="TLS enabled" />}
                 <span
-                  className={router.status === "enabled" ? "text-status-up" : "text-status-down"}
+                  className={`flex items-center gap-1.5 ${router.status === "enabled" ? "text-status-up" : "text-status-down"}`}
                 >
+                  <span className="h-1.5 w-1.5 rounded-full bg-current" />
                   {router.status}
                 </span>
               </span>
             </div>
           ))}
-          <span className="pt-1 text-xs text-fg-muted">
+          <span className="pt-2 text-[11px] text-fg-muted">
             <span className="font-mono tabular-nums">{data.middlewaresCount}</span> middlewares
           </span>
         </div>
       )}
-    </div>
+    </WidgetCard>
   );
 }

config/.env.example

@@ -1,7 +1,6 @@
 # Public hostnames of the services PulseNode links to / monitors.
 # These are not secrets, but keeping them here (rather than hardcoded in
 # config.yml) means the same config.yml works across environments.
-TRAEFIK_HOST_TRAEFIK=traefik.example.com
 TRAEFIK_HOST_CODE=code.example.com
 TRAEFIK_HOST_COOLIFY=coolify.example.com
 TRAEFIK_HOST_GITEA=git.example.com

config/config.yml

@@ -3,8 +3,6 @@ settings:
 
 theme:
   mode: dark
-  variables:
-    --pn-accent: "#38bdf8"
 
 # Manual widgets below always take precedence over an auto-discovered one for
 # the same container - this is on as a safety net for anything added to
@@ -21,14 +19,16 @@ groups:
       - type: docker
         name: Traefik
         containerName: traefik
-        href: https://${TRAEFIK_HOST_TRAEFIK}
+        icon: traefik
         interval: 10s
+        # No href: the dashboard is disabled (--api.dashboard=false).
         # Swap for a `traefik` widget (router/entrypoint/middleware view)
-        # once the API is enabled - see Traefik's --api.dashboard docs.
+        # if the API gets enabled - see Traefik's --api.dashboard docs.
 
       - type: docker
         name: Coolify
         containerName: coolify
+        icon: coolify
         href: https://${TRAEFIK_HOST_COOLIFY}
         interval: 10s
 
@@ -37,12 +37,14 @@ groups:
       - type: docker
         name: Gitea
         containerName: gitea
+        icon: gitea
         href: https://${TRAEFIK_HOST_GITEA}
         interval: 10s
 
       - type: docker
         name: Gitea Runner
         containerName: gitea_runner
+        icon: gitea
         showStats: true
         interval: 15s
 
@@ -57,35 +59,41 @@ groups:
       - type: docker
         name: Immich
         containerName: immich
+        icon: immich
         href: https://${TRAEFIK_HOST_IMMICH}
         interval: 10s
 
       - type: docker
         name: Immich ML
         containerName: immich_ml
+        icon: immich
         interval: 15s
 
       - type: docker
         name: n8n
         containerName: n8n
+        icon: n8n
         href: https://${TRAEFIK_HOST_N8N}
         interval: 10s
 
       - type: docker
         name: Passbolt
         containerName: passbolt
+        icon: passbolt
         href: https://${TRAEFIK_HOST_PASSBOLT}
         interval: 10s
 
       - type: docker
         name: Umami
         containerName: umami
+        icon: umami
         href: https://${TRAEFIK_HOST_UMAMI}
         interval: 10s
 
       - type: docker
         name: Headscale
         containerName: headscale
+        icon: headscale
         href: https://${TRAEFIK_HOST_HEADSCALE}
         interval: 10s
 

docker-compose.yml

@@ -24,7 +24,7 @@ services:
       - ./config:/app/config:ro
     env_file: .env
     networks:
-      - falcon_network
+      - compose_network
     labels:
       - traefik.enable=true
       - traefik.docker.network=${NETWORK_NAME}
@@ -33,11 +33,8 @@ services:
       - traefik.http.routers.pulsenode-web.entrypoints=web
       - traefik.http.routers.pulsenode-web.middlewares=pulsenode-redirect-web-secure
       - traefik.http.routers.pulsenode-web-secure.rule=Host(`${TRAEFIK_HOST}`)
-      - traefik.http.routers.pulsenode-web-secure.entrypoints=websecure
+      - traefik.http.routers.pulsenode-web-secure.entrypoints=web-secure
       - traefik.http.routers.pulsenode-web-secure.tls.certresolver=resolver
-      # Verify these entrypoint/middleware/certresolver names against
-      # traefik/dynamic/*.yaml in the stacks repo before deploying - written
-      # to match that repo's own convention, not independently confirmed.
       - traefik.http.routers.pulsenode-web-secure.middlewares=security-headers@file,no-index@file
       - traefik.http.services.pulsenode-web-secure.loadbalancer.server.port=3000
     healthcheck:
@@ -48,5 +45,6 @@ services:
       retries: 3
 
 networks:
-  falcon_network:
+  compose_network:
+    name: ${NETWORK_NAME}
     external: true

lib/collectors/docker.ts

@@ -1,11 +1,14 @@
 import Docker from "dockerode";
 import type { ContainerStats } from "dockerode";
+import pLimit from "p-limit";
 import type { DockerContainerResult } from "@/lib/types/widget-result";
 
 const docker = new Docker({
   socketPath: process.env.DOCKER_SOCKET_PATH ?? "/var/run/docker.sock",
 });
 
+export const dockerLimit = pLimit(4);
+
 function calcCpuPercent(stats: ContainerStats): number | null {
   const cpuDelta = stats.cpu_stats.cpu_usage.total_usage - stats.precpu_stats.cpu_usage.total_usage;
   const systemDelta = stats.cpu_stats.system_cpu_usage - stats.precpu_stats.system_cpu_usage;

lib/collectors/scheduler.ts

@@ -2,13 +2,13 @@ import pLimit from "p-limit";
 import type { Config, Widget } from "@/lib/config/schema";
 import { flattenWidgets } from "@/lib/config/widgets";
 import { parseDuration } from "@/lib/config/duration";
-import { collectDockerContainer } from "./docker";
+import { collectDockerContainer, dockerLimit } from "./docker";
 import { collectSystem } from "./system";
 import { collectHttp } from "./http";
 import { collectTraefik } from "./traefik";
+import { collectService } from "./service";
 import type { WidgetResult } from "@/lib/types/widget-result";
 
-const dockerLimit = pLimit(4);
 const httpLimit = pLimit(8);
 
 type ResultListener = (widgetId: string, result: WidgetResult) => void;
@@ -20,7 +20,14 @@ interface Job {
   consecutiveFailures: number;
 }
 
-const COLLECTOR_TYPES = new Set<Widget["type"]>(["docker", "database", "system", "http", "traefik"]);
+const COLLECTOR_TYPES = new Set<Widget["type"]>([
+  "docker",
+  "database",
+  "system",
+  "http",
+  "traefik",
+  "service",
+]);
 
 function isCollectorWidget(widget: Widget): boolean {
   return COLLECTOR_TYPES.has(widget.type);
@@ -32,7 +39,8 @@ function getIntervalMs(widget: Widget): number {
     widget.type === "database" ||
     widget.type === "system" ||
     widget.type === "http" ||
-    widget.type === "traefik"
+    widget.type === "traefik" ||
+    widget.type === "service"
   ) {
     return parseDuration(widget.interval);
   }
@@ -55,6 +63,9 @@ function sameTarget(a: Widget, b: Widget): boolean {
   if (a.type === "traefik" && b.type === "traefik") {
     return a.apiUrl === b.apiUrl;
   }
+  if (a.type === "service" && b.type === "service") {
+    return a.containerName === b.containerName && a.service === b.service && a.showStats === b.showStats;
+  }
   return false;
 }
 
@@ -81,6 +92,10 @@ async function collect(widget: Widget): Promise<WidgetResult> {
     const data = await collectTraefik(widget.apiUrl);
     return { type: "traefik", data };
   }
+  if (widget.type === "service") {
+    const data = await collectService(widget);
+    return { type: "service", data };
+  }
   throw new Error(`No collector for widget type "${widget.type}"`);
 }
 

lib/collectors/service.ts

@@ -0,0 +1,41 @@
+import type { ServiceWidget } from "@/lib/config/schema";
+import type { ServiceStat, ServiceWidgetResult } from "@/lib/types/service-result";
+import { collectDockerContainer, dockerLimit } from "./docker";
+import { collectGitea } from "./services/gitea";
+import { collectCoolify } from "./services/coolify";
+import { collectImmich } from "./services/immich";
+import { collectN8n } from "./services/n8n";
+import { collectUmami } from "./services/umami";
+import { collectHeadscale } from "./services/headscale";
+
+function collectServiceStat(widget: ServiceWidget): Promise<{ stats: ServiceStat[]; detail?: string[] }> {
+  switch (widget.service) {
+    case "gitea":
+      return collectGitea(widget);
+    case "coolify":
+      return collectCoolify(widget);
+    case "immich":
+      return collectImmich(widget);
+    case "n8n":
+      return collectN8n(widget);
+    case "umami":
+      return collectUmami(widget);
+    case "headscale":
+      return collectHeadscale(widget);
+  }
+}
+
+export async function collectService(widget: ServiceWidget): Promise<ServiceWidgetResult> {
+  const dockerPromise = dockerLimit(() => collectDockerContainer(widget.containerName, widget.showStats));
+
+  // A failed service-API call (bad token, service down) must not take out the
+  // docker health readout too - the two are independent failure modes and
+  // merging them into one card should not let one mask the other.
+  const statPromise = collectServiceStat(widget).catch((err) => ({
+    stats: [] as ServiceStat[],
+    statError: (err as Error).message,
+  }));
+
+  const [docker, statResult] = await Promise.all([dockerPromise, statPromise]);
+  return { docker, ...statResult };
+}

lib/collectors/services/base-url.ts

@@ -0,0 +1,14 @@
+import type { ServiceWidget } from "@/lib/config/schema";
+
+const SERVICE_PORTS: Record<ServiceWidget["service"], number> = {
+  gitea: 3000,
+  coolify: 8080,
+  immich: 2283,
+  n8n: 5678,
+  umami: 3000,
+  headscale: 8080,
+};
+
+export function serviceBaseUrl(widget: ServiceWidget): string {
+  return `http://${widget.containerName}:${SERVICE_PORTS[widget.service]}`;
+}

lib/collectors/services/coolify.ts

@@ -0,0 +1,30 @@
+import type { CoolifyServiceWidget } from "@/lib/config/schema";
+import type { ServiceStat } from "@/lib/types/service-result";
+import { serviceBaseUrl } from "./base-url";
+
+const DETAIL_LIMIT = 5;
+
+interface CoolifyProject {
+  name: string;
+}
+
+export async function collectCoolify(
+  widget: CoolifyServiceWidget
+): Promise<{ stats: ServiceStat[]; detail?: string[] }> {
+  const base = serviceBaseUrl(widget);
+  const response = await fetch(`${base}/api/v1/projects`, {
+    headers: { Authorization: `Bearer ${widget.apiToken}` },
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (!response.ok) {
+    throw new Error(`Coolify API returned ${response.status}`);
+  }
+  const projects = (await response.json()) as CoolifyProject[];
+  const names = projects.slice(0, DETAIL_LIMIT).map((p) => p.name);
+  if (projects.length > DETAIL_LIMIT) names.push(`+${projects.length - DETAIL_LIMIT} more`);
+
+  return {
+    stats: [{ label: "Projects", value: String(projects.length) }],
+    detail: names.length > 0 ? names : undefined,
+  };
+}

lib/collectors/services/gitea.ts

@@ -0,0 +1,16 @@
+import type { GiteaServiceWidget } from "@/lib/config/schema";
+import type { ServiceStat } from "@/lib/types/service-result";
+import { serviceBaseUrl } from "./base-url";
+
+export async function collectGitea(widget: GiteaServiceWidget): Promise<{ stats: ServiceStat[] }> {
+  const base = serviceBaseUrl(widget);
+  const response = await fetch(`${base}/api/v1/users/${widget.username}/repos?limit=1`, {
+    headers: { Authorization: `token ${widget.apiToken}` },
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (!response.ok) {
+    throw new Error(`Gitea API returned ${response.status}`);
+  }
+  const count = response.headers.get("X-Total-Count") ?? "0";
+  return { stats: [{ label: "Repos", value: count }] };
+}

lib/collectors/services/headscale.ts

@@ -0,0 +1,30 @@
+import type { HeadscaleServiceWidget } from "@/lib/config/schema";
+import type { ServiceStat } from "@/lib/types/service-result";
+import { serviceBaseUrl } from "./base-url";
+
+async function fetchList(url: string, apiToken: string, label: string, key: "users" | "nodes"): Promise<unknown[]> {
+  const response = await fetch(url, {
+    headers: { Authorization: `Bearer ${apiToken}` },
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (!response.ok) {
+    throw new Error(`Headscale ${label} API returned ${response.status}`);
+  }
+  const body = (await response.json()) as Record<string, unknown[]>;
+  return body[key] ?? [];
+}
+
+export async function collectHeadscale(widget: HeadscaleServiceWidget): Promise<{ stats: ServiceStat[] }> {
+  const base = serviceBaseUrl(widget);
+  const [users, nodes] = await Promise.all([
+    fetchList(`${base}/api/v1/user`, widget.apiToken, "user", "users"),
+    fetchList(`${base}/api/v1/node`, widget.apiToken, "node", "nodes"),
+  ]);
+
+  return {
+    stats: [
+      { label: "Users", value: String(users.length) },
+      { label: "Nodes", value: String(nodes.length) },
+    ],
+  };
+}

lib/collectors/services/immich.ts

@@ -0,0 +1,26 @@
+import type { ImmichServiceWidget } from "@/lib/config/schema";
+import type { ServiceStat } from "@/lib/types/service-result";
+import { serviceBaseUrl } from "./base-url";
+
+interface ImmichStatistics {
+  photos: number;
+  videos: number;
+}
+
+export async function collectImmich(widget: ImmichServiceWidget): Promise<{ stats: ServiceStat[] }> {
+  const base = serviceBaseUrl(widget);
+  const response = await fetch(`${base}/api/server/statistics`, {
+    headers: { "x-api-key": widget.apiKey },
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (!response.ok) {
+    throw new Error(`Immich API returned ${response.status}`);
+  }
+  const stats = (await response.json()) as ImmichStatistics;
+  return {
+    stats: [
+      { label: "Photos", value: String(stats.photos) },
+      { label: "Videos", value: String(stats.videos) },
+    ],
+  };
+}

lib/collectors/services/n8n.ts

@@ -0,0 +1,20 @@
+import type { N8nServiceWidget } from "@/lib/config/schema";
+import type { ServiceStat } from "@/lib/types/service-result";
+import { serviceBaseUrl } from "./base-url";
+
+interface N8nWorkflowsPage {
+  data: unknown[];
+}
+
+export async function collectN8n(widget: N8nServiceWidget): Promise<{ stats: ServiceStat[] }> {
+  const base = serviceBaseUrl(widget);
+  const response = await fetch(`${base}/api/v1/workflows?limit=250`, {
+    headers: { "X-N8N-API-KEY": widget.apiKey },
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (!response.ok) {
+    throw new Error(`n8n API returned ${response.status}`);
+  }
+  const page = (await response.json()) as N8nWorkflowsPage;
+  return { stats: [{ label: "Workflows", value: String(page.data.length) }] };
+}

lib/collectors/services/umami.ts

@@ -0,0 +1,48 @@
+import type { UmamiServiceWidget } from "@/lib/config/schema";
+import type { ServiceStat } from "@/lib/types/service-result";
+import { serviceBaseUrl } from "./base-url";
+
+// Self-hosted Umami has no static API-key header (that's Cloud-only) - it needs
+// a username/password login exchanged for a Bearer token. Cache the token per
+// container and only re-login when a request comes back 401, since the docs
+// don't document a fixed token lifetime to pre-emptively refresh against.
+const tokenCache = new Map<string, string>();
+
+async function login(widget: UmamiServiceWidget, base: string): Promise<string> {
+  const response = await fetch(`${base}/api/auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username: widget.username, password: widget.password }),
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (!response.ok) {
+    throw new Error(`Umami login returned ${response.status}`);
+  }
+  const body = (await response.json()) as { token: string };
+  tokenCache.set(widget.containerName, body.token);
+  return body.token;
+}
+
+export async function collectUmami(widget: UmamiServiceWidget): Promise<{ stats: ServiceStat[] }> {
+  const base = serviceBaseUrl(widget);
+  let token = tokenCache.get(widget.containerName) ?? (await login(widget, base));
+
+  let response = await fetch(`${base}/api/websites/${widget.websiteId}/active`, {
+    headers: { Authorization: `Bearer ${token}` },
+    signal: AbortSignal.timeout(5_000),
+  });
+
+  if (response.status === 401) {
+    token = await login(widget, base);
+    response = await fetch(`${base}/api/websites/${widget.websiteId}/active`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(5_000),
+    });
+  }
+
+  if (!response.ok) {
+    throw new Error(`Umami API returned ${response.status}`);
+  }
+  const body = (await response.json()) as { visitors: number };
+  return { stats: [{ label: "Active", value: String(body.visitors) }] };
+}

lib/config/public.ts

@@ -0,0 +1,19 @@
+import type { Config, Widget } from "./schema";
+
+const SECRET_WIDGET_FIELDS = ["apiToken", "apiKey", "password"] as const;
+
+export function toPublicConfig(config: Config): Config {
+  return {
+    ...config,
+    groups: config.groups.map((group) => ({
+      ...group,
+      widgets: group.widgets.map(redactWidget),
+    })),
+  };
+}
+
+function redactWidget(widget: Widget): Widget {
+  const clone: Record<string, unknown> = { ...widget };
+  for (const key of SECRET_WIDGET_FIELDS) delete clone[key];
+  return clone as Widget;
+}

lib/config/schema.ts

@@ -11,6 +11,7 @@ export const bookmarkWidgetSchema = z.object({
   name: z.string(),
   href: z.string().url(),
   description: z.string().optional(),
+  icon: z.string().optional(),
 });
 
 export const searchWidgetSchema = z.object({
@@ -26,6 +27,7 @@ export const dockerWidgetSchema = z.object({
   href: z.string().url().optional(),
   showStats: z.boolean().default(true),
   interval: durationSchema.default("5s"),
+  icon: z.string().optional(),
 });
 
 export const databaseWidgetSchema = z.object({
@@ -63,6 +65,64 @@ export const traefikWidgetSchema = z.object({
   interval: durationSchema.default("15s"),
 });
 
+const serviceCommonFields = {
+  type: z.literal("service") as z.ZodLiteral<"service">,
+  name: z.string(),
+  containerName: z.string(),
+  href: z.string().url().optional(),
+  showStats: z.boolean().default(true),
+  interval: durationSchema.default("15s"),
+  icon: z.string().optional(),
+};
+
+export const giteaServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("gitea"),
+  username: z.string().default("Valknar"),
+  apiToken: z.string(),
+});
+
+export const coolifyServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("coolify"),
+  apiToken: z.string(),
+});
+
+export const immichServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("immich"),
+  apiKey: z.string(),
+});
+
+export const n8nServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("n8n"),
+  apiKey: z.string(),
+});
+
+export const umamiServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("umami"),
+  username: z.string(),
+  password: z.string(),
+  websiteId: z.string(),
+});
+
+export const headscaleServiceWidgetSchema = z.object({
+  ...serviceCommonFields,
+  service: z.literal("headscale"),
+  apiToken: z.string(),
+});
+
+export const serviceWidgetSchema = z.discriminatedUnion("service", [
+  giteaServiceWidgetSchema,
+  coolifyServiceWidgetSchema,
+  immichServiceWidgetSchema,
+  n8nServiceWidgetSchema,
+  umamiServiceWidgetSchema,
+  headscaleServiceWidgetSchema,
+]);
+
 export const widgetSchema = z.discriminatedUnion("type", [
   bookmarkWidgetSchema,
   searchWidgetSchema,
@@ -71,6 +131,7 @@ export const widgetSchema = z.discriminatedUnion("type", [
   systemWidgetSchema,
   httpWidgetSchema,
   traefikWidgetSchema,
+  serviceWidgetSchema,
 ]);
 
 export const groupSchema = z.object({
@@ -124,3 +185,10 @@ export type Config = z.infer<typeof configSchema>;
 export type Widget = z.infer<typeof widgetSchema>;
 export type Group = z.infer<typeof groupSchema>;
 export type SearchEngine = z.infer<typeof searchEngineSchema>;
+export type ServiceWidget = z.infer<typeof serviceWidgetSchema>;
+export type GiteaServiceWidget = z.infer<typeof giteaServiceWidgetSchema>;
+export type CoolifyServiceWidget = z.infer<typeof coolifyServiceWidgetSchema>;
+export type ImmichServiceWidget = z.infer<typeof immichServiceWidgetSchema>;
+export type N8nServiceWidget = z.infer<typeof n8nServiceWidgetSchema>;
+export type UmamiServiceWidget = z.infer<typeof umamiServiceWidgetSchema>;
+export type HeadscaleServiceWidget = z.infer<typeof headscaleServiceWidgetSchema>;

lib/types/service-result.ts

@@ -0,0 +1,13 @@
+import type { DockerContainerResult } from "./widget-result";
+
+export interface ServiceStat {
+  label: string;
+  value: string;
+}
+
+export interface ServiceWidgetResult {
+  docker: DockerContainerResult;
+  stats: ServiceStat[];
+  detail?: string[];
+  statError?: string;
+}

lib/types/widget-result.ts

@@ -1,6 +1,7 @@
 import type { SystemResult } from "./system-result";
 import type { HttpCheckResult } from "./http-result";
 import type { TraefikResult } from "./traefik-result";
+import type { ServiceWidgetResult } from "./service-result";
 
 export interface DockerContainerResult {
   status: "running" | "exited" | "restarting" | "paused" | "dead" | "created" | "unknown";
@@ -20,4 +21,5 @@ export type WidgetResult =
   | { type: "system"; data: SystemResult }
   | { type: "http"; data: HttpCheckResult }
   | { type: "traefik"; data: TraefikResult }
+  | { type: "service"; data: ServiceWidgetResult }
   | { type: "error"; message: string };

lib/ws/client.ts

@@ -12,14 +12,23 @@ interface Envelope {
 }
 
 type TopicListener = (envelope: Envelope) => void;
+export type ConnectionStatus = "connecting" | "connected" | "reconnecting";
+type ConnectionListener = (status: ConnectionStatus) => void;
 
 let sharedSocket: WebSocket | null = null;
 let refCount = 0;
 let reconnectAttempts = 0;
 let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
+let connectionStatus: ConnectionStatus = "connecting";
 const topicListeners = new Map<string, Set<TopicListener>>();
+const connectionListeners = new Set<ConnectionListener>();
 const pendingWidgetSubscriptions = new Set<string>();
 
+function setConnectionStatus(status: ConnectionStatus): void {
+  connectionStatus = status;
+  for (const listener of connectionListeners) listener(status);
+}
+
 function getSocketUrl(): string {
   const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
   return `${protocol}//${window.location.host}/ws`;
@@ -27,6 +36,7 @@ function getSocketUrl(): string {
 
 function scheduleReconnect(): void {
   if (reconnectTimer || refCount === 0) return;
+  setConnectionStatus("reconnecting");
   const delay = Math.min(30_000, 1_000 * 2 ** reconnectAttempts);
   reconnectAttempts += 1;
   reconnectTimer = setTimeout(() => {
@@ -45,6 +55,7 @@ function ensureSocket(): WebSocket {
 
   socket.addEventListener("open", () => {
     reconnectAttempts = 0;
+    setConnectionStatus("connected");
     for (const widgetId of pendingWidgetSubscriptions) {
       socket.send(JSON.stringify({ action: "subscribe", widgetId }));
     }
@@ -134,3 +145,65 @@ export function useConfigSubscription(initial: Config): Config {
 
   return config;
 }
+
+export function useConnectionStatus(): ConnectionStatus {
+  const [status, setStatus] = useState<ConnectionStatus>(connectionStatus);
+
+  useEffect(() => {
+    refCount += 1;
+    // ensureSocket() can synchronously open a connection another component
+    // already established, so the module-level status may have moved past
+    // what this hook's initial useState captured - reconcile once before
+    // subscribing to future changes.
+    ensureSocket();
+    connectionListeners.add(setStatus);
+    // eslint-disable-next-line react-hooks/set-state-in-effect
+    setStatus(connectionStatus);
+
+    return () => {
+      refCount -= 1;
+      connectionListeners.delete(setStatus);
+    };
+  }, []);
+
+  return status;
+}
+
+export interface ConfigToast {
+  id: number;
+  tone: "ok" | "error";
+  message: string;
+}
+
+let toastCounter = 0;
+
+export function useConfigToasts(): ConfigToast[] {
+  const [toasts, setToasts] = useState<ConfigToast[]>([]);
+
+  useEffect(() => {
+    refCount += 1;
+    ensureSocket();
+
+    const removeListener = addTopicListener("config", (envelope) => {
+      let toast: Omit<ConfigToast, "id"> | null = null;
+      if (envelope.type === "config:update") {
+        toast = { tone: "ok", message: "config.yml reloaded" };
+      } else if (envelope.type === "config:error") {
+        toast = { tone: "error", message: "config.yml has an error — showing last valid config" };
+      }
+      if (!toast) return;
+
+      toastCounter += 1;
+      const id = toastCounter;
+      setToasts((prev) => [...prev, { ...toast!, id }]);
+      setTimeout(() => setToasts((prev) => prev.filter((t) => t.id !== id)), 4000);
+    });
+
+    return () => {
+      refCount -= 1;
+      removeListener();
+    };
+  }, []);
+
+  return toasts;
+}

lib/ws/server.ts

@@ -3,6 +3,7 @@ import { WebSocket, WebSocketServer } from "ws";
 import { collectorScheduler } from "@/lib/collectors/scheduler";
 import { configStore, type ConfigError } from "@/lib/config/loader";
 import { effectiveConfigStore } from "@/lib/config/effective";
+import { toPublicConfig } from "@/lib/config/public";
 import type { Config } from "@/lib/config/schema";
 import type { WidgetResult } from "@/lib/types/widget-result";
 
@@ -49,7 +50,7 @@ export function attachWebSocketServer(httpServer: HttpServer): WebSocketServer {
 
     try {
       const config = effectiveConfigStore.get();
-      send(socket, { topic: "config", type: "config:update", ts: Date.now(), data: config });
+      send(socket, { topic: "config", type: "config:update", ts: Date.now(), data: toPublicConfig(config) });
     } catch {
       // no valid config loaded yet; client keeps its SSR-seeded config until one arrives
     }
@@ -80,7 +81,12 @@ export function attachWebSocketServer(httpServer: HttpServer): WebSocketServer {
   });
 
   effectiveConfigStore.onUpdate((config) => {
-    const envelope: Envelope = { topic: "config", type: "config:update", ts: Date.now(), data: config };
+    const envelope: Envelope = {
+      topic: "config",
+      type: "config:update",
+      ts: Date.now(),
+      data: toPublicConfig(config),
+    };
     for (const socket of allSockets) send(socket, envelope);
   });
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulsenode",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "private": true,
   "scripts": {
     "dev": "tsx watch server.ts",
@@ -9,6 +9,7 @@
     "lint": "eslint"
   },
   "dependencies": {
+    "@phosphor-icons/react": "^2.1.10",
     "chokidar": "^5.0.0",
     "dockerode": "^5.0.1",
     "dotenv": "^17.4.2",
@@ -16,6 +17,7 @@
     "p-limit": "^7.3.1",
     "react": "19.2.8",
     "react-dom": "19.2.8",
+    "simple-icons": "^16.28.0",
     "systeminformation": "^5.33.1",
     "tsx": "^4.23.12",
     "ws": "^8.21.3",

pnpm-lock.yaml

@@ -8,6 +8,9 @@ importers:
 
   .:
     dependencies:
+      '@phosphor-icons/react':
+        specifier: ^2.1.10
+        version: 2.1.10(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       chokidar:
         specifier: ^5.0.0
         version: 5.0.0
@@ -29,6 +32,9 @@ importers:
       react-dom:
         specifier: 19.2.8
         version: 19.2.8(react@19.2.8)
+      simple-icons:
+        specifier: ^16.28.0
+        version: 16.28.0
       systeminformation:
         specifier: ^5.33.1
         version: 5.33.1
@@ -660,6 +666,13 @@ packages:
     resolution: {integrity: sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==}
     engines: {node: '>=12.4.0'}
 
+  '@phosphor-icons/react@2.1.10':
+    resolution: {integrity: sha512-vt8Tvq8GLjheAZZYa+YG/pW7HDbov8El/MANW8pOAz4eGxrwhnbfrQZq0Cp4q8zBEu8NIhHdnr+r8thnfRSNYA==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      react: '>= 16.8'
+      react-dom: '>= 16.8'
+
   '@protobufjs/aspromise@1.1.2':
     resolution: {integrity: sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==}
 
@@ -2203,6 +2216,10 @@ packages:
     resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
     engines: {node: '>= 0.4'}
 
+  simple-icons@16.28.0:
+    resolution: {integrity: sha512-sQPR5AtK/ijRjou7zw7mlLp08oB6FH7i0lOy5XJ2zp9mJs/yejgiOn7KvQoe2q4YJIx6VmgUSW5AOefebPt5kg==}
+    engines: {node: '>=0.12.18'}
+
   source-map-js@1.2.1:
     resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
     engines: {node: '>=0.10.0'}
@@ -2943,6 +2960,11 @@ snapshots:
 
   '@nolyfill/is-core-module@1.0.39': {}
 
+  '@phosphor-icons/react@2.1.10(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+
   '@protobufjs/aspromise@1.1.2': {}
 
   '@protobufjs/base64@1.1.2': {}
@@ -4701,6 +4723,8 @@ snapshots:
       side-channel-map: 1.0.1
       side-channel-weakmap: 1.0.2
 
+  simple-icons@16.28.0: {}
+
   source-map-js@1.2.1: {}
 
   split-ca@1.0.1: {}

scripts/extract-brand-icons.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""Regenerates lib/brand-icons.ts from the `simple-icons` package.
+
+Run from the repo root after `pnpm add simple-icons` has installed it:
+
+    python3 scripts/extract-brand-icons.py
+
+Add a new service by adding a "our key" -> "simple-icons slug" entry below.
+Slugs are the filenames under node_modules/simple-icons/icons/ (without the
+.svg extension).
+"""
+
+import json
+import re
+from pathlib import Path
+
+ICONS = {
+    "traefik": "traefikproxy",
+    "coolify": "coolify",
+    "gitea": "gitea",
+    "docker": "docker",
+    "immich": "immich",
+    "n8n": "n8n",
+    "passbolt": "passbolt",
+    "umami": "umami",
+    "postgresql": "postgresql",
+    "redis": "redis",
+    "headscale": "tailscale",
+}
+
+ROOT = Path(__file__).resolve().parent.parent
+ICONS_DIR = ROOT / "node_modules" / "simple-icons" / "icons"
+OUT_PATH = ROOT / "lib" / "brand-icons.ts"
+
+HEADER = """// Path data extracted from the `simple-icons` package (CC0) at build time -
+// see scripts/extract-brand-icons.py. Rendered monochrome (currentColor) to
+// stay consistent with the single-accent design rather than a dozen
+// competing brand colors; the shape alone is enough to be recognizable.
+export const BRAND_ICON_PATHS: Record<string, string> = {
+"""
+
+
+def main() -> None:
+    lines = [HEADER]
+    for key, slug in ICONS.items():
+        svg = (ICONS_DIR / f"{slug}.svg").read_text()
+        d_matches = re.findall(r'<path d="([^"]+)"', svg)
+        combined = " ".join(d_matches)
+        lines.append(f"  {json.dumps(key)}: {json.dumps(combined)},\n")
+    lines.append("};\n")
+    OUT_PATH.write_text("".join(lines))
+    print(f"Wrote {OUT_PATH} ({len(ICONS)} icons)")
+
+
+if __name__ == "__main__":
+    main()