diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..035ec05
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,25 @@
+**
+!Dockerfile
+!requirements.txt
+!app.wsgi
+!gunicorn.conf.py
+!scheduler_runner.py
+!operations_runner.py
+!runtime_health.py
+!rotate_credential_secret.py
+!favicon.ico
+!LICENSE
+!NOTICE
+!LICENSING.md
+!app/
+!app/**
+!config_other/
+!config_other/**
+!container/
+!container/**
+**/__pycache__
+**/*.pyc
+app/tools/
+app/scripts/ansible/inventory/
+app/scripts/ansible/artifacts/
+app/scripts/ansible/env/
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..dd0369c
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,49 @@
+# Copy to .env in your deployment directory and restrict access to that file.
+# Use image references available for your installation; a digest pins a version.
+RMON_WEB_IMAGE=ghcr.io/roxy-wi/rmon/rmon-web:1.4.0
+RMON_PROXY_IMAGE=rmon-proxy:local
+RMON_SERVER_IMAGE=ghcr.io/roxy-wi/rmon/rmon-server:7.0
+RMON_AGENT_IMAGE=ghcr.io/roxy-wi/rmon/rmon-agent:2.0
+
+# Replace with the address users and agents can reach.
+RMON_PUBLIC_URL=https://192.0.2.10
+RMON_TLS_NAME=192.0.2.10
+RMON_WEB_PORT=443
+RMON_BIND_IP=0.0.0.0
+RMON_PROXY_SCHEME=https
+RMON_SELF_SIGNED=1
+
+# Keep these defaults for a new installation. For existing data, use absolute
+# host directory paths. Both web and server use the same config/data sources.
+RMON_CONFIG_SOURCE=rmon-config
+RMON_DATA_SOURCE=rmon-data
+RMON_LOG_SOURCE=rmon-logs
+RMON_TLS_SOURCE=rmon-tls
+# RMON_CONFIG_SOURCE=/etc/rmon
+# RMON_DATA_SOURCE=/var/lib/rmon
+# RMON_LOG_SOURCE=/var/log/rmon
+# RMON_TLS_SOURCE=/srv/rmon/tls
+
+# Used only with compose.server.yaml. The port is local-only by default.
+# COMPOSE_FILE=compose.yaml:compose.server.yaml
+RMON_SERVER_TOKEN_FILE=./secrets/server-token
+RMON_SERVER_BIND_IP=127.0.0.1
+RMON_SERVER_PORT=5100
+
+# Existing application secrets: preserve their exact values or mounted paths.
+# Single-quote literal values containing $ or #. Do not replace existing keys.
+# RMON_SECRET_PHRASE='existing-credential-key'
+# RMON_SECRET_KEY_FILE=/var/lib/rmon/keys/flask-secret
+# RMON_JWT_PRIVATE_KEY_FILE=/var/lib/rmon/keys/rmon-key
+# RMON_JWT_PUBLIC_KEY_FILE=/var/lib/rmon/keys/rmon-key.pub
+
+# External server diagnostics, used with compose.yaml alone. Files must be
+# mounted in web; paths below /etc/rmon are included by the config mount.
+# RMON_SERVER_INTERNAL_URL=https://receiver.example.net:5100
+# RMON_SERVER_INTERNAL_TOKEN_FILE=/etc/rmon/secrets/server-token
+# RMON_SERVER_CA_FILE=/etc/rmon/tls/ca.crt
+# RMON_SERVER_CLIENT_CERT_FILE=/etc/rmon/tls/web.crt
+# RMON_SERVER_CLIENT_KEY_FILE=/etc/rmon/tls/web.key
+
+# Override only when agents cannot reach RMON_PUBLIC_URL.
+# RMON_AGENT_CONTROL_URL=https://rmon-agent-access.example.net
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..16fa685
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,15 @@
+## Summary
+
+Describe the change and why it is needed.
+
+## Testing
+
+Describe the tests or checks you ran.
+
+## Contributor License Agreement
+
+After opening this pull request, comment exactly:
+
+`/sign-cla`
+
+You only need to sign once per CLA version. If you already accepted the current `CLA.md`, the `CLA` status check will pass automatically.
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
new file mode 100644
index 0000000..5b1fa3a
--- /dev/null
+++ b/.github/workflows/cla.yml
@@ -0,0 +1,468 @@
+name: CLA
+
+on:
+  pull_request_target:
+    branches:
+      - main
+      - "release/**"
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  issue_comment:
+    types:
+      - created
+  push:
+    paths:
+      - CLA.md
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: rmon-cla-registry
+  cancel-in-progress: false
+
+jobs:
+  evaluate:
+    name: Update CLA status
+    if: github.event_name == 'pull_request_target'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+      statuses: write
+
+    steps:
+      - name: Evaluate contributor acceptance
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pr = context.payload.pull_request;
+            const registryTitle = "[CLA] Signature Registry";
+            const markerPrefix = "<!-- rmon-cla-signature ";
+            const exemptLogins = new Set([
+              "dependabot[bot]",
+              "github-actions[bot]",
+            ]);
+
+            async function currentClaSha() {
+              const repository = await github.rest.repos.get({ owner, repo });
+              const defaultBranch = repository.data.default_branch;
+              const response = await github.rest.repos.getContent({
+                owner,
+                repo,
+                path: "CLA.md",
+                ref: defaultBranch,
+              });
+
+              if (Array.isArray(response.data) || response.data.type !== "file") {
+                throw new Error("CLA.md is not a file on the default branch");
+              }
+
+              return {
+                sha: response.data.sha,
+                defaultBranch,
+              };
+            }
+
+            async function registryIssues() {
+              const query = `repo:${owner}/${repo} is:issue in:title \"${registryTitle}\"`;
+              const response = await github.rest.search.issuesAndPullRequests({
+                q: query,
+                per_page: 100,
+              });
+
+              return response.data.items.filter((issue) =>
+                issue.title === registryTitle &&
+                issue.user &&
+                issue.user.login === "github-actions[bot]"
+              );
+            }
+
+            async function hasSignature(githubId, claSha) {
+              for (const issue of await registryIssues()) {
+                const comments = await github.paginate(
+                  github.rest.issues.listComments,
+                  {
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    per_page: 100,
+                  }
+                );
+
+                for (const comment of comments) {
+                  if (!comment.user || comment.user.login !== "github-actions[bot]") {
+                    continue;
+                  }
+
+                  const body = comment.body || "";
+                  const start = body.indexOf(markerPrefix);
+                  if (start === -1) {
+                    continue;
+                  }
+
+                  const jsonStart = start + markerPrefix.length;
+                  const jsonEnd = body.indexOf(" -->", jsonStart);
+                  if (jsonEnd === -1) {
+                    continue;
+                  }
+
+                  try {
+                    const record = JSON.parse(body.slice(jsonStart, jsonEnd));
+                    if (
+                      record.version === 1 &&
+                      Number(record.github_id) === Number(githubId) &&
+                      record.cla_sha === claSha
+                    ) {
+                      return true;
+                    }
+                  } catch (error) {
+                    core.warning(`Ignoring malformed CLA registry record in comment ${comment.id}`);
+                  }
+                }
+              }
+
+              return false;
+            }
+
+            const { sha: claSha, defaultBranch } = await currentClaSha();
+            const login = pr.user.login;
+            const isExempt = exemptLogins.has(login);
+            const accepted = isExempt || await hasSignature(pr.user.id, claSha);
+
+            await github.rest.repos.createCommitStatus({
+              owner,
+              repo,
+              sha: pr.head.sha,
+              state: accepted ? "success" : "failure",
+              context: "CLA",
+              description: isExempt
+                ? "Automated dependency account is exempt from CLA"
+                : accepted
+                  ? "Contributor accepted the current CLA"
+                  : "Comment /sign-cla on the PR to accept the current CLA",
+              target_url: `${context.serverUrl}/${owner}/${repo}/blob/${defaultBranch}/CLA.md`,
+            });
+
+            if (!accepted) {
+              core.notice(`@${login} has not accepted CLA ${claSha}. Comment /sign-cla on PR #${pr.number}.`);
+            }
+
+  sign:
+    name: Record CLA acceptance
+    if: >-
+      github.event_name == 'issue_comment' &&
+      github.event.issue.pull_request &&
+      github.event.comment.body == '/sign-cla'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+      statuses: write
+
+    steps:
+      - name: Record acceptance
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const issueNumber = context.payload.issue.number;
+            const commenter = context.payload.comment.user;
+            const registryTitle = "[CLA] Signature Registry";
+            const markerPrefix = "<!-- rmon-cla-signature ";
+
+            const { data: pr } = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: issueNumber,
+            });
+
+            if (Number(commenter.id) !== Number(pr.user.id)) {
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: issueNumber,
+                body: `Only the pull request author (@${pr.user.login}) can accept the CLA for this contribution.`,
+              });
+              return;
+            }
+
+            if (commenter.type === "Bot") {
+              return;
+            }
+
+            const repository = await github.rest.repos.get({ owner, repo });
+            const defaultBranch = repository.data.default_branch;
+            const claResponse = await github.rest.repos.getContent({
+              owner,
+              repo,
+              path: "CLA.md",
+              ref: defaultBranch,
+            });
+
+            if (Array.isArray(claResponse.data) || claResponse.data.type !== "file") {
+              throw new Error("CLA.md is not a file on the default branch");
+            }
+
+            const claSha = claResponse.data.sha;
+
+            async function findRegistryIssues() {
+              const query = `repo:${owner}/${repo} is:issue in:title \"${registryTitle}\"`;
+              const response = await github.rest.search.issuesAndPullRequests({
+                q: query,
+                per_page: 100,
+              });
+
+              return response.data.items.filter((issue) =>
+                issue.title === registryTitle &&
+                issue.user &&
+                issue.user.login === "github-actions[bot]"
+              );
+            }
+
+            async function alreadyAccepted(issues) {
+              for (const issue of issues) {
+                const comments = await github.paginate(
+                  github.rest.issues.listComments,
+                  {
+                    owner,
+                    repo,
+                    issue_number: issue.number,
+                    per_page: 100,
+                  }
+                );
+
+                for (const comment of comments) {
+                  if (!comment.user || comment.user.login !== "github-actions[bot]") {
+                    continue;
+                  }
+
+                  const body = comment.body || "";
+                  const start = body.indexOf(markerPrefix);
+                  if (start === -1) {
+                    continue;
+                  }
+
+                  const jsonStart = start + markerPrefix.length;
+                  const jsonEnd = body.indexOf(" -->", jsonStart);
+                  if (jsonEnd === -1) {
+                    continue;
+                  }
+
+                  try {
+                    const record = JSON.parse(body.slice(jsonStart, jsonEnd));
+                    if (
+                      record.version === 1 &&
+                      Number(record.github_id) === Number(commenter.id) &&
+                      record.cla_sha === claSha
+                    ) {
+                      return true;
+                    }
+                  } catch (error) {
+                    core.warning(`Ignoring malformed CLA registry record in comment ${comment.id}`);
+                  }
+                }
+              }
+
+              return false;
+            }
+
+            let registries = await findRegistryIssues();
+            const accepted = await alreadyAccepted(registries);
+
+            if (!accepted) {
+              let registry = registries.find((issue) => issue.state === "open");
+
+              if (!registry) {
+                const created = await github.rest.issues.create({
+                  owner,
+                  repo,
+                  title: registryTitle,
+                  body: [
+                    "This issue is an automated public registry of RMON CLA acceptances.",
+                    "",
+                    "Do not edit or manually add signature records. Only records posted by `github-actions[bot]` are trusted by the CLA workflow.",
+                    "",
+                    "Each record is bound to the contributor's numeric GitHub user ID and the Git blob SHA of the accepted `CLA.md` version.",
+                  ].join("\n"),
+                });
+                registry = created.data;
+              }
+
+              const record = {
+                version: 1,
+                github_id: commenter.id,
+                github_login: commenter.login,
+                cla_sha: claSha,
+                accepted_at: context.payload.comment.created_at,
+                source_pr: issueNumber,
+                source_comment_id: context.payload.comment.id,
+                command: "/sign-cla",
+              };
+
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: registry.number,
+                body: [
+                  `${markerPrefix}${JSON.stringify(record)} -->`,
+                  `✅ @${commenter.login} accepted RMON CLA \`${claSha}\` on ${context.payload.comment.created_at}.`,
+                  `Source: #${issueNumber}, comment ${context.payload.comment.id}.`,
+                ].join("\n"),
+              });
+            }
+
+            await github.rest.repos.createCommitStatus({
+              owner,
+              repo,
+              sha: pr.head.sha,
+              state: "success",
+              context: "CLA",
+              description: "Contributor accepted the current CLA",
+              target_url: `${context.serverUrl}/${owner}/${repo}/blob/${defaultBranch}/CLA.md`,
+            });
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: issueNumber,
+              body: accepted
+                ? `✅ @${commenter.login}, you already accepted the current RMON CLA (\`${claSha}\`).`
+                : `✅ @${commenter.login}, your RMON CLA acceptance has been recorded for version \`${claSha}\`.`,
+            });
+
+  refresh:
+    name: Refresh open PR CLA statuses
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
+      statuses: write
+
+    steps:
+      - name: Refresh statuses
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const registryTitle = "[CLA] Signature Registry";
+            const markerPrefix = "<!-- rmon-cla-signature ";
+            const exemptLogins = new Set([
+              "dependabot[bot]",
+              "github-actions[bot]",
+            ]);
+
+            const repository = await github.rest.repos.get({ owner, repo });
+            const defaultBranch = repository.data.default_branch;
+
+            if (context.eventName === "push" && context.ref !== `refs/heads/${defaultBranch}`) {
+              core.notice("CLA.md changed outside the default branch; open PR statuses were not refreshed.");
+              return;
+            }
+
+            const claResponse = await github.rest.repos.getContent({
+              owner,
+              repo,
+              path: "CLA.md",
+              ref: defaultBranch,
+            });
+
+            if (Array.isArray(claResponse.data) || claResponse.data.type !== "file") {
+              throw new Error("CLA.md is not a file on the default branch");
+            }
+
+            const claSha = claResponse.data.sha;
+            const query = `repo:${owner}/${repo} is:issue in:title \"${registryTitle}\"`;
+            const registryResponse = await github.rest.search.issuesAndPullRequests({
+              q: query,
+              per_page: 100,
+            });
+            const registries = registryResponse.data.items.filter((issue) =>
+              issue.title === registryTitle &&
+              issue.user &&
+              issue.user.login === "github-actions[bot]"
+            );
+
+            const acceptedIds = new Set();
+
+            for (const issue of registries) {
+              const comments = await github.paginate(
+                github.rest.issues.listComments,
+                {
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  per_page: 100,
+                }
+              );
+
+              for (const comment of comments) {
+                if (!comment.user || comment.user.login !== "github-actions[bot]") {
+                  continue;
+                }
+
+                const body = comment.body || "";
+                const start = body.indexOf(markerPrefix);
+                if (start === -1) {
+                  continue;
+                }
+
+                const jsonStart = start + markerPrefix.length;
+                const jsonEnd = body.indexOf(" -->", jsonStart);
+                if (jsonEnd === -1) {
+                  continue;
+                }
+
+                try {
+                  const record = JSON.parse(body.slice(jsonStart, jsonEnd));
+                  if (record.version === 1 && record.cla_sha === claSha) {
+                    acceptedIds.add(Number(record.github_id));
+                  }
+                } catch (error) {
+                  core.warning(`Ignoring malformed CLA registry record in comment ${comment.id}`);
+                }
+              }
+            }
+
+            const pulls = await github.paginate(
+              github.rest.pulls.list,
+              {
+                owner,
+                repo,
+                state: "open",
+                per_page: 100,
+              }
+            );
+
+            for (const pr of pulls) {
+              const accepted =
+                exemptLogins.has(pr.user.login) ||
+                acceptedIds.has(Number(pr.user.id));
+
+              await github.rest.repos.createCommitStatus({
+                owner,
+                repo,
+                sha: pr.head.sha,
+                state: accepted ? "success" : "failure",
+                context: "CLA",
+                description: exemptLogins.has(pr.user.login)
+                  ? "Automated dependency account is exempt from CLA"
+                  : accepted
+                    ? "Contributor accepted the current CLA"
+                    : "Comment /sign-cla on the PR to accept the current CLA",
+                target_url: `${context.serverUrl}/${owner}/${repo}/blob/${defaultBranch}/CLA.md`,
+              });
+            }
+
+            core.notice(`Refreshed CLA status for ${pulls.length} open pull request(s).`);
diff --git a/.github/workflows/container-tests.yml b/.github/workflows/container-tests.yml
new file mode 100644
index 0000000..6b3b83b
--- /dev/null
+++ b/.github/workflows/container-tests.yml
@@ -0,0 +1,26 @@
+name: Container tests
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  container-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+      - name: Build the web image (no registry publication)
+        run: docker build --tag rmon-web:test .
+      - name: Build the Nginx proxy image
+        run: docker build --tag rmon-proxy:test container/nginx
+      - name: Validate Compose
+        run: |
+          docker compose config --quiet
+          docker compose -f compose.yaml -f compose.server.yaml config --quiet
+      - name: Test HTTP, HTTPS, bootstrap, persistence and database readiness
+        run: python3 tests/container/image_smoke.py
+      - name: Test database operation queue on PostgreSQL and MariaDB
+        run: python3 tests/operations/database_smoke.py
diff --git a/.github/workflows/helm-oci.yml b/.github/workflows/helm-oci.yml
new file mode 100644
index 0000000..568e96c
--- /dev/null
+++ b/.github/workflows/helm-oci.yml
@@ -0,0 +1,170 @@
+name: Docker image and Helm chart
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main, release/1.4.0]
+    tags: ['helm-*']
+    paths:
+      - 'helm/**'
+      - 'container/**'
+      - 'tests/helm/**'
+      - 'Dockerfile'
+      - '.github/workflows/helm-oci.yml'
+  pull_request:
+    branches: [main, release/1.4.0]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: helm-oci-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  IMAGE: ghcr.io/roxy-wi/rmon/rmon
+  WEB_IMAGE: ghcr.io/roxy-wi/rmon/rmon-web
+  CHART_REGISTRY: oci://ghcr.io/roxy-wi/rmon
+
+jobs:
+  helm-check:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        helm: [v3.21.3, v4.2.3]
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: azure/setup-helm@v5.0.1
+        with:
+          version: ${{ matrix.helm }}
+      - run: python3 -m pip install PyYAML==6.0.2
+      - run: helm lint helm/rmon --set publicURL=https://rmon.example.test --set existingConfigSecret=settings --set server.existingTokenSecret=receiver
+      - run: python3 tests/helm/validate.py
+
+  image-and-chart:
+    needs: helm-check
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: azure/setup-helm@v5.0.1
+        with:
+          version: v3.21.3
+      - run: python3 -m pip install PyYAML==6.0.2
+      - name: Verify anonymous access to Server and Agent
+        shell: bash
+        run: |
+          export DOCKER_CONFIG="$(mktemp -d)"
+          docker pull ghcr.io/roxy-wi/rmon/rmon-server:7.0
+          docker manifest inspect ghcr.io/roxy-wi/rmon/rmon-agent:2.0 > /dev/null
+      - name: Validate release metadata
+        id: release
+        shell: bash
+        run: |
+          python3 - <<'PY'
+          import os, re, runpy, yaml
+          chart = yaml.safe_load(open('helm/rmon/Chart.yaml'))
+          assert chart['name'] == 'rmon-chart'
+          version = chart['version']
+          assert re.fullmatch(r'[0-9]+\.[0-9]+\.[0-9]+', version)
+          assert chart['appVersion'] == runpy.run_path('app/version.py')['get_service_version']()
+          if os.environ['GITHUB_REF_TYPE'] == 'tag':
+              assert os.environ['GITHUB_REF_NAME'] == 'helm-' + version
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write(f'version={version}\napp-version={chart["appVersion"]}\n')
+          PY
+      - uses: docker/setup-buildx-action@v3
+      - name: Build image for Kubernetes validation
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          load: true
+          platforms: linux/amd64
+          tags: rmon-web-test:ci
+          labels: |
+            org.opencontainers.image.source=https://github.com/roxy-wi/RMON
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ steps.release.outputs.app-version }}
+            org.opencontainers.image.licenses=Elastic-2.0
+          cache-from: type=gha,scope=rmon-web
+          cache-to: type=gha,mode=max,scope=rmon-web
+      - name: Set up disposable Kubernetes cluster
+        shell: bash
+        run: |
+          curl -fsSLO https://github.com/kubernetes-sigs/kind/releases/download/v0.33.0/kind-linux-amd64
+          curl -fsSLO https://github.com/kubernetes-sigs/kind/releases/download/v0.33.0/kind-linux-amd64.sha256sum
+          sha256sum --check kind-linux-amd64.sha256sum
+          chmod +x kind-linux-amd64
+          sudo install kind-linux-amd64 /usr/local/bin/kind
+          kind create cluster --name rmon-chart-test --wait 120s
+          kind load docker-image rmon-web-test:ci --name rmon-chart-test
+          kind load docker-image ghcr.io/roxy-wi/rmon/rmon-server:7.0 --name rmon-chart-test
+      - name: Verify fresh install, persistence, maintenance, HTTPS and mTLS
+        run: python3 tests/helm/cluster_smoke.py
+      - name: Kubernetes diagnostics on failure
+        if: failure()
+        run: |
+          kubectl -n rmon-helm-test get pods,deployments,jobs,pvc || true
+          kubectl -n rmon-helm-test get events --sort-by=.lastTimestamp | tail -60 || true
+          kubectl -n rmon-helm-test logs -l app.kubernetes.io/instance=smoke --all-containers --tail=80 --prefix || true
+      - name: Remove test cluster
+        if: always()
+        run: kind delete cluster --name rmon-chart-test
+      - uses: docker/login-action@v3
+        if: startsWith(github.ref, 'refs/tags/helm-')
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish the tested image and OCI chart
+        if: startsWith(github.ref, 'refs/tags/helm-')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APP_VERSION: ${{ steps.release.outputs.app-version }}
+          CHART_VERSION: ${{ steps.release.outputs.version }}
+        shell: bash
+        run: |
+          docker tag rmon-web-test:ci "${IMAGE}:${APP_VERSION}"
+          docker tag rmon-web-test:ci "${IMAGE}:sha-${GITHUB_SHA::12}"
+          docker push "${IMAGE}:${APP_VERSION}"
+          docker push "${IMAGE}:sha-${GITHUB_SHA::12}"
+          docker tag rmon-web-test:ci "${WEB_IMAGE}:${APP_VERSION}"
+          docker tag rmon-web-test:ci "${WEB_IMAGE}:sha-${GITHUB_SHA::12}"
+          docker push "${WEB_IMAGE}:${APP_VERSION}"
+          docker push "${WEB_IMAGE}:sha-${GITHUB_SHA::12}"
+          IMAGE_DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${APP_VERSION}" --format '{{json .Manifest}}' | jq -r .digest)
+          export IMAGE_DIGEST
+          web_digest=$(docker buildx imagetools inspect "${WEB_IMAGE}:${APP_VERSION}" --format '{{json .Manifest}}' | jq -r .digest)
+          test "$web_digest" = "$IMAGE_DIGEST"
+          server_ref=$(docker image inspect ghcr.io/roxy-wi/rmon/rmon-server:7.0 --format '{{index .RepoDigests 0}}')
+          export SERVER_DIGEST="${server_ref#*@}"
+          python3 - <<'PY'
+          import os, re, yaml
+          digest = os.environ['IMAGE_DIGEST']
+          assert re.fullmatch(r'sha256:[a-f0-9]{64}', digest), 'Missing pushed image digest'
+          server_digest = os.environ['SERVER_DIGEST']
+          assert re.fullmatch(r'sha256:[a-f0-9]{64}', server_digest), 'Missing tested server digest'
+          path = 'helm/rmon/values.yaml'
+          values = yaml.safe_load(open(path))
+          values['image']['digest'] = digest
+          values['server']['image']['digest'] = server_digest
+          with open(path, 'w') as output:
+              yaml.safe_dump(values, output, sort_keys=False)
+          PY
+          helm package helm/rmon --destination dist
+          printf '%s' "$GH_TOKEN" | helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+          helm push "dist/rmon-chart-${CHART_VERSION}.tgz" "$CHART_REGISTRY"
+          mkdir -p pulled
+          helm pull "${CHART_REGISTRY}/rmon-chart" --version "$CHART_VERSION" --destination pulled
+          cmp "dist/rmon-chart-${CHART_VERSION}.tgz" "pulled/rmon-chart-${CHART_VERSION}.tgz"
diff --git a/.github/workflows/native-packages.yml b/.github/workflows/native-packages.yml
new file mode 100644
index 0000000..d7fdf9c
--- /dev/null
+++ b/.github/workflows/native-packages.yml
@@ -0,0 +1,172 @@
+name: RMON packages
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rmon-native-repository
+  cancel-in-progress: false
+
+jobs:
+  metadata:
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.release.outputs.version }}
+      tooling-revision: ${{ steps.tooling.outputs.revision }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Check out release tooling
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ secrets.REPO_PACKAGING_REPOSITORY }}
+          ref: ${{ vars.REPO_PACKAGING_REF }}
+          ssh-key: ${{ secrets.REPO_PACKAGING_SSH_KEY }}
+          path: build-support
+          persist-credentials: false
+      - id: tooling
+        run: echo "revision=$(git -C build-support rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+      - id: release
+        run: python3 build-support/package_tools/rmon/build.py metadata
+
+  tests:
+    needs: metadata
+    uses: ./.github/workflows/tests.yml
+
+  build:
+    needs: [metadata, tests]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Check out release tooling
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ secrets.REPO_PACKAGING_REPOSITORY }}
+          ref: ${{ needs.metadata.outputs.tooling-revision }}
+          ssh-key: ${{ secrets.REPO_PACKAGING_SSH_KEY }}
+          path: build-support
+          persist-credentials: false
+      - run: docker build -t rmon-package-tools build-support/package_tools/rmon
+      - name: Test package publication and reruns
+        run: docker run --rm -v "$PWD:/src:ro" rmon-package-tools python3 -m pytest build-support/package_tools/rmon/tests -q -p no:cacheprovider
+      - name: Build DEB and RPM from the tagged checkout
+        run: |
+          mkdir -p dist
+          docker run --rm -v "$PWD:/src:ro" -v "$PWD/dist:/output" rmon-package-tools python3 build-support/package_tools/rmon/build.py deb --output /output
+          docker run --rm -v "$PWD:/src:ro" -v "$PWD/dist:/output" rmon-package-tools python3 build-support/package_tools/rmon/build.py el9 --output /output
+          docker run --rm -v "$PWD:/src:ro" -v "$PWD/dist:/output" rmon-package-tools python3 build-support/package_tools/rmon/build.py el10 --output /output
+      - name: Verify installation on Ubuntu and Rocky Linux
+        run: |
+          docker run --rm -v "$PWD/dist:/packages:ro" -v "$PWD/build-support/package_tools/rmon/tests:/checks:ro" ubuntu:24.04 bash /checks/install.sh deb
+          docker run --rm -v "$PWD/dist:/packages:ro" -v "$PWD/build-support/package_tools/rmon/tests:/checks:ro" rockylinux:9 bash /checks/install.sh el9
+          docker run --rm -v "$PWD/dist:/packages:ro" -v "$PWD/build-support/package_tools/rmon/tests:/checks:ro" rockylinux/rockylinux:10 bash /checks/install.sh el10
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rmon-native-packages
+          path: |
+            dist/*.deb
+            dist/*.rpm
+          if-no-files-found: error
+          retention-days: 7
+          overwrite: true
+
+  publish:
+    needs: [metadata, build]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    env:
+      REPO_S3_ENDPOINT: ${{ vars.REPO_S3_ENDPOINT }}
+      REPO_S3_BUCKET: ${{ vars.REPO_S3_BUCKET }}
+      REPO_S3_REGION: ${{ vars.REPO_S3_REGION }}
+      AWS_ACCESS_KEY_ID: ${{ secrets.REPO_S3_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.REPO_S3_SECRET_ACCESS_KEY }}
+      REPO_GPG_KEY_ID: ${{ vars.REPO_GPG_KEY_ID }}
+      REPO_GPG_PRIVATE_KEY: ${{ secrets.REPO_GPG_PRIVATE_KEY }}
+      REPO_GPG_PASSPHRASE: ${{ secrets.REPO_GPG_PASSPHRASE }}
+      RELEASE_VERSION: ${{ needs.metadata.outputs.version }}
+      RELEASE_REVISION: ${{ github.sha }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Check out release tooling
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ secrets.REPO_PACKAGING_REPOSITORY }}
+          ref: ${{ needs.metadata.outputs.tooling-revision }}
+          ssh-key: ${{ secrets.REPO_PACKAGING_SSH_KEY }}
+          path: build-support
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+        with:
+          name: rmon-native-packages
+          path: dist
+      - name: Check publication configuration
+        run: |
+          python3 - <<'PY'
+          import os
+          required = ['REPO_S3_ENDPOINT','REPO_S3_BUCKET','AWS_ACCESS_KEY_ID','AWS_SECRET_ACCESS_KEY','REPO_GPG_KEY_ID','REPO_GPG_PRIVATE_KEY']
+          missing = [name for name in required if not os.environ.get(name)]
+          if missing:
+              raise SystemExit('Configure Actions settings: ' + ', '.join(missing))
+          PY
+      - run: docker build -t rmon-package-tools build-support/package_tools/rmon
+      - name: Sign packages and replace this release in S3
+        run: |
+          docker run --rm -v "$PWD:/src:ro" \
+            --env GITHUB_REPOSITORY --env GITHUB_RUN_ID \
+            --env REPO_S3_ENDPOINT --env REPO_S3_BUCKET --env REPO_S3_REGION \
+            --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY \
+            --env REPO_GPG_KEY_ID --env REPO_GPG_PRIVATE_KEY --env REPO_GPG_PASSPHRASE \
+            rmon-package-tools python3 build-support/package_tools/rmon/repository.py \
+            --artifacts /src/dist --version "$RELEASE_VERSION" --revision "$RELEASE_REVISION"
+
+  verify:
+    needs: [metadata, publish]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: ubuntu:24.04
+            format: deb
+          - image: rockylinux:9
+            format: el9
+          - image: rockylinux/rockylinux:10
+            format: el10
+    env:
+      RMON_PACKAGE_REPOSITORY: https://repo.rmon.io
+      RMON_PACKAGE_VERSION: ${{ needs.metadata.outputs.version }}
+      REPO_GPG_KEY_ID: ${{ vars.REPO_GPG_KEY_ID }}
+      TEST_IMAGE: ${{ matrix.image }}
+      TEST_FORMAT: ${{ matrix.format }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Check out release tooling
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ secrets.REPO_PACKAGING_REPOSITORY }}
+          ref: ${{ needs.metadata.outputs.tooling-revision }}
+          ssh-key: ${{ secrets.REPO_PACKAGING_SSH_KEY }}
+          path: build-support
+          persist-credentials: false
+      - name: Install the published release from the public repository with APT or DNF
+        run: |
+          docker run --rm -v "$PWD/build-support/package_tools/rmon/tests:/checks:ro" \
+            --env RMON_PACKAGE_REPOSITORY --env RMON_PACKAGE_VERSION --env REPO_GPG_KEY_ID \
+            "$TEST_IMAGE" bash /checks/install.sh "$TEST_FORMAT"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e697757..8079b97 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,11 +6,28 @@ on:
   pull_request:
     branches: [main]
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
 
 jobs:
+  frontend-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        working-directory: tests/frontend
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: tests/frontend/package-lock.json
+      - run: npm ci --ignore-scripts
+      - run: npm test
+
   unit-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -35,7 +52,7 @@ jobs:
           python -m pip install -r requirements.txt -r requirements-dev.txt
 
       - name: Compile Python sources
-        run: python -m compileall -q app tests scheduler_runner.py rotate_credential_secret.py
+        run: python -m compileall -q app tests container gunicorn.conf.py scheduler_runner.py rotate_credential_secret.py
 
       - name: Smoke test application startup
         run: python -m pytest tests/smoke -q
diff --git a/.gitignore b/.gitignore
index 1c0bc40..5313acb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,11 @@ __pycache__/
 /.pytest_cache/
 /.coverage
 /.idea/
+/tests/frontend/node_modules/
+/.env
+/.env.*
+!/.env.example
+/secrets/
+/backups/
+/compose.override.yaml
+/compose.rollback.yaml
diff --git a/CLA.md b/CLA.md
new file mode 100644
index 0000000..f4dce2d
--- /dev/null
+++ b/CLA.md
@@ -0,0 +1,128 @@
+# RMON Contributor License Agreement
+
+This Contributor License Agreement ("Agreement") applies to each contribution
+that you submit to RMON after this Agreement is adopted by the project.
+
+By expressly accepting this Agreement in connection with a pull request or
+other contribution, you agree to the terms below.
+
+## 1. Definitions
+
+"Contribution" means any original work of authorship, including source code,
+documentation, tests, designs, or other material, that you intentionally submit
+to the RMON project for inclusion in the project.
+
+"Project" means RMON and the repositories maintained as part of the
+RMON project.
+
+"Project Owner" means the copyright holder or entity authorized to maintain
+and license RMON.
+
+## 2. Your ownership
+
+You retain ownership of the copyright in your Contribution. This Agreement is a
+license grant; it is not an assignment of your copyright.
+
+## 3. Copyright license
+
+You grant the Project Owner and recipients of software distributed by the
+Project Owner a perpetual, worldwide, non-exclusive, royalty-free,
+irrevocable copyright license to reproduce, prepare derivative works of,
+publicly display, publicly perform, distribute, and otherwise use your
+Contribution as part of RMON.
+
+You also grant the Project Owner the right to sublicense and relicense your
+Contribution, including as part of RMON, under source-available,
+open-source, proprietary, commercial, or other software-license terms chosen by
+the Project Owner.
+
+This includes the right to offer RMON containing your Contribution
+under both the project's public source license and separate commercial license
+terms.
+
+## 4. Patent license
+
+To the extent you can grant patent rights, you grant the Project Owner and
+recipients of RMON a perpetual, worldwide, non-exclusive,
+royalty-free patent license under patent claims that you control and that are
+necessarily infringed by your Contribution alone or by combination of your
+Contribution with the Project as submitted.
+
+If a recipient institutes patent litigation alleging that the Contribution or
+RMON infringes a patent, that recipient's patent license granted under
+this section terminates to the extent permitted by applicable law.
+
+## 5. Authority to contribute
+
+You represent that:
+
+- you are legally entitled to grant the rights in this Agreement;
+- the Contribution is your original work, or you have sufficient rights to
+  submit it under this Agreement;
+- to your knowledge, the Contribution does not intentionally include material
+  that cannot legally be contributed to the Project;
+- if your employer or another organization owns rights in the Contribution,
+  you have obtained authorization to submit it and grant the rights in this
+  Agreement.
+
+If you are contributing on behalf of a company or other organization, you
+represent that you are authorized to accept this Agreement on its behalf, or
+that an authorized representative has separately approved the contribution.
+
+## 6. Third-party material
+
+If a Contribution includes third-party material, identify that material and its
+license clearly in the pull request or accompanying documentation. Do not submit
+third-party code whose license is incompatible with RMON's licensing
+model.
+
+## 7. No obligation
+
+The Project Owner is not required to use, merge, distribute, support, or retain
+any Contribution.
+
+## 8. No warranties
+
+Unless required by applicable law or agreed separately in writing, your
+Contribution is provided without warranties or conditions of any kind.
+
+## 9. Public licensing and commercial licensing
+
+You understand that RMON may be distributed under the Elastic License
+2.0 or another public license selected by the Project Owner and may also be
+licensed to other parties under separate commercial or proprietary terms.
+
+No revenue share, royalty, fee, or other payment is owed to you merely because
+your Contribution is included in a commercially licensed version of
+RMON.
+
+## 10. How to accept
+
+For a GitHub pull request, accept this Agreement by posting the following
+comment on the pull request:
+
+`/sign-cla`
+
+The project's GitHub workflow records the acceptance together with your
+numeric GitHub user ID, the accepted CLA version, the date of acceptance,
+and the originating pull request/comment.
+
+You only need to accept a particular version of this Agreement once. If this
+Agreement changes, the Project may require you to accept the new version before
+additional Contributions are merged.
+
+A Contribution must not be merged unless the contributor has expressly
+accepted the applicable version of this Agreement.
+
+## 11. Existing contributions
+
+This Agreement does not retroactively change the license under which a
+Contribution was previously submitted and accepted before the Project adopted
+this CLA. Existing contributions remain subject to the rights already granted
+for those contributions unless the contributor separately agrees otherwise.
+
+## 12. Entire contributor agreement
+
+This Agreement governs the rights granted for Contributions submitted after its
+adoption unless the contributor and Project Owner enter into a separate written
+agreement covering those Contributions.
diff --git a/COMMERCIAL_LICENSE.md b/COMMERCIAL_LICENSE.md
new file mode 100644
index 0000000..b1a35c4
--- /dev/null
+++ b/COMMERCIAL_LICENSE.md
@@ -0,0 +1,74 @@
+# RMON commercial licensing
+
+RMON is available under the Elastic License 2.0 (ELv2) for uses
+permitted by that license. Separate commercial licensing is available for
+organizations that need additional rights.
+
+## Hosted and managed services
+
+If your organization wants to provide RMON, or a service exposing a
+substantial set of RMON features or functionality, to third parties as
+a hosted or managed service, obtain a commercial license before launching that
+offering.
+
+Commercial licensing can cover use cases such as:
+
+- SaaS and RMON-as-a-Service;
+- managed or multi-tenant RMON hosting;
+- white-label hosted services;
+- OEM or embedded commercial distribution;
+- negotiated redistribution rights;
+- commercial branding arrangements;
+- enterprise support, warranty, indemnity, or other negotiated terms.
+
+## No commercial rights are granted by this file
+
+This document describes the availability of commercial licensing. It is not a
+commercial license grant and does not itself give any organization additional
+rights beyond the license that already applies to the software.
+
+Additional commercial rights exist only after the copyright holder and the
+customer enter into a separate written agreement that expressly grants those
+rights.
+
+## Expected commercial agreement
+
+A signed commercial agreement should normally identify at least:
+
+- the licensor's legal name and address;
+- the customer's legal name and address;
+- the RMON software and versions covered;
+- whether SaaS, hosted, managed, OEM, white-label, or redistribution rights are
+  granted;
+- permitted production environments, customers, tenants, or usage limits, if
+  applicable;
+- fees and payment terms;
+- agreement term and renewal terms;
+- support and service obligations, if any;
+- confidentiality terms, if any;
+- intellectual-property ownership;
+- warranty, liability, and indemnity terms;
+- termination and post-termination rights;
+- governing law and dispute-resolution terms.
+
+## Requesting a license
+
+Contact the RMON copyright holder through the project repository with:
+
+1. your organization's legal name;
+2. a short description of the product or service;
+3. whether customers will access the RMON UI, APIs, or monitoring checks;
+4. whether the service is single-tenant or multi-tenant;
+5. expected number of customers or deployments;
+6. whether you need white-label, OEM, redistribution, support, or indemnity
+   rights.
+
+The copyright holder can then provide commercial terms appropriate for that
+use case.
+
+## Legal identity
+
+A repository username or project name should not be used as a substitute for
+the licensor's legal identity in a signed commercial agreement. Before signing
+a commercial agreement, replace project-only identifiers with the correct legal
+name, address, and other required contracting details.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..1639130
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,50 @@
+# Contributing to RMON
+
+## Backend changes policy
+
+Any backend code change must be covered by tests.
+
+When changing backend logic:
+
+- add new tests for new behavior;
+- update existing tests for changed behavior;
+- do not remove failing tests unless the tested behavior was intentionally removed;
+- if a backend change does not need tests, explain why in the pull request.
+
+## Contributor License Agreement
+
+RMON uses a Contributor License Agreement so that contributions can be
+distributed under the project's public source license and, where applicable,
+under separate commercial terms.
+
+Before a pull request can be merged, read [CLA.md](CLA.md) and accept it by
+posting this exact comment on your pull request:
+
+`/sign-cla`
+
+Acceptance is recorded against your numeric GitHub user ID and the version of
+`CLA.md` on the repository's default branch. You only need to sign once per CLA
+version. A checked box or a statement in the pull request description does not
+replace the signing comment.
+
+The `CLA` status check verifies the pull request author's acceptance. If a pull
+request contains contributions from other people, maintainers must also ensure
+that those contributors have accepted the applicable CLA. Identify third-party
+material and its license in the pull request.
+
+Do not merge a contribution until the applicable contributors have expressly
+accepted the CLA.
+
+## Maintainer setup
+
+The signing workflow reads `CLA.md` from the default branch. Publish the CLA and
+`.github/workflows/cla.yml` there before relying on the signing workflow for
+pull requests targeting `main` or `release/**`.
+
+Configure the repository's branch protection or rulesets to require the `CLA`
+status check. Adding the workflow alone does not enforce a merge restriction.
+
+The workflow maintains a public `[CLA] Signature Registry` issue. Only signature
+records written by the workflow's GitHub Actions bot are accepted. Changes to
+the CLA on the default branch refresh open pull request statuses and require
+contributors to accept the new version.
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..3a1c162
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,36 @@
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      python3 python3-venv python3-ldap python3-pkg-resources \
+      ca-certificates openssl openssh-client sshpass git util-linux \
+      iputils-ping iputils-tracepath dnsutils netcat-openbsd nmap \
+    && rm -rf /var/lib/apt/lists/* \
+    && python3 -m venv --system-site-packages /opt/rmon-venv
+
+ENV PATH="/opt/rmon-venv/bin:${PATH}" \
+    PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 \
+    RMON_CONTAINER=1 RMON_PROXY_MODE=1 RMON_PROMETHEUS_MULTIPROC_DIR=/tmp/rmon-prometheus \
+    ANSIBLE_HOME=/tmp/ansible-local ANSIBLE_LOCAL_TEMP=/tmp/ansible-local ANSIBLE_REMOTE_TEMP=/tmp/ansible-remote
+
+WORKDIR /var/www/rmon
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+COPY app/scripts/ansible/requirements.yml /tmp/ansible-requirements.yml
+RUN ANSIBLE_HOME=/tmp/ansible-build ANSIBLE_LOCAL_TEMP=/tmp/ansible-build ansible-galaxy collection install \
+      -r /tmp/ansible-requirements.yml -p /usr/share/ansible/collections
+COPY app ./app
+COPY config_other ./config_other
+COPY container ./container
+COPY app.wsgi gunicorn.conf.py scheduler_runner.py operations_runner.py runtime_health.py rotate_credential_secret.py favicon.ico LICENSE NOTICE LICENSING.md ./
+RUN install -d /etc/rmon /var/lib/rmon /var/log/rmon \
+    && install -d -o www-data -g www-data \
+       app/scripts/ansible/inventory app/scripts/ansible/artifacts app/scripts/ansible/env /tmp/ansible-local \
+    && chmod -R go-w /var/www/rmon
+
+EXPOSE 8080
+STOPSIGNAL SIGTERM
+HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+    CMD ["/opt/rmon-venv/bin/python", "-m", "container.runtime", "healthcheck"]
+ENTRYPOINT ["/opt/rmon-venv/bin/python", "-m", "container.runtime"]
+CMD ["serve"]
diff --git a/LICENSE b/LICENSE
index 3d84448..cdba7ad 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,203 +1,94 @@
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   10. Modification and distribution for commercial purposes is prohibited without the consent of the author.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [2024] [Pavel Loginov]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor's trademarks is
+subject to applicable law.
+
+Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software.
+
+If you or your company make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license for the software
+granted under these terms ends immediately. If your company makes such a claim,
+your patent license ends immediately for work on behalf of your company.
+
+Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of legal
+claim.
+
+Definitions
+
+The licensor is the entity offering these terms, and the software is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+you refers to the individual or entity agreeing to these terms.
+
+your company is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+control means ownership of substantially all the assets of an entity, or the
+power to direct its management and policies by vote, contract, or otherwise.
+Control can be direct or indirect.
+
+your licenses are all the licenses granted to you for the software under these
+terms.
+
+use means anything you do with the software requiring one of your licenses.
+
+trademark means trademarks, service marks, and similar rights.
diff --git a/LICENSING.md b/LICENSING.md
new file mode 100644
index 0000000..6f370e4
--- /dev/null
+++ b/LICENSING.md
@@ -0,0 +1,110 @@
+# RMON licensing
+
+RMON uses a source-available licensing model designed to keep
+self-hosting broadly available while reserving hosted/managed RMON
+services for commercial licensing.
+
+## Community license
+
+Starting with the 1.4.0 release line, the RMON source distribution is offered
+under the Elastic License 2.0 (ELv2), SPDX identifier `Elastic-2.0`.
+
+The canonical ELv2 text is published by Elastic at:
+https://www.elastic.co/licensing/elastic-license
+
+An SPDX reference is available at:
+https://spdx.org/licenses/Elastic-2.0.html
+
+ELv2 is source-available, but it is not an OSI-approved Open Source license.
+
+## Typical permitted uses
+
+Subject to the complete ELv2 terms, typical permitted uses include:
+
+- running RMON internally in your own organization;
+- modifying RMON for your own internal use;
+- evaluating, testing, and developing against RMON;
+- redistributing RMON subject to ELv2 requirements;
+- a consultant installing or operating RMON for a customer where the
+  customer is using it internally and the consultant is not offering
+  RMON itself as a hosted product to multiple third parties.
+
+## When a commercial license is required
+
+A separate commercial agreement is required when you want rights that are not
+granted by ELv2. The primary example is offering RMON, or a service
+that exposes a substantial set of RMON features or functionality, to
+third parties as a hosted or managed service.
+
+Examples include:
+
+- RMON-as-a-Service;
+- a hosted monitoring product that substantially exposes the
+  RMON UI, APIs, monitoring checks, or feature set to customers;
+- a managed multi-tenant RMON offering;
+- a white-label hosted RMON service;
+- another hosted or managed offering where commercial rights beyond ELv2 are
+  needed.
+
+A commercial license may also be used for negotiated OEM, redistribution,
+branding, support, indemnity, warranty, or other enterprise rights.
+
+See `COMMERCIAL_LICENSE.md` for the commercial licensing process.
+
+## What is not automatically a hosted RMON service
+
+Using RMON as an internal component of a larger service does not by
+itself mean that the larger service is prohibited. The controlling terms are
+the ELv2 terms, including whether third-party users are given access to a
+substantial set of RMON features or functionality.
+
+When a proposed deployment is close to that boundary, obtain written licensing
+confirmation before launching the service.
+
+## Historical releases
+
+RMON versions and copies distributed before this licensing change remain
+subject to the terms that accompanied those copies. This change does not revoke
+previously granted rights or retroactively apply ELv2 to earlier copies.
+
+Before this change, the repository's `LICENSE` contained the Apache License 2.0
+text with an additional clause restricting modification and distribution for
+commercial purposes without the author's consent. The exact previous text is
+preserved in [licenses/legacy/LICENSE-before-1.4.0.txt](licenses/legacy/LICENSE-before-1.4.0.txt)
+for historical reference. It is not an alternative license for the current
+source distribution.
+
+Consult the license and notices shipped with the particular historical copy;
+the transition does not relabel those terms as MIT or unmodified Apache 2.0.
+
+## Contributions
+
+New contributions are accepted only under the contributor terms in `CLA.md`.
+Those terms are intended to ensure that RMON can continue to be
+published under ELv2 while also being offered under separate commercial terms.
+
+Contributors retain ownership of their contributions but grant the project the
+rights described in the CLA, including the rights needed for sublicensing and
+commercial licensing.
+
+## Third-party dependencies
+
+Third-party dependencies and vendored components retain their own licenses.
+Nothing in RMON's licensing files changes the license of third-party
+software.
+
+## Trademarks
+
+A software license does not automatically grant rights to project names,
+logos, service marks, or other trademarks except to the extent required by
+applicable law or expressly stated in a separate agreement.
+
+## Questions and commercial licensing
+
+For a proposed SaaS, hosted, managed, OEM, white-label, or other commercial use,
+contact the RMON copyright holder through the project repository before
+launching the offering.
+
+A signed commercial agreement should identify the licensor and licensee by
+legal name and should state the exact rights granted, fees, term, support (if
+any), liability terms, governing law, and termination terms.
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..fc636f9
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,6 @@
+RMON
+Copyright 2024 Pavel Loginov
+
+Third-party dependencies and vendored components retain their own copyright
+notices and licenses. See LICENSING.md for the current licensing model and
+historical release terms.
diff --git a/README.md b/README.md
index b315b76..2092f44 100644
--- a/README.md
+++ b/README.md
@@ -1,57 +1,47 @@
-# ![alt text](https://rmon.io/static/images/logo/orange_640.png "Logo")
-RMON (remote monitoring) is an easy to understand and use geo-distributed monitoring.
+# RMON
 
-# Get involved
-* [Telegram Channel](https://t.me/roxy_wi_channel) about RMON, talks and questions are welcome
+RMON monitors service availability from multiple locations, records results and alerts your team. It supports HTTP(S), TCP, Ping, DNS, SMTP and RabbitMQ checks, notification channels and public status pages.
 
-![alt text](https://rmon.io/static//images/rmon_history_dashboard.png "RMON check history")
+![RMON Dashboard](https://rmon.io/static/images/docs/dashboard.jpg)
 
-# Features:
-1. Checking ping availability
-2. Checking DNS records availability
-3. Checking the availability of TCP and UDP ports
-4. Checking HTTP statuses
-5. Checking the BODY of HTTP(s) responses
-6. Checking the SSL expiration date
-7. Checking SMTP service
-8. Checking RabbitMQ service
-9. Sending Telegram, Slack, PagerDuty and Email notifications
-10. Real-time alerting via RMON web interface
-11. Checking network connectivity
-12. Providing information upon response time
-13. Providing information upon servers uptime and downtime
-14. Storing the alarm history
-15. Storing the history of events for each host
-16. Status pages
-17. RMON Agents 
-18. Network tools
+## Get started
 
-# Install
+Follow the [installation guide](https://rmon.io/installation) for native installations or Docker. For a new Docker deployment, prepare `compose.yaml` and `.env` as described in the [Docker guide](https://rmon.io/installation#docker), make the selected images available on the host, then run:
 
-For installation on EL and Ubuntu read this [guide](https://rmon.io/installation)
+```sh
+docker compose config --quiet
+docker compose run --rm --no-deps web init
+docker compose up -d --no-build
+```
 
-## Security configuration
+Choose the administrator password when prompted and open your RMON HTTPS address. For an existing installation, follow the [migration guide](https://rmon.io/installation#docker-existing-rmon-installation) and preserve the database and application keys; do not run `init`.
 
-RMON no longer ships reusable application or credential-encryption secrets. Set these values in the service environment before starting RMON:
+Add [hosts and SSH credentials](https://rmon.io/howto/setup), [install agents](https://rmon.io/howto/manage-agents), then [create a check](https://rmon.io/howto/assign-checks). The website covers [HTTPS and mTLS settings](https://rmon.io/settings#agent-connections), [notifications](https://rmon.io/howto/notifications), [status pages](https://rmon.io/howto/status-pages) and [updates and backups](https://rmon.io/update-guide).
 
-- `RMON_SECRET_KEY`: a random value of at least 32 characters for Flask sessions.
-- `RMON_SECRET_PHRASE`: a Fernet key for stored SSH passwords, passphrases, and private keys. Generate one with `python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"`.
-- `RMON_JWT_PRIVATE_KEY_FILE` and `RMON_JWT_PUBLIC_KEY_FILE`: optional overrides for the default JWT key paths in `/var/lib/rmon/keys`.
+For Kubernetes, prepare the Secrets, storage and `values.yaml` using the [Kubernetes guide](https://rmon.io/installation#kubernetes), then install:
 
-The Flask secret may instead be stored in `RMON_SECRET_KEY_FILE`; when neither setting exists, RMON creates `/var/lib/rmon/keys/flask-secret` with mode `0600`. The scheduler itself remains enabled by default, but its unauthenticated REST API is disabled. Set `RMON_SCHEDULER_ENABLED=0` when a separate scheduler process is used.
+```sh
+helm upgrade --install rmon oci://ghcr.io/roxy-wi/rmon/rmon-chart \
+  --version 1.4.2 --namespace rmon --create-namespace \
+  --values values.yaml --wait --timeout 10m
+```
 
-To rotate an existing credential key, back up the database and run `rotate_credential_secret.py` with both `RMON_OLD_SECRET_PHRASE` and the new `RMON_SECRET_PHRASE` in the environment. The update is transactional and can safely skip values that were already rotated.
+## Plans and support
 
-## OpenID Connect
+RMON is a commercial product. See [documentation](https://rmon.io/howto) and [support contacts](https://rmon.io/contacts).
 
-Super administrators can configure one or more OIDC providers under **Admin area → OIDC**. RMON supports discovery metadata, signed ID-token validation through JWKS, optional UserInfo claims, verified-email and domain policies, automatic user creation or email linking, and external-group mappings to RMON groups and roles. Local and LDAP login remain available.
+## License
 
-Set `RMON_PUBLIC_URL=https://rmon.example.com` when RMON is behind a reverse proxy so the generated callback URL uses the public origin. Register the displayed `/oidc/<provider>/callback` URL in the identity provider and include at least the `openid` scope. OIDC client secrets are encrypted with `RMON_SECRET_PHRASE` and are included in `rotate_credential_secret.py` rotations.
+Starting with the 1.4.0 release line, RMON is source-available under the
+[Elastic License 2.0](LICENSE) (`Elastic-2.0`). Self-hosted and internal use is
+available subject to ELv2. Offering RMON, or a service exposing a substantial
+set of its functionality, to third parties as a hosted or managed service
+requires rights permitted by ELv2 or a separate commercial license.
 
-## Subscription feature catalog
+See [LICENSING.md](LICENSING.md) for usage examples and historical release
+terms, and [COMMERCIAL_LICENSE.md](COMMERCIAL_LICENSE.md) for commercial
+licensing. Contributions are subject to [CLA.md](CLA.md); see
+[CONTRIBUTING.md](CONTRIBUTING.md) for the signing process.
 
-Subscription checks are centralized in `app/modules/subscription/access.py`, following the Roxy-WI entitlement model. The catalog covers OIDC, action history, monitoring history, alert history, alerting channels, status pages, monitoring check and agent limits, and service control.
-
-All cataloged features are currently free. `SUBSCRIPTION_ENFORCEMENT_ENABLED` is intentionally set to `False` in the subscription module, so stored license status and plan values do not restrict access. When paid enforcement is ready, change that code constant to `True`; the existing feature policies, route guards, business-service checks, UI visibility rules, and plan limits will become active together.
-
-![alt text](https://rmon.io/static//images/rmon_checks.png "RMON checks")
+Historical versions and copies retain the terms that accompanied them.
+Third-party dependencies and vendored components retain their own licenses.
diff --git a/app/__init__.py b/app/__init__.py
index 2f623aa..05e574e 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -7,9 +7,12 @@
 from prometheus_client import multiprocess
 from prometheus_client.core import CollectorRegistry
 from prometheus_flask_exporter import PrometheusMetrics
+from app.version import get_service_version
 
 app = Flask(__name__)
 app.config.from_object('app.config.Configuration')
+from app.modules.common.proxy import configure_trusted_proxy
+configure_trusted_proxy(app)
 app.jinja_env.add_extension('jinja2.ext.do')
 app.jinja_env.add_extension('jinja2.ext.loopcontrols')
 
@@ -27,7 +30,7 @@
 multiprocess.MultiProcessCollector(registry, path=os.getenv('RMON_PROMETHEUS_MULTIPROC_DIR', '/tmp'))
 
 metrics = PrometheusMetrics(app, registry=registry)
-metrics.info('rmon', 'RMON app', version='1.2.12')
+metrics.info('rmon', 'RMON app', version=get_service_version())
 
 from app.api.v1.routes.main import bp as main_api_v1_0_bp
 from app.api.v1.routes.user import bp as user_api_v1_0_bp
diff --git a/app/api/v1/routes/main/routes.py b/app/api/v1/routes/main/routes.py
index fdfac4a..2528608 100644
--- a/app/api/v1/routes/main/routes.py
+++ b/app/api/v1/routes/main/routes.py
@@ -45,7 +45,7 @@ def register_api_with_group(view, endpoint, url_beg, pk='receiver', pk_type='int
 )
 
 bp.add_url_rule(
-    '/settings/<any(rmon, main, rabbitmq, ldap, monitoring, mail, logs):section>',
+    '/settings/<any(rmon, main, ldap, monitoring, mail, logs, agent):section>',
     view_func=SettingsView.as_view('settings_section'),
     methods=['GET', 'POST']
 )
diff --git a/app/create_db.py b/app/create_db.py
index 0c4e14b..7b72cd4 100644
--- a/app/create_db.py
+++ b/app/create_db.py
@@ -48,14 +48,6 @@ def default_values():
 		{'param': 'use_victoria_metrics', 'value': '0', 'section': 'smon', 'desc': '', 'group_id': '1'},
 		{'param': 'victoria_metrics_select', 'value': '', 'section': 'smon', 'desc': '', 'group_id': '1'},
 		{'param': 'victoria_metrics_insert', 'value': '', 'section': 'smon', 'desc': '', 'group_id': '1'},
-		{'param': 'rabbitmq_enabled', 'value': '0', 'section': 'rabbitmq', 'desc': 'Enable alerting in the WEB panel', 'group_id': '1'},
-		{'param': 'rabbitmq_host', 'value': '127.0.0.1', 'section': 'rabbitmq', 'desc': 'RabbitMQ-server host', 'group_id': '1'},
-		{'param': 'rabbitmq_port', 'value': '5672', 'section': 'rabbitmq', 'desc': 'RabbitMQ-server port', 'group_id': '1'},
-		{'param': 'rabbitmq_port', 'value': '5672', 'section': 'rabbitmq', 'desc': 'RabbitMQ-server port', 'group_id': '1'},
-		{'param': 'rabbitmq_vhost', 'value': '/', 'section': 'rabbitmq', 'desc': 'RabbitMQ-server vhost', 'group_id': '1'},
-		{'param': 'rabbitmq_queue', 'value': 'rmon', 'section': 'rabbitmq', 'desc': 'RabbitMQ-server queue', 'group_id': '1'},
-		{'param': 'rabbitmq_user', 'value': 'rmon', 'section': 'rabbitmq', 'desc': 'RabbitMQ-server user', 'group_id': '1'},
-		{'param': 'rabbitmq_password', 'value': 'rmon123', 'section': 'rabbitmq', 'desc': 'RabbitMQ-server user password', 'group_id': '1'},
 		{'param': 'mail_ssl', 'value': '0', 'section': 'mail', 'desc': 'Enable TLS', 'group_id': '1'},
 		{'param': 'mail_from', 'value': '', 'section': 'mail', 'desc': 'Address of sender', 'group_id': '1'},
 		{'param': 'mail_smtp_host', 'value': '', 'section': 'mail', 'desc': 'SMTP server address', 'group_id': '1'},
@@ -70,7 +62,8 @@ def default_values():
 	]
 
 	try:
-		Setting.insert_many(data_source).on_conflict_ignore().execute()
+		from app.modules.common.agent_transport import setting_rows
+		Setting.insert_many(data_source + setting_rows(1)).on_conflict_ignore().execute()
 	except Exception as e:
 		print(str(e))
 
@@ -124,10 +117,8 @@ def default_values():
 		print(str(e))
 
 	data_source = [
-		{'name': 'rmon-socket', 'current_version': '1.0', 'new_version': '0', 'is_roxy': 1, 'desc': ''},
 		{'name': 'rmon-server', 'current_version': '1.0', 'new_version': '0', 'is_roxy': 1, 'desc': ''},
 		{'name': 'fail2ban', 'current_version': '1.0', 'new_version': '1.0', 'is_roxy': 0, 'desc': 'Fail2ban service'},
-		{'name': 'rabbitmq-server', 'current_version': '1.0', 'new_version': '1.0', 'is_roxy': 0, 'desc': 'Rabbitmq service'},
 	]
 
 	try:
@@ -146,5 +137,20 @@ def default_values():
 
 
 if __name__ == "__main__":
+	# Models describe the current schema; historical rename/drop migrations must
+	# not be replayed against a freshly created database.
+	bootstrap_connection = connect()
+	try:
+		was_empty = not bootstrap_connection.get_tables()
+	finally:
+		bootstrap_connection.close()
 	create_tables()
 	default_values()
+	if was_empty:
+		from app.modules.db.migrations import get_migration_files
+		from app.version import get_service_version
+		if User.select().count() != 3 or Role.select().count() != 4 or not Setting.select().exists():
+			raise RuntimeError('New database initialization is incomplete; migrations were not baselined')
+		for filename in get_migration_files():
+			Migration.create(name=filename[:-3])
+		Version.insert(version=get_service_version()).execute()
diff --git a/app/jobs.py b/app/jobs.py
index 3b8dec4..fad52d8 100644
--- a/app/jobs.py
+++ b/app/jobs.py
@@ -67,6 +67,8 @@ def delete_old_logs():
 
 @scheduler.task('interval', id='update_owner_on_log', hours=12, misfire_grace_time=None)
 def update_owner_on_log():
+    if os.getenv('RMON_CONTAINER') == '1':
+        return
     log_path = get_config.get_config_var('main', 'log_path')
     try:
         if distro.id() == 'ubuntu':
@@ -79,13 +81,28 @@ def update_owner_on_log():
 
 @scheduler.task('interval', id='delete_ansible_artifacts', hours=24, misfire_grace_time=None)
 def delete_ansible_artifacts():
+    from app.modules.db.db_model import OperationJob, conn
+    try:
+        if OperationJob.select().where(OperationJob.status == 'running').exists():
+            return
+    finally:
+        conn.close()
     ansible_path = '/var/www/rmon/app/scripts/ansible'
     folders = ['artifacts', 'env']
 
     for folder in folders:
         if os.path.isdir(f'{ansible_path}/{folder}'):
             try:
-                shutil.rmtree(f'{ansible_path}/{folder}')
+                # Preserve writable roots and recent files created by operations.
+                cutoff = datetime.datetime.now().timestamp() - 2 * 86400
+                with os.scandir(f'{ansible_path}/{folder}') as entries:
+                    for entry in entries:
+                        if entry.stat(follow_symlinks=False).st_mtime >= cutoff:
+                            continue
+                        if entry.is_dir(follow_symlinks=False):
+                            shutil.rmtree(entry.path)
+                        else:
+                            os.unlink(entry.path)
             except Exception as e:
                 raise Exception(f'error: Cron cannot delete ansible folders: {e}')
 
@@ -110,3 +127,13 @@ def delete_smon_history():
     app = scheduler.app
     with app.app_context():
         smon_sql.delete_smon_history()
+
+
+@scheduler.task('interval', id='cleanup_operations', hours=24, max_instances=1, coalesce=True)
+def cleanup_operations():
+    from app.modules.operations.queue import cleanup
+    from app.modules.db.db_model import conn
+    try:
+        return cleanup()
+    finally:
+        conn.close()
diff --git a/app/migrate.py b/app/migrate.py
index dd5cb01..f149321 100755
--- a/app/migrate.py
+++ b/app/migrate.py
@@ -2,16 +2,16 @@
 import os
 import sys
 import argparse
+from tempfile import TemporaryDirectory
 
 # Add the app directory to the Python path
 sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
-from app.modules.db.migrations import (
-    create_migration, migrate, rollback, list_migrations, MigrationError
-)
-
-
 def main():
+    from app.modules.db.migrations import (
+        create_migration, migrate, rollback, list_migrations, MigrationError
+    )
+
     parser = argparse.ArgumentParser(description='RMON Database Migration Tool')
     subparsers = parser.add_subparsers(dest='command', help='Command to run')
 
@@ -53,4 +53,8 @@ def main():
 
 
 if __name__ == '__main__':
-    main()
+    os.environ['RMON_SCHEDULER_ENABLED'] = '0'
+    # CLI imports initialize metrics too; keep them separate from running services.
+    with TemporaryDirectory(prefix='rmon-migrate-metrics-') as metrics_directory:
+        os.environ['RMON_PROMETHEUS_MULTIPROC_DIR'] = metrics_directory
+        main()
diff --git a/app/migrations/20260911000000_add_agent_result_transport.py b/app/migrations/20260911000000_add_agent_result_transport.py
new file mode 100644
index 0000000..98a75b1
--- /dev/null
+++ b/app/migrations/20260911000000_add_agent_result_transport.py
@@ -0,0 +1,34 @@
+from peewee import CharField, DateTimeField
+from playhouse.migrate import migrate
+
+from app.modules.db.db_model import Groups, Setting, connect
+from app.modules.common.agent_transport import setting_rows, DEFAULTS
+
+
+FIELDS = {
+    'result_transport': CharField(null=True),
+    'applied_result_transport': CharField(null=True),
+    'transport_settings_hash': CharField(null=True),
+    'transport_checked_at': DateTimeField(null=True),
+}
+
+
+def upgrade():
+    database = connect()
+    migrator = connect(get_migrator=True)
+    existing = {column.name for column in database.get_columns('smon_agents')}
+    for name, field in FIELDS.items():
+        if name not in existing:
+            migrate(migrator.add_column('smon_agents', name, field))
+    for group in Groups.select():
+        Setting.insert_many(setting_rows(group.group_id)).on_conflict_ignore().execute()
+
+
+def downgrade():
+    database = connect()
+    migrator = connect(get_migrator=True)
+    Setting.delete().where(Setting.param.in_(tuple(DEFAULTS))).execute()
+    existing = {column.name for column in database.get_columns('smon_agents')}
+    for name in FIELDS:
+        if name in existing:
+            migrate(migrator.drop_column('smon_agents', name))
diff --git a/app/migrations/20260912000000_add_http_ssl_policy.py b/app/migrations/20260912000000_add_http_ssl_policy.py
new file mode 100644
index 0000000..e68be3c
--- /dev/null
+++ b/app/migrations/20260912000000_add_http_ssl_policy.py
@@ -0,0 +1,19 @@
+from peewee import CharField, SQL
+from playhouse.migrate import migrate
+
+from app.modules.db.db_model import connect
+
+
+def upgrade():
+    database = connect()
+    if 'ssl_policy' not in {column.name for column in database.get_columns('smon_http_check')}:
+        migrate(connect(get_migrator=True).add_column(
+            'smon_http_check', 'ssl_policy',
+            CharField(default='default', constraints=[SQL("DEFAULT 'default'")]),
+        ))
+
+
+def downgrade():
+    database = connect()
+    if 'ssl_policy' in {column.name for column in database.get_columns('smon_http_check')}:
+        migrate(connect(get_migrator=True).drop_column('smon_http_check', 'ssl_policy'))
diff --git a/app/migrations/20260913000000_remove_web_notifications.py b/app/migrations/20260913000000_remove_web_notifications.py
new file mode 100644
index 0000000..87a567d
--- /dev/null
+++ b/app/migrations/20260913000000_remove_web_notifications.py
@@ -0,0 +1,12 @@
+from app.modules.db.db_model import connect, Setting, RoxyTool
+
+
+def upgrade():
+    database = connect()
+    with database.connection_context(), database.atomic():
+        Setting.delete().where(Setting.section == 'rabbitmq').execute(database)
+        RoxyTool.delete().where(RoxyTool.name.in_(('rmon-socket', 'rabbitmq-server'))).execute(database)
+
+
+def downgrade():
+    raise RuntimeError('Restore a database backup to recover removed web-notification settings.')
diff --git a/app/migrations/20260916000000_add_operation_queue.py b/app/migrations/20260916000000_add_operation_queue.py
new file mode 100644
index 0000000..61817a3
--- /dev/null
+++ b/app/migrations/20260916000000_add_operation_queue.py
@@ -0,0 +1,21 @@
+from app.modules.db.db_model import InstallationTasks, OperationJob, OperationLock, connect
+
+
+def upgrade():
+    database = connect()
+    with database.bind_ctx([OperationJob, OperationLock]):
+        database.create_tables([OperationJob, OperationLock], safe=True)
+    index_name = 'installation_tasks_status_finish_date'
+    if index_name not in {index.name for index in database.get_indexes('installation_tasks')}:
+        from playhouse.migrate import migrate
+        migrate(connect(get_migrator=True).add_index('installation_tasks', ('status', 'finish_date')))
+
+
+def downgrade():
+    database = connect()
+    if 'operation_jobs' in database.get_tables():
+        with database.bind_ctx([OperationJob]):
+            if OperationJob.select().where(OperationJob.status.in_(('queued', 'running'))).exists():
+                raise RuntimeError('Finish pending agent operations before rolling back this migration')
+    with database.bind_ctx([OperationJob, OperationLock]):
+        database.drop_tables([OperationJob, OperationLock], safe=True)
diff --git a/app/modules/common/agent_transport.py b/app/modules/common/agent_transport.py
new file mode 100644
index 0000000..a9380b0
--- /dev/null
+++ b/app/modules/common/agent_transport.py
@@ -0,0 +1,130 @@
+"""Group-owned settings for agent result delivery."""
+import hashlib
+import json
+import os
+from pathlib import Path
+from uuid import UUID
+
+MODES = ('http', 'https', 'mtls')
+DEFAULTS = {
+    'agent_result_transport': 'http',
+    'agent_tls_ca_file': '',
+    'agent_tls_generate': '1',
+    'agent_tls_ca_key_file': '',
+    'agent_tls_cert_file': '',
+    'agent_tls_key_file': '',
+}
+PATH_SETTINGS = frozenset(DEFAULTS) - {'agent_result_transport', 'agent_tls_generate'}
+
+
+def setting_rows(group_id):
+    return [dict(param=key, value=value, section='agent', desc='', group_id=group_id)
+            for key, value in DEFAULTS.items()]
+
+
+def group_settings(group_id):
+    from app.modules.db.db_model import Setting
+    values = dict(DEFAULTS)
+    values.update({row.param: row.value or '' for row in Setting.select().where(
+        (Setting.group_id == int(group_id)) & (Setting.param.in_(tuple(DEFAULTS))))})
+    return values
+
+
+def certificate_root(group_id):
+    # Only host configuration can select the base; group admins cannot change it.
+    base = Path(os.getenv('RMON_AGENT_CERTIFICATES_DIR', '/var/lib/rmon/keys/agent-certificates'))
+    base = base.resolve()
+    root = base / str(int(group_id))
+    if not root.resolve().is_relative_to(base) or root.is_symlink():
+        raise ValueError('The group certificate directory is invalid')
+    return root
+
+
+def certificate_path(value, group_id, agent_uuid=None, *, require_file=False):
+    if not value:
+        return ''
+    if any(char in value for char in ('\n', '\r', '\x00', ',', '\\')):
+        raise ValueError('Invalid certificate path')
+    if '{' in value or '}' in value:
+        if value.replace('{uuid}', '').find('{') != -1 or '}' in value.replace('{uuid}', ''):
+            raise ValueError('Only {uuid} is supported in certificate paths')
+        value = value.replace('{uuid}', str(UUID(str(agent_uuid))) if agent_uuid else 'agent-id')
+    root = certificate_root(group_id)
+    path = Path(value)
+    if not path.is_absolute() or not path.resolve().is_relative_to(root):
+        raise ValueError(f'Certificate files must be inside {root.as_posix()}')
+    if require_file and (not path.is_file() or not os.access(path, os.R_OK)):
+        raise ValueError('A configured certificate file is missing or cannot be read')
+    return path.resolve().as_posix()
+
+
+def validate_setting(param, value, group_id):
+    if param not in DEFAULTS:
+        raise ValueError('Unknown agent connection setting')
+    value = value.strip()
+    if param == 'agent_result_transport' and value not in MODES:
+        raise ValueError('Select HTTP, HTTPS or HTTPS + mTLS')
+    if param == 'agent_tls_generate' and value not in ('0', '1'):
+        raise ValueError('Certificate generation must be enabled or disabled')
+    if param in PATH_SETTINGS:
+        if '{uuid}' in value and param not in ('agent_tls_cert_file', 'agent_tls_key_file'):
+            raise ValueError('The CA path cannot contain {uuid}')
+        certificate_path(value, group_id)
+    return value
+
+
+def settings_hash(values, mode):
+    # A new group default does not reconfigure agents that already chose a mode.
+    keys = set()
+    if mode == 'mtls':
+        keys = PATH_SETTINGS | {'agent_tls_generate'}
+    elif mode == 'https':
+        keys = {'agent_tls_ca_file'}
+    data = {key: values[key] for key in sorted(keys)}
+    return hashlib.sha256(json.dumps(data, sort_keys=True).encode()).hexdigest()
+
+
+def inventory_settings(group_id, agent_uuid, mode):
+    if mode not in MODES:
+        raise ValueError('Select HTTP, HTTPS or HTTPS + mTLS')
+    values = group_settings(group_id)
+    validate_setting('agent_tls_generate', values['agent_tls_generate'], group_id)
+    result = dict(agent_transport=mode, agent_mtls_enabled=mode == 'mtls',
+                  agent_tls_generate=values['agent_tls_generate'] == '1',
+                  agent_verify_result_connection=True,
+                  agent_transport_settings_hash=settings_hash(values, mode),
+                  agent_certificate_directory=certificate_root(group_id).as_posix())
+    for key in PATH_SETTINGS:
+        result[key] = ''
+        if mode == 'http' or (mode == 'https' and key != 'agent_tls_ca_file'):
+            continue
+        value = values[key]
+        validate_setting(key, value, group_id)
+        result[key] = certificate_path(value, group_id, agent_uuid, require_file=True)
+    if mode == 'mtls':
+        if not result['agent_tls_ca_file']:
+            raise ValueError('Select the trusted CA certificate in the agent group settings')
+        if bool(result['agent_tls_cert_file']) != bool(result['agent_tls_key_file']):
+            raise ValueError('Specify both the client certificate and its private key')
+    return result
+
+
+def pending(agent):
+    mode = agent.result_transport
+    if not mode:
+        return False
+    return (mode != agent.applied_result_transport or
+            (mode != 'http' and agent.transport_settings_hash !=
+             settings_hash(group_settings(agent.server_id.group_id), mode)))
+
+
+def record_applied(inventory):
+    from datetime import datetime
+    from app.modules.db.db_model import SmonAgent
+    for host in inventory.get('server', {}).get('hosts', {}).values():
+        if host.get('agent_verify_result_connection') and host.get('action') == 'install':
+            SmonAgent.update(
+                applied_result_transport=host['agent_transport'],
+                transport_settings_hash=host['agent_transport_settings_hash'],
+                transport_checked_at=datetime.now(),
+            ).where(SmonAgent.uuid == str(host['agent_uuid'])).execute()
diff --git a/app/modules/common/proxy.py b/app/modules/common/proxy.py
new file mode 100644
index 0000000..2d94039
--- /dev/null
+++ b/app/modules/common/proxy.py
@@ -0,0 +1,11 @@
+"""Only enabled by deployments where the Gunicorn backend is private."""
+import os
+
+from werkzeug.middleware.proxy_fix import ProxyFix
+
+
+def configure_trusted_proxy(app):
+    if os.getenv('RMON_PROXY_MODE') == '1':
+        # Nginx replaces XFF; Apache appends the actual client as the last hop.
+        # Gunicorn handles the trusted scheme header. Never trust forwarded Host.
+        app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=0, x_host=0, x_port=0, x_prefix=0)
diff --git a/app/modules/db/db_model.py b/app/modules/db/db_model.py
index 0c85325..995a32a 100644
--- a/app/modules/db/db_model.py
+++ b/app/modules/db/db_model.py
@@ -248,11 +248,11 @@ class OidcProvider(BaseModel):
     token_endpoint = TextField(null=True)
     userinfo_endpoint = TextField(null=True)
     jwks_uri = TextField(null=True)
-    scope = CharField(constraints=[SQL('DEFAULT "openid email profile"')])
-    subject_claim = CharField(constraints=[SQL('DEFAULT "sub"')])
-    email_claim = CharField(constraints=[SQL('DEFAULT "email"')])
-    username_claim = CharField(constraints=[SQL('DEFAULT "preferred_username"')])
-    groups_claim = CharField(constraints=[SQL('DEFAULT "groups"')])
+    scope = CharField(constraints=[SQL("DEFAULT 'openid email profile'")])
+    subject_claim = CharField(constraints=[SQL("DEFAULT 'sub'")])
+    email_claim = CharField(constraints=[SQL("DEFAULT 'email'")])
+    username_claim = CharField(constraints=[SQL("DEFAULT 'preferred_username'")])
+    groups_claim = CharField(constraints=[SQL("DEFAULT 'groups'")])
     allowed_domains = TextField(null=True)
     auto_create_users = IntegerField(constraints=[SQL('DEFAULT 0')])
     auto_link_by_email = IntegerField(constraints=[SQL('DEFAULT 1')])
@@ -383,6 +383,10 @@ class SmonAgent(BaseModel):
     shared = IntegerField(constraints=[SQL('DEFAULT 0')], index=True)
     port = IntegerField(constraints=[SQL('DEFAULT 5701')])
     region_id = ForeignKeyField(Region, null=True, on_delete='SET NULL', index=True)
+    result_transport = CharField(null=True)
+    applied_result_transport = CharField(null=True)
+    transport_settings_hash = CharField(null=True)
+    transport_checked_at = DateTimeField(null=True)
 
     class Meta:
         table_name = 'smon_agents'
@@ -573,11 +577,12 @@ class SmonHttpCheck(BaseModel):
     body_req = JSONField(null=True)
     ignore_ssl_error = IntegerField(constraints=[SQL('DEFAULT 0')])
     redirects = IntegerField(constraints=[SQL('DEFAULT 10')])
+    ssl_policy = CharField(default='default', constraints=[SQL("DEFAULT 'default'")])
     auth = JSONField(null=True)
     body_json = JSONField(null=True)
     proxy = JSONField(null=True)
     headers_response = JSONField(null=True)
-    accept_cookies = BooleanField(constraints=[SQL('DEFAULT 1')])
+    accept_cookies = BooleanField(constraints=[SQL('DEFAULT TRUE')])
     http_version = IntegerField(constraints=[SQL('DEFAULT 0')])
     resole_to_ip = CharField(null=True)
 
@@ -660,6 +665,31 @@ class InstallationTasks(BaseModel):
 
     class Meta:
         table_name = 'installation_tasks'
+        indexes = ((('status', 'finish_date'), False),)
+
+
+class OperationJob(BaseModel):
+    task = ForeignKeyField(InstallationTasks, primary_key=True, on_delete='CASCADE')
+    server = ForeignKeyField(Server, on_delete='CASCADE')
+    payload = TextField(null=True)
+    status = CharField(default='queued')
+    available_at = DateTimeField()
+    owner = CharField(null=True)
+    lease_until = DateTimeField(null=True)
+    attempts = IntegerField(default=0)
+
+    class Meta:
+        table_name = 'operation_jobs'
+        indexes = ((('status', 'available_at'), False), (('status', 'lease_until'), False),
+                   (('server', 'status', 'task'), False))
+
+
+class OperationLock(BaseModel):
+    server = ForeignKeyField(Server, primary_key=True, on_delete='CASCADE')
+    owner = CharField(null=True, index=True)
+
+    class Meta:
+        table_name = 'operation_locks'
 
 
 class AlertState(BaseModel):
@@ -705,5 +735,5 @@ def create_tables():
              Setting, Cred, Version, ActionHistory, Region,
              SystemInfo, UserName, PD, SmonHistory, SmonAgent, SmonTcpCheck, SmonHttpCheck, SmonPingCheck, SmonDnsCheck, RoxyTool,
              SmonStatusPage, SmonStatusPageCheck, SMON, SmonGroup, MM, RMONAlertsHistory, SmonSMTPCheck, SmonRabbitCheck,
-             Country, MultiCheck, Email, InstallationTasks, Migration, AlertEvent, AlertState, AggregatorLock, IncidentRelay]
+             Country, MultiCheck, Email, InstallationTasks, OperationJob, OperationLock, Migration, AlertEvent, AlertState, AggregatorLock, IncidentRelay]
         )
diff --git a/app/modules/db/group.py b/app/modules/db/group.py
index 8fffc07..8ad1e8a 100644
--- a/app/modules/db/group.py
+++ b/app/modules/db/group.py
@@ -1,4 +1,5 @@
 from peewee import IntegrityError
+from app.modules.common.agent_transport import setting_rows
 
 from app.modules.db.db_model import Groups, OidcGroupMapping, Setting, UserGroups
 from app.modules.db.common import out_error, resource_not_empty
@@ -58,7 +59,7 @@ def add_setting_for_new_group(group_id):
 	]
 
 	try:
-		Setting.insert_many(data_source).execute()
+		Setting.insert_many(data_source + setting_rows(group_id)).execute()
 	except Exception as e:
 		out_error(e)
 
diff --git a/app/modules/db/roxy.py b/app/modules/db/roxy.py
index 2ad2a67..62fc287 100644
--- a/app/modules/db/roxy.py
+++ b/app/modules/db/roxy.py
@@ -2,6 +2,9 @@
 from app.modules.db.common import out_error
 
 
+SUPPORTED_SERVICES = ('rmon-server', 'fail2ban')
+
+
 def insert_user_name(user_name):
 	try:
 		UserName.insert(UserName=user_name).execute()
@@ -67,7 +70,7 @@ def select_user_all():
 
 
 def get_roxy_tools():
-	query = RoxyTool.select()
+	query = RoxyTool.select().where(RoxyTool.name.in_(SUPPORTED_SERVICES))
 	try:
 		query_res = query.where(RoxyTool.is_roxy == 1).execute()
 	except Exception as e:
@@ -81,7 +84,7 @@ def get_roxy_tools():
 
 def get_all_tools():
 	try:
-		query_res = RoxyTool.select().execute()
+		query_res = RoxyTool.select().where(RoxyTool.name.in_(SUPPORTED_SERVICES)).execute()
 	except Exception as e:
 		out_error(e)
 	else:
diff --git a/app/modules/db/sql.py b/app/modules/db/sql.py
index e935a0a..c94d7eb 100755
--- a/app/modules/db/sql.py
+++ b/app/modules/db/sql.py
@@ -17,7 +17,7 @@ def get_setting(param, **kwargs):
 
 	if param in (
 			'proxy', 'agent_port', 'master_port', 'master_ip', 'rmon_name', 'use_victoria_metrics',
-			'victoria_metrics_select', 'rabbitmq_enabled', 'json_format'
+			'victoria_metrics_select', 'json_format'
 	):
 		user_group_id = 1
 
@@ -40,7 +40,7 @@ def get_setting(param, **kwargs):
 				if param in (
 					'session_ttl', 'token_ttl', 'ldap_type', 'ldap_port', 'ldap_enable', 'log_time_storage', 'syslog_server_enable',
 					'keep_history_range', 'ssl_expire_warning_alert', 'ssl_expire_critical_alert', 'action_keep_history_range',
-					'use_victoria_metrics', 'mail_enabled', 'mail_send_hello_message', 'rabbitmq_enabled', 'json_format'
+					'use_victoria_metrics', 'mail_enabled', 'mail_send_hello_message', 'json_format'
 				):
 					return int(setting.value)
 				else:
diff --git a/app/modules/operations/__init__.py b/app/modules/operations/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/app/modules/operations/queue.py b/app/modules/operations/queue.py
new file mode 100644
index 0000000..ab90f1c
--- /dev/null
+++ b/app/modules/operations/queue.py
@@ -0,0 +1,166 @@
+"""Durable agent operations. Empty polls are a single indexed read, never a write."""
+import json
+from datetime import datetime, timedelta, timezone
+from uuid import uuid4
+
+from cryptography.fernet import Fernet
+from peewee import MySQLDatabase, PostgresqlDatabase, SQL, Select, fn
+
+from app.modules.db.db_model import InstallationTasks, OperationJob, OperationLock, Server, conn
+from app.modules.server.ssh import _get_fernet_key
+
+LEASE_SECONDS = 180
+MAX_ATTEMPTS = 3
+RETENTION_DAYS = 30
+
+
+def clock_expression():
+    if isinstance(conn, MySQLDatabase):
+        return fn.UTC_TIMESTAMP()
+    if isinstance(conn, PostgresqlDatabase):
+        return fn.timezone('UTC', SQL('CURRENT_TIMESTAMP'))
+    return SQL('CURRENT_TIMESTAMP')
+
+
+def database_time():
+    value = conn.execute(Select(columns=[clock_expression()])).fetchone()
+    now = value[0]
+    if isinstance(now, str):
+        now = datetime.fromisoformat(now)
+    if now.tzinfo:
+        now = now.astimezone(timezone.utc).replace(tzinfo=None)
+    return now
+
+
+def enqueue(inventory, server_ips, role, service_name, action, user_id):
+    if role != 'rmon_agent' or action not in {'install', 'delete', 'reconfigure', 'start', 'stop', 'restart'}:
+        raise ValueError('Unsupported agent operation')
+    if len(server_ips) != 1 or set(inventory.get('server', {}).get('hosts', {})) != set(server_ips):
+        raise ValueError('An agent operation must target exactly one server')
+    server = Server.get(Server.ip == server_ips[0])
+    payload = Fernet(_get_fernet_key()).encrypt(json.dumps({
+        'inventory': inventory, 'server_ips': server_ips, 'role': role,
+    }, separators=(',', ':')).encode()).decode()
+    with conn.atomic():
+        OperationLock.insert(server=server.server_id).on_conflict_ignore().execute()
+        task = InstallationTasks.create(service_name=service_name, server_id=server.server_id,
+                                        user_id=user_id, group_id=server.group_id, action=action)
+        OperationJob.create(task=task.id, server=server.server_id, payload=payload, available_at=database_time())
+    return task.id
+
+
+def claim():
+    earlier = OperationJob.alias()
+    preceding = earlier.select(SQL('1')).where(
+        (earlier.server == OperationJob.server) & (earlier.task < OperationJob.task)
+        & earlier.status.in_(('queued', 'running')))
+    candidates = list(OperationJob.select(OperationJob.task, OperationJob.server)
+                      .join(OperationLock, on=(OperationJob.server == OperationLock.server))
+                      .where((OperationJob.status == 'queued') & (OperationJob.available_at <= clock_expression())
+                             & OperationLock.owner.is_null() & ~fn.EXISTS(preceding))
+                      .order_by(OperationJob.task).limit(16).dicts())
+    for candidate in candidates:
+        owner = uuid4().hex
+        with conn.atomic() as transaction:
+            locked = OperationLock.update(owner=owner).where(
+                (OperationLock.server == candidate['server']) & OperationLock.owner.is_null()).execute()
+            if not locked:
+                continue
+            now = database_time()
+            updated = OperationJob.update(status='running', owner=owner,
+                                          lease_until=now + timedelta(seconds=LEASE_SECONDS),
+                                          attempts=OperationJob.attempts + 1).where(
+                (OperationJob.task == candidate['task']) & (OperationJob.status == 'queued')
+                & (OperationJob.available_at <= now)).execute()
+            if not updated:
+                transaction.rollback()
+                continue
+            InstallationTasks.update(status='running', error=None).where(
+                InstallationTasks.id == candidate['task']).execute()
+        return candidate['task'], owner
+    return None
+
+
+def renew(task_id, owner):
+    now = database_time()
+    deadline = now + timedelta(seconds=LEASE_SECONDS)
+    changed = OperationJob.update(lease_until=deadline).where(
+        (OperationJob.task == task_id) & (OperationJob.owner == owner)
+        & (OperationJob.status == 'running') & (OperationJob.lease_until > now)).execute() == 1
+    if changed:
+        return True
+    # MySQL reports zero affected rows when the deadline is already the same.
+    return OperationJob.select().where(
+        (OperationJob.task == task_id) & (OperationJob.owner == owner)
+        & (OperationJob.status == 'running') & (OperationJob.lease_until >= deadline)
+        & (OperationJob.lease_until > clock_expression())).exists()
+
+
+def load_payload(task_id, owner):
+    job = OperationJob.get((OperationJob.task == task_id) & (OperationJob.owner == owner)
+                          & (OperationJob.status == 'running') & (OperationJob.lease_until > clock_expression()))
+    if str(job.task.group_id_id) != str(job.server.group_id):
+        raise ValueError('The server group changed; submit the operation again')
+    return json.loads(Fernet(_get_fernet_key()).decrypt(job.payload.encode()))
+
+
+def finish(task_id, owner, error=None, on_success=None):
+    with conn.atomic():
+        now = database_time()
+        status = 'failed' if error else 'completed'
+        changed = OperationJob.update(status=status, payload=None, owner=None, lease_until=None).where(
+            (OperationJob.task == task_id) & (OperationJob.owner == owner)
+            & (OperationJob.status == 'running') & (OperationJob.lease_until > now)).execute()
+        if not changed:
+            return False
+        if not error and on_success:
+            on_success()
+        InstallationTasks.update(status=status, error=error, finish_date=datetime.now()).where(
+            InstallationTasks.id == task_id).execute()
+        OperationLock.update(owner=None).where(OperationLock.owner == owner).execute()
+    return True
+
+
+def recover_expired(limit=100):
+    expired = list(OperationJob.select(OperationJob.task, OperationJob.owner, OperationJob.attempts)
+                   .where((OperationJob.status == 'running') & (OperationJob.lease_until <= clock_expression()))
+                   .order_by(OperationJob.lease_until).limit(limit).dicts())
+    recovered = 0
+    for job in expired:
+        with conn.atomic():
+            now = database_time()
+            failed = job['attempts'] >= MAX_ATTEMPTS
+            changed = OperationJob.update(
+                status='failed' if failed else 'queued', owner=None, lease_until=None,
+                available_at=now + timedelta(seconds=30),
+                **({'payload': None} if failed else {}),
+            ).where((OperationJob.task == job['task']) & (OperationJob.owner == job['owner'])
+                    & (OperationJob.status == 'running') & (OperationJob.lease_until <= now)).execute()
+            if not changed:
+                continue
+            InstallationTasks.update(
+                status='failed' if failed else 'created',
+                error='Operation interrupted repeatedly. Check the agent and try again.' if failed else None,
+                finish_date=datetime.now(),
+            ).where(InstallationTasks.id == job['task']).execute()
+            OperationLock.update(owner=None).where(OperationLock.owner == job['owner']).execute()
+            recovered += 1
+    return recovered
+
+
+def cleanup(batch_size=500, max_batches=20):
+    """Bound each daily cleanup; pending operations are never removed."""
+    cutoff = datetime.now() - timedelta(days=RETENTION_DAYS)
+    active = OperationJob.select(OperationJob.task).where(OperationJob.status.in_(('queued', 'running')))
+    eligible = ((InstallationTasks.status.in_(('completed', 'failed')))
+                & (InstallationTasks.finish_date < cutoff) & InstallationTasks.id.not_in(active))
+    deleted = 0
+    for _ in range(max_batches):
+        ids = [row.id for row in InstallationTasks.select(InstallationTasks.id).where(eligible)
+               .order_by(InstallationTasks.finish_date).limit(batch_size)]
+        if not ids:
+            break
+        deleted += InstallationTasks.delete().where(eligible & InstallationTasks.id.in_(ids)).execute()
+        if len(ids) < batch_size:
+            break
+    return deleted
diff --git a/app/modules/operations/worker.py b/app/modules/operations/worker.py
new file mode 100644
index 0000000..259a24e
--- /dev/null
+++ b/app/modules/operations/worker.py
@@ -0,0 +1,140 @@
+import logging
+import random
+import signal
+import threading
+import time
+
+import runtime_health
+from app import app
+from app.modules.db.db_model import conn
+from app.modules.operations import queue
+
+logger = logging.getLogger(__name__)
+
+
+class LeaseGuard:
+    """Cancel Ansible before a lease expires, even if the renewal query hangs."""
+    def __init__(self):
+        self.lost = False
+        self.renewed()
+
+    def renewed(self):
+        self.deadline = time.monotonic() + queue.LEASE_SECONDS - 60
+
+    def cancelled(self):
+        return self.lost or time.monotonic() >= self.deadline
+
+
+class Worker:
+    def __init__(self):
+        self.stop_event = threading.Event()
+        self.idle_delay = 2.0
+        self.error_delay = 5.0
+        self.next_recovery = 0.0
+        self.next_artifact_cleanup = 0.0
+
+    def stop(self, *_):
+        self.stop_event.set()
+
+    def wait(self, seconds, ready=True):
+        deadline = time.monotonic() + seconds
+        while not self.stop_event.is_set():
+            runtime_health.pulse('operations', ready=ready)
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                return
+            self.stop_event.wait(min(5, remaining))
+
+    def execute(self, task_id, owner):
+        guard = LeaseGuard()
+        done = threading.Event()
+        result = {}
+
+        def run():
+            try:
+                with app.app_context():
+                    payload = queue.load_payload(task_id, owner)
+                    from app.modules.service.installation import execute_installation
+                    execute_installation(payload['inventory'], payload['server_ips'], payload['role'],
+                                         cancel_callback=guard.cancelled)
+                    result['inventory'] = payload['inventory']
+            except Exception as error:
+                logger.error('Agent operation %s failed (%s)', task_id, type(error).__name__)
+                result['error'] = 'Agent operation failed. Check SSH access and the operations service logs.'
+            finally:
+                try:
+                    conn.close()
+                finally:
+                    done.set()
+
+        thread = threading.Thread(target=run, name=f'agent-operation-{task_id}', daemon=False)
+        thread.start()
+        next_renew = time.monotonic() + 30
+        lost = False
+        while not done.wait(5):
+            runtime_health.pulse('operations', ready=not lost and not self.stop_event.is_set())
+            if not lost and time.monotonic() >= next_renew:
+                try:
+                    lost = not queue.renew(task_id, owner)
+                except Exception as error:
+                    logger.error('Cannot renew operation %s (%s); cancelling execution', task_id, type(error).__name__)
+                    lost = True
+                finally:
+                    conn.close()
+                if lost:
+                    guard.lost = True
+                else:
+                    guard.renewed()
+                next_renew = time.monotonic() + 30
+        thread.join()
+        if lost or guard.cancelled():
+            logger.warning('Operation %s lost its lease; completion was not recorded', task_id)
+            return
+        from app.modules.common.agent_transport import record_applied
+        if not queue.finish(task_id, owner, result.get('error'),
+                            on_success=lambda: record_applied(result['inventory'])):
+            logger.warning('Operation %s completion rejected after lease expiry', task_id)
+
+    def step(self):
+        try:
+            if time.monotonic() >= self.next_recovery:
+                queue.recover_expired()
+                self.next_recovery = time.monotonic() + 60
+            claimed = queue.claim()
+            runtime_health.pulse('operations', ready=not self.stop_event.is_set())
+            if claimed:
+                self.execute(*claimed)
+                self.idle_delay = 2.0
+            elif time.monotonic() >= self.next_artifact_cleanup:
+                # Each operations container owns its Ansible files; the separate
+                # scheduler cannot clean files in this container's filesystem.
+                from app.jobs import delete_ansible_artifacts
+                delete_ansible_artifacts()
+                self.next_artifact_cleanup = time.monotonic() + 86400
+            self.error_delay = 5.0
+            return bool(claimed)
+        finally:
+            conn.close()
+
+    def run(self):
+        with app.app_context():
+            while not self.stop_event.is_set():
+                try:
+                    if self.step():
+                        continue
+                except Exception as error:
+                    logger.error('Operations service unavailable (%s); retrying in %.0fs',
+                                 type(error).__name__, self.error_delay)
+                    self.wait(self.error_delay, ready=False)
+                    self.error_delay = min(300, self.error_delay * 2)
+                    continue
+                self.wait(min(30, self.idle_delay * random.uniform(1, 1.15)))
+                self.idle_delay = min(30, self.idle_delay * 2)
+        runtime_health.pulse('operations', ready=False)
+
+
+def main():
+    worker = Worker()
+    signal.signal(signal.SIGTERM, worker.stop)
+    signal.signal(signal.SIGINT, worker.stop)
+    worker.run()
diff --git a/app/modules/roxywi/auth.py b/app/modules/roxywi/auth.py
index 5882581..ccea617 100644
--- a/app/modules/roxywi/auth.py
+++ b/app/modules/roxywi/auth.py
@@ -97,7 +97,7 @@ def check_in_ldap(user, password):
 
 def do_login(user_params: dict, next_url: str):
     next_url = safe_next_url(next_url)
-    redirect_to = f'https://{request.host}{next_url}'
+    redirect_to = next_url
 
     response = jsonify({"status": "done", "next_url": redirect_to})
     access_token = create_jwt_token(user_params)
diff --git a/app/modules/roxywi/class_models.py b/app/modules/roxywi/class_models.py
index 73a4558..797f94b 100644
--- a/app/modules/roxywi/class_models.py
+++ b/app/modules/roxywi/class_models.py
@@ -216,6 +216,7 @@ class HttpCheckRequest(BaseCheckRequest):
     body_json: Optional[JSONPathRule] = None
     accepted_status_codes: List[Union[int, str]]
     ignore_ssl_error: Optional[bool] = 0
+    ssl_policy: Literal['default', 'require_https', 'require_http'] = 'default'
     redirects: Optional[int] = 10
     auth: Optional[dict] = None
     proxy: Optional[HttpProxy] = None
@@ -284,7 +285,7 @@ def validate_status_codes(cls, v):
 class DnsCheckRequest(BaseCheckRequest):
     resolver: Union[IPvAnyAddress, DomainName]
     port: Annotated[int, Gt(1), Le(65535)] = 53
-    record_type: Literal['a', 'aaa', 'caa', 'cname', 'mx', 'ns', 'ptr', 'sao', 'src', 'txt']
+    record_type: Literal['a', 'aaaa', 'caa', 'cname', 'mx', 'ns', 'ptr', 'soa', 'srv', 'txt']
     ip: Union[IPvAnyAddress, DomainName]
 
 
@@ -348,7 +349,7 @@ class AddUserToGroup(BaseModel):
 
 class RmonAgent(BaseModel):
     name: EscapedString
-    description: Optional[EscapedString] = None
+    description: Optional[EscapedString] = ''
     enabled: Optional[bool] = 1
     shared: Optional[bool] = 0
     port: Annotated[int, Gt(1024), Le(65535)] = 5101
@@ -356,6 +357,12 @@ class RmonAgent(BaseModel):
     uuid: Optional[UUID4] = ''
     reconfigure: Optional[bool] = 0
     region_id: Optional[int] = None
+    result_transport: Optional[Literal['http', 'https', 'mtls']] = None
+
+    @field_validator('description', mode='before')
+    @classmethod
+    def normalize_description(cls, value):
+        return '' if value is None else value
 
 
 class GroupQuery(BaseModel):
diff --git a/app/modules/roxywi/overview.py b/app/modules/roxywi/overview.py
index 75d659a..b328f64 100644
--- a/app/modules/roxywi/overview.py
+++ b/app/modules/roxywi/overview.py
@@ -1,5 +1,3 @@
-import json
-
 from flask import render_template
 
 import app.modules.db.sql as sql
@@ -66,8 +64,7 @@ def show_overview(server_ip) -> str:
         agent_id = 0
 
     try:
-        req = smon_agent.send_get_request_to_agent(agent_id, server_ip, 'scheduler')
-        req = json.loads(req.decode('utf-8'))
+        req = smon_agent.get_agent_health(agent_id, server_ip)
     except Exception:
         req = {'running': False}
 
diff --git a/app/modules/roxywi/roxy.py b/app/modules/roxywi/roxy.py
index 62eb09a..7329f6d 100644
--- a/app/modules/roxywi/roxy.py
+++ b/app/modules/roxywi/roxy.py
@@ -33,6 +33,8 @@ def versions():
 	json_data = {
 		'need_update': 0
 	}
+	if os.getenv('RMON_CONTAINER') == '1':
+		json_data['managed_by'] = 'docker'
 	try:
 		current_ver = get_service_version()
 		json_data['current_ver'] = current_ver
@@ -89,6 +91,10 @@ def update_user_status() -> None:
 
 def action_service(action: str, service: str) -> str:
 	require_feature(SERVICE_CONTROL)
+	if service not in roxy_sql.SUPPORTED_SERVICES:
+		return 'error: Unsupported service'
+	if os.getenv('RMON_CONTAINER') == '1':
+		return 'error: Manage external services outside the RMON web container.'
 	is_in_docker = is_docker()
 	cmd = f"sudo systemctl disable {service} --now"
 	if action in ("start", "restart"):
diff --git a/app/modules/server/ssh_connection.py b/app/modules/server/ssh_connection.py
index 7198629..dbc3a69 100644
--- a/app/modules/server/ssh_connection.py
+++ b/app/modules/server/ssh_connection.py
@@ -5,6 +5,8 @@
 
 class SshConnection:
     def __init__(self, server_ip: str, ssh_settings: dict):
+        if not ssh_settings.get('user'):
+            raise ValueError('SSH credentials are not configured for this server')
         self.ssh = paramiko.SSHClient()
         self.ssh.load_system_host_keys()
         self.ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
diff --git a/app/modules/service/installation.py b/app/modules/service/installation.py
index 3d730d8..bd7b7fa 100644
--- a/app/modules/service/installation.py
+++ b/app/modules/service/installation.py
@@ -1,6 +1,8 @@
 import os
-import random
-import threading
+import json
+import uuid
+import subprocess
+from pathlib import Path
 from datetime import datetime
 from packaging import version
 
@@ -12,104 +14,96 @@
 from app.modules.db.db_model import InstallationTasks
 
 
-def run_ansible(inv: dict, server_ips: list, ansible_role: str) -> dict:
-	import ansible_runner
-
-	inventory_path = '/var/www/rmon/app/scripts/ansible/inventory'
-	inventory = f'{inventory_path}/{ansible_role}-{random.randint(0, 135)}.json'
-	proxy = sql.get_setting('proxy')
-	proxy_serv = ''
-	tags = ''
-	agent_pid = server_mod.start_ssh_agent()
-
-	try:
-		_install_ansible_collections()
-	except Exception as e:
-		raise Exception(f'{e}')
-
-	for server_ip in server_ips:
-		ssh_settings = return_ssh_keys_path(server_ip)
-		if ssh_settings['enabled']:
-			inv['server']['hosts'][server_ip]['ansible_ssh_private_key_file'] = ssh_settings['key']
-		inv['server']['hosts'][server_ip]['ansible_password'] = ssh_settings['password']
-		inv['server']['hosts'][server_ip]['ansible_user'] = ssh_settings['user']
-		inv['server']['hosts'][server_ip]['ansible_port'] = ssh_settings['port']
-		inv['server']['hosts'][server_ip]['ansible_become'] = True
-
-		if ssh_settings['enabled']:
-			try:
-				server_mod.add_key_to_agent(ssh_settings, agent_pid)
-			except Exception as e:
-				server_mod.stop_ssh_agent(agent_pid)
-				raise Exception(e)
-
-		if proxy is not None and proxy != '' and proxy != 'None':
-			proxy_serv = proxy
-
-		inv['server']['hosts'][server_ip]['PROXY'] = proxy_serv
-
-		if 'DOCKER' in inv['server']['hosts'][server_ip]:
-			if inv['server']['hosts'][server_ip]['DOCKER']:
-				tags = 'docker'
-			else:
-				tags = 'system'
-
-	envvars = {
-		'ANSIBLE_DISPLAY_OK_HOSTS': 'no',
-		'ANSIBLE_SHOW_CUSTOM_STATS': 'no',
-		'ANSIBLE_DISPLAY_SKIPPED_HOSTS': "no",
-		'ANSIBLE_DEPRECATION_WARNINGS': "no",
-		'ANSIBLE_HOST_KEY_CHECKING': "no",
-		'ANSIBLE_TIMEOUT': 15,
-		'ACTION_WARNINGS': "no",
-		'LOCALHOST_WARNING': "no",
-		'COMMAND_WARNINGS': "no",
-		'AWX_DISPLAY': False,
-		'SSH_AUTH_PID': agent_pid['pid'],
-		'SSH_AUTH_SOCK': agent_pid['socket'],
-		'ANSIBLE_PYTHON_INTERPRETER': '/usr/bin/python3'
-	}
-	kwargs = {
-		'private_data_dir': '/var/www/rmon/app/scripts/ansible/',
-		'inventory': inventory,
-		'envvars': envvars,
-		'playbook': f'/var/www/rmon/app/scripts/ansible/roles/{ansible_role}.yml',
-		'tags': tags
-	}
-
-	if os.path.isfile(inventory):
-		os.remove(inventory)
-
-	if not os.path.isdir(inventory_path):
-		os.makedirs(inventory_path)
-
-	try:
-		with open(inventory, 'a') as invent:
-			invent.write(str(inv))
-	except Exception as e:
-		server_mod.stop_ssh_agent(agent_pid)
-		roxywi_common.handle_exceptions(e, 'Cannot save inventory file')
-
-	try:
-		result = ansible_runner.run(**kwargs)
-	except Exception as e:
-		server_mod.stop_ssh_agent(agent_pid)
-		roxywi_common.handle_exceptions(e, 'Cannot run Ansible')
-
-	try:
-		server_mod.stop_ssh_agent(agent_pid)
-	except Exception as e:
-		roxywi_common.logger(f'Cannot stop SSH agent {e}', 'error')
-
-	os.remove(inventory)
-
-	if result.rc != 0:
-		raise Exception('Something wrong with installation, check <a href="/logs/internal?log_file=rmon.error.log" target="_blank" class="link">Apache logs</a> for details')
-
-	return result.stats
+def run_ansible(inv: dict, server_ips: list, ansible_role: str, *, cancel_callback=None) -> dict:
+    import ansible_runner
+    import logging
+
+    def check_cancelled():
+        if cancel_callback and cancel_callback():
+            raise RuntimeError('Agent operation was interrupted')
+
+    check_cancelled()
+    collection_path = _ensure_agent_collections() if ansible_role == 'rmon_agent' else None
+    if collection_path is None:
+        _install_ansible_collections()
+    proxy = sql.get_setting('proxy')
+    proxy_serv = proxy if proxy and proxy != 'None' else ''
+    inventory_path = Path('/var/www/rmon/app/scripts/ansible/inventory')
+    inventory = inventory_path / f'{ansible_role}-{uuid.uuid4().hex}.json'
+    agent_pid = server_mod.start_ssh_agent()
+    tags = ''
+    try:
+        for server_ip in server_ips:
+            check_cancelled()
+            ssh_settings = return_ssh_keys_path(server_ip)
+            host = inv['server']['hosts'][server_ip]
+            if ssh_settings['enabled']:
+                host['ansible_ssh_private_key_file'] = ssh_settings['key']
+                server_mod.add_key_to_agent(ssh_settings, agent_pid)
+            host.update(ansible_password=ssh_settings['password'], ansible_user=ssh_settings['user'],
+                        ansible_port=ssh_settings['port'], ansible_become=True, ansible_connection='ssh',
+                        PROXY=proxy_serv)
+            if 'DOCKER' in host:
+                tags = 'docker' if host['DOCKER'] else 'system'
+        envvars = {
+            'ANSIBLE_DISPLAY_OK_HOSTS': 'no', 'ANSIBLE_SHOW_CUSTOM_STATS': 'no',
+            'ANSIBLE_DISPLAY_SKIPPED_HOSTS': 'no', 'ANSIBLE_DEPRECATION_WARNINGS': 'no',
+            'ANSIBLE_HOST_KEY_CHECKING': 'no', 'ANSIBLE_TIMEOUT': 15,
+            'ACTION_WARNINGS': 'no', 'LOCALHOST_WARNING': 'no', 'COMMAND_WARNINGS': 'no',
+            'AWX_DISPLAY': False, 'SSH_AUTH_PID': agent_pid['pid'], 'SSH_AUTH_SOCK': agent_pid['socket'],
+            'ANSIBLE_PYTHON_INTERPRETER': '/usr/bin/python3',
+        }
+        if collection_path:
+            envvars['ANSIBLE_COLLECTIONS_PATH'] = collection_path
+        if os.getenv('RMON_CONTAINER') == '1':
+            envvars.update(ANSIBLE_HOME='/tmp/ansible-local', ANSIBLE_SSH_CONTROL_PATH_DIR='/tmp/ansible-local/cp')
+        kwargs = {
+            'private_data_dir': '/var/www/rmon/app/scripts/ansible/',
+            'inventory': str(inventory), 'envvars': envvars,
+            'playbook': f'/var/www/rmon/app/scripts/ansible/roles/{ansible_role}.yml', 'tags': tags,
+        }
+        if cancel_callback is not None:
+            kwargs['cancel_callback'] = cancel_callback
+        check_cancelled()
+        inventory_path.mkdir(parents=True, exist_ok=True)
+        descriptor = os.open(inventory, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(descriptor, 'w') as stream:
+            json.dump(inv, stream)
+        result = ansible_runner.run(**kwargs)
+        check_cancelled()
+        if result.rc != 0:
+            raise RuntimeError('Agent operation failed. Check SSH access and the failed task in the operations service logs.')
+        return result.stats
+    finally:
+        try:
+            inventory.unlink(missing_ok=True)
+        finally:
+            try:
+                server_mod.stop_ssh_agent(agent_pid)
+            except Exception as error:
+                logging.getLogger(__name__).error('Cannot stop operation SSH agent (%s)', type(error).__name__)
+
+
+def _ensure_agent_collections() -> str:
+	if os.getenv('RMON_CONTAINER') == '1':
+		root = Path('/usr/share/ansible/collections')
+	else:
+		from app.modules.roxy_wi_tools import GetConfigVar
+		root = Path(GetConfigVar().get_config_var('main', 'lib_path')) / 'ansible/collections'
+	required = ('docker', 'general', 'crypto')
+	if not all((root / 'ansible_collections/community' / name).is_dir() for name in required):
+		if os.getenv('RMON_CONTAINER') == '1':
+			raise RuntimeError('Required Ansible collections are missing from this RMON installation')
+		root.mkdir(parents=True, exist_ok=True)
+		manifest = Path(__file__).resolve().parents[2] / 'scripts/ansible/requirements.yml'
+		subprocess.run(['ansible-galaxy', 'collection', 'install', '-r', str(manifest), '-p', str(root)],
+		               check=True, capture_output=True, text=True, timeout=180)
+	return str(root)
 
 
 def _install_ansible_collections():
+	if os.getenv('RMON_CONTAINER') == '1':
+		return
 	import ansible
 
 	old_ansible_server = ''
@@ -131,27 +125,29 @@ def _install_ansible_collections():
 
 
 def run_ansible_thread(inv: dict, server_ips: list, ansible_role: str, service_name: str, action: str) -> int:
+	# Keep the existing caller contract; execution now belongs to the operations service.
+	from app.modules.operations.queue import enqueue
 	claims = roxywi_common.get_jwt_token_claims()
-	server_id = server_sql.get_server_by_ip(server_ips[0]).server_id
+	return enqueue(inv, server_ips, ansible_role, service_name, action, claims['user_id'])
+
 
-	task_id = InstallationTasks.insert(
-		service_name=service_name, server_id=server_id, user_id=claims['user_id'], group_id=claims['group'], action=action
-	).execute()
-	thread = threading.Thread(target=run_installations, args=(inv, server_ips, ansible_role, task_id))
-	thread.start()
-	return task_id
+def execute_installation(inv, server_ips, service, *, cancel_callback=None):
+	kwargs = {'cancel_callback': cancel_callback} if cancel_callback else {}
+	output = run_ansible(inv, server_ips, service, **kwargs)
+	if output.get('failures') or output.get('dark'):
+		raise RuntimeError('Agent operation failed. Check SSH access and the failed task in the operations service logs.')
+	if cancel_callback and cancel_callback():
+		raise RuntimeError('Agent operation was interrupted')
 
 
 def run_installations(inv: dict, server_ips: list, service: str, task_id: int) -> None:
 	try:
 		InstallationTasks.update(status='running').where(InstallationTasks.id == task_id).execute()
-		output = run_ansible(inv, server_ips, service)
-		if len(output['failures']) > 0 or len(output['dark']) > 0:
-			InstallationTasks.update(
-				status='failed', finish_date=datetime.now(), error=f'Cannot install {service}. Check Apache error log'
-			).where(InstallationTasks.id == task_id).execute()
-			roxywi_common.logger('', f'error: Cannot install {service}')
+		execute_installation(inv, server_ips, service)
+		if service == 'rmon_agent':
+			from app.modules.common.agent_transport import record_applied
+			record_applied(inv)
 		InstallationTasks.update(status='completed', finish_date=datetime.now()).where(InstallationTasks.id == task_id).execute()
 	except Exception as e:
 		InstallationTasks.update(status='failed', finish_date=datetime.now(), error=str(e)).where(InstallationTasks.id == task_id).execute()
-		roxywi_common.logger('', f'error: Cannot install {service}: {e}')
+		roxywi_common.logging_without_user(f'Cannot install {service}: {e}', 'error', extra={'task_id': task_id})
diff --git a/app/modules/tools/alerting.py b/app/modules/tools/alerting.py
index 5a3cb3c..ba8be79 100644
--- a/app/modules/tools/alerting.py
+++ b/app/modules/tools/alerting.py
@@ -1,7 +1,6 @@
 import json
 from typing import Union
 
-import pika
 import pagerduty
 import telebot
 from telebot import apihelper
@@ -20,34 +19,6 @@
 from app.modules.subscription.access import ALERTING_CHANNELS, is_feature_available, require_feature
 
 
-def send_message_to_rabbit(message: str, **kwargs) -> None:
-	require_feature(ALERTING_CHANNELS)
-	rabbit_user = sql.get_setting('rabbitmq_user')
-	rabbit_password = sql.get_setting('rabbitmq_password')
-	rabbit_host = sql.get_setting('rabbitmq_host')
-	rabbit_port = sql.get_setting('rabbitmq_port')
-	rabbit_vhost = sql.get_setting('rabbitmq_vhost')
-	if kwargs.get('rabbit_queue'):
-		rabbit_queue = kwargs.get('rabbit_queue')
-	else:
-		rabbit_queue = sql.get_setting('rabbitmq_queue')
-
-	credentials = pika.PlainCredentials(rabbit_user, rabbit_password)
-	parameters = pika.ConnectionParameters(
-		rabbit_host,
-		rabbit_port,
-		rabbit_vhost,
-		credentials
-	)
-
-	connection = pika.BlockingConnection(parameters)
-	channel = connection.channel()
-	channel.queue_declare(queue=rabbit_queue)
-	channel.basic_publish(exchange='', routing_key=rabbit_queue, body=message)
-
-	connection.close()
-
-
 def send_email_to_server_group(subject: str, mes: str, level: str, group_id: int) -> None:
 	require_feature(ALERTING_CHANNELS)
 	if not sql.get_setting('mail_enabled'):
@@ -508,23 +479,6 @@ def incidentrelay_send_mess(mess, level, **kwargs):
 	return 'ok'
 
 
-def check_rabbit_alert() -> Union[str, dict]:
-	require_feature(ALERTING_CHANNELS)
-	claims = roxywi_common.get_jwt_token_claims()
-	try:
-		user_group_id = claims['group']
-	except Exception as e:
-		return roxywi_common.handle_json_exceptions(e, 'Cannot get group')
-
-	try:
-		json_for_sending = {"user_group": user_group_id, "message": 'info: Test message'}
-		send_message_to_rabbit(json.dumps(json_for_sending))
-	except Exception as e:
-		return roxywi_common.handle_json_exceptions(e, 'Cannot get group')
-	else:
-		return 'ok'
-
-
 def email_send_mess(mess, o_level, **kwargs):
 	require_feature(ALERTING_CHANNELS)
 	runbook = ''
diff --git a/app/modules/tools/common.py b/app/modules/tools/common.py
index 16c0aa4..45e145d 100644
--- a/app/modules/tools/common.py
+++ b/app/modules/tools/common.py
@@ -1,6 +1,14 @@
 from typing import Union, Type
+import ast
+import os
+from pathlib import Path
+import re
+import subprocess
+from urllib.parse import urlparse
 
 import distro
+import requests
+from packaging.version import InvalidVersion, Version
 
 import app.modules.db.roxy as roxy_sql
 import app.modules.roxywi.roxy as roxywi_mod
@@ -11,17 +19,29 @@
 
 def get_services_status(update_cur_ver=0):
     services = []
-    services_name = roxy_sql.get_all_tools()
+    refreshed = {}
 
     if update_cur_ver:
         try:
-            update_cur_tool_versions()
+            refreshed = update_cur_tool_versions()
         except Exception as e:
             raise Exception(f'error: Cannot update current versions: {e}')
 
     try:
+        # Read after refresh: the first request must not render yesterday's values.
+        services_name = roxy_sql.get_all_tools()
         for s, v in services_name.items():
             status = is_tool_active(s)
+            v.update(refreshed.get(s, {}))
+            current = _valid_version(v['current_version'])
+            latest = _valid_version(v['new_version'])
+            v.setdefault('version_known', current is not None)
+            v.setdefault('installed', True if current else None)
+            v['update_available'] = bool(current and latest and Version(current) < Version(latest))
+            if os.getenv('RMON_CONTAINER') == '1':
+                v['managed_by'] = 'external'
+                if not (s == 'rmon-server' and os.getenv('RMON_SERVER_INTERNAL_URL')):
+                    v.update(current_version='0', version_known=False, installed=None, update_available=False)
             services.append([s, status, v])
     except Exception as e:
         raise Exception(f'error: Cannot get tools status: {e}')
@@ -30,6 +50,10 @@ def get_services_status(update_cur_ver=0):
 
 
 def update_roxy_wi(service: str) -> str:
+    if os.getenv('RMON_CONTAINER') == '1':
+        raise ValueError('error: Update container images or external services outside the RMON web container.')
+    if service == 'rmon-server' and os.getenv('RMON_SERVER_INTERNAL_URL'):
+        raise ValueError('error: This RMON Server is managed by Docker. Update its container image instead of installing an OS package.')
     restart_service = ''
     services = roxy_sql.get_roxy_tools()
 
@@ -54,42 +78,123 @@ def update_roxy_wi(service: str) -> str:
 
 
 def is_tool_active(tool_name: str) -> str:
+    if os.getenv('RMON_CONTAINER') == '1':
+        return 'external'
     is_in_docker = roxywi_mod.is_docker()
     if is_in_docker:
         cmd = f"sudo supervisorctl status {tool_name}|awk '{{print $2}}'"
     else:
         cmd = f"systemctl is-active {tool_name}"
     status, stderr = server_mod.subprocess_execute(cmd)
-    return status[0]
+    return status[0] if status else 'unknown'
 
 
-def update_cur_tool_versions() -> None:
+def update_cur_tool_versions() -> dict:
     tools = roxy_sql.get_all_tools()
+    versions = {}
     for s, _v in tools.items():
-        update_cur_tool_version(s)
+        versions[s] = update_cur_tool_version(s)
+    return versions
 
 
-def update_cur_tool_version(tool_name: str) -> None:
-    correct_name = tool_name
-    if distro.id() == 'ubuntu':
-        cmd = f"apt list --installed 2>&1 |grep {correct_name}|awk '{{print $2}}'|sed 's/-/./'"
-    else:
-        cmd = f"rpm -q {correct_name}|awk -F\"{correct_name}\" '{{print $2}}' |awk -F\".noa\" '{{print $1}}' |sed 's/-//1' |sed 's/-/./'"
+def _valid_version(value) -> str | None:
+    value = str(value or '').strip()
+    if not value or value == '0' or len(value) > 100:
+        return None
+    try:
+        Version(value)
+    except InvalidVersion:
+        return None
+    return value
 
-    service_ver, stderr = server_mod.subprocess_execute(cmd)
 
+def _version_command(args: list[str]) -> str | None:
     try:
-        service_ver = service_ver[0]
-    except Exception:
-        service_ver = 0
+        result = subprocess.run(args, capture_output=True, text=True, timeout=3, check=False)
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    return result.stdout.strip() if result.returncode == 0 else None
 
-    if service_ver in ('command', 'prometheus:', 'not'):
-        service_ver = 0
 
+def _source_version(directory: str) -> str | None:
+    """Read version metadata without importing or executing the service's code."""
     try:
-        roxy_sql.update_tool_cur_version(tool_name, service_ver)
-    except Exception:
+        path = Path(directory) / 'modules' / 'common' / 'version.py'
+        if not path.is_absolute() or path.stat().st_size > 65536:
+            return None
+        tree = ast.parse(path.read_text(encoding='utf-8'))
+        for node in tree.body:
+            if isinstance(node, ast.Assign) and any(
+                    isinstance(target, ast.Name) and target.id == 'SERVICE_VERSION' for target in node.targets):
+                if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                    return _valid_version(node.value.value)
+    except (OSError, SyntaxError, UnicodeError, ValueError):
+        return None
+    return None
+
+
+def _server_runtime_version() -> str | None:
+    """Read the explicitly configured receiver over HTTP, HTTPS or mTLS."""
+    url = os.getenv('RMON_SERVER_INTERNAL_URL', '').rstrip('/')
+    parsed = urlparse(url)
+    if parsed.scheme not in ('http', 'https') or not parsed.hostname or parsed.username or parsed.password or parsed.query or parsed.fragment:
+        return None
+    try:
+        token = Path(os.environ['RMON_SERVER_INTERNAL_TOKEN_FILE']).read_text().strip()
+        if not token:
+            return None
+        certfile = os.getenv('RMON_SERVER_CLIENT_CERT_FILE')
+        keyfile = os.getenv('RMON_SERVER_CLIENT_KEY_FILE')
+        if bool(certfile) != bool(keyfile) or (certfile and parsed.scheme != 'https'):
+            return None
+        cert = (certfile, keyfile) if certfile else None
+        with requests.Session() as session:
+            session.trust_env = False
+            with session.get(url + '/internal/version', headers={'Authorization': 'Bearer ' + token},
+                             verify=os.getenv('RMON_SERVER_CA_FILE') or True, cert=cert,
+                             timeout=(3, 3), allow_redirects=False) as response:
+                if response.status_code != 200:
+                    return None
+                data = response.json()
+                if isinstance(data, dict) and data.get('service') == 'rmon-server' and isinstance(data.get('version'), str):
+                    return _valid_version(data['version'])
+    except (OSError, KeyError, ValueError, requests.RequestException):
         pass
+    return None
+
+
+def update_cur_tool_version(tool_name: str) -> dict:
+    if not re.fullmatch(r'[a-z0-9][a-z0-9.-]*', tool_name):
+        raise ValueError('Invalid service name')
+    if tool_name == 'rmon-server' and os.getenv('RMON_SERVER_INTERNAL_URL'):
+        current = _server_runtime_version()
+        roxy_sql.update_tool_cur_version(tool_name, current or '0')
+        return {'current_version': current or '0', 'version_known': bool(current), 'installed': True, 'managed_by': 'docker'}
+    if os.getenv('RMON_CONTAINER') == '1':
+        return {'current_version': '0', 'version_known': False, 'installed': None, 'managed_by': 'external'}
+    if distro.id() in ('ubuntu', 'debian') or 'debian' in distro.like().split():
+        package = _version_command(['dpkg-query', '-W', '-f=${Status}\t${Version}', tool_name])
+        version = package.split('\t', 1)[1] if package and package.startswith('install ok installed\t') else None
+    else:
+        version = _version_command(['rpm', '-q', '--queryformat', '%{VERSION}-%{RELEASE}', tool_name])
+    # Preserve the package revision convention already used by the UI.
+    current = _valid_version(version.split(':')[-1].replace('-', '.') if version else None)
+    if not current and version:
+        # Distribution suffixes (ubuntu1, el9, etc.) are package builds, not service versions.
+        current = _valid_version(version.split(':')[-1].split('-', 1)[0])
+    installed = True if current else None
+    if not current:
+        properties = _version_command(['systemctl', 'show', tool_name,
+                                      '--property=LoadState', '--property=WorkingDirectory'])
+        unit = dict(line.split('=', 1) for line in (properties or '').splitlines() if '=' in line)
+        if unit.get('LoadState') == 'not-found':
+            installed = False
+        elif unit.get('LoadState') == 'loaded':
+            installed = True
+            if tool_name == 'rmon-server' and unit.get('WorkingDirectory'):
+                current = _source_version(unit['WorkingDirectory'])
+    roxy_sql.update_tool_cur_version(tool_name, current or '0')
+    return {'current_version': current or '0', 'version_known': bool(current), 'installed': installed}
 
 
 def get_model_for_check(
diff --git a/app/modules/tools/smon.py b/app/modules/tools/smon.py
index 694c9a0..89eced8 100644
--- a/app/modules/tools/smon.py
+++ b/app/modules/tools/smon.py
@@ -89,6 +89,7 @@ def create_http_check(data: HttpCheckRequest, check_id: int) -> Optional[tuple[d
         'accepted_status_codes': data.accepted_status_codes,
         'ignore_ssl_error': data.ignore_ssl_error,
         'redirects': data.redirects,
+        'ssl_policy': data.ssl_policy,
         'auth': data.auth,
         'proxy': data.proxy.model_dump(mode='json') if data.proxy else None,
         'headers_response': data.headers_response.model_dump(mode='json') if data.headers_response else None,
diff --git a/app/modules/tools/smon_agent.py b/app/modules/tools/smon_agent.py
index ed1e5e7..5d43b4d 100644
--- a/app/modules/tools/smon_agent.py
+++ b/app/modules/tools/smon_agent.py
@@ -1,20 +1,33 @@
+import json
 import uuid
+import os
+import re
 from typing import Union
 
 import requests
 from requests import Response
+from flask import current_app, has_app_context, has_request_context, request
 
 import app.modules.db.sql as sql
 import app.modules.db.smon as smon_sql
 import app.modules.db.server as server_sql
 import app.modules.roxywi.common as roxywi_common
 from app.modules.subscription.access import MONITORING_AGENTS, enforce_resource_limit
-from app.modules.service.installation import run_ansible_thread
+from app.modules.service.installation import run_ansible, run_ansible_thread
 from app.modules.roxywi.class_models import RmonAgent
 from app.modules.roxywi.exception import RoxywiResourceNotFound
-
-
-def generate_agent_inv(server_ip: str, action: str, agent_uuid: uuid, agent_port=5101) -> object:
+from app.modules.roxy_wi_tools import GetConfigVar
+from app.modules.common import agent_transport
+
+
+def generate_agent_inv(server_ip: str, action: str, agent_uuid: uuid, agent_port=5101,
+                       *, group_id=None, result_transport=None) -> object:
+    config = GetConfigVar().config
+    control_url = os.getenv('RMON_AGENT_CONTROL_URL') or config.get('agent_deployment', 'control_url', fallback='')
+    if not control_url and has_app_context():
+        control_url = current_app.config.get('PUBLIC_URL', '')
+    if not control_url and has_request_context():
+        control_url = request.url_root.rstrip('/')
     master_port = sql.get_setting('master_port')
     master_ip = sql.get_setting('master_ip')
     if not master_ip: raise Exception(' Master IP cannot be empty')
@@ -28,11 +41,32 @@ def generate_agent_inv(server_ip: str, action: str, agent_uuid: uuid, agent_port
         'agent_uuid': agent_uuid,
         'master_ip': master_ip,
         'master_port': master_port,
+        'agent_control_url': control_url,
+        'agent_image': os.getenv('RMON_AGENT_IMAGE') or config.get(
+            'agent_deployment', 'image', fallback='ghcr.io/roxy-wi/rmon/rmon-agent:2.0'),
     }
 
+    for option in ('bind_ip', 'pull'):
+        if config.has_option('agent_deployment', option):
+            inv['server']['hosts'][server_ip]['agent_' + option] = config.get('agent_deployment', option)
+    if action == 'install' and result_transport is not None:
+        if group_id is None:
+            raise ValueError('The agent owner group is required')
+        inv['server']['hosts'][server_ip].update(
+            agent_transport.inventory_settings(group_id, agent_uuid, result_transport))
+
     return inv, server_ips
 
 
+def run_agent_action(agent_id: int, action: str):
+    if action not in ('start', 'stop', 'restart'):
+        raise ValueError('Unsupported agent action')
+    agent = smon_sql.get_agent_data(agent_id)
+    server_ip = smon_sql.get_agent_ip_by_id(agent_id)
+    inventory = {'server': {'hosts': {server_ip: {'action': action, 'agent_uuid': str(agent.uuid)}}}}
+    return run_ansible_thread(inventory, [server_ip], 'rmon_agent', 'Agent', action)
+
+
 def check_agent_limit():
     count_agents = smon_sql.count_agents()
     enforce_resource_limit(MONITORING_AGENTS, count_agents)
@@ -51,20 +85,24 @@ def add_agent(data: RmonAgent) -> Union[tuple[int, int], tuple[dict, int], None]
         return roxywi_common.handle_json_exceptions('', 'The agent is already installed the server'), 409
     agent_uuid = str(uuid.uuid4())
     check_agent_limit()
+    server = server_sql.get_server_by_ip(server_ip)
+    mode = data.result_transport or agent_transport.group_settings(server.group_id)['agent_result_transport']
     agent_kwargs = data.model_dump(mode='json', exclude={'reconfigure': True})
     agent_kwargs['uuid'] = agent_uuid
+    agent_kwargs['result_transport'] = mode
 
     try:
-        inv, server_ips = generate_agent_inv(server_ip, 'install', agent_uuid, data.port)
+        inv, server_ips = generate_agent_inv(server_ip, 'install', agent_uuid, data.port,
+                                             group_id=server.group_id, result_transport=mode)
     except Exception as e:
         roxywi_common.handle_exceptions(e, 'Cannot generate inventory')
-    try:
-        task_id = run_ansible_thread(inv, server_ips, 'rmon_agent', 'Agent', 'install')
-    except Exception as e:
-        roxywi_common.handle_exceptions(e, 'Cannot install RMON agent')
-
     try:
         last_id = smon_sql.add_agent(**agent_kwargs)
+        try:
+            task_id = run_ansible_thread(inv, server_ips, 'rmon_agent', 'Agent', 'install')
+        except Exception:
+            smon_sql.delete_agent(last_id)
+            raise
         roxywi_common.logger('A new RMON agent has been created', 'info', keep_history=1, service='RMON')
         return last_id, task_id
     except Exception as e:
@@ -76,7 +114,7 @@ def delete_agent(agent_id: int):
         server_ip = smon_sql.get_agent_ip_by_id(agent_id)
     except Exception as e:
         raise e
-    agent_uuid = ''
+    agent_uuid = str(smon_sql.get_agent_data(agent_id).uuid)
     try:
         inv, server_ips = generate_agent_inv(server_ip, 'uninstall', agent_uuid)
         return run_ansible_thread(inv, server_ips, 'rmon_agent', 'Agent', 'delete')
@@ -85,22 +123,31 @@ def delete_agent(agent_id: int):
 
 
 def update_agent(agent_id: int, data: RmonAgent):
+    agent = smon_sql.get_agent_data(agent_id)
+    if data.server_id != agent.server_id_id:
+        raise ValueError('An installed agent cannot be moved to another server')
     json_data = data.model_dump(mode='python', exclude={'reconfigure': True, 'uuid': True}, exclude_none=True)
-
+    inv = None
+    if data.reconfigure:
+        mode = data.result_transport or agent.result_transport
+        inv, server_ips = generate_agent_inv(agent.server_id.ip, 'install', agent.uuid, data.port,
+                                             group_id=agent.server_id.group_id, result_transport=mode)
     try:
         smon_sql.update_agent(agent_id, **json_data)
     except Exception as e:
         raise e
 
     if data.reconfigure:
-        return reconfigure_agent(agent_id)
+        return run_ansible_thread(inv, server_ips, 'rmon_agent', 'Agent', 'reconfigure')
 
 
 def reconfigure_agent(agent_id: int):
     agent = smon_sql.get_agent_data(agent_id)
     server_ip = smon_sql.select_server_ip_by_agent_id(agent_id)
     try:
-        inv, server_ips = generate_agent_inv(server_ip, 'install', agent.uuid, agent.port)
+        inv, server_ips = generate_agent_inv(server_ip, 'install', agent.uuid, agent.port,
+                                             group_id=agent.server_id.group_id,
+                                             result_transport=agent.result_transport)
         return run_ansible_thread(inv, server_ips, 'rmon_agent', 'Agent', 'reconfigure')
     except Exception as e:
         raise e
@@ -123,12 +170,32 @@ def send_get_request_to_agent(agent_id: int, server_ip: str, api_path: str) -> b
     server_ip = smon_sql.get_agent_ip_by_id(agent_id)
     try:
         req = requests.get(f'http://{server_ip}:{agent.port}/{api_path}', headers=headers, timeout=5)
-        return req.content
+        try:
+            req.raise_for_status()
+            return req.content
+        finally:
+            req.close()
+    except requests.HTTPError:
+        raise
     except Exception as e:
         roxywi_common.logger(f'Cannot get agent status: {e}', 'error')
         raise Exception(' Cannot get agent status')
 
 
+def get_agent_health(agent_id: int, server_ip: str) -> dict:
+    try:
+        result = send_get_request_to_agent(agent_id, server_ip, 'health')
+    except requests.HTTPError as error:
+        if error.response is None or error.response.status_code != 404:
+            raise
+        # Older agents expose status only through Flask-APScheduler.
+        result = send_get_request_to_agent(agent_id, server_ip, 'scheduler')
+    data = json.loads(result)
+    if not isinstance(data, dict) or not isinstance(data.get('running'), bool):
+        raise ValueError('Invalid agent health response')
+    return data
+
+
 def send_post_request_to_agent(agent_id: int, server_ip: str, api_path: str, json_data: object) -> Response:
     headers = get_agent_headers(agent_id)
     agent = smon_sql.get_agent_data(agent_id)
@@ -264,11 +331,31 @@ def send_dns_checks(agent_id: int, server_ip: str, check_id=None) -> None:
                                                )
 
 
+def _require_http_policy_support(agent_id: int, server_ip: str) -> None:
+    try:
+        data = json.loads(send_get_request_to_agent(agent_id, server_ip, 'version'))
+        version = data.get('version') if isinstance(data, dict) else None
+        match = re.fullmatch(r'(\d+)\.(\d+)(?:\.\d+)?', version or '')
+    except Exception as error:
+        raise ValueError('Cannot verify agent support for HTTPS policy. Check the agent connection and try again.') from error
+    if not match or tuple(map(int, match.group(1, 2))) < (1, 20):
+        raise ValueError('HTTPS policy requires Agent 1.20 or later. Update the agent and resend the check.')
+
+
 def send_http_checks(agent_id: int, server_ip: str, check_id=None) -> None:
     if check_id:
         checks = smon_sql.select_one_smon(check_id, 2)
     else:
         checks = smon_sql.select_en_smon(agent_id, 'http')
+    checks = list(checks)
+    policy_error = None
+    if any(check.ssl_policy != 'default' for check in checks):
+        try:
+            _require_http_policy_support(agent_id, server_ip)
+        except ValueError as error:
+            policy_error = error
+            # Continue synchronizing checks that do not need the optional feature.
+            checks = [check for check in checks if check.ssl_policy == 'default']
     for check in checks:
         body = check.body
         if body:
@@ -290,6 +377,8 @@ def send_http_checks(agent_id: int, server_ip: str, check_id=None) -> None:
             'body_req': check.body_req,
             'header_req': check.header_req,
             'redirects': check.redirects,
+            'fail_if_not_ssl': check.ssl_policy == 'require_https',
+            'fail_if_ssl': check.ssl_policy == 'require_http',
             'auth': check.auth,
             'proxy': check.proxy,
             'headers_response': check.headers_response,
@@ -304,6 +393,8 @@ def send_http_checks(agent_id: int, server_ip: str, check_id=None) -> None:
                                                'error',
                                                extra={'check_id': check.id, 'agent_id': agent_id, 'multi_check_id': check.smon_id.multi_check_id}
                                                )
+    if policy_error:
+        raise policy_error
 
 
 def send_smtp_checks(agent_id: int, server_ip: str, check_id=None) -> None:
diff --git a/app/routes/admin/routes.py b/app/routes/admin/routes.py
index c2d57fc..7075c0c 100644
--- a/app/routes/admin/routes.py
+++ b/app/routes/admin/routes.py
@@ -14,6 +14,7 @@
 import app.modules.roxywi.auth as roxywi_auth
 import app.modules.roxywi.common as roxywi_common
 import app.modules.tools.common as tools_common
+from app.modules.common.agent_transport import certificate_root
 
 
 @bp.before_request
@@ -52,6 +53,7 @@ def admin():
         'roles': sql.select_roles(),
         'timezones': pytz.all_timezones,
         'settings': sql.get_setting('', all=1),
+        'agent_certificate_root': certificate_root(g.user_params['group_id']).as_posix(),
         'ldap_enable': sql.get_setting('ldap_enable'),
         'guide_me': 1,
         'user_subscription': roxywi_common.return_user_subscription(),
@@ -141,7 +143,7 @@ def update_roxywi():
     """
     roxywi_auth.page_for_admin()
     versions = roxy.versions()
-    services = tools_common.get_services_status()
+    services = tools_common.get_services_status(update_cur_ver=1)
     lang = roxywi_common.get_user_lang_for_flask()
 
     return render_template(
diff --git a/app/routes/channel/routes.py b/app/routes/channel/routes.py
index 76c84eb..6f3dcd5 100644
--- a/app/routes/channel/routes.py
+++ b/app/routes/channel/routes.py
@@ -43,13 +43,11 @@ def load_channels():
 @feature_required(ALERTING_CHANNELS)
 def check_sender():
     json_data = request.get_json()
-    sender = json_data.get('sender')
-    send_function = {
-        'email': alerting.check_email_alert,
-        'web': alerting.check_rabbit_alert
-    }
+    sender = json_data.get('sender') if isinstance(json_data, dict) else None
+    if sender != 'email':
+        return jsonify({'error': 'Unsupported notification channel'}), 400
     try:
-        send_function[sender]()
+        alerting.check_email_alert()
         return jsonify({'status': 'success'})
     except Exception as e:
         return roxywi_common.handle_json_exceptions(e, f'Cannot send message via {sender.title()}')
diff --git a/app/routes/main/routes.py b/app/routes/main/routes.py
index 0463ac1..0f7b653 100644
--- a/app/routes/main/routes.py
+++ b/app/routes/main/routes.py
@@ -129,8 +129,9 @@ def show_roxywi_version():
 @validate()
 def scan_port(server_ip: Union[IPvAnyAddress, DomainName]):
     ip = str(server_ip)
-    cmd = f"sudo nmap -sS {ip} |grep -E '^[[:digit:]]'|sed 's/  */ /g'"
-    cmd1 = f"sudo nmap -sS {ip} |head -5|tail -2"
+    scanner = 'nmap -sT' if os.getenv('RMON_CONTAINER') == '1' else 'sudo nmap -sS'
+    cmd = f"{scanner} {ip} |grep -E '^[[:digit:]]'|sed 's/  */ /g'"
+    cmd1 = f"{scanner} {ip} |head -5|tail -2"
 
     stdout, stderr = server_mod.subprocess_execute(cmd)
     stdout1, stderr1 = server_mod.subprocess_execute(cmd1)
diff --git a/app/routes/smon/agent_routes.py b/app/routes/smon/agent_routes.py
index 47f5349..3114c17 100644
--- a/app/routes/smon/agent_routes.py
+++ b/app/routes/smon/agent_routes.py
@@ -14,7 +14,7 @@
 import app.modules.tools.smon_agent as smon_agent
 import app.modules.tools.common as tools_common
 import app.modules.roxywi.common as roxywi_common
-import app.modules.server.server as server_mod
+from app.modules.common import agent_transport
 
 
 def _require_agent_access(agent_id: int, server_ip: str = None):
@@ -140,6 +140,15 @@ def get_free_agents():
     return jsonify(servers)
 
 
+@bp.get('/agent/transport-settings')
+@jwt_required()
+@get_user_params()
+@page_for_admin(level=2)
+def get_agent_transport_settings():
+    group_id = g.user_params['group_id']
+    return jsonify(result_transport=agent_transport.group_settings(group_id)['agent_result_transport'])
+
+
 @bp.get('/agent/count')
 @jwt_required()
 def get_agent_count():
@@ -157,7 +166,9 @@ def get_agent_count():
 def get_agent_info(agent_id):
     try:
         _require_agent_access(agent_id)
-        agent_data = smon_sql.get_agent(agent_id)
+        agent_data = list(smon_sql.get_agent(agent_id))
+        for item in agent_data:
+            item.transport_pending = agent_transport.pending(item)
     except Exception as e:
         return f'{e}'
 
@@ -205,7 +216,7 @@ def get_agent_version(server_ip):
             j_resp['update'] = "1"
         return jsonify(j_resp)
     except Exception as e:
-        return f'{e}'
+        return jsonify(error='Cannot get agent version'), 502
 
 
 @bp.get('/agent/uptime/<server_ip>')
@@ -217,9 +228,12 @@ def get_agent_uptime(server_ip):
 
     try:
         req = smon_agent.send_get_request_to_agent(agent_id, agent.ip, 'uptime')
-        return req
+        data = json.loads(req)
+        if not isinstance(data, dict) or not isinstance(data.get('uptime'), str):
+            raise ValueError('Invalid agent uptime response')
+        return jsonify(data)
     except Exception as e:
-        return f'{e}'
+        return jsonify(error='Cannot get agent uptime'), 502
 
 
 @bp.get('/agent/status/<server_ip>')
@@ -230,10 +244,9 @@ def get_agent_status(server_ip):
     agent = _require_agent_access(agent_id, server_ip)
 
     try:
-        req = smon_agent.send_get_request_to_agent(agent_id, agent.ip, 'scheduler')
-        return req
+        return jsonify(smon_agent.get_agent_health(agent_id, agent.ip))
     except Exception as e:
-        return f'{e}'
+        return jsonify(error='Cannot get agent health. Check connectivity and update agents without a health endpoint.'), 502
 
 
 @bp.get('/agent/checks/<server_ip>')
@@ -245,9 +258,12 @@ def get_agent_checks(server_ip):
 
     try:
         req = smon_agent.send_get_request_to_agent(agent_id, agent.ip, 'checks')
-        return req
+        count = json.loads(req)
+        if isinstance(count, bool) or not isinstance(count, int) or count < 0:
+            raise ValueError('Invalid agent check count')
+        return jsonify(count)
     except Exception as e:
-        return f'{e}'
+        return jsonify(error='Cannot get agent check count'), 502
 
 
 @bp.post('/agent/action/<any(start, stop, restart):action>')
@@ -255,12 +271,11 @@ def get_agent_checks(server_ip):
 @get_user_params()
 @page_for_admin(level=2)
 def agent_action(action):
-    agent = _require_agent_access(int(request.form.get('agent_id')))
-    server_ip = agent.ip
+    agent_id = int(request.form.get('agent_id'))
+    _require_agent_access(agent_id)
 
     try:
-        command = f'sudo systemctl {action} rmon-agent'
-        server_mod.ssh_command(server_ip, command, timeout=30)
+        task_id = smon_agent.run_agent_action(agent_id, action)
     except Exception as e:
-        return f'{e}'
-    return 'ok'
+        return jsonify(error=str(e)), 502
+    return jsonify(status='queued', task_id=task_id), 202
diff --git a/app/scripts/ansible/requirements.yml b/app/scripts/ansible/requirements.yml
new file mode 100644
index 0000000..23771db
--- /dev/null
+++ b/app/scripts/ansible/requirements.yml
@@ -0,0 +1,8 @@
+---
+collections:
+  - name: community.docker
+    version: 3.13.3
+  - name: community.general
+    version: 9.5.5
+  - name: community.crypto
+    version: 2.26.9
diff --git a/app/scripts/ansible/roles/rmon_agent/defaults/main.yml b/app/scripts/ansible/roles/rmon_agent/defaults/main.yml
new file mode 100644
index 0000000..c3f2021
--- /dev/null
+++ b/app/scripts/ansible/roles/rmon_agent/defaults/main.yml
@@ -0,0 +1,20 @@
+---
+agent_container_name: rmon-agent
+agent_image: ghcr.io/roxy-wi/rmon/rmon-agent:2.0
+agent_pull: missing
+agent_bind_ip: 0.0.0.0
+agent_config_path: /etc/rmon/rmon-agent.cfg
+agent_data_path: /var/lib/rmon/rmon-agent
+agent_log_path: /var/log/rmon
+agent_docker_host: unix:///var/run/docker.sock
+agent_lock_path: /run/lock/rmon-agent-deployment
+agent_transport: preserve
+agent_mtls_enabled: false
+agent_tls_ca_file: ''
+agent_tls_ca_key_file: ''
+agent_tls_cert_file: ''
+agent_tls_key_file: ''
+agent_tls_generate: true
+agent_verify_result_connection: false
+agent_tls_directory: /etc/rmon/mtls
+agent_certificate_directory: /var/lib/rmon/keys/agent-certificates
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/control.yml b/app/scripts/ansible/roles/rmon_agent/tasks/control.yml
new file mode 100644
index 0000000..d7b9d92
--- /dev/null
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/control.yml
@@ -0,0 +1,51 @@
+---
+- name: Find Docker without installing it for a service action
+  ansible.builtin.command:
+    argv: [docker, --version]
+  register: agent_control_docker
+  changed_when: false
+  failed_when: false
+
+- name: Inspect the container on this SSH host
+  community.docker.docker_container_info:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+  register: agent_control_container
+  when: agent_control_docker.rc == 0
+  no_log: true
+
+- name: Require an agent managed by this installation
+  ansible.builtin.assert:
+    that:
+      - agent_control_container.container.Config.Labels.get('io.rmon.managed') == 'true'
+      - agent_control_container.container.Config.Labels.get('io.rmon.uuid') == agent_uuid
+    fail_msg: Refusing to manage a container belonging to another agent.
+  when: agent_control_container.exists | default(false)
+
+- name: Manage the container without deleting configuration or data
+  community.docker.docker_container:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+    state: "{{ {'start': 'started', 'stop': 'stopped', 'restart': 'started', 'uninstall': 'absent'}[action] }}"
+    restart: "{{ action == 'restart' }}"
+    stop_timeout: 30
+    keep_volumes: true
+  when: agent_control_container.exists | default(false)
+
+- name: Inspect native service availability
+  ansible.builtin.service_facts:
+  when: not agent_control_container.exists | default(false)
+
+- name: Manage the existing native service when no container is installed
+  ansible.builtin.systemd_service:
+    name: rmon-agent
+    state: "{{ {'start': 'started', 'stop': 'stopped', 'restart': 'restarted', 'uninstall': 'stopped'}[action] }}"
+    enabled: "{{ false if action == 'uninstall' else omit }}"
+  when:
+    - not agent_control_container.exists | default(false)
+    - "'rmon-agent.service' in ansible_facts.services"
+
+- name: Report a missing agent for start, stop or restart
+  ansible.builtin.assert:
+    that: action == 'uninstall' or agent_control_container.exists | default(false) or 'rmon-agent.service' in ansible_facts.services
+    fail_msg: No agent is installed on this server.
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/deploy.yml b/app/scripts/ansible/roles/rmon_agent/tasks/deploy.yml
new file mode 100644
index 0000000..525fb18
--- /dev/null
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/deploy.yml
@@ -0,0 +1,78 @@
+---
+- name: Read native service state before migration
+  ansible.builtin.service_facts:
+
+- name: Record the recovery state
+  ansible.builtin.set_fact:
+    agent_previous_name: '{{ agent_container_name }}-previous-{{ lookup("ansible.builtin.password", "/dev/null", length=12, chars=["ascii_lowercase", "digits"]) }}'
+    agent_native_running: "{{ ansible_facts.services.get('rmon-agent.service', {}).get('state') == 'running' }}"
+    agent_native_enabled: "{{ ansible_facts.services.get('rmon-agent.service', {}).get('status') == 'enabled' }}"
+    agent_runtime_started: true
+    agent_previous_renamed: false
+
+- name: Stop the native agent before using its existing data
+  ansible.builtin.systemd_service:
+    name: rmon-agent
+    state: stopped
+  when: agent_native_running | bool
+
+- name: Stop the previous container and disable its automatic restart
+  community.docker.docker_container:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+    state: stopped
+    stop_timeout: 30
+    restart_policy: 'no'
+  when: agent_previous.exists
+
+- name: Retain the previous container for recovery
+  ansible.builtin.command:
+    argv: [docker, --host, '{{ agent_docker_host }}', rename, '{{ agent_container_name }}', '{{ agent_previous_name }}']
+  when: agent_previous.exists
+  changed_when: true
+  register: agent_rename_result
+
+- name: Record the retained container
+  ansible.builtin.set_fact:
+    agent_previous_renamed: '{{ agent_previous.exists and agent_rename_result is changed }}'
+
+- name: Start the agent with its original paths and wait for health
+  community.docker.docker_container:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+    image: '{{ agent_image_selected.images[0].Id }}'
+    pull: never
+    state: healthy
+    healthy_wait_timeout: 120
+    restart_policy: unless-stopped
+    stop_timeout: 30
+    read_only: true
+    user: '0:0'
+    cap_drop: [ALL]
+    capabilities: [NET_RAW, DAC_OVERRIDE]
+    security_opts: ['no-new-privileges:true']
+    tmpfs: ['/tmp:rw,noexec,nosuid,size=64m']
+    etc_hosts:
+      host.docker.internal: host-gateway
+    published_ports: ['{{ agent_bind_ip }}:{{ agent_port }}:{{ agent_port }}']
+    labels:
+      io.rmon.managed: 'true'
+      io.rmon.uuid: '{{ agent_uuid }}'
+      io.rmon.deployment: '{{ agent_deployment_hash }}'
+      io.rmon.operation: '{{ agent_previous_name }}'
+    env:
+      RMON_AGENT_SCHEDULER_API_ENABLED: '0'
+      RMON_AGENT_CONFIG_FILE: '{{ agent_config_path }}'
+      RMON_AGENT_DB_PATH: '{{ agent_data_path }}/check_results.db'
+      RMON_AGENT_LOG_PATH: '{{ agent_log_path }}/rmon-agent.log'
+    mounts: >-
+      {{ agent_read_only_mounts + [
+         {'type': 'bind', 'source': agent_data_path, 'target': agent_data_path},
+         {'type': 'bind', 'source': agent_log_path, 'target': agent_log_path}] }}
+  no_log: true
+
+- name: Disable the native service after a successful migration
+  ansible.builtin.systemd_service:
+    name: rmon-agent
+    enabled: false
+  when: agent_native_enabled | bool
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/docker.yml b/app/scripts/ansible/roles/rmon_agent/tasks/docker.yml
new file mode 100644
index 0000000..eec2288
--- /dev/null
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/docker.yml
@@ -0,0 +1,53 @@
+---
+- name: Check whether Docker is installed
+  ansible.builtin.command:
+    argv: [docker, --version]
+  register: agent_docker_cli
+  changed_when: false
+  failed_when: false
+
+- name: Check the supported package manager
+  ansible.builtin.assert:
+    that: ansible_facts.os_family in ['Debian', 'RedHat']
+    fail_msg: Docker installation requires a Debian/Ubuntu or EL host.
+
+- name: Read installed packages before contacting package mirrors
+  ansible.builtin.package_facts:
+    manager: auto
+  when: ansible_facts.os_family == 'Debian'
+
+- name: Install Docker and module dependencies on Debian or Ubuntu
+  vars:
+    agent_required_packages: "{{ ['python3-requests', 'python3-cryptography', 'openssl'] + (['docker.io'] if agent_docker_cli.rc != 0 else []) }}"
+  ansible.builtin.apt:
+    name: '{{ agent_required_packages }}'
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  when:
+    - ansible_facts.os_family == 'Debian'
+    - agent_required_packages | difference(ansible_facts.packages.keys() | list) | length > 0
+
+- name: Configure the Docker repository on EL
+  ansible.builtin.yum_repository:
+    name: docker-ce-stable
+    description: Docker CE stable
+    baseurl: https://download.docker.com/linux/centos/$releasever/$basearch/stable
+    gpgcheck: true
+    gpgkey: https://download.docker.com/linux/centos/gpg
+    enabled: true
+  when:
+    - ansible_facts.os_family == 'RedHat'
+    - agent_docker_cli.rc != 0
+
+- name: Install Docker and module dependencies on EL
+  ansible.builtin.dnf:
+    name: "{{ ['python3-requests', 'python3-cryptography', 'openssl'] + (['docker-ce', 'docker-ce-cli', 'containerd.io'] if agent_docker_cli.rc != 0 else []) }}"
+    state: present
+  when: ansible_facts.os_family == 'RedHat'
+
+- name: Enable and start Docker
+  ansible.builtin.systemd_service:
+    name: docker
+    state: started
+    enabled: true
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/install.yml b/app/scripts/ansible/roles/rmon_agent/tasks/install.yml
index 3c04799..ceb1853 100644
--- a/app/scripts/ansible/roles/rmon_agent/tasks/install.yml
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/install.yml
@@ -1,78 +1,290 @@
-- name: Create RMON Agent directory
-  file:
-    path: "{{ item }}"
-    owner: "{{ansible_user}}"
-    group: "{{ansible_user}}"
+---
+- name: Validate deployment settings
+  ansible.builtin.assert:
+    that:
+      - agent_image is match('^[A-Za-z0-9][A-Za-z0-9._:/@-]+$')
+      - "':' in agent_image.split('/')[-1]"
+      - not agent_image.endswith(':latest')
+      - agent_pull in ['missing', 'always', 'never']
+      - agent_uuid is match('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$')
+      - agent_port | int > 1024 and agent_port | int < 65536
+      - master_port | int > 0 and master_port | int < 65536
+      - master_ip is match('^[A-Za-z0-9.,: -]+$')
+      - agent_transport in ['preserve', 'http', 'https', 'mtls']
+    quiet: true
+  no_log: true
+
+- name: Install Docker before deploying the agent
+  ansible.builtin.include_tasks: docker.yml
+
+- name: Inspect the existing agent container
+  community.docker.docker_container_info:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+  register: agent_previous
+  no_log: true
+
+- name: Check ownership of the existing container
+  ansible.builtin.assert:
+    that:
+      - not agent_previous.exists or agent_previous.container.Config.Labels.get('io.rmon.managed') == 'true'
+      - not agent_previous.exists or agent_previous.container.Config.Labels.get('io.rmon.uuid') == agent_uuid
+    fail_msg: The existing container belongs to another installation.
+
+- name: Find the requested image
+  community.docker.docker_image_info:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_image }}'
+  register: agent_image_before
+
+- name: Require a local image when downloads are disabled
+  ansible.builtin.assert:
+    that: agent_pull != 'never' or agent_image_before.images | length > 0
+
+- name: Download the image before stopping the agent
+  community.docker.docker_image:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_image }}'
+    source: pull
+    force_source: "{{ agent_pull == 'always' }}"
+  when: agent_pull == 'always' or (agent_pull == 'missing' and agent_image_before.images | length == 0)
+
+- name: Inspect the selected image
+  community.docker.docker_image_info:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_image }}'
+  register: agent_image_selected
+
+- name: Inspect the original configuration
+  ansible.builtin.stat:
+    path: '{{ agent_config_path }}'
+  register: agent_config_stat
+
+- name: Save the original configuration for recovery
+  ansible.builtin.slurp:
+    src: '{{ agent_config_path }}'
+  register: agent_original_config
+  when: agent_config_stat.stat.exists
+  no_log: true
+
+- name: Create a private controller directory for reading configuration
+  ansible.builtin.tempfile:
     state: directory
-  with_items:
-  - "/etc/rmon"
-  - "/var/lib/rmon/rmon-agent/modules/db"
-  - "/var/lib/rmon/rmon-agent/modules/common"
-  - "/var/lib/rmon/rmon-agent/modules/checks"
-  - "/var/log/rmon"
-  - "/etc/pki/tls/certs"
-  ignore_errors: yes
-
-- name: Copy RMON Agent files
-  ansible.builtin.copy:
-    src: "/var/www/rmon/app/tools/rmon-agent/{{ item }}"
-    dest: "/var/lib/rmon/rmon-agent/{{ item }}"
-    owner: "{{ansible_user}}"
-    group: "{{ansible_user}}"
-    mode: '0644'
-  with_items:
-  - "rmon_agent.py"
-  - "modules/common/rmon_agent_common.py"
-  - "rmon_checks.py"
-  - "modules/checks/http_check.py"
-  - "modules/checks/http_sub_checks.py"
-  - "modules/checks/smtp_check.py"
-  - "modules/checks/rabbitmq_check.py"
-  - "modules/checks/tcp_check.py"
-  - "modules/checks/dns_check.py"
-  - "modules/checks/ping_check.py"
-  - "wsgi.py"
-  - "requirements.txt"
-  - "modules/db/check_result.py"
-  - "modules/db/db_models.py"
-
-- name: Copy RMON Agent service file
-  template:
-    src: "{{ item.file }}"
-    dest: "{{ item.path }}"
-    mode: 0644
-  with_items:
-    - {file: "rmon-agent.service.j2", path: "/etc/systemd/system/rmon-agent.service"}
-    - {file: "logrotate.j2", path: "/etc/logrotate.d/rmon-agent"}
-
-- name: Install requirements
-  ansible.builtin.include_tasks: "{{ role_path }}/tasks/install-{{ ansible_facts['os_family'] | lower }}.yml"
-
-- name: Copy RMON Agent config file
-  template:
-    src: rmon-agent.cfg.j2
-    dest: /etc/rmon/rmon-agent.cfg
-    mode: 0644
-
-- name: Try to upgrade pycurl
-  pip:
-    name: pycurl
-    executable: /usr/local/bin/pip3
-    state: latest
-    extra_args: --upgrade --ignore-installed
-  ignore_errors: yes
-
-- name: Try to copy ca cert
-  ansible.builtin.copy:
-    src: /etc/ssl/certs/ca-certificates.crt
-    dest: /etc/pki/tls/certs/ca-bundle.crt
-    remote_src: yes
-  ignore_errors: yes
-
-- name: Start and enable RMON Agent
-  ansible.builtin.systemd:
-    name: rmon-agent
-    enabled: true
-    masked: no
-    daemon_reload: true
-    state: restarted
+    prefix: rmon-agent-config-
+  delegate_to: localhost
+  become: false
+  register: agent_config_temporary
+
+- name: Configure and deploy the agent
+  block:
+    - name: Initialize operation state
+      ansible.builtin.set_fact:
+        agent_existing_options: {}
+        agent_certificate_paths: []
+        agent_runtime_started: false
+        agent_tls_copies: {results: []}
+
+    - name: Read the original settings without changing their format
+      ansible.builtin.copy:
+        content: "{{ agent_original_config.content | default('') | b64decode }}"
+        dest: '{{ agent_config_temporary.path }}/original.cfg'
+        mode: '0600'
+      delegate_to: localhost
+      become: false
+      no_log: true
+
+    - name: Make absent sections readable in the temporary copy only
+      ansible.builtin.lineinfile:
+        path: '{{ agent_config_temporary.path }}/original.cfg'
+        regexp: '^\s*\[{{ item }}\]\s*(?:[#;].*)?$'
+        line: '[{{ item }}]'
+      loop: [agent, master, control]
+      delegate_to: localhost
+      become: false
+      no_log: true
+
+    - name: Preserve existing identity and connection settings
+      ansible.builtin.set_fact:
+        agent_existing_options: >-
+          {{ agent_existing_options | combine({item.section + '.' + item.option:
+             lookup('ansible.builtin.ini', item.option, section=item.section,
+                    file=agent_config_temporary.path + '/original.cfg', default='')}) }}
+      loop:
+        - {section: agent, option: uuid}
+        - {section: master, option: ca_file}
+        - {section: master, option: client_cert}
+        - {section: master, option: client_key}
+        - {section: control, option: url}
+      no_log: true
+
+    - name: Refuse to replace another agent's configuration
+      ansible.builtin.assert:
+        that: agent_existing_options['agent.uuid'] in ['', agent_uuid]
+        fail_msg: The existing configuration belongs to another agent.
+
+    - name: Keep the standard configuration, data and log directories
+      ansible.builtin.file:
+        path: '{{ item }}'
+        state: directory
+      loop:
+        - '{{ agent_config_path | dirname }}'
+        - '{{ agent_data_path }}'
+        - '{{ agent_log_path }}'
+
+    - name: Update only the settings managed by RMON
+      community.general.ini_file:
+        path: '{{ agent_config_path }}'
+        section: '{{ item.section }}'
+        option: '{{ item.option }}'
+        value: '{{ item.value }}'
+        mode: "{{ agent_config_stat.stat.mode | default('0600') }}"
+      loop:
+        - {section: agent, option: uuid, value: '{{ agent_uuid }}'}
+        - {section: agent, option: agent_port, value: '{{ agent_port }}'}
+        - {section: master, option: host, value: '{{ master_ip }}'}
+        - {section: master, option: port, value: '{{ master_port }}'}
+      no_log: true
+
+    - name: Set the assignment address when it was not configured
+      community.general.ini_file:
+        path: '{{ agent_config_path }}'
+        section: control
+        option: url
+        value: '{{ agent_control_url }}'
+        mode: "{{ agent_config_stat.stat.mode | default('0600') }}"
+      when:
+        - agent_control_url | default('') | length > 0
+        - agent_existing_options['control.url'] | length == 0
+      no_log: true
+
+    - name: Configure the requested transport and certificates
+      ansible.builtin.include_tasks: tls.yml
+      when: agent_transport != 'preserve' or agent_mtls_enabled | bool
+
+    - name: Read the final configuration for certificate mounts
+      ansible.builtin.fetch:
+        src: '{{ agent_config_path }}'
+        dest: '{{ agent_config_temporary.path }}/final.cfg'
+        flat: true
+      no_log: true
+
+    - name: Make optional sections readable in the final temporary copy
+      ansible.builtin.lineinfile:
+        path: '{{ agent_config_temporary.path }}/final.cfg'
+        regexp: '^\s*\[{{ item }}\]\s*(?:[#;].*)?$'
+        line: '[{{ item }}]'
+      loop: [master, control]
+      delegate_to: localhost
+      become: false
+      no_log: true
+
+    - name: Collect the certificate paths already used by the agent
+      ansible.builtin.set_fact:
+        agent_certificate_paths: >-
+          {{ (agent_certificate_paths + [lookup('ansible.builtin.ini', item.option,
+              section=item.section, file=agent_config_temporary.path + '/final.cfg', default='')])
+             | reject('equalto', '') | unique | list }}
+      loop:
+        - {section: master, option: ca_file}
+        - {section: master, option: client_cert}
+        - {section: master, option: client_key}
+        - {section: control, option: ca_file}
+        - {section: control, option: client_cert}
+        - {section: control, option: client_key}
+      no_log: true
+
+    - name: Validate certificate paths
+      ansible.builtin.assert:
+        that:
+          - item.startswith('/')
+          - item != agent_config_path
+          - "item is not search('[,\\r\\n]')"
+      loop: '{{ agent_certificate_paths }}'
+
+    - name: Check certificates and record their content hashes
+      ansible.builtin.stat:
+        path: '{{ item }}'
+        checksum_algorithm: sha256
+      loop: '{{ agent_certificate_paths + [agent_config_path] }}'
+      register: agent_mounted_files
+      no_log: true
+
+    - name: Require existing regular files for all read-only mounts
+      ansible.builtin.assert:
+        that: item.stat.isreg | default(false)
+        fail_msg: A referenced agent configuration or certificate file is missing.
+      loop: '{{ agent_mounted_files.results }}'
+      no_log: true
+
+    - name: Describe this deployment without moving agent data
+      ansible.builtin.set_fact:
+        agent_deployment_hash: >-
+          {{ {'image': agent_image_selected.images[0].Id, 'port': agent_port, 'bind': agent_bind_ip,
+              'config': agent_config_path, 'data': agent_data_path, 'logs': agent_log_path,
+              'files': agent_mounted_files.results | map(attribute='stat.checksum') | list}
+             | to_json | hash('sha256') }}
+        agent_read_only_mounts: []
+      no_log: true
+
+    - name: Mount configuration and certificates at their original paths
+      ansible.builtin.set_fact:
+        agent_read_only_mounts: "{{ agent_read_only_mounts + [{'type': 'bind', 'source': item, 'target': item, 'read_only': true}] }}"
+      loop: '{{ agent_certificate_paths + [agent_config_path] }}'
+
+    - name: Apply the deployment with recovery on failure
+      ansible.builtin.include_tasks: deploy.yml
+      when: >-
+        not agent_previous.exists or
+        agent_previous.container.Config.Labels.get('io.rmon.deployment') != agent_deployment_hash or
+        agent_previous.container.State.get('Health', {}).get('Status') != 'healthy'
+  rescue:
+    - name: Restore certificate files changed by this operation
+      ansible.builtin.copy:
+        src: '{{ item.backup_file }}'
+        dest: '{{ item.item.target }}'
+        remote_src: true
+        mode: preserve
+      loop: '{{ agent_tls_copies.results | default([]) }}'
+      when: item.backup_file is defined
+      no_log: true
+
+    - name: Remove only newly copied credentials after failure
+      ansible.builtin.file:
+        path: '{{ item.item.target }}'
+        state: absent
+      loop: '{{ agent_tls_copies.results | default([]) }}'
+      when:
+        - item is changed
+        - item.backup_file is not defined
+      no_log: true
+
+    - name: Restore the original configuration after a failed deployment
+      ansible.builtin.copy:
+        content: '{{ agent_original_config.content | b64decode }}'
+        dest: '{{ agent_config_path }}'
+        mode: '{{ agent_config_stat.stat.mode }}'
+        owner: '{{ agent_config_stat.stat.uid }}'
+        group: '{{ agent_config_stat.stat.gid }}'
+      when: agent_config_stat.stat.exists
+      no_log: true
+
+    - name: Remove only the new configuration when initialization failed
+      ansible.builtin.file:
+        path: '{{ agent_config_path }}'
+        state: absent
+      when: not agent_config_stat.stat.exists
+
+    - name: Restore the previous runtime
+      ansible.builtin.include_tasks: recover.yml
+      when: agent_runtime_started | default(false)
+
+    - name: Report the failed agent operation
+      ansible.builtin.fail:
+        msg: Agent deployment failed. The previous configuration and runtime were restored; inspect the failed Ansible task.
+  always:
+    - name: Remove the temporary controller copy of the configuration
+      ansible.builtin.file:
+        path: '{{ agent_config_temporary.path }}'
+        state: absent
+      delegate_to: localhost
+      become: false
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/issue_certificate.yml b/app/scripts/ansible/roles/rmon_agent/tasks/issue_certificate.yml
new file mode 100644
index 0000000..853eb37
--- /dev/null
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/issue_certificate.yml
@@ -0,0 +1,54 @@
+---
+- name: Require an authorized signing CA for certificate generation
+  ansible.builtin.assert:
+    that:
+      - agent_tls_generate | bool
+      - agent_tls_ca_file | length > 0
+      - agent_tls_ca_key_file | length > 0
+    fail_msg: Supply existing client credentials or enable generation with the trusted CA certificate and signing key on the controller.
+
+- name: Issue a client certificate without sending the CA key to the agent
+  delegate_to: localhost
+  become: false
+  block:
+    - name: Create the private certificate directory
+      ansible.builtin.file:
+        path: '{{ agent_certificate_directory }}/{{ agent_uuid }}'
+        state: directory
+        mode: '0700'
+
+    - name: Generate the agent private key when needed
+      community.crypto.openssl_privatekey:
+        path: '{{ agent_certificate_directory }}/{{ agent_uuid }}/agent.key'
+        type: ECC
+        curve: secp256r1
+        mode: '0600'
+      no_log: true
+
+    - name: Create a client authentication certificate request
+      community.crypto.openssl_csr_pipe:
+        privatekey_path: '{{ agent_certificate_directory }}/{{ agent_uuid }}/agent.key'
+        common_name: 'rmon-agent-{{ agent_uuid }}'
+        use_common_name_for_san: false
+        key_usage: [digitalSignature]
+        extended_key_usage: [clientAuth]
+        basic_constraints: ['CA:FALSE']
+        basic_constraints_critical: true
+      register: agent_client_csr
+      no_log: true
+
+    - name: Sign the agent certificate with the supplied CA
+      community.crypto.x509_certificate:
+        path: '{{ agent_certificate_directory }}/{{ agent_uuid }}/agent.crt'
+        csr_content: '{{ agent_client_csr.csr }}'
+        provider: ownca
+        ownca_path: '{{ agent_tls_ca_file }}'
+        ownca_privatekey_path: '{{ agent_tls_ca_key_file }}'
+        ownca_not_after: +365d
+        mode: '0644'
+      no_log: true
+
+    - name: Select the generated credentials for copying
+      ansible.builtin.set_fact:
+        agent_client_cert_source: '{{ agent_certificate_directory }}/{{ agent_uuid }}/agent.crt'
+        agent_client_key_source: '{{ agent_certificate_directory }}/{{ agent_uuid }}/agent.key'
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/main.yml b/app/scripts/ansible/roles/rmon_agent/tasks/main.yml
index d36cae2..512002e 100644
--- a/app/scripts/ansible/roles/rmon_agent/tasks/main.yml
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/main.yml
@@ -1,2 +1,22 @@
 ---
-- include_tasks: "{{ action }}.yml"
+- name: Validate the requested agent operation
+  ansible.builtin.assert:
+    that:
+      - action in ['install', 'uninstall', 'start', 'stop', 'restart']
+      - agent_container_name is match('^[a-zA-Z0-9][a-zA-Z0-9_.-]+$')
+
+- name: Create the deployment lock
+  ansible.builtin.command:
+    argv: [mkdir, '--', '{{ agent_lock_path }}']
+  changed_when: true
+
+- name: Manage the agent on its SSH host
+  block:
+    - name: Run the requested operation
+      ansible.builtin.include_tasks:
+        file: "{{ 'install.yml' if action == 'install' else 'control.yml' }}"
+  always:
+    - name: Release the deployment lock
+      ansible.builtin.file:
+        path: '{{ agent_lock_path }}'
+        state: absent
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/recover.yml b/app/scripts/ansible/roles/rmon_agent/tasks/recover.yml
new file mode 100644
index 0000000..b285815
--- /dev/null
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/recover.yml
@@ -0,0 +1,39 @@
+---
+- name: Inspect the candidate container after failure
+  community.docker.docker_container_info:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+  register: agent_failed_candidate
+  no_log: true
+
+- name: Remove only the candidate created by this operation
+  community.docker.docker_container:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+    state: absent
+    force_kill: true
+    keep_volumes: true
+  when:
+    - agent_failed_candidate.exists
+    - agent_failed_candidate.container.Config.Labels.get('io.rmon.operation') == agent_previous_name
+
+- name: Restore the previous container name
+  ansible.builtin.command:
+    argv: [docker, --host, '{{ agent_docker_host }}', rename, '{{ agent_previous_name }}', '{{ agent_container_name }}']
+  when: agent_previous_renamed | bool
+  changed_when: true
+
+- name: Restore the previous container state and restart policy
+  community.docker.docker_container:
+    docker_host: '{{ agent_docker_host }}'
+    name: '{{ agent_container_name }}'
+    state: "{{ 'started' if agent_previous.container.State.Running else 'stopped' }}"
+    restart_policy: '{{ agent_previous.container.HostConfig.RestartPolicy.Name }}'
+  when: agent_previous.exists
+
+- name: Restore the native service state
+  ansible.builtin.systemd_service:
+    name: rmon-agent
+    state: "{{ 'started' if agent_native_running else 'stopped' }}"
+    enabled: '{{ agent_native_enabled }}'
+  when: agent_native_running | bool or agent_native_enabled | bool
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/tls.yml b/app/scripts/ansible/roles/rmon_agent/tasks/tls.yml
new file mode 100644
index 0000000..85524ec
--- /dev/null
+++ b/app/scripts/ansible/roles/rmon_agent/tasks/tls.yml
@@ -0,0 +1,204 @@
+---
+- name: Select the requested transport without changing existing certificate paths
+  ansible.builtin.set_fact:
+    agent_selected_transport: "{{ 'mtls' if agent_mtls_enabled | bool else agent_transport }}"
+    agent_ca_target: "{{ agent_existing_options['master.ca_file'] or agent_tls_directory + '/ca.crt' }}"
+    agent_cert_target: "{{ agent_existing_options['master.client_cert'] or agent_tls_directory + '/agent.crt' }}"
+    agent_key_target: "{{ agent_existing_options['master.client_key'] or agent_tls_directory + '/agent.key' }}"
+    agent_client_cert_source: '{{ agent_tls_cert_file }}'
+    agent_client_key_source: '{{ agent_tls_key_file }}'
+
+- name: Validate certificate destinations
+  ansible.builtin.assert:
+    that:
+      - item.startswith('/')
+      - item != agent_config_path
+      - "item is not search('[,\\r\\n]')"
+  loop: ['{{ agent_ca_target }}', '{{ agent_cert_target }}', '{{ agent_key_target }}']
+
+- name: Require separate paths for trust, certificate and private key
+  ansible.builtin.assert:
+    that: ([agent_ca_target, agent_cert_target, agent_key_target] | unique | length) == 3
+
+- name: Inspect the existing client certificate and key
+  ansible.builtin.stat:
+    path: '{{ item }}'
+  loop: ['{{ agent_ca_target }}', '{{ agent_cert_target }}', '{{ agent_key_target }}']
+  register: agent_tls_existing_files
+  when: agent_selected_transport in ['https', 'mtls']
+
+- name: Check the supplied certificate pair
+  ansible.builtin.assert:
+    that: (agent_tls_cert_file | length > 0) == (agent_tls_key_file | length > 0)
+    fail_msg: Supply both the agent client certificate and its private key.
+  when: agent_selected_transport == 'mtls'
+
+- name: Preserve an existing incomplete key pair for explicit recovery
+  ansible.builtin.assert:
+    that: agent_tls_existing_files.results[1].stat.exists == agent_tls_existing_files.results[2].stat.exists
+    fail_msg: The existing client certificate pair is incomplete. Restore the missing file or supply both replacement files.
+  when:
+    - agent_selected_transport == 'mtls'
+    - agent_tls_cert_file | length == 0
+
+- name: Issue missing client credentials on the controller
+  ansible.builtin.include_tasks: issue_certificate.yml
+  when:
+    - agent_selected_transport == 'mtls'
+    - agent_tls_cert_file | length == 0
+    - not (agent_tls_existing_files.results[1].stat.exists and agent_tls_existing_files.results[2].stat.exists)
+
+- name: Prepare certificate destination directories
+  ansible.builtin.file:
+    path: '{{ item | dirname }}'
+    state: directory
+  loop: ['{{ agent_ca_target }}', '{{ agent_cert_target }}', '{{ agent_key_target }}']
+  when: agent_selected_transport in ['https', 'mtls']
+
+- name: Copy only the trust certificate and client credentials to the agent
+  ansible.builtin.copy:
+    src: '{{ item.source }}'
+    dest: '{{ item.target }}'
+    mode: '{{ item.mode }}'
+    backup: true
+  loop:
+    - {source: '{{ agent_tls_ca_file }}', target: '{{ agent_ca_target }}', mode: '0644'}
+    - {source: '{{ agent_client_cert_source }}', target: '{{ agent_cert_target }}', mode: '0644'}
+    - {source: '{{ agent_client_key_source }}', target: '{{ agent_key_target }}', mode: '0600'}
+  when:
+    - agent_selected_transport in ['https', 'mtls']
+    - item.source | length > 0
+    - item.target == agent_ca_target or agent_selected_transport == 'mtls'
+  register: agent_tls_copies
+  no_log: true
+
+- name: Require all mTLS credentials before changing transport
+  ansible.builtin.stat:
+    path: '{{ item }}'
+  loop: ['{{ agent_ca_target }}', '{{ agent_cert_target }}', '{{ agent_key_target }}']
+  register: agent_tls_ready
+  when: agent_selected_transport == 'mtls'
+
+- name: Validate the installed mTLS files
+  ansible.builtin.assert:
+    that: item.stat.isreg | default(false)
+    fail_msg: mTLS requires a trusted CA, a client certificate and a private key.
+  loop: '{{ agent_tls_ready.results | default([]) }}'
+  when: agent_selected_transport == 'mtls'
+  no_log: true
+
+- name: Verify that the client certificate is trusted for client authentication
+  ansible.builtin.command:
+    argv: [openssl, verify, -purpose, sslclient, -CAfile, '{{ agent_ca_target }}', '{{ agent_cert_target }}']
+  changed_when: false
+  when: agent_selected_transport == 'mtls'
+
+- name: Read the client certificate public key
+  community.crypto.x509_certificate_info:
+    path: '{{ agent_cert_target }}'
+  register: agent_client_certificate_info
+  when: agent_selected_transport == 'mtls'
+  no_log: true
+
+- name: Reject expired client certificates
+  ansible.builtin.command:
+    argv: [openssl, x509, -checkend, '0', -noout, -in, '{{ agent_cert_target }}']
+  changed_when: false
+  when: agent_selected_transport == 'mtls'
+  no_log: true
+
+- name: Read the public part of the agent private key
+  community.crypto.openssl_privatekey_info:
+    path: '{{ agent_key_target }}'
+  register: agent_client_privatekey_info
+  when: agent_selected_transport == 'mtls'
+  no_log: true
+
+- name: Require matching client credentials
+  ansible.builtin.assert:
+    that: agent_client_certificate_info.public_key == agent_client_privatekey_info.public_key
+    fail_msg: The client certificate does not match the agent private key.
+  when: agent_selected_transport == 'mtls'
+
+- name: Configure verified HTTPS or explicit HTTP
+  community.general.ini_file:
+    path: '{{ agent_config_path }}'
+    section: master
+    option: '{{ item.option }}'
+    value: '{{ item.value }}'
+  loop:
+    - {option: scheme, value: "{{ 'http' if agent_selected_transport == 'http' else 'https' }}"}
+    - {option: tls_verify, value: "{{ 'false' if agent_selected_transport == 'http' else 'true' }}"}
+
+- name: Use the installed trust certificate
+  community.general.ini_file:
+    path: '{{ agent_config_path }}'
+    section: master
+    option: ca_file
+    value: '{{ agent_ca_target }}'
+  when: agent_selected_transport == 'mtls' or (agent_selected_transport == 'https' and agent_tls_ca_file | length > 0)
+
+- name: Enable the mTLS client certificate
+  community.general.ini_file:
+    path: '{{ agent_config_path }}'
+    section: master
+    option: '{{ item.option }}'
+    value: '{{ item.value }}'
+  loop:
+    - {option: client_cert, value: '{{ agent_cert_target }}'}
+    - {option: client_key, value: '{{ agent_key_target }}'}
+  when: agent_selected_transport == 'mtls'
+
+- name: Remove client authentication only when explicitly selecting HTTP or HTTPS
+  community.general.ini_file:
+    path: '{{ agent_config_path }}'
+    section: master
+    option: '{{ item }}'
+    state: absent
+  loop: "{{ ['client_cert', 'client_key'] + (['ca_file'] if agent_selected_transport == 'http' else []) }}"
+  when: agent_selected_transport in ['http', 'https']
+
+- name: Use system trust when HTTPS has no custom CA
+  community.general.ini_file:
+    path: '{{ agent_config_path }}'
+    section: master
+    option: ca_file
+    state: absent
+  when: agent_selected_transport == 'https' and agent_tls_ca_file | length == 0
+
+- name: Verify result server connections before replacing the agent
+  ansible.builtin.uri:
+    url: "{{ 'http' if agent_selected_transport == 'http' else 'https' }}://{{ item | trim }}:{{ master_port }}/"
+    method: GET
+    validate_certs: true
+    ca_path: "{{ agent_ca_target if agent_tls_ca_file | length > 0 else omit }}"
+    client_cert: "{{ agent_cert_target if agent_selected_transport == 'mtls' else omit }}"
+    client_key: "{{ agent_key_target if agent_selected_transport == 'mtls' else omit }}"
+    status_code: [200, 401, 403, 404, 405]
+    follow_redirects: none
+    use_proxy: false
+    timeout: 10
+  loop: "{{ master_ip.split(',') }}"
+  when: agent_verify_result_connection | bool
+  changed_when: false
+
+- name: Check that mTLS rejects connections without a client certificate
+  ansible.builtin.uri:
+    url: 'https://{{ item | trim }}:{{ master_port }}/'
+    validate_certs: true
+    ca_path: '{{ agent_ca_target }}'
+    follow_redirects: none
+    use_proxy: false
+    timeout: 10
+  loop: "{{ master_ip.split(',') }}"
+  register: agent_unauthenticated_result
+  failed_when: false
+  changed_when: false
+  when: agent_verify_result_connection | bool and agent_selected_transport == 'mtls'
+
+- name: Require client authentication on every result server
+  ansible.builtin.assert:
+    that: item.status == -1
+    fail_msg: The result server must require a trusted client certificate for mTLS.
+  loop: '{{ agent_unauthenticated_result.results | default([]) }}'
+  when: agent_verify_result_connection | bool and agent_selected_transport == 'mtls'
diff --git a/app/scripts/ansible/roles/rmon_agent/tasks/uninstall.yml b/app/scripts/ansible/roles/rmon_agent/tasks/uninstall.yml
deleted file mode 100644
index a132f82..0000000
--- a/app/scripts/ansible/roles/rmon_agent/tasks/uninstall.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-- name: Stop and disable RMON Agent
-  ansible.builtin.systemd:
-    name: rmon-agent
-    enabled: false
-    state: stopped
-
-- name: Delete RMON Agent directory
-  file:
-    path: "{{ item }}"
-    state: absent
-  with_items:  ["/var/lib/rmon/rmon-agent"]
-  ignore_errors: yes
-
-- name: Remove files
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: absent
-  with_items:
-    - "/etc/rmon/rmon-agent.cfg"
-    - "/etc/systemd/system/rmon-rmon-agent.service"
-    - "/etc/logrotate.d/rmon-agent"
-    - "/etc/rsyslog.d/rmon-agent.conf"
diff --git a/app/static/css/check_editor.css b/app/static/css/check_editor.css
new file mode 100644
index 0000000..0f07ab8
--- /dev/null
+++ b/app/static/css/check_editor.css
@@ -0,0 +1,52 @@
+/* Scoped to the check editor; dashboard tables keep their own layout. */
+body .check-editor { color: var(--color-black, #172b3b); padding: 0 22px 20px !important; }
+.check-editor-intro { margin: 16px 0; line-height: 1.6; color: var(--color-grey-dark, #526575); }
+.check-editor-tabs { display: flex; gap: 8px; margin: 0 0 20px; padding: 4px 0 10px; border-bottom: 1px solid #aebfcb; }
+body .check-editor-tabs button { flex: 1; min-width: 0; display: flex; align-items: center; justify-content: center; gap: 8px; white-space: normal; padding: 10px; border: 1px solid #aebfcb; border-radius: 7px; background: transparent; color: inherit; }
+body .check-editor-tabs [aria-selected=true] { background: #087fab; border-color: #087fab; color: white; }
+.check-editor-tabs button span { display: inline-grid; place-items: center; width: 24px; height: 24px; border-radius: 50%; border: 1px solid currentColor; flex: 0 0 auto; }
+.check-editor h3 { margin: 0 0 8px; padding: 0; background: none; border: 0; height: auto; font-size: 18px; }
+.check-editor .field-help { margin: 0 0 18px; }
+.check-fields { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px 24px; }
+.check-field { min-width: 0; }
+.check-field-wide { grid-column: 1 / -1; }
+.check-field-label { display: block; font-weight: 600; margin-bottom: 7px; line-height: 1.5; }
+.check-field-control { min-width: 0; }
+body .check-editor .form-control, body .check-editor .ui-selectmenu-button, body .check-editor .tagify { box-sizing: border-box; width: 100% !important; max-width: 100%; margin: 0; }
+body .check-editor .form-control { min-height: 40px; padding: 9px 10px; border: 1px solid #92a6b5 !important; border-radius: 5px; background: var(--color-white); color: inherit; }
+body .check-editor textarea.form-control { font-family: monospace; min-height: 110px; }
+body .check-editor .ui-selectmenu-button { padding: 10px !important; min-height: 40px; }
+body .check-editor .tagify { min-height: 40px; border-radius: 5px; }
+.check-editor .tagify__input { min-width: 60px; }
+.check-editor .tagify + #new-smon-status-code { display: none !important; }
+.check-editor .tooltip { display: block; width: auto; max-width: none; margin-top: 6px; line-height: 1.5; font-size: 12px; }
+.check-advanced { margin-top: 18px; border: 1px solid #aebfcb; border-radius: 7px; }
+.check-advanced > summary { padding: 14px; cursor: pointer; font-weight: 600; }
+.check-advanced[open] > summary { border-bottom: 1px solid #aebfcb; }
+.check-advanced > .check-fields { padding: 18px; }
+.check-field-control > input + input, .check-field-control textarea + textarea { margin-top: 8px !important; }
+.check-editor-summary { display: grid; gap: 6px; border-left: 4px solid #087fab; background: #087fab10; padding: 14px; margin-bottom: 20px; overflow-wrap: anywhere; }
+.check-editor-error, .check-field-error { color: #a82e27; background: #ffeded; border-radius: 4px; padding: 9px; line-height: 1.5; }
+.check-editor-error { margin-bottom: 16px; }
+.check-field-error { margin: 6px 0 0; }
+body .check-editor [aria-invalid=true] { border-color: #b72c24 !important; }
+.check-editor .country, .check-entity-headings { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px; width: 100%; height: auto; }
+.check-entity-headings { font-weight: 600; margin-bottom: 8px; }
+.check-editor #all-entities, .check-editor #checked-entities { width: auto; height: auto; min-height: 52px; max-height: 220px; overflow: auto; float: none; margin: 0; border: 1px solid #aebfcb; border-radius: 5px; }
+.check-editor #all-entities { grid-column: 1; grid-row: 1; }
+.check-editor #checked-entities { grid-column: 2; grid-row: 1; }
+.check-editor .country .all-checks, .check-editor #checked-entities > div { display: flex; width: auto; height: auto; min-height: 42px; align-items: center; padding: 4px; gap: 4px; }
+.check-editor .country .check-name { flex: 1; min-width: 0; width: auto; float: none; overflow-wrap: anywhere; white-space: normal; margin: 0; }
+.check-editor .country .check-button { margin: 0; float: none; flex: 0 0 auto; }
+body #check-editor-submit { background: #087fab; color: white; border-color: #087fab; font-weight: 600; }
+body #check-editor-submit:disabled { opacity: .6; }
+@media (max-width: 640px) {
+    body .check-editor { padding: 0 12px 12px !important; }
+    .check-fields { grid-template-columns: minmax(0, 1fr); gap: 16px; }
+    .check-editor-tabs { gap: 4px; }
+    body .check-editor-tabs button { flex-direction: column; font-size: 12px; padding: 8px 4px; }
+    .check-editor-intro { font-size: 13px; }
+    .check-advanced > .check-fields { padding: 12px; }
+    body .ui-dialog:has(.check-editor) .ui-dialog-buttonset { display: flex; flex-wrap: wrap; gap: 6px; justify-content: flex-end; float: none; }
+    body .ui-dialog:has(.check-editor) .ui-dialog-buttonset button { margin: 0; padding: 8px; font-size: 13px; }
+}
diff --git a/app/static/css/ux.css b/app/static/css/ux.css
new file mode 100644
index 0000000..3610150
--- /dev/null
+++ b/app/static/css/ux.css
@@ -0,0 +1,140 @@
+button, input, select, textarea { font: inherit; }
+[hidden] { display: none !important; }
+:focus-visible { outline: 3px solid #147eb3 !important; outline-offset: 3px; }
+.skip-link { position: fixed; top: -100px; left: 16px; z-index: 2000; padding: 12px; background: white; color: #00243e; }
+.skip-link:focus { top: 8px; }
+.app-shell { --sidebar-width: 207px; min-height: 100vh; }
+.app-shell .top-menu { position: fixed; width: var(--sidebar-width); height: 100dvh; min-height: 0; margin: 0; overflow-y: auto; overflow-x: hidden; }
+.app-shell .top-menu .v_menu { display: none; position: static; width: auto; opacity: 1; border: 0; transition: none; }
+.app-shell .top-menu .p_menu:hover .v_menu, .app-shell .top-menu .p_menu:focus-within .v_menu { display: block; }
+.app-shell .top-menu .v_menu a { padding-left: 24px; }
+.app-shell .container { box-sizing: border-box; min-width: 0; width: auto; max-width: none; margin-left: var(--sidebar-width); min-height: calc(100vh - 90px); }
+.page-header { display: flex; align-items: center; gap: 10px; padding: 10px 16px; flex-wrap: wrap; }
+.page-header h2 { padding: 0; margin: 0; height: auto; flex: 1; min-width: 0; }
+.account-actions { display: flex; gap: 8px; align-items: center; margin-left: auto; }
+.page-header .login { float: none; margin: 0; font-size: 14px; }
+body .icon-button { display: inline-flex; align-items: center; justify-content: center; min-width: 36px; min-height: 36px; box-sizing: border-box; margin: 0; padding: 6px !important; border: 1px solid transparent; border-radius: 6px; background: transparent; color: inherit; cursor: pointer; text-decoration: none; }
+body .icon-button:hover { background: rgba(49, 175, 225, .15); }
+#menu-toggle { font-size: 22px; color: var(--color-blue); }
+body.nav-collapsed { --sidebar-width: 0px; }
+.nav-collapsed .top-menu { display: none; }
+.menu-backdrop { position: fixed; inset: 0; z-index: 98; background: #001b30a6; border: 0; }
+.app-shell .footer { box-sizing: border-box; display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr); align-items: center; gap: 12px; margin: 0 16px 0 calc(var(--sidebar-width) + 16px); padding: 12px 0; width: auto; min-width: 0; max-width: none; }
+.footer #logo_footer, .footer .footer-div, .footer #version { float: none; margin: 0; padding: 0; width: auto; }
+.footer .footer-div { min-width: 0; }
+.footer #useful-links { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 8px 14px; }
+.footer .footer-link { padding: 4px 0; font-size: 13px; }
+.footer #logo_footer_img { margin: 0; }
+.footer #hide_menu, .footer .show_menu { display: none !important; }
+.table-scroll { clear: both; width: auto; max-width: 100%; min-width: 0; overflow-x: auto; overscroll-behavior-x: contain; }
+.table-scroll > table { float: none !important; margin: 0 !important; width: 100% !important; max-width: none !important; }
+.admin-table-toolbar, .admin-table-bottom { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 12px; padding: 10px 0; clear: both; }
+.admin-page-actions { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin: 16px 20px; }
+body .admin-table-toolbar .dataTables_length, body .admin-table-toolbar .dataTables_filter,
+body .admin-table-bottom .dataTables_info, body .admin-table-bottom .dataTables_paginate { float: none; margin: 0; padding-top: 0; }
+body #tabs table.overview { table-layout: auto; display: table; }
+body #tabs table.overview th { width: auto !important; }
+body #tabs table.dataTable th:first-child { width: 56px !important; }
+body #tabs table.dataTable th.checkbox-head { width: 90px !important; }
+body #tabs table.overview .cred-field { min-width: 170px; }
+body #ajax-users .form-control { width: 100%; }
+body #tabs table.overview .form-control { box-sizing: border-box; max-width: 100%; }
+body #tabs table.overview th.actions-column, body table.overview th.actions-column, body table.overview td.actions-column { width: 80px !important; min-width: 80px; text-align: center; white-space: nowrap; box-sizing: border-box; }
+body table.overview th.actions-column { cursor: default; padding-right: 10px; }
+.row-actions { display: inline-block; }
+body .row-actions-toggle { font-size: 24px; line-height: 1; border: 0; background: transparent; }
+body .row-actions-menu { position: fixed; z-index: 2000; box-sizing: border-box; width: max-content; min-width: 180px; max-width: min(340px, calc(100vw - 24px)); max-height: calc(100dvh - 24px); overflow-y: auto; padding: 6px; border: 1px solid #8295a5; border-radius: 8px; box-shadow: 0 6px 24px #001b3033; background: var(--color-white, white); color: var(--color-black, #171717); text-align: left; white-space: normal; }
+body .row-actions-menu > [role=menuitem] { display: block; box-sizing: border-box; width: 100%; min-height: 36px; margin: 0; padding: 8px 12px; border: 0; border-radius: 4px; background: transparent; color: inherit; font: inherit; text-align: left; text-decoration: none; white-space: normal; cursor: pointer; }
+body .row-actions-menu > [role=menuitem]:hover, body .row-actions-menu > [role=menuitem]:focus { background: #31afe126; }
+body .row-actions-menu > [role=menuitem]:disabled { opacity: .5; cursor: default; }
+.overview-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 18px; padding: 16px; }
+.overview-grid .overview-wi { width: 100%; min-width: 0; max-width: none; float: none; margin: 0; }
+.overview-grid > .table-scroll { border: 1px solid #b8c3cc; border-radius: 8px; align-self: start; }
+.overview-grid .overviewHead { height: auto; }
+.overview-grid .overview-small-table { height: auto; min-height: 0; }
+.overview-grid #cpu_div:has(.widget-state), .overview-grid #ram_div:has(.widget-state) { height: auto !important; min-height: 122px; }
+.widget-state { display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 10px; min-height: 100px; padding: 12px; text-align: center; box-sizing: border-box; }
+.retry-button { color: inherit; border: 1px solid #8295a5; padding: 7px 12px; border-radius: 5px; background: transparent; cursor: pointer; }
+.empty-state { text-align: center; margin: 20px auto; padding: 24px; max-width: 650px; }
+.empty-state h3 { background: transparent; border: 0; padding: 0; }
+.empty-state p { font-size: 16px; line-height: 1.6; }
+.empty-state img { max-width: min(240px, 70vw); height: auto; }
+body button.add-button { background: #087fab; color: #fff; border: 1px solid transparent; font-weight: 600; min-height: 40px; }
+body button.add-button:hover { background: #00668f; }
+body .ui-dialog { box-sizing: border-box; max-width: calc(100vw - 24px); }
+body .ui-dialog .ui-dialog-titlebar { flex: 0 0 auto; }
+body .ui-dialog .ui-dialog-title { white-space: normal; }
+body .ui-dialog .ui-dialog-buttonpane { flex: 0 0 auto; margin: 0; background: var(--color-white); border-top: 1px solid #b8c3cc; }
+body .ui-dialog .ui-dialog-content { min-width: 0; }
+body .ui-dialog .overview { max-width: 100%; }
+body .ui-dialog .validateTips { width: auto; max-width: 100%; }
+body .ui-dialog textarea { box-sizing: border-box; max-width: 100%; }
+body .ui-selectmenu-menu .ui-menu { max-width: calc(100vw - 32px); }
+body .field-help { font-size: 13px; line-height: 1.5; overflow-wrap: anywhere; margin: 8px 0; }
+body #create-status-page-step-1-overview, body #create-status-page-step-2-overview { width: 100%; table-layout: fixed; }
+body #create-status-page-step-1 .form-control, body #create-status-page-step-2 .form-control { width: 100%; box-sizing: border-box; }
+#status-page-url-preview { color: var(--color-blue); }
+#pages .page_div { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
+#pages .page_link { flex: 1; min-width: 0; overflow-wrap: anywhere; }
+#pages .page_slug { font-size: 13px; }
+body #admin-tabs { display: flex; overflow-x: auto; overflow-y: hidden; flex-wrap: nowrap; gap: 4px; }
+body #admin-tabs li { flex: 0 0 auto; float: none; }
+.ui-tabs-panel { min-width: 0; }
+body #toast-container { max-width: calc(100vw - 24px); }
+
+/* Login keeps its existing form IDs, login flow and SSO buttons. */
+body.login-page { min-height: 100dvh; display: grid; place-items: center; background: #eef4f8; color: #172b3b; padding: 24px; box-sizing: border-box; }
+.login-page #main_div { margin: 0; padding: 0; width: 100%; min-width: 0; max-width: 440px; background: white; border-radius: 14px; box-shadow: 0 8px 36px #00243e1a; }
+.login-page #login-form { padding: 28px; min-height: 0; }
+.login-page #logo_span { float: none; border: 0; margin: -28px -28px 28px; padding: 24px; width: auto; height: auto; background: #00243e; border-radius: 14px 14px 0 0; text-align: center; }
+.login-page #logo_img { margin: 0; float: none; width: auto; }
+.login-page #logo_span img { width: 170px; margin: 0; padding: 0; }
+.login-page #logo_sign { float: none; color: white; margin: 6px 0 0; font-size: 14px; }
+.login-page #auth { margin: 0; float: none; position: static; width: 100%; }
+.login-page #auth > label { display: block; margin: 12px 0 6px; font-weight: 600; }
+.login-page .fontuser, .login-page .fontpassword { position: relative; }
+.login-page .fontuser > i, .login-page .fontpassword > i { position: absolute; top: 16px; left: 12px; color: #436078; }
+.login-page .form-login { box-sizing: border-box; width: 100%; min-height: 46px; padding: 10px 44px 10px 34px; border: 1px solid #91a4b4 !important; border-radius: 6px; font-size: 16px; color: #172b3b; background: white; }
+.login-page .password-toggle { position: absolute; top: 4px; right: 4px; color: #172b3b; }
+.login-page #enter { width: 100%; margin: 20px 0 0; min-height: 46px; color: white; background: #007cab; border: 0; font-weight: 600; }
+.login-page .wrong-login { box-sizing: border-box; width: 100%; margin: 16px 0 0; text-align: left; }
+.login-page .oidc-login-options { width: 100%; margin: 20px 0 0; padding: 0; clear: both; }
+.login-page .oidc-login-button { box-sizing: border-box; width: 100%; min-height: 44px; color: #172b3b; white-space: normal; }
+
+@media (max-width: 1100px) {
+    .footer .footer-div { grid-column: 1 / -1; }
+    .footer #useful-links { justify-content: center; }
+    .overview-grid { grid-template-columns: minmax(0, 1fr); }
+    body .ui-dialog #smon-add-table > table { width: 100% !important; float: none !important; }
+}
+@media (max-width: 800px) {
+    .app-shell { --sidebar-width: 0px; }
+    .app-shell .top-menu { width: 260px; display: none; top: 62px; height: calc(100dvh - 62px); z-index: 99; }
+    .app-shell.nav-open .top-menu { display: block; }
+    .nav-open { overflow: hidden; }
+    .page-header { min-height: 62px; padding: 8px 12px; box-sizing: border-box; position: relative; z-index: 100; background: var(--color-white); }
+    .page-header h2 { font-size: 18px; }
+    .account-actions { gap: 2px; }
+    .account-actions #show-user-settings-button { max-width: 140px; overflow-wrap: anywhere; }
+    .app-shell .top-menu .menu a { min-height: 44px; box-sizing: border-box; }
+    .app-shell .top-menu .v_menu { display: block; position: static; width: auto; }
+    .app-shell .top-menu .v_menu a { padding-left: 30px; }
+    .app-shell .container { width: 100%; margin-left: 0; }
+    .app-shell .footer { margin-left: 12px; margin-right: 12px; }
+    .footer #useful-links { justify-content: flex-start; }
+    body .icon-button, body [role=button], body .ui-button { min-height: 44px; min-width: 44px; }
+    body .table-scroll { margin: 0; }
+    body .table-scroll table { min-width: 560px; }
+    .overview-grid { padding: 12px; gap: 12px; }
+    .overview-grid .table-scroll table { min-width: 0; }
+    body .ui-dialog table.overview { width: 100% !important; table-layout: fixed; }
+    body .ui-dialog table.overview td { display: block; box-sizing: border-box; width: 100% !important; padding: 6px 2px !important; }
+    body .ui-dialog input:not([type=checkbox]):not([type=radio]):not([type=hidden]), body .ui-dialog textarea,
+    body .ui-dialog .ui-selectmenu-button, body .ui-dialog .tagify { box-sizing: border-box; width: 100% !important; max-width: 100%; font-size: 16px; }
+    body .ui-dialog .checks { display: flex; gap: 12px; height: auto; max-height: 300px; }
+    body .ui-dialog .checks > div { width: 50%; min-width: 0; float: none; }
+    body .ui-dialog .all-checks { width: 100%; height: auto; min-height: 52px; display: flex; }
+    body .ui-dialog .check-name { width: auto; min-width: 0; overflow-wrap: anywhere; float: none; margin: 4px; flex: 1; }
+    body .ui-tabs-panel { padding: 10px !important; }
+    .empty-state { padding: 16px; margin: 12px; }
+}
diff --git a/app/static/js/admin/cred.js b/app/static/js/admin/cred.js
index 1d610eb..7c93894 100644
--- a/app/static/js/admin/cred.js
+++ b/app/static/js/admin/cred.js
@@ -31,12 +31,12 @@ $( function() {
 			}
 		}]
 	});
-	$("#ssh_enable_table input").change(function () {
+	$("#ssh_enable_table").on('change', 'input', function () {
 		let id = $(this).attr('id').split('-');
 		updateSSH(id[1])
 		sshKeyEnableShow(id[1])
 	});
-	$("#ssh_enable_table select").on('selectmenuchange', function () {
+	$("#ssh_enable_table").on('selectmenuchange', 'select', function () {
 		let id = $(this).attr('id').split('-');
 		updateSSH(id[1])
 		sshKeyEnableShow(id[1])
diff --git a/app/static/js/admin/group.js b/app/static/js/admin/group.js
index d017ac3..bce73d8 100644
--- a/app/static/js/admin/group.js
+++ b/app/static/js/admin/group.js
@@ -1,5 +1,5 @@
 $( function() {
-	$( "#ajax-group input" ).change(function() {
+	$("#ajax-group").on('change', 'input', function() {
 		var id = $(this).attr('id').split('-');
 		updateGroup(id[1])
 	});
@@ -65,8 +65,8 @@ function addGroup(dialog_id) {
                         elem("td", null, [
                             elem("input", {"type":"text","name":"descript-"+id,"value":desc,"id":"descript-"+id,"size":"60","class":"form-control","autocomplete":"off"})
                         ]),
-                        elem("td", null, [
-                            elem("a", {"class":"delete","onclick":"confirmDeleteGroup("+id+")","title":"Delete group "+name,"style":"cursor: pointer;"})
+                        elem("td", {"class": "actions-column"}, [
+                            elem("button", {"type":"button","onclick":"confirmDeleteGroup("+id+")"}, "Delete group "+name)
                         ])
                     ])
                     common_ajax_action_after_success(dialog_id, 'newgroup', 'ajax-group', new_group);
@@ -120,12 +120,12 @@ function removeGroup(id) {
         contentType: "application/json; charset=utf-8",
 		statusCode: {
 			204: function (xhr) {
-				$("#group-" + id).remove();
+				RmonUI.removeTableRow("#group-" + id);
                 $('select:regex(id, group) option[value=' + id + ']').remove();
                 $('select:regex(id, group)').selectmenu("refresh");
 			},
 			404: function (xhr) {
-				$("#group-" + id).remove();
+				RmonUI.removeTableRow("#group-" + id);
                 $('select:regex(id, group) option[value=' + id + ']').remove();
                 $('select:regex(id, group)').selectmenu("refresh");
 			}
diff --git a/app/static/js/admin/oidc.js b/app/static/js/admin/oidc.js
index b75e71c..7c90f90 100644
--- a/app/static/js/admin/oidc.js
+++ b/app/static/js/admin/oidc.js
@@ -139,16 +139,7 @@
     }
 
     function actionButton(cssClass, title, handler) {
-        return $('<a>')
-            .addClass(cssClass)
-            .attr({title: title, role: 'button', tabindex: 0})
-            .on('click', handler)
-            .on('keydown', function (event) {
-                if (event.key === 'Enter' || event.key === ' ') {
-                    event.preventDefault();
-                    handler();
-                }
-            });
+        return $('<button>', {type: 'button', 'data-action': cssClass}).text(title).on('click', handler);
     }
 
     function renderProviders() {
@@ -163,16 +154,15 @@
             ).appendTo(row);
             $('<td>').text(provider.enabled ? translations.enabled : translations.disabled).appendTo(row);
             $('<td>').text(provider.client_id || '').appendTo(row);
-            $('<td>').append(actionButton('map', translations.mappings_action, function () {
+            $('<td>', {class: 'actions-column'}).append(actionButton('map', translations.mappings_action, function () {
                 openMappings(provider);
-            })).appendTo(row);
-            $('<td>').append(actionButton('edit', translations.edit_action, function () {
+            }), actionButton('edit', translations.edit_action, function () {
                 editProvider(provider);
             })).appendTo(row);
             body.append(row);
         });
         if (!providers.length) {
-            body.append($('<tr>').append($('<td colspan="5">').addClass('padding10').text(translations.no_providers)));
+            body.append($('<tr>').append($('<td colspan="4">').addClass('padding10').text(translations.no_providers)));
         }
     }
 
@@ -219,10 +209,9 @@
             $('<td>').text(mapping.role_name || mapping.role_id).appendTo(row);
             $('<td>').text(mapping.active ? translations.active : translations.disabled).appendTo(row);
             $('<td>').text(mapping.priority).appendTo(row);
-            $('<td>').append(actionButton('edit', translations.edit_action, function () {
+            $('<td>', {class: 'actions-column'}).append(actionButton('edit', translations.edit_action, function () {
                 editMapping(mapping);
-            })).appendTo(row);
-            $('<td>').append(actionButton('delete', translations.delete_action, function () {
+            }), actionButton('delete', translations.delete_action, function () {
                 if (!window.confirm(translate('delete_mapping_confirm', {group: mapping.external_group}))) return;
                 $.ajax({
                     url: '/admin/oidc/mappings/' + mapping.id,
@@ -237,7 +226,7 @@
             body.append(row);
         });
         if (!mappings.length) {
-            body.append($('<tr>').append($('<td colspan="7">').addClass('padding10').text(translations.no_mappings)));
+            body.append($('<tr>').append($('<td colspan="6">').addClass('padding10').text(translations.no_mappings)));
         }
     }
 
diff --git a/app/static/js/admin/server.js b/app/static/js/admin/server.js
index 44a83e9..b27ee71 100644
--- a/app/static/js/admin/server.js
+++ b/app/static/js/admin/server.js
@@ -1,9 +1,9 @@
 $( function() {
-	$("#ajax-servers input").change(function () {
+	$("#ajax-servers").on('change', 'input', function () {
 		let id = $(this).attr('id').split('-');
 		updateServer(id[1])
 	});
-	$("#ajax-servers select").on('selectmenuchange', function () {
+	$("#ajax-servers").on('selectmenuchange', 'select', function () {
 		let id = $(this).attr('id').split('-');
 		updateServer(id[1])
 	});
@@ -125,10 +125,10 @@ function removeServer(id) {
 		contentType: "application/json; charset=utf-8",
 		statusCode: {
 			204: function (xhr) {
-				$("#server-" + id).remove();
+				RmonUI.removeTableRow("#server-" + id);
 			},
 			404: function (xhr) {
-				$("#server-" + id).remove();
+				RmonUI.removeTableRow("#server-" + id);
 			}
 		},
 		success: function (data) {
@@ -244,11 +244,14 @@ function serverIsUp(server_id) {
 			} else {
 				$('#server_enabled-' + server_id).prop('checked', false);
 			}
-			$('#server_enabled-' + server_id).checkboxradio("refresh");
+			const enabled = $('#server_enabled-' + server_id);
+			if (enabled.checkboxradio('instance')) enabled.checkboxradio('refresh');
 			$('#servergroup-' + server_id).val(data.group_id).change();
 			$('#credentials-' + server_id).val(data.cred_id).change();
-			$('#servergroup-' + server_id).selectmenu("refresh");
-			$('#credentials-' + server_id).selectmenu("refresh");
+			for (const prefix of ['servergroup-', 'credentials-']) {
+				const select = $('#' + prefix + server_id);
+				if (select.selectmenu('instance')) select.selectmenu('refresh');
+			}
 		}
 	});
 }
diff --git a/app/static/js/admin_settings.js b/app/static/js/admin_settings.js
index 605d91d..4c34071 100644
--- a/app/static/js/admin_settings.js
+++ b/app/static/js/admin_settings.js
@@ -1,4 +1,8 @@
 $( function() {
+	$('#agent-section-head').click(function () { hideAndShowSettings('agent'); });
+	$('.agent-setting-select').selectmenu({change: function () {
+		updateSettings(this.id, 'agent', this.value);
+	}});
 	$('#main-section-head').click(function () {
 		hideAndShowSettings('main');
 	});
@@ -11,9 +15,6 @@ $( function() {
 	$('#logs-section-head').click(function () {
 		hideAndShowSettings('logs');
 	});
-	$('#rabbitmq-section-head').click(function () {
-		hideAndShowSettings('rabbitmq');
-	});
 	$('#mail-section-head').click(function () {
 		hideAndShowSettings('mail');
 	});
@@ -78,6 +79,7 @@ function updateSettings(param, section, val) {
 					$("#" + param).parent().parent().removeClass("update");
 				}, 2500);
 			}
-		}
+		},
+		error: function (xhr) { toastr.error(xhr.responseJSON?.error || xhr.statusText); }
 	});
 }
diff --git a/app/static/js/ion.sound.min.js b/app/static/js/ion.sound.min.js
deleted file mode 100644
index b619204..0000000
--- a/app/static/js/ion.sound.min.js
+++ /dev/null
@@ -1,26 +0,0 @@
-// Ion.Sound | version 3.0.7 | https://github.com/IonDen/ion.sound
-(function(l,e,n,r){l.ion=l.ion||{};if(!ion.sound){var m=function(a){a||(a="undefined");if(l.console){console.warn&&"function"===typeof console.warn?console.warn(a):console.log&&"function"===typeof console.log&&console.log(a);var g=n&&n("#debug");if(g&&g.length){var b=g.html();g.html(b+a+"<br/>")}}},f=function(a,b){var c;b=b||{};for(c in a)a.hasOwnProperty(c)&&(b[c]=a[c]);return b};if("function"!==typeof Audio&&"object"!==typeof Audio)e=function(){m("HTML5 Audio is not supported in this browser")},
-ion.sound=e,ion.sound.play=e,ion.sound.stop=e,ion.sound.pause=e,ion.sound.preload=e,ion.sound.destroy=e,e();else{e=/iPad|iPhone|iPod/.test(e.appVersion);var q=0,c={},d={},b;!c.supported&&e?c.supported=["mp3","mp4","aac"]:c.supported||(c.supported=["mp3","ogg","mp4","aac","wav"]);ion.sound=function(a){f(a,c);c.path=c.path||"";c.volume=c.volume||1;c.preload=c.preload||!1;c.multiplay=c.multiplay||!1;c.loop=c.loop||!1;c.sprite=c.sprite||null;c.scope=c.scope||null;c.ready_callback=c.ready_callback||null;
-c.ended_callback=c.ended_callback||null;if(q=c.sounds.length)for(b=0;b<q;b++){a=c.sounds[b];var g=a.alias||a.name;d[g]||(d[g]=new p(a),d[g].init())}else m("No sound-files provided!")};ion.sound.VERSION="3.0.7";ion.sound._method=function(a,c,e){if(c)d[c]&&d[c][a](e);else for(b in d)if(d.hasOwnProperty(b)&&d[b])d[b][a](e)};ion.sound.preload=function(a,b){b=b||{};f({preload:!0},b);ion.sound._method("init",a,b)};ion.sound.destroy=function(a){ion.sound._method("destroy",a);if(a)d[a]=null;else for(b in d)d.hasOwnProperty(b)&&
-d[b]&&(d[b]=null)};ion.sound.play=function(a,b){ion.sound._method("play",a,b)};ion.sound.stop=function(a,b){ion.sound._method("stop",a,b)};ion.sound.pause=function(a,b){ion.sound._method("pause",a,b)};ion.sound.volume=function(a,b){ion.sound._method("volume",a,b)};n&&(n.ionSound=ion.sound);e=l.AudioContext||l.webkitAudioContext;var h;e&&(h=new e);var p=function(a){this.options=f(c);delete this.options.sounds;f(a,this.options);this.request=null;this.streams={};this.result={};this.ext=0;this.url="";
-this.autoplay=this.no_file=this.decoded=this.loaded=!1};p.prototype={init:function(a){a&&f(a,this.options);this.options.preload&&this.load()},destroy:function(){var a;for(b in this.streams)(a=this.streams[b])&&a.destroy();this.streams={};this.result=null;this.options=this.options.buffer=null;this.request&&(this.request.removeEventListener("load",this.ready.bind(this),!1),this.request.removeEventListener("error",this.error.bind(this),!1),this.request.abort(),this.request=null)},createUrl:function(){var a=
-(new Date).valueOf();this.url=this.options.path+encodeURIComponent(this.options.name)+"."+this.options.supported[this.ext]+"?"+a},load:function(){this.no_file?m('No sources for "'+this.options.name+'" sound :('):this.request||(this.createUrl(),this.request=new XMLHttpRequest,this.request.open("GET",this.url,!0),this.request.responseType="arraybuffer",this.request.addEventListener("load",this.ready.bind(this),!1),this.request.addEventListener("error",this.error.bind(this),!1),this.request.send())},
-reload:function(){this.ext++;this.options.supported[this.ext]?this.load():(this.no_file=!0,m('No sources for "'+this.options.name+'" sound :('))},ready:function(a){this.result=a.target;4!==this.result.readyState?this.reload():200!==this.result.status&&0!==this.result.status?(m(this.url+" was not found on server!"),this.reload()):(this.request.removeEventListener("load",this.ready.bind(this),!1),this.request.removeEventListener("error",this.error.bind(this),!1),this.request=null,this.loaded=!0,this.decode())},
-decode:function(){h&&h.decodeAudioData(this.result.response,this.setBuffer.bind(this),this.error.bind(this))},setBuffer:function(a){this.options.buffer=a;this.decoded=!0;a={name:this.options.name,alias:this.options.alias,ext:this.options.supported[this.ext],duration:this.options.buffer.duration};this.options.ready_callback&&"function"===typeof this.options.ready_callback&&this.options.ready_callback.call(this.options.scope,a);if(this.options.sprite)for(b in this.options.sprite)this.options.start=
-this.options.sprite[b][0],this.options.end=this.options.sprite[b][1],this.streams[b]=new k(this.options,b);else this.streams[0]=new k(this.options);this.autoplay&&(this.autoplay=!1,this.play())},error:function(){this.reload()},play:function(a){delete this.options.part;a&&f(a,this.options);if(!this.loaded)this.autoplay=!0,this.load();else if(!this.no_file&&this.decoded)if(this.options.sprite)if(this.options.part)this.streams[this.options.part].play(this.options);else for(b in this.options.sprite)this.streams[b].play(this.options);
-else this.streams[0].play(this.options)},stop:function(a){if(this.options.sprite)if(a)this.streams[a.part].stop();else for(b in this.options.sprite)this.streams[b].stop();else this.streams[0].stop()},pause:function(a){if(this.options.sprite)if(a)this.streams[a.part].pause();else for(b in this.options.sprite)this.streams[b].pause();else this.streams[0].pause()},volume:function(a){if(a)if(f(a,this.options),this.options.sprite)if(this.options.part)(a=this.streams[this.options.part])&&a.setVolume(this.options);
-else for(b in this.options.sprite)(a=this.streams[b])&&a.setVolume(this.options);else(a=this.streams[0])&&a.setVolume(this.options)}};var k=function(a,b){this.alias=a.alias;this.name=a.name;this.sprite_part=b;this.buffer=a.buffer;this.start=a.start||0;this.end=a.end||this.buffer.duration;this.multiplay=a.multiplay||!1;this.volume=a.volume||1;this.scope=a.scope;this.ended_callback=a.ended_callback;this.setLoop(a);this.gain=this.source=null;this.paused=this.playing=!1;this.time_offset=this.time_played=
-this.time_ended=this.time_started=0};k.prototype={destroy:function(){this.stop();this.source=this.buffer=null;this.gain&&this.gain.disconnect();this.source&&this.source.disconnect();this.source=this.gain=null},setLoop:function(a){this.loop=!0===a.loop?9999999:"number"===typeof a.loop?+a.loop-1:!1},update:function(a){this.setLoop(a);"volume"in a&&(this.volume=a.volume)},play:function(a){a&&this.update(a);if(this.multiplay||!this.playing)this.gain=h.createGain(),this.source=h.createBufferSource(),this.source.buffer=
-this.buffer,this.source.connect(this.gain),this.gain.connect(h.destination),this.gain.gain.value=this.volume,this.source.onended=this.ended.bind(this),this._play()},_play:function(){var a,b;this.paused?(a=this.start+this.time_offset,b=this.end-this.time_offset):(a=this.start,b=this.end);0>=b?this.clear():("function"===typeof this.source.start?this.source.start(0,a,b):this.source.noteOn(0,a,b),this.playing=!0,this.paused=!1,this.time_started=(new Date).valueOf())},stop:function(){this.playing&&this.source&&
-("function"===typeof this.source.stop?this.source.stop(0):this.source.noteOff(0));this.clear()},pause:function(){this.paused?this.play():this.playing&&(this.source&&this.source.stop(0),this.paused=!0)},ended:function(){this.playing=!1;this.time_ended=(new Date).valueOf();this.time_played=(this.time_ended-this.time_started)/1E3;this.time_offset+=this.time_played;if(this.time_offset>=this.end||.015>this.end-this.time_offset)this._ended(),this.clear(),this.loop&&(this.loop--,this.play())},_ended:function(){var a=
-{name:this.name,alias:this.alias,part:this.sprite_part,start:this.start,duration:this.end};this.ended_callback&&"function"===typeof this.ended_callback&&this.ended_callback.call(this.scope,a)},clear:function(){this.time_offset=this.time_played=0;this.playing=this.paused=!1},setVolume:function(a){this.volume=a.volume;this.gain&&(this.gain.gain.value=this.volume)}};h||(function(){var a=new Audio,b=a.canPlayType("audio/mpeg"),e=a.canPlayType("audio/ogg"),a=a.canPlayType('audio/mp4; codecs="mp4a.40.2"'),
-d,f;for(f=0;f<c.supported.length;f++)d=c.supported[f],b||"mp3"!==d||c.supported.splice(f,1),e||"ogg"!==d||c.supported.splice(f,1),a||"aac"!==d||c.supported.splice(f,1),a||"mp4"!==d||c.supported.splice(f,1)}(),p.prototype={init:function(a){a&&f(a,this.options);this.inited=!0;this.options.preload&&this.load()},destroy:function(){var a;for(b in this.streams)(a=this.streams[b])&&a.destroy();this.streams={};this.inited=this.loaded=!1},load:function(){var a;this.options.preload=!0;this.options._ready=this.ready;
-this.options._scope=this;if(this.options.sprite)for(b in this.options.sprite)a=this.options.sprite[b],this.options.start=a[0],this.options.end=a[1],this.streams[b]=new k(this.options,b);else this.streams[0]=new k(this.options)},ready:function(a){this.loaded||(this.loaded=!0,a={name:this.options.name,alias:this.options.alias,ext:this.options.supported[this.ext],duration:a},this.options.ready_callback&&"function"===typeof this.options.ready_callback&&this.options.ready_callback.call(this.options.scope,
-a),this.autoplay&&(this.autoplay=!1,this.play()))},play:function(a){if(this.inited)if(delete this.options.part,a&&f(a,this.options),console.log(1),this.loaded)if(this.options.sprite)if(this.options.part)this.streams[this.options.part].play(this.options);else for(b in this.options.sprite)this.streams[b].play(this.options);else this.streams[0].play(this.options);else this.options.preload?this.autoplay=!0:(this.autoplay=!0,this.load())},stop:function(a){if(this.inited)if(this.options.sprite)if(a)this.streams[a.part].stop();
-else for(b in this.options.sprite)this.streams[b].stop();else this.streams[0].stop()},pause:function(a){if(this.inited)if(this.options.sprite)if(a)this.streams[a.part].pause();else for(b in this.options.sprite)this.streams[b].pause();else this.streams[0].pause()},volume:function(a){if(a)if(f(a,this.options),this.options.sprite)if(this.options.part)(a=this.streams[this.options.part])&&a.setVolume(this.options);else for(b in this.options.sprite)(a=this.streams[b])&&a.setVolume(this.options);else(a=
-this.streams[0])&&a.setVolume(this.options)}},k=function(a,b){this.name=a.name;this.alias=a.alias;this.sprite_part=b;this.multiplay=a.multiplay;this.volume=a.volume;this.preload=a.preload;this.path=c.path;this.start=a.start||0;this.end=a.end||0;this.scope=a.scope;this.ended_callback=a.ended_callback;this._scope=a._scope;this._ready=a._ready;this.setLoop(a);this.url=this.sound=null;this.loaded=!1;this.played_time=this.paused_time=this.start_time=0;this.init()},k.prototype={init:function(){this.sound=
-new Audio;this.sound.volume=this.volume;this.createUrl();this.sound.addEventListener("ended",this.ended.bind(this),!1);this.sound.addEventListener("canplaythrough",this.can_play_through.bind(this),!1);this.sound.addEventListener("timeupdate",this._update.bind(this),!1);this.load()},destroy:function(){this.stop();this.sound.removeEventListener("ended",this.ended.bind(this),!1);this.sound.removeEventListener("canplaythrough",this.can_play_through.bind(this),!1);this.sound.removeEventListener("timeupdate",
-this._update.bind(this),!1);this.sound=null;this.loaded=!1},createUrl:function(){var a=(new Date).valueOf();this.url=this.path+encodeURIComponent(this.name)+"."+c.supported[0]+"?"+a},can_play_through:function(){this.preload&&this.ready()},load:function(){this.sound.src=this.url;this.sound.preload=this.preload?"auto":"none";this.preload&&this.sound.load()},setLoop:function(a){this.loop=!0===a.loop?9999999:"number"===typeof a.loop?+a.loop-1:!1},update:function(a){this.setLoop(a);"volume"in a&&(this.volume=
-a.volume)},ready:function(){!this.loaded&&this.sound&&(this.loaded=!0,this._ready.call(this._scope,this.sound.duration),this.end||(this.end=this.sound.duration))},play:function(a){a&&this.update(a);!this.multiplay&&this.playing||this._play()},_play:function(){if(this.paused)this.paused=!1;else try{this.sound.currentTime=this.start}catch(a){}this.playing=!0;this.start_time=(new Date).valueOf();this.sound.volume=this.volume;this.sound.play()},stop:function(){if(this.playing){this.paused=this.playing=
-!1;this.sound.pause();this.clear();try{this.sound.currentTime=this.start}catch(a){}}},pause:function(){this.paused?this._play():(this.playing=!1,this.paused=!0,this.sound.pause(),this.paused_time=(new Date).valueOf(),this.played_time+=this.paused_time-this.start_time)},_update:function(){this.start_time&&(this.played_time+((new Date).valueOf()-this.start_time))/1E3>=this.end&&this.playing&&(this.stop(),this._ended())},ended:function(){this.playing&&(this.stop(),this._ended())},_ended:function(){this.playing=
-!1;var a={name:this.name,alias:this.alias,part:this.sprite_part,start:this.start,duration:this.end};this.ended_callback&&"function"===typeof this.ended_callback&&this.ended_callback.call(this.scope,a);this.loop&&setTimeout(this.looper.bind(this),15)},looper:function(){this.loop--;this.play()},clear:function(){this.paused_time=this.played_time=this.start_time=0},setVolume:function(a){this.volume=a.volume;this.sound&&(this.sound.volume=this.volume)}})}}})(window,navigator,window.jQuery||window.$);
\ No newline at end of file
diff --git a/app/static/js/metrics.js b/app/static/js/metrics.js
index 1ea733d..5b1ff1a 100644
--- a/app/static/js/metrics.js
+++ b/app/static/js/metrics.js
@@ -5,11 +5,11 @@ function getChartDataHapWiRam(ip) {
     }
     $.ajax({
         url: "/metrics/ram",
+        global: false,
+        error: () => RmonUI.widgetState("#ram_div", "error", () => getChartDataHapWiRam(ip)),
 		data: JSON.stringify(jsonData),
         contentType: "application/json; charset=utf-8",
-		beforeSend: function() {
-			$('#ram').html('<img class="loading_hapwi_overview" src="/static/images/loading.gif" alt="loading..." />')
-		},
+		beforeSend: () => RmonUI.widgetState("#ram_div", "loading"),
 		type: "POST",
         success: function (result) {
             let data = [];
@@ -19,6 +19,7 @@ function getChartDataHapWiRam(ip) {
 
             // Преобразование значений в числа
             const formattedData = ramsData.map(value => parseFloat(value));
+            RmonUI.widgetState("#ram_div", "ready");
             renderChartHapWiRam(formattedData);
         }
     });
@@ -83,6 +84,9 @@ function getChartDataHapWiCpu(ip) {
     }
     $.ajax({
         url: "/metrics/cpu",
+        global: false,
+        beforeSend: () => RmonUI.widgetState("#cpu_div", "loading"),
+        error: () => RmonUI.widgetState("#cpu_div", "error", () => getChartDataHapWiCpu(ip)),
 		data: JSON.stringify(jsonData),
         contentType: "application/json; charset=utf-8",
 		type: "POST",
@@ -92,6 +96,7 @@ function getChartDataHapWiCpu(ip) {
 
             // Преобразование значений в числа
             const formattedData = ramsData.map(value => parseFloat(value));
+            RmonUI.widgetState("#cpu_div", "ready");
             renderChartHapWiCpu(formattedData);
         }
     });
diff --git a/app/static/js/overview.js b/app/static/js/overview.js
index 44dde55..2291de6 100644
--- a/app/static/js/overview.js
+++ b/app/static/js/overview.js
@@ -5,47 +5,16 @@ function showOverview(serv, hostnamea) {
 	showUsersOverview();
 	showSubOverview();
 	showServicesOverview();
-	updatingCpuRamCharts();
 	var i;
 	for (i = 0; i < serv.length; i++) {
 		showOverviewCallBack(serv[i], hostnamea[i])
 	}
 }
 function showOverviewCallBack(serv, hostnamea) {
-	$.ajax( {
-		url: "/overview/server/"+serv,
-		beforeSend: function() {
-			$("#"+hostnamea).html('<img class="loading_small" src="/static/images/loading.gif" />');
-		},
-		type: "GET",
-		success: function( data ) {
-			if (data.indexOf('error:') != '-1') {
-				toastr.error(data);
-				$("#"+hostnamea).html("");
-			} else {
-				$("#" + hostnamea).empty();
-				$("#" + hostnamea).html(data);
-			}
-		}
-	} );
+    return RmonUI.loadFragment("#" + hostnamea, "/overview/server/" + encodeURIComponent(serv));
 }
 function showServicesOverview() {
-	$.ajax( {
-		url: "/overview/services",
-		beforeSend: function() {
-			$("#services_ovw").html('<img class="loading_small_bin_bout" style="padding-left: 100%;padding-top: 40px;padding-bottom: 40px;" src="/static/images/loading.gif" />');
-
-		},
-		type: "GET",
-		success: function( data ) {
-			if (data.indexOf('error:') != '-1') {
-				toastr.error(data);
-			} else {
-				$("#services_ovw").empty();
-				$("#services_ovw").html(data);
-			}
-		}
-	} );
+    return RmonUI.loadFragment("#services_ovw", "/overview/services");
 }
 function showOverviewServer(ip) {
 	getChartDataHapWiRam(ip);
@@ -87,12 +56,12 @@ $( function() {
 		$("#show-all-groups").css("display", "block");
 	});
 
-	$( "#show-all-haproxy-wi-log" ).click( function() {
+	$(document).on('click', '#show-all-haproxy-wi-log', function() {
 		$(".show-haproxy-wi-log").show("fast");
 		$("#hide-all-haproxy-wi-log").css("display", "block");
 		$("#show-all-haproxy-wi-log").css("display", "none");
 	});
-	$( "#hide-all-haproxy-wi-log" ).click( function() {
+	$(document).on('click', '#hide-all-haproxy-wi-log', function() {
 		$(".show-haproxy-wi-log").hide("fast");
 		$("#hide-all-haproxy-wi-log").css("display", "none");
 		$("#show-all-haproxy-wi-log").css("display", "block");
@@ -103,52 +72,11 @@ $( function() {
 	}
 });
 function showUsersOverview() {
-	$.ajax( {
-		url: "overview/users",
-		type: "GET",
-		beforeSend: function() {
-			$("#users-table").html('<img class="loading_small_bin_bout" style="padding-left: 100%;padding-top: 40px;padding-bottom: 40px;" src="/static/images/loading.gif" />');
-		},
-		success: function( data ) {
-			data = data.replace(/\s+/g,' ');
-			if (data.indexOf('error:') != '-1') {
-				toastr.error(data);
-			} else {
-				$("#users-table").html(data);
-			}
-		}
-	} );
+    return RmonUI.loadFragment("#users-table", "/overview/users");
 }
 function showSubOverview() {
-	$.ajax( {
-		url: "/overview/sub",
-		type: "GET",
-		beforeSend: function() {
-			$("#sub-table").html('<img class="loading_small_bin_bout" style="padding-left: 40%;padding-top: 40px;padding-bottom: 40px;" src="/static/images/loading.gif" />');
-		},
-		success: function( data ) {
-			data = data.replace(/\s+/g,' ');
-			if (data.indexOf('error:') != '-1') {
-				toastr.error(data);
-			} else {
-				$("#sub-table").html(data);
-			}
-		}
-	} );
+    return RmonUI.loadFragment("#sub-table", "/overview/sub");
 }
-
 function ShowOverviewLogs() {
-	$.ajax( {
-		url: "/overview/logs",
-		type: "GET",
-		beforeSend: function() {
-			$("#overview-logs").html('<img class="loading_small_bin_bout" style="padding-left: 40%;padding-top: 40px;padding-bottom: 40px;" src="/static/images/loading.gif" />');
-		},
-		success: function( data ) {
-			data = data.replace(/\s+/g,' ');
-			$("#overview-logs").html(data);
-			$.getScript("/static/js/fontawesome.min.js")
-			$.getScript("/static/js/overview.js")
-		}
-	} );
+    return RmonUI.loadFragment("#overview-logs", "/overview/logs");
 }
diff --git a/app/static/js/reconnecting-websocket.js b/app/static/js/reconnecting-websocket.js
deleted file mode 100644
index 3015099..0000000
--- a/app/static/js/reconnecting-websocket.js
+++ /dev/null
@@ -1 +0,0 @@
-!function(a,b){"function"==typeof define&&define.amd?define([],b):"undefined"!=typeof module&&module.exports?module.exports=b():a.ReconnectingWebSocket=b()}(this,function(){function a(b,c,d){function l(a,b){var c=document.createEvent("CustomEvent");return c.initCustomEvent(a,!1,!1,b),c}var e={debug:!1,automaticOpen:!0,reconnectInterval:1e3,maxReconnectInterval:3e4,reconnectDecay:1.5,timeoutInterval:2e3};d||(d={});for(var f in e)this[f]="undefined"!=typeof d[f]?d[f]:e[f];this.url=b,this.reconnectAttempts=0,this.readyState=WebSocket.CONNECTING,this.protocol=null;var h,g=this,i=!1,j=!1,k=document.createElement("div");k.addEventListener("open",function(a){g.onopen(a)}),k.addEventListener("close",function(a){g.onclose(a)}),k.addEventListener("connecting",function(a){g.onconnecting(a)}),k.addEventListener("message",function(a){g.onmessage(a)}),k.addEventListener("error",function(a){g.onerror(a)}),this.addEventListener=k.addEventListener.bind(k),this.removeEventListener=k.removeEventListener.bind(k),this.dispatchEvent=k.dispatchEvent.bind(k),this.open=function(b){h=new WebSocket(g.url,c||[]),b||k.dispatchEvent(l("connecting")),(g.debug||a.debugAll)&&console.debug("ReconnectingWebSocket","attempt-connect",g.url);var d=h,e=setTimeout(function(){(g.debug||a.debugAll)&&console.debug("ReconnectingWebSocket","connection-timeout",g.url),j=!0,d.close(),j=!1},g.timeoutInterval);h.onopen=function(){clearTimeout(e),(g.debug||a.debugAll)&&console.debug("ReconnectingWebSocket","onopen",g.url),g.protocol=h.protocol,g.readyState=WebSocket.OPEN,g.reconnectAttempts=0;var d=l("open");d.isReconnect=b,b=!1,k.dispatchEvent(d)},h.onclose=function(c){if(clearTimeout(e),h=null,i)g.readyState=WebSocket.CLOSED,k.dispatchEvent(l("close"));else{g.readyState=WebSocket.CONNECTING;var d=l("connecting");d.code=c.code,d.reason=c.reason,d.wasClean=c.wasClean,k.dispatchEvent(d),b||j||((g.debug||a.debugAll)&&console.debug("ReconnectingWebSocket","onclose",g.url),k.dispatchEvent(l("close")));var e=g.reconnectInterval*Math.pow(g.reconnectDecay,g.reconnectAttempts);setTimeout(function(){g.reconnectAttempts++,g.open(!0)},e>g.maxReconnectInterval?g.maxReconnectInterval:e)}},h.onmessage=function(b){(g.debug||a.debugAll)&&console.debug("ReconnectingWebSocket","onmessage",g.url,b.data);var c=l("message");c.data=b.data,k.dispatchEvent(c)},h.onerror=function(b){(g.debug||a.debugAll)&&console.debug("ReconnectingWebSocket","onerror",g.url,b),k.dispatchEvent(l("error"))}},1==this.automaticOpen&&this.open(!1),this.send=function(b){if(h)return(g.debug||a.debugAll)&&console.debug("ReconnectingWebSocket","send",g.url,b),h.send(b);throw"INVALID_STATE_ERR : Pausing to reconnect websocket"},this.close=function(a,b){"undefined"==typeof a&&(a=1e3),i=!0,h&&h.close(a,b)},this.refresh=function(){h&&h.close()}}return a.prototype.onopen=function(){},a.prototype.onclose=function(){},a.prototype.onconnecting=function(){},a.prototype.onmessage=function(){},a.prototype.onerror=function(){},a.debugAll=!1,a.CONNECTING=WebSocket.CONNECTING,a.OPEN=WebSocket.OPEN,a.CLOSING=WebSocket.CLOSING,a.CLOSED=WebSocket.CLOSED,a});
diff --git a/app/static/js/rmon/agent.js b/app/static/js/rmon/agent.js
index 9a62033..0901576 100644
--- a/app/static/js/rmon/agent.js
+++ b/app/static/js/rmon/agent.js
@@ -47,6 +47,7 @@ function addAgentDialog(agent_id=0, edit=false) {
 			return false;
 		}
 		getFreeServers();
+		if (!getAgentTransportDefaults()) return false;
 		buttons = [
 			{
 				text: add_word,
@@ -100,6 +101,8 @@ function addAgent(dialog_id, agent_id=0, edit=false, reconfigure=false) {
         'enabled': agent_enabled,
         'shared': agent_shared
     };
+	const resultTransport = $('#new-agent-result-transport').val();
+	if (resultTransport) agent_data.result_transport = resultTransport;
 	let method = 'POST';
 	let req_url = api_v_prefix + "/rmon/agent";
 	if (edit) {
@@ -124,11 +127,11 @@ function addAgent(dialog_id, agent_id=0, edit=false, reconfigure=false) {
 					if (edit) {
 						getAgent(agent_id, false);
 						if (reconfigure) {
-							runInstallationTaskCheck(data.tasks_ids);
+							runInstallationTaskCheck(data.tasks_ids, agent_id);
 						}
 					} else {
 						getAgent(data.id, new_agent = true);
-						runInstallationTaskCheck(data.tasks_ids);
+						runInstallationTaskCheck(data.tasks_ids, data.id);
 					}
 				}
 			}
@@ -142,10 +145,12 @@ function getAgentSettings(agent_id) {
 		success: function (data) {
 			$('#new-agent-name').val(data['name'].replaceAll("'", ""));
 			$('#new-agent-port').val(data['port']);
+			$('#new-agent-result-transport option[value=""]').prop('disabled', Boolean(data.result_transport));
+			$('#new-agent-result-transport').val(data.result_transport || '').selectmenu('refresh');
 			$('#new-agent-select-tr').hide();
 			generateSelect('#new-agent-server-id', data['server_id'], data['server_id'], 'selected')
 			$('#new-agent-server-id').attr('disabled', 'disabled');
-			$('#new-agent-desc').val(data['description'].replaceAll("'", ""));
+			$('#new-agent-desc').val((data['description'] || '').replaceAll("'", ""));
 			$('#new-agent-enabled').checkboxradio("refresh");
 			if (data['enabled'] == '1') {
 				$('#new-agent-enabled').prop('checked', true)
@@ -177,10 +182,27 @@ function getFreeServers() {
 		}
 	});
 }
+function getAgentTransportDefaults() {
+	let loaded = false;
+	$.ajax({
+		url: '/rmon/agent/transport-settings',
+		async: false,
+		success: function (data) {
+			if (!['http', 'https', 'mtls'].includes(data.result_transport)) return;
+			$('#new-agent-result-transport option[value=""]').prop('disabled', true);
+			$('#new-agent-result-transport').val(data.result_transport).selectmenu('refresh');
+			loaded = true;
+		},
+		error: function (xhr) { toastr.error(xhr.responseJSON?.error || xhr.statusText); }
+	});
+	return loaded;
+}
 function cleanAgentAddForm() {
 	$('#new-agent-name').val('');
 	$('#new-agent-server-id').val('------').change();
 	$('#new-agent-desc').val('');
+	$('#new-agent-result-transport option[value=""]').prop('disabled', false);
+	$('#new-agent-result-transport').val('').selectmenu('refresh');
 	$('#new-agent-shared').prop('checked', false);
 	$('#new-agent-enabled').prop('checked', true);
 	$('#new-agent-shared').checkboxradio("refresh");
@@ -213,6 +235,7 @@ function getAgentVersion(server_ip, agent_id){
 	$.ajax({
 		url: '/rmon/agent/version/' + server_ip,
 		type: 'get',
+		dataType: 'json',
 		data: {agent_id: agent_id},
 		success: function (data){
 			try {
@@ -230,68 +253,53 @@ function getAgentUptime(server_ip, agent_id){
 	$.ajax({
 		url: '/rmon/agent/uptime/' + server_ip,
 		type: 'get',
+		dataType: 'json',
 		data: {agent_id: agent_id},
 		success: function (data){
 			try {
-				data = JSON.parse(data);
+				if (!data || typeof data.uptime !== 'string') throw new Error('Invalid agent uptime');
 				$('#agent-uptime-' + agent_id).text(data['uptime']);
 				$('#agent-uptime-' + agent_id).attr('datetime', data['uptime']);
 				$("#agent-uptime-"+agent_id).timeago();
 			} catch (e) {
 				console.log(e)
 			}
-		}
+		},
+		error: function () { $('#agent-uptime-' + agent_id).text('—').removeAttr('datetime'); }
 	});
 }
+function setAgentStatus(agent_id, running) {
+	$('#agent-' + agent_id).removeClass('div-server-head-up div-server-head-down div-server-head-pause')
+		.addClass(running === null ? 'div-server-head-down' : (running ? 'div-server-head-up' : 'div-server-head-pause'));
+	for (const [action, prefix, enabled] of [['start', 'start', running !== true], ['restart', 'reload', true], ['stop', 'stop', running !== null]]) {
+		$('#' + prefix + '-' + agent_id).children().toggleClass('disabled-button', !enabled)
+			.attr('aria-disabled', String(!enabled)).removeAttr('onclick').off('click.rmonAgent')
+			.on('click.rmonAgent', function () { if (enabled) confirmAjaxAction(action, agent_id); });
+	}
+}
 function getAgentStatus(server_ip, agent_id){
 	$.ajax({
 		url: '/rmon/agent/status/' + server_ip,
 		type: 'get',
+		dataType: 'json',
 		data: {agent_id: agent_id},
 		success: function (data){
-			try {
-				data = JSON.parse(data);
-				if (data['running']) {
-					$('#agent-'+agent_id).addClass('div-server-head-up');
-					$('#start-'+agent_id).children().addClass('disabled-button');
-					$('#start-'+agent_id).children().removeAttr('onclick');
-					$('#agent-'+agent_id).removeClass('div-server-head-down');
-				} else {
-					$('#agent-'+agent_id).removeClass('div-server-head-up');
-					$('#agent-'+agent_id).addClass('div-server-head-pause');
-					$('#pause-'+agent_id).children().addClass('disabled-button');
-					$('#pause-'+agent_id).children().removeAttr('onclick');
-				}
-			} catch (e) {
-				console.log(e);
-				$('#agent-'+agent_id).addClass('div-server-head-down');
-				$('#stop-'+agent_id).children().addClass('disabled-button');
-				$('#pause-'+agent_id).children().addClass('disabled-button');
-				$('#pause-'+agent_id).children().removeAttr('onclick');
-				$('#stop-'+agent_id).children().removeAttr('onclick');
-			}
-		}
+			setAgentStatus(agent_id, data && typeof data.running === 'boolean' ? data.running : null);
+		},
+		error: function () { setAgentStatus(agent_id, null); }
 	});
 }
 function getAgentTotalChecks(server_ip, agent_id){
 	$.ajax({
 		url: '/rmon/agent/checks/' + server_ip,
 		type: 'get',
+		dataType: 'json',
 		data: {agent_id: agent_id},
 		contentType: "application/json; charset=utf-8",
 		success: function (data){
-			try {
-				data = JSON.parse(data);
-				if (data.error) {
-					$('#agent-total-checks-'+agent_id).text(data.error);
-				} else {
-					$('#agent-total-checks-'+agent_id).text(data);
-				}
-			} catch (e) {
-				console.log(e);
-				$('#agent-'+agent_id).addClass('div-server-head-down')
-			}
-		}
+			$('#agent-total-checks-' + agent_id).text(Number.isInteger(data) && data >= 0 ? data : '—');
+		},
+		error: function () { $('#agent-total-checks-' + agent_id).text('—'); }
 	});
 }
 function confirmDeleteAgent(id) {
@@ -372,16 +380,23 @@ function agentAction(action, id, dialog_id) {
 	$.ajax({
 		url: "/rmon/agent/action/"+ action,
 		type: "post",
+		dataType: 'json',
 		data: {agent_id: id},
 		success: function (data) {
-			data = data.replace(/\s+/g, ' ');
-			if (data.indexOf('error:') != '-1' || data.indexOf('unique') != '-1') {
-				toastr.error(data);
+			if (!data || !['ok', 'queued'].includes(data.status)) {
+				toastr.error(window.RmonUI ? RmonUI.text('request_error') : 'Unexpected server response');
 			} else {
 				toastr.clear();
 				$(dialog_id).dialog("close");
-				getAgent(id, false);
+				if (data.task_id) runInstallationTaskCheck([data.task_id], id);
+				else getAgent(id, false);
 			}
+		},
+		error: function (xhr) {
+			const message = xhr.responseJSON && xhr.responseJSON.error;
+			if (typeof message === 'string') toastr.error(message, '', {escapeHtml: true});
+			else if (window.RmonUI) RmonUI.notifyRequestError(xhr);
+			else toastr.error('Cannot manage agent over SSH');
 		}
 	});
 }
@@ -456,61 +471,95 @@ function moveChecks(agent_id, agent_ip, dialog_id) {
 	});
 }
 const INSTALLATION_TASKS_KEY = 'installationTasks';
+const installationTaskAgents = new Map();
+const installationTaskPolls = new Map();
+let checkInstallationTaskTimer = null;
+
 function getInstallationTasksFromSessionStorage() {
-    const tasks = sessionStorage.getItem(INSTALLATION_TASKS_KEY);
-    return tasks ? JSON.parse(tasks) : [];
+    try {
+        const tasks = JSON.parse(sessionStorage.getItem(INSTALLATION_TASKS_KEY) || '[]');
+        return Array.isArray(tasks) ? [...new Set(tasks.map(String))] : [];
+    } catch (_) {
+        sessionStorage.removeItem(INSTALLATION_TASKS_KEY);
+        return [];
+    }
 }
 function addItemToSessionStorageInstallTask(taskId) {
-	if (!sessionStorage.getItem(INSTALLATION_TASKS_KEY)) {
-		sessionStorage.setItem(INSTALLATION_TASKS_KEY, JSON.stringify([])); // Создаем пустой массив
-	}
-	let tasks = getInstallationTasksFromSessionStorage();
-
-	tasks.push(taskId);
-
-	sessionStorage.setItem(INSTALLATION_TASKS_KEY, JSON.stringify(tasks));
+    const tasks = new Set(getInstallationTasksFromSessionStorage());
+    tasks.add(String(taskId));
+    sessionStorage.setItem(INSTALLATION_TASKS_KEY, JSON.stringify([...tasks]));
 }
 function removeItemFromSessionStorage(taskId) {
-      let tasks = getInstallationTasksFromSessionStorage();
-
-      tasks = tasks.filter(item => item !== taskId);
-
-      sessionStorage.setItem(INSTALLATION_TASKS_KEY, JSON.stringify(tasks));
-    }
-
+    sessionStorage.setItem(INSTALLATION_TASKS_KEY, JSON.stringify(
+        getInstallationTasksFromSessionStorage().filter(item => item !== String(taskId))));
+    installationTaskPolls.delete(String(taskId));
+}
+function scheduleInstallationTaskCheck() {
+    clearTimeout(checkInstallationTaskTimer);
+    checkInstallationTaskTimer = null;
+    const now = Date.now();
+    const waiting = getInstallationTasksFromSessionStorage().map(id => {
+        if (!installationTaskPolls.has(id)) installationTaskPolls.set(id, {next: now + 5000, delay: 5000, pending: false});
+        return installationTaskPolls.get(id);
+    }).filter(state => !state.pending);
+    if (!waiting.length) return;
+    const delay = Math.max(document.hidden ? 30000 : 1000, Math.min(...waiting.map(state => state.next - now)));
+    checkInstallationTaskTimer = setTimeout(checkInstallationTask, delay);
+}
 function checkInstallationTask() {
-	let tasks = getInstallationTasksFromSessionStorage(); // Извлекаем список
-	if (tasks && tasks.length > 0) {
-		tasks.forEach(item => {
-			checkInstallationStatus(item);
-		});
-	} else {
-		console.log('No tasks');
-		clearInterval(checkInstallationTaskInterval);
-	}
+    checkInstallationTaskTimer = null;
+    for (const id of getInstallationTasksFromSessionStorage()) {
+        const state = installationTaskPolls.get(id);
+        if (state && !state.pending && state.next <= Date.now()) checkInstallationStatus(id);
+    }
+    scheduleInstallationTaskCheck();
 }
-function runInstallationTaskCheck(tasks_ids) {
-	toastr.info('Installation started. You can continue to use the system while it is installing');
-	tasks_ids.forEach(item => {
-		addItemToSessionStorageInstallTask(item);
-		setTimeout(function () {
-			setInterval(checkInstallationTask, 3000);
-		}, 5000);
-	});
+function runInstallationTaskCheck(taskIds, agentId=null) {
+    toastr.info('Agent operation queued. You can continue using RMON.');
+    for (const id of taskIds) {
+        if (agentId !== null) installationTaskAgents.set(String(id), agentId);
+        addItemToSessionStorageInstallTask(id);
+    }
+    scheduleInstallationTaskCheck();
 }
 function checkInstallationStatus(taskId) {
-	NProgress.configure({showSpinner: false});
-	$.ajax({
-		url: api_v_prefix + "/rmon/task-status/" + taskId,
-		success: function (data) {
-			if (data.status === 'completed') {
-				toastr.success('Installation completed for ' + data.service_name + ' successfully on ' + data.server);
-				removeItemFromSessionStorage(taskId);
-			} else if (data.status === 'failed') {
-				toastr.error('Cannot install ' + data.service_name + '. Error: ' + data.error);
-				removeItemFromSessionStorage(taskId);
-			}
-		}
-	});
+    taskId = String(taskId);
+    const state = installationTaskPolls.get(taskId);
+    if (!state || state.pending) return;
+    state.pending = true;
+    $.ajax({
+        url: api_v_prefix + '/rmon/task-status/' + taskId,
+        dataType: 'json',
+        timeout: 10000,
+        success: function (data) {
+            if (data.status === 'completed' || data.status === 'failed') {
+                if (data.status === 'completed') {
+                    toastr.success('Agent operation completed on ' + data.server, '', {escapeHtml: true});
+                } else {
+                    toastr.error(data.error || 'Agent operation failed.', '', {escapeHtml: true});
+                }
+                removeItemFromSessionStorage(taskId);
+                const agentId = installationTaskAgents.get(taskId);
+                if (agentId !== undefined) getAgent(agentId);
+                installationTaskAgents.delete(taskId);
+            } else {
+                state.delay = data.status === 'running' ? 10000 : Math.min(30000, state.delay * 2);
+            }
+        },
+        error: function (xhr) {
+            if ([401, 403, 404].includes(xhr.status)) {
+                removeItemFromSessionStorage(taskId);
+                installationTaskAgents.delete(taskId);
+                toastr.warning('This operation is no longer available. Refresh the agent status.');
+            } else {
+                state.delay = Math.min(60000, state.delay * 2);
+            }
+        },
+        complete: function () {
+            state.pending = false;
+            state.next = Date.now() + state.delay;
+            scheduleInstallationTaskCheck();
+        }
+    });
 }
-let checkInstallationTaskInterval = setInterval(checkInstallationTask, 3000);
+scheduleInstallationTaskCheck();
diff --git a/app/static/js/rmon/check.js b/app/static/js/rmon/check.js
index 8aaab19..0039706 100644
--- a/app/static/js/rmon/check.js
+++ b/app/static/js/rmon/check.js
@@ -86,45 +86,36 @@ function getCountriesForCheck() {
 	});
 }
 function addEntityToStatus(server_id, hostname) {
-	let service_word = translate_div.attr('data-service');
-	let html_tag = '<div id="remove_check-' + server_id + '" data-name="' + hostname + '">' +
-		'<div class="check-name">' + hostname + '</div>' +
-		'<div class="add_user_group check-button" onclick="removeEntityFromStatus(' + server_id + ', \'' + hostname + '\')" title="' + delete_word + ' ' + service_word + '">-</div>' +
-		'</div>';
-	$('#add_check-' + server_id).remove();
-	$('#checked-entities').append(html_tag);
+    renderCheckEntity(server_id, hostname, true);
 }
 function removeEntityFromStatus(server_id, hostname) {
-	let add_word = translate_div.attr('data-add');
-	let service_word = translate_div.attr('data-service');
-
-	let html_tag = '<div class="all-checks" id="add_check-' + server_id + '" data-name="' + hostname + '">' +
-		'<div class="check-name">' + hostname + '</div>' +
-		'<div class="add_user_group check-button" onclick="addEntityToStatus(' + server_id + ',  \'' + hostname + '\')" title="' + add_word + ' ' + service_word + '">+</div></div>';
-    $('#all-entities').append(html_tag);
-	$('#remove_check-' + server_id).remove();
+    renderCheckEntity(server_id, hostname, false);
+}
+function renderCheckEntity(server_id, hostname, selected) {
+    if (!Number.isInteger(Number(server_id)) || Number(server_id) <= 0) return;
+    const action = selected ? delete_word : translate_div.attr('data-add');
+    const label = action + ' ' + hostname;
+    $('#add_check-' + server_id + ', #remove_check-' + server_id).remove();
+    const row = $('<div>', {id: (selected ? 'remove_check-' : 'add_check-') + server_id,
+        class: selected ? '' : 'all-checks', 'data-name': hostname});
+    $('<div>', {class: 'check-name'}).text(hostname).appendTo(row);
+    $('<button>', {type: 'button', class: 'add_user_group check-button', 'aria-label': label, title: label})
+        .text(selected ? '−' : '+').on('click', () => renderCheckEntity(server_id, hostname, !selected)).appendTo(row);
+    $(selected ? '#checked-entities' : '#all-entities').append(row);
 }
 function getEntityJson(entity_id, entity_type) {
-	let isGetEntity = true;
-	let dataId = '';
-	let dataName = '';
+	let loaded = false;
 	$.ajax({
 		url: api_v_prefix + "/rmon/" + entity_type + "/" + entity_id,
 		async: false,
 		contentType: "application/json; charset=utf-8",
 		success: function (data) {
-			$("#checked-entities > div").each((index, elem) => {
-				if (data.id === Number(elem.id.split('-')[1])) {
-					isGetEntity = false;
-				}
-			});
-			dataId = data.id;
-			dataName = data.name;
+			if (!data || Number(data.id) !== Number(entity_id) || !data.name) return;
+			addEntityToStatus(data.id, data.name);
+			loaded = true;
 		}
 	});
-	if (isGetEntity) {
-		addEntityToStatus(dataId, dataName);
-	}
+	return loaded;
 }
 function updateCurrentStatusRequest(check_id) {
 	$.ajax({
diff --git a/app/static/js/rmon/check_editor.js b/app/static/js/rmon/check_editor.js
new file mode 100644
index 0000000..7902daf
--- /dev/null
+++ b/app/static/js/rmon/check_editor.js
@@ -0,0 +1,247 @@
+/* Presentation and draft state for the existing check API. Field IDs remain stable. */
+window.CheckEditor = (function () {
+    'use strict';
+    const catalog = document.getElementById('check-editor-strings');
+    const strings = catalog ? JSON.parse(catalog.textContent) : {};
+    const text = key => strings[key] || key;
+    const root = () => $('#smon-add-table');
+    const value = id => $('#' + id).val();
+    let step = 0, type = null, ports = {}, busy = false, failed = false;
+    const typeClasses = {http: 'smon_http_check', tcp: 'smon_tcp_check', dns: 'smon_dns_check',
+        ping: 'smon_ping_check', smtp: 'smon_smtp_check', rabbitmq: 'smon_rabbit_check'};
+    const portDefaults = {tcp: '', dns: '53', smtp: '587', rabbitmq: '5672'};
+    function fit() {
+        if (root().data('ui-dialog') && root().dialog('isOpen')) RmonUI.fitDialog(root()[0]);
+    }
+    function refresh() {
+        root().find('select').each(function () {
+            if ($(this).data('ui-selectmenu')) $(this).selectmenu('refresh');
+            const label = $(this).closest('.check-field').find('.check-field-label').first().text().replace(/\*/g, '').trim();
+            // jQuery UI labels its button with the selected option; use the field name.
+            $('#' + this.id + '-button').removeAttr('aria-labelledby').attr('aria-label', label);
+        });
+        root().find('input[type=checkbox]').each(function () {
+            if ($(this).data('ui-checkboxradio')) $(this).checkboxradio('refresh');
+            $(this).attr('aria-label', $(this).closest('.check-field').find('.check-field-label').first().text().trim());
+        });
+        window.tagify?.DOM.input.setAttribute('aria-label', $('#new-smon-status-code').closest('.check-field').find('label').text().replace(/\*/g, '').trim());
+        RmonUI.enhance(root()[0]);
+    }
+    function conditionalFields() {
+        root().find('.smon_http_check_basic').toggle(type === 'http' && value('smon_http_check_auth_method') === 'basic');
+        root().find('.smon_http_check_mtls').toggle(type === 'http' && value('smon_http_check_auth_method') === 'mtls');
+        root().find('.smon_http_check_proxy').toggle(type === 'http' && value('smon_http_check_proxy_method') !== '0');
+        root().find('#new-smon-headers-response').toggle(type === 'http' && value('smon_http_check_headers_response_type') !== '0');
+        root().find('.smon_http_check_body_type_keyword').toggle(type === 'http' && value('smon_http_check_body_type') === 'keyword');
+        root().find('.smon_http_check_body_type_json').toggle(type === 'http' && value('smon_http_check_body_type') === 'json');
+    }
+    function setType(nextType) {
+        if (!typeClasses[nextType]) return;
+        if (type && Object.hasOwn(portDefaults, type)) ports[type] = value('new-smon-port');
+        if (nextType !== type && Object.hasOwn(portDefaults, nextType)) $('#new-smon-port').val(ports[nextType] ?? portDefaults[nextType]);
+        type = nextType;
+        $('#check_type').val(type);
+        const classes = Object.values(typeClasses);
+        root().find(classes.map(c => '.' + c).join(',')).each(function () { $(this).toggle(this.classList.contains(typeClasses[type])); });
+        root().find('.new_smon_hostname').toggle(type !== 'http');
+        $('#new-smon-username').attr('placeholder', type === 'rabbitmq' ? 'guest' : 'monitor@example.com');
+        conditionalFields(); refresh(); summary(); fit();
+    }
+    function clearErrors() {
+        const errorIds = new Set(root().find('.check-field-error').map((_, error) => error.id).get());
+        root().find('.check-field-error').remove();
+        root().find('[aria-invalid]').each(function () {
+            $(this).removeAttr('aria-invalid').removeClass('ui-state-error');
+            const description = (this.getAttribute('aria-describedby') || '').split(' ').filter(id => id && !errorIds.has(id));
+            if (description.length) this.setAttribute('aria-describedby', description.join(' '));
+            else this.removeAttribute('aria-describedby');
+        });
+        $('#check-editor-error').prop('hidden', true).empty();
+    }
+    function showStep(index, focus = false) {
+        step = Math.max(0, Math.min(2, Number(index)));
+        root().find('[role=tabpanel]').each(function () { this.hidden = Number(this.dataset.step) !== step; });
+        root().find('[role=tab]').each(function () {
+            const active = Number(this.dataset.step) === step;
+            $(this).attr({'aria-selected': String(active), tabindex: active ? '0' : '-1'});
+        });
+        $('#check-editor-back').prop('hidden', step === 0);
+        $('#check-editor-next').prop('hidden', step === 2);
+        summary();
+        root().scrollTop(0);
+        fit();
+        if (focus) $('#check-editor-tab-' + step).trigger('focus');
+    }
+    function reset(nextType) {
+        busy = false; failed = false; type = null; ports = {};
+        const form = document.getElementById('check-editor-form');
+        form.reset(); form.inert = false;
+        root().attr('aria-busy', 'false');
+        $('#check_type, #new-smon-place').prop('disabled', false);
+        $('#checked-entities, #all-entities').empty(); $('#agent_tr').hide();
+        root().find('details').prop('open', false);
+        if (window.tagify) window.tagify.removeAllTags();
+        clearErrors(); setType(nextType); showStep(0);
+    }
+    function focusField(id) {
+        const field = document.getElementById(id);
+        if (!field) return;
+        showStep(field.closest('[role=tabpanel]')?.dataset.step || 0);
+        $(field).parents('details').prop('open', true);
+        fit();
+        const target = document.getElementById(id + '-button') ||
+            (id === 'new-smon-status-code' ? window.tagify?.DOM.input : null) || field;
+        target.focus(); target.scrollIntoView?.({block: 'nearest'});
+    }
+    function validate(onlyStep) {
+        clearErrors();
+        const errors = [];
+        function add(id, message) {
+            const field = document.getElementById(id);
+            if (!field || (onlyStep !== undefined && Number(field.closest('[role=tabpanel]')?.dataset.step) !== onlyStep)) return;
+            if (!errors.some(e => e.id === id)) errors.push({id, message});
+        }
+        function required(id) { if (!String(value(id) ?? '').trim()) add(id, text('required')); }
+        function number(id, min, max = Infinity, integer = true) {
+            const n = Number(value(id));
+            if (String(value(id) ?? '').trim() === '' || !Number.isFinite(n) || n < min || n > max || (integer && !Number.isInteger(n))) add(id, text(id.endsWith('port') ? 'port' : 'number'));
+        }
+        required('new-smon-name');
+        if (type === 'http') {
+            try { const url = new URL(value('new-smon-url')); if (!['http:', 'https:'].includes(url.protocol) || !url.hostname) throw new Error(); }
+            catch (_) { add('new-smon-url', text('invalid_url')); }
+            const codes = window.tagify?.value || [];
+            if (!codes.length || codes.some(tag => {
+                const code = String(tag.value);
+                if (!/^(?:[1-5][0-9]{2}|[1-5]\*\*|[1-5][0-9]{2}-[1-5][0-9]{2})$/.test(code)) return true;
+                const [start, end] = code.split('-').map(Number);
+                return end !== undefined && start > end;
+            })) add('new-smon-status-code', text('status_codes'));
+            number('new-smon-redirects', 0);
+            if (value('smon_http_check_body_type') === 'keyword') required('new-smon-body-keyword');
+            if (value('smon_http_check_body_type') === 'json') required('new-smon-body-json-path');
+            if (value('smon_http_check_auth_method') === 'mtls') { required('new-smon-mtls_key'); required('new-smon-mtls_cert'); }
+            if (value('smon_http_check_proxy_method') !== '0') { required('new-smon-http_proxy_host'); number('new-smon-http_proxy_port', 2, 65535); }
+            const jsonFields = ['new-smon-header-req'];
+            if (value('smon_http_check_headers_response_type') !== '0') jsonFields.push('new-smon-header-response-required');
+            for (const id of jsonFields) {
+                if (!String(value(id) || '').trim()) continue;
+                try { const parsed = JSON.parse(value(id)); if (!parsed || Array.isArray(parsed) || typeof parsed !== 'object') throw new Error(); }
+                catch (_) { add(id, text('json')); }
+            }
+        } else required('new-smon-ip');
+        if (['tcp', 'dns', 'smtp', 'rabbitmq'].includes(type)) number('new-smon-port', 2, 65535);
+        if (type === 'dns') required('new-smon-resolver-server');
+        if (['smtp', 'rabbitmq'].includes(type)) { required('new-smon-username'); required('new-smon-password'); }
+        if (type === 'rabbitmq') required('new-smon-vhost');
+        number('new-smon-interval', 1); number('new-smon-timeout', 2, 59); number('new-smon-retries', 1);
+        number('new-smon-threshold_timeout', 0, Infinity, false);
+        if (Number(value('new-smon-timeout')) >= Number(value('new-smon-interval'))) add('new-smon-timeout', text('timeout'));
+        if (Number(value('new-smon-threshold_timeout')) >= Number(value('new-smon-timeout')) * 1000) add('new-smon-threshold_timeout', text('number'));
+        if (type === 'ping') {
+            number('new-smon-packet_size', 17); number('new-smon-count_packets', 1);
+            if (Number(value('new-smon-count_packets')) * Number(value('new-smon-timeout')) >= Number(value('new-smon-interval'))) add('new-smon-count_packets', text('ping_timeout'));
+        }
+        if (value('new-smon-place') !== 'all' && !$('#checked-entities > div').length) add('new-smon-place', text('entities'));
+        for (const error of errors) {
+            const field = $('#' + error.id);
+            $('<p>', {class: 'check-field-error', id: error.id + '-error'}).text(error.message).appendTo(field.closest('.check-field-control'));
+            field.attr({'aria-invalid': 'true', 'aria-describedby': ((field.attr('aria-describedby') || '') + ' ' + error.id + '-error').trim()}).addClass('ui-state-error');
+            const widget = document.getElementById(error.id + '-button') || (error.id === 'new-smon-status-code' ? window.tagify?.DOM.input : null);
+            if (widget) $(widget).attr({'aria-invalid': 'true', 'aria-describedby': error.id + '-error'});
+        }
+        if (errors.length) focusField(errors[0].id);
+        return !errors.length;
+    }
+    function summary() {
+        const host = $('#check-editor-summary').empty();
+        if (!host.length) return;
+        let target = value('new-smon-ip') || text('summary_empty');
+        if (type === 'http') {
+            try { const url = new URL(value('new-smon-url')); target = url.origin + url.pathname; }
+            catch (_) { target = text('summary_empty'); }
+        }
+        $('<strong>').text((value('new-smon-name') || text('summary')) + ' · ' + (type || '').toUpperCase()).appendTo(host);
+        $('<span>').text(target).appendTo(host);
+        if (type === 'http') $('<span>').text(text('ssl_policy') + ': ' + $('#new-smon-ssl_policy option:selected').text()).appendTo(host);
+        $('<span>').text($('#new-smon-place option:selected').text() + ' · ' + value('new-smon-interval') + ' ' + text('seconds')).appendTo(host);
+        const channels = ['telegram','slack','pd','mm','incidentrelay','email'].filter(c => value('new-smon-' + c) !== '0');
+        $('<span>').text(channels.length ? channels.map(c => $('#new-smon-' + c).closest('.check-field').find('label').first().text()).join(', ') : text('no_channels')).appendTo(host);
+    }
+    function setBusy(active, loading = false) {
+        busy = active;
+        root().attr('aria-busy', String(active));
+        document.getElementById('check-editor-form').inert = active;
+        $('#check-editor-back, #check-editor-next, #check-editor-submit, #check-editor-cancel').prop('disabled', active);
+        root().find('[role=tab]').prop('disabled', active);
+        if (active) $('#check-editor-error').prop('hidden', false).text(text(loading ? 'loading' : 'saving'));
+        else $('#check-editor-error').prop('hidden', true);
+    }
+    function showError(message, loadFailed = false) {
+        setBusy(false); failed = loadFailed;
+        $('#check-editor-submit, #check-editor-next').prop('disabled', loadFailed);
+        $('#check-editor-error').prop('hidden', false).text(message).trigger('focus');
+    }
+    function populate(data) {
+        if (!Array.isArray(data.checks) || !data.checks.length) throw new Error('Missing check settings');
+        const check = data.checks[0], common = check.smon_id || {};
+        const settings = {...common, ...check, ...data};
+        const map = {name:'name', ip:'ip', port:'port', resolver:'resolver-server', record_type:'dns_record_type',
+            url:'url', resole_to_ip:'resole_to_ip', description:'description', packet_size:'packet_size', count_packets:'count_packets',
+            interval:'interval', check_timeout:'timeout', username:'username', password:'password', vhost:'vhost', retries:'retries',
+            redirects:'redirects', runbook:'runbook', priority:'priority', expiration:'expiration', threshold_timeout:'threshold_timeout',
+            check_group:'group', body_req:'body-req', header_req:'header-req', method:'method', http_version:'http_version', ssl_policy:'ssl_policy'};
+        for (const [key, id] of Object.entries(map)) {
+            if (Object.hasOwn(settings, key)) $('#new-smon-' + id).val(settings[key] ?? '');
+        }
+        for (const channel of ['telegram','slack','pd','mm','incidentrelay','email']) $('#new-smon-' + channel).val(settings[channel + '_channel_id'] || '0');
+        for (const [id, key] of [['enable','enabled'],['ignore_ssl_error','ignore_ssl_error'],['accept_cookies','accept_cookies'],['use_kernel_timestamp','use_kernel_timestamp']]) {
+            if (settings[key] !== undefined) $('#new-smon-' + id).prop('checked', settings[key] === true || Number(settings[key]) === 1);
+        }
+        window.tagify?.removeAllTags(); window.tagify?.addTags(check.accepted_status_codes || []);
+        $('#new-smon-place').val(data.place).trigger('selectmenuchange');
+        if (data.place !== 'all') for (const id of data.entities || []) {
+            if (!getEntityJson(id, data.place)) throw new Error('Cannot load a selected location');
+        }
+        if (settings.body_json) {
+            $('#smon_http_check_body_type').val('json');
+            $('#new-smon-body-json-path').val(settings.body_json.path); $('#new-smon-body-json-value').val(settings.body_json.value ?? '');
+        } else if (settings.body) { $('#smon_http_check_body_type').val('keyword'); $('#new-smon-body-keyword').val(settings.body); }
+        if (check.auth?.basic) {
+            $('#smon_http_check_auth_method').val('basic');
+            $('#new-smon-basic_username').val(check.auth.basic.username); $('#new-smon-basic_password').val(check.auth.basic.password);
+        } else if (check.auth?.mtls) {
+            $('#smon_http_check_auth_method').val('mtls');
+            for (const key of ['key','cert','ca']) $('#new-smon-mtls_' + key).val(check.auth.mtls[key] || '');
+        }
+        if (check.proxy) {
+            $('#smon_http_check_proxy_method').val(check.proxy.type);
+            for (const key of ['host','port','username','password']) $('#new-smon-http_proxy_' + key).val(check.proxy[key] ?? '');
+        }
+        if (check.headers_response) {
+            $('#smon_http_check_headers_response_type').val('check');
+            $('#new-smon-header-response-forbidden').val((check.headers_response.forbidden_headers || []).join(',\n'));
+            $('#new-smon-header-response-required').val(check.headers_response.required_response_headers ? JSON.stringify(check.headers_response.required_response_headers, null, 2) : '');
+        }
+        conditionalFields(); refresh(); summary();
+    }
+    $(function () {
+        root()[0]?.addEventListener('toggle', fit, true);
+        root().on('click', '[role=tab]', function () { if (!busy) showStep(this.dataset.step, true); });
+        root().on('keydown', '[role=tab]', function (event) {
+            if (busy) return;
+            const keys = {ArrowRight: (step + 1) % 3, ArrowLeft: (step + 2) % 3, Home: 0, End: 2};
+            if (Object.hasOwn(keys, event.key)) { event.preventDefault(); showStep(keys[event.key], true); }
+        });
+        root().on('input change selectmenuchange', 'input, textarea, select', summary);
+        root().on('selectmenuchange', 'select', function () { refresh(); fit(); });
+        $('#check-editor-form').on('submit', event => { event.preventDefault(); $('#check-editor-submit').trigger('click'); });
+        const labels = {'new-smon-body-json-path':'json_path','new-smon-body-json-value':'json_value',
+            'new-smon-http_proxy_host':'proxy_host','new-smon-http_proxy_port':'proxy_port',
+            'new-smon-http_proxy_username':'proxy_username','new-smon-http_proxy_password':'proxy_password'};
+        for (const [id, key] of Object.entries(labels)) $('#' + id).attr('aria-label', text(key));
+        root().find('textarea:not([aria-label])').each(function () { if (!this.labels?.length) $(this).attr('aria-label', this.title || this.placeholder); });
+    });
+    return {text, reset, setType, populate, refresh, summary, validate, showStep, setBusy, showError,
+        isBusy: () => busy, isBlocked: () => busy || failed, next: () => { if (validate(step)) showStep(step + 1, true); }, back: () => showStep(step - 1, true)};
+})();
diff --git a/app/static/js/rmon/smon.js b/app/static/js/rmon/smon.js
index 541b00b..3dc085d 100644
--- a/app/static/js/rmon/smon.js
+++ b/app/static/js/rmon/smon.js
@@ -79,54 +79,9 @@ function showSmon(action) {
 	window.location.reload();
 }
 function addNewSmonServer(dialog_id, smon_id=0, edit=false) {
-	let valid = true;
-	let check_type = $('#check_type').val();
-	let allFields = '';
-	let statusList = [];
-	if (check_type === 'tcp') {
-		allFields = $([]).add($('#new-smon-ip')).add($('#new-smon-port')).add($('#new-smon-name')).add($('#new-smon-interval')).add($('#new-smon-timeout'))
-		allFields.removeClass("ui-state-error");
-		valid = valid && checkLength($('#new-smon-port'), "Port", 1);
-		valid = valid && checkLength($('#new-smon-ip'), "Hostname", 1);
-	}
-	if (check_type === 'http') {
-		allFields = $([]).add($('#new-smon-url')).add($('#new-smon-name')).add($('#new-smon-interval')).add($('#new-smon-timeout'))
-		allFields.removeClass("ui-state-error");
-		valid = valid && checkLength($('#new-smon-url'), "URL", 1);
-		statusList = window.tagify.value.map(tag => tag.value);
-	}
-	if (check_type === 'ping') {
-		allFields = $([]).add($('#new-smon-ip')).add($('#new-smon-name')).add($('#new-smon-packet_size')).add($('#new-smon-count_packets')).add($('#new-smon-interval')).add($('#new-smon-timeout'))
-		allFields.removeClass("ui-state-error");
-		valid = valid && checkLength($('#new-smon-ip'), "Hostname", 1);
-	}
-	if (check_type === 'dns') {
-		allFields = $([]).add($('#new-smon-ip')).add($('#new-smon-port')).add($('#new-smon-name')).add($('#new-smon-resolver-server')).add($('#new-smon-interval')).add($('#new-smon-timeout'))
-		allFields.removeClass("ui-state-error");
-		valid = valid && checkLength($('#new-smon-port'), "Port", 1);
-		valid = valid && checkLength($('#new-smon-resolver-server'), "Resolver server", 1);
-		valid = valid && checkLength($('#new-smon-ip'), "Hostname", 1);
-	}
-	if (check_type === 'smtp') {
-		allFields = $([]).add($('#new-smon-ip')).add($('#new-smon-port')).add($('#new-smon-name')).add($('#new-smon-username')).add($('#new-smon-password')).add($('#new-smon-interval')).add($('#new-smon-timeout'))
-		allFields.removeClass("ui-state-error");
-		valid = valid && checkLength($('#new-smon-port'), "Port", 1);
-		valid = valid && checkLength($('#new-smon-username'), "Username", 1);
-		valid = valid && checkLength($('#new-smon-password'), "Password", 1);
-		valid = valid && checkLength($('#new-smon-ip'), "Hostname", 1);
-	}
-	if (check_type === 'rabbit') {
-		allFields = $([]).add($('#new-smon-ip')).add($('#new-smon-port')).add($('#new-smon-name')).add($('#new-smon-username')).add($('#new-smon-password')).add($('#new-smon-vhost')).add($('#new-smon-interval')).add($('#new-smon-timeout'))
-		allFields.removeClass("ui-state-error");
-		valid = valid && checkLength($('#new-smon-port'), "Port", 1);
-		valid = valid && checkLength($('#new-smon-username'), "Username", 1);
-		valid = valid && checkLength($('#new-smon-password'), "Password", 1);
-		valid = valid && checkLength($('#new-smon-vhost'), "VHost", 1);
-		valid = valid && checkLength($('#new-smon-ip'), "Hostname", 1);
-	}
-	valid = valid && checkLength($('#new-smon-name'), "Name", 1);
-	valid = valid && checkLength($('#new-smon-interval'), "Check interval", 1);
-	valid = valid && checkLength($('#new-smon-timeout'), "Timeout", 1);
+	if (CheckEditor.isBlocked() || !CheckEditor.validate()) return false;
+	const check_type = $('#check_type').val();
+	const statusList = check_type === 'http' ? window.tagify.value.map(tag => tag.value) : [];
 	let enable = 0;
 	if ($('#new-smon-enable').is(':checked')) {
 		enable = '1';
@@ -148,12 +103,6 @@ function addNewSmonServer(dialog_id, smon_id=0, edit=false) {
 		let entity_id = elem.id.split('-')[1]
 		entities.push(entity_id);
 	});
-	if ($('#new-smon-place option:selected').val() !== 'all') {
-		if (entities.length === 0) {
-			toastr.warning('Check must have at least one entity');
-			return false;
-		}
-	}
 	let auth = null;
 	if ($('#smon_http_check_auth_method').val() === 'basic') {
 		auth = {'basic':{
@@ -245,6 +194,7 @@ function addNewSmonServer(dialog_id, smon_id=0, edit=false) {
 		'proxy': proxy,
 		'headers_response': headers_response,
 		'http_version': parseInt($('#new-smon-http_version').val()),
+		'ssl_policy': $('#new-smon-ssl_policy').val() || 'default',
 	}
 	let method = "post";
 	let api_url = api_v_prefix + '/rmon/check/' + check_type;
@@ -252,26 +202,20 @@ function addNewSmonServer(dialog_id, smon_id=0, edit=false) {
 		method = "put";
 		api_url = api_v_prefix + '/rmon/check/' + check_type + "/" + smon_id;
 	}
-	if (valid) {
-		$.ajax( {
-			url: api_url,
-            data: JSON.stringify(jsonData),
-            contentType: "application/json; charset=utf-8",
-			type: method,
-			success: function( data ) {
-				if (data.status === 'failed') {
-					toastr.error(data);
-				} else {
-					let check_id = check_types[check_type];
-					if (edit) {
-						getSmonCheck(smon_id, check_id, dialog_id);
-					} else {
-						getSmonCheck(data.id, check_id, dialog_id, true);
-					}
-				}
-			}
-		} );
-	}
+    CheckEditor.setBusy(true);
+    return $.ajax({
+        url: api_url, data: JSON.stringify(jsonData),
+        contentType: "application/json; charset=utf-8", type: method,
+        error: function () { CheckEditor.showError(CheckEditor.text('save_error')); },
+        success: function (data) {
+            if (data.status === 'failed') {
+                CheckEditor.showError(CheckEditor.text('save_error'));
+            } else {
+                CheckEditor.setBusy(false);
+                getSmonCheck(edit ? smon_id : data.id, check_types[check_type], dialog_id, !edit);
+            }
+        }
+    });
 }
 function confirmDeleteSmon(id, check_type) {
 	$( "#dialog-confirm" ).dialog({
@@ -312,266 +256,68 @@ function removeSmon(smon_id, check_type) {
 	});
 }
 function openSmonDialog(check_type, smon_id=0, edit=false) {
-	check_and_clear_check_type(check_type);
-	$('#checked-entities').empty();
-	$('#all-entities').empty();
-	$('#new-smon-place').val('all').change();
-	$('#new-smon-place').selectmenu('refresh');
-	let smon_add_tabel_title = $("#smon-add-table-overview").attr('title');
-	if (edit) {
-		add_word = $('#translate').attr('data-edit');
-		smon_add_tabel_title = $("#smon-add-table-overview").attr('data-edit');
-		$('#check_type').attr('disabled', 'disabled');
-		$('#new-smon-place').attr('disabled', 'disabled');
-		$('#check_type').selectmenu("refresh");
-		$('#new-smon-place').selectmenu("refresh");
-	} else {
-		if (!checkChecksLimit()) {
-			return false;
-		}
-		$('#check_type').removeAttr('disabled');
-		$('#new-smon-place').removeAttr('disabled');
-		$('#check_type').selectmenu("refresh");
-		$('#new-smon-place').selectmenu("refresh");
-		$('#new-smon-name').val('');
-	}
-	let addSmonServer = $("#smon-add-table").dialog({
-		autoOpen: false,
-		resizable: false,
-		height: "auto",
-		width: 1225,
-		modal: true,
-		title: smon_add_tabel_title,
-		show: {
-			effect: "fade",
-			duration: 200
-		},
-		hide: {
-			effect: "fade",
-			duration: 200
-		},
-		open: function () {
-			const input = document.querySelector('#new-smon-status-code')
-
-			if (input && !input._tagify) { // предотвращаем повторную инициализацию
-				const allStatusCodes = []
-				allStatusCodes.push("1**", "2**", "3**", "4**", "5**", "100-199", "200-299", "300-399", "400-499", "500-599")
-				for (let i = 100; i <= 599; i++) allStatusCodes.push(i.toString())
-
-				window.tagify = new Tagify(input, {
-					whitelist: allStatusCodes,
-					duplicates: false,
-					enforceWhitelist: true,
-					dropdown: {
-						enabled: 1,
-						maxItems: 15
-					},
-				});
-				if (!edit) {
-					window.tagify.addTags(["200"]);
-				}
-			}
-		},
-		close: function () {
-			if (window.tagify) {
-				window.tagify.removeAllTags();
-			}
-		},
-		buttons: [{
-			text: add_word,
-			click: function () {
-				if (edit) {
-					addNewSmonServer(this, smon_id, check_type);
-				} else {
-					addNewSmonServer(this);
-				}
-			}
-		}, {
-			text: cancel_word,
-			click: function () {
-				$(this).dialog("close");
-				clearTips();
-			}
-		}]
-	});
-	addSmonServer.dialog('open');
+    if (!edit && !checkChecksLimit()) return false;
+    CheckEditor.reset(check_type);
+    $('#check_type, #new-smon-place').prop('disabled', edit);
+    CheckEditor.refresh();
+    const dialog = $('#smon-add-table').dialog({
+        autoOpen: false, resizable: false, height: "auto", width: 940, modal: true,
+        title: CheckEditor.text(edit ? 'edit' : 'create'),
+        show: {effect: "fade", duration: 150}, hide: {effect: "fade", duration: 150},
+        beforeClose: function () { return !CheckEditor.isBusy(); },
+        open: function () {
+            const input = document.querySelector('#new-smon-status-code');
+            if (input && !input._tagify) {
+                const codes = ["1**", "2**", "3**", "4**", "5**", "100-199", "200-299", "300-399", "400-499", "500-599"];
+                for (let i = 100; i <= 599; i++) codes.push(String(i));
+                window.tagify = new Tagify(input, {whitelist: codes, duplicates: false,
+                    // The API accepts arbitrary valid ranges such as 300-304.
+                    enforceWhitelist: false, pattern: /^(?:[1-5][0-9]{2}|[1-5]\*\*|[1-5][0-9]{2}-[1-5][0-9]{2})$/,
+                    dropdown: {enabled: 1, maxItems: 15}});
+            }
+            if (!edit) window.tagify.addTags(["200"]);
+            CheckEditor.refresh();
+            CheckEditor.showStep(0);
+        },
+        close: function () { if (window.tagify) window.tagify.removeAllTags(); },
+        buttons: [
+            {id: 'check-editor-back', text: CheckEditor.text('back'), click: CheckEditor.back},
+            {id: 'check-editor-next', text: CheckEditor.text('next'), click: CheckEditor.next},
+            {id: 'check-editor-submit', text: CheckEditor.text(edit ? 'save' : 'create'),
+                click: function () { addNewSmonServer(this, smon_id, edit); }},
+            {id: 'check-editor-cancel', text: cancel_word, click: function () { $(this).dialog('close'); }}
+        ]
+    });
+    dialog.dialog('open');
+    if (!edit && !window.tagify.value.length) window.tagify.addTags(["200"]);
+    CheckEditor.showStep(0);
+    return dialog;
 }
-function getCheckSettings(smon_id, check_type) {
-	$.ajax({
-		url: api_v_prefix + "/rmon/check/" + check_type + "/" + smon_id,
-		type: "get",
-		async: false,
-		dataType: "json",
-		success: function (data) {
-			$('#new-smon-name').val(data['name'].replaceAll("'", ""));
-			$('#new-smon-ip').val(data['checks'][0]['ip']);
-			$('#new-smon-port').val(data['checks'][0]['port']);
-			$('#new-smon-resolver-server').val(data['checks'][0]['resolver']);
-			$('#new-smon-dns_record_typer').val(data['checks'][0]['record_type']);
-			$('#new-smon-url').val(data['checks'][0]['url']);
-			$('#new-smon-resole_to_ip').val(data['checks'][0]['resole_to_ip']);
-			$('#new-smon-description').val(data['description'].replaceAll("'", ""))
-			$('#new-smon-packet_size').val(data['checks'][0]['packet_size']);
-			$('#new-smon-count_packets').val(data['checks'][0]['count_packets']);
-			$('#new-smon-interval').val(data['checks'][0]['interval']);
-			$('#new-smon-username').val(data['checks'][0]['username']);
-			$('#new-smon-password').val(data['checks'][0]['password']);
-			$('#new-smon-retries').val(data['retries']);
-			$('#new-smon-redirects').val(data['redirects']);
-			$('#new-smon-runbook').val(data['runbook']);
-			$('#new-smon-priority').val(data['priority']);
-			$('#new-smon-expiration').val(data['expiration']);
-			$('#new-smon-threshold_timeout').val(data['threshold_timeout']);
-			if (data['check_group']) {
-				$('#new-smon-group').val(data['check_group'].replaceAll("'", ""));
-			}
-			if (data['checks'][0]['smon_id']['check_timeout']) {
-				$('#new-smon-timeout').val(data['checks'][0]['smon_id']['check_timeout']);
-			}
-			try {
-				$('#new-smon-body-req').val(data['checks'][0]['body_req'].replaceAll("'", ""));
-			} catch (e) {
-				$('#new-smon-body-req').val(data['checks'][0]['body_req']);
-			}
-			try {
-				$('#new-smon-header-req').val(data['checks'][0]['headers'].replaceAll("'", ""));
-			} catch (e) {
-				$('#new-smon-header-req').val(data['checks'][0]['headers']);
-			}
-			window.tagify.addTags(data['checks'][0]['accepted_status_codes']);
-			$('#new-smon-place').val(data['place']).change();
-			$('#new-smon-telegram').selectmenu("refresh");
-			$('#new-smon-place').trigger('selectmenuchange');
-			$('#new-smon-slack').selectmenu("refresh");
-			if (data['place'] != 'all') {
-				for (let entity_id of data['entities']) {
-					getEntityJson(entity_id, data['place']);
-				}
-			}
-			if (data['body']) {
-				$('#new-smon-body-keyword').val(data['body'].replaceAll("'", ""));
-				$('#smon_http_check_body_type').val('keyword').change();
-				$('#smon_http_check_body_type').selectmenu("refresh");
-				$('.smon_http_check_body_type_keyword').show();
-				$('.smon_http_check_body_type_json').hide();
-			}
-			if (data['body_json']) {
-				$('#new-smon-body-json-path').val(data['body_json']['path']);
-				$('#new-smon-body-json-value').val(data['body_json']['value']);
-				$('#smon_http_check_body_type').val('json').change();
-				$('#smon_http_check_body_type').selectmenu("refresh");
-				$('.smon_http_check_body_type_keyword').hide();
-				$('.smon_http_check_body_type_json').show();
-			}
-			if (data['checks'][0]['smon_id']['email_channel_id']) {
-				$('#new-smon-email').val(data['checks'][0]['smon_id']['email_channel_id']).change();
-				$('#new-smon-email').selectmenu("refresh");
-			}
-			if (data['checks'][0]['smon_id']['mm_channel_id']) {
-				$('#new-smon-mm').val(data['checks'][0]['smon_id']['mm_channel_id']).change();
-				$('#new-smon-mm').selectmenu("refresh");
-			}
-			if (data['checks'][0]['smon_id']['incidentrelay_channel_id']) {
-				$('#new-smon-incidentrelay').val(data['checks'][0]['smon_id']['incidentrelay_channel_id']).change();
-				$('#new-smon-incidentrelay').selectmenu("refresh");
-			}
-			if (data['checks'][0]['smon_id']['pd_channel_id']) {
-				$('#new-smon-pd').val(data['checks'][0]['smon_id']['pd_channel_id']).change();
-				$('#new-smon-mm').selectmenu("refresh");
-			}
-			if (data['checks'][0]['smon_id']['telegram_channel_id']) {
-				$('#new-smon-telegram').val(data['checks'][0]['smon_id']['telegram_channel_id']).change();
-				$('#new-smon-mm').selectmenu("refresh");
-			}
-			if (data['checks'][0]['smon_id']['slack_channel_id']) {
-				$('#new-smon-slack').val(data['checks'][0]['smon_id']['slack_channel_id']).change();
-				$('#new-smon-mm').selectmenu("refresh");
-			}
-			if (data['checks'][0]['method']) {
-				$('#new-smon-method').val(data['checks'][0]['method']).change();
-				$('#new-smon-method').selectmenu("refresh");
-			}
-			if (data['checks'][0]['http_version']) {
-				$('#new-smon-http_version').val(data['checks'][0]['http_version']).change();
-				$('#new-smon-http_version').selectmenu("refresh");
-			}
-			$('select').selectmenu("refresh");
-			if (data['checks'][0]['smon_id']['enabled']) {
-				$('#new-smon-enable').prop('checked', true)
-			} else {
-				$('#new-smon-enable').prop('checked', false)
-			}
-			if (data['checks'][0]['ignore_ssl_error']) {
-				$('#new-smon-ignore_ssl_error').prop('checked', true)
-			} else {
-				$('#new-smon-ignore_ssl_error').prop('checked', false)
-			}
-			if (data['checks'][0]['accept_cookies']) {
-				$('#new-smon-accept_cookies').prop('checked', true)
-			} else {
-				$('#new-smon-accept_cookies').prop('checked', false)
-			}
-			if (data['checks'][0]['use_kernel_timestamp']) {
-				$('#new-smon-use_kernel_timestamp').prop('checked', true)
-			} else {
-				$('#new-smon-use_kernel_timestamp').prop('checked', false)
-			}
-			if (data['checks'][0]['auth']) {
-				if (data['checks'][0]['auth'].hasOwnProperty('basic')) {
-					$('#new-smon-basic_username').val(data['checks'][0]['auth']['basic']['username']);
-					$('#new-smon-basic_password').val(data['checks'][0]['auth']['basic']['password']);
-					$('#smon_http_check_auth_method').val('basic');
-					$('#smon_http_check_basic').show();
-				} else if (data['checks'][0]['auth'].hasOwnProperty('mtls')) {
-					$('#new-smon-mtls_key').val(data['checks'][0]['auth']['mtls']['key']);
-					$('#new-smon-mtls_cert').val(data['checks'][0]['auth']['mtls']['cert']);
-					$('#new-smon-mtls_ca').val(data['checks'][0]['auth']['mtls']['ca']);
-					$('#smon_http_check_auth_method').val('mtls');
-					$('.smon_http_check_mtls').show();
-				}
-				$('#smon_http_check_auth_method').selectmenu("refresh");
-			}
-			$('#new-smon-enable').checkboxradio("refresh");
-			$('#new-smon-ignore_ssl_error').checkboxradio("refresh");
-			$('#new-smon-accept_cookies').checkboxradio("refresh");
-			$('#new-smon-use_kernel_timestamp').checkboxradio("refresh");
-			if (data['checks'][0]['proxy']) {
-				$('#smon_http_check_proxy_method').val(data['checks'][0]['proxy']['type']);
-				$('.smon_http_check_proxy').show();
-				$('#new-smon-http_proxy_host').val(data['checks'][0]['proxy']['host']);
-				$('#new-smon-http_proxy_port').val(data['checks'][0]['proxy']['port']);
-				$('#new-smon-http_proxy_username').val(data['checks'][0]['proxy']['username']);
-				$('#new-smon-http_proxy_password').val(data['checks'][0]['proxy']['password']);
-			} else {
-				$('#smon_http_check_proxy_method').val('0');
-				$('.smon_http_check_proxy').hide();
-			}
-			if (data['checks'][0]['headers_response']) {
-				$('#smon_http_check_headers_response_type').val('check');
-				$('#new-smon-headers-response').show();
-				$('#new-smon-header-response-forbidden').val(data['checks'][0]['headers_response']['forbidden_headers'].map(h => `"${h}"`).join(",\n "));
-				if (data['checks'][0]['headers_response']['required_response_headers']) {
-					$('#new-smon-header-response-required').val(JSON.stringify(data['checks'][0]['headers_response']['required_response_headers'], null, 2));
-				}
-			} else {
-				$('#smon_http_check_headers_response_type').val('0');
-				$('#new-smon-headers-response').hide();
-			}
-			$('#smon_http_check_proxy_method').selectmenu("refresh");
-			$('#smon_http_check_headers_response_type').selectmenu("refresh");
-		}
-	});
+function getCheckSettings(smon_id, check_type, onLoaded) {
+    CheckEditor.setBusy(true, true);
+    return $.ajax({
+        url: api_v_prefix + "/rmon/check/" + check_type + "/" + smon_id,
+        type: "get", dataType: "json", timeout: 15000,
+        error: function () { CheckEditor.showError(CheckEditor.text('load_error'), true); },
+        success: function (data) {
+            try {
+                CheckEditor.populate(data);
+                CheckEditor.setBusy(false);
+                if (onLoaded) onLoaded();
+            } catch (_) { CheckEditor.showError(CheckEditor.text('load_error'), true); }
+        }
+    });
 }
 function editSmon(smon_id, check_type) {
-	check_and_clear_check_type(check_type);
-	openSmonDialog(check_type, smon_id, true);
-	getCheckSettings(smon_id, check_type);
-
+    openSmonDialog(check_type, smon_id, true);
+    return getCheckSettings(smon_id, check_type);
 }
 function cloneSmon(id, check_type) {
-	check_and_clear_check_type(check_type);
-	getCheckSettings(id, check_type);
-	openSmonDialog(check_type);
+    if (!openSmonDialog(check_type)) return false;
+    return getCheckSettings(id, check_type, function () {
+        $('#new-smon-name').val($('#new-smon-name').val() + ' (' + CheckEditor.text('copy') + ')');
+        CheckEditor.summary();
+    });
 }
 function getSmonCheck(smon_id, check_id, dialog_id, new_check=false) {
 	$.ajax({
@@ -592,109 +338,7 @@ function getSmonCheck(smon_id, check_id, dialog_id, new_check=false) {
 	$(dialog_id).dialog("close");
 }
 function check_and_clear_check_type(check_type) {
-	$("#check_type").val(check_type);
-	$('#check_type').selectmenu("refresh");
-	if (check_type === 'http') {
-		$('.new_smon_hostname').hide();
-		$('.smon_tcp_check').hide();
-		$('.smon_ping_check').hide();
-		$('.smon_dns_check').hide();
-		$('.smon_smtp_check').hide();
-		$('.smon_rabbit_check').hide();
-		clear_check_vals();
-		hideAuthFields();
-		$("#new-smon-body-keyword").val('');
-		$("#new-smon-body-json-path").val('');
-		$("#new-smon-body-json-value").val('');
-		$("#smon_http_check_body_type").val('0');
-		$('#smon_http_check_body_type').selectmenu("refresh");
-		$("#smon_http_check_auth_method").val('0');
-		$('#smon_http_check_auth_method').selectmenu("refresh");
-		$("#smon_http_check_headers_response_type").val('0');
-		$('#smon_http_check_headers_response_type').selectmenu("refresh");
-		$('.smon_http_check').show();
-		$('.smon_http_check_proxy').hide();
-		$('.smon_http_check_body_type_keyword').hide();
-		$('.smon_http_check_body_type_json').hide();
-		$('#new-smon-headers-response').hide();
-	} else if (check_type === 'tcp') {
-		$('.new_smon_hostname').show();
-		$('.smon_http_check').hide();
-		$('.smon_dns_check').hide();
-		$('.smon_ping_check').hide();
-		$('.smon_smtp_check').hide();
-		$('.smon_rabbit_check').hide();
-		$('.smon_http_check_proxy').hide();
-		clear_check_vals();
-		hideAuthFields();
-		$('.smon_tcp_check').show();
-	} else if (check_type === 'dns') {
-		$('.new_smon_hostname').show();
-		$('.smon_tcp_check').hide();
-		$('.smon_http_check').hide();
-		$('.smon_ping_check').hide();
-		$('.smon_smtp_check').hide();
-		$('.smon_rabbit_check').hide();
-		$('.smon_http_check_proxy').hide();
-		clear_check_vals();
-		hideAuthFields();
-		$('#new-smon-port').val('53');
-		$('.smon_dns_check').show();
-	} else if (check_type === 'smtp') {
-		$('.new_smon_hostname').show();
-		$('.smon_tcp_check').hide();
-		$('.smon_http_check').hide();
-		$('.smon_ping_check').hide();
-		$('.smon_dns_check').hide();
-		$('.smon_rabbit_check').hide();
-		$('.smon_http_check_proxy').hide();
-		clear_check_vals();
-		hideAuthFields();
-		$('#new-smon-port').val('587');
-		$('#new-smon-username').attr('placeholder', 'examplte@example.com');
-		$('.smon_smtp_check').show();
-	} else if (check_type === 'rabbitmq') {
-		$('.new_smon_hostname').show();
-		$('.smon_tcp_check').hide();
-		$('.smon_http_check').hide();
-		$('.smon_ping_check').hide();
-		$('.smon_dns_check').hide();
-		$('.smon_smtp_check').hide();
-		$('.smon_http_check_proxy').hide();
-		clear_check_vals();
-		hideAuthFields();
-		$('#new-smon-port').val('5672');
-		$('#new-smon-vhost').val('/');
-		$('#new-smon-username').attr('placeholder', 'guest');
-		$('.smon_rabbit_check').show();
-	} else {
-		$('.new_smon_hostname').show();
-		$('.smon_http_check').hide();
-		$('.smon_tcp_check').hide();
-		$('.smon_dns_check').hide();
-		$('.smon_smtp_check').hide();
-		$('.smon_rabbit_check').hide();
-		$('.smon_http_check_proxy').hide();
-		clear_check_vals();
-		hideAuthFields();
-		$('#new-smon-packet_size').val('56');
-		$('#new-smon-count_packets').val('4');
-		$('.smon_ping_check').show();
-	}
-}
-function clear_check_vals() {
-	const inputs_for_clean = ['url', 'body', 'body-req', 'port', 'packet_size', 'ip', 'header-req', 'username',
-		'password', 'vhost', 'group', 'description', 'runbook', 'expiration', 'count_packets', 'new-smon-mtls_key',
-		'new-smon-mtls_cert', 'new-smon-mtls_ca', 'new-smon-basic_username', 'new-smon-basic_password', 'http_proxy_host',
-		'http_proxy_port', 'http_proxy_username', 'http_proxy_password', 'use_kernel_timestamp', 'resole_to_ip'
-	]
-	for (let i of inputs_for_clean) {
-		$('#new-smon-' + i).val('');
-	}
-}
-function hideAuthFields() {
-	$('.smon_http_check_mtls').hide();
-	$('.smon_http_check_basic').hide();
+    CheckEditor.setType(check_type);
 }
 function show_smon_history_statuses(check_id, id_for_history_replace) {
 	$.ajax({
diff --git a/app/static/js/rmon/status_page.js b/app/static/js/rmon/status_page.js
index 4c13edc..34abbf1 100644
--- a/app/static/js/rmon/status_page.js
+++ b/app/static/js/rmon/status_page.js
@@ -1,11 +1,29 @@
-function createStatusPageStep1(edited=false, page_id=0) {
-	clearStatusPageDialog();
+function updateStatusPagePreview() {
+    const preview = $('#status-page-url-preview');
+    preview.text(window.location.origin + preview.attr('data-prefix') + $('#new-status-page-slug').val());
+}
+$(function () {
+    $('#new-status-page-slug').attr('aria-describedby', 'status-page-slug-help status-page-url-preview')
+        .on('input', function () { $(this).data('manually-edited', true); updateStatusPagePreview(); });
+    $('#new-status-page-name').on('input', function () {
+        if (!$('#new-status-page-slug').data('manually-edited')) {
+            $('#new-status-page-slug').val($(this).val().toLowerCase().trim()
+                .normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[^a-z0-9_]+/g, '-').replace(/^-|-$/g, ''));
+            updateStatusPagePreview();
+        }
+    });
+});
+function createStatusPageStep1(edited=false, page_id=0, preserveDraft=false) {
+	if (!preserveDraft) clearStatusPageDialog();
 	let next_word = $('#translate').attr('data-next');
 	let smon_add_tabel_title = $("#create-status-page-step-1-overview").attr('title');
 	if (edited) {
 		smon_add_tabel_title = $("#create-status-page-step-1-overview").attr('data-edit');
+	}
+	if (edited && !preserveDraft) {
 		$('#new-status-page-name').val($('#page_name-' + page_id).text());
 		$('#new-status-page-slug').val($('#page_slug-' + page_id).text().split('/').pop());
+		$('#new-status-page-slug').data('manually-edited', true);
 		$('#new-status-page-desc').val($('#page_desc-' + page_id).text().replace('(', '').replace(')', ''));
 		$.ajax({
 			url: api_v_prefix + '/rmon/status-page/' + page_id + '?recurse=true',
@@ -43,19 +61,21 @@ function createStatusPageStep1(edited=false, page_id=0) {
 			text: next_word,
 			click: function () {
 				if ($('#new-status-page-name').val() == '') {
-					toastr.error('error: Fill in the Name field');
+					toastr.error(RmonUI.text('name_required'));
+                    $('#new-status-page-name').trigger('focus');
 					return false;
 				}
 				if (!regx.test($('#new-status-page-slug').val())) {
-					toastr.error('error: Incorrect Slug');
+					toastr.error(RmonUI.text('slug_invalid'));
+                    $('#new-status-page-slug').trigger('focus');
 					return false;
 				}
 				if ($('#new-status-page-slug').val().indexOf('--') != '-1') {
-					toastr.error('error: "--" are prohibeted in Slug');
+					toastr.error(RmonUI.text('slug_invalid'));
 					return false;
 				}
 				if ($('#new-status-page-slug').val() == '') {
-					toastr.error('error: Fill in the Slug field');
+					toastr.error(RmonUI.text('slug_invalid'));
 					return false;
 				}
 				createStatusPageStep2(edited, page_id);
@@ -70,6 +90,7 @@ function createStatusPageStep1(edited=false, page_id=0) {
 			}
 		}]
 	});
+	updateStatusPagePreview();
 	addSmonStatus.dialog('open');
 }
 function createStatusPageStep2(edited, page_id) {
@@ -106,7 +127,7 @@ function createStatusPageStep2(edited, page_id) {
 			text: back_word,
 			click: function () {
 				$(this).dialog("close");
-				createStatusPageStep1(edited, page_id);
+				createStatusPageStep1(edited, page_id, true);
 			}
 		}, {
 			text: cancel_word,
@@ -121,7 +142,7 @@ function createStatusPageStep2(edited, page_id) {
 function clearStatusPageDialog() {
 	clearTips();
 	$('#new-status-page-name').val('');
-	$('#new-status-page-slug').val('');
+	$('#new-status-page-slug').val('').data('manually-edited', false);
 	$('#new-status-page-desc').val('');
 	$('#new-status-page-style').val('');
 	$("#enabled-check > div").each((index, elem) => {
@@ -150,10 +171,12 @@ function createStatusPage(dialog_id) {
 						]),
 						elem("div", {"class":"page_slug","id":"page_slug-"+id}, "/rmon/status/"+json_data['slug'])
 					]),
-					elem("div", {"class":"edit status_page-edit","onclick":"createStatusPageStep1('true', '"+id+"')"}),
-					elem("div", {"class":"delete","onclick":"confirmDeleteStatusPage('"+id+"')"})
+					elem("button", {"type":"button","aria-label":RmonUI.text("edit"),"class":"edit status_page-edit icon-button","onclick":"createStatusPageStep1('true', '"+id+"')"}),
+					elem("button", {"type":"button","aria-label":RmonUI.text("delete"),"class":"delete icon-button","onclick":"confirmDeleteStatusPage('"+id+"')"})
 				])
 				$("#pages").append(new_page);
+                $("#status-pages-empty").prop("hidden", true);
+                clearStatusPageDialog();
 				smon_manage_status_page_avg_status(id);
 				$(dialog_id).dialog('close');
 				$.getScript("/static/js/fontawesome.min.js");
@@ -246,9 +269,11 @@ function deleteStatusPage(page_id) {
 		statusCode: {
 			204: function (xhr) {
 				$("#page_" + page_id).remove();
+                $("#status-pages-empty").prop("hidden", $("#pages .page_div").length > 0);
 			},
 			404: function (xhr) {
 				$("#page_" + page_id).remove();
+                $("#status-pages-empty").prop("hidden", $("#pages .page_div").length > 0);
 			}
 		},
 		success: function (data) {
diff --git a/app/static/js/script.js b/app/static/js/script.js
index 2328de8..bbb992a 100644
--- a/app/static/js/script.js
+++ b/app/static/js/script.js
@@ -46,9 +46,9 @@ $.ajaxSetup({
 	headers: {"X-CSRF-TOKEN": csrf_token},
 });
 $(document).ajaxError(function myErrorHandler(event, xhr, ajaxOptions, thrownError) {
-	if (xhr.status != 401 && xhr.status != 404) {
-		toastr.error(xhr.responseJSON.error);
-	}
+	if (xhr.statusText !== 'abort' && !ajaxOptions.error) {
+        RmonUI.notifyRequestError(xhr);
+    }
 
 });
 function showLog() {
@@ -171,9 +171,10 @@ $( function() {
 	});
 	toastr.options.closeButton = true;
 	toastr.options.progressBar = true;
-	toastr.options.positionClass = 'toast-bottom-full-width';
-	toastr.options.timeOut = 25000;
-	toastr.options.extendedTimeOut = 50000;
+	toastr.options.positionClass = 'toast-bottom-right';
+	toastr.options.timeOut = 8000;
+    toastr.options.preventDuplicates = true;
+	toastr.options.extendedTimeOut = 2000;
 	$('#errorMess').click(function () {
 		$('#error').remove();
 	});
@@ -198,45 +199,7 @@ $( function() {
 	$("input[type=checkbox]").checkboxradio();
 	$(".controlgroup").controlgroup();
 
-	$("#hide_menu").click(function () {
-		$(".top-menu").hide("drop", "fast");
-		$(".container").css("max-width", "100%");
-		$(".footer").css("max-width", "97%");
-		$(".container").css("margin-left", "1%");
-		$(".footer").css("margin-left", "1%");
-		$(".show_menu").show();
-		$("#hide_menu").hide();
-		sessionStorage.setItem('hide_menu', 'hide');
-	});
-	$("#show_menu").click(function () {
-		$(".top-menu").show("drop", "fast");
-		$(".container").css("max-width", "100%");
-		$(".footer").css("max-width", "100%");
-		$(".container").css("margin-left", "207px");
-		$(".footer").css("margin-left", "207px");
-		$(".show_menu").hide();
-		$("#hide_menu").show();
-		sessionStorage.setItem('hide_menu', 'show');
-	});
-	var hideMenu = sessionStorage.getItem('hide_menu');
-	if (hideMenu === "show") {
-		$(".top-menu").show("drop", "fast");
-		$(".container").css("max-width", "100%");
-		$(".container").css("margin-left", "207px");
-		$(".footer").css("margin-left", "207px");
-		$(".footer").css("max-width", "100%");
-		$("#hide_menu").show();
-		$(".show_menu").hide();
-	}
-	if (hideMenu === "hide") {
-		$(".top-menu").hide();
-		$(".container").css("max-width", "97%");
-		$(".container").css("margin-left", "1%");
-		$(".footer").css("margin-left", "1%");
-		$(".footer").css("max-width", "97%");
-		$(".show_menu").show();
-		$("#hide_menu").hide();
-	}
+    RmonUI.initNavigation();
 
 	var now = new Date(Date.now());
 	if ($('#time_range_out_hour').val() != '' && $('#time_range_out_hour').val() != 'None') {
@@ -319,29 +282,18 @@ $( function() {
 			data: JSON.stringify(json_data),
 			contentType: "application/json; charset=utf-8",
 			type: "POST",
-			statusCode: {
-				401: function (xhr) {
-					$('.alert').show();
-					if (xhr.responseText.indexOf('disabled') != '-1') {
-						$('.alert').html('Your login is disabled')
-					} else {
-						$('.alert').html('Login or password is incorrect');
-						ban();
-					}
-				}
-			},
-			success: function (data) {
+			error: function (xhr) {
+                $('#wrong-login').show();
+                $('#login-error-message').text(xhr.status === 401 ? RmonUI.text('login_failed') : RmonUI.requestError(xhr));
+                if (xhr.status === 401) { ban(); }
+            },
+            success: function (data) {
 				if (data.status === 'failed') {
-					if (data.error.indexOf('disabled') != '-1') {
-						$('.alert').show();
-						$('.alert').html(data.error);
-					} else {
-						$('.alert').show();
-						$('.alert').html(data.error);
-						ban();
-					}
-				} else {
-					sessionStorage.removeItem('check-service');
+                    $('#wrong-login').show();
+                    $('#login-error-message').text(RmonUI.text('login_failed'));
+                    ban();
+                } else {
+                    sessionStorage.removeItem('check-service');
 					window.location.replace(data.next_url);
 				}
 			}
@@ -458,11 +410,6 @@ $( function() {
 	})
 });
 function saveUserSettings(user_id){
-	if ($('#disable_alerting').is(':checked')) {
-		localStorage.removeItem('disabled_alert');
-	} else {
-		localStorage.setItem('disabled_alert', '1');
-	}
 	changeCurrentGroupF(user_id);
 	changeTheme($('#theme_select').val());
 	Cookies.set('lang', $('#lang_select').val(), { expires: 365, path: '/', samesite: 'strict', secure: 'true' });
@@ -486,7 +433,7 @@ checkTheme();
 async function ban() {
 	$( '#login').attr('disabled', 'disabled');
 	$( '#pass').attr('disabled', 'disabled');
-	$( "input[type=submit], button" ).button('disable');
+	$('#enter').button('disable');
 	$('#wrong-login').show();
 	$('#ban_10').show();
 	$( '#ban_timer').text(10);
@@ -500,7 +447,7 @@ async function ban() {
 
 	$( '#login').removeAttr('disabled');
 	$( '#pass').removeAttr('disabled');
-	$( "input[type=submit], button" ).button('enable');
+	$('#enter').button('enable');
 	$('#ban_10').hide();
 }
 function changeCurrentGroupF(user_id) {
@@ -538,77 +485,6 @@ function checkLength( o, n, min ) {
 		return true;
 	}
 }
-$(function () {
-	ion.sound({
-		sounds: [
-			{
-				name: "bell_ring",
-			},
-			{
-				name: "glass",
-				volume: 1,
-			},
-			{
-				name: "alert_sound",
-				volume: 0.3,
-				preload: false
-			}
-		],
-		volume: 0.5,
-		path: "/static/js/sounds/",
-		preload: true
-	});
-});
-let socket = new ReconnectingWebSocket("wss://" + window.location.host, null, {maxReconnectAttempts: 20, reconnectInterval: 3000});
-
-socket.onopen = function(e) {
-  console.log("[open] Connection is established with " + window.location.host);
-  getAlerts();
-};
-
-function getAlerts() {
-	socket.send("alert_group " + $('#user_group_socket').val() + " " + $('#user_id_socket').val());
-}
-
-socket.onmessage = function(event) {
-	let cur_url = window.location.href.split('/').pop();
-	cur_url = cur_url.split('/');
-	if (cur_url != 'login' && localStorage.getItem('disabled_alert') === null) {
-		let data = event.data.split(";");
-		for (let i = 0; i < data.length; i++) {
-			if (data[i].indexOf('warning: ') != '-1') {
-				toastr.warning(data[i]);
-				ion.sound.play("bell_ring");
-			} else if (data[i].indexOf('error:') != '-1' || data[i].indexOf('alert') != '-1' || data[i].indexOf('FAILED') != '-1') {
-				if (data[i].indexOf('error: database is locked') == '-1') {
-					toastr.error(data[i]);
-					ion.sound.play("bell_ring");
-				}
-			} else if (data[i].indexOf('info: ') != '-1') {
-				toastr.info(data[i]);
-				ion.sound.play("glass");
-			} else if (data[i].indexOf('success: ') != '-1') {
-				toastr.success(data[i]);
-				ion.sound.play("glass");
-			} else if (data[i].indexOf('critical: ') != '-1') {
-				toastr.error(data[i]);
-				ion.sound.play("bell_ring");
-			}
-		}
-	}
-};
-
-socket.onclose = function(event) {
-  if (event.wasClean) {
-    console.log(`[close] Соединение закрыто чисто, код=${event.code} причина=${event.reason}`);
-  } else {
-    console.log('[close] Соединение прервано');
-  }
-};
-
-socket.onerror = function(error) {
-  console.log(`[error] ${error.message}`);
-};
 function changePassword() {
 	$("#user-change-password-table").dialog({
 		autoOpen: true,
@@ -664,6 +540,8 @@ function show_version() {
 	NProgress.configure({showSpinner: false});
 	$.ajax( {
 		url: "/internal/show_version",
+        global: false,
+        error: function () { $("#version").text("RMON"); },
 		contentType: "application/json; charset=utf-8",
 		success: function( data ) {
 			if (data.need_update) {
@@ -690,13 +568,17 @@ function show_version() {
 	} );
 	NProgress.configure({showSpinner: true});
 }
-function showPassword(input) {
+function showPassword(input, button) {
   let x = document.getElementById(input);
   if (x.type === "password") {
     x.type = "text";
   } else {
     x.type = "password";
   }
+  if (button) {
+    button.setAttribute('aria-pressed', String(x.type === 'text'));
+    button.setAttribute('aria-label', RmonUI.text(x.type === 'text' ? 'hide_password' : 'show_password'));
+  }
 }
 function removeData() {
     let chart;
@@ -707,10 +589,9 @@ function removeData() {
 }
 function common_ajax_action_after_success(dialog_id, new_group, ajax_append_id, data) {
 	toastr.clear();
-	$("#"+ajax_append_id).append(data);
+	RmonUI.addTableRows("#"+ajax_append_id, data);
 	$( "."+new_group ).addClass( "update", 1000);
 	$.getScript(awesome);
-	$.getScript('/static/js/users.js');
 	clearTips();
 	$( dialog_id ).dialog("close" );
 	setTimeout(function() {
@@ -718,11 +599,6 @@ function common_ajax_action_after_success(dialog_id, new_group, ajax_append_id,
 	}, 2500 );
 }
 function openUserSettings(user_id) {
-	if (localStorage.getItem('disabled_alert') == '1') {
-		$('#disable_alerting').prop('checked', false).checkboxradio('refresh');
-	} else {
-		$('#disable_alerting').prop('checked', true).checkboxradio('refresh');
-	}
 	let theme = 'light';
 	if (localStorage.getItem('theme') != null) {
 		theme = localStorage.getItem('theme');
diff --git a/app/static/js/sounds/bell_ring.aac b/app/static/js/sounds/bell_ring.aac
deleted file mode 100644
index 05dbe8f..0000000
Binary files a/app/static/js/sounds/bell_ring.aac and /dev/null differ
diff --git a/app/static/js/sounds/bell_ring.mp3 b/app/static/js/sounds/bell_ring.mp3
deleted file mode 100644
index f661881..0000000
Binary files a/app/static/js/sounds/bell_ring.mp3 and /dev/null differ
diff --git a/app/static/js/sounds/bell_ring.ogg b/app/static/js/sounds/bell_ring.ogg
deleted file mode 100644
index 9ac9876..0000000
Binary files a/app/static/js/sounds/bell_ring.ogg and /dev/null differ
diff --git a/app/static/js/sounds/glass.aac b/app/static/js/sounds/glass.aac
deleted file mode 100644
index f93060f..0000000
Binary files a/app/static/js/sounds/glass.aac and /dev/null differ
diff --git a/app/static/js/sounds/glass.mp3 b/app/static/js/sounds/glass.mp3
deleted file mode 100644
index e195690..0000000
Binary files a/app/static/js/sounds/glass.mp3 and /dev/null differ
diff --git a/app/static/js/sounds/glass.ogg b/app/static/js/sounds/glass.ogg
deleted file mode 100644
index 9dabb83..0000000
Binary files a/app/static/js/sounds/glass.ogg and /dev/null differ
diff --git a/app/static/js/users.js b/app/static/js/users.js
index 41361fc..73f86cf 100644
--- a/app/static/js/users.js
+++ b/app/static/js/users.js
@@ -34,7 +34,7 @@ $( function() {
 			}
 		}]
 	});
-	$( "#ajax-users input" ).change(function() {
+	$("#ajax-users").on('change', 'input', function() {
 		let id = $(this).attr('id').split('-');
 		if ($('#role-'+id + ' option:selected' ).val() === 'Select a role') {
 			toastr.warning(superAdmin_pass);
@@ -43,7 +43,7 @@ $( function() {
 			updateUser(id[1])
 		}
 	});
-	$( "#ajax-users select" ).on('selectmenuchange',function() {
+	$("#ajax-users").on('selectmenuchange', 'select', function() {
 		let id = $(this).attr('id').split('-');
 		if ($('#role-'+id + ' option:selected' ).val() === 'Select a role') {
 			toastr.warning(superAdmin_pass);
@@ -191,7 +191,7 @@ function removeUser(id) {
 					toastr.error(data.error);
 				}
 			} else {
-				$("#user-" + id).remove();
+				RmonUI.removeTableRow("#user-" + id);
 			}
 		}
 	});
diff --git a/app/static/js/ux.js b/app/static/js/ux.js
new file mode 100644
index 0000000..a423119
--- /dev/null
+++ b/app/static/js/ux.js
@@ -0,0 +1,271 @@
+/* Shared interaction helpers. Existing editor IDs and event handlers stay stable. */
+window.RmonUI = (function () {
+    'use strict';
+    const catalog = document.getElementById('rmon-ui-strings');
+    const strings = catalog ? JSON.parse(catalog.textContent) : {};
+    const text = key => strings[key] || key;
+    function requestError(xhr) {
+        const keys = {0: 'network_error', 400: 'validation_error', 401: 'unauthorized',
+            403: 'forbidden', 404: 'not_found', 409: 'conflict', 422: 'validation_error', 429: 'rate_limit'};
+        return text(xhr.status >= 500 ? 'server_error' : (keys[xhr.status] || 'request_error'));
+    }
+    function notifyRequestError(xhr) {
+        toastr.error(requestError(xhr));
+    }
+    function widgetState(target, state, retry) {
+        const host = $(target);
+        if (!host.length) return;
+        host.children('.widget-state, .widget-state-row').remove();
+        host.attr('aria-busy', String(state === 'loading'));
+        host.children('canvas').toggle(state === 'ready');
+        if (state === 'ready') return;
+        const message = $('<div>', {class: 'widget-state', role: 'status'});
+        $('<span>').text(text(state === 'loading' ? 'loading' : 'widget_error')).appendTo(message);
+        if (state === 'error' && retry) {
+            $('<button>', {type: 'button', class: 'retry-button'}).text(text('retry')).on('click', retry).appendTo(message);
+        }
+        if (host.is('tbody, tr, table')) {
+            const cell = $('<td>', {colspan: 20}).append(message);
+            if (host.is('tr')) host.empty().append(cell);
+            else host.empty().append($('<tr>', {class: 'widget-state-row'}).append(cell));
+        } else host.append(message);
+    }
+    function loadFragment(target, url) {
+        if (!$(target).length) return;
+        const retry = () => loadFragment(target, url);
+        return $.ajax({url, global: false, beforeSend: () => widgetState(target, 'loading'),
+            success: function (data) {
+                if (typeof data !== 'string' || /^\s*error:/i.test(data)) {
+                    widgetState(target, 'error', retry);
+                } else {
+                    $(target).attr('aria-busy', 'false').html(data);
+                    enhance(document);
+                }
+            }, error: () => widgetState(target, 'error', retry)});
+    }
+    function initNavigation() {
+        const nav = document.getElementById('main-navigation');
+        const toggle = document.getElementById('menu-toggle');
+        const backdrop = document.getElementById('menu-backdrop');
+        if (!nav || !toggle) return;
+        const mobile = window.matchMedia('(max-width: 800px)');
+        let desktopHidden = false;
+        try { desktopHidden = sessionStorage.getItem('hide_menu') === 'hide'; } catch (_) {}
+        function setOpen(open, focusMenu = false) {
+            document.body.classList.toggle('nav-collapsed', !mobile.matches && !open);
+            document.body.classList.toggle('nav-open', mobile.matches && open);
+            nav.inert = !open;
+            nav.setAttribute('aria-hidden', String(!open));
+            toggle.setAttribute('aria-expanded', String(open));
+            backdrop.hidden = !(mobile.matches && open);
+            $('#hide_menu').toggle(open);
+            $('.show_menu').toggle(!open);
+            if (focusMenu && open && mobile.matches) nav.querySelector('a').focus();
+        }
+        function close() { setOpen(false); toggle.focus(); }
+        toggle.addEventListener('click', () => {
+            const open = toggle.getAttribute('aria-expanded') !== 'true';
+            if (!mobile.matches) {
+                desktopHidden = !open;
+                try { sessionStorage.setItem('hide_menu', open ? 'show' : 'hide'); } catch (_) {}
+            }
+            setOpen(open, true);
+        });
+        backdrop.addEventListener('click', close);
+        nav.addEventListener('click', event => {
+            if (mobile.matches && event.target.closest('a')) close();
+        });
+        document.addEventListener('keydown', event => {
+            if (!mobile.matches || toggle.getAttribute('aria-expanded') !== 'true') return;
+            if (event.key === 'Escape') { event.preventDefault(); close(); }
+            if (event.key === 'Tab') {
+                const links = Array.from(nav.querySelectorAll('a')).filter(a => a.getClientRects().length);
+                if (event.shiftKey && document.activeElement === links[0]) { event.preventDefault(); toggle.focus(); }
+                else if (!event.shiftKey && document.activeElement === links[links.length - 1]) { event.preventDefault(); toggle.focus(); }
+                else if (document.activeElement === toggle) { event.preventDefault(); links[event.shiftKey ? links.length - 1 : 0].focus(); }
+            }
+        });
+        $('#hide_menu, #show_menu').on('click', function (event) {
+            event.preventDefault(); desktopHidden = this.id === 'hide_menu';
+            try { sessionStorage.setItem('hide_menu', desktopHidden ? 'hide' : 'show'); } catch (_) {}
+            setOpen(!desktopHidden);
+        });
+        mobile.addEventListener('change', () => setOpen(!mobile.matches && !desktopHidden));
+        setOpen(!mobile.matches && !desktopHidden);
+    }
+    function fitDialog(element) {
+        const content = $(element);
+        const dialog = content.dialog('widget');
+        const intended = content.dialog('option', 'width');
+        dialog.css({width: Math.min(Number(intended) || 600, window.innerWidth - 24),
+            maxHeight: 'calc(100dvh - 24px)', display: 'flex', flexDirection: 'column', position: 'fixed'});
+        content.css({minHeight: 0, maxHeight: 'none', overflow: 'auto', flex: '1 1 auto'});
+        content.dialog('option', 'position', {my: 'center', at: 'center', of: window});
+    }
+    let menuSequence = 0;
+    let openMenu = null;
+    function closeActions(restoreFocus = false) {
+        if (!openMenu) return;
+        const {toggle, menu} = openMenu;
+        menu.hidden = true;
+        toggle.setAttribute('aria-expanded', 'false');
+        openMenu = null;
+        if (restoreFocus && toggle.isConnected) toggle.focus();
+    }
+    function showActions(toggle, last = false) {
+        closeActions();
+        const menu = toggle.nextElementSibling;
+        menu.hidden = false;
+        toggle.setAttribute('aria-expanded', 'true');
+        openMenu = {toggle, menu};
+        const anchor = toggle.getBoundingClientRect();
+        const box = menu.getBoundingClientRect();
+        const top = anchor.bottom + 4 + box.height <= window.innerHeight - 12 ? anchor.bottom + 4 : anchor.top - box.height - 4;
+        menu.style.left = Math.max(12, Math.min(anchor.right - box.width, window.innerWidth - box.width - 12)) + 'px';
+        menu.style.top = Math.max(12, top) + 'px';
+        const items = menu.querySelectorAll('[role=menuitem]:not(:disabled)');
+        items[last ? items.length - 1 : 0]?.focus();
+    }
+    function enhanceActions(root) {
+        $(root).find('td.actions-column').each(function () {
+            if (this.querySelector('.row-actions') || !this.querySelector('button, a')) return;
+            const id = 'row-actions-' + (++menuSequence);
+            const label = (this.closest('tr').querySelector('input')?.value || this.closest('tr').cells[0]?.textContent || '').trim();
+            const menu = $('<div>', {id, class: 'row-actions-menu', role: 'menu', hidden: true})
+                .append($(this).contents().detach());
+            menu.children('button, a').attr({role: 'menuitem', tabindex: -1});
+            const toggle = $('<button>', {type: 'button', class: 'icon-button row-actions-toggle',
+                'aria-label': 'Actions: ' + label, 'aria-haspopup': 'menu', 'aria-expanded': 'false', 'aria-controls': id}).text('⋮');
+            $(this).append($('<div>', {class: 'row-actions'}).append(toggle, menu));
+        });
+    }
+    function initAdminTable(selector) {
+        const table = $(selector);
+        if (!table.length || $.fn.dataTable.isDataTable(table[0])) return;
+        // An early enhancement must not leave the toolbar inside another scroll box.
+        if (table.parent().hasClass('table-scroll')) table.unwrap();
+        return table.DataTable({
+            dom: '<"admin-table-toolbar"lf><"table-scroll"t><"admin-table-bottom"ip>',
+            autoWidth: false, pageLength: 25, stateSave: true,
+            lengthMenu: [[10, 25, 50, -1], [10, 25, 50, 'All']],
+            columnDefs: [{targets: 'actions-column', orderable: false, searchable: false}],
+            stateLoadParams: function (settings, data) {
+                data.order = (data.order || []).filter(order => settings.aoColumns[order[0]]?.bSortable);
+                if (!data.order.length) data.order = [[0, 'asc']];
+            },
+            drawCallback: function () { closeActions(); enhance(document); }
+        });
+    }
+    function addTableRows(selector, data) {
+        const table = $(selector);
+        const nodes = $(data);
+        (table.children('tbody').first().length ? table.children('tbody').first() : table).append(nodes);
+        if ($.fn.checkboxradio) nodes.find('input[type=checkbox]').checkboxradio();
+        if ($.fn.selectmenu) nodes.find('select').selectmenu();
+        if ($.fn.dataTable?.isDataTable(table[0])) {
+            // Register DOM rows with the plugin so later draws cannot drop them.
+            table.DataTable().rows.add(nodes.filter('tr').detach()).draw(false);
+        }
+        enhance(document);
+    }
+    function removeTableRow(selector) {
+        const row = $(selector);
+        const table = row.closest('table');
+        closeActions();
+        if (table.length && $.fn.dataTable?.isDataTable(table[0])) table.DataTable().row(row).remove().draw(false);
+        else row.remove();
+    }
+    function adjustTables() {
+        if ($.fn.dataTable) $.fn.dataTable.tables({visible: true, api: true}).columns.adjust();
+        enhance(document);
+    }
+    function enhance(root) {
+        enhanceActions(root);
+        $(root).find('.container table.overview, .container table.overview-wi').each(function () {
+            if (this.closest('.table-scroll, .ui-dialog-content') ||
+                !this.getClientRects().length || this.closest('[style*="display: none"], [style*="display:none"]')) return;
+            $(this).wrap($('<div>', {class: 'table-scroll', tabindex: 0, role: 'region', 'aria-label': text('table_label')}));
+        });
+        $(root).find('.dataTables_wrapper > .table-scroll').attr({
+            tabindex: 0, role: 'region', 'aria-label': text('table_label')
+        });
+        $(root).find('[onclick], .add-button, .add-button-wi, .check-button, .span-link').each(function () {
+            if (this.matches('button, input, select, textarea, a[href]')) return;
+            if (!this.getAttribute('role')) this.setAttribute('role', 'button');
+            if (!this.hasAttribute('tabindex')) this.setAttribute('tabindex', '0');
+            if (!this.textContent.trim() && !this.hasAttribute('aria-label')) {
+                this.setAttribute('aria-label', this.title || text(this.classList.contains('delete') ? 'delete' : this.classList.contains('edit') ? 'edit' : 'action'));
+            }
+        });
+        // Preserve existing forms while exposing their row labels to assistive technology.
+        $(root).find('input[id]:not([type=hidden]), select[id], textarea[id]').each(function () {
+            let name = this.getAttribute('aria-label') || Array.from(this.labels || []).map(l => l.textContent.trim()).filter(Boolean).join(' ');
+            if (!name && !this.hasAttribute('aria-labelledby')) {
+                const cell = this.closest('td');
+                const label = cell?.previousElementSibling || this.closest('tr')?.querySelector('td');
+                const heading = this.closest('table')?.querySelector('thead th:nth-child(' + ((cell?.cellIndex || 0) + 1) + ')');
+                name = (heading || label)?.textContent.trim().replace(/\s+/g, ' ').replace(/\*/g, '').trim();
+                if (name && !label?.contains(this)) this.setAttribute('aria-label', name);
+            }
+            // jQuery UI/Select2 expose a separate combobox, not the hidden native select.
+            if (name && this.tagName === 'SELECT') {
+                document.getElementById(this.id + '-button')?.setAttribute('aria-label', name);
+                $(this).next('.select2').find('[role=combobox]').attr('aria-label', name);
+            }
+        });
+    }
+    $(function () {
+        enhance(document);
+        $(document).on('click', '.row-actions-toggle', function () {
+            if (openMenu?.toggle === this) closeActions(true);
+            else showActions(this);
+        });
+        $(document).on('click', function (event) {
+            if (!openMenu || event.target.closest('.row-actions-toggle')) return;
+            if (!openMenu.menu.contains(event.target) || event.target.closest('[role=menuitem]:not(:disabled)')) closeActions();
+        });
+        $(document).on('keydown', '.row-actions', function (event) {
+            const toggle = this.querySelector('.row-actions-toggle');
+            if (!openMenu || openMenu.toggle !== toggle) {
+                if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+                    event.preventDefault(); showActions(toggle, event.key === 'ArrowUp');
+                }
+                return;
+            }
+            const items = Array.from(openMenu.menu.querySelectorAll('[role=menuitem]:not(:disabled)'));
+            const index = items.indexOf(document.activeElement);
+            if (event.key === 'Escape') { event.preventDefault(); event.stopPropagation(); closeActions(true); }
+            else if (event.key === 'Tab') closeActions(true);
+            else if (['ArrowDown', 'ArrowUp', 'Home', 'End'].includes(event.key)) {
+                event.preventDefault();
+                const next = event.key === 'Home' ? 0 : event.key === 'End' ? items.length - 1 :
+                    (index + (event.key === 'ArrowDown' ? 1 : -1) + items.length) % items.length;
+                items[next]?.focus();
+            }
+        });
+        document.addEventListener('scroll', event => {
+            if (openMenu && !openMenu.menu.contains(event.target)) closeActions();
+        }, true);
+        $(document).on('keydown', '[role=button]:not(button)', function (event) {
+            if (event.target === this && (event.key === 'Enter' || event.key === ' ')) {
+                event.preventDefault(); this.click();
+            }
+        });
+        // jQuery UI's fade effect restores inline styles before emitting dialogfocus.
+        $(document).on('dialogopen dialogfocus', '.ui-dialog-content', function () { fitDialog(this); enhance(this); });
+        $(window).on('resize', function () {
+            closeActions();
+            adjustTables();
+            $('.ui-dialog-content').each(function () { if ($(this).dialog('isOpen')) fitDialog(this); });
+        });
+        $('#tabs').on('tabsactivate', adjustTables);
+        let pending = false;
+        new MutationObserver(records => {
+            if (pending || !records.some(r => r.addedNodes.length)) return;
+            pending = true;
+            requestAnimationFrame(() => { pending = false; enhance(document); });
+        }).observe(document.body, {childList: true, subtree: true});
+    });
+    return {text, requestError, notifyRequestError, widgetState, loadFragment, initNavigation, enhance, fitDialog,
+        initAdminTable, addTableRows, removeTableRow};
+})();
diff --git a/app/templates/admin.html b/app/templates/admin.html
index 413afc1..19de914 100644
--- a/app/templates/admin.html
+++ b/app/templates/admin.html
@@ -55,7 +55,7 @@
 				<th class="padding10" style="width: 0;">Id</th>
 				<th class="padding10 first-collumn">{{lang.words.name|title()}}</th>
 				<th style="width: 100%;">{{lang.words.desc|title()}}</th>
-				<th></th>
+				<th class="actions-column">Actions</th>
 			</tr>
             </thead>
 			<tbody>
@@ -65,7 +65,7 @@
 			{% if group.name == "Default" %}
 				<td class="padding10 first-collumn" style="padding: 8px 0;">{{ group.name }}</td>
 				<td>{{ group.description.replace("'", "") }}</td>
-				<td></td>
+				<td class="actions-column"></td>
 			{% else %}
 				<td class="padding10 first-collumn" style="padding: 8px 0;">
 					{% set id = 'name-' + group.group_id|string() %}
@@ -81,8 +81,8 @@
 					{% endif %}
                     <span style="display: none">{{ group.description.replace("'", "") }}</span>
 				</td>
-				<td>
-					<a class="delete" onclick="confirmDeleteGroup({{ group.group_id }})" title="{{lang.words.delete|title()}} {{lang.words.group2}} {{group.name.replace("'", "")}}" style="cursor: pointer;"></a>
+				<td class="actions-column">
+					<button type="button" onclick="confirmDeleteGroup({{ group.group_id }})">{{lang.words.delete|title()}} {{group.name}}</button>
 				</td>
 			{% endif %}
 			</tr>
@@ -104,16 +104,14 @@
 					<td class="padding10 first-collumn" style="width: 25%;">
 						{{lang.words.service|title()}}
 					</td>
-					<td class="padding10 first-collumn">
-						{{lang.words.actions|title()}}
-					</td>
 					<td class="first-collumn">{{lang.words.version|title()}}</td>
 					<td style="width: 100%">{{lang.words.desc|title()}}</td>
-					<td><span onclick="loadServices()" class="refresh" title="{{lang.words.reload|title()}} {{lang.words.services}}"></span></td>
+					<th class="actions-column">Actions</th>
 				</tr>
 			</thead>
 			<tbody id="ajax-services-body"></tbody>
 		</table>
+        <div class="admin-page-actions"><button type="button" class="retry-button" onclick="loadServices()">{{lang.words.reload|title()}} {{lang.words.services}}</button></div>
 		<div class="add-note alert addName alert-info" style="width: inherit; margin-right: 15px;">
 			{{lang.words.read|title()}} {{lang.words.about}} {{lang.words.services}} <a href="https://rmon.io/tools" title="RMON {{lang.words.services4}}" target="_blank">{{lang.words.here}}</a>
 		</div>
@@ -126,14 +124,16 @@
 				<td class="padding10 first-collumn" style="width: 25%;">{{lang.words.service|title()}}</td>
 				<td class="first-collumn" style="width: 10%">{{lang.words.current2|title()}} {{lang.words.version}}</td>
 				<td class="padding10" style="width: 10%">{{lang.words.latest|title()}} {{lang.words.version}}</td>
-				<td style="width: 10%"></td>
 				<td style="width: 100%">{{lang.words.desc|title()}}</td>
-				<td><span onclick="checkUpdateRoxy()" class="refresh service-restart" title="{{lang.words.check|title()}} {{lang.words.new4}} {{lang.words.versions}}"></span></td>
-				<td><span onclick="loadupdatehapwi()" class="refresh" title="{{lang.words.refresh|title()}}"></span></td>
+				<th class="actions-column">Actions</th>
 			</tr>
 			</thead>
 			<tbody id="ajax-updatehapwi-body"></tbody>
 		</table>
+        <div class="admin-page-actions">
+            <button type="button" class="retry-button" onclick="checkUpdateRoxy()">{{lang.words.check|title()}} {{lang.words.new4}} {{lang.words.versions}}</button>
+            <button type="button" class="retry-button" onclick="loadupdatehapwi()">{{lang.words.refresh|title()}}</button>
+        </div>
 		<div class="add-note alert addName alert-info" style="width: inherit; margin-right: 15px;">
 			<b style="font-size: 20px; display: block; padding-bottom: 10px;">{{lang.words.note|title()}}:</b>
 			{{lang.admin_page.desc.proxy_settings}}
@@ -177,20 +177,7 @@
 		{% endfor %}
 	});
     $(document).ready(function() {
-        $('#ajax-group').on('page.dt')
-            .DataTable({
-                dom: 'Blfrtip',
-                colReorder: true,
-                "pageLength": 25,
-                stateSave: true,
-                "lengthMenu": [[10, 25, 50, -1], [10, 25, 50, "All"]],
-                "columnDefs": [
-                    {
-                        "searchable": false,
-                        "orderable": false
-                    }
-                ],
-            });
+        RmonUI.initAdminTable('#ajax-group');
     });
 </script>
 <link href="{{ url_for('static', filename='css/servers.css') }}" rel="stylesheet"/>
diff --git a/app/templates/ajax/channels.html b/app/templates/ajax/channels.html
index 999dc86..2d899ca 100644
--- a/app/templates/ajax/channels.html
+++ b/app/templates/ajax/channels.html
@@ -316,15 +316,11 @@
     <caption><i class="fas fa-envelope-open-text caption-icon"></i><h3>{{lang.words.test2|title()}} {{lang.words.message}}</h3></caption>
     <tr class="overviewHead">
         <td class="padding10 first-collumn" style="width: 45%">{{lang.words.email|title()}}</td>
-        <td style="width: 100%">{{lang.words.web_panel|title()}}</td>
     </tr>
     <tr>
         <td class="padding10 first-collumn">
             <button title="{{lang.phrases.send_test_mes}} {{lang.words.via}} {{lang.words.email}}" onclick="sendCheckMessage('email')">{{lang.words.test|title()}}</button>
         </td>
-        <td>
-            <button title="{{lang.phrases.send_test_mes}} {{lang.words.via}} {{lang.words.web_panel}}" onclick="sendCheckMessage('web')">{{lang.words.test|title()}}</button>
-        </td>
     </tr>
 </table>
 <br /><br />
diff --git a/app/templates/ajax/load_services.html b/app/templates/ajax/load_services.html
index 029469f..7d73c52 100644
--- a/app/templates/ajax/load_services.html
+++ b/app/templates/ajax/load_services.html
@@ -1,12 +1,12 @@
 {% import 'languages/'+lang|default('en')+'.html' as lang %}
+{% from 'include/service_version.html' import service_version %}
 {% set services_name = {
 	'rmon-server': { 'name': 'RMON Server', 'desc': lang.admin_page.desc.smon_desc },
-	'rmon-socket': { 'name': 'Socket', 'desc': lang.admin_page.desc.socket_desc },
 	'fail2ban': { 'name': 'Fail2ban', 'desc': 'Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs' },
-    'rabbitmq-server': { 'name': 'RabbitMQ', 'desc': 'RabbitMQ server' },
     }
 %}
-{% for s in services %}
+{% for s in services if s.0 in services_name %}
+{% set installed = s.2.get('installed', s.2['current_version'] not in ('0', '', '* is not installed')) %}
 {% set is_service_started_class = '' %}
 {% set is_service_stopped_class = '' %}
 {% set onclick_start_action = "confirmAjaxServiceAction('start', '"+s.0+"')" %}
@@ -15,7 +15,9 @@
 {% set is_service_stopped_title = lang.words.stop|title()+" "+lang.words.and+" "+lang.words.disable+" "+services_name[s.0]['name']+" "+lang.words.service %}
 <tr class="{{ loop.cycle('odd', 'even') }}" id="{{s.0}}">
     <td class="padding10 first-collumn">
-        {% if s.1 == 'active' or s.1 == 'RUNNING' %}
+        {% if s.2.get('managed_by') == 'external' %}
+            <span title="Status is unavailable here. Manage this service on its host."><span class="serverNone server-status"></span></span>
+        {% elif s.1 == 'active' or s.1 == 'RUNNING' %}
             <span title="{{lang.words.service|title()}} {{services_name[s.0]['name']}} {{lang.words.started}}"><span class="serverUp server-status"></span></span>
             {% set is_service_started_class = 'disabled-button' %}
             {% set onclick_start_action = "" %}
@@ -32,32 +34,24 @@
         {% endif %}
         {{services_name[s.0]['name']}}
     </td>
-    <td class="padding10 first-collumn">
-        {% if 'is not installed' in s.2['current_version'] or not s.2['current_version'] or s.2['current_version'] == '0' %}
-            {% if s.0 in ('rabbitmq-server', 'fail2ban') %}
-                <a class="ui-button ui-widget ui-corner-all" href="https://rmon.io/tools/{{s.0.split('-')[0]}}" title="{{lang.words.install|title()}} {{services_name[s.0]['name']}}" target="_blank">{{lang.words.install|title()}}</a>
+    <td>
+        {{service_version(s.2, lang)}}
+    </td>
+    <td>{{ services_name[s.0]['desc'] | safe }}</td>
+    <td class="actions-column">
+        {% if s.2.get('managed_by') == 'external' %}
+            <span>Managed externally</span>
+        {% elif installed is sameas false %}
+            {% if s.0 == 'fail2ban' %}
+                <a href="https://rmon.io/tools/{{s.0.split('-')[0]}}" target="_blank" rel="noopener noreferrer">{{lang.words.install|title()}}</a>
             {% else %}
-                <a class="ui-button ui-widget ui-corner-all" onclick="updateService('{{s.0}}', 'install')" title="{{lang.words.install|title()}} {{service_name}}">{{lang.words.install|title()}}</a>
+                <button type="button" onclick="updateService('{{s.0}}', 'install')">{{lang.words.install|title()}}</button>
             {% endif %}
         {% else %}
-        <a id="start-{{ s.0 }}" class="start" title="{{is_service_started_title}}">
-            <span class="service-start {{is_service_started_class}}" onclick="{{onclick_start_action}}"></span>
-        </a>
-        <a id="restart-{{ s.2 }}" class="restart" title="{{lang.words.restart|title()}} {{services_name[s.0]['name']}} {{lang.words.service}}">
-            <span class="service-reload service-restart" onclick="confirmAjaxServiceAction('restart', '{{s.0}}')"></span>
-        </a>
-        <a id="stop-{{ s.0 }}" class="stop" title="{{is_service_stopped_title}}">
-            <span class="service-stop {{is_service_stopped_class}}" onclick="{{onclick_stop_action}}"></span>
-        </a>
+        <button type="button" id="start-{{ s.0 }}" title="{{is_service_started_title}}" {% if is_service_started_class %}disabled{% endif %} onclick="{{onclick_start_action}}">{{lang.words.start|title()}}</button>
+        <button type="button" id="restart-{{ s.0 }}" onclick="confirmAjaxServiceAction('restart', '{{s.0}}')">{{lang.words.restart|title()}}</button>
+        <button type="button" id="stop-{{ s.0 }}" title="{{is_service_stopped_title}}" {% if is_service_stopped_class %}disabled{% endif %} onclick="{{onclick_stop_action}}">{{lang.words.stop|title()}}</button>
         {% endif %}
     </td>
-    <td>
-        {% if 'is not installed' not in s.2['current_version'] %}
-        {{s.2['current_version']}}
-        {% endif %}
-    </td>
-    <td colspan="2">
-        {{ services_name[s.0]['desc'] | safe }}
-    </td>
 </tr>
 {% endfor %}
diff --git a/app/templates/ajax/load_updateroxywi.html b/app/templates/ajax/load_updateroxywi.html
index 6d81d88..60894ae 100644
--- a/app/templates/ajax/load_updateroxywi.html
+++ b/app/templates/ajax/load_updateroxywi.html
@@ -1,7 +1,7 @@
 {% import 'languages/'+lang|default('en')+'.html' as lang %}
+{% from 'include/service_version.html' import service_version %}
 {% set services_name = {
     'rmon-server': { 'link': 'rmon-server', 'name': 'RMON Server', 'desc': lang.admin_page.desc.smon_desc },
-    'rmon-socket': { 'link': 'socket', 'name': 'Socket', 'desc': lang.admin_page.desc.socket_desc },
     }
 %}
 <tr class="odd">
@@ -11,10 +11,10 @@
     <td>
         <b
                 {% if versions.need_update %}
-                title=lang.admin_page.desc.a_new_version+" RMON"
+                title="{{lang.admin_page.desc.a_new_version}} RMON"
                 style="color: var(--red-color)"
                 {% else %}
-                title=lang.admin_page.desc.no_new_version+" RMON"
+                title="{{lang.admin_page.desc.no_new_version}} RMON"
                 style="color: var(--green-color)"
                 {% endif %}
         >
@@ -24,58 +24,55 @@
     <td class="padding10">
         <b>{{versions.new_ver}}</b>
     </td>
-    <td>
-        {% if versions.need_update %}
-        <a class="ui-button ui-widget ui-corner-all" onclick="updateService('rmon')" title="{{lang.words.w_update|title()}} RMON">{{lang.words.w_update|title()}}</a>
+    <td>{{lang.admin_page.desc.main_app}}</td>
+    <td class="actions-column">
+        {% if versions.get('managed_by') == 'docker' %}
+        <span>Update container image</span>
+        {% elif versions.need_update %}
+        <button type="button" onclick="updateService('rmon')">{{lang.words.w_update|title()}}</button>
         {% endif %}
     </td>
-    <td colspan="2">
-        {{lang.admin_page.desc.main_app}}
-    </td>
 </tr>
 {% for s in services %}
-    {% if s.0 in ('rmon-server', 'rmon-socket') %}
-        {% set is_need_update = 0 %}
-        {% if s.2['current_version']|float < s.2['new_version']|float %}
-            {% set is_need_update = 1 %}
-        {% endif %}
+    {% if s.0 == 'rmon-server' %}
+        {% set is_need_update = s.2.get('update_available', false) %}
+        {% set installed = s.2.get('installed') %}
+        {% set known_version = s.2.get('version_known', s.2['current_version'] not in ('0', '', '* is not installed')) %}
 <tr class="{{ loop.cycle('even', 'odd') }}">
     <td class="padding10 first-collumn">
         <a href="https://rmon.io/tools/{{services_name[s.0]['link']}}" title="{{lang.words.read|title()}} {{lang.words.more}} {{lang.words.about}} {{services_name[s.0]['name']}}" target="_blank" class="link" rel="noopener noreferrer">{{services_name[s.0]['name']}}</a>
     </td>
     <td>
-        {% if s.2['current_version'] != '* is not installed' and s.2['current_version'] != '' %}
         <b id="current-version-{{s.0}}"
-                {% if is_need_update %}
+                {% if known_version and is_need_update %}
                 title="{{lang.admin_page.desc.a_new_version}} {{services_name[s.0]['name']}}"
                 style="color: var(--red-color)"
-                {% else %}
+                {% elif known_version %}
                 title="{{lang.admin_page.desc.no_new_version}} {{services_name[s.0]['name']}}"
                 style="color: var(--green-color)"
                 {% endif %}
         >
-            {{s.2['current_version']}}
+            {{service_version(s.2, lang)}}
         </b>
-        {% endif %}
     </td>
     <td class="padding10">
         <b>
             {{s.2['new_version']}}
         </b>
     </td>
-    <td>
-        {% if 'is not installed' not in s.2['current_version'] and s.2['current_version'] != '' and s.2['current_version'] != '0' %}
-            {% if is_need_update %}
-                <a class="ui-button ui-widget ui-corner-all" onclick="updateService('{{s.0}}')" title="{{lang.words.w_update|title()}} {{services_name[s.0]['name']}}">{{lang.words.w_update|title()}}</a>
-            {% endif %}
+    <td>{{services_name[s.0]['desc']|safe}}</td>
+    <td class="actions-column">
+        {% if s.2.get('managed_by') == 'external' %}
+            <span>Managed externally</span>
+        {% elif s.2.get('managed_by') == 'docker' %}
+            <a href="https://rmon.io/installation#standalone-server" target="_blank" rel="noopener noreferrer">Docker</a>
+        {% elif known_version and is_need_update %}
+            <button type="button" onclick="updateService('{{s.0}}')">{{lang.words.w_update|title()}}</button>
         {% endif %}
-        {% if s.2['current_version'] == '0'  %}
-            <a class="ui-button ui-widget ui-corner-all" onclick="updateService('{{s.0}}', 'install')" title="{{lang.words.install|title()}} {{service_name}}">{{lang.words.install|title()}}</a>
+        {% if installed is sameas false and s.2.get('managed_by') not in ('docker', 'external') %}
+            <button type="button" onclick="updateService('{{s.0}}', 'install')">{{lang.words.install|title()}}</button>
         {% endif %}
     </td>
-    <td colspan="3">
-        {{services_name[s.0]['desc']|safe}}
-    </td>
 </tr>
 {% endif %}
 {% endfor %}
diff --git a/app/templates/ajax/new_ssh.html b/app/templates/ajax/new_ssh.html
index 79f64a9..0a6713f 100644
--- a/app/templates/ajax/new_ssh.html
+++ b/app/templates/ajax/new_ssh.html
@@ -44,11 +44,11 @@
 			{% endif %}
 			<br>
 		</td>
-		<td>
+		<td class="actions-column">
             {% if ssh.shared and g.user_params['group_id']|string() != ssh.group_id|string() %}
                 <!-- continue -->
             {% else %}
-			<a class="delete" onclick="confirmDeleteSsh({{ssh.id}})" title="{{lang.words.delete|title()}} {{ssh.name}}" style="cursor: pointer;"></a>
+			<button type="button" onclick="confirmDeleteSsh({{ssh.id}})">{{lang.words.delete|title()}} {{ssh.name}}</button>
             {% endif %}
 		</td>
 	</tr>
diff --git a/app/templates/ajax/show_services_ovw.html b/app/templates/ajax/show_services_ovw.html
index c53ff01..9632fe8 100644
--- a/app/templates/ajax/show_services_ovw.html
+++ b/app/templates/ajax/show_services_ovw.html
@@ -23,30 +23,3 @@
 	</td>
     <td></td>
 </tr>
-<tr class="odd">
-	<td class="padding10 first-collumn-wi">
-		{% if roxy_tools_status['rmon-socket'] == 'active' %}
-			<span class="serverUp server-status-small" title="Socket {{lang.words.started}}"></span>
-			{% if role <= 1 %}
-				<a href="{{ url_for('logs.logs_internal') }}" title="{{lang.words.view|title()}} {{lang.words.logs2}}" class="logs_link">
-					Socket service
-				</a>
-			{% else %}
-					Socket service
-			{% endif %}
-		{% else %}
-			{% if roxy_tools_status['rmon-socket']  == 'inactive' or roxy_tools_status['rmon-socket']  == 'failed' %}
-				<span class="serverDown server-status-small" title="Socket {{lang.words.stopped}}"></span>
-				<a href="{{ url_for('admin.admin') }}#services" title="{{lang.words.start|title()}} Socket" class="logs_link">
-					Socket service
-				</a>
-			{% else %}
-				<span title="Socket service is not installed"><span class="serverNone server-status-small"></span></span>
-				<a href="https://rmon.io/tools/socket" title="Socket service" target="_blank" class="logs_link">
-					Socket service
-				</a>
-			{% endif %}
-		{% endif %}
-	</td>
-    <td></td>
-</tr>
diff --git a/app/templates/ajax/smon/agent.html b/app/templates/ajax/smon/agent.html
index 517a8dd..63b766e 100644
--- a/app/templates/ajax/smon/agent.html
+++ b/app/templates/ajax/smon/agent.html
@@ -31,6 +31,14 @@
     {% endif %}
     </div>
     <div class="server-desc">
+        <div>
+            <b>{{ lang.agent_transport.label }}</b>:
+            {{ {'http': 'HTTP', 'https': 'HTTPS', 'mtls': 'HTTPS + mTLS'}.get(agent.applied_result_transport, lang.agent_transport.unknown) }}
+            {% if agent.transport_pending %}<span class="transport-pending">— {{ lang.agent_transport.pending }}</span>{% endif %}
+            {% if agent.transport_checked_at %}
+                <span title="{{ lang.agent_transport.checked }}">({{ agent.transport_checked_at }})</span>
+            {% endif %}
+        </div>
         <div>
             <b>{{ lang.words.server|title() }}</b>: {{ copy_to_clipboard(value=agent.hostname) }}
             <b>{{ lang.words.server|title() }} IP</b>: {{ copy_to_clipboard(value=agent.ip) }}
diff --git a/app/templates/ajax/smon/status_pages.html b/app/templates/ajax/smon/status_pages.html
index 82fd71e..37e64b7 100644
--- a/app/templates/ajax/smon/status_pages.html
+++ b/app/templates/ajax/smon/status_pages.html
@@ -1,6 +1,6 @@
 {% for page in pages %}
 <div id="page_{{page}}" class="page_div">
-    <a href="/rmon/status/{{page.slug}}" id="page_link-{{ page }}" class="page_link" target="_blank" title="Open status page">
+    <a href="{{ url_for('smon.show_smon_status_page', slug=page.slug) }}" id="page_link-{{ page }}" class="page_link" target="_blank" title="Open status page">
         <span id="page_status-{{page}}"><i class="far fa-check-circle status-page-icon"></i></span>
         <div>
             <span class="page_name" id="page_name-{{page}}">{{page.name|replace("'", "")}}</span>
@@ -10,8 +10,8 @@
         </div>
         <div class="page_slug" id="page_slug-{{page}}">/rmon/status/{{page.slug}}</div>
     </a>
-    <div class="edit status_page-edit" onclick="createStatusPageStep1('true', '{{page}}')"></div>
-    <div class="delete" onclick="confirmDeleteStatusPage('{{page}}')"></div>
+    <button type="button" class="edit status_page-edit icon-button" aria-label="{{ lang.words.edit|title() }} {{ page.name }}" onclick="createStatusPageStep1('true', '{{page}}')"></button>
+    <button type="button" class="delete icon-button" aria-label="{{ lang.words.delete|title() }} {{ page.name }}" onclick="confirmDeleteStatusPage('{{page}}')"></button>
 </div>
 <script>smon_manage_status_page_avg_status('{{page}}')</script>
 {% endfor %}
diff --git a/app/templates/base.html b/app/templates/base.html
index 74d45d9..94d8c90 100644
--- a/app/templates/base.html
+++ b/app/templates/base.html
@@ -1,3 +1,4 @@
+<!doctype html>
 <html lang="{{lang|default('en')}}">
 {% set chosen_lang = lang|default('en') %}
 {% import 'languages/'+lang|default('en')+'.html' as lang %}
@@ -21,17 +22,20 @@
               data-unknown="{{ lang.smon_page.desc.UNKNOWN }}" data-warning="{{ lang.smon_page.desc.WARNING }}"/>
         {% include 'include/main_head.html' %}
 	</head>
-	<body>
+	<body class="app-shell">
+        <a href="#main-content" class="skip-link">{{ lang.ux.skip_content }}</a>
 		{% if g.user_params['user'] %}
-		<script>show_version();</script>
-            <input type="hidden" id="user_group_socket" value="{{ g.user_params['group_id'] }}">
-            <input type="hidden" id="user_id_socket" value="{{ g.user_params['user_id'] }}">
+        <script>$(show_version);</script>
 		{% include 'include/main_menu.html' %}
-		<div class="container">
+		<main class="container" id="main-content" tabindex="-1">
+            <header class="page-header">
+                <button type="button" id="menu-toggle" class="icon-button" aria-controls="main-navigation" aria-expanded="true" aria-label="{{ lang.ux.toggle_menu }}">☰</button>
 			<h2>
 				{% block h2 %}{% endblock %}
-				{% include 'include/login.html' %}
 			</h2>
+                {% include 'include/login.html' %}
+            </header>
+            <button type="button" id="menu-backdrop" class="menu-backdrop" tabindex="-1" aria-label="{{ lang.ux.close_menu }}" hidden></button>
 			<ul id='browse_history'></ul>
 			{% if g.user_params['role'] %}
 				{% if g.user_params['role'] <= 2 %}
@@ -44,7 +48,7 @@ <h2>
 			{% block content %}{% endblock %}
 			<div id="ajax-compare"></div>
 			<div id="ajax"></div>			
-		</div>	
+		</main>
 		<div id="show-updates" style="display: none;">	
 			<div>
 				{{lang.phrases.new_version}} <a href="{{ url_for('admin.admin') }}#updatehapwi" class="link">{{lang.words.w_update|title()}}</a>
@@ -53,13 +57,13 @@ <h2>
 		<div class="footer">
 			<a href="#" id="hide_menu" title="{{lang.words.hide|title()}} {{lang.words.menu}}" style="float: left;">
 				<span class="ui-state-default ui-corner-all">
-					<span class="ui-icon ui-icon-arrowthick-1-w" id="arrow"></span>
+					<span class="ui-icon ui-icon-arrowthick-1-w" ></span>
 				</span>
 			</a>
 			<div class="show_menu" style="display: none; float: left;">
 				<a href="#" id="show_menu" title="{{lang.words.show|title()}} {{lang.words.menu}}">
 					<span class="ui-state-default ui-corner-all">
-						<span class="ui-icon ui-icon-arrowthick-1-e" id="arrow"></span>
+						<span class="ui-icon ui-icon-arrowthick-1-e" ></span>
 					</span>
 				</a>
 			</div>
@@ -83,12 +87,6 @@ <h2>
 		</div>
 		<div id="show-user-settings" style="display: none;">
 			<table class="overview" id="show-user-settings-table" title="{{lang.words.user3|title()}} {{lang.words.settings}}">
-				<tr>
-					<td class="padding20" style="width: 70%">{{lang.words.alerts|title()}}</td>
-					<td>
-						{{ checkbox('disable_alerting') }}
-					</td>
-				</tr>
 				<tr class="padding20">
 					<td class="padding20">{{lang.words.language|title()}}</td>
 					<td>
diff --git a/app/templates/include/admin_oidc.html b/app/templates/include/admin_oidc.html
index f24debb..b433098 100644
--- a/app/templates/include/admin_oidc.html
+++ b/app/templates/include/admin_oidc.html
@@ -7,8 +7,7 @@
                 <th class="padding10 first-collumn">{{ lang.oidc_page.provider }}</th>
                 <th style="width: 15%;">{{ lang.oidc_page.status }}</th>
                 <th style="width: 100%;">{{ lang.oidc_page.client_id }}</th>
-                <th></th>
-                <th></th>
+                <th class="actions-column">Actions</th>
             </tr>
         </thead>
         <tbody id="oidc-provider-list"></tbody>
@@ -90,8 +89,7 @@
                     <th>{{ lang.oidc_page.role }}</th>
                     <th>{{ lang.oidc_page.status }}</th>
                     <th>{{ lang.oidc_page.priority }}</th>
-                    <th></th>
-                    <th></th>
+                    <th class="actions-column">Actions</th>
                 </tr>
             </thead>
             <tbody id="oidc-mapping-list"></tbody>
diff --git a/app/templates/include/admin_servers.html b/app/templates/include/admin_servers.html
index 0f61bb9..68b95de 100644
--- a/app/templates/include/admin_servers.html
+++ b/app/templates/include/admin_servers.html
@@ -2,21 +2,7 @@
 {% if not adding %}
 <script>
 $(document).ready(function() {
-    $('#ajax-servers').on('page.dt')
-        .DataTable({
-            dom: 'Blfrtip',
-            colReorder: true,
-            "pageLength": 25,
-            stateSave: true,
-            "lengthMenu": [[10, 25, 50, -1], [10, 25, 50, "All"]],
-            "columnDefs": [
-                {
-                    "searchable": false,
-                    "orderable": false
-                }
-            ],
-            "stripeClasses": [ 'odd', 'even' ]
-        });
+    RmonUI.initAdminTable('#ajax-servers');
 });
 </script>
 <table class="overview overview-overflow" id="ajax-servers">
@@ -30,15 +16,9 @@
 			<th style="width: 10%">{{lang.words.group|title()}}</th>
 			{% endif %}
 			<th class="checkbox-head" style="min-width: 70px;">{{lang.words.enabled|title()}}</th>
-			<th style="min-width: 120px;" class="help_cursor" id="server-firewalld-th">
-				<span title="If the server has a firewall enabled, enable this option">Firewalld</span>
-			</th>
 			<th class="cred-field">{{lang.words.creds|title()}}</th>
 			<th style="width: 100%">{{lang.words.desc|title()}}</th>
-			<th style="min-width: 17px;"></th>
-			<th></th>
-			<th></th>
-			<th></th>
+			<th class="actions-column">Actions</th>
 		</tr>
 	</thead>
 	<tbody>
@@ -83,11 +63,6 @@
 					{{ checkbox(id) }}
 				{% endif %}
 			</td>
-			<td class="checkbox" style="padding-left: 0">
-				<div class="controlgroup">
-					<button onclick="viewFirewallRules('{{server.2}}')" title="{{lang.words.view|title()}} firewall {{lang.words.rules2}} {{lang.words.on}} {{lang.words.server2}} {{server.1}}" class="overflow" style="width: 60px;height: 28px;">{{lang.words.view}}</button>
-				</div>
-			</td>
 			<td>
 				<div class="controlgroup">
 					<select id="credentials-{{server.0}}">
@@ -100,7 +75,6 @@
 							{% endif %}
 						{% endfor %}
 					</select>
-					<button onclick="checkSshConnect('{{server.2}}')" title="Check SSH connect to the server {{server.1}}" class="overflow" style="width: 70px;height: 25px;">{{lang.words.check}}</button>
 				</div>
 			</td>
 			<td>
@@ -111,17 +85,13 @@
 					{{ input(id, size='20') }}
 				{% endif %}
 			</td>
-			<td>
-				<a href="/history/server/{{server.2}}" title="{{lang.words.view|title}} {{lang.words.history}} {{lang.words.for}} {{lang.words.this}} {{lang.words.server}}" class="history"></a>
-			</td>
-			<td style="min-width: 17px;">
-				<a class="info" onclick="showServerInfo('{{server.0}}', '{{server.2}}')" id="server_info_link-{{server.0}}" title="{{lang.words.show|title()}} {{lang.words.server}} {{lang.words.info}}" style="cursor: pointer; color: var(--color-blue)"></a>
-			</td>
-			<td>
-				<a class="add" onclick="cloneServer({{server.0}})" id="clone-{{server.0}}" title="{{lang.words.w_copy|title()}} {{lang.words.settings}} {{server.1}}" style="cursor: pointer;"></a>
-			</td>
-			<td>
-				<a class="delete" onclick="confirmDeleteServer({{server.0}})" title="{{lang.words.delete|title()}} {{lang.words.server}} {{server.1}}" style="cursor: pointer;"></a>
+			<td class="actions-column">
+                <button type="button" onclick="checkSshConnect('{{server.2}}')">{{lang.words.check|title()}} SSH</button>
+                <button type="button" onclick="viewFirewallRules('{{server.2}}')">{{lang.words.view|title()}} firewall {{lang.words.rules2}}</button>
+                <a href="/history/server/{{server.2}}">{{lang.words.view|title()}} {{lang.words.history}}</a>
+                <button type="button" onclick="showServerInfo('{{server.0}}', '{{server.2}}')" id="server_info_link-{{server.0}}">{{lang.words.show|title()}} {{lang.words.server}} {{lang.words.info}}</button>
+                <button type="button" onclick="cloneServer({{server.0}})" id="clone-{{server.0}}">{{lang.words.w_copy|title()}} {{lang.words.settings}}</button>
+                <button type="button" onclick="confirmDeleteServer({{server.0}})">{{lang.words.delete|title()}} {{server.1}}</button>
 			</td>
 		</tr>
 		{% endfor %}
diff --git a/app/templates/include/admin_settings.html b/app/templates/include/admin_settings.html
index 11aecdb..2aba506 100644
--- a/app/templates/include/admin_settings.html
+++ b/app/templates/include/admin_settings.html
@@ -1,19 +1,19 @@
 {% set sections_name = {
-    'rabbitmq': 'RabbitMQ',
     'main': 'Main',
     'mail': 'Mail',
     'monitoring': 'Monitoring',
     'logs': 'Logs',
     'ldap': 'LDAP',
     'smon': 'RMON',
+    'agent': lang.agent_transport.section,
     }
 %}
 <script defer src="{{ url_for('static', filename='js/admin_settings.js') }}"></script>
 <table id="settings">
     <tbody>
         {% set section = namespace(section='') %}
-        {% for set in settings %}
-        {% if g.user_params['role'] == 2 and (set.section in ('monitoring', 'rabbitmq', 'mail', 'rmon')) %}
+        {% for set in settings if set.section in sections_name %}
+        {% if g.user_params['role'] == 2 and (set.section in ('monitoring', 'mail', 'rmon')) %}
         <!-- continue -->
         {% else %}
         {% if section.section|string() != set.section|string() %}
@@ -22,6 +22,11 @@ <h3 class="plus-after" id="{{set.section}}-section-h3" style="font-size: 1em; pa
                 {{sections_name[set.section]}}
             </h3>
         </th>
+        {% if set.section == 'agent' %}
+        <tr class="agent-section" style="display: none"><td colspan="3" class="padding10">
+            {{ lang.agent_transport.settings_help }} <code>{{ agent_certificate_root }}</code>
+        </td></tr>
+        {% endif %}
         <tr class="overviewHead {{set.section}}-section" style="display: none">
             <td class="padding10 first-collumn">Parameter</td>
             <td class="addOption">Value</td>
@@ -34,17 +39,25 @@ <h3 class="plus-after" id="{{set.section}}-section-h3" style="font-size: 1em; pa
         {% else %}
         <tr class="{{ loop.cycle('odd', 'even') }} {{set.section}}-section" style="display: none">
             <td class="addName">
-                {{set.param}}
+                {% if set.section == 'agent' %}{{ lang.agent_transport.fields[set.param] }}{% else %}{{set.param}}{% endif %}
             </td>
             <td class="addOption">
-                {% if set.param in ('ldap_password', 'rabbitmq_password', 'mail_smtp_password') %}
+                {% if set.param == 'agent_result_transport' %}
+                    <select id="{{ set.param }}" name="{{ set.param }}" class="agent-setting-select">
+                        {% for value, label in [('http', 'HTTP'), ('https', 'HTTPS'), ('mtls', 'HTTPS + mTLS')] %}
+                        <option value="{{ value }}" {% if set.value == value %}selected{% endif %}>{{ label }}</option>
+                        {% endfor %}
+                    </select>
+                {% elif set.param == 'agent_tls_generate' %}
+                    {{ checkbox(set.param, checked='checked' if set.value == '1' else '', style='margin: 0') }}
+                {% elif set.param in ('ldap_password', 'mail_smtp_password') %}
                     {% if set.value is none %}
                         {{ input(set.param, size='25', type='password', style='width: 210px;') }}
                     {% else %}
                         {{ input(set.param, size='25', type='password', style='width: 210px;', placeholder='******') }}
                     {% endif %}
                 {% elif set.param in ('session_ttl', 'token_ttl', 'ldap_port', 'log_time_storage', 'keep_history_range', 'master_port', 'master_port',
-                    'mail_smtp_port', 'rabbitmq_port', 'ssl_expire_warning_alert', 'ssl_expire_critical_alert', 'action_keep_history_range') %}
+                    'mail_smtp_port', 'ssl_expire_warning_alert', 'ssl_expire_critical_alert', 'action_keep_history_range') %}
                     {{ input(set.param, value=set.value, style='width: 210px;', type='number') }}
                 {% elif set.param == 'time_zone' %}
                     <select name="{{set.param}}" id="{{set.param}}" style="width: 215px;">
@@ -56,7 +69,7 @@ <h3 class="plus-after" id="{{set.section}}-section-h3" style="font-size: 1em; pa
                         {% endif %}
                         {% endfor %}
                     </select>
-                {% elif set.param in ('ldap_type', 'ldap_enable', 'syslog_server_enable', 'mail_ssl', 'use_victoria_metrics', 'mail_enabled', 'mail_send_hello_message', 'rabbitmq_enabled', 'json_format') %}
+                {% elif set.param in ('ldap_type', 'ldap_enable', 'syslog_server_enable', 'mail_ssl', 'use_victoria_metrics', 'mail_enabled', 'mail_send_hello_message', 'json_format') %}
                     {% if set.value|int() == 1 %}
                         {{ checkbox(set.param, checked='checked', style='margin: 0') }}
                     {% else %}
@@ -71,7 +84,7 @@ <h3 class="plus-after" id="{{set.section}}-section-h3" style="font-size: 1em; pa
                 {% endif %}
             </td>
             <td class="addOption">
-                {{ lang.settings[set.section][set.param] }}
+                {% if set.section == 'agent' %}{{ lang.agent_transport.descriptions[set.param] }}{% else %}{{ lang.settings[set.section][set.param] }}{% endif %}
             </td>
         </tr>
         {% endif %}
diff --git a/app/templates/include/admin_ssh.html b/app/templates/include/admin_ssh.html
index 908d677..edf899f 100644
--- a/app/templates/include/admin_ssh.html
+++ b/app/templates/include/admin_ssh.html
@@ -15,7 +15,7 @@
         <td style="width: 100%;" class="help_cursor" id="ssh-user-name-td">
             <span title="Enter SSH user name. If SSH key disabled, enter password for SSH user">{{lang.words.username|title()}}</span>
         </td>
-        <td></td>
+        <th class="actions-column">Actions</th>
     </tr>
     {% include 'ajax/new_ssh.html' %}
 </table>
diff --git a/app/templates/include/admin_users.html b/app/templates/include/admin_users.html
index 829d976..3edc15d 100644
--- a/app/templates/include/admin_users.html
+++ b/app/templates/include/admin_users.html
@@ -2,21 +2,7 @@
 {% if not adding %}
 <script>
 $(document).ready(function() {
-    $('#ajax-users').on('page.dt')
-        .DataTable({
-            dom: 'Blfrtip',
-            colReorder: true,
-            "pageLength": 25,
-            stateSave: true,
-            "lengthMenu": [[10, 25, 50, -1], [10, 25, 50, "All"]],
-            "columnDefs": [
-                {
-                    "searchable": false,
-                    "orderable": false
-                }
-            ],
-            "stripeClasses": [ 'odd', 'even' ]
-        });
+    RmonUI.initAdminTable('#ajax-users');
 });
 </script>
 <table class="overview" id="ajax-users">
@@ -24,16 +10,12 @@
 		<tr class="overviewHead">
             <th class="padding10" style="width: 0;">Id</th>
 			<th class="padding10 first-collumn" id="user-login-th">{{lang.words.login|title()}}</th>
-			<th style="width: 10%">{{lang.words.password|title()}}</th>
 			<th style="width: 10%" class="checkbox-head" id="user-active-th">{{lang.words.active|title()}}</th>
 			<th style="width: 20%">{{lang.words.email|title()}}</th>
 			{% if g.user_params['role'] == 2 %}
 			<th style="width: 100%" id="user-role-th">{{lang.words.role|title()}}</th>
-			{% else %}
-				<th style="width: 100%" id="user-group-role-th">{{lang.words.groups|title()}} {{lang.words.and}} {{lang.words.roles|title()}}</th>
 			{% endif %}
-			<th></th>
-			<th></th>
+			<th class="actions-column">Actions</th>
 		</tr>
 	</thead>
 	<tbody>
@@ -60,12 +42,6 @@
 				{% endif %}
                 <span style="display: none">{{ user.username }}</span>
 			</td>
-			<td>
-				{% if user.ldap_user != 1 and not disable_superAdmin['disabled'] %}
-				<span title="{{lang.words.change|title()}} {{lang.words.password}}" style="cursor: pointer; margin-left: 15px;" class="div-pic" onclick="openChangeUserPasswordDialog('{{user.user_id}}')">
-				</span>
-				{% endif %}
-			</td>
 			<td class="checkbox">
 				{% set activeuser_id = 'enabled-' + user.user_id|string() %}
 				{% if user.enabled == 1 %}
@@ -83,8 +59,8 @@
 				{% endif %}
                 <span style="display: none">{{ user.email }}</span>
 			</td>
+			{% if g.user_params['role'] == 2 %}
 			<td>
-				{% if g.user_params['role'] == 2 %}
 				<select id="role-{{user.user_id}}" name="role-{{user.user_id}}" {{ disable_superAdmin['disabled'] }}>
 					<option disabled selected>Select a role</option>
 					{% for r in roles %}
@@ -99,20 +75,22 @@
 						{% endfor %}
 					{% endfor %}
 				</select>
-				{% else %}
-				<span title="{{lang.words.change2|title()}} {{lang.words.user3}} {{lang.words.groups}} {{lang.words.and}} {{lang.words.roles}}" style="cursor: pointer; margin-left: 40px;" class="div-pic" onclick="confirmChangeGroupsAndRoles('{{user.user_id}}')"></span>
-				{% endif %}
 			</td>
-			<td>
-				<a href="/history/user/{{user.user_id}}" title="{{lang.words.view|title()}} {{lang.words.history}} {{lang.words.for}} {{lang.words.user2}}" class="history"></a>
-			</td>
-			<td>
-				<a class="delete" onclick="confirmDeleteUser({{user.user_id}})" title="{{lang.words.delete|title()}} {{user.username}}" style="cursor: pointer;"></a>
+			{% endif %}
+			<td class="actions-column">
+                {% if user.ldap_user != 1 and not disable_superAdmin['disabled'] %}
+                <button type="button" onclick="openChangeUserPasswordDialog('{{user.user_id}}')">{{lang.words.change|title()}} {{lang.words.password}}</button>
+                {% endif %}
+                {% if g.user_params['role'] == 1 %}
+                <button type="button" onclick="confirmChangeGroupsAndRoles('{{user.user_id}}')">{{lang.words.groups|title()}} {{lang.words.and}} {{lang.words.roles}}</button>
+                {% endif %}
+                <a href="/history/user/{{user.user_id}}">{{lang.words.view|title()}} {{lang.words.history}}</a>
+                <button type="button" onclick="confirmDeleteUser({{user.user_id}})">{{lang.words.delete|title()}} {{user.username}}</button>
 			</td>
 		</tr>
 	{% endfor %}
 	{% if not adding %}
-	<tbody>
+	</tbody>
 </table>
 <br /><span class="add-button" title="{{lang.words.add|title()}} {{lang.words.new}} {{lang.words.user2}}" id="add-user-button">+ {{lang.words.add|title()}}</span>
 <br /><br />
diff --git a/app/templates/include/agent_transport.html b/app/templates/include/agent_transport.html
new file mode 100644
index 0000000..b7d8017
--- /dev/null
+++ b/app/templates/include/agent_transport.html
@@ -0,0 +1,16 @@
+<tr>
+    <td class="padding20">{{ lang.agent_transport.label }}</td>
+    <td>
+        <select id="new-agent-result-transport" name="new-agent-result-transport">
+            <option value="">{{ lang.agent_transport.preserve }}</option>
+            <option value="http">HTTP</option>
+            <option value="https">HTTPS</option>
+            <option value="mtls">HTTPS + mTLS</option>
+        </select>
+    </td>
+</tr>
+<tr>
+    <td colspan="2" class="padding20">
+        <small>{{ lang.agent_transport.help }}</small>
+    </td>
+</tr>
diff --git a/app/templates/include/input_macros.html b/app/templates/include/input_macros.html
index 2c33629..bea3d1c 100644
--- a/app/templates/include/input_macros.html
+++ b/app/templates/include/input_macros.html
@@ -1,11 +1,11 @@
-{% macro input(id, name='', value='', type='text', size='', readonly='', required='', placeholder='', autofocus='', title='', class='form-control', disabled='', style='') -%}
+{% macro input(id, name='', value='', type='text', size='', readonly='', required='', placeholder='', autofocus='', title='', class='form-control', disabled='', style='', autocomplete='off') -%}
 	{% if name == '' %}
 		{% set name = id %}
 	{% endif %}
 	{% if disabled == 'true' %}
 		{% set disabled = 'disabled' %}
 	{% endif %}
-    <input type="{{ type }}" name="{{name}}" value="{{ value|e }}" id="{{ id }}" data-help="{{title}}" size="{{size}}" style="{{style}}" {{readonly}} {{ disabled }} {{required}} {{autofocus}} placeholder="{{placeholder}}" title="{{title}}" class="{{class}}" autocomplete="off" />
+    <input type="{{ type }}" name="{{name}}" value="{{ value|e }}" id="{{ id }}" data-help="{{title}}" size="{{size}}" style="{{style}}" {{readonly}} {{ disabled }} {{required}} {{autofocus}} placeholder="{{placeholder}}" title="{{title}}" class="{{class}}" autocomplete="{{ autocomplete }}" />
 {%- endmacro %}
 
 {%- macro checkbox(id, name='', checked='', title='', value='', desc='', disabled='', style='') -%}
diff --git a/app/templates/include/login.html b/app/templates/include/login.html
index f215edf..cc93244 100644
--- a/app/templates/include/login.html
+++ b/app/templates/include/login.html
@@ -1,11 +1,10 @@
 {% if g.user_params['user'] %}
-	<span id="show-user-settings-button" class="user-circle login" title="{{lang.words.user3|title()}} {{lang.words.settings}}" style="margin-top: 5px;" onclick="openUserSettings('{{ g.user_params['user_id'] }}')">
-        {{g.user_params['user']}}
-    </span>
+    <div class="account-actions">
+        <button type="button" id="show-user-settings-button" class="user-circle login icon-button"
+                title="{{lang.words.user3|title()}} {{lang.words.settings}}"
+                onclick="openUserSettings('{{ g.user_params['user_id'] }}')">{{ g.user_params['user'] }}</button>
+        <a href="{{ url_for('logout') }}" class="icon-button" aria-label="{{ lang.words.logout|title() }}" title="{{ lang.words.logout|title() }}"><i class="fas fa-sign-out-alt" aria-hidden="true"></i></a>
+    </div>
 {% else %}
-	<a href=/app/login title="Login" class="login"> Login</a>
+    <a href="{{ url_for('login_page') }}" class="login">{{ lang.words.login2|title() }}</a>
 {% endif %}
-<a href="/logout" title="{{lang.words.logout|title()}}" style="float: right;
-    right: 27px;
-    position: absolute;
-    top: 12px;"><i class="fas fa-sign-out-alt"></i></a>
diff --git a/app/templates/include/main_head.html b/app/templates/include/main_head.html
index 019ab79..fe56373 100644
--- a/app/templates/include/main_head.html
+++ b/app/templates/include/main_head.html
@@ -2,9 +2,7 @@
 <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
 <meta http-equiv="Pragma" content="no-cache" />
 <meta http-equiv="Expires" content="0" />
-{% if title == 'Login page' %}
-<meta name="viewport" content="width=device-width, user-scalable=1">
-{% endif %}
+<meta name="viewport" content="width=device-width, initial-scale=1">
 <link rel="preconnect" href="https://fonts.googleapis.com">
 <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link href="https://fonts.googleapis.com/css2?family=Manrope:wght@200..800&display=swap" rel="stylesheet">
@@ -22,7 +20,6 @@
 <script defer src="{{ url_for('static', filename='js/fontawesome.min.js') }}"></script>
 <script src="https://use.fontawesome.com/releases/v5.15.4/js/all.js" data-auto-replace-svg="nest"></script>
 <script>FontAwesomeConfig = { searchPseudoElements: true, observeMutations: false };</script>
-<script defer src="{{ url_for('static', filename='js/ion.sound.min.js') }}"></script>
 <link href="{{ url_for('static', filename='css/awesome-6.3.9.css') }}" rel="stylesheet">
 <link href="{{ url_for('static', filename='css/style-6.3.9.css') }}" rel="stylesheet">
 <link href="{{ url_for('static', filename='css/nprogress.css') }}" rel="stylesheet">
@@ -31,7 +28,6 @@
 <script src="{{ url_for('static', filename='js/jquery-3.6.0.min.js') }}"></script>
 <script src="{{ url_for('static', filename='js/jquery-ui.min.js') }}"></script>
 <script src="{{ url_for('static', filename='js/js.cookie.min.js') }}"></script>
-<script src="{{ url_for('static', filename='js/reconnecting-websocket.js') }}"></script>
 <link href="{{ url_for('static', filename='css/select2.css') }}" rel="stylesheet" />
 <script src="{{ url_for('static', filename='js/select2.js') }}"></script>
 <script src="{{ url_for('static', filename='js/element.js') }}"></script>
@@ -40,3 +36,7 @@
 <script src="{{ url_for('static', filename='js/nprogress.js') }}"></script>
 <link href="{{ url_for('static', filename='css/toastr-6.3.9.css') }}" rel="stylesheet"/>
 <script src="{{ url_for('static', filename='js/toastr.js') }}"></script>
+
+<link href="{{ url_for('static', filename='css/ux.css') }}" rel="stylesheet">
+<script id="rmon-ui-strings" type="application/json">{{ lang.ux|tojson }}</script>
+<script src="{{ url_for('static', filename='js/ux.js') }}"></script>
diff --git a/app/templates/include/main_menu.html b/app/templates/include/main_menu.html
index dac3e8d..b7197c3 100644
--- a/app/templates/include/main_menu.html
+++ b/app/templates/include/main_menu.html
@@ -1,4 +1,4 @@
-<div class="top-menu">
+<aside class="top-menu" id="main-navigation" aria-label="{{ lang.words.menu|title() }}">
 	<div class="LogoText">
 		<span id="logo_text">
 			<a href="https://rmon.io" title="RMON site" target="_blank">
@@ -38,4 +38,4 @@
 			</ul>
 		</nav>
 	</div>
-</div>
+</aside>
diff --git a/app/templates/include/service_version.html b/app/templates/include/service_version.html
new file mode 100644
index 0000000..298631f
--- /dev/null
+++ b/app/templates/include/service_version.html
@@ -0,0 +1,9 @@
+{% macro service_version(details, lang) -%}
+    {%- if details.get('version_known', details['current_version'] not in ('0', '', '* is not installed')) -%}
+        {{ details['current_version'] }}
+    {%- elif details.get('installed') is sameas false -%}
+        {{ lang.ux.service_not_installed }}
+    {%- else -%}
+        {{ lang.ux.service_version_unknown }}
+    {%- endif -%}
+{%- endmacro %}
diff --git a/app/templates/include/smon/add_form.html b/app/templates/include/smon/add_form.html
index afc527c..91b5420 100644
--- a/app/templates/include/smon/add_form.html
+++ b/app/templates/include/smon/add_form.html
@@ -1,209 +1,190 @@
+{% set c = lang.check_editor %}
+<script id="check-editor-strings" type="application/json">{{ c|tojson }}</script>
 <script src="{{ url_for('static', filename='js/rmon/check.js') }}"></script>
+<script src="{{ url_for('static', filename='js/rmon/check_editor.js') }}"></script>
 <link href="{{ url_for('static', filename='css/datetimepicker.min.css') }}" rel="stylesheet">
 <script src="{{ url_for('static', filename='js/datetimepicker.full.min.js') }}"></script>
-<style>
-    .check-name {
-        width: 210px;
-    }
-    .overview {
-        width: 50%;
-    }
-    .validateTips {
-        width: 1175px;
-    }
-    .tagify {
-        width: 240px !important;
-    }
-</style>
+<link rel="stylesheet" href="{{ url_for('static', filename='css/tagify.css') }}">
+<script src="{{ url_for('static', filename='js/tagify.js') }}"></script>
+<link rel="stylesheet" href="{{ url_for('static', filename='css/check_editor.css') }}">
 <script>
-    $(function () {
-        $.datetimepicker.setLocale('{{ chosen_lang }}');
-        $('#new-smon-expiration').datetimepicker({
-            format: 'Y-m-d H:i',
-            minDate: 0,
-            step: 1,
-        });
-    });
+$(function () {
+    $.datetimepicker.setLocale('{{ chosen_lang }}');
+    $('#new-smon-expiration').datetimepicker({format: 'Y-m-d H:i', minDate: 0, step: 1});
+});
 </script>
-<!-- Tagify -->
-<link rel="stylesheet" href="{{ url_for('static', filename='css/tagify.css') }}" />
-<script src="{{ url_for('static', filename='js/tagify.js') }}"></script>
-
-
-<div id="smon-add-table" style="display: none;">
-	<table class="overview" id="smon-add-table-overview" title="{{lang.words.create|title()}} {{lang.words.w_a}} {{lang.words.new}} {{lang.words.server}} {{lang.words.for}} {{lang.words.monitoring}}"
-    data-edit="{{lang.words.edit|title()}} {{lang.words.w_a}} {{lang.words.new}} {{lang.words.server}} {{lang.words.for}} {{lang.words.monitoring}}">
-		{% include 'include/tr_validate_tips.html' %}
-    </table>
-    <table class="overview"  style="float: left;">
-		<tr>
-			<td colspan="2" class="padding20">
-				{{lang.words.name|title()}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-name', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr>
-			<td colspan="2" class="padding20">
-				Place
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-                <select name="new-smon-place" id="new-smon-place">
+<div id="smon-add-table" class="check-editor" style="display: none;">
+    <div id="smon-add-table-overview" data-create="{{ c.create }}" data-edit="{{ c.edit }}">
+        <p class="check-editor-intro">{{ c.intro }}</p>
+    </div>
+    <div class="check-editor-tabs" role="tablist" aria-label="{{ c.sections }}">
+        {% for key in ['target', 'settings', 'notifications'] %}
+        <button type="button" role="tab" id="check-editor-tab-{{ loop.index0 }}" aria-controls="check-editor-step-{{ loop.index0 }}" aria-selected="{{ 'true' if loop.first else 'false' }}" tabindex="{{ '0' if loop.first else '-1' }}" data-step="{{ loop.index0 }}"><span>{{ loop.index }}</span>{{ c[key] }}</button>
+        {% endfor %}
+    </div>
+    <div id="check-editor-error" class="check-editor-error" role="alert" tabindex="-1" hidden></div>
+    <form id="check-editor-form" novalidate>
+        <section role="tabpanel" id="check-editor-step-0" aria-labelledby="check-editor-tab-0" data-step="0">
+            <h3>{{ c.target }}</h3><p class="field-help">{{ c.target_hint }}</p>
+            <div class="check-fields">
+<div class="check-field ">
+<label class="check-field-label" for="check_type">{{lang.words.checking|title()}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{% set check_types = {'dns': 'DNS', 'ping': 'Ping', 'smtp': 'SMTP', 'rabbitmq': 'RabbitMQ', 'tcp': 'TCP', 'http': 'HTTP(s)'} %}
+				{{ select('check_type', values=check_types, selected='http') }}</div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-name">{{lang.words.name|title()}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-name') }}</div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-url">URL
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-url', title='https://example.com/health', placeholder='https://example.com/health') }}</div>
+</div>
+<div class="check-field new_smon_hostname">
+<label class="check-field-label" for="new-smon-ip">{{lang.words.Hostname}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-ip') }}</div>
+</div>
+<div class="check-field smon_tcp_check smon_dns_check smon_smtp_check smon_rabbit_check">
+<label class="check-field-label" for="new-smon-port">{{lang.words.port|title()}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-port', type='number') }}</div>
+</div>
+<div class="check-field smon_dns_check">
+<label class="check-field-label" for="new-smon-resolver-server">Resolver {{lang.words.server}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-resolver-server', value='8.8.8.8') }}</div>
+</div>
+<div class="check-field smon_dns_check">
+<label class="check-field-label" for="new-smon-dns_record_type">{{lang.phrases.resource_record_type}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{% set check_types = {'a': 'A', 'aaa': 'AAA', 'caa': 'CAA', 'cname': 'CNAME', 'mx': 'MX', 'ns': 'NS',
+				'ptr': 'PTR', 'sao': 'SAO', 'srv': 'SRV', 'txt': 'TXT'} %}
+				{{ select('new-smon-dns_record_type', values=check_types, selected='a') }}</div>
+</div>
+<div class="check-field smon_smtp_check smon_rabbit_check">
+<label class="check-field-label" for="new-smon-username">{{lang.words.username|title()}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-username', placeholder='example@example.com') }}</div>
+</div>
+<div class="check-field smon_smtp_check smon_rabbit_check">
+<label class="check-field-label" for="new-smon-password">{{lang.words.password|title()}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-password', type='password') }}</div>
+</div>
+<div class="check-field smon_rabbit_check">
+<label class="check-field-label" for="new-smon-vhost">VHost
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-vhost', type='text', value='/') }}</div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-place">{{ c.locations }}
+				<span class="need-field">*</span></label>
+<div class="check-field-control"><select name="new-smon-place" id="new-smon-place">
                     <option value="all">{{ lang.words.all|title() }} {{ lang.words.regions }}</option>
                     <option value="country">{{ lang.words.countries|title() }}</option>
                     <option value="region">{{ lang.words.regions|title() }}</option>
                     <option value="agent">{{ lang.words.agents|title() }}</option>
-                </select>
-			</td>
-		</tr>
-        <tr style="display: none;" id="agent_tr">
-            <td colspan="2" colspan="2">
-            <div class="country">
+                </select></div>
+</div>
+<div id="agent_tr" class="check-field check-field-wide" style="display: none;"><div class="check-entity-headings"><span>{{ c.available }}</span><span>{{ c.selected }}</span></div><div class="country">
                 <div id="checked-entities" class="enabled-check" style="height: auto"></div>
                 <div id="all-entities" style="height: auto"></div>
+            </div></div>
             </div>
-            </td>
-        </tr>
-		<tr>
-			<td colspan="2" class="padding20">
-				{{lang.words.checking|title()}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{% set check_types = {'dns': 'DNS', 'ping': 'Ping', 'smtp': 'SMTP', 'rabbitmq': 'RabbitMQ', 'tcp': 'TCP', 'http': 'HTTP(s)'} %}
-				{{ select('check_type', values=check_types, selected='http') }}
-			</td>
-		</tr>
-		<tr>
-			<td colspan="2" class="padding20" title="{{ lang.phrases.check_interval_title }}">
-				{{lang.phrases.check_interval}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-interval', value='120', type='number', placeholder='120', title=lang.phrases.check_interval_title, style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="new_smon_hostname">
-			<td colspan="2" class="padding20">
-				{{lang.words.Hostname}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-ip', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="smon_ping_check">
-			<td colspan="2" class="padding20">
-				{{lang.smon_page.desc.packet_size}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-packet_size', value='56', type='number', placeholder='56', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="smon_ping_check">
-			<td colspan="2" class="padding20">
-				{{lang.smon_page.desc.count_packets}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-count_packets', value='5', type='number', placeholder='5', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="smon_ping_check">
-			<td colspan="2" class="padding20">
-				{{lang.smon_page.desc.use_kernel_timestamp}}
-			</td>
-			<td colspan="2">
-				{{ checkbox('new-smon-use_kernel_timestamp') }}
-                <div class="tooltip" style="padding: 0">{{ lang.smon_page.desc.use_kernel_timestamp_desc }}</div>
-			</td>
-		</tr>
-		<tr class="smon_dns_check">
-			<td colspan="2" class="padding20">
-				Resolver {{lang.words.server}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-resolver-server', value='8.8.8.8', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="smon_tcp_check smon_dns_check smon_smtp_check smon_rabbit_check">
-			<td colspan="2" class="padding20">
-				{{lang.words.port|title()}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-port', type='number', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="smon_smtp_check smon_rabbit_check">
-			<td colspan="2" class="padding20">
-				{{lang.words.username|title()}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-username', placeholder='example@example.com', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="smon_smtp_check smon_rabbit_check">
-			<td colspan="2" class="padding20">
-				{{lang.words.password|title()}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-password', type='password', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr class="smon_rabbit_check">
-			<td colspan="2" class="padding20">
-				VHost
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-vhost', type='vhost', value='/', style="width: 240px;") }}
-			</td>
-		</tr>
-		<tr>
-			<td colspan="2" class="padding20">
-				{{lang.words.timeout|title()}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-timeout', type='number', style="width: 240px;", value=10) }}
-			</td>
-		</tr>
-			<td colspan="2" class="padding20">
-				{{lang.words.Retries}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-retries', type='number', style="width: 240px;", value=3) }}
-                <div class="tooltip" style="padding: 0">{{ lang.smon_page.desc.retries_desc }}</div>
-			</td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">
-				URL
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">{{ input('new-smon-url', value='https://', title='proto://url[:port]/', placeholder='proto://url[:port]/', style="width: 240px;") }}</td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">
-				{{ lang.smon_page.desc.resolve_to_ip }}
-			</td>
-			<td colspan="2">{{ input('new-smon-resole_to_ip', title='IPv4 or IPv6', placeholder='1.1.1.1', style="width: 240px;") }}</td>
-		</tr>
-        <tr class="smon_http_check">
-            <td colspan="2" class="padding20">
-                {{lang.words.headers|title()}} {{lang.words.response}}
-            </td>
-            <td colspan="2" id="smon_http_check_headers_response">
-                <select id="smon_http_check_headers_response_type">
+        </section>
+        <section role="tabpanel" id="check-editor-step-1" aria-labelledby="check-editor-tab-1" data-step="1" hidden>
+            <h3>{{ c.settings }}</h3><p class="field-help">{{ c.settings_hint }}</p>
+            <div class="check-fields">
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-interval">{{lang.phrases.check_interval}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-interval', value='120', type='number', placeholder='120', title=lang.phrases.check_interval_title) }}</div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-timeout">{{lang.words.timeout|title()}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-timeout', type='number', value=10) }}</div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-retries">{{lang.words.Retries}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-retries', type='number', value=3) }}
+                <div class="tooltip" style="padding: 0">{{ lang.smon_page.desc.retries_desc }}</div></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-threshold_timeout">{{ lang.phrases.threshold_timeout }}</label>
+<div class="check-field-control">{{ input('new-smon-threshold_timeout', value=0) }}
+                <div class="tooltip" style="padding: 0">{{ lang.phrases.threshold_timeout_desc }}</div></div>
+</div>
+<div class="check-field smon_ping_check">
+<label class="check-field-label" for="new-smon-packet_size">{{lang.smon_page.desc.packet_size}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-packet_size', value='56', type='number', placeholder='56') }}</div>
+</div>
+<div class="check-field smon_ping_check">
+<label class="check-field-label" for="new-smon-count_packets">{{lang.smon_page.desc.count_packets}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-count_packets', value='5', type='number', placeholder='5') }}</div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-status-code">{{lang.phrases.accepted_status_code}}
+				<span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-status-code') }}</div>
+</div>
+            </div>
+<details class="check-advanced smon_http_check smon_smtp_check"><summary>{{ c.request }}</summary><div class="check-fields"><div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-method">HTTP {{lang.words.method}}</label>
+<div class="check-field-control">{% set http_methods = {'get': 'GET', 'post': 'POST', 'put': 'PUT', 'head': 'HEAD', 'patch': 'PATCH', 'delete': 'DELETE', 'options': 'OPTIONS'} %}
+				{{ select('new-smon-method', values=http_methods, selected='get') }}</div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-http_version">{{ lang.words.check|title() }} HTTP {{ lang.words.version }}</label>
+<div class="check-field-control">{% set http_versions = {'0': 'None', 1: '1.1', 2: '1.1', 3: '2', 4: '3'} %}
+				{{ select('new-smon-http_version', values=http_versions, selected='0') }}</div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="new-smon-body-req">{{lang.words.body|title()}} {{lang.words.request}}</label>
+<div class="check-field-control"><textarea id="new-smon-body-req" cols="50" rows="5" class="form-control" title="JSON only" placeholder="Example:
+{
+    &quot;key&quot;: &quot;value&quot;
+}"></textarea></div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="new-smon-header-req">{{lang.words.headers|title()}} {{lang.words.request}}</label>
+<div class="check-field-control"><textarea id="new-smon-header-req" cols="50" rows="5" class="form-control" title="JSON only" placeholder="Example:
+{
+    &quot;Header&quot;: &quot;Value&quot;
+}"></textarea></div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-resole_to_ip">{{ lang.smon_page.desc.resolve_to_ip }}</label>
+<div class="check-field-control">{{ input('new-smon-resole_to_ip', title='IPv4 or IPv6', placeholder='1.1.1.1') }}</div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-redirects">{{lang.smon_page.desc.redirects}}</label>
+<div class="check-field-control">{{ input('new-smon-redirects', type='number', value=10) }}
+                <div class="tooltip" style="padding: 0">{{ lang.smon_page.desc.redirects_desc }}</div></div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="new-smon-ssl_policy">{{ c.ssl_policy }}</label>
+<div class="check-field-control">
+<select id="new-smon-ssl_policy" aria-describedby="ssl-policy-hint">
+    <option value="default" selected>{{ c.ssl_policy_default }}</option>
+    <option value="require_https">{{ c.ssl_policy_https }}</option>
+    <option value="require_http">{{ c.ssl_policy_http }}</option>
+</select>
+<div class="tooltip" id="ssl-policy-hint">{{ c.ssl_policy_hint }}</div>
+</div>
+</div>
+<div class="check-field smon_http_check smon_smtp_check"><div class="check-field-label">{{lang.phrases.ignore_ssl_error}}</div><div class="check-field-control">{{ checkbox('new-smon-ignore_ssl_error') }}</div></div>
+<div class="check-field smon_http_check"><div class="check-field-label">{{ lang.words.accept|title() }} cookies</div><div class="check-field-control">{{ checkbox('new-smon-accept_cookies', checked='checked') }}</div></div></div></details>
+<details class="check-advanced smon_http_check"><summary>{{ c.response }}</summary><div class="check-fields"><div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="smon_http_check_headers_response_type">{{lang.words.headers|title()}} {{lang.words.response}}</label>
+<div class="check-field-control" id="smon_http_check_headers_response"><select id="smon_http_check_headers_response_type">
                     <option value="0">None</option>
                     <option value="check">{{lang.words.check|title()}}</option>
                 </select>
@@ -216,118 +197,63 @@
                     <textarea id="new-smon-header-response-forbidden" cols="50" rows="5" class="form-control" title="Forbidden headers" placeholder="Forbidden headers example:
     &quot;Header&quot;, &quot;Header2&quot;
 "></textarea>
-                </div>
-            </td>
-        </tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">
-                {{lang.words.body|title()}} {{lang.words.response}}
-            </td>
-			<td colspan="2">
-                <select id="smon_http_check_body_type">
+                </div></div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="smon_http_check_body_type">{{lang.words.body|title()}} {{lang.words.response}}</label>
+<div class="check-field-control"><select id="smon_http_check_body_type">
                     <option value="0">None</option>
                     <option value="keyword">Keyword</option>
                     <option value="json">JSON Path</option>
                 </select>
                 <div class="smon_http_check_body_type_keyword" style="display: none;margin-bottom: 10px;margin-top: 10px;">
-                    {{ input('new-smon-body-keyword', style="width: 240px;") }}
+                    {{ input('new-smon-body-keyword') }}
 				    <span class="need-field">*</span>
                 </div>
                 <div class="smon_http_check_body_type_json" style="display: none; margin-bottom: 10px;margin-top: 10px;">
-                    {{ input('new-smon-body-json-path', style="width: 240px;", placeholder="Example: $.foo") }}
+                    {{ input('new-smon-body-json-path', placeholder="Example: $.foo") }}
 				    <span class="need-field">*</span>
                     <div class="tooltip" style="padding: 0">
                         Check out <a href="https://jsonata.org/" target="_blank">jsonata.org</a>
                         for the documentation about the query language. A playground can be found <a href="https://try.jsonata.org/" target="_blank">here</a>.
                     </div>
-                    {{ input('new-smon-body-json-value', style="width: 240px;", placeholder="Example: \"bar\"") }}
+                    {{ input('new-smon-body-json-value', placeholder="Example: \"bar\"") }}
                     <div class="tooltip" style="padding: 0">Leave value empty, if want to check only path</div>
-                </div>
-            </td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">HTTP {{lang.words.method}}</td>
-			<td colspan="2">
-				{% set http_methods = {'get': 'GET', 'post': 'POST', 'put': 'PUT', 'head': 'HEAD', 'patch': 'PATCH', 'delete': 'DELETE', 'options': 'OPTIONS'} %}
-				{{ select('new-smon-method', values=http_methods, selected='get') }}
-			</td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">{{ lang.words.check|title() }} HTTP {{ lang.words.version }}</td>
-			<td colspan="2">
-				{% set http_versions = {'0': 'None', 1: '1.1', 2: '1.1', 3: '2', 4: '3'} %}
-				{{ select('new-smon-http_version', values=http_versions, selected='0') }}
-			</td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">{{lang.words.body|title()}} {{lang.words.request}}</td>
-			<td colspan="2">
-				<textarea id="new-smon-body-req" cols="50" rows="5" class="form-control" title="JSON only" placeholder="Example:
-{
-    &quot;key&quot;: &quot;value&quot;
-}"></textarea>
-			</td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">{{lang.words.headers|title()}} {{lang.words.request}}</td>
-			<td colspan="2">
-				<textarea id="new-smon-header-req" cols="50" rows="5" class="form-control" title="JSON only" placeholder="Example:
-{
-    &quot;Header&quot;: &quot;Value&quot;
-}"></textarea>
-			</td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">
-				{{lang.phrases.accepted_status_code}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-status-code') }}
-			</td>
-		</tr>
-		<tr class="smon_http_check">
-			<td colspan="2" class="padding20">
-				{{lang.smon_page.desc.redirects}}
-			</td>
-			<td colspan="2">
-				{{ input('new-smon-redirects', type='number', style="width: 240px;", value=10) }}
-                <div class="tooltip" style="padding: 0">{{ lang.smon_page.desc.redirects_desc }}</div>
-			</td>
-		</tr>
-		<tr class="smon_http_check smon_smtp_check">
-			<td class="padding20">{{lang.phrases.ignore_ssl_error}}</td>
-			<td>
-				{{ checkbox('new-smon-ignore_ssl_error') }}
-			</td>
-			<td class="padding20" style="padding-left: 150px;">{{ lang.words.accept|title() }} cookies</td>
-			<td>
-				{{ checkbox('new-smon-accept_cookies', checked='checked') }}
-			</td>
-		</tr>
-		<tr class="smon_dns_check">
-			<td colspan="2" class="padding20">
-				{{lang.phrases.resource_record_type}}
-				<span class="need-field">*</span>
-			</td>
-			<td colspan="2">
-				{% set check_types = {'a': 'A', 'aaa': 'AAA', 'caa': 'CAA', 'cname': 'CNAME', 'mx': 'MX', 'ns': 'NS',
-				'ptr': 'PTR', 'sao': 'SAO', 'srv': 'SRV', 'txt': 'TXT'} %}
-				{{ select('new-smon-dns_record_type', values=check_types, selected='a') }}
-			</td>
-		</tr>
-    </table>
-    <table class="overview" style="border-left: 1px solid #ddd;margin-left: 10px;">
-		<tr>
-			<td class="padding20">{{lang.words.enable|title()}}</td>
-			<td>
-				{{ checkbox('new-smon-enable', checked='checked') }}
-			</td>
-		</tr>
-        <tr class="smon_http_check">
-            <td class="padding20">Proxy</td>
-            <td>
-				<select id="smon_http_check_proxy_method">
+                </div></div>
+</div></div></details>
+<details class="check-advanced smon_http_check"><summary>{{ c.authentication }}</summary><div class="check-fields"><div class="check-field smon_http_check">
+<label class="check-field-label" for="smon_http_check_auth_method">Authentication method</label>
+<div class="check-field-control"><select id="smon_http_check_auth_method">
+                    <option value="0">None</option>
+                    <option value="basic">Basic</option>
+                    <option value="mtls">MTLS</option>
+                </select></div>
+</div>
+<div class="check-field smon_http_check_basic" style="display: none;">
+<label class="check-field-label" for="new-smon-basic_username">{{ lang.words.username|title() }}</label>
+<div class="check-field-control">{{ input('new-smon-basic_username') }}</div>
+</div>
+<div class="check-field smon_http_check_basic" style="display: none;">
+<label class="check-field-label" for="new-smon-basic_password">{{ lang.words.password|title() }}</label>
+<div class="check-field-control">{{ input('new-smon-basic_password', type='password') }}</div>
+</div>
+<div class="check-field smon_http_check_mtls check-field-wide" style="display: none;">
+<label class="check-field-label" for="new-smon-mtls_key">Key
+				<span class="need-field">*</span></label>
+<div class="check-field-control"><textarea id="new-smon-mtls_key" cols="50" rows="5" class="form-control" placeholder="Key body"></textarea></div>
+</div>
+<div class="check-field smon_http_check_mtls check-field-wide" style="display: none;">
+<label class="check-field-label" for="new-smon-mtls_cert">Cert
+				<span class="need-field">*</span></label>
+<div class="check-field-control"><textarea id="new-smon-mtls_cert" cols="50" rows="5" class="form-control" placeholder="Cert body"></textarea></div>
+</div>
+<div class="check-field smon_http_check_mtls check-field-wide" style="display: none;">
+<label class="check-field-label" for="new-smon-mtls_ca">CA</label>
+<div class="check-field-control"><textarea id="new-smon-mtls_ca" cols="50" rows="5" class="form-control" placeholder="CA body"></textarea></div>
+</div></div></details>
+<details class="check-advanced smon_http_check"><summary>{{ c.proxy }}</summary><div class="check-fields"><div class="check-field smon_http_check">
+<label class="check-field-label" for="smon_http_check_proxy_method">Proxy</label>
+<div class="check-field-control"><select id="smon_http_check_proxy_method">
                     <option value="0">None</option>
                     <option value="http">http</option>
                     <option value="https">https</option>
@@ -335,177 +261,114 @@
                     <option value="socks4a">socks4a</option>
                     <option value="socks5">socks5</option>
                     <option value="socks5h">socks5h</option>
-                </select>
-			</td>
-        </tr>
-        <tr class="smon_http_check_proxy" style="display: none;">
-            <td class="padding20">
-                Host {{ lang.words.and }} {{ lang.words.port }}
-                <span class="need-field">*</span>
-            </td>
-            <td>
-                {{ input('new-smon-http_proxy_host', placeholder='proxy-server.com') }} {{ input('new-smon-http_proxy_port', placeholder='3128') }}
-            </td>
-        </tr>
-        <tr class="smon_http_check_proxy" style="display: none;">
-            <td class="padding20">
-                Authentication
-            </td>
-            <td>
-                {{ input('new-smon-http_proxy_username', placeholder='username') }}
-                {{ input('new-smon-http_proxy_password', placeholder='password', type='password') }}
-            </td>
-        </tr>
-		<tr class="smon_http_check">
-			<td class="padding20">Authentication method</td>
-			<td>
-				<select id="smon_http_check_auth_method">
-                    <option value="0">None</option>
-                    <option value="basic">Basic</option>
-                    <option value="mtls">MTLS</option>
-                </select>
-			</td>
-		</tr>
-		<tr class="smon_http_check_mtls" style="display: none;">
-			<td class="padding20">
-                Key
-				<span class="need-field">*</span>
-            </td>
-			<td>
-				<textarea id="new-smon-mtls_key" cols="50" rows="5" class="form-control" placeholder="Key body"></textarea>
-			</td>
-		</tr>
-		<tr class="smon_http_check_mtls" style="display: none;">
-			<td class="padding20">
-                Cert
-				<span class="need-field">*</span>
-            </td>
-			<td>
-				<textarea id="new-smon-mtls_cert" cols="50" rows="5" class="form-control" placeholder="Cert body"></textarea>
-			</td>
-		</tr>
-		<tr class="smon_http_check_mtls" style="display: none;">
-			<td class="padding20">CA</td>
-			<td>
-				<textarea id="new-smon-mtls_ca" cols="50" rows="5" class="form-control" placeholder="CA body"></textarea>
-			</td>
-		</tr>
-		<tr class="smon_http_check_basic" style="display: none;">
-			<td class="padding20">{{ lang.words.username|title() }}</td>
-			<td>
-                {{ input('new-smon-basic_username') }}
-			</td>
-		</tr>
-		<tr class="smon_http_check_basic" style="display: none;">
-			<td class="padding20">{{ lang.words.password|title() }}</td>
-			<td>
-                {{ input('new-smon-basic_password', type='password') }}
-			</td>
-		</tr>
-
-        <tr>
-            <td class="padding20">{{ lang.phrases.expiration_date }}</td>
-            <td>
-                {{ input('new-smon-expiration', placeholder="YYYY-MM-DD HH:MM") }}
-                <div class="tooltip" style="padding: 0">{{ lang.words.time|title() }} UTC</div>
-            </td>
-        </tr>
-        <tr>
-            <td class="padding20">{{ lang.phrases.threshold_timeout }}</td>
-            <td>
-                {{ input('new-smon-threshold_timeout', value=0) }}
-                <div class="tooltip" style="padding: 0">{{ lang.phrases.threshold_timeout_desc }}</div>
-            </td>
-        </tr>
-		<tr>
-			<td class="padding20">Telegram</td>
-			<td>
-				<select id="new-smon-telegram">
+                </select></div>
+</div>
+<div class="check-field smon_http_check_proxy" style="display: none;">
+<label class="check-field-label" for="new-smon-http_proxy_host">Host {{ lang.words.and }} {{ lang.words.port }}
+                <span class="need-field">*</span></label>
+<div class="check-field-control">{{ input('new-smon-http_proxy_host', placeholder='proxy-server.com') }} {{ input('new-smon-http_proxy_port', placeholder='3128') }}</div>
+</div>
+<div class="check-field smon_http_check_proxy" style="display: none;">
+<label class="check-field-label" for="new-smon-http_proxy_username">Authentication</label>
+<div class="check-field-control">{{ input('new-smon-http_proxy_username', placeholder='username') }}
+                {{ input('new-smon-http_proxy_password', placeholder='password', type='password') }}</div>
+</div></div></details>
+<details class="check-advanced "><summary>{{ c.extra }}</summary><div class="check-fields"><div class="check-field smon_ping_check">
+<label class="check-field-label" for="new-smon-use_kernel_timestamp">{{lang.smon_page.desc.use_kernel_timestamp}}</label>
+<div class="check-field-control">{{ checkbox('new-smon-use_kernel_timestamp') }}
+                <div class="tooltip" style="padding: 0">{{ lang.smon_page.desc.use_kernel_timestamp_desc }}</div></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-expiration">{{ lang.phrases.expiration_date }}</label>
+<div class="check-field-control">{{ input('new-smon-expiration', placeholder="YYYY-MM-DD HH:MM") }}
+                <div class="tooltip" style="padding: 0">{{ lang.words.time|title() }} UTC</div></div>
+</div></div></details>
+        </section>
+        <section role="tabpanel" id="check-editor-step-2" aria-labelledby="check-editor-tab-2" data-step="2" hidden>
+            <h3>{{ c.notifications }}</h3><p class="field-help">{{ c.notifications_hint }}</p>
+            <div id="check-editor-summary" class="check-editor-summary" aria-live="polite"></div>
+            <div class="check-fields">
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-telegram">Telegram</label>
+<div class="check-field-control"><select id="new-smon-telegram">
 					<option value="0">{{lang.words.disabled|title()}}</option>
 				{% for t in telegrams %}
 					<option value="{{t.id}}">{{t.channel_name.replace("'", "")}}</option>
 				{% endfor %}
-				</select>
-			</td>
-		</tr>
-		<tr>
-			<td class="padding20">Slack</td>
-			<td>
-				<select id="new-smon-slack">
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-slack">Slack</label>
+<div class="check-field-control"><select id="new-smon-slack">
 					<option value="0">{{lang.words.disabled|title()}}</option>
 				{% for t in slacks %}
 					<option value="{{t.id}}">{{t.channel_name.replace("'", "")}}</option>
 				{% endfor %}
-				</select>
-			</td>
-		</tr>
-		<tr>
-			<td class="padding20">PagerDuty</td>
-			<td>
-				<select id="new-smon-pd">
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-pd">PagerDuty</label>
+<div class="check-field-control"><select id="new-smon-pd">
 					<option value="0">{{lang.words.disabled|title()}}</option>
 				{% for t in pds %}
 					<option value="{{t.id}}">{{t.channel_name.replace("'", "")}}</option>
 				{% endfor %}
-				</select>
-			</td>
-		</tr>
-        <tr>
-			<td class="padding20">Mattermost</td>
-			<td>
-				<select id="new-smon-mm">
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-mm">Mattermost</label>
+<div class="check-field-control"><select id="new-smon-mm">
 					<option value="0">{{lang.words.disabled|title()}}</option>
 				{% for t in mms %}
 					<option value="{{t.id}}">{{t.channel_name.replace("'", "")}}</option>
 				{% endfor %}
-				</select>
-			</td>
-		</tr>
-        <tr>
-			<td class="padding20">IncidentRelay</td>
-			<td>
-				<select id="new-smon-incidentrelay">
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-incidentrelay">IncidentRelay</label>
+<div class="check-field-control"><select id="new-smon-incidentrelay">
 					<option value="0">{{lang.words.disabled|title()}}</option>
 				{% for t in incidentrelay %}
 					<option value="{{t.id}}">{{t.channel_name.replace("'", "")}}</option>
 				{% endfor %}
-				</select>
-			</td>
-		</tr>
-        <tr>
-			<td class="padding20">Email</td>
-			<td>
-				<select id="new-smon-email">
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-email">Email</label>
+<div class="check-field-control"><select id="new-smon-email">
 					<option value="0">{{lang.words.disabled|title()}}</option>
 				{% for t in emails %}
 					<option value="{{t.id}}">{{t.channel_name.replace("'", "")}}</option>
 				{% endfor %}
-				</select>
-			</td>
-		</tr>
-        <tr>
-			<td class="padding20">{{ lang.words.priority|title() }}</td>
-			<td>
-				<select id="new-smon-priority">
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-priority">{{ lang.words.priority|title() }}</label>
+<div class="check-field-control"><select id="new-smon-priority">
 					<option value="info">{{lang.words.info|title()}}</option>
 					<option value="warning">{{lang.words.warning|title()}}</option>
 					<option value="error">{{lang.words.error|title()}}</option>
 					<option value="critical" selected>{{lang.words.critical|title()}}</option>
-				</select>
-			</td>
-		</tr>
-		<tr>
-			<td class="padding20">{{lang.words.runbook|title()}}</td>
-			<td>{{ input('new-smon-runbook', style="width: 240px;", placeholder="https://wiki.example.com/runbook/help") }}</td>
-		</tr>
-		<tr>
-			<td class="padding20">{{lang.words.group|title()}}</td>
-			<td>{{ input('new-smon-group', style="width: 240px;") }}</td>
-		</tr>
-		<tr>
-			<td class="padding20">{{lang.words.desc|title()}}</td>
-			<td>{{ input('new-smon-description', style="width: 240px;") }}</td>
-		</tr>
-	</table>
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-runbook">{{lang.words.runbook|title()}}</label>
+<div class="check-field-control">{{ input('new-smon-runbook', placeholder="https://wiki.example.com/runbook/help") }}</div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-group">{{lang.words.group|title()}}</label>
+<div class="check-field-control">{{ input('new-smon-group') }}</div>
+</div>
+<div class="check-field  check-field-wide">
+<label class="check-field-label" for="new-smon-description">{{lang.words.desc|title()}}</label>
+<div class="check-field-control">{{ input('new-smon-description') }}</div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-enable">{{lang.words.enable|title()}}</label>
+<div class="check-field-control">{{ checkbox('new-smon-enable', checked='checked') }}</div>
+</div>
+            </div>
+        </section>
+    </form>
 </div>
 {% include 'include/del_confirm.html' %}
diff --git a/app/templates/languages/en.html b/app/templates/languages/en.html
index 99c13b3..d90aaeb 100644
--- a/app/templates/languages/en.html
+++ b/app/templates/languages/en.html
@@ -1,4 +1,30 @@
 {% set lang_short = 'en' %}
+{% set agent_transport = {
+    "section": "Agent connections",
+    "label": "Result delivery",
+    "preserve": "Keep current configuration",
+    "unknown": "Not yet verified",
+    "pending": "Changes pending application",
+    "checked": "Connection verified",
+    "help": "Uses the agent owner's group settings. Apply connection changes with Reconfigure. Configure the result server for the selected mode. The agent management API remains HTTP.",
+    "settings_help": "Certificate paths refer to files accessible to RMON inside this group's directory:",
+    "fields": {
+        "agent_result_transport": "Default connection",
+        "agent_tls_ca_file": "Trusted CA",
+        "agent_tls_generate": "Generate client certificates",
+        "agent_tls_ca_key_file": "CA signing key",
+        "agent_tls_cert_file": "Client certificate",
+        "agent_tls_key_file": "Client private key"
+    },
+    "descriptions": {
+        "agent_result_transport": "Default for newly installed agents. Existing agents keep their selected mode.",
+        "agent_tls_ca_file": "Path to the trusted CA bundle. Leave empty for HTTPS with system trust. Required for mTLS.",
+        "agent_tls_generate": "Issue a separate client certificate for each agent when a pair is missing.",
+        "agent_tls_ca_key_file": "Path to the CA signing key for certificate generation. The key stays in RMON.",
+        "agent_tls_cert_file": "Path to an existing client certificate. Use {uuid} for an individual file for each agent.",
+        "agent_tls_key_file": "Path to the matching client private key. Supports {uuid}."
+    }
+} %}
 {% set menu_links = dict() %}
 {% set menu_links = {
     "overview": {
@@ -45,15 +71,6 @@
     }
 %}
 {% set settings = {
-    "rabbitmq": {
-        "rabbitmq_enabled": "Enable alerting in the WEB panel",
-        "rabbitmq_host": "RabbitMQ-server host",
-        "rabbitmq_port": "RabbitMQ-server port",
-        "rabbitmq_vhost": "RabbitMQ-server vhost",
-        "rabbitmq_queue": "RabbitMQ-server queue",
-        "rabbitmq_user": "RabbitMQ-server user",
-        "rabbitmq_password": "RabbitMQ-server password",
-        },
     "monitoring": {
         "port_scan_interval": "Check interval for Port scanner (in minutes)",
         "portscanner_keep_history_range": "Retention period for Port scanner history",
@@ -166,7 +183,6 @@
     "alert_master_backup": "Alert about changing Master/Backup status",
     "new_version": "There is a new version RMON. Check the",
     "all_alerts_enabled": "Alerts are enabled",
-    "disable_alerts": "Disable alerting",
     "work_with_prev": "Here you can work with previous versions of configs",
     "roll_back": "Roll back to them, view or delete",
     "files_been_deleted": "The following files have been deleted",
@@ -240,7 +256,6 @@
         "auto_start_desc": "The Auto Start service allows to restart the HAProxy, NGINX, Apache and Keepalived services if they are down",
         "metrics_desc": "Collects number of connections for HAProxy, NGINX, Apache and HAProxy WAF services",
         "p_s_desc": "Checks the server for open ports and saves history",
-        "socket_desc": "Socket is a service for sending alerts and notifications",
         "a_new_version": "There is a newer version",
         "no_new_version": "There is not a newer version",
         "main_app": "The main application",
@@ -602,7 +617,6 @@
     "test2": "test",
     "disabled": "disabled",
     "via": "via",
-    "web_panel": "web panel",
     "message": "message",
     "menu": "menu",
     "language": "language",
@@ -773,3 +787,92 @@
     "accept": "accept",
     }
 %}
+
+{% set ux = {
+    "skip_content": "Skip to content",
+    "toggle_menu": "Toggle navigation",
+    "close_menu": "Close navigation",
+    "retry": "Try again",
+    "loading": "Loading…",
+    "widget_error": "This information is temporarily unavailable.",
+    "network_error": "Cannot reach RMON. Check your connection and try again.",
+    "request_error": "The request could not be completed. Please try again.",
+    "server_error": "RMON could not complete this request. Try again shortly.",
+    "validation_error": "Check the required fields and their values, then try again.",
+    "unauthorized": "Your session has expired. Sign in again to continue.",
+    "forbidden": "You do not have permission to perform this action.",
+    "not_found": "This item is no longer available. Refresh the page.",
+    "conflict": "This item has changed or already exists. Refresh and try again.",
+    "rate_limit": "Too many requests. Wait a moment and try again.",
+    "login_failed": "Login or password is incorrect, or this account is disabled.",
+    "show_password": "Show password",
+    "hide_password": "Hide password",
+    "no_checks": "No checks yet",
+    "no_checks_description": "Add your first check to monitor availability and receive alerts.",
+    "no_status_pages": "No status pages yet",
+    "no_status_pages_description": "Create a public page to share the availability of your monitored services.",
+    "slug_hint": "Use lowercase letters, numbers, underscores or dashes. Consecutive dashes are not allowed.",
+    "table_label": "Data table. Scroll horizontally to see all columns.",
+    "name_required": "Enter a name.",
+    "slug_invalid": "Enter a valid URL slug.",
+    "edit": "Edit",
+    "delete": "Delete",
+    "action": "Action",
+    "service_not_installed": "Not installed",
+    "service_version_unknown": "Version unavailable"
+} %}
+
+
+{% set check_editor = {
+    "ssl_policy": "HTTPS policy",
+    "ssl_policy_default": "Default",
+    "ssl_policy_https": "Require HTTPS",
+    "ssl_policy_http": "Require HTTP",
+    "ssl_policy_hint": "Checks the final URL after allowed redirects. HTTPS to HTTP is always an error, including in Default mode. Ignoring certificate errors does not disable this policy.",
+    "create": "Create check",
+    "edit": "Edit check",
+    "sections": "Check setup",
+    "target": "Check",
+    "settings": "Settings",
+    "notifications": "Notifications",
+    "intro": "Start with the target. Defaults are ready to use; tune advanced settings only when needed.",
+    "target_hint": "Choose what to monitor and where to run the check.",
+    "settings_hint": "Intervals and timeouts are in seconds. Expand the blocks below for advanced settings.",
+    "notifications_hint": "Choose notification channels or leave them disabled. You can change these settings later.",
+    "locations": "Run checks from",
+    "available": "Available",
+    "selected": "Selected",
+    "request": "Request and connection",
+    "response": "Response validation",
+    "authentication": "Authentication",
+    "proxy": "Proxy",
+    "extra": "Additional settings",
+    "back": "Back",
+    "next": "Next",
+    "save": "Save changes",
+    "saving": "Saving…",
+    "required": "Fill in this field.",
+    "invalid_url": "Enter an HTTP or HTTPS URL with a hostname.",
+    "number": "Enter a number in the allowed range.",
+    "port": "Enter a port from 2 to 65535.",
+    "timeout": "The timeout must be shorter than the interval.",
+    "ping_timeout": "Packet count × timeout must be shorter than the interval.",
+    "entities": "Select at least one location.",
+    "status_codes": "Add at least one accepted HTTP status code.",
+    "json": "Enter a valid JSON object.",
+    "save_error": "The check was not saved. Your input is still here; review the fields and try again.",
+    "loading": "Loading check settings…",
+    "load_error": "Unable to load the check. Close this window and try again.",
+    "copy": "copy",
+    "disabled": "Disabled",
+    "summary": "Review",
+    "seconds": "s",
+    "summary_empty": "Choose a target",
+    "no_channels": "Notifications are disabled",
+    "json_path": "JSON path",
+    "json_value": "Expected JSON value",
+    "proxy_host": "Proxy hostname",
+    "proxy_port": "Proxy port",
+    "proxy_username": "Proxy username",
+    "proxy_password": "Proxy password"
+} %}
diff --git a/app/templates/languages/fr.html b/app/templates/languages/fr.html
index 2e4456b..2814db0 100644
--- a/app/templates/languages/fr.html
+++ b/app/templates/languages/fr.html
@@ -1,4 +1,30 @@
 {% set lang_short = 'fr' %}
+{% set agent_transport = {
+    "section": "Agent connections",
+    "label": "Result delivery",
+    "preserve": "Keep current configuration",
+    "unknown": "Not yet verified",
+    "pending": "Changes pending application",
+    "checked": "Connection verified",
+    "help": "Uses the agent owner's group settings. Apply connection changes with Reconfigure. Configure the result server for the selected mode. The agent management API remains HTTP.",
+    "settings_help": "Certificate paths refer to files accessible to RMON inside this group's directory:",
+    "fields": {
+        "agent_result_transport": "Default connection",
+        "agent_tls_ca_file": "Trusted CA",
+        "agent_tls_generate": "Generate client certificates",
+        "agent_tls_ca_key_file": "CA signing key",
+        "agent_tls_cert_file": "Client certificate",
+        "agent_tls_key_file": "Client private key"
+    },
+    "descriptions": {
+        "agent_result_transport": "Default for newly installed agents. Existing agents keep their selected mode.",
+        "agent_tls_ca_file": "Path to the trusted CA bundle. Leave empty for HTTPS with system trust. Required for mTLS.",
+        "agent_tls_generate": "Issue a separate client certificate for each agent when a pair is missing.",
+        "agent_tls_ca_key_file": "Path to the CA signing key for certificate generation. The key stays in RMON.",
+        "agent_tls_cert_file": "Path to an existing client certificate. Use {uuid} for an individual file for each agent.",
+        "agent_tls_key_file": "Path to the matching client private key. Supports {uuid}."
+    }
+} %}
 {% set menu_links = dict() %}
 {% set menu_links = {
     "overview": {
@@ -45,15 +71,6 @@
     }
 %}
 {% set settings = {
-    "rabbitmq": {
-        "rabbitmq_enabled": "Activer les alertes dans le panneau WEB",
-        "rabbitmq_host": "RabbitMQ-server serveur",
-        "rabbitmq_port": "RabbitMQ-server port",
-        "rabbitmq_vhost": "RabbitMQ-server vhost",
-        "rabbitmq_queue": "RabbitMQ-server queue",
-        "rabbitmq_user": "RabbitMQ-server utilisateur",
-        "rabbitmq_password": "RabbitMQ-server mot de passe",
-        },
     "monitoring": {
         "port_scan_interval": "Interval de vérification pour le scanner de Port (en minutes)",
         "portscanner_keep_history_range": "Période de rétention pour l\'historiques le scanner de Port",
@@ -166,7 +183,6 @@
     "alert_master_backup": "Alert about changing Master/Backup status",
     "new_version": "Il y a une nouvelle version RMON. Vérifiez le",
     "all_alerts_enabled": "Les alertes sont activées",
-    "disable_alerts": "Désactiver les alertes",
     "work_with_prev": "Ici, vous pouvez travailler avec les versions précédentes des configurations",
     "roll_back": "Revenir en arrière, afficher ou supprimer",
     "files_been_deleted": "Les fichiers suivants ont été supprimés",
@@ -240,7 +256,6 @@
         "auto_start_desc": "Le service Auto Start permet de redémarrer les services HAProxy, NGINX, Apache et Keepalived s\'ils sont hors service.",
         "metrics_desc": "Collecte du nombre de connexions pour les services HAProxy, NGINX, Apache et HAProxy WAF",
         "p_s_desc": "Vérifie les ports ouverts du serveur et enregistre l\'historique.",
-        "socket_desc": "Socket est un service permettant d\'envoyer des alertes et des notifications.",
         "a_new_version": "Il existe une version plus récente",
         "no_new_version": "Il n\'existe pas de version plus récente",
         "main_app": "Application principale",
@@ -602,7 +617,6 @@
     "test2": "test",
     "disabled": "désactivé",
     "via": "via",
-    "web_panel": "volet webl",
     "message": "message",
     "menu": "menu",
     "language": "langage",
@@ -773,3 +787,92 @@
     "accept": "accepter",
     }
 %}
+
+{% set ux = {
+    "skip_content": "Aller au contenu",
+    "toggle_menu": "Afficher ou masquer le menu",
+    "close_menu": "Fermer le menu",
+    "retry": "Réessayer",
+    "loading": "Chargement…",
+    "widget_error": "Ces informations sont temporairement indisponibles.",
+    "network_error": "Connexion à RMON impossible. Vérifiez votre connexion.",
+    "request_error": "La demande n’a pas abouti. Veuillez réessayer.",
+    "server_error": "RMON n’a pas pu traiter la demande. Réessayez plus tard.",
+    "validation_error": "Vérifiez les champs obligatoires et leurs valeurs.",
+    "unauthorized": "Votre session a expiré. Connectez-vous à nouveau.",
+    "forbidden": "Vous n’avez pas l’autorisation d’effectuer cette action.",
+    "not_found": "Cet élément n’est plus disponible. Actualisez la page.",
+    "conflict": "Cet élément a changé ou existe déjà. Actualisez la page.",
+    "rate_limit": "Trop de demandes. Réessayez dans un instant.",
+    "login_failed": "Identifiant ou mot de passe incorrect, ou compte désactivé.",
+    "show_password": "Afficher le mot de passe",
+    "hide_password": "Masquer le mot de passe",
+    "no_checks": "Aucune vérification pour le moment",
+    "no_checks_description": "Ajoutez une vérification pour surveiller la disponibilité et recevoir des alertes.",
+    "no_status_pages": "Aucune page de statut pour le moment",
+    "no_status_pages_description": "Créez une page publique pour partager la disponibilité de vos services.",
+    "slug_hint": "Lettres minuscules, chiffres, tirets bas ou tirets. Pas de tirets consécutifs.",
+    "table_label": "Tableau de données. Faites défiler horizontalement pour voir toutes les colonnes.",
+    "name_required": "Saisissez un nom.",
+    "slug_invalid": "Saisissez une adresse de page valide.",
+    "edit": "Modifier",
+    "delete": "Supprimer",
+    "action": "Action",
+    "service_not_installed": "Non installé",
+    "service_version_unknown": "Version indisponible"
+} %}
+
+
+{% set check_editor = {
+    "ssl_policy": "Politique HTTPS",
+    "ssl_policy_default": "Par défaut",
+    "ssl_policy_https": "Exiger HTTPS",
+    "ssl_policy_http": "Exiger HTTP",
+    "ssl_policy_hint": "Vérifie l’adresse finale après les redirections autorisées. Un passage de HTTPS à HTTP est toujours une erreur, même en mode Par défaut. Ignorer les erreurs de certificat ne désactive pas cette politique.",
+    "create": "Créer une vérification",
+    "edit": "Modifier la vérification",
+    "sections": "Configuration",
+    "target": "Vérification",
+    "settings": "Paramètres",
+    "notifications": "Notifications",
+    "intro": "Commencez par la cible. Les valeurs par défaut sont prêtes ; développez les paramètres avancés si nécessaire.",
+    "target_hint": "Choisissez la cible et les emplacements d’exécution.",
+    "settings_hint": "Les intervalles et délais sont en secondes. Développez les blocs pour les paramètres avancés.",
+    "notifications_hint": "Choisissez les canaux ou laissez-les désactivés. Ces paramètres restent modifiables.",
+    "locations": "Emplacements",
+    "available": "Disponibles",
+    "selected": "Sélectionnés",
+    "request": "Requête et connexion",
+    "response": "Validation de la réponse",
+    "authentication": "Authentification",
+    "proxy": "Proxy",
+    "extra": "Paramètres supplémentaires",
+    "back": "Retour",
+    "next": "Suivant",
+    "save": "Enregistrer",
+    "saving": "Enregistrement…",
+    "required": "Remplissez ce champ.",
+    "invalid_url": "Saisissez une URL HTTP ou HTTPS avec un nom d’hôte.",
+    "number": "Saisissez un nombre dans la plage autorisée.",
+    "port": "Saisissez un port entre 2 et 65535.",
+    "timeout": "Le délai doit être inférieur à l’intervalle.",
+    "ping_timeout": "Nombre de paquets × délai doit être inférieur à l’intervalle.",
+    "entities": "Sélectionnez au moins un emplacement.",
+    "status_codes": "Ajoutez au moins un code HTTP accepté.",
+    "json": "Saisissez un objet JSON valide.",
+    "save_error": "La vérification n’a pas été enregistrée. Vos données sont conservées ; vérifiez les champs et réessayez.",
+    "loading": "Chargement des paramètres…",
+    "load_error": "Impossible de charger la vérification. Fermez cette fenêtre et réessayez.",
+    "copy": "copie",
+    "disabled": "Désactivé",
+    "summary": "Résumé",
+    "seconds": "s",
+    "summary_empty": "Choisissez une cible",
+    "no_channels": "Notifications désactivées",
+    "json_path": "Chemin JSON",
+    "json_value": "Valeur JSON attendue",
+    "proxy_host": "Hôte du proxy",
+    "proxy_port": "Port du proxy",
+    "proxy_username": "Utilisateur du proxy",
+    "proxy_password": "Mot de passe du proxy"
+} %}
diff --git a/app/templates/languages/pt-br.html b/app/templates/languages/pt-br.html
index b3ba445..e38005f 100644
--- a/app/templates/languages/pt-br.html
+++ b/app/templates/languages/pt-br.html
@@ -1,4 +1,30 @@
 {% set lang_short = 'pt-br' %}
+{% set agent_transport = {
+    "section": "Agent connections",
+    "label": "Result delivery",
+    "preserve": "Keep current configuration",
+    "unknown": "Not yet verified",
+    "pending": "Changes pending application",
+    "checked": "Connection verified",
+    "help": "Uses the agent owner's group settings. Apply connection changes with Reconfigure. Configure the result server for the selected mode. The agent management API remains HTTP.",
+    "settings_help": "Certificate paths refer to files accessible to RMON inside this group's directory:",
+    "fields": {
+        "agent_result_transport": "Default connection",
+        "agent_tls_ca_file": "Trusted CA",
+        "agent_tls_generate": "Generate client certificates",
+        "agent_tls_ca_key_file": "CA signing key",
+        "agent_tls_cert_file": "Client certificate",
+        "agent_tls_key_file": "Client private key"
+    },
+    "descriptions": {
+        "agent_result_transport": "Default for newly installed agents. Existing agents keep their selected mode.",
+        "agent_tls_ca_file": "Path to the trusted CA bundle. Leave empty for HTTPS with system trust. Required for mTLS.",
+        "agent_tls_generate": "Issue a separate client certificate for each agent when a pair is missing.",
+        "agent_tls_ca_key_file": "Path to the CA signing key for certificate generation. The key stays in RMON.",
+        "agent_tls_cert_file": "Path to an existing client certificate. Use {uuid} for an individual file for each agent.",
+        "agent_tls_key_file": "Path to the matching client private key. Supports {uuid}."
+    }
+} %}
 {% set menu_links = dict() %}
 {% set menu_links = {
     "overview": {
@@ -45,15 +71,6 @@
     }
 %}
 {% set settings = {
-    "rabbitmq": {
-        "rabbitmq_enabled": "Habilitar alertas no painel WEB",
-        "rabbitmq_host": "RabbitMQ-server host",
-        "rabbitmq_port": "RabbitMQ-server port",
-        "rabbitmq_vhost": "RabbitMQ-server vhost",
-        "rabbitmq_queue": "RabbitMQ-server queue",
-        "rabbitmq_user": "Usuario de RabbitMQ-server",
-        "rabbitmq_password": "Senha do RabbitMQ-server",
-        },
     "monitoring": {
         "port_scan_interval": "Intervalo de verificação para o Port scanner (em minutos)",
         "portscanner_keep_history_range": "Período de retenção de historico de Port scanner",
@@ -166,7 +183,6 @@
     "alert_master_backup": "Alerta sobre a alteração de estado do Master/Backup",
     "new_version": "Uma nova versão RMON apareceu. Verifica a",
     "all_alerts_enabled": "Alertas são ativadas",
-    "disable_alerts": "Desativar alertas",
     "work_with_prev": "Aqui você pode editar as versões anteriores de configurações",
     "roll_back": "Reverta para eles, visualize ou exclua",
     "files_been_deleted": "Os seguintes arquivos foram exluídos",
@@ -240,7 +256,6 @@
         "auto_start_desc": "O serviços Auto Start permite reiniciar os serviços HAProxy, NGINX, Apache e Keepalived se estiverem inoperantes",
         "metrics_desc": "Coleta o número de conexões para os serviços HAProxy, NGINX, Apache e HAProxy WAF",
         "p_s_desc": "Verifica se há portas abertas no servidor e salva o histórico",
-        "socket_desc": "Socket é um serviço de envio de alertas e notificações",
         "a_new_version": "Há uma versão mais recente",
         "no_new_version": "Nã há uma versão mais recente",
         "main_app": "O aplicativo principal",
@@ -602,7 +617,6 @@
     "test2": "test",
     "disabled": "desativado",
     "via": "via",
-    "web_panel": "painel web",
     "message": "mensagem",
     "menu": "menu",
     "language": "idioma",
@@ -773,3 +787,92 @@
     "accept": "aceitar",
     }
 %}
+
+{% set ux = {
+    "skip_content": "Ir para o conteúdo",
+    "toggle_menu": "Mostrar ou ocultar o menu",
+    "close_menu": "Fechar o menu",
+    "retry": "Tentar novamente",
+    "loading": "Carregando…",
+    "widget_error": "Estas informações estão temporariamente indisponíveis.",
+    "network_error": "Não foi possível conectar ao RMON. Verifique sua conexão.",
+    "request_error": "Não foi possível concluir a solicitação. Tente novamente.",
+    "server_error": "O RMON não pôde concluir a solicitação. Tente mais tarde.",
+    "validation_error": "Verifique os campos obrigatórios e seus valores.",
+    "unauthorized": "Sua sessão expirou. Entre novamente para continuar.",
+    "forbidden": "Você não tem permissão para esta ação.",
+    "not_found": "Este item não está mais disponível. Atualize a página.",
+    "conflict": "Este item mudou ou já existe. Atualize a página.",
+    "rate_limit": "Muitas solicitações. Aguarde e tente novamente.",
+    "login_failed": "Login ou senha incorretos, ou conta desativada.",
+    "show_password": "Mostrar senha",
+    "hide_password": "Ocultar senha",
+    "no_checks": "Ainda não há verificações",
+    "no_checks_description": "Adicione uma verificação para monitorar a disponibilidade e receber alertas.",
+    "no_status_pages": "Ainda não há páginas de status",
+    "no_status_pages_description": "Crie uma página pública para compartilhar a disponibilidade dos serviços.",
+    "slug_hint": "Letras minúsculas, números, sublinhados ou hífens. Hífens consecutivos não são permitidos.",
+    "table_label": "Tabela de dados. Role horizontalmente para ver todas as colunas.",
+    "name_required": "Digite um nome.",
+    "slug_invalid": "Digite um endereço de página válido.",
+    "edit": "Editar",
+    "delete": "Excluir",
+    "action": "Ação",
+    "service_not_installed": "Não instalado",
+    "service_version_unknown": "Versão indisponível"
+} %}
+
+
+{% set check_editor = {
+    "ssl_policy": "Política HTTPS",
+    "ssl_policy_default": "Padrão",
+    "ssl_policy_https": "Exigir HTTPS",
+    "ssl_policy_http": "Exigir HTTP",
+    "ssl_policy_hint": "Verifica o endereço final após os redirecionamentos permitidos. A mudança de HTTPS para HTTP sempre é um erro, inclusive no modo Padrão. Ignorar erros de certificado não desativa esta política.",
+    "create": "Criar verificação",
+    "edit": "Editar verificação",
+    "sections": "Configuração",
+    "target": "Verificação",
+    "settings": "Parâmetros",
+    "notifications": "Notificações",
+    "intro": "Comece pelo destino. Os valores padrão estão prontos; expanda as opções avançadas quando necessário.",
+    "target_hint": "Escolha o destino e os locais de execução.",
+    "settings_hint": "Intervalos e tempos limite estão em segundos. Expanda os blocos para opções avançadas.",
+    "notifications_hint": "Escolha os canais ou deixe-os desativados. Você poderá alterar as opções depois.",
+    "locations": "Locais de execução",
+    "available": "Disponíveis",
+    "selected": "Selecionados",
+    "request": "Requisição e conexão",
+    "response": "Validação da resposta",
+    "authentication": "Autenticação",
+    "proxy": "Proxy",
+    "extra": "Configurações adicionais",
+    "back": "Voltar",
+    "next": "Próximo",
+    "save": "Salvar alterações",
+    "saving": "Salvando…",
+    "required": "Preencha este campo.",
+    "invalid_url": "Digite uma URL HTTP ou HTTPS com um nome de host.",
+    "number": "Digite um número no intervalo permitido.",
+    "port": "Digite uma porta de 2 a 65535.",
+    "timeout": "O tempo limite deve ser menor que o intervalo.",
+    "ping_timeout": "Quantidade de pacotes × tempo limite deve ser menor que o intervalo.",
+    "entities": "Selecione pelo menos um local.",
+    "status_codes": "Adicione pelo menos um código HTTP aceito.",
+    "json": "Digite um objeto JSON válido.",
+    "save_error": "A verificação não foi salva. Os dados foram mantidos; confira os campos e tente novamente.",
+    "loading": "Carregando configurações…",
+    "load_error": "Não foi possível carregar a verificação. Feche a janela e tente novamente.",
+    "copy": "cópia",
+    "disabled": "Desativado",
+    "summary": "Resumo",
+    "seconds": "s",
+    "summary_empty": "Escolha um destino",
+    "no_channels": "Notificações desativadas",
+    "json_path": "Caminho JSON",
+    "json_value": "Valor JSON esperado",
+    "proxy_host": "Host do proxy",
+    "proxy_port": "Porta do proxy",
+    "proxy_username": "Usuário do proxy",
+    "proxy_password": "Senha do proxy"
+} %}
diff --git a/app/templates/languages/ru.html b/app/templates/languages/ru.html
index 64318bc..023480b 100644
--- a/app/templates/languages/ru.html
+++ b/app/templates/languages/ru.html
@@ -1,4 +1,30 @@
 {% set lang_short = 'ru' %}
+{% set agent_transport = {
+    "section": "Соединения агентов",
+    "label": "Передача результатов",
+    "preserve": "Сохранить текущую конфигурацию",
+    "unknown": "Ещё не проверено",
+    "pending": "Есть неприменённые изменения",
+    "checked": "Соединение проверено",
+    "help": "Используются настройки группы владельца агента. Для применения изменений нажмите «Перенастроить». Принимающий сервер должен поддерживать выбранный режим. API управления агентом остаётся HTTP.",
+    "settings_help": "Укажите пути к файлам, доступным RMON внутри каталога этой группы:",
+    "fields": {
+        "agent_result_transport": "Режим по умолчанию",
+        "agent_tls_ca_file": "Доверенный CA",
+        "agent_tls_generate": "Генерировать клиентские сертификаты",
+        "agent_tls_ca_key_file": "Ключ подписи CA",
+        "agent_tls_cert_file": "Клиентский сертификат",
+        "agent_tls_key_file": "Клиентский закрытый ключ"
+    },
+    "descriptions": {
+        "agent_result_transport": "Для новых агентов. Режим существующих агентов сохраняется.",
+        "agent_tls_ca_file": "Путь к доверенному CA. Для HTTPS с системным доверием можно оставить пустым. Для mTLS обязателен.",
+        "agent_tls_generate": "Выпускать отдельный клиентский сертификат для каждого агента, если пара отсутствует.",
+        "agent_tls_ca_key_file": "Путь к ключу CA для выпуска сертификатов. Этот ключ остаётся в RMON.",
+        "agent_tls_cert_file": "Путь к готовому клиентскому сертификату. Используйте {uuid} для отдельного файла каждого агента.",
+        "agent_tls_key_file": "Путь к соответствующему закрытому ключу. Поддерживает {uuid}."
+    }
+} %}
 {% set menu_links = dict() %}
 {% set menu_links = {
     "overview": {
@@ -45,15 +71,6 @@
     }
 %}
 {% set settings = {
-    "rabbitmq": {
-        "rabbitmq_enabled": "Включить оповещение на WEB-панели",
-        "rabbitmq_host": "Адрес сервера RabbitMQ",
-        "rabbitmq_port": "Порт сервера RabbitMQ",
-        "rabbitmq_vhost": "Виртуальный хост RabbitMQ",
-        "rabbitmq_queue": "Имя очереди RabbitMQ",
-        "rabbitmq_user": "Имя пользователя RabbitMQ",
-        "rabbitmq_password": "Пароль пользователя RabbitMQ",
-        },
     "monitoring": {
         "port_scan_interval": "Интервал проверки для Port scanner (в минутах)",
         "portscanner_keep_history_range": "Время хранения истории Port scanner",
@@ -166,7 +183,6 @@
     "alert_master_backup": "Уведомлять о смене статуса Master/Backup",
     "new_version": "Доступна новая версия RMON. Проверьте",
     "all_alerts_enabled": "Уведомления включены",
-    "disable_alerts": "Выключить уведомления",
     "work_with_prev": "Здесь вы можете работать с предыдущими версиями конфигов",
     "roll_back": "Откатиться к ним, просмотреть или удалить",
     "files_been_deleted": "Следующие файлы были удалены",
@@ -240,7 +256,6 @@
         "auto_start_desc": "Служба автозапуска позволяет перезапустить службы HAProxy, NGINX, Apache и Keepalived, если они не работают.",
         "metrics_desc": "Собирает количество подключений для сервисов HAProxy, NGINX, Apache и HAProxy WAF",
         "p_s_desc": "Проверяет сервер на наличие открытых портов и сохраняет историю",
-        "socket_desc": "Socket — сервис для отправки предупреждений и уведомлений",
         "a_new_version": "Доступна новая версия",
         "no_new_version": "Нет новой версии",
         "main_app": "Главное приложение",
@@ -602,7 +617,6 @@
     "test2": "тестовое",
     "disabled": "отключено",
     "via": "через",
-    "web_panel": "веб интерфейс",
     "message": "сообщение",
     "menu": "меню",
     "language": "язык",
@@ -773,3 +787,92 @@
     "accept": "принимать",
     }
 %}
+
+{% set ux = {
+    "skip_content": "Перейти к содержимому",
+    "toggle_menu": "Открыть или скрыть меню",
+    "close_menu": "Закрыть меню",
+    "retry": "Повторить",
+    "loading": "Загрузка…",
+    "widget_error": "Эти данные временно недоступны.",
+    "network_error": "Нет связи с RMON. Проверьте подключение и повторите попытку.",
+    "request_error": "Не удалось выполнить запрос. Попробуйте еще раз.",
+    "server_error": "RMON не смог выполнить запрос. Повторите попытку чуть позже.",
+    "validation_error": "Проверьте обязательные поля и их значения.",
+    "unauthorized": "Сессия истекла. Войдите снова, чтобы продолжить.",
+    "forbidden": "У вас нет прав для этого действия.",
+    "not_found": "Элемент больше недоступен. Обновите страницу.",
+    "conflict": "Элемент изменился или уже существует. Обновите страницу.",
+    "rate_limit": "Слишком много запросов. Попробуйте чуть позже.",
+    "login_failed": "Неверный логин или пароль, либо учетная запись отключена.",
+    "show_password": "Показать пароль",
+    "hide_password": "Скрыть пароль",
+    "no_checks": "Пока нет проверок",
+    "no_checks_description": "Добавьте первую проверку, чтобы следить за доступностью и получать уведомления.",
+    "no_status_pages": "Пока нет статус-страниц",
+    "no_status_pages_description": "Создайте публичную страницу доступности ваших сервисов.",
+    "slug_hint": "Строчные латинские буквы, цифры, подчеркивания и дефисы. Два дефиса подряд недопустимы.",
+    "table_label": "Таблица данных. Прокрутите вправо, чтобы увидеть все столбцы.",
+    "name_required": "Укажите название.",
+    "slug_invalid": "Укажите корректный адрес страницы.",
+    "edit": "Изменить",
+    "delete": "Удалить",
+    "action": "Действие",
+    "service_not_installed": "Не установлен",
+    "service_version_unknown": "Версия недоступна"
+} %}
+
+
+{% set check_editor = {
+    "ssl_policy": "Политика HTTPS",
+    "ssl_policy_default": "По умолчанию",
+    "ssl_policy_https": "Требовать HTTPS",
+    "ssl_policy_http": "Требовать HTTP",
+    "ssl_policy_hint": "Проверяется конечный адрес после разрешённых редиректов. Переход HTTPS → HTTP всегда считается ошибкой, в том числе в режиме «По умолчанию». Игнорирование ошибок сертификата не отключает эту политику.",
+    "create": "Создать проверку",
+    "edit": "Изменить проверку",
+    "sections": "Настройка проверки",
+    "target": "Проверка",
+    "settings": "Параметры",
+    "notifications": "Уведомления",
+    "intro": "Начните с цели проверки. Значения по умолчанию готовы к работе; дополнительные настройки можно раскрыть при необходимости.",
+    "target_hint": "Выберите, что проверять и откуда запускать проверку.",
+    "settings_hint": "Интервалы и тайм-ауты указаны в секундах. Дополнительные настройки находятся в раскрываемых блоках.",
+    "notifications_hint": "Выберите каналы уведомлений или оставьте их отключёнными. Позже настройки можно изменить.",
+    "locations": "Откуда проверять",
+    "available": "Доступные",
+    "selected": "Выбранные",
+    "request": "Запрос и соединение",
+    "response": "Проверка ответа",
+    "authentication": "Авторизация",
+    "proxy": "Прокси",
+    "extra": "Дополнительные настройки",
+    "back": "Назад",
+    "next": "Далее",
+    "save": "Сохранить изменения",
+    "saving": "Сохранение…",
+    "required": "Заполните это поле.",
+    "invalid_url": "Укажите HTTP- или HTTPS-адрес с именем хоста.",
+    "number": "Укажите число в допустимом диапазоне.",
+    "port": "Укажите порт от 2 до 65535.",
+    "timeout": "Тайм-аут должен быть меньше интервала.",
+    "ping_timeout": "Количество пакетов × тайм-аут должно быть меньше интервала.",
+    "entities": "Выберите хотя бы одно место запуска.",
+    "status_codes": "Добавьте хотя бы один допустимый HTTP-код ответа.",
+    "json": "Укажите корректный JSON-объект.",
+    "save_error": "Проверка не сохранена. Введённые данные остались в форме: проверьте поля и попробуйте ещё раз.",
+    "loading": "Загрузка настроек проверки…",
+    "load_error": "Не удалось загрузить проверку. Закройте окно и попробуйте ещё раз.",
+    "copy": "копия",
+    "disabled": "Отключено",
+    "summary": "Сводка",
+    "seconds": "с",
+    "summary_empty": "Укажите цель проверки",
+    "no_channels": "Уведомления отключены",
+    "json_path": "JSON-путь",
+    "json_value": "Ожидаемое JSON-значение",
+    "proxy_host": "Хост прокси",
+    "proxy_port": "Порт прокси",
+    "proxy_username": "Пользователь прокси",
+    "proxy_password": "Пароль прокси"
+} %}
diff --git a/app/templates/login.html b/app/templates/login.html
index 5b871f4..dda6227 100644
--- a/app/templates/login.html
+++ b/app/templates/login.html
@@ -1,84 +1,30 @@
+<!doctype html>
 {% from 'include/input_macros.html' import input %}
 <html lang="{{lang|default('en')}}">
 {% import 'languages/'+lang|default('en')+'.html' as lang %}
 <head>
+    <title>{{ lang.words.login2|title() }} — RMON</title>
     {% include 'include/main_head.html' %}
 </head>
-<body>
-<style>
-body, .container {
-	background-color: #fff;
-}
-.top-menu, .footer {
-	display: none !important;
-}
-.container {
-	margin: 0 !important;
-	width: 100% !important;
-	max-width: 100% !important;
-}
-#enter {
-	width: 220px !important;
-	padding: 10px !important;
-	background-color: #ededee !important;
-	font-weight: bold !important;
-}
-#main_div {
-	margin-top: 10%;
-	background-color: #31afe1;
-}
-@supports (-moz-osx-font-smoothing: auto) {
-	#main_div {
-		background-color: #31afe1;
-	}
-}
-.fontuser {
-	position: relative;
-}
-.fontuser i {
-	position: absolute;
-	left: 9px;
-	top: 10px;
-	color: #036bb0;
-}
-.fontpassword {
-	position: relative;
-	margin-bottom: 15px;
-}
-.fontpassword i {
-	position: absolute;
-	left: 9px;
-	top: 10px;
-	color: #036bb0;
-}
-.fontpassword span i {
-	position: absolute;
-	left: 193px;
-    top: 10px;
-    color: #036bb0;
-    font-size: 17px;
-	cursor: pointer;
-}
-</style>
-<div id="main_div">
-	<div id="login-form" style="padding-top: 40px; padding-bottom: 50px; min-height: 250px; color: #000;">
+<body class="login-page">
+<main id="main_div">
+	<div id="login-form">
 		<div id="logo_span">
-            <div id="logo_img"><img src="{{ url_for('static', filename='images/logo/white_320.png')}}"></div>
+            <div id="logo_img"><img src="{{ url_for('static', filename='images/logo/white_320.png')}}" alt="RMON"></div>
             <div id="logo_sign" style="">remote monitoring</div>
 		</div>
-		<form class="form-horizontal" id="auth" method="post" style="margin-top: 60px;left: 0;float: left;margin-left: 93px;">
-			<div class="fontuser">
-				{{ input('login', class='form-login', placeholder=lang.words.login|title(), required='required', autofocus='autofocus') }}
+		<form class="form-horizontal" id="auth" method="post">
+			<label for="login">{{ lang.words.login|title() }}</label>
+            <div class="fontuser">
+				{{ input('login', class='form-login', placeholder=lang.words.login|title(), required='required', autofocus='autofocus', autocomplete='username') }}
 				<i class="fa fa-user fa-lg"></i>
 			</div>
-			<br>
-			<div class="fontpassword">
-				{{ input('pass', type='password', class='form-login', placeholder=lang.words.password|title(), required='required') }}
+			<label for="pass">{{ lang.words.password|title() }}</label>
+            <div class="fontpassword">
+				{{ input('pass', type='password', class='form-login', placeholder=lang.words.password|title(), required='required', autocomplete='current-password') }}
 				{{ input('ref', type='hidden', value=ref) }}
 				<i class="fa fa-key fa-lg"></i>
-				<span onclick="showPassword('pass')" title="{{lang.words.show|title()}} {{lang.words.password}}">
-				<i class="far fa-eye"></i>
-					</span>
+				<button type="button" class="password-toggle icon-button" aria-controls="pass" aria-pressed="false" aria-label="{{ lang.ux.show_password }}" onclick="showPassword('pass', this)"><i class="far fa-eye" aria-hidden="true"></i></button>
 			</div>
 			<button type="submit" name="Login" value="Enter" id="enter">{{lang.words.login2|title()}}</button>
 		</form>
@@ -96,20 +42,19 @@
 		</div>
 		{% endif %}
 		{% if error_log or error %}
-		<div class="alert alert-danger wrong-login alert-one-row" style="display: block">
+		<div class="alert alert-danger wrong-login alert-one-row" style="display: block" role="alert">
 			{{error_log}}
 			{{error}}
 		</div>
 		{% endif %}
-		<div class="alert alert-danger wrong-login alert-one-row" id="wrong-login">
-			{{lang.phrases.login_or_pass_incorrect}}
+		<div class="alert alert-danger wrong-login alert-one-row" id="wrong-login" role="alert" aria-live="polite">
+			<span id="login-error-message">{{lang.phrases.login_or_pass_incorrect}}</span>
 			<br />
 			<span id="ban_10">
 				{{lang.phrases.can_try_again}} <span id="ban_timer">10</span> {{lang.words.seconds2}}
 			</span>
 		</div>
-		<br /><br />
 	</div>
-</div>
+</main>
 </body>
 </html>
diff --git a/app/templates/ovw.html b/app/templates/ovw.html
index 59ebf96..f2bd9f0 100644
--- a/app/templates/ovw.html
+++ b/app/templates/ovw.html
@@ -21,25 +21,26 @@
 <style>
 	.fa-sync-alt { margin-bottom: -1px; }
 </style>
+<div class="overview-grid">
 <table class="overview-wi overview-small-table" id="overview-roxy-wi">
     <thead class="overviewHead">
     <tr>
 		<th class="padding10 first-collumn-wi">
 			{% if g.user_params['role'] <= 2 %}
-				<a href="servers#servers" title="{{lang.words.manage|title()}} {{lang.words.servers}}">{{lang.words.servers|title()}}</a>
+				<a href="{{ url_for('admin.admin') }}#servers" title="{{lang.words.manage|title()}} {{lang.words.servers}}">{{lang.words.servers|title()}}</a>
 			{% else %}
 				{{lang.words.servers|title()}}
 			{% endif %}
 		</th>
 		<th class="padding10">
-			<a href="/rmon/agent" title="{{lang.words.agent|title()}} {{lang.words.servers}} {{lang.words.overview}}">
+			<a href="{{ url_for('smon.agent') }}" title="{{lang.words.agent|title()}} {{lang.words.servers}} {{lang.words.overview}}">
 				{{ lang.words.status|title() }}
 			</a>
 		</th>
 		<th  class="padding10">
-			<a onclick="showOverview(ip, hostnamea)" title="{{lang.words.refresh|title()}}" style="float: right;">
+			<button type="button" class="icon-button" onclick="showOverview(ip, hostnamea)" title="{{lang.words.refresh|title()}}" aria-label="{{lang.words.refresh|title()}}" style="float: right;">
 				<span class="refresh"></span>
-			</a>
+			</button>
 		</th>
     </tr>
     </thead>
@@ -52,7 +53,7 @@
 		<tr class="overviewHead">
 			<td class="padding10 first-collumn-wi">
 				{% if g.user_params['role'] <= 1 %}
-					<a href="admin#tools" title="{{lang.words.view|title()}} {{lang.words.services}} {{lang.words.status}}">
+					<a href="{{ url_for('admin.admin') }}#tools" title="{{lang.words.view|title()}} {{lang.words.services}} {{lang.words.status}}">
 						RMON {{lang.words.services_status}}
 					</a>
 				{% else %}
@@ -60,9 +61,9 @@
 				{% endif %}
 			</td>
 			<td>
-				<a onclick="showServicesOverview()" title="{{lang.words.refresh|title()}}" style="float: right; margin-right: 15px;">
+				<button type="button" class="icon-button" onclick="showServicesOverview()" title="{{lang.words.refresh|title()}}" aria-label="{{lang.words.refresh|title()}}" style="float: right; margin-right: 15px;">
 					<span class="refresh"></span>
-				</a>
+				</button>
 			</td>
 		</tr>
 	</thead>
@@ -72,7 +73,7 @@
 	<tr class="overviewHead" style="height: 30px;">
 		<td class="padding10 first-collumn-wi" colspan="2">
 			{% if g.user_params['role'] <= 1 %}
-				<a href="/app/logs/internal" title="{{lang.words.view|title()}} RMON {{lang.words.logs}}">
+				<a href="{{ url_for('logs.logs_internal') }}" title="{{lang.words.view|title()}} RMON {{lang.words.logs}}">
 					RMON {{lang.words.monitoring}}
 				</a>
 			{% else %}
@@ -80,9 +81,9 @@
 			{% endif %}
 		</td>
 		<td>
-			<a onclick="showOverviewHapWI()" title="{{lang.words.refresh|title()}}" style="float: right; margin-right: 15px;">
+			<button type="button" class="icon-button" onclick="showOverviewHapWI()" title="{{lang.words.refresh|title()}}" aria-label="{{lang.words.refresh|title()}}" style="float: right; margin-right: 15px;">
 				<span class="refresh"></span>
-			</a>
+			</button>
 		</td>
 	</tr>
 	<tr>
@@ -106,7 +107,7 @@
 		<thead>
 			<tr class="overviewHead" style="height: 30px;">
 				<td class="padding10 first-collumn-wi">
-					<a href="{{admin_uri}}#users" title="{{lang.words.manage|title()}} {{lang.words.users2}}">{{lang.words.login|title()}}</a>
+					<a href="{{ url_for('admin.admin') }}#users" title="{{lang.words.manage|title()}} {{lang.words.users2}}">{{lang.words.login|title()}}</a>
 				</td>
 				<td class="second-collumn">{{lang.words.groups|title()}}</td>
 				<td>{{lang.words.role|title()}}</td>
@@ -121,9 +122,9 @@
 					</span>
 				</td>
 				<td style="padding-right: 10px;">
-					<a onclick="showUsersOverview()" title="{{lang.words.refresh|title()}}" style="float: right;">
+					<button type="button" class="icon-button" onclick="showUsersOverview()" title="{{lang.words.refresh|title()}}" aria-label="{{lang.words.refresh|title()}}" style="float: right;">
 						<span class="refresh"></span>
-					</a>
+					</button>
 				</td>
 			</tr>
 		</thead>
@@ -134,7 +135,7 @@
 	<table class="overview-wi" id="overview-groups">
 		<tr class="overviewHead">
 			<td class="padding10 first-collumn-wi">
-				<a href="/app/users#groups" title="{{lang.words.manage|title()}} {{lang.words.groups3}}">{{lang.words.groups|title()}}</a>
+				<a href="{{ url_for('admin.admin') }}#groups" title="{{lang.words.manage|title()}} {{lang.words.groups3}}">{{lang.words.groups|title()}}</a>
 			</td>
 			<td class="second-collumn" style="width: 40%">{{lang.words.desc|title()}}</td>
 			<td>
@@ -187,7 +188,7 @@
 	</table>
 {% endif %}
 {% if g.user_params['role'] <= 2 %}
-	<script>ShowOverviewLogs();</script>
+	<script>$(ShowOverviewLogs);</script>
 	<table class="overview-wi" id="overview-logs"></table>
 {% endif %}
 {% if g.user_params['role'] <= 1 %}
@@ -197,14 +198,15 @@
 				<a href="https://rmon.io/cabinet" title="{{lang.words.personal|title()}} {{lang.words.cabinet}}" target="_blank">{{lang.words.subs|title()}}</a>
 			</td>
 			<td style="padding-right: 10px;">
-				<a onclick="showSubOverview()" title="{{lang.words.refresh|title()}}" style="float: right;">
+				<button type="button" class="icon-button" onclick="showSubOverview()" title="{{lang.words.refresh|title()}}" aria-label="{{lang.words.refresh|title()}}" style="float: right;">
 					<span class="refresh"></span>
-				</a>
+				</button>
 			</td>
 		</tr>
 		<tbody id="sub-table"></tbody>
 	</table>
 {% endif %}
+</div>
 <div id="dialog-confirm" style="display: none;">
   <p><span class="ui-icon ui-icon-alert" style="float:left; margin:3px 12px 20px 0;"></span>Are you sure?</p>
 </div>
diff --git a/app/templates/smon/agent.html b/app/templates/smon/agent.html
index 40f1e02..dae9062 100644
--- a/app/templates/smon/agent.html
+++ b/app/templates/smon/agent.html
@@ -41,6 +41,7 @@
            title="{{lang.words.create|title()}} {{lang.words.w_a}} {{lang.words.new2}} {{lang.words.agent}}"
            data-edit="{{lang.words.edit|title()}} {{lang.words.agent}}">
         {% include 'include/tr_validate_tips.html' %}
+        {% include 'include/agent_transport.html' %}
         <tr>
             <td class="padding20">
                 {{lang.words.server|title()}}
diff --git a/app/templates/smon/agents.html b/app/templates/smon/agents.html
index 66f5596..95fa209 100644
--- a/app/templates/smon/agents.html
+++ b/app/templates/smon/agents.html
@@ -68,6 +68,7 @@ <h4>{{lang.smon_page.desc.run_smon}} <a href="/users/services" title="RMON servi
                title="{{lang.words.create|title()}} {{lang.words.w_a}} {{lang.words.new2}} {{lang.words.agent}}"
                data-edit="{{lang.words.edit|title()}} {{lang.words.agent}}">
             {% include 'include/tr_validate_tips.html' %}
+            {% include 'include/agent_transport.html' %}
             <tr id="new-agent-select-tr">
                 <td class="padding20">
                     {{lang.words.server|title()}}
diff --git a/app/templates/smon/dashboard.html b/app/templates/smon/dashboard.html
index eb25c8d..ef5575c 100644
--- a/app/templates/smon/dashboard.html
+++ b/app/templates/smon/dashboard.html
@@ -14,26 +14,26 @@
 <link href="{{ url_for('static', filename='css/smon.css') }}" rel="stylesheet"/>
 <link href="{{ url_for('static', filename='css/ha.css') }}" rel="stylesheet">
 {% if smon_status in ('failed', 'inactive', 'ERROR') %}
-<div style="text-align: center;">
+<div class="empty-state">
 	<br />
 	<h3>{{lang.smon_page.desc.smon_is_not_run}}</h3>
-	<img src="{{ url_for('static', filename='images/no_servers.png')}}" alt="There is no server">
-	<h4>{{lang.smon_page.desc.run_smon}} <a href="/admin/tools" title="RMON services" target="_blank">{{lang.words.here}}</a> {{lang.smon_page.desc.before_use}}</h4>
+	<img src="{{ url_for('static', filename='images/no_servers.png')}}" alt="">
+	<h4>{{lang.smon_page.desc.run_smon}} <a href="{{ url_for('admin.admin') }}#tools" title="RMON services" target="_blank">{{lang.words.here}}</a> {{lang.smon_page.desc.before_use}}</h4>
 </div>
 {% elif multi_checks|length == 0 %}
-<div style="text-align: center;">
+<div class="empty-state">
 	<br />
-	<h3>{{lang.smon_page.desc.not_added}}</h3>
-	<img src="{{ url_for('static', filename='images/no_servers.png')}}" alt="There is no server">
-		<h4>{{lang.smon_page.desc.create_server}} <a onclick="openSmonDialog('http')" style="cursor: pointer" title="RMON" target="_blank">{{lang.words.here}}</a> {{lang.smon_page.desc.before_use}}</h4>
+	<h3>{{ lang.ux.no_checks }}</h3>
+	<img src="{{ url_for('static', filename='images/no_servers.png')}}" alt="">
+		<p>{{ lang.ux.no_checks_description }}</p>
 	<br />
 </div>
     {% if g.user_params['role'] <= 3 %}
-        <div class="add-button add-button-big" title="{{lang.words.add|title()}} {{ lang.words.check2 }}" onclick="openSmonDialog('http')">+ {{lang.words.add|title()}} {{ lang.words.check2 }}</div>
+        <button type="button" class="add-button add-button-big" title="{{lang.words.add|title()}} {{ lang.words.check2 }}" onclick="openSmonDialog('http')">+ {{lang.words.add|title()}} {{ lang.words.check2 }}</button>
     {% endif %}
 {% else %}
     {% if g.user_params['role'] <= 3 %}
-        <div class="add-button add-button-big" title="{{lang.words.add|title()}} {{ lang.words.check2 }}" onclick="openSmonDialog('http')">+ {{lang.words.add|title()}} {{ lang.words.check2 }}</div>
+        <button type="button" class="add-button add-button-big" title="{{lang.words.add|title()}} {{ lang.words.check2 }}" onclick="openSmonDialog('http')">+ {{lang.words.add|title()}} {{ lang.words.check2 }}</button>
     {% endif %}
     <div class="main" id="smon_dashboard">
 		{% include 'ajax/smon/smon_dashboard.html' %}
diff --git a/app/templates/smon/manage_status_page.html b/app/templates/smon/manage_status_page.html
index c15db44..b148036 100644
--- a/app/templates/smon/manage_status_page.html
+++ b/app/templates/smon/manage_status_page.html
@@ -14,10 +14,13 @@
 	<br />
 	<h3>{{lang.smon_page.desc.smon_is_not_run}}</h3>
 	<img src="{{ url_for('static', filename='images/no_servers.png')}}" alt="There is no server">
-	<h4>{{lang.smon_page.desc.run_smon}} <a href="/users/services" title="RMON services" target="_blank">{{lang.words.here}}</a> {{lang.smon_page.desc.before_use}}</h4>
+	<h4>{{lang.smon_page.desc.run_smon}} <a href="{{ url_for('admin.admin') }}#tools" title="RMON services" target="_blank">{{lang.words.here}}</a> {{lang.smon_page.desc.before_use}}</h4>
 </div>
 {% else %}
-    <div class="add-button add-button-big" title="SMOM: {{lang.phrases.create_page_status}} - RMON" onclick="createStatusPageStep1();">+ {{lang.phrases.create_page_status}}</div>
+    <button type="button" class="add-button add-button-big" onclick="createStatusPageStep1();">+ {{lang.phrases.create_page_status}}</button>
+    <div id="status-pages-empty" class="empty-state"{% if pages|length %} hidden{% endif %}>
+        <h3>{{ lang.ux.no_status_pages }}</h3><p>{{ lang.ux.no_status_pages_description }}</p>
+    </div>
     <div id="pages">
         {% include 'ajax/smon/status_pages.html' %}
     </div>
@@ -28,7 +31,7 @@ <h4>{{lang.smon_page.desc.run_smon}} <a href="/users/services" title="RMON servi
             {% include 'include/tr_validate_tips.html' %}
             <tr>
                 <td class="padding20">
-                    {{lang.words.name|title()}}
+                    <label for="new-status-page-name">{{lang.words.name|title()}}</label>
                     <span class="need-field">*</span>
                 </td>
                 <td>
@@ -37,15 +40,13 @@ <h4>{{lang.smon_page.desc.run_smon}} <a href="/users/services" title="RMON servi
             </tr>
             <tr>
                 <td class="padding20">
-                    Slug
+                    <label for="new-status-page-slug">Slug</label>
                     <span class="need-field">*</span>
                 </td>
                 <td>
-                    <span style="margin-top: 10px;display: inline-block;margin-right: -5px;">/app/smon/status/</span>{{ input('new-status-page-slug') }}
-                    <ul class="tooltip tooltipTop">
-                        <li>Accept characters: a-z 0-9 -</li>
-                        <li>No consecutive dashes --</li>
-                    </ul>
+                    {{ input('new-status-page-slug', title=lang.ux.slug_hint) }}
+                    <p class="field-help" id="status-page-url-preview" aria-live="polite" data-prefix="{{ url_for('smon.show_smon_status_page', slug='SLUG')|replace('SLUG', '') }}">{{ url_for('smon.show_smon_status_page', slug='SLUG')|replace('SLUG', '') }}</p>
+                    <p class="field-help" id="status-page-slug-help">{{ lang.ux.slug_hint }}</p>
                 </td>
             </tr>
         </table>
@@ -57,14 +58,14 @@ <h4>{{lang.smon_page.desc.run_smon}} <a href="/users/services" title="RMON servi
             {% include 'include/tr_validate_tips.html' %}
             <tr>
                 <td class="padding20" style="width: 50%">
-                    {{lang.words.desc|title()}}
+                    <label for="new-status-page-desc">{{lang.words.desc|title()}}</label>
                 </td>
                 <td>
                     {{ input('new-status-page-desc', autofocus='autofocus') }}
                 </td>
             </tr>
             <tr>
-                <td class="padding20">{{lang.phrases.custom_styles}}</td>
+                <td class="padding20"><label for="new-status-page-style">{{lang.phrases.custom_styles}}</label></td>
                 <td>
                     <textarea id="new-status-page-style" cols="50" rows="5" class="form-control" title="Custom styles" placeholder="
 body {
diff --git a/app/version.py b/app/version.py
index 0c38f69..f019882 100644
--- a/app/version.py
+++ b/app/version.py
@@ -1,4 +1,4 @@
-SERVICE_VERSION = "1.3.0"
+SERVICE_VERSION = "1.4.0"
 
 
 def get_service_version():
diff --git a/app/views/admin/views.py b/app/views/admin/views.py
index b6c1e4a..6e61156 100644
--- a/app/views/admin/views.py
+++ b/app/views/admin/views.py
@@ -13,6 +13,7 @@
 from app.middleware import get_user_params, page_for_admin, check_group
 from app.modules.roxywi.class_models import BaseResponse, GroupQuery, SettingsRequest
 from app.modules.common.common_classes import SupportClass
+from app.modules.common import agent_transport
 
 
 class SettingsView(MethodView):
@@ -31,10 +32,10 @@ def get(self, section: Optional[str], query: GroupQuery):
         parameters:
         - name: section
           in: path
-          description: The name of the settings section. Only 'main', 'rmon', 'rabbitmq', 'ldap', 'monitoring', 'logs' are allowed. If none get all settings.
+          description: The name of the settings section. Only 'main', 'rmon', 'ldap', 'monitoring', 'logs' are allowed. If none get all settings.
           required: true
           type: string
-          enum: ['main', 'rmon', 'rabbitmq', 'ldap', 'monitoring', 'logs']
+          enum: ['main', 'rmon', 'ldap', 'monitoring', 'logs']
         - name: group_id
           in: query
           description: This parameter is used only for the superAdmin role.
@@ -74,9 +75,10 @@ def get(self, section: Optional[str], query: GroupQuery):
         try:
             group_id = SupportClass.return_group_id(query)
         except Exception as e:
-            return roxywi_common.handle_json_exceptions(e, 'Cannot get Settings')
+            return roxywi_common.handler_exceptions_for_json_data(e, 'Cannot get Settings')
 
-        settings = sql.get_setting('', group_id=group_id, section=section, all=1)
+        settings = sql.get_setting('', group_id=group_id,
+                                   section='smon' if section == 'rmon' else section, all=section is None)
 
         return jsonify([model_to_dict(setting) for setting in settings])
 
@@ -92,10 +94,10 @@ def post(self, section: str, body: SettingsRequest, query: GroupQuery):
         parameters:
         - name: section
           in: path
-          description: The name of the settings section. Only 'main', 'rmon', 'rabbitmq', 'ldap', 'monitoring', 'logs' are allowed.
+          description: The name of the settings section. Only 'main', 'rmon', 'ldap', 'monitoring', 'logs' are allowed.
           required: true
           type: string
-          enum: ['main', 'rmon', 'rabbitmq', 'ldap', 'monitoring', 'logs']
+          enum: ['main', 'rmon', 'ldap', 'monitoring', 'logs']
         - name: group_id
           in: query
           description: The parameter is used only for the superAdmin role.
@@ -126,12 +128,19 @@ def post(self, section: str, body: SettingsRequest, query: GroupQuery):
         try:
             group_id = SupportClass.return_group_id(query)
         except Exception as e:
-            return roxywi_common.handle_json_exceptions(e, 'Cannot get Settings')
+            return roxywi_common.handler_exceptions_for_json_data(e, 'Cannot get Settings')
         try:
+            if body.param in agent_transport.DEFAULTS or section == 'agent':
+                if section != 'agent':
+                    raise ValueError('Use the agent connection settings section')
+                body.value = agent_transport.validate_setting(body.param, body.value, group_id)
             sql.update_setting(body.param, body.value, group_id)
         except Exception as e:
-            roxywi_common.handle_json_exceptions(e, 'Cannot update settings')
-        roxywi_common.logger(f'The {body.param} setting has been changed to: {body.value}', login=1)
+            return roxywi_common.handle_json_exceptions(e, 'Cannot update settings'), 400
+        if body.param in agent_transport.DEFAULTS:
+            roxywi_common.logger(f'The {body.param} setting has been changed', login=1)
+        else:
+            roxywi_common.logger(f'The {body.param} setting has been changed to: {body.value}', login=1)
 
         if body.param == 'master_port':
             try:
diff --git a/app/views/agent/views.py b/app/views/agent/views.py
index dc0d7fb..f8307a6 100644
--- a/app/views/agent/views.py
+++ b/app/views/agent/views.py
@@ -12,6 +12,7 @@
 from app.modules.roxywi.exception import RoxywiResourceNotFound
 from app.modules.roxywi.class_models import BaseResponse, RmonAgent, GroupQuery, TaskAcceptedPostResponse, TaskAcceptedOtherResponse
 from app.modules.common.common_classes import SupportClass
+from app.modules.common import agent_transport
 
 
 def _get_agent_for_management(agent_id: int, group_id: int):
@@ -102,6 +103,8 @@ def get(agent_id: int):
             return roxywi_common.handler_exceptions_for_json_data(e, 'Cannot get agent')
         agent_dict = model_to_dict(agent, recurse=False)
         agent_dict.pop('uuid', None)
+        agent_dict.pop('transport_settings_hash', None)
+        agent_dict['transport_pending'] = agent_transport.pending(agent)
         return jsonify(agent_dict)
 
     @validate(body=RmonAgent)
@@ -554,7 +557,7 @@ def get(task_id: int):
         try:
             task = InstallationTasks.get(id=task_id)
         except InstallationTasks.DoesNotExist:
-            return RoxywiResourceNotFound
+            raise RoxywiResourceNotFound
         except Exception as e:
             return roxywi_common.handler_exceptions_for_json_data(e, 'Cannot get agent task')
         try:
@@ -569,6 +572,7 @@ def get(task_id: int):
                 'status': task.status,
                 'service_name': task.service_name,
                 'error': task.error,
-                'server': task.server_id.hostname,
+                'server': task.server_id.hostname if task.server_id else '',
+                'action': task.action,
             }
         ), 200
diff --git a/app/views/check/checks_view.py b/app/views/check/checks_view.py
index 095ded6..335ab91 100644
--- a/app/views/check/checks_view.py
+++ b/app/views/check/checks_view.py
@@ -93,6 +93,11 @@ def get(self, query: GroupQuery):
               items:
                 type: 'object'
                 properties:
+                  ssl_policy:
+                    type: string
+                    enum: [default, require_https, require_http]
+                    default: default
+                    description: Expected protocol of the final URL after redirects. HTTPS to HTTP is always an error.
                   accepted_status_codes:
                     type: 'integer'
                     description: 'Expected HTTP status codes'
@@ -119,6 +124,11 @@ def get(self, query: GroupQuery):
                     items:
                       type: 'object'
                       properties:
+                        ssl_policy:
+                          type: string
+                          enum: [default, require_https, require_http]
+                          default: default
+                          description: Expected protocol of the final URL after redirects. HTTPS to HTTP is always an error.
                         accepted_status_codes:
                           type: 'integer'
                         body:
diff --git a/app/views/check/views.py b/app/views/check/views.py
index ea5bd49..f407ddc 100644
--- a/app/views/check/views.py
+++ b/app/views/check/views.py
@@ -384,6 +384,11 @@ def get(self, check_id: int, query: GroupQuery) -> object:
                   items:
                     type: 'object'
                     properties:
+                      ssl_policy:
+                        type: string
+                        enum: [default, require_https, require_http]
+                        default: default
+                        description: Expected protocol of the final URL after redirects. HTTPS to HTTP is always an error.
                       accepted_status_codes:
                         type: 'array'
                         description: 'Expected status code'
@@ -691,6 +696,11 @@ def post(self, body: HttpCheckRequest) -> Union[dict, tuple]:
               header_req:
                 type: 'string'
                 description: 'Header Request (optional)'
+              ssl_policy:
+                type: string
+                enum: [default, require_https, require_http]
+                default: default
+                description: Expected protocol of the final URL after redirects. HTTPS to HTTP is always an error.
               accepted_status_codes:
                 type: 'array'
                 description: 'Expected status code'
@@ -893,6 +903,11 @@ def put(self, check_id: int, body: HttpCheckRequest) -> Union[dict, tuple]:
               header_req:
                 type: 'string'
                 description: 'Header Request (optional)'
+              ssl_policy:
+                type: string
+                enum: [default, require_https, require_http]
+                default: default
+                description: Expected protocol of the final URL after redirects. HTTPS to HTTP is always an error.
               accepted_status_codes:
                 type: 'array'
                 description: 'Expected status code'
diff --git a/compose.server.yaml b/compose.server.yaml
new file mode 100644
index 0000000..da49924
--- /dev/null
+++ b/compose.server.yaml
@@ -0,0 +1,65 @@
+# Use together with compose.yaml to run RMON Server on the same Docker host.
+services:
+  web:
+    environment:
+      RMON_SERVER_INTERNAL_URL: "${RMON_SERVER_INTERNAL_URL:-http://server:5100}"
+      RMON_SERVER_INTERNAL_TOKEN_FILE: /run/secrets/rmon_server_token
+    secrets:
+      - rmon_server_token
+
+  server:
+    image: "${RMON_SERVER_IMAGE:-ghcr.io/roxy-wi/rmon/rmon-server:7.0}"
+    user: "33:33"
+    restart: unless-stopped
+    depends_on:
+      web:
+        condition: service_healthy
+    environment:
+      RMON_CONFIG_FILE: "${RMON_CONFIG_FILE:-/etc/rmon/rmon.cfg}"
+      RMON_DB_PATH: "${RMON_DB_PATH:-/var/lib/rmon/rmon.db}"
+      RMON_INTERNAL_API_TOKEN_FILE: /run/secrets/rmon_server_token
+      RMON_SERVER_WORKERS: "${RMON_SERVER_WORKERS:-1}"
+      RMON_SERVER_THREADS: "${RMON_SERVER_THREADS:-4}"
+      RMON_SERVER_LOG_PATH: "-"
+      RMON_SERVER_TRANSPORT:
+      RMON_TLS_CERT_FILE:
+      RMON_TLS_KEY_FILE:
+      RMON_TLS_CA_FILE:
+      RMON_PROBE_SCHEME:
+      RMON_PROBE_CA_FILE:
+      RMON_PROBE_CLIENT_CERT_FILE:
+      RMON_PROBE_CLIENT_KEY_FILE:
+    volumes:
+      - "${RMON_CONFIG_SOURCE:-rmon-config}:/etc/rmon:ro"
+      - "${RMON_DATA_SOURCE:-rmon-data}:/var/lib/rmon"
+    secrets:
+      - rmon_server_token
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    ports:
+      - "${RMON_SERVER_BIND_IP:-127.0.0.1}:${RMON_SERVER_PORT:-5100}:5100"
+    stop_grace_period: 45s
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=32m,mode=1777
+    cap_drop: [ALL]
+    security_opt:
+      - no-new-privileges:true
+
+  scheduler:
+    environment:
+      RMON_SERVER_INTERNAL_URL: "${RMON_SERVER_INTERNAL_URL:-http://server:5100}"
+      RMON_SERVER_INTERNAL_TOKEN_FILE: /run/secrets/rmon_server_token
+    secrets:
+      - rmon_server_token
+
+  operations:
+    environment:
+      RMON_SERVER_INTERNAL_URL: "${RMON_SERVER_INTERNAL_URL:-http://server:5100}"
+      RMON_SERVER_INTERNAL_TOKEN_FILE: /run/secrets/rmon_server_token
+    secrets:
+      - rmon_server_token
+
+secrets:
+  rmon_server_token:
+    file: "${RMON_SERVER_TOKEN_FILE:-./secrets/server-token}"
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..8bb5e23
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,88 @@
+x-rmon: &rmon
+    image: "${RMON_WEB_IMAGE:-ghcr.io/roxy-wi/rmon/rmon-web:1.4.0}"
+    build: .
+    restart: unless-stopped
+    environment:
+      - RMON_PUBLIC_URL
+      - RMON_COOKIE_SECURE
+      - RMON_AGENT_IMAGE
+      - RMON_AGENT_CONTROL_URL
+      - RMON_CONFIG_FILE
+      - RMON_DB_PATH
+      - RMON_SECRET_KEY
+      - RMON_SECRET_KEY_FILE
+      - RMON_SECRET_PHRASE
+      - RMON_JWT_ALGORITHM
+      - RMON_JWT_SECRET_KEY
+      - RMON_JWT_PRIVATE_KEY_FILE
+      - RMON_JWT_PUBLIC_KEY_FILE
+      - RMON_SERVER_INTERNAL_URL
+      - RMON_SERVER_INTERNAL_TOKEN_FILE
+      - RMON_SERVER_CA_FILE
+      - RMON_SERVER_CLIENT_CERT_FILE
+      - RMON_SERVER_CLIENT_KEY_FILE
+    volumes:
+      - "${RMON_CONFIG_SOURCE:-rmon-config}:/etc/rmon"
+      - "${RMON_DATA_SOURCE:-rmon-data}:/var/lib/rmon"
+      - "${RMON_LOG_SOURCE:-rmon-logs}:/var/log/rmon"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    stop_grace_period: 45s
+    security_opt:
+      - no-new-privileges:true
+    sysctls:
+      net.ipv4.ping_group_range: "0 2147483647"
+
+services:
+  web:
+    <<: *rmon
+
+  scheduler:
+    <<: *rmon
+    command: [scheduler]
+    depends_on:
+      web:
+        condition: service_healthy
+    healthcheck:
+      test: [CMD, /opt/rmon-venv/bin/python, -m, container.runtime, healthcheck, --role, scheduler]
+      interval: 30s
+      timeout: 10s
+      start_period: 40s
+
+  operations:
+    <<: *rmon
+    command: [operations]
+    stop_grace_period: 30m
+    depends_on:
+      web:
+        condition: service_healthy
+    healthcheck:
+      test: [CMD, /opt/rmon-venv/bin/python, -m, container.runtime, healthcheck, --role, operations]
+      interval: 30s
+      timeout: 10s
+      start_period: 40s
+
+  proxy:
+    image: "${RMON_PROXY_IMAGE:-rmon-proxy:local}"
+    build:
+      context: container/nginx
+    restart: unless-stopped
+    depends_on:
+      web:
+        condition: service_healthy
+    environment:
+      RMON_PROXY_SCHEME: "${RMON_PROXY_SCHEME:-https}"
+      RMON_TLS_NAME: "${RMON_TLS_NAME:-localhost}"
+      RMON_SELF_SIGNED: "${RMON_SELF_SIGNED:-1}"
+    ports:
+      - "${RMON_BIND_IP:-0.0.0.0}:${RMON_WEB_PORT:-443}:8080"
+    volumes:
+      - "${RMON_TLS_SOURCE:-rmon-tls}:/etc/ssl/certs/rmon"
+    security_opt:
+      - no-new-privileges:true
+
+volumes:
+  rmon-config:
+  rmon-data:
+  rmon-logs:
+  rmon-tls:
diff --git a/config_other/httpd/rmon.conf b/config_other/httpd/rmon.conf
index 14e37c1..cf68df6 100644
--- a/config_other/httpd/rmon.conf
+++ b/config_other/httpd/rmon.conf
@@ -12,23 +12,17 @@
     TimeOut 600
     LimitRequestLine 16380
 
-    RewriteEngine On
-    RewriteCond %{HTTP:Upgrade} =websocket [NC]
-    RewriteRule /(.*)           ws://localhost:8766/ [P,L]
-    ProxyPassReverse / http://localhost:8766/
-
     DocumentRoot /var/www/rmon
 
-    WSGIDaemonProcess rmon-app display-name=%{GROUP} user=apache group=apache processes=1 threads=10
-    WSGIScriptAlias / /var/www/rmon/app.wsgi
-
-    <Directory /var/www/rmon/>
-        WSGIPassAuthorization On
-        WSGIProcessGroup rmon-app
-        WSGIApplicationGroup %{GLOBAL}
-        Order deny,allow
-        Allow from all
-    </Directory>
+    ProxyRequests Off
+    ProxyPreserveHost On
+    RequestHeader set X-Forwarded-Proto "https"
+    ProxyPass /_rmon/ !
+    <Location /_rmon/>
+        Require all denied
+    </Location>
+    ProxyPass / unix:/run/rmon/rmon.sock|http://localhost/ timeout=600
+    ProxyPassReverse / http://localhost/
 
     <IfModule mod_headers.c>
         Header set X-XSS-Protection: 1;
@@ -42,4 +36,4 @@
                 Header set Cache-Control "max-age=86400, public"
         </filesMatch>
 	</IfModule>
-</VirtualHost>
\ No newline at end of file
+</VirtualHost>
diff --git a/config_other/httpd/rmon_deb.conf b/config_other/httpd/rmon_deb.conf
index 0fe3319..8a58b44 100644
--- a/config_other/httpd/rmon_deb.conf
+++ b/config_other/httpd/rmon_deb.conf
@@ -12,23 +12,17 @@
     TimeOut 600
     LimitRequestLine 16380
 
-    RewriteEngine On
-    RewriteCond %{HTTP:Upgrade} =websocket [NC]
-    RewriteRule /(.*)           ws://localhost:8766/ [P,L]
-    ProxyPassReverse / http://localhost:8766/
-
     DocumentRoot /var/www/rmon
 
-    WSGIDaemonProcess rmon-app display-name=%{GROUP} user=www-data group=www-data processes=1 threads=10
-    WSGIScriptAlias / /var/www/rmon/app.wsgi
-
-    <Directory /var/www/rmon/>
-        WSGIPassAuthorization On
-        WSGIProcessGroup rmon-app
-        WSGIApplicationGroup %{GLOBAL}
-        Order deny,allow
-        Allow from all
-    </Directory>
+    ProxyRequests Off
+    ProxyPreserveHost On
+    RequestHeader set X-Forwarded-Proto "https"
+    ProxyPass /_rmon/ !
+    <Location /_rmon/>
+        Require all denied
+    </Location>
+    ProxyPass / unix:/run/rmon/rmon.sock|http://localhost/ timeout=600
+    ProxyPassReverse / http://localhost/
 
     <IfModule mod_headers.c>
         Header set X-XSS-Protection: 1;
@@ -42,4 +36,4 @@
                 Header set Cache-Control "max-age=86400, public"
         </filesMatch>
 	</IfModule>
-</VirtualHost>
\ No newline at end of file
+</VirtualHost>
diff --git a/container/__init__.py b/container/__init__.py
new file mode 100644
index 0000000..8da0bdb
--- /dev/null
+++ b/container/__init__.py
@@ -0,0 +1 @@
+"""Container tooling. Importing it never starts the RMON application."""
diff --git a/container/nginx/Dockerfile b/container/nginx/Dockerfile
new file mode 100644
index 0000000..655183f
--- /dev/null
+++ b/container/nginx/Dockerfile
@@ -0,0 +1,7 @@
+FROM nginx:stable-alpine
+RUN apk add --no-cache python3 openssl
+COPY default.conf.template runtime.py /opt/rmon-proxy/
+RUN ln -s /etc/ssl/certs/rmon/rmon.crt /etc/ssl/certs/rmon.crt \
+    && ln -s /etc/ssl/certs/rmon/rmon.key /etc/ssl/certs/rmon.key
+ENTRYPOINT ["python3", "/opt/rmon-proxy/runtime.py"]
+EXPOSE 8080
diff --git a/container/nginx/default.conf.template b/container/nginx/default.conf.template
new file mode 100644
index 0000000..e1d6fda
--- /dev/null
+++ b/container/nginx/default.conf.template
@@ -0,0 +1,23 @@
+# Resolve at request time so web container replacement needs no proxy restart.
+resolver 127.0.0.11 valid=30s ipv6=off;
+server {
+    listen ${RMON_LISTENER};
+    server_name _;
+    ${RMON_TLS_DIRECTIVES}
+    server_tokens off;
+    client_max_body_size 16m;
+    add_header X-Content-Type-Options nosniff always;
+    location ^~ /_rmon/ { return 404; }
+    location / {
+        set $rmon_upstream http://web:8080;
+        proxy_pass $rmon_upstream;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header Upgrade "";
+        proxy_set_header Connection "";
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+    }
+}
diff --git a/container/nginx/runtime.py b/container/nginx/runtime.py
new file mode 100644
index 0000000..5e48cc8
--- /dev/null
+++ b/container/nginx/runtime.py
@@ -0,0 +1,68 @@
+"""Nginx-only TLS setup. The web container has no access to the TLS volume."""
+import ipaddress
+import os
+from pathlib import Path
+import re
+import subprocess
+import tempfile
+
+
+def settings():
+    scheme = os.getenv('RMON_PROXY_SCHEME', 'https')
+    if scheme not in ('http', 'https'):
+        raise ValueError('RMON_PROXY_SCHEME must be http or https')
+    return scheme
+
+
+def certificate_san(host):
+    try:
+        ipaddress.ip_address(host)
+        return f'IP:{host}'
+    except ValueError:
+        if not re.fullmatch(r'[a-zA-Z0-9][a-zA-Z0-9.-]*', host):
+            raise ValueError('RMON_TLS_NAME must be a hostname or IP address')
+        return f'DNS:{host}'
+
+
+def ensure_certificate(cert=Path('/etc/ssl/certs/rmon.crt'), key=Path('/etc/ssl/certs/rmon.key'),
+                       store=Path('/etc/ssl/certs/rmon')):
+    if cert.is_file() and key.is_file():
+        return
+    if cert.exists() or key.exists() or any((store / name).exists() for name in ('rmon.crt', 'rmon.key')):
+        raise ValueError('Incomplete TLS key pair; restore it instead of generating new keys')
+    if os.getenv('RMON_SELF_SIGNED', '1') != '1':
+        raise ValueError('Mount rmon.crt and rmon.key at /etc/ssl/certs')
+    host = os.getenv('RMON_TLS_NAME', 'localhost')
+    san = certificate_san(host)
+    store.mkdir(parents=True, exist_ok=True)
+    with tempfile.TemporaryDirectory(prefix='.tls-init-', dir=store) as temp:
+        temp = Path(temp)
+        subprocess.run(['openssl', 'req', '-x509', '-newkey', 'rsa:3072', '-nodes', '-days', '365',
+                        '-subj', f'/CN={host}', '-addext', f'subjectAltName={san}',
+                        '-keyout', str(temp / 'rmon.key'), '-out', str(temp / 'rmon.crt')],
+                       check=True, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
+        (temp / 'rmon.key').chmod(0o600)
+        # Exclusive links: never replace existing certificate material.
+        os.link(temp / 'rmon.key', store / 'rmon.key')
+        os.link(temp / 'rmon.crt', store / 'rmon.crt')
+    print('Created a self-signed RMON certificate. Explicitly trust it in your client.', flush=True)
+
+
+def render(template):
+    scheme = settings()
+    tls = ('ssl_certificate /etc/ssl/certs/rmon.crt;\n'
+           'ssl_certificate_key /etc/ssl/certs/rmon.key;\n'
+           'ssl_protocols TLSv1.2 TLSv1.3;' if scheme == 'https' else '')
+    for name, value in {'RMON_LISTENER': '8080 ssl' if scheme == 'https' else '8080',
+                        'RMON_TLS_DIRECTIVES': tls}.items():
+        template = template.replace('${' + name + '}', value)
+    return template
+
+
+if __name__ == '__main__':
+    os.umask(0o077)
+    if settings() == 'https':
+        ensure_certificate()
+    Path('/etc/nginx/conf.d/default.conf').write_text(render(Path('/opt/rmon-proxy/default.conf.template').read_text()))
+    subprocess.run(['nginx', '-t'], check=True)
+    os.execvp('nginx', ['nginx', '-g', 'daemon off;'])
diff --git a/container/runtime.py b/container/runtime.py
new file mode 100644
index 0000000..acf8274
--- /dev/null
+++ b/container/runtime.py
@@ -0,0 +1,271 @@
+"""Explicit initialization and Gunicorn entrypoint; never migrate on restart."""
+import argparse
+import configparser
+import getpass
+import os
+from pathlib import Path
+import secrets
+import subprocess
+import sys
+import urllib.request
+
+ROOT = Path(__file__).resolve().parents[1]
+UID = GID = 33  # Ubuntu's www-data; existing data must already be accessible to it.
+
+
+def read_config(path=None):
+    path = Path(path or os.getenv('RMON_CONFIG_FILE', '/etc/rmon/rmon.cfg'))
+    cfg = configparser.ConfigParser(interpolation=configparser.ExtendedInterpolation())
+    with path.open(encoding='utf-8') as stream:
+        cfg.read_file(stream)
+    for section, keys in {'main': ('lib_path', 'log_path', 'secret_phrase'),
+                          'mysql': ('enable',), 'pgsql': ('enable',)}.items():
+        for key in keys:
+            cfg.get(section, key)
+    if cfg['mysql']['enable'] not in ('0', '1') or cfg['pgsql']['enable'] not in ('0', '1'):
+        raise ValueError('Database enable flags must be 0 or 1')
+    if cfg['mysql']['enable'] == cfg['pgsql']['enable'] == '1':
+        raise ValueError('Enable only one database backend')
+    return cfg
+
+
+def option(cfg, name, default=''):
+    return os.getenv('RMON_' + name.upper(), cfg.get('container', name, fallback=default))
+
+
+
+
+
+
+def prepare_directory(path):
+    path = Path(path)
+    if not path.is_absolute():
+        raise ValueError('Runtime directories must use absolute paths')
+    path.mkdir(parents=True, exist_ok=True)
+    # No recursive chown of user data. Empty newly mounted volumes can be initialized.
+    if not any(path.iterdir()):
+        os.chown(path, UID, GID)
+        path.chmod(0o750)
+
+
+def drop_privileges():
+    if os.getuid() == 0:
+        os.setgroups([])
+        os.setgid(GID)
+        os.setuid(UID)
+
+
+def private_file(path, data, owner=True):
+    path = Path(path)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, 'wb') as stream:
+        stream.write(data)
+    if owner:
+        os.chown(path, UID, GID)
+
+
+def ensure_new_config(path):
+    if path.exists():
+        return
+    from cryptography.fernet import Fernet
+    data = (ROOT / 'config_other/rmon.cfg').read_text(encoding='utf-8')
+    private_file(path, data.replace('CHANGE_ME', Fernet.generate_key().decode()).encode())
+
+
+def database(cfg):
+    """Preflight without importing app (which requires the JWT keys first)."""
+    from peewee import MySQLDatabase, PostgresqlDatabase, SqliteDatabase
+    if cfg['pgsql']['enable'] == '1':
+        section = cfg['pgsql']
+        return PostgresqlDatabase(section['db'], user=section['user'], password=section['password'],
+                                  host=section['host'], port=int(section['port']), connect_timeout=5)
+    if cfg['mysql']['enable'] == '1':
+        section = cfg['mysql']
+        return MySQLDatabase(section['mysql_db'], user=section['mysql_user'], password=section['mysql_password'],
+                             host=section['mysql_host'], port=int(section['mysql_port']), connect_timeout=5)
+    return SqliteDatabase(os.getenv('RMON_DB_PATH', '/var/lib/rmon/rmon.db'))
+
+
+def require_empty_database(cfg):
+    db = database(cfg)
+    try:
+        if db.get_tables():
+            raise ValueError('init requires an empty database; existing installations must use serve')
+    finally:
+        db.close()
+
+
+def bootstrap(cfg):
+    """Initialize only an empty database; never migrate or rotate an existing installation."""
+    import fcntl
+    lock = Path(cfg['main']['lib_path']) / '.bootstrap.lock'
+    with lock.open('a') as stream:
+        fcntl.flock(stream, fcntl.LOCK_EX)
+        db = database(cfg)
+        try:
+            populated = bool(db.get_tables())
+        finally:
+            db.close()
+        command = 'check' if populated else 'init'
+        subprocess.run([sys.executable, '-m', 'container.runtime', command], check=True)
+
+
+def jwt_keys():
+    if os.getenv('RMON_JWT_ALGORITHM', 'RS256') != 'RS256':
+        return
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+    private = Path(os.getenv('RMON_JWT_PRIVATE_KEY_FILE', '/var/lib/rmon/keys/rmon-key'))
+    public = Path(os.getenv('RMON_JWT_PUBLIC_KEY_FILE', '/var/lib/rmon/keys/rmon-key.pub'))
+    if private.exists() and public.exists():
+        return
+    if private.exists() or public.exists():
+        raise ValueError('Incomplete JWT key pair; restore the missing key (no automatic rotation)')
+    key = rsa.generate_private_key(public_exponent=65537, key_size=3072)
+    private_file(private, key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
+                                           serialization.NoEncryption()))
+    private_file(public, key.public_key().public_bytes(serialization.Encoding.PEM,
+                                                      serialization.PublicFormat.SubjectPublicKeyInfo))
+
+
+
+
+def admin_password():
+    filename = os.getenv('RMON_ADMIN_PASSWORD_FILE')
+    if filename:
+        password = Path(filename).read_text(encoding='utf-8').rstrip('\r\n')
+    elif sys.stdin.isatty():
+        password = getpass.getpass('Initial admin password (at least 12 characters): ')
+        if password != getpass.getpass('Confirm password: '):
+            raise ValueError('Passwords do not match')
+    else:
+        raise ValueError('Use an interactive init or mount RMON_ADMIN_PASSWORD_FILE')
+    if len(password) < 12:
+        raise ValueError('Initial admin password must contain at least 12 characters')
+    return password
+
+
+def initialize_schema(password):
+    from werkzeug.security import generate_password_hash
+    from app import create_db
+    from app.modules.db.db_model import (BaseModel, conn, User, Role, Setting, UserGroups,
+                                        Migration, Version, RoxyTool)
+    from app.modules.db.migrations import get_migration_files
+    from app.version import get_service_version
+    # Check again under the application identity; never baseline an existing schema.
+    if conn.get_tables():
+        raise ValueError('Refusing to initialize a nonempty database')
+    with conn.atomic():
+        conn.create_tables(BaseModel.__subclasses__())
+        create_db.default_values()
+        if read_config()['pgsql']['enable'] == '1':
+            # The explicit Default group id must advance the sequence in this transaction.
+            conn.execute_sql("SELECT setval(pg_get_serial_sequence('groups', 'id'), (SELECT max(id) FROM groups))")
+        if (User.select().count() != 3 or Role.select().count() != 4 or
+                UserGroups.select().count() != 3 or not Setting.select().exists()):
+            raise RuntimeError('Default database values were not initialized completely')
+        User.update(password=generate_password_hash(password)).where(User.username == 'admin').execute()
+        User.update(enabled=0, password=None).where(User.username != 'admin').execute()
+        RoxyTool.update(current_version='0').execute()
+        Version.insert(version=get_service_version()).execute()
+        for name in get_migration_files():
+            Migration.create(name=name[:-3])
+    conn.close()
+
+
+def check_application():
+    from cryptography.fernet import Fernet
+    cfg = read_config()
+    Fernet((os.getenv('RMON_SECRET_PHRASE') or cfg['main']['secret_phrase']).encode('ascii'))
+    from app import app
+    from app.modules.db.db_model import Setting
+    with app.app_context():
+        if not Setting.select().limit(1).exists():
+            raise ValueError('Database is not initialized')
+    for path in (cfg['main']['lib_path'], cfg['main']['log_path']):
+        if not os.access(path, os.W_OK):
+            raise ValueError(f'{path} must be writable by www-data (uid 33)')
+
+
+def healthcheck():
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+    token = Path('/tmp/rmon-health-token').read_text().strip()
+    request = urllib.request.Request('http://127.0.0.1:8080/_rmon/ready', headers={'X-RMON-Health-Token': token})
+    with opener.open(request, timeout=5) as response:
+        if response.status != 200:
+            raise RuntimeError('RMON is not ready')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('command', choices=('serve', 'init', 'bootstrap', 'check', 'healthcheck', 'scheduler', 'operations'), default='serve', nargs='?')
+    parser.add_argument('--role', choices=('scheduler', 'operations'))
+    parser.add_argument('--live', action='store_true')
+    args = parser.parse_args()
+    command = args.command
+    os.umask(0o077)
+    if command == 'healthcheck':
+        if args.role:
+            import runtime_health
+            if not runtime_health.healthy(args.role, ready=not args.live):
+                raise RuntimeError('Process is not ready')
+            return
+        healthcheck()
+        return
+    if command == 'check':
+        os.environ['RMON_SCHEDULER_ENABLED'] = '0'
+        drop_privileges()
+        check_application()
+        return
+    if os.getuid() != 0:
+        raise ValueError('Entrypoint must start as root; Gunicorn runs the application as www-data')
+    password = admin_password() if command == 'init' else None
+    config_path = Path(os.getenv('RMON_CONFIG_FILE', '/etc/rmon/rmon.cfg'))
+    if command == 'init':
+        ensure_new_config(config_path)
+    cfg = read_config(config_path)
+    for path in (cfg['main']['lib_path'], cfg['main']['log_path'], '/var/lib/rmon/keys',
+                 os.getenv('RMON_PROMETHEUS_MULTIPROC_DIR', '/tmp/rmon-prometheus')):
+        prepare_directory(path)
+    if command == 'bootstrap':
+        bootstrap(cfg)
+        return
+    if command == 'init':
+        require_empty_database(cfg)
+        jwt_keys()
+        # Preflight SQLite was opened as root; only this verified empty database is new.
+        if cfg['mysql']['enable'] == cfg['pgsql']['enable'] == '0':
+            os.chown(os.getenv('RMON_DB_PATH', '/var/lib/rmon/rmon.db'), UID, GID)
+        os.environ['RMON_SCHEDULER_ENABLED'] = '0'
+        drop_privileges()
+        initialize_schema(password)
+        print('Initialized. Login: admin. Default editor/guest accounts are disabled.')
+        return
+    for key in ('public_url', 'cookie_secure'):
+        if cfg.has_option('container', key):
+            os.environ.setdefault('RMON_' + key.upper(), cfg['container'][key])
+    subprocess.run([sys.executable, '-m', 'container.runtime', 'check'], check=True, timeout=30)
+    if command in ('scheduler', 'operations'):
+        drop_privileges()
+        os.execv(sys.executable, [sys.executable, str(ROOT / f'{command}_runner.py')])
+    os.environ['RMON_SCHEDULER_ENABLED'] = '0'
+    token = secrets.token_urlsafe(32)
+    # Ephemeral probe credential only; never part of persistent application secrets.
+    token_path = Path('/tmp/rmon-health-token')
+    token_path.unlink(missing_ok=True)
+    private_file(token_path, token.encode())
+    os.environ['RMON_HEALTH_TOKEN'] = token
+    os.execv('/opt/rmon-venv/bin/gunicorn', ['gunicorn', '--config', '/var/www/rmon/gunicorn.conf.py',
+                                           'container.wsgi:application'])
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except Exception as exc:
+        # Never print connection strings, passwords, tokens or key material.
+        print(f'RMON container {type(exc).__name__}: startup failed. Check configuration, mounts and database access.', file=sys.stderr)
+        if isinstance(exc, (ValueError, FileNotFoundError, PermissionError)):
+            print(str(exc), file=sys.stderr)
+        sys.exit(1)
diff --git a/container/wsgi.py b/container/wsgi.py
new file mode 100644
index 0000000..1d03369
--- /dev/null
+++ b/container/wsgi.py
@@ -0,0 +1,25 @@
+"""Gunicorn target; private readiness probe without exposing a Flask route."""
+import hmac
+import os
+
+from app import app
+from app.modules.db.db_model import Setting, conn
+
+
+def application(environ, start_response):
+    if environ.get('PATH_INFO') != '/_rmon/ready':
+        return app(environ, start_response)
+    token = os.getenv('RMON_HEALTH_TOKEN', '')
+    supplied = environ.get('HTTP_X_RMON_HEALTH_TOKEN', '')
+    if not token or not hmac.compare_digest(token.encode(), supplied.encode()):
+        status, body = '404 Not Found', b'Not found'
+    else:
+        try:
+            with app.app_context(), conn.connection_context():
+                if not Setting.select().limit(1).exists():
+                    raise RuntimeError('Uninitialized database')
+            status, body = '200 OK', b'{"status":"ready"}'
+        except Exception:
+            status, body = '503 Service Unavailable', b'{"status":"not_ready"}'
+    start_response(status, [('Content-Type', 'application/json'), ('Content-Length', str(len(body)))])
+    return [body]
diff --git a/gunicorn.conf.py b/gunicorn.conf.py
new file mode 100644
index 0000000..9c62961
--- /dev/null
+++ b/gunicorn.conf.py
@@ -0,0 +1,29 @@
+"""Shared package/container worker policy. TLS belongs to Apache or Nginx."""
+import os
+
+os.environ['RMON_SCHEDULER_ENABLED'] = '0'
+
+container = os.getenv('RMON_CONTAINER') == '1'
+bind = '0.0.0.0:8080' if container else 'unix:/run/rmon/rmon.sock'
+workers = 1
+worker_class = 'gthread'
+threads = 10
+preload_app = False
+max_requests = 0
+timeout = 120
+graceful_timeout = 30
+keepalive = 5
+umask = 0o007
+chdir = '/var/www/rmon'
+worker_tmp_dir = '/tmp'
+accesslog = '-'
+errorlog = '-'
+capture_output = True
+limit_request_line = 8190
+# Compose exposes only Nginx; the package uses an Apache-only Unix socket.
+# Both proxies replace the incoming scheme header. Do not publish port 8080.
+forwarded_allow_ips = '*' if container else ''
+secure_scheme_headers = {'X-FORWARDED-PROTO': 'https'}
+if container:
+    user = 'www-data'
+    group = 'www-data'
diff --git a/helm/rmon/.helmignore b/helm/rmon/.helmignore
new file mode 100644
index 0000000..c2ada5d
--- /dev/null
+++ b/helm/rmon/.helmignore
@@ -0,0 +1,7 @@
+*.tgz
+.git/
+AGENTS.md
+*.swp
+*.bak
+*.tmp
+*.orig
diff --git a/helm/rmon/Chart.yaml b/helm/rmon/Chart.yaml
new file mode 100644
index 0000000..bfcf6bc
--- /dev/null
+++ b/helm/rmon/Chart.yaml
@@ -0,0 +1,15 @@
+apiVersion: v2
+name: rmon-chart
+description: Service availability monitoring, distributed checks and notifications
+type: application
+version: 1.4.2
+appVersion: "1.4.0"
+kubeVersion: ">=1.25.0-0"
+home: https://rmon.io
+sources:
+  - https://github.com/roxy-wi/RMON
+keywords: [monitoring, availability, alerting]
+annotations:
+  org.opencontainers.image.source: https://github.com/roxy-wi/RMON
+  org.opencontainers.image.description: RMON Helm chart for service availability monitoring
+  org.opencontainers.image.licenses: Elastic-2.0
diff --git a/helm/rmon/templates/_helpers.tpl b/helm/rmon/templates/_helpers.tpl
new file mode 100644
index 0000000..e90de3e
--- /dev/null
+++ b/helm/rmon/templates/_helpers.tpl
@@ -0,0 +1,174 @@
+{{- define "rmon.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 52 | trimSuffix "-" -}}
+{{- end -}}
+{{- define "rmon.placement" -}}
+{{- with .Values.nodeSelector }}
+nodeSelector:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- with .Values.tolerations }}
+tolerations:
+  {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end -}}
+{{- define "rmon.colocate" -}}
+{{- if has "ReadWriteOnce" .Values.persistence.accessModes }}
+affinity:
+  podAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      - labelSelector:
+          matchLabels:
+            {{- include "rmon.selector" . | nindent 12 }}
+          matchExpressions:
+            - key: app.kubernetes.io/component
+              operator: In
+              values: [web, scheduler, operations, server]
+        topologyKey: kubernetes.io/hostname
+{{- end }}
+{{- end -}}
+{{- define "rmon.fullname" -}}
+{{- default (printf "%s-%s" .Release.Name (include "rmon.name" .)) .Values.fullnameOverride | trunc 52 | trimSuffix "-" -}}
+{{- end -}}
+{{- define "rmon.selector" -}}
+app.kubernetes.io/name: {{ include "rmon.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+{{- define "rmon.labels" -}}
+{{ include "rmon.selector" . }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | quote }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- define "rmon.image" -}}
+{{- if .image.digest -}}
+{{ printf "%s@%s" .image.repository .image.digest }}
+{{- else -}}
+{{ printf "%s:%s" .image.repository (default .version .image.tag) }}
+{{- end -}}
+{{- end -}}
+{{- define "rmon.configSecret" -}}
+{{ default (printf "%s-config" (include "rmon.fullname" .)) .Values.existingConfigSecret }}
+{{- end -}}
+{{- define "rmon.claim" -}}
+{{ default (printf "%s-data" (include "rmon.fullname" .)) .Values.persistence.existingClaim }}
+{{- end -}}
+{{- define "rmon.account" -}}
+{{- if .Values.serviceAccount.create -}}
+{{ default (include "rmon.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+{{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+{{- define "rmon.config" -}}
+{{- range $section, $options := .Values.config }}
+[{{ $section }}]
+{{ range $key, $value := $options -}}
+{{ $key }} = {{ if kindIs "float64" $value }}{{ printf "%.0f" $value }}{{ else }}{{ $value }}{{ end }}
+{{ end }}
+{{- end -}}
+{{- end -}}
+{{- define "rmon.validate" -}}
+{{- if and .Values.migration.enabled (not .Values.maintenance) -}}{{ fail "Enable maintenance and stop all RMON pods before enabling migration" }}{{- end -}}
+{{- $_ := required "Set publicURL to the RMON address reachable by users and agents" .Values.publicURL -}}
+{{- if ne (int .Values.web.replicaCount) 1 -}}{{ fail "This chart requires web.replicaCount=1" }}{{- end -}}
+{{- if not .Values.existingConfigSecret -}}
+{{- $key := required "Set config.main.secret_phrase or existingConfigSecret; preserve existing application keys" .Values.config.main.secret_phrase -}}
+{{- if not (regexMatch "^[A-Za-z0-9_-]{43}=$" $key) -}}{{ fail "config.main.secret_phrase must be a Fernet key" }}{{- end -}}
+{{- if and (eq (int .Values.config.mysql.enable) 1) (eq (int .Values.config.pgsql.enable) 1) -}}{{ fail "Enable only one database backend" }}{{- end -}}
+{{- if and (eq (int .Values.config.mysql.enable) 0) (eq (int .Values.config.pgsql.enable) 0) (has "ReadWriteMany" .Values.persistence.accessModes) -}}{{ fail "SQLite requires ReadWriteOnce storage; use an external database before selecting ReadWriteMany" }}{{- end -}}
+{{- if or (ne .Values.config.main.lib_path "/var/lib/rmon") (ne .Values.config.main.log_path "/var/log/rmon") -}}{{ fail "Keep config.main.lib_path=/var/lib/rmon and log_path=/var/log/rmon for the chart's persistent volumes" }}{{- end -}}
+{{- end -}}
+{{- if .Values.bootstrap.enabled -}}{{- $_ := required "Set bootstrap.existingSecret with the initial administrator password" .Values.bootstrap.existingSecret -}}{{- end -}}
+{{- if or .Values.server.enabled .Values.server.externalURL -}}
+{{- $_ := required "Set server.existingTokenSecret with the result server access token" .Values.server.existingTokenSecret -}}
+{{- end -}}
+{{- if and .Values.server.enabled (ne .Values.server.transport "http") -}}
+{{- $_ := required "Set server.tls.existingServerSecret for HTTPS/mTLS" .Values.server.tls.existingServerSecret -}}
+{{- $_ = required "Set server.tls.existingClientSecret for HTTPS/mTLS" .Values.server.tls.existingClientSecret -}}
+{{- end -}}
+{{- if .Values.ingress.enabled -}}{{- $_ := required "Set ingress.host" .Values.ingress.host -}}{{- end -}}
+{{- end -}}
+{{- define "rmon.env" -}}
+- name: RMON_CONFIG_FILE
+  value: /etc/rmon/rmon.cfg
+- name: RMON_DB_PATH
+  value: /var/lib/rmon/rmon.db
+- name: RMON_PUBLIC_URL
+  value: {{ .Values.publicURL | quote }}
+- name: RMON_AGENT_CONTROL_URL
+  value: {{ default .Values.publicURL .Values.agentControlURL | quote }}
+- name: RMON_COOKIE_SECURE
+  value: {{ ternary "1" "0" .Values.cookieSecure | quote }}
+- name: RMON_AGENT_IMAGE
+  value: {{ .Values.agentImage | quote }}
+{{- if or .Values.server.enabled .Values.server.externalURL }}
+- name: RMON_SERVER_INTERNAL_URL
+  value: {{ if .Values.server.enabled }}{{ printf "%s://%s-server:%v" (ternary "http" "https" (eq .Values.server.transport "http")) (include "rmon.fullname" .) .Values.server.service.port | quote }}{{ else }}{{ .Values.server.externalURL | quote }}{{ end }}
+- name: RMON_SERVER_INTERNAL_TOKEN_FILE
+  value: /run/rmon-token/token
+{{- end }}
+{{- if and .Values.server.enabled (ne .Values.server.transport "http") }}
+- name: RMON_SERVER_CA_FILE
+  value: /run/rmon-client-tls/ca.crt
+{{- if eq .Values.server.transport "mtls" }}
+- name: RMON_SERVER_CLIENT_CERT_FILE
+  value: /run/rmon-client-tls/tls.crt
+- name: RMON_SERVER_CLIENT_KEY_FILE
+  value: /run/rmon-client-tls/tls.key
+{{- end }}
+{{- end }}
+{{- with .Values.extraEnv }}
+{{ toYaml . }}
+{{- end }}
+{{- end -}}
+{{- define "rmon.mounts" -}}
+- name: config
+  mountPath: /etc/rmon/rmon.cfg
+  subPath: rmon.cfg
+  readOnly: true
+- name: data
+  mountPath: /var/lib/rmon
+- name: data
+  mountPath: /var/log/rmon
+  subPath: logs
+{{- if or .Values.server.enabled .Values.server.externalURL }}
+- name: server-token
+  mountPath: /run/rmon-token
+  readOnly: true
+{{- end }}
+{{- if and .Values.server.enabled (ne .Values.server.transport "http") }}
+- name: client-tls
+  mountPath: /run/rmon-client-tls
+  readOnly: true
+{{- end }}
+{{- with .Values.extraVolumeMounts }}
+{{ toYaml . }}
+{{- end }}
+{{- end -}}
+{{- define "rmon.volumes" -}}
+- name: config
+  secret:
+    secretName: {{ include "rmon.configSecret" . }}
+    defaultMode: 0440
+- name: data
+  persistentVolumeClaim:
+    claimName: {{ include "rmon.claim" . }}
+{{- if or .Values.server.enabled .Values.server.externalURL }}
+- name: server-token
+  secret:
+    secretName: {{ .Values.server.existingTokenSecret }}
+    defaultMode: 0440
+    items:
+      - key: {{ .Values.server.tokenKey }}
+        path: token
+{{- end }}
+{{- if and .Values.server.enabled (ne .Values.server.transport "http") }}
+- name: client-tls
+  secret:
+    secretName: {{ .Values.server.tls.existingClientSecret }}
+    defaultMode: 0440
+{{- end }}
+{{- with .Values.extraVolumes }}
+{{ toYaml . }}
+{{- end }}
+{{- end -}}
diff --git a/helm/rmon/templates/application.yaml b/helm/rmon/templates/application.yaml
new file mode 100644
index 0000000..c688082
--- /dev/null
+++ b/helm/rmon/templates/application.yaml
@@ -0,0 +1,119 @@
+{{- range $role := list "web" "scheduler" "operations" }}
+{{- $settings := index $.Values $role }}
+{{- if or (eq $role "web") $settings.enabled }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "rmon.fullname" $ }}-{{ $role }}
+  labels:
+    {{- include "rmon.labels" $ | nindent 4 }}
+    app.kubernetes.io/component: {{ $role }}
+spec:
+  replicas: {{ ternary 0 1 $.Values.maintenance }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "rmon.selector" $ | nindent 6 }}
+      app.kubernetes.io/component: {{ $role }}
+  template:
+    metadata:
+      labels:
+        {{- include "rmon.selector" $ | nindent 8 }}
+        app.kubernetes.io/component: {{ $role }}
+      annotations:
+        checksum/config: {{ include "rmon.config" $ | sha256sum }}
+        {{- with $.Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "rmon.account" $ }}
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: {{ default 45 $settings.terminationGracePeriodSeconds }}
+      securityContext:
+        fsGroup: 33
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      {{- with $.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- include "rmon.placement" $ | nindent 6 }}
+      {{- include "rmon.colocate" $ | nindent 6 }}
+      {{- if and (eq $role "web") $.Values.bootstrap.enabled }}
+      initContainers:
+        - name: initialize
+          image: {{ include "rmon.image" (dict "image" $.Values.image "version" $.Chart.AppVersion) | quote }}
+          imagePullPolicy: {{ $.Values.image.pullPolicy }}
+          args: [bootstrap]
+          securityContext:
+            runAsUser: 0
+            allowPrivilegeEscalation: false
+          env:
+            {{- include "rmon.env" $ | nindent 12 }}
+            - name: RMON_ADMIN_PASSWORD_FILE
+              value: /run/rmon-bootstrap/password
+          resources:
+            {{- toYaml $.Values.web.resources | nindent 12 }}
+          volumeMounts:
+            {{- include "rmon.mounts" $ | nindent 12 }}
+            - name: bootstrap
+              mountPath: /run/rmon-bootstrap
+              readOnly: true
+      {{- end }}
+      containers:
+        - name: {{ $role }}
+          image: {{ include "rmon.image" (dict "image" $.Values.image "version" $.Chart.AppVersion) | quote }}
+          imagePullPolicy: {{ $.Values.image.pullPolicy }}
+          args: [{{ ternary "serve" $role (eq $role "web") }}]
+          securityContext:
+            runAsUser: 0
+            allowPrivilegeEscalation: false
+          env:
+            {{- include "rmon.env" $ | nindent 12 }}
+          {{- if eq $role "web" }}
+          ports:
+            - name: http
+              containerPort: 8080
+          {{- end }}
+          startupProbe:
+            exec:
+              command: [/opt/rmon-venv/bin/python, -m, container.runtime, healthcheck{{ if ne $role "web" }}, --role, {{ $role }}{{ end }}]
+            periodSeconds: 10
+            timeoutSeconds: 8
+            failureThreshold: 60
+          readinessProbe:
+            exec:
+              command: [/opt/rmon-venv/bin/python, -m, container.runtime, healthcheck{{ if ne $role "web" }}, --role, {{ $role }}{{ end }}]
+            periodSeconds: 15
+            timeoutSeconds: 8
+          livenessProbe:
+            {{- if eq $role "web" }}
+            tcpSocket:
+              port: http
+            {{- else }}
+            exec:
+              command: [/opt/rmon-venv/bin/python, -m, container.runtime, healthcheck, --role, {{ $role }}, --live]
+            {{- end }}
+            periodSeconds: 30
+            timeoutSeconds: 8
+            failureThreshold: 3
+          resources:
+            {{- toYaml $settings.resources | nindent 12 }}
+          volumeMounts:
+            {{- include "rmon.mounts" $ | nindent 12 }}
+      volumes:
+        {{- include "rmon.volumes" $ | nindent 8 }}
+        {{- if and (eq $role "web") $.Values.bootstrap.enabled }}
+        - name: bootstrap
+          secret:
+            secretName: {{ $.Values.bootstrap.existingSecret }}
+            defaultMode: 0400
+            items:
+              - key: {{ $.Values.bootstrap.passwordKey }}
+                path: password
+        {{- end }}
+{{- end }}
+{{- end }}
diff --git a/helm/rmon/templates/config.yaml b/helm/rmon/templates/config.yaml
new file mode 100644
index 0000000..f96cf02
--- /dev/null
+++ b/helm/rmon/templates/config.yaml
@@ -0,0 +1,13 @@
+{{- include "rmon.validate" . -}}
+{{- if not .Values.existingConfigSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "rmon.configSecret" . }}
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  rmon.cfg: |
+    {{- include "rmon.config" . | trim | nindent 4 }}
+{{- end }}
diff --git a/helm/rmon/templates/ingress.yaml b/helm/rmon/templates/ingress.yaml
new file mode 100644
index 0000000..d8720d1
--- /dev/null
+++ b/helm/rmon/templates/ingress.yaml
@@ -0,0 +1,31 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "rmon.fullname" . }}
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "rmon.fullname" . }}-web
+                port:
+                  number: {{ .Values.service.port }}
+{{- end }}
diff --git a/helm/rmon/templates/migration.yaml b/helm/rmon/templates/migration.yaml
new file mode 100644
index 0000000..95bdd80
--- /dev/null
+++ b/helm/rmon/templates/migration.yaml
@@ -0,0 +1,52 @@
+{{- if .Values.migration.enabled }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "rmon.fullname" . }}-migrate-{{ .Release.Revision }}
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+    app.kubernetes.io/component: migration
+spec:
+  backoffLimit: 0
+  activeDeadlineSeconds: 600
+  template:
+    metadata:
+      labels:
+        {{- include "rmon.selector" . | nindent 8 }}
+        app.kubernetes.io/component: migration
+    spec:
+      restartPolicy: Never
+      serviceAccountName: {{ include "rmon.account" . }}
+      automountServiceAccountToken: false
+      securityContext:
+        runAsUser: 33
+        runAsGroup: 33
+        runAsNonRoot: true
+        fsGroup: 33
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- include "rmon.placement" . | nindent 6 }}
+      containers:
+        - name: migrate
+          image: {{ include "rmon.image" (dict "image" .Values.image "version" .Chart.AppVersion) | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: [/opt/rmon-venv/bin/python]
+          args: [/var/www/rmon/app/migrate.py, migrate]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          env:
+            {{- include "rmon.env" . | nindent 12 }}
+          resources:
+            {{- toYaml .Values.web.resources | nindent 12 }}
+          volumeMounts:
+            {{- include "rmon.mounts" . | nindent 12 }}
+      volumes:
+        {{- include "rmon.volumes" . | nindent 8 }}
+{{- end }}
diff --git a/helm/rmon/templates/pvc.yaml b/helm/rmon/templates/pvc.yaml
new file mode 100644
index 0000000..055b64b
--- /dev/null
+++ b/helm/rmon/templates/pvc.yaml
@@ -0,0 +1,23 @@
+{{- if not .Values.persistence.existingClaim }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "rmon.claim" . }}
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+  {{- if .Values.persistence.keep }}
+  annotations:
+    helm.sh/resource-policy: keep
+  {{- end }}
+spec:
+  accessModes:
+    {{- toYaml .Values.persistence.accessModes | nindent 4 }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+  {{- if eq .Values.persistence.storageClass "-" }}
+  storageClassName: ""
+  {{- else if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+{{- end }}
diff --git a/helm/rmon/templates/server.yaml b/helm/rmon/templates/server.yaml
new file mode 100644
index 0000000..64335ed
--- /dev/null
+++ b/helm/rmon/templates/server.yaml
@@ -0,0 +1,130 @@
+{{- if .Values.server.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "rmon.fullname" . }}-server
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+    app.kubernetes.io/component: server
+spec:
+  replicas: {{ ternary 0 1 .Values.maintenance }}
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      {{- include "rmon.selector" . | nindent 6 }}
+      app.kubernetes.io/component: server
+  template:
+    metadata:
+      labels:
+        {{- include "rmon.selector" . | nindent 8 }}
+        app.kubernetes.io/component: server
+      annotations:
+        checksum/config: {{ include "rmon.config" . | sha256sum }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "rmon.account" . }}
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 45
+      securityContext:
+        runAsUser: 33
+        runAsGroup: 33
+        runAsNonRoot: true
+        fsGroup: 33
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- include "rmon.placement" . | nindent 6 }}
+      {{- include "rmon.colocate" . | nindent 6 }}
+      containers:
+        - name: server
+          image: {{ include "rmon.image" (dict "image" .Values.server.image "version" "7.0") | quote }}
+          imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+          env:
+            - name: RMON_CONFIG_FILE
+              value: /etc/rmon/rmon.cfg
+            - name: RMON_DB_PATH
+              value: /var/lib/rmon/rmon.db
+            - name: RMON_INTERNAL_API_TOKEN_FILE
+              value: /run/rmon-token/token
+            - name: RMON_SERVER_WORKERS
+              value: "1"
+            - name: RMON_SERVER_THREADS
+              value: "4"
+            - name: RMON_SERVER_LOG_PATH
+              value: "-"
+            - name: RMON_SERVER_TRANSPORT
+              value: {{ .Values.server.transport | quote }}
+            {{- if ne .Values.server.transport "http" }}
+            - name: RMON_TLS_CERT_FILE
+              value: /run/rmon-server-tls/tls.crt
+            - name: RMON_TLS_KEY_FILE
+              value: /run/rmon-server-tls/tls.key
+            - name: RMON_TLS_CA_FILE
+              value: /run/rmon-server-tls/ca.crt
+            - name: RMON_PROBE_SCHEME
+              value: https
+            - name: RMON_PROBE_CA_FILE
+              value: /run/rmon-client-tls/ca.crt
+            {{- if eq .Values.server.transport "mtls" }}
+            - name: RMON_PROBE_CLIENT_CERT_FILE
+              value: /run/rmon-client-tls/tls.crt
+            - name: RMON_PROBE_CLIENT_KEY_FILE
+              value: /run/rmon-client-tls/tls.key
+            {{- end }}
+            {{- end }}
+          ports:
+            - name: api
+              containerPort: 5100
+          startupProbe:
+            exec:
+              command: [python, -m, modules.common.probe, ready]
+            periodSeconds: 10
+            timeoutSeconds: 8
+            failureThreshold: 60
+          readinessProbe:
+            exec:
+              command: [python, -m, modules.common.probe, ready]
+            periodSeconds: 15
+            timeoutSeconds: 8
+          livenessProbe:
+            exec:
+              command: [python, -m, modules.common.probe, live]
+            periodSeconds: 30
+            timeoutSeconds: 8
+            failureThreshold: 3
+          resources:
+            {{- toYaml .Values.server.resources | nindent 12 }}
+          volumeMounts:
+            {{- include "rmon.mounts" . | nindent 12 }}
+            - name: tmp
+              mountPath: /tmp
+            {{- if ne .Values.server.transport "http" }}
+            - name: server-tls
+              mountPath: /run/rmon-server-tls
+              readOnly: true
+            {{- end }}
+      volumes:
+        {{- include "rmon.volumes" . | nindent 8 }}
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 32Mi
+        {{- if ne .Values.server.transport "http" }}
+        - name: server-tls
+          secret:
+            secretName: {{ .Values.server.tls.existingServerSecret }}
+            defaultMode: 0440
+        {{- end }}
+{{- end }}
diff --git a/helm/rmon/templates/serviceaccount.yaml b/helm/rmon/templates/serviceaccount.yaml
new file mode 100644
index 0000000..2977aa7
--- /dev/null
+++ b/helm/rmon/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "rmon.account" . }}
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: false
+{{- end }}
diff --git a/helm/rmon/templates/services.yaml b/helm/rmon/templates/services.yaml
new file mode 100644
index 0000000..1e6e875
--- /dev/null
+++ b/helm/rmon/templates/services.yaml
@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "rmon.fullname" . }}-web
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "rmon.selector" . | nindent 4 }}
+    app.kubernetes.io/component: web
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+{{- if .Values.server.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "rmon.fullname" . }}-server
+  labels:
+    {{- include "rmon.labels" . | nindent 4 }}
+  {{- with .Values.server.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.server.service.type }}
+  {{- with .Values.server.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  selector:
+    {{- include "rmon.selector" . | nindent 4 }}
+    app.kubernetes.io/component: server
+  ports:
+    - name: api
+      port: {{ .Values.server.service.port }}
+      targetPort: api
+      {{- if and .Values.server.service.nodePort (ne .Values.server.service.type "ClusterIP") }}
+      nodePort: {{ .Values.server.service.nodePort }}
+      {{- end }}
+{{- end }}
diff --git a/helm/rmon/values.schema.json b/helm/rmon/values.schema.json
new file mode 100644
index 0000000..5f58020
--- /dev/null
+++ b/helm/rmon/values.schema.json
@@ -0,0 +1,248 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "publicURL": {
+      "type": "string",
+      "pattern": "^https?://[^/]+/?$"
+    },
+    "agentControlURL": {
+      "type": "string",
+      "pattern": "^$|^https?://[^/]+/?$"
+    },
+    "cookieSecure": {
+      "type": "boolean"
+    },
+    "maintenance": {
+      "type": "boolean"
+    },
+    "existingConfigSecret": {
+      "type": "string"
+    },
+    "image": {
+      "type": "object",
+      "properties": {
+        "repository": {
+          "type": "string"
+        },
+        "tag": {
+          "type": "string"
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^$|^sha256:[a-f0-9]{64}$"
+        },
+        "pullPolicy": {
+          "enum": [
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ]
+        }
+      }
+    },
+    "web": {
+      "type": "object",
+      "properties": {
+        "replicaCount": {
+          "const": 1
+        },
+        "resources": {
+          "type": "object"
+        }
+      }
+    },
+    "bootstrap": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "existingSecret": {
+          "type": "string"
+        },
+        "passwordKey": {
+          "type": "string"
+        }
+      }
+    },
+    "persistence": {
+      "type": "object",
+      "properties": {
+        "existingClaim": {
+          "type": "string"
+        },
+        "size": {
+          "type": "string"
+        },
+        "storageClass": {
+          "type": "string"
+        },
+        "keep": {
+          "type": "boolean"
+        },
+        "accessModes": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 1,
+          "items": {
+            "enum": [
+              "ReadWriteOnce",
+              "ReadWriteMany"
+            ]
+          }
+        }
+      }
+    },
+    "server": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "transport": {
+          "enum": [
+            "http",
+            "https",
+            "mtls"
+          ]
+        },
+        "image": {
+          "type": "object",
+          "properties": {
+            "repository": {
+              "type": "string"
+            },
+            "tag": {
+              "type": "string"
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^$|^sha256:[a-f0-9]{64}$"
+            },
+            "pullPolicy": {
+              "enum": [
+                "Always",
+                "IfNotPresent",
+                "Never"
+              ]
+            }
+          }
+        },
+        "existingTokenSecret": {
+          "type": "string"
+        },
+        "tokenKey": {
+          "type": "string"
+        },
+        "externalURL": {
+          "type": "string",
+          "pattern": "^$|^https?://[^/]+/?$"
+        },
+        "service": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "enum": [
+                "ClusterIP",
+                "NodePort",
+                "LoadBalancer"
+              ]
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 65535
+            },
+            "nodePort": {
+              "type": [
+                "integer",
+                "null"
+              ],
+              "minimum": 1,
+              "maximum": 65535
+            }
+          }
+        }
+      }
+    },
+    "scheduler": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        }
+      }
+    },
+    "operations": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "terminationGracePeriodSeconds": {
+          "type": "integer",
+          "minimum": 1
+        }
+      }
+    },
+    "config": {
+      "type": "object",
+      "properties": {
+        "mysql": {
+          "type": "object",
+          "properties": {
+            "enable": {
+              "enum": [
+                0,
+                1
+              ]
+            },
+            "mysql_port": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        },
+        "pgsql": {
+          "type": "object",
+          "properties": {
+            "enable": {
+              "enum": [
+                0,
+                1
+              ]
+            },
+            "port": {
+              "type": "integer",
+              "minimum": 1
+            }
+          }
+        }
+      }
+    },
+    "ingress": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "host": {
+          "type": "string"
+        },
+        "tls": {
+          "type": "array"
+        }
+      }
+    },
+    "extraEnv": {
+      "type": "array"
+    },
+    "extraVolumes": {
+      "type": "array"
+    },
+    "extraVolumeMounts": {
+      "type": "array"
+    }
+  }
+}
diff --git a/helm/rmon/values.yaml b/helm/rmon/values.yaml
new file mode 100644
index 0000000..7d9209e
--- /dev/null
+++ b/helm/rmon/values.yaml
@@ -0,0 +1,118 @@
+image:
+  repository: ghcr.io/roxy-wi/rmon/rmon-web
+  tag: ""
+  digest: ""
+  pullPolicy: IfNotPresent
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# Address reachable by users and agents. HTTPS is recommended.
+publicURL: ""
+agentControlURL: ""
+cookieSecure: true
+agentImage: ghcr.io/roxy-wi/rmon/rmon-agent:2.0
+
+# Supply a complete rmon.cfg in an existing Secret, or configure the map below.
+existingConfigSecret: ""
+config:
+  main:
+    log_path: /var/log/rmon
+    lib_path: /var/lib/rmon
+    # Required Fernet key. Preserve the existing value when moving RMON.
+    secret_phrase: ""
+  mysql:
+    enable: 0
+    mysql_host: ""
+    mysql_port: 3306
+    mysql_user: rmon
+    mysql_password: ""
+    mysql_db: rmon
+  pgsql:
+    enable: 0
+    host: ""
+    port: 5432
+    user: rmon
+    password: ""
+    db: rmon
+
+# Enable only when preparing a new installation. An existing database is
+# checked without changing its schema, accounts or application keys.
+bootstrap:
+  enabled: false
+  existingSecret: ""
+  passwordKey: admin-password
+
+# Data and keys must remain persistent even with an external database.
+# Use RWO storage on one node for SQLite. RWX is for external databases only.
+persistence:
+  existingClaim: ""
+  size: 5Gi
+  storageClass: ""
+  accessModes: [ReadWriteOnce]
+  keep: true
+
+serviceAccount:
+  create: true
+  name: ""
+  annotations: {}
+
+# The published web image supports amd64, matching the default node selection.
+nodeSelector:
+  kubernetes.io/arch: amd64
+tolerations: []
+podAnnotations: {}
+extraEnv: []
+extraVolumes: []
+extraVolumeMounts: []
+maintenance: false
+migration:
+  enabled: false
+
+web:
+  replicaCount: 1
+  resources: {}
+scheduler:
+  enabled: true
+  resources: {}
+operations:
+  enabled: true
+  terminationGracePeriodSeconds: 1800
+  resources: {}
+
+service:
+  port: 8080
+  annotations: {}
+ingress:
+  enabled: false
+  className: ""
+  host: ""
+  annotations: {}
+  tls: []
+
+server:
+  enabled: true
+  image:
+    repository: ghcr.io/roxy-wi/rmon/rmon-server
+    tag: "7.0"
+    digest: ""
+    pullPolicy: IfNotPresent
+  # The same token is used by RMON and its result server.
+  existingTokenSecret: ""
+  tokenKey: token
+  # Used when enabled=false. Mount any outbound TLS files with extraVolumes.
+  externalURL: ""
+  transport: http
+  # Server identity: tls.crt, tls.key, ca.crt. Client identity: ca.crt and,
+  # for mTLS, tls.crt/tls.key. The server certificate must cover its Service
+  # DNS name and 127.0.0.1 (used by the local health probe).
+  tls:
+    existingServerSecret: ""
+    existingClientSecret: ""
+  service:
+    type: ClusterIP
+    port: 5100
+    nodePort: null
+    annotations: {}
+    loadBalancerSourceRanges: []
+  resources: {}
diff --git a/licenses/legacy/LICENSE-before-1.4.0.txt b/licenses/legacy/LICENSE-before-1.4.0.txt
new file mode 100644
index 0000000..3d84448
--- /dev/null
+++ b/licenses/legacy/LICENSE-before-1.4.0.txt
@@ -0,0 +1,203 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   10. Modification and distribution for commercial purposes is prohibited without the consent of the author.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [2024] [Pavel Loginov]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/operations_runner.py b/operations_runner.py
new file mode 100644
index 0000000..a8d25d7
--- /dev/null
+++ b/operations_runner.py
@@ -0,0 +1,9 @@
+"""Run the durable agent-operation worker outside the web process."""
+import os
+
+os.environ['RMON_SCHEDULER_ENABLED'] = '0'
+
+from app.modules.operations.worker import main  # noqa: E402
+
+if __name__ == '__main__':
+    main()
diff --git a/requirements.txt b/requirements.txt
index e748aea..423bb89 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -13,6 +13,7 @@ PyMySQL>=1.1.1
 psycopg2-binary==2.9.10
 Werkzeug~=3.0.3
 Flask~=3.0.3
+gunicorn~=23.0.0
 Flask-APScheduler==1.12.4
 Flask-Caching==1.10.1
 Flask-JWT-Extended==4.6.0
@@ -22,9 +23,6 @@ ansible-core==2.16.19
 ansible-runner==2.3.1
 distro==1.9.0
 psutil==6.1.0
-aio-pika==9.4.3
-pika==1.3.1
-websockets==13.1
 python-whois==0.9.4
 pydantic~=2.7.4
 python-dateutil~=2.9.0.post0
diff --git a/rotate_credential_secret.py b/rotate_credential_secret.py
index 6529622..2643208 100644
--- a/rotate_credential_secret.py
+++ b/rotate_credential_secret.py
@@ -4,7 +4,7 @@
 
 from cryptography.fernet import Fernet, InvalidToken
 
-from app.modules.db.db_model import Cred, OidcProvider, conn
+from app.modules.db.db_model import Cred, OidcProvider, OperationJob, conn
 
 
 SECRET_FIELDS = ('password', 'passphrase', 'private_key')
@@ -71,6 +71,21 @@ def rotate_credentials() -> int:
             ).where(OidcProvider.id == provider.id).execute()
             rotated_credentials += 1
 
+        if OperationJob.table_exists():
+            for job in OperationJob.select().where(OperationJob.payload.is_null(False)):
+                token = job.payload.encode('ascii')
+                try:
+                    plaintext = old_fernet.decrypt(token)
+                except InvalidToken as exc:
+                    try:
+                        new_fernet.decrypt(token)
+                    except InvalidToken:
+                        raise RuntimeError(f'Operation {job.task_id} contains an invalid payload token') from exc
+                    continue
+                OperationJob.update(payload=new_fernet.encrypt(plaintext).decode('ascii')).where(
+                    OperationJob.task == job.task_id).execute()
+                rotated_credentials += 1
+
     return rotated_credentials
 
 
diff --git a/runtime_health.py b/runtime_health.py
new file mode 100644
index 0000000..eca4d5a
--- /dev/null
+++ b/runtime_health.py
@@ -0,0 +1,26 @@
+"""Local process probes; polling health never adds database traffic."""
+import json
+import os
+from pathlib import Path
+import time
+
+
+def path(role):
+    return Path(os.getenv('RMON_PROCESS_HEALTH_DIR', '/tmp')) / f'rmon-{role}-health.json'
+
+
+def pulse(role, ready=True):
+    target = path(role)
+    temporary = target.with_suffix(f'.{os.getpid()}.tmp')
+    with temporary.open('w', encoding='utf-8') as stream:
+        json.dump({'time': time.time(), 'ready': ready}, stream)
+    temporary.chmod(0o600)
+    os.replace(temporary, target)
+
+
+def healthy(role, ready=True):
+    try:
+        state = json.loads(path(role).read_text(encoding='utf-8'))
+        return 0 <= time.time() - state['time'] < 90 and (not ready or state['ready'] is True)
+    except (OSError, ValueError, KeyError, TypeError):
+        return False
diff --git a/scheduler_runner.py b/scheduler_runner.py
index f1d9a22..54cd63a 100644
--- a/scheduler_runner.py
+++ b/scheduler_runner.py
@@ -2,14 +2,24 @@
 
 import os
 import threading
+import runtime_health
+from apscheduler.executors.pool import ThreadPoolExecutor
 
 
-os.environ.setdefault('RMON_SCHEDULER_ENABLED', '1')
+os.environ['RMON_SCHEDULER_ENABLED'] = '1'
 
 from app import scheduler  # noqa: E402
 
 
-if __name__ == '__main__':
+def main():
     if not scheduler.running:
         raise RuntimeError('The scheduler did not start')
+    scheduler.scheduler.add_executor(ThreadPoolExecutor(1), alias='process-health')
+    scheduler.add_job(id='process-health', func=runtime_health.pulse, args=['scheduler'],
+                      trigger='interval', seconds=5, executor='process-health', max_instances=1, coalesce=True)
+    runtime_health.pulse('scheduler')
     threading.Event().wait()
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/container/agent_tls_smoke.py b/tests/container/agent_tls_smoke.py
new file mode 100644
index 0000000..e25f142
--- /dev/null
+++ b/tests/container/agent_tls_smoke.py
@@ -0,0 +1,122 @@
+"""Exercise the real certificate tasks using temporary files and the web identity."""
+import configparser
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+from contextlib import contextmanager
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import ssl
+import threading
+
+
+@contextmanager
+def receiver(mode, certificate, key, ca):
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            self.send_response(401)
+            self.end_headers()
+
+        def log_message(self, *_args):
+            pass
+
+    server = ThreadingHTTPServer(('127.0.0.1', 0), Handler)
+    if mode != 'http':
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        context.load_cert_chain(certificate, key)
+        if mode == 'mtls':
+            context.load_verify_locations(ca)
+            context.verify_mode = ssl.CERT_REQUIRED
+        server.socket = context.wrap_socket(server.socket, server_side=True)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield server.server_address[1]
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+
+def run(role):
+    role = Path(role).resolve()
+    with tempfile.TemporaryDirectory(prefix='rmon-agent-tls-test-') as directory:
+        root = Path(directory)
+        ca, ca_key = root / 'issuer.crt', root / 'issuer.key'
+        subprocess.run(['openssl', 'req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-days', '2',
+                        '-subj', '/CN=Temporary test issuer', '-addext', 'basicConstraints=critical,CA:TRUE',
+                        '-keyout', str(ca_key), '-out', str(ca)], check=True, capture_output=True)
+        targets = [root / 'existing-paths' / name for name in ('trust.pem', 'client.pem', 'private.pem')]
+        config = root / 'agent.cfg'
+        config.write_text('[master]\nscheme = http\n[untouched]\nsetting = keep-me\n')
+        options = dict(zip(('master.ca_file', 'master.client_cert', 'master.client_key'), map(str, targets)))
+        variables = {'ansible_python_interpreter': sys.executable, 'agent_existing_options': options,
+                     'agent_config_path': str(config), 'agent_mtls_enabled': True,
+                     'agent_uuid': '181a769d-ecf2-4f2a-a7a4-f47800a745a1',
+                     'agent_tls_ca_file': str(ca), 'agent_tls_ca_key_file': str(ca_key),
+                     'agent_certificate_directory': str(root / 'issued')}
+        playbook = root / 'test.json'
+        playbook.write_text(json.dumps([{'hosts': 'localhost', 'connection': 'local', 'gather_facts': False,
+            'vars_files': [str(role / 'defaults/main.yml')],
+            'tasks': [{'ansible.builtin.include_tasks': str(role / 'tasks/tls.yml')}]}]))
+
+        def apply(**overrides):
+            return subprocess.run(['ansible-playbook', '-i', 'localhost,', str(playbook), '-e',
+                                   json.dumps({**variables, **overrides})], capture_output=True, text=True, timeout=120)
+
+        first = apply()
+        assert first.returncode == 0, first.stdout + first.stderr
+        cfg = configparser.ConfigParser()
+        cfg.read(config)
+        assert cfg['master']['scheme'] == 'https' and cfg['master']['tls_verify'] == 'true'
+        assert cfg['untouched']['setting'] == 'keep-me'
+        assert [cfg['master'][key] for key in ('ca_file', 'client_cert', 'client_key')] == list(map(str, targets))
+        assert targets[2].stat().st_mode & 0o777 == 0o600
+        assert sorted(path.name for path in targets[0].parent.iterdir()) == sorted(path.name for path in targets)
+        snapshots = {path: (hashlib.sha256(path.read_bytes()).hexdigest(), path.stat().st_mtime_ns) for path in targets}
+        second = apply()
+        assert second.returncode == 0, second.stdout + second.stderr
+        assert snapshots == {path: (hashlib.sha256(path.read_bytes()).hexdigest(), path.stat().st_mtime_ns) for path in targets}
+        print('mTLS generation, original paths, private key permissions and repeat without rotation: passed', flush=True)
+
+        targets[2].unlink()
+        incomplete = apply()
+        assert incomplete.returncode != 0 and 'pair is incomplete' in incomplete.stdout
+        assert not targets[2].exists() and hashlib.sha256(targets[1].read_bytes()).hexdigest() == snapshots[targets[1]][0]
+        print('Incomplete existing pair is preserved and rejected: passed', flush=True)
+
+        issued = Path(variables['agent_certificate_directory']) / variables['agent_uuid']
+        copied = apply(agent_tls_generate=False, agent_tls_cert_file=str(issued / 'agent.crt'), agent_tls_key_file=str(issued / 'agent.key'))
+        assert copied.returncode == 0, copied.stdout + copied.stderr
+        assert hashlib.sha256(targets[2].read_bytes()).hexdigest() == snapshots[targets[2]][0]
+        wrong = apply(agent_tls_cert_file=str(issued / 'agent.crt'), agent_tls_key_file=str(ca_key))
+        assert wrong.returncode != 0 and 'does not match' in wrong.stdout
+        print('Supplied certificate copying and mismatched key rejection: passed', flush=True)
+
+        server_key, server_cert, csr = (root / name for name in ('server.key', 'server.crt', 'server.csr'))
+        extensions = root / 'server.ext'
+        extensions.write_text('subjectAltName=IP:127.0.0.1\nextendedKeyUsage=serverAuth\n')
+        subprocess.run(['openssl', 'req', '-new', '-newkey', 'rsa:2048', '-nodes', '-subj', '/CN=Test receiver',
+                        '-keyout', str(server_key), '-out', str(csr)], check=True, capture_output=True)
+        subprocess.run(['openssl', 'x509', '-req', '-in', str(csr), '-CA', str(ca), '-CAkey', str(ca_key),
+                        '-CAcreateserial', '-days', '2', '-extfile', str(extensions), '-out', str(server_cert)],
+                       check=True, capture_output=True)
+        for mode in ('http', 'https', 'mtls'):
+            with receiver(mode, server_cert, server_key, ca) as port:
+                checked = apply(agent_transport=mode, agent_mtls_enabled=mode == 'mtls',
+                                agent_tls_cert_file=str(issued / 'agent.crt'),
+                                agent_tls_key_file=str(issued / 'agent.key'),
+                                agent_verify_result_connection=True, master_ip='127.0.0.1', master_port=port)
+                assert checked.returncode == 0, checked.stdout + checked.stderr
+                print(f'{mode}: verified result-server connection through Ansible passed', flush=True)
+        with receiver('https', server_cert, server_key, ca) as port:
+            rejected = apply(agent_transport='mtls', agent_mtls_enabled=True,
+                             agent_verify_result_connection=True, master_ip='127.0.0.1', master_port=port)
+            assert rejected.returncode != 0 and 'must require a trusted client certificate' in rejected.stdout
+            print('mTLS selection rejects a server without mandatory client authentication: passed', flush=True)
+
+
+if __name__ == '__main__':
+    run(sys.argv[1] if len(sys.argv) > 1 else Path(__file__).resolve().parents[2] / 'app/scripts/ansible/roles/rmon_agent')
diff --git a/tests/container/image_smoke.py b/tests/container/image_smoke.py
new file mode 100644
index 0000000..2d57012
--- /dev/null
+++ b/tests/container/image_smoke.py
@@ -0,0 +1,163 @@
+"""Run against locally built web/proxy images; owns only uniquely named test resources."""
+import base64
+import http.cookiejar
+import json
+import os
+from pathlib import Path
+import secrets
+import socket
+import ssl
+import subprocess
+import tempfile
+import time
+import urllib.error
+import urllib.request
+import uuid
+
+WEB_IMAGE = os.getenv('RMON_TEST_WEB_IMAGE', 'rmon-web:test')
+PROXY_IMAGE = os.getenv('RMON_TEST_PROXY_IMAGE', 'rmon-proxy:test')
+
+
+def docker(*args, check=True):
+    return subprocess.run(['docker', *args], text=True, capture_output=True, check=check, timeout=90)
+
+
+def wait_ready(name):
+    deadline = time.monotonic() + 90
+    while time.monotonic() < deadline:
+        state = json.loads(docker('inspect', name).stdout)[0]['State']
+        if state.get('Health', {}).get('Status') == 'healthy':
+            return
+        if not state['Running']:
+            raise AssertionError('Container exited: ' + docker('logs', name).stderr)
+        time.sleep(2)
+    raise AssertionError('Container not ready: ' + docker('logs', name).stderr)
+
+
+def request(opener, url, payload=None):
+    data = json.dumps(payload).encode() if payload is not None else None
+    return opener.open(urllib.request.Request(url, data=data, headers={'Content-Type': 'application/json'}), timeout=30)
+
+
+def exercise(scheme):
+    prefix = 'rmon-smoke-' + uuid.uuid4().hex[:12]
+    network = prefix + '-network'
+    web, proxy = (prefix + '-' + component for component in ('web', 'proxy'))
+    workers = {role: prefix + '-' + role for role in ('scheduler', 'operations')}
+    volumes = [prefix + '-' + name for name in ('config', 'data', 'logs', 'tls')]
+    mounts = sum((['-v', name + ':' + path] for name, path in zip(volumes[:3],
+                  ('/etc/rmon', '/var/lib/rmon', '/var/log/rmon'))), [])
+    port = 8080
+    password = secrets.token_urlsafe(24)
+    try:
+        docker('network', 'create', network)
+        with tempfile.TemporaryDirectory(prefix=prefix) as temporary:
+            temporary = Path(temporary)
+            password_file = temporary / 'password'
+            password_file.write_text(password)
+            password_file.chmod(0o600)
+            init = [*mounts, '-v', f'{password_file}:/run/password:ro', '-e', 'RMON_ADMIN_PASSWORD_FILE=/run/password']
+            docker('run', '--rm', *init, WEB_IMAGE, 'init')
+            assert docker('run', '--rm', *init, WEB_IMAGE, 'init', check=False).returncode != 0
+            snapshots = []
+            for _ in range(2):
+                docker('run', '-d', '--name', web, '--network', network, '--network-alias', 'web',
+                       '--security-opt', 'no-new-privileges:true', *mounts,
+                       '-e', 'RMON_COOKIE_SECURE=' + ('1' if scheme == 'https' else '0'), WEB_IMAGE)
+                wait_ready(web)
+                for role, name in workers.items():
+                    docker('run', '-d', '--name', name, '--network', network, *mounts,
+                           '--security-opt', 'no-new-privileges:true',
+                           '--health-cmd', '/opt/rmon-venv/bin/python -m container.runtime healthcheck --role ' + role,
+                           WEB_IMAGE, role)
+                    wait_ready(name)
+                docker('run', '-d', '--name', proxy, '--network', network, '-p', f'127.0.0.1::{port}',
+                       '-e', f'RMON_PROXY_SCHEME={scheme}',
+                       '-e', 'RMON_TLS_NAME=127.0.0.1', '-v', f'{volumes[3]}:/etc/ssl/certs/rmon', PROXY_IMAGE)
+                mapped = int(docker('port', proxy, str(port)).stdout.strip().split(':')[-1])
+                deadline = time.monotonic() + 60
+                while True:
+                    result = docker('exec', proxy, 'nginx', '-t', check=False)
+                    cert_ready = scheme == 'http' or docker('exec', proxy, 'test', '-f', '/etc/ssl/certs/rmon.crt', check=False).returncode == 0
+                    if result.returncode == 0 and cert_ready:
+                        break
+                    if time.monotonic() > deadline:
+                        raise AssertionError(docker('logs', proxy).stderr)
+                    time.sleep(1)
+                context = ssl.create_default_context()
+                if scheme == 'https':
+                    cert = temporary / 'rmon.crt'
+                    docker('cp', f'{proxy}:/etc/ssl/certs/rmon/rmon.crt', str(cert))
+                    context.load_verify_locations(cafile=str(cert))
+                opener = urllib.request.build_opener(urllib.request.ProxyHandler({}),
+                    urllib.request.HTTPSHandler(context=context),
+                    urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()))
+                origin = f'{scheme}://127.0.0.1:{mapped}'
+                # The proxy may still be opening its listener immediately after nginx -t.
+                while True:
+                    try:
+                        with request(opener, origin + '/login') as response:
+                            assert response.status == 200
+                        break
+                    except (urllib.error.URLError, ConnectionError):
+                        if time.monotonic() > deadline:
+                            raise
+                        time.sleep(1)
+                with request(opener, origin + '/login', {'login': 'admin', 'pass': password}) as response:
+                    assert json.load(response)['status'] == 'done'
+                    cookies = response.headers.get_all('Set-Cookie') or []
+                    assert any('access_token_cookie=' in value for value in cookies)
+                    assert any('Secure' in value for value in cookies) is (scheme == 'https')
+                with request(opener, origin + '/admin') as response:
+                    assert response.status == 200
+                try:
+                    request(opener, origin + '/_rmon/ready')
+                    raise AssertionError('Public readiness must be blocked')
+                except urllib.error.HTTPError as error:
+                    assert error.code == 404
+                with socket.create_connection(('127.0.0.1', mapped), timeout=10) as raw:
+                    connection = context.wrap_socket(raw, server_hostname='127.0.0.1') if scheme == 'https' else raw
+                    with connection:
+                        key = base64.b64encode(secrets.token_bytes(16)).decode()
+                        connection.sendall((f'GET / HTTP/1.1\r\nHost: 127.0.0.1:{mapped}\r\nUpgrade: websocket\r\n'
+                                            f'Connection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n').encode())
+                        status = connection.recv(4096).split(b'\r\n', 1)[0]
+                        assert status.split()[1] in (b'200', b'302'), status
+                docker('exec', web, '/opt/rmon-venv/bin/python', '-c', 'import ldap, ansible_runner')
+                # Agent installation runs in operations under the application identity.
+                docker('exec', '--user', '33:33', workers['operations'], 'ansible-playbook', '--syntax-check',
+                       '/var/www/rmon/app/scripts/ansible/roles/rmon_agent.yml', '-i', 'localhost,')
+                if scheme == 'http' and not snapshots:
+                    docker('cp', str(Path(__file__).with_name('agent_tls_smoke.py')), f'{workers["operations"]}:/tmp/agent_tls_smoke.py')
+                    subprocess.run(['docker', 'exec', '--user', '33:33', workers['operations'], '/opt/rmon-venv/bin/python',
+                                    '/tmp/agent_tls_smoke.py', '/var/www/rmon/app/scripts/ansible/roles/rmon_agent'],
+                                   check=True, timeout=600)
+                snapshot = docker('exec', web, '/opt/rmon-venv/bin/python', '-c',
+                    "from pathlib import Path; import hashlib,json; "
+                    "paths=[Path('/etc/rmon/rmon.cfg'), *Path('/var/lib/rmon/keys').glob('*')]; "
+                    "print(json.dumps({str(p):hashlib.sha256(p.read_bytes()).hexdigest() for p in paths if p.is_file()}))").stdout
+                snapshots.append(json.loads(snapshot))
+                # Prove the healthcheck checks the DB, not just an open HTTP port.
+                sql = "import sqlite3; db=sqlite3.connect('/var/lib/rmon/rmon.db'); db.execute(%r); db.commit(); db.close()"
+                docker('exec', web, '/opt/rmon-venv/bin/python', '-c', sql % 'ALTER TABLE settings RENAME TO settings_outage')
+                try:
+                    assert docker('exec', web, '/opt/rmon-venv/bin/python', '-m', 'container.runtime', 'healthcheck', check=False).returncode != 0
+                finally:
+                    docker('exec', web, '/opt/rmon-venv/bin/python', '-c', sql % 'ALTER TABLE settings_outage RENAME TO settings')
+                docker('exec', web, '/opt/rmon-venv/bin/python', '-m', 'container.runtime', 'healthcheck')
+                for name in (proxy, *workers.values(), web):
+                    docker('stop', '--time', '30', name)
+                    docker('rm', name)
+            assert snapshots[0] == snapshots[1], 'Application secrets or config changed after recreation'
+            print(scheme + ': web, scheduler, operations, proxy, login, DB outage and persistence passed', flush=True)
+    finally:
+        for name in (proxy, *workers.values(), web):
+            docker('rm', '-f', name, check=False)
+        docker('network', 'rm', network, check=False)
+        for name in volumes:
+            docker('volume', 'rm', name, check=False)
+
+
+if __name__ == '__main__':
+    for mode in ('http', 'https'):
+        exercise(mode)
diff --git a/tests/container/stack_smoke.py b/tests/container/stack_smoke.py
new file mode 100644
index 0000000..e9717e7
--- /dev/null
+++ b/tests/container/stack_smoke.py
@@ -0,0 +1,309 @@
+"""Opt-in Linux integration check using an existing, authorized SSH host.
+
+Owns a separate Compose project, database and agent directory. SSH credentials
+stay on the host and are re-encrypted into the temporary database, never logged.
+"""
+import argparse
+import configparser
+from contextlib import closing
+import hashlib
+import http.cookiejar
+import json
+import os
+from pathlib import Path
+import secrets
+import shutil
+import socket
+import sqlite3
+import subprocess
+import tempfile
+import time
+from urllib.parse import urlencode
+from urllib.request import build_opener, ProxyHandler, HTTPCookieProcessor, Request
+from uuid import uuid4
+
+
+def run(*args, check=True, timeout=180, **kwargs):
+    result = subprocess.run(args, capture_output=True, text=True, timeout=timeout, **kwargs)
+    if check and result.returncode:
+        raise RuntimeError(f'{args[0]} failed: {result.stderr[-3000:]}')
+    return result
+
+
+def free_port(address):
+    with socket.socket() as listener:
+        listener.bind((address, 0))
+        return listener.getsockname()[1]
+
+
+def exercise(args):
+    if os.geteuid() != 0:
+        raise RuntimeError('Run on the authorized Linux Docker/SSH validation host')
+    if run('systemctl', 'is-active', '--quiet', 'rmon-agent', check=False).returncode == 0:
+        raise RuntimeError('This check must not stop an existing native agent service')
+    prefix = 'rmon-stack-test-' + uuid4().hex[:12]
+    root = Path(tempfile.mkdtemp(prefix=prefix + '-', dir='/tmp'))
+    source = Path(args.source).resolve()
+    agent_name = prefix + '-agent'
+    agent_root = root / 'agent'
+    project = ['docker', 'compose', '--project-name', prefix, '--project-directory', str(source),
+               '-f', str(source / 'compose.yaml'), '-f', str(source / 'compose.server.yaml')]
+    password = secrets.token_urlsafe(24)
+    ports = {key: free_port(args.bind_ip) for key in ('web', 'server', 'agent')}
+    origin = f'http://{args.bind_ip}:{ports["web"]}'
+    environment = {**{key: value for key, value in os.environ.items() if not key.startswith('RMON_')},
+                   'RMON_WEB_IMAGE': args.web_image, 'RMON_PROXY_IMAGE': args.proxy_image,
+                   'RMON_SERVER_IMAGE': args.server_image, 'RMON_AGENT_IMAGE': args.agent_image,
+                   'RMON_BIND_IP': args.bind_ip, 'RMON_WEB_PORT': str(ports['web']),
+                   'RMON_SERVER_BIND_IP': args.bind_ip, 'RMON_SERVER_PORT': str(ports['server']),
+                   'RMON_PUBLIC_URL': origin, 'RMON_AGENT_CONTROL_URL': origin,
+                   'RMON_COOKIE_SECURE': '0', 'RMON_PROXY_SCHEME': 'http',
+                   'RMON_SERVER_TOKEN_FILE': str(root / 'server-token')}
+    for key, folder in [('CONFIG', 'config'), ('DATA', 'data'), ('LOG', 'logs'), ('TLS', 'tls')]:
+        path = root / folder
+        path.mkdir()
+        environment[f'RMON_{key}_SOURCE'] = str(path)
+    for name, value in [('password', password), ('server-token', secrets.token_urlsafe(32))]:
+        path = root / name
+        path.write_text(value)
+        path.chmod(0o600)
+        os.chown(path, 33, 33)
+    mounts = sum((['-v', f'{root / name}:{target}'] for name, target in
+                  [('config', '/etc/rmon'), ('data', '/var/lib/rmon'), ('logs', '/var/log/rmon')]), [])
+    database = root / 'data/rmon.db'
+    cookies = http.cookiejar.CookieJar()
+    opener = build_opener(ProxyHandler({}), HTTPCookieProcessor(cookies))
+
+    def compose(*commands, **kwargs):
+        return run(*project, *commands, env=environment, **kwargs)
+
+    def container(service):
+        return compose('ps', '-q', service).stdout.strip()
+
+    def execute(service, code):
+        return run('docker', 'exec', '-i', '--user', '33:33', '-e', 'RMON_SCHEDULER_ENABLED=0',
+                   container(service), '/opt/rmon-venv/bin/python', '-', input=code).stdout
+
+    def sql(statement, parameters=()):
+        with closing(sqlite3.connect(database)) as connection:
+            with connection:
+                return connection.execute(statement, parameters).fetchall()
+
+    def ready(*services):
+        deadline = time.monotonic() + 180
+        while time.monotonic() < deadline:
+            states = []
+            for service in services:
+                name = container(service)
+                if not name:
+                    raise AssertionError(service + ' was not created')
+                state = json.loads(run('docker', 'inspect', name).stdout)[0]['State']
+                if not state['Running']:
+                    raise AssertionError(service + ' exited')
+                states.append(state.get('Health', {}).get('Status') == 'healthy')
+            if all(states):
+                return
+            time.sleep(3)
+        raise AssertionError('Services did not become healthy: ' + ', '.join(services))
+
+    def request(path, payload=None, *, form=False, method=None, expected=200):
+        headers = {'Content-Type': 'application/x-www-form-urlencoded' if form else 'application/json'}
+        for cookie in cookies:
+            if cookie.name == 'csrf_access_token':
+                headers['X-CSRF-TOKEN'] = cookie.value
+        data = (urlencode(payload) if form else json.dumps(payload)).encode() if payload is not None else None
+        with opener.open(Request(origin + path, data=data, headers=headers, method=method), timeout=40) as response:
+            assert response.status == expected, (path, response.status)
+            return json.load(response)
+
+    def login():
+        assert request('/login', {'login': 'admin', 'pass': password})['status'] == 'done'
+
+    def isolate_job(task_id):
+        # Only the test target's paths/name change. Product defaults remain intact.
+        overrides = {'agent_container_name': agent_name, 'agent_config_path': str(agent_root / 'rmon-agent.cfg'),
+                     'agent_data_path': str(agent_root / 'data'), 'agent_log_path': str(agent_root / 'logs'),
+                     'agent_lock_path': str(root / 'agent-lock'), 'agent_bind_ip': args.bind_ip,
+                     'agent_image': args.agent_image, 'agent_pull': 'never'}
+        execute('web', f'''
+import json
+from cryptography.fernet import Fernet
+from app.modules.db.db_model import OperationJob
+from app.modules.server.ssh import _get_fernet_key
+job = OperationJob.get_by_id({task_id})
+assert job.status == 'queued'
+codec = Fernet(_get_fernet_key())
+payload = json.loads(codec.decrypt(job.payload.encode()))
+host = payload['inventory']['server']['hosts'][{args.ssh_host!r}]
+host.update({overrides!r})
+job.payload = codec.encrypt(json.dumps(payload).encode()).decode()
+job.save()
+''')
+
+    def wait_task(task_id):
+        deadline = time.monotonic() + 480
+        while time.monotonic() < deadline:
+            status = request(f'/api/v1.0/rmon/task-status/{task_id}')['status']
+            if status == 'completed':
+                return
+            if status == 'failed':
+                raise AssertionError(f'Agent operation {task_id} failed; inspect operations logs')
+            time.sleep(3)
+        raise AssertionError('Agent operation did not complete')
+
+    def fresh_result(check_id, previous):
+        deadline = time.monotonic() + 180
+        while time.monotonic() < deadline:
+            rows = sql('SELECT h.rowid,h.status FROM smon_history h JOIN smon s ON s.id=h.smon_id '
+                       'WHERE s.multi_check_id=? AND h.rowid>? ORDER BY h.rowid DESC', (check_id, previous))
+            if rows and rows[0][1] == 1:
+                return rows[0][0]
+            time.sleep(3)
+        raise AssertionError('No fresh successful check result')
+
+    def fingerprints():
+        paths = [root / 'config/rmon.cfg', *(root / 'data/keys').glob('rmon-key*')]
+        return {str(path): hashlib.sha256(path.read_bytes()).hexdigest() for path in paths if path.is_file()}
+
+    try:
+        # Upgrade a genuine database created by the previous container image.
+        run('docker', 'run', '--rm', *mounts, '-v', f'{root / "password"}:/run/password:ro',
+            '-e', 'RMON_ADMIN_PASSWORD_FILE=/run/password', args.previous_image, 'init')
+        before = fingerprints()
+        sql('CREATE TABLE readiness_marker (value TEXT)')
+        sql('INSERT INTO readiness_marker VALUES (?)', (prefix,))
+        migration = run('docker', 'run', '--rm', '--user', '33:33', *mounts,
+                        '-e', 'RMON_SCHEDULER_ENABLED=0',
+                        '--entrypoint', '/opt/rmon-venv/bin/python',
+                        args.web_image, 'app/migrate.py', 'migrate')
+        assert '20260916000000_add_operation_queue' in migration.stdout
+        assert sql('SELECT value FROM readiness_marker') == [(prefix,)]
+        assert before == fingerprints()
+        print('Existing installation: migration preserved configuration, keys and data', flush=True)
+
+        # Use only the already authorized host credential, with read-only source access.
+        cfg = configparser.ConfigParser(interpolation=None)
+        cfg.read(args.ssh_source_config)
+        with closing(sqlite3.connect(f'file:{args.ssh_source_db}?mode=ro', uri=True)) as connection:
+            connection.row_factory = sqlite3.Row
+            credential = dict(connection.execute('SELECT c.* FROM cred c JOIN servers s ON s.cred_id=c.id '
+                                                  'WHERE s.id=?', (args.ssh_server_id,)).fetchone())
+        seed = root / 'seed.json'
+        seed.write_text(json.dumps({'credential': credential, 'key': cfg['main']['secret_phrase']}))
+        seed.chmod(0o600)
+        os.chown(seed, 33, 33)
+        seed_code = f'''
+import json
+from pathlib import Path
+from cryptography.fernet import Fernet
+from app.modules.db.db_model import Cred, Server, Setting
+from app.modules.server.ssh import crypt_password
+source = json.loads(Path('/run/seed.json').read_text())
+old = source['credential']
+codec = Fernet(source['key'].encode())
+values = {{name: crypt_password(codec.decrypt(old[name].encode()).decode()).decode() if old[name] else None
+          for name in ('private_key', 'password', 'passphrase')}}
+cred = Cred.create(name='container-readiness-ssh', username=old['username'], key_enabled=old['key_enabled'],
+                   group_id=1, **values)
+Server.create(hostname='container-readiness', ip={args.ssh_host!r}, group_id='1', cred_id=cred.id)
+for name, value in {{'master_ip': {args.bind_ip!r}, 'master_port': {str(ports['server'])!r}}}.items():
+    Setting.update(value=value).where(Setting.param == name).execute()
+'''
+        run('docker', 'run', '--rm', '-i', '--user', '33:33', *mounts, '-v', f'{seed}:/run/seed.json:ro',
+            '-e', 'RMON_SCHEDULER_ENABLED=0', '-e', 'RMON_PROMETHEUS_MULTIPROC_DIR=/tmp',
+            '--entrypoint', '/opt/rmon-venv/bin/python',
+            args.web_image, '-', input=seed_code)
+        seed.unlink()
+        compose('up', '-d', '--no-build', 'web', 'proxy', 'server', 'scheduler')
+        ready('web', 'server', 'scheduler')
+        login()
+        server_id = sql('SELECT id FROM servers WHERE ip=?', (args.ssh_host,))[0][0]
+        created = request('/api/v1.0/rmon/agent', {'name': 'Container readiness', 'server_id': server_id,
+                          'port': ports['agent'], 'description': '', 'result_transport': 'http'}, expected=202)
+        agent_id, task_id = created['id'], created['tasks_ids'][0]
+        isolate_job(task_id)
+        compose('restart', 'web')
+        ready('web')
+        login()
+        assert request(f'/api/v1.0/rmon/task-status/{task_id}')['status'] == 'created'
+        compose('up', '-d', '--no-build', 'operations')
+        ready('operations')
+        wait_task(task_id)
+        print('Queued installation survived web restart and completed through operations/SSH/Ansible', flush=True)
+        execute('operations', '''
+import os, time
+from pathlib import Path
+root = Path('/var/www/rmon/app/scripts/ansible/artifacts')
+old = root / 'readiness-old-artifact'
+old.mkdir()
+(root / 'readiness-recent-artifact').mkdir()
+os.utime(old, (time.time() - 3 * 86400,) * 2)
+''')
+        compose('restart', 'operations')
+        ready('operations')
+        execute('operations', '''
+from pathlib import Path
+root = Path('/var/www/rmon/app/scripts/ansible/artifacts')
+assert not (root / 'readiness-old-artifact').exists()
+assert (root / 'readiness-recent-artifact').is_dir()
+''')
+        print('Operations restart cleaned old temporary artifacts and preserved recent files', flush=True)
+
+        def add_check(name):
+            return request('/api/v1.0/rmon/check/http', {'name': name, 'place': 'agent', 'entities': [agent_id],
+                'url': origin + '/login', 'method': 'get', 'interval': 10, 'check_timeout': 3,
+                'retries': 1, 'accepted_status_codes': [200]}, expected=201)['id']
+
+        check_id = add_check('Container readiness HTTP')
+        result_id = fresh_result(check_id, 0)
+        print('Agent execution and RMON Server ingestion produced a fresh successful result', flush=True)
+        identity = sql('SELECT uuid FROM smon_agents WHERE id=?', (agent_id,))[0][0]
+        saved = fingerprints()
+        compose('stop', 'operations')
+        action = request('/rmon/agent/action/restart', {'agent_id': agent_id}, form=True, expected=202)
+        isolate_job(action['task_id'])
+        compose('up', '-d', '--no-build', '--force-recreate', 'web', 'proxy', 'server', 'scheduler', 'operations')
+        ready('web', 'server', 'scheduler', 'operations')
+        login()
+        wait_task(action['task_id'])
+        fresh_result(check_id, result_id)
+        second_check = add_check('Container readiness after recreation')
+        fresh_result(second_check, 0)
+        assert sql('SELECT uuid FROM smon_agents WHERE id=?', (agent_id,)) == [(identity,)]
+        assert fingerprints() == saved
+        assert sql('SELECT value FROM readiness_marker') == [(prefix,)]
+        print('Recreated services retained queued work, identity, secrets, history and new successful checks', flush=True)
+        for service in ('web', 'scheduler', 'operations', 'server'):
+            logs = compose('logs', '--no-color', service).stdout
+            assert 'Traceback (most recent call last)' not in logs, service + ' has a traceback'
+        print('Full container stack readiness: passed', flush=True)
+    except Exception:
+        report = Path('/tmp') / (prefix + '-failure.log')
+        report.write_text(compose('logs', '--no-color', check=False).stdout)
+        report.chmod(0o600)
+        print('Validation failure log:', report, flush=True)
+        raise
+    finally:
+        compose('down', '--remove-orphans', check=False, timeout=240)
+        listed = run('docker', 'ps', '-a', '--filter', 'name=' + agent_name, '--format', '{{.Names}}', check=False)
+        for name in listed.stdout.splitlines():
+            if name == agent_name or name.startswith(agent_name + '-previous-'):
+                run('docker', 'rm', '-f', name, check=False)
+        assert root.parent == Path('/tmp') and root.name.startswith(prefix + '-') and not root.is_symlink()
+        shutil.rmtree(root)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--source', required=True)
+    parser.add_argument('--bind-ip', required=True)
+    parser.add_argument('--ssh-host', required=True)
+    parser.add_argument('--ssh-source-config', required=True)
+    parser.add_argument('--ssh-source-db', required=True)
+    parser.add_argument('--ssh-server-id', type=int, required=True)
+    parser.add_argument('--previous-image', required=True)
+    parser.add_argument('--web-image', default='rmon-web:test')
+    parser.add_argument('--proxy-image', default='rmon-proxy:test')
+    parser.add_argument('--server-image', required=True)
+    parser.add_argument('--agent-image', required=True)
+    exercise(parser.parse_args())
diff --git a/tests/container/test_agent_inventory.py b/tests/container/test_agent_inventory.py
new file mode 100644
index 0000000..6bd1c8b
--- /dev/null
+++ b/tests/container/test_agent_inventory.py
@@ -0,0 +1,60 @@
+import configparser
+from types import SimpleNamespace
+import uuid
+
+import pytest
+
+from app.modules.tools import smon_agent
+
+
+@pytest.fixture
+def config(monkeypatch):
+    cfg = configparser.ConfigParser()
+    monkeypatch.setattr(smon_agent, 'GetConfigVar', lambda: SimpleNamespace(config=cfg))
+    monkeypatch.setattr(smon_agent.sql, 'get_setting', lambda key: {'master_ip': 'receiver.test', 'master_port': '5100'}[key])
+    monkeypatch.delenv('RMON_AGENT_CONTROL_URL', raising=False)
+    monkeypatch.delenv('RMON_AGENT_IMAGE', raising=False)
+    return cfg
+
+
+def test_existing_installation_does_not_implicitly_change_transport(config):
+    inventory, hosts = smon_agent.generate_agent_inv('host.test', 'install', str(uuid.uuid4()))
+    settings = inventory['server']['hosts']['host.test']
+    assert hosts == ['host.test']
+    assert 'agent_transport' not in settings and 'agent_mtls_enabled' not in settings
+    assert settings['master_ip'] == 'receiver.test'
+
+
+@pytest.mark.parametrize('configured,environment,expected', [
+    (None, None, 'ghcr.io/roxy-wi/rmon/rmon-agent:2.0'),
+    ('example.invalid/rmon-agent:pinned', None, 'example.invalid/rmon-agent:pinned'),
+    ('example.invalid/rmon-agent:pinned', 'example.invalid/rmon-agent:custom',
+     'example.invalid/rmon-agent:custom'),
+])
+def test_agent_image_default_and_explicit_overrides(config, monkeypatch, configured, environment, expected):
+    if configured:
+        config['agent_deployment'] = {'image': configured}
+    if environment:
+        monkeypatch.setenv('RMON_AGENT_IMAGE', environment)
+    inventory, _ = smon_agent.generate_agent_inv('host.test', 'install', str(uuid.uuid4()))
+    assert inventory['server']['hosts']['host.test']['agent_image'] == expected
+
+
+def test_global_tls_settings_cannot_override_group_or_existing_agents(config):
+    config['agent_deployment'] = {
+        'transport': 'https', 'mtls_enabled': 'true', 'tls_generate': 'true',
+        'tls_ca_file': '/run/issuer/ca.crt', 'tls_ca_key_file': '/run/issuer/ca.key',
+        'bind_ip': '172.17.0.1', 'pull': 'never',
+    }
+    inventory, _ = smon_agent.generate_agent_inv('host.test', 'install', str(uuid.uuid4()))
+    settings = inventory['server']['hosts']['host.test']
+    assert 'agent_mtls_enabled' not in settings
+    assert 'agent_tls_ca_key_file' not in settings
+    assert 'agent_tls_ca_file' not in settings
+    assert settings['agent_bind_ip'] == '172.17.0.1'
+    assert settings['agent_pull'] == 'never'
+
+
+def test_explicit_transport_requires_owner_group(config):
+    with pytest.raises(ValueError, match='owner group'):
+        smon_agent.generate_agent_inv('host.test', 'install', str(uuid.uuid4()), result_transport='mtls')
diff --git a/tests/container/test_application.py b/tests/container/test_application.py
new file mode 100644
index 0000000..4a6b48b
--- /dev/null
+++ b/tests/container/test_application.py
@@ -0,0 +1,119 @@
+from pathlib import Path
+import os
+import subprocess
+import sys
+from unittest.mock import Mock
+
+import pytest
+from flask import render_template
+
+from app.modules.tools import common
+from app.modules.roxywi import roxy
+from app.modules.service import installation
+
+
+@pytest.fixture(autouse=True)
+def container_mode(monkeypatch):
+    monkeypatch.setenv('RMON_CONTAINER', '1')
+    monkeypatch.delenv('RMON_SERVER_INTERNAL_URL', raising=False)
+
+
+def test_migration_cli_works_without_service_metrics_directory(tmp_path):
+    metrics_directory = tmp_path / 'missing-service-metrics'
+    environment = dict(os.environ, RMON_PROMETHEUS_MULTIPROC_DIR=str(metrics_directory),
+                       RMON_SCHEDULER_ENABLED='1', TEMP=str(tmp_path), TMP=str(tmp_path), TMPDIR=str(tmp_path))
+    result = subprocess.run([sys.executable, 'app/migrate.py', 'list'],
+                            cwd=Path(__file__).resolve().parents[2], env=environment,
+                            text=True, capture_output=True, timeout=30)
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert '20260916000000_add_operation_queue' in result.stdout
+    assert not metrics_directory.exists()
+    assert not list(tmp_path.glob('rmon-migrate-metrics-*'))
+
+
+@pytest.mark.parametrize('service', ['rmon', 'rmon-server', 'fail2ban'])
+def test_container_never_installs_os_packages(monkeypatch, service):
+    monkeypatch.setattr(common.server_mod, 'subprocess_execute', Mock(side_effect=AssertionError('Package command')))
+    with pytest.raises(ValueError, match='outside'):
+        common.update_roxy_wi(service)
+
+
+@pytest.mark.parametrize('action', ['start', 'stop', 'restart'])
+def test_container_never_controls_local_daemons(monkeypatch, action):
+    monkeypatch.setattr(roxy.os, 'system', Mock(side_effect=AssertionError('Local service command')))
+    assert roxy.action_service(action, 'rmon-server').startswith('error:')
+
+
+def test_no_false_versions_or_package_queries_for_external_services(monkeypatch):
+    monkeypatch.setattr(common, '_version_command', Mock(side_effect=AssertionError('Package query')))
+    monkeypatch.setattr(common.server_mod, 'subprocess_execute', Mock(side_effect=AssertionError('Systemctl')))
+    assert common.is_tool_active('fail2ban') == 'external'
+    assert common.update_cur_tool_version('fail2ban') == {
+        'current_version': '0', 'installed': None, 'version_known': False, 'managed_by': 'external'}
+    monkeypatch.setattr(common.roxy_sql, 'get_all_tools', lambda: {'fail2ban': {'current_version': '1.0', 'new_version': '1.5'}})
+    service = common.get_services_status()[0]
+    assert service[2]['version_known'] is False
+    assert service[2]['update_available'] is False
+    assert service[2]['installed'] is None
+
+
+def test_external_server_can_still_report_version(monkeypatch):
+    monkeypatch.setenv('RMON_SERVER_INTERNAL_URL', 'https://receiver:5100')
+    monkeypatch.setattr(common, '_server_runtime_version', lambda: '7.0')
+    monkeypatch.setattr(common.roxy_sql, 'update_tool_cur_version', Mock())
+    assert common.update_cur_tool_version('rmon-server')['current_version'] == '7.0'
+
+
+def test_container_ui_hides_external_actions_and_own_package_update(app):
+    services = [['rmon-server', 'external', {'current_version': '0', 'new_version': '7.0',
+                                          'installed': None, 'version_known': False, 'managed_by': 'external'}]]
+    with app.test_request_context('/'):
+        services_html = render_template('ajax/load_services.html', services=services, lang='en')
+        update_html = render_template('ajax/load_updateroxywi.html', services=services, lang='en',
+                                      versions={'current_ver': '1.4.0', 'new_ver': '2.0', 'need_update': True,
+                                                'managed_by': 'docker'})
+    assert 'Managed externally' in services_html
+    assert 'confirmAjaxServiceAction' not in services_html
+    assert 'updateService(' not in update_html
+    assert 'Update container image' in update_html
+
+
+def test_agent_installation_no_longer_needs_source_payload():
+    role = Path(__file__).resolve().parents[2] / 'app/scripts/ansible/roles/rmon_agent'
+    install = (role / 'tasks/install.yml').read_text()
+    assert not (role / 'files/container_agent.py').exists()
+    assert '/var/www/rmon/app/tools/rmon-agent' not in install
+
+
+@pytest.mark.parametrize('available', [True, False])
+def test_container_uses_bundled_collections_and_never_downloads_at_runtime(monkeypatch, available):
+    monkeypatch.setattr(installation.subprocess, 'run', Mock(side_effect=AssertionError('Runtime download')))
+    monkeypatch.setattr(installation.Path, 'is_dir', lambda _: available)
+    if available:
+        assert installation._ensure_agent_collections().replace('\\', '/') == '/usr/share/ansible/collections'
+    else:
+        with pytest.raises(RuntimeError, match='Ansible collections are missing'):
+            installation._ensure_agent_collections()
+
+
+def test_container_log_job_does_not_chown_data(monkeypatch):
+    from app import jobs
+    monkeypatch.setattr(jobs.os, 'system', Mock(side_effect=AssertionError('Recursive chown')))
+    jobs.update_owner_on_log()
+
+
+def test_container_artifact_cleanup_preserves_writable_directory(tmp_path, monkeypatch):
+    from app import jobs
+    artifact = tmp_path / 'artifacts'
+    artifact.mkdir()
+    (artifact / 'run').mkdir()
+    (artifact / 'run' / 'result').write_text('private artifact')
+    import time
+    jobs.os.utime(artifact / 'run', (time.time() - 3 * 86400,) * 2)
+    (artifact / 'recent').mkdir()
+    original_scandir = jobs.os.scandir
+    monkeypatch.setattr(jobs.os.path, 'isdir', lambda path: str(path).endswith('/artifacts'))
+    monkeypatch.setattr(jobs.os, 'scandir', lambda path: original_scandir(artifact) if str(path).startswith('/var/www/') else original_scandir(path))
+    jobs.delete_ansible_artifacts()
+    assert artifact.is_dir()
+    assert list(artifact.iterdir()) == [artifact / 'recent']
diff --git a/tests/container/test_compose_config.py b/tests/container/test_compose_config.py
new file mode 100644
index 0000000..ad65cb8
--- /dev/null
+++ b/tests/container/test_compose_config.py
@@ -0,0 +1,158 @@
+"""Validate resolved deployment contracts with Compose, without a Docker daemon."""
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+@pytest.fixture
+def compose_config(tmp_path):
+    executable = os.getenv('RMON_TEST_COMPOSE_BINARY')
+    command = [executable] if executable else ['docker', 'compose']
+    if not executable and not shutil.which('docker'):
+        pytest.skip('Compose CLI is required; no Docker daemon is used')
+    # Never resolve a developer's real deployment settings or secrets in a test.
+    environment = {key: value for key, value in os.environ.items()
+                   if not key.startswith(('RMON_', 'COMPOSE_', 'DOCKER_'))}
+    environment['COMPOSE_DISABLE_ENV_FILE'] = 'true'
+    env_file = tmp_path / 'test.env'
+
+    def resolve(values=None, server=False):
+        env_file.write_text('\n'.join(f"{key}='{value}'" for key, value in (values or {}).items()), encoding='utf-8')
+        args = [*command, '--project-name', 'rmon-compose-test', '--project-directory', str(tmp_path),
+                '--env-file', str(env_file), '-f', str(ROOT / 'compose.yaml')]
+        if server:
+            args += ['-f', str(ROOT / 'compose.server.yaml')]
+        result = subprocess.run([*args, 'config', '--format', 'json'], env=environment,
+                                cwd=tmp_path, capture_output=True, text=True, timeout=30)
+        assert result.returncode == 0, result.stderr
+        config = json.loads(result.stdout)
+        # Compose versions serialize the list form as either a list or a map.
+        for service in config['services'].values():
+            settings = service.get('environment') or {}
+            if isinstance(settings, list):
+                settings = dict(entry.split('=', 1) for entry in settings if '=' in entry)
+            service['environment'] = settings
+        return config
+
+    return resolve
+
+
+def mounts(service):
+    return {mount['target']: mount for mount in service['volumes']}
+
+
+def test_default_deployment_uses_published_web_image_and_separates_tls(compose_config):
+    config = compose_config()
+    assert set(config['services']) == {'web', 'proxy', 'scheduler', 'operations'}
+    web, proxy = config['services']['web'], config['services']['proxy']
+    assert web['image'] == 'ghcr.io/roxy-wi/rmon/rmon-web:1.4.0'
+    assert proxy['image'] == 'rmon-proxy:local'
+    assert not web.get('ports')
+    assert '/etc/ssl/certs/rmon' not in mounts(web)
+    assert proxy['environment']['RMON_SELF_SIGNED'] == '1'
+    assert not web['environment'].get('RMON_SECRET_PHRASE')
+    assert any('host.docker.internal' in host for host in web['extra_hosts'])
+    for role in ('scheduler', 'operations'):
+        service = config['services'][role]
+        assert service['command'] == [role]
+        assert service['image'] == web['image']
+        assert not service.get('ports')
+        assert mounts(service) == mounts(web)
+        assert service['healthcheck']['test'][-2:] == ['--role', role]
+
+
+def test_dotenv_preserves_literal_secrets_and_external_server_settings(compose_config):
+    values = {
+        'RMON_WEB_IMAGE': 'example.invalid/rmon:web-test',
+        'RMON_PROXY_IMAGE': 'example.invalid/rmon:proxy-test',
+        'RMON_PUBLIC_URL': 'https://rmon.example.net',
+        'RMON_SECRET_KEY': 'test-only-literal-$value#with-special-characters',
+        'RMON_SECRET_PHRASE': 'test-only-credential-key',
+        'RMON_JWT_ALGORITHM': 'HS256',
+        'RMON_JWT_SECRET_KEY': 'test-only-jwt-key',
+        'RMON_CONFIG_FILE': '/etc/rmon/custom.cfg',
+        'RMON_DB_PATH': '/var/lib/rmon/custom.db',
+        'RMON_SERVER_INTERNAL_URL': 'https://receiver.example.net:5100',
+        'RMON_SERVER_INTERNAL_TOKEN_FILE': '/etc/rmon/secrets/token',
+        'RMON_SERVER_CA_FILE': '/etc/rmon/tls/ca.crt',
+        'RMON_SERVER_CLIENT_CERT_FILE': '/etc/rmon/tls/web.crt',
+        'RMON_SERVER_CLIENT_KEY_FILE': '/etc/rmon/tls/web.key',
+    }
+    services = compose_config(values)['services']
+    assert services['web']['image'] == values['RMON_WEB_IMAGE']
+    assert services['proxy']['image'] == values['RMON_PROXY_IMAGE']
+    for key, value in values.items():
+        if key not in ('RMON_WEB_IMAGE', 'RMON_PROXY_IMAGE'):
+            # The canonical config escapes literal dollars for safe reloading.
+            assert services['web']['environment'][key] == value.replace('$', '$$')
+    assert 'RMON_SECRET_KEY' not in services['proxy']['environment']
+    assert 'RMON_JWT_SECRET_KEY' not in services['proxy']['environment']
+
+
+def test_same_host_server_shares_config_database_and_token(compose_config):
+    config = compose_config(server=True)
+    web, server = (config['services'][name] for name in ('web', 'server'))
+    assert server['image'] == 'ghcr.io/roxy-wi/rmon/rmon-server:7.0'
+    assert server['user'] == '33:33'
+    for target in ('/etc/rmon', '/var/lib/rmon'):
+        assert mounts(web)[target]['source'] == mounts(server)[target]['source']
+    assert mounts(server)['/etc/rmon']['read_only'] is True
+    assert not mounts(server)['/var/lib/rmon'].get('read_only', False)
+    assert server['read_only'] is True and server['cap_drop'] == ['ALL']
+    assert not server.get('privileged')
+    assert server['ports'][0]['host_ip'] == '127.0.0.1'
+    assert server['depends_on']['web']['condition'] == 'service_healthy'
+    assert web['secrets'][0]['source'] == server['secrets'][0]['source'] == 'rmon_server_token'
+    assert web['environment']['RMON_SERVER_INTERNAL_TOKEN_FILE'] == server['environment']['RMON_INTERNAL_API_TOKEN_FILE']
+    assert web['environment']['RMON_SERVER_INTERNAL_URL'] == 'http://server:5100'
+    # Unset environment overrides must leave existing server TLS settings usable.
+    assert not server['environment'].get('RMON_SERVER_TRANSPORT')
+
+
+def test_existing_directories_are_shared_in_both_services(compose_config, tmp_path):
+    values = {}
+    for kind in ('CONFIG', 'DATA', 'LOG', 'TLS'):
+        directory = tmp_path / kind.lower()
+        directory.mkdir()
+        values[f'RMON_{kind}_SOURCE'] = directory.as_posix()
+    values.update({'RMON_CONFIG_FILE': '/etc/rmon/custom.cfg', 'RMON_DB_PATH': '/var/lib/rmon/custom.db',
+                   'RMON_SELF_SIGNED': '0', 'RMON_SERVER_BIND_IP': '192.0.2.10', 'RMON_SERVER_PORT': '5510',
+                   'RMON_SERVER_IMAGE': 'example.invalid/rmon-server:pinned'})
+    services = compose_config(values, server=True)['services']
+    assert services['server']['image'] == values['RMON_SERVER_IMAGE']
+    for target in ('/etc/rmon', '/var/lib/rmon'):
+        web_mount = mounts(services['web'])[target]
+        server_mount = mounts(services['server'])[target]
+        assert web_mount['type'] == server_mount['type'] == 'bind'
+        assert web_mount['source'] == server_mount['source']
+    for key in ('RMON_CONFIG_FILE', 'RMON_DB_PATH'):
+        assert services['web']['environment'][key] == services['server']['environment'][key] == values[key]
+    assert mounts(services['proxy'])['/etc/ssl/certs/rmon']['type'] == 'bind'
+    assert services['proxy']['environment']['RMON_SELF_SIGNED'] == '0'
+    assert services['server']['ports'][0]['host_ip'] == '192.0.2.10'
+    assert services['server']['ports'][0]['published'] == '5510'
+
+
+def test_server_tls_and_probe_settings_survive_compose(compose_config):
+    server_values = {
+        'RMON_SERVER_TRANSPORT': 'mtls',
+        'RMON_TLS_CERT_FILE': '/etc/rmon/tls/server.crt',
+        'RMON_TLS_KEY_FILE': '/etc/rmon/tls/server.key',
+        'RMON_TLS_CA_FILE': '/etc/rmon/tls/ca.crt',
+        'RMON_PROBE_SCHEME': 'https',
+        'RMON_PROBE_CA_FILE': '/etc/rmon/tls/ca.crt',
+        'RMON_PROBE_CLIENT_CERT_FILE': '/etc/rmon/tls/probe.crt',
+        'RMON_PROBE_CLIENT_KEY_FILE': '/etc/rmon/tls/probe.key',
+    }
+    services = compose_config({**server_values, 'RMON_SERVER_INTERNAL_URL': 'https://server:5100'}, server=True)['services']
+    for key, value in server_values.items():
+        assert services['server']['environment'][key] == value
+    assert services['web']['environment']['RMON_SERVER_INTERNAL_URL'] == 'https://server:5100'
+    assert 'RMON_TLS_KEY_FILE' not in services['web']['environment']
diff --git a/tests/container/test_proxy_and_package.py b/tests/container/test_proxy_and_package.py
new file mode 100644
index 0000000..58a1572
--- /dev/null
+++ b/tests/container/test_proxy_and_package.py
@@ -0,0 +1,88 @@
+import importlib.util
+from pathlib import Path
+from unittest.mock import Mock
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[2]
+spec = importlib.util.spec_from_file_location('proxy_runtime', ROOT / 'container/nginx/runtime.py')
+proxy = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(proxy)
+
+
+@pytest.mark.parametrize('scheme', ['http', 'https'])
+def test_proxy_routes_only_to_web_and_hides_readiness(monkeypatch, scheme):
+    monkeypatch.setenv('RMON_PROXY_SCHEME', scheme)
+    result = proxy.render((ROOT / 'container/nginx/default.conf.template').read_text())
+    assert 'http://web:8080' in result
+    assert 'proxy_set_header Upgrade "";' in result
+    assert 'proxy_set_header Connection "";' in result
+    assert 'location ^~ /_rmon/ { return 404; }' in result
+    assert '$http_upgrade' not in result and '${RMON_' not in result
+    assert ('listen 8080 ssl' in result) is (scheme == 'https')
+    assert ('ssl_certificate_key' in result) is (scheme == 'https')
+
+
+@pytest.mark.parametrize('value', ['ftp', 'https;bad', ''])
+def test_proxy_rejects_unsupported_scheme(monkeypatch, value):
+    monkeypatch.setenv('RMON_PROXY_SCHEME', value)
+    with pytest.raises(ValueError):
+        proxy.settings()
+
+
+@pytest.mark.parametrize('host,san', [('192.0.2.10', 'IP:192.0.2.10'), ('::1', 'IP:::1'), ('rmon.test', 'DNS:rmon.test')])
+def test_self_signed_certificate_supports_ips_and_dns(host, san):
+    assert proxy.certificate_san(host) == san
+
+
+def test_existing_tls_key_is_never_replaced(tmp_path, monkeypatch):
+    cert, key = tmp_path / 'rmon.crt', tmp_path / 'rmon.key'
+    cert.write_text('existing certificate')
+    key.write_text('existing key')
+    run = Mock()
+    monkeypatch.setattr(proxy.subprocess, 'run', run)
+    proxy.ensure_certificate(cert, key, tmp_path / 'store')
+    run.assert_not_called()
+    assert key.read_text() == 'existing key'
+    key.unlink()
+    with pytest.raises(ValueError, match='Incomplete'):
+        proxy.ensure_certificate(cert, key, tmp_path / 'store')
+    run.assert_not_called()
+
+
+@pytest.mark.parametrize('name', ['rmon.conf', 'rmon_deb.conf'])
+def test_packaged_apache_proxies_to_unix_socket_and_keeps_tls_paths(name):
+    text = (ROOT / 'config_other/httpd' / name).read_text()
+    assert 'WSGIDaemonProcess' not in text and 'WSGIScriptAlias' not in text
+    assert 'unix:/run/rmon/rmon.sock|http://localhost/' in text
+    assert 'ws://' not in text and 'websocket' not in text.lower()
+    assert '/etc/ssl/certs/rmon.key' in text
+    assert 'RequestHeader set X-Forwarded-Proto "https"' in text
+
+
+def test_systemd_units_are_owned_by_packaging_repository():
+    assert not list((ROOT / 'config_other').rglob('*.service'))
+
+
+def test_web_image_has_no_tls_volume_or_docker_socket():
+    # This section-level assertion also works without an optional YAML parser.
+    web = (ROOT / 'compose.yaml').read_text().split('  proxy:')[0]
+    assert 'rmon-tls' not in web and 'ports:' not in web
+    assert 'docker.sock' not in web
+    dockerfile = (ROOT / 'Dockerfile').read_text()
+    assert 'mod-wsgi' not in dockerfile and 'apache2' not in dockerfile
+
+
+@pytest.mark.parametrize('enabled', [True, False])
+def test_real_client_ip_trusts_only_one_hop_in_explicit_proxy_mode(monkeypatch, enabled):
+    from flask import Flask, request
+    from app.modules.common.proxy import configure_trusted_proxy
+    app = Flask('proxy-regression-test')
+    monkeypatch.setenv('RMON_PROXY_MODE', '1' if enabled else '0')
+    configure_trusted_proxy(app)
+    @app.get('/')
+    def address():
+        return {'ip': request.remote_addr, 'host': request.host, 'scheme': request.scheme}
+    result = app.test_client().get('/', headers={'X-Forwarded-For': 'forged, 192.0.2.10',
+        'X-Forwarded-Host': 'evil.test', 'X-Forwarded-Proto': 'https'}).json
+    assert result == {'ip': '192.0.2.10' if enabled else '127.0.0.1', 'host': 'localhost', 'scheme': 'http'}
diff --git a/tests/container/test_runtime.py b/tests/container/test_runtime.py
new file mode 100644
index 0000000..82ac222
--- /dev/null
+++ b/tests/container/test_runtime.py
@@ -0,0 +1,283 @@
+import configparser
+import os
+from pathlib import Path
+import subprocess
+import sys
+from unittest.mock import Mock
+
+import pytest
+from cryptography.fernet import Fernet
+
+from container import runtime
+
+
+@pytest.fixture
+def cfg():
+    return runtime.read_config(runtime.ROOT / 'config_other/rmon.cfg')
+
+
+@pytest.mark.parametrize('container,bind', [(True, '0.0.0.0:8080'), (False, 'unix:/run/rmon/rmon.sock')])
+def test_gunicorn_has_one_worker_no_preload_and_no_tls(monkeypatch, container, bind):
+    import runpy
+    monkeypatch.setenv('RMON_CONTAINER', '1' if container else '0')
+    config = runpy.run_path(str(runtime.ROOT / 'gunicorn.conf.py'))
+    assert config['bind'] == bind
+    assert config['workers'] == 1
+    assert config['threads'] == 10
+    assert config['preload_app'] is False
+    assert config['max_requests'] == 0
+    assert 'certfile' not in config and 'keyfile' not in config
+
+
+def test_env_overrides_optional_config_without_rewriting_it(cfg, monkeypatch):
+    cfg['container'] = {'public_url': 'https://old.test'}
+    monkeypatch.setenv('RMON_PUBLIC_URL', 'https://new.test')
+    assert runtime.option(cfg, 'public_url') == 'https://new.test'
+    assert cfg['container']['public_url'] == 'https://old.test'
+
+
+def test_missing_configuration_fails_closed(tmp_path):
+    with pytest.raises(FileNotFoundError):
+        runtime.read_config(tmp_path / 'missing.cfg')
+
+
+@pytest.mark.parametrize('mysql,pgsql', [('1', '1'), ('yes', '0'), ('0', 'false')])
+def test_ambiguous_database_rejected(tmp_path, cfg, mysql, pgsql):
+    cfg['mysql']['enable'], cfg['pgsql']['enable'] = mysql, pgsql
+    path = tmp_path / 'rmon.cfg'
+    with path.open('w') as stream:
+        cfg.write(stream)
+    with pytest.raises(ValueError):
+        runtime.read_config(path)
+
+
+def test_init_generates_fernet_only_for_new_config(tmp_path, monkeypatch):
+    monkeypatch.setattr(os, 'chown', Mock(), raising=False)
+    path = tmp_path / 'rmon.cfg'
+    runtime.ensure_new_config(path)
+    original = path.read_bytes()
+    Fernet(runtime.read_config(path)['main']['secret_phrase'].encode())
+    runtime.ensure_new_config(path)
+    assert path.read_bytes() == original
+    assert b'/var/lib/rmon' in original
+
+
+def test_existing_config_is_never_rewritten_even_if_invalid(tmp_path, monkeypatch):
+    path = tmp_path / 'rmon.cfg'
+    path.write_text('existing config must stay untouched')
+    runtime.ensure_new_config(path)
+    assert path.read_text() == 'existing config must stay untouched'
+
+
+def test_secret_file_never_overwrites_existing_file(tmp_path):
+    path = tmp_path / 'secret'
+    path.write_bytes(b'existing')
+    with pytest.raises(FileExistsError):
+        runtime.private_file(path, b'replacement', owner=False)
+    assert path.read_bytes() == b'existing'
+
+
+def test_jwt_keys_persist_and_partial_pair_fails(tmp_path, monkeypatch):
+    monkeypatch.setattr(os, 'chown', Mock(), raising=False)
+    monkeypatch.setenv('RMON_JWT_ALGORITHM', 'RS256')
+    private, public = tmp_path / 'key', tmp_path / 'key.pub'
+    monkeypatch.setenv('RMON_JWT_PRIVATE_KEY_FILE', str(private))
+    monkeypatch.setenv('RMON_JWT_PUBLIC_KEY_FILE', str(public))
+    runtime.jwt_keys()
+    before = (private.read_bytes(), public.read_bytes())
+    runtime.jwt_keys()
+    assert (private.read_bytes(), public.read_bytes()) == before
+    public.unlink()
+    with pytest.raises(ValueError, match='Incomplete JWT'):
+        runtime.jwt_keys()
+    assert private.read_bytes() == before[0]
+
+
+def test_prepare_directory_never_recursively_chowns_user_data(tmp_path, monkeypatch):
+    chown = Mock()
+    monkeypatch.setattr(os, 'chown', chown, raising=False)
+    empty = tmp_path / 'empty'
+    runtime.prepare_directory(empty)
+    chown.assert_called_once_with(empty, 33, 33)
+    (empty / 'existing').write_text('data')
+    chown.reset_mock()
+    runtime.prepare_directory(empty)
+    chown.assert_not_called()
+
+
+@pytest.mark.parametrize('backend', ['mysql', 'pgsql'])
+def test_database_uses_existing_config_fields(cfg, backend):
+    cfg[backend]['enable'] = '1'
+    db = runtime.database(cfg)
+    assert db.database == 'rmon'
+    assert db.connect_params['host'] == '127.0.0.1'
+    assert db.connect_params['user'] == 'rmon'
+    assert db.connect_params['port'] == (3306 if backend == 'mysql' else 5432)
+
+
+def test_init_refuses_nonempty_database(cfg, tmp_path, monkeypatch):
+    monkeypatch.setenv('RMON_DB_PATH', str(tmp_path / 'data.db'))
+    runtime.require_empty_database(cfg)
+    db = runtime.database(cfg)
+    db.execute_sql('CREATE TABLE existing (value TEXT)')
+    db.execute_sql("INSERT INTO existing VALUES ('unchanged')")
+    with pytest.raises(ValueError, match='empty database'):
+        runtime.require_empty_database(cfg)
+    assert db.execute_sql('SELECT value FROM existing').fetchone() == ('unchanged',)
+    db.close()
+
+
+@pytest.mark.parametrize('populated', [False, True])
+def test_bootstrap_preserves_existing_database(cfg, tmp_path, monkeypatch, populated):
+    monkeypatch.setitem(sys.modules, 'fcntl', Mock(LOCK_EX=2))
+    cfg['main']['lib_path'] = str(tmp_path)
+    monkeypatch.setenv('RMON_DB_PATH', str(tmp_path / 'bootstrap.db'))
+    db = runtime.database(cfg)
+    if populated:
+        db.execute_sql('CREATE TABLE existing (value TEXT)')
+        db.execute_sql("INSERT INTO existing VALUES ('keep')")
+    db.close()
+    run = Mock()
+    monkeypatch.setattr(runtime.subprocess, 'run', run)
+    runtime.bootstrap(cfg)
+    run.assert_called_once_with([sys.executable, '-m', 'container.runtime',
+                                 'check' if populated else 'init'], check=True)
+    if populated:
+        assert db.execute_sql('SELECT value FROM existing').fetchone() == ('keep',)
+        db.close()
+
+
+def test_bootstrap_does_not_reinitialize_after_failed_check(cfg, tmp_path, monkeypatch):
+    monkeypatch.setitem(sys.modules, 'fcntl', Mock(LOCK_EX=2))
+    cfg['main']['lib_path'] = str(tmp_path)
+    monkeypatch.setenv('RMON_DB_PATH', str(tmp_path / 'partial.db'))
+    db = runtime.database(cfg)
+    db.execute_sql('CREATE TABLE existing (value TEXT)')
+    db.close()
+    run = Mock(side_effect=subprocess.CalledProcessError(1, 'check'))
+    monkeypatch.setattr(runtime.subprocess, 'run', run)
+    with pytest.raises(subprocess.CalledProcessError):
+        runtime.bootstrap(cfg)
+    assert run.call_count == 1
+    assert run.call_args.args[0][-1] == 'check'
+
+
+@pytest.mark.parametrize('password,valid', [('short', False), ('long-unique-test-password', True)])
+def test_admin_password_file(tmp_path, monkeypatch, password, valid):
+    path = tmp_path / 'password'
+    path.write_text(password + '\n')
+    monkeypatch.setenv('RMON_ADMIN_PASSWORD_FILE', str(path))
+    if valid:
+        assert runtime.admin_password() == password
+    else:
+        with pytest.raises(ValueError, match='12 characters'):
+            runtime.admin_password()
+
+
+def test_admin_password_requires_input(monkeypatch):
+    monkeypatch.delenv('RMON_ADMIN_PASSWORD_FILE', raising=False)
+    monkeypatch.setattr(sys.stdin, 'isatty', lambda: False)
+    with pytest.raises(ValueError, match='interactive init'):
+        runtime.admin_password()
+
+
+def test_healthcheck_ignores_proxy_environment(monkeypatch):
+    opener = Mock()
+    response = Mock(status=200)
+    opener.open.return_value.__enter__ = Mock(return_value=response)
+    opener.open.return_value.__exit__ = Mock(return_value=False)
+    build = Mock(return_value=opener)
+    monkeypatch.setattr(runtime.urllib.request, 'build_opener', build)
+    monkeypatch.setattr(runtime.Path, 'read_text', lambda _: 'local-health-secret')
+    runtime.healthcheck()
+    assert build.call_args.args[0].proxies == {}
+    request = opener.open.call_args.args[0]
+    assert request.full_url == 'http://127.0.0.1:8080/_rmon/ready'
+    assert request.get_header('X-rmon-health-token') == 'local-health-secret'
+    assert opener.open.call_args.kwargs['timeout'] == 5
+
+
+def test_fresh_schema_login_disabled_defaults_and_baseline(tmp_path):
+    cfg_path = tmp_path / 'rmon.cfg'
+    cfg = runtime.read_config(runtime.ROOT / 'config_other/rmon.cfg')
+    cfg['main']['lib_path'] = str(tmp_path)
+    cfg['main']['log_path'] = str(tmp_path)
+    with cfg_path.open('w') as stream:
+        cfg.write(stream)
+    env = {**os.environ, 'RMON_CONFIG_FILE': str(cfg_path), 'RMON_DB_PATH': str(tmp_path / 'fresh.db'),
+           'RMON_SCHEDULER_ENABLED': '0'}
+    code = '''
+from container.runtime import initialize_schema
+initialize_schema('fresh-container-test-password')
+from app import app
+from app.modules.db.db_model import User, Migration, BaseModel, conn
+from app.modules.db.migrations import get_migration_files
+from app.modules.roxywi import roxy
+from werkzeug.security import check_password_hash
+assert check_password_hash(User.get(User.username == 'admin').password, 'fresh-container-test-password')
+assert all(not u.enabled and u.password is None for u in User.select().where(User.username != 'admin'))
+assert set(m.name for m in Migration.select()) == set(n[:-3] for n in get_migration_files())
+assert set(m._meta.table_name for m in BaseModel.__subclasses__()) <= set(conn.get_tables())
+roxy.update_plan = lambda: None
+client = app.test_client()
+assert client.get('/login').status_code == 200
+assert client.post('/login', json={'login':'admin','pass':'fresh-container-test-password'}).status_code == 200
+assert client.post('/login', json={'login':'admin','pass':'admin'}).status_code == 401
+try:
+    initialize_schema('must-not-reset-this-password')
+except ValueError:
+    pass
+else:
+    raise AssertionError('Existing database was reinitialized')
+assert check_password_hash(User.get(User.username == 'admin').password, 'fresh-container-test-password')
+'''
+    result = subprocess.run([sys.executable, '-c', code], cwd=runtime.ROOT, env=env,
+                            text=True, capture_output=True, timeout=60)
+    assert result.returncode == 0, result.stdout + result.stderr
+
+
+def test_package_bootstrap_baselines_only_a_new_database(tmp_path):
+    env = {**os.environ, 'RMON_DB_PATH': str(tmp_path / 'package.db'), 'RMON_SCHEDULER_ENABLED': '0'}
+    result = subprocess.run([sys.executable, '-m', 'app.create_db'], cwd=runtime.ROOT, env=env,
+                            text=True, capture_output=True, timeout=60)
+    assert result.returncode == 0, result.stdout + result.stderr
+    code = '''
+import runpy
+from app.modules.db.db_model import Migration, Version, User
+from app.modules.db.migrations import get_migration_files
+from app.version import get_service_version
+assert set(m.name for m in Migration.select()) == set(n[:-3] for n in get_migration_files())
+assert Version.get().version == get_service_version()
+User.update(password='must-stay-unchanged').where(User.username == 'admin').execute()
+runpy.run_module('app.create_db', run_name='__main__')
+assert User.get(User.username == 'admin').password == 'must-stay-unchanged'
+assert Version.select().count() == 1
+'''
+    result = subprocess.run([sys.executable, '-c', code], cwd=runtime.ROOT, env=env,
+                            text=True, capture_output=True, timeout=60)
+    assert result.returncode == 0, result.stdout + result.stderr
+
+
+def test_container_health_checks_database_without_public_route(app, monkeypatch):
+    from container.wsgi import application
+    from app.modules.db.db_model import Setting
+    monkeypatch.setenv('RMON_HEALTH_TOKEN', 'test-probe-token')
+    env = {'PATH_INFO': '/_rmon/ready', 'HTTP_X_RMON_HEALTH_TOKEN': 'test-probe-token'}
+    status = []
+    assert b''.join(application(env, lambda value, headers: status.append(value))) == b'{"status":"ready"}'
+    assert status == ['200 OK']
+    monkeypatch.setattr(Setting, 'select', Mock(side_effect=RuntimeError('secret connection details')))
+    status.clear()
+    assert b''.join(application(env, lambda value, headers: status.append(value))) == b'{"status":"not_ready"}'
+    assert status == ['503 Service Unavailable']
+
+
+@pytest.mark.parametrize('token', ['', 'wrong-token'])
+def test_readiness_is_not_public(monkeypatch, token):
+    from container.wsgi import application
+    monkeypatch.setenv('RMON_HEALTH_TOKEN', 'test-probe-token')
+    status = []
+    data = application({'PATH_INFO': '/_rmon/ready', 'HTTP_X_RMON_HEALTH_TOKEN': token},
+                       lambda value, headers: status.append(value))
+    assert status == ['404 Not Found']
+    assert b'ready' not in b''.join(data)
diff --git a/tests/container/test_worker_health.py b/tests/container/test_worker_health.py
new file mode 100644
index 0000000..576f753
--- /dev/null
+++ b/tests/container/test_worker_health.py
@@ -0,0 +1,25 @@
+import runtime_health
+from pathlib import Path
+
+
+def test_process_probe_never_needs_a_database(tmp_path, monkeypatch):
+    monkeypatch.setenv('RMON_PROCESS_HEALTH_DIR', str(tmp_path))
+    for role in ('operations', 'scheduler'):
+        assert not runtime_health.healthy(role)
+        runtime_health.pulse(role)
+        assert runtime_health.healthy(role)
+        runtime_health.pulse(role, ready=False)
+        assert not runtime_health.healthy(role)
+        assert runtime_health.healthy(role, ready=False)
+    monkeypatch.setattr(runtime_health.time, 'time', lambda: 10**12)
+    assert not runtime_health.healthy('operations', ready=False)
+
+
+def test_worker_entrypoints_are_in_the_container_build_context():
+    root = Path(__file__).resolve().parents[2]
+    included = (root / '.dockerignore').read_text().splitlines()
+    dockerfile = (root / 'Dockerfile').read_text()
+    for name in ('scheduler_runner.py', 'operations_runner.py', 'runtime_health.py'):
+        assert root.joinpath(name).is_file()
+        assert '!' + name in included
+        assert name in dockerfile
diff --git a/tests/frontend/README.md b/tests/frontend/README.md
new file mode 100644
index 0000000..ce9575b
--- /dev/null
+++ b/tests/frontend/README.md
@@ -0,0 +1,24 @@
+# Frontend interaction tests
+
+Run `npm ci --ignore-scripts` and `npm test` from this directory (Node.js 22+).
+The Tests workflow runs this suite in the `frontend-tests` job.
+
+Tests execute RMON's bundled jQuery, jQuery UI and application scripts in jsdom.
+They cover navigation state and keyboard access, dialog constraints, background
+request errors and retries, and status-page URL suggestions and draft preservation.
+Check editor tests run the real form with Tagify and cover creation, editing and
+cloning for HTTP, TCP, DNS, Ping, SMTP and RabbitMQ, payloads, advanced settings,
+validation, locations, keyboard navigation and duplicate-submit protection.
+Agent card tests cover JSON health probes, failure/recovery states, restored service
+buttons and SSH action errors.
+Admin table tests run the bundled DataTables plugin and cover toolbar separation,
+non-sortable/non-searchable Actions, saved sorting state, three-dot menus and keyboard
+navigation, viewport boundaries, AJAX row addition/removal and delegated field updates.
+
+`fixtures/check-editor.html` is the English rendering of
+`app/templates/include/smon/add_form.html` with empty notification channels and the
+real input macros. Update it alongside the template; a Python UI test compares it
+to Flask's actual rendering to prevent fixture drift.
+
+They do not replace real-browser layout checks; verify mobile and desktop layouts
+when changing CSS or dialog behavior. Rendered page contracts are in `tests/ui`.
diff --git a/tests/frontend/admin_tables.test.cjs b/tests/frontend/admin_tables.test.cjs
new file mode 100644
index 0000000..aea8be2
--- /dev/null
+++ b/tests/frontend/admin_tables.test.cjs
@@ -0,0 +1,241 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const {JSDOM} = require('jsdom');
+const scripts = path.resolve(__dirname, '../../app/static/js');
+const row = id => '<tr id="user-' + id + '"><td>' + id + '</td><td>User ' + id +
+    '</td><td class="actions-column"><button type="button" data-edit="' + id +
+    '">Edit</button><button type="button" disabled>Unavailable</button><a href="#history-' + id + '">History</a></td></tr>';
+const table = '<main class="container"><div id="tabs"><table id="users" class="overview"><thead>' +
+    '<tr><th>Id</th><th>Name</th><th class="actions-column">Actions</th></tr></thead><tbody>' +
+    row(1) + row(2) + '</tbody></table></div></main>';
+
+async function page(t, savedState) {
+    const dom = new JSDOM('<!doctype html><body>' + table + '</body>',
+        {url: 'http://rmon.test/admin', runScripts: 'outside-only', pretendToBeVisual: true});
+    t.after(() => dom.window.close());
+    const w = dom.window;
+    w.matchMedia = () => ({matches: false, addEventListener() {}});
+    if (savedState) w.localStorage.setItem('DataTables_users_/admin', JSON.stringify(savedState));
+    for (const file of ['jquery-3.6.0.min.js', 'jquery-ui.min.js', 'dataTables.min.js', 'ux.js']) {
+        w.eval(fs.readFileSync(path.join(scripts, file), 'utf8'));
+    }
+    await new Promise(resolve => w.jQuery(resolve));
+    const api = w.RmonUI.initAdminTable('#users');
+    return {w, $: w.jQuery, ui: w.RmonUI, api};
+}
+
+test('admin table separates controls, scrolling and pagination and Actions cannot sort or search', async t => {
+    const {w, $, api} = await page(t);
+    assert.equal($('#users_wrapper > .admin-table-toolbar .dataTables_length').length, 1);
+    assert.equal($('#users_wrapper > .admin-table-toolbar .dataTables_filter').length, 1);
+    assert.equal($('#users_wrapper > .table-scroll > #users').length, 1);
+    assert.equal($('#users_wrapper > .admin-table-bottom .dataTables_paginate').length, 1);
+    assert.equal($('.table-scroll').length, 1);
+    const actions = api.settings()[0].aoColumns[2];
+    assert.equal(actions.bSortable, false);
+    assert.equal(actions.bSearchable, false);
+    const order = JSON.stringify(api.order());
+    $('#users th.actions-column').trigger('click');
+    assert.equal(JSON.stringify(api.order()), order);
+    assert.equal($('#users th.actions-column').attr('tabindex'), undefined);
+    api.search('Unavailable').draw();
+    assert.equal(api.rows({search: 'applied'}).count(), 0);
+    assert.equal(w.RmonUI.initAdminTable('#missing'), undefined);
+});
+
+test('persisted sorting on the former icon column is discarded on reload', async t => {
+    const {api} = await page(t, {time: Date.now(), start: 0, length: 25, order: [[2, 'desc']],
+        search: {search: '', smart: true, regex: false, caseInsensitive: true},
+        columns: [0, 1, 2].map(() => ({visible: true, search: {search: ''}}))});
+    assert.equal(JSON.stringify(api.order()), '[[0,"asc"]]');
+});
+
+test('three-dot menus are idempotent, labelled, and only one opens at a time', async t => {
+    const {w, $, ui} = await page(t);
+    ui.enhance(w.document);
+    ui.enhance(w.document);
+    assert.equal($('.row-actions-toggle').length, 2);
+    assert.equal(new Set($('.row-actions-menu').map((_, el) => el.id).get()).size, 2);
+    assert.equal($('.row-actions-toggle').first().attr('aria-label'), 'Actions: 1');
+    $('.row-actions-toggle')[0].click();
+    assert.equal($('.row-actions-toggle').first().attr('aria-expanded'), 'true');
+    assert.equal(w.document.activeElement.textContent, 'Edit');
+    $('.row-actions-toggle')[1].click();
+    assert.equal($('.row-actions-toggle').first().attr('aria-expanded'), 'false');
+    assert.equal($('.row-actions-menu').filter((_, el) => !el.hidden).length, 1);
+    w.document.body.click();
+    assert.equal($('.row-actions-menu').filter((_, el) => !el.hidden).length, 0);
+});
+
+test('keyboard navigation skips disabled actions, wraps, and Escape restores focus', async t => {
+    const {w, $} = await page(t);
+    const key = name => w.document.activeElement.dispatchEvent(new w.KeyboardEvent('keydown', {key: name, bubbles: true}));
+    $('.row-actions-toggle')[0].focus();
+    key('ArrowDown');
+    assert.equal(w.document.activeElement.textContent, 'Edit');
+    key('ArrowDown');
+    assert.equal(w.document.activeElement.textContent, 'History');
+    key('ArrowDown');
+    assert.equal(w.document.activeElement.textContent, 'Edit');
+    key('End');
+    assert.equal(w.document.activeElement.textContent, 'History');
+    key('Home');
+    assert.equal(w.document.activeElement.textContent, 'Edit');
+    key('Escape');
+    assert.equal(w.document.activeElement, $('.row-actions-toggle')[0]);
+    assert.equal($('.row-actions-menu')[0].hidden, true);
+    key('ArrowUp');
+    assert.equal(w.document.activeElement.textContent, 'History');
+    key('Tab');
+    assert.equal($('.row-actions-menu')[0].hidden, true);
+});
+
+test('row actions keep their callbacks and disabled items cannot invoke them', async t => {
+    const {w, $} = await page(t);
+    let edits = 0;
+    let disabledClicks = 0;
+    $('#user-2 [data-edit]').on('click', () => edits++);
+    $('#user-2 button:disabled').on('click', () => disabledClicks++);
+    $('#user-2 .row-actions-toggle')[0].click();
+    $('#user-2 button:disabled')[0].click();
+    assert.equal(disabledClicks, 0);
+    $('#user-2 [data-edit]')[0].click();
+    assert.equal(edits, 1);
+    assert.equal($('#user-2 .row-actions-menu')[0].hidden, true);
+    assert.notEqual(w.document.activeElement, $('#user-1 .row-actions-toggle')[0]);
+});
+
+test('menu is clamped to viewport and closes on table redraw, scrolling and resize', async t => {
+    const {w, $, api} = await page(t);
+    w.innerWidth = 390; w.innerHeight = 500;
+    const toggle = $('.row-actions-toggle')[0];
+    const menu = $('.row-actions-menu')[0];
+    toggle.getBoundingClientRect = () => ({top: 430, bottom: 474, right: 382});
+    menu.getBoundingClientRect = () => ({width: 220, height: 180});
+    toggle.click();
+    assert.equal(menu.style.left, '158px');
+    assert.equal(menu.style.top, '246px');
+    menu.dispatchEvent(new w.Event('scroll'));
+    assert.equal(menu.hidden, false);
+    w.document.dispatchEvent(new w.Event('scroll'));
+    assert.equal(menu.hidden, true);
+    toggle.click(); api.draw(false);
+    assert.equal(menu.hidden, true);
+    toggle.click(); w.dispatchEvent(new w.Event('resize'));
+    assert.equal(menu.hidden, true);
+});
+
+test('AJAX rows survive sorting, filtering and pagination; removed rows never return', async t => {
+    const {w, $, ui, api} = await page(t);
+    const newRow = $(row(3));
+    let calls = 0;
+    newRow.find('[data-edit]').on('click', () => calls++);
+    ui.addTableRows('#users', newRow);
+    assert.equal(api.rows().count(), 3);
+    api.page.len(1).order([[0, 'desc']]).draw();
+    assert.equal($('#users tbody tr').first().attr('id'), 'user-3');
+    $('#user-3 .row-actions-toggle')[0].click();
+    $('#user-3 [data-edit]')[0].click();
+    assert.equal(calls, 1);
+    api.search('User 3').draw();
+    assert.equal(api.rows({search: 'applied'}).count(), 1);
+    ui.removeTableRow('#user-3');
+    api.search('').page.len(25).order([[0, 'asc']]).draw();
+    assert.equal(api.rows().count(), 2);
+    assert.equal($('#user-3').length, 0);
+    assert.equal($('.row-actions-toggle').length, 2);
+    assert.equal(w.document.querySelectorAll('.table-scroll .table-scroll').length, 0);
+});
+
+test('plain AJAX tables receive the same menu without enabling sorting', async t => {
+    const {w, $, ui} = await page(t);
+    $('<table id="plain"><tbody></tbody></table>').appendTo('main');
+    ui.addTableRows('#plain', row(9));
+    assert.equal($('#plain .row-actions-toggle').length, 1);
+    assert.equal($.fn.dataTable.isDataTable($('#plain')[0]), false);
+    ui.removeTableRow('#user-9');
+    assert.equal(w.document.getElementById('user-9'), null);
+});
+
+for (const [file, tableId, handler, inputPrefix] of [
+    ['users.js', 'ajax-users', 'updateUser', 'login'],
+    ['admin/server.js', 'ajax-servers', 'updateServer', 'hostname'],
+    ['admin/group.js', 'ajax-group', 'updateGroup', 'name'],
+    ['admin/cred.js', 'ssh_enable_table', 'updateSSH', 'ssh_name']
+]) {
+    test(file + ': dynamically added fields save exactly once without reloading scripts', async t => {
+        const {w, $, ui} = await page(t);
+        $('<table>', {id: tableId}).append('<tbody></tbody>').appendTo('main');
+        Object.assign(w, {add_word: 'Add', cancel_word: 'Cancel', sshKeyEnableShow() {}});
+        w.eval(fs.readFileSync(path.join(scripts, file), 'utf8'));
+        const calls = [];
+        w[handler] = id => calls.push(id);
+        await new Promise(resolve => $(resolve));
+        ui.addTableRows('#' + tableId, '<tr id="dynamic"><td><input id="' + inputPrefix + '-9" value="new"></td></tr>');
+        $('#' + inputPrefix + '-9').val('edited').trigger('change');
+        assert.deepEqual(calls, ['9']);
+    });
+}
+
+test('new row checkbox and select widgets initialize before a table draw', async t => {
+    const {w, $, ui, api} = await page(t);
+    ui.addTableRows('#users', '<tr id="user-4"><td>4</td><td><label for="active-4">Active</label>' +
+        '<input type="checkbox" id="active-4"><select id="role-4"><option>Editor</option></select></td><td class="actions-column"></td></tr>');
+    assert.ok($('#active-4').checkboxradio('instance'));
+    assert.ok($('#role-4').selectmenu('instance'));
+    api.order([[0, 'desc']]).draw();
+    assert.equal(w.document.querySelectorAll('#role-4-button').length, 1);
+});
+
+test('server poll before widget initialization does not throw or trigger a save', async t => {
+    const {w, $} = await page(t);
+    $('<div>').append('<label for="server_enabled-9">Enabled</label><input type="checkbox" id="server_enabled-9">' +
+        '<select id="servergroup-9"><option value="1">Default</option></select>' +
+        '<select id="credentials-9"><option value="1">SSH</option></select>').appendTo('main');
+    Object.assign(w, {add_word: 'Add', cancel_word: 'Cancel'});
+    w.eval(fs.readFileSync(path.join(scripts, 'admin/server.js'), 'utf8'));
+    const requests = [];
+    $.ajax = options => requests.push(options);
+    w.serverIsUp(9);
+    assert.doesNotThrow(() => requests[0].success({status: 'up', enabled: 1, group_id: 1, cred_id: 1}));
+    assert.equal($('#server_enabled-9').prop('checked'), true);
+    assert.equal(requests.length, 1);
+});
+
+test('OIDC provider and mapping callbacks remain usable inside a single Actions cell', async t => {
+    const {w, $, ui} = await page(t);
+    const messages = {mappings_action: 'Mappings', edit_action: 'Edit', delete_action: 'Delete',
+        enabled: 'Enabled', disabled: 'Disabled', active: 'Active', no_providers: 'No providers', no_mappings: 'No mappings'};
+    $('<script>', {id:'oidc-translations', type:'application/json'}).text(JSON.stringify(messages)).appendTo('body');
+    $('body').append('<table><tbody id="oidc-provider-list"></tbody></table>' +
+        '<div id="oidc-provider-dialog"><form id="oidc-provider-form"><input id="oidc-provider-id"><input id="oidc-client-id"></form></div>' +
+        '<div id="oidc-mappings-dialog"><table><tbody id="oidc-mapping-list"></tbody></table></div>' +
+        '<div id="oidc-mapping-dialog"><form id="oidc-mapping-form"><input id="oidc-mapping-id"><input id="oidc-external-group"></form></div>');
+    const requests = [];
+    $.ajax = options => requests.push(options);
+    w.eval(fs.readFileSync(path.join(scripts, 'admin/oidc.js'), 'utf8'));
+    await new Promise(resolve => $(resolve));
+    assert.equal(requests[0].url, '/admin/oidc/providers');
+    requests[0].success([]);
+    assert.equal($('#oidc-provider-list td').attr('colspan'), '4');
+    requests[0].success([{id: 7, label: 'Company', slug: 'company', client_id: 'public-client', enabled: true}]);
+    ui.enhance(w.document);
+    assert.equal($('#oidc-provider-list tr > td').length, 4);
+    assert.equal($('#oidc-provider-list .row-actions-toggle').length, 1);
+    $('#oidc-provider-list [data-action=map]')[0].click();
+    assert.equal(requests[1].url, '/admin/oidc/providers/7/mappings');
+    requests[1].success([]);
+    assert.equal($('#oidc-mapping-list td').attr('colspan'), '6');
+    requests[1].success([{id: 8, external_group: 'ops', group_id: 1, role_id: 2, priority: 100, active: true}]);
+    ui.enhance(w.document);
+    assert.equal($('#oidc-mapping-list tr > td').length, 6);
+    assert.equal($('#oidc-mapping-list .row-actions-toggle').length, 1);
+    $('#oidc-mapping-list [data-action=edit]')[0].click();
+    assert.equal($('#oidc-mapping-id').val(), '8');
+    assert.equal($('#oidc-external-group').val(), 'ops');
+    $('#oidc-provider-list [data-action=edit]')[0].click();
+    assert.equal($('#oidc-provider-id').val(), '7');
+    assert.equal($('#oidc-client-id').val(), 'public-client');
+});
diff --git a/tests/frontend/agent.test.cjs b/tests/frontend/agent.test.cjs
new file mode 100644
index 0000000..1bb7f39
--- /dev/null
+++ b/tests/frontend/agent.test.cjs
@@ -0,0 +1,146 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const {JSDOM} = require('jsdom');
+
+function page(t) {
+    const dom = new JSDOM('<body><div id="agent-1"></div><a id="start-1"><span></span></a><a id="reload-1"><span></span></a>' +
+        '<a id="stop-1"><span></span></a><time id="agent-uptime-1"></time><span id="agent-total-checks-1"></span></body>',
+        {url: 'https://rmon.test', runScripts: 'outside-only'});
+    t.after(() => dom.window.close());
+    const w = dom.window;
+    w.setInterval = () => 0;
+    const scripts = path.resolve(__dirname, '../../app/static/js');
+    w.eval(fs.readFileSync(path.join(scripts, 'jquery-3.6.0.min.js'), 'utf8'));
+    w.eval(fs.readFileSync(path.join(scripts, 'rmon/agent.js'), 'utf8'));
+    const $ = w.jQuery, calls = [], messages = [], actions = [];
+    $.ajax = options => { calls.push(options); };
+    $.fn.timeago = function () { return this; };
+    w.toastr = {error: (...args) => messages.push(args), info() {}, success() {}, warning() {}, clear() {}};
+    w.api_v_prefix = '/api/v1.0';
+    w.confirmAjaxAction = (...args) => actions.push(args);
+    return {w, $, calls, messages, actions};
+}
+
+test('agent probes request JSON and accept already-decoded values', t => {
+    const {w, $, calls} = page(t);
+    w.getAgentStatus('host', 1);
+    assert.equal(calls[0].dataType, 'json');
+    calls[0].success({running: true});
+    assert.ok($('#agent-1').hasClass('div-server-head-up'));
+    w.getAgentUptime('host', 1);
+    assert.equal(calls[1].dataType, 'json');
+    calls[1].success({uptime: '2026-09-07 06:00:00'});
+    assert.equal($('#agent-uptime-1').text(), '2026-09-07 06:00:00');
+    w.getAgentTotalChecks('host', 1);
+    assert.equal(calls[2].dataType, 'json');
+    calls[2].success(0);
+    assert.equal($('#agent-total-checks-1').text(), '0');
+});
+
+test('HTML and failed probes mark agent unavailable without JSON.parse exceptions', t => {
+    const {w, $, calls} = page(t);
+    w.getAgentStatus('host', 1);
+    assert.doesNotThrow(() => calls[0].error({status: 502, responseText: '<!doctype html>'}));
+    assert.ok($('#agent-1').hasClass('div-server-head-down'));
+    assert.doesNotThrow(() => calls[0].success('<!doctype html>'));
+    assert.equal($('#start-1 span').attr('aria-disabled'), 'false');
+    w.getAgentTotalChecks('host', 1);
+    calls[1].error({status: 502});
+    assert.equal($('#agent-total-checks-1').text(), '—');
+});
+
+test('start, stop and restart handlers recover after state changes without duplicate callbacks', t => {
+    const {w, $, actions} = page(t);
+    w.setAgentStatus(1, true);
+    $('#start-1 span').trigger('click');
+    assert.equal(actions.length, 0);
+    w.setAgentStatus(1, null);
+    w.setAgentStatus(1, null);
+    $('#start-1 span').trigger('click');
+    assert.deepEqual(actions, [['start', 1]]);
+    $('#stop-1 span').trigger('click');
+    assert.equal(actions.length, 1);
+    w.setAgentStatus(1, true);
+    $('#stop-1 span').trigger('click');
+    $('#reload-1 span').trigger('click');
+    assert.deepEqual(actions, [['start', 1], ['stop', 1], ['restart', 1]]);
+    assert.ok(!$('#agent-1').hasClass('div-server-head-down'));
+});
+
+test('SSH action errors are shown safely and never treated as success', t => {
+    const {w, calls, messages} = page(t);
+    let refreshes = 0;
+    w.getAgent = () => refreshes++;
+    w.agentAction('start', 1, {});
+    assert.equal(calls[0].dataType, 'json');
+    calls[0].error({status: 502, responseJSON: {error: 'SSH credentials are not configured for this server'}});
+    assert.match(messages[0][0], /SSH credentials/);
+    assert.equal(messages[0][2].escapeHtml, true);
+    calls[0].success('<!doctype html>');
+    assert.equal(refreshes, 0);
+});
+
+test('queued agent controls wait for task completion before refreshing', t => {
+    const {w, calls} = page(t);
+    let task;
+    w.runInstallationTaskCheck = (ids, agentId) => task = [Array.from(ids), agentId];
+    w.agentAction('restart', 1, {});
+    w.jQuery.fn.dialog = function () { return this; };
+    calls[0].success({status: 'queued', task_id: 9});
+    assert.deepEqual(task, [[9], 1]);
+});
+
+test('task polling uses one timer, backs off, and stops after completion', t => {
+    const {w, calls} = page(t);
+    Object.defineProperty(w.document, 'hidden', {value: false});
+    let now = 0, sequence = 0;
+    const timers = new Map();
+    w.Date.now = () => now;
+    w.setTimeout = (callback, delay) => {
+        timers.set(++sequence, {callback, delay});
+        return sequence;
+    };
+    w.clearTimeout = id => timers.delete(id);
+    const tick = () => {
+        assert.equal(timers.size, 1);
+        const [id, timer] = [...timers][0];
+        timers.delete(id);
+        now += timer.delay;
+        timer.callback();
+    };
+    w.runInstallationTaskCheck([7, 7]);
+    assert.equal(timers.size, 1);
+    tick();
+    assert.equal(calls.length, 1);
+    w.checkInstallationTask();
+    assert.equal(calls.length, 1); // No overlapping request for the same task.
+    calls[0].success({status: 'created'});
+    calls[0].complete();
+    assert.equal([...timers.values()][0].delay, 10000);
+    tick();
+    calls[1].success({status: 'created'});
+    calls[1].complete();
+    assert.equal([...timers.values()][0].delay, 20000);
+    tick();
+    calls[2].success({status: 'completed', server: 'example.test'});
+    calls[2].complete();
+    assert.equal(timers.size, 0);
+    assert.deepEqual(Array.from(w.getInstallationTasksFromSessionStorage()), []);
+});
+
+test('removed task stops polling after history cleanup', t => {
+    const {w, calls} = page(t);
+    let timer;
+    w.setTimeout = callback => { timer = callback; return 1; };
+    w.clearTimeout = () => { timer = null; };
+    w.runInstallationTaskCheck([8]);
+    const realNow = w.Date.now;
+    w.Date.now = () => realNow() + 60000;
+    timer();
+    calls[0].error({status: 404});
+    calls[0].complete();
+    assert.equal(timer, null);
+    assert.deepEqual(Array.from(w.getInstallationTasksFromSessionStorage()), []);
+});
diff --git a/tests/frontend/agent_transport.test.cjs b/tests/frontend/agent_transport.test.cjs
new file mode 100644
index 0000000..8956a6d
--- /dev/null
+++ b/tests/frontend/agent_transport.test.cjs
@@ -0,0 +1,26 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const source = fs.readFileSync(path.resolve(__dirname, '../../app/static/js/rmon/agent.js'), 'utf8');
+
+for (const status of ['running', 'completed', 'failed']) {
+    test(`agent card follows ${status} installation status`, () => {
+        const storage = new Map();
+        const refreshed = [];
+        const context = vm.createContext({
+            Map, console, api_v_prefix: '/api/v1.0',
+            setInterval: () => 1, clearInterval: () => {}, setTimeout: () => {}, clearTimeout: () => {},
+            document: {hidden: false},
+            NProgress: {configure: () => {}},
+            toastr: {info: () => {}, success: () => {}, error: () => {}},
+            sessionStorage: {getItem: key => storage.get(key), setItem: (key, value) => storage.set(key, value)},
+            $: {ajax: options => options.success({status, service_name: 'Agent', server: 'test'})},
+        });
+        vm.runInContext(source, context);
+        context.getAgent = id => refreshed.push(id);
+        vm.runInContext('runInstallationTaskCheck([10], 7); checkInstallationStatus(10);', context);
+        assert.deepEqual(refreshed, status === 'running' ? [] : [7]);
+    });
+}
diff --git a/tests/frontend/check_editor.test.cjs b/tests/frontend/check_editor.test.cjs
new file mode 100644
index 0000000..87a25e0
--- /dev/null
+++ b/tests/frontend/check_editor.test.cjs
@@ -0,0 +1,340 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const {JSDOM} = require('jsdom');
+const scripts = path.resolve(__dirname, '../../app/static/js');
+const fixture = fs.readFileSync(path.join(__dirname, 'fixtures/check-editor.html'), 'utf8');
+
+async function editor(t) {
+    const dom = new JSDOM('<!doctype html><body><div id="translate" data-add="Add" data-service="location"></div>' + fixture + '</body>',
+        {url: 'http://rmon.test', runScripts: 'outside-only', pretendToBeVisual: true});
+    t.after(() => dom.window.close());
+    const w = dom.window;
+    w.matchMedia = () => ({matches: false, addEventListener() {}, removeEventListener() {}});
+    w.ResizeObserver = class {observe() {} unobserve() {} disconnect() {}};
+    w.toastr = {error() {}, warning() {}};
+    w.cancel_word = 'Cancel'; w.delete_word = 'Delete'; w.api_v_prefix = '/api/v1.0';
+    w.check_types = {http:2,tcp:1,dns:5,ping:4,smtp:3,rabbitmq:6};
+    for (const file of ['jquery-3.6.0.min.js','jquery-ui.min.js','ux.js','tagify.js','rmon/check_editor.js','rmon/smon.js','rmon/check.js']) {
+        w.eval(fs.readFileSync(path.join(scripts, file), 'utf8'));
+    }
+    const $ = w.jQuery;
+    w.translate_div = $('#translate');
+    $.fx.off = true;
+    $('select').selectmenu(); $('input[type=checkbox]').checkboxradio();
+    const requests = [], saved = [];
+    $.ajax = options => {
+        if (options.url === '/rmon/checks/count') options.success('0');
+        else if (/\/rmon\/(agents|regions|countries)$/.test(options.url)) options.success([{id:7,name:'Test location',enabled:1}]);
+        else if (/\/rmon\/(agent|region|country)\/7$/.test(options.url)) options.success({id:7,name:'Test location'});
+        else requests.push(options);
+        return options;
+    };
+    w.getSmonCheck = (...args) => saved.push(args);
+    await new Promise(resolve => $(resolve));
+    return {w, $, requests, saved, ui:w.CheckEditor};
+}
+
+const cases = {
+    http: {url:'https://example.test/health',ssl_policy:'require_https'},
+    tcp: {ip:'example.test',port:443},
+    dns: {ip:'example.test',port:53,resolver:'1.1.1.1',record_type:'mx'},
+    ping: {ip:'192.0.2.1',packet_size:56,count_packets:3,use_kernel_timestamp:true},
+    smtp: {ip:'smtp.example.test',port:587,username:'monitor',password:'smtp-pass'},
+    rabbitmq: {ip:'rabbit.example.test',port:5672,username:'monitor',password:'rabbit-pass',vhost:'/monitor'}
+};
+const control = {record_type:'dns_record_type',resolver:'resolver-server'};
+function fill($, type) {
+    $('#new-smon-name').val('Health check');
+    for (const [key,value] of Object.entries(cases[type])) {
+        const field = $('#new-smon-' + (control[key] || key));
+        if (field.attr('type') === 'checkbox') field.prop('checked',value); else field.val(value);
+    }
+}
+function response(type) {
+    return {name:'Saved check',place:'all',entities:[],retries:4,description:"Owner's check",priority:'warning',
+        runbook:'https://docs.example.test/runbook',check_group:'Production',threshold_timeout:200,
+        checks:[{...cases[type],interval:120,method:'post',body_req:'{"name":"O\'Brien"}',header_req:'{"X-Test":"it\'s valid"}',
+            accepted_status_codes:type === 'http' ? [200,'300-304'] : [],
+            smon_id:{check_timeout:5,enabled:0,telegram_channel_id:9}}]};
+}
+
+for (const type of Object.keys(cases)) {
+    test(`${type}: create preserves API payload and sends only one request while saving`, async t => {
+        const {w,$,ui,requests,saved} = await editor(t);
+        w.openSmonDialog(type); fill($,type);
+        assert.equal(ui.validate(),true);
+        w.addNewSmonServer($('#smon-add-table')[0]);
+        w.addNewSmonServer($('#smon-add-table')[0]);
+        assert.equal(requests.length,1);
+        const request = requests[0], payload = JSON.parse(request.data);
+        assert.equal(request.url,`/api/v1.0/rmon/check/${type}`);
+        assert.equal(request.type,'post');
+        assert.equal(payload.name,'Health check');
+        for (const [key,value] of Object.entries(cases[type])) assert.equal(String(payload[key]), typeof value === 'boolean' ? String(Number(value)) : String(value));
+        assert.equal(payload.interval,'120');
+        assert.equal(payload.enabled,'1');
+        assert.equal($('#check-editor-submit').prop('disabled'),true);
+        request.success({id:42});
+        assert.equal(saved[0][0],42);
+        assert.equal(saved[0][3],true);
+        assert.equal(ui.isBusy(),false);
+    });
+
+    test(`${type}: edit restores values and uses PUT; clone uses POST without losing the draft`, async t => {
+        const {w,$,requests} = await editor(t);
+        $('#new-smon-telegram').append('<option value="9">Operations</option>');
+        w.editSmon(17,type);
+        requests.shift().success(response(type));
+        assert.equal($('#check_type').prop('disabled'),true);
+        assert.equal($('#new-smon-place').prop('disabled'),true);
+        assert.equal($('#new-smon-description').val(),"Owner's check");
+        assert.equal($('#new-smon-timeout').val(),'5');
+        assert.equal($('#new-smon-enable').prop('checked'),false);
+        assert.equal($('#new-smon-telegram').val(),'9');
+        for (const [key,value] of Object.entries(cases[type])) {
+            const field = $('#new-smon-' + (control[key] || key));
+            assert.equal(String(field.attr('type') === 'checkbox' ? field.prop('checked') : field.val()),String(value));
+        }
+        if (type === 'http') {
+            assert.equal($('#new-smon-body-req').val(),'{"name":"O\'Brien"}');
+            assert.equal($('#new-smon-header-req').val(),'{"X-Test":"it\'s valid"}');
+            assert.deepEqual(Array.from(w.tagify.value,tag => tag.value),['200','300-304']);
+        }
+        $('#check-editor-submit').trigger('click');
+        const update = requests.shift();
+        assert.equal(update.type,'put');
+        assert.equal(update.url,`/api/v1.0/rmon/check/${type}/17`);
+        update.error(); // Keep the test dialog available for a subsequent clone.
+        w.cloneSmon(17,type);
+        requests.shift().success(response(type));
+        assert.equal($('#check_type').prop('disabled'),false);
+        assert.equal($('#new-smon-place').prop('disabled'),false);
+        assert.equal($('#new-smon-name').val(),'Saved check (copy)');
+        assert.equal($('#new-smon-group').val(),'Production');
+        $('#check-editor-submit').trigger('click');
+        assert.equal(requests[0].type,'post');
+        assert.equal(requests[0].url,`/api/v1.0/rmon/check/${type}`);
+        if (type === 'http') assert.equal(JSON.parse(requests[0].data).ssl_policy, 'require_https');
+    });
+}
+
+test('switching type and steps preserves shared fields and per-protocol ports', async t => {
+    const {w,$,ui} = await editor(t);
+    w.openSmonDialog('tcp'); fill($,'tcp');
+    $('#new-smon-group').val('Production'); $('#new-smon-runbook').val('https://docs.example.test');
+    ui.setType('dns'); assert.equal($('#new-smon-port').val(),'53');
+    $('#new-smon-port').val('5353');
+    ui.setType('tcp'); assert.equal($('#new-smon-port').val(),'443');
+    ui.setType('dns'); assert.equal($('#new-smon-port').val(),'5353');
+    ui.showStep(2); ui.showStep(0);
+    assert.equal($('#new-smon-name').val(),'Health check');
+    assert.equal($('#new-smon-group').val(),'Production');
+    assert.equal($('#new-smon-ip').val(),'example.test');
+});
+
+test('next validates only the current step; save exposes the first invalid section', async t => {
+    const {w,$,ui,requests} = await editor(t);
+    w.openSmonDialog('http');
+    ui.next();
+    assert.equal($('#new-smon-name').attr('aria-invalid'),'true');
+    fill($,'http'); $('#new-smon-timeout').val('999');
+    ui.next(); assert.equal($('#check-editor-step-1').prop('hidden'),false);
+    ui.showStep(2); $('#check-editor-submit').trigger('click');
+    assert.equal(requests.length,0);
+    assert.equal($('#check-editor-step-1').prop('hidden'),false);
+    assert.equal($('#new-smon-timeout').attr('aria-invalid'),'true');
+});
+
+test('validation rejects empty RabbitMQ credentials, invalid ports and unsafe URL schemes', async t => {
+    const {w,$,ui} = await editor(t);
+    w.openSmonDialog('rabbitmq'); fill($,'rabbitmq');
+    $('#new-smon-password').val(''); $('#new-smon-port').val('65536');
+    assert.equal(ui.validate(),false);
+    assert.equal($('#new-smon-password').attr('aria-invalid'),'true');
+    assert.equal($('#new-smon-port').attr('aria-invalid'),'true');
+    ui.setType('http'); $('#new-smon-url').val('javascript:alert(1)');
+    assert.equal(ui.validate(),false);
+    assert.equal($('#new-smon-url').attr('aria-invalid'),'true');
+});
+
+test('HTTP advanced settings survive editing and expand when validation fails', async t => {
+    const {w,$,ui,requests} = await editor(t);
+    const data = response('http');
+    Object.assign(data.checks[0], {body_json:{path:'$.health',value:'ok'},auth:{basic:{username:'user',password:"a'b"}},
+        proxy:{type:'http',host:'proxy.test',port:3128,username:'proxy-user',password:'proxy-pass'},
+        headers_response:{required_response_headers:{'X-Health':'yes'},forbidden_headers:null}});
+    w.editSmon(17,'http'); requests.shift().success(data);
+    assert.equal($('#new-smon-basic_password').val(),"a'b");
+    assert.equal($('#new-smon-header-response-required').val(),'{\n  "X-Health": "yes"\n}');
+    assert.equal($('#new-smon-body-json-path').val(),'$.health');
+    assert.equal($('#smon_http_check_proxy_method').val(),'http');
+    assert.equal(ui.validate(),true);
+    $('#new-smon-header-req').val('{invalid'); ui.showStep(2);
+    assert.equal(ui.validate(),false);
+    assert.equal($('#new-smon-header-req').closest('details').prop('open'),true);
+    assert.equal($('#check-editor-step-1').prop('hidden'),false);
+});
+
+test('selected location is required and entities survive edit and clone', async t => {
+    const {w,$,ui,requests} = await editor(t);
+    w.openSmonDialog('tcp'); fill($,'tcp');
+    $('#new-smon-place').val('agent').trigger('selectmenuchange');
+    assert.equal(ui.validate(),false);
+    w.addEntityToStatus(7,'Test location');
+    assert.equal(ui.validate(),true);
+    const data = response('tcp'); data.place='agent'; data.entities=[7];
+    w.cloneSmon(17,'tcp'); requests.shift().success(data);
+    assert.equal($('#checked-entities > div').length,1);
+    assert.equal($('#new-smon-place').val(),'agent');
+});
+
+test('save errors keep the draft and allow retry; loading errors prevent empty overwrite', async t => {
+    const {w,$,ui,requests} = await editor(t);
+    w.openSmonDialog('tcp'); fill($,'tcp');
+    $('#check-editor-submit').trigger('click'); requests.shift().error({status:500});
+    assert.equal($('#new-smon-name').val(),'Health check');
+    assert.equal($('#check-editor-error').prop('hidden'),false);
+    assert.equal($('#check-editor-submit').prop('disabled'),false);
+    $('#check-editor-submit').trigger('click'); assert.equal(requests.length,1);
+    requests.shift().error();
+    w.editSmon(99,'tcp'); requests.shift().error({status:404});
+    assert.equal(ui.isBlocked(),true);
+    assert.equal($('#check-editor-submit').prop('disabled'),true);
+    w.addNewSmonServer($('#smon-add-table')[0],99,true);
+    assert.equal(requests.length,0);
+});
+
+test('new check clears credentials, advanced settings, channels and errors from previous draft', async t => {
+    const {w,$,ui} = await editor(t);
+    w.openSmonDialog('http');
+    $('#new-smon-basic_password').val('secret'); $('#smon_http_check_auth_method').val('basic');
+    $('#new-smon-mtls_key').val('secret-key'); $('#new-smon-http_proxy_password').val('proxy-secret');
+    $('#new-smon-description').val('Previous'); $('#new-smon-enable').prop('checked',false);
+    $('#new-smon-ssl_policy').val('require_http');
+    ui.validate();
+    w.openSmonDialog('http');
+    for (const id of ['basic_password','mtls_key','http_proxy_password','description']) assert.equal($('#new-smon-' + id).val(),'');
+    assert.equal($('#smon_http_check_auth_method').val(),'0');
+    assert.equal($('#new-smon-enable').prop('checked'),true);
+    assert.equal($('#new-smon-ssl_policy').val(),'default');
+    assert.equal($('[aria-invalid=true]').length,0);
+    assert.deepEqual(Array.from(w.tagify.value,tag => tag.value),['200']);
+});
+
+test('summary excludes URL credentials and query values and tabs support keyboard navigation', async t => {
+    const {w,$,ui} = await editor(t);
+    w.openSmonDialog('http');
+    $('#new-smon-url').val('https://user:secret@example.test/health?token=private');
+    ui.showStep(2);
+    assert.equal($('#check-editor-summary').text().includes('secret'),false);
+    assert.equal($('#check-editor-summary').text().includes('private'),false);
+    $('#check-editor-tab-2')[0].dispatchEvent(new w.KeyboardEvent('keydown',{key:'Home',bubbles:true}));
+    assert.equal($('#check-editor-tab-0').attr('aria-selected'),'true');
+});
+
+test('HTTP status codes accept wildcards and ranges and reject reversed ranges', async t => {
+    const {w,$,ui,requests} = await editor(t);
+    w.openSmonDialog('http'); fill($,'http');
+    w.tagify.removeAllTags(); w.tagify.addTags(['204','300-304','4**']);
+    assert.deepEqual(Array.from(w.tagify.value, tag => tag.value),['204','300-304','4**']);
+    assert.equal(ui.validate(),true);
+    $('#check-editor-submit').trigger('click');
+    assert.deepEqual(JSON.parse(requests[0].data).accepted_status_codes,['204','300-304','4**']);
+    requests.shift().error();
+    w.tagify.removeAllTags(); w.tagify.addTags(['400-300']);
+    assert.equal(ui.validate(),false);
+    assert.equal(w.tagify.DOM.input.getAttribute('aria-invalid'),'true');
+    w.tagify.removeAllTags(); w.tagify.addTags(['200']);
+    assert.equal(ui.validate(),true);
+    assert.equal(w.tagify.DOM.input.hasAttribute('aria-describedby'),false);
+});
+
+test('mTLS, headers, proxy, channels and HTTP options retain their exact payload', async t => {
+    const {w,$,requests} = await editor(t);
+    for (const channel of ['telegram','slack','pd','mm','incidentrelay','email']) {
+        $('#new-smon-' + channel).append('<option value="9">Operations</option>');
+    }
+    const data = response('http');
+    Object.assign(data.checks[0], {
+        auth:{mtls:{key:'PRIVATE KEY\nbody',cert:'CERTIFICATE\nbody',ca:'CA\nbody'}},
+        proxy:{type:'socks5',host:'proxy.test',port:1080,username:'monitor',password:'proxy-pass'},
+        headers_response:{required_response_headers:{'X-Ready':'yes'},forbidden_headers:['X-Error']},
+        ignore_ssl_error:1,accept_cookies:false,http_version:2,resole_to_ip:'192.0.2.1',redirects:2,
+    });
+    for (const channel of ['telegram','slack','pd','mm','incidentrelay','email']) data[channel + '_channel_id']=9;
+    w.editSmon(17,'http'); requests.shift().success(data);
+    $('#check-editor-submit').trigger('click');
+    const payload = JSON.parse(requests.shift().data);
+    assert.deepEqual(payload.auth,data.checks[0].auth);
+    assert.deepEqual(payload.proxy,{...data.checks[0].proxy,port:'1080'});
+    assert.deepEqual(JSON.parse(payload.headers_response.required_response_headers),{'X-Ready':'yes'});
+    assert.equal(payload.headers_response.forbidden_headers,'X-Error');
+    assert.equal(payload.header_req,data.checks[0].header_req);
+    assert.equal(payload.body_req,data.checks[0].body_req);
+    assert.equal(payload.ignore_ssl_error,'1');
+    assert.equal(payload.accept_cookies,0);
+    assert.equal(payload.http_version,2);
+    assert.equal(payload.resole_to_ip,'192.0.2.1');
+    for (const channel of ['telegram','slack','pd','mm','incidentrelay','email']) assert.equal(payload[channel + '_channel_id'],'9');
+});
+
+test('interval, timeout, ping packet budget and mTLS required fields are validated before saving', async t => {
+    const {w,$,ui} = await editor(t);
+    w.openSmonDialog('ping'); fill($,'ping');
+    $('#new-smon-interval').val('30');
+    assert.equal(ui.validate(),false);
+    assert.equal($('#new-smon-count_packets').attr('aria-invalid'),'true');
+    $('#new-smon-count_packets').val('2'); $('#new-smon-packet_size').val('16');
+    assert.equal(ui.validate(),false);
+    assert.equal($('#new-smon-packet_size').attr('aria-invalid'),'true');
+    $('#new-smon-packet_size').val('56'); $('#new-smon-threshold_timeout').val('10000');
+    assert.equal(ui.validate(),false);
+    assert.equal($('#new-smon-threshold_timeout').attr('aria-invalid'),'true');
+    $('#new-smon-threshold_timeout').val('0');
+    assert.equal(ui.validate(),true);
+    ui.setType('http'); fill($,'http');
+    $('#smon_http_check_auth_method').val('mtls').trigger('selectmenuchange');
+    assert.equal(ui.validate(),false);
+    assert.equal($('#new-smon-mtls_key').attr('aria-invalid'),'true');
+    assert.equal($('#new-smon-mtls_cert').attr('aria-invalid'),'true');
+});
+
+test('location buttons support names with quotes; missing locations block edit and clone', async t => {
+    const {w,$,ui,requests} = await editor(t);
+    w.openSmonDialog('tcp'); fill($,'tcp');
+    const name = 'Paris "DC" / O\'Brien <backup>';
+    w.removeEntityFromStatus(12,name);
+    $('#add_check-12 button').trigger('click');
+    assert.equal($('#remove_check-12 .check-name').text(),name);
+    assert.equal($('#remove_check-12 button').attr('aria-label'),'Delete ' + name);
+    assert.equal($('#remove_check-12 backup').length,0);
+    $('#remove_check-12 button').trigger('click');
+    assert.equal($('#add_check-12 .check-name').text(),name);
+    const data = response('tcp'); data.place='agent'; data.entities=[999];
+    for (const action of ['editSmon','cloneSmon']) {
+        w[action](17,'tcp'); requests.shift().success(data);
+        requests.shift().error?.();
+        assert.equal(ui.isBlocked(),true);
+        assert.equal($('#checked-entities > div').length,0);
+        assert.equal($('#check-editor-submit').prop('disabled'),true);
+    }
+});
+
+test('custom controls have accessible names and errors on the real focus target', async t => {
+    const {w,$,ui} = await editor(t);
+    w.openSmonDialog('http'); fill($,'http');
+    assert.equal($('#check_type-button').attr('aria-label'),'Checking');
+    assert.equal($('#check_type-button').attr('aria-labelledby'),undefined);
+    assert.equal($('#new-smon-place-button').attr('aria-label'),'Run checks from');
+    assert.equal(w.tagify.DOM.input.getAttribute('aria-label'),'Accepted Status Codes');
+    assert.equal($('#new-smon-enable').attr('aria-label'),'Enable');
+    $('#new-smon-place').val('agent').trigger('selectmenuchange');
+    assert.equal($('#new-smon-place-button').attr('aria-labelledby'),undefined);
+    ui.validate();
+    assert.equal($('#new-smon-place-button').attr('aria-invalid'),'true');
+    assert.equal(w.document.activeElement.id,'new-smon-place-button');
+    w.addEntityToStatus(7,'Test location'); ui.validate();
+    assert.equal($('#new-smon-place-button').attr('aria-describedby'),undefined);
+});
diff --git a/tests/frontend/fixtures/check-editor.html b/tests/frontend/fixtures/check-editor.html
new file mode 100644
index 0000000..c0efcae
--- /dev/null
+++ b/tests/frontend/fixtures/check-editor.html
@@ -0,0 +1,667 @@
+
+<script id="check-editor-strings" type="application/json">{"authentication": "Authentication", "available": "Available", "back": "Back", "copy": "copy", "create": "Create check", "disabled": "Disabled", "edit": "Edit check", "entities": "Select at least one location.", "extra": "Additional settings", "intro": "Start with the target. Defaults are ready to use; tune advanced settings only when needed.", "invalid_url": "Enter an HTTP or HTTPS URL with a hostname.", "json": "Enter a valid JSON object.", "json_path": "JSON path", "json_value": "Expected JSON value", "load_error": "Unable to load the check. Close this window and try again.", "loading": "Loading check settings\u2026", "locations": "Run checks from", "next": "Next", "no_channels": "Notifications are disabled", "notifications": "Notifications", "notifications_hint": "Choose notification channels or leave them disabled. You can change these settings later.", "number": "Enter a number in the allowed range.", "ping_timeout": "Packet count \u00d7 timeout must be shorter than the interval.", "port": "Enter a port from 2 to 65535.", "proxy": "Proxy", "proxy_host": "Proxy hostname", "proxy_password": "Proxy password", "proxy_port": "Proxy port", "proxy_username": "Proxy username", "request": "Request and connection", "required": "Fill in this field.", "response": "Response validation", "save": "Save changes", "save_error": "The check was not saved. Your input is still here; review the fields and try again.", "saving": "Saving\u2026", "seconds": "s", "sections": "Check setup", "selected": "Selected", "settings": "Settings", "settings_hint": "Intervals and timeouts are in seconds. Expand the blocks below for advanced settings.", "ssl_policy": "HTTPS policy", "ssl_policy_default": "Default", "ssl_policy_hint": "Checks the final URL after allowed redirects. HTTPS to HTTP is always an error, including in Default mode. Ignoring certificate errors does not disable this policy.", "ssl_policy_http": "Require HTTP", "ssl_policy_https": "Require HTTPS", "status_codes": "Add at least one accepted HTTP status code.", "summary": "Review", "summary_empty": "Choose a target", "target": "Check", "target_hint": "Choose what to monitor and where to run the check.", "timeout": "The timeout must be shorter than the interval."}</script>
+<script src="/static/js/rmon/check.js"></script>
+<script src="/static/js/rmon/check_editor.js"></script>
+<link href="/static/css/datetimepicker.min.css" rel="stylesheet">
+<script src="/static/js/datetimepicker.full.min.js"></script>
+<link rel="stylesheet" href="/static/css/tagify.css">
+<script src="/static/js/tagify.js"></script>
+<link rel="stylesheet" href="/static/css/check_editor.css">
+<script>
+$(function () {
+    $.datetimepicker.setLocale('en');
+    $('#new-smon-expiration').datetimepicker({format: 'Y-m-d H:i', minDate: 0, step: 1});
+});
+</script>
+<div id="smon-add-table" class="check-editor" style="display: none;">
+    <div id="smon-add-table-overview" data-create="Create check" data-edit="Edit check">
+        <p class="check-editor-intro">Start with the target. Defaults are ready to use; tune advanced settings only when needed.</p>
+    </div>
+    <div class="check-editor-tabs" role="tablist" aria-label="Check setup">
+        
+        <button type="button" role="tab" id="check-editor-tab-0" aria-controls="check-editor-step-0" aria-selected="true" tabindex="0" data-step="0"><span>1</span>Check</button>
+        
+        <button type="button" role="tab" id="check-editor-tab-1" aria-controls="check-editor-step-1" aria-selected="false" tabindex="-1" data-step="1"><span>2</span>Settings</button>
+        
+        <button type="button" role="tab" id="check-editor-tab-2" aria-controls="check-editor-step-2" aria-selected="false" tabindex="-1" data-step="2"><span>3</span>Notifications</button>
+        
+    </div>
+    <div id="check-editor-error" class="check-editor-error" role="alert" tabindex="-1" hidden></div>
+    <form id="check-editor-form" novalidate>
+        <section role="tabpanel" id="check-editor-step-0" aria-labelledby="check-editor-tab-0" data-step="0">
+            <h3>Check</h3><p class="field-help">Choose what to monitor and where to run the check.</p>
+            <div class="check-fields">
+<div class="check-field ">
+<label class="check-field-label" for="check_type">Checking
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+				
+		
+	
+	
+		
+	
+	<select  name="check_type" id="check_type" title="" data-help="" class="">
+		
+			<option disabled selected>------</option>
+		
+		
+			
+				
+					<option value="dns">DNS</option>
+				
+			
+				
+					<option value="ping">Ping</option>
+				
+			
+				
+					<option value="smtp">SMTP</option>
+				
+			
+				
+					<option value="rabbitmq">RabbitMQ</option>
+				
+			
+				
+					<option value="tcp">TCP</option>
+				
+			
+				
+					<option value="http" selected>HTTP(s)</option>
+				
+			
+		
+	</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-name">Name
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-name" value="" id="new-smon-name" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-url">URL
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-url" value="" id="new-smon-url" data-help="https://example.com/health" size="" style=""     placeholder="https://example.com/health" title="https://example.com/health" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field new_smon_hostname">
+<label class="check-field-label" for="new-smon-ip">Hostname
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-ip" value="" id="new-smon-ip" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_tcp_check smon_dns_check smon_smtp_check smon_rabbit_check">
+<label class="check-field-label" for="new-smon-port">Port
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="number" name="new-smon-port" value="" id="new-smon-port" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_dns_check">
+<label class="check-field-label" for="new-smon-resolver-server">Resolver server
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-resolver-server" value="8.8.8.8" id="new-smon-resolver-server" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_dns_check">
+<label class="check-field-label" for="new-smon-dns_record_type">Resource Record Type
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+				
+		
+	
+	
+		
+	
+	<select  name="new-smon-dns_record_type" id="new-smon-dns_record_type" title="" data-help="" class="">
+		
+			<option disabled selected>------</option>
+		
+		
+			
+				
+					<option value="a" selected>A</option>
+				
+			
+				
+					<option value="aaa">AAA</option>
+				
+			
+				
+					<option value="caa">CAA</option>
+				
+			
+				
+					<option value="cname">CNAME</option>
+				
+			
+				
+					<option value="mx">MX</option>
+				
+			
+				
+					<option value="ns">NS</option>
+				
+			
+				
+					<option value="ptr">PTR</option>
+				
+			
+				
+					<option value="sao">SAO</option>
+				
+			
+				
+					<option value="srv">SRV</option>
+				
+			
+				
+					<option value="txt">TXT</option>
+				
+			
+		
+	</select></div>
+</div>
+<div class="check-field smon_smtp_check smon_rabbit_check">
+<label class="check-field-label" for="new-smon-username">Username
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-username" value="" id="new-smon-username" data-help="" size="" style=""     placeholder="example@example.com" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_smtp_check smon_rabbit_check">
+<label class="check-field-label" for="new-smon-password">Password
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="password" name="new-smon-password" value="" id="new-smon-password" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_rabbit_check">
+<label class="check-field-label" for="new-smon-vhost">VHost
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-vhost" value="/" id="new-smon-vhost" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-place">Run checks from
+				<span class="need-field">*</span></label>
+<div class="check-field-control"><select name="new-smon-place" id="new-smon-place">
+                    <option value="all">All regions</option>
+                    <option value="country">Countries</option>
+                    <option value="region">Regions</option>
+                    <option value="agent">Agents</option>
+                </select></div>
+</div>
+<div id="agent_tr" class="check-field check-field-wide" style="display: none;"><div class="check-entity-headings"><span>Available</span><span>Selected</span></div><div class="country">
+                <div id="checked-entities" class="enabled-check" style="height: auto"></div>
+                <div id="all-entities" style="height: auto"></div>
+            </div></div>
+            </div>
+        </section>
+        <section role="tabpanel" id="check-editor-step-1" aria-labelledby="check-editor-tab-1" data-step="1" hidden>
+            <h3>Settings</h3><p class="field-help">Intervals and timeouts are in seconds. Expand the blocks below for advanced settings.</p>
+            <div class="check-fields">
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-interval">Check interval
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="number" name="new-smon-interval" value="120" id="new-smon-interval" data-help="Check interval. In seconds." size="" style=""     placeholder="120" title="Check interval. In seconds." class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-timeout">Timeout
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="number" name="new-smon-timeout" value="10" id="new-smon-timeout" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-retries">Retries
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="number" name="new-smon-retries" value="3" id="new-smon-retries" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" />
+                <div class="tooltip" style="padding: 0">Maximum retries before the service is marked as down and a notification is sent</div></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-threshold_timeout">Threshold timeout</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-threshold_timeout" value="0" id="new-smon-threshold_timeout" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" />
+                <div class="tooltip" style="padding: 0">A warning message will be sent if the response is slower than this value. In ms. 0 disabled</div></div>
+</div>
+<div class="check-field smon_ping_check">
+<label class="check-field-label" for="new-smon-packet_size">Packet size
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="number" name="new-smon-packet_size" value="56" id="new-smon-packet_size" data-help="" size="" style=""     placeholder="56" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_ping_check">
+<label class="check-field-label" for="new-smon-count_packets">Count packets
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="number" name="new-smon-count_packets" value="5" id="new-smon-count_packets" data-help="" size="" style=""     placeholder="5" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-status-code">Accepted Status Codes
+				<span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-status-code" value="" id="new-smon-status-code" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+            </div>
+<details class="check-advanced smon_http_check smon_smtp_check"><summary>Request and connection</summary><div class="check-fields"><div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-method">HTTP method</label>
+<div class="check-field-control">
+				
+		
+	
+	
+		
+	
+	<select  name="new-smon-method" id="new-smon-method" title="" data-help="" class="">
+		
+			<option disabled selected>------</option>
+		
+		
+			
+				
+					<option value="get" selected>GET</option>
+				
+			
+				
+					<option value="post">POST</option>
+				
+			
+				
+					<option value="put">PUT</option>
+				
+			
+				
+					<option value="head">HEAD</option>
+				
+			
+				
+					<option value="patch">PATCH</option>
+				
+			
+				
+					<option value="delete">DELETE</option>
+				
+			
+				
+					<option value="options">OPTIONS</option>
+				
+			
+		
+	</select></div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-http_version">Check HTTP version</label>
+<div class="check-field-control">
+				
+		
+	
+	
+		
+	
+	<select  name="new-smon-http_version" id="new-smon-http_version" title="" data-help="" class="">
+		
+			<option disabled selected>------</option>
+		
+		
+			
+				
+					<option value="0" selected>None</option>
+				
+			
+				
+					<option value="1">1.1</option>
+				
+			
+				
+					<option value="2">1.1</option>
+				
+			
+				
+					<option value="3">2</option>
+				
+			
+				
+					<option value="4">3</option>
+				
+			
+		
+	</select></div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="new-smon-body-req">Body request</label>
+<div class="check-field-control"><textarea id="new-smon-body-req" cols="50" rows="5" class="form-control" title="JSON only" placeholder="Example:
+{
+    &quot;key&quot;: &quot;value&quot;
+}"></textarea></div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="new-smon-header-req">Headers request</label>
+<div class="check-field-control"><textarea id="new-smon-header-req" cols="50" rows="5" class="form-control" title="JSON only" placeholder="Example:
+{
+    &quot;Header&quot;: &quot;Value&quot;
+}"></textarea></div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-resole_to_ip">Resole name to a specific IP address</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-resole_to_ip" value="" id="new-smon-resole_to_ip" data-help="IPv4 or IPv6" size="" style=""     placeholder="1.1.1.1" title="IPv4 or IPv6" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_http_check">
+<label class="check-field-label" for="new-smon-redirects">Maximum redirects</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="number" name="new-smon-redirects" value="10" id="new-smon-redirects" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" />
+                <div class="tooltip" style="padding: 0">Maximum number of redirects to follow. Set to 0 to disable redirects.</div></div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="new-smon-ssl_policy">HTTPS policy</label>
+<div class="check-field-control">
+<select id="new-smon-ssl_policy" aria-describedby="ssl-policy-hint">
+    <option value="default" selected>Default</option>
+    <option value="require_https">Require HTTPS</option>
+    <option value="require_http">Require HTTP</option>
+</select>
+<div class="tooltip" id="ssl-policy-hint">Checks the final URL after allowed redirects. HTTPS to HTTP is always an error, including in Default mode. Ignoring certificate errors does not disable this policy.</div>
+</div>
+</div>
+<div class="check-field smon_http_check smon_smtp_check"><div class="check-field-label">Ignore TLS/SSL error</div><div class="check-field-control">
+		
+	
+	
+	<label for="new-smon-ignore_ssl_error" title="" class="new-smon-ignore_ssl_error" style="" data-help=""></label><input name="new-smon-ignore_ssl_error" type="checkbox" id="new-smon-ignore_ssl_error" value=""   /></div></div>
+<div class="check-field smon_http_check"><div class="check-field-label">Accept cookies</div><div class="check-field-control">
+		
+	
+	
+	<label for="new-smon-accept_cookies" title="" class="new-smon-accept_cookies" style="" data-help=""></label><input name="new-smon-accept_cookies" type="checkbox" id="new-smon-accept_cookies" value="" checked  /></div></div></div></details>
+<details class="check-advanced smon_http_check"><summary>Response validation</summary><div class="check-fields"><div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="smon_http_check_headers_response_type">Headers response</label>
+<div class="check-field-control" id="smon_http_check_headers_response"><select id="smon_http_check_headers_response_type">
+                    <option value="0">None</option>
+                    <option value="check">Check</option>
+                </select>
+                <div id="new-smon-headers-response" style="display: none;margin-bottom: 10px;margin-top: 10px;">
+                    <textarea id="new-smon-header-response-required" cols="50" rows="5" class="form-control" title="Required headers. JSON only." placeholder="Required headers example:
+{
+    &quot;Header&quot;: &quot;Value&quot;,
+    &quot;Header2&quot;: &quot;Value2&quot;
+}"></textarea>
+                    <textarea id="new-smon-header-response-forbidden" cols="50" rows="5" class="form-control" title="Forbidden headers" placeholder="Forbidden headers example:
+    &quot;Header&quot;, &quot;Header2&quot;
+"></textarea>
+                </div></div>
+</div>
+<div class="check-field smon_http_check check-field-wide">
+<label class="check-field-label" for="smon_http_check_body_type">Body response</label>
+<div class="check-field-control"><select id="smon_http_check_body_type">
+                    <option value="0">None</option>
+                    <option value="keyword">Keyword</option>
+                    <option value="json">JSON Path</option>
+                </select>
+                <div class="smon_http_check_body_type_keyword" style="display: none;margin-bottom: 10px;margin-top: 10px;">
+                    
+		
+	
+	
+    <input type="text" name="new-smon-body-keyword" value="" id="new-smon-body-keyword" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" />
+				    <span class="need-field">*</span>
+                </div>
+                <div class="smon_http_check_body_type_json" style="display: none; margin-bottom: 10px;margin-top: 10px;">
+                    
+		
+	
+	
+    <input type="text" name="new-smon-body-json-path" value="" id="new-smon-body-json-path" data-help="" size="" style=""     placeholder="Example: $.foo" title="" class="form-control" autocomplete="off" />
+				    <span class="need-field">*</span>
+                    <div class="tooltip" style="padding: 0">
+                        Check out <a href="https://jsonata.org/" target="_blank">jsonata.org</a>
+                        for the documentation about the query language. A playground can be found <a href="https://try.jsonata.org/" target="_blank">here</a>.
+                    </div>
+                    
+		
+	
+	
+    <input type="text" name="new-smon-body-json-value" value="" id="new-smon-body-json-value" data-help="" size="" style=""     placeholder="Example: &#34;bar&#34;" title="" class="form-control" autocomplete="off" />
+                    <div class="tooltip" style="padding: 0">Leave value empty, if want to check only path</div>
+                </div></div>
+</div></div></details>
+<details class="check-advanced smon_http_check"><summary>Authentication</summary><div class="check-fields"><div class="check-field smon_http_check">
+<label class="check-field-label" for="smon_http_check_auth_method">Authentication method</label>
+<div class="check-field-control"><select id="smon_http_check_auth_method">
+                    <option value="0">None</option>
+                    <option value="basic">Basic</option>
+                    <option value="mtls">MTLS</option>
+                </select></div>
+</div>
+<div class="check-field smon_http_check_basic" style="display: none;">
+<label class="check-field-label" for="new-smon-basic_username">Username</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-basic_username" value="" id="new-smon-basic_username" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_http_check_basic" style="display: none;">
+<label class="check-field-label" for="new-smon-basic_password">Password</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="password" name="new-smon-basic_password" value="" id="new-smon-basic_password" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_http_check_mtls check-field-wide" style="display: none;">
+<label class="check-field-label" for="new-smon-mtls_key">Key
+				<span class="need-field">*</span></label>
+<div class="check-field-control"><textarea id="new-smon-mtls_key" cols="50" rows="5" class="form-control" placeholder="Key body"></textarea></div>
+</div>
+<div class="check-field smon_http_check_mtls check-field-wide" style="display: none;">
+<label class="check-field-label" for="new-smon-mtls_cert">Cert
+				<span class="need-field">*</span></label>
+<div class="check-field-control"><textarea id="new-smon-mtls_cert" cols="50" rows="5" class="form-control" placeholder="Cert body"></textarea></div>
+</div>
+<div class="check-field smon_http_check_mtls check-field-wide" style="display: none;">
+<label class="check-field-label" for="new-smon-mtls_ca">CA</label>
+<div class="check-field-control"><textarea id="new-smon-mtls_ca" cols="50" rows="5" class="form-control" placeholder="CA body"></textarea></div>
+</div></div></details>
+<details class="check-advanced smon_http_check"><summary>Proxy</summary><div class="check-fields"><div class="check-field smon_http_check">
+<label class="check-field-label" for="smon_http_check_proxy_method">Proxy</label>
+<div class="check-field-control"><select id="smon_http_check_proxy_method">
+                    <option value="0">None</option>
+                    <option value="http">http</option>
+                    <option value="https">https</option>
+                    <option value="socks4">socks4</option>
+                    <option value="socks4a">socks4a</option>
+                    <option value="socks5">socks5</option>
+                    <option value="socks5h">socks5h</option>
+                </select></div>
+</div>
+<div class="check-field smon_http_check_proxy" style="display: none;">
+<label class="check-field-label" for="new-smon-http_proxy_host">Host and port
+                <span class="need-field">*</span></label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-http_proxy_host" value="" id="new-smon-http_proxy_host" data-help="" size="" style=""     placeholder="proxy-server.com" title="" class="form-control" autocomplete="off" /> 
+		
+	
+	
+    <input type="text" name="new-smon-http_proxy_port" value="" id="new-smon-http_proxy_port" data-help="" size="" style=""     placeholder="3128" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field smon_http_check_proxy" style="display: none;">
+<label class="check-field-label" for="new-smon-http_proxy_username">Authentication</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-http_proxy_username" value="" id="new-smon-http_proxy_username" data-help="" size="" style=""     placeholder="username" title="" class="form-control" autocomplete="off" />
+                
+		
+	
+	
+    <input type="password" name="new-smon-http_proxy_password" value="" id="new-smon-http_proxy_password" data-help="" size="" style=""     placeholder="password" title="" class="form-control" autocomplete="off" /></div>
+</div></div></details>
+<details class="check-advanced "><summary>Additional settings</summary><div class="check-fields"><div class="check-field smon_ping_check">
+<label class="check-field-label" for="new-smon-use_kernel_timestamp">Use kernel timestamp</label>
+<div class="check-field-control">
+		
+	
+	
+	<label for="new-smon-use_kernel_timestamp" title="" class="new-smon-use_kernel_timestamp" style="" data-help=""></label><input name="new-smon-use_kernel_timestamp" type="checkbox" id="new-smon-use_kernel_timestamp" value=""   />
+                <div class="tooltip" style="padding: 0">Use kernel timestamps for more accurate RTT measurements. More expensive.</div></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-expiration">Expiration date</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-expiration" value="" id="new-smon-expiration" data-help="" size="" style=""     placeholder="YYYY-MM-DD HH:MM" title="" class="form-control" autocomplete="off" />
+                <div class="tooltip" style="padding: 0">Time UTC</div></div>
+</div></div></details>
+        </section>
+        <section role="tabpanel" id="check-editor-step-2" aria-labelledby="check-editor-tab-2" data-step="2" hidden>
+            <h3>Notifications</h3><p class="field-help">Choose notification channels or leave them disabled. You can change these settings later.</p>
+            <div id="check-editor-summary" class="check-editor-summary" aria-live="polite"></div>
+            <div class="check-fields">
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-telegram">Telegram</label>
+<div class="check-field-control"><select id="new-smon-telegram">
+					<option value="0">Disabled</option>
+				
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-slack">Slack</label>
+<div class="check-field-control"><select id="new-smon-slack">
+					<option value="0">Disabled</option>
+				
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-pd">PagerDuty</label>
+<div class="check-field-control"><select id="new-smon-pd">
+					<option value="0">Disabled</option>
+				
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-mm">Mattermost</label>
+<div class="check-field-control"><select id="new-smon-mm">
+					<option value="0">Disabled</option>
+				
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-incidentrelay">IncidentRelay</label>
+<div class="check-field-control"><select id="new-smon-incidentrelay">
+					<option value="0">Disabled</option>
+				
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-email">Email</label>
+<div class="check-field-control"><select id="new-smon-email">
+					<option value="0">Disabled</option>
+				
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-priority">Priority</label>
+<div class="check-field-control"><select id="new-smon-priority">
+					<option value="info">Info</option>
+					<option value="warning">Warning</option>
+					<option value="error">Error</option>
+					<option value="critical" selected>Critical</option>
+				</select></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-runbook">Runbook</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-runbook" value="" id="new-smon-runbook" data-help="" size="" style=""     placeholder="https://wiki.example.com/runbook/help" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-group">Group</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-group" value="" id="new-smon-group" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field  check-field-wide">
+<label class="check-field-label" for="new-smon-description">Description</label>
+<div class="check-field-control">
+		
+	
+	
+    <input type="text" name="new-smon-description" value="" id="new-smon-description" data-help="" size="" style=""     placeholder="" title="" class="form-control" autocomplete="off" /></div>
+</div>
+<div class="check-field ">
+<label class="check-field-label" for="new-smon-enable">Enable</label>
+<div class="check-field-control">
+		
+	
+	
+	<label for="new-smon-enable" title="" class="new-smon-enable" style="" data-help=""></label><input name="new-smon-enable" type="checkbox" id="new-smon-enable" value="" checked  /></div>
+</div>
+            </div>
+        </section>
+    </form>
+</div>
+<div id="dialog-confirm" title="Are you sure you want to delete?" style="display: none;">
+  <p><span class="ui-icon ui-icon-alert" style="float:left; margin:3px 12px 20px 0;"></span>Deletion is irretrievable, all data will be lost</p>
+</div>
diff --git a/tests/frontend/package-lock.json b/tests/frontend/package-lock.json
new file mode 100644
index 0000000..c5e643d
--- /dev/null
+++ b/tests/frontend/package-lock.json
@@ -0,0 +1,543 @@
+{
+  "name": "rmon-frontend-tests",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "rmon-frontend-tests",
+      "devDependencies": {
+        "jsdom": "26.1.0"
+      }
+    },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
+      }
+    },
+    "node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/cssstyle": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
+      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^3.2.0",
+        "rrweb-cssom": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/data-urls": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
+      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/html-encoding-sniffer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
+      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-encoding": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/jsdom": {
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
+      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssstyle": "^4.2.1",
+        "data-urls": "^5.0.0",
+        "decimal.js": "^10.5.0",
+        "html-encoding-sniffer": "^4.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.16",
+        "parse5": "^7.2.1",
+        "rrweb-cssom": "^0.8.0",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^5.1.1",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^7.0.0",
+        "whatwg-encoding": "^3.1.1",
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.1.1",
+        "ws": "^8.18.0",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nwsapi": {
+      "version": "2.2.27",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.27.tgz",
+      "integrity": "sha512-gQPNF78qebCQ6tvVFBYrvJdBNOrYZm90ZlXgpIFm06p6qHDHq/XC4TnJftN6OMbxVE0UTBAoRgcsDeJBBooITw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/parse5": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/rrweb-cssom": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
+      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tldts": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
+      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^6.1.86"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
+      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tough-cookie": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
+      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^6.1.32"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    }
+  }
+}
diff --git a/tests/frontend/package.json b/tests/frontend/package.json
new file mode 100644
index 0000000..bc43b15
--- /dev/null
+++ b/tests/frontend/package.json
@@ -0,0 +1,6 @@
+{
+  "name": "rmon-frontend-tests",
+  "private": true,
+  "scripts": {"test": "node --test *.test.cjs"},
+  "devDependencies": {"jsdom": "26.1.0"}
+}
diff --git a/tests/frontend/user_preferences.test.cjs b/tests/frontend/user_preferences.test.cjs
new file mode 100644
index 0000000..32fbb16
--- /dev/null
+++ b/tests/frontend/user_preferences.test.cjs
@@ -0,0 +1,40 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const {JSDOM, VirtualConsole} = require('jsdom');
+
+const scripts = path.resolve(__dirname, '../../app/static/js');
+
+for (const protocol of ['http', 'https']) {
+    test(`shared UI and user preferences work without browser notification services over ${protocol}`, async t => {
+        const errors = [];
+        const output = new VirtualConsole();
+        output.on('jsdomError', error => errors.push(error));
+        const dom = new JSDOM('<!doctype html><body><div id="translate"></div>' +
+            '<select id="theme_select"><option value="dark" selected>Dark</option></select>' +
+            '<select id="lang_select"><option value="ru" selected>Russian</option></select></body>',
+            {url: `${protocol}://rmon.test/overview`, runScripts: 'outside-only', pretendToBeVisual: true, virtualConsole: output});
+        t.after(() => dom.window.close());
+        const w = dom.window;
+        w.csrf_token = 'test-only-csrf';
+        w.matchMedia = () => ({matches: false, addEventListener() {}});
+        w.WebSocket = function () { throw new Error('Unexpected WebSocket connection'); };
+        for (const file of ['jquery-3.6.0.min.js', 'jquery-ui.min.js', 'js.cookie.min.js',
+            'select2.js', 'element.js', 'variables.js', 'nprogress.js', 'toastr.js', 'ux.js']) {
+            w.eval(fs.readFileSync(path.join(scripts, file), 'utf8'));
+        }
+        w.jQuery.ajax = () => w.jQuery.Deferred().resolve().promise();
+        w.jQuery.getScript = () => w.jQuery.Deferred().resolve().promise();
+        w.eval(fs.readFileSync(path.join(scripts, 'script.js'), 'utf8'));
+        await new Promise(resolve => w.jQuery(resolve));
+        assert.deepEqual(errors, []);
+        const groups = [];
+        w.changeCurrentGroupF = user => groups.push(user);
+        w.saveUserSettings(7);
+        assert.deepEqual(groups, [7]);
+        assert.equal(w.localStorage.getItem('theme'), 'dark');
+        if (protocol === 'https') assert.equal(w.Cookies.get('lang'), 'ru');
+        assert.equal(w.document.querySelectorAll('link[href="/static/css/dark.css"]').length, 1);
+    });
+}
diff --git a/tests/frontend/ux.test.cjs b/tests/frontend/ux.test.cjs
new file mode 100644
index 0000000..72b5d26
--- /dev/null
+++ b/tests/frontend/ux.test.cjs
@@ -0,0 +1,209 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const {JSDOM} = require('jsdom');
+
+const scripts = path.resolve(__dirname, '../../app/static/js');
+const messages = {network_error: 'Offline', server_error: 'Try later', unauthorized: 'Sign in',
+    forbidden: 'No access', validation_error: 'Check fields', not_found: 'Not found',
+    conflict: 'Conflict', rate_limit: 'Wait', request_error: 'Request failed',
+    loading: 'Loading', widget_error: 'Unavailable', retry: 'Retry', table_label: 'Data', action: 'Action'};
+
+async function page(t, html = '', mobile = false) {
+    const dom = new JSDOM(`<!doctype html><body><script id="rmon-ui-strings" type="application/json">${JSON.stringify(messages)}</script>${html}</body>`,
+        {url: 'http://rmon.test', runScripts: 'outside-only', pretendToBeVisual: true});
+    t.after(() => dom.window.close());
+    const w = dom.window;
+    const media = {matches: mobile, addEventListener: (_, fn) => {media.change = fn;}};
+    w.matchMedia = () => media;
+    w.toastr = {error: () => {}, clear: () => {}};
+    for (const file of ['jquery-3.6.0.min.js', 'jquery-ui.min.js', 'ux.js']) {
+        w.eval(fs.readFileSync(path.join(scripts, file), 'utf8'));
+    }
+    w.jQuery.fx.off = true;
+    await new Promise(resolve => w.jQuery(resolve));
+    return {w, $: w.jQuery, ui: w.RmonUI, media};
+}
+
+test('request errors are localized and do not display backend HTML or tracebacks', async t => {
+    const {ui} = await page(t);
+    for (const [status, key] of [[0,'network_error'],[400,'validation_error'],[401,'unauthorized'],
+        [403,'forbidden'],[404,'not_found'],[409,'conflict'],[422,'validation_error'],
+        [429,'rate_limit'],[500,'server_error'],[503,'server_error'],[418,'request_error']]) {
+        assert.equal(ui.requestError({status, responseJSON: {error: '<script>private traceback</script>'}}), messages[key]);
+    }
+});
+
+test('failed overview fragment offers retry and restores content when retry succeeds', async t => {
+    const {ui, $} = await page(t, '<table><tbody id="widget"></tbody></table>');
+    const requests = [];
+    $.ajax = options => { requests.push(options); options.beforeSend(); };
+    ui.loadFragment('#widget', '/overview/users');
+    assert.equal($('#widget').attr('aria-busy'), 'true');
+    assert.equal(requests[0].global, false);
+    requests[0].error({status: 500});
+    assert.equal($('#widget').attr('aria-busy'), 'false');
+    assert.equal($('#widget button').text(), 'Retry');
+    $('#widget button').trigger('click');
+    assert.equal(requests.length, 2);
+    requests[1].success('<tr><td>Alice</td></tr>');
+    assert.equal($('#widget').text(), 'Alice');
+    assert.equal($('#widget').attr('aria-busy'), 'false');
+    assert.equal($('#widget button').length, 0);
+});
+
+test('legacy error text is replaced and absent role-specific widgets make no requests', async t => {
+    const {ui, $} = await page(t, '<table id="widget"></table>');
+    let request;
+    $.ajax = options => {request = options; options.beforeSend();};
+    ui.loadFragment('#missing', '/private');
+    assert.equal(request, undefined);
+    ui.loadFragment('#widget', '/overview/logs');
+    request.success('error: secret backend traceback');
+    assert.equal($('#widget').text(), 'UnavailableRetry');
+});
+
+test('chart loading and error states do not accumulate and ready restores canvas', async t => {
+    const {ui, $} = await page(t, '<div id="chart"><canvas></canvas></div>');
+    ui.widgetState('#chart', 'loading');
+    ui.widgetState('#chart', 'loading');
+    assert.equal($('#chart .widget-state').length, 1);
+    assert.equal($('#chart canvas').css('display'), 'none');
+    ui.widgetState('#chart', 'error', () => {});
+    ui.widgetState('#chart', 'ready');
+    assert.equal($('#chart .widget-state').length, 0);
+    assert.notEqual($('#chart canvas').css('display'), 'none');
+});
+
+const navigation = '<aside id="main-navigation"><a href="/overview">Overview</a><a href="/admin">Admin</a></aside>' +
+    '<button id="menu-toggle"></button><button id="menu-backdrop" hidden></button>';
+
+test('mobile menu opens, closes on Escape and restores focus to toggle', async t => {
+    const {ui, w, $} = await page(t, navigation, true);
+    ui.initNavigation();
+    assert.equal($('#menu-toggle').attr('aria-expanded'), 'false');
+    assert.equal(w.document.getElementById('main-navigation').inert, true);
+    $('#menu-toggle')[0].click();
+    assert.equal($('#menu-toggle').attr('aria-expanded'), 'true');
+    assert.equal($('#menu-backdrop')[0].hidden, false);
+    assert.equal(w.document.activeElement.textContent, 'Overview');
+    w.document.dispatchEvent(new w.KeyboardEvent('keydown', {key: 'Escape'}));
+    assert.equal($('#menu-toggle').attr('aria-expanded'), 'false');
+    assert.equal(w.document.activeElement.id, 'menu-toggle');
+});
+
+test('desktop menu preference survives resize while mobile starts collapsed', async t => {
+    const {ui, w, $, media} = await page(t, navigation);
+    ui.initNavigation();
+    $('#menu-toggle')[0].click();
+    assert.equal(w.sessionStorage.getItem('hide_menu'), 'hide');
+    assert.ok(w.document.body.classList.contains('nav-collapsed'));
+    media.matches = true; media.change();
+    assert.equal($('#menu-toggle').attr('aria-expanded'), 'false');
+    media.matches = false; media.change();
+    assert.ok(w.document.body.classList.contains('nav-collapsed'));
+});
+
+test('legacy action controls support keyboard activation without duplicate activation', async t => {
+    const {w, $} = await page(t, '<span id="action" onclick="" title="Edit"></span>');
+    let clicks = 0;
+    $('#action').on('click', () => clicks++);
+    assert.equal($('#action').attr('role'), 'button');
+    assert.equal($('#action').attr('aria-label'), 'Edit');
+    $('#action')[0].dispatchEvent(new w.KeyboardEvent('keydown', {key: 'Enter', bubbles: true}));
+    assert.equal(clicks, 1);
+});
+
+test('enhancement keeps a single scroll region when a table plugin inserts a wrapper', async t => {
+    const {w, ui} = await page(t, '<main class="container"><div class="table-scroll"><div class="dataTables_wrapper"><table class="overview"></table></div></div></main>');
+    w.document.querySelector('table').getClientRects = () => [{width: 600, height: 400}];
+    ui.enhance(w.document);
+    ui.enhance(w.document);
+    assert.equal(w.document.querySelectorAll('.table-scroll').length, 1);
+});
+
+test('empty checkbox labels and custom comboboxes get meaningful field names', async t => {
+    const {w, ui, $} = await page(t, '<table><tr><td>Enabled</td><td><label for="enabled"></label><input type="checkbox" id="enabled"></td>' +
+        '<td>Accept cookies</td><td><label for="cookies"></label><input type="checkbox" id="cookies"></td></tr>' +
+        '<tr><td>Protocol</td><td><select id="protocol"><option>HTTP</option></select></td></tr></table>');
+    $('#protocol').selectmenu();
+    ui.enhance(w.document);
+    assert.equal($('#enabled').attr('aria-label'), 'Enabled');
+    assert.equal($('#cookies').attr('aria-label'), 'Accept cookies');
+    assert.equal($('#protocol-button').attr('aria-label'), 'Protocol');
+});
+
+test('mobile menu traps Tab and closes when a destination is chosen', async t => {
+    const {w, ui, $} = await page(t, navigation, true);
+    for (const link of w.document.querySelectorAll('aside a')) link.getClientRects = () => [{width: 100, height: 44}];
+    ui.initNavigation();
+    $('#menu-toggle')[0].click();
+    w.document.dispatchEvent(new w.KeyboardEvent('keydown', {key: 'Tab', shiftKey: true}));
+    assert.equal(w.document.activeElement.id, 'menu-toggle');
+    w.document.dispatchEvent(new w.KeyboardEvent('keydown', {key: 'Tab', shiftKey: true}));
+    assert.equal(w.document.activeElement.textContent, 'Admin');
+    // Suppress navigation: this test verifies only the menu's click handler.
+    $('aside a').on('click', event => event.preventDefault()).last()[0].click();
+    assert.equal($('#menu-toggle').attr('aria-expanded'), 'false');
+    assert.equal($('#menu-backdrop')[0].hidden, true);
+});
+
+test('dialog keeps viewport constraints after animation restores inline styles', async t => {
+    const {w, $} = await page(t, '<div id="editor">Fields</div>');
+    w.innerWidth = 390;
+    $('#editor').dialog({width: 1225, autoOpen: false});
+    const dialog = $('#editor').dialog('widget');
+    // jsdom has no layout engine; expose the visible box used by jQuery's positioning code.
+    dialog[0].getClientRects = () => [{width: 366, height: 400}];
+    $('#editor').dialog('open');
+    assert.equal(dialog[0].style.width, '366px');
+    dialog.attr('style', 'position: absolute; display: block; width: 1225px');
+    $('#editor').trigger('dialogfocus');
+    assert.equal(dialog[0].style.width, '366px');
+    assert.equal(dialog[0].style.position, 'fixed');
+    assert.equal(dialog[0].style.display, 'flex');
+    assert.equal($('#editor')[0].style.overflow, 'auto');
+});
+
+async function statusEditor(t) {
+    const context = await page(t, '<div id="translate" data-next="Next"></div>' +
+        '<div id="create-status-page-step-1"><table id="create-status-page-step-1-overview" title="New"></table>' +
+        '<input id="new-status-page-name"><input id="new-status-page-slug">' +
+        '<p id="status-page-url-preview" data-prefix="/rmon/status/"></p></div>' +
+        '<div id="create-status-page-step-2"><table id="create-status-page-step-2-overview" title="New"></table>' +
+        '<input id="new-status-page-desc"><textarea id="new-status-page-style"></textarea></div>' +
+        '<div id="enabled-check"></div><div id="all-checks"></div>');
+    Object.assign(context.w, {clearTips: () => {}, cancel_word: 'Cancel', back_word: 'Back', add_word: 'Add'});
+    context.w.eval(fs.readFileSync(path.join(scripts, 'rmon/status_page.js'), 'utf8'));
+    await new Promise(resolve => context.$(resolve));
+    return context;
+}
+
+test('status page slug is suggested, preview is correct and manual URL is preserved', async t => {
+    const {w, $} = await statusEditor(t);
+    w.createStatusPageStep1();
+    $('#new-status-page-name').val('API Health').trigger('input');
+    assert.equal($('#new-status-page-slug').val(), 'api-health');
+    assert.equal($('#status-page-url-preview').text(), 'http://rmon.test/rmon/status/api-health');
+    $('#new-status-page-slug').val('public-api').trigger('input');
+    $('#new-status-page-name').val('Renamed').trigger('input');
+    assert.equal($('#new-status-page-slug').val(), 'public-api');
+});
+
+test('status page Back preserves draft and Cancel resets it for a new page', async t => {
+    const {w, $} = await statusEditor(t);
+    w.createStatusPageStep1();
+    $('#new-status-page-name').val('API Health').trigger('input');
+    $('#create-status-page-step-1').dialog('option', 'buttons')[0].click.call($('#create-status-page-step-1')[0]);
+    $('#new-status-page-desc').val('Public description');
+    $('#create-status-page-step-2').dialog('option', 'buttons')[1].click.call($('#create-status-page-step-2')[0]);
+    assert.equal($('#new-status-page-name').val(), 'API Health');
+    assert.equal($('#new-status-page-slug').val(), 'api-health');
+    assert.equal($('#new-status-page-desc').val(), 'Public description');
+    $('#create-status-page-step-1').dialog('option', 'buttons')[1].click.call($('#create-status-page-step-1')[0]);
+    w.createStatusPageStep1();
+    assert.equal($('#new-status-page-name').val(), '');
+    assert.equal($('#new-status-page-desc').val(), '');
+    assert.equal($('#new-status-page-slug').data('manually-edited'), false);
+});
diff --git a/tests/functional/test_agent_group_transport.py b/tests/functional/test_agent_group_transport.py
new file mode 100644
index 0000000..ac69d72
--- /dev/null
+++ b/tests/functional/test_agent_group_transport.py
@@ -0,0 +1,229 @@
+import configparser
+import importlib.util
+from pathlib import Path
+from types import SimpleNamespace
+import uuid
+from unittest.mock import Mock
+from flask import g, render_template_string
+
+import pytest
+from peewee import SqliteDatabase
+from playhouse.migrate import SqliteMigrator
+
+from app.modules.common import agent_transport as transport
+from app.modules.db import group as group_sql
+from app.modules.db.db_model import Groups, Setting, Server, SmonAgent, InstallationTasks
+from app.modules.roxywi.class_models import RmonAgent
+from app.modules.service import installation
+from app.modules.tools import smon_agent
+
+
+@pytest.fixture
+def owned_agent(tmp_path, monkeypatch):
+    group = Groups.create(name=uuid.uuid4().hex, description='Transport test')
+    group_sql.add_setting_for_new_group(group.group_id)
+    server = Server.create(hostname='transport-test', ip=f'{uuid.uuid4().hex}.test', group_id=group.group_id)
+    agent = SmonAgent.create(server_id=server, name='Transport test', uuid=str(uuid.uuid4()), description='')
+    monkeypatch.setenv('RMON_AGENT_CERTIFICATES_DIR', str(tmp_path / 'certificates'))
+    config = configparser.ConfigParser()
+    config['agent_deployment'] = {'mtls_enabled': 'true', 'tls_ca_file': '/another-group/ca.crt'}
+    monkeypatch.setattr(smon_agent, 'GetConfigVar', lambda: SimpleNamespace(config=config))
+    get_setting = smon_agent.sql.get_setting
+    receiver_settings = {'master_ip': 'receiver.test', 'master_port': '5100'}
+    monkeypatch.setattr(smon_agent.sql, 'get_setting', lambda key, **kwargs:
+                        receiver_settings[key] if key in receiver_settings else get_setting(key, **kwargs))
+    yield agent
+    InstallationTasks.delete().where(InstallationTasks.server_id == server).execute()
+    SmonAgent.delete().where(SmonAgent.server_id == server).execute()
+    server.delete_instance()
+    group_sql.delete_group(group.group_id)
+
+
+def set_value(agent, key, value):
+    Setting.update(value=value).where((Setting.group_id == agent.server_id.group_id) & (Setting.param == key)).execute()
+
+
+def test_new_groups_have_independent_settings(owned_agent):
+    values = transport.group_settings(owned_agent.server_id.group_id)
+    assert values == transport.DEFAULTS
+    set_value(owned_agent, 'agent_result_transport', 'mtls')
+    assert transport.group_settings(1)['agent_result_transport'] == 'http'
+
+
+def test_explicit_group_mtls_paths_reach_role(owned_agent):
+    group_id = owned_agent.server_id.group_id
+    root = transport.certificate_root(group_id)
+    root.mkdir(parents=True)
+    for name, key in [('ca.crt', 'agent_tls_ca_file'), ('ca.key', 'agent_tls_ca_key_file')]:
+        path = root / name
+        path.write_text('test file; real PEM validation is done by the role')
+        set_value(owned_agent, key, path.as_posix())
+    inv, _ = smon_agent.generate_agent_inv('host.test', 'install', owned_agent.uuid,
+                                          group_id=group_id, result_transport='mtls')
+    settings = inv['server']['hosts']['host.test']
+    assert settings['agent_transport'] == 'mtls'
+    assert settings['agent_tls_ca_file'] == (root / 'ca.crt').as_posix()
+    assert settings['agent_tls_ca_key_file'] == (root / 'ca.key').as_posix()
+    assert settings['agent_certificate_directory'] == root.as_posix()
+    assert settings['agent_verify_result_connection'] is True
+
+
+@pytest.mark.parametrize('value', ['../other/ca.key', '/etc/passwd', '/var/lib/rmon/keys/agent-certificates/1/ca.key', '{{ secret }}', '/tmp/a\nkey'])
+def test_certificate_paths_cannot_escape_the_group(owned_agent, value):
+    with pytest.raises(ValueError):
+        transport.validate_setting('agent_tls_ca_key_file', value, owned_agent.server_id.group_id)
+
+
+def test_uuid_template_uses_persisted_agent_identity(owned_agent):
+    group_id = owned_agent.server_id.group_id
+    root = transport.certificate_root(group_id)
+    path = root / '{uuid}' / 'client.pem'
+    assert transport.certificate_path(path.as_posix(), group_id, owned_agent.uuid) == (
+        root / owned_agent.uuid / 'client.pem').as_posix()
+    with pytest.raises(ValueError, match='CA path'):
+        transport.validate_setting('agent_tls_ca_file', path.as_posix(), group_id)
+
+
+def test_missing_file_is_rejected_before_launch(owned_agent):
+    group_id = owned_agent.server_id.group_id
+    set_value(owned_agent, 'agent_tls_ca_file', (transport.certificate_root(group_id) / 'missing.pem').as_posix())
+    with pytest.raises(ValueError, match='missing'):
+        transport.inventory_settings(group_id, owned_agent.uuid, 'https')
+
+
+def test_legacy_reconfigure_preserves_transport(owned_agent, monkeypatch):
+    run = Mock(return_value=42)
+    monkeypatch.setattr(smon_agent, 'run_ansible_thread', run)
+    smon_agent.reconfigure_agent(owned_agent.id)
+    host = run.call_args.args[0]['server']['hosts'][owned_agent.server_id.ip]
+    assert 'agent_transport' not in host
+    assert 'agent_tls_ca_file' not in host
+
+
+def test_save_does_not_apply_and_success_records_selected_mode(owned_agent, monkeypatch):
+    run = Mock(return_value=42)
+    monkeypatch.setattr(smon_agent, 'run_ansible_thread', run)
+    body = RmonAgent(name=owned_agent.name, server_id=owned_agent.server_id_id, result_transport='https')
+    smon_agent.update_agent(owned_agent.id, body)
+    run.assert_not_called()
+    agent = SmonAgent.get_by_id(owned_agent.id)
+    assert agent.result_transport == 'https' and transport.pending(agent)
+    smon_agent.reconfigure_agent(agent.id)
+    inv = run.call_args.args[0]
+    transport.record_applied(inv)
+    agent = SmonAgent.get_by_id(agent.id)
+    assert agent.applied_result_transport == 'https' and agent.transport_checked_at is not None
+    assert not transport.pending(agent)
+    set_value(agent, 'agent_tls_ca_file', (transport.certificate_root(agent.server_id.group_id) / 'new-ca.pem').as_posix())
+    assert transport.pending(agent)
+
+
+def test_failed_task_does_not_claim_new_transport(owned_agent, monkeypatch):
+    owned_agent.applied_result_transport = 'http'
+    owned_agent.result_transport = 'https'
+    owned_agent.save()
+    task = InstallationTasks.create(service_name='Agent', server_id=owned_agent.server_id,
+                                    user_id=1, group_id=owned_agent.server_id.group_id, action='reconfigure')
+    inv, hosts = smon_agent.generate_agent_inv(owned_agent.server_id.ip, 'install', owned_agent.uuid,
+        group_id=owned_agent.server_id.group_id, result_transport='https')
+    monkeypatch.setattr(installation, 'run_ansible', Mock(return_value={'failures': {'host': 1}, 'dark': {}}))
+    installation.run_installations(inv, hosts, 'rmon_agent', task.id)
+    assert SmonAgent.get_by_id(owned_agent.id).applied_result_transport == 'http'
+    assert InstallationTasks.get_by_id(task.id).status == 'failed'
+
+
+def test_successful_task_records_the_verified_mode(owned_agent, monkeypatch):
+    task = InstallationTasks.create(service_name='Agent', server_id=owned_agent.server_id,
+                                    user_id=1, group_id=owned_agent.server_id.group_id, action='reconfigure')
+    inv, hosts = smon_agent.generate_agent_inv(owned_agent.server_id.ip, 'install', owned_agent.uuid,
+        group_id=owned_agent.server_id.group_id, result_transport='https')
+    monkeypatch.setattr(installation, 'run_ansible', Mock(return_value={'failures': {}, 'dark': {}}))
+    installation.run_installations(inv, hosts, 'rmon_agent', task.id)
+    assert InstallationTasks.get_by_id(task.id).status == 'completed'
+    agent = SmonAgent.get_by_id(owned_agent.id)
+    assert agent.applied_result_transport == 'https'
+    assert agent.transport_checked_at is not None
+
+
+def test_agent_exists_before_background_installation(owned_agent, monkeypatch):
+    owned_agent.delete_instance()
+    set_value(owned_agent, 'agent_result_transport', 'https')
+    monkeypatch.setattr(smon_agent, 'check_agent_limit', lambda: None)
+    monkeypatch.setattr(smon_agent.roxywi_common, 'logger', Mock())
+    def run(inv, *args):
+        transport.record_applied(inv)
+        return 42
+    monkeypatch.setattr(smon_agent, 'run_ansible_thread', run)
+    agent_id, task_id = smon_agent.add_agent(RmonAgent(name='New agent', server_id=owned_agent.server_id_id))
+    agent = SmonAgent.get_by_id(agent_id)
+    assert task_id == 42 and agent.result_transport == 'https'
+    assert agent.applied_result_transport == 'https'
+
+
+def test_group_settings_api_validates_paths(client, auth_headers, owned_agent):
+    response = client.post('/api/v1.0/settings/agent', json={'param': 'agent_tls_ca_file', 'value': '/etc/passwd'}, headers=auth_headers(1, 1))
+    assert response.status_code == 400
+    assert transport.group_settings(1)['agent_tls_ca_file'] == ''
+
+
+def test_settings_api_returns_only_requested_group_section(client, auth_headers, owned_agent):
+    group_id = owned_agent.server_id.group_id
+    set_value(owned_agent, 'agent_result_transport', 'mtls')
+    response = client.get(f'/api/v1.0/settings/agent?group_id={group_id}', headers=auth_headers(1, 1))
+    assert response.status_code == 200
+    assert {row['param'] for row in response.json} == set(transport.DEFAULTS)
+    assert all(int(row['group_id']) == group_id for row in response.json)
+    assert next(row['value'] for row in response.json if row['param'] == 'agent_result_transport') == 'mtls'
+
+
+def test_other_group_cannot_change_transport_settings(client, auth_headers, owned_agent):
+    group_id = owned_agent.server_id.group_id
+    response = client.post(f'/api/v1.0/settings/agent?group_id={group_id}',
+                           json={'param': 'agent_result_transport', 'value': 'mtls'}, headers=auth_headers(2, 1))
+    assert response.status_code == 404
+    assert transport.group_settings(group_id)['agent_result_transport'] == 'http'
+
+
+def test_transport_defaults_and_agent_status_api(client, auth_headers, owned_agent):
+    response = client.get('/rmon/agent/transport-settings', headers=auth_headers(1, 1))
+    assert response.status_code == 200 and response.json == {'result_transport': 'http'}
+    response = client.get(f'/api/v1.0/rmon/agent/{owned_agent.id}', headers=auth_headers(1, 1))
+    assert response.status_code == 200
+    assert response.json['applied_result_transport'] is None
+    assert 'uuid' not in response.json and 'transport_settings_hash' not in response.json
+
+
+def test_migration_is_repeatable_and_preserves_legacy_agents(owned_agent, monkeypatch):
+    path = Path(__file__).resolve().parents[2] / 'app/migrations/20260911000000_add_agent_result_transport.py'
+    spec = importlib.util.spec_from_file_location('agent_transport_migration', path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    db = SqliteDatabase(':memory:')
+    db.execute_sql('CREATE TABLE smon_agents (id INTEGER PRIMARY KEY, uuid TEXT, port INTEGER)')
+    db.execute_sql("INSERT INTO smon_agents VALUES (1, 'keep-uuid', 5101)")
+    monkeypatch.setattr(module, 'connect', lambda get_migrator=False: SqliteMigrator(db) if get_migrator else db)
+    module.upgrade()
+    module.upgrade()
+    row = db.execute_sql('SELECT uuid, port, result_transport, applied_result_transport FROM smon_agents').fetchone()
+    assert row == ('keep-uuid', 5101, None, None)
+    db.close()
+
+
+@pytest.mark.parametrize('language', ['en', 'ru', 'fr', 'pt-br'])
+def test_group_connection_controls_render(app, owned_agent, language):
+    with app.test_request_context('/'):
+        g.user_params = {'role': 2}
+        markup = render_template_string(
+            "{% import 'languages/' + language + '.html' as lang %}"
+            "{% from 'include/input_macros.html' import input, checkbox %}"
+            "{% include 'include/admin_settings.html' %}"
+            "{% include 'include/agent_transport.html' %}",
+            language=language,
+            settings=Setting.select().where(Setting.group_id == owned_agent.server_id.group_id),
+            agent_certificate_root=transport.certificate_root(owned_agent.server_id.group_id),
+            timezones=['UTC'],
+        )
+        assert 'id="new-agent-result-transport"' in markup
+        assert 'id="agent_tls_ca_file"' in markup
+        assert 'HTTPS + mTLS' in markup
+        assert 'Undefined' not in markup
diff --git a/tests/functional/test_agent_health_and_control.py b/tests/functional/test_agent_health_and_control.py
new file mode 100644
index 0000000..b3fb6df
--- /dev/null
+++ b/tests/functional/test_agent_health_and_control.py
@@ -0,0 +1,184 @@
+import json
+import uuid
+from types import SimpleNamespace
+from unittest.mock import Mock
+
+import pytest
+import requests
+
+import app.modules.tools.smon_agent as agents
+import app.routes.smon.agent_routes as routes
+import app.modules.roxywi.overview as overview
+from app.modules.server.ssh_connection import SshConnection
+from app.modules.db.db_model import Server, SmonAgent, InstallationTasks
+from app.modules.service import installation
+from app.modules.roxywi.class_models import RmonAgent
+
+
+@pytest.mark.parametrize('description', [{}, {'description': None}, {'description': ''}])
+def test_agent_creation_accepts_empty_description(agent, description):
+    data = RmonAgent(name='Empty description', server_id=agent.server_id.server_id, **description)
+    row = SmonAgent.create(**data.model_dump(exclude={'reconfigure', 'uuid'}), uuid=str(uuid.uuid4()))
+    try:
+        assert row.description == ''
+    finally:
+        row.delete_instance()
+
+
+def test_failed_installation_is_recorded_without_a_request_context(agent, monkeypatch):
+    task = InstallationTasks.create(service_name='Agent', server_id=agent.server_id, user_id=1,
+                                    group_id=1, action='install')
+    monkeypatch.setattr(installation, 'run_ansible', Mock(side_effect=RuntimeError('Deployment failed')))
+    monkeypatch.setattr(installation.roxywi_common, 'logger', Mock(side_effect=AssertionError('Requires HTTP request')))
+    try:
+        installation.run_installations({}, [agent.server_id.ip], 'rmon_agent', task.id)
+        result = InstallationTasks.get_by_id(task.id)
+        assert result.status == 'failed'
+        assert result.error == 'Deployment failed'
+        assert result.finish_date is not None
+    finally:
+        task.delete_instance()
+
+
+@pytest.fixture
+def agent():
+    server = Server.create(hostname='health-test', ip=f'{uuid.uuid4().hex}.test', group_id='1')
+    row = SmonAgent.create(server_id=server, name='Health test', uuid=str(uuid.uuid4()), description='', port=5101)
+    yield row
+    row.delete_instance()
+    server.delete_instance()
+
+
+@pytest.mark.parametrize('running', [True, False])
+def test_health_uses_dedicated_probe(monkeypatch, running):
+    get = Mock(return_value=json.dumps({'status': 'ok', 'running': running}).encode())
+    monkeypatch.setattr(agents, 'send_get_request_to_agent', get)
+    assert agents.get_agent_health(7, '192.0.2.10')['running'] is running
+    get.assert_called_once_with(7, '192.0.2.10', 'health')
+
+
+def http_error(status):
+    response = requests.Response()
+    response.status_code = status
+    return requests.HTTPError(response=response)
+
+
+def test_old_agent_can_use_scheduler_status(monkeypatch):
+    get = Mock(side_effect=[http_error(404), b'{"running": true}'])
+    monkeypatch.setattr(agents, 'send_get_request_to_agent', get)
+    assert agents.get_agent_health(7, 'host') == {'running': True}
+    assert [call.args[2] for call in get.call_args_list] == ['health', 'scheduler']
+
+
+@pytest.mark.parametrize('status', [401, 403, 500])
+def test_health_does_not_hide_auth_or_server_errors(monkeypatch, status):
+    get = Mock(side_effect=http_error(status))
+    monkeypatch.setattr(agents, 'send_get_request_to_agent', get)
+    with pytest.raises(requests.HTTPError):
+        agents.get_agent_health(7, 'host')
+    assert get.call_count == 1
+
+
+@pytest.mark.parametrize('payload', [b'<!doctype html>', b'{}', b'[]', b'{"running":"true"}'])
+def test_health_rejects_invalid_responses(monkeypatch, payload):
+    monkeypatch.setattr(agents, 'send_get_request_to_agent', Mock(return_value=payload))
+    with pytest.raises(ValueError):
+        agents.get_agent_health(7, 'host')
+
+
+@pytest.mark.parametrize('status', [200, 404, 500])
+def test_agent_transport_checks_http_status_and_closes(monkeypatch, status):
+    response = Mock(content=b'ok')
+    if status != 200:
+        response.raise_for_status.side_effect = http_error(status)
+    monkeypatch.setattr(agents.requests, 'get', Mock(return_value=response))
+    monkeypatch.setattr(agents, 'get_agent_headers', lambda _: {})
+    monkeypatch.setattr(agents.smon_sql, 'get_agent_data', lambda _: SimpleNamespace(port=5101))
+    monkeypatch.setattr(agents.smon_sql, 'get_agent_ip_by_id', lambda _: '127.0.0.1')
+    if status == 200:
+        assert agents.send_get_request_to_agent(1, 'host', 'health') == b'ok'
+    else:
+        with pytest.raises(requests.HTTPError):
+            agents.send_get_request_to_agent(1, 'host', 'health')
+    response.raise_for_status.assert_called_once()
+    response.close.assert_called_once()
+
+
+@pytest.mark.parametrize('endpoint,payload,expected', [
+    ('status', b'{"running":true}', {'running': True}),
+    ('uptime', b'{"uptime":"2026-09-07 06:00:00"}', {'uptime': '2026-09-07 06:00:00'}),
+    ('checks', b'0', 0),
+    ('version', b'{"version":"1.20"}', {'version': '1.20'}),
+])
+def test_agent_probes_return_json(client, auth_headers, agent, monkeypatch, endpoint, payload, expected):
+    monkeypatch.setattr(agents, 'send_get_request_to_agent', Mock(return_value=payload))
+    response = client.get(f'/rmon/agent/{endpoint}/{agent.server_id.ip}?agent_id={agent.id}', headers=auth_headers(1, 1))
+    assert response.status_code == 200
+    assert response.is_json
+    assert response.get_json() == expected
+
+
+@pytest.mark.parametrize('endpoint', ['status', 'uptime', 'checks', 'version'])
+def test_html_upstream_is_json_failure_not_success(client, auth_headers, agent, monkeypatch, endpoint):
+    monkeypatch.setattr(agents, 'send_get_request_to_agent', Mock(return_value=b'<!doctype html><h1>404</h1>'))
+    response = client.get(f'/rmon/agent/{endpoint}/{agent.server_id.ip}?agent_id={agent.id}', headers=auth_headers(1, 1))
+    assert response.status_code == 502
+    assert response.is_json and 'error' in response.get_json()
+    assert '<!doctype' not in response.get_data(as_text=True)
+
+
+@pytest.mark.parametrize('action', ['start', 'stop', 'restart'])
+@pytest.mark.parametrize('loopback', [True, False])
+def test_service_actions_always_use_ssh(client, auth_headers, agent, monkeypatch, action, loopback):
+    if loopback:
+        agent.server_id.ip = '127.0.0.1'
+        agent.server_id.save()
+    run = Mock(return_value=42)
+    monkeypatch.setattr(agents, 'run_ansible_thread', run)
+    response = client.post(f'/rmon/agent/action/{action}', data={'agent_id': agent.id}, headers=auth_headers(1, 1))
+    assert response.status_code == 202 and response.get_json() == {'status': 'queued', 'task_id': 42}
+    run.assert_called_once_with(
+        {'server': {'hosts': {agent.server_id.ip: {'action': action, 'agent_uuid': str(agent.uuid)}}}},
+        [agent.server_id.ip], 'rmon_agent', 'Agent', action)
+
+
+def test_service_ssh_errors_have_json_failure_status(client, auth_headers, agent, monkeypatch):
+    monkeypatch.setattr(agents, 'run_ansible_thread', Mock(side_effect=ValueError('SSH credentials are not configured for this server')))
+    response = client.post('/rmon/agent/action/start', data={'agent_id': agent.id}, headers=auth_headers(1, 1))
+    assert response.status_code == 502
+    assert 'SSH credentials' in response.get_json()['error']
+
+
+def test_missing_ssh_credentials_are_not_a_key_error():
+    with pytest.raises(ValueError, match='SSH credentials are not configured'):
+        SshConnection('127.0.0.1', {'port': 22})
+
+
+def test_probes_and_actions_enforce_agent_access(client, auth_headers, agent, monkeypatch):
+    request = Mock()
+    ssh = Mock()
+    monkeypatch.setattr(agents, 'send_get_request_to_agent', request)
+    monkeypatch.setattr(agents, 'run_ansible_thread', ssh)
+    response = client.get(f'/rmon/agent/status/another.test?agent_id={agent.id}', headers=auth_headers(1, 1))
+    assert response.status_code == 403
+    response = client.post('/rmon/agent/action/start', data={'agent_id': agent.id}, headers=auth_headers(3, 1))
+    assert response.status_code == 403
+    request.assert_not_called()
+    ssh.assert_not_called()
+
+
+@pytest.mark.parametrize('available', [True, False])
+def test_overview_uses_same_health_probe(monkeypatch, available):
+    monkeypatch.setattr(overview.roxywi_common, 'get_jwt_token_claims', lambda: {'user_id': 1, 'group': '1'})
+    monkeypatch.setattr(overview.roxywi_common, 'get_user_lang_for_flask', lambda: 'en')
+    monkeypatch.setattr(overview.user_sql, 'get_role_id', lambda *_: 1)
+    monkeypatch.setattr(overview.server_sql, 'get_server_by_ip', lambda _: SimpleNamespace(hostname='agent'))
+    monkeypatch.setattr(overview.smon_sql, 'get_agent_id_by_ip', lambda _: 7)
+    probe = Mock(return_value={'running': True})
+    if not available:
+        probe.side_effect = requests.ConnectionError()
+    monkeypatch.setattr(agents, 'get_agent_health', probe)
+    monkeypatch.setattr(overview, 'render_template', lambda _, **kwargs: kwargs)
+    context = overview.show_overview('127.0.0.1')
+    probe.assert_called_once_with(7, '127.0.0.1')
+    assert context['service_status'][3]['running'] is available
diff --git a/tests/functional/test_authentication_workflow.py b/tests/functional/test_authentication_workflow.py
index 91800ec..eeee5fb 100644
--- a/tests/functional/test_authentication_workflow.py
+++ b/tests/functional/test_authentication_workflow.py
@@ -51,13 +51,26 @@ def test_web_login_sets_cookie_and_rejects_external_next_url(client, monkeypatch
     )
 
     assert response.status_code == 200
-    assert response.get_json()['next_url'] == 'https://localhost/overview'
+    assert response.get_json()['next_url'] == '/overview'
     assert 'access_token_cookie=' in response.headers['Set-Cookie']
 
     cookie_authenticated_response = client.get('/api/v1.0/servers')
     assert cookie_authenticated_response.status_code == 200
 
 
+@pytest.mark.functional
+@pytest.mark.parametrize('scheme', ['http', 'https'])
+def test_web_login_preserves_local_return_path_and_transport(client, monkeypatch, scheme):
+    user, password = _create_login_user()
+    monkeypatch.setattr('app.login.roxy.update_plan', lambda: None)
+    response = client.post(
+        '/login', base_url=f'{scheme}://rmon.example.test',
+        json={'login': user.username, 'pass': password, 'next': '/rmon/dashboard?group=1#checks'},
+    )
+    assert response.status_code == 200
+    assert response.get_json()['next_url'] == '/rmon/dashboard?group=1#checks'
+
+
 @pytest.mark.functional
 @pytest.mark.parametrize('enabled, password_is_correct', [(True, False), (False, True)])
 def test_login_rejects_wrong_password_and_disabled_accounts(client, enabled, password_is_correct):
diff --git a/tests/functional/test_check_workflows.py b/tests/functional/test_check_workflows.py
index 814a779..69b2768 100644
--- a/tests/functional/test_check_workflows.py
+++ b/tests/functional/test_check_workflows.py
@@ -294,3 +294,95 @@ def test_invalid_check_configuration_is_rejected(
 
     assert response.status_code == 400
     assert not MultiCheck.select().where(MultiCheck.name == payload['name']).exists()
+
+
+@pytest.mark.functional
+@pytest.mark.parametrize('policy', ['default', 'require_https', 'require_http'])
+@pytest.mark.parametrize('version', ['1.20', '2.0'])
+def test_http_policy_survives_crud_and_agent_resynchronization(
+    client, auth_headers, check_agent, monkeypatch, policy, version
+):
+    payload = _payload('http', check_agent.id, uuid.uuid4().hex)
+    payload['ssl_policy'] = policy
+    sent = []
+    monkeypatch.setattr(smon_agent, 'send_get_request_to_agent', lambda *_: ('{"version":"' + version + '"}').encode())
+    monkeypatch.setattr(smon_agent, 'send_check_to_agent', lambda *args: sent.append(args[-1]))
+    monkeypatch.setattr(smon_agent, 'delete_check', lambda *_: None)
+    headers = auth_headers(2, 1)
+    response = client.post('/api/v1.0/rmon/check/http', json=payload, headers=headers)
+    assert response.status_code == 201, response.get_json()
+    multi_id = response.get_json()['id']
+    check = SMON.get(SMON.multi_check_id == multi_id)
+    assert SmonHttpCheck.get(SmonHttpCheck.smon_id == check.id).ssl_policy == policy
+    assert sent[-1]['fail_if_not_ssl'] is (policy == 'require_https')
+    assert sent[-1]['fail_if_ssl'] is (policy == 'require_http')
+
+    returned = client.get(f'/api/v1.0/rmon/check/http/{multi_id}', headers=headers).get_json()
+    assert returned['ssl_policy'] == policy
+    assert returned['checks'][0]['ssl_policy'] == policy
+    # A restarted agent receives the same policy when requesting all enabled checks.
+    smon_agent.send_http_checks(check_agent.id, check_agent.server_id.ip)
+    assert sent[-1] == sent[-2]
+
+    payload['ssl_policy'] = 'require_http' if policy != 'require_http' else 'require_https'
+    updated = client.put(f'/api/v1.0/rmon/check/http/{multi_id}', json=payload, headers=headers)
+    assert updated.status_code == 201, updated.get_json()
+    assert SmonHttpCheck.get(SmonHttpCheck.smon_id == check.id).ssl_policy == payload['ssl_policy']
+    assert sent[-1]['fail_if_not_ssl'] is (payload['ssl_policy'] == 'require_https')
+    assert sent[-1]['fail_if_ssl'] is (payload['ssl_policy'] == 'require_http')
+
+
+@pytest.mark.functional
+def test_http_policy_defaults_for_existing_api_clients(client, auth_headers, check_agent, monkeypatch):
+    payload = _payload('http', check_agent.id, uuid.uuid4().hex)
+    sent = []
+    monkeypatch.setattr(smon_agent, 'send_check_to_agent', lambda *args: sent.append(args[-1]))
+    response = client.post('/api/v1.0/rmon/check/http', json=payload, headers=auth_headers(2, 1))
+    assert response.status_code == 201, response.get_json()
+    check = SMON.get(SMON.multi_check_id == response.get_json()['id'])
+    assert SmonHttpCheck.get(SmonHttpCheck.smon_id == check.id).ssl_policy == 'default'
+    assert sent[-1]['fail_if_not_ssl'] is False
+    assert sent[-1]['fail_if_ssl'] is False
+
+
+@pytest.mark.functional
+@pytest.mark.parametrize('policy', ['https', 'disabled', '', None, True, 1])
+def test_invalid_http_policy_is_rejected_before_saving(client, auth_headers, check_agent, policy):
+    payload = _payload('http', check_agent.id, uuid.uuid4().hex)
+    payload['ssl_policy'] = policy
+    response = client.post('/api/v1.0/rmon/check/http', json=payload, headers=auth_headers(2, 1))
+    assert response.status_code == 400
+    assert not MultiCheck.select().where(MultiCheck.name == payload['name']).exists()
+
+
+@pytest.mark.parametrize('version', ['1.19', 'unknown', '', '1.18.9'])
+def test_unsupported_agents_do_not_receive_required_http_policy(monkeypatch, version):
+    from types import SimpleNamespace
+    import json
+    monkeypatch.setattr(smon_agent.smon_sql, 'select_en_smon', lambda *_: [SimpleNamespace(ssl_policy='require_https')])
+    monkeypatch.setattr(smon_agent, 'send_get_request_to_agent', lambda *_: json.dumps({'version': version}).encode())
+    def unexpected_send(*_):
+        pytest.fail('An unsupported agent must not receive the check')
+    monkeypatch.setattr(smon_agent, 'send_check_to_agent', unexpected_send)
+    with pytest.raises(ValueError, match='Agent 1.20 or later'):
+        smon_agent.send_http_checks(1, 'agent.example.test')
+
+
+def test_unavailable_policy_support_does_not_block_default_checks(
+    client, auth_headers, check_agent, monkeypatch
+):
+    sent = []
+    monkeypatch.setattr(smon_agent, 'send_check_to_agent', lambda *args: sent.append(args[-1]))
+    monkeypatch.setattr(smon_agent, 'send_get_request_to_agent', lambda *_: b'{"version":"2.0"}')
+    for policy in ('default', 'require_https'):
+        payload = _payload('http', check_agent.id, uuid.uuid4().hex)
+        payload['ssl_policy'] = policy
+        response = client.post('/api/v1.0/rmon/check/http', json=payload, headers=auth_headers(2, 1))
+        assert response.status_code == 201
+    sent.clear()
+    monkeypatch.setattr(smon_agent, 'send_get_request_to_agent', lambda *_: b'{"version":"1.19"}')
+    with pytest.raises(ValueError, match='Agent 1.20 or later'):
+        smon_agent.send_http_checks(check_agent.id, check_agent.server_id.ip)
+    assert len(sent) == 1
+    assert sent[0]['fail_if_not_ssl'] is False
+    assert sent[0]['fail_if_ssl'] is False
diff --git a/tests/functional/test_http_policy_migration.py b/tests/functional/test_http_policy_migration.py
new file mode 100644
index 0000000..4ffff4b
--- /dev/null
+++ b/tests/functional/test_http_policy_migration.py
@@ -0,0 +1,31 @@
+import importlib.util
+from pathlib import Path
+
+from peewee import SqliteDatabase
+from playhouse.migrate import SqliteMigrator
+
+
+def test_http_policy_migration_preserves_checks_and_is_repeatable(tmp_path, monkeypatch):
+    path = Path(__file__).parents[2] / 'app/migrations/20260912000000_add_http_ssl_policy.py'
+    spec = importlib.util.spec_from_file_location('http_policy_migration', path)
+    migration = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(migration)
+    database = SqliteDatabase(tmp_path / 'legacy.db')
+    monkeypatch.setattr(migration, 'connect', lambda get_migrator=False:
+                        SqliteMigrator(database) if get_migrator else database)
+    with database:
+        database.execute_sql('CREATE TABLE smon_http_check (smon_id INTEGER PRIMARY KEY, url TEXT NOT NULL)')
+        database.execute_sql("INSERT INTO smon_http_check VALUES (1, 'https://example.test')")
+        migration.upgrade()
+        assert database.execute_sql('SELECT url, ssl_policy FROM smon_http_check').fetchone() == (
+            'https://example.test', 'default')
+        database.execute_sql("UPDATE smon_http_check SET ssl_policy = 'require_https' WHERE smon_id = 1")
+        migration.upgrade()
+        database.execute_sql("INSERT INTO smon_http_check (smon_id, url) VALUES (2, 'http://example.test')")
+        assert database.execute_sql('SELECT ssl_policy FROM smon_http_check ORDER BY smon_id').fetchall() == [
+            ('require_https',), ('default',)]
+        migration.downgrade()
+        migration.downgrade()
+        assert database.execute_sql('SELECT COUNT(*) FROM smon_http_check').fetchone() == (2,)
+        migration.upgrade()
+        assert database.execute_sql('SELECT DISTINCT ssl_policy FROM smon_http_check').fetchall() == [('default',)]
diff --git a/tests/functional/test_operation_queue.py b/tests/functional/test_operation_queue.py
new file mode 100644
index 0000000..2189ccb
--- /dev/null
+++ b/tests/functional/test_operation_queue.py
@@ -0,0 +1,312 @@
+import concurrent.futures
+import importlib.util
+from datetime import datetime, timedelta
+from pathlib import Path
+from unittest.mock import Mock
+from uuid import uuid4
+
+import pytest
+from peewee import SqliteDatabase
+from playhouse.migrate import SqliteMigrator
+
+from app.modules.db.db_model import InstallationTasks, OperationJob, OperationLock, Server, conn
+from app.modules.operations import queue
+from app.modules.operations.worker import LeaseGuard, Worker
+
+
+@pytest.fixture
+def target(tmp_path, monkeypatch):
+    monkeypatch.setenv('RMON_PROCESS_HEALTH_DIR', str(tmp_path))
+    server = Server.create(hostname='operations-test', ip=f'{uuid4().hex}.test', group_id='1')
+    yield server
+    InstallationTasks.delete().where(InstallationTasks.server_id == server.server_id).execute()
+    server.delete_instance()
+
+
+def enqueue(target, action='install'):
+    inventory = {'server': {'hosts': {target.ip: {'action': action, 'agent_uuid': str(uuid4()),
+                                                'private_test_value': 'never-store-plaintext'}}}}
+    return queue.enqueue(inventory, [target.ip], 'rmon_agent', 'Agent', action, 1)
+
+
+def expire(task_id):
+    OperationJob.update(lease_until=queue.database_time() - timedelta(seconds=1)).where(
+        OperationJob.task == task_id).execute()
+
+
+def test_enqueue_is_durable_encrypted_and_does_not_execute(target, monkeypatch):
+    from app.modules.service import installation
+    monkeypatch.setattr(installation.roxywi_common, 'get_jwt_token_claims', lambda: {'user_id': 1, 'group': 1})
+    run = Mock(side_effect=AssertionError('Web executed the operation'))
+    monkeypatch.setattr(installation, 'run_ansible', run)
+    inventory = {'server': {'hosts': {target.ip: {'action': 'install', 'secret': 'test-only-secret'}}}}
+    task_id = installation.run_ansible_thread(inventory, [target.ip], 'rmon_agent', 'Agent', 'install')
+    assert InstallationTasks.get_by_id(task_id).status == 'created'
+    assert 'test-only-secret' not in OperationJob.get_by_id(task_id).payload
+    conn.close()
+    claimed, owner = queue.claim()
+    assert claimed == task_id
+    assert queue.load_payload(claimed, owner)['inventory'] == inventory
+    run.assert_not_called()
+
+
+def test_empty_poll_is_one_select_without_writes(monkeypatch):
+    execute = Mock(wraps=conn.execute_sql)
+    monkeypatch.setattr(conn, 'execute_sql', execute)
+    assert queue.claim() is None
+    assert execute.call_count == 1
+    assert execute.call_args.args[0].startswith('SELECT')
+
+
+def test_concurrent_workers_claim_once_and_serialize_target(target):
+    first, second = enqueue(target), enqueue(target)
+    def claim():
+        try:
+            return queue.claim()
+        finally:
+            conn.close()
+    with concurrent.futures.ThreadPoolExecutor(max_workers=6) as pool:
+        results = list(pool.map(lambda _: claim(), range(6)))
+    claimed = [result for result in results if result is not None]
+    assert len(claimed) == 1 and claimed[0][0] == first
+    assert OperationJob.get_by_id(first).attempts == 1
+    assert queue.finish(*claimed[0])
+    next_task = queue.claim()
+    assert next_task[0] == second
+    assert queue.finish(*next_task)
+
+
+def test_expired_lease_cannot_renew_or_finish_and_is_recovered(target):
+    task = enqueue(target)
+    claim = queue.claim()
+    expire(task)
+    assert not queue.renew(*claim)
+    callback = Mock()
+    assert not queue.finish(*claim, on_success=callback)
+    callback.assert_not_called()
+    assert queue.recover_expired() == 1
+    assert queue.claim() is None  # Recovery has a cooldown, no immediate retry loop.
+    OperationJob.update(available_at=queue.database_time()).where(OperationJob.task == task).execute()
+    replacement = queue.claim()
+    assert replacement[0] == task and replacement[1] != claim[1]
+    assert not queue.finish(*claim)
+    assert queue.finish(*replacement)
+    assert OperationJob.get_by_id(task).payload is None
+
+
+def test_renew_accepts_an_unchanged_deadline_but_rejects_stale_owners(target, monkeypatch):
+    task = enqueue(target)
+    claimed = queue.claim()
+    now = queue.database_time()
+    monkeypatch.setattr(queue, 'database_time', lambda: now)
+    assert queue.renew(*claimed)
+    # Match MySQL's affected-row count for an update with the same values.
+    monkeypatch.setattr(conn, 'rows_affected', lambda cursor: 0)
+    assert queue.renew(*claimed)
+    assert not queue.renew(task, 'another-owner')
+    expire(task)
+    assert not queue.renew(*claimed)
+
+
+def test_repeated_crashes_are_bounded_and_release_target(target):
+    task = enqueue(target)
+    for _ in range(queue.MAX_ATTEMPTS):
+        OperationJob.update(available_at=queue.database_time()).where(OperationJob.task == task).execute()
+        assert queue.claim()[0] == task
+        expire(task)
+        assert queue.recover_expired() == 1
+    assert queue.claim() is None
+    assert InstallationTasks.get_by_id(task).status == 'failed'
+    assert OperationJob.get_by_id(task).payload is None
+    assert OperationLock.get_by_id(target.server_id).owner is None
+
+
+def test_later_operation_cannot_overtake_a_delayed_retry(target):
+    first, second = enqueue(target), enqueue(target)
+    assert queue.claim()[0] == first
+    expire(first)
+    queue.recover_expired()
+    assert queue.claim() is None
+    assert OperationJob.get_by_id(second).status == 'queued'
+
+
+def test_operations_for_other_servers_can_run_concurrently(target):
+    other = Server.create(hostname='other-operations-test', ip=f'{uuid4().hex}.test', group_id='1')
+    try:
+        first, second = enqueue(target), enqueue(other)
+        assert queue.claim()[0] == first
+        assert queue.claim()[0] == second
+    finally:
+        InstallationTasks.delete().where(InstallationTasks.server_id == other.server_id).execute()
+        other.delete_instance()
+
+
+def test_changed_server_group_invalidates_old_operation(target):
+    enqueue(target)
+    claimed = queue.claim()
+    Server.update(group_id='2').where(Server.server_id == target.server_id).execute()
+    with pytest.raises(ValueError, match='group changed'):
+        queue.load_payload(*claimed)
+
+
+def test_control_api_returns_a_durable_task_and_removed_history_is_404(target, client, auth_headers):
+    from app.modules.db.db_model import SmonAgent
+    agent = SmonAgent.create(server_id=target.server_id, name='Queue API test', uuid=str(uuid4()),
+                             description='', port=5101)
+    try:
+        response = client.post('/rmon/agent/action/start', data={'agent_id': agent.id}, headers=auth_headers(1, 1))
+        assert response.status_code == 202
+        task_id = response.json['task_id']
+        status = client.get(f'/api/v1.0/rmon/task-status/{task_id}', headers=auth_headers(1, 1))
+        assert status.status_code == 200 and status.json['status'] == 'created'
+        assert 'payload' not in status.json and status.json['action'] == 'start'
+        assert queue.finish(*queue.claim())
+        InstallationTasks.update(finish_date=datetime.now() - timedelta(days=31)).where(
+            InstallationTasks.id == task_id).execute()
+        queue.cleanup()
+        assert client.get(f'/api/v1.0/rmon/task-status/{task_id}', headers=auth_headers(1, 1)).status_code == 404
+    finally:
+        agent.delete_instance()
+
+
+def test_cleanup_only_old_terminal_tasks_and_is_bounded(target):
+    old = datetime.now() - timedelta(days=31)
+    completed = enqueue(target)
+    assert queue.finish(*queue.claim())
+    failed = enqueue(target)
+    assert queue.finish(*queue.claim(), error='test failure')
+    recent = enqueue(target)
+    assert queue.finish(*queue.claim())
+    active = enqueue(target)
+    pending = enqueue(target)
+    queue.claim()
+    InstallationTasks.update(finish_date=old).where(
+        InstallationTasks.id.in_([completed, failed, active, pending])).execute()
+    assert queue.cleanup(batch_size=1, max_batches=1) == 1
+    assert queue.cleanup() == 1
+    assert queue.cleanup() == 0
+    assert {t.id for t in InstallationTasks.select().where(InstallationTasks.server_id == target.server_id)} == {
+        recent, active, pending}
+    assert not OperationJob.select().where(OperationJob.task.in_([completed, failed])).exists()
+
+
+def test_new_worker_can_execute_saved_job_and_clears_sensitive_payload(target, monkeypatch):
+    from app.modules.service import installation
+    from app.modules.common import agent_transport
+    task = enqueue(target)
+    run = Mock(return_value=None)
+    monkeypatch.setattr(installation, 'execute_installation', run)
+    record = Mock()
+    monkeypatch.setattr(agent_transport, 'record_applied', record)
+    assert Worker().step()
+    assert InstallationTasks.get_by_id(task).status == 'completed'
+    assert OperationJob.get_by_id(task).payload is None
+    run.assert_called_once()
+    record.assert_called_once()
+
+
+def test_worker_records_failure_without_leaking_payload(target, monkeypatch):
+    from app.modules.service import installation
+    enqueue(target)
+    monkeypatch.setattr(installation, 'execute_installation', Mock(side_effect=ValueError('sensitive-material')))
+    assert Worker().step()
+    task = InstallationTasks.get(InstallationTasks.server_id == target.server_id)
+    assert task.status == 'failed' and 'sensitive-material' not in task.error
+
+
+def test_idle_worker_backs_off_and_recovery_is_not_run_each_poll(monkeypatch):
+    worker = Worker()
+    monkeypatch.setattr(queue, 'claim', Mock(return_value=None))
+    recover = Mock()
+    monkeypatch.setattr(queue, 'recover_expired', recover)
+    cleanup = Mock()
+    monkeypatch.setattr('app.jobs.delete_ansible_artifacts', cleanup)
+    delays = []
+    def wait(seconds, ready=True):
+        delays.append(seconds)
+        if len(delays) == 7:
+            worker.stop()
+    monkeypatch.setattr(worker, 'wait', wait)
+    monkeypatch.setattr('runtime_health.pulse', Mock())
+    monkeypatch.setattr('app.modules.operations.worker.random.uniform', lambda *_: 1)
+    worker.run()
+    assert delays == [2, 4, 8, 16, 30, 30, 30]
+    assert recover.call_count == 1
+    cleanup.assert_called_once_with()
+
+
+def test_queue_migration_preserves_history_and_is_repeatable(tmp_path, monkeypatch):
+    path = Path(__file__).parents[2] / 'app/migrations/20260916000000_add_operation_queue.py'
+    spec = importlib.util.spec_from_file_location('operation_migration', path)
+    migration = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(migration)
+    database = SqliteDatabase(tmp_path / 'old.db')
+    monkeypatch.setattr(migration, 'connect', lambda get_migrator=False:
+                        SqliteMigrator(database) if get_migrator else database)
+    with database.connection_context():
+        database.execute_sql('CREATE TABLE installation_tasks (id INTEGER PRIMARY KEY, status TEXT, finish_date DATETIME)')
+        database.execute_sql("INSERT INTO installation_tasks VALUES (1, 'completed', '2026-01-01')")
+        migration.upgrade()
+        migration.upgrade()
+        assert database.execute_sql('SELECT status FROM installation_tasks').fetchone() == ('completed',)
+        assert {'operation_jobs', 'operation_locks'} <= set(database.get_tables())
+        assert any(index.columns == ['status', 'finish_date'] for index in database.get_indexes('installation_tasks'))
+
+
+def test_lease_guard_cancels_without_database_access_when_renewal_stalls(monkeypatch):
+    clock = [0]
+    monkeypatch.setattr('app.modules.operations.worker.time.monotonic', lambda: clock[0])
+    guard = LeaseGuard()
+    clock[0] = 100
+    assert not guard.cancelled()
+    guard.renewed()
+    clock[0] = 220
+    assert guard.cancelled()
+    assert clock[0] < 100 + queue.LEASE_SECONDS
+
+
+def test_rotation_preserves_queued_payload_and_can_be_repeated(target, monkeypatch):
+    import os
+    from cryptography.fernet import Fernet
+    from rotate_credential_secret import rotate_credentials
+    old = os.environ['RMON_SECRET_PHRASE']
+    task_id = enqueue(target)
+    monkeypatch.setenv('RMON_OLD_SECRET_PHRASE', old)
+    monkeypatch.setenv('RMON_SECRET_PHRASE', Fernet.generate_key().decode())
+    assert rotate_credentials() >= 1
+    assert rotate_credentials() == 0
+    claimed = queue.claim()
+    assert claimed[0] == task_id
+    assert queue.load_payload(*claimed)['inventory']['server']['hosts'][target.ip]['private_test_value'] == 'never-store-plaintext'
+
+
+@pytest.mark.parametrize('runner_fails', [True, False])
+def test_ansible_releases_ssh_agent_and_inventory_on_failure_or_success(tmp_path, monkeypatch, runner_fails):
+    import sys
+    from types import SimpleNamespace
+    from app.modules.service import installation
+    original_path = Path
+    monkeypatch.setattr(installation, 'Path', lambda path: tmp_path if str(path).endswith('/ansible/inventory') else original_path(path))
+    monkeypatch.setattr(installation, '_ensure_agent_collections', lambda: '/test/collections')
+    monkeypatch.setattr(installation.sql, 'get_setting', lambda _: '')
+    monkeypatch.setattr(installation.server_mod, 'start_ssh_agent', lambda: {'pid': 123, 'socket': 'test-socket'})
+    stop = Mock()
+    monkeypatch.setattr(installation.server_mod, 'stop_ssh_agent', stop)
+    monkeypatch.setattr(installation, 'return_ssh_keys_path', lambda _: {
+        'enabled': False, 'password': 'test-only-password', 'user': 'test', 'port': 22})
+    cancelled = Mock(return_value=False)
+    def execute(**kwargs):
+        assert kwargs['cancel_callback'] is cancelled
+        assert Path(kwargs['inventory']).is_file()
+        if runner_fails:
+            raise RuntimeError('Runner failed')
+        return SimpleNamespace(rc=0, stats={'failures': {}, 'dark': {}})
+    monkeypatch.setitem(sys.modules, 'ansible_runner', SimpleNamespace(run=execute))
+    inventory = {'server': {'hosts': {'example.test': {'action': 'start'}}}}
+    if runner_fails:
+        with pytest.raises(RuntimeError, match='Runner failed'):
+            installation.run_ansible(inventory, ['example.test'], 'rmon_agent', cancel_callback=cancelled)
+    else:
+        assert installation.run_ansible(inventory, ['example.test'], 'rmon_agent', cancel_callback=cancelled)['failures'] == {}
+    stop.assert_called_once()
+    assert not list(tmp_path.iterdir())
diff --git a/tests/functional/test_remove_web_notifications.py b/tests/functional/test_remove_web_notifications.py
new file mode 100644
index 0000000..b9d3705
--- /dev/null
+++ b/tests/functional/test_remove_web_notifications.py
@@ -0,0 +1,101 @@
+import importlib.util
+from pathlib import Path
+from unittest.mock import Mock
+
+import pytest
+from peewee import IntegrityError, SqliteDatabase
+
+from app.modules.db.db_model import RoxyTool, Setting
+
+
+@pytest.fixture
+def legacy_notifications(tmp_path, monkeypatch):
+    path = Path(__file__).parents[2] / 'app/migrations/20260913000000_remove_web_notifications.py'
+    spec = importlib.util.spec_from_file_location('remove_web_notifications', path)
+    migration = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(migration)
+    database = SqliteDatabase(tmp_path / 'legacy.db')
+    monkeypatch.setattr(migration, 'connect', lambda: database)
+    with database.bind_ctx([Setting, RoxyTool]):
+        database.create_tables([Setting, RoxyTool])
+        for group_id in (1, 2):
+            for param in ('enabled', 'host', 'port', 'vhost', 'queue', 'user', 'password'):
+                Setting.create(param='rabbitmq_' + param, value='legacy-value', section='rabbitmq', desc='', group_id=group_id)
+            Setting.create(param='mail_smtp_host', value='mail.example.test', section='mail', desc='', group_id=group_id)
+        for service in ('rmon-socket', 'rabbitmq-server', 'rmon-server', 'fail2ban'):
+            RoxyTool.create(name=service, current_version='1.0', new_version='1.1', is_roxy=1, desc='')
+        try:
+            yield database, migration
+        finally:
+            database.close()
+
+
+def test_migration_removes_only_retired_settings_and_services_and_is_repeatable(legacy_notifications):
+    database, migration = legacy_notifications
+    migration.upgrade()
+    migration.upgrade()
+    assert list(Setting.select(Setting.param, Setting.value, Setting.group_id).order_by(Setting.group_id).tuples()) == [
+        ('mail_smtp_host', 'mail.example.test', 1), ('mail_smtp_host', 'mail.example.test', 2)]
+    assert {row.name for row in RoxyTool.select()} == {'rmon-server', 'fail2ban'}
+    with pytest.raises(RuntimeError, match='database backup'):
+        migration.downgrade()
+
+
+def test_migration_rolls_back_settings_if_service_cleanup_fails(legacy_notifications):
+    database, migration = legacy_notifications
+    database.execute_sql("CREATE TRIGGER reject_cleanup BEFORE DELETE ON roxy_tools BEGIN SELECT RAISE(ABORT, 'blocked'); END")
+    with pytest.raises(IntegrityError, match='blocked'):
+        migration.upgrade()
+    assert Setting.select().where(Setting.section == 'rabbitmq').count() == 14
+    assert RoxyTool.select().count() == 4
+
+
+def test_retired_services_are_not_exposed_or_controllable_even_before_migration(legacy_notifications, monkeypatch):
+    from app.modules.db import roxy as service_sql
+    from app.modules.roxywi import roxy
+    from app.modules.tools import common
+    assert set(service_sql.get_all_tools()) == {'rmon-server', 'fail2ban'}
+    assert set(service_sql.get_roxy_tools()) == {'rmon-server', 'fail2ban'}
+    monkeypatch.delenv('RMON_CONTAINER', raising=False)
+    monkeypatch.setattr(roxy.os, 'system', Mock(side_effect=AssertionError('Retired service was controlled')))
+    monkeypatch.setattr(common.server_mod, 'subprocess_execute', Mock(side_effect=AssertionError('Retired package was installed')))
+    for name in ('rmon-socket', 'rabbitmq-server'):
+        assert roxy.action_service('restart', name) == 'error: Unsupported service'
+        with pytest.raises(Exception, match='not part of RMON'):
+            common.update_roxy_wi(name)
+
+
+@pytest.mark.functional
+def test_settings_api_and_channel_page_no_longer_offer_web_notifications(client, auth_headers):
+    headers = auth_headers(1, 1)
+    response = client.get('/api/v1.0/settings', headers=headers)
+    assert response.status_code == 200
+    assert not any(row['section'] == 'rabbitmq' for row in response.json)
+    assert client.get('/api/v1.0/settings/rabbitmq', headers=headers).status_code == 404
+    html = client.get('/channel/load', headers=headers)
+    assert html.status_code == 200
+    assert "sendCheckMessage('web')" not in html.get_data(as_text=True)
+    assert "sendCheckMessage('email')" in html.get_data(as_text=True)
+
+
+@pytest.mark.functional
+def test_email_test_remains_available_and_retired_sender_is_rejected(client, auth_headers, monkeypatch):
+    from app.modules.tools import alerting
+    send_email = Mock(return_value='ok')
+    monkeypatch.setattr(alerting, 'check_email_alert', send_email)
+    headers = auth_headers(1, 1)
+    rejected = client.post('/channel/check', headers=headers, json={'sender': 'web'})
+    assert rejected.status_code == 400
+    send_email.assert_not_called()
+    accepted = client.post('/channel/check', headers=headers, json={'sender': 'email'})
+    assert accepted.status_code == 200
+    assert accepted.json == {'status': 'success'}
+    send_email.assert_called_once_with()
+
+
+@pytest.mark.functional
+@pytest.mark.parametrize('payload', [{}, [], {'sender': []}, {'sender': {}}])
+def test_invalid_notification_test_sender_is_rejected(client, auth_headers, payload):
+    response = client.post('/channel/check', headers=auth_headers(1, 1), json=payload)
+    assert response.status_code == 400
+    assert response.json == {'error': 'Unsupported notification channel'}
diff --git a/tests/functional/test_service_versions.py b/tests/functional/test_service_versions.py
new file mode 100644
index 0000000..9add0d1
--- /dev/null
+++ b/tests/functional/test_service_versions.py
@@ -0,0 +1,207 @@
+import copy
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from app.modules.tools import common
+
+
+@pytest.fixture
+def version_probes(monkeypatch):
+    monkeypatch.delenv('RMON_SERVER_INTERNAL_URL', raising=False)
+    monkeypatch.setattr(common.distro, 'id', lambda: 'ubuntu')
+    monkeypatch.setattr(common.distro, 'like', lambda: '')
+    writes = []
+    monkeypatch.setattr(common.roxy_sql, 'update_tool_cur_version', lambda *args: writes.append(args))
+    return writes
+
+
+@pytest.mark.parametrize('status,payload,expected', [
+    (200, {'service': 'rmon-server', 'version': '6.33'}, '6.33'),
+    (401, {}, '0'), (302, {}, '0'), (200, {'service': 'other', 'version': '6.33'}, '0'),
+    (200, {'service': 'rmon-server', 'version': '<html>'}, '0'), (200, [], '0'),
+])
+def test_container_version_uses_authenticated_mtls(monkeypatch, tmp_path, version_probes, status, payload, expected):
+    token = tmp_path / 'token'
+    token.write_text('test-only-token\n')
+    for key, value in {'URL': 'https://127.0.0.1:5100', 'TOKEN_FILE': str(token)}.items():
+        monkeypatch.setenv('RMON_SERVER_INTERNAL_' + key, value)
+    for key, value in {'CA_FILE': '/tls/ca.crt', 'CLIENT_CERT_FILE': '/tls/ui.crt', 'CLIENT_KEY_FILE': '/tls/ui.key'}.items():
+        monkeypatch.setenv('RMON_SERVER_' + key, value)
+    response = MagicMock(status_code=status)
+    response.json.return_value = payload
+    response.__enter__.return_value = response
+    session = MagicMock()
+    session.__enter__.return_value = session
+    session.get.return_value = response
+    monkeypatch.setattr(common.requests, 'Session', lambda: session)
+    monkeypatch.setattr(common, '_version_command', lambda _: pytest.fail('No package or source fallback'))
+    assert common.update_cur_tool_version('rmon-server')['current_version'] == expected
+    assert session.trust_env is False
+    kwargs = session.get.call_args.kwargs
+    assert kwargs['cert'] == ('/tls/ui.crt', '/tls/ui.key')
+    assert kwargs['verify'] == '/tls/ca.crt'
+    assert kwargs['headers']['Authorization'] == 'Bearer test-only-token'
+    assert kwargs['allow_redirects'] is False
+
+
+@pytest.mark.parametrize('url', ['ftp://localhost:5100', 'https://user:secret@localhost', 'https://localhost?token=secret'])
+def test_container_version_rejects_unsafe_url(monkeypatch, url):
+    monkeypatch.setenv('RMON_SERVER_INTERNAL_URL', url)
+    monkeypatch.setattr(common.requests, 'Session', lambda: pytest.fail('Request must not run'))
+    assert common._server_runtime_version() is None
+
+
+@pytest.mark.parametrize('scheme,ca', [('http', ''), ('https', ''), ('https', '/tls/self-signed-server.crt')])
+def test_container_version_supports_http_and_https_without_client_certificate(monkeypatch, tmp_path, scheme, ca):
+    token = tmp_path / 'token'
+    token.write_text('test-only-token')
+    monkeypatch.setenv('RMON_SERVER_INTERNAL_URL', f'{scheme}://localhost:5100')
+    monkeypatch.setenv('RMON_SERVER_INTERNAL_TOKEN_FILE', str(token))
+    monkeypatch.setenv('RMON_SERVER_CA_FILE', ca)
+    monkeypatch.delenv('RMON_SERVER_CLIENT_CERT_FILE', raising=False)
+    monkeypatch.delenv('RMON_SERVER_CLIENT_KEY_FILE', raising=False)
+    session = MagicMock()
+    session.__enter__.return_value = session
+    response = session.get.return_value.__enter__.return_value
+    response.status_code = 200
+    response.json.return_value = {'service': 'rmon-server', 'version': '7.0'}
+    monkeypatch.setattr(common.requests, 'Session', lambda: session)
+    assert common._server_runtime_version() == '7.0'
+    assert session.get.call_args.kwargs['cert'] is None
+    assert session.get.call_args.kwargs['verify'] == (ca or True)
+    assert session.get.call_args.kwargs['allow_redirects'] is False
+
+
+@pytest.mark.parametrize('scheme,cert,key', [('http', 'client.crt', 'client.key'),
+                                          ('https', 'client.crt', ''), ('https', '', 'client.key')])
+def test_container_version_rejects_incomplete_or_plaintext_client_identity(monkeypatch, tmp_path, scheme, cert, key):
+    token = tmp_path / 'token'
+    token.write_text('test-only-token')
+    monkeypatch.setenv('RMON_SERVER_INTERNAL_URL', f'{scheme}://localhost:5100')
+    monkeypatch.setenv('RMON_SERVER_INTERNAL_TOKEN_FILE', str(token))
+    monkeypatch.setenv('RMON_SERVER_CLIENT_CERT_FILE', cert)
+    monkeypatch.setenv('RMON_SERVER_CLIENT_KEY_FILE', key)
+    monkeypatch.setattr(common.requests, 'Session', lambda: pytest.fail('Invalid client identity'))
+    assert common._server_runtime_version() is None
+
+
+def test_container_cannot_be_overwritten_by_package_update(monkeypatch):
+    monkeypatch.setenv('RMON_SERVER_INTERNAL_URL', 'https://localhost:5100')
+    monkeypatch.setattr(common.server_mod, 'subprocess_execute', lambda _: pytest.fail('No package installation'))
+    with pytest.raises(ValueError, match='managed by Docker'):
+        common.update_roxy_wi('rmon-server')
+
+
+@pytest.mark.parametrize('distro_name,package,expected', [
+    ('ubuntu', 'install ok installed\t6.33-1', '6.33.1'),
+    ('debian', 'install ok installed\t1:6.33-2', '6.33.2'),
+    ('ubuntu', 'install ok installed\t1.0.2-3ubuntu1.1', '1.0.2'),
+    ('rocky', '1.0.2-14.el9', '1.0.2'),
+    ('rocky', '6.33-1', '6.33.1'),
+])
+def test_exact_package_versions_for_deb_and_rpm(monkeypatch, version_probes, distro_name, package, expected):
+    monkeypatch.setattr(common.distro, 'id', lambda: distro_name)
+    calls = []
+    def query(args):
+        calls.append(args)
+        return package
+    monkeypatch.setattr(common, '_version_command', query)
+    result = common.update_cur_tool_version('rmon-server')
+    assert result == {'current_version': expected, 'version_known': True, 'installed': True}
+    assert calls[0][-1] == 'rmon-server'
+    assert calls[0][0] == ('dpkg-query' if distro_name in ('ubuntu', 'debian') else 'rpm')
+    assert len(calls) == 1
+    assert version_probes == [('rmon-server', expected)]
+
+
+def test_source_install_reads_unit_working_directory_without_executing_code(monkeypatch, tmp_path, version_probes):
+    source = tmp_path / 'custom deployment' / 'modules' / 'common'
+    source.mkdir(parents=True)
+    (source / 'version.py').write_text('raise RuntimeError("Must never execute")\nSERVICE_VERSION = "6.33"\n')
+    monkeypatch.setattr(common, '_version_command', lambda args:
+                        None if args[0] == 'dpkg-query' else f'LoadState=loaded\nWorkingDirectory={source.parents[1]}')
+    assert common.update_cur_tool_version('rmon-server') == {
+        'current_version': '6.33', 'version_known': True, 'installed': True}
+    assert version_probes == [('rmon-server', '6.33')]
+
+
+@pytest.mark.parametrize('content', [
+    'SERVICE_VERSION = read_secret()',
+    'SERVICE_VERSION = "<html>error</html>"',
+    'SERVICE_VERSION = ',
+    'SERVICE_VERSION = 6.33',
+    '#' * 65537,
+], ids=['expression', 'html', 'syntax', 'number', 'oversized'])
+def test_invalid_source_metadata_is_not_a_version(tmp_path, content):
+    source = tmp_path / 'modules' / 'common'
+    source.mkdir(parents=True)
+    (source / 'version.py').write_text(content)
+    assert common._source_version(str(tmp_path)) is None
+
+
+@pytest.mark.parametrize('properties,installed', [
+    ('LoadState=not-found\nWorkingDirectory=', False),
+    ('LoadState=loaded\nWorkingDirectory=/nonexistent-rmon-test-path', True),
+    (None, None),
+])
+def test_missing_package_is_not_confused_with_missing_or_stopped_source_service(monkeypatch, version_probes, properties, installed):
+    monkeypatch.setattr(common, '_version_command', lambda args:
+                        'deinstall ok config-files\t6.33' if args[0] == 'dpkg-query' else properties)
+    assert common.update_cur_tool_version('rmon-server') == {
+        'current_version': '0', 'version_known': False, 'installed': installed}
+
+
+def test_command_uses_argument_list_timeout_and_exit_status(monkeypatch):
+    calls = []
+    def run(args, **kwargs):
+        calls.append((args, kwargs))
+        return SimpleNamespace(returncode=0, stdout=' 6.33\n')
+    monkeypatch.setattr(common.subprocess, 'run', run)
+    assert common._version_command(['rpm', '-q', 'rmon-server']) == '6.33'
+    assert calls[0][1]['timeout'] == 3
+    assert not calls[0][1].get('shell')
+    monkeypatch.setattr(common.subprocess, 'run', lambda *args, **kwargs: SimpleNamespace(returncode=1, stdout='6.33'))
+    assert common._version_command(['rpm']) is None
+
+
+@pytest.mark.parametrize('error', [FileNotFoundError(), common.subprocess.TimeoutExpired('rpm', 3)])
+def test_unavailable_package_manager_is_handled(monkeypatch, error):
+    def run(*args, **kwargs):
+        raise error
+    monkeypatch.setattr(common.subprocess, 'run', run)
+    assert common._version_command(['rpm']) is None
+
+
+def test_service_name_cannot_inject_commands(monkeypatch, version_probes):
+    monkeypatch.setattr(common, '_version_command', lambda _: pytest.fail('Command must not run'))
+    with pytest.raises(ValueError):
+        common.update_cur_tool_version('rmon-server; touch /tmp/unexpected')
+    assert not version_probes
+
+
+@pytest.mark.parametrize('current,latest,expected', [
+    ('6.9', '6.33', True), ('6.33', '6.9', False), ('6.33', '6.33', False),
+    ('1.9', '1.10', True), ('0', '6.34', False), ('6.33', '', False),
+])
+def test_refresh_is_visible_on_first_request_and_versions_are_not_compared_as_floats(monkeypatch, current, latest, expected):
+    stored = {'rmon-server': {'current_version': '0', 'new_version': latest}}
+    monkeypatch.setattr(common.roxy_sql, 'get_all_tools', lambda: copy.deepcopy(stored))
+    monkeypatch.setattr(common, 'is_tool_active', lambda _: 'active')
+    def refresh(name):
+        stored[name]['current_version'] = current
+        return {'current_version': current, 'version_known': current != '0', 'installed': True}
+    monkeypatch.setattr(common, 'update_cur_tool_version', refresh)
+    result = common.get_services_status(update_cur_ver=1)
+    assert result[0][2]['current_version'] == current
+    assert result[0][2]['update_available'] is expected
+
+
+def test_update_tab_refreshes_installed_versions(client, auth_headers, monkeypatch):
+    calls = []
+    monkeypatch.setattr('app.modules.roxywi.roxy.versions',
+                        lambda: {'current_ver': '1.4.0', 'new_ver': '1.3.0', 'need_update': False})
+    monkeypatch.setattr(common, 'get_services_status', lambda **kwargs: calls.append(kwargs) or [])
+    assert client.get('/admin/update', headers=auth_headers(1, 1)).status_code == 200
+    assert calls == [{'update_cur_ver': 1}]
diff --git a/tests/helm/cluster_smoke.py b/tests/helm/cluster_smoke.py
new file mode 100644
index 0000000..711e690
--- /dev/null
+++ b/tests/helm/cluster_smoke.py
@@ -0,0 +1,157 @@
+"""Opt-in end-to-end test in a disposable Kind cluster owned by CI."""
+import base64
+import json
+import os
+from pathlib import Path
+import secrets
+import subprocess
+import tempfile
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+NS = 'rmon-helm-test'
+SELECTOR = 'app.kubernetes.io/instance=smoke'
+
+
+def run(*args, input=None, timeout=900):
+    result = subprocess.run(args, input=input, text=True, capture_output=True, timeout=timeout)
+    if result.returncode:
+        raise RuntimeError(f'{args[0:3]} failed:\n{result.stdout[-3000:]}\n{result.stderr[-3000:]}')
+    return result.stdout
+
+
+def kube(*args, **kwargs):
+    return run('kubectl', '-n', NS, *args, **kwargs)
+
+
+def secret(name, data):
+    kube('apply', '-f', '-', input=json.dumps({'apiVersion': 'v1', 'kind': 'Secret',
+         'metadata': {'name': name}, 'stringData': data}))
+
+
+def execute(role, code):
+    interpreter = 'python' if role == 'server' else '/opt/rmon-venv/bin/python'
+    return kube('exec', '-i', 'deployment/smoke-rmon-chart-' + role, '-c', role, '--', interpreter, '-', input=code)
+
+
+def verify(password, expected=None):
+    result = execute('web', f'''
+import hashlib, json, os, sqlite3, urllib.request
+from pathlib import Path
+opener = urllib.request.build_opener(urllib.request.ProxyHandler({{}}))
+base = 'http://smoke-rmon-chart-web:8080'
+assert opener.open(base + '/login', timeout=15).status == 200
+request = urllib.request.Request(base + '/login', data=json.dumps({{'login': 'admin', 'pass': {password!r}}}).encode(), headers={{'Content-Type': 'application/json'}})
+with opener.open(request, timeout=45) as response:
+    assert json.load(response)['status'] == 'done'
+os.environ['RMON_SCHEDULER_ENABLED'] = '0'
+from app.modules.tools.common import _server_runtime_version
+assert _server_runtime_version() == '7.0'
+db = sqlite3.connect('/var/lib/rmon/rmon.db')
+db.execute('CREATE TABLE IF NOT EXISTS helm_persistence_test (id INTEGER PRIMARY KEY, value TEXT)')
+db.execute("INSERT OR IGNORE INTO helm_persistence_test VALUES (1, 'preserved')")
+db.commit()
+assert db.execute('SELECT value FROM helm_persistence_test').fetchone() == ('preserved',)
+keys = {{p.name: hashlib.sha256(p.read_bytes()).hexdigest() for p in Path('/var/lib/rmon/keys').iterdir() if p.is_file()}}
+assert 'rmon-key' in keys and 'rmon-key.pub' in keys
+print(json.dumps(keys, sort_keys=True))
+''')
+    fingerprint = json.loads(result.strip().splitlines()[-1])
+    if expected is not None:
+        assert fingerprint == expected, 'Application keys changed after pod replacement'
+    pods = json.loads(kube('get', 'pods', '-l', SELECTOR, '-o', 'json'))['items']
+    running = [p for p in pods if p['metadata']['labels']['app.kubernetes.io/component'] != 'migration']
+    assert len(running) == 4
+    assert len({p['spec']['nodeName'] for p in running}) == 1, 'RWO pods must share a node'
+    for role in ('scheduler', 'operations'):
+        kube('exec', 'deployment/smoke-rmon-chart-' + role, '--', '/opt/rmon-venv/bin/python', '-m',
+             'container.runtime', 'healthcheck', '--role', role)
+    kube('exec', 'deployment/smoke-rmon-chart-server', '--', 'python', '-m', 'modules.common.probe', 'ready')
+    return fingerprint
+
+
+def main():
+    # Refuse arbitrary clusters, including a developer's current production context.
+    assert run('kubectl', 'config', 'current-context').strip() == 'kind-rmon-chart-test'
+    run('kubectl', 'create', 'namespace', NS)
+    password = secrets.token_urlsafe(24)
+    secret('initial-password', {'admin-password': password})
+    secret('receiver-token', {'token': secrets.token_urlsafe(32)})
+    values = {'publicURL': 'http://smoke-rmon-chart-web:8080', 'cookieSecure': False,
+              'config': {'main': {'secret_phrase': base64.urlsafe_b64encode(secrets.token_bytes(32)).decode()}},
+              'image': {'repository': 'rmon-web-test', 'tag': 'ci', 'pullPolicy': 'Never'},
+              'bootstrap': {'enabled': True, 'existingSecret': 'initial-password'},
+              'server': {'existingTokenSecret': 'receiver-token', 'image': {'pullPolicy': 'Never'}},
+              'persistence': {'size': '1Gi'}}
+    with tempfile.TemporaryDirectory(prefix='rmon-chart-') as directory:
+        directory = Path(directory)
+        settings = directory / 'values.yaml'
+        settings.write_text(yaml.safe_dump(values), encoding='utf-8')
+        settings.chmod(0o600)
+
+        def upgrade(*options):
+            return run('helm', 'upgrade', '--install', 'smoke', str(ROOT / 'helm/rmon'), '-n', NS,
+                       '-f', str(settings), '--wait', '--wait-for-jobs', '--timeout', '10m', *options)
+
+        upgrade()
+        before = verify(password)
+        print('Fresh installation: login, all services, receiver API and RWO placement passed', flush=True)
+        # A new initialization password must not reset an existing administrator.
+        secret('initial-password', {'admin-password': secrets.token_urlsafe(24)})
+        kube('delete', 'pods', '-l', SELECTOR, '--wait=true')
+        kube('wait', 'deployment', '-l', SELECTOR, '--for=condition=Available', '--timeout=600s')
+        # rollout status also observes the new deployment generation/readiness.
+        for role in ('web', 'scheduler', 'operations', 'server'):
+            kube('rollout', 'status', 'deployment/smoke-rmon-chart-' + role, '--timeout=600s')
+        verify(password, before)
+        print('Pod replacement: original login, database marker and application keys preserved', flush=True)
+        upgrade('--set', 'maintenance=true', '--set', 'bootstrap.enabled=false')
+        kube('wait', 'pod', '-l', SELECTOR, '--for=delete', '--timeout=180s')
+        upgrade('--set', 'maintenance=true', '--set', 'bootstrap.enabled=false', '--set', 'migration.enabled=true')
+        jobs = json.loads(kube('get', 'jobs', '-l', SELECTOR, '-o', 'json'))['items']
+        assert len(jobs) == 1 and jobs[0]['status'].get('succeeded') == 1
+        upgrade('--set', 'bootstrap.enabled=false')
+        verify(password, before)
+        print('Explicit maintenance and app/migrate.py job passed', flush=True)
+        # Exercise actual certificate mounts and authenticated probes, not only rendering.
+        run('openssl', 'req', '-x509', '-newkey', 'rsa:2048', '-nodes', '-keyout', str(directory / 'ca.key'),
+            '-out', str(directory / 'ca.crt'), '-subj', '/CN=RMON CI CA', '-days', '1')
+        for name, usage in [('server', 'serverAuth'), ('client', 'clientAuth')]:
+            run('openssl', 'req', '-newkey', 'rsa:2048', '-nodes', '-keyout', str(directory / f'{name}.key'),
+                '-out', str(directory / f'{name}.csr'), '-subj', f'/CN={name}')
+            extension = directory / f'{name}.ext'
+            extension.write_text(f'extendedKeyUsage={usage}\nsubjectAltName=DNS:smoke-rmon-chart-server,IP:127.0.0.1\n')
+            run('openssl', 'x509', '-req', '-in', str(directory / f'{name}.csr'), '-CA', str(directory / 'ca.crt'),
+                '-CAkey', str(directory / 'ca.key'), '-CAcreateserial', '-out', str(directory / f'{name}.crt'),
+                '-days', '1', '-extfile', str(extension))
+            secret('tls-' + name, {'tls.crt': (directory / f'{name}.crt').read_text(),
+                                  'tls.key': (directory / f'{name}.key').read_text(),
+                                  'ca.crt': (directory / 'ca.crt').read_text()})
+        for mode in ('https', 'mtls'):
+            upgrade('--set', 'bootstrap.enabled=false', '--set', 'server.transport=' + mode,
+                    '--set', 'server.tls.existingServerSecret=tls-server',
+                    '--set', 'server.tls.existingClientSecret=tls-client')
+            verify(password, before)
+            if mode == 'mtls':
+                execute('web', '''
+import ssl, urllib.request, urllib.error
+context = ssl.create_default_context(cafile='/run/rmon-client-tls/ca.crt')
+opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), urllib.request.HTTPSHandler(context=context))
+try:
+    opener.open('https://smoke-rmon-chart-server:5100/internal/health/live', timeout=5)
+except urllib.error.HTTPError:
+    raise AssertionError('mTLS accepted a connection without a client certificate')
+except (urllib.error.URLError, ssl.SSLError, ConnectionError):
+    pass
+else:
+    raise AssertionError('mTLS did not require a client certificate')
+''')
+            print(mode.upper() + ': receiver API and authenticated probes passed', flush=True)
+        run('helm', 'uninstall', 'smoke', '-n', NS, '--wait')
+        assert kube('get', 'pvc', 'smoke-rmon-chart-data', '-o', 'name').strip()
+        print('Uninstall preserved the data volume', flush=True)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/helm/validate.py b/tests/helm/validate.py
new file mode 100644
index 0000000..b7a431b
--- /dev/null
+++ b/tests/helm/validate.py
@@ -0,0 +1,105 @@
+"""Render actual chart variants with Helm and validate their Kubernetes contracts."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+HELM = os.getenv('RMON_TEST_HELM_BINARY', 'helm')
+BASE = {'publicURL': 'https://rmon.example.test', 'existingConfigSecret': 'settings',
+        'server': {'existingTokenSecret': 'receiver'}}
+
+
+def render(values, *, valid=True):
+    with tempfile.TemporaryDirectory() as directory:
+        path = Path(directory) / 'values.yaml'
+        path.write_text(yaml.safe_dump(values), encoding='utf-8')
+        result = subprocess.run([HELM, 'template', 'test', str(ROOT / 'helm/rmon'), '-f', str(path)],
+                                text=True, capture_output=True, check=False)
+    if not valid:
+        assert result.returncode != 0, values
+        return
+    assert result.returncode == 0, result.stderr
+    return [doc for doc in yaml.safe_load_all(result.stdout) if doc]
+
+
+def deployments(docs):
+    return {d['metadata']['labels']['app.kubernetes.io/component']: d for d in docs if d['kind'] == 'Deployment'}
+
+
+def main():
+    docs = render(BASE)
+    apps = deployments(docs)
+    assert set(apps) == {'web', 'scheduler', 'operations', 'server'}
+    assert not any(d['kind'] == 'Secret' for d in docs)
+    for role, app in apps.items():
+        assert app['metadata']['name'] == 'test-rmon-chart-' + role
+        assert app['spec']['selector']['matchLabels'] == {
+            'app.kubernetes.io/name': 'rmon-chart',
+            'app.kubernetes.io/instance': 'test',
+            'app.kubernetes.io/component': role,
+        }
+        assert app['spec']['replicas'] == 1
+        assert app['spec']['strategy']['type'] == 'Recreate'
+        pod = app['spec']['template']['spec']
+        assert not pod['automountServiceAccountToken']
+        assert pod['securityContext']['fsGroup'] == 33
+        assert 'affinity' in pod
+        container = pod['containers'][0]
+        expected_image = ('ghcr.io/roxy-wi/rmon/rmon-server:7.0' if role == 'server'
+                          else 'ghcr.io/roxy-wi/rmon/rmon-web:1.4.0')
+        assert container['image'] == expected_image
+        if role != 'server':
+            env = {v['name']: v.get('value') for v in container['env']}
+            assert env['RMON_AGENT_IMAGE'] == 'ghcr.io/roxy-wi/rmon/rmon-agent:2.0'
+        assert all(p in container for p in ('livenessProbe', 'readinessProbe', 'startupProbe'))
+        volumes = {v['name'] for v in pod['volumes']}
+        assert all(m['name'] in volumes for m in container['volumeMounts'])
+    claim = next(d for d in docs if d['kind'] == 'PersistentVolumeClaim')
+    assert claim['metadata']['name'] == 'test-rmon-chart-data'
+    assert apps['operations']['spec']['template']['spec']['terminationGracePeriodSeconds'] == 1800
+    maintenance = deployments(render({**BASE, 'maintenance': True}))
+    assert all(a['spec']['replicas'] == 0 for a in maintenance.values())
+    migration = render({**BASE, 'maintenance': True, 'migration': {'enabled': True}})
+    job = next(d for d in migration if d['kind'] == 'Job')
+    assert job['spec']['template']['spec']['containers'][0]['args'] == ['/var/www/rmon/app/migrate.py', 'migrate']
+    assert 'affinity' not in job['spec']['template']['spec']
+    config = {'main': {'secret_phrase': 'A' * 43 + '='}, 'pgsql': {'enable': 1, 'host': 'db.example'}}
+    docs = render({**BASE, 'existingConfigSecret': '', 'config': config,
+                   'persistence': {'accessModes': ['ReadWriteMany']},
+                   'bootstrap': {'enabled': True, 'existingSecret': 'initial-password'},
+                   'ingress': {'enabled': True, 'host': 'rmon.example.test', 'tls': [{'secretName': 'web-tls', 'hosts': ['rmon.example.test']}]}})
+    secret = next(d for d in docs if d['kind'] == 'Secret')
+    assert 'port = 5432' in secret['stringData']['rmon.cfg']
+    assert all('affinity' not in d['spec']['template']['spec'] for d in deployments(docs).values())
+    assert deployments(docs)['web']['spec']['template']['spec']['initContainers'][0]['args'] == ['bootstrap']
+    assert any(d['kind'] == 'Ingress' for d in docs)
+    for mode in ('https', 'mtls'):
+        docs = render({**BASE, 'server': {**BASE['server'], 'transport': mode,
+                       'tls': {'existingServerSecret': 'identity', 'existingClientSecret': 'client'}}})
+        for role, app in deployments(docs).items():
+            volumes = app['spec']['template']['spec']['volumes']
+            assert any(v['name'] == 'server-tls' for v in volumes) == (role == 'server')
+            assert any(v['name'] == 'client-tls' for v in volumes)
+    docs = render({**BASE, 'server': {'enabled': False, 'externalURL': 'https://receiver.test', 'existingTokenSecret': 'token'},
+                   'persistence': {'existingClaim': 'restored-data'},
+                   'image': {'digest': 'sha256:' + 'a' * 64}})
+    assert 'server' not in deployments(docs)
+    assert not any(d['kind'] == 'PersistentVolumeClaim' for d in docs)
+    assert '@sha256:' in deployments(docs)['web']['spec']['template']['spec']['containers'][0]['image']
+    for invalid in (
+        {}, {**BASE, 'publicURL': ''}, {**BASE, 'web': {'replicaCount': 2}},
+        {**BASE, 'migration': {'enabled': True}},
+        {**BASE, 'bootstrap': {'enabled': True}}, {**BASE, 'server': {'transport': 'mtls'}},
+        {**BASE, 'persistence': {'accessModes': ['ReadWriteOncePod']}},
+        {**BASE, 'existingConfigSecret': '', 'config': {'main': {'secret_phrase': 'short'}}},
+        {**BASE, 'existingConfigSecret': '', 'config': {'main': {'secret_phrase': 'A' * 43 + '='}}, 'persistence': {'accessModes': ['ReadWriteMany']}},
+    ):
+        render(invalid, valid=False)
+    print('Helm rendering: default, bootstrap, maintenance, PostgreSQL/RWX, ingress, HTTPS/mTLS, external server, restored PVC, digest and invalid settings passed')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/operations/database_smoke.py b/tests/operations/database_smoke.py
new file mode 100644
index 0000000..68893ab
--- /dev/null
+++ b/tests/operations/database_smoke.py
@@ -0,0 +1,150 @@
+"""Exercise the real queue against disposable, private PostgreSQL/MariaDB containers."""
+import argparse
+import concurrent.futures
+from datetime import datetime, timedelta
+import importlib.util
+import os
+from pathlib import Path
+import subprocess
+import time
+from uuid import uuid4
+
+
+def inside(backend):
+    root = Path('/tmp/rmon-queue-contract')
+    root.mkdir()
+    (root / 'prometheus').mkdir()
+    config = root / 'rmon.cfg'
+    config.write_text(f'''[main]
+lib_path = {root}
+log_path = {root}
+secret_phrase = E2nCq8NnECvPQ5zUQntL_-Nt-qBncYkrEmMkYGzVpyM=
+[mysql]
+enable = {int(backend == 'mysql')}
+mysql_host = database
+mysql_port = 3306
+mysql_user = root
+mysql_password =
+mysql_db = rmon_queue_test
+[pgsql]
+enable = {int(backend == 'postgres')}
+host = database
+port = 5432
+user = rmon_test
+password =
+db = rmon_queue_test
+''')
+    os.environ.update(RMON_TESTING='1', RMON_SCHEDULER_ENABLED='0', RMON_CONFIG_FILE=str(config),
+                      RMON_SECRET_KEY='queue-contract-test-only-secret-key-32-chars',
+                      RMON_JWT_ALGORITHM='HS256', RMON_JWT_SECRET_KEY='queue-contract-test-only-jwt-key-32-chars',
+                      RMON_PROMETHEUS_MULTIPROC_DIR=str(root / 'prometheus'))
+    from app.modules.db.db_model import Groups, User, Server, InstallationTasks, OperationJob, OperationLock, conn
+    from app.modules.operations import queue
+    assert conn.database == 'rmon_queue_test'
+    deadline = time.monotonic() + 120
+    while True:
+        try:
+            conn.connect(reuse_if_open=True)
+            break
+        except Exception:
+            if time.monotonic() >= deadline:
+                raise
+            time.sleep(2)
+    assert not conn.get_tables(), 'Use a fresh disposable test database'
+    conn.create_tables([Groups, User, Server, InstallationTasks])
+    spec = importlib.util.spec_from_file_location('queue_migration',
+            Path('/var/www/rmon/app/migrations/20260916000000_add_operation_queue.py'))
+    migration = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(migration)
+    migration.upgrade()
+    migration.upgrade()
+    group = Groups.create(name='Queue test')
+    user = User.create(username='queue-test', email='queue@example.test', role='1', group_id=group.group_id)
+    server = Server.create(hostname='queue-test', ip='192.0.2.10', group_id=str(group.group_id))
+    inventory = {'server': {'hosts': {server.ip: {'action': 'start', 'secret': 'test-only-value'}}}}
+    def enqueue():
+        return queue.enqueue(inventory, [server.ip], 'rmon_agent', 'Agent', 'start', user.user_id)
+    first, second = enqueue(), enqueue()
+    assert 'test-only-value' not in OperationJob.get_by_id(first).payload
+    def claim():
+        try:
+            return queue.claim()
+        finally:
+            conn.close()
+    with concurrent.futures.ThreadPoolExecutor(max_workers=6) as pool:
+        claims = [result for result in pool.map(lambda _: claim(), range(6)) if result]
+    assert len(claims) == 1 and claims[0][0] == first
+    assert queue.load_payload(*claims[0])['inventory'] == inventory
+    assert queue.renew(*claims[0])
+    assert queue.renew(*claims[0])
+    assert queue.finish(*claims[0])
+    previous = queue.claim()
+    assert previous[0] == second
+    OperationJob.update(lease_until=queue.database_time() - timedelta(seconds=1)).where(OperationJob.task == second).execute()
+    assert not queue.renew(*previous)
+    assert not queue.finish(*previous)
+    third = enqueue()
+    assert queue.recover_expired() == 1
+    assert queue.claim() is None
+    OperationJob.update(available_at=queue.database_time()).where(OperationJob.task == second).execute()
+    replacement = queue.claim()
+    assert replacement[0] == second and replacement[1] != previous[1]
+    assert not queue.finish(*previous)
+    assert queue.finish(*replacement)
+    InstallationTasks.update(finish_date=datetime.now() - timedelta(days=31)).where(
+        InstallationTasks.id.in_([first, second])).execute()
+    assert queue.cleanup(batch_size=1) == 2
+    assert not OperationJob.select().where(OperationJob.task.in_([first, second])).exists()
+    assert queue.claim()[0] == third
+    assert queue.cleanup() == 0
+    assert OperationLock.get_by_id(server.server_id).owner
+    try:
+        migration.downgrade()
+    except RuntimeError:
+        pass
+    else:
+        raise AssertionError('Rollback removed a running operation')
+    print(f'{backend}: migration, concurrent claims, FIFO, leases, recovery and cleanup passed', flush=True)
+
+
+def outside(image, source=None, selected_backend=None):
+    def docker(*args, check=True, timeout=300):
+        return subprocess.run(['docker', *args], check=check, capture_output=True, text=True, timeout=timeout)
+    for backend, db_image in [('postgres', 'postgres:16-alpine'), ('mysql', 'mariadb:11.4')]:
+        if selected_backend and backend != selected_backend:
+            continue
+        print(f'{backend}: starting database queue check', flush=True)
+        name = 'rmon-queue-test-' + uuid4().hex[:12]
+        database, client = name + '-db', name + '-client'
+        try:
+            docker('pull', db_image)
+            docker('network', 'create', '--internal', name)
+            env = (['-e', 'POSTGRES_HOST_AUTH_METHOD=trust', '-e', 'POSTGRES_USER=rmon_test', '-e', 'POSTGRES_DB=rmon_queue_test']
+                   if backend == 'postgres' else ['-e', 'MARIADB_ALLOW_EMPTY_ROOT_PASSWORD=1', '-e', 'MARIADB_DATABASE=rmon_queue_test'])
+            settings = (['-c', 'shared_buffers=16MB', '-c', 'max_connections=20'] if backend == 'postgres'
+                        else ['--innodb-buffer-pool-size=32M', '--performance-schema=OFF', '--max-connections=20'])
+            docker('run', '-d', '--name', database, '--network', name, '--network-alias', 'database',
+                   '--memory', '192m', '--memory-swap', '384m', *env, db_image, *settings)
+            mounts = ['-v', str(Path(__file__).resolve()) + ':/queue-smoke.py:ro']
+            if source:
+                mounts += ['-v', str(Path(source).resolve()) + ':/var/www/rmon:ro']
+            result = docker('run', '--name', client, '--network', name, '--memory', '128m', '--memory-swap', '256m',
+                            *mounts, '-e', 'PYTHONPATH=/var/www/rmon', '--entrypoint', 'python',
+                            image, '/queue-smoke.py', '--inside', backend, check=False)
+            print(result.stdout, end='', flush=True)
+            if result.returncode:
+                print(result.stderr, flush=True)
+                raise RuntimeError(f'{backend} queue contract failed')
+        finally:
+            docker('rm', '-fv', client, database, check=False)
+            docker('network', 'rm', name, check=False)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--inside', choices=['postgres', 'mysql'])
+    parser.add_argument('--image', default='rmon-web:test')
+    parser.add_argument('--source')
+    parser.add_argument('--backend', choices=['postgres', 'mysql'])
+    args = parser.parse_args()
+    inside(args.inside) if args.inside else outside(args.image, args.source, args.backend)
diff --git a/tests/security/test_auth_and_scheduler.py b/tests/security/test_auth_and_scheduler.py
index 35c04c9..1b5a8fe 100644
--- a/tests/security/test_auth_and_scheduler.py
+++ b/tests/security/test_auth_and_scheduler.py
@@ -31,6 +31,6 @@ def test_protected_api_requires_a_token(client):
 def test_dedicated_scheduler_runner_matches_application_configuration():
     source = (PROJECT_ROOT / 'scheduler_runner.py').read_text(encoding='utf-8')
 
-    assert "os.environ.setdefault('RMON_SCHEDULER_ENABLED', '1')" in source
+    assert "os.environ['RMON_SCHEDULER_ENABLED'] = '1'" in source
     assert "from app import scheduler" in source
     assert 'threading.Event().wait()' in source
diff --git a/tests/security/test_command_and_ssrf.py b/tests/security/test_command_and_ssrf.py
index bab0092..f7abf61 100644
--- a/tests/security/test_command_and_ssrf.py
+++ b/tests/security/test_command_and_ssrf.py
@@ -42,7 +42,7 @@ def test_agent_http_request_ignores_caller_supplied_host(monkeypatch):
     def get(url, **kwargs):
         captured['url'] = url
         captured['kwargs'] = kwargs
-        return SimpleNamespace(content=b'ok')
+        return SimpleNamespace(content=b'ok', raise_for_status=lambda: None, close=lambda: None)
 
     monkeypatch.setattr(smon_agent, 'get_agent_headers', lambda _agent_id: {'Agent-UUID': 'uuid'})
     monkeypatch.setattr(smon_agent.smon_sql, 'get_agent_data', lambda _agent_id: SimpleNamespace(port=5101))
diff --git a/tests/ui/test_admin_tables.py b/tests/ui/test_admin_tables.py
new file mode 100644
index 0000000..bd5a1dc
--- /dev/null
+++ b/tests/ui/test_admin_tables.py
@@ -0,0 +1,180 @@
+from html.parser import HTMLParser
+from types import SimpleNamespace
+
+import pytest
+from flask import g, render_template
+
+
+class Rows(HTMLParser):
+    def __init__(self, html):
+        super().__init__()
+        self.rows = []
+        self.cell = None
+        self.feed(html)
+
+    def handle_starttag(self, tag, attrs):
+        attrs = dict(attrs)
+        if tag == 'tr':
+            self.rows.append([])
+        if tag in ('th', 'td'):
+            self.cell = {'attrs': attrs, 'actions': [], 'text': ''}
+            self.rows[-1].append(self.cell)
+        if self.cell is not None and (tag == 'button' or attrs.get('onclick') or tag == 'a'):
+            self.cell['actions'].append((tag, attrs))
+
+    def handle_endtag(self, tag):
+        if tag in ('th', 'td'):
+            self.cell = None
+
+    def handle_data(self, data):
+        if self.cell is not None:
+            self.cell['text'] += data
+
+
+def render(app, template, *, role=1, language='en', **context):
+    with app.test_request_context('/admin'):
+        g.user_params = {'role': role, 'group_id': 1}
+        lang = language if template.startswith('ajax/load_') else app.jinja_env.get_template(
+            f'languages/{language}.html').module
+        return render_template(template, lang=lang, **context)
+
+
+def assert_actions(rows, columns):
+    assert rows
+    for row in rows:
+        assert len(row) == columns
+        assert 'actions-column' in row[-1]['attrs'].get('class', '')
+        # Editable fields are data; non-data buttons and links belong to Actions.
+        assert not any(cell['actions'] for cell in row[:-1])
+
+
+@pytest.mark.ui
+@pytest.mark.parametrize('role,columns', [(1, 5), (2, 6)])
+@pytest.mark.parametrize('language', ['en', 'ru', 'fr', 'pt-br'])
+def test_users_have_one_actions_column_and_keep_field_ids(app, role, columns, language):
+    users = [SimpleNamespace(user_id=9, username='alice', email='alice@example.test', enabled=1, ldap_user=0)]
+    html = render(app, 'include/admin_users.html', role=role, language=language, users=users,
+                  users_roles=[], user_roles=[], roles=[])
+    rows = Rows(html).rows
+    assert_actions(rows, columns)
+    assert rows[0][-1]['text'].strip() == 'Actions'
+    for field in ['login-9', 'enabled-9', 'email-9']:
+        assert f'id="{field}"' in html
+    assert 'openChangeUserPasswordDialog' in html
+    assert ('confirmChangeGroupsAndRoles' in html) == (role == 1)
+    fragment = render(app, 'include/admin_users.html', role=role, language=language, adding=True,
+                      users=users, users_roles=[], user_roles=[], roles=[])
+    assert_actions(Rows(fragment).rows, columns)
+
+
+@pytest.mark.ui
+def test_ldap_and_protected_superadmin_do_not_get_password_actions(app):
+    user = SimpleNamespace(user_id=9, username='alice', email='alice@example.test', enabled=1, ldap_user=1)
+    html = render(app, 'include/admin_users.html', users=[user], users_roles=[], user_roles=[], roles=[])
+    assert 'openChangeUserPasswordDialog' not in html
+    user.ldap_user = 0
+    html = render(app, 'include/admin_users.html', role=2, users=[user],
+                  users_roles=[SimpleNamespace(user_role_id=1, user_id=9)], user_roles=[], roles=[])
+    assert 'openChangeUserPasswordDialog' not in html
+    assert 'confirmChangeGroupsAndRoles' not in html
+
+
+@pytest.mark.ui
+@pytest.mark.parametrize('role,columns', [(1, 9), (2, 8)])
+def test_server_actions_share_a_column_in_full_page_and_ajax_fragment(app, role, columns):
+    context = {'servers': [(9, 'test-host', '192.0.2.9', '1', 1, 1, None, 22, 'Test')],
+               'groups': [], 'sshs': []}
+    for adding in [False, True]:
+        html = render(app, 'include/admin_servers.html', role=role, adding=adding, **context)
+        rows = Rows(html).rows
+        assert all(len(row) == columns for row in rows)
+        action_cell = rows[-1][-1]
+        assert 'actions-column' in action_cell['attrs']['class']
+        assert len(action_cell['actions']) == 6
+        for handler in ['checkSshConnect', 'viewFirewallRules', 'showServerInfo', 'cloneServer', 'confirmDeleteServer']:
+            assert any(handler in attrs.get('onclick', '') for _, attrs in action_cell['actions'])
+        for field in ['hostname-9', 'ip-9', 'port-9', 'server_enabled-9', 'credentials-9', 'desc-9',
+                      'server_info_link-9', 'clone-9']:
+            assert f'id="{field}"' in html
+
+
+@pytest.mark.ui
+@pytest.mark.parametrize('shared,group,action_count', [(0, 1, 1), (1, 1, 1), (1, 2, 0)])
+def test_ssh_delete_menu_respects_shared_credential_ownership(app, shared, group, action_count):
+    ssh = SimpleNamespace(id=9, name='test-ssh', key_enabled=1, group_id=group, shared=shared, username='ubuntu')
+    html = render(app, 'ajax/new_ssh.html', sshs=[ssh], groups=[])
+    rows = Rows(html).rows
+    assert_actions(rows, 6)
+    assert len(rows[0][-1]['actions']) == action_count
+
+
+@pytest.mark.ui
+def test_services_have_one_actions_column_and_native_disabled_controls(app):
+    services = [('rmon-server', 'active', {'current_version': '6.33'}),
+                ('fail2ban', 'inactive', {'current_version': '1.0'})]
+    html = render(app, 'ajax/load_services.html', services=services)
+    rows = Rows(html).rows
+    assert_actions(rows, 4)
+    assert 'disabled' in rows[0][-1]['actions'][0][1]
+    assert 'disabled' in rows[1][-1]['actions'][2][1]
+    missing = render(app, 'ajax/load_services.html', services=[
+        ('fail2ban', 'missing', {'current_version': '* is not installed'})])
+    assert len(Rows(missing).rows[0][-1]['actions']) == 1
+    assert 'id="restart-rmon-server"' in html
+
+
+@pytest.mark.ui
+def test_update_rows_have_matching_columns_with_and_without_available_updates(app):
+    for need_update in [False, True]:
+        html = render(app, 'ajax/load_updateroxywi.html',
+                      versions={'need_update': need_update, 'current_ver': '1.4.0', 'new_ver': '1.4.1'},
+                      services=[('rmon-server', 'active', {'current_version': '6.33', 'new_version': '6.34', 'update_available': True})])
+        rows = Rows(html).rows
+        assert all(len(row) == 5 for row in rows)
+        assert len(rows[0][-1]['actions']) == int(need_update)
+        assert len(rows[1][-1]['actions']) == 1
+        assert all('actions-column' in row[-1]['attrs']['class'] for row in rows)
+
+
+@pytest.mark.ui
+@pytest.mark.parametrize('language,missing,unknown', [
+    ('en', 'Not installed', 'Version unavailable'),
+    ('ru', 'Не установлен', 'Версия недоступна'),
+    ('fr', 'Non installé', 'Version indisponible'),
+    ('pt-br', 'Não instalado', 'Versão indisponível'),
+])
+@pytest.mark.parametrize('template', ['ajax/load_updateroxywi.html', 'ajax/load_services.html'])
+def test_service_versions_distinguish_source_install_missing_and_unknown(app, language, missing, unknown, template):
+    def details(version, installed, update=False):
+        return {'current_version': version, 'new_version': '6.34', 'installed': installed,
+                'version_known': version != '0', 'update_available': update}
+    kwargs = {'versions': {'current_ver': '1.4.0', 'new_ver': '1.3.0', 'need_update': False}}
+    html = render(app, template, language=language, services=[
+        ('rmon-server', 'active', details('6.33', True, True)),
+    ], **kwargs)
+    assert '6.33' in html
+    assert "updateService('rmon-server', 'install')" not in html
+    html = render(app, template, language=language,
+                  services=[('rmon-server', 'inactive', details('0', False))], **kwargs)
+    assert missing in html
+    assert "updateService('rmon-server', 'install')" in html
+    html = render(app, template, language=language,
+                  services=[('rmon-server', 'active', details('0', True))], **kwargs)
+    assert unknown in html
+    assert "updateService('rmon-server', 'install')" not in html
+
+
+@pytest.mark.ui
+def test_admin_page_buttons_have_their_own_inset_toolbar(client, auth_headers):
+    html = client.get('/admin', headers=auth_headers(1, 1)).get_data(as_text=True)
+    assert html.count('class="admin-page-actions"') == 2
+
+
+@pytest.mark.ui
+def test_container_update_links_to_docker_instead_of_installing_packages(app):
+    html = render(app, 'ajax/load_updateroxywi.html',
+                  versions={'need_update': False, 'current_ver': '1.4.0', 'new_ver': '1.4.0'},
+                  services=[('rmon-server', 'active', {'current_version': '6.33', 'new_version': '6.34',
+                            'update_available': True, 'managed_by': 'docker', 'installed': True})])
+    assert 'https://rmon.io/installation#standalone-server' in html
+    assert "updateService('rmon-server'" not in html
diff --git a/tests/ui/test_pages.py b/tests/ui/test_pages.py
index a468252..61e7b39 100644
--- a/tests/ui/test_pages.py
+++ b/tests/ui/test_pages.py
@@ -1,5 +1,6 @@
 from collections import Counter
 from html.parser import HTMLParser
+from pathlib import Path
 from types import SimpleNamespace
 from urllib.parse import parse_qs, urlsplit
 
@@ -31,6 +32,15 @@
 SUPPORTED_LANGUAGES = ('en', 'ru', 'fr', 'pt-br')
 
 
+@pytest.mark.ui
+@pytest.mark.parametrize('language', SUPPORTED_LANGUAGES)
+def test_admin_settings_remain_available_without_broker_in_every_language(client, auth_headers, language):
+    client.set_cookie('lang', language)
+    document = _document(client.get('/admin', headers=auth_headers(1, 1)))
+    assert {'main-section-head', 'smon-section-head', 'mail-section-head', 'agent-section-head'} <= set(document.ids)
+    assert document.find(element_id='rabbitmq-section-head') is None
+
+
 class HtmlDocument(HTMLParser):
     def __init__(self):
         super().__init__(convert_charrefs=True)
@@ -146,8 +156,10 @@ def test_authenticated_core_ui_pages_render(
 
     assert expected_ids <= set(document.ids)
     assert document.find(element_id='top-link') is not None
-    assert document.find(tag='input', element_id='user_group_socket')['value'] == '1'
-    assert document.find(tag='input', element_id='user_id_socket')['value'] == '1'
+    assert document.find(element_id='disable_alerting') is None
+    assert document.find(element_id='user_group_socket') is None
+    assert document.find(element_id='user_id_socket') is None
+    assert not any('reconnecting-websocket' in asset or 'ion.sound' in asset for asset in document.local_assets)
 
     for asset in document.local_assets:
         asset_response = client.get(asset)
@@ -293,3 +305,101 @@ def test_ui_templates_and_language_catalogs_compile(app):
             assert app.jinja_env.get_template(template)
         for language in SUPPORTED_LANGUAGES:
             assert app.jinja_env.get_template(f'languages/{language}.html')
+
+
+@pytest.mark.ui
+@pytest.mark.parametrize('path', ('/login',) + PRIVATE_UI_PATHS)
+def test_pages_support_mobile_viewport_and_load_shared_interactions(client, auth_headers, monkeypatch, path):
+    monkeypatch.setattr('app.modules.tools.common.is_tool_active', lambda _name: 'active')
+    document = _document(client.get(path, headers=auth_headers(1, 1)))
+    viewport = [a for a in document.find_all(tag='meta') if a.get('name') == 'viewport']
+    assert len(viewport) == 1
+    assert 'width=device-width' in viewport[0]['content']
+    assert 'user-scalable=no' not in viewport[0]['content']
+    assert {'/static/css/ux.css', '/static/js/ux.js'} <= document.local_assets
+
+
+@pytest.mark.ui
+def test_login_controls_have_labels_password_manager_hints_and_live_errors(client):
+    document = _document(client.get('/login'))
+    assert {'login', 'pass'} <= {a.get('for') for a in document.find_all(tag='label')}
+    assert document.find(element_id='login')['autocomplete'] == 'username'
+    assert document.find(element_id='pass')['autocomplete'] == 'current-password'
+    toggle, = document.find_all(tag='button', class_name='password-toggle')
+    assert toggle['type'] == 'button'
+    assert toggle['aria-controls'] == 'pass'
+    assert toggle['aria-pressed'] == 'false'
+    assert toggle['aria-label']
+    assert document.find(element_id='wrong-login')['role'] == 'alert'
+
+
+@pytest.mark.ui
+def test_app_shell_exposes_keyboard_navigation_and_correct_overview_links(client, auth_headers):
+    document = _document(client.get('/overview', headers=auth_headers(1, 1)))
+    toggle = document.find(tag='button', element_id='menu-toggle')
+    assert document.find(tag='aside', element_id=toggle['aria-controls'])
+    assert document.find(tag='main', element_id='main-content')['tabindex'] == '-1'
+    assert document.find_all(tag='a', class_name='skip-link')[0]['href'] == '#main-content'
+    links = {a.get('href') for a in document.find_all(tag='a')}
+    assert {'/admin#servers', '/admin#users', '/admin#groups', '/admin#tools', '/logs/internal'} <= links
+    assert not any(link and link.startswith('/app/') for link in links)
+    assert document.find(tag='button', element_id='show-user-settings-button')
+    for button in document.find_all(tag='button', class_name='icon-button'):
+        assert button.get('aria-label') or button.get('id') == 'show-user-settings-button'
+
+
+@pytest.mark.ui
+def test_status_editor_preview_matches_public_route(client, auth_headers, monkeypatch):
+    monkeypatch.setattr('app.modules.tools.common.is_tool_active', lambda _name: 'active')
+    document = _document(client.get('/rmon/status-page', headers=auth_headers(1, 1)))
+    assert document.find(element_id='status-page-url-preview')['data-prefix'] == '/rmon/status/'
+    assert document.find(element_id='status-pages-empty') is not None
+    assert {'new-status-page-name', 'new-status-page-slug'} <= {
+        a.get('for') for a in document.find_all(tag='label')
+    }
+
+
+@pytest.mark.ui
+@pytest.mark.parametrize('language', SUPPORTED_LANGUAGES)
+def test_ux_messages_are_translated_consistently(app, language):
+    with app.app_context():
+        english = app.jinja_env.get_template('languages/en.html').module.ux
+        translated = app.jinja_env.get_template(f'languages/{language}.html').module.ux
+    assert translated.keys() == english.keys()
+    assert all(isinstance(message, str) and message.strip() for message in translated.values())
+
+
+@pytest.mark.ui
+def test_check_editor_fixture_matches_the_real_rendered_template(app):
+    """Keep the DOM used by JavaScript workflow tests aligned with the actual form."""
+    with app.test_request_context():
+        env = app.jinja_env
+        macros = env.get_template('include/input_macros.html').module
+        rendered = env.get_template('include/smon/add_form.html').render(
+            lang=env.get_template('languages/en.html').module, chosen_lang='en',
+            input=macros.input, select=macros.select, checkbox=macros.checkbox,
+            telegrams=[], slacks=[], pds=[], mms=[], emails=[], incidentrelay=[],
+        )
+    fixture = Path(__file__).resolve().parents[1] / 'frontend/fixtures/check-editor.html'
+    assert rendered.strip() == fixture.read_text(encoding='utf-8').strip()
+    document = HtmlDocument()
+    document.feed(rendered)
+    _assert_unique_ids(document, set(document.ids))
+    assert len([a for a in document.find_all(tag='section') if a.get('role') == 'tabpanel']) == 3
+    labels = {label.get('for') for label in document.find_all(tag='label')}
+    assert {'new-smon-name', 'new-smon-url', 'new-smon-place', 'check_type',
+            'new-smon-port', 'new-smon-interval', 'new-smon-timeout'} <= labels
+    for tab in document.find_all(tag='button'):
+        if tab.get('role') == 'tab':
+            panel = document.find(element_id=tab['aria-controls'])
+            assert panel['aria-labelledby'] == tab['id']
+
+
+@pytest.mark.ui
+@pytest.mark.parametrize('language', SUPPORTED_LANGUAGES)
+def test_check_editor_messages_are_translated_consistently(app, language):
+    with app.app_context():
+        english = app.jinja_env.get_template('languages/en.html').module.check_editor
+        translated = app.jinja_env.get_template(f'languages/{language}.html').module.check_editor
+    assert translated.keys() == english.keys()
+    assert all(isinstance(message, str) and message.strip() for message in translated.values())