chore(release): v0.2.0 — System TLS rationale + version bump + CHANGELOG

- System page: collapsible "Warum läuft TLS über Caddy?" explaining the single host-exposed TLS terminator (auto Let's Encrypt + auto-renew + wss for Reverb, decoupled from app updates) — answers the operator's question in the UI; Caddy stays. - Bump 0.1.1 -> 0.2.0 (cross-OS management, firewall + fail2ban control, command palette) + CHANGELOG entry. Pint clean; Codex review clean; R12 — all 9 routes HTTP 200, 0 console errors, TLS note renders. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat(ux): command palette (Strg/⌘-K) + keyboard shortcuts
2026-06-13 20:43:07 +02:00 · 2026-06-13 20:38:22 +02:00 · 2026-06-13 20:27:55 +02:00 · 2026-06-13 19:53:52 +02:00 · 2026-06-13 18:30:25 +02:00
29 changed files with 2607 additions and 241 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -13,6 +13,41 @@ getaggte Releases (Kanal `stable`, optional `beta`) — niemals Entwicklungs-Bui

 _Keine offenen Änderungen — der nächste Stand wird hier gesammelt und als `vX.Y.Z` getaggt._

+## [0.2.0] - 2026-06-13
+
+Mehr-Betriebssystem-Verwaltung, echte Firewall- und fail2ban-Steuerung aus dem Dashboard sowie eine Tastatur-/Befehls-Bedienung.
+
+### Hinzugefügt
+- **OS-Abstraktion**: Updates, Härtung und Firewall laufen jetzt über **apt, dnf und
+  zypper** (Debian/Ubuntu, RHEL/Fedora/Rocky/Alma, openSUSE). Das Betriebssystem wird
+  erkannt und auf der Server-Detailseite angezeigt (Paketverwaltung/Firewall). Arch
+  und Alpine werden erkannt; nicht unterstützte Funktionen werden mit deutschem
+  Hinweis sauber deaktiviert statt fehlzuschlagen.
+- **Firewall-Regeln (UFW)**: Regeln ansehen, hinzufügen und löschen samt
+  Standard-Anzeige — mit Aussperr-Schutz (SSH-Regeln/-Port, deny ohne Port). firewalld
+  wird nur angezeigt (Laufzeit aller aktiven Zonen inkl. Rich Rules); Regelverwaltung
+  bleibt vorerst UFW.
+- **fail2ban-Status**: Jails mit Zählern, **gebannte IPs sehen und entsperren**,
+  IP manuell sperren (R5-Dialog, Aussperr-Schutz für Loopback + eigenen Zugang) und
+  **Whitelist (ignoreip)** verwalten.
+- **Befehls-Palette (Strg/⌘-K)** + Tastenkürzel: Schnell-Navigation (Leader „g“),
+  Seitensuche („/“), Hilfe („?“).
+
+### Geändert
+- System-Updates verwenden je Distribution den passenden Paketmanager
+  (Audit-Aktion `system.package_upgrade`).
+- fail2ban-Tuning und -Whitelist liegen in getrennten Drop-ins, damit Änderungen sich
+  nicht gegenseitig überschreiben; das frühere Einzel-Drop-in wird migriert.
+- Server-Detailseite zeigt erkanntes System, Paketverwaltung und Firewall-Werkzeug.
+- System-Seite erklärt jetzt, warum TLS über Caddy terminiert wird.
+
+### Sicherheit
+- Firewall: race-freies Löschen per Regel-Spezifikation (keine Regelnummern),
+  Whitelisting gegen Befehls-Injection, firewalld-Lockout-Schutz (Ports vor dem Start
+  in der permanenten Konfiguration).
+- fail2ban: kanonischer (inet_pton) Schutz gegen das Sperren des eigenen Zugangs,
+  ignoreip wird verbatim erhalten (inkl. Hostnames/Fortsetzungszeilen).
+
 ## [0.1.1] - 2026-06-13

 Wartungs-Release: vollständige Code-Auditierung, Entfernung von totem Code und ein behobenes Open-Redirect. Keine funktionalen Änderungen für Nutzer.
@ -79,6 +114,7 @@ Erste geschnittene Version — die komplette v1-Basis inklusive Server- und Pane
 - Release-/Versionierungsmodell: echte semantische Versionen + Git-Tags, Changelog
  pro Version, Kanäle `stable`/`beta` (kein nutzer-seitiges `dev`).

-[Unreleased]: https://git.bave.dev/boban/clusev/compare/v0.1.1...HEAD
+[Unreleased]: https://git.bave.dev/boban/clusev/compare/v0.2.0...HEAD
+[0.2.0]: https://git.bave.dev/boban/clusev/compare/v0.1.1...v0.2.0
 [0.1.1]: https://git.bave.dev/boban/clusev/compare/v0.1.0...v0.1.1
 [0.1.0]: https://git.bave.dev/boban/clusev/releases/tag/v0.1.0
--- a/app/Livewire/Modals/ConfirmAction.php
+++ b/app/Livewire/Modals/ConfirmAction.php
@ -39,6 +39,8 @@ class ConfirmAction extends ModalComponent
    /** @var array<string, mixed> */
    public array $params = [];

+    /** Toast shown on confirm. Pass '' to defer the notification to the handler
+     *  (e.g. when the real outcome is only known after a remote command runs). */
    public string $notify = 'Aktion ausgeführt.';

    public static function modalMaxWidth(): string
@ -63,7 +65,10 @@ class ConfirmAction extends ModalComponent
            $this->dispatch($this->event, ...$this->params);
        }

-        $this->dispatch('notify', message: $this->notify);
+        // Empty notify = the handler will report the real outcome itself.
+        if ($this->notify !== '') {
+            $this->dispatch('notify', message: $this->notify);
+        }

        $this->closeModal();
    }
--- a/app/Livewire/Modals/Fail2banBan.php
+++ b/app/Livewire/Modals/Fail2banBan.php
@ -0,0 +1,88 @@
+<?php
+
+namespace App\Livewire\Modals;
+
+use App\Models\AuditEvent;
+use App\Models\Server;
+use App\Services\Fail2banService;
+use Illuminate\Support\Facades\Auth;
+use LivewireUI\Modal\ModalComponent;
+use Throwable;
+
+/**
+ * Manually ban an IP in a fail2ban jail (R5: a deliberate confirm dialog, not a
+ * native popup). Fail2banService refuses to ban loopback or Clusev's own connection,
+ * so this can never lock the operator out.
+ */
+class Fail2banBan extends ModalComponent
+{
+    public int $serverId;
+
+    /** @var array<int, string> */
+    public array $jails = [];
+
+    public string $jail = '';
+
+    public string $ip = '';
+
+    public ?string $error = null;
+
+    /**
+     * @param  array<int, string>  $jails
+     */
+    public function mount(int $serverId, array $jails = []): void
+    {
+        $this->serverId = $serverId;
+        $this->jails = array_values($jails);
+        $this->jail = $this->jails[0] ?? 'sshd';
+    }
+
+    public static function modalMaxWidth(): string
+    {
+        return 'lg';
+    }
+
+    public function save(Fail2banService $fail2ban): void
+    {
+        $this->error = null;
+
+        $server = Server::find($this->serverId);
+        if (! $server) {
+            $this->error = 'Server nicht gefunden.';
+
+            return;
+        }
+
+        try {
+            $res = $fail2ban->ban($server, $this->jail, trim($this->ip));
+        } catch (Throwable $e) {
+            $this->error = $e->getMessage();
+
+            return;
+        }
+
+        if (! $res['ok']) {
+            $this->error = $res['output'] !== '' ? $res['output'] : 'Sperren fehlgeschlagen.';
+
+            return;
+        }
+
+        AuditEvent::create([
+            'user_id' => Auth::id(),
+            'server_id' => $server->id,
+            'actor' => Auth::user()?->name ?? 'system',
+            'action' => 'fail2ban.ban',
+            'target' => trim($this->ip).' · '.$this->jail.' · '.$server->name,
+            'ip' => request()->ip(),
+        ]);
+
+        $this->dispatch('fail2banChanged');
+        $this->dispatch('notify', message: 'IP '.trim($this->ip).' gesperrt.');
+        $this->closeModal();
+    }
+
+    public function render()
+    {
+        return view('livewire.modals.fail2ban-ban');
+    }
+}
--- a/app/Livewire/Modals/Fail2banConfig.php
+++ b/app/Livewire/Modals/Fail2banConfig.php
@ -4,7 +4,7 @@ namespace App\Livewire\Modals;

 use App\Models\AuditEvent;
 use App\Models\Server;
-use App\Services\MaintenanceService;
+use App\Services\Fail2banService;
 use Illuminate\Support\Facades\Auth;
 use LivewireUI\Modal\ModalComponent;
 use Throwable;
@ -33,7 +33,7 @@ class Fail2banConfig extends ModalComponent
    /** True only once the current policy was read — guards save() from overwriting with unseen defaults. */
    public bool $loaded = false;

-    public function mount(int $serverId, MaintenanceService $maintenance): void
+    public function mount(int $serverId, Fail2banService $fail2ban): void
    {
        $this->serverId = $serverId;

@ -47,7 +47,7 @@ class Fail2banConfig extends ModalComponent
        $this->serverName = $server->name;

        try {
-            $current = $maintenance->readFail2ban($server);
+            $current = $fail2ban->readConfig($server);
            $this->bantime = $current['bantime'];
            $this->maxretry = $current['maxretry'];
            $this->findtime = $current['findtime'];
@ -62,7 +62,7 @@ class Fail2banConfig extends ModalComponent
        return 'lg';
    }

-    public function save(MaintenanceService $maintenance): void
+    public function save(Fail2banService $fail2ban): void
    {
        // Never overwrite the remote policy with defaults the operator never saw —
        // saving is only allowed once the current values were read successfully.
@ -99,8 +99,9 @@ class Fail2banConfig extends ModalComponent
        }

        try {
-            // Values are already validated/clamped to the allowed ranges above.
-            $result = $maintenance->writeFail2ban(
+            // Tuning lives in its OWN drop-in (separate from the whitelist), so this can
+            // never touch ignoreip. Values were validated/clamped above.
+            $result = $fail2ban->writeTuning(
                $server,
                (string) $validated['bantime'],
                (int) $validated['maxretry'],
--- a/app/Livewire/Modals/FirewallRule.php
+++ b/app/Livewire/Modals/FirewallRule.php
@ -0,0 +1,108 @@
+<?php
+
+namespace App\Livewire\Modals;
+
+use App\Models\AuditEvent;
+use App\Models\Server;
+use App\Services\FirewallService;
+use Illuminate\Support\Facades\Auth;
+use LivewireUI\Modal\ModalComponent;
+use Throwable;
+
+/**
+ * Add a firewall rule. For ufw the operator picks action/protocol/port/source; for
+ * firewalld (an allow-list default zone) it opens a port. All validation happens in
+ * FirewallService — this modal only collects and forwards. Adding is non-destructive,
+ * so no R5 confirm (deleting a rule is the guarded path).
+ */
+class FirewallRule extends ModalComponent
+{
+    public int $serverId;
+
+    public string $tool = 'ufw';
+
+    public string $action = 'allow';
+
+    public string $proto = 'tcp';
+
+    public string $port = '';
+
+    public string $from = '';
+
+    public ?string $error = null;
+
+    public function mount(int $serverId, string $tool = 'ufw'): void
+    {
+        $this->serverId = $serverId;
+        $this->tool = $tool === 'firewalld' ? 'firewalld' : 'ufw';
+    }
+
+    public static function modalMaxWidth(): string
+    {
+        return 'lg';
+    }
+
+    public function save(FirewallService $firewall): void
+    {
+        $this->error = null;
+
+        $server = Server::find($this->serverId);
+        if (! $server) {
+            $this->error = 'Server nicht gefunden.';
+
+            return;
+        }
+
+        $port = trim($this->port) !== '' ? (int) $this->port : null;
+
+        try {
+            $res = $firewall->addRule($server, $this->action, $this->proto, $port, $this->from);
+        } catch (Throwable $e) {
+            $this->error = $e->getMessage();
+
+            return;
+        }
+
+        if (! $res['ok']) {
+            $this->error = $res['output'] !== '' ? $res['output'] : 'Regel konnte nicht hinzugefügt werden.';
+
+            return;
+        }
+
+        AuditEvent::create([
+            'user_id' => Auth::id(),
+            'server_id' => $server->id,
+            'actor' => Auth::user()?->name ?? 'system',
+            'action' => 'firewall.rule_add',
+            'target' => $server->name.' · '.$this->summary($port),
+            'ip' => request()->ip(),
+        ]);
+
+        $this->dispatch('firewallChanged');
+        $this->dispatch('notify', message: 'Firewall-Regel hinzugefügt.');
+        $this->closeModal();
+    }
+
+    /** Short human summary of the rule for the audit log. */
+    private function summary(?int $port): string
+    {
+        if ($this->tool === 'firewalld') {
+            return 'Port '.$port.'/'.($this->proto === 'udp' ? 'udp' : 'tcp').' geöffnet';
+        }
+
+        $parts = [$this->action];
+        if ($port !== null) {
+            $parts[] = $port.($this->proto !== 'any' ? '/'.$this->proto : '');
+        }
+        if (trim($this->from) !== '') {
+            $parts[] = 'von '.trim($this->from);
+        }
+
+        return implode(' ', $parts);
+    }
+
+    public function render()
+    {
+        return view('livewire.modals.firewall-rule');
+    }
+}
--- a/app/Livewire/Modals/SystemUpdate.php
+++ b/app/Livewire/Modals/SystemUpdate.php
@ -10,10 +10,11 @@ use LivewireUI\Modal\ModalComponent;
 use Throwable;

 /**
- * Apply pending apt package updates (Debian/Ubuntu only). mount() reads whether
- * apt exists + the pending count; the body explains in GERMAN what happens — never
- * a shell command. „Jetzt aktualisieren" runs the upgrade, AUDITs, notifies, and
- * keeps the modal open showing a clean German result.
+ * Apply pending package updates across apt/dnf/zypper (resolved per OS). mount()
+ * reads whether updates are supported on this host + the pending count; the body
+ * explains in GERMAN what happens — never a shell command. „Jetzt aktualisieren"
+ * runs the upgrade, AUDITs, notifies, and keeps the modal open showing a clean
+ * German result. Unsupported hosts (e.g. Arch/Alpine) get a German reason instead.
 */
 class SystemUpdate extends ModalComponent
 {
@ -21,7 +22,11 @@ class SystemUpdate extends ModalComponent

    public string $serverName = '';

-    public bool $hasApt = false;
+    /** True when Clusev can manage package updates on this host. */
+    public bool $supported = false;
+
+    /** German reason shown when updates are not supported on this OS. */
+    public ?string $unsupportedReason = null;

    /** Pending upgrade count, or null when it could not be determined ("unbekannt"). */
    public ?int $pending = null;
@ -30,7 +35,7 @@ class SystemUpdate extends ModalComponent

    public bool $ok = false;

-    /** Trimmed apt output, only shown when the upgrade failed. */
+    /** Trimmed package-manager output, only shown when the upgrade failed. */
    public string $output = '';

    public ?string $error = null;
@ -49,8 +54,9 @@ class SystemUpdate extends ModalComponent
        $this->serverName = $server->name;

        try {
-            $this->hasApt = $maintenance->hasApt($server);
-            $this->pending = $this->hasApt ? $maintenance->pendingUpdates($server) : null;
+            $this->unsupportedReason = $maintenance->updateSupport($server);
+            $this->supported = $this->unsupportedReason === null;
+            $this->pending = $this->supported ? $maintenance->pendingUpdates($server) : null;
        } catch (Throwable $e) {
            $this->error = $e->getMessage();
        }
@ -63,7 +69,7 @@ class SystemUpdate extends ModalComponent

    public function upgrade(MaintenanceService $maintenance): void
    {
-        if ($this->error !== null || $this->done || ! $this->hasApt) {
+        if ($this->error !== null || $this->done || ! $this->supported) {
            return;
        }

@ -75,7 +81,7 @@ class SystemUpdate extends ModalComponent
        }

        try {
-            $result = $maintenance->aptUpgrade($server);
+            $result = $maintenance->applyUpgrades($server);
        } catch (Throwable $e) {
            $this->done = true;
            $this->ok = false;
@ -95,7 +101,7 @@ class SystemUpdate extends ModalComponent
            'user_id' => Auth::id(),
            'server_id' => $server->id,
            'actor' => Auth::user()?->name ?? 'system',
-            'action' => 'system.apt_upgrade',
+            'action' => 'system.package_upgrade',
            'target' => $server->name.($this->ok ? '' : ' (fehlgeschlagen)'),
            'ip' => request()->ip(),
        ]);
--- a/app/Livewire/Servers/Show.php
+++ b/app/Livewire/Servers/Show.php
@ -4,9 +4,13 @@ namespace App\Livewire\Servers;

 use App\Models\AuditEvent;
 use App\Models\Server;
+use App\Services\Fail2banService;
+use App\Services\FirewallService;
 use App\Services\FleetService;
 use App\Services\HardeningService;
+use App\Support\Os\OsDetector;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
 use Livewire\Attributes\Layout;
 use Livewire\Attributes\On;
 use Livewire\Attributes\Title;
@ -32,6 +36,18 @@ class Show extends Component

    public array $hardening = [];

+    /** Firewall state (installed/active/defaults/rules) for the Firewall-Regeln panel. */
+    public array $firewall = [];
+
+    /** fail2ban state (jails/banned IPs/whitelist) for the fail2ban-Status panel. */
+    public array $fail2ban = [];
+
+    /** Input for adding an IP/CIDR to the fail2ban whitelist. */
+    public string $newIgnoreIp = '';
+
+    /** Detected OS tooling (family/package manager/firewall) for the identity panel. */
+    public array $os = [];
+
    public array $sshKeys = [];

    /**
@ -76,12 +92,42 @@ class Show extends Component
            $this->interfaces = $snap['interfaces'];
            $this->sshKeys = $snap['sshKeys'];

+            // Detected OS profile (cached) — surfaces the package manager + firewall
+            // tooling and drives which hardening features are offered.
+            try {
+                // fresh probe on each full load; primes the 1h cache the hardening,
+                // firewall and update reads reuse within this request cycle.
+                $profile = app(OsDetector::class)->detect($this->server, fresh: true);
+                $this->os = [
+                    'familyLabel' => $profile->familyLabel(),
+                    'packageManager' => $profile->packageManager,
+                    'firewallTool' => $profile->firewallTool,
+                    'serviceManager' => $profile->serviceManager,
+                ];
+            } catch (Throwable) {
+                $this->os = [];
+            }
+
            // Hardening state is a separate PRIVILEGED read (sshd -T + pkg checks).
            try {
                $this->hardening = app(HardeningService::class)->state($this->server);
            } catch (Throwable) {
                $this->hardening = [];
            }
+
+            // Firewall rules/defaults (separate PRIVILEGED read; empty on failure).
+            try {
+                $this->firewall = app(FirewallService::class)->status($this->server);
+            } catch (Throwable) {
+                $this->firewall = [];
+            }
+
+            // fail2ban jails/banned IPs/whitelist (separate PRIVILEGED read).
+            try {
+                $this->fail2ban = app(Fail2banService::class)->status($this->server);
+            } catch (Throwable) {
+                $this->fail2ban = [];
+            }
            $this->loadAvg = (float) ($snap['metrics']['load'] ?? 0);
            $this->connected = true;
        } catch (Throwable) {
@ -252,6 +298,190 @@ class Show extends Component
        $this->load($fleet);
    }

+    /**
+     * Delete a firewall rule (R5): opens the confirm modal, which writes the
+     * AuditEvent and re-dispatches `firewallRuleDelete` (handled below).
+     */
+    public function confirmDeleteRule(int $index): void
+    {
+        $rule = $this->firewall['rules'][$index] ?? null;
+        if ($rule === null) {
+            return;
+        }
+        $spec = $rule['spec'] ?? '';
+        $label = $rule['label'] ?? ($rule['raw'] ?? $spec);
+
+        $this->dispatch('openModal',
+            component: 'modals.confirm-action',
+            arguments: [
+                'heading' => 'Firewall-Regel entfernen',
+                'body' => "Die Regel „{$label}“ wird aus der Firewall von {$this->server->name} entfernt.",
+                'confirmLabel' => 'Entfernen',
+                'danger' => true,
+                'icon' => 'trash',
+                // No premature audit/notify — the handler records the real outcome
+                // only after the remote command returns (audit reflects success).
+                'event' => 'firewallRuleDelete',
+                'params' => ['spec' => $spec, 'label' => $label],
+                'notify' => '',
+            ],
+        );
+    }
+
+    /** Applies the confirmed rule deletion over SSH, then audits + reloads on success. */
+    #[On('firewallRuleDelete')]
+    public function deleteFirewallRule(string $spec, string $label, FirewallService $firewall): void
+    {
+        try {
+            $res = $firewall->deleteRule($this->server, $spec);
+        } catch (Throwable $e) {
+            $this->dispatch('notify', message: 'Entfernen fehlgeschlagen: '.Str::limit($e->getMessage(), 90));
+
+            return;
+        }
+
+        // The rule was already gone — inform, refresh, but do NOT audit a non-event.
+        if (! empty($res['notFound'])) {
+            $this->dispatch('notify', message: 'Regel existiert nicht mehr.');
+            $this->reloadFirewall($firewall);
+
+            return;
+        }
+
+        if (! $res['ok']) {
+            $this->dispatch('notify', message: 'Entfernen fehlgeschlagen: '.Str::limit($res['output'] ?: 'unbekannt', 90));
+
+            return;
+        }
+
+        AuditEvent::create([
+            'user_id' => Auth::id(),
+            'server_id' => $this->server->id,
+            'actor' => Auth::user()?->name ?? 'system',
+            'action' => 'firewall.rule_delete',
+            'target' => $label.' · '.$this->server->name,
+            'ip' => request()->ip(),
+        ]);
+
+        $this->dispatch('notify', message: 'Firewall-Regel entfernt.');
+        $this->reloadFirewall($firewall);
+    }
+
+    /** Re-read the firewall state after an add/delete/default change. */
+    #[On('firewallChanged')]
+    public function reloadFirewall(FirewallService $firewall): void
+    {
+        try {
+            $this->firewall = $firewall->status($this->server);
+        } catch (Throwable) {
+            // keep the current state on failure
+        }
+    }
+
+    /** Unban a fail2ban IP — recovery action, so a direct (audited) click, no R5 modal. */
+    public function unbanIp(string $jail, string $ip, Fail2banService $fail2ban): void
+    {
+        try {
+            $res = $fail2ban->unban($this->server, $jail, $ip);
+        } catch (Throwable $e) {
+            $this->dispatch('notify', message: 'Entsperren fehlgeschlagen: '.Str::limit($e->getMessage(), 90));
+
+            return;
+        }
+        if (! $res['ok']) {
+            $this->dispatch('notify', message: 'Entsperren fehlgeschlagen: '.Str::limit($res['output'] ?: 'unbekannt', 90));
+
+            return;
+        }
+
+        $this->audit('fail2ban.unban', $ip.' · '.$jail.' · '.$this->server->name);
+        $this->dispatch('notify', message: "IP {$ip} entsperrt.");
+        $this->reloadFail2ban($fail2ban);
+    }
+
+    /** Add an IP/CIDR to the fail2ban whitelist (ignoreip) — non-destructive, direct + audited. */
+    public function addIgnore(Fail2banService $fail2ban): void
+    {
+        $ip = trim($this->newIgnoreIp);
+        if ($ip === '') {
+            return;
+        }
+
+        try {
+            $res = $fail2ban->addIgnoreIp($this->server, $ip);
+        } catch (Throwable $e) {
+            $this->dispatch('notify', message: 'Whitelist: '.Str::limit($e->getMessage(), 90));
+
+            return;
+        }
+        if (! $res['ok']) {
+            $this->dispatch('notify', message: 'Whitelist: '.Str::limit($res['output'] ?: 'fehlgeschlagen', 90));
+
+            return;
+        }
+        if (! empty($res['noop'])) {
+            $this->newIgnoreIp = '';
+            $this->dispatch('notify', message: $res['output']);
+
+            return;
+        }
+
+        $this->audit('fail2ban.ignoreip_add', $ip.' · '.$this->server->name);
+        $this->newIgnoreIp = '';
+        $this->dispatch('notify', message: "{$ip} zur Whitelist hinzugefügt.");
+        $this->reloadFail2ban($fail2ban);
+    }
+
+    /** Remove an IP/CIDR from the fail2ban whitelist — direct + audited (loopback is refused by the service). */
+    public function removeIgnore(string $ip, Fail2banService $fail2ban): void
+    {
+        try {
+            $res = $fail2ban->removeIgnoreIp($this->server, $ip);
+        } catch (Throwable $e) {
+            $this->dispatch('notify', message: 'Whitelist: '.Str::limit($e->getMessage(), 90));
+
+            return;
+        }
+        if (! $res['ok']) {
+            $this->dispatch('notify', message: 'Whitelist: '.Str::limit($res['output'] ?: 'fehlgeschlagen', 90));
+
+            return;
+        }
+        if (! empty($res['noop'])) {
+            $this->dispatch('notify', message: $res['output']);
+
+            return;
+        }
+
+        $this->audit('fail2ban.ignoreip_remove', $ip.' · '.$this->server->name);
+        $this->dispatch('notify', message: "{$ip} von der Whitelist entfernt.");
+        $this->reloadFail2ban($fail2ban);
+    }
+
+    /** Re-read fail2ban state after an unban/ban/whitelist change. */
+    #[On('fail2banChanged')]
+    public function reloadFail2ban(Fail2banService $fail2ban): void
+    {
+        try {
+            $this->fail2ban = $fail2ban->status($this->server);
+        } catch (Throwable) {
+            // keep the current state on failure
+        }
+    }
+
+    /** Write one AuditEvent for a fail2ban action (success path only). */
+    private function audit(string $action, string $target): void
+    {
+        AuditEvent::create([
+            'user_id' => Auth::id(),
+            'server_id' => $this->server->id,
+            'actor' => Auth::user()?->name ?? 'system',
+            'action' => $action,
+            'target' => $target,
+            'ip' => request()->ip(),
+        ]);
+    }
+
    public function render()
    {
        return view('livewire.servers.show');
--- a/app/Services/Fail2banService.php
+++ b/app/Services/Fail2banService.php
@ -0,0 +1,427 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Server;
+use App\Support\Os\OsDetector;
+use RuntimeException;
+
+/**
+ * fail2ban management over SSH (as root): jail status + banned-IP list, unban,
+ * manual ban (lockout-guarded), and the Clusev-managed [DEFAULT] tuning + whitelist.
+ *
+ * Clusev owns EXACTLY ONE file — the zz-clusev.local drop-in — and rewrites the whole
+ * [DEFAULT] block on every change, so the tuning (bantime/findtime/maxretry) and the
+ * whitelist (ignoreip) can never clobber each other. Loopback is always whitelisted.
+ */
+class Fail2banService
+{
+    // TWO 'zz-' drop-ins (sort LAST in jail.d so their [DEFAULT] wins). Tuning and the
+    // whitelist live in SEPARATE files and each writes only its OWN keys, so editing the
+    // whitelist can never rewrite (and clobber) the ban policy, and vice-versa.
+    private const DROPIN_TUNING = '/etc/fail2ban/jail.d/zz-clusev-tuning.local';
+
+    private const DROPIN_IGNOREIP = '/etc/fail2ban/jail.d/zz-clusev-ignoreip.local';
+
+    // The previous single-file drop-in (tuning only). It sorts AFTER the new split files,
+    // so it must be removed on migration or its stale [DEFAULT] would override new tuning.
+    private const LEGACY_DROPIN = '/etc/fail2ban/jail.d/zz-clusev.local';
+
+    // Always whitelisted so the operator can never lock fail2ban against localhost.
+    private const LOOPBACK = ['127.0.0.1/8', '::1'];
+
+    public function __construct(private FleetService $fleet, private OsDetector $detector) {}
+
+    /** NULL when fail2ban is supported on this host, else a German reason. */
+    public function support(Server $server): ?string
+    {
+        return $this->detector->detect($server)->supports('fail2ban');
+    }
+
+    /**
+     * Jail status + banned IPs + whitelist in as few round-trips as possible.
+     *
+     * @return array<string, mixed>
+     */
+    public function status(Server $server): array
+    {
+        $reason = $this->support($server);
+        $base = ['supported' => $reason === null, 'reason' => $reason, 'installed' => false, 'active' => false, 'jails' => [], 'ignoreip' => []];
+        if ($reason !== null) {
+            return $base;
+        }
+
+        $cmd = 'echo CLUSEV_F2B_OK; '
+            .'command -v fail2ban-client >/dev/null 2>&1 && echo INST=yes || echo INST=no; '
+            .'systemctl is-active --quiet fail2ban && echo ACT=active || echo ACT=inactive; '
+            // CLIENT_OK only when `fail2ban-client status` itself SUCCEEDS — so an active
+            // service whose client call fails is not misreported as "0 jails".
+            .'cs=$(fail2ban-client status 2>/dev/null) && echo CLIENT_OK; '
+            .'jails=$(printf "%s" "$cs" | sed -n "s/.*Jail list:[[:space:]]*//p" | tr "," " "); '
+            .'for j in $jails; do echo ===CLUSEV:jail:$j===; fail2ban-client status "$j" 2>/dev/null; done';
+
+        $res = $this->fleet->runPrivileged($server, $cmd);
+        if (! str_contains($res['output'], 'CLUSEV_F2B_OK')) {
+            return $base + ['readError' => true];
+        }
+
+        $out = $res['output'];
+        $installed = (bool) preg_match('/^INST=yes$/m', $out);
+        $active = (bool) preg_match('/^ACT=active$/m', $out);
+
+        // Service active but the client query failed -> a real read error, not "no jails".
+        if ($installed && $active && ! preg_match('/^CLIENT_OK$/m', $out)) {
+            return $base + ['readError' => true];
+        }
+
+        $jails = [];
+        foreach ($this->jailSections($out) as $name => $body) {
+            $jails[] = [
+                'name' => $name,
+                'currentlyFailed' => $this->intField($body, 'Currently failed'),
+                'totalFailed' => $this->intField($body, 'Total failed'),
+                'currentlyBanned' => $this->intField($body, 'Currently banned'),
+                'totalBanned' => $this->intField($body, 'Total banned'),
+                'bannedIps' => $this->bannedIps($body),
+            ];
+        }
+
+        // ignoreip is managed separately (our drop-in); read it best-effort.
+        $ignoreip = [];
+        try {
+            $ignoreip = $this->readConfig($server)['ignoreip'];
+        } catch (RuntimeException) {
+            // leave empty on read failure
+        }
+
+        return ['supported' => true, 'reason' => null, 'installed' => $installed, 'active' => $active, 'jails' => $jails, 'ignoreip' => $ignoreip];
+    }
+
+    /**
+     * Read the effective [DEFAULT] tuning + whitelist (last value wins across files).
+     *
+     * @return array{bantime: string, maxretry: int, findtime: string, ignoreip: array<int, string>}
+     */
+    public function readConfig(Server $server): array
+    {
+        // A leading sentinel proves the read RAN (sudo/SSH ok); a CLUSEV_RESET marker
+        // stops a section bleeding across file boundaries. Only [DEFAULT] keys count.
+        $cmd = 'echo CLUSEV_READ_OK; for f in /etc/fail2ban/jail.conf /etc/fail2ban/jail.d/*.conf '
+            .'/etc/fail2ban/jail.local /etc/fail2ban/jail.d/*.local; do '
+            .'[ -f "$f" ] && { echo "[CLUSEV_RESET]"; cat "$f"; }; done 2>/dev/null';
+
+        $res = $this->fleet->runPrivileged($server, $cmd);
+        if (! str_contains($res['output'], 'CLUSEV_READ_OK')) {
+            throw new RuntimeException('fail2ban-Konfiguration konnte nicht gelesen werden.');
+        }
+
+        return $this->parseDefaults($res['output']);
+    }
+
+    /**
+     * Write ONLY the [DEFAULT] tuning keys to the tuning drop-in (never ignoreip), so a
+     * tuning change can't touch the whitelist. Values must already be validated/clamped.
+     *
+     * @return array{ok: bool, output: string}
+     */
+    public function writeTuning(Server $server, string $bantime, int $maxretry, string $findtime): array
+    {
+        $bantime = trim(preg_replace('/\s+/', ' ', $bantime) ?? '');
+        $findtime = trim(preg_replace('/\s+/', ' ', $findtime) ?? '');
+
+        $content = "# Managed by Clusev — fail2ban tuning. Do not edit by hand.\n"
+            ."[DEFAULT]\n"
+            ."bantime = {$bantime}\n"
+            ."findtime = {$findtime}\n"
+            ."maxretry = {$maxretry}\n";
+
+        // Drop the legacy single-file drop-in (tuning only) so it can't override this.
+        return $this->writeDropin($server, self::DROPIN_TUNING, $content, [self::LEGACY_DROPIN]);
+    }
+
+    /**
+     * Write ONLY the [DEFAULT] ignoreip to the whitelist drop-in (never tuning), so a
+     * whitelist change can't touch the ban policy. Loopback is always re-seeded.
+     *
+     * @param  array<int, string>  $ignoreip
+     * @return array{ok: bool, output: string}
+     */
+    public function writeIgnoreip(Server $server, array $ignoreip): array
+    {
+        $ignoreip = $this->normalizeIgnoreip($ignoreip);
+
+        $content = "# Managed by Clusev — fail2ban whitelist. Do not edit by hand.\n"
+            ."[DEFAULT]\n"
+            .'ignoreip = '.implode(' ', $ignoreip)."\n";
+
+        return $this->writeDropin($server, self::DROPIN_IGNOREIP, $content);
+    }
+
+    /**
+     * Atomically write one drop-in (base64-safe), optionally removing stale files first,
+     * then reload fail2ban if it is running.
+     *
+     * @param  array<int, string>  $removeFirst
+     */
+    private function writeDropin(Server $server, string $path, string $content, array $removeFirst = []): array
+    {
+        $rm = '';
+        foreach ($removeFirst as $stale) {
+            $rm .= 'rm -f '.$stale.'; ';
+        }
+
+        $b64 = base64_encode($content);
+        $cmd = 'mkdir -p /etc/fail2ban/jail.d; '.$rm
+            .'printf %s '.$b64.' | base64 -d > '.$path
+            .' && if systemctl is-active --quiet fail2ban; then systemctl reload fail2ban || fail2ban-client reload; fi';
+
+        $res = $this->fleet->runPrivileged($server, $cmd, 120);
+
+        return ['ok' => $res['ok'], 'output' => $this->tail($res['output'])];
+    }
+
+    /** Unban one IP from a jail. "is not banned" counts as success (idempotent). */
+    public function unban(Server $server, string $jail, string $ip): array
+    {
+        if (! $this->validJail($jail) || ! filter_var($ip, FILTER_VALIDATE_IP)) {
+            return ['ok' => false, 'output' => 'Ungültige Eingabe.'];
+        }
+        if ($reason = $this->support($server)) {
+            return ['ok' => false, 'output' => $reason];
+        }
+
+        $res = $this->fleet->runPrivileged($server, 'fail2ban-client set '.$jail.' unbanip '.$ip);
+        $ok = $res['ok'] || stripos($res['output'], 'not banned') !== false;
+
+        return ['ok' => $ok, 'output' => $this->tail($res['output'])];
+    }
+
+    /** Manually ban an IP in a jail. GUARDED against banning Clusev's own connection. */
+    public function ban(Server $server, string $jail, string $ip): array
+    {
+        if (! $this->validJail($jail) || ! filter_var($ip, FILTER_VALIDATE_IP)) {
+            return ['ok' => false, 'output' => 'Ungültige Eingabe.'];
+        }
+        if ($reason = $this->support($server)) {
+            return ['ok' => false, 'output' => $reason];
+        }
+
+        // LOCKOUT GUARD: never ban loopback (the WHOLE 127.0.0.0/8 range + ::1) or the
+        // address Clusev connects FROM. Compare CANONICALLY (inet_pton) so an alternate
+        // IPv6 spelling cannot slip past.
+        $cp = $this->controlPlaneIp($server);
+        $loopback = $this->sameIp($ip, '::1')
+            || (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false && str_starts_with($ip, '127.'));
+        if ($loopback || ($cp !== null && $this->sameIp($ip, $cp))) {
+            return ['ok' => false, 'output' => 'Diese IP gehört zum Clusev-Zugang und kann nicht gesperrt werden (Aussperrgefahr).'];
+        }
+
+        $res = $this->fleet->runPrivileged($server, 'fail2ban-client set '.$jail.' banip '.$ip);
+
+        return ['ok' => $res['ok'], 'output' => $this->tail($res['output'])];
+    }
+
+    /** Add an IP/CIDR to the whitelist (ignoreip), preserving the tuning values. */
+    public function addIgnoreIp(Server $server, string $ip): array
+    {
+        $ip = trim($ip);
+        if (! $this->validIpOrCidr($ip)) {
+            return ['ok' => false, 'output' => 'Ungültige IP-Adresse oder CIDR.'];
+        }
+        if ($reason = $this->support($server)) {
+            return ['ok' => false, 'output' => $reason];
+        }
+
+        $cfg = $this->readConfig($server);
+        if (in_array($ip, $cfg['ignoreip'], true)) {
+            return ['ok' => true, 'noop' => true, 'output' => 'Bereits auf der Whitelist.'];
+        }
+        $list = $cfg['ignoreip'];
+        $list[] = $ip;
+
+        return $this->writeIgnoreip($server, $list);
+    }
+
+    /** Remove an IP/CIDR from the whitelist (loopback can never be removed). */
+    public function removeIgnoreIp(Server $server, string $ip): array
+    {
+        $ip = trim($ip);
+        if ($reason = $this->support($server)) {
+            return ['ok' => false, 'output' => $reason];
+        }
+        if (in_array($ip, self::LOOPBACK, true)) {
+            return ['ok' => false, 'output' => 'Loopback bleibt immer auf der Whitelist.'];
+        }
+
+        $cfg = $this->readConfig($server);
+        if (! in_array($ip, $cfg['ignoreip'], true)) {
+            return ['ok' => true, 'noop' => true, 'output' => 'Nicht auf der Whitelist.'];
+        }
+        $list = array_values(array_filter($cfg['ignoreip'], fn (string $e): bool => $e !== $ip));
+
+        return $this->writeIgnoreip($server, $list);
+    }
+
+    /** Canonical IP equality (normalizes IPv6 spellings via inet_pton). */
+    private function sameIp(string $a, string $b): bool
+    {
+        $pa = @inet_pton($a);
+        $pb = @inet_pton($b);
+
+        return $pa !== false && $pb !== false && $pa === $pb;
+    }
+
+    /** Clusev's source IP as the server sees it (from $SSH_CONNECTION), or null. */
+    private function controlPlaneIp(Server $server): ?string
+    {
+        $res = $this->fleet->runPlain($server, 'printf %s "$SSH_CONNECTION"');
+        $ip = $res['ok'] ? (preg_split('/\s+/', trim($res['output']))[0] ?? '') : '';
+
+        return filter_var($ip, FILTER_VALIDATE_IP) ? $ip : null;
+    }
+
+    /**
+     * @return array{bantime: string, maxretry: int, findtime: string, ignoreip: array<int, string>}
+     */
+    private function parseDefaults(string $body): array
+    {
+        $vals = ['bantime' => '10m', 'maxretry' => 5, 'findtime' => '10m', 'ignoreip' => self::LOOPBACK];
+        $inDefault = false;
+        $cont = false;          // currently inside an ignoreip continuation
+        $ignoreRaw = null;      // raw ignoreip value (across continuation lines), last file wins
+
+        foreach (preg_split('/\R/', $body) ?: [] as $raw) {
+            $t = trim($raw);
+            if ($t === '' || $t[0] === '#' || $t[0] === ';') {
+                $cont = false;
+
+                continue;
+            }
+            // Section header (incl. the [CLUSEV_RESET] between files) resets state.
+            if (preg_match('/^\[([^\]]+)\]/', $t, $m)) {
+                $inDefault = strcasecmp(trim($m[1]), 'DEFAULT') === 0;
+                $cont = false;
+
+                continue;
+            }
+            if (! $inDefault) {
+                $cont = false;
+
+                continue;
+            }
+            // INI continuation: an indented line right after ignoreip extends its value.
+            if ($cont && preg_match('/^\s/', $raw)) {
+                $ignoreRaw .= ' '.$t;
+
+                continue;
+            }
+            $cont = false;
+
+            if (preg_match('/^bantime\s*=\s*(.+?)\s*$/i', $t, $m)) {
+                $vals['bantime'] = $m[1];
+            } elseif (preg_match('/^findtime\s*=\s*(.+?)\s*$/i', $t, $m)) {
+                $vals['findtime'] = $m[1];
+            } elseif (preg_match('/^maxretry\s*=\s*(\d+)/i', $t, $m)) {
+                $vals['maxretry'] = (int) $m[1];
+            } elseif (preg_match('/^ignoreip\s*=\s*(.*)$/i', $t, $m)) {
+                $ignoreRaw = $m[1];   // last assignment (highest-precedence file) wins
+                $cont = true;
+            }
+        }
+
+        if ($ignoreRaw !== null) {
+            $vals['ignoreip'] = $this->normalizeIgnoreip(preg_split('/\s+/', trim($ignoreRaw)) ?: []);
+        }
+
+        return $vals;
+    }
+
+    /**
+     * Loopback first, then every existing entry VERBATIM (deduped) — hostnames, CIDRs
+     * and other fail2ban-valid tokens are preserved, never dropped (new entries from
+     * the UI are validated separately before they reach this list).
+     */
+    private function normalizeIgnoreip(array $list): array
+    {
+        $out = self::LOOPBACK;
+        foreach ($list as $entry) {
+            $entry = trim((string) $entry);
+            if ($entry !== '' && ! in_array($entry, $out, true)) {
+                $out[] = $entry;
+            }
+        }
+
+        return $out;
+    }
+
+    /** @return array<string, string> jail name => status body */
+    private function jailSections(string $out): array
+    {
+        $sections = [];
+        $current = null;
+        $buffer = [];
+        foreach (preg_split('/\R/', $out) ?: [] as $line) {
+            if (str_starts_with($line, '===CLUSEV:jail:')) {
+                if ($current !== null) {
+                    $sections[$current] = implode("\n", $buffer);
+                }
+                $current = rtrim(substr($line, strlen('===CLUSEV:jail:')), '=');
+                $buffer = [];
+            } elseif ($current !== null) {
+                $buffer[] = $line;
+            }
+        }
+        if ($current !== null) {
+            $sections[$current] = implode("\n", $buffer);
+        }
+
+        return $sections;
+    }
+
+    private function intField(string $body, string $label): int
+    {
+        return preg_match('/'.preg_quote($label, '/').':\s*(\d+)/i', $body, $m) ? (int) $m[1] : 0;
+    }
+
+    /** @return array<int, string> */
+    private function bannedIps(string $body): array
+    {
+        if (! preg_match('/Banned IP list:\s*(.*)$/im', $body, $m)) {
+            return [];
+        }
+
+        return array_values(array_filter(
+            preg_split('/\s+/', trim($m[1])) ?: [],
+            fn (string $ip): bool => (bool) filter_var($ip, FILTER_VALIDATE_IP)
+        ));
+    }
+
+    private function validJail(string $jail): bool
+    {
+        return (bool) preg_match('/^[A-Za-z0-9._-]+$/', $jail);
+    }
+
+    private function validIpOrCidr(string $v): bool
+    {
+        if (filter_var($v, FILTER_VALIDATE_IP)) {
+            return true;
+        }
+        if (! str_contains($v, '/')) {
+            return false;
+        }
+        [$ip, $mask] = explode('/', $v, 2);
+        if (! filter_var($ip, FILTER_VALIDATE_IP) || ! ctype_digit($mask)) {
+            return false;
+        }
+        $max = str_contains($ip, ':') ? 128 : 32;
+
+        return (int) $mask >= 0 && (int) $mask <= $max;
+    }
+
+    private function tail(string $out, int $max = 300): string
+    {
+        $out = trim($out);
+
+        return mb_strlen($out) <= $max ? $out : '…'.mb_substr($out, -$max);
+    }
+}
--- a/app/Services/FirewallService.php
+++ b/app/Services/FirewallService.php
@ -3,49 +3,258 @@
 namespace App\Services;

 use App\Models\Server;
+use App\Support\Os\FirewallTool;
+use App\Support\Os\OsDetector;

 /**
- * UFW firewall control over SSH (as root).
+ * Host firewall control over SSH (as root), abstracted across ufw and firewalld
+ * (resolved per OS via OsDetector/FirewallTool).
 *
- * Safety model: "guards + confirmation". enable() ALWAYS opens the real sshd
- * Port (detected from sshd_config, default 22) plus 80/443 BEFORE turning the
- * firewall on — so enabling UFW can never sever the operator's own SSH session.
+ * Safety model: "guards + confirmation". enable() ALWAYS opens the real sshd Port
+ * (detected from sshd_config, default 22) plus 80/443 BEFORE turning the firewall
+ * on — so enabling can never sever the operator's own SSH session.
 *
 * Both mutating methods return array{ok: bool, output: string}.
 */
 class FirewallService
 {
-    public function __construct(private FleetService $fleet) {}
+    public function __construct(private FleetService $fleet, private OsDetector $detector) {}

    /**
-     * GUARD: allow the real sshd Port + 80/443 first, THEN enable UFW. Never
-     * enable a firewall that would drop the current SSH session. Installs ufw if missing.
+     * GUARD: allow the real sshd Port + 80/443 first, THEN enable the firewall.
+     * Never enable a firewall that would drop the current SSH session. Installs the
+     * firewall package first when supported and missing.
     *
     * @return array{ok: bool, output: string}
     */
    public function enable(Server $server): array
    {
-        // long timeout: may apt-install ufw first.
-        $res = $this->fleet->runPrivileged($server, $this->enableScript($this->sshPort($server)), 600);
+        $os = $this->detector->detect($server);
+        if ($reason = $os->supports('firewall')) {
+            return ['ok' => false, 'output' => $reason];
+        }
+
+        // long timeout: may install the firewall package first.
+        $script = FirewallTool::for($os)->enableScript($this->sshPort($server));
+        $res = $this->fleet->runPrivileged($server, $script, 600);

        return ['ok' => $res['ok'], 'output' => $res['output']];
    }

-    /** Turn the firewall off (ufw disable). @return array{ok: bool, output: string} */
+    /** Turn the firewall off (clean stop, never a panic/drop-all). @return array{ok: bool, output: string} */
    public function disable(Server $server): array
    {
-        $res = $this->fleet->runPrivileged($server, 'ufw disable');
+        $os = $this->detector->detect($server);
+        $res = $this->fleet->runPrivileged($server, FirewallTool::for($os)->disableScript());

        return ['ok' => $res['ok'], 'output' => $res['output']];
    }

-    /** Build the guarded enable script: install ufw if missing, open ssh+80+443, then enable. */
-    private function enableScript(int $port): string
+    /**
+     * Read the full firewall state in one privileged round-trip: installed/active,
+     * default policies (ufw) or zone+target (firewalld), and the rule list. Returns
+     * `supported=false` + a German reason on an OS without a supported firewall.
+     *
+     * @return array<string, mixed>
+     */
+    public function status(Server $server): array
    {
-        return '(command -v ufw >/dev/null 2>&1 || DEBIAN_FRONTEND=noninteractive apt-get install -y ufw) && '
-            ."ufw allow {$port}/tcp && ufw allow 80/tcp && ufw allow 443/tcp && ufw --force enable";
+        $os = $this->detector->detect($server);
+        $reason = $os->supports('firewall');
+        $tool = FirewallTool::for($os);
+
+        $base = [
+            'supported' => $reason === null,
+            'reason' => $reason,
+            'tool' => $tool->isFirewalld() ? 'firewalld' : 'ufw',
+            'installed' => false,
+            'active' => false,
+            'defaults' => [],
+            'rules' => [],
+        ];
+
+        if ($reason !== null) {
+            return $base;
+        }
+
+        $res = $this->fleet->runPrivileged($server, $tool->statusScript());
+        // The sentinel proves the privileged read actually RAN (sudo/SSH ok). A sudo
+        // failure emits error text (non-empty) but no sentinel — so we must not parse
+        // that as an empty firewall (which would make a delete falsely "succeed").
+        if (! str_contains($res['output'], 'CLUSEV_FWREAD_OK')) {
+            return $base + ['readError' => true];
+        }
+
+        $s = $this->sections($res['output']);
+
+        // ufw: a successful read ALWAYS prints a "Status:" line. If the tool is installed
+        // but that line is missing, the privileged ufw call itself failed (malformed
+        // config, etc.) — treat as a read error rather than an empty (no-rules) firewall,
+        // so a later delete can't falsely report "already gone".
+        if (! $tool->isFirewalld()
+            && trim($s['inst'] ?? '') === 'yes'
+            && ! preg_match('/Status:/i', $s['verbose'] ?? '')) {
+            return $base + ['readError' => true];
+        }
+
+        return $tool->isFirewalld() ? $this->parseFirewalld($s, $base) : $this->parseUfw($s, $base);
    }

+    /**
+     * Add a firewall rule from validated parts. ufw: action/proto/port/from;
+     * firewalld: opens a port in the default zone.
+     *
+     * @return array{ok: bool, output: string}
+     */
+    public function addRule(Server $server, string $action, string $proto, ?int $port, ?string $from): array
+    {
+        $os = $this->detector->detect($server);
+        if ($reason = $os->supports('firewall')) {
+            return ['ok' => false, 'output' => $reason];
+        }
+
+        // Rule mutation is ufw-only this release; firewalld is read-only.
+        if ($os->firewallTool === 'firewalld') {
+            return ['ok' => false, 'output' => 'Regelverwaltung für firewalld ist in dieser Version nur lesend — bitte am Server konfigurieren.'];
+        }
+
+        $action = in_array($action, ['allow', 'deny', 'reject', 'limit'], true) ? $action : 'allow';
+        $proto = in_array($proto, ['tcp', 'udp', 'any'], true) ? $proto : 'tcp';
+        $from = ($from !== null && trim($from) !== '') ? trim($from) : null;
+
+        if ($port !== null && ($port < 1 || $port > 65535)) {
+            return ['ok' => false, 'output' => 'Ungültiger Port (1–65535).'];
+        }
+        if ($from !== null && ! $this->validIpOrCidr($from)) {
+            return ['ok' => false, 'output' => 'Ungültige Quelle — IP-Adresse oder CIDR erwartet.'];
+        }
+        if ($port === null && $from === null) {
+            return ['ok' => false, 'output' => 'Port oder Quelle ist erforderlich.'];
+        }
+
+        // LOCKOUT GUARD: a deny/reject that can cover the SSH connection would sever
+        // every future management session. Over TCP/any, refuse it when it targets the
+        // SSH port OR has NO port (a portless deny blocks ALL inbound, incl. SSH) —
+        // regardless of source, since a source may include Clusev's own address. Use
+        // fail2ban to block individual IPs from SSH instead.
+        $sshPort = $this->sshPort($server);
+        if (in_array($action, ['deny', 'reject'], true) && in_array($proto, ['tcp', 'any'], true)
+            && ($port === null || $port === $sshPort)) {
+            return ['ok' => false, 'output' => ($port === null
+                ? 'Eine '.$action.'-Regel ohne Port würde auch den SSH-Zugang blockieren und ist nicht erlaubt. '
+                : 'Eine '.$action.'-Regel auf den SSH-Port ('.$sshPort.') ist nicht erlaubt (Aussperrgefahr). ')
+                .'Nutze fail2ban, um einzelne IPs vom SSH-Zugang auszusperren.'];
+        }
+
+        $tool = FirewallTool::for($os);
+        if ($tool->isFirewalld() && $port === null) {
+            return ['ok' => false, 'output' => 'firewalld: Bitte einen Port angeben.'];
+        }
+
+        $res = $this->fleet->runPrivileged($server, $tool->addRuleScript($action, $proto, $port, $from), 60);
+
+        return ['ok' => $res['ok'], 'output' => $res['output']];
+    }
+
+    /**
+     * Delete a rule. ufw: $spec is the rule's raw line content — we re-read NOW and
+     * delete by the CURRENT number that matches, side-stepping the renumber race.
+     * firewalld: $spec is "port:80/tcp" or "service:ssh".
+     *
+     * @return array{ok: bool, output: string}
+     */
+    public function deleteRule(Server $server, string $spec): array
+    {
+        $os = $this->detector->detect($server);
+        if ($reason = $os->supports('firewall')) {
+            return ['ok' => false, 'output' => $reason];
+        }
+
+        // Rule mutation is ufw-only this release; firewalld is read-only.
+        if ($os->firewallTool === 'firewalld') {
+            return ['ok' => false, 'output' => 'Regelverwaltung für firewalld ist in dieser Version nur lesend — bitte am Server konfigurieren.'];
+        }
+
+        $tool = FirewallTool::for($os);
+        $sshPort = $this->sshPort($server);
+
+        // ufw: $spec is a public-method argument, so it is UNTRUSTED. Whitelist it
+        // against the specs ufw itself reported (which contain no shell metacharacters)
+        // — a forged spec like "allow 80/tcp; rm -rf /" can never match, so the raw
+        // concatenation into `ufw delete <spec>` can never inject. Delete-by-spec is
+        // also race-free (no rule number to shift).
+        $status = $this->status($server);
+        if (! empty($status['readError'])) {
+            return ['ok' => false, 'output' => 'Firewall-Status konnte nicht gelesen werden — Regel nicht entfernt.'];
+        }
+        $known = array_column($status['rules'], 'spec');
+        if (! in_array($spec, $known, true)) {
+            // The rule vanished between confirm and apply — report not_found so the
+            // caller does NOT audit a deletion that never happened.
+            return ['ok' => true, 'notFound' => true, 'output' => 'Regel existiert nicht mehr.'];
+        }
+        // LOCKOUT GUARD: refuse to remove an allow/limit rule that keeps the SSH port open.
+        if ($this->ufwSpecOpensSsh($spec, $sshPort)) {
+            return ['ok' => false, 'output' => $this->sshGuardMessage($sshPort)];
+        }
+
+        $res = $this->fleet->runPrivileged($server, $tool->deleteUfwScript($spec));
+
+        return ['ok' => $res['ok'], 'output' => $res['output']];
+    }
+
+    /**
+     * True when a ufw allow/limit spec keeps the SSH port (or an SSH app profile)
+     * open. The port is matched ONLY in the destination position — the simple form
+     * ("allow 22/tcp") or after "to any port" — never inside a source IP like
+     * 192.0.2.22, which must stay deletable.
+     */
+    private function ufwSpecOpensSsh(string $spec, int $sshPort): bool
+    {
+        $spec = trim($spec);
+        if (! preg_match('/^(allow|limit)\b/i', $spec)) {
+            return false;
+        }
+        if (stripos($spec, 'OpenSSH') !== false || preg_match('/(^|\s)SSH(\s|$)/i', $spec)) {
+            return true;
+        }
+        // SSH is TCP — ignore explicitly UDP-only rules (simple "<port>/udp" or "proto udp").
+        if (preg_match('/^(allow|limit)\s+\d+(?::\d+)?\/udp\b/i', $spec) || preg_match('/proto\s+udp/i', $spec)) {
+            return false;
+        }
+        // simple form: "allow 22", "allow 22/tcp", or a range "allow 20:30/tcp".
+        if (preg_match('/^(allow|limit)\s+(\d+)(?::(\d+))?(\/tcp)?(\s|$)/i', $spec, $m)
+            && $this->portInRange($sshPort, (int) $m[2], ($m[3] ?? '') !== '' ? (int) $m[3] : null)) {
+            return true;
+        }
+        // destination-port form: "... port 22 ..." or a range "... port 20:30 ...".
+        if (preg_match('/\bport\s+(\d+)(?::(\d+))?/i', $spec, $m)
+            && $this->portInRange($sshPort, (int) $m[1], ($m[2] ?? '') !== '' ? (int) $m[2] : null)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /** True when $needle equals the single port, or falls inside the [low, high] range. */
+    private function portInRange(int $needle, int $low, ?int $high): bool
+    {
+        return $high === null ? $needle === $low : ($needle >= $low && $needle <= $high);
+    }
+
+    /** German refusal shown when a delete would sever Clusev's own SSH access. */
+    private function sshGuardMessage(int $port): string
+    {
+        return "Diese Regel hält den SSH-Zugang (Port {$port}) offen und kann nicht entfernt werden — "
+            .'sonst sperrt sich Clusev selbst aus. Deaktiviere bei Bedarf die gesamte Firewall.';
+    }
+
+    // NOTE: editing default policies (e.g. "deny incoming") was intentionally NOT
+    // exposed — it is the highest-lockout-risk firewall operation (a restrictive
+    // default with a missing/source-mismatched SSH rule severs Clusev). Defaults are
+    // shown READ-ONLY in the panel; activating the firewall via the hardening toggle
+    // applies safe defaults while guaranteeing ssh/80/443 stay open.
+
    /**
     * Detect the listening sshd Port from sshd_config (incl. drop-ins). Falls
     * back to 22 when nothing is set explicitly.
@ -62,4 +271,164 @@ class FirewallService

        return ($res['ok'] && $port >= 1 && $port <= 65535) ? $port : 22;
    }
+
+    /**
+     * @param  array<string, string>  $s
+     * @param  array<string, mixed>  $base
+     * @return array<string, mixed>
+     */
+    private function parseUfw(array $s, array $base): array
+    {
+        // Defaults from /etc/default/ufw — correct whether ufw is active or inactive
+        // (verbose only prints the Default: line while active).
+        $map = ['DROP' => 'deny', 'REJECT' => 'reject', 'ACCEPT' => 'allow'];
+        $defaults = ['incoming' => null, 'outgoing' => null, 'routed' => null];
+        if (preg_match('/DEFAULT_INPUT_POLICY="?(\w+)"?/', $s['defaults'] ?? '', $mi)) {
+            $defaults['incoming'] = $map[strtoupper($mi[1])] ?? strtolower($mi[1]);
+        }
+        if (preg_match('/DEFAULT_OUTPUT_POLICY="?(\w+)"?/', $s['defaults'] ?? '', $mo)) {
+            $defaults['outgoing'] = $map[strtoupper($mo[1])] ?? strtolower($mo[1]);
+        }
+
+        // Rules from `ufw show added` (add-syntax). The spec IS the delete argument.
+        $rules = [];
+        foreach (preg_split('/\R/', $s['added'] ?? '') ?: [] as $line) {
+            if (! preg_match('/^ufw\s+(.+\S)\s*$/', trim($line), $m)) {
+                continue;
+            }
+            $spec = trim(preg_replace('/\s+/', ' ', $m[1]) ?? '');
+            // Routed/forwarding rules look like "route allow in on eth0 ..." — the action
+            // is the SECOND token; keep the whole spec (delete needs "route allow …").
+            $first = (string) strtok($spec, ' ');
+            $routed = strcasecmp($first, 'route') === 0;
+            $afterFirst = trim((string) substr($spec, strlen($first)));
+            $action = strtoupper($routed ? (string) strtok($afterFirst, ' ') : $first);
+            if (! in_array($action, ['ALLOW', 'DENY', 'REJECT', 'LIMIT'], true)) {
+                continue;
+            }
+            $label = $routed ? $spec : (trim((string) substr($spec, strlen($first))) ?: $spec);
+            $rules[] = ['raw' => $spec, 'label' => $label, 'action' => $action, 'from' => '', 'v6' => false, 'spec' => $spec];
+        }
+
+        $installed = trim($s['inst'] ?? '') === 'yes';
+
+        return array_merge($base, [
+            'installed' => $installed,
+            'active' => (bool) preg_match('/Status:\s*active/i', $s['verbose'] ?? ''),
+            // ufw stores rules in files, so they are manageable even while inactive.
+            'manageable' => $installed,
+            'readOnly' => false,
+            'defaults' => $defaults,
+            'rules' => $rules,
+        ]);
+    }
+
+    /**
+     * @param  array<string, string>  $s
+     * @param  array<string, mixed>  $base
+     * @return array<string, mixed>
+     */
+    private function parseFirewalld(array $s, array $base): array
+    {
+        // Each line is "zone|value"; the zone is shown when it is not the default zone,
+        // so a port enforced in a non-default zone is attributed correctly and identical
+        // rules in different zones stay distinct. firewalld is read-only, so `spec` is
+        // cosmetic here (never used for deletion).
+        $default = trim($s['zone'] ?? '');
+        $rules = [];
+        $seen = [];
+
+        $add = function (string $line, string $kind) use (&$rules, &$seen, $default): void {
+            $line = trim($line);
+            if ($line === '') {
+                return;
+            }
+            [$zone, $value] = array_pad(explode('|', $line, 2), 2, '');
+            if ($value === '') {
+                [$zone, $value] = [$default, $zone];
+            }
+            $key = $kind.'|'.$zone.'|'.$value;
+            if (isset($seen[$key])) {
+                return;
+            }
+            $seen[$key] = true;
+
+            $suffix = ($zone !== '' && $zone !== $default) ? ' · '.$zone : '';
+            $action = 'ALLOW';
+            $label = $value.$suffix;
+            if ($kind === 'service') {
+                $label = $value.' (Dienst)'.$suffix;
+            } elseif ($kind === 'rich') {
+                $action = stripos($value, 'accept') !== false ? 'ALLOW'
+                    : (stripos($value, 'reject') !== false ? 'REJECT' : (stripos($value, 'drop') !== false ? 'DENY' : 'ALLOW'));
+            }
+            $rules[] = ['label' => $label, 'action' => $action, 'from' => '', 'v6' => false, 'spec' => $kind.':'.$value];
+        };
+
+        foreach (preg_split('/\R/', $s['ports'] ?? '') ?: [] as $l) {
+            $add($l, 'port');
+        }
+        foreach (preg_split('/\R/', $s['services'] ?? '') ?: [] as $l) {
+            $add($l, 'service');
+        }
+        foreach (preg_split('/\R/', $s['rich'] ?? '') ?: [] as $l) {
+            $add($l, 'rich');
+        }
+
+        $installed = trim($s['inst'] ?? '') === 'yes';
+        $active = trim($s['active'] ?? '') === 'active';
+
+        return array_merge($base, [
+            'installed' => $installed,
+            'active' => $active,
+            // firewalld is READ-ONLY this release: rules are displayed (runtime state)
+            // but not mutated from Clusev, so it is never "manageable" for add/delete.
+            'manageable' => false,
+            'readOnly' => true,
+            'defaults' => ['zone' => trim($s['zone'] ?? '')],
+            'rules' => $rules,
+        ]);
+    }
+
+    /** Split a marker-sectioned (===CLUSEV:name===) output into [name => body]. */
+    private function sections(string $out): array
+    {
+        $sections = [];
+        $current = null;
+        $buffer = [];
+        foreach (preg_split('/\R/', $out) ?: [] as $line) {
+            if (str_starts_with($line, '===CLUSEV:')) {
+                if ($current !== null) {
+                    $sections[$current] = implode("\n", $buffer);
+                }
+                $current = rtrim(substr($line, strlen('===CLUSEV:')), '=');
+                $buffer = [];
+            } elseif ($current !== null) {
+                $buffer[] = $line;
+            }
+        }
+        if ($current !== null) {
+            $sections[$current] = implode("\n", $buffer);
+        }
+
+        return $sections;
+    }
+
+    /** Accept a bare IP (v4/v6) or an IP/CIDR with a valid prefix length. */
+    private function validIpOrCidr(string $v): bool
+    {
+        if (filter_var($v, FILTER_VALIDATE_IP)) {
+            return true;
+        }
+        if (! str_contains($v, '/')) {
+            return false;
+        }
+        [$ip, $mask] = explode('/', $v, 2);
+        if (! filter_var($ip, FILTER_VALIDATE_IP) || ! ctype_digit($mask)) {
+            return false;
+        }
+        $max = str_contains($ip, ':') ? 128 : 32;
+
+        return (int) $mask >= 0 && (int) $mask <= $max;
+    }
 }
--- a/app/Services/HardeningService.php
+++ b/app/Services/HardeningService.php
@ -3,17 +3,24 @@
 namespace App\Services;

 use App\Models\Server;
+use App\Support\Os\FirewallTool;
+use App\Support\Os\OsDetector;
+use App\Support\Os\OsProfile;
+use App\Support\Os\PackageManager;
 use InvalidArgumentException;
 use RuntimeException;
 use Throwable;

 /**
- * Applies the dashboard server-hardening toggles over SSH (as root). Every item is
- * BIDIRECTIONAL — apply($server, $action, $enable) toggles the underlying feature
- * on/off; package items (fail2ban, unattended-upgrades, UFW) install on demand.
+ * Applies the dashboard server-hardening toggles over SSH (as root), OS-aware
+ * across apt/dnf/zypper + ufw/firewalld (resolved per host via OsDetector). Every
+ * item is BIDIRECTIONAL — apply($server, $action, $enable) toggles the underlying
+ * feature; package items (fail2ban, auto-updates, firewall) install on demand.
 *
 * apply() runs the exact command built by commandFor() (the single source of truth);
 * title()/description() supply the German confirm-modal copy for each direction.
+ * Each state() row carries `supported`/`reason`, so a feature unavailable on the
+ * host's OS degrades with a German explanation instead of failing opaquely.
 * Disabling SSH password auth is GUARDED so the operator can never lock themselves out.
 */
 class HardeningService
@ -24,43 +31,56 @@ class HardeningService
    // 99zz- so Clusev's apt periodic setting wins (apt uses the LAST value across apt.conf.d/*).
    private const APT_DROPIN = '/etc/apt/apt.conf.d/99zz-clusev';

-    public function __construct(private FleetService $fleet, private FirewallService $firewall) {}
+    public function __construct(
+        private FleetService $fleet,
+        private FirewallService $firewall,
+        private OsDetector $detector,
+    ) {}

    /**
     * Live state of every hardening item, read PRIVILEGED in one shot. SSH uses
-     * `sshd -T` (the EFFECTIVE config — honours Include order + Match blocks);
-     * UFW uses `ufw status`; unattended uses the apt periodic config.
+     * `sshd -T` (the EFFECTIVE config — honours Include order + Match blocks); the
+     * package/firewall/auto-update probes are built per-OS (dpkg vs rpm, ufw vs
+     * firewalld, apt periodic vs dnf-automatic).
     *
-     * @return array<int, array{key:string, label:string, detail:string, featureOn:bool, secure:bool}>
+     * @return array<int, array{key:string, label:string, detail:string, featureOn:bool, secure:bool, supported:bool, reason:?string}>
     */
    public function state(Server $server): array
    {
+        $os = $this->detector->detect($server);
+        $pm = $os->managesPackages() ? PackageManager::for($os) : null;
+        $fw = FirewallTool::for($os);
+
+        // Shell CONDITIONS (exit 0 = true); `false` where the host lacks the tool.
+        $f2bInst = $pm ? $pm->isInstalledTest('fail2ban') : 'false';
+        $auInst = $pm ? $pm->isInstalledTest($os->packageManager === 'dnf' ? 'dnf-automatic' : 'unattended-upgrades') : 'false';
+        $auActive = match ($os->packageManager) {
+            'apt' => 'apt-config dump APT::Periodic::Unattended-Upgrade 2>/dev/null | grep -q \'"1"\'',
+            'dnf' => 'systemctl is-enabled --quiet dnf-automatic.timer',
+            default => 'false',
+        };
+
        $cmd = 'sshd -T 2>/dev/null | grep -iE "^(permitrootlogin|passwordauthentication) "; '
-            .'echo "fail2ban $(dpkg -l fail2ban 2>/dev/null | grep -c "^ii") $(systemctl is-active fail2ban 2>/dev/null)"; '
-            .'ufw_inst=$(dpkg -l ufw 2>/dev/null | grep -c "^ii"); ufw_act=inactive; '
-            .'[ "$ufw_inst" = "1" ] && ufw status 2>/dev/null | grep -qi "Status: active" && ufw_act=active; '
-            .'echo "ufw $ufw_inst $ufw_act"; '
-            .'ui=$(dpkg -l unattended-upgrades 2>/dev/null | grep -c "^ii"); ua=inactive; '
-            // apt-config dump = the EFFECTIVE periodic value across all apt.conf.d files (last wins).
-            .'apt-config dump APT::Periodic::Unattended-Upgrade 2>/dev/null | grep -q \'"1"\' && ua=active; '
-            .'echo "unattended-upgrades $ui $ua"';
+            .'echo "fail2ban $('.$f2bInst.' && echo 1 || echo 0) $(systemctl is-active --quiet fail2ban && echo active || echo inactive)"; '
+            .'echo "firewall $('.$fw->installedTest().' && echo 1 || echo 0) $('.$fw->activeTest().' && echo active || echo inactive)"; '
+            .'echo "autoupdate $('.$auInst.' && echo 1 || echo 0) $('.$auActive.' && echo active || echo inactive)"';

        $res = $this->fleet->runPrivileged($server, $cmd);
        if (! $res['ok']) {
            throw new RuntimeException('Härtungs-Status konnte nicht gelesen werden.');
        }

-        return $this->parseState($res['output']);
+        return $this->parseState($res['output'], $os);
    }

-    /** @return array<int, array{key:string, label:string, detail:string, featureOn:bool, secure:bool}> */
-    private function parseState(string $out): array
+    /** @return array<int, array{key:string, label:string, detail:string, featureOn:bool, secure:bool, supported:bool, reason:?string}> */
+    private function parseState(string $out, OsProfile $os): array
    {
        $root = 'default';
        $pwauth = 'default';
        $pkg = [];

-        foreach (preg_split('/\R/', $out) as $line) {
+        foreach (preg_split('/\R/', $out) ?: [] as $line) {
            $line = trim($line);
            if (preg_match('/^permitrootlogin\s+(\S+)/i', $line, $m)) {
                $root = strtolower($m[1]);
@ -68,34 +88,38 @@ class HardeningService
                $pwauth = strtolower($m[1]);
            } else {
                $p = preg_split('/\s+/', $line);
-                if (count($p) === 3 && in_array($p[0], ['fail2ban', 'ufw', 'unattended-upgrades'], true)) {
+                if (count($p) === 3 && in_array($p[0], ['fail2ban', 'firewall', 'autoupdate'], true)) {
                    $pkg[$p[0]] = ['installed' => $p[1] === '1', 'active' => $p[2] === 'active'];
                }
            }
        }

        $f2b = $pkg['fail2ban'] ?? ['installed' => false, 'active' => false];
-        $ufw = $pkg['ufw'] ?? ['installed' => false, 'active' => false];
-        $upg = $pkg['unattended-upgrades'] ?? ['installed' => false, 'active' => false];
+        $fw = $pkg['firewall'] ?? ['installed' => false, 'active' => false];
+        $upg = $pkg['autoupdate'] ?? ['installed' => false, 'active' => false];

        $detail = fn (string $name, array $st): string => $name.' · '
            .(! $st['installed'] ? 'nicht installiert' : ($st['active'] ? 'aktiv' : 'inaktiv'));
-        // A package feature is only effectively ON when the package is installed AND active —
+        // A package feature is only effectively ON when installed AND active —
        // stale config (e.g. apt periodic = 1 after removal) must not read as secure.
        $on = fn (array $st): bool => $st['installed'] && $st['active'];

+        $row = fn (string $key, string $label, string $detail, bool $featureOn, bool $secure, ?string $reason): array => [
+            'key' => $key, 'label' => $label, 'detail' => $detail,
+            'featureOn' => $featureOn, 'secure' => $secure,
+            'supported' => $reason === null, 'reason' => $reason,
+        ];
+
+        $fwName = $os->firewallTool === 'firewalld' ? 'firewalld' : 'ufw';
+        $auName = $os->packageManager === 'dnf' ? 'dnf-automatic' : 'unattended-upgrades';
+
        // `featureOn` drives the button (Aktivieren/Deaktivieren); `secure` drives the OK/Offen pill.
        return [
-            ['key' => 'ssh_root', 'label' => 'SSH-Root-Login', 'detail' => 'PermitRootLogin '.$root,
-                'featureOn' => $root !== 'no', 'secure' => $root === 'no'],
-            ['key' => 'ssh_password', 'label' => 'SSH-Passwort-Login', 'detail' => 'PasswordAuthentication '.$pwauth,
-                'featureOn' => $pwauth !== 'no', 'secure' => $pwauth === 'no'],
-            ['key' => 'fail2ban', 'label' => 'fail2ban', 'detail' => $detail('fail2ban.service', $f2b),
-                'featureOn' => $on($f2b), 'secure' => $on($f2b)],
-            ['key' => 'firewall', 'label' => 'Firewall (UFW)', 'detail' => $detail('ufw', $ufw),
-                'featureOn' => $on($ufw), 'secure' => $on($ufw)],
-            ['key' => 'unattended', 'label' => 'Automatische Updates', 'detail' => $detail('unattended-upgrades', $upg),
-                'featureOn' => $on($upg), 'secure' => $on($upg)],
+            $row('ssh_root', 'SSH-Root-Login', 'PermitRootLogin '.$root, $root !== 'no', $root === 'no', $os->supports('ssh')),
+            $row('ssh_password', 'SSH-Passwort-Login', 'PasswordAuthentication '.$pwauth, $pwauth !== 'no', $pwauth === 'no', $os->supports('ssh')),
+            $row('fail2ban', 'fail2ban', $detail('fail2ban.service', $f2b), $on($f2b), $on($f2b), $os->supports('fail2ban')),
+            $row('firewall', $os->firewallLabel(), $detail($fwName, $fw), $on($fw), $on($fw), $os->supports('firewall')),
+            $row('unattended', 'Automatische Updates', $detail($auName, $upg), $on($upg), $on($upg), $os->supports('auto_updates')),
        ];
    }

@ -106,7 +130,7 @@ class HardeningService
            'ssh_root' => $enable ? 'SSH-Root-Login erlauben' : 'SSH-Root-Login deaktivieren',
            'ssh_password' => $enable ? 'SSH-Passwort-Login erlauben' : 'SSH-Passwort-Login deaktivieren',
            'fail2ban' => $enable ? 'fail2ban aktivieren' : 'fail2ban deaktivieren',
-            'firewall' => $enable ? 'Firewall (UFW) aktivieren' : 'Firewall (UFW) deaktivieren',
+            'firewall' => $enable ? 'Firewall aktivieren' : 'Firewall deaktivieren',
            'unattended' => $enable ? 'Automatische Updates aktivieren' : 'Automatische Updates deaktivieren',
            default => throw new InvalidArgumentException("Unbekannte Härtung: {$action}"),
        };
@ -125,11 +149,11 @@ class HardeningService
                ? 'Installiert fail2ban (falls nötig) und startet den Dienst. Wiederholte Fehl-Logins werden gesperrt.'
                : 'Stoppt fail2ban und deaktiviert den Autostart.',
            'firewall' => $enable
-                ? 'Installiert UFW (falls nötig), gibt SSH + 80/443 frei und aktiviert die Firewall.'
-                : 'Deaktiviert die UFW-Firewall (ufw disable).',
+                ? 'Installiert die Firewall (falls nötig), gibt vorher SSH + 80/443 frei und aktiviert sie.'
+                : 'Deaktiviert die Firewall des Servers.',
            'unattended' => $enable
-                ? 'Installiert unattended-upgrades (falls nötig) und aktiviert die automatische Update-Periodik + Timer.'
-                : 'Schaltet die automatische Update-Periodik ab.',
+                ? 'Installiert (falls nötig) und aktiviert die automatischen Sicherheitsupdates des Systems.'
+                : 'Schaltet die automatischen Updates ab.',
            default => throw new InvalidArgumentException("Unbekannte Härtung: {$action}"),
        };
    }
@ -137,6 +161,20 @@ class HardeningService
    /** @return array{ok: bool, output: string} */
    public function apply(Server $server, string $action, bool $enable): array
    {
+        $os = $this->detector->detect($server);
+
+        // Gracefully refuse a feature the host's OS does not support.
+        $feature = match ($action) {
+            'ssh_root', 'ssh_password' => 'ssh',
+            'fail2ban' => 'fail2ban',
+            'firewall' => 'firewall',
+            'unattended' => 'auto_updates',
+            default => throw new InvalidArgumentException("Unbekannte Härtung: {$action}"),
+        };
+        if ($reason = $os->supports($feature)) {
+            return ['ok' => false, 'output' => $reason];
+        }
+
        if ($action === 'firewall') {
            $res = $enable ? $this->firewall->enable($server) : $this->firewall->disable($server);

@ -153,32 +191,49 @@ class HardeningService
            }
        }

-        // apt operations need a long timeout; the 12s default would abort the install.
+        // package operations need a long timeout; the 12s default would abort the install.
        $timeout = $enable && in_array($action, ['fail2ban', 'unattended'], true) ? 600 : 60;
-        $res = $this->fleet->runPrivileged($server, $this->commandFor($action, $enable), $timeout);
+        $res = $this->fleet->runPrivileged($server, $this->commandFor($os, $action, $enable), $timeout);

        return ['ok' => $res['ok'], 'output' => $res['output']];
    }

    /** Single source of truth for the shell command of a (non-firewall) toggle. */
-    private function commandFor(string $action, bool $enable): string
+    private function commandFor(OsProfile $os, string $action, bool $enable): string
    {
+        $pm = PackageManager::for($os);
+
        return match ($action) {
            'ssh_root' => $this->sshDropInScript('PermitRootLogin '.($enable ? 'yes' : 'no')),
            'ssh_password' => $this->sshDropInScript('PasswordAuthentication '.($enable ? 'yes' : 'no')),
            'fail2ban' => $enable
-                ? '(dpkg -l fail2ban 2>/dev/null | grep -q "^ii" || DEBIAN_FRONTEND=noninteractive apt-get install -y fail2ban) && systemctl enable --now fail2ban'
+                ? $pm->ensureInstalledScript('fail2ban').' && systemctl enable --now fail2ban'
                : 'systemctl disable --now fail2ban',
-            'unattended' => $enable
-                ? '(dpkg -l unattended-upgrades 2>/dev/null | grep -q "^ii" || DEBIAN_FRONTEND=noninteractive apt-get install -y unattended-upgrades)'
-                    .' && printf \'%s\n%s\n\' \'APT::Periodic::Update-Package-Lists "1";\' \'APT::Periodic::Unattended-Upgrade "1";\' > '.self::APT_DROPIN
-                    .' && systemctl enable --now unattended-upgrades apt-daily-upgrade.timer apt-daily.timer'
-                : 'printf \'%s\n%s\n\' \'APT::Periodic::Update-Package-Lists "0";\' \'APT::Periodic::Unattended-Upgrade "0";\' > '.self::APT_DROPIN
-                    .' && (systemctl disable --now unattended-upgrades 2>/dev/null || true)',
+            'unattended' => $this->autoUpdateScript($os, $pm, $enable),
            default => throw new InvalidArgumentException("Unbekannte Härtung: {$action}"),
        };
    }

+    /** Auto-update mechanism per family: apt periodic + timers, or dnf-automatic.timer. */
+    private function autoUpdateScript(OsProfile $os, PackageManager $pm, bool $enable): string
+    {
+        if ($os->packageManager === 'dnf') {
+            return $enable
+                ? $pm->ensureInstalledScript('dnf-automatic')
+                    .' && sed -i \'s/^apply_updates.*/apply_updates = yes/\' /etc/dnf/automatic.conf'
+                    .' && systemctl enable --now dnf-automatic.timer'
+                : 'systemctl disable --now dnf-automatic.timer';
+        }
+
+        // apt (default): the periodic drop-in + service/timers.
+        return $enable
+            ? $pm->ensureInstalledScript('unattended-upgrades')
+                .' && printf \'%s\n%s\n\' \'APT::Periodic::Update-Package-Lists "1";\' \'APT::Periodic::Unattended-Upgrade "1";\' > '.self::APT_DROPIN
+                .' && systemctl enable --now unattended-upgrades apt-daily-upgrade.timer apt-daily.timer'
+            : 'printf \'%s\n%s\n\' \'APT::Periodic::Update-Package-Lists "0";\' \'APT::Periodic::Unattended-Upgrade "0";\' > '.self::APT_DROPIN
+                .' && (systemctl disable --now unattended-upgrades 2>/dev/null || true)';
+    }
+
    /** True if the SSH user has at least one authorized key. */
    private function hasAuthorizedKey(Server $server): bool
    {
--- a/app/Services/MaintenanceService.php
+++ b/app/Services/MaintenanceService.php
@ -3,168 +3,65 @@
 namespace App\Services;

 use App\Models\Server;
-use RuntimeException;
+use App\Support\Os\OsDetector;
+use App\Support\Os\PackageManager;

 /**
- * Debian/Ubuntu (apt) maintenance helpers: counts pending package updates,
- * applies an apt upgrade, and reads/writes the fail2ban [DEFAULT] tuning.
+ * Package-maintenance helpers across apt/dnf/zypper (resolved per OS via
+ * OsDetector): counts pending package updates and applies an upgrade.
 *
 * Every reader/writer goes through FleetService, so quoting is base64-safe and
- * privileged work runs as root. Callers must clamp the fail2ban integers before
- * calling writeFail2ban(); this service only persists already-validated values.
+ * privileged work runs as root. (fail2ban tuning + management lives in Fail2banService.)
 */
 class MaintenanceService
 {
-    // A Clusev-owned drop-in. 'zz-' so it sorts LAST in jail.d and its [DEFAULT] wins
-    // (fail2ban applies the last value). We only ever write/read THIS file — never the
-    // operator's jail.local or jail definitions.
-    private const FAIL2BAN_DROPIN = '/etc/fail2ban/jail.d/zz-clusev.local';
+    public function __construct(private FleetService $fleet, private OsDetector $detector) {}

-    public function __construct(private FleetService $fleet) {}
-
-    /** True if apt-get exists on the target (only then are the update features meaningful). */
-    public function hasApt(Server $server): bool
+    /**
+     * NULL when Clusev can manage package updates on this host, otherwise a German
+     * reason (e.g. unsupported package manager) for the operator.
+     */
+    public function updateSupport(Server $server): ?string
    {
-        $res = $this->fleet->runPlain($server, 'command -v apt-get >/dev/null 2>&1 && echo 1 || echo 0');
-
-        return $res['ok'] && trim($res['output']) === '1';
+        return $this->detector->detect($server)->supports('updates');
    }

    /**
-     * Number of pending package upgrades via a dry-run simulation (no root needed),
-     * or NULL when the simulation could not run (apt absent / errored) — so the caller
-     * can show "unbekannt" rather than a misleading "0 / up to date".
+     * Number of pending package upgrades via a dry-run/metadata read (no root
+     * needed), or NULL when it could not run (unsupported manager / errored) — so
+     * the caller shows "unbekannt" rather than a misleading "0 / up to date". The
+     * remote script emits a CLUSEV_OK sentinel only when the query actually ran.
     */
    public function pendingUpdates(Server $server): ?int
    {
-        $res = $this->fleet->runPlain($server, 'apt-get -s upgrade 2>/dev/null');
-        if (! $res['ok']) {
+        $os = $this->detector->detect($server);
+        if (! $os->managesPackages()) {
            return null;
        }

-        return (int) preg_match_all('/^Inst /m', $res['output']);
+        $res = $this->fleet->runPlain($server, PackageManager::for($os)->pendingScript());
+        if (! str_contains($res['output'], 'CLUSEV_OK')) {
+            return null;
+        }
+
+        return preg_match('/CLUSEV_PENDING=(\d+)/', $res['output'], $m) ? (int) $m[1] : null;
    }

    /**
-     * apt-get update && upgrade as root. Long-running, so a 900s timeout. The
-     * returned output is trimmed to the last ~400 chars for a compact result panel.
+     * Refresh the index and apply all upgrades as root, using the host's package
+     * manager. Long-running, so a 900s timeout. Output trimmed to the last ~400
+     * chars for a compact result panel.
     *
     * @return array{ok: bool, output: string}
     */
-    public function aptUpgrade(Server $server): array
+    public function applyUpgrades(Server $server): array
    {
-        $res = $this->fleet->runPrivileged(
-            $server,
-            'apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -y upgrade',
-            900,
-        );
-
-        return ['ok' => $res['ok'], 'output' => $this->tail($res['output'], 400)];
-    }
-
-    /**
-     * Read the Clusev-managed fail2ban [DEFAULT] tuning from our OWN drop-in only —
-     * we never read the operator's jail.local or per-jail sections, so a jail's
-     * `maxretry` can't masquerade as the global default. Defaults when unset.
-     *
-     * @return array{bantime: int, maxretry: int, findtime: int}
-     */
-    public function readFail2ban(Server $server): array
-    {
-        // Read the [DEFAULT] section across all fail2ban files in fail2ban's own
-        // precedence order (last value wins). A CLUSEV_RESET marker between files
-        // stops a section bleeding across file boundaries; only [DEFAULT] keys count
-        // (a jail's maxretry must not masquerade as the global default).
-        // A leading sentinel proves the read actually RAN (sudo/SSH ok). We key success
-        // off the sentinel — NOT the loop's exit code — so a final unmatched glob (a
-        // benign "no drop-ins" case) does not look like a failure, while a genuine
-        // sudo/permission/SSH error (no sentinel echoed) IS propagated as a throw and can
-        // never be downgraded to defaults the operator might then overwrite.
-        $cmd = 'echo CLUSEV_READ_OK; for f in /etc/fail2ban/jail.conf /etc/fail2ban/jail.d/*.conf '
-            .'/etc/fail2ban/jail.local /etc/fail2ban/jail.d/*.local; do '
-            .'[ -f "$f" ] && { echo "[CLUSEV_RESET]"; cat "$f"; }; done 2>/dev/null';
-
-        $res = $this->fleet->runPrivileged($server, $cmd);
-        if (! str_contains($res['output'], 'CLUSEV_READ_OK')) {
-            throw new RuntimeException('fail2ban-Konfiguration konnte nicht gelesen werden.');
+        $os = $this->detector->detect($server);
+        if ($reason = $os->supports('updates')) {
+            return ['ok' => false, 'output' => $reason];
        }

-        return $this->parseFail2banDefaults($res['output']);
-    }
-
-    /**
-     * Section-aware parse of the effective [DEFAULT] tuning (last value wins),
-     * converting fail2ban time units (s/m/h/d/w) to seconds.
-     *
-     * @return array{bantime: int, maxretry: int, findtime: int}
-     */
-    private function parseFail2banDefaults(string $body): array
-    {
-        // bantime/findtime are kept VERBATIM — fail2ban's native duration grammar
-        // (600, 10m, 1h 30m, -1 for permanent, …) is preserved, never lossily converted
-        // to seconds. maxretry is a plain integer.
-        $vals = ['bantime' => '10m', 'maxretry' => 5, 'findtime' => '10m'];
-        $inDefault = false;
-
-        foreach (preg_split('/\R/', $body) ?: [] as $line) {
-            $t = trim($line);
-            if ($t === '' || $t[0] === '#' || $t[0] === ';') {
-                continue;
-            }
-            if (preg_match('/^\[([^\]]+)\]/', $t, $m)) {
-                $inDefault = strcasecmp(trim($m[1]), 'DEFAULT') === 0;
-
-                continue;
-            }
-            if (! $inDefault) {
-                continue;
-            }
-            if (preg_match('/^bantime\s*=\s*(.+?)\s*$/i', $t, $m)) {
-                $vals['bantime'] = $m[1];
-            } elseif (preg_match('/^findtime\s*=\s*(.+?)\s*$/i', $t, $m)) {
-                $vals['findtime'] = $m[1];
-            } elseif (preg_match('/^maxretry\s*=\s*(\d+)/i', $t, $m)) {
-                $vals['maxretry'] = (int) $m[1];
-            }
-        }
-
-        return $vals;
-    }
-
-    /**
-     * Write the Clusev [DEFAULT] block to our OWN jail.d drop-in (overwriting only
-     * that file — the operator's jail.local and jail definitions are untouched),
-     * then reload (fallback restart) fail2ban. The integers MUST already be clamped
-     * by the caller; cast here as a last line of defence.
-     *
-     * @return array{ok: bool, output: string}
-     */
-    public function writeFail2ban(Server $server, string $bantime, int $maxretry, string $findtime): array
-    {
-        $maxretry = (int) $maxretry;
-        // Durations stay in fail2ban's native grammar (validated by the caller); collapse
-        // any stray whitespace/newlines so the written ini line stays well-formed.
-        $bantime = trim(preg_replace('/\s+/', ' ', $bantime) ?? '');
-        $findtime = trim(preg_replace('/\s+/', ' ', $findtime) ?? '');
-
-        // Build the config with base64 so it never touches the shell unquoted; the
-        // whole command is itself base64-wrapped again by runPrivileged.
-        $content = "# Managed by Clusev — do not edit by hand.\n"
-            ."[DEFAULT]\n"
-            ."bantime = {$bantime}\n"
-            ."findtime = {$findtime}\n"
-            ."maxretry = {$maxretry}\n";
-
-        $b64 = base64_encode($content);
-
-        // Write the drop-in; reload ONLY if fail2ban is already running (never start an
-        // inactive service from the settings form). A reload failure while active IS
-        // propagated (the `if` returns reload's exit code); inactive succeeds silently.
-        $cmd = 'mkdir -p /etc/fail2ban/jail.d'
-            .' && printf %s '.$b64.' | base64 -d > '.self::FAIL2BAN_DROPIN
-            .' && if systemctl is-active --quiet fail2ban; then systemctl reload fail2ban; fi';
-
-        $res = $this->fleet->runPrivileged($server, $cmd, 120);
+        $res = $this->fleet->runPrivileged($server, PackageManager::for($os)->applyScript(), 900);

        return ['ok' => $res['ok'], 'output' => $this->tail($res['output'], 400)];
    }
--- a/app/Support/Os/FirewallTool.php
+++ b/app/Support/Os/FirewallTool.php
@ -0,0 +1,162 @@
+<?php
+
+namespace App\Support\Os;
+
+/**
+ * Shell command strings for the host firewall (ufw or firewalld), built per OS.
+ *
+ * Safety model is preserved across both tools: enableScript() ALWAYS opens the
+ * real sshd port + 80/443 BEFORE turning the firewall on, so Clusev can never sever
+ * its own SSH session. Disable is the clean stop — never `firewall-cmd --panic-on`
+ * (which would drop ALL traffic, the exact lockout the guard avoids).
+ */
+final class FirewallTool
+{
+    private const MARK = '===CLUSEV:';
+
+    /** @param  'ufw'|'firewalld'  $tool */
+    public function __construct(
+        private string $tool,
+        private PackageManager $pm,
+        private bool $canInstall,
+    ) {}
+
+    public static function for(OsProfile $os): self
+    {
+        return new self(
+            $os->firewallTool === 'firewalld' ? 'firewalld' : 'ufw',
+            $os->managesPackages() ? PackageManager::for($os) : new PackageManager('none'),
+            $os->managesPackages(),
+        );
+    }
+
+    public function isFirewalld(): bool
+    {
+        return $this->tool === 'firewalld';
+    }
+
+    private function packageName(): string
+    {
+        return $this->tool === 'firewalld' ? 'firewalld' : 'ufw';
+    }
+
+    /** Guarded enable: install if needed + missing, open ssh/80/443, then turn on. */
+    public function enableScript(int $sshPort): string
+    {
+        $ensure = $this->canInstall ? $this->pm->ensureInstalledScript($this->packageName()).' && ' : '';
+
+        if ($this->isFirewalld()) {
+            $ports = "--add-port={$sshPort}/tcp --add-port=80/tcp --add-port=443/tcp";
+
+            // GUARD: open ssh/80/443 in the PERMANENT config BEFORE firewalld starts
+            // filtering, so starting it can never drop the operator's SSH session (a
+            // custom SSH port is not in the default zone). Handle both states: if the
+            // daemon is already running, add to permanent + reload; if it is stopped,
+            // write the permanent rules offline first, THEN start it.
+            return $ensure
+                .'if systemctl is-active --quiet firewalld; then '
+                    ."firewall-cmd --permanent {$ports} && systemctl enable --now firewalld && firewall-cmd --reload; "
+                .'else '
+                    ."firewall-offline-cmd {$ports} && systemctl enable --now firewalld; "
+                .'fi';
+        }
+
+        return $ensure
+            ."ufw allow {$sshPort}/tcp && ufw allow 80/tcp && ufw allow 443/tcp && ufw --force enable";
+    }
+
+    /** Clean disable (never a panic/drop-all). */
+    public function disableScript(): string
+    {
+        return $this->isFirewalld() ? 'systemctl disable --now firewalld' : 'ufw disable';
+    }
+
+    /** Shell CONDITION exiting 0 when the firewall binary is present. */
+    public function installedTest(): string
+    {
+        return $this->isFirewalld()
+            ? 'command -v firewall-cmd >/dev/null 2>&1'
+            : 'command -v ufw >/dev/null 2>&1';
+    }
+
+    /** Shell CONDITION exiting 0 when the firewall is currently active. */
+    public function activeTest(): string
+    {
+        return $this->isFirewalld()
+            ? 'systemctl is-active --quiet firewalld'
+            : 'ufw status 2>/dev/null | grep -qi "Status: active"';
+    }
+
+    /** One privileged read of the firewall state, marker-sectioned for parsing. */
+    public function statusScript(): string
+    {
+        if ($this->isFirewalld()) {
+            // firewalld is READ-ONLY in this release (rule mutation is ufw-only), so we
+            // read the RUNTIME state of the active default zone — exactly what is being
+            // enforced right now — which also sidesteps any runtime/permanent zone drift.
+            // Enumerate EVERY active zone (an interface/source may be bound to a
+            // non-default zone), so the read-only view reflects all enforced rules.
+            $zones = 'firewall-cmd --get-active-zones 2>/dev/null | grep -v "^[[:space:]]"';
+
+            return 'echo CLUSEV_FWREAD_OK; '
+                .'echo '.self::MARK.'inst===; command -v firewall-cmd >/dev/null 2>&1 && echo yes || echo no; '
+                .'echo '.self::MARK.'active===; systemctl is-active --quiet firewalld && echo active || echo inactive; '
+                .'echo '.self::MARK.'zone===; firewall-cmd --get-default-zone 2>/dev/null; '
+                // emit "zone|value" per line so each rule keeps its zone attribution.
+                .'echo '.self::MARK.'ports===; for z in $('.$zones.'); do for p in $(firewall-cmd --zone="$z" --list-ports 2>/dev/null); do echo "$z|$p"; done; done; '
+                .'echo '.self::MARK.'services===; for z in $('.$zones.'); do for s in $(firewall-cmd --zone="$z" --list-services 2>/dev/null); do echo "$z|$s"; done; done; '
+                .'echo '.self::MARK.'rich===; for z in $('.$zones.'); do firewall-cmd --zone="$z" --list-rich-rules 2>/dev/null | while IFS= read -r r; do [ -n "$r" ] && echo "$z|$r"; done; done';
+        }
+
+        return 'echo CLUSEV_FWREAD_OK; '
+            .'echo '.self::MARK.'inst===; command -v ufw >/dev/null 2>&1 && echo yes || echo no; '
+            .'echo '.self::MARK.'verbose===; ufw status verbose 2>/dev/null; '
+            // `ufw show added` lists user rules in add-syntax and works whether ufw is
+            // active OR inactive (status only shows rules while active); the spec
+            // doubles as the delete argument, so deletes need no rule NUMBER (race-free).
+            .'echo '.self::MARK.'added===; ufw show added 2>/dev/null; '
+            // defaults from the config file so they are correct even when inactive.
+            .'echo '.self::MARK.'defaults===; grep -E "^DEFAULT_(INPUT|OUTPUT)_POLICY" /etc/default/ufw 2>/dev/null';
+    }
+
+    /**
+     * Build the ufw add command from already-validated parts (action/proto/port/from).
+     * Rule mutation is ufw-only in this release; firewalld is read-only.
+     */
+    public function addRuleScript(string $action, string $proto, ?int $port, ?string $from): string
+    {
+        $spec = $action;
+        if ($from !== null && $from !== '') {
+            // ufw extended syntax wants `proto <p>` BEFORE the `from` clause; the
+            // trailing-proto form is rejected. proto is kept even without a port so a
+            // source-only rule constrains the protocol instead of allowing all.
+            if ($proto !== 'any') {
+                $spec .= ' proto '.$proto;
+            }
+            $spec .= ' from '.$from;
+            if ($port !== null) {
+                $spec .= ' to any port '.$port;
+            }
+        } elseif ($port !== null) {
+            $spec .= ' '.$port.($proto !== 'any' ? '/'.$proto : '');
+        }
+
+        return 'ufw '.$spec;
+    }
+
+    /**
+     * Delete a ufw rule by its add-syntax spec (e.g. "allow 80/tcp"). Race-free:
+     * no rule number is involved, so a concurrent change cannot shift the target.
+     * Deleting by rule does not prompt (unlike delete-by-number).
+     */
+    public function deleteUfwScript(string $spec): string
+    {
+        // Routed rules use the route grammar: "ufw route delete allow …" (NOT "ufw
+        // delete route …", which ufw rejects).
+        if (preg_match('/^route\s+(.+)$/i', $spec, $m)) {
+            return 'ufw route delete '.$m[1];
+        }
+
+        return 'ufw delete '.$spec;
+    }
+}
--- a/app/Support/Os/OsDetector.php
+++ b/app/Support/Os/OsDetector.php
@ -0,0 +1,186 @@
+<?php
+
+namespace App\Support\Os;
+
+use App\Models\Server;
+use App\Services\FleetService;
+use Illuminate\Support\Facades\Cache;
+
+/**
+ * Resolves a Server's OsProfile from one unprivileged probe (/etc/os-release +
+ * `command -v`), cached for an hour per server. The family is inferred from
+ * ID/ID_LIKE, cross-checked against the binaries actually present so a derivative
+ * (e.g. ID_LIKE="rhel fedora") still resolves and the installed tool wins.
+ */
+class OsDetector
+{
+    private const PROBE_BINARIES = [
+        'apt-get', 'dnf', 'yum', 'zypper', 'pacman', 'apk',
+        'firewall-cmd', 'ufw', 'nft', 'systemctl', 'rc-service',
+    ];
+
+    public function __construct(private FleetService $fleet) {}
+
+    /** Detect (and cache) the OS profile of a server. */
+    public function detect(Server $server, bool $fresh = false): OsProfile
+    {
+        $key = 'os-profile:'.$server->id;
+
+        if (! $fresh) {
+            $cached = Cache::get($key);
+            if ($cached instanceof OsProfile) {
+                return $cached;
+            }
+        }
+
+        // Include the sbin dirs: ufw/firewall-cmd live in /usr/sbin, which is not on a
+        // non-root user's PATH, so a bare `command -v ufw` would miss an installed tool.
+        // Guard the source: `.` is a POSIX special built-in, so sourcing a MISSING
+        // /etc/os-release would make a non-interactive sh exit before the binary
+        // probe runs — defeating the package-manager fallback. Only source when readable.
+        $probe = 'export PATH="/usr/local/sbin:/usr/sbin:/sbin:$PATH"; '
+            .'[ -r /etc/os-release ] && . /etc/os-release 2>/dev/null; '
+            .'echo "ID=${ID:-}"; echo "ID_LIKE=${ID_LIKE:-}"; echo "PRETTY=${PRETTY_NAME:-}"; '
+            .'for p in '.implode(' ', self::PROBE_BINARIES).'; do command -v "$p" >/dev/null 2>&1 && echo "HAS=$p"; done; '
+            // which firewall is actually RUNNING — decides the tool when both are installed.
+            .'systemctl is-active --quiet firewalld 2>/dev/null && echo ACTIVE=firewalld; '
+            .'systemctl is-active --quiet ufw 2>/dev/null && echo ACTIVE=ufw';
+
+        // Parse the output regardless of exit code: the probe's status reflects the
+        // LAST `command -v` (often a binary that is legitimately absent, e.g.
+        // rc-service on a systemd host), so a non-zero exit is normal and the
+        // ID=/HAS= lines that printed are still valid.
+        $res = $this->fleet->runPlain($server, $probe);
+        $profile = $this->parse($res['output']);
+
+        // Don't lock in a "nothing detected" result (transient SSH failure / host
+        // down) for a full hour — re-probe soon in that case.
+        $detected = $profile->id !== '' || $profile->available !== [];
+        Cache::put($key, $profile, $detected ? now()->addHour() : now()->addSeconds(60));
+
+        return $profile;
+    }
+
+    /** Drop the cached profile (call after a credential change or on demand). */
+    public function forget(Server $server): void
+    {
+        Cache::forget('os-profile:'.$server->id);
+    }
+
+    private function parse(string $out): OsProfile
+    {
+        $id = '';
+        $idLike = '';
+        $pretty = '';
+        $available = [];
+        $active = [];
+
+        foreach (preg_split('/\R/', $out) ?: [] as $line) {
+            $line = trim($line);
+            if (str_starts_with($line, 'ID=')) {
+                $id = strtolower(trim(substr($line, 3), " \"'"));
+            } elseif (str_starts_with($line, 'ID_LIKE=')) {
+                $idLike = strtolower(trim(substr($line, 8), " \"'"));
+            } elseif (str_starts_with($line, 'PRETTY=')) {
+                $pretty = trim(substr($line, 7), " \"'");
+            } elseif (str_starts_with($line, 'HAS=')) {
+                $available[] = substr($line, 4);
+            } elseif (str_starts_with($line, 'ACTIVE=')) {
+                $active[] = substr($line, 7);
+            }
+        }
+
+        $tokens = array_values(array_filter(array_merge([$id], preg_split('/\s+/', $idLike) ?: [])));
+        $family = $this->family($tokens, $available);
+
+        return new OsProfile(
+            family: $family,
+            id: $id,
+            prettyName: $pretty !== '' ? $pretty : 'Unbekanntes System',
+            packageManager: $this->packageManager($available),
+            firewallTool: $this->firewallTool($family, $available, $active),
+            serviceManager: in_array('systemctl', $available, true)
+                ? 'systemd'
+                : (in_array('rc-service', $available, true) ? 'openrc' : 'none'),
+            available: $available,
+        );
+    }
+
+    /** @param  list<string>  $tokens */
+    private function family(array $tokens, array $available): string
+    {
+        $hit = fn (array $names): bool => count(array_intersect($names, $tokens)) > 0;
+
+        if ($hit(['debian', 'ubuntu', 'raspbian', 'linuxmint', 'pop', 'devuan', 'kali'])) {
+            return 'debian';
+        }
+        if ($hit(['rhel', 'fedora', 'centos', 'rocky', 'almalinux', 'ol', 'amzn'])) {
+            return 'rhel';
+        }
+        if ($hit(['suse', 'opensuse', 'opensuse-leap', 'opensuse-tumbleweed', 'sles', 'sled'])) {
+            return 'suse';
+        }
+        if ($hit(['arch', 'manjaro', 'endeavouros', 'arcolinux'])) {
+            return 'arch';
+        }
+        if ($hit(['alpine'])) {
+            return 'alpine';
+        }
+
+        // No ID match — fall back to whichever package manager is actually present.
+        return match (true) {
+            in_array('apt-get', $available, true) => 'debian',
+            in_array('dnf', $available, true), in_array('yum', $available, true) => 'rhel',
+            in_array('zypper', $available, true) => 'suse',
+            in_array('pacman', $available, true) => 'arch',
+            in_array('apk', $available, true) => 'alpine',
+            default => 'unknown',
+        };
+    }
+
+    /** @param  list<string>  $available */
+    private function packageManager(array $available): string
+    {
+        return match (true) {
+            in_array('apt-get', $available, true) => 'apt',
+            in_array('dnf', $available, true), in_array('yum', $available, true) => 'dnf',
+            in_array('zypper', $available, true) => 'zypper',
+            in_array('pacman', $available, true) => 'pacman',
+            in_array('apk', $available, true) => 'apk',
+            default => 'none',
+        };
+    }
+
+    /**
+     * @param  list<string>  $available
+     * @param  list<string>  $active  firewall tools reported running (firewalld/ufw)
+     */
+    private function firewallTool(string $family, array $available, array $active): string
+    {
+        $hasFirewalld = in_array('firewall-cmd', $available, true);
+        $hasUfw = in_array('ufw', $available, true);
+
+        // Both installed: the RUNNING one wins (managing the inactive tool would
+        // report the wrong state and could start a second firewall manager).
+        if ($hasFirewalld && $hasUfw) {
+            if (in_array('firewalld', $active, true)) {
+                return 'firewalld';
+            }
+            if (in_array('ufw', $active, true)) {
+                return 'ufw';
+            }
+        } elseif ($hasFirewalld) {
+            return 'firewalld';
+        } elseif ($hasUfw) {
+            return 'ufw';
+        }
+
+        // Nothing installed (or both present but neither active) — default by family
+        // so enable() installs/uses the conventional tool for the distro.
+        return match ($family) {
+            'rhel', 'suse' => 'firewalld',
+            'debian', 'arch', 'alpine' => 'ufw',
+            default => 'none',
+        };
+    }
+}
--- a/app/Support/Os/OsProfile.php
+++ b/app/Support/Os/OsProfile.php
@ -0,0 +1,106 @@
+<?php
+
+namespace App\Support\Os;
+
+/**
+ * Immutable description of a fleet host's operating system, resolved once by
+ * OsDetector from /etc/os-release + a `command -v` probe. Everything that used to
+ * hard-code Debian/apt/ufw/systemd now asks an OsProfile instead.
+ *
+ * Phase-1 fully-supported package managers: apt, dnf (incl. yum), zypper — all on
+ * systemd hosts with ufw or firewalld. Arch (pacman) and Alpine (apk/OpenRC) are
+ * DETECTED and surfaced, but features that need an unsupported manager/init are
+ * gracefully disabled with a German reason via supports().
+ */
+final class OsProfile
+{
+    /** Package managers Clusev can drive for updates/installs in this release. */
+    public const SUPPORTED_MANAGERS = ['apt', 'dnf', 'zypper'];
+
+    /**
+     * @param  list<string>  $available  detected binaries (apt-get, dnf, ufw, firewall-cmd, systemctl, …)
+     */
+    public function __construct(
+        public readonly string $family,          // debian|rhel|suse|arch|alpine|unknown
+        public readonly string $id,              // raw /etc/os-release ID
+        public readonly string $prettyName,      // PRETTY_NAME for display
+        public readonly string $packageManager,  // apt|dnf|zypper|pacman|apk|none
+        public readonly string $firewallTool,    // ufw|firewalld|none
+        public readonly string $serviceManager,  // systemd|openrc|none
+        public readonly array $available = [],
+    ) {}
+
+    public function has(string $binary): bool
+    {
+        return in_array($binary, $this->available, true);
+    }
+
+    public function isSystemd(): bool
+    {
+        return $this->serviceManager === 'systemd';
+    }
+
+    /** True when Clusev can drive package install/update on this host. */
+    public function managesPackages(): bool
+    {
+        return in_array($this->packageManager, self::SUPPORTED_MANAGERS, true);
+    }
+
+    /** German family label for the UI. */
+    public function familyLabel(): string
+    {
+        return match ($this->family) {
+            'debian' => 'Debian/Ubuntu',
+            'rhel' => 'RHEL/Fedora',
+            'suse' => 'openSUSE/SLES',
+            'arch' => 'Arch Linux',
+            'alpine' => 'Alpine Linux',
+            default => 'Unbekanntes System',
+        };
+    }
+
+    /** German label for the host firewall in the hardening checklist. */
+    public function firewallLabel(): string
+    {
+        return match ($this->firewallTool) {
+            'ufw' => 'Firewall (UFW)',
+            'firewalld' => 'Firewall (firewalld)',
+            default => 'Firewall',
+        };
+    }
+
+    /**
+     * Whether a feature is supported on this host. Returns NULL when supported, or
+     * a German reason to show the operator when not — so unsupported combinations
+     * degrade with an explanation instead of failing opaquely.
+     */
+    public function supports(string $feature): ?string
+    {
+        return match ($feature) {
+            'ssh' => $this->isSystemd()
+                ? null
+                : 'SSH-Härtung benötigt systemd, das auf '.$this->familyLabel().' nicht erkannt wurde.',
+            'services' => $this->isSystemd()
+                ? null
+                : 'Dienst-Steuerung benötigt systemd, das hier nicht erkannt wurde.',
+            'updates' => $this->managesPackages()
+                ? null
+                : 'Paket-Updates über Clusev werden unter '.$this->familyLabel().' noch nicht unterstützt.',
+            'fail2ban' => ($this->managesPackages() && $this->isSystemd())
+                ? null
+                : 'fail2ban wird unter '.$this->familyLabel().' über Clusev noch nicht unterstützt.',
+            'firewall' => ($this->firewallTool !== 'none' && $this->isSystemd()
+                && ($this->firewallTool === 'firewalld' || $this->managesPackages() || $this->has('ufw')))
+                ? null
+                : 'Eine unterstützte Firewall (UFW oder firewalld) wurde unter '.$this->familyLabel().' nicht gefunden.',
+            // apt -> unattended-upgrades; dnf -> dnf-automatic. A yum-ONLY host (e.g.
+            // CentOS 7) maps to the dnf manager for upgrades but has no dnf-automatic
+            // (it uses yum-cron), so require a real `dnf` binary for this feature.
+            'auto_updates' => (($this->packageManager === 'apt'
+                || ($this->packageManager === 'dnf' && $this->has('dnf'))) && $this->isSystemd())
+                ? null
+                : 'Automatische Updates werden unter '.$this->familyLabel().' über Clusev noch nicht unterstützt.',
+            default => null,
+        };
+    }
+}
--- a/app/Support/Os/PackageManager.php
+++ b/app/Support/Os/PackageManager.php
@ -0,0 +1,94 @@
+<?php
+
+namespace App\Support\Os;
+
+/**
+ * Builds SHELL COMMAND STRINGS for package operations, per manager. It never runs
+ * anything — FleetService is the single executor (base64-wrapped, sudo + LC_ALL=C
+ * handled there). Only apt/dnf/zypper are driven this release; package names passed
+ * in are Clusev constants (fail2ban, ufw, …), never operator input.
+ *
+ * Note: the dnf/zypper command strings are constructed from documented syntax but
+ * are exercised live only on the families a tester actually runs; the apt path is
+ * the one verified against the live fleet today.
+ */
+final class PackageManager
+{
+    /** @param  'apt'|'dnf'|'zypper'|'none'  $manager */
+    public function __construct(
+        private string $manager,
+        private bool $useYum = false,   // dnf family lacking the dnf binary -> yum
+    ) {}
+
+    public static function for(OsProfile $os): self
+    {
+        $useYum = $os->packageManager === 'dnf' && ! $os->has('dnf') && $os->has('yum');
+
+        return new self($os->packageManager, $useYum);
+    }
+
+    private function dnf(): string
+    {
+        return $this->useYum ? 'yum' : 'dnf';
+    }
+
+    /**
+     * A command that prints `CLUSEV_OK` (only when the query actually ran) and
+     * `CLUSEV_PENDING=<n>`. Runs unprivileged (simulation / metadata read only).
+     */
+    public function pendingScript(): string
+    {
+        return match ($this->manager) {
+            'apt' => 'out=$(apt-get -s upgrade 2>/dev/null) && echo CLUSEV_OK; '
+                ."echo \"CLUSEV_PENDING=\$(printf '%s\\n' \"\$out\" | grep -c '^Inst ')\"",
+            'dnf' => 'out=$('.$this->dnf().' -q check-update 2>/dev/null); rc=$?; '
+                .'if [ "$rc" = 0 ] || [ "$rc" = 100 ]; then echo CLUSEV_OK; fi; '
+                ."echo \"CLUSEV_PENDING=\$(printf '%s\\n' \"\$out\" | grep -cE '^[[:graph:]]+[[:space:]]+[[:graph:]]+[[:space:]]+[[:graph:]]+')\"",
+            'zypper' => 'out=$(zypper --non-interactive list-updates 2>/dev/null); rc=$?; '
+                .'[ "$rc" = 0 ] && echo CLUSEV_OK; '
+                ."echo \"CLUSEV_PENDING=\$(printf '%s\\n' \"\$out\" | grep -cE '^v \\|')\"",
+            default => 'echo CLUSEV_PENDING=0',
+        };
+    }
+
+    /** Refresh index + apply all upgrades (privileged, long-running). */
+    public function applyScript(): string
+    {
+        return match ($this->manager) {
+            'apt' => 'apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -y upgrade',
+            'dnf' => $this->dnf().' -y upgrade',
+            // zypper exits 102 (reboot required) / 103 (restart zypper) on SUCCESS —
+            // normalize those to 0 so a successful upgrade is not reported as failed.
+            'zypper' => 'zypper --non-interactive refresh && { zypper --non-interactive update; rc=$?; '
+                .'[ "$rc" = 0 ] || [ "$rc" = 102 ] || [ "$rc" = 103 ]; }',
+            default => 'false',
+        };
+    }
+
+    /** Install one package (privileged). */
+    public function installScript(string $pkg): string
+    {
+        return match ($this->manager) {
+            'apt' => 'DEBIAN_FRONTEND=noninteractive apt-get install -y '.$pkg,
+            'dnf' => $this->dnf().' install -y '.$pkg,
+            'zypper' => 'zypper --non-interactive install '.$pkg,
+            default => 'false',
+        };
+    }
+
+    /** A shell CONDITION that exits 0 when $pkg is installed (for use with && / ||). */
+    public function isInstalledTest(string $pkg): string
+    {
+        return match ($this->manager) {
+            'apt' => "dpkg -l {$pkg} 2>/dev/null | grep -q '^ii'",
+            'dnf', 'zypper' => "rpm -q {$pkg} >/dev/null 2>&1",
+            default => 'false',
+        };
+    }
+
+    /** Install $pkg only if missing (idempotent). */
+    public function ensureInstalledScript(string $pkg): string
+    {
+        return '('.$this->isInstalledTest($pkg).' || '.$this->installScript($pkg).')';
+    }
+}
--- a/config/clusev.php
+++ b/config/clusev.php
@ -3,7 +3,7 @@
 return [
    // First tagged release is v0.1.0 (semantic, not -dev). The live build hash
    // is resolved from .git at runtime (see App\Livewire\Versions\Index).
-    'version' => '0.1.1',
+    'version' => '0.2.0',

    // Default user channel. Only 'stable' and 'beta' are ever offered to users.
    'channel' => 'stable',
--- a/resources/js/app.js
+++ b/resources/js/app.js
@ -66,4 +66,132 @@ document.addEventListener('alpine:init', () => {
        get memLine() { return this._coords(this.mem); },
        get memArea() { return `0,100 ${this._coords(this.mem)} 300,100`; },
    }));
+
+    // ── Command palette + keyboard shortcuts ────────────────────────────
+    // German nav targets (mirrors the sidebar) with a leader-key hint. Leader
+    // mnemonics: i=dIenste, l=Log, e=Einstellungen, y=sYstem (d/s already taken).
+    const CMDK_NAV = [
+        { label: 'Dashboard', href: '/', hint: 'g d' },
+        { label: 'Server', href: '/servers', hint: 'g s' },
+        { label: 'Dienste', href: '/services', hint: 'g i' },
+        { label: 'Dateien', href: '/files', hint: 'g f' },
+        { label: 'Audit-Log', href: '/audit', hint: 'g l' },
+        { label: 'Einstellungen', href: '/settings', hint: 'g e' },
+        { label: 'System', href: '/system', hint: 'g y' },
+        { label: 'Version', href: '/versions', hint: 'g v' },
+    ];
+    const CMDK_ACTIONS = [
+        { label: 'Server hinzufügen', action: 'create-server', hint: '' },
+    ];
+    const CMDK_GO = { d: '/', s: '/servers', i: '/services', f: '/files', l: '/audit', e: '/settings', y: '/system', v: '/versions' };
+
+    window.Alpine.data('cmdk', () => ({
+        open: false,
+        help: false,
+        query: '',
+        active: 0,
+        leader: false,
+        leaderTimer: null,
+        nav: CMDK_NAV,
+
+        init() {
+            // Reset overlays after an SPA navigation. The component is recreated on each
+            // wire:navigate, so we MUST remove this document listener in destroy() — else
+            // every navigation would accumulate another permanent callback.
+            this._onNav = () => {
+                this.open = false;
+                this.help = false;
+                this.leader = false;
+            };
+            document.addEventListener('livewire:navigated', this._onNav);
+        },
+
+        destroy() {
+            document.removeEventListener('livewire:navigated', this._onNav);
+        },
+
+        get items() {
+            const q = this.query.trim().toLowerCase();
+            const all = [...CMDK_NAV, ...CMDK_ACTIONS];
+            return q === '' ? all : all.filter((i) => i.label.toLowerCase().includes(q));
+        },
+
+        toggle(force) {
+            this.open = force === true ? true : ! this.open;
+            if (this.open) {
+                this.help = false;
+                this.query = '';
+                this.active = 0;
+                this.$nextTick(() => this.$refs.input?.focus());
+            }
+        },
+
+        close() {
+            this.open = false;
+            this.help = false;
+        },
+
+        move(d) {
+            const n = this.items.length;
+            if (n) this.active = (this.active + d + n) % n;
+        },
+
+        run(item) {
+            item = item || this.items[this.active] || null;
+            if (! item) return;
+            if (item.href) {
+                this.navigate(item.href);
+            } else if (item.action === 'create-server') {
+                this.close();
+                window.Livewire?.dispatch('openModal', { component: 'modals.create-server' });
+            }
+        },
+
+        navigate(href) {
+            this.close();
+            if (window.Livewire?.navigate) window.Livewire.navigate(href);
+            else window.location.href = href;
+        },
+
+        focusSearch() {
+            const el = document.querySelector('[data-page-search]');
+            if (el) {
+                el.focus();
+
+                return true;
+            }
+
+            return false;
+        },
+
+        go(key) {
+            if (CMDK_GO[key]) this.navigate(CMDK_GO[key]);
+        },
+
+        onKey(e) {
+            // Cmd/Ctrl-K toggles the palette even from within an input.
+            if ((e.key === 'k' || e.key === 'K') && (e.metaKey || e.ctrlKey)) {
+                e.preventDefault();
+                this.toggle();
+                return;
+            }
+            if (this.open || this.help) return; // overlay keys handled in the markup
+            const t = e.target;
+            if (t && (t.tagName === 'INPUT' || t.tagName === 'TEXTAREA' || t.tagName === 'SELECT' || t.isContentEditable)) return;
+            if (e.metaKey || e.ctrlKey || e.altKey) return;
+            // Only consume "/" when a page search exists — otherwise leave the browser's quick-find.
+            if (e.key === '/') { if (this.focusSearch()) e.preventDefault(); return; }
+            if (e.key === '?') { e.preventDefault(); this.help = true; return; }
+            if (this.leader) {
+                this.leader = false;
+                clearTimeout(this.leaderTimer);
+                this.go(e.key.toLowerCase());
+                return;
+            }
+            if (e.key === 'g' || e.key === 'G') {
+                this.leader = true;
+                this.leaderTimer = setTimeout(() => { this.leader = false; }, 1200);
+            }
+        },
+    }));
 });
--- a/resources/views/components/command-palette.blade.php
+++ b/resources/views/components/command-palette.blade.php
@ -0,0 +1,89 @@
+{{--
+    Command palette + keyboard shortcuts. Mounted ONCE in the persistent layout so it
+    survives wire:navigate and its global keydown listener is registered only once.
+    Strg/⌘-K opens it; "g" + a key navigates; "/" focuses the page search; "?" shows help.
+--}}
+@php
+    $chords = [
+        ['Strg / ⌘  K', 'Befehle öffnen'],
+        ['/', 'Suche auf der Seite fokussieren'],
+        ['?', 'Diese Hilfe anzeigen'],
+        ['g  d', 'Dashboard'],
+        ['g  s', 'Server'],
+        ['g  i', 'Dienste'],
+        ['g  f', 'Dateien'],
+        ['g  l', 'Audit-Log'],
+        ['g  e', 'Einstellungen'],
+        ['g  y', 'System'],
+        ['g  v', 'Version'],
+    ];
+    $kbd = 'rounded border border-line bg-inset px-1.5 py-0.5 font-mono text-[10px] text-ink-2';
+@endphp
+<div x-data="cmdk"
+     @keydown.window="onKey($event)"
+     @keydown.escape.window="close()"
+     @cmdk-open.window="toggle(true)">
+
+    {{-- Command palette --}}
+    <div x-show="open" x-cloak class="fixed inset-0 z-50 flex items-start justify-center px-4 pt-[12vh]" role="dialog" aria-modal="true">
+        <div class="fixed inset-0 bg-void/70 backdrop-blur-sm" @click="close()" aria-hidden="true"></div>
+
+        <div x-show="open" x-transition
+             class="relative w-full max-w-xl overflow-hidden rounded-lg border border-line bg-surface shadow-pop">
+            <div class="flex items-center gap-2.5 border-b border-line px-4">
+                <x-icon name="search" class="h-4 w-4 shrink-0 text-ink-3" />
+                <input x-ref="input" x-model="query" type="text" autocomplete="off" spellcheck="false"
+                       placeholder="Befehl oder Seite…"
+                       @input="active = 0"
+                       @keydown.down.prevent="move(1)"
+                       @keydown.up.prevent="move(-1)"
+                       @keydown.enter.prevent="run()"
+                       class="h-12 w-full bg-transparent font-mono text-sm text-ink placeholder:text-ink-4 focus:outline-none" />
+                <span class="shrink-0 font-mono text-[10px] uppercase tracking-wider text-ink-4">Esc</span>
+            </div>
+
+            <ul class="max-h-80 overflow-y-auto py-1.5">
+                <template x-for="(item, idx) in items" :key="item.label">
+                    <li>
+                        <button type="button"
+                                @click="run(item)"
+                                @mouseenter="active = idx"
+                                :class="active === idx ? 'bg-accent/10 text-accent-text' : 'text-ink-2'"
+                                class="flex w-full items-center justify-between gap-3 px-4 py-2 text-left">
+                            <span class="truncate font-mono text-sm" x-text="item.label"></span>
+                            <span class="shrink-0 font-mono text-[10px] uppercase tracking-wider text-ink-4" x-text="item.hint"></span>
+                        </button>
+                    </li>
+                </template>
+                <li x-show="items.length === 0" class="px-4 py-3 font-mono text-[11px] text-ink-4">Kein Treffer.</li>
+            </ul>
+
+            <div class="flex items-center justify-between border-t border-line px-4 py-2 font-mono text-[10px] text-ink-4">
+                <span class="flex items-center gap-1.5"><x-icon name="corner-down-left" class="h-3 w-3" /> öffnen</span>
+                <button type="button" @click="open = false; help = true" class="hover:text-ink-2">? Tastenkürzel</button>
+            </div>
+        </div>
+    </div>
+
+    {{-- Shortcut help --}}
+    <div x-show="help" x-cloak class="fixed inset-0 z-50 flex items-start justify-center px-4 pt-[12vh]" role="dialog" aria-modal="true">
+        <div class="fixed inset-0 bg-void/70 backdrop-blur-sm" @click="help = false" aria-hidden="true"></div>
+        <div x-show="help" x-transition class="relative w-full max-w-md overflow-hidden rounded-lg border border-line bg-surface shadow-pop">
+            <div class="flex items-center gap-2.5 border-b border-line px-4 py-3">
+                <x-icon name="command" class="h-4 w-4 shrink-0 text-accent-text" />
+                <h2 class="font-display text-sm font-semibold text-ink">Tastenkürzel</h2>
+                <button type="button" @click="help = false" class="ml-auto text-ink-4 hover:text-ink" aria-label="Schließen">
+                    <x-icon name="x" class="h-4 w-4" />
+                </button>
+            </div>
+            <dl class="divide-y divide-line">
+                @foreach ($chords as [$chord, $desc])
+                    <div class="flex items-center justify-between gap-3 px-4 py-2">
+                        <dt class="text-sm text-ink-2">{{ $desc }}</dt>
+                        <dd class="shrink-0"><span class="{{ $kbd }}">{{ $chord }}</span></dd>
+                    </div>
+                @endforeach
+            </dl>
+        </div>
+    </div>
+</div>
--- a/resources/views/components/icon.blade.php
+++ b/resources/views/components/icon.blade.php
@ -15,6 +15,8 @@
        'folder'     => '<path d="M20 20a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2h-7.9a2 2 0 0 1-1.69-.9L9.6 3.9A2 2 0 0 0 7.93 3H4a2 2 0 0 0-2 2v13a2 2 0 0 0 2 2Z"/>',
        'audit'      => '<path d="M15 12h-5"/><path d="M15 8h-5"/><path d="M19 17V5a2 2 0 0 0-2-2H4"/><path d="M8 21h12a2 2 0 0 0 2-2v-1a1 1 0 0 0-1-1H11a1 1 0 0 0-1 1v1a2 2 0 1 1-4 0V5a2 2 0 1 0-4 0v2a1 1 0 0 0 1 1h3"/>',
        'file'       => '<path d="M15 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V7Z"/><path d="M14 2v4a2 2 0 0 0 2 2h4"/>',
+        'command'    => '<path d="M15 6v12a3 3 0 1 0 3-3H6a3 3 0 1 0 3 3V6a3 3 0 1 0-3 3h12a3 3 0 1 0-3-3"/>',
+        'corner-down-left' => '<path d="M20 4v7a4 4 0 0 1-4 4H4"/><path d="m9 10-5 5 5 5"/>',
        'activity'   => '<path d="M22 12h-4l-3 9L9 3l-3 9H2"/>',
        'switcher'   => '<path d="m7 15 5 5 5-5"/><path d="m7 9 5-5 5 5"/>',
        'search'     => '<circle cx="11" cy="11" r="8"/><path d="m21 21-4.3-4.3"/>',
--- a/resources/views/components/topbar.blade.php
+++ b/resources/views/components/topbar.blade.php
@ -9,6 +9,12 @@
    <h1 class="min-w-0 truncate font-display text-sm font-semibold text-ink sm:text-base">{{ $title }}</h1>

    <div class="ml-auto flex min-w-0 items-center gap-2">
+        <button type="button" @click="$dispatch('cmdk-open')"
+                class="hidden items-center gap-2 rounded-md border border-line bg-inset px-2.5 py-1.5 text-ink-3 transition-colors hover:border-line-strong hover:text-ink sm:flex"
+                aria-label="Befehle öffnen (Strg K)" title="Befehle (Strg K)">
+            <x-icon name="command" class="h-3.5 w-3.5" />
+            <span class="font-mono text-[10px] uppercase tracking-wider">Strg K</span>
+        </button>
        @php
            $fleetTotal = \App\Models\Server::count();
            $fleetOnline = \App\Models\Server::where('status', 'online')->count();
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@ -48,6 +48,9 @@
        </template>
    </div>

+    {{-- Command palette + keyboard shortcuts (persistent; one global keydown listener) --}}
+    <x-command-palette />
+
    <livewire:wire-elements-modal />
    @livewireScripts
 </body>
--- a/resources/views/livewire/audit/index.blade.php
+++ b/resources/views/livewire/audit/index.blade.php
@ -18,6 +18,7 @@
                </span>
                <input
                    type="search"
+                    data-page-search
                    wire:model.live.debounce.300ms="q"
                    placeholder="Akteur, Aktion, Ziel …"
                    class="min-h-11 w-44 rounded-md border border-line bg-inset py-1.5 pl-8 pr-3 font-mono text-xs text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none sm:w-64"
--- a/resources/views/livewire/modals/fail2ban-ban.blade.php
+++ b/resources/views/livewire/modals/fail2ban-ban.blade.php
@ -0,0 +1,51 @@
+@php
+    $label = 'mb-1 block font-mono text-[11px] uppercase tracking-wider text-ink-3';
+    $field = 'h-9 w-full rounded-md border border-line bg-inset px-3 font-mono text-sm text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none';
+    $select = 'h-9 w-full rounded-md border border-line bg-inset px-3 text-sm text-ink focus:border-accent/40 focus:outline-none';
+@endphp
+<div class="p-5 sm:p-6">
+    <div class="flex items-start gap-3.5">
+        <span class="grid h-10 w-10 shrink-0 place-items-center rounded-md border border-offline/30 bg-offline/10 text-offline">
+            <x-icon name="shield" class="h-5 w-5" />
+        </span>
+        <div class="min-w-0 flex-1">
+            <h2 class="font-display text-base font-semibold text-ink">IP manuell sperren</h2>
+            <p class="mt-1 text-sm leading-relaxed text-ink-2">
+                Sperrt eine IP-Adresse sofort im gewählten Jail. Loopback und der Clusev-Zugang
+                können nicht gesperrt werden.
+            </p>
+        </div>
+    </div>
+
+    @if ($error)
+        <div class="mt-4 flex items-center gap-2.5 rounded-md border border-offline/25 bg-offline/10 px-3.5 py-3">
+            <x-icon name="alert" class="h-4 w-4 shrink-0 text-offline" />
+            <p class="text-sm text-ink-2">{{ $error }}</p>
+        </div>
+    @endif
+
+    <div class="mt-4 grid grid-cols-1 gap-3 sm:grid-cols-2">
+        <div>
+            <label class="{{ $label }}">Jail</label>
+            <select wire:model="jail" class="{{ $select }}">
+                @forelse ($jails as $j)
+                    <option value="{{ $j }}">{{ $j }}</option>
+                @empty
+                    <option value="sshd">sshd</option>
+                @endforelse
+            </select>
+        </div>
+        <div>
+            <label class="{{ $label }}">IP-Adresse</label>
+            <input wire:model="ip" type="text" placeholder="z. B. 203.0.113.10" class="{{ $field }}" />
+        </div>
+    </div>
+
+    <div class="mt-6 flex items-center justify-end gap-2">
+        <x-btn variant="secondary" wire:click="$dispatch('closeModal')">Abbrechen</x-btn>
+        <x-btn variant="primary" wire:click="save" wire:target="save" wire:loading.attr="disabled">
+            <svg wire:loading wire:target="save" class="h-3.5 w-3.5 animate-spin" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M21 12a9 9 0 1 1-6.219-8.56" stroke-linecap="round" /></svg>
+            IP sperren
+        </x-btn>
+    </div>
+</div>
--- a/resources/views/livewire/modals/firewall-rule.blade.php
+++ b/resources/views/livewire/modals/firewall-rule.blade.php
@ -0,0 +1,76 @@
+@php
+    $label = 'mb-1 block font-mono text-[11px] uppercase tracking-wider text-ink-3';
+    $field = 'h-9 w-full rounded-md border border-line bg-inset px-3 font-mono text-sm text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none';
+    $select = 'h-9 w-full rounded-md border border-line bg-inset px-3 text-sm text-ink focus:border-accent/40 focus:outline-none';
+@endphp
+<div class="p-5 sm:p-6">
+    <div class="flex items-start gap-3.5">
+        <span class="grid h-10 w-10 shrink-0 place-items-center rounded-md border border-accent/30 bg-accent/10 text-accent-text">
+            <x-icon name="shield" class="h-5 w-5" />
+        </span>
+        <div class="min-w-0 flex-1">
+            <h2 class="font-display text-base font-semibold text-ink">Firewall-Regel hinzufügen</h2>
+            <p class="mt-1 text-sm leading-relaxed text-ink-2">
+                @if ($tool === 'firewalld')
+                    Öffnet einen Port in der Standard-Zone von firewalld.
+                @else
+                    Neue UFW-Regel. Quelle leer lassen = von überall.
+                @endif
+            </p>
+        </div>
+    </div>
+
+    @if ($error)
+        <div class="mt-4 flex items-center gap-2.5 rounded-md border border-offline/25 bg-offline/10 px-3.5 py-3">
+            <x-icon name="alert" class="h-4 w-4 shrink-0 text-offline" />
+            <p class="text-sm text-ink-2">{{ $error }}</p>
+        </div>
+    @endif
+
+    <div class="mt-4 space-y-3">
+        @if ($tool !== 'firewalld')
+            <div>
+                <label class="{{ $label }}">Aktion</label>
+                <select wire:model="action" class="{{ $select }}">
+                    <option value="allow">Erlauben (allow)</option>
+                    <option value="deny">Verwerfen (deny)</option>
+                    <option value="reject">Ablehnen (reject)</option>
+                    <option value="limit">Begrenzen (limit)</option>
+                </select>
+            </div>
+        @endif
+
+        <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <div>
+                <label class="{{ $label }}">Port {{ $tool === 'firewalld' ? '' : '(optional)' }}</label>
+                <input wire:model="port" type="number" min="1" max="65535" placeholder="z. B. 8080" class="{{ $field }}" />
+            </div>
+            <div>
+                <label class="{{ $label }}">Protokoll</label>
+                <select wire:model="proto" class="{{ $select }}">
+                    <option value="tcp">TCP</option>
+                    <option value="udp">UDP</option>
+                    @if ($tool !== 'firewalld')
+                        <option value="any">Beide</option>
+                    @endif
+                </select>
+            </div>
+        </div>
+
+        @if ($tool !== 'firewalld')
+            <div>
+                <label class="{{ $label }}">Quelle (optional)</label>
+                <input wire:model="from" type="text" placeholder="IP oder CIDR, z. B. 10.0.0.0/8" class="{{ $field }}" />
+            </div>
+        @endif
+    </div>
+
+    <div class="mt-6 flex items-center justify-end gap-2">
+        <x-btn variant="secondary" wire:click="$dispatch('closeModal')">Abbrechen</x-btn>
+        <x-btn variant="primary" wire:click="save" wire:target="save" wire:loading.attr="disabled">
+            <x-icon name="plus" class="h-3.5 w-3.5" wire:loading.remove wire:target="save" />
+            <svg wire:loading wire:target="save" class="h-3.5 w-3.5 animate-spin" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M21 12a9 9 0 1 1-6.219-8.56" stroke-linecap="round" /></svg>
+            Hinzufügen
+        </x-btn>
+    </div>
+</div>
--- a/resources/views/livewire/modals/system-update.blade.php
+++ b/resources/views/livewire/modals/system-update.blade.php
@ -17,10 +17,10 @@
            <x-icon name="alert" class="h-4 w-4 shrink-0 text-offline" />
            <p class="text-sm text-ink-2">{{ $error }}</p>
        </div>
-    @elseif (! $hasApt)
+    @elseif (! $supported)
        <div class="mt-4 flex items-center gap-2.5 rounded-md border border-warning/25 bg-warning/10 px-3.5 py-3">
            <x-icon name="alert" class="h-4 w-4 shrink-0 text-warning" />
-            <p class="text-sm text-ink-2">Nur für Debian/Ubuntu (apt) verfügbar.</p>
+            <p class="text-sm text-ink-2">{{ $unsupportedReason ?: 'Auf diesem System nicht verfügbar.' }}</p>
        </div>
    @else
        <div class="mt-4 flex items-center gap-3.5 rounded-md border border-line bg-inset px-3.5 py-3">
@ -78,7 +78,7 @@
            <x-btn variant="primary" wire:click="$dispatch('closeModal')">Schließen</x-btn>
        @else
            <x-btn variant="secondary" wire:click="$dispatch('closeModal')">Abbrechen</x-btn>
-            @if (! $error && $hasApt)
+            @if (! $error && $supported)
                <x-btn variant="accent" wire:click="upgrade" wire:target="upgrade" wire:loading.attr="disabled">
                    <x-icon name="rotate" class="h-3.5 w-3.5" wire:loading.remove wire:target="upgrade" />
                    <svg wire:loading wire:target="upgrade" class="h-3.5 w-3.5 animate-spin" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M21 12a9 9 0 1 1-6.219-8.56" stroke-linecap="round" /></svg>
--- a/resources/views/livewire/servers/index.blade.php
+++ b/resources/views/livewire/servers/index.blade.php
@ -34,6 +34,7 @@
                <x-icon name="search" class="pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-ink-4" />
                <input
                    type="search"
+                    data-page-search
                    wire:model.live.debounce.300ms="search"
                    placeholder="Name oder IP…"
                    class="min-h-11 w-full rounded-md border border-line bg-inset py-1.5 pl-8 pr-3 font-mono text-xs text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none sm:w-56"
--- a/resources/views/livewire/servers/show.blade.php
+++ b/resources/views/livewire/servers/show.blade.php
@ -20,6 +20,15 @@
        ['Disk',            $diskGb !== null ? $diskGb.' GB' : '—'],
    ];

+    // Detected OS tooling (populated once the live profile loads).
+    if (! empty($os)) {
+        $pm = ($os['packageManager'] ?? 'none') !== 'none' ? $os['packageManager'] : '—';
+        $fw = ($os['firewallTool'] ?? 'none') !== 'none' ? $os['firewallTool'] : '—';
+        $specRows[] = ['System',         $os['familyLabel'] ?? '—'];
+        $specRows[] = ['Paketverwaltung', $pm];
+        $specRows[] = ['Firewall',        $fw];
+    }
+
    $vitals = [
        ['label' => 'CPU',  'icon' => 'cpu',      'val' => (int) $server->cpu,  'sub' => ($loadAvg > 0 ? 'Last '.number_format($loadAvg, 2).' · ' : '').($cores ? $cores.' Kerne' : '—')],
        ['label' => 'RAM',  'icon' => 'activity', 'val' => (int) $server->mem,  'sub' => $ramUsed !== null ? $ramUsed.' / '.$ramGb.' GB' : '—'],
@ -99,7 +108,7 @@
                </span>
                <div class="min-w-0 flex-1">
                    <div class="flex flex-wrap items-center gap-2">
-                        <p class="truncate font-display text-sm font-semibold text-ink">{{ $cred->name ?: '—' }}</p>
+                        <p class="truncate font-display text-sm font-semibold text-ink">{{ $cred->name ?: $cred->username }}</p>
                        <x-status-pill :status="$credStatus" class="shrink-0">{{ $credStatusLabel }}</x-status-pill>
                        <x-badge tone="neutral" class="shrink-0">{{ $credAuthLabel }}</x-badge>
                    </div>
@ -169,43 +178,258 @@
            <x-panel title="Sicherheit" subtitle="Hardening-Checkliste" :padded="false">
                <div class="divide-y divide-line">
                    @foreach ($hardening as $check)
-                        {{-- One calm state signal: a lock glyph (geschlossen = sicher, offen = offen). --}}
+                        @php $supported = $check['supported'] ?? true; @endphp
+                        {{-- One calm state signal: a lock glyph (geschlossen = sicher, offen = offen);
+                             unsupported items render muted with a German reason and no toggle. --}}
                        <div class="flex items-center gap-3.5 px-4 py-3 transition-colors hover:bg-raised/40 sm:px-5">
                            <span @class([
                                'grid h-9 w-9 shrink-0 place-items-center rounded-md border',
-                                'border-online/25 bg-online/10 text-online' => $check['secure'],
-                                'border-warning/25 bg-warning/10 text-warning' => ! $check['secure'],
+                                'border-online/25 bg-online/10 text-online' => $supported && $check['secure'],
+                                'border-warning/25 bg-warning/10 text-warning' => $supported && ! $check['secure'],
+                                'border-line bg-raised text-ink-4' => ! $supported,
                            ])>
-                                <x-icon :name="$check['secure'] ? 'lock' : 'lock-open'" class="h-4 w-4" />
+                                <x-icon :name="$supported && ! $check['secure'] ? 'lock-open' : 'lock'" class="h-4 w-4" />
                            </span>
                            <div class="min-w-0 flex-1">
                                <p class="flex items-center gap-2 truncate text-sm text-ink">
                                    {{ $check['label'] }}
-                                    <span @class([
-                                        'shrink-0 font-mono text-[10px] uppercase tracking-wider',
-                                        'text-online' => $check['secure'],
-                                        'text-warning' => ! $check['secure'],
-                                    ])>{{ $check['secure'] ? 'sicher' : 'offen' }}</span>
+                                    @if ($supported)
+                                        <span @class([
+                                            'shrink-0 font-mono text-[10px] uppercase tracking-wider',
+                                            'text-online' => $check['secure'],
+                                            'text-warning' => ! $check['secure'],
+                                        ])>{{ $check['secure'] ? 'sicher' : 'offen' }}</span>
+                                    @else
+                                        <span class="shrink-0 font-mono text-[10px] uppercase tracking-wider text-ink-4">n. v.</span>
+                                    @endif
                                </p>
-                                <p class="truncate font-mono text-[11px] text-ink-3">{{ $check['detail'] }}</p>
+                                <p class="truncate font-mono text-[11px] text-ink-3">{{ $supported ? $check['detail'] : $check['reason'] }}</p>
                            </div>
-                            @if ($check['key'] === 'fail2ban')
-                                <x-btn variant="ghost" size="sm" icon class="shrink-0" title="fail2ban konfigurieren"
-                                       wire:click="$dispatch('openModal', { component: 'modals.fail2ban-config', arguments: { serverId: {{ $server->id }} } })">
-                                    <x-icon name="settings" class="h-3.5 w-3.5" />
+                            @if ($supported)
+                                @if ($check['key'] === 'fail2ban')
+                                    <x-btn variant="ghost" size="sm" icon class="shrink-0" title="fail2ban konfigurieren"
+                                           wire:click="$dispatch('openModal', { component: 'modals.fail2ban-config', arguments: { serverId: {{ $server->id }} } })">
+                                        <x-icon name="settings" class="h-3.5 w-3.5" />
+                                    </x-btn>
+                                @endif
+                                {{-- Toggle: secondary to make secure, quiet ghost to loosen. --}}
+                                <x-btn :variant="$check['secure'] ? 'ghost' : 'secondary'" size="sm" class="shrink-0"
+                                       wire:click="$dispatch('openModal', { component: 'modals.hardening-action', arguments: { serverId: {{ $server->id }}, action: '{{ $check['key'] }}', enable: {{ $check['featureOn'] ? 'false' : 'true' }} } })">
+                                    {{ $check['featureOn'] ? 'Deaktivieren' : 'Aktivieren' }}
                                </x-btn>
                            @endif
-                            {{-- Toggle: secondary to make secure, quiet ghost to loosen. --}}
-                            <x-btn :variant="$check['secure'] ? 'ghost' : 'secondary'" size="sm" class="shrink-0"
-                                   wire:click="$dispatch('openModal', { component: 'modals.hardening-action', arguments: { serverId: {{ $server->id }}, action: '{{ $check['key'] }}', enable: {{ $check['featureOn'] ? 'false' : 'true' }} } })">
-                                {{ $check['featureOn'] ? 'Deaktivieren' : 'Aktivieren' }}
-                            </x-btn>
                        </div>
                    @endforeach
                </div>
            </x-panel>
        </div>

+        {{-- Firewall-Regeln --}}
+        @php
+            $fw = $firewall ?? [];
+            $fwTool = $fw['tool'] ?? 'ufw';
+            $fwToolLabel = $fwTool === 'firewalld' ? 'firewalld' : 'UFW';
+            $fwSupported = $fw['supported'] ?? false;
+            $fwInstalled = $fw['installed'] ?? false;
+            $fwActive = $fw['active'] ?? false;
+            $fwManageable = $fw['manageable'] ?? false;
+            $fwReadOnly = $fw['readOnly'] ?? false;
+            $fwReadError = $fw['readError'] ?? false;
+            $fwRules = $fw['rules'] ?? [];
+            $fwDefaults = $fw['defaults'] ?? [];
+            $actTone = ['ALLOW' => 'online', 'LIMIT' => 'warning', 'DENY' => 'offline', 'REJECT' => 'offline'];
+        @endphp
+        <x-panel title="Firewall-Regeln"
+                 :subtitle="$fwSupported ? ($fwToolLabel . ($fwInstalled ? ($fwActive ? ' · aktiv' : ' · inaktiv') : ' · nicht installiert')) : 'Nicht verfügbar'"
+                 :padded="false">
+            @if ($fwSupported && $fwManageable)
+                <x-slot:actions>
+                    <x-btn variant="accent" size="sm"
+                           wire:click="$dispatch('openModal', { component: 'modals.firewall-rule', arguments: { serverId: {{ $server->id }}, tool: '{{ $fwTool }}' } })">
+                        <x-icon name="plus" class="h-3.5 w-3.5" /> Regel
+                    </x-btn>
+                </x-slot:actions>
+            @endif
+
+            @if (! $fwSupported)
+                <div class="px-4 py-4 sm:px-5">
+                    <p class="font-mono text-[11px] leading-relaxed text-ink-3">{{ $fw['reason'] ?? 'Firewall-Verwaltung ist auf diesem System nicht verfügbar.' }}</p>
+                </div>
+            @elseif ($fwReadError)
+                <div class="flex flex-wrap items-center gap-2.5 px-4 py-4 sm:px-5">
+                    <x-icon name="alert" class="h-4 w-4 shrink-0 text-warning" />
+                    <p class="font-mono text-[11px] text-ink-3">Firewall-Status konnte nicht gelesen werden (Verbindung/Rechte). Bitte später erneut laden.</p>
+                </div>
+            @elseif (! $fwInstalled)
+                <div class="flex flex-wrap items-center justify-between gap-3 px-4 py-4 sm:px-5">
+                    <p class="font-mono text-[11px] text-ink-3">{{ $fwToolLabel }} ist nicht installiert.</p>
+                    <x-btn variant="secondary" size="sm"
+                           wire:click="$dispatch('openModal', { component: 'modals.hardening-action', arguments: { serverId: {{ $server->id }}, action: 'firewall', enable: true } })">
+                        Aktivieren
+                    </x-btn>
+                </div>
+            @elseif ($fwTool === 'firewalld' && ! $fwActive)
+                <div class="flex flex-wrap items-center justify-between gap-3 px-4 py-4 sm:px-5">
+                    <p class="font-mono text-[11px] text-ink-3">firewalld ist installiert, aber inaktiv.</p>
+                    <x-btn variant="secondary" size="sm"
+                           wire:click="$dispatch('openModal', { component: 'modals.hardening-action', arguments: { serverId: {{ $server->id }}, action: 'firewall', enable: true } })">
+                        Aktivieren
+                    </x-btn>
+                </div>
+            @else
+                <div class="flex flex-wrap items-center gap-2 border-b border-line px-4 py-2.5 sm:px-5">
+                    @if ($fwTool === 'ufw')
+                        <span class="font-mono text-[10px] uppercase tracking-wider text-ink-4">Standard</span>
+                        <x-badge tone="neutral">eingehend: {{ $fwDefaults['incoming'] ?? '—' }}</x-badge>
+                        <x-badge tone="neutral">ausgehend: {{ $fwDefaults['outgoing'] ?? '—' }}</x-badge>
+                    @else
+                        <span class="font-mono text-[10px] uppercase tracking-wider text-ink-4">Zone</span>
+                        <x-badge tone="neutral">{{ $fwDefaults['zone'] ?? '—' }}</x-badge>
+                    @endif
+                </div>
+
+                @if ($fwReadOnly)
+                    <div class="flex items-start gap-2.5 border-b border-line bg-inset px-4 py-2.5 sm:px-5">
+                        <x-icon name="lock" class="mt-0.5 h-3.5 w-3.5 shrink-0 text-ink-4" />
+                        <p class="font-mono text-[11px] leading-relaxed text-ink-3">firewalld: nur Anzeige — Regeln bitte direkt am Server verwalten.</p>
+                    </div>
+                @endif
+
+                <div class="divide-y divide-line">
+                    @forelse ($fwRules as $rule)
+                        {{-- $ruleTone, NOT $tone: the page-level $tone is a closure used by the
+                             gauges/Volumes panel; reusing the name here would clobber it. --}}
+                        @php $ruleTone = $actTone[$rule['action'] ?? 'ALLOW'] ?? 'online'; @endphp
+                        <div class="flex items-center gap-3 px-4 py-2.5 sm:px-5">
+                            <span @class([
+                                'h-2 w-2 shrink-0 rounded-full',
+                                'bg-online' => $ruleTone === 'online',
+                                'bg-warning' => $ruleTone === 'warning',
+                                'bg-offline' => $ruleTone === 'offline',
+                            ])></span>
+                            <div class="min-w-0 flex-1">
+                                <p class="truncate font-mono text-sm text-ink">{{ $rule['label'] ?? ($rule['to'] ?? $rule['raw']) }}</p>
+                                @if ($fwTool === 'ufw' && ($rule['from'] ?? '') !== '' && ! \Illuminate\Support\Str::contains($rule['from'], 'Anywhere'))
+                                    <p class="truncate font-mono text-[11px] text-ink-3">von {{ $rule['from'] }}</p>
+                                @endif
+                            </div>
+                            <span @class([
+                                'shrink-0 font-mono text-[10px] uppercase tracking-wider',
+                                'text-online' => $ruleTone === 'online',
+                                'text-warning' => $ruleTone === 'warning',
+                                'text-offline' => $ruleTone === 'offline',
+                            ])>{{ strtolower($rule['action'] ?? 'allow') }}</span>
+                            @unless ($fwReadOnly)
+                                <x-btn variant="ghost-danger" size="sm" icon class="shrink-0" title="Regel entfernen"
+                                       wire:click="confirmDeleteRule({{ $loop->index }})">
+                                    <x-icon name="trash" class="h-3.5 w-3.5" />
+                                </x-btn>
+                            @endunless
+                        </div>
+                    @empty
+                        <div class="px-4 py-4 sm:px-5">
+                            <p class="font-mono text-[11px] text-ink-3">Keine Regeln definiert.</p>
+                        </div>
+                    @endforelse
+                </div>
+            @endif
+        </x-panel>
+
+        {{-- fail2ban-Status --}}
+        @php
+            $f2b = $fail2ban ?? [];
+            $f2bSupported = $f2b['supported'] ?? false;
+            $f2bReadError = $f2b['readError'] ?? false;
+            $f2bInstalled = $f2b['installed'] ?? false;
+            $f2bActive = $f2b['active'] ?? false;
+            $f2bJails = $f2b['jails'] ?? [];
+            $f2bIgnore = $f2b['ignoreip'] ?? [];
+            $f2bBanned = array_sum(array_map(fn ($j) => $j['currentlyBanned'] ?? 0, $f2bJails));
+        @endphp
+        <x-panel title="fail2ban-Status"
+                 :subtitle="$f2bSupported ? ($f2bInstalled ? ($f2bActive ? ('aktiv · ' . $f2bBanned . ' gesperrt') : 'installiert · inaktiv') : 'nicht installiert') : 'Nicht verfügbar'"
+                 :padded="false">
+            @if ($f2bSupported && $f2bInstalled && $f2bActive)
+                <x-slot:actions>
+                    <x-btn variant="ghost" size="sm" icon title="fail2ban konfigurieren"
+                           wire:click="$dispatch('openModal', { component: 'modals.fail2ban-config', arguments: { serverId: {{ $server->id }} } })">
+                        <x-icon name="settings" class="h-3.5 w-3.5" />
+                    </x-btn>
+                    <x-btn variant="accent" size="sm"
+                           wire:click="$dispatch('openModal', { component: 'modals.fail2ban-ban', arguments: { serverId: {{ $server->id }}, jails: {{ \Illuminate\Support\Js::from(array_map(fn ($j) => $j['name'], $f2bJails)) }} } })">
+                        <x-icon name="lock" class="h-3.5 w-3.5" /> IP sperren
+                    </x-btn>
+                </x-slot:actions>
+            @endif
+
+            @if (! $f2bSupported)
+                <div class="px-4 py-4 sm:px-5">
+                    <p class="font-mono text-[11px] leading-relaxed text-ink-3">{{ $f2b['reason'] ?? 'fail2ban ist auf diesem System nicht verfügbar.' }}</p>
+                </div>
+            @elseif ($f2bReadError)
+                <div class="flex flex-wrap items-center gap-2.5 px-4 py-4 sm:px-5">
+                    <x-icon name="alert" class="h-4 w-4 shrink-0 text-warning" />
+                    <p class="font-mono text-[11px] text-ink-3">fail2ban-Status konnte nicht gelesen werden. Bitte später erneut laden.</p>
+                </div>
+            @elseif (! $f2bInstalled || ! $f2bActive)
+                <div class="flex flex-wrap items-center justify-between gap-3 px-4 py-4 sm:px-5">
+                    <p class="font-mono text-[11px] text-ink-3">fail2ban ist {{ $f2bInstalled ? 'installiert, aber inaktiv' : 'nicht installiert' }}.</p>
+                    <x-btn variant="secondary" size="sm"
+                           wire:click="$dispatch('openModal', { component: 'modals.hardening-action', arguments: { serverId: {{ $server->id }}, action: 'fail2ban', enable: true } })">
+                        Aktivieren
+                    </x-btn>
+                </div>
+            @else
+                <div class="divide-y divide-line">
+                    @foreach ($f2bJails as $jail)
+                        <div class="px-4 py-3 sm:px-5">
+                            <div class="flex flex-wrap items-center justify-between gap-2">
+                                <p class="font-mono text-sm text-ink">{{ $jail['name'] }}</p>
+                                <p class="font-mono text-[11px] text-ink-3">
+                                    <span @class(['text-offline' => ($jail['currentlyBanned'] ?? 0) > 0])>gebannt: {{ $jail['currentlyBanned'] ?? 0 }}</span>
+                                    · Fehlversuche: {{ $jail['currentlyFailed'] ?? 0 }}
+                                </p>
+                            </div>
+                            @if (count($jail['bannedIps'] ?? []))
+                                <div class="mt-2 space-y-1">
+                                    @foreach ($jail['bannedIps'] as $ip)
+                                        <div class="flex items-center justify-between gap-2">
+                                            <span class="font-mono text-[11px] text-ink-2">{{ $ip }}</span>
+                                            <x-btn variant="ghost" size="sm" wire:click="unbanIp({{ \Illuminate\Support\Js::from($jail['name']) }}, {{ \Illuminate\Support\Js::from($ip) }})">Entsperren</x-btn>
+                                        </div>
+                                    @endforeach
+                                </div>
+                            @else
+                                <p class="mt-1 font-mono text-[11px] text-ink-4">Keine gebannten IPs.</p>
+                            @endif
+                        </div>
+                    @endforeach
+                </div>
+
+                {{-- Whitelist (ignoreip) --}}
+                <div class="border-t border-line px-4 py-3 sm:px-5">
+                    <p class="mb-2 font-mono text-[10px] uppercase tracking-wider text-ink-4">Whitelist (ignoreip)</p>
+                    <div class="flex flex-wrap gap-1.5">
+                        @foreach ($f2bIgnore as $ip)
+                            <span class="inline-flex items-center gap-1.5 rounded-sm border border-line bg-inset px-2 py-1 font-mono text-[11px] text-ink-2">
+                                {{ $ip }}
+                                @unless (in_array($ip, ['127.0.0.1/8', '::1'], true))
+                                    <button type="button" wire:click="removeIgnore({{ \Illuminate\Support\Js::from($ip) }})" class="text-ink-4 hover:text-offline" title="Entfernen">
+                                        <x-icon name="x" class="h-3 w-3" />
+                                    </button>
+                                @endunless
+                            </span>
+                        @endforeach
+                    </div>
+                    <div class="mt-2.5 flex items-center gap-2">
+                        <input wire:model="newIgnoreIp" wire:keydown.enter="addIgnore" type="text" placeholder="IP oder CIDR"
+                               class="h-8 w-full max-w-xs rounded-md border border-line bg-inset px-2.5 font-mono text-[11px] text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none" />
+                        <x-btn variant="secondary" size="sm" wire:click="addIgnore">Hinzufügen</x-btn>
+                    </div>
+                </div>
+            @endif
+        </x-panel>
+
        {{-- Volumes + Netzwerk-Interfaces --}}
        <div class="grid grid-cols-1 gap-3 lg:grid-cols-2">
            <x-panel title="Volumes" :subtitle="count($volumes) . ' Mountpoints'" :padded="false">
--- a/resources/views/livewire/services/index.blade.php
+++ b/resources/views/livewire/services/index.blade.php
@ -29,6 +29,7 @@
                <x-icon name="search" class="pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-ink-4" />
                <input
                    type="search"
+                    data-page-search
                    wire:model.live.debounce.250ms="search"
                    placeholder="Dienst suchen…"
                    class="h-9 w-40 rounded-md border border-line bg-inset pl-8 pr-3 font-mono text-xs text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none sm:w-56"
--- a/resources/views/livewire/system/index.blade.php
+++ b/resources/views/livewire/system/index.blade.php
@ -45,6 +45,20 @@
            </div>
        @endif

+        {{-- Architecture rationale: why TLS is terminated by Caddy (collapsible) --}}
+        <div class="mb-4 rounded-md border border-line bg-inset p-3" x-data="{ open: false }">
+            <button type="button" @click="open = ! open" class="flex w-full items-center gap-2 text-left">
+                <x-icon name="shield" class="h-3.5 w-3.5 shrink-0 text-ink-3" />
+                <span class="text-sm text-ink-2">Warum läuft TLS über Caddy?</span>
+                <span class="ml-auto shrink-0 font-mono text-[10px] uppercase tracking-wider text-ink-4" x-text="open ? 'schließen' : 'mehr'"></span>
+            </button>
+            <div x-show="open" x-cloak x-transition class="mt-2.5 space-y-1.5 font-mono text-[11px] leading-relaxed text-ink-3">
+                <p>Clusev nutzt <span class="text-ink-2">genau einen</span> nach außen offenen Dienst: Caddy. Es terminiert TLS, holt und erneuert das Let's-Encrypt-Zertifikat automatisch und leitet die Reverb-WebSockets (wss) über dieselbe Adresse — ohne Skript, Cronjob oder Reload-Hook.</p>
+                <p>App und Reverb bleiben intern erreichbar (kein offener Port nach außen). Caddy ist ein eigener Container mit eigener Version, daher kann ein App-Update die TLS-Terminierung nie unterbrechen.</p>
+                <p>Ein zusätzliches certbot + nginx wären <span class="text-ink-2">mehr</span> bewegliche Teile (eigene 443-Konfiguration, WebSocket-Upgrade, Renewal-Timer, Reload-Hook) — bei nur einer Domain kein Gewinn.</p>
+            </div>
+        </div>
+
        <form wire:submit="saveDomain" class="space-y-4">
            <div class="grid gap-4 sm:grid-cols-2">
                <div>
Author	SHA1	Message	Date
boban	4a4d107bfc	chore(release): v0.2.0 — System TLS rationale + version bump + CHANGELOG - System page: collapsible "Warum läuft TLS über Caddy?" explaining the single host-exposed TLS terminator (auto Let's Encrypt + auto-renew + wss for Reverb, decoupled from app updates) — answers the operator's question in the UI; Caddy stays. - Bump 0.1.1 -> 0.2.0 (cross-OS management, firewall + fail2ban control, command palette) + CHANGELOG entry. Pint clean; Codex review clean; R12 — all 9 routes HTTP 200, 0 console errors, TLS note renders. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 20:43:07 +02:00
boban	2c533bf821	feat(ux): command palette (Strg/⌘-K) + keyboard shortcuts A global command palette and keyboard shortcuts, mounted once in the persistent layout with a single global keydown listener. - Strg/⌘-K opens the palette: fuzzy-filter nav targets (German, from the sidebar) + "Server hinzufügen"; ↑/↓ to move, Enter to run, Esc to close. Navigation uses window.Livewire.navigate (SPA-fast). - Leader "g" + key: d=Dashboard, s=Server, i=Dienste, f=Dateien, l=Audit-Log, e=Einstellungen, y=System, v=Version. - "/" focuses the page search ([data-page-search] on services/servers/audit) — but only consumes the key when such a field exists, so the browser quick-find still works elsewhere. - "?" shows a shortcut-help overlay. - Typing guard: shortcuts never fire inside inputs/textarea/select/contentEditable. - Alpine destroy() removes the navigation listener (no leak across wire:navigate); topbar gains a "Strg K" trigger button. New icons: command, corner-down-left. R5/R3/R9 respected: the palette only navigates or opens the existing (R5) create-server modal — zero direct destructive actions; tokens-only styling, German, no emoji. Pint clean; Codex review clean (destroy cleanup + slash-passthrough hardened); R12 — verified in-browser: Ctrl-K opens, filter works, Esc closes, g+f navigates, ? help, HTTP 200, 0 console errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 20:38:22 +02:00
boban	e792e9a3af	feat(fail2ban): jail status, banned-IP list + unban, manual ban, whitelist Addresses "ich sehe nicht welche IPs gebannt sind / entsperren / whitelist". The server-detail page gains a "fail2ban-Status" panel. New Fail2banService (owns all fail2ban I/O): - status(): jails with currently/total failed+banned + the banned IP list, plus the whitelist; sentinel-guarded, and a CLIENT_OK marker so an active service whose fail2ban-client query fails is reported as a read error, not "0 jails". - unban() (idempotent: "not banned" = success), manual ban() GUARDED against loopback (whole 127.0.0.0/8 + ::1) and Clusev's own SSH source (canonical inet_pton compare). - readConfig()/writeTuning()/writeIgnoreip(): tuning and whitelist live in SEPARATE zz- drop-ins and each writes only its own keys, so a whitelist change can never rewrite the ban policy (and vice-versa). The legacy single-file zz-clusev.local is removed on tuning save (migration). ignoreip is preserved VERBATIM (hostnames/CIDRs, continuation lines) — loopback always re-seeded; add/remove report no-ops so the audit only records real changes. UI: jails + banned IPs each with "Entsperren" (direct, audited), whitelist editor (add/remove, audited), "IP sperren" via an R5 modal (modals.fail2ban-ban). Jail/IP args are Js::from()-encoded (remote-sourced, injection-safe). Direct handlers catch SSH failures. Tuning modal migrated to Fail2banService.writeTuning. MaintenanceService slimmed to package updates only (fail2ban moved out). Pint clean; Codex review clean (IPv6 guard, verbatim ignoreip, decoupled drop-ins, legacy migration, read-error detection all hardened); R12 — server-detail HTTP 200, 0 console errors, fail2ban panel + jail + whitelist render. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 20:27:55 +02:00
boban	efecd26e31	feat(firewall): full UFW rule management + read-only firewalld view The server-detail page gains a "Firewall-Regeln" panel — addressing "ich kann nur aktivieren, sonst nichts": list rules, add, and delete, with hard SSH-lockout guards. FirewallService: - status(): one privileged read — installed/active, default policies, and the rule list. ufw rules come from `ufw show added` (add-syntax, works active OR inactive), defaults from /etc/default/ufw; a CLUSEV_FWREAD_OK sentinel + a "Status:" check distinguish a real read from a failed/empty one. - addRule(): validated action/proto/port/from (proto before `from`, ufw grammar); refuses deny/reject on the SSH port or portless (would block all inbound). - deleteRule(): whitelists the spec against rules ufw actually reported (injection- proof — a forged spec can't match), deletes by spec (race-free, no rule number), guards SSH-port allow rules incl. ranges and trailing comments, distinguishes not_found from a real deletion so the audit only records true deletions. firewalld is READ-ONLY this release: status() reads the runtime state of every active zone (ports/services/rich rules, zone-attributed), rule mutation is refused with a German note. on/off + hardening (Phase A) still work. UI: x-panel with default-policy badges, "+ Regel" (modal modals.firewall-rule), per- rule delete via R5 ConfirmAction (audit deferred to the real outcome), graceful read-error / not-installed / inactive / firewalld-read-only states. Fix: the firewall row's tone variable was renamed $tone -> $ruleTone — the page-level $tone is a closure used by the gauges/Volumes panel; reusing the name clobbered it and 500'd the page below the firewall block. R12 now confirms the full loaded page. Default-policy EDITING was intentionally not exposed (highest lockout risk). Pint clean; Codex review clean; R12 — server-detail HTTP 200, 0 console errors, firewall panel + rules + volumes all render. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 19:53:52 +02:00
boban	4bfa367ccf	feat(os): OS abstraction — manage updates/hardening/firewall across apt, dnf & zypper Foundation so Clusev no longer assumes Debian/apt/ufw/systemd. A host's OS is resolved once (cached) and every package/firewall/service decision asks it. New app/Support/Os/: - OsProfile — family + package manager + firewall tool + service manager, plus supports(feature) returning NULL or a German reason (graceful degradation). - OsDetector — one unprivileged probe (/etc/os-release + `command -v` with sbin on PATH + which firewall is RUNNING); family from ID/ID_LIKE cross-checked against installed binaries; cached 1h (60s when nothing detected). Readability-guards the `.` source so a host without /etc/os-release still falls back by package manager. - PackageManager — apt/dnf/zypper command strings (pending count, apply, install, is-installed); zypper exit 102/103 normalized to success. - FirewallTool — ufw + firewalld enable/disable. firewalld opens ssh/80/443 in the PERMANENT config BEFORE the daemon starts filtering (handles running + stopped), preserving the no-lockout guard for custom SSH ports. Integration: - FirewallService enable/disable now OS-aware (ufw or firewalld) with a support gate. - MaintenanceService: hasApt -> updateSupport(); pendingUpdates() + applyUpgrades() across managers (dnf check-update exit 100 handled). - HardeningService: state()/commandFor() per-OS (dpkg vs rpm, ufw vs firewalld, apt periodic vs dnf-automatic; yum-only hosts gate auto-updates). Each row carries supported/reason; unsupported features render muted with a German note instead of a toggle. apply() refuses unsupported features gracefully. - Server-Details surfaces the detected System / package manager / firewall. - SystemUpdate modal + view: OS-neutral copy; audit action system.package_upgrade. Arch (pacman) & Alpine (apk/OpenRC) are detected and gracefully disabled where unsupported. Debian/ufw/systemd path verified behaviourally identical on the live fleet. Pint clean; Codex review clean (fixed firewalld lockout + os-release guard + yum/dual-firewall/zypper edge cases); R12 — 9 routes 200, 0 console errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-13 18:30:25 +02:00