chore: updates in UI due to migration to OAS3.1

Signed-off-by: allanice001 <allanice001@gmail.com>

.github/workflows/docker-publish.yml

@@ -33,13 +33,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         with:
           cosign-release: 'v2.2.4'
 

.gitignore

@@ -137,4 +137,6 @@ notes.txt
 
 .terraform
 .terraform.lock*
-terraform.tfstate*
+terraform.tfstate*
+
+ui/src/sdk

.semgrep.yml

@@ -0,0 +1,100 @@
+# AutoGlue Semgrep configuration
+# Use with: opengrep scan --config .semgrep.yml .
+
+rules:
+
+  #
+  # 1. Suppress known benign “direct write to ResponseWriter” warnings
+  #
+  - id: autoglue.ignore.direct-write-static
+    message: Ignore direct writes for static or binary responses
+    languages: [go]
+    severity: INFO
+    metadata:
+      category: suppression
+      project: autoglue
+    patterns:
+      - pattern: |
+          _, _ = $W.Write($DATA)
+    pattern-inside: |
+      func $F($X...) {
+        ...
+      }
+    paths:
+      include:
+        - internal/api/utils.go
+        - internal/handlers/ssh_keys.go
+
+
+  #
+  # 2. Enforce Allowed Origins checking in writePostMessageHTML
+  #
+  - id: autoglue.auth.require-origin-validation
+    message: >
+      writePostMessageHTML must validate `origin` against known allowed origins
+      to prevent token exfiltration via crafted state/redirect parameters.
+    languages: [go]
+    severity: ERROR
+    metadata:
+      category: security
+      project: autoglue
+
+    # Look for the JS snippet inside the Go string literal using a regex.
+    # This is NOT Go code, so we must use pattern-regex, not pattern.
+    pattern-regex: |
+      window\.opener\.postMessage\(\{ type: 'autoglue:auth', payload: data \}, .*?\);
+
+    paths:
+      include:
+        - internal/handlers/auth.go
+
+
+  #
+  # 3. Require httpOnly+Secure cookies for JWT cookies
+  #
+  - id: autoglue.cookies.ensure-secure-jwt
+    message: >
+      JWT cookies must always have a Secure field (true in prod, false only for localhost dev).
+    languages: [go]
+    severity: WARNING
+    metadata:
+      category: security
+      project: autoglue
+
+    patterns:
+      # 1) Find any SetCookie for ag_jwt
+      - pattern: |
+          http.SetCookie($W, &http.Cookie{
+            Name: "ag_jwt",
+            ...
+          })
+      # 2) BUT ignore cases where the Secure field is present
+      - pattern-not: |
+          http.SetCookie($W, &http.Cookie{
+            Name: "ag_jwt",
+            Secure: $SECURE,
+            ...
+          })
+
+    paths:
+      include:
+        - internal/handlers/auth.go
+
+
+  #
+  # 4. Ban path.Clean for user-controlled paths
+  #
+  - id: autoglue.filesystem.no-path-clean
+    message: Use securejoin instead of path.Clean() for file paths.
+    languages: [go]
+    severity: WARNING
+    metadata:
+      category: security
+      project: autoglue
+
+    pattern: |
+      path.Clean($X)
+
+    paths:
+      include:
+        - internal/web/static.go

Makefile

@@ -30,6 +30,7 @@ UI_SSG_ROUTES ?= /,/login,/docs,/pricing
 
 # Go versioning (go.mod uses major.minor; you’re on 1.25.4)
 GO_VERSION   ?= 1.25.4
+SWAG_FLAGS   ?= --v3.1 --outputTypes json,yaml,go
 
 # SDK / package settings (TypeScript)
 SDK_TS_OUTDIR     ?= sdk/ts
@@ -70,7 +71,7 @@ export GO_POST_PROCESS_FILE := gofmt -w
 .DEFAULT_GOAL := help
 
 # --- version metadata (ldflags) ---
-VERSION  := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
+VERSION  := $(shell git describe --tags --always 2>/dev/null || echo "dev")
 COMMIT   := $(shell git rev-parse HEAD 2>/dev/null || echo "none")
 DATE     := $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
 BUILT_BY := $(shell whoami)
@@ -98,8 +99,8 @@ SDK_PKG_CLEAN       := $(call trim,$(SDK_PKG))
         validate-spec check-tags doctor diff-swagger
 
 # --- inputs/outputs for swagger (incremental) ---
-DOCS_JSON := docs/swagger.json
-DOCS_YAML := docs/swagger.yaml
+DOCS_JSON := docs/openapi.json
+DOCS_YAML := docs/openapi.yaml
 # Prefer git for speed; fall back to find. Exclude UI dir.
 #GO_SRCS := $(shell (git ls-files '*.go' ':!$(UI_DIR)/**' 2>/dev/null || find . -name '*.go' -not -path './$(UI_DIR)/*' -type f))
 GO_SRCS := $(shell ( \
@@ -111,11 +112,14 @@ GO_SRCS := $(shell ( \
 $(DOCS_JSON) $(DOCS_YAML): $(GO_SRCS)
 	@echo ">> Generating Swagger docs..."
 	@if ! command -v swag >/dev/null 2>&1; then \
-		echo "Installing swag/v2 CLI @v2.0.0-rc4..."; \
-		$(GOINSTALL) github.com/swaggo/swag/v2/cmd/swag@v2.0.0-rc4; \
+		echo "Installing swag/v2 CLI @latest..."; \
+		$(GOINSTALL) github.com/swaggo/swag/v2/cmd/swag@latest; \
 	fi
-	@rm -rf docs/swagger.* docs/docs.go
-	@swag init -g $(MAIN) -o docs
+	@rm -rf docs/openapi.* docs/docs.go
+	@swag fmt --exclude main.go -d .
+	@swag init $(SWAG_FLAGS) -g $(MAIN) -o docs
+	@mv docs/swagger.json $(DOCS_JSON)
+	@mv docs/swagger.yaml $(DOCS_YAML)
 
 # --- spec validation + tag guard ---
 validate-spec: $(DOCS_JSON) ## Validate docs/swagger.json and pin the core OpenAPI Generator version
@@ -310,6 +314,9 @@ doctor: ## Print environment diagnostics (shell, versions, generator availabilit
 		$(OGC_BIN) version || true; \
 	}
 
+fetch-pgweb: ## Fetch PGWeb Binaries for embedding
+	go run ./tools/pgweb_fetch.go
+
 help: ## Show this help
 	@grep -hE '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | \
 	awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'

README.md

@@ -60,6 +60,7 @@ Create your org (http://localhost:8080/me) - you should be redirected here after
 
 Once you have an org - create a set of api keys for your org:
 They will be in the format of:
+Example values only; these are not real secrets.
 ```text
 Org Key: org_lnJwmyyWH7JC-JgZo5v3Kw
 Org Secret: fqd9yebGMfK6h5HSgWn4sXrwr9xlFbvbIYtNylRElMQ

atlas.hcl

@@ -0,0 +1,20 @@
+data "external_schema" "gorm" {
+  program = [
+    "go",
+    "run",
+    "-mod=mod",
+    "ariga.io/atlas-provider-gorm",
+    "load",
+    "--path", "./internal/models",
+    "--dialect", "postgres",
+  ]
+}
+
+env "gorm" {
+  src = data.external_schema.gorm.url
+  dev = "postgres://autoglue:autoglue@localhost:5432/autoglue_dev"
+}
+
+env "gorm-src" {
+  src = data.external_schema.gorm.url
+}

cmd/db.go

@@ -0,0 +1,51 @@
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"time"
+
+	"github.com/glueops/autoglue/internal/config"
+	"github.com/spf13/cobra"
+)
+
+var dbCmd = &cobra.Command{
+	Use:   "db",
+	Short: "Database utilities",
+}
+
+var dbPsqlCmd = &cobra.Command{
+	Use:   "psql",
+	Short: "Open a psql session to the app database",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		cfg, err := config.Load()
+		if err != nil {
+			return err
+		}
+		if cfg.DbURL == "" {
+			return errors.New("database.url is empty")
+		}
+		psql := "psql"
+		if runtime.GOOS == "windows" {
+			psql = "psql.exe"
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), 72*time.Hour)
+		defer cancel()
+
+		psqlCmd := exec.CommandContext(ctx, psql, cfg.DbURL)
+		psqlCmd.Stdin, psqlCmd.Stdout, psqlCmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+		fmt.Println("Launching psql…")
+		return psqlCmd.Run()
+	},
+}
+
+func init() {
+	dbCmd.AddCommand(dbPsqlCmd)
+
+	rootCmd.AddCommand(dbCmd)
+}

cmd/serve.go

@@ -18,6 +18,7 @@ import (
 	"github.com/glueops/autoglue/internal/auth"
 	"github.com/glueops/autoglue/internal/bg"
 	"github.com/glueops/autoglue/internal/config"
+	"github.com/glueops/autoglue/internal/models"
 	"github.com/google/uuid"
 	"github.com/spf13/cobra"
 )
@@ -38,6 +39,8 @@ var serveCmd = &cobra.Command{
 			log.Fatalf("failed to init background jobs: %v", err)
 		}
 
+		rt.DB.Where("status IN ?", []string{"scheduled", "queued", "pending"}).Delete(&models.Job{})
+
 		// Start workers in background ONCE
 		go func() {
 			if err := jobs.Start(); err != nil {
@@ -50,7 +53,7 @@ var serveCmd = &cobra.Command{
 		{
 			// schedule next 03:30 local time
 			next := time.Now().Truncate(24 * time.Hour).Add(24 * time.Hour).Add(3*time.Hour + 30*time.Minute)
-			_, _ = jobs.Enqueue(
+			_, err = jobs.Enqueue(
 				context.Background(),
 				uuid.NewString(),
 				"archer_cleanup",
@@ -58,10 +61,13 @@ var serveCmd = &cobra.Command{
 				archer.WithScheduleTime(next),
 				archer.WithMaxRetries(1),
 			)
+			if err != nil {
+				log.Fatalf("failed to enqueue archer cleanup job: %v", err)
+			}
 
 			// schedule next 03:45 local time
 			next2 := time.Now().Truncate(24 * time.Hour).Add(24 * time.Hour).Add(3*time.Hour + 45*time.Minute)
-			_, _ = jobs.Enqueue(
+			_, err = jobs.Enqueue(
 				context.Background(),
 				uuid.NewString(),
 				"tokens_cleanup",
@@ -69,46 +75,47 @@ var serveCmd = &cobra.Command{
 				archer.WithScheduleTime(next2),
 				archer.WithMaxRetries(1),
 			)
-		}
-
-		// Periodic scheduler
-		schedCtx, schedCancel := context.WithCancel(context.Background())
-		defer schedCancel()
-
-		ticker := time.NewTicker(10 * time.Second)
-		defer ticker.Stop()
-
-		go func() {
-			for {
-				select {
-				case <-ticker.C:
-					_, err := jobs.Enqueue(
-						context.Background(),
-						uuid.NewString(),
-						"bootstrap_bastion",
-						bg.BastionBootstrapArgs{},
-						archer.WithMaxRetries(3),
-						// while debugging, avoid extra schedule delay:
-						archer.WithScheduleTime(time.Now().Add(60*time.Second)),
-					)
-					if err != nil {
-						log.Printf("failed to enqueue bootstrap_bastion: %v", err)
-					}
-					/*
-						_, _ = jobs.Enqueue(
-							context.Background(),
-							uuid.NewString(),
-							"tokens_cleanup",
-							bg.TokensCleanupArgs{},
-							archer.WithMaxRetries(3),
-							archer.WithScheduleTime(time.Now().Add(10*time.Second)),
-						)
-					*/
-				case <-schedCtx.Done():
-					return
-				}
+			if err != nil {
+				log.Fatalf("failed to enqueue token cleanup job: %v", err)
 			}
-		}()
+
+			_, err = jobs.Enqueue(
+				context.Background(),
+				uuid.NewString(),
+				"db_backup_s3",
+				bg.DbBackupArgs{IntervalS: 3600},
+				archer.WithMaxRetries(1),
+				archer.WithScheduleTime(time.Now().Add(1*time.Hour)),
+			)
+			if err != nil {
+				log.Fatalf("failed to enqueue backup jobs: %v", err)
+			}
+
+			_, err = jobs.Enqueue(
+				context.Background(),
+				uuid.NewString(),
+				"dns_reconcile",
+				bg.DNSReconcileArgs{MaxDomains: 25, MaxRecords: 100, IntervalS: 10},
+				archer.WithScheduleTime(time.Now().Add(5*time.Second)),
+				archer.WithMaxRetries(1),
+			)
+			if err != nil {
+				log.Fatalf("failed to enqueue dns reconcile: %v", err)
+			}
+
+			_, err := jobs.Enqueue(
+				context.Background(),
+				uuid.NewString(),
+				"bootstrap_bastion",
+				bg.BastionBootstrapArgs{IntervalS: 10},
+				archer.WithMaxRetries(3),
+				// while debugging, avoid extra schedule delay:
+				archer.WithScheduleTime(time.Now().Add(60*time.Second)),
+			)
+			if err != nil {
+				log.Printf("failed to enqueue bootstrap_bastion: %v", err)
+			}
+		}
 
 		_ = auth.Refresh(rt.DB, rt.Cfg.JWTPrivateEncKey)
 		go func() {
@@ -119,7 +126,26 @@ var serveCmd = &cobra.Command{
 			}
 		}()
 
-		r := api.NewRouter(rt.DB, jobs)
+		r := api.NewRouter(rt.DB, jobs, nil)
+
+		if cfg.DBStudioEnabled {
+			dbURL := cfg.DbURLRO
+			if dbURL == "" {
+				dbURL = cfg.DbURL
+			}
+
+			studio, err := api.MountDbStudio(
+				dbURL,
+				"db-studio",
+				false,
+			)
+			if err != nil {
+				log.Fatalf("failed to init db studio: %v", err)
+			} else {
+				r = api.NewRouter(rt.DB, jobs, studio)
+				log.Printf("pgweb mounted at /db-studio/")
+			}
+		}
 
 		addr := fmt.Sprintf("%s:%s", cfg.Host, cfg.Port)
 

docker-compose.yml

@@ -42,7 +42,7 @@ services:
       - postgres
 
   mailpit:
-    image: axllent/mailpit@sha256:6abc8e633df15eaf785cfcf38bae48e66f64beecdc03121e249d0f9ec15f0707
+    image: axllent/mailpit@sha256:e22dce5b36f93c77082e204a3942fb6b283b7896e057458400a4c88344c3df68
     restart: always
     ports:
       - "1025:1025"

docs/efs.go

@@ -2,8 +2,8 @@ package docs
 
 import _ "embed"
 
-//go:embed swagger.json
+//go:embed openapi.json
 var SwaggerJSON []byte
 
-//go:embed swagger.yaml
+//go:embed openapi.yaml
 var SwaggerYAML []byte

go.mod

@@ -3,22 +3,31 @@ module github.com/glueops/autoglue
 go 1.25.4
 
 require (
+	ariga.io/atlas-provider-gorm v0.6.0
 	github.com/alexedwards/argon2id v1.0.0
+	github.com/aws/aws-sdk-go-v2 v1.39.6
+	github.com/aws/aws-sdk-go-v2/config v1.31.20
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.24
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.59.5
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.90.2
 	github.com/coreos/go-oidc/v3 v3.16.0
-	github.com/dyaksa/archer v1.1.3
+	github.com/dyaksa/archer v1.1.5
+	github.com/fergusstrange/embedded-postgres v1.33.0
+	github.com/gin-gonic/gin v1.11.0
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/cors v1.2.2
 	github.com/go-chi/httprate v0.15.0
+	github.com/go-playground/validator/v10 v10.28.0
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1
 	github.com/rs/zerolog v1.34.0
+	github.com/sosedoff/pgweb v0.16.2
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/viper v1.21.0
-	github.com/swaggo/http-swagger/v2 v2.0.2
 	github.com/swaggo/swag/v2 v2.0.0-rc4
-	golang.org/x/crypto v0.43.0
-	golang.org/x/oauth2 v0.32.0
+	golang.org/x/crypto v0.44.0
+	golang.org/x/oauth2 v0.33.0
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/datatypes v1.2.7
 	gorm.io/driver/postgres v1.6.0
@@ -26,47 +35,146 @@ require (
 )
 
 require (
+	ariga.io/atlas v0.36.2-0.20250806044935-5bb51a0a956e // indirect
+	cel.dev/expr v0.24.0 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/auth v0.16.4 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
+	cloud.google.com/go/iam v1.5.2 // indirect
+	cloud.google.com/go/longrunning v0.6.7 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
+	cloud.google.com/go/spanner v1.84.1 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/BurntSushi/toml v1.1.0 // indirect
+	github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
+	github.com/ScaleFT/sshkeys v0.0.0-20200327173127-6142f742bca5 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.40.2 // indirect
+	github.com/aws/smithy-go v1.23.2 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bytedance/sonic v1.14.0 // indirect
+	github.com/bytedance/sonic/loader v0.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.10 // indirect
+	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/spec v0.20.9 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
+	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
+	github.com/golang-sql/sqlexp v0.1.0 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/googleapis/go-gorm-spanner v1.8.6 // indirect
+	github.com/googleapis/go-sql-spanner v1.17.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/pgx/v5 v5.6.0 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jessevdk/go-flags v1.5.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/jmoiron/sqlx v1.3.5 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-sqlite3 v1.14.28 // indirect
+	github.com/microsoft/go-mssqldb v1.7.2 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/prometheus/client_golang v1.19.1 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.48.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/quic-go/qpack v0.5.1 // indirect
+	github.com/quic-go/quic-go v0.54.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/sirupsen/logrus v1.9.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/sv-tools/openapi v0.2.1 // indirect
-	github.com/swaggo/files/v2 v2.0.0 // indirect
-	github.com/swaggo/swag v1.8.1 // indirect
+	github.com/tuvistavie/securerandom v0.0.0-20140719024926-15512123a948 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.3.0 // indirect
+	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
+	github.com/zeebo/errs v1.4.0 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.37.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.uber.org/mock v0.5.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.37.0 // indirect
-	golang.org/x/text v0.30.0 // indirect
-	golang.org/x/tools v0.37.0 // indirect
+	golang.org/x/arch v0.20.0 // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/net v0.46.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	google.golang.org/api v0.247.0 // indirect
+	google.golang.org/genproto v0.0.0-20250804133106-a7a43d27e69b // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/grpc v1.74.2 // indirect
+	google.golang.org/protobuf v1.36.9 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gorm.io/driver/mysql v1.5.6 // indirect
+	gorm.io/driver/mysql v1.5.7 // indirect
+	gorm.io/driver/sqlite v1.6.0 // indirect
+	gorm.io/driver/sqlserver v1.6.0 // indirect
 )

internal/api/httpmiddleware/auth.go

@@ -49,6 +49,14 @@ func AuthMiddleware(db *gorm.DB, requireOrg bool) func(http.Handler) http.Handle
 				} else if appKey := r.Header.Get("X-APP-KEY"); appKey != "" {
 					secret := r.Header.Get("X-APP-SECRET")
 					user = auth.ValidateAppKeyPair(appKey, secret, db)
+				} else if c, err := r.Cookie("ag_jwt"); err == nil {
+					tok := strings.TrimSpace(c.Value)
+					if strings.HasPrefix(strings.ToLower(tok), "bearer ") {
+						tok = tok[7:]
+					}
+					if tok != "" {
+						user = auth.ValidateJWT(tok, db)
+					}
 				}
 
 				if user == nil {

internal/api/mount_admin_routes.go

@@ -0,0 +1,26 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/api/httpmiddleware"
+	"github.com/glueops/autoglue/internal/bg"
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountAdminRoutes(r chi.Router, db *gorm.DB, jobs *bg.Jobs, authUser func(http.Handler) http.Handler) {
+	r.Route("/admin", func(admin chi.Router) {
+		admin.Route("/archer", func(archer chi.Router) {
+			archer.Use(authUser)
+			archer.Use(httpmiddleware.RequirePlatformAdmin())
+
+			archer.Get("/jobs", handlers.AdminListArcherJobs(db))
+			archer.Post("/jobs", handlers.AdminEnqueueArcherJob(db, jobs))
+			archer.Post("/jobs/{id}/retry", handlers.AdminRetryArcherJob(db))
+			archer.Post("/jobs/{id}/cancel", handlers.AdminCancelArcherJob(db))
+			archer.Get("/queues", handlers.AdminListArcherQueues(db))
+		})
+	})
+}

internal/api/mount_annotation_routes.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountAnnotationRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/annotations", func(a chi.Router) {
+		a.Use(authOrg)
+		a.Get("/", handlers.ListAnnotations(db))
+		a.Post("/", handlers.CreateAnnotation(db))
+		a.Get("/{id}", handlers.GetAnnotation(db))
+		a.Patch("/{id}", handlers.UpdateAnnotation(db))
+		a.Delete("/{id}", handlers.DeleteAnnotation(db))
+	})
+}

internal/api/mount_api_routes.go

@@ -0,0 +1,39 @@
+package api
+
+import (
+	"github.com/glueops/autoglue/internal/api/httpmiddleware"
+	"github.com/glueops/autoglue/internal/bg"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountAPIRoutes(r chi.Router, db *gorm.DB, jobs *bg.Jobs) {
+	r.Route("/api", func(api chi.Router) {
+		api.Route("/v1", func(v1 chi.Router) {
+			authUser := httpmiddleware.AuthMiddleware(db, false)
+			authOrg := httpmiddleware.AuthMiddleware(db, true)
+
+			// shared basics
+			mountMetaRoutes(v1)
+			mountAuthRoutes(v1, db)
+
+			// admin
+			mountAdminRoutes(v1, db, jobs, authUser)
+
+			// user/org scoped
+			mountMeRoutes(v1, db, authUser)
+			mountOrgRoutes(v1, db, authUser, authOrg)
+
+			mountCredentialRoutes(v1, db, authOrg)
+			mountSSHRoutes(v1, db, authOrg)
+			mountServerRoutes(v1, db, authOrg)
+			mountTaintRoutes(v1, db, authOrg)
+			mountLabelRoutes(v1, db, authOrg)
+			mountAnnotationRoutes(v1, db, authOrg)
+			mountNodePoolRoutes(v1, db, authOrg)
+			mountDNSRoutes(v1, db, authOrg)
+			mountLoadBalancerRoutes(v1, db, authOrg)
+			mountClusterRoutes(v1, db, authOrg)
+		})
+	})
+}

internal/api/mount_auth_routes.go

@@ -0,0 +1,16 @@
+package api
+
+import (
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountAuthRoutes(r chi.Router, db *gorm.DB) {
+	r.Route("/auth", func(a chi.Router) {
+		a.Post("/{provider}/start", handlers.AuthStart(db))
+		a.Get("/{provider}/callback", handlers.AuthCallback(db))
+		a.Post("/refresh", handlers.Refresh(db))
+		a.Post("/logout", handlers.Logout(db))
+	})
+}

internal/api/mount_cluster_routes.go

@@ -0,0 +1,41 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountClusterRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/clusters", func(c chi.Router) {
+		c.Use(authOrg)
+		c.Get("/", handlers.ListClusters(db))
+		c.Post("/", handlers.CreateCluster(db))
+
+		c.Get("/{clusterID}", handlers.GetCluster(db))
+		c.Patch("/{clusterID}", handlers.UpdateCluster(db))
+		c.Delete("/{clusterID}", handlers.DeleteCluster(db))
+
+		c.Post("/{clusterID}/captain-domain", handlers.AttachCaptainDomain(db))
+		c.Delete("/{clusterID}/captain-domain", handlers.DetachCaptainDomain(db))
+
+		c.Post("/{clusterID}/control-plane-record-set", handlers.AttachControlPlaneRecordSet(db))
+		c.Delete("/{clusterID}/control-plane-record-set", handlers.DetachControlPlaneRecordSet(db))
+
+		c.Post("/{clusterID}/apps-load-balancer", handlers.AttachAppsLoadBalancer(db))
+		c.Delete("/{clusterID}/apps-load-balancer", handlers.DetachAppsLoadBalancer(db))
+		c.Post("/{clusterID}/glueops-load-balancer", handlers.AttachGlueOpsLoadBalancer(db))
+		c.Delete("/{clusterID}/glueops-load-balancer", handlers.DetachGlueOpsLoadBalancer(db))
+
+		c.Post("/{clusterID}/bastion", handlers.AttachBastionServer(db))
+		c.Delete("/{clusterID}/bastion", handlers.DetachBastionServer(db))
+
+		c.Post("/{clusterID}/kubeconfig", handlers.SetClusterKubeconfig(db))
+		c.Delete("/{clusterID}/kubeconfig", handlers.ClearClusterKubeconfig(db))
+
+		c.Post("/{clusterID}/node-pools", handlers.AttachNodePool(db))
+		c.Delete("/{clusterID}/node-pools/{nodePoolID}", handlers.DeleteNodePool(db))
+	})
+}

internal/api/mount_credential_routes.go

@@ -0,0 +1,21 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountCredentialRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/credentials", func(c chi.Router) {
+		c.Use(authOrg)
+		c.Get("/", handlers.ListCredentials(db))
+		c.Post("/", handlers.CreateCredential(db))
+		c.Get("/{id}", handlers.GetCredential(db))
+		c.Patch("/{id}", handlers.UpdateCredential(db))
+		c.Delete("/{id}", handlers.DeleteCredential(db))
+		c.Post("/{id}/reveal", handlers.RevealCredential(db))
+	})
+}

internal/api/mount_db_studio.go

@@ -0,0 +1,53 @@
+package api
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	pgapi "github.com/sosedoff/pgweb/pkg/api"
+	pgclient "github.com/sosedoff/pgweb/pkg/client"
+	pgcmd "github.com/sosedoff/pgweb/pkg/command"
+)
+
+func MountDbStudio(dbURL, prefix string, readonly bool) (http.Handler, error) {
+	// Normalize prefix for pgweb:
+	//  - no leading slash
+	//  - always trailing slash if not empty
+	prefix = strings.Trim(prefix, "/")
+	if prefix != "" {
+		prefix = prefix + "/"
+	}
+
+	pgcmd.Opts = pgcmd.Options{
+		URL:         dbURL,
+		Prefix:      prefix, // e.g. "db-studio/"
+		ReadOnly:    readonly,
+		Sessions:    false,
+		LockSession: true,
+		SkipOpen:    true,
+	}
+
+	cli, err := pgclient.NewFromUrl(dbURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	if readonly {
+		_ = cli.SetReadOnlyMode()
+	}
+
+	if err := cli.Test(); err != nil {
+		return nil, err
+	}
+
+	pgapi.DbClient = cli
+
+	gin.SetMode(gin.ReleaseMode)
+	g := gin.New()
+	g.Use(gin.Recovery())
+
+	pgapi.SetupRoutes(g)
+	pgapi.SetupMetrics(g)
+
+	return g, nil
+}

internal/api/mount_dns_routes.go

@@ -0,0 +1,26 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountDNSRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/dns", func(d chi.Router) {
+		d.Use(authOrg)
+
+		d.Get("/domains", handlers.ListDomains(db))
+		d.Post("/domains", handlers.CreateDomain(db))
+		d.Get("/domains/{id}", handlers.GetDomain(db))
+		d.Patch("/domains/{id}", handlers.UpdateDomain(db))
+		d.Delete("/domains/{id}", handlers.DeleteDomain(db))
+
+		d.Get("/domains/{domain_id}/records", handlers.ListRecordSets(db))
+		d.Post("/domains/{domain_id}/records", handlers.CreateRecordSet(db))
+		d.Patch("/records/{id}", handlers.UpdateRecordSet(db))
+		d.Delete("/records/{id}", handlers.DeleteRecordSet(db))
+	})
+}

internal/api/mount_label_routes.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountLabelRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/labels", func(l chi.Router) {
+		l.Use(authOrg)
+		l.Get("/", handlers.ListLabels(db))
+		l.Post("/", handlers.CreateLabel(db))
+		l.Get("/{id}", handlers.GetLabel(db))
+		l.Patch("/{id}", handlers.UpdateLabel(db))
+		l.Delete("/{id}", handlers.DeleteLabel(db))
+	})
+}

internal/api/mount_load_balancer_routes.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountLoadBalancerRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/load-balancers", func(l chi.Router) {
+		l.Use(authOrg)
+		l.Get("/", handlers.ListLoadBalancers(db))
+		l.Post("/", handlers.CreateLoadBalancer(db))
+		l.Get("/{id}", handlers.GetLoadBalancer(db))
+		l.Patch("/{id}", handlers.UpdateLoadBalancer(db))
+		l.Delete("/{id}", handlers.DeleteLoadBalancer(db))
+	})
+}

internal/api/mount_me_routes.go

@@ -0,0 +1,22 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountMeRoutes(r chi.Router, db *gorm.DB, authUser func(http.Handler) http.Handler) {
+	r.Route("/me", func(me chi.Router) {
+		me.Use(authUser)
+
+		me.Get("/", handlers.GetMe(db))
+		me.Patch("/", handlers.UpdateMe(db))
+
+		me.Get("/api-keys", handlers.ListUserAPIKeys(db))
+		me.Post("/api-keys", handlers.CreateUserAPIKey(db))
+		me.Delete("/api-keys/{id}", handlers.DeleteUserAPIKey(db))
+	})
+}

internal/api/mount_meta_routes.go

@@ -0,0 +1,13 @@
+package api
+
+import (
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+)
+
+func mountMetaRoutes(r chi.Router) {
+	// Versioned JWKS for swagger
+	r.Get("/.well-known/jwks.json", handlers.JWKSHandler)
+	r.Get("/healthz", handlers.HealthCheck)
+	r.Get("/version", handlers.Version)
+}

internal/api/mount_node_pool_routes.go

@@ -0,0 +1,40 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountNodePoolRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/node-pools", func(n chi.Router) {
+		n.Use(authOrg)
+		n.Get("/", handlers.ListNodePools(db))
+		n.Post("/", handlers.CreateNodePool(db))
+		n.Get("/{id}", handlers.GetNodePool(db))
+		n.Patch("/{id}", handlers.UpdateNodePool(db))
+		n.Delete("/{id}", handlers.DeleteNodePool(db))
+
+		// Servers
+		n.Get("/{id}/servers", handlers.ListNodePoolServers(db))
+		n.Post("/{id}/servers", handlers.AttachNodePoolServers(db))
+		n.Delete("/{id}/servers/{serverId}", handlers.DetachNodePoolServer(db))
+
+		// Taints
+		n.Get("/{id}/taints", handlers.ListNodePoolTaints(db))
+		n.Post("/{id}/taints", handlers.AttachNodePoolTaints(db))
+		n.Delete("/{id}/taints/{taintId}", handlers.DetachNodePoolTaint(db))
+
+		// Labels
+		n.Get("/{id}/labels", handlers.ListNodePoolLabels(db))
+		n.Post("/{id}/labels", handlers.AttachNodePoolLabels(db))
+		n.Delete("/{id}/labels/{labelId}", handlers.DetachNodePoolLabel(db))
+
+		// Annotations
+		n.Get("/{id}/annotations", handlers.ListNodePoolAnnotations(db))
+		n.Post("/{id}/annotations", handlers.AttachNodePoolAnnotations(db))
+		n.Delete("/{id}/annotations/{annotationId}", handlers.DetachNodePoolAnnotation(db))
+	})
+}

internal/api/mount_org_routes.go

@@ -0,0 +1,35 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountOrgRoutes(r chi.Router, db *gorm.DB, authUser, authOrg func(http.Handler) http.Handler) {
+	r.Route("/orgs", func(o chi.Router) {
+		o.Use(authUser)
+		o.Get("/", handlers.ListMyOrgs(db))
+		o.Post("/", handlers.CreateOrg(db))
+
+		o.Group(func(og chi.Router) {
+			og.Use(authOrg)
+
+			og.Get("/{id}", handlers.GetOrg(db))
+			og.Patch("/{id}", handlers.UpdateOrg(db))
+			og.Delete("/{id}", handlers.DeleteOrg(db))
+
+			// members
+			og.Get("/{id}/members", handlers.ListMembers(db))
+			og.Post("/{id}/members", handlers.AddOrUpdateMember(db))
+			og.Delete("/{id}/members/{user_id}", handlers.RemoveMember(db))
+
+			// org-scoped key/secret pair
+			og.Get("/{id}/api-keys", handlers.ListOrgKeys(db))
+			og.Post("/{id}/api-keys", handlers.CreateOrgKey(db))
+			og.Delete("/{id}/api-keys/{key_id}", handlers.DeleteOrgKey(db))
+		})
+	})
+}

internal/api/mount_pprof_routes.go

@@ -0,0 +1,24 @@
+package api
+
+import (
+	httpPprof "net/http/pprof"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func mountPprofRoutes(r chi.Router) {
+	r.Route("/debug/pprof", func(pr chi.Router) {
+		pr.Get("/", httpPprof.Index)
+		pr.Get("/cmdline", httpPprof.Cmdline)
+		pr.Get("/profile", httpPprof.Profile)
+		pr.Get("/symbol", httpPprof.Symbol)
+		pr.Get("/trace", httpPprof.Trace)
+
+		pr.Handle("/allocs", httpPprof.Handler("allocs"))
+		pr.Handle("/block", httpPprof.Handler("block"))
+		pr.Handle("/goroutine", httpPprof.Handler("goroutine"))
+		pr.Handle("/heap", httpPprof.Handler("heap"))
+		pr.Handle("/mutex", httpPprof.Handler("mutex"))
+		pr.Handle("/threadcreate", httpPprof.Handler("threadcreate"))
+	})
+}

internal/api/mount_server_routes.go

@@ -0,0 +1,21 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountServerRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/servers", func(s chi.Router) {
+		s.Use(authOrg)
+		s.Get("/", handlers.ListServers(db))
+		s.Post("/", handlers.CreateServer(db))
+		s.Get("/{id}", handlers.GetServer(db))
+		s.Patch("/{id}", handlers.UpdateServer(db))
+		s.Delete("/{id}", handlers.DeleteServer(db))
+		s.Post("/{id}/reset-hostkey", handlers.ResetServerHostKey(db))
+	})
+}

internal/api/mount_ssh_routes.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountSSHRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/ssh", func(s chi.Router) {
+		s.Use(authOrg)
+		s.Get("/", handlers.ListPublicSshKeys(db))
+		s.Post("/", handlers.CreateSSHKey(db))
+		s.Get("/{id}", handlers.GetSSHKey(db))
+		s.Delete("/{id}", handlers.DeleteSSHKey(db))
+		s.Get("/{id}/download", handlers.DownloadSSHKey(db))
+	})
+}

internal/api/mount_swagger_routes.go

@@ -0,0 +1,87 @@
+package api
+
+import (
+	"fmt"
+	"html/template"
+	"net/http"
+
+	"github.com/glueops/autoglue/docs"
+	"github.com/go-chi/chi/v5"
+)
+
+func mountSwaggerRoutes(r chi.Router) {
+	r.Get("/swagger", RapidDocHandler("/swagger/swagger.yaml"))
+	r.Get("/swagger/index.html", RapidDocHandler("/swagger/swagger.yaml"))
+	r.Get("/swagger/openapi.json", serveSwaggerFromEmbed(docs.SwaggerJSON, "application/json"))
+	r.Get("/swagger/openapi.yaml", serveSwaggerFromEmbed(docs.SwaggerYAML, "application/x-yaml"))
+}
+
+var rapidDocTmpl = template.Must(template.New("redoc").Parse(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>AutoGlue API Docs</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta charset="utf-8">
+  <style>
+    body { margin: 0; padding: 0; }
+    .redoc-container { height: 100vh; }
+  </style>
+</head>
+<body>
+  <rapi-doc
+    id="autoglue-docs"
+    spec-url="{{.SpecURL}}"
+    render-style="read"
+    theme="dark"
+    show-header="false"
+    persist-auth="true"
+	allow-advanced-search="true"
+	schema-description-expanded="true"                                                                                                                                   
+	allow-schema-description-expand-toggle="false"                                                                                                                       
+	allow-spec-file-download="true"                                                                                                                                      
+	allow-spec-file-load="false"                                                                                                                                         
+	allow-spec-url-load="false"                       
+    allow-try="true"
+    schema-style="tree"
+	fetch-credentials="include"
+    default-api-server="{{.DefaultServer}}"
+ 	api-key-name="X-ORG-ID"
+  	api-key-location="header"
+  	api-key-value=""
+  />
+  <script type="module" src="https://unpkg.com/rapidoc/dist/rapidoc-min.js"></script>
+  <script>
+    window.addEventListener('DOMContentLoaded', () => {
+      const rd = document.getElementById('autoglue-docs');
+      if (!rd) return;
+
+      const storedOrg = localStorage.getItem('autoglue.org');
+      if (storedOrg) {
+        rd.setAttribute('api-key-value', storedOrg);
+      }
+    }
+  </script>
+</body>
+</html>`))
+
+func RapidDocHandler(specURL string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		scheme := "http"
+		if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" {
+			scheme = "https"
+		}
+
+		host := r.Host
+		defaultServer := fmt.Sprintf("%s://%s/api/v1", scheme, host)
+
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		if err := rapidDocTmpl.Execute(w, map[string]string{
+			"SpecURL":       specURL,
+			"DefaultServer": defaultServer,
+		}); err != nil {
+			http.Error(w, "failed to render docs", http.StatusInternalServerError)
+			return
+		}
+	}
+}

internal/api/mount_taint_routes.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/glueops/autoglue/internal/handlers"
+	"github.com/go-chi/chi/v5"
+	"gorm.io/gorm"
+)
+
+func mountTaintRoutes(r chi.Router, db *gorm.DB, authOrg func(http.Handler) http.Handler) {
+	r.Route("/taints", func(t chi.Router) {
+		t.Use(authOrg)
+		t.Get("/", handlers.ListTaints(db))
+		t.Post("/", handlers.CreateTaint(db))
+		t.Get("/{id}", handlers.GetTaint(db))
+		t.Patch("/{id}", handlers.UpdateTaint(db))
+		t.Delete("/{id}", handlers.DeleteTaint(db))
+	})
+}

internal/api/mw_security.go

@@ -29,14 +29,14 @@ func SecurityHeaders(next http.Handler) http.Handler {
 				"base-uri 'self'",
 				"form-action 'self'",
 				// Vite dev & inline preamble/eval:
-				"script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:5173",
+				"script-src 'self' 'unsafe-inline' 'unsafe-eval' http://localhost:5173 https://unpkg.com",
 				// allow dev style + Google Fonts
 				"style-src 'self' 'unsafe-inline' http://localhost:5173 https://fonts.googleapis.com",
 				"img-src 'self' data: blob:",
 				// Google font files
 				"font-src 'self' data: https://fonts.gstatic.com",
 				// HMR connections
-				"connect-src 'self' http://localhost:5173 ws://localhost:5173 ws://localhost:8080",
+				"connect-src 'self' http://localhost:5173 ws://localhost:5173 ws://localhost:8080 https://api.github.com https://unpkg.com",
 				"frame-ancestors 'none'",
 			}, "; "))
 		} else {
@@ -49,11 +49,11 @@ func SecurityHeaders(next http.Handler) http.Handler {
 				"default-src 'self'",
 				"base-uri 'self'",
 				"form-action 'self'",
-				"script-src 'self' 'unsafe-inline'",
+				"script-src 'self' 'unsafe-inline' https://unpkg.com",
 				"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
 				"img-src 'self' data: blob:",
 				"font-src 'self' data: https://fonts.gstatic.com",
-				"connect-src 'self'",
+				"connect-src 'self' ws://localhost:8080 https://api.github.com https://unpkg.com",
 				"frame-ancestors 'none'",
 			}, "; "))
 		}

internal/api/routes.go

@@ -3,11 +3,10 @@ package api
 import (
 	"fmt"
 	"net/http"
-	httpPprof "net/http/pprof"
 	"os"
+	"strings"
 	"time"
 
-	"github.com/glueops/autoglue/docs"
 	"github.com/glueops/autoglue/internal/api/httpmiddleware"
 	"github.com/glueops/autoglue/internal/bg"
 	"github.com/glueops/autoglue/internal/config"
@@ -23,11 +22,9 @@ import (
 
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
-
-	httpSwagger "github.com/swaggo/http-swagger/v2"
 )
 
-func NewRouter(db *gorm.DB, jobs *bg.Jobs) http.Handler {
+func NewRouter(db *gorm.DB, jobs *bg.Jobs, studio http.Handler) http.Handler {
 	zerolog.TimeFieldFormat = time.RFC3339
 
 	l := log.Output(zerolog.ConsoleWriter{Out: os.Stdout, TimeFormat: "15:04:05"})
@@ -41,6 +38,7 @@ func NewRouter(db *gorm.DB, jobs *bg.Jobs) http.Handler {
 	r.Use(SecurityHeaders)
 	r.Use(requestBodyLimit(10 << 20))
 	r.Use(httprate.LimitByIP(100, 1*time.Minute))
+	r.Use(middleware.StripSlashes)
 
 	allowed := getAllowedOrigins()
 	r.Use(cors.Handler(cors.Options{
@@ -59,177 +57,44 @@ func NewRouter(db *gorm.DB, jobs *bg.Jobs) http.Handler {
 		MaxAge:           600,
 	}))
 
-	r.Use(middleware.AllowContentType("application/json"))
+	r.Use(middleware.Maybe(
+		middleware.AllowContentType("application/json"),
+		func(r *http.Request) bool {
+			// return true  => run AllowContentType
+			// return false => skip AllowContentType for this request
+			return !strings.HasPrefix(r.URL.Path, "/db-studio")
+		}))
+	//r.Use(middleware.AllowContentType("application/json"))
 
+	// Unversioned, non-auth endpoints
 	r.Get("/.well-known/jwks.json", handlers.JWKSHandler)
-	r.Route("/api", func(api chi.Router) {
-		api.Route("/v1", func(v1 chi.Router) {
+
+	// Versioned API
+	mountAPIRoutes(r, db, jobs)
+
+	// Optional DB studio
+	if studio != nil {
+		r.Group(func(gr chi.Router) {
 			authUser := httpmiddleware.AuthMiddleware(db, false)
-			authOrg := httpmiddleware.AuthMiddleware(db, true)
-
-			// Also serving a versioned JWKS for swagger, which uses BasePath
-			v1.Get("/.well-known/jwks.json", handlers.JWKSHandler)
-
-			v1.Get("/healthz", handlers.HealthCheck)
-			v1.Get("/version", handlers.Version)
-
-			v1.Route("/auth", func(a chi.Router) {
-				a.Post("/{provider}/start", handlers.AuthStart(db))
-				a.Get("/{provider}/callback", handlers.AuthCallback(db))
-				a.Post("/refresh", handlers.Refresh(db))
-				a.Post("/logout", handlers.Logout(db))
-			})
-
-			v1.Route("/admin", func(admin chi.Router) {
-				admin.Route("/archer", func(archer chi.Router) {
-					archer.Use(authUser)
-					archer.Use(httpmiddleware.RequirePlatformAdmin())
-
-					archer.Get("/jobs", handlers.AdminListArcherJobs(db))
-					archer.Post("/jobs", handlers.AdminEnqueueArcherJob(db, jobs))
-					archer.Post("/jobs/{id}/retry", handlers.AdminRetryArcherJob(db))
-					archer.Post("/jobs/{id}/cancel", handlers.AdminCancelArcherJob(db))
-					archer.Get("/queues", handlers.AdminListArcherQueues(db))
-				})
-			})
-
-			v1.Route("/me", func(me chi.Router) {
-				me.Use(authUser)
-
-				me.Get("/", handlers.GetMe(db))
-				me.Patch("/", handlers.UpdateMe(db))
-
-				me.Get("/api-keys", handlers.ListUserAPIKeys(db))
-				me.Post("/api-keys", handlers.CreateUserAPIKey(db))
-				me.Delete("/api-keys/{id}", handlers.DeleteUserAPIKey(db))
-			})
-
-			v1.Route("/orgs", func(o chi.Router) {
-				o.Use(authUser)
-				o.Get("/", handlers.ListMyOrgs(db))
-				o.Post("/", handlers.CreateOrg(db))
-
-				o.Group(func(og chi.Router) {
-					og.Use(authOrg)
-					og.Get("/{id}", handlers.GetOrg(db))
-					og.Patch("/{id}", handlers.UpdateOrg(db))
-					og.Delete("/{id}", handlers.DeleteOrg(db))
-
-					// members
-					og.Get("/{id}/members", handlers.ListMembers(db))
-					og.Post("/{id}/members", handlers.AddOrUpdateMember(db))
-					og.Delete("/{id}/members/{user_id}", handlers.RemoveMember(db))
-
-					// org-scoped key/secret pair
-					og.Get("/{id}/api-keys", handlers.ListOrgKeys(db))
-					og.Post("/{id}/api-keys", handlers.CreateOrgKey(db))
-					og.Delete("/{id}/api-keys/{key_id}", handlers.DeleteOrgKey(db))
-				})
-			})
-
-			v1.Route("/ssh", func(s chi.Router) {
-				s.Use(authOrg)
-				s.Get("/", handlers.ListPublicSshKeys(db))
-				s.Post("/", handlers.CreateSSHKey(db))
-				s.Get("/{id}", handlers.GetSSHKey(db))
-				s.Delete("/{id}", handlers.DeleteSSHKey(db))
-				s.Get("/{id}/download", handlers.DownloadSSHKey(db))
-			})
-
-			v1.Route("/servers", func(s chi.Router) {
-				s.Use(authOrg)
-				s.Get("/", handlers.ListServers(db))
-				s.Post("/", handlers.CreateServer(db))
-				s.Get("/{id}", handlers.GetServer(db))
-				s.Patch("/{id}", handlers.UpdateServer(db))
-				s.Delete("/{id}", handlers.DeleteServer(db))
-			})
-
-			v1.Route("/taints", func(s chi.Router) {
-				s.Use(authOrg)
-				s.Get("/", handlers.ListTaints(db))
-				s.Post("/", handlers.CreateTaint(db))
-				s.Get("/{id}", handlers.GetTaint(db))
-				s.Patch("/{id}", handlers.UpdateTaint(db))
-				s.Delete("/{id}", handlers.DeleteTaint(db))
-			})
-
-			v1.Route("/labels", func(l chi.Router) {
-				l.Use(authOrg)
-				l.Get("/", handlers.ListLabels(db))
-				l.Post("/", handlers.CreateLabel(db))
-				l.Get("/{id}", handlers.GetLabel(db))
-				l.Patch("/{id}", handlers.UpdateLabel(db))
-				l.Delete("/{id}", handlers.DeleteLabel(db))
-			})
-
-			v1.Route("/annotations", func(a chi.Router) {
-				a.Use(authOrg)
-				a.Get("/", handlers.ListAnnotations(db))
-				a.Post("/", handlers.CreateAnnotation(db))
-				a.Get("/{id}", handlers.GetAnnotation(db))
-				a.Patch("/{id}", handlers.UpdateAnnotation(db))
-				a.Delete("/{id}", handlers.DeleteAnnotation(db))
-			})
-
-			v1.Route("/node-pools", func(n chi.Router) {
-				n.Use(authOrg)
-				n.Get("/", handlers.ListNodePools(db))
-				n.Post("/", handlers.CreateNodePool(db))
-				n.Get("/{id}", handlers.GetNodePool(db))
-				n.Patch("/{id}", handlers.UpdateNodePool(db))
-				n.Delete("/{id}", handlers.DeleteNodePool(db))
-
-				// Servers
-				n.Get("/{id}/servers", handlers.ListNodePoolServers(db))
-				n.Post("/{id}/servers", handlers.AttachNodePoolServers(db))
-				n.Delete("/{id}/servers/{serverId}", handlers.DetachNodePoolServer(db))
-
-				// Taints
-				n.Get("/{id}/taints", handlers.ListNodePoolTaints(db))
-				n.Post("/{id}/taints", handlers.AttachNodePoolTaints(db))
-				n.Delete("/{id}/taints/{taintId}", handlers.DetachNodePoolTaint(db))
-
-				// Labels
-				n.Get("/{id}/labels", handlers.ListNodePoolLabels(db))
-				n.Post("/{id}/labels", handlers.AttachNodePoolLabels(db))
-				n.Delete("/{id}/labels/{labelId}", handlers.DetachNodePoolLabel(db))
-
-				// Annotations
-				n.Get("/{id}/annotations", handlers.ListNodePoolAnnotations(db))
-				n.Post("/{id}/annotations", handlers.AttachNodePoolAnnotations(db))
-				n.Delete("/{id}/annotations/{annotationId}", handlers.DetachNodePoolAnnotation(db))
-			})
+			adminOnly := httpmiddleware.RequirePlatformAdmin()
+			gr.Use(authUser, adminOnly)
+			gr.Mount("/db-studio", studio)
 		})
-	})
+	}
+
+	// pprof
 	if config.IsDebug() {
-		r.Route("/debug/pprof", func(pr chi.Router) {
-			pr.Get("/", httpPprof.Index)
-			pr.Get("/cmdline", httpPprof.Cmdline)
-			pr.Get("/profile", httpPprof.Profile)
-			pr.Get("/symbol", httpPprof.Symbol)
-			pr.Get("/trace", httpPprof.Trace)
-
-			pr.Handle("/allocs", httpPprof.Handler("allocs"))
-			pr.Handle("/block", httpPprof.Handler("block"))
-			pr.Handle("/goroutine", httpPprof.Handler("goroutine"))
-			pr.Handle("/heap", httpPprof.Handler("heap"))
-			pr.Handle("/mutex", httpPprof.Handler("mutex"))
-			pr.Handle("/threadcreate", httpPprof.Handler("threadcreate"))
-		})
+		mountPprofRoutes(r)
 	}
 
+	// Swagger
 	if config.IsSwaggerEnabled() {
-		r.Get("/swagger/*", httpSwagger.Handler(
-			httpSwagger.URL("swagger.json"),
-		))
-		r.Get("/swagger/swagger.json", serveSwaggerFromEmbed(docs.SwaggerJSON, "application/json"))
-		r.Get("/swagger/swagger.yaml", serveSwaggerFromEmbed(docs.SwaggerYAML, "application/x-yaml"))
+		mountSwaggerRoutes(r)
 	}
 
+	// UI dev/prod
 	if config.IsUIDev() {
 		fmt.Println("Running in development mode")
-		// Dev: isolate proxy from chi middlewares so WS upgrade can hijack.
 		proxy, err := web.DevProxy("http://localhost:5173")
 		if err != nil {
 			log.Error().Err(err).Msg("dev proxy init failed")
@@ -237,14 +102,13 @@ func NewRouter(db *gorm.DB, jobs *bg.Jobs) http.Handler {
 		}
 
 		mux := http.NewServeMux()
-		// Send API/Swagger/pprof to chi
 		mux.Handle("/api/", r)
 		mux.Handle("/api", r)
+		mux.Handle("/swagger", r)
 		mux.Handle("/swagger/", r)
+		mux.Handle("/db-studio/", r)
 		mux.Handle("/debug/pprof/", r)
-		// Everything else (/, /brand-preview, assets) → proxy (no middlewares)
 		mux.Handle("/", proxy)
-
 		return mux
 	} else {
 		fmt.Println("Running in production mode")

internal/api/utils.go

@@ -40,6 +40,7 @@ func serveSwaggerFromEmbed(data []byte, contentType string) http.HandlerFunc {
 	return func(w http.ResponseWriter, _ *http.Request) {
 		w.Header().Set("Content-Type", contentType)
 		w.WriteHeader(http.StatusOK)
+		// nosemgrep: go.lang.security.audit.xss.no-direct-write-to-responsewriter
 		_, _ = w.Write(data)
 	}
 }

internal/app/runtime.go

@@ -39,6 +39,10 @@ func NewRuntime() *Runtime {
 		&models.Label{},
 		&models.Annotation{},
 		&models.NodePool{},
+		&models.Credential{},
+		&models.Domain{},
+		&models.RecordSet{},
+		&models.LoadBalancer{},
 		&models.Cluster{},
 	)
 

internal/bg/backup_s3.go

@@ -0,0 +1,264 @@
+package bg
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"mime"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/dyaksa/archer"
+	"github.com/dyaksa/archer/job"
+	"github.com/glueops/autoglue/internal/config"
+	"github.com/glueops/autoglue/internal/models"
+	"github.com/glueops/autoglue/internal/utils"
+	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
+	"gorm.io/gorm"
+)
+
+type DbBackupArgs struct {
+	IntervalS int `json:"interval_seconds,omitempty"`
+}
+
+type s3Scope struct {
+	Service string `json:"service"`
+	Region  string `json:"region"`
+}
+
+type encAWS struct {
+	AccessKeyID     string `json:"access_key_id"`
+	SecretAccessKey string `json:"secret_access_key"`
+}
+
+func DbBackupWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
+	return func(ctx context.Context, j job.Job) (any, error) {
+		args := DbBackupArgs{IntervalS: 3600}
+		_ = j.ParseArguments(&args)
+
+		if args.IntervalS <= 0 {
+			args.IntervalS = 3600
+		}
+
+		if err := DbBackup(ctx, db); err != nil {
+			return nil, err
+		}
+
+		queue := j.QueueName
+		if strings.TrimSpace(queue) == "" {
+			queue = "db_backup_s3"
+		}
+
+		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
+
+		payload := DbBackupArgs{}
+
+		opts := []archer.FnOptions{
+			archer.WithScheduleTime(next),
+			archer.WithMaxRetries(1),
+		}
+
+		if _, err := jobs.Enqueue(ctx, uuid.NewString(), queue, payload, opts...); err != nil {
+			log.Error().Err(err).Str("queue", queue).Time("next", next).Msg("failed to enqueue next db backup")
+		} else {
+			log.Info().Str("queue", queue).Time("next", next).Msg("scheduled next db backup")
+		}
+		return nil, nil
+	}
+}
+
+func DbBackup(ctx context.Context, db *gorm.DB) error {
+	cfg, err := config.Load()
+	if err != nil {
+		return fmt.Errorf("load config: %w", err)
+	}
+
+	cred, sc, err := loadS3Credential(ctx, db)
+	if err != nil {
+		return fmt.Errorf("load credential: %w", err)
+	}
+
+	ak, sk, err := decryptAwsAccessKeys(ctx, db, cred)
+	if err != nil {
+		return fmt.Errorf("decrypt aws keys: %w", err)
+	}
+
+	region := sc.Region
+
+	if strings.TrimSpace(region) == "" {
+		region = cred.Region
+		if strings.TrimSpace(region) == "" {
+			region = "us-west-1"
+		}
+	}
+
+	bucket := strings.ToLower(fmt.Sprintf("%s-autoglue-backups-%s", cred.OrganizationID, region))
+
+	s3cli, err := makeS3Client(ctx, ak, sk, region)
+	if err != nil {
+		return err
+	}
+
+	if err := ensureBucket(ctx, s3cli, bucket, region); err != nil {
+		return fmt.Errorf("ensure bucket: %w", err)
+	}
+
+	tmpDir := os.TempDir()
+	now := time.Now().UTC()
+	key := fmt.Sprintf("%04d/%02d/%02d/backup-%02d.sql", now.Year(), now.Month(), now.Day(), now.Hour())
+	outPath := filepath.Join(tmpDir, "autoglue-backup-"+now.Format("20060102T150405Z")+".sql")
+
+	if err := runPgDump(ctx, cfg.DbURL, outPath); err != nil {
+		return fmt.Errorf("pg_dump: %w", err)
+	}
+	defer os.Remove(outPath)
+
+	if err := uploadFileToS3(ctx, s3cli, bucket, key, outPath); err != nil {
+		return fmt.Errorf("s3 upload: %w", err)
+	}
+
+	log.Info().Str("bucket", bucket).Str("key", key).Msg("backup uploaded")
+
+	return nil
+}
+
+// --- Helpers
+
+func loadS3Credential(ctx context.Context, db *gorm.DB) (models.Credential, s3Scope, error) {
+	var c models.Credential
+	err := db.
+		WithContext(ctx).
+		Where("provider = ? AND kind = ? AND scope_kind = ?", "aws", "aws_access_key", "service").
+		Where("scope ->> 'service' = ?", "s3").
+		Order("created_at DESC").
+		First(&c).Error
+	if err != nil {
+		return models.Credential{}, s3Scope{}, fmt.Errorf("load credential: %w", err)
+	}
+
+	var sc s3Scope
+	_ = json.Unmarshal(c.Scope, &sc)
+	return c, sc, nil
+}
+
+func decryptAwsAccessKeys(ctx context.Context, db *gorm.DB, c models.Credential) (string, string, error) {
+	plain, err := utils.DecryptForOrg(c.OrganizationID, c.EncryptedData, c.IV, c.Tag, db)
+	if err != nil {
+		return "", "", err
+	}
+
+	var payload encAWS
+	if err := json.Unmarshal([]byte(plain), &payload); err != nil {
+		return "", "", fmt.Errorf("parse decrypted payload: %w", err)
+	}
+
+	if payload.AccessKeyID == "" || payload.SecretAccessKey == "" {
+		return "", "", errors.New("decrypted payload missing keys")
+	}
+	return payload.AccessKeyID, payload.SecretAccessKey, nil
+}
+
+func makeS3Client(ctx context.Context, accessKey, secret, region string) (*s3.Client, error) {
+	staticCredentialsProvider := credentials.NewStaticCredentialsProvider(accessKey, secret, "")
+	cfg, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithCredentialsProvider(staticCredentialsProvider), awsconfig.WithRegion(region))
+	if err != nil {
+		return nil, fmt.Errorf("aws config: %w", err)
+	}
+	return s3.NewFromConfig(cfg), nil
+}
+
+func ensureBucket(ctx context.Context, s3cli *s3.Client, bucket, region string) error {
+	_, err := s3cli.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(bucket)})
+	if err == nil {
+		return nil
+	}
+
+	if out, err := s3cli.GetBucketLocation(ctx, &s3.GetBucketLocationInput{Bucket: aws.String(bucket)}); err == nil {
+		existing := string(out.LocationConstraint)
+		if existing == "" {
+			existing = "us-east-1"
+		}
+		if existing != region {
+			return fmt.Errorf("bucket %q already exists in region %q (requested %q)", bucket, existing, region)
+		}
+	}
+
+	// Create; LocationConstraint except us-east-1
+	in := &s3.CreateBucketInput{Bucket: aws.String(bucket)}
+	if region != "us-east-1" {
+		in.CreateBucketConfiguration = &s3types.CreateBucketConfiguration{
+			LocationConstraint: s3types.BucketLocationConstraint(region),
+		}
+	}
+	if _, err := s3cli.CreateBucket(ctx, in); err != nil {
+		return fmt.Errorf("create bucket: %w", err)
+	}
+
+	// default SSE (best-effort)
+	_, _ = s3cli.PutBucketEncryption(ctx, &s3.PutBucketEncryptionInput{
+		Bucket: aws.String(bucket),
+		ServerSideEncryptionConfiguration: &s3types.ServerSideEncryptionConfiguration{
+			Rules: []s3types.ServerSideEncryptionRule{
+				{ApplyServerSideEncryptionByDefault: &s3types.ServerSideEncryptionByDefault{
+					SSEAlgorithm: s3types.ServerSideEncryptionAes256,
+				}},
+			},
+		},
+	})
+	return nil
+}
+
+func runPgDump(ctx context.Context, dbURL, outPath string) error {
+	if err := os.MkdirAll(filepath.Dir(outPath), 0o755); err != nil {
+		return err
+	}
+
+	args := []string{
+		"--no-owner",
+		"--no-privileges",
+		"--format=plain",
+		"--file", outPath,
+		dbURL,
+	}
+
+	cmd := exec.CommandContext(ctx, "pg_dump", args...)
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("pg_dump failed: %v | %s", err, stderr.String())
+	}
+
+	return nil
+}
+
+func uploadFileToS3(ctx context.Context, s3cli *s3.Client, bucket, key, path string) error {
+	f, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close()
+
+	info, _ := f.Stat()
+	_, err = s3cli.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:               aws.String(bucket),
+		Key:                  aws.String(key),
+		Body:                 f,
+		ContentLength:        aws.Int64(info.Size()),
+		ContentType:          aws.String(mime.TypeByExtension(filepath.Ext(path))),
+		ServerSideEncryption: s3types.ServerSideEncryptionAes256,
+	})
+
+	return err
+}

internal/bg/bastion.go

@@ -2,8 +2,8 @@ package bg
 
 import (
 	"context"
+	"encoding/base64"
 	"fmt"
-	"log"
 	"net"
 	"strings"
 	"time"
@@ -13,13 +13,16 @@ import (
 	"github.com/glueops/autoglue/internal/models"
 	"github.com/glueops/autoglue/internal/utils"
 	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
 	"golang.org/x/crypto/ssh"
 	"gorm.io/gorm"
 )
 
 // ----- Public types -----
 
-type BastionBootstrapArgs struct{}
+type BastionBootstrapArgs struct {
+	IntervalS int `json:"interval_seconds,omitempty"`
+}
 
 type BastionBootstrapFailure struct {
 	ID     uuid.UUID `json:"id"`
@@ -39,11 +42,17 @@ type BastionBootstrapResult struct {
 
 // ----- Worker -----
 
-func BastionBootstrapWorker(db *gorm.DB) archer.WorkerFn {
+func BastionBootstrapWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
 	return func(ctx context.Context, j job.Job) (any, error) {
+		args := BastionBootstrapArgs{IntervalS: 120}
 		jobID := j.ID
 		start := time.Now()
 
+		_ = j.ParseArguments(&args)
+		if args.IntervalS <= 0 {
+			args.IntervalS = 120
+		}
+
 		var servers []models.Server
 		if err := db.
 			Preload("SshKey").
@@ -105,7 +114,7 @@ func BastionBootstrapWorker(db *gorm.DB) archer.WorkerFn {
 			// 4) SSH + install docker
 			host := net.JoinHostPort(*s.PublicIPAddress, "22")
 			runCtx, cancel := context.WithTimeout(ctx, perHostTimeout)
-			out, err := sshInstallDockerWithOutput(runCtx, host, s.SSHUser, []byte(privKey))
+			out, err := sshInstallDockerWithOutput(runCtx, db, s, host, s.SSHUser, []byte(privKey))
 			cancel()
 
 			if err != nil {
@@ -131,10 +140,7 @@ func BastionBootstrapWorker(db *gorm.DB) archer.WorkerFn {
 				_ = setServerStatus(db, s.ID, "failed")
 				continue
 			}
-
 			ok++
-			//  logHostInfo(jobID, s, "done", "host completed",
-			//	  "elapsed_ms", time.Since(hostStart).Milliseconds())
 		}
 
 		res := BastionBootstrapResult{
@@ -147,9 +153,17 @@ func BastionBootstrapWorker(db *gorm.DB) archer.WorkerFn {
 			Failures:     failures,
 		}
 
-		// log.Printf("[bastion] level=INFO job=%s step=finish processed=%d ready=%d failed=%d elapsed_ms=%d",
-		// 	jobID, proc, ok, fail, res.ElapsedMs)
+		log.Debug().Int("processed", proc).Int("ready", ok).Int("failed", fail).Msg("[bastion] reconcile tick ok")
 
+		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
+		_, _ = jobs.Enqueue(
+			ctx,
+			uuid.NewString(),
+			"bootstrap_bastion",
+			args,
+			archer.WithScheduleTime(next),
+			archer.WithMaxRetries(1),
+		)
 		return res, nil
 	}
 }
@@ -187,16 +201,24 @@ func logHostInfo(jobID string, s *models.Server, step, msg string, kv ...any) {
 // ----- SSH & command execution -----
 
 // returns combined stdout/stderr so caller can log it on error
-func sshInstallDockerWithOutput(ctx context.Context, host, user string, privateKeyPEM []byte) (string, error) {
+func sshInstallDockerWithOutput(
+	ctx context.Context,
+	db *gorm.DB,
+	s *models.Server,
+	host, user string,
+	privateKeyPEM []byte,
+) (string, error) {
 	signer, err := ssh.ParsePrivateKey(privateKeyPEM)
 	if err != nil {
 		return "", fmt.Errorf("parse private key: %w", err)
 	}
 
+	hkcb := makeDBHostKeyCallback(db, s)
+
 	config := &ssh.ClientConfig{
 		User:            user,
 		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // TODO: known_hosts verification
+		HostKeyCallback: hkcb,
 		Timeout:         30 * time.Second,
 	}
 
@@ -494,3 +516,38 @@ func wrapSSHError(err error, output string) error {
 func sshEscape(s string) string {
 	return fmt.Sprintf("%q", s)
 }
+
+// makeDBHostKeyCallback returns a HostKeyCallback bound to a specific server row.
+// TOFU semantics:
+//   - If s.SSHHostKey is empty: store the current key in DB and accept.
+//   - If s.SSHHostKey is set: require exact match, else error (possible MITM/reinstall).
+func makeDBHostKeyCallback(db *gorm.DB, s *models.Server) ssh.HostKeyCallback {
+	return func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+		algo := key.Type()
+		enc := base64.StdEncoding.EncodeToString(key.Marshal())
+
+		// First-time connect: persist key (TOFU).
+		if s.SSHHostKey == "" {
+			if err := db.Model(&models.Server{}).
+				Where("id = ? AND (ssh_host_key IS NULL or ssh_host_key = '')", s.ID).
+				Updates(map[string]any{
+					"ssh_host_key":      enc,
+					"ssh_host_key_algo": algo,
+				}).Error; err != nil {
+				return fmt.Errorf("store new host key for %s (%s): %w", hostname, s.ID, err)
+			}
+
+			s.SSHHostKey = enc
+			s.SSHHostKeyAlgo = algo
+			return nil
+		}
+
+		if s.SSHHostKeyAlgo != algo || s.SSHHostKey != enc {
+			return fmt.Errorf(
+				"host key mismatch for %s (server_id=%s, stored=%s/%s, got=%s/%s) - POSSIBLE MITM or host reinstalled",
+				hostname, s.ID, s.SSHHostKeyAlgo, s.SSHHostKey, algo, enc,
+			)
+		}
+		return nil
+	}
+}

internal/bg/bg.go

@@ -67,7 +67,7 @@ func NewJobs(gdb *gorm.DB, dbUrl string) (*Jobs, error) {
 		archer.WithSetTableName("jobs"), // <- ensure correct table
 		archer.WithSleepInterval(1*time.Second), // fast poll while debugging
 		archer.WithErrHandler(func(err error) { // bubble up worker SQL errors
-			log.Printf("[archer] ERROR: %v", err)
+			log.Error().Err(err).Msg("[archer] worker error")
 		}),
 	)
 
@@ -75,7 +75,7 @@ func NewJobs(gdb *gorm.DB, dbUrl string) (*Jobs, error) {
 
 	c.Register(
 		"bootstrap_bastion",
-		BastionBootstrapWorker(gdb),
+		BastionBootstrapWorker(gdb, jobs),
 		archer.WithInstances(instances),
 		archer.WithTimeout(time.Duration(timeoutSec)*time.Second),
 	)
@@ -94,6 +94,19 @@ func NewJobs(gdb *gorm.DB, dbUrl string) (*Jobs, error) {
 		archer.WithTimeout(5*time.Minute),
 	)
 
+	c.Register(
+		"db_backup_s3",
+		DbBackupWorker(gdb, jobs),
+		archer.WithInstances(1),
+		archer.WithTimeout(15*time.Minute),
+	)
+
+	c.Register(
+		"dns_reconcile",
+		DNSReconsileWorker(gdb, jobs),
+		archer.WithInstances(1),
+		archer.WithTimeout(2*time.Minute),
+	)
 	return jobs, nil
 }
 

internal/bg/dns.go

@@ -0,0 +1,597 @@
+package bg
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/dyaksa/archer"
+	"github.com/dyaksa/archer/job"
+	"github.com/glueops/autoglue/internal/handlers/dto"
+	"github.com/glueops/autoglue/internal/models"
+	"github.com/glueops/autoglue/internal/utils"
+	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
+	"gorm.io/gorm"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	r53 "github.com/aws/aws-sdk-go-v2/service/route53"
+	r53types "github.com/aws/aws-sdk-go-v2/service/route53/types"
+)
+
+/************* args & small DTOs *************/
+
+type DNSReconcileArgs struct {
+	MaxDomains int `json:"max_domains,omitempty"`
+	MaxRecords int `json:"max_records,omitempty"`
+	IntervalS  int `json:"interval_seconds,omitempty"`
+}
+
+// TXT marker content (compact)
+type ownershipMarker struct {
+	Ver string `json:"v"`   // "ag1"
+	Org string `json:"org"` // org UUID
+	Rec string `json:"rec"` // record UUID
+	Fp  string `json:"fp"`  // short fp (first 16 of sha256)
+}
+
+// ExternalDNS poison owner id – MUST NOT match any real external-dns --txt-owner-id
+const externalDNSPoisonOwner = "autoglue-lock"
+
+// ExternalDNS poison content – fake owner so real external-dns skips it.
+const externalDNSPoisonValue = "heritage=external-dns,external-dns/owner=" + externalDNSPoisonOwner + ",external-dns/resource=manual/autoglue"
+
+/************* entrypoint worker *************/
+
+func DNSReconsileWorker(db *gorm.DB, jobs *Jobs) archer.WorkerFn {
+	return func(ctx context.Context, j job.Job) (any, error) {
+		args := DNSReconcileArgs{MaxDomains: 25, MaxRecords: 100, IntervalS: 30}
+		_ = j.ParseArguments(&args)
+
+		if args.MaxDomains <= 0 {
+			args.MaxDomains = 25
+		}
+		if args.MaxRecords <= 0 {
+			args.MaxRecords = 100
+		}
+		if args.IntervalS <= 0 {
+			args.IntervalS = 30
+		}
+
+		processedDomains, processedRecords, err := reconcileDNSOnce(ctx, db, args)
+		if err != nil {
+			log.Error().Err(err).Msg("[dns] reconcile tick failed")
+		} else {
+			log.Debug().
+				Int("domains", processedDomains).
+				Int("records", processedRecords).
+				Msg("[dns] reconcile tick ok")
+		}
+
+		next := time.Now().Add(time.Duration(args.IntervalS) * time.Second)
+		_, _ = jobs.Enqueue(ctx, uuid.NewString(), "dns_reconcile", args,
+			archer.WithScheduleTime(next),
+			archer.WithMaxRetries(1),
+		)
+
+		return map[string]any{
+			"domains_processed": processedDomains,
+			"records_processed": processedRecords,
+		}, nil
+	}
+}
+
+/************* core tick *************/
+
+func reconcileDNSOnce(ctx context.Context, db *gorm.DB, args DNSReconcileArgs) (int, int, error) {
+	var domains []models.Domain
+
+	// 1) validate/backfill pending domains
+	if err := db.
+		Where("status = ?", "pending").
+		Order("created_at ASC").
+		Limit(args.MaxDomains).
+		Find(&domains).Error; err != nil {
+		return 0, 0, err
+	}
+
+	domainsProcessed := 0
+	for i := range domains {
+		if err := processDomain(ctx, db, &domains[i]); err != nil {
+			log.Error().Err(err).Str("domain", domains[i].DomainName).Msg("[dns] domain processing failed")
+		} else {
+			domainsProcessed++
+		}
+	}
+
+	// 2) apply pending record sets for ready domains
+	var readyDomains []models.Domain
+	if err := db.Where("status = ?", "ready").Find(&readyDomains).Error; err != nil {
+		return domainsProcessed, 0, err
+	}
+
+	recordsProcessed := 0
+	for i := range readyDomains {
+		n, err := processPendingRecordsForDomain(ctx, db, &readyDomains[i], args.MaxRecords)
+		if err != nil {
+			log.Error().Err(err).Str("domain", readyDomains[i].DomainName).Msg("[dns] record processing failed")
+			continue
+		}
+		recordsProcessed += n
+	}
+
+	return domainsProcessed, recordsProcessed, nil
+}
+
+/************* domain processing *************/
+
+func processDomain(ctx context.Context, db *gorm.DB, d *models.Domain) error {
+	orgID := d.OrganizationID
+
+	// 1) Load credential (org-guarded)
+	var cred models.Credential
+	if err := db.Where("id = ? AND organization_id = ?", d.CredentialID, orgID).First(&cred).Error; err != nil {
+		return setDomainFailed(db, d, fmt.Errorf("credential not found: %w", err))
+	}
+
+	// 2) Decrypt → dto.AWSCredential
+	secret, err := utils.DecryptForOrg(orgID, cred.EncryptedData, cred.IV, cred.Tag, db)
+	if err != nil {
+		return setDomainFailed(db, d, fmt.Errorf("decrypt: %w", err))
+	}
+	var awsCred dto.AWSCredential
+	if err := jsonUnmarshalStrict([]byte(secret), &awsCred); err != nil {
+		return setDomainFailed(db, d, fmt.Errorf("secret decode: %w", err))
+	}
+
+	// 3) Client
+	r53c, _, err := newRoute53Client(ctx, awsCred)
+	if err != nil {
+		return setDomainFailed(db, d, err)
+	}
+
+	// 4) Backfill zone id if missing
+	zoneID := strings.TrimSpace(d.ZoneID)
+	if zoneID == "" {
+		zid, err := findHostedZoneID(ctx, r53c, d.DomainName)
+		if err != nil {
+			return setDomainFailed(db, d, fmt.Errorf("discover zone id: %w", err))
+		}
+		zoneID = zid
+		d.ZoneID = zoneID
+	}
+
+	// 5) Sanity: can fetch zone
+	if _, err := r53c.GetHostedZone(ctx, &r53.GetHostedZoneInput{Id: aws.String(zoneID)}); err != nil {
+		return setDomainFailed(db, d, fmt.Errorf("get hosted zone: %w", err))
+	}
+
+	// 6) Mark ready
+	d.Status = "ready"
+	d.LastError = ""
+	if err := db.Save(d).Error; err != nil {
+		return err
+	}
+	return nil
+}
+
+func setDomainFailed(db *gorm.DB, d *models.Domain, cause error) error {
+	d.Status = "failed"
+	d.LastError = truncateErr(cause.Error())
+	_ = db.Save(d).Error
+	return cause
+}
+
+/************* record processing *************/
+
+func processPendingRecordsForDomain(ctx context.Context, db *gorm.DB, d *models.Domain, max int) (int, error) {
+	orgID := d.OrganizationID
+
+	// reload credential
+	var cred models.Credential
+	if err := db.Where("id = ? AND organization_id = ?", d.CredentialID, orgID).First(&cred).Error; err != nil {
+		return 0, err
+	}
+
+	secret, err := utils.DecryptForOrg(orgID, cred.EncryptedData, cred.IV, cred.Tag, db)
+	if err != nil {
+		return 0, err
+	}
+
+	var awsCred dto.AWSCredential
+	if err := jsonUnmarshalStrict([]byte(secret), &awsCred); err != nil {
+		return 0, err
+	}
+	r53c, _, err := newRoute53Client(ctx, awsCred)
+	if err != nil {
+		return 0, err
+	}
+
+	var records []models.RecordSet
+	if err := db.
+		Where("domain_id = ? AND status = ?", d.ID, "pending").
+		Order("created_at ASC").
+		Limit(max).
+		Find(&records).Error; err != nil {
+		return 0, err
+	}
+
+	applied := 0
+	for i := range records {
+		if err := applyRecord(ctx, db, r53c, d, &records[i]); err != nil {
+			log.Error().Err(err).Str("rr", records[i].Name).Msg("[dns] apply record failed")
+			_ = setRecordFailed(db, &records[i], err)
+			continue
+		}
+		applied++
+	}
+	return applied, nil
+}
+
+// core write + ownership + external-dns hardening
+
+func applyRecord(ctx context.Context, db *gorm.DB, r53c *r53.Client, d *models.Domain, r *models.RecordSet) error {
+	zoneID := strings.TrimSpace(d.ZoneID)
+	if zoneID == "" {
+		return errors.New("domain has no zone_id")
+	}
+
+	rt := strings.ToUpper(r.Type)
+
+	// FQDN & marker
+	fq := recordFQDN(r.Name, d.DomainName) // ends with "."
+	mname := markerName(fq)
+	expected := buildMarkerValue(d.OrganizationID.String(), r.ID.String(), r.Fingerprint)
+
+	// ---- ExternalDNS preflight ----
+	extOwned, err := hasExternalDNSOwnership(ctx, r53c, zoneID, fq, rt)
+	if err != nil {
+		return fmt.Errorf("external_dns_lookup: %w", err)
+	}
+	if extOwned {
+		r.Owner = "external"
+		_ = db.Save(r).Error
+		return fmt.Errorf("ownership_conflict: external-dns claims %s; refusing to modify", strings.TrimSuffix(fq, "."))
+	}
+
+	// ---- Autoglue ownership preflight via _autoglue.<fqdn> TXT ----
+	markerVals, err := getMarkerTXTValues(ctx, r53c, zoneID, mname)
+	if err != nil {
+		return fmt.Errorf("marker lookup: %w", err)
+	}
+	hasForeignOwner := false
+	hasOurExact := false
+	for _, v := range markerVals {
+		mk, ok := parseMarkerValue(v)
+		if !ok {
+			continue
+		}
+		switch {
+		case mk.Org == d.OrganizationID.String() && mk.Rec == r.ID.String() && mk.Fp == shortFP(r.Fingerprint):
+			hasOurExact = true
+		case mk.Org != d.OrganizationID.String() || mk.Rec != r.ID.String():
+			hasForeignOwner = true
+		}
+	}
+	if hasForeignOwner {
+		r.Owner = "external"
+		_ = db.Save(r).Error
+		return fmt.Errorf("ownership_conflict: marker for %s is owned by another controller; refusing to modify", strings.TrimSuffix(fq, "."))
+	}
+
+	// Build RR change (UPSERT)
+	rrChange := r53types.Change{
+		Action: r53types.ChangeActionUpsert,
+		ResourceRecordSet: &r53types.ResourceRecordSet{
+			Name: aws.String(fq),
+			Type: r53types.RRType(rt),
+		},
+	}
+
+	// Decode user values
+	var userVals []string
+	if len(r.Values) > 0 {
+		if err := jsonUnmarshalStrict([]byte(r.Values), &userVals); err != nil {
+			return fmt.Errorf("values decode: %w", err)
+		}
+	}
+
+	// Quote TXT values as required by Route53
+	recs := make([]r53types.ResourceRecord, 0, len(userVals))
+	for _, v := range userVals {
+		v = strings.TrimSpace(v)
+		if rt == "TXT" && !(strings.HasPrefix(v, `"`) && strings.HasSuffix(v, `"`)) {
+			v = strconv.Quote(v)
+		}
+		recs = append(recs, r53types.ResourceRecord{Value: aws.String(v)})
+	}
+	rrChange.ResourceRecordSet.ResourceRecords = recs
+	if r.TTL != nil {
+		ttl := int64(*r.TTL)
+		rrChange.ResourceRecordSet.TTL = aws.Int64(ttl)
+	}
+
+	// Build marker TXT change (UPSERT)
+	markerChange := r53types.Change{
+		Action: r53types.ChangeActionUpsert,
+		ResourceRecordSet: &r53types.ResourceRecordSet{
+			Name: aws.String(mname),
+			Type: r53types.RRTypeTxt,
+			TTL:  aws.Int64(300),
+			ResourceRecords: []r53types.ResourceRecord{
+				{Value: aws.String(strconv.Quote(expected))},
+			},
+		},
+	}
+
+	// Build external-dns poison TXT changes
+	poisonChanges := buildExternalDNSPoisonTXTChanges(fq, rt)
+
+	// Apply all in one batch (atomic-ish)
+	changes := []r53types.Change{rrChange, markerChange}
+	changes = append(changes, poisonChanges...)
+
+	_, err = r53c.ChangeResourceRecordSets(ctx, &r53.ChangeResourceRecordSetsInput{
+		HostedZoneId: aws.String(zoneID),
+		ChangeBatch:  &r53types.ChangeBatch{Changes: changes},
+	})
+	if err != nil {
+		return err
+	}
+
+	// Success → mark ready & ownership
+	r.Status = "ready"
+	r.LastError = ""
+	r.Owner = "autoglue"
+	if err := db.Save(r).Error; err != nil {
+		return err
+	}
+	_ = hasOurExact // could be used to skip marker write in future
+	return nil
+}
+
+func setRecordFailed(db *gorm.DB, r *models.RecordSet, cause error) error {
+	msg := truncateErr(cause.Error())
+	r.Status = "failed"
+	r.LastError = msg
+	// classify ownership on conflict
+	if strings.HasPrefix(msg, "ownership_conflict") {
+		r.Owner = "external"
+	} else if r.Owner == "" || r.Owner == "unknown" {
+		r.Owner = "unknown"
+	}
+	_ = db.Save(r).Error
+	return cause
+}
+
+/************* AWS helpers *************/
+
+func newRoute53Client(ctx context.Context, cred dto.AWSCredential) (*r53.Client, *aws.Config, error) {
+	// Route53 is global, but config still wants a region
+	region := strings.TrimSpace(cred.Region)
+	if region == "" {
+		region = "us-east-1"
+	}
+	cfg, err := config.LoadDefaultConfig(ctx,
+		config.WithRegion(region),
+		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
+			cred.AccessKeyID, cred.SecretAccessKey, "",
+		)),
+	)
+	if err != nil {
+		return nil, nil, err
+	}
+	return r53.NewFromConfig(cfg), &cfg, nil
+}
+
+func findHostedZoneID(ctx context.Context, c *r53.Client, domain string) (string, error) {
+	d := normalizeDomain(domain)
+	out, err := c.ListHostedZonesByName(ctx, &r53.ListHostedZonesByNameInput{
+		DNSName: aws.String(d),
+	})
+	if err != nil {
+		return "", err
+	}
+	for _, hz := range out.HostedZones {
+		if strings.TrimSuffix(aws.ToString(hz.Name), ".") == d {
+			return trimZoneID(aws.ToString(hz.Id)), nil
+		}
+	}
+	return "", fmt.Errorf("hosted zone not found for %q", d)
+}
+
+func trimZoneID(id string) string {
+	return strings.TrimPrefix(id, "/hostedzone/")
+}
+
+func normalizeDomain(s string) string {
+	s = strings.TrimSpace(strings.ToLower(s))
+	return strings.TrimSuffix(s, ".")
+}
+
+func recordFQDN(name, domain string) string {
+	name = strings.TrimSpace(name)
+	if name == "" || name == "@" {
+		return normalizeDomain(domain) + "."
+	}
+	if strings.HasSuffix(name, ".") {
+		return name
+	}
+	return fmt.Sprintf("%s.%s.", name, normalizeDomain(domain))
+}
+
+/************* TXT marker / external-dns helpers *************/
+
+func markerName(fqdn string) string {
+	trimmed := strings.TrimSuffix(fqdn, ".")
+	return "_autoglue." + trimmed + "."
+}
+
+func shortFP(full string) string {
+	if len(full) > 16 {
+		return full[:16]
+	}
+	return full
+}
+
+func buildMarkerValue(orgID, recID, fp string) string {
+	return "v=ag1 org=" + orgID + " rec=" + recID + " fp=" + shortFP(fp)
+}
+
+func parseMarkerValue(s string) (ownershipMarker, bool) {
+	out := ownershipMarker{}
+	fields := strings.Fields(s)
+	if len(fields) < 4 {
+		return out, false
+	}
+	kv := map[string]string{}
+	for _, f := range fields {
+		parts := strings.SplitN(f, "=", 2)
+		if len(parts) == 2 {
+			kv[parts[0]] = parts[1]
+		}
+	}
+	if kv["v"] == "" || kv["org"] == "" || kv["rec"] == "" || kv["fp"] == "" {
+		return out, false
+	}
+	out.Ver, out.Org, out.Rec, out.Fp = kv["v"], kv["org"], kv["rec"], kv["fp"]
+	return out, true
+}
+
+func getMarkerTXTValues(ctx context.Context, c *r53.Client, zoneID, marker string) ([]string, error) {
+	return getTXTValues(ctx, c, zoneID, marker)
+}
+
+// generic TXT fetcher
+func getTXTValues(ctx context.Context, c *r53.Client, zoneID, name string) ([]string, error) {
+	out, err := c.ListResourceRecordSets(ctx, &r53.ListResourceRecordSetsInput{
+		HostedZoneId:    aws.String(zoneID),
+		StartRecordName: aws.String(name),
+		StartRecordType: r53types.RRTypeTxt,
+		MaxItems:        aws.Int32(1),
+	})
+	if err != nil {
+		return nil, err
+	}
+	if len(out.ResourceRecordSets) == 0 {
+		return nil, nil
+	}
+	rrset := out.ResourceRecordSets[0]
+	if aws.ToString(rrset.Name) != name || rrset.Type != r53types.RRTypeTxt {
+		return nil, nil
+	}
+	vals := make([]string, 0, len(rrset.ResourceRecords))
+	for _, rr := range rrset.ResourceRecords {
+		vals = append(vals, aws.ToString(rr.Value))
+	}
+	return vals, nil
+}
+
+// detect external-dns-style ownership for this fqdn/type
+func hasExternalDNSOwnership(ctx context.Context, c *r53.Client, zoneID, fqdn, rrType string) (bool, error) {
+	base := strings.TrimSuffix(fqdn, ".")
+	candidates := []string{
+		// with txtPrefix=extdns-, external-dns writes both:
+		// extdns-<fqdn> and extdns-<rrtype-lc>-<fqdn>
+		"extdns-" + base + ".",
+		"extdns-" + strings.ToLower(rrType) + "-" + base + ".",
+	}
+	for _, name := range candidates {
+		vals, err := getTXTValues(ctx, c, zoneID, name)
+		if err != nil {
+			return false, err
+		}
+		for _, raw := range vals {
+			v := strings.TrimSpace(raw)
+			// strip surrounding quotes if present
+			if len(v) >= 2 && v[0] == '"' && v[len(v)-1] == '"' {
+				if unq, err := strconv.Unquote(v); err == nil {
+					v = unq
+				}
+			}
+			meta := parseExternalDNSMeta(v)
+			if meta == nil {
+				continue
+			}
+			if meta["heritage"] == "external-dns" &&
+				meta["external-dns/owner"] != "" &&
+				meta["external-dns/owner"] != externalDNSPoisonOwner {
+				return true, nil
+			}
+		}
+	}
+	return false, nil
+}
+
+// parseExternalDNSMeta parses the comma-separated external-dns TXT format into a small map.
+func parseExternalDNSMeta(v string) map[string]string {
+	parts := strings.Split(v, ",")
+	if len(parts) == 0 {
+		return nil
+	}
+	meta := make(map[string]string, len(parts))
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p == "" {
+			continue
+		}
+		kv := strings.SplitN(p, "=", 2)
+		if len(kv) != 2 {
+			continue
+		}
+		meta[kv[0]] = kv[1]
+	}
+	if len(meta) == 0 {
+		return nil
+	}
+	return meta
+}
+
+// build poison TXT records so external-dns thinks some *other* owner manages this
+func buildExternalDNSPoisonTXTChanges(fqdn, rrType string) []r53types.Change {
+	base := strings.TrimSuffix(fqdn, ".")
+	names := []string{
+		"extdns-" + base + ".",
+		"extdns-" + strings.ToLower(rrType) + "-" + base + ".",
+	}
+	val := strconv.Quote(externalDNSPoisonValue)
+	changes := make([]r53types.Change, 0, len(names))
+	for _, n := range names {
+		changes = append(changes, r53types.Change{
+			Action: r53types.ChangeActionUpsert,
+			ResourceRecordSet: &r53types.ResourceRecordSet{
+				Name: aws.String(n),
+				Type: r53types.RRTypeTxt,
+				TTL:  aws.Int64(300),
+				ResourceRecords: []r53types.ResourceRecord{
+					{Value: aws.String(val)},
+				},
+			},
+		})
+	}
+	return changes
+}
+
+/************* misc utils *************/
+
+func truncateErr(s string) string {
+	const max = 2000
+	if len(s) > max {
+		return s[:max]
+	}
+	return s
+}
+
+// Strict unmarshal that treats "null" -> zero value correctly.
+func jsonUnmarshalStrict(b []byte, dst any) error {
+	if len(b) == 0 {
+		return errors.New("empty json")
+	}
+	return json.Unmarshal(b, dst)
+}

internal/config/config.go

@@ -13,6 +13,7 @@ import (
 
 type Config struct {
 	DbURL              string
+	DbURLRO            string
 	Port               string
 	Host               string
 	JWTIssuer          string
@@ -29,6 +30,12 @@ type Config struct {
 	Debug       bool
 	Swagger     bool
 	SwaggerHost string
+
+	DBStudioEnabled bool
+	DBStudioBind    string
+	DBStudioPort    string
+	DBStudioUser    string
+	DBStudioPass    string
 }
 
 var (
@@ -48,6 +55,12 @@ func Load() (Config, error) {
 		v.SetDefault("bind.address", "127.0.0.1")
 		v.SetDefault("bind.port", "8080")
 		v.SetDefault("database.url", "postgres://user:pass@localhost:5432/db?sslmode=disable")
+		v.SetDefault("database.url_ro", "")
+		v.SetDefault("db_studio.enabled", false)
+		v.SetDefault("db_studio.bind", "127.0.0.1")
+		v.SetDefault("db_studio.port", "0") // 0 = random
+		v.SetDefault("db_studio.user", "")
+		v.SetDefault("db_studio.pass", "")
 
 		v.SetDefault("ui.dev", false)
 		v.SetDefault("env", "development")
@@ -63,6 +76,7 @@ func Load() (Config, error) {
 			"bind.address",
 			"bind.port",
 			"database.url",
+			"database.url_ro",
 			"jwt.issuer",
 			"jwt.audience",
 			"jwt.private.enc.key",
@@ -76,6 +90,11 @@ func Load() (Config, error) {
 			"debug",
 			"swagger",
 			"swagger.host",
+			"db_studio.enabled",
+			"db_studio.bind",
+			"db_studio.port",
+			"db_studio.user",
+			"db_studio.pass",
 		}
 		for _, k := range keys {
 			_ = v.BindEnv(k)
@@ -84,6 +103,7 @@ func Load() (Config, error) {
 		// Build config
 		cfg := Config{
 			DbURL:              v.GetString("database.url"),
+			DbURLRO:            v.GetString("database.url_ro"),
 			Port:               v.GetString("bind.port"),
 			Host:               v.GetString("bind.address"),
 			JWTIssuer:          v.GetString("jwt.issuer"),
@@ -100,6 +120,12 @@ func Load() (Config, error) {
 			Debug:       v.GetBool("debug"),
 			Swagger:     v.GetBool("swagger"),
 			SwaggerHost: v.GetString("swagger.host"),
+
+			DBStudioEnabled: v.GetBool("db_studio.enabled"),
+			DBStudioBind:    v.GetString("db_studio.bind"),
+			DBStudioPort:    v.GetString("db_studio.port"),
+			DBStudioUser:    v.GetString("db_studio.user"),
+			DBStudioPass:    v.GetString("db_studio.pass"),
 		}
 
 		// Validate

internal/handlers/annotations.go

@@ -22,7 +22,6 @@ import (
 //	@Summary		List annotations (org scoped)
 //	@Description	Returns annotations for the organization in X-Org-ID. Filters: `key`, `value`, and `q` (key contains). Add `include=node_pools` to include linked node pools.
 //	@Tags			Annotations
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			key			query		string	false	"Exact key"
@@ -75,7 +74,6 @@ func ListAnnotations(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Get annotation by ID (org scoped)
 //	@Description	Returns one annotation. Add `include=node_pools` to include node pools.
 //	@Tags			Annotations
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			id			path		string	true	"Annotation ID (UUID)"
@@ -255,11 +253,10 @@ func UpdateAnnotation(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Delete annotation (org scoped)
 //	@Description	Permanently deletes the annotation.
 //	@Tags			Annotations
-//	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header		string	false	"Organization UUID"
-//	@Param			id			path		string	true	"Annotation ID (UUID)"
-//	@Success		204			{string}	string	"No Content"
+//	@Param			X-Org-ID	header	string	false	"Organization UUID"
+//	@Param			id			path	string	true	"Annotation ID (UUID)"
+//	@Success		204			"No Content"
 //	@Failure		400			{string}	string	"invalid id"
 //	@Failure		401			{string}	string	"Unauthorized"
 //	@Failure		403			{string}	string	"organization required"

internal/handlers/auth.go

@@ -2,7 +2,9 @@ package handlers
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
+	"html/template"
 	"net/http"
 	"net/url"
 	"strings"
@@ -252,10 +254,11 @@ func AuthCallback(db *gorm.DB) http.HandlerFunc {
 		accessTTL := 1 * time.Hour
 		refreshTTL := 30 * 24 * time.Hour
 
+		cfgLoaded, _ := config.Load()
 		access, err := auth.IssueAccessToken(auth.IssueOpts{
 			Subject:  user.ID.String(),
-			Issuer:   cfg.JWTIssuer,
-			Audience: cfg.JWTAudience,
+			Issuer:   cfgLoaded.JWTIssuer,
+			Audience: cfgLoaded.JWTAudience,
 			TTL:      accessTTL,
 			Claims: map[string]any{
 				"email": email,
@@ -273,17 +276,28 @@ func AuthCallback(db *gorm.DB) http.HandlerFunc {
 			return
 		}
 
+		secure := true
+		if u, err := url.Parse(cfg.OAuthRedirectBase); err == nil && isLocalDev(u) {
+			secure = false
+		}
+		if xf := r.Header.Get("X-Forwarded-Proto"); xf != "" {
+			secure = strings.EqualFold(xf, "https")
+		}
+
+		http.SetCookie(w, &http.Cookie{
+			Name:     "ag_jwt",
+			Value:    "Bearer " + access,
+			Path:     "/",
+			HttpOnly: true,
+			SameSite: http.SameSiteLaxMode,
+			Secure:   secure,
+			MaxAge:   int((time.Hour * 8).Seconds()),
+		})
+
 		// If the state indicates SPA popup mode, postMessage tokens to the opener and close
 		state := r.URL.Query().Get("state")
 		if strings.Contains(state, "mode=spa") {
-			origin := ""
-			for _, part := range strings.Split(state, "|") {
-				if strings.HasPrefix(part, "origin=") {
-					origin, _ = url.QueryUnescape(strings.TrimPrefix(part, "origin="))
-					break
-				}
-			}
-			// fallback: restrict to backend origin if none supplied
+			origin := canonicalOrigin(cfg.OAuthRedirectBase)
 			if origin == "" {
 				origin = cfg.OAuthRedirectBase
 			}
@@ -356,6 +370,24 @@ func Refresh(db *gorm.DB) http.HandlerFunc {
 			return
 		}
 
+		secure := true
+		if uParsed, err := url.Parse(cfg.OAuthRedirectBase); err == nil && isLocalDev(uParsed) {
+			secure = false
+		}
+		if xf := r.Header.Get("X-Forwarded-Proto"); xf != "" {
+			secure = strings.EqualFold(xf, "https")
+		}
+
+		http.SetCookie(w, &http.Cookie{
+			Name:     "ag_jwt",
+			Value:    "Bearer " + access,
+			Path:     "/",
+			HttpOnly: true,
+			SameSite: http.SameSiteLaxMode,
+			Secure:   secure,
+			MaxAge:   int((time.Hour * 8).Seconds()),
+		})
+
 		utils.WriteJSON(w, 200, dto.TokenPair{
 			AccessToken:  access,
 			RefreshToken: newPair.Plain,
@@ -377,6 +409,7 @@ func Refresh(db *gorm.DB) http.HandlerFunc {
 //	@Router		/auth/logout [post]
 func Logout(db *gorm.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		cfg, _ := config.Load()
 		var req dto.LogoutRequest
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			utils.WriteError(w, 400, "invalid_json", err.Error())
@@ -385,12 +418,30 @@ func Logout(db *gorm.DB) http.HandlerFunc {
 		rec, err := auth.ValidateRefreshToken(db, req.RefreshToken)
 		if err != nil {
 			w.WriteHeader(204) // already invalid/revoked
-			return
+			goto clearCookie
 		}
 		if err := auth.RevokeFamily(db, rec.FamilyID); err != nil {
 			utils.WriteError(w, 500, "revoke_failed", err.Error())
 			return
 		}
+
+	clearCookie:
+		secure := true
+		if uParsed, err := url.Parse(cfg.OAuthRedirectBase); err == nil && isLocalDev(uParsed) {
+			secure = false
+		}
+
+		http.SetCookie(w, &http.Cookie{
+			Name:     "ag_jwt",
+			Value:    "",
+			Path:     "/",
+			HttpOnly: true,
+			MaxAge:   -1,
+			Expires:  time.Unix(0, 0),
+			SameSite: http.SameSiteLaxMode,
+			Secure:   secure,
+		})
+
 		w.WriteHeader(204)
 	}
 }
@@ -461,21 +512,63 @@ func ensureAutoMembership(db *gorm.DB, userID uuid.UUID, email string) error {
 	}).Error
 }
 
+// postMessage HTML template
+var postMessageTpl = template.Must(template.New("postmsg").Parse(`<!doctype html>
+<html>
+  <body>
+    <script>
+      (function(){
+        try {
+          var data = JSON.parse(atob("{{.PayloadB64}}"));
+          if (window.opener) {
+            window.opener.postMessage(
+              { type: 'autoglue:auth', payload: data },
+              "{{.Origin}}"
+            );
+          }
+        } catch (e) {}
+        window.close();
+      })();
+    </script>
+  </body>
+</html>`))
+
+type postMessageData struct {
+	Origin     string
+	PayloadB64 string
+}
+
 // writePostMessageHTML sends a tiny HTML page that posts tokens to the SPA and closes the window.
 func writePostMessageHTML(w http.ResponseWriter, origin string, payload dto.TokenPair) {
 	b, _ := json.Marshal(payload)
+
+	data := postMessageData{
+		Origin:     origin,
+		PayloadB64: base64.StdEncoding.EncodeToString(b),
+	}
+
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
-	_, _ = w.Write([]byte(`<!doctype html><html><body><script>
-(function(){
-  try {
-    var data = ` + string(b) + `;
-    if (window.opener) {
-      window.opener.postMessage({ type: 'autoglue:auth', payload: data }, '` + origin + `');
-    }
-  } catch (e) {}
-  window.close();
-})();
-</script></body></html>`))
+	_ = postMessageTpl.Execute(w, data)
+}
+
+// canonicalOrigin returns scheme://host[:port] for a given URL, or "" if invalid.
+func canonicalOrigin(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil || u.Scheme == "" || u.Host == "" {
+		return ""
+	}
+
+	// Normalize: no path/query/fragment — just the origin.
+	return (&url.URL{
+		Scheme: u.Scheme,
+		Host:   u.Host,
+	}).String()
+}
+
+func isLocalDev(u *url.URL) bool {
+	host := strings.ToLower(u.Hostname())
+	return u.Scheme == "http" &&
+		(host == "localhost" || host == "127.0.0.1")
 }

internal/handlers/credentials.go

@@ -0,0 +1,564 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"sort"
+	"time"
+
+	"github.com/glueops/autoglue/internal/api/httpmiddleware"
+	"github.com/glueops/autoglue/internal/handlers/dto"
+	"github.com/glueops/autoglue/internal/models"
+	"github.com/glueops/autoglue/internal/utils"
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"gorm.io/datatypes"
+	"gorm.io/gorm"
+)
+
+// ListCredentials godoc
+//
+//	@ID				ListCredentials
+//	@Summary		List credentials (metadata only)
+//	@Description	Returns credential metadata for the current org. Secrets are never returned.
+//	@Tags			Credentials
+//	@Produce		json
+//	@Param			X-Org-ID	header		string	false	"Organization ID (UUID)"
+//	@Param			provider	query		string	false	"Filter by provider (e.g., aws)"
+//	@Param			kind		query		string	false	"Filter by kind (e.g., aws_access_key)"
+//	@Param			scope_kind	query		string	false	"Filter by scope kind (provider/service/resource)"
+//	@Success		200			{array}		dto.CredentialOut
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"internal server error"
+//	@Router			/credentials [get]
+//	@Security		BearerAuth
+//	@Security		OrgKeyAuth
+//	@Security		OrgSecretAuth
+func ListCredentials(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		q := db.Where("organization_id = ?", orgID)
+		if v := r.URL.Query().Get("provider"); v != "" {
+			q = q.Where("provider = ?", v)
+		}
+		if v := r.URL.Query().Get("kind"); v != "" {
+			q = q.Where("kind = ?", v)
+		}
+		if v := r.URL.Query().Get("scope_kind"); v != "" {
+			q = q.Where("scope_kind = ?", v)
+		}
+
+		var rows []models.Credential
+		if err := q.Order("updated_at DESC").Find(&rows).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		out := make([]dto.CredentialOut, 0, len(rows))
+		for i := range rows {
+			out = append(out, credOut(&rows[i]))
+		}
+		utils.WriteJSON(w, http.StatusOK, out)
+	}
+}
+
+// GetCredential godoc
+//
+//	@ID			GetCredential
+//	@Summary	Get credential by ID (metadata only)
+//	@Tags		Credentials
+//	@Produce	json
+//	@Param		X-Org-ID	header		string	false	"Organization ID (UUID)"
+//	@Param		id			path		string	true	"Credential ID (UUID)"
+//	@Success	200			{object}	dto.CredentialOut
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	500			{string}	string	"internal server error"
+//	@Router		/credentials/{id} [get]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func GetCredential(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		idStr := chi.URLParam(r, "id")
+		id, err := uuid.Parse(idStr)
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+
+		var row models.Credential
+		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusOK, credOut(&row))
+	}
+}
+
+// CreateCredential godoc
+//
+//	@ID			CreateCredential
+//	@Summary	Create a credential (encrypts secret)
+//	@Tags		Credentials
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string						false	"Organization ID (UUID)"
+//	@Param		body		body		dto.CreateCredentialRequest	true	"Credential payload"
+//	@Success	201			{object}	dto.CredentialOut
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	500			{string}	string	"internal server error"
+//	@Router		/credentials [post]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func CreateCredential(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		var in dto.CreateCredentialRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+
+		if err := dto.Validate.Struct(in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
+			return
+		}
+
+		cred, err := SaveCredentialWithScope(
+			r.Context(), db, orgID,
+			in.Provider, in.Kind, in.SchemaVersion,
+			in.ScopeKind, in.ScopeVersion, json.RawMessage(in.Scope), json.RawMessage(in.Secret),
+			in.Name, in.AccountID, in.Region,
+		)
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "save_failed", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusCreated, credOut(cred))
+	}
+}
+
+// UpdateCredential godoc
+//
+//	@ID			UpdateCredential
+//	@Summary	Update credential metadata and/or rotate secret
+//	@Tags		Credentials
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string						false	"Organization ID (UUID)"
+//	@Param		id			path		string						true	"Credential ID (UUID)"
+//	@Param		body		body		dto.UpdateCredentialRequest	true	"Fields to update"
+//	@Success	200			{object}	dto.CredentialOut
+//	@Failure	403			{string}	string	"X-Org-ID required"
+//	@Failure	404			{string}	string	"not found"
+//	@Router		/credentials/{id} [patch]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func UpdateCredential(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+
+		var row models.Credential
+		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+
+		var in dto.UpdateCredentialRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+
+		// Update metadata
+		if in.Name != nil {
+			row.Name = *in.Name
+		}
+		if in.AccountID != nil {
+			row.AccountID = *in.AccountID
+		}
+		if in.Region != nil {
+			row.Region = *in.Region
+		}
+
+		// Update scope (re-validate + fingerprint)
+		if in.ScopeKind != nil || in.Scope != nil || in.ScopeVersion != nil {
+			newKind := row.ScopeKind
+			if in.ScopeKind != nil {
+				newKind = *in.ScopeKind
+			}
+			newVersion := row.ScopeVersion
+			if in.ScopeVersion != nil {
+				newVersion = *in.ScopeVersion
+			}
+			if in.Scope == nil {
+				utils.WriteError(w, http.StatusBadRequest, "validation_error", "scope must be provided when changing scope kind/version")
+				return
+			}
+			prScopes := dto.ScopeRegistry[row.Provider]
+			kScopes := prScopes[newKind]
+			sdef := kScopes[newVersion]
+			dst := sdef.New()
+			if err := json.Unmarshal(*in.Scope, dst); err != nil {
+				utils.WriteError(w, http.StatusBadRequest, "invalid_scope_json", err.Error())
+				return
+			}
+			if err := sdef.Validate(dst); err != nil {
+				utils.WriteError(w, http.StatusBadRequest, "invalid_scope", err.Error())
+				return
+			}
+			canonScope, err := canonicalJSON(dst)
+			if err != nil {
+				utils.WriteError(w, http.StatusInternalServerError, "canon_error", err.Error())
+				return
+			}
+			row.Scope = canonScope
+			row.ScopeKind = newKind
+			row.ScopeVersion = newVersion
+			row.ScopeFingerprint = sha256Hex(canonScope)
+		}
+
+		// Rotate secret
+		if in.Secret != nil {
+			// validate against current Provider/Kind/SchemaVersion
+			def := dto.CredentialRegistry[row.Provider][row.Kind][row.SchemaVersion]
+			dst := def.New()
+			if err := json.Unmarshal(*in.Secret, dst); err != nil {
+				utils.WriteError(w, http.StatusBadRequest, "invalid_secret_json", err.Error())
+				return
+			}
+			if err := def.Validate(dst); err != nil {
+				utils.WriteError(w, http.StatusBadRequest, "invalid_secret", err.Error())
+				return
+			}
+			canonSecret, err := canonicalJSON(dst)
+			if err != nil {
+				utils.WriteError(w, http.StatusInternalServerError, "canon_error", err.Error())
+				return
+			}
+			cipher, iv, tag, err := utils.EncryptForOrg(orgID, canonSecret, db)
+			if err != nil {
+				utils.WriteError(w, http.StatusInternalServerError, "encrypt_error", err.Error())
+				return
+			}
+			row.EncryptedData = cipher
+			row.IV = iv
+			row.Tag = tag
+		}
+
+		if err := db.Save(&row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusOK, credOut(&row))
+	}
+}
+
+// DeleteCredential godoc
+//
+//	@ID			DeleteCredential
+//	@Summary	Delete credential
+//	@Tags		Credentials
+//	@Produce	json
+//	@Param		X-Org-ID	header	string	false	"Organization ID (UUID)"
+//	@Param		id			path	string	true	"Credential ID (UUID)"
+//	@Success	204
+//	@Failure	404	{string}	string	"not found"
+//	@Router		/credentials/{id} [delete]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func DeleteCredential(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+		res := db.Where("organization_id = ? AND id = ?", orgID, id).Delete(&models.Credential{})
+		if res.Error != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", res.Error.Error())
+			return
+		}
+		if res.RowsAffected == 0 {
+			utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// RevealCredential godoc
+//
+//	@ID			RevealCredential
+//	@Summary	Reveal decrypted secret (one-time read)
+//	@Tags		Credentials
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string	false	"Organization ID (UUID)"
+//	@Param		id			path		string	true	"Credential ID (UUID)"
+//	@Success	200			{object}	map[string]any
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Router		/credentials/{id}/reveal [post]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func RevealCredential(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+
+		var row models.Credential
+		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "credential not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+
+		plain, err := utils.DecryptForOrg(orgID, row.EncryptedData, row.IV, row.Tag, db)
+		if err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "decrypt_error", err.Error())
+			return
+		}
+
+		utils.WriteJSON(w, http.StatusOK, plain)
+	}
+}
+
+// -- Helpers
+
+func canonicalJSON(v any) ([]byte, error) {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	var m any
+	if err := json.Unmarshal(b, &m); err != nil {
+		return nil, err
+	}
+	return marshalSorted(m)
+}
+
+func marshalSorted(v any) ([]byte, error) {
+	switch vv := v.(type) {
+	case map[string]any:
+		keys := make([]string, 0, len(vv))
+		for k := range vv {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		buf := bytes.NewBufferString("{")
+		for i, k := range keys {
+			if i > 0 {
+				buf.WriteByte(',')
+			}
+			kb, _ := json.Marshal(k)
+			buf.Write(kb)
+			buf.WriteByte(':')
+			b, err := marshalSorted(vv[k])
+			if err != nil {
+				return nil, err
+			}
+			buf.Write(b)
+		}
+		buf.WriteByte('}')
+		return buf.Bytes(), nil
+	case []any:
+		buf := bytes.NewBufferString("[")
+		for i, e := range vv {
+			if i > 0 {
+				buf.WriteByte(',')
+			}
+			b, err := marshalSorted(e)
+			if err != nil {
+				return nil, err
+			}
+			buf.Write(b)
+		}
+		buf.WriteByte(']')
+		return buf.Bytes(), nil
+	default:
+		return json.Marshal(v)
+	}
+}
+
+func sha256Hex(b []byte) string {
+	sum := sha256.Sum256(b)
+	return hex.EncodeToString(sum[:])
+}
+
+// SaveCredentialWithScope validates secret+scope, encrypts, fingerprints, and stores.
+func SaveCredentialWithScope(
+	ctx context.Context,
+	db *gorm.DB,
+	orgID uuid.UUID,
+	provider, kind string,
+	schemaVersion int,
+	scopeKind string,
+	scopeVersion int,
+	rawScope json.RawMessage,
+	rawSecret json.RawMessage,
+	name, accountID, region string,
+) (*models.Credential, error) {
+	// 1) secret shape
+	pv, ok := dto.CredentialRegistry[provider]
+	if !ok {
+		return nil, fmt.Errorf("unknown provider %q", provider)
+	}
+	kv, ok := pv[kind]
+	if !ok {
+		return nil, fmt.Errorf("unknown kind %q for provider %q", kind, provider)
+	}
+	def, ok := kv[schemaVersion]
+	if !ok {
+		return nil, fmt.Errorf("unsupported schema version %d for %s/%s", schemaVersion, provider, kind)
+	}
+
+	secretDst := def.New()
+	if err := json.Unmarshal(rawSecret, secretDst); err != nil {
+		return nil, fmt.Errorf("payload is not valid JSON for %s/%s: %w", provider, kind, err)
+	}
+	if err := def.Validate(secretDst); err != nil {
+		return nil, fmt.Errorf("invalid %s/%s: %w", provider, kind, err)
+	}
+
+	// 2) scope shape
+	prScopes, ok := dto.ScopeRegistry[provider]
+	if !ok {
+		return nil, fmt.Errorf("no scopes registered for provider %q", provider)
+	}
+	kScopes, ok := prScopes[scopeKind]
+	if !ok {
+		return nil, fmt.Errorf("invalid scope_kind %q for provider %q", scopeKind, provider)
+	}
+	sdef, ok := kScopes[scopeVersion]
+	if !ok {
+		return nil, fmt.Errorf("unsupported scope version %d for %s/%s", scopeVersion, provider, scopeKind)
+	}
+
+	scopeDst := sdef.New()
+	if err := json.Unmarshal(rawScope, scopeDst); err != nil {
+		return nil, fmt.Errorf("invalid scope JSON: %w", err)
+	}
+	if err := sdef.Validate(scopeDst); err != nil {
+		return nil, fmt.Errorf("invalid scope: %w", err)
+	}
+
+	// 3) canonicalize scope (also what we persist in plaintext)
+	canonScope, err := canonicalJSON(scopeDst)
+	if err != nil {
+		return nil, err
+	}
+	fp := sha256Hex(canonScope) // or HMAC if you have a server-side key
+
+	// 4) canonicalize + encrypt secret
+	canonSecret, err := canonicalJSON(secretDst)
+	if err != nil {
+		return nil, err
+	}
+	cipher, iv, tag, err := utils.EncryptForOrg(orgID, canonSecret, db)
+	if err != nil {
+		return nil, fmt.Errorf("encrypt: %w", err)
+	}
+
+	cred := &models.Credential{
+		OrganizationID:   orgID,
+		Provider:         provider,
+		Kind:             kind,
+		SchemaVersion:    schemaVersion,
+		Name:             name,
+		ScopeKind:        scopeKind,
+		Scope:            datatypes.JSON(canonScope),
+		ScopeVersion:     scopeVersion,
+		AccountID:        accountID,
+		Region:           region,
+		ScopeFingerprint: fp,
+		EncryptedData:    cipher,
+		IV:               iv,
+		Tag:              tag,
+	}
+
+	if err := db.WithContext(ctx).Create(cred).Error; err != nil {
+		return nil, err
+	}
+	return cred, nil
+}
+
+// credOut converts model → response DTO
+func credOut(c *models.Credential) dto.CredentialOut {
+	return dto.CredentialOut{
+		ID:            c.ID.String(),
+		Provider:      c.Provider,
+		Kind:          c.Kind,
+		SchemaVersion: c.SchemaVersion,
+		Name:          c.Name,
+		ScopeKind:     c.ScopeKind,
+		ScopeVersion:  c.ScopeVersion,
+		Scope:         dto.RawJSON(c.Scope),
+		AccountID:     c.AccountID,
+		Region:        c.Region,
+		CreatedAt:     c.CreatedAt.UTC().Format(time.RFC3339),
+		UpdatedAt:     c.UpdatedAt.UTC().Format(time.RFC3339),
+	}
+}

internal/handlers/dns.go

@@ -0,0 +1,797 @@
+package handlers
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/glueops/autoglue/internal/api/httpmiddleware"
+	"github.com/glueops/autoglue/internal/handlers/dto"
+	"github.com/glueops/autoglue/internal/models"
+	"github.com/glueops/autoglue/internal/utils"
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/rs/zerolog/log"
+	"gorm.io/datatypes"
+	"gorm.io/gorm"
+)
+
+// ---------- Helpers ----------
+
+func normLowerNoDot(s string) string {
+	s = strings.TrimSpace(strings.ToLower(s))
+	return strings.TrimSuffix(s, ".")
+}
+
+func fqdn(domain string, rel string) string {
+	d := normLowerNoDot(domain)
+	r := normLowerNoDot(rel)
+	if r == "" || r == "@" {
+		return d
+	}
+	return r + "." + d
+}
+
+func canonicalJSONAny(v any) ([]byte, error) {
+	b, err := json.Marshal(v)
+	if err != nil {
+		return nil, err
+	}
+	var anyv any
+	if err := json.Unmarshal(b, &anyv); err != nil {
+		return nil, err
+	}
+	return marshalSortedDNS(anyv)
+}
+
+func marshalSortedDNS(v any) ([]byte, error) {
+	switch vv := v.(type) {
+	case map[string]any:
+		keys := make([]string, 0, len(vv))
+		for k := range vv {
+			keys = append(keys, k)
+		}
+		sortStrings(keys)
+		var buf bytes.Buffer
+		buf.WriteByte('{')
+		for i, k := range keys {
+			if i > 0 {
+				buf.WriteByte(',')
+			}
+			kb, _ := json.Marshal(k)
+			buf.Write(kb)
+			buf.WriteByte(':')
+			b, err := marshalSortedDNS(vv[k])
+			if err != nil {
+				return nil, err
+			}
+			buf.Write(b)
+		}
+		buf.WriteByte('}')
+		return buf.Bytes(), nil
+	case []any:
+		var buf bytes.Buffer
+		buf.WriteByte('[')
+		for i, e := range vv {
+			if i > 0 {
+				buf.WriteByte(',')
+			}
+			b, err := marshalSortedDNS(e)
+			if err != nil {
+				return nil, err
+			}
+			buf.Write(b)
+		}
+		buf.WriteByte(']')
+		return buf.Bytes(), nil
+	default:
+		return json.Marshal(v)
+	}
+}
+
+func sortStrings(a []string) {
+	for i := 0; i < len(a); i++ {
+		for j := i + 1; j < len(a); j++ {
+			if a[j] < a[i] {
+				a[i], a[j] = a[j], a[i]
+			}
+		}
+	}
+}
+
+func sha256HexBytes(b []byte) string {
+	sum := sha256.Sum256(b)
+	return hex.EncodeToString(sum[:])
+}
+
+/* Fingerprint (provider-agnostic) */
+type desiredRecord struct {
+	ZoneID string   `json:"zone_id"`
+	FQDN   string   `json:"fqdn"`
+	Type   string   `json:"type"`
+	TTL    *int     `json:"ttl,omitempty"`
+	Values []string `json:"values,omitempty"`
+}
+
+func computeFingerprint(zoneID, fqdn, typ string, ttl *int, values datatypes.JSON) (string, error) {
+	var vals []string
+	if len(values) > 0 && string(values) != "null" {
+		if err := json.Unmarshal(values, &vals); err != nil {
+			return "", err
+		}
+		sortStrings(vals)
+	}
+	payload := &desiredRecord{
+		ZoneID: zoneID, FQDN: fqdn, Type: strings.ToUpper(typ), TTL: ttl, Values: vals,
+	}
+	can, err := canonicalJSONAny(payload)
+	if err != nil {
+		return "", err
+	}
+	return sha256HexBytes(can), nil
+}
+
+func mustSameOrgDomainWithCredential(db *gorm.DB, orgID uuid.UUID, credID uuid.UUID) error {
+	var cred models.Credential
+	if err := db.Where("id = ? AND organization_id = ?", credID, orgID).First(&cred).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return fmt.Errorf("credential not found or belongs to different org")
+		}
+		return err
+	}
+	if cred.Provider != "aws" || cred.ScopeKind != "service" {
+		return fmt.Errorf("credential must be AWS Route 53 service scoped")
+	}
+	var scope map[string]any
+	if err := json.Unmarshal(cred.Scope, &scope); err != nil {
+		return fmt.Errorf("credential scope invalid json: %w", err)
+	}
+	if strings.ToLower(fmt.Sprint(scope["service"])) != "route53" {
+		return fmt.Errorf("credential scope.service must be route53")
+	}
+	return nil
+}
+
+// ---------- Domain Handlers ----------
+
+// ListDomains godoc
+//
+//	@ID				ListDomains
+//	@Summary		List domains (org scoped)
+//	@Description	Returns domains for X-Org-ID. Filters: `domain_name`, `status`, `q` (contains).
+//	@Tags			DNS
+//	@Produce		json
+//	@Param			X-Org-ID	header		string	false	"Organization UUID"
+//	@Param			domain_name	query		string	false	"Exact domain name (lowercase, no trailing dot)"
+//	@Param			status		query		string	false	"pending|provisioning|ready|failed"
+//	@Param			q			query		string	false	"Domain contains (case-insensitive)"
+//	@Success		200			{array}		dto.DomainResponse
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"db error"
+//	@Router			/dns/domains [get]
+//	@Security		BearerAuth
+//	@Security		OrgKeyAuth
+//	@Security		OrgSecretAuth
+func ListDomains(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		q := db.Model(&models.Domain{}).Where("organization_id = ?", orgID)
+		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("domain_name"))); v != "" {
+			q = q.Where("LOWER(domain_name) = ?", v)
+		}
+		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("status"))); v != "" {
+			q = q.Where("status = ?", v)
+		}
+		if needle := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("q"))); needle != "" {
+			q = q.Where("LOWER(domain_name) LIKE ?", "%"+needle+"%")
+		}
+
+		var rows []models.Domain
+		if err := q.Order("created_at DESC").Find(&rows).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
+			return
+		}
+		out := make([]dto.DomainResponse, 0, len(rows))
+		for i := range rows {
+			out = append(out, domainOut(&rows[i]))
+		}
+		utils.WriteJSON(w, http.StatusOK, out)
+	}
+}
+
+// GetDomain godoc
+//
+//	@ID			GetDomain
+//	@Summary	Get a domain (org scoped)
+//	@Tags		DNS
+//	@Produce	json
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Domain ID (UUID)"
+//	@Success	200			{object}	dto.DomainResponse
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Router		/dns/domains/{id} [get]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func GetDomain(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+		var row models.Domain
+		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
+			return
+		}
+		utils.WriteJSON(w, http.StatusOK, domainOut(&row))
+	}
+}
+
+// CreateDomain godoc
+//
+//	@ID				CreateDomain
+//	@Summary		Create a domain (org scoped)
+//	@Description	Creates a domain bound to a Route 53 scoped credential. Archer will backfill ZoneID if omitted.
+//	@Tags			DNS
+//	@Accept			json
+//	@Produce		json
+//	@Param			X-Org-ID	header		string					false	"Organization UUID"
+//	@Param			body		body		dto.CreateDomainRequest	true	"Domain payload"
+//	@Success		201			{object}	dto.DomainResponse
+//	@Failure		400			{string}	string	"validation error"
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"db error"
+//	@Router			/dns/domains [post]
+//	@Security		BearerAuth
+//	@Security		OrgKeyAuth
+//	@Security		OrgSecretAuth
+func CreateDomain(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		var in dto.CreateDomainRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+		if err := dto.DNSValidate(in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
+			return
+		}
+		credID, _ := uuid.Parse(in.CredentialID)
+		if err := mustSameOrgDomainWithCredential(db, orgID, credID); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "invalid_credential", err.Error())
+			return
+		}
+
+		row := &models.Domain{
+			OrganizationID: orgID,
+			DomainName:     normLowerNoDot(in.DomainName),
+			ZoneID:         strings.TrimSpace(in.ZoneID),
+			Status:         "pending",
+			LastError:      "",
+			CredentialID:   credID,
+		}
+		if err := db.Create(row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusCreated, domainOut(row))
+	}
+}
+
+// UpdateDomain godoc
+//
+//	@ID			UpdateDomain
+//	@Summary	Update a domain (org scoped)
+//	@Tags		DNS
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string					false	"Organization UUID"
+//	@Param		id			path		string					true	"Domain ID (UUID)"
+//	@Param		body		body		dto.UpdateDomainRequest	true	"Fields to update"
+//	@Success	200			{object}	dto.DomainResponse
+//	@Failure	400			{string}	string	"validation error"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Router		/dns/domains/{id} [patch]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func UpdateDomain(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+		var row models.Domain
+		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		var in dto.UpdateDomainRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+		if err := dto.DNSValidate(in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
+			return
+		}
+		if in.DomainName != nil {
+			row.DomainName = normLowerNoDot(*in.DomainName)
+		}
+		if in.CredentialID != nil {
+			credID, _ := uuid.Parse(*in.CredentialID)
+			if err := mustSameOrgDomainWithCredential(db, orgID, credID); err != nil {
+				utils.WriteError(w, http.StatusBadRequest, "invalid_credential", err.Error())
+				return
+			}
+			row.CredentialID = credID
+			row.Status = "pending"
+			row.LastError = ""
+		}
+		if in.ZoneID != nil {
+			row.ZoneID = strings.TrimSpace(*in.ZoneID)
+		}
+		if in.Status != nil {
+			row.Status = *in.Status
+			if row.Status == "pending" {
+				row.LastError = ""
+			}
+		}
+		if err := db.Save(&row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusOK, domainOut(&row))
+	}
+}
+
+// DeleteDomain godoc
+//
+//	@ID			DeleteDomain
+//	@Summary	Delete a domain
+//	@Tags		DNS
+//	@Produce	json
+//	@Param		X-Org-ID	header	string	false	"Organization UUID"
+//	@Param		id			path	string	true	"Domain ID (UUID)"
+//	@Success	204
+//	@Failure	403	{string}	string	"organization required"
+//	@Failure	404	{string}	string	"not found"
+//	@Router		/dns/domains/{id} [delete]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func DeleteDomain(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+		res := db.Where("organization_id = ? AND id = ?", orgID, id).Delete(&models.Domain{})
+		if res.Error != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", res.Error.Error())
+			return
+		}
+		if res.RowsAffected == 0 {
+			utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// ---------- Record Set Handlers ----------
+
+// ListRecordSets godoc
+//
+//	@ID				ListRecordSets
+//	@Summary		List record sets for a domain
+//	@Description	Filters: `name`, `type`, `status`.
+//	@Tags			DNS
+//	@Produce		json
+//	@Param			X-Org-ID	header		string	false	"Organization UUID"
+//	@Param			domain_id	path		string	true	"Domain ID (UUID)"
+//	@Param			name		query		string	false	"Exact relative name or FQDN (server normalizes)"
+//	@Param			type		query		string	false	"RR type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
+//	@Param			status		query		string	false	"pending|provisioning|ready|failed"
+//	@Success		200			{array}		dto.RecordSetResponse
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		404			{string}	string	"domain not found"
+//	@Router			/dns/domains/{domain_id}/records [get]
+//	@Security		BearerAuth
+//	@Security		OrgKeyAuth
+//	@Security		OrgSecretAuth
+func ListRecordSets(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		did, err := uuid.Parse(chi.URLParam(r, "domain_id"))
+		if err != nil {
+			log.Info().Msg(err.Error())
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid domain UUID:")
+			return
+		}
+		var domain models.Domain
+		if err := db.Where("organization_id = ? AND id = ?", orgID, did).First(&domain).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
+			return
+		}
+
+		q := db.Model(&models.RecordSet{}).Where("domain_id = ?", did)
+		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("name"))); v != "" {
+			dn := strings.ToLower(domain.DomainName)
+			rel := v
+			// normalize apex or FQDN into relative
+			if v == dn || v == dn+"." {
+				rel = ""
+			} else {
+				rel = strings.TrimSuffix(v, "."+dn)
+				rel = normLowerNoDot(rel)
+			}
+			q = q.Where("LOWER(name) = ?", rel)
+		}
+		if v := strings.TrimSpace(strings.ToUpper(r.URL.Query().Get("type"))); v != "" {
+			q = q.Where("type = ?", v)
+		}
+		if v := strings.TrimSpace(strings.ToLower(r.URL.Query().Get("status"))); v != "" {
+			q = q.Where("status = ?", v)
+		}
+
+		var rows []models.RecordSet
+		if err := q.Order("created_at DESC").Find(&rows).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
+			return
+		}
+		out := make([]dto.RecordSetResponse, 0, len(rows))
+		for i := range rows {
+			out = append(out, recordOut(&rows[i]))
+		}
+		utils.WriteJSON(w, http.StatusOK, out)
+	}
+}
+
+// CreateRecordSet godoc
+//
+//	@ID			CreateRecordSet
+//	@Summary	Create a record set (pending; Archer will UPSERT to Route 53)
+//	@Tags		DNS
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string						false	"Organization UUID"
+//	@Param		domain_id	path		string						true	"Domain ID (UUID)"
+//	@Param		body		body		dto.CreateRecordSetRequest	true	"Record set payload"
+//	@Success	201			{object}	dto.RecordSetResponse
+//	@Failure	400			{string}	string	"validation error"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"domain not found"
+//	@Router		/dns/domains/{domain_id}/records [post]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func CreateRecordSet(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		did, err := uuid.Parse(chi.URLParam(r, "domain_id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid domain UUID")
+			return
+		}
+		var domain models.Domain
+		if err := db.Where("organization_id = ? AND id = ?", orgID, did).First(&domain).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "domain not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+
+		var in dto.CreateRecordSetRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+		if err := dto.DNSValidate(in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
+			return
+		}
+		t := strings.ToUpper(in.Type)
+		if t == "CNAME" && len(in.Values) != 1 {
+			utils.WriteError(w, http.StatusBadRequest, "validation_error", "CNAME requires exactly one value")
+			return
+		}
+
+		rel := normLowerNoDot(in.Name)
+		fq := fqdn(domain.DomainName, rel)
+
+		// Pre-flight: block duplicate tuple and protect from non-autoglue rows
+		var existing models.RecordSet
+		if err := db.Where("domain_id = ? AND LOWER(name) = ? AND type = ?",
+			domain.ID, strings.ToLower(rel), t).First(&existing).Error; err == nil {
+			if existing.Owner != "" && existing.Owner != "autoglue" {
+				utils.WriteError(w, http.StatusConflict, "ownership_conflict",
+					"record with the same (name,type) exists but is not owned by autoglue")
+				return
+			}
+			utils.WriteError(w, http.StatusConflict, "already_exists",
+				"a record with the same (name,type) already exists; use PATCH to modify")
+			return
+		} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+
+		valuesJSON, _ := json.Marshal(in.Values)
+		fp, err := computeFingerprint(domain.ZoneID, fq, t, in.TTL, datatypes.JSON(valuesJSON))
+		if err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "fingerprint_error", err.Error())
+			return
+		}
+
+		row := &models.RecordSet{
+			DomainID:    domain.ID,
+			Name:        rel,
+			Type:        t,
+			TTL:         in.TTL,
+			Values:      datatypes.JSON(valuesJSON),
+			Fingerprint: fp,
+			Status:      "pending",
+			LastError:   "",
+			Owner:       "autoglue",
+		}
+		if err := db.Create(row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusCreated, recordOut(row))
+	}
+}
+
+// UpdateRecordSet godoc
+//
+//	@ID			UpdateRecordSet
+//	@Summary	Update a record set (flips to pending for reconciliation)
+//	@Tags		DNS
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string						false	"Organization UUID"
+//	@Param		id			path		string						true	"Record Set ID (UUID)"
+//	@Param		body		body		dto.UpdateRecordSetRequest	true	"Fields to update"
+//	@Success	200			{object}	dto.RecordSetResponse
+//	@Failure	400			{string}	string	"validation error"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Router		/dns/records/{id} [patch]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func UpdateRecordSet(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+
+		var row models.RecordSet
+		if err := db.
+			Joins("Domain").
+			Where(`record_sets.id = ? AND "Domain"."organization_id" = ?`, id, orgID).
+			First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "record set not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		var domain models.Domain
+		if err := db.Where("id = ?", row.DomainID).First(&domain).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+
+		var in dto.UpdateRecordSetRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+		if err := dto.DNSValidate(in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "validation_error", err.Error())
+			return
+		}
+		if row.Owner != "" && row.Owner != "autoglue" {
+			utils.WriteError(w, http.StatusConflict, "ownership_conflict",
+				"record is not owned by autoglue; refuse to modify")
+			return
+		}
+
+		// Mutations
+		if in.Name != nil {
+			row.Name = normLowerNoDot(*in.Name)
+		}
+		if in.Type != nil {
+			row.Type = strings.ToUpper(*in.Type)
+		}
+		if in.TTL != nil {
+			row.TTL = in.TTL
+		}
+		if in.Values != nil {
+			t := row.Type
+			if in.Type != nil {
+				t = strings.ToUpper(*in.Type)
+			}
+			if t == "CNAME" && len(*in.Values) != 1 {
+				utils.WriteError(w, http.StatusBadRequest, "validation_error", "CNAME requires exactly one value")
+				return
+			}
+			b, _ := json.Marshal(*in.Values)
+			row.Values = datatypes.JSON(b)
+		}
+
+		if in.Status != nil {
+			row.Status = *in.Status
+		} else {
+			row.Status = "pending"
+			row.LastError = ""
+		}
+
+		fq := fqdn(domain.DomainName, row.Name)
+		fp, err := computeFingerprint(domain.ZoneID, fq, row.Type, row.TTL, row.Values)
+		if err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "fingerprint_error", err.Error())
+			return
+		}
+		row.Fingerprint = fp
+
+		if err := db.Save(&row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusOK, recordOut(&row))
+	}
+}
+
+// DeleteRecordSet godoc
+//
+//	@ID			DeleteRecordSet
+//	@Summary	Delete a record set (API removes row; worker can optionally handle external deletion policy)
+//	@Tags		DNS
+//	@Produce	json
+//	@Param		X-Org-ID	header	string	false	"Organization UUID"
+//	@Param		id			path	string	true	"Record Set ID (UUID)"
+//	@Success	204
+//	@Failure	403	{string}	string	"organization required"
+//	@Failure	404	{string}	string	"not found"
+//	@Router		/dns/records/{id} [delete]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func DeleteRecordSet(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+		sub := db.Model(&models.RecordSet{}).
+			Select("record_sets.id").
+			Joins("JOIN domains ON domains.id = record_sets.domain_id").
+			Where("record_sets.id = ? AND domains.organization_id = ?", id, orgID)
+
+		res := db.Where("id IN (?)", sub).Delete(&models.RecordSet{})
+		if res.Error != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", res.Error.Error())
+			return
+		}
+		if res.RowsAffected == 0 {
+			utils.WriteError(w, http.StatusNotFound, "not_found", "record set not found")
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// ---------- Out mappers ----------
+
+func domainOut(m *models.Domain) dto.DomainResponse {
+	return dto.DomainResponse{
+		ID:             m.ID.String(),
+		OrganizationID: m.OrganizationID.String(),
+		DomainName:     m.DomainName,
+		ZoneID:         m.ZoneID,
+		Status:         m.Status,
+		LastError:      m.LastError,
+		CredentialID:   m.CredentialID.String(),
+		CreatedAt:      m.CreatedAt.UTC().Format(time.RFC3339),
+		UpdatedAt:      m.UpdatedAt.UTC().Format(time.RFC3339),
+	}
+}
+
+func recordOut(r *models.RecordSet) dto.RecordSetResponse {
+	vals := r.Values
+	if len(vals) == 0 {
+		vals = datatypes.JSON("[]")
+	}
+	return dto.RecordSetResponse{
+		ID:          r.ID.String(),
+		DomainID:    r.DomainID.String(),
+		Name:        r.Name,
+		Type:        r.Type,
+		TTL:         r.TTL,
+		Values:      []byte(vals),
+		Fingerprint: r.Fingerprint,
+		Status:      r.Status,
+		LastError:   r.LastError,
+		Owner:       r.Owner,
+		CreatedAt:   r.CreatedAt.UTC().Format(time.RFC3339),
+		UpdatedAt:   r.UpdatedAt.UTC().Format(time.RFC3339),
+	}
+}

internal/handlers/dto/clusters.go

@@ -0,0 +1,62 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type ClusterResponse struct {
+	ID                    uuid.UUID             `json:"id"`
+	Name                  string                `json:"name"`
+	CaptainDomain         *DomainResponse       `json:"captain_domain,omitempty"`
+	ControlPlaneRecordSet *RecordSetResponse    `json:"control_plane_record_set,omitempty"`
+	AppsLoadBalancer      *LoadBalancerResponse `json:"apps_load_balancer,omitempty"`
+	GlueOpsLoadBalancer   *LoadBalancerResponse `json:"glueops_load_balancer,omitempty"`
+	BastionServer         *ServerResponse       `json:"bastion_server,omitempty"`
+	Provider              string                `json:"provider"`
+	Region                string                `json:"region"`
+	Status                string                `json:"status"`
+	LastError             string                `json:"last_error"`
+	RandomToken           string                `json:"random_token"`
+	CertificateKey        string                `json:"certificate_key"`
+	NodePools             []NodePoolResponse    `json:"node_pools,omitempty"`
+	CreatedAt             time.Time             `json:"created_at"`
+	UpdatedAt             time.Time             `json:"updated_at"`
+}
+
+type CreateClusterRequest struct {
+	Name     string `json:"name"`
+	Provider string `json:"provider"`
+	Region   string `json:"region"`
+}
+
+type UpdateClusterRequest struct {
+	Name     *string `json:"name,omitempty"`
+	Provider *string `json:"provider,omitempty"`
+	Region   *string `json:"region,omitempty"`
+}
+
+type AttachCaptainDomainRequest struct {
+	DomainID uuid.UUID `json:"domain_id"`
+}
+
+type AttachRecordSetRequest struct {
+	RecordSetID uuid.UUID `json:"record_set_id"`
+}
+
+type AttachLoadBalancerRequest struct {
+	LoadBalancerID uuid.UUID `json:"load_balancer_id"`
+}
+
+type AttachBastionRequest struct {
+	ServerID uuid.UUID `json:"server_id"`
+}
+
+type SetKubeconfigRequest struct {
+	Kubeconfig string `json:"kubeconfig"`
+}
+
+type AttachNodePoolRequest struct {
+	NodePoolID uuid.UUID `json:"node_pool_id"`
+}

internal/handlers/dto/credentials.go

@@ -0,0 +1,138 @@
+package dto
+
+import (
+	"encoding/json"
+
+	"github.com/go-playground/validator/v10"
+)
+
+// RawJSON is a swagger-friendly wrapper for json.RawMessage.
+type RawJSON = json.RawMessage
+
+var Validate = validator.New()
+
+func init() {
+	_ = Validate.RegisterValidation("awsarn", func(fl validator.FieldLevel) bool {
+		v := fl.Field().String()
+		return len(v) > 10 && len(v) < 2048 && len(v) >= 4 && v[:4] == "arn:"
+	})
+}
+
+/*** Shapes for secrets ***/
+
+type AWSCredential struct {
+	AccessKeyID     string `json:"access_key_id" validate:"required,alphanum,len=20"`
+	SecretAccessKey string `json:"secret_access_key" validate:"required"`
+	Region          string `json:"region" validate:"omitempty"`
+}
+
+type BasicAuth struct {
+	Username string `json:"username" validate:"required"`
+	Password string `json:"password" validate:"required"`
+}
+
+type APIToken struct {
+	Token string `json:"token" validate:"required"`
+}
+
+type OAuth2Credential struct {
+	ClientID     string `json:"client_id" validate:"required"`
+	ClientSecret string `json:"client_secret" validate:"required"`
+	RefreshToken string `json:"refresh_token" validate:"required"`
+}
+
+/*** Shapes for scopes ***/
+
+type AWSProviderScope struct{}
+
+type AWSServiceScope struct {
+	Service string `json:"service" validate:"required,oneof=route53 s3 ec2 iam rds dynamodb"`
+}
+
+type AWSResourceScope struct {
+	ARN string `json:"arn" validate:"required,awsarn"`
+}
+
+/*** Registries ***/
+
+type ProviderDef struct {
+	New      func() any
+	Validate func(any) error
+}
+
+type ScopeDef struct {
+	New         func() any
+	Validate    func(any) error
+	Specificity int // 0=provider, 1=service, 2=resource
+}
+
+// Secret shapes per provider/kind/version
+
+var CredentialRegistry = map[string]map[string]map[int]ProviderDef{
+	"aws": {
+		"aws_access_key": {
+			1: {New: func() any { return &AWSCredential{} }, Validate: func(x any) error { return Validate.Struct(x) }},
+		},
+	},
+	"cloudflare":   {"api_token": {1: {New: func() any { return &APIToken{} }, Validate: func(x any) error { return Validate.Struct(x) }}}},
+	"hetzner":      {"api_token": {1: {New: func() any { return &APIToken{} }, Validate: func(x any) error { return Validate.Struct(x) }}}},
+	"digitalocean": {"api_token": {1: {New: func() any { return &APIToken{} }, Validate: func(x any) error { return Validate.Struct(x) }}}},
+	"generic": {
+		"basic_auth": {1: {New: func() any { return &BasicAuth{} }, Validate: func(x any) error { return Validate.Struct(x) }}},
+		"oauth2":     {1: {New: func() any { return &OAuth2Credential{} }, Validate: func(x any) error { return Validate.Struct(x) }}},
+	},
+}
+
+// Scope shapes per provider/scopeKind/version
+
+var ScopeRegistry = map[string]map[string]map[int]ScopeDef{
+	"aws": {
+		"provider": {1: {New: func() any { return &AWSProviderScope{} }, Validate: func(any) error { return nil }, Specificity: 0}},
+		"service":  {1: {New: func() any { return &AWSServiceScope{} }, Validate: func(x any) error { return Validate.Struct(x) }, Specificity: 1}},
+		"resource": {1: {New: func() any { return &AWSResourceScope{} }, Validate: func(x any) error { return Validate.Struct(x) }, Specificity: 2}},
+	},
+}
+
+/*** API DTOs used by swagger ***/
+
+// CreateCredentialRequest represents the POST /credentials payload
+type CreateCredentialRequest struct {
+	Provider      string  `json:"provider" validate:"required,oneof=aws cloudflare hetzner digitalocean generic"`
+	Kind          string  `json:"kind" validate:"required"`                 // aws_access_key, api_token, basic_auth, oauth2
+	SchemaVersion int     `json:"schema_version" validate:"required,gte=1"` // secret schema version
+	Name          string  `json:"name" validate:"omitempty,max=100"`        // human label
+	ScopeKind     string  `json:"scope_kind" validate:"required,oneof=provider service resource"`
+	ScopeVersion  int     `json:"scope_version" validate:"required,gte=1"`        // scope schema version
+	Scope         RawJSON `json:"scope" validate:"required" swaggertype:"object"` // {"service":"route53"} or {"arn":"..."}
+	AccountID     string  `json:"account_id,omitempty" validate:"omitempty,max=32"`
+	Region        string  `json:"region,omitempty" validate:"omitempty,max=32"`
+	Secret        RawJSON `json:"secret" validate:"required" swaggertype:"object"` // encrypted later
+}
+
+// UpdateCredentialRequest represents PATCH /credentials/{id}
+type UpdateCredentialRequest struct {
+	Name         *string  `json:"name,omitempty"`
+	AccountID    *string  `json:"account_id,omitempty"`
+	Region       *string  `json:"region,omitempty"`
+	ScopeKind    *string  `json:"scope_kind,omitempty"`
+	ScopeVersion *int     `json:"scope_version,omitempty"`
+	Scope        *RawJSON `json:"scope,omitempty" swaggertype:"object"`
+	Secret       *RawJSON `json:"secret,omitempty" swaggertype:"object"` // set if rotating
+
+}
+
+// CredentialOut is what we return (no secrets)
+type CredentialOut struct {
+	ID            string  `json:"id"`
+	Provider      string  `json:"provider"`
+	Kind          string  `json:"kind"`
+	SchemaVersion int     `json:"schema_version"`
+	Name          string  `json:"name"`
+	ScopeKind     string  `json:"scope_kind"`
+	ScopeVersion  int     `json:"scope_version"`
+	Scope         RawJSON `json:"scope" swaggertype:"object"`
+	AccountID     string  `json:"account_id,omitempty"`
+	Region        string  `json:"region,omitempty"`
+	CreatedAt     string  `json:"created_at"`
+	UpdatedAt     string  `json:"updated_at"`
+}

internal/handlers/dto/dns.go

@@ -0,0 +1,103 @@
+package dto
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/go-playground/validator/v10"
+)
+
+var dnsValidate = validator.New()
+
+func init() {
+	_ = dnsValidate.RegisterValidation("fqdn", func(fl validator.FieldLevel) bool {
+		s := strings.TrimSpace(fl.Field().String())
+		if s == "" || len(s) > 253 {
+			return false
+		}
+		// Minimal: lower-cased, no trailing dot in our API (normalize server-side)
+		// You can add stricter checks later.
+		return !strings.HasPrefix(s, ".") && !strings.Contains(s, "..")
+	})
+	_ = dnsValidate.RegisterValidation("rrtype", func(fl validator.FieldLevel) bool {
+		switch strings.ToUpper(fl.Field().String()) {
+		case "A", "AAAA", "CNAME", "TXT", "MX", "NS", "SRV", "CAA":
+			return true
+		default:
+			return false
+		}
+	})
+}
+
+// ---- Domains ----
+
+type CreateDomainRequest struct {
+	DomainName   string `json:"domain_name" validate:"required,fqdn"`
+	CredentialID string `json:"credential_id" validate:"required,uuid4"`
+	ZoneID       string `json:"zone_id,omitempty" validate:"omitempty,max=128"`
+}
+
+type UpdateDomainRequest struct {
+	CredentialID *string `json:"credential_id,omitempty" validate:"omitempty,uuid4"`
+	ZoneID       *string `json:"zone_id,omitempty" validate:"omitempty,max=128"`
+	Status       *string `json:"status,omitempty" validate:"omitempty,oneof=pending provisioning ready failed"`
+	DomainName   *string `json:"domain_name,omitempty" validate:"omitempty,fqdn"`
+}
+
+type DomainResponse struct {
+	ID             string `json:"id"`
+	OrganizationID string `json:"organization_id"`
+	DomainName     string `json:"domain_name"`
+	ZoneID         string `json:"zone_id"`
+	Status         string `json:"status"`
+	LastError      string `json:"last_error"`
+	CredentialID   string `json:"credential_id"`
+	CreatedAt      string `json:"created_at"`
+	UpdatedAt      string `json:"updated_at"`
+}
+
+// ---- Record Sets ----
+
+type AliasTarget struct {
+	HostedZoneID         string `json:"hosted_zone_id" validate:"required"`
+	DNSName              string `json:"dns_name" validate:"required"`
+	EvaluateTargetHealth bool   `json:"evaluate_target_health"`
+}
+
+type CreateRecordSetRequest struct {
+	// Name relative to domain ("endpoint") OR FQDN ("endpoint.example.com").
+	// Server normalizes to relative.
+	Name   string   `json:"name" validate:"required,max=253"`
+	Type   string   `json:"type" validate:"required,rrtype"`
+	TTL    *int     `json:"ttl,omitempty" validate:"omitempty,gte=1,lte=86400"`
+	Values []string `json:"values" validate:"omitempty,dive,min=1,max=1024"`
+}
+
+type UpdateRecordSetRequest struct {
+	// Any change flips status back to pending (worker will UPSERT)
+	Name   *string   `json:"name,omitempty" validate:"omitempty,max=253"`
+	Type   *string   `json:"type,omitempty" validate:"omitempty,rrtype"`
+	TTL    *int      `json:"ttl,omitempty" validate:"omitempty,gte=1,lte=86400"`
+	Values *[]string `json:"values,omitempty" validate:"omitempty,dive,min=1,max=1024"`
+	Status *string   `json:"status,omitempty" validate:"omitempty,oneof=pending provisioning ready failed"`
+}
+
+type RecordSetResponse struct {
+	ID          string          `json:"id"`
+	DomainID    string          `json:"domain_id"`
+	Name        string          `json:"name"`
+	Type        string          `json:"type"`
+	TTL         *int            `json:"ttl,omitempty"`
+	Values      json.RawMessage `json:"values" swaggertype:"object"` // []string JSON
+	Fingerprint string          `json:"fingerprint"`
+	Status      string          `json:"status"`
+	LastError   string          `json:"last_error"`
+	Owner       string          `json:"owner"`
+	CreatedAt   string          `json:"created_at"`
+	UpdatedAt   string          `json:"updated_at"`
+}
+
+// DNSValidate Quick helper to validate DTOs in handlers
+func DNSValidate(i any) error {
+	return dnsValidate.Struct(i)
+}

internal/handlers/dto/jobs.go

@@ -57,6 +57,6 @@ type PageJob struct {
 type EnqueueRequest struct {
 	Queue   string          `json:"queue" example:"default"`
 	Type    string          `json:"type" example:"email.send"`
-	Payload json.RawMessage `json:"payload"`
+	Payload json.RawMessage `json:"payload" swaggertype:"object"`
 	RunAt   *time.Time      `json:"run_at" example:"2025-11-05T08:00:00Z"`
 }

internal/handlers/dto/load_balancers.go

@@ -0,0 +1,32 @@
+package dto
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type LoadBalancerResponse struct {
+	ID               uuid.UUID `json:"id"`
+	OrganizationID   uuid.UUID `json:"organization_id"`
+	Name             string    `json:"name"`
+	Kind             string    `json:"kind"`
+	PublicIPAddress  string    `json:"public_ip_address"`
+	PrivateIPAddress string    `json:"private_ip_address"`
+	CreatedAt        time.Time `json:"created_at"`
+	UpdatedAt        time.Time `json:"updated_at"`
+}
+
+type CreateLoadBalancerRequest struct {
+	Name             string `json:"name" example:"glueops"`
+	Kind             string `json:"kind" example:"public" enums:"glueops,public"`
+	PublicIPAddress  string `json:"public_ip_address" example:"8.8.8.8"`
+	PrivateIPAddress string `json:"private_ip_address" example:"192.168.0.2"`
+}
+
+type UpdateLoadBalancerRequest struct {
+	Name             *string `json:"name" example:"glue"`
+	Kind             *string `json:"kind" example:"public" enums:"glueops,public"`
+	PublicIPAddress  *string `json:"public_ip_address" example:"8.8.8.8"`
+	PrivateIPAddress *string `json:"private_ip_address" example:"192.168.0.2"`
+}

internal/handlers/health.go

@@ -16,7 +16,6 @@ type HealthStatus struct {
 //	@Description	Returns 200 OK when the service is up
 //	@Tags			Health
 //	@ID				HealthCheck               // operationId
-//	@Accept			json
 //	@Produce		json
 //	@Success		200	{object}	HealthStatus
 //	@Router			/healthz [get]

internal/handlers/jobs.go

@@ -25,7 +25,6 @@ import (
 //	@Summary		List Archer jobs (admin)
 //	@Description	Paginated background jobs with optional filters. Search `q` may match id, type, error, payload (implementation-dependent).
 //	@Tags			ArcherAdmin
-//	@Accept			json
 //	@Produce		json
 //	@Param			status		query		string	false	"Filter by status"	Enums(queued,running,succeeded,failed,canceled,retrying,scheduled)
 //	@Param			queue		query		string	false	"Filter by queue name / worker name"
@@ -283,7 +282,6 @@ func AdminCancelArcherJob(db *gorm.DB) http.HandlerFunc {
 //	@Summary		List Archer queues (admin)
 //	@Description	Summary metrics per queue (pending, running, failed, scheduled).
 //	@Tags			ArcherAdmin
-//	@Accept			json
 //	@Produce		json
 //	@Success		200	{array}		dto.QueueInfo
 //	@Failure		401	{string}	string	"Unauthorized"

internal/handlers/labels.go

@@ -22,7 +22,6 @@ import (
 //	@Summary		List node labels (org scoped)
 //	@Description	Returns node labels for the organization in X-Org-ID. Filters: `key`, `value`, and `q` (key contains). Add `include=node_pools` to include linked node groups.
 //	@Tags			Labels
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			key			query		string	false	"Exact key"
@@ -74,7 +73,6 @@ func ListLabels(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Get label by ID (org scoped)
 //	@Description	Returns one label.
 //	@Tags			Labels
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			id			path		string	true	"Label ID (UUID)"
@@ -253,11 +251,10 @@ func UpdateLabel(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Delete label (org scoped)
 //	@Description	Permanently deletes the label.
 //	@Tags			Labels
-//	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header		string	false	"Organization UUID"
-//	@Param			id			path		string	true	"Label ID (UUID)"
-//	@Success		204			{string}	string	"No Content"
+//	@Param			X-Org-ID	header	string	false	"Organization UUID"
+//	@Param			id			path	string	true	"Label ID (UUID)"
+//	@Success		204			"No Content"
 //	@Failure		400			{string}	string	"invalid id"
 //	@Failure		401			{string}	string	"Unauthorized"
 //	@Failure		403			{string}	string	"organization required"

internal/handlers/load_balancers.go

@@ -0,0 +1,286 @@
+package handlers
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/glueops/autoglue/internal/api/httpmiddleware"
+	"github.com/glueops/autoglue/internal/handlers/dto"
+	"github.com/glueops/autoglue/internal/models"
+	"github.com/glueops/autoglue/internal/utils"
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+// ListLoadBalancers godoc
+//
+//	@ID				ListLoadBalancers
+//	@Summary		List load balancers (org scoped)
+//	@Description	Returns load balancers for the organization in X-Org-ID.
+//	@Tags			LoadBalancers
+//	@Produce		json
+//	@Param			X-Org-ID	header		string	false	"Organization UUID"
+//	@Success		200			{array}		dto.LoadBalancerResponse
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"failed to list clusters"
+//	@Router			/load-balancers [get]
+//	@Security		BearerAuth
+//	@Security		OrgKeyAuth
+//	@Security		OrgSecretAuth
+func ListLoadBalancers(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		var rows []models.LoadBalancer
+		if err := db.Where("organization_id = ?", orgID).Find(&rows).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
+			return
+		}
+		out := make([]dto.LoadBalancerResponse, 0, len(rows))
+		for _, row := range rows {
+			out = append(out, loadBalancerOut(&row))
+		}
+		utils.WriteJSON(w, http.StatusOK, out)
+	}
+}
+
+// GetLoadBalancer godoc
+//
+//	@ID				GetLoadBalancers
+//	@Summary		Get a load balancer (org scoped)
+//	@Description	Returns load balancer for the organization in X-Org-ID.
+//	@Tags			LoadBalancers
+//	@Produce		json
+//	@Param			X-Org-ID	header		string	false	"Organization UUID"
+//	@Param			id			path		string	true	"LoadBalancer ID (UUID)"
+//	@Success		200			{array}		dto.LoadBalancerResponse
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"failed to list clusters"
+//	@Router			/load-balancers/{id} [get]
+//	@Security		BearerAuth
+//	@Security		OrgKeyAuth
+//	@Security		OrgSecretAuth
+func GetLoadBalancer(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+
+		var row models.LoadBalancer
+		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "load balancer not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "db error")
+			return
+		}
+		out := loadBalancerOut(&row)
+		utils.WriteJSON(w, http.StatusOK, out)
+	}
+}
+
+// CreateLoadBalancer godoc
+//
+//	@ID			CreateLoadBalancer
+//	@Summary	Create a load balancer
+//	@Tags		LoadBalancers
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string							false	"Organization UUID"
+//	@Param		body		body		dto.CreateLoadBalancerRequest	true	"Record set payload"
+//	@Success	201			{object}	dto.LoadBalancerResponse
+//	@Failure	400			{string}	string	"validation error"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"domain not found"
+//	@Router		/load-balancers [post]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func CreateLoadBalancer(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		var in dto.CreateLoadBalancerRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+
+		if strings.ToLower(in.Kind) != "glueops" && strings.ToLower(in.Kind) != "public" {
+			fmt.Println(in.Kind)
+			utils.WriteError(w, http.StatusBadRequest, "bad_kind", "invalid kind only 'glueops' or 'public'")
+			return
+		}
+
+		row := &models.LoadBalancer{
+			OrganizationID:   orgID,
+			Name:             in.Name,
+			Kind:             strings.ToLower(in.Kind),
+			PublicIPAddress:  in.PublicIPAddress,
+			PrivateIPAddress: in.PrivateIPAddress,
+		}
+		if err := db.Create(row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusCreated, loadBalancerOut(row))
+	}
+}
+
+// UpdateLoadBalancer godoc
+//
+//	@ID			UpdateLoadBalancer
+//	@Summary	Update a load balancer (org scoped)
+//	@Tags		LoadBalancers
+//	@Accept		json
+//	@Produce	json
+//	@Param		X-Org-ID	header		string							false	"Organization UUID"
+//	@Param		id			path		string							true	"Load Balancer ID (UUID)"
+//	@Param		body		body		dto.UpdateLoadBalancerRequest	true	"Fields to update"
+//	@Success	200			{object}	dto.LoadBalancerResponse
+//	@Failure	400			{string}	string	"validation error"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Router		/load-balancers/{id} [patch]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func UpdateLoadBalancer(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+
+		row := &models.LoadBalancer{}
+		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "load balancer not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+
+		var in dto.UpdateLoadBalancerRequest
+		if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_json", err.Error())
+			return
+		}
+		if in.Name != nil {
+			row.Name = *in.Name
+		}
+		if in.Kind != nil {
+			fmt.Println(*in.Kind)
+			if strings.ToLower(*in.Kind) != "glueops" && strings.ToLower(*in.Kind) != "public" {
+				utils.WriteError(w, http.StatusBadRequest, "bad_kind", "invalid kind only 'glueops' or 'public'")
+				return
+			}
+			row.Kind = strings.ToLower(*in.Kind)
+		}
+		if in.PublicIPAddress != nil {
+			row.PublicIPAddress = *in.PublicIPAddress
+		}
+		if in.PrivateIPAddress != nil {
+			row.PrivateIPAddress = *in.PrivateIPAddress
+		}
+		if err := db.Save(row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		utils.WriteJSON(w, http.StatusOK, loadBalancerOut(row))
+
+	}
+}
+
+// DeleteLoadBalancer godoc
+//
+//	@ID			DeleteLoadBalancer
+//	@Summary	Delete a load balancer
+//	@Tags		LoadBalancers
+//	@Produce	json
+//	@Param		X-Org-ID	header	string	false	"Organization UUID"
+//	@Param		id			path	string	true	"Load Balancer ID (UUID)"
+//	@Success	204
+//	@Failure	403	{string}	string	"organization required"
+//	@Failure	404	{string}	string	"not found"
+//	@Router		/load-balancers/{id} [delete]
+//	@Security	BearerAuth
+//	@Security	OrgKeyAuth
+//	@Security	OrgSecretAuth
+func DeleteLoadBalancer(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "bad_id", "invalid UUID")
+			return
+		}
+
+		row := &models.LoadBalancer{}
+		if err := db.Where("organization_id = ? AND id = ?", orgID, id).First(&row).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "not_found", "load balancer not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+
+		if err := db.Delete(row).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", err.Error())
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+// ---------- Out mappers ----------
+
+func loadBalancerOut(m *models.LoadBalancer) dto.LoadBalancerResponse {
+	return dto.LoadBalancerResponse{
+		ID:               m.ID,
+		OrganizationID:   m.OrganizationID,
+		Name:             m.Name,
+		Kind:             m.Kind,
+		PublicIPAddress:  m.PublicIPAddress,
+		PrivateIPAddress: m.PrivateIPAddress,
+		CreatedAt:        m.CreatedAt.UTC(),
+		UpdatedAt:        m.UpdatedAt.UTC(),
+	}
+}

internal/handlers/node_pools.go

@@ -25,14 +25,13 @@ import (
 //	@Summary		List node pools (org scoped)
 //	@Description	Returns node pools for the organization in X-Org-ID.
 //	@Tags			NodePools
-//	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header	string	false	"Organization UUID"
-//	@Param			q			query	string	false	"Name contains (case-insensitive)"
-//	@Success		200	{array}		dto.NodePoolResponse
-//	@Failure		401	{string}	string	"Unauthorized"
-//	@Failure		403	{string}	string	"organization required"
-//	@Failure		500	{string}	string	"failed to list node pools"
+//	@Param			X-Org-ID	header		string	false	"Organization UUID"
+//	@Param			q			query		string	false	"Name contains (case-insensitive)"
+//	@Success		200			{array}		dto.NodePoolResponse
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"failed to list node pools"
 //	@Router			/node-pools [get]
 //	@Security		BearerAuth
 //	@Security		OrgKeyAuth
@@ -145,16 +144,15 @@ func ListNodePools(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Get node pool by ID (org scoped)
 //	@Description	Returns one node pool. Add `include=servers` to include servers.
 //	@Tags			NodePools
-//	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header	string	false	"Organization UUID"
-//	@Param			id			path	string	true	"Node Pool ID (UUID)"
-//	@Success		200	{object}	dto.NodePoolResponse
-//	@Failure		400	{string}	string	"invalid id"
-//	@Failure		401	{string}	string	"Unauthorized"
-//	@Failure		403	{string}	string	"organization required"
-//	@Failure		404	{string}	string	"not found"
-//	@Failure		500	{string}	string	"fetch failed"
+//	@Param			X-Org-ID	header		string	false	"Organization UUID"
+//	@Param			id			path		string	true	"Node Pool ID (UUID)"
+//	@Success		200			{object}	dto.NodePoolResponse
+//	@Failure		400			{string}	string	"invalid id"
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		404			{string}	string	"not found"
+//	@Failure		500			{string}	string	"fetch failed"
 //	@Router			/node-pools/{id} [get]
 //	@Security		BearerAuth
 //	@Security		OrgKeyAuth
@@ -194,13 +192,13 @@ func GetNodePool(db *gorm.DB) http.HandlerFunc {
 //	@Tags			NodePools
 //	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header	string					false	"Organization UUID"
-//	@Param			body		body	dto.CreateNodePoolRequest	true	"NodePool payload"
-//	@Success		201	{object}	dto.NodePoolResponse
-//	@Failure		400	{string}	string	"invalid json / missing fields / invalid server_ids"
-//	@Failure		401	{string}	string	"Unauthorized"
-//	@Failure		403	{string}	string	"organization required"
-//	@Failure		500	{string}	string	"create failed"
+//	@Param			X-Org-ID	header		string						false	"Organization UUID"
+//	@Param			body		body		dto.CreateNodePoolRequest	true	"NodePool payload"
+//	@Success		201			{object}	dto.NodePoolResponse
+//	@Failure		400			{string}	string	"invalid json / missing fields / invalid server_ids"
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"create failed"
 //	@Router			/node-pools [post]
 //	@Security		BearerAuth
 //	@Security		OrgKeyAuth
@@ -257,15 +255,15 @@ func CreateNodePool(db *gorm.DB) http.HandlerFunc {
 //	@Tags			NodePools
 //	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header	string					false	"Organization UUID"
-//	@Param			id			path	string					true	"Node Pool ID (UUID)"
-//	@Param			body		body	dto.UpdateNodePoolRequest	true	"Fields to update"
-//	@Success		200	{object}	dto.NodePoolResponse
-//	@Failure		400	{string}	string	"invalid id / invalid json"
-//	@Failure		401	{string}	string	"Unauthorized"
-//	@Failure		403	{string}	string	"organization required"
-//	@Failure		404	{string}	string	"not found"
-//	@Failure		500	{string}	string	"update failed"
+//	@Param			X-Org-ID	header		string						false	"Organization UUID"
+//	@Param			id			path		string						true	"Node Pool ID (UUID)"
+//	@Param			body		body		dto.UpdateNodePoolRequest	true	"Fields to update"
+//	@Success		200			{object}	dto.NodePoolResponse
+//	@Failure		400			{string}	string	"invalid id / invalid json"
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		404			{string}	string	"not found"
+//	@Failure		500			{string}	string	"update failed"
 //	@Router			/node-pools/{id} [patch]
 //	@Security		BearerAuth
 //	@Security		OrgKeyAuth
@@ -327,15 +325,14 @@ func UpdateNodePool(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Delete node pool (org scoped)
 //	@Description	Permanently deletes the node pool.
 //	@Tags			NodePools
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header	string	false	"Organization UUID"
 //	@Param			id			path	string	true	"Node Pool ID (UUID)"
-//	@Success		204	{string}	string	"No Content"
-//	@Failure		400	{string}	string	"invalid id"
-//	@Failure		401	{string}	string	"Unauthorized"
-//	@Failure		403	{string}	string	"organization required"
-//	@Failure		500	{string}	string	"delete failed"
+//	@Success		204			"No Content"
+//	@Failure		400			{string}	string	"invalid id"
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		500			{string}	string	"delete failed"
 //	@Router			/node-pools/{id} [delete]
 //	@Security		BearerAuth
 //	@Security		OrgKeyAuth
@@ -369,16 +366,15 @@ func DeleteNodePool(db *gorm.DB) http.HandlerFunc {
 //	@ID			ListNodePoolServers
 //	@Summary	List servers attached to a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Node Pool ID (UUID)"
-//	@Success	200	{array}		dto.ServerResponse
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"fetch failed"
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Node Pool ID (UUID)"
+//	@Success	200			{array}		dto.ServerResponse
+//	@Failure	400			{string}	string	"invalid id"
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Failure	500			{string}	string	"fetch failed"
 //	@Router		/node-pools/{id}/servers [get]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -434,15 +430,15 @@ func ListNodePoolServers(db *gorm.DB) http.HandlerFunc {
 //	@Tags		NodePools
 //	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string					false	"Organization UUID"
-//	@Param		id			path	string					true	"Node Pool ID (UUID)"
-//	@Param		body		body	dto.AttachServersRequest	true	"Server IDs to attach"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id / invalid server_ids"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"attach failed"
+//	@Param		X-Org-ID	header		string						false	"Organization UUID"
+//	@Param		id			path		string						true	"Node Pool ID (UUID)"
+//	@Param		body		body		dto.AttachServersRequest	true	"Server IDs to attach"
+//	@Success	204			{string}	string						"No Content"
+//	@Failure	400			{string}	string						"invalid id / invalid server_ids"
+//	@Failure	401			{string}	string						"Unauthorized"
+//	@Failure	403			{string}	string						"organization required"
+//	@Failure	404			{string}	string						"not found"
+//	@Failure	500			{string}	string						"attach failed"
 //	@Router		/node-pools/{id}/servers [post]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -521,17 +517,16 @@ func AttachNodePoolServers(db *gorm.DB) http.HandlerFunc {
 //	@ID			DetachNodePoolServer
 //	@Summary	Detach one server from a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Node Pool ID (UUID)"
-//	@Param		serverId	path	string	true	"Server ID (UUID)"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"detach failed"
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Node Pool ID (UUID)"
+//	@Param		serverId	path		string	true	"Server ID (UUID)"
+//	@Success	204			{string}	string	"No Content"
+//	@Failure	400			{string}	string	"invalid id"
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Failure	500			{string}	string	"detach failed"
 //	@Router		/node-pools/{id}/servers/{serverId} [delete]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -588,16 +583,15 @@ func DetachNodePoolServer(db *gorm.DB) http.HandlerFunc {
 //	@ID			ListNodePoolTaints
 //	@Summary	List taints attached to a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Node Pool ID (UUID)"
-//	@Success	200	{array}		dto.TaintResponse
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"fetch failed"
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Node Pool ID (UUID)"
+//	@Success	200			{array}		dto.TaintResponse
+//	@Failure	400			{string}	string	"invalid id"
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Failure	500			{string}	string	"fetch failed"
 //	@Router		/node-pools/{id}/taints [get]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -646,15 +640,15 @@ func ListNodePoolTaints(db *gorm.DB) http.HandlerFunc {
 //	@Tags		NodePools
 //	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string					false	"Organization UUID"
-//	@Param		id			path	string					true	"Node Pool ID (UUID)"
-//	@Param		body		body	dto.AttachTaintsRequest	true	"Taint IDs to attach"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id / invalid taint_ids"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"attach failed"
+//	@Param		X-Org-ID	header		string					false	"Organization UUID"
+//	@Param		id			path		string					true	"Node Pool ID (UUID)"
+//	@Param		body		body		dto.AttachTaintsRequest	true	"Taint IDs to attach"
+//	@Success	204			{string}	string					"No Content"
+//	@Failure	400			{string}	string					"invalid id / invalid taint_ids"
+//	@Failure	401			{string}	string					"Unauthorized"
+//	@Failure	403			{string}	string					"organization required"
+//	@Failure	404			{string}	string					"not found"
+//	@Failure	500			{string}	string					"attach failed"
 //	@Router		/node-pools/{id}/taints [post]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -730,17 +724,16 @@ func AttachNodePoolTaints(db *gorm.DB) http.HandlerFunc {
 //	@ID			DetachNodePoolTaint
 //	@Summary	Detach one taint from a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Node Pool ID (UUID)"
-//	@Param		taintId	path	string	true	"Taint ID (UUID)"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"detach failed"
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Node Pool ID (UUID)"
+//	@Param		taintId		path		string	true	"Taint ID (UUID)"
+//	@Success	204			{string}	string	"No Content"
+//	@Failure	400			{string}	string	"invalid id"
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Failure	500			{string}	string	"detach failed"
 //	@Router		/node-pools/{id}/taints/{taintId} [delete]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -798,16 +791,15 @@ func DetachNodePoolTaint(db *gorm.DB) http.HandlerFunc {
 //	@ID			ListNodePoolLabels
 //	@Summary	List labels attached to a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Label Pool ID (UUID)"
-//	@Success	200	{array}		dto.LabelResponse
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"fetch failed"
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Label Pool ID (UUID)"
+//	@Success	200			{array}		dto.LabelResponse
+//	@Failure	400			{string}	string	"invalid id"
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Failure	500			{string}	string	"fetch failed"
 //	@Router		/node-pools/{id}/labels [get]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -859,15 +851,15 @@ func ListNodePoolLabels(db *gorm.DB) http.HandlerFunc {
 //	@Tags		NodePools
 //	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string					false	"Organization UUID"
-//	@Param		id			path	string					true	"Node Pool ID (UUID)"
-//	@Param		body		body	dto.AttachLabelsRequest	true	"Label IDs to attach"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id / invalid server_ids"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"attach failed"
+//	@Param		X-Org-ID	header		string					false	"Organization UUID"
+//	@Param		id			path		string					true	"Node Pool ID (UUID)"
+//	@Param		body		body		dto.AttachLabelsRequest	true	"Label IDs to attach"
+//	@Success	204			{string}	string					"No Content"
+//	@Failure	400			{string}	string					"invalid id / invalid server_ids"
+//	@Failure	401			{string}	string					"Unauthorized"
+//	@Failure	403			{string}	string					"organization required"
+//	@Failure	404			{string}	string					"not found"
+//	@Failure	500			{string}	string					"attach failed"
 //	@Router		/node-pools/{id}/labels [post]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -940,17 +932,16 @@ func AttachNodePoolLabels(db *gorm.DB) http.HandlerFunc {
 //	@ID			DetachNodePoolLabel
 //	@Summary	Detach one label from a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Node Pool ID (UUID)"
-//	@Param		labelId	path	string	true	"Label ID (UUID)"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"detach failed"
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Node Pool ID (UUID)"
+//	@Param		labelId		path		string	true	"Label ID (UUID)"
+//	@Success	204			{string}	string	"No Content"
+//	@Failure	400			{string}	string	"invalid id"
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Failure	500			{string}	string	"detach failed"
 //	@Router		/node-pools/{id}/labels/{labelId} [delete]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -1008,16 +999,15 @@ func DetachNodePoolLabel(db *gorm.DB) http.HandlerFunc {
 //	@ID			ListNodePoolAnnotations
 //	@Summary	List annotations attached to a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Node Pool ID (UUID)"
-//	@Success	200	{array}		dto.AnnotationResponse
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"fetch failed"
+//	@Param		X-Org-ID	header		string	false	"Organization UUID"
+//	@Param		id			path		string	true	"Node Pool ID (UUID)"
+//	@Success	200			{array}		dto.AnnotationResponse
+//	@Failure	400			{string}	string	"invalid id"
+//	@Failure	401			{string}	string	"Unauthorized"
+//	@Failure	403			{string}	string	"organization required"
+//	@Failure	404			{string}	string	"not found"
+//	@Failure	500			{string}	string	"fetch failed"
 //	@Router		/node-pools/{id}/annotations [get]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -1069,15 +1059,15 @@ func ListNodePoolAnnotations(db *gorm.DB) http.HandlerFunc {
 //	@Tags		NodePools
 //	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string					false	"Organization UUID"
-//	@Param		id			path	string					true	"Node Group ID (UUID)"
-//	@Param		body		body	dto.AttachAnnotationsRequest	true	"Annotation IDs to attach"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id / invalid server_ids"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"attach failed"
+//	@Param		X-Org-ID	header		string							false	"Organization UUID"
+//	@Param		id			path		string							true	"Node Group ID (UUID)"
+//	@Param		body		body		dto.AttachAnnotationsRequest	true	"Annotation IDs to attach"
+//	@Success	204			{string}	string							"No Content"
+//	@Failure	400			{string}	string							"invalid id / invalid server_ids"
+//	@Failure	401			{string}	string							"Unauthorized"
+//	@Failure	403			{string}	string							"organization required"
+//	@Failure	404			{string}	string							"not found"
+//	@Failure	500			{string}	string							"attach failed"
 //	@Router		/node-pools/{id}/annotations [post]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth
@@ -1151,17 +1141,16 @@ func AttachNodePoolAnnotations(db *gorm.DB) http.HandlerFunc {
 //	@ID			DetachNodePoolAnnotation
 //	@Summary	Detach one annotation from a node pool (org scoped)
 //	@Tags		NodePools
-//	@Accept		json
 //	@Produce	json
-//	@Param		X-Org-ID	header	string	false	"Organization UUID"
-//	@Param		id			path	string	true	"Node Pool ID (UUID)"
-//	@Param		annotationId	path	string	true	"Annotation ID (UUID)"
-//	@Success	204	{string}	string	"No Content"
-//	@Failure	400	{string}	string	"invalid id"
-//	@Failure	401	{string}	string	"Unauthorized"
-//	@Failure	403	{string}	string	"organization required"
-//	@Failure	404	{string}	string	"not found"
-//	@Failure	500	{string}	string	"detach failed"
+//	@Param		X-Org-ID		header		string	false	"Organization UUID"
+//	@Param		id				path		string	true	"Node Pool ID (UUID)"
+//	@Param		annotationId	path		string	true	"Annotation ID (UUID)"
+//	@Success	204				{string}	string	"No Content"
+//	@Failure	400				{string}	string	"invalid id"
+//	@Failure	401				{string}	string	"Unauthorized"
+//	@Failure	403				{string}	string	"organization required"
+//	@Failure	404				{string}	string	"not found"
+//	@Failure	500				{string}	string	"detach failed"
 //	@Router		/node-pools/{id}/annotations/{annotationId} [delete]
 //	@Security	BearerAuth
 //	@Security	OrgKeyAuth

internal/handlers/node_pools_test.go

@@ -0,0 +1,381 @@
+package handlers
+
+import (
+	"os"
+	"testing"
+
+	"github.com/glueops/autoglue/internal/common"
+	"github.com/glueops/autoglue/internal/models"
+	"github.com/glueops/autoglue/internal/testutil/pgtest"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+func TestMain(m *testing.M) {
+	code := m.Run()
+	pgtest.Stop()
+	os.Exit(code)
+}
+
+func TestParseUUIDs_Success(t *testing.T) {
+	u1 := uuid.New()
+	u2 := uuid.New()
+
+	got, err := parseUUIDs([]string{u1.String(), u2.String()})
+	if err != nil {
+		t.Fatalf("parseUUIDs returned error: %v", err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("expected 2 UUIDs, got %d", len(got))
+	}
+	if got[0] != u1 || got[1] != u2 {
+		t.Fatalf("unexpected UUIDs: got=%v", got)
+	}
+}
+
+func TestParseUUIDs_Invalid(t *testing.T) {
+	_, err := parseUUIDs([]string{"not-a-uuid"})
+	if err == nil {
+		t.Fatalf("expected error for invalid UUID, got nil")
+	}
+}
+
+// --- ensureServersBelongToOrg ---
+
+func TestEnsureServersBelongToOrg_AllBelong(t *testing.T) {
+	db := pgtest.DB(t)
+
+	org := models.Organization{Name: "org-a"}
+	if err := db.Create(&org).Error; err != nil {
+		t.Fatalf("create org: %v", err)
+	}
+
+	sshKey := createTestSshKey(t, db, org.ID, "org-a-key")
+
+	s1 := models.Server{
+		OrganizationID: org.ID,
+		Hostname:       "srv-1",
+		SSHUser:        "ubuntu",
+		SshKeyID:       sshKey.ID,
+		Role:           "worker",
+		Status:         "pending",
+	}
+	s2 := models.Server{
+		OrganizationID: org.ID,
+		Hostname:       "srv-2",
+		SSHUser:        "ubuntu",
+		SshKeyID:       sshKey.ID,
+		Role:           "worker",
+		Status:         "pending",
+	}
+
+	if err := db.Create(&s1).Error; err != nil {
+		t.Fatalf("create server 1: %v", err)
+	}
+	if err := db.Create(&s2).Error; err != nil {
+		t.Fatalf("create server 2: %v", err)
+	}
+
+	ids := []uuid.UUID{s1.ID, s2.ID}
+	if err := ensureServersBelongToOrg(org.ID, ids, db); err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+}
+
+func TestEnsureServersBelongToOrg_ForeignOrgFails(t *testing.T) {
+	db := pgtest.DB(t)
+
+	orgA := models.Organization{Name: "org-a"}
+	orgB := models.Organization{Name: "org-b"}
+
+	if err := db.Create(&orgA).Error; err != nil {
+		t.Fatalf("create orgA: %v", err)
+	}
+	if err := db.Create(&orgB).Error; err != nil {
+		t.Fatalf("create orgB: %v", err)
+	}
+
+	sshKeyA := createTestSshKey(t, db, orgA.ID, "org-a-key")
+	sshKeyB := createTestSshKey(t, db, orgB.ID, "org-b-key")
+
+	s1 := models.Server{
+		OrganizationID: orgA.ID,
+		Hostname:       "srv-a-1",
+		SSHUser:        "ubuntu",
+		SshKeyID:       sshKeyA.ID,
+		Role:           "worker",
+		Status:         "pending",
+	}
+	s2 := models.Server{
+		OrganizationID: orgB.ID,
+		Hostname:       "srv-b-1",
+		SSHUser:        "ubuntu",
+		SshKeyID:       sshKeyB.ID,
+		Role:           "worker",
+		Status:         "pending",
+	}
+
+	if err := db.Create(&s1).Error; err != nil {
+		t.Fatalf("create server s1: %v", err)
+	}
+	if err := db.Create(&s2).Error; err != nil {
+		t.Fatalf("create server s2: %v", err)
+	}
+
+	ids := []uuid.UUID{s1.ID, s2.ID}
+	if err := ensureServersBelongToOrg(orgA.ID, ids, db); err == nil {
+		t.Fatalf("expected error when one server belongs to a different org")
+	}
+}
+
+// --- ensureTaintsBelongToOrg ---
+
+func TestEnsureTaintsBelongToOrg_AllBelong(t *testing.T) {
+	db := pgtest.DB(t)
+
+	org := models.Organization{Name: "org-taints"}
+	if err := db.Create(&org).Error; err != nil {
+		t.Fatalf("create org: %v", err)
+	}
+
+	t1 := models.Taint{
+		OrganizationID: org.ID,
+		Key:            "key1",
+		Value:          "val1",
+		Effect:         "NoSchedule",
+	}
+	t2 := models.Taint{
+		OrganizationID: org.ID,
+		Key:            "key2",
+		Value:          "val2",
+		Effect:         "PreferNoSchedule",
+	}
+
+	if err := db.Create(&t1).Error; err != nil {
+		t.Fatalf("create taint 1: %v", err)
+	}
+	if err := db.Create(&t2).Error; err != nil {
+		t.Fatalf("create taint 2: %v", err)
+	}
+
+	ids := []uuid.UUID{t1.ID, t2.ID}
+	if err := ensureTaintsBelongToOrg(org.ID, ids, db); err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+}
+
+func TestEnsureTaintsBelongToOrg_ForeignOrgFails(t *testing.T) {
+	db := pgtest.DB(t)
+
+	orgA := models.Organization{Name: "org-a"}
+	orgB := models.Organization{Name: "org-b"}
+	if err := db.Create(&orgA).Error; err != nil {
+		t.Fatalf("create orgA: %v", err)
+	}
+	if err := db.Create(&orgB).Error; err != nil {
+		t.Fatalf("create orgB: %v", err)
+	}
+
+	t1 := models.Taint{
+		OrganizationID: orgA.ID,
+		Key:            "key1",
+		Value:          "val1",
+		Effect:         "NoSchedule",
+	}
+	t2 := models.Taint{
+		OrganizationID: orgB.ID,
+		Key:            "key2",
+		Value:          "val2",
+		Effect:         "NoSchedule",
+	}
+
+	if err := db.Create(&t1).Error; err != nil {
+		t.Fatalf("create taint 1: %v", err)
+	}
+	if err := db.Create(&t2).Error; err != nil {
+		t.Fatalf("create taint 2: %v", err)
+	}
+
+	ids := []uuid.UUID{t1.ID, t2.ID}
+	if err := ensureTaintsBelongToOrg(orgA.ID, ids, db); err == nil {
+		t.Fatalf("expected error when a taint belongs to another org")
+	}
+}
+
+// --- ensureLabelsBelongToOrg ---
+
+func TestEnsureLabelsBelongToOrg_AllBelong(t *testing.T) {
+	db := pgtest.DB(t)
+
+	org := models.Organization{Name: "org-labels"}
+	if err := db.Create(&org).Error; err != nil {
+		t.Fatalf("create org: %v", err)
+	}
+
+	l1 := models.Label{
+		AuditFields: common.AuditFields{
+			OrganizationID: org.ID,
+		},
+		Key:   "env",
+		Value: "dev",
+	}
+	l2 := models.Label{
+		AuditFields: common.AuditFields{
+			OrganizationID: org.ID,
+		},
+		Key:   "env",
+		Value: "prod",
+	}
+
+	if err := db.Create(&l1).Error; err != nil {
+		t.Fatalf("create label 1: %v", err)
+	}
+	if err := db.Create(&l2).Error; err != nil {
+		t.Fatalf("create label 2: %v", err)
+	}
+
+	ids := []uuid.UUID{l1.ID, l2.ID}
+	if err := ensureLabelsBelongToOrg(org.ID, ids, db); err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+}
+
+func TestEnsureLabelsBelongToOrg_ForeignOrgFails(t *testing.T) {
+	db := pgtest.DB(t)
+
+	orgA := models.Organization{Name: "org-a"}
+	orgB := models.Organization{Name: "org-b"}
+	if err := db.Create(&orgA).Error; err != nil {
+		t.Fatalf("create orgA: %v", err)
+	}
+	if err := db.Create(&orgB).Error; err != nil {
+		t.Fatalf("create orgB: %v", err)
+	}
+
+	l1 := models.Label{
+		AuditFields: common.AuditFields{
+			OrganizationID: orgA.ID,
+		},
+		Key:   "env",
+		Value: "dev",
+	}
+	l2 := models.Label{
+		AuditFields: common.AuditFields{
+			OrganizationID: orgB.ID,
+		},
+		Key:   "env",
+		Value: "prod",
+	}
+
+	if err := db.Create(&l1).Error; err != nil {
+		t.Fatalf("create label 1: %v", err)
+	}
+	if err := db.Create(&l2).Error; err != nil {
+		t.Fatalf("create label 2: %v", err)
+	}
+
+	ids := []uuid.UUID{l1.ID, l2.ID}
+	if err := ensureLabelsBelongToOrg(orgA.ID, ids, db); err == nil {
+		t.Fatalf("expected error when a label belongs to another org")
+	}
+}
+
+// --- ensureAnnotaionsBelongToOrg (typo in original name is preserved) ---
+
+func TestEnsureAnnotationsBelongToOrg_AllBelong(t *testing.T) {
+	db := pgtest.DB(t)
+
+	org := models.Organization{Name: "org-annotations"}
+	if err := db.Create(&org).Error; err != nil {
+		t.Fatalf("create org: %v", err)
+	}
+
+	a1 := models.Annotation{
+		AuditFields: common.AuditFields{
+			OrganizationID: org.ID,
+		},
+		Key:   "team",
+		Value: "core",
+	}
+	a2 := models.Annotation{
+		AuditFields: common.AuditFields{
+			OrganizationID: org.ID,
+		},
+		Key:   "team",
+		Value: "platform",
+	}
+
+	if err := db.Create(&a1).Error; err != nil {
+		t.Fatalf("create annotation 1: %v", err)
+	}
+	if err := db.Create(&a2).Error; err != nil {
+		t.Fatalf("create annotation 2: %v", err)
+	}
+
+	ids := []uuid.UUID{a1.ID, a2.ID}
+	if err := ensureAnnotaionsBelongToOrg(org.ID, ids, db); err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+}
+
+func TestEnsureAnnotationsBelongToOrg_ForeignOrgFails(t *testing.T) {
+	db := pgtest.DB(t)
+
+	orgA := models.Organization{Name: "org-a"}
+	orgB := models.Organization{Name: "org-b"}
+	if err := db.Create(&orgA).Error; err != nil {
+		t.Fatalf("create orgA: %v", err)
+	}
+	if err := db.Create(&orgB).Error; err != nil {
+		t.Fatalf("create orgB: %v", err)
+	}
+
+	a1 := models.Annotation{
+		AuditFields: common.AuditFields{
+			OrganizationID: orgA.ID,
+		},
+		Key:   "team",
+		Value: "core",
+	}
+	a2 := models.Annotation{
+		AuditFields: common.AuditFields{
+			OrganizationID: orgB.ID,
+		},
+		Key:   "team",
+		Value: "platform",
+	}
+
+	if err := db.Create(&a1).Error; err != nil {
+		t.Fatalf("create annotation 1: %v", err)
+	}
+	if err := db.Create(&a2).Error; err != nil {
+		t.Fatalf("create annotation 2: %v", err)
+	}
+
+	ids := []uuid.UUID{a1.ID, a2.ID}
+	if err := ensureAnnotaionsBelongToOrg(orgA.ID, ids, db); err == nil {
+		t.Fatalf("expected error when an annotation belongs to another org")
+	}
+}
+
+func createTestSshKey(t *testing.T, db *gorm.DB, orgID uuid.UUID, name string) models.SshKey {
+	t.Helper()
+
+	key := models.SshKey{
+		AuditFields: common.AuditFields{
+			OrganizationID: orgID,
+		},
+		Name:                name,
+		PublicKey:           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITestKey",
+		EncryptedPrivateKey: "encrypted",
+		PrivateIV:           "iv",
+		PrivateTag:          "tag",
+		Fingerprint:         "fp-" + name,
+	}
+
+	if err := db.Create(&key).Error; err != nil {
+		t.Fatalf("create ssh key %s: %v", name, err)
+	}
+
+	return key
+}

internal/handlers/servers.go

@@ -22,7 +22,6 @@ import (
 //	@Summary		List servers (org scoped)
 //	@Description	Returns servers for the organization in X-Org-ID. Optional filters: status, role.
 //	@Tags			Servers
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			status		query		string	false	"Filter by status (pending|provisioning|ready|failed)"
@@ -89,7 +88,6 @@ func ListServers(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Get server by ID (org scoped)
 //	@Description	Returns one server in the given organization.
 //	@Tags			Servers
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			id			path		string	true	"Server ID (UUID)"
@@ -329,11 +327,10 @@ func UpdateServer(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Delete server (org scoped)
 //	@Description	Permanently deletes the server.
 //	@Tags			Servers
-//	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header		string	false	"Organization UUID"
-//	@Param			id			path		string	true	"Server ID (UUID)"
-//	@Success		204			{string}	string	"No Content"
+//	@Param			X-Org-ID	header	string	false	"Organization UUID"
+//	@Param			id			path	string	true	"Server ID (UUID)"
+//	@Success		204			"No Content"
 //	@Failure		400			{string}	string	"invalid id"
 //	@Failure		401			{string}	string	"Unauthorized"
 //	@Failure		403			{string}	string	"organization required"
@@ -370,6 +367,63 @@ func DeleteServer(db *gorm.DB) http.HandlerFunc {
 	}
 }
 
+// ResetServerHostKey godoc
+//
+//	@ID				ResetServerHostKey
+//	@Summary		Reset SSH host key (org scoped)
+//	@Description	Clears the stored SSH host key for this server. The next SSH connection will re-learn the host key (trust-on-first-use).
+//	@Tags			Servers
+//	@Accept			json
+//	@Produce		json
+//	@Param			X-Org-ID	header		string	false	"Organization UUID"
+//	@Param			id			path		string	true	"Server ID (UUID)"
+//	@Success		200			{object}	dto.ServerResponse
+//	@Failure		400			{string}	string	"invalid id"
+//	@Failure		401			{string}	string	"Unauthorized"
+//	@Failure		403			{string}	string	"organization required"
+//	@Failure		404			{string}	string	"not found"
+//	@Failure		500			{string}	string	"reset failed"
+//	@Router			/servers/{id}/reset-hostkey [post]
+//	@Security		BearerAuth
+//	@Security		OrgKeyAuth
+//	@Security		OrgSecretAuth
+func ResetServerHostKey(db *gorm.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		orgID, ok := httpmiddleware.OrgIDFrom(r.Context())
+		if !ok {
+			utils.WriteError(w, http.StatusForbidden, "org_required", "specify X-Org-ID")
+			return
+		}
+
+		id, err := uuid.Parse(chi.URLParam(r, "id"))
+		if err != nil {
+			utils.WriteError(w, http.StatusBadRequest, "id_invalid", "invalid id")
+			return
+		}
+
+		var server models.Server
+		if err := db.Where("id = ? AND organization_id = ?", id, orgID).First(&server).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				utils.WriteError(w, http.StatusNotFound, "server_not_found", "server not found")
+				return
+			}
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to get server")
+			return
+		}
+
+		// Clear stored host key so next SSH handshake will TOFU and persist a new one.
+		server.SSHHostKey = ""
+		server.SSHHostKeyAlgo = ""
+
+		if err := db.Save(&server).Error; err != nil {
+			utils.WriteError(w, http.StatusInternalServerError, "db_error", "failed to reset host key")
+			return
+		}
+
+		utils.WriteJSON(w, http.StatusOK, server)
+	}
+}
+
 // --- Helpers ---
 
 func validStatus(status string) bool {

internal/handlers/servers_test.go

@@ -0,0 +1,78 @@
+package handlers
+
+import (
+	"testing"
+
+	"github.com/glueops/autoglue/internal/models"
+	"github.com/glueops/autoglue/internal/testutil/pgtest"
+	"github.com/google/uuid"
+)
+
+func TestValidStatus(t *testing.T) {
+	// known-good statuses from servers.go
+	valid := []string{"pending", "provisioning", "ready", "failed"}
+	for _, s := range valid {
+		if !validStatus(s) {
+			t.Errorf("expected validStatus(%q) = true, got false", s)
+		}
+	}
+
+	invalid := []string{"foobar", "unknown"}
+	for _, s := range invalid {
+		if validStatus(s) {
+			t.Errorf("expected validStatus(%q) = false, got true", s)
+		}
+	}
+}
+
+func TestEnsureKeyBelongsToOrg_Success(t *testing.T) {
+	db := pgtest.DB(t)
+
+	org := models.Organization{Name: "servers-org"}
+	if err := db.Create(&org).Error; err != nil {
+		t.Fatalf("create org: %v", err)
+	}
+
+	key := createTestSshKey(t, db, org.ID, "org-key")
+
+	if err := ensureKeyBelongsToOrg(org.ID, key.ID, db); err != nil {
+		t.Fatalf("expected no error, got %v", err)
+	}
+}
+
+func TestEnsureKeyBelongsToOrg_WrongOrg(t *testing.T) {
+	db := pgtest.DB(t)
+
+	orgA := models.Organization{Name: "org-a"}
+	orgB := models.Organization{Name: "org-b"}
+
+	if err := db.Create(&orgA).Error; err != nil {
+		t.Fatalf("create orgA: %v", err)
+	}
+	if err := db.Create(&orgB).Error; err != nil {
+		t.Fatalf("create orgB: %v", err)
+	}
+
+	keyA := createTestSshKey(t, db, orgA.ID, "org-a-key")
+
+	// ask for orgB with a key that belongs to orgA → should fail
+	if err := ensureKeyBelongsToOrg(orgB.ID, keyA.ID, db); err == nil {
+		t.Fatalf("expected error when ssh key belongs to a different org, got nil")
+	}
+}
+
+func TestEnsureKeyBelongsToOrg_NotFound(t *testing.T) {
+	db := pgtest.DB(t)
+
+	org := models.Organization{Name: "org-nokey"}
+	if err := db.Create(&org).Error; err != nil {
+		t.Fatalf("create org: %v", err)
+	}
+
+	// random keyID that doesn't exist
+	randomKeyID := uuid.New()
+
+	if err := ensureKeyBelongsToOrg(org.ID, randomKeyID, db); err == nil {
+		t.Fatalf("expected error when ssh key does not exist, got nil")
+	}
+}

internal/handlers/ssh_keys.go

@@ -31,7 +31,6 @@ import (
 //	@Summary		List ssh keys (org scoped)
 //	@Description	Returns ssh keys for the organization in X-Org-ID.
 //	@Tags			Ssh
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Success		200			{array}		dto.SshResponse
@@ -189,7 +188,6 @@ func CreateSSHKey(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Get ssh key by ID (org scoped)
 //	@Description	Returns public key fields. Append `?reveal=true` to include the private key PEM.
 //	@Tags			Ssh
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			id			path		string	true	"SSH Key ID (UUID)"
@@ -283,11 +281,10 @@ func GetSSHKey(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Delete ssh keypair (org scoped)
 //	@Description	Permanently deletes a keypair.
 //	@Tags			Ssh
-//	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header		string	false	"Organization UUID"
-//	@Param			id			path		string	true	"SSH Key ID (UUID)"
-//	@Success		204			{string}	string	"No Content"
+//	@Param			X-Org-ID	header	string	false	"Organization UUID"
+//	@Param			id			path	string	true	"SSH Key ID (UUID)"
+//	@Success		204			"No Content"
 //	@Failure		400			{string}	string	"invalid id"
 //	@Failure		401			{string}	string	"Unauthorized"
 //	@Failure		403			{string}	string	"organization required"

internal/handlers/taints.go

@@ -22,7 +22,6 @@ import (
 //	@Summary		List node pool taints (org scoped)
 //	@Description	Returns node taints for the organization in X-Org-ID. Filters: `key`, `value`, and `q` (key contains). Add `include=node_pools` to include linked node pools.
 //	@Tags			Taints
-//	@Accept			json
 //	@Produce		json
 //	@Param			X-Org-ID	header		string	false	"Organization UUID"
 //	@Param			key			query		string	false	"Exact key"
@@ -70,7 +69,6 @@ func ListTaints(db *gorm.DB) http.HandlerFunc {
 //	@ID			GetTaint
 //	@Summary	Get node taint by ID (org scoped)
 //	@Tags		Taints
-//	@Accept		json
 //	@Produce	json
 //	@Param		X-Org-ID	header		string	false	"Organization UUID"
 //	@Param		id			path		string	true	"Node Taint ID (UUID)"
@@ -279,11 +277,10 @@ func UpdateTaint(db *gorm.DB) http.HandlerFunc {
 //	@Summary		Delete taint (org scoped)
 //	@Description	Permanently deletes the taint.
 //	@Tags			Taints
-//	@Accept			json
 //	@Produce		json
-//	@Param			X-Org-ID	header		string	false	"Organization UUID"
-//	@Param			id			path		string	true	"Node Taint ID (UUID)"
-//	@Success		204			{string}	string	"No Content"
+//	@Param			X-Org-ID	header	string	false	"Organization UUID"
+//	@Param			id			path	string	true	"Node Taint ID (UUID)"
+//	@Success		204			"No Content"
 //	@Failure		400			{string}	string	"invalid id"
 //	@Failure		401			{string}	string	"Unauthorized"
 //	@Failure		403			{string}	string	"organization required"

internal/handlers/version.go

@@ -30,7 +30,6 @@ type VersionResponse struct {
 //	@Description	Returns build/runtime metadata for the running service.
 //	@Tags			Meta
 //	@ID				Version                 // operationId
-//	@Accept			json
 //	@Produce		json
 //	@Success		200	{object}	VersionResponse
 //	@Router			/version [get]

internal/models/backup.go

@@ -0,0 +1,18 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type Backup struct {
+	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
+	OrganizationID uuid.UUID    `gorm:"type:uuid;not null;index;uniqueIndex:uniq_org_credential,priority:1"`
+	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
+	Enabled        bool         `gorm:"not null;default:false" json:"enabled"`
+	CredentialID   uuid.UUID    `gorm:"type:uuid;not null;uniqueIndex:uniq_org_credential,priority:2" json:"credential_id"`
+	Credential     Credential   `gorm:"foreignKey:CredentialID" json:"credential,omitempty"`
+	CreatedAt      time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
+	UpdatedAt      time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
+}

internal/models/cluster.go

@@ -6,24 +6,40 @@ import (
 	"github.com/google/uuid"
 )
 
+const (
+	ClusterStatusPrePending   = "pre_pending" // needs validation
+	ClusterStatusIncomplete   = "incomplete"  // invalid/missing shape
+	ClusterStatusPending      = "pending"     // valid shape, waiting for provisioning
+	ClusterStatusProvisioning = "provisioning"
+	ClusterStatusReady        = "ready"
+	ClusterStatusFailed       = "failed" // provisioning/runtime failure
+)
+
 type Cluster struct {
-	ID                  uuid.UUID    `gorm:"type:uuid;default:gen_random_uuid();primaryKey" json:"id"`
-	OrganizationID      uuid.UUID    `gorm:"type:uuid;not null" json:"organization_id"`
-	Organization        Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
-	Name                string       `gorm:"not null" json:"name"`
-	Provider            string       `json:"provider"`
-	Region              string       `json:"region"`
-	Status              string       `json:"status"`
-	CaptainDomain       string       `gorm:"not null" json:"captain_domain"`
-	ClusterLoadBalancer string       `json:"cluster_load_balancer"`
-	RandomToken         string       `json:"random_token"`
-	CertificateKey      string       `json:"certificate_key"`
-	EncryptedKubeconfig string       `gorm:"type:text" json:"-"`
-	KubeIV              string       `json:"-"`
-	KubeTag             string       `json:"-"`
-	NodePools           []NodePool   `gorm:"many2many:cluster_node_pools;constraint:OnDelete:CASCADE" json:"node_pools,omitempty"`
-	BastionServerID     *uuid.UUID   `gorm:"type:uuid" json:"bastion_server_id,omitempty"`
-	BastionServer       *Server      `gorm:"foreignKey:BastionServerID" json:"bastion_server,omitempty"`
-	CreatedAt           time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
-	UpdatedAt           time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
+	ID                      uuid.UUID     `gorm:"type:uuid;default:gen_random_uuid();primaryKey" json:"id"`
+	OrganizationID          uuid.UUID     `gorm:"type:uuid;not null" json:"organization_id"`
+	Organization            Organization  `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
+	Name                    string        `gorm:"not null" json:"name"`
+	Provider                string        `json:"provider"`
+	Region                  string        `json:"region"`
+	Status                  string        `gorm:"type:varchar(20);not null;default:'pre_pending'" json:"status"`
+	LastError               string        `gorm:"type:text;not null;default:''" json:"last_error"`
+	CaptainDomainID         *uuid.UUID    `gorm:"type:uuid" json:"captain_domain_id"`
+	CaptainDomain           Domain        `gorm:"foreignKey:CaptainDomainID" json:"captain_domain"`
+	ControlPlaneRecordSetID *uuid.UUID    `gorm:"type:uuid" json:"control_plane_record_set_id,omitempty"`
+	ControlPlaneRecordSet   *RecordSet    `gorm:"foreignKey:ControlPlaneRecordSetID" json:"control_plane_record_set,omitempty"`
+	AppsLoadBalancerID      *uuid.UUID    `gorm:"type:uuid" json:"apps_load_balancer_id,omitempty"`
+	AppsLoadBalancer        *LoadBalancer `gorm:"foreignKey:AppsLoadBalancerID" json:"apps_load_balancer,omitempty"`
+	GlueOpsLoadBalancerID   *uuid.UUID    `gorm:"type:uuid" json:"glueops_load_balancer_id,omitempty"`
+	GlueOpsLoadBalancer     *LoadBalancer `gorm:"foreignKey:GlueOpsLoadBalancerID" json:"glueops_load_balancer,omitempty"`
+	BastionServerID         *uuid.UUID    `gorm:"type:uuid" json:"bastion_server_id,omitempty"`
+	BastionServer           *Server       `gorm:"foreignKey:BastionServerID" json:"bastion_server,omitempty"`
+	NodePools               []NodePool    `gorm:"many2many:cluster_node_pools;constraint:OnDelete:CASCADE" json:"node_pools,omitempty"`
+	RandomToken             string        `json:"random_token"`
+	CertificateKey          string        `json:"certificate_key"`
+	EncryptedKubeconfig     string        `gorm:"type:text" json:"-"`
+	KubeIV                  string        `json:"-"`
+	KubeTag                 string        `json:"-"`
+	CreatedAt               time.Time     `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
+	UpdatedAt               time.Time     `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
 }

internal/models/credential.go

@@ -0,0 +1,29 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+	"gorm.io/datatypes"
+)
+
+type Credential struct {
+	ID               uuid.UUID      `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
+	OrganizationID   uuid.UUID      `gorm:"type:uuid;not null;index;uniqueIndex:uniq_org_provider_scopekind_scope,priority:1" json:"organization_id"`
+	Organization     Organization   `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
+	Provider         string         `gorm:"type:varchar(50);not null;uniqueIndex:uniq_org_provider_scopekind_scope,priority:2;index:idx_provider_kind"`
+	Kind             string         `gorm:"type:varchar(50);not null;index:idx_provider_kind;index:idx_kind_scope"`
+	ScopeKind        string         `gorm:"type:varchar(20);not null;uniqueIndex:uniq_org_provider_scopekind_scope,priority:3"`
+	Scope            datatypes.JSON `gorm:"type:jsonb;not null;default:'{}';index:idx_kind_scope"`
+	ScopeFingerprint string         `gorm:"type:char(64);not null;uniqueIndex:uniq_org_provider_scopekind_scope,priority:4;index"`
+	SchemaVersion    int            `gorm:"not null;default:1"`
+	Name             string         `gorm:"type:varchar(100);not null;default:''"`
+	ScopeVersion     int            `gorm:"not null;default:1"`
+	AccountID        string         `gorm:"type:varchar(32)"`
+	Region           string         `gorm:"type:varchar(32)"`
+	EncryptedData    string         `gorm:"not null"`
+	IV               string         `gorm:"not null"`
+	Tag              string         `gorm:"not null"`
+	CreatedAt        time.Time      `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()" format:"date-time"`
+	UpdatedAt        time.Time      `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" format:"date-time"`
+}

internal/models/domain.go

@@ -0,0 +1,41 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+	"gorm.io/datatypes"
+)
+
+type Domain struct {
+	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
+	OrganizationID uuid.UUID    `gorm:"type:uuid;not null;index;uniqueIndex:uniq_org_domain,priority:1"`
+	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"organization"`
+	DomainName     string       `gorm:"type:varchar(253);not null;uniqueIndex:uniq_org_domain,priority:2"`
+	ZoneID         string       `gorm:"type:varchar(128);not null;default:''"`       // backfilled for R53 (e.g. "/hostedzone/Z123...")
+	Status         string       `gorm:"type:varchar(20);not null;default:'pending'"` // pending, provisioning, ready, failed
+	LastError      string       `gorm:"type:text;not null;default:''"`
+	CredentialID   uuid.UUID    `gorm:"type:uuid;not null" json:"credential_id"`
+	Credential     Credential   `gorm:"foreignKey:CredentialID" json:"credential,omitempty"`
+	CreatedAt      time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
+	UpdatedAt      time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
+}
+
+type RecordSet struct {
+	ID          uuid.UUID      `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
+	DomainID    uuid.UUID      `gorm:"type:uuid;not null;index"`
+	Domain      Domain         `gorm:"foreignKey:DomainID;constraint:OnDelete:CASCADE"`
+	Name        string         `gorm:"type:varchar(253);not null"`      // e.g. "endpoint" (relative to DomainName)
+	Type        string         `gorm:"type:varchar(10);not null;index"` // A, AAAA, CNAME, TXT, MX, SRV, NS, CAA...
+	TTL         *int           `gorm:""`                                // nil for alias targets (Route 53 ignores TTL for alias)
+	Values      datatypes.JSON `gorm:"type:jsonb;not null;default:'[]'"`
+	Fingerprint string         `gorm:"type:char(64);not null;index"` // sha256 of canonical(name,type,ttl,values|alias)
+	Status      string         `gorm:"type:varchar(20);not null;default:'pending'"`
+	Owner       string         `gorm:"type:varchar(16);not null;default:'unknown'"` // 'autoglue' | 'external' | 'unknown'
+	LastError   string         `gorm:"type:text;not null;default:''"`
+	_           struct{}       `gorm:"uniqueIndex:uniq_domain_name_type,priority:1"` // tag holder
+	_           struct{}       `gorm:"uniqueIndex:uniq_domain_name_type,priority:2"`
+	_           struct{}       `gorm:"uniqueIndex:uniq_domain_name_type,priority:3"`
+	CreatedAt   time.Time      `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
+	UpdatedAt   time.Time      `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
+}

internal/models/load_balancer.go

@@ -0,0 +1,19 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type LoadBalancer struct {
+	ID               uuid.UUID    `json:"id" gorm:"primaryKey;type:uuid;default:gen_random_uuid()"`
+	OrganizationID   uuid.UUID    `json:"organization_id" gorm:"type:uuid;index"`
+	Organization     Organization `json:"organization" gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE"`
+	Name             string       `json:"name" gorm:"not null"`
+	Kind             string       `json:"kind" gorm:"not null"`
+	PublicIPAddress  string       `json:"public_ip_address" gorm:"not null"`
+	PrivateIPAddress string       `json:"private_ip_address" gorm:"not null"`
+	CreatedAt        time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
+	UpdatedAt        time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
+}

internal/models/node_pool.go

@@ -12,7 +12,7 @@ type NodePool struct {
 	Annotations  []Annotation `gorm:"many2many:node_annotations;constraint:OnDelete:CASCADE" json:"annotations,omitempty"`
 	Labels       []Label      `gorm:"many2many:node_labels;constraint:OnDelete:CASCADE" json:"labels,omitempty"`
 	Taints       []Taint      `gorm:"many2many:node_taints;constraint:OnDelete:CASCADE" json:"taints,omitempty"`
-	//Clusters       []Cluster    `gorm:"many2many:cluster_node_pools;constraint:OnDelete:CASCADE" json:"clusters,omitempty"`
+	Clusters     []Cluster    `gorm:"many2many:cluster_node_pools;constraint:OnDelete:CASCADE" json:"clusters,omitempty"`
 	//Topology  string    `gorm:"not null,default:'stacked'" json:"topology,omitempty"` // stacked or external
 	Role string `gorm:"not null,default:'worker'" json:"role,omitempty"` // master, worker, or etcd (etcd only if topology = external
 }

internal/models/server.go

@@ -22,6 +22,8 @@ type Server struct {
 	Role             string       `gorm:"not null" json:"role" enums:"master,worker,bastion"`                           // e.g., "master", "worker", "bastion"
 	Status           string       `gorm:"default:'pending'" json:"status" enums:"pending, provisioning, ready, failed"` // pending, provisioning, ready, failed
 	NodePools        []NodePool   `gorm:"many2many:node_servers;constraint:OnDelete:CASCADE" json:"node_pools,omitempty"`
+	SSHHostKey       string       `gorm:"column:ssh_host_key"`
+	SSHHostKeyAlgo   string       `gorm:"column:ssh_host_key_algo"`
 	CreatedAt        time.Time    `gorm:"not null;default:now()" json:"created_at" format:"date-time"`
 	UpdatedAt        time.Time    `gorm:"not null;default:now()" json:"updated_at" format:"date-time"`
 }

internal/testutil/pgtest/pgtest.go

@@ -0,0 +1,119 @@
+package pgtest
+
+import (
+	"fmt"
+	"log"
+	"sync"
+	"testing"
+	"time"
+
+	embeddedpostgres "github.com/fergusstrange/embedded-postgres"
+	"github.com/glueops/autoglue/internal/db"
+	"github.com/glueops/autoglue/internal/models"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+var (
+	once    sync.Once
+	epg     *embeddedpostgres.EmbeddedPostgres
+	gdb     *gorm.DB
+	initErr error
+	dsn     string
+)
+
+// initDB is called once via sync.Once. It starts embedded Postgres,
+// opens a GORM connection and runs the same migrations as NewRuntime.
+func initDB() {
+	const port uint32 = 55432
+
+	cfg := embeddedpostgres.
+		DefaultConfig().
+		Database("autoglue_test").
+		Username("autoglue").
+		Password("autoglue").
+		Port(port).
+		StartTimeout(30 * time.Second)
+
+	epg = embeddedpostgres.NewDatabase(cfg)
+	if err := epg.Start(); err != nil {
+		initErr = fmt.Errorf("start embedded postgres: %w", err)
+		return
+	}
+
+	dsn = fmt.Sprintf(
+		"host=127.0.0.1 port=%d user=%s password=%s dbname=%s sslmode=disable",
+		port,
+		"autoglue",
+		"autoglue",
+		"autoglue_test",
+	)
+
+	dbConn, err := gorm.Open(postgres.Open(dsn), &gorm.Config{})
+	if err != nil {
+		initErr = fmt.Errorf("open gorm: %w", err)
+		return
+	}
+
+	// Use the same model list as app.NewRuntime so schema matches prod
+	if err := db.Run(
+		dbConn,
+		&models.Job{},
+		&models.MasterKey{},
+		&models.SigningKey{},
+		&models.User{},
+		&models.Organization{},
+		&models.Account{},
+		&models.Membership{},
+		&models.APIKey{},
+		&models.UserEmail{},
+		&models.RefreshToken{},
+		&models.OrganizationKey{},
+		&models.SshKey{},
+		&models.Server{},
+		&models.Taint{},
+		&models.Label{},
+		&models.Annotation{},
+		&models.NodePool{},
+		&models.Cluster{},
+		&models.Credential{},
+		&models.Domain{},
+		&models.RecordSet{},
+	); err != nil {
+		initErr = fmt.Errorf("migrate: %w", err)
+		return
+	}
+
+	gdb = dbConn
+}
+
+// DB returns a lazily-initialized *gorm.DB backed by embedded Postgres.
+//
+// Call this from any test that needs a real DB. If init fails, the test
+// will fail immediately with a clear message.
+func DB(t *testing.T) *gorm.DB {
+	t.Helper()
+	once.Do(initDB)
+	if initErr != nil {
+		t.Fatalf("failed to init embedded postgres: %v", initErr)
+	}
+	return gdb
+}
+
+// URL returns the DSN for the embedded Postgres instance, useful for code
+// that expects a DB URL (e.g. bg.NewJobs).
+func URL(t *testing.T) string {
+	t.Helper()
+	DB(t) // ensure initialized
+	return dsn
+}
+
+// Stop stops the embedded Postgres process. Call from TestMain in at
+// least one package, or let the OS clean it up on process exit.
+func Stop() {
+	if epg != nil {
+		if err := epg.Stop(); err != nil {
+			log.Printf("stop embedded postgres: %v", err)
+		}
+	}
+}

internal/web/dist/index.html

@@ -5,9 +5,9 @@
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>AutoGlue</title>
-    <script type="module" crossorigin src="/assets/index-DCrfJ1uu.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/react-B75e6Si-.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-CImaF4Hs.css">
+    <script type="module" crossorigin src="/assets/index-BRRMZeeQ.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/react-B7S5QDrv.js">
+    <link rel="stylesheet" crossorigin href="/assets/index-VHZG0dIU.css">
   </head>
   <body>
     <div id="root"></div>