Add secure dashboard-managed SSH public-key access

Replace server-generated key escrow with public-key-only enable/disable
tasks. Validate ED25519 keys, atomically reconcile one marked
authorized_keys entry, preserve operator keys, and never handle
private keys. Return real task errors and add lifecycle tests.

.github/workflows/go.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
-        go-version: ^1.15
+        go-version: '1.20.2'
     - name: Check out code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Build
       run: make build
     - name: Test

.vscode/tasks.json

@@ -0,0 +1,236 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "Build",
+            "type": "shell",
+            "command": "make",
+            "args": ["build"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+                
+            },
+            "group": {
+                "kind": "build",
+                "isDefault": true
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Build All",
+            "type": "shell",
+            "command": "make",
+            "args": ["build-all"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "group": "build",
+            "problemMatcher": []
+        },
+        {
+            "label": "Build Prod",
+            "type": "shell",
+            "command": "make",
+            "args": ["build-prod"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "group": "build",
+            "problemMatcher": []
+        },
+        {
+            "label": "Build Cloud",
+            "type": "shell",
+            "command": "make",
+            "args": ["build-cloud"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "group": "build",
+            "problemMatcher": []
+        },
+        {
+            "label": "Build ARM64",
+            "type": "shell",
+            "command": "make",
+            "args": ["build-arm64"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "group": "build",
+            "problemMatcher": []
+        },
+        {
+            "label": "Build ARMHF",
+            "type": "shell",
+            "command": "make",
+            "args": ["build-armhf"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "group": "build",
+            "problemMatcher": []
+        },
+        {
+            "label": "Build AMD64",
+            "type": "shell",
+            "command": "make",
+            "args": ["build-amd64"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "group": "build",
+            "problemMatcher": []
+        },
+        {
+            "label": "Clean",
+            "type": "shell",
+            "command": "make",
+            "args": ["clean"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Test",
+            "type": "shell",
+            "command": "make",
+            "args": ["test"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Test with Coverage",
+            "type": "shell",
+            "command": "make",
+            "args": ["test-with-coverage"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Run",
+            "type": "shell",
+            "command": "make",
+            "args": ["run"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Install",
+            "type": "shell",
+            "command": "make",
+            "args": ["install"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Install Prod",
+            "type": "shell",
+            "command": "make",
+            "args": ["install-prod"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Install Cloud",
+            "type": "shell",
+            "command": "make",
+            "args": ["install-cloud"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Install ARM64",
+            "type": "shell",
+            "command": "make",
+            "args": ["install-arm64"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Install ARMHF",
+            "type": "shell",
+            "command": "make",
+            "args": ["install-armhf"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Install AMD64",
+            "type": "shell",
+            "command": "make",
+            "args": ["install-amd64"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Start",
+            "type": "shell",
+            "command": "make",
+            "args": ["start"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Stop",
+            "type": "shell",
+            "command": "make",
+            "args": ["stop"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Restart",
+            "type": "shell",
+            "command": "make",
+            "args": ["restart"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Status",
+            "type": "shell",
+            "command": "make",
+            "args": ["status"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Logs",
+            "type": "shell",
+            "command": "make",
+            "args": ["log"],
+            "options": {
+                "cwd": "${workspaceFolder}"
+            },
+            "problemMatcher": []
+        }
+    ]
+}

CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+## [1.4.0] - 23-09-2026
+
+* Added dashboard-managed SSH public-key access.
+* Validates ED25519 public keys and reports their SHA256 fingerprints.
+* Atomically installs or removes only the marked Edgebox key while preserving all other authorized keys.
+* Never generates, reads, stores, logs, or returns SSH private keys.
+
+## [1.3.2] - 08-12-2024
+
+* Fix to Browser Dev feature:
+    * Checking browser dev url when internet_accessible was checking the incorrect path. This is now fixed.
+
+## [1.3.1] - 08-12-2024
+
+* Fixes to Browser Dev feature:
+    * Now edgeboxctl also fetches or generates the browser dev environment url and saves it into an option both when starting, and every time the browser dev status is fetched.
+
+## [1.3.0] - 05-12-2024
+
+* Added Edgebox Browser Development Environment Feature Support
+    * Added tasks for handling browser development environment into tasks.go
+    * Added executable tasks to ExecuteTask and scheduled ones to ExecuteSchedules
+* Other bug fixes and improvements.
+
+### Missing Past Releases
+
+Release notes for past versions are not available in this file. Please refer to the [GitHub releases](https://hithub.com/edgebox-iot/edgeboxctl/releases) for more information. Feel free to contribute to this file by adding missing release notes.

Dockerfile

@@ -1,11 +1,9 @@
-FROM golang:latest
+FROM golang:1.20.2
 
 WORKDIR /app
 
 COPY ./ /app
 
-RUN go mod download
+RUN go install github.com/githubnemo/CompileDaemon@latest
 
-RUN go get github.com/githubnemo/CompileDaemon
+ENTRYPOINT CompileDaemon --build="make build" --command=./bin/edgeboxctl-$(go env GOOS)-$(go env GOARCH)
-
-ENTRYPOINT CompileDaemon --build="make build" --command=./bin/edgeboxctl

Makefile

@@ -1,14 +1,23 @@
-PROJECT?=github.com/edgebox-iot/edgeboxctl
+.DEFAULT_GOAL := build
 
+PROJECT ?= github.com/edgebox-iot/edgeboxctl
 RELEASE ?= dev
 COMMIT := $(shell git rev-parse --short HEAD)
 BUILD_DATE := $(shell date -u '+%Y-%m-%d_%H:%M:%S')
 BUILD_DIR = bin
+GOOS := $(shell go env GOOS)
+GOARCH := $(shell go env GOARCH)
+
 
 build-all:
+	@echo "\n🏗️ Building all architectures for ${RELEASE} mode"
+	@echo "🟡 This will build all supported architectures and release combinations. It can take a while...\n"
+
 	GOOS=linux GOARCH=amd64 make build
 	GOOS=linux GOARCH=arm make build
 
+	@echo "\n🟢 All builds completed and available at ./bin/ \n"
+
 build-prod:
 	GOOS=linux GOARCH=arm RELEASE=prod make build
 
@@ -26,33 +35,54 @@ build-amd64:
 
 
 build:
-	@echo "Building ${GOOS}-${GOARCH}"
+	@echo "\n🏗️ Building edgeboxctl (${RELEASE} release) on ${GOOS} (${GOARCH})"
+	@echo "📦 Binary will be saved in ./${BUILD_DIR}/edgeboxctl-${GOOS}-${GOARCH}\n"
+
 	GOOS=${GOOS} GOARCH=${GOARCH} go build \
 		-trimpath -ldflags "-s -w -X ${PROJECT}/internal/diagnostics.Version=${RELEASE} \
 		-X ${PROJECT}/internal/diagnostics.Commit=${COMMIT} \
 		-X ${PROJECT}/internal/diagnostics.BuildDate=${BUILD_DATE}" \
 		-o bin/edgeboxctl-${GOOS}-${GOARCH} ${PROJECT}/cmd/edgeboxctl
-	cp ./bin/edgeboxctl-${GOOS}-${GOARCH} ./bin/edgeboxctl
+
+	@echo "\n🟢 Build task completed\n"
 
 clean:
+	@echo "🧹 Cleaning build directory and go cache\n"
+
 	rm -rf ${BUILD_DIR}
 	go clean
 
+	@echo "\n🟢 Clean task completed\n"
+
 test:
 	go test -tags=unit -timeout=600s -v ./...
 
 test-with-coverage:
 	go test -tags=unit -timeout=600s -v ./... -coverprofile=coverage.out
 
+run:
+	@echo "\n🚀 Running edgeboxctl\n"
+	./bin/edgeboxctl-${GOOS}-${GOARCH}
+
 install:
+	@echo "📦 Installing edgeboxctl service (${RELEASE}) for ${GOOS} (${GOARCH})\n"
+	
+	@echo "�🚧 Stopping edgeboxctl service if it is running"
 	sudo systemctl stop edgeboxctl || true
+
+	@echo "\n🗑️ Removing old edgeboxctl binary and service"
 	sudo rm -rf /usr/local/bin/edgeboxctl /usr/local/sbin/edgeboctl /lib/systemd/system/edgeboxctl.service
-	sudo cp ./bin/edgeboxctl /usr/local/bin/edgeboxctl
+	
-	sudo cp ./bin/edgeboxctl /usr/local/sbin/edgeboxctl
+	@echo "\n🚚 Copying edgeboxctl binary to /usr/local/bin"
+	sudo cp ./bin/edgeboxctl-${GOOS}-${GOARCH} /usr/local/bin/edgeboxctl
+	sudo cp ./bin/edgeboxctl-${GOOS}-${GOARCH} /usr/local/sbin/edgeboxctl
+
+	@echo "\n🚚 Copying edgeboxctl service to /lib/systemd/system"
 	sudo cp ./edgeboxctl.service /lib/systemd/system/edgeboxctl.service
 	sudo systemctl daemon-reload
-	@echo "Edgeboxctl installed successfully"
+
-	@echo "To start edgeboxctl run: systemctl start edgeboxctl"
+	@echo "\n 🚀 To start edgeboxctl run: make start"
+	@echo "🟢 Edgeboxctl installed successfully\n"
 
 install-prod: build-prod install
 install-cloud: build-cloud install
@@ -61,11 +91,24 @@ install-armhf: build-armhf install
 install-amd64: build-amd64 install
 
 start:
+	@echo "\n 🚀 Starting edgeboxctl service\n"
 	systemctl start edgeboxctl
+	@echo "\n 🟢 Edgebox service started\n"
 
 stop:
+	@echo "\n✋ Stopping edgeboxctl service\n"
 	systemctl stop edgeboxctl
+	@echo "\n 🟢 Edgebox service stopped\n"
 
-log: start
+restart:
+	@echo "\n💫 Restarting edgeboxctl service\n"
+	systemctl restart edgeboxctl
+	@echo "\n 🟢 Edgebox service restarted\n"
+
+status:
+	@echo "\nℹ️ edgeboxctl Service Info:\n"
+	systemctl status edgeboxctl
+
+log:
+	@echo "\n📰 edgeboxctl service logs:\n"
 	journalctl -fu edgeboxctl
-

README.md

@@ -8,7 +8,7 @@
   <h3 align="center">Edgebox Control Module</h3>
 
   <p align="center">
-    A System Control module written in Go. Its resonsability is to configure dependencies and perform system tasks, automatically in a schedule, or by command.
+    A System Control module written in Go. Its responsibility is to configure dependencies and perform system tasks, automatically on a schedule, or on demand.
     <br />
     <br />
     <a href="https://github.com/github_username/edgeboxctl/issues">Report Bug</a>
@@ -38,8 +38,6 @@
 <!-- ABOUT THE PROJECT -->
 ## About The Project
 
-[![Edgebox Screen Shot][product-screenshot]](https://edgebox.co)
-
 Edgebox is an easy to configure and use system. It brings powerful features that go alongside or can even completely replace various services that you already use in the day-to-day.
 
 
@@ -58,18 +56,17 @@ To get a local copy up and running follow these simple steps.
 
 ### Prerequisites
 
-If you're installing this to run natively in the system, you better be doing it inside of the [Development Virtual Machine](https://github.com/edgebox-iot/devm). This software can do destructive action in the system is is running. You've been warned.
+If you're running for development purposes, a docker container suffices, so make sure you have:
 
-If you're running for development purposes, a Docker container suffices, so make sure you have:
+* docker
-* Docker
+* docker compose (docker-compose-v2 package)
-* Docker Compose
-```sh
-sudo apt-get install docker docker-compose
-```
 
 Check the following links for more info on [Docker](https://www.docker.com/) and [Docker Compose](https://docs.docker.com/compose/).
 
-Aditionally, edgeboxctl needs the following bash commands available wherever it runs:
+**Note:** If you don't have `docker compose` available, install it with: `sudo apt-get install docker-compose-v2`
+
+Aditionally, `edgeboxctl` needs the following bash commands available wherever it runs:
+
 * `arm-linux-gnueabi-gcc` (`sudo apt-get install gcc-arm*`)
 * `sh`
 * `rm`
@@ -84,10 +81,10 @@ Aditionally, edgeboxctl needs the following bash commands available wherever it
 ```sh
 git clone https://github.com/edgebox-iot/edgeboxctl.git
 ```
-2. Run Docker-Compose
+2. Run Docker Compose
-```sh
+
-docker-compose up
 ```
+docker compose up
 
 
 
@@ -121,4 +118,4 @@ Contributions are what make the open source community such an amazing place to b
 <!-- LICENSE -->
 ## License
 
-Distributed under the MIT License. See `LICENSE` for more information.
+Distributed under the Elastic License 2.0. See `LICENSE` for more information.

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/dustin/go-humanize v1.0.0 // indirect
 	github.com/go-ole/go-ole v1.2.5 // indirect
 	github.com/go-sql-driver/mysql v1.5.0
+	github.com/go-yaml/yaml v2.1.0+incompatible // indirect
 	github.com/joho/godotenv v1.3.0
 	github.com/mattn/go-sqlite3 v1.14.7 // indirect
 	github.com/shirou/gopsutil v3.21.4+incompatible // indirect

go.sum

@@ -11,6 +11,8 @@ github.com/go-ole/go-ole v1.2.5 h1:t4MGB5xEDZvXI+0rMjjsfBsD7yAgp/s9ZDkL1JndXwY=
 github.com/go-ole/go-ole v1.2.5/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-yaml/yaml v2.1.0+incompatible h1:RYi2hDdss1u4YE7GwixGzWwVo47T8UQwnTLB6vQiq+o=
+github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=

internal/edgeapps/edgeapps.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/edgebox-iot/edgeboxctl/internal/system"
 	"github.com/edgebox-iot/edgeboxctl/internal/utils"
+	"github.com/edgebox-iot/edgeboxctl/internal/diagnostics"
 )
 
 // EdgeApp : Struct representing an EdgeApp in the system
@@ -18,6 +19,7 @@ type EdgeApp struct {
 	ID                 string           `json:"id"`
 	Name               string           `json:"name"`
 	Description        string           `json:"description"`
+	Experimental	   bool             `json:"experimental"`
 	Status             EdgeAppStatus    `json:"status"`
 	Services           []EdgeAppService `json:"services"`
 	InternetAccessible bool             `json:"internet_accessible"`
@@ -25,6 +27,7 @@ type EdgeApp struct {
 	InternetURL        string           `json:"internet_url"`
 	Options			   []EdgeAppOption  `json:"options"`
 	NeedsConfig		   bool             `json:"needs_config"`
+	Login              EdgeAppLogin	 	`json:"login"`
 }
 
 // MaybeEdgeApp : Boolean flag for validation of edgeapp existance
@@ -55,11 +58,20 @@ type EdgeAppOption struct {
 	IsInstallLocked bool   `json:"is_install_locked"`
 }
 
+type EdgeAppLogin struct {
+	Enabled  bool   `json:"enabled"`
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
 const configFilename = "/edgebox-compose.yml"
 const envFilename = "/edgebox.env"
 const optionsTemplateFilename = "/edgeapp.template.env"
 const optionsEnvFilename = "/edgeapp.env"
+const authEnvFilename = "/auth.env"
 const runnableFilename = "/.run"
+const appdataFoldername = "/appdata"
+const postInstallFilename = "/edgebox-postinstall.done"
 const myEdgeAppServiceEnvFilename = "/myedgeapp.env"
 const defaultContainerOperationSleepTime time.Duration = time.Second * 10
 
@@ -77,6 +89,7 @@ func GetEdgeApp(ID string) MaybeEdgeApp {
 
 		edgeAppName := ID
 		edgeAppDescription := ""
+		edgeAppExperimental := false
 		edgeAppOptions := []EdgeAppOption{}
 
 		edgeAppEnv, err := godotenv.Read(utils.GetPath(utils.EdgeAppsPath) + ID + envFilename)
@@ -90,6 +103,9 @@ func GetEdgeApp(ID string) MaybeEdgeApp {
 			if edgeAppEnv["EDGEAPP_DESCRIPTION"] != "" {
 				edgeAppDescription = edgeAppEnv["EDGEAPP_DESCRIPTION"]
 			}
+			if edgeAppEnv["EDGEAPP_EXPERIMENTAL"] == "true" {
+				edgeAppExperimental = true
+			}
 		}
 
 		needsConfig := false
@@ -202,11 +218,27 @@ func GetEdgeApp(ID string) MaybeEdgeApp {
 			}
 		}
 
+		edgeAppBasicAuthEnabled := false
+		edgeAppBasicAuthUsername := ""
+		edgeAppBasicAuthPassword := ""
+
+		edgeAppAuthEnv, err := godotenv.Read(utils.GetPath(utils.EdgeAppsPath) + ID + authEnvFilename)
+		if err != nil {
+			log.Println("No auth.env file found. Login status is disabled.")
+		} else {
+			if edgeAppAuthEnv["USERNAME"] != "" && edgeAppAuthEnv["PASSWORD"] != "" {
+				edgeAppBasicAuthEnabled = true
+				edgeAppBasicAuthUsername = edgeAppAuthEnv["USERNAME"]
+				edgeAppBasicAuthPassword = edgeAppAuthEnv["PASSWORD"]
+			}
+		}
+
 		result = MaybeEdgeApp{
 			EdgeApp: EdgeApp{
 				ID:                 ID,
 				Name:               edgeAppName,
 				Description:        edgeAppDescription,
+				Experimental:       edgeAppExperimental,
 				Status:             GetEdgeAppStatus(ID),
 				Services:           GetEdgeAppServices(ID),
 				InternetAccessible: edgeAppInternetAccessible,
@@ -214,6 +246,8 @@ func GetEdgeApp(ID string) MaybeEdgeApp {
 				InternetURL:        edgeAppInternetURL,
 				Options: 		    edgeAppOptions,
 				NeedsConfig:        needsConfig,
+				Login:				EdgeAppLogin{edgeAppBasicAuthEnabled, edgeAppBasicAuthUsername, edgeAppBasicAuthPassword},
+				
 			},
 			Valid: true,
 		}
@@ -237,22 +271,54 @@ func IsEdgeAppInstalled(ID string) bool {
 
 }
 
+func writeAppRunnableFiles(ID string) bool {
+	edgeAppPath := utils.GetPath(utils.EdgeAppsPath)
+	_, err := os.Stat(edgeAppPath + ID + runnableFilename)
+	if os.IsNotExist(err) {
+		_, err := os.Create(edgeAppPath + ID + runnableFilename)
+		if err != nil {
+			log.Fatal("Runnable file for EdgeApp could not be created!")
+			return false
+		}
+
+		// Check the block default apps option
+        blockDefaultAppsOption := utils.ReadOption("DASHBOARD_BLOCK_DEFAULT_APPS_PUBLIC_ACCESS")
+        if blockDefaultAppsOption != "yes" {
+            // Create myedgeapp.env file with default network URL
+            envFilePath := edgeAppPath + ID + myEdgeAppServiceEnvFilename
+            
+			var networkURL string
+			domainName := utils.ReadOption("DOMAIN_NAME")
+
+			if domainName != "" {
+				networkURL = ID + "." + domainName
+			} else if diagnostics.GetReleaseVersion() == diagnostics.CLOUD_VERSION {
+				cluster := utils.ReadOption("CLUSTER") 
+				username := utils.ReadOption("USERNAME")
+				if cluster != "" && username != "" {
+					networkURL = username + "-" + ID + "." + cluster
+				}
+			} else {
+				networkURL = ID + "." + system.GetHostname() + ".local" // default 
+			}
+			
+            env, _ := godotenv.Unmarshal("INTERNET_URL=" + networkURL)
+            err = godotenv.Write(env, envFilePath)
+            if err != nil {
+                log.Printf("Error creating myedgeapp.env file: %s", err)
+                // result = false
+            }
+        }
+	}
+	return true
+}
+
 func SetEdgeAppInstalled(ID string) bool {
 
 	result := true
-	edgeAppPath := utils.GetPath(utils.EdgeAppsPath)
-
-	_, err := os.Stat(edgeAppPath + ID + runnableFilename)
-	if os.IsNotExist(err) {
-
-		_, err := os.Create(edgeAppPath + ID + runnableFilename)
-		result = true
-
-		if err != nil {
-			log.Fatal("Runnable file for EdgeApp could not be created!")
-			result = false
-		}
 
+	if writeAppRunnableFiles(ID) {
+		
 		buildFrameworkContainers()
 
 	} else {
@@ -266,13 +332,63 @@ func SetEdgeAppInstalled(ID string) bool {
 
 }
 
-func SetEdgeAppNotInstalled(ID string) bool {
+func SetEdgeAppBulkInstalled(IDs []string) bool {
 
 	result := true
+
+	for _, ID := range IDs {
+		writeAppRunnableFiles(ID)
+	}
+
+	buildFrameworkContainers()
+
+	return result
+
+}
+
+
+func SetEdgeAppNotInstalled(ID string) bool {
+
+	// Stop the app first
+	StopEdgeApp(ID)
+
+	// Now remove any files
+	result := true
+	
 	err := os.Remove(utils.GetPath(utils.EdgeAppsPath) + ID + runnableFilename)
 	if err != nil {
 		result = false
-		log.Fatal(err)
+		log.Println(err)
+	}
+
+	err = os.Remove(utils.GetPath(utils.EdgeAppsPath) + ID + authEnvFilename)
+	if err != nil {
+		result = false
+		log.Println(err)
+	}
+
+	err = os.RemoveAll(utils.GetPath(utils.EdgeAppsPath) + ID + appdataFoldername)
+	if err != nil {
+		result = false
+		log.Println(err)
+	}
+
+	err = os.Remove(utils.GetPath(utils.EdgeAppsPath) + ID + myEdgeAppServiceEnvFilename)
+	if err != nil {
+		result = false
+		log.Println(err)
+	}
+
+	err = os.Remove(utils.GetPath(utils.EdgeAppsPath) + ID + optionsEnvFilename)
+	if err != nil {
+		result = false
+		log.Println(err)
+	}
+
+	err = os.Remove(utils.GetPath(utils.EdgeAppsPath) + ID + postInstallFilename)
+	if err != nil {
+		result = false
+		log.Println(err)
 	}
 
 	buildFrameworkContainers()
@@ -361,12 +477,24 @@ func GetEdgeAppServices(ID string) []EdgeAppService {
 	var edgeAppServices []EdgeAppService
 
 	for _, serviceID := range serviceSlices {
-		cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "exec", "-T", serviceID, "echo", "'Service Check'"}
+		shouldBeRunning := false
-		cmdResult := utils.Exec(wsPath, "docker-compose", cmdArgs)
 		isRunning := false
-		if cmdResult != "" {
+
-			isRunning = true
+		// Is service "runnable" when .run lockfile in the app folder
+		_, err := os.Stat(utils.GetPath(utils.EdgeAppsPath) + ID + runnableFilename)
+		if !os.IsNotExist(err) {
+			shouldBeRunning = true
 		}
+
+		// Check if the service is actually running
+		if shouldBeRunning {
+			cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "exec", "-T", serviceID, "echo", "'Service Check'"}
+			cmdResult := utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
+			if cmdResult != "" {
+				isRunning = true
+			}
+		}
+
 		edgeAppServices = append(edgeAppServices, EdgeAppService{ID: serviceID, IsRunning: isRunning})
 	}
 
@@ -383,7 +511,7 @@ func RunEdgeApp(ID string) EdgeAppStatus {
 	for _, service := range services {
 
 		cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "start", service.ID}
-		utils.Exec(wsPath, "docker-compose", cmdArgs)
+		utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 	}
 
 	// Wait for it to settle up before continuing...
@@ -401,7 +529,7 @@ func StopEdgeApp(ID string) EdgeAppStatus {
 	for _, service := range services {
 
 		cmdArgs = []string{"-f", wsPath + "/docker-compose.yml", "stop", service.ID}
-		utils.Exec(wsPath, "docker-compose", cmdArgs)
+		utils.Exec(wsPath, "docker", append([]string{"compose"}, cmdArgs...))
 	}
 
 	// Wait for it to settle up before continuing...

internal/storage/storage.go

@@ -2,6 +2,7 @@ package storage
 
 import (
 	"fmt"
+	"strconv"
 	"os"
 	"path/filepath"
 	"strings"
@@ -73,12 +74,13 @@ const (
 	DISK_TYPE_SDA   DeviceIdentifier = "sda"
 	DISK_TYPE_MCBLK DeviceIdentifier = "mmcblk0"
 	DISK_TYPE_VDA   DeviceIdentifier = "vda"
+	MIN_DISK_SIZE   int              = 1048576 // 1GB in bytes
 )
 
 func GetDeviceIdentifier(release_version diagnostics.ReleaseVersion) DeviceIdentifier {
 	switch release_version {
 	case diagnostics.CLOUD_VERSION:
-		return DISK_TYPE_VDA
+		return DISK_TYPE_SDA
 	case diagnostics.PROD_VERSION:
 		return DISK_TYPE_MCBLK
 	}
@@ -134,7 +136,13 @@ func GetDevices(release_version diagnostics.ReleaseVersion) []Device {
 				currentDevice.InUse = currentDeviceInUseFlag
 				currentDeviceInUseFlag = false
 				currentPartitions = []Partition{}
-				devices = append(devices, currentDevice)
+				size, err := strconv.Atoi(currentDevice.Size)
+				if err != nil {
+					size = 0
+				}
+				if size > MIN_DISK_SIZE {
+					devices = append(devices, currentDevice)
+				}
 			} else {
 				firstDevice = false
 			}
@@ -193,8 +201,22 @@ func GetDevices(release_version diagnostics.ReleaseVersion) []Device {
 		currentDevice.Status.Description = "Not configured"
 	}
 	currentDevice.InUse = currentDeviceInUseFlag
-	devices = append([]Device{currentDevice}, devices...) // Prepending the first device...
 
+	fmt.Println("Secondary Storage Devices Found: ", len(devices))
+	fmt.Println("Main Storage Device size: ", currentDevice.Size)
+
+	// only append device if size > 1GB
+	if currentDevice.Size != "" && currentDevice.Size != "0" {
+		// Convert size to int
+		// Convert string to int
+		size, err := strconv.Atoi(currentDevice.Size)
+		if err != nil {
+			size = 0
+		}
+		if size > MIN_DISK_SIZE {
+			devices = append([]Device{currentDevice}, devices...) // Prepending the first device...
+		}
+	}
 	devices = getDevicesSpaceUsage(devices)
 
 	return devices

internal/system/system.go

@@ -7,6 +7,7 @@ import (
 	"log"
 	"os"
 	"io"
+	"errors"
 	"os/exec"
 	"bufio"
 	"path/filepath"
@@ -17,6 +18,7 @@ import (
 
 	"github.com/joho/godotenv"
 	"github.com/shirou/gopsutil/host"
+	"github.com/go-yaml/yaml"
 )
 
 type cloudflaredTunnelJson struct {
@@ -425,3 +427,174 @@ func CopyFile(src string, dest string) error {
     return nil
 }
 
+func CheckUpdates() {
+	fmt.Println("Checking for Edgebox System Updates.")
+	
+	// Configure the service and start it
+	cmd := exec.Command("sh", "/home/system/components/updater/run.sh", "--check")
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		panic(err)
+	}
+	scanner := bufio.NewScanner(stdout)
+	err = cmd.Start()
+	if err != nil {
+		panic(err)
+	}
+	for scanner.Scan() {
+		// fmt.Println(scanner.Text())
+		text := scanner.Text()
+		fmt.Println(text)
+	}
+	if scanner.Err() != nil {
+		cmd.Process.Kill()
+		cmd.Wait()
+		fmt.Println("Error running updates check.")
+		utils.WriteOption("SYSTEM_UPDATES", "[]")
+		return
+	}
+
+	// Read targets.env file into JSON list structure
+	targets := []string{}
+	targetsFile, err := os.Open("/home/system/components/updater/targets.env")
+	if err != nil {
+		fmt.Println("No targets.env file found. Skipping.")
+		utils.WriteOption("SYSTEM_UPDATES", "[]")
+		return
+	}
+	defer targetsFile.Close()
+	scanner = bufio.NewScanner(targetsFile)
+	for scanner.Scan() {
+		text := scanner.Text()
+		// text line should look like: {"target": "<target>", "version": "<version>"}
+		target := strings.Split(text, "=")
+		newText := "{\"target\": \"" + strings.Replace(target[0], "_VERSION", "", -1) + "\", \"version\": \"" + target[1] + "\"}"
+		targets = append(targets, newText)
+	}
+	if scanner.Err() != nil {
+		fmt.Println("Error reading update targets file.")
+		utils.WriteOption("SYSTEM_UPDATES", "[]")
+		return
+	}
+
+	// convert targets to string
+	targetsString := strings.Join(targets, ",")
+	targetsString = "[" + targetsString + "]"
+
+	fmt.Println(targetsString)
+
+	// Write option with targets
+	utils.WriteOption("SYSTEM_UPDATES", targetsString)
+}
+
+func ApplyUpdates() {
+	fmt.Println("Applying Edgebox System Updates.")
+
+	utils.WriteOption("UPDATING_SYSTEM", "true")
+	
+	// Configure the service and start it
+	cmd := exec.Command("sh", "/home/system/components/updater/run.sh", "--update")
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		panic(err)
+	}
+	scanner := bufio.NewScanner(stdout)
+	err = cmd.Start()
+	if err != nil {
+		panic(err)
+	}
+	for scanner.Scan() {
+		fmt.Println(scanner.Text())
+		text := scanner.Text()
+		fmt.Println(text)
+	}
+	if scanner.Err() != nil {
+		cmd.Process.Kill()
+		cmd.Wait()
+		panic(scanner.Err())
+	}
+
+	// If the system did not yet restart, set updating system to false
+	utils.WriteOption("UPDATING_SYSTEM", "false")
+}
+
+func FetchBrowserDevPasswordFromFile() (string, error) {
+	fmt.Println("Executing FetchBrowserDevPasswordFromFile")
+
+	// Read the "password" entry on the yaml file
+	// Read the yaml file in system.GetPath(BrowserDevPasswordFileLocation)
+	yamlFile, err := ioutil.ReadFile(utils.GetPath(utils.BrowserDevPasswordFileLocation))
+	if err != nil {
+		return "", err
+	}
+
+	// Parse the yaml file and get the "password" entry
+	var yamlFileMap yaml.MapSlice
+	err = yaml.Unmarshal(yamlFile, &yamlFileMap)
+	if err != nil {
+		return "", err
+	}
+
+	for _, item := range yamlFileMap {
+        key, value := item.Key, item.Value
+        if key == "password" {
+            if pwString, ok := value.(string); ok {
+                return pwString, nil
+            } else {
+                return "", errors.New("password value is not a string")
+            }
+        }
+    }
+    return "", errors.New("password key not found")
+}
+
+func SetBrowserDevPasswordFile(password string) error {
+	// Get current password from file
+	currentPassword, err := FetchBrowserDevPasswordFromFile()
+	if err != nil {
+		fmt.Println("Error fetching current password from file.")
+		return err
+	}
+
+	// Write the new password on the file using ReplaceTextInFile
+	err = ReplaceTextInFile(utils.GetPath(utils.BrowserDevPasswordFileLocation), currentPassword, password)
+	if err != nil {
+		fmt.Println("Error writing new password to file.")
+		return err
+	}
+
+	return nil
+}
+
+func ReplaceTextInFile(filePath string, oldText string, newText string) error {
+	// Open the file for reading
+	file, err := os.OpenFile(filePath, os.O_RDWR, 0644)
+	if err != nil {
+		return err
+	}
+
+	// Read the file contents
+	data, err := ioutil.ReadAll(file)
+	if err != nil {
+		return err
+	}
+
+	// Close the file
+	err = file.Close()
+	if err != nil {
+		return err
+	}
+
+	// Replace the text in the file
+	newData := strings.Replace(string(data), oldText, newText, -1)
+
+	// Write the new data back to the file
+	err = ioutil.WriteFile(filePath, []byte(newData), 0644)
+	if err != nil {
+		return err
+	}
+	
+	return nil
+}
+		
+

internal/tasks/ssh_access.go

@@ -0,0 +1,217 @@
+package tasks
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/edgebox-iot/edgeboxctl/internal/utils"
+)
+
+const (
+	sshDirectory      = "/root/.ssh"
+	managedSSHComment = "edgebox-dashboard-managed"
+)
+
+type sshAccessResult struct {
+	Status      string `json:"status"`
+	PublicKey   string `json:"public_key,omitempty"`
+	Fingerprint string `json:"fingerprint,omitempty"`
+}
+
+func taskEnableSSHAccess(args taskEnableSSHAccessArgs) (string, error) {
+	if err := verifyRootSSHAccess(); err != nil {
+		return "", err
+	}
+
+	publicKey, fingerprint, err := parseSSHEd25519PublicKey(args.PublicKey)
+	if err != nil {
+		return "", err
+	}
+
+	if err := reconcileManagedSSHKey(sshDirectory, publicKey); err != nil {
+		return "", err
+	}
+
+	utils.WriteOption("SSH_ACCESS_ENABLED", "true")
+	utils.WriteOption("SSH_PUBLIC_KEY", publicKey)
+	utils.WriteOption("SSH_KEY_FINGERPRINT", fingerprint)
+
+	result, err := json.Marshal(sshAccessResult{
+		Status:      "enabled",
+		PublicKey:   publicKey,
+		Fingerprint: fingerprint,
+	})
+	if err != nil {
+		return "", err
+	}
+
+	return string(result), nil
+}
+
+func taskDisableSSHAccess() (string, error) {
+	if err := reconcileManagedSSHKey(sshDirectory, ""); err != nil {
+		return "", err
+	}
+
+	utils.WriteOption("SSH_ACCESS_ENABLED", "false")
+	utils.DeleteOption("SSH_PUBLIC_KEY")
+	utils.DeleteOption("SSH_KEY_FINGERPRINT")
+
+	result, err := json.Marshal(sshAccessResult{Status: "disabled"})
+	if err != nil {
+		return "", err
+	}
+
+	return string(result), nil
+}
+
+func parseSSHEd25519PublicKey(input string) (string, string, error) {
+	trimmed := strings.TrimSpace(input)
+	if trimmed == "" || strings.ContainsAny(trimmed, "\r\n") {
+		return "", "", fmt.Errorf("provide exactly one SSH public key")
+	}
+
+	fields := strings.Fields(trimmed)
+	if len(fields) < 2 || len(fields) > 3 || fields[0] != "ssh-ed25519" {
+		return "", "", fmt.Errorf("only one ssh-ed25519 public key is supported")
+	}
+
+	keyBlob, err := base64.StdEncoding.DecodeString(fields[1])
+	if err != nil || !validEd25519KeyBlob(keyBlob) {
+		return "", "", fmt.Errorf("invalid ssh-ed25519 public key")
+	}
+
+	digest := sha256.Sum256(keyBlob)
+	publicKey := "ssh-ed25519 " + base64.StdEncoding.EncodeToString(keyBlob) + " " + managedSSHComment
+	fingerprint := "SHA256:" + base64.RawStdEncoding.EncodeToString(digest[:])
+
+	return publicKey, fingerprint, nil
+}
+
+func validEd25519KeyBlob(blob []byte) bool {
+	if len(blob) < 4 {
+		return false
+	}
+
+	typeLength := int(binary.BigEndian.Uint32(blob[:4]))
+	if typeLength != len("ssh-ed25519") || len(blob) < 4+typeLength+4 {
+		return false
+	}
+	if string(blob[4:4+typeLength]) != "ssh-ed25519" {
+		return false
+	}
+
+	keyLengthOffset := 4 + typeLength
+	keyLength := int(binary.BigEndian.Uint32(blob[keyLengthOffset : keyLengthOffset+4]))
+	return keyLength == 32 && len(blob) == keyLengthOffset+4+keyLength
+}
+
+func reconcileManagedSSHKey(directory string, publicKey string) error {
+	if info, err := os.Lstat(directory); err == nil {
+		if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+			return fmt.Errorf("SSH directory is not a regular directory")
+		}
+	} else if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect SSH directory: %w", err)
+	} else if err := os.MkdirAll(directory, 0700); err != nil {
+		return fmt.Errorf("create SSH directory: %w", err)
+	}
+
+	if err := os.Chmod(directory, 0700); err != nil {
+		return fmt.Errorf("secure SSH directory: %w", err)
+	}
+
+	authorizedKeysPath := filepath.Join(directory, "authorized_keys")
+	if info, err := os.Lstat(authorizedKeysPath); err == nil && info.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("authorized_keys must not be a symbolic link")
+	} else if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("inspect authorized_keys: %w", err)
+	}
+
+	existing, err := os.ReadFile(authorizedKeysPath)
+	if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("read authorized_keys: %w", err)
+	}
+
+	lines := strings.Split(string(existing), "\n")
+	kept := make([]string, 0, len(lines)+1)
+	for _, line := range lines {
+		if strings.TrimSpace(line) == "" || isManagedSSHKey(line) {
+			continue
+		}
+		kept = append(kept, line)
+	}
+	if publicKey != "" {
+		kept = append(kept, publicKey)
+	}
+
+	contents := ""
+	if len(kept) > 0 {
+		contents = strings.Join(kept, "\n") + "\n"
+	}
+
+	temporary, err := os.CreateTemp(directory, ".authorized_keys-*")
+	if err != nil {
+		return fmt.Errorf("create authorized_keys temporary file: %w", err)
+	}
+	temporaryPath := temporary.Name()
+	defer os.Remove(temporaryPath)
+
+	if err := temporary.Chmod(0600); err != nil {
+		temporary.Close()
+		return fmt.Errorf("secure authorized_keys temporary file: %w", err)
+	}
+	if _, err := temporary.WriteString(contents); err != nil {
+		temporary.Close()
+		return fmt.Errorf("write authorized_keys: %w", err)
+	}
+	if err := temporary.Sync(); err != nil {
+		temporary.Close()
+		return fmt.Errorf("sync authorized_keys: %w", err)
+	}
+	if err := temporary.Close(); err != nil {
+		return fmt.Errorf("close authorized_keys: %w", err)
+	}
+	if err := os.Rename(temporaryPath, authorizedKeysPath); err != nil {
+		return fmt.Errorf("replace authorized_keys: %w", err)
+	}
+
+	return nil
+}
+
+func isManagedSSHKey(line string) bool {
+	fields := strings.Fields(line)
+	return len(fields) == 3 && fields[2] == managedSSHComment
+}
+
+func verifyRootSSHAccess() error {
+	sshdPath, err := exec.LookPath("sshd")
+	if err != nil {
+		sshdPath = "/usr/sbin/sshd"
+		if _, statErr := os.Stat(sshdPath); statErr != nil {
+			return fmt.Errorf("OpenSSH server is not installed")
+		}
+	}
+
+	output, err := exec.Command(sshdPath, "-T").Output()
+	if err != nil {
+		return fmt.Errorf("could not verify the effective SSH server configuration")
+	}
+
+	settings := string(output)
+	if !strings.Contains(settings, "pubkeyauthentication yes") {
+		return fmt.Errorf("SSH public-key authentication is disabled")
+	}
+	if strings.Contains(settings, "permitrootlogin no") {
+		return fmt.Errorf("SSH root login is disabled")
+	}
+
+	return nil
+}

internal/tasks/ssh_access_test.go

@@ -0,0 +1,111 @@
+package tasks
+
+import (
+	"encoding/base64"
+	"encoding/binary"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func testPublicKey(t *testing.T) string {
+	t.Helper()
+	blob := make([]byte, 4+len("ssh-ed25519")+4+32)
+	binary.BigEndian.PutUint32(blob[:4], uint32(len("ssh-ed25519")))
+	copy(blob[4:], "ssh-ed25519")
+	offset := 4 + len("ssh-ed25519")
+	binary.BigEndian.PutUint32(blob[offset:offset+4], 32)
+	for index := 0; index < 32; index++ {
+		blob[offset+4+index] = byte(index + 1)
+	}
+	return "ssh-ed25519 " + base64.StdEncoding.EncodeToString(blob) + " workstation"
+}
+
+func TestParseSSHEd25519PublicKey(t *testing.T) {
+	publicKey, fingerprint, err := parseSSHEd25519PublicKey(testPublicKey(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasSuffix(publicKey, " "+managedSSHComment) {
+		t.Fatalf("public key does not have managed marker: %q", publicKey)
+	}
+	if !strings.HasPrefix(fingerprint, "SHA256:") {
+		t.Fatalf("unexpected fingerprint: %q", fingerprint)
+	}
+}
+
+func TestParseSSHEd25519PublicKeyRejectsUnsafeInput(t *testing.T) {
+	inputs := []string{
+		"",
+		"-----BEGIN OPENSSH PRIVATE KEY-----",
+		testPublicKey(t) + "\n" + testPublicKey(t),
+		"command=whoami " + testPublicKey(t),
+		"ssh-rsa AAAA invalid",
+	}
+	for _, input := range inputs {
+		if _, _, err := parseSSHEd25519PublicKey(input); err == nil {
+			t.Fatalf("expected input to be rejected: %q", input)
+		}
+	}
+}
+
+func TestReconcileManagedSSHKeyPreservesUnrelatedKeys(t *testing.T) {
+	directory := t.TempDir()
+	authorizedKeysPath := filepath.Join(directory, "authorized_keys")
+	original := "# operator key\nssh-ed25519 AAAAoperator operator\n"
+	if err := os.WriteFile(authorizedKeysPath, []byte(original), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	publicKey, _, err := parseSSHEd25519PublicKey(testPublicKey(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := reconcileManagedSSHKey(directory, publicKey); err != nil {
+		t.Fatal(err)
+	}
+	if err := reconcileManagedSSHKey(directory, publicKey); err != nil {
+		t.Fatal(err)
+	}
+
+	contents, err := os.ReadFile(authorizedKeysPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Count(string(contents), managedSSHComment) != 1 {
+		t.Fatalf("managed key is not idempotent: %s", contents)
+	}
+	if !strings.Contains(string(contents), original) {
+		t.Fatalf("unrelated content was changed: %s", contents)
+	}
+	if info, err := os.Stat(authorizedKeysPath); err != nil || info.Mode().Perm() != 0600 {
+		t.Fatalf("authorized_keys mode is not 0600: %v, %v", info, err)
+	}
+
+	if err := reconcileManagedSSHKey(directory, ""); err != nil {
+		t.Fatal(err)
+	}
+	contents, err = os.ReadFile(authorizedKeysPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(contents) != original {
+		t.Fatalf("disable changed unrelated content: %q", contents)
+	}
+}
+
+func TestReconcileManagedSSHKeyRejectsSymlink(t *testing.T) {
+	directory := t.TempDir()
+	target := filepath.Join(directory, "target")
+	if err := os.WriteFile(target, []byte("preserve me"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, filepath.Join(directory, "authorized_keys")); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := reconcileManagedSSHKey(directory, ""); err == nil {
+		t.Fatal("expected symlink to be rejected")
+	}
+}

internal/tasks/tasks.go

@@ -1,16 +1,16 @@
 package tasks
 
 import (
+	"bufio"
 	"database/sql"
 	"encoding/json"
 	"fmt"
 	"log"
-	"strconv"
-	"time"
-	"os/exec"
-	"strings"
 	"os"
-	"bufio"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
 
 	"github.com/edgebox-iot/edgeboxctl/internal/diagnostics"
 	"github.com/edgebox-iot/edgeboxctl/internal/edgeapps"
@@ -18,6 +18,8 @@ import (
 	"github.com/edgebox-iot/edgeboxctl/internal/system"
 	"github.com/edgebox-iot/edgeboxctl/internal/utils"
 
+	"github.com/joho/godotenv"
+
 	_ "github.com/go-sql-driver/mysql" // Mysql Driver
 	_ "github.com/mattn/go-sqlite3"    // SQlite Driver
 )
@@ -39,6 +41,11 @@ type TaskOption struct {
 	Value string `json:"value"`
 }
 
+type TaskBasicAuth struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
 type taskSetupTunnelArgs struct {
 	DomainName string `json:"domain_name"`
 }
@@ -51,6 +58,10 @@ type taskInstallEdgeAppArgs struct {
 	ID string `json:"id"`
 }
 
+type taskInstallBulkEdgeAppsArgs struct {
+	IDS []string `json:"ids"`
+}
+
 type taskRemoveEdgeAppArgs struct {
 	ID string `json:"id"`
 }
@@ -65,6 +76,15 @@ type taskSetEdgeAppOptionsArgs struct {
 	Options []TaskOption `json:"options"`
 }
 
+type taskSetEdgeAppBasicAuthArgs struct {
+	ID    string        `json:"id"`
+	Login TaskBasicAuth `json:"login"`
+}
+
+type taskRemoveEdgeAppBasicAuthArgs struct {
+	ID string `json:"id"`
+}
+
 type taskEnableOnlineArgs struct {
 	ID          string `json:"id"`
 	InternetURL string `json:"internet_url"`
@@ -79,13 +99,24 @@ type taskEnablePublicDashboardArgs struct {
 }
 
 type taskSetupBackupsArgs struct {
-	Service string `json:"service"`
+	Service            string `json:"service"`
-	AccessKeyID string `json:"access_key_id"`
+	AccessKeyID        string `json:"access_key_id"`
-	SecretAccessKey string `json:"secret_access_key"`
+	SecretAccessKey    string `json:"secret_access_key"`
-	RepositoryName string `json:"repository_name"`
+	RepositoryName     string `json:"repository_name"`
 	RepositoryPassword string `json:"repository_password"`
 }
 
+type taskStartShellArgs struct {
+	Timeout int `json:"timeout"`
+}
+
+type taskSetBrowserDevPasswordArgs struct {
+	Password string `json:"password"`
+}
+
+type taskEnableSSHAccessArgs struct {
+	PublicKey string `json:"public_key"`
+}
 
 const STATUS_CREATED int = 0
 const STATUS_EXECUTING int = 1
@@ -128,6 +159,33 @@ func GetNextTask() Task {
 
 }
 
+// GetExecutingTasks : Performs a MySQL query over the device's Edgebox API to obtain all tasks that are currently executing
+func GetExecutingTasks() []Task {
+	// Will try to connect to API database, which should be running locally under WS.
+	db, err := sql.Open("sqlite3", utils.GetSQLiteDbConnectionDetails())
+	if err != nil {
+		panic(err.Error())
+	}
+	results, err := db.Query("SELECT id, task, args, status, result, created, updated FROM task WHERE status = 1;")
+	if err != nil {
+		panic(err.Error())
+	}
+
+	var tasks []Task
+	for results.Next() {
+		// for each row, scan the result into our task composite object
+		var task Task
+		err = results.Scan(&task.ID, &task.Task, &task.Args, &task.Status, &task.Result, &task.Created, &task.Updated)
+		if err != nil {
+			panic(err.Error()) // proper error handling instead of panic in your app
+		}
+		tasks = append(tasks, task)
+	}
+	results.Close()
+	db.Close()
+	return tasks
+}
+
 // ExecuteTask : Performs execution of the given task, updating the task status as it goes, and publishing the task result
 func ExecuteTask(task Task) Task {
 
@@ -219,13 +277,34 @@ func ExecuteTask(task Task) Task {
 			log.Println("Stopping Cloudflare Tunnel...")
 			taskResult := taskStopTunnel()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
-		
+
 		case "disable_tunnel":
 
 			log.Println("Disabling Cloudflare Tunnel...")
 			taskResult := taskDisableTunnel()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
 
+		case "start_shell":
+			log.Println("Starting SSHX.io Shell")
+			var args taskStartShellArgs
+			err := json.Unmarshal([]byte(task.Args.String), &args)
+			if err != nil {
+				log.Printf("Error reading arguments or start_shell task: %s", err)
+			} else {
+				taskResult := taskStartShell(args)
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
+		case "stop_shell":
+			log.Println("Stopping SSHX.io Shell...")
+			taskResult := taskStopShell()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "activate_browser_dev":
+			log.Println("Activating Browser Dev Environment")
+			taskResult := taskActivateBrowserDev()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
 		case "install_edgeapp":
 
 			log.Println("Installing EdgeApp...")
@@ -238,6 +317,18 @@ func ExecuteTask(task Task) Task {
 				task.Result = sql.NullString{String: taskResult, Valid: true}
 			}
 
+		case "install_bulk_edgeapps":
+
+			log.Println("Installing Bulk EdgeApps...")
+			var args taskInstallBulkEdgeAppsArgs
+			err := json.Unmarshal([]byte(task.Args.String), &args)
+			if err != nil {
+				log.Printf("Error reading arguments of install_bulk_edgeapps task: %s", err)
+			} else {
+				taskResult := taskInstallBulkEdgeApps(args)
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
 		case "remove_edgeapp":
 
 			log.Println("Removing EdgeApp...")
@@ -287,6 +378,30 @@ func ExecuteTask(task Task) Task {
 				task.Result = sql.NullString{String: taskResult, Valid: true}
 			}
 
+		case "set_edgeapp_basic_auth":
+
+			log.Println("Settig EdgeApp Basic Authentication...")
+			var args taskSetEdgeAppBasicAuthArgs
+			err := json.Unmarshal([]byte(task.Args.String), &args)
+			if err != nil {
+				log.Printf("Error reading arguments of set_edgeapp_basic_auth task: %s", err)
+			} else {
+				taskResult := taskSetEdgeAppBasicAuth(args)
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
+		case "remove_edgeapp_basic_auth":
+
+			log.Println("Removing EdgeApp Basic Authentication...")
+			var args taskRemoveEdgeAppBasicAuthArgs
+			err := json.Unmarshal([]byte(task.Args.String), &args)
+			if err != nil {
+				log.Printf("Error reading arguments of remove_edgeapp_basic_auth task: %s", err)
+			} else {
+				taskResult := taskRemoveEdgeAppBasicAuth(args)
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
 		case "enable_online":
 
 			log.Println("Enabling online access to EdgeApp...")
@@ -329,6 +444,70 @@ func ExecuteTask(task Task) Task {
 			taskResult := taskDisablePublicDashboard()
 			task.Result = sql.NullString{String: taskResult, Valid: true}
 
+		case "check_updates":
+			log.Println("Checking for updates...")
+			taskResult := taskCheckSystemUpdates()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "apply_updates":
+
+			log.Println("Updating Edgebox System...")
+			is_updating := utils.ReadOption("UPDATING_SYSTEM")
+			if is_updating == "true" {
+				log.Println("Edgebox update was running... Probably system restarted. Finishing update...")
+				utils.WriteOption("UPDATING_SYSTEM", "false")
+				task.Result = sql.NullString{String: "{result: true}", Valid: true}
+			} else {
+				log.Println("Updating Edgebox System...")
+				taskResult := taskUpdateSystem()
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
+		case "set_browserdev_password":
+
+			log.Println("Setting BrowserDev Password...")
+			var args taskSetBrowserDevPasswordArgs
+			err := json.Unmarshal([]byte(task.Args.String), &args)
+			if err != nil {
+				log.Printf("Error reading arguments of set_browserdev_password task: %s", err)
+			} else {
+				taskResult := taskSetBrowserDevPassword(args)
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
+		case "activate_browserdev":
+
+			log.Println("Activating BrowserDev Environment...")
+			taskResult := taskActivateBrowserDev()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "deactivate_browserdev":
+
+			log.Println("Deactivating BrowserDev Environment...")
+			taskResult := taskDeactivateBrowserDev()
+			task.Result = sql.NullString{String: taskResult, Valid: true}
+
+		case "enable_ssh_access":
+			log.Println("Installing dashboard-managed SSH public key...")
+			var args taskEnableSSHAccessArgs
+			if err := json.Unmarshal([]byte(task.Args.String), &args); err != nil {
+				task.Result = sql.NullString{String: "invalid SSH access task arguments", Valid: false}
+			} else if taskResult, err := taskEnableSSHAccess(args); err != nil {
+				log.Printf("Error enabling SSH access: %s", err)
+				task.Result = sql.NullString{String: err.Error(), Valid: false}
+			} else {
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
+		case "disable_ssh_access":
+			log.Println("Removing dashboard-managed SSH public key...")
+			if taskResult, err := taskDisableSSHAccess(); err != nil {
+				log.Printf("Error disabling SSH access: %s", err)
+				task.Result = sql.NullString{String: err.Error(), Valid: false}
+			} else {
+				task.Result = sql.NullString{String: taskResult, Valid: true}
+			}
+
 		}
 
 	}
@@ -349,9 +528,14 @@ func ExecuteTask(task Task) Task {
 		if err != nil {
 			log.Fatal(err.Error())
 		}
+
 	} else {
 		fmt.Println("Error executing task with result: " + task.Result.String)
-		_, err = statement.Exec(STATUS_ERROR, "Error", formatedDatetime, strconv.Itoa(task.ID)) // Execute SQL Statement with Error info
+		errorResult := task.Result.String
+		if errorResult == "" {
+			errorResult = "Error"
+		}
+		_, err = statement.Exec(STATUS_ERROR, errorResult, formatedDatetime, strconv.Itoa(task.ID)) // Execute SQL Statement with Error info
 		if err != nil {
 			log.Fatal(err.Error())
 		}
@@ -374,6 +558,12 @@ func ExecuteSchedules(tick int) {
 
 	if tick == 1 {
 
+		log.Println("Fetching Browser Dev Environment Information")
+		taskGetBrowserDevPassword()
+		taskGetBrowserDevStatus()
+
+		taskCheckSystemUpdates()
+
 		ip := taskGetSystemIP()
 		log.Println("System IP is: " + ip)
 
@@ -402,6 +592,7 @@ func ExecuteSchedules(tick int) {
 		taskStartWs()
 		log.Println(taskGetEdgeApps())
 		taskUpdateSystemLoggerServices()
+		taskRecoverFromUpdate()
 	}
 
 	if tick%5 == 0 {
@@ -410,6 +601,10 @@ func ExecuteSchedules(tick int) {
 		log.Println(taskGetStorageDevices())
 	}
 
+	if tick%15 == 0 {
+		taskGetBrowserDevStatus()
+	}
+
 	if tick%30 == 0 {
 		// Executing every 30 ticks
 		log.Println(taskGetEdgeApps())
@@ -432,7 +627,7 @@ func ExecuteSchedules(tick int) {
 				} else {
 
 					log.Println("Last backup is " + fmt.Sprint(secondsSinceLastBackup) + " seconds old (less than 1 hour ago), skipping auto backup...")
-		
+
 				}
 			}
 		} else {
@@ -448,6 +643,9 @@ func ExecuteSchedules(tick int) {
 
 	if tick%3600 == 0 {
 		// Executing every 3600 ticks (1 hour)
+		taskGetBrowserDevStatus()
+		taskCheckSystemUpdates()
+
 	}
 
 	if tick%86400 == 0 {
@@ -470,17 +668,17 @@ func taskSetupBackups(args taskSetupBackupsArgs) string {
 	service_found := false
 
 	switch args.Service {
-		case "s3":
+	case "s3":
-			service_url = "s3.amazonaws.com/"
+		service_url = "s3.amazonaws.com/"
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			service_url = ""
+		service_url = ""
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
-			service_url = "s3.wasabisys.com/"
+		service_url = "s3.wasabisys.com/"
 	}
 
 	if !service_found {
@@ -493,14 +691,14 @@ func taskSetupBackups(args taskSetupBackupsArgs) string {
 	os.Setenv(key_secret_name, args.SecretAccessKey)
 
 	fmt.Println("Creating restic password file")
-	
+
 	system.CreateBackupsPasswordFile(args.RepositoryPassword)
 
 	fmt.Println("Initializing restic repository")
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	cmdArgs := []string{"-r", args.Service + ":" + service_url + args.RepositoryName + ":" + repo_location, "init", "--password-file", utils.GetPath(utils.BackupPasswordFileLocation), "--verbose=3"}
-	
+
 	result := utils.ExecAndStream(repo_location, "restic", cmdArgs)
 
 	utils.WriteOption("BACKUP_IS_WORKING", "0")
@@ -529,9 +727,9 @@ func taskSetupBackups(args taskSetupBackupsArgs) string {
 
 	// Populate Stats right away
 	taskGetBackupStatus()
-	
+
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskRemoveBackups() string {
@@ -540,12 +738,12 @@ func taskRemoveBackups() string {
 
 	// ...	This deletes the restic repository
 	// cmdArgs := []string{"-r", "s3:https://s3.amazonaws.com/edgebox-backups:/home/system/components/apps/", "forget", "latest", "--password-file", utils.GetPath(utils.BackupPasswordFileLocation), "--verbose=3"}
-	
+
 	utils.WriteOption("BACKUP_STATUS", "")
 	utils.WriteOption("BACKUP_IS_WORKING", "0")
 
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskBackup() string {
@@ -565,14 +763,14 @@ func taskBackup() string {
 	service_found := false
 
 	switch backup_service {
-		case "s3":
+	case "s3":
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
 	}
 
 	if !service_found {
@@ -586,7 +784,6 @@ func taskBackup() string {
 	fmt.Println(key_secret_name)
 	os.Setenv(key_secret_name, backup_repository_secret_access_key)
 
-
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	// ...	This backs up the restic repository
@@ -608,7 +805,7 @@ func taskBackup() string {
 	utils.WriteOption("BACKUP_STATUS", "working")
 	taskGetBackupStatus()
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskRestoreBackup() string {
@@ -628,14 +825,14 @@ func taskRestoreBackup() string {
 	service_found := false
 
 	switch backup_service {
-		case "s3":
+	case "s3":
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
 	}
 
 	if !service_found {
@@ -649,7 +846,6 @@ func taskRestoreBackup() string {
 	fmt.Println(key_secret_name)
 	os.Setenv(key_secret_name, backup_repository_secret_access_key)
 
-
 	utils.WriteOption("BACKUP_IS_WORKING", "1")
 
 	fmt.Println("Stopping All EdgeApps")
@@ -658,8 +854,8 @@ func taskRestoreBackup() string {
 
 	// Copy all files in /home/system/components/apps/ to a backup folder
 	fmt.Println("Copying all files in /home/system/components/apps/ to a backup folder")
-	os.MkdirAll(utils.GetPath(utils.EdgeAppsBackupPath + "temp/"), 0777)
+	os.MkdirAll(utils.GetPath(utils.EdgeAppsBackupPath+"temp/"), 0777)
-	system.CopyDir(utils.GetPath(utils.EdgeAppsPath), utils.GetPath(utils.EdgeAppsBackupPath + "temp/"))
+	system.CopyDir(utils.GetPath(utils.EdgeAppsPath), utils.GetPath(utils.EdgeAppsBackupPath+"temp/"))
 
 	fmt.Println("Removing all files in /home/system/components/apps/")
 	os.RemoveAll(utils.GetPath(utils.EdgeAppsPath))
@@ -682,7 +878,7 @@ func taskRestoreBackup() string {
 	if strings.Contains(result, "Fatal:") {
 		// Copy all files from backup folder to /home/system/components/apps/
 		os.MkdirAll(utils.GetPath(utils.EdgeAppsPath), 0777)
-		system.CopyDir(utils.GetPath(utils.EdgeAppsBackupPath + "temp/"), utils.GetPath(utils.EdgeAppsPath))
+		system.CopyDir(utils.GetPath(utils.EdgeAppsBackupPath+"temp/"), utils.GetPath(utils.EdgeAppsPath))
 
 		fmt.Println("Error restoring backup: ")
 		utils.WriteOption("BACKUP_STATUS", "error")
@@ -693,7 +889,7 @@ func taskRestoreBackup() string {
 	utils.WriteOption("BACKUP_STATUS", "working")
 	taskGetBackupStatus()
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskAutoBackup() string {
@@ -706,7 +902,7 @@ func taskAutoBackup() string {
 		return taskBackup()
 	} else {
 		fmt.Println("Backup status is not working... skipping")
-		return "{\"status\": \"skipped\"}"		
+		return "{\"status\": \"skipped\"}"
 	}
 }
 
@@ -727,14 +923,14 @@ func taskGetBackupStatus() string {
 	service_found := false
 
 	switch backup_service {
-		case "s3":
+	case "s3":
-			service_found = true
+		service_found = true
-		case "b2":
+	case "b2":
-			key_id_name = "B2_ACCOUNT_ID"
+		key_id_name = "B2_ACCOUNT_ID"
-			key_secret_name = "B2_ACCOUNT_KEY"
+		key_secret_name = "B2_ACCOUNT_KEY"
-			service_found = true
+		service_found = true
-		case "wasabi":
+	case "wasabi":
-			service_found = true
+		service_found = true
 	}
 
 	if !service_found {
@@ -751,12 +947,12 @@ func taskGetBackupStatus() string {
 	utils.WriteOption("BACKUP_STATS", utils.ExecAndStream(backup_repository_location, "restic", cmdArgs))
 
 	return "{\"status\": \"ok\"}"
-	
+
 }
 
 func taskSetupTunnel(args taskSetupTunnelArgs) string {
 	fmt.Println("Executing taskSetupTunnel")
-	wsPath := utils.GetPath(utils.WsPath)	
+	wsPath := utils.GetPath(utils.WsPath)
 
 	// Stop a the service if it is running
 	system.StopService("cloudflared")
@@ -825,14 +1021,14 @@ func taskSetupTunnel(args taskSetupTunnelArgs) string {
 		system.CreateTunnel("/home/system/.cloudflared/config.yml")
 
 		fmt.Println("Creating DNS Routes for @ and *.")
-		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f" ,"edgebox", "*." + args.DomainName)
+		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f", "edgebox", "*."+args.DomainName)
 		cmd.Start()
 		err = cmd.Wait()
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f" ,"edgebox", args.DomainName)
+		cmd = exec.Command("cloudflared", "tunnel", "route", "dns", "-f", "edgebox", args.DomainName)
 		cmd.Start()
 		err = cmd.Wait()
 		if err != nil {
@@ -862,15 +1058,22 @@ func taskSetupTunnel(args taskSetupTunnelArgs) string {
 		fmt.Println("Finished running async")
 	}()
 
-    return "{\"url\": \"" + url + "\"}"
+	return "{\"url\": \"" + url + "\"}"
 }
 
 func taskStartTunnel() string {
 	fmt.Println("Executing taskStartTunnel")
-	system.StartService("cloudflared")
+
-	domainName := utils.ReadOption("DOMAIN_NAME")
+	// Read tunnel status to check if cloudflare is configured
-	status := "{\"status\": \"connected\", \"domain\": \"" + domainName + "\"}"
+	tunnelStatus := utils.ReadOption("TUNNEL_STATUS")
-	utils.WriteOption("TUNNEL_STATUS", status)
+	if tunnelStatus != "" {
+		// Only start cloudflared if we have a tunnel configured
+		system.StartService("cloudflared")
+		domainName := utils.ReadOption("DOMAIN_NAME")
+		status := "{\"status\": \"connected\", \"domain\": \"" + domainName + "\"}"
+		utils.WriteOption("TUNNEL_STATUS", status)
+	}
+
 	return "{\"status\": \"ok\"}"
 }
 
@@ -893,6 +1096,182 @@ func taskDisableTunnel() string {
 	return "{\"status\": \"ok\"}"
 }
 
+func taskStartShell(args taskStartShellArgs) string {
+	fmt.Println("Executing taskStartShell")
+	wsPath := utils.GetPath(utils.WsPath)
+
+	// kill the process if its running
+	utils.Exec(wsPath, "killall", []string{"sshx"})
+
+	cmd := exec.Command("/usr/local/bin/sshx", "--quiet", "--shell", "bash")
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		panic(err)
+	}
+	scanner := bufio.NewScanner(stdout)
+	err = cmd.Start()
+	if err != nil {
+		panic(err)
+	}
+	url := ""
+
+	timeout := args.Timeout
+
+	for scanner.Scan() {
+		fmt.Println(scanner.Text())
+		text := scanner.Text()
+		if strings.Contains(text, "https://") {
+			url = text
+			fmt.Println("Shell start is responding with URL: " + url)
+			utils.WriteOption("SHELL_URL", url)
+			utils.WriteOption("SHELL_STATUS", "running")
+			break
+		}
+	}
+	if scanner.Err() != nil {
+		cmd.Process.Kill()
+		cmd.Wait()
+		panic(scanner.Err())
+	}
+
+	go func() {
+		fmt.Println("Running shell async")
+
+		// cmd.Wait()
+
+		// Keep retrying to calculate timeout to know when to kill the process
+		for {
+			timeout = timeout - 1
+			if timeout <= 0 {
+				fmt.Println("Timeout reached, killing process...")
+				utils.Exec(wsPath, "killall sshx", []string{})
+				utils.WriteOption("SHELL_STATUS", "not_running")
+				break
+			}
+			if timeout%10 == 0 {
+				fmt.Println("Active Shell Timeout is " + fmt.Sprint(timeout) + " seconds")
+			}
+			time.Sleep(1 * time.Second)
+		}
+	}()
+
+	return "{\"status\": \"ok\"}"
+}
+
+func taskStopShell() string {
+	fmt.Println("Executing taskStopShell")
+	wsPath := utils.GetPath(utils.WsPath)
+
+	// kill the process if its running
+	utils.Exec(wsPath, "killall", []string{"sshx"})
+	utils.WriteOption("SHELL_STATUS", "not_running")
+
+	return "{\"status\": \"ok\"}"
+
+}
+
+func taskGetBrowserDevStatus() string {
+	fmt.Println("Executing taskGetBrowserDevStatus")
+
+	// Read status from systemctl status code-server@root
+	browserDevStatus := utils.Exec(
+		utils.GetPath(utils.WsPath),
+		"sh",
+		[]string{"-c", "systemctl --quiet is-active code-server@root && echo 'active' || echo 'inactive'"},
+	)
+	if browserDevStatus == "active" {
+		fmt.Println("Browser Dev Environment is running")
+		utils.WriteOption("BROWSERDEV_STATUS", "running")
+		taskGetBrowserDevUrl()
+
+		return "{\"status\": \"running\"}"
+
+	} else {
+		fmt.Println("Browser Dev Environment is not running")
+		utils.WriteOption("BROWSERDEV_STATUS", "not_running")
+		return "{\"status\": \"not_running\"}"
+	}
+}
+
+func taskGetBrowserDevUrl() string {
+	url := ""
+	myEdgeAppServiceEnv, err := godotenv.Read(utils.GetPath(utils.BrowserDevPath) + "myedgeapp.env")
+	if err != nil {
+		log.Println("No myedge.app environment file found. Status is Network-Only")
+		url = "http://dev." + system.GetHostname() + ".local"
+	} else {
+		if myEdgeAppServiceEnv["INTERNET_URL"] != "" {
+			url = "https://" + myEdgeAppServiceEnv["INTERNET_URL"]
+		}
+	}
+
+	fmt.Println("Browser Dev Url: " + url)
+
+	utils.WriteOption("BROWSERDEV_URL", url)
+	return url
+}
+
+func taskActivateBrowserDev() string {
+	fmt.Println("Executing taskActivateBrowserDev")
+	wsPath := utils.GetPath(utils.WsPath)
+
+	// Start the service
+	utils.Exec(wsPath, "systemctl", []string{"start", "code-server@root"})
+	// Write run file to /home/system/components/dev/.run
+	utils.Exec(wsPath, "touch", []string{utils.GetPath(utils.BrowserDevProxyPath) + ".run"})
+	// Rebuild WS (necessary to start the proxy)
+	system.StartWs()
+	// Write control option for API
+	utils.WriteOption("BROWSERDEV_STATUS", "running")
+
+	// Write and refresh the dev environment password option
+	taskGetBrowserDevPassword()
+
+	return "{\"status\": \"ok\"}"
+}
+
+func taskDeactivateBrowserDev() string {
+	fmt.Println("Executing taskDeactivateBrowserDev")
+	wsPath := utils.GetPath(utils.WsPath)
+
+	// Remove the run file
+	os.Remove(utils.GetPath(utils.BrowserDevProxyPath) + ".run")
+	system.StartWs()
+
+	utils.Exec(wsPath, "systemctl", []string{"stop", "code-server@root"})
+	utils.WriteOption("BROWSERDEV_STATUS", "not_running")
+
+	return "{\"status\": \"ok\"}"
+}
+
+func taskGetBrowserDevPassword() string {
+	fmt.Println("Executing taskGetBrowserDevPassword")
+
+	password, err := system.FetchBrowserDevPasswordFromFile()
+	if err == nil {
+		utils.WriteOption("BROWSERDEV_PASSWORD", password)
+	} else {
+		fmt.Println("Error fetching browser dev password from file: " + err.Error())
+	}
+
+	return password
+}
+
+func taskSetBrowserDevPassword(args taskSetBrowserDevPasswordArgs) string {
+	fmt.Println("Executing taskSetBrowserDevPassword")
+	wsPath := utils.GetPath(utils.WsPath)
+
+	system.SetBrowserDevPasswordFile(args.Password)
+	utils.WriteOption("BROWSERDEV_PASSWORD", args.Password)
+
+	// Check if BROWSERDEV_STATUS is "running", if so, restart the service
+	if utils.ReadOption("BROWSERDEV_STATUS") == "running" {
+		utils.Exec(wsPath, "systemctl", []string{"restart", "code-server@root"})
+	}
+
+	return "{\"status\": \"ok\"}"
+}
+
 func taskInstallEdgeApp(args taskInstallEdgeAppArgs) string {
 	fmt.Println("Executing taskInstallEdgeApp for " + args.ID)
 
@@ -903,6 +1282,16 @@ func taskInstallEdgeApp(args taskInstallEdgeAppArgs) string {
 	return string(resultJSON)
 }
 
+func taskInstallBulkEdgeApps(args taskInstallBulkEdgeAppsArgs) string {
+	fmt.Println("Executing taskInstallBulkEdgeApps for " + strings.Join(args.IDS, ", "))
+
+	// args.Apps is a list of edgeapp ids
+	edgeapps.SetEdgeAppBulkInstalled(args.IDS)
+
+	taskGetEdgeApps()
+	return "{\"status\": \"ok\"}"
+}
+
 func taskRemoveEdgeApp(args taskRemoveEdgeAppArgs) string {
 	fmt.Println("Executing taskRemoveEdgeApp for " + args.ID)
 
@@ -939,7 +1328,6 @@ func taskSetEdgeAppOptions(args taskSetEdgeAppOptionsArgs) string {
 	// Id is the edgeapp id
 	appID := args.ID
 
-
 	// Open the file to write the options,
 	// it is an env file in /home/system/components/apps/<app_id>/edgeapp.env
 
@@ -970,7 +1358,7 @@ func taskSetEdgeAppOptions(args taskSetEdgeAppOptionsArgs) string {
 			log.Printf("Error writing option to edgeapp.env file: %s", err)
 		}
 	}
-	
+
 	// Close the file
 	err = edgeappEnvFile.Close()
 	if err != nil {
@@ -986,6 +1374,76 @@ func taskSetEdgeAppOptions(args taskSetEdgeAppOptionsArgs) string {
 	return string(resultJSON)
 }
 
+func taskSetEdgeAppBasicAuth(args taskSetEdgeAppBasicAuthArgs) string {
+	// Id is the edgeapp id
+	appID := args.ID
+
+	// Open the file to write the options,
+	// it is an env file in /home/system/components/apps/<app_id>/auth.env
+
+	// Get the path to the auth.env file
+	edgeappAuthEnvPath := "/home/system/components/apps/" + appID + "/auth.env"
+
+	// If the file does not exist, create it
+	if _, err := os.Stat(edgeappAuthEnvPath); os.IsNotExist(err) {
+		// Create the file
+		_, err := os.Create(edgeappAuthEnvPath)
+		if err != nil {
+			log.Printf("Error creating auth.env file: %s", err)
+		}
+	}
+
+	// It is an env file, so we can use go-dotenv to write the options
+	// Open the file
+	edgeappAuthEnvFile, err := os.OpenFile(edgeappAuthEnvPath, os.O_WRONLY, 0600)
+	if err != nil {
+		log.Printf("Error opening auth.env file: %s", err)
+	}
+
+	// Write the login values to the file
+	_, err = edgeappAuthEnvFile.WriteString("USERNAME=" + args.Login.Username + "\n" + "PASSWORD=" + args.Login.Password + "\n")
+	if err != nil {
+		log.Printf("Error writing credentials to auth.env file: %s", err)
+	}
+
+	// Close the file
+	err = edgeappAuthEnvFile.Close()
+	if err != nil {
+		log.Printf("Error closing auth.env file: %s", err)
+	}
+
+	result := edgeapps.GetEdgeAppStatus(appID)
+	resultJSON, _ := json.Marshal(result)
+
+	system.StartWs()
+	taskGetEdgeApps() // This task will imediatelly update the entry in the api database.
+
+	return string(resultJSON)
+}
+
+func taskRemoveEdgeAppBasicAuth(args taskRemoveEdgeAppBasicAuthArgs) string {
+	// Id is the edgeapp id
+	appID := args.ID
+
+	// Get the path to the auth.env file
+	edgeappAuthEnvFile := "/auth.env"
+
+	fmt.Println("Removing auth.env file" + edgeappAuthEnvFile)
+
+	err := os.Remove(utils.GetPath(utils.EdgeAppsPath) + args.ID + edgeappAuthEnvFile)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	result := edgeapps.GetEdgeAppStatus(appID)
+	resultJSON, _ := json.Marshal(result)
+
+	system.StartWs()
+	taskGetEdgeApps() // This task will imediatelly update the entry in the api database.
+
+	return string(resultJSON)
+}
+
 func taskEnableOnline(args taskEnableOnlineArgs) string {
 	fmt.Println("Executing taskEnableOnline for " + args.ID)
 
@@ -1029,6 +1487,39 @@ func taskDisablePublicDashboard() string {
 	return "{result: false}"
 }
 
+func taskCheckSystemUpdates() string {
+	fmt.Println("Executing taskCheckSystemUpdates")
+	system.CheckUpdates()
+	return "{result: true}"
+}
+
+func taskUpdateSystem() string {
+	fmt.Println("Executing taskUpdateSystem")
+	system.ApplyUpdates()
+	utils.WriteOption("LAST_UPDATE", strconv.FormatInt(time.Now().Unix(), 10))
+	return "{result: true}"
+}
+
+func taskRecoverFromUpdate() string {
+	fmt.Println("Executing taskRecoverFromUpdate")
+	executing_tasks := GetExecutingTasks()
+	// Filter out the task with task value "update_system"
+	filteredTasks := []Task{}
+	for _, task := range executing_tasks {
+		if task.Task != "update_system" {
+			filteredTasks = append(filteredTasks, task)
+		}
+	}
+
+	// If tasks is not empty, Get the last task
+	if len(filteredTasks) > 0 {
+		lastTask := filteredTasks[len(filteredTasks)-1]
+		ExecuteTask(lastTask)
+	}
+
+	return "{result: true}"
+}
+
 func taskSetReleaseVersion() string {
 
 	fmt.Println("Executing taskSetReleaseVersion")
@@ -1060,7 +1551,7 @@ func taskUpdateSystemLoggerServices() string {
 
 	input = append(input, "edgeboxctl")
 	input = append(input, "tunnel")
-	
+
 	// Run the system logger
 	system.UpdateSystemLoggerServices(input)
 

internal/utils/utils.go

@@ -111,7 +111,10 @@ const ApiPath string = "apiPath"
 const EdgeAppsPath string = "edgeAppsPath"
 const EdgeAppsBackupPath string = "edgeAppsBackupPath"
 const WsPath string = "wsPath"
+const BrowserDevPath string = "browserDevPath"
 const LoggerPath string = "loggerPath"
+const BrowserDevPasswordFileLocation string = "browserDevPasswordFileLocation"
+const BrowserDevProxyPath string = "browserDevProxyPath"
 
 
 // GetPath : Returns either the hardcoded path, or a overwritten value via .env file at project root. Register paths here for seamless working code between dev and prod environments ;)
@@ -174,6 +177,14 @@ func GetPath(pathKey string) string {
 			targetPath = "/home/system/components/ws/"
 		}
 
+	case BrowserDevPath:
+
+		if env["BROWSERDEV_PATH"] != "" {
+			targetPath = env["BROWSERDEV_PATH"]
+		} else {
+			targetPath = "/home/system/components/dev/"
+		}
+
 	case LoggerPath:
 		if env["LOGGER_PATH"] != "" {
 			targetPath = env["LOGGER_PATH"]
@@ -189,6 +200,20 @@ func GetPath(pathKey string) string {
 			targetPath = "/home/system/components/backups/pw.txt"
 		}
 
+	case BrowserDevPasswordFileLocation:
+		if env["BROWSERDEV_PASSWORD_FILE_LOCATION"] != "" {
+			targetPath = env["BROWSERDEV_PASSWORD_FILE_LOCATION"]
+		} else {
+			targetPath = "/root/.config/code-server/config.yaml"
+		}
+
+	case BrowserDevProxyPath:
+		if env["BROWSERDEV_PROXY_PATH"] != "" {
+			targetPath = env["BROWSERDEV_PROXY_PATH"]
+		} else {
+			targetPath = "/home/system/components/dev/"
+		}
+
 	default:
 
 		log.Printf("path_key %s nonexistant in GetPath().\n", pathKey)