fix(scraper): update status and genres selectors for current novelfire.net HTML

novelfire.net changed its book page structure. Old selectors produced empty status and null genres for every book, causing all Meilisearch filters to return zero results. Old → new: - status: <span class="status"> → <strong class="ongoing|completed|hiatus"> (text lowercased for consistent index values) - genres: <div class="genres"> <a> → <div class="categories"> <a class="property-item"> (text lowercased for consistent index values) Adds TestParseMetadataSelectors to guard against future regressions.
docs(d2): update architecture and api-routing diagrams to current state
2026-03-28 22:54:35 +05:00 · 2026-03-28 22:44:31 +05:00 · 2026-03-28 22:38:09 +05:00 · 2026-03-28 21:49:52 +05:00 · 2026-03-28 21:41:13 +05:00 · 2026-03-28 21:36:12 +05:00
29 changed files with 895 additions and 606 deletions
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -2,20 +2,14 @@ name: CI

 on:
  push:
-    branches: ["main", "master"]
    paths:
      - "backend/**"
      - "ui/**"
-      - "caddy/**"
-      - "docker-compose.yml"
      - ".gitea/workflows/ci.yaml"
  pull_request:
-    branches: ["main", "master"]
    paths:
      - "backend/**"
      - "ui/**"
-      - "caddy/**"
-      - "docker-compose.yml"
      - ".gitea/workflows/ci.yaml"

 concurrency:
@@ -23,10 +17,13 @@ concurrency:
  cancel-in-progress: true

 jobs:
-  # ── backend: vet & test ───────────────────────────────────────────────────────
-  test-backend:
-    name: Test backend
+  # ── Go: vet + build + test ────────────────────────────────────────────────
+  backend:
+    name: Backend
    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
    steps:
      - uses: actions/checkout@v4

@@ -36,16 +33,23 @@ jobs:
          cache-dependency-path: backend/go.sum

      - name: go vet
-        working-directory: backend
        run: go vet ./...

+      - name: Build backend
+        run: go build -o /dev/null ./cmd/backend
+
+      - name: Build runner
+        run: go build -o /dev/null ./cmd/runner
+
+      - name: Build healthcheck
+        run: go build -o /dev/null ./cmd/healthcheck
+
      - name: Run tests
-        working-directory: backend
        run: go test -short -race -count=1 -timeout=60s ./...

-  # ── ui: type-check & build ────────────────────────────────────────────────────
-  check-ui:
-    name: Check ui
+  # ── UI: type-check + build ────────────────────────────────────────────────
+  ui:
+    name: UI
    runs-on: ubuntu-latest
    defaults:
      run:
@@ -67,57 +71,3 @@ jobs:

      - name: Build
        run: npm run build
-
-  # ── docker: validate Dockerfiles build (no push) ──────────────────────────────
-  docker-backend:
-    name: Docker / backend
-    runs-on: ubuntu-latest
-    needs: [test-backend]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: backend
-          target: backend
-          push: false
-
-  docker-runner:
-    name: Docker / runner
-    runs-on: ubuntu-latest
-    needs: [test-backend]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: backend
-          target: runner
-          push: false
-
-  docker-ui:
-    name: Docker / ui
-    runs-on: ubuntu-latest
-    needs: [check-ui]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: ui
-          push: false
-
-  docker-caddy:
-    name: Docker / caddy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: caddy
-          push: false
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -190,6 +190,17 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      - name: Fetch releases from Gitea API
+        run: |
+          set -euo pipefail
+          RESPONSE=$(curl -sfL \
+            -H "Accept: application/json" \
+            "http://gitea.kalekber.cc/api/v1/repos/kamil/libnovel/releases?limit=50&page=1")
+          # Validate JSON before writing — fails hard if response is not a JSON array
+          COUNT=$(echo "$RESPONSE" | jq 'if type == "array" then length else error("expected array, got \(type)") end')
+          echo "$RESPONSE" > ui/static/releases.json
+          echo "Fetched $COUNT releases"
+
      - uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
@@ -218,6 +229,7 @@ jobs:
          build-args: |
            BUILD_VERSION=${{ steps.meta.outputs.version }}
            BUILD_COMMIT=${{ gitea.sha }}
+            BUILD_TIME=${{ gitea.event.head_commit.timestamp }}
          cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-ui:latest
          cache-to: type=inline

--- a/61
+++ b/61
@@ -56,6 +56,22 @@
 		ticker_interval 15s
 	}

+	# ── Redis TCP proxy via layer4 ────────────────────────────────────────────
+	# Exposes homelab Redis over TLS for Asynq job enqueueing from the backend.
+	# Listens on :6380 (all interfaces). TLS is terminated here using the cert
+	# for redis.libnovel.cc; traffic is proxied to the homelab Redis instance.
+	# Requires the caddy-l4 module in the custom Caddy build.
+	layer4 {
+		:6380 {
+			route {
+				tls
+				proxy {
+					upstream {$HOMELAB_REDIS_ADDR:192.168.0.109:6379}
+				}
+			}
+		}
+	}
+}

 (security_headers) {
 	header {
@@ -170,12 +186,31 @@
 	# ── SvelteKit UI (catch-all — includes all remaining /api/* routes) ───────
 	handle {
 		reverse_proxy ui:3000 {
-	}
+			# Active health check: Caddy polls /health every 5 s and marks the
+			# upstream down immediately when it fails. Combined with
+			# lb_try_duration this means Watchtower container replacements
+			# show the maintenance page within a few seconds instead of
+			# hanging or returning a raw connection error to the browser.
+			health_uri      /health
+			health_interval 5s
+			health_timeout  2s
+			health_status   200
+
+			# If the upstream is down, fail fast (don't retry for longer than
+			# 3 s) and let Caddy's handle_errors 502/503 take over.
+			lb_try_duration 3s
+		}
+	}

 	# ── Caddy-level error pages ───────────────────────────────────────────────
 	# These fire when the upstream (backend or ui) is completely unreachable.
 	# SvelteKit's own +error.svelte handles application-level errors (404, 500).
 	handle_errors 404 {
+		root * /srv/errors
+		rewrite * /404.html
+		file_server
+	}
+	handle_errors 502 {
 		root * /srv/errors
 		rewrite * /502.html
 		file_server
@@ -234,27 +269,3 @@ search.libnovel.cc {
 	reverse_proxy meilisearch:7700
 }
 }
-# ── Redis TCP proxy: exposes homelab Redis over TLS for Asynq ─────────────────
-# The backend (prod) connects to rediss://redis.libnovel.cc:6380 to enqueue
-# Asynq jobs. Caddy terminates TLS (Let's Encrypt cert for redis.libnovel.cc)
-# and proxies the raw TCP stream to the homelab Redis via this reverse proxy.
-#
-# NOTE: Redis is NOT running on the prod server — it runs on the homelab
-# (192.168.0.109:6379) and is exposed to the internet via this Caddy proxy.
-# The homelab Redis is protected by REDIS_PASSWORD (requirepass).
-#
-# Caddy layer4 app handles this; requires the caddy-l4 module in the build.
-{
-	layer4 {
-		redis.libnovel.cc:6380 {
-			route {
-				tls
-				proxy {
-					# Homelab Redis — replace with actual homelab IP or FQDN
-					upstream {$HOMELAB_REDIS_ADDR:192.168.0.109:6379}
-				}
-			}
-		}
-	}
-}
-}
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -30,9 +30,14 @@ RUN --mount=type=cache,target=/root/go/pkg/mod \
      -o /out/healthcheck ./cmd/healthcheck

 # ── backend service ──────────────────────────────────────────────────────────
-FROM gcr.io/distroless/static:nonroot AS backend
+# Uses Alpine (not distroless) so ffmpeg is available for on-demand voice
+# sample generation via pocket-tts (WAV→MP3 transcoding).
+FROM alpine:3.21 AS backend
+RUN apk add --no-cache ffmpeg ca-certificates && \
+    addgroup -S appgroup && adduser -S appuser -G appgroup
 COPY --from=builder /out/healthcheck /healthcheck
 COPY --from=builder /out/backend /backend
+USER appuser
 ENTRYPOINT ["/backend"]

 # ── runner service ───────────────────────────────────────────────────────────
--- a/backend/internal/novelfire/scraper.go
+++ b/backend/internal/novelfire/scraper.go
@@ -178,12 +178,26 @@ func (s *Scraper) ScrapeMetadata(ctx context.Context, bookURL string) (domain.Bo
 		}
 	}

-	status := htmlutil.ExtractFirst(root, scraper.Selector{Tag: "span", Class: "status"})
+	// Status: novelfire renders <strong class="ongoing">Ongoing</strong> (or
+	// "completed", "hiatus") inside the .header-stats block. We take the text
+	// content and lowercase it so the index value is always canonical lowercase.
+	var status string
+	for _, cls := range []string{"ongoing", "completed", "hiatus"} {
+		if v := htmlutil.ExtractFirst(root, scraper.Selector{Tag: "strong", Class: cls}); v != "" {
+			status = strings.ToLower(strings.TrimSpace(v))
+			break
+		}
+	}

-	genresNode := htmlutil.FindFirst(root, scraper.Selector{Tag: "div", Class: "genres"})
+	// Genres: novelfire renders <div class="categories"><ul><li><a class="property-item">Genre</a>
+	// Each <a class="property-item"> is one genre tag. Lowercase for index consistency.
 	var genres []string
-	if genresNode != nil {
-		genres = htmlutil.ExtractAll(genresNode, scraper.Selector{Tag: "a", Multiple: true})
+	if categoriesNode := htmlutil.FindFirst(root, scraper.Selector{Tag: "div", Class: "categories"}); categoriesNode != nil {
+		for _, v := range htmlutil.ExtractAll(categoriesNode, scraper.Selector{Tag: "a", Class: "property-item", Multiple: true}) {
+			if v != "" {
+				genres = append(genres, strings.ToLower(strings.TrimSpace(v)))
+			}
+		}
 	}

 	summary := htmlutil.ExtractFirst(root, scraper.Selector{Tag: "div", Class: "summary"})
--- a/backend/internal/novelfire/scraper_test.go
+++ b/backend/internal/novelfire/scraper_test.go
@@ -2,6 +2,7 @@ package novelfire

 import (
 	"context"
+	"log/slog"
 	"testing"
 )

@@ -100,6 +101,56 @@ func TestRetryGet_EventualSuccess(t *testing.T) {
 	}
 }

+// TestParseMetadataSelectors verifies that the status and genres selectors
+// match the current novelfire.net HTML structure.
+func TestParseMetadataSelectors(t *testing.T) {
+	// Minimal HTML reproducing the relevant novelfire.net book page structure.
+	const html = `<!DOCTYPE html>
+<html><body>
+<h1 class="novel-title">Shadow Slave</h1>
+<span class="author">Guiltythree</span>
+<figure class="cover"><img src="https://cdn.example.com/cover.jpg"></figure>
+<div class="header-stats">
+  <span><strong>123</strong><small>Chapters</small></span>
+  <span> <strong class="ongoing">Ongoing</strong> <small>Status</small></span>
+</div>
+<div class="categories">
+  <h4>Genres</h4>
+  <ul>
+    <li><a href="/genre-fantasy/..." class="property-item">Fantasy</a></li>
+    <li><a href="/genre-action/..." class="property-item">Action</a></li>
+    <li><a href="/genre-adventure/..." class="property-item">Adventure</a></li>
+  </ul>
+</div>
+<span class="chapter-count">123 Chapters</span>
+</body></html>`
+
+	stub := newStubClient()
+	stub.setFn("https://novelfire.net/book/shadow-slave", func() (string, error) {
+		return html, nil
+	})
+
+	s := &Scraper{client: stub, log: slog.Default()}
+	meta, err := s.ScrapeMetadata(t.Context(), "https://novelfire.net/book/shadow-slave")
+	if err != nil {
+		t.Fatalf("ScrapeMetadata: %v", err)
+	}
+
+	if meta.Status != "ongoing" {
+		t.Errorf("status = %q, want %q", meta.Status, "ongoing")
+	}
+
+	wantGenres := []string{"fantasy", "action", "adventure"}
+	if len(meta.Genres) != len(wantGenres) {
+		t.Fatalf("genres = %v, want %v", meta.Genres, wantGenres)
+	}
+	for i, g := range meta.Genres {
+		if g != wantGenres[i] {
+			t.Errorf("genres[%d] = %q, want %q", i, g, wantGenres[i])
+		}
+	}
+}
+
 // ── minimal stub client for tests ─────────────────────────────────────────────

 type stubClient struct {
--- a/caddy/errors/404.html
+++ b/caddy/errors/404.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>404 — Page Not Found</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      min-height: 100svh;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      gap: 1rem;
+      background: #09090b;
+      color: #a1a1aa;
+      font-family: ui-sans-serif, system-ui, sans-serif;
+      padding: 2rem;
+      text-align: center;
+    }
+    .code {
+      font-size: clamp(4rem, 20vw, 8rem);
+      font-weight: 800;
+      color: #27272a;
+      line-height: 1;
+      letter-spacing: -0.04em;
+    }
+    h1 { font-size: 1.25rem; font-weight: 600; color: #e4e4e7; }
+    p  { font-size: 0.9rem; max-width: 36ch; line-height: 1.6; }
+    a  {
+      margin-top: 0.5rem;
+      display: inline-block;
+      padding: 0.6rem 1.4rem;
+      border-radius: 0.5rem;
+      background: #f59e0b;
+      color: #000;
+      font-weight: 600;
+      font-size: 0.875rem;
+      text-decoration: none;
+    }
+    a:hover { background: #d97706; }
+  </style>
+</head>
+<body>
+  <div class="code">404</div>
+  <h1>Page Not Found</h1>
+  <p>The page you're looking for doesn't exist or has been moved.</p>
+  <a href="/">Go home</a>
+</body>
+</html>
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -154,7 +154,7 @@ services:
    # No public port — all traffic is routed via Caddy.
    expose:
      - "8080"
-     environment:
+    environment:
      <<: *infra-env
      BACKEND_HTTP_ADDR: ":8080"
      LOG_LEVEL: "${LOG_LEVEL}"
@@ -224,6 +224,7 @@ services:
      # Kokoro-FastAPI TTS endpoint
      KOKORO_URL: "${KOKORO_URL}"
      KOKORO_VOICE: "${KOKORO_VOICE}"
+      POCKET_TTS_URL: "${POCKET_TTS_URL}"
      GLITCHTIP_DSN: "${GLITCHTIP_DSN}"
      OTEL_EXPORTER_OTLP_ENDPOINT: "${OTEL_EXPORTER_OTLP_ENDPOINT}"
      OTEL_SERVICE_NAME: "runner"
--- a/docs/d2/api-routing.d2
+++ b/docs/d2/api-routing.d2
@@ -35,11 +35,11 @@ client: Browser / iOS App {
 caddy: Caddy :443 {
  shape: rectangle
  style.fill: "#f1f5f9"
-  label: "Caddy :443\ncustom build · caddy-ratelimit\nsecurity headers · rate limiting\nstatic error pages"
+  label: "Caddy :443\ncustom build · caddy-l4 · caddy-ratelimit\nCrowdSec bouncer · security headers\nrate limiting · static error pages\nRedis TCP proxy :6380"
 }

 # ─── SvelteKit UI ─────────────────────────────────────────────────────────────
-# Handles: auth enforcement, session, all /api/* routes that have SK counterparts
+# All routes here pass through SvelteKit — auth is enforced server-side.

 sk: SvelteKit UI :3000 {
  style.fill: "#fef3c7"
@@ -53,7 +53,7 @@ sk: SvelteKit UI :3000 {
  catalogue_sk: Catalogue {
    style.fill: "#f0fdf4"
    style.stroke: "#86efac"
-    label: "GET /api/catalogue-page\nGET /api/search"
+    label: "GET /api/catalogue-page  (infinite scroll)\nGET /api/search"
  }

  book_sk: Book {
@@ -65,7 +65,7 @@ sk: SvelteKit UI :3000 {
  scrape_sk: Scrape (admin) {
    style.fill: "#fff7ed"
    style.stroke: "#fdba74"
-    label: "GET  /api/scrape/status\nGET  /api/scrape/tasks\nPOST /api/scrape\nPOST /api/scrape/range\nPOST /api/scrape/cancel/{id}"
+    label: "GET  /api/scrape/status\nGET  /api/scrape/tasks\nPOST /api/scrape\nPOST /api/scrape/book\nPOST /api/scrape/book/range\nPOST /api/scrape/cancel/{id}"
  }

  audio_sk: Audio {
@@ -74,7 +74,7 @@ sk: SvelteKit UI :3000 {
    label: "POST /api/audio/{slug}/{n}\nGET  /api/audio/status/{slug}/{n}\nGET  /api/voices"
  }

-  presign_sk: Presigned URLs {
+  presign_sk: Presigned URLs (public) {
    style.fill: "#f0fdf4"
    style.stroke: "#86efac"
    label: "GET /api/presign/chapter/{slug}/{n}\nGET /api/presign/audio/{slug}/{n}\nGET /api/presign/voice-sample/{voice}"
@@ -106,12 +106,12 @@ sk: SvelteKit UI :3000 {
 }

 # ─── Go Backend ───────────────────────────────────────────────────────────────
-# Caddy proxies these paths directly — no SvelteKit auth layer
+# Caddy proxies these paths directly — bypasses SvelteKit entirely.

 be: Backend API :8080 {
  style.fill: "#eef3ff"

-  health_be: Health {
+  health_be: Health / Version {
    style.fill: "#f0fdf4"
    style.stroke: "#86efac"
    label: "GET /health\nGET /api/version"
@@ -126,7 +126,7 @@ be: Backend API :8080 {
  catalogue_be: Catalogue {
    style.fill: "#f0fdf4"
    style.stroke: "#86efac"
-    label: "GET /api/browse\nGET /api/catalogue\nGET /api/ranking\nGET /api/cover/{domain}/{slug}"
+    label: "GET /api/catalogue  (Meilisearch)\nGET /api/browse  (legacy MinIO cache)\nGET /api/ranking\nGET /api/cover/{domain}/{slug}"
  }

  book_be: Book / Chapter {
@@ -138,7 +138,13 @@ be: Backend API :8080 {
  audio_be: Audio {
    style.fill: "#f0fdf4"
    style.stroke: "#86efac"
-    label: "GET /api/audio-proxy/{slug}/{n}\nGET /api/voices"
+    label: "POST /api/audio/{slug}/{n}\nGET  /api/audio/status/{slug}/{n}\nGET  /api/audio-proxy/{slug}/{n}\nGET  /api/voices"
+  }
+
+  presign_be: Presigned URLs {
+    style.fill: "#f0fdf4"
+    style.stroke: "#86efac"
+    label: "GET /api/presign/chapter/{slug}/{n}\nGET /api/presign/audio/{slug}/{n}\nGET /api/presign/voice-sample/{voice}\nGET /api/presign/avatar-upload/{userId}\nGET /api/presign/avatar/{userId}"
  }
 }

@@ -149,19 +155,19 @@ storage: Storage {

  pb: PocketBase :8090 {
    shape: cylinder
-    label: "auth · books · progress\ncomments · library\nscrape_jobs · audio_cache"
+    label: "auth · books · progress\ncomments · library\nscrape_jobs · audio_cache\nranking"
  }
  mn: MinIO :9000 {
    shape: cylinder
-    label: "chapters · audio\navatars · browse"
+    label: "chapters · audio\navatars · catalogue (browse)"
  }
  ms: Meilisearch :7700 {
    shape: cylinder
-    label: "index: books"
+    label: "index: books\nfilterable: status · genres\nsortable: rank · rating\n  total_chapters · meta_updated"
  }
  vk: Valkey :6379 {
    shape: cylinder
-    label: "presign URL cache"
+    label: "presign URL cache (TTL ~55 min)\nAsynq job queue (runner)"
  }
 }

@@ -169,18 +175,17 @@ storage: Storage {

 client -> caddy: HTTPS :443

-caddy -> sk: "/* (catch-all)\n→ SvelteKit handles auth"
-caddy -> be: "/health  /scrape*\n/api/browse  /api/book-preview/*\n/api/chapter-text/*  /api/chapter-markdown/*\n/api/reindex/*  /api/cover/*\n/api/audio-proxy/*  /api/catalogue  /api/ranking"
-caddy -> storage.mn: "/avatars/*\n/audio/*\n/chapters/*\n(presigned MinIO GETs)"
+caddy -> sk: "/* (catch-all)\n→ SvelteKit enforces auth"
+caddy -> be: "/health  /scrape*\n/api/browse  /api/catalogue  /api/ranking\n/api/version  /api/book-preview/*\n/api/chapter-text/*  /api/chapter-markdown/*\n/api/reindex/*  /api/cover/*\n/api/audio*  /api/voices  /api/presign/*"
+caddy -> storage.mn: "/avatars/*  /audio/*  /chapters/*\n(presigned MinIO GETs)"

 # ─── SvelteKit → Backend (server-side proxy) ──────────────────────────────────

 sk.catalogue_sk -> be.catalogue_be: internal proxy
 sk.book_sk -> be.book_be: internal proxy
 sk.audio_sk -> be.audio_be: internal proxy
-sk.presign_sk -> storage.vk: check cache
-sk.presign_sk -> storage.mn: generate presign
-sk.presign_user -> storage.mn: generate presign
+sk.presign_sk -> be.presign_be: internal proxy
+sk.presign_user -> be.presign_be: internal proxy

 # ─── SvelteKit → Storage (direct) ────────────────────────────────────────────

@@ -192,10 +197,12 @@ sk.comments_sk -> storage.pb

 # ─── Backend → Storage ────────────────────────────────────────────────────────

-be.catalogue_be -> storage.ms: full-text search
+be.catalogue_be -> storage.ms: full-text search + facets
 be.catalogue_be -> storage.pb: ranking records
 be.catalogue_be -> storage.mn: cover presign
 be.book_be -> storage.mn: chapter objects
 be.book_be -> storage.pb: book metadata
 be.audio_be -> storage.mn: audio presign
 be.audio_be -> storage.vk: presign cache
+be.presign_be -> storage.vk: check / set presign cache
+be.presign_be -> storage.mn: generate presigned URL
--- a/docs/d2/api-routing.svg
+++ b/docs/d2/api-routing.svg
--- a/docs/d2/architecture.d2
+++ b/docs/d2/architecture.d2
@@ -5,16 +5,25 @@ direction: right
 novelfire: novelfire.net {
  shape: cloud
  style.fill: "#f0f4ff"
+  label: "novelfire.net\n(scrape source)"
 }

 kokoro: Kokoro-FastAPI TTS {
  shape: cloud
  style.fill: "#f0f4ff"
+  label: "Kokoro-FastAPI TTS\n(self-hosted · homelab)\nchapter audio"
+}
+
+pockettts: pocket-tts {
+  shape: cloud
+  style.fill: "#f0f4ff"
+  label: "pocket-tts\n(self-hosted · homelab)\nvoice sample MP3s"
 }

 letsencrypt: Let's Encrypt {
  shape: cloud
  style.fill: "#f0f4ff"
+  label: "Let's Encrypt\n(ACME TLS-ALPN-01)"
 }

 browser: Browser / iOS App {
@@ -30,12 +39,12 @@ init: Init containers {

  minio-init: minio-init {
    shape: rectangle
-    label: "minio-init\n(mc: create buckets)"
+    label: "minio-init\n(mc: create buckets\n  chapters · audio\n  avatars · catalogue)"
  }

  pb-init: pb-init {
    shape: rectangle
-    label: "pb-init\n(bootstrap collections)"
+    label: "pb-init\n(bootstrap PocketBase\n  collections + schema)"
  }
 }

@@ -46,109 +55,126 @@ storage: Storage {

  minio: MinIO {
    shape: cylinder
-    label: "MinIO :9000\n\nbuckets:\n  chapters\n  audio\n  avatars\n  catalogue"
+    label: "MinIO :9000\nbuckets:\n  chapters · audio\n  avatars · catalogue"
  }

  pocketbase: PocketBase {
    shape: cylinder
-    label: "PocketBase :8090\n\ncollections:\n  books  chapters_idx\n  audio_cache  progress\n  scrape_jobs  app_users\n  ranking"
+    label: "PocketBase :8090\ncollections:\n  books · chapters_idx\n  audio_cache · progress\n  scrape_jobs · app_users\n  ranking · library\n  comments"
  }

  valkey: Valkey {
    shape: cylinder
-    label: "Valkey :6379\n\n(presign URL cache\nTTL-based, shared)"
+    label: "Valkey :6379\npresign URL cache (TTL ~55 min)\nAsynq job queue (runner tasks)"
  }

  meilisearch: Meilisearch {
    shape: cylinder
-    label: "Meilisearch :7700\n\nindices:\n  books"
+    label: "Meilisearch :7700\nindex: books\n(filterable: status · genres\n sortable: rank · rating\n  total_chapters · meta_updated)"
  }
 }

-# ─── Application ──────────────────────────────────────────────────────────────
+# ─── Application — prod VPS (165.22.70.138) ───────────────────────────────────

-app: Application {
+app: Application — prod (165.22.70.138) {
  style.fill: "#eef3ff"

  caddy: caddy {
    shape: rectangle
-    label: "Caddy :443 / :80\ncustom build + caddy-ratelimit\n\nfeatures:\n  auto-HTTPS (Let's Encrypt)\n  security headers\n  rate limiting (per-IP)\n  static error pages (502/503/504)"
+    label: "Caddy :443 / :80 / :6380\ncustom build\n+ caddy-l4 (Redis TCP proxy)\n+ caddy-ratelimit\nauto-HTTPS · security headers\nrate limiting (per-IP)\nstatic error pages (404/502/503/504)\nCrowdSec bouncer"
  }

  backend: backend {
    shape: rectangle
-    label: "Backend API :8080\n(Go — HTTP API server)"
-  }
-
-  runner: runner {
-    shape: rectangle
-    label: "Runner :9091\n(Go — background worker\nscraping + TTS jobs\n/metrics endpoint)"
+    label: "Backend API :8080\n(Go)\nHTTP API server\nffmpeg (audio sample conv.)\nOpenTelemetry tracing\nSentry / GlitchTip errors"
  }

  ui: ui {
    shape: rectangle
-    label: "SvelteKit UI :3000\n(adapter-node)"
+    label: "SvelteKit UI :3000\n(adapter-node)\nSSR · session auth\nserver-side API proxy"
+  }
+
+  crowdsec: CrowdSec {
+    shape: rectangle
+    label: "CrowdSec :8080\nsecurity engine\nreads Caddy JSON logs\nbouncer integrated in Caddy"
+  }
+
+  dozzle: Dozzle agent {
+    shape: rectangle
+    label: "Dozzle agent\n127.0.0.1:7007\nlog relay → homelab dashboard"
+  }
+}
+
+# ─── Runner — homelab (192.168.0.109) ────────────────────────────────────────
+
+homelab: Runner — homelab (192.168.0.109) {
+  style.fill: "#fef9ec"
+
+  runner: runner {
+    shape: rectangle
+    label: "Runner :9091\n(Go background worker)\nscrape pipeline\nTTS audio job queue\nPrometheus /metrics\ncron: catalogue refresh\nAsynq worker → Valkey"
  }
 }

 # ─── Ops ──────────────────────────────────────────────────────────────────────

 ops: Ops {
-  style.fill: "#fef9ec"
+  style.fill: "#f5f5f5"

  watchtower: Watchtower {
    shape: rectangle
-    label: "Watchtower\n(containrrr/watchtower)\n\npolls every 5 min\nautopulls + redeploys:\n  backend · runner · ui"
+    label: "Watchtower\n(containrrr/watchtower)\npolls Docker Hub every 5 min\nautopulls + redeploys:\n  backend · ui\n(runner: label-disabled on prod)"
  }
 }

-# ─── Init → Storage deps ──────────────────────────────────────────────────────
+# ─── CI / CD ──────────────────────────────────────────────────────────────────
+
+cicd: CI / CD {
+  style.fill: "#f0f9ff"
+
+  gitea: Gitea Actions {
+    shape: rectangle
+    label: "Gitea Actions\n(homelab runner)\ntag v* trigger:\n  test-backend\n  check-ui (type-check + build)\n  docker-backend\n  docker-runner\n  docker-ui (bakes releases.json)\n  docker-caddy\n  → push Docker Hub\n  → Gitea Release"
+  }
+}
+
+# ─── Init → Storage ───────────────────────────────────────────────────────────

 init.minio-init -> storage.minio: create buckets {style.stroke-dash: 4}
 init.pb-init -> storage.pocketbase: bootstrap schema {style.stroke-dash: 4}

-# ─── App → Storage ────────────────────────────────────────────────────────────
-
-app.backend -> storage.minio: blobs (chapters, audio,\navatars, browse)
-app.backend -> storage.pocketbase: structured records\n(books, progress, jobs…)
-app.backend -> storage.valkey: cache presigned URLs\n(SET/GET with TTL)
-
-app.runner -> storage.minio: write chapter markdown\n& audio MP3s
-app.runner -> storage.pocketbase: read/update scrape jobs\nwrite book records
-app.runner -> storage.meilisearch: index books on\nscrape completion
-
-app.ui -> storage.valkey: read presigned URL cache
-app.ui -> storage.pocketbase: auth, progress,\ncomments, settings
-
 # ─── App internal ─────────────────────────────────────────────────────────────

-app.ui -> app.backend: REST API calls (server-side)\n/api/catalogue /api/book-preview\n/api/chapter-text /api/audio etc.
+app.caddy -> app.ui: "/* (catch-all)\nSvelteKit — auth enforced"
+app.caddy -> app.backend: "/health  /scrape*\n/api/browse  /api/catalogue\n/api/ranking  /api/version\n/api/book-preview/*\n/api/chapter-text/*\n/api/chapter-markdown/*\n/api/reindex/*  /api/cover/*\n/api/audio-proxy/*  /api/voices\n/api/audio*  /api/presign/*"
+app.caddy -> storage.minio: "/avatars/*  /audio/*\n/chapters/*\n(presigned GETs)"
+app.caddy -> app.crowdsec: bouncer check (15 s poll)
+app.caddy -> letsencrypt: ACME cert (TLS-ALPN-01)

-# ─── Caddy routing ────────────────────────────────────────────────────────────
-# Routes sent directly to backend (no SvelteKit counterpart):
-#   /health  /scrape*
-#   /api/browse  /api/book-preview/*  /api/chapter-text/*
-#   /api/reindex/*  /api/cover/*  /api/audio-proxy/*
-# Routes sent to MinIO:
-#   /avatars/*
-# Everything else → SvelteKit UI (including /api/scrape/*, /api/chapter-text-preview/*)
+app.ui -> app.backend: "internal REST proxy\n(server-side only)"
+app.ui -> storage.pocketbase: "auth · sessions\nprogress · library\ncomments"

-app.caddy -> app.ui: "/* (catch-all)\n/api/scrape/*\n/api/chapter-text-preview/*\n→ SvelteKit (auth enforced)"
-app.caddy -> app.backend: "/health  /scrape*\n/api/browse  /api/book-preview/*\n/api/chapter-text/*\n/api/reindex/*  /api/cover/*\n/api/audio-proxy/*"
-app.caddy -> storage.minio: "/avatars/*\n/audio/*\n/chapters/*\n(presigned MinIO GETs)"
+app.backend -> storage.minio: "chapter objs · audio MP3s\navatars · browse cache"
+app.backend -> storage.pocketbase: "books · scrape_jobs\naudio_cache · ranking"
+app.backend -> storage.valkey: "presign URL cache\n(SET/GET TTL ~55 min)"
+app.backend -> storage.meilisearch: "catalogue search\nfacets: genres · status"
+app.backend -> pockettts: "voice sample gen.\n(on-demand · ffmpeg conv.)"

-# ─── External → App ───────────────────────────────────────────────────────────
+# ─── Runner → deps ────────────────────────────────────────────────────────────

-app.runner -> novelfire: scrape\n(HTTP GET)
-app.runner -> kokoro: TTS generation\n(HTTP POST)
-app.caddy -> letsencrypt: ACME certificate\n(TLS-ALPN-01)
+homelab.runner -> novelfire: "HTTP scrape\nHTML → Markdown"
+homelab.runner -> kokoro: "TTS generation\ntext → MP3"
+homelab.runner -> storage.minio: "write chapters\n& audio MP3s"
+homelab.runner -> storage.pocketbase: "read/update scrape_jobs\nwrite book records"
+homelab.runner -> storage.meilisearch: "index books\n(on scrape completion)"
+homelab.runner -> storage.valkey: "Asynq job queue\n(task consume)"

-# ─── Ops → Docker socket ──────────────────────────────────────────────────────
-
-ops.watchtower -> app.backend: watch (label-enabled)
-ops.watchtower -> app.runner: watch (label-enabled)
-ops.watchtower -> app.ui: watch (label-enabled)
-
-# ─── Browser ──────────────────────────────────────────────────────────────────
+# ─── Client ───────────────────────────────────────────────────────────────────

 browser -> app.caddy: HTTPS :443\n(single entry point)
+
+# ─── Ops / CI ─────────────────────────────────────────────────────────────────
+
+ops.watchtower -> app.backend: watch (label-enabled)
+ops.watchtower -> app.ui: watch (label-enabled)
+cicd.gitea -> ops.watchtower: push to Docker Hub\n→ Watchtower detects new tag
--- a/docs/d2/architecture.svg
+++ b/docs/d2/architecture.svg
--- a/homelab/docker-compose.yml
+++ b/homelab/docker-compose.yml
@@ -222,6 +222,10 @@ services:
      EMAIL_SMTP_USERNAME: "${FIDER_SMTP_USER}"
      EMAIL_SMTP_PASSWORD: "${FIDER_SMTP_PASSWORD}"
      EMAIL_SMTP_ENABLE_STARTTLS: "false"
+      OAUTH_GOOGLE_CLIENTID: "${OAUTH_GOOGLE_CLIENTID}"
+      OAUTH_GOOGLE_SECRET: "${OAUTH_GOOGLE_SECRET}"
+      OAUTH_GITHUB_CLIENTID: "${OAUTH_GITHUB_CLIENTID}"
+      OAUTH_GITHUB_SECRET: "${OAUTH_GITHUB_SECRET}"

  # ── Dozzle ──────────────────────────────────────────────────────────────────
  # Watches both homelab and prod containers.
--- a/ui/.gitignore
+++ b/ui/.gitignore
@@ -21,3 +21,6 @@ Thumbs.db
 # Vite
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
+
+# Generated by CI at build time — do not commit
+/static/releases.json
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -14,10 +14,12 @@ COPY . .
 # Build-time version info — injected by docker-compose or CI via --build-arg.
 ARG BUILD_VERSION=dev
 ARG BUILD_COMMIT=unknown
+ARG BUILD_TIME=unknown

 # Expose as PUBLIC_ env vars so SvelteKit's $env/dynamic/public can read them.
 ENV PUBLIC_BUILD_VERSION=$BUILD_VERSION
 ENV PUBLIC_BUILD_COMMIT=$BUILD_COMMIT
+ENV PUBLIC_BUILD_TIME=$BUILD_TIME

 RUN npm run build

@@ -40,5 +42,16 @@ ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOST=0.0.0.0

+# Carry build-time metadata into the runtime image so the UI footer can
+# display the version, commit SHA, and build timestamp.
+# These must be re-declared after the second FROM — ARG values do not
+# cross stage boundaries, but ENV values set here persist at runtime.
+ARG BUILD_VERSION=dev
+ARG BUILD_COMMIT=unknown
+ARG BUILD_TIME=unknown
+ENV PUBLIC_BUILD_VERSION=$BUILD_VERSION
+ENV PUBLIC_BUILD_COMMIT=$BUILD_COMMIT
+ENV PUBLIC_BUILD_TIME=$BUILD_TIME
+
 EXPOSE $PORT
 CMD ["node", "build"]
--- a/ui/src/lib/server/minio.ts
+++ b/ui/src/lib/server/minio.ts
@@ -40,8 +40,8 @@ export async function presignAvatarUploadUrl(userId: string, mimeType: string):
 }

 /**
- * Returns a presigned GET URL for a user's avatar, rewritten to the public URL.
- * Returns null if no avatar exists.
+ * Returns a presigned GET URL for a user's avatar from MinIO.
+ * Returns null if no avatar object exists in MinIO for this user.
 */
 export async function presignAvatarUrl(userId: string): Promise<string | null> {
 	const res = await backendFetch(`/api/presign/avatar/${encodeURIComponent(userId)}`);
@@ -54,6 +54,42 @@ export async function presignAvatarUrl(userId: string): Promise<string | null> {
 	return data.url ? rewriteHost(data.url) : null;
 }

+/**
+ * Resolves the best available avatar URL for a user.
+ *
+ * Priority:
+ *   1. MinIO — if the user has uploaded a custom avatar it will be found here
+ *      (presigned, short-lived GET URL).
+ *   2. OAuth provider URL — stored in avatar_url when the account was created
+ *      via Google / GitHub OAuth (e.g. https://lh3.googleusercontent.com/...).
+ *      Returned as-is; the browser fetches it directly.
+ *
+ * Pass the raw `avatar_url` field from the PocketBase record as `storedValue`
+ * so this function can distinguish between a MinIO key and a remote URL without
+ * an extra DB round-trip.
+ *
+ * Returns null when neither source yields an avatar.
+ */
+export async function resolveAvatarUrl(
+	userId: string,
+	storedValue: string | null | undefined
+): Promise<string | null> {
+	// 1. Try MinIO first (custom upload takes priority over OAuth picture).
+	try {
+		const minioUrl = await presignAvatarUrl(userId);
+		if (minioUrl) return minioUrl;
+	} catch {
+		// MinIO unavailable — fall through to OAuth fallback.
+	}
+
+	// 2. Fall back to OAuth-provided picture URL if it looks like a remote URL.
+	if (storedValue && storedValue.startsWith('http')) {
+		return storedValue;
+	}
+
+	return null;
+}
+
 /**
 * Rewrites the MinIO host in a presigned URL to the public-facing URL.
 *
--- a/ui/src/lib/server/pocketbase.ts
+++ b/ui/src/lib/server/pocketbase.ts
@@ -541,6 +541,19 @@ export async function getUserByUsername(username: string): Promise<User | null>
 	return listOne<User>('app_users', `username="${username.replace(/"/g, '\\"')}"`);
 }

+/**
+ * Look up a user by their PocketBase record ID. Returns null if not found.
+ */
+export async function getUserById(id: string): Promise<User | null> {
+	const token = await getToken();
+	const res = await fetch(`${PB_URL}/api/collections/app_users/records/${encodeURIComponent(id)}`, {
+		headers: { Authorization: `Bearer ${token}` }
+	});
+	if (res.status === 404) return null;
+	if (!res.ok) return null;
+	return res.json() as Promise<User>;
+}
+
 /**
 * Look up a user by email. Returns null if not found.
 */
--- a/ui/src/routes/+layout.svelte
+++ b/ui/src/routes/+layout.svelte
@@ -257,20 +257,14 @@

 				<div class="ml-auto flex items-center gap-4">
 					<!-- Desktop: admin + profile + sign out (hidden on mobile) -->
-					{#if data.user?.role === 'admin'}
-						<a
-							href="/admin/scrape"
-							class="hidden sm:block text-sm transition-colors {page.url.pathname.startsWith('/admin/scrape') ? 'text-zinc-100 font-medium' : 'text-zinc-400 hover:text-zinc-100'}"
-						>
-							Scrape
-						</a>
-						<a
-							href="/admin/audio"
-							class="hidden sm:block text-sm transition-colors {page.url.pathname.startsWith('/admin/audio') ? 'text-zinc-100 font-medium' : 'text-zinc-400 hover:text-zinc-100'}"
-						>
-							Audio
-						</a>
-					{/if}
+				{#if data.user?.role === 'admin'}
+					<a
+						href="/admin/scrape"
+						class="hidden sm:block text-sm transition-colors {page.url.pathname.startsWith('/admin') ? 'text-zinc-100 font-medium' : 'text-zinc-400 hover:text-zinc-100'}"
+					>
+						Admin
+					</a>
+				{/if}
 					<a
 						href="/profile"
 						class="hidden sm:block text-sm transition-colors {page.url.pathname === '/profile' ? 'text-zinc-100 font-medium' : 'text-zinc-400 hover:text-zinc-100'}"
@@ -350,31 +344,17 @@
 				>
 					Profile <span class="text-zinc-500 font-normal">({data.user.username})</span>
 				</a>
-				{#if data.user?.role === 'admin'}
-					<div class="my-1 border-t border-zinc-700/60"></div>
-					<p class="px-3 pt-1 pb-0.5 text-xs text-zinc-600 uppercase tracking-widest">Admin</p>
-					<a
-						href="/admin/scrape"
-						onclick={() => (menuOpen = false)}
-						class="px-3 py-2.5 rounded-lg text-sm font-medium transition-colors {page.url.pathname.startsWith('/admin/scrape') ? 'bg-zinc-800 text-zinc-100' : 'text-zinc-400 hover:bg-zinc-800 hover:text-zinc-100'}"
-					>
-						Scrape tasks
-					</a>
-					<a
-						href="/admin/audio"
-						onclick={() => (menuOpen = false)}
-						class="px-3 py-2.5 rounded-lg text-sm font-medium transition-colors {page.url.pathname === '/admin/audio' ? 'bg-zinc-800 text-zinc-100' : 'text-zinc-400 hover:bg-zinc-800 hover:text-zinc-100'}"
-					>
-						Audio cache
-					</a>
-					<a
-						href="/admin/audio-jobs"
-						onclick={() => (menuOpen = false)}
-						class="px-3 py-2.5 rounded-lg text-sm font-medium transition-colors {page.url.pathname.startsWith('/admin/audio-jobs') ? 'bg-zinc-800 text-zinc-100' : 'text-zinc-400 hover:bg-zinc-800 hover:text-zinc-100'}"
-					>
-						Audio jobs
-					</a>
-				{/if}
+			{#if data.user?.role === 'admin'}
+				<div class="my-1 border-t border-zinc-700/60"></div>
+				<p class="px-3 pt-1 pb-0.5 text-xs text-zinc-600 uppercase tracking-widest">Admin</p>
+				<a
+					href="/admin/scrape"
+					onclick={() => (menuOpen = false)}
+					class="px-3 py-2.5 rounded-lg text-sm font-medium transition-colors {page.url.pathname.startsWith('/admin') ? 'bg-zinc-800 text-zinc-100' : 'text-zinc-400 hover:bg-zinc-800 hover:text-zinc-100'}"
+				>
+					Admin panel
+				</a>
+			{/if}
 			<div class="my-1 border-t border-zinc-700/60"></div>
 			<form method="POST" action="/logout">
 				<Button
@@ -396,16 +376,16 @@
 	</main>

 	<footer class="border-t border-zinc-800 mt-auto">
-		<div class="max-w-6xl mx-auto px-4 py-6 flex flex-col items-center gap-4 text-xs text-zinc-600">
+		<div class="max-w-6xl mx-auto px-4 py-6 flex flex-col items-center gap-4 text-xs text-zinc-500">
 			<!-- Top row: site links -->
 			<nav class="flex flex-wrap items-center justify-center gap-x-5 gap-y-2">
-			<a href="/books" class="hover:text-zinc-400 transition-colors">Library</a>
-			<a href="/catalogue" class="hover:text-zinc-400 transition-colors">Catalogue</a>
+			<a href="/books" class="hover:text-zinc-300 transition-colors">Library</a>
+			<a href="/catalogue" class="hover:text-zinc-300 transition-colors">Catalogue</a>
 			<a
 				href="https://feedback.libnovel.cc"
 				target="_blank"
 				rel="noopener noreferrer"
-				class="hover:text-zinc-400 transition-colors flex items-center gap-1"
+				class="hover:text-zinc-300 transition-colors flex items-center gap-1"
 			>
 				Feedback
 				<svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -417,7 +397,7 @@
 				href="https://novelfire.net"
 					target="_blank"
 					rel="noopener noreferrer"
-					class="hover:text-zinc-400 transition-colors flex items-center gap-1"
+					class="hover:text-zinc-300 transition-colors flex items-center gap-1"
 				>
 					novelfire.net
 					<svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -427,23 +407,32 @@
 				</a>
 			</nav>
 		<!-- Bottom row: legal links + copyright -->
-		<div class="flex flex-wrap items-center justify-center gap-x-5 gap-y-2 text-zinc-700">
-			<a href="/disclaimer" class="hover:text-zinc-500 transition-colors">Disclaimer</a>
-			<a href="/privacy" class="hover:text-zinc-500 transition-colors">Privacy</a>
-			<a href="/dmca" class="hover:text-zinc-500 transition-colors">DMCA</a>
+		<div class="flex flex-wrap items-center justify-center gap-x-5 gap-y-2 text-zinc-500">
+			<a href="/disclaimer" class="hover:text-zinc-300 transition-colors">Disclaimer</a>
+			<a href="/privacy" class="hover:text-zinc-300 transition-colors">Privacy</a>
+			<a href="/dmca" class="hover:text-zinc-300 transition-colors">DMCA</a>
 			<span>&copy; {new Date().getFullYear()} libnovel</span>
 		</div>
-		<!-- Build version / commit SHA -->
-		<div class="text-zinc-700 tabular-nums font-mono">
+		<!-- Build version / commit SHA / build time -->
+		{#snippet buildTime()}
+			{#if env.PUBLIC_BUILD_TIME && env.PUBLIC_BUILD_TIME !== 'unknown'}
+				{@const d = new Date(env.PUBLIC_BUILD_TIME)}
+				<span class="text-zinc-500" title="Build time">
+					· {d.toUTCString().replace(' GMT', ' UTC').replace(/:\d\d /, ' ')}
+				</span>
+			{/if}
+		{/snippet}
+		<div class="text-xs tabular-nums font-mono px-2 py-0.5 rounded bg-zinc-800 border border-zinc-700">
 			{#if env.PUBLIC_BUILD_VERSION && env.PUBLIC_BUILD_VERSION !== 'dev'}
-				<span title="Build version">{env.PUBLIC_BUILD_VERSION}</span>
+				<span class="text-zinc-300" title="Build version">{env.PUBLIC_BUILD_VERSION}</span>
 				{#if env.PUBLIC_BUILD_COMMIT && env.PUBLIC_BUILD_COMMIT !== 'unknown'}
-					<span class="text-zinc-800 select-all" title="Commit SHA"
+					<span class="text-zinc-500 select-all" title="Commit SHA"
 						>+{env.PUBLIC_BUILD_COMMIT.slice(0, 7)}</span
 					>
 				{/if}
+				{@render buildTime()}
 			{:else}
-				<span class="text-zinc-800">dev</span>
+				<span class="text-zinc-400">dev</span>
 			{/if}
 		</div>
 		</div>
--- a/ui/src/routes/admin/+layout.svelte
+++ b/ui/src/routes/admin/+layout.svelte
@@ -1,12 +1,13 @@
 <script lang="ts">
 	import { page } from '$app/state';

-	const adminTabs = [
+	const internalLinks = [
 		{ href: '/admin/scrape', label: 'Scrape' },
-		{ href: '/admin/audio', label: 'Audio' }
+		{ href: '/admin/audio', label: 'Audio' },
+		{ href: '/admin/changelog', label: 'Changelog' }
 	];

-	const toolTabs = [
+	const externalLinks = [
 		{ href: 'https://feedback.libnovel.cc', label: 'Feedback' },
 		{ href: 'https://errors.libnovel.cc', label: 'Errors' },
 		{ href: 'https://analytics.libnovel.cc', label: 'Analytics' },
@@ -21,36 +22,51 @@
 	let { children }: Props = $props();
 </script>

-<!-- Admin nav: internal pages + external tools -->
-<div class="mb-6 flex flex-wrap items-center gap-3">
-	<!-- Internal admin pages -->
-	<div class="flex gap-1 bg-zinc-800 rounded-lg p-1 border border-zinc-700">
-		{#each adminTabs as tab}
-			<a
-				href={tab.href}
-				class="px-4 py-1.5 rounded-md text-sm font-medium transition-colors
-					{page.url.pathname.startsWith(tab.href)
-						? 'bg-zinc-700 text-zinc-100'
-						: 'text-zinc-400 hover:text-zinc-200'}"
-			>
-				{tab.label}
-			</a>
-		{/each}
-	</div>
+<div class="flex min-h-[calc(100vh-4rem)] gap-0">
+	<!-- Sidebar -->
+	<aside class="w-48 shrink-0 border-r border-zinc-800 px-3 py-6 flex flex-col gap-6">
+		<!-- Internal pages -->
+		<div>
+			<p class="px-2 mb-2 text-xs font-semibold text-zinc-600 uppercase tracking-widest">Pages</p>
+			<nav class="flex flex-col gap-0.5">
+				{#each internalLinks as link}
+					<a
+						href={link.href}
+						class="px-2 py-1.5 rounded-md text-sm font-medium transition-colors
+							{page.url.pathname.startsWith(link.href)
+								? 'bg-zinc-800 text-zinc-100'
+								: 'text-zinc-400 hover:bg-zinc-800/60 hover:text-zinc-200'}"
+					>
+						{link.label}
+					</a>
+				{/each}
+			</nav>
+		</div>

-	<!-- External tools (open in new tab) -->
-	<div class="flex gap-1 bg-zinc-800 rounded-lg p-1 border border-zinc-700">
-		{#each toolTabs as tool}
-			<a
-				href={tool.href}
-				target="_blank"
-				rel="noopener noreferrer"
-				class="px-4 py-1.5 rounded-md text-sm font-medium text-zinc-400 hover:text-zinc-200 transition-colors"
-			>
-				{tool.label} ↗
-			</a>
-		{/each}
-	</div>
+		<!-- External tools -->
+		<div>
+			<p class="px-2 mb-2 text-xs font-semibold text-zinc-600 uppercase tracking-widest">Tools</p>
+			<nav class="flex flex-col gap-0.5">
+				{#each externalLinks as link}
+					<a
+						href={link.href}
+						target="_blank"
+						rel="noopener noreferrer"
+						class="px-2 py-1.5 rounded-md text-sm font-medium text-zinc-400 hover:bg-zinc-800/60 hover:text-zinc-200 transition-colors flex items-center justify-between"
+					>
+						{link.label}
+						<svg class="w-3 h-3 shrink-0 opacity-50" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+							<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+								d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" />
+						</svg>
+					</a>
+				{/each}
+			</nav>
+		</div>
+	</aside>
+
+	<!-- Main content -->
+	<main class="flex-1 min-w-0 px-8 py-6">
+		{@render children?.()}
+	</main>
 </div>
-
-{@render children?.()}
--- a/ui/src/routes/admin/changelog/+page.server.ts
+++ b/ui/src/routes/admin/changelog/+page.server.ts
@@ -0,0 +1,26 @@
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import type { PageServerLoad } from './$types';
+
+export interface Release {
+	id: number;
+	tag_name: string;
+	name: string;
+	body: string;
+	published_at: string;
+	prerelease: boolean;
+	draft: boolean;
+}
+
+export const load: PageServerLoad = async () => {
+	try {
+		// releases.json is baked into the image at build time by CI.
+		// SvelteKit Node adapter copies static/ → build/client/, so the file
+		// lives at <cwd>/build/client/releases.json in production.
+		const raw = readFileSync(join(process.cwd(), 'build', 'client', 'releases.json'), 'utf-8');
+		const releases: Release[] = JSON.parse(raw);
+		return { releases: releases.filter((r) => !r.draft) };
+	} catch (e) {
+		return { releases: [], error: String(e) };
+	}
+};
--- a/ui/src/routes/admin/changelog/+page.svelte
+++ b/ui/src/routes/admin/changelog/+page.svelte
@@ -0,0 +1,59 @@
+<script lang="ts">
+	import type { PageData } from './$types';
+
+	let { data }: { data: PageData } = $props();
+
+	function fmtDate(s: string) {
+		return new Date(s).toLocaleDateString(undefined, {
+			year: 'numeric', month: 'short', day: 'numeric'
+		});
+	}
+</script>
+
+<svelte:head>
+	<title>Changelog — libnovel admin</title>
+</svelte:head>
+
+<div class="space-y-6 max-w-2xl">
+	<div class="flex items-center gap-3">
+		<h1 class="text-xl font-semibold text-zinc-100 flex-1">Changelog</h1>
+		<a
+			href="https://gitea.kalekber.cc/kamil/libnovel/releases"
+			target="_blank"
+			rel="noopener noreferrer"
+			class="text-xs text-zinc-500 hover:text-zinc-300 transition-colors flex items-center gap-1"
+		>
+			Gitea releases
+			<svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+				<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+					d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" />
+			</svg>
+		</a>
+	</div>
+
+	{#if data.error}
+		<p class="text-sm text-red-400">Could not load releases: {data.error}</p>
+	{:else if data.releases.length === 0}
+		<p class="text-sm text-zinc-500 py-8 text-center">No releases found.</p>
+	{:else}
+		<div class="space-y-0 divide-y divide-zinc-800 border border-zinc-800 rounded-xl overflow-hidden">
+			{#each data.releases as release}
+				<div class="px-5 py-4 bg-zinc-900 space-y-2">
+					<div class="flex items-baseline gap-3 flex-wrap">
+						<span class="font-mono text-sm font-semibold text-amber-400">{release.tag_name}</span>
+						{#if release.name && release.name !== release.tag_name}
+							<span class="text-sm text-zinc-300">{release.name}</span>
+						{/if}
+						{#if release.prerelease}
+							<span class="text-xs px-1.5 py-0.5 rounded bg-zinc-700 text-zinc-400">pre-release</span>
+						{/if}
+						<span class="text-xs text-zinc-600 ml-auto">{fmtDate(release.published_at)}</span>
+					</div>
+					{#if release.body.trim()}
+						<p class="text-sm text-zinc-400 leading-relaxed whitespace-pre-wrap">{release.body.trim()}</p>
+					{/if}
+				</div>
+			{/each}
+		</div>
+	{/if}
+</div>
--- a/ui/src/routes/admin/scrape/+page.svelte
+++ b/ui/src/routes/admin/scrape/+page.svelte
@@ -231,131 +231,110 @@
 	<title>Scrape tasks — libnovel admin</title>
 </svelte:head>

-<div class="space-y-8">
+<div class="space-y-6">
 	<!-- Header -->
-	<div class="flex items-center justify-between flex-wrap gap-3">
-		<div>
-			<h1 class="text-2xl font-bold text-zinc-100">Scrape tasks</h1>
-			<p class="text-zinc-400 text-sm mt-1">
-				Job status:
-				{#if running}
-					<span class="text-amber-400 font-medium animate-pulse">Running</span>
-				{:else}
-					<span class="text-green-400 font-medium">Idle</span>
-				{/if}
-			</p>
-		</div>
+	<div class="flex items-center gap-3 flex-wrap">
+		<h1 class="text-xl font-semibold text-zinc-100 flex-1">Scrape</h1>
+		<span class="text-xs {running ? 'text-amber-400 animate-pulse' : 'text-green-500'}">
+			● {running ? 'Running' : 'Idle'}
+		</span>
 	</div>

-	<!-- Scrape controls -->
-	<div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+	<!-- Compact controls -->
+	<div class="divide-y divide-zinc-800 border border-zinc-800 rounded-xl overflow-hidden">
 		<!-- Full catalogue -->
-		<div class="bg-zinc-800 rounded-xl border border-zinc-700 p-5 space-y-3">
-			<div>
-				<h2 class="text-sm font-semibold text-zinc-300">Scrape full catalogue</h2>
-				<p class="text-xs text-zinc-500 mt-1">Re-crawls all novelfire.net pages and picks up new books.</p>
-			</div>
+		<div class="flex items-center gap-4 px-4 py-3 bg-zinc-900">
+			<span class="text-sm text-zinc-400 w-36 shrink-0">Full catalogue</span>
 			<button
 				onclick={triggerCatalogueScrape}
 				disabled={running || cataloguing}
-				class="w-full px-4 py-2 rounded-lg bg-amber-600 text-zinc-900 font-semibold text-sm hover:bg-amber-500 transition-colors disabled:opacity-50"
+				class="px-3 py-1.5 rounded-md bg-amber-600 text-zinc-900 font-semibold text-xs hover:bg-amber-500 transition-colors disabled:opacity-50"
 			>
-				{cataloguing ? 'Queuing…' : running ? 'Already running…' : 'Start catalogue scrape'}
+				{cataloguing ? 'Queuing…' : running ? 'Running…' : 'Start scrape'}
 			</button>
-			{#if catalogueError}
-				<p class="text-sm text-red-400">{catalogueError}</p>
-			{/if}
+			{#if catalogueError}<span class="text-xs text-red-400">{catalogueError}</span>{/if}
 		</div>

 		<!-- Single book -->
-		<div id="book-form" class="bg-zinc-800 rounded-xl border border-zinc-700 p-5 space-y-3">
-			<h2 class="text-sm font-semibold text-zinc-300">Scrape a single book</h2>
-			<div class="flex gap-2">
-				<input
-					type="url"
-					bind:value={scrapeUrl}
-					placeholder="https://novelfire.net/book/…"
-					class="flex-1 min-w-0 bg-zinc-700 border border-zinc-600 rounded-lg px-3 py-2 text-zinc-100 text-sm placeholder-zinc-500 focus:outline-none focus:ring-2 focus:ring-amber-400"
-				/>
-				<button
-					onclick={() => triggerBookScrape(scrapeUrl)}
-					disabled={!scrapeUrl.trim() || running || scraping}
-					class="shrink-0 px-4 py-2 rounded-lg bg-zinc-600 text-zinc-100 font-semibold text-sm hover:bg-zinc-500 transition-colors disabled:opacity-50"
-				>
-					{scraping ? 'Queuing…' : 'Scrape'}
-				</button>
-			</div>
-			{#if scrapeError}
-				<p class="text-sm text-red-400">{scrapeError}</p>
-			{/if}
+		<div id="book-form" class="flex items-center gap-3 px-4 py-3 bg-zinc-900">
+			<span class="text-sm text-zinc-400 w-36 shrink-0">Single book</span>
+			<input
+				type="url"
+				bind:value={scrapeUrl}
+				placeholder="https://novelfire.net/book/…"
+				class="flex-1 min-w-0 bg-zinc-800 border border-zinc-700 rounded-md px-3 py-1.5 text-zinc-100 text-sm placeholder-zinc-600 focus:outline-none focus:ring-1 focus:ring-amber-400"
+			/>
+			<button
+				onclick={() => triggerBookScrape(scrapeUrl)}
+				disabled={!scrapeUrl.trim() || running || scraping}
+				class="shrink-0 px-3 py-1.5 rounded-md bg-zinc-700 text-zinc-100 font-medium text-xs hover:bg-zinc-600 transition-colors disabled:opacity-50"
+			>
+				{scraping ? 'Queuing…' : 'Scrape'}
+			</button>
+			{#if scrapeError}<span class="text-xs text-red-400">{scrapeError}</span>{/if}
 		</div>

 		<!-- Range scrape -->
-		<div id="range-form" class="bg-zinc-800 rounded-xl border border-zinc-700 p-5 space-y-3">
-			<h2 class="text-sm font-semibold text-zinc-300">Scrape chapter range</h2>
+		<div id="range-form" class="flex items-center gap-3 px-4 py-3 bg-zinc-900 flex-wrap">
+			<span class="text-sm text-zinc-400 w-36 shrink-0">Chapter range</span>
 			<input
 				type="url"
 				bind:value={rangeUrl}
 				placeholder="https://novelfire.net/book/…"
-				class="w-full bg-zinc-700 border border-zinc-600 rounded-lg px-3 py-2 text-zinc-100 text-sm placeholder-zinc-500 focus:outline-none focus:ring-2 focus:ring-amber-400"
+				class="flex-1 min-w-0 bg-zinc-800 border border-zinc-700 rounded-md px-3 py-1.5 text-zinc-100 text-sm placeholder-zinc-600 focus:outline-none focus:ring-1 focus:ring-amber-400"
 			/>
-			<div class="flex gap-2">
-				<input
-					type="number"
-					bind:value={rangeFrom}
-					min="1"
-					placeholder="From ch."
-					class="w-full bg-zinc-700 border border-zinc-600 rounded-lg px-3 py-2 text-zinc-100 text-sm placeholder-zinc-500 focus:outline-none focus:ring-2 focus:ring-amber-400"
-				/>
-				<input
-					type="number"
-					bind:value={rangeTo}
-					min="1"
-					placeholder="To ch. (opt)"
-					class="w-full bg-zinc-700 border border-zinc-600 rounded-lg px-3 py-2 text-zinc-100 text-sm placeholder-zinc-500 focus:outline-none focus:ring-2 focus:ring-amber-400"
-				/>
-				<button
-					onclick={triggerRangeScrape}
-					disabled={!rangeUrl.trim() || rangeFrom === null || running || ranging}
-					class="shrink-0 px-4 py-2 rounded-lg bg-zinc-600 text-zinc-100 font-semibold text-sm hover:bg-zinc-500 transition-colors disabled:opacity-50"
-				>
-					{ranging ? 'Queuing…' : 'Go'}
-				</button>
-			</div>
-			{#if rangeError}
-				<p class="text-sm text-red-400">{rangeError}</p>
-			{/if}
-		</div>
-	</div>
-
-	<!-- Quick-scrape genre links -->
-	<div class="bg-zinc-800 rounded-xl border border-zinc-700 p-5 space-y-3">
-		<h2 class="text-sm font-semibold text-zinc-300">Quick genre refresh</h2>
-		<p class="text-xs text-zinc-500">Paste one of these into the single-book scraper to re-index a genre, or use them as starting points for range scrapes.</p>
-		<div class="flex flex-wrap gap-2">
-			{#each quickScrapes as qs}
-				<button
-					onclick={() => { scrapeUrl = qs.url; }}
-					class="px-3 py-1.5 rounded-lg text-xs font-medium bg-zinc-700 text-zinc-300 border border-zinc-600 hover:border-amber-400/60 hover:text-amber-300 transition-colors"
-				>
-					{qs.label}
-				</button>
-			{/each}
-			<a
-				href="https://novelfire.net"
-				target="_blank"
-				rel="noopener noreferrer"
-				class="px-3 py-1.5 rounded-lg text-xs font-medium bg-zinc-700/50 text-zinc-400 border border-zinc-600/50 hover:text-amber-300 hover:border-amber-400/40 transition-colors"
+			<input
+				type="number"
+				bind:value={rangeFrom}
+				min="1"
+				placeholder="From"
+				class="w-20 bg-zinc-800 border border-zinc-700 rounded-md px-3 py-1.5 text-zinc-100 text-sm placeholder-zinc-600 focus:outline-none focus:ring-1 focus:ring-amber-400"
+			/>
+			<input
+				type="number"
+				bind:value={rangeTo}
+				min="1"
+				placeholder="To"
+				class="w-20 bg-zinc-800 border border-zinc-700 rounded-md px-3 py-1.5 text-zinc-100 text-sm placeholder-zinc-600 focus:outline-none focus:ring-1 focus:ring-amber-400"
+			/>
+			<button
+				onclick={triggerRangeScrape}
+				disabled={!rangeUrl.trim() || rangeFrom === null || running || ranging}
+				class="shrink-0 px-3 py-1.5 rounded-md bg-zinc-700 text-zinc-100 font-medium text-xs hover:bg-zinc-600 transition-colors disabled:opacity-50"
 			>
-				Browse novelfire.net ↗
-			</a>
+				{ranging ? 'Queuing…' : 'Go'}
+			</button>
+			{#if rangeError}<span class="text-xs text-red-400 w-full pl-40">{rangeError}</span>{/if}
+		</div>
+
+		<!-- Quick genre chips -->
+		<div class="flex items-center gap-3 px-4 py-3 bg-zinc-900 flex-wrap">
+			<span class="text-sm text-zinc-400 w-36 shrink-0">Quick genres</span>
+			<div class="flex flex-wrap gap-1.5">
+				{#each quickScrapes as qs}
+					<button
+						onclick={() => { scrapeUrl = qs.url; }}
+						class="px-2.5 py-1 rounded text-xs font-medium bg-zinc-800 text-zinc-400 border border-zinc-700 hover:border-amber-400/50 hover:text-amber-300 transition-colors"
+					>
+						{qs.label}
+					</button>
+				{/each}
+				<a
+					href="https://novelfire.net"
+					target="_blank"
+					rel="noopener noreferrer"
+					class="px-2.5 py-1 rounded text-xs font-medium text-zinc-500 border border-zinc-700/50 hover:text-amber-300 hover:border-amber-400/40 transition-colors"
+				>
+					novelfire.net ↗
+				</a>
+			</div>
 		</div>
 	</div>

 	<!-- Tasks table -->
 	<div class="space-y-3">
 		<div class="flex items-center gap-3 flex-wrap">
-			<h2 class="text-lg font-semibold text-zinc-100 flex-1">Task history</h2>
+			<h2 class="text-sm font-semibold text-zinc-400 flex-1 uppercase tracking-widest">Task history</h2>
 			<input
 				type="search"
 				bind:value={q}
--- a/ui/src/routes/api/auth/me/+server.ts
+++ b/ui/src/routes/api/auth/me/+server.ts
@@ -1,6 +1,7 @@
 import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getUserByUsername } from '$lib/server/pocketbase';
+import { resolveAvatarUrl } from '$lib/server/minio';

 /**
 * GET /api/auth/me
@@ -13,10 +14,11 @@ export const GET: RequestHandler = async ({ locals }) => {
 	}
 	// Fetch full record from PocketBase to get avatar_url
 	const record = await getUserByUsername(locals.user.username).catch(() => null);
+	const avatarUrl = await resolveAvatarUrl(locals.user.id, record?.avatar_url).catch(() => null);
 	return json({
 		id: locals.user.id,
 		username: locals.user.username,
 		role: locals.user.role,
-		avatar_url: record?.avatar_url ?? null
+		avatar_url: avatarUrl
 	});
 };
--- a/ui/src/routes/api/comments/[slug]/+server.ts
+++ b/ui/src/routes/api/comments/[slug]/+server.ts
@@ -5,9 +5,10 @@ import {
 	listReplies,
 	createComment,
 	getMyVotes,
+	getUserById,
 	type CommentSort
 } from '$lib/server/pocketbase';
-import { presignAvatarUrl } from '$lib/server/minio';
+import { resolveAvatarUrl } from '$lib/server/minio';
 import { log } from '$lib/server/logger';

 /**
@@ -38,13 +39,15 @@ export const GET: RequestHandler = async ({ params, url, locals }) => {
 			replies: repliesPerComment[i]
 		}));

-		// Batch-resolve avatar presign URLs for all unique user_ids
+		// Batch-resolve avatar URLs for all unique user_ids
+		// MinIO first (custom upload), fall back to OAuth provider picture.
 		const allComments = [...topLevel, ...allReplies];
 		const uniqueUserIds = [...new Set(allComments.map((c) => c.user_id).filter(Boolean))];
 		const avatarEntries = await Promise.all(
 			uniqueUserIds.map(async (userId) => {
 				try {
-					const url = await presignAvatarUrl(userId);
+					const user = await getUserById(userId);
+					const url = await resolveAvatarUrl(userId, user?.avatar_url);
 					return [userId, url] as [string, string | null];
 				} catch {
 					return [userId, null] as [string, null];
--- a/ui/src/routes/api/profile/avatar/+server.ts
+++ b/ui/src/routes/api/profile/avatar/+server.ts
@@ -1,6 +1,6 @@
 import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
-import { presignAvatarUrl } from '$lib/server/minio';
+import { presignAvatarUrl, resolveAvatarUrl } from '$lib/server/minio';
 import { updateUserAvatarUrl, getUserByUsername } from '$lib/server/pocketbase';
 import { backendFetch } from '$lib/server/scraper';

@@ -63,10 +63,6 @@ export const GET: RequestHandler = async ({ locals }) => {
 	if (!locals.user) error(401, 'Not authenticated');

 	const record = await getUserByUsername(locals.user.username).catch(() => null);
-	if (!record?.avatar_url) {
-		return json({ avatar_url: null });
-	}
-
-	const avatarUrl = await presignAvatarUrl(locals.user.id);
+	const avatarUrl = await resolveAvatarUrl(locals.user.id, record?.avatar_url).catch(() => null);
 	return json({ avatar_url: avatarUrl });
 };
--- a/ui/src/routes/api/users/[username]/+server.ts
+++ b/ui/src/routes/api/users/[username]/+server.ts
@@ -1,7 +1,7 @@
 import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getPublicProfile, getSubscription } from '$lib/server/pocketbase';
-import { presignAvatarUrl } from '$lib/server/minio';
+import { resolveAvatarUrl } from '$lib/server/minio';
 import { log } from '$lib/server/logger';

 /**
@@ -15,11 +15,9 @@ export const GET: RequestHandler = async ({ params, locals }) => {
 		const profile = await getPublicProfile(username);
 		if (!profile) error(404, `User "${username}" not found`);

-		// Resolve avatar presigned URL if set
+		// Resolve avatar — MinIO first, fall back to OAuth provider picture
 		let avatarUrl: string | null = null;
-		if (profile.avatar_url) {
-			avatarUrl = await presignAvatarUrl(profile.id).catch(() => null);
-		}
+		avatarUrl = await resolveAvatarUrl(profile.id, profile.avatar_url).catch(() => null);

 		// Is the current logged-in user subscribed?
 		let isSubscribed = false;
--- a/ui/src/routes/catalogue/+page.svelte
+++ b/ui/src/routes/catalogue/+page.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { enhance } from '$app/forms';
+	import { goto } from '$app/navigation';
 	import { navigating } from '$app/state';
 	import { untrack } from 'svelte';
 	import type { PageData, ActionData } from './$types';
@@ -7,6 +8,29 @@

 	let { data, form }: { data: PageData; form: ActionData } = $props();

+	// ── Local filter state (mirrors URL params) ──────────────────────────────
+	// These are separate from data.* so we can bind them to selects and keep
+	// the DOM in sync. They sync back from data whenever a navigation completes.
+	let filterSort = $state(untrack(() => data.sort));
+	let filterGenre = $state(untrack(() => data.genre));
+	let filterStatus = $state(untrack(() => data.status));
+
+	// Keep local state in sync whenever SvelteKit re-runs the load (URL changed).
+	$effect(() => {
+		filterSort = data.sort;
+		filterGenre = data.genre;
+		filterStatus = data.status;
+	});
+
+	function applyFilters() {
+		const params = new URLSearchParams();
+		params.set('sort', filterSort);
+		params.set('genre', filterGenre);
+		params.set('status', filterStatus);
+		params.set('page', '1');
+		goto(`/catalogue?${params.toString()}`);
+	}
+
 	// Track which novel card is currently being navigated to
 	let loadingSlug = $state<string | null>(null);

@@ -389,11 +413,11 @@
 				<select
 					id="filter-sort"
 					name="sort"
-					value={data.sort}
+					bind:value={filterSort}
 					class="bg-zinc-900 border border-zinc-700 text-zinc-200 text-sm rounded px-3 py-2 focus:outline-none focus:border-amber-400 w-full"
 				>
 					{#each sorts as s}
-						<option value={s.value}>{s.label}</option>
+						<option value={s.value} selected={s.value === filterSort}>{s.label}</option>
 					{/each}
 				</select>
 			</div>
@@ -403,12 +427,12 @@
 				<select
 					id="filter-genre"
 					name="genre"
-					value={data.genre}
+					bind:value={filterGenre}
 					disabled={isRankView}
 					class="bg-zinc-900 border border-zinc-700 text-zinc-200 text-sm rounded px-3 py-2 focus:outline-none focus:border-amber-400 disabled:opacity-40 disabled:cursor-not-allowed w-full"
 				>
 					{#each genres as g}
-						<option value={g.value}>{g.label}</option>
+						<option value={g.value} selected={g.value === filterGenre}>{g.label}</option>
 					{/each}
 				</select>
 			</div>
@@ -418,12 +442,12 @@
 				<select
 					id="filter-status"
 					name="status"
-					value={data.status}
+					bind:value={filterStatus}
 					disabled={isRankView}
 					class="bg-zinc-900 border border-zinc-700 text-zinc-200 text-sm rounded px-3 py-2 focus:outline-none focus:border-amber-400 disabled:opacity-40 disabled:cursor-not-allowed w-full"
 				>
 					{#each statuses as st}
-						<option value={st.value}>{st.label}</option>
+						<option value={st.value} selected={st.value === filterStatus}>{st.label}</option>
 					{/each}
 				</select>
 			</div>
@@ -438,8 +462,8 @@
 				Reset
 			</a>
 			<button
-				type="submit"
-				onclick={() => (filtersOpen = false)}
+				type="button"
+				onclick={applyFilters}
 				class="px-4 py-2 rounded bg-amber-400 text-zinc-900 text-sm font-semibold hover:bg-amber-300 transition-colors"
 			>
 				Apply
--- a/ui/src/routes/profile/+page.server.ts
+++ b/ui/src/routes/profile/+page.server.ts
@@ -1,7 +1,7 @@
 import { fail, redirect } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 import { changePassword, listUserSessions, getUserByUsername } from '$lib/server/pocketbase';
-import { presignAvatarUrl } from '$lib/server/minio';
+import { resolveAvatarUrl } from '$lib/server/minio';
 import { log } from '$lib/server/logger';

 export const load: PageServerLoad = async ({ locals }) => {
@@ -16,13 +16,11 @@ export const load: PageServerLoad = async ({ locals }) => {
 		log.warn('profile', 'listUserSessions failed (non-fatal)', { err: String(e) });
 	}

-	// Fetch avatar presigned URL if user has one
+	// Fetch avatar — MinIO first, fall back to OAuth provider picture
 	let avatarUrl: string | null = null;
 	try {
 		const record = await getUserByUsername(locals.user.username);
-		if (record?.avatar_url) {
-			avatarUrl = await presignAvatarUrl(locals.user.id);
-		}
+		avatarUrl = await resolveAvatarUrl(locals.user.id, record?.avatar_url);
 	} catch (e) {
 		log.warn('profile', 'avatar fetch failed (non-fatal)', { err: String(e) });
 	}
--- a/ui/src/routes/users/[username]/+page.server.ts
+++ b/ui/src/routes/users/[username]/+page.server.ts
@@ -6,7 +6,7 @@ import {
 	getUserPublicLibrary,
 	getUserCurrentlyReading
 } from '$lib/server/pocketbase';
-import { presignAvatarUrl } from '$lib/server/minio';
+import { resolveAvatarUrl } from '$lib/server/minio';
 import { log } from '$lib/server/logger';

 export const load: PageServerLoad = async ({ params, locals }) => {
@@ -15,11 +15,9 @@ export const load: PageServerLoad = async ({ params, locals }) => {
 	const profile = await getPublicProfile(username).catch(() => null);
 	if (!profile) error(404, `User "${username}" not found`);

-	// Resolve avatar
+	// Resolve avatar — MinIO first, fall back to OAuth provider picture
 	let avatarUrl: string | null = null;
-	if (profile.avatar_url) {
-		avatarUrl = await presignAvatarUrl(profile.id).catch(() => null);
-	}
+	avatarUrl = await resolveAvatarUrl(profile.id, profile.avatar_url).catch(() => null);

 	// Subscription state for the logged-in visitor
 	let isSubscribed = false;
Author	SHA1	Message	Date
Admin	801928aadf	fix(scraper): update status and genres selectors for current novelfire.net HTML Some checks failed CI / Backend (push) Failing after 11s Details CI / UI (push) Successful in 48s Details Release / Test backend (push) Successful in 50s Details Release / Check ui (push) Successful in 55s Details CI / UI (pull_request) Successful in 37s Details Release / Docker / caddy (push) Successful in 47s Details CI / Backend (pull_request) Successful in 46s Details Release / Docker / runner (push) Successful in 2m37s Details Release / Docker / ui (push) Successful in 2m42s Details Release / Docker / backend (push) Successful in 3m13s Details Release / Gitea Release (push) Failing after 2s Details novelfire.net changed its book page structure. Old selectors produced empty status and null genres for every book, causing all Meilisearch filters to return zero results. Old → new: - status: <span class="status"> → <strong class="ongoing\|completed\|hiatus"> (text lowercased for consistent index values) - genres: <div class="genres"> <a> → <div class="categories"> <a class="property-item"> (text lowercased for consistent index values) Adds TestParseMetadataSelectors to guard against future regressions.	2026-03-28 22:54:35 +05:00
Admin	040072c3f5	docs(d2): update architecture and api-routing diagrams to current state All checks were successful CI / Backend (pull_request) Successful in 33s Details CI / UI (pull_request) Successful in 40s Details architecture.d2: - Split app into prod VPS (165.22.70.138) and homelab runner (192.168.0.109) - Add CrowdSec, Dozzle agent, pocket-tts (voice samples) - Valkey now shown as Asynq job queue in addition to presign cache - Add caddy-l4 Redis TCP proxy (:6380) to Caddy label - Add CI/CD node (Gitea Actions) with full job list incl. releases.json bake - Remove runner from prod app group (it runs on homelab only) - Watchtower: note runner is label-disabled on prod api-routing.d2: - Add /api/presign/* routes to backend (presign_be group) - Add /api/audio POST + status GET to both sk and be - Add /api/scrape/book and /api/scrape/book/range to scrape_sk - Catalogue: annotate Meilisearch vs legacy browse - Add Meilisearch filter/sort fields to storage node - Add Asynq queue note to Valkey storage node - Fix presign proxy: sk routes through be.presign_be, not directly to storage	2026-03-28 22:44:31 +05:00
Admin	6a76e97a67	fix(ci): follow HTTP redirect and validate JSON in fetch-releases step Some checks failed CI / Backend (push) Successful in 26s Details Release / Test backend (push) Successful in 42s Details Release / Check ui (push) Successful in 28s Details CI / UI (push) Successful in 1m4s Details CI / UI (pull_request) Failing after 11s Details CI / Backend (pull_request) Successful in 27s Details Release / Docker / caddy (push) Successful in 1m3s Details Release / Docker / runner (push) Failing after 1m3s Details Release / Docker / ui (push) Successful in 1m53s Details Release / Docker / backend (push) Failing after 4m2s Details Release / Gitea Release (push) Has been skipped Details curl -sf without -L silently wrote '301 Moved Permanently' to releases.json instead of following the http→https redirect. Added -L to follow redirects, set -euo pipefail, and jq type validation so the step fails hard on bad JSON.	2026-03-28 22:38:09 +05:00
Admin	71f79c8e02	feat(admin): bake changelog into UI image at CI build time Some checks failed CI / Backend (push) Failing after 11s Details Release / Test backend (push) Successful in 34s Details CI / UI (push) Successful in 48s Details Release / Check ui (push) Successful in 1m5s Details Release / Docker / caddy (push) Successful in 52s Details CI / Backend (pull_request) Successful in 42s Details CI / UI (pull_request) Successful in 37s Details Release / Docker / backend (push) Failing after 44s Details Release / Docker / ui (push) Successful in 2m24s Details Release / Docker / runner (push) Failing after 3m24s Details Release / Gitea Release (push) Has been skipped Details Replace runtime Gitea API fetch with fs.readFileSync of releases.json, which CI writes to ui/static/ before the Docker build context is sent. Eliminates prod→homelab network dependency for the changelog page.	2026-03-28 21:49:52 +05:00
Admin	5ee4a06654	feat(admin): compact scrape page layout; add Changelog page Some checks failed CI / Backend (push) Successful in 48s Details CI / UI (push) Successful in 35s Details Release / Test backend (push) Successful in 39s Details Release / Check ui (push) Successful in 36s Details CI / Backend (pull_request) Successful in 41s Details Release / Docker / caddy (push) Successful in 1m31s Details CI / UI (pull_request) Successful in 49s Details Release / Docker / backend (push) Failing after 1m9s Details Release / Docker / ui (push) Successful in 2m18s Details Release / Docker / runner (push) Successful in 3m49s Details Release / Gitea Release (push) Has been skipped Details - Scrape page: replace three large cards + genre card with a compact bordered table of rows (label + inline controls per action). Visually much lighter, all controls visible without scrolling. - Admin sidebar: add Changelog link after Audio. - New /admin/changelog page: fetches releases from Gitea API and renders them as a clean list (tag, title, date, body).	2026-03-28 21:41:13 +05:00
Admin	63b286d0a4	fix(caddy): move layer4 into global block; use :6380 listener address Some checks failed CI / Backend (push) Successful in 30s Details CI / UI (push) Successful in 39s Details Release / Test backend (push) Successful in 40s Details Release / Check ui (push) Successful in 25s Details CI / UI (pull_request) Successful in 25s Details Release / Docker / caddy (push) Successful in 1m9s Details CI / Backend (pull_request) Successful in 1m14s Details Release / Docker / ui (push) Successful in 3m56s Details Release / Docker / runner (push) Successful in 4m41s Details Release / Docker / backend (push) Successful in 7m51s Details Release / Gitea Release (push) Failing after 2s Details The bare { } block at the bottom was a second global options block which Caddy's caddyfile adapter rejects on reload. Merged layer4 into the single top-level global block. Changed listener from hostname (redis.libnovel.cc:6380) to :6380 so Caddy binds to the local interface rather than the Cloudflare IP that resolves for the hostname.	2026-03-28 21:36:12 +05:00
Admin	d3f06c5c40	fix(caddy): add 404 error page; add health checks and lb_try_duration to ui upstream Some checks failed Release / Test backend (push) Successful in 26s Details CI / Backend (push) Successful in 42s Details CI / UI (push) Successful in 47s Details Release / Check ui (push) Successful in 26s Details CI / UI (pull_request) Successful in 26s Details CI / Backend (pull_request) Successful in 44s Details Release / Docker / caddy (push) Successful in 53s Details Release / Docker / backend (push) Failing after 1m4s Details Release / Docker / runner (push) Failing after 1m3s Details Release / Docker / ui (push) Successful in 1m54s Details Release / Gitea Release (push) Has been skipped Details - Add caddy/errors/404.html (matches existing 502/503/504 style) - Add handle_errors 404 block in Caddyfile - Add active health checks (5s interval) and lb_try_duration 3s to the ui reverse_proxy so Caddy detects Watchtower container replacements quickly and serves the 502 maintenance page instead of a raw error	2026-03-28 21:32:04 +05:00
Admin	e71ddc2f8b	fix(backend): add ffmpeg to backend image for pocket-tts voice sample generation Some checks failed CI / Backend (push) Successful in 29s Details CI / UI (push) Successful in 27s Details Release / Test backend (push) Successful in 37s Details CI / Backend (pull_request) Failing after 11s Details Release / Check ui (push) Successful in 49s Details Release / Docker / caddy (push) Successful in 57s Details CI / UI (pull_request) Successful in 56s Details Release / Docker / runner (push) Failing after 1m22s Details Release / Docker / backend (push) Failing after 1m46s Details Release / Docker / ui (push) Successful in 2m25s Details Release / Gitea Release (push) Has been skipped Details handlePresignVoiceSample generates voice samples on demand via pocket-tts, which requires WAV→MP3 transcoding via ffmpeg. The backend was using distroless/static (no ffmpeg) so all pocket-tts preview requests returned 500. Switch backend stage to Alpine + ffmpeg, matching the runner image.	2026-03-28 21:24:59 +05:00
Admin	b783dae5f4	refactor(admin): replace tab bar with sidebar layout Some checks failed CI / Backend (push) Successful in 38s Details CI / UI (push) Successful in 42s Details Release / Test backend (push) Successful in 40s Details Release / Check ui (push) Successful in 33s Details CI / Backend (pull_request) Successful in 28s Details Release / Docker / caddy (push) Successful in 1m11s Details CI / UI (pull_request) Successful in 29s Details Release / Docker / ui (push) Successful in 1m54s Details Release / Docker / runner (push) Successful in 4m27s Details Release / Docker / backend (push) Failing after 5m11s Details Release / Gitea Release (push) Has been skipped Details Move admin navigation from a two-row tab strip into a persistent left sidebar with grouped sections (Pages / Tools). Consolidate Scrape and Audio entries in the global top nav into a single Admin link.	2026-03-28 21:15:49 +05:00
Admin	dcf40197d4	fix(ui): brighten footer link text for readability on dark background Some checks failed CI / Backend (push) Successful in 51s Details CI / UI (push) Successful in 28s Details Release / Test backend (push) Successful in 50s Details Release / Docker / caddy (push) Successful in 1m0s Details Release / Check ui (push) Successful in 1m15s Details CI / Backend (pull_request) Successful in 41s Details CI / UI (pull_request) Successful in 32s Details Release / Docker / ui (push) Successful in 2m2s Details Release / Docker / backend (push) Successful in 4m9s Details Release / Docker / runner (push) Successful in 5m46s Details Release / Gitea Release (push) Failing after 1s Details	2026-03-28 21:12:46 +05:00
Admin	9dae5e7cc0	fix(infra): add POCKET_TTS_URL to backend and runner services Some checks failed CI / Backend (push) Successful in 27s Details Release / Test backend (push) Successful in 39s Details CI / UI (push) Successful in 48s Details Release / Check ui (push) Successful in 25s Details CI / UI (pull_request) Successful in 25s Details CI / Backend (pull_request) Successful in 45s Details Release / Docker / caddy (push) Successful in 1m7s Details Release / Docker / backend (push) Successful in 2m17s Details Release / Docker / ui (push) Successful in 2m9s Details Release / Docker / runner (push) Failing after 3m34s Details Release / Gitea Release (push) Has been skipped Details Backend was missing POCKET_TTS_URL entirely — pocketTTSClient was nil so voices() only returned 67 Kokoro voices. Runner already had the var via Doppler but it was absent from the compose environment block. Also fix stray leading space on backend environment: key (YAML parse error). Verified: /api/voices now returns 87 voices (67 kokoro + 20 pocket-tts).	2026-03-28 20:54:04 +05:00
Admin	908f5679fd	fix(ui): defer catalogue filter navigation to explicit Apply button Some checks failed CI / Backend (push) Failing after 11s Details Release / Check ui (push) Successful in 34s Details Release / Test backend (push) Successful in 52s Details CI / UI (push) Successful in 55s Details Release / Docker / caddy (push) Successful in 48s Details CI / UI (pull_request) Successful in 39s Details CI / Backend (pull_request) Successful in 43s Details Release / Docker / runner (push) Failing after 38s Details Release / Docker / ui (push) Successful in 1m55s Details Release / Docker / backend (push) Successful in 3m30s Details Release / Gitea Release (push) Has been skipped Details Removed onchange→navigateWithFilters from all three selects — the immediate navigation on every change was the root cause of both bugs: 1. Filters applied before the user finished selecting all options. 2. Svelte 5 bind:value updates state after onchange fires, so the navigateWithFilters call read stale values → wrong URL params → no results. Renamed navigateWithFilters to applyFilters (no overrides arg needed). Added an amber Apply button next to Reset; selects now only update local state until the user presses Apply.	2026-03-28 19:44:36 +05:00
Admin	f75292f531	fix(homelab): add Google + GitHub OAuth env vars to Fider service All checks were successful CI / Backend (pull_request) Successful in 45s Details CI / UI (pull_request) Successful in 38s Details	2026-03-28 19:38:11 +05:00
Admin	2cf0528730	fix(ui): show version+SHA+build time in footer; fix env not reaching runtime image Some checks failed CI / Backend (push) Successful in 51s Details CI / UI (push) Successful in 27s Details Release / Docker / caddy (push) Failing after 23s Details Release / Test backend (push) Successful in 38s Details Release / Check ui (push) Successful in 39s Details CI / Backend (pull_request) Successful in 28s Details CI / UI (pull_request) Successful in 36s Details Release / Docker / backend (push) Failing after 1m25s Details Release / Docker / runner (push) Successful in 2m25s Details Release / Docker / ui (push) Successful in 1m51s Details Release / Gitea Release (push) Has been skipped Details PUBLIC_BUILD_VERSION and PUBLIC_BUILD_COMMIT were set only in the builder stage ENV — they were never re-declared in the runtime stage, so the Node server started with them undefined and the badge always showed 'dev'. Fix: re-declare all three ARGs after the second FROM and set runtime ENVs. Add PUBLIC_BUILD_TIME (ISO timestamp from gitea.event.head_commit.timestamp) injected via build-arg in release.yaml. Badge now shows e.g.: v2.3.9+abc1234 · 28 Mar 2026 14:30 UTC	2026-03-28 19:33:49 +05:00
Admin	428b57732e	fix(ui): resolve avatar URL from MinIO; fall back to OAuth provider URL Some checks failed CI / Backend (push) Successful in 50s Details CI / UI (push) Successful in 34s Details Release / Test backend (push) Successful in 37s Details Release / Check ui (push) Successful in 45s Details Release / Docker / caddy (push) Successful in 35s Details CI / Backend (pull_request) Successful in 49s Details CI / UI (pull_request) Successful in 40s Details Release / Docker / backend (push) Failing after 52s Details Release / Docker / runner (push) Failing after 58s Details Release / Docker / ui (push) Failing after 55s Details Release / Gitea Release (push) Has been skipped Details Add resolveAvatarUrl(userId, storedValue) helper that tries MinIO first, then falls back to the stored HTTP URL for OAuth users (Google/GitHub) who have never uploaded a custom avatar. Add getUserById() to pocketbase helpers for batch avatar resolution in comments. Update all 6 call sites to use the new helper.	2026-03-28 19:23:30 +05:00
Admin	61e77e3e28	ci: remove Docker builds from CI; keep vet/build/test/type-check only All checks were successful CI / Backend (push) Successful in 43s Details CI / UI (push) Successful in 37s Details CI / UI (pull_request) Successful in 35s Details CI / Backend (pull_request) Successful in 1m9s Details Docker image builds belong to the release workflow (tag-triggered). CI now runs: go vet, go build (backend/runner/healthcheck), go test, svelte-check, and UI vite build — fast feedback without Docker overhead. Also triggers on all branches, not just main/master.	2026-03-28 19:08:17 +05:00
Admin	b363c151a5	fix(ui): fix catalogue filters in Svelte 5; improve build badge visibility Some checks failed Release / Test backend (push) Successful in 40s Details Release / Check ui (push) Successful in 49s Details Release / Docker / caddy (push) Failing after 1m0s Details CI / Test backend (pull_request) Successful in 40s Details CI / Docker / caddy (pull_request) Failing after 21s Details CI / Check ui (pull_request) Successful in 48s Details Release / Docker / ui (push) Successful in 2m49s Details Release / Docker / runner (push) Successful in 3m10s Details Release / Docker / backend (push) Successful in 3m47s Details Release / Gitea Release (push) Has been skipped Details CI / Docker / ui (pull_request) Successful in 1m31s Details CI / Docker / backend (pull_request) Successful in 3m13s Details CI / Docker / runner (pull_request) Successful in 3m59s Details - Catalogue filter selects: replace value= initializer with bind:value + onchange goto() so filters navigate immediately on change (no Apply button) - Add selected= on each <option> for correct DOM initialisation in Svelte 5 - Build badge: give distinct bg-zinc-800 pill, visible zinc-300/400/500 text instead of zinc-700/zinc-800 which blended into the footer background	2026-03-28 19:01:58 +05:00