feat: Add gallery management to admin panel + system documentation

Features:
- Gallery upload, delete, reorder (drag & drop)
- Preview images in admin panel
- Same upload flow as events (WebP conversion via sharp)
- Complete system documentation explaining:
  - Architecture (Frontend/Backend/Volume)
  - Upload flow (Multipart → Sharp → WebP → Storage)
  - Why SQLite works on Fly.io (persistent volumes)
  - Troubleshooting guide

Admin now has full CRUD for both Events and Gallery!

.gitignore

@@ -22,3 +22,4 @@ pnpm-debug.log*
 
 # jetbrains setting folder
 .idea/
+/ai/

.woodpecker.yml

@@ -1,5 +1,5 @@
 steps:
-  deploy:
+  deploy_frontend:
     image: node:20
     environment:
       FLY_API_TOKEN:
@@ -7,10 +7,7 @@ steps:
     commands:
       - curl -L https://fly.io/install.sh | sh
       - export PATH="$HOME/.fly/bin:$PATH"
-      - flyctl deploy --config fly.toml --app gallus-pub
-
+      - flyctl deploy --config fly.toml --app gallus-pub --remote-only
     when:
-  branch:
-    - main
-  event:
-    - push
+      branch: main
+      event: push

CLAUDE.md

@@ -1,40 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-This is a website for Gallus Pub, a bar/pub in Switzerland. The site is built with Astro, a static site generator, and uses component-based architecture with .astro files. Content is in German.
-
-## Development Commands
-
-```bash
-npm install              # Install dependencies
-npm run dev             # Start dev server at localhost:4321
-npm run build           # Build production site to ./dist/
-npm run preview         # Preview production build locally
-npm run astro ...       # Run Astro CLI commands
-```
-
-## Architecture
-
-### Component Structure
-- **Layout.astro**: Base layout template that wraps all pages. Imports global styles (variables.css, index.css) and includes Header/Footer components
-- **Pages** (`src/pages/`): File-based routing where each .astro file becomes a route
-  - `index.astro`: Main landing page that composes multiple sections (Hero, Welcome, EventsGrid, ImageCarousel, Drinks)
-  - `Gallery.astro`, `Openings.astro`: Additional pages
-- **Components** (`src/components/`): Reusable UI components
-  - Most components have corresponding CSS files in `src/styles/components/`
-  - EventsGrid uses HoverCard components to display event information
-  - Event data is defined directly in page files (e.g., events array in index.astro)
-
-### Content Management Pattern
-Event data and image galleries are defined as JavaScript arrays in the frontmatter of page files (see index.astro:11-55). This is the current pattern for managing dynamic content rather than using a separate CMS or data files.
-
-### Styling
-- Global styles: `src/styles/variables.css` (CSS custom properties) and `src/styles/index.css`
-- Component styles: `src/styles/components/[ComponentName].css`
-- All styles are imported in component files, not centrally
-
-### Static Assets
-Images and other static files are in `/public/images/` and referenced with absolute paths (e.g., "/images/Gallery1.png")

Dockerfile

@@ -2,7 +2,8 @@ FROM node:20-alpine AS build
 
 WORKDIR /app
 COPY package*.json ./
-RUN npm ci
+# Fallback to npm install if no lockfile is present
+RUN npm ci || npm install
 COPY . .
 # Ensure CSS variables are present
 RUN mkdir -p public/styles
@@ -16,7 +17,8 @@ RUN npm install -g serve
 COPY --from=build /app/dist ./dist
 
 EXPOSE 3000
-CMD ["serve", "-s", "dist", "-l", "3000"]
+# Serve static files (no SPA fallback), so /admin serves dist/admin/index.html
+CMD ["serve", "-l", "3000", "dist"]
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
   CMD wget -qO- http://localhost:3000/ || exit 1

Dockerfile.caddy

@@ -0,0 +1,9 @@
+FROM caddy:2-alpine
+
+# Embed Caddyfile directly to avoid host path issues on Windows
+RUN mkdir -p /etc/caddy \
+ && printf ":80\nlog\nroute {\n  handle /api/* {\n    reverse_proxy backend:8080\n  }\n  handle {\n    reverse_proxy frontend:3000\n  }\n}\n" > /etc/caddy/Caddyfile
+
+EXPOSE 80
+
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

MIGRATION_README.md

@@ -0,0 +1,142 @@
+# Migration der alten Events und Gallery-Bilder
+
+## ✅ Was wurde migriert?
+
+### Events (7 Stück):
+- Karaoke (wiederkehrend)
+- Pub Quiz (wiederkehrend)
+- Schlager Hüttenzauber Karaoke
+- Adventskalender
+- Santa Karaoke-Party
+- Weihnachtsferien
+- Neujahrs-Apero
+
+### Gallery-Bilder (9 Stück):
+- Gallery1.webp bis Gallery9.webp
+
+## 📁 Wo liegen die Bilder?
+
+Alle Bilder wurden konvertiert und liegen jetzt in:
+- **Events:** `backend/data/images/events/`
+- **Gallery:** `backend/data/images/gallery/`
+
+Die Bilder wurden automatisch:
+- Von PNG/JPG/JPEG zu WebP konvertiert
+- Auf max. 1600px Breite skaliert
+- Mit 85% Qualität optimiert
+
+## 🚀 Deployment-Schritte
+
+### 1. Lokale Vorbereitung (bereits erledigt ✓)
+- ✓ Migrations-Script erstellt
+- ✓ Bilder konvertiert und in `backend/data/images/` kopiert
+- ✓ Public API-Endpunkte erstellt (`/api/events/public`, `/api/gallery/public`)
+- ✓ Frontend aktualisiert, um Events und Gallery dynamisch zu laden
+
+### 2. Auf Fly.io deployen
+
+Alle Änderungen committen und pushen:
+```bash
+git add .
+git commit -m "feat: Migrate old events and gallery images to CMS"
+git push origin main
+```
+
+Woodpecker CI wird automatisch beide Services deployen.
+
+### 3. Nach dem ersten Deploy - Datenbank initialisieren
+
+**Wichtig:** Die Bilder sind bereits im Repository in `backend/data/images/`, aber die Datenbank muss noch mit den Event- und Gallery-Einträgen befüllt werden.
+
+#### Via fly ssh (Empfohlen):
+
+```bash
+# In das Backend einloggen
+fly ssh console -a gallus-cms-backend
+
+# Prüfen ob Bilder da sind
+ls -la /app/data/images/events/
+ls -la /app/data/images/gallery/
+
+# Migrations-Script ausführen
+cd /app
+npm run migrate:old-data
+```
+
+#### Alternative: Manuell via Admin-Panel
+
+1. Gehe zu https://gallus-pub.ch/admin
+2. Melde dich an
+3. Für jedes Event:
+   - Klicke auf "Neues Event"
+   - Gib Titel, Datum und Beschreibung ein
+   - Statt Bild hochzuladen, trage manuell die imageUrl ein:
+     - z.B. `/images/events/event_karaoke.webp`
+   - Speichere das Event
+
+## 🔍 Verifikation
+
+Nach dem Deployment prüfen:
+
+1. **Frontend:** https://gallus-pub.ch/
+   - Events sollten angezeigt werden
+   - Gallery sollte Bilder zeigen
+
+2. **Admin:** https://gallus-pub.ch/admin
+   - Events können bearbeitet werden
+   - Neue Events können hinzugefügt werden
+
+3. **Backend Health:** https://cms.gallus-pub.ch/health
+   - Status sollte "ok" sein
+
+## 📝 Event-Daten für manuelles Einfügen
+
+Falls du die Events manuell via Admin-Panel einfügen möchtest:
+
+### Karaoke
+- **Titel:** Karaoke
+- **Datum:** 2025-12-31
+- **Beschreibung:** Bei uns gibt es Karaoke Mi-Sa!! <br>Seid ihr eine Gruppe und lieber unter euch? ..unseren 2.Stock kannst du auch mieten ;) <br>Reserviere am besten gleich per Whatsapp <a href="tel:+41772322770">077 232 27 70</a>
+- **Bild-URL:** `/images/events/event_karaoke.webp`
+
+### Pub Quiz
+- **Titel:** Pub Quiz
+- **Datum:** 2025-12-31
+- **Beschreibung:** Jeden Freitag findet unser <b>Pub Quiz</b> statt. Gespielt wird tischweise in 3-4 Runden. <br>Jede Woche gibt es ein anderes Thema. Es geht um Ruhm und Ehre und zusätzlich werden die Sieger der Herzen durch das Publikum gekürt! <3 <br>Auch Einzelpersonen sind herzlich willkommen! <br>*zum mitmachen minimum 1 Getränk konsumieren oder 5CHF
+- **Bild-URL:** `/images/events/event_pub-quiz.webp`
+
+### Schlager Hüttenzauber Karaoke
+- **Titel:** Schlager Hüttenzauber Karaoke
+- **Datum:** 2025-11-27
+- **Beschreibung:** Ab 19:00 Uhr Eintritt ist Frei! Reservieren unter <a href="tel:+41772322770">077 232 27 70</a>
+- **Bild-URL:** `/images/events/event_schlager-karaoke.webp`
+
+### Adventskalender
+- **Titel:** Adventskalender
+- **Datum:** 2025-12-20
+- **Beschreibung:** Jeden Tag neue Überraschungen! Check unsere Social Media Stories!
+- **Bild-URL:** `/images/events/event_advents-kalender.webp`
+
+### Santa Karaoke-Party
+- **Titel:** Santa Karaoke-Party
+- **Datum:** 2025-12-06
+- **Beschreibung:** 🤶🏻🎅🏻Komme als Weihnachts-Mann/-Frau und bekomme einen Shot auf's Haus!🤶🏻🎅🏻
+- **Bild-URL:** `/images/events/event_santa_karaoke.webp`
+
+### Weihnachtsferien
+- **Titel:** Weihnachtsferien
+- **Datum:** 2025-12-21
+- **Beschreibung:** Wir sind ab 02.01.2026 wieder wie gewohnt für euch da! 🍀. <br> Für Anfragen WA <a href="tel:+41772322770">077 232 27 70</a> Antwort innerhalb 48h
+- **Bild-URL:** `/images/events/event_ferien.webp`
+
+### Neujahrs-Apero
+- **Titel:** Neujahrs-Apero
+- **Datum:** 2026-01-02
+- **Beschreibung:** 18:00-20:00 Uhr
+- **Bild-URL:** `/images/events/event_neujahrs-apero.webp`
+
+## ⚠️ Wichtige Hinweise
+
+1. **Bilder sind im Volume persistent:** Alle Bilder in `/app/data/` bleiben bei Restarts erhalten
+2. **Datenbank ist persistent:** Die SQLite-DB in `/app/data/gallus_cms.db` bleibt erhalten
+3. **Alte Bilder in `public/images/`:** Die alten Original-Bilder bleiben im Frontend-Repository, werden aber nicht mehr verwendet

README.md

@@ -45,3 +45,4 @@ All commands are run from the root of the project, from a terminal:
 ## 👀 Want to learn more?
 
 Feel free to check [our documentation](https://docs.astro.build) or jump into our [Discord server](https://astro.build/chat).
+# Test commit to trigger Woodpecker

SYSTEM_ERKLAERUNG.md

@@ -0,0 +1,220 @@
+# 🎯 Gallus Pub CMS - System-Erklärung
+
+## 📐 Architektur-Überblick
+
+```
+┌─────────────────┐         ┌──────────────────┐         ┌─────────────────┐
+│   Frontend      │         │   Backend CMS    │         │  Fly.io Volume  │
+│  (Astro SSG)    │◄────────┤   (Fastify API)  │◄────────┤   /app/data/    │
+│ gallus-pub.ch   │  fetch  │ cms.gallus-pub.ch│  mount  │  - SQLite DB    │
+│                 │         │                  │         │  - images/      │
+└─────────────────┘         └──────────────────┘         └─────────────────┘
+```
+
+## 🔄 Wie funktioniert der Upload-Flow?
+
+### 1. **Admin lädt Bild hoch** (admin.astro)
+```
+User wählt Bild → uploadImage() → POST /api/gallery/upload
+```
+
+### 2. **Backend verarbeitet Upload** (backend/src/routes/gallery.ts)
+```javascript
+// Line 60-134 in gallery.ts
+1. Empfange Multipart-File
+2. Validiere Mimetype (nur images/*)
+3. Lese Stream in Buffer
+4. sharp() konvertiert zu WebP:
+   - Auto-rotate (EXIF)
+   - Resize auf max 1600px
+   - WebP quality 82%
+5. Speichere in /app/data/images/gallery/
+6. Erstelle DB-Eintrag mit imageUrl
+7. Return imageUrl an Frontend
+```
+
+### 3. **Bilder werden serviert** (backend/src/index.ts)
+```javascript
+// Line 63-69
+fastifyStatic → /static/ → /app/data/
+```
+
+Beispiel:
+- Bild liegt in: `/app/data/images/gallery/miyma9zc-8he1di.webp`
+- URL ist: `/images/gallery/miyma9zc-8he1di.webp`
+- Wird serviert als: `https://cms.gallus-pub.ch/static/images/gallery/miyma9zc-8he1di.webp`
+
+### 4. **Frontend zeigt Bilder** (src/pages/index.astro)
+```javascript
+// Line 30-43
+1. Fetch von /api/gallery/public
+2. Map imageUrl: `${API_BASE}${img.imageUrl}`
+3. Result: https://cms.gallus-pub.ch/static/images/gallery/xyz.webp
+```
+
+## 💾 Warum funktioniert SQLite mit Fly.io?
+
+**Fly.io Volumes** sind persistente Speicher:
+- Gemountet als: `/app/data/`
+- Konfiguration in: `backend/fly.toml` (Line 40-42)
+- Bleibt bei Restarts/Deploys erhalten
+
+```toml
+[mounts]
+  source = "gallus_data"
+  destination = "/app/data"
+```
+
+### Was liegt wo?
+
+```
+/app/data/
+├── gallus_cms.db          # SQLite Datenbank
+├── gallus_cms.db-wal      # Write-Ahead Log
+├── gallus_cms.db-shm      # Shared Memory
+└── images/
+    ├── events/
+    │   ├── event_karaoke.webp
+    │   └── ...
+    └── gallery/
+        ├── Gallery1.webp
+        └── ...
+```
+
+## 🔒 Datenfluss im Detail
+
+### Event erstellen:
+```
+1. Admin: Bild auswählen + Formular ausfüllen
+2. uploadImage(file) → /api/gallery/upload
+   ↓
+3. Backend:
+   - Sharp konvertiert → WebP
+   - Speichert in /app/data/images/gallery/
+   - Returnt: { image: { imageUrl: "/images/gallery/xyz.webp" } }
+   ↓
+4. Admin: POST /api/events
+   Body: { title, date, description, imageUrl: "/images/gallery/xyz.webp" }
+   ↓
+5. Backend:
+   - INSERT INTO events (imageUrl = "/images/gallery/xyz.webp")
+   ↓
+6. Frontend: GET /api/events/public
+   - Fetcht Events aus DB
+   - Mapped imageUrl zu voller URL
+   - Zeigt an: <img src="https://cms.gallus-pub.ch/static/images/gallery/xyz.webp">
+```
+
+### Warum separate Uploads für Gallery?
+
+Events nutzen den Gallery-Upload, weil:
+- Beide brauchen WebP-Konvertierung
+- Beide nutzen gleichen Storage
+- Vermeidet Code-Duplikation
+- Gallery kann eigenständige Bildergalerie haben
+
+## 🎨 Admin-Panel Features
+
+### Events-Verwaltung:
+- ✅ Event erstellen (mit Bild-Upload)
+- ✅ Events auflisten
+- ✅ Events löschen
+- ✅ Reihenfolge ändern (Drag & Drop)
+- ✅ Events veröffentlichen/verstecken (isPublished)
+
+### Gallery-Verwaltung: (NEU!)
+- ✅ Bild hochladen
+- ✅ Gallery auflisten
+- ✅ Bilder löschen
+- ✅ Reihenfolge ändern (Drag & Drop)
+- ✅ Bilder veröffentlichen/verstecken (isPublished)
+
+### Publish:
+- Git-Integration (für statische Seiten-Updates)
+- Commit & Push zu Repository
+
+## 🚀 Deployment-Prozess
+
+### Was passiert beim Deploy?
+
+1. **Woodpecker CI** triggered bei Push zu `main`
+2. **Frontend Deploy** (gallus-pub):
+   - Build Astro SSG
+   - Deploy zu Fly.io
+
+3. **Backend Deploy** (gallus-cms-backend):
+   - Docker Build:
+     ```dockerfile
+     # Backend-Code kompilieren
+     npm run build → dist/
+
+     # Migrierte Bilder einpacken
+     COPY backend/data/images → /app/migration-images
+
+     # Migration-Script kopieren
+     COPY migrate-production.js → /app/
+     ```
+   - Deploy zu Fly.io
+   - **Volume bleibt erhalten** (SQLite DB + hochgeladene Bilder)
+
+4. **Nach erstem Deploy**: Migration ausführen
+   ```bash
+   fly ssh console -a gallus-cms-backend
+   node migrate-production.js
+   ```
+   - Kopiert Bilder: `/app/migration-images/` → `/app/data/images/`
+   - Befüllt DB mit Event/Gallery-Einträgen
+
+## 🔍 Troubleshooting
+
+### "Bilder werden nicht angezeigt"
+
+**Prüfe:**
+1. Backend logs: `fly logs -a gallus-cms-backend`
+2. Bild existiert: `fly ssh console -a gallus-cms-backend`
+   ```bash
+   ls -la /app/data/images/gallery/
+   ```
+3. DB-Eintrag korrekt:
+   ```bash
+   sqlite3 /app/data/gallus_cms.db
+   SELECT * FROM gallery_images;
+   ```
+4. Static-Route funktioniert:
+   ```bash
+   curl https://cms.gallus-pub.ch/static/images/gallery/xyz.webp
+   ```
+
+### "SQLite locked" Fehler
+
+- Nur ein Writer zur Zeit erlaubt
+- Bei hohem Traffic: Wechsel zu PostgreSQL empfohlen
+- Für Gallus Pub: ausreichend (wenig Writes)
+
+### "Volume voll"
+
+```bash
+fly volumes list -a gallus-cms-backend
+fly volumes extend <volume-id> -s <new-size>
+```
+
+## 📁 Wichtige Dateien
+
+| Datei | Zweck |
+|-------|-------|
+| `backend/src/routes/gallery.ts` | Gallery-Upload & CRUD |
+| `backend/src/routes/events.ts` | Events CRUD + Public API |
+| `backend/src/index.ts` | Static File Serving |
+| `backend/migrate-production.js` | Initiale Daten-Migration |
+| `src/pages/admin.astro` | Admin-Interface |
+| `src/pages/index.astro` | Frontend (fetched von API) |
+| `backend/fly.toml` | Backend Fly.io Config |
+| `fly.toml` | Frontend Fly.io Config |
+
+## 🎯 Nächste Schritte
+
+1. ✅ Gallery-Verwaltung implementiert
+2. ⏳ Migration ausführen (nach Deploy)
+3. ⏳ Testen: Bild hochladen → Frontend anzeigen
+4. 📋 Optional: Image-Editing Features
+5. 📋 Optional: Bulk-Upload für Gallery

backend/.env.local

@@ -0,0 +1,34 @@
+# Local development environment for Gallus CMS Backend
+
+# Database
+DB_CLIENT=sqlite
+DATABASE_URL=
+DATABASE_PATH=./data/gallus_cms.db
+
+# Gitea OAuth
+GITEA_URL=https://git.bookageek.ch
+GITEA_CLIENT_ID=bcddfe24-3099-41bc-bb7a-6c6d80bd9048
+GITEA_CLIENT_SECRET=gto_me7hsswrsdq2ygey65edlc6qa2xxr3i5nrq7q4jvjwx654ytrh7q
+# Frontend proxy callback in local dev
+GITEA_REDIRECT_URI=http://localhost:4321/api/auth/callback
+GITEA_ALLOWED_USERS=Gallus-maintanance
+
+# Git repository for content versioning
+GIT_REPO_URL=https://git.bookageek.ch/Kenzo/Gallus_Pub
+GIT_TOKEN=1482ae7bcdbd7610bf0cfd468b6757722d16a2a2
+GIT_USER_NAME=Gallus-maintanance
+GIT_USER_EMAIL=Admin@gallus-pub.ch
+GIT_WORKSPACE_DIR=./data/workspace
+
+# JWT & Session secrets (use strong random strings in real deployments)
+JWT_SECRET=local-dev-jwt-secret-please-change-1234567890abcdef
+SESSION_SECRET=local-dev-session-secret-please-change-abcdef1234567890
+
+# Server & CORS
+PORT=3000
+NODE_ENV=development
+FRONTEND_URL=http://localhost:4321
+CORS_ORIGIN=http://localhost:4321
+
+# Upload limits
+MAX_FILE_SIZE=5242880

backend/.gitignore

@@ -4,7 +4,9 @@ dist
 *.log
 .DS_Store
 /tmp
-/data
-*.db
-*.db-wal
-*.db-shm
+/data/*.db
+/data/*.db-wal
+/data/*.db-shm
+/data/workspace
+# Allow images to be committed
+!/data/images

backend/DEPLOYMENT.md

@@ -1,6 +1,6 @@
 # Deployment Guide
 
-## Prerequisites
+## Prerequisite
 
 1. Fly.io CLI installed: `curl -L https://fly.io/install.sh | sh`
 2. Fly.io account: `flyctl auth login`

backend/Dockerfile

@@ -10,7 +10,8 @@ RUN apk add --no-cache python3 make g++
 
 # Install dependencies
 COPY package*.json ./
-RUN npm ci
+# Use npm ci when lockfile exists, fallback to npm install for local/dev
+RUN npm ci || npm install
 
 # Copy source
 COPY . .
@@ -26,17 +27,8 @@ WORKDIR /app
 # Install runtime dependencies (git for simple-git, sqlite3 CLI tool)
 RUN apk add --no-cache git sqlite
 
-# Install build dependencies for better-sqlite3 (needed for npm ci)
-RUN apk add --no-cache python3 make g++
-
-# Copy package files
-COPY package*.json ./
-
-# Install production dependencies only
-RUN npm ci --production
-
-# Remove build dependencies after install
-RUN apk del python3 make g++
+# Copy production dependencies from builder (already compiled native modules)
+COPY --from=builder /app/node_modules ./node_modules
 
 # Copy built files from builder
 COPY --from=builder /app/dist ./dist
@@ -63,5 +55,5 @@ ENV DATABASE_PATH=/app/data/gallus_cms.db
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
   CMD node -e "require('http').get('http://localhost:8080/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"
 
-# Start application
-CMD ["node", "dist/index.js"]
+# Run DB migrations if present, then start application
+CMD ["/bin/sh", "-lc", "[ -f dist/migrate.js ] && node dist/migrate.js || true; node dist/index.js"]

backend/fly.toml

@@ -3,6 +3,8 @@ app = "gallus-cms-backend"
 primary_region = "ams"
 
 [build]
+  # Ensure Fly uses the Dockerfile in this backend directory
+  dockerfile = "Dockerfile"
 
 [env]
   PORT = "8080"
@@ -10,6 +12,10 @@ primary_region = "ams"
   GITEA_URL = "https://git.bookageek.ch"
   DATABASE_PATH = "/app/data/gallus_cms.db"
   GIT_WORKSPACE_DIR = "/app/data/workspace"
+  # Cross-site frontend and OAuth
+  FRONTEND_URL = "https://gallus-pub.ch"
+  CORS_ORIGIN = "https://gallus-pub.ch"
+  GITEA_REDIRECT_URI = "https://cms.gallus-pub.ch/api/auth/callback"
 
 [http_service]
   internal_port = 8080

backend/package.json

@@ -9,14 +9,15 @@
     "start": "node dist/index.js",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
-    "db:studio": "drizzle-kit studio"
+    "db:studio": "drizzle-kit studio",
+    "migrate:old-data": "tsx src/scripts/migrate-old-data.ts"
   },
   "dependencies": {
     "@fastify/cookie": "^9.3.1",
     "@fastify/cors": "^9.0.1",
     "@fastify/jwt": "^8.0.0",
+    "@fastify/static": "^6.12.0",
     "@fastify/multipart": "^8.1.0",
-    "@fastify/session": "^10.8.0",
     "bcrypt": "^5.1.1",
     "better-sqlite3": "^11.10.0",
     "drizzle-orm": "^0.33.0",

backend/src/config/database.ts

@@ -2,14 +2,103 @@ import { drizzle } from 'drizzle-orm/better-sqlite3';
 import Database from 'better-sqlite3';
 import * as schema from '../db/schema.js';
 import { env } from './env.js';
+import fs from 'fs';
+import path from 'path';
 
 if (!env.DATABASE_PATH) {
   throw new Error('DATABASE_PATH environment variable is not set');
 }
 
+// Ensure directory exists BEFORE opening the database file
+const dbDir = path.dirname(env.DATABASE_PATH);
+if (!fs.existsSync(dbDir)) {
+  fs.mkdirSync(dbDir, { recursive: true });
+}
+
 const sqlite = new Database(env.DATABASE_PATH);
 
 // Enable WAL mode for better concurrent access
 sqlite.pragma('journal_mode = WAL');
 
 export const db = drizzle(sqlite, { schema });
+
+// Auto-create tables if they don't exist
+export function initDatabase() {
+  console.log('🔧 Initializing database...');
+
+  try {
+    // Check if users table exists (acts as a sentinel for initial setup)
+    const tableCheck = sqlite
+      .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='users'")
+      .get();
+
+    if (!tableCheck) {
+      console.log('📝 Creating database schema...');
+
+      sqlite.exec(`
+        PRAGMA foreign_keys = ON;
+
+        CREATE TABLE IF NOT EXISTS users (
+          id TEXT PRIMARY KEY,
+          gitea_id TEXT UNIQUE NOT NULL,
+          gitea_username TEXT NOT NULL,
+          gitea_email TEXT,
+          display_name TEXT,
+          avatar_url TEXT,
+          role TEXT DEFAULT 'admin',
+          created_at INTEGER DEFAULT (unixepoch()),
+          last_login INTEGER
+        );
+
+        CREATE TABLE IF NOT EXISTS events (
+          id TEXT PRIMARY KEY,
+          title TEXT NOT NULL,
+          date TEXT NOT NULL,
+          description TEXT NOT NULL,
+          image_url TEXT NOT NULL,
+          display_order INTEGER NOT NULL,
+          is_published INTEGER DEFAULT 1,
+          created_at INTEGER DEFAULT (unixepoch()),
+          updated_at INTEGER DEFAULT (unixepoch())
+        );
+
+        CREATE TABLE IF NOT EXISTS gallery_images (
+          id TEXT PRIMARY KEY,
+          image_url TEXT NOT NULL,
+          alt_text TEXT NOT NULL,
+          display_order INTEGER NOT NULL,
+          is_published INTEGER DEFAULT 1,
+          created_at INTEGER DEFAULT (unixepoch())
+        );
+
+        CREATE TABLE IF NOT EXISTS content_sections (
+          id TEXT PRIMARY KEY,
+          section_name TEXT UNIQUE NOT NULL,
+          content_json TEXT NOT NULL,
+          updated_at INTEGER DEFAULT (unixepoch())
+        );
+
+        CREATE TABLE IF NOT EXISTS site_settings (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL,
+          updated_at INTEGER DEFAULT (unixepoch())
+        );
+
+        CREATE TABLE IF NOT EXISTS publish_history (
+          id TEXT PRIMARY KEY,
+          user_id TEXT REFERENCES users(id),
+          commit_hash TEXT,
+          commit_message TEXT,
+          published_at INTEGER DEFAULT (unixepoch())
+        );
+      `);
+
+      console.log('✅ Database schema created successfully!');
+    } else {
+      console.log('✅ Database already initialized.');
+    }
+  } catch (error) {
+    console.error('❌ Error initializing database:', error);
+    throw error;
+  }
+}

backend/src/index.ts

@@ -3,9 +3,11 @@ import cors from '@fastify/cors';
 import jwt from '@fastify/jwt';
 import multipart from '@fastify/multipart';
 import cookie from '@fastify/cookie';
-import session from '@fastify/session';
 import { authenticate } from './middleware/auth.middleware.js';
 import { env, validateEnv } from './config/env.js';
+import { db, initDatabase } from './config/database.js';
+import fastifyStatic from '@fastify/static';
+import path from 'path';
 
 // Import routes
 import authRoute from './routes/auth.js';
@@ -44,17 +46,12 @@ fastify.register(cors, {
 
 fastify.register(cookie);
 
-fastify.register(session, {
-  secret: env.SESSION_SECRET,
-  cookie: {
-    secure: env.NODE_ENV === 'production',
-    httpOnly: true,
-    maxAge: 600000, // 10 minutes (only needed for OAuth flow)
-  },
-});
-
 fastify.register(jwt, {
   secret: env.JWT_SECRET,
+  cookie: {
+    cookieName: 'token',
+    signed: false,
+  },
 });
 
 fastify.register(multipart, {
@@ -63,6 +60,14 @@ fastify.register(multipart, {
   },
 });
 
+// Serve static files (uploaded images, etc.) from persistent volume
+const dataDir = env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data');
+fastify.register(fastifyStatic, {
+  root: dataDir,
+  prefix: '/static/',
+  decorateReply: false
+});
+
 // Decorate fastify with authenticate method
 fastify.decorate('authenticate', authenticate);
 
@@ -105,6 +110,8 @@ fastify.setErrorHandler((error, request, reply) => {
 // Start server
 const start = async () => {
   try {
+    // Initialize database before starting server
+    initDatabase();
     await fastify.listen({ port: env.PORT, host: '0.0.0.0' });
     console.log(`🚀 Server listening on port ${env.PORT}`);
     console.log(`📝 Environment: ${env.NODE_ENV}`);

backend/src/routes/auth.ts

@@ -6,10 +6,15 @@ import { eq } from 'drizzle-orm';
 import { GiteaService } from '../services/gitea.service.js';
 import { env } from '../config/env.js';
 
-const callbackSchema = z.object({
-  code: z.string(),
-  state: z.string(),
-});
+// Use explicit JSON schema for Fastify route validation to avoid provider issues
+const callbackQueryJsonSchema = {
+  type: 'object',
+  required: ['code', 'state'],
+  properties: {
+    code: { type: 'string' },
+    state: { type: 'string' },
+  },
+} as const;
 
 const authRoute: FastifyPluginAsync = async (fastify) => {
   const giteaService = new GiteaService();
@@ -22,8 +27,14 @@ const authRoute: FastifyPluginAsync = async (fastify) => {
     // Generate CSRF state token
     const state = giteaService.generateState();
 
-    // Store state in session
-    request.session.set('oauth_state', state);
+    // Store state in a short-lived cookie
+    reply.setCookie('oauth_state', state, {
+      path: '/',
+      httpOnly: true,
+      sameSite: 'none',
+      secure: true,
+      maxAge: 10 * 60, // 10 minutes
+    });
 
     // Generate authorization URL
     const authUrl = giteaService.getAuthorizationUrl(state);
@@ -38,20 +49,20 @@ const authRoute: FastifyPluginAsync = async (fastify) => {
    */
   fastify.get('/auth/callback', {
     schema: {
-      querystring: callbackSchema,
+      querystring: callbackQueryJsonSchema,
     },
   }, async (request, reply) => {
     try {
-      const { code, state } = request.query as z.infer<typeof callbackSchema>;
+      const { code, state } = request.query as { code: string; state: string };
 
-      // Verify CSRF state
-      const expectedState = request.session.get('oauth_state');
+      // Verify CSRF state from cookie
+      const expectedState = request.cookies?.oauth_state as string | undefined;
       if (!expectedState || state !== expectedState) {
           return reply.code(400).send({ error: 'Invalid state parameter' });
       }
 
-      // Clear state from session
-      request.session.delete('oauth_state');
+      // Clear state cookie
+      reply.clearCookie('oauth_state', { path: '/' });
 
       // Exchange code for access token
       const tokenResponse = await giteaService.exchangeCodeForToken(code);
@@ -103,18 +114,28 @@ const authRoute: FastifyPluginAsync = async (fastify) => {
         {
           id: user.id,
           giteaId: user.giteaId,
-          username: user.giteaUsername,
-          role: user.role,
+          username: user.giteaUsername || '',
+          role: user.role ?? 'admin',
         },
         { expiresIn: '24h' }
       );
 
-      // Redirect to frontend with token
+      // Also set token as HttpOnly cookie so subsequent API calls authenticate reliably
+      // Cross-site admin (gallus-pub.ch) -> backend (cms.gallus-pub.ch) requires SameSite=None & Secure in production
+      reply.setCookie('token', token, {
+        path: '/',
+        httpOnly: true,
+        sameSite: (env.NODE_ENV === 'production' ? 'none' : 'lax'),
+        secure: (env.NODE_ENV === 'production') || (!!env.FRONTEND_URL && env.FRONTEND_URL.startsWith('https')),
+        maxAge: 60 * 60 * 24, // 24h
+      });
+
+      // Redirect to admin dashboard
       const frontendUrl = env.FRONTEND_URL;
-      return reply.redirect(`${frontendUrl}/auth/callback?token=${token}`);
+      return reply.redirect(`${frontendUrl}/admin`);
 
     } catch (error) {
-      fastify.log.error('OAuth callback error:', error);
+      fastify.log.error({ err: error }, 'OAuth callback error');
       return reply.code(500).send({ error: 'Authentication failed' });
     }
   });
@@ -139,12 +160,14 @@ const authRoute: FastifyPluginAsync = async (fastify) => {
     }
 
     return {
+      user: {
         id: user.id,
-      username: user.giteaUsername,
-      email: user.giteaEmail,
+        giteaUsername: user.giteaUsername,
+        giteaEmail: user.giteaEmail,
         displayName: user.displayName,
         avatarUrl: user.avatarUrl,
         role: user.role,
+      },
     };
   });
 
@@ -157,6 +180,7 @@ const authRoute: FastifyPluginAsync = async (fastify) => {
   }, async (request, reply) => {
     // For JWT, logout is primarily client-side (delete token)
     // You could maintain a token blacklist in Redis for production
+    reply.clearCookie('token', { path: '/' });
     return { message: 'Logged out successfully' };
   });
 };

backend/src/routes/content.ts

@@ -4,9 +4,14 @@ import { db } from '../config/database.js';
 import { contentSections } from '../db/schema.js';
 import { eq } from 'drizzle-orm';
 
-const contentSectionSchema = z.object({
-  contentJson: z.record(z.any()),
-});
+// Fastify JSON schema for content section body
+const contentBodyJsonSchema = {
+  type: 'object',
+  required: ['contentJson'],
+  properties: {
+    contentJson: {}, // allow any JSON
+  },
+} as const;
 
 const contentRoute: FastifyPluginAsync = async (fastify) => {
 
@@ -36,12 +41,12 @@ const contentRoute: FastifyPluginAsync = async (fastify) => {
   // Update content section
   fastify.put('/content/:section', {
     schema: {
-      body: contentSectionSchema,
+      body: contentBodyJsonSchema,
     },
     preHandler: [fastify.authenticate],
   }, async (request, reply) => {
     const { section } = request.params as { section: string };
-    const { contentJson } = request.body as z.infer<typeof contentSectionSchema>;
+    const { contentJson } = request.body as any;
 
     // Check if section exists
     const [existing] = await db
@@ -87,7 +92,7 @@ const contentRoute: FastifyPluginAsync = async (fastify) => {
     const sections = await db.select().from(contentSections);
 
     return {
-      sections: sections.map(s => ({
+      sections: (sections as any[]).map((s: any) => ({
         section: s.sectionName,
         content: s.contentJson,
         updatedAt: s.updatedAt,

backend/src/routes/events.ts

@@ -1,121 +1,95 @@
 import { FastifyPluginAsync } from 'fastify';
-import { z } from 'zod';
 import { db } from '../config/database.js';
 import { events } from '../db/schema.js';
 import { eq } from 'drizzle-orm';
 
-const eventSchema = z.object({
-  title: z.string().min(1).max(200),
-  date: z.string().min(1).max(100),
-  description: z.string().min(1),
-  imageUrl: z.string().url(),
-  displayOrder: z.number().int().min(0),
-  isPublished: z.boolean().optional().default(true),
-});
+// Fastify JSON schema for event body
+const eventBodyJsonSchema = {
+  type: 'object',
+  required: ['title', 'date', 'description', 'imageUrl', 'displayOrder'],
+  properties: {
+    title: { type: 'string', minLength: 1, maxLength: 200 },
+    date: { type: 'string', minLength: 1, maxLength: 100 },
+    description: { type: 'string', minLength: 1 },
+    imageUrl: { type: 'string', minLength: 1 },
+    displayOrder: { type: 'integer', minimum: 0 },
+    isPublished: { type: 'boolean' },
+  },
+} as const;
+
+const reorderBodyJsonSchema = {
+  type: 'object',
+  required: ['orders'],
+  properties: {
+    orders: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['id', 'displayOrder'],
+        properties: {
+          id: { type: 'string' },
+          displayOrder: { type: 'integer', minimum: 0 },
+        },
+      },
+    },
+  },
+} as const;
 
 const eventsRoute: FastifyPluginAsync = async (fastify) => {
+  // PUBLIC: List published events (no auth required)
+  fastify.get('/events/public', async () => {
+    const all = await db.select().from(events)
+      .where(eq(events.isPublished, true))
+      .orderBy(events.displayOrder);
+    return { events: all };
+  });
 
-  // List all events
-  fastify.get('/events', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const allEvents = await db.select().from(events).orderBy(events.displayOrder);
-    return { events: allEvents };
+  // List all events (by displayOrder) - admin only
+  fastify.get('/events', { preHandler: [fastify.authenticate] }, async () => {
+    const all = await db.select().from(events).orderBy(events.displayOrder);
+    return { events: all };
   });
 
   // Get single event
-  fastify.get('/events/:id', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
+  fastify.get('/events/:id', { preHandler: [fastify.authenticate] }, async (request, reply) => {
     const { id } = request.params as { id: string };
-    const event = await db.select().from(events).where(eq(events.id, id)).limit(1);
-
-    if (event.length === 0) {
-      return reply.code(404).send({ error: 'Event not found' });
-    }
-
-    return { event: event[0] };
+    const rows = await db.select().from(events).where(eq(events.id, id)).limit(1);
+    if (rows.length === 0) return reply.code(404).send({ error: 'Event not found' });
+    return { event: rows[0] };
   });
 
   // Create event
-  fastify.post('/events', {
-    schema: {
-      body: eventSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
-    const data = request.body as z.infer<typeof eventSchema>;
-
-    const [newEvent] = await db.insert(events).values(data).returning();
-
-    return reply.code(201).send({ event: newEvent });
+  fastify.post('/events', { schema: { body: eventBodyJsonSchema }, preHandler: [fastify.authenticate] }, async (request, reply) => {
+    const data = request.body as any;
+    const [row] = await db.insert(events).values(data).returning();
+    return reply.code(201).send({ event: row });
   });
 
   // Update event
-  fastify.put('/events/:id', {
-    schema: {
-      body: eventSchema,
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
+  fastify.put('/events/:id', { schema: { body: eventBodyJsonSchema }, preHandler: [fastify.authenticate] }, async (request, reply) => {
     const { id } = request.params as { id: string };
-    const data = request.body as z.infer<typeof eventSchema>;
-
-    const [updated] = await db
-      .update(events)
-      .set({ ...data, updatedAt: new Date() })
-      .where(eq(events.id, id))
-      .returning();
-
-    if (!updated) {
-      return reply.code(404).send({ error: 'Event not found' });
-    }
-
-    return { event: updated };
+    const data = request.body as any;
+    const [row] = await db.update(events).set({ ...data, updatedAt: new Date() }).where(eq(events.id, id)).returning();
+    if (!row) return reply.code(404).send({ error: 'Event not found' });
+    return { event: row };
   });
 
   // Delete event
-  fastify.delete('/events/:id', {
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
+  fastify.delete('/events/:id', { preHandler: [fastify.authenticate] }, async (request, reply) => {
     const { id } = request.params as { id: string };
-
-    const [deleted] = await db
-      .delete(events)
-      .where(eq(events.id, id))
-      .returning();
-
-    if (!deleted) {
-      return reply.code(404).send({ error: 'Event not found' });
-    }
-
+    const [row] = await db.delete(events).where(eq(events.id, id)).returning();
+    if (!row) return reply.code(404).send({ error: 'Event not found' });
     return { message: 'Event deleted successfully' };
   });
 
-  // Reorder events
-  fastify.put('/events/reorder', {
-    schema: {
-      body: z.object({
-        orders: z.array(z.object({
-          id: z.string().uuid(),
-          displayOrder: z.number().int().min(0),
-        })),
-      }),
-    },
-    preHandler: [fastify.authenticate],
-  }, async (request, reply) => {
+  // Reorder events (synchronous transaction for better-sqlite3)
+  fastify.put('/events/reorder', { schema: { body: reorderBodyJsonSchema }, preHandler: [fastify.authenticate] }, async (request) => {
     const { orders } = request.body as { orders: Array<{ id: string; displayOrder: number }> };
-
-    // Update all in transaction
-    await db.transaction(async (tx) => {
+    db.transaction((tx: any) => {
       for (const { id, displayOrder } of orders) {
-        await tx
-          .update(events)
-          .set({ displayOrder })
-          .where(eq(events.id, id));
+        tx.update(events).set({ displayOrder }).where(eq(events.id, id)).run?.();
       }
     });
-
     return { message: 'Events reordered successfully' };
   });
 };

backend/src/routes/gallery.ts

@@ -3,17 +3,33 @@ import { z } from 'zod';
 import { db } from '../config/database.js';
 import { galleryImages } from '../db/schema.js';
 import { eq } from 'drizzle-orm';
+import fs from 'fs';
+import path from 'path';
+import sharp from 'sharp';
 
-const galleryImageSchema = z.object({
-  imageUrl: z.string().url(),
-  altText: z.string().min(1).max(200),
-  displayOrder: z.number().int().min(0),
-  isPublished: z.boolean().optional().default(true),
-});
+// Fastify JSON schema for gallery image body
+const galleryBodyJsonSchema = {
+  type: 'object',
+  required: ['imageUrl', 'altText', 'displayOrder'],
+  properties: {
+    imageUrl: { type: 'string', minLength: 1 },
+    altText: { type: 'string', minLength: 1, maxLength: 200 },
+    displayOrder: { type: 'integer', minimum: 0 },
+    isPublished: { type: 'boolean' },
+  },
+} as const;
 
 const galleryRoute: FastifyPluginAsync = async (fastify) => {
 
-  // List all gallery images
+  // PUBLIC: List published gallery images (no auth required)
+  fastify.get('/gallery/public', async () => {
+    const images = await db.select().from(galleryImages)
+      .where(eq(galleryImages.isPublished, true))
+      .orderBy(galleryImages.displayOrder);
+    return { images };
+  });
+
+  // List all gallery images - admin only
   fastify.get('/gallery', {
     preHandler: [fastify.authenticate],
   }, async (request, reply) => {
@@ -38,26 +54,102 @@ const galleryRoute: FastifyPluginAsync = async (fastify) => {
   // Create gallery image
   fastify.post('/gallery', {
     schema: {
-      body: galleryImageSchema,
+      body: galleryBodyJsonSchema,
     },
     preHandler: [fastify.authenticate],
   }, async (request, reply) => {
-    const data = request.body as z.infer<typeof galleryImageSchema>;
+    const data = request.body as any;
 
     const [newImage] = await db.insert(galleryImages).values(data).returning();
 
     return reply.code(201).send({ image: newImage });
   });
 
+  // Upload image file (multipart)
+  fastify.post('/gallery/upload', {
+    preHandler: [fastify.authenticate],
+  }, async (request, reply) => {
+    try {
+      // Expect a single file field named "file"
+      const file = await (request as any).file();
+      if (!file) {
+        return reply.code(400).send({ error: 'No file uploaded' });
+      }
+
+      const altText = (file.fields?.altText?.value as string | undefined) || '';
+      const displayOrderRaw = (file.fields?.displayOrder?.value as string | undefined) || '0';
+      const displayOrder = Number.parseInt(displayOrderRaw) || 0;
+
+      const mime = file.mimetype as string | undefined;
+      if (!mime || !mime.startsWith('image/')) {
+        return reply.code(400).send({ error: 'Only image uploads are allowed' });
+      }
+
+      // Prepare directories - use persistent volume for Fly.io
+      const dataDir = process.env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data');
+      const uploadDir = path.join(dataDir, 'images', 'gallery');
+      if (!fs.existsSync(uploadDir)) fs.mkdirSync(uploadDir, { recursive: true });
+
+      // Read uploaded stream into buffer
+      const chunks: Buffer[] = [];
+      for await (const chunk of file.file) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      }
+      const inputBuffer = Buffer.concat(chunks);
+
+      // Generate filename
+      const stamp = Date.now().toString(36);
+      const rand = Math.random().toString(36).slice(2, 8);
+      const baseName = `${stamp}-${rand}`;
+
+      // Try to convert to webp and limit size; fallback to original
+      let outBuffer: Buffer | null = null;
+      let outExt = '.webp';
+      try {
+        outBuffer = await sharp(inputBuffer)
+          .rotate()
+          .resize({ width: 1600, withoutEnlargement: true })
+          .webp({ quality: 82 })
+          .toBuffer();
+      } catch {
+        outBuffer = inputBuffer;
+        // naive extension from mimetype
+        const extFromMime = mime.split('/')[1] || 'bin';
+        outExt = '.' + extFromMime.replace(/[^a-z0-9]/gi, '').toLowerCase();
+      }
+
+      const filename = baseName + outExt;
+      const destPath = path.join(uploadDir, filename);
+      fs.writeFileSync(destPath, outBuffer);
+
+      // Public URL (served via /static)
+      const publicUrl = `/static/images/gallery/${filename}`;
+
+      // Store in DB (optional but useful)
+      const [row] = await db.insert(galleryImages).values({
+        imageUrl: publicUrl,
+        altText: altText || filename,
+        displayOrder,
+        isPublished: true,
+      }).returning();
+
+      return reply.code(201).send({ image: row });
+
+    } catch (err) {
+      fastify.log.error({ err }, 'Upload failed');
+      return reply.code(500).send({ error: 'Failed to upload image' });
+    }
+  });
+
   // Update gallery image
   fastify.put('/gallery/:id', {
     schema: {
-      body: galleryImageSchema,
+      body: galleryBodyJsonSchema,
     },
     preHandler: [fastify.authenticate],
   }, async (request, reply) => {
     const { id } = request.params as { id: string };
-    const data = request.body as z.infer<typeof galleryImageSchema>;
+    const data = request.body as any;
 
     const [updated] = await db
       .update(galleryImages)
@@ -93,24 +185,32 @@ const galleryRoute: FastifyPluginAsync = async (fastify) => {
   // Reorder gallery images
   fastify.put('/gallery/reorder', {
     schema: {
-      body: z.object({
-        orders: z.array(z.object({
-          id: z.string().uuid(),
-          displayOrder: z.number().int().min(0),
-        })),
-      }),
+      body: {
+        type: 'object',
+        required: ['orders'],
+        properties: {
+          orders: {
+            type: 'array',
+            items: {
+              type: 'object',
+              required: ['id', 'displayOrder'],
+              properties: {
+                id: { type: 'string' },
+                displayOrder: { type: 'integer', minimum: 0 },
+              },
+            },
+          },
+        },
+      },
     },
     preHandler: [fastify.authenticate],
   }, async (request, reply) => {
     const { orders } = request.body as { orders: Array<{ id: string; displayOrder: number }> };
 
-    // Update all in transaction
-    await db.transaction(async (tx) => {
+    // Update all in synchronous transaction (better-sqlite3 requirement)
+    db.transaction((tx: any) => {
       for (const { id, displayOrder } of orders) {
-        await tx
-          .update(galleryImages)
-          .set({ displayOrder })
-          .where(eq(galleryImages.id, id));
+        tx.update(galleryImages).set({ displayOrder }).where(eq(galleryImages.id, id)).run?.();
       }
     });
 

backend/src/routes/publish.ts

@@ -6,19 +6,24 @@ import { db } from '../config/database.js';
 import { events, galleryImages, contentSections, publishHistory } from '../db/schema.js';
 import { eq } from 'drizzle-orm';
 
-const publishSchema = z.object({
-  commitMessage: z.string().min(1).max(200),
-});
+// Fastify JSON schema for publish body
+const publishBodyJsonSchema = {
+  type: 'object',
+  required: ['commitMessage'],
+  properties: {
+    commitMessage: { type: 'string', minLength: 1, maxLength: 200 },
+  },
+} as const;
 
 const publishRoute: FastifyPluginAsync = async (fastify) => {
   fastify.post('/publish', {
     schema: {
-      body: publishSchema,
+      body: publishBodyJsonSchema,
     },
     preHandler: [fastify.authenticate],
   }, async (request, reply) => {
     try {
-      const { commitMessage } = request.body as z.infer<typeof publishSchema>;
+      const { commitMessage } = request.body as any;
       const userId = request.user.id;
 
       fastify.log.info('Starting publish process...');
@@ -43,8 +48,8 @@ const publishRoute: FastifyPluginAsync = async (fastify) => {
         .orderBy(galleryImages.displayOrder);
 
       const sectionsData = await db.select().from(contentSections);
-      const sectionsMap = new Map(
-        sectionsData.map(s => [s.sectionName, s.contentJson as any])
+      const sectionsMap = new Map<string, any>(
+        (sectionsData as any[]).map((s: any) => [s.sectionName as string, s.contentJson as any])
       );
 
       fastify.log.info(`Fetched ${eventsData.length} events, ${galleryData.length} images, ${sectionsData.length} sections`);
@@ -53,13 +58,13 @@ const publishRoute: FastifyPluginAsync = async (fastify) => {
       const fileGenerator = new FileGeneratorService();
       await fileGenerator.writeFiles(
         gitService.getWorkspacePath(''),
-        eventsData.map(e => ({
+        (eventsData as any[]).map((e: any) => ({
           title: e.title,
           date: e.date,
           description: e.description,
           imageUrl: e.imageUrl,
         })),
-        galleryData.map(g => ({
+        (galleryData as any[]).map((g: any) => ({
           imageUrl: g.imageUrl,
           altText: g.altText,
         })),
@@ -87,14 +92,14 @@ const publishRoute: FastifyPluginAsync = async (fastify) => {
       };
 
     } catch (error) {
-      fastify.log.error('Publish error:', error);
+      fastify.log.error({ err: error }, 'Publish error');
 
       // Attempt to reset git state on error
       try {
         const gitService = new GitService();
         await gitService.reset();
       } catch (resetError) {
-        fastify.log.error('Failed to reset git state:', resetError);
+        fastify.log.error({ err: resetError }, 'Failed to reset git state');
       }
 
       return reply.code(500).send({

backend/src/routes/settings.ts

@@ -4,9 +4,14 @@ import { db } from '../config/database.js';
 import { siteSettings } from '../db/schema.js';
 import { eq } from 'drizzle-orm';
 
-const settingSchema = z.object({
-  value: z.string(),
-});
+// Fastify JSON schema for settings body
+const settingBodyJsonSchema = {
+  type: 'object',
+  required: ['value'],
+  properties: {
+    value: { type: 'string' },
+  },
+} as const;
 
 const settingsRoute: FastifyPluginAsync = async (fastify) => {
 
@@ -50,12 +55,12 @@ const settingsRoute: FastifyPluginAsync = async (fastify) => {
   // Update setting
   fastify.put('/settings/:key', {
     schema: {
-      body: settingSchema,
+      body: settingBodyJsonSchema,
     },
     preHandler: [fastify.authenticate],
   }, async (request, reply) => {
     const { key } = request.params as { key: string };
-    const { value } = request.body as z.infer<typeof settingSchema>;
+    const { value } = request.body as any;
 
     // Check if setting exists
     const [existing] = await db

backend/src/scripts/migrate-old-data.ts

@@ -0,0 +1,190 @@
+import { db } from '../config/database.js';
+import { events, galleryImages } from '../db/schema.js';
+import fs from 'fs';
+import path from 'path';
+import sharp from 'sharp';
+
+// Old events data
+const oldEvents = [
+  {
+    image: "/images/events/event_karaoke.jpg",
+    title: "Karaoke",
+    date: "2025-12-31", // Set as ongoing event
+    description: `Bei uns gibt es Karaoke Mi-Sa!! <br>
+Seid ihr eine Gruppe und lieber unter euch? ..unseren 2.Stock kannst du auch mieten ;) <br>
+Reserviere am besten gleich per Whatsapp <a href="tel:+41772322770">077 232 27 70</a>`,
+    displayOrder: 0,
+  },
+  {
+    image: "/images/events/event_pub-quiz.jpg",
+    title: "Pub Quiz",
+    date: "2025-12-31", // Set as ongoing event
+    description: `Jeden Freitag findet unser <b>Pub Quiz</b> statt. Gespielt wird tischweise in 3-4 Runden. <br>
+Jede Woche gibt es ein anderes Thema. Es geht um Ruhm und Ehre und zusätzlich werden die Sieger der Herzen durch das Publikum gekürt! <3 <br>
+Auch Einzelpersonen sind herzlich willkommen! <br>
+*zum mitmachen minimum 1 Getränk konsumieren oder 5CHF`,
+    displayOrder: 1,
+  },
+  {
+    image: "/images/events/event_schlager-karaoke.jpeg",
+    title: "Schlager Hüttenzauber Karaoke",
+    date: "2025-11-27",
+    description: `Ab 19:00 Uhr Eintritt ist Frei! Reservieren unter <a href="tel:+41772322770">077 232 27 70</a>`,
+    displayOrder: 2,
+  },
+  {
+    image: "/images/events/event_advents-kalender.jpeg",
+    title: "Adventskalender",
+    date: "2025-12-20",
+    description: `Jeden Tag neue Überraschungen! Check unsere Social Media Stories!`,
+    displayOrder: 3,
+  },
+  {
+    image: "/images/events/event_santa_karaoke.jpeg",
+    title: "Santa Karaoke-Party",
+    date: "2025-12-06",
+    description: `🤶🏻🎅🏻Komme als Weihnachts-Mann/-Frau und bekomme einen Shot auf's Haus!🤶🏻🎅🏻`,
+    displayOrder: 4,
+  },
+  {
+    image: "/images/events/event_ferien.jpeg",
+    title: "Weihnachtsferien",
+    date: "2025-12-21",
+    description: `Wir sind ab 02.01.2026 wieder wie gewohnt für euch da! 🍀. <br> Für Anfragen WA <a href="tel:+41772322770">077 232 27 70</a> Antwort innerhalb 48h`,
+    displayOrder: 5,
+  },
+  {
+    image: "/images/events/event_neujahrs-apero.jpeg",
+    title: "Neujahrs-Apero",
+    date: "2026-01-02",
+    description: `18:00-20:00 Uhr`,
+    displayOrder: 6,
+  },
+];
+
+// Old gallery images
+const oldGalleryImages = [
+  { src: "/images/gallery/Gallery7.png", alt: "Gallery 7" },
+  { src: "/images/gallery/Gallery8.png", alt: "Gallery 8" },
+  { src: "/images/gallery/Gallery9.png", alt: "Gallery 9" },
+  { src: "/images/gallery/Gallery6.png", alt: "Gallery 6" },
+  { src: "/images/gallery/Gallery1.png", alt: "Gallery 1" },
+  { src: "/images/gallery/Gallery2.png", alt: "Gallery 2" },
+  { src: "/images/gallery/Gallery3.png", alt: "Gallery 3" },
+  { src: "/images/gallery/Gallery4.png", alt: "Gallery 4" },
+  { src: "/images/gallery/Gallery5.png", alt: "Gallery 5" },
+];
+
+async function copyAndConvertImage(
+  sourcePath: string,
+  destDir: string,
+  filename: string
+): Promise<string> {
+  const projectRoot = path.join(process.cwd(), '..');
+  const fullSourcePath = path.join(projectRoot, 'public', sourcePath);
+
+  // Ensure destination directory exists
+  if (!fs.existsSync(destDir)) {
+    fs.mkdirSync(destDir, { recursive: true });
+  }
+
+  const ext = path.extname(filename);
+  const baseName = path.basename(filename, ext);
+  const webpFilename = `${baseName}.webp`;
+  const destPath = path.join(destDir, webpFilename);
+
+  console.log(`Processing: ${fullSourcePath} -> ${destPath}`);
+
+  // Check if source exists
+  if (!fs.existsSync(fullSourcePath)) {
+    console.error(`Source file not found: ${fullSourcePath}`);
+    throw new Error(`Source file not found: ${fullSourcePath}`);
+  }
+
+  // Convert to webp and copy
+  await sharp(fullSourcePath)
+    .rotate() // Auto-rotate based on EXIF
+    .resize({ width: 1600, withoutEnlargement: true })
+    .webp({ quality: 85 })
+    .toFile(destPath);
+
+  return `/images/${path.relative(destDir, destPath).replace(/\\/g, '/')}`;
+}
+
+async function migrateEvents() {
+  console.log('\n=== Migrating Events ===\n');
+
+  const dataDir = process.env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data');
+  const eventsImageDir = path.join(dataDir, 'images', 'events');
+
+  for (const event of oldEvents) {
+    try {
+      const filename = path.basename(event.image);
+      const newImageUrl = await copyAndConvertImage(
+        event.image,
+        eventsImageDir,
+        filename
+      );
+
+      const [newEvent] = await db.insert(events).values({
+        title: event.title,
+        date: event.date,
+        description: event.description,
+        imageUrl: newImageUrl,
+        displayOrder: event.displayOrder,
+        isPublished: true,
+      }).returning();
+
+      console.log(`✓ Migrated event: ${newEvent.title}`);
+    } catch (error) {
+      console.error(`✗ Failed to migrate event "${event.title}":`, error);
+    }
+  }
+}
+
+async function migrateGallery() {
+  console.log('\n=== Migrating Gallery Images ===\n');
+
+  const dataDir = process.env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data');
+  const galleryImageDir = path.join(dataDir, 'images', 'gallery');
+
+  for (let i = 0; i < oldGalleryImages.length; i++) {
+    const img = oldGalleryImages[i];
+    try {
+      const filename = path.basename(img.src);
+      const newImageUrl = await copyAndConvertImage(
+        img.src,
+        galleryImageDir,
+        filename
+      );
+
+      const [newImage] = await db.insert(galleryImages).values({
+        imageUrl: newImageUrl,
+        altText: img.alt,
+        displayOrder: i,
+        isPublished: true,
+      }).returning();
+
+      console.log(`✓ Migrated gallery image: ${newImage.altText}`);
+    } catch (error) {
+      console.error(`✗ Failed to migrate gallery image "${img.alt}":`, error);
+    }
+  }
+}
+
+async function main() {
+  console.log('Starting migration of old data...\n');
+  console.log('Working directory:', process.cwd());
+  console.log('Data directory:', process.env.GIT_WORKSPACE_DIR || path.join(process.cwd(), 'data'));
+
+  try {
+    await migrateEvents();
+    await migrateGallery();
+    console.log('\n✓ Migration completed successfully!');
+  } catch (error) {
+    console.error('\n✗ Migration failed:', error);
+    process.exit(1);
+  }
+}
+
+main();

docker-compose.yml

@@ -0,0 +1,38 @@
+services:
+  frontend:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    environment:
+      - BACKEND_URL=http://proxy:4321
+    depends_on:
+      - backend
+
+  backend:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    env_file:
+      - ./backend/.env.local
+    environment:
+      - NODE_ENV=production
+      - PORT=8080
+      - DATABASE_PATH=/app/data/gallus_cms.db
+      - GIT_WORKSPACE_DIR=/app/workspace
+    volumes:
+      - backend_data:/app/data
+      - backend_workspace:/app/workspace
+
+  proxy:
+    build:
+      context: .
+      dockerfile: Dockerfile.caddy
+    depends_on:
+      - frontend
+      - backend
+    ports:
+      - "4321:80"
+
+volumes:
+  backend_data:
+  backend_workspace:

fly.toml

@@ -9,6 +9,9 @@ kill_timeout = 5
 [env]
   PORT = "3000"
   NODE_ENV = "production"
+  BACKEND_PORT = "8080"
+  DATABASE_PATH = "/app/data/db/gallus_cms.db"
+  GIT_WORKSPACE_DIR = "/app/data/workspace"
 
 [http_service]
   internal_port = 3000
@@ -40,3 +43,7 @@ kill_timeout = 5
   memory = "512MB"
   cpu_kind = "shared"
   cpus = 1
+
+[[mounts]]
+  source = "gallus_data"
+  destination = "/app/data"

package.json

@@ -1,5 +1,5 @@
 {
-  "name": "",
+  "name": "Gallus Pub Site",
   "type": "module",
   "version": "0.0.1",
   "scripts": {

src/components/Drinks.astro

@@ -29,15 +29,15 @@ const { id } = Astro.props;
 
     <div class="circle-row">
         <div class="circle whiskey-circle" title="Whiskey 1">
-            <img src="/images/Whiskey1.png" alt="Whiskey 1" class="circle-image" />
+            <img src="/images/whiskey/Whiskey1.png" alt="Whiskey 1" class="circle-image" />
             <span class="circle-label"></span>
         </div>
         <div class="circle whiskey-circle" title="Whiskey 2">
-            <img src="/images/Whiskey2.png" alt="Whiskey 2" class="circle-image" />
+            <img src="/images/whiskey/Whiskey2.png" alt="Whiskey 2" class="circle-image" />
             <span class="circle-label"></span>
         </div>
         <div class="circle whiskey-circle" title="Whiskey 3">
-            <img src="/images/Whiskey3.png" alt="Whiskey 3" class="circle-image" />
+            <img src="/images/whiskey/Whiskey3.png" alt="Whiskey 3" class="circle-image" />
             <span class="circle-label"></span>
         </div>
     </div>

src/components/Hero.astro

@@ -15,7 +15,7 @@ const { id } = Astro.props;
 
 			<p>Im Herzen von St.Gallen</p>
 
-			<a href="#" class="button">Aktuelles ↓</a>
+			<a href="#welcome" class="button">Aktuelles ↓</a>
 		</div>
 
 	</div>

src/components/HoverCard.astro

@@ -39,7 +39,7 @@ const {title, description, image = "", date} = Astro.props;
 
 			// Close card when clicking outside (mobile only)
 			document.addEventListener('click', (e) => {
-				if (window.innerWidth <= 768 && !card.contains(e.target)) {
+				if (window.innerWidth <= 768 && !card.contains(e.target as Node)) {
 					card.classList.remove('active');
 				}
 			});

src/pages/admin.astro

@@ -0,0 +1,443 @@
+---
+const title = 'Admin';
+---
+
+<html lang="de">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{title}</title>
+    <style>
+      body { font-family: system-ui, -apple-system, Segoe UI, Roboto, Ubuntu, Cantarell, 'Helvetica Neue', Arial, 'Noto Sans', 'Liberation Sans', sans-serif; margin: 1rem; }
+      h1, h2 { margin: 0.5rem 0; }
+      section { border: 1px solid #ddd; padding: 1rem; border-radius: 8px; margin-bottom: 1rem; }
+      .row { display: flex; gap: 1rem; flex-wrap: wrap; }
+      .events-row { display: grid; grid-template-columns: 1fr 2fr; gap: 1rem; align-items: start; }
+      @media (max-width: 900px){ .events-row { grid-template-columns: 1fr; } }
+      button { margin-top: 0.5rem; padding: 0.5rem 1rem; cursor: pointer; }
+      .muted { color: #666; }
+      .btn { display: inline-block; padding: 0.5rem 1rem; background: #222; color: #fff; border-radius: 6px; text-decoration: none; }
+      .btn:hover { background: #444; }
+      .grid { display: grid; grid-template-columns: repeat(auto-fit,minmax(260px,1fr)); gap: 0.75rem; }
+      .card { border: 1px solid #eee; padding: 0.75rem; border-radius: 6px; }
+      label { display:block; margin-top: 0.5rem; }
+      input, textarea { width: 100%; max-width: 600px; padding: 0.5rem; margin-top: 0.25rem; }
+      img.thumb { max-width: 100%; height: auto; display: block; }
+      .toolbar { display:flex; gap:.5rem; align-items:center; margin:.5rem 0; }
+      .pill { font-size:.85rem; padding:.25rem .5rem; border:1px solid #ddd; border-radius:999px; background:#f7f7f7; }
+      .dragging { opacity:.5; }
+      .drag-handle { cursor:grab; padding:.25rem .5rem; border:1px dashed #bbb; border-radius:6px; font-size:.85rem; }
+      .row-buttons { display:flex; gap:.5rem; margin-top:.5rem; }
+    </style>
+  </head>
+  <body>
+    <h1>Admin</h1>
+    <section>
+      <h2>Authentifizierung</h2>
+      <div id="auth-status" class="muted">Prüfe Anmeldestatus...</div>
+      <div class="row">
+        <a id="login-link" class="btn" href="https://cms.gallus-pub.ch/api/auth/gitea">Mit Gitea anmelden</a>
+        <button id="btn-relogin">Neu anmelden</button>
+        <button id="btn-logout">Abmelden</button>
+      </div>
+    </section>
+
+    <section id="sec-events" style="display:none">
+      <h2>Events verwalten</h2>
+      <div class="events-row">
+        <div class="card">
+          <h3>Neues Event</h3>
+          <label>Titel<input id="ev-title" /></label>
+          <label>Datum<input id="ev-date" type="date" placeholder="z. B. 2025-12-31" /></label>
+          <label>Beschreibung<textarea id="ev-desc" rows="4"></textarea></label>
+          <label>Bild-Datei<input id="ev-file" type="file" accept="image/*" /></label>
+          <label>Alt-Text<input id="ev-alt" placeholder="Bildbeschreibung" /></label>
+          <button id="btn-create-ev">Event anlegen</button>
+          <div id="ev-create-msg" class="muted"></div>
+        </div>
+        <div class="card" style="min-width:380px;">
+          <h3>Liste</h3>
+          <div class="toolbar">
+            <span class="pill" id="lbl-order">Anzeige: automatisch nach Datum (neueste zuerst)</span>
+            <button id="btn-toggle-reorder">Reihenfolge bearbeiten</button>
+            <button id="btn-save-order" style="display:none">Reihenfolge speichern</button>
+            <span id="order-msg" class="muted"></span>
+          </div>
+          <div id="events-list" class="grid"></div>
+        </div>
+      </div>
+    </section>
+
+    <section id="sec-gallery" style="display:none">
+      <h2>Gallery verwalten</h2>
+      <div class="events-row">
+        <div class="card">
+          <h3>Neues Gallery-Bild</h3>
+          <label>Bild-Datei<input id="gal-file" type="file" accept="image/*" /></label>
+          <label>Alt-Text<input id="gal-alt" placeholder="Bildbeschreibung" /></label>
+          <button id="btn-create-gal">Bild hochladen</button>
+          <div id="gal-create-msg" class="muted"></div>
+        </div>
+        <div class="card" style="min-width:380px;">
+          <h3>Liste</h3>
+          <div class="toolbar">
+            <button id="btn-toggle-gal-reorder">Reihenfolge bearbeiten</button>
+            <button id="btn-save-gal-order" style="display:none">Reihenfolge speichern</button>
+            <span id="gal-order-msg" class="muted"></span>
+          </div>
+          <div id="gallery-list" class="grid"></div>
+        </div>
+      </div>
+    </section>
+
+    <section id="sec-publish" style="display:none">
+      <h2>Veröffentlichen</h2>
+      <label>Commit-Message<input id="pub-msg" placeholder="Änderungen beschreiben" value="Update events" /></label>
+      <button id="btn-publish">Publish</button>
+      <div id="pub-status" class="muted"></div>
+    </section>
+
+    <script>
+      // Base-URL des Backends (separate Subdomain)
+      const API_BASE = 'https://cms.gallus-pub.ch';
+
+      const api = async (path, opts = {}) => {
+        const res = await fetch(API_BASE + path, { credentials: 'include', ...opts });
+        if (!res.ok) throw new Error(await res.text());
+        const ct = res.headers.get('content-type') || '';
+        return ct.includes('application/json') ? res.json() : res.text();
+      };
+
+      async function refreshAuth() {
+        try {
+          const me = await api('/api/auth/me');
+          document.getElementById('auth-status').textContent = `Angemeldet als ${me.user?.giteaUsername || 'Admin'}`;
+          // UI-Bereiche für eingeloggte Nutzer einblenden
+          document.getElementById('sec-events').style.display = '';
+          document.getElementById('sec-gallery').style.display = '';
+          document.getElementById('sec-publish').style.display = '';
+          // Direkt Events laden und auf Sektion fokussieren
+          await loadEvents();
+          await loadGallery();
+          document.getElementById('sec-events').scrollIntoView({ behavior: 'smooth' });
+        } catch (e) {
+          const el = document.getElementById('auth-status');
+          el.textContent = 'Nicht angemeldet';
+          // Kein Auto-Redirect, damit keine Schleife entsteht. Login-Button verwenden.
+          document.getElementById('sec-events').style.display = 'none';
+          document.getElementById('sec-publish').style.display = 'none';
+        }
+      }
+
+      // Fallback: falls der Link von Browser/Extensions blockiert wäre
+      const loginLink = document.getElementById('login-link');
+      loginLink.addEventListener('click', (e) => {
+        try {
+          // Stelle sicher, dass Navigieren erzwungen wird
+          window.location.assign(API_BASE + '/api/auth/gitea');
+        } catch {}
+      });
+      document.getElementById('btn-relogin').addEventListener('click', async () => {
+        try { await api('/api/auth/logout', { method: 'POST' }); } catch {}
+        document.cookie = 'token=; Path=/; Max-Age=0;';
+        window.location.assign(API_BASE + '/api/auth/gitea');
+      });
+      document.getElementById('btn-logout').addEventListener('click', async () => {
+        try { await api('/api/auth/logout', { method: 'POST' }); } catch {}
+        document.cookie = 'token=; Path=/; Max-Age=0;';
+        await refreshAuth();
+      });
+
+      // ========== Events & Publish ==========
+      async function uploadImage(file, altText) {
+        const fd = new FormData();
+        fd.append('file', file);
+        if (altText) fd.append('altText', altText);
+        fd.append('displayOrder', '0');
+        const res = await fetch(API_BASE + '/api/gallery/upload', { method: 'POST', body: fd, credentials: 'include' });
+        if (!res.ok) throw new Error(await res.text());
+        return res.json();
+      }
+
+      let reorderMode = false;
+      let lastEvents = [];
+
+      function parseDateSafe(s){
+        const d = new Date(s);
+        return isNaN(+d) ? new Date(0) : d;
+      }
+
+      async function loadEvents() {
+        const listEl = document.getElementById('events-list');
+        listEl.innerHTML = '<div class="muted">Lade...</div>';
+        try {
+          const data = await api('/api/events');
+          listEl.innerHTML = '';
+          // Merken, globale Liste aktualisieren
+          lastEvents = (data.events || []).slice();
+          let renderList = lastEvents.slice();
+          if (!reorderMode) {
+            // Automatisch nach Datum sortieren (neueste zuerst)
+            renderList.sort((a,b) => +parseDateSafe(b.date) - +parseDateSafe(a.date));
+            document.getElementById('lbl-order').textContent = 'Anzeige: automatisch nach Datum (neueste zuerst)';
+          } else {
+            // Nach displayOrder aufsteigend
+            renderList.sort((a,b) => (a.displayOrder??0) - (b.displayOrder??0));
+            document.getElementById('lbl-order').textContent = 'Anzeige: manuelle Reihenfolge (drag & drop)';
+          }
+
+          renderList.forEach((ev, idx) => {
+            const card = document.createElement('div');
+            card.className = 'card';
+            card.setAttribute('draggable', String(reorderMode));
+            card.dataset.id = ev.id;
+            card.dataset.displayOrder = String(ev.displayOrder ?? idx);
+            card.innerHTML = `
+              <div class="row" style="justify-content:space-between;align-items:center">
+                <div><strong>${ev.title}</strong></div>
+                ${reorderMode ? '<span class="drag-handle">⇅ Ziehen</span>' : ''}
+              </div>
+              <div class="muted">${ev.date}</div>
+              <div>${ev.description || ''}</div>
+              <div class="muted">Bild: ${ev.imageUrl || ''}</div>
+              <div class="row-buttons">
+                <button data-id="${ev.id}" class="btn-del-ev">Löschen</button>
+              </div>`;
+            listEl.appendChild(card);
+          });
+          listEl.querySelectorAll('.btn-del-ev').forEach(btn => {
+            btn.addEventListener('click', async () => {
+              const id = btn.getAttribute('data-id');
+              if (!id) return;
+              if (!confirm('Event wirklich löschen?')) return;
+              try { await api(`/api/events/${id}`, { method: 'DELETE' }); await loadEvents(); } catch(e){ alert('Fehler: '+e.message); }
+            })
+          })
+
+          if (reorderMode) {
+            enableDragAndDrop(listEl);
+          }
+        } catch (e) {
+          listEl.innerHTML = '<div class="muted">Fehler beim Laden</div>';
+          console.error(e);
+        }
+      }
+
+      // Drag & Drop Reorder
+      function enableDragAndDrop(container){
+        let draggingEl = null;
+        container.querySelectorAll('.card').forEach(card => {
+          card.addEventListener('dragstart', (e) => {
+            draggingEl = card; card.classList.add('dragging');
+            e.dataTransfer.setData('text/plain', card.dataset.id || '');
+          });
+          card.addEventListener('dragend', () => { draggingEl = null; card.classList.remove('dragging'); });
+          card.addEventListener('dragover', (e) => { e.preventDefault(); });
+          card.addEventListener('drop', (e) => {
+            e.preventDefault();
+            const target = card;
+            if (!draggingEl || draggingEl === target) return;
+            const cards = Array.from(container.querySelectorAll('.card'));
+            const draggingIdx = cards.indexOf(draggingEl);
+            const targetIdx = cards.indexOf(target);
+            if (draggingIdx < targetIdx) {
+              target.after(draggingEl);
+            } else {
+              target.before(draggingEl);
+            }
+          });
+        });
+      }
+
+      document.getElementById('btn-create-ev').addEventListener('click', async () => {
+        const title = (document.getElementById('ev-title')).value.trim();
+        const date = (document.getElementById('ev-date')).value.trim();
+        const desc = (document.getElementById('ev-desc')).value.trim();
+        const file = /** @type {HTMLInputElement} */ (document.getElementById('ev-file')).files[0];
+        const alt = (document.getElementById('ev-alt')).value.trim();
+        const msg = document.getElementById('ev-create-msg');
+        msg.textContent = 'Lade Bild hoch...';
+        try {
+          let imageUrl = '';
+          if (file) {
+            const up = await uploadImage(file, alt || title);
+            imageUrl = up?.image?.imageUrl || '';
+          }
+          msg.textContent = 'Lege Event an...';
+          await api('/api/events', {
+            method: 'POST', headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ title, date, description: desc, imageUrl, displayOrder: 0, isPublished: true })
+          });
+          msg.textContent = 'Event erstellt';
+          (document.getElementById('ev-title')).value = '';
+          (document.getElementById('ev-date')).value = '';
+          (document.getElementById('ev-desc')).value = '';
+          (document.getElementById('ev-file')).value = '';
+          (document.getElementById('ev-alt')).value = '';
+          await loadEvents();
+        } catch(e){ msg.textContent = 'Fehler: '+e.message }
+      });
+
+      document.getElementById('btn-publish').addEventListener('click', async () => {
+        const s = document.getElementById('pub-status');
+        const m = (document.getElementById('pub-msg')).value.trim() || 'Update events';
+        s.textContent = 'Veröffentliche...';
+        try {
+          const res = await api('/api/publish', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ commitMessage: m }) });
+          s.textContent = res?.message || 'Veröffentlicht';
+        } catch(e){ s.textContent = 'Fehler: '+e.message }
+      });
+
+      // Toggle Reorder
+      document.getElementById('btn-toggle-reorder').addEventListener('click', async () => {
+        reorderMode = !reorderMode;
+        document.getElementById('btn-save-order').style.display = reorderMode ? '' : 'none';
+        await loadEvents();
+      });
+
+      // Save Order
+      document.getElementById('btn-save-order').addEventListener('click', async () => {
+        const container = document.getElementById('events-list');
+        const cards = Array.from(container.querySelectorAll('.card'));
+        const orders = cards.map((c, idx) => ({ id: c.dataset.id, displayOrder: idx }));
+        const msg = document.getElementById('order-msg');
+        msg.textContent = 'Speichere Reihenfolge...';
+        try {
+          await api('/api/events/reorder', { method:'PUT', headers:{'Content-Type':'application/json'}, body: JSON.stringify({ orders }) });
+          msg.textContent = 'Reihenfolge gespeichert';
+          // Bleibe in Reorder-Mode oder verlasse ihn? Hier: verlassen
+          reorderMode = false;
+          document.getElementById('btn-save-order').style.display = 'none';
+          await loadEvents();
+        } catch(e){ msg.textContent = 'Fehler: '+e.message }
+      });
+
+      // ========== Gallery Management ==========
+      let galReorderMode = false;
+      let lastGallery = [];
+
+      async function loadGallery() {
+        const listEl = document.getElementById('gallery-list');
+        listEl.innerHTML = '<div class="muted">Lade...</div>';
+        try {
+          const data = await api('/api/gallery');
+          listEl.innerHTML = '';
+          lastGallery = (data.images || []).slice();
+          let renderList = lastGallery.slice();
+
+          if (galReorderMode) {
+            renderList.sort((a,b) => (a.displayOrder??0) - (b.displayOrder??0));
+          }
+
+          renderList.forEach((img, idx) => {
+            const card = document.createElement('div');
+            card.className = 'card';
+            card.setAttribute('draggable', String(galReorderMode));
+            card.dataset.id = img.id;
+            card.dataset.displayOrder = String(img.displayOrder ?? idx);
+            card.innerHTML = `
+              <div class="row" style="justify-content:space-between;align-items:center">
+                <div><strong>${img.altText}</strong></div>
+                ${galReorderMode ? '<span class="drag-handle">⇅ Ziehen</span>' : ''}
+              </div>
+              <img src="${API_BASE}${img.imageUrl}" alt="${img.altText}" style="max-width:100%;height:auto;margin:0.5rem 0;" />
+              <div class="muted">URL: ${img.imageUrl}</div>
+              <div class="row-buttons">
+                <button data-id="${img.id}" class="btn-del-gal">Löschen</button>
+              </div>`;
+            listEl.appendChild(card);
+          });
+
+          listEl.querySelectorAll('.btn-del-gal').forEach(btn => {
+            btn.addEventListener('click', async () => {
+              const id = btn.getAttribute('data-id');
+              if (!id) return;
+              if (!confirm('Bild wirklich löschen?')) return;
+              try {
+                await api(`/api/gallery/${id}`, { method: 'DELETE' });
+                await loadGallery();
+              } catch(e){ alert('Fehler: '+e.message); }
+            })
+          })
+
+          if (galReorderMode) {
+            enableGalleryDragAndDrop(listEl);
+          }
+        } catch (e) {
+          listEl.innerHTML = '<div class="muted">Fehler beim Laden</div>';
+          console.error(e);
+        }
+      }
+
+      function enableGalleryDragAndDrop(container){
+        let draggingEl = null;
+        container.querySelectorAll('.card').forEach(card => {
+          card.addEventListener('dragstart', (e) => {
+            draggingEl = card; card.classList.add('dragging');
+            e.dataTransfer.setData('text/plain', card.dataset.id || '');
+          });
+          card.addEventListener('dragend', () => { draggingEl = null; card.classList.remove('dragging'); });
+          card.addEventListener('dragover', (e) => { e.preventDefault(); });
+          card.addEventListener('drop', (e) => {
+            e.preventDefault();
+            const target = card;
+            if (!draggingEl || draggingEl === target) return;
+            const cards = Array.from(container.querySelectorAll('.card'));
+            const draggingIdx = cards.indexOf(draggingEl);
+            const targetIdx = cards.indexOf(target);
+            if (draggingIdx < targetIdx) {
+              target.after(draggingEl);
+            } else {
+              target.before(draggingEl);
+            }
+          });
+        });
+      }
+
+      document.getElementById('btn-create-gal').addEventListener('click', async () => {
+        const file = document.getElementById('gal-file').files[0];
+        const alt = document.getElementById('gal-alt').value.trim();
+        const msg = document.getElementById('gal-create-msg');
+
+        if (!file) {
+          msg.textContent = 'Bitte wähle ein Bild aus';
+          return;
+        }
+
+        msg.textContent = 'Lade Bild hoch...';
+        try {
+          const up = await uploadImage(file, alt || 'Gallery Image');
+          msg.textContent = 'Bild hochgeladen';
+          document.getElementById('gal-file').value = '';
+          document.getElementById('gal-alt').value = '';
+          await loadGallery();
+        } catch(e){
+          msg.textContent = 'Fehler: '+e.message
+        }
+      });
+
+      document.getElementById('btn-toggle-gal-reorder').addEventListener('click', async () => {
+        galReorderMode = !galReorderMode;
+        document.getElementById('btn-save-gal-order').style.display = galReorderMode ? '' : 'none';
+        await loadGallery();
+      });
+
+      document.getElementById('btn-save-gal-order').addEventListener('click', async () => {
+        const container = document.getElementById('gallery-list');
+        const cards = Array.from(container.querySelectorAll('.card'));
+        const orders = cards.map((c, idx) => ({ id: c.dataset.id, displayOrder: idx }));
+        const msg = document.getElementById('gal-order-msg');
+        msg.textContent = 'Speichere Reihenfolge...';
+        try {
+          await api('/api/gallery/reorder', { method:'PUT', headers:{'Content-Type':'application/json'}, body: JSON.stringify({ orders }) });
+          msg.textContent = 'Reihenfolge gespeichert';
+          galReorderMode = false;
+          document.getElementById('btn-save-gal-order').style.display = 'none';
+          await loadGallery();
+        } catch(e){ msg.textContent = 'Fehler: '+e.message }
+      });
+
+      refreshAuth();
+    </script>
+  </body>
+  </html>

src/pages/auth/callback.astro

@@ -0,0 +1,29 @@
+---
+const title = 'Anmeldung wird abgeschlossen...';
+---
+
+<html lang="de">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{title}</title>
+  </head>
+  <body>
+    <p>{title}</p>
+    <script>
+      (function(){
+        try {
+          const params = new URLSearchParams(window.location.search);
+          const token = params.get('token');
+          if (token) {
+            const secure = window.location.protocol === 'https:';
+            document.cookie = `token=${encodeURIComponent(token)}; Path=/; Max-Age=${60*60*24}; SameSite=Lax; ${secure ? 'Secure' : ''}`.trim();
+          }
+        } catch(e) {
+          console.error('Failed to process OAuth token', e);
+        }
+        window.location.replace('/admin');
+      })();
+    </script>
+  </body>
+  </html>

src/pages/index.astro

@@ -8,51 +8,39 @@ import ImageCarousel from "../components/ImageCarousel.astro";
 import Contact from "../components/Contact.astro";
 import About from "../components/About.astro";
 
-const events = [
-	{
-		image: "/images/karaoke.jpg",
-		title: "Karaoke",
-		date: "Mittwoch - Samstag",
-		description: `
-			Bei uns gibt es Karaoke Mi-Sa!! <br>
-			Seid ihr eine Gruppe und lieber unter euch? ..unseren 2.Stock kannst du auch mieten ;) <br>
-			Reserviere am besten gleich per Whatsapp <a href="tel:+41772322770">077 232 27 70</a>
-		`,
-	},
-	{
-		image: "/images/pub_quiz.jpg",
-		title: "Pub Quiz",
-		date: "Jeden Freitag",
-		description: `
-			Jeden Freitag findet unser <b>Pub Quiz</b> statt. Gespielt wird tischweise in 3-4 Runden. <br>
-			Jede Woche gibt es ein anderes Thema. Es geht um Ruhm und Ehre und zusätzlich werden die Sieger der Herzen durch das Publikum gekürt! <3 <br>
-			Auch Einzelpersonen sind herzlich willkommen! <br>
-			*zum mitmachen minimum 1 Getränk konsumieren oder 5CHF
-		`,
-	},
-    {
-        image: "/images/Event4.png",
-        title: "Kevin McFlannigan <br> Live Music im Gallus Pub!",
-        date: "Sa, 27. September 2025",
-        description: `
-			<b>ab 20:00 Uhr</b> <br>
-			Eintritt ist Frei / Hutkollekte <br>
-			Reservieren unter <a href="tel:+41772322770">077 232 27 70</a>
-		`,
-    },
-];
+const API_BASE = 'https://cms.gallus-pub.ch';
 
-const images = [
-	{ src: "/images/Gallery7.png", alt: "Siebtes Bild" },
-	{ src: "/images/Gallery8.png", alt: "Achtes Bild" },
-	{ src: "/images/Gallery9.png", alt: "Neuntes Bild" },
-	{ src: "/images/Gallery6.png", alt: "Sechstes Bild" },
-	{ src: "/images/Gallery1.png", alt: "Erstes Bild" },
-	{ src: "/images/Gallery2.png", alt: "Zweites Bild" },
-	{ src: "/images/Gallery3.png", alt: "Drittes Bild" },
-	{ src: "/images/Gallery4.png", alt: "Viertes Bild" },
-	{ src: "/images/Gallery5.png", alt: "Fünftes Bild" },
-];
+// Fetch events from backend API
+let events = [];
+try {
+	const eventsResponse = await fetch(`${API_BASE}/api/events/public`);
+	if (eventsResponse.ok) {
+		const eventsData = await eventsResponse.json();
+		events = (eventsData.events || []).map((ev: any) => ({
+			image: `${API_BASE}${ev.imageUrl}`,
+			title: ev.title,
+			date: ev.date,
+			description: ev.description
+		}));
+	}
+} catch (error) {
+	console.error('Failed to fetch events:', error);
+}
+
+// Fetch gallery images from backend API
+let images = [];
+try {
+	const galleryResponse = await fetch(`${API_BASE}/api/gallery/public`);
+	if (galleryResponse.ok) {
+		const galleryData = await galleryResponse.json();
+		images = (galleryData.images || []).map((img: any) => ({
+			src: `${API_BASE}${img.imageUrl}`,
+			alt: img.altText
+		}));
+	}
+} catch (error) {
+	console.error('Failed to fetch gallery:', error);
+}
 ---
 
 <Layout>