diff --git a/.env.test b/.env.test
new file mode 100644
index 00000000..a8c805e0
--- /dev/null
+++ b/.env.test
@@ -0,0 +1 @@
+DATABASE_URL=:memory:
diff --git a/.github/actions/install-dependencies/action.yml b/.github/actions/install-dependencies/action.yml
new file mode 100644
index 00000000..36b4abec
--- /dev/null
+++ b/.github/actions/install-dependencies/action.yml
@@ -0,0 +1,15 @@
+name: Install dependencies
+
+description: Install dependencies
+
+runs:
+  using: "composite"
+  steps:
+    - uses: oven-sh/setup-bun@v2
+      name: Install Bun
+      with:
+        bun-version: "1.3.5"
+
+    - name: Install dependencies
+      shell: bash
+      run: bun install --frozen-lockfile
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index acb4c335..1d7d4d7e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,7 +2,6 @@ name: Checks
 
 permissions:
   contents: read
-  security-events: write
 
 on:
   pull_request:
@@ -21,15 +20,18 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
-          ref: ${{ github.ref }}
 
-      - name: Scan current project
-        id: scan
-        uses: anchore/scan-action@v7
-        with:
-          path: "."
+      - name: Install dependencies
+        uses: "./.github/actions/install-dependencies"
 
-      - name: upload Anchore scan SARIF report
-        uses: github/codeql-action/upload-sarif@v4
-        with:
-          sarif_file: ${{ steps.scan.outputs.sarif }}
+      - name: Run type checks
+        shell: bash
+        run: bun run tsc
+
+      - name: Run tests
+        shell: bash
+        run: bun run test --ci --coverage
+
+      - name: Build project
+        shell: bash
+        run: bun run build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 946ad8ef..1d7f7158 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,7 +8,7 @@ on:
       - "v*.*.*-alpha.*"
 
 permissions:
-  contents: read
+  contents: write
   packages: write
   security-events: write
 
diff --git a/AGENTS.md b/AGENTS.md
index 6ba3fcd9..92f7ff18 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -36,6 +36,16 @@ This is a unified application with the following structure:
 bun run tsc
 ```
 
+### Testing
+
+```bash
+# Run all tests
+bun run test
+
+# Run a specific test file
+bunx dotenv-cli -e .env.test -- bun test --preload ./app/test/setup.ts path/to/test.ts
+```
+
 ### Building
 
 ```bash
diff --git a/README.md b/README.md
index e07807d0..ae261fbb 100644
--- a/README.md
+++ b/README.md
@@ -447,6 +447,9 @@ services:
       - ./zerobyte.config.json:/app/zerobyte.config.json:ro # Mount your config file
 ```
 
+> [!WARNING]
+> It is highly discouraged to run Zerobyte on a server that is accessible from the internet (VPS or home server with port forwarding) If you do, make sure to change the port mapping to "127.0.0.1:4096:4096" and use a secure tunnel (SSH tunnel, Cloudflare Tunnel, etc.) with authentication.
+
 > [!WARNING]
 > Do not try to point `/var/lib/zerobyte` on a network share. You will face permission issues and strong performance degradation.
 
@@ -486,6 +489,10 @@ services:
 
 If you need remote mount capabilities, keep the original configuration with `cap_add: SYS_ADMIN` and `devices: /dev/fuse:/dev/fuse`.
 
+## Examples
+
+See [examples/README.md](examples/README.md) for runnable, copy/paste-friendly examples.
+
 ## Adding your first volume
 
 Zerobyte supports multiple volume backends including NFS, SMB, WebDAV, and local directories. A volume represents the source data you want to back up and monitor.
@@ -546,22 +553,27 @@ Zerobyte can use [rclone](https://rclone.org/) to support 40+ cloud storage prov
 **Setup instructions:**
 
 1. **Install rclone on your host system** (if not already installed):
+
    ```bash
    curl https://rclone.org/install.sh | sudo bash
    ```
 
 2. **Configure your cloud storage remote** using rclone's interactive config:
+
    ```bash
    rclone config
    ```
+
    Follow the prompts to set up your cloud storage provider. For OAuth providers (Google Drive, Dropbox, etc.), rclone will guide you through the authentication flow.
 
 3. **Verify your remote is configured**:
+
    ```bash
    rclone listremotes
    ```
 
 4. **Mount the rclone config into the Zerobyte container** by updating your `docker-compose.yml`:
+
    ```diff
    services:
      zerobyte:
@@ -583,6 +595,7 @@ Zerobyte can use [rclone](https://rclone.org/) to support 40+ cloud storage prov
    ```
 
 5. **Restart the Zerobyte container**:
+
    ```bash
    docker compose down
    docker compose up -d
@@ -600,6 +613,7 @@ For a complete list of supported providers, see the [rclone documentation](https
 Once you have added a volume and created a repository, you can create your first backup job. A backup job defines the schedule and parameters for backing up a specific volume to a designated repository.
 
 When creating a backup job, you can specify the following settings:
+
 - **Schedule**: Define how often the backup should run (e.g., daily, weekly)
 - **Retention Policy**: Set rules for how long backups should be retained (e.g., keep daily backups for 7 days, weekly backups for 4 weeks)
 - **Paths**: Specify which files or directories to include in the backup
diff --git a/app/client/modules/backups/components/create-schedule-form.tsx b/app/client/modules/backups/components/create-schedule-form.tsx
index 8f6de25c..2cf62e15 100644
--- a/app/client/modules/backups/components/create-schedule-form.tsx
+++ b/app/client/modules/backups/components/create-schedule-form.tsx
@@ -318,7 +318,7 @@ export const CreateScheduleForm = ({ initialValues, formId, onSubmit, volume }:
 								onSelectionChange={handleSelectionChange}
 								withCheckboxes={true}
 								foldersOnly={false}
-								className="flex-1 border rounded-md bg-card p-2 min-h-[300px] max-h-[400px] overflow-auto"
+								className="flex-1 border rounded-md bg-card p-2 min-h-75 max-h-100 overflow-auto"
 							/>
 							{selectedPaths.size > 0 && (
 								<div className="mt-4">
@@ -342,7 +342,7 @@ export const CreateScheduleForm = ({ initialValues, formId, onSubmit, volume }:
 											<Textarea
 												{...field}
 												placeholder="/data/**&#10;/config/*.json&#10;*.db"
-												className="font-mono text-sm min-h-[100px]"
+												className="font-mono text-sm min-h-25"
 											/>
 										</FormControl>
 										<FormDescription>
@@ -375,7 +375,7 @@ export const CreateScheduleForm = ({ initialValues, formId, onSubmit, volume }:
 											<Textarea
 												{...field}
 												placeholder="*.tmp&#10;node_modules/**&#10;.cache/&#10;*.log"
-												className="font-mono text-sm min-h-[120px]"
+												className="font-mono text-sm min-h-30"
 											/>
 										</FormControl>
 										<FormDescription>
diff --git a/app/client/modules/notifications/routes/notification-details.tsx b/app/client/modules/notifications/routes/notification-details.tsx
index c6675360..1a29229c 100644
--- a/app/client/modules/notifications/routes/notification-details.tsx
+++ b/app/client/modules/notifications/routes/notification-details.tsx
@@ -172,7 +172,15 @@ export default function NotificationDetailsPage({ loaderData }: Route.ComponentP
 							</AlertDescription>
 						</Alert>
 					)}
-					<CreateNotificationForm mode="update" formId={formId} onSubmit={handleSubmit} initialValues={data.config} />
+					<CreateNotificationForm
+						mode="update"
+						formId={formId}
+						onSubmit={handleSubmit}
+						initialValues={{
+							...data.config,
+							name: data.name,
+						}}
+					/>
 					<div className="flex justify-end gap-2 pt-4 border-t">
 						<Button type="submit" form={formId} loading={updateDestination.isPending}>
 							<Save className="h-4 w-4 mr-2" />
diff --git a/app/server/app.ts b/app/server/app.ts
new file mode 100644
index 00000000..b2d12d02
--- /dev/null
+++ b/app/server/app.ts
@@ -0,0 +1,87 @@
+import { Scalar } from "@scalar/hono-api-reference";
+import { Hono } from "hono";
+import { logger as honoLogger } from "hono/logger";
+import { secureHeaders } from "hono/secure-headers";
+import { rateLimiter } from "hono-rate-limiter";
+import { openAPIRouteHandler } from "hono-openapi";
+import { authController } from "./modules/auth/auth.controller";
+import { requireAuth } from "./modules/auth/auth.middleware";
+import { repositoriesController } from "./modules/repositories/repositories.controller";
+import { systemController } from "./modules/system/system.controller";
+import { volumeController } from "./modules/volumes/volume.controller";
+import { backupScheduleController } from "./modules/backups/backups.controller";
+import { eventsController } from "./modules/events/events.controller";
+import { notificationsController } from "./modules/notifications/notifications.controller";
+import { handleServiceError } from "./utils/errors";
+import { logger } from "./utils/logger";
+import { config } from "./core/config";
+
+export const generalDescriptor = (app: Hono) =>
+	openAPIRouteHandler(app, {
+		documentation: {
+			info: {
+				title: "Zerobyte API",
+				version: "1.0.0",
+				description: "API for managing volumes",
+			},
+			servers: [{ url: `http://${config.serverIp}:4096`, description: "Development Server" }],
+		},
+	});
+
+export const scalarDescriptor = Scalar({
+	title: "Zerobyte API Docs",
+	pageTitle: "Zerobyte API Docs",
+	url: "/api/v1/openapi.json",
+});
+
+export const createApp = () => {
+	const app = new Hono();
+
+	if (config.environment !== "test") {
+		app.use(honoLogger());
+	}
+
+	app
+		.use(secureHeaders())
+		.use(
+			rateLimiter({
+				windowMs: 60 * 5 * 1000,
+				limit: 1000,
+				keyGenerator: (c) => c.req.header("x-forwarded-for") ?? "",
+				skip: () => {
+					return config.__prod__ === false;
+				},
+			}),
+		)
+		.get("healthcheck", (c) => c.json({ status: "ok" }))
+		.route("/api/v1/auth", authController)
+		.use("/api/v1/volumes/*", requireAuth)
+		.use("/api/v1/repositories/*", requireAuth)
+		.use("/api/v1/backups/*", requireAuth)
+		.use("/api/v1/notifications/*", requireAuth)
+		.use("/api/v1/system/*", requireAuth)
+		.use("/api/v1/events/*", requireAuth)
+		.route("/api/v1/volumes", volumeController)
+		.route("/api/v1/repositories", repositoriesController)
+		.route("/api/v1/backups", backupScheduleController)
+		.route("/api/v1/notifications", notificationsController)
+		.route("/api/v1/system", systemController)
+		.route("/api/v1/events", eventsController);
+
+	app.get("/api/v1/openapi.json", generalDescriptor(app));
+	app.get("/api/v1/docs", requireAuth, scalarDescriptor);
+
+	app.onError((err, c) => {
+		logger.error(`${c.req.url}: ${err.message}`);
+
+		if (err.cause instanceof Error) {
+			logger.error(err.cause.message);
+		}
+
+		const { status, message } = handleServiceError(err);
+
+		return c.json({ message }, status);
+	});
+
+	return app;
+};
diff --git a/app/server/core/__tests__/repository-mutex.test.ts b/app/server/core/__tests__/repository-mutex.test.ts
new file mode 100644
index 00000000..623881e0
--- /dev/null
+++ b/app/server/core/__tests__/repository-mutex.test.ts
@@ -0,0 +1,38 @@
+import { test, describe, expect } from "bun:test";
+import { repoMutex } from "../repository-mutex";
+
+describe("RepositoryMutex", () => {
+	test("should prioritize waiting exclusive locks over new shared locks", async () => {
+		const repoId = "test-repo";
+		const results: string[] = [];
+
+		const releaseShared1 = await repoMutex.acquireShared(repoId, "backup-1");
+		results.push("acquired-shared-1");
+
+		const exclusivePromise = repoMutex.acquireExclusive(repoId, "unlock").then((release) => {
+			results.push("acquired-exclusive");
+			return release;
+		});
+
+		const shared2Promise = repoMutex.acquireShared(repoId, "backup-2").then((release) => {
+			results.push("acquired-shared-2");
+			return release;
+		});
+
+		await new Promise((resolve) => setTimeout(resolve, 50));
+
+		expect(results).toEqual(["acquired-shared-1"]);
+
+		releaseShared1();
+
+		const releaseExclusive = await exclusivePromise;
+		expect(results).toEqual(["acquired-shared-1", "acquired-exclusive"]);
+
+		releaseExclusive();
+
+		const releaseShared2 = await shared2Promise;
+		expect(results).toEqual(["acquired-shared-1", "acquired-exclusive", "acquired-shared-2"]);
+
+		releaseShared2();
+	});
+});
diff --git a/app/server/core/constants.ts b/app/server/core/constants.ts
index a59f558d..98a38724 100644
--- a/app/server/core/constants.ts
+++ b/app/server/core/constants.ts
@@ -1,7 +1,7 @@
 export const OPERATION_TIMEOUT = 5000;
 export const VOLUME_MOUNT_BASE = "/var/lib/zerobyte/volumes";
 export const REPOSITORY_BASE = "/var/lib/zerobyte/repositories";
-export const DATABASE_URL = "/var/lib/zerobyte/data/ironmount.db";
+export const DATABASE_URL = process.env.DATABASE_URL || "/var/lib/zerobyte/data/ironmount.db";
 export const RESTIC_PASS_FILE = "/var/lib/zerobyte/data/restic.pass";
 
 export const DEFAULT_EXCLUDES = [DATABASE_URL, RESTIC_PASS_FILE, REPOSITORY_BASE];
diff --git a/app/server/core/repository-mutex.ts b/app/server/core/repository-mutex.ts
index 4717c882..a1bb5ad4 100644
--- a/app/server/core/repository-mutex.ts
+++ b/app/server/core/repository-mutex.ts
@@ -49,7 +49,9 @@ class RepositoryMutex {
 	async acquireShared(repositoryId: string, operation: string): Promise<() => void> {
 		const state = this.getOrCreateState(repositoryId);
 
-		if (!state.exclusiveHolder) {
+		const hasExclusiveInQueue = state.waitQueue.some((item) => item.type === "exclusive");
+
+		if (!state.exclusiveHolder && !hasExclusiveInQueue) {
 			const lockId = this.generateLockId();
 			state.sharedHolders.set(lockId, {
 				id: lockId,
@@ -60,7 +62,7 @@ class RepositoryMutex {
 		}
 
 		logger.debug(
-			`[Mutex] Waiting for shared lock on repo ${repositoryId}: ${operation} (exclusive held by: ${state.exclusiveHolder.operation})`,
+			`[Mutex] Waiting for shared lock on repo ${repositoryId}: ${operation} (exclusive held by: ${state.exclusiveHolder?.operation ?? "none"}, queue: ${state.waitQueue.length})`,
 		);
 		const lockId = await new Promise<string>((resolve) => {
 			state.waitQueue.push({ type: "shared", operation, resolve });
diff --git a/app/server/db/schema.ts b/app/server/db/schema.ts
index cb94d29b..e35ca820 100644
--- a/app/server/db/schema.ts
+++ b/app/server/db/schema.ts
@@ -21,6 +21,7 @@ export const volumesTable = sqliteTable("volumes_table", {
 	autoRemount: int("auto_remount", { mode: "boolean" }).notNull().default(true),
 });
 export type Volume = typeof volumesTable.$inferSelect;
+export type VolumeInsert = typeof volumesTable.$inferInsert;
 
 /**
  * Users Table
@@ -61,6 +62,7 @@ export const repositoriesTable = sqliteTable("repositories_table", {
 	updatedAt: int("updated_at", { mode: "number" }).notNull().default(sql`(unixepoch() * 1000)`),
 });
 export type Repository = typeof repositoriesTable.$inferSelect;
+export type RepositoryInsert = typeof repositoriesTable.$inferInsert;
 
 /**
  * Backup Schedules Table
@@ -96,6 +98,7 @@ export const backupSchedulesTable = sqliteTable("backup_schedules_table", {
 	createdAt: int("created_at", { mode: "number" }).notNull().default(sql`(unixepoch() * 1000)`),
 	updatedAt: int("updated_at", { mode: "number" }).notNull().default(sql`(unixepoch() * 1000)`),
 });
+export type BackupScheduleInsert = typeof backupSchedulesTable.$inferInsert;
 
 export const backupScheduleRelations = relations(backupSchedulesTable, ({ one, many }) => ({
 	volume: one(volumesTable, {
diff --git a/app/server/index.ts b/app/server/index.ts
index 20139a11..d1c32098 100644
--- a/app/server/index.ts
+++ b/app/server/index.ts
@@ -1,89 +1,14 @@
 import { createHonoServer } from "react-router-hono-server/bun";
-import { Scalar } from "@scalar/hono-api-reference";
-import { Hono } from "hono";
-import { logger as honoLogger } from "hono/logger";
-import { secureHeaders } from "hono/secure-headers";
-import { rateLimiter } from "hono-rate-limiter";
-import { openAPIRouteHandler } from "hono-openapi";
 import { runDbMigrations } from "./db/db";
-import { authController } from "./modules/auth/auth.controller";
-import { requireAuth } from "./modules/auth/auth.middleware";
 import { startup } from "./modules/lifecycle/startup";
 import { migrateToShortIds } from "./modules/lifecycle/migration";
-import { repositoriesController } from "./modules/repositories/repositories.controller";
-import { systemController } from "./modules/system/system.controller";
-import { volumeController } from "./modules/volumes/volume.controller";
-import { backupScheduleController } from "./modules/backups/backups.controller";
-import { eventsController } from "./modules/events/events.controller";
-import { notificationsController } from "./modules/notifications/notifications.controller";
-import { handleServiceError } from "./utils/errors";
 import { logger } from "./utils/logger";
 import { shutdown } from "./modules/lifecycle/shutdown";
 import { REQUIRED_MIGRATIONS } from "./core/constants";
 import { validateRequiredMigrations } from "./modules/lifecycle/checkpoint";
-import { config } from "./core/config";
+import { createApp } from "./app";
 
-export const generalDescriptor = (app: Hono) =>
-	openAPIRouteHandler(app, {
-		documentation: {
-			info: {
-				title: "Zerobyte API",
-				version: "1.0.0",
-				description: "API for managing volumes",
-			},
-			servers: [{ url: `http://${config.serverIp}:4096`, description: "Development Server" }],
-		},
-	});
-
-export const scalarDescriptor = Scalar({
-	title: "Zerobyte API Docs",
-	pageTitle: "Zerobyte API Docs",
-	url: "/api/v1/openapi.json",
-});
-
-const app = new Hono()
-	.use(honoLogger())
-	.use(secureHeaders())
-	.use(
-		rateLimiter({
-			windowMs: 60 * 5 * 1000,
-			limit: 1000,
-			keyGenerator: (c) => c.req.header("x-forwarded-for") ?? "",
-			skip: () => {
-				return config.__prod__ === false;
-			},
-		}),
-	)
-	.get("healthcheck", (c) => c.json({ status: "ok" }))
-	.route("/api/v1/auth", authController)
-	.use("/api/v1/volumes/*", requireAuth)
-	.use("/api/v1/repositories/*", requireAuth)
-	.use("/api/v1/backups/*", requireAuth)
-	.use("/api/v1/notifications/*", requireAuth)
-	.use("/api/v1/system/*", requireAuth)
-	.use("/api/v1/events/*", requireAuth)
-	.route("/api/v1/volumes", volumeController)
-	.route("/api/v1/repositories", repositoriesController)
-	.route("/api/v1/backups", backupScheduleController)
-	.route("/api/v1/notifications", notificationsController)
-	.route("/api/v1/system", systemController)
-	.route("/api/v1/events", eventsController);
-
-// API documentation endpoints require authentication
-app.get("/api/v1/openapi.json", requireAuth, generalDescriptor(app));
-app.get("/api/v1/docs", requireAuth, scalarDescriptor);
-
-app.onError((err, c) => {
-	logger.error(`${c.req.url}: ${err.message}`);
-
-	if (err.cause instanceof Error) {
-		logger.error(err.cause.message);
-	}
-
-	const { status, message } = handleServiceError(err);
-
-	return c.json({ message }, status);
-});
+const app = createApp();
 
 runDbMigrations();
 
diff --git a/app/server/jobs/backup-execution.ts b/app/server/jobs/backup-execution.ts
index 821333ef..c38947a6 100644
--- a/app/server/jobs/backup-execution.ts
+++ b/app/server/jobs/backup-execution.ts
@@ -1,6 +1,5 @@
 import { Job } from "../core/scheduler";
 import { backupsService } from "../modules/backups/backups.service";
-import { toMessage } from "../utils/errors";
 import { logger } from "../utils/logger";
 
 export class BackupExecutionJob extends Job {
@@ -17,8 +16,8 @@ export class BackupExecutionJob extends Job {
 		logger.info(`Found ${scheduleIds.length} backup schedule(s) to execute`);
 
 		for (const scheduleId of scheduleIds) {
-			backupsService.executeBackup(scheduleId).catch((error) => {
-				logger.error(`Failed to execute backup for schedule ${scheduleId}: ${toMessage(error)}`);
+			backupsService.executeBackup(scheduleId).catch((err) => {
+				logger.error(`Error executing backup for schedule ${scheduleId}:`, err);
 			});
 		}
 
diff --git a/app/server/modules/backends/utils/backend-utils.ts b/app/server/modules/backends/utils/backend-utils.ts
index 637001fb..e610217d 100644
--- a/app/server/modules/backends/utils/backend-utils.ts
+++ b/app/server/modules/backends/utils/backend-utils.ts
@@ -7,6 +7,7 @@ import { $ } from "bun";
 export const executeMount = async (args: string[]): Promise<void> => {
 	let stderr: string | undefined;
 
+	logger.debug(`Executing mount ${args.join(" ")}`);
 	const result = await $`mount ${args}`.nothrow();
 	stderr = result.stderr.toString();
 
@@ -22,7 +23,8 @@ export const executeMount = async (args: string[]): Promise<void> => {
 export const executeUnmount = async (path: string): Promise<void> => {
 	let stderr: string | undefined;
 
-	const result = await $`umount -l -f ${path}`.nothrow();
+	logger.debug(`Executing umount -l ${path}`);
+	const result = await $`umount -l ${path}`.nothrow();
 	stderr = result.stderr.toString();
 
 	if (stderr?.trim()) {
diff --git a/app/server/modules/backups/__tests__/backups.controller.test.ts b/app/server/modules/backups/__tests__/backups.controller.test.ts
new file mode 100644
index 00000000..3c415004
--- /dev/null
+++ b/app/server/modules/backups/__tests__/backups.controller.test.ts
@@ -0,0 +1,126 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("backups security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/backups");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/backups", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/backups", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/backups" },
+			{ method: "GET", path: "/api/v1/backups/1" },
+			{ method: "GET", path: "/api/v1/backups/volume/1" },
+			{ method: "POST", path: "/api/v1/backups" },
+			{ method: "PATCH", path: "/api/v1/backups/1" },
+			{ method: "DELETE", path: "/api/v1/backups/1" },
+			{ method: "POST", path: "/api/v1/backups/1/run" },
+			{ method: "POST", path: "/api/v1/backups/1/stop" },
+			{ method: "POST", path: "/api/v1/backups/1/forget" },
+			{ method: "GET", path: "/api/v1/backups/1/notifications" },
+			{ method: "PUT", path: "/api/v1/backups/1/notifications" },
+			{ method: "GET", path: "/api/v1/backups/1/mirrors" },
+			{ method: "PUT", path: "/api/v1/backups/1/mirrors" },
+			{ method: "GET", path: "/api/v1/backups/1/mirrors/compatibility" },
+			{ method: "POST", path: "/api/v1/backups/reorder" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("information disclosure", () => {
+		test("should not disclose if a schedule exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/backups/999999");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+
+		test("should not disclose if a volume exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/backups/volume/999999");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+	});
+
+	describe("input validation", () => {
+		test("should return 404 for malformed schedule ID", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/backups/not-a-number", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+		});
+
+		test("should return 404 for non-existent schedule ID", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/backups/999999", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+			const body = await res.json();
+			expect(body.message).toBe("Backup schedule not found");
+		});
+
+		test("should return 400 for invalid payload on create", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/backups", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					name: "Test",
+				}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+});
diff --git a/app/server/modules/backups/__tests__/backups.patterns.test.ts b/app/server/modules/backups/__tests__/backups.patterns.test.ts
new file mode 100644
index 00000000..fafb9e6d
--- /dev/null
+++ b/app/server/modules/backups/__tests__/backups.patterns.test.ts
@@ -0,0 +1,136 @@
+import { test, describe, mock, expect, beforeEach, afterEach, spyOn } from "bun:test";
+import { backupsService } from "../backups.service";
+import { createTestVolume } from "~/test/helpers/volume";
+import { createTestBackupSchedule } from "~/test/helpers/backup";
+import { createTestRepository } from "~/test/helpers/repository";
+import { generateBackupOutput } from "~/test/helpers/restic";
+import { getVolumePath } from "../../volumes/helpers";
+import { restic } from "~/server/utils/restic";
+import path from "node:path";
+
+const backupMock = mock(() => Promise.resolve({ exitCode: 0, result: JSON.parse(generateBackupOutput()) }));
+
+beforeEach(() => {
+	backupMock.mockClear();
+	spyOn(restic, "backup").mockImplementation(backupMock);
+	spyOn(restic, "forget").mockImplementation(mock(() => Promise.resolve({ success: true })));
+});
+
+afterEach(() => {
+	mock.restore();
+});
+
+describe("executeBackup - include / exclude patterns", () => {
+	test("should correctly build include and exclude patterns", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const volumePath = getVolumePath(volume);
+
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			includePatterns: ["*.zip", "/Photos", "!/Temp", "!*.log"],
+			excludePatterns: [".DS_Store", "/Config", "!/Important", "!*.tmp"],
+			excludeIfPresent: [".nobackup"],
+		});
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		expect(backupMock).toHaveBeenCalledWith(
+			expect.anything(),
+			volumePath,
+			expect.objectContaining({
+				include: ["*.zip", path.join(volumePath, "Photos"), `!${path.join(volumePath, "Temp")}`, "!*.log"],
+				exclude: [".DS_Store", path.join(volumePath, "Config"), `!${path.join(volumePath, "Important")}`, "!*.tmp"],
+				excludeIfPresent: [".nobackup"],
+			}),
+		);
+	});
+
+	test("should not join with volume path if pattern already starts with it", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const volumePath = getVolumePath(volume);
+		const repository = await createTestRepository();
+
+		const alreadyJoinedInclude = path.join(volumePath, "already/joined");
+		const alreadyJoinedExclude = path.join(volumePath, "already/excluded");
+
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			includePatterns: [alreadyJoinedInclude],
+			excludePatterns: [alreadyJoinedExclude],
+		});
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		expect(backupMock).toHaveBeenCalledWith(
+			expect.anything(),
+			volumePath,
+			expect.objectContaining({
+				include: [alreadyJoinedInclude],
+				exclude: [alreadyJoinedExclude],
+			}),
+		);
+	});
+
+	test("should correctly mix relative and absolute patterns", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const volumePath = getVolumePath(volume);
+		const repository = await createTestRepository();
+
+		const alreadyJoinedInclude = path.join(volumePath, "already/joined");
+		const relativeInclude = "relative/include";
+		const anchoredInclude = "/anchored/include";
+
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			includePatterns: [alreadyJoinedInclude, relativeInclude, anchoredInclude],
+		});
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		expect(backupMock).toHaveBeenCalledWith(
+			expect.anything(),
+			volumePath,
+			expect.objectContaining({
+				include: [alreadyJoinedInclude, relativeInclude, path.join(volumePath, "anchored/include")],
+			}),
+		);
+	});
+
+	test("should handle empty include and exclude patterns", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			includePatterns: [],
+			excludePatterns: [],
+		});
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		expect(backupMock).toHaveBeenCalledWith(
+			expect.anything(),
+			getVolumePath(volume),
+			expect.not.objectContaining({
+				include: expect.anything(),
+				exclude: expect.anything(),
+			}),
+		);
+	});
+});
diff --git a/app/server/modules/backups/__tests__/backups.service.test.ts b/app/server/modules/backups/__tests__/backups.service.test.ts
new file mode 100644
index 00000000..75933fc1
--- /dev/null
+++ b/app/server/modules/backups/__tests__/backups.service.test.ts
@@ -0,0 +1,176 @@
+import { test, describe, mock, expect, beforeEach, afterEach, spyOn } from "bun:test";
+import { backupsService } from "../backups.service";
+import { createTestVolume } from "~/test/helpers/volume";
+import { createTestBackupSchedule } from "~/test/helpers/backup";
+import { createTestRepository } from "~/test/helpers/repository";
+import { generateBackupOutput } from "~/test/helpers/restic";
+import { faker } from "@faker-js/faker";
+import * as spawnModule from "~/server/utils/spawn";
+
+const resticBackupMock = mock(() => Promise.resolve({ exitCode: 0, stdout: "", stderr: "" }));
+
+beforeEach(() => {
+	resticBackupMock.mockClear();
+	spyOn(spawnModule, "safeSpawn").mockImplementation(resticBackupMock);
+});
+
+afterEach(() => {
+	mock.restore();
+});
+
+describe("execute backup", () => {
+	test("should correctly set next backup time", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			cronExpression: "*/5 * * * *",
+		});
+		expect(schedule.nextBackupAt).toBeNull();
+
+		resticBackupMock.mockImplementationOnce(() =>
+			Promise.resolve({ exitCode: 0, stdout: generateBackupOutput(), stderr: "" }),
+		);
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		const updatedSchedule = await backupsService.getSchedule(schedule.id);
+		expect(updatedSchedule.nextBackupAt).not.toBeNull();
+
+		const nextBackupAt = new Date(updatedSchedule.nextBackupAt ?? 0);
+		const now = new Date();
+
+		expect(nextBackupAt.getTime()).toBeGreaterThanOrEqual(now.getTime());
+		expect(nextBackupAt.getTime() - now.getTime()).toBeLessThanOrEqual(5 * 60 * 1000);
+	});
+
+	test("should skip backup if schedule is disabled", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			enabled: false,
+		});
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		expect(resticBackupMock).not.toHaveBeenCalled();
+	});
+
+	test("should execute backup if schedule is disabled but the run is manual", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			enabled: false,
+		});
+
+		resticBackupMock.mockImplementationOnce(() =>
+			Promise.resolve({ exitCode: 0, stdout: generateBackupOutput(), stderr: "" }),
+		);
+
+		// act
+		await backupsService.executeBackup(schedule.id, true);
+
+		// assert
+		expect(resticBackupMock).toHaveBeenCalled();
+	});
+
+	test("should skip the backup if the previous one is still running", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+		});
+
+		resticBackupMock.mockImplementation(async () => {
+			await new Promise((resolve) => setTimeout(resolve, 100));
+			return Promise.resolve({ exitCode: 0, stdout: generateBackupOutput(), stderr: "" });
+		});
+
+		// act
+		backupsService.executeBackup(schedule.id);
+		await new Promise((resolve) => setTimeout(resolve, 10));
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		expect(resticBackupMock).toHaveBeenCalledTimes(1);
+	});
+
+	test("should set the backup status to failed if restic returns a 3 exit code", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+		});
+
+		resticBackupMock.mockImplementationOnce(() =>
+			Promise.resolve({ exitCode: 3, stdout: generateBackupOutput(), stderr: "Some error occurred" }),
+		);
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		const updatedSchedule = await backupsService.getSchedule(schedule.id);
+		expect(updatedSchedule.lastBackupStatus).toBe("warning");
+	});
+
+	test("should set the backup status to failed if restic returns a non zero exit code", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+		});
+
+		resticBackupMock.mockImplementationOnce(() =>
+			Promise.resolve({ exitCode: 1, stdout: generateBackupOutput(), stderr: "Some error occurred" }),
+		);
+
+		// act
+		await backupsService.executeBackup(schedule.id);
+
+		// assert
+		const updatedSchedule = await backupsService.getSchedule(schedule.id);
+		expect(updatedSchedule.lastBackupStatus).toBe("error");
+	});
+});
+
+describe("getSchedulesToExecute", () => {
+	test("should return schedules with NULL lastBackupStatus", async () => {
+		// arrange
+		const volume = await createTestVolume();
+		const repository = await createTestRepository();
+
+		const schedule = await createTestBackupSchedule({
+			volumeId: volume.id,
+			repositoryId: repository.id,
+			enabled: true,
+			cronExpression: "* * * * *",
+			lastBackupStatus: null,
+			nextBackupAt: faker.date.past().getTime(),
+		});
+
+		// act
+		const schedulesToExecute = await backupsService.getSchedulesToExecute();
+
+		// assert
+		expect(schedulesToExecute).toContain(schedule.id);
+	});
+});
diff --git a/app/server/modules/backups/backups.controller.ts b/app/server/modules/backups/backups.controller.ts
index 653cd659..e9fa9f7a 100644
--- a/app/server/modules/backups/backups.controller.ts
+++ b/app/server/modules/backups/backups.controller.ts
@@ -86,8 +86,8 @@ export const backupScheduleController = new Hono()
 	.post("/:scheduleId/run", runBackupNowDto, async (c) => {
 		const scheduleId = c.req.param("scheduleId");
 
-		backupsService.executeBackup(Number(scheduleId), true).catch((error) => {
-			console.error("Backup execution failed:", error);
+		backupsService.executeBackup(Number(scheduleId), true).catch((err) => {
+			console.error(`Error executing manual backup for schedule ${scheduleId}:`, err);
 		});
 
 		return c.json<RunBackupNowDto>({ success: true }, 200);
diff --git a/app/server/modules/backups/backups.service.ts b/app/server/modules/backups/backups.service.ts
index 584fada7..1ff51247 100644
--- a/app/server/modules/backups/backups.service.ts
+++ b/app/server/modules/backups/backups.service.ts
@@ -1,4 +1,4 @@
-import { and, asc, eq, ne } from "drizzle-orm";
+import { and, asc, eq, isNull, ne, or } from "drizzle-orm";
 import cron from "node-cron";
 import { CronExpressionParser } from "cron-parser";
 import { NotFoundError, BadRequestError, ConflictError } from "http-errors-enhanced";
@@ -13,6 +13,7 @@ import { serverEvents } from "../../core/events";
 import { notificationsService } from "../notifications/notifications.service";
 import { repoMutex } from "../../core/repository-mutex";
 import { checkMirrorCompatibility, getIncompatibleMirrorError } from "~/server/utils/backend-compatibility";
+import path from "node:path";
 
 const runningBackups = new Map<number, AbortController>();
 
@@ -32,6 +33,27 @@ const calculateNextRun = (cronExpression: string): number => {
 	}
 };
 
+const processPattern = (pattern: string, volumePath: string): string => {
+	let isNegated = false;
+	let p = pattern;
+
+	if (p.startsWith("!")) {
+		isNegated = true;
+		p = p.slice(1);
+	}
+
+	if (p.startsWith(volumePath)) {
+		return pattern;
+	}
+
+	if (p.startsWith("/")) {
+		const processed = path.join(volumePath, p.slice(1));
+		return isNegated ? `!${processed}` : processed;
+	}
+
+	return pattern;
+};
+
 const listSchedules = async () => {
 	const schedules = await db.query.backupSchedulesTable.findMany({
 		with: {
@@ -258,7 +280,7 @@ const executeBackup = async (scheduleId: number, manual = false) => {
 		};
 
 		if (schedule.excludePatterns && schedule.excludePatterns.length > 0) {
-			backupOptions.exclude = schedule.excludePatterns;
+			backupOptions.exclude = schedule.excludePatterns.map((p) => processPattern(p, volumePath));
 		}
 
 		if (schedule.excludeIfPresent && schedule.excludeIfPresent.length > 0) {
@@ -266,7 +288,7 @@ const executeBackup = async (scheduleId: number, manual = false) => {
 		}
 
 		if (schedule.includePatterns && schedule.includePatterns.length > 0) {
-			backupOptions.include = schedule.includePatterns;
+			backupOptions.include = schedule.includePatterns.map((p) => processPattern(p, volumePath));
 		}
 
 		const releaseBackupLock = await repoMutex.acquireShared(repository.id, `backup:${volume.name}`);
@@ -363,8 +385,6 @@ const executeBackup = async (scheduleId: number, manual = false) => {
 			.catch((notifError) => {
 				logger.error(`Failed to send backup failure notification: ${toMessage(notifError)}`);
 			});
-
-		throw error;
 	} finally {
 		runningBackups.delete(scheduleId);
 	}
@@ -373,7 +393,10 @@ const executeBackup = async (scheduleId: number, manual = false) => {
 const getSchedulesToExecute = async () => {
 	const now = Date.now();
 	const schedules = await db.query.backupSchedulesTable.findMany({
-		where: and(eq(backupSchedulesTable.enabled, true), ne(backupSchedulesTable.lastBackupStatus, "in_progress")),
+		where: and(
+			eq(backupSchedulesTable.enabled, true),
+			or(ne(backupSchedulesTable.lastBackupStatus, "in_progress"), isNull(backupSchedulesTable.lastBackupStatus)),
+		),
 	});
 
 	const schedulesToRun: number[] = [];
@@ -405,15 +428,6 @@ const stopBackup = async (scheduleId: number) => {
 		throw new NotFoundError("Backup schedule not found");
 	}
 
-	await db
-		.update(backupSchedulesTable)
-		.set({
-			lastBackupStatus: "error",
-			lastBackupError: "Backup was stopped by user",
-			updatedAt: Date.now(),
-		})
-		.where(eq(backupSchedulesTable.id, scheduleId));
-
 	const abortController = runningBackups.get(scheduleId);
 	if (!abortController) {
 		throw new ConflictError("No backup is currently running for this schedule");
@@ -422,6 +436,15 @@ const stopBackup = async (scheduleId: number) => {
 	logger.info(`Stopping backup for schedule ${scheduleId}`);
 
 	abortController.abort();
+
+	await db
+		.update(backupSchedulesTable)
+		.set({
+			lastBackupStatus: "warning",
+			lastBackupError: "Backup was stopped by user",
+			updatedAt: Date.now(),
+		})
+		.where(eq(backupSchedulesTable.id, scheduleId));
 };
 
 const runForget = async (scheduleId: number, repositoryId?: string) => {
diff --git a/app/server/modules/events/__tests__/events.controller.test.ts b/app/server/modules/events/__tests__/events.controller.test.ts
new file mode 100644
index 00000000..c40793fe
--- /dev/null
+++ b/app/server/modules/events/__tests__/events.controller.test.ts
@@ -0,0 +1,53 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("events security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/events");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/events", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/events", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+		expect(res.headers.get("Content-Type")).toBe("text/event-stream");
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [{ method: "GET", path: "/api/v1/events" }];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+});
diff --git a/app/server/modules/notifications/__tests__/notifications.controller.test.ts b/app/server/modules/notifications/__tests__/notifications.controller.test.ts
new file mode 100644
index 00000000..02834267
--- /dev/null
+++ b/app/server/modules/notifications/__tests__/notifications.controller.test.ts
@@ -0,0 +1,110 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("notifications security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/notifications/destinations");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/notifications/destinations", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/notifications/destinations", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/notifications/destinations" },
+			{ method: "POST", path: "/api/v1/notifications/destinations" },
+			{ method: "GET", path: "/api/v1/notifications/destinations/1" },
+			{ method: "PATCH", path: "/api/v1/notifications/destinations/1" },
+			{ method: "DELETE", path: "/api/v1/notifications/destinations/1" },
+			{ method: "POST", path: "/api/v1/notifications/destinations/1/test" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("information disclosure", () => {
+		test("should not disclose if a destination exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/notifications/destinations/999999");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+	});
+
+	describe("input validation", () => {
+		test("should return 404 for malformed destination ID", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/notifications/destinations/not-a-number", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+		});
+
+		test("should return 404 for non-existent destination ID", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/notifications/destinations/999999", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+			const body = await res.json();
+			expect(body.message).toBe("Notification destination not found");
+		});
+
+		test("should return 400 for invalid payload on create", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/notifications/destinations", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					name: "Test",
+				}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+});
diff --git a/app/server/modules/repositories/__tests__/repositories.controller.test.ts b/app/server/modules/repositories/__tests__/repositories.controller.test.ts
new file mode 100644
index 00000000..d7afc68d
--- /dev/null
+++ b/app/server/modules/repositories/__tests__/repositories.controller.test.ts
@@ -0,0 +1,105 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("repositories security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/repositories");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/repositories", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/repositories", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/repositories" },
+			{ method: "POST", path: "/api/v1/repositories" },
+			{ method: "GET", path: "/api/v1/repositories/rclone-remotes" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo" },
+			{ method: "DELETE", path: "/api/v1/repositories/test-repo" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot" },
+			{ method: "GET", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot/files" },
+			{ method: "POST", path: "/api/v1/repositories/test-repo/restore" },
+			{ method: "POST", path: "/api/v1/repositories/test-repo/doctor" },
+			{ method: "DELETE", path: "/api/v1/repositories/test-repo/snapshots/test-snapshot" },
+			{ method: "PATCH", path: "/api/v1/repositories/test-repo" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("information disclosure", () => {
+		test("should not disclose if a repository exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/repositories/non-existent-repo");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+	});
+
+	describe("input validation", () => {
+		test("should return 404 for non-existent repository", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/repositories/non-existent-repo", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+			const body = await res.json();
+			expect(body.message).toBe("Repository not found");
+		});
+
+		test("should return 400 for invalid payload on create", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/repositories", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					name: "Test",
+				}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+});
diff --git a/app/server/modules/system/__tests__/system.controller.test.ts b/app/server/modules/system/__tests__/system.controller.test.ts
new file mode 100644
index 00000000..5ce3d51e
--- /dev/null
+++ b/app/server/modules/system/__tests__/system.controller.test.ts
@@ -0,0 +1,89 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("system security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/system/info");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/system/info", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/system/info", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/system/info" },
+			{ method: "POST", path: "/api/v1/system/restic-password" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("input validation", () => {
+		test("should return 400 for invalid payload on restic-password", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/system/restic-password", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+
+		test("should return 401 for incorrect password on restic-password", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/system/restic-password", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					password: "wrong-password",
+				}),
+			});
+
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Incorrect password");
+		});
+	});
+});
diff --git a/app/server/modules/volumes/__tests__/volumes.controller.test.ts b/app/server/modules/volumes/__tests__/volumes.controller.test.ts
new file mode 100644
index 00000000..04b05776
--- /dev/null
+++ b/app/server/modules/volumes/__tests__/volumes.controller.test.ts
@@ -0,0 +1,104 @@
+import { test, describe, expect } from "bun:test";
+import { createApp } from "~/server/app";
+import { createTestSession } from "~/test/helpers/auth";
+
+const app = createApp();
+
+describe("volumes security", () => {
+	test("should return 401 if no session cookie is provided", async () => {
+		const res = await app.request("/api/v1/volumes");
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Authentication required");
+	});
+
+	test("should return 401 if session is invalid", async () => {
+		const res = await app.request("/api/v1/volumes", {
+			headers: {
+				Cookie: "session_id=invalid-session",
+			},
+		});
+		expect(res.status).toBe(401);
+		const body = await res.json();
+		expect(body.message).toBe("Invalid or expired session");
+
+		expect(res.headers.get("Set-Cookie")).toContain("session_id=;");
+	});
+
+	test("should return 200 if session is valid", async () => {
+		const { sessionId } = await createTestSession();
+
+		const res = await app.request("/api/v1/volumes", {
+			headers: {
+				Cookie: `session_id=${sessionId}`,
+			},
+		});
+
+		expect(res.status).toBe(200);
+	});
+
+	describe("unauthenticated access", () => {
+		const endpoints: { method: string; path: string }[] = [
+			{ method: "GET", path: "/api/v1/volumes" },
+			{ method: "POST", path: "/api/v1/volumes" },
+			{ method: "POST", path: "/api/v1/volumes/test-connection" },
+			{ method: "DELETE", path: "/api/v1/volumes/test-volume" },
+			{ method: "GET", path: "/api/v1/volumes/test-volume" },
+			{ method: "PUT", path: "/api/v1/volumes/test-volume" },
+			{ method: "POST", path: "/api/v1/volumes/test-volume/mount" },
+			{ method: "POST", path: "/api/v1/volumes/test-volume/unmount" },
+			{ method: "POST", path: "/api/v1/volumes/test-volume/health-check" },
+			{ method: "GET", path: "/api/v1/volumes/test-volume/files" },
+			{ method: "GET", path: "/api/v1/volumes/filesystem/browse" },
+		];
+
+		for (const { method, path } of endpoints) {
+			test(`${method} ${path} should return 401`, async () => {
+				const res = await app.request(path, { method });
+				expect(res.status).toBe(401);
+				const body = await res.json();
+				expect(body.message).toBe("Authentication required");
+			});
+		}
+	});
+
+	describe("information disclosure", () => {
+		test("should not disclose if a volume exists when unauthenticated", async () => {
+			const res = await app.request("/api/v1/volumes/non-existent-volume");
+			expect(res.status).toBe(401);
+			const body = await res.json();
+			expect(body.message).toBe("Authentication required");
+		});
+	});
+
+	describe("input validation", () => {
+		test("should return 404 for non-existent volume", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/volumes/non-existent-volume", {
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+				},
+			});
+
+			expect(res.status).toBe(404);
+			const body = await res.json();
+			expect(body.message).toBe("Volume not found");
+		});
+
+		test("should return 400 for invalid payload on create", async () => {
+			const { sessionId } = await createTestSession();
+			const res = await app.request("/api/v1/volumes", {
+				method: "POST",
+				headers: {
+					Cookie: `session_id=${sessionId}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify({
+					name: "Test",
+				}),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+});
diff --git a/app/server/utils/restic.ts b/app/server/utils/restic.ts
index ebd52e23..8cb4502f 100644
--- a/app/server/utils/restic.ts
+++ b/app/server/utils/restic.ts
@@ -4,7 +4,6 @@ import path from "node:path";
 import os from "node:os";
 import { throttle } from "es-toolkit";
 import { type } from "arktype";
-import { $ } from "bun";
 import { REPOSITORY_BASE, RESTIC_PASS_FILE, DEFAULT_EXCLUDES } from "../core/constants";
 import { logger } from "./logger";
 import { cryptoUtils } from "./crypto";
@@ -29,6 +28,7 @@ const backupOutputSchema = type({
 	total_duration: "number",
 	snapshot_id: "string",
 });
+export type BackupOutput = typeof backupOutputSchema.infer;
 
 const snapshotInfoSchema = type({
 	gid: "number?",
@@ -205,12 +205,12 @@ const init = async (config: RepositoryConfig) => {
 	const args = ["init", "--repo", repoUrl];
 	addCommonArgs(args, env);
 
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
 	await cleanupTemporaryKeys(config, env);
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic init failed: ${res.stderr}`);
-		return { success: false, error: res.stderr.toString() };
+		return { success: false, error: res.stderr };
 	}
 
 	logger.info(`Restic repository initialized: ${repoUrl}`);
@@ -266,9 +266,7 @@ const backup = async (
 		const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "zerobyte-restic-include-"));
 		includeFile = path.join(tmp, `include.txt`);
 
-		const includePaths = options.include.map((p) => path.join(source, p));
-
-		await fs.writeFile(includeFile, includePaths.join("\n"), "utf-8");
+		await fs.writeFile(includeFile, options.include.join("\n"), "utf-8");
 
 		args.push("--files-from", includeFile);
 	} else {
@@ -279,10 +277,14 @@ const backup = async (
 		args.push("--exclude", exclude);
 	}
 
+	let excludeFile: string | null = null;
 	if (options?.exclude && options.exclude.length > 0) {
-		for (const pattern of options.exclude) {
-			args.push("--exclude", pattern);
-		}
+		const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "zerobyte-restic-exclude-"));
+		excludeFile = path.join(tmp, `exclude.txt`);
+
+		await fs.writeFile(excludeFile, options.exclude.join("\n"), "utf-8");
+
+		args.push("--exclude-file", excludeFile);
 	}
 
 	if (options?.excludeIfPresent && options.excludeIfPresent.length > 0) {
@@ -329,22 +331,28 @@ const backup = async (
 		},
 		finally: async () => {
 			includeFile && (await fs.unlink(includeFile).catch(() => {}));
+			excludeFile && (await fs.unlink(excludeFile).catch(() => {}));
 			await cleanupTemporaryKeys(config, env);
 		},
 	});
 
+	if (options?.signal?.aborted) {
+		logger.warn("Restic backup was aborted by signal.");
+		return { result: null, exitCode: res.exitCode };
+	}
+
 	if (res.exitCode === 3) {
-		logger.error(`Restic backup encountered read errors: ${res.stderr.toString()}`);
+		logger.error(`Restic backup encountered read errors: ${res.stderr}`);
 	}
 
 	if (res.exitCode !== 0 && res.exitCode !== 3) {
-		logger.error(`Restic backup failed: ${res.stderr.toString()}`);
+		logger.error(`Restic backup failed: ${res.stderr}`);
 		logger.error(`Command executed: restic ${args.join(" ")}`);
 
-		throw new ResticError(res.exitCode, res.stderr.toString());
+		throw new ResticError(res.exitCode, res.stderr);
 	}
 
-	const lastLine = stdout.trim();
+	const lastLine = (stdout || res.stdout).trim();
 	let summaryLine = "";
 	try {
 		const resSummary = JSON.parse(lastLine ?? "{}");
@@ -420,16 +428,16 @@ const restore = async (
 	addCommonArgs(args, env);
 
 	logger.debug(`Executing: restic ${args.join(" ")}`);
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
+
 	await cleanupTemporaryKeys(config, env);
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic restore failed: ${res.stderr}`);
-		throw new ResticError(res.exitCode, res.stderr.toString());
+		throw new ResticError(res.exitCode, res.stderr);
 	}
 
-	const stdout = res.text();
-	const outputLines = stdout.trim().split("\n");
+	const outputLines = res.stdout.trim().split("\n");
 	const lastLine = outputLines[outputLines.length - 1];
 
 	if (!lastLine) {
@@ -482,7 +490,7 @@ const snapshots = async (config: RepositoryConfig, options: { tags?: string[] }
 
 	addCommonArgs(args, env);
 
-	const res = await $`restic ${args}`.env(env).nothrow().quiet();
+	const res = await safeSpawn({ command: "restic", args, env });
 	await cleanupTemporaryKeys(config, env);
 
 	if (res.exitCode !== 0) {
@@ -490,7 +498,7 @@ const snapshots = async (config: RepositoryConfig, options: { tags?: string[] }
 		throw new Error(`Restic snapshots retrieval failed: ${res.stderr}`);
 	}
 
-	const result = snapshotInfoSchema.array()(res.json());
+	const result = snapshotInfoSchema.array()(JSON.parse(res.stdout));
 
 	if (result instanceof type.errors) {
 		logger.error(`Restic snapshots output validation failed: ${result}`);
@@ -531,12 +539,12 @@ const forget = async (config: RepositoryConfig, options: RetentionPolicy, extra:
 	args.push("--prune");
 	addCommonArgs(args, env);
 
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
 	await cleanupTemporaryKeys(config, env);
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic forget failed: ${res.stderr}`);
-		throw new ResticError(res.exitCode, res.stderr.toString());
+		throw new ResticError(res.exitCode, res.stderr);
 	}
 
 	return { success: true };
@@ -549,12 +557,12 @@ const deleteSnapshot = async (config: RepositoryConfig, snapshotId: string) => {
 	const args: string[] = ["--repo", repoUrl, "forget", snapshotId, "--prune"];
 	addCommonArgs(args, env);
 
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
 	await cleanupTemporaryKeys(config, env);
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic snapshot deletion failed: ${res.stderr}`);
-		throw new ResticError(res.exitCode, res.stderr.toString());
+		throw new ResticError(res.exitCode, res.stderr);
 	}
 
 	return { success: true };
@@ -604,7 +612,7 @@ const ls = async (config: RepositoryConfig, snapshotId: string, path?: string) =
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic ls failed: ${res.stderr}`);
-		throw new ResticError(res.exitCode, res.stderr.toString());
+		throw new ResticError(res.exitCode, res.stderr);
 	}
 
 	// The output is a stream of JSON objects, first is snapshot info, rest are file/dir nodes
@@ -650,12 +658,12 @@ const unlock = async (config: RepositoryConfig) => {
 	const args = ["unlock", "--repo", repoUrl, "--remove-all"];
 	addCommonArgs(args, env);
 
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
 	await cleanupTemporaryKeys(config, env);
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic unlock failed: ${res.stderr}`);
-		throw new ResticError(res.exitCode, res.stderr.toString());
+		throw new ResticError(res.exitCode, res.stderr);
 	}
 
 	logger.info(`Restic unlock succeeded for repository: ${repoUrl}`);
@@ -674,11 +682,10 @@ const check = async (config: RepositoryConfig, options?: { readData?: boolean })
 
 	addCommonArgs(args, env);
 
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
 	await cleanupTemporaryKeys(config, env);
 
-	const stdout = res.text();
-	const stderr = res.stderr.toString();
+	const { stdout, stderr } = res;
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic check failed: ${stderr}`);
@@ -708,11 +715,10 @@ const repairIndex = async (config: RepositoryConfig) => {
 	const args = ["repair", "index", "--repo", repoUrl];
 	addCommonArgs(args, env);
 
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
 	await cleanupTemporaryKeys(config, env);
 
-	const stdout = res.text();
-	const stderr = res.stderr.toString();
+	const { stdout, stderr } = res;
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic repair index failed: ${stderr}`);
@@ -768,13 +774,12 @@ const copy = async (
 	logger.info(`Copying snapshots from ${sourceRepoUrl} to ${destRepoUrl}...`);
 	logger.debug(`Executing: restic ${args.join(" ")}`);
 
-	const res = await $`restic ${args}`.env(env).nothrow();
+	const res = await safeSpawn({ command: "restic", args, env });
 
 	await cleanupTemporaryKeys(sourceConfig, sourceEnv);
 	await cleanupTemporaryKeys(destConfig, destEnv);
 
-	const stdout = res.text();
-	const stderr = res.stderr.toString();
+	const { stdout, stderr } = res;
 
 	if (res.exitCode !== 0) {
 		logger.error(`Restic copy failed: ${stderr}`);
diff --git a/app/server/utils/spawn.ts b/app/server/utils/spawn.ts
index 6ef86cba..c2b9246b 100644
--- a/app/server/utils/spawn.ts
+++ b/app/server/utils/spawn.ts
@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 
-interface Params {
+export interface SafeSpawnParams {
 	command: string;
 	args: string[];
 	env?: NodeJS.ProcessEnv;
@@ -18,7 +18,7 @@ type SpawnResult = {
 	stderr: string;
 };
 
-export const safeSpawn = (params: Params) => {
+export const safeSpawn = (params: SafeSpawnParams) => {
 	const { command, args, env = {}, signal, ...callbacks } = params;
 
 	return new Promise<SpawnResult>((resolve) => {
diff --git a/app/test/helpers/auth.ts b/app/test/helpers/auth.ts
new file mode 100644
index 00000000..fba04ccf
--- /dev/null
+++ b/app/test/helpers/auth.ts
@@ -0,0 +1,24 @@
+import { authService } from "~/server/modules/auth/auth.service";
+import { db } from "~/server/db/db";
+import { usersTable, sessionsTable } from "~/server/db/schema";
+
+export async function createTestSession() {
+	const [existingUser] = await db.select().from(usersTable);
+
+	if (!existingUser) {
+		await authService.register("testadmin", "testpassword");
+	}
+
+	const [user] = await db.select().from(usersTable);
+
+	const sessionId = crypto.randomUUID();
+	const expiresAt = Date.now() + 1000 * 60 * 60 * 24; // 24 hours
+
+	await db.insert(sessionsTable).values({
+		id: sessionId,
+		userId: user.id,
+		expiresAt,
+	});
+
+	return { sessionId, user };
+}
diff --git a/app/test/helpers/backup.ts b/app/test/helpers/backup.ts
new file mode 100644
index 00000000..4e8be3fe
--- /dev/null
+++ b/app/test/helpers/backup.ts
@@ -0,0 +1,16 @@
+import { db } from "~/server/db/db";
+import { faker } from "@faker-js/faker";
+import { backupSchedulesTable, type BackupScheduleInsert } from "~/server/db/schema";
+
+export const createTestBackupSchedule = async (overrides: Partial<BackupScheduleInsert> = {}) => {
+	const backup: BackupScheduleInsert = {
+		name: faker.system.fileName(),
+		cronExpression: "0 0 * * *",
+		repositoryId: "repo_123",
+		volumeId: 1,
+		...overrides,
+	};
+
+	const data = await db.insert(backupSchedulesTable).values(backup).returning();
+	return data[0];
+};
diff --git a/app/test/helpers/repository.ts b/app/test/helpers/repository.ts
new file mode 100644
index 00000000..0a15c59e
--- /dev/null
+++ b/app/test/helpers/repository.ts
@@ -0,0 +1,20 @@
+import { db } from "~/server/db/db";
+import { faker } from "@faker-js/faker";
+import { repositoriesTable, type RepositoryInsert } from "~/server/db/schema";
+
+export const createTestRepository = async (overrides: Partial<RepositoryInsert> = {}) => {
+	const repository: RepositoryInsert = {
+		id: faker.string.alphanumeric(6),
+		name: faker.string.alphanumeric(10),
+		shortId: faker.string.alphanumeric(6),
+		config: {
+			name: "test-repo",
+			backend: "local",
+		},
+		type: "local",
+		...overrides,
+	};
+
+	const data = await db.insert(repositoriesTable).values(repository).returning();
+	return data[0];
+};
diff --git a/app/test/helpers/restic.ts b/app/test/helpers/restic.ts
new file mode 100644
index 00000000..b5732019
--- /dev/null
+++ b/app/test/helpers/restic.ts
@@ -0,0 +1,18 @@
+export const generateBackupOutput = () => {
+	return JSON.stringify({
+		message_type: "summary",
+		files_new: 10,
+		files_changed: 5,
+		files_unmodified: 85,
+		dirs_new: 2,
+		dirs_changed: 1,
+		dirs_unmodified: 17,
+		data_blobs: 20,
+		tree_blobs: 5,
+		data_added: 1048576,
+		total_files_processed: 100,
+		total_bytes_processed: 2097152,
+		total_duration: 12.34,
+		snapshot_id: "abcd1234",
+	});
+};
diff --git a/app/test/helpers/volume.ts b/app/test/helpers/volume.ts
new file mode 100644
index 00000000..0d63740d
--- /dev/null
+++ b/app/test/helpers/volume.ts
@@ -0,0 +1,21 @@
+import { db } from "~/server/db/db";
+import { faker } from "@faker-js/faker";
+import { volumesTable, type VolumeInsert } from "~/server/db/schema";
+
+export const createTestVolume = async (overrides: Partial<VolumeInsert> = {}) => {
+	const volume: VolumeInsert = {
+		name: faker.system.fileName(),
+		config: {
+			backend: "directory",
+			path: `/mnt/volumes/${faker.system.fileName()}`,
+		},
+		status: "mounted",
+		autoRemount: true,
+		shortId: faker.string.alphanumeric(6),
+		type: "directory",
+		...overrides,
+	};
+
+	const data = await db.insert(volumesTable).values(volume).returning();
+	return data[0];
+};
diff --git a/app/test/setup.ts b/app/test/setup.ts
new file mode 100644
index 00000000..8791d42c
--- /dev/null
+++ b/app/test/setup.ts
@@ -0,0 +1,19 @@
+import { beforeAll, mock } from "bun:test";
+import { migrate } from "drizzle-orm/bun-sqlite/migrator";
+import path from "node:path";
+import { cwd } from "node:process";
+import { db } from "~/server/db/db";
+
+mock.module("~/server/utils/logger", () => ({
+	logger: {
+		debug: () => {},
+		info: () => {},
+		warn: () => {},
+		error: () => {},
+	},
+}));
+
+beforeAll(async () => {
+	const migrationsFolder = path.join(cwd(), "app", "drizzle");
+	migrate(db, { migrationsFolder });
+});
diff --git a/bun.lock b/bun.lock
index b430f4dc..82e3a37c 100644
--- a/bun.lock
+++ b/bun.lock
@@ -58,6 +58,7 @@
       },
       "devDependencies": {
         "@biomejs/biome": "^2.3.8",
+        "@faker-js/faker": "^10.1.0",
         "@hey-api/openapi-ts": "^0.88.0",
         "@react-router/dev": "^7.10.0",
         "@tailwindcss/vite": "^4.1.17",
@@ -66,6 +67,7 @@
         "@types/node": "^24.10.1",
         "@types/react": "^19.2.7",
         "@types/react-dom": "^19.2.3",
+        "dotenv-cli": "^11.0.0",
         "drizzle-kit": "^0.31.7",
         "lightningcss": "^1.30.2",
         "tailwindcss": "^4.1.17",
@@ -230,6 +232,8 @@
 
     "@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.2", "", { "os": "win32", "cpu": "x64" }, "sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ=="],
 
+    "@faker-js/faker": ["@faker-js/faker@10.1.0", "", {}, "sha512-C3mrr3b5dRVlKPJdfrAXS8+dq+rq8Qm5SNRazca0JKgw1HQERFmrVb0towvMmw5uu8hHKNiQasMaR/tydf3Zsg=="],
+
     "@floating-ui/core": ["@floating-ui/core@1.7.3", "", { "dependencies": { "@floating-ui/utils": "^0.2.10" } }, "sha512-sGnvb5dmrJaKEZ+LDIpguvdX3bDlEllmv4/ClQ9awcmCZrlx5jQyyMWFM5kBI+EyNOCDDiKk8il0zeuX3Zlg/w=="],
 
     "@floating-ui/dom": ["@floating-ui/dom@1.7.4", "", { "dependencies": { "@floating-ui/core": "^1.7.3", "@floating-ui/utils": "^0.2.10" } }, "sha512-OOchDgh4F2CchOX94cRVqhvy7b3AFb+/rQXyswmzmGakRfkMgoWVjfnLWkRirfLEfuD4ysVW16eXzwt3jHIzKA=="],
@@ -400,11 +404,13 @@
 
     "@rollup/rollup-win32-x64-msvc": ["@rollup/rollup-win32-x64-msvc@4.53.5", "", { "os": "win32", "cpu": "x64" }, "sha512-JRpZUhCfhZ4keB5v0fe02gQJy05GqboPOaxvjugW04RLSYYoB/9t2lx2u/tMs/Na/1NXfY8QYjgRljRpN+MjTQ=="],
 
-    "@scalar/core": ["@scalar/core@0.3.26", "", { "dependencies": { "@scalar/types": "0.5.2" } }, "sha512-CTwhU0zteyhFvlGbiErUC/nt7o4VMraXC4E52x2Cz+s/rgGrmS00pTYtnjO3NVQXXqjScq8BqMTqBZrHQEJhWw=="],
+    "@scalar/core": ["@scalar/core@0.3.28", "", { "dependencies": { "@scalar/types": "0.5.4" } }, "sha512-Ka+g5P3Fe4f9lsJcBxfI+XAgwMYeZRgzIBWw1/HBrDoRmH3rV/N//410MBKEYXUw7pWpS+dZPJANZRvU5jtxhw=="],
 
-    "@scalar/hono-api-reference": ["@scalar/hono-api-reference@0.9.28", "", { "dependencies": { "@scalar/core": "0.3.26" }, "peerDependencies": { "hono": "^4.10.3" } }, "sha512-RVY55Rpcy9/irv0SMSxuSlQ6wDyuP+iTDmTz/d5tGv/qqo8vEOJMdDRNftMUqdtqiZUAE8fXJnuDCTJ80ZztAQ=="],
+    "@scalar/helpers": ["@scalar/helpers@0.2.4", "", {}, "sha512-G7oGybO2QXM+MIxa4OZLXaYsS9mxKygFgOcY4UOXO6xpVoY5+8rahdak9cPk7HNj8RZSt4m/BveoT8g5BtnXxg=="],
 
-    "@scalar/types": ["@scalar/types@0.5.2", "", { "dependencies": { "nanoid": "5.1.5", "type-fest": "5.0.0", "zod": "^4.1.11" } }, "sha512-F5wyb/B/Mu56PpNqhgSfuKwiwVnmhNhzTOo+k5b++HvYhjwAnqnw8BzbDzwXhhn172IPw8kSkupA/vphw61IRA=="],
+    "@scalar/hono-api-reference": ["@scalar/hono-api-reference@0.9.30", "", { "dependencies": { "@scalar/core": "0.3.28" }, "peerDependencies": { "hono": "^4.10.3" } }, "sha512-a9cPluqfi1bgX2p7PJl/2O4jgPcoAl/ecSAe74TbPYIi27A0O0bkUBscO7WNRJhWJ1GVVxX8NvJTNlDxUNBlpg=="],
+
+    "@scalar/types": ["@scalar/types@0.5.4", "", { "dependencies": { "@scalar/helpers": "0.2.4", "nanoid": "5.1.5", "type-fest": "5.0.0", "zod": "^4.1.11" } }, "sha512-5FNQH/zx3tnERzxfpErscPHfRxLCuhncmhFYiaSz196Xi2iG1YI08BtxTV2slfT6of52epJ/MrKerarplKf9eg=="],
 
     "@so-ric/colorspace": ["@so-ric/colorspace@1.1.6", "", { "dependencies": { "color": "^5.0.2", "text-hex": "1.0.x" } }, "sha512-/KiKkpHNOBgkFJwu9sh48LkHSMYGyuTcSFK/qMBdnOAlrRJzRSXAOFB5qwzaVQuDl8wAvHVMkaASQDReTahxuw=="],
 
@@ -454,7 +460,7 @@
 
     "@tanstack/react-query-devtools": ["@tanstack/react-query-devtools@5.91.1", "", { "dependencies": { "@tanstack/query-devtools": "5.91.1" }, "peerDependencies": { "@tanstack/react-query": "^5.90.10", "react": "^18 || ^19" } }, "sha512-tRnJYwEbH0kAOuToy8Ew7bJw1lX3AjkkgSlf/vzb+NpnqmHPdWM+lA2DSdGQSLi1SU0PDRrrCI1vnZnci96CsQ=="],
 
-    "@types/bun": ["@types/bun@1.3.4", "", { "dependencies": { "bun-types": "1.3.4" } }, "sha512-EEPTKXHP+zKGPkhRLv+HI0UEX8/o+65hqARxLy8Ov5rIxMBPNTjeZww00CIihrIQGEQBYg+0roO5qOnS/7boGA=="],
+    "@types/bun": ["@types/bun@1.3.5", "", { "dependencies": { "bun-types": "1.3.5" } }, "sha512-RnygCqNrd3srIPEWBd5LFeUYG7plCoH2Yw9WaZGyNmdTEei+gWaHqydbaIRkIkcbXwhBT94q78QljxN0Sk838w=="],
 
     "@types/d3-array": ["@types/d3-array@3.2.2", "", {}, "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw=="],
 
@@ -492,6 +498,8 @@
 
     "ansi-colors": ["ansi-colors@4.1.3", "", {}, "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw=="],
 
+    "anymatch": ["anymatch@3.1.3", "", { "dependencies": { "normalize-path": "^3.0.0", "picomatch": "^2.0.4" } }, "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw=="],
+
     "arg": ["arg@5.0.2", "", {}, "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg=="],
 
     "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="],
@@ -510,7 +518,7 @@
 
     "balanced-match": ["balanced-match@1.0.2", "", {}, "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="],
 
-    "baseline-browser-mapping": ["baseline-browser-mapping@2.9.9", "", { "bin": { "baseline-browser-mapping": "dist/cli.js" } }, "sha512-V8fbOCSeOFvlDj7LLChUcqbZrdKD9RU/VR260piF1790vT0mfLSwGc/Qzxv3IqiTukOpNtItePa0HBpMAj7MDg=="],
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.9.11", "", { "bin": { "baseline-browser-mapping": "dist/cli.js" } }, "sha512-Sg0xJUNDU1sJNGdfGWhVHX0kkZ+HWcvmVymJbj6NSgZZmW/8S9Y2HQ5euytnIgakgxN6papOAWiwDo1ctFDcoQ=="],
 
     "basic-auth": ["basic-auth@2.0.1", "", { "dependencies": { "safe-buffer": "5.1.2" } }, "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg=="],
 
@@ -522,7 +530,7 @@
 
     "buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
 
-    "bun-types": ["bun-types@1.3.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-5ua817+BZPZOlNaRgGBpZJOSAQ9RQ17pkwPD0yR7CfJg+r8DgIILByFifDTa+IPDDxzf5VNhtNlcKqFzDgJvlQ=="],
+    "bun-types": ["bun-types@1.3.5", "", { "dependencies": { "@types/node": "*" } }, "sha512-inmAYe2PFLs0SUbFOWSVD24sg1jFlMPxOjOSSCYqUgn4Hsc3rDc7dFvfVYjFPNHtov6kgUeulV4SxbuIV/stPw=="],
 
     "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
 
@@ -536,7 +544,7 @@
 
     "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001760", "", {}, "sha512-7AAMPcueWELt1p3mi13HR/LHH0TJLT11cnwDJEs3xA4+CK/PLKeO9Kl1oru24htkyUKtkGCvAx4ohB0Ttry8Dw=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001761", "", {}, "sha512-JF9ptu1vP2coz98+5051jZ4PwQgd2ni8A+gYSN7EA7dPKIMf0pDlSUxhdmVOaV3/fYK5uWBkgSXJaRLr4+3A6g=="],
 
     "chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="],
 
@@ -574,10 +582,16 @@
 
     "cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="],
 
+    "cookie-es": ["cookie-es@1.2.2", "", {}, "sha512-+W7VmiVINB+ywl1HGXJXmrqkOhpKrIiVZV6tQuV54ZyQC7MMuBt81Vc336GMLoHBq5hV/F9eXgt5Mnx0Rha5Fg=="],
+
     "cookie-signature": ["cookie-signature@1.0.7", "", {}, "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA=="],
 
     "cron-parser": ["cron-parser@5.4.0", "", { "dependencies": { "luxon": "^3.7.1" } }, "sha512-HxYB8vTvnQFx4dLsZpGRa0uHp6X3qIzS3ZJgJ9v6l/5TJMgeWQbLkR5yiJ5hOxGbc9+jCADDnydIe15ReLZnJA=="],
 
+    "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
+
+    "crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+
     "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="],
 
     "d3-array": ["d3-array@3.2.4", "", { "dependencies": { "internmap": "1 - 2" } }, "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg=="],
@@ -632,6 +646,10 @@
 
     "dotenv": ["dotenv@17.2.3", "", {}, "sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w=="],
 
+    "dotenv-cli": ["dotenv-cli@11.0.0", "", { "dependencies": { "cross-spawn": "^7.0.6", "dotenv": "^17.1.0", "dotenv-expand": "^12.0.0", "minimist": "^1.2.6" }, "bin": { "dotenv": "cli.js" } }, "sha512-r5pA8idbk7GFWuHEU7trSTflWcdBpQEK+Aw17UrSHjS6CReuhrrPcyC3zcQBPQvhArRHnBo/h6eLH1fkCvNlww=="],
+
+    "dotenv-expand": ["dotenv-expand@12.0.3", "", { "dependencies": { "dotenv": "^16.4.5" } }, "sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA=="],
+
     "drizzle-kit": ["drizzle-kit@0.31.8", "", { "dependencies": { "@drizzle-team/brocli": "^0.10.2", "@esbuild-kit/esm-loader": "^2.5.5", "esbuild": "^0.25.4", "esbuild-register": "^3.5.0" }, "bin": { "drizzle-kit": "bin.cjs" } }, "sha512-O9EC/miwdnRDY10qRxM8P3Pg8hXe3LyU4ZipReKOgTwn4OqANmftj8XJz1UPUAS6NMHf0E2htjsbQujUTkncCg=="],
 
     "drizzle-orm": ["drizzle-orm@0.44.7", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1.13", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@upstash/redis": ">=1.34.7", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@upstash/redis", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "sql.js", "sqlite3"] }, "sha512-quIpnYznjU9lHshEOAYLoZ9s3jweleHlZIAWR/jX9gAWNg/JhQ1wj0KGRf7/Zm+obRrYd9GjPVJg790QY9N5AQ=="],
@@ -712,6 +730,8 @@
 
     "graceful-fs": ["graceful-fs@4.2.11", "", {}, "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="],
 
+    "h3": ["h3@1.15.4", "", { "dependencies": { "cookie-es": "^1.2.2", "crossws": "^0.3.5", "defu": "^6.1.4", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.2", "radix3": "^1.1.2", "ufo": "^1.6.1", "uncrypto": "^0.1.3" } }, "sha512-z5cFQWDffyOe4vQ9xIqNfCZdV4p//vy6fBnr8Q1AWnVZ0teurKMG66rLj++TKwKPUP3u7iMUvrvKaEUiQw2QWQ=="],
+
     "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="],
 
     "hasown": ["hasown@2.0.2", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ=="],
@@ -720,7 +740,7 @@
 
     "hono-openapi": ["hono-openapi@1.1.2", "", { "peerDependencies": { "@hono/standard-validator": "^0.2.0", "@standard-community/standard-json": "^0.3.5", "@standard-community/standard-openapi": "^0.2.9", "@types/json-schema": "^7.0.15", "hono": "^4.8.3", "openapi-types": "^12.1.3" }, "optionalPeers": ["@hono/standard-validator", "hono"] }, "sha512-toUcO60MftRBxqcVyxsHNYs2m4vf4xkQaiARAucQx3TiBPDtMNNkoh+C4I1vAretQZiGyaLOZNWn1YxfSyUA5g=="],
 
-    "hono-rate-limiter": ["hono-rate-limiter@0.5.0", "", { "peerDependencies": { "hono": "^4.10.8", "unstorage": "^1.17.3" }, "optionalPeers": ["unstorage"] }, "sha512-Cps4udhDdPQ3O1Dm1fOzunI1iN1fW3TcVj1YvPdIjxHiHRitTsEz05q+BjgnLtcVDaDGbyuYyBaAxIy1DD1bMw=="],
+    "hono-rate-limiter": ["hono-rate-limiter@0.5.1", "", { "peerDependencies": { "hono": "^4.10.8", "unstorage": "^1.17.3" } }, "sha512-c3bUn6IRgFKjlouvRNBy+ZIPZ2CTyTt3fc0uat2bv3GiHmLM4jI0QJ6fHd3Tf4R6dO2sX2Uvl9Gtp+kny4KdXg=="],
 
     "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="],
 
@@ -736,6 +756,8 @@
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
 
+    "iron-webcrypto": ["iron-webcrypto@1.2.1", "", {}, "sha512-feOM6FaSr6rEABp/eDfVseKyTMDt+KGpeB35SkVn9Tyn0CqvVsY3EwI0v5i8nMHyJnzCIQf7nsy3p41TPkJZhg=="],
+
     "is-docker": ["is-docker@3.0.0", "", { "bin": { "is-docker": "cli.js" } }, "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ=="],
 
     "is-in-ssh": ["is-in-ssh@1.0.0", "", {}, "sha512-jYa6Q9rH90kR1vKB6NM7qqd1mge3Fx4Dhw5TVlK1MUBqhEOuCagrEHMevNuCcbECmXZ0ThXkRm+Ymr51HwEPAw=="],
@@ -748,6 +770,8 @@
 
     "isbot": ["isbot@5.1.32", "", {}, "sha512-VNfjM73zz2IBZmdShMfAUg10prm6t7HFUQmNAEOAVS4YH92ZrZcvkMcGX6cIgBJAzWDzPent/EeAtYEHNPNPBQ=="],
 
+    "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
+
     "jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
 
     "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
@@ -788,7 +812,7 @@
 
     "logform": ["logform@2.7.0", "", { "dependencies": { "@colors/colors": "1.6.0", "@types/triple-beam": "^1.3.2", "fecha": "^4.2.0", "ms": "^2.1.1", "safe-stable-stringify": "^2.3.1", "triple-beam": "^1.3.0" } }, "sha512-TFYA4jnP7PVbmlBIfhlSe+WKxs9dklXMTEGcBCIvLhE/Tn3H6Gk1norupVW7m5Cnd4bLcr08AytbyV/xj7f/kQ=="],
 
-    "lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
+    "lru-cache": ["lru-cache@10.4.3", "", {}, "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="],
 
     "lucide-react": ["lucide-react@0.555.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-D8FvHUGbxWBRQM90NZeIyhAvkFfsh3u9ekrMvJ30Z6gnpBHS6HC6ldLg7tL45hwiIz/u66eKDtdA23gwwGsAHA=="],
 
@@ -812,6 +836,8 @@
 
     "minimatch": ["minimatch@9.0.5", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow=="],
 
+    "minimist": ["minimist@1.2.8", "", {}, "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA=="],
+
     "morgan": ["morgan@1.10.1", "", { "dependencies": { "basic-auth": "~2.0.1", "debug": "2.6.9", "depd": "~2.0.0", "on-finished": "~2.3.0", "on-headers": "~1.1.0" } }, "sha512-223dMRJtI/l25dJKWpgij2cMtywuG/WiUKXdvwfbhGKBhy1puASqXwFzmWZ7+K73vUPoR7SS2Qz2cI/g9MKw0A=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
@@ -826,12 +852,18 @@
 
     "node-fetch-native": ["node-fetch-native@1.6.7", "", {}, "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q=="],
 
+    "node-mock-http": ["node-mock-http@1.0.4", "", {}, "sha512-8DY+kFsDkNXy1sJglUfuODx1/opAGJGyrTuFqEoN90oRc2Vk0ZbD4K2qmKXBBEhZQzdKHIVfEJpDU8Ak2NJEvQ=="],
+
     "node-releases": ["node-releases@2.0.27", "", {}, "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA=="],
 
+    "normalize-path": ["normalize-path@3.0.0", "", {}, "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA=="],
+
     "nypm": ["nypm@0.6.2", "", { "dependencies": { "citty": "^0.1.6", "consola": "^3.4.2", "pathe": "^2.0.3", "pkg-types": "^2.3.0", "tinyexec": "^1.0.1" }, "bin": { "nypm": "dist/cli.mjs" } }, "sha512-7eM+hpOtrKrBDCh7Ypu2lJ9Z7PNZBdi/8AT3AX8xoCj43BBVHD0hPSTEvMtkMpfs8FCqBGhxB+uToIQimA111g=="],
 
     "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="],
 
+    "ofetch": ["ofetch@1.5.1", "", { "dependencies": { "destr": "^2.0.5", "node-fetch-native": "^1.6.7", "ufo": "^1.6.1" } }, "sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA=="],
+
     "ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
 
     "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="],
@@ -848,6 +880,8 @@
 
     "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="],
 
+    "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
+
     "path-to-regexp": ["path-to-regexp@0.1.12", "", {}, "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ=="],
 
     "pathe": ["pathe@1.1.2", "", {}, "sha512-whLdWMYL2TwI08hn8/ZqAbrVemu0LNaNNJZX73O6qaIdCTfXutsLhMkjdENX0qhsQ9uIimo4/aQOmXkoon2nDQ=="],
@@ -872,6 +906,8 @@
 
     "quansync": ["quansync@0.2.11", "", {}, "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA=="],
 
+    "radix3": ["radix3@1.1.2", "", {}, "sha512-b484I/7b8rDEdSDKckSSBA8knMpcdsXudlE/LNL639wFoHKwLbEkQFZHWEYwDC0wa0FKUcCY+GAF73Z7wxNVFA=="],
+
     "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="],
 
     "raw-body": ["raw-body@2.5.3", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.4.24", "unpipe": "~1.0.0" } }, "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA=="],
@@ -936,6 +972,10 @@
 
     "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="],
 
+    "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
+
+    "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
+
     "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="],
 
     "side-channel-list": ["side-channel-list@1.0.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3" } }, "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA=="],
@@ -994,10 +1034,16 @@
 
     "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
 
+    "ufo": ["ufo@1.6.1", "", {}, "sha512-9a4/uxlTWJ4+a5i0ooc1rU7C7YOw3wT+UGqdeNNHWnOF9qcMBgLRS+4IYUqbczewFx4mLEig6gawh7X6mFlEkA=="],
+
+    "uncrypto": ["uncrypto@0.1.3", "", {}, "sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q=="],
+
     "undici-types": ["undici-types@7.16.0", "", {}, "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw=="],
 
     "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
 
+    "unstorage": ["unstorage@1.17.3", "", { "dependencies": { "anymatch": "^3.1.3", "chokidar": "^4.0.3", "destr": "^2.0.5", "h3": "^1.15.4", "lru-cache": "^10.4.3", "node-fetch-native": "^1.6.7", "ofetch": "^1.5.1", "ufo": "^1.6.1" }, "peerDependencies": { "@azure/app-configuration": "^1.8.0", "@azure/cosmos": "^4.2.0", "@azure/data-tables": "^13.3.0", "@azure/identity": "^4.6.0", "@azure/keyvault-secrets": "^4.9.0", "@azure/storage-blob": "^12.26.0", "@capacitor/preferences": "^6.0.3 || ^7.0.0", "@deno/kv": ">=0.9.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.34.3", "@vercel/blob": ">=0.27.1", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "db0": ">=0.2.1", "idb-keyval": "^6.2.1", "ioredis": "^5.4.2", "uploadthing": "^7.4.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "db0", "idb-keyval", "ioredis", "uploadthing"] }, "sha512-i+JYyy0DoKmQ3FximTHbGadmIYb8JEpq7lxUjnjeB702bCPum0vzo6oy5Mfu0lpqISw7hCyMW2yj4nWC8bqJ3Q=="],
+
     "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
 
     "use-callback-ref": ["use-callback-ref@1.3.3", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg=="],
@@ -1024,6 +1070,8 @@
 
     "vite-tsconfig-paths": ["vite-tsconfig-paths@5.1.4", "", { "dependencies": { "debug": "^4.1.1", "globrex": "^0.1.2", "tsconfck": "^3.0.3" }, "peerDependencies": { "vite": "*" }, "optionalPeers": ["vite"] }, "sha512-cYj0LRuLV2c2sMqhqhGpaO3LretdtMn/BVX4cPLanIZuwwrkVl+lK84E/miEXkCHWXuq65rhNN4rXsBcOB3S4w=="],
 
+    "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
+
     "winston": ["winston@3.19.0", "", { "dependencies": { "@colors/colors": "^1.6.0", "@dabh/diagnostics": "^2.0.8", "async": "^3.2.3", "is-stream": "^2.0.0", "logform": "^2.7.0", "one-time": "^1.0.0", "readable-stream": "^3.4.0", "safe-stable-stringify": "^2.3.1", "stack-trace": "0.0.x", "triple-beam": "^1.3.0", "winston-transport": "^4.9.0" } }, "sha512-LZNJgPzfKR+/J3cHkxcpHKpKKvGfDZVPS4hfJCc4cCG0CgYzvlD6yE/S3CIL/Yt91ak327YCpiF/0MyeZHEHKA=="],
 
     "winston-transport": ["winston-transport@4.9.0", "", { "dependencies": { "logform": "^2.7.0", "readable-stream": "^3.6.2", "triple-beam": "^1.3.0" } }, "sha512-8drMJ4rkgaPo1Me4zD/3WLfI/zPdA9o2IipKODunnGDcuqbHwjsbB79ylv04LCGGzU0xQ6vTznOMpQGaLhhm6A=="],
@@ -1040,6 +1088,8 @@
 
     "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
+    "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
+
     "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
     "@babel/helper-create-class-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
@@ -1082,6 +1132,8 @@
 
     "accepts/negotiator": ["negotiator@0.6.3", "", {}, "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg=="],
 
+    "anymatch/picomatch": ["picomatch@2.3.1", "", {}, "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA=="],
+
     "basic-auth/safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],
 
     "body-parser/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
@@ -1090,6 +1142,8 @@
 
     "compression/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
 
+    "dotenv-expand/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
+
     "express/cookie": ["cookie@0.7.2", "", {}, "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="],
 
     "express/debug": ["debug@2.6.9", "", { "dependencies": { "ms": "2.0.0" } }, "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA=="],
diff --git a/docker-compose.yml b/docker-compose.yml
index 3e59cfd8..4a0f2578 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -13,18 +13,13 @@ services:
     environment:
       - NODE_ENV=development
       - ZEROBYTE_CONFIG_IMPORT=true
-      # - SMB_PASSWORD=secret
     ports:
       - "4096:4096"
-    # secrets:
-    #   - smb-password
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - /var/lib/zerobyte:/var/lib/zerobyte
-
       - ./mydata:/mydata:ro
       - ./zerobyte.config.json:/app/zerobyte.config.json:ro
-
       - ./app:/app/app
       - ~/.config/rclone:/root/.config/rclone
 
@@ -71,7 +66,3 @@ services:
       - ./zerobyte.config.json:/app/zerobyte.config.json:ro
       - ./mydata:/mydata:ro
       - ~/.config/rclone:/root/.config/rclone
-
-# secrets:
-#   smb-password:
-#     file: ./smb-password.txt
diff --git a/examples/README.md b/examples/README.md
new file mode 100644
index 00000000..8d2e7657
--- /dev/null
+++ b/examples/README.md
@@ -0,0 +1,17 @@
+# Examples
+
+This folder contains runnable, copy/paste-friendly examples for running Zerobyte in different setups.
+
+## Table of contents
+
+### Basic usage
+
+- [Basic Docker Compose](basic-docker-compose/README.md) — standard deployment with remote mount support (includes `SYS_ADMIN` + `/dev/fuse`).
+- [Simplified Docker Compose (no remote mounts)](simplified-docker-compose/README.md) — reduced-privilege deployment (no `SYS_ADMIN`, no `/dev/fuse`).
+- [Bind-mount a local directory](directory-bind-mount/README.md) — back up a host folder by mounting it into the container.
+- [Mount an rclone config](rclone-config-mount/README.md) — use rclone-based repository backends by mounting your rclone config.
+- [Secret placeholders + Docker secrets](secrets-placeholders/README.md) — keep secrets out of the DB using `env://...` and `file://...` references.
+
+### Advanced setups
+
+- [Tailscale sidecar](tailscale-sidecar/README.md) — run Zerobyte behind a Tailscale sidecar using shared networking.
diff --git a/examples/basic-docker-compose/.env.example b/examples/basic-docker-compose/.env.example
new file mode 100644
index 00000000..50409532
--- /dev/null
+++ b/examples/basic-docker-compose/.env.example
@@ -0,0 +1,2 @@
+# Timezone used by the container
+TZ=UTC
diff --git a/examples/basic-docker-compose/README.md b/examples/basic-docker-compose/README.md
new file mode 100644
index 00000000..4b326066
--- /dev/null
+++ b/examples/basic-docker-compose/README.md
@@ -0,0 +1,25 @@
+# Basic Docker Compose
+
+Minimal "standard" deployment for Zerobyte.
+
+This setup enables remote mount backends (NFS/SMB/WebDAV) from inside the container by granting the required capability and FUSE device.
+
+## Prerequisites
+
+- Docker + Docker Compose
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d
+```
+
+## Access
+
+- UI/API: `http://<host>:4096`
+
+## Notes
+
+- This example uses `cap_add: SYS_ADMIN` and `/dev/fuse` to support mounting remote volumes.
+- Do not place `/var/lib/zerobyte` on a network share.
diff --git a/examples/basic-docker-compose/docker-compose.yml b/examples/basic-docker-compose/docker-compose.yml
new file mode 100644
index 00000000..0f34772a
--- /dev/null
+++ b/examples/basic-docker-compose/docker-compose.yml
@@ -0,0 +1,16 @@
+services:
+  zerobyte:
+    image: ghcr.io/nicotsx/zerobyte:latest
+    container_name: zerobyte
+    restart: unless-stopped
+    cap_add:
+      - SYS_ADMIN
+    devices:
+      - /dev/fuse:/dev/fuse
+    ports:
+      - "4096:4096"
+    environment:
+      - TZ=${TZ:-UTC}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/zerobyte:/var/lib/zerobyte
diff --git a/examples/directory-bind-mount/.env.example b/examples/directory-bind-mount/.env.example
new file mode 100644
index 00000000..03946fe6
--- /dev/null
+++ b/examples/directory-bind-mount/.env.example
@@ -0,0 +1,8 @@
+# Timezone used by the container
+TZ=UTC
+
+# Absolute path on the Docker host to back up.
+# Examples:
+# - /srv/data
+# - /mnt/storage/photos
+HOST_DATA_DIR=/path/to/your/directory
diff --git a/examples/directory-bind-mount/README.md b/examples/directory-bind-mount/README.md
new file mode 100644
index 00000000..51d500f7
--- /dev/null
+++ b/examples/directory-bind-mount/README.md
@@ -0,0 +1,34 @@
+# Bind-mount a local directory
+
+This example shows how to back up a host directory by bind-mounting it into the Zerobyte container.
+
+It uses the simplified setup (no remote mounts).
+
+## Prerequisites
+
+- Docker + Docker Compose
+
+## Setup
+
+1. Copy the env file:
+
+```bash
+cp .env.example .env
+```
+
+2. Edit `.env` and set `HOST_DATA_DIR` to the directory you want to back up.
+
+3. Start the stack:
+
+```bash
+docker compose up -d
+```
+
+## Use in Zerobyte
+
+- Create a new volume of type **Directory**
+- Select the mounted path shown in the compose file: `/mydata`
+
+## Access
+
+- UI/API: `http://<host>:4096`
diff --git a/examples/directory-bind-mount/docker-compose.yml b/examples/directory-bind-mount/docker-compose.yml
new file mode 100644
index 00000000..e050d4c1
--- /dev/null
+++ b/examples/directory-bind-mount/docker-compose.yml
@@ -0,0 +1,13 @@
+services:
+  zerobyte:
+    image: ghcr.io/nicotsx/zerobyte:latest
+    container_name: zerobyte
+    restart: unless-stopped
+    ports:
+      - "4096:4096"
+    environment:
+      - TZ=${TZ:-UTC}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/zerobyte:/var/lib/zerobyte
+      - ${HOST_DATA_DIR:?HOST_DATA_DIR must be set}:/mydata
diff --git a/examples/rclone-config-mount/.env.example b/examples/rclone-config-mount/.env.example
new file mode 100644
index 00000000..15bb93fa
--- /dev/null
+++ b/examples/rclone-config-mount/.env.example
@@ -0,0 +1,8 @@
+# Timezone used by the container
+TZ=UTC
+
+# Absolute path on the Docker host to your rclone config directory.
+# Common locations:
+# - Linux: /home/<user>/.config/rclone
+# - Linux (root): /root/.config/rclone
+RCLONE_CONFIG_DIR=/path/to/rclone/config
diff --git a/examples/rclone-config-mount/README.md b/examples/rclone-config-mount/README.md
new file mode 100644
index 00000000..e1c86790
--- /dev/null
+++ b/examples/rclone-config-mount/README.md
@@ -0,0 +1,41 @@
+# Mount an rclone config (for rclone repositories)
+
+This example shows how to make an existing rclone configuration available inside the Zerobyte container.
+
+Use this if you want to use **rclone** as a repository backend (Dropbox/Google Drive/OneDrive/etc.).
+
+## Prerequisites
+
+- Docker + Docker Compose
+- An existing rclone config directory on the Docker host
+
+If you don't have one yet:
+
+```bash
+rclone config
+```
+
+## Setup
+
+1. Copy the env file:
+
+```bash
+cp .env.example .env
+```
+
+2. Edit `.env` and set `RCLONE_CONFIG_DIR` to the absolute path of your host rclone config directory.
+
+3. Start the stack:
+
+```bash
+docker compose up -d
+```
+
+## Access
+
+- UI/API: `http://<host>:4096`
+
+## Notes
+
+- This setup does not require `SYS_ADMIN` or `/dev/fuse`.
+- The rclone config is mounted read-only into `/root/.config/rclone`.
diff --git a/examples/rclone-config-mount/docker-compose.yml b/examples/rclone-config-mount/docker-compose.yml
new file mode 100644
index 00000000..b1f167c2
--- /dev/null
+++ b/examples/rclone-config-mount/docker-compose.yml
@@ -0,0 +1,13 @@
+services:
+  zerobyte:
+    image: ghcr.io/nicotsx/zerobyte:latest
+    container_name: zerobyte
+    restart: unless-stopped
+    ports:
+      - "4096:4096"
+    environment:
+      - TZ=${TZ:-UTC}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/zerobyte:/var/lib/zerobyte
+      - ${RCLONE_CONFIG_DIR}:/root/.config/rclone:ro
diff --git a/examples/secrets-placeholders/.env.example b/examples/secrets-placeholders/.env.example
new file mode 100644
index 00000000..e1ed0423
--- /dev/null
+++ b/examples/secrets-placeholders/.env.example
@@ -0,0 +1,6 @@
+# Timezone used by the container
+TZ=UTC
+
+# Optional example secret injected via environment variable.
+# Use it in Zerobyte config fields as: env://ZEROBYTE_SMB_PASSWORD
+ZEROBYTE_SMB_PASSWORD=
diff --git a/examples/secrets-placeholders/.gitignore b/examples/secrets-placeholders/.gitignore
new file mode 100644
index 00000000..55d6353f
--- /dev/null
+++ b/examples/secrets-placeholders/.gitignore
@@ -0,0 +1,5 @@
+# Secret files - do not commit
+smb-password.txt
+*-password.txt
+*.secret
+*.key
diff --git a/examples/secrets-placeholders/README.md b/examples/secrets-placeholders/README.md
new file mode 100644
index 00000000..dac55772
--- /dev/null
+++ b/examples/secrets-placeholders/README.md
@@ -0,0 +1,61 @@
+# Secret placeholders (env:// and file://) + Docker secrets
+
+Zerobyte supports **secret placeholders** in many configuration fields (repositories, volumes, notifications).
+Instead of storing raw secrets in the database, you can store a reference that gets resolved at runtime.
+
+Supported formats:
+
+- `env://VAR_NAME` → reads `process.env.VAR_NAME`
+- `file://name` → reads `/run/secrets/name` (Docker Compose / Docker secrets)
+
+This example shows how to run Zerobyte with:
+
+- an environment variable you can reference via `env://...`
+- a Docker secret you can reference via `file://...`
+
+## Prerequisites
+
+- Docker + Docker Compose
+
+This example includes `SYS_ADMIN` and `/dev/fuse` because it’s intended for SMB volumes (remote mounts).
+
+## Setup
+
+1. Copy the env file:
+
+```bash
+cp .env.example .env
+```
+
+2. Create a Docker secret file.
+
+	⚠️ **Important**: never commit real credentials. This folder includes a `.gitignore` to help prevent accidentally committing secret files.
+
+```bash
+printf "your-smb-password" > smb-password.txt
+```
+
+3. Start Zerobyte:
+
+```bash
+docker compose up -d
+```
+
+## Using placeholders in Zerobyte
+
+You can now use the placeholders for example in these Zerobyte configuration fields:
+
+| UI section | Type | Field | Example value |
+| --- | --- | --- | --- |
+| Volumes → Create volume | SMB | Password | `file://smb_password` or `env://ZEROBYTE_SMB_PASSWORD` |
+| Volumes → Create volume | WebDAV | Password | `file://webdav_password` or `env://ZEROBYTE_WEBDAV_PASSWORD` |
+| Repositories → Create repository | S3 | Secret access key | `file://aws_secret_access_key` or `env://AWS_SECRET_ACCESS_KEY` |
+| Repositories → Create repository | SFTP | SSH Private key | `file://sftp_private_key` or `env://SFTP_PRIVATE_KEY` |
+| Notifications → Create notification | Telegram | Bot token | `file://telegram_bot_token` or `env://TELEGRAM_BOT_TOKEN` |
+
+Notes:
+
+- Placeholder names used in these examples are arbitrary; you can choose any valid name.
+- Placeholder names are case-sensitive.
+- With `file://...`, the secret name must be a single path segment (no `/` or `\\`).
+- You can still paste a raw secret, but placeholders can be considered safer and easier to rotate.
diff --git a/examples/secrets-placeholders/docker-compose.yml b/examples/secrets-placeholders/docker-compose.yml
new file mode 100644
index 00000000..96f3d86d
--- /dev/null
+++ b/examples/secrets-placeholders/docker-compose.yml
@@ -0,0 +1,26 @@
+services:
+  zerobyte:
+    image: ghcr.io/nicotsx/zerobyte:latest
+    container_name: zerobyte
+    restart: unless-stopped
+    # Required for mounting remote volumes (SMB/NFS/WebDAV) from inside the container
+    cap_add:
+      - SYS_ADMIN
+    devices:
+      - /dev/fuse:/dev/fuse
+    ports:
+      - "4096:4096"
+    environment:
+      - TZ=${TZ:-UTC}
+      # Example env-backed secret (refer to it in Zerobyte as env://ZEROBYTE_SMB_PASSWORD)
+      - ZEROBYTE_SMB_PASSWORD=${ZEROBYTE_SMB_PASSWORD:-}
+    secrets:
+      # Example file-backed secret (refer to it in Zerobyte as file://smb_password)
+      - smb_password
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/zerobyte:/var/lib/zerobyte
+
+secrets:
+  smb_password:
+    file: ./smb-password.txt
diff --git a/examples/simplified-docker-compose/.env.example b/examples/simplified-docker-compose/.env.example
new file mode 100644
index 00000000..50409532
--- /dev/null
+++ b/examples/simplified-docker-compose/.env.example
@@ -0,0 +1,2 @@
+# Timezone used by the container
+TZ=UTC
diff --git a/examples/simplified-docker-compose/README.md b/examples/simplified-docker-compose/README.md
new file mode 100644
index 00000000..0388af4c
--- /dev/null
+++ b/examples/simplified-docker-compose/README.md
@@ -0,0 +1,25 @@
+# Simplified Docker Compose (no remote mounts)
+
+A reduced-privilege setup for Zerobyte when you do **not** need to mount NFS/SMB/WebDAV from inside the container.
+
+## Prerequisites
+
+- Docker + Docker Compose
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d
+```
+
+## Access
+
+- UI/API: `http://<host>:4096`
+
+## Trade-offs
+
+- ✅ No `SYS_ADMIN`
+- ✅ No `/dev/fuse`
+- ✅ Still supports all repository backends (local, S3, GCS, Azure, rclone)
+- ❌ Cannot mount remote shares from inside Zerobyte
diff --git a/examples/simplified-docker-compose/docker-compose.yml b/examples/simplified-docker-compose/docker-compose.yml
new file mode 100644
index 00000000..69df9689
--- /dev/null
+++ b/examples/simplified-docker-compose/docker-compose.yml
@@ -0,0 +1,12 @@
+services:
+  zerobyte:
+    image: ghcr.io/nicotsx/zerobyte:latest
+    container_name: zerobyte
+    restart: unless-stopped
+    ports:
+      - "4096:4096"
+    environment:
+      - TZ=${TZ:-UTC}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/zerobyte:/var/lib/zerobyte
diff --git a/examples/tailscale-sidecar/.env.example b/examples/tailscale-sidecar/.env.example
new file mode 100644
index 00000000..5d831079
--- /dev/null
+++ b/examples/tailscale-sidecar/.env.example
@@ -0,0 +1,22 @@
+# --- Zerobyte ---
+TZ=UTC
+
+# --- Tailscale ---
+# Create an auth key in the Tailscale admin console.
+# Recommended: ephemeral + pre-approved (or tagged) key.
+TS_AUTHKEY=tskey-auth-xxxxxxxxxxxxxxxxxxxx
+
+# How this node should appear in your tailnet.
+TS_HOSTNAME=zerobyte
+
+# Kernel-mode (false) vs userspace-mode (true).
+# - false: requires /dev/net/tun on the host
+# - true: works on Docker Desktop / hosts without TUN, but you must also remove
+#   the /dev/net/tun device mapping from docker-compose.yml
+TS_USERSPACE=false
+
+# Optional extra args passed to `tailscale up`.
+# Examples:
+# TS_EXTRA_ARGS=--accept-dns=true
+# TS_EXTRA_ARGS=--advertise-tags=tag:backup --accept-routes
+TS_EXTRA_ARGS=
diff --git a/examples/tailscale-sidecar/README.md b/examples/tailscale-sidecar/README.md
new file mode 100644
index 00000000..2d128cb4
--- /dev/null
+++ b/examples/tailscale-sidecar/README.md
@@ -0,0 +1,93 @@
+# Zerobyte + Tailscale sidecar (Docker Compose)
+
+This example runs Zerobyte behind a Tailscale sidecar container so the Zerobyte web UI/API can be reached over your tailnet and Zerobyte can access other devices on your tailnet (based on the ACLs/tags you configure in Tailscale).
+
+It uses a common “sidecar networking” pattern:
+
+- The `tailscale` container brings up a Tailscale node
+- The `zerobyte` container shares the `tailscale` network namespace (`network_mode: service:tailscale`)
+
+## About Tailscale
+
+Tailscale is a mesh VPN built on WireGuard. It connects devices and containers into a private network (“tailnet”) without opening inbound ports on your router or exposing services directly to the public internet.
+
+In this example, Tailscale acts as a secure access layer in front of Zerobyte:
+
+- You reach Zerobyte using the node’s tailnet IP/DNS name.
+- Access can be restricted using Tailscale ACLs/tags.
+
+## Prerequisites
+
+- Docker + Docker Compose
+- A Tailscale account and an auth key
+
+This example supports two Tailscale modes:
+
+- **Kernel mode** (`TS_USERSPACE=false`, default):
+  - requires `/dev/net/tun` on the host
+  - requires `NET_ADMIN`
+  - may require `SYS_MODULE` on some hosts (kept commented out in the compose file)
+
+- **Userspace mode** (`TS_USERSPACE=true`):
+  - does **not** require `/dev/net/tun`
+  - works better on Docker Desktop / restricted hosts
+  - requires a small edit in the compose file (see Troubleshooting)
+
+## Setup
+
+1. Copy the env file and fill in your auth key:
+
+   ```bash
+   cp .env.example .env
+   ```
+
+2. Start the stack:
+
+   ```bash
+   docker compose up -d
+   ```
+
+3. In the Tailscale admin console, confirm the node is present (and approved if your policy requires it).
+
+## Access
+
+- Over Tailscale: `http://<tailscale-ip>:4096` or `http://<tailscale-name>:4096` (if MagicDNS is enabled)
+- Locally (optional): the example publishes `4096:4096` on the host
+
+If you want Zerobyte to be reachable only via Tailscale, remove the `ports:` section from the `tailscale` service in [docker-compose.yml](docker-compose.yml). Zerobyte will still be able to access the internet and other resources outside the tailnet, but UI will only be accessible over Tailscale with possibility to further restrict access to it with ACLs/tags.
+
+## Notes
+
+- `network_mode: service:tailscale` makes Zerobyte share the Tailscale container’s *entire* network namespace (interfaces + routing table).
+- Traffic to tailnet IPs (typically `100.x.y.z`) goes over `tailscale0` and is governed by Tailscale ACLs; traffic to your LAN/Internet may still go over the normal network interface depending on routes and host firewall.
+- If `--accept-routes` is used, the Tailscale container may add routes to your routing table that Zerobyte will also use and be able to access remote networks.
+- If `--accept-dns` is used, Zerobyte will also use Tailscale’s DNS servers.
+- Zerobyte still needs `SYS_ADMIN` and `/dev/fuse` if you intend to mount NFS/SMB/WebDAV volumes from inside the container.
+
+The example uses these environment variables (see [.env.example](.env.example)):
+
+- `TS_AUTHKEY` (required)
+- `TS_HOSTNAME` (optional)
+- `TS_EXTRA_ARGS` (optional; passed to `tailscale up`)
+- `TS_USERSPACE` (optional; set to `true` to use userspace mode)
+- `TZ` (optional)
+
+## Troubleshooting
+
+- If the `tailscale` container can’t start due to missing TUN support, ensure your host has `/dev/net/tun` available and that Docker is allowed to use it.
+- If your tailnet uses ACLs/tags, set `TS_EXTRA_ARGS` accordingly (for example `--advertise-tags=tag:backup`).
+- If the `tailscale` container fails due to Docker Desktop / missing TUN support: set `TS_USERSPACE=true` in your `.env`, remove the `/dev/net/tun:/dev/net/tun` device mapping in [docker-compose.yml](docker-compose.yml), and keep `SYS_MODULE` disabled (commented out).
+
+To confirm the tailnet address of the container:
+
+```bash
+docker exec zerobyte-tailscale tailscale status
+docker exec zerobyte-tailscale tailscale ip -4
+```
+
+To confirm received routes when `--accept-routes` is used in kernel mode:
+(Missing routes could be due to ACLs or because `--accept-routes` is not set or not supported in userspace mode)
+```bash
+docker exec zerobyte-tailscale ip route
+docker exec zerobyte-tailscale ip route show table 52
+```
\ No newline at end of file
diff --git a/examples/tailscale-sidecar/docker-compose.yml b/examples/tailscale-sidecar/docker-compose.yml
new file mode 100644
index 00000000..40f4cfd1
--- /dev/null
+++ b/examples/tailscale-sidecar/docker-compose.yml
@@ -0,0 +1,51 @@
+services:
+  tailscale:
+    image: tailscale/tailscale:stable
+    container_name: zerobyte-tailscale
+    hostname: ${TS_HOSTNAME:-zerobyte}
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      # Optional: Some hosts require this for kernel-mode Tailscale.
+      # If it causes issues (common on Docker Desktop), keep it commented out (disabled as shown here).
+      # - SYS_MODULE
+    # Kernel-mode Tailscale (TS_USERSPACE=false) requires /dev/net/tun.
+    # If you switch to userspace mode (TS_USERSPACE=true), you MUST remove this
+    # devices section (or at least this mapping), otherwise the container may
+    # fail to start or hit runtime errors on some hosts.
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      # Kernel-mode (false) vs userspace-mode (true).
+      - TS_USERSPACE=${TS_USERSPACE:-false}
+      # Optional flags passed to `tailscale up`.
+      # Examples:
+      # - --advertise-tags=tag:zerobyte
+      # - --accept-dns=true --accept-routes
+      - TS_EXTRA_ARGS=${TS_EXTRA_ARGS:-}
+    volumes:
+      - /var/lib/tailscale:/var/lib/tailscale
+    # If you only want access over Tailscale (not from the local network), remove this.
+    ports:
+      - "4096:4096"
+
+  zerobyte:
+    image: ghcr.io/nicotsx/zerobyte:latest
+    container_name: zerobyte
+    restart: unless-stopped
+    # Uncomment if you need to mount NFS/SMB/WebDAV volumes:
+    # cap_add:
+    #   - SYS_ADMIN
+    # devices:
+    #   - /dev/fuse:/dev/fuse
+    # Share the Tailscale network namespace (sidecar pattern)
+    network_mode: service:tailscale
+    depends_on:
+      - tailscale
+    environment:
+      - TZ=${TZ:-UTC}
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/lib/zerobyte:/var/lib/zerobyte
diff --git a/package.json b/package.json
index 2dc931fc..c6e73e60 100644
--- a/package.json
+++ b/package.json
@@ -14,7 +14,8 @@
 		"start:prod": "docker compose down && docker compose up --build zerobyte-prod",
 		"gen:api-client": "openapi-ts",
 		"gen:migrations": "drizzle-kit generate",
-		"studio": "drizzle-kit studio"
+		"studio": "drizzle-kit studio",
+		"test": "dotenv -e .env.test -- bun test --preload ./app/test/setup.ts"
 	},
 	"overrides": {
 		"esbuild": "^0.27.2"
@@ -73,6 +74,7 @@
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.3.8",
+		"@faker-js/faker": "^10.1.0",
 		"@hey-api/openapi-ts": "^0.88.0",
 		"@react-router/dev": "^7.10.0",
 		"@tailwindcss/vite": "^4.1.17",
@@ -81,6 +83,7 @@
 		"@types/node": "^24.10.1",
 		"@types/react": "^19.2.7",
 		"@types/react-dom": "^19.2.3",
+		"dotenv-cli": "^11.0.0",
 		"drizzle-kit": "^0.31.7",
 		"lightningcss": "^1.30.2",
 		"tailwindcss": "^4.1.17",