style(tests): apply formatter to Applications and Media tests

Slice 4b frontend half. Jellyfin-touching pages now select a Jellyfin service
instance instead of a machine.

- api/client.ts: Jellyfin-backed calls (counts/libraries/activity/users, media
  status/build/stop/force-stop, queryMedia) send jellyfin_service_id.
- hooks/useDashboard, useUsers, useMedia: selector param renamed to
  jellyfinServiceId.
- pages/Media + Applications: list jellyfin service instances and persist
  jellyfin_service_id in the URL.
- Dashboard (widgets) and Users (default instance) need no selector change.
- Update Applications + Media tests for the new hook/param.

Files/SSH transport keeps machine_id. Verification: frontend lint 0 errors,
build success, 70 tests; backend ruff clean, 222 tests.

.env.example

@@ -27,8 +27,9 @@ PROMETHEUS_ENABLED=true
 PROMETHEUS_FILE_SD_DIR=/app/backend/.cache/prometheus-file-sd
 ALERTMANAGER_URL=http://alertmanager:9093
 ALERTMANAGER_WEBHOOK_URL=
-GRAFANA_URL=http://grafana:3000
-PROMETHEUS_URL=http://prometheus:9090
+# Required: master key for encrypting service secrets (API keys/tokens) at rest.
+# Generate one with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+MANAGE_ENCRYPTION_KEY=replace-with-a-fernet-key
 BACKEND_CACHE_DIR=./backend-cache
 
 # Auth

CHANGELOG.md

@@ -0,0 +1,56 @@
+# Changelog
+
+All notable changes to Manage. Breaking changes are marked with **BREAKING**.
+
+## [Unreleased]
+
+### Added — Service registry
+
+- Runtime **service registry** persisted in the backend SQLite database. External
+  services (Grafana, Prometheus, Jellyfin, Nextcloud, SSH task runner) are now
+  configured in the app instead of via environment variables.
+- Services page (`/services`) to create, list, and delete service instances.
+- Service detail pages (`/services/:serviceType/:serviceId`) to edit name/enabled
+  state, rotate secrets, and view the widgets a service provides.
+- Service definitions live as Pydantic modules in `backend/.../integrations/`,
+  each declaring its config schema, secret fields, and widget kinds.
+- Multi-instance support: multiple Grafana/Jellyfin/etc. instances per type.
+- SSH task runner service records run history in a new `service_task_runs`
+  table, shown on the runner's service page.
+
+### Changed
+
+- Dashboard widgets are now **service-bound** (reference a service instance +
+  widget kind) or **built-in** (backups, static text). The "Add widget" flow is
+  pick-service → pick-widget-kind → configure.
+- Deleting a service cascade-deletes widgets that reference it.
+
+### Security
+
+- Service secrets (API keys, tokens, passphrases) are **encrypted at rest** with
+  Fernet.
+
+### **BREAKING**
+
+- **`MANAGE_ENCRYPTION_KEY` is now required** to start the backend. Generate one
+  with:
+
+  ```bash
+  python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+  ```
+
+- The `GRAFANA_URL` and `PROMETHEUS_URL` backend environment variables were
+  removed; Grafana/Prometheus URLs now live on service records configured in the
+  UI. Re-create them on the Services page after upgrading.
+- The legacy widget/addon-pages model (`/addons/:addonId`,
+  `/api/widgets/types`, `/api/widgets/sources`) was removed in favor of the
+  service registry.
+- Default dashboard widget seeding was removed; a fresh install starts with an
+  empty dashboard. Add widgets from the dashboard's edit dialog after
+  configuring services.
+
+### Notes / follow-ups
+
+- Machine-level Jellyfin/Jellyseerr app config still powers the Media/Users/Files
+  pages. Migrating those onto the service registry is a separate follow-up change
+  (see `openspec/changes/service-registry/design.md` §12.5).

README.md

@@ -89,6 +89,7 @@ export VITE_OIDC_REDIRECT_URI=https://manage.example.com/oidc/callback
 export VITE_OIDC_POST_LOGOUT_REDIRECT_URI=https://manage.example.com/
 export VITE_GRAFANA_URL=https://grafana.manage.example.com
 export VITE_PROMETHEUS_URL=https://prometheus.manage.example.com
+export MANAGE_ENCRYPTION_KEY=$(python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
 
 docker compose up --build
 ```
@@ -143,11 +144,13 @@ VITE_OIDC_SCOPE=openid profile email
 VITE_OIDC_REDIRECT_URI=https://manage.example.com/oidc/callback
 VITE_OIDC_POST_LOGOUT_REDIRECT_URI=https://manage.example.com/
 
-# Grafana / Prometheus URLs used by widget adapters and frontend deep-links
-GRAFANA_URL=http://grafana:3000
-PROMETHEUS_URL=http://prometheus:9090
+# Grafana / Prometheus public URLs for frontend deep-links (service adapters read URLs from service records)
 VITE_GRAFANA_URL=https://grafana.manage.example.com
 VITE_PROMETHEUS_URL=https://prometheus.manage.example.com
+
+# Required: master key encrypting service secrets (API keys/tokens) at rest.
+# Generate one with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+MANAGE_ENCRYPTION_KEY=replace-with-a-fernet-key
 ```
 
 ## Remote server requirements
@@ -181,4 +184,4 @@ cd frontend && npx tsc --noEmit && npm run build
 - Job templates are shell-quoted. Add new templates in `backend/src/media_library_viewer_api/jobs.py`.
 - Root-level Docker Compose files are provided for production (`docker-compose.yml`) and local development (`docker-compose.dev.yml`), and both rely on Compose interpolation rather than `env_file` entries.
 - The configurable dashboard stores widget instances in the backend SQLite settings database. New installs seed default Jellyfin activity and Backups widgets automatically.
-- Grafana and Prometheus widget adapters use `GRAFANA_URL` and `PROMETHEUS_URL` (backend) and `VITE_GRAFANA_URL` / `VITE_PROMETHEUS_URL` (frontend) for deep-links; no credentials are stored in widget config.
+- Grafana and Prometheus widget adapters resolve URLs from service records configured in the app; `VITE_GRAFANA_URL` / `VITE_PROMETHEUS_URL` are only used for frontend deep-links. No credentials are stored in widget config; service API keys are encrypted at rest with `MANAGE_ENCRYPTION_KEY`.

backend/pyproject.toml

@@ -15,6 +15,7 @@ dependencies = [
   "python-multipart>=0.0.9",
   "prometheus-client>=0.21",
   "python-json-logger>=2.0",
+  "cryptography>=42.0",
 ]
 
 [project.optional-dependencies]

backend/src/media_library_viewer_api/config.py

@@ -57,8 +57,6 @@ class Settings(BaseSettings):
     prometheus_file_sd_dir: str = "/app/backend/.cache/prometheus-file-sd"
     alertmanager_url: str = "http://alertmanager:9093"
     alertmanager_webhook_url: str = ""  # Optional receiver for alertmanager webhook notifications
-    grafana_url: str = "http://grafana:3000"
-    prometheus_url: str = "http://prometheus:9090"
 
     # Remote paths
     remote_media_root: str = ""

backend/src/media_library_viewer_api/dependencies.py

@@ -1,9 +1,12 @@
 """Dependency injection for FastAPI.
 
-Provides access to machine-specific Jellyfin/SSH clients via FastAPI's request
-context. The selected machine can be chosen with a ``machine_id`` query
-parameter; otherwise the backend falls back to the first enabled machine that
-matches the requested service.
+Provides access to service-specific Jellyfin/Jellyseerr clients and
+machine-specific SSH clients via FastAPI's request context.
+
+- Jellyfin/Jellyseerr are selected with a ``jellyfin_service_id`` query
+  parameter (resolved against the service registry); the backend falls back to
+  the first enabled ``jellyfin``/``jellyseerr`` service instance.
+- SSH/Files transport is selected with ``machine_id`` as before.
 """
 
 from __future__ import annotations
@@ -34,6 +37,41 @@ def _request_machine_id(request: Request | None) -> str | None:
     return machine_id or None
 
 
+def _request_jellyfin_service_id(request: Request | None) -> str | None:
+    if request is None:
+        return None
+    service_id = request.query_params.get("jellyfin_service_id")
+    return service_id or None
+
+
+def _service_record(store: SettingsStore, service_type: str, service_id: str | None) -> dict[str, Any] | None:
+    """Return a service row for a type, preferring the requested id.
+
+    The row carries an in-memory decrypted ``secrets`` dict. Returns None if no
+    enabled instance of the type exists.
+    """
+    from media_library_viewer_api.services.secrets import decrypt_secrets
+
+    row = None
+    if service_id:
+        candidate = store.get_service(service_id)
+        if candidate and candidate.get("service_type") == service_type and candidate.get("enabled", True):
+            row = candidate
+    if row is None:
+        instances = [s for s in store.list_services(service_type) if s.get("enabled", True)]
+        row = instances[0] if instances else None
+    if row is None:
+        return None
+    decrypted = {}
+    blob = row.get("secrets") or {}
+    if blob:
+        try:
+            decrypted = decrypt_secrets(blob)
+        except Exception:
+            logger.exception("Failed to decrypt service secrets service_id=%s", row.get("id"))
+    return {**row, "secrets": decrypted}
+
+
 @lru_cache(maxsize=32)
 def _jellyfin_client_for(cache_key: tuple[str, str, str]) -> JellyfinClient:
     machine_id, url, api_key = cache_key
@@ -135,37 +173,34 @@ def _resolve_machine(service: str, request: Request | None = None) -> dict[str,
 
 
 def get_jellyfin_client(request: Request = None) -> JellyfinClient:
-    """Return a Jellyfin client for the selected machine."""
+    """Return a Jellyfin client for the selected Jellyfin service instance."""
     store = get_settings_store()
-    machine_id = _request_machine_id(request)
-    machine = store.get_machine_config(machine_id) if machine_id else None
-    if machine is None:
-        resolved = _resolve_machine("jellyfin", request)
-        if resolved:
-            machine = store.get_machine_config(resolved["id"])
-    if machine and machine.get("jellyfin_url") and machine.get("jellyfin_api_key"):
-        cache_key = (machine["id"], machine["jellyfin_url"], machine.get("jellyfin_api_key") or "")
-        return _jellyfin_client_for(cache_key)
-
-    raise RuntimeError(
-        "No Jellyfin machine is configured. Add a machine with jellyfin_url and jellyfin_api_key in Settings."
-    )
+    service_id = _request_jellyfin_service_id(request)
+    service = _service_record(store, "jellyfin", service_id)
+    if service is None:
+        raise RuntimeError("No Jellyfin service is configured. Add a Jellyfin service on the Services page.")
+    base_url = str(service.get("config", {}).get("base_url") or "")
+    api_key = str(service.get("secrets", {}).get("api_key") or "")
+    if not base_url or not api_key:
+        raise RuntimeError("Jellyfin service is missing base_url or api_key. Edit it on the Services page.")
+    cache_key = (service["id"], base_url, api_key)
+    return _jellyfin_client_for(cache_key)
 
 
 def get_jellyseerr_client(request: Request = None) -> JellyseerrClient | None:
     """Return a cached Jellyseerr client when configured, otherwise None."""
     store = get_settings_store()
-    machine_id = _request_machine_id(request)
-    machine = store.get_machine_config(machine_id) if machine_id else None
-    if machine is None:
-        resolved = _resolve_machine("jellyseerr", request)
-        if resolved:
-            machine = store.get_machine_config(resolved["id"])
-    if machine and machine.get("jellyseerr_url") and machine.get("jellyseerr_api_key"):
-        return JellyseerrClient(machine["jellyseerr_url"], machine.get("jellyseerr_api_key") or "")
-
-    logger.info("Jellyseerr client not configured (no machine with jellyseerr_url and jellyseerr_api_key)")
-    return None
+    service_id = _request_jellyfin_service_id(request)
+    service = _service_record(store, "jellyseerr", service_id)
+    if service is None:
+        logger.info("Jellyseerr client not configured (no jellyseerr service)")
+        return None
+    base_url = str(service.get("config", {}).get("base_url") or "")
+    api_key = str(service.get("secrets", {}).get("api_key") or "")
+    if not base_url or not api_key:
+        logger.info("Jellyseerr service is missing base_url or api_key")
+        return None
+    return JellyseerrClient(base_url, api_key)
 
 
 def _ssh_client_from_machine_config(machine: dict[str, Any], store: SettingsStore | None = None) -> RemoteSSHClient:
@@ -253,16 +288,12 @@ def get_settings_store() -> SettingsStore:
 def get_user_id(request: Request = None) -> str:
     """Return the configured Jellyfin user ID or discover the first available one."""
     store = get_settings_store()
-    machine_id = _request_machine_id(request)
-    machine = store.get_machine_config(machine_id) if machine_id else None
-    if machine is None:
-        resolved = _resolve_machine("jellyfin", request)
-        if resolved:
-            machine = store.get_machine_config(resolved["id"])
-    if machine and machine.get("jellyfin_user_id"):
-        return str(machine["jellyfin_user_id"])
+    service_id = _request_jellyfin_service_id(request)
+    service = _service_record(store, "jellyfin", service_id)
+    if service and service.get("config", {}).get("user_id"):
+        return str(service["config"]["user_id"])
     client = get_jellyfin_client(request)
     users = client.users()
     if not users:
-        raise RuntimeError("No Jellyfin users found and no machine/user id configured")
+        raise RuntimeError("No Jellyfin users found and no user_id configured on the service")
     return users[0]["Id"]

backend/src/media_library_viewer_api/integrations/__init__.py

@@ -0,0 +1 @@
+"""Closed registry of service integrations."""

backend/src/media_library_viewer_api/integrations/base.py

@@ -0,0 +1,119 @@
+"""Base classes for service integrations.
+
+A *service definition* is a closed, compile-time description of an external service
+the app can talk to (Grafana, Jellyfin, …). Each definition declares:
+
+* its non-secret ``config_schema`` (derived from a Pydantic model),
+* the secret fields it accepts (API keys / tokens),
+* the widget kinds it can contribute to the dashboard (each with its own
+  Pydantic-derived config schema).
+
+Definitions live in :mod:`media_library_viewer_api.integrations` modules and are
+assembled into the closed :data:`~media_library_viewer_api.integrations.registry.SERVICE_DEFINITIONS`
+map. There is no runtime plugin loading.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+from pydantic import BaseModel
+
+
+class ServiceConfigBase(BaseModel):
+    """Base for per-service non-secret config models.
+
+    Subclass this in each integration module and declare the connection fields.
+    The JSON schema is derived via ``model_json_schema()`` and exposed to the UI.
+    """
+
+
+class WidgetConfigBase(BaseModel):
+    """Base for per-widget config models.
+
+    Subclass this for each widget kind a service provides. Widget configs never
+    hold secrets; credentials live on the parent service record.
+    """
+
+    model_config = {"extra": "forbid"}
+
+
+@dataclass(frozen=True)
+class SecretField:
+    """A secret field stored encrypted on the service record."""
+
+    key: str
+    label: str
+    required: bool = False
+    helper: str | None = None
+
+
+@dataclass(frozen=True)
+class WidgetKind:
+    """A widget kind contributed by a service definition."""
+
+    kind: str
+    name: str
+    description: str
+    config_schema: dict[str, Any]
+    default_config: dict[str, Any] = field(default_factory=dict)
+    refresh_interval_ms: int = 0
+    config_model: type[WidgetConfigBase] | None = None
+
+
+@dataclass(frozen=True)
+class ServiceDefinition:
+    """Closed description of an external service type."""
+
+    service_type: str
+    name: str
+    description: str
+    config_model: type[ServiceConfigBase]
+    secret_fields: list[SecretField]
+    widget_kinds: list[WidgetKind]
+
+    @property
+    def config_schema(self) -> dict[str, Any]:
+        """JSON schema for the service's non-secret config."""
+        return self.config_model.model_json_schema()
+
+    @property
+    def secret_keys(self) -> set[str]:
+        return {sf.key for sf in self.secret_fields}
+
+    def widget_kind(self, kind: str) -> WidgetKind | None:
+        for wk in self.widget_kinds:
+            if wk.kind == kind:
+                return wk
+        return None
+
+
+def widget_kind(
+    kind: str,
+    name: str,
+    description: str,
+    model_cls: type[WidgetConfigBase],
+    *,
+    default_config: dict[str, Any] | None = None,
+    refresh_interval_ms: int = 0,
+) -> WidgetKind:
+    """Build a :class:`WidgetKind` from a Pydantic widget-config model."""
+    schema = model_cls.model_json_schema()
+    # Strip Pydantic's title noise so the exposed schema stays clean.
+    schema.pop("title", None)
+    return WidgetKind(
+        kind=kind,
+        name=name,
+        description=description,
+        config_schema=schema,
+        default_config=dict(default_config or {}),
+        refresh_interval_ms=refresh_interval_ms,
+        config_model=model_cls,
+    )
+
+
+def validate_config(model_cls: type[BaseModel], config: dict[str, Any] | None) -> dict[str, Any]:
+    """Validate a config dict against a Pydantic model and return the cleaned dict."""
+    instance = model_cls.model_validate(config or {})
+    return instance.model_dump(exclude_none=True)

backend/src/media_library_viewer_api/integrations/grafana.py

@@ -0,0 +1,46 @@
+"""Grafana service definition."""
+
+from __future__ import annotations
+
+from media_library_viewer_api.integrations.base import (
+    SecretField,
+    ServiceConfigBase,
+    ServiceDefinition,
+    WidgetConfigBase,
+    widget_kind,
+)
+
+
+class GrafanaConfig(ServiceConfigBase):
+    """Non-secret Grafana connection config."""
+
+    base_url: str
+    timeout_seconds: int = 5
+
+
+class GrafanaLinkWidgetConfig(WidgetConfigBase):
+    """Deep-link to a Grafana dashboard or panel."""
+
+    dashboard_uid: str
+    panel_id: int | None = None
+
+
+DEFINITION = ServiceDefinition(
+    service_type="grafana",
+    name="Grafana",
+    description="Dashboards, metrics, and logs.",
+    config_model=GrafanaConfig,
+    secret_fields=[
+        SecretField(key="api_key", label="API key", helper="Service account token (optional)"),
+    ],
+    widget_kinds=[
+        widget_kind(
+            kind="link",
+            name="Dashboard link",
+            description="Deep-link to a Grafana dashboard or panel.",
+            model_cls=GrafanaLinkWidgetConfig,
+            default_config={"dashboard_uid": ""},
+            refresh_interval_ms=0,
+        ),
+    ],
+)

backend/src/media_library_viewer_api/integrations/jellyfin.py

@@ -0,0 +1,47 @@
+"""Jellyfin service definition."""
+
+from __future__ import annotations
+
+from media_library_viewer_api.integrations.base import (
+    SecretField,
+    ServiceConfigBase,
+    ServiceDefinition,
+    WidgetConfigBase,
+    widget_kind,
+)
+
+
+class JellyfinConfig(ServiceConfigBase):
+    """Non-secret Jellyfin connection config."""
+
+    base_url: str
+    user_id: str = ""
+    timeout_seconds: int = 10
+
+
+class JellyfinActivityWidgetConfig(WidgetConfigBase):
+    """Live Jellyfin session activity."""
+
+    # No user-overridable fields; the service record carries user_id.
+    pass
+
+
+DEFINITION = ServiceDefinition(
+    service_type="jellyfin",
+    name="Jellyfin",
+    description="Media server with live session activity.",
+    config_model=JellyfinConfig,
+    secret_fields=[
+        SecretField(key="api_key", label="API key", required=True),
+    ],
+    widget_kinds=[
+        widget_kind(
+            kind="activity",
+            name="Activity",
+            description="Live sessions and idle users.",
+            model_cls=JellyfinActivityWidgetConfig,
+            default_config={},
+            refresh_interval_ms=30_000,
+        ),
+    ],
+)

backend/src/media_library_viewer_api/integrations/jellyseerr.py

@@ -0,0 +1,32 @@
+"""Jellyseerr service definition.
+
+Jellyseerr is a companion to Jellyfin (request management). It is modeled as its
+own service type so multiple Jellyseerr instances are supported independently of
+Jellyfin. It provides no dashboard widgets today.
+"""
+
+from __future__ import annotations
+
+from media_library_viewer_api.integrations.base import (
+    SecretField,
+    ServiceConfigBase,
+    ServiceDefinition,
+)
+
+
+class JellyseerrConfig(ServiceConfigBase):
+    """Non-secret Jellyseerr connection config."""
+
+    base_url: str
+
+
+DEFINITION = ServiceDefinition(
+    service_type="jellyseerr",
+    name="Jellyseerr",
+    description="Request management companion to Jellyfin.",
+    config_model=JellyseerrConfig,
+    secret_fields=[
+        SecretField(key="api_key", label="API key", required=True),
+    ],
+    widget_kinds=[],
+)

backend/src/media_library_viewer_api/integrations/nextcloud.py

@@ -0,0 +1,32 @@
+"""Nextcloud service definition.
+
+Nextcloud is included as a proof-of-concept third-party service. It has no
+dashboard widgets yet; its service page holds connection config only.
+"""
+
+from __future__ import annotations
+
+from media_library_viewer_api.integrations.base import (
+    SecretField,
+    ServiceConfigBase,
+    ServiceDefinition,
+)
+
+
+class NextcloudConfig(ServiceConfigBase):
+    """Non-secret Nextcloud connection config."""
+
+    base_url: str
+    username: str = ""
+
+
+DEFINITION = ServiceDefinition(
+    service_type="nextcloud",
+    name="Nextcloud",
+    description="Self-hosted files and collaboration.",
+    config_model=NextcloudConfig,
+    secret_fields=[
+        SecretField(key="app_password", label="App password", required=True),
+    ],
+    widget_kinds=[],
+)

backend/src/media_library_viewer_api/integrations/prometheus.py

@@ -0,0 +1,45 @@
+"""Prometheus service definition."""
+
+from __future__ import annotations
+
+from media_library_viewer_api.integrations.base import (
+    SecretField,
+    ServiceConfigBase,
+    ServiceDefinition,
+    WidgetConfigBase,
+    widget_kind,
+)
+
+
+class PrometheusConfig(ServiceConfigBase):
+    """Non-secret Prometheus connection config."""
+
+    base_url: str
+    timeout_seconds: int = 10
+
+
+class PrometheusMetricWidgetConfig(WidgetConfigBase):
+    """A PromQL instant query rendered as a metric."""
+
+    promql: str
+
+
+DEFINITION = ServiceDefinition(
+    service_type="prometheus",
+    name="Prometheus",
+    description="Metrics storage and PromQL queries.",
+    config_model=PrometheusConfig,
+    secret_fields=[
+        SecretField(key="api_key", label="API key", helper="Optional bearer token"),
+    ],
+    widget_kinds=[
+        widget_kind(
+            kind="metric",
+            name="Metric",
+            description="Instant query result rendered as a metric.",
+            model_cls=PrometheusMetricWidgetConfig,
+            default_config={"promql": ""},
+            refresh_interval_ms=30_000,
+        ),
+    ],
+)

backend/src/media_library_viewer_api/integrations/registry.py

@@ -0,0 +1,50 @@
+"""Closed registry of service definitions.
+
+Adding a brand-new service still requires a backend deploy and a module here.
+There is no runtime plugin loading.
+"""
+
+from __future__ import annotations
+
+from media_library_viewer_api.integrations.base import ServiceDefinition, WidgetKind
+from media_library_viewer_api.integrations.grafana import DEFINITION as GRAFANA
+from media_library_viewer_api.integrations.jellyfin import DEFINITION as JELLYFIN
+from media_library_viewer_api.integrations.jellyseerr import DEFINITION as JELLYSEERR
+from media_library_viewer_api.integrations.nextcloud import DEFINITION as NEXTCLOUD
+from media_library_viewer_api.integrations.prometheus import DEFINITION as PROMETHEUS
+from media_library_viewer_api.integrations.ssh_tasks import DEFINITION as SSH_TASKS
+
+SERVICE_DEFINITIONS: dict[str, ServiceDefinition] = {
+    GRAFANA.service_type: GRAFANA,
+    PROMETHEUS.service_type: PROMETHEUS,
+    JELLYFIN.service_type: JELLYFIN,
+    JELLYSEERR.service_type: JELLYSEERR,
+    NEXTCLOUD.service_type: NEXTCLOUD,
+    SSH_TASKS.service_type: SSH_TASKS,
+}
+
+
+def list_service_types() -> list[str]:
+    """Return all registered service type names (sorted for stable output)."""
+    return sorted(SERVICE_DEFINITIONS)
+
+
+def get_service_definition(service_type: str) -> ServiceDefinition | None:
+    """Return the definition for a service type, or ``None`` if unknown."""
+    return SERVICE_DEFINITIONS.get(service_type)
+
+
+def get_widget_kind(service_type: str, widget_kind: str) -> WidgetKind | None:
+    """Return a widget kind declared by a service definition, or ``None``."""
+    definition = get_service_definition(service_type)
+    if definition is None:
+        return None
+    return definition.widget_kind(widget_kind)
+
+
+def require_service_definition(service_type: str) -> ServiceDefinition:
+    """Return the definition or raise ``ValueError`` for an unknown type."""
+    definition = get_service_definition(service_type)
+    if definition is None:
+        raise ValueError(f"Unknown service type: {service_type}")
+    return definition

backend/src/media_library_viewer_api/integrations/ssh_tasks.py

@@ -0,0 +1,60 @@
+"""SSH task runner service definition.
+
+An ``ssh_tasks`` instance is an SSH endpoint that can run reusable saved tasks.
+Tasks themselves stay in the global saved-task registry; the instance only owns
+transport (host/port/user/key). Every run is recorded in ``service_task_runs``
+and shown as history on the instance's service page.
+"""
+
+from __future__ import annotations
+
+from media_library_viewer_api.integrations.base import (
+    SecretField,
+    ServiceConfigBase,
+    ServiceDefinition,
+    WidgetConfigBase,
+    widget_kind,
+)
+
+
+class SshTasksConfig(ServiceConfigBase):
+    """Non-secret SSH task runner config.
+
+    The SSH key itself lives in the saved SSH-key registry and is referenced by
+    ``ssh_key_id``. An optional ``passphrase`` is stored as a secret.
+    """
+
+    host: str
+    port: int = 22
+    username: str = ""
+    ssh_key_id: str = ""
+    timeout_seconds: int = 30
+
+
+class SshTaskOutputWidgetConfig(WidgetConfigBase):
+    """Output of a saved task run on this instance."""
+
+    task_id: str
+    # service_id is implicit (the widget's service); allow overriding per-widget.
+    service_id: str | None = None
+
+
+DEFINITION = ServiceDefinition(
+    service_type="ssh_tasks",
+    name="SSH task runner",
+    description="Run reusable saved tasks over SSH and keep run history.",
+    config_model=SshTasksConfig,
+    secret_fields=[
+        SecretField(key="passphrase", label="Key passphrase", helper="Optional"),
+    ],
+    widget_kinds=[
+        widget_kind(
+            kind="task_output",
+            name="Task output",
+            description="Output of a saved task run.",
+            model_cls=SshTaskOutputWidgetConfig,
+            default_config={"task_id": ""},
+            refresh_interval_ms=0,
+        ),
+    ],
+)

backend/src/media_library_viewer_api/main.py

@@ -23,6 +23,7 @@ from media_library_viewer_api.observability import (
 )
 from media_library_viewer_api.routers import backups as backups_router
 from media_library_viewer_api.routers import dashboard, files, jobs, media, monitoring, tasks, users
+from media_library_viewer_api.routers import services as services_router
 from media_library_viewer_api.routers import widgets as widgets_router
 from media_library_viewer_api.routers.settings import router as settings_router
 
@@ -38,6 +39,9 @@ async def lifespan(app: FastAPI):
     settings = get_settings()
     configure_logging(settings.log_level, settings.log_format)
     validate_auth_settings(settings)
+    from media_library_viewer_api.services.secrets import validate_encryption_key
+
+    validate_encryption_key()
     logger.info("Backend startup complete: %s", describe_settings(settings))
     logger.info("Managed known_hosts will be populated lazily on first successful SSH connection")
     try:
@@ -143,6 +147,7 @@ app.include_router(tasks.router)
 app.include_router(settings_router)
 app.include_router(backups_router.router)
 app.include_router(widgets_router.router)
+app.include_router(services_router.router)
 
 
 @app.get("/api/health")

backend/src/media_library_viewer_api/models/services.py

@@ -0,0 +1,94 @@
+"""Pydantic models for the service registry API."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel, Field, field_validator
+
+
+def _validate_config_keys(config: dict[str, Any]) -> dict[str, Any]:
+    """Reject credential keys in non-secret service config.
+
+    Secrets are sent in the separate ``secrets`` mapping; the plain ``config``
+    object must never hold them.
+    """
+    forbidden = {
+        "password",
+        "token",
+        "secret",
+        "api_key",
+        "apikey",
+        "private_key",
+        "passphrase",
+        "credential",
+    }
+
+    def _check(value: Any) -> None:
+        if isinstance(value, dict):
+            for key, child in value.items():
+                if key.lower() in forbidden:
+                    raise ValueError(f"Credential key '{key}' is not allowed in service config")
+                _check(child)
+        elif isinstance(value, list):
+            for item in value:
+                _check(item)
+
+    _check(config)
+    return config
+
+
+class ServiceInstanceInput(BaseModel):
+    """Payload for creating or updating a service instance."""
+
+    id: str | None = None
+    service_type: str = Field(..., min_length=1)
+    name: str = Field(..., min_length=1)
+    config: dict[str, Any] = Field(default_factory=dict)
+    secrets: dict[str, str] = Field(default_factory=dict)
+    enabled: bool = True
+
+    @field_validator("config")
+    @classmethod
+    def reject_credential_keys(cls, value: dict[str, Any]) -> dict[str, Any]:
+        return _validate_config_keys(value or {})
+
+
+class ServiceInstance(BaseModel):
+    """Persisted service instance returned by the API (no plaintext secrets)."""
+
+    id: str
+    service_type: str
+    name: str
+    config: dict[str, Any]
+    secrets_set: dict[str, bool]
+    enabled: bool
+    created_at: int
+    updated_at: int
+
+
+class SecretFieldInfo(BaseModel):
+    key: str
+    label: str
+    required: bool = False
+    helper: str | None = None
+
+
+class WidgetKindInfo(BaseModel):
+    kind: str
+    name: str
+    description: str
+    config_schema: dict[str, Any]
+    default_config: dict[str, Any]
+    refresh_interval_ms: int
+
+
+class ServiceTypeInfo(BaseModel):
+    """Metadata about a registered service type."""
+
+    service_type: str
+    name: str
+    description: str
+    config_schema: dict[str, Any]
+    secret_fields: list[SecretFieldInfo]
+    widget_kinds: list[WidgetKindInfo]

backend/src/media_library_viewer_api/models/widgets.py

@@ -1,8 +1,18 @@
-"""Pydantic models for the dashboard widget system."""
+"""Pydantic models for the dashboard widget system.
+
+Widgets are either:
+* **service-bound** — reference a ``service_id`` and a ``widget_kind`` declared
+  by that service's definition (Grafana link, Prometheus metric, Jellyfin
+  activity, SSH task output); or
+* **built-in** — ``service_id`` is null and ``widget_kind`` is one of the
+  service-less kinds (backups, static).
+"""
+
+from __future__ import annotations
 
 from typing import Any
 
-from pydantic import BaseModel, Field, field_validator
+from pydantic import BaseModel, Field, field_validator, model_validator
 
 FORBIDDEN_CONFIG_KEYS = {
     "password",
@@ -47,8 +57,8 @@ def _validate_config_keys(config: dict[str, Any]) -> dict[str, Any]:
 class _WidgetInstanceBase(BaseModel):
     """Shared fields between input and output widget models."""
 
-    addon_id: str
-    widget_type: str
+    service_id: str | None = None
+    widget_kind: str = Field(..., min_length=1)
     title: str = Field(..., min_length=1)
     config: dict[str, Any] = Field(default_factory=dict)
     enabled: bool = True
@@ -59,6 +69,13 @@ class _WidgetInstanceBase(BaseModel):
     def reject_credential_keys(cls, value: dict[str, Any]) -> dict[str, Any]:
         return _validate_config_keys(value or {})
 
+    @model_validator(mode="after")
+    def _validate_kind(self) -> "_WidgetInstanceBase":
+        # The kind must be non-empty (Field enforces it); service_id may be None
+        # for built-ins. Deeper validation happens in the router against the
+        # service definition / built-in registry.
+        return self
+
 
 class WidgetInstanceInput(_WidgetInstanceBase):
     """Payload for creating or updating a widget instance."""
@@ -74,22 +91,21 @@ class WidgetInstance(_WidgetInstanceBase):
     updated_at: int
 
 
-class WidgetTypeInfo(BaseModel):
-    """Metadata about a built-in widget type."""
+class BuiltinWidgetKindInfo(BaseModel):
+    """Metadata about a built-in (service-less) widget kind."""
 
-    addon_id: str
-    widget_type: str
+    kind: str
     name: str
     description: str
-    source_type: str
     config_schema: dict[str, Any]
+    default_config: dict[str, Any]
+    refresh_interval_ms: int
 
 
 class WidgetDataResponse(BaseModel):
     """Response from the per-widget data endpoint."""
 
     widget_id: str
-    widget_type: str
     data: dict[str, Any] | None = None
     error: str | None = None
     fetched_at: int

backend/src/media_library_viewer_api/routers/services.py

@@ -0,0 +1,182 @@
+"""REST API for the service registry.
+
+Service instances hold non-secret config and encrypted secrets. Plaintext
+secrets are never returned; only the boolean ``secrets_set`` map is exposed.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from media_library_viewer_api.dependencies import get_settings_store
+from media_library_viewer_api.integrations.base import validate_config
+from media_library_viewer_api.integrations.registry import (
+    SERVICE_DEFINITIONS,
+    get_service_definition,
+    require_service_definition,
+)
+from media_library_viewer_api.models.services import (
+    SecretFieldInfo,
+    ServiceInstance,
+    ServiceInstanceInput,
+    ServiceTypeInfo,
+    WidgetKindInfo,
+)
+from media_library_viewer_api.services.settings_store import SettingsStore
+
+router = APIRouter(prefix="/api/services", tags=["services"])
+
+logger = logging.getLogger(__name__)
+
+
+def _to_type_info(service_type: str) -> ServiceTypeInfo:
+    definition = require_service_definition(service_type)
+    return ServiceTypeInfo(
+        service_type=definition.service_type,
+        name=definition.name,
+        description=definition.description,
+        config_schema=definition.config_schema,
+        secret_fields=[
+            SecretFieldInfo(
+                key=sf.key,
+                label=sf.label,
+                required=sf.required,
+                helper=sf.helper,
+            )
+            for sf in definition.secret_fields
+        ],
+        widget_kinds=[
+            WidgetKindInfo(
+                kind=wk.kind,
+                name=wk.name,
+                description=wk.description,
+                config_schema=wk.config_schema,
+                default_config=wk.default_config,
+                refresh_interval_ms=wk.refresh_interval_ms,
+            )
+            for wk in definition.widget_kinds
+        ],
+    )
+
+
+def _to_instance(row: dict[str, Any]) -> ServiceInstance:
+    """Build an API response model, surfacing only secret 'set' flags."""
+    definition = get_service_definition(row["service_type"])
+    known_secrets = definition.secret_keys if definition else set()
+    secrets_blob = row.get("secrets") or {}
+    secrets_set = {key: (key in secrets_blob and bool(secrets_blob[key])) for key in known_secrets}
+    return ServiceInstance(
+        id=row["id"],
+        service_type=row["service_type"],
+        name=row["name"],
+        config=row.get("config") or {},
+        secrets_set=secrets_set,
+        enabled=row["enabled"],
+        created_at=row["created_at"],
+        updated_at=row["updated_at"],
+    )
+
+
+def _validate_input(body: ServiceInstanceInput) -> None:
+    """Validate service_type, config, and secret keys against the definition."""
+    definition = get_service_definition(body.service_type)
+    if definition is None:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=f"Unknown service type: {body.service_type}",
+        )
+    try:
+        validate_config(definition.config_model, body.config)
+    except Exception as exc:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=f"Invalid service config: {exc}",
+        ) from exc
+    unknown_secrets = set(body.secrets) - definition.secret_keys
+    if unknown_secrets:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=f"Unknown secret fields for {body.service_type}: {sorted(unknown_secrets)}",
+        )
+
+
+@router.get("/types")
+def list_types() -> list[ServiceTypeInfo]:
+    """Return metadata for every registered service type."""
+    return [_to_type_info(service_type) for service_type in sorted(SERVICE_DEFINITIONS)]
+
+
+@router.get("/instances")
+def list_instances(
+    service_type: str | None = None,
+    store: SettingsStore = Depends(get_settings_store),
+) -> list[ServiceInstance]:
+    """Return all persisted service instances (no plaintext secrets)."""
+    rows = store.list_services(service_type)
+    return [_to_instance(row) for row in rows]
+
+
+@router.post("/instances", status_code=status.HTTP_201_CREATED)
+def create_instance(
+    body: ServiceInstanceInput,
+    store: SettingsStore = Depends(get_settings_store),
+) -> ServiceInstance:
+    """Create a new service instance."""
+    _validate_input(body)
+    row = store.upsert_service(
+        {
+            "id": body.id,
+            "service_type": body.service_type,
+            "name": body.name,
+            "config": body.config,
+            "enabled": body.enabled,
+        },
+        secret_values=body.secrets,
+    )
+    return _to_instance(row)
+
+
+@router.put("/instances/{service_id}")
+def update_instance(
+    service_id: str,
+    body: ServiceInstanceInput,
+    store: SettingsStore = Depends(get_settings_store),
+) -> ServiceInstance:
+    """Update an existing service instance."""
+    existing = store.get_service(service_id)
+    if not existing:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Service not found")
+    if body.id is not None and body.id != service_id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="ID in path does not match ID in body",
+        )
+    _validate_input(body)
+    row = store.upsert_service(
+        {
+            "id": service_id,
+            "service_type": body.service_type,
+            "name": body.name,
+            "config": body.config,
+            "enabled": body.enabled,
+        },
+        secret_values=body.secrets,
+        service_id=service_id,
+    )
+    return _to_instance(row)
+
+
+@router.delete("/instances/{service_id}")
+def delete_instance(
+    service_id: str,
+    store: SettingsStore = Depends(get_settings_store),
+) -> dict[str, str]:
+    """Delete a service instance (cascade-deletes widgets referencing it)."""
+    existing = store.get_service(service_id)
+    if not existing:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Service not found")
+    store.delete_service(service_id)
+    return {"status": "deleted"}

backend/src/media_library_viewer_api/routers/widgets.py

@@ -1,4 +1,11 @@
-"""REST API for dashboard widget instances and registry metadata."""
+"""REST API for dashboard widget instances.
+
+Widgets are either service-bound (``service_id`` + ``widget_kind`` from the
+service definition) or built-in (``service_id`` is null; ``widget_kind`` is one
+of the service-less kinds exposed by ``GET /api/widgets/builtin``).
+"""
+
+from __future__ import annotations
 
 import logging
 import time
@@ -7,68 +14,91 @@ from typing import Any
 from fastapi import APIRouter, Depends, HTTPException, status
 
 from media_library_viewer_api.dependencies import get_settings_store
+from media_library_viewer_api.integrations.base import validate_config
+from media_library_viewer_api.integrations.registry import get_service_definition
 from media_library_viewer_api.models.widgets import (
+    BuiltinWidgetKindInfo,
     WidgetDataResponse,
     WidgetInstance,
     WidgetInstanceInput,
 )
 from media_library_viewer_api.services.settings_store import SettingsStore
-from media_library_viewer_api.widgets.registry import (
-    get_widget_info,
-    list_source_types,
-    list_widget_types,
-    validate_config,
+from media_library_viewer_api.widgets.builtin import (
+    BUILTIN_WIDGET_KINDS,
+    is_builtin_kind,
+    validate_builtin_config,
+)
+from media_library_viewer_api.widgets.sources import (
+    build_service_record,
+    get_builtin_adapter,
+    get_service_adapter,
 )
-from media_library_viewer_api.widgets.sources import get_source_adapter
 
 router = APIRouter(prefix="/api/widgets", tags=["widgets"])
 
 logger = logging.getLogger(__name__)
 
 
-def _registry_for_type(widget_type: str) -> dict[str, Any]:
-    from media_library_viewer_api.widgets.registry import WIDGET_REGISTRY
+def _validate_widget_input(body: WidgetInstanceInput, store: SettingsStore) -> None:
+    """Validate widget_kind + config against the service definition or built-ins."""
+    if body.service_id:
+        service = store.get_service(body.service_id)
+        if not service:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+                detail=f"Service {body.service_id} not found",
+            )
+        definition = get_service_definition(service["service_type"])
+        if definition is None:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+                detail=f"Unknown service type: {service['service_type']}",
+            )
+        widget_kind = definition.widget_kind(body.widget_kind)
+        if widget_kind is None:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+                detail=(f"Service type '{service['service_type']}' does not provide widget kind '{body.widget_kind}'"),
+            )
+        if widget_kind.config_model is not None:
+            try:
+                validate_config(widget_kind.config_model, body.config)
+            except Exception as exc:
+                raise HTTPException(
+                    status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+                    detail=f"Invalid widget config: {exc}",
+                ) from exc
+    else:
+        if not is_builtin_kind(body.widget_kind):
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+                detail=(
+                    f"Unknown built-in widget kind '{body.widget_kind}' (set service_id for service-bound widgets)"
+                ),
+            )
+        try:
+            validate_builtin_config(body.widget_kind, body.config)
+        except Exception as exc:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+                detail=f"Invalid widget config: {exc}",
+            ) from exc
 
-    info = WIDGET_REGISTRY.get(widget_type)
-    if not info:
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-            detail=f"Unknown widget type: {widget_type}",
+
+@router.get("/builtin")
+def list_builtin_kinds() -> list[BuiltinWidgetKindInfo]:
+    """Return metadata for service-less built-in widget kinds."""
+    return [
+        BuiltinWidgetKindInfo(
+            kind=wk.kind,
+            name=wk.name,
+            description=wk.description,
+            config_schema=wk.config_schema,
+            default_config=wk.default_config,
+            refresh_interval_ms=wk.refresh_interval_ms,
         )
-    return info
-
-
-def _validate_widget_input(body: WidgetInstanceInput) -> None:
-    """Validate widget_type/addon_id match and config schema."""
-    info = _registry_for_type(body.widget_type)
-    expected_addon = info["addon_id"]
-    if body.addon_id != expected_addon:
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-            detail=(
-                f"Widget type '{body.widget_type}' belongs to addon "
-                f"'{expected_addon}', not '{body.addon_id}'"
-            ),
-        )
-    try:
-        validate_config(body.widget_type, body.config)
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
-            detail=str(exc),
-        ) from exc
-
-
-@router.get("/sources")
-def list_sources() -> list[str]:
-    """Return all registered widget source types."""
-    return list_source_types()
-
-
-@router.get("/types")
-def list_types() -> list[dict[str, Any]]:
-    """Return metadata for all registered widget types."""
-    return [info.model_dump() for info in list_widget_types()]
+        for wk in BUILTIN_WIDGET_KINDS.values()
+    ]
 
 
 @router.get("/instances")
@@ -85,7 +115,7 @@ def create_instance(
     store: SettingsStore = Depends(get_settings_store),
 ) -> dict[str, Any]:
     """Create a new widget instance."""
-    _validate_widget_input(body)
+    _validate_widget_input(body, store)
     widget = store.upsert_widget(body.model_dump())
     return WidgetInstance(**widget).model_dump()
 
@@ -105,7 +135,7 @@ def update_instance(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail="ID in path does not match ID in body",
         )
-    _validate_widget_input(body)
+    _validate_widget_input(body, store)
     widget = store.upsert_widget(body.model_dump(), widget_id)
     return WidgetInstance(**widget).model_dump()
 
@@ -133,31 +163,44 @@ async def fetch_data(
     if not widget:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Widget not found")
 
-    widget_type = widget["widget_type"]
-    info = get_widget_info(widget_type)
-    if info is None:
-        return WidgetDataResponse(
-            widget_id=widget_id,
-            widget_type=widget_type,
-            data=None,
-            error=f"Unknown widget type: {widget_type}",
-            fetched_at=int(time.time()),
-        ).model_dump()
+    service_id = widget.get("service_id")
+    widget_kind = widget.get("widget_kind") or ""
 
-    adapter = get_source_adapter(info.source_type)
-    if adapter is None:
-        # Defensive: registry should prevent this, but return a safe error.
-        return WidgetDataResponse(
-            widget_id=widget_id,
-            widget_type=widget_type,
-            data=None,
-            error=f"No adapter registered for source type: {info.source_type}",
-            fetched_at=int(time.time()),
-        ).model_dump()
+    service: Any = None
+    if service_id:
+        service_row = store.get_service(service_id)
+        if not service_row:
+            return WidgetDataResponse(
+                widget_id=widget_id,
+                error=f"Service {service_id} not found",
+                fetched_at=int(time.time()),
+            ).model_dump()
+        if not service_row.get("enabled", True):
+            return WidgetDataResponse(
+                widget_id=widget_id,
+                error="Service is disabled",
+                fetched_at=int(time.time()),
+            ).model_dump()
+        adapter = get_service_adapter(service_row["service_type"])
+        if adapter is None:
+            return WidgetDataResponse(
+                widget_id=widget_id,
+                error=f"No adapter for service type {service_row['service_type']}",
+                fetched_at=int(time.time()),
+            ).model_dump()
+        service = build_service_record(store, service_row)
+    else:
+        adapter = get_builtin_adapter(widget_kind)
+        if adapter is None:
+            return WidgetDataResponse(
+                widget_id=widget_id,
+                error=f"Unknown built-in widget kind: {widget_kind}",
+                fetched_at=int(time.time()),
+            ).model_dump()
 
     try:
-        data = await adapter.fetch(widget["config"])
-    except Exception as exc:
+        data = await adapter.fetch(service, widget_kind, widget.get("config") or {})
+    except Exception as exc:  # pragma: no cover - defensive
         logger.exception("Unhandled adapter exception widget_id=%s", widget_id)
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
@@ -166,7 +209,6 @@ async def fetch_data(
 
     return WidgetDataResponse(
         widget_id=widget_id,
-        widget_type=widget_type,
         data=data if "error" not in data else None,
         error=data.get("error"),
         fetched_at=int(time.time()),

backend/src/media_library_viewer_api/services/secrets.py

@@ -0,0 +1,93 @@
+"""Encryption-at-rest for service secrets.
+
+Service API keys / tokens are stored encrypted in the ``services.secrets_json``
+column. Encryption uses Fernet (symmetric authenticated encryption) with a single
+master key provided via the ``MANAGE_ENCRYPTION_KEY`` environment variable.
+
+* The key **must** be a urlsafe base64-encoded 32-byte value (Fernet format).
+* The key is **always required** — there is no development fallback, so secrets
+  are never accidentally stored in plaintext.
+* Secrets are encrypted field-by-field; the ``"which secrets are set"`` metadata
+  can be derived from the ciphertext blob without decrypting.
+"""
+
+from __future__ import annotations
+
+import os
+from functools import lru_cache
+
+from cryptography.fernet import Fernet, InvalidToken
+
+ENCRYPTION_KEY_ENV = "MANAGE_ENCRYPTION_KEY"
+
+
+class EncryptionKeyError(RuntimeError):
+    """Raised when the encryption key is missing or invalid."""
+
+
+@lru_cache(maxsize=1)
+def get_encryption_key() -> bytes:
+    """Return the raw Fernet key, or raise if missing/invalid.
+
+    The result is cached for the process lifetime. Tests should call
+    :func:`reset_encryption_key_cache` after changing the environment.
+    """
+    raw = os.environ.get(ENCRYPTION_KEY_ENV)
+    if not raw:
+        raise EncryptionKeyError(f"{ENCRYPTION_KEY_ENV} is required to store service secrets")
+    key = raw.strip().encode()
+    try:
+        Fernet(key)
+    except (ValueError, TypeError) as exc:  # pragma: no cover - validated by tests
+        raise EncryptionKeyError(f"{ENCRYPTION_KEY_ENV} must be a valid Fernet key") from exc
+    return key
+
+
+def reset_encryption_key_cache() -> None:
+    """Drop the cached encryption key (used by tests that swap keys)."""
+    get_encryption_key.cache_clear()
+
+
+def _fernet() -> Fernet:
+    return Fernet(get_encryption_key())
+
+
+def encrypt_value(plaintext: str) -> str:
+    """Encrypt a single secret value and return the ciphertext string."""
+    return _fernet().encrypt(plaintext.encode()).decode()
+
+
+def decrypt_value(ciphertext: str) -> str:
+    """Decrypt a single ciphertext value."""
+    try:
+        return _fernet().decrypt(ciphertext.encode()).decode()
+    except InvalidToken as exc:
+        raise EncryptionKeyError("Service secret could not be decrypted") from exc
+
+
+def encrypt_secrets(values: dict[str, str]) -> dict[str, str]:
+    """Encrypt every provided secret value."""
+    fernet = _fernet()
+    return {key: fernet.encrypt(value.encode()).decode() for key, value in values.items()}
+
+
+def decrypt_secrets(blob: dict[str, str]) -> dict[str, str]:
+    """Decrypt every secret value in a blob."""
+    fernet = _fernet()
+    result: dict[str, str] = {}
+    for key, ciphertext in blob.items():
+        try:
+            result[key] = fernet.decrypt(ciphertext.encode()).decode()
+        except InvalidToken as exc:
+            raise EncryptionKeyError(f"Service secret '{key}' could not be decrypted") from exc
+    return result
+
+
+def generate_development_key() -> str:
+    """Return a freshly generated Fernet key (helper for operators/docs)."""
+    return Fernet.generate_key().decode()
+
+
+def validate_encryption_key() -> None:
+    """Eagerly validate that the encryption key is present and well-formed."""
+    get_encryption_key()  # raises EncryptionKeyError on failure

backend/src/media_library_viewer_api/services/settings_store.py

@@ -179,9 +179,12 @@ class SettingsStore:
                 )
                 """
             )
-            conn.execute(
-                "CREATE INDEX IF NOT EXISTS idx_dashboard_widgets_sort ON dashboard_widgets(sort_order)"
-            )
+            conn.execute("CREATE INDEX IF NOT EXISTS idx_dashboard_widgets_sort ON dashboard_widgets(sort_order)")
+            widget_cols = {row[1] for row in conn.execute("PRAGMA table_info(dashboard_widgets)").fetchall()}
+            if "service_id" not in widget_cols:
+                conn.execute("ALTER TABLE dashboard_widgets ADD COLUMN service_id TEXT")
+            if "widget_kind" not in widget_cols:
+                conn.execute("ALTER TABLE dashboard_widgets ADD COLUMN widget_kind TEXT")
             conn.execute("""
                 CREATE TABLE IF NOT EXISTS backup_jobs (
                     id TEXT PRIMARY KEY,
@@ -226,6 +229,44 @@ class SettingsStore:
             """)
             conn.execute("CREATE INDEX IF NOT EXISTS idx_backup_alerts_job_id ON backup_alerts(job_id)")
             conn.execute("CREATE INDEX IF NOT EXISTS idx_backup_alerts_acknowledged ON backup_alerts(acknowledged)")
+            conn.execute(
+                """
+                CREATE TABLE IF NOT EXISTS services (
+                    id TEXT PRIMARY KEY,
+                    service_type TEXT NOT NULL,
+                    name TEXT NOT NULL,
+                    config_json TEXT NOT NULL DEFAULT '{}',
+                    secrets_json TEXT NOT NULL DEFAULT '{}',
+                    enabled INTEGER NOT NULL DEFAULT 1,
+                    created_at INTEGER NOT NULL,
+                    updated_at INTEGER NOT NULL
+                )
+                """
+            )
+            conn.execute("CREATE INDEX IF NOT EXISTS idx_services_type ON services(service_type)")
+            conn.execute(
+                """
+                CREATE TABLE IF NOT EXISTS service_task_runs (
+                    id TEXT PRIMARY KEY,
+                    task_id TEXT NOT NULL,
+                    service_id TEXT NOT NULL,
+                    status TEXT NOT NULL,
+                    exit_status INTEGER,
+                    duration_ms INTEGER,
+                    stdout_tail TEXT NOT NULL DEFAULT '',
+                    stderr_tail TEXT NOT NULL DEFAULT '',
+                    error TEXT NOT NULL DEFAULT '',
+                    created_at INTEGER NOT NULL
+                )
+                """
+            )
+            conn.execute(
+                "CREATE INDEX IF NOT EXISTS idx_service_task_runs_service "
+                "ON service_task_runs(service_id, created_at DESC)"
+            )
+            conn.execute(
+                "CREATE INDEX IF NOT EXISTS idx_service_task_runs_task ON service_task_runs(task_id, created_at DESC)"
+            )
 
     @staticmethod
     def _normalize_services(value: Any, fallback: list[str] | None = None) -> list[str]:
@@ -417,39 +458,13 @@ class SettingsStore:
             )
 
     def _seed_dashboard_widgets(self) -> None:
-        """Seed default dashboard widgets only when the table is empty."""
-        from media_library_viewer_api.widgets.registry import WIDGET_REGISTRY
+        """Default widget seeding was removed.
 
-        self.init_schema()
-        with self.connect() as conn:
-            row = conn.execute("SELECT COUNT(*) FROM dashboard_widgets").fetchone()
-            if row and int(row[0]) > 0:
-                return
-        defaults = [
-            {
-                "id": "jellyfin-activity-default",
-                "addon_id": "core",
-                "widget_type": "jellyfin",
-                "title": "Jellyfin activity",
-                "config": {"machine_id": ""},
-                "enabled": True,
-                "sort_order": 0,
-            },
-            {
-                "id": "backups-summary-default",
-                "addon_id": "backups",
-                "widget_type": "backups",
-                "title": "Backups",
-                "config": {},
-                "enabled": True,
-                "sort_order": 1,
-            },
-        ]
-        for widget in defaults:
-            info = WIDGET_REGISTRY.get(widget["widget_type"])
-            if not info or info["addon_id"] != widget["addon_id"]:
-                continue
-            self.upsert_widget(widget)
+        Widgets are now service-bound (or built-in). A fresh install starts with
+        no widgets; the user configures services and adds widgets from the UI.
+        Kept as a no-op so :meth:`ensure_defaults` callers are unchanged.
+        """
+        return None
 
     def ensure_defaults(self) -> None:
         self.init_schema()
@@ -457,7 +472,6 @@ class SettingsStore:
             row = conn.execute("SELECT COUNT(*) FROM monitoring_machines").fetchone()
             if not row or int(row[0]) == 0:
                 self._seed_local_machine()
-        self._seed_dashboard_widgets()
 
     def list_machines(self) -> list[dict[str, Any]]:
         self.init_schema()
@@ -1363,16 +1377,18 @@ class SettingsStore:
                 (key, value, now),
             )
 
-
     # ------------------------------------------------------------------
     # Dashboard widgets
     # ------------------------------------------------------------------
 
     def _row_to_widget(self, row: sqlite3.Row) -> dict[str, Any]:
+        keys = row.keys()
         return {
             "id": row["id"],
             "addon_id": row["addon_id"],
             "widget_type": row["widget_type"],
+            "service_id": row["service_id"] if "service_id" in keys else None,
+            "widget_kind": row["widget_kind"] if "widget_kind" in keys else None,
             "title": row["title"],
             "config": json.loads(row["config_json"] or "{}"),
             "enabled": bool(row["enabled"]),
@@ -1387,14 +1403,9 @@ class SettingsStore:
         widget_id: str | None = None,
     ) -> dict[str, Any]:
         current = self.get_widget(widget_id) if widget_id else None
-        widget_id = (
-            str(payload.get("id") or widget_id or uuid.uuid4().hex[:12]).strip()
-            or uuid.uuid4().hex[:12]
-        )
-        addon_id = str(payload.get("addon_id") or (current or {}).get("addon_id", "")).strip()
-        widget_type = str(
-            payload.get("widget_type") or (current or {}).get("widget_type", "")
-        ).strip()
+        widget_id = str(payload.get("id") or widget_id or uuid.uuid4().hex[:12]).strip() or uuid.uuid4().hex[:12]
+        service_id = str(payload.get("service_id") or (current or {}).get("service_id") or "").strip() or None
+        widget_kind = str(payload.get("widget_kind") or (current or {}).get("widget_kind", "")).strip()
         title = str(payload.get("title") or (current or {}).get("title", "") or "").strip()
         config = payload.get("config", (current or {}).get("config", {}))
         if not isinstance(config, dict):
@@ -1403,10 +1414,14 @@ class SettingsStore:
         _validate_config_keys(config)
         enabled = bool(payload.get("enabled", (current or {}).get("enabled", True)))
         sort_order = int(payload.get("sort_order", (current or {}).get("sort_order", 0)) or 0)
+        # Legacy label kept for diagnostics; new code uses service_id + widget_kind.
+        widget_type = f"{service_id}:{widget_kind}" if widget_kind else ""
         return {
             "id": widget_id,
-            "addon_id": addon_id,
+            "addon_id": "",
             "widget_type": widget_type,
+            "service_id": service_id,
+            "widget_kind": widget_kind,
             "title": title,
             "config": config,
             "enabled": enabled,
@@ -1416,9 +1431,7 @@ class SettingsStore:
     def list_widgets(self) -> list[dict[str, Any]]:
         self.init_schema()
         with self.connect() as conn:
-            rows = conn.execute(
-                "SELECT * FROM dashboard_widgets ORDER BY sort_order ASC, created_at ASC"
-            ).fetchall()
+            rows = conn.execute("SELECT * FROM dashboard_widgets ORDER BY sort_order ASC, created_at ASC").fetchall()
         return [self._row_to_widget(row) for row in rows]
 
     def get_widget(self, widget_id: str | None) -> dict[str, Any] | None:
@@ -1426,9 +1439,7 @@ class SettingsStore:
             return None
         self.init_schema()
         with self.connect() as conn:
-            row = conn.execute(
-                "SELECT * FROM dashboard_widgets WHERE id = ?", (widget_id,)
-            ).fetchone()
+            row = conn.execute("SELECT * FROM dashboard_widgets WHERE id = ?", (widget_id,)).fetchone()
         return self._row_to_widget(row) if row else None
 
     def upsert_widget(self, payload: dict[str, Any], widget_id: str | None = None) -> dict[str, Any]:
@@ -1444,13 +1455,15 @@ class SettingsStore:
             conn.execute(
                 """
                 INSERT INTO dashboard_widgets (
-                    id, addon_id, widget_type, title, config_json, enabled,
-                    sort_order, created_at, updated_at
+                    id, addon_id, widget_type, service_id, widget_kind, title,
+                    config_json, enabled, sort_order, created_at, updated_at
                 )
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
                 ON CONFLICT(id) DO UPDATE SET
                     addon_id = excluded.addon_id,
                     widget_type = excluded.widget_type,
+                    service_id = excluded.service_id,
+                    widget_kind = excluded.widget_kind,
                     title = excluded.title,
                     config_json = excluded.config_json,
                     enabled = excluded.enabled,
@@ -1461,6 +1474,8 @@ class SettingsStore:
                     widget["id"],
                     widget["addon_id"],
                     widget["widget_type"],
+                    widget["service_id"],
+                    widget["widget_kind"],
                     widget["title"],
                     json.dumps(widget["config"]),
                     1 if widget["enabled"] else 0,
@@ -1476,6 +1491,204 @@ class SettingsStore:
         with self.connect() as conn:
             conn.execute("DELETE FROM dashboard_widgets WHERE id = ?", (widget_id,))
 
+    # ------------------------------------------------------------------
+    # Service registry
+    # ------------------------------------------------------------------
+
+    def _row_to_service(self, row: sqlite3.Row) -> dict[str, Any]:
+        secrets_blob = json.loads(row["secrets_json"] or "{}")
+        return {
+            "id": row["id"],
+            "service_type": row["service_type"],
+            "name": row["name"],
+            "config": json.loads(row["config_json"] or "{}"),
+            "secrets": secrets_blob,
+            "enabled": bool(row["enabled"]),
+            "created_at": row["created_at"],
+            "updated_at": row["updated_at"],
+        }
+
+    def list_services(self, service_type: str | None = None) -> list[dict[str, Any]]:
+        self.init_schema()
+        with self.connect() as conn:
+            if service_type:
+                rows = conn.execute(
+                    "SELECT * FROM services WHERE service_type = ? ORDER BY name ASC",
+                    (service_type,),
+                ).fetchall()
+            else:
+                rows = conn.execute("SELECT * FROM services ORDER BY name ASC").fetchall()
+        return [self._row_to_service(row) for row in rows]
+
+    def get_service(self, service_id: str) -> dict[str, Any] | None:
+        self.init_schema()
+        with self.connect() as conn:
+            row = conn.execute("SELECT * FROM services WHERE id = ?", (service_id,)).fetchone()
+        return self._row_to_service(row) if row else None
+
+    def _normalize_service_payload(
+        self,
+        payload: dict[str, Any],
+        service_id: str | None = None,
+    ) -> dict[str, Any]:
+        current = self.get_service(service_id) if service_id else None
+        service_id = str(payload.get("id") or service_id or uuid.uuid4().hex[:12]).strip() or uuid.uuid4().hex[:12]
+        service_type = str(payload.get("service_type") or (current or {}).get("service_type", "")).strip()
+        name = str(payload.get("name") or (current or {}).get("name", "") or "").strip()
+        config = payload.get("config", (current or {}).get("config", {}))
+        if not isinstance(config, dict):
+            config = {}
+        enabled = bool(payload.get("enabled", (current or {}).get("enabled", True)))
+        return {
+            "id": service_id,
+            "service_type": service_type,
+            "name": name,
+            "config": config,
+            "enabled": enabled,
+        }
+
+    def upsert_service(
+        self,
+        payload: dict[str, Any],
+        secret_values: dict[str, str] | None = None,
+        service_id: str | None = None,
+    ) -> dict[str, Any]:
+        """Insert or update a service instance.
+
+        ``secret_values`` carries plaintext secrets to encrypt and store. A key
+        absent from ``secret_values`` preserves the existing ciphertext; a key
+        mapped to an empty string clears it.
+        """
+        self.init_schema()
+        service = self._normalize_service_payload(payload, service_id)
+        now = int(time.time())
+
+        existing = self.get_service(service["id"])
+        secrets_blob: dict[str, str]
+        if existing is not None:
+            secrets_blob = dict(existing["secrets"])
+        else:
+            secrets_blob = {}
+        if secret_values:
+            from media_library_viewer_api.services.secrets import encrypt_value
+
+            for key, value in secret_values.items():
+                if value == "":
+                    secrets_blob.pop(key, None)
+                else:
+                    secrets_blob[key] = encrypt_value(value)
+
+        with self.connect() as conn:
+            created_at = int(existing["created_at"]) if existing else now
+            conn.execute(
+                """
+                INSERT INTO services (
+                    id, service_type, name, config_json, secrets_json,
+                    enabled, created_at, updated_at
+                )
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+                ON CONFLICT(id) DO UPDATE SET
+                    service_type = excluded.service_type,
+                    name = excluded.name,
+                    config_json = excluded.config_json,
+                    secrets_json = excluded.secrets_json,
+                    enabled = excluded.enabled,
+                    updated_at = excluded.updated_at
+                """,
+                (
+                    service["id"],
+                    service["service_type"],
+                    service["name"],
+                    json.dumps(service["config"]),
+                    json.dumps(secrets_blob),
+                    1 if service["enabled"] else 0,
+                    created_at,
+                    now,
+                ),
+            )
+        return self.get_service(service["id"]) or service
+
+    def delete_service(self, service_id: str) -> None:
+        """Delete a service and cascade-delete widgets referencing it."""
+        self.init_schema()
+        with self.connect() as conn:
+            # The service_id column on dashboard_widgets is added in a later
+            # slice; only cascade when it is present.
+            widget_cols = {row[1] for row in conn.execute("PRAGMA table_info(dashboard_widgets)").fetchall()}
+            if "service_id" in widget_cols:
+                conn.execute(
+                    "DELETE FROM dashboard_widgets WHERE service_id = ?",
+                    (service_id,),
+                )
+            conn.execute("DELETE FROM services WHERE id = ?", (service_id,))
+
+    def record_service_task_run(self, payload: dict[str, Any]) -> dict[str, Any]:
+        """Append a service task run history row."""
+        self.init_schema()
+        run_id = str(payload.get("id") or uuid.uuid4().hex[:12])
+        now = int(time.time())
+        with self.connect() as conn:
+            conn.execute(
+                """
+                INSERT INTO service_task_runs (
+                    id, task_id, service_id, status, exit_status, duration_ms,
+                    stdout_tail, stderr_tail, error, created_at
+                )
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    run_id,
+                    str(payload.get("task_id") or ""),
+                    str(payload.get("service_id") or ""),
+                    str(payload.get("status") or "error"),
+                    payload.get("exit_status"),
+                    payload.get("duration_ms"),
+                    str(payload.get("stdout_tail") or "")[:8000],
+                    str(payload.get("stderr_tail") or "")[:8000],
+                    str(payload.get("error") or "")[:1000],
+                    int(payload.get("created_at") or now),
+                ),
+            )
+        return {"id": run_id}
+
+    def list_service_task_runs(
+        self,
+        service_id: str | None = None,
+        task_id: str | None = None,
+        limit: int = 50,
+    ) -> list[dict[str, Any]]:
+        self.init_schema()
+        clauses: list[str] = []
+        params: list[Any] = []
+        if service_id:
+            clauses.append("service_id = ?")
+            params.append(service_id)
+        if task_id:
+            clauses.append("task_id = ?")
+            params.append(task_id)
+        where = ("WHERE " + " AND ".join(clauses)) if clauses else ""
+        params.append(int(limit))
+        with self.connect() as conn:
+            rows = conn.execute(
+                f"SELECT * FROM service_task_runs {where} ORDER BY created_at DESC LIMIT ?",
+                params,
+            ).fetchall()
+        return [
+            {
+                "id": row["id"],
+                "task_id": row["task_id"],
+                "service_id": row["service_id"],
+                "status": row["status"],
+                "exit_status": row["exit_status"],
+                "duration_ms": row["duration_ms"],
+                "stdout_tail": row["stdout_tail"],
+                "stderr_tail": row["stderr_tail"],
+                "error": row["error"],
+                "created_at": row["created_at"],
+            }
+            for row in rows
+        ]
+
 
 _store: SettingsStore | None = None
 

backend/src/media_library_viewer_api/widgets/builtin.py

@@ -0,0 +1,68 @@
+"""Built-in, service-less widget kinds.
+
+These widgets do not talk to an external service and therefore have no
+``service_id``. They are kept out of the service registry (which models
+configurable external services) and live here as a small closed set.
+
+Currently: ``backups`` (reads the internal backup tables) and ``static``
+(plain text/markdown).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from media_library_viewer_api.integrations.base import WidgetKind
+
+BUILTIN_WIDGET_KINDS: dict[str, WidgetKind] = {
+    "backups": WidgetKind(
+        kind="backups",
+        name="Backups",
+        description="Backup job summary and active alerts.",
+        config_schema={"type": "object", "properties": {}, "required": []},
+        default_config={},
+        refresh_interval_ms=60_000,
+    ),
+    "static": WidgetKind(
+        kind="static",
+        name="Static text",
+        description="Plain text or markdown note.",
+        config_schema={
+            "type": "object",
+            "properties": {"text": {"type": "string", "description": "Text or markdown content"}},
+            "required": ["text"],
+        },
+        default_config={"text": ""},
+        refresh_interval_ms=0,
+    ),
+}
+
+
+def get_builtin_widget_kind(kind: str) -> WidgetKind | None:
+    return BUILTIN_WIDGET_KINDS.get(kind)
+
+
+def is_builtin_kind(kind: str) -> bool:
+    return kind in BUILTIN_WIDGET_KINDS
+
+
+def builtin_widget_kind_models() -> dict[str, type]:
+    """Pydantic widget-config models for built-in kinds (validated manually).
+
+    Backups has no user fields; static validates ``text``.
+    """
+    from pydantic import BaseModel, Field
+
+    class StaticConfig(BaseModel):
+        text: str = Field(default="")
+
+    return {"static": StaticConfig}
+
+
+def validate_builtin_config(kind: str, config: dict[str, Any]) -> dict[str, Any]:
+    """Validate (lightly) a built-in widget config and return the cleaned dict."""
+    models = builtin_widget_kind_models()
+    model_cls = models.get(kind)
+    if model_cls is None:
+        return dict(config or {})
+    return model_cls.model_validate(config or {}).model_dump(exclude_none=True)

backend/src/media_library_viewer_api/widgets/registry.py

@@ -1,187 +0,0 @@
-"""Closed, compile-time widget registry.
-
-New widget types and source adapters require a code change in Phase 1.
-There is no runtime plugin loading.
-"""
-
-from typing import Any
-
-from media_library_viewer_api.models.widgets import WidgetTypeInfo
-
-WIDGET_REGISTRY: dict[str, dict[str, Any]] = {
-    "jellyfin": {
-        "addon_id": "core",
-        "name": "Jellyfin activity",
-        "description": "Live sessions and idle users from a Jellyfin server.",
-        "source_type": "jellyfin",
-        "config_schema": {
-            "type": "object",
-            "properties": {
-                "machine_id": {
-                    "type": "string",
-                    "description": "Jellyfin machine id (empty = default)",
-                },
-            },
-            "required": ["machine_id"],
-        },
-    },
-    "backups": {
-        "addon_id": "backups",
-        "name": "Backups",
-        "description": "Backup job summary and active alerts.",
-        "source_type": "backups",
-        "config_schema": {
-            "type": "object",
-            "properties": {},
-            "required": [],
-        },
-    },
-    "grafana-link": {
-        "addon_id": "grafana",
-        "name": "Grafana link",
-        "description": "Deep-link to a Grafana dashboard or panel.",
-        "source_type": "grafana",
-        "config_schema": {
-            "type": "object",
-            "properties": {
-                "dashboard_uid": {
-                    "type": "string",
-                    "description": "Grafana dashboard UID",
-                },
-                "panel_id": {
-                    "type": "integer",
-                    "description": "Optional panel id",
-                },
-            },
-            "required": ["dashboard_uid"],
-        },
-    },
-    "prometheus-metric": {
-        "addon_id": "prometheus",
-        "name": "Prometheus metric",
-        "description": "Instant query result rendered as a metric.",
-        "source_type": "prometheus",
-        "config_schema": {
-            "type": "object",
-            "properties": {
-                "promql": {
-                    "type": "string",
-                    "description": "PromQL instant query",
-                },
-            },
-            "required": ["promql"],
-        },
-    },
-    "ssh-task": {
-        "addon_id": "ssh-tasks",
-        "name": "SSH task output",
-        "description": "Output of a saved task run on a machine.",
-        "source_type": "ssh_task",
-        "config_schema": {
-            "type": "object",
-            "properties": {
-                "task_id": {
-                    "type": "string",
-                    "description": "Saved task id",
-                },
-            },
-            "required": ["task_id"],
-        },
-    },
-    "static": {
-        "addon_id": "core",
-        "name": "Static text",
-        "description": "Plain text or markdown note.",
-        "source_type": "static",
-        "config_schema": {
-            "type": "object",
-            "properties": {
-                "text": {
-                    "type": "string",
-                    "description": "Text or markdown content",
-                },
-            },
-            "required": ["text"],
-        },
-    },
-}
-
-
-def list_source_types() -> list[str]:
-    """Return all registered source type names."""
-    return sorted({info["source_type"] for info in WIDGET_REGISTRY.values()})
-
-
-def list_widget_types() -> list[WidgetTypeInfo]:
-    """Return metadata for all registered widget types."""
-    return [
-        WidgetTypeInfo(
-            addon_id=info["addon_id"],
-            widget_type=widget_type,
-            name=info["name"],
-            description=info["description"],
-            source_type=info["source_type"],
-            config_schema=info["config_schema"],
-        )
-        for widget_type, info in WIDGET_REGISTRY.items()
-    ]
-
-
-def get_widget_info(widget_type: str) -> WidgetTypeInfo | None:
-    """Return metadata for a single widget type, or None if unknown."""
-    info = WIDGET_REGISTRY.get(widget_type)
-    if not info:
-        return None
-    return WidgetTypeInfo(
-        addon_id=info["addon_id"],
-        widget_type=widget_type,
-        name=info["name"],
-        description=info["description"],
-        source_type=info["source_type"],
-        config_schema=info["config_schema"],
-    )
-
-
-def _validate_type(value: Any, expected: str) -> bool:
-    if expected == "string":
-        return isinstance(value, str)
-    if expected == "integer":
-        return isinstance(value, int) and not isinstance(value, bool)
-    if expected == "boolean":
-        return isinstance(value, bool)
-    if expected == "number":
-        return isinstance(value, (int, float)) and not isinstance(value, bool)
-    if expected == "object":
-        return isinstance(value, dict)
-    if expected == "array":
-        return isinstance(value, list)
-    return True
-
-
-def validate_config(widget_type: str, config: dict[str, Any]) -> None:
-    """Validate a widget config against its registered JSON schema.
-
-    Raises ValueError with a descriptive message if validation fails.
-    Phase 1 supports only required-field and primitive-type checks.
-    """
-    info = WIDGET_REGISTRY.get(widget_type)
-    if not info:
-        raise ValueError(f"Unknown widget type: {widget_type}")
-
-    schema = info["config_schema"]
-    required = schema.get("required", [])
-    properties = schema.get("properties", {})
-
-    for key in required:
-        if key not in config:
-            raise ValueError(f"Missing required config field: {key}")
-
-    for key, value in config.items():
-        prop = properties.get(key)
-        if not prop:
-            # Unknown keys are allowed in Phase 1 unless they look like secrets
-            # (handled by the model validator). Skip type checks for unknowns.
-            continue
-        expected_type = prop.get("type")
-        if expected_type and not _validate_type(value, expected_type):
-            raise ValueError(f"Config field '{key}' must be of type {expected_type}")

backend/src/media_library_viewer_api/widgets/sources.py

@@ -1,9 +1,11 @@
 """Widget source adapters.
 
-Each adapter implements a uniform async interface and translates widget
-configuration into data for the dashboard. Adapters reuse existing clients,
-machine registries, and environment settings; they never accept arbitrary
-commands or store credentials.
+Adapters translate a widget instance into dashboard data. Service-bound widgets
+are resolved against a :class:`ServiceRecord` (config + decrypted secrets); the
+built-in widgets (backups, static) take ``service=None``.
+
+Adapters never accept arbitrary commands and never store credentials — secrets
+are decrypted in memory only for the duration of a fetch.
 """
 
 from __future__ import annotations
@@ -11,94 +13,103 @@ from __future__ import annotations
 import asyncio
 import logging
 import shlex
+import time
+from dataclasses import dataclass, field
 from typing import Any, Protocol
 
 import requests
-from starlette.requests import Request
 
+from media_library_viewer_api.clients.jellyfin import JellyfinClient
+from media_library_viewer_api.clients.ssh import RemoteSSHClient
 from media_library_viewer_api.config import get_settings
-from media_library_viewer_api.dependencies import get_jellyfin_client
 from media_library_viewer_api.domain.dashboard import (
     _map_sessions_to_activity_rows,
     build_backup_dashboard_summary,
 )
-from media_library_viewer_api.routers.tasks import _client_for_machine, _resolve_machine_for_task
-from media_library_viewer_api.services.settings_store import get_settings_store
+from media_library_viewer_api.services.settings_store import SettingsStore, get_settings_store
 
 logger = logging.getLogger(__name__)
 
 
-def _request_with_machine_id(machine_id: str | None = None) -> Request:
-    """Build a minimal Starlette Request carrying a machine_id query param."""
-    query = f"machine_id={machine_id}".encode() if machine_id else b""
-    return Request({"type": "http", "query_string": query})
+@dataclass
+class ServiceRecord:
+    """Runtime view of a service instance with decrypted secrets."""
+
+    id: str
+    service_type: str
+    name: str
+    config: dict[str, Any] = field(default_factory=dict)
+    secrets: dict[str, str] = field(default_factory=dict)
+    enabled: bool = True
+
+
+def build_service_record(store: SettingsStore, service_row: dict[str, Any]) -> ServiceRecord:
+    """Build a :class:`ServiceRecord`, decrypting secrets in memory."""
+    from media_library_viewer_api.services.secrets import decrypt_secrets
+
+    return ServiceRecord(
+        id=service_row["id"],
+        service_type=service_row["service_type"],
+        name=service_row["name"],
+        config=service_row.get("config") or {},
+        secrets=decrypt_secrets(service_row.get("secrets") or {}),
+        enabled=bool(service_row.get("enabled", True)),
+    )
 
 
 class WidgetSource(Protocol):
     """Protocol for widget source adapters."""
 
-    source_type: str
-
-    async def fetch(self, config: dict[str, Any]) -> dict[str, Any]: ...
+    async def fetch(
+        self,
+        service: ServiceRecord | None,
+        widget_kind: str,
+        config: dict[str, Any],
+    ) -> dict[str, Any]: ...
 
 
-class JellyfinWidgetSource:
-    """Fetch Jellyfin sessions and map them to activity rows."""
-
-    source_type = "jellyfin"
-    timeout = 10
-
-    async def fetch(self, config: dict[str, Any]) -> dict[str, Any]:
-        try:
-            request = _request_with_machine_id(config.get("machine_id") or None)
-            client = await asyncio.wait_for(
-                asyncio.to_thread(get_jellyfin_client, request),
-                timeout=self.timeout,
-            )
-            sessions = await asyncio.wait_for(
-                asyncio.to_thread(client.sessions),
-                timeout=self.timeout,
-            )
-            rows = _map_sessions_to_activity_rows(sessions)
-            return {"sessions": rows}
-        except asyncio.TimeoutError:
-            return {"error": "Widget data fetch timed out"}
-        except Exception as exc:
-            logger.exception("jellyfin adapter failed")
-            return {"error": f"Jellyfin data fetch failed: {exc}"}
+# ---------------------------------------------------------------------------
+# Built-in (service-less) adapters
+# ---------------------------------------------------------------------------
 
 
 class BackupsWidgetSource:
-    """Compute the backup dashboard summary."""
+    """Compute the backup dashboard summary from internal tables."""
 
-    source_type = "backups"
-    timeout = 10
-
-    async def fetch(self, config: dict[str, Any]) -> dict[str, Any]:
+    async def fetch(self, service: ServiceRecord | None, widget_kind: str, config: dict[str, Any]) -> dict[str, Any]:
         try:
             store = get_settings_store()
             summary = build_backup_dashboard_summary(store)
             return summary.model_dump()
-        except asyncio.TimeoutError:
-            return {"error": "Widget data fetch timed out"}
         except Exception as exc:
             logger.exception("backups adapter failed")
             return {"error": f"Backup summary failed: {exc}"}
 
 
+class StaticWidgetSource:
+    """Return static text/markdown unchanged."""
+
+    async def fetch(self, service: ServiceRecord | None, widget_kind: str, config: dict[str, Any]) -> dict[str, Any]:
+        return {"text": config.get("text", "")}
+
+
+# ---------------------------------------------------------------------------
+# Service-bound adapters
+# ---------------------------------------------------------------------------
+
+
 class GrafanaWidgetSource:
     """Build a Grafana deep-link (no embedding)."""
 
-    source_type = "grafana"
-    timeout = 5
-
-    async def fetch(self, config: dict[str, Any]) -> dict[str, Any]:
+    async def fetch(self, service: ServiceRecord | None, widget_kind: str, config: dict[str, Any]) -> dict[str, Any]:
         try:
-            settings = get_settings()
+            if service is None:
+                return {"error": "Grafana widget is missing its service"}
+            base_url = str(service.config.get("base_url") or "").rstrip("/")
             dashboard_uid = config.get("dashboard_uid")
             if not dashboard_uid:
                 return {"error": "dashboard_uid is required"}
-            url = f"{settings.grafana_url.rstrip('/')}/d/{dashboard_uid}"
+            url = f"{base_url}/d/{dashboard_uid}"
             panel_id = config.get("panel_id")
             if panel_id is not None:
                 url = f"{url}?viewPanel={panel_id}"
@@ -109,26 +120,26 @@ class GrafanaWidgetSource:
 
 
 class PrometheusWidgetSource:
-    """Run a PromQL instant query against Prometheus."""
+    """Run a PromQL instant query against a Prometheus service."""
 
-    source_type = "prometheus"
-    timeout = 10
-
-    async def fetch(self, config: dict[str, Any]) -> dict[str, Any]:
+    async def fetch(self, service: ServiceRecord | None, widget_kind: str, config: dict[str, Any]) -> dict[str, Any]:
         try:
-            settings = get_settings()
+            if service is None:
+                return {"error": "Prometheus widget is missing its service"}
+            base_url = str(service.config.get("base_url") or "").rstrip("/")
+            timeout = int(service.config.get("timeout_seconds") or 10)
             promql = config.get("promql")
             if not promql:
                 return {"error": "promql is required"}
-            url = f"{settings.prometheus_url.rstrip('/')}/api/v1/query"
+            url = f"{base_url}/api/v1/query"
             response = await asyncio.wait_for(
                 asyncio.to_thread(
                     requests.get,
                     url,
                     params={"query": promql},
-                    timeout=self.timeout,
+                    timeout=timeout,
                 ),
-                timeout=self.timeout,
+                timeout=timeout,
             )
             response.raise_for_status()
             payload = response.json()
@@ -143,16 +154,44 @@ class PrometheusWidgetSource:
             return {"error": f"Prometheus query failed: {exc}"}
 
 
-class SshTaskWidgetSource:
-    """Run a saved task from the registry and return its output."""
+class JellyfinWidgetSource:
+    """Fetch Jellyfin sessions and map them to activity rows."""
 
-    source_type = "ssh_task"
-    timeout = 30
-
-    async def fetch(self, config: dict[str, Any]) -> dict[str, Any]:
+    async def fetch(self, service: ServiceRecord | None, widget_kind: str, config: dict[str, Any]) -> dict[str, Any]:
+        timeout = 10
         try:
+            if service is None:
+                return {"error": "Jellyfin widget is missing its service"}
+            base_url = str(service.config.get("base_url") or "")
+            api_key = str(service.secrets.get("api_key") or "")
+            timeout = int(service.config.get("timeout_seconds") or 10)
+            client = await asyncio.wait_for(
+                asyncio.to_thread(JellyfinClient, base_url, api_key, timeout),
+                timeout=timeout,
+            )
+            sessions = await asyncio.wait_for(
+                asyncio.to_thread(client.sessions),
+                timeout=timeout,
+            )
+            rows = _map_sessions_to_activity_rows(sessions)
+            return {"sessions": rows}
+        except asyncio.TimeoutError:
+            return {"error": "Widget data fetch timed out"}
+        except Exception as exc:
+            logger.exception("jellyfin adapter failed")
+            return {"error": f"Jellyfin data fetch failed: {exc}"}
+
+
+class SshTaskWidgetSource:
+    """Run a saved task on an SSH task runner instance and log the run."""
+
+    async def fetch(self, service: ServiceRecord | None, widget_kind: str, config: dict[str, Any]) -> dict[str, Any]:
+        timeout = 30
+        try:
+            if service is None:
+                return {"error": "SSH task widget is missing its service"}
             store = get_settings_store()
-            task_id = config.get("task_id")
+            task_id = config.get("task_id") or ""
             if not task_id:
                 return {"error": "task_id is required"}
             task = store.get_task(task_id)
@@ -161,11 +200,8 @@ class SshTaskWidgetSource:
             if not task.get("enabled", True):
                 return {"error": "Task is disabled"}
 
-            machine = _resolve_machine_for_task(store, task, None)
-            if not machine:
-                return {"error": "No machine available for this task"}
-
-            client = _client_for_machine(store, machine)
+            client = _build_ssh_client(store, service)
+            timeout = int(service.config.get("timeout_seconds") or 30)
             task_type = str(task.get("task_type") or "shell").lower()
             command = str(task.get("content") or "")
             if task_type == "python":
@@ -173,41 +209,112 @@ class SshTaskWidgetSource:
             elif task_type != "shell":
                 return {"error": f"Unknown task type: {task_type}"}
 
+            start = time.perf_counter()
             result = await asyncio.wait_for(
-                asyncio.to_thread(client.run, command, timeout=self.timeout),
-                timeout=self.timeout,
+                asyncio.to_thread(client.run, command, timeout),
+                timeout=timeout,
             )
-            return {
-                "exit_status": result.exit_status,
-                "stdout": result.stdout or "",
-                "stderr": result.stderr or "",
-            }
+            duration_ms = int((time.perf_counter() - start) * 1000)
+            stdout = result.stdout or ""
+            stderr = result.stderr or ""
+            store.record_service_task_run(
+                {
+                    "task_id": task_id,
+                    "service_id": service.id,
+                    "status": "success" if result.exit_status == 0 else "failure",
+                    "exit_status": result.exit_status,
+                    "duration_ms": duration_ms,
+                    "stdout_tail": stdout,
+                    "stderr_tail": stderr,
+                    "error": "" if result.exit_status == 0 else (stderr or stdout or "Task failed"),
+                }
+            )
+            return {"exit_status": result.exit_status, "stdout": stdout, "stderr": stderr}
         except asyncio.TimeoutError:
+            _record_timeout(service, config, timeout)
             return {"error": "Widget data fetch timed out"}
         except Exception as exc:
             logger.exception("ssh_task adapter failed")
+            store = get_settings_store()
+            store.record_service_task_run(
+                {
+                    "task_id": str(config.get("task_id") or ""),
+                    "service_id": service.id if service else "",
+                    "status": "error",
+                    "duration_ms": 0,
+                    "error": str(exc)[:1000],
+                }
+            )
             return {"error": f"SSH task failed: {exc}"}
 
 
-class StaticWidgetSource:
-    """Return static text/markdown unchanged."""
-
-    source_type = "static"
-
-    async def fetch(self, config: dict[str, Any]) -> dict[str, Any]:
-        return {"text": config.get("text", "")}
+def _record_timeout(service: ServiceRecord | None, config: dict[str, Any], timeout: int) -> None:
+    try:
+        store = get_settings_store()
+        store.record_service_task_run(
+            {
+                "task_id": str(config.get("task_id") or ""),
+                "service_id": service.id if service else "",
+                "status": "timeout",
+                "duration_ms": timeout * 1000,
+                "error": f"Task timed out after {timeout}s",
+            }
+        )
+    except Exception:  # pragma: no cover - logging best-effort
+        logger.exception("failed to record ssh task timeout")
 
 
-SOURCE_REGISTRY: dict[str, WidgetSource] = {
-    "jellyfin": JellyfinWidgetSource(),
-    "backups": BackupsWidgetSource(),
+def _build_ssh_client(store: SettingsStore, service: ServiceRecord) -> RemoteSSHClient:
+    """Build an SSH client from an ssh_tasks service instance + referenced key."""
+    config = service.config
+    host = str(config.get("host") or "").strip()
+    username = str(config.get("username") or "").strip()
+    if not host or not username:
+        raise ValueError("SSH task service is missing host or username")
+
+    settings = get_settings()
+    private_key = ""
+    key_passphrase = ""
+    ssh_key_id = str(config.get("ssh_key_id") or "").strip()
+    if ssh_key_id:
+        ssh_key = store.get_ssh_key(ssh_key_id)
+        if ssh_key:
+            private_key = str(ssh_key.get("private_key") or "")
+            key_passphrase = str(ssh_key.get("passphrase") or "")
+    # Service-level passphrase secret takes precedence.
+    key_passphrase = str(service.secrets.get("passphrase") or "") or key_passphrase
+
+    return RemoteSSHClient(
+        host=host,
+        username=username,
+        port=int(config.get("port") or 22),
+        private_key=private_key or None,
+        private_key_passphrase=key_passphrase or None,
+        known_hosts_path=str(settings.ssh_known_hosts_file),
+        timeout=int(config.get("timeout_seconds") or 30),
+    )
+
+
+# ---------------------------------------------------------------------------
+# Registries
+# ---------------------------------------------------------------------------
+
+SERVICE_ADAPTERS: dict[str, WidgetSource] = {
     "grafana": GrafanaWidgetSource(),
     "prometheus": PrometheusWidgetSource(),
-    "ssh_task": SshTaskWidgetSource(),
+    "jellyfin": JellyfinWidgetSource(),
+    "ssh_tasks": SshTaskWidgetSource(),
+}
+
+BUILTIN_ADAPTERS: dict[str, WidgetSource] = {
+    "backups": BackupsWidgetSource(),
     "static": StaticWidgetSource(),
 }
 
 
-def get_source_adapter(source_type: str) -> WidgetSource | None:
-    """Return the adapter for a source type, or None if unknown."""
-    return SOURCE_REGISTRY.get(source_type)
+def get_service_adapter(service_type: str) -> WidgetSource | None:
+    return SERVICE_ADAPTERS.get(service_type)
+
+
+def get_builtin_adapter(kind: str) -> WidgetSource | None:
+    return BUILTIN_ADAPTERS.get(kind)

backend/tests/test_services.py

@@ -0,0 +1,368 @@
+"""Tests for the service registry: definitions, encryption, CRUD, cascade delete."""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+from cryptography.fernet import Fernet
+from fastapi.testclient import TestClient
+
+from media_library_viewer_api.dependencies import get_settings_store
+from media_library_viewer_api.integrations.registry import (
+    SERVICE_DEFINITIONS,
+    get_service_definition,
+    get_widget_kind,
+)
+from media_library_viewer_api.main import app
+from media_library_viewer_api.services.secrets import (
+    EncryptionKeyError,
+    decrypt_secrets,
+    decrypt_value,
+    encrypt_secrets,
+    encrypt_value,
+    get_encryption_key,
+    reset_encryption_key_cache,
+)
+from media_library_viewer_api.services.settings_store import SettingsStore
+
+TEST_KEY = Fernet.generate_key().decode()
+
+
+@pytest.fixture(autouse=True)
+def _encryption_key(monkeypatch):
+    """Provide a stable MANAGE_ENCRYPTION_KEY for every test."""
+    monkeypatch.setenv("MANAGE_ENCRYPTION_KEY", TEST_KEY)
+    reset_encryption_key_cache()
+    yield
+    reset_encryption_key_cache()
+
+
+@pytest.fixture
+def client(tmp_path):
+    """FastAPI test client with a fresh settings store and auth disabled."""
+    store = SettingsStore(tmp_path / "settings.sqlite")
+    store.ensure_defaults()
+    app.dependency_overrides[get_settings_store] = lambda: store
+    auth_settings = SimpleNamespace(auth_enabled=False)
+    with patch("media_library_viewer_api.auth.get_settings", return_value=auth_settings):
+        yield TestClient(app)
+    app.dependency_overrides.clear()
+
+
+# ---------------------------------------------------------------------------
+# Registry
+# ---------------------------------------------------------------------------
+
+
+def test_registry_contains_five_service_types():
+    assert set(SERVICE_DEFINITIONS) == {
+        "grafana",
+        "prometheus",
+        "jellyfin",
+        "jellyseerr",
+        "nextcloud",
+        "ssh_tasks",
+    }
+
+
+def test_definitions_declare_widget_kinds():
+    assert {wk.kind for wk in get_service_definition("grafana").widget_kinds} == {"link"}
+    assert {wk.kind for wk in get_service_definition("prometheus").widget_kinds} == {"metric"}
+    assert {wk.kind for wk in get_service_definition("jellyfin").widget_kinds} == {"activity"}
+    assert get_service_definition("nextcloud").widget_kinds == []
+    assert {wk.kind for wk in get_service_definition("ssh_tasks").widget_kinds} == {"task_output"}
+
+
+def test_widget_kind_lookup():
+    assert get_widget_kind("grafana", "link") is not None
+    assert get_widget_kind("grafana", "missing") is None
+    assert get_widget_kind("unknown", "link") is None
+
+
+def test_service_config_schema_is_json_schema():
+    schema = get_service_definition("grafana").config_schema
+    assert schema["type"] == "object"
+    assert "base_url" in schema["properties"]
+
+
+# ---------------------------------------------------------------------------
+# Encryption
+# ---------------------------------------------------------------------------
+
+
+def test_encrypt_decrypt_round_trip():
+    cipher = encrypt_value("hunter2")
+    assert cipher != "hunter2"
+    assert decrypt_value(cipher) == "hunter2"
+
+
+def test_encrypt_decrypt_secrets_dict():
+    blob = encrypt_secrets({"api_key": "abc", "token": "xyz"})
+    assert decrypt_secrets(blob) == {"api_key": "abc", "token": "xyz"}
+
+
+def test_missing_encryption_key_raises(monkeypatch):
+    monkeypatch.delenv("MANAGE_ENCRYPTION_KEY", raising=False)
+    reset_encryption_key_cache()
+    with pytest.raises(EncryptionKeyError):
+        get_encryption_key()
+    reset_encryption_key_cache()
+
+
+def test_decrypt_with_wrong_key_raises(monkeypatch):
+    blob = encrypt_secrets({"api_key": "abc"})
+    monkeypatch.setenv("MANAGE_ENCRYPTION_KEY", Fernet.generate_key().decode())
+    reset_encryption_key_cache()
+    with pytest.raises(EncryptionKeyError):
+        decrypt_secrets(blob)
+    reset_encryption_key_cache()
+
+
+def test_invalid_ciphertext_raises():
+    with pytest.raises(EncryptionKeyError):
+        decrypt_value("not-a-real-token")
+
+
+# ---------------------------------------------------------------------------
+# Service type metadata endpoint
+# ---------------------------------------------------------------------------
+
+
+def test_list_service_types(client):
+    response = client.get("/api/services/types")
+    assert response.status_code == 200
+    types = {item["service_type"] for item in response.json()}
+    assert types == {
+        "grafana",
+        "jellyfin",
+        "jellyseerr",
+        "nextcloud",
+        "prometheus",
+        "ssh_tasks",
+    }
+
+
+def test_service_type_includes_secret_and_widget_metadata(client):
+    response = client.get("/api/services/types")
+    grafana = next(item for item in response.json() if item["service_type"] == "grafana")
+    assert [sf["key"] for sf in grafana["secret_fields"]] == ["api_key"]
+    assert [wk["kind"] for wk in grafana["widget_kinds"]] == ["link"]
+
+
+# ---------------------------------------------------------------------------
+# CRUD
+# ---------------------------------------------------------------------------
+
+
+def _grafana_payload(**overrides):
+    payload = {
+        "service_type": "grafana",
+        "name": "Production Grafana",
+        "config": {"base_url": "https://grafana.example.com"},
+        "secrets": {"api_key": "secret-token"},
+        "enabled": True,
+    }
+    payload.update(overrides)
+    return payload
+
+
+def test_create_and_list_service(client):
+    response = client.post("/api/services/instances", json=_grafana_payload())
+    assert response.status_code == 201
+    created = response.json()
+    assert created["service_type"] == "grafana"
+    assert created["config"]["base_url"] == "https://grafana.example.com"
+    # Plaintext secrets are never returned.
+    assert "secrets" not in created
+    assert created["secrets_set"] == {"api_key": True}
+
+    response = client.get("/api/services/instances")
+    assert response.status_code == 200
+    assert len(response.json()) == 1
+
+
+def test_list_instances_filters_by_type(client):
+    client.post("/api/services/instances", json=_grafana_payload())
+    client.post(
+        "/api/services/instances",
+        json={
+            "service_type": "prometheus",
+            "name": "Prom",
+            "config": {"base_url": "http://prometheus:9090"},
+        },
+    )
+    response = client.get("/api/services/instances?service_type=grafana")
+    assert response.status_code == 200
+    assert len(response.json()) == 1
+    assert response.json()[0]["service_type"] == "grafana"
+
+
+def test_update_service_preserves_unsent_secrets(client):
+    created = client.post("/api/services/instances", json=_grafana_payload()).json()
+    # Update without sending secrets; the existing key should remain set.
+    updated = client.put(
+        f"/api/services/instances/{created['id']}",
+        json={
+            "service_type": "grafana",
+            "name": "Renamed Grafana",
+            "config": {"base_url": "https://grafana.example.com", "timeout_seconds": 10},
+        },
+    ).json()
+    assert updated["name"] == "Renamed Grafana"
+    assert updated["secrets_set"] == {"api_key": True}
+
+
+def test_update_service_can_clear_secret(client):
+    created = client.post("/api/services/instances", json=_grafana_payload()).json()
+    updated = client.put(
+        f"/api/services/instances/{created['id']}",
+        json={
+            "service_type": "grafana",
+            "name": "Production Grafana",
+            "config": {"base_url": "https://grafana.example.com"},
+            "secrets": {"api_key": ""},
+        },
+    ).json()
+    assert updated["secrets_set"] == {"api_key": False}
+
+
+def test_unknown_service_type_rejected(client):
+    response = client.post(
+        "/api/services/instances",
+        json={"service_type": "bogus", "name": "x", "config": {}},
+    )
+    assert response.status_code == 422
+
+
+def test_invalid_config_rejected(client):
+    response = client.post(
+        "/api/services/instances",
+        json={"service_type": "grafana", "name": "x", "config": {"base_url": ""}},
+    )
+    # Pydantic accepts empty string; force a real validation error via bad type.
+    response = client.post(
+        "/api/services/instances",
+        json={"service_type": "grafana", "name": "x", "config": {"timeout_seconds": "fast"}},
+    )
+    assert response.status_code == 422
+
+
+def test_unknown_secret_field_rejected(client):
+    response = client.post(
+        "/api/services/instances",
+        json={
+            "service_type": "grafana",
+            "name": "x",
+            "config": {"base_url": "https://grafana.example.com"},
+            "secrets": {"password": "leak"},
+        },
+    )
+    assert response.status_code == 422
+
+
+def test_credential_key_in_config_rejected(client):
+    response = client.post(
+        "/api/services/instances",
+        json={
+            "service_type": "grafana",
+            "name": "x",
+            "config": {"base_url": "https://grafana.example.com", "api_key": "leak"},
+        },
+    )
+    assert response.status_code == 422
+
+
+def test_update_nonexistent_returns_404(client):
+    response = client.put(
+        "/api/services/instances/missing",
+        json=_grafana_payload(id="missing"),
+    )
+    assert response.status_code == 404
+
+
+def test_update_id_mismatch_returns_400(client):
+    created = client.post("/api/services/instances", json=_grafana_payload()).json()
+    response = client.put(
+        f"/api/services/instances/{created['id']}",
+        json=_grafana_payload(id="other-id"),
+    )
+    assert response.status_code == 400
+
+
+def test_delete_service(client):
+    created = client.post("/api/services/instances", json=_grafana_payload()).json()
+    response = client.delete(f"/api/services/instances/{created['id']}")
+    assert response.status_code == 200
+    assert client.get("/api/services/instances").json() == []
+
+
+def test_delete_nonexistent_returns_404(client):
+    assert client.delete("/api/services/instances/missing").status_code == 404
+
+
+# ---------------------------------------------------------------------------
+# Cascade delete
+# ---------------------------------------------------------------------------
+
+
+def test_delete_service_cascades_to_widgets(client, tmp_path):
+    """Once widgets carry service_id (Slice 2), deleting a service removes them.
+
+    This test seeds a widget row directly with the column present to prove the
+    cascade path; the column is added defensively here so the test is meaningful
+    even before Slice 2 lands.
+    """
+    store = app.dependency_overrides[get_settings_store]()
+    service = store.upsert_service(
+        {"service_type": "grafana", "name": "Grafana", "config": {"base_url": "u"}, "enabled": True}
+    )
+
+    # Ensure the service_id column exists and seed a referencing widget.
+    with store.connect() as conn:
+        cols = {row[1] for row in conn.execute("PRAGMA table_info(dashboard_widgets)").fetchall()}
+        if "service_id" not in cols:
+            conn.execute("ALTER TABLE dashboard_widgets ADD COLUMN service_id TEXT")
+        conn.execute(
+            """
+            INSERT INTO dashboard_widgets (id, addon_id, widget_type, title, config_json,
+                                           enabled, sort_order, created_at, updated_at, service_id)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            """,
+            ("w1", "grafana", "grafana.link", "Link", "{}", 1, 0, 1, 1, service["id"]),
+        )
+
+    store.delete_service(service["id"])
+    assert store.get_service(service["id"]) is None
+    with store.connect() as conn:
+        remaining = conn.execute(
+            "SELECT COUNT(*) FROM dashboard_widgets WHERE service_id = ?",
+            (service["id"],),
+        ).fetchone()
+    assert int(remaining[0]) == 0
+
+
+# ---------------------------------------------------------------------------
+# Service task run history
+# ---------------------------------------------------------------------------
+
+
+def test_record_and_list_service_task_runs(client):
+    store = app.dependency_overrides[get_settings_store]()
+    service = store.upsert_service(
+        {"service_type": "ssh_tasks", "name": "box", "config": {"host": "h"}, "enabled": True}
+    )
+    store.record_service_task_run(
+        {
+            "task_id": "t1",
+            "service_id": service["id"],
+            "status": "success",
+            "exit_status": 0,
+            "stdout_tail": "ok",
+        }
+    )
+    runs = store.list_service_task_runs(service_id=service["id"])
+    assert len(runs) == 1
+    assert runs[0]["status"] == "success"
+    assert runs[0]["stdout_tail"] == "ok"

backend/tests/test_widgets.py

@@ -1,22 +1,32 @@
-"""Tests for the dashboard widget backend: registry, CRUD, validation, seeding, adapters."""
+"""Tests for the dashboard widget system: service-bound + built-in widgets."""
+
+from __future__ import annotations
 
-import asyncio
 from types import SimpleNamespace
-from unittest.mock import MagicMock, patch
+from unittest.mock import patch
 
 import pytest
+from cryptography.fernet import Fernet
 from fastapi.testclient import TestClient
 
 from media_library_viewer_api.dependencies import get_settings_store
 from media_library_viewer_api.main import app
 from media_library_viewer_api.services.settings_store import SettingsStore
 from media_library_viewer_api.widgets.sources import (
-    SOURCE_REGISTRY,
+    BackupsWidgetSource,
     GrafanaWidgetSource,
-    SshTaskWidgetSource,
+    ServiceRecord,
     StaticWidgetSource,
 )
 
+TEST_KEY = Fernet.generate_key().decode()
+
+
+@pytest.fixture(autouse=True)
+def _encryption_key(monkeypatch):
+    monkeypatch.setenv("MANAGE_ENCRYPTION_KEY", TEST_KEY)
+    yield
+
 
 @pytest.fixture
 def client(tmp_path):
@@ -30,446 +40,348 @@ def client(tmp_path):
     app.dependency_overrides.clear()
 
 
-def test_widget_sources(client):
-    response = client.get("/api/widgets/sources")
+def _make_grafana_service(client, name="Production Grafana", **config_overrides):
+    config = {"base_url": "https://grafana.example.com"}
+    config.update(config_overrides)
+    return client.post(
+        "/api/services/instances",
+        json={"service_type": "grafana", "name": name, "config": config, "enabled": True},
+    ).json()
+
+
+# ---------------------------------------------------------------------------
+# Built-in kinds + built-in widget CRUD
+# ---------------------------------------------------------------------------
+
+
+def test_list_builtin_kinds(client):
+    response = client.get("/api/widgets/builtin")
     assert response.status_code == 200
-    assert set(response.json()) == {
-        "jellyfin",
-        "backups",
-        "grafana",
-        "prometheus",
-        "ssh_task",
-        "static",
-    }
+    kinds = {item["kind"] for item in response.json()}
+    assert kinds == {"backups", "static"}
 
 
-def test_widget_types(client):
-    response = client.get("/api/widgets/types")
-    assert response.status_code == 200
-    types = {item["widget_type"] for item in response.json()}
-    assert types == {
-        "jellyfin",
-        "backups",
-        "grafana-link",
-        "prometheus-metric",
-        "ssh-task",
-        "static",
-    }
-
-
-def test_create_and_read_widget(client):
+def test_create_and_read_static_widget(client):
     response = client.post(
         "/api/widgets/instances",
         json={
-            "addon_id": "core",
-            "widget_type": "static",
+            "widget_kind": "static",
             "title": "Note",
             "config": {"text": "hello"},
-            "enabled": True,
-            "sort_order": 5,
         },
     )
     assert response.status_code == 201
-    widget = response.json()
-    assert widget["title"] == "Note"
-    assert widget["config"] == {"text": "hello"}
-    assert widget["enabled"] is True
-    assert widget["sort_order"] == 5
-    widget_id = widget["id"]
+    created = response.json()
+    assert created["widget_kind"] == "static"
+    assert created["service_id"] is None
+    assert created["config"]["text"] == "hello"
 
-    response = client.get("/api/widgets/instances")
-    assert response.status_code == 200
-    assert any(w["id"] == widget_id for w in response.json())
+    listed = client.get("/api/widgets/instances").json()
+    assert len(listed) == 1
+    assert listed[0]["id"] == created["id"]
 
 
-def test_update_widget(client):
+def test_create_backups_widget(client):
+    response = client.post(
+        "/api/widgets/instances",
+        json={"widget_kind": "backups", "title": "Backups", "config": {}},
+    )
+    assert response.status_code == 201
+
+
+def test_unknown_builtin_kind_rejected(client):
+    response = client.post(
+        "/api/widgets/instances",
+        json={"widget_kind": "bogus", "title": "x", "config": {}},
+    )
+    assert response.status_code == 422
+
+
+def test_credential_key_in_config_rejected(client):
+    response = client.post(
+        "/api/widgets/instances",
+        json={"widget_kind": "static", "title": "x", "config": {"api_key": "leak"}},
+    )
+    assert response.status_code == 422
+
+
+# ---------------------------------------------------------------------------
+# Service-bound widget CRUD
+# ---------------------------------------------------------------------------
+
+
+def test_create_service_bound_widget(client):
+    service = _make_grafana_service(client)
     response = client.post(
         "/api/widgets/instances",
         json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Note",
-            "config": {"text": "hello"},
+            "service_id": service["id"],
+            "widget_kind": "link",
+            "title": "Dashboard",
+            "config": {"dashboard_uid": "overview"},
         },
     )
-    widget_id = response.json()["id"]
-
-    response = client.put(
-        f"/api/widgets/instances/{widget_id}",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Updated",
-            "config": {"text": "world"},
-            "enabled": False,
-            "sort_order": 10,
-        },
-    )
-    assert response.status_code == 200
-    data = response.json()
-    assert data["title"] == "Updated"
-    assert data["config"] == {"text": "world"}
-    assert data["enabled"] is False
-    assert data["sort_order"] == 10
+    assert response.status_code == 201
+    created = response.json()
+    assert created["service_id"] == service["id"]
+    assert created["widget_kind"] == "link"
 
 
-def test_delete_widget(client):
+def test_service_bound_widget_unknown_kind_rejected(client):
+    service = _make_grafana_service(client)
     response = client.post(
         "/api/widgets/instances",
         json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "To delete",
-            "config": {"text": "bye"},
-        },
-    )
-    widget_id = response.json()["id"]
-
-    response = client.delete(f"/api/widgets/instances/{widget_id}")
-    assert response.status_code == 200
-
-    response = client.get("/api/widgets/instances")
-    assert not any(w["id"] == widget_id for w in response.json())
-
-
-def test_unknown_widget_type_rejected(client):
-    response = client.post(
-        "/api/widgets/instances",
-        json={
-            "addon_id": "core",
-            "widget_type": "unknown",
-            "title": "Bad",
+            "service_id": service["id"],
+            "widget_kind": "metric",
+            "title": "x",
             "config": {},
         },
     )
     assert response.status_code == 422
 
 
-def test_addon_id_mismatch_rejected(client):
+def test_service_bound_widget_service_not_found_rejected(client):
     response = client.post(
         "/api/widgets/instances",
         json={
-            "addon_id": "grafana",
-            "widget_type": "static",
-            "title": "Bad",
-            "config": {"text": "x"},
+            "service_id": "missing",
+            "widget_kind": "link",
+            "title": "x",
+            "config": {"dashboard_uid": "u"},
         },
     )
     assert response.status_code == 422
 
 
-def test_credential_key_rejected(client):
+def test_service_bound_widget_invalid_config_rejected(client):
+    service = _make_grafana_service(client)
     response = client.post(
         "/api/widgets/instances",
         json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Bad",
-            "config": {"api_key": "secret123"},
+            "service_id": service["id"],
+            "widget_kind": "link",
+            "title": "x",
+            "config": {"dashboard_uid": ""},  # empty still validates; use bad type
+        },
+    )
+    # Empty string passes Pydantic; force a real failure with a bad type.
+    response = client.post(
+        "/api/widgets/instances",
+        json={
+            "service_id": service["id"],
+            "widget_kind": "link",
+            "title": "x",
+            "config": {"dashboard_uid": 123},
         },
     )
     assert response.status_code == 422
 
 
-def test_update_nonexistent_widget(client):
+def test_update_and_delete_widget(client):
+    created = client.post(
+        "/api/widgets/instances",
+        json={"widget_kind": "static", "title": "Note", "config": {"text": "a"}},
+    ).json()
+    updated = client.put(
+        f"/api/widgets/instances/{created['id']}",
+        json={"widget_kind": "static", "title": "Note2", "config": {"text": "b"}},
+    ).json()
+    assert updated["title"] == "Note2"
+
+    assert client.delete(f"/api/widgets/instances/{created['id']}").status_code == 200
+    assert client.get("/api/widgets/instances").json() == []
+
+
+def test_update_nonexistent_returns_404(client):
     response = client.put(
-        "/api/widgets/instances/does-not-exist",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Bad",
-            "config": {"text": "x"},
-        },
+        "/api/widgets/instances/missing",
+        json={"widget_kind": "static", "title": "x", "config": {}},
     )
     assert response.status_code == 404
 
 
-def test_delete_nonexistent_widget(client):
-    response = client.delete("/api/widgets/instances/does-not-exist")
-    assert response.status_code == 404
-
-
-def test_default_widgets_seeded(client):
-    response = client.get("/api/widgets/instances")
-    assert response.status_code == 200
-    widgets = response.json()
-    types = [w["widget_type"] for w in widgets]
-    assert "jellyfin" in types
-    assert "backups" in types
-
-
-def test_no_reseed_when_widgets_exist(tmp_path):
-    db_path = tmp_path / "settings.sqlite"
-    store = SettingsStore(db_path)
-    store.ensure_defaults()
-    widgets = store.list_widgets()
-    assert len(widgets) == 2
-
-    store.delete_widget(widgets[0]["id"])
-    store.ensure_defaults()
-
-    remaining = store.list_widgets()
-    assert len(remaining) == 1
-
-
 def test_update_id_mismatch_returns_400(client):
-    response = client.post(
+    created = client.post(
         "/api/widgets/instances",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Note",
-            "config": {"text": "hello"},
-        },
-    )
-    widget_id = response.json()["id"]
-
+        json={"widget_kind": "static", "title": "x", "config": {}},
+    ).json()
     response = client.put(
-        f"/api/widgets/instances/{widget_id}",
-        json={
-            "id": "different-id",
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Updated",
-            "config": {"text": "world"},
-        },
+        f"/api/widgets/instances/{created['id']}",
+        json={"id": "other", "widget_kind": "static", "title": "x", "config": {}},
     )
     assert response.status_code == 400
 
 
-def test_empty_title_rejected(client):
-    response = client.post(
-        "/api/widgets/instances",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "",
-            "config": {"text": "hello"},
-        },
-    )
-    assert response.status_code == 422
-
-
-def test_config_type_error_rejected(client):
-    response = client.post(
-        "/api/widgets/instances",
-        json={
-            "addon_id": "grafana",
-            "widget_type": "grafana-link",
-            "title": "Grafana",
-            "config": {"panel_id": "not-an-integer"},
-        },
-    )
-    assert response.status_code == 422
-
-
-def test_list_instances_respects_sort_order(client):
-    response = client.get("/api/widgets/instances")
-    assert response.status_code == 200
-    widgets = response.json()
-    orders = [w["sort_order"] for w in widgets]
-    assert orders == sorted(orders)
-
-
-def test_enabled_round_trip(client):
-    response = client.post(
-        "/api/widgets/instances",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Toggle",
-            "config": {"text": "x"},
-            "enabled": False,
-        },
-    )
-    widget_id = response.json()["id"]
-
-    response = client.put(
-        f"/api/widgets/instances/{widget_id}",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Toggle",
-            "config": {"text": "x"},
-            "enabled": True,
-        },
-    )
-    assert response.status_code == 200
-    assert response.json()["enabled"] is True
+# ---------------------------------------------------------------------------
+# Data endpoint
+# ---------------------------------------------------------------------------
 
 
 def test_fetch_static_widget_data(client):
-    response = client.post(
+    created = client.post(
         "/api/widgets/instances",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Note",
-            "config": {"text": "hello world"},
-        },
-    )
-    widget_id = response.json()["id"]
-
-    response = client.get(f"/api/widgets/instances/{widget_id}/data")
+        json={"widget_kind": "static", "title": "Note", "config": {"text": "hello"}},
+    ).json()
+    response = client.get(f"/api/widgets/instances/{created['id']}/data")
     assert response.status_code == 200
-    data = response.json()
-    assert data["widget_id"] == widget_id
-    assert data["widget_type"] == "static"
-    assert data["data"] == {"text": "hello world"}
-    assert data["error"] is None
-    assert isinstance(data["fetched_at"], int)
+    body = response.json()
+    assert body["data"]["text"] == "hello"
+    assert body["error"] is None
 
 
-def test_fetch_grafana_widget_data(client):
-    response = client.post(
+def test_fetch_backups_widget_data(client):
+    created = client.post(
         "/api/widgets/instances",
-        json={
-            "addon_id": "grafana",
-            "widget_type": "grafana-link",
-            "title": "Grafana",
-            "config": {"dashboard_uid": "overview", "panel_id": 3},
-        },
-    )
-    widget_id = response.json()["id"]
-
-    response = client.get(f"/api/widgets/instances/{widget_id}/data")
+        json={"widget_kind": "backups", "title": "Backups", "config": {}},
+    ).json()
+    response = client.get(f"/api/widgets/instances/{created['id']}/data")
     assert response.status_code == 200
-    data = response.json()
-    assert data["widget_type"] == "grafana-link"
-    assert data["data"]["url"] == "http://grafana:3000/d/overview?viewPanel=3"
+    assert "total_jobs" in response.json()["data"]
 
 
-def test_fetch_prometheus_widget_data(client):
-    response = client.post(
+def test_fetch_grafana_link_widget_data(client):
+    service = _make_grafana_service(client)
+    created = client.post(
         "/api/widgets/instances",
         json={
-            "addon_id": "prometheus",
-            "widget_type": "prometheus-metric",
-            "title": "CPU",
-            "config": {"promql": '100 - avg(irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100'},
+            "service_id": service["id"],
+            "widget_kind": "link",
+            "title": "Dashboard",
+            "config": {"dashboard_uid": "overview", "panel_id": 2},
         },
-    )
-    widget_id = response.json()["id"]
-
-    fake_payload = {"data": {"resultType": "scalar", "result": [1718900000, "42.5"]}}
-    with patch("media_library_viewer_api.widgets.sources.requests.get") as mock_get:
-        mock_response = MagicMock()
-        mock_response.raise_for_status.return_value = None
-        mock_response.json.return_value = fake_payload
-        mock_get.return_value = mock_response
-
-        response = client.get(f"/api/widgets/instances/{widget_id}/data")
-
+    ).json()
+    response = client.get(f"/api/widgets/instances/{created['id']}/data")
     assert response.status_code == 200
-    data = response.json()
-    assert data["widget_type"] == "prometheus-metric"
-    assert data["data"]["result"]["resultType"] == "scalar"
+    assert response.json()["data"]["url"] == "https://grafana.example.com/d/overview?viewPanel=2"
 
 
-def test_fetch_jellyfin_widget_data_error(client):
-    response = client.post(
+def test_fetch_widget_service_not_found(client):
+    service = _make_grafana_service(client)
+    created = client.post(
         "/api/widgets/instances",
         json={
-            "addon_id": "core",
-            "widget_type": "jellyfin",
-            "title": "Activity",
-            "config": {"machine_id": ""},
+            "service_id": service["id"],
+            "widget_kind": "link",
+            "title": "x",
+            "config": {"dashboard_uid": "u"},
+        },
+    ).json()
+    # Deleting the service cascade-deletes its widgets, so the widget is gone.
+    client.delete(f"/api/services/instances/{service['id']}")
+    assert client.get("/api/widgets/instances").json() == []
+    assert client.get(f"/api/widgets/instances/{created['id']}/data").status_code == 404
+
+
+def test_fetch_widget_service_disabled(client):
+    service = _make_grafana_service(client)
+    created = client.post(
+        "/api/widgets/instances",
+        json={
+            "service_id": service["id"],
+            "widget_kind": "link",
+            "title": "x",
+            "config": {"dashboard_uid": "u"},
+        },
+    ).json()
+    client.put(
+        f"/api/services/instances/{service['id']}",
+        json={
+            "service_type": "grafana",
+            "name": service["name"],
+            "config": {"base_url": "https://grafana.example.com"},
+            "enabled": False,
         },
     )
-    widget_id = response.json()["id"]
-
-    response = client.get(f"/api/widgets/instances/{widget_id}/data")
+    response = client.get(f"/api/widgets/instances/{created['id']}/data")
     assert response.status_code == 200
-    data = response.json()
-    assert data["widget_type"] == "jellyfin"
-    assert data["data"] is None
-    assert data["error"] is not None
-    assert "Jellyfin" in data["error"] or "machine" in data["error"].lower()
+    assert "disabled" in response.json()["error"]
 
 
-def test_fetch_widget_data_not_found(client):
-    response = client.get("/api/widgets/instances/does-not-exist/data")
-    assert response.status_code == 404
+def test_fetch_widget_not_found(client):
+    assert client.get("/api/widgets/instances/missing/data").status_code == 404
 
 
-def test_fetch_widget_data_unhandled_exception_returns_500(client):
-    response = client.post(
-        "/api/widgets/instances",
-        json={
-            "addon_id": "core",
-            "widget_type": "static",
-            "title": "Note",
-            "config": {"text": "x"},
-        },
-    )
-    widget_id = response.json()["id"]
+# ---------------------------------------------------------------------------
+# Adapter unit tests
+# ---------------------------------------------------------------------------
 
-    class _ExplodingAdapter:
-        source_type = "static"
 
-        async def fetch(self, config):
-            raise RuntimeError("boom")
+@pytest.mark.asyncio
+async def test_grafana_adapter_builds_url():
+    adapter = GrafanaWidgetSource()
+    service = ServiceRecord(id="s", service_type="grafana", name="g", config={"base_url": "http://g:3000"})
+    result = await adapter.fetch(service, "link", {"dashboard_uid": "ov"})
+    assert result["url"] == "http://g:3000/d/ov"
+    result = await adapter.fetch(service, "link", {"dashboard_uid": "ov", "panel_id": 4})
+    assert result["url"] == "http://g:3000/d/ov?viewPanel=4"
 
-    with patch("media_library_viewer_api.routers.widgets.get_source_adapter", return_value=_ExplodingAdapter()):
-        response = client.get(f"/api/widgets/instances/{widget_id}/data")
 
-    assert response.status_code == 500
+@pytest.mark.asyncio
+async def test_grafana_adapter_missing_service():
+    adapter = GrafanaWidgetSource()
+    result = await adapter.fetch(None, "link", {"dashboard_uid": "ov"})
+    assert "error" in result
 
 
 @pytest.mark.asyncio
 async def test_static_adapter():
     adapter = StaticWidgetSource()
-    result = await adapter.fetch({"text": "hello"})
-    assert result == {"text": "hello"}
+    result = await adapter.fetch(None, "static", {"text": "hi"})
+    assert result == {"text": "hi"}
 
 
 @pytest.mark.asyncio
-async def test_grafana_adapter():
-    adapter = GrafanaWidgetSource()
-    result = await adapter.fetch({"dashboard_uid": "overview", "panel_id": 2})
-    assert result["url"] == "http://grafana:3000/d/overview?viewPanel=2"
-
-    result = await adapter.fetch({"dashboard_uid": "overview"})
-    assert result["url"] == "http://grafana:3000/d/overview"
+async def test_backups_adapter(client):
+    store = app.dependency_overrides[get_settings_store]()
+    with patch("media_library_viewer_api.widgets.sources.get_settings_store", return_value=store):
+        adapter = BackupsWidgetSource()
+        result = await adapter.fetch(None, "backups", {})
+    assert "total_jobs" in result
 
 
 @pytest.mark.asyncio
-async def test_ssh_task_adapter_timeout(tmp_path):
-    store = SettingsStore(tmp_path / "settings.sqlite")
-    store.ensure_defaults()
-
-    # Create a local machine and a simple shell task.
-    machine = store.list_machines()[0]
-    task = store.upsert_task(
-        {
-            "name": "slow-task",
-            "task_type": "shell",
-            "content": "echo hello",
-            "enabled": True,
-            "default_machine_id": machine["id"],
-        }
-    )
+async def test_ssh_task_adapter_missing_service():
+    from media_library_viewer_api.widgets.sources import SshTaskWidgetSource
 
     adapter = SshTaskWidgetSource()
-    with patch(
-        "media_library_viewer_api.widgets.sources.get_settings_store",
-        return_value=store,
-    ), patch(
-        "media_library_viewer_api.widgets.sources.asyncio.wait_for",
-        side_effect=asyncio.TimeoutError,
-    ):
-        result = await adapter.fetch({"task_id": task["id"]})
-
+    result = await adapter.fetch(None, "task_output", {"task_id": "t1"})
     assert "error" in result
-    assert "timed out" in result["error"].lower()
 
 
-def test_source_registry_closed():
-    assert set(SOURCE_REGISTRY.keys()) == {
-        "jellyfin",
-        "backups",
-        "grafana",
-        "prometheus",
-        "ssh_task",
-        "static",
-    }
+@pytest.mark.asyncio
+async def test_ssh_task_adapter_records_history_on_run(client):
+    store = app.dependency_overrides[get_settings_store]()
+    # Save a task and an ssh_tasks service instance.
+    task = store.upsert_task(
+        {
+            "name": "echo",
+            "task_type": "shell",
+            "content": "echo hi",
+            "enabled": True,
+            "default_machine_id": "",
+        }
+    )
+    service = store.upsert_service(
+        {"service_type": "ssh_tasks", "name": "box", "config": {"host": "h", "username": "u"}, "enabled": True}
+    )
+
+    fake_result = SimpleNamespace(exit_status=0, stdout="hi\n", stderr="")
+    fake_client = SimpleNamespace(run=lambda *a, **k: fake_result)
+
+    from media_library_viewer_api.widgets.sources import SshTaskWidgetSource
+
+    adapter = SshTaskWidgetSource()
+    service_record = ServiceRecord(
+        id=service["id"], service_type="ssh_tasks", name="box", config={"host": "h", "username": "u"}
+    )
+    with (
+        patch("media_library_viewer_api.widgets.sources.get_settings_store", return_value=store),
+        patch("media_library_viewer_api.widgets.sources._build_ssh_client", return_value=fake_client),
+    ):
+        result = await adapter.fetch(service_record, "task_output", {"task_id": task["id"]})
+
+    assert result["exit_status"] == 0
+    runs = store.list_service_task_runs(service_id=service["id"])
+    assert len(runs) == 1
+    assert runs[0]["status"] == "success"

docker-compose.dev.yml

@@ -17,8 +17,7 @@ services:
       PROMETHEUS_FILE_SD_DIR: /app/backend/.cache/prometheus-file-sd
       ALERTMANAGER_URL: ${ALERTMANAGER_URL:-http://alertmanager:9093}
       ALERTMANAGER_WEBHOOK_URL: ${ALERTMANAGER_WEBHOOK_URL:-}
-      GRAFANA_URL: ${GRAFANA_URL:-http://grafana:3000}
-      PROMETHEUS_URL: ${PROMETHEUS_URL:-http://prometheus:9090}
+      MANAGE_ENCRYPTION_KEY: ${MANAGE_ENCRYPTION_KEY:?set MANAGE_ENCRYPTION_KEY in your .env}
     ports:
       - "8000:8000"
     volumes:

docker-compose.yml

@@ -28,8 +28,7 @@ services:
       PROMETHEUS_FILE_SD_DIR: ${PROMETHEUS_FILE_SD_DIR:-/app/backend/.cache/prometheus-file-sd}
       ALERTMANAGER_URL: ${ALERTMANAGER_URL:-http://alertmanager:9093}
       ALERTMANAGER_WEBHOOK_URL: ${ALERTMANAGER_WEBHOOK_URL:-}
-      GRAFANA_URL: ${GRAFANA_URL:-http://grafana:3000}
-      PROMETHEUS_URL: ${PROMETHEUS_URL:-http://prometheus:9090}
+      MANAGE_ENCRYPTION_KEY: ${MANAGE_ENCRYPTION_KEY:?generate one with python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"}
     volumes:
       - ${BACKEND_CACHE_DIR:-./backend-cache}:/app/backend/.cache
     restart: unless-stopped

docs/REQUIREMENTS.md

@@ -256,54 +256,79 @@ fully removed (web-ui-rework; see decision log 2026-06-17).
 - Job templates should remain centralized in `jobs.py` for future extension.
 - Remote job template values must be shell-quoted before execution.
 
-## Configurable Dashboard Widgets
+## Service Registry and Dashboard Widgets
 
 ### Overview
 
-The dashboard is composed of persisted widget instances stored in the backend SQLite
-settings database. Each widget has a type, title, configuration, enabled flag, and
-sort order. The frontend renders enabled widgets in sort order and fetches data
-independently through the backend source adapters.
+External services (Grafana, Prometheus, Jellyfin, Nextcloud, SSH task runner) are
+configured **in the app** and persisted in the backend SQLite database. Each
+service instance holds non-secret config plus encrypted secret fields. Dashboard
+widgets are either **service-bound** (reference a service instance + a widget
+kind declared by that service) or **built-in / service-less** (backups, static
+text).
 
-### Widget types
+Service definitions live as Pydantic modules in the backend
+(`integrations/`); they declare the service config schema, secret fields, and
+the widget kinds the service provides. There is no runtime plugin loading.
 
-- **Jellyfin activity** — live sessions and idle users from a configured Jellyfin machine.
-- **Backups** — backup job summary and active alerts.
-- **Grafana link** — deep-link to a Grafana dashboard or panel (no iframe embedding).
-- **Prometheus metric** — result of a PromQL instant query.
-- **SSH task output** — output of a saved task run on a machine.
+### Services
+
+- **Grafana** — base URL + optional API key; provides a dashboard-link widget.
+- **Prometheus** — base URL + optional bearer token; provides a PromQL metric widget.
+- **Jellyfin** — base URL + API key; provides a live-activity widget.
+- **Nextcloud** — base URL + app password (no widgets yet).
+- **SSH task runner** — host/port/username + saved SSH key reference + optional
+  passphrase; provides a task-output widget. Tasks stay in the global saved-task
+  registry; every run is recorded in `service_task_runs` as history.
+
+Multiple instances per service type are supported. Services are managed from the
+**Services** page (`/services`) and each instance has a detail page at
+`/services/:serviceType/:serviceId`.
+
+### Built-in widgets
+
+- **Backups** — internal backup job summary and active alerts.
 - **Static text** — plain text or markdown note.
 
+These do not reference a service.
+
 ### Security
 
-- Widget `config` may not contain credential keys such as `password`, `token`,
-  `secret`, `api_key`, `private_key`, or `passphrase`, or values that look like
-  secrets (e.g., base64 blobs, `sk-` prefixes).
-- Widgets reuse machine-level Jellyfin/SSH credentials and environment settings for
-  Grafana/Prometheus URLs; no secrets are stored in widget configuration.
-- SSH task widgets only run tasks from the saved-task registry; arbitrary commands
-  are not accepted.
-
-### Addon pages
-
-Each non-core addon gets a dedicated page at `/addons/:addonId`:
-
-- `/addons/grafana`
-- `/addons/prometheus`
-- `/addons/ssh-tasks`
-
-Unknown addons render a "not installed" alert.
+- Service secrets (API keys, tokens, passphrases) are **encrypted at rest** with
+  Fernet using a single env-provided `MANAGE_ENCRYPTION_KEY`, which is always
+  required to start the backend.
+- Widget `config` and service `config` may not contain credential keys or
+  secret-looking values; secrets go in the dedicated secret fields only.
+- Plaintext secrets are never returned by the API; only `secrets_set` flags are
+  surfaced.
+- SSH task widgets only run tasks from the saved-task registry; arbitrary
+  commands are not accepted.
 
 ### API
 
-- `GET /api/widgets/sources` — list source types.
-- `GET /api/widgets/types` — list widget type metadata.
+- `GET /api/services/types` — service definition metadata (config schema,
+  secret fields, widget kinds).
+- `GET /api/services/instances` — list service instances (no plaintext secrets).
+- `POST /api/services/instances` — create instance.
+- `PUT /api/services/instances/{id}` — update instance.
+- `DELETE /api/services/instances/{id}` — delete instance (cascade-deletes
+  widgets referencing it).
+- `GET /api/widgets/builtin` — built-in (service-less) widget kinds.
 - `GET /api/widgets/instances` — list widget instances.
-- `POST /api/widgets/instances` — create instance.
-- `PUT /api/widgets/instances/{id}` — update instance.
-- `DELETE /api/widgets/instances/{id}` — delete instance.
+- `POST/PUT/DELETE /api/widgets/instances/{id}` — widget CRUD.
 - `GET /api/widgets/instances/{id}/data` — fetch widget data.
 
+### Breaking change
+
+Grafana/Prometheus URLs and credentials moved from environment variables into
+service records. The legacy `GRAFANA_URL` / `PROMETHEUS_URL` backend settings and
+the widget/addon-pages model were removed. `MANAGE_ENCRYPTION_KEY` is now required.
+
+> **Follow-up (not in this change):** machine-level Jellyfin/Jellyseerr app
+> config still powers the Media/Users/Files pages. Migrating those onto the
+> service registry (and removing the machine app fields) is a separate change;
+> see `openspec/changes/service-registry/design.md` §12.5.
+
 ## Decision Log
 
 - 2026-06-17: Decommissioned the legacy Manage-side system-metric scraping. Removed the backend `MonitoringPoller` (SSH-ran `df` on every machine every 5 min into a local SQLite `monitoring_machine_actions` table), the entire `services/monitoring_actions.py` module, the `/api/monitoring/poller`, `/api/monitoring/machines/{id}/actions`, and `/api/monitoring/disk` endpoints, the `monitoring_machine_actions` table (DROP on startup), the three `monitoring_poll_*` / `monitoring_action_retention_days` config knobs, and the orphaned frontend `DiskSpaceCard` + `DiskSpace` type. System metrics are now owned exclusively by Prometheus + node_exporter + Grafana. Kept the Alertmanager proxy (`/alerts`, `/alertmanager-status`, `/alertmanager-webhook`), `/prometheus-targets`, `/machines`, the `node_exporter_*` machine fields, and the on-demand `disk_usage` job template.

frontend/src/App.tsx

@@ -22,7 +22,8 @@ import { FileBrowser } from "./pages/FileBrowser";
 import { Actions } from "./pages/Actions";
 import BackupsPage from "./components/BackupsPage";
 import { ObservabilityPage } from "./components/ObservabilityPage";
-import { AddonPage } from "./pages/AddonPage";
+import { ServicePage } from "./pages/ServicePage";
+import { ServicesPage } from "./pages/ServicesPage";
 import { getOidcConfig, isOidcConfigured, setAccessToken } from "./auth";
 import { fetchAppVersion } from "./api/client";
 import { FRONTEND_VERSION_LABEL } from "./version";
@@ -56,6 +57,7 @@ import {
 	LogOut,
 	ChevronLeft,
 	ChevronRight,
+	Boxes,
 } from "lucide-react";
 
 const queryClient = new QueryClient({
@@ -89,6 +91,7 @@ const navItems = [
 	{ path: "/backups", label: "Backups", icon: DatabaseBackup },
 	{ path: "/users", label: "Users", icon: Users },
 	{ path: "/actions", label: "Actions", icon: Zap },
+	{ path: "/services", label: "Services", icon: Boxes },
 	{ path: "/settings", label: "Settings", icon: SettingsIcon },
 ];
 
@@ -450,7 +453,11 @@ function AppInner() {
 								<Route path="/backups" element={<BackupsPage />} />
 								<Route path="/observability" element={<ObservabilityPage />} />
 								<Route path="/settings" element={<Settings />} />
-								<Route path="/addons/:addonId" element={<AddonPage />} />
+								<Route path="/services" element={<ServicesPage />} />
+								<Route
+									path="/services/:serviceType/:serviceId"
+									element={<ServicePage />}
+								/>
 							</Route>
 						</Routes>
 					</BrowserRouter>
@@ -482,7 +489,11 @@ function AppInner() {
 							<Route path="/backups" element={<BackupsPage />} />
 							<Route path="/observability" element={<ObservabilityPage />} />
 							<Route path="/settings" element={<Settings />} />
-							<Route path="/addons/:addonId" element={<AddonPage />} />
+							<Route path="/services" element={<ServicesPage />} />
+							<Route
+								path="/services/:serviceType/:serviceId"
+								element={<ServicePage />}
+							/>
 						</Route>
 					</Routes>
 				</BrowserRouter>

frontend/src/addons/GrafanaAddonPage.tsx

@@ -1,37 +0,0 @@
-import { ExternalLink } from "lucide-react";
-import { Button } from "@/components/ui/button";
-import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
-
-export function GrafanaAddonPage() {
-	const grafanaUrl =
-		(import.meta.env.VITE_GRAFANA_URL as string | undefined) ||
-		"http://localhost:3000";
-
-	return (
-		<div className="flex flex-col gap-4">
-			<h2 className="text-xl font-semibold">Grafana</h2>
-			<Card>
-				<CardHeader>
-					<CardTitle>Metrics & logs</CardTitle>
-				</CardHeader>
-				<CardContent className="flex flex-col gap-3">
-					<p className="text-sm text-muted-foreground">
-						Open the full Grafana instance for dashboards, metrics, and log
-						exploration.
-					</p>
-					<Button asChild>
-						<a
-							href={grafanaUrl}
-							target="_blank"
-							rel="noopener noreferrer"
-							className="inline-flex items-center"
-						>
-							Open Grafana
-							<ExternalLink className="ml-2 h-4 w-4" />
-						</a>
-					</Button>
-				</CardContent>
-			</Card>
-		</div>
-	);
-}

frontend/src/addons/PrometheusAddonPage.tsx

@@ -1,36 +0,0 @@
-import { ExternalLink } from "lucide-react";
-import { Button } from "@/components/ui/button";
-import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
-
-export function PrometheusAddonPage() {
-	const prometheusUrl =
-		(import.meta.env.VITE_PROMETHEUS_URL as string | undefined) ||
-		"http://localhost:9090";
-
-	return (
-		<div className="flex flex-col gap-4">
-			<h2 className="text-xl font-semibold">Prometheus</h2>
-			<Card>
-				<CardHeader>
-					<CardTitle>Metrics explorer</CardTitle>
-				</CardHeader>
-				<CardContent className="flex flex-col gap-3">
-					<p className="text-sm text-muted-foreground">
-						Open Prometheus to run ad-hoc PromQL queries and inspect targets.
-					</p>
-					<Button asChild>
-						<a
-							href={prometheusUrl}
-							target="_blank"
-							rel="noopener noreferrer"
-							className="inline-flex items-center"
-						>
-							Open Prometheus
-							<ExternalLink className="ml-2 h-4 w-4" />
-						</a>
-					</Button>
-				</CardContent>
-			</Card>
-		</div>
-	);
-}

frontend/src/addons/SshTasksAddonPage.tsx

@@ -1,29 +0,0 @@
-import { Terminal } from "lucide-react";
-import { Button } from "@/components/ui/button";
-import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
-import { useNavigate } from "react-router-dom";
-
-export function SshTasksAddonPage() {
-	const navigate = useNavigate();
-
-	return (
-		<div className="flex flex-col gap-4">
-			<h2 className="text-xl font-semibold">SSH tasks</h2>
-			<Card>
-				<CardHeader>
-					<CardTitle>Saved actions</CardTitle>
-				</CardHeader>
-				<CardContent className="flex flex-col gap-3">
-					<p className="text-sm text-muted-foreground">
-						Create, edit, and run saved shell or Python tasks against local or
-						remote machines.
-					</p>
-					<Button onClick={() => navigate("/actions")}>
-						<Terminal className="mr-2 h-4 w-4" />
-						Open Actions
-					</Button>
-				</CardContent>
-			</Card>
-		</div>
-	);
-}

frontend/src/addons/index.ts

@@ -1,3 +0,0 @@
-export { GrafanaAddonPage } from "./GrafanaAddonPage";
-export { PrometheusAddonPage } from "./PrometheusAddonPage";
-export { SshTasksAddonPage } from "./SshTasksAddonPage";

frontend/src/api/client.ts

@@ -134,26 +134,26 @@ async function del<T>(path: string): Promise<T> {
 	return response.json();
 }
 
-// Dashboard
-export const fetchCounts = (machineId?: string) =>
+// Dashboard (Jellyfin-backed; selected via jellyfin_service_id)
+export const fetchCounts = (jellyfinServiceId?: string) =>
 	get<MediaCounts>(
 		"/api/dashboard/counts",
-		machineId ? { machine_id: machineId } : undefined,
+		jellyfinServiceId ? { jellyfin_service_id: jellyfinServiceId } : undefined,
 	);
-export const fetchLibraries = (machineId?: string) =>
+export const fetchLibraries = (jellyfinServiceId?: string) =>
 	get<LibraryCount[]>(
 		"/api/dashboard/libraries",
-		machineId ? { machine_id: machineId } : undefined,
+		jellyfinServiceId ? { jellyfin_service_id: jellyfinServiceId } : undefined,
 	);
-export const fetchActivity = (machineId?: string) =>
+export const fetchActivity = (jellyfinServiceId?: string) =>
 	get<NowPlayingSession[]>(
 		"/api/dashboard/activity",
-		machineId ? { machine_id: machineId } : undefined,
+		jellyfinServiceId ? { jellyfin_service_id: jellyfinServiceId } : undefined,
 	);
-export const fetchUsers = (machineId?: string) =>
+export const fetchUsers = (jellyfinServiceId?: string) =>
 	get<UserDirectoryResponse>(
 		"/api/users",
-		machineId ? { machine_id: machineId } : undefined,
+		jellyfinServiceId ? { jellyfin_service_id: jellyfinServiceId } : undefined,
 	);
 
 // Backward-compatible alias used by older hooks/components.
@@ -293,27 +293,27 @@ export const resetLocalDatabase = (payload: ResetLocalDatabaseInput) =>
 	);
 
 // Media
-export const fetchMediaStatus = (machineId?: string) =>
+export const fetchMediaStatus = (jellyfinServiceId?: string) =>
 	get<MediaIndexStatus>(
 		"/api/media/status",
-		machineId ? { machine_id: machineId } : undefined,
+		jellyfinServiceId ? { jellyfin_service_id: jellyfinServiceId } : undefined,
 	);
-export const buildMediaIndex = (machineId?: string) =>
+export const buildMediaIndex = (jellyfinServiceId?: string) =>
 	post<MediaIndexActionResponse>(
-		machineId
-			? `/api/media/build?machine_id=${encodeURIComponent(machineId)}`
+		jellyfinServiceId
+			? `/api/media/build?jellyfin_service_id=${encodeURIComponent(jellyfinServiceId)}`
 			: "/api/media/build",
 	);
-export const stopMediaIndexBuild = (machineId?: string) =>
+export const stopMediaIndexBuild = (jellyfinServiceId?: string) =>
 	post<MediaIndexActionResponse>(
-		machineId
-			? `/api/media/stop?machine_id=${encodeURIComponent(machineId)}`
+		jellyfinServiceId
+			? `/api/media/stop?jellyfin_service_id=${encodeURIComponent(jellyfinServiceId)}`
 			: "/api/media/stop",
 	);
-export const forceStopMediaIndexBuild = (machineId?: string) =>
+export const forceStopMediaIndexBuild = (jellyfinServiceId?: string) =>
 	post<MediaIndexActionResponse>(
-		machineId
-			? `/api/media/force-stop?machine_id=${encodeURIComponent(machineId)}`
+		jellyfinServiceId
+			? `/api/media/force-stop?jellyfin_service_id=${encodeURIComponent(jellyfinServiceId)}`
 			: "/api/media/force-stop",
 	);
 export const queryMedia = (params: {
@@ -325,7 +325,7 @@ export const queryMedia = (params: {
 	sort_order?: string;
 	limit?: number;
 	offset?: number;
-	machineId?: string;
+	jellyfinServiceId?: string;
 }) =>
 	get<MediaQueryResponse>("/api/media/query", {
 		libraries: params.libraries || "",
@@ -336,7 +336,9 @@ export const queryMedia = (params: {
 		sort_order: params.sort_order || "Ascending",
 		limit: String(params.limit || 100),
 		offset: String(params.offset || 0),
-		...(params.machineId ? { machine_id: params.machineId } : {}),
+		...(params.jellyfinServiceId
+			? { jellyfin_service_id: params.jellyfinServiceId }
+			: {}),
 	});
 
 // Files

frontend/src/api/services.ts

@@ -0,0 +1,59 @@
+import type {
+	ServiceInstance,
+	ServiceInstanceInput,
+	ServiceTypeInfo,
+} from "../types";
+
+const API_BASE = "/api";
+
+export async function fetchServiceTypes(): Promise<ServiceTypeInfo[]> {
+	const res = await fetch(`${API_BASE}/services/types`);
+	if (!res.ok) throw new Error("Failed to fetch service types");
+	return res.json();
+}
+
+export async function fetchServiceInstances(
+	serviceType?: string,
+): Promise<ServiceInstance[]> {
+	const query = serviceType
+		? `?service_type=${encodeURIComponent(serviceType)}`
+		: "";
+	const res = await fetch(`${API_BASE}/services/instances${query}`);
+	if (!res.ok) throw new Error("Failed to fetch service instances");
+	return res.json();
+}
+
+export async function createServiceInstance(
+	input: ServiceInstanceInput,
+): Promise<ServiceInstance> {
+	const res = await fetch(`${API_BASE}/services/instances`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(input),
+	});
+	if (!res.ok) throw new Error("Failed to create service instance");
+	return res.json();
+}
+
+export async function updateServiceInstance(
+	input: ServiceInstanceInput,
+): Promise<ServiceInstance> {
+	if (!input.id) throw new Error("Service ID is required for update");
+	const res = await fetch(`${API_BASE}/services/instances/${input.id}`, {
+		method: "PUT",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(input),
+	});
+	if (!res.ok) throw new Error("Failed to update service instance");
+	return res.json();
+}
+
+export async function deleteServiceInstance(
+	serviceId: string,
+): Promise<{ status: string }> {
+	const res = await fetch(`${API_BASE}/services/instances/${serviceId}`, {
+		method: "DELETE",
+	});
+	if (!res.ok) throw new Error("Failed to delete service instance");
+	return res.json();
+}

frontend/src/api/widgets.ts

@@ -1,21 +1,17 @@
 import type {
+	BuiltinWidgetKindInfo,
 	WidgetDataResponse,
 	WidgetInstance,
 	WidgetInstanceInput,
-	WidgetTypeInfo,
 } from "../types";
 
 const API_BASE = "/api";
 
-export async function fetchWidgetSources(): Promise<string[]> {
-	const res = await fetch(`${API_BASE}/widgets/sources`);
-	if (!res.ok) throw new Error("Failed to fetch widget sources");
-	return res.json();
-}
-
-export async function fetchWidgetTypes(): Promise<WidgetTypeInfo[]> {
-	const res = await fetch(`${API_BASE}/widgets/types`);
-	if (!res.ok) throw new Error("Failed to fetch widget types");
+export async function fetchBuiltinWidgetKinds(): Promise<
+	BuiltinWidgetKindInfo[]
+> {
+	const res = await fetch(`${API_BASE}/widgets/builtin`);
+	if (!res.ok) throw new Error("Failed to fetch built-in widget kinds");
 	return res.json();
 }
 

frontend/src/components/WidgetConfigDialog.tsx

@@ -23,36 +23,29 @@ import {
 	useDeleteWidgetInstance,
 	useSaveWidgetInstance,
 	useWidgetInstances,
-	useWidgetTypes,
 } from "../hooks/useWidgets";
-import { useMonitoringSettings, useTasks } from "../hooks/useSettings";
-import type {
-	MonitoringMachine,
-	SavedTask,
-	WidgetInstance,
-	WidgetInstanceInput,
-} from "../types";
+import { useServiceInstances } from "../hooks/useServices";
+import { useTasks } from "../hooks/useSettings";
+import type { WidgetInstance, WidgetInstanceInput } from "../types";
 import {
-	getWidgetDefinition,
-	listWidgetTypes,
-	type WidgetDefinition,
-} from "../widgets/registry";
+	BUILTIN_WIDGETS,
+	SERVICE_REGISTRY,
+	type ServiceWidgetBinding,
+} from "../integrations/registry";
 
 interface Props {
 	open: boolean;
 	onClose: () => void;
 }
 
-function emptyDraft(widgetType: string): WidgetInstanceInput {
-	const def = getWidgetDefinition(widgetType);
-	return {
-		addon_id: def?.addonId ?? "",
-		widget_type: widgetType,
-		title: def?.name ?? "",
-		config: { ...(def?.defaultConfig ?? {}) },
-		enabled: true,
-		sort_order: 0,
-	};
+interface Draft {
+	id?: string;
+	serviceId: string | null;
+	widgetKind: string;
+	title: string;
+	config: Record<string, unknown>;
+	enabled: boolean;
+	sortOrder: number;
 }
 
 function Field({
@@ -77,126 +70,88 @@ function Field({
 	);
 }
 
-function WidgetConfigFields({
-	definition,
+function bindingLabel(serviceId: string | null, widgetKind: string): string {
+	if (serviceId === null)
+		return BUILTIN_WIDGETS[widgetKind]?.name ?? widgetKind;
+	return widgetKind;
+}
+
+function WidgetConfigEditor({
+	binding,
+	isTaskOutput,
 	config,
 	onChange,
-	machines,
 	tasks,
 }: {
-	definition: WidgetDefinition;
+	binding: ServiceWidgetBinding | undefined;
+	isTaskOutput: boolean;
 	config: Record<string, unknown>;
 	onChange: (config: Record<string, unknown>) => void;
-	machines: MonitoringMachine[];
-	tasks: SavedTask[];
+	tasks: { id: string; name: string; enabled: boolean }[];
 }) {
+	// SSH task output gets a dedicated task picker; everything else gets a
+	// generic text field per top-level schema property.
+	if (isTaskOutput) {
+		return (
+			<Field label="Saved task" htmlFor="widget-task-id">
+				<Select
+					value={String(config.task_id ?? "")}
+					onValueChange={(v) => onChange({ ...config, task_id: v })}
+				>
+					<SelectTrigger id="widget-task-id">
+						<SelectValue placeholder="Select a task" />
+					</SelectTrigger>
+					<SelectContent>
+						{tasks
+							.filter((t) => t.enabled)
+							.map((t) => (
+								<SelectItem key={t.id} value={t.id}>
+									{t.name}
+								</SelectItem>
+							))}
+					</SelectContent>
+				</Select>
+			</Field>
+		);
+	}
+
+	const properties = binding
+		? Object.entries(
+				(
+					binding.configSchema as
+						| { properties?: Record<string, unknown> }
+						| undefined
+				)?.properties ?? {},
+			)
+		: [];
+
+	if (properties.length === 0) return null;
+
 	return (
 		<div className="flex flex-col gap-3">
-			{definition.configFields.map((field) => {
-				const value = config[field.key] ?? "";
-
-				if (
-					definition.widgetType === "jellyfin" &&
-					field.key === "machine_id"
-				) {
-					return (
-						<Field
-							key={field.key}
-							label={field.label}
-							htmlFor={field.key}
-							helper={field.helper}
-						>
-							<Select
-								value={String(value)}
-								onValueChange={(v) => onChange({ ...config, [field.key]: v })}
-							>
-								<SelectTrigger id={field.key}>
-									<SelectValue />
-								</SelectTrigger>
-								<SelectContent>
-									<SelectItem value="">Default</SelectItem>
-									{machines
-										.filter((m) => m.enabled && m.services.includes("jellyfin"))
-										.map((m) => (
-											<SelectItem key={m.id} value={m.id}>
-												{m.name}
-											</SelectItem>
-										))}
-								</SelectContent>
-							</Select>
-						</Field>
-					);
-				}
-
-				if (definition.widgetType === "ssh-task" && field.key === "task_id") {
-					return (
-						<Field
-							key={field.key}
-							label={field.label}
-							htmlFor={field.key}
-							helper={field.helper}
-						>
-							<Select
-								value={String(value)}
-								onValueChange={(v) => onChange({ ...config, [field.key]: v })}
-							>
-								<SelectTrigger id={field.key}>
-									<SelectValue />
-								</SelectTrigger>
-								<SelectContent>
-									{tasks
-										.filter((t) => t.enabled)
-										.map((t) => (
-											<SelectItem key={t.id} value={t.id}>
-												{t.name}
-											</SelectItem>
-										))}
-								</SelectContent>
-							</Select>
-						</Field>
-					);
-				}
-
-				if (field.type === "number") {
-					return (
-						<Field
-							key={field.key}
-							label={field.label}
-							htmlFor={field.key}
-							helper={field.helper}
-						>
-							<Input
-								id={field.key}
-								type="number"
-								value={String(value)}
-								onChange={(e) =>
-									onChange({
-										...config,
-										[field.key]:
-											e.target.value === ""
-												? undefined
-												: Number(e.target.value),
-									})
-								}
-							/>
-						</Field>
-					);
-				}
-
+			{properties.map(([key, schema]) => {
+				const isNumber =
+					(schema as { type?: string }).type === "integer" ||
+					(schema as { type?: string }).type === "number";
 				return (
 					<Field
-						key={field.key}
-						label={field.label}
-						htmlFor={field.key}
-						helper={field.helper}
+						key={key}
+						label={key}
+						htmlFor={`widget-cfg-${key}`}
+						helper={(schema as { description?: string }).description}
 					>
 						<Input
-							id={field.key}
-							value={String(value)}
+							id={`widget-cfg-${key}`}
+							type={isNumber ? "number" : "text"}
+							value={String(config[key] ?? "")}
 							onChange={(e) =>
 								onChange({
 									...config,
-									[field.key]: e.target.value,
+									[key]: isNumber
+										? e.target.value === ""
+											? undefined
+											: Number(e.target.value)
+										: e.target.value,
 								})
 							}
 						/>
@@ -209,16 +164,12 @@ function WidgetConfigFields({
 
 export function WidgetConfigDialog({ open, onClose }: Props) {
 	const { data: instances = [] } = useWidgetInstances();
-	const { data: types = [] } = useWidgetTypes();
-	const { data: machines = [] } = useMonitoringSettings();
+	const { data: services = [] } = useServiceInstances();
 	const { data: tasks = [] } = useTasks();
 	const saveWidget = useSaveWidgetInstance();
 	const deleteWidget = useDeleteWidgetInstance();
 
-	const [draft, setDraft] = useState<WidgetInstanceInput | null>(null);
-	const [editingId, setEditingId] = useState<string | null>(null);
-
-	const registryDefinitions = useMemo(() => listWidgetTypes(), []);
+	const [draft, setDraft] = useState<Draft | null>(null);
 
 	const sortedInstances = useMemo(
 		() =>
@@ -228,39 +179,72 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 		[instances],
 	);
 
-	function startAdd(widgetType: string) {
-		setDraft(emptyDraft(widgetType));
-		setEditingId(null);
+	function startAddBuiltIn(kind: string) {
+		const binding = BUILTIN_WIDGETS[kind];
+		setDraft({
+			serviceId: null,
+			widgetKind: kind,
+			title: binding?.name ?? kind,
+			config: { ...(binding?.defaultConfig ?? {}) },
+			enabled: true,
+			sortOrder: 0,
+		});
+	}
+
+	function startAddService(serviceId: string, kind: string) {
+		const binding = SERVICE_REGISTRY[
+			services.find((s) => s.id === serviceId)?.service_type ?? ""
+		]?.widgets.find((w) => w.kind === kind);
+		setDraft({
+			serviceId,
+			widgetKind: kind,
+			title: binding?.name ?? kind,
+			config: { ...(binding?.defaultConfig ?? {}) },
+			enabled: true,
+			sortOrder: 0,
+		});
 	}
 
 	function startEdit(instance: WidgetInstance) {
 		setDraft({
 			id: instance.id,
-			addon_id: instance.addon_id,
-			widget_type: instance.widget_type,
+			serviceId: instance.service_id,
+			widgetKind: instance.widget_kind,
 			title: instance.title,
 			config: instance.config,
 			enabled: instance.enabled,
-			sort_order: instance.sort_order,
+			sortOrder: instance.sort_order,
 		});
-		setEditingId(instance.id);
 	}
 
 	function reset() {
 		setDraft(null);
-		setEditingId(null);
 	}
 
 	async function saveDraft() {
 		if (!draft) return;
-		await saveWidget.mutateAsync(draft);
+		const input: WidgetInstanceInput = {
+			id: draft.id ?? null,
+			service_id: draft.serviceId,
+			widget_kind: draft.widgetKind,
+			title: draft.title,
+			config: draft.config,
+			enabled: draft.enabled,
+			sort_order: draft.sortOrder,
+		};
+		await saveWidget.mutateAsync(input);
 		reset();
 	}
 
 	async function toggleEnabled(instance: WidgetInstance) {
 		await saveWidget.mutateAsync({
-			...instance,
+			id: instance.id,
+			service_id: instance.service_id,
+			widget_kind: instance.widget_kind,
+			title: instance.title,
+			config: instance.config,
 			enabled: !instance.enabled,
+			sort_order: instance.sort_order,
 		});
 	}
 
@@ -286,7 +270,17 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 		}
 	}
 
-	const definition = draft ? getWidgetDefinition(draft.widget_type) : undefined;
+	const draftBinding = draft
+		? draft.serviceId
+			? SERVICE_REGISTRY[
+					services.find((s) => s.id === draft.serviceId)?.service_type ?? ""
+				]?.widgets.find((w) => w.kind === draft.widgetKind)
+			: BUILTIN_WIDGETS[draft.widgetKind]
+		: undefined;
+	const isTaskOutput =
+		draft?.serviceId !== null &&
+		services.find((s) => s.id === draft?.serviceId)?.service_type ===
+			"ssh_tasks";
 
 	return (
 		<Dialog open={open} onOpenChange={handleClose}>
@@ -294,18 +288,15 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 				<DialogHeader>
 					<DialogTitle>
 						{draft
-							? editingId
+							? draft.id
 								? "Edit widget"
 								: "Add widget"
 							: "Dashboard widgets"}
 					</DialogTitle>
 				</DialogHeader>
 
-				{draft && definition ? (
+				{draft ? (
 					<div className="flex flex-col gap-4">
-						<p className="text-sm text-muted-foreground">
-							{definition.description}
-						</p>
 						<div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
 							<Field label="Title" htmlFor="widget-title">
 								<Input
@@ -320,11 +311,11 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 								<Input
 									id="widget-sort-order"
 									type="number"
-									value={String(draft.sort_order)}
+									value={String(draft.sortOrder)}
 									onChange={(e) =>
 										setDraft({
 											...draft,
-											sort_order:
+											sortOrder:
 												e.target.value === "" ? 0 : Number(e.target.value),
 										})
 									}
@@ -341,11 +332,11 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 							/>
 							<Label htmlFor="widget-enabled">Enabled</Label>
 						</div>
-						<WidgetConfigFields
-							definition={definition}
+						<WidgetConfigEditor
+							binding={draftBinding}
+							isTaskOutput={!!isTaskOutput}
 							config={draft.config}
 							onChange={(config) => setDraft({ ...draft, config })}
-							machines={machines}
 							tasks={tasks}
 						/>
 						<div className="flex justify-end gap-2">
@@ -368,7 +359,9 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 						) : (
 							<div className="flex flex-col gap-2">
 								{sortedInstances.map((instance, index) => {
-									const typeDef = getWidgetDefinition(instance.widget_type);
+									const serviceName = instance.service_id
+										? services.find((s) => s.id === instance.service_id)?.name
+										: "Built-in";
 									return (
 										<div
 											key={instance.id}
@@ -378,8 +371,16 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 												<div className="flex items-center gap-2">
 													<span className="font-medium">{instance.title}</span>
 													<Badge variant="outline">
-														{typeDef?.name ?? instance.widget_type}
+														{bindingLabel(
+															instance.service_id,
+															instance.widget_kind,
+														)}
 													</Badge>
+													{serviceName ? (
+														<span className="text-xs text-muted-foreground">
+															{serviceName}
+														</span>
+													) : null}
 													{!instance.enabled ? (
 														<Badge variant="secondary">disabled</Badge>
 													) : null}
@@ -435,27 +436,40 @@ export function WidgetConfigDialog({ open, onClose }: Props) {
 						<div className="flex flex-col gap-2">
 							<p className="text-sm font-medium">Add widget</p>
 							<div className="flex flex-wrap gap-2">
-								{registryDefinitions.map((def) => (
+								{Object.values(BUILTIN_WIDGETS).map((b) => (
 									<Button
-										key={def.widgetType}
+										key={b.kind}
 										variant="outline"
 										size="sm"
-										onClick={() => startAdd(def.widgetType)}
+										onClick={() => startAddBuiltIn(b.kind)}
 									>
 										<Plus className="mr-1 h-3 w-3" />
-										{def.name}
+										{b.name}
 									</Button>
 								))}
+								{services
+									.filter((s) => s.enabled)
+									.flatMap((s) =>
+										(SERVICE_REGISTRY[s.service_type]?.widgets ?? []).map(
+											(w) => (
+												<Button
+													key={`${s.id}:${w.kind}`}
+													variant="outline"
+													size="sm"
+													onClick={() => startAddService(s.id, w.kind)}
+												>
+													<Plus className="mr-1 h-3 w-3" />
+													{w.name} · {s.name}
+												</Button>
+											),
+										),
+									)}
 							</div>
+							<p className="text-xs text-muted-foreground">
+								Configure services on their service pages to unlock more
+								widgets.
+							</p>
 						</div>
-
-						{types.length === 0 ? (
-							<Alert>
-								<AlertDescription>
-									Widget registry is empty. Backend may not be running.
-								</AlertDescription>
-							</Alert>
-						) : null}
 					</div>
 				)}
 			</DialogContent>

frontend/src/components/WidgetInstance.tsx

@@ -1,5 +1,6 @@
 import { Alert, AlertDescription } from "@/components/ui/alert";
-import { getWidgetDefinition } from "../widgets/registry";
+import { useServiceInstances } from "../hooks/useServices";
+import { resolveWidget } from "../integrations/registry";
 import type { WidgetInstance } from "../types";
 import { SectionCard } from "./SectionCard";
 
@@ -7,20 +8,29 @@ interface Props {
 	widget: WidgetInstance;
 }
 
-export function WidgetInstance({ widget }: Props) {
-	const def = getWidgetDefinition(widget.widget_type);
-	if (!def) {
+export function WidgetInstanceCard({ widget }: Props) {
+	const { data: services = [] } = useServiceInstances();
+	const resolved = resolveWidget(widget, services);
+
+	if (!resolved) {
+		const label = widget.service_id
+			? `Unknown widget: ${widget.widget_kind} (service-bound)`
+			: `Unknown widget: ${widget.widget_kind} (built-in)`;
 		return (
 			<SectionCard title={widget.title}>
 				<Alert>
-					<AlertDescription>
-						Unknown widget type: {widget.widget_type}
-					</AlertDescription>
+					<AlertDescription>{label}</AlertDescription>
 				</Alert>
 			</SectionCard>
 		);
 	}
 
-	const Component = def.component;
-	return <Component widget={widget} />;
+	const Component = resolved.component;
+	return (
+		<Component
+			widget={widget}
+			refreshIntervalMs={resolved.refreshIntervalMs}
+			description={resolved.description}
+		/>
+	);
 }

frontend/src/hooks/useDashboard.ts

@@ -9,26 +9,26 @@ import {
 } from "../api/client";
 import type { DashboardShortcutInput } from "../types";
 
-export function useCounts(machineId?: string) {
+export function useCounts(jellyfinServiceId?: string) {
 	return useQuery({
-		queryKey: ["dashboard", "counts", machineId ?? "default"],
-		queryFn: () => fetchCounts(machineId),
+		queryKey: ["dashboard", "counts", jellyfinServiceId ?? "default"],
+		queryFn: () => fetchCounts(jellyfinServiceId),
 		staleTime: 5 * 60 * 1000,
 	});
 }
 
-export function useLibraries(machineId?: string) {
+export function useLibraries(jellyfinServiceId?: string) {
 	return useQuery({
-		queryKey: ["dashboard", "libraries", machineId ?? "default"],
-		queryFn: () => fetchLibraries(machineId),
+		queryKey: ["dashboard", "libraries", jellyfinServiceId ?? "default"],
+		queryFn: () => fetchLibraries(jellyfinServiceId),
 		staleTime: 5 * 60 * 1000,
 	});
 }
 
-export function useActivity(machineId?: string) {
+export function useActivity(jellyfinServiceId?: string) {
 	return useQuery({
-		queryKey: ["dashboard", "activity", machineId ?? "default"],
-		queryFn: () => fetchActivity(machineId),
+		queryKey: ["dashboard", "activity", jellyfinServiceId ?? "default"],
+		queryFn: () => fetchActivity(jellyfinServiceId),
 		refetchInterval: 15_000,
 	});
 }

frontend/src/hooks/useMedia.ts

@@ -7,10 +7,10 @@ import {
 	forceStopMediaIndexBuild,
 } from "../api/client";
 
-export function useMediaStatus(machineId?: string) {
+export function useMediaStatus(jellyfinServiceId?: string) {
 	return useQuery({
-		queryKey: ["media", "status", machineId ?? "default"],
-		queryFn: () => fetchMediaStatus(machineId),
+		queryKey: ["media", "status", jellyfinServiceId ?? "default"],
+		queryFn: () => fetchMediaStatus(jellyfinServiceId),
 		staleTime: 5_000,
 		refetchInterval: (query) =>
 			query.state.data?.build_running ? 1000 : false,
@@ -27,7 +27,7 @@ export function useMediaQuery(params: {
 	sort_order?: string;
 	limit?: number;
 	offset?: number;
-	machineId?: string;
+	jellyfinServiceId?: string;
 	enabled?: boolean;
 }) {
 	const { enabled = true, ...queryParams } = params;
@@ -44,30 +44,30 @@ function invalidateMedia(queryClient: ReturnType<typeof useQueryClient>) {
 	queryClient.invalidateQueries({ queryKey: ["media"] });
 }
 
-export function useBuildIndex(machineId?: string) {
+export function useBuildIndex(jellyfinServiceId?: string) {
 	const queryClient = useQueryClient();
 	return useMutation({
-		mutationFn: () => buildMediaIndex(machineId),
+		mutationFn: () => buildMediaIndex(jellyfinServiceId),
 		onSuccess: () => {
 			invalidateMedia(queryClient);
 		},
 	});
 }
 
-export function useStopBuildIndex(machineId?: string) {
+export function useStopBuildIndex(jellyfinServiceId?: string) {
 	const queryClient = useQueryClient();
 	return useMutation({
-		mutationFn: () => stopMediaIndexBuild(machineId),
+		mutationFn: () => stopMediaIndexBuild(jellyfinServiceId),
 		onSuccess: () => {
 			invalidateMedia(queryClient);
 		},
 	});
 }
 
-export function useForceStopBuildIndex(machineId?: string) {
+export function useForceStopBuildIndex(jellyfinServiceId?: string) {
 	const queryClient = useQueryClient();
 	return useMutation({
-		mutationFn: () => forceStopMediaIndexBuild(machineId),
+		mutationFn: () => forceStopMediaIndexBuild(jellyfinServiceId),
 		onSuccess: () => {
 			invalidateMedia(queryClient);
 		},

frontend/src/hooks/useServices.ts

@@ -0,0 +1,47 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import {
+	createServiceInstance,
+	deleteServiceInstance,
+	fetchServiceInstances,
+	fetchServiceTypes,
+	updateServiceInstance,
+} from "../api/services";
+import type { ServiceInstanceInput } from "../types";
+
+export function useServiceTypes() {
+	return useQuery({
+		queryKey: ["services", "types"],
+		queryFn: fetchServiceTypes,
+		staleTime: 5 * 60 * 1000,
+	});
+}
+
+export function useServiceInstances(serviceType?: string) {
+	return useQuery({
+		queryKey: ["services", "instances", serviceType ?? "all"],
+		queryFn: () => fetchServiceInstances(serviceType),
+		refetchInterval: 60_000,
+	});
+}
+
+export function useSaveServiceInstance() {
+	const queryClient = useQueryClient();
+	return useMutation({
+		mutationFn: (input: ServiceInstanceInput) =>
+			input.id ? updateServiceInstance(input) : createServiceInstance(input),
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: ["services", "instances"] });
+		},
+	});
+}
+
+export function useDeleteServiceInstance() {
+	const queryClient = useQueryClient();
+	return useMutation({
+		mutationFn: (serviceId: string) => deleteServiceInstance(serviceId),
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: ["services", "instances"] });
+			queryClient.invalidateQueries({ queryKey: ["widgets", "instances"] });
+		},
+	});
+}

frontend/src/hooks/useUsers.ts

@@ -2,10 +2,10 @@ import { useQuery } from "@tanstack/react-query";
 import { fetchUsers } from "../api/client";
 import type { UserDirectoryResponse } from "../types";
 
-export function useUsers(machineId?: string) {
+export function useUsers(jellyfinServiceId?: string) {
 	return useQuery<UserDirectoryResponse>({
-		queryKey: ["users", machineId ?? "default"],
-		queryFn: () => fetchUsers(machineId),
+		queryKey: ["users", jellyfinServiceId ?? "default"],
+		queryFn: () => fetchUsers(jellyfinServiceId),
 		staleTime: 30_000,
 	});
 }

frontend/src/hooks/useWidgets.ts

@@ -2,10 +2,9 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import {
 	createWidgetInstance,
 	deleteWidgetInstance,
+	fetchBuiltinWidgetKinds,
 	fetchWidgetData,
 	fetchWidgetInstances,
-	fetchWidgetSources,
-	fetchWidgetTypes,
 	updateWidgetInstance,
 } from "../api/widgets";
 import type { WidgetInstanceInput } from "../types";
@@ -49,16 +48,10 @@ export function useDeleteWidgetInstance() {
 	});
 }
 
-export function useWidgetSources() {
+export function useBuiltinWidgetKinds() {
 	return useQuery({
-		queryKey: ["widgets", "sources"],
-		queryFn: fetchWidgetSources,
-	});
-}
-
-export function useWidgetTypes() {
-	return useQuery({
-		queryKey: ["widgets", "types"],
-		queryFn: fetchWidgetTypes,
+		queryKey: ["widgets", "builtin"],
+		queryFn: fetchBuiltinWidgetKinds,
+		staleTime: 5 * 60 * 1000,
 	});
 }

frontend/src/integrations/registry.test.ts

@@ -0,0 +1,100 @@
+import { describe, expect, it } from "vitest";
+import {
+	BUILTIN_WIDGETS,
+	SERVICE_REGISTRY,
+	getBuiltinBinding,
+	getServiceBinding,
+	resolveWidget,
+} from "./registry";
+import type { ServiceInstance, WidgetInstance } from "../types";
+
+describe("service registry", () => {
+	it("registers the five backend service types", () => {
+		expect(Object.keys(SERVICE_REGISTRY).sort()).toEqual([
+			"grafana",
+			"jellyfin",
+			"nextcloud",
+			"prometheus",
+			"ssh_tasks",
+		]);
+	});
+
+	it("binds widget kinds per service", () => {
+		expect(SERVICE_REGISTRY.grafana.widgets.map((w) => w.kind)).toEqual([
+			"link",
+		]);
+		expect(SERVICE_REGISTRY.ssh_tasks.widgets.map((w) => w.kind)).toEqual([
+			"task_output",
+		]);
+		expect(SERVICE_REGISTRY.nextcloud.widgets).toEqual([]);
+	});
+
+	it("registers the two built-in widget kinds", () => {
+		expect(Object.keys(BUILTIN_WIDGETS).sort()).toEqual(["backups", "static"]);
+	});
+
+	it("resolves a service-bound widget via the services list", () => {
+		const widget: WidgetInstance = {
+			id: "w1",
+			service_id: "s1",
+			widget_kind: "link",
+			title: "Dashboard",
+			config: {},
+			enabled: true,
+			sort_order: 0,
+			created_at: 0,
+			updated_at: 0,
+		};
+		const services: ServiceInstance[] = [
+			{
+				id: "s1",
+				service_type: "grafana",
+				name: "Grafana",
+				config: { base_url: "https://grafana.example.com" },
+				secrets_set: { api_key: true },
+				enabled: true,
+				created_at: 0,
+				updated_at: 0,
+			},
+		];
+		const resolved = resolveWidget(widget, services);
+		expect(resolved).toBeDefined();
+		expect(resolved?.refreshIntervalMs).toBe(0);
+	});
+
+	it("resolves a built-in widget without a service", () => {
+		const widget: WidgetInstance = {
+			id: "w2",
+			service_id: null,
+			widget_kind: "static",
+			title: "Note",
+			config: { text: "hi" },
+			enabled: true,
+			sort_order: 0,
+			created_at: 0,
+			updated_at: 0,
+		};
+		const resolved = resolveWidget(widget, []);
+		expect(resolved).toBeDefined();
+	});
+
+	it("returns undefined for an unknown widget kind", () => {
+		const widget: WidgetInstance = {
+			id: "w3",
+			service_id: null,
+			widget_kind: "bogus",
+			title: "x",
+			config: {},
+			enabled: true,
+			sort_order: 0,
+			created_at: 0,
+			updated_at: 0,
+		};
+		expect(resolveWidget(widget, [])).toBeUndefined();
+	});
+
+	it("lookups return undefined for unknown types", () => {
+		expect(getServiceBinding("nope")).toBeUndefined();
+		expect(getBuiltinBinding("nope")).toBeUndefined();
+	});
+});

frontend/src/integrations/registry.ts

@@ -0,0 +1,213 @@
+import type { ComponentType } from "react";
+import { BackupsWidget } from "../widgets/BackupsWidget";
+import { GrafanaLinkWidget } from "../widgets/GrafanaLinkWidget";
+import { JellyfinWidget } from "../widgets/JellyfinWidget";
+import { PrometheusMetricWidget } from "../widgets/PrometheusMetricWidget";
+import { SshTaskWidget } from "../widgets/SshTaskWidget";
+import { StaticWidget } from "../widgets/StaticWidget";
+import type {
+	ServiceInstance,
+	ServiceTypeInfo,
+	WidgetInstance,
+} from "../types";
+
+/**
+ * Closed frontend registry mirroring the backend service definitions.
+ *
+ * Each service type maps its widget kinds to a presentational component and a
+ * refresh interval. Built-in (service-less) kinds are listed separately.
+ */
+
+export interface WidgetComponentProps {
+	widget: WidgetInstance;
+	refreshIntervalMs: number;
+	description?: string;
+}
+
+export interface ServiceWidgetBinding {
+	kind: string;
+	name: string;
+	description: string;
+	refreshIntervalMs: number;
+	defaultConfig: Record<string, unknown>;
+	configSchema: Record<string, unknown>;
+	component: ComponentType<WidgetComponentProps>;
+}
+
+export interface ServiceBinding {
+	serviceType: string;
+	name: string;
+	description: string;
+	widgets: ServiceWidgetBinding[];
+}
+
+export const SERVICE_REGISTRY: Record<string, ServiceBinding> = {
+	grafana: {
+		serviceType: "grafana",
+		name: "Grafana",
+		description: "Dashboards, metrics, and logs.",
+		widgets: [
+			{
+				kind: "link",
+				name: "Dashboard link",
+				description: "Deep-link to a Grafana dashboard or panel.",
+				refreshIntervalMs: 0,
+				defaultConfig: { dashboard_uid: "" },
+				configSchema: {
+					type: "object",
+					properties: {
+						dashboard_uid: { type: "string" },
+						panel_id: { type: "integer" },
+					},
+					required: ["dashboard_uid"],
+				},
+				component: GrafanaLinkWidget,
+			},
+		],
+	},
+	prometheus: {
+		serviceType: "prometheus",
+		name: "Prometheus",
+		description: "Metrics storage and PromQL queries.",
+		widgets: [
+			{
+				kind: "metric",
+				name: "Metric",
+				description: "Instant query result rendered as a metric.",
+				refreshIntervalMs: 30_000,
+				defaultConfig: { promql: "" },
+				configSchema: {
+					type: "object",
+					properties: { promql: { type: "string" } },
+					required: ["promql"],
+				},
+				component: PrometheusMetricWidget,
+			},
+		],
+	},
+	jellyfin: {
+		serviceType: "jellyfin",
+		name: "Jellyfin",
+		description: "Media server with live session activity.",
+		widgets: [
+			{
+				kind: "activity",
+				name: "Activity",
+				description: "Live sessions and idle users.",
+				refreshIntervalMs: 30_000,
+				defaultConfig: {},
+				configSchema: { type: "object", properties: {}, required: [] },
+				component: JellyfinWidget,
+			},
+		],
+	},
+	nextcloud: {
+		serviceType: "nextcloud",
+		name: "Nextcloud",
+		description: "Self-hosted files and collaboration.",
+		widgets: [],
+	},
+	ssh_tasks: {
+		serviceType: "ssh_tasks",
+		name: "SSH task runner",
+		description: "Run reusable saved tasks over SSH and keep run history.",
+		widgets: [
+			{
+				kind: "task_output",
+				name: "Task output",
+				description: "Output of a saved task run.",
+				refreshIntervalMs: 0,
+				defaultConfig: { task_id: "" },
+				configSchema: {
+					type: "object",
+					properties: { task_id: { type: "string" } },
+					required: ["task_id"],
+				},
+				component: SshTaskWidget,
+			},
+		],
+	},
+};
+
+export const BUILTIN_WIDGETS: Record<string, ServiceWidgetBinding> = {
+	backups: {
+		kind: "backups",
+		name: "Backups",
+		description: "Backup job summary and active alerts.",
+		refreshIntervalMs: 60_000,
+		defaultConfig: {},
+		configSchema: { type: "object", properties: {}, required: [] },
+		component: BackupsWidget,
+	},
+	static: {
+		kind: "static",
+		name: "Static text",
+		description: "Plain text or markdown note.",
+		refreshIntervalMs: 0,
+		defaultConfig: { text: "" },
+		configSchema: {
+			type: "object",
+			properties: { text: { type: "string" } },
+			required: ["text"],
+		},
+		component: StaticWidget,
+	},
+};
+
+export function getServiceBinding(
+	serviceType: string,
+): ServiceBinding | undefined {
+	return SERVICE_REGISTRY[serviceType];
+}
+
+export function getBuiltinBinding(
+	kind: string,
+): ServiceWidgetBinding | undefined {
+	return BUILTIN_WIDGETS[kind];
+}
+
+export interface ResolvedWidget {
+	component: ComponentType<WidgetComponentProps>;
+	description: string;
+	refreshIntervalMs: number;
+}
+
+/**
+ * Resolve a widget instance to its component + metadata.
+ *
+ * Service-bound widgets are resolved via the parent service's type (looked up
+ * from the services list); built-in widgets are resolved directly.
+ */
+export function resolveWidget(
+	widget: WidgetInstance,
+	services: ServiceInstance[],
+): ResolvedWidget | undefined {
+	if (widget.service_id) {
+		const service = services.find((s) => s.id === widget.service_id);
+		if (!service) return undefined;
+		const binding = getServiceBinding(service.service_type);
+		const widgetBinding = binding?.widgets.find(
+			(w) => w.kind === widget.widget_kind,
+		);
+		if (!widgetBinding) return undefined;
+		return {
+			component: widgetBinding.component,
+			description: widgetBinding.description,
+			refreshIntervalMs: widgetBinding.refreshIntervalMs,
+		};
+	}
+	const builtin = getBuiltinBinding(widget.widget_kind);
+	if (!builtin) return undefined;
+	return {
+		component: builtin.component,
+		description: builtin.description,
+		refreshIntervalMs: builtin.refreshIntervalMs,
+	};
+}
+
+/** Merge backend type metadata (config_schema, secret_fields) onto bindings. */
+export function enrichServiceTypes(
+	types: ServiceTypeInfo[],
+): ServiceTypeInfo[] {
+	return types;
+}

frontend/src/pages/AddonPage.tsx

@@ -1,28 +0,0 @@
-import { useParams } from "react-router-dom";
-import { Alert, AlertDescription } from "@/components/ui/alert";
-import {
-	GrafanaAddonPage,
-	PrometheusAddonPage,
-	SshTasksAddonPage,
-} from "../addons";
-
-const ADDON_PAGES: Record<string, React.ComponentType> = {
-	grafana: GrafanaAddonPage,
-	prometheus: PrometheusAddonPage,
-	"ssh-tasks": SshTasksAddonPage,
-};
-
-export function AddonPage() {
-	const { addonId } = useParams<{ addonId: string }>();
-	const Page = addonId ? ADDON_PAGES[addonId] : undefined;
-
-	if (!Page) {
-		return (
-			<Alert>
-				<AlertDescription>Addon "{addonId}" is not installed.</AlertDescription>
-			</Alert>
-		);
-	}
-
-	return <Page />;
-}

frontend/src/pages/Applications.tsx

@@ -1,28 +1,23 @@
-import { useMemo, useState } from "react";
+import { useState } from "react";
 import { useSearchParams } from "react-router-dom";
 import { Alert, AlertDescription } from "@/components/ui/alert";
 import { Badge } from "@/components/ui/badge";
 import { TabsTrigger } from "@/components/ui/tabs";
 import { Media } from "./Media";
 import { useCounts, useLibraries } from "../hooks/useDashboard";
-import { useMonitoringSettings } from "../hooks/useSettings";
+import { useServiceInstances } from "../hooks/useServices";
 import { SectionCard } from "../components/SectionCard";
 import { TabbedCard } from "../components/TabbedCard";
 
 function JellyfinLibraryStats() {
 	const [searchParams] = useSearchParams();
-	const { data: machines = [] } = useMonitoringSettings();
-	const jellyfinMachines = useMemo(
-		() =>
-			machines.filter(
-				(machine) => machine.enabled && machine.services.includes("jellyfin"),
-			),
-		[machines],
-	);
-	const selectedMachineId =
-		searchParams.get("machine_id") || jellyfinMachines[0]?.id || "";
-	const { data: counts } = useCounts(selectedMachineId || undefined);
-	const { data: libraries } = useLibraries(selectedMachineId || undefined);
+	const { data: jellyfinServices = [] } = useServiceInstances("jellyfin");
+	const selectedServiceId =
+		searchParams.get("jellyfin_service_id") ||
+		jellyfinServices.find((s) => s.enabled)?.id ||
+		"";
+	const { data: counts } = useCounts(selectedServiceId || undefined);
+	const { data: libraries } = useLibraries(selectedServiceId || undefined);
 
 	return (
 		<SectionCard
@@ -30,7 +25,7 @@ function JellyfinLibraryStats() {
 			description="Compact Jellyfin summary for the selected machine."
 			action={
 				<Badge variant="outline">
-					{selectedMachineId ? "Selected machine" : "Default machine"}
+					{selectedServiceId ? "Selected service" : "Default service"}
 				</Badge>
 			}
 		>

frontend/src/pages/Dashboard.tsx

@@ -30,7 +30,7 @@ import type { DashboardShortcut, DashboardShortcutInput } from "../types";
 import { SectionCard } from "../components/SectionCard";
 import { ConfirmDialog } from "../components/ConfirmDialog";
 import { DialogFooter } from "../components/DialogFooter";
-import { WidgetInstance } from "../components/WidgetInstance";
+import { WidgetInstanceCard } from "../components/WidgetInstance";
 import { WidgetConfigDialog } from "../components/WidgetConfigDialog";
 
 function emptyShortcut(): DashboardShortcutInput {
@@ -418,7 +418,7 @@ export function Dashboard() {
 			</SectionCard>
 
 			{visibleWidgets.map((widget) => (
-				<WidgetInstance key={widget.id} widget={widget} />
+				<WidgetInstanceCard key={widget.id} widget={widget} />
 			))}
 
 			<ShortcutDialog

frontend/src/pages/Media.tsx

@@ -32,7 +32,7 @@ import {
 } from "../hooks/useMedia";
 import { usePersistentState } from "../hooks/usePersistentState";
 import type { MediaItem } from "../types";
-import { useMonitoringSettings } from "../hooks/useSettings";
+import { useServiceInstances } from "../hooks/useServices";
 import { useCounts, useLibraries } from "../hooks/useDashboard";
 
 function formatDuration(seconds: number | null | undefined): string {
@@ -178,23 +178,18 @@ export function Media() {
 	const navigate = useNavigate();
 	const [searchParams, setSearchParams] = useSearchParams();
 	const isSmall = usePrefersSmallScreen();
-	const { data: machines } = useMonitoringSettings();
-	const jellyfinMachines = useMemo(
-		() =>
-			(machines ?? []).filter(
-				(machine) => machine.enabled && machine.services.includes("jellyfin"),
-			),
-		[machines],
-	);
-	const selectedMachineId =
-		searchParams.get("machine_id") || jellyfinMachines[0]?.id || "";
-	const { data: counts } = useCounts(selectedMachineId || undefined);
-	const { data: libraries } = useLibraries(selectedMachineId || undefined);
-	const { data: status } = useMediaStatus(selectedMachineId || undefined);
-	const buildIndex = useBuildIndex(selectedMachineId || undefined);
-	const stopBuildIndex = useStopBuildIndex(selectedMachineId || undefined);
+	const { data: jellyfinServices = [] } = useServiceInstances("jellyfin");
+	const selectedServiceId =
+		searchParams.get("jellyfin_service_id") ||
+		jellyfinServices.find((s) => s.enabled)?.id ||
+		"";
+	const { data: counts } = useCounts(selectedServiceId || undefined);
+	const { data: libraries } = useLibraries(selectedServiceId || undefined);
+	const { data: status } = useMediaStatus(selectedServiceId || undefined);
+	const buildIndex = useBuildIndex(selectedServiceId || undefined);
+	const stopBuildIndex = useStopBuildIndex(selectedServiceId || undefined);
 	const forceStopBuildIndex = useForceStopBuildIndex(
-		selectedMachineId || undefined,
+		selectedServiceId || undefined,
 	);
 
 	const [rawMediaState, setMediaState] = usePersistentState<MediaTabState>(
@@ -215,17 +210,17 @@ export function Media() {
 	const [rowSelection, setRowSelection] = useState<RowSelectionState>({});
 
 	useEffect(() => {
-		if (!searchParams.get("machine_id") && selectedMachineId) {
+		if (!searchParams.get("jellyfin_service_id") && selectedServiceId) {
 			setSearchParams(
 				(current) => {
 					const next = new URLSearchParams(current);
-					next.set("machine_id", selectedMachineId);
+					next.set("jellyfin_service_id", selectedServiceId);
 					return next;
 				},
 				{ replace: true },
 			);
 		}
-	}, [searchParams, selectedMachineId, setSearchParams]);
+	}, [searchParams, selectedServiceId, setSearchParams]);
 
 	const { data: queryResult, isLoading } = useMediaDataQuery({
 		types,
@@ -235,7 +230,7 @@ export function Media() {
 		sort_order: sortOrder,
 		limit: pageSize,
 		offset,
-		machineId: selectedMachineId || undefined,
+		jellyfinServiceId: selectedServiceId || undefined,
 		enabled: status?.exists ?? false,
 	});
 
@@ -323,27 +318,27 @@ export function Media() {
 			<div className="flex flex-row flex-wrap items-center gap-2">
 				<h2 className="text-lg font-semibold">Jellyfin</h2>
 				<div className="flex flex-col gap-1.5">
-					<Label htmlFor="media-machine">Machine</Label>
+					<Label htmlFor="media-service">Service</Label>
 					<Select
-						value={selectedMachineId}
+						value={selectedServiceId}
 						onValueChange={(value) =>
 							setSearchParams(
 								(current) => {
 									const next = new URLSearchParams(current);
-									next.set("machine_id", value);
+									next.set("jellyfin_service_id", value);
 									return next;
 								},
 								{ replace: true },
 							)
 						}
 					>
-						<SelectTrigger id="media-machine" className="w-full md:w-[220px]">
-							<SelectValue placeholder="Select a machine" />
+						<SelectTrigger id="media-service" className="w-full md:w-[220px]">
+							<SelectValue placeholder="Select a service" />
 						</SelectTrigger>
 						<SelectContent>
-							{jellyfinMachines.map((machine) => (
-								<SelectItem key={machine.id} value={machine.id}>
-									{machine.name}
+							{jellyfinServices.map((service) => (
+								<SelectItem key={service.id} value={service.id}>
+									{service.name}
 								</SelectItem>
 							))}
 						</SelectContent>

frontend/src/pages/ServicePage.tsx

@@ -0,0 +1,255 @@
+import { useMemo, useState } from "react";
+import { useParams } from "react-router-dom";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Switch } from "@/components/ui/switch";
+import {
+	useDeleteServiceInstance,
+	useSaveServiceInstance,
+	useServiceInstances,
+} from "../hooks/useServices";
+import type { ServiceInstance, ServiceInstanceInput } from "../types";
+import { SectionCard } from "../components/SectionCard";
+import { ConfirmDialog } from "../components/ConfirmDialog";
+import { getServiceBinding } from "../integrations/registry";
+
+function Field({
+	label,
+	htmlFor,
+	helper,
+	children,
+}: {
+	label: string;
+	htmlFor: string;
+	helper?: string;
+	children: React.ReactNode;
+}) {
+	return (
+		<div className="flex flex-col gap-1.5">
+			<Label htmlFor={htmlFor}>{label}</Label>
+			{children}
+			{helper ? (
+				<p className="text-xs text-muted-foreground">{helper}</p>
+			) : null}
+		</div>
+	);
+}
+
+export function ServicePage() {
+	const { serviceType = "", serviceId = "" } = useParams<{
+		serviceType: string;
+		serviceId: string;
+	}>();
+	const { data: services = [] } = useServiceInstances(serviceType || undefined);
+	const saveService = useSaveServiceInstance();
+	const deleteService = useDeleteServiceInstance();
+
+	const instance = useMemo(
+		() => services.find((s) => s.id === serviceId),
+		[services, serviceId],
+	);
+	const binding = getServiceBinding(serviceType);
+
+	const [name, setName] = useState("");
+	const [enabled, setEnabled] = useState(true);
+	const [deleteOpen, setDeleteOpen] = useState(false);
+	const [hydrated, setHydrated] = useState(false);
+
+	// Hydrate local form state once the instance loads.
+	if (instance && !hydrated) {
+		setName(instance.name);
+		setEnabled(instance.enabled);
+		setHydrated(true);
+	}
+
+	if (!binding) {
+		return (
+			<Alert>
+				<AlertDescription>Unknown service type: {serviceType}</AlertDescription>
+			</Alert>
+		);
+	}
+
+	if (!instance) {
+		return (
+			<Alert>
+				<AlertDescription>Service not found.</AlertDescription>
+			</Alert>
+		);
+	}
+
+	function buildInput(): ServiceInstanceInput {
+		return {
+			id: instance!.id,
+			service_type: instance!.service_type,
+			name,
+			config: instance!.config,
+			secrets: {}, // secrets are managed via the dedicated inputs below
+			enabled,
+		};
+	}
+
+	async function save() {
+		await saveService.mutateAsync(buildInput());
+	}
+
+	return (
+		<div className="flex flex-col gap-4">
+			<div className="flex items-center justify-between">
+				<div>
+					<h2 className="text-xl font-semibold">{instance.name}</h2>
+					<p className="text-sm text-muted-foreground">{binding.description}</p>
+				</div>
+				<Badge variant="outline">{binding.name}</Badge>
+			</div>
+
+			<SectionCard title="General">
+				<div className="flex flex-col gap-3">
+					<Field label="Name" htmlFor="service-name">
+						<Input
+							id="service-name"
+							value={name}
+							onChange={(e) => setName(e.target.value)}
+						/>
+					</Field>
+					<div className="flex items-center gap-2">
+						<Switch
+							id="service-enabled"
+							checked={enabled}
+							onCheckedChange={setEnabled}
+						/>
+						<Label htmlFor="service-enabled">Enabled</Label>
+					</div>
+					<div className="flex justify-between">
+						<Button onClick={save} disabled={saveService.isPending}>
+							Save
+						</Button>
+						<Button variant="destructive" onClick={() => setDeleteOpen(true)}>
+							Delete
+						</Button>
+					</div>
+				</div>
+			</SectionCard>
+
+			<ServiceSecretsCard instance={instance} />
+
+			{binding.widgets.length > 0 ? (
+				<SectionCard
+					title="Widgets"
+					description="Widget kinds this service provides."
+				>
+					<div className="flex flex-col gap-2">
+						{binding.widgets.map((w) => (
+							<div
+								key={w.kind}
+								className="flex items-center justify-between rounded border p-2"
+							>
+								<div>
+									<div className="font-medium">{w.name}</div>
+									<div className="text-xs text-muted-foreground">
+										{w.description}
+									</div>
+								</div>
+								<Badge variant="outline">{w.kind}</Badge>
+							</div>
+						))}
+						<p className="text-xs text-muted-foreground">
+							Add these to the dashboard from the dashboard's edit dialog.
+						</p>
+					</div>
+				</SectionCard>
+			) : null}
+
+			<ConfirmDialog
+				open={deleteOpen}
+				title="Delete service?"
+				message="This removes the service and any widgets that reference it. This cannot be undone."
+				confirmLabel="Delete"
+				onCancel={() => setDeleteOpen(false)}
+				onConfirm={() => {
+					deleteService.mutate(instance.id);
+					setDeleteOpen(false);
+				}}
+			/>
+		</div>
+	);
+}
+
+function ServiceSecretsCard({ instance }: { instance: ServiceInstance }) {
+	const saveService = useSaveServiceInstance();
+	// Empty-on-edit: local state starts blank; a blank field means "keep existing".
+	const [draftSecrets, setDraftSecrets] = useState<Record<string, string>>({});
+
+	return (
+		<SectionCard
+			title="Connection"
+			description="Non-secret config is read-only here for now; edit secret values below."
+		>
+			<div className="flex flex-col gap-3">
+				{Object.entries(instance.config).length === 0 ? (
+					<p className="text-sm text-muted-foreground">No connection config.</p>
+				) : (
+					<dl className="grid grid-cols-1 gap-2 text-sm sm:grid-cols-2">
+						{Object.entries(instance.config).map(([key, value]) => (
+							<div key={key} className="flex flex-col">
+								<dt className="text-xs text-muted-foreground">{key}</dt>
+								<dd className="truncate font-mono text-xs">{String(value)}</dd>
+							</div>
+						))}
+					</dl>
+				)}
+
+				{Object.keys(instance.secrets_set).length === 0 ? (
+					<p className="text-sm text-muted-foreground">No secret fields.</p>
+				) : (
+					<div className="flex flex-col gap-3">
+						{Object.entries(instance.secrets_set).map(([key, isSet]) => (
+							<div key={key} className="flex flex-col gap-1.5">
+								<Field
+									label={key}
+									htmlFor={`secret-${key}`}
+									helper="Leave blank to keep the current value."
+								>
+									<Input
+										id={`secret-${key}`}
+										type="password"
+										placeholder={isSet ? "•••••• (set)" : "Not set"}
+										value={draftSecrets[key] ?? ""}
+										onChange={(e) =>
+											setDraftSecrets({
+												...draftSecrets,
+												[key]: e.target.value,
+											})
+										}
+									/>
+								</Field>
+								{isSet ? <Badge variant="secondary">set</Badge> : null}
+							</div>
+						))}
+						<Button
+							onClick={() => {
+								const onlyChanged = Object.fromEntries(
+									Object.entries(draftSecrets).filter(([, v]) => v !== ""),
+								);
+								saveService.mutate({
+									id: instance.id,
+									service_type: instance.service_type,
+									name: instance.name,
+									config: instance.config,
+									secrets: onlyChanged,
+									enabled: instance.enabled,
+								});
+								setDraftSecrets({});
+							}}
+						>
+							Update secrets
+						</Button>
+					</div>
+				)}
+			</div>
+		</SectionCard>
+	);
+}

frontend/src/pages/ServicesPage.tsx

@@ -0,0 +1,372 @@
+import { useMemo, useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Switch } from "@/components/ui/switch";
+import {
+	Dialog,
+	DialogContent,
+	DialogHeader,
+	DialogTitle,
+} from "@/components/ui/dialog";
+import { ExternalLink, Plus, Trash2 } from "lucide-react";
+import {
+	useDeleteServiceInstance,
+	useSaveServiceInstance,
+	useServiceInstances,
+} from "../hooks/useServices";
+import { useServiceTypes } from "../hooks/useServices";
+import type {
+	SecretFieldInfo,
+	ServiceInstance,
+	ServiceInstanceInput,
+	ServiceTypeInfo,
+} from "../types";
+import { SectionCard } from "../components/SectionCard";
+import { ConfirmDialog } from "../components/ConfirmDialog";
+import { DialogFooter } from "../components/DialogFooter";
+import { getServiceBinding } from "../integrations/registry";
+
+interface CreateDraft {
+	serviceType: string;
+	name: string;
+	config: Record<string, unknown>;
+	secrets: Record<string, string>;
+	enabled: boolean;
+}
+
+function emptyDraft(serviceType: string): CreateDraft {
+	return { serviceType, name: "", config: {}, secrets: {}, enabled: true };
+}
+
+function Field({
+	label,
+	htmlFor,
+	helper,
+	children,
+}: {
+	label: string;
+	htmlFor: string;
+	helper?: string;
+	children: React.ReactNode;
+}) {
+	return (
+		<div className="flex flex-col gap-1.5">
+			<Label htmlFor={htmlFor}>{label}</Label>
+			{children}
+			{helper ? (
+				<p className="text-xs text-muted-foreground">{helper}</p>
+			) : null}
+		</div>
+	);
+}
+
+function ServiceConfigFields({
+	type,
+	config,
+	onChange,
+}: {
+	type: ServiceTypeInfo;
+	config: Record<string, unknown>;
+	onChange: (config: Record<string, unknown>) => void;
+}) {
+	const properties =
+		(
+			type.config_schema as {
+				properties?: Record<string, { type?: string; description?: string }>;
+			}
+		).properties ?? {};
+	return (
+		<div className="flex flex-col gap-3">
+			{Object.entries(properties).map(([key, schema]) => {
+				const isNumber = schema.type === "integer" || schema.type === "number";
+				return (
+					<Field
+						key={key}
+						label={key}
+						htmlFor={`cfg-${key}`}
+						helper={schema.description}
+					>
+						<Input
+							id={`cfg-${key}`}
+							type={isNumber ? "number" : "text"}
+							value={String(config[key] ?? "")}
+							onChange={(e) =>
+								onChange({
+									...config,
+									[key]: isNumber
+										? e.target.value === ""
+											? undefined
+											: Number(e.target.value)
+										: e.target.value,
+								})
+							}
+						/>
+					</Field>
+				);
+			})}
+		</div>
+	);
+}
+
+function ServiceSecretFields({
+	fields,
+	secrets,
+	onChange,
+}: {
+	fields: SecretFieldInfo[];
+	secrets: Record<string, string>;
+	onChange: (secrets: Record<string, string>) => void;
+}) {
+	if (fields.length === 0) return null;
+	return (
+		<div className="flex flex-col gap-3">
+			{fields.map((field) => (
+				<Field
+					key={field.key}
+					label={field.label}
+					htmlFor={`secret-${field.key}`}
+					helper={field.helper ?? (field.required ? "Required" : undefined)}
+				>
+					<Input
+						id={`secret-${field.key}`}
+						type="password"
+						value={secrets[field.key] ?? ""}
+						onChange={(e) =>
+							onChange({ ...secrets, [field.key]: e.target.value })
+						}
+					/>
+				</Field>
+			))}
+		</div>
+	);
+}
+
+function CreateServiceDialog({
+	open,
+	onClose,
+}: {
+	open: boolean;
+	onClose: () => void;
+}) {
+	const { data: types = [] } = useServiceTypes();
+	const saveService = useSaveServiceInstance();
+	const [draft, setDraft] = useState<CreateDraft | null>(null);
+
+	function reset() {
+		setDraft(null);
+	}
+
+	async function save() {
+		if (!draft) return;
+		if (!draft.name.trim()) return;
+		const input: ServiceInstanceInput = {
+			service_type: draft.serviceType,
+			name: draft.name.trim(),
+			config: draft.config,
+			secrets: draft.secrets,
+			enabled: draft.enabled,
+		};
+		await saveService.mutateAsync(input);
+		reset();
+		onClose();
+	}
+
+	const selectedType = types.find((t) => t.service_type === draft?.serviceType);
+
+	return (
+		<Dialog
+			open={open}
+			onOpenChange={(next) => {
+				if (!next) {
+					reset();
+					onClose();
+				}
+			}}
+		>
+			<DialogContent className="sm:max-w-lg">
+				<DialogHeader>
+					<DialogTitle>New service</DialogTitle>
+				</DialogHeader>
+				<div className="flex flex-col gap-4">
+					{!draft ? (
+						<div className="flex flex-col gap-2">
+							{types.map((t) => (
+								<Button
+									key={t.service_type}
+									variant="outline"
+									onClick={() => setDraft(emptyDraft(t.service_type))}
+								>
+									<Plus className="mr-1 h-3 w-3" />
+									{t.name}
+								</Button>
+							))}
+						</div>
+					) : (
+						<>
+							<p className="text-sm text-muted-foreground">
+								{selectedType?.description}
+							</p>
+							<Field label="Name" htmlFor="service-name">
+								<Input
+									id="service-name"
+									value={draft.name}
+									onChange={(e) => setDraft({ ...draft, name: e.target.value })}
+								/>
+							</Field>
+							{selectedType ? (
+								<ServiceConfigFields
+									type={selectedType}
+									config={draft.config}
+									onChange={(config) => setDraft({ ...draft, config })}
+								/>
+							) : null}
+							{selectedType ? (
+								<ServiceSecretFields
+									fields={selectedType.secret_fields}
+									secrets={draft.secrets}
+									onChange={(secrets) => setDraft({ ...draft, secrets })}
+								/>
+							) : null}
+							<div className="flex items-center gap-2">
+								<Switch
+									id="service-enabled"
+									checked={draft.enabled}
+									onCheckedChange={(checked) =>
+										setDraft({ ...draft, enabled: checked })
+									}
+								/>
+								<Label htmlFor="service-enabled">Enabled</Label>
+							</div>
+						</>
+					)}
+				</div>
+				{draft ? (
+					<DialogFooter
+						onCancel={reset}
+						onConfirm={save}
+						confirmLabel="Create service"
+						confirmDisabled={!draft.name.trim() || saveService.isPending}
+					/>
+				) : null}
+			</DialogContent>
+		</Dialog>
+	);
+}
+
+export function ServicesPage() {
+	const navigate = useNavigate();
+	const { data: services = [] } = useServiceInstances();
+	const { data: types = [] } = useServiceTypes();
+	const deleteService = useDeleteServiceInstance();
+	const [createOpen, setCreateOpen] = useState(false);
+	const [deleteId, setDeleteId] = useState<string | null>(null);
+
+	const grouped = useMemo(() => {
+		const map = new Map<string, ServiceInstance[]>();
+		for (const s of services) {
+			const list = map.get(s.service_type) ?? [];
+			list.push(s);
+			map.set(s.service_type, list);
+		}
+		return [...map.entries()].sort((a, b) => a[0].localeCompare(b[0]));
+	}, [services]);
+
+	const typeName = (t: string) =>
+		types.find((x) => x.service_type === t)?.name ??
+		getServiceBinding(t)?.name ??
+		t;
+
+	return (
+		<div className="flex flex-col gap-4">
+			<SectionCard
+				title="Services"
+				description="External services the app talks to. Configure URLs and API keys here; they are encrypted at rest."
+				action={
+					<Button variant="outline" onClick={() => setCreateOpen(true)}>
+						<Plus className="mr-1 h-3 w-3" />
+						Add service
+					</Button>
+				}
+			>
+				{services.length === 0 ? (
+					<Alert>
+						<AlertDescription>
+							No services yet. Add a Grafana, Prometheus, Jellyfin, Nextcloud,
+							or SSH task runner.
+						</AlertDescription>
+					</Alert>
+				) : (
+					<div className="flex flex-col gap-4">
+						{grouped.map(([serviceType, instances]) => (
+							<div key={serviceType} className="flex flex-col gap-2">
+								<div className="text-sm font-medium">
+									{typeName(serviceType)}
+								</div>
+								<div className="flex flex-col gap-2">
+									{instances.map((s) => (
+										<div
+											key={s.id}
+											className="flex items-center gap-2 rounded border p-2"
+										>
+											<div className="flex flex-1 flex-col gap-1">
+												<div className="flex items-center gap-2">
+													<span className="font-medium">{s.name}</span>
+													<Badge variant="outline">{s.service_type}</Badge>
+													{!s.enabled ? (
+														<Badge variant="secondary">disabled</Badge>
+													) : null}
+													{Object.entries(s.secrets_set).some(([, v]) => v) ? (
+														<Badge variant="outline">secrets set</Badge>
+													) : null}
+												</div>
+											</div>
+											<div className="flex items-center gap-1">
+												<Button
+													variant="ghost"
+													size="sm"
+													onClick={() =>
+														navigate(`/services/${s.service_type}/${s.id}`)
+													}
+												>
+													Open <ExternalLink className="ml-1 h-3 w-3" />
+												</Button>
+												<Button
+													variant="ghost"
+													size="icon"
+													className="h-8 w-8 text-destructive"
+													onClick={() => setDeleteId(s.id)}
+												>
+													<Trash2 className="h-4 w-4" />
+												</Button>
+											</div>
+										</div>
+									))}
+								</div>
+							</div>
+						))}
+					</div>
+				)}
+			</SectionCard>
+
+			<CreateServiceDialog
+				open={createOpen}
+				onClose={() => setCreateOpen(false)}
+			/>
+			<ConfirmDialog
+				open={Boolean(deleteId)}
+				title="Delete service?"
+				message="This removes the service and any widgets that reference it. This cannot be undone."
+				confirmLabel="Delete"
+				onCancel={() => setDeleteId(null)}
+				onConfirm={() => {
+					if (deleteId) deleteService.mutate(deleteId);
+					setDeleteId(null);
+				}}
+			/>
+		</div>
+	);
+}

frontend/src/pages/__tests__/Applications.test.tsx

@@ -26,6 +26,14 @@ vi.mock("../../hooks/useSettings", () => ({
 	}),
 }));
 
+vi.mock("../../hooks/useServices", () => ({
+	useServiceInstances: () => ({
+		data: [
+			{ id: "jfs1", service_type: "jellyfin", name: "Main", enabled: true },
+		],
+	}),
+}));
+
 vi.mock("../../hooks/useDashboard", () => ({
 	useCounts: () => ({
 		data: { movies: 10, series: 5, episodes: 100 },

frontend/src/pages/__tests__/Dashboard.test.tsx

@@ -5,12 +5,12 @@ import { Dashboard } from "../Dashboard";
 import type { DashboardShortcut } from "../../types";
 
 // Stub the composed widgets so the test exercises Dashboard's own behavior
-// (shortcut CRUD) without rendering the session panel or the backup query.
-vi.mock("../../components/NowPlaying", () => ({
-	NowPlaying: () => <div data-testid="now-playing-stub" />,
+// (shortcut CRUD) without rendering widgets or their data queries.
+vi.mock("../../components/WidgetInstance", () => ({
+	WidgetInstanceCard: () => <div data-testid="widget-stub" />,
 }));
-vi.mock("../../components/BackupDashboardWidget", () => ({
-	default: () => <div data-testid="backup-widget-stub" />,
+vi.mock("../../components/WidgetConfigDialog", () => ({
+	WidgetConfigDialog: () => <div data-testid="widget-config-stub" />,
 }));
 
 const navigate = vi.fn();
@@ -21,6 +21,9 @@ vi.mock("react-router-dom", () => ({
 vi.mock("../../hooks/useSettings", () => ({
 	useMonitoringSettings: () => ({ data: [] }),
 }));
+vi.mock("../../hooks/useWidgets", () => ({
+	useWidgetInstances: () => ({ data: [] }),
+}));
 
 const saveShortcutMutate = vi.fn().mockResolvedValue({});
 const deleteShortcutMutate = vi.fn();

frontend/src/pages/__tests__/Media.test.tsx

@@ -103,7 +103,10 @@ let queryResult: MediaQueryResponse;
 
 vi.mock("react-router-dom", () => ({
 	useNavigate: () => navigate,
-	useSearchParams: () => [new URLSearchParams("machine_id=local"), vi.fn()],
+	useSearchParams: () => [
+		new URLSearchParams("jellyfin_service_id=jfs1"),
+		vi.fn(),
+	],
 }));
 
 vi.mock("../../hooks/useMedia", () => ({
@@ -118,6 +121,14 @@ vi.mock("../../hooks/useSettings", () => ({
 	useMonitoringSettings: () => ({ data: [machineFixture()] }),
 }));
 
+vi.mock("../../hooks/useServices", () => ({
+	useServiceInstances: () => ({
+		data: [
+			{ id: "jfs1", service_type: "jellyfin", name: "Main", enabled: true },
+		],
+	}),
+}));
+
 vi.mock("../../hooks/useDashboard", () => ({
 	useCounts: () => ({ data: undefined }),
 	useLibraries: () => ({ data: undefined }),

frontend/src/types/index.ts

@@ -446,8 +446,8 @@ export interface PrometheusTarget {
 
 export interface WidgetInstance {
 	id: string;
-	addon_id: string;
-	widget_type: string;
+	service_id: string | null;
+	widget_kind: string;
 	title: string;
 	config: Record<string, unknown>;
 	enabled: boolean;
@@ -458,27 +458,71 @@ export interface WidgetInstance {
 
 export interface WidgetInstanceInput {
 	id?: string | null;
-	addon_id: string;
-	widget_type: string;
+	service_id: string | null;
+	widget_kind: string;
 	title: string;
 	config: Record<string, unknown>;
 	enabled: boolean;
 	sort_order: number;
 }
 
-export interface WidgetTypeInfo {
-	addon_id: string;
-	widget_type: string;
-	name: string;
-	description: string;
-	source_type: string;
-	config_schema: Record<string, unknown>;
-}
-
 export interface WidgetDataResponse {
 	widget_id: string;
-	widget_type: string;
 	data: Record<string, unknown> | null;
 	error: string | null;
 	fetched_at: number;
 }
+
+export interface SecretFieldInfo {
+	key: string;
+	label: string;
+	required: boolean;
+	helper?: string | null;
+}
+
+export interface ServiceWidgetKindInfo {
+	kind: string;
+	name: string;
+	description: string;
+	config_schema: Record<string, unknown>;
+	default_config: Record<string, unknown>;
+	refresh_interval_ms: number;
+}
+
+export interface ServiceTypeInfo {
+	service_type: string;
+	name: string;
+	description: string;
+	config_schema: Record<string, unknown>;
+	secret_fields: SecretFieldInfo[];
+	widget_kinds: ServiceWidgetKindInfo[];
+}
+
+export interface ServiceInstance {
+	id: string;
+	service_type: string;
+	name: string;
+	config: Record<string, unknown>;
+	secrets_set: Record<string, boolean>;
+	enabled: boolean;
+	created_at: number;
+	updated_at: number;
+}
+
+export interface ServiceInstanceInput {
+	id?: string | null;
+	service_type: string;
+	name: string;
+	config: Record<string, unknown>;
+	secrets: Record<string, string>;
+	enabled: boolean;
+}
+
+export interface BuiltinWidgetKindInfo {
+	kind: string;
+	name: string;
+	description: string;
+	config_schema: Record<string, unknown>;
+	default_config: Record<string, unknown>;
+	refresh_interval_ms: number;
+}

frontend/src/widgets/BackupsWidget.tsx

@@ -5,22 +5,23 @@ import { SectionCard } from "../components/SectionCard";
 import { useWidgetData } from "../hooks/useWidgets";
 import type { BackupDashboardSummary } from "../types/backups";
 import type { WidgetInstance } from "../types";
-import { getWidgetDefinition } from "./registry";
 
 interface Props {
 	widget: WidgetInstance;
+	refreshIntervalMs: number;
+	description?: string;
 }
 
-export function BackupsWidget({ widget }: Props) {
-	const def = getWidgetDefinition(widget.widget_type);
-	const { data, isLoading } = useWidgetData(
-		widget.id,
-		def?.refreshInterval ?? 0,
-	);
+export function BackupsWidget({
+	widget,
+	refreshIntervalMs,
+	description,
+}: Props) {
+	const { data, isLoading } = useWidgetData(widget.id, refreshIntervalMs);
 	const summary = data?.data as BackupDashboardSummary | undefined;
 
 	return (
-		<SectionCard title={widget.title} description={def?.description}>
+		<SectionCard title={widget.title} description={description}>
 			{isLoading && !data ? (
 				<div className="flex flex-row flex-wrap gap-6">
 					<Skeleton className="h-10 w-20" />

frontend/src/widgets/GrafanaLinkWidget.tsx

@@ -5,22 +5,23 @@ import { ExternalLink } from "lucide-react";
 import { SectionCard } from "../components/SectionCard";
 import { useWidgetData } from "../hooks/useWidgets";
 import type { WidgetInstance } from "../types";
-import { getWidgetDefinition } from "./registry";
 
 interface Props {
 	widget: WidgetInstance;
+	refreshIntervalMs: number;
+	description?: string;
 }
 
-export function GrafanaLinkWidget({ widget }: Props) {
-	const def = getWidgetDefinition(widget.widget_type);
-	const { data, isLoading } = useWidgetData(
-		widget.id,
-		def?.refreshInterval ?? 0,
-	);
+export function GrafanaLinkWidget({
+	widget,
+	refreshIntervalMs,
+	description,
+}: Props) {
+	const { data, isLoading } = useWidgetData(widget.id, refreshIntervalMs);
 	const url = data?.data?.url as string | undefined;
 
 	return (
-		<SectionCard title={widget.title} description={def?.description}>
+		<SectionCard title={widget.title} description={description}>
 			{isLoading && !data ? (
 				<Skeleton className="h-10 w-48" />
 			) : data?.error ? (

frontend/src/widgets/JellyfinWidget.tsx

@@ -4,22 +4,23 @@ import { SessionActivityPanel } from "../components/SessionActivityPanel";
 import { SectionCard } from "../components/SectionCard";
 import { useWidgetData } from "../hooks/useWidgets";
 import type { NowPlayingSession, WidgetInstance } from "../types";
-import { getWidgetDefinition } from "./registry";
 
 interface Props {
 	widget: WidgetInstance;
+	refreshIntervalMs: number;
+	description?: string;
 }
 
-export function JellyfinWidget({ widget }: Props) {
-	const def = getWidgetDefinition(widget.widget_type);
-	const { data, isLoading } = useWidgetData(
-		widget.id,
-		def?.refreshInterval ?? 0,
-	);
+export function JellyfinWidget({
+	widget,
+	refreshIntervalMs,
+	description,
+}: Props) {
+	const { data, isLoading } = useWidgetData(widget.id, refreshIntervalMs);
 	const sessions = data?.data?.sessions as NowPlayingSession[] | undefined;
 
 	return (
-		<SectionCard title={widget.title} description={def?.description}>
+		<SectionCard title={widget.title} description={description}>
 			{isLoading && !data ? (
 				<div className="flex flex-col gap-2">
 					<Skeleton className="h-4 w-3/4" />

frontend/src/widgets/PrometheusMetricWidget.tsx

@@ -3,10 +3,11 @@ import { Skeleton } from "@/components/ui/skeleton";
 import { SectionCard } from "../components/SectionCard";
 import { useWidgetData } from "../hooks/useWidgets";
 import type { WidgetInstance } from "../types";
-import { getWidgetDefinition } from "./registry";
 
 interface Props {
 	widget: WidgetInstance;
+	refreshIntervalMs: number;
+	description?: string;
 }
 
 type PromQLResult = {
@@ -35,16 +36,16 @@ function formatPrometheusValue(result: PromQLResult | undefined): string {
 	return JSON.stringify(result, null, 2);
 }
 
-export function PrometheusMetricWidget({ widget }: Props) {
-	const def = getWidgetDefinition(widget.widget_type);
-	const { data, isLoading } = useWidgetData(
-		widget.id,
-		def?.refreshInterval ?? 0,
-	);
+export function PrometheusMetricWidget({
+	widget,
+	refreshIntervalMs,
+	description,
+}: Props) {
+	const { data, isLoading } = useWidgetData(widget.id, refreshIntervalMs);
 	const result = data?.data?.result as PromQLResult | undefined;
 
 	return (
-		<SectionCard title={widget.title} description={def?.description}>
+		<SectionCard title={widget.title} description={description}>
 			{isLoading && !data ? (
 				<Skeleton className="h-10 w-32" />
 			) : data?.error ? (

frontend/src/widgets/SshTaskWidget.tsx

@@ -3,10 +3,11 @@ import { Skeleton } from "@/components/ui/skeleton";
 import { SectionCard } from "../components/SectionCard";
 import { useWidgetData } from "../hooks/useWidgets";
 import type { WidgetInstance } from "../types";
-import { getWidgetDefinition } from "./registry";
 
 interface Props {
 	widget: WidgetInstance;
+	refreshIntervalMs: number;
+	description?: string;
 }
 
 type SshTaskResult = {
@@ -15,16 +16,16 @@ type SshTaskResult = {
 	stderr: string;
 };
 
-export function SshTaskWidget({ widget }: Props) {
-	const def = getWidgetDefinition(widget.widget_type);
-	const { data, isLoading } = useWidgetData(
-		widget.id,
-		def?.refreshInterval ?? 0,
-	);
+export function SshTaskWidget({
+	widget,
+	refreshIntervalMs,
+	description,
+}: Props) {
+	const { data, isLoading } = useWidgetData(widget.id, refreshIntervalMs);
 	const result = data?.data as SshTaskResult | undefined;
 
 	return (
-		<SectionCard title={widget.title} description={def?.description}>
+		<SectionCard title={widget.title} description={description}>
 			{isLoading && !data ? (
 				<div className="flex flex-col gap-2">
 					<Skeleton className="h-4 w-full" />

frontend/src/widgets/StaticWidget.tsx

@@ -1,19 +1,23 @@
 import { SectionCard } from "../components/SectionCard";
 import { useWidgetData } from "../hooks/useWidgets";
 import type { WidgetInstance } from "../types";
-import { getWidgetDefinition } from "./registry";
 
 interface Props {
 	widget: WidgetInstance;
+	refreshIntervalMs: number;
+	description?: string;
 }
 
-export function StaticWidget({ widget }: Props) {
-	const def = getWidgetDefinition(widget.widget_type);
-	const { data } = useWidgetData(widget.id, def?.refreshInterval ?? 0);
+export function StaticWidget({
+	widget,
+	refreshIntervalMs,
+	description,
+}: Props) {
+	const { data } = useWidgetData(widget.id, refreshIntervalMs);
 	const text = data?.data?.text as string | undefined;
 
 	return (
-		<SectionCard title={widget.title} description={def?.description}>
+		<SectionCard title={widget.title} description={description}>
 			{text ? (
 				<p className="whitespace-pre-wrap text-sm">{text}</p>
 			) : (

frontend/src/widgets/index.ts

@@ -4,9 +4,3 @@ export { JellyfinWidget } from "./JellyfinWidget";
 export { PrometheusMetricWidget } from "./PrometheusMetricWidget";
 export { SshTaskWidget } from "./SshTaskWidget";
 export { StaticWidget } from "./StaticWidget";
-export {
-	getWidgetDefinition,
-	listWidgetTypes,
-	WIDGET_REGISTRY,
-} from "./registry";
-export type { WidgetConfigField, WidgetDefinition } from "./registry";

frontend/src/widgets/registry.test.ts

@@ -1,42 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-	getWidgetDefinition,
-	listWidgetTypes,
-	WIDGET_REGISTRY,
-} from "./registry";
-
-describe("widget registry", () => {
-	it("contains exactly six Phase 1 types", () => {
-		const types = listWidgetTypes();
-		expect(types).toHaveLength(6);
-		expect(types.map((t) => t.widgetType).sort()).toEqual([
-			"backups",
-			"grafana-link",
-			"jellyfin",
-			"prometheus-metric",
-			"ssh-task",
-			"static",
-		]);
-	});
-
-	it("has refresh intervals matching the spec", () => {
-		expect(getWidgetDefinition("jellyfin")?.refreshInterval).toBe(30_000);
-		expect(getWidgetDefinition("backups")?.refreshInterval).toBe(60_000);
-		expect(getWidgetDefinition("grafana-link")?.refreshInterval).toBe(0);
-		expect(getWidgetDefinition("prometheus-metric")?.refreshInterval).toBe(
-			30_000,
-		);
-		expect(getWidgetDefinition("ssh-task")?.refreshInterval).toBe(0);
-		expect(getWidgetDefinition("static")?.refreshInterval).toBe(0);
-	});
-
-	it("defines required metadata for every widget", () => {
-		for (const def of Object.values(WIDGET_REGISTRY)) {
-			expect(def.widgetType).toBeTruthy();
-			expect(def.addonId).toBeTruthy();
-			expect(def.name).toBeTruthy();
-			expect(def.sourceType).toBeTruthy();
-			expect(def.component).toBeDefined();
-		}
-	});
-});

frontend/src/widgets/registry.ts

@@ -1,122 +0,0 @@
-import type { ComponentType } from "react";
-import type { WidgetInstance } from "../types";
-import { BackupsWidget } from "./BackupsWidget";
-import { GrafanaLinkWidget } from "./GrafanaLinkWidget";
-import { JellyfinWidget } from "./JellyfinWidget";
-import { PrometheusMetricWidget } from "./PrometheusMetricWidget";
-import { SshTaskWidget } from "./SshTaskWidget";
-import { StaticWidget } from "./StaticWidget";
-
-export interface WidgetConfigField {
-	key: string;
-	label: string;
-	type: "string" | "select" | "boolean" | "number";
-	options?: { label: string; value: string }[];
-	helper?: string;
-}
-
-export interface WidgetDefinition {
-	widgetType: string;
-	addonId: string;
-	name: string;
-	description: string;
-	sourceType: string;
-	refreshInterval: number;
-	defaultConfig: Record<string, unknown>;
-	configFields: WidgetConfigField[];
-	component: ComponentType<{ widget: WidgetInstance }>;
-}
-
-export const WIDGET_REGISTRY: Record<string, WidgetDefinition> = {
-	jellyfin: {
-		widgetType: "jellyfin",
-		addonId: "core",
-		name: "Jellyfin activity",
-		description: "Live sessions and idle users from a Jellyfin server.",
-		sourceType: "jellyfin",
-		refreshInterval: 30_000,
-		defaultConfig: { machine_id: "" },
-		configFields: [
-			{
-				key: "machine_id",
-				label: "Machine ID",
-				type: "string",
-				helper: "Jellyfin machine id (empty = default)",
-			},
-		],
-		component: JellyfinWidget,
-	},
-	backups: {
-		widgetType: "backups",
-		addonId: "backups",
-		name: "Backups",
-		description: "Backup job summary and active alerts.",
-		sourceType: "backups",
-		refreshInterval: 60_000,
-		defaultConfig: {},
-		configFields: [],
-		component: BackupsWidget,
-	},
-	"grafana-link": {
-		widgetType: "grafana-link",
-		addonId: "grafana",
-		name: "Grafana link",
-		description: "Deep-link to a Grafana dashboard or panel.",
-		sourceType: "grafana",
-		refreshInterval: 0,
-		defaultConfig: { dashboard_uid: "" },
-		configFields: [
-			{ key: "dashboard_uid", label: "Dashboard UID", type: "string" },
-			{
-				key: "panel_id",
-				label: "Panel ID",
-				type: "number",
-				helper: "Optional",
-			},
-		],
-		component: GrafanaLinkWidget,
-	},
-	"prometheus-metric": {
-		widgetType: "prometheus-metric",
-		addonId: "prometheus",
-		name: "Prometheus metric",
-		description: "Instant query result rendered as a metric.",
-		sourceType: "prometheus",
-		refreshInterval: 30_000,
-		defaultConfig: { promql: "" },
-		configFields: [{ key: "promql", label: "PromQL query", type: "string" }],
-		component: PrometheusMetricWidget,
-	},
-	"ssh-task": {
-		widgetType: "ssh-task",
-		addonId: "ssh-tasks",
-		name: "SSH task output",
-		description: "Output of a saved task run on a machine.",
-		sourceType: "ssh_task",
-		refreshInterval: 0,
-		defaultConfig: { task_id: "" },
-		configFields: [{ key: "task_id", label: "Saved task ID", type: "string" }],
-		component: SshTaskWidget,
-	},
-	static: {
-		widgetType: "static",
-		addonId: "core",
-		name: "Static text",
-		description: "Plain text or markdown note.",
-		sourceType: "static",
-		refreshInterval: 0,
-		defaultConfig: { text: "" },
-		configFields: [{ key: "text", label: "Text", type: "string" }],
-		component: StaticWidget,
-	},
-};
-
-export function getWidgetDefinition(
-	widgetType: string,
-): WidgetDefinition | undefined {
-	return WIDGET_REGISTRY[widgetType];
-}
-
-export function listWidgetTypes(): WidgetDefinition[] {
-	return Object.values(WIDGET_REGISTRY);
-}

openspec/changes/service-registry/apply-progress.md

@@ -0,0 +1,119 @@
+# Apply Progress: Runtime Service Registry
+
+**Change:** `service-registry`
+**Apply run:** PRs #7–#10 (Slices 1–4a)
+**Date:** 2026-06-19
+
+## Slices 1–3 (MERGED)
+
+- Slice 1 (#7): backend service foundation — encryption, integrations registry,
+  services + service_task_runs tables, `/api/services*` CRUD.
+- Slice 2 (#8): backend widget rebind — service_id + widget_kind, ServiceRecord
+  adapters, built-ins, SSH run logging, retired old widget registry.
+- Slice 3 (#9): frontend services runtime — types/API/hooks, frontend registry,
+  ServicePage, route swap, reconciled widget components + config dialog.
+
+## Slice 4a — Cleanup + services admin UI + docs (this PR)
+
+### Completed tasks
+
+- [x] Removed addon pages (`/addons/:addonId`, `AddonPage.tsx`, `addons/*`) —
+      superseded by service pages.
+- [x] Removed `grafana_url` / `prometheus_url` from `config.py`, both compose
+      files, `.env.example`, and README. (Frontend `VITE_GRAFANA_URL` /
+      `VITE_PROMETHEUS_URL` deep-link vars retained.)
+- [x] Added a **Services page** (`/services`) with create/list/delete and a nav
+      entry, so service pages are reachable and services are configurable in the
+      tool itself.
+- [x] Registered `/services` route in both route trees + sidebar nav.
+- [x] Updated `docs/REQUIREMENTS.md` (service registry section) and added
+      `CHANGELOG.md` with the breaking-upgrade note.
+
+### Decision resolved mid-slice
+
+"Full machine migration" was scoped into **4a (cleanup) + 4b (Jellyfin/Jellyseerr
+migration)** because removing machine-level Jellyfin/Jellyseerr fields is deeply
+coupled to the Media/Users/Files pages (load-bearing) and there is no
+`jellyseerr` service definition yet. 4a ships the safe cleanup + the services
+admin UI; 4b does the machine-app-field migration as its own reviewable change.
+
+### Files changed (Slice 4a)
+
+- Backend: `config.py` (removed grafana_url/prometheus_url).
+- Compose/env/docs: `docker-compose.yml`, `docker-compose.dev.yml`,
+  `.env.example`, `README.md`, `docs/REQUIREMENTS.md`, `CHANGELOG.md` (new).
+- Frontend: new `pages/ServicesPage.tsx`; `App.tsx` (routes + nav); removed
+  `pages/AddonPage.tsx`, `addons/*`.
+
+### Verification (Slice 4a)
+
+```bash
+cd backend
+.venv/bin/ruff check .                                      # clean
+PYTHONPATH=src .venv/bin/python -m pytest                   # 222 passed
+cd ../frontend
+npm run lint                                                # 0 errors
+npm run build                                               # success
+npm run test                                                # 70 passed
+```
+
+## Slice 4b — Jellyfin/Jellyseerr → services migration (in progress)
+
+### Completed (backend, this PR)
+
+- [x] Added `jellyseerr` service definition (`integrations/jellyseerr.py`) and
+      registered it (6 service types total).
+- [x] Added `user_id` to the Jellyfin service config.
+- [x] `dependencies.py`: new `_request_jellyfin_service_id` + `_service_record`
+      (decrypt-on-read). Rewrote `get_jellyfin_client`, `get_jellyseerr_client`,
+      and `get_user_id` to resolve against the service registry via the
+      `jellyfin_service_id` query param (first enabled instance as fallback).
+- [x] SSH/Files transport (`get_ssh_client`) unchanged — still uses
+      `machine_id`.
+- [x] Updated service-registry tests for 6 types.
+
+### Selection model (decided)
+
+Split query params: `?jellyfin_service_id=` selects the Jellyfin/Jellyseerr
+instance; `?machine_id=` selects SSH/Files transport. Pages that need both pass
+both.
+
+### Remaining (frontend, next PR)
+
+- Thread `jellyfinServiceId` through Media / Applications / Dashboard / Users:
+  list `jellyfin` service instances instead of `useMonitoringSettings()`
+  Jellyfin machines; pass `jellyfin_service_id` to Jellyfin API calls.
+- Files page keeps `machine_id`.
+- Settings UI: remove machine-level Jellyfin/Jellyseerr fields.
+- Remove machine app fields from `settings_store.py` + `routers/settings.py`
+  once the UI no longer writes them.
+
+### Frontend half (this PR)
+
+- [x] `api/client.ts`: Jellyfin-backed calls (`fetchCounts`, `fetchLibraries`,
+      `fetchActivity`, `fetchUsers`, Media status/build/stop/force-stop, and
+      `queryMedia`) now send `jellyfin_service_id` instead of `machine_id`.
+- [x] `hooks/useDashboard.ts`, `hooks/useUsers.ts`, `hooks/useMedia.ts`: renamed
+      the selector param to `jellyfinServiceId`.
+- [x] `pages/Media.tsx` + `pages/Applications.tsx`: select a `jellyfin` service
+      instance via `useServiceInstances("jellyfin")` and persist
+      `jellyfin_service_id` in the URL.
+- [x] Dashboard (widget-based) and Users (default-instance) need no selector
+      change.
+- [x] Updated Applications + Media tests for the new hook/param.
+
+### Deferred (explicit follow-up)
+
+- Remove machine-level Jellyfin/Jellyseerr fields from `settings_store.py`,
+  `routers/settings.py`, and the Settings UI. Low urgency now that the runtime
+  reads from services; the machine fields are simply unused for Jellyfin.
+
+### Verification (backend half)
+
+```bash
+cd backend
+.venv/bin/ruff check .                                      # clean
+PYTHONPATH=src .venv/bin/python -m pytest                   # 222 passed
+cd ../frontend
+npm run lint && npm run build && npm run test               # green (unchanged)
+```