Merge pull request '(release) Prepare 1.2.0' (#74) from release-1.2 into master

Reviewed-on: #74

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 1.2.0 - 2026-05-28
+
+Operations-focused release for more reliable production backups and maintenance.
+
+### Added
+
+- Staff-only updater page for checking configured Gitea releases, inspecting the installed git checkout, fetching tags, pulling the current branch, and running the native systemd updater.
+- Read-only control panel access level for authenticated non-staff users, with status pages visible and credentials, logs, configs, retention, and mutating actions kept staff-only.
+- Run completion notifications for email and webhooks, including recorded delivery history per run and target.
+- Dedicated hosts page with host cards, enabled/disabled filtering, and quick host/schedule/retention state controls.
+- Per-host rsync bandwidth limit overrides with inherit, unlimited, and explicit limit semantics.
+- Backup data totals by snapshot kind on dashboard and host detail pages, including unique/non-hardlinked data totals.
+
+### Changed
+
+- Real backup runs now default to verbose rsync progress output so the live run view behaves consistently with dry-runs.
+- Run progress panels are shared between dry-runs and real runs for more consistent status, timing, cancellation, and log display.
+- Incomplete snapshot cleanup now requires operator review before deletion.
+- Incomplete snapshot size reporting now prefers on-disk measurement when metadata is stale or missing.
+- Installer and environment examples now include optional updater configuration.
+
+### Fixed
+
+- Remote preflight shell commands are now quoted correctly, including roots such as `/`.
+- Worker reconciliation now detects real rsync failures and stale/running process state more reliably.
+- Retention pruning and incomplete cleanup can delete snapshots containing restrictive directory modes preserved by rsync archive mode.
+- Snapshot data summaries no longer count incomplete metadata/log files as backup data when measuring from disk.
+- Filesystem SSH credential tests use writable test state without changing production defaults.
+
 ## 1.1.0 - 2026-05-21
 
 UI-focused release for the Django control panel.

README.md

@@ -131,6 +131,11 @@ Create a superuser if needed:
 sudo -u pobsync pobsync-manage createsuperuser
 ```
 
+The control panel supports two access levels. Django staff users can manage hosts, SSH keys, configs, retention,
+notifications, logs, and administrative actions. Normal authenticated users can view backup status pages such as the
+dashboard, hosts, runs, snapshots, schedules, purged history, changelog, and `/api/status/`, but cannot see SSH
+credentials or run mutating actions.
+
 For other Django management commands on native installs, use `pobsync-manage` so the production environment file is
 loaded before Django starts:
 
@@ -153,6 +158,7 @@ The UI includes:
 - Django-managed SSH keys
 - `/self-check/` for runtime checks
 - `/logs/` for filtered pobsync service logs
+- `/updater/` for checking Gitea releases, pulling the git checkout, and running the native updater
 
 ## Bandwidth Limits
 
@@ -238,6 +244,21 @@ The updater is a thin wrapper around the installer for normal production deploys
 Python dependencies, runs migrations, collects static files, and restarts the systemd services so new Django code is
 loaded.
 
+The Django control panel also exposes an `/updater/` page for staff users. It can check a Gitea releases endpoint, run
+`git fetch`, run a fast-forward-only pull for the installed branch, and invoke the configured native update command.
+Configure these optional environment variables in `/etc/pobsync/pobsync.env`:
+
+```
+POBSYNC_UPDATE_RELEASES_URL=https://code.example.test/api/v1/repos/owner/pobsync/releases
+POBSYNC_UPDATE_RELEASES_TOKEN=
+POBSYNC_UPDATE_GIT_REMOTE=origin
+POBSYNC_UPDATE_COMMAND=sudo -n scripts/update-systemd
+```
+
+If the web service runs as the `pobsync` user, `POBSYNC_UPDATE_COMMAND` needs a matching sudoers rule or a different
+operator-approved command. Without that, the page still shows update status and command output, but the native update
+action will fail with a permission error instead of silently doing the wrong thing.
+
 Use the full installer again when you intentionally want to change install-time settings, install OS packages, enable
 nginx, or rewrite the environment file:
 

deploy/pobsync.env.example

@@ -16,3 +16,11 @@ POBSYNC_GUNICORN_WORKERS=2
 POBSYNC_GUNICORN_TIMEOUT=120
 POBSYNC_WORKER_INTERVAL=15
 POBSYNC_SCHEDULER_INTERVAL=60
+
+# Optional UI updater integration.
+# Point this at the Gitea releases API endpoint, for example:
+# https://code.example.test/api/v1/repos/owner/pobsync/releases
+POBSYNC_UPDATE_RELEASES_URL=
+POBSYNC_UPDATE_RELEASES_TOKEN=
+POBSYNC_UPDATE_GIT_REMOTE=origin
+POBSYNC_UPDATE_COMMAND=sudo -n scripts/update-systemd

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pobsync"
-version = "1.1.0"
+version = "1.2.0"
 description = "Pull-based rsync backup tool with hardlinked snapshots"
 requires-python = ">=3.11"
 dependencies = [

scripts/install-systemd

@@ -472,6 +472,10 @@ POBSYNC_GUNICORN_WORKERS=2
 POBSYNC_GUNICORN_TIMEOUT=120
 POBSYNC_WORKER_INTERVAL=15
 POBSYNC_SCHEDULER_INTERVAL=60
+POBSYNC_UPDATE_RELEASES_URL=
+POBSYNC_UPDATE_RELEASES_TOKEN=
+POBSYNC_UPDATE_GIT_REMOTE=origin
+POBSYNC_UPDATE_COMMAND=sudo -n scripts/update-systemd
 EOF
     chmod 0640 "$ENV_FILE"
     chown "root:$SERVICE_GROUP" "$ENV_FILE"

src/pobsync/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "1.1.0"
+__version__ = "1.2.0"

src/pobsync_backend/access.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from collections.abc import Callable
+from functools import wraps
+from typing import Any
+
+from django.contrib.auth.decorators import login_required
+from django.core.exceptions import PermissionDenied
+from django.http import HttpRequest, HttpResponse
+
+
+def can_view_status(user) -> bool:
+    return bool(user.is_authenticated)
+
+
+def can_manage_control_panel(user) -> bool:
+    return bool(user.is_authenticated and user.is_staff)
+
+
+def status_view_required(view_func: Callable[..., HttpResponse]) -> Callable[..., HttpResponse]:
+    return login_required(view_func)
+
+
+def control_panel_admin_required(view_func: Callable[..., HttpResponse]) -> Callable[..., HttpResponse]:
+    @login_required
+    @wraps(view_func)
+    def wrapper(request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
+        if not can_manage_control_panel(request.user):
+            raise PermissionDenied
+        return view_func(request, *args, **kwargs)
+
+    return wrapper
+
+
+def access_context(request: HttpRequest) -> dict[str, Any]:
+    return {
+        "can_view_status": can_view_status(request.user),
+        "can_manage_control_panel": can_manage_control_panel(request.user),
+    }

src/pobsync_backend/api.py

@@ -2,16 +2,16 @@ from __future__ import annotations
 
 from typing import Any
 
-from django.contrib.admin.views.decorators import staff_member_required
 from django.db import connection
 from django.db.models import Count
 from django.http import JsonResponse
 from django.utils import timezone
 
 from .models import BackupRun, HostConfig, ScheduleConfig, SnapshotRecord
+from .access import control_panel_admin_required, status_view_required
 
 
-@staff_member_required
+@control_panel_admin_required
 def api_index(request) -> JsonResponse:
     return JsonResponse(
         {
@@ -26,7 +26,7 @@ def api_index(request) -> JsonResponse:
     )
 
 
-@staff_member_required
+@status_view_required
 def status(request) -> JsonResponse:
     latest_run = BackupRun.objects.select_related("host", "snapshot").order_by("-created_at").first()
     latest_schedule = ScheduleConfig.objects.select_related("host").order_by("-last_started_at", "-updated_at").first()
@@ -55,7 +55,7 @@ def status(request) -> JsonResponse:
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def hosts(request) -> JsonResponse:
     host_qs = (
         HostConfig.objects.annotate(snapshot_count=Count("snapshots", distinct=True), run_count=Count("runs", distinct=True))
@@ -65,7 +65,7 @@ def hosts(request) -> JsonResponse:
     return JsonResponse({"ok": True, "hosts": [_host_payload(host) for host in host_qs]})
 
 
-@staff_member_required
+@control_panel_admin_required
 def snapshots(request) -> JsonResponse:
     snapshot_qs = SnapshotRecord.objects.select_related("host", "base").order_by("host__host", "-started_at", "dirname")
     host_filter = request.GET.get("host")
@@ -78,7 +78,7 @@ def snapshots(request) -> JsonResponse:
     return JsonResponse({"ok": True, "snapshots": [_snapshot_payload(snapshot) for snapshot in snapshot_qs[:limit]]})
 
 
-@staff_member_required
+@control_panel_admin_required
 def runs(request) -> JsonResponse:
     run_qs = BackupRun.objects.select_related("host", "snapshot").order_by("-created_at")
     host_filter = request.GET.get("host")

src/pobsync_backend/backup_runner.py

@@ -27,7 +27,7 @@ def queue_backup_run(
     host: HostConfig,
     run_type: str = BackupRun.RunType.MANUAL,
     dry_run: bool = False,
-    verbose_output: bool = False,
+    verbose_output: bool = True,
     prune: bool = False,
     prune_max_delete: int = 10,
     prune_protect_bases: bool = False,

src/pobsync_backend/context_processors.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from django.http import HttpRequest
+
+from .access import access_context
+
+
+def pobsync_access(request: HttpRequest) -> dict[str, object]:
+    return access_context(request)

src/pobsync_backend/management/commands/run_pobsync_backup.py

@@ -19,6 +19,7 @@ class Command(BaseCommand):
         parser.add_argument("--prefix", default=settings.POBSYNC_HOME, help="Runtime state root")
         parser.add_argument("--dry-run", action="store_true", help="Run rsync --dry-run")
         parser.add_argument("--verbose-rsync", action="store_true", help="Write itemized rsync output to the run log")
+        parser.add_argument("--quiet-rsync", action="store_true", help="Skip default rsync progress output for real runs")
         parser.add_argument("--prune", action="store_true", help="Apply retention after a successful run")
         parser.add_argument("--prune-max-delete", type=int, default=10)
         parser.add_argument("--prune-protect-bases", action="store_true")
@@ -32,6 +33,7 @@ class Command(BaseCommand):
         except HostConfig.DoesNotExist as exc:
             raise CommandError(f"Missing enabled host {host_name!r}") from exc
 
+        verbose_output = bool(options["dry_run"] or options["verbose_rsync"] or not options["quiet_rsync"])
         run = BackupRun.objects.create(
             host=host,
             run_type=BackupRun.RunType.MANUAL if options["manual"] else BackupRun.RunType.SCHEDULED,
@@ -39,7 +41,7 @@ class Command(BaseCommand):
             result={
                 "requested": {
                     "dry_run": bool(options["dry_run"]),
-                    "verbose_output": bool(options["dry_run"] or options["verbose_rsync"]),
+                    "verbose_output": verbose_output,
                     "prune": bool(options["prune"]),
                     "prune_max_delete": int(options["prune_max_delete"]),
                     "prune_protect_bases": bool(options["prune_protect_bases"]),
@@ -50,7 +52,7 @@ class Command(BaseCommand):
             run=run,
             prefix=paths.home,
             dry_run=bool(options["dry_run"]),
-            verbose_output=bool(options["dry_run"] or options["verbose_rsync"]),
+            verbose_output=verbose_output,
             prune=bool(options["prune"]),
             prune_max_delete=int(options["prune_max_delete"]),
             prune_protect_bases=bool(options["prune_protect_bases"]),

src/pobsync_backend/stats_summary.py

@@ -120,12 +120,15 @@ def _backup_data_by_kind(host: HostConfig) -> dict[str, Any]:
         row = rows.setdefault(snapshot.kind, _empty_snapshot_data_row())
         allocated = summary.get("allocated_size_bytes") or summary.get("apparent_size_bytes") or 0
         apparent = summary.get("apparent_size_bytes") or 0
+        unique_apparent = summary.get("unique_apparent_size_bytes") or 0
         row["count"] += 1
         row["allocated_size_bytes"] += int(allocated)
         row["apparent_size_bytes"] += int(apparent)
+        row["unique_apparent_size_bytes"] += int(unique_apparent)
         total["count"] += 1
         total["allocated_size_bytes"] += int(allocated)
         total["apparent_size_bytes"] += int(apparent)
+        total["unique_apparent_size_bytes"] += int(unique_apparent)
 
     return {
         "scheduled": rows[SnapshotRecord.Kind.SCHEDULED],
@@ -140,6 +143,7 @@ def _empty_snapshot_data_row() -> dict[str, int]:
         "count": 0,
         "allocated_size_bytes": 0,
         "apparent_size_bytes": 0,
+        "unique_apparent_size_bytes": 0,
     }
 
 
@@ -157,6 +161,7 @@ def _sum_backup_data_by_kind(rows: Iterable[dict[str, dict[str, int]]]) -> dict[
             total_row["count"] += values.get("count", 0)
             total_row["allocated_size_bytes"] += values.get("allocated_size_bytes", 0)
             total_row["apparent_size_bytes"] += values.get("apparent_size_bytes", 0)
+            total_row["unique_apparent_size_bytes"] += values.get("unique_apparent_size_bytes", 0)
 
     return total_rows
 
@@ -168,21 +173,28 @@ def _snapshot_summary(snapshot: SnapshotRecord | None) -> dict[str, Any]:
     stats = metadata.get("stats") if isinstance(metadata.get("stats"), dict) else {}
     storage = stats.get("storage") if isinstance(stats.get("storage"), dict) else {}
     snapshot_storage = storage.get("snapshot") if isinstance(storage.get("snapshot"), dict) else {}
-    has_recorded_size = (
-        _int_at(snapshot_storage, "allocated_size_bytes") is not None
-        or _int_at(snapshot_storage, "apparent_size_bytes") is not None
-    )
-    if not has_recorded_size:
+    if snapshot.kind == SnapshotRecord.Kind.INCOMPLETE:
         snapshot_storage = _snapshot_storage_from_filesystem(snapshot)
+    else:
+        has_recorded_size = (
+            _int_at(snapshot_storage, "allocated_size_bytes") is not None
+            or _int_at(snapshot_storage, "apparent_size_bytes") is not None
+        )
+        if not has_recorded_size:
+            snapshot_storage = _snapshot_storage_from_filesystem(snapshot)
+    apparent_size = _int_at(snapshot_storage, "apparent_size_bytes")
+    hardlinked_apparent = _int_at(snapshot_storage, "hardlinked_apparent_size_bytes") or 0
     return {
         "id": snapshot.id,
         "dirname": snapshot.dirname,
         "kind": snapshot.kind,
         "status": snapshot.status,
         "started_at": snapshot.started_at,
-        "apparent_size_bytes": _int_at(snapshot_storage, "apparent_size_bytes"),
+        "apparent_size_bytes": apparent_size,
         "allocated_size_bytes": _int_at(snapshot_storage, "allocated_size_bytes"),
         "hardlinked_files": _int_at(snapshot_storage, "hardlinked_files"),
+        "hardlinked_apparent_size_bytes": hardlinked_apparent,
+        "unique_apparent_size_bytes": max((apparent_size or 0) - hardlinked_apparent, 0),
     }
 
 

src/pobsync_backend/templates/pobsync_backend/base.html

@@ -275,6 +275,23 @@
 	    .status.skipped { color: var(--muted); background: #f7f9fb; }
 	    .stack { display: grid; gap: 5px; }
 	    .stack.spaced { margin-bottom: 14px; }
+	    .detail-list {
+	      display: grid;
+	      gap: 8px 14px;
+	      grid-template-columns: minmax(120px, max-content) minmax(0, 1fr);
+	      margin: 0 0 12px;
+	    }
+	    .detail-list dt {
+	      color: var(--muted);
+	      font-size: 12px;
+	      font-weight: 750;
+	      text-transform: uppercase;
+	    }
+	    .detail-list dd {
+	      margin: 0;
+	      min-width: 0;
+	      overflow-wrap: anywhere;
+	    }
 	    .two-col { display: grid; gap: 18px; grid-template-columns: minmax(0, 1fr) minmax(0, 1fr); }
 	    .panel-grid {
 	      display: grid;
@@ -919,17 +936,24 @@
       <span class="nav-primary" aria-label="Primary navigation">
         <a href="{% url 'dashboard' %}" {% if request.resolver_match.url_name == "dashboard" %}aria-current="page"{% endif %}>Dashboard</a>
         <a href="{% url 'hosts_list' %}" {% if request.resolver_match.url_name == "hosts_list" or request.resolver_match.url_name == "host_detail" or request.resolver_match.url_name == "create_host_config" or request.resolver_match.url_name == "edit_host_config" or request.resolver_match.url_name == "edit_host_schedule" %}aria-current="page"{% endif %}>Hosts</a>
-        <a href="{% url 'ssh_credentials' %}" {% if request.resolver_match.url_name == "ssh_credentials" or request.resolver_match.url_name == "create_ssh_credential" or request.resolver_match.url_name == "generate_ssh_credential" or request.resolver_match.url_name == "edit_ssh_credential" %}aria-current="page"{% endif %}>SSH Keys</a>
-        <a href="{% url 'notification_targets' %}" {% if request.resolver_match.url_name == "notification_targets" or request.resolver_match.url_name == "create_notification_target" or request.resolver_match.url_name == "edit_notification_target" %}aria-current="page"{% endif %}>Notifications</a>
-        <a href="{% url 'logs' %}" {% if request.resolver_match.url_name == "logs" %}aria-current="page"{% endif %}>Logs</a>
+        {% if can_manage_control_panel %}
+          <a href="{% url 'ssh_credentials' %}" {% if request.resolver_match.url_name == "ssh_credentials" or request.resolver_match.url_name == "create_ssh_credential" or request.resolver_match.url_name == "generate_ssh_credential" or request.resolver_match.url_name == "edit_ssh_credential" %}aria-current="page"{% endif %}>SSH Keys</a>
+          <a href="{% url 'notification_targets' %}" {% if request.resolver_match.url_name == "notification_targets" or request.resolver_match.url_name == "create_notification_target" or request.resolver_match.url_name == "edit_notification_target" %}aria-current="page"{% endif %}>Notifications</a>
+          <a href="{% url 'logs' %}" {% if request.resolver_match.url_name == "logs" %}aria-current="page"{% endif %}>Logs</a>
+          <a href="{% url 'updater' %}" {% if request.resolver_match.url_name == "updater" %}aria-current="page"{% endif %}>Updater</a>
+        {% endif %}
         <a href="{% url 'purged_snapshots' %}" {% if request.resolver_match.url_name == "purged_snapshots" %}aria-current="page"{% endif %}>Purged</a>
       </span>
       <span class="spacer"></span>
       <span class="nav-secondary" aria-label="System navigation">
-        <a href="{% url 'self_check' %}" {% if request.resolver_match.url_name == "self_check" %}aria-current="page"{% endif %}>Self Check</a>
+        {% if can_manage_control_panel %}
+          <a href="{% url 'self_check' %}" {% if request.resolver_match.url_name == "self_check" %}aria-current="page"{% endif %}>Self Check</a>
+        {% endif %}
         <a href="{% url 'changelog' %}" {% if request.resolver_match.url_name == "changelog" %}aria-current="page"{% endif %}>Changelog</a>
         <a href="/api/status/">Status API</a>
-        <a href="{% url 'admin:index' %}">Admin</a>
+        {% if can_manage_control_panel %}
+          <a href="{% url 'admin:index' %}">Admin</a>
+        {% endif %}
       </span>
       <span class="muted nav-user">{{ request.user.username }}</span>
     </nav>

src/pobsync_backend/templates/pobsync_backend/dashboard.html

@@ -9,27 +9,31 @@
       <h1>Dashboard</h1>
       <div class="page-subtitle">Backup health, required action, storage pressure, and recent activity in one place.</div>
     </div>
-    <section class="actions" aria-label="Dashboard actions">
-      <a class="button-link" href="{% url 'create_host_config' %}">New host</a>
-      <a class="button-link secondary" href="{% url 'edit_global_config' %}">{% if global_config %}Edit global config{% else %}Create global config{% endif %}</a>
-    </section>
+    {% if can_manage_control_panel %}
+      <section class="actions" aria-label="Dashboard actions">
+        <a class="button-link" href="{% url 'create_host_config' %}">New host</a>
+        <a class="button-link secondary" href="{% url 'edit_global_config' %}">{% if global_config %}Edit global config{% else %}Create global config{% endif %}</a>
+      </section>
+    {% endif %}
   </header>
 
-  {% if not global_config or not counts.hosts %}
-    <section class="panel">
-      <h2>Setup</h2>
-      {% if not global_config %}
-        <p class="muted">No default global config exists yet. Create it first so discovery, backups, and retention know where pobsync stores snapshots.</p>
-        <div class="actions inline">
-          <a class="button-link" href="{% url 'edit_global_config' %}">Create global config</a>
-        </div>
-      {% elif not counts.hosts %}
-        <p class="muted">Global config is ready. Add the first host to make this dashboard useful.</p>
-        <div class="actions inline">
-          <a class="button-link" href="{% url 'create_host_config' %}">Add first host</a>
-        </div>
-      {% endif %}
-    </section>
+  {% if can_manage_control_panel %}
+    {% if not global_config or not counts.hosts %}
+      <section class="panel">
+        <h2>Setup</h2>
+        {% if not global_config %}
+          <p class="muted">No default global config exists yet. Create it first so discovery, backups, and retention know where pobsync stores snapshots.</p>
+          <div class="actions inline">
+            <a class="button-link" href="{% url 'edit_global_config' %}">Create global config</a>
+          </div>
+        {% elif not counts.hosts %}
+          <p class="muted">Global config is ready. Add the first host to make this dashboard useful.</p>
+          <div class="actions inline">
+            <a class="button-link" href="{% url 'create_host_config' %}">Add first host</a>
+          </div>
+        {% endif %}
+      </section>
+    {% endif %}
   {% endif %}
 
   <div

src/pobsync_backend/templates/pobsync_backend/host_detail.html

@@ -27,10 +27,12 @@
             {{ retention_warning.incomplete_count }} incomplete snapshot(s) exist. Retention does not delete incomplete
             snapshots automatically; inspect them before cleanup.
           </div>
-          <form method="post" action="{% url 'resolve_host_incomplete_reviews' host.host %}">
-            {% csrf_token %}
-            <button type="submit" class="secondary">Mark incomplete reviewed</button>
-          </form>
+          {% if can_manage_control_panel %}
+            <form method="post" action="{% url 'resolve_host_incomplete_reviews' host.host %}">
+              {% csrf_token %}
+              <button type="submit" class="secondary">Mark incomplete reviewed</button>
+            </form>
+          {% endif %}
         {% endif %}
         {% if retention_warning.error %}
           <div>{{ retention_warning.error }}</div>
@@ -80,8 +82,9 @@
       </div>
     </article>
 
-    <article class="panel host-control-panel">
-      <h2>Backup Control</h2>
+    {% if can_manage_control_panel %}
+      <article class="panel host-control-panel">
+        <h2>Backup Control</h2>
       <div class="operator-state">
         {% if active_run %}
           <span class="status {{ active_run.status }}">{{ active_run.status }}</span>
@@ -105,6 +108,7 @@
         </form>
         <form class="inline-form" method="post" action="{% url 'queue_manual_backup' host.host %}">
           {% csrf_token %}
+          <input type="hidden" name="verbose_output" value="on">
           <input type="hidden" name="prune_max_delete" value="10">
           <button type="submit" {% if not can_queue_real_backup %}disabled{% endif %}>Queue backup</button>
         </form>
@@ -120,10 +124,16 @@
           <p class="muted">Real backups are blocked by failed preflight checks. Dry-runs may still be available when storage-only checks fail.</p>
         {% endif %}
       {% endif %}
-    </article>
+      </article>
+    {% endif %}
 
     <article class="panel host-control-panel">
-      <h2>Schedule <a class="button-link secondary compact" href="{% url 'edit_host_schedule' host.host %}">Edit schedule</a></h2>
+      <h2>
+        Schedule
+        {% if can_manage_control_panel %}
+          <a class="button-link secondary compact" href="{% url 'edit_host_schedule' host.host %}">Edit schedule</a>
+        {% endif %}
+      </h2>
       {% if schedule %}
         <div class="host-control-meta">
           <div><span class="label">Schedule expression</span><strong>{{ schedule.cron_expr }}</strong></div>
@@ -135,7 +145,9 @@
         <p class="muted">Evaluated by the pobsync scheduler service.</p>
       {% else %}
         <p class="muted">No schedule configured.</p>
-        <a class="button-link secondary compact" href="{% url 'edit_host_schedule' host.host %}">Add schedule</a>
+        {% if can_manage_control_panel %}
+          <a class="button-link secondary compact" href="{% url 'edit_host_schedule' host.host %}">Add schedule</a>
+        {% endif %}
       {% endif %}
     </article>
 
@@ -178,21 +190,28 @@
       <div class="metric">
         <div class="label">Scheduled</div>
         <div class="value">{{ stats_summary.backup_data.scheduled.allocated_size_bytes|filesizeformat }}</div>
+        <div class="muted">unique {{ stats_summary.backup_data.scheduled.unique_apparent_size_bytes|filesizeformat }}</div>
       </div>
       <div class="metric">
         <div class="label">Manual</div>
         <div class="value">{{ stats_summary.backup_data.manual.allocated_size_bytes|filesizeformat }}</div>
+        <div class="muted">unique {{ stats_summary.backup_data.manual.unique_apparent_size_bytes|filesizeformat }}</div>
       </div>
       <div class="metric">
         <div class="label">Incomplete</div>
         <div class="value">{{ stats_summary.backup_data.incomplete.allocated_size_bytes|filesizeformat }}</div>
+        <div class="muted">measured from disk</div>
       </div>
       <div class="metric">
         <div class="label">Total</div>
         <div class="value">{{ stats_summary.backup_data.total.allocated_size_bytes|filesizeformat }}</div>
+        <div class="muted">unique {{ stats_summary.backup_data.total.unique_apparent_size_bytes|filesizeformat }}</div>
       </div>
     </section>
-    <p class="muted">Totals use the allocated snapshot size recorded in backup metadata, grouped by snapshot kind.</p>
+    <p class="muted">
+      Main totals use allocated snapshot size. Unique values estimate non-hardlinked visible data; incomplete
+      snapshots are measured from disk because their metadata can be stale.
+    </p>
   </section>
 
   {% if stats_summary.runs %}
@@ -244,8 +263,9 @@
     </section>
   {% endif %}
 
-  <section class="panel">
-    <h2>Host Check</h2>
+  {% if can_manage_control_panel %}
+    <section class="panel">
+      <h2>Host Check</h2>
     <section class="grid" aria-label="Host check summary">
       <div class="metric"><div class="label">OK</div><div class="value">{{ host_check_summary.ok }}</div></div>
       <div class="metric"><div class="label">Warnings</div><div class="value">{{ host_check_summary.warning }}</div></div>
@@ -271,26 +291,32 @@
         </article>
       {% endfor %}
     </div>
-  </section>
+    </section>
+  {% endif %}
 
   <div class="panel-grid">
     <section class="panel">
       <h2>Configuration</h2>
       <div class="host-control-meta">
         <div><span class="label">Address</span><strong>{{ host.address }}</strong></div>
-        <div><span class="label">SSH key</span><strong>{{ host.ssh_credential|default:"global default" }}</strong></div>
-        <div><span class="label">SSH</span><strong>{{ host.ssh_user|default:"global" }}{% if host.ssh_port %}:{{ host.ssh_port }}{% endif %}</strong></div>
+        {% if can_manage_control_panel %}
+          <div><span class="label">SSH key</span><strong>{{ host.ssh_credential|default:"global default" }}</strong></div>
+          <div><span class="label">SSH</span><strong>{{ host.ssh_user|default:"global" }}{% if host.ssh_port %}:{{ host.ssh_port }}{% endif %}</strong></div>
+        {% endif %}
         <div><span class="label">Backup source</span><strong>{{ host.source_root|default:"global default" }}</strong></div>
         <div><span class="label">Retention</span><strong>d{{ host.retention_daily }} w{{ host.retention_weekly }} m{{ host.retention_monthly }} y{{ host.retention_yearly }}</strong></div>
       </div>
-      <div class="actions inline">
-        <a class="button-link secondary compact" href="{% url 'edit_host_config' host.host %}">Edit config</a>
-        <a class="button-link secondary compact" href="{% url 'host_retention_plan' host.host %}">Plan retention</a>
-      </div>
+      {% if can_manage_control_panel %}
+        <div class="actions inline">
+          <a class="button-link secondary compact" href="{% url 'edit_host_config' host.host %}">Edit config</a>
+          <a class="button-link secondary compact" href="{% url 'host_retention_plan' host.host %}">Plan retention</a>
+        </div>
+      {% endif %}
     </section>
 
-    <section class="panel">
-      <h2>Connection Preflight &amp; SSH</h2>
+    {% if can_manage_control_panel %}
+      <section class="panel">
+        <h2>Connection Preflight &amp; SSH</h2>
       {% if last_preflight %}
         <div class="host-control-meta">
           <div>
@@ -333,7 +359,8 @@
           {% endfor %}
         </div>
       {% endif %}
-    </section>
+      </section>
+    {% endif %}
 
     <section class="panel">
       <h2>Snapshot Storage</h2>
@@ -352,16 +379,18 @@
           </div>
         {% endif %}
       </div>
-      <div class="actions inline">
-        <form method="post" action="{% url 'discover_host_snapshots' host.host %}">
-          {% csrf_token %}
-          <button type="submit" class="secondary compact">Discover snapshots</button>
-        </form>
-        <form method="post" action="{% url 'prepare_host_directories' host.host %}">
-          {% csrf_token %}
-          <button type="submit" class="secondary compact">Prepare directories</button>
-        </form>
-      </div>
+      {% if can_manage_control_panel %}
+        <div class="actions inline">
+          <form method="post" action="{% url 'discover_host_snapshots' host.host %}">
+            {% csrf_token %}
+            <button type="submit" class="secondary compact">Discover snapshots</button>
+          </form>
+          <form method="post" action="{% url 'prepare_host_directories' host.host %}">
+            {% csrf_token %}
+            <button type="submit" class="secondary compact">Prepare directories</button>
+          </form>
+        </div>
+      {% endif %}
     </section>
   </div>
 
@@ -443,8 +472,9 @@
     </section>
   {% endif %}
 
-  <section class="panel">
-    <h2>Backup Options</h2>
+  {% if can_manage_control_panel %}
+    <section class="panel">
+      <h2>Backup Options</h2>
     <p class="muted">Use this when the quick actions above need a custom label, include/exclude override, or prune limit.</p>
     <form method="post" action="{% url 'queue_manual_backup' host.host %}" class="form-grid">
       {% csrf_token %}
@@ -463,7 +493,8 @@
         <button type="submit" {% if not can_queue_dry_run and not can_queue_real_backup %}disabled{% endif %}>Queue with options</button>
       </div>
     </form>
-  </section>
+    </section>
+  {% endif %}
 
   <section class="panel">
     <h2>Latest Runs <a class="button-link secondary compact" href="{% url 'runs_list' %}?host={{ host.host }}">View all</a></h2>

src/pobsync_backend/templates/pobsync_backend/hosts_list.html

@@ -9,9 +9,11 @@
       <h1>Hosts</h1>
       <div class="page-subtitle">Configured backup targets, schedules, retention state, and host-level controls.</div>
     </div>
-    <section class="actions" aria-label="Host actions">
-      <a class="button-link" href="{% url 'create_host_config' %}">New host</a>
-    </section>
+    {% if can_manage_control_panel %}
+      <section class="actions" aria-label="Host actions">
+        <a class="button-link" href="{% url 'create_host_config' %}">New host</a>
+      </section>
+    {% endif %}
   </header>
 
   <section class="grid dashboard-summary-grid" aria-label="Host summary">

src/pobsync_backend/templates/pobsync_backend/partials/dashboard_hosts.html

@@ -105,18 +105,22 @@
               <div class="host-card-stat">
                 <div class="label">Scheduled data</div>
                 <div class="value">{{ host.stats_summary.backup_data.scheduled.allocated_size_bytes|filesizeformat }}</div>
+                <div class="muted">unique {{ host.stats_summary.backup_data.scheduled.unique_apparent_size_bytes|filesizeformat }}</div>
               </div>
               <div class="host-card-stat">
                 <div class="label">Manual data</div>
                 <div class="value">{{ host.stats_summary.backup_data.manual.allocated_size_bytes|filesizeformat }}</div>
+                <div class="muted">unique {{ host.stats_summary.backup_data.manual.unique_apparent_size_bytes|filesizeformat }}</div>
               </div>
               <div class="host-card-stat">
                 <div class="label">Incomplete data</div>
                 <div class="value">{{ host.stats_summary.backup_data.incomplete.allocated_size_bytes|filesizeformat }}</div>
+                <div class="muted">measured from disk</div>
               </div>
               <div class="host-card-stat">
                 <div class="label">Total data</div>
                 <div class="value">{{ host.stats_summary.backup_data.total.allocated_size_bytes|filesizeformat }}</div>
+                <div class="muted">unique {{ host.stats_summary.backup_data.total.unique_apparent_size_bytes|filesizeformat }}</div>
               </div>
             </div>
           </div>

src/pobsync_backend/templates/pobsync_backend/partials/dashboard_priority.html

@@ -130,18 +130,22 @@
       <div>
         <span class="label">Scheduled data</span>
         <strong>{{ stats_summary.backup_data.scheduled.allocated_size_bytes|filesizeformat }}</strong>
+        <span class="muted">unique {{ stats_summary.backup_data.scheduled.unique_apparent_size_bytes|filesizeformat }}</span>
       </div>
       <div>
         <span class="label">Manual data</span>
         <strong>{{ stats_summary.backup_data.manual.allocated_size_bytes|filesizeformat }}</strong>
+        <span class="muted">unique {{ stats_summary.backup_data.manual.unique_apparent_size_bytes|filesizeformat }}</span>
       </div>
       <div>
         <span class="label">Incomplete data</span>
         <strong>{{ stats_summary.backup_data.incomplete.allocated_size_bytes|filesizeformat }}</strong>
+        <span class="muted">measured from disk</span>
       </div>
       <div>
         <span class="label">Total snapshot data</span>
         <strong>{{ stats_summary.backup_data.total.allocated_size_bytes|filesizeformat }}</strong>
+        <span class="muted">unique {{ stats_summary.backup_data.total.unique_apparent_size_bytes|filesizeformat }}</span>
       </div>
     </div>
   </article>

src/pobsync_backend/templates/pobsync_backend/partials/run_detail_live.html

@@ -32,7 +32,7 @@
   </section>
 {% endif %}
 
-{% if run.status == "failed" or run.status == "warning" %}
+{% if can_manage_control_panel and run.status == "failed" or can_manage_control_panel and run.status == "warning" %}
   {% if not run.reviewed_at %}
     <section class="panel highlight warning">
       <h2>Review Required</h2>
@@ -78,7 +78,7 @@
       {% endif %}
       <div>
         <strong>Log:</strong>
-        {% if dry_run_summary.log_available %}
+        {% if dry_run_summary.log_available and can_manage_control_panel %}
           <a href="{% url 'run_rsync_log' run.id %}">Open full rsync log</a>
         {% elif rsync_log_path %}
           <span class="muted">{{ rsync_log_path }} (missing)</span>
@@ -155,7 +155,7 @@
       {% if live_progress.log.path %}
         <div>
           <strong>Log:</strong>
-          {% if live_progress.log.exists %}
+          {% if live_progress.log.exists and can_manage_control_panel %}
             <a href="{% url 'run_rsync_log' run.id %}">Open full rsync log</a>
           {% else %}
             <span class="muted">{{ live_progress.log.path }} (missing)</span>
@@ -189,7 +189,7 @@
       <div><strong>Base:</strong> {{ run.base_path|default:"" }}</div>
       <div>
         <strong>Rsync log:</strong>
-        {% if rsync_log_exists %}
+        {% if rsync_log_exists and can_manage_control_panel %}
           <a href="{% url 'run_rsync_log' run.id %}">{{ rsync_log_path }}</a>
         {% elif rsync_log_path %}
           <span class="muted">{{ rsync_log_path }} (missing)</span>
@@ -204,7 +204,7 @@
 <section class="panel">
   <h2>Rsync Log</h2>
   <div class="stack spaced">
-    {% if rsync_log_exists %}
+    {% if rsync_log_exists and can_manage_control_panel %}
       <div><a href="{% url 'run_rsync_log' run.id %}">Open full rsync log</a></div>
       <div class="muted">{{ rsync_log_path }}</div>
     {% elif rsync_log_path %}

src/pobsync_backend/templates/pobsync_backend/updater.html

@@ -0,0 +1,122 @@
+{% extends "pobsync_backend/base.html" %}
+
+{% block title %}Updater | pobsync{% endblock %}
+
+{% block content %}
+  <header class="page-header">
+    <div class="page-title">
+      <div class="page-kicker">Operations</div>
+      <h1>Updater</h1>
+      <div class="page-subtitle">Check Gitea releases, pull the installed git checkout, and run the native systemd updater.</div>
+    </div>
+    <section class="actions" aria-label="Updater actions">
+      <a class="button-link secondary" href="{% url 'dashboard' %}">Back to dashboard</a>
+    </section>
+  </header>
+
+  <section class="panel-grid">
+    <section class="panel">
+      <h2>Installed App</h2>
+      <dl class="detail-list">
+        <dt>Version</dt>
+        <dd>{{ status.installed_version }}</dd>
+        <dt>Git branch</dt>
+        <dd>{{ status.git.branch|default:"unknown" }}</dd>
+        <dt>Git commit</dt>
+        <dd>{{ status.git.commit|default:"unknown" }}</dd>
+        <dt>Git describe</dt>
+        <dd>{{ status.git.describe|default:"unknown" }}</dd>
+        <dt>App directory</dt>
+        <dd>{{ status.app_dir }}</dd>
+      </dl>
+    </section>
+
+    <section class="panel">
+      <h2>Release Check</h2>
+      <dl class="detail-list">
+        <dt>Status</dt>
+        <dd>
+          {% if status.update_available == True %}
+            <span class="status warning">update available</span>
+          {% elif status.update_available == False %}
+            <span class="status ok">up to date</span>
+          {% elif status.release_check_configured %}
+            <span class="status skipped">not checked</span>
+          {% else %}
+            <span class="status skipped">not configured</span>
+          {% endif %}
+        </dd>
+        <dt>Latest release</dt>
+        <dd>
+          {% if status.latest_release %}
+            {% if status.latest_release.html_url %}
+              <a href="{{ status.latest_release.html_url }}">
+                {% if status.latest_release.tag_name %}{{ status.latest_release.tag_name }}{% else %}{{ status.latest_release.name }}{% endif %}
+              </a>
+            {% else %}
+              {% if status.latest_release.tag_name %}{{ status.latest_release.tag_name }}{% else %}{{ status.latest_release.name }}{% endif %}
+            {% endif %}
+          {% else %}
+            none
+          {% endif %}
+        </dd>
+        <dt>Release endpoint</dt>
+        <dd>{% if status.release_check_configured %}configured{% else %}set POBSYNC_UPDATE_RELEASES_URL{% endif %}</dd>
+      </dl>
+      {% if status.release_error %}
+        <p class="status failed">{{ status.release_error }}</p>
+      {% endif %}
+      <form method="post" class="actions inline">
+        {% csrf_token %}
+        <button type="submit" name="action" value="check_release">Check releases</button>
+      </form>
+    </section>
+  </section>
+
+  <section class="panel">
+    <h2>Update Actions</h2>
+    <p class="muted">Run these from the installed checkout. The native updater may require a sudoers rule for the pobsync service user.</p>
+    <dl class="detail-list">
+      <dt>Git remote</dt>
+      <dd>{{ status.git_remote }}</dd>
+      <dt>Update command</dt>
+      <dd><code>{{ status.update_command }}</code></dd>
+    </dl>
+    <div class="actions">
+      <form method="post" class="inline-form">
+        {% csrf_token %}
+        <button class="secondary" type="submit" name="action" value="git_fetch">Fetch releases</button>
+      </form>
+      <form method="post" class="inline-form">
+        {% csrf_token %}
+        <button class="secondary" type="submit" name="action" value="git_pull">Pull current branch</button>
+      </form>
+      <form method="post" class="inline-form">
+        {% csrf_token %}
+        <button type="submit" name="action" value="run_update">Run native updater</button>
+      </form>
+    </div>
+  </section>
+
+  {% if action_result %}
+    <section class="panel">
+      <h2>Last Action Result</h2>
+      <dl class="detail-list">
+        <dt>Status</dt>
+        <dd><span class="status {% if action_result.ok %}ok{% else %}failed{% endif %}">{% if action_result.ok %}ok{% else %}failed{% endif %}</span></dd>
+        <dt>Exit code</dt>
+        <dd>{{ action_result.exit_code }}</dd>
+        <dt>Command</dt>
+        <dd><code>{{ action_result.command|join:" " }}</code></dd>
+      </dl>
+      {% if action_result.stdout %}
+        <h3>Stdout</h3>
+        <pre>{{ action_result.stdout }}</pre>
+      {% endif %}
+      {% if action_result.stderr %}
+        <h3>Stderr</h3>
+        <pre>{{ action_result.stderr }}</pre>
+      {% endif %}
+    </section>
+  {% endif %}
+{% endblock %}

src/pobsync_backend/tests/test_api.py

@@ -18,6 +18,12 @@ class ApiTests(TestCase):
             is_staff=True,
             is_superuser=True,
         )
+        self.readonly_user = user_model.objects.create_user(
+            username="viewer",
+            password="secret",
+            is_staff=False,
+            is_superuser=False,
+        )
 
     def test_api_requires_staff_login(self) -> None:
         response = self.client.get("/api/hosts/")
@@ -25,6 +31,15 @@ class ApiTests(TestCase):
         self.assertEqual(response.status_code, 302)
         self.assertIn("/admin/login/", response["Location"])
 
+    def test_readonly_user_can_access_status_endpoint_only(self) -> None:
+        self.client.force_login(self.readonly_user)
+
+        status_response = self.client.get("/api/status/")
+        hosts_response = self.client.get("/api/hosts/")
+
+        self.assertEqual(status_response.status_code, 200)
+        self.assertEqual(hosts_response.status_code, 403)
+
     def test_hosts_endpoint_returns_counts_and_schedule(self) -> None:
         self.client.force_login(self.staff_user)
         host = HostConfig.objects.create(host="web-01", address="web-01.example.test")

src/pobsync_backend/tests/test_backup_worker.py

@@ -39,13 +39,20 @@ class BackupWorkerTests(TestCase):
             },
         )
 
-    def test_queue_backup_run_can_request_verbose_output(self) -> None:
+    def test_queue_backup_run_enables_verbose_output_by_default(self) -> None:
         host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
 
-        run = queue_backup_run(host=host, verbose_output=True)
+        run = queue_backup_run(host=host)
 
         self.assertTrue(run.result["requested"]["verbose_output"])
 
+    def test_queue_backup_run_can_disable_verbose_output(self) -> None:
+        host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
+
+        run = queue_backup_run(host=host, verbose_output=False)
+
+        self.assertFalse(run.result["requested"]["verbose_output"])
+
     def test_worker_executes_next_queued_run(self) -> None:
         with TemporaryDirectory() as tmp:
             backup_root = Path(tmp) / "backups"

src/pobsync_backend/tests/test_console_entrypoint.py

@@ -5,6 +5,7 @@ from unittest.mock import patch
 
 from django.test import SimpleTestCase
 
+from pobsync import __version__
 from pobsync.cli import main
 
 
@@ -15,7 +16,7 @@ class ConsoleEntrypointTests(SimpleTestCase):
             exit_code = main(["--version"])
 
         self.assertEqual(exit_code, 0)
-        self.assertEqual(stdout.getvalue().strip(), "pobsync 1.1.0")
+        self.assertEqual(stdout.getvalue().strip(), f"pobsync {__version__}")
 
     def test_maps_backup_alias_to_django_command(self) -> None:
         with patch("pobsync.cli.execute_from_command_line") as execute:

src/pobsync_backend/tests/test_run_backup_records_snapshot.py

@@ -39,12 +39,16 @@ class RunBackupRecordsSnapshotTests(TestCase):
                     "host": host.host,
                     "snapshot": str(snapshot_dir),
                     "base": None,
+                    "verbose_output": True,
                     "rsync": {"exit_code": 0},
                 }
                 call_command("run_pobsync_backup", host.host, prefix=str(Path(tmp) / "home"), stdout=StringIO())
 
+        run_scheduled.assert_called_once()
+        self.assertTrue(run_scheduled.call_args.kwargs["verbose_output"])
         self.assertEqual(BackupRun.objects.count(), 1)
         run = BackupRun.objects.get()
+        self.assertTrue(run.result["verbose_output"])
         self.assertEqual(SnapshotRecord.objects.count(), 1)
         record = SnapshotRecord.objects.get()
         self.assertEqual(run.snapshot, record)
@@ -52,6 +56,45 @@ class RunBackupRecordsSnapshotTests(TestCase):
         self.assertEqual(record.kind, "scheduled")
         self.assertEqual(record.status, "success")
 
+    def test_backup_command_can_skip_default_verbose_rsync_output(self) -> None:
+        with TemporaryDirectory() as tmp:
+            backup_root = Path(tmp) / "backups"
+            GlobalConfig.objects.create(name="default", backup_root=str(backup_root))
+            host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
+            snapshot_dir = backup_root / host.host / "scheduled" / "20260519-021500Z__ABCDEFGH"
+            meta_dir = snapshot_dir / "meta"
+            meta_dir.mkdir(parents=True)
+            write_yaml_atomic(
+                meta_dir / "meta.yaml",
+                {
+                    "status": "success",
+                    "started_at": "2026-05-19T02:15:00Z",
+                    "ended_at": "2026-05-19T02:16:00Z",
+                },
+            )
+
+            with patch("pobsync_backend.backup_runner.run_scheduled") as run_scheduled:
+                run_scheduled.return_value = {
+                    "ok": True,
+                    "dry_run": False,
+                    "host": host.host,
+                    "snapshot": str(snapshot_dir),
+                    "base": None,
+                    "verbose_output": False,
+                    "rsync": {"exit_code": 0},
+                }
+                call_command(
+                    "run_pobsync_backup",
+                    host.host,
+                    prefix=str(Path(tmp) / "home"),
+                    quiet_rsync=True,
+                    stdout=StringIO(),
+                )
+
+        run_scheduled.assert_called_once()
+        self.assertFalse(run_scheduled.call_args.kwargs["verbose_output"])
+        self.assertFalse(BackupRun.objects.get().result["verbose_output"])
+
     def test_prune_uses_sql_retention_after_snapshot_record_is_created(self) -> None:
         with TemporaryDirectory() as tmp:
             backup_root = Path(tmp) / "backups"

src/pobsync_backend/tests/test_stats_summary.py

@@ -18,32 +18,44 @@ class StatsSummaryTests(TestCase):
         self._snapshot(web, "20260519-021500Z__SCHED01", SnapshotRecord.Kind.SCHEDULED, allocated=100)
         self._snapshot(web, "20260519-031500Z__MANUAL1", SnapshotRecord.Kind.MANUAL, allocated=200)
         self._snapshot(db, "20260519-041500Z__SCHED02", SnapshotRecord.Kind.SCHEDULED, allocated=300)
-        self._snapshot(db, "20260519-051500Z__BROKEN1", SnapshotRecord.Kind.INCOMPLETE, allocated=400)
+        with TemporaryDirectory() as tmp:
+            incomplete_usage = self._incomplete_snapshot_on_disk(
+                db,
+                Path(tmp),
+                "20260519-051500Z__BROKEN1",
+            )
 
-        stats = collect_dashboard_stats(hosts=[web, db], global_config=None)
+            stats = collect_dashboard_stats(hosts=[web, db], global_config=None)
 
         self.assertEqual(stats["backup_data"]["scheduled"]["count"], 2)
         self.assertEqual(stats["backup_data"]["scheduled"]["allocated_size_bytes"], 400)
         self.assertEqual(stats["backup_data"]["manual"]["allocated_size_bytes"], 200)
-        self.assertEqual(stats["backup_data"]["incomplete"]["allocated_size_bytes"], 400)
+        self.assertEqual(stats["backup_data"]["incomplete"]["allocated_size_bytes"], incomplete_usage["allocated_size_bytes"])
         self.assertEqual(stats["backup_data"]["total"]["count"], 4)
-        self.assertEqual(stats["backup_data"]["total"]["allocated_size_bytes"], 1000)
+        self.assertEqual(stats["backup_data"]["total"]["allocated_size_bytes"], 600 + incomplete_usage["allocated_size_bytes"])
+        self.assertEqual(stats["backup_data"]["total"]["unique_apparent_size_bytes"], 1200 + incomplete_usage["apparent_size_bytes"])
 
     def test_collect_host_stats_sums_backup_data_by_snapshot_kind(self) -> None:
         host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
         self._snapshot(host, "20260519-021500Z__SCHED01", SnapshotRecord.Kind.SCHEDULED, allocated=100)
         self._snapshot(host, "20260519-031500Z__SCHED02", SnapshotRecord.Kind.SCHEDULED, allocated=200)
         self._snapshot(host, "20260519-041500Z__MANUAL1", SnapshotRecord.Kind.MANUAL, allocated=300)
-        self._snapshot(host, "20260519-051500Z__BROKEN1", SnapshotRecord.Kind.INCOMPLETE, allocated=400)
+        with TemporaryDirectory() as tmp:
+            incomplete_usage = self._incomplete_snapshot_on_disk(
+                host,
+                Path(tmp),
+                "20260519-051500Z__BROKEN1",
+            )
 
-        stats = collect_host_stats(host=host)
+            stats = collect_host_stats(host=host)
 
         self.assertEqual(stats["backup_data"]["scheduled"]["count"], 2)
         self.assertEqual(stats["backup_data"]["scheduled"]["allocated_size_bytes"], 300)
         self.assertEqual(stats["backup_data"]["manual"]["allocated_size_bytes"], 300)
-        self.assertEqual(stats["backup_data"]["incomplete"]["allocated_size_bytes"], 400)
+        self.assertEqual(stats["backup_data"]["incomplete"]["allocated_size_bytes"], incomplete_usage["allocated_size_bytes"])
         self.assertEqual(stats["backup_data"]["total"]["count"], 4)
-        self.assertEqual(stats["backup_data"]["total"]["allocated_size_bytes"], 1000)
+        self.assertEqual(stats["backup_data"]["total"]["allocated_size_bytes"], 600 + incomplete_usage["allocated_size_bytes"])
+        self.assertEqual(stats["backup_data"]["total"]["unique_apparent_size_bytes"], 1200 + incomplete_usage["apparent_size_bytes"])
 
     def test_collect_host_stats_falls_back_to_filesystem_usage_for_snapshots_without_metadata(self) -> None:
         host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
@@ -81,8 +93,87 @@ class StatsSummaryTests(TestCase):
             expected_usage["allocated_size_bytes"],
         )
 
+    def test_collect_host_stats_measures_incomplete_data_from_disk_even_with_stale_metadata(self) -> None:
+        host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
+        with TemporaryDirectory() as tmp:
+            incomplete_dir = Path(tmp) / host.host / ".incomplete" / "20260519-051500Z__BROKEN1"
+            data_dir = incomplete_dir / "data"
+            data_dir.mkdir(parents=True)
+            data_dir.joinpath("partial-file").write_text("interrupted backup data\n", encoding="utf-8")
+            expected_usage = tree_usage(data_dir)
+            SnapshotRecord.objects.create(
+                host=host,
+                kind=SnapshotRecord.Kind.INCOMPLETE,
+                dirname=incomplete_dir.name,
+                path=str(incomplete_dir),
+                status="failed",
+                metadata={
+                    "stats": {
+                        "storage": {
+                            "snapshot": {
+                                "apparent_size_bytes": 0,
+                                "allocated_size_bytes": 0,
+                            }
+                        }
+                    }
+                },
+            )
+
+            stats = collect_host_stats(host=host)
+
+        self.assertEqual(
+            stats["backup_data"]["incomplete"]["allocated_size_bytes"],
+            expected_usage["allocated_size_bytes"],
+        )
+        self.assertGreater(stats["backup_data"]["incomplete"]["apparent_size_bytes"], 0)
+
+    def test_collect_host_stats_reports_non_hardlinked_snapshot_data(self) -> None:
+        host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
+        self._snapshot_with_sizes(
+            host,
+            "20260519-021500Z__SCHED01",
+            SnapshotRecord.Kind.SCHEDULED,
+            allocated=1_200,
+            apparent=2_000,
+            hardlinked_apparent=1_500,
+        )
+
+        stats = collect_host_stats(host=host)
+
+        self.assertEqual(stats["backup_data"]["scheduled"]["apparent_size_bytes"], 2_000)
+        self.assertEqual(stats["backup_data"]["scheduled"]["unique_apparent_size_bytes"], 500)
+        self.assertEqual(stats["backup_data"]["total"]["unique_apparent_size_bytes"], 500)
+
     def _snapshot(self, host: HostConfig, dirname: str, kind: str, *, allocated: int) -> SnapshotRecord:
+        return self._snapshot_with_sizes(host, dirname, kind, allocated=allocated)
+
+    def _incomplete_snapshot_on_disk(self, host: HostConfig, root: Path, dirname: str) -> dict:
+        incomplete_dir = root / host.host / ".incomplete" / dirname
+        data_dir = incomplete_dir / "data"
+        data_dir.mkdir(parents=True)
+        data_dir.joinpath("partial-file").write_text("interrupted backup data\n", encoding="utf-8")
+        usage = tree_usage(data_dir)
+        SnapshotRecord.objects.create(
+            host=host,
+            kind=SnapshotRecord.Kind.INCOMPLETE,
+            dirname=dirname,
+            path=str(incomplete_dir),
+            status="failed",
+        )
+        return usage
+
+    def _snapshot_with_sizes(
+        self,
+        host: HostConfig,
+        dirname: str,
+        kind: str,
+        *,
+        allocated: int,
+        apparent: int | None = None,
+        hardlinked_apparent: int = 0,
+    ) -> SnapshotRecord:
         started_at = datetime.strptime(dirname.split("__", 1)[0], "%Y%m%d-%H%M%SZ").replace(tzinfo=timezone.utc)
+        apparent_size = apparent if apparent is not None else allocated * 2
         return SnapshotRecord.objects.create(
             host=host,
             kind=kind,
@@ -94,8 +185,9 @@ class StatsSummaryTests(TestCase):
                 "stats": {
                     "storage": {
                         "snapshot": {
-                            "apparent_size_bytes": allocated * 2,
+                            "apparent_size_bytes": apparent_size,
                             "allocated_size_bytes": allocated,
+                            "hardlinked_apparent_size_bytes": hardlinked_apparent,
                         }
                     }
                 }

src/pobsync_backend/tests/test_updater.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+import json
+from unittest.mock import MagicMock, patch
+
+from django.test import SimpleTestCase, override_settings
+
+from pobsync_backend import updater
+
+
+class UpdaterTests(SimpleTestCase):
+    @override_settings(
+        POBSYNC_UPDATE_RELEASES_URL="https://code.example.test/api/v1/repos/owner/pobsync/releases",
+        POBSYNC_UPDATE_RELEASES_TOKEN="secret",
+    )
+    def test_fetch_latest_release_reads_first_gitea_release(self) -> None:
+        response = MagicMock()
+        response.__enter__.return_value.read.return_value = json.dumps(
+            [
+                {
+                    "tag_name": "v1.2.0",
+                    "name": "1.2.0",
+                    "html_url": "https://code.example.test/releases/v1.2.0",
+                }
+            ]
+        ).encode("utf-8")
+
+        with patch("pobsync_backend.updater.urlopen", return_value=response) as urlopen:
+            release = updater.fetch_latest_release()
+
+        self.assertEqual(release["tag_name"], "v1.2.0")
+        request = urlopen.call_args.args[0]
+        self.assertEqual(request.full_url, "https://code.example.test/api/v1/repos/owner/pobsync/releases")
+        self.assertEqual(request.headers["Authorization"], "token secret")
+
+    @override_settings(POBSYNC_UPDATE_RELEASES_URL="")
+    def test_collect_update_status_reports_unconfigured_release_check(self) -> None:
+        with patch("pobsync_backend.updater._git_status", return_value={"branch": "master"}):
+            status = updater.collect_update_status(check_release=True)
+
+        self.assertFalse(status["release_check_configured"])
+        self.assertEqual(status["release_error"], "POBSYNC_UPDATE_RELEASES_URL is not configured.")
+        self.assertIsNone(status["update_available"])
+
+    @override_settings(POBSYNC_UPDATE_GIT_REMOTE="upstream")
+    def test_run_git_fetch_uses_configured_remote(self) -> None:
+        completed = MagicMock(returncode=0, stdout="ok", stderr="")
+        with patch("pobsync_backend.updater.subprocess.run", return_value=completed) as run:
+            result = updater.run_git_fetch()
+
+        self.assertTrue(result.ok)
+        self.assertEqual(result.command, ["git", "fetch", "--tags", "--prune", "upstream"])
+        run.assert_called_once()
+
+    @override_settings(POBSYNC_UPDATE_GIT_REMOTE="origin")
+    def test_run_git_pull_rejects_detached_checkout(self) -> None:
+        with patch("pobsync_backend.updater._git_current_branch", return_value=""):
+            result = updater.run_git_pull()
+
+        self.assertFalse(result.ok)
+        self.assertEqual(result.exit_code, 2)
+        self.assertIn("not on a branch", result.stderr)
+
+    @override_settings(POBSYNC_UPDATE_COMMAND="sudo -n scripts/update-systemd --verbose")
+    def test_run_native_update_splits_configured_command(self) -> None:
+        completed = MagicMock(returncode=1, stdout="", stderr="sudo failed")
+        with patch("pobsync_backend.updater.subprocess.run", return_value=completed):
+            result = updater.run_native_update()
+
+        self.assertFalse(result.ok)
+        self.assertEqual(result.command, ["sudo", "-n", "scripts/update-systemd", "--verbose"])
+        self.assertEqual(result.stderr, "sudo failed")

src/pobsync_backend/tests/test_views.py

@@ -36,6 +36,12 @@ class ViewTests(TestCase):
             is_staff=True,
             is_superuser=True,
         )
+        self.readonly_user = user_model.objects.create_user(
+            username="viewer",
+            password="secret",
+            is_staff=False,
+            is_superuser=False,
+        )
 
     def test_dashboard_requires_staff_login(self) -> None:
         response = self.client.get(reverse("dashboard"))
@@ -56,6 +62,7 @@ class ViewTests(TestCase):
         self.assertContains(response, reverse("ssh_credentials"))
         self.assertContains(response, reverse("notification_targets"))
         self.assertContains(response, reverse("logs"))
+        self.assertContains(response, reverse("updater"))
         self.assertContains(response, reverse("purged_snapshots"))
         self.assertContains(response, reverse("self_check"))
         self.assertContains(response, reverse("changelog"))
@@ -63,6 +70,23 @@ class ViewTests(TestCase):
         self.assertContains(response, reverse("admin:index"))
         self.assertContains(response, '<a href="/" aria-current="page">Dashboard</a>', html=False)
 
+    def test_readonly_navigation_hides_admin_and_sensitive_links(self) -> None:
+        self.client.force_login(self.readonly_user)
+
+        response = self.client.get(reverse("dashboard"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, reverse("dashboard"))
+        self.assertContains(response, reverse("hosts_list"))
+        self.assertContains(response, reverse("changelog"))
+        self.assertContains(response, "/api/status/")
+        self.assertNotContains(response, reverse("ssh_credentials"))
+        self.assertNotContains(response, reverse("notification_targets"))
+        self.assertNotContains(response, reverse("logs"))
+        self.assertNotContains(response, reverse("updater"))
+        self.assertNotContains(response, reverse("self_check"))
+        self.assertNotContains(response, reverse("admin:index"))
+
     def test_base_navigation_marks_current_secondary_page(self) -> None:
         self.client.force_login(self.staff_user)
 
@@ -71,12 +95,166 @@ class ViewTests(TestCase):
         self.assertEqual(response.status_code, 200)
         self.assertContains(response, f'<a href="{reverse("self_check")}" aria-current="page">Self Check</a>', html=False)
 
-    def test_changelog_requires_staff_login(self) -> None:
+    def test_changelog_requires_login(self) -> None:
         response = self.client.get(reverse("changelog"))
 
         self.assertEqual(response.status_code, 302)
         self.assertIn("/admin/login/", response["Location"])
 
+    def test_readonly_user_can_view_status_pages(self) -> None:
+        self.client.force_login(self.readonly_user)
+        host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
+        snapshot = SnapshotRecord.objects.create(
+            host=host,
+            kind=SnapshotRecord.Kind.SCHEDULED,
+            dirname="20260519-021500Z__ABCDEFGH",
+            path="/backups/web-01/scheduled/20260519-021500Z__ABCDEFGH",
+            status="success",
+        )
+        run = BackupRun.objects.create(host=host, status=BackupRun.Status.SUCCESS, snapshot=snapshot)
+
+        urls = [
+            reverse("dashboard"),
+            reverse("hosts_list"),
+            reverse("host_detail", args=[host.host]),
+            reverse("runs_list"),
+            reverse("run_detail", args=[run.id]),
+            reverse("snapshots_list"),
+            reverse("snapshot_detail", args=[snapshot.id]),
+            reverse("schedules_list"),
+            reverse("purged_snapshots"),
+        ]
+
+        for url in urls:
+            with self.subTest(url=url):
+                response = self.client.get(url)
+                self.assertEqual(response.status_code, 200)
+
+    def test_readonly_user_cannot_access_sensitive_or_mutating_views(self) -> None:
+        self.client.force_login(self.readonly_user)
+        host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
+
+        blocked_urls = [
+            reverse("ssh_credentials"),
+            reverse("logs"),
+            reverse("updater"),
+            reverse("self_check"),
+            reverse("edit_global_config"),
+            reverse("create_host_config"),
+            reverse("edit_host_config", args=[host.host]),
+            reverse("edit_host_schedule", args=[host.host]),
+        ]
+
+        for url in blocked_urls:
+            with self.subTest(url=url):
+                response = self.client.get(url)
+                self.assertEqual(response.status_code, 403)
+
+    def test_updater_view_renders_status(self) -> None:
+        self.client.force_login(self.staff_user)
+
+        with patch("pobsync_backend.views.collect_update_status") as collect_update_status:
+            collect_update_status.return_value = {
+                "app_dir": "/opt/pobsync/app",
+                "installed_version": "1.1.0",
+                "release_check_configured": True,
+                "update_command": "sudo -n scripts/update-systemd",
+                "git_remote": "origin",
+                "git": {"branch": "master", "commit": "abc1234", "describe": "v1.1.0"},
+                "latest_release": None,
+                "release_error": "",
+                "update_available": None,
+            }
+
+            response = self.client.get(reverse("updater"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Updater")
+        self.assertContains(response, "1.1.0")
+        self.assertContains(response, "master")
+        collect_update_status.assert_called_once_with(check_release=False)
+
+    def test_updater_check_release_requests_release_status(self) -> None:
+        self.client.force_login(self.staff_user)
+
+        with patch("pobsync_backend.views.collect_update_status") as collect_update_status:
+            collect_update_status.return_value = {
+                "app_dir": "/opt/pobsync/app",
+                "installed_version": "1.1.0",
+                "release_check_configured": True,
+                "update_command": "sudo -n scripts/update-systemd",
+                "git_remote": "origin",
+                "git": {"branch": "master", "commit": "abc1234", "describe": "v1.1.0"},
+                "latest_release": {"tag_name": "v1.2.0", "html_url": "https://code.example.test/releases/v1.2.0"},
+                "release_error": "",
+                "update_available": True,
+            }
+
+            response = self.client.post(reverse("updater"), {"action": "check_release"})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "update available")
+        self.assertContains(response, "v1.2.0")
+        collect_update_status.assert_called_once_with(check_release=True)
+
+    def test_updater_git_fetch_runs_action_and_renders_output(self) -> None:
+        self.client.force_login(self.staff_user)
+
+        result = type(
+            "Result",
+            (),
+            {
+                "ok": True,
+                "exit_code": 0,
+                "command": ["git", "fetch", "--tags", "--prune", "origin"],
+                "stdout": "fetched",
+                "stderr": "",
+            },
+        )()
+        with patch("pobsync_backend.views.run_git_fetch", return_value=result) as run_git_fetch, patch(
+            "pobsync_backend.views.collect_update_status"
+        ) as collect_update_status:
+            collect_update_status.return_value = {
+                "app_dir": "/opt/pobsync/app",
+                "installed_version": "1.1.0",
+                "release_check_configured": False,
+                "update_command": "sudo -n scripts/update-systemd",
+                "git_remote": "origin",
+                "git": {"branch": "master", "commit": "abc1234", "describe": "v1.1.0"},
+                "latest_release": None,
+                "release_error": "",
+                "update_available": None,
+            }
+
+            response = self.client.post(reverse("updater"), {"action": "git_fetch"})
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "fetched")
+        self.assertContains(response, "Updater action completed successfully.")
+        run_git_fetch.assert_called_once_with()
+        collect_update_status.assert_called_once_with(check_release=True)
+
+    def test_readonly_host_detail_hides_backup_controls_and_sensitive_config(self) -> None:
+        self.client.force_login(self.readonly_user)
+        GlobalConfig.objects.create(name="default", backup_root="/backups")
+        credential = SshCredential.objects.create(name="root-key", key_path="/var/lib/pobsync/state/root-key")
+        host = HostConfig.objects.create(
+            host="web-01",
+            address="web-01.example.test",
+            ssh_credential=credential,
+            ssh_user="root",
+        )
+
+        response = self.client.get(reverse("host_detail", args=[host.host]))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Host Status")
+        self.assertNotContains(response, "Backup Control")
+        self.assertNotContains(response, "Backup Options")
+        self.assertNotContains(response, "Connection Preflight")
+        self.assertNotContains(response, "root-key")
+        self.assertNotContains(response, reverse("queue_manual_backup", args=[host.host]))
+
     def test_changelog_renders_repository_changelog(self) -> None:
         self.client.force_login(self.staff_user)
         with TemporaryDirectory() as tmp:
@@ -265,12 +443,23 @@ class ViewTests(TestCase):
         db = HostConfig.objects.create(host="db-01", address="db-01.example.test")
         scheduled = self._snapshot(web, "20260519-021500Z__SCHED01", kind=SnapshotRecord.Kind.SCHEDULED)
         manual = self._snapshot(web, "20260519-031500Z__MANUAL1", kind=SnapshotRecord.Kind.MANUAL)
-        incomplete = self._snapshot(db, "20260519-041500Z__BROKEN1", kind=SnapshotRecord.Kind.INCOMPLETE)
         self._set_snapshot_storage(scheduled, allocated=100)
         self._set_snapshot_storage(manual, allocated=200)
-        self._set_snapshot_storage(incomplete, allocated=300)
+        with TemporaryDirectory() as tmp:
+            incomplete_dir = Path(tmp) / db.host / ".incomplete" / "20260519-041500Z__BROKEN1"
+            data_dir = incomplete_dir / "data"
+            data_dir.mkdir(parents=True)
+            data_dir.joinpath("partial-file").write_text("interrupted backup data\n", encoding="utf-8")
+            expected_usage = tree_usage(data_dir)
+            SnapshotRecord.objects.create(
+                host=db,
+                kind=SnapshotRecord.Kind.INCOMPLETE,
+                dirname=incomplete_dir.name,
+                path=str(incomplete_dir),
+                status="failed",
+            )
 
-        response = self.client.get(reverse("dashboard_priority_live"))
+            response = self.client.get(reverse("dashboard_priority_live"))
 
         self.assertEqual(response.status_code, 200)
         self.assertContains(response, "Scheduled data")
@@ -279,8 +468,8 @@ class ViewTests(TestCase):
         self.assertContains(response, "Total snapshot data")
         self.assertContains(response, "100&nbsp;bytes", html=True)
         self.assertContains(response, "200&nbsp;bytes", html=True)
-        self.assertContains(response, "300&nbsp;bytes", html=True)
-        self.assertContains(response, "600&nbsp;bytes", html=True)
+        self.assertContains(response, filesizeformat(expected_usage["allocated_size_bytes"]))
+        self.assertContains(response, filesizeformat(300 + expected_usage["allocated_size_bytes"]))
 
     def test_dashboard_hosts_live_returns_hosts_partial(self) -> None:
         self.client.force_login(self.staff_user)
@@ -300,12 +489,23 @@ class ViewTests(TestCase):
         host = HostConfig.objects.create(host="web-01", address="web-01.example.test")
         scheduled = self._snapshot(host, "20260519-021500Z__SCHED01", kind=SnapshotRecord.Kind.SCHEDULED)
         manual = self._snapshot(host, "20260519-031500Z__MANUAL1", kind=SnapshotRecord.Kind.MANUAL)
-        incomplete = self._snapshot(host, "20260519-041500Z__BROKEN1", kind=SnapshotRecord.Kind.INCOMPLETE)
         self._set_snapshot_storage(scheduled, allocated=100)
         self._set_snapshot_storage(manual, allocated=200)
-        self._set_snapshot_storage(incomplete, allocated=300)
+        with TemporaryDirectory() as tmp:
+            incomplete_dir = Path(tmp) / host.host / ".incomplete" / "20260519-041500Z__BROKEN1"
+            data_dir = incomplete_dir / "data"
+            data_dir.mkdir(parents=True)
+            data_dir.joinpath("partial-file").write_text("interrupted backup data\n", encoding="utf-8")
+            expected_usage = tree_usage(data_dir)
+            SnapshotRecord.objects.create(
+                host=host,
+                kind=SnapshotRecord.Kind.INCOMPLETE,
+                dirname=incomplete_dir.name,
+                path=str(incomplete_dir),
+                status="failed",
+            )
 
-        response = self.client.get(reverse("dashboard_hosts_live"))
+            response = self.client.get(reverse("dashboard_hosts_live"))
 
         self.assertEqual(response.status_code, 200)
         self.assertContains(response, "Scheduled data")
@@ -314,8 +514,8 @@ class ViewTests(TestCase):
         self.assertContains(response, "Total data")
         self.assertContains(response, "100&nbsp;bytes", html=True)
         self.assertContains(response, "200&nbsp;bytes", html=True)
-        self.assertContains(response, "300&nbsp;bytes", html=True)
-        self.assertContains(response, "600&nbsp;bytes", html=True)
+        self.assertContains(response, filesizeformat(expected_usage["allocated_size_bytes"]))
+        self.assertContains(response, filesizeformat(300 + expected_usage["allocated_size_bytes"]))
 
     def test_dashboard_host_cards_measure_incomplete_data_without_snapshot_metadata(self) -> None:
         self.client.force_login(self.staff_user)
@@ -1350,7 +1550,7 @@ class ViewTests(TestCase):
 
             response = self.client.post(
                 reverse("queue_manual_backup", args=[host.host]),
-                {"prune_max_delete": "10"},
+                {"verbose_output": "on", "prune_max_delete": "10"},
                 follow=True,
             )
 
@@ -1588,7 +1788,7 @@ class ViewTests(TestCase):
 
             response = self.client.post(
                 reverse("queue_manual_backup", args=[host.host]),
-                {"prune_max_delete": "10"},
+                {"verbose_output": "on", "prune_max_delete": "10"},
                 follow=True,
             )
 
@@ -1598,7 +1798,7 @@ class ViewTests(TestCase):
             run.result["requested"],
             {
                 "dry_run": False,
-                "verbose_output": False,
+                "verbose_output": True,
                 "prune": False,
                 "prune_max_delete": 10,
                 "prune_protect_bases": False,

src/pobsync_backend/updater.py

@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+import json
+import shlex
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+from urllib.error import HTTPError, URLError
+from urllib.request import Request, urlopen
+
+from django.conf import settings
+
+from pobsync import __version__
+
+
+@dataclass(frozen=True)
+class CommandResult:
+    command: list[str]
+    exit_code: int
+    stdout: str
+    stderr: str
+
+    @property
+    def ok(self) -> bool:
+        return self.exit_code == 0
+
+
+def collect_update_status(*, check_release: bool = False) -> dict[str, Any]:
+    app_dir = Path(settings.BASE_DIR)
+    status: dict[str, Any] = {
+        "app_dir": app_dir,
+        "installed_version": __version__,
+        "release_check_configured": bool(settings.POBSYNC_UPDATE_RELEASES_URL),
+        "update_command": settings.POBSYNC_UPDATE_COMMAND,
+        "git_remote": settings.POBSYNC_UPDATE_GIT_REMOTE,
+        "git": _git_status(app_dir),
+        "latest_release": None,
+        "release_error": "",
+        "update_available": None,
+    }
+
+    if check_release:
+        if not settings.POBSYNC_UPDATE_RELEASES_URL:
+            status["release_error"] = "POBSYNC_UPDATE_RELEASES_URL is not configured."
+        else:
+            try:
+                latest_release = fetch_latest_release()
+                status["latest_release"] = latest_release
+                status["update_available"] = _version_key(latest_release.get("tag_name", "")) != _version_key(__version__)
+            except (HTTPError, URLError, TimeoutError, json.JSONDecodeError, ValueError) as exc:
+                status["release_error"] = str(exc)
+
+    return status
+
+
+def fetch_latest_release() -> dict[str, Any]:
+    request = Request(settings.POBSYNC_UPDATE_RELEASES_URL, headers={"Accept": "application/json"})
+    if settings.POBSYNC_UPDATE_RELEASES_TOKEN:
+        request.add_header("Authorization", f"token {settings.POBSYNC_UPDATE_RELEASES_TOKEN}")
+
+    with urlopen(request, timeout=10) as response:
+        payload = json.loads(response.read().decode("utf-8"))
+
+    if isinstance(payload, list):
+        if not payload:
+            raise ValueError("No releases were returned.")
+        release = payload[0]
+    elif isinstance(payload, dict):
+        release = payload
+    else:
+        raise ValueError("Release endpoint returned an unexpected payload.")
+
+    if not isinstance(release, dict):
+        raise ValueError("Release endpoint returned an unexpected release entry.")
+    return release
+
+
+def run_git_fetch() -> CommandResult:
+    remote = settings.POBSYNC_UPDATE_GIT_REMOTE
+    return _run_command(["git", "fetch", "--tags", "--prune", remote])
+
+
+def run_git_pull() -> CommandResult:
+    remote = settings.POBSYNC_UPDATE_GIT_REMOTE
+    branch = _git_current_branch(Path(settings.BASE_DIR))
+    if not branch:
+        return CommandResult(
+            command=["git", "pull", "--ff-only", remote],
+            exit_code=2,
+            stdout="",
+            stderr="Cannot pull automatically because the installed checkout is not on a branch.",
+        )
+    return _run_command(["git", "pull", "--ff-only", remote, branch])
+
+
+def run_native_update() -> CommandResult:
+    return _run_command(shlex.split(settings.POBSYNC_UPDATE_COMMAND))
+
+
+def _run_command(command: list[str]) -> CommandResult:
+    completed = subprocess.run(
+        command,
+        cwd=settings.BASE_DIR,
+        capture_output=True,
+        check=False,
+        text=True,
+        timeout=600,
+    )
+    return CommandResult(
+        command=command,
+        exit_code=completed.returncode,
+        stdout=completed.stdout[-6000:],
+        stderr=completed.stderr[-6000:],
+    )
+
+
+def _git_status(app_dir: Path) -> dict[str, str]:
+    return {
+        "branch": _git_current_branch(app_dir),
+        "commit": _git_output(app_dir, ["git", "rev-parse", "--short", "HEAD"]),
+        "describe": _git_output(app_dir, ["git", "describe", "--tags", "--always", "--dirty"]),
+    }
+
+
+def _git_current_branch(app_dir: Path) -> str:
+    branch = _git_output(app_dir, ["git", "branch", "--show-current"])
+    return branch or _git_output(app_dir, ["git", "rev-parse", "--abbrev-ref", "HEAD"])
+
+
+def _git_output(app_dir: Path, command: list[str]) -> str:
+    try:
+        completed = subprocess.run(
+            command,
+            cwd=app_dir,
+            capture_output=True,
+            check=False,
+            text=True,
+            timeout=5,
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return ""
+    if completed.returncode != 0:
+        return ""
+    return completed.stdout.strip()
+
+
+def _version_key(value: str) -> str:
+    return value.strip().removeprefix("v")

src/pobsync_backend/views.py

@@ -10,7 +10,6 @@ from pathlib import Path
 from urllib.parse import urlencode
 
 from django.contrib import messages
-from django.contrib.admin.views.decorators import staff_member_required
 from django.conf import settings
 from django.http import FileResponse, Http404
 from django.db.models import Count, Q
@@ -24,6 +23,7 @@ from pobsync import __version__
 from pobsync.errors import PobsyncError
 from pobsync.config.defaults import DEFAULT_EXCLUDES, DEFAULT_RSYNC_ARGS
 
+from .access import access_context, control_panel_admin_required, status_view_required
 from .backup_runner import queue_backup_run
 from .config_checks import collect_effective_host_config_checks, collect_global_config_checks
 from .forms import (
@@ -57,21 +57,22 @@ from .scheduler import next_due_after
 from .snapshot_discovery import discover_snapshots, inspect_snapshot_discovery
 from .ssh_keys import SshKeyError, delete_generated_key_files, generate_ssh_key, merge_known_hosts, scan_known_host
 from .stats_summary import collect_dashboard_stats, collect_host_stats
+from .updater import collect_update_status, run_git_fetch, run_git_pull, run_native_update
 
 
-@staff_member_required
+@status_view_required
 def dashboard(request):
-    return render(request, "pobsync_backend/dashboard.html", _dashboard_context())
+    return render(request, "pobsync_backend/dashboard.html", _dashboard_context(request))
 
 
-@staff_member_required
+@status_view_required
 def dashboard_priority_live(request):
-    return render(request, "pobsync_backend/partials/dashboard_priority.html", _dashboard_context())
+    return render(request, "pobsync_backend/partials/dashboard_priority.html", _dashboard_context(request))
 
 
-@staff_member_required
+@status_view_required
 def dashboard_hosts_live(request):
-    return render(request, "pobsync_backend/partials/dashboard_hosts.html", _dashboard_context())
+    return render(request, "pobsync_backend/partials/dashboard_hosts.html", _dashboard_context(request))
 
 
 def _host_cards_context(*, enabled: str = "") -> dict[str, object]:
@@ -120,7 +121,7 @@ def _host_cards_context(*, enabled: str = "") -> dict[str, object]:
     }
 
 
-def _dashboard_context() -> dict[str, object]:
+def _dashboard_context(request) -> dict[str, object]:
     global_config = GlobalConfig.objects.filter(name="default").first()
     host_context = _host_cards_context()
     hosts = host_context["hosts"]
@@ -129,6 +130,7 @@ def _dashboard_context() -> dict[str, object]:
     recent_runs = BackupRun.objects.select_related("host", "snapshot").order_by("-created_at", "-id")[:6]
     stats_summary = collect_dashboard_stats(hosts=hosts, global_config=global_config)
     context = {
+        **access_context(request),
         "hosts": hosts,
         "global_config": global_config,
         "stats_summary": stats_summary,
@@ -159,7 +161,7 @@ def _dashboard_context() -> dict[str, object]:
     return context
 
 
-@staff_member_required
+@status_view_required
 def hosts_list(request):
     enabled = request.GET.get("enabled", "").strip()
     if enabled not in {"", "yes", "no"}:
@@ -171,15 +173,16 @@ def hosts_list(request):
         request,
         "pobsync_backend/hosts_list.html",
         {
+            **access_context(request),
             **context,
             "global_config": global_config,
-            "show_host_controls": True,
+            "show_host_controls": request.user.is_staff,
             "total_count": HostConfig.objects.count(),
         },
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def update_host_state(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -290,7 +293,7 @@ def _retention_warning_summary(retention_warning) -> str:
     return " ".join(parts)
 
 
-@staff_member_required
+@status_view_required
 def changelog(request):
     changelog_path = Path(settings.BASE_DIR) / "CHANGELOG.md"
     try:
@@ -312,7 +315,7 @@ def changelog(request):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def self_check(request):
     checks = collect_self_checks()
     return render(
@@ -325,13 +328,47 @@ def self_check(request):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def logs(request):
     context = _log_context(request)
     return render(request, "pobsync_backend/logs.html", context)
 
 
-@staff_member_required
+@control_panel_admin_required
+def updater(request):
+    action_result = None
+    check_release = request.method == "POST" and request.POST.get("action") == "check_release"
+    if request.method == "POST":
+        action = request.POST.get("action")
+        if action == "git_fetch":
+            action_result = run_git_fetch()
+            check_release = True
+        elif action == "git_pull":
+            action_result = run_git_pull()
+            check_release = True
+        elif action == "run_update":
+            action_result = run_native_update()
+            check_release = True
+        elif action != "check_release":
+            messages.error(request, "Unknown updater action.")
+
+        if action_result is not None:
+            if action_result.ok:
+                messages.success(request, "Updater action completed successfully.")
+            else:
+                messages.error(request, f"Updater action failed with exit code {action_result.exit_code}.")
+
+    return render(
+        request,
+        "pobsync_backend/updater.html",
+        {
+            "status": collect_update_status(check_release=check_release),
+            "action_result": action_result,
+        },
+    )
+
+
+@control_panel_admin_required
 def notification_targets(request):
     targets = NotificationTarget.objects.order_by("name")
     deliveries = NotificationDelivery.objects.select_related("target", "run", "run__host").order_by("-created_at")[:12]
@@ -345,7 +382,7 @@ def notification_targets(request):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def create_notification_target(request):
     if request.method == "POST":
         form = NotificationTargetForm(request.POST)
@@ -367,7 +404,7 @@ def create_notification_target(request):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def edit_notification_target(request, target_id: int):
     target = get_object_or_404(NotificationTarget, id=target_id)
     if request.method == "POST":
@@ -390,7 +427,7 @@ def edit_notification_target(request, target_id: int):
     )
 
 
-@staff_member_required
+@status_view_required
 def runs_list(request):
     status = request.GET.get("status", "").strip()
     run_type = request.GET.get("type", "").strip()
@@ -422,7 +459,7 @@ def runs_list(request):
     return render(request, "pobsync_backend/runs_list.html", context)
 
 
-@staff_member_required
+@status_view_required
 def snapshots_list(request):
     kind = request.GET.get("kind", "").strip()
     status = request.GET.get("status", "").strip()
@@ -448,7 +485,7 @@ def snapshots_list(request):
     return render(request, "pobsync_backend/snapshots_list.html", context)
 
 
-@staff_member_required
+@status_view_required
 def schedules_list(request):
     enabled = request.GET.get("enabled", "").strip()
     prune = request.GET.get("prune", "").strip()
@@ -486,7 +523,7 @@ def schedules_list(request):
     return render(request, "pobsync_backend/schedules_list.html", context)
 
 
-@staff_member_required
+@status_view_required
 def purged_snapshots(request):
     host = request.GET.get("host", "").strip()
     action = request.GET.get("action", "").strip()
@@ -507,7 +544,7 @@ def purged_snapshots(request):
     return render(request, "pobsync_backend/purged_snapshots.html", context)
 
 
-@staff_member_required
+@control_panel_admin_required
 def ssh_credentials(request):
     context = {
         "credentials": SshCredential.objects.order_by("name"),
@@ -515,7 +552,7 @@ def ssh_credentials(request):
     return render(request, "pobsync_backend/ssh_credentials.html", context)
 
 
-@staff_member_required
+@control_panel_admin_required
 def create_ssh_credential(request):
     if request.method == "POST":
         form = SshCredentialForm(request.POST, request.FILES)
@@ -536,7 +573,7 @@ def create_ssh_credential(request):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def generate_ssh_credential(request):
     if request.method == "POST":
         form = SshCredentialGenerateForm(request.POST)
@@ -572,7 +609,7 @@ def generate_ssh_credential(request):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def edit_ssh_credential(request, credential_id: int):
     credential = get_object_or_404(SshCredential, id=credential_id)
     if request.method == "POST":
@@ -594,7 +631,7 @@ def edit_ssh_credential(request, credential_id: int):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def delete_ssh_credential(request, credential_id: int):
     credential = get_object_or_404(SshCredential, id=credential_id)
@@ -618,7 +655,7 @@ def delete_ssh_credential(request, credential_id: int):
     return redirect("ssh_credentials")
 
 
-@staff_member_required
+@control_panel_admin_required
 def edit_global_config(request):
     global_config = GlobalConfig.objects.filter(name="default").first()
     if request.method == "POST":
@@ -644,7 +681,7 @@ def edit_global_config(request):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def create_host_config(request):
     if request.method == "POST":
         form = CreateHostConfigForm(request.POST)
@@ -672,7 +709,7 @@ def create_host_config(request):
     )
 
 
-@staff_member_required
+@status_view_required
 def host_detail(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
     global_config = GlobalConfig.objects.filter(name="default").first()
@@ -685,7 +722,9 @@ def host_detail(request, host: str):
     has_global_config = global_config is not None
     backup_gate = collect_backup_gate(host_config, global_config)
     stats_summary = collect_host_stats(host=host_config, limit=10)
+    can_manage = request.user.is_staff
     context = {
+        **access_context(request),
         "host": host_config,
         "schedule": schedule,
         "retention_warning": _retention_warning_for_host(host_config, schedule),
@@ -696,11 +735,11 @@ def host_detail(request, host: str):
         "host_check_summary": summarize_self_checks(backup_gate.checks),
         "backup_gate": backup_gate,
         "last_preflight": (host_config.config or {}).get("last_preflight") if isinstance(host_config.config, dict) else {},
-        "effective_config": effective_host_config_preview(host_config, global_config) if global_config else {},
+        "effective_config": effective_host_config_preview(host_config, global_config) if global_config and can_manage else {},
         "stats_summary": stats_summary,
         "manual_backup_form": ManualBackupForm(initial=_default_manual_backup_initial(host_config)),
-        "can_queue_dry_run": host_config.enabled and has_global_config and backup_gate.can_queue_dry_run and active_run is None,
-        "can_queue_real_backup": host_config.enabled and has_global_config and backup_gate.can_queue_real and active_run is None,
+        "can_queue_dry_run": can_manage and host_config.enabled and has_global_config and backup_gate.can_queue_dry_run and active_run is None,
+        "can_queue_real_backup": can_manage and host_config.enabled and has_global_config and backup_gate.can_queue_real and active_run is None,
         "has_global_config": has_global_config,
         "active_run": active_run,
         "latest_runs": host_config.runs.select_related("snapshot").order_by("-created_at")[:10],
@@ -720,7 +759,7 @@ def host_detail(request, host: str):
     return render(request, "pobsync_backend/host_detail.html", context)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def prepare_host_directories(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -733,7 +772,7 @@ def prepare_host_directories(request, host: str):
     return redirect("host_detail", host=host_config.host)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def scan_host_known_key(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -755,7 +794,7 @@ def scan_host_known_key(request, host: str):
     return redirect("host_detail", host=host_config.host)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def run_host_preflight(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -783,7 +822,7 @@ def run_host_preflight(request, host: str):
     return redirect("host_detail", host=host_config.host)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def queue_manual_backup(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -823,22 +862,22 @@ def queue_manual_backup(request, host: str):
     return redirect("run_detail", run_id=run.id)
 
 
-@staff_member_required
+@status_view_required
 def run_detail(request, run_id: int):
     run = get_object_or_404(BackupRun.objects.select_related("host", "snapshot"), id=run_id)
-    return render(request, "pobsync_backend/run_detail.html", _run_detail_context(run))
+    return render(request, "pobsync_backend/run_detail.html", _run_detail_context(run, request=request))
 
 
-@staff_member_required
+@status_view_required
 def run_detail_live(request, run_id: int):
     run = get_object_or_404(BackupRun.objects.select_related("host", "snapshot"), id=run_id)
-    context = _run_detail_context(run)
+    context = _run_detail_context(run, request=request)
     response = render(request, "pobsync_backend/partials/run_detail_live.html", context)
     response["X-Pobsync-Refresh-Active"] = "true" if context["can_auto_refresh"] else "false"
     return response
 
 
-def _run_detail_context(run: BackupRun) -> dict[str, object]:
+def _run_detail_context(run: BackupRun, *, request=None) -> dict[str, object]:
     result = run.result if isinstance(run.result, dict) else {}
     run_stats = result.get("stats") if isinstance(result.get("stats"), dict) else {}
     rsync_result = result.get("rsync") if isinstance(result.get("rsync"), dict) else {}
@@ -848,8 +887,10 @@ def _run_detail_context(run: BackupRun) -> dict[str, object]:
     rsync_log_path = _run_rsync_log_path(run)
     rsync_log_tail = _run_rsync_log_tail(rsync_result, rsync_log_path)
     requested = result.get("requested") if isinstance(result.get("requested"), dict) else {}
-    can_cancel = run.status in {BackupRun.Status.QUEUED, BackupRun.Status.RUNNING}
+    can_manage = bool(request and request.user.is_staff)
+    can_cancel = can_manage and run.status in {BackupRun.Status.QUEUED, BackupRun.Status.RUNNING}
     return {
+        **(access_context(request) if request is not None else {}),
         "run": run,
         "can_cancel": can_cancel,
         "can_auto_refresh": can_cancel,
@@ -880,7 +921,7 @@ def _run_detail_context(run: BackupRun) -> dict[str, object]:
     }
 
 
-@staff_member_required
+@control_panel_admin_required
 def run_rsync_log(request, run_id: int):
     run = get_object_or_404(BackupRun.objects.select_related("host", "snapshot"), id=run_id)
     log_path = _run_rsync_log_path(run)
@@ -889,7 +930,7 @@ def run_rsync_log(request, run_id: int):
     return FileResponse(log_path.open("rb"), content_type="text/plain; charset=utf-8")
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def cancel_run(request, run_id: int):
     run = get_object_or_404(BackupRun.objects.select_related("host"), id=run_id)
@@ -913,7 +954,7 @@ def cancel_run(request, run_id: int):
     return redirect("run_detail", run_id=run.id)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def resolve_run_review(request, run_id: int):
     run = get_object_or_404(BackupRun.objects.select_related("host"), id=run_id)
@@ -931,7 +972,7 @@ def resolve_run_review(request, run_id: int):
     return _redirect_after_run_review(request, run)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def resolve_host_incomplete_reviews(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -947,7 +988,7 @@ def resolve_host_incomplete_reviews(request, host: str):
     return redirect("host_detail", host=host_config.host)
 
 
-@staff_member_required
+@status_view_required
 def snapshot_detail(request, snapshot_id: int):
     snapshot = get_object_or_404(
         SnapshotRecord.objects.select_related("host", "base").prefetch_related("derived_snapshots", "backup_runs"),
@@ -965,7 +1006,7 @@ def snapshot_detail(request, snapshot_id: int):
     return render(request, "pobsync_backend/snapshot_detail.html", context)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def discover_host_snapshots(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -986,7 +1027,7 @@ def discover_host_snapshots(request, host: str):
     return redirect("host_detail", host=host_config.host)
 
 
-@staff_member_required
+@control_panel_admin_required
 def host_retention_plan(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
     kind = request.GET.get("kind", "scheduled")
@@ -1037,7 +1078,7 @@ def host_retention_plan(request, host: str):
     return render(request, "pobsync_backend/retention_plan.html", context)
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def apply_host_retention(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -1091,7 +1132,7 @@ def apply_host_retention(request, host: str):
     return target
 
 
-@staff_member_required
+@control_panel_admin_required
 @require_POST
 def cleanup_host_incomplete_snapshots(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
@@ -1126,7 +1167,7 @@ def cleanup_host_incomplete_snapshots(request, host: str):
     return redirect("host_retention_plan", host=host_config.host)
 
 
-@staff_member_required
+@control_panel_admin_required
 def edit_host_config(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
     global_config = GlobalConfig.objects.filter(name="default").first()
@@ -1152,7 +1193,7 @@ def edit_host_config(request, host: str):
     )
 
 
-@staff_member_required
+@control_panel_admin_required
 def edit_host_schedule(request, host: str):
     host_config = get_object_or_404(HostConfig, host=host)
     schedule = _schedule_for_host(host_config)
@@ -1301,6 +1342,7 @@ def _default_manual_backup_initial(host_config: HostConfig) -> dict[str, object]
     schedule = _schedule_for_host(host_config)
     return {
         "dry_run": True,
+        "verbose_output": True,
         "prune": bool(schedule.prune) if schedule else False,
         "prune_max_delete": schedule.prune_max_delete if schedule else 10,
         "prune_protect_bases": bool(schedule.prune_protect_bases) if schedule else False,

src/pobsync_server/settings.py

@@ -48,6 +48,7 @@ TEMPLATES = [
                 "django.template.context_processors.request",
                 "django.contrib.auth.context_processors.auth",
                 "django.contrib.messages.context_processors.messages",
+                "pobsync_backend.context_processors.pobsync_access",
             ],
         },
     },
@@ -55,6 +56,8 @@ TEMPLATES = [
 
 WSGI_APPLICATION = "pobsync_server.wsgi.application"
 
+LOGIN_URL = "/admin/login/"
+
 
 def _database_config() -> dict[str, object]:
     engine = os.getenv("POBSYNC_DB_ENGINE", "sqlite").strip().lower()
@@ -102,3 +105,7 @@ POBSYNC_BACKUP_ROOT = os.getenv("POBSYNC_BACKUP_ROOT", "/backups")
 POBSYNC_ENV_FILE = os.getenv("POBSYNC_ENV_FILE", "/etc/pobsync/pobsync.env")
 POBSYNC_SERVICE_USER = os.getenv("POBSYNC_SERVICE_USER", "pobsync")
 POBSYNC_SERVICE_GROUP = os.getenv("POBSYNC_SERVICE_GROUP", "pobsync")
+POBSYNC_UPDATE_RELEASES_URL = os.getenv("POBSYNC_UPDATE_RELEASES_URL", "")
+POBSYNC_UPDATE_RELEASES_TOKEN = os.getenv("POBSYNC_UPDATE_RELEASES_TOKEN", "")
+POBSYNC_UPDATE_GIT_REMOTE = os.getenv("POBSYNC_UPDATE_GIT_REMOTE", "origin")
+POBSYNC_UPDATE_COMMAND = os.getenv("POBSYNC_UPDATE_COMMAND", "sudo -n scripts/update-systemd")

src/pobsync_server/urls.py

@@ -13,6 +13,7 @@ urlpatterns = [
     path("changelog/", views.changelog, name="changelog"),
     path("self-check/", views.self_check, name="self_check"),
     path("logs/", views.logs, name="logs"),
+    path("updater/", views.updater, name="updater"),
     path("notifications/", views.notification_targets, name="notification_targets"),
     path("notifications/new/", views.create_notification_target, name="create_notification_target"),
     path("notifications/<int:target_id>/", views.edit_notification_target, name="edit_notification_target"),