updates

controller/cmd/controller/main.go

@@ -101,7 +101,8 @@ func main() {
 	}()
 
 	// --- Start background tasks ---
-	// Periodic stack status refresh
+
+	// Periodic container status refresh (lightweight — just runs docker ps)
 	go func() {
 		ticker := time.NewTicker(30 * time.Second)
 		defer ticker.Stop()
@@ -117,6 +118,26 @@ func main() {
 		}
 	}()
 
+	// Periodic stack scan (discovers new/removed stacks from disk)
+	// Runs less frequently since it reads the filesystem.
+	// This allows adding new stacks without restarting the controller.
+	go func() {
+		ticker := time.NewTicker(2 * time.Minute)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				if err := stackMgr.ScanStacks(); err != nil {
+					logger.Printf("[WARN] Periodic stack scan failed: %v", err)
+				} else {
+					logger.Printf("[DEBUG] Periodic stack scan completed")
+				}
+			}
+		}
+	}()
+
 	logger.Printf("[INFO] Web UI listening on %s", cfg.Web.Listen)
 	if err := server.ListenAndServe(); err != http.ErrServerClosed {
 		logger.Fatalf("[FATAL] HTTP server error: %v", err)

controller/internal/api/router.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"encoding/json"
+	"fmt"
 	"log"
 	"net/http"
 	"strconv"
@@ -39,6 +40,10 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	case path == "/stacks" && req.Method == http.MethodGet:
 		r.listStacks(w, req)
 
+	// POST /api/stacks/rescan — re-scan stacks directory for new/removed stacks
+	case path == "/stacks/rescan" && req.Method == http.MethodPost:
+		r.rescanStacks(w, req)
+
 	// GET /api/stacks/{name}
 	case strings.HasPrefix(path, "/stacks/") && req.Method == http.MethodGet && !hasSubpath(path, "/stacks/"):
 		r.getStack(w, req, trimSegment(path, "/stacks/"))
@@ -91,6 +96,21 @@ func (r *Router) listStacks(w http.ResponseWriter, _ *http.Request) {
 	writeJSON(w, http.StatusOK, apiResponse{OK: true, Data: r.stackMgr.GetStacks()})
 }
 
+func (r *Router) rescanStacks(w http.ResponseWriter, _ *http.Request) {
+	r.logger.Printf("[API] Manual stack rescan requested")
+	if err := r.stackMgr.ScanStacks(); err != nil {
+		r.logger.Printf("[API] Stack rescan failed: %v", err)
+		writeJSON(w, http.StatusInternalServerError, apiResponse{OK: false, Error: err.Error()})
+		return
+	}
+	stackCount := len(r.stackMgr.GetStacks())
+	r.logger.Printf("[API] Stack rescan completed: %d stacks found", stackCount)
+	writeJSON(w, http.StatusOK, apiResponse{
+		OK:      true,
+		Message: fmt.Sprintf("Rescan completed: %d stacks found", stackCount),
+	})
+}
+
 func (r *Router) getStack(w http.ResponseWriter, _ *http.Request, name string) {
 	stack, ok := r.stackMgr.GetStack(name)
 	if !ok {
@@ -138,7 +158,7 @@ func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name stri
 		if strings.Contains(err.Error(), "already deployed") {
 			status = http.StatusConflict
 		}
-		if strings.Contains(err.Error(), "required field") || strings.Contains(err.Error(), "does not exist") {
+		if strings.Contains(err.Error(), "required field") || strings.Contains(err.Error(), "does not exist") || strings.Contains(err.Error(), "kötelező") {
 			status = http.StatusBadRequest
 		}
 		writeJSON(w, status, apiResponse{OK: false, Error: err.Error()})

controller/internal/stacks/deploy.go

@@ -16,10 +16,10 @@ import (
 // AppConfig holds the per-app deployment configuration.
 // Saved as app.yaml in each stack directory after first deployment.
 type AppConfig struct {
-	Deployed         bool              `yaml:"deployed" json:"deployed"`
+	Deployed     bool              `yaml:"deployed" json:"deployed"`
-	DeployedAt       string            `yaml:"deployed_at" json:"deployed_at"`
+	DeployedAt   string            `yaml:"deployed_at" json:"deployed_at"`
-	Env              map[string]string `yaml:"env" json:"env"`
+	Env          map[string]string `yaml:"env" json:"env"`
-	LockedFields     []string          `yaml:"locked_fields" json:"locked_fields"`
+	LockedFields []string          `yaml:"locked_fields" json:"locked_fields"`
 }
 
 // DeployRequest contains the user-provided values from the deploy form.
@@ -30,9 +30,9 @@ type DeployRequest struct {
 
 // DeployStack handles first-time deployment of an app:
 // 1. Load metadata (.felhom.yml) to know what fields exist
-// 2. Auto-generate secrets for secret/password fields without user values
+// 2. Auto-generate secrets for secret fields (hidden from user)
 // 3. Auto-fill domain from controller config
-// 4. Merge with user-provided values
+// 4. Validate all user-provided values (password, path, required fields)
 // 5. Save app.yaml
 // 6. Run docker compose up -d with env vars
 func (m *Manager) DeployStack(req DeployRequest) error {
@@ -50,6 +50,16 @@ func (m *Manager) DeployStack(req DeployRequest) error {
 		return fmt.Errorf("stack %q is already deployed; use update instead", req.StackName)
 	}
 
+	// Debug: log received values (redact passwords)
+	m.logger.Printf("[DEBUG] Deploy %s: received %d user values", req.StackName, len(req.Values))
+	for k, v := range req.Values {
+		if strings.Contains(strings.ToLower(k), "password") || strings.Contains(strings.ToLower(k), "secret") {
+			m.logger.Printf("[DEBUG]   %s = [REDACTED, len=%d]", k, len(v))
+		} else {
+			m.logger.Printf("[DEBUG]   %s = %q", k, v)
+		}
+	}
+
 	// Build the full env map
 	env := make(map[string]string)
 	var lockedFields []string
@@ -71,15 +81,12 @@ func (m *Manager) DeployStack(req DeployRequest) error {
 			value = generated
 
 		case "password":
-			// Use user value if provided, otherwise generate
+			// Password fields MUST be filled by the user (via typing or Generálás button).
+			// We never silently auto-generate — the user needs to know their password.
 			if userVal, ok := req.Values[field.EnvVar]; ok && userVal != "" {
 				value = userVal
-			} else if field.Generate != "" {
+			} else {
-				generated, err := generateValue(field.Generate)
+				return fmt.Errorf("a(z) %q mező kitöltése kötelező — használja a Generálás gombot vagy írjon be egy jelszót", field.Label)
-				if err != nil {
-					return fmt.Errorf("generating %s: %w", field.EnvVar, err)
-				}
-				value = generated
 			}
 
 		default:
@@ -93,7 +100,7 @@ func (m *Manager) DeployStack(req DeployRequest) error {
 
 		// Validate required fields
 		if field.Required && value == "" {
-			return fmt.Errorf("required field %q (%s) is empty", field.Label, field.EnvVar)
+			return fmt.Errorf("a(z) %q (%s) mező kitöltése kötelező", field.Label, field.EnvVar)
 		}
 
 		// Validate path fields exist
@@ -124,7 +131,12 @@ func (m *Manager) DeployStack(req DeployRequest) error {
 		return fmt.Errorf("saving app config: %w", err)
 	}
 
-	m.logger.Printf("[INFO] Deploying stack %s with %d env vars", req.StackName, len(env))
+	// Debug: log final env var keys (not values)
+	envKeys := make([]string, 0, len(env))
+	for k := range env {
+		envKeys = append(envKeys, k)
+	}
+	m.logger.Printf("[INFO] Deploying stack %s with %d env vars: [%s]", req.StackName, len(env), strings.Join(envKeys, ", "))
 
 	// Run docker compose up -d
 	_, err := m.composeExecWithEnv(stackDir, env, "up", "-d")

controller/internal/web/templates.go

@@ -190,7 +190,7 @@ const stacksTmpl = `
                 <span class="badge badge-protected">🔒 Védett rendszerkomponens</span>
             {{else if not .Deployed}}
                 <a href="/stacks/{{.Name}}/deploy" class="btn btn-primary">🚀 Telepítés</a>
-                <a href="{{appPageURL .Meta.Slug}}" target="_blank" class="btn btn-outline">ℹ️ Részletek</a>
+                <a href="{{appPageURL .Meta.Slug}}" class="btn btn-outline">ℹ️ Részletek</a>
             {{else}}
                 {{if eq (stateStr .State) "running"}}
                     <button class="btn btn-success" onclick="stackAction('{{.Name}}', 'update')">⬆ Frissítés</button>
@@ -200,7 +200,7 @@ const stacksTmpl = `
                     <button class="btn btn-success" onclick="stackAction('{{.Name}}', 'start')">▶ Indítás</button>
                 {{end}}
                 <a href="/stacks/{{.Name}}/logs" class="btn btn-outline">📋 Naplók</a>
-                <a href="{{appPageURL .Meta.Slug}}" target="_blank" class="btn btn-outline">ℹ️ Részletek</a>
+                <a href="{{appPageURL .Meta.Slug}}" class="btn btn-outline">ℹ️ Részletek</a>
             {{end}}
         </div>
     </div>
@@ -264,7 +264,7 @@ const deployTmpl = `
             <div class="form-group">
                 <label for="field-{{.EnvVar}}">
                     {{.Label}}
-                    {{if .Required}}<span class="required">*</span>{{end}}
+                    {{if or .Required (eq .Type "password")}}<span class="required">*</span>{{end}}
                     {{if .LockedAfterDeploy}}<span class="locked-hint">🔒 telepítés után nem módosítható</span>{{end}}
                 </label>
 
@@ -280,6 +280,8 @@ const deployTmpl = `
                     <input type="text" id="field-{{.EnvVar}}" name="{{.EnvVar}}"
                            class="form-control" value="{{.Default}}"
                            placeholder="{{.Placeholder}}"
+                           data-field-type="password"
+                           required
                            {{if $.AlreadyDeployed}}disabled{{end}}>
                     <button type="button" class="btn btn-sm btn-outline"
                             onclick="generatePassword('field-{{.EnvVar}}')">🎲 Generálás</button>
@@ -327,6 +329,87 @@ function generatePassword(fieldId) {
     document.getElementById(fieldId).value = pass;
 }
 
+document.getElementById('deploy-form').addEventListener('submit', async function(e) {
+    e.preventDefault();
+
+    // Client-side validation: check all password fields are filled
+    const passwordFields = e.target.querySelectorAll('input[data-field-type="password"]');
+    for (const pf of passwordFields) {
+        if (!pf.disabled && pf.value.trim() === '') {
+            const label = pf.closest('.form-group').querySelector('label').textContent.trim();
+            alert('Kötelező mező: ' + label + '\nHasználja a Generálás gombot vagy írjon be egy jelszót.');
+            pf.focus();
+            return;
+        }
+    }
+
+    // Client-side validation: check all required fields are filled
+    const requiredFields = e.target.querySelectorAll('input[required], select[required]');
+    for (const rf of requiredFields) {
+        if (!rf.disabled && rf.value.trim() === '') {
+            const label = rf.closest('.form-group').querySelector('label').textContent.trim();
+            alert('Kötelező mező: ' + label);
+            rf.focus();
+            return;
+        }
+    }
+
+    const btn = e.target.querySelector('[type=submit]');
+    const origText = btn.textContent;
+    btn.disabled = true;
+    btn.textContent = 'Telepítés folyamatban...';
+
+    const values = {};
+    const inputs = e.target.querySelectorAll('input, select');
+    inputs.forEach(function(el) {
+        if (el.name && !el.disabled) {
+            if (el.type === 'checkbox') {
+                values[el.name] = el.checked ? 'true' : 'false';
+            } else {
+                values[el.name] = el.value;
+            }
+        }
+    });
+
+    try {
+        const resp = await fetch('/api/stacks/{{.Stack.Name}}/deploy', {
+            method: 'POST',
+            headers: {'Content-Type': 'application/json'},
+            body: JSON.stringify({values: values})
+        });
+        const data = await resp.json();
+        if (!data.ok) {
+            alert('Hiba: ' + data.error);
+            btn.textContent = origText;
+            btn.disabled = false;
+            return;
+        }
+        alert('Sikeres telepítés! ✔');
+        window.location.href = '/stacks';
+    } catch (err) {
+        alert('Hálózati hiba: ' + err.message);
+        btn.textContent = origText;
+        btn.disabled = false;
+    }
+});
+</script>
+
+{{template "layout_end" .}}
+{{end}}
+` + "\n"
+
+<script>
+function generatePassword(fieldId) {
+    const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+    let pass = '';
+    const arr = new Uint8Array(16);
+    crypto.getRandomValues(arr);
+    for (let i = 0; i < 16; i++) {
+        pass += chars[arr[i] % chars.length];
+    }
+    document.getElementById(fieldId).value = pass;
+}
+
 document.getElementById('deploy-form').addEventListener('submit', async function(e) {
     e.preventDefault();
     const btn = e.target.querySelector('[type=submit]');