v1.11.0

Fix human date on iOS devices (#510 )
feat: Add support for rendering .ipynb Jupyter/IPython notebooks (#491 )
2025-09-21 04:51:49 +02:00 · 2025-09-21 04:31:58 +02:00 · 2025-09-21 03:48:59 +02:00 · 2025-09-16 01:56:38 +02:00 · 2025-09-16 01:35:54 +02:00 · 2025-08-28 02:44:09 +02:00
135 changed files with 5152 additions and 1498 deletions
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -0,0 +1,53 @@
+name: Build / Deploy Helm Chart
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4.3.0
+        with:
+          version: 'latest'
+
+      - name: Update Helm chart dependencies
+        run: |
+          cd ./helm/opengist
+          helm dependency update
+
+      - name: Package Helm chart
+        run: |
+          cd ./helm
+          helm package ./opengist
+
+          # First time, create the index
+          wget -q https://helm.opengist.io/index.yaml
+          if [ ! -f index.yaml ]; then
+            helm repo index --url https://helm.opengist.io .
+          else
+            # For subsequent runs, merge with existing index
+            helm repo index --url https://helm.opengist.io --merge index.yaml .
+          fi
+
+      - name: Deploy to server
+        uses: appleboy/scp-action@master
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USERNAME }}
+          key: ${{ secrets.SERVER_SSH_KEY }}
+          source: "./helm/*.tgz,./helm/index.yaml"
+          target: ${{ secrets.HELM_SERVER_PATH }}
+
+      - name: Update remote helm repository
+        uses: appleboy/ssh-action@master
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USERNAME }}
+          key: ${{ secrets.SERVER_SSH_KEY }}
+          script: |
+            ${{ secrets.UPDATE_HELM_REPO }}
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,15 @@
 node_modules/
 gist.db
 .idea/
+.vscode/
 .DS_Store
 /**/.DS_Store
 public/assets/*
 public/manifest.json
+./opengist
 opengist
 build/
 docs/.vitepress/dist/
 docs/.vitepress/cache/
+helm/opengist/charts/
+vendor/
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,64 @@
 # Changelog

+## [1.11.0](https://github.com/thomiceli/opengist/compare/v1.10.0...v1.11.0) - 2025-09-21
+See here how to [update](https://opengist.io/docs/update) Opengist.
+
+### Added
+- LDAP authentication (#470)
+- Listen to Unix websocket (#484)
+- Binary files support (#503)
+- Support for rendering .ipynb Jupyter/IPython notebooks (#491)
+- File upload on gist creation/edition (#507)
+- Read psql sslmode from db uri (#462)
+- OIDC group claim name to OpenID request (#490)
+- Reworked user settings page (#467)
+- Style preference tab for user (#467)
+- Init gist with regular urls via git CLI (http) (#501)
+
+### Fixed
+- Gitlab avatar (#461)
+- Correct German spelling, use consistent wording (#468)
+- Filename unescape (#474)
+- Fix Markdown preview links (#475)
+- Replace Unicode characters with HTML entity codes in embed template (#480)
+- Redirect to $baseUrl after auth with passkey instead of / (#482)
+- Human date on iOS devices (#510)
+
+### Docs
+- Add Proxmox VE Helper-Script (#473)
+
+### Other
+- Use Helm deployment.env[] values (#471)
+- Update Helm Postgres version
+- Use database for Gist init queue (#498)
+- Update go dep chroma (#493)
+
+## [1.10.0](https://github.com/thomiceli/opengist/compare/v1.9.1...v1.10.0) - 2025-04-07
+See here how to [update](https://opengist.io/docs/update) Opengist.
+
+### 🔴 Deprecations
+_Removed in the next SemVer MAJOR version of Opengist._
+* Use the configuration option `index`/`OG_INDEX` **instead of** `index.enabled`/`OG_INDEX_ENABLED`. The default value is `bleve`.
+* The configuration `index.dirname`/`OG_INDEX_DIRNAME` will be removed. If you're using Bleve, the path of the index will be `opengist.index`.
+
+### Added
+- Helm Chart (#454)
+- Meilisearch indexer (#444)
+- Prometheus metrics (#439)
+- Config to name the OIDC provider (#435)
+- Read admin group from OIDC token claim (#445)
+- More translation strings (#438)
+
+### Fixed
+- Garbled text display issues for non-English Unicode characters in browsers (#441)
+- Test database when running `go test` (#442)
+- Allow lag between admin invitation creation and test assertion (#452)
+- gist.html using relative URL (#451)
+- Do not hide file delete button on gist edit page (#447)
+
+### Other
+- Update deps Golang & JS deps (#455)
+
 ## [1.9.1](https://github.com/thomiceli/opengist/compare/v1.9.0...v1.9.1) - 2025-02-04
 See here how to [update](https://opengist.io/docs/update) Opengist.

--- a/2
+++ b/2
@@ -50,7 +50,7 @@ watch_backend:
 	OG_DEV=1 npx nodemon --watch '**/*' -e html,yml,go,js --signal SIGTERM --exec 'go run -ldflags "-X $(VERSION_PKG)=$(GIT_TAG)" . --config config.yml'

 watch:
-	@sh ./scripts/watch.sh
+	@bash ./scripts/watch.sh

 clean:
 	@echo "Cleaning up build artifacts..."
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ It is similar to [GitHub Gist](https://gist.github.com/), but open-source and co
 * Download raw files or as a ZIP archive
 * OAuth2 login with GitHub, GitLab, Gitea, and OpenID Connect
 * Restrict or unrestrict snippets visibility to anonymous users
-* Docker support
+* Docker support / Helm Chart
 * [More...](/docs/introduction.md#features)

 ## Quick start
@@ -38,7 +38,7 @@ It is similar to [GitHub Gist](https://gist.github.com/), but open-source and co
 Docker [images](https://github.com/thomiceli/opengist/pkgs/container/opengist) are available for each release :

 ```shell
-docker pull ghcr.io/thomiceli/opengist:1.9
+docker pull ghcr.io/thomiceli/opengist:1.11
 ```

 It can be used in a `docker-compose.yml` file :
@@ -50,7 +50,7 @@ It can be used in a `docker-compose.yml` file :
 ```yml
 services:
  opengist:
-    image: ghcr.io/thomiceli/opengist:1.9
+    image: ghcr.io/thomiceli/opengist:1.11
    container_name: opengist
    restart: unless-stopped
    ports:
@@ -77,9 +77,9 @@ Download the archive for your system from the release page [here](https://github

 ```shell
 # example for linux amd64
-wget https://github.com/thomiceli/opengist/releases/download/v1.9.1/opengist1.9.1-linux-amd64.tar.gz
+wget https://github.com/thomiceli/opengist/releases/download/v1.11.0/opengist1.11.0-linux-amd64.tar.gz

-tar xzvf opengist1.9.1-linux-amd64.tar.gz
+tar xzvf opengist1.11.0-linux-amd64.tar.gz
 cd opengist
 chmod +x opengist
 ./opengist # with or without `--config config.yml`
--- a/config.yml
+++ b/config.yml
@@ -3,7 +3,7 @@
 # https://github.com/thomiceli/opengist/blob/master/docs/configuration/cheat-sheet.md

 # Set the log level to one of the following: debug, info, warn, error, fatal. Default: warn
-log-level: warn
+log-level: debug

 # Set the log output to one or more of the following: `stdout`, `file`. Default: stdout,file
 log-output: stdout,file
@@ -23,11 +23,14 @@ secret-key:
 # MySQL/MariaDB: mysql://user:password@host:port/database
 db-uri: opengist.db

-# Enable or disable the code search index (either `true` or `false`). Default: true
-index.enabled: true
+# Define the code indexer (either `bleve`, `meilisearch`, or empty for no index). Default: bleve
+index: bleve

-# Name of the directory where the code search index is stored. Default: opengist.index
-index.dirname: opengist.index
+# Set the host for the Meiliseach server
+index.meili.host:
+
+# Set the API key for the Meiliseach server
+index.meili.api-key:

 # Default branch name used by Opengist when initializing Git repositories.
 # If not set, uses the Git default branch name. See https://git-scm.com/book/en/v2/Getting-Started-First-Time-Git-Setup#_new_default_branch
@@ -40,6 +43,7 @@ sqlite.journal-mode: WAL

 # HTTP server configuration
 # Host to bind to. Default: 0.0.0.0
+# Use an IP address for network binding. Use a path for Unix socket binding (e.g. /run/opengist.sock)
 http.host: 0.0.0.0

 # Port to bind to. Default: 6157
@@ -48,6 +52,12 @@ http.port: 6157
 # Enable or disable git operations (clone, pull, push) via HTTP (either `true` or `false`). Default: true
 http.git-enabled: true

+# File permissions for Unix socket (octal format). Default: 0666
+unix-socket-permissions: 0666
+
+# Enable or disable the metrics endpoint (either `true` or `false`). Default: false
+metrics.enabled: false
+
 # SSH built-in server configuration
 # Note: it is not using the SSH daemon from your machine (yet)

@@ -95,10 +105,27 @@ gitea.url: https://gitea.com/
 gitea.name: Gitea

 # To create a new OAuth2 application using OpenID Connect:
+oidc.provider-name:
 oidc.client-key:
 oidc.secret:
 # Discovery endpoint of the OpenID provider. Generally something like http://auth.example.com/.well-known/openid-configuration
 oidc.discovery-url:
+# The name of the claim containing the groups
+oidc.group-claim-name:
+# The name of the group that should receive admin rights
+oidc.admin-group:
+
+# LDAP authentication configuration
+# URL of the LDAP instance e.g: ldap://ldap.example.com:389 ; if not set, LDAP authentication is disabled
+ldap.url:
+# Bind DN to authenticate against the LDAP e.g: cn=read-only-admin,dc=example,dc=com
+ldap.bind-dn:
+# The password for the Bind DN.
+ldap.bind-credentials:
+# The Base DN to start search from e.g: ou=People,dc=example,dc=com
+ldap.search-base:
+# The filter to search against (the format string %s will be replaced with the username) e.g: (uid=%s)
+ldap.search-filter:

 # Instance name
 # Set your own custom name to be displayed instead of 'Opengist'
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -1,75 +0,0 @@
-# kustomize
-
-## Simple
-
-`kustomization.yaml`:
-
-```yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-metadata:
-  name: opengist
-
-resources:
-  - https://github.com/thomiceli/opengist/deploy/
-```
-
-## Full example
-
-`kustomization.yaml`:
-
-```yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-metadata:
-  name: opengist
-
-namespace: opengist
-
-resources:
-  - namespace.yaml
-  - https://github.com/thomiceli/opengist/deploy/?ref:v1.9.1
-
-images:
-  - name: ghcr.io/thomiceli/opengist
-    newTag: 1.9.1
-
-patches:
-  # Add your ingress
-  - path: ingress.yaml
-  - patch: |-
-      - op: add
-        path: /spec/rules/0/host
-        value: opengist.mydomain.com
-    target:
-      group: networking.k8s.io
-      version: v1
-      kind: Ingress
-      name: opengist
-```
-
-`namespace.yaml`:
-
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: opengist
-```
-
-`ingress.yaml`:
-
-```yaml
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: opengist
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - opengist.mydomain.com
-      secretName: opengist-tls
-```
--- a/deploy/deployment.yaml
+++ b/deploy/deployment.yaml
@@ -1,29 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: opengist
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: opengist
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: opengist
-    spec:
-      containers:
-        - name: opengist
-          image: ghcr.io/thomiceli/opengist
-          ports:
-            - name: http
-              containerPort: 6157
-            - name: ssh
-              containerPort: 2222
-          volumeMounts:
-            - mountPath: /opengist
-              name: data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: opengist-data
--- a/deploy/ingress.yaml
+++ b/deploy/ingress.yaml
@@ -1,20 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: opengist
-  labels:
-    app.kubernetes.io/name: opengist
-    app.kubernetes.io/component: ingress
-spec:
-  rules:
-    - host: opengist.local
-      http:
-        paths:
-          - pathType: Prefix
-            path: "/"
-            backend:
-              service:
-                name: opengist
-                port:
-                  name: http
--- a/deploy/kustomization.yaml
+++ b/deploy/kustomization.yaml
@@ -1,11 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-metadata:
-  name: opengist
-
-resources:
-  - deployment.yaml
-  - pvc.yaml
-  - ingress.yaml
-  - service.yaml
--- a/deploy/pvc.yaml
+++ b/deploy/pvc.yaml
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: opengist-data
-  labels:
-    app.kubernetes.io/name: opengist
-    app.kubernetes.io/component: data
-spec:
-  resources:
-    requests:
-      storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
--- a/deploy/service.yaml
+++ b/deploy/service.yaml
@@ -1,14 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: opengist
-  labels:
-    app.kubernetes.io/name: opengist
-spec:
-  selector:
-    app.kubernetes.io/name: opengist
-  ports:
-    - port: 80
-      targetPort: http
-      name: http
--- a/docs/.vitepress/config.mts
+++ b/docs/.vitepress/config.mts
@@ -25,6 +25,7 @@ export default defineConfig({
                    {text: 'Introduction', link: '/docs'},
                    {text: 'Installation', link: '/docs/installation', items: [
                        {text: 'Docker', link: '/docs/installation/docker'},
+                        {text: 'Kubernetes', link: '/docs/installation/kubernetes'},
                        {text: 'Binary', link: '/docs/installation/binary'},
                        {text: 'Source', link: '/docs/installation/source'},
                        ],
@@ -46,6 +47,7 @@ export default defineConfig({
                    {text: 'Custom assets', link: '/custom-assets'},
                    {text: 'Custom links', link: '/custom-links'},
                    {text: 'Cheat Sheet', link: '/cheat-sheet'},
+                    {text: 'Metrics', link: '/metrics'},
                    {text: 'Admin panel', link: '/admin-panel'},
                ], collapsed: false
            },
--- a/docs/.vitepress/theme/Home.vue
+++ b/docs/.vitepress/theme/Home.vue
@@ -19,7 +19,7 @@ export default {
        <div class="mx-auto  lg:text-center">
          <img class="rotating h-36 mx-auto my-8 " src="https://raw.githubusercontent.com/thomiceli/opengist/master/public/opengist.svg" alt="" >
          <a target="_blank" href="https://github.com/thomiceli/opengist/releases" class="inline-flex items-center rounded-full bg-indigo-100 hover:bg-indigo-200 px-4 py-1.5 text-lg font-medium text-indigo-700">
-              <span class="pr-1">Released 1.9</span>
+              <span class="pr-1">Released 1.11</span>
                        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="size-4">
              <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 19.5 15-15m0 0H8.25m11.25 0v11.25" />
            </svg>
--- a/docs/configuration/cheat-sheet.md
+++ b/docs/configuration/cheat-sheet.md
@@ -4,40 +4,49 @@ aside: false

 # Configuration Cheat Sheet

-| YAML Config Key       | Environment Variable                | Default value         | Description                                                                                                                                                                                                                      |
-|-----------------------|-------------------------------------|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| log-level             | OG_LOG_LEVEL                        | `warn`                | Set the log level to one of the following: `debug`, `info`, `warn`, `error`, `fatal`.                                                                                                                                            |
-| log-output            | OG_LOG_OUTPUT                       | `stdout,file`         | Set the log output to one or more of the following: `stdout`, `file`.                                                                                                                                                            |
-| external-url          | OG_EXTERNAL_URL                     | none                  | Public URL to access to Opengist.                                                                                                                                                                                                |
-| opengist-home         | OG_OPENGIST_HOME                    | home directory        | Path to the directory where Opengist stores its data.                                                                                                                                                                            |
-| secret-key            | OG_SECRET_KEY                       | randomized 32 bytes   | Secret key used for session store & encrypt MFA data on database.                                                                                                                                                                |
-| db-uri                | OG_DB_URI                           | `opengist.db`         | URI of the database.                                                                                                                                                                                                             |
-| index.enabled         | OG_INDEX_ENABLED                    | `true`                | Enable or disable the code search index (`true` or `false`)                                                                                                                                                                      |
-| index.dirname         | OG_INDEX_DIRNAME                    | `opengist.index`      | Name of the directory where the code search index is stored.                                                                                                                                                                     |
-| git.default-branch    | OG_GIT_DEFAULT_BRANCH               | none                  | Default branch name used by Opengist when initializing Git repositories. If not set, uses the Git default branch name. More info [here](https://git-scm.com/book/en/v2/Getting-Started-First-Time-Git-Setup#_new_default_branch) |
-| sqlite.journal-mode   | OG_SQLITE_JOURNAL_MODE              | `WAL`                 | Set the journal mode for SQLite. More info [here](https://www.sqlite.org/pragma.html#pragma_journal_mode)                                                                                                                        |
-| http.host             | OG_HTTP_HOST                        | `0.0.0.0`             | The host on which the HTTP server should bind.                                                                                                                                                                                   |
-| http.port             | OG_HTTP_PORT                        | `6157`                | The port on which the HTTP server should listen.                                                                                                                                                                                 |
-| http.git-enabled      | OG_HTTP_GIT_ENABLED                 | `true`                | Enable or disable git operations (clone, pull, push) via HTTP. (`true` or `false`)                                                                                                                                               |
-| ssh.git-enabled       | OG_SSH_GIT_ENABLED                  | `true`                | Enable or disable git operations (clone, pull, push) via SSH. (`true` or `false`)                                                                                                                                                |
-| ssh.host              | OG_SSH_HOST                         | `0.0.0.0`             | The host on which the SSH server should bind.                                                                                                                                                                                    |
-| ssh.port              | OG_SSH_PORT                         | `2222`                | The port on which the SSH server should listen.                                                                                                                                                                                  |
-| ssh.external-domain   | OG_SSH_EXTERNAL_DOMAIN              | none                  | Public domain for the Git SSH connection, if it has to be different from the HTTP one. If not set, uses the URL from the request.                                                                                                |
-| ssh.keygen-executable | OG_SSH_KEYGEN_EXECUTABLE            | `ssh-keygen`          | Path to the SSH key generation executable.                                                                                                                                                                                       |
-| github.client-key     | OG_GITHUB_CLIENT_KEY                | none                  | The client key for the GitHub OAuth application.                                                                                                                                                                                 |
-| github.secret         | OG_GITHUB_SECRET                    | none                  | The secret for the GitHub OAuth application.                                                                                                                                                                                     |
-| gitlab.client-key     | OG_GITLAB_CLIENT_KEY                | none                  | The client key for the GitLab OAuth application.                                                                                                                                                                                 |
-| gitlab.secret         | OG_GITLAB_SECRET                    | none                  | The secret for the GitLab OAuth application.                                                                                                                                                                                     |
-| gitlab.url            | OG_GITLAB_URL                       | `https://gitlab.com/` | The URL of the GitLab instance.                                                                                                                                                                                                  |
-| gitlab.name           | OG_GITLAB_NAME                      | `GitLab`              | The name of the GitLab instance. It is displayed in the OAuth login button.                                                                                                                                                      |
-| gitea.client-key      | OG_GITEA_CLIENT_KEY                 | none                  | The client key for the Gitea OAuth application.                                                                                                                                                                                  |
-| gitea.secret          | OG_GITEA_SECRET                     | none                  | The secret for the Gitea OAuth application.                                                                                                                                                                                      |
-| gitea.url             | OG_GITEA_URL                        | `https://gitea.com/`  | The URL of the Gitea instance.                                                                                                                                                                                                   |
-| gitea.name            | OG_GITEA_NAME                       | `Gitea`               | The name of the Gitea instance. It is displayed in the OAuth login button.                                                                                                                                                       |
-| oidc.client-key       | OG_OIDC_CLIENT_KEY                  | none                  | The client key for the OpenID application.                                                                                                                                                                                       |
-| oidc.secret           | OG_OIDC_SECRET                      | none                  | The secret for the OpenID application.                                                                                                                                                                                           |
-| oidc.discovery-url    | OG_OIDC_DISCOVERY_URL               | none                  | Discovery endpoint of the OpenID provider.                                                                                                                                                                                       |
-| custom.name           | OG_CUSTOM_NAME                      | none                  | The name of your instance, to be displayed in the tab title                                                                                                                                                                      |
-| custom.logo           | OG_CUSTOM_LOGO                      | none                  | Path to an image, relative to $opengist-home/custom.                                                                                                                                                                             |
-| custom.favicon        | OG_CUSTOM_FAVICON                   | none                  | Path to an image, relative to $opengist-home/custom.                                                                                                                                                                             |
-| custom.static-links   | OG_CUSTOM_STATIC_LINK_#_(PATH,NAME) | none                  | Path and name to custom links, more info [here](custom-links.md).                                                                                                                                                                |
+| YAML Config Key         | Environment Variable                | Default value         | Description                                                                                                                                                                                                                      |
+|-------------------------|-------------------------------------|-----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| log-level               | OG_LOG_LEVEL                        | `warn`                | Set the log level to one of the following: `debug`, `info`, `warn`, `error`, `fatal`.                                                                                                                                            |
+| log-output              | OG_LOG_OUTPUT                       | `stdout,file`         | Set the log output to one or more of the following: `stdout`, `file`.                                                                                                                                                            |
+| external-url            | OG_EXTERNAL_URL                     | none                  | Public URL to access to Opengist.                                                                                                                                                                                                |
+| opengist-home           | OG_OPENGIST_HOME                    | home directory        | Path to the directory where Opengist stores its data.                                                                                                                                                                            |
+| secret-key              | OG_SECRET_KEY                       | randomized 32 bytes   | Secret key used for session store & encrypt MFA data on database.                                                                                                                                                                |
+| db-uri                  | OG_DB_URI                           | `opengist.db`         | URI of the database.                                                                                                                                                                                                             |
+| index                   | OG_INDEX                            | `bleve`               | Define the code indexer (either `bleve`, `meilisearch`, or empty for no index).                                                                                                                                                  |
+| index.meili.host        | OG_MEILI_HOST                       | none                  | Set the host for the Meiliseach server.                                                                                                                                                                                          |
+| index.meili.api-key     | OG_MEILI_API_KEY                    | none                  | Set the API key for the Meiliseach server.                                                                                                                                                                                       |
+| git.default-branch      | OG_GIT_DEFAULT_BRANCH               | none                  | Default branch name used by Opengist when initializing Git repositories. If not set, uses the Git default branch name. More info [here](https://git-scm.com/book/en/v2/Getting-Started-First-Time-Git-Setup#_new_default_branch) |
+| sqlite.journal-mode     | OG_SQLITE_JOURNAL_MODE              | `WAL`                 | Set the journal mode for SQLite. More info [here](https://www.sqlite.org/pragma.html#pragma_journal_mode)                                                                                                                        |
+| http.host               | OG_HTTP_HOST                        | `0.0.0.0`             | The host on which the HTTP server should bind. Use an IP address for network binding. Use a path for Unix socket binding (e.g. /run/opengist.sock)                                                                               |
+| http.port               | OG_HTTP_PORT                        | `6157`                | The port on which the HTTP server should listen.                                                                                                                                                                                 |
+| http.git-enabled        | OG_HTTP_GIT_ENABLED                 | `true`                | Enable or disable git operations (clone, pull, push) via HTTP. (`true` or `false`)                                                                                                                                               |
+| unix-socket-permissions | OG_UNIX_SOCKET_PERMISSIONS          | `0666`                | File permissions for Unix socket (octal format).                                                                                                                                                                                 |
+| metrics.enabled         | OG_METRICS_ENABLED                  | `false`               | Enable or disable Prometheus metrics endpoint at `/metrics` (`true` or `false`)                                                                                                                                                  |
+| ssh.git-enabled         | OG_SSH_GIT_ENABLED                  | `true`                | Enable or disable git operations (clone, pull, push) via SSH. (`true` or `false`)                                                                                                                                                |
+| ssh.host                | OG_SSH_HOST                         | `0.0.0.0`             | The host on which the SSH server should bind.                                                                                                                                                                                    |
+| ssh.port                | OG_SSH_PORT                         | `2222`                | The port on which the SSH server should listen.                                                                                                                                                                                  |
+| ssh.external-domain     | OG_SSH_EXTERNAL_DOMAIN              | none                  | Public domain for the Git SSH connection, if it has to be different from the HTTP one. If not set, uses the URL from the request.                                                                                                |
+| ssh.keygen-executable   | OG_SSH_KEYGEN_EXECUTABLE            | `ssh-keygen`          | Path to the SSH key generation executable.                                                                                                                                                                                       |
+| github.client-key       | OG_GITHUB_CLIENT_KEY                | none                  | The client key for the GitHub OAuth application.                                                                                                                                                                                 |
+| github.secret           | OG_GITHUB_SECRET                    | none                  | The secret for the GitHub OAuth application.                                                                                                                                                                                     |
+| gitlab.client-key       | OG_GITLAB_CLIENT_KEY                | none                  | The client key for the GitLab OAuth application.                                                                                                                                                                                 |
+| gitlab.secret           | OG_GITLAB_SECRET                    | none                  | The secret for the GitLab OAuth application.                                                                                                                                                                                     |
+| gitlab.url              | OG_GITLAB_URL                       | `https://gitlab.com/` | The URL of the GitLab instance.                                                                                                                                                                                                  |
+| gitlab.name             | OG_GITLAB_NAME                      | `GitLab`              | The name of the GitLab instance. It is displayed in the OAuth login button.                                                                                                                                                      |
+| gitea.client-key        | OG_GITEA_CLIENT_KEY                 | none                  | The client key for the Gitea OAuth application.                                                                                                                                                                                  |
+| gitea.secret            | OG_GITEA_SECRET                     | none                  | The secret for the Gitea OAuth application.                                                                                                                                                                                      |
+| gitea.url               | OG_GITEA_URL                        | `https://gitea.com/`  | The URL of the Gitea instance.                                                                                                                                                                                                   |
+| gitea.name              | OG_GITEA_NAME                       | `Gitea`               | The name of the Gitea instance. It is displayed in the OAuth login button.                                                                                                                                                       |
+| oidc.provider-name      | OG_OIDC_PROVIDER_NAME               | none                  | The name of the OIDC provider                                                                                                                                                                                                    |
+| oidc.client-key         | OG_OIDC_CLIENT_KEY                  | none                  | The client key for the OpenID application.                                                                                                                                                                                       |
+| oidc.secret             | OG_OIDC_SECRET                      | none                  | The secret for the OpenID application.                                                                                                                                                                                           |
+| oidc.discovery-url      | OG_OIDC_DISCOVERY_URL               | none                  | Discovery endpoint of the OpenID provider.                                                                                                                                                                                       |
+| ldap.url                | OG_LDAP_URL                         | none                  | URL of the LDAP instance; if not set, LDAP authentication is disabled                                                                                                                                                            |
+| ldap.bind-dn            | OG_LDAP_BIND_DN                     | none                  | Bind DN to authenticate against the LDAP. e.g: cn=read-only-admin,dc=example,dc=com                                                                                                                                              |
+| ldap.bind-credentials   | OG_LDAP_BIND_CREDENTIALS            | none                  | The password for the Bind DN.                                                                                                                                                                                                    |
+| ldap.search-base        | OG_LDAP_SEARCH_BASE                 | none                  | The Base DN to start search from. e.g: ou=People,dc=example,dc=com                                                                                                                                                               |
+| ldap.search-filter      | OG_LDAP_SEARCH_FILTER               | none                  | The filter to search against (the format string %s will be replaced with the username). e.g: (uid=%s)                                                                                                                            |
+| custom.name             | OG_CUSTOM_NAME                      | none                  | The name of your instance, to be displayed in the tab title                                                                                                                                                                      |
+| custom.logo             | OG_CUSTOM_LOGO                      | none                  | Path to an image, relative to $opengist-home/custom.                                                                                                                                                                             |
+| custom.favicon          | OG_CUSTOM_FAVICON                   | none                  | Path to an image, relative to $opengist-home/custom.                                                                                                                                                                             |
+| custom.static-links     | OG_CUSTOM_STATIC_LINK_#_(PATH,NAME) | none                  | Path and name to custom links, more info [here](custom-links.md).                                                                                                                                                                |
--- a/docs/configuration/metrics.md
+++ b/docs/configuration/metrics.md
@@ -0,0 +1,49 @@
+# Metrics
+
+Opengist offers built-in support for Prometheus metrics to help you monitor the performance and usage of your instance. These metrics provide insights into application health, user activity, and database statistics.
+
+## Enabling metrics
+
+By default, the metrics endpoint is disabled for security and performance reasons. To enable it, update your configuration as stated in the [configuration cheat sheet](cheat-sheet.md):
+
+```yaml
+metrics.enabled = true
+```
+
+Alternatively, you can use the environment variable:
+
+```bash
+OG_METRICS_ENABLED=true
+```
+
+Once enabled, metrics are available at the /metrics endpoint.
+
+## Available metrics
+
+### Opengist-specific metrics
+
+| Metric Name | Type | Description |
+|-------------|------|-------------|
+| `opengist_users_total` | Gauge | Total number of registered users |
+| `opengist_gists_total` | Gauge | Total number of gists in the system |
+| `opengist_ssh_keys_total` | Gauge | Total number of SSH keys added by users |
+
+### Standard HTTP metrics
+
+In addition to the Opengist-specific metrics, standard Prometheus HTTP metrics are also available through the Echo Prometheus middleware. These include request durations, request counts, and request/response sizes.
+
+These standard metrics follow the Prometheus naming convention and include labels for HTTP method, status code, and handler path.
+
+## Security Considerations
+
+The metrics endpoint exposes information about your Opengist instance that might be sensitive in some environments. Consider using a reverse proxy with authentication for the `/metrics` endpoint if your Opengist instance is publicly accessible.
+
+Example with Nginx:
+
+```shell
+location /metrics {
+    auth_basic "Metrics";
+    auth_basic_user_file /etc/nginx/.htpasswd;
+    proxy_pass http://localhost:6157/metrics;
+}
+```
--- a/docs/configuration/oauth-providers.md
+++ b/docs/configuration/oauth-providers.md
@@ -63,15 +63,32 @@ Opengist can be configured to use OAuth to authenticate users, with GitHub, Gite
 * Set 'Redirect URI' to `http://opengist.url/oauth/openid-connect/callback`
 * Copy the 'Client ID', 'Client Secret', and the discovery endpoint, and add them to the [configuration](cheat-sheet.md) :
  ```yaml
+  oidc.provider-name: <provider-name>
  oidc.client-key: <key>
  oidc.secret: <secret>
  # Discovery endpoint of the OpenID provider. Generally something like http://auth.example.com/.well-known/openid-configuration
  oidc.discovery-url: http://auth.example.com/.well-known/openid-configuration
  ```
  ```shell
+  OG_OIDC_PROVIDER_NAME=<provider-name>
  OG_OIDC_CLIENT_KEY=<key>
  OG_OIDC_SECRET=<secret>
  # Discovery endpoint of the OpenID provider. Generally something like http://auth.example.com/.well-known/openid-configuration
  OG_OIDC_DISCOVERY_URL=http://auth.example.com/.well-known/openid-configuration
  ```
-  
+
+### OIDC Admin Group
+
+OpenGist supports automatic admin privilege assignment based on OIDC group claims. To configure this feature:
+```yaml
+oidc.group-claim-name: groups        # Name of the claim containing the groups
+oidc.admin-group: admin-group-name   # Name of the group that should receive admin rights
+```
+```shell
+OG_OIDC_GROUP_CLAIM_NAME=groups
+OG_OIDC_ADMIN_GROUP=admin-group-name
+```
+
+The `group-claim-name` must match the name of the claim in your JWT token that contains the groups.
+
+Users who are members of the configured `admin-group` will automatically receive admin privileges in OpenGist. These privileges are synchronized on every login.
--- a/docs/contributing/community.md
+++ b/docs/contributing/community.md
@@ -4,3 +4,4 @@ The following is a list of resources made by happy users of Opengist. Feel free

 - [Aetherinox/opengist-debian](https://github.com/Aetherinox/opengist-debian) - A Debian package for Opengist
 - [How to Install Opengist on Your Synology NAS](https://mariushosting.com/how-to-install-opengist-on-your-synology-nas/) - A guide to install Opengist on a Synology NAS
+- [Proxmox VE Helper-Script](https://community-scripts.github.io/ProxmoxVE/scripts?id=opengist) - A script to install Opengist on Proxmox VE
--- a/docs/installation/binary.md
+++ b/docs/installation/binary.md
@@ -4,9 +4,9 @@ Download the archive for your system from the release page [here](https://github

 ```shell
 # example for linux amd64
-wget https://github.com/thomiceli/opengist/releases/download/v1.9.1/opengist1.9.1-linux-amd64.tar.gz
+wget https://github.com/thomiceli/opengist/releases/download/v1.11.0/opengist1.11.0-linux-amd64.tar.gz

-tar xzvf opengist1.9.1-linux-amd64.tar.gz
+tar xzvf opengist1.11.0-linux-amd64.tar.gz
 cd opengist
 chmod +x opengist
 ./opengist # with or without `--config config.yml`
--- a/docs/installation/kubernetes.md
+++ b/docs/installation/kubernetes.md
@@ -0,0 +1,15 @@
+# Install on Kubernetes
+
+A [Helm](https://helm.sh) chart is available to install Opengist on a Kubernetes cluster.
+Check the [Helm documentation](https://helm.sh/docs/) for more information on how to use Helm.
+
+A non-customized installation of Opengist can be done with:
+
+```bash
+helm repo add opengist https://helm.opengist.io
+ 
+helm install opengist opengist/opengist
+```
+
+Refer to the [Opengist chart](https://github.com/thomiceli/opengist/tree/master/helm/opengist) for more information 
+about the chart and to customize your installation.
--- a/docs/installation/source.md
+++ b/docs/installation/source.md
@@ -10,7 +10,7 @@ Requirements:
 git clone https://github.com/thomiceli/opengist
 cd opengist

-git checkout v1.9.1 # optional, to checkout the latest release
+git checkout v1.11.0 # optional, to checkout the latest release

 make
 ./opengist
--- a/docs/update.md
+++ b/docs/update.md
@@ -27,9 +27,9 @@ Stop the running instance; then like your first installation of Opengist, downlo

 ```shell
 # example for linux amd64
-wget https://github.com/thomiceli/opengist/releases/download/v1.9.1/opengist1.9.1-linux-amd64.tar.gz
+wget https://github.com/thomiceli/opengist/releases/download/v1.11.0/opengist1.11.0-linux-amd64.tar.gz

-tar xzvf opengist1.9.1-linux-amd64.tar.gz
+tar xzvf opengist1.11.0-linux-amd64.tar.gz
 cd opengist
 chmod +x opengist
 ./opengist # with or without `--config config.yml`
--- a/docs/usage/init-via-git.md
+++ b/docs/usage/init-via-git.md
@@ -1,6 +1,6 @@
 # Init Gists via Git

-Opengist allows you to create new snippets via Git over HTTP.
+Opengist allows you to create new snippets via Git over HTTP. You can create gists with either auto-generated URLs or custom URLs of your choice.

 Simply init a new Git repository where your file(s) is/are located:

@@ -10,19 +10,41 @@ git add .
 git commit -m "My cool snippet"
 ```

-Then add this Opengist special remote URL and push your changes:
+### Option A: Regular URL
+
+Create a gist with a custom URL using the format `http://opengist.url/username/custom-url`, where `username` is your authenticated username and `custom-url` is your desired gist identifier.
+
+The gist must not exist yet if you want to create it, otherwise you will just push to the existing gist.

 ```shell
-git remote add origin http://localhost:6157/init
+git remote add origin http://opengist.url/thomas/my-custom-gist

 git push -u origin master
 ```

-Log in with your Opengist account credentials, and your snippet will be created at the specified URL:
+**Requirements for custom URLs:**
+- The username must match your authenticated username
+- URL format: `http://opengist.url/username/custom-url`
+- The custom URL becomes your gist's identifier and title
+- `.git` suffix is automatically removed if present
+
+### Option B: Init endpoint
+
+Use the special `http://opengist.url/init` endpoint to create a gist with an automatically generated URL:

 ```shell
-Username for 'http://localhost:6157': thomas
-Password for 'http://thomas@localhost:6157':
+git remote add origin http://opengist.url/init
+
+git push -u origin master
+```
+
+## Authentication
+
+When you push, you'll be prompted to authenticate:
+
+```shell
+Username for 'http://opengist.url': thomas
+Password for 'http://thomas@opengist.url': [your-password]
 Enumerating objects: 3, done.
 Counting objects: 100% (3/3), done.
 Delta compression using up to 8 threads
@@ -30,12 +52,12 @@ Compressing objects: 100% (2/2), done.
 Writing objects: 100% (3/3), 416 bytes | 416.00 KiB/s, done.
 Total 3 (delta 0), reused 0 (delta 0), pack-reused 0
 remote:
-remote: Your new repository has been created here: http://localhost:6157/thomas/6051e930f140429f9a2f3bb1fa101066
+remote: Your new repository has been created here: http://opengist.url/thomas/6051e930f140429f9a2f3bb1fa101066
 remote:
 remote: If you want to keep working with your gist, you could set the remote URL via:
-remote: git remote set-url origin http://localhost:6157/thomas/6051e930f140429f9a2f3bb1fa101066
+remote: git remote set-url origin http://opengist.url/thomas/6051e930f140429f9a2f3bb1fa101066
 remote:
-To http://localhost:6157/init
+To http://opengist.url/init
 * [new branch]      master -> master
 ```

--- a/go.mod
+++ b/go.mod
@@ -1,31 +1,36 @@
 module github.com/thomiceli/opengist

-go 1.23
+go 1.23.0

 require (
 	github.com/Kunde21/markdownfmt/v3 v3.1.0
-	github.com/alecthomas/chroma/v2 v2.15.0
-	github.com/blevesearch/bleve/v2 v2.4.4
+	github.com/alecthomas/chroma/v2 v2.20.0
+	github.com/blevesearch/bleve/v2 v2.5.0
 	github.com/dustin/go-humanize v1.0.1
+	github.com/gabriel-vasile/mimetype v1.4.8
 	github.com/glebarez/sqlite v1.11.0
-	github.com/go-playground/validator/v10 v10.24.0
-	github.com/go-webauthn/webauthn v0.11.2
+	github.com/go-ldap/ldap/v3 v3.4.8
+	github.com/go-playground/validator/v10 v10.26.0
+	github.com/go-webauthn/webauthn v0.12.3
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/schema v1.4.1
 	github.com/gorilla/securecookie v1.1.2
 	github.com/gorilla/sessions v1.4.0
+	github.com/labstack/echo-contrib v0.17.3
 	github.com/labstack/echo/v4 v4.13.3
-	github.com/markbates/goth v1.80.0
+	github.com/markbates/goth v1.81.0
+	github.com/meilisearch/meilisearch-go v0.31.0
 	github.com/pquerna/otp v1.4.0
-	github.com/rs/zerolog v1.33.0
+	github.com/prometheus/client_golang v1.21.1
+	github.com/rs/zerolog v1.34.0
 	github.com/stretchr/testify v1.10.0
-	github.com/urfave/cli/v2 v2.27.5
+	github.com/urfave/cli/v2 v2.27.6
 	github.com/yuin/goldmark v1.7.8
-	github.com/yuin/goldmark-emoji v1.0.4
+	github.com/yuin/goldmark-emoji v1.0.5
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	go.abhg.dev/goldmark/mermaid v0.5.0
-	golang.org/x/crypto v0.32.0
-	golang.org/x/text v0.22.0
+	golang.org/x/crypto v0.36.0
+	golang.org/x/text v0.23.0
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.7
 	gorm.io/driver/postgres v1.5.11
@@ -34,61 +39,74 @@ require (

 require (
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/RoaringBitmap/roaring v1.9.4 // indirect
-	github.com/bits-and-blooms/bitset v1.17.0 // indirect
-	github.com/blevesearch/bleve_index_api v1.1.13 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/RoaringBitmap/roaring/v2 v2.4.5 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bits-and-blooms/bitset v1.22.0 // indirect
+	github.com/blevesearch/bleve_index_api v1.2.7 // indirect
 	github.com/blevesearch/geo v0.1.20 // indirect
-	github.com/blevesearch/go-faiss v1.0.24 // indirect
+	github.com/blevesearch/go-faiss v1.0.25 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
 	github.com/blevesearch/mmap-go v1.0.4 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.2.16 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.3.9 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
-	github.com/blevesearch/vellum v1.0.11 // indirect
-	github.com/blevesearch/zapx/v11 v11.3.10 // indirect
-	github.com/blevesearch/zapx/v12 v12.3.10 // indirect
-	github.com/blevesearch/zapx/v13 v13.3.10 // indirect
-	github.com/blevesearch/zapx/v14 v14.3.10 // indirect
-	github.com/blevesearch/zapx/v15 v15.3.16 // indirect
-	github.com/blevesearch/zapx/v16 v16.1.9-0.20241217210638-a0519e7caf3b // indirect
+	github.com/blevesearch/vellum v1.1.0 // indirect
+	github.com/blevesearch/zapx/v11 v11.4.1 // indirect
+	github.com/blevesearch/zapx/v12 v12.4.1 // indirect
+	github.com/blevesearch/zapx/v13 v13.4.1 // indirect
+	github.com/blevesearch/zapx/v14 v14.4.1 // indirect
+	github.com/blevesearch/zapx/v15 v15.4.1 // indirect
+	github.com/blevesearch/zapx/v16 v16.2.2 // indirect
 	github.com/boombuler/barcode v1.0.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dlclark/regexp2 v1.11.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
 	github.com/glebarez/go-sqlite v1.22.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
+	github.com/go-chi/chi/v5 v5.2.1 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-sql-driver/mysql v1.8.1 // indirect
-	github.com/go-webauthn/x v0.1.15 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
-	github.com/golang/geo v0.0.0-20230421003525-6adc56603217 // indirect
+	github.com/go-sql-driver/mysql v1.9.1 // indirect
+	github.com/go-webauthn/x v0.1.20 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/golang/geo v0.0.0-20250404181303-07d601f131f3 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/go-tpm v0.9.1 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/go-tpm v0.9.3 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.1 // indirect
+	github.com/jackc/pgx/v5 v5.7.4 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/labstack/gommon v0.4.2 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
+	github.com/prometheus/procfs v0.16.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -96,16 +114,16 @@ require (
 	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
-	go.etcd.io/bbolt v1.3.11 // indirect
-	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
-	google.golang.org/protobuf v1.35.2 // indirect
-	modernc.org/libc v1.61.2 // indirect
-	modernc.org/mathutil v1.6.0 // indirect
-	modernc.org/memory v1.8.0 // indirect
-	modernc.org/sqlite v1.34.1 // indirect
+	go.etcd.io/bbolt v1.4.0 // indirect
+	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
+	golang.org/x/net v0.38.0 // indirect
+	golang.org/x/oauth2 v0.29.0 // indirect
+	golang.org/x/sync v0.13.0 // indirect
+	golang.org/x/sys v0.32.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	modernc.org/libc v1.62.1 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.9.1 // indirect
+	modernc.org/sqlite v1.37.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@@ -1,59 +1,69 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/Kunde21/markdownfmt/v3 v3.1.0 h1:KiZu9LKs+wFFBQKhrZJrFZwtLnCCWJahL+S+E/3VnM0=
 github.com/Kunde21/markdownfmt/v3 v3.1.0/go.mod h1:tPXN1RTyOzJwhfHoon9wUr4HGYmWgVxSQN6VBJDkrVc=
-github.com/RoaringBitmap/roaring v1.9.4 h1:yhEIoH4YezLYT04s1nHehNO64EKFTop/wBhxv2QzDdQ=
-github.com/RoaringBitmap/roaring v1.9.4/go.mod h1:6AXUsoIEzDTFFQCe1RbGA6uFONMhvejWj5rqITANK90=
+github.com/RoaringBitmap/roaring/v2 v2.4.5 h1:uGrrMreGjvAtTBobc0g5IrW1D5ldxDQYe2JW2gggRdg=
+github.com/RoaringBitmap/roaring/v2 v2.4.5/go.mod h1:FiJcsfkGje/nZBZgCu0ZxCPOKD/hVXDS2dXi7/eUFE0=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.15.0 h1:LxXTQHFoYrstG2nnV9y2X5O94sOBzf0CIUpSTbpxvMc=
-github.com/alecthomas/chroma/v2 v2.15.0/go.mod h1:gUhVLrPDXPtp/f+L1jo9xepo9gL4eLwRuGAunSZMkio=
+github.com/alecthomas/chroma/v2 v2.20.0 h1:sfIHpxPyR07/Oylvmcai3X/exDlE8+FA820NTz+9sGw=
+github.com/alecthomas/chroma/v2 v2.20.0/go.mod h1:e7tViK0xh/Nf4BYHl00ycY6rV7b8iXBksI9E359yNmA=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
-github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
-github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/repr v0.5.1 h1:E3G4t2QbHTSNpPKBgMTln5KLkZHLOcU7r37J4pXBuIg=
+github.com/alecthomas/repr v0.5.1/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bits-and-blooms/bitset v1.12.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/bits-and-blooms/bitset v1.17.0 h1:1X2TS7aHz1ELcC0yU1y2stUs/0ig5oMU6STFZGrhvHI=
-github.com/bits-and-blooms/bitset v1.17.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
-github.com/blevesearch/bleve/v2 v2.4.4 h1:RwwLGjUm54SwyyykbrZs4vc1qjzYic4ZnAnY9TwNl60=
-github.com/blevesearch/bleve/v2 v2.4.4/go.mod h1:fa2Eo6DP7JR+dMFpQe+WiZXINKSunh7WBtlDGbolKXk=
-github.com/blevesearch/bleve_index_api v1.1.13 h1:+nrA6oRJr85aCPyqaeZtsruObwKojutfonHJin/BP48=
-github.com/blevesearch/bleve_index_api v1.1.13/go.mod h1:PbcwjIcRmjhGbkS/lJCpfgVSMROV6TRubGGAODaK1W8=
+github.com/bits-and-blooms/bitset v1.22.0 h1:Tquv9S8+SGaS3EhyA+up3FXzmkhxPGjQQCkcs2uw7w4=
+github.com/bits-and-blooms/bitset v1.22.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
+github.com/blevesearch/bleve/v2 v2.5.0 h1:HzYqBy/5/M9Ul9ESEmXzN/3Jl7YpmWBdHM/+zzv/3k4=
+github.com/blevesearch/bleve/v2 v2.5.0/go.mod h1:PcJzTPnEynO15dCf9isxOga7YFRa/cMSsbnRwnszXUk=
+github.com/blevesearch/bleve_index_api v1.2.7 h1:c8r9vmbaYQroAMSGag7zq5gEVPiuXrUQDqfnj7uYZSY=
+github.com/blevesearch/bleve_index_api v1.2.7/go.mod h1:rKQDl4u51uwafZxFrPD1R7xFOwKnzZW7s/LSeK4lgo0=
 github.com/blevesearch/geo v0.1.20 h1:paaSpu2Ewh/tn5DKn/FB5SzvH0EWupxHEIwbCk/QPqM=
 github.com/blevesearch/geo v0.1.20/go.mod h1:DVG2QjwHNMFmjo+ZgzrIq2sfCh6rIHzy9d9d0B59I6w=
-github.com/blevesearch/go-faiss v1.0.24 h1:K79IvKjoKHdi7FdiXEsAhxpMuns0x4fM0BO93bW5jLI=
-github.com/blevesearch/go-faiss v1.0.24/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
+github.com/blevesearch/go-faiss v1.0.25 h1:lel1rkOUGbT1CJ0YgzKwC7k+XH0XVBHnCVWahdCXk4U=
+github.com/blevesearch/go-faiss v1.0.25/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
 github.com/blevesearch/go-porterstemmer v1.0.3/go.mod h1:angGc5Ht+k2xhJdZi511LtmxuEf0OVpvUUNrwmM1P7M=
 github.com/blevesearch/gtreap v0.1.1 h1:2JWigFrzDMR+42WGIN/V2p0cUvn4UP3C4Q5nmaZGW8Y=
 github.com/blevesearch/gtreap v0.1.1/go.mod h1:QaQyDRAT51sotthUWAH4Sj08awFSSWzgYICSZ3w0tYk=
 github.com/blevesearch/mmap-go v1.0.4 h1:OVhDhT5B/M1HNPpYPBKIEJaD0F3Si+CrEKULGCDPWmc=
 github.com/blevesearch/mmap-go v1.0.4/go.mod h1:EWmEAOmdAS9z/pi/+Toxu99DnsbhG1TIxUoRmJw/pSs=
-github.com/blevesearch/scorch_segment_api/v2 v2.2.16 h1:uGvKVvG7zvSxCwcm4/ehBa9cCEuZVE+/zvrSl57QUVY=
-github.com/blevesearch/scorch_segment_api/v2 v2.2.16/go.mod h1:VF5oHVbIFTu+znY1v30GjSpT5+9YFs9dV2hjvuh34F0=
+github.com/blevesearch/scorch_segment_api/v2 v2.3.9 h1:X6nJXnNHl7nasXW+U6y2Ns2Aw8F9STszkYkyBfQ+p0o=
+github.com/blevesearch/scorch_segment_api/v2 v2.3.9/go.mod h1:IrzspZlVjhf4X29oJiEhBxEteTqOY9RlYlk1lCmYHr4=
 github.com/blevesearch/segment v0.9.1 h1:+dThDy+Lvgj5JMxhmOVlgFfkUtZV2kw49xax4+jTfSU=
 github.com/blevesearch/segment v0.9.1/go.mod h1:zN21iLm7+GnBHWTao9I+Au/7MBiL8pPFtJBJTsk6kQw=
 github.com/blevesearch/snowballstem v0.9.0 h1:lMQ189YspGP6sXvZQ4WZ+MLawfV8wOmPoD/iWeNXm8s=
 github.com/blevesearch/snowballstem v0.9.0/go.mod h1:PivSj3JMc8WuaFkTSRDW2SlrulNWPl4ABg1tC/hlgLs=
 github.com/blevesearch/upsidedown_store_api v1.0.2 h1:U53Q6YoWEARVLd1OYNc9kvhBMGZzVrdmaozG2MfoB+A=
 github.com/blevesearch/upsidedown_store_api v1.0.2/go.mod h1:M01mh3Gpfy56Ps/UXHjEO/knbqyQ1Oamg8If49gRwrQ=
-github.com/blevesearch/vellum v1.0.11 h1:SJI97toEFTtA9WsDZxkyGTaBWFdWl1n2LEDCXLCq/AU=
-github.com/blevesearch/vellum v1.0.11/go.mod h1:QgwWryE8ThtNPxtgWJof5ndPfx0/YMBh+W2weHKPw8Y=
-github.com/blevesearch/zapx/v11 v11.3.10 h1:hvjgj9tZ9DeIqBCxKhi70TtSZYMdcFn7gDb71Xo/fvk=
-github.com/blevesearch/zapx/v11 v11.3.10/go.mod h1:0+gW+FaE48fNxoVtMY5ugtNHHof/PxCqh7CnhYdnMzQ=
-github.com/blevesearch/zapx/v12 v12.3.10 h1:yHfj3vXLSYmmsBleJFROXuO08mS3L1qDCdDK81jDl8s=
-github.com/blevesearch/zapx/v12 v12.3.10/go.mod h1:0yeZg6JhaGxITlsS5co73aqPtM04+ycnI6D1v0mhbCs=
-github.com/blevesearch/zapx/v13 v13.3.10 h1:0KY9tuxg06rXxOZHg3DwPJBjniSlqEgVpxIqMGahDE8=
-github.com/blevesearch/zapx/v13 v13.3.10/go.mod h1:w2wjSDQ/WBVeEIvP0fvMJZAzDwqwIEzVPnCPrz93yAk=
-github.com/blevesearch/zapx/v14 v14.3.10 h1:SG6xlsL+W6YjhX5N3aEiL/2tcWh3DO75Bnz77pSwwKU=
-github.com/blevesearch/zapx/v14 v14.3.10/go.mod h1:qqyuR0u230jN1yMmE4FIAuCxmahRQEOehF78m6oTgns=
-github.com/blevesearch/zapx/v15 v15.3.16 h1:Ct3rv7FUJPfPk99TI/OofdC+Kpb4IdyfdMH48sb+FmE=
-github.com/blevesearch/zapx/v15 v15.3.16/go.mod h1:Turk/TNRKj9es7ZpKK95PS7f6D44Y7fAFy8F4LXQtGg=
-github.com/blevesearch/zapx/v16 v16.1.9-0.20241217210638-a0519e7caf3b h1:ju9Az5YgrzCeK3M1QwvZIpxYhChkXp7/L0RhDYsxXoE=
-github.com/blevesearch/zapx/v16 v16.1.9-0.20241217210638-a0519e7caf3b/go.mod h1:BlrYNpOu4BvVRslmIG+rLtKhmjIaRhIbG8sb9scGTwI=
+github.com/blevesearch/vellum v1.1.0 h1:CinkGyIsgVlYf8Y2LUQHvdelgXr6PYuvoDIajq6yR9w=
+github.com/blevesearch/vellum v1.1.0/go.mod h1:QgwWryE8ThtNPxtgWJof5ndPfx0/YMBh+W2weHKPw8Y=
+github.com/blevesearch/zapx/v11 v11.4.1 h1:qFCPlFbsEdwbbckJkysptSQOsHn4s6ZOHL5GMAIAVHA=
+github.com/blevesearch/zapx/v11 v11.4.1/go.mod h1:qNOGxIqdPC1MXauJCD9HBG487PxviTUUbmChFOAosGs=
+github.com/blevesearch/zapx/v12 v12.4.1 h1:K77bhypII60a4v8mwvav7r4IxWA8qxhNjgF9xGdb9eQ=
+github.com/blevesearch/zapx/v12 v12.4.1/go.mod h1:QRPrlPOzAxBNMI0MkgdD+xsTqx65zbuPr3Ko4Re49II=
+github.com/blevesearch/zapx/v13 v13.4.1 h1:EnkEMZFUK0lsW/jOJJF2xOcp+W8TjEsyeN5BeAZEYYE=
+github.com/blevesearch/zapx/v13 v13.4.1/go.mod h1:e6duBMlCvgbH9rkzNMnUa9hRI9F7ri2BRcHfphcmGn8=
+github.com/blevesearch/zapx/v14 v14.4.1 h1:G47kGCshknBZzZAtjcnIAMn3oNx8XBLxp8DMq18ogyE=
+github.com/blevesearch/zapx/v14 v14.4.1/go.mod h1:O7sDxiaL2r2PnCXbhh1Bvm7b4sP+jp4unE9DDPWGoms=
+github.com/blevesearch/zapx/v15 v15.4.1 h1:B5IoTMUCEzFdc9FSQbhVOxAY+BO17c05866fNruiI7g=
+github.com/blevesearch/zapx/v15 v15.4.1/go.mod h1:b/MreHjYeQoLjyY2+UaM0hGZZUajEbE0xhnr1A2/Q6Y=
+github.com/blevesearch/zapx/v16 v16.2.2 h1:MifKJVRTEhMTgSlle2bDRTb39BGc9jXFRLPZc6r0Rzk=
+github.com/blevesearch/zapx/v16 v16.2.2/go.mod h1:B9Pk4G1CqtErgQV9DyCSA9Lb7WZe4olYfGw7fVDZ4sk=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.2 h1:79yrbttoZrLGkL/oOI8hBrUKucwOL0oOjUgEguGMcJ4=
 github.com/boombuler/barcode v1.0.2/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chromedp/cdproto v0.0.0-20230220211738-2b1ec77315c9 h1:wMSvdj3BswqfQOXp2R1bJOAE7xIQLt2dlMQDMf836VY=
 github.com/chromedp/cdproto v0.0.0-20230220211738-2b1ec77315c9/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
 github.com/chromedp/chromedp v0.9.1 h1:CC7cC5p1BeLiiS2gfNNPwp3OaUxtRMBjfiw3E3k6dFA=
@@ -61,41 +71,47 @@ github.com/chromedp/chromedp v0.9.1/go.mod h1:DUgZWRvYoEfgi66CgZ/9Yv+psgi+Sksy5D
 github.com/chromedp/sysutil v1.0.0 h1:+ZxhTpfpZlmchB58ih/LBHX52ky7w2VhQVKQMucy3Ic=
 github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
-github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2 v1.11.4 h1:rPYF9/LECdNymJufQKmri9gV604RvvABwgOA8un7yAo=
-github.com/dlclark/regexp2 v1.11.4/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
+github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
-github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.8.0 h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU=
+github.com/fxamacker/cbor/v2 v2.8.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
 github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
 github.com/glebarez/go-sqlite v1.22.0 h1:uAcMJhaA6r3LHMTFgP0SifzgXg46yJkgxqyuyec+ruQ=
 github.com/glebarez/go-sqlite v1.22.0/go.mod h1:PlBIdHe0+aUEFn+r2/uthrWq4FxbzugL0L8Li6yQJbc=
 github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw=
 github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
+github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
+github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-ldap/ldap/v3 v3.4.8 h1:loKJyspcRezt2Q3ZRMq2p/0v8iOurlmeXDPw6fikSvQ=
+github.com/go-ldap/ldap/v3 v3.4.8/go.mod h1:qS3Sjlu76eHfHGpUdWkAXQTw4beih+cHsco2jXlIXrk=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.24.0 h1:KHQckvo8G6hlWnrPX4NJJ+aBfWNAE/HH+qdL2cBpCmg=
-github.com/go-playground/validator/v10 v10.24.0/go.mod h1:GGzBIJMuE98Ic/kJsBXbz1x/7cByt++cQ+YOuDM5wus=
+github.com/go-playground/validator/v10 v10.26.0 h1:SP05Nqhjcvz81uJaRfEV0YBSSSGMc/iMaVtFbr3Sw2k=
+github.com/go-playground/validator/v10 v10.26.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
 github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
-github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
-github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-webauthn/webauthn v0.11.2 h1:Fgx0/wlmkClTKlnOsdOQ+K5HcHDsDcYIvtYmfhEOSUc=
-github.com/go-webauthn/webauthn v0.11.2/go.mod h1:aOtudaF94pM71g3jRwTYYwQTG1KyTILTcZqN1srkmD0=
-github.com/go-webauthn/x v0.1.15 h1:eG1OhggBJTkDE8gUeOlGRbRe8E/PSVG26YG4AyFbwkU=
-github.com/go-webauthn/x v0.1.15/go.mod h1:pf7VI23raFLHPO9VVIs9/u1etqwAOP0S2KoHGL6WbZ8=
+github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtSb/iI=
+github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-webauthn/webauthn v0.12.3 h1:hHQl1xkUuabUU9uS+ISNCMLs9z50p9mDUZI/FmkayNE=
+github.com/go-webauthn/webauthn v0.12.3/go.mod h1:4JRe8Z3W7HIw8NGEWn2fnUwecoDzkkeach/NnvhkqGY=
+github.com/go-webauthn/x v0.1.20 h1:brEBDqfiPtNNCdS/peu8gARtq8fIPsHz0VzpPjGvgiw=
+github.com/go-webauthn/x v0.1.20/go.mod h1:n/gAc8ssZJGATM0qThE+W+vfgXiMedsWi3wf/C4lld0=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
@@ -103,43 +119,63 @@ github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6Wezm
 github.com/gobwas/ws v1.1.0 h1:7RFti/xnNkMJnrK7D1yQ/iCIB5OrrY/54/H930kIbHA=
 github.com/gobwas/ws v1.1.0/go.mod h1:nzvNcVha5eUziGrbxFCo6qFIojQHjJV5cLYIbezhfL0=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/golang/geo v0.0.0-20230421003525-6adc56603217 h1:HKlyj6in2JV6wVkmQ4XmG/EIm+SCYlPZ+V4GWit7Z+I=
-github.com/golang/geo v0.0.0-20230421003525-6adc56603217/go.mod h1:8wI0hitZ3a1IxZfeH3/5I97CI8i5cLGsYe7xNhQGs9U=
+github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang/geo v0.0.0-20250404181303-07d601f131f3 h1:8COTSTFIIXnaD81+kfCw4dRANNAKuCp06EdYLqwX30g=
+github.com/golang/geo v0.0.0-20250404181303-07d601f131f3/go.mod h1:J+F9/3Ofc8ysEOY2/cNjxTMl2eB1gvPIywEHUplPgDA=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
-github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-tpm v0.9.1 h1:0pGc4X//bAlmZzMKf8iz6IsDo1nYTbYJ6FZN/rg4zdM=
-github.com/google/go-tpm v0.9.1/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
+github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-tpm v0.9.3 h1:+yx0/anQuGzi+ssRqeD6WpXjW2L/V0dItUayO0i9sRc=
+github.com/google/go-tpm v0.9.3/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd h1:gbpYu9NMq8jhDVbvlGkMFWCjLFlqqEZjEmObmhUy6Vo=
-github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/schema v1.4.1 h1:jUg5hUjCSDZpNGLuXQOgIWGdlgrIdYvgQ0wZtdK1M3E=
 github.com/gorilla/schema v1.4.1/go.mod h1:Dg5SSm5PV60mhF2NFaTV1xuYYj8tV8NOPRo4FggUMnM=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.7.1 h1:x7SYsPBYDkHDksogeSmZZ5xzThcTgRz++I5E+ePFUcs=
-github.com/jackc/pgx/v5 v5.7.1/go.mod h1:e7O26IywZZ+naJtWWos6i6fvWK+29etgITqrqHLfoZA=
+github.com/jackc/pgx/v5 v5.7.4 h1:9wKznZrhWa2QiHL+NjTSPP6yjl3451BX3imWDnokYlg=
+github.com/jackc/pgx/v5 v5.7.4/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
@@ -148,28 +184,37 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/labstack/echo-contrib v0.17.3 h1:hj+qXksKZG1scSe9ksUXMtv7fZYN+PtQT+bPcYA3/TY=
+github.com/labstack/echo-contrib v0.17.3/go.mod h1:TcRBrzW8jcC4JD+5Dc/pvOyAps0rtgzj7oBqoR3nYsc=
 github.com/labstack/echo/v4 v4.13.3 h1:pwhpCPrTl5qry5HRdM5FwdXnhXSLSY+WE+YQSeCaafY=
 github.com/labstack/echo/v4 v4.13.3/go.mod h1:o90YNEeQWjDozo584l7AwhJMHN0bOC4tAfg+Xox9q5g=
 github.com/labstack/gommon v0.4.2 h1:F8qTUNXgG1+6WQmqoUWnz8WiEU60mXVVw0P4ht1WRA0=
 github.com/labstack/gommon v0.4.2/go.mod h1:QlUFxVM+SNXhDL/Z7YhocGIBYOiwB0mXm1+1bAPHPyU=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/markbates/goth v1.80.0 h1:NnvatczZDzOs1hn9Ug+dVYf2Viwwkp/ZDX5K+GLjan8=
-github.com/markbates/goth v1.80.0/go.mod h1:4/GYHo+W6NWisrMPZnq0Yr2Q70UntNLn7KXEFhrIdAY=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/markbates/goth v1.81.0 h1:XVcCkeGWokynPV7MXvgb8pd2s3r7DS40P7931w6kdnE=
+github.com/markbates/goth v1.81.0/go.mod h1:+6z31QyUms84EHmuBY7iuqYSxyoN3njIgg9iCF/lR1k=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/meilisearch/meilisearch-go v0.31.0 h1:yZRhY1qJqdH8h6GFZALGtkDLyj8f9v5aJpsNMyrUmnY=
+github.com/meilisearch/meilisearch-go v0.31.0/go.mod h1:aNtyuwurDg/ggxQIcKqWH6G9g2ptc8GyY7PLY4zMn/g=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -179,6 +224,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
 github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -186,6 +233,14 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
+github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
+github.com/prometheus/procfs v0.16.0 h1:xh6oHhKwnOJKMYiYBDWmkHqQPyiY40sny36Cmx2bbsM=
+github.com/prometheus/procfs v0.16.0/go.mod h1:8veyXUu3nGP7oaCxhX6yeaM5u4stL2FeMXnCqhDthZg=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
@@ -193,18 +248,25 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
 github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
-github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8=
-github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/urfave/cli/v2 v2.27.5 h1:WoHEJLdsXr6dDWoJgMq/CboDmyY/8HMMH1fTECbih+w=
-github.com/urfave/cli/v2 v2.27.5/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
+github.com/urfave/cli/v2 v2.27.6 h1:VdRdS98FNhKZ8/Az8B7MTyGQmpIr36O1EHybx/LaZ4g=
+github.com/urfave/cli/v2 v2.27.6/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
@@ -213,50 +275,99 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark v1.7.8 h1:iERMLn0/QJeHFhxSt3p6PeN9mGnvIKSpG9YYorDMnic=
 github.com/yuin/goldmark v1.7.8/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
-github.com/yuin/goldmark-emoji v1.0.4 h1:vCwMkPZSNefSUnOW2ZKRUjBSD5Ok3W78IXhGxxAEF90=
-github.com/yuin/goldmark-emoji v1.0.4/go.mod h1:tTkZEbwu5wkPmgTcitqddVxY9osFZiavD+r4AzQrh1U=
+github.com/yuin/goldmark-emoji v1.0.5 h1:EMVWyCGPlXJfUXBXpuMu+ii3TIaxbVBnEX9uaDC4cIk=
+github.com/yuin/goldmark-emoji v1.0.5/go.mod h1:tTkZEbwu5wkPmgTcitqddVxY9osFZiavD+r4AzQrh1U=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 go.abhg.dev/goldmark/mermaid v0.5.0 h1:mDkykpSPJ+5wCQ8bSXgzJ2KQskjXkI5Ndxz7JYDHW38=
 go.abhg.dev/goldmark/mermaid v0.5.0/go.mod h1:OCyk2o85TX2drWHH+HRy6bih2yZlUwbbv/R1MMh1YLs=
-go.etcd.io/bbolt v1.3.11 h1:yGEzV1wPz2yVCLsD8ZAiGHhHVlczyC9d1rP43/VCRJ0=
-go.etcd.io/bbolt v1.3.11/go.mod h1:dksAq7YMXoljX0xu6VF5DMZGbhYYoLUalEiSySYAS4I=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
-golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
-golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+go.etcd.io/bbolt v1.4.0 h1:TU77id3TnN/zKr7CO/uk+fBCwF2jGcMuw2B/FMAzYIk=
+go.etcd.io/bbolt v1.4.0/go.mod h1:AsD+OCi/qPN1giOX1aiLAha3o1U8rAz65bvN4j0sRuk=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/oauth2 v0.29.0 h1:WdYw2tdTK1S8olAzWHdgeqfy+Mtm9XNhv/xJsY65d98=
+golang.org/x/oauth2 v0.29.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/tools v0.27.0 h1:qEKojBykQkQ4EynWy4S8Weg69NumxKdn40Fce3uc/8o=
-golang.org/x/tools v0.27.0/go.mod h1:sUi0ZgbwW9ZPAq26Ekut+weQPR5eIM6GQLQ1Yjm1H0Q=
-google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
-google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
+golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gorm.io/driver/mysql v1.5.7 h1:MndhOPYOfEp2rHKgkZIhJ16eVUIRf2HmzgoPmh7FCWo=
@@ -266,27 +377,27 @@ gorm.io/driver/postgres v1.5.11/go.mod h1:DX3GReXH+3FPWGrrgffdvCk3DQ1dwDPdmbenSk
 gorm.io/gorm v1.25.7/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
 gorm.io/gorm v1.25.12 h1:I0u8i2hWQItBq1WfE0o2+WuL9+8L21K9e2HHSTE/0f8=
 gorm.io/gorm v1.25.12/go.mod h1:xh7N7RHfYlNc5EmcI/El95gXusucDrQnHXe0+CgWcLQ=
-modernc.org/cc/v4 v4.23.1 h1:WqJoPL3x4cUufQVHkXpXX7ThFJ1C4ik80i2eXEXbhD8=
-modernc.org/cc/v4 v4.23.1/go.mod h1:HM7VJTZbUCR3rV8EYBi9wxnJ0ZBRiGE5OeGXNA0IsLQ=
-modernc.org/ccgo/v4 v4.22.3 h1:C7AW89Zw3kygesTQWBzApwIn9ldM+cb/plrTIKq41Os=
-modernc.org/ccgo/v4 v4.22.3/go.mod h1:Dz7n0/UkBbH3pnYaxgi1mFSfF4REqUOZNziphZASx6k=
+modernc.org/cc/v4 v4.25.2 h1:T2oH7sZdGvTaie0BRNFbIYsabzCxUQg8nLqCdQ2i0ic=
+modernc.org/cc/v4 v4.25.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.25.1 h1:TFSzPrAGmDsdnhT9X2UrcPMI3N/mJ9/X9ykKXwLhDsU=
+modernc.org/ccgo/v4 v4.25.1/go.mod h1:njjuAYiPflywOOrm3B7kCB444ONP5pAVr8PIEoE0uDw=
 modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
 modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
-modernc.org/gc/v2 v2.5.0 h1:bJ9ChznK1L1mUtAQtxi0wi5AtAs5jQuw4PrPHO5pb6M=
-modernc.org/gc/v2 v2.5.0/go.mod h1:wzN5dK1AzVGoH6XOzc3YZ+ey/jPgYHLuVckd62P0GYU=
-modernc.org/libc v1.61.2 h1:dkO4DlowfClcJYsvf/RiK6fUwvzCQTmB34bJLt0CAGQ=
-modernc.org/libc v1.61.2/go.mod h1:4QGjNyX3h+rn7V5oHpJY2yH0QN6frt1X+5BkXzwLPCo=
-modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
-modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
-modernc.org/memory v1.8.0 h1:IqGTL6eFMaDZZhEWwcREgeMXYwmW83LYW8cROZYkg+E=
-modernc.org/memory v1.8.0/go.mod h1:XPZ936zp5OMKGWPqbD3JShgd/ZoQ7899TUuQqxY+peU=
-modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
-modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sortutil v1.2.0 h1:jQiD3PfS2REGJNzNCMMaLSp/wdMNieTbKX920Cqdgqc=
-modernc.org/sortutil v1.2.0/go.mod h1:TKU2s7kJMf1AE84OoiGppNHJwvB753OYfNl2WRb++Ss=
-modernc.org/sqlite v1.34.1 h1:u3Yi6M0N8t9yKRDwhXcyp1eS5/ErhPTBggxWFuR6Hfk=
-modernc.org/sqlite v1.34.1/go.mod h1:pXV2xHxhzXZsgT/RtTFAPY6JJDEvOTcTdwADQCCWD4k=
-modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
-modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/libc v1.62.1 h1:s0+fv5E3FymN8eJVmnk0llBe6rOxCu/DEU+XygRbS8s=
+modernc.org/libc v1.62.1/go.mod h1:iXhATfJQLjG3NWy56a6WVU73lWOcdYVxsvwCgoPljuo=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.9.1 h1:V/Z1solwAVmMW1yttq3nDdZPJqV1rM05Ccq6KMSZ34g=
+modernc.org/memory v1.9.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
+modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
--- a/helm/opengist/.helmignore
+++ b/helm/opengist/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
--- a/helm/opengist/Chart.lock
+++ b/helm/opengist/Chart.lock
@@ -0,0 +1,9 @@
+dependencies:
+- name: postgresql
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 16.7.27
+- name: meilisearch
+  repository: https://meilisearch.github.io/meilisearch-kubernetes
+  version: 0.17.1
+digest: sha256:ad702e35f258fed1f804d3e48b071767499f5730e099a8c461610950e5182368
+generated: "2025-09-21T04:49:08.679554149+02:00"
--- a/helm/opengist/Chart.yaml
+++ b/helm/opengist/Chart.yaml
@@ -0,0 +1,19 @@
+apiVersion: v2
+name: opengist
+description: Opengist Helm chart for Kubernetes
+type: application
+version: 0.3.0
+appVersion: 1.11.0
+home: https://opengist.io
+icon: https://raw.githubusercontent.com/thomiceli/opengist/master/public/opengist.svg
+sources:
+  - https://github.com/thomiceli/opengist
+dependencies:
+  - name: postgresql
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 16.7.27
+    condition: postgresql.enabled
+  - name: meilisearch
+    repository: https://meilisearch.github.io/meilisearch-kubernetes
+    version: 0.17.1
+    condition: meilisearch.enabled
--- a/helm/opengist/README.md
+++ b/helm/opengist/README.md
@@ -0,0 +1,81 @@
+# Opengist Helm Chart
+
+![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![AppVersion: 1.11.0](https://img.shields.io/badge/AppVersion-1.11.0-informational?style=flat-square)
+
+Opengist Helm chart for Kubernetes.
+
+* [Install](#install)
+* [Configuration](#configuration)
+* [Dependencies](#dependencies)
+  * [Meilisearch Indexer](#meilisearch-indexer)
+  * [PostgreSQL Database](#postgresql-database)
+
+## Install
+
+```bash
+helm repo add opengist https://helm.opengist.io
+ 
+helm install opengist opengist/opengist
+```
+
+## Configuration
+
+This part explains how to configure the Opengist instance using the Helm chart. The `config.yml` file used by Opengist
+is mounted from a Kubernetes Secret with a key `config.yml` and the values formatted as YAML.
+
+### Using values
+
+Using Helm values, you can define the values from a key name `config`
+
+```yaml
+config:
+  log-level: "warn"
+  log-output: "stdout"
+```
+
+This will create a Kubernetes secret named `opengist` mounted to the pod as a file with the YAML content of the secret,
+used by Opengist.
+
+### Using an existing secret
+
+If you wish to not store sensitive data in your Helm values, you can create a Kubernetes secret with a key `config.yml`
+and values formatted as YAML. You can then reference this secret in the Helm chart with the `configExistingSecret` key.
+
+If defined, this existing secret will be used instead of creating a new one.
+
+```yaml
+configExistingSecret: <name of the secret>
+```
+
+## Dependencies
+
+### Meilisearch Indexer
+
+By default, Opengist uses the `bleve` indexer. **It is NOT available** if there is multiple replicas of the opengist pod (only one pod can open the index at the same time).
+
+Instead, for multiple replicas setups, you **MUST** use the `meilisearch` indexer.
+
+By setting `meilisearch.enabled: true`, the [Meilisearch chart](https://github.com/meilisearch/meilisearch-kubernetes) will be deployed aswell. 
+You must define the `meilisearch.host` (Kubernetes Service) and `meilisearch.key` (value created by Meilisearch) values to connect to the Meilisearch instance in your Opengist config :
+
+```yaml
+index: meilisearch
+index.meili.host: http://opengist-meilisearch:7700 # pointing to the K8S Service
+index.meili.api-key: MASTER_KEY                    # generated by Meilisearch
+```
+
+If you want to use the `bleve` indexer, you need to set the `replicas` to `1`.
+
+### PostgreSQL Database
+
+By default, Opengist uses the `sqlite` database. If needed, this chart also deploys a PostgreSQL instance.
+
+By setting `postgresql.enabled: true`, the [Bitnami PostgreSQL chart](https://github.com/bitnami/charts/tree/main/bitnami/postgresql) will be deployed aswell.
+You must define the `postgresql.host`, `postgresql.port`, `postgresql.database`, `postgresql.username` and `postgresql.password` values to connect to the PostgreSQL instance.
+
+Then define the connection string in your Opengist config:
+
+```yaml
+db-uri: postgres://user:password@opengist-postgresql:5432/opengist
+```
+Note: `opengist-postgresql` is the name of the K8S Service deployed by this chart.
--- a/helm/opengist/templates/NOTES.txt
+++ b/helm/opengist/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.http.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "opengist.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.http.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "opengist.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "opengist.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.http.port }}
+{{- else if contains "ClusterIP" .Values.service.http.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "opengist.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
--- a/helm/opengist/templates/_helpers.tpl
+++ b/helm/opengist/templates/_helpers.tpl
@@ -0,0 +1,85 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "opengist.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "opengist.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "opengist.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "opengist.labels" -}}
+helm.sh/chart: {{ include "opengist.chart" . }}
+app: {{ include "opengist.name" . }}
+{{ include "opengist.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "opengist.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "opengist.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "opengist.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "opengist.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create image URI
+*/}}
+{{- define "opengist.image" -}}
+{{- if .Values.image.digest -}}
+{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
+{{- else -}}
+{{- printf "%s:%s" .Values.image.repository (.Values.image.tag | default .Chart.AppVersion) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create secret name
+*/}}
+{{- define "opengist.secretName" -}}
+{{- if .Values.configExistingSecret -}}
+{{- printf "%s" (tpl .Values.configExistingSecret $) -}}
+{{- else -}}
+{{- printf "%s" (include "opengist.fullname" .) -}}
+{{- end -}}
+{{- end -}}
--- a/helm/opengist/templates/deployment.yaml
+++ b/helm/opengist/templates/deployment.yaml
@@ -0,0 +1,122 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "opengist.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+    {{- if .Values.deployment.labels }}
+    {{- toYaml .Values.deployment.labels | nindent 4 }}
+    {{- end }}
+  {{- with .Values.deployment.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "opengist.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "opengist.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- if .Values.deployment.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "opengist.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+        - name: init-config
+          image: busybox:1.37
+          imagePullPolicy: IfNotPresent
+          command: ['sh', '-c', 'cp /init/config/config.yml /config-volume/config.yml']
+          volumeMounts:
+            - name: config-secret
+              mountPath: /init/config
+            - name: config-volume
+              mountPath: /config-volume
+          {{- if .Values.deployment.env }}
+          env:
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+          {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.http.port }}
+              protocol: TCP
+          {{- if .Values.livenessProbe.enabled }}
+          livenessProbe:
+            {{- toYaml (omit .Values.livenessProbe "enabled") | nindent 12 }}
+            httpGet:
+              port: http
+              path: /healthcheck
+          {{- end }}
+          {{- if .Values.readinessProbe.enabled }}
+          readinessProbe:
+            {{- toYaml (omit .Values.readinessProbe "enabled") | nindent 12 }}
+            httpGet:
+              port: http
+              path: /healthcheck
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: config-volume
+              mountPath: /config.yml
+              subPath: config.yml
+            - name: opengist-data
+              mountPath: /opengist
+          {{- if gt (len .Values.extraVolumeMounts) 0 }}
+            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: opengist-data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ include "opengist.fullname" . }}-data
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        - name: config-secret
+          secret:
+            secretName: {{ include "opengist.secretName" . }}
+            defaultMode: 511
+        - name: config-volume
+          emptyDir: {}
+      {{- if gt (len .Values.extraVolumes) 0 }}
+        {{- toYaml .Values.extraVolumes | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
--- a/helm/opengist/templates/hpa.yaml
+++ b/helm/opengist/templates/hpa.yaml
@@ -0,0 +1,37 @@
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "opengist.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+  {{- with .Values.autoscaling.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "opengist.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}
--- a/helm/opengist/templates/ingress.yaml
+++ b/helm/opengist/templates/ingress.yaml
@@ -0,0 +1,47 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "opengist.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+    {{- if .Values.ingress.labels }}
+    {{- toYaml .Values.service.http.labels  | nindent 4 }}
+    {{- end }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- with .pathType }}
+            pathType: {{ . }}
+            {{- end }}
+            backend:
+              service:
+                name: {{ include "opengist.fullname" $ }}-http
+                port:
+                  number: {{ $.Values.service.http.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}
--- a/helm/opengist/templates/pdb.yaml
+++ b/helm/opengist/templates/pdb.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.podDisruptionBudget -}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "opengist.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "opengist.selectorLabels" . | nindent 6 }}
+  {{- toYaml .Values.podDisruptionBudget | nindent 2 }}
+{{- end -}}
--- a/helm/opengist/templates/pvc.yaml
+++ b/helm/opengist/templates/pvc.yaml
@@ -0,0 +1,28 @@
+{{- if .Values.persistence.enabled }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ include "opengist.fullname" . }}-data
+  namespace: {{ .Release.Namespace }}
+{{- with .Values.persistence.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+    {{- if .Values.persistence.labels }}
+    {{- toYaml .Values.persistence.labels | nindent 4 }}
+    {{- end }}
+spec:
+  accessModes:
+  {{- if gt .Values.replicaCount 1.0 }}
+    - ReadWriteMany
+  {{- else }}
+    {{- .Values.persistence.accessModes | toYaml | nindent 4 }}
+  {{- end }}
+  volumeMode: Filesystem
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}
--- a/helm/opengist/templates/secret.yaml
+++ b/helm/opengist/templates/secret.yaml
@@ -0,0 +1,13 @@
+{{- if (not .Values.configExistingSecret) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "opengist.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+{{ include "opengist.labels" . | indent 4 }}
+type: Opaque
+stringData:
+  config.yml: |-
+    {{- .Values.config | toYaml | nindent 4 }}
+{{- end }}
--- a/helm/opengist/templates/serviceaccount.yaml
+++ b/helm/opengist/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "opengist.serviceAccountName" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
--- a/helm/opengist/templates/svc-http.yaml
+++ b/helm/opengist/templates/svc-http.yaml
@@ -0,0 +1,47 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opengist.fullname" . }}-http
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+    {{- if .Values.service.http.labels }}
+    {{- toYaml .Values.service.http.labels  | nindent 4 }}
+    {{- end }}
+  {{- with .Values.service.http.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+
+spec:
+  type: {{ .Values.service.http.type }}
+  {{- if eq .Values.service.http.type "LoadBalancer" }}
+  {{- if and .Values.service.http.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.service.http.loadBalancerIP  }}
+  {{- end }}
+  {{- if .Values.service.http.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+  {{- range .Values.service.http.loadBalancerSourceRanges }}
+    - {{ . }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.service.http.externalIPs }}
+  externalIPs:
+    {{- toYaml .Values.service.http.externalIPs | nindent 4 }}
+  {{- end }}
+  {{- if .Values.service.http.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ .Values.service.http.externalTrafficPolicy }}
+  {{- end }}
+  {{- if and .Values.service.http.clusterIP (eq .Values.service.http.type "ClusterIP") }}
+  clusterIP: {{ .Values.service.http.clusterIP }}
+  {{- end }}
+  ports:
+    - name: http
+      port: {{ .Values.service.http.port }}
+    {{- if  .Values.service.http.nodePort }}
+      nodePort: {{ .Values.service.http.nodePort }}
+    {{- end }}
+      targetPort: {{ index .Values.config "http.port" }}
+  selector:
+    {{- include "opengist.selectorLabels" . | nindent 4 }}
--- a/helm/opengist/templates/svc-ssh.yaml
+++ b/helm/opengist/templates/svc-ssh.yaml
@@ -0,0 +1,64 @@
+{{- if .Values.service.ssh.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "opengist.fullname" . }}-ssh
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+    {{- if .Values.service.ssh.labels }}
+    {{- toYaml .Values.service.ssh.labels  | nindent 4 }}
+    {{- end }}
+  {{- with .Values.service.http.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.ssh.type }}
+  {{- if eq .Values.service.ssh.type "LoadBalancer" }}
+  {{- if .Values.service.ssh.loadBalancerClass }}
+  loadBalancerClass: {{ .Values.service.ssh.loadBalancerClass }}
+  {{- end }}
+  {{- if .Values.service.ssh.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.service.ssh.loadBalancerIP }}
+  {{- end -}}
+  {{- if .Values.service.ssh.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+  {{- range .Values.service.ssh.loadBalancerSourceRanges }}
+    - {{ . }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+  {{- if and .Values.service.ssh.clusterIP (eq .Values.service.ssh.type "ClusterIP") }}
+  clusterIP: {{ .Values.service.ssh.clusterIP }}
+  {{- end }}
+  {{- if .Values.service.ssh.externalIPs }}
+  externalIPs:
+    {{- toYaml .Values.service.ssh.externalIPs | nindent 4 }}
+  {{- end }}
+  {{- if .Values.service.ssh.ipFamilyPolicy }}
+  ipFamilyPolicy: {{ .Values.service.ssh.ipFamilyPolicy }}
+  {{- end }}
+  {{- with .Values.service.ssh.ipFamilies }}
+  ipFamilies:
+  {{- toYaml . | nindent 4 }}
+  {{- end -}}
+  {{- if .Values.service.ssh.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ .Values.service.ssh.externalTrafficPolicy }}
+  {{- end }}
+  ports:
+    - name: ssh
+      port: {{ .Values.service.ssh.port }}
+      {{- if .Values.service.ssh.nodePort }}
+      nodePort: {{ .Values.service.ssh.nodePort }}
+      {{- end }}
+      {{- if index .Values.config "ssh.port" }}
+      targetPort: {{ index .Values.config "ssh.port" }}
+      {{- else }}
+      targetPort: 2222
+      {{- end }}
+      protocol: TCP
+
+  selector:
+    {{- include "opengist.selectorLabels" . | nindent 4 }}
+{{- end }}
--- a/helm/opengist/templates/tests/test-connection.yaml
+++ b/helm/opengist/templates/tests/test-connection.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "opengist.fullname" . }}-test-connection"
+  labels:
+    {{- include "opengist.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "opengist.fullname" . }}:{{ .Values.service.port }}']
+  restartPolicy: Never
--- a/helm/opengist/values.yaml
+++ b/helm/opengist/values.yaml
@@ -0,0 +1,201 @@
+## Kubernetes workload configuration for Opengist
+nameOverride: ""
+fullnameOverride: ""
+namespace: ""
+
+## Opengist YAML Application Config. See more at https://opengist.io/docs/configuration/cheat-sheet.html
+## This will create a Kubernetes secret with the key `config.yml` containing the YAML configuration mounted in the pod.
+config:
+  log-level: "warn"
+  log-output: "stdout"
+
+## If defined, the existing secret will be used instead of creating a new one.
+## The secret must contain a key named `config.yml` with the YAML configuration.
+configExistingSecret: ""
+
+## Define the image repository and tag to use.
+image:
+  repository: ghcr.io/thomiceli/opengist
+  pullPolicy: Always
+  tag: "1.10.0"
+  digest: ""
+imagePullSecrets: []
+# - name: "image-pull-secret"
+
+## Define the deployment replica count
+replicaCount: 1
+
+## Define the deployment strategy type
+strategy:
+  type: "RollingUpdate"
+  rollingUpdate:
+    maxSurge: "100%"
+    maxUnavailable: 0
+
+## Security Context settings
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+podSecurityContext:
+  fsGroup: 1000
+securityContext: {}
+# allowPrivilegeEscalation: false
+
+## Pod Disruption Budget settings
+## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+podDisruptionBudget: {}
+#  maxUnavailable: 1
+#  minAvailable: 1
+
+## Set the Kubernetes service type
+## ref: https://kubernetes.io/docs/concepts/services-networking/service/
+service:
+  http:
+    type: ClusterIP
+    clusterIP:
+    port: 6157
+    nodePort:
+    loadBalancerIP:
+    externalIPs: []
+    labels: {}
+    annotations: {}
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy:
+
+  ssh:
+    enabled: true
+    type: ClusterIP
+    clusterIP:
+    port: 2222
+    nodePort:
+    loadBalancerIP:
+    externalIPs: []
+    labels: {}
+    annotations: {}
+    loadBalancerSourceRanges: []
+    externalTrafficPolicy:
+
+## HTTP Ingress for Opengist
+## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
+ingress:
+  enabled: false
+  className: ""
+  labels: {}
+    # node-role.kubernetes.io/ingress: platform
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+  hosts:
+    - host: opengist.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+    # - secretName: opengist-tls
+    #   hosts:
+    #     - opengist.example.com
+
+## Service Account for Opengist pods
+## ref: https://kubernetes.io/docs/concepts/security/service-accounts/
+serviceAccount:
+  create: true
+  annotations: {}
+  name: ""
+
+## Set persistence using a Persistent Volume Claim
+## If more than 2 replicas are set, the access mode must be ReadWriteMany
+## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
+persistence:
+  enabled: true
+  existingClaim: ""
+  storageClass: ""
+  labels: {}
+  annotations:
+    helm.sh/resource-policy: keep
+  size: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  subPath: ""
+
+extraVolumes: []
+extraVolumeMounts: []
+
+## Additional pod labels and annotations
+podLabels: {}
+podAnnotations: {}
+
+## Configure resource requests and limits
+## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+resources: {}
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+
+## Configure the liveness and readiness probes
+## ref: https://kubernetes.io/docs/concepts/configuration/liveness-readiness-startup-probes/
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 200
+  timeoutSeconds: 1
+  periodSeconds: 10
+  successThreshold: 1
+  failureThreshold: 5
+
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 5
+  timeoutSeconds: 1
+  periodSeconds: 10
+  successThreshold: 1
+  failureThreshold: 3
+
+## Define autoscaling configuration using Horizontal Pod Autoscaler
+## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 10
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+  annotations: {}
+
+## Additional deployment configuration
+deployment:
+  env: []
+  terminationGracePeriodSeconds: 60
+  labels: {}
+  annotations: {}
+
+## Set pod assignment with node labels
+## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+## Use PostgreSQL as a database, using Bitnami's PostgreSQL Helm chart
+## ref: https://artifacthub.io/packages/helm/bitnami/postgresql/16.5.6
+postgresql:
+  enabled: false
+  global:
+    postgresql:
+      auth:
+        username: opengist
+        password: opengist
+        database: opengist
+      service:
+        ports:
+          postgresql: 5432
+  primary:
+    persistence:
+      size: 10Gi
+
+
+## Use Meilisearch as a code indexer, using Meilisearch's Helm chart
+## ref: https://github.com/meilisearch/meilisearch-kubernetes/tree/meilisearch-0.12.0
+meilisearch:
+  enabled: false
+  environment:
+    MEILI_ENV: "production"
+  auth:
+    existingMasterKeySecret:
--- a/internal/auth/ldap/ldap.go
+++ b/internal/auth/ldap/ldap.go
@@ -0,0 +1,64 @@
+package ldap
+
+import (
+	"fmt"
+	"github.com/go-ldap/ldap/v3"
+	"github.com/thomiceli/opengist/internal/config"
+)
+
+func Enabled() bool {
+	return config.C.LDAPUrl != ""
+}
+
+// Authenticate attempts to authenticate a user against the configured LDAP instance.
+func Authenticate(username, password string) (bool, error) {
+	l, err := ldap.DialURL(config.C.LDAPUrl)
+	if err != nil {
+		return false, fmt.Errorf("unable to connect to URI: %v", config.C.LDAPUrl)
+	}
+	defer func(l *ldap.Conn) {
+		_ = l.Close()
+	}(l)
+
+	// First bind with a read only user
+	err = l.Bind(config.C.LDAPBindDn, config.C.LDAPBindCredentials)
+	if err != nil {
+		return false, err
+	}
+
+	searchFilter := fmt.Sprintf(config.C.LDAPSearchFilter, username)
+	searchRequest := ldap.NewSearchRequest(
+		config.C.LDAPSearchBase,
+		ldap.ScopeWholeSubtree,
+		ldap.NeverDerefAliases,
+		0,
+		0,
+		false,
+		searchFilter,
+		[]string{"dn"},
+		nil,
+	)
+
+	sr, err := l.Search(searchRequest)
+	if err != nil {
+		return false, err
+	}
+
+	if len(sr.Entries) != 1 {
+		return false, nil
+	}
+
+	// Bind as the user to verify their password
+	err = l.Bind(sr.Entries[0].DN, password)
+	if err != nil {
+		return false, nil
+	}
+
+	// Rebind as the read only user for any further queries
+	err = l.Bind(config.C.LDAPBindDn, config.C.LDAPBindCredentials)
+	if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
--- a/internal/auth/oauth/gitlab.go
+++ b/internal/auth/oauth/gitlab.go
@@ -2,13 +2,17 @@ package oauth

 import (
 	gocontext "context"
+	gojson "encoding/json"
+	"io"
+	"net/http"
+
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/gothic"
 	"github.com/markbates/goth/providers/gitlab"
+	"github.com/rs/zerolog/log"
 	"github.com/thomiceli/opengist/internal/config"
 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/web/context"
-	"net/http"
 )

 type GitLabProvider struct {
@@ -77,7 +81,34 @@ func (p *GitLabCallbackProvider) GetProviderUserSSHKeys() ([]string, error) {

 func (p *GitLabCallbackProvider) UpdateUserDB(user *db.User) {
 	user.GitlabID = p.User.UserID
-	user.AvatarURL = urlJoin(config.C.GitlabUrl, "/uploads/-/system/user/avatar/", p.User.UserID, "/avatar.png") + "?width=400"
+
+	resp, err := http.Get(urlJoin(config.C.GitlabUrl, "/api/v4/avatar?size=400&email=", p.User.Email))
+	if err != nil {
+		log.Error().Err(err).Msg("Cannot get user avatar from GitLab")
+		return
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		log.Error().Err(err).Msg("Cannot read Gitlab response body")
+		return
+	}
+
+	var result map[string]interface{}
+	err = gojson.Unmarshal(body, &result)
+	if err != nil {
+		log.Error().Err(err).Msg("Cannot unmarshal Gitlab response body")
+		return
+	}
+
+	field, ok := result["avatar_url"]
+	if !ok {
+		log.Error().Msg("Field 'avatar_url' not found in Gitlab JSON response")
+		return
+	}
+
+	user.AvatarURL = field.(string)
 }

 func NewGitLabCallbackProvider(user *goth.User) CallbackProvider {
--- a/internal/auth/oauth/openid.go
+++ b/internal/auth/oauth/openid.go
@@ -25,6 +25,7 @@ func (p *OIDCProvider) RegisterProvider() error {
 		"openid",
 		"email",
 		"profile",
+		config.C.OIDCGroupClaimName,
 	)

 	if err != nil {
--- a/internal/auth/password/argon2id.go
+++ b/internal/auth/password/argon2id.go
@@ -1,4 +1,4 @@
-package auth
+package password

 import (
 	"crypto/rand"
@@ -6,8 +6,9 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"golang.org/x/crypto/argon2"
 	"strings"
+
+	"golang.org/x/crypto/argon2"
 )

 type argon2ID struct {
--- a/internal/auth/password/password.go
+++ b/internal/auth/password/password.go
@@ -1,11 +1,9 @@
 package password

-import "github.com/thomiceli/opengist/internal/auth"
-
 func HashPassword(code string) (string, error) {
-	return auth.Argon2id.Hash(code)
+	return Argon2id.Hash(code)
 }

 func VerifyPassword(code, hashedCode string) (bool, error) {
-	return auth.Argon2id.Verify(code, hashedCode)
+	return Argon2id.Verify(code, hashedCode)
 }
--- a/internal/auth/totp/aes.go
+++ b/internal/auth/totp/aes.go
@@ -1,4 +1,4 @@
-package auth
+package totp

 import (
 	"crypto/aes"
--- a/internal/auth/try_login.go
+++ b/internal/auth/try_login.go
@@ -0,0 +1,83 @@
+package auth
+
+import (
+	"errors"
+
+	"github.com/rs/zerolog/log"
+	"github.com/thomiceli/opengist/internal/auth/ldap"
+	passwordpkg "github.com/thomiceli/opengist/internal/auth/password"
+	"github.com/thomiceli/opengist/internal/db"
+	"gorm.io/gorm"
+)
+
+type AuthError struct {
+	message string
+}
+
+func (e AuthError) Error() string {
+	return e.message
+}
+
+func TryAuthentication(username, password string) (*db.User, error) {
+	user, err := db.GetUserByUsername(username)
+	if err != nil {
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			log.Error().Err(err).Msgf("Cannot get user by username %s", username)
+			return nil, err
+		}
+	}
+
+	if user.Password != "" {
+		return tryDbLogin(user, password)
+	} else {
+		if ldap.Enabled() {
+			return tryLdapLogin(username, password)
+		}
+		return nil, AuthError{"no authentication method available"}
+	}
+}
+
+func tryDbLogin(user *db.User, password string) (*db.User, error) {
+	if ok, err := passwordpkg.VerifyPassword(password, user.Password); !ok {
+		if err != nil {
+			log.Error().Err(err).Msg("Password verification failed")
+			return nil, err
+		}
+		return nil, AuthError{"invalid password"}
+	}
+
+	return user, nil
+}
+
+func tryLdapLogin(username, password string) (user *db.User, err error) {
+	ok, err := ldap.Authenticate(username, password)
+	if err != nil {
+		log.Error().Err(err).Msg("LDAP authentication failed")
+		return nil, err
+	}
+
+	if !ok {
+		return nil, AuthError{"invalid LDAP credentials"}
+	}
+
+	if user, err = db.GetUserByUsername(username); err != nil {
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			log.Error().Err(err).Msgf("Cannot get user by username %s", username)
+			return nil, err
+		}
+	}
+
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		user = &db.User{
+			Username: username,
+		}
+		if err = user.Create(); err != nil {
+			log.Warn().Err(err).Msg("Cannot create user after LDAP authentication")
+			return nil, err
+		}
+
+		return user, nil
+	}
+
+	return user, nil
+}
--- a/internal/cli/main.go
+++ b/internal/cli/main.go
@@ -36,11 +36,12 @@ var CmdStart = cli.Command{

 		Initialize(ctx)

-		go server.NewServer(os.Getenv("OG_DEV") == "1", path.Join(config.GetHomeDir(), "sessions"), false).Start()
+		server := server.NewServer(os.Getenv("OG_DEV") == "1", path.Join(config.GetHomeDir(), "sessions"), false)
+		go server.Start()
 		go ssh.Start()

 		<-stopCtx.Done()
-		shutdown()
+		shutdown(server)
 		return nil
 	},
 }
@@ -124,23 +125,25 @@ func Initialize(ctx *cli.Context) {
 		log.Error().Err(err).Msg("Failed to initialize WebAuthn")
 	}

-	if config.C.IndexEnabled {
-		log.Info().Msg("Index directory: " + filepath.Join(homePath, config.C.IndexDirname))
-		index.Init(filepath.Join(homePath, config.C.IndexDirname))
+	index.DepreactionIndexDirname()
+	if index.IndexEnabled() {
+		go index.NewIndexer(index.IndexType())
 	}
 }

-func shutdown() {
+func shutdown(server *server.Server) {
 	log.Info().Msg("Shutting down database...")
 	if err := db.Close(); err != nil {
 		log.Error().Err(err).Msg("Failed to close database")
 	}

-	if config.C.IndexEnabled {
+	if index.IndexEnabled() {
 		log.Info().Msg("Shutting down index...")
 		index.Close()
 	}

+	server.Stop()
+
 	log.Info().Msg("Shutdown complete")
 }

--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -37,8 +37,11 @@ type config struct {
 	DBUri      string `yaml:"db-uri" env:"OG_DB_URI"`
 	DBFilename string `yaml:"db-filename" env:"OG_DB_FILENAME"` // deprecated

-	IndexEnabled bool   `yaml:"index.enabled" env:"OG_INDEX_ENABLED"`
-	IndexDirname string `yaml:"index.dirname" env:"OG_INDEX_DIRNAME"`
+	IndexEnabled bool   `yaml:"index.enabled" env:"OG_INDEX_ENABLED"` // deprecated
+	Index        string `yaml:"index" env:"OG_INDEX"`
+	BleveDirname string `yaml:"index.dirname" env:"OG_INDEX_DIRNAME"` // deprecated
+	MeiliHost    string `yaml:"index.meili.host" env:"OG_MEILI_HOST"`
+	MeiliAPIKey  string `yaml:"index.meili.api-key" env:"OG_MEILI_API_KEY"`

 	GitDefaultBranch string `yaml:"git.default-branch" env:"OG_GIT_DEFAULT_BRANCH"`

@@ -48,6 +51,8 @@ type config struct {
 	HttpPort string `yaml:"http.port" env:"OG_HTTP_PORT"`
 	HttpGit  bool   `yaml:"http.git-enabled" env:"OG_HTTP_GIT_ENABLED"`

+	UnixSocketPermissions string `yaml:"unix-socket-permissions" env:"OG_UNIX_SOCKET_PERMISSIONS"`
+
 	SshGit            bool   `yaml:"ssh.git-enabled" env:"OG_SSH_GIT_ENABLED"`
 	SshHost           string `yaml:"ssh.host" env:"OG_SSH_HOST"`
 	SshPort           string `yaml:"ssh.port" env:"OG_SSH_PORT"`
@@ -67,9 +72,20 @@ type config struct {
 	GiteaUrl       string `yaml:"gitea.url" env:"OG_GITEA_URL"`
 	GiteaName      string `yaml:"gitea.name" env:"OG_GITEA_NAME"`

-	OIDCClientKey    string `yaml:"oidc.client-key" env:"OG_OIDC_CLIENT_KEY"`
-	OIDCSecret       string `yaml:"oidc.secret" env:"OG_OIDC_SECRET"`
-	OIDCDiscoveryUrl string `yaml:"oidc.discovery-url" env:"OG_OIDC_DISCOVERY_URL"`
+	OIDCProviderName   string `yaml:"oidc.provider-name" env:"OG_OIDC_PROVIDER_NAME"`
+	OIDCClientKey      string `yaml:"oidc.client-key" env:"OG_OIDC_CLIENT_KEY"`
+	OIDCSecret         string `yaml:"oidc.secret" env:"OG_OIDC_SECRET"`
+	OIDCDiscoveryUrl   string `yaml:"oidc.discovery-url" env:"OG_OIDC_DISCOVERY_URL"`
+	OIDCGroupClaimName string `yaml:"oidc.group-claim-name" env:"OG_OIDC_GROUP_CLAIM_NAME"`
+	OIDCAdminGroup     string `yaml:"oidc.admin-group" env:"OG_OIDC_ADMIN_GROUP"`
+
+	MetricsEnabled bool `yaml:"metrics.enabled" env:"OG_METRICS_ENABLED"`
+
+	LDAPUrl             string `yaml:"ldap.url" env:"OG_LDAP_URL"`
+	LDAPBindDn          string `yaml:"ldap.bind-dn" env:"OG_LDAP_BIND_DN"`
+	LDAPBindCredentials string `yaml:"ldap.bind-credentials" env:"OG_LDAP_BIND_CREDENTIALS"`
+	LDAPSearchBase      string `yaml:"ldap.search-base" env:"OG_LDAP_SEARCH_BASE"`
+	LDAPSearchFilter    string `yaml:"ldap.search-filter" env:"OG_LDAP_SEARCH_FILTER"`

 	CustomName    string       `yaml:"custom.name" env:"OG_CUSTOM_NAME"`
 	CustomLogo    string       `yaml:"custom.logo" env:"OG_CUSTOM_LOGO"`
@@ -91,8 +107,7 @@ func configWithDefaults() (*config, error) {
 	c.LogOutput = "stdout,file"
 	c.OpengistHome = ""
 	c.DBUri = "opengist.db"
-	c.IndexEnabled = true
-	c.IndexDirname = "opengist.index"
+	c.Index = "bleve"

 	c.SqliteJournalMode = "WAL"

@@ -100,6 +115,8 @@ func configWithDefaults() (*config, error) {
 	c.HttpPort = "6157"
 	c.HttpGit = true

+	c.UnixSocketPermissions = "0666"
+
 	c.SshGit = true
 	c.SshHost = "0.0.0.0"
 	c.SshPort = "2222"
@@ -110,6 +127,8 @@ func configWithDefaults() (*config, error) {
 	c.GiteaUrl = "https://gitea.com"
 	c.GiteaName = "Gitea"

+	c.MetricsEnabled = false
+
 	return c, nil
 }

--- a/internal/db/db.go
+++ b/internal/db/db.go
@@ -3,16 +3,17 @@ package db
 import (
 	"errors"
 	"fmt"
-	"github.com/glebarez/sqlite"
-	"gorm.io/driver/mysql"
-	"gorm.io/driver/postgres"
-	"gorm.io/gorm/logger"
 	"net/url"
 	"path/filepath"
 	"slices"
 	"strings"
 	"time"

+	"github.com/glebarez/sqlite"
+	"gorm.io/driver/mysql"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm/logger"
+
 	"github.com/rs/zerolog/log"
 	"github.com/thomiceli/opengist/internal/config"
 	"gorm.io/gorm"
@@ -39,6 +40,7 @@ type databaseInfo struct {
 	User     string
 	Password string
 	Database string
+	SSLMode  string
 }

 var DatabaseInfo *databaseInfo
@@ -46,6 +48,8 @@ var DatabaseInfo *databaseInfo
 func parseDBURI(uri string) (*databaseInfo, error) {
 	info := &databaseInfo{}

+	info.SSLMode = "disable"
+
 	if uri == ":memory:" {
 		info.Type = SQLite
 		info.Database = uri
@@ -85,6 +89,13 @@ func parseDBURI(uri string) (*databaseInfo, error) {
 		info.Password, _ = u.User.Password()
 	}

+	if u.RawQuery != "" {
+		q, _ := url.ParseQuery(u.RawQuery)
+		if sslmode := q.Get("sslmode"); sslmode != "" && info.Type == PostgreSQL {
+			info.SSLMode = sslmode
+		}
+	}
+
 	switch info.Type {
 	case PostgreSQL, MySQL:
 		info.Database = strings.TrimPrefix(u.Path, "/")
@@ -144,7 +155,7 @@ func Setup(dbUri string) error {
 		return err
 	}

-	if err = db.AutoMigrate(&User{}, &Gist{}, &SSHKey{}, &AdminSetting{}, &Invitation{}, &WebAuthnCredential{}, &TOTP{}, &GistTopic{}, &GistLanguage{}); err != nil {
+	if err = db.AutoMigrate(&User{}, &Gist{}, &SSHKey{}, &AdminSetting{}, &Invitation{}, &WebAuthnCredential{}, &TOTP{}, &GistTopic{}, &GistLanguage{}, &GistInitQueue{}); err != nil {
 		return err
 	}

@@ -222,7 +233,7 @@ func setupSQLite(dbInfo databaseInfo) error {

 func setupPostgres(dbInfo databaseInfo) error {
 	var err error
-	dsn := fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=disable", dbInfo.Host, dbInfo.Port, dbInfo.User, dbInfo.Password, dbInfo.Database)
+	dsn := fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=%s", dbInfo.Host, dbInfo.Port, dbInfo.User, dbInfo.Password, dbInfo.Database, dbInfo.SSLMode)

 	db, err = gorm.Open(postgres.Open(dsn), &gorm.Config{
 		Logger:         logger.Default.LogMode(logger.Silent),
@@ -258,5 +269,5 @@ func DeprecationDBFilename() {
 }

 func TruncateDatabase() error {
-	return db.Migrator().DropTable("likes", &User{}, "gists", &SSHKey{}, &AdminSetting{}, &Invitation{}, &WebAuthnCredential{}, &TOTP{}, &GistTopic{}, &GistLanguage{})
+	return db.Migrator().DropTable("likes", &User{}, "gists", &SSHKey{}, &AdminSetting{}, &Invitation{}, &WebAuthnCredential{}, &TOTP{}, &GistTopic{}, &GistLanguage{}, &GistInitQueue{})
 }
--- a/internal/db/gist.go
+++ b/internal/db/gist.go
@@ -1,8 +1,6 @@
 package db

 import (
-	"bytes"
-	"encoding/gob"
 	"fmt"
 	"os/exec"
 	"path/filepath"
@@ -40,6 +38,10 @@ func (v Visibility) String() string {
 	}
 }

+func (v Visibility) Uint() uint {
+	return uint(v)
+}
+
 func (v Visibility) Next() Visibility {
 	switch v {
 	case PublicVisibility:
@@ -416,12 +418,20 @@ func (gist *Gist) Files(revision string, truncate bool) ([]*git.File, error) {

 	var files []*git.File
 	for _, fileCat := range filesCat {
+		var shortContent string
+		if len(fileCat.Content) > 512 {
+			shortContent = fileCat.Content[:512]
+		} else {
+			shortContent = fileCat.Content
+		}
+
 		files = append(files, &git.File{
 			Filename:  fileCat.Name,
 			Size:      fileCat.Size,
 			HumanSize: humanize.IBytes(fileCat.Size),
 			Content:   fileCat.Content,
 			Truncated: fileCat.Truncated,
+			MimeType:  git.DetectMimeType([]byte(shortContent)),
 		})
 	}
 	return files, err
@@ -442,12 +452,20 @@ func (gist *Gist) File(revision string, filename string, truncate bool) (*git.Fi
 		return nil, err
 	}

+	var shortContent string
+	if len(content) > 512 {
+		shortContent = content[:512]
+	} else {
+		shortContent = content
+	}
+
 	return &git.File{
 		Filename:  filename,
 		Size:      size,
 		HumanSize: humanize.IBytes(size),
 		Content:   content,
 		Truncated: truncated,
+		MimeType:  git.DetectMimeType([]byte(shortContent)),
 	}, err
 }

@@ -469,8 +487,14 @@ func (gist *Gist) AddAndCommitFiles(files *[]FileDTO) error {
 	}

 	for _, file := range *files {
-		if err := git.SetFileContent(gist.Uuid, file.Filename, file.Content); err != nil {
-			return err
+		if file.SourcePath != "" { // if it's an uploaded file
+			if err := git.MoveFileToRepository(gist.Uuid, file.Filename, file.SourcePath); err != nil {
+				return err
+			}
+		} else { // else it's a text editor file
+			if err := git.SetFileContent(gist.Uuid, file.Filename, file.Content); err != nil {
+				return err
+			}
 		}
 	}

@@ -528,19 +552,28 @@ func (gist *Gist) UpdatePreviewAndCount(withTimestampUpdate bool) error {
 		gist.Preview = ""
 		gist.PreviewFilename = ""
 	} else {
-		file, err := gist.File("HEAD", filesStr[0], true)
-		if err != nil {
-			return err
-		}
+		for _, fileStr := range filesStr {
+			file, err := gist.File("HEAD", fileStr, true)
+			if err != nil {
+				return err
+			}
+			if file == nil {
+				continue
+			}
+			gist.Preview = ""
+			gist.PreviewFilename = file.Filename

-		split := strings.Split(file.Content, "\n")
-		if len(split) > 10 {
-			gist.Preview = strings.Join(split[:10], "\n")
-		} else {
-			gist.Preview = file.Content
-		}
+			if !file.MimeType.CanBeEdited() {
+				continue
+			}

-		gist.PreviewFilename = file.Filename
+			split := strings.Split(file.Content, "\n")
+			if len(split) > 10 {
+				gist.Preview = strings.Join(split[:10], "\n")
+			} else {
+				gist.Preview = file.Content
+			}
+		}
 	}

 	if withTimestampUpdate {
@@ -609,30 +642,6 @@ func (gist *Gist) TopicsSlice() []string {
 	return topics
 }

-func (gist *Gist) SerialiseInitRepository() error {
-	var gobBuffer bytes.Buffer
-	encoder := gob.NewEncoder(&gobBuffer)
-	if err := encoder.Encode(gist); err != nil {
-		return fmt.Errorf("gob encoding error: %v", err)
-	}
-
-	return git.SerialiseInitRepository(gist.User.Username, gobBuffer.Bytes())
-}
-
-func DeserialiseInitRepository(user string) (*Gist, error) {
-	data, err := git.DeserialiseInitRepository(user)
-	if err != nil {
-		return nil, err
-	}
-
-	var gist Gist
-	decoder := gob.NewDecoder(bytes.NewReader(data))
-	if err := decoder.Decode(&gist); err != nil {
-		return nil, fmt.Errorf("gob decoding error: %v", err)
-	}
-	return &gist, nil
-}
-
 func (gist *Gist) UpdateLanguages() {
 	languages, err := gist.GetLanguagesFromFiles()
 	if err != nil {
@@ -682,10 +691,15 @@ func (gist *Gist) ToDTO() (*GistDTO, error) {

 	fileDTOs := make([]FileDTO, 0, len(files))
 	for _, file := range files {
-		fileDTOs = append(fileDTOs, FileDTO{
+		f := FileDTO{
 			Filename: file.Filename,
-			Content:  file.Content,
-		})
+		}
+		if file.MimeType.CanBeEdited() {
+			f.Content = file.Content
+		} else {
+			f.Binary = true
+		}
+		fileDTOs = append(fileDTOs, f)
 	}

 	return &GistDTO{
@@ -722,8 +736,10 @@ type VisibilityDTO struct {
 }

 type FileDTO struct {
-	Filename string `validate:"excludes=\x2f,excludes=\x5c,max=255"`
-	Content  string `validate:"required"`
+	Filename   string `validate:"excludes=\x2f,excludes=\x5c,max=255"`
+	Content    string
+	Binary     bool
+	SourcePath string // Path to uploaded file, used instead of Content when present
 }

 func (dto *GistDTO) ToGist() *Gist {
@@ -788,6 +804,8 @@ func (gist *Gist) ToIndexedGist() (*index.Gist, error) {

 	indexedGist := &index.Gist{
 		GistID:     gist.ID,
+		UserID:     gist.UserID,
+		Visibility: gist.Private.Uint(),
 		Username:   gist.User.Username,
 		Title:      gist.Title,
 		Content:    wholeContent,
@@ -803,7 +821,7 @@ func (gist *Gist) ToIndexedGist() (*index.Gist, error) {
 }

 func (gist *Gist) AddInIndex() {
-	if !index.Enabled() {
+	if !index.IndexEnabled() {
 		return
 	}

@@ -821,7 +839,7 @@ func (gist *Gist) AddInIndex() {
 }

 func (gist *Gist) RemoveFromIndex() {
-	if !index.Enabled() {
+	if !index.IndexEnabled() {
 		return
 	}

--- a/internal/db/gist_init_queue.go
+++ b/internal/db/gist_init_queue.go
@@ -0,0 +1,34 @@
+package db
+
+type GistInitQueue struct {
+	GistID uint `gorm:"primaryKey"`
+	Gist   Gist `gorm:"constraint:OnUpdate:CASCADE,OnDelete:CASCADE;foreignKey:GistID"`
+	UserID uint `gorm:"primaryKey"`
+	User   User `gorm:"constraint:OnUpdate:CASCADE,OnDelete:CASCADE;foreignKey:UserID"`
+}
+
+func GetInitGistInQueueForUser(userID uint) (*Gist, error) {
+	queue := new(GistInitQueue)
+	err := db.Preload("Gist").Preload("Gist.User").
+		Where("user_id = ?", userID).
+		Order("gist_id asc").
+		First(&queue).Error
+	if err != nil {
+		return nil, err
+	}
+
+	err = db.Delete(&queue).Error
+	if err != nil {
+		return nil, err
+	}
+
+	return &queue.Gist, nil
+}
+
+func AddInitGistToQueue(gistID uint, userID uint) error {
+	queue := &GistInitQueue{
+		GistID: gistID,
+		UserID: userID,
+	}
+	return db.Create(&queue).Error
+}
--- a/internal/db/totp.go
+++ b/internal/db/totp.go
@@ -6,11 +6,11 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
-	"github.com/thomiceli/opengist/internal/auth"
+	"slices"
+
 	"github.com/thomiceli/opengist/internal/auth/password"
 	ogtotp "github.com/thomiceli/opengist/internal/auth/totp"
 	"github.com/thomiceli/opengist/internal/config"
-	"slices"
 )

 type TOTP struct {
@@ -31,7 +31,7 @@ func GetTOTPByUserID(userID uint) (*TOTP, error) {

 func (totp *TOTP) StoreSecret(secret string) error {
 	secretBytes := []byte(secret)
-	encrypted, err := auth.AESEncrypt(config.SecretKey, secretBytes)
+	encrypted, err := ogtotp.AESEncrypt(config.SecretKey, secretBytes)
 	if err != nil {
 		return err
 	}
@@ -46,7 +46,7 @@ func (totp *TOTP) ValidateCode(code string) (bool, error) {
 		return false, err
 	}

-	secretBytes, err := auth.AESDecrypt(config.SecretKey, ciphertext)
+	secretBytes, err := ogtotp.AESDecrypt(config.SecretKey, ciphertext)
 	if err != nil {
 		return false, err
 	}
--- a/internal/db/user.go
+++ b/internal/db/user.go
@@ -1,23 +1,25 @@
 package db

 import (
+	"encoding/json"
 	"github.com/thomiceli/opengist/internal/git"
 	"gorm.io/gorm"
 )

 type User struct {
-	ID        uint   `gorm:"primaryKey"`
-	Username  string `gorm:"uniqueIndex,size:191"`
-	Password  string
-	IsAdmin   bool
-	CreatedAt int64
-	Email     string
-	MD5Hash   string // for gravatar, if no Email is specified, the value is random
-	AvatarURL string
-	GithubID  string
-	GitlabID  string
-	GiteaID   string
-	OIDCID    string `gorm:"column:oidc_id"`
+	ID               uint   `gorm:"primaryKey"`
+	Username         string `gorm:"uniqueIndex,size:191"`
+	Password         string
+	IsAdmin          bool
+	CreatedAt        int64
+	Email            string
+	MD5Hash          string // for gravatar, if no Email is specified, the value is random
+	AvatarURL        string
+	GithubID         string
+	GitlabID         string
+	GiteaID          string
+	OIDCID           string `gorm:"column:oidc_id"`
+	StylePreferences string

 	Gists               []Gist               `gorm:"constraint:OnUpdate:CASCADE,OnDelete:CASCADE;foreignKey:UserID"`
 	SSHKeys             []SSHKey             `gorm:"constraint:OnUpdate:CASCADE,OnDelete:CASCADE;foreignKey:UserID"`
@@ -234,6 +236,15 @@ func (user *User) HasMFA() (bool, bool, error) {
 	return webauthn, totp, err
 }

+func (user *User) GetStyle() *UserStyleDTO {
+	style := new(UserStyleDTO)
+	err := json.Unmarshal([]byte(user.StylePreferences), style)
+	if err != nil {
+		return nil
+	}
+	return style
+}
+
 // -- DTO -- //

 type UserDTO struct {
@@ -251,3 +262,18 @@ func (dto *UserDTO) ToUser() *User {
 type UserUsernameDTO struct {
 	Username string `form:"username" validate:"required,max=24,alphanumdash,notreserved"`
 }
+
+type UserStyleDTO struct {
+	SoftWrap         bool   `form:"softwrap" json:"soft_wrap"`
+	RemovedLineColor string `form:"removedlinecolor" json:"removed_line_color" validate:"min=0,max=7"`
+	AddedLineColor   string `form:"addedlinecolor" json:"added_line_color" validate:"min=0,max=7"`
+	GitLineColor     string `form:"gitlinecolor" json:"git_line_color" validate:"min=0,max=7"`
+}
+
+func (dto *UserStyleDTO) ToJson() string {
+	data, err := json.Marshal(dto)
+	if err != nil {
+		return "{}"
+	}
+	return string(data)
+}
--- a/internal/git/commands.go
+++ b/internal/git/commands.go
@@ -4,7 +4,6 @@ import (
 	"bufio"
 	"bytes"
 	"context"
-	"encoding/base64"
 	"fmt"
 	"io"
 	"net/url"
@@ -203,6 +202,11 @@ func CatFileBatch(user string, gist string, revision string, truncate bool) ([]*
 			return nil, err
 		}

+		// Don't truncate Jupyter notebooks
+		if strings.HasSuffix(file.Name, ".ipynb") {
+			truncate = false
+		}
+
 		sizeToRead := size
 		if truncate && sizeToRead > truncateLimit {
 			sizeToRead = truncateLimit
@@ -381,6 +385,17 @@ func SetFileContent(gistTmpId string, filename string, content string) error {
 	return os.WriteFile(filepath.Join(repositoryPath, filename), []byte(content), 0644)
 }

+func MoveFileToRepository(gistTmpId string, filename string, sourcePath string) error {
+	repositoryPath := TmpRepositoryPath(gistTmpId)
+	destPath := filepath.Join(repositoryPath, filename)
+
+	if err := os.MkdirAll(filepath.Dir(destPath), 0755); err != nil {
+		return err
+	}
+
+	return os.Rename(sourcePath, destPath)
+}
+
 func AddAll(gistTmpId string) error {
 	tmpPath := TmpRepositoryPath(gistTmpId)

@@ -565,50 +580,6 @@ func DeleteUserDirectory(user string) error {
 	return os.RemoveAll(filepath.Join(config.GetHomeDir(), ReposDirectory, user))
 }

-func SerialiseInitRepository(user string, serialized []byte) error {
-	userRepositoryPath := UserRepositoriesPath(user)
-	initPath := filepath.Join(userRepositoryPath, "_init")
-
-	f, err := os.OpenFile(initPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	encodedData := base64.StdEncoding.EncodeToString(serialized)
-	_, err = f.Write(append([]byte(encodedData), '\n'))
-	return err
-}
-
-func DeserialiseInitRepository(user string) ([]byte, error) {
-	initPath := filepath.Join(UserRepositoriesPath(user), "_init")
-
-	content, err := os.ReadFile(initPath)
-	if err != nil {
-		return nil, err
-	}
-
-	idx := bytes.Index(content, []byte{'\n'})
-	if idx == -1 {
-		return base64.StdEncoding.DecodeString(string(content))
-	}
-
-	firstLine := content[:idx]
-	remaining := content[idx+1:]
-
-	if len(remaining) == 0 {
-		if err := os.Remove(initPath); err != nil {
-			return nil, fmt.Errorf("failed to remove file: %v", err)
-		}
-	} else {
-		if err := os.WriteFile(initPath, remaining, 0644); err != nil {
-			return nil, fmt.Errorf("failed to write remaining content: %v", err)
-		}
-	}
-
-	return base64.StdEncoding.DecodeString(string(firstLine))
-}
-
 func createDotGitHookFile(repositoryPath string, hook string, content string) error {
 	preReceiveDst, err := os.OpenFile(filepath.Join(repositoryPath, "hooks", hook), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0744)
 	if err != nil {
@@ -672,7 +643,7 @@ func convertUTF8ToOctal(name string) string {
 }

 func convertURLToOctal(name string) string {
-	decoded, err := url.QueryUnescape(name)
+	decoded, err := url.PathUnescape(name)
 	if err != nil {
 		return name
 	}
--- a/internal/git/mime.go
+++ b/internal/git/mime.go
@@ -0,0 +1,89 @@
+package git
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/gabriel-vasile/mimetype"
+)
+
+type MimeType struct {
+	ContentType string
+}
+
+func (mt MimeType) IsText() bool {
+	return strings.Contains(mt.ContentType, "text/")
+}
+
+func (mt MimeType) IsCSV() bool {
+	return strings.Contains(mt.ContentType, "text/csv")
+}
+
+func (mt MimeType) IsImage() bool {
+	return strings.Contains(mt.ContentType, "image/")
+}
+
+func (mt MimeType) IsSVG() bool {
+	return strings.Contains(mt.ContentType, "image/svg+xml")
+}
+
+func (mt MimeType) IsPDF() bool {
+	return strings.Contains(mt.ContentType, "application/pdf")
+}
+
+func (mt MimeType) IsAudio() bool {
+	return strings.Contains(mt.ContentType, "audio/")
+}
+
+func (mt MimeType) IsVideo() bool {
+	return strings.Contains(mt.ContentType, "video/")
+}
+
+func (mt MimeType) CanBeHighlighted() bool {
+	return mt.IsText() && !mt.IsCSV()
+}
+
+func (mt MimeType) CanBeEmbedded() bool {
+	return mt.IsImage() || mt.IsPDF() || mt.IsAudio() || mt.IsVideo()
+}
+
+func (mt MimeType) CanBeRendered() bool {
+	return mt.IsText() || mt.IsImage() || mt.IsSVG() || mt.IsPDF() || mt.IsAudio() || mt.IsVideo()
+}
+
+func (mt MimeType) CanBeEdited() bool {
+	return mt.IsText() || mt.IsSVG()
+}
+
+func (mt MimeType) RenderType() string {
+	t := strings.Split(mt.ContentType, "/")
+	str := ""
+	if len(t) == 2 {
+		str = fmt.Sprintf("(%s)", strings.ToUpper(t[1]))
+	}
+
+	// More user friendly description
+	if mt.IsImage() || mt.IsSVG() {
+		return fmt.Sprintf("Image %s", str)
+	}
+	if mt.IsAudio() {
+		return fmt.Sprintf("Audio %s", str)
+	}
+	if mt.IsVideo() {
+		return fmt.Sprintf("Video %s", str)
+	}
+	if mt.IsPDF() {
+		return "PDF"
+	}
+	if mt.IsCSV() {
+		return "CSV"
+	}
+	if mt.IsText() {
+		return "Text"
+	}
+	return "Binary"
+}
+
+func DetectMimeType(data []byte) MimeType {
+	return MimeType{mimetype.Detect(data).String()}
+}
--- a/internal/git/output_parser.go
+++ b/internal/git/output_parser.go
@@ -3,27 +3,23 @@ package git
 import (
 	"bufio"
 	"bytes"
-	"encoding/csv"
 	"fmt"
 	"io"
+	"regexp"
 	"strings"
 )

 type File struct {
-	Filename    string `json:"filename"`
-	Size        uint64 `json:"size"`
-	HumanSize   string `json:"human_size"`
-	OldFilename string `json:"-"`
-	Content     string `json:"content"`
-	Truncated   bool   `json:"truncated"`
-	IsCreated   bool   `json:"-"`
-	IsDeleted   bool   `json:"-"`
-}
-
-type CsvFile struct {
-	File
-	Header []string
-	Rows   [][]string
+	Filename    string   `json:"filename"`
+	Size        uint64   `json:"size"`
+	HumanSize   string   `json:"human_size"`
+	OldFilename string   `json:"-"`
+	Content     string   `json:"content"`
+	Truncated   bool     `json:"truncated"`
+	IsCreated   bool     `json:"-"`
+	IsDeleted   bool     `json:"-"`
+	IsBinary    bool     `json:"-"`
+	MimeType    MimeType `json:"-"`
 }

 type Commit struct {
@@ -62,6 +58,8 @@ func truncateCommandOutput(out io.Reader, maxBytes int64) (string, bool, error)
 	return string(buf), truncated, nil
 }

+var reLogBinaryNames = regexp.MustCompile(`Binary files (.+) and (.+) differ`)
+
 // inspired from https://github.com/go-gitea/gitea/blob/main/services/gitdiff/gitdiff.go
 func parseLog(out io.Reader, maxFiles int, maxBytes int) ([]*Commit, error) {
 	var commits []*Commit
@@ -206,6 +204,20 @@ loopLog:
 						currentFile.IsCreated = true
 					case strings.HasPrefix(line, "deleted file"):
 						currentFile.IsDeleted = true
+					case strings.HasPrefix(line, "Binary files"):
+						currentFile.IsBinary = true
+						names := reLogBinaryNames.FindStringSubmatch(line)
+						if names[1][2:] != names[2][2:] {
+							if currentFile.IsCreated {
+								currentFile.Filename = convertOctalToUTF8(names[2])[2:]
+							}
+							if currentFile.IsDeleted {
+								currentFile.Filename = convertOctalToUTF8(names[1])[2:]
+							}
+						} else {
+							currentFile.OldFilename = convertOctalToUTF8(names[1])[2:]
+							currentFile.Filename = convertOctalToUTF8(names[2])[2:]
+						}
 					case strings.HasPrefix(line, "--- "):
 						name := convertOctalToUTF8(line[4 : len(line)-1])
 						if parseRename && currentFile.IsDeleted {
@@ -344,27 +356,3 @@ func skipToNextCommit(input *bufio.Reader) (line string, err error) {
 	}
 	return line, err
 }
-
-func ParseCsv(file *File) (*CsvFile, error) {
-
-	reader := csv.NewReader(strings.NewReader(file.Content))
-	records, err := reader.ReadAll()
-	if err != nil {
-		return nil, err
-	}
-
-	header := records[0]
-	numColumns := len(header)
-
-	for i := 1; i < len(records); i++ {
-		if len(records[i]) != numColumns {
-			return nil, fmt.Errorf("CSV file has invalid row at index %d", i)
-		}
-	}
-
-	return &CsvFile{
-		File:   *file,
-		Header: header,
-		Rows:   records[1:],
-	}, nil
-}
--- a/internal/i18n/locales/de-DE.yml
+++ b/internal/i18n/locales/de-DE.yml
@@ -21,7 +21,7 @@ gist.header.embed: 'Einbetten'
 gist.header.embed-help: 'Bette diese Gist in deine Webseite ein.'
 gist.header.download-zip: 'ZIP Herunterladen'

-gist.raw: 'Orginalformat'
+gist.raw: 'Originalformat'
 gist.file-truncated: 'Diese Datei wurde abgeschnitten.'
 gist.watch-full-file: 'Die gesamte Datei anzeigen.'
 gist.file-not-valid: 'Diese Datei ist keine korrekte CSV Datei.'
@@ -37,7 +37,7 @@ gist.new.indent-mode-space: 'Leerzeichen'
 gist.new.indent-mode-tab: 'Tab'
 gist.new.indent-size: 'Einrückungs Größe'
 gist.new.wrap-mode: 'Textumbruch Modus'
-gist.new.wrap-mode-no: 'kein Textumruch'
+gist.new.wrap-mode-no: 'kein Textumbruch'
 gist.new.wrap-mode-soft: 'weicher Zeilenumbruch'
 gist.new.add-file: 'Datei hinzufügen'
 gist.new.create-public-button: 'Öffentliche Gist erstellen'
@@ -53,7 +53,7 @@ gist.edit.delete: 'Löschen'
 gist.edit.cancel: 'Abbrechen'
 gist.edit.save: 'Speichern'

-gist.list.joined: 'Gemeinsam'
+gist.list.joined: 'Beigetreten'
 gist.list.all: 'Alle Gists'
 gist.list.search-results: 'Suchergebnisse'
 gist.list.sort: 'Sortieren'
@@ -61,17 +61,17 @@ gist.list.sort-by-created: 'erstellt'
 gist.list.sort-by-updated: 'bearbeitet'
 gist.list.order-by-asc: 'Älteste'
 gist.list.order-by-desc: 'Neueste'
-gist.list.select-tab: 'Tab Auswählen'
+gist.list.select-tab: 'Tab auswählen'
 gist.list.liked: 'Favorisiert'
 gist.list.likes: 'Favoriten'
-gist.list.forked: 'Forked'
-gist.list.forked-from: 'Forked von'
+gist.list.forked: 'Geforkt'
+gist.list.forked-from: 'Geforkt von'
 gist.list.forks: 'Forks'
 gist.list.files: 'Dateien'
 gist.list.last-active: 'Zuletzt aktiv'
 gist.list.no-gists: 'Keine Gists'
 gist.list.all-liked-by: 'Alle Gists favorisiert von %s'
-gist.list.all-forked-by: 'Alle Gists geforked von %s'
+gist.list.all-forked-by: 'Alle Gists geforkt von %s'
 gist.list.all-from: 'Alle Gists von %s'

 gist.search.found: 'Gists gefunden'
@@ -89,7 +89,7 @@ gist.forks.for: 'Fork für %s'

 gist.likes: 'Favoriten'
 gist.likes.no: 'Keine Favorisierungen'
-gist.likes.for: 'Favortitisiert für %s'
+gist.likes.for: 'Favorisiert für %s'

 gist.revisions: 'Revisionen'
 gist.revision.revised: 'hat die Gist bearbeitet'
@@ -112,7 +112,7 @@ settings.link-accounts: 'Accounts verlinken'
 settings.link-github-account: 'GitHub-Account verlinken'
 settings.link-gitlab-account: 'GitLab-Account verlinken'
 settings.link-gitea-account: 'Gitea-Account verlinken'
-settings.unlink-github-account: 'Github-Account Verlinkung aufheben'
+settings.unlink-github-account: 'GitHub-Account Verlinkung aufheben'
 settings.unlink-gitlab-account: 'GitLab-Account Verlinkung aufheben'
 settings.unlink-gitea-account: 'Gitea-Account Verlinkung aufheben'
 settings.delete-account: 'Account löschen'
--- a/internal/i18n/locales/en-US.yml
+++ b/internal/i18n/locales/en-US.yml
@@ -23,9 +23,12 @@ gist.header.download-zip: Download ZIP

 gist.raw: Raw
 gist.file-truncated: This file has been truncated.
+gist.file-raw: This file can't be rendered.
+gist.file-binary-edit: This file is binary.
 gist.watch-full-file: View the full file.
 gist.file-not-valid: This file is not a valid CSV file.
 gist.no-content: No files found
+gist.preview-non-available: Preview not available

 gist.new.new_gist: New gist
 gist.new.title: Title
@@ -46,6 +49,8 @@ gist.new.create-private-button: Create private gist
 gist.new.preview: Preview
 gist.new.create-a-new-gist: Create a new gist
 gist.new.topics: Topics (separate with spaces)
+gist.new.drop-files: Drop files here or click to upload
+gist.new.any-file-type: Upload any file type

 gist.edit.editing: Editing
 gist.edit.edit-gist: Edit %s
@@ -115,6 +120,7 @@ gist.revision.file-renamed: renamed to
 gist.revision.diff-truncated: Diff is too large to be shown
 gist.revision.file-renamed-no-changes: File renamed without changes
 gist.revision.empty-file: Empty file
+gist.revision.binary-file-changes: Binary file changes are not shown
 gist.revision.no-changes: No changes
 gist.revision.no-revisions: No revisions to show
 gist.revision-of: Revision of %s
@@ -148,6 +154,17 @@ settings.create-password-help: Create your password to login to Opengist via HTT
 settings.change-password: Change password
 settings.change-password-help: Change your password to login to Opengist via HTTP
 settings.password-label-title: Password
+settings.header.account: Account
+settings.header.mfa: MFA
+settings.header.ssh: SSH
+settings.header.style: Style
+settings.style.gist-code: Gist code
+settings.style.no-soft-wrap: No Soft Wrap
+settings.style.soft-wrap: Soft Wrap
+settings.style.removed-lines-color: Removed lines color
+settings.style.added-lines-color: Added lines color
+settings.style.git-lines-color: Git lines color
+settings.style.save-style: Save style

 auth.signup-disabled: Administrator has disabled signing up
 auth.login: Login
@@ -204,6 +221,8 @@ error.cannot-bind-data: Cannot bind data
 error.invalid-number: Invalid number
 error.invalid-character-unescaped: Invalid character unescaped
 error.not-in-mfa-session: User is not in a MFA session
+error.no-file-uploaded: No file uploaded
+error.cannot-open-file: Cannot open uploaded file

 header.menu.all: All
 header.menu.new: New
--- a/internal/i18n/locales/ja_JP.yml
+++ b/internal/i18n/locales/ja_JP.yml
@@ -0,0 +1,324 @@
+gist.public: '全体に公開'
+gist.unlisted: '限定公開'
+gist.private: '非公開'
+
+gist.header.like: 'いいね'
+gist.header.unlike: 'よくないね'
+gist.header.fork: 'フォーク'
+gist.header.edit: '編集'
+gist.header.delete: '削除'
+gist.header.forked-from: 'フォーク元'
+gist.header.last-active: '最終更新'
+gist.header.select-tab: 'タブを選択'
+gist.header.code: 'コード'
+gist.header.revisions: '修正履歴'
+gist.header.revision: '修正履歴'
+gist.header.clone-http: '%sでクローン'
+gist.header.clone-http-help: 'HTTP BASIC認証によりGitを使ってクローン'
+gist.header.clone-ssh: 'SSHでクローン'
+gist.header.clone-ssh-help: 'SSH鍵認証によりGitを使ってクローン'
+gist.header.embed: '埋め込み'
+gist.header.embed-help: 'gistをWebサイトに埋め込む'
+gist.header.download-zip: 'ZIPでダウンロード'
+
+gist.raw: 'Raw'
+gist.file-truncated: ''
+gist.watch-full-file: 'ファイル全体を見る'
+gist.file-not-valid: '無効なCSVファイルです'
+gist.no-content: 'ファイルがありません'
+
+gist.new.new_gist: '新規gist'
+gist.new.title: 'タイトル'
+gist.new.description: '概要'
+gist.new.url: ''
+gist.new.filename-with-extension: 'ファイル名 (拡張子あり)'
+gist.new.indent-mode: 'インデント'
+gist.new.indent-mode-space: '空白'
+gist.new.indent-mode-tab: 'タブ文字'
+gist.new.indent-size: 'インデントサイズ'
+gist.new.wrap-mode: '折り返し'
+gist.new.wrap-mode-no: 'なし'
+gist.new.wrap-mode-soft: '右端で折り返し'
+gist.new.add-file: 'ファイルを追加'
+gist.new.create-public-button: '公開gistを作成'
+gist.new.create-unlisted-button: '限定公開gistを作成'
+gist.new.create-private-button: '非公開gistを作成'
+gist.new.preview: 'プレビュー'
+gist.new.create-a-new-gist: '新規gistを作成'
+gist.new.topics: 'トピック (スペースで区切り)'
+
+gist.edit.editing: '編集中'
+gist.edit.edit-gist: '編集 %s'
+gist.edit.change-visibility: '作成'
+gist.edit.delete: '削除'
+gist.edit.cancel: ''
+gist.edit.save: ''
+gist.delete.confirm: ''
+
+gist.list.joined: ''
+gist.list.all: ''
+gist.list.search-results: ''
+gist.list.sort: ''
+gist.list.sort-by-created: ''
+gist.list.sort-by-updated: ''
+gist.list.order-by-asc: ''
+gist.list.order-by-desc: ''
+gist.list.select-tab: ''
+gist.list.liked: ''
+gist.list.likes: ''
+gist.list.forked: ''
+gist.list.forked-from: ''
+gist.list.forks: ''
+gist.list.files: ''
+gist.list.last-active: ''
+gist.list.no-gists: ''
+gist.list.all-liked-by: ''
+gist.list.all-forked-by: ''
+gist.list.all-from: ''
+gist.list.topic-results-topic: ''
+gist.list.topic-results: ''
+
+
+gist.search.found: ''
+gist.search.no-results: ''
+gist.search.help.user: ''
+gist.search.help.title: ''
+gist.search.help.filename: ''
+gist.search.help.extension: ''
+gist.search.help.language: ''
+gist.search.help.topic: ''
+gist.search.placeholder.title: ''
+gist.search.placeholder.visibility: ''
+gist.search.placeholder.public: ''
+gist.search.placeholder.unlisted: ''
+gist.search.placeholder.private: ''
+gist.search.placeholder.language: ''
+gist.search.placeholder.all: ''
+gist.search.placeholder.topics: ''
+gist.search.placeholder.search: ''
+
+gist.forks: ''
+gist.forks.view: ''
+gist.forks.no: ''
+gist.forks.for: ''
+
+gist.likes: ''
+gist.likes.no: ''
+gist.likes.for: ''
+
+gist.revisions: ''
+gist.revision.revised: ''
+gist.revision.go-to-revision: ''
+gist.revision.file-created: ''
+gist.revision.file-deleted: ''
+gist.revision.file-renamed: ''
+gist.revision.diff-truncated: ''
+gist.revision.file-renamed-no-changes: ''
+gist.revision.empty-file: ''
+gist.revision.no-changes: ''
+gist.revision.no-revisions: ''
+gist.revision-of: ''
+
+settings: ''
+settings.email: ''
+settings.email-help: ''
+settings.email-set: ''
+settings.link-accounts: ''
+settings.link-github-account: ''
+settings.link-gitlab-account: ''
+settings.link-gitea-account: ''
+settings.unlink-github-account: ''
+settings.unlink-gitlab-account: ''
+settings.unlink-gitea-account: ''
+settings.delete-account: ''
+settings.delete-account-confirm: ''
+settings.add-ssh-key: ''
+settings.add-ssh-key-help: ''
+settings.add-ssh-key-title: ''
+settings.add-ssh-key-content: ''
+settings.delete-ssh-key: ''
+settings.delete-ssh-key-confirm: ''
+settings.ssh-key-added-at: ''
+settings.ssh-key-never-used: ''
+settings.ssh-key-last-used: ''
+settings.ssh-key-exists: ''
+settings.change-username: ''
+settings.create-password: ''
+settings.create-password-help: ''
+settings.change-password: ''
+settings.change-password-help: ''
+settings.password-label-title: ''
+
+auth.signup-disabled: ''
+auth.login: ''
+auth.signup: ''
+auth.new-account: ''
+auth.username: ''
+auth.password: ''
+auth.register-instead: ''
+auth.login-instead: ''
+auth.oauth: ''
+auth.mfa: ''
+auth.mfa.passkey: ''
+auth.mfa.passkeys: ''
+auth.mfa.use-passkey: ''
+auth.mfa.bind-passkey: ''
+auth.mfa.login-with-passkey: ''
+auth.mfa.waiting-for-passkey-input: ''
+auth.mfa.use-passkey-to-finish: ''
+auth.mfa.passkeys-help: ''
+auth.mfa.passkey-name: ''
+auth.mfa.delete-passkey: ''
+auth.mfa.passkey-added-at: ''
+auth.mfa.passkey-never-used: ''
+auth.mfa.passkey-last-used: ''
+auth.mfa.delete-passkey-confirm: ''
+auth.totp: ''
+auth.totp.help: ''
+auth.totp.use: ''
+auth.totp.regenerate-recovery-codes: ''
+auth.totp.already-enabled: ''
+auth.totp.invalid-secret: ''
+auth.totp.invalid-code: ''
+auth.totp.code-used: ''
+auth.totp.disabled: ''
+auth.totp.disable: ''
+auth.totp.enter-code: ''
+auth.totp.enter-recovery-key: ''
+auth.totp.code: ''
+auth.totp.submit: ''
+auth.totp.proceed: ''
+auth.totp.save-recovery-codes: ''
+auth.totp.scan-qr-code: ''
+
+
+error: ''
+error.page-not-found: ''
+error.bad-request: ''
+error.signup-disabled: ''
+error.signup-disabled-form: ''
+error.login-disabled-form: ''
+error.complete-oauth-login: ""
+error.oauth-unsupported: ''
+error.cannot-bind-data: ''
+error.invalid-number: ''
+error.invalid-character-unescaped: ''
+error.not-in-mfa-session: ''
+
+header.menu.all: ''
+header.menu.new: ''
+header.menu.search: ''
+header.menu.my-gists: ''
+header.menu.liked: ''
+header.menu.admin: ''
+header.menu.settings: ''
+header.menu.logout: ''
+header.menu.register: ''
+header.menu.login: ''
+header.menu.light: ''
+header.menu.dark: ''
+header.menu.system: ''
+footer.powered-by: ''
+
+pagination.older: ''
+pagination.newer: ''
+pagination.previous: ''
+pagination.next: ''
+
+admin.admin_panel: ''
+admin.general: ''
+admin.users: ''
+admin.gists: ''
+admin.configuration: ''
+admin.invitations: ''
+admin.invitations.create: ''
+admin.versions: ''
+admin.ssh_keys: ''
+admin.stats: ''
+admin.actions: ''
+admin.actions.sync-fs: ''
+admin.actions.sync-db: ''
+admin.actions.git-gc: ''
+admin.actions.sync-previews: ''
+admin.actions.reset-hooks: ''
+admin.actions.index-gists: ''
+admin.actions.sync-gist-languages: ''
+admin.id: ''
+admin.user: ''
+admin.delete: ''
+admin.created_at: ''
+
+admin.config-link: ''
+admin.config-link-overriden: ''
+admin.disable-signup: ''
+admin.disable-signup_help: ''
+admin.require-login: ''
+admin.require-login_help: ''
+admin.allow-gists-without-login: ''
+admin.allow-gists-without-login_help: ''
+admin.disable-login: ''
+admin.disable-login_help: ''
+admin.disable-gravatar: ''
+admin.disable-gravatar_help: ''
+
+admin.users.delete_confirm: ''
+
+admin.gists.title: ''
+admin.gists.private: ''
+admin.gists.nb-files: ''
+admin.gists.nb-likes: ''
+admin.gists.delete_confirm: ''
+
+admin.invitations.help: ''
+admin.invitations.max_uses: ''
+admin.invitations.expires_at: ''
+admin.invitations.code: ''
+admin.invitations.copy_link: ''
+admin.invitations.uses: ''
+admin.invitations.expired: ''
+admin.invitations.delete_confirm: ''
+
+flash.admin.user-deleted: ''
+flash.admin.gist-deleted: ''
+flash.admin.invitation-created: ''
+flash.admin.invitation-deleted: ''
+flash.admin.sync-fs: ''
+flash.admin.sync-db: ''
+flash.admin.git-gc: ''
+flash.admin.sync-previews: ''
+flash.admin.reset-hooks: ''
+flash.admin.index-gists: ''
+flash.admin.sync-gist-languages: ''
+
+flash.auth.username-exists: ''
+flash.auth.invalid-credentials: ''
+flash.auth.account-linked-oauth: ''
+flash.auth.account-unlinked-oauth: ''
+flash.auth.user-sshkeys-not-retrievable: ''
+flash.auth.user-sshkeys-not-created: ''
+flash.auth.must-be-logged-in: ''
+flash.auth.passkey-registred: ''
+flash.auth.passkey-deleted: ''
+
+flash.gist.visibility-changed: ''
+flash.gist.deleted: ''
+flash.gist.fork-own-gist: ''
+flash.gist.forked: ''
+
+flash.user.email-updated: ''
+flash.user.invalid-ssh-key: ''
+flash.user.ssh-key-added: ''
+flash.user.ssh-key-deleted: ''
+flash.user.password-updated: ''
+flash.user.username-updated: ''
+
+validation.is-too-long: ''
+validation.should-not-be-empty: ''
+validation.should-not-include-sub-directory: ''
+validation.should-only-contain-alphanumeric-characters: ''
+validation.should-only-contain-alphanumeric-characters-and-dashes: ''
+validation.not-enough: ''
+validation.invalid: ''
+validation.invalid-gist-topics: ''
+
+html.title.admin-panel: ''
--- a/internal/i18n/locales/zh-CN.yml
+++ b/internal/i18n/locales/zh-CN.yml
@@ -295,3 +295,19 @@ auth.totp.submit: 提交
 auth.totp.proceed: 继续
 auth.totp.save-recovery-codes: 请将您的恢复代码保存在安全的地方。在您无法访问身份验证应用程序时，可以使用这些代码恢复访问。
 admin.invitations.delete_confirm: 您想要删除此邀请吗？
+gist.new.topics: 主题（用空格分隔）
+validation.invalid-gist-topics: 无效的 Gists 主题，它们必须以字母或数字开头，长度不超过50个字符，并且可以包含连字符
+gist.list.topic-results-topic: '%s 与主题匹配的所有 Gists'
+admin.actions.sync-gist-languages: 同步所有 gists 语言
+flash.admin.sync-gist-languages: 正在同步 Gist 语言...
+gist.list.topic-results: 所有匹配主题的 Gist
+gist.search.help.topic: 具有给定主题的 Gists
+gist.search.placeholder.title: 标题
+gist.search.placeholder.visibility: 可见性
+gist.search.placeholder.private: 私密
+gist.search.placeholder.language: 语言
+gist.search.placeholder.all: 所有
+gist.search.placeholder.topics: 话题
+gist.search.placeholder.search: 搜索
+gist.search.placeholder.public: 公开
+gist.search.placeholder.unlisted: 未列出的
--- a/internal/index/bleve.go
+++ b/internal/index/bleve.go
@@ -10,37 +10,39 @@ import (
 	"github.com/blevesearch/bleve/v2/analysis/tokenizer/unicode"
 	"github.com/blevesearch/bleve/v2/search/query"
 	"github.com/rs/zerolog/log"
-	"github.com/thomiceli/opengist/internal/config"
 	"strconv"
-	"sync/atomic"
 )

-var atomicIndexer atomic.Pointer[Indexer]
-
-type Indexer struct {
-	Index bleve.Index
+type BleveIndexer struct {
+	index bleve.Index
+	path  string
 }

-func Enabled() bool {
-	return config.C.IndexEnabled
+func NewBleveIndexer(path string) *BleveIndexer {
+	return &BleveIndexer{path: path}
 }

-func Init(indexFilename string) {
-	atomicIndexer.Store(&Indexer{Index: nil})
+func (i *BleveIndexer) Init() error {
+	errChan := make(chan error, 1)

 	go func() {
-		bleveIndex, err := open(indexFilename)
+		bleveIndex, err := i.open()
 		if err != nil {
-			log.Error().Err(err).Msg("Failed to open index")
-			(*atomicIndexer.Load()).close()
+			log.Error().Err(err).Msg("Failed to open Bleve index")
+			i.Close()
+			errChan <- err
+			return
 		}
-		atomicIndexer.Store(&Indexer{Index: bleveIndex})
-		log.Info().Msg("Indexer initialized")
+		i.index = bleveIndex
+		log.Info().Msg("Bleve indexer initialized")
+		errChan <- nil
 	}()
+
+	return <-errChan
 }

-func open(indexFilename string) (bleve.Index, error) {
-	bleveIndex, err := bleve.Open(indexFilename)
+func (i *BleveIndexer) open() (bleve.Index, error) {
+	bleveIndex, err := bleve.Open(i.path)
 	if err == nil {
 		return bleveIndex, nil
 	}
@@ -73,67 +75,33 @@ func open(indexFilename string) (bleve.Index, error) {

 	docMapping.DefaultAnalyzer = "gistAnalyser"

-	return bleve.New(indexFilename, mapping)
+	return bleve.New(i.path, mapping)
 }

-func Close() {
-	(*atomicIndexer.Load()).close()
-}
-
-func (i *Indexer) close() {
-	if i == nil || i.Index == nil {
+func (i *BleveIndexer) Close() {
+	if i == nil || i.index == nil {
 		return
 	}

-	err := i.Index.Close()
+	err := i.index.Close()
 	if err != nil {
-		log.Error().Err(err).Msg("Failed to close bleve index")
+		log.Error().Err(err).Msg("Failed to close Bleve index")
 	}
-	log.Info().Msg("Indexer closed")
-	atomicIndexer.Store(&Indexer{Index: nil})
+	log.Info().Msg("Bleve indexer closed")
 }

-func checkForIndexer() error {
-	if (*atomicIndexer.Load()).Index == nil {
-		return errors.New("indexer is not initialized")
-	}
-
-	return nil
-}
-
-func AddInIndex(gist *Gist) error {
-	if !Enabled() {
-		return nil
-	}
-	if err := checkForIndexer(); err != nil {
-		return err
-	}
-
+func (i *BleveIndexer) Add(gist *Gist) error {
 	if gist == nil {
 		return errors.New("failed to add nil gist to index")
 	}
-	return (*atomicIndexer.Load()).Index.Index(strconv.Itoa(int(gist.GistID)), gist)
+	return (*atomicIndexer.Load()).(*BleveIndexer).index.Index(strconv.Itoa(int(gist.GistID)), gist)
 }

-func RemoveFromIndex(gistID uint) error {
-	if !Enabled() {
-		return nil
-	}
-	if err := checkForIndexer(); err != nil {
-		return err
-	}
-
-	return (*atomicIndexer.Load()).Index.Delete(strconv.Itoa(int(gistID)))
+func (i *BleveIndexer) Remove(gistID uint) error {
+	return (*atomicIndexer.Load()).(*BleveIndexer).index.Delete(strconv.Itoa(int(gistID)))
 }

-func SearchGists(queryStr string, queryMetadata SearchGistMetadata, gistsIds []uint, page int) ([]uint, uint64, map[string]int, error) {
-	if !Enabled() {
-		return nil, 0, nil, nil
-	}
-	if err := checkForIndexer(); err != nil {
-		return nil, 0, nil, err
-	}
-
+func (i *BleveIndexer) Search(queryStr string, queryMetadata SearchGistMetadata, userId uint, page int) ([]uint, uint64, map[string]int, error) {
 	var err error
 	var indexerQuery query.Query
 	if queryStr != "" {
@@ -145,17 +113,16 @@ func SearchGists(queryStr string, queryMetadata SearchGistMetadata, gistsIds []u
 		indexerQuery = contentQuery
 	}

-	repoQueries := make([]query.Query, 0, len(gistsIds))
+	privateQuery := bleve.NewBoolFieldQuery(false)
+	privateQuery.SetField("Private")

+	userIdMatch := float64(userId)
 	truee := true
-	for _, id := range gistsIds {
-		f := float64(id)
-		qq := bleve.NewNumericRangeInclusiveQuery(&f, &f, &truee, &truee)
-		qq.SetField("GistID")
-		repoQueries = append(repoQueries, qq)
-	}
+	userIdQuery := bleve.NewNumericRangeInclusiveQuery(&userIdMatch, &userIdMatch, &truee, &truee)
+	userIdQuery.SetField("UserID")

-	indexerQuery = bleve.NewConjunctionQuery(bleve.NewDisjunctionQuery(repoQueries...), indexerQuery)
+	accessQuery := bleve.NewDisjunctionQuery(privateQuery, userIdQuery)
+	indexerQuery = bleve.NewConjunctionQuery(accessQuery, indexerQuery)

 	addQuery := func(field, value string) {
 		if value != "" && value != "." {
@@ -182,7 +149,7 @@ func SearchGists(queryStr string, queryMetadata SearchGistMetadata, gistsIds []u
 	s.Fields = []string{"GistID"}
 	s.IncludeLocations = false

-	results, err := (*atomicIndexer.Load()).Index.Search(s)
+	results, err := (*atomicIndexer.Load()).(*BleveIndexer).index.Search(s)
 	if err != nil {
 		return nil, 0, nil, err
 	}
--- a/internal/index/gist.go
+++ b/internal/index/gist.go
@@ -2,6 +2,8 @@ package index

 type Gist struct {
 	GistID     uint
+	UserID     uint
+	Visibility uint
 	Username   string
 	Title      string
 	Content    string
--- a/internal/index/indexer.go
+++ b/internal/index/indexer.go
@@ -0,0 +1,138 @@
+package index
+
+import (
+	"fmt"
+	"github.com/rs/zerolog/log"
+	"github.com/thomiceli/opengist/internal/config"
+	"path/filepath"
+	"sync/atomic"
+)
+
+var atomicIndexer atomic.Pointer[Indexer]
+
+type Indexer interface {
+	Init() error
+	Close()
+	Add(gist *Gist) error
+	Remove(gistID uint) error
+	Search(query string, metadata SearchGistMetadata, userId uint, page int) ([]uint, uint64, map[string]int, error)
+}
+
+type IndexerType string
+
+const (
+	Bleve       IndexerType = "bleve"
+	Meilisearch IndexerType = "meilisearch"
+	None        IndexerType = ""
+)
+
+func IndexType() IndexerType {
+	switch config.C.Index {
+	case "bleve":
+		return Bleve
+	case "meilisearch":
+		return Meilisearch
+	default:
+		return None
+	}
+}
+
+func IndexEnabled() bool {
+	switch config.C.Index {
+	case "bleve", "meilisearch":
+		return true
+	default:
+		return false
+	}
+}
+
+func NewIndexer(idxType IndexerType) {
+	if !IndexEnabled() {
+		return
+	}
+	atomicIndexer.Store(nil)
+
+	var idx Indexer
+
+	switch idxType {
+	case Bleve:
+		idx = NewBleveIndexer(filepath.Join(config.GetHomeDir(), "opengist.index"))
+	case Meilisearch:
+		idx = NewMeiliIndexer(config.C.MeiliHost, config.C.MeiliAPIKey, "opengist")
+	default:
+		log.Warn().Msgf("Failed to create indexer, unknown indexer type: %s", idxType)
+		return
+	}
+
+	if err := idx.Init(); err != nil {
+		return
+	}
+	atomicIndexer.Store(&idx)
+}
+
+func Close() {
+	if !IndexEnabled() {
+		return
+	}
+
+	idx := atomicIndexer.Load()
+	if idx == nil {
+		return
+	}
+
+	(*idx).Close()
+	atomicIndexer.Store(nil)
+}
+
+func AddInIndex(gist *Gist) error {
+	if !IndexEnabled() {
+		return nil
+	}
+
+	idx := atomicIndexer.Load()
+	if idx == nil {
+		return fmt.Errorf("indexer is not initialized")
+	}
+
+	return (*idx).Add(gist)
+}
+
+func RemoveFromIndex(gistID uint) error {
+	if !IndexEnabled() {
+		return nil
+	}
+
+	idx := atomicIndexer.Load()
+	if idx == nil {
+		return fmt.Errorf("indexer is not initialized")
+	}
+
+	return (*idx).Remove(gistID)
+}
+
+func SearchGists(query string, metadata SearchGistMetadata, userId uint, page int) ([]uint, uint64, map[string]int, error) {
+	if !IndexEnabled() {
+		return nil, 0, nil, nil
+	}
+
+	idx := atomicIndexer.Load()
+	if idx == nil {
+		return nil, 0, nil, fmt.Errorf("indexer is not initialized")
+	}
+
+	return (*idx).Search(query, metadata, userId, page)
+}
+
+func DepreactionIndexDirname() {
+	if config.C.IndexEnabled {
+		log.Warn().Msg("The 'index.enabled'/'OG_INDEX_ENABLED' configuration option is deprecated and will be removed in a future version. Please use 'index'/'OG_INDEX' instead.")
+	}
+
+	if config.C.Index == "" {
+		config.C.Index = "bleve"
+	}
+
+	if config.C.BleveDirname != "" {
+		log.Warn().Msg("The 'index.dirname'/'OG_INDEX_DIRNAME' configuration option is deprecated and will be removed in a future version.")
+	}
+}
--- a/internal/index/meilisearch.go
+++ b/internal/index/meilisearch.go
@@ -0,0 +1,151 @@
+package index
+
+import (
+	"errors"
+	"fmt"
+	"github.com/meilisearch/meilisearch-go"
+	"github.com/rs/zerolog/log"
+	"strconv"
+	"strings"
+)
+
+type MeiliIndexer struct {
+	client    meilisearch.ServiceManager
+	index     meilisearch.IndexManager
+	indexName string
+	host      string
+	apikey    string
+}
+
+func NewMeiliIndexer(host, apikey, indexName string) *MeiliIndexer {
+	return &MeiliIndexer{
+		host:      host,
+		apikey:    apikey,
+		indexName: indexName,
+	}
+}
+
+func (i *MeiliIndexer) Init() error {
+	errChan := make(chan error, 1)
+
+	go func() {
+		meiliIndex, err := i.open()
+		if err != nil {
+			log.Error().Err(err).Msg("Failed to open Meilisearch index")
+			i.Close()
+			errChan <- err
+			return
+		}
+		i.index = meiliIndex
+		log.Info().Msg("Meilisearch indexer initialized")
+		errChan <- nil
+	}()
+
+	return <-errChan
+}
+
+func (i *MeiliIndexer) open() (meilisearch.IndexManager, error) {
+	i.client = meilisearch.New(i.host, meilisearch.WithAPIKey(i.apikey))
+	indexResult, err := i.client.GetIndex(i.indexName)
+
+	if indexResult != nil && err == nil {
+		return indexResult.IndexManager, nil
+	}
+
+	_, err = i.client.CreateIndex(&meilisearch.IndexConfig{
+		Uid:        i.indexName,
+		PrimaryKey: "GistID",
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	_, _ = i.client.Index(i.indexName).UpdateSettings(&meilisearch.Settings{
+		FilterableAttributes: []string{"GistID", "UserID", "Visibility", "Username", "Title", "Filenames", "Extensions", "Languages", "Topics"},
+		DisplayedAttributes:  []string{"GistID"},
+		SearchableAttributes: []string{"Content", "Username", "Title", "Filenames", "Extensions", "Languages", "Topics"},
+		RankingRules:         []string{"words"},
+	})
+
+	return i.client.Index(i.indexName), nil
+}
+
+func (i *MeiliIndexer) Close() {
+	if i.client != nil {
+		i.client.Close()
+		log.Info().Msg("Meilisearch indexer closed")
+	}
+	i.client = nil
+}
+
+func (i *MeiliIndexer) Add(gist *Gist) error {
+	if gist == nil {
+		return errors.New("failed to add nil gist to index")
+	}
+	_, err := (*atomicIndexer.Load()).(*MeiliIndexer).index.AddDocuments(gist, "GistID")
+	return err
+}
+
+func (i *MeiliIndexer) Remove(gistID uint) error {
+	_, err := (*atomicIndexer.Load()).(*MeiliIndexer).index.DeleteDocument(strconv.Itoa(int(gistID)))
+	return err
+}
+
+func (i *MeiliIndexer) Search(queryStr string, queryMetadata SearchGistMetadata, userId uint, page int) ([]uint, uint64, map[string]int, error) {
+	searchRequest := &meilisearch.SearchRequest{
+		Offset:               int64((page - 1) * 10),
+		Limit:                11,
+		AttributesToRetrieve: []string{"GistID", "Languages"},
+		Facets:               []string{"Languages"},
+		AttributesToSearchOn: []string{"Content"},
+	}
+
+	var filters []string
+	filters = append(filters, fmt.Sprintf("(Visibility = 0 OR UserID = %d)", userId))
+
+	addFilter := func(field, value string) {
+		if value != "" && value != "." {
+			filters = append(filters, fmt.Sprintf("%s = \"%s\"", field, escapeFilterValue(value)))
+		}
+	}
+	addFilter("Username", queryMetadata.Username)
+	addFilter("Title", queryMetadata.Title)
+	addFilter("Filenames", queryMetadata.Filename)
+	addFilter("Extensions", queryMetadata.Extension)
+	addFilter("Languages", queryMetadata.Language)
+	addFilter("Topics", queryMetadata.Topic)
+
+	if len(filters) > 0 {
+		searchRequest.Filter = strings.Join(filters, " AND ")
+	}
+
+	response, err := (*atomicIndexer.Load()).(*MeiliIndexer).index.Search(queryStr, searchRequest)
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to search Meilisearch index")
+		return nil, 0, nil, err
+	}
+
+	gistIds := make([]uint, 0, len(response.Hits))
+	for _, hit := range response.Hits {
+		if gistID, ok := hit.(map[string]interface{})["GistID"].(float64); ok {
+			gistIds = append(gistIds, uint(gistID))
+		}
+	}
+
+	languageCounts := make(map[string]int)
+	if facets, ok := response.FacetDistribution.(map[string]interface{})["Languages"]; ok {
+		for language, count := range facets.(map[string]interface{}) {
+			if countValue, ok := count.(float64); ok {
+				languageCounts[language] = int(countValue)
+			}
+		}
+	}
+
+	return gistIds, uint64(response.EstimatedTotalHits), languageCounts, nil
+}
+
+func escapeFilterValue(value string) string {
+	escaped := strings.ReplaceAll(value, "\\", "\\\\")
+	escaped = strings.ReplaceAll(escaped, "\"", "\\\"")
+	return escaped
+}
--- a/internal/render/csv.go
+++ b/internal/render/csv.go
@@ -0,0 +1,44 @@
+package render
+
+import (
+	"encoding/csv"
+	"fmt"
+	"strings"
+
+	"github.com/thomiceli/opengist/internal/git"
+)
+
+type CSVFile struct {
+	*git.File
+	Type   string     `json:"type"`
+	Header []string   `json:"-"`
+	Rows   [][]string `json:"-"`
+}
+
+func (r CSVFile) getFile() *git.File {
+	return r.File
+}
+
+func renderCsvFile(file *git.File) (*CSVFile, error) {
+	reader := csv.NewReader(strings.NewReader(file.Content))
+	records, err := reader.ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	header := records[0]
+	numColumns := len(header)
+
+	for i := 1; i < len(records); i++ {
+		if len(records[i]) != numColumns {
+			return nil, fmt.Errorf("CSV file has invalid row at index %d", i)
+		}
+	}
+
+	return &CSVFile{
+		File:   file,
+		Type:   "CSV",
+		Header: header,
+		Rows:   records[1:],
+	}, nil
+}
--- a/internal/render/highlight.go
+++ b/internal/render/highlight.go
@@ -5,47 +5,44 @@ import (
 	"bytes"
 	"encoding/base64"
 	"fmt"
+
 	"github.com/alecthomas/chroma/v2"
 	"github.com/alecthomas/chroma/v2/formatters/html"
 	"github.com/alecthomas/chroma/v2/lexers"
 	"github.com/alecthomas/chroma/v2/styles"
-	"github.com/rs/zerolog/log"
 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/git"
-	"path"
-	"sync"
 )

-type RenderedFile struct {
+type HighlightedFile struct {
 	*git.File
 	Type  string   `json:"type"`
 	Lines []string `json:"-"`
 	HTML  string   `json:"-"`
 }

+func (r HighlightedFile) getFile() *git.File {
+	return r.File
+}
+
 type RenderedGist struct {
 	*db.Gist
 	Lines []string
 	HTML  string
 }

-func HighlightFile(file *git.File) (RenderedFile, error) {
+func highlightFile(file *git.File) (HighlightedFile, error) {
+	rendered := HighlightedFile{
+		File: file,
+	}
+	if !file.MimeType.IsText() {
+		return rendered, nil
+	}
 	style := newStyle()
 	lexer := newLexer(file.Filename)

-	if lexer.Config().Name == "markdown" {
-		return MarkdownFile(file)
-	}
-	if lexer.Config().Name == "XML" && path.Ext(file.Filename) == ".svg" {
-		return RenderSvgFile(file), nil
-	}
-
 	formatter := html.New(html.WithClasses(true), html.PreventSurroundingPre(true))

-	rendered := RenderedFile{
-		File: file,
-	}
-
 	iterator, err := lexer.Tokenise(nil, file.Content+"\n")
 	if err != nil {
 		return rendered, err
@@ -74,38 +71,6 @@ func HighlightFile(file *git.File) (RenderedFile, error) {
 	return rendered, err
 }

-func HighlightFiles(files []*git.File) []RenderedFile {
-	const numWorkers = 10
-	jobs := make(chan int, numWorkers)
-	renderedFiles := make([]RenderedFile, len(files))
-	var wg sync.WaitGroup
-
-	worker := func() {
-		for idx := range jobs {
-			rendered, err := HighlightFile(files[idx])
-			if err != nil {
-				log.Error().Err(err).Msg("Error rendering gist preview for " + files[idx].Filename)
-			}
-			renderedFiles[idx] = rendered
-		}
-		wg.Done()
-	}
-
-	for i := 0; i < numWorkers; i++ {
-		wg.Add(1)
-		go worker()
-	}
-
-	for i := range files {
-		jobs <- i
-	}
-	close(jobs)
-
-	wg.Wait()
-
-	return renderedFiles
-}
-
 func HighlightGistPreview(gist *db.Gist) (RenderedGist, error) {
 	rendered := RenderedGist{
 		Gist: gist,
@@ -146,18 +111,12 @@ func HighlightGistPreview(gist *db.Gist) (RenderedGist, error) {
 	return rendered, err
 }

-func RenderSvgFile(file *git.File) RenderedFile {
-	rendered := RenderedFile{
+func renderSvgFile(file *git.File) HighlightedFile {
+	return HighlightedFile{
 		File: file,
+		HTML: `<img src="data:image/svg+xml;base64,` + base64.StdEncoding.EncodeToString([]byte(file.Content)) + `" />`,
+		Type: "SVG",
 	}
-
-	encoded := base64.StdEncoding.EncodeToString([]byte(file.Content))
-	content := `<img src="data:image/svg+xml;base64,` + encoded + `" />`
-
-	rendered.HTML = content
-	rendered.Type = "SVG"
-
-	return rendered
 }

 func parseFileTypeName(config chroma.Config) string {
--- a/internal/render/markdown.go
+++ b/internal/render/markdown.go
@@ -2,6 +2,8 @@ package render

 import (
 	"bytes"
+	"regexp"
+
 	"github.com/alecthomas/chroma/v2/formatters/html"
 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/git"
@@ -18,17 +20,19 @@ func MarkdownGistPreview(gist *db.Gist) (RenderedGist, error) {
 	var buf bytes.Buffer
 	err := newMarkdown().Convert([]byte(gist.Preview), &buf)

+	// remove links in Markdown Preview, quick fix for now
+	re := regexp.MustCompile(`<a\b[^>]*>(.*?)</a>`)
 	return RenderedGist{
 		Gist: gist,
-		HTML: buf.String(),
+		HTML: re.ReplaceAllString(buf.String(), `$1`),
 	}, err
 }

-func MarkdownFile(file *git.File) (RenderedFile, error) {
+func renderMarkdownFile(file *git.File) (HighlightedFile, error) {
 	var buf bytes.Buffer
 	err := newMarkdownWithSvgExtension().Convert([]byte(file.Content), &buf)

-	return RenderedFile{
+	return HighlightedFile{
 		File: file,
 		HTML: buf.String(),
 		Type: "Markdown",
--- a/internal/render/render.go
+++ b/internal/render/render.go
@@ -0,0 +1,84 @@
+package render
+
+import (
+	"path/filepath"
+	"sync"
+
+	"github.com/rs/zerolog/log"
+	"github.com/thomiceli/opengist/internal/git"
+)
+
+type RenderedFile interface {
+	getFile() *git.File
+}
+
+type NonHighlightedFile struct {
+	*git.File
+	Type string `json:"type"`
+}
+
+func (r NonHighlightedFile) getFile() *git.File {
+	return r.File
+}
+
+func RenderFiles(files []*git.File) []RenderedFile {
+	const numWorkers = 10
+	jobs := make(chan int, numWorkers)
+	renderedFiles := make([]RenderedFile, len(files))
+	var wg sync.WaitGroup
+
+	worker := func() {
+		for idx := range jobs {
+			renderedFiles[idx] = processFile(files[idx])
+		}
+		wg.Done()
+	}
+
+	for i := 0; i < numWorkers; i++ {
+		wg.Add(1)
+		go worker()
+	}
+
+	for i := range files {
+		jobs <- i
+	}
+	close(jobs)
+
+	wg.Wait()
+
+	return renderedFiles
+}
+
+func processFile(file *git.File) RenderedFile {
+	mt := file.MimeType
+	if mt.IsCSV() {
+		rendered, err := renderCsvFile(file)
+		if err != nil {
+			log.Error().Err(err).Msg("Error parsing CSV file for " + file.Filename)
+		}
+		return rendered
+	} else if mt.IsText() && filepath.Ext(file.Filename) == ".md" {
+		rendered, err := renderMarkdownFile(file)
+		if err != nil {
+			log.Error().Err(err).Msg("Error rendering markdown file for " + file.Filename)
+		}
+		return rendered
+	} else if mt.IsSVG() {
+		rendered := renderSvgFile(file)
+		return rendered
+	} else if mt.CanBeEmbedded() {
+		rendered := NonHighlightedFile{File: file, Type: mt.RenderType()}
+		file.Content = ""
+		return rendered
+	} else if mt.CanBeRendered() {
+		rendered, err := highlightFile(file)
+		if err != nil {
+			log.Error().Err(err).Msg("Error rendering gist preview for " + file.Filename)
+		}
+		return rendered
+	} else {
+		rendered := NonHighlightedFile{File: file, Type: mt.RenderType()}
+		file.Content = ""
+		return rendered
+	}
+}
--- a/internal/web/context/context.go
+++ b/internal/web/context/context.go
@@ -2,15 +2,16 @@ package context

 import (
 	"context"
+	"html/template"
+	"net/http"
+	"sync"
+
 	"github.com/gorilla/sessions"
 	"github.com/labstack/echo/v4"
 	"github.com/rs/zerolog/log"
 	"github.com/thomiceli/opengist/internal/config"
 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/i18n"
-	"html/template"
-	"net/http"
-	"sync"
 )

 type dataKey string
@@ -57,7 +58,7 @@ func (ctx *Context) DataMap() echo.Map {
 }

 func (ctx *Context) ErrorRes(code int, message string, err error) error {
-	if code >= 500 {
+	if code >= 500 && err != nil {
 		var skipLogger = log.With().CallerWithSkipFrameCount(3).Logger()
 		skipLogger.Error().Err(err).Msg(message)
 	}
--- a/internal/web/handlers/auth/oauth.go
+++ b/internal/web/handlers/auth/oauth.go
@@ -4,6 +4,9 @@ import (
 	"crypto/md5"
 	"errors"
 	"fmt"
+	"slices"
+	"strings"
+
 	"github.com/rs/zerolog/log"
 	"github.com/thomiceli/opengist/internal/auth/oauth"
 	"github.com/thomiceli/opengist/internal/config"
@@ -12,7 +15,6 @@ import (
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
 	"gorm.io/gorm"
-	"strings"
 )

 func Oauth(ctx *context.Context) error {
@@ -110,7 +112,8 @@ func OauthCallback(ctx *context.Context) error {
 			return ctx.ErrorRes(500, "Cannot create user", err)
 		}

-		if userDB.ID == 1 {
+		// if oidc admin group is not configured set first user as admin
+		if config.C.OIDCAdminGroup == "" && userDB.ID == 1 {
 			if err = userDB.SetAdmin(); err != nil {
 				return ctx.ErrorRes(500, "Cannot set user admin", err)
 			}
@@ -136,6 +139,32 @@ func OauthCallback(ctx *context.Context) error {
 		}
 	}

+	// update is admin status from oidc group
+	if config.C.OIDCAdminGroup != "" {
+		groupClaimName := config.C.OIDCGroupClaimName
+		if groupClaimName == "" {
+			log.Error().Msg("No OIDC group claim name configured")
+		} else if groups, ok := user.RawData[groupClaimName].([]interface{}); ok {
+			var groupNames []string
+			for _, group := range groups {
+				if groupName, ok := group.(string); ok {
+					groupNames = append(groupNames, groupName)
+				}
+			}
+			isOIDCAdmin := slices.Contains(groupNames, config.C.OIDCAdminGroup)
+			log.Debug().Bool("isOIDCAdmin", isOIDCAdmin).Str("user", user.Name).Msg("User is in admin group")
+
+			if userDB.IsAdmin != isOIDCAdmin {
+				userDB.IsAdmin = isOIDCAdmin
+				if err = userDB.Update(); err != nil {
+					return ctx.ErrorRes(500, "Cannot set user admin", err)
+				}
+			}
+		} else {
+			log.Error().Msg("No groups found in user data")
+		}
+	}
+
 	sess := ctx.GetSession()
 	sess.Values["user"] = userDB.ID
 	ctx.SaveSession(sess)
--- a/internal/web/handlers/auth/password.go
+++ b/internal/web/handlers/auth/password.go
@@ -2,7 +2,9 @@ package auth

 import (
 	"errors"
+
 	"github.com/rs/zerolog/log"
+	"github.com/thomiceli/opengist/internal/auth"
 	passwordpkg "github.com/thomiceli/opengist/internal/auth/password"
 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/i18n"
@@ -114,6 +116,7 @@ func ProcessLogin(ctx *context.Context) error {
 		return ctx.ErrorRes(403, ctx.Tr("error.login-disabled-form"), nil)
 	}

+	var user *db.User
 	var err error
 	sess := ctx.GetSession()

@@ -121,26 +124,16 @@ func ProcessLogin(ctx *context.Context) error {
 	if err = ctx.Bind(dto); err != nil {
 		return ctx.ErrorRes(400, ctx.Tr("error.cannot-bind-data"), err)
 	}
-	password := dto.Password

-	var user *db.User
-
-	if user, err = db.GetUserByUsername(dto.Username); err != nil {
-		if !errors.Is(err, gorm.ErrRecordNotFound) {
-			return ctx.ErrorRes(500, "Cannot get user", err)
+	user, err = auth.TryAuthentication(dto.Username, dto.Password)
+	if err != nil {
+		var authErr auth.AuthError
+		if errors.As(err, &authErr) {
+			log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
+			ctx.AddFlash(ctx.Tr("flash.auth.invalid-credentials"), "error")
+			return ctx.RedirectTo("/login")
 		}
-		log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
-		ctx.AddFlash(ctx.Tr("flash.auth.invalid-credentials"), "error")
-		return ctx.RedirectTo("/login")
-	}
-
-	if ok, err := passwordpkg.VerifyPassword(password, user.Password); !ok {
-		if err != nil {
-			return ctx.ErrorRes(500, "Cannot check for password", err)
-		}
-		log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
-		ctx.AddFlash(ctx.Tr("flash.auth.invalid-credentials"), "error")
-		return ctx.RedirectTo("/login")
+		return ctx.ErrorRes(500, "Authentication system error", nil)
 	}

 	// handle MFA
--- a/internal/web/handlers/auth/totp.go
+++ b/internal/web/handlers/auth/totp.go
@@ -14,7 +14,7 @@ func BeginTotp(ctx *context.Context) error {
 		return ctx.ErrorRes(500, "Cannot check for user MFA", err)
 	} else if hasTotp {
 		ctx.AddFlash(ctx.Tr("auth.totp.already-enabled"), "error")
-		return ctx.RedirectTo("/settings")
+		return ctx.RedirectTo("/settings/mfa")
 	}

 	ogUrl, err := url.Parse(ctx.GetData("baseHttpUrl").(string))
@@ -47,7 +47,7 @@ func FinishTotp(ctx *context.Context) error {
 		return ctx.ErrorRes(500, "Cannot check for user MFA", err)
 	} else if hasTotp {
 		ctx.AddFlash(ctx.Tr("auth.totp.already-enabled"), "error")
-		return ctx.RedirectTo("/settings")
+		return ctx.RedirectTo("/settings/mfa")
 	}

 	dto := &db.TOTPDTO{}
@@ -134,7 +134,7 @@ func AssertTotp(ctx *context.Context) error {
 		}

 		ctx.AddFlash(ctx.Tr("auth.totp.code-used", dto.Code), "warning")
-		redirectUrl = "/settings"
+		redirectUrl = "/settings/mfa"
 	}

 	sess.Values["user"] = userId
@@ -157,7 +157,7 @@ func DisableTotp(ctx *context.Context) error {
 	}

 	ctx.AddFlash(ctx.Tr("auth.totp.disabled"), "success")
-	return ctx.RedirectTo("/settings")
+	return ctx.RedirectTo("/settings/mfa")
 }

 func RegenerateTotpRecoveryCodes(ctx *context.Context) error {
--- a/internal/web/handlers/gist/all.go
+++ b/internal/web/handlers/gist/all.go
@@ -179,12 +179,6 @@ func Search(ctx *context.Context) error {
 		currentUserId = 0
 	}

-	var visibleGistsIds []uint
-	visibleGistsIds, err = db.GetAllGistsVisibleByUser(currentUserId)
-	if err != nil {
-		return ctx.ErrorRes(500, "Error fetching gists", err)
-	}
-
 	gistsIds, nbHits, langs, err := index.SearchGists(content, index.SearchGistMetadata{
 		Username:  meta["user"],
 		Title:     meta["title"],
@@ -192,7 +186,7 @@ func Search(ctx *context.Context) error {
 		Extension: meta["extension"],
 		Language:  meta["language"],
 		Topic:     meta["topic"],
-	}, visibleGistsIds, pageInt)
+	}, currentUserId, pageInt)
 	if err != nil {
 		return ctx.ErrorRes(500, "Error searching gists", err)
 	}
--- a/internal/web/handlers/gist/create.go
+++ b/internal/web/handlers/gist/create.go
@@ -1,14 +1,19 @@
 package gist

 import (
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
 	"github.com/google/uuid"
+	"github.com/thomiceli/opengist/internal/config"
 	"github.com/thomiceli/opengist/internal/db"
+	"github.com/thomiceli/opengist/internal/git"
 	"github.com/thomiceli/opengist/internal/i18n"
 	"github.com/thomiceli/opengist/internal/validator"
 	"github.com/thomiceli/opengist/internal/web/context"
-	"net/url"
-	"strconv"
-	"strings"
 )

 func Create(ctx *context.Context) error {
@@ -43,25 +48,78 @@ func ProcessCreate(ctx *context.Context) error {

 	dto.Files = make([]db.FileDTO, 0)
 	fileCounter := 0
-	for i := 0; i < len(ctx.Request().PostForm["content"]); i++ {
-		name := ctx.Request().PostForm["name"][i]
-		content := ctx.Request().PostForm["content"][i]

+	names := ctx.Request().PostForm["name"]
+	contents := ctx.Request().PostForm["content"]
+
+	// Process files from text editors
+	for i, content := range contents {
+		if content == "" {
+			continue
+		}
+		name := names[i]
 		if name == "" {
 			fileCounter += 1
 			name = "gistfile" + strconv.Itoa(fileCounter) + ".txt"
 		}

-		escapedValue, err := url.QueryUnescape(content)
+		escapedValue, err := url.PathUnescape(content)
 		if err != nil {
 			return ctx.ErrorRes(400, ctx.Tr("error.invalid-character-unescaped"), err)
 		}

 		dto.Files = append(dto.Files, db.FileDTO{
-			Filename: strings.Trim(name, " "),
+			Filename: strings.TrimSpace(name),
 			Content:  escapedValue,
 		})
 	}
+
+	// Process uploaded files from UUID arrays
+	fileUUIDs := ctx.Request().PostForm["uploadedfile_uuid"]
+	fileFilenames := ctx.Request().PostForm["uploadedfile_filename"]
+	if len(fileUUIDs) == len(fileFilenames) {
+		for i, fileUUID := range fileUUIDs {
+			filePath := filepath.Join(filepath.Join(config.GetHomeDir(), "uploads"), fileUUID)
+
+			if _, err := os.Stat(filePath); err != nil {
+				continue
+			}
+
+			dto.Files = append(dto.Files, db.FileDTO{
+				Filename:   fileFilenames[i],
+				SourcePath: filePath,
+				Content:    "", // Empty since we're using SourcePath
+			})
+		}
+	}
+
+	// Process binary file operations (edit mode)
+	binaryOldNames := ctx.Request().PostForm["binary_old_name"]
+	binaryNewNames := ctx.Request().PostForm["binary_new_name"]
+	if len(binaryOldNames) == len(binaryNewNames) {
+		for i, oldName := range binaryOldNames {
+			newName := binaryNewNames[i]
+
+			if newName == "" { // deletion
+				continue
+			}
+
+			if !isCreate {
+				gistOld := ctx.GetData("gist").(*db.Gist)
+
+				fileContent, _, err := git.GetFileContent(gistOld.User.Username, gistOld.Uuid, "HEAD", oldName, false)
+				if err != nil {
+					continue
+				}
+
+				dto.Files = append(dto.Files, db.FileDTO{
+					Filename: newName,
+					Content:  fileContent,
+					Binary:   true,
+				})
+			}
+		}
+	}
 	ctx.SetData("dto", dto)

 	err = ctx.Validate(dto)
@@ -100,24 +158,13 @@ func ProcessCreate(ctx *context.Context) error {
 	}

 	if gist.Title == "" {
-		if ctx.Request().PostForm["name"][0] == "" {
+		if dto.Files[0].Filename == "" {
 			gist.Title = "gist:" + gist.Uuid
 		} else {
-			gist.Title = ctx.Request().PostForm["name"][0]
+			gist.Title = dto.Files[0].Filename
 		}
 	}

-	if len(dto.Files) > 0 {
-		split := strings.Split(dto.Files[0].Content, "\n")
-		if len(split) > 10 {
-			gist.Preview = strings.Join(split[:10], "\n")
-		} else {
-			gist.Preview = dto.Files[0].Content
-		}
-
-		gist.PreviewFilename = dto.Files[0].Filename
-	}
-
 	if err = gist.InitRepository(); err != nil {
 		return ctx.ErrorRes(500, "Error creating the repository", err)
 	}
@@ -138,6 +185,9 @@ func ProcessCreate(ctx *context.Context) error {

 	gist.AddInIndex()
 	gist.UpdateLanguages()
+	if err = gist.UpdatePreviewAndCount(true); err != nil {
+		return ctx.ErrorRes(500, "Error updating preview and count", err)
+	}

 	return ctx.RedirectTo("/" + user.Username + "/" + gist.Identifier())
 }
--- a/internal/web/handlers/gist/download.go
+++ b/internal/web/handlers/gist/download.go
@@ -7,7 +7,6 @@ import (

 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/web/context"
-	"github.com/thomiceli/opengist/internal/web/handlers"
 )

 func RawFile(ctx *context.Context) error {
@@ -20,8 +19,8 @@ func RawFile(ctx *context.Context) error {
 	if file == nil {
 		return ctx.NotFound("File not found")
 	}
-	contentType := handlers.GetContentTypeFromFilename(file.Filename)
-	ctx.Response().Header().Set("Content-Type", contentType)
+	ctx.Response().Header().Set("Content-Type", file.MimeType.ContentType)
+	ctx.Response().Header().Set("Content-Disposition", "inline; filename=\""+file.Filename+"\"")
 	return ctx.PlainText(200, file.Content)
 }

@@ -36,7 +35,7 @@ func DownloadFile(ctx *context.Context) error {
 		return ctx.NotFound("File not found")
 	}

-	ctx.Response().Header().Set("Content-Type", "text/plain")
+	ctx.Response().Header().Set("Content-Type", file.MimeType.ContentType)
 	ctx.Response().Header().Set("Content-Disposition", "attachment; filename="+file.Filename)
 	ctx.Response().Header().Set("Content-Length", strconv.Itoa(len(file.Content)))
 	_, err = ctx.Response().Write([]byte(file.Content))
--- a/internal/web/handlers/gist/edit.go
+++ b/internal/web/handlers/gist/edit.go
@@ -70,6 +70,8 @@ func EditVisibility(ctx *context.Context) error {
 		return ctx.ErrorRes(500, "Error updating this gist", err)
 	}

+	gist.AddInIndex()
+
 	ctx.AddFlash(ctx.Tr("flash.gist.visibility-changed"), "success")
 	return ctx.RedirectTo("/" + gist.User.Username + "/" + gist.Identifier())
 }
--- a/internal/web/handlers/gist/gist.go
+++ b/internal/web/handlers/gist/gist.go
@@ -5,12 +5,13 @@ import (
 	"bytes"
 	gojson "encoding/json"
 	"fmt"
+	"net/url"
+	"time"
+
 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/git"
 	"github.com/thomiceli/opengist/internal/render"
 	"github.com/thomiceli/opengist/internal/web/context"
-	"net/url"
-	"time"
 )

 func GistIndex(ctx *context.Context) error {
@@ -34,7 +35,7 @@ func GistIndex(ctx *context.Context) error {
 		return ctx.ErrorRes(500, "Error fetching files", err)
 	}

-	renderedFiles := render.HighlightFiles(files)
+	renderedFiles := render.RenderFiles(files)

 	ctx.SetData("page", "code")
 	ctx.SetData("commit", revision)
@@ -51,7 +52,7 @@ func GistJson(ctx *context.Context) error {
 		return ctx.ErrorRes(500, "Error fetching files", err)
 	}

-	renderedFiles := render.HighlightFiles(files)
+	renderedFiles := render.RenderFiles(files)
 	ctx.SetData("files", renderedFiles)

 	topics, err := gist.GetTopics()
@@ -106,7 +107,7 @@ func GistJs(ctx *context.Context) error {
 		return ctx.ErrorRes(500, "Error fetching files", err)
 	}

-	renderedFiles := render.HighlightFiles(files)
+	renderedFiles := render.RenderFiles(files)
 	ctx.SetData("files", renderedFiles)

 	htmlbuf := bytes.Buffer{}
--- a/internal/web/handlers/gist/upload.go
+++ b/internal/web/handlers/gist/upload.go
@@ -0,0 +1,77 @@
+package gist
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/google/uuid"
+	"github.com/thomiceli/opengist/internal/config"
+	"github.com/thomiceli/opengist/internal/web/context"
+)
+
+func Upload(ctx *context.Context) error {
+	err := ctx.Request().ParseMultipartForm(32 << 20) // 32 MB max
+	if err != nil {
+		return ctx.ErrorRes(400, ctx.Tr("error.bad-request"), err)
+	}
+
+	fileHeader, err := ctx.FormFile("file")
+	if err != nil {
+		return ctx.ErrorRes(400, ctx.Tr("error.no-file-uploaded"), err)
+	}
+
+	file, err := fileHeader.Open()
+	if err != nil {
+		return ctx.ErrorRes(400, ctx.Tr("error.cannot-open-file"), err)
+	}
+	defer file.Close()
+
+	fileUUID, err := uuid.NewRandom()
+	if err != nil {
+		return ctx.ErrorRes(500, "Error generating UUID", err)
+	}
+
+	uploadsDir := filepath.Join(config.GetHomeDir(), "uploads")
+	if err := os.MkdirAll(uploadsDir, 0755); err != nil {
+		return ctx.ErrorRes(500, "Error creating uploads directory", err)
+	}
+
+	filename := fileUUID.String()
+	filePath := filepath.Join(uploadsDir, filename)
+
+	destFile, err := os.Create(filePath)
+	if err != nil {
+		return ctx.ErrorRes(500, "Error creating file", err)
+	}
+	defer destFile.Close()
+
+	if _, err := io.Copy(destFile, file); err != nil {
+		return ctx.ErrorRes(500, "Error saving file", err)
+	}
+
+	return ctx.JSON(200, map[string]string{
+		"uuid":     filename,
+		"filename": fileHeader.Filename,
+	})
+}
+
+func DeleteUpload(ctx *context.Context) error {
+	uuid := ctx.Param("uuid")
+	if uuid == "" {
+		return ctx.ErrorRes(400, ctx.Tr("error.bad-request"), nil)
+	}
+
+	uploadsDir := filepath.Join(config.GetHomeDir(), "uploads")
+	filePath := filepath.Join(uploadsDir, uuid)
+
+	if _, err := os.Stat(filePath); err == nil {
+		if err := os.Remove(filePath); err != nil {
+			return ctx.ErrorRes(500, "Error deleting file", err)
+		}
+	}
+
+	return ctx.JSON(200, map[string]string{
+		"status": "deleted",
+	})
+}
--- a/internal/web/handlers/git/http.go
+++ b/internal/web/handlers/git/http.go
@@ -6,9 +6,6 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"github.com/thomiceli/opengist/internal/auth/password"
-	"github.com/thomiceli/opengist/internal/web/context"
-	"github.com/thomiceli/opengist/internal/web/handlers"
 	"net/http"
 	"os"
 	"os/exec"
@@ -23,7 +20,8 @@ import (
 	"github.com/thomiceli/opengist/internal/auth"
 	"github.com/thomiceli/opengist/internal/db"
 	"github.com/thomiceli/opengist/internal/git"
-	"gorm.io/gorm"
+	"github.com/thomiceli/opengist/internal/web/context"
+	"github.com/thomiceli/opengist/internal/web/handlers"
 )

 var routes = []struct {
@@ -45,138 +43,211 @@ var routes = []struct {
 }

 func GitHttp(ctx *context.Context) error {
+	route := findMatchingRoute(ctx)
+	if route == nil {
+		return ctx.NotFound("Gist not found") // regular 404 for non-git routes
+	}
+	gist := ctx.GetData("gist").(*db.Gist)
+	gistExists := gist.ID != 0
+
+	isInitRoute := strings.HasPrefix(ctx.Request().URL.Path, "/init/info/refs")
+	isInitRouteReceive := strings.HasPrefix(ctx.Request().URL.Path, "/init/git-receive-pack")
+	isInfoRefs := strings.HasSuffix(route.gitUrl, "/info/refs$")
+	isPull := ctx.QueryParam("service") == "git-upload-pack" ||
+		strings.HasSuffix(ctx.Request().URL.Path, "git-upload-pack") && !isInfoRefs
+	isPush := ctx.QueryParam("service") == "git-receive-pack" ||
+		strings.HasSuffix(ctx.Request().URL.Path, "git-receive-pack") && !isInfoRefs
+
+	repositoryPath := git.RepositoryPath(gist.User.Username, gist.Uuid)
+	ctx.SetData("repositoryPath", repositoryPath)
+
+	allow, err := auth.ShouldAllowUnauthenticatedGistAccess(handlers.ContextAuthInfo{Context: ctx}, true)
+	if err != nil {
+		log.Fatal().Err(err).Msg("Cannot check if unauthenticated access is allowed")
+	}
+
+	// No need to authenticate if the user wants
+	// to clone/pull ; a non-private gist ; that exists ; where unauthenticated access is allowed in the instance
+	if isPull && gist.Private != db.PrivateVisibility && gistExists && allow {
+		return route.handler(ctx)
+	}
+
+	// Else we need to authenticate the user, that include other cases:
+	// - user wants to push the gist
+	// - user wants to clone/pull a private gist
+	// - user wants to clone/pull a non-private gist but unauthenticated access is not allowed
+	// - gist is not found ; has no right to clone/pull (obfuscation)
+	// - admin setting to require login is set to true
+	authUsername, authPassword, err := parseAuthHeader(ctx)
+	if err != nil {
+		return basicAuth(ctx)
+	}
+
+	// if the user wants to create a gist via the /init route
+	if isInitRoute || isInitRouteReceive {
+		var user *db.User
+
+		// check if the user has a valid account on opengist to push a gist
+		user, err = auth.TryAuthentication(authUsername, authPassword)
+		if err != nil {
+			var authErr auth.AuthError
+			if errors.As(err, &authErr) {
+				log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
+				return ctx.PlainText(401, "Invalid credentials")
+			}
+			return ctx.ErrorRes(500, "Authentication system error", nil)
+		}
+
+		if isInitRoute {
+			gist, err = createGist(user, "")
+			if err != nil {
+				return ctx.ErrorRes(500, "Cannot create gist", err)
+			}
+
+			err = db.AddInitGistToQueue(gist.ID, user.ID)
+			if err != nil {
+				return ctx.ErrorRes(500, "Cannot add inited gist to the queue", err)
+			}
+			ctx.SetData("gist", gist)
+			return route.handler(ctx)
+		} else {
+			gist, err = db.GetInitGistInQueueForUser(user.ID)
+			if err != nil {
+				return ctx.ErrorRes(500, "Cannot retrieve inited gist from the queue", err)
+			}
+
+			ctx.SetData("gist", gist)
+			ctx.SetData("repositoryPath", git.RepositoryPath(gist.User.Username, gist.Uuid))
+			return route.handler(ctx)
+		}
+	}
+
+	// if clone/pull
+	// check if the gist exists and if the credentials are valid
+	if isPull {
+		log.Debug().Msg("Detected git pull operation")
+		if !gistExists {
+			log.Debug().Str("authUsername", authUsername).Msg("Pulling unknown gist")
+			return ctx.PlainText(404, "Check your credentials or make sure you have access to the Gist")
+		}
+
+		var userToCheckPermissions string
+		// if the user is trying to clone/pull a non-private gist while unauthenticated access is not allowed,
+		// check if the user has a valid account
+		if gist.Private != db.PrivateVisibility {
+			log.Debug().Str("authUsername", authUsername).Msg("Pulling non-private gist with authenticated access")
+			userToCheckPermissions = authUsername
+		} else { // else just check the password against the gist owner
+			log.Debug().Str("authUsername", authUsername).Str("gistOwner", gist.User.Username).Msg("Pulling private gist")
+			userToCheckPermissions = gist.User.Username
+		}
+
+		if _, err = auth.TryAuthentication(userToCheckPermissions, authPassword); err != nil {
+			var authErr auth.AuthError
+			if errors.As(err, &authErr) {
+				log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
+				return ctx.PlainText(404, "Check your credentials or make sure you have access to the Gist")
+			}
+			return ctx.ErrorRes(500, "Authentication system error", nil)
+		}
+		log.Debug().Str("authUsername", authUsername).Msg("Pulling gist")
+
+		return route.handler(ctx)
+	}
+
+	if isPush {
+		log.Debug().Msg("Detected git push operation")
+		// if gist exists, check if the credentials are valid and if the user is the gist owner
+		if gistExists {
+			log.Debug().Str("authUsername", authUsername).Str("gistOwner", gist.User.Username).Msg("Pushing to existing gist")
+			if _, err = auth.TryAuthentication(gist.User.Username, authPassword); err != nil {
+				var authErr auth.AuthError
+				if errors.As(err, &authErr) {
+					log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
+					return ctx.PlainText(404, "Check your credentials or make sure you have access to the Gist")
+				}
+				return ctx.ErrorRes(500, "Authentication system error", nil)
+			}
+			log.Debug().Str("authUsername", authUsername).Msg("Pushing gist")
+
+			return route.handler(ctx)
+		} else { // if the gist does not exist, check if the user has a valid account on opengist to push a gist and create it
+			log.Debug().Str("authUsername", authUsername).Msg("Creating new gist by pushing")
+			var user *db.User
+			if user, err = auth.TryAuthentication(authUsername, authPassword); err != nil {
+				var authErr auth.AuthError
+				if errors.As(err, &authErr) {
+					log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
+					return ctx.PlainText(404, "Check your credentials or make sure you have access to the Gist")
+				}
+				return ctx.ErrorRes(500, "Authentication system error", nil)
+			}
+
+			urlPath := ctx.Request().URL.Path
+			pathParts := strings.Split(strings.Trim(urlPath, "/"), "/")
+			if pathParts[0] == authUsername && len(pathParts) == 4 {
+				log.Debug().Str("authUsername", authUsername).Msg("Valid URL format for push operation")
+				gist, err = createGist(user, pathParts[1])
+				if err != nil {
+					return ctx.ErrorRes(500, "Cannot create gist", err)
+				}
+				log.Debug().Str("authUsername", authUsername).Str("url", urlPath).Msg("Gist created")
+				ctx.SetData("gist", gist)
+				ctx.SetData("repositoryPath", git.RepositoryPath(gist.User.Username, gist.Uuid))
+			} else {
+				log.Debug().Str("authUsername", authUsername).Any("path", pathParts).Msg("Invalid URL format for push operation")
+				return ctx.PlainText(401, "Invalid URL format for push operation")
+			}
+			return route.handler(ctx)
+
+		}
+	}
+
+	return route.handler(ctx)
+}
+
+func findMatchingRoute(ctx *context.Context) *struct {
+	gitUrl  string
+	method  string
+	handler func(ctx *context.Context) error
+} {
 	for _, route := range routes {
 		matched, _ := regexp.MatchString(route.gitUrl, ctx.Request().URL.Path)
 		if ctx.Request().Method == route.method && matched {
 			if !strings.HasPrefix(ctx.Request().Header.Get("User-Agent"), "git/") {
 				continue
 			}
-
-			gist := ctx.GetData("gist").(*db.Gist)
-
-			isInit := strings.HasPrefix(ctx.Request().URL.Path, "/init/info/refs")
-			isInitReceive := strings.HasPrefix(ctx.Request().URL.Path, "/init/git-receive-pack")
-			isInfoRefs := strings.HasSuffix(route.gitUrl, "/info/refs$")
-			isPull := ctx.QueryParam("service") == "git-upload-pack" ||
-				strings.HasSuffix(ctx.Request().URL.Path, "git-upload-pack") ||
-				ctx.Request().Method == "GET" && !isInfoRefs
-
-			repositoryPath := git.RepositoryPath(gist.User.Username, gist.Uuid)
-			if _, err := os.Stat(repositoryPath); os.IsNotExist(err) {
-				if err != nil {
-					log.Info().Err(err).Msg("Repository directory does not exist")
-					return ctx.ErrorRes(404, "Repository directory does not exist", err)
-				}
-			}
-
-			ctx.SetData("repositoryPath", repositoryPath)
-
-			allow, err := auth.ShouldAllowUnauthenticatedGistAccess(handlers.ContextAuthInfo{Context: ctx}, true)
-			if err != nil {
-				log.Fatal().Err(err).Msg("Cannot check if unauthenticated access is allowed")
-			}
-
-			// Shows basic auth if :
-			// - user wants to push the gist
-			// - user wants to clone/pull a private gist
-			// - gist is not found (obfuscation)
-			// - admin setting to require login is set to true
-			if isPull && gist.Private != db.PrivateVisibility && gist.ID != 0 && allow {
-				return route.handler(ctx)
-			}
-
-			authHeader := ctx.Request().Header.Get("Authorization")
-			if authHeader == "" {
-				return basicAuth(ctx)
-			}
-
-			authFields := strings.Fields(authHeader)
-			if len(authFields) != 2 || authFields[0] != "Basic" {
-				return basicAuth(ctx)
-			}
-
-			authUsername, authPassword, err := basicAuthDecode(authFields[1])
-			if err != nil {
-				return basicAuth(ctx)
-			}
-
-			if !isInit && !isInitReceive {
-				if gist.ID == 0 {
-					return ctx.PlainText(404, "Check your credentials or make sure you have access to the Gist")
-				}
-
-				var userToCheckPermissions *db.User
-				if gist.Private != db.PrivateVisibility && isPull {
-					userToCheckPermissions, _ = db.GetUserByUsername(authUsername)
-				} else {
-					userToCheckPermissions = &gist.User
-				}
-
-				if ok, err := password.VerifyPassword(authPassword, userToCheckPermissions.Password); !ok {
-					if err != nil {
-						return ctx.ErrorRes(500, "Cannot verify password", err)
-					}
-					log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
-					return ctx.PlainText(404, "Check your credentials or make sure you have access to the Gist")
-				}
-			} else {
-				var user *db.User
-				if user, err = db.GetUserByUsername(authUsername); err != nil {
-					if !errors.Is(err, gorm.ErrRecordNotFound) {
-						return ctx.ErrorRes(500, "Cannot get user", err)
-					}
-					log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
-					return ctx.ErrorRes(401, "Invalid credentials", nil)
-				}
-
-				if ok, err := password.VerifyPassword(authPassword, user.Password); !ok {
-					if err != nil {
-						return ctx.ErrorRes(500, "Cannot check for password", err)
-					}
-					log.Warn().Msg("Invalid HTTP authentication attempt from " + ctx.RealIP())
-					return ctx.ErrorRes(401, "Invalid credentials", nil)
-				}
-
-				if isInit {
-					gist = new(db.Gist)
-					gist.UserID = user.ID
-					gist.User = *user
-					uuidGist, err := uuid.NewRandom()
-					if err != nil {
-						return ctx.ErrorRes(500, "Error creating an UUID", err)
-					}
-					gist.Uuid = strings.Replace(uuidGist.String(), "-", "", -1)
-					gist.Title = "gist:" + gist.Uuid
-
-					if err = gist.InitRepository(); err != nil {
-						return ctx.ErrorRes(500, "Cannot init repository in the file system", err)
-					}
-
-					if err = gist.Create(); err != nil {
-						return ctx.ErrorRes(500, "Cannot init repository in database", err)
-					}
-
-					err = gist.SerialiseInitRepository()
-					if err != nil {
-						return ctx.ErrorRes(500, "Cannot serialise the repository", err)
-					}
-
-					ctx.SetData("gist", gist)
-				} else {
-					gist, err = db.DeserialiseInitRepository(user.Username)
-					if err != nil {
-						return ctx.ErrorRes(500, "Cannot deserialise the repository", err)
-					}
-
-					ctx.SetData("gist", gist)
-					ctx.SetData("repositoryPath", git.RepositoryPath(gist.User.Username, gist.Uuid))
-				}
-			}
-
-			return route.handler(ctx)
+			return &route
 		}
 	}
-	return ctx.NotFound("Gist not found")
+	return nil
+}
+
+func createGist(user *db.User, url string) (*db.Gist, error) {
+	gist := new(db.Gist)
+	gist.UserID = user.ID
+	gist.User = *user
+	uuidGist, err := uuid.NewRandom()
+	if err != nil {
+		return nil, err
+	}
+	gist.Uuid = strings.Replace(uuidGist.String(), "-", "", -1)
+	gist.Title = "gist:" + gist.Uuid
+
+	if url != "" {
+		gist.URL = strings.TrimSuffix(url, ".git")
+		gist.Title = strings.TrimSuffix(url, ".git")
+	}
+
+	if err := gist.InitRepository(); err != nil {
+		return nil, err
+	}
+
+	if err := gist.Create(); err != nil {
+		return nil, err
+	}
+
+	return gist, nil
 }

 func uploadPack(ctx *context.Context) error {
@@ -302,6 +373,26 @@ func basicAuth(ctx *context.Context) error {
 	return ctx.PlainText(401, "Requires authentication")
 }

+func parseAuthHeader(ctx *context.Context) (string, string, error) {
+	authHeader := ctx.Request().Header.Get("Authorization")
+	if authHeader == "" {
+		return "", "", errors.New("no auth header")
+	}
+
+	authFields := strings.Fields(authHeader)
+	if len(authFields) != 2 || authFields[0] != "Basic" {
+		return "", "", errors.New("invalid auth header")
+	}
+
+	authUsername, authPassword, err := basicAuthDecode(authFields[1])
+	if err != nil {
+		log.Error().Err(err).Msg("Cannot decode basic auth header")
+		return "", "", err
+	}
+
+	return authUsername, authPassword, nil
+}
+
 func basicAuthDecode(encoded string) (string, string, error) {
 	s, err := base64.StdEncoding.DecodeString(encoded)
 	if err != nil {
--- a/internal/web/handlers/health/metrics.go
+++ b/internal/web/handlers/health/metrics.go
@@ -1,9 +0,0 @@
-package health
-
-import "github.com/thomiceli/opengist/internal/web/context"
-
-// Metrics is a dummy handler to satisfy the /metrics endpoint (for Prometheus, Openmetrics, etc.)
-// until we have a proper metrics endpoint
-func Metrics(ctx *context.Context) error {
-	return ctx.String(200, "")
-}
--- a/internal/web/handlers/metrics/metrics.go
+++ b/internal/web/handlers/metrics/metrics.go
@@ -0,0 +1,101 @@
+package metrics
+
+import (
+	"github.com/labstack/echo-contrib/echoprometheus"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+	"github.com/thomiceli/opengist/internal/config"
+	"github.com/thomiceli/opengist/internal/db"
+	"github.com/thomiceli/opengist/internal/web/context"
+)
+
+var (
+	// Using promauto to automatically register metrics with the default registry
+	countUsersGauge   prometheus.Gauge
+	countGistsGauge   prometheus.Gauge
+	countSSHKeysGauge prometheus.Gauge
+
+	metricsInitialized bool = false
+)
+
+// initMetrics initializes metrics if they're not already initialized
+func initMetrics() {
+	if metricsInitialized {
+		return
+	}
+
+	// Only initialize metrics if they're enabled
+	if config.C.MetricsEnabled {
+		countUsersGauge = promauto.NewGauge(
+			prometheus.GaugeOpts{
+				Name: "opengist_users_total",
+				Help: "Total number of users",
+			},
+		)
+
+		countGistsGauge = promauto.NewGauge(
+			prometheus.GaugeOpts{
+				Name: "opengist_gists_total",
+				Help: "Total number of gists",
+			},
+		)
+
+		countSSHKeysGauge = promauto.NewGauge(
+			prometheus.GaugeOpts{
+				Name: "opengist_ssh_keys_total",
+				Help: "Total number of SSH keys",
+			},
+		)
+
+		metricsInitialized = true
+	}
+}
+
+// updateMetrics refreshes all metric values from the database
+func updateMetrics() {
+	// Only update metrics if they're enabled
+	if !config.C.MetricsEnabled || !metricsInitialized {
+		return
+	}
+
+	// Update users count
+	countUsers, err := db.CountAll(&db.User{})
+	if err == nil {
+		countUsersGauge.Set(float64(countUsers))
+	}
+
+	// Update gists count
+	countGists, err := db.CountAll(&db.Gist{})
+	if err == nil {
+		countGistsGauge.Set(float64(countGists))
+	}
+
+	// Update SSH keys count
+	countKeys, err := db.CountAll(&db.SSHKey{})
+	if err == nil {
+		countSSHKeysGauge.Set(float64(countKeys))
+	}
+}
+
+// Metrics handles prometheus metrics endpoint requests.
+func Metrics(ctx *context.Context) error {
+	// If metrics are disabled, return 404
+	if !config.C.MetricsEnabled {
+		return ctx.NotFound("Metrics endpoint is disabled")
+	}
+
+	// Initialize metrics if not already done
+	initMetrics()
+
+	// Update metrics
+	updateMetrics()
+
+	// Get the Echo context
+	echoCtx := ctx.Context
+
+	// Use the Prometheus metrics handler
+	handler := echoprometheus.NewHandler()
+
+	// Call the handler
+	return handler(echoCtx)
+}
--- a/internal/web/handlers/settings/settings.go
+++ b/internal/web/handlers/settings/settings.go
@@ -5,13 +5,19 @@ import (
 	"github.com/thomiceli/opengist/internal/web/context"
 )

-func UserSettings(ctx *context.Context) error {
+func UserAccount(ctx *context.Context) error {
 	user := ctx.User

-	keys, err := db.GetSSHKeysByUserID(user.ID)
-	if err != nil {
-		return ctx.ErrorRes(500, "Cannot get SSH keys", err)
-	}
+	ctx.SetData("email", user.Email)
+	ctx.SetData("hasPassword", user.Password != "")
+	ctx.SetData("disableForm", ctx.GetData("DisableLoginForm"))
+	ctx.SetData("settingsHeaderPage", "account")
+	ctx.SetData("htmlTitle", ctx.TrH("settings"))
+	return ctx.Html("settings_account.html")
+}
+
+func UserMFA(ctx *context.Context) error {
+	user := ctx.User

 	passkeys, err := db.GetAllCredentialsForUser(user.ID)
 	if err != nil {
@@ -23,12 +29,48 @@ func UserSettings(ctx *context.Context) error {
 		return ctx.ErrorRes(500, "Cannot get MFA status", err)
 	}

-	ctx.SetData("email", user.Email)
-	ctx.SetData("sshKeys", keys)
 	ctx.SetData("passkeys", passkeys)
 	ctx.SetData("hasTotp", hasTotp)
-	ctx.SetData("hasPassword", user.Password != "")
-	ctx.SetData("disableForm", ctx.GetData("DisableLoginForm"))
+	ctx.SetData("settingsHeaderPage", "mfa")
 	ctx.SetData("htmlTitle", ctx.TrH("settings"))
-	return ctx.Html("settings.html")
+	return ctx.Html("settings_mfa.html")
+}
+
+func UserSSHKeys(ctx *context.Context) error {
+	user := ctx.User
+
+	keys, err := db.GetSSHKeysByUserID(user.ID)
+	if err != nil {
+		return ctx.ErrorRes(500, "Cannot get SSH keys", err)
+	}
+
+	ctx.SetData("sshKeys", keys)
+	ctx.SetData("settingsHeaderPage", "ssh")
+	ctx.SetData("htmlTitle", ctx.TrH("settings"))
+	return ctx.Html("settings_ssh.html")
+}
+
+func UserStyle(ctx *context.Context) error {
+	ctx.SetData("settingsHeaderPage", "style")
+	ctx.SetData("htmlTitle", ctx.TrH("settings"))
+	return ctx.Html("settings_style.html")
+}
+
+func ProcessUserStyle(ctx *context.Context) error {
+	styleDto := new(db.UserStyleDTO)
+	if err := ctx.Bind(styleDto); err != nil {
+		return ctx.ErrorRes(400, ctx.Tr("error.cannot-bind-data"), err)
+	}
+
+	if err := ctx.Validate(styleDto); err != nil {
+		return ctx.ErrorRes(400, "Invalid data", err)
+	}
+	user := ctx.User
+	user.StylePreferences = styleDto.ToJson()
+	if err := user.Update(); err != nil {
+		return ctx.ErrorRes(500, "Cannot update user styles", err)
+	}
+
+	ctx.AddFlash("Updated style", "success")
+	return ctx.RedirectTo("/settings/style")
 }
--- a/internal/web/handlers/settings/sshkey.go
+++ b/internal/web/handlers/settings/sshkey.go
@@ -20,7 +20,7 @@ func SshKeysProcess(ctx *context.Context) error {

 	if err := ctx.Validate(dto); err != nil {
 		ctx.AddFlash(validator.ValidationMessages(&err, ctx.GetData("locale").(*i18n.Locale)), "error")
-		return ctx.RedirectTo("/settings")
+		return ctx.RedirectTo("/settings/ssh")
 	}
 	key := dto.ToSSHKey()

@@ -29,7 +29,7 @@ func SshKeysProcess(ctx *context.Context) error {
 	pubKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(key.Content))
 	if err != nil {
 		ctx.AddFlash(ctx.Tr("flash.user.invalid-ssh-key"), "error")
-		return ctx.RedirectTo("/settings")
+		return ctx.RedirectTo("/settings/ssh")
 	}
 	key.Content = strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pubKey)))

@@ -38,7 +38,7 @@ func SshKeysProcess(ctx *context.Context) error {
 			return ctx.ErrorRes(500, "Cannot check if SSH key exists", err)
 		}
 		ctx.AddFlash(ctx.Tr("settings.ssh-key-exists"), "error")
-		return ctx.RedirectTo("/settings")
+		return ctx.RedirectTo("/settings/ssh")
 	}

 	if err := key.Create(); err != nil {
@@ -46,20 +46,20 @@ func SshKeysProcess(ctx *context.Context) error {
 	}

 	ctx.AddFlash(ctx.Tr("flash.user.ssh-key-added"), "success")
-	return ctx.RedirectTo("/settings")
+	return ctx.RedirectTo("/settings/ssh")
 }

 func SshKeysDelete(ctx *context.Context) error {
 	user := ctx.User
 	keyId, err := strconv.Atoi(ctx.Param("id"))
 	if err != nil {
-		return ctx.RedirectTo("/settings")
+		return ctx.RedirectTo("/settings/ssh")
 	}

 	key, err := db.GetSSHKeyByID(uint(keyId))

 	if err != nil || key.UserID != user.ID {
-		return ctx.RedirectTo("/settings")
+		return ctx.RedirectTo("/settings/ssh")
 	}

 	if err := key.Delete(); err != nil {
@@ -67,5 +67,5 @@ func SshKeysDelete(ctx *context.Context) error {
 	}

 	ctx.AddFlash(ctx.Tr("flash.user.ssh-key-deleted"), "success")
-	return ctx.RedirectTo("/settings")
+	return ctx.RedirectTo("/settings/ssh")
 }
--- a/internal/web/handlers/util.go
+++ b/internal/web/handlers/util.go
@@ -2,13 +2,13 @@ package handlers

 import (
 	"errors"
-	"github.com/gorilla/schema"
 	"html/template"
 	"net/url"
-	"path/filepath"
 	"strconv"
 	"strings"

+	"github.com/gorilla/schema"
+
 	"github.com/thomiceli/opengist/internal/web/context"
 )

@@ -140,13 +140,3 @@ func ParseSearchQueryStr(query string) (string, map[string]string) {
 	content := strings.TrimSpace(contentBuilder.String())
 	return content, metadata
 }
-
-func GetContentTypeFromFilename(filename string) string {
-	ext := strings.ToLower(filepath.Ext(filename))
-	switch ext {
-	case ".css":
-		return "text/css"
-	default:
-		return "text/plain"
-	}
-}
--- a/internal/web/server/middlewares.go
+++ b/internal/web/server/middlewares.go
@@ -3,6 +3,14 @@ package server
 import (
 	"errors"
 	"fmt"
+	"html/template"
+	"net/http"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/labstack/echo-contrib/echoprometheus"
 	"github.com/labstack/echo/v4"
 	"github.com/labstack/echo/v4/middleware"
 	"github.com/rs/zerolog/log"
@@ -14,12 +22,6 @@ import (
 	"github.com/thomiceli/opengist/internal/web/handlers"
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
-	"html/template"
-	"net/http"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"time"
 )

 func (s *Server) useCustomContext() {
@@ -34,6 +36,10 @@ func (s *Server) useCustomContext() {
 func (s *Server) registerMiddlewares() {
 	s.echo.Use(Middleware(dataInit).toEcho())
 	s.echo.Use(Middleware(locale).toEcho())
+	if config.C.MetricsEnabled {
+		p := echoprometheus.NewMiddleware("opengist")
+		s.echo.Use(p)
+	}

 	s.echo.Pre(middleware.MethodOverrideWithConfig(middleware.MethodOverrideConfig{
 		Getter: middleware.MethodFromForm("_method"),
@@ -49,7 +55,7 @@ func (s *Server) registerMiddlewares() {
 			return nil
 		},
 	}))
-	//s.echo.Use(middleware.Recover())
+	s.echo.Use(middleware.Recover())
 	s.echo.Use(middleware.Secure())
 	s.echo.Use(Middleware(sessionInit).toEcho())

@@ -270,6 +276,7 @@ func sessionInit(next Handler) Handler {
 			if user != nil {
 				ctx.User = user
 				ctx.SetData("userLogged", user)
+				ctx.SetData("currentStyle", user.GetStyle())
 			}
 			return next(ctx)
 		}
--- a/internal/web/server/renderer.go
+++ b/internal/web/server/renderer.go
@@ -4,16 +4,6 @@ import (
 	gojson "encoding/json"
 	"errors"
 	"fmt"
-	"github.com/labstack/echo/v4"
-	"github.com/rs/zerolog/log"
-	"github.com/thomiceli/opengist/internal/config"
-	"github.com/thomiceli/opengist/internal/db"
-	"github.com/thomiceli/opengist/internal/git"
-	"github.com/thomiceli/opengist/internal/index"
-	"github.com/thomiceli/opengist/internal/web/context"
-	"github.com/thomiceli/opengist/internal/web/handlers"
-	"github.com/thomiceli/opengist/public"
-	"github.com/thomiceli/opengist/templates"
 	htmlpkg "html"
 	"html/template"
 	"io"
@@ -24,6 +14,17 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/dustin/go-humanize"
+	"github.com/labstack/echo/v4"
+	"github.com/rs/zerolog/log"
+	"github.com/thomiceli/opengist/internal/config"
+	"github.com/thomiceli/opengist/internal/db"
+	"github.com/thomiceli/opengist/internal/index"
+	"github.com/thomiceli/opengist/internal/web/context"
+	"github.com/thomiceli/opengist/internal/web/handlers"
+	"github.com/thomiceli/opengist/public"
+	"github.com/thomiceli/opengist/templates"
 )

 type Template struct {
@@ -58,23 +59,8 @@ func (s *Server) setFuncMap() {
 		"isMarkdown": func(i string) bool {
 			return strings.ToLower(filepath.Ext(i)) == ".md"
 		},
-		"isCsv": func(i string) bool {
-			return strings.ToLower(filepath.Ext(i)) == ".csv"
-		},
-		"isSvg": func(i string) bool {
-			return strings.ToLower(filepath.Ext(i)) == ".svg"
-		},
-		"csvFile": func(file *git.File) *git.CsvFile {
-			if strings.ToLower(filepath.Ext(file.Filename)) != ".csv" {
-				return nil
-			}
-
-			csvFile, err := git.ParseCsv(file)
-			if err != nil {
-				return nil
-			}
-
-			return csvFile
+		"isJupyter": func(i string) bool {
+			return strings.ToLower(filepath.Ext(i)) == ".ipynb"
 		},
 		"httpStatusText": http.StatusText,
 		"loadedTime": func(startTime time.Time) string {
@@ -171,7 +157,7 @@ func (s *Server) setFuncMap() {

 			return strings.TrimSpace(resultBuilder.String())
 		},
-		"indexEnabled": index.Enabled,
+		"indexEnabled": index.IndexEnabled,
 		"isUrl": func(s string) bool {
 			_, err := url.ParseRequestURI(s)
 			return err == nil
@@ -186,6 +172,20 @@ func (s *Server) setFuncMap() {
 			}
 			return str
 		},
+		"hexToRgb": func(hex string) string {
+			h, _ := strconv.ParseUint(strings.TrimPrefix(hex, "#"), 16, 32)
+			return fmt.Sprintf("%d, %d, %d,", (h>>16)&0xFF, (h>>8)&0xFF, h&0xFF)
+		},
+		"humanTimeDiff": func(t int64) string {
+			return humanize.Time(time.Unix(t, 0))
+		},
+		"humanTimeDiffStr": func(timestamp string) string {
+			t, _ := strconv.ParseInt(timestamp, 10, 64)
+			return humanize.Time(time.Unix(t, 0))
+		},
+		"humanDate": func(t int64) string {
+			return time.Unix(t, 0).Format("02/01/2006 15:04")
+		},
 	}

 	t := template.Must(template.New("t").Funcs(fm).ParseFS(templates.Files, "*/*.html"))
--- a/internal/web/server/router.go
+++ b/internal/web/server/router.go
@@ -1,6 +1,13 @@
 package server

 import (
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
 	"github.com/labstack/echo/v4"
 	"github.com/thomiceli/opengist/internal/config"
 	"github.com/thomiceli/opengist/internal/index"
@@ -10,14 +17,9 @@ import (
 	"github.com/thomiceli/opengist/internal/web/handlers/gist"
 	"github.com/thomiceli/opengist/internal/web/handlers/git"
 	"github.com/thomiceli/opengist/internal/web/handlers/health"
+	"github.com/thomiceli/opengist/internal/web/handlers/metrics"
 	"github.com/thomiceli/opengist/internal/web/handlers/settings"
 	"github.com/thomiceli/opengist/public"
-	"net/http"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-	"time"
 )

 func (s *Server) registerRoutes() {
@@ -27,9 +29,14 @@ func (s *Server) registerRoutes() {
 		r.GET("/", gist.Create, logged)
 		r.POST("/", gist.ProcessCreate, logged)
 		r.POST("/preview", gist.Preview, logged)
+		r.POST("/upload", gist.Upload, logged)
+		r.DELETE("/upload/:uuid", gist.DeleteUpload, logged)

 		r.GET("/healthcheck", health.Healthcheck)
-		r.GET("/metrics", health.Metrics)
+
+		if config.C.MetricsEnabled {
+			r.GET("/metrics", metrics.Metrics)
+		}

 		r.GET("/register", auth.Register)
 		r.POST("/register", auth.ProcessRegister)
@@ -51,7 +58,11 @@ func (s *Server) registerRoutes() {
 		sA := r.SubGroup("/settings")
 		{
 			sA.Use(logged)
-			sA.GET("", settings.UserSettings)
+			sA.GET("", settings.UserAccount)
+			sA.GET("/mfa", settings.UserMFA)
+			sA.GET("/ssh", settings.UserSSHKeys)
+			sA.GET("/style", settings.UserStyle)
+			sA.POST("/style", settings.ProcessUserStyle)
 			sA.POST("/email", settings.EmailProcess)
 			sA.DELETE("/account", settings.AccountDeleteProcess)
 			sA.POST("/ssh-keys", settings.SshKeysProcess)
@@ -93,7 +104,7 @@ func (s *Server) registerRoutes() {

 		r.GET("/all", gist.AllGists, checkRequireLogin, setAllGistsMode("all"))

-		if index.Enabled() {
+		if index.IndexEnabled() {
 			r.GET("/search", gist.Search, checkRequireLogin)
 		} else {
 			r.GET("/search", gist.AllGists, checkRequireLogin, setAllGistsMode("search"))
--- a/internal/web/server/server.go
+++ b/internal/web/server/server.go
@@ -1,8 +1,14 @@
 package server

 import (
+	"fmt"
 	"github.com/thomiceli/opengist/internal/validator"
+	"net"
 	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"

 	"github.com/labstack/echo/v4"
 	"github.com/rs/zerolog/log"
@@ -45,7 +51,19 @@ func NewServer(isDev bool, sessionsPath string, ignoreCsrf bool) *Server {
 	return s
 }

+func isSocketPath(host string) bool {
+	return strings.Contains(host, "/") || strings.Contains(host, "\\")
+}
+
 func (s *Server) Start() {
+	if isSocketPath(config.C.HttpHost) {
+		s.startUnixSocket()
+	} else {
+		s.startHTTP()
+	}
+}
+
+func (s *Server) startHTTP() {
 	addr := config.C.HttpHost + ":" + config.C.HttpPort

 	log.Info().Msg("Starting HTTP server on http://" + addr)
@@ -54,12 +72,106 @@ func (s *Server) Start() {
 	}
 }

+func (s *Server) startUnixSocket() {
+	socketPath := config.C.HttpHost
+	if socketPath == "" {
+		socketPath = "/tmp/opengist.sock"
+	}
+
+	if dir := filepath.Dir(socketPath); dir != "." {
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			log.Warn().Err(err).Str("dir", dir).Msg("Failed to create socket directory")
+		}
+	}
+	if err := os.Remove(socketPath); err != nil && !os.IsNotExist(err) {
+		log.Warn().Err(err).Str("socket", socketPath).Msg("Failed to remove existing socket file")
+	}
+
+	pidPath := strings.TrimSuffix(socketPath, filepath.Ext(socketPath)) + ".pid"
+	if err := s.createPidFile(pidPath); err != nil {
+		log.Warn().Err(err).Str("pid-file", pidPath).Msg("Failed to create PID file")
+	}
+
+	listener, err := net.Listen("unix", socketPath)
+	if err != nil {
+		log.Fatal().Err(err).Msg("Failed to start Unix socket server")
+	}
+	s.echo.Listener = listener
+
+	if config.C.UnixSocketPermissions != "" {
+		if perm, err := strconv.ParseUint(config.C.UnixSocketPermissions, 8, 32); err == nil {
+			if err := os.Chmod(socketPath, os.FileMode(perm)); err != nil {
+				log.Warn().Err(err).Str("socket", socketPath).Str("permissions", config.C.UnixSocketPermissions).Msg("Failed to set socket permissions")
+			}
+		} else {
+			log.Warn().Err(err).Str("permissions", config.C.UnixSocketPermissions).Msg("Invalid socket permissions format")
+		}
+	}
+
+	log.Info().Str("socket", socketPath).Msg("Starting Unix socket server")
+	log.Info().Str("pid-file", pidPath).Msg("PID file created")
+	server := new(http.Server)
+	if err := s.echo.StartServer(server); err != nil && err != http.ErrServerClosed {
+		log.Fatal().Err(err).Msg("Failed to start Unix socket server")
+	}
+}
+
 func (s *Server) Stop() {
+	if isSocketPath(config.C.HttpHost) {
+		s.stopUnixSocket()
+	} else {
+		s.stopHTTP()
+	}
+}
+
+func (s *Server) stopHTTP() {
+	log.Info().Msg("Stopping HTTP server...")
 	if err := s.echo.Close(); err != nil {
 		log.Fatal().Err(err).Msg("Failed to stop HTTP server")
 	}
 }

+func (s *Server) stopUnixSocket() {
+	log.Info().Msg("Stopping Unix socket server...")
+
+	var socketPath string
+	if s.echo.Listener != nil {
+		if unixListener, ok := s.echo.Listener.(*net.UnixListener); ok {
+			socketPath = unixListener.Addr().String()
+		}
+	}
+
+	if err := s.echo.Close(); err != nil {
+		log.Error().Err(err).Msg("Failed to stop Unix socket server")
+	}
+
+	if socketPath != "" {
+		if err := os.Remove(socketPath); err != nil && !os.IsNotExist(err) {
+			log.Error().Err(err).Str("socket", socketPath).Msg("Failed to remove socket file")
+		} else {
+			log.Info().Str("socket", socketPath).Msg("Socket file removed")
+		}
+
+		pidPath := strings.TrimSuffix(socketPath, filepath.Ext(socketPath)) + ".pid"
+		if err := os.Remove(pidPath); err != nil && !os.IsNotExist(err) {
+			log.Error().Err(err).Str("pid-file", pidPath).Msg("Failed to remove PID file")
+		} else {
+			log.Info().Str("pid-file", pidPath).Msg("PID file removed")
+		}
+	}
+}
+
+func (s *Server) createPidFile(pidPath string) error {
+	pid := os.Getpid()
+	pidContent := fmt.Sprintf("%d\n", pid)
+
+	if err := os.WriteFile(pidPath, []byte(pidContent), 0644); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	s.echo.ServeHTTP(w, r)
 }
--- a/internal/web/test/admin_test.go
+++ b/internal/web/test/admin_test.go
@@ -212,13 +212,10 @@ func TestAdminInvitation(t *testing.T) {
 	require.NoError(t, err)
 	invitation1, err := db.GetInvitationByID(1)
 	require.NoError(t, err)
-	require.Equal(t, invitation1, &db.Invitation{
-		ID:        1,
-		Code:      invitation1.Code,
-		ExpiresAt: time.Now().Unix() + 604800,
-		NbUsed:    0,
-		NbMax:     10,
-	})
+	require.Equal(t, uint(1), invitation1.ID)
+	require.Equal(t, uint(0), invitation1.NbUsed)
+	require.Equal(t, uint(10), invitation1.NbMax)
+	require.InDelta(t, time.Now().Unix()+604800, invitation1.ExpiresAt, 10)

 	err = s.Request("POST", "/admin-panel/invitations", invitationAdmin{
 		nbMax:         "aa",
--- a/internal/web/test/auth_test.go
+++ b/internal/web/test/auth_test.go
@@ -203,49 +203,28 @@ func TestGitOperations(t *testing.T) {
 	err = s.Request("POST", "/", gist3, 302)
 	require.NoError(t, err)

-	gitOperations := func(credentials, owner, url, filename string, expectErrorClone, expectErrorCheck, expectErrorPush bool) {
-		log.Debug().Msgf("Testing %s %s %t %t %t", credentials, url, expectErrorClone, expectErrorCheck, expectErrorPush)
-		err := clientGitClone(credentials, owner, url)
-		if expectErrorClone {
-			require.Error(t, err)
-		} else {
-			require.NoError(t, err)
-		}
-		err = clientCheckRepo(url, filename)
-		if expectErrorCheck {
-			require.Error(t, err)
-		} else {
-			require.NoError(t, err)
-		}
-		err = clientGitPush(url)
-		if expectErrorPush {
-			require.Error(t, err)
-		} else {
-			require.NoError(t, err)
-		}
-	}
-
 	tests := []struct {
 		credentials      string
 		user             string
 		url              string
+		pushOptions      string
 		expectErrorClone bool
 		expectErrorCheck bool
 		expectErrorPush  bool
 	}{
-		{":", "kaguya", "kaguya-pub-gist", false, false, true},
-		{":", "kaguya", "kaguya-unl-gist", false, false, true},
-		{":", "kaguya", "kaguya-priv-gist", true, true, true},
-		{"kaguya:kaguya", "kaguya", "kaguya-pub-gist", false, false, false},
-		{"kaguya:kaguya", "kaguya", "kaguya-unl-gist", false, false, false},
-		{"kaguya:kaguya", "kaguya", "kaguya-priv-gist", false, false, false},
-		{"fujiwara:fujiwara", "kaguya", "kaguya-pub-gist", false, false, true},
-		{"fujiwara:fujiwara", "kaguya", "kaguya-unl-gist", false, false, true},
-		{"fujiwara:fujiwara", "kaguya", "kaguya-priv-gist", true, true, true},
+		{":", "kaguya", "kaguya-pub-gist", "", false, false, true},
+		{":", "kaguya", "kaguya-unl-gist", "", false, false, true},
+		{":", "kaguya", "kaguya-priv-gist", "", true, true, true},
+		{"kaguya:kaguya", "kaguya", "kaguya-pub-gist", "", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-unl-gist", "", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-priv-gist", "", false, false, false},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-pub-gist", "", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-unl-gist", "", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-priv-gist", "", true, true, true},
 	}

 	for _, test := range tests {
-		gitOperations(test.credentials, test.user, test.url, "kaguya-file.txt", test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
+		gitCloneCheckPush(t, test.credentials, test.user, test.url, "kaguya-file.txt", test.pushOptions, test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
 	}

 	login(t, s, admin)
@@ -256,23 +235,24 @@ func TestGitOperations(t *testing.T) {
 		credentials      string
 		user             string
 		url              string
+		pushOptions      string
 		expectErrorClone bool
 		expectErrorCheck bool
 		expectErrorPush  bool
 	}{
-		{":", "kaguya", "kaguya-pub-gist", true, true, true},
-		{":", "kaguya", "kaguya-unl-gist", true, true, true},
-		{":", "kaguya", "kaguya-priv-gist", true, true, true},
-		{"kaguya:kaguya", "kaguya", "kaguya-pub-gist", false, false, false},
-		{"kaguya:kaguya", "kaguya", "kaguya-unl-gist", false, false, false},
-		{"kaguya:kaguya", "kaguya", "kaguya-priv-gist", false, false, false},
-		{"fujiwara:fujiwara", "kaguya", "kaguya-pub-gist", false, false, true},
-		{"fujiwara:fujiwara", "kaguya", "kaguya-unl-gist", false, false, true},
-		{"fujiwara:fujiwara", "kaguya", "kaguya-priv-gist", true, true, true},
+		{":", "kaguya", "kaguya-pub-gist", "", true, true, true},
+		{":", "kaguya", "kaguya-unl-gist", "", true, true, true},
+		{":", "kaguya", "kaguya-priv-gist", "", true, true, true},
+		{"kaguya:kaguya", "kaguya", "kaguya-pub-gist", "", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-unl-gist", "", false, false, false},
+		{"kaguya:kaguya", "kaguya", "kaguya-priv-gist", "", false, false, false},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-pub-gist", "", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-unl-gist", "", false, false, true},
+		{"fujiwara:fujiwara", "kaguya", "kaguya-priv-gist", "", true, true, true},
 	}

 	for _, test := range testsRequireLogin {
-		gitOperations(test.credentials, test.user, test.url, "kaguya-file.txt", test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
+		gitCloneCheckPush(t, test.credentials, test.user, test.url, "kaguya-file.txt", test.pushOptions, test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
 	}

 	login(t, s, admin)
@@ -280,31 +260,155 @@ func TestGitOperations(t *testing.T) {
 	require.NoError(t, err)

 	for _, test := range tests {
-		gitOperations(test.credentials, test.user, test.url, "kaguya-file.txt", test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
+		gitCloneCheckPush(t, test.credentials, test.user, test.url, "kaguya-file.txt", test.pushOptions, test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
 	}
 }

+func TestGitInit(t *testing.T) {
+	s := Setup(t)
+	defer Teardown(t, s)
+
+	admin := db.UserDTO{Username: "thomas", Password: "thomas"}
+	register(t, s, admin)
+	s.sessionCookie = ""
+	register(t, s, db.UserDTO{Username: "fujiwara", Password: "fujiwara"})
+	s.sessionCookie = ""
+	register(t, s, db.UserDTO{Username: "kaguya", Password: "kaguya"})
+
+	testsNewWithPush := []struct {
+		credentials      string
+		user             string
+		url              string
+		pushOptions      string
+		expectErrorClone bool
+		expectErrorCheck bool
+		expectErrorPush  bool
+	}{
+		{":", "kaguya", "gist1", "", true, true, true},
+		{"kaguya:wrongpass", "kaguya", "gist2", "", true, true, true},
+		{"fujiwara:fujiwara", "kaguya", "gist3", "", true, true, true},
+		{"kaguya:kaguya", "kaguya", "gist4", "", false, false, false},
+		{"kaguya:kaguya", "kaguya", "gist5/g", "", true, true, true},
+	}
+
+	for _, test := range testsNewWithPush {
+		gitInitPush(t, test.credentials, test.user, test.url, "newfile.txt", test.pushOptions, test.expectErrorPush)
+	}
+
+	gist1db, err := db.GetGistByID("1")
+	require.NoError(t, err)
+	require.Equal(t, "kaguya", gist1db.User.Username)
+
+	for _, test := range testsNewWithPush {
+		gitCloneCheckPush(t, test.credentials, test.user, test.url, "newfile.txt", test.pushOptions, test.expectErrorClone, test.expectErrorCheck, test.expectErrorPush)
+	}
+
+	count, err := db.CountAll(db.Gist{})
+	require.NoError(t, err)
+	require.Equal(t, int64(1), count)
+
+	testsNewWithInit := []struct {
+		credentials     string
+		url             string
+		pushOptions     string
+		expectErrorPush bool
+	}{
+		{":", "init", "", true},
+		{"fujiwara:wrongpass", "init", "", true},
+		{"kaguya:kaguya", "init", "", false},
+		{"fujiwara:fujiwara", "init", "", false},
+	}
+
+	for _, test := range testsNewWithInit {
+		gitInitPush(t, test.credentials, "kaguya", test.url, "newfile.txt", test.pushOptions, test.expectErrorPush)
+	}
+
+	count, err = db.CountAll(db.Gist{})
+	require.NoError(t, err)
+	require.Equal(t, int64(3), count)
+
+	gist2db, err := db.GetGistByID("2")
+	require.NoError(t, err)
+	require.Equal(t, "kaguya", gist2db.User.Username)
+
+	gist3db, err := db.GetGistByID("3")
+	require.NoError(t, err)
+	require.Equal(t, "fujiwara", gist3db.User.Username)
+}
+
 func clientGitClone(creds string, user string, url string) error {
 	return exec.Command("git", "clone", "http://"+creds+"@localhost:6157/"+user+"/"+url, filepath.Join(config.GetHomeDir(), "tmp", url)).Run()
 }

-func clientGitPush(url string) error {
-	f, err := os.Create(filepath.Join(config.GetHomeDir(), "tmp", url, "newfile.txt"))
+func clientGitPush(url string, pushOptions string, file string) error {
+	f, err := os.Create(filepath.Join(config.GetHomeDir(), "tmp", url, file))
 	if err != nil {
 		return err
 	}
-	f.Close()
+	_, _ = f.WriteString("new file")
+	_ = f.Close()

-	_ = exec.Command("git", "-C", filepath.Join(config.GetHomeDir(), "tmp", url), "add", "newfile.txt").Run()
+	_ = exec.Command("git", "-C", filepath.Join(config.GetHomeDir(), "tmp", url), "add", file).Run()
 	_ = exec.Command("git", "-C", filepath.Join(config.GetHomeDir(), "tmp", url), "commit", "-m", "new file").Run()
-	err = exec.Command("git", "-C", filepath.Join(config.GetHomeDir(), "tmp", url), "push", "origin", "master").Run()
-
+	if pushOptions != "" {
+		err = exec.Command("git", "-C", filepath.Join(config.GetHomeDir(), "tmp", url), "push", pushOptions, "origin").Run()
+	} else {
+		err = exec.Command("git", "-C", filepath.Join(config.GetHomeDir(), "tmp", url), "push", "origin").Run()
+	}
 	_ = os.RemoveAll(filepath.Join(config.GetHomeDir(), "tmp", url))

 	return err
 }

+func clientGitInit(path string) error {
+	return exec.Command("git", "init", "--initial-branch=master", filepath.Join(config.GetHomeDir(), "tmp", path)).Run()
+}
+
+func clientGitSetRemote(path string, remoteName string, remoteUrl string) error {
+	return exec.Command("git", "-C", filepath.Join(config.GetHomeDir(), "tmp", path), "remote", "add", remoteName, remoteUrl).Run()
+}
+
 func clientCheckRepo(url string, file string) error {
 	_, err := os.ReadFile(filepath.Join(config.GetHomeDir(), "tmp", url, file))
 	return err
 }
+
+func gitCloneCheckPush(t *testing.T, credentials, owner, url, filename, pushOptions string, expectErrorClone, expectErrorCheck, expectErrorPush bool) {
+	log.Debug().Msgf("Testing %s %s %t %t %t", credentials, url, expectErrorClone, expectErrorCheck, expectErrorPush)
+	err := clientGitClone(credentials, owner, url)
+	if expectErrorClone {
+		require.Error(t, err)
+	} else {
+		require.NoError(t, err)
+	}
+	err = clientCheckRepo(url, filename)
+	if expectErrorCheck {
+		require.Error(t, err)
+	} else {
+		require.NoError(t, err)
+	}
+	err = clientGitPush(url, pushOptions, filename)
+	if expectErrorPush {
+		require.Error(t, err)
+	} else {
+		require.NoError(t, err)
+	}
+}
+
+func gitInitPush(t *testing.T, credentials, owner, url, filename, pushOptions string, expectErrorPush bool) {
+	log.Debug().Msgf("Testing %s %s %t", credentials, url, expectErrorPush)
+	err := clientGitInit(url)
+	require.NoError(t, err)
+	if url == "init" {
+		err = clientGitSetRemote(url, "origin", "http://"+credentials+"@localhost:6157/init/")
+	} else {
+		err = clientGitSetRemote(url, "origin", "http://"+credentials+"@localhost:6157/"+owner+"/"+url)
+	}
+	require.NoError(t, err)
+	err = clientGitPush(url, pushOptions, filename)
+	if expectErrorPush {
+		require.Error(t, err)
+	} else {
+		require.NoError(t, err)
+	}
+}
--- a/internal/web/test/gist_test.go
+++ b/internal/web/test/gist_test.go
@@ -66,7 +66,7 @@ func TestGists(t *testing.T) {
 		Content: []string{"", "yeah\ncool", "yeah\ncool gist actually"},
 		Topics:  "",
 	}
-	err = s.Request("POST", "/", gist2, 400)
+	err = s.Request("POST", "/", gist2, 302)
 	require.NoError(t, err)

 	gist3 := db.GistDTO{
@@ -82,7 +82,7 @@ func TestGists(t *testing.T) {
 	err = s.Request("POST", "/", gist3, 302)
 	require.NoError(t, err)

-	gist3db, err := db.GetGistByID("2")
+	gist3db, err := db.GetGistByID("3")
 	require.NoError(t, err)

 	gist3files, err := git.GetFilesOfRepository(gist3db.User.Username, gist3db.Uuid, "HEAD")
--- a/internal/web/test/metrics_test.go
+++ b/internal/web/test/metrics_test.go
@@ -0,0 +1,113 @@
+package test
+
+import (
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/thomiceli/opengist/internal/db"
+	"io"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+var (
+	SSHKey = db.SSHKeyDTO{
+		Title:   "Test SSH Key",
+		Content: `ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAklOUpkDHrfHY17SbrmTIpNLTGK9Tjom/BWDSUGPl+nafzlHDTYW7hdI4yZ5ew18JH4JW9jbhUFrviQzM7xlELEVf4h9lFX5QVkbPppSwg0cda3Pbv7kOdJ/MTyBlWXFCR+HAo3FXRitBqxiX1nKhXpHAZsMciLq8V6RjsNAQwdsdMFvSlVK/7XAt3FaoJoAsncM1Q9x5+3V0Ww68/eIFmb1zuUFljQJKprrX88XypNDvjYNby6vw/Pb0rwert/EnmZ+AW4OZPnTPI89ZPmVMLuayrD2cE86Z/il8b+gw3r3+1nKatmIkjn2so1d01QraTlMqVSsbxNrRFi9wrf+M7Q== admin@admin.local`,
+	}
+	AdminUser = db.UserDTO{
+		Username: "admin",
+		Password: "admin",
+	}
+
+	SimpleGist = db.GistDTO{
+		Title:       "Simple Test Gist",
+		Description: "A simple gist for testing",
+		VisibilityDTO: db.VisibilityDTO{
+			Private: 0,
+		},
+		Name:    []string{"file1.txt"},
+		Content: []string{"This is the content of file1"},
+		Topics:  "",
+	}
+)
+
+// TestMetrics tests the metrics endpoint functionality of the application.
+// It verifies that the metrics endpoint correctly reports counts for:
+// - Total number of users
+// - Total number of gists
+// - Total number of SSH keys
+//
+// The test follows these steps:
+// 1. Enables metrics via environment variable
+// 2. Sets up test environment
+// 3. Registers and logs in an admin user
+// 4. Creates a gist and adds an SSH key
+// 5. Queries the metrics endpoint
+// 6. Verifies the reported metrics match expected values
+//
+// Environment variables:
+//   - OG_METRICS_ENABLED: Set to "true" for this test
+func TestMetrics(t *testing.T) {
+	originalValue := os.Getenv("OG_METRICS_ENABLED")
+
+	os.Setenv("OG_METRICS_ENABLED", "true")
+
+	defer os.Setenv("OG_METRICS_ENABLED", originalValue)
+
+	s := Setup(t)
+	defer Teardown(t, s)
+
+	register(t, s, AdminUser)
+	login(t, s, AdminUser)
+
+	err := s.Request("GET", "/all", nil, 200)
+	require.NoError(t, err)
+
+	err = s.Request("POST", "/", SimpleGist, 302)
+	require.NoError(t, err)
+
+	err = s.Request("POST", "/settings/ssh-keys", SSHKey, 302)
+	require.NoError(t, err)
+
+	var metricsRes http.Response
+	err = s.Request("GET", "/metrics", nil, 200, &metricsRes)
+	require.NoError(t, err)
+
+	body, err := io.ReadAll(metricsRes.Body)
+	defer metricsRes.Body.Close()
+	require.NoError(t, err)
+
+	lines := strings.Split(string(body), "\n")
+	var usersTotal float64
+	var gistsTotal float64
+	var sshKeysTotal float64
+
+	for _, line := range lines {
+		if strings.HasPrefix(line, "opengist_users_total") {
+			parts := strings.Fields(line)
+			if len(parts) == 2 {
+				usersTotal, err = strconv.ParseFloat(parts[1], 64)
+				assert.NoError(t, err)
+			}
+		} else if strings.HasPrefix(line, "opengist_gists_total") {
+			parts := strings.Fields(line)
+			if len(parts) == 2 {
+				gistsTotal, err = strconv.ParseFloat(parts[1], 64)
+				assert.NoError(t, err)
+			}
+		} else if strings.HasPrefix(line, "opengist_ssh_keys_total") {
+			parts := strings.Fields(line)
+			if len(parts) == 2 {
+				sshKeysTotal, err = strconv.ParseFloat(parts[1], 64)
+				assert.NoError(t, err)
+			}
+		}
+	}
+
+	assert.Equal(t, 1.0, usersTotal, "opengist_users_total should be 1")
+	assert.Equal(t, 1.0, gistsTotal, "opengist_gists_total should be 1")
+	assert.Equal(t, 1.0, sshKeysTotal, "opengist_ssh_keys_total should be 1")
+}
--- a/internal/web/test/server.go
+++ b/internal/web/test/server.go
@@ -8,6 +8,7 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"reflect"
 	"runtime"
@@ -48,7 +49,7 @@ func (s *TestServer) stop() {
 	s.server.Stop()
 }

-func (s *TestServer) Request(method, uri string, data interface{}, expectedCode int) error {
+func (s *TestServer) Request(method, uri string, data interface{}, expectedCode int, responsePtr ...*http.Response) error {
 	var bodyReader io.Reader
 	if method == http.MethodPost || method == http.MethodPut {
 		values := structToURLValues(data)
@@ -92,6 +93,11 @@ func (s *TestServer) Request(method, uri string, data interface{}, expectedCode
 		}
 	}

+	// If a response pointer was provided, fill it with the response data
+	if len(responsePtr) > 0 && responsePtr[0] != nil {
+		*responsePtr[0] = *w.Result()
+	}
+
 	return nil
 }

@@ -146,24 +152,30 @@ func Setup(t *testing.T) *TestServer {

 	git.ReposDirectory = filepath.Join("tests")

-	config.C.IndexEnabled = false
+	config.C.Index = ""
 	config.C.LogLevel = "error"
+	config.C.GitDefaultBranch = "master"
 	config.InitLog()

+	err = exec.Command("git", "config", "--global", "--type", "bool", "push.autoSetupRemote", "true").Run()
+	require.NoError(t, err)
+	err = exec.Command("git", "config", "--global", "user.email", "test@opengist.io").Run()
+	require.NoError(t, err)
+	err = exec.Command("git", "config", "--global", "user.name", "test").Run()
+	require.NoError(t, err)
+
 	homePath := config.GetHomeDir()
 	log.Info().Msg("Data directory: " + homePath)

 	var databaseDsn string
 	databaseType = os.Getenv("OPENGIST_TEST_DB")
 	switch databaseType {
-	case "sqlite":
-		databaseDsn = "file:" + filepath.Join(homePath, "tmp", "opengist.db")
 	case "postgres":
 		databaseDsn = "postgres://postgres:opengist@localhost:5432/opengist_test"
 	case "mysql":
 		databaseDsn = "mysql://root:opengist@localhost:3306/opengist_test"
 	default:
-		databaseDsn = ":memory:"
+		databaseDsn = "file:" + filepath.Join(homePath, "tmp", "opengist_test.db")
 	}

 	err = os.MkdirAll(filepath.Join(homePath, "tests"), 0755)
--- a/package-lock.json
+++ b/package-lock.json
@@ -17,10 +17,12 @@
        "autoprefixer": "^10.4.14",
        "codemirror": "^6.0.1",
        "cssnano": "^5.1.15",
-        "dayjs": "^1.11.9",
        "github-markdown-css": "^5.5.0",
+        "highlight.js": "^11.11.1",
        "jdenticon": "^3.3.0",
+        "katex": "^0.16.22",
        "nodemon": "^2.0.22",
+        "pdfobject": "^2.3.1",
        "postcss": "^8.4.32",
        "postcss-cli": "^11.0.0",
        "postcss-cssnext": "^3.1.1",
@@ -28,6 +30,7 @@
        "postcss-loader": "^7.1.0",
        "postcss-selector-namespace": "^3.0.1",
        "sass": "^1.62.1",
+        "showdown": "^2.1.0",
        "sugarss": "^4.0.1",
        "tailwindcss": "^3.2.7",
        "vite": "^4.5.3"
@@ -1868,13 +1871,6 @@
        "node": ">=8.0.0"
      }
    },
-    "node_modules/dayjs": {
-      "version": "1.11.11",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.11.tgz",
-      "integrity": "sha512-okzr3f11N6WuqYtZSvm+F776mB41wRZMhKP+hc34YdW+KmtYYK9iqvHSwo2k9FEH3fhGXvOPV6yz2IcSrfRUDg==",
-      "dev": true,
-      "license": "MIT"
-    },
    "node_modules/debug": {
      "version": "3.2.7",
      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
@@ -2428,6 +2424,16 @@
        "node": ">= 0.4"
      }
    },
+    "node_modules/highlight.js": {
+      "version": "11.11.1",
+      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-11.11.1.tgz",
+      "integrity": "sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
    "node_modules/ignore": {
      "version": "5.3.1",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.1.tgz",
@@ -2705,6 +2711,33 @@
        "graceful-fs": "^4.1.6"
      }
    },
+    "node_modules/katex": {
+      "version": "0.16.22",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.22.tgz",
+      "integrity": "sha512-XCHRdUw4lf3SKBaJe4EvgqIuWwkPSo9XoeO8GjQW94Bp7TWv9hNhzZjZ+OH9yf1UmLygb7DIT5GSFQiyt16zYg==",
+      "dev": true,
+      "funding": [
+        "https://opencollective.com/katex",
+        "https://github.com/sponsors/katex"
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "commander": "^8.3.0"
+      },
+      "bin": {
+        "katex": "cli.js"
+      }
+    },
+    "node_modules/katex/node_modules/commander": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
+      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
    "node_modules/lilconfig": {
      "version": "2.1.0",
      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
@@ -2797,14 +2830,11 @@
      "license": "MIT"
    },
    "node_modules/lru-cache": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.2.2.tgz",
-      "integrity": "sha512-9hp3Vp2/hFQUiIwKo8XCeFVnrg8Pk3TYNPIR7tJADKi5YfcF7vEaK7avFHTlSy3kOKYaJQaalfEo6YuXdceBOQ==",
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": "14 || >=16.14"
-      }
+      "license": "ISC"
    },
    "node_modules/math-expression-evaluator": {
      "version": "1.4.0",
@@ -3154,6 +3184,13 @@
        "url": "https://github.com/sponsors/sindresorhus"
      }
    },
+    "node_modules/pdfobject": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/pdfobject/-/pdfobject-2.3.1.tgz",
+      "integrity": "sha512-vluuGiSDmMGpOvWFGiUY4trNB8aGKLDVxIXuuGHjX0kK3bMxCANUVtLivctE7uejLBScWCnbVarKatFVvdwXaQ==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/picocolors": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.1.tgz",
@@ -5325,6 +5362,33 @@
        "node": ">=8"
      }
    },
+    "node_modules/showdown": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/showdown/-/showdown-2.1.0.tgz",
+      "integrity": "sha512-/6NVYu4U819R2pUIk79n67SYgJHWCce0a5xTP979WbNp0FL9MN1I1QK662IDU1b6JzKTvmhgI7T7JYIxBi3kMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "commander": "^9.0.0"
+      },
+      "bin": {
+        "showdown": "bin/showdown.js"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://www.paypal.me/tiviesantos"
+      }
+    },
+    "node_modules/showdown/node_modules/commander": {
+      "version": "9.5.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
+      "integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || >=14"
+      }
+    },
    "node_modules/signal-exit": {
      "version": "4.1.0",
      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
--- a/package.json
+++ b/package.json
@@ -21,10 +21,12 @@
    "autoprefixer": "^10.4.14",
    "codemirror": "^6.0.1",
    "cssnano": "^5.1.15",
-    "dayjs": "^1.11.9",
    "github-markdown-css": "^5.5.0",
+    "highlight.js": "^11.11.1",
    "jdenticon": "^3.3.0",
+    "katex": "^0.16.22",
    "nodemon": "^2.0.22",
+    "pdfobject": "^2.3.1",
    "postcss": "^8.4.32",
    "postcss-cli": "^11.0.0",
    "postcss-cssnext": "^3.1.1",
@@ -32,6 +34,7 @@
    "postcss-loader": "^7.1.0",
    "postcss-selector-namespace": "^3.0.1",
    "sass": "^1.62.1",
+    "showdown": "^2.1.0",
    "sugarss": "^4.0.1",
    "tailwindcss": "^3.2.7",
    "vite": "^4.5.3"
--- a/public/editor.ts
+++ b/public/editor.ts
@@ -117,7 +117,11 @@ document.addEventListener("DOMContentLoaded", () => {
        let deleteBtns = dom.querySelector<HTMLButtonElement>("button.delete-file");
        if (deleteBtns !== null) {
            deleteBtns.onclick = () => {
-                editorsjs.splice(editorsjs.indexOf(editor), 1);
+                // For both text and binary files, just remove from DOM
+                if (!dom.hasAttribute('data-binary-original-name')) {
+                    // Only remove from editors array for text files
+                    editorsjs.splice(editorsjs.indexOf(editor), 1);
+                }
                dom.remove();
                checkForFirstDeleteButton();
            };
@@ -196,21 +200,27 @@ document.addEventListener("DOMContentLoaded", () => {
    let arr = Array.from(allEditorsdom);
    arr.forEach((el: HTMLElement) => {
        // in case we edit the gist contents
-        let currEditor = newEditor(el, el.querySelector<HTMLInputElement>(".form-filecontent")!.value);
-        editorsjs.push(currEditor);
+        let formFileContent =el.querySelector<HTMLInputElement>(".form-filecontent")
+        if (formFileContent !== null) {
+            let currEditor = newEditor(el, el.querySelector<HTMLInputElement>(".form-filecontent")!.value);
+            editorsjs.push(currEditor);
+        } else if (el.hasAttribute('data-binary-original-name')) {
+            // For binary files, just set up the delete button
+            let deleteBtn = el.querySelector<HTMLButtonElement>("button.delete-file");
+            if (deleteBtn) {
+                deleteBtn.onclick = () => {
+                    el.remove();
+                    checkForFirstDeleteButton();
+                };
+            }
+        }
    });

    checkForFirstDeleteButton();

    document.getElementById("add-file")!.onclick = () => {
-        let newEditorDom = firstEditordom.cloneNode(true) as HTMLElement;
-
-        // reset the filename of the new cloned element
-        newEditorDom.querySelector<HTMLInputElement>('input[name="name"]')!.value = "";
-
-        // removing the previous codemirror editor
-        let newEditorDomCM = newEditorDom.querySelector(".cm-editor");
-        newEditorDomCM!.remove();
+        const template = document.getElementById("editor-template")!;
+        const newEditorDom = template.firstElementChild!.cloneNode(true) as HTMLElement;

        // creating the new codemirror editor and append it in the editor div
        editorsjs.push(newEditor(newEditorDom));
@@ -220,9 +230,56 @@ document.addEventListener("DOMContentLoaded", () => {

    document.querySelector<HTMLFormElement>("form#create")!.onsubmit = () => {
        let j = 0;
-        document.querySelectorAll<HTMLInputElement>(".form-filecontent").forEach((e) => {
-            e.value = encodeURIComponent(editorsjs[j++].state.doc.toString());
+        document.querySelectorAll<HTMLInputElement>(".form-filecontent").forEach((el) => {
+            if (j < editorsjs.length) {
+                el.value = encodeURIComponent(editorsjs[j++].state.doc.toString());
+            }
        });
+
+        const fileInput = document.getElementById("file-upload") as HTMLInputElement;
+        if (fileInput) {
+            fileInput.remove();
+        }
+
+        const form = document.querySelector<HTMLFormElement>("form#create")!;
+
+        uploadedFileUUIDs.forEach((fileData) => {
+            const uuidInput = document.createElement('input');
+            uuidInput.type = 'hidden';
+            uuidInput.name = 'uploadedfile_uuid';
+            uuidInput.value = fileData.uuid;
+            form.appendChild(uuidInput);
+
+            const filenameInput = document.createElement('input');
+            filenameInput.type = 'hidden';
+            filenameInput.name = 'uploadedfile_filename';
+            filenameInput.value = fileData.filename;
+            form.appendChild(filenameInput);
+        });
+
+        const binaryFiles = document.querySelectorAll('[data-binary-original-name]');
+        binaryFiles.forEach((fileDiv) => {
+            const originalName = fileDiv.getAttribute('data-binary-original-name');
+            const fileNameInput = fileDiv.querySelector('.form-filename') as HTMLInputElement;
+
+            if (fileNameInput) {
+                fileNameInput.removeAttribute('name');
+            }
+
+            const oldNameInput = document.createElement('input');
+            oldNameInput.type = 'hidden';
+            oldNameInput.name = 'binary_old_name';
+            oldNameInput.value = originalName || '';
+            form.appendChild(oldNameInput);
+
+            const newNameInput = document.createElement('input');
+            newNameInput.type = 'hidden';
+            newNameInput.name = 'binary_new_name';
+            newNameInput.value = fileNameInput?.value || '';
+            form.appendChild(newNameInput);
+        });
+
+        window.onbeforeunload = null;
    };

    document.getElementById('gist-metadata-btn')!.onclick = (el) => {
@@ -239,16 +296,22 @@ document.addEventListener("DOMContentLoaded", () => {
    }

    function checkForFirstDeleteButton() {
-        let deleteBtn = editorsParentdom.querySelector<HTMLButtonElement>("button.delete-file")!;
-        if (editorsjs.length === 1) {
-            deleteBtn.classList.add("hidden");
-            deleteBtn.previousElementSibling.classList.remove("rounded-l-md");
-            deleteBtn.previousElementSibling.classList.add("rounded-md");
-        } else {
-            deleteBtn.classList.remove("hidden");
-            deleteBtn.previousElementSibling.classList.add("rounded-l-md");
-            deleteBtn.previousElementSibling.classList.remove("rounded-md");
-        }
+        // Count total files (both text and binary)
+        const totalFiles = editorsParentdom.querySelectorAll('.editor').length;
+
+        // Hide/show all delete buttons based on total file count
+        const deleteButtons = editorsParentdom.querySelectorAll<HTMLButtonElement>("button.delete-file");
+        deleteButtons.forEach(deleteBtn => {
+            if (totalFiles <= 1) {
+                deleteBtn.classList.add("hidden");
+                deleteBtn.previousElementSibling?.classList.remove("rounded-l-md");
+                deleteBtn.previousElementSibling?.classList.add("rounded-md");
+            } else {
+                deleteBtn.classList.remove("hidden");
+                deleteBtn.previousElementSibling?.classList.add("rounded-l-md");
+                deleteBtn.previousElementSibling?.classList.remove("rounded-md");
+            }
+        });
    }

    function showDeleteButton(editorDom: HTMLElement) {
@@ -259,7 +322,140 @@ document.addEventListener("DOMContentLoaded", () => {
        checkForFirstDeleteButton();
    }

-    document.onsubmit = () => {
-        window.onbeforeunload = null;
+    // File upload functionality
+    let uploadedFileUUIDs: {uuid: string, filename: string}[] = [];
+    const fileUploadInput = document.getElementById("file-upload") as HTMLInputElement;
+    const uploadedFilesContainer = document.getElementById("uploaded-files")!;
+    const fileUploadZone = document.getElementById("file-upload-zone")!.querySelector('.border-dashed') as HTMLElement;
+
+    // Handle file selection
+    const handleFiles = (files: FileList) => {
+        Array.from(files).forEach(file => {
+            if (!uploadedFileUUIDs.find(f => f.filename === file.name)) {
+                uploadFile(file);
+            }
+        });
    };
+
+    // Upload file to server
+    const uploadFile = async (file: File) => {
+        const formData = new FormData();
+        formData.append('file', file);
+
+        // @ts-ignore
+        const baseUrl = window.opengist_base_url || '';
+        const csrf = document.querySelector<HTMLInputElement>('form#create input[name="_csrf"]')?.value;
+
+        try {
+            const response = await fetch(`${baseUrl}/upload`, {
+                method: 'POST',
+                credentials: 'same-origin',
+                body: formData,
+                headers: {
+                    'X-CSRF-Token': csrf || ''
+                }
+            });
+
+            if (response.ok) {
+                const result = await response.json();
+                uploadedFileUUIDs.push({uuid: result.uuid, filename: result.filename});
+                addFileToUI(result.filename, result.uuid, file.size);
+            } else {
+                console.error('Upload failed:', response.statusText);
+            }
+        } catch (error) {
+            console.error('Upload error:', error);
+        }
+    };
+
+    // Add file to UI
+    const addFileToUI = (filename: string, uuid: string, fileSize: number) => {
+        const fileElement = document.createElement('div');
+        fileElement.className = 'flex items-stretch bg-gray-50 dark:bg-gray-800 border border-gray-200 dark:border-gray-700 rounded-md overflow-hidden';
+        fileElement.dataset.uuid = uuid;
+
+        fileElement.innerHTML = `
+            <div class="flex items-center space-x-3 px-3 py-1 flex-1">
+                <svg class="h-5 w-5 text-gray-400 dark:text-gray-500" fill="currentColor" viewBox="0 0 20 20">
+                    <path d="M4 4a2 2 0 012-2h4.586A2 2 0 0112 2.586L15.414 6A2 2 0 0116 7.414V16a2 2 0 01-2 2H6a2 2 0 01-2-2V4zm2 6a1 1 0 011-1h6a1 1 0 110 2H7a1 1 0 01-1-1zm1 3a1 1 0 100 2h6a1 1 0 100-2H7z"></path>
+                </svg>
+                <div>
+                    <p class="text-sm font-medium text-slate-700 dark:text-slate-300">${filename}</p>
+                    <p class="text-xs text-gray-500 dark:text-gray-400">${formatFileSize(fileSize)}</p>
+                </div>
+            </div>
+            <button type="button" class="remove-file flex items-center justify-center px-4 border-l-1 dark:border-l-1 text-rose-600 dark:text-rose-400 border-gray-200 dark:border-gray-600 bg-gray-50 dark:bg-gray-800 hover:bg-rose-500 hover:text-white dark:hover:bg-rose-600 hover:border-rose-600 dark:hover:border-rose-700 dark:hover:text-white focus:outline-none">
+                <svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                </svg>
+            </button>
+        `;
+
+        // Remove file handler
+        fileElement.querySelector('.remove-file')!.addEventListener('click', async () => {
+            // Remove from server
+            try {
+                // @ts-ignore
+                const baseUrl = window.opengist_base_url || '';
+                const csrf = document.querySelector<HTMLInputElement>('form#create input[name="_csrf"]')?.value;
+
+                await fetch(`${baseUrl}/upload/${uuid}`, {
+                    method: 'DELETE',
+                    credentials: 'same-origin',
+                    headers: {
+                        'X-CSRF-Token': csrf || ''
+                    }
+                });
+            } catch (error) {
+                console.error('Error deleting file:', error);
+            }
+
+            // Remove from UI and local array
+            uploadedFileUUIDs = uploadedFileUUIDs.filter(f => f.uuid !== uuid);
+            fileElement.remove();
+        });
+
+        uploadedFilesContainer.appendChild(fileElement);
+    };
+
+    // Format file size
+    const formatFileSize = (bytes: number): string => {
+        if (bytes === 0) return '0 B';
+        const k = 1024;
+        const sizes = ['B', 'KB', 'MB', 'GB'];
+        const i = Math.floor(Math.log(bytes) / Math.log(k));
+        return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i];
+    };
+
+    // File input change handler
+    fileUploadInput.addEventListener('change', (e) => {
+        const files = (e.target as HTMLInputElement).files;
+        if (files) {
+            handleFiles(files);
+            // Clear the input value immediately so it doesn't get submitted with the form
+            (e.target as HTMLInputElement).value = '';
+        }
+    });
+
+    // Drag and drop handlers
+    fileUploadZone.addEventListener('dragover', (e) => {
+        e.preventDefault();
+        fileUploadZone.classList.add('border-primary-400', 'dark:border-primary-500');
+    });
+
+    fileUploadZone.addEventListener('dragleave', (e) => {
+        e.preventDefault();
+        fileUploadZone.classList.remove('border-primary-400', 'dark:border-primary-500');
+    });
+
+    fileUploadZone.addEventListener('drop', (e) => {
+        e.preventDefault();
+        fileUploadZone.classList.remove('border-primary-400', 'dark:border-primary-500');
+        
+        const files = e.dataTransfer?.files;
+        if (files) {
+            handleFiles(files);
+        }
+    });
+
 });
--- a/public/fs_embed.go
+++ b/public/fs_embed.go
@@ -4,5 +4,5 @@ package public

 import "embed"

-//go:embed manifest.json assets/*.js assets/*.css assets/*.svg assets/*.png
+//go:embed manifest.json assets/*.js assets/*.css assets/*.svg assets/*.png assets/*.ttf assets/*.woff assets/*.woff2
 var Files embed.FS
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Thomas Miceli	c7b947580d	v1.11.0	2025-09-21 04:51:49 +02:00
Thomas Miceli	4106956f6d	Fix human date on iOS devices (#510 )	2025-09-21 04:31:58 +02:00
Fabio Manganiello	c02bf97b63	feat: Add support for rendering .ipynb Jupyter/IPython notebooks (#491 )	2025-09-21 03:48:59 +02:00
Thomas Miceli	53ce41e0e4	Add file upload on gist creation/edition (#507 )	2025-09-16 01:56:38 +02:00
Thomas Miceli	594d876ba8	Add binary files support (#503 )	2025-09-16 01:35:54 +02:00
Thomas Miceli	905276f24b	Init gist with regular urls via git CLI (http) (#501 )	2025-08-28 02:44:09 +02:00
Sebastian Ertz	2976173658	Update go dep chroma (#493 )	2025-08-18 16:05:07 +02:00
Thomas Miceli	b048203216	Use db for queue (#498 )	2025-08-18 16:01:50 +02:00
Thomas Miceli	a7a25c4100	Fix LDAP with valid old password login (#497 )	2025-08-14 11:10:45 +02:00
Alex Martens	bb1991f3ca	Add OIDC group claim name to OpenID request (#490 ) This fixes Kanidm compatibility.	2025-08-01 17:55:34 +02:00
Thomas Miceli	979b302e4c	Add listen to Unix websocket (#484 )	2025-08-01 17:34:52 +02:00
s1shed	b18cdb9188	Redirect to $baseUrl after auth with passkey instead of / (#482 ) Fixes: #481	2025-07-01 14:40:33 +02:00
Aly Smith	867aa6e57b	Replace unicode characters with HTML entity codes in embed template (#480 )	2025-07-01 14:39:47 +02:00
Thomas Miceli	3c0115d829	Fix Markdown preview links (#475 )	2025-05-15 15:16:40 +02:00
Thomas Miceli	d796895b75	Fix filename unescape (#474 )	2025-05-14 11:51:42 +02:00
Andy Piper	5542497622	Add Proxmox VE Helper-Script (#473 )	2025-05-14 10:49:27 +02:00
Thomas Miceli	546f1968e0	Fix helm ci	2025-05-09 20:16:57 +02:00
Thomas Miceli	75e71fd042	Use Helm deployment.env[] values (#471 )	2025-05-09 20:08:25 +02:00
Thomas Miceli	897dc43790	Add LDAP authentication (#470 ) * Introduce basic LDAP authentication. * Reformat LDAP code; use ldap in Git HTTP * lint --------- Co-authored-by: Santhosh Raju <santhosh.raju@gmail.com>	2025-05-09 19:32:22 +02:00
Johannes Kirchner	72e02700ec	fix: Correct German spelling, use consistent wording (#468 )	2025-05-05 15:04:28 +02:00
Thomas Miceli	dc43fccc04	Style preference tab for user (#467 )	2025-05-05 01:31:42 +02:00
Sergey Ryazanov	0e9b778b45	Fix Gitlab avatar (#461 ) * Fix GitLab user avatar method * Fix size of Gitlab avatar	2025-05-05 00:46:29 +02:00
Johannes Kirchner	3c940cd81f	feat: read psql sslmode from db uri (#462 )	2025-05-05 00:29:13 +02:00
Thomas Miceli	de144d09d3	Update README.md	2025-04-09 15:45:38 +02:00
Thomas Miceli	fde8a85e2b	v1.10.0	2025-04-07 16:31:45 +02:00
Thomas Miceli	b82b3d9e0e	Update Go deps (#455 )	2025-04-06 01:11:44 +02:00
Thomas Miceli	9e69677f58	Add Helm Chart (#454 )	2025-04-06 00:51:38 +02:00
Thomas Miceli	2d8debecbe	Translations update from Opengist (#438 ) * Added translation using Weblate (Japanese) * Translated using Weblate (Japanese) Currently translated at 15.8% (47 of 297 strings) Translation: Opengist/Opengist Translate-URL: http://tr.opengist.io/projects/_/opengist/ja/ * Translated using Weblate (Chinese (Simplified Han script)) Currently translated at 100.0% (297 of 297 strings) Translation: Opengist/Opengist Translate-URL: http://tr.opengist.io/projects/_/opengist/zh_Hans/ --------- Co-authored-by: YoshichikaAAA <isthisyourpen@gmail.com> Co-authored-by: Ricky <1173024819@qq.com>	2025-04-06 00:51:18 +02:00
Johannes Kirchner	8cfaceb303	feat: read admin group from OIDC token claim (#445 )	2025-04-02 13:38:11 +02:00
jmjl	7907c7bc1e	Fix gist.html using relative URL (#451 ) Due to the fact the file templates/base/base_header.html contains a <base> element, all relative URLs are interpreted as dependant on the base.[1] I've noticed the base isn't the current page, but the element linking to anchor identifier isn't using the complete URL to the gist page, which means that if you go to a gist, and try to click on the link that leads you to the file (which would make browsers automatically go down if it's a file that has a lot of lines), you get taken to the homepage, and unless you look at the URL closely you wouldn't notice the fragment/anchor part. I'm sure there's a better way of dealing with this, such as removing <base> from the template mentioned above, but due to the fact I'd like to have this work, I've made it put the full URL to this page. Something that might be good to do is making the relative URLs always be absolute, by having the '{{ $.c.ExternalUrl }}' thing everywhere where a relative URL would be, as that'd probably fix #415, and would allow for this commit to be reverted if that's desired. [1] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/base	2025-03-31 23:07:01 +02:00
Philipp Eckel	e3aa994d30	fix: do not hide file delete button on gist edit page (#447 )	2025-03-31 22:44:04 +02:00
Ross A. Baker	91df15f957	Allow lag between admin invitation creation and test assertion (#452 )	2025-03-31 11:53:12 +02:00
Thomas Miceli	efba783c56	Add Meilisearch indexer (#444 )	2025-03-19 23:28:04 +01:00
Philipp Eckel	dbdfcd4e85	feat: add option to name an OIDC provider (#435 )	2025-03-17 17:19:48 +01:00
awkj	da0b440360	Fix garbled/mojibake text display issues for non-English Unicode characters in browsers. (#441 ) * Update util.go Fix garbled/mojibake text display issues for non-English Unicode characters in browsers. * add Content-Disposition, help handle file name on download Author: awkj <hzzbiu@gmail.com>	2025-03-17 16:22:54 +01:00
Thomas Miceli	d53885c541	Fix test database with go command (#442 )	2025-03-17 16:17:53 +01:00
Philipp Eckel	1ec026e191	feat: add Prometheus metrics (#439 ) * feat: add Prometheus metrics * setup metrics using Prometheus client under /metrics endpoint * add configuration value for metrics * configure Prometheus middleware for generic metrics * provide metrics for totals of users, gists and SSH keys * modify test request to optionally return the response * provide integration test for Prometheus metrics * update documentation * chore: make fmt	2025-03-17 14:30:38 +01:00