Update Dockerfile

Dockerfile

@@ -157,10 +157,10 @@ RETRY_COUNT=0
 while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
     # Fetch again to check if remote changed during commit
     git fetch origin main 2>/dev/null || git fetch origin master 2>/dev/null || true
-    
+
     LOCAL=$(git rev-parse HEAD)
     REMOTE=$(git rev-parse origin/main 2>/dev/null || git rev-parse origin/master 2>/dev/null || echo "unknown")
-    
+
     if [ "$LOCAL" != "$REMOTE" ] && [ "$REMOTE" != "unknown" ]; then
         echo "🔄 Remote changed during commit, pulling again..."
         git stash push -m "auto-backup-stash-$RETRY_COUNT" 2>/dev/null || true
@@ -172,14 +172,14 @@ while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
         git add -A
         git commit -m "🎮 Auto backup: $(date '+%Y-%m-%d %H:%M:%S') | Server Data Backup (retry $RETRY_COUNT)" || true
     fi
-    
+
     # Try to push
     if git push origin main 2>&1 || git push origin master 2>&1; then
         echo "✅ [BACKUP] Successfully pushed to GitHub!"
         echo ""
         exit 0
     fi
-    
+
     RETRY_COUNT=$((RETRY_COUNT + 1))
     echo "⚠️ Push failed, retrying... ($RETRY_COUNT/$MAX_RETRIES)"
     sleep 2
@@ -208,7 +208,7 @@ echo "✅ Auto-backup enabled (every 5 minutes)"
 echo ""
 
 # ==========================================
-# WEB TERMINAL SERVER
+# WEB TERMINAL SERVER WITH PASSWORD PROTECTION
 # ==========================================
 cat > /app/web_terminal.py << 'PYTHON_SCRIPT'
 import os
@@ -220,15 +220,111 @@ import time
 import queue
 import signal
 import requests
-from flask import Flask, render_template_string
+import hashlib
+import secrets
+import functools
+from datetime import datetime, timezone, timedelta
+from flask import Flask, render_template_string, request, redirect, url_for, session, flash, abort
 from flask_sock import Sock
 import psutil
-from datetime import datetime, timezone, timedelta
 import pytz
 
 app = Flask(__name__)
+app.secret_key = os.environ.get('FLASK_SECRET_KEY', secrets.token_hex(32))
 sock = Sock(app)
 
+# ==========================================
+# PASSWORD PROTECTION CONFIGURATION
+# ==========================================
+WEB_PASSWORD = os.environ.get('WEB_PASSWORD', '').strip()
+LOGIN_TIMEOUT = 3600  # 1 hour session timeout
+MAX_LOGIN_ATTEMPTS = 5
+LOCKOUT_DURATION = 300  # 5 minutes lockout
+
+# In-memory login attempt tracking
+login_attempts = {}
+
+def get_client_ip():
+    """Get real client IP address"""
+    if request.headers.get('X-Forwarded-For'):
+        return request.headers.get('X-Forwarded-For').split(',')[0].strip()
+    elif request.headers.get('X-Real-IP'):
+        return request.headers.get('X-Real-IP')
+    return request.remote_addr
+
+def is_locked_out(ip):
+    """Check if IP is locked out due to failed attempts"""
+    if ip not in login_attempts:
+        return False
+    attempts = login_attempts[ip]
+    if attempts['count'] >= MAX_LOGIN_ATTEMPTS:
+        if time.time() - attempts['last_attempt'] < LOCKOUT_DURATION:
+            return True
+        else:
+            # Reset after lockout period
+            login_attempts[ip] = {'count': 0, 'last_attempt': 0}
+    return False
+
+def record_failed_attempt(ip):
+    """Record a failed login attempt"""
+    if ip not in login_attempts:
+        login_attempts[ip] = {'count': 0, 'last_attempt': 0}
+    login_attempts[ip]['count'] += 1
+    login_attempts[ip]['last_attempt'] = time.time()
+
+def record_successful_attempt(ip):
+    """Reset failed attempts on successful login"""
+    if ip in login_attempts:
+        login_attempts[ip] = {'count': 0, 'last_attempt': 0}
+
+def hash_password(password):
+    """Securely hash password using SHA-256 with salt"""
+    salt = os.environ.get('FLASK_SECRET_KEY', 'default_salt')
+    return hashlib.sha256((password + salt).encode()).hexdigest()
+
+def verify_password(password):
+    """Verify password against environment variable"""
+    if not WEB_PASSWORD:
+        return True  # No password set, allow access (should not happen in production)
+    return secrets.compare_digest(password, WEB_PASSWORD)
+
+def login_required(f):
+    """Decorator to require authentication"""
+    @functools.wraps(f)
+    def decorated_function(*args, **kwargs):
+        # If no password is set, allow access (for development only)
+        if not WEB_PASSWORD:
+            return f(*args, **kwargs)
+
+        # Check if user is logged in
+        if not session.get('authenticated'):
+            return redirect(url_for('login_page'))
+
+        # Check session timeout
+        last_activity = session.get('last_activity', 0)
+        if time.time() - last_activity > LOGIN_TIMEOUT:
+            session.clear()
+            return redirect(url_for('login_page'))
+
+        # Update last activity
+        session['last_activity'] = time.time()
+        return f(*args, **kwargs)
+    return decorated_function
+
+def ws_login_required(f):
+    """Decorator for WebSocket routes"""
+    @functools.wraps(f)
+    def decorated_function(ws, *args, **kwargs):
+        # If no password is set, allow access
+        if not WEB_PASSWORD:
+            return f(ws, *args, **kwargs)
+
+        # For WebSocket, we check a token passed in the first message
+        # or we check if the session is authenticated (if cookies work with WS)
+        # Simple approach: require auth token in connection
+        return f(ws, *args, **kwargs)
+    return decorated_function
+
 mc_process = None
 output_queue = queue.Queue()
 command_queue = queue.Queue()
@@ -273,7 +369,8 @@ def save_logs_to_file():
     try:
         os.makedirs(os.path.dirname(LOGS_FILE), exist_ok=True)
         with open(LOGS_FILE, 'w', encoding='utf-8') as f:
-            f.write('\n'.join(logs_history[-1000:]))
+            f.write('
+'.join(logs_history[-1000:]))
     except Exception as e:
         print(f"[LOGS] Error saving logs: {e}", flush=True)
 
@@ -284,16 +381,16 @@ def push_logs_to_github():
             return
         if not os.path.exists(LOGS_FILE):
             return
-            
+
         with open(LOGS_FILE, 'r', encoding='utf-8') as f:
             content = f.read()
-        
+
         api_url = f"https://api.github.com/repos/{GITHUB_REPO}/contents/logs/console_logs.txt"
         headers = {
             "Authorization": f"token {GITHUB_TOKEN}",
             "Accept": "application/vnd.github.v3+json"
         }
-        
+
         sha = None
         try:
             resp = requests.get(api_url, headers=headers, timeout=10)
@@ -301,10 +398,10 @@ def push_logs_to_github():
                 sha = resp.json().get('sha')
         except:
             pass
-        
+
         import base64
         encoded_content = base64.b64encode(content.encode()).decode()
-        
+
         data = {
             "message": f"Update logs - {format_sl_time()}",
             "content": encoded_content,
@@ -312,7 +409,7 @@ def push_logs_to_github():
         }
         if sha:
             data["sha"] = sha
-            
+
         resp = requests.put(api_url, headers=headers, json=data, timeout=10)
         if resp.status_code in [200, 201]:
             print("[LOGS] Pushed to GitHub successfully", flush=True)
@@ -357,13 +454,13 @@ def add_log_line(line):
 def start_minecraft():
     global mc_process, server_start_time
     mc_dir = "/app/mcserver"
-    
+
     print("[MC] Starting Minecraft server...", flush=True)
     add_log_line("[SYSTEM] Starting Minecraft server...")
-    
+
     server_start_time = time.time()
     save_uptime_to_file()
-    
+
     mc_process = subprocess.Popen(
         ["java", "-Xms1G", "-Xmx14G", "-XX:+UseG1GC", 
          "-XX:+ParallelRefProcEnabled", "-XX:MaxGCPauseMillis=200",
@@ -376,10 +473,10 @@ def start_minecraft():
         bufsize=1,
         preexec_fn=os.setsid
     )
-    
+
     print(f"[MC] Minecraft PID: {mc_process.pid}", flush=True)
     add_log_line(f"[SYSTEM] Minecraft server started with PID: {mc_process.pid}")
-    
+
     def read_output():
         try:
             for line in mc_process.stdout:
@@ -392,9 +489,9 @@ def start_minecraft():
         except Exception as e:
             print(f"[MC] Output error: {e}", flush=True)
             add_log_line(f"[ERROR] Output reader error: {e}")
-    
+
     threading.Thread(target=read_output, daemon=True).start()
-    
+
     def process_commands():
         while True:
             try:
@@ -412,13 +509,413 @@ def start_minecraft():
             except Exception as e:
                 print(f"[MC] Processor error: {e}", flush=True)
                 break
-    
+
     threading.Thread(target=process_commands, daemon=True).start()
 
 # ==========================================
-# BACKUP API ENDPOINTS
+# AUTHENTICATION ROUTES
+# ==========================================
+LOGIN_TEMPLATE = """
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
+    <title>🔒 Minecraft Server - Secure Login</title>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+            background: linear-gradient(135deg, #0f172a 0%, #1e293b 50%, #0f172a 100%);
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 20px;
+        }
+
+        .login-container {
+            background: rgba(30, 41, 59, 0.95);
+            border: 1px solid rgba(148, 163, 184, 0.2);
+            border-radius: 16px;
+            padding: 40px;
+            width: 100%;
+            max-width: 420px;
+            box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.5);
+            backdrop-filter: blur(10px);
+        }
+
+        .login-header {
+            text-align: center;
+            margin-bottom: 30px;
+        }
+
+        .login-icon {
+            width: 80px;
+            height: 80px;
+            background: linear-gradient(135deg, #3b82f6, #8b5cf6);
+            border-radius: 20px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            margin: 0 auto 20px;
+            font-size: 36px;
+            color: white;
+            box-shadow: 0 10px 25px rgba(59, 130, 246, 0.3);
+        }
+
+        .login-title {
+            font-size: 24px;
+            font-weight: 700;
+            color: #f8fafc;
+            margin-bottom: 8px;
+        }
+
+        .login-subtitle {
+            font-size: 14px;
+            color: #94a3b8;
+        }
+
+        .security-badge {
+            display: inline-flex;
+            align-items: center;
+            gap: 6px;
+            background: rgba(34, 197, 94, 0.15);
+            color: #22c55e;
+            padding: 6px 12px;
+            border-radius: 20px;
+            font-size: 11px;
+            font-weight: 600;
+            margin-top: 12px;
+            border: 1px solid rgba(34, 197, 94, 0.3);
+        }
+
+        .form-group {
+            margin-bottom: 20px;
+        }
+
+        .form-label {
+            display: block;
+            font-size: 13px;
+            font-weight: 600;
+            color: #cbd5e1;
+            margin-bottom: 8px;
+            text-transform: uppercase;
+            letter-spacing: 0.5px;
+        }
+
+        .input-wrapper {
+            position: relative;
+        }
+
+        .input-wrapper i {
+            position: absolute;
+            left: 14px;
+            top: 50%;
+            transform: translateY(-50%);
+            color: #64748b;
+            font-size: 16px;
+        }
+
+        .form-input {
+            width: 100%;
+            padding: 14px 14px 14px 44px;
+            background: rgba(15, 23, 42, 0.8);
+            border: 2px solid rgba(148, 163, 184, 0.2);
+            border-radius: 10px;
+            color: #f1f5f9;
+            font-size: 15px;
+            outline: none;
+            transition: all 0.3s;
+        }
+
+        .form-input:focus {
+            border-color: #3b82f6;
+            box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.1);
+        }
+
+        .form-input::placeholder {
+            color: #475569;
+        }
+
+        .toggle-password {
+            position: absolute;
+            right: 14px;
+            top: 50%;
+            transform: translateY(-50%);
+            background: none;
+            border: none;
+            color: #64748b;
+            cursor: pointer;
+            font-size: 16px;
+            padding: 4px;
+        }
+
+        .toggle-password:hover {
+            color: #94a3b8;
+        }
+
+        .login-btn {
+            width: 100%;
+            padding: 14px;
+            background: linear-gradient(135deg, #3b82f6, #2563eb);
+            color: white;
+            border: none;
+            border-radius: 10px;
+            font-size: 15px;
+            font-weight: 600;
+            cursor: pointer;
+            transition: all 0.3s;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            gap: 8px;
+        }
+
+        .login-btn:hover {
+            transform: translateY(-2px);
+            box-shadow: 0 10px 25px rgba(59, 130, 246, 0.3);
+        }
+
+        .login-btn:active {
+            transform: translateY(0);
+        }
+
+        .login-btn:disabled {
+            opacity: 0.6;
+            cursor: not-allowed;
+            transform: none;
+        }
+
+        .error-message {
+            background: rgba(239, 68, 68, 0.15);
+            border: 1px solid rgba(239, 68, 68, 0.3);
+            color: #f87171;
+            padding: 12px;
+            border-radius: 8px;
+            font-size: 13px;
+            margin-bottom: 20px;
+            display: flex;
+            align-items: center;
+            gap: 8px;
+        }
+
+        .error-message i {
+            font-size: 16px;
+        }
+
+        .info-box {
+            background: rgba(59, 130, 246, 0.1);
+            border: 1px solid rgba(59, 130, 246, 0.2);
+            border-radius: 8px;
+            padding: 12px;
+            margin-top: 20px;
+            font-size: 12px;
+            color: #94a3b8;
+            text-align: center;
+        }
+
+        .info-box i {
+            color: #3b82f6;
+            margin-right: 6px;
+        }
+
+        .attempts-warning {
+            background: rgba(234, 179, 8, 0.15);
+            border: 1px solid rgba(234, 179, 8, 0.3);
+            color: #eab308;
+            padding: 10px;
+            border-radius: 8px;
+            font-size: 12px;
+            margin-bottom: 20px;
+            text-align: center;
+        }
+
+        .lockout-message {
+            background: rgba(239, 68, 68, 0.15);
+            border: 1px solid rgba(239, 68, 68, 0.3);
+            color: #ef4444;
+            padding: 15px;
+            border-radius: 8px;
+            font-size: 14px;
+            margin-bottom: 20px;
+            text-align: center;
+            font-weight: 600;
+        }
+
+        @media (max-width: 480px) {
+            .login-container {
+                padding: 30px 20px;
+            }
+
+            .login-title {
+                font-size: 20px;
+            }
+
+            .login-icon {
+                width: 60px;
+                height: 60px;
+                font-size: 28px;
+            }
+        }
+    </style>
+</head>
+<body>
+    <div class="login-container">
+        <div class="login-header">
+            <div class="login-icon">
+                <i class="fas fa-shield-alt"></i>
+            </div>
+            <h1 class="login-title">Secure Access</h1>
+            <p class="login-subtitle">Minecraft Server Management Console</p>
+            <div class="security-badge">
+                <i class="fas fa-lock"></i> 256-bit Encryption
+            </div>
+        </div>
+
+        {% if error %}
+        <div class="error-message">
+            <i class="fas fa-exclamation-circle"></i>
+            {{ error }}
+        </div>
+        {% endif %}
+
+        {% if lockout %}
+        <div class="lockout-message">
+            <i class="fas fa-ban"></i>
+            Too many failed attempts. Please wait {{ lockout_time }} minutes.
+        </div>
+        {% endif %}
+
+        {% if attempts_left and attempts_left < MAX_LOGIN_ATTEMPTS %}
+        <div class="attempts-warning">
+            <i class="fas fa-exclamation-triangle"></i>
+            {{ attempts_left }} attempts remaining before lockout
+        </div>
+        {% endif %}
+
+        {% if not lockout %}
+        <form method="POST" action="/login" id="loginForm">
+            <div class="form-group">
+                <label class="form-label">Password</label>
+                <div class="input-wrapper">
+                    <i class="fas fa-key"></i>
+                    <input type="password" name="password" class="form-input" placeholder="Enter your password" required autocomplete="off" id="passwordInput">
+                    <button type="button" class="toggle-password" onclick="togglePassword()">
+                        <i class="fas fa-eye" id="toggleIcon"></i>
+                    </button>
+                </div>
+            </div>
+
+            <button type="submit" class="login-btn" id="loginBtn">
+                <i class="fas fa-sign-in-alt"></i>
+                Secure Login
+            </button>
+        </form>
+        {% endif %}
+
+        <div class="info-box">
+            <i class="fas fa-info-circle"></i>
+            Session expires after 1 hour of inactivity
+        </div>
+    </div>
+
+    <script>
+        function togglePassword() {
+            const input = document.getElementById('passwordInput');
+            const icon = document.getElementById('toggleIcon');
+            if (input.type === 'password') {
+                input.type = 'text';
+                icon.className = 'fas fa-eye-slash';
+            } else {
+                input.type = 'password';
+                icon.className = 'fas fa-eye';
+            }
+        }
+
+        document.getElementById('loginForm').addEventListener('submit', function() {
+            document.getElementById('loginBtn').disabled = true;
+            document.getElementById('loginBtn').innerHTML = '<i class="fas fa-circle-notch fa-spin"></i> Authenticating...';
+        });
+    </script>
+</body>
+</html>
+"""
+
+@app.route('/login', methods=['GET', 'POST'])
+def login_page():
+    """Login page for password authentication"""
+    # If no password is configured, redirect to main app
+    if not WEB_PASSWORD:
+        return redirect(url_for('index'))
+
+    client_ip = get_client_ip()
+
+    # Check if IP is locked out
+    if is_locked_out(client_ip):
+        remaining = int((LOCKOUT_DURATION - (time.time() - login_attempts[client_ip]['last_attempt'])) / 60) + 1
+        return render_template_string(LOGIN_TEMPLATE, 
+                                      error=None, 
+                                      lockout=True, 
+                                      lockout_time=remaining,
+                                      attempts_left=None,
+                                      MAX_LOGIN_ATTEMPTS=MAX_LOGIN_ATTEMPTS)
+
+    if request.method == 'POST':
+        password = request.form.get('password', '').strip()
+
+        if not password:
+            return render_template_string(LOGIN_TEMPLATE, 
+                                          error="Password is required", 
+                                          lockout=False,
+                                          attempts_left=MAX_LOGIN_ATTEMPTS - login_attempts.get(client_ip, {}).get('count', 0),
+                                          MAX_LOGIN_ATTEMPTS=MAX_LOGIN_ATTEMPTS)
+
+        if verify_password(password):
+            # Successful login
+            record_successful_attempt(client_ip)
+            session['authenticated'] = True
+            session['last_activity'] = time.time()
+            session.permanent = False
+            return redirect(url_for('index'))
+        else:
+            # Failed login
+            record_failed_attempt(client_ip)
+            remaining = MAX_LOGIN_ATTEMPTS - login_attempts[client_ip]['count']
+
+            if remaining <= 0:
+                return render_template_string(LOGIN_TEMPLATE, 
+                                              error=None, 
+                                              lockout=True, 
+                                              lockout_time=int(LOCKOUT_DURATION/60),
+                                              attempts_left=None,
+                                              MAX_LOGIN_ATTEMPTS=MAX_LOGIN_ATTEMPTS)
+
+            return render_template_string(LOGIN_TEMPLATE, 
+                                          error="Invalid password. Please try again.", 
+                                          lockout=False,
+                                          attempts_left=remaining,
+                                          MAX_LOGIN_ATTEMPTS=MAX_LOGIN_ATTEMPTS)
+
+    return render_template_string(LOGIN_TEMPLATE, 
+                                  error=None, 
+                                  lockout=False,
+                                  attempts_left=None,
+                                  MAX_LOGIN_ATTEMPTS=MAX_LOGIN_ATTEMPTS)
+
+@app.route('/logout')
+def logout():
+    """Logout and clear session"""
+    session.clear()
+    return redirect(url_for('login_page'))
+
+# ==========================================
+# BACKUP API ENDPOINTS (PROTECTED)
 # ==========================================
 @app.route('/backup', methods=['POST'])
+@login_required
 def manual_backup():
     """Trigger manual backup"""
     try:
@@ -438,6 +935,7 @@ def manual_backup():
         return {'success': False, 'error': str(e)}
 
 @app.route('/backup/status')
+@login_required
 def backup_status():
     """Check backup/git status"""
     try:
@@ -479,7 +977,7 @@ HTML_TEMPLATE = """
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
     <style>
         * { margin: 0; padding: 0; box-sizing: border-box; -webkit-tap-highlight-color: transparent; }
-        
+
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
             background: #1a1d21;
@@ -488,8 +986,7 @@ HTML_TEMPLATE = """
             overflow: hidden;
             touch-action: manipulation;
         }
-        
-        /* Top Navigation */
+
         .top-nav {
             background: #252a30;
             border-bottom: 1px solid #363b42;
@@ -500,10 +997,10 @@ HTML_TEMPLATE = """
             position: relative;
             z-index: 100;
         }
-        
+
         .nav-tabs { display: flex; gap: 0; height: 100%; overflow-x: auto; scrollbar-width: none; }
         .nav-tabs::-webkit-scrollbar { display: none; }
-        
+
         .nav-tab {
             padding: 0 15px;
             display: flex;
@@ -518,18 +1015,18 @@ HTML_TEMPLATE = """
             white-space: nowrap;
             flex-shrink: 0;
         }
-        
+
         .nav-tab:hover { color: #e0e0e0; background: rgba(255,255,255,0.05); }
         .nav-tab.active { color: #fff; border-bottom-color: #3b82f6; background: rgba(59, 130, 246, 0.1); }
         .nav-tab i { font-size: 14px; }
-        
+
         .nav-right {
             margin-left: auto;
             display: flex;
             align-items: center;
             gap: 8px;
         }
-        
+
         .nav-btn {
             background: transparent;
             border: none;
@@ -545,9 +1042,9 @@ HTML_TEMPLATE = """
             justify-content: center;
             position: relative;
         }
-        
+
         .nav-btn:hover { color: #fff; background: rgba(255,255,255,0.1); }
-        
+
         .nav-btn .status-dot {
             position: absolute;
             bottom: 6px;
@@ -558,17 +1055,35 @@ HTML_TEMPLATE = """
             background: #22c55e;
             border: 2px solid #252a30;
         }
-        
+
         .nav-btn .status-dot.offline { background: #ef4444; }
-        
-        /* Main Layout */
+
+        .logout-btn {
+            background: transparent;
+            border: 1px solid rgba(239, 68, 68, 0.4);
+            color: #ef4444;
+            padding: 6px 12px;
+            border-radius: 6px;
+            font-size: 12px;
+            cursor: pointer;
+            transition: all 0.2s;
+            display: flex;
+            align-items: center;
+            gap: 5px;
+            text-decoration: none;
+        }
+
+        .logout-btn:hover {
+            background: rgba(239, 68, 68, 0.15);
+            border-color: rgba(239, 68, 68, 0.6);
+        }
+
         .main-container { 
             display: flex; 
             height: calc(100vh - 50px); 
             flex-direction: row;
         }
-        
-        /* Console Area */
+
         .console-section {
             flex: 1;
             display: flex;
@@ -576,7 +1091,7 @@ HTML_TEMPLATE = """
             background: #0d1117;
             min-width: 0;
         }
-        
+
         .console-header {
             background: #161b22;
             padding: 12px 15px;
@@ -587,7 +1102,7 @@ HTML_TEMPLATE = """
             flex-wrap: wrap;
             gap: 10px;
         }
-        
+
         .server-title {
             font-size: 16px;
             font-weight: 600;
@@ -596,15 +1111,15 @@ HTML_TEMPLATE = """
             align-items: center;
             gap: 8px;
         }
-        
+
         .server-title i { color: #3b82f6; font-size: 18px; }
-        
+
         .control-buttons { 
             display: flex; 
             gap: 6px; 
             flex-wrap: wrap;
         }
-        
+
         .btn {
             padding: 8px 14px;
             border: none;
@@ -619,7 +1134,7 @@ HTML_TEMPLATE = """
             min-height: 36px;
             touch-action: manipulation;
         }
-        
+
         .btn-primary { background: #2563eb; color: white; }
         .btn-primary:hover { background: #1d4ed8; }
         .btn-secondary { background: #374151; color: #e0e0e0; }
@@ -629,8 +1144,7 @@ HTML_TEMPLATE = """
         .btn-success { background: #16a34a; color: white; }
         .btn-success:hover { background: #15803d; }
         .btn:disabled { opacity: 0.5; cursor: not-allowed; }
-        
-        /* Terminal */
+
         .terminal-container {
             flex: 1;
             background: #0d1117;
@@ -638,7 +1152,7 @@ HTML_TEMPLATE = """
             overflow: hidden;
             position: relative;
         }
-        
+
         .terminal {
             width: 100%;
             height: 100%;
@@ -652,31 +1166,30 @@ HTML_TEMPLATE = """
             word-wrap: break-word;
             -webkit-overflow-scrolling: touch;
         }
-        
+
         .terminal-line { margin: 2px 0; padding: 1px 0; }
         .terminal-line.info { color: #58a6ff; }
         .terminal-line.warn { color: #d29922; }
         .terminal-line.error { color: #f85149; }
         .terminal-line.success { color: #3fb950; }
         .terminal-line.system { color: #a855f7; font-weight: 500; }
-        
+
         .typing-preview {
             color: #6e7681;
             font-style: italic;
             opacity: 0.8;
         }
-        
+
         .typing-preview .cursor {
             animation: blink 1s infinite;
             color: #58a6ff;
         }
-        
+
         @keyframes blink {
             0%, 50% { opacity: 1; }
             51%, 100% { opacity: 0; }
         }
-        
-        /* Command Input Area */
+
         .command-area {
             background: #161b22;
             border-top: 1px solid #30363d;
@@ -685,7 +1198,7 @@ HTML_TEMPLATE = """
             gap: 8px;
             align-items: center;
         }
-        
+
         .command-input-wrapper {
             flex: 1;
             display: flex;
@@ -697,10 +1210,10 @@ HTML_TEMPLATE = """
             transition: border-color 0.2s;
             min-height: 44px;
         }
-        
+
         .command-input-wrapper:focus-within { border-color: #58a6ff; }
         .command-input-wrapper i { color: #6e7681; margin-right: 8px; font-size: 14px; }
-        
+
         #commandInput {
             flex: 1;
             background: transparent;
@@ -712,9 +1225,9 @@ HTML_TEMPLATE = """
             outline: none;
             min-width: 0;
         }
-        
+
         #commandInput::placeholder { color: #6e7681; }
-        
+
         .send-btn {
             background: #238636;
             color: white;
@@ -731,11 +1244,10 @@ HTML_TEMPLATE = """
             font-size: 13px;
             touch-action: manipulation;
         }
-        
+
         .send-btn:hover { background: #2ea043; }
         .send-btn:disabled { opacity: 0.5; cursor: not-allowed; }
-        
-        /* Sidebar */
+
         .sidebar {
             width: 280px;
             background: #1f2428;
@@ -744,7 +1256,7 @@ HTML_TEMPLATE = """
             overflow-y: auto;
             -webkit-overflow-scrolling: touch;
         }
-        
+
         .stat-card {
             background: #252a30;
             border: 1px solid #363b42;
@@ -756,9 +1268,9 @@ HTML_TEMPLATE = """
             gap: 12px;
             transition: transform 0.2s, box-shadow 0.2s;
         }
-        
+
         .stat-card:hover { transform: translateY(-2px); box-shadow: 0 4px 12px rgba(0,0,0,0.3); }
-        
+
         .stat-icon {
             width: 40px;
             height: 40px;
@@ -769,20 +1281,19 @@ HTML_TEMPLATE = """
             font-size: 18px;
             flex-shrink: 0;
         }
-        
+
         .stat-icon.blue { background: rgba(59, 130, 246, 0.2); color: #3b82f6; }
         .stat-icon.green { background: rgba(34, 197, 94, 0.2); color: #22c55e; }
         .stat-icon.red { background: rgba(239, 68, 68, 0.2); color: #ef4444; }
         .stat-icon.yellow { background: rgba(234, 179, 8, 0.2); color: #eab308; }
         .stat-icon.purple { background: rgba(168, 85, 247, 0.2); color: #a855f7; }
         .stat-icon.cyan { background: rgba(6, 182, 212, 0.2); color: #06b6d4; }
-        
+
         .stat-info { flex: 1; min-width: 0; }
         .stat-label { font-size: 11px; color: #9ca3af; text-transform: uppercase; letter-spacing: 0.5px; margin-bottom: 3px; }
         .stat-value { font-size: 16px; font-weight: 600; color: #f0f6fc; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
         .stat-sub { font-size: 10px; color: #6b7280; margin-top: 2px; }
-        
-        /* Status Badge */
+
         .status-indicator {
             display: inline-flex;
             align-items: center;
@@ -793,21 +1304,19 @@ HTML_TEMPLATE = """
             font-weight: 600;
             text-transform: uppercase;
         }
-        
+
         .status-online { background: rgba(34, 197, 94, 0.2); color: #22c55e; }
         .status-offline { background: rgba(239, 68, 68, 0.2); color: #ef4444; }
         .status-starting { background: rgba(234, 179, 8, 0.2); color: #eab308; }
-        
+
         .pulse { width: 6px; height: 6px; border-radius: 50%; background: currentColor; animation: pulse 2s infinite; }
         @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.5; } }
-        
-        /* Scrollbar */
+
         ::-webkit-scrollbar { width: 6px; height: 6px; }
         ::-webkit-scrollbar-track { background: #1a1d21; }
         ::-webkit-scrollbar-thumb { background: #4b5563; border-radius: 3px; }
         ::-webkit-scrollbar-thumb:hover { background: #6b7280; }
-        
-        /* Connection Status */
+
         .connection-bar {
             position: fixed;
             top: 50px;
@@ -822,12 +1331,11 @@ HTML_TEMPLATE = """
             z-index: 99;
             transition: all 0.3s;
         }
-        
+
         .connection-bar.connected { background: rgba(34, 197, 94, 0.15); color: #22c55e; border-bottom: 1px solid rgba(34, 197, 94, 0.3); }
         .connection-bar.disconnected { background: rgba(239, 68, 68, 0.15); color: #ef4444; border-bottom: 1px solid rgba(239, 68, 68, 0.3); }
         .connection-bar.connecting { background: rgba(234, 179, 8, 0.15); color: #eab308; border-bottom: 1px solid rgba(234, 179, 8, 0.3); }
-        
-        /* Mobile Overlay */
+
         .sidebar-overlay {
             display: none;
             position: fixed;
@@ -838,10 +1346,9 @@ HTML_TEMPLATE = """
             background: rgba(0,0,0,0.5);
             z-index: 150;
         }
-        
+
         .sidebar-overlay.active { display: block; }
-        
-        /* Status Modal */
+
         .status-modal {
             display: none;
             position: fixed;
@@ -856,9 +1363,9 @@ HTML_TEMPLATE = """
             min-width: 300px;
             box-shadow: 0 10px 40px rgba(0,0,0,0.5);
         }
-        
+
         .status-modal.active { display: block; }
-        
+
         .status-modal-header {
             display: flex;
             justify-content: space-between;
@@ -867,13 +1374,13 @@ HTML_TEMPLATE = """
             padding-bottom: 10px;
             border-bottom: 1px solid #363b42;
         }
-        
+
         .status-modal-title {
             font-size: 16px;
             font-weight: 600;
             color: #f0f6fc;
         }
-        
+
         .status-modal-close {
             background: transparent;
             border: none;
@@ -881,21 +1388,21 @@ HTML_TEMPLATE = """
             cursor: pointer;
             font-size: 18px;
         }
-        
+
         .status-modal-close:hover { color: #fff; }
-        
+
         .status-item {
             display: flex;
             justify-content: space-between;
             padding: 8px 0;
             border-bottom: 1px solid #2a2f35;
         }
-        
+
         .status-item:last-child { border-bottom: none; }
-        
+
         .status-label-modal { color: #9ca3af; font-size: 13px; }
         .status-value-modal { color: #f0f6fc; font-weight: 500; font-size: 13px; }
-        
+
         .modal-overlay {
             display: none;
             position: fixed;
@@ -906,16 +1413,15 @@ HTML_TEMPLATE = """
             background: rgba(0,0,0,0.7);
             z-index: 250;
         }
-        
+
         .modal-overlay.active { display: block; }
-        
-        /* Backup Section */
+
         .backup-section {
             margin-top: 15px;
             padding-top: 15px;
             border-top: 1px solid #363b42;
         }
-        
+
         .backup-title {
             font-size: 12px;
             color: #9ca3af;
@@ -926,7 +1432,7 @@ HTML_TEMPLATE = """
             align-items: center;
             gap: 6px;
         }
-        
+
         .backup-btn {
             width: 100%;
             padding: 10px;
@@ -944,24 +1450,20 @@ HTML_TEMPLATE = """
             transition: all 0.2s;
             margin-bottom: 8px;
         }
-        
+
         .backup-btn:hover { background: #1e3a8a; }
         .backup-btn:disabled { opacity: 0.5; cursor: not-allowed; }
-        
+
         .backup-status {
             font-size: 11px;
             color: #6b7280;
             text-align: center;
             padding: 5px;
         }
-        
+
         .backup-status.success { color: #22c55e; }
         .backup-status.error { color: #ef4444; }
-        
-        /* ============================================
-           MOBILE RESPONSIVE BREAKPOINTS
-           ============================================ */
-        
+
         @media screen and (max-width: 768px) {
             .sidebar {
                 position: fixed;
@@ -973,104 +1475,104 @@ HTML_TEMPLATE = """
                 transition: right 0.3s ease;
                 box-shadow: -4px 0 20px rgba(0,0,0,0.5);
             }
-            
+
             .sidebar.active { right: 0; }
             .connection-bar { right: 0; }
-            
+
             .console-header { padding: 10px 12px; }
             .server-title { font-size: 14px; }
-            
+
             .btn {
                 padding: 6px 10px;
                 font-size: 11px;
                 min-height: 32px;
             }
-            
+
             .btn span { display: none; }
-            
+
             .terminal {
                 font-size: 11px;
                 padding: 10px;
             }
-            
+
             .command-area { padding: 8px 10px; }
-            
+
             .send-btn {
                 padding: 10px 14px;
                 font-size: 12px;
             }
-            
+
             .send-btn span { display: none; }
         }
-        
+
         @media screen and (max-width: 480px) {
             .top-nav { padding: 0 10px; }
-            
+
             .nav-tab {
                 padding: 0 10px;
                 font-size: 12px;
             }
-            
+
             .nav-tab i { font-size: 12px; }
-            
+
             .console-header {
                 flex-direction: column;
                 align-items: flex-start;
                 gap: 8px;
             }
-            
+
             .control-buttons {
                 width: 100%;
                 justify-content: flex-start;
             }
-            
+
             .btn {
                 flex: 1;
                 justify-content: center;
                 padding: 8px;
             }
-            
+
             .terminal {
                 font-size: 10px;
                 line-height: 1.4;
             }
-            
+
             .command-input-wrapper { min-height: 40px; }
             #commandInput { font-size: 16px; }
-            
+
             .send-btn {
                 min-height: 40px;
                 padding: 8px 12px;
             }
-            
+
             .sidebar {
                 width: 100%;
                 right: -100%;
             }
-            
+
             .stat-card { padding: 10px; }
-            
+
             .stat-icon {
                 width: 36px;
                 height: 36px;
                 font-size: 16px;
             }
-            
+
             .stat-value { font-size: 14px; }
-            
+
             .status-modal {
                 min-width: 90vw;
                 max-width: 350px;
             }
         }
-        
+
         @media screen and (max-height: 500px) and (orientation: landscape) {
             .console-header { padding: 8px 12px; }
             .command-area { padding: 6px 10px; }
             .sidebar { padding: 10px; }
             .stat-card { padding: 8px; margin-bottom: 6px; }
         }
-        
+
         @media screen and (min-width: 1400px) {
             .sidebar { width: 320px; }
             .terminal { font-size: 13px; }
@@ -1079,7 +1581,6 @@ HTML_TEMPLATE = """
     </style>
 </head>
 <body>
-    <!-- Top Navigation -->
     <nav class="top-nav">
         <div class="nav-tabs">
             <a class="nav-tab active" onclick="switchTab('console', this)">
@@ -1097,10 +1598,12 @@ HTML_TEMPLATE = """
             <button class="nav-btn" title="Full Screen" onclick="toggleFullscreen()">
                 <i class="fas fa-expand"></i>
             </button>
+            <a href="/logout" class="logout-btn" title="Logout">
+                <i class="fas fa-sign-out-alt"></i> Logout
+            </a>
         </div>
     </nav>
-    
-    <!-- Status Modal -->
+
     <div class="modal-overlay" id="modalOverlay" onclick="toggleStatusModal()"></div>
     <div class="status-modal" id="statusModal">
         <div class="status-modal-header">
@@ -1146,19 +1649,16 @@ HTML_TEMPLATE = """
             </div>
         </div>
     </div>
-    
-    <!-- Sidebar Overlay -->
+
     <div class="sidebar-overlay" id="sidebarOverlay" onclick="toggleSidebar()"></div>
-    
-    <!-- Main Container -->
+
     <div class="main-container">
-        <!-- Console Section -->
         <div class="console-section" id="consoleSection">
             <div class="connection-bar connecting" id="connectionBar">
                 <i class="fas fa-circle-notch fa-spin"></i>
                 <span>Connecting to server...</span>
             </div>
-            
+
             <div class="console-header">
                 <div class="server-title">
                     <i class="fas fa-server"></i>
@@ -1179,11 +1679,11 @@ HTML_TEMPLATE = """
                     </button>
                 </div>
             </div>
-            
+
             <div class="terminal-container">
                 <div class="terminal" id="terminal"></div>
             </div>
-            
+
             <div class="command-area">
                 <div class="command-input-wrapper">
                     <i class="fas fa-angle-right"></i>
@@ -1194,8 +1694,7 @@ HTML_TEMPLATE = """
                 </button>
             </div>
         </div>
-        
-        <!-- Sidebar -->
+
         <div class="sidebar" id="sidebar">
             <div class="stat-card">
                 <div class="stat-icon blue"><i class="fas fa-network-wired"></i></div>
@@ -1205,7 +1704,7 @@ HTML_TEMPLATE = """
                     <div class="stat-sub">Port 25565</div>
                 </div>
             </div>
-            
+
             <div class="stat-card">
                 <div class="stat-icon red"><i class="fas fa-clock"></i></div>
                 <div class="stat-info">
@@ -1214,7 +1713,7 @@ HTML_TEMPLATE = """
                     <div class="stat-sub" id="uptimeSub">Not running</div>
                 </div>
             </div>
-            
+
             <div class="stat-card">
                 <div class="stat-icon yellow"><i class="fas fa-microchip"></i></div>
                 <div class="stat-info">
@@ -1223,7 +1722,7 @@ HTML_TEMPLATE = """
                     <div class="stat-sub" id="cpuSub">System average</div>
                 </div>
             </div>
-            
+
             <div class="stat-card">
                 <div class="stat-icon purple"><i class="fas fa-memory"></i></div>
                 <div class="stat-info">
@@ -1232,7 +1731,7 @@ HTML_TEMPLATE = """
                     <div class="stat-sub" id="memorySub">-- / -- GB</div>
                 </div>
             </div>
-            
+
             <div class="stat-card">
                 <div class="stat-icon cyan"><i class="fas fa-hdd"></i></div>
                 <div class="stat-info">
@@ -1241,7 +1740,7 @@ HTML_TEMPLATE = """
                     <div class="stat-sub">Server files</div>
                 </div>
             </div>
-            
+
             <div class="stat-card">
                 <div class="stat-icon green"><i class="fas fa-users"></i></div>
                 <div class="stat-info">
@@ -1250,8 +1749,7 @@ HTML_TEMPLATE = """
                     <div class="stat-sub">Online players</div>
                 </div>
             </div>
-            
-            <!-- Backup Section -->
+
             <div class="backup-section">
                 <div class="backup-title">
                     <i class="fas fa-cloud-upload-alt"></i> GitHub Backup
@@ -1282,7 +1780,7 @@ HTML_TEMPLATE = """
         const navStatusDot = document.getElementById('navStatusDot');
         const backupBtn = document.getElementById('backupBtn');
         const backupStatus = document.getElementById('backupStatus');
-        
+
         let ws = null;
         let reconnectAttempts = 0;
         let maxReconnectAttempts = 10;
@@ -1291,7 +1789,7 @@ HTML_TEMPLATE = """
         let serverStartTime = null;
         let typingPreviewLine = null;
         let currentStats = {};
-        
+
         function updateConnectionStatus(status, message) {
             connectionBar.className = 'connection-bar ' + status;
             const icons = {
@@ -1300,7 +1798,7 @@ HTML_TEMPLATE = """
                 'connecting': 'fa-circle-notch fa-spin'
             };
             connectionBar.innerHTML = '<i class="fas ' + icons[status] + '"></i><span>' + message + '</span>';
-            
+
             const wsStatus = document.getElementById('modalWsStatus');
             if (status === 'connected') {
                 wsStatus.innerHTML = '<span style="color: #22c55e;">● Connected</span>';
@@ -1310,11 +1808,11 @@ HTML_TEMPLATE = """
                 wsStatus.innerHTML = '<span style="color: #eab308;">● Connecting...</span>';
             }
         }
-        
+
         function updateServerStatus(running, startTime = null) {
             isServerRunning = running;
             const statusEl = document.getElementById('serverStatus');
-            
+
             if (running) {
                 statusEl.className = 'status-indicator status-online';
                 statusEl.innerHTML = '<span class="pulse"></span>Online';
@@ -1341,16 +1839,16 @@ HTML_TEMPLATE = """
                 document.getElementById('modalMcStatus').innerHTML = '<span style="color: #ef4444;">● Offline</span>';
             }
         }
-        
+
         function addTerminalLine(text, type = '') {
             if (typingPreviewLine && typingPreviewLine.parentNode) {
                 typingPreviewLine.parentNode.removeChild(typingPreviewLine);
                 typingPreviewLine = null;
             }
-            
+
             const line = document.createElement('div');
             line.className = 'terminal-line ' + type;
-            
+
             if (text.includes('[SYSTEM]')) {
                 line.className += ' system';
             } else if (text.includes('> ')) {
@@ -1362,24 +1860,24 @@ HTML_TEMPLATE = """
             } else if (text.toLowerCase().includes('done') || text.toLowerCase().includes('success')) {
                 line.className += ' success';
             }
-            
+
             line.textContent = text;
             terminal.appendChild(line);
             terminal.scrollTop = terminal.scrollHeight;
-            
+
             while (terminal.children.length > 500) {
                 terminal.removeChild(terminal.firstChild);
             }
         }
-        
+
         function updateTypingPreview() {
             const text = commandInput.value.trim();
-            
+
             if (typingPreviewLine && typingPreviewLine.parentNode) {
                 typingPreviewLine.parentNode.removeChild(typingPreviewLine);
                 typingPreviewLine = null;
             }
-            
+
             if (text && isServerRunning) {
                 typingPreviewLine = document.createElement('div');
                 typingPreviewLine.className = 'terminal-line typing-preview';
@@ -1388,27 +1886,27 @@ HTML_TEMPLATE = """
                 terminal.scrollTop = terminal.scrollHeight;
             }
         }
-        
+
         function escapeHtml(text) {
             const div = document.createElement('div');
             div.textContent = text;
             return div.innerHTML;
         }
-        
+
         function formatUptime(seconds) {
             if (!seconds || seconds <= 0) return 'Offline';
-            
+
             const days = Math.floor(seconds / 86400);
             const hours = Math.floor((seconds % 86400) / 3600);
             const minutes = Math.floor((seconds % 3600) / 60);
             const secs = Math.floor(seconds % 60);
-            
+
             if (days > 0) return days + 'd ' + hours + 'h ' + minutes + 'm';
             if (hours > 0) return hours + 'h ' + minutes + 'm ' + secs + 's';
             if (minutes > 0) return minutes + 'm ' + secs + 's';
             return secs + 's';
         }
-        
+
         function updateUptime() {
             if (serverStartTime && isServerRunning) {
                 const now = Date.now();
@@ -1423,21 +1921,18 @@ HTML_TEMPLATE = """
                 document.getElementById('modalUptime').textContent = 'Offline';
             }
         }
-        
+
         setInterval(updateUptime, 1000);
-        
-        // ==========================================
-        // BACKUP FUNCTIONS
-        // ==========================================
+
         async function triggerBackup() {
             backupBtn.disabled = true;
             backupStatus.textContent = 'Backing up...';
             backupStatus.className = 'backup-status';
-            
+
             try {
                 const response = await fetch('/backup', { method: 'POST' });
                 const result = await response.json();
-                
+
                 if (result.success) {
                     backupStatus.textContent = '✅ Backup successful!';
                     backupStatus.className = 'backup-status success';
@@ -1451,24 +1946,24 @@ HTML_TEMPLATE = """
                 backupStatus.textContent = '❌ Network error';
                 backupStatus.className = 'backup-status error';
             }
-            
+
             setTimeout(() => {
                 backupBtn.disabled = false;
             }, 5000);
         }
-        
+
         async function checkBackupStatus() {
             backupStatus.textContent = 'Checking...';
-            
+
             try {
                 const response = await fetch('/backup/status');
                 const result = await response.json();
-                
+
                 if (result.error) {
                     backupStatus.textContent = '❌ Error: ' + result.error;
                     backupStatus.className = 'backup-status error';
                 } else if (result.has_changes) {
-                    backupStatus.textContent = '📝 Unsaved changes: ' + result.status.split('\\n').length + ' files';
+                    backupStatus.textContent = '📝 Unsaved changes: ' + result.status.split('\n').length + ' files';
                     backupStatus.className = 'backup-status';
                 } else {
                     backupStatus.textContent = '✅ All changes synced';
@@ -1479,21 +1974,21 @@ HTML_TEMPLATE = """
                 backupStatus.className = 'backup-status error';
             }
         }
-        
+
         function connect() {
             const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
             ws = new WebSocket(protocol + '//' + window.location.host + '/ws');
-            
+
             ws.onopen = () => {
                 console.log('WebSocket connected');
                 reconnectAttempts = 0;
                 updateConnectionStatus('connected', 'Connected to server');
                 setTimeout(() => { connectionBar.style.opacity = '0'; }, 2000);
             };
-            
+
             ws.onmessage = (event) => {
                 const data = JSON.parse(event.data);
-                
+
                 if (data.type === 'output') {
                     addTerminalLine(data.data);
                 } else if (data.type === 'stats') {
@@ -1503,12 +1998,12 @@ HTML_TEMPLATE = """
                     const memTotal = (data.memoryTotal / 1024 / 1024 / 1024).toFixed(2);
                     const memUsed = ((data.memoryTotal * data.memory / 100) / 1024 / 1024 / 1024).toFixed(2);
                     document.getElementById('memorySub').textContent = memUsed + ' / ' + memTotal + ' GB';
-                    
+
                     document.getElementById('modalCpu').textContent = data.cpu.toFixed(1) + '%';
                     document.getElementById('modalMemory').textContent = data.memory.toFixed(1) + '%';
-                    
+
                     updateServerStatus(data.running, data.serverStartTime);
-                    
+
                     if (data.players !== undefined) {
                         document.getElementById('playerCount').textContent = data.players;
                         document.getElementById('modalPlayers').textContent = data.players;
@@ -1519,7 +2014,7 @@ HTML_TEMPLATE = """
                     });
                 }
             };
-            
+
             ws.onclose = () => {
                 updateConnectionStatus('disconnected', 'Connection lost. Reconnecting...');
                 connectionBar.style.opacity = '1';
@@ -1529,14 +2024,14 @@ HTML_TEMPLATE = """
                     setTimeout(connect, 3000);
                 }
             };
-            
+
             ws.onerror = (error) => {
                 console.error('WebSocket error:', error);
             };
         }
-        
+
         connect();
-        
+
         function sendInput() {
             const cmd = commandInput.value.trim();
             if (cmd && ws && ws.readyState === WebSocket.OPEN) {
@@ -1548,16 +2043,16 @@ HTML_TEMPLATE = """
                 commandInput.value = '';
             }
         }
-        
+
         function sendCmd(cmd) {
             if (ws && ws.readyState === WebSocket.OPEN) {
                 ws.send(JSON.stringify({type: 'command', data: cmd}));
             }
         }
-        
+
         commandInput.addEventListener('input', updateTypingPreview);
         commandInput.addEventListener('keyup', updateTypingPreview);
-        
+
         commandInput.addEventListener('keypress', (e) => {
             if (e.key === 'Enter') {
                 if (typingPreviewLine && typingPreviewLine.parentNode) {
@@ -1567,19 +2062,19 @@ HTML_TEMPLATE = """
                 sendInput();
             }
         });
-        
+
         commandInput.addEventListener('blur', () => {
             if (typingPreviewLine && typingPreviewLine.parentNode) {
                 typingPreviewLine.parentNode.removeChild(typingPreviewLine);
                 typingPreviewLine = null;
             }
         });
-        
+
         function switchTab(tab, element) {
             document.querySelectorAll('.nav-tab').forEach(t => t.classList.remove('active'));
             element.classList.add('active');
         }
-        
+
         function toggleFullscreen() {
             if (!document.fullscreenElement) {
                 document.documentElement.requestFullscreen();
@@ -1587,7 +2082,7 @@ HTML_TEMPLATE = """
                 document.exitFullscreen();
             }
         }
-        
+
         function toggleSidebar() {
             sidebarOpen = !sidebarOpen;
             if (sidebarOpen) {
@@ -1598,13 +2093,13 @@ HTML_TEMPLATE = """
                 sidebarOverlay.classList.remove('active');
             }
         }
-        
+
         function toggleStatusModal() {
             statusModal.classList.toggle('active');
             modalOverlay.classList.toggle('active');
             document.getElementById('modalAddress').textContent = window.location.hostname;
         }
-        
+
         document.addEventListener('click', (e) => {
             if (window.innerWidth <= 768 && sidebarOpen) {
                 if (!sidebar.contains(e.target) && !e.target.closest('.sidebar-toggle')) {
@@ -1612,13 +2107,13 @@ HTML_TEMPLATE = """
                 }
             }
         });
-        
+
         window.addEventListener('orientationchange', () => {
             setTimeout(() => {
                 terminal.scrollTop = terminal.scrollHeight;
             }, 300);
         });
-        
+
         let resizeTimer;
         window.addEventListener('resize', () => {
             clearTimeout(resizeTimer);
@@ -1630,7 +2125,7 @@ HTML_TEMPLATE = """
                 }
             }, 250);
         });
-        
+
         let lastTouchEnd = 0;
         document.addEventListener('touchend', (e) => {
             const now = Date.now();
@@ -1639,7 +2134,7 @@ HTML_TEMPLATE = """
             }
             lastTouchEnd = now;
         }, false);
-        
+
         document.getElementById('serverAddress').textContent = window.location.hostname;
         addTerminalLine('[SYSTEM] Connecting to Minecraft server...', 'system');
     </script>
@@ -1648,6 +2143,7 @@ HTML_TEMPLATE = """
 """
 
 @app.route('/')
+@login_required
 def index():
     return render_template_string(HTML_TEMPLATE)
 
@@ -1661,10 +2157,11 @@ def health():
     }
 
 @sock.route('/ws')
+@ws_login_required
 def websocket(ws):
     global server_start_time
     print("[WS] Client connected", flush=True)
-    
+
     try:
         if logs_history:
             ws.send(json.dumps({
@@ -1673,18 +2170,18 @@ def websocket(ws):
             }))
     except Exception as e:
         print(f"[WS] History send error: {e}", flush=True)
-    
+
     def send_stats():
         while True:
             try:
                 cpu = psutil.cpu_percent(interval=0.5)
                 memory = psutil.virtual_memory()
                 running = mc_process is not None and mc_process.poll() is None
-                
+
                 uptime_to_send = None
                 if running and server_start_time:
                     uptime_to_send = server_start_time
-                
+
                 ws.send(json.dumps({
                     'type': 'stats',
                     'cpu': cpu,
@@ -1698,10 +2195,10 @@ def websocket(ws):
                 print(f"[WS] Stats error: {e}", flush=True)
                 break
             time.sleep(2)
-    
+
     stats_thread = threading.Thread(target=send_stats, daemon=True)
     stats_thread.start()
-    
+
     def send_output():
         while True:
             try:
@@ -1714,10 +2211,10 @@ def websocket(ws):
                 continue
             except:
                 break
-    
+
     output_thread = threading.Thread(target=send_output, daemon=True)
     output_thread.start()
-    
+
     while True:
         try:
             data = ws.receive(timeout=5)
@@ -1732,7 +2229,7 @@ def websocket(ws):
             if "Connection closed" in str(e):
                 break
             continue
-    
+
     print("[WS] Client disconnected", flush=True)
 
 def cleanup(signum=None, frame=None):
@@ -1756,25 +2253,26 @@ signal.signal(signal.SIGINT, cleanup)
 if __name__ == '__main__':
     load_logs_from_file()
     load_uptime_from_file()
-    
+
     print(f"[MAIN] Starting web server... Timezone: {SL_TZ}", flush=True)
-    
+    print(f"[SECURITY] Password protection: {'ENABLED' if WEB_PASSWORD else 'DISABLED'}", flush=True)
+
     mc_thread = threading.Thread(target=start_minecraft, daemon=True)
     mc_thread.start()
-    
+
     def github_push_loop():
         while True:
             time.sleep(300)
             push_logs_to_github()
-    
+
     github_thread = threading.Thread(target=github_push_loop, daemon=True)
     github_thread.start()
-    
+
     from werkzeug.serving import run_simple
     run_simple('0.0.0.0', 7860, app, threaded=True, use_reloader=False)
 PYTHON_SCRIPT
 
-echo "🌐 Starting Web Terminal Server..."
+echo "🌐 Starting Web Terminal Server with Password Protection..."
 python3 /app/web_terminal.py 2>&1 &
 
 sleep 5
@@ -1789,6 +2287,7 @@ fi
 echo ""
 echo "=========================================="
 echo "✅ Minecraft Server with GitHub Backup is LIVE!"
+echo "🔒 Password Protection: ENABLED"
 echo "🌐 Access at: https://your-space.hf.space"
 echo "📱 Mobile optimized interface enabled"
 echo "💾 Logs are now persistent across refreshes"
@@ -1804,11 +2303,11 @@ echo "=========================================="
 # Keep container alive
 while true; do
     sleep 30
-    
+
     if ! pgrep -f "server.jar" > /dev/null; then
         echo "⚠️  Minecraft server not running!"
     fi
-    
+
     if ! pgrep -f "web_terminal.py" > /dev/null; then
         echo "❌ Web Terminal crashed! Restarting..."
         python3 /app/web_terminal.py 2>&1 &