diff --git a/Overlord-Server/src/config.ts b/Overlord-Server/src/config.ts
index c8f7de0..2b10265 100644
--- a/Overlord-Server/src/config.ts
+++ b/Overlord-Server/src/config.ts
@@ -615,3 +615,102 @@ export async function updateAppearanceConfig(customCSS: string): Promise {
+ const config = getConfig();
+ return {
+ _meta: {
+ exportedAt: new Date().toISOString(),
+ version: serverVersion,
+ },
+ auth: {
+ jwtSecret: config.auth.jwtSecret,
+ agentToken: config.auth.agentToken,
+ },
+ notifications: config.notifications,
+ security: config.security,
+ tls: config.tls,
+ enrollment: config.enrollment,
+ appearance: config.appearance,
+ };
+}
+
+export async function importFullConfig(data: Record): Promise<{ applied: string[]; warnings: string[] }> {
+ const applied: string[] = [];
+ const warnings: string[] = [];
+
+ const envOverrides: Record = {
+ notifications: process.env.OVERLORD_NOTIFICATION_KEYWORDS || process.env.OVERLORD_NOTIFICATION_WEBHOOK_URL,
+ security: process.env.OVERLORD_SESSION_TTL_HOURS || process.env.OVERLORD_LOGIN_MAX_ATTEMPTS,
+ tls: process.env.OVERLORD_TLS_CERT || process.env.OVERLORD_TLS_CERTBOT_ENABLED,
+ auth: process.env.JWT_SECRET || process.env.OVERLORD_AGENT_TOKEN,
+ };
+
+ if (data.notifications && typeof data.notifications === "object") {
+ await updateNotificationsConfig(data.notifications);
+ applied.push("notifications");
+ if (envOverrides.notifications) {
+ warnings.push("Some notification settings may be overridden by environment variables after restart.");
+ }
+ }
+
+ if (data.security && typeof data.security === "object") {
+ await updateSecurityConfig(data.security);
+ applied.push("security");
+ if (envOverrides.security) {
+ warnings.push("Some security settings may be overridden by environment variables after restart.");
+ }
+ }
+
+ if (data.tls && typeof data.tls === "object") {
+ await updateTlsConfig(data.tls);
+ applied.push("tls");
+ if (envOverrides.tls) {
+ warnings.push("Some TLS settings may be overridden by environment variables after restart.");
+ }
+ }
+
+ if (data.enrollment && typeof data.enrollment === "object") {
+ await updateEnrollmentConfig(data.enrollment);
+ applied.push("enrollment");
+ }
+
+ if (data.appearance && typeof data.appearance === "object") {
+ const css = typeof data.appearance.customCSS === "string" ? data.appearance.customCSS : "";
+ if (css.length <= 51200) {
+ await updateAppearanceConfig(css);
+ applied.push("appearance");
+ } else {
+ warnings.push("Custom CSS exceeds 50 KB limit and was skipped.");
+ }
+ }
+
+ if (data.auth && typeof data.auth === "object") {
+ const dataDir = ensureDataDir();
+ const savePath = resolve(dataDir, "save.json");
+ const savedSecrets = loadSaveSecrets(savePath);
+ let changed = false;
+
+ if (typeof data.auth.jwtSecret === "string" && data.auth.jwtSecret) {
+ if (!savedSecrets.auth) savedSecrets.auth = {};
+ savedSecrets.auth.jwtSecret = data.auth.jwtSecret;
+ changed = true;
+ }
+
+ if (typeof data.auth.agentToken === "string" && data.auth.agentToken) {
+ if (!savedSecrets.auth) savedSecrets.auth = {};
+ savedSecrets.auth.agentToken = data.auth.agentToken;
+ changed = true;
+ }
+
+ if (changed) {
+ persistSaveSecrets(savePath, savedSecrets);
+ applied.push("auth (secrets updated in save.json — restart required)");
+ if (envOverrides.auth) {
+ warnings.push("Auth secrets may be overridden by JWT_SECRET / OVERLORD_AGENT_TOKEN environment variables.");
+ }
+ }
+ }
+
+ return { applied, warnings };
+}
diff --git a/Overlord-Server/src/server/routes/misc-routes.ts b/Overlord-Server/src/server/routes/misc-routes.ts
index 4194298..8c58936 100644
--- a/Overlord-Server/src/server/routes/misc-routes.ts
+++ b/Overlord-Server/src/server/routes/misc-routes.ts
@@ -1,6 +1,6 @@
import { authenticateRequest } from "../../auth";
import { AuditAction, getAuditLogs, logAudit } from "../../auditLog";
-import { getConfig, updateSecurityConfig, updateTlsConfig, updateAppearanceConfig } from "../../config";
+import { getConfig, updateSecurityConfig, updateTlsConfig, updateAppearanceConfig, getExportableConfig, importFullConfig } from "../../config";
import { getClientMetricsSummary } from "../../db";
import { metrics } from "../../metrics";
import { requirePermission } from "../../rbac";
@@ -397,6 +397,84 @@ export async function handleMiscRoutes(
);
}
+ if (req.method === "GET" && url.pathname === "/api/settings/export") {
+ const user = await authenticateRequest(req);
+ if (!user) {
+ return new Response("Unauthorized", { status: 401 });
+ }
+ if (user.role !== "admin") {
+ return new Response("Forbidden: Admin access required", { status: 403 });
+ }
+
+ const exportData = getExportableConfig(deps.SERVER_VERSION);
+
+ logAudit({
+ timestamp: Date.now(),
+ username: user.username,
+ ip: deps.requestIP?.(req)?.address || "unknown",
+ action: AuditAction.COMMAND,
+ details: "Exported settings",
+ success: true,
+ });
+
+ const dateStr = new Date().toISOString().slice(0, 10);
+ return new Response(JSON.stringify(exportData, null, 2), {
+ headers: {
+ "Content-Type": "application/json",
+ "Content-Disposition": `attachment; filename="overlord-settings-${dateStr}.json"`,
+ ...deps.CORS_HEADERS,
+ },
+ });
+ }
+
+ if (req.method === "POST" && url.pathname === "/api/settings/import") {
+ const user = await authenticateRequest(req);
+ if (!user) {
+ return new Response("Unauthorized", { status: 401 });
+ }
+ if (user.role !== "admin") {
+ return new Response("Forbidden: Admin access required", { status: 403 });
+ }
+
+ let body: any = {};
+ try {
+ body = await req.json();
+ } catch {
+ return Response.json({ error: "Invalid JSON" }, { status: 400 });
+ }
+
+ if (!body || typeof body !== "object") {
+ return Response.json({ error: "Expected a JSON object" }, { status: 400 });
+ }
+
+ try {
+ const result = await importFullConfig(body);
+
+ logAudit({
+ timestamp: Date.now(),
+ username: user.username,
+ ip: deps.requestIP?.(req)?.address || "unknown",
+ action: AuditAction.COMMAND,
+ details: `Imported settings: ${result.applied.join(", ") || "none"}`,
+ success: true,
+ });
+
+ return Response.json({ ok: true, applied: result.applied, warnings: result.warnings }, { headers: deps.CORS_HEADERS });
+ } catch (error: any) {
+ logAudit({
+ timestamp: Date.now(),
+ username: user.username,
+ ip: deps.requestIP?.(req)?.address || "unknown",
+ action: AuditAction.COMMAND,
+ details: "Settings import failed",
+ success: false,
+ errorMessage: String(error?.message || error),
+ });
+
+ return Response.json({ ok: false, error: String(error?.message || "Import failed") }, { status: 400, headers: deps.CORS_HEADERS });
+ }
+ }
+
if (url.pathname === "/api/settings/appearance") {
const user = await authenticateRequest(req);
if (!user) {