import + export settings and always export settings if never done before.

Overlord-Server/src/config.ts

@@ -615,3 +615,102 @@ export async function updateAppearanceConfig(customCSS: string): Promise<Config[
   await writePersistentFileConfig(fileConfig);
   return next;
 }
+
+export function getExportableConfig(serverVersion: string): Record<string, unknown> {
+  const config = getConfig();
+  return {
+    _meta: {
+      exportedAt: new Date().toISOString(),
+      version: serverVersion,
+    },
+    auth: {
+      jwtSecret: config.auth.jwtSecret,
+      agentToken: config.auth.agentToken,
+    },
+    notifications: config.notifications,
+    security: config.security,
+    tls: config.tls,
+    enrollment: config.enrollment,
+    appearance: config.appearance,
+  };
+}
+
+export async function importFullConfig(data: Record<string, any>): Promise<{ applied: string[]; warnings: string[] }> {
+  const applied: string[] = [];
+  const warnings: string[] = [];
+
+  const envOverrides: Record<string, string | undefined> = {
+    notifications: process.env.OVERLORD_NOTIFICATION_KEYWORDS || process.env.OVERLORD_NOTIFICATION_WEBHOOK_URL,
+    security: process.env.OVERLORD_SESSION_TTL_HOURS || process.env.OVERLORD_LOGIN_MAX_ATTEMPTS,
+    tls: process.env.OVERLORD_TLS_CERT || process.env.OVERLORD_TLS_CERTBOT_ENABLED,
+    auth: process.env.JWT_SECRET || process.env.OVERLORD_AGENT_TOKEN,
+  };
+
+  if (data.notifications && typeof data.notifications === "object") {
+    await updateNotificationsConfig(data.notifications);
+    applied.push("notifications");
+    if (envOverrides.notifications) {
+      warnings.push("Some notification settings may be overridden by environment variables after restart.");
+    }
+  }
+
+  if (data.security && typeof data.security === "object") {
+    await updateSecurityConfig(data.security);
+    applied.push("security");
+    if (envOverrides.security) {
+      warnings.push("Some security settings may be overridden by environment variables after restart.");
+    }
+  }
+
+  if (data.tls && typeof data.tls === "object") {
+    await updateTlsConfig(data.tls);
+    applied.push("tls");
+    if (envOverrides.tls) {
+      warnings.push("Some TLS settings may be overridden by environment variables after restart.");
+    }
+  }
+
+  if (data.enrollment && typeof data.enrollment === "object") {
+    await updateEnrollmentConfig(data.enrollment);
+    applied.push("enrollment");
+  }
+
+  if (data.appearance && typeof data.appearance === "object") {
+    const css = typeof data.appearance.customCSS === "string" ? data.appearance.customCSS : "";
+    if (css.length <= 51200) {
+      await updateAppearanceConfig(css);
+      applied.push("appearance");
+    } else {
+      warnings.push("Custom CSS exceeds 50 KB limit and was skipped.");
+    }
+  }
+
+  if (data.auth && typeof data.auth === "object") {
+    const dataDir = ensureDataDir();
+    const savePath = resolve(dataDir, "save.json");
+    const savedSecrets = loadSaveSecrets(savePath);
+    let changed = false;
+
+    if (typeof data.auth.jwtSecret === "string" && data.auth.jwtSecret) {
+      if (!savedSecrets.auth) savedSecrets.auth = {};
+      savedSecrets.auth.jwtSecret = data.auth.jwtSecret;
+      changed = true;
+    }
+
+    if (typeof data.auth.agentToken === "string" && data.auth.agentToken) {
+      if (!savedSecrets.auth) savedSecrets.auth = {};
+      savedSecrets.auth.agentToken = data.auth.agentToken;
+      changed = true;
+    }
+
+    if (changed) {
+      persistSaveSecrets(savePath, savedSecrets);
+      applied.push("auth (secrets updated in save.json — restart required)");
+      if (envOverrides.auth) {
+        warnings.push("Auth secrets may be overridden by JWT_SECRET / OVERLORD_AGENT_TOKEN environment variables.");
+      }
+    }
+  }
+
+  return { applied, warnings };
+}

Overlord-Server/src/server/routes/misc-routes.ts

@@ -1,6 +1,6 @@
 import { authenticateRequest } from "../../auth";
 import { AuditAction, getAuditLogs, logAudit } from "../../auditLog";
-import { getConfig, updateSecurityConfig, updateTlsConfig, updateAppearanceConfig } from "../../config";
+import { getConfig, updateSecurityConfig, updateTlsConfig, updateAppearanceConfig, getExportableConfig, importFullConfig } from "../../config";
 import { getClientMetricsSummary } from "../../db";
 import { metrics } from "../../metrics";
 import { requirePermission } from "../../rbac";
@@ -397,6 +397,84 @@ export async function handleMiscRoutes(
     );
   }
 
+  if (req.method === "GET" && url.pathname === "/api/settings/export") {
+    const user = await authenticateRequest(req);
+    if (!user) {
+      return new Response("Unauthorized", { status: 401 });
+    }
+    if (user.role !== "admin") {
+      return new Response("Forbidden: Admin access required", { status: 403 });
+    }
+
+    const exportData = getExportableConfig(deps.SERVER_VERSION);
+
+    logAudit({
+      timestamp: Date.now(),
+      username: user.username,
+      ip: deps.requestIP?.(req)?.address || "unknown",
+      action: AuditAction.COMMAND,
+      details: "Exported settings",
+      success: true,
+    });
+
+    const dateStr = new Date().toISOString().slice(0, 10);
+    return new Response(JSON.stringify(exportData, null, 2), {
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Disposition": `attachment; filename="overlord-settings-${dateStr}.json"`,
+        ...deps.CORS_HEADERS,
+      },
+    });
+  }
+
+  if (req.method === "POST" && url.pathname === "/api/settings/import") {
+    const user = await authenticateRequest(req);
+    if (!user) {
+      return new Response("Unauthorized", { status: 401 });
+    }
+    if (user.role !== "admin") {
+      return new Response("Forbidden: Admin access required", { status: 403 });
+    }
+
+    let body: any = {};
+    try {
+      body = await req.json();
+    } catch {
+      return Response.json({ error: "Invalid JSON" }, { status: 400 });
+    }
+
+    if (!body || typeof body !== "object") {
+      return Response.json({ error: "Expected a JSON object" }, { status: 400 });
+    }
+
+    try {
+      const result = await importFullConfig(body);
+
+      logAudit({
+        timestamp: Date.now(),
+        username: user.username,
+        ip: deps.requestIP?.(req)?.address || "unknown",
+        action: AuditAction.COMMAND,
+        details: `Imported settings: ${result.applied.join(", ") || "none"}`,
+        success: true,
+      });
+
+      return Response.json({ ok: true, applied: result.applied, warnings: result.warnings }, { headers: deps.CORS_HEADERS });
+    } catch (error: any) {
+      logAudit({
+        timestamp: Date.now(),
+        username: user.username,
+        ip: deps.requestIP?.(req)?.address || "unknown",
+        action: AuditAction.COMMAND,
+        details: "Settings import failed",
+        success: false,
+        errorMessage: String(error?.message || error),
+      });
+
+      return Response.json({ ok: false, error: String(error?.message || "Import failed") }, { status: 400, headers: deps.CORS_HEADERS });
+    }
+  }
+
   if (url.pathname === "/api/settings/appearance") {
     const user = await authenticateRequest(req);
     if (!user) {