4.3.2 changes

Revert "Update cloudron-manifestformat and other modules"
This reverts commit 3d337640ef. Only update cloudron-manifestformat
2019-11-12 16:43:27 -08:00 · 2019-11-12 14:54:16 -08:00 · 2019-11-12 14:26:13 -08:00 · 2019-11-11 17:09:46 -08:00 · 2019-11-11 16:32:29 -08:00 · 2019-11-11 16:05:53 -08:00
227 changed files with 13524 additions and 14885 deletions
@@ -1,11 +1,11 @@
 {
    "env": {
-        "es6": true,
-        "node": true
+        "node": true,
+        "es6": true
    },
    "extends": "eslint:recommended",
    "parserOptions": {
-        "ecmaVersion": 2017
+        "ecmaVersion": 8
    },
    "rules": {
        "indent": [
@@ -26,4 +26,4 @@
        ],
        "no-console": "off"
    }
-}
+}
@@ -1550,3 +1550,175 @@
 * Add notification for cert renewal and backup failures
 * Fix issue where mail container was not updated with the latest certificate

+[3.5.4]
+* Make reboot required check server side
+* Update node to 10.15.1
+* Enable gzip compression for large objects
+* Update docker to 18.09
+* Add a way to lock specific settings
+* Add UI to copy app's backup id
+* Block platform updates based on app manifest constraints
+* Make crash logs viewable via the dashboard
+* Fix issue where uploading of filenames with brackets and plus was not working
+* Add notification for cert renewal and backup failures
+* Fix issue where mail container was not updated with the latest certificate
+
+[4.0.0]
+* (mail) Bump mail_max_userip_connections to 50
+* Fix issue where DKIM was not setup correctly during a restore
+* (mysql) Remove any stale lock file on restart
+* Add a way to disable outbound mail for a domain
+* Cleanup task logs
+* Fix issue where dashboard location might conflict with existing app location
+* Ad graphite to services
+* Add labels and tags to apps
+* Ensure MySQL is storing data/time in UTC
+* Fix bug where the UI redirects to login screen when enabling 2FA with invalid token
+* Use unbound resolver when resolving NS record of a domain
+* Various fixes for notifications
+* Add FTP support for apps
+* Add app version as part of info dialog
+* (backup) Do not abort archive if file(s) disappear
+* Show app upstream version in the info dialog
+* Add Scaleway ObjectStorage backup backend
+* Preserve update backups for 3 weeks
+* Make send test mail functionality work with secondary domain
+* Add support for an external email relay that does not require authentication
+* Add option to accept self-signed certs when using external mail relay
+* Allow publishing and listing community supported apps
+* Remove spaces support
+* Features implementation for customization
+
+[4.0.1]
+* Make it easier to import email
+* Give SFTP access only to admins
+
+[4.0.2]
+* Fix GCDNS crash
+* Add option to update without backing up
+
+[4.0.3]
+* Fix dashboard issue for non-admins
+
+[4.1.0]
+* Remove password requirement for uninstalling apps and users
+* Hosting provider edition
+* Enforce limits in mail container
+* Fix crash when using unauthenticated relay
+* Fix domain and tag filtering
+* Customizable app icons
+* Remove obsolete X-Frame-Options from nginx configs
+* Give SFTP access based on access restriction
+
+[4.1.1]
+* Add UI hint about SFTP access restriction
+
+[4.1.2]
+* Accept incoming mail from a private relay
+* Fix issue where unused addon images were not pruned
+* Add UI for redirect from multiple domains
+* Allow apps to be relocated to custom data directory
+* Make all cloudron env vars have CLOUDRON_ prefix
+* Update manifest version to 2
+* Fix issue where DKIM keys were inaccessible
+* Fix DKIM selector conflict when adding same domain across multiple cloudrons
+* Fix name.com DNS backend issue for naked domains
+* Add DigitalOcean Frankfurt (fra1) region for backup storage
+
+[4.1.3]
+* Update manifest format package
+
+[4.1.4]
+* Add CLOUDRON_ prefix to MySQL addon variables
+
+[4.1.5]
+* Make the terminal addon button inject variables based on manifest version
+* Preserve addon passwords correctly when using v2 manifest
+* Show error message instead of logging out user when invalid 2FA token is provided
+* Ensure redis vars are renamed with manifest v2
+* Add missing Scaleway Object Storage to restore UI
+* Fix Exoscale endpoints in restore UI
+* Reset the app icon when showing the configure UI
+
+[4.1.6]
+* Fix issue where CLOUDRON_APP_HOSTNAME was incorrectly set
+* Remove chat link from the footer of login screen
+* Add support for oplog tailing in mongodb
+* Fix LDAP not accessible via scheduler containers
+
+[4.1.7]
+* Fix issue where login looped when admin bit was removed
+
+[4.2.0]
+* Fix issue where tar backups with files > 8GB was corrupt
+* Add SparkPost as mail relay backend
+* Add Wasabi storage backend
+* TOTP tokens are now checked for with +- 60 seconds
+* IP based restore
+* Fix issue where task logs were not getting rotated correctly
+* Add notification for box update
+* User enable/disable flag
+* Check disk space before various operations like install, update, backup etc
+* Collect per app du information
+* Set Cloudron specific UA for healthchecks
+* Show message why an app task is 'pending'
+* Rework app task system so that we can now pass dynamic arguments
+* Add external LDAP server integration
+
+[4.2.1]
+* Rework the app configuration routes & UI
+* Fine grained eventlog for app configuration
+* Update Haraka to 2.8.24
+* Set sieve_max_redirects to 64
+* SRS support for mail forwarding
+* Fix issue where sieve responses were not sent via the relay
+* File based session store
+* Fix API token error reporting for namecheap backend
+
+[4.2.2]
+* Fix typos in migration
+
+[4.2.3]
+* Remove flicker of custom icon
+* Preserve PROVIDER setting from cloudron.conf
+* Add Skip backup option when updating an app
+* Fix bug where nginx was not reloaded on cert renewal
+
+[4.2.4]
+* Fix demo settings state regression
+
+[4.2.5]
+* Fix the demo settins fix
+
+[4.2.6]
+* Fix configuration of empty app location (subdomain)
+
+[4.2.7]
+* Fix issue where the icon for normal users was displayed incorrectly
+* Kill stuck backup processes after 12 hours and notify admins
+* Reconfigure email apps when mail domain is added/removed
+* Fix crash when only udp ports are defined
+
+[4.3.0]
+* Add timeout to kill long running tasks in case they get stuck
+* email: Auto-subscribe to Spam folder
+* Allow setting a custom CSP policy
+* ticket: when email is down, add a field to provide alternate contact email
+* Re-work app import flow
+* Add pagination and search to mailbox and mail alias listing
+* Add UI and workflow to add a private registry
+* Show external LDAP connector
+* Network view: Allow IP address detection to be configurable
+* Add support for custom docker registry
+* Resolve any lists and aliases in a mailing list
+* Rename Accounts view to Profile
+* Add search for groups and user association UI
+
+[4.3.1]
+* Make logout from all button logout from all sessions
+* List unstable apps by default
+* Fix crash when listing mailboxes
+
+[4.3.2]
+* Update manifestformat module
+
@@ -37,16 +37,11 @@ anyone to effortlessly host web applications on their server on their own terms.

 ## Demo

-Try our demo at https://my-demo.cloudron.me (username: cloudron password: cloudron).
+Try our demo at https://my.demo.cloudron.io (username: cloudron password: cloudron).

 ## Installing

-You can install the Cloudron platform on your own server or get a managed server
-from cloudron.io. In either case, the Cloudron platform will keep your server and
-apps up-to-date and secure.
-
-* [Selfhosting](https://cloudron.io/documentation/installation/) - [Pricing](https://cloudron.io/pricing.html)
-* [Managed Hosting](https://cloudron.io/managed.html)
+[Install script](https://cloudron.io/documentation/installation/) - [Pricing](https://cloudron.io/pricing.html)

 **Note:** This repo is a small part of what gets installed on your server - there is
 the dashboard, database addons, graph container, base image etc. Cloudron also relies
@@ -64,6 +59,7 @@ the containers in the Cloudron.

 ## Community

+* [Chat](https://chat.cloudron.io)
 * [Forum](https://forum.cloudron.io/)
 * [Support](mailto:support@cloudron.io)

@@ -1,179 +0,0 @@
-#!/bin/bash
-
-set -eu -o pipefail
-
-assertNotEmpty() {
-    : "${!1:? "$1 is not set."}"
-}
-
-readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-readonly SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd)"
-export JSON="${SOURCE_DIR}/node_modules/.bin/json"
-
-revision=$(git rev-parse HEAD)
-box_name=""
-server_id=""
-server_ip=""
-destroy_server="yes"
-deploy_env="dev"
-
-# Only GNU getopt supports long options. OS X comes bundled with the BSD getopt
-# brew install gnu-getopt to get the GNU getopt on OS X
-[[ $(uname -s) == "Darwin" ]] && GNU_GETOPT="/usr/local/opt/gnu-getopt/bin/getopt" || GNU_GETOPT="getopt"
-readonly GNU_GETOPT
-
-args=$(${GNU_GETOPT} -o "" -l "revision:,regions:,size:,name:,no-destroy,env:" -n "$0" -- "$@")
-eval set -- "${args}"
-
-while true; do
-    case "$1" in
-    --env) deploy_env="$2"; shift 2;;
-    --revision) revision="$2"; shift 2;;
-    --name) box_name="$2"; destroy_server="no"; shift 2;;
-    --no-destroy) destroy_server="no"; shift 2;;
-    --) break;;
-    *) echo "Unknown option $1"; exit 1;;
-    esac
-done
-
-echo "Creating digitalocean image"
-if [[ "${deploy_env}" == "staging" ]]; then
-    assertNotEmpty DIGITAL_OCEAN_TOKEN_STAGING
-    export DIGITAL_OCEAN_TOKEN="${DIGITAL_OCEAN_TOKEN_STAGING}"
-elif [[ "${deploy_env}" == "dev" ]]; then
-    assertNotEmpty DIGITAL_OCEAN_TOKEN_DEV
-    export DIGITAL_OCEAN_TOKEN="${DIGITAL_OCEAN_TOKEN_DEV}"
-elif [[ "${deploy_env}" == "prod" ]]; then
-    assertNotEmpty DIGITAL_OCEAN_TOKEN_PROD
-    export DIGITAL_OCEAN_TOKEN="${DIGITAL_OCEAN_TOKEN_PROD}"
-else
-    echo "No such env ${deploy_env}."
-    exit 1
-fi
-
-vps="/bin/bash ${SCRIPT_DIR}/digitalocean.sh"
-
-readonly ssh_keys="${HOME}/.ssh/id_rsa_caas_${deploy_env}"
-readonly scp202="scp -P 202 -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${ssh_keys}"
-readonly scp22="scp -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${ssh_keys}"
-
-readonly ssh202="ssh -p 202 -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${ssh_keys}"
-readonly ssh22="ssh -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${ssh_keys}"
-
-if [[ ! -f "${ssh_keys}" ]]; then
-    echo "caas ssh key is missing at ${ssh_keys} (pick it up from secrets repo)"
-    exit 1
-fi
-
-function get_pretty_revision() {
-    local git_rev="$1"
-    local sha1=$(git rev-parse --short "${git_rev}" 2>/dev/null)
-
-    echo "${sha1}"
-}
-
-now=$(date "+%Y-%m-%d-%H%M%S")
-pretty_revision=$(get_pretty_revision "${revision}")
-
-if [[ -z "${box_name}" ]]; then
-    # if you change this, change the regexp is appstore/janitor.js
-    box_name="box-${deploy_env}-${pretty_revision}-${now}" # remove slashes
-
-    # create a new server if no name given
-    if ! caas_ssh_key_id=$($vps get_ssh_key_id "caas"); then
-        echo "Could not query caas ssh key"
-        exit 1
-    fi
-    echo "Detected caas ssh key id: ${caas_ssh_key_id}"
-
-    echo "Creating Server with name [${box_name}]"
-    if ! server_id=$($vps create ${caas_ssh_key_id} ${box_name}); then
-        echo "Failed to create server"
-        exit 1
-    fi
-    echo "Created server with id: ${server_id}"
-
-    # If we run scripts overenthusiastically without the wait, setup script randomly fails
-    echo -n "Waiting 120 seconds for server creation"
-    for i in $(seq 1 24); do
-        echo -n "."
-        sleep 5
-    done
-    echo ""
-else
-    if ! server_id=$($vps get_id "${box_name}"); then
-        echo "Could not determine id from name"
-        exit 1
-    fi
-    echo "Reusing server with id: ${server_id}"
-
-    $vps power_on "${server_id}"
-fi
-
-# Query until we get an IP
-while true; do
-    echo "Trying to get the server IP"
-    if server_ip=$($vps get_ip "${server_id}"); then
-        echo "Server IP : [${server_ip}]"
-        break
-    fi
-    echo "Timedout, trying again in 10 seconds"
-    sleep 10
-done
-
-while true; do
-    echo "Trying to copy init script to server"
-    if $scp22 "${SCRIPT_DIR}/initializeBaseUbuntuImage.sh" root@${server_ip}:.; then
-        break
-    fi
-    echo "Timedout, trying again in 30 seconds"
-    sleep 30
-done
-
-echo "Copying infra_version.js"
-$scp22 "${SCRIPT_DIR}/../src/infra_version.js" root@${server_ip}:.
-
-echo "Copying box source"
-cd "${SOURCE_DIR}"
-git archive --format=tar HEAD | $ssh22 "root@${server_ip}" "cat - > /tmp/box.tar.gz"
-
-echo "Executing init script"
-if ! $ssh22 "root@${server_ip}" "/bin/bash /root/initializeBaseUbuntuImage.sh caas"; then
-    echo "Init script failed"
-    exit 1
-fi
-
-echo "Shutting down server with id : ${server_id}"
-$ssh22 "root@${server_ip}" "shutdown -f now" || true # shutdown sometimes terminates ssh connection immediately making this command fail
-
-# wait 10 secs for actual shutdown
-echo "Waiting for 10 seconds for server to shutdown"
-sleep 30
-
-echo "Powering off server"
-if ! $vps power_off "${server_id}"; then
-    echo "Could not power off server"
-    exit 1
-fi
-
-snapshot_name="box-${deploy_env}-${pretty_revision}-${now}"
-echo "Snapshotting as ${snapshot_name}"
-if ! image_id=$($vps snapshot "${server_id}" "${snapshot_name}"); then
-    echo "Could not snapshot and get image id"
-    exit 1
-fi
-
-if [[ "${destroy_server}" == "yes" ]]; then
-    echo "Destroying server"
-    if ! $vps destroy "${server_id}"; then
-        echo "Could not destroy server"
-        exit 1
-    fi
-else
-    echo "Skipping server destroy"
-fi
-
-echo "Transferring image ${image_id} to other regions"
-$vps transfer_image_to_all_regions "${image_id}"
-
-echo "Done."
@@ -33,24 +33,30 @@ gpg_package=$([[ "${ubuntu_version}" == "16.04" ]] && echo "gnupg" || echo "gpg"
 apt-get -y install \
    acl \
    build-essential \
+    cifs-utils \
    cron \
    curl \
+    debconf-utils \
    dmsetup \
    $gpg_package \
    iptables \
    libpython2.7 \
+    linux-generic \
    logrotate \
    mysql-server-5.7 \
    nginx-full \
    openssh-server \
    pwgen \
    resolvconf \
-    sudo \
    swaks \
+    tzdata \
    unattended-upgrades \
    unbound \
    xfsprogs

+# on some providers like scaleway the sudo file is changed and we want to keep the old one
+apt-get -o Dpkg::Options::="--force-confold" install -y sudo
+
 # this ensures that unattended upgades are enabled, if it was disabled during ubuntu install time (see #346)
 # debconf-set-selection of unattended-upgrades/enable_auto_updates + dpkg-reconfigure does not work
 cp /usr/share/unattended-upgrades/20auto-upgrades /etc/apt/apt.conf.d/20auto-upgrades
@@ -66,7 +72,7 @@ apt-get install -y python   # Install python which is required for npm rebuild
 # https://docs.docker.com/engine/installation/linux/ubuntulinux/
 echo "==> Installing Docker"

-# create systemd drop-in file
+# create systemd drop-in file. if you channge options here, be sure to fixup installer.sh as well
 mkdir -p /etc/systemd/system/docker.service.d
 echo -e "[Service]\nExecStart=\nExecStart=/usr/bin/dockerd -H fd:// --log-driver=journald --exec-opt native.cgroupdriver=cgroupfs --storage-driver=overlay2" > /etc/systemd/system/docker.service.d/cloudron.conf

@@ -114,6 +120,7 @@ fi
 echo "==> Configuring host"
 sed -e 's/^#NTP=/NTP=0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org 3.ubuntu.pool.ntp.org/' -i /etc/systemd/timesyncd.conf
 timedatectl set-ntp 1
+# mysql follows the system timezone
 timedatectl set-timezone UTC

 # Disable bind for good measure (on online.net, kimsufi servers these are pre-installed and conflicts with unbound)
@@ -14,25 +14,14 @@
 require('supererror')({ splatchError: true });

 let async = require('async'),
-    config = require('./src/config.js'),
-    ldap = require('./src/ldap.js'),
+    constants = require('./src/constants.js'),
    dockerProxy = require('./src/dockerproxy.js'),
+    ldap = require('./src/ldap.js'),
    server = require('./src/server.js');

 console.log();
 console.log('==========================================');
-console.log(' Cloudron will use the following settings ');
-console.log('==========================================');
-console.log();
-console.log(' Environment:                    ', config.CLOUDRON ? 'CLOUDRON' : 'TEST');
-console.log(' Version:                        ', config.version());
-console.log(' Admin Origin:                   ', config.adminOrigin());
-console.log(' Appstore API server origin:     ', config.apiServerOrigin());
-console.log(' Appstore Web server origin:     ', config.webServerOrigin());
-console.log(' SysAdmin Port:                  ', config.get('sysadminPort'));
-console.log(' LDAP Server Port:               ', config.get('ldapPort'));
-console.log(' Docker Proxy Port:              ', config.get('dockerProxyPort'));
-console.log();
+console.log(`           Cloudron ${constants.VERSION}  `);
 console.log('==========================================');
 console.log();

@@ -0,0 +1,15 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE apps ADD COLUMN label VARCHAR(128)', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE apps DROP COLUMN label', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,15 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE apps ADD COLUMN tagsJson VARCHAR(2048)', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE apps DROP COLUMN tagsJson ', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,15 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE backups ADD COLUMN preserveSecs INTEGER DEFAULT 0', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE backups DROP COLUMN preserveSecs', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,19 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.all('SELECT value FROM settings WHERE name="backup_config"', function (error, results) {
+        if (error || results.length === 0) return callback(error);
+
+        var backupConfig = JSON.parse(results[0].value);
+        if (backupConfig.provider !== 'caas') return callback();
+
+        backupConfig.boxId = backupConfig.prefix; // hack to set the boxId that happens to match the prefix
+        delete backupConfig.fqdn;
+
+        db.runSql('UPDATE settings SET value=? WHERE name="backup_config"', [ JSON.stringify(backupConfig) ], callback);
+    });
+};
+
+exports.down = function(db, callback) {
+  callback();
+};
@@ -0,0 +1,51 @@
+'use strict';
+
+var async = require('async'),
+    fs = require('fs'),
+    superagent = require('superagent');
+
+exports.up = function(db, callback) {
+    if (!fs.existsSync('/etc/cloudron/cloudron.conf')) {
+        console.log('Unable to locate cloudron.conf');
+        return callback();
+    }
+
+    const config = JSON.parse(fs.readFileSync('/etc/cloudron/cloudron.conf', 'utf8'));
+
+    db.all('SELECT * FROM settings WHERE name="appstore_config"', function (error, results) {
+        if (error) return callback(error);
+
+        if (results.length === 0) {
+            console.log('No appstore config, skipping license migration');
+            return callback();
+        }
+
+        console.log('Downloading license');
+
+        const appstoreConfig = JSON.parse(results[0].value);
+
+        superagent.get(`${config.apiServerOrigin}/api/v1/cloudron_license`)
+            .query({ accessToken: appstoreConfig.token, cloudronId: appstoreConfig.cloudronId, provider: config.provider })
+            .timeout(30 * 1000).end(function (error, result) {
+                if (error && !error.response) return callback(new Error('Network error getting license:' + error.message));
+                if (result.statusCode !== 200) return callback(new Error(`Bad status getting license: ${result.status} ${result.text}`));
+
+                if (!result.body.cloudronId || !result.body.licenseKey || !result.body.cloudronToken) return callback(new Error(`Bad response getting license:  ${result.text}`));
+
+                console.log('Adding license', result.body);
+
+                async.series([
+                    db.runSql.bind(db, 'START TRANSACTION;'),
+                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'cloudron_id', result.body.cloudronId ]),
+                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'license_key', result.body.licenseKey ]),
+                    db.runSql.bind(db, 'INSERT settings (name, value) VALUES(?, ?)', [ 'cloudron_token', result.body.cloudronToken ]),
+                    db.runSql.bind(db, 'DELETE FROM settings WHERE name=?', [ 'appstore_config' ]),
+                    db.runSql.bind(db, 'COMMIT')
+                ], callback);
+            });
+    });
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -0,0 +1,13 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('UPDATE tokens SET expires=? WHERE clientId=?', [ 1557089270832, 'cid-webadmin' ], function (error) { // force webadmin to get a new token
+        if (error) console.error(error);
+
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -0,0 +1,15 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE settings DROP COLUMN locked', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE settings ADD COLUMN locked BOOLEAN DEFAULT 0', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,15 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE mail ADD COLUMN dkimSelector VARCHAR(128) NOT NULL DEFAULT "cloudron"', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE mail DROP COLUMN dkimSelector', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,14 @@
+'use strict';
+
+var async = require('async');
+
+exports.up = function(db, callback) {
+    async.series([
+        db.runSql.bind(db, 'ALTER TABLE apps DROP FOREIGN KEY apps_owner_constraint'),
+        db.runSql.bind(db, 'ALTER TABLE apps DROP COLUMN ownerId')
+    ], callback);
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -0,0 +1,29 @@
+'use strict';
+
+var async = require('async'),
+    fs = require('fs');
+
+exports.up = function(db, callback) {
+    if (!fs.existsSync('/etc/cloudron/cloudron.conf')) {
+        console.log('Unable to locate cloudron.conf');
+        return callback();
+    }
+
+    const config = JSON.parse(fs.readFileSync('/etc/cloudron/cloudron.conf', 'utf8'));
+
+    async.series([
+        fs.writeFile.bind(null, '/etc/cloudron/PROVIDER', config.provider, 'utf8'),
+        db.runSql.bind(db, 'START TRANSACTION;'),
+        // we use replace instead of insert because the cloudron-setup adds api/web_server_origin even for legacy setups
+        db.runSql.bind(db, 'REPLACE INTO settings (name, value) VALUES(?, ?)', [ 'api_server_origin', config.apiServerOrigin ]),
+        db.runSql.bind(db, 'REPLACE INTO settings (name, value) VALUES(?, ?)', [ 'web_server_origin', config.webServerOrigin ]),
+        db.runSql.bind(db, 'REPLACE INTO settings (name, value) VALUES(?, ?)', [ 'admin_domain', config.adminDomain ]),
+        db.runSql.bind(db, 'REPLACE INTO settings (name, value) VALUES(?, ?)', [ 'admin_fqdn', config.adminFqdn ]),
+        db.runSql.bind(db, 'REPLACE INTO settings (name, value) VALUES(?, ?)', [ 'demo', config.isDemo ]),
+        db.runSql.bind(db, 'COMMIT')
+    ], callback);
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -0,0 +1,17 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE users ADD COLUMN active BOOLEAN DEFAULT 1', function (error) {
+        if (error) return callback(error);
+
+        callback();
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE users DROP COLUMN active', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
@@ -0,0 +1,17 @@
+'use strict';
+
+var async = require('async');
+
+exports.up = function(db, callback) {
+    async.series([
+        db.runSql.bind(db, 'ALTER TABLE apps ADD COLUMN taskId INTEGER'),
+        db.runSql.bind(db, 'ALTER TABLE apps ADD CONSTRAINT apps_task_constraint FOREIGN KEY(taskId) REFERENCES tasks(id)')
+    ], callback);
+};
+
+exports.down = function(db, callback) {
+    async.series([
+        db.runSql.bind(db, 'ALTER TABLE app DROP FOREIGN KEY apps_task_constraint'),
+        db.runSql.bind(db, 'ALTER TABLE apps DROP COLUMN taskId'),
+    ], callback);
+};
@@ -0,0 +1,12 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE apps DROP updateConfigJson, DROP restoreConfigJson, DROP oldConfigJson', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -0,0 +1,15 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE apps CHANGE installationProgress errorJson TEXT', [], function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE apps CHANGE errorJson installationProgress TEXT', [], function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,17 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE users ADD COLUMN source VARCHAR(128) DEFAULT ""', function (error) {
+        if (error) return callback(error);
+
+        callback();
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE users DROP COLUMN source', function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
+
@@ -0,0 +1,26 @@
+'use strict';
+
+let async = require('async');
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE tasks CHANGE errorMessage errorJson TEXT', [], function (error) {
+        if (error) console.error(error);
+
+        // convert error messages into json
+        db.all('SELECT id, errorJson FROM apps', function (error, apps) {
+            async.eachSeries(apps, function (app, iteratorDone) {
+                if (app.errorJson === 'null') return iteratorDone();
+                if (app.errorJson === null) return iteratorDone();
+
+                db.runSql('UPDATE apps SET errorJson = ? WHERE id = ?', [ JSON.stringify({ message: app.errorJson }), app.id ], iteratorDone);
+            }, callback);
+        });
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE tasks CHANGE errorJson errorMessage TEXT', [], function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,21 @@
+'use strict';
+
+var async = require('async');
+
+// imports mailbox entries for existing users
+exports.up = function(db, callback) {
+    db.all('SELECT * FROM mailboxes', function (error, mailboxes) {
+        async.eachSeries(mailboxes, function (mailbox, iteratorDone) {
+            if (!mailbox.membersJson) return iteratorDone();
+
+            let members = JSON.parse(mailbox.membersJson);
+            members = members.map((m) => m.indexOf('@') === -1 ? `${m}@${mailbox.domain}` : m); // only because we don't do things in a xction
+
+            db.runSql('UPDATE mailboxes SET membersJson=? WHERE name=? AND domain=?', [ JSON.stringify(members), mailbox.name, mailbox.domain ], iteratorDone);
+        }, callback);
+    });
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -0,0 +1,19 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    db.runSql('UPDATE apps SET runState=? WHERE runState IS NULL', [ 'running' ], function (error) {
+        if (error) return callback(error);
+
+        db.runSql('ALTER TABLE apps MODIFY runState VARCHAR(512) NOT NULL', [], function (error) {
+            if (error) console.error(error);
+            callback(error);
+        });
+    });
+};
+
+exports.down = function(db, callback) {
+    db.runSql('ALTER TABLE app MODIFY runState VARCHAR(512)', [], function (error) {
+        if (error) console.error(error);
+        callback(error);
+    });
+};
@@ -0,0 +1,10 @@
+'use strict';
+
+exports.up = function(db, callback) {
+    // We clear all demo state in the Cloudron...the demo cloudron needs manual intervention afterwards
+    db.runSql('REPLACE INTO settings (name, value) VALUES(?, ?)', [ 'demo', '' ], callback);
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -0,0 +1,30 @@
+'use strict';
+
+var async = require('async');
+
+exports.up = function(db, callback) {
+    db.runSql('ALTER TABLE apps ADD COLUMN reverseProxyConfigJson TEXT', function (error) {
+        if (error) return callback(error);
+
+        db.all('SELECT id, robotsTxt FROM apps', function (error, apps) {
+            if (error) return callback(error);
+
+            async.eachSeries(apps, function (app, iteratorDone) {
+                if (!app.robotsTxt) return iteratorDone();
+
+                db.runSql('UPDATE apps SET reverseProxyConfigJson=? WHERE id=?', [ JSON.stringify({ robotsTxt: JSON.stringify(app.robotsTxt) }), app.id ], iteratorDone);
+            }, function (error) {
+                if (error) return callback(error);
+
+                db.runSql('ALTER TABLE apps DROP COLUMN robotsTxt', callback);
+            });
+        });
+    });
+};
+
+exports.down = function(db, callback) {
+    async.series([
+        db.runSql.bind(db, 'ALTER TABLE apps DROP COLUMN reverseProxyConfigJson'),
+    ], callback);
+};
+
@@ -0,0 +1,13 @@
+'use strict';
+
+var fs = require('fs');
+
+exports.up = function(db, callback) {
+    let sysinfoConfig = { provider: 'generic' };
+
+    db.runSql('REPLACE INTO settings (name, value) VALUES(?, ?)', [ 'sysinfo_config', JSON.stringify(sysinfoConfig) ], callback);
+};
+
+exports.down = function(db, callback) {
+    callback();
+};
@@ -8,6 +8,7 @@
 #### TEXT - stored offline from table row (use for strings)
 #### BLOB - stored offline from table row (use for binary data)
 #### https://dev.mysql.com/doc/refman/5.0/en/storage-requirements.html
+#### Times are stored in the database in UTC. And precision is seconds

 # The code uses zero dates. Make sure sql_mode does NOT have NO_ZERO_DATE
 # http://johnemb.blogspot.com/2014/09/adding-or-removing-individual-sql-modes.html
@@ -26,6 +27,7 @@ CREATE TABLE IF NOT EXISTS users(
    twoFactorAuthenticationSecret VARCHAR(128) DEFAULT "",
    twoFactorAuthenticationEnabled BOOLEAN DEFAULT false,
    admin BOOLEAN DEFAULT false,
+    source VARCHAR(128) DEFAULT "",

    PRIMARY KEY(id));

@@ -62,9 +64,8 @@ CREATE TABLE IF NOT EXISTS clients(
 CREATE TABLE IF NOT EXISTS apps(
    id VARCHAR(128) NOT NULL UNIQUE,
    appStoreId VARCHAR(128) NOT NULL,
-    installationState VARCHAR(512) NOT NULL,
-    installationProgress TEXT,
-    runState VARCHAR(512),
+    installationState VARCHAR(512) NOT NULL, // the active task on the app
+    runState VARCHAR(512) NOT NULL,   // if the app is stopped
    health VARCHAR(128),
    healthTime TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, // when the app last responded
    containerId VARCHAR(128),
@@ -80,19 +81,17 @@ CREATE TABLE IF NOT EXISTS apps(
    xFrameOptions VARCHAR(512),
    sso BOOLEAN DEFAULT 1, // whether user chose to enable SSO
    debugModeJson TEXT, // options for development mode
-    robotsTxt TEXT,
+    reverseProxyConfigJson TEXT, // { robotsTxt, csp }
    enableBackup BOOLEAN DEFAULT 1, // misnomer: controls automatic daily backups
    enableAutomaticUpdate BOOLEAN DEFAULT 1,
    mailboxName VARCHAR(128), // mailbox of this app. default allocated as '.app'
+    label VARCHAR(128),     // display name
+    tagsJson VARCHAR(2048), // array of tags
+    dataDir VARCHAR(256) UNIQUE,
+    taskId INTEGER, // current task
+    errorJson TEXT,

-    // the following fields do not belong here, they can be removed when we use a queue for apptask
-    restoreConfigJson VARCHAR(256), // used to pass backupId to restore from to apptask
-    oldConfigJson TEXT, // used to pass old config to apptask (configure, restore)
-    updateConfigJson TEXT, // used to pass new config to apptask (update)
-
-    ownerId VARCHAR(128),
-
-    FOREIGN KEY(ownerId) REFERENCES users(id),
+    FOREIGN KEY(taskId) REFERENCES tasks(id),
    PRIMARY KEY(id));

 CREATE TABLE IF NOT EXISTS appPortBindings(
@@ -113,7 +112,6 @@ CREATE TABLE IF NOT EXISTS authcodes(
 CREATE TABLE IF NOT EXISTS settings(
    name VARCHAR(128) NOT NULL UNIQUE,
    value TEXT,
-    locked BOOLEAN,
    PRIMARY KEY(name));

 CREATE TABLE IF NOT EXISTS appAddonConfigs(
@@ -138,6 +136,7 @@ CREATE TABLE IF NOT EXISTS backups(
    state VARCHAR(16) NOT NULL,
    manifestJson TEXT, /* to validate if the app can be installed in this version of box */
    format VARCHAR(16) DEFAULT "tgz",
+    preserveSecs INTEGER DEFAULT 0,

    PRIMARY KEY (id));

@@ -171,6 +170,8 @@ CREATE TABLE IF NOT EXISTS mail(
    catchAllJson TEXT,
    relayJson TEXT,

+    dkimSelector VARCHAR(128) NOT NULL DEFAULT "cloudron",
+
    FOREIGN KEY(domain) REFERENCES domains(domain),
    PRIMARY KEY(domain))

@@ -188,7 +189,7 @@ CREATE TABLE IF NOT EXISTS mailboxes(
    type VARCHAR(16) NOT NULL, /* 'mailbox', 'alias', 'list' */
    ownerId VARCHAR(128) NOT NULL, /* user id */
    aliasTarget VARCHAR(128), /* the target name type is an alias */
-    membersJson TEXT, /* members of a group */
+    membersJson TEXT, /* members of a group. fully qualified */
    creationTime TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    domain VARCHAR(128),

@@ -199,7 +200,7 @@ CREATE TABLE IF NOT EXISTS subdomains(
    appId VARCHAR(128) NOT NULL,
    domain VARCHAR(128) NOT NULL,
    subdomain VARCHAR(128) NOT NULL,
-    type VARCHAR(128) NOT NULL,
+    type VARCHAR(128) NOT NULL, /* primary or redirect */

    FOREIGN KEY(domain) REFERENCES domains(domain),
    FOREIGN KEY(appId) REFERENCES apps(id),
@@ -210,8 +211,8 @@ CREATE TABLE IF NOT EXISTS tasks(
    type VARCHAR(32) NOT NULL,
    percent INTEGER DEFAULT 0,
    message TEXT,
-    errorMessage TEXT,
-    result TEXT,
+    errorJson TEXT,
+    resultJson TEXT,
    creationTime TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    ts TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    PRIMARY KEY (id));
@@ -14,85 +14,87 @@
    "node": ">=4.0.0 <=4.1.1"
  },
  "dependencies": {
-    "@google-cloud/dns": "^0.7.2",
-    "@google-cloud/storage": "^1.7.0",
-    "@sindresorhus/df": "^2.1.0",
+    "@google-cloud/dns": "^1.1.0",
+    "@google-cloud/storage": "^2.5.0",
+    "@sindresorhus/df": "git+https://github.com/cloudron-io/df.git#type",
    "async": "^2.6.2",
-    "aws-sdk": "^2.408.0",
-    "body-parser": "^1.18.3",
-    "cloudron-manifestformat": "^2.14.2",
-    "connect": "^3.6.6",
+    "aws-sdk": "^2.476.0",
+    "body-parser": "^1.19.0",
+    "cloudron-manifestformat": "^3.0.0",
+    "connect": "^3.7.0",
    "connect-ensure-login": "^0.1.1",
-    "connect-lastmile": "^1.0.2",
+    "connect-lastmile": "^1.2.1",
    "connect-timeout": "^1.9.0",
    "cookie-parser": "^1.4.4",
-    "cookie-session": "^1.3.2",
-    "cron": "^1.6.0",
-    "csurf": "^1.6.6",
-    "db-migrate": "^0.11.5",
+    "cookie-session": "^1.3.3",
+    "cron": "^1.7.1",
+    "csurf": "^1.10.0",
+    "db-migrate": "^0.11.6",
    "db-migrate-mysql": "^1.1.10",
-    "debug": "^3.1.0",
+    "debug": "^4.1.1",
    "dockerode": "^2.5.8",
    "ejs": "^2.6.1",
    "ejs-cli": "^2.0.1",
-    "express": "^4.16.4",
-    "express-session": "^1.15.6",
-    "json": "^9.0.3",
+    "express": "^4.17.1",
+    "express-session": "^1.16.2",
+    "js-yaml": "^3.13.1",
+    "json": "^9.0.6",
    "ldapjs": "^1.0.2",
+    "lodash": "^4.17.11",
    "lodash.chunk": "^4.2.0",
-    "mime": "^2.3.1",
-    "moment-timezone": "^0.5.17",
+    "mime": "^2.4.4",
+    "moment-timezone": "^0.5.25",
    "morgan": "^1.9.1",
-    "multiparty": "^4.1.4",
-    "mysql": "^2.15.0",
-    "namecheap": "github:joshuakarjala/node-namecheap#464a952",
-    "nodemailer": "^4.6.5",
+    "multiparty": "^4.2.1",
+    "mysql": "^2.17.1",
+    "nodemailer": "^6.2.1",
    "nodemailer-smtp-transport": "^2.7.4",
    "oauth2orize": "^1.11.0",
-    "once": "^1.3.2",
+    "once": "^1.4.0",
    "parse-links": "^0.1.0",
    "passport": "^0.4.0",
    "passport-http": "^0.3.0",
    "passport-http-bearer": "^1.0.1",
    "passport-local": "^1.0.0",
    "passport-oauth2-client-password": "^0.1.2",
+    "pretty-bytes": "^5.3.0",
    "progress-stream": "^2.0.0",
    "proxy-middleware": "^0.15.0",
-    "qrcode": "^1.2.0",
-    "readdirp": "^2.1.0",
-    "request": "^2.87.0",
-    "rimraf": "^2.6.2",
+    "qrcode": "^1.3.3",
+    "readdirp": "^3.0.2",
+    "request": "^2.88.0",
+    "rimraf": "^2.6.3",
    "s3-block-read-stream": "^0.5.0",
    "safetydance": "^0.7.1",
-    "semver": "^5.5.0",
-    "showdown": "^1.8.6",
+    "semver": "^6.1.1",
+    "session-file-store": "^1.3.1",
+    "showdown": "^1.9.0",
    "speakeasy": "^2.0.0",
-    "split": "^1.0.0",
-    "superagent": "^3.8.3",
+    "split": "^1.0.1",
+    "superagent": "^5.0.9",
    "supererror": "^0.7.2",
-    "tar-fs": "^1.16.2",
-    "tar-stream": "^1.6.1",
+    "tar-fs": "github:cloudron-io/tar-fs#ignore_stat_error",
+    "tar-stream": "^2.1.0",
    "tldjs": "^2.3.1",
    "underscore": "^1.9.1",
-    "uuid": "^3.2.1",
+    "uuid": "^3.3.2",
    "valid-url": "^1.0.9",
-    "validator": "^10.3.0",
-    "ws": "^5.2.0"
+    "validator": "^11.0.0",
+    "ws": "^7.0.0",
+    "xml2js": "^0.4.19"
  },
  "devDependencies": {
    "expect.js": "*",
-    "hock": "^1.3.2",
-    "istanbul": "*",
-    "js2xmlparser": "^3.0.0",
-    "mocha": "^5.2.0",
+    "hock": "^1.3.3",
+    "js2xmlparser": "^4.0.0",
+    "mocha": "^6.1.4",
    "mock-aws-s3": "git+https://github.com/cloudron-io/mock-aws-s3.git",
-    "nock": "^9.0.14",
-    "node-sass": "^4.11.0",
-    "recursive-readdir": "^2.2.2",
-    "sinon": "^7.2.2"
+    "nock": "^10.0.6",
+    "node-sass": "^4.12.0",
+    "recursive-readdir": "^2.2.2"
  },
  "scripts": {
-    "test": "src/test/setupTest && BOX_ENV=test ./node_modules/istanbul/lib/cli.js test $1 ./node_modules/mocha/bin/_mocha -- --no-timeouts --exit -R spec ./src/test ./src/routes/test/[^a]*js",
+    "test": "./runTests",
    "postmerge": "/bin/true",
    "precommit": "/bin/true",
    "prepush": "npm test",
@@ -0,0 +1,71 @@
+#!/bin/bash
+
+set -eu
+
+readonly SOURCE_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly DATA_DIR="${HOME}/.cloudron_test"
+readonly DEFAULT_TESTS="./src/test/*-test.js ./src/routes/test/*-test.js"
+
+! "${SOURCE_dir}/src/test/checkInstall" && exit 1
+
+# cleanup old data dirs some of those docker container data requires sudo to be removed
+echo "=> Provide root password to purge any leftover data in ${DATA_DIR} and load apparmor profile:"
+sudo rm -rf ${DATA_DIR}
+
+# archlinux does not have apparmor
+if hash apparmor_parser 2>/dev/null; then
+    echo "=> Loading app armor profile"
+    sudo apparmor_parser --replace --write-cache ./setup/start/docker-cloudron-app.apparmor
+fi
+
+# create dir structure
+mkdir -p ${DATA_DIR}
+cd ${DATA_DIR}
+mkdir -p appsdata
+mkdir -p boxdata/appicons boxdata/mail boxdata/certs boxdata/mail/dkim/localhost boxdata/mail/dkim/foobar.com
+mkdir -p platformdata/addons/mail platformdata/nginx/cert platformdata/nginx/applications platformdata/collectd/collectd.conf.d platformdata/addons platformdata/logrotate.d platformdata/backup platformdata/logs/tasks
+
+# put cert
+echo "=> Generating a localhost selfsigned cert"
+openssl req -x509 -newkey rsa:2048 -keyout platformdata/nginx/cert/host.key -out platformdata/nginx/cert/host.cert -days 3650 -subj '/CN=localhost' -nodes -config <(cat /etc/ssl/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:*.localhost"))
+
+# clear out any containers
+echo "=> Delete all docker containers first"
+docker ps -qa | xargs --no-run-if-empty docker rm -f
+
+# create docker network (while the infra code does this, most tests skip infra setup)
+docker network create --subnet=172.18.0.0/16 cloudron || true
+
+# create the same mysql server version to test with
+OUT=`docker inspect mysql-server` || true
+if [[ "${OUT}" = "[]" ]]; then
+    echo "=> Starting mysql-server..."
+    docker run --name mysql-server -e MYSQL_ROOT_PASSWORD=password -d mysql:5.7
+else
+    echo "=> mysql-server already running. If you want to start fresh, run 'docker rm --force mysql-server'"
+fi
+
+export MYSQL_IP=`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' mysql-server`
+
+echo "=> Waiting for mysql server to be ready..."
+while ! mysqladmin ping -h"${MYSQL_IP}" --silent; do
+    sleep 1
+done
+
+echo "=> Starting cloudron-syslog"
+cloudron-syslog --logdir "${DATA_DIR}/platformdata/logs/" &
+
+echo "=> Ensure database"
+mysql -h"${MYSQL_IP}" -uroot -ppassword -e 'CREATE DATABASE IF NOT EXISTS box'
+
+echo "=> Run database migrations"
+cd "${SOURCE_dir}"
+BOX_ENV=test DATABASE_URL=mysql://root:password@${MYSQL_IP}/box node_modules/.bin/db-migrate up
+
+echo "=> Run tests with mocha"
+TESTS=${DEFAULT_TESTS}
+if [[ $# -gt 0 ]]; then
+    TESTS="$*"
+fi
+
+BOX_ENV=test ./node_modules/mocha/bin/_mocha --bail --no-timeouts --exit -R spec ${TESTS}
@@ -1,106 +0,0 @@
-#!/bin/bash
-
-set -eu -o pipefail
-
-readonly curl="curl --fail --connect-timeout 20 --retry 10 --retry-delay 2 --max-time 2400 --http1.1"
-
-ip=""
-dns_config=""
-tls_cert_file=""
-tls_key_file=""
-license_file=""
-backup_config=""
-
-args=$(getopt -o "" -l "ip:,backup-config:,license:,dns-config:,tls-cert:,tls-key:" -n "$0" -- "$@")
-eval set -- "${args}"
-
-while true; do
-    case "$1" in
-    --ip) ip="$2"; shift 2;;
-    --dns-config) dns_config="$2"; shift 2;;
-    --tls-cert) tls_cert_file="$2"; shift 2;;
-    --tls-key) tls_key_file="$2"; shift 2;;
-    --license) license_file="$2"; shift 2;;
-    --backup-config) backup_config="$2"; shift 2;;
-    --) break;;
-    *) echo "Unknown option $1"; exit 1;;
-    esac
-done
-
-# validate arguments in the absence of data
-if [[ -z "${ip}" ]]; then
-    echo "--ip is required"
-    exit 1
-fi
-
-if [[ -z "${dns_config}" ]]; then
-    echo "--dns-config is required"
-    exit 1
-fi
-
-if [[ ! -f "${license_file}" ]]; then
-    echo "--license must be a valid license file"
-    exit 1
-fi
-
-function get_status() {
-    key="$1"
-    if status=$($curl -q -f -k "https://${ip}/api/v1/cloudron/status" 2>/dev/null); then
-        currentValue=$(echo "${status}" | python3 -c 'import sys, json; print(json.dumps(json.load(sys.stdin)[sys.argv[1]]))' "${key}")
-        echo "${currentValue}"
-        return 0
-    fi
-
-    return 1
-}
-
-function wait_for_status() {
-    key="$1"
-    expectedValue="$2"
-
-    echo "wait_for_status: $key to be $expectedValue"
-    while true; do
-        if currentValue=$(get_status "${key}"); then
-            echo "wait_for_status: $key is current: $currentValue expecting: $expectedValue"
-            if [[ "${currentValue}" == $expectedValue ]]; then
-                break
-            fi
-        fi
-        sleep 3
-    done
-}
-
-echo "=> Waiting for cloudron to be ready"
-wait_for_status "version" '*'
-
-domain=$(echo "${dns_config}" | python3 -c 'import json,sys;obj=json.load(sys.stdin);print(obj["domain"])')
-
-echo "Provisioning Cloudron ${domain}"
-if [[ -n "${tls_cert_file}" && -n "${tls_key_file}" ]]; then
-    tls_cert=$(cat "${tls_cert_file}" | awk '{printf "%s\\n", $0}')
-    tls_key=$(cat "${tls_key_file}" | awk '{printf "%s\\n", $0}')
-    fallback_cert=$(printf '{ "cert": "%s", "key": "%s", "provider": "fallback", "restricted": true }' "${tls_cert}" "${tls_key}")
-else
-    fallback_cert=None
-fi
-
-tls_config='{ "provider": "fallback" }'
-dns_config=$(echo "${dns_config}" | python3 -c "import json,sys;obj=json.load(sys.stdin);obj.update(tlsConfig=${tls_config});obj.update(fallbackCertficate=${fallback_cert});print(json.dumps(obj))")
-
-license=$(cat "${license_file}")
-
-if [[ -z "${backup_config:-}" ]]; then
-    backup_config='{ "provider": "filesystem", "backupFolder": "/var/backups", "format": "tgz" }'
-fi
-
-setupData=$(printf '{ "dnsConfig": %s, "autoconf": { "appstoreConfig": %s, "backupConfig": %s } }' "${dns_config}" "${license}" "${backup_config}")
-
-if ! setupResult=$($curl -kq -X POST -H "Content-Type: application/json" -d "${setupData}" https://${ip}/api/v1/cloudron/setup); then
-    echo "Failed to setup with ${setupData} ${setupResult}"
-    exit 1
-fi
-
-wait_for_status "webadminStatus" '*"tls": true*'
-
-echo "Cloudron is ready at https://my-${domain}"
-
@@ -43,21 +43,20 @@ fi
 initBaseImage="true"
 # provisioning data
 provider=""
-edition=""
 requestedVersion=""
 apiServerOrigin="https://api.cloudron.io"
 webServerOrigin="https://cloudron.io"
 sourceTarballUrl=""
 rebootServer="true"
+license=""

-args=$(getopt -o "" -l "help,skip-baseimage-init,provider:,version:,env:,edition:,skip-reboot" -n "$0" -- "$@")
+args=$(getopt -o "" -l "help,skip-baseimage-init,provider:,version:,env:,skip-reboot,license:" -n "$0" -- "$@")
 eval set -- "${args}"

 while true; do
    case "$1" in
    --help) echo "See https://cloudron.io/documentation/installation/ on how to install Cloudron"; exit 0;;
    --provider) provider="$2"; shift 2;;
-    --edition) edition="$2"; shift 2;;
    --version) requestedVersion="$2"; shift 2;;
    --env)
        if [[ "$2" == "dev" ]]; then
@@ -68,6 +67,7 @@ while true; do
            webServerOrigin="https://staging.cloudron.io"
        fi
        shift 2;;
+    --license) license="$2"; shift 2;;
    --skip-baseimage-init) initBaseImage="false"; shift;;
    --skip-reboot) rebootServer="false"; shift;;
    --) break;;
@@ -92,8 +92,9 @@ fi
 echo "Running cloudron-setup with args : $@" > "${LOG_FILE}"

 # validate arguments in the absence of data
+readonly AVAILABLE_PROVIDERS="azure, caas, cloudscale, contabo, digitalocean, ec2, exoscale, galaxygate, gce, hetzner, interox, lightsail, linode, netcup, ovh, rosehosting, scaleway, skysilk, time4vps, upcloud, vultr or generic"
 if [[ -z "${provider}" ]]; then
-    echo "--provider is required (azure, digitalocean, ec2, exoscale, gce, hetzner, lightsail, linode, netcup, ovh, rosehosting, scaleway, vultr or generic)"
+    echo "--provider is required ($AVAILABLE_PROVIDERS)"
    exit 1
 elif [[  \
            "${provider}" != "ami" && \
@@ -106,9 +107,10 @@ elif [[  \
            "${provider}" != "ec2" && \
            "${provider}" != "exoscale" && \
            "${provider}" != "galaxygate" && \
-            "${provider}" != "digitalocean" && \
            "${provider}" != "gce" && \
            "${provider}" != "hetzner" && \
+            "${provider}" != "interox" && \
+            "${provider}" != "interox-image" && \
            "${provider}" != "lightsail" && \
            "${provider}" != "linode" && \
            "${provider}" != "linode-stackscript" && \
@@ -117,15 +119,16 @@ elif [[  \
            "${provider}" != "ovh" && \
            "${provider}" != "rosehosting" && \
            "${provider}" != "scaleway" && \
+            "${provider}" != "skysilk" && \
+            "${provider}" != "skysilk-image" && \
+            "${provider}" != "time4vps" && \
+            "${provider}" != "time4vps-image" && \
+            "${provider}" != "upcloud" && \
+            "${provider}" != "upcloud-image" && \
            "${provider}" != "vultr" && \
            "${provider}" != "generic" \
        ]]; then
-    echo "--provider must be one of: azure, cloudscale.ch, contabo, digitalocean, ec2, exoscale, galaxygate, gce, hetzner, lightsail, linode, netcup, ovh, rosehosting, scaleway, vultr or generic"
-    exit 1
-fi
-
-if [[ -n "${edition}" && ! -f "LICENSE" ]]; then
-    echo "A LICENSE is required to use this edition. Please contact support@cloudron.io"
+    echo "--provider must be one of: $AVAILABLE_PROVIDERS"
    exit 1
 fi

@@ -159,7 +162,7 @@ if [[ "${initBaseImage}" == "true" ]]; then
        exit 1
    fi

-    if ! apt-get install curl python3 ubuntu-standard -y &>> "${LOG_FILE}"; then
+    if ! DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y install curl python3 ubuntu-standard -y &>> "${LOG_FILE}"; then
        echo "Could not install setup dependencies (curl). See ${LOG_FILE}"
        exit 1
    fi
@@ -201,44 +204,29 @@ fi

 # NOTE: this install script only supports 3.x and above
 echo "=> Installing version ${version} (this takes some time) ..."
-if [[ "${version}" =~ 3\.[0-2]+\.[0-9]+ ]]; then
-    readonly DATA_FILE="/root/cloudron-install-data.json"
-    data=$(cat <<EOF
-{
-    "provider": "${provider}",
-    "edition": "${edition}",
-    "apiServerOrigin": "${apiServerOrigin}",
-    "webServerOrigin": "${webServerOrigin}",
-    "version": "${version}"
-}
-EOF
-)
-    echo "${data}" > "${DATA_FILE}"
+mkdir -p /etc/cloudron
+# this file is used >= 4.2
+echo "${provider}" > /etc/cloudron/PROVIDER

-    if ! /bin/bash "${box_src_tmp_dir}/scripts/installer.sh" --data-file "${DATA_FILE}" &>> "${LOG_FILE}"; then
-        echo "Failed to install cloudron. See ${LOG_FILE} for details"
-        exit 1
-    fi
-
-    rm "${DATA_FILE}"
-else
-    mkdir -p /etc/cloudron
-    cat > "/etc/cloudron/cloudron.conf" <<CONF_END
+# this file is unused <= 4.2 and exists to make legacy installations work. the start script will remove this file anyway
+cat > "/etc/cloudron/cloudron.conf" <<CONF_END
 {
    "apiServerOrigin": "${apiServerOrigin}",
    "webServerOrigin": "${webServerOrigin}",
-    "provider": "${provider}",
-    "edition": "${edition}"
+    "provider": "${provider}"
 }
 CONF_END

-    if ! /bin/bash "${box_src_tmp_dir}/scripts/installer.sh" &>> "${LOG_FILE}"; then
-        echo "Failed to install cloudron. See ${LOG_FILE} for details"
-        exit 1
-    fi
+[[ -n "${license}" ]] && echo -n "$license" > /etc/cloudron/LICENSE
+
+if ! /bin/bash "${box_src_tmp_dir}/scripts/installer.sh" &>> "${LOG_FILE}"; then
+    echo "Failed to install cloudron. See ${LOG_FILE} for details"
+    exit 1
 fi

-[[ -f LICENSE ]] && cp LICENSE /etc/cloudron/LICENSE
+# only needed for >= 4.2
+mysql -uroot -ppassword -e "REPLACE INTO box.settings (name, value) VALUES ('api_server_origin', '${apiServerOrigin}');" 2>/dev/null
+mysql -uroot -ppassword -e "REPLACE INTO box.settings (name, value) VALUES ('web_server_origin', '${webServerOrigin}');" 2>/dev/null

 echo -n "=> Waiting for cloudron to be ready (this takes some time) ..."
 while true; do
@@ -1,5 +1,7 @@
 #!/bin/bash

+set -eu -o pipefail
+
 # This script collects diagnostic information to help debug server related issues
 # It also enables SSH access for the cloudron support team

@@ -11,25 +13,33 @@ HELP_MESSAGE="
 This script collects diagnostic information to help debug server related issues

 Options:
+   --admin-login   Login as administrator
   --enable-ssh    Enable SSH access for the Cloudron support team
   --help          Show this message
 "

 # We require root
 if [[ ${EUID} -ne 0 ]]; then
-    echo "This script should be run as root." > /dev/stderr
+    echo "This script should be run as root. Run with sudo"
    exit 1
 fi

 enableSSH="false"

-args=$(getopt -o "" -l "help,enable-ssh" -n "$0" -- "$@")
+args=$(getopt -o "" -l "help,enable-ssh,admin-login" -n "$0" -- "$@")
 eval set -- "${args}"

 while true; do
    case "$1" in
    --help) echo -e "${HELP_MESSAGE}"; exit 0;;
    --enable-ssh) enableSSH="true"; shift;;
+    --admin-login)
+        admin_username=$(mysql -NB -uroot -ppassword -e "SELECT username FROM box.users WHERE admin=1 LIMIT 1" 2>/dev/null)
+        admin_password=$(pwgen -1s 12)
+        printf '{"%s":"%s"}\n' "${admin_username}" "${admin_password}" > /tmp/cloudron_ghost.json
+        echo "Login as ${admin_username} / ${admin_password} . Remove /tmp/cloudron_ghost.json when done."
+        exit 0
+        ;;
    --) break;;
    *) echo "Unknown option $1"; exit 1;;
    esac
@@ -42,7 +52,7 @@ if [[ "`df --output="avail" / | sed -n 2p`" -lt "10240" ]]; then
    echo ""
    df -h
    echo ""
-    echo "To recover from a full disk, follow the guide at https://cloudron.io/documentation/server/#recovery-after-disk-full"
+    echo "To recover from a full disk, follow the guide at https://cloudron.io/documentation/troubleshooting/#recovery-after-disk-full"
    exit 1
 fi

@@ -58,23 +68,8 @@ echo -n "Generating Cloudron Support stats..."
 # clear file
 rm -rf $OUT

-ssh_port=$(cat /etc/ssh/sshd_config | grep "Port " | sed -e "s/.*Port //")
-if [[ $SUDO_USER == "" ]]; then
-    ssh_user="root"
-    ssh_folder="/root/.ssh/"
-    authorized_key_file="${ssh_folder}/authorized_keys"
-else
-    ssh_user="$SUDO_USER"
-    ssh_folder="/home/$SUDO_USER/.ssh/"
-    authorized_key_file="${ssh_folder}/authorized_keys"
-fi
-
-echo -e $LINE"SSH"$LINE >> $OUT
-echo "Username: ${ssh_user}" >> $OUT
-echo "Port:     ${ssh_port}" >> $OUT
-
-echo -e $LINE"cloudron.conf"$LINE >> $OUT
-cat /etc/cloudron/cloudron.conf &>> $OUT
+echo -e $LINE"PROVIDER"$LINE >> $OUT
+cat /etc/cloudron/PROVIDER &>> $OUT || true

 echo -e $LINE"Docker container"$LINE >> $OUT
 if ! timeout --kill-after 10s 15s docker ps -a &>> $OUT 2>&1; then
@@ -84,31 +79,65 @@ fi
 echo -e $LINE"Filesystem stats"$LINE >> $OUT
 df -h &>> $OUT

+echo -e $LINE"Appsdata stats"$LINE >> $OUT
+du -hcsL /home/yellowtent/appsdata/* &>> $OUT
+
+echo -e $LINE"Boxdata stats"$LINE >> $OUT
+du -hcsL /home/yellowtent/boxdata/* &>> $OUT
+
+echo -e $LINE"Backup stats (possibly misleading)"$LINE >> $OUT
+du -hcsL /var/backups/* &>> $OUT
+
 echo -e $LINE"System daemon status"$LINE >> $OUT
 systemctl status --lines=100 cloudron.target box mysql unbound cloudron-syslog nginx collectd docker &>> $OUT

 echo -e $LINE"Box logs"$LINE >> $OUT
 tail -n 100 /home/yellowtent/platformdata/logs/box.log &>> $OUT

+echo -e $LINE"Firewall chains"$LINE >> $OUT
+ip addr &>> $OUT
+
 echo -e $LINE"Firewall chains"$LINE >> $OUT
 iptables -L &>> $OUT

 echo "Done"

+if [[ "${enableSSH}" == "true" ]]; then
+    ssh_port=$(cat /etc/ssh/sshd_config | grep "Port " | sed -e "s/.*Port //")
+    permit_root_login=$(grep -q ^PermitRootLogin.*yes /etc/ssh/sshd_config && echo "yes" || echo "no")
+
+    # support.js uses similar logic
+    if $(grep -q "ec2\|lightsail\|ami" /etc/cloudron/PROVIDER); then
+        ssh_user="ubuntu"
+        keys_file="/home/ubuntu/.ssh/authorized_keys"
+    else
+        ssh_user="root"
+        keys_file="/root/.ssh/authorized_keys"
+    fi
+
+    echo -e $LINE"SSH"$LINE >> $OUT
+    echo "Username: ${ssh_user}" >> $OUT
+    echo "Port:     ${ssh_port}" >> $OUT
+    echo "PermitRootLogin: ${permit_root_login}" >> $OUT
+    echo "Key file: ${keys_file}" >> $OUT
+
+    echo -n "Enabling ssh access for the Cloudron support team..."
+    mkdir -p $(dirname "${keys_file}")       # .ssh does not exist sometimes
+    touch "${keys_file}"                # required for concat to work
+    if ! grep -q "${CLOUDRON_SUPPORT_PUBLIC_KEY}" "${keys_file}"; then
+        echo -e "\n${CLOUDRON_SUPPORT_PUBLIC_KEY}" >> "${keys_file}"
+        chmod 600 "${keys_file}"
+        chown "${ssh_user}" "${keys_file}"
+    fi
+
+    echo "Done"
+fi
+
 echo -n "Uploading information..."
 # for some reason not using $(cat $OUT) will not contain newlines!?
 paste_key=$(curl -X POST ${PASTEBIN}/documents --silent -d "$(cat $OUT)" | python3 -c "import sys, json; print(json.load(sys.stdin)['key'])")
 echo "Done"

-if [[ "${enableSSH}" == "true" ]]; then
-    echo -n "Enabling ssh access for the Cloudron support team..."
-    mkdir -p "${ssh_folder}"
-    echo "${CLOUDRON_SUPPORT_PUBLIC_KEY}" >> ${authorized_key_file}
-    chown -R ${ssh_user} "${ssh_folder}"
-    chmod 600 "${authorized_key_file}"
-    echo "Done"
-fi
-
 echo ""
 echo "Please email the following link to support@cloudron.io"
 echo ""
@@ -25,6 +25,7 @@ readonly ubuntu_codename=$(lsb_release -cs)
 readonly is_update=$(systemctl is-active box && echo "yes" || echo "no")

 echo "==> installer: updating docker"
+
 if [[ $(docker version --format {{.Client.Version}}) != "18.09.2" ]]; then
    # there are 3 packages for docker - containerd, CLI and the daemon
    $curl -sL "https://download.docker.com/linux/ubuntu/dists/${ubuntu_codename}/pool/stable/amd64/containerd.io_1.2.2-3_amd64.deb" -o /tmp/containerd.deb
@@ -26,22 +26,6 @@ systemctl enable apparmor
 systemctl restart apparmor

 usermod ${USER} -a -G docker
-# preserve the existing storage driver (user might be using overlay2)
-storage_driver=$(docker info | grep "Storage Driver" | sed 's/.*: //')
-[[ -n "${storage_driver}" ]] || storage_driver="overlay2" # if the above command fails
-
-temp_file=$(mktemp)
-# create systemd drop-in. some apps do not work with aufs
-echo -e "[Service]\nExecStart=\nExecStart=/usr/bin/dockerd -H fd:// --log-driver=journald --exec-opt native.cgroupdriver=cgroupfs --storage-driver=${storage_driver}" > "${temp_file}"
-
-systemctl enable docker
-# restart docker if options changed
-if [[ ! -f /etc/systemd/system/docker.service.d/cloudron.conf ]] || ! diff -q /etc/systemd/system/docker.service.d/cloudron.conf "${temp_file}" >/dev/null; then
-    mkdir -p /etc/systemd/system/docker.service.d
-    mv "${temp_file}" /etc/systemd/system/docker.service.d/cloudron.conf
-    systemctl daemon-reload
-    systemctl restart docker
-fi
 docker network create --subnet=172.18.0.0/16 cloudron || true

 mkdir -p "${BOX_DATA_DIR}"
@@ -138,8 +122,10 @@ echo "==> Configuring logrotate"
 if ! grep -q "^include ${PLATFORM_DATA_DIR}/logrotate.d" /etc/logrotate.conf; then
    echo -e "\ninclude ${PLATFORM_DATA_DIR}/logrotate.d\n" >> /etc/logrotate.conf
 fi
+rm -f "${PLATFORM_DATA_DIR}/logrotate.d/"*
 cp "${script_dir}/start/logrotate/"* "${PLATFORM_DATA_DIR}/logrotate.d/"
-rm -f "${PLATFORM_DATA_DIR}/logrotate.d/box-logrotate" "${PLATFORM_DATA_DIR}/logrotate.d/app-logrotate" # remove pre 3.6 config files
+
+# logrotate files have to be owned by root, this is here to fixup existing installations where we were resetting the owner to yellowtent
 chown root:root "${PLATFORM_DATA_DIR}/logrotate.d/"

 echo "==> Adding motd message for admins"
@@ -183,7 +169,13 @@ mysqladmin -u root -ppassword password password # reset default root password
 mysql -u root -p${mysql_root_password} -e 'CREATE DATABASE IF NOT EXISTS box'

 echo "==> Migrating data"
-(cd "${BOX_SRC_DIR}" && BOX_ENV=cloudron DATABASE_URL=mysql://root:${mysql_root_password}@127.0.0.1/box "${BOX_SRC_DIR}/node_modules/.bin/db-migrate" up)
+cd "${BOX_SRC_DIR}"
+if ! BOX_ENV=cloudron DATABASE_URL=mysql://root:${mysql_root_password}@127.0.0.1/box "${BOX_SRC_DIR}/node_modules/.bin/db-migrate" up; then
+    echo "DB migration failed"
+    exit 1
+fi
+
+rm -f /etc/cloudron/cloudron.conf

 if [[ ! -f "${BOX_DATA_DIR}/dhparams.pem" ]]; then
    echo "==> Generating dhparams (takes forever)"
@@ -193,6 +185,10 @@ else
    cp "${BOX_DATA_DIR}/dhparams.pem" "${PLATFORM_DATA_DIR}/addons/mail/dhparams.pem"
 fi

+# old installations used to create appdata/<app>/redis which is now part of old backups and prevents restore
+echo "==> Cleaning up stale redis directories"
+find "${APPS_DATA_DIR}" -maxdepth 2 -type d -name redis -exec rm -rf {} +
+
 echo "==> Changing ownership"
 # be careful of what is chown'ed here. subdirs like mysql,redis etc are owned by the containers and will stop working if perms change
 chown -R "${USER}" /etc/cloudron
@@ -201,9 +197,6 @@ chown "${USER}:${USER}" "${PLATFORM_DATA_DIR}/INFRA_VERSION" 2>/dev/null || true
 chown "${USER}:${USER}" "${PLATFORM_DATA_DIR}"
 chown "${USER}:${USER}" "${APPS_DATA_DIR}"

-# logrotate files have to be owned by root, this is here to fixup existing installations where we were resetting the owner to yellowtent
-chown root:root -R "${PLATFORM_DATA_DIR}/logrotate.d"
-
 # do not chown the boxdata/mail directory; dovecot gets upset
 chown "${USER}:${USER}" "${BOX_DATA_DIR}"
 find "${BOX_DATA_DIR}" -mindepth 1 -maxdepth 1 -not -path "${BOX_DATA_DIR}/mail" -exec chown -R "${USER}:${USER}" {} \;
@@ -9,7 +9,7 @@ iptables -t filter -F CLOUDRON # empty any existing rules
 # NOTE: keep these in sync with src/apps.js validatePortBindings
 # allow ssh, http, https, ping, dns
 iptables -t filter -I CLOUDRON -m state --state RELATED,ESTABLISHED -j ACCEPT
-# caas has ssh on port 202
+# ssh is allowed alternately on port 202
 iptables -A CLOUDRON -p tcp -m tcp -m multiport --dports 22,25,80,202,443,587,993,4190 -j ACCEPT

 iptables -t filter -A CLOUDRON -p icmp --icmp-type echo-request -j ACCEPT
@@ -17,11 +17,6 @@ else
    printf "are automatically installed on this server every night.\n"
    printf "\n"
    printf "Read more at https://cloudron.io/documentation/security/#os-updates\n"
-
-    if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config; then
-        printf "\nPlease disable password based SSH access to secure your server. Read more at\n"
-        printf "https://cloudron.io/documentation/security/#securing-ssh-access\n"
-    fi
 fi

 printf "\nFor help and more information, visit https://forum.cloudron.io\n\n"
@@ -240,8 +240,23 @@ LoadPlugin write_graphite
    Interactive false

    Import "df"
-    # <Module df>
-    # </Module>
+
+    Import "du"
+    <Module du>
+        <Path>
+            Instance maildata
+            Dir "/home/yellowtent/boxdata/mail"
+        </Path>
+        <Path>
+            Instance boxdata
+            Dir "/home/yellowtent/boxdata"
+            Exclude "mail"
+        </Path>
+        <Path>
+            Instance platformdata
+            Dir "/home/yellowtent/platformdata"
+        </Path>
+    </Module>
 </Plugin>

 <Plugin write_graphite>
@@ -21,6 +21,7 @@ def read():
        except:
            continue

+        # type comes from https://github.com/collectd/collectd/blob/master/src/types.db
        val = collectd.Values(type='df_complex', plugin='df', plugin_instance=instance)

        free = st.f_bavail * st.f_frsize # bavail is for non-root user. bfree is total
@@ -0,0 +1,79 @@
+import collectd,os,subprocess,sys,re,time
+
+# https://www.programcreek.com/python/example/106897/collectd.register_read
+
+PATHS = [] # { name, dir, exclude }
+INTERVAL = 60 * 60 * 12 # twice a day. change values in docker-graphite if you change this
+
+def du(pathinfo):
+    cmd = 'timeout 1800 du -Dsb "{}"'.format(pathinfo['dir'])
+    if pathinfo['exclude'] != '':
+        cmd += ' --exclude "{}"'.format(pathinfo['exclude'])
+
+    collectd.info('computing size with command: %s' % cmd);
+    try:
+        size = subprocess.check_output(cmd, shell=True).split()[0].decode('utf-8')
+        collectd.info('\tsize of %s is %s (time: %i)' % (pathinfo['dir'], size, int(time.time())))
+        return size
+    except Exception as e:
+        collectd.info('\terror getting the size of %s: %s' % (pathinfo['dir'], str(e)))
+        return 0
+
+def parseSize(size):
+    units = {"B": 1, "KB": 10**3, "MB": 10**6, "GB": 10**9, "TB": 10**12}
+    number, unit, _ = re.split('([a-zA-Z]+)', size.upper())
+    return int(float(number)*units[unit])
+
+def dockerSize():
+    # use --format '{{json .}}' to dump the string. '{{if eq .Type "Images"}}{{.Size}}{{end}}' still creates newlines
+    cmd = 'timeout 1800 docker system df --format "{{.Size}}" | head -n1'
+    try:
+        size = subprocess.check_output(cmd, shell=True).strip().decode('utf-8')
+        collectd.info('size of docker images is %s (%s) (time: %i)' % (size, parseSize(size), int(time.time())))
+        return parseSize(size)
+    except Exception as e:
+        collectd.info('error getting docker images size : %s' % str(e))
+        return 0
+
+# configure is called for each module block. this is called before init
+def configure(config):
+    global PATHS
+
+    for child in config.children:
+        if child.key != 'Path':
+            collectd.info('du plugin: Unknown config key "%s"' % key)
+            continue
+
+        pathinfo = { 'name': '', 'dir': '', 'exclude': '' }
+        for node in child.children:
+            if node.key == 'Instance':
+                pathinfo['name'] = node.values[0]
+            elif node.key == 'Dir':
+                pathinfo['dir'] = node.values[0]
+            elif node.key == 'Exclude':
+                pathinfo['exclude'] = node.values[0]
+
+        PATHS.append(pathinfo);
+        collectd.info('du plugin: monitoring %s' % pathinfo['dir']);
+
+def init():
+    global PATHS
+    collectd.info('custom du plugin initialized with %s %s' % (PATHS, sys.version))
+
+def read():
+    for pathinfo in PATHS:
+        size = du(pathinfo)
+
+        # type comes from https://github.com/collectd/collectd/blob/master/src/types.db
+        val = collectd.Values(type='capacity', plugin='du', plugin_instance=pathinfo['name'])
+        val.dispatch(values=[size], type_instance='usage')
+
+    size = dockerSize()
+    val = collectd.Values(type='capacity', plugin='du', plugin_instance='docker')
+    val.dispatch(values=[size], type_instance='usage')
+
+
+
+collectd.register_init(init)
+collectd.register_config(configure)
+collectd.register_read(read, INTERVAL)
@@ -0,0 +1,40 @@
+# add customizations here
+# after making changes run "sudo systemctl restart box"
+
+# appstore:
+#   blacklist:
+#     - io.wekan.cloudronapp
+#     - io.cloudron.openvpn
+#   whitelist:
+#     org.wordpress.cloudronapp: {}
+#     chat.rocket.cloudronapp: {}
+#     com.nextcloud.cloudronapp: {}
+#
+# backups:
+#   configurable: true
+#
+# domains:
+#   dynamicDns: true
+#   changeDashboardDomain: true
+#
+# subscription:
+#   configurable: true
+#
+# support:
+#   email: support@cloudron.io
+#   remoteSupport: true
+#
+#   ticketFormBody: |
+#     Use this form to open support tickets. You can also write directly to [support@cloudron.io](mailto:support@cloudron.io).
+#       * [Knowledge Base & App Docs](https://cloudron.io/documentation/apps/?support_view)
+#       * [Custom App Packaging & API](https://cloudron.io/developer/packaging/?support_view)
+#       * [Forum](https://forum.cloudron.io/)
+#
+#   submitTickets: true
+#
+# alerts:
+#   email: support@cloudron.io
+#   notifyCloudronAdmins: false
+#
+# footer:
+#   body: '&copy; 2019 [Cloudron](https://cloudron.io) [Forum <i class="fa fa-comments"></i>](https://forum.cloudron.io)'
@@ -1,10 +0,0 @@
-# logrotate config for app and crash logs
-
-/home/yellowtent/platformdata/logs/*/*.log {
-    # only keep one rotated file, we currently do not send that over the api
-    rotate 1
-    size 10M
-    # we never compress so we can simply tail the files
-    nocompress
-    copytruncate
-}
@@ -1,7 +1,8 @@
 # logrotate config for box logs

+# keep upto 5 logs of size 10M each
 /home/yellowtent/platformdata/logs/box.log {
-    rotate 10
+    rotate 5
    size 10M
    # we never compress so we can simply tail the files
    nocompress
@@ -0,0 +1,31 @@
+# logrotate config for app, crash, addon and task logs
+
+# man 7 glob
+/home/yellowtent/platformdata/logs/graphite/*.log
+/home/yellowtent/platformdata/logs/mail/*.log
+/home/yellowtent/platformdata/logs/mysql/*.log
+/home/yellowtent/platformdata/logs/mongodb/*.log
+/home/yellowtent/platformdata/logs/postgresql/*.log
+/home/yellowtent/platformdata/logs/sftp/*.log
+/home/yellowtent/platformdata/logs/redis-*/*.log
+/home/yellowtent/platformdata/logs/crash/*.log
+/home/yellowtent/platformdata/logs/updater/*.log {
+    # only keep one rotated file, we currently do not send that over the api
+    rotate 1
+    size 10M
+    missingok
+    # we never compress so we can simply tail the files
+    nocompress
+    copytruncate
+}
+
+# keep task logs for a week. the 'nocreate' option ensures empty log files are not
+# created post rotation
+/home/yellowtent/platformdata/logs/tasks/*.log {
+    minage 7
+    daily
+    rotate 0
+    missingok
+    nocreate
+}
+
@@ -12,6 +12,9 @@ max_allowed_packet=32M
 character-set-server = utf8mb4
 collation-server = utf8mb4_unicode_ci

+# set timezone to UTC
+default_time_zone='+00:00'
+
 [mysqldump]
 quick
 quote-names
@@ -49,3 +49,4 @@ yellowtent ALL=(root) NOPASSWD: /home/yellowtent/box/src/scripts/restartdocker.s

 Defaults!/home/yellowtent/box/src/scripts/restartunbound.sh env_keep="HOME BOX_ENV"
 yellowtent ALL=(root) NOPASSWD: /home/yellowtent/box/src/scripts/restartunbound.sh
+
@@ -3,6 +3,7 @@
 exports = module.exports = {
    SCOPE_APPS_READ: 'apps:read',
    SCOPE_APPS_MANAGE: 'apps:manage',
+    SCOPE_APPSTORE: 'appstore',
    SCOPE_CLIENTS: 'clients',
    SCOPE_CLOUDRON: 'cloudron',
    SCOPE_DOMAINS_READ: 'domains:read',
@@ -10,9 +11,10 @@ exports = module.exports = {
    SCOPE_MAIL: 'mail',
    SCOPE_PROFILE: 'profile',
    SCOPE_SETTINGS: 'settings',
+    SCOPE_SUBSCRIPTION: 'subscription',
    SCOPE_USERS_READ: 'users:read',
    SCOPE_USERS_MANAGE: 'users:manage',
-    VALID_SCOPES: [ 'apps', 'clients', 'cloudron', 'domains', 'mail', 'profile', 'settings', 'users' ], // keep this sorted
+    VALID_SCOPES: [ 'apps', 'appstore', 'clients', 'cloudron', 'domains', 'mail', 'profile', 'settings', 'subscription', 'users' ], // keep this sorted

    SCOPE_ANY: '*',

@@ -25,12 +27,10 @@ exports = module.exports = {
 };

 var assert = require('assert'),
-    config = require('./config.js'),
-    DatabaseError = require('./databaseerror.js'),
+    BoxError = require('./boxerror.js'),
    debug = require('debug')('box:accesscontrol'),
    tokendb = require('./tokendb.js'),
    users = require('./users.js'),
-    UsersError = users.UsersError,
    _ = require('underscore');

 // returns scopes that does not have wildcards and is sorted
@@ -77,13 +77,12 @@ function intersectScopes(allowedScopes, wantedScopes) {
 function validateScopeString(scope) {
    assert.strictEqual(typeof scope, 'string');

-    if (scope === '') return new Error('Empty scope not allowed');
+    if (scope === '') return new BoxError(BoxError.BAD_FIELD, 'Empty scope not allowed', { field: 'scope' });

    // NOTE: this function intentionally does not allow '*'. This is only allowed in the db to allow
    // us not write a migration script every time we add a new scope
    var allValid = scope.split(',').every(function (s) { return exports.VALID_SCOPES.indexOf(s.split(':')[0]) !== -1; });
-    if (!allValid) return new Error('Invalid scope. Available scopes are ' + exports.VALID_SCOPES.join(', '));
-
+    if (!allValid) return new BoxError(BoxError.BAD_FIELD, 'Invalid scope. Available scopes are ' + exports.VALID_SCOPES.join(', '), { field: 'scope' });
    return null;
 }

@@ -100,7 +99,7 @@ function hasScopes(authorizedScopes, requiredScopes) {
        // this allows apps:write if the token has a higher apps scope
        if (authorizedScopes.indexOf(requiredScopes[i]) === -1 && authorizedScopes.indexOf(scopeParts[0]) === -1) {
            debug('scope: missing scope "%s".', requiredScopes[i]);
-            return new Error('Missing required scope "' + requiredScopes[i] + '"');
+            return new BoxError(BoxError.NOT_FOUND, 'Missing required scope "' + requiredScopes[i] + '"');
        }
    }

@@ -113,7 +112,7 @@ function scopesForUser(user, callback) {

    if (user.admin) return callback(null, exports.VALID_SCOPES);

-    callback(null, config.isSpacesEnabled() ? [ 'profile', 'apps', 'domains:read', 'users:read' ] : [ 'profile', 'apps:read' ]);
+    callback(null, [ 'profile', 'apps:read' ]);
 }

 function validateToken(accessToken, callback) {
@@ -121,21 +120,20 @@ function validateToken(accessToken, callback) {
    assert.strictEqual(typeof callback, 'function');

    tokendb.getByAccessToken(accessToken, function (error, token) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, null /* user */, 'Invalid Token'); // will end up as a 401
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(null, null /* user */, 'Invalid Token'); // will end up as a 401
        if (error) return callback(error); // this triggers 'internal error' in passport

        users.get(token.identifier, function (error, user) {
-            if (error && error.reason === UsersError.NOT_FOUND) return callback(null, null /* user */, 'Invalid Token'); // will end up as a 401
+            if (error && error.reason === BoxError.NOT_FOUND) return callback(null, null /* user */, 'Invalid Token'); // will end up as a 401
            if (error) return callback(error);

+            if (!user.active) return callback(null, null /* user */, 'Invalid Token'); // will end up as a 401
+
            scopesForUser(user, function (error, userScopes) {
                if (error) return callback(error);

-                var authorizedScopes = intersectScopes(userScopes, token.scope.split(','));
-                const skipPasswordVerification = token.clientId === 'cid-sdk' || token.clientId === 'cid-cli'; // these clients do not require password checks unlike UI
-                var info = { authorizedScopes: authorizedScopes, skipPasswordVerification: skipPasswordVerification }; // ends up in req.authInfo
-
-                callback(null, user, info);
+                const authorizedScopes = intersectScopes(userScopes, token.scope.split(','));
+                callback(null, user, { authorizedScopes }); // ends up in req.authInfo
            });
        });
    });
@@ -1,8 +1,6 @@
 'use strict';

 exports = module.exports = {
-    AddonsError: AddonsError,
-
    getServices: getServices,
    getService: getService,
    configureService: configureService,
@@ -36,16 +34,15 @@ var accesscontrol = require('./accesscontrol.js'),
    apps = require('./apps.js'),
    assert = require('assert'),
    async = require('async'),
+    BoxError = require('./boxerror.js'),
    clients = require('./clients.js'),
-    config = require('./config.js'),
-    ClientsError = clients.ClientsError,
+    constants = require('./constants.js'),
    crypto = require('crypto'),
-    DatabaseError = require('./databaseerror.js'),
    debug = require('debug')('box:addons'),
    docker = require('./docker.js'),
    dockerConnection = docker.connection,
-    DockerError = docker.DockerError,
    fs = require('fs'),
+    graphs = require('./graphs.js'),
    hat = require('./hat.js'),
    infra = require('./infra_version.js'),
    mail = require('./mail.js'),
@@ -57,37 +54,13 @@ var accesscontrol = require('./accesscontrol.js'),
    safe = require('safetydance'),
    semver = require('semver'),
    settings = require('./settings.js'),
+    sftp = require('./sftp.js'),
    shell = require('./shell.js'),
    spawn = require('child_process').spawn,
    split = require('split'),
    request = require('request'),
    util = require('util');

-// http://dustinsenos.com/articles/customErrorsInNode
-// http://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
-function AddonsError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(AddonsError, Error);
-AddonsError.INTERNAL_ERROR = 'Internal Error';
-AddonsError.NOT_FOUND = 'Not Found';
-AddonsError.NOT_ACTIVE = 'Not Active';
-
 const NOOP = function (app, options, callback) { return callback(); };
 const NOOP_CALLBACK = function (error) { if (error) debug(error); };
 const RMADDONDIR_CMD = path.join(__dirname, 'scripts/rmaddondir.sh');
@@ -211,10 +184,25 @@ const KNOWN_SERVICES = {
        status: statusUnbound,
        restart: restartUnbound,
        defaultMemoryLimit: 0
+    },
+    sftp: {
+        status: statusSftp,
+        restart: restartContainer.bind(null, 'sftp'),
+        defaultMemoryLimit: 256 * 1024 * 1024
+    },
+    graphite: {
+        status: statusGraphite,
+        restart: restartContainer.bind(null, 'graphite'),
+        defaultMemoryLimit: 75 * 1024 * 1024
+    },
+    nginx: {
+        status: statusNginx,
+        restart: restartNginx,
+        defaultMemoryLimit: 0
    }
 };

-function debugApp(app, args) {
+function debugApp(app /*, args */) {
    assert(typeof app === 'object');

    debug((app.fqdn || app.location) + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
@@ -251,23 +239,68 @@ function restartContainer(serviceName, callback) {
    assert(KNOWN_SERVICES[serviceName], `Unknown service ${serviceName}`);

    docker.stopContainer(serviceName, function (error) {
-        if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        docker.startContainer(serviceName, function (error) {
-            if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
+            if (error && error.reason === BoxError.NOT_FOUND) {
+                callback(null); // callback early since rebuilding takes long
+                return rebuildService(serviceName, function (error) { if (error) console.error(`Unable to rebuild service ${serviceName}`, error); });
+            }
+            if (error) return callback(error);

            callback(null);
        });
    });
 }

+function rebuildService(serviceName, callback) {
+    assert.strictEqual(typeof serviceName, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    assert(KNOWN_SERVICES[serviceName], `Unknown service ${serviceName}`);
+
+    // this attempts to recreate the service docker container if they don't exist but platform infra version is unchanged
+    // passing an infra version of 'none' will not attempt to purge existing data, not sure if this is good or bad
+    if (serviceName === 'mongodb') return startMongodb({ version: 'none' }, callback);
+    if (serviceName === 'postgresql') return startPostgresql({ version: 'none' }, callback);
+    if (serviceName === 'mysql') return startMysql({ version: 'none' }, callback);
+    if (serviceName === 'sftp') return sftp.startSftp({ version: 'none' }, callback);
+    if (serviceName === 'graphite') return graphs.startGraphite({ version: 'none' }, callback);
+
+    // nothing to rebuild for now
+    callback();
+}
+
+function getServiceDetails(containerName, tokenEnvName, callback) {
+    assert.strictEqual(typeof containerName, 'string');
+    assert.strictEqual(typeof tokenEnvName, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    docker.inspect(containerName, function (error, result) {
+        if (error) return callback(error);
+
+        const ip = safe.query(result, 'NetworkSettings.Networks.cloudron.IPAddress', null);
+        if (!ip) return callback(new BoxError(BoxError.INACTIVE, `Error getting ${containerName} container ip`));
+
+        // extract the cloudron token for auth
+        const env = safe.query(result, 'Config.Env', null);
+        if (!env) return callback(new BoxError(BoxError.DOCKER_ERROR, `Error getting ${containerName} env`));
+        const tmp = env.find(function (e) { return e.indexOf(tokenEnvName) === 0; });
+        if (!tmp) return callback(new BoxError(BoxError.DOCKER_ERROR, `Error getting ${containerName} cloudron token env var`));
+        const token = tmp.slice(tokenEnvName.length + 1); // +1 for the = sign
+        if (!token)  return callback(new BoxError(BoxError.DOCKER_ERROR, `Error getting ${containerName} cloudron token`));
+
+        callback(null, { ip: ip, token: token, state: result.State });
+    });
+}
+
 function containerStatus(addonName, addonTokenName, callback) {
    assert.strictEqual(typeof addonName, 'string');
    assert.strictEqual(typeof addonTokenName, 'string');
    assert.strictEqual(typeof callback, 'function');

    getServiceDetails(addonName, addonTokenName, function (error, addonDetails) {
-        if (error && error.reason === AddonsError.NOT_ACTIVE) return callback(null, { status: exports.SERVICE_STATUS_STOPPED });
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(null, { status: exports.SERVICE_STATUS_STOPPED });
        if (error) return callback(error);

        request.get(`https://${addonDetails.ip}:3000/healthcheck?access_token=${addonDetails.token}`, { json: true, rejectUnauthorized: false }, function (error, response) {
@@ -275,7 +308,7 @@ function containerStatus(addonName, addonTokenName, callback) {
            if (response.statusCode !== 200 || !response.body.status) return callback(null, { status: exports.SERVICE_STATUS_STARTING, error: `Error waiting for ${addonName}. Status code: ${response.statusCode} message: ${response.body.message}` });

            docker.memoryUsage(addonName, function (error, result) {
-                if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
+                if (error) return callback(error);

                var tmp = {
                    status: addonDetails.state.Running ? exports.SERVICE_STATUS_ACTIVE : exports.SERVICE_STATUS_STOPPED,
@@ -301,7 +334,7 @@ function getService(serviceName, callback) {
    assert.strictEqual(typeof serviceName, 'string');
    assert.strictEqual(typeof callback, 'function');

-    if (!KNOWN_SERVICES[serviceName]) return callback(new AddonsError(AddonsError.NOT_FOUND));
+    if (!KNOWN_SERVICES[serviceName]) return callback(new BoxError(BoxError.NOT_FOUND));

    var tmp = {
        name: serviceName,
@@ -314,7 +347,7 @@ function getService(serviceName, callback) {
    };

    settings.getPlatformConfig(function (error, platformConfig) {
-        if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        if (platformConfig[serviceName] && platformConfig[serviceName].memory && platformConfig[serviceName].memorySwap) {
            tmp.config.memory = platformConfig[serviceName].memory;
@@ -325,7 +358,7 @@ function getService(serviceName, callback) {
        }

        KNOWN_SERVICES[serviceName].status(function (error, result) {
-            if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
+            if (error) return callback(error);

            tmp.status = result.status;
            tmp.memoryUsed = result.memoryUsed;
@@ -342,10 +375,10 @@ function configureService(serviceName, data, callback) {
    assert.strictEqual(typeof data, 'object');
    assert.strictEqual(typeof callback, 'function');

-    if (!KNOWN_SERVICES[serviceName]) return callback(new AddonsError(AddonsError.NOT_FOUND));
+    if (!KNOWN_SERVICES[serviceName]) return callback(new BoxError(BoxError.NOT_FOUND));

    settings.getPlatformConfig(function (error, platformConfig) {
-        if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        if (!platformConfig[serviceName]) platformConfig[serviceName] = {};

@@ -358,7 +391,7 @@ function configureService(serviceName, data, callback) {
        }

        settings.setPlatformConfig(platformConfig, function (error) {
-            if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
+            if (error) return callback(error);

            callback(null);
        });
@@ -374,7 +407,7 @@ function getServiceLogs(serviceName, options, callback) {
    assert.strictEqual(typeof options.format, 'string');
    assert.strictEqual(typeof options.follow, 'boolean');

-    if (!KNOWN_SERVICES[serviceName]) return callback(new AddonsError(AddonsError.NOT_FOUND));
+    if (!KNOWN_SERVICES[serviceName]) return callback(new BoxError(BoxError.NOT_FOUND));

    debug(`Getting logs for ${serviceName}`);

@@ -433,35 +466,11 @@ function restartService(serviceName, callback) {
    assert.strictEqual(typeof serviceName, 'string');
    assert.strictEqual(typeof callback, 'function');

-    if (!KNOWN_SERVICES[serviceName]) return callback(new AddonsError(AddonsError.NOT_FOUND));
+    if (!KNOWN_SERVICES[serviceName]) return callback(new BoxError(BoxError.NOT_FOUND));

    KNOWN_SERVICES[serviceName].restart(callback);
 }

-function getServiceDetails(containerName, tokenEnvName, callback) {
-    assert.strictEqual(typeof containerName, 'string');
-    assert.strictEqual(typeof tokenEnvName, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    docker.inspect(containerName, function (error, result) {
-        if (error && error.reason === DockerError.NOT_FOUND) return callback(new AddonsError(AddonsError.NOT_ACTIVE, error));
-        if (error) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, error));
-
-        const ip = safe.query(result, 'NetworkSettings.Networks.cloudron.IPAddress', null);
-        if (!ip) return callback(new AddonsError(AddonsError.NOT_ACTIVE, `Error getting ${containerName} container ip`));
-
-        // extract the cloudron token for auth
-        const env = safe.query(result, 'Config.Env', null);
-        if (!env) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, `Error getting ${containerName} env`));
-        const tmp = env.find(function (e) { return e.indexOf(tokenEnvName) === 0; });
-        if (!tmp) return callback(new AddonsError(AddonsError.INTERNAL_ERROR, `Error getting ${containerName} cloudron token env var`));
-        const token = tmp.slice(tokenEnvName.length + 1); // +1 for the = sign
-        if (!token)  return callback(new AddonsError(AddonsError.INTERNAL_ERROR, `Error getting ${containerName} cloudron token`));
-
-        callback(null, { ip: ip, token: token, state: result.State });
-    });
-}
-
 function waitForService(containerName, tokenEnvName, callback) {
    assert.strictEqual(typeof containerName, 'string');
    assert.strictEqual(typeof tokenEnvName, 'string');
@@ -605,7 +614,9 @@ function importDatabase(addon, callback) {
                if (!error) return iteratorCallback();

                debug(`importDatabase: Error importing ${addon} of app ${app.id}. Marking as errored`, error);
-                appdb.update(app.id, { installationState: appdb.ISTATE_ERROR, installationProgress: error.message }, iteratorCallback);
+                // FIXME: there is no way to 'repair' if we are here. we need to make a separate apptask that re-imports db
+                // not clear, if repair workflow should be part of addon or per-app
+                appdb.update(app.id, { installationState: apps.ISTATE_ERROR, error: { message: error.message } }, iteratorCallback);
            });
        }, callback);
    });
@@ -617,7 +628,7 @@ function updateServiceConfig(platformConfig, callback) {
    debug('updateServiceConfig: %j', platformConfig);

    // TODO: this should possibly also rollback memory to default
-    async.eachSeries([ 'mysql', 'postgresql', 'mail', 'mongodb' ], function iterator(serviceName, iteratorCallback) {
+    async.eachSeries([ 'mysql', 'postgresql', 'mail', 'mongodb', 'graphite' ], function iterator(serviceName, iteratorCallback) {
        const containerConfig = platformConfig[serviceName];
        let memory, memorySwap;
        if (containerConfig && containerConfig.memory && containerConfig.memorySwap) {
@@ -670,7 +681,7 @@ function getEnvironment(app, callback) {
    appdb.getAddonConfigByAppId(app.id, function (error, result) {
        if (error) return callback(error);

-        if (app.manifest.addons['docker']) result.push({ name: 'DOCKER_HOST', value: `tcp://172.18.0.1:${config.get('dockerProxyPort')}` });
+        if (app.manifest.addons['docker']) result.push({ name: 'DOCKER_HOST', value: `tcp://172.18.0.1:${constants.DOCKER_PROXY_PORT}` });

        return callback(null, result.map(function (e) { return e.name + '=' + e.value; }));
    });
@@ -775,15 +786,17 @@ function setupOauth(app, options, callback) {
    var scope = accesscontrol.SCOPE_PROFILE;

    clients.delByAppIdAndType(appId, clients.TYPE_OAUTH, function (error) { // remove existing creds
-        if (error && error.reason !== ClientsError.NOT_FOUND) return callback(error);
+        if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

        clients.add(appId, clients.TYPE_OAUTH, redirectURI, scope, function (error, result) {
            if (error) return callback(error);

+            const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
            var env = [
-                { name: 'OAUTH_CLIENT_ID', value: result.id },
-                { name: 'OAUTH_CLIENT_SECRET', value: result.clientSecret },
-                { name: 'OAUTH_ORIGIN', value: config.adminOrigin() }
+                { name: `${envPrefix}OAUTH_CLIENT_ID`, value: result.id },
+                { name: `${envPrefix}OAUTH_CLIENT_SECRET`, value: result.clientSecret },
+                { name: `${envPrefix}OAUTH_ORIGIN`, value: settings.adminOrigin() }
            ];

            debugApp(app, 'Setting oauth addon config to %j', env);
@@ -801,7 +814,7 @@ function teardownOauth(app, options, callback) {
    debugApp(app, 'teardownOauth');

    clients.delByAppIdAndType(app.id, clients.TYPE_OAUTH, function (error) {
-        if (error && error.reason !== ClientsError.NOT_FOUND) debug(error);
+        if (error && error.reason !== BoxError.NOT_FOUND) debug(error);

        appdb.unsetAddonConfig(app.id, 'oauth', callback);
    });
@@ -817,17 +830,19 @@ function setupEmail(app, options, callback) {

        const mailInDomains = mailDomains.filter(function (d) { return d.enabled; }).map(function (d) { return d.domain; }).join(',');

+        const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
        // note that "external" access info can be derived from MAIL_DOMAIN (since it's part of user documentation)
        var env = [
-            { name: 'MAIL_SMTP_SERVER', value: 'mail' },
-            { name: 'MAIL_SMTP_PORT', value: '2525' },
-            { name: 'MAIL_IMAP_SERVER', value: 'mail' },
-            { name: 'MAIL_IMAP_PORT', value: '9993' },
-            { name: 'MAIL_SIEVE_SERVER', value: 'mail' },
-            { name: 'MAIL_SIEVE_PORT', value: '4190' },
-            { name: 'MAIL_DOMAIN', value: app.domain },
-            { name: 'MAIL_DOMAINS', value: mailInDomains },
-            { name: 'LDAP_MAILBOXES_BASE_DN', value: 'ou=mailboxes,dc=cloudron' }
+            { name: `${envPrefix}MAIL_SMTP_SERVER`, value: 'mail' },
+            { name: `${envPrefix}MAIL_SMTP_PORT`, value: '2525' },
+            { name: `${envPrefix}MAIL_IMAP_SERVER`, value: 'mail' },
+            { name: `${envPrefix}MAIL_IMAP_PORT`, value: '9993' },
+            { name: `${envPrefix}MAIL_SIEVE_SERVER`, value: 'mail' },
+            { name: `${envPrefix}MAIL_SIEVE_PORT`, value: '4190' },
+            { name: `${envPrefix}MAIL_DOMAIN`, value: app.domain },
+            { name: `${envPrefix}MAIL_DOMAINS`, value: mailInDomains },
+            { name: `${envPrefix}LDAP_MAILBOXES_BASE_DN`, value: 'ou=mailboxes,dc=cloudron' }
        ];

        debugApp(app, 'Setting up Email');
@@ -853,14 +868,16 @@ function setupLdap(app, options, callback) {

    if (!app.sso) return callback(null);

+    const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
    var env = [
-        { name: 'LDAP_SERVER', value: '172.18.0.1' },
-        { name: 'LDAP_PORT', value: '' + config.get('ldapPort') },
-        { name: 'LDAP_URL', value: 'ldap://172.18.0.1:' + config.get('ldapPort') },
-        { name: 'LDAP_USERS_BASE_DN', value: 'ou=users,dc=cloudron' },
-        { name: 'LDAP_GROUPS_BASE_DN', value: 'ou=groups,dc=cloudron' },
-        { name: 'LDAP_BIND_DN', value: 'cn='+ app.id + ',ou=apps,dc=cloudron' },
-        { name: 'LDAP_BIND_PASSWORD', value: hat(4 * 128) } // this is ignored
+        { name: `${envPrefix}LDAP_SERVER`, value: '172.18.0.1' },
+        { name: `${envPrefix}LDAP_PORT`, value: '' + constants.LDAP_PORT },
+        { name: `${envPrefix}LDAP_URL`, value: 'ldap://172.18.0.1:' + constants.LDAP_PORT },
+        { name: `${envPrefix}LDAP_USERS_BASE_DN`, value: 'ou=users,dc=cloudron' },
+        { name: `${envPrefix}LDAP_GROUPS_BASE_DN`, value: 'ou=groups,dc=cloudron' },
+        { name: `${envPrefix}LDAP_BIND_DN`, value: 'cn='+ app.id + ',ou=apps,dc=cloudron' },
+        { name: `${envPrefix}LDAP_BIND_PASSWORD`, value: hat(4 * 128) } // this is ignored
    ];

    debugApp(app, 'Setting up LDAP');
@@ -885,19 +902,21 @@ function setupSendMail(app, options, callback) {

    debugApp(app, 'Setting up SendMail');

-    appdb.getAddonConfigByName(app.id, 'sendmail', 'MAIL_SMTP_PASSWORD', function (error, existingPassword) {
-        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
+    appdb.getAddonConfigByName(app.id, 'sendmail', '%MAIL_SMTP_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

        var password = error ? hat(4 * 48) : existingPassword; // see box#565 for password length

+        const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
        var env = [
-            { name: 'MAIL_SMTP_SERVER', value: 'mail' },
-            { name: 'MAIL_SMTP_PORT', value: '2525' },
-            { name: 'MAIL_SMTPS_PORT', value: '2465' },
-            { name: 'MAIL_SMTP_USERNAME', value: app.mailboxName + '@' + app.domain },
-            { name: 'MAIL_SMTP_PASSWORD', value: password },
-            { name: 'MAIL_FROM', value: app.mailboxName + '@' + app.domain },
-            { name: 'MAIL_DOMAIN', value: app.domain }
+            { name: `${envPrefix}MAIL_SMTP_SERVER`, value: 'mail' },
+            { name: `${envPrefix}MAIL_SMTP_PORT`, value: '2525' },
+            { name: `${envPrefix}MAIL_SMTPS_PORT`, value: '2465' },
+            { name: `${envPrefix}MAIL_SMTP_USERNAME`, value: app.mailboxName + '@' + app.domain },
+            { name: `${envPrefix}MAIL_SMTP_PASSWORD`, value: password },
+            { name: `${envPrefix}MAIL_FROM`, value: app.mailboxName + '@' + app.domain },
+            { name: `${envPrefix}MAIL_DOMAIN`, value: app.domain }
        ];
        debugApp(app, 'Setting sendmail addon config to %j', env);
        appdb.setAddonConfig(app.id, 'sendmail', env, callback);
@@ -921,18 +940,20 @@ function setupRecvMail(app, options, callback) {

    debugApp(app, 'Setting up recvmail');

-    appdb.getAddonConfigByName(app.id, 'recvmail', 'MAIL_IMAP_PASSWORD', function (error, existingPassword) {
-        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
+    appdb.getAddonConfigByName(app.id, 'recvmail', '%MAIL_IMAP_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

        var password = error ? hat(4 * 48) : existingPassword;  // see box#565 for password length

+        const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
        var env = [
-            { name: 'MAIL_IMAP_SERVER', value: 'mail' },
-            { name: 'MAIL_IMAP_PORT', value: '9993' },
-            { name: 'MAIL_IMAP_USERNAME', value: app.mailboxName + '@' + app.domain },
-            { name: 'MAIL_IMAP_PASSWORD', value: password },
-            { name: 'MAIL_TO', value: app.mailboxName + '@' + app.domain },
-            { name: 'MAIL_DOMAIN', value: app.domain }
+            { name: `${envPrefix}MAIL_IMAP_SERVER`, value: 'mail' },
+            { name: `${envPrefix}MAIL_IMAP_PORT`, value: '9993' },
+            { name: `${envPrefix}MAIL_IMAP_USERNAME`, value: app.mailboxName + '@' + app.domain },
+            { name: `${envPrefix}MAIL_IMAP_PASSWORD`, value: password },
+            { name: `${envPrefix}MAIL_TO`, value: app.mailboxName + '@' + app.domain },
+            { name: `${envPrefix}MAIL_DOMAIN`, value: app.domain }
        ];

        debugApp(app, 'Setting sendmail addon config to %j', env);
@@ -977,6 +998,7 @@ function startMysql(existingInfra, callback) {
        if (error) return callback(error);

        const cmd = `docker run --restart=always -d --name="mysql" \
+                    --hostname mysql \
                    --net cloudron \
                    --net-alias mysql \
                    --log-driver syslog \
@@ -1014,8 +1036,8 @@ function setupMySql(app, options, callback) {

    debugApp(app, 'Setting up mysql');

-    appdb.getAddonConfigByName(app.id, 'mysql', 'MYSQL_PASSWORD', function (error, existingPassword) {
-        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
+    appdb.getAddonConfigByName(app.id, 'mysql', '%MYSQL_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

        const tmp = mysqlDatabaseName(app.id);

@@ -1033,19 +1055,21 @@ function setupMySql(app, options, callback) {
                if (error) return callback(new Error('Error setting up mysql: ' + error));
                if (response.statusCode !== 201) return callback(new Error(`Error setting up mysql. Status code: ${response.statusCode} message: ${response.body.message}`));

+                const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
                var env = [
-                    { name: 'MYSQL_USERNAME', value: data.username },
-                    { name: 'MYSQL_PASSWORD', value: data.password },
-                    { name: 'MYSQL_HOST', value: 'mysql' },
-                    { name: 'MYSQL_PORT', value: '3306' }
+                    { name: `${envPrefix}MYSQL_USERNAME`, value: data.username },
+                    { name: `${envPrefix}MYSQL_PASSWORD`, value: data.password },
+                    { name: `${envPrefix}MYSQL_HOST`, value: 'mysql' },
+                    { name: `${envPrefix}MYSQL_PORT`, value: '3306' }
                ];

                if (options.multipleDatabases) {
-                    env = env.concat({ name: 'MYSQL_DATABASE_PREFIX', value: `${data.prefix}_` });
+                    env = env.concat({ name: `${envPrefix}MYSQL_DATABASE_PREFIX`, value: `${data.prefix}_` });
                } else {
                    env = env.concat(
-                        { name: 'MYSQL_URL', value: `mysql://${data.username}:${data.password}@mysql/${data.database}` },
-                        { name: 'MYSQL_DATABASE', value: data.database }
+                        { name: `${envPrefix}MYSQL_URL`, value: `mysql://${data.username}:${data.password}@mysql/${data.database}` },
+                        { name: `${envPrefix}MYSQL_DATABASE`, value: data.database }
                    );
                }

@@ -1189,6 +1213,7 @@ function startPostgresql(existingInfra, callback) {
        if (error) return callback(error);

        const cmd = `docker run --restart=always -d --name="postgresql" \
+                    --hostname postgresql \
                    --net cloudron \
                    --net-alias postgresql \
                    --log-driver syslog \
@@ -1227,8 +1252,8 @@ function setupPostgreSql(app, options, callback) {

    const { database, username } = postgreSqlNames(app.id);

-    appdb.getAddonConfigByName(app.id, 'postgresql', 'POSTGRESQL_PASSWORD', function (error, existingPassword) {
-        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
+    appdb.getAddonConfigByName(app.id, 'postgresql', '%POSTGRESQL_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

        const data = {
            database: database,
@@ -1243,13 +1268,15 @@ function setupPostgreSql(app, options, callback) {
                if (error) return callback(new Error('Error setting up postgresql: ' + error));
                if (response.statusCode !== 201) return callback(new Error(`Error setting up postgresql. Status code: ${response.statusCode} message: ${response.body.message}`));

+                const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
                var env = [
-                    { name: 'POSTGRESQL_URL', value: `postgres://${data.username}:${data.password}@postgresql/${data.database}` },
-                    { name: 'POSTGRESQL_USERNAME', value: data.username },
-                    { name: 'POSTGRESQL_PASSWORD', value: data.password },
-                    { name: 'POSTGRESQL_HOST', value: 'postgresql' },
-                    { name: 'POSTGRESQL_PORT', value: '5432' },
-                    { name: 'POSTGRESQL_DATABASE', value: data.database }
+                    { name: `${envPrefix}POSTGRESQL_URL`, value: `postgres://${data.username}:${data.password}@postgresql/${data.database}` },
+                    { name: `${envPrefix}POSTGRESQL_USERNAME`, value: data.username },
+                    { name: `${envPrefix}POSTGRESQL_PASSWORD`, value: data.password },
+                    { name: `${envPrefix}POSTGRESQL_HOST`, value: 'postgresql' },
+                    { name: `${envPrefix}POSTGRESQL_PORT`, value: '5432' },
+                    { name: `${envPrefix}POSTGRESQL_DATABASE`, value: data.database }
                ];

                debugApp(app, 'Setting postgresql addon config to %j', env);
@@ -1363,6 +1390,7 @@ function startMongodb(existingInfra, callback) {
        if (error) return callback(error);

        const cmd = `docker run --restart=always -d --name="mongodb" \
+                    --hostname mongodb \
                    --net cloudron \
                    --net-alias mongodb \
                    --log-driver syslog \
@@ -1399,13 +1427,14 @@ function setupMongoDb(app, options, callback) {

    debugApp(app, 'Setting up mongodb');

-    appdb.getAddonConfigByName(app.id, 'mongodb', 'MONGODB_PASSWORD', function (error, existingPassword) {
-        if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
+    appdb.getAddonConfigByName(app.id, 'mongodb', '%MONGODB_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

        const data = {
            database: app.id,
            username: app.id,
-            password: error ? hat(4 * 128) : existingPassword
+            password: error ? hat(4 * 128) : existingPassword,
+            oplog: !!options.oplog
        };

        getServiceDetails('mongodb', 'CLOUDRON_MONGODB_TOKEN', function (error, result) {
@@ -1415,15 +1444,21 @@ function setupMongoDb(app, options, callback) {
                if (error) return callback(new Error('Error setting up mongodb: ' + error));
                if (response.statusCode !== 201) return callback(new Error(`Error setting up mongodb. Status code: ${response.statusCode}`));

+                const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
                var env = [
-                    { name: 'MONGODB_URL', value : `mongodb://${data.username}:${data.password}@mongodb/${data.database}` },
-                    { name: 'MONGODB_USERNAME', value : data.username },
-                    { name: 'MONGODB_PASSWORD', value: data.password },
-                    { name: 'MONGODB_HOST', value : 'mongodb' },
-                    { name: 'MONGODB_PORT', value : '27017' },
-                    { name: 'MONGODB_DATABASE', value : data.database }
+                    { name: `${envPrefix}MONGODB_URL`, value : `mongodb://${data.username}:${data.password}@mongodb:27017/${data.database}` },
+                    { name: `${envPrefix}MONGODB_USERNAME`, value : data.username },
+                    { name: `${envPrefix}MONGODB_PASSWORD`, value: data.password },
+                    { name: `${envPrefix}MONGODB_HOST`, value : 'mongodb' },
+                    { name: `${envPrefix}MONGODB_PORT`, value : '27017' },
+                    { name: `${envPrefix}MONGODB_DATABASE`, value : data.database }
                ];

+                if (options.oplog) {
+                    env.push({ name: `${envPrefix}MONGODB_OPLOG_URL`, value : `mongodb://${data.username}:${data.password}@mongodb:27017/local?authSource=${data.database}` });
+                }
+
                debugApp(app, 'Setting mongodb addon config to %j', env);
                appdb.setAddonConfig(app.id, 'mongodb', env, callback);
            });
@@ -1517,9 +1552,21 @@ function startRedis(existingInfra, callback) {
    const tag = infra.images.redis.tag;
    const upgrading = existingInfra.version !== 'none' && requiresUpgrade(existingInfra.images.redis.tag, tag);

-    if (!upgrading) return callback();
+    appdb.getAll(function (error, apps) {
+        if (error) return callback(error);

-    importDatabase('redis', callback); // setupRedis currently starts the app container
+        async.eachSeries(apps, function iterator (app, iteratorCallback) {
+            if (!('redis' in app.manifest.addons)) return iteratorCallback(); // app doesn't use the addon
+
+            setupRedis(app, app.manifest.addons.redis, iteratorCallback);
+        }, function (error) {
+            if (error) return callback(error);
+
+            if (!upgrading) return callback();
+
+            importDatabase('redis', callback); // setupRedis currently starts the app container
+        });
+    });
 }

 // Ensures that app's addon redis container is running. Can be called when named container already exists/running
@@ -1530,65 +1577,69 @@ function setupRedis(app, options, callback) {

    const redisName = 'redis-' + app.id;

-    docker.inspect(redisName, function (error, result) {
-        if (!error) {
-            debug(`Re-using existing redis container with state: ${result.State}`);
-            return callback();
+    appdb.getAddonConfigByName(app.id, 'redis', '%REDIS_PASSWORD', function (error, existingPassword) {
+        if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);
+
+        const redisPassword = options.noPassword ? '' : (error ? hat(4 * 48) : existingPassword); // see box#362 for password length
+        const redisServiceToken = hat(4 * 48);
+
+        // Compute redis memory limit based on app's memory limit (this is arbitrary)
+        var memoryLimit = app.memoryLimit || app.manifest.memoryLimit || 0;
+
+        if (memoryLimit === -1) { // unrestricted (debug mode)
+            memoryLimit = 0;
+        } else if (memoryLimit === 0 || memoryLimit <= (2 * 1024 * 1024 * 1024)) { // less than 2G (ram+swap)
+            memoryLimit = 150 * 1024 * 1024; // 150m
+        } else {
+            memoryLimit = 600 * 1024 * 1024; // 600m
        }

-        appdb.getAddonConfigByName(app.id, 'redis', 'REDIS_PASSWORD', function (error, existingPassword) {
-            if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(error);
+        const tag = infra.images.redis.tag;
+        const label = app.fqdn;
+        // note that we do not add appId label because this interferes with the stop/start app logic
+        const cmd = `docker run --restart=always -d --name=${redisName} \
+                    --hostname ${redisName} \
+                    --label=location=${label} \
+                    --net cloudron \
+                    --net-alias ${redisName} \
+                    --log-driver syslog \
+                    --log-opt syslog-address=udp://127.0.0.1:2514 \
+                    --log-opt syslog-format=rfc5424 \
+                    --log-opt tag="${redisName}" \
+                    -m ${memoryLimit/2} \
+                    --memory-swap ${memoryLimit} \
+                    --dns 172.18.0.1 \
+                    --dns-search=. \
+                    -e CLOUDRON_REDIS_PASSWORD="${redisPassword}" \
+                    -e CLOUDRON_REDIS_TOKEN="${redisServiceToken}" \
+                    -v "${paths.PLATFORM_DATA_DIR}/redis/${app.id}:/var/lib/redis" \
+                    --label isCloudronManaged=true \
+                    --read-only -v /tmp -v /run ${tag}`;

-            const redisPassword = error ? hat(4 * 48) : existingPassword; // see box#362 for password length
-            const redisServiceToken = hat(4 * 48);
+        const envPrefix = app.manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';

-            // Compute redis memory limit based on app's memory limit (this is arbitrary)
-            var memoryLimit = app.memoryLimit || app.manifest.memoryLimit || 0;
+        var env = [
+            { name: `${envPrefix}REDIS_URL`, value: 'redis://redisuser:' + redisPassword + '@redis-' + app.id },
+            { name: `${envPrefix}REDIS_PASSWORD`, value: redisPassword },
+            { name: `${envPrefix}REDIS_HOST`, value: redisName },
+            { name: `${envPrefix}REDIS_PORT`, value: '6379' }
+        ];

-            if (memoryLimit === -1) { // unrestricted (debug mode)
-                memoryLimit = 0;
-            } else if (memoryLimit === 0 || memoryLimit <= (2 * 1024 * 1024 * 1024)) { // less than 2G (ram+swap)
-                memoryLimit = 150 * 1024 * 1024; // 150m
-            } else {
-                memoryLimit = 600 * 1024 * 1024; // 600m
-            }
-
-            const tag = infra.images.redis.tag;
-            const label = app.fqdn;
-            // note that we do not add appId label because this interferes with the stop/start app logic
-            const cmd = `docker run --restart=always -d --name=${redisName} \
-                        --label=location=${label} \
-                        --net cloudron \
-                        --net-alias ${redisName} \
-                        --log-driver syslog \
-                        --log-opt syslog-address=udp://127.0.0.1:2514 \
-                        --log-opt syslog-format=rfc5424 \
-                        --log-opt tag="${redisName}" \
-                        -m ${memoryLimit/2} \
-                        --memory-swap ${memoryLimit} \
-                        --dns 172.18.0.1 \
-                        --dns-search=. \
-                        -e CLOUDRON_REDIS_PASSWORD="${redisPassword}" \
-                        -e CLOUDRON_REDIS_TOKEN="${redisServiceToken}" \
-                        -v "${paths.PLATFORM_DATA_DIR}/redis/${app.id}:/var/lib/redis" \
-                        --label isCloudronManaged=true \
-                        --read-only -v /tmp -v /run ${tag}`;
-
-            var env = [
-                { name: 'REDIS_URL', value: 'redis://redisuser:' + redisPassword + '@redis-' + app.id },
-                { name: 'REDIS_PASSWORD', value: redisPassword },
-                { name: 'REDIS_HOST', value: redisName },
-                { name: 'REDIS_PORT', value: '6379' }
-            ];
-
-            async.series([
-                shell.exec.bind(null, 'startRedis', cmd),
-                appdb.setAddonConfig.bind(null, app.id, 'redis', env),
-                waitForService.bind(null, 'redis-' + app.id, 'CLOUDRON_REDIS_TOKEN')
-            ], function (error) {
-                if (error) debug('Error setting up redis: ', error);
-                callback(error);
-            });
+        async.series([
+            (next) => {
+                docker.inspect(redisName, function (inspectError, result) { // fast-path
+                    if (!inspectError) {
+                        debug(`Re-using existing redis container with state: ${JSON.stringify(result.State)}`);
+                        return next();
+                    }
+                    shell.exec('startRedis', cmd, next);
+                });
+            },
+            appdb.setAddonConfig.bind(null, app.id, 'redis', env),
+            waitForService.bind(null, 'redis-' + app.id, 'CLOUDRON_REDIS_TOKEN')
+        ], function (error) {
+            if (error) debug('Error setting up redis: ', error);
+            callback(error);
        });
    });
 }
@@ -1715,3 +1766,66 @@ function restartUnbound(callback) {

    callback(null);
 }
+
+function statusNginx(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    shell.exec('statusNginx', 'systemctl is-active nginx', function (error) {
+        callback(null, { status: error ? exports.SERVICE_STATUS_STOPPED : exports.SERVICE_STATUS_ACTIVE });
+    });
+}
+
+function restartNginx(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    shell.sudo('reloadnginx', [ path.join(__dirname, 'scripts/reloadnginx.sh') ], {}, NOOP_CALLBACK);
+
+    callback(null);
+}
+
+function statusSftp(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    docker.inspect('sftp', function (error, container) {
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(null, { status: exports.SERVICE_STATUS_STOPPED });
+        if (error) return callback(error);
+
+        docker.memoryUsage('sftp', function (error, result) {
+            if (error) return callback(error);
+
+            var tmp = {
+                status: container.State.Running ? exports.SERVICE_STATUS_ACTIVE : exports.SERVICE_STATUS_STOPPED,
+                memoryUsed: result.memory_stats.usage,
+                memoryPercent: parseInt(100 * result.memory_stats.usage / result.memory_stats.limit)
+            };
+
+            callback(null, tmp);
+        });
+    });
+}
+
+function statusGraphite(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    docker.inspect('graphite', function (error, container) {
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(null, { status: exports.SERVICE_STATUS_STOPPED });
+        if (error) return callback(error);
+
+        request.get('http://127.0.0.1:8417/graphite-web/dashboard', { timeout: 3000 }, function (error, response) {
+            if (error) return callback(null, { status: exports.SERVICE_STATUS_STARTING, error: `Error waiting for graphite: ${error.message}` });
+            if (response.statusCode !== 200) return callback(null, { status: exports.SERVICE_STATUS_STARTING, error: `Error waiting for graphite. Status code: ${response.statusCode} message: ${response.body.message}` });
+
+            docker.memoryUsage('graphite', function (error, result) {
+                if (error) return callback(error);
+
+                var tmp = {
+                    status: container.State.Running ? exports.SERVICE_STATUS_ACTIVE : exports.SERVICE_STATUS_STOPPED,
+                    memoryUsed: result.memory_stats.usage,
+                    memoryPercent: parseInt(100 * result.memory_stats.usage / result.memory_stats.limit)
+                };
+
+                callback(null, tmp);
+            });
+        });
+    });
+}
@@ -21,36 +21,9 @@ exports = module.exports = {
    getAppIdByAddonConfigValue: getAppIdByAddonConfigValue,

    setHealth: setHealth,
-    setInstallationCommand: setInstallationCommand,
-    setRunCommand: setRunCommand,
+    setTask: setTask,
    getAppStoreIds: getAppStoreIds,

-    setOwner: setOwner,
-    transferOwnership: transferOwnership,
-
-    // installation codes (keep in sync in UI)
-    ISTATE_PENDING_INSTALL: 'pending_install', // installs and fresh reinstalls
-    ISTATE_PENDING_CLONE: 'pending_clone', // clone
-    ISTATE_PENDING_CONFIGURE: 'pending_configure', // config (location, port) changes and on infra update
-    ISTATE_PENDING_UNINSTALL: 'pending_uninstall', // uninstallation
-    ISTATE_PENDING_RESTORE: 'pending_restore', // restore to previous backup or on upgrade
-    ISTATE_PENDING_UPDATE: 'pending_update', // update from installed state preserving data
-    ISTATE_PENDING_FORCE_UPDATE: 'pending_force_update', // update from any state preserving data
-    ISTATE_PENDING_BACKUP: 'pending_backup', // backup the app
-    ISTATE_ERROR: 'error', // error executing last pending_* command
-    ISTATE_INSTALLED: 'installed', // app is installed
-
-    RSTATE_RUNNING: 'running',
-    RSTATE_PENDING_START: 'pending_start',
-    RSTATE_PENDING_STOP: 'pending_stop',
-    RSTATE_STOPPED: 'stopped', // app stopped by us
-
-    // run codes (keep in sync in UI)
-    HEALTH_HEALTHY: 'healthy',
-    HEALTH_UNHEALTHY: 'unhealthy',
-    HEALTH_ERROR: 'error',
-    HEALTH_DEAD: 'dead',
-
    // subdomain table types
    SUBDOMAIN_TYPE_PRIMARY: 'primary',
    SUBDOMAIN_TYPE_REDIRECT: 'redirect',
@@ -60,16 +33,17 @@ exports = module.exports = {

 var assert = require('assert'),
    async = require('async'),
+    BoxError = require('./boxerror.js'),
    database = require('./database.js'),
-    DatabaseError = require('./databaseerror'),
    safe = require('safetydance'),
    util = require('util');

-var APPS_FIELDS_PREFIXED = [ 'apps.id', 'apps.appStoreId', 'apps.installationState', 'apps.installationProgress', 'apps.runState',
+var APPS_FIELDS_PREFIXED = [ 'apps.id', 'apps.appStoreId', 'apps.installationState', 'apps.errorJson', 'apps.runState',
    'apps.health', 'apps.containerId', 'apps.manifestJson', 'apps.httpPort', 'subdomains.subdomain AS location', 'subdomains.domain',
-    'apps.accessRestrictionJson', 'apps.restoreConfigJson', 'apps.oldConfigJson', 'apps.updateConfigJson', 'apps.memoryLimit',
-    'apps.xFrameOptions', 'apps.sso', 'apps.debugModeJson', 'apps.robotsTxt', 'apps.enableBackup',
-    'apps.creationTime', 'apps.updateTime', 'apps.ownerId', 'apps.mailboxName', 'apps.enableAutomaticUpdate',
+    'apps.accessRestrictionJson', 'apps.memoryLimit',
+    'apps.label', 'apps.tagsJson', 'apps.taskId', 'apps.reverseProxyConfigJson',
+    'apps.sso', 'apps.debugModeJson', 'apps.enableBackup',
+    'apps.creationTime', 'apps.updateTime', 'apps.mailboxName', 'apps.enableAutomaticUpdate',
    'apps.dataDir', 'apps.ts', 'apps.healthTime' ].join(',');

 var PORT_BINDINGS_FIELDS = [ 'hostPort', 'type', 'environmentVariable', 'appId' ].join(',');
@@ -83,17 +57,13 @@ function postProcess(result) {
    result.manifest = safe.JSON.parse(result.manifestJson);
    delete result.manifestJson;

-    assert(result.oldConfigJson === null || typeof result.oldConfigJson === 'string');
-    result.oldConfig = safe.JSON.parse(result.oldConfigJson);
-    delete result.oldConfigJson;
+    assert(result.tagsJson === null || typeof result.tagsJson === 'string');
+    result.tags = safe.JSON.parse(result.tagsJson) || [];
+    delete result.tagsJson;

-    assert(result.updateConfigJson === null || typeof result.updateConfigJson === 'string');
-    result.updateConfig = safe.JSON.parse(result.updateConfigJson);
-    delete result.updateConfigJson;
-
-    assert(result.restoreConfigJson === null || typeof result.restoreConfigJson === 'string');
-    result.restoreConfig = safe.JSON.parse(result.restoreConfigJson);
-    delete result.restoreConfigJson;
+    assert(result.reverseProxyConfigJson === null || typeof result.reverseProxyConfigJson === 'string');
+    result.reverseProxyConfig = safe.JSON.parse(result.reverseProxyConfigJson) || {};
+    delete result.reverseProxyConfigJson;

    assert(result.hostPorts === null || typeof result.hostPorts === 'string');
    assert(result.environmentVariables === null || typeof result.environmentVariables === 'string');
@@ -116,9 +86,6 @@ function postProcess(result) {
    if (result.accessRestriction && !result.accessRestriction.users) result.accessRestriction.users = [];
    delete result.accessRestrictionJson;

-    // TODO remove later once all apps have this attribute
-    result.xFrameOptions = result.xFrameOptions || 'SAMEORIGIN';
-
    result.sso = !!result.sso; // make it bool
    result.enableBackup = !!result.enableBackup; // make it bool
    result.enableAutomaticUpdate = !!result.enableAutomaticUpdate; // make it bool
@@ -141,8 +108,10 @@ function postProcess(result) {
        if (envNames[i]) result.env[envNames[i]] = envValues[i];
    }

-    // in the db, we store dataDir as unique/nullable
-    result.dataDir = result.dataDir || '';
+    result.error = safe.JSON.parse(result.errorJson);
+    delete result.errorJson;
+
+    result.taskId = result.taskId ? String(result.taskId) : null;
 }

 function get(id, callback) {
@@ -157,11 +126,11 @@ function get(id, callback) {
        + '  LEFT OUTER JOIN appEnvVars ON apps.id = appEnvVars.appId'
        + '  LEFT OUTER JOIN subdomains ON apps.id = subdomains.appId AND subdomains.type = ?'
        + ' WHERE apps.id = ? GROUP BY apps.id', [ exports.SUBDOMAIN_TYPE_PRIMARY, id ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        database.query('SELECT ' + SUBDOMAIN_FIELDS + ' FROM subdomains WHERE appId = ? AND type = ?', [ id, exports.SUBDOMAIN_TYPE_REDIRECT ], function (error, alternateDomains) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            result[0].alternateDomains = alternateDomains;

@@ -184,11 +153,11 @@ function getByHttpPort(httpPort, callback) {
        + '  LEFT OUTER JOIN appEnvVars ON apps.id = appEnvVars.appId'
        + '  LEFT OUTER JOIN subdomains ON apps.id = subdomains.appId AND subdomains.type = ?'
        + ' WHERE httpPort = ? GROUP BY apps.id', [ exports.SUBDOMAIN_TYPE_PRIMARY, httpPort ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        database.query('SELECT ' + SUBDOMAIN_FIELDS + ' FROM subdomains WHERE appId = ? AND type = ?', [ result[0].id, exports.SUBDOMAIN_TYPE_REDIRECT ], function (error, alternateDomains) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            result[0].alternateDomains = alternateDomains;
            postProcess(result[0]);
@@ -210,11 +179,11 @@ function getByContainerId(containerId, callback) {
        + '  LEFT OUTER JOIN appEnvVars ON apps.id = appEnvVars.appId'
        + '  LEFT OUTER JOIN subdomains ON apps.id = subdomains.appId AND subdomains.type = ?'
        + ' WHERE containerId = ? GROUP BY apps.id', [ exports.SUBDOMAIN_TYPE_PRIMARY, containerId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        database.query('SELECT ' + SUBDOMAIN_FIELDS + ' FROM subdomains WHERE appId = ? AND type = ?', [ result[0].id, exports.SUBDOMAIN_TYPE_REDIRECT ], function (error, alternateDomains) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            result[0].alternateDomains = alternateDomains;
            postProcess(result[0]);
@@ -235,10 +204,10 @@ function getAll(callback) {
        + '  LEFT OUTER JOIN appEnvVars ON apps.id = appEnvVars.appId'
        + '  LEFT OUTER JOIN subdomains ON apps.id = subdomains.appId AND subdomains.type = ?'
        + ' GROUP BY apps.id ORDER BY apps.id', [ exports.SUBDOMAIN_TYPE_PRIMARY ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        database.query('SELECT ' + SUBDOMAIN_FIELDS + ' FROM subdomains WHERE type = ?', [ exports.SUBDOMAIN_TYPE_REDIRECT ], function (error, alternateDomains) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            alternateDomains.forEach(function (d) {
                var domain = results.find(function (a) { return d.appId === a.id; });
@@ -255,41 +224,42 @@ function getAll(callback) {
    });
 }

-function add(id, appStoreId, manifest, location, domain, ownerId, portBindings, data, callback) {
+function add(id, appStoreId, manifest, location, domain, portBindings, data, callback) {
    assert.strictEqual(typeof id, 'string');
    assert.strictEqual(typeof appStoreId, 'string');
    assert(manifest && typeof manifest === 'object');
    assert.strictEqual(typeof manifest.version, 'string');
    assert.strictEqual(typeof location, 'string');
    assert.strictEqual(typeof domain, 'string');
-    assert.strictEqual(typeof ownerId, 'string');
    assert.strictEqual(typeof portBindings, 'object');
    assert(data && typeof data === 'object');
-    assert(typeof data.mailboxName === 'string' && data.mailboxName); // non-empty string
    assert.strictEqual(typeof callback, 'function');

    portBindings = portBindings || { };

    var manifestJson = JSON.stringify(manifest);

-    var accessRestriction = data.accessRestriction || null;
-    var accessRestrictionJson = JSON.stringify(accessRestriction);
-    var memoryLimit = data.memoryLimit || 0;
-    var xFrameOptions = data.xFrameOptions || '';
-    var installationState = data.installationState || exports.ISTATE_PENDING_INSTALL;
-    var restoreConfigJson = data.restoreConfig ? JSON.stringify(data.restoreConfig) : null; // used when cloning
-    var sso = 'sso' in data ? data.sso : null;
-    var robotsTxt = 'robotsTxt' in data ? data.robotsTxt : null;
-    var debugModeJson = data.debugMode ? JSON.stringify(data.debugMode) : null;
-    var env = data.env || {};
-    const mailboxName = data.mailboxName;
+    const accessRestriction = data.accessRestriction || null;
+    const accessRestrictionJson = JSON.stringify(accessRestriction);
+    const memoryLimit = data.memoryLimit || 0;
+    const installationState = data.installationState;
+    const runState = data.runState;
+    const sso = 'sso' in data ? data.sso : null;
+    const debugModeJson = data.debugMode ? JSON.stringify(data.debugMode) : null;
+    const env = data.env || {};
+    const label = data.label || null;
+    const tagsJson = data.tags ? JSON.stringify(data.tags) : null;
+    const mailboxName = data.mailboxName || null;
+    const reverseProxyConfigJson = data.reverseProxyConfig ? JSON.stringify(data.reverseProxyConfig) : null;

    var queries = [];

    queries.push({
-        query: 'INSERT INTO apps (id, appStoreId, manifestJson, installationState, accessRestrictionJson, memoryLimit, xFrameOptions, restoreConfigJson, sso, debugModeJson, robotsTxt, ownerId, mailboxName) ' +
-            ' VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        args: [ id, appStoreId, manifestJson, installationState, accessRestrictionJson, memoryLimit, xFrameOptions, restoreConfigJson, sso, debugModeJson, robotsTxt, ownerId, mailboxName ]
+        query: 'INSERT INTO apps (id, appStoreId, manifestJson, installationState, runState, accessRestrictionJson, memoryLimit, '
+            + 'sso, debugModeJson, mailboxName, label, tagsJson, reverseProxyConfigJson) '
+            + ' VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [ id, appStoreId, manifestJson, installationState, runState, accessRestrictionJson, memoryLimit,
+            sso, debugModeJson, mailboxName, label, tagsJson, reverseProxyConfigJson ]
    });

    queries.push({
@@ -321,9 +291,9 @@ function add(id, appStoreId, manifest, location, domain, ownerId, portBindings,
    }

    database.transaction(queries, function (error) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS, error.message));
-        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND, 'no such domain'));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS, error.message));
+        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new BoxError(BoxError.NOT_FOUND, 'no such domain'));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -334,7 +304,7 @@ function exists(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT 1 FROM apps WHERE id=?', [ id ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        return callback(null, result.length !== 0);
    });
@@ -345,7 +315,7 @@ function getPortBindings(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + PORT_BINDINGS_FIELDS + ' FROM appPortBindings WHERE appId = ?', [ id ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        var portBindings = { };
        for (var i = 0; i < results.length; i++) {
@@ -362,8 +332,8 @@ function delPortBinding(hostPort, type, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM appPortBindings WHERE hostPort=? AND type=?', [ hostPort, type ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        callback(null);
    });
@@ -381,8 +351,8 @@ function del(id, callback) {
    ];

    database.transaction(queries, function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (results[3].affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (results[3].affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        callback(null);
    });
@@ -398,7 +368,7 @@ function clear(callback) {
        database.query.bind(null, 'DELETE FROM appEnvVars'),
        database.query.bind(null, 'DELETE FROM apps')
    ], function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
        return callback(null);
    });
 }
@@ -415,6 +385,7 @@ function updateWithConstraints(id, app, constraints, callback) {
    assert(!('portBindings' in app) || typeof app.portBindings === 'object');
    assert(!('accessRestriction' in app) || typeof app.accessRestriction === 'object' || app.accessRestriction === '');
    assert(!('alternateDomains' in app) || Array.isArray(app.alternateDomains));
+    assert(!('tags' in app) || Array.isArray(app.tags));
    assert(!('env' in app) || typeof app.env === 'object');

    var queries = [ ];
@@ -453,7 +424,7 @@ function updateWithConstraints(id, app, constraints, callback) {

    var fields = [ ], values = [ ];
    for (var p in app) {
-        if (p === 'manifest' || p === 'oldConfig' || p === 'updateConfig' || p === 'restoreConfig' || p === 'accessRestriction' || p === 'debugMode') {
+        if (p === 'manifest' || p === 'tags' || p === 'accessRestriction' || p === 'debugMode' || p === 'error' || p === 'reverseProxyConfig') {
            fields.push(`${p}Json = ?`);
            values.push(JSON.stringify(app[p]));
        } else if (p !== 'portBindings' && p !== 'location' && p !== 'domain' && p !== 'alternateDomains' && p !== 'env') {
@@ -468,15 +439,14 @@ function updateWithConstraints(id, app, constraints, callback) {
    }

    database.transaction(queries, function (error, results) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS, error.message));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (results[results.length - 1].affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS, error.message));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (results[results.length - 1].affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        return callback(null);
    });
 }

-// not sure if health should influence runState
 function setHealth(appId, health, healthTime, callback) {
    assert.strictEqual(typeof appId, 'string');
    assert.strictEqual(typeof health, 'string');
@@ -485,60 +455,29 @@ function setHealth(appId, health, healthTime, callback) {

    var values = { health, healthTime };

-    var constraints = 'AND runState NOT LIKE "pending_%" AND installationState = "installed"';
-
-    updateWithConstraints(appId, values, constraints, callback);
+    updateWithConstraints(appId, values, '', callback);
 }

-function setInstallationCommand(appId, installationState, values, callback) {
+function setTask(appId, values, options, callback) {
    assert.strictEqual(typeof appId, 'string');
-    assert.strictEqual(typeof installationState, 'string');
-
-    if (typeof values === 'function') {
-        callback = values;
-        values = { };
-    } else {
-        assert.strictEqual(typeof values, 'object');
-        assert.strictEqual(typeof callback, 'function');
-    }
-
-    values.installationState = installationState;
-    values.installationProgress = '';
-
-    // Rules are:
-    // uninstall is allowed in any state
-    // force update is allowed in any state including pending_uninstall! (for better or worse)
-    // restore is allowed from installed or error state or currently restoring
-    // configure is allowed in installed state or currently configuring or in error state
-    // update and backup are allowed only in installed state
-
-    if (installationState === exports.ISTATE_PENDING_UNINSTALL || installationState === exports.ISTATE_PENDING_FORCE_UPDATE) {
-        updateWithConstraints(appId, values, '', callback);
-    } else if (installationState === exports.ISTATE_PENDING_RESTORE) {
-        updateWithConstraints(appId, values, 'AND (installationState = "installed" OR installationState = "error" OR installationState = "pending_restore")', callback);
-    } else if (installationState === exports.ISTATE_PENDING_UPDATE || installationState === exports.ISTATE_PENDING_BACKUP) {
-        updateWithConstraints(appId, values, 'AND installationState = "installed"', callback);
-    } else if (installationState === exports.ISTATE_PENDING_CONFIGURE) {
-        updateWithConstraints(appId, values, 'AND (installationState = "installed" OR installationState = "pending_configure" OR installationState = "error")', callback);
-    } else {
-        callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, 'invalid installationState'));
-    }
-}
-
-function setRunCommand(appId, runState, callback) {
-    assert.strictEqual(typeof appId, 'string');
-    assert.strictEqual(typeof runState, 'string');
+    assert.strictEqual(typeof values, 'object');
+    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof callback, 'function');

-    var values = { runState: runState };
-    updateWithConstraints(appId, values, 'AND runState NOT LIKE "pending_%" AND installationState = "installed"', callback);
+    if (!options.requireNullTaskId)  return updateWithConstraints(appId, values, '', callback);
+
+    if (options.requiredState === null) {
+        updateWithConstraints(appId, values, 'AND taskId IS NULL', callback);
+    } else {
+        updateWithConstraints(appId, values, `AND taskId IS NULL AND installationState = "${options.requiredState}"`, callback);
+    }
 }

 function getAppStoreIds(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT id, appStoreId FROM apps', function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
@@ -563,7 +502,7 @@ function setAddonConfig(appId, addonId, env, callback) {
        }

        database.query(query + queryArgs.join(','), args, function (error) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            return callback(null);
        });
@@ -576,7 +515,7 @@ function unsetAddonConfig(appId, addonId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM appAddonConfigs WHERE appId = ? AND addonId = ?', [ appId, addonId ], function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -587,7 +526,7 @@ function unsetAddonConfigByAppId(appId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM appAddonConfigs WHERE appId = ?', [ appId ], function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -599,7 +538,7 @@ function getAddonConfig(appId, addonId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT name, value FROM appAddonConfigs WHERE appId = ? AND addonId = ?', [ appId, addonId ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
@@ -610,64 +549,36 @@ function getAddonConfigByAppId(appId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT name, value FROM appAddonConfigs WHERE appId = ?', [ appId ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
 }

-function getAppIdByAddonConfigValue(addonId, name, value, callback) {
+function getAppIdByAddonConfigValue(addonId, namePattern, value, callback) {
    assert.strictEqual(typeof addonId, 'string');
-    assert.strictEqual(typeof name, 'string');
+    assert.strictEqual(typeof namePattern, 'string');
    assert.strictEqual(typeof value, 'string');
    assert.strictEqual(typeof callback, 'function');

-    database.query('SELECT appId FROM appAddonConfigs WHERE addonId = ? AND name = ? AND value = ?', [ addonId, name, value ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (results.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+    database.query('SELECT appId FROM appAddonConfigs WHERE addonId = ? AND name LIKE ? AND value = ?', [ addonId, namePattern, value ], function (error, results) {
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (results.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        callback(null, results[0].appId);
    });
 }

-function getAddonConfigByName(appId, addonId, name, callback) {
+function getAddonConfigByName(appId, addonId, namePattern, callback) {
    assert.strictEqual(typeof appId, 'string');
    assert.strictEqual(typeof addonId, 'string');
-    assert.strictEqual(typeof name, 'string');
+    assert.strictEqual(typeof namePattern, 'string');
    assert.strictEqual(typeof callback, 'function');

-    database.query('SELECT value FROM appAddonConfigs WHERE appId = ? AND addonId = ? AND name = ?', [ appId, addonId, name ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (results.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+    database.query('SELECT value FROM appAddonConfigs WHERE appId = ? AND addonId = ? AND name LIKE ?', [ appId, addonId, namePattern ], function (error, results) {
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (results.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'App not found'));

        callback(null, results[0].value);
    });
 }
-
-function setOwner(appId, ownerId, callback) {
-    assert.strictEqual(typeof appId, 'string');
-    assert.strictEqual(typeof ownerId, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    database.query('UPDATE apps SET ownerId=? WHERE appId=?', [ ownerId, appId ], function (error, results) {
-        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND, 'No such user'));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-
-        if (results.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND, 'No such app'));
-
-        callback(null);
-    });
-}
-
-function transferOwnership(oldOwnerId, newOwnerId, callback) {
-    assert.strictEqual(typeof oldOwnerId, 'string');
-    assert.strictEqual(typeof newOwnerId, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    database.query('UPDATE apps SET ownerId=? WHERE ownerId=?', [ newOwnerId, oldOwnerId ], function (error) {
-        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND, 'No such user'));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-
-        callback(null);
-    });
-}
@@ -4,7 +4,8 @@ var appdb = require('./appdb.js'),
    apps = require('./apps.js'),
    assert = require('assert'),
    async = require('async'),
-    DatabaseError = require('./databaseerror.js'),
+    auditSource = require('./auditsource.js'),
+    BoxError = require('./boxerror.js'),
    debug = require('debug')('box:apphealthmonitor'),
    docker = require('./docker.js'),
    eventlog = require('./eventlog.js'),
@@ -22,8 +23,6 @@ const UNHEALTHY_THRESHOLD = 10 * 60 * 1000; // 10 minutes
 const OOM_EVENT_LIMIT = 60 * 60 * 1000; // 60 minutes
 let gLastOomMailTime = Date.now() - (5 * 60 * 1000); // pretend we sent email 5 minutes ago

-const AUDIT_SOURCE = { userId: null, username: 'healthmonitor' };
-
 function debugApp(app) {
    assert(typeof app === 'object');

@@ -37,20 +36,20 @@ function setHealth(app, health, callback) {

    let now = new Date(), healthTime = app.healthTime, curHealth = app.health;

-    if (health === appdb.HEALTH_HEALTHY) {
+    if (health === apps.HEALTH_HEALTHY) {
        healthTime = now;
-        if (curHealth && curHealth !== appdb.HEALTH_HEALTHY) { // app starts out with null health
+        if (curHealth && curHealth !== apps.HEALTH_HEALTHY) { // app starts out with null health
            debugApp(app, 'app switched from %s to healthy', curHealth);

            // do not send mails for dev apps
-            if (!app.debugMode) eventlog.add(eventlog.ACTION_APP_UP, AUDIT_SOURCE, { app: app });
+            if (!app.debugMode) eventlog.add(eventlog.ACTION_APP_UP, auditSource.HEALTH_MONITOR, { app: app });
        }
    } else if (Math.abs(now - healthTime) > UNHEALTHY_THRESHOLD) {
-        if (curHealth === appdb.HEALTH_HEALTHY) {
+        if (curHealth === apps.HEALTH_HEALTHY) {
            debugApp(app, 'marking as unhealthy since not seen for more than %s minutes', UNHEALTHY_THRESHOLD/(60 * 1000));

            // do not send mails for dev apps
-            if (!app.debugMode) eventlog.add(eventlog.ACTION_APP_DOWN, AUDIT_SOURCE, { app: app });
+            if (!app.debugMode) eventlog.add(eventlog.ACTION_APP_DOWN, auditSource.HEALTH_MONITOR, { app: app });
        }
    } else {
        debugApp(app, 'waiting for %s seconds to update the app health', (UNHEALTHY_THRESHOLD - Math.abs(now - healthTime))/1000);
@@ -58,7 +57,7 @@ function setHealth(app, health, callback) {
    }

    appdb.setHealth(app.id, health, healthTime, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null); // app uninstalled?
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(null); // app uninstalled?
        if (error) return callback(error);

        app.health = health;
@@ -73,7 +72,7 @@ function checkAppHealth(app, callback) {
    assert.strictEqual(typeof app, 'object');
    assert.strictEqual(typeof callback, 'function');

-    if (app.installationState !== appdb.ISTATE_INSTALLED || app.runState !== appdb.RSTATE_RUNNING) {
+    if (app.installationState !== apps.ISTATE_INSTALLED || app.runState !== apps.RSTATE_RUNNING) {
        debugApp(app, 'skipped. istate:%s rstate:%s', app.installationState, app.runState);
        return callback(null);
    }
@@ -83,34 +82,34 @@ function checkAppHealth(app, callback) {
    docker.inspect(app.containerId, function (error, data) {
        if (error || !data || !data.State) {
            debugApp(app, 'Error inspecting container');
-            return setHealth(app, appdb.HEALTH_ERROR, callback);
+            return setHealth(app, apps.HEALTH_ERROR, callback);
        }

        if (data.State.Running !== true) {
            debugApp(app, 'exited');
-            return setHealth(app, appdb.HEALTH_DEAD, callback);
+            return setHealth(app, apps.HEALTH_DEAD, callback);
        }

        // non-appstore apps may not have healthCheckPath
-        if (!manifest.healthCheckPath) return setHealth(app, appdb.HEALTH_HEALTHY, callback);
+        if (!manifest.healthCheckPath) return setHealth(app, apps.HEALTH_HEALTHY, callback);

        // poll through docker network instead of nginx to bypass any potential oauth proxy
        var healthCheckUrl = 'http://127.0.0.1:' + app.httpPort + manifest.healthCheckPath;
        superagent
            .get(healthCheckUrl)
            .set('Host', app.fqdn) // required for some apache configs with rewrite rules
-            .set('User-Agent', 'Mozilla') // required for some apps (e.g. minio)
+            .set('User-Agent', 'Mozilla (CloudronHealth)') // required for some apps (e.g. minio)
            .redirects(0)
            .timeout(HEALTHCHECK_INTERVAL)
            .end(function (error, res) {
                if (error && !error.response) {
                    debugApp(app, 'not alive (network error): %s', error.message);
-                    setHealth(app, appdb.HEALTH_UNHEALTHY, callback);
+                    setHealth(app, apps.HEALTH_UNHEALTHY, callback);
                } else if (res.statusCode >= 400) { // 2xx and 3xx are ok
                    debugApp(app, 'not alive : %s', error || res.status);
-                    setHealth(app, appdb.HEALTH_UNHEALTHY, callback);
+                    setHealth(app, apps.HEALTH_UNHEALTHY, callback);
                } else {
-                    setHealth(app, appdb.HEALTH_HEALTHY, callback);
+                    setHealth(app, apps.HEALTH_HEALTHY, callback);
                }
            });
    });
@@ -159,7 +158,7 @@ function processDockerEvents(intervalSecs, callback) {
                // do not send mails for dev apps
                if (notifyUser) {
                    // app can be null for addon containers
-                    eventlog.add(eventlog.ACTION_APP_OOM, AUDIT_SOURCE, { event: event, containerId: containerId, addon: addon || null, app: app || null });
+                    eventlog.add(eventlog.ACTION_APP_OOM, auditSource.HEALTH_MONITOR, { event: event, containerId: containerId, addon: addon || null, app: app || null });

                    gLastOomMailTime = now;
                }
@@ -188,7 +187,7 @@ function processApp(callback) {
            if (error) console.error(error);

            var alive = result
-                .filter(function (a) { return a.installationState === appdb.ISTATE_INSTALLED && a.runState === appdb.RSTATE_RUNNING && a.health === appdb.HEALTH_HEALTHY; })
+                .filter(function (a) { return a.installationState === apps.ISTATE_INSTALLED && a.runState === apps.RSTATE_RUNNING && a.health === apps.HEALTH_HEALTHY; })
                .map(function (a) { return (a.location || 'naked_domain') + '|' + a.manifest.id; }).join(', ');

            debug('apps alive: [%s]', alive);
@@ -1,8 +1,15 @@
 'use strict';

 exports = module.exports = {
-    purchase: purchase,
-    unpurchase: unpurchase,
+    getApps: getApps,
+    getApp: getApp,
+    getAppVersion: getAppVersion,
+
+    registerWithLoginCredentials: registerWithLoginCredentials,
+    registerWithLicense: registerWithLicense,
+
+    purchaseApp: purchaseApp,
+    unpurchaseApp: unpurchaseApp,

    getSubscription: getSubscription,
    isFreePlan: isFreePlan,
@@ -12,83 +19,98 @@ exports = module.exports = {
    getAppUpdate: getAppUpdate,
    getBoxUpdate: getBoxUpdate,

-    getAccount: getAccount,
-
-    registerCloudron: registerCloudron,
-    getCloudron: getCloudron,
-
-    sendFeedback: sendFeedback,
-
-    AppstoreError: AppstoreError
+    createTicket: createTicket
 };

 var apps = require('./apps.js'),
    assert = require('assert'),
    async = require('async'),
-    config = require('./config.js'),
+    BoxError = require('./boxerror.js'),
+    constants = require('./constants.js'),
+    custom = require('./custom.js'),
    debug = require('debug')('box:appstore'),
    domains = require('./domains.js'),
    eventlog = require('./eventlog.js'),
+    groups = require('./groups.js'),
    mail = require('./mail.js'),
    os = require('os'),
    safe = require('safetydance'),
    semver = require('semver'),
    settings = require('./settings.js'),
    superagent = require('superagent'),
+    users = require('./users.js'),
    util = require('util');

-function AppstoreError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
+const NOOP_CALLBACK = function (error) { if (error) debug(error); };

-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(AppstoreError, Error);
-AppstoreError.INTERNAL_ERROR = 'Internal Error';
-AppstoreError.EXTERNAL_ERROR = 'External Error';
-AppstoreError.NOT_FOUND = 'Internal Error';
-AppstoreError.BILLING_REQUIRED = 'Billing Required';
-
-var NOOP_CALLBACK = function (error) { if (error) debug(error); };
-
-function getAppstoreConfig(callback) {
+function getCloudronToken(callback) {
    assert.strictEqual(typeof callback, 'function');

-    settings.getAppstoreConfig(function (error, result) {
-        if (error) return callback(new AppstoreError(AppstoreError.INTERNAL_ERROR, error));
-        if (!result.token) return callback(new AppstoreError(AppstoreError.BILLING_REQUIRED));
+    settings.getCloudronToken(function (error, token) {
+        if (error) return callback(error);
+        if (!token) return callback(new BoxError(BoxError.LICENSE_ERROR, 'Missing token'));

-        callback(null, result);
+        callback(null, token);
+    });
+}
+
+function login(email, password, totpToken, callback) {
+    assert.strictEqual(typeof email, 'string');
+    assert.strictEqual(typeof password, 'string');
+    assert.strictEqual(typeof totpToken, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    var data = {
+        email: email,
+        password: password,
+        totpToken: totpToken
+    };
+
+    const url = settings.apiServerOrigin() + '/api/v1/login';
+    superagent.post(url).send(data).timeout(30 * 1000).end(function (error, result) {
+        if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+        if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+        if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `login status code: ${result.statusCode}`));
+
+        callback(null, result.body); // { userId, accessToken }
+    });
+}
+
+function registerUser(email, password, callback) {
+    assert.strictEqual(typeof email, 'string');
+    assert.strictEqual(typeof password, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    var data = {
+        email: email,
+        password: password,
+    };
+
+    const url = settings.apiServerOrigin() + '/api/v1/register_user';
+    superagent.post(url).send(data).timeout(30 * 1000).end(function (error, result) {
+        if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+        if (result.statusCode === 409) return callback(new BoxError(BoxError.ALREADY_EXISTS));
+        if (result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `register status code: ${result.statusCode}`));
+
+        callback(null);
    });
 }

 function getSubscription(callback) {
    assert.strictEqual(typeof callback, 'function');

-    getAppstoreConfig(function (error, appstoreConfig) {
+    getCloudronToken(function (error, token) {
        if (error) return callback(error);

-        const url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId + '/cloudrons/' + appstoreConfig.cloudronId + '/subscription';
-        superagent.get(url).query({ accessToken: appstoreConfig.token }).timeout(30 * 1000).end(function (error, result) {
-            if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error.message));
-            if (result.statusCode === 401) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'invalid appstore token'));
-            if (result.statusCode === 403) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'wrong user'));
-            if (result.statusCode === 502) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'stripe error'));
-            if (result.statusCode !== 200) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'unknown error'));
+        const url = settings.apiServerOrigin() + '/api/v1/subscription';
+        superagent.get(url).query({ accessToken: token }).timeout(30 * 1000).end(function (error, result) {
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+            if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR));
+            if (result.statusCode === 502) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `Stripe error: ${error.message}`));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `Unknown error: ${error.message}`));

-            callback(null, result.body.subscription);
+            callback(null, result.body); // { email, subscription }
        });
    });
 }
@@ -98,50 +120,53 @@ function isFreePlan(subscription) {
 }

 // See app.js install it will create a db record first but remove it again if appstore purchase fails
-function purchase(appId, data, callback) {
-    assert.strictEqual(typeof appId, 'string');
-    assert.strictEqual(typeof data, 'object');
+function purchaseApp(data, callback) {
+    assert.strictEqual(typeof data, 'object'); // { appstoreId, manifestId, appId }
    assert(data.appstoreId || data.manifestId);
+    assert.strictEqual(typeof data.appId, 'string');
    assert.strictEqual(typeof callback, 'function');

-    getAppstoreConfig(function (error, appstoreConfig) {
+    getCloudronToken(function (error, token) {
        if (error) return callback(error);

-        var url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId + '/cloudrons/' + appstoreConfig.cloudronId + '/apps/' + appId;
+        const url = `${settings.apiServerOrigin()}/api/v1/cloudronapps`;

-        superagent.post(url).send(data).query({ accessToken: appstoreConfig.token }).timeout(30 * 1000).end(function (error, result) {
-            if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error.message));
-            if (result.statusCode === 404) return callback(new AppstoreError(AppstoreError.NOT_FOUND));
-            if (result.statusCode === 403 || result.statusCode === 401) return callback(new AppstoreError(AppstoreError.BILLING_REQUIRED));
-            if (result.statusCode === 402) return callback(new AppstoreError(AppstoreError.BILLING_REQUIRED, result.body.message));
-            if (result.statusCode !== 201 && result.statusCode !== 200) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('App purchase failed. %s %j', result.status, result.body)));
+        superagent.post(url).send(data).query({ accessToken: token }).timeout(30 * 1000).end(function (error, result) {
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND)); // appstoreId does not exist
+            if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+            if (result.statusCode === 402) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
+            if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
+            // 200 if already purchased, 201 is newly purchased
+            if (result.statusCode !== 201 && result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('App purchase failed. %s %j', result.status, result.body)));

            callback(null);
        });
    });
 }

-function unpurchase(appId, data, callback) {
+function unpurchaseApp(appId, data, callback) {
    assert.strictEqual(typeof appId, 'string');
-    assert.strictEqual(typeof data, 'object');
+    assert.strictEqual(typeof data, 'object'); // { appstoreId, manifestId }
    assert(data.appstoreId || data.manifestId);
    assert.strictEqual(typeof callback, 'function');

-    getAppstoreConfig(function (error, appstoreConfig) {
+    getCloudronToken(function (error, token) {
        if (error) return callback(error);

-        var url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId + '/cloudrons/' + appstoreConfig.cloudronId + '/apps/' + appId;
+        const url = `${settings.apiServerOrigin()}/api/v1/cloudronapps/${appId}`;

-        superagent.get(url).query({ accessToken: appstoreConfig.token }).timeout(30 * 1000).end(function (error, result) {
-            if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error));
-            if (result.statusCode === 403 || result.statusCode === 401) return callback(new AppstoreError(AppstoreError.BILLING_REQUIRED));
+        superagent.get(url).query({ accessToken: token }).timeout(30 * 1000).end(function (error, result) {
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
            if (result.statusCode === 404) return callback(null);   // was never purchased
-            if (result.statusCode !== 201 && result.statusCode !== 200) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('App unpurchase failed. %s %j', result.status, result.body)));
+            if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+            if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
+            if (result.statusCode !== 201 && result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('App unpurchase failed. %s %j', result.status, result.body)));

-            superagent.del(url).send(data).query({ accessToken: appstoreConfig.token }).timeout(30 * 1000).end(function (error, result) {
-                if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error));
-                if (result.statusCode === 403 || result.statusCode === 401) return callback(new AppstoreError(AppstoreError.BILLING_REQUIRED));
-                if (result.statusCode !== 204) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('App unpurchase failed. %s %j', result.status, result.body)));
+            superagent.del(url).send(data).query({ accessToken: token }).timeout(30 * 1000).end(function (error, result) {
+                if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error));
+                if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+                if (result.statusCode !== 204) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('App unpurchase failed. %s %j', result.status, result.body)));

                callback(null);
            });
@@ -152,36 +177,50 @@ function unpurchase(appId, data, callback) {
 function sendAliveStatus(callback) {
    callback = callback || NOOP_CALLBACK;

-    var allSettings, allDomains, mailDomains, loginEvents;
+    let allSettings, allDomains, mailDomains, loginEvents, userCount, groupCount;

    async.series([
        function (callback) {
            settings.getAll(function (error, result) {
-                if (error) return callback(new AppstoreError(AppstoreError.INTERNAL_ERROR, error));
+                if (error) return callback(error);
                allSettings = result;
                callback();
            });
        },
        function (callback) {
            domains.getAll(function (error, result) {
-                if (error) return callback(new AppstoreError(AppstoreError.INTERNAL_ERROR, error));
+                if (error) return callback(error);
                allDomains = result;
                callback();
            });
        },
        function (callback) {
            mail.getDomains(function (error, result) {
-                if (error) return callback(new AppstoreError(AppstoreError.INTERNAL_ERROR, error));
+                if (error) return callback(error);
                mailDomains = result;
                callback();
            });
        },
        function (callback) {
            eventlog.getAllPaged([ eventlog.ACTION_USER_LOGIN ], null, 1, 1, function (error, result) {
-                if (error) return callback(new AppstoreError(AppstoreError.INTERNAL_ERROR, error));
+                if (error) return callback(error);
                loginEvents = result;
                callback();
            });
+        },
+        function (callback) {
+            users.count(function (error, result) {
+                if (error) return callback(error);
+                userCount = result;
+                callback();
+            });
+        },
+        function (callback) {
+            groups.count(function (error, result) {
+                if (error) return callback(error);
+                groupCount = result;
+                callback();
+            });
        }
    ], function (error) {
        if (error) return callback(error);
@@ -201,15 +240,18 @@ function sendAliveStatus(callback) {
                catchAllCount: mailDomains.filter(function (d) { return d.catchAll.length !== 0; }).length,
                relayProviders: Array.from(new Set(mailDomains.map(function (d) { return d.relay.provider; })))
            },
+            userCount: userCount,
+            groupCount: groupCount,
            appAutoupdatePattern: allSettings[settings.APP_AUTOUPDATE_PATTERN_KEY],
            boxAutoupdatePattern: allSettings[settings.BOX_AUTOUPDATE_PATTERN_KEY],
            timeZone: allSettings[settings.TIME_ZONE_KEY],
+            sysinfoProvider: allSettings[settings.SYSINFO_CONFIG_KEY].provider
        };

        var data = {
-            version: config.version(),
-            adminFqdn: config.adminFqdn(),
-            provider: config.provider(),
+            version: constants.VERSION,
+            adminFqdn: settings.adminFqdn(),
+            provider: settings.provider(),
            backendSettings: backendSettings,
            machine: {
                cpus: os.cpus(),
@@ -220,14 +262,16 @@ function sendAliveStatus(callback) {
            }
        };

-        getAppstoreConfig(function (error, appstoreConfig) {
+        getCloudronToken(function (error, token) {
            if (error) return callback(error);

-            var url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId + '/cloudrons/' + appstoreConfig.cloudronId + '/alive';
-            superagent.post(url).send(data).query({ accessToken: appstoreConfig.token }).timeout(30 * 1000).end(function (error, result) {
-                if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error));
-                if (result.statusCode === 404) return callback(new AppstoreError(AppstoreError.NOT_FOUND));
-                if (result.statusCode !== 201) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Sending alive status failed. %s %j', result.status, result.body)));
+            const url = `${settings.apiServerOrigin()}/api/v1/alive`;
+            superagent.post(url).send(data).query({ accessToken: token }).timeout(30 * 1000).end(function (error, result) {
+                if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error));
+                if (result.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND));
+                if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+                if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
+                if (result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Sending alive status failed. %s %j', result.status, result.body)));

                callback(null);
            });
@@ -238,29 +282,31 @@ function sendAliveStatus(callback) {
 function getBoxUpdate(callback) {
    assert.strictEqual(typeof callback, 'function');

-    getAppstoreConfig(function (error, appstoreConfig) {
+    getCloudronToken(function (error, token) {
        if (error) return callback(error);

-        var url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId + '/cloudrons/' + appstoreConfig.cloudronId + '/boxupdate';
+        const url = `${settings.apiServerOrigin()}/api/v1/boxupdate`;

-        superagent.get(url).query({ accessToken: appstoreConfig.token, boxVersion: config.version() }).timeout(10 * 1000).end(function (error, result) {
-            if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error.message));
+        superagent.get(url).query({ accessToken: token, boxVersion: constants.VERSION }).timeout(10 * 1000).end(function (error, result) {
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+            if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
            if (result.statusCode === 204) return callback(null); // no update
-            if (result.statusCode !== 200 || !result.body) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));
+            if (result.statusCode !== 200 || !result.body) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));

            var updateInfo = result.body;

-            if (!semver.valid(updateInfo.version) || semver.gt(config.version(), updateInfo.version)) {
-                return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Invalid update version: %s %s', result.statusCode, result.text)));
+            if (!semver.valid(updateInfo.version) || semver.gt(constants.VERSION, updateInfo.version)) {
+                return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Invalid update version: %s %s', result.statusCode, result.text)));
            }

            // updateInfo: { version, changelog, sourceTarballUrl, sourceTarballSigUrl, boxVersionsUrl, boxVersionsSigUrl }
-            if (!updateInfo.version || typeof updateInfo.version !== 'string') return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response (bad version): %s %s', result.statusCode, result.text)));
-            if (!updateInfo.changelog || !Array.isArray(updateInfo.changelog)) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response (bad version): %s %s', result.statusCode, result.text)));
-            if (!updateInfo.sourceTarballUrl || typeof updateInfo.sourceTarballUrl !== 'string') return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response (bad sourceTarballUrl): %s %s', result.statusCode, result.text)));
-            if (!updateInfo.sourceTarballSigUrl || typeof updateInfo.sourceTarballSigUrl !== 'string') return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response (bad sourceTarballSigUrl): %s %s', result.statusCode, result.text)));
-            if (!updateInfo.boxVersionsUrl || typeof updateInfo.boxVersionsUrl !== 'string') return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response (bad boxVersionsUrl): %s %s', result.statusCode, result.text)));
-            if (!updateInfo.boxVersionsSigUrl || typeof updateInfo.boxVersionsSigUrl !== 'string') return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response (bad boxVersionsSigUrl): %s %s', result.statusCode, result.text)));
+            if (!updateInfo.version || typeof updateInfo.version !== 'string') return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response (bad version): %s %s', result.statusCode, result.text)));
+            if (!updateInfo.changelog || !Array.isArray(updateInfo.changelog)) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response (bad version): %s %s', result.statusCode, result.text)));
+            if (!updateInfo.sourceTarballUrl || typeof updateInfo.sourceTarballUrl !== 'string') return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response (bad sourceTarballUrl): %s %s', result.statusCode, result.text)));
+            if (!updateInfo.sourceTarballSigUrl || typeof updateInfo.sourceTarballSigUrl !== 'string') return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response (bad sourceTarballSigUrl): %s %s', result.statusCode, result.text)));
+            if (!updateInfo.boxVersionsUrl || typeof updateInfo.boxVersionsUrl !== 'string') return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response (bad boxVersionsUrl): %s %s', result.statusCode, result.text)));
+            if (!updateInfo.boxVersionsSigUrl || typeof updateInfo.boxVersionsSigUrl !== 'string') return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response (bad boxVersionsSigUrl): %s %s', result.statusCode, result.text)));

            callback(null, updateInfo);
        });
@@ -271,15 +317,17 @@ function getAppUpdate(app, callback) {
    assert.strictEqual(typeof app, 'object');
    assert.strictEqual(typeof callback, 'function');

-    getAppstoreConfig(function (error, appstoreConfig) {
+    getCloudronToken(function (error, token) {
        if (error) return callback(error);

-        var url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId + '/cloudrons/' + appstoreConfig.cloudronId + '/appupdate';
+        const url = `${settings.apiServerOrigin()}/api/v1/appupdate`;

-        superagent.get(url).query({ accessToken: appstoreConfig.token, boxVersion: config.version(), appId: app.appStoreId, appVersion: app.manifest.version }).timeout(10 * 1000).end(function (error, result) {
-            if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error));
+        superagent.get(url).query({ accessToken: token, boxVersion: constants.VERSION, appId: app.appStoreId, appVersion: app.manifest.version }).timeout(10 * 1000).end(function (error, result) {
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error));
+            if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+            if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
            if (result.statusCode === 204) return callback(null); // no update
-            if (result.statusCode !== 200 || !result.body) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));
+            if (result.statusCode !== 200 || !result.body) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));

            const updateInfo = result.body;

@@ -289,7 +337,7 @@ function getAppUpdate(app, callback) {
            // do some sanity checks
            if (!safe.query(updateInfo, 'manifest.version') || semver.gt(curAppVersion, safe.query(updateInfo, 'manifest.version'))) {
                debug('Skipping malformed update of app %s version: %s. got %j', app.id, curAppVersion, updateInfo);
-                return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Malformed update: %s %s', result.statusCode, result.text)));
+                return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Malformed update: %s %s', result.statusCode, result.text)));
            }

            // { id, creationDate, manifest }
@@ -298,66 +346,73 @@ function getAppUpdate(app, callback) {
    });
 }

-function getAccount(callback) {
+function registerCloudron(data, callback) {
+    assert.strictEqual(typeof data, 'object');
    assert.strictEqual(typeof callback, 'function');

-    getAppstoreConfig(function (error, appstoreConfig) {
-        if (error) return callback(error);
+    const url = `${settings.apiServerOrigin()}/api/v1/register_cloudron`;

-        var url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId;
+    superagent.post(url).send(data).timeout(30 * 1000).end(function (error, result) {
+        if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+        if (result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `Unable to register cloudron: ${error.message}`));

-        superagent.get(url).query({ accessToken: appstoreConfig.token }).timeout(10 * 1000).end(function (error, result) {
-            if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error));
-            if (result.statusCode !== 200) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));
+        // cloudronId, token, licenseKey
+        if (!result.body.cloudronId) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response - no cloudron id'));
+        if (!result.body.cloudronToken) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response - no token'));
+        if (!result.body.licenseKey) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response - no license'));

-            // { profile: { id, email, groupId, billing, firstName, lastName, company, street, city, zip, state, country } }
-            callback(null, result.body.profile);
+        async.series([
+            settings.setCloudronId.bind(null, result.body.cloudronId),
+            settings.setCloudronToken.bind(null, result.body.cloudronToken),
+            settings.setLicenseKey.bind(null, result.body.licenseKey),
+        ], function (error) {
+            if (error) return callback(error);
+
+            debug(`registerCloudron: Cloudron registered with id ${result.body.cloudronId}`);
+
+            callback();
        });
    });
 }

-function registerCloudron(adminDomain, userId, token, callback) {
-    assert.strictEqual(typeof adminDomain, 'string');
-    assert.strictEqual(typeof userId, 'string');
-    assert.strictEqual(typeof token, 'string');
+function registerWithLicense(license, domain, callback) {
+    assert.strictEqual(typeof license, 'string');
+    assert.strictEqual(typeof domain, 'string');
    assert.strictEqual(typeof callback, 'function');

-    const url = `${config.apiServerOrigin()}/api/v1/users/${userId}/cloudrons`;
+    getCloudronToken(function (error, token) {
+        if (token) return callback(new BoxError(BoxError.CONFLICT));

-    superagent.post(url).send({ domain: adminDomain }).query({ accessToken: token }).timeout(30 * 1000).end(function (error, result) {
-        if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error.message));
-        if (result.statusCode === 401) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'invalid appstore token'));
-        if (result.statusCode !== 201) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'unable to register cloudron'));
-
-        const cloudronId = safe.query(result.body, 'cloudron.id');
-        if (!cloudronId) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'Invalid response - no cloudron id'));
-
-        debug(`setAppstoreConfig: Cloudron registered with id ${cloudronId}`);
-
-        callback(null, cloudronId);
+        registerCloudron({ license, domain }, callback);
    });
 }

-function getCloudron(appstoreConfig, callback) {
-    assert.strictEqual(typeof appstoreConfig, 'object');
+function registerWithLoginCredentials(options, callback) {
+    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof callback, 'function');

-    const { userId, cloudronId, token } = appstoreConfig;
+    function maybeSignup(done) {
+        if (!options.signup) return done();

-    const url = config.apiServerOrigin() + '/api/v1/users/' + userId + '/cloudrons/' + cloudronId;
+        registerUser(options.email, options.password, done);
+    }

-    superagent.get(url).query({ accessToken: token }).timeout(30 * 1000).end(function (error, result) {
-        if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error.message));
-        if (result.statusCode === 401) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'invalid appstore token'));
-        if (result.statusCode === 403) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'wrong user'));
-        if (result.statusCode === 404) return callback(new AppstoreError(AppstoreError.NOT_FOUND, error.message));
-        if (result.statusCode !== 200) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, 'unknown error'));
+    getCloudronToken(function (error, token) {
+        if (token) return callback(new BoxError(BoxError.CONFLICT));

-        callback();
+        maybeSignup(function (error) {
+            if (error) return callback(error);
+
+            login(options.email, options.password, options.totpToken || '', function (error, result) {
+                if (error) return callback(error);
+
+                registerCloudron({ domain: settings.adminDomain(), accessToken: result.accessToken }, callback);
+            });
+        });
    });
 }

-function sendFeedback(info, callback) {
+function createTicket(info, callback) {
    assert.strictEqual(typeof info, 'object');
    assert.strictEqual(typeof info.email, 'string');
    assert.strictEqual(typeof info.displayName, 'string');
@@ -371,21 +426,78 @@ function sendFeedback(info, callback) {
        apps.get(info.appId, callback);
    }

-    getAppstoreConfig(function (error, appstoreConfig) {
+    getCloudronToken(function (error, token) {
        if (error) return callback(error);

        collectAppInfoIfNeeded(function (error, result) {
            if (error) console.error('Unable to get app info', error);
            if (result) info.app = result;

-            var url = config.apiServerOrigin() + '/api/v1/users/' + appstoreConfig.userId + '/cloudrons/' + appstoreConfig.cloudronId + '/feedback';
+            let url = settings.apiServerOrigin() + '/api/v1/ticket';

-            superagent.post(url).query({ accessToken: appstoreConfig.token }).send(info).timeout(10 * 1000).end(function (error, result) {
-                if (error && !error.response) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, error));
-                if (result.statusCode !== 201) return callback(new AppstoreError(AppstoreError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));
+            info.supportEmail = custom.spec().support.email; // destination address for tickets
+
+            superagent.post(url).query({ accessToken: token }).send(info).timeout(10 * 1000).end(function (error, result) {
+                if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+                if (result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+                if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
+                if (result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));

                callback(null);
            });
        });
    });
 }
+
+function getApps(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    getCloudronToken(function (error, token) {
+        if (error) return callback(error);
+
+        settings.getUnstableAppsConfig(function (error, unstable) {
+            if (error) return callback(error);
+
+            const url = `${settings.apiServerOrigin()}/api/v1/apps`;
+            superagent.get(url).query({ accessToken: token, boxVersion: constants.VERSION, unstable: unstable }).timeout(10 * 1000).end(function (error, result) {
+                if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+                if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+                if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
+                if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('App listing failed. %s %j', result.status, result.body)));
+                if (!result.body.apps) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Bad response: %s %s', result.statusCode, result.text)));
+
+                callback(null, result.body.apps);
+            });
+        });
+    });
+}
+
+function getAppVersion(appId, version, callback) {
+    assert.strictEqual(typeof appId, 'string');
+    assert.strictEqual(typeof version, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    getCloudronToken(function (error, token) {
+        if (error) return callback(error);
+
+        let url = `${settings.apiServerOrigin()}/api/v1/apps/${appId}`;
+        if (version !== 'latest') url += `/versions/${version}`;
+
+        superagent.get(url).query({ accessToken: token }).timeout(10 * 1000).end(function (error, result) {
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+            if (result.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND));
+            if (result.statusCode === 422) return callback(new BoxError(BoxError.LICENSE_ERROR, result.body.message));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('App fetch failed. %s %j', result.status, result.body)));
+
+            callback(null, result.body);
+        });
+    });
+}
+
+function getApp(appId, callback) {
+    assert.strictEqual(typeof appId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    getAppVersion(appId, 'latest', callback);
+}
@@ -0,0 +1,86 @@
+'use strict';
+
+exports = module.exports = {
+    scheduleTask: scheduleTask
+};
+
+let assert = require('assert'),
+    debug = require('debug')('box:apptaskmanager'),
+    fs = require('fs'),
+    locker = require('./locker.js'),
+    safe = require('safetydance'),
+    path = require('path'),
+    paths = require('./paths.js'),
+    tasks = require('./tasks.js');
+
+let gActiveTasks = { }; // indexed by app id
+let gPendingTasks = [ ];
+let gInitialized = false;
+
+const TASK_CONCURRENCY = 3;
+const NOOP_CALLBACK = function (error) { if (error) debug(error); };
+
+function waitText(lockOperation) {
+    if (lockOperation === locker.OP_BOX_UPDATE) return 'Waiting for Cloudron to finish updating. See the Settings view';
+    if (lockOperation === locker.OP_PLATFORM_START) return 'Waiting for Cloudron to initialize';
+    if (lockOperation === locker.OP_FULL_BACKUP) return 'Wait for Cloudron to finish backup. See the Backups view';
+
+    return ''; // cannot happen
+}
+
+function initializeSync() {
+    gInitialized = true;
+    locker.on('unlocked', startNextTask);
+}
+
+// callback is called when task is finished
+function scheduleTask(appId, taskId, callback) {
+    assert.strictEqual(typeof appId, 'string');
+    assert.strictEqual(typeof taskId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    if (!gInitialized) initializeSync();
+
+    if (appId in gActiveTasks) {
+        return callback(new Error(`Task for %s is already active: ${appId}`));
+    }
+
+    if (Object.keys(gActiveTasks).length >= TASK_CONCURRENCY) {
+        debug(`Reached concurrency limit, queueing task id ${taskId}`);
+        tasks.update(taskId, { percent: 0, message: 'Waiting for other app tasks to complete' }, NOOP_CALLBACK);
+        gPendingTasks.push({ appId, taskId, callback });
+        return;
+    }
+
+    var lockError = locker.recursiveLock(locker.OP_APPTASK);
+
+    if (lockError) {
+        debug(`Could not get lock. ${lockError.message}, queueing task id ${taskId}`);
+        tasks.update(taskId, { percent: 0, message: waitText(lockError.operation) }, NOOP_CALLBACK);
+        gPendingTasks.push({ appId, taskId, callback });
+        return;
+    }
+
+    gActiveTasks[appId] = {};
+
+    const logFile = path.join(paths.LOG_DIR, appId, 'apptask.log');
+
+    if (!fs.existsSync(path.dirname(logFile))) safe.fs.mkdirSync(path.dirname(logFile)); // ensure directory
+
+    tasks.startTask(taskId, { logFile, timeout: 20 * 60 * 60 * 1000 /* 20 hours */ }, function (error, result) {
+        callback(error, result);
+
+        delete gActiveTasks[appId];
+        locker.unlock(locker.OP_APPTASK); // unlock event will trigger next task
+    });
+}
+
+function startNextTask() {
+    if (gPendingTasks.length === 0) return;
+
+    assert(Object.keys(gActiveTasks).length < TASK_CONCURRENCY);
+
+    const t = gPendingTasks.shift();
+    scheduleTask(t.appId, t.taskId, t.callback);
+}
+
@@ -0,0 +1,15 @@
+'use strict';
+
+exports = module.exports = {
+    CRON:  { userId: null, username: 'cron' },
+    HEALTH_MONITOR: { userId: null, username: 'healthmonitor' },
+    APP_TASK: { userId: null, username: 'apptask' },
+    EXTERNAL_LDAP_TASK: { userId: null, username: 'externalldap' },
+
+    fromRequest: fromRequest
+};
+
+function fromRequest(req) {
+    var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress || null;
+    return { ip: ip, username: req.user ? req.user.username : null, userId: req.user ? req.user.id : null };
+}
@@ -12,8 +12,8 @@ exports = module.exports = {
 };

 var assert = require('assert'),
-    database = require('./database.js'),
-    DatabaseError = require('./databaseerror');
+    BoxError = require('./boxerror.js'),
+    database = require('./database.js');

 var AUTHCODES_FIELDS = [ 'authCode', 'userId', 'clientId', 'expiresAt' ].join(',');

@@ -22,8 +22,8 @@ function get(authCode, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + AUTHCODES_FIELDS + ' FROM authcodes WHERE authCode = ? AND expiresAt > ?', [ authCode, Date.now() ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Authcode not found'));

        callback(null, result[0]);
    });
@@ -37,12 +37,12 @@ function add(authCode, clientId, userId, expiresAt, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('INSERT INTO authcodes (authCode, clientId, userId, expiresAt) VALUES (?, ?, ?, ?)',
-            [ authCode, clientId, userId, expiresAt ], function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS));
-        if (error || result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        [ authCode, clientId, userId, expiresAt ], function (error, result) {
+            if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS));
+            if (error || result.affectedRows !== 1) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

-        callback(null);
-    });
+            callback(null);
+        });
 }

 function del(authCode, callback) {
@@ -50,8 +50,8 @@ function del(authCode, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM authcodes WHERE authCode = ?', [ authCode ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'Authcode not found'));

        callback(null);
    });
@@ -61,7 +61,7 @@ function delExpired(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM authcodes WHERE expiresAt <= ?', [ Date.now() ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
        return callback(null, result.affectedRows);
    });
 }
@@ -70,7 +70,7 @@ function clear(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM authcodes', function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -1,12 +1,12 @@
 'use strict';

 var assert = require('assert'),
+    BoxError = require('./boxerror.js'),
    database = require('./database.js'),
-    DatabaseError = require('./databaseerror.js'),
    safe = require('safetydance'),
    util = require('util');

-var BACKUPS_FIELDS = [ 'id', 'creationTime', 'version', 'type', 'dependsOn', 'state', 'manifestJson', 'format' ];
+var BACKUPS_FIELDS = [ 'id', 'creationTime', 'version', 'type', 'dependsOn', 'state', 'manifestJson', 'format', 'preserveSecs' ];

 exports = module.exports = {
    add: add,
@@ -47,7 +47,7 @@ function getByTypeAndStatePaged(type, state, page, perPage, callback) {

    database.query('SELECT ' + BACKUPS_FIELDS + ' FROM backups WHERE type = ? AND state = ? ORDER BY creationTime DESC LIMIT ?,?',
        [ type, state, (page-1)*perPage, perPage ], function (error, results) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            results.forEach(function (result) { postProcess(result); });

@@ -63,7 +63,7 @@ function getByTypePaged(type, page, perPage, callback) {

    database.query('SELECT ' + BACKUPS_FIELDS + ' FROM backups WHERE type = ? ORDER BY creationTime DESC LIMIT ?,?',
        [ type, (page-1)*perPage, perPage ], function (error, results) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            results.forEach(function (result) { postProcess(result); });

@@ -80,7 +80,7 @@ function getByAppIdPaged(page, perPage, appId, callback) {
    // box versions (0.93.x and below) used to use appbackup_ prefix
    database.query('SELECT ' + BACKUPS_FIELDS + ' FROM backups WHERE type = ? AND state = ? AND id LIKE ? ORDER BY creationTime DESC LIMIT ?,?',
        [ exports.BACKUP_TYPE_APP, exports.BACKUP_STATE_NORMAL, '%app%\\_' + appId + '\\_%', (page-1)*perPage, perPage ], function (error, results) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            results.forEach(function (result) { postProcess(result); });

@@ -94,8 +94,8 @@ function get(id, callback) {

    database.query('SELECT ' + BACKUPS_FIELDS + ' FROM backups WHERE id = ? ORDER BY creationTime DESC',
        [ id ], function (error, result) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-            if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+            if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Backup not found'));

            postProcess(result[0]);

@@ -103,24 +103,24 @@ function get(id, callback) {
        });
 }

-function add(backup, callback) {
-    assert(backup && typeof backup === 'object');
-    assert.strictEqual(typeof backup.id, 'string');
-    assert.strictEqual(typeof backup.version, 'string');
-    assert(backup.type === exports.BACKUP_TYPE_APP || backup.type === exports.BACKUP_TYPE_BOX);
-    assert(util.isArray(backup.dependsOn));
-    assert.strictEqual(typeof backup.manifest, 'object');
-    assert.strictEqual(typeof backup.format, 'string');
+function add(id, data, callback) {
+    assert(data && typeof data === 'object');
+    assert.strictEqual(typeof id, 'string');
+    assert.strictEqual(typeof data.version, 'string');
+    assert(data.type === exports.BACKUP_TYPE_APP || data.type === exports.BACKUP_TYPE_BOX);
+    assert(util.isArray(data.dependsOn));
+    assert.strictEqual(typeof data.manifest, 'object');
+    assert.strictEqual(typeof data.format, 'string');
    assert.strictEqual(typeof callback, 'function');

-    var creationTime = backup.creationTime || new Date(); // allow tests to set the time
-    var manifestJson = JSON.stringify(backup.manifest);
+    var creationTime = data.creationTime || new Date(); // allow tests to set the time
+    var manifestJson = JSON.stringify(data.manifest);

    database.query('INSERT INTO backups (id, version, type, creationTime, state, dependsOn, manifestJson, format) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
-        [ backup.id, backup.version, backup.type, creationTime, exports.BACKUP_STATE_NORMAL, backup.dependsOn.join(','), manifestJson, backup.format ],
+        [ id, data.version, data.type, creationTime, exports.BACKUP_STATE_NORMAL, data.dependsOn.join(','), manifestJson, data.format ],
        function (error) {
-            if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS));
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            callback(null);
        });
@@ -139,8 +139,8 @@ function update(id, backup, callback) {
    values.push(id);

    database.query('UPDATE backups SET ' + fields.join(', ') + ' WHERE id = ?', values, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(new BoxError(BoxError.NOT_FOUND, 'Backup not found'));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -150,7 +150,7 @@ function clear(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('TRUNCATE TABLE backups', [], function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
        callback(null);
    });
 }
@@ -160,7 +160,7 @@ function del(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM backups WHERE id=?', [ id ], function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
        callback(null);
    });
 }
@@ -1,8 +1,6 @@
 'use strict';

 exports = module.exports = {
-    BackupsError: BackupsError,
-
    testConfig: testConfig,

    getByStatePaged: getByStatePaged,
@@ -40,18 +38,17 @@ exports = module.exports = {
 };

 var addons = require('./addons.js'),
-    appdb = require('./appdb.js'),
    apps = require('./apps.js'),
-    AppsError = require('./apps.js').AppsError,
    async = require('async'),
    assert = require('assert'),
    backupdb = require('./backupdb.js'),
-    config = require('./config.js'),
+    BoxError = require('./boxerror.js'),
+    constants = require('./constants.js'),
    crypto = require('crypto'),
    database = require('./database.js'),
-    DatabaseError = require('./databaseerror.js'),
    DataLayout = require('./datalayout.js'),
    debug = require('debug')('box:backups'),
+    df = require('@sindresorhus/df'),
    eventlog = require('./eventlog.js'),
    fs = require('fs'),
    locker = require('./locker.js'),
@@ -60,10 +57,10 @@ var addons = require('./addons.js'),
    path = require('path'),
    paths = require('./paths.js'),
    progressStream = require('progress-stream'),
+    prettyBytes = require('pretty-bytes'),
    safe = require('safetydance'),
    shell = require('./shell.js'),
    settings = require('./settings.js'),
-    superagent = require('superagent'),
    syncer = require('./syncer.js'),
    tar = require('tar-fs'),
    tasks = require('./tasks.js'),
@@ -78,35 +75,9 @@ function debugApp(app) {
    debug(app.fqdn + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
 }

-function BackupsError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(BackupsError, Error);
-BackupsError.EXTERNAL_ERROR = 'external error';
-BackupsError.INTERNAL_ERROR = 'internal error';
-BackupsError.BAD_STATE = 'bad state';
-BackupsError.BAD_FIELD = 'bad field';
-BackupsError.NOT_FOUND = 'not found';
-
 // choose which storage backend we use for test purpose we use s3
 function api(provider) {
    switch (provider) {
-    case 'caas': return require('./storage/s3.js');
    case 's3': return require('./storage/s3.js');
    case 'gcs': return require('./storage/gcs.js');
    case 'filesystem': return require('./storage/filesystem.js');
@@ -114,6 +85,8 @@ function api(provider) {
    case 's3-v4-compat': return require('./storage/s3.js');
    case 'digitalocean-spaces': return require('./storage/s3.js');
    case 'exoscale-sos': return require('./storage/s3.js');
+    case 'wasabi': return require('./storage/s3.js');
+    case 'scaleway-objectstorage': return require('./storage/s3.js');
    case 'noop': return require('./storage/noop.js');
    default: return null;
    }
@@ -135,12 +108,12 @@ function testConfig(backupConfig, callback) {
    assert.strictEqual(typeof callback, 'function');

    var func = api(backupConfig.provider);
-    if (!func) return callback(new BackupsError(BackupsError.BAD_FIELD, 'unknown storage provider'));
+    if (!func) return callback(new BoxError(BoxError.BAD_FIELD, 'unknown storage provider', { field: 'provider' }));

-    if (backupConfig.format !== 'tgz' && backupConfig.format !== 'rsync') return callback(new BackupsError(BackupsError.BAD_FIELD, 'unknown format'));
+    if (backupConfig.format !== 'tgz' && backupConfig.format !== 'rsync') return callback(new BoxError(BoxError.BAD_FIELD, 'unknown format', { field: 'format' }));

    // remember to adjust the cron ensureBackup task interval accordingly
-    if (backupConfig.intervalSecs < 6 * 60 * 60) return callback(new BackupsError(BackupsError.BAD_FIELD, 'Interval must be atleast 6 hours'));
+    if (backupConfig.intervalSecs < 6 * 60 * 60) return callback(new BoxError(BoxError.BAD_FIELD, 'Interval must be atleast 6 hours', { field: 'interval' }));

    api(backupConfig.provider).testConfig(backupConfig, callback);
 }
@@ -152,7 +125,7 @@ function getByStatePaged(state, page, perPage, callback) {
    assert.strictEqual(typeof callback, 'function');

    backupdb.getByTypeAndStatePaged(backupdb.BACKUP_TYPE_BOX, state, page, perPage, function (error, results) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, results);
    });
@@ -165,7 +138,7 @@ function getByAppIdPaged(page, perPage, appId, callback) {
    assert.strictEqual(typeof callback, 'function');

    backupdb.getByAppIdPaged(page, perPage, appId, function (error, results) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, results);
    });
@@ -176,8 +149,7 @@ function get(backupId, callback) {
    assert.strictEqual(typeof callback, 'function');

    backupdb.get(backupId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new BackupsError(BackupsError.NOT_FOUND));
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, result);
    });
@@ -245,14 +217,14 @@ function createReadStream(sourceFile, key) {

    stream.on('error', function (error) {
        debug('createReadStream: read stream error.', error);
-        ps.emit('error', new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        ps.emit('error', new BoxError(BoxError.EXTERNAL_ERROR, error.message));
    });

    if (key !== null) {
        var encrypt = crypto.createCipher('aes-256-cbc', key);
        encrypt.on('error', function (error) {
            debug('createReadStream: encrypt stream error.', error);
-            ps.emit('error', new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+            ps.emit('error', new BoxError(BoxError.EXTERNAL_ERROR, error.message));
        });
        return stream.pipe(encrypt).pipe(ps);
    } else {
@@ -286,8 +258,15 @@ function tarPack(dataLayout, key, callback) {
    var pack = tar.pack('/', {
        dereference: false, // pack the symlink and not what it points to
        entries: dataLayout.localPaths(),
+        ignoreStatError: (path, err) => {
+            debug(`tarPack: error stat'ing ${path} - ${err.code}`);
+            return err.code === 'ENOENT'; // ignore if file or dir got removed (probably some temporary file)
+        },
        map: function(header) {
            header.name = dataLayout.toRemotePath(header.name);
+            // the tar pax format allows us to encode filenames > 100 and size > 8GB (see #640)
+            // https://www.systutorials.com/docs/linux/man/5-star/
+            if (header.size > 8589934590 || header.name > 99) header.pax = { size: header.size };
            return header;
        },
        strict: false // do not error for unknown types (skip fifo, char/block devices)
@@ -298,19 +277,19 @@ function tarPack(dataLayout, key, callback) {

    pack.on('error', function (error) {
        debug('tarPack: tar stream error.', error);
-        ps.emit('error', new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        ps.emit('error', new BoxError(BoxError.EXTERNAL_ERROR, error.message));
    });

    gzip.on('error', function (error) {
        debug('tarPack: gzip stream error.', error);
-        ps.emit('error', new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        ps.emit('error', new BoxError(BoxError.EXTERNAL_ERROR, error.message));
    });

    if (key !== null) {
        var encrypt = crypto.createCipher('aes-256-cbc', key);
        encrypt.on('error', function (error) {
            debug('tarPack: encrypt stream error.', error);
-            ps.emit('error', new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+            ps.emit('error', new BoxError(BoxError.EXTERNAL_ERROR, error.message));
        });
        pack.pipe(gzip).pipe(encrypt).pipe(ps);
    } else {
@@ -371,7 +350,7 @@ function sync(backupConfig, backupId, dataLayout, progressCallback, callback) {
            }
        }, iteratorCallback);
    }, concurrency, function (error) {
-        if (error) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));

        callback();
    });
@@ -405,6 +384,34 @@ function saveFsMetadata(dataLayout, metadataFile, callback) {
    callback();
 }

+// the du call in the function below requires root
+function checkFreeDiskSpace(backupConfig, dataLayout, callback) {
+    assert.strictEqual(typeof backupConfig, 'object');
+    assert(dataLayout instanceof DataLayout, 'dataLayout must be a DataLayout');
+    assert.strictEqual(typeof callback, 'function');
+
+    if (backupConfig.provider !== 'filesystem') return callback();
+
+    let used = 0;
+    for (let localPath of dataLayout.localPaths()) {
+        debug(`checkFreeDiskSpace: getting disk usage of ${localPath}`);
+        let result = safe.child_process.execSync(`du -Dsb ${localPath}`, { encoding: 'utf8' });
+        if (!result) return callback(new BoxError(BoxError.FS_ERROR, safe.error));
+        used += parseInt(result, 10);
+    }
+
+    debug(`checkFreeDiskSpace: ${used} bytes`);
+
+    df.file(backupConfig.backupFolder).then(function (diskUsage) {
+        const needed = used + (1024 * 1024 * 1024); // check if there is atleast 1GB left afterwards
+        if (diskUsage.available <= needed) return callback(new BoxError(BoxError.FS_ERROR, `Not enough disk space for backup. Needed: ${prettyBytes(needed)} Available: ${prettyBytes(diskUsage.available)}`));
+
+        callback(null);
+    }).catch(function (error) {
+        callback(new BoxError(BoxError.FS_ERROR, error));
+    });
+}
+
 // this function is called via backupupload (since it needs root to traverse app's directory)
 function upload(backupId, format, dataLayoutString, progressCallback, callback) {
    assert.strictEqual(typeof backupId, 'string');
@@ -418,31 +425,35 @@ function upload(backupId, format, dataLayoutString, progressCallback, callback)
    const dataLayout = DataLayout.fromString(dataLayoutString);

    settings.getBackupConfig(function (error, backupConfig) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

-        if (format === 'tgz') {
-            async.retry({ times: 5, interval: 20000 }, function (retryCallback) {
-                retryCallback = once(retryCallback); // protect again upload() erroring much later after tar stream error
+        checkFreeDiskSpace(backupConfig, dataLayout, function (error) {
+            if (error) return callback(error);

-                tarPack(dataLayout, backupConfig.key || null, function (error, tarStream) {
-                    if (error) return retryCallback(error);
+            if (format === 'tgz') {
+                async.retry({ times: 5, interval: 20000 }, function (retryCallback) {
+                    retryCallback = once(retryCallback); // protect again upload() erroring much later after tar stream error

-                    tarStream.on('progress', function(progress) {
-                        const transferred = Math.round(progress.transferred/1024/1024), speed = Math.round(progress.speed/1024/1024);
-                        if (!transferred && !speed) return progressCallback({ message: 'Uploading backup' }); // 0M@0Mbps looks wrong
-                        progressCallback({ message: `Uploading backup ${transferred}M@${speed}Mbps` });
+                    tarPack(dataLayout, backupConfig.key || null, function (error, tarStream) {
+                        if (error) return retryCallback(error);
+
+                        tarStream.on('progress', function(progress) {
+                            const transferred = Math.round(progress.transferred/1024/1024), speed = Math.round(progress.speed/1024/1024);
+                            if (!transferred && !speed) return progressCallback({ message: 'Uploading backup' }); // 0M@0Mbps looks wrong
+                            progressCallback({ message: `Uploading backup ${transferred}M@${speed}Mbps` });
+                        });
+                        tarStream.on('error', retryCallback); // already returns BoxError
+
+                        api(backupConfig.provider).upload(backupConfig, getBackupFilePath(backupConfig, backupId, format), tarStream, retryCallback);
                    });
-                    tarStream.on('error', retryCallback); // already returns BackupsError
-
-                    api(backupConfig.provider).upload(backupConfig, getBackupFilePath(backupConfig, backupId, format), tarStream, retryCallback);
-                });
-            }, callback);
-        } else {
-            async.series([
-                saveFsMetadata.bind(null, dataLayout, `${dataLayout.localRoot()}/fsmetadata.json`),
-                sync.bind(null, backupConfig, backupId, dataLayout, progressCallback)
-            ], callback);
-        }
+                }, callback);
+            } else {
+                async.series([
+                    saveFsMetadata.bind(null, dataLayout, `${dataLayout.localRoot()}/fsmetadata.json`),
+                    sync.bind(null, backupConfig, backupId, dataLayout, progressCallback)
+                ], callback);
+            }
+        });
    });
 }

@@ -465,17 +476,17 @@ function tarExtract(inStream, dataLayout, key, callback) {

    inStream.on('error', function (error) {
        debug('tarExtract: input stream error.', error);
-        emitError(new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        emitError(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
    });

    gunzip.on('error', function (error) {
        debug('tarExtract: gunzip stream error.', error);
-        emitError(new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        emitError(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
    });

    extract.on('error', function (error) {
        debug('tarExtract: extract stream error.', error);
-        emitError(new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        emitError(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
    });

    extract.on('finish', function () {
@@ -488,7 +499,7 @@ function tarExtract(inStream, dataLayout, key, callback) {
        var decrypt = crypto.createDecipher('aes-256-cbc', key);
        decrypt.on('error', function (error) {
            debug('tarExtract: decrypt stream error.', error);
-            emitError(new BackupsError(BackupsError.EXTERNAL_ERROR, `Failed to decrypt: ${error.message}`));
+            emitError(new BoxError(BoxError.EXTERNAL_ERROR, `Failed to decrypt: ${error.message}`));
        });
        inStream.pipe(ps).pipe(decrypt).pipe(gunzip).pipe(extract);
    } else {
@@ -506,19 +517,19 @@ function restoreFsMetadata(dataLayout, metadataFile, callback) {
    debug(`Recreating empty directories in ${dataLayout.toString()}`);

    var metadataJson = safe.fs.readFileSync(metadataFile, 'utf8');
-    if (metadataJson === null) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, 'Error loading fsmetadata.txt:' + safe.error.message));
+    if (metadataJson === null) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Error loading fsmetadata.json:' + safe.error.message));
    var metadata = safe.JSON.parse(metadataJson);
-    if (metadata === null) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, 'Error parsing fsmetadata.txt:' + safe.error.message));
+    if (metadata === null) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Error parsing fsmetadata.json:' + safe.error.message));

    async.eachSeries(metadata.emptyDirs, function createPath(emptyDir, iteratorDone) {
        mkdirp(dataLayout.toLocalPath(emptyDir), iteratorDone);
    }, function (error) {
-        if (error) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, `unable to create path: ${error.message}`));
+        if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `unable to create path: ${error.message}`));

        async.eachSeries(metadata.execFiles, function createPath(execFile, iteratorDone) {
            fs.chmod(dataLayout.toLocalPath(execFile), parseInt('0755', 8), iteratorDone);
        }, function (error) {
-            if (error) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, `unable to chmod: ${error.message}`));
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `unable to chmod: ${error.message}`));

            callback();
        });
@@ -538,12 +549,12 @@ function downloadDir(backupConfig, backupFilePath, dataLayout, progressCallback,
        let relativePath = path.relative(backupFilePath, entry.fullPath);
        if (backupConfig.key) {
            relativePath = decryptFilePath(relativePath, backupConfig.key);
-            if (!relativePath) return callback(new BackupsError(BackupsError.BAD_STATE, 'Unable to decrypt file'));
+            if (!relativePath) return callback(new BoxError(BoxError.BAD_STATE, 'Unable to decrypt file'));
        }
        const destFilePath = dataLayout.toLocalPath('./' + relativePath);

        mkdirp(path.dirname(destFilePath), function (error) {
-            if (error) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+            if (error) return callback(new BoxError(BoxError.FS_ERROR, error.message));

            async.retry({ times: 5, interval: 20000 }, function (retryCallback) {
                let destStream = createWriteStream(destFilePath, backupConfig.key || null);
@@ -600,7 +611,7 @@ function download(backupConfig, backupId, format, dataLayout, progressCallback,

                    ps.on('progress', function (progress) {
                        const transferred = Math.round(progress.transferred/1024/1024), speed = Math.round(progress.speed/1024/1024);
-                        if (!transferred && !speed) return progressCallback({ message: 'Downloading' }); // 0M@0Mbps looks wrong
+                        if (!transferred && !speed) return progressCallback({ message: 'Downloading backup' }); // 0M@0Mbps looks wrong
                        progressCallback({ message: `Downloading ${transferred}M@${speed}Mbps` });
                    });
                    ps.on('error', retryCallback);
@@ -631,11 +642,11 @@ function restore(backupConfig, backupId, progressCallback, callback) {
        debug('restore: download completed, importing database');

        database.importFromFile(`${dataLayout.localRoot()}/box.mysqldump`, function (error) {
-            if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            debug('restore: database imported');

-            callback();
+            settings.initCache(callback);
        });
    });
 }
@@ -654,7 +665,7 @@ function restoreApp(app, addonsToRestore, restoreConfig, progressCallback, callb
    var startTime = new Date();

    settings.getBackupConfig(function (error, backupConfig) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        async.series([
            download.bind(null, backupConfig, restoreConfig.backupId, restoreConfig.backupFormat, dataLayout, progressCallback),
@@ -678,15 +689,15 @@ function runBackupUpload(backupId, format, dataLayout, progressCallback, callbac

    shell.sudo(`backup-${backupId}`, [ BACKUP_UPLOAD_CMD, backupId, format, dataLayout.toString() ], { preserveEnv: true, ipc: true }, function (error) {
        if (error && (error.code === null /* signal */ || (error.code !== 0 && error.code !== 50))) { // backuptask crashed
-            return callback(new BackupsError(BackupsError.INTERNAL_ERROR, 'Backuptask crashed'));
+            return callback(new BoxError(BoxError.INTERNAL_ERROR, 'Backuptask crashed'));
        } else if (error && error.code === 50) { // exited with error
-            return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, result));
+            return callback(new BoxError(BoxError.EXTERNAL_ERROR, result));
        }

        callback();
    }).on('message', function (message) {
        if (!message.result) return progressCallback(message);
-        debug(`runBackupUpload: result - ${message}`);
+        debug(`runBackupUpload: result - ${JSON.stringify(message)}`);
        result = message.result;
    });
 }
@@ -708,7 +719,9 @@ function setSnapshotInfo(id, info, callback) {
    var contents = safe.fs.readFileSync(paths.SNAPSHOT_INFO_FILE, 'utf8');
    var data = safe.JSON.parse(contents) || { };
    if (info) data[id] = info; else delete data[id];
-    if (!safe.fs.writeFileSync(paths.SNAPSHOT_INFO_FILE, JSON.stringify(data, null, 4), 'utf8')) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, safe.error.message));
+    if (!safe.fs.writeFileSync(paths.SNAPSHOT_INFO_FILE, JSON.stringify(data, null, 4), 'utf8')) {
+        return callback(new BoxError(BoxError.FS_ERROR, safe.error.message));
+    }

    callback();
 }
@@ -720,7 +733,7 @@ function snapshotBox(progressCallback, callback) {
    progressCallback({ message: 'Snapshotting box' });

    database.exportToFile(`${paths.BOX_DATA_DIR}/box.mysqldump`, function (error) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        return callback();
    });
@@ -750,52 +763,23 @@ function uploadBoxSnapshot(backupConfig, progressCallback, callback) {
    });
 }

-
-function backupDone(apiConfig, backupId, appBackupIds, callback) {
-    assert.strictEqual(typeof apiConfig, 'object');
-    assert.strictEqual(typeof backupId, 'string');
-    assert(Array.isArray(appBackupIds));
-    assert.strictEqual(typeof callback, 'function');
-
-    if (apiConfig.provider !== 'caas') return callback();
-
-    debug('[%s] backupDone: %s apps %j', backupId, backupId, appBackupIds);
-
-    var url = config.apiServerOrigin() + '/api/v1/boxes/' + apiConfig.fqdn + '/backupDone';
-    var data = {
-        boxVersion: config.version(),
-        backupId: backupId,
-        appId: null,        // now unused
-        appVersion: null,   // now unused
-        appBackupIds: appBackupIds
-    };
-
-    superagent.post(url).send(data).query({ token: apiConfig.token }).timeout(30 * 1000).end(function (error, result) {
-        if (error && !error.response) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, error));
-        if (result.statusCode !== 200) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, result.text));
-
-        return callback(null);
-    });
-}
-
-function rotateBoxBackup(backupConfig, timestamp, appBackupIds, progressCallback, callback) {
+function rotateBoxBackup(backupConfig, tag, appBackupIds, progressCallback, callback) {
    assert.strictEqual(typeof backupConfig, 'object');
-    assert.strictEqual(typeof timestamp, 'string');
+    assert.strictEqual(typeof tag, 'string');
    assert(Array.isArray(appBackupIds));
    assert.strictEqual(typeof progressCallback, 'function');
    assert.strictEqual(typeof callback, 'function');

    var snapshotInfo = getSnapshotInfo('box');
-    if (!snapshotInfo) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, 'Snapshot info missing or corrupt'));

-    var snapshotTime = snapshotInfo.timestamp.replace(/[T.]/g, '-').replace(/[:Z]/g,'');
-    var backupId = util.format('%s/box_%s_v%s', timestamp, snapshotTime, config.version());
+    const snapshotTime = snapshotInfo.timestamp.replace(/[T.]/g, '-').replace(/[:Z]/g,''); // add this to filename to make it unique, so it's easy to download them
+    const backupId = util.format('%s/box_%s_v%s', tag, snapshotTime, constants.VERSION);
    const format = backupConfig.format;

    debug(`Rotating box backup to id ${backupId}`);

-    backupdb.add({ id: backupId, version: config.version(), type: backupdb.BACKUP_TYPE_BOX, dependsOn: appBackupIds, manifest: null, format: format }, function (error) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+    backupdb.add(backupId, { version: constants.VERSION, type: backupdb.BACKUP_TYPE_BOX, dependsOn: appBackupIds, manifest: null, format: format }, function (error) {
+        if (error) return callback(error);

        var copy = api(backupConfig.provider).copy(backupConfig, getBackupFilePath(backupConfig, 'snapshot/box', format), getBackupFilePath(backupConfig, backupId, format));
        copy.on('progress', (message) => progressCallback({ message }));
@@ -804,33 +788,29 @@ function rotateBoxBackup(backupConfig, timestamp, appBackupIds, progressCallback

            backupdb.update(backupId, { state: state }, function (error) {
                if (copyBackupError) return callback(copyBackupError);
-                if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+                if (error) return callback(error);

                debug(`Rotated box backup successfully as id ${backupId}`);

-                backupDone(backupConfig, backupId, appBackupIds, function (error) {
-                    if (error) return callback(error);
-
-                    callback(null, backupId);
-                });
+                callback(null, backupId);
            });
        });
    });
 }

-function backupBoxWithAppBackupIds(appBackupIds, timestamp, progressCallback, callback) {
+function backupBoxWithAppBackupIds(appBackupIds, tag, progressCallback, callback) {
    assert(Array.isArray(appBackupIds));
-    assert.strictEqual(typeof timestamp, 'string');
+    assert.strictEqual(typeof tag, 'string');
    assert.strictEqual(typeof progressCallback, 'function');
    assert.strictEqual(typeof callback, 'function');

    settings.getBackupConfig(function (error, backupConfig) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        uploadBoxSnapshot(backupConfig, progressCallback, function (error) {
            if (error) return callback(error);

-            rotateBoxBackup(backupConfig, timestamp, appBackupIds, progressCallback, callback);
+            rotateBoxBackup(backupConfig, tag, appBackupIds, progressCallback, callback);
        });
    });
 }
@@ -838,10 +818,10 @@ function backupBoxWithAppBackupIds(appBackupIds, timestamp, progressCallback, ca
 function canBackupApp(app) {
    // only backup apps that are installed or pending configure or called from apptask. Rest of them are in some
    // state not good for consistent backup (i.e addons may not have been setup completely)
-    return (app.installationState === appdb.ISTATE_INSTALLED && app.health === appdb.HEALTH_HEALTHY) ||
-            app.installationState === appdb.ISTATE_PENDING_CONFIGURE ||
-            app.installationState === appdb.ISTATE_PENDING_BACKUP ||  // called from apptask
-            app.installationState === appdb.ISTATE_PENDING_UPDATE; // called from apptask
+    return (app.installationState === apps.ISTATE_INSTALLED && app.health === apps.HEALTH_HEALTHY) ||
+            app.installationState === apps.ISTATE_PENDING_CONFIGURE ||
+            app.installationState === apps.ISTATE_PENDING_BACKUP ||  // called from apptask
+            app.installationState === apps.ISTATE_PENDING_UPDATE; // called from apptask
 }

 function snapshotApp(app, progressCallback, callback) {
@@ -851,45 +831,45 @@ function snapshotApp(app, progressCallback, callback) {

    progressCallback({ message: `Snapshotting app ${app.fqdn}` });

-    if (!safe.fs.writeFileSync(path.join(paths.APPS_DATA_DIR, app.id + '/config.json'), JSON.stringify(apps.getAppConfig(app)))) {
-        return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, 'Error creating config.json: ' + safe.error.message));
+    if (!safe.fs.writeFileSync(path.join(paths.APPS_DATA_DIR, app.id + '/config.json'), JSON.stringify(app))) {
+        return callback(new BoxError(BoxError.FS_ERROR, 'Error creating config.json: ' + safe.error.message));
    }

    addons.backupAddons(app, app.manifest.addons, function (error) {
-        if (error) return callback(new BackupsError(BackupsError.EXTERNAL_ERROR, error.message));
+        if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));

        return callback(null);
    });
 }

-function rotateAppBackup(backupConfig, app, timestamp, progressCallback, callback) {
+function rotateAppBackup(backupConfig, app, tag, options, progressCallback, callback) {
    assert.strictEqual(typeof backupConfig, 'object');
    assert.strictEqual(typeof app, 'object');
-    assert.strictEqual(typeof timestamp, 'string');
+    assert.strictEqual(typeof tag, 'string');
+    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof progressCallback, 'function');
    assert.strictEqual(typeof callback, 'function');

    var snapshotInfo = getSnapshotInfo(app.id);
-    if (!snapshotInfo) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, 'Snapshot info missing or corrupt'));

-    var snapshotTime = snapshotInfo.timestamp.replace(/[T.]/g, '-').replace(/[:Z]/g,'');
    var manifest = snapshotInfo.restoreConfig ? snapshotInfo.restoreConfig.manifest : snapshotInfo.manifest; // compat
-    var backupId = util.format('%s/app_%s_%s_v%s', timestamp, app.id, snapshotTime, manifest.version);
+    const snapshotTime = snapshotInfo.timestamp.replace(/[T.]/g, '-').replace(/[:Z]/g,''); // add this for unique filename which helps when downloading them
+    const backupId = util.format('%s/app_%s_%s_v%s', tag, app.id, snapshotTime, manifest.version);
    const format = backupConfig.format;

    debug(`Rotating app backup of ${app.id} to id ${backupId}`);

-    backupdb.add({ id: backupId, version: manifest.version, type: backupdb.BACKUP_TYPE_APP, dependsOn: [ ], manifest: manifest, format: format }, function (error) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+    backupdb.add(backupId, { version: manifest.version, type: backupdb.BACKUP_TYPE_APP, dependsOn: [ ], manifest: manifest, format: format }, function (error) {
+        if (error) return callback(error);

        var copy = api(backupConfig.provider).copy(backupConfig, getBackupFilePath(backupConfig, `snapshot/app_${app.id}`, format), getBackupFilePath(backupConfig, backupId, format));
        copy.on('progress', (message) => progressCallback({ message }));
        copy.on('done', function (copyBackupError) {
            const state = copyBackupError ? backupdb.BACKUP_STATE_ERROR : backupdb.BACKUP_STATE_NORMAL;

-            backupdb.update(backupId, { state: state }, function (error) {
+            backupdb.update(backupId, { preserveSecs: options.preserveSecs || 0, state: state }, function (error) {
                if (copyBackupError) return callback(copyBackupError);
-                if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+                if (error) return callback(error);

                debug(`Rotated app backup of ${app.id} successfully to id ${backupId}`);

@@ -928,35 +908,37 @@ function uploadAppSnapshot(backupConfig, app, progressCallback, callback) {
    });
 }

-function backupAppWithTimestamp(app, timestamp, progressCallback, callback) {
+function backupAppWithTag(app, tag, options, progressCallback, callback) {
    assert.strictEqual(typeof app, 'object');
-    assert.strictEqual(typeof timestamp, 'string');
+    assert.strictEqual(typeof tag, 'string');
+    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof progressCallback, 'function');
    assert.strictEqual(typeof callback, 'function');

    if (!canBackupApp(app)) return callback(); // nothing to do

    settings.getBackupConfig(function (error, backupConfig) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        uploadAppSnapshot(backupConfig, app, progressCallback, function (error) {
            if (error) return callback(error);

-            rotateAppBackup(backupConfig, app, timestamp, progressCallback, callback);
+            rotateAppBackup(backupConfig, app, tag, options, progressCallback, callback);
        });
    });
 }

-function backupApp(app, progressCallback, callback) {
+function backupApp(app, options, progressCallback, callback) {
    assert.strictEqual(typeof app, 'object');
+    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof progressCallback, 'function');
    assert.strictEqual(typeof callback, 'function');

-    const timestamp = (new Date()).toISOString().replace(/[T.]/g, '-').replace(/[:Z]/g,'');
+    const tag = (new Date()).toISOString().replace(/[T.]/g, '-').replace(/[:Z]/g,'');

-    debug(`backupApp - Backing up ${app.fqdn} with timestamp ${timestamp}`);
+    debug(`backupApp - Backing up ${app.fqdn} with tag ${tag}`);

-    backupAppWithTimestamp(app, timestamp, progressCallback, callback);
+    backupAppWithTag(app, tag, options, progressCallback, callback);
 }

 // this function expects you to have a lock. Unlike other progressCallback this also has a progress field
@@ -964,10 +946,10 @@ function backupBoxAndApps(progressCallback, callback) {
    assert.strictEqual(typeof progressCallback, 'function');
    assert.strictEqual(typeof callback, 'function');

-    var timestamp = (new Date()).toISOString().replace(/[T.]/g, '-').replace(/[:Z]/g,'');
+    const tag = (new Date()).toISOString().replace(/[T.]/g, '-').replace(/[:Z]/g,'');

    apps.getAll(function (error, allApps) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        let percent = 1;
        let step = 100/(allApps.length+2);
@@ -981,8 +963,8 @@ function backupBoxAndApps(progressCallback, callback) {
                return iteratorCallback(null, null); // nothing to backup
            }

-            backupAppWithTimestamp(app, timestamp, (progress) => progressCallback({ percent: percent, message: progress.message }), function (error, backupId) {
-                if (error && error.reason !== BackupsError.BAD_STATE) {
+            backupAppWithTag(app, tag, { /* options */ }, (progress) => progressCallback({ percent: percent, message: progress.message }), function (error, backupId) {
+                if (error && error.reason !== BoxError.BAD_STATE) {
                    debugApp(app, 'Unable to backup', error);
                    return iteratorCallback(error);
                }
@@ -999,28 +981,31 @@ function backupBoxAndApps(progressCallback, callback) {
            progressCallback({ percent: percent, message: 'Backing up system data' });
            percent += step;

-            backupBoxWithAppBackupIds(backupIds, timestamp, (progress) => progressCallback({ percent: percent, message: progress.message }), callback);
+            backupBoxWithAppBackupIds(backupIds, tag, (progress) => progressCallback({ percent: percent, message: progress.message }), callback);
        });
    });
 }

 function startBackupTask(auditSource, callback) {
    let error = locker.lock(locker.OP_FULL_BACKUP);
-    if (error) return callback(new BackupsError(BackupsError.BAD_STATE, `Cannot backup now: ${error.message}`));
+    if (error) return callback(new BoxError(BoxError.BAD_STATE, `Cannot backup now: ${error.message}`));
+
+    tasks.add(tasks.TASK_BACKUP, [ ], function (error, taskId) {
+        if (error) return callback(error);

-    let task = tasks.startTask(tasks.TASK_BACKUP, []);
-    task.on('error', (error) => callback(new BackupsError(BackupsError.INTERNAL_ERROR, error)));
-    task.on('start', (taskId) => {
        eventlog.add(eventlog.ACTION_BACKUP_START, auditSource, { taskId });
+
+        tasks.startTask(taskId, { timeout: 12 * 60 * 60 * 1000 /* 12 hours */ }, function (error, backupId) {
+            locker.unlock(locker.OP_FULL_BACKUP);
+
+            const errorMessage = error ? error.message : '';
+            const timedOut = error ? error.code === tasks.ETIMEOUT : false;
+
+            eventlog.add(eventlog.ACTION_BACKUP_FINISH, auditSource, { taskId, errorMessage, timedOut, backupId });
+        });
+
        callback(null, taskId);
    });
-    task.on('finish', (error, result) => {
-        locker.unlock(locker.OP_FULL_BACKUP);
-
-        const errorMessage = error ? error.message : '';
-
-        eventlog.add(eventlog.ACTION_BACKUP_FINISH, auditSource, { taskId: task.id, errorMessage: errorMessage, backupId: result });
-    });
 }

 function ensureBackup(auditSource, callback) {
@@ -1092,10 +1077,11 @@ function cleanupAppBackups(backupConfig, referencedAppBackups, callback) {

    // we clean app backups of any state because the ones to keep are determined by the box cleanup code
    backupdb.getByTypePaged(backupdb.BACKUP_TYPE_APP, 1, 1000, function (error, appBackups) {
-        if (error) return callback(new BackupsError(BackupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        async.eachSeries(appBackups, function iterator(appBackup, iteratorDone) {
            if (referencedAppBackups.indexOf(appBackup.id) !== -1) return iteratorDone();
+            if ((now - appBackup.creationTime) < (appBackup.preserveSecs * 1000)) return iteratorDone();
            if ((now - appBackup.creationTime) < (backupConfig.retentionSecs * 1000)) return iteratorDone();

            debug('cleanupAppBackups: removing %s', appBackup.id);
@@ -1179,7 +1165,7 @@ function cleanupSnapshots(backupConfig, callback) {
    delete info.box;
    async.eachSeries(Object.keys(info), function (appId, iteratorDone) {
        apps.get(appId, function (error /*, app */) {
-            if (!error || error.reason !== AppsError.NOT_FOUND) return iteratorDone();
+            if (!error || error.reason !== BoxError.NOT_FOUND) return iteratorDone();

            function done(/* ignoredError */) {
                safe.fs.unlinkSync(path.join(paths.BACKUP_INFO_DIR, `${appId}.sync.cache`));
@@ -1243,18 +1229,20 @@ function cleanup(auditSource, progressCallback, callback) {
 }

 function startCleanupTask(auditSource, callback) {
-    let task = tasks.startTask(tasks.TASK_CLEAN_BACKUPS, [ auditSource ]);
-    task.on('error', (error) => callback(new BackupsError(BackupsError.INTERNAL_ERROR, error)));
-    task.on('start', (taskId) => {
-        eventlog.add(eventlog.ACTION_BACKUP_CLEANUP_START, auditSource, { taskId });
-        callback(null, taskId);
-    });
-    task.on('finish', (error, result) => { // result is { removedBoxBackups, removedAppBackups }
-        eventlog.add(eventlog.ACTION_BACKUP_CLEANUP_FINISH, auditSource, {
-            errorMessage: error ? error.message : null,
-            removedBoxBackups: result ? result.removedBoxBackups : [],
-            removedAppBackups: result ? result.removedAppBackups : []
+
+    tasks.add(tasks.TASK_CLEAN_BACKUPS, [ auditSource ], function (error, taskId) {
+        if (error) return callback(error);
+
+        tasks.startTask(taskId, {}, (error, result) => { // result is { removedBoxBackups, removedAppBackups }
+            eventlog.add(eventlog.ACTION_BACKUP_CLEANUP_FINISH, auditSource, {
+                taskId,
+                errorMessage: error ? error.message : null,
+                removedBoxBackups: result ? result.removedBoxBackups : [],
+                removedAppBackups: result ? result.removedAppBackups : []
+            });
        });
+
+        callback(null, taskId);
    });
 }

@@ -0,0 +1,95 @@
+/* jslint node:true */
+
+'use strict';
+
+const assert = require('assert'),
+    HttpError = require('connect-lastmile').HttpError,
+    util = require('util'),
+    _ = require('underscore');
+
+exports = module.exports = BoxError;
+
+function BoxError(reason, errorOrMessage, details) {
+    assert.strictEqual(typeof reason, 'string');
+    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
+    assert(typeof details === 'object' || typeof details === 'undefined');
+
+    Error.call(this);
+    Error.captureStackTrace(this, this.constructor);
+
+    this.name = this.constructor.name;
+    this.reason = reason;
+    this.details = details || {};
+
+    if (typeof errorOrMessage === 'undefined') {
+        this.message = reason;
+    } else if (typeof errorOrMessage === 'string') {
+        this.message = errorOrMessage;
+    } else { // error object
+        this.message = errorOrMessage.message;
+        this.nestedError = errorOrMessage;
+        _.extend(this.details, errorOrMessage); // copy enumerable properies
+    }
+}
+util.inherits(BoxError, Error);
+BoxError.ACCESS_DENIED = 'Access Denied';
+BoxError.ALREADY_EXISTS = 'Already Exists';
+BoxError.BAD_FIELD = 'Bad Field';
+BoxError.BAD_STATE = 'Bad State';
+BoxError.BUSY = 'Busy';
+BoxError.COLLECTD_ERROR = 'Collectd Error';
+BoxError.CONFLICT = 'Conflict';
+BoxError.CRYPTO_ERROR = 'Crypto Error';
+BoxError.DATABASE_ERROR = 'Database Error';
+BoxError.DNS_ERROR = 'DNS Error';
+BoxError.DOCKER_ERROR = 'Docker Error';
+BoxError.EXTERNAL_ERROR = 'External Error'; // use this for external API errors
+BoxError.FS_ERROR = 'FileSystem Error';
+BoxError.INACTIVE = 'Inactive';
+BoxError.INTERNAL_ERROR = 'Internal Error';
+BoxError.INVALID_CREDENTIALS = 'Invalid Credentials';
+BoxError.LICENSE_ERROR = 'License Error';
+BoxError.LOGROTATE_ERROR = 'Logrotate Error';
+BoxError.MAIL_ERROR = 'Mail Error';
+BoxError.NETWORK_ERROR = 'Network Error';
+BoxError.NGINX_ERROR = 'Nginx Error';
+BoxError.NOT_FOUND = 'Not found';
+BoxError.NOT_IMPLEMENTED = 'Not implemented';
+BoxError.NOT_SIGNED = 'Not Signed';
+BoxError.OPENSSL_ERROR = 'OpenSSL Error';
+BoxError.PLAN_LIMIT = 'Plan Limit';
+BoxError.TASK_ERROR = 'Task Error';
+BoxError.TRY_AGAIN = 'Try Again';
+BoxError.UNKNOWN_ERROR = 'Unknown Error'; // only used for porting
+
+BoxError.prototype.toPlainObject = function () {
+    return _.extend({}, { message: this.message, reason: this.reason }, this.details);
+};
+
+// this is a class method for now in case error is not a BoxError
+BoxError.toHttpError = function (error) {
+    switch (error.reason) {
+    case BoxError.BAD_FIELD:
+        return new HttpError(400, error);
+    case BoxError.LICENSE_ERROR:
+        return new HttpError(402, error);
+    case BoxError.NOT_FOUND:
+        return new HttpError(404, error);
+    case BoxError.ALREADY_EXISTS:
+    case BoxError.BAD_STATE:
+    case BoxError.CONFLICT:
+        return new HttpError(409, error);
+    case BoxError.INVALID_CREDENTIALS:
+        return new HttpError(412, error);
+    case BoxError.EXTERNAL_ERROR:
+    case BoxError.NETWORK_ERROR:
+    case BoxError.FS_ERROR:
+    case BoxError.MAIL_ERROR:
+    case BoxError.DOCKER_ERROR:
+        return new HttpError(424, error);
+    case BoxError.DATABASE_ERROR:
+    case BoxError.INTERNAL_ERROR:
+    default:
+        return new HttpError(500, error);
+    }
+};
@@ -1,130 +0,0 @@
-'use strict';
-
-exports = module.exports = {
-    verifySetupToken: verifySetupToken,
-    setupDone: setupDone,
-
-    sendHeartbeat: sendHeartbeat,
-    setPtrRecord: setPtrRecord,
-
-    CaasError: CaasError
-};
-
-var assert = require('assert'),
-    config = require('./config.js'),
-    debug = require('debug')('box:caas'),
-    settings = require('./settings.js'),
-    superagent = require('superagent'),
-    util = require('util');
-
-function CaasError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(CaasError, Error);
-CaasError.BAD_FIELD = 'Field error';
-CaasError.BAD_STATE = 'Bad state';
-CaasError.INVALID_TOKEN = 'Invalid Token';
-CaasError.INTERNAL_ERROR = 'Internal Error';
-CaasError.EXTERNAL_ERROR = 'External Error';
-
-function getCaasConfig(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    settings.getCaasConfig(function (error, result) {
-        if (error) return callback(new CaasError(CaasError.INTERNAL_ERROR, error));
-
-        callback(null, result);
-    });
-}
-
-function verifySetupToken(setupToken, callback) {
-    assert.strictEqual(typeof setupToken, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    settings.getCaasConfig(function (error, caasConfig) {
-        if (error) return callback(new CaasError(CaasError.INTERNAL_ERROR, error));
-
-        superagent.get(config.apiServerOrigin() + '/api/v1/boxes/' + caasConfig.boxId + '/setup/verify').query({ setupToken: setupToken })
-            .timeout(30 * 1000)
-            .end(function (error, result) {
-                if (error && !error.response) return callback(new CaasError(CaasError.EXTERNAL_ERROR, error));
-                if (result.statusCode === 403) return callback(new CaasError(CaasError.INVALID_TOKEN));
-                if (result.statusCode === 409) return callback(new CaasError(CaasError.BAD_STATE, 'Already setup'));
-                if (result.statusCode !== 200) return callback(new CaasError(CaasError.EXTERNAL_ERROR, error));
-
-                callback(null);
-            });
-    });
-}
-
-function setupDone(setupToken, callback) {
-    assert.strictEqual(typeof setupToken, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    settings.getCaasConfig(function (error, caasConfig) {
-        if (error) return callback(new CaasError(CaasError.INTERNAL_ERROR, error));
-
-        // Now let the api server know we got activated
-        superagent.post(config.apiServerOrigin() + '/api/v1/boxes/' + caasConfig.boxId + '/setup/done').query({ setupToken: setupToken })
-            .timeout(30 * 1000)
-            .end(function (error, result) {
-                if (error && !error.response) return callback(new CaasError(CaasError.EXTERNAL_ERROR, error));
-                if (result.statusCode === 403) return callback(new CaasError(CaasError.INVALID_TOKEN));
-                if (result.statusCode === 409) return callback(new CaasError(CaasError.BAD_STATE, 'Already setup'));
-                if (result.statusCode !== 201) return callback(new CaasError(CaasError.EXTERNAL_ERROR, error));
-
-                callback(null);
-            });
-    });
-}
-
-function sendHeartbeat() {
-    assert(config.provider() === 'caas', 'Heartbeat is only sent for managed cloudrons');
-
-    getCaasConfig(function (error, result) {
-        if (error) return debug('Caas config missing', error);
-
-        var url = config.apiServerOrigin() + '/api/v1/boxes/' + result.boxId + '/heartbeat';
-        superagent.post(url).query({ token: result.token, version: config.version() }).timeout(30 * 1000).end(function (error, result) {
-            if (error && !error.response) debug('Network error sending heartbeat.', error);
-            else if (result.statusCode !== 200) debug('Server responded to heartbeat with %s %s', result.statusCode, result.text);
-            else debug('Heartbeat sent to %s', url);
-        });
-    });
-}
-
-function setPtrRecord(domain, callback) {
-    assert.strictEqual(typeof domain, 'string');
-    assert.strictEqual(typeof callback, 'function');
-
-    getCaasConfig(function (error, result) {
-        if (error) return callback(error);
-
-        superagent
-            .post(config.apiServerOrigin() + '/api/v1/boxes/' + result.boxId + '/ptr')
-            .query({ token: result.token })
-            .send({ domain: domain })
-            .timeout(5 * 1000)
-            .end(function (error, result) {
-                if (error && !error.response) return callback(new CaasError(CaasError.EXTERNAL_ERROR, 'Cannot reach appstore'));
-                if (result.statusCode !== 202) return callback(new CaasError(CaasError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
-
-                return callback(null);
-            });
-    });
-}
@@ -2,6 +2,7 @@

 var assert = require('assert'),
    async = require('async'),
+    BoxError = require('../boxerror.js'),
    crypto = require('crypto'),
    debug = require('debug')('box:cert/acme2'),
    domains = require('../domains.js'),
@@ -24,31 +25,6 @@ exports = module.exports = {
    _getChallengeSubdomain: getChallengeSubdomain
 };

-function Acme2Error(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(Acme2Error, Error);
-Acme2Error.INTERNAL_ERROR = 'Internal Error';
-Acme2Error.EXTERNAL_ERROR = 'External Error';
-Acme2Error.ALREADY_EXISTS = 'Already Exists';
-Acme2Error.NOT_COMPLETED = 'Not Completed';
-Acme2Error.FORBIDDEN = 'Forbidden';
-
 // http://jose.readthedocs.org/en/latest/
 // https://www.ietf.org/proceedings/92/slides/slides-92-acme-1.pdf
 // https://community.letsencrypt.org/t/list-of-client-implementations/2103
@@ -80,7 +56,7 @@ function urlBase64Encode(string) {
 }

 function b64(str) {
-    var buf = util.isBuffer(str) ? str : new Buffer(str);
+    var buf = util.isBuffer(str) ? str : Buffer.from(str);
    return urlBase64Encode(buf.toString('base64'));
 }

@@ -158,8 +134,8 @@ Acme2.prototype.updateContact = function (registrationUri, callback) {

    const that = this;
    this.sendSignedRequest(registrationUri, JSON.stringify(payload), function (error, result) {
-        if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Network error when registering user: ' + error.message));
-        if (result.statusCode !== 200) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, util.format('Failed to update contact. Expecting 200, got %s %s', result.statusCode, result.text)));
+        if (error) return callback(new BoxError(BoxError.NETWORK_ERROR, `Network error when updating contact: ${error.message}`));
+        if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Failed to update contact. Expecting 200, got %s %s', result.statusCode, result.text)));

        debug(`updateContact: contact of user updated to ${that.email}`);

@@ -178,9 +154,9 @@ Acme2.prototype.registerUser = function (callback) {

    var that = this;
    this.sendSignedRequest(this.directory.newAccount, JSON.stringify(payload), function (error, result) {
-        if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Network error when registering new account: ' + error.message));
+        if (error) return callback(new BoxError(BoxError.NETWORK_ERROR, `Network error when registering user: ${error.message}`));
        // 200 if already exists. 201 for new accounts
-        if (result.statusCode !== 200 && result.statusCode !== 201) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, util.format('Failed to register new account. Expecting 200 or 201, got %s %s', result.statusCode, result.text)));
+        if (result.statusCode !== 200 && result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Failed to register new account. Expecting 200 or 201, got %s %s', result.statusCode, result.text)));

        debug(`registerUser: user registered keyid: ${result.headers.location}`);

@@ -204,17 +180,17 @@ Acme2.prototype.newOrder = function (domain, callback) {
    debug('newOrder: %s', domain);

    this.sendSignedRequest(this.directory.newOrder, JSON.stringify(payload), function (error, result) {
-        if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Network error when registering domain: ' + error.message));
-        if (result.statusCode === 403) return callback(new Acme2Error(Acme2Error.FORBIDDEN, result.body.detail));
-        if (result.statusCode !== 201) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, util.format('Failed to register user. Expecting 201, got %s %s', result.statusCode, result.text)));
+        if (error) return callback(new BoxError(BoxError.NETWORK_ERROR, `Network error when creating new order: ${error.message}`));
+        if (result.statusCode === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, `Forbidden sending signed request: ${result.body.detail}`));
+        if (result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Failed to register user. Expecting 201, got %s %s', result.statusCode, result.text)));

        debug('newOrder: created order %s %j', domain, result.body);

        const order = result.body, orderUrl = result.headers.location;

-        if (!Array.isArray(order.authorizations)) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'invalid authorizations in order'));
-        if (typeof order.finalize !== 'string') return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'invalid finalize in order'));
-        if (typeof orderUrl !== 'string') return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'invalid order location in order header'));
+        if (!Array.isArray(order.authorizations)) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'invalid authorizations in order'));
+        if (typeof order.finalize !== 'string') return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'invalid finalize in order'));
+        if (typeof orderUrl !== 'string') return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'invalid order location in order header'));

        callback(null, order, orderUrl);
    });
@@ -232,18 +208,18 @@ Acme2.prototype.waitForOrder = function (orderUrl, callback) {
        superagent.get(orderUrl).timeout(30 * 1000).end(function (error, result) {
            if (error && !error.response) {
                debug('waitForOrder: network error getting uri %s', orderUrl);
-                return retryCallback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, error.message)); // network error
+                return retryCallback(new BoxError(BoxError.NETWORK_ERROR, `Network error waiting for order: ${error.message}`)); // network error
            }
            if (result.statusCode !== 200) {
                debug('waitForOrder: invalid response code getting uri %s', result.statusCode);
-                return retryCallback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Bad response code:' + result.statusCode));
+                return retryCallback(new BoxError(BoxError.EXTERNAL_ERROR, 'Bad response code:' + result.statusCode));
            }

            debug('waitForOrder: status is "%s %j', result.body.status, result.body);

-            if (result.body.status === 'pending' || result.body.status === 'processing') return retryCallback(new Acme2Error(Acme2Error.NOT_COMPLETED));
+            if (result.body.status === 'pending' || result.body.status === 'processing') return retryCallback(new BoxError(BoxError.TRY_AGAIN, `Request is in ${result.body.status} state`));
            else if (result.body.status === 'valid' && result.body.certificate) return retryCallback(null, result.body.certificate);
-            else return retryCallback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Unexpected status or invalid response: ' + result.body));
+            else return retryCallback(new BoxError(BoxError.EXTERNAL_ERROR, 'Unexpected status or invalid response: ' + result.body));
        });
    }, callback);
 };
@@ -277,8 +253,8 @@ Acme2.prototype.notifyChallengeReady = function (challenge, callback) {
    };

    this.sendSignedRequest(challenge.url, JSON.stringify(payload), function (error, result) {
-        if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Network error when notifying challenge: ' + error.message));
-        if (result.statusCode !== 200) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, util.format('Failed to notify challenge. Expecting 200, got %s %s', result.statusCode, result.text)));
+        if (error) return callback(new BoxError(BoxError.NETWORK_ERROR, `Network error when notifying challenge: ${error.message}`));
+        if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Failed to notify challenge. Expecting 200, got %s %s', result.statusCode, result.text)));

        callback();
    });
@@ -296,18 +272,18 @@ Acme2.prototype.waitForChallenge = function (challenge, callback) {
        superagent.get(challenge.url).timeout(30 * 1000).end(function (error, result) {
            if (error && !error.response) {
                debug('waitForChallenge: network error getting uri %s', challenge.url);
-                return retryCallback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, error.message)); // network error
+                return retryCallback(new BoxError(BoxError.NETWORK_ERROR, `Network error waiting for challenge: ${error.message}`));
            }
            if (result.statusCode !== 200) {
                debug('waitForChallenge: invalid response code getting uri %s', result.statusCode);
-                return retryCallback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Bad response code:' + result.statusCode));
+                return retryCallback(new BoxError(BoxError.EXTERNAL_ERROR, 'Bad response code:' + result.statusCode));
            }

            debug('waitForChallenge: status is "%s %j', result.body.status, result.body);

-            if (result.body.status === 'pending') return retryCallback(new Acme2Error(Acme2Error.NOT_COMPLETED));
+            if (result.body.status === 'pending') return retryCallback(new BoxError(BoxError.TRY_AGAIN));
            else if (result.body.status === 'valid') return retryCallback();
-            else return retryCallback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Unexpected status: ' + result.body.status));
+            else return retryCallback(new BoxError(BoxError.EXTERNAL_ERROR, 'Unexpected status: ' + result.body.status));
        });
    }, function retryFinished(error) {
        // async.retry will pass 'undefined' as second arg making it unusable with async.waterfall()
@@ -329,9 +305,9 @@ Acme2.prototype.signCertificate = function (domain, finalizationUrl, csrDer, cal
    debug('signCertificate: sending sign request');

    this.sendSignedRequest(finalizationUrl, JSON.stringify(payload), function (error, result) {
-        if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Network error when signing certificate: ' + error.message));
+        if (error) return callback(new BoxError(BoxError.NETWORK_ERROR, `Network error when signing certificate: ${error.message}`));
        // 429 means we reached the cert limit for this domain
-        if (result.statusCode !== 200) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, util.format('Failed to sign certificate. Expecting 200, got %s %s', result.statusCode, result.text)));
+        if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Failed to sign certificate. Expecting 200, got %s %s', result.statusCode, result.text)));

        return callback(null);
    });
@@ -351,15 +327,15 @@ Acme2.prototype.createKeyAndCsr = function (hostname, callback) {
        debug('createKeyAndCsr: reuse the key for renewal at %s', privateKeyFile);
    } else {
        var key = safe.child_process.execSync('openssl genrsa 4096');
-        if (!key) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, safe.error));
-        if (!safe.fs.writeFileSync(privateKeyFile, key)) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, safe.error));
+        if (!key) return callback(new BoxError(BoxError.OPENSSL_ERROR, safe.error));
+        if (!safe.fs.writeFileSync(privateKeyFile, key)) return callback(new BoxError(BoxError.FS_ERROR, safe.error));

        debug('createKeyAndCsr: key file saved at %s', privateKeyFile);
    }

    var csrDer = safe.child_process.execSync(`openssl req -new -key ${privateKeyFile} -outform DER -subj /CN=${hostname}`);
-    if (!csrDer) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, safe.error));
-    if (!safe.fs.writeFileSync(csrFile, csrDer)) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, safe.error)); // bookkeeping
+    if (!csrDer) return callback(new BoxError(BoxError.OPENSSL_ERROR, safe.error));
+    if (!safe.fs.writeFileSync(csrFile, csrDer)) return callback(new BoxError(BoxError.FS_ERROR, safe.error)); // bookkeeping

    debug('createKeyAndCsr: csr file (DER) saved at %s', csrFile);

@@ -373,25 +349,29 @@ Acme2.prototype.downloadCertificate = function (hostname, certUrl, callback) {

    var outdir = paths.APP_CERTS_DIR;

-    superagent.get(certUrl).buffer().parse(function (res, done) {
-        var data = [ ];
-        res.on('data', function(chunk) { data.push(chunk); });
-        res.on('end', function () { res.text = Buffer.concat(data); done(); });
-    }).timeout(30 * 1000).end(function (error, result) {
-        if (error && !error.response) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'Network error when downloading certificate'));
-        if (result.statusCode === 202) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, 'Retry not implemented yet'));
-        if (result.statusCode !== 200) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, util.format('Failed to get cert. Expecting 200, got %s %s', result.statusCode, result.text)));
+    async.retry({ times: 5, interval: 20000 }, function (retryCallback) {
+        debug('downloadCertificate: downloading certificate');

-        const fullChainPem = result.text;
+        superagent.get(certUrl).buffer().parse(function (res, done) {
+            var data = [ ];
+            res.on('data', function(chunk) { data.push(chunk); });
+            res.on('end', function () { res.text = Buffer.concat(data); done(); });
+        }).timeout(30 * 1000).end(function (error, result) {
+            if (error && !error.response) return retryCallback(new BoxError(BoxError.NETWORK_ERROR, `Network error when downloading certificate: ${error.message}`));
+            if (result.statusCode === 202) return retryCallback(new BoxError(BoxError.TRY_AGAIN, 'Retry'));
+            if (result.statusCode !== 200) return retryCallback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('Failed to get cert. Expecting 200, got %s %s', result.statusCode, result.text)));

-        const certName = hostname.replace('*.', '_.');
-        var certificateFile = path.join(outdir, `${certName}.cert`);
-        if (!safe.fs.writeFileSync(certificateFile, fullChainPem)) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, safe.error));
+            const fullChainPem = result.text;

-        debug('downloadCertificate: cert file for %s saved at %s', hostname, certificateFile);
+            const certName = hostname.replace('*.', '_.');
+            var certificateFile = path.join(outdir, `${certName}.cert`);
+            if (!safe.fs.writeFileSync(certificateFile, fullChainPem)) return retryCallback(new BoxError(BoxError.FS_ERROR, safe.error));

-        callback();
-    });
+            debug('downloadCertificate: cert file for %s saved at %s', hostname, certificateFile);
+
+            retryCallback(null);
+        });
+    }, callback);
 };

 Acme2.prototype.prepareHttpChallenge = function (hostname, domain, authorization, callback) {
@@ -402,7 +382,7 @@ Acme2.prototype.prepareHttpChallenge = function (hostname, domain, authorization

    debug('acmeFlow: challenges: %j', authorization);
    let httpChallenges = authorization.challenges.filter(function(x) { return x.type === 'http-01'; });
-    if (httpChallenges.length === 0) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'no http challenges'));
+    if (httpChallenges.length === 0) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'no http challenges'));
    let challenge = httpChallenges[0];

    debug('prepareHttpChallenge: preparing for challenge %j', challenge);
@@ -412,7 +392,7 @@ Acme2.prototype.prepareHttpChallenge = function (hostname, domain, authorization
    debug('prepareHttpChallenge: writing %s to %s', keyAuthorization, path.join(paths.ACME_CHALLENGES_DIR, challenge.token));

    fs.writeFile(path.join(paths.ACME_CHALLENGES_DIR, challenge.token), keyAuthorization, function (error) {
-        if (error) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.FS_ERROR, error));

        callback(null, challenge);
    });
@@ -454,7 +434,7 @@ Acme2.prototype.prepareDnsChallenge = function (hostname, domain, authorization,

    debug('acmeFlow: challenges: %j', authorization);
    let dnsChallenges = authorization.challenges.filter(function(x) { return x.type === 'dns-01'; });
-    if (dnsChallenges.length === 0) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, 'no dns challenges'));
+    if (dnsChallenges.length === 0) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'no dns challenges'));
    let challenge = dnsChallenges[0];

    const keyAuthorization = this.getKeyAuthorization(challenge.token);
@@ -467,10 +447,10 @@ Acme2.prototype.prepareDnsChallenge = function (hostname, domain, authorization,
    debug(`prepareDnsChallenge: update ${challengeSubdomain} with ${txtValue}`);

    domains.upsertDnsRecords(challengeSubdomain, domain, 'TXT', [ `"${txtValue}"` ], function (error) {
-        if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, error.message));
+        if (error) return callback(error);

        domains.waitForDnsRecord(challengeSubdomain, domain, 'TXT', txtValue, { interval: 5000, times: 200 }, function (error) {
-            if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, error.message));
+            if (error) return callback(error);

            callback(null, challenge);
        });
@@ -493,7 +473,7 @@ Acme2.prototype.cleanupDnsChallenge = function (hostname, domain, challenge, cal
    debug(`cleanupDnsChallenge: remove ${challengeSubdomain} with ${txtValue}`);

    domains.removeDnsRecords(challengeSubdomain, domain, 'TXT', [ `"${txtValue}"` ], function (error) {
-        if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null);
    });
@@ -505,10 +485,12 @@ Acme2.prototype.prepareChallenge = function (hostname, domain, authorizationUrl,
    assert.strictEqual(typeof authorizationUrl, 'string');
    assert.strictEqual(typeof callback, 'function');

+    debug(`prepareChallenge: http: ${this.performHttpAuthorization}`);
+
    const that = this;
    superagent.get(authorizationUrl).timeout(30 * 1000).end(function (error, response) {
-        if (error && !error.response) return callback(error);
-        if (response.statusCode !== 200) return callback(new Error('Invalid response code getting authorization : ' + response.statusCode));
+        if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, `Network error when preparing challenge: ${error.message}`));
+        if (response.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response code getting authorization : ' + response.statusCode));

        const authorization = response.body;

@@ -526,6 +508,8 @@ Acme2.prototype.cleanupChallenge = function (hostname, domain, challenge, callba
    assert.strictEqual(typeof challenge, 'object');
    assert.strictEqual(typeof callback, 'function');

+    debug(`cleanupChallenge: http: ${this.performHttpAuthorization}`);
+
    if (this.performHttpAuthorization) {
        this.cleanupHttpChallenge(hostname, domain, challenge, callback);
    } else {
@@ -541,7 +525,7 @@ Acme2.prototype.acmeFlow = function (hostname, domain, callback) {
    if (!fs.existsSync(paths.ACME_ACCOUNT_KEY_FILE)) {
        debug('getCertificate: generating acme account key on first run');
        this.accountKeyPem = safe.child_process.execSync('openssl genrsa 4096');
-        if (!this.accountKeyPem) return callback(new Acme2Error(Acme2Error.INTERNAL_ERROR, safe.error));
+        if (!this.accountKeyPem) return callback(new BoxError(BoxError.OPENSSL_ERROR, safe.error));

        safe.fs.writeFileSync(paths.ACME_ACCOUNT_KEY_FILE, this.accountKeyPem);
    } else {
@@ -586,8 +570,8 @@ Acme2.prototype.getDirectory = function (callback) {
    const that = this;

    superagent.get(this.caDirectory).timeout(30 * 1000).end(function (error, response) {
-        if (error && !error.response) return callback(error);
-        if (response.statusCode !== 200) return callback(new Error('Invalid response code when fetching directory : ' + response.statusCode));
+        if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, `Network error getting directory: ${error.message}`));
+        if (response.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response code when fetching directory : ' + response.statusCode));

        if (typeof response.body.newNonce !== 'string' ||
            typeof response.body.newOrder !== 'string' ||
@@ -631,6 +615,11 @@ function getCertificate(hostname, domain, options, callback) {
    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof callback, 'function');

-    var acme = new Acme2(options || { });
-    acme.getCertificate(hostname, domain, callback);
+    let attempt = 1;
+    async.retry({ times: 3, interval: 0 }, function (retryCallback) {
+        debug(`getCertificate: attempt ${attempt++}`);
+
+        let acme = new Acme2(options || { });
+        acme.getCertificate(hostname, domain, retryCallback);
+    }, callback);
 }
@@ -0,0 +1,38 @@
+'use strict';
+
+let assert = require('assert'),
+    fs = require('fs'),
+    path = require('path');
+
+exports = module.exports = {
+    getChanges: getChanges
+};
+
+function getChanges(version) {
+    assert.strictEqual(typeof version, 'string');
+
+    let changelog = [ ];
+    const lines = fs.readFileSync(path.join(__dirname, '../CHANGES'), 'utf8').split('\n');
+
+    version = version.replace(/[+-].*/, ''); // strip prerelease
+
+    let i;
+    for (i = 0; i < lines.length; i++) {
+        if (lines[i] === '[' + version + ']') break;
+    }
+
+    for (i = i + 1; i < lines.length; i++) {
+        if (lines[i] === '') continue;
+        if (lines[i][0] === '[') break;
+
+        lines[i] = lines[i].trim();
+
+        // detect and remove list style - and * in changelog lines
+        if (lines[i].indexOf('-') === 0) lines[i] = lines[i].slice(1).trim();
+        if (lines[i].indexOf('*') === 0) lines[i] = lines[i].slice(1).trim();
+
+        changelog.push(lines[i]);
+    }
+
+    return changelog;
+}
@@ -15,14 +15,12 @@ exports = module.exports = {
    delByAppId: delByAppId,
    delByAppIdAndType: delByAppIdAndType,

-    _clear: clear,
-    _addDefaultClients: addDefaultClients
+    _clear: clear
 };

 var assert = require('assert'),
-    async = require('async'),
-    database = require('./database.js'),
-    DatabaseError = require('./databaseerror.js');
+    BoxError = require('./boxerror.js'),
+    database = require('./database.js');

 var CLIENTS_FIELDS = [ 'id', 'appId', 'type', 'clientSecret', 'redirectURI', 'scope' ].join(',');
 var CLIENTS_FIELDS_PREFIXED = [ 'clients.id', 'clients.appId', 'clients.type', 'clients.clientSecret', 'clients.redirectURI', 'clients.scope' ].join(',');
@@ -32,8 +30,8 @@ function get(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + CLIENTS_FIELDS + ' FROM clients WHERE id = ?', [ id ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, `Client not found: ${id}`));

        callback(null, result[0]);
    });
@@ -43,7 +41,7 @@ function getAll(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + CLIENTS_FIELDS + ' FROM clients ORDER BY appId', function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
@@ -53,7 +51,7 @@ function getAllWithTokenCount(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + CLIENTS_FIELDS_PREFIXED + ',COUNT(tokens.clientId) AS tokenCount FROM clients LEFT OUTER JOIN tokens ON clients.id=tokens.clientId GROUP BY clients.id', [], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
@@ -64,7 +62,7 @@ function getAllWithTokenCountByIdentifier(identifier, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + CLIENTS_FIELDS_PREFIXED + ',COUNT(tokens.clientId) AS tokenCount FROM clients LEFT OUTER JOIN tokens ON clients.id=tokens.clientId WHERE tokens.identifier=? GROUP BY clients.id', [ identifier ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
@@ -75,8 +73,8 @@ function getByAppId(appId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + CLIENTS_FIELDS + ' FROM clients WHERE appId = ? LIMIT 1', [ appId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Client not found'));

        callback(null, result[0]);
    });
@@ -88,8 +86,8 @@ function getByAppIdAndType(appId, type, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + CLIENTS_FIELDS + ' FROM clients WHERE appId = ? AND type = ? LIMIT 1', [ appId, type ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Client not found'));

        callback(null, result[0]);
    });
@@ -107,8 +105,8 @@ function add(id, appId, type, clientSecret, redirectURI, scope, callback) {
    var data = [ id, appId, type, clientSecret, redirectURI, scope ];

    database.query('INSERT INTO clients (id, appId, type, clientSecret, redirectURI, scope) VALUES (?, ?, ?, ?, ?, ?)', data, function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS));
-        if (error || result.affectedRows === 0) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS));
+        if (error || result.affectedRows === 0) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -126,8 +124,8 @@ function upsert(id, appId, type, clientSecret, redirectURI, scope, callback) {
    var data = [ id, appId, type, clientSecret, redirectURI, scope ];

    database.query('REPLACE INTO clients (id, appId, type, clientSecret, redirectURI, scope) VALUES (?, ?, ?, ?, ?, ?)', data, function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS));
-        if (error || result.affectedRows === 0) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS));
+        if (error || result.affectedRows === 0) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -138,8 +136,8 @@ function del(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM clients WHERE id = ?', [ id ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, `Client not found: ${id}`));

        callback(null);
    });
@@ -150,8 +148,8 @@ function delByAppId(appId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM clients WHERE appId=?', [ appId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'Client not found'));

        callback(null);
    });
@@ -163,8 +161,8 @@ function delByAppIdAndType(appId, type, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM clients WHERE appId=? AND type=?', [ appId, type ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'Client not found'));

        callback(null);
    });
@@ -173,17 +171,9 @@ function delByAppIdAndType(appId, type, callback) {
 function clear(callback) {
    assert.strictEqual(typeof callback, 'function');

-    database.query('DELETE FROM clients WHERE id!="cid-webadmin" AND id!="cid-sdk" AND id!="cid-cli"', function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+    database.query('DELETE FROM clients', function (error) {
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
 }
-
-function addDefaultClients(callback) {
-    async.series([
-        add.bind(null, 'cid-webadmin', 'Settings', 'built-in', 'secret-webadmin', 'https://admin-localhost', '*'),
-        add.bind(null, 'cid-sdk', 'SDK', 'built-in', 'secret-sdk', 'https://admin-localhost', '*'),
-        add.bind(null, 'cid-cli', 'Cloudron Tool', 'built-in', 'secret-cli', 'https://admin-localhost', '*')
-    ], callback);
-}
@@ -1,8 +1,6 @@
 'use strict';

 exports = module.exports = {
-    ClientsError: ClientsError,
-
    add: add,
    get: get,
    del: del,
@@ -20,6 +18,11 @@ exports = module.exports = {

    removeTokenPrivateFields: removeTokenPrivateFields,

+    // client ids. we categorize them so we can have different restrictions based on the client
+    ID_WEBADMIN: 'cid-webadmin',    // dashboard oauth
+    ID_SDK: 'cid-sdk',              // created by user via dashboard
+    ID_CLI: 'cid-cli',              // created via cli tool
+
    // client type enums
    TYPE_EXTERNAL: 'external',
    TYPE_BUILT_IN: 'built-in',
@@ -30,54 +33,25 @@ exports = module.exports = {
 var apps = require('./apps.js'),
    assert = require('assert'),
    async = require('async'),
+    BoxError = require('./boxerror.js'),
    clientdb = require('./clientdb.js'),
    constants = require('./constants.js'),
-    DatabaseError = require('./databaseerror.js'),
    debug = require('debug')('box:clients'),
    eventlog = require('./eventlog.js'),
    hat = require('./hat.js'),
    accesscontrol = require('./accesscontrol.js'),
    tokendb = require('./tokendb.js'),
    users = require('./users.js'),
-    UsersError = users.UsersError,
-    util = require('util'),
    uuid = require('uuid'),
    _ = require('underscore');

-function ClientsError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(ClientsError, Error);
-ClientsError.INVALID_SCOPE = 'Invalid scope';
-ClientsError.INVALID_CLIENT = 'Invalid client';
-ClientsError.INVALID_TOKEN = 'Invalid token';
-ClientsError.BAD_FIELD = 'Bad field';
-ClientsError.NOT_FOUND = 'Not found';
-ClientsError.INTERNAL_ERROR = 'Internal Error';
-ClientsError.NOT_ALLOWED = 'Not allowed to remove this client';
-
 function validateClientName(name) {
    assert.strictEqual(typeof name, 'string');

-    if (name.length < 1) return new ClientsError(ClientsError.BAD_FIELD, 'Name must be atleast 1 character');
-    if (name.length > 128) return new ClientsError(ClientsError.BAD_FIELD, 'Name too long');
+    if (name.length < 1) return new BoxError(BoxError.BAD_FIELD, 'name must be atleast 1 character', { field: 'name' });
+    if (name.length > 128) return new BoxError(BoxError.BAD_FIELD, 'name too long', { field: 'name' });

-    if (/[^a-zA-Z0-9-]/.test(name)) return new ClientsError(ClientsError.BAD_FIELD, 'Username can only contain alphanumerals and dash');
+    if (/[^a-zA-Z0-9-]/.test(name)) return new BoxError(BoxError.BAD_FIELD, 'name can only contain alphanumerals and dash', { field: 'name' });

    return null;
 }
@@ -85,7 +59,7 @@ function validateClientName(name) {
 function validateTokenName(name) {
    assert.strictEqual(typeof name, 'string');

-    if (name.length > 64) return new ClientsError(ClientsError.BAD_FIELD, 'Name too long');
+    if (name.length > 64) return new BoxError(BoxError.BAD_FIELD, 'name too long', { field: 'name' });

    return null;
 }
@@ -98,7 +72,7 @@ function add(appId, type, redirectURI, scope, callback) {
    assert.strictEqual(typeof callback, 'function');

    var error = accesscontrol.validateScopeString(scope);
-    if (error) return callback(new ClientsError(ClientsError.INVALID_SCOPE, error.message));
+    if (error) return callback(error);

    error = validateClientName(appId);
    if (error) return callback(error);
@@ -127,8 +101,8 @@ function get(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    clientdb.get(id, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new ClientsError(ClientsError.NOT_FOUND, 'No such client'));
        if (error) return callback(error);
+
        callback(null, result);
    });
 }
@@ -138,8 +112,8 @@ function del(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    clientdb.del(id, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new ClientsError(ClientsError.NOT_FOUND, 'No such client'));
        if (error) return callback(error);
+
        callback(null, result);
    });
 }
@@ -148,7 +122,7 @@ function getAll(callback) {
    assert.strictEqual(typeof callback, 'function');

    clientdb.getAll(function (error, results) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, []);
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(null, []);
        if (error) return callback(error);

        var tmp = [];
@@ -190,8 +164,8 @@ function getByAppIdAndType(appId, type, callback) {
    assert.strictEqual(typeof callback, 'function');

    clientdb.getByAppIdAndType(appId, type, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new ClientsError(ClientsError.NOT_FOUND, 'No such client'));
        if (error) return callback(error);
+
        callback(null, result);
    });
 }
@@ -202,7 +176,7 @@ function getTokensByUserId(clientId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    tokendb.getByIdentifierAndClientId(userId, clientId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) {
+        if (error && error.reason === BoxError.NOT_FOUND) {
            // this can mean either that there are no tokens or the clientId is actually unknown
            get(clientId, function (error/*, result*/) {
                if (error) return callback(error);
@@ -221,7 +195,7 @@ function delTokensByUserId(clientId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    tokendb.delByIdentifierAndClientId(userId, clientId, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) {
+        if (error && error.reason === BoxError.NOT_FOUND) {
            // this can mean either that there are no tokens or the clientId is actually unknown
            get(clientId, function (error/*, result*/) {
                if (error) return callback(error);
@@ -243,10 +217,9 @@ function delByAppIdAndType(appId, type, callback) {
        if (error) return callback(error);

        tokendb.delByClientId(result.id, function (error) {
-            if (error && error.reason !== DatabaseError.NOT_FOUND) return callback(new ClientsError(ClientsError.INTERNAL_ERROR, error));
+            if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

            clientdb.delByAppIdAndType(appId, type, function (error) {
-                if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new ClientsError(ClientsError.NOT_FOUND, 'No such client'));
                if (error) return callback(error);

                callback(null);
@@ -270,11 +243,10 @@ function addTokenByUserId(clientId, userId, expiresAt, options, callback) {
        if (error) return callback(error);

        users.get(userId, function (error, user) {
-            if (error && error.reason === UsersError.NOT_FOUND) return callback(new ClientsError(ClientsError.NOT_FOUND, 'No such user'));
-            if (error) return callback(new ClientsError(ClientsError.INTERNAL_ERROR, error));
+            if (error) return callback(error);

            accesscontrol.scopesForUser(user, function (error, userScopes) {
-                if (error) return callback(new ClientsError(ClientsError.INTERNAL_ERROR, error));
+                if (error) return callback(error);

                const scope = accesscontrol.canonicalScopeString(result.scope);
                const authorizedScopes = accesscontrol.intersectScopes(userScopes, scope.split(','));
@@ -290,7 +262,7 @@ function addTokenByUserId(clientId, userId, expiresAt, options, callback) {
                };

                tokendb.add(token, function (error) {
-                    if (error) return callback(new ClientsError(ClientsError.INTERNAL_ERROR, error));
+                    if (error) return callback(error);

                    callback(null, {
                        accessToken: token.accessToken,
@@ -305,7 +277,6 @@ function addTokenByUserId(clientId, userId, expiresAt, options, callback) {
    });
 }

-// this issues a cid-cli token that does not require a password in various routes
 function issueDeveloperToken(userObject, auditSource, callback) {
    assert.strictEqual(typeof userObject, 'object');
    assert.strictEqual(typeof auditSource, 'object');
@@ -313,7 +284,7 @@ function issueDeveloperToken(userObject, auditSource, callback) {

    const expiresAt = Date.now() + constants.DEFAULT_TOKEN_EXPIRATION;

-    addTokenByUserId('cid-cli', userObject.id, expiresAt, {}, function (error, result) {
+    addTokenByUserId(exports.ID_CLI, userObject.id, expiresAt, {}, function (error, result) {
        if (error) return callback(error);

        eventlog.add(eventlog.ACTION_USER_LOGIN, auditSource, { userId: userObject.id, user: users.removePrivateFields(userObject) });
@@ -331,8 +302,7 @@ function delToken(clientId, tokenId, callback) {
        if (error) return callback(error);

        tokendb.del(tokenId, function (error) {
-            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new ClientsError(ClientsError.INVALID_TOKEN, 'Invalid token'));
-            if (error) return callback(new ClientsError(ClientsError.INTERNAL_ERROR, error));
+            if (error) return callback(error);

            callback(null);
        });
@@ -348,9 +318,9 @@ function addDefaultClients(origin, callback) {
    // The domain might have changed, therefor we have to update the record
    // id, appId, type, clientSecret, redirectURI, scope
    async.series([
-        clientdb.upsert.bind(null, 'cid-webadmin', 'Settings', 'built-in', 'secret-webadmin', origin, '*'),
-        clientdb.upsert.bind(null, 'cid-sdk', 'SDK', 'built-in', 'secret-sdk', origin, '*'),
-        clientdb.upsert.bind(null, 'cid-cli', 'Cloudron Tool', 'built-in', 'secret-cli', origin, '*')
+        clientdb.upsert.bind(null, exports.ID_WEBADMIN, 'Settings', 'built-in', 'secret-webadmin', origin, '*'),
+        clientdb.upsert.bind(null, exports.ID_SDK, 'SDK', 'built-in', 'secret-sdk', origin, '*'),
+        clientdb.upsert.bind(null, exports.ID_CLI, 'Cloudron Tool', 'built-in', 'secret-cli', origin, '*')
    ], callback);
 }

@@ -1,12 +1,9 @@
 'use strict';

 exports = module.exports = {
-    CloudronError: CloudronError,
-
    initialize: initialize,
    uninitialize: uninitialize,
    getConfig: getConfig,
-    getDisks: getDisks,
    getLogs: getLogs,

    reboot: reboot,
@@ -19,24 +16,24 @@ exports = module.exports = {
    setDashboardAndMailDomain: setDashboardAndMailDomain,
    renewCerts: renewCerts,

-    runSystemChecks: runSystemChecks,
+    setupDashboard: setupDashboard,

-    // exposed for testing
-    _checkDiskSpace: checkDiskSpace
+    runSystemChecks: runSystemChecks,
 };

-var assert = require('assert'),
+var apps = require('./apps.js'),
+    assert = require('assert'),
    async = require('async'),
+    auditSource = require('./auditsource.js'),
    backups = require('./backups.js'),
+    BoxError = require('./boxerror.js'),
    clients = require('./clients.js'),
-    config = require('./config.js'),
    constants = require('./constants.js'),
    cron = require('./cron.js'),
    debug = require('debug')('box:cloudron'),
    domains = require('./domains.js'),
-    DomainsError = require('./domains.js').DomainsError,
-    df = require('@sindresorhus/df'),
    eventlog = require('./eventlog.js'),
+    custom = require('./custom.js'),
    fs = require('fs'),
    mail = require('./mail.js'),
    notifications = require('./notifications.js'),
@@ -45,49 +42,24 @@ var assert = require('assert'),
    paths = require('./paths.js'),
    platform = require('./platform.js'),
    reverseProxy = require('./reverseproxy.js'),
+    safe = require('safetydance'),
    settings = require('./settings.js'),
    shell = require('./shell.js'),
    spawn = require('child_process').spawn,
    split = require('split'),
    tasks = require('./tasks.js'),
-    users = require('./users.js'),
-    util = require('util');
+    users = require('./users.js');

 var REBOOT_CMD = path.join(__dirname, 'scripts/reboot.sh');

-var NOOP_CALLBACK = function (error) { if (error) debug(error); };
-
-function CloudronError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(CloudronError, Error);
-CloudronError.BAD_FIELD = 'Field error';
-CloudronError.INTERNAL_ERROR = 'Internal Error';
-CloudronError.EXTERNAL_ERROR = 'External Error';
-CloudronError.BAD_STATE = 'Bad state';
-CloudronError.ALREADY_UPTODATE = 'No Update Available';
+const NOOP_CALLBACK = function (error) { if (error) debug(error); };

 function initialize(callback) {
    assert.strictEqual(typeof callback, 'function');

-    cron.startPreActivationJobs(callback);
-
    runStartupTasks();
+
+    notifyUpdate(callback);
 }

 function uninitialize(callback) {
@@ -107,17 +79,36 @@ function onActivated(callback) {
    // 2. the restore code path can run without sudo (since mail/ is non-root)
    async.series([
        platform.start,
-        cron.startPostActivationJobs
+        cron.startJobs
    ], callback);
 }

+function notifyUpdate(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    const version = safe.fs.readFileSync(paths.VERSION_FILE, 'utf8');
+    if (version === constants.VERSION) return callback();
+
+    eventlog.add(eventlog.ACTION_UPDATE_FINISH, auditSource.CRON, { errorMessage: '', oldVersion: version || 'dev', newVersion: constants.VERSION }, function (error) {
+        if (error) return callback(error);
+
+        tasks.setCompletedByType(tasks.TASK_UPDATE, { error: null }, function (error) {
+            if (error && error.reason !== BoxError.NOT_FOUND) return callback(error); // when hotfixing, task may not exist
+
+            safe.fs.writeFileSync(paths.VERSION_FILE, constants.VERSION, 'utf8');
+
+            callback();
+        });
+    });
+}
+
 // each of these tasks can fail. we will add some routes to fix/re-run them
 function runStartupTasks() {
    // configure nginx to be reachable by IP
-    reverseProxy.configureDefaultServer(NOOP_CALLBACK);
+    reverseProxy.writeDefaultConfig(NOOP_CALLBACK);

    // always generate webadmin config since we have no versioning mechanism for the ejs
-    if (config.adminDomain()) reverseProxy.writeAdminConfig(config.adminDomain(), NOOP_CALLBACK);
+    if (settings.adminDomain()) reverseProxy.writeAdminConfig(settings.adminDomain(), NOOP_CALLBACK);

    // check activation state and start the platform
    users.isActivated(function (error, activated) {
@@ -128,51 +119,25 @@ function runStartupTasks() {
    });
 }

-function getDisks(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    var disks = {
-        boxDataDisk: null,
-        platformDataDisk: null,
-        appsDataDisk: null
-    };
-
-    df.file(paths.BOX_DATA_DIR).then(function (result) {
-        disks.boxDataDisk = result.filesystem;
-
-        return df.file(paths.PLATFORM_DATA_DIR);
-    }).then(function (result) {
-        disks.platformDataDisk = result.filesystem;
-
-        return df.file(paths.APPS_DATA_DIR);
-    }).then(function (result) {
-        disks.appsDataDisk = result.filesystem;
-
-        callback(null, disks);
-    }).catch(function (error) {
-        callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
-    });
-}
-
 function getConfig(callback) {
    assert.strictEqual(typeof callback, 'function');

    settings.getAll(function (error, allSettings) {
-        if (error) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        // be picky about what we send out here since this is sent for 'normal' users as well
        callback(null, {
-            apiServerOrigin: config.apiServerOrigin(),
-            webServerOrigin: config.webServerOrigin(),
-            adminDomain: config.adminDomain(),
-            adminFqdn: config.adminFqdn(),
-            mailFqdn: config.mailFqdn(),
-            version: config.version(),
-            isDemo: config.isDemo(),
-            edition: config.edition(),
+            apiServerOrigin: settings.apiServerOrigin(),
+            webServerOrigin: settings.webServerOrigin(),
+            adminDomain: settings.adminDomain(),
+            adminFqdn: settings.adminFqdn(),
+            mailFqdn: settings.mailFqdn(),
+            version: constants.VERSION,
+            isDemo: settings.isDemo(),
            memory: os.totalmem(),
-            provider: config.provider(),
-            cloudronName: allSettings[settings.CLOUDRON_NAME_KEY]
+            provider: settings.provider(),
+            cloudronName: allSettings[settings.CLOUDRON_NAME_KEY],
+            uiSpec: custom.uiSpec()
        });
    });
 }
@@ -192,7 +157,6 @@ function isRebootRequired(callback) {
 function runSystemChecks() {
    async.parallel([
        checkBackupConfiguration,
-        checkDiskSpace,
        checkMailStatus,
        checkRebootRequired
    ], function (error) {
@@ -208,46 +172,7 @@ function checkBackupConfiguration(callback) {
    backups.checkConfiguration(function (error, message) {
        if (error) return callback(error);

-        notifications.alert(notifications.ALERT_BACKUP_CONFIG, message, callback);
-    });
-}
-
-function checkDiskSpace(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    debug('Checking disk space');
-
-    getDisks(function (error, disks) {
-        if (error) {
-            debug('df error %s', error.message);
-            return callback();
-        }
-
-        df().then(function (entries) {
-            /*
-                [{
-                filesystem: '/dev/disk1',
-                size: 499046809600,
-                used: 443222245376,
-                available: 55562420224,
-                capacity: 0.89,
-                mountpoint: '/'
-            }, ...]
-            */
-            var oos = entries.some(function (entry) {
-                // ignore other filesystems but where box, app and platform data is
-                if (entry.filesystem !== disks.boxDataDisk && entry.filesystem !== disks.platformDataDisk && entry.filesystem !== disks.appsDataDisk) return false;
-
-                return (entry.available <= (1.25 * 1024 * 1024 * 1024)); // 1.5G
-            });
-
-            debug('Disk space checked. ok: %s', !oos);
-
-            notifications.alert(notifications.ALERT_DISK_SPACE, oos ? JSON.stringify(entries, null, 4) : '', callback);
-        }).catch(function (error) {
-            if (error) console.error(error);
-            callback();
-        });
+        notifications.alert(notifications.ALERT_BACKUP_CONFIG, 'Backup configuration is unsafe', message, callback);
    });
 }

@@ -259,7 +184,7 @@ function checkMailStatus(callback) {
    mail.checkConfiguration(function (error, message) {
        if (error) return callback(error);

-        notifications.alert(notifications.ALERT_MAIL_STATUS, message, callback);
+        notifications.alert(notifications.ALERT_MAIL_STATUS, 'Email is not configured properly', message, callback);
    });
 }

@@ -271,7 +196,7 @@ function checkRebootRequired(callback) {
    isRebootRequired(function (error, rebootRequired) {
        if (error) return callback(error);

-        notifications.alert(notifications.ALERT_REBOOT, rebootRequired ? 'To finish security updates, a [reboot](/#/system) is necessary.' : '', callback);
+        notifications.alert(notifications.ALERT_REBOOT, 'Reboot Required', rebootRequired ? 'To finish security updates, a [reboot](/#/system) is necessary.' : '', callback);
    });
 }

@@ -296,7 +221,7 @@ function getLogs(unit, options, callback) {
    // need to handle box.log without subdir
    if (unit === 'box') args.push(path.join(paths.LOG_DIR, 'box.log'));
    else if (unit.startsWith('crash-')) args.push(path.join(paths.CRASH_LOG_DIR, unit.slice(6) + '.log'));
-    else return callback(new CloudronError(CloudronError.BAD_FIELD, 'No such unit'));
+    else return callback(new BoxError(BoxError.BAD_FIELD, 'No such unit', { field: 'unit' }));

    var cp = spawn('/usr/bin/tail', args);

@@ -328,9 +253,26 @@ function prepareDashboardDomain(domain, auditSource, callback) {

    debug(`prepareDashboardDomain: ${domain}`);

-    let task = tasks.startTask(tasks.TASK_PREPARE_DASHBOARD_DOMAIN, [ domain, auditSource ]);
-    task.on('error', (error) => callback(new CloudronError(CloudronError.INTERNAL_ERROR, error)));
-    task.on('start', (taskId) => callback(null, taskId));
+    domains.get(domain, function (error, domainObject) {
+        if (error) return callback(error);
+
+        const fqdn = domains.fqdn(constants.ADMIN_LOCATION, domainObject);
+
+        apps.getAll(function (error, result) {
+            if (error) return callback(error);
+
+            const conflict = result.filter(app => app.fqdn === fqdn);
+            if (conflict.length) return callback(new BoxError(BoxError.BAD_STATE, 'Dashboard location conflicts with an existing app'));
+
+            tasks.add(tasks.TASK_PREPARE_DASHBOARD_DOMAIN, [ domain, auditSource ], function (error, taskId) {
+                if (error) return callback(error);
+
+                tasks.startTask(taskId, {}, NOOP_CALLBACK);
+
+                callback(null, taskId);
+            });
+        });
+    });
 }

 // call this only pre activation since it won't start mail server
@@ -342,20 +284,18 @@ function setDashboardDomain(domain, auditSource, callback) {
    debug(`setDashboardDomain: ${domain}`);

    domains.get(domain, function (error, domainObject) {
-        if (error && error.reason === DomainsError.NOT_FOUND) return callback(new CloudronError(CloudronError.BAD_FIELD, 'No such domain'));
-        if (error) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        reverseProxy.writeAdminConfig(domain, function (error) {
-            if (error) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
+            if (error) return callback(error);

            const fqdn = domains.fqdn(constants.ADMIN_LOCATION, domainObject);

-            config.setAdminDomain(domain);
-            config.setAdminLocation(constants.ADMIN_LOCATION);
-            config.setAdminFqdn(fqdn);
-
-            clients.addDefaultClients(config.adminOrigin(), function (error) {
-                if (error) return callback(new CloudronError(CloudronError.INTERNAL_ERROR, error));
+            async.series([
+                (done) => settings.setAdmin(domain, fqdn, done),
+                (done) => clients.addDefaultClients(settings.adminOrigin(), done)
+            ], function (error) {
+                if (error) return callback(error);

                eventlog.add(eventlog.ACTION_DASHBOARD_DOMAIN_UPDATE, auditSource, { domain: domain, fqdn: fqdn });

@@ -382,12 +322,27 @@ function setDashboardAndMailDomain(domain, auditSource, callback) {
    });
 }

+function setupDashboard(auditSource, progressCallback, callback) {
+    assert.strictEqual(typeof auditSource, 'object');
+    assert.strictEqual(typeof progressCallback, 'function');
+    assert.strictEqual(typeof callback, 'function');
+
+    async.series([
+        domains.prepareDashboardDomain.bind(null, settings.adminDomain(), auditSource, progressCallback),
+        setDashboardDomain.bind(null, settings.adminDomain(), auditSource)
+    ], callback);
+}
+
 function renewCerts(options, auditSource, callback) {
    assert.strictEqual(typeof options, 'object');
    assert.strictEqual(typeof auditSource, 'object');
    assert.strictEqual(typeof callback, 'function');

-    let task = tasks.startTask(tasks.TASK_RENEW_CERTS, [ options, auditSource ]);
-    task.on('error', (error) => callback(new CloudronError(CloudronError.INTERNAL_ERROR, error)));
-    task.on('start', (taskId) => callback(null, taskId));
+    tasks.add(tasks.TASK_RENEW_CERTS, [ options, auditSource ], function (error, taskId) {
+        if (error) return callback(error);
+
+        tasks.startTask(taskId, {}, NOOP_CALLBACK);
+
+        callback(null, taskId);
+    });
 }
@@ -30,3 +30,13 @@ LoadPlugin "table"
    </Result>
  </Table>
 </Plugin>
+
+<Plugin python>
+  <Module du>
+    <Path>
+        Instance "<%= appId %>"
+        Dir "<%= appDataDir %>"
+    </Path>
+  </Module>
+</Plugin>
+
@@ -1,248 +0,0 @@
-'use strict';
-
-exports = module.exports = {
-    baseDir: baseDir,
-
-    // values set here will be lost after a upgrade/update. use the sqlite database
-    // for persistent values that need to be backed up
-    get: get,
-    set: set,
-
-    // ifdefs to check environment
-    CLOUDRON: process.env.BOX_ENV === 'cloudron',
-    TEST: process.env.BOX_ENV === 'test',
-
-    // convenience getters
-    provider: provider,
-    apiServerOrigin: apiServerOrigin,
-    webServerOrigin: webServerOrigin,
-    adminDomain: adminDomain,
-    setFqdn: setAdminDomain,
-    setAdminDomain: setAdminDomain,
-    setAdminFqdn: setAdminFqdn,
-    setAdminLocation: setAdminLocation,
-    version: version,
-    database: database,
-    edition: edition,
-
-    // these values are derived
-    adminOrigin: adminOrigin,
-    internalAdminOrigin: internalAdminOrigin,
-    sysadminOrigin: sysadminOrigin, // caas routes
-    adminLocation: adminLocation,
-    adminFqdn: adminFqdn,
-    mailLocation: mailLocation,
-    mailFqdn: mailFqdn,
-    hasIPv6: hasIPv6,
-    dkimSelector: dkimSelector,
-
-    isManaged: isManaged,
-    isDemo: isDemo,
-
-    // feature flags based on editions (these have a separate license from standard edition)
-    isSpacesEnabled: isSpacesEnabled,
-
-    // for testing resets to defaults
-    _reset: _reset
-};
-
-var assert = require('assert'),
-    fs = require('fs'),
-    path = require('path'),
-    safe = require('safetydance'),
-    _ = require('underscore');
-
-
-// assert on unknown environment can't proceed
-assert(exports.CLOUDRON || exports.TEST, 'Unknown environment. This should not happen!');
-
-var data = { };
-
-function baseDir() {
-    const homeDir = process.env.HOME || process.env.HOMEPATH || process.env.USERPROFILE;
-    if (exports.CLOUDRON) return homeDir;
-    if (exports.TEST) return path.join(homeDir, '.cloudron_test');
-    // cannot reach
-}
-
-const cloudronConfigFileName = exports.CLOUDRON ? '/etc/cloudron/cloudron.conf' : path.join(baseDir(), 'cloudron.conf');
-
-function saveSync() {
-    // only save values we want to have in the cloudron.conf, see start.sh
-    var conf = {
-        apiServerOrigin: data.apiServerOrigin,
-        webServerOrigin: data.webServerOrigin,
-        adminDomain: data.adminDomain,
-        adminFqdn: data.adminFqdn,
-        adminLocation: data.adminLocation,
-        provider: data.provider,
-        isDemo: data.isDemo,
-        edition: data.edition
-    };
-
-    fs.writeFileSync(cloudronConfigFileName, JSON.stringify(conf, null, 4)); // functions are ignored by JSON.stringify
-}
-
-function _reset(callback) {
-    safe.fs.unlinkSync(cloudronConfigFileName);
-
-    initConfig();
-
-    if (callback) callback();
-}
-
-function initConfig() {
-    // setup defaults
-    data.adminFqdn = '';
-    data.adminDomain = '';
-    data.adminLocation = 'my';
-    data.port = 3000;
-    data.apiServerOrigin = null;
-    data.webServerOrigin = null;
-    data.provider = 'generic';
-    data.smtpPort = 2525; // this value comes from mail container
-    data.sysadminPort = 3001;
-    data.ldapPort = 3002;
-    data.dockerProxyPort = 3003;
-    data.edition = '';
-
-    // keep in sync with start.sh
-    data.database = {
-        hostname: '127.0.0.1',
-        username: 'root',
-        password: 'password',
-        port: 3306,
-        name: 'box'
-    };
-
-    // overrides for local testings
-    if (exports.TEST) {
-        data.port = 5454;
-        data.apiServerOrigin = 'http://localhost:6060'; // hock doesn't support https
-
-        // see setupTest script how the mysql-server is run
-        data.database.hostname = require('child_process').execSync('docker inspect -f "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}" mysql-server').toString().trim();
-    }
-
-    // overwrite defaults with saved config
-    var existingData = safe.JSON.parse(safe.fs.readFileSync(cloudronConfigFileName, 'utf8'));
-    _.extend(data, existingData);
-}
-
-initConfig();
-
-// set(obj) or set(key, value)
-function set(key, value) {
-    if (typeof key === 'object') {
-        var obj = key;
-        for (var k in obj) {
-            assert(k in data, 'config.js is missing key "' + k + '"');
-            data[k] = obj[k];
-        }
-    } else {
-        data = safe.set(data, key, value);
-    }
-
-    saveSync();
-}
-
-function get(key) {
-    assert.strictEqual(typeof key, 'string');
-
-    return safe.query(data, key);
-}
-
-function apiServerOrigin() {
-    return get('apiServerOrigin');
-}
-
-function webServerOrigin() {
-    return get('webServerOrigin');
-}
-
-function setAdminDomain(domain) {
-    set('adminDomain', domain);
-}
-
-function adminDomain() {
-    return get('adminDomain');
-}
-
-function mailLocation() {
-    return get('adminLocation'); // not a typo! should be same as admin location until we figure out certificates
-}
-
-function setAdminLocation(location) {
-    set('adminLocation', location);
-}
-
-
-function adminLocation() {
-    return get('adminLocation');
-}
-
-function setAdminFqdn(adminFqdn) {
-    set('adminFqdn', adminFqdn);
-}
-
-function adminFqdn() {
-    return get('adminFqdn');
-}
-
-function mailFqdn() {
-    return adminFqdn();
-}
-
-function adminOrigin() {
-    return 'https://' + adminFqdn();
-}
-
-function internalAdminOrigin() {
-    return 'http://127.0.0.1:' + get('port');
-}
-
-function sysadminOrigin() {
-    return 'http://127.0.0.1:' + get('sysadminPort');
-}
-
-function version() {
-    if (exports.TEST) return '3.0.0-test';
-    return fs.readFileSync(path.join(__dirname, '../VERSION'), 'utf8').trim();
-}
-
-function database() {
-    return get('database');
-}
-
-function isDemo() {
-    return get('isDemo') === true;
-}
-
-function isSpacesEnabled() {
-    return get('edition') === 'education';
-}
-
-function provider() {
-    return get('provider');
-}
-
-function isManaged() {
-    return edition() === 'hostingprovider';
-}
-
-function hasIPv6() {
-    const IPV6_PROC_FILE = '/proc/net/if_inet6';
-    // on contabo, /proc/net/if_inet6 is an empty file. so just exists is not enough
-    return fs.existsSync(IPV6_PROC_FILE) && fs.readFileSync(IPV6_PROC_FILE, 'utf8').trim().length !== 0;
-}
-
-// it has to change with the adminLocation so that multiple cloudrons
-// can send out emails at the same time.
-function dkimSelector() {
-    var loc = adminLocation();
-    return loc === 'my' ? 'cloudron' : `cloudron-${loc.replace(/\./g, '')}`;
-}
-
-function edition() {
-    return get('edition');
-}
@@ -1,7 +1,12 @@
 'use strict';

+let fs = require('fs'),
+    path = require('path');
+
+const CLOUDRON = process.env.BOX_ENV === 'cloudron',
+    TEST = process.env.BOX_ENV === 'test';
+
 exports = module.exports = {
-    API_LOCATION: 'api', // this is unused but reserved for future use (#403)
    SMTP_LOCATION: 'smtp',
    IMAP_LOCATION: 'imap',

@@ -19,6 +24,12 @@ exports = module.exports = {

    ADMIN_LOCATION: 'my',

+    PORT: CLOUDRON ? 3000 : 5454,
+    INTERNAL_SMTP_PORT: 2525, // this value comes from the mail container
+    SYSADMIN_PORT: 3001, // unused
+    LDAP_PORT: 3002,
+    DOCKER_PROXY_PORT: 3003,
+
    NGINX_DEFAULT_CONFIG_FILE_NAME: 'default.conf',

    GHOST_USER_FILE: '/tmp/cloudron_ghost.json',
@@ -31,6 +42,11 @@ exports = module.exports = {

    AUTOUPDATE_PATTERN_NEVER: 'never',

-    SECRET_PLACEHOLDER: String.fromCharCode(0x25CF).repeat(8)
+    SECRET_PLACEHOLDER: String.fromCharCode(0x25CF).repeat(8),
+
+    CLOUDRON: CLOUDRON,
+    TEST: TEST,
+
+    VERSION: process.env.BOX_ENV === 'cloudron' ? fs.readFileSync(path.join(__dirname, '../VERSION'), 'utf8').trim() : '4.2.0-test'
 };

@@ -5,6 +5,7 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    auditSource = require('./auditsource.js'),
    eventlog = require('./eventlog.js'),
    safe = require('safetydance'),
    path = require('path'),
@@ -16,8 +17,6 @@ const COLLECT_LOGS_CMD = path.join(__dirname, 'scripts/collectlogs.sh');
 const CRASH_LOG_TIMESTAMP_OFFSET = 1000 * 60 * 60; // 60 min
 const CRASH_LOG_TIMESTAMP_FILE = '/tmp/crashlog.timestamp';

-const AUDIT_SOURCE = { userId: null, username: 'healthmonitor' };
-
 function collectLogs(unitName, callback) {
    assert.strictEqual(typeof unitName, 'string');
    assert.strictEqual(typeof callback, 'function');
@@ -50,7 +49,7 @@ function sendFailureLogs(unitName, callback) {

        if (!safe.fs.writeFileSync(path.join(paths.CRASH_LOG_DIR, `${crashId}.log`), logs)) console.log(`Failed to stash logs to ${crashId}.log:`, safe.error);

-        eventlog.add(eventlog.ACTION_PROCESS_CRASH, AUDIT_SOURCE, { processName: unitName, crashId: crashId }, function (error) {
+        eventlog.add(eventlog.ACTION_PROCESS_CRASH, auditSource.HEALTH_MONITOR, { processName: unitName, crashId: crashId }, function (error) {
            if (error) console.log(`Error sending crashlog. Logs stashed at ${crashId}.log`);

            safe.fs.writeFileSync(CRASH_LOG_TIMESTAMP_FILE, String(Date.now()));
@@ -1,8 +1,7 @@
 'use strict';

 exports = module.exports = {
-    startPostActivationJobs: startPostActivationJobs,
-    startPreActivationJobs: startPreActivationJobs,
+    startJobs: startJobs,

    stopJobs: stopJobs,

@@ -13,14 +12,13 @@ var appHealthMonitor = require('./apphealthmonitor.js'),
    apps = require('./apps.js'),
    appstore = require('./appstore.js'),
    assert = require('assert'),
+    auditSource = require('./auditsource.js'),
    backups = require('./backups.js'),
-    caas = require('./caas.js'),
    cloudron = require('./cloudron.js'),
-    config = require('./config.js'),
    constants = require('./constants.js'),
    CronJob = require('cron').CronJob,
    debug = require('debug')('box:cron'),
-    digest = require('./digest.js'),
+    disks = require('./disks.js'),
    dyndns = require('./dyndns.js'),
    eventlog = require('./eventlog.js'),
    janitor = require('./janitor.js'),
@@ -36,13 +34,12 @@ var gJobs = {
    appUpdateChecker: null,
    backup: null,
    boxUpdateChecker: null,
-    caasHeartbeat: null,
    systemChecks: null,
+    diskSpaceChecker: null,
    certificateRenew: null,
    cleanupBackups: null,
    cleanupEventlog: null,
    cleanupTokens: null,
-    digestEmail: null,
    dockerVolumeCleaner: null,
    dynamicDns: null,
    schedulerSync: null,
@@ -50,7 +47,6 @@ var gJobs = {
 };

 var NOOP_CALLBACK = function (error) { if (error) debug(error); };
-var AUDIT_SOURCE = { userId: null, username: 'cron' };

 // cron format
 // Seconds: 0-59
@@ -60,24 +56,7 @@ var AUDIT_SOURCE = { userId: null, username: 'cron' };
 // Months: 0-11
 // Day of Week: 0-6

-function startPreActivationJobs(callback) {
-    if (config.provider() === 'caas') {
-        // hack: send the first heartbeat only after we are running for 60 seconds
-        // required as we end up sending a heartbeat and then cloudron-setup reboots the server
-        var seconds = (new Date()).getSeconds() - 1;
-        if (seconds === -1) seconds = 59;
-
-        gJobs.caasHeartbeat = new CronJob({
-            cronTime: `${seconds} */1 * * * *`, // every minute
-            onTick: caas.sendHeartbeat,
-            start: true
-        });
-    }
-
-    callback();
-}
-
-function startPostActivationJobs(callback) {
+function startJobs(callback) {
    assert.strictEqual(typeof callback, 'function');

    var randomHourMinute = Math.floor(60*Math.random());
@@ -120,7 +99,7 @@ function recreateJobs(tz) {
    if (gJobs.backup) gJobs.backup.stop();
    gJobs.backup = new CronJob({
        cronTime: '00 00 */6 * * *', // check every 6 hours
-        onTick: backups.ensureBackup.bind(null, AUDIT_SOURCE, NOOP_CALLBACK),
+        onTick: backups.ensureBackup.bind(null, auditSource.CRON, NOOP_CALLBACK),
        start: true,
        timeZone: tz
    });
@@ -134,13 +113,22 @@ function recreateJobs(tz) {
        timeZone: tz
    });

+    if (gJobs.diskSpaceChecker) gJobs.diskSpaceChecker.stop();
+    gJobs.diskSpaceChecker = new CronJob({
+        cronTime: '00 30 * * * *', // every 30 minutes. if you change this interval, change the notification messages with correct duration
+        onTick: () => disks.checkDiskSpace(NOOP_CALLBACK),
+        start: true,
+        runOnInit: true, // run system check immediately
+        timeZone: tz
+    });
+
    // randomized pattern per cloudron every hour
    var randomMinute = Math.floor(60*Math.random());

    if (gJobs.boxUpdateCheckerJob) gJobs.boxUpdateCheckerJob.stop();
    gJobs.boxUpdateCheckerJob = new CronJob({
        cronTime: '00 ' + randomMinute + ' * * * *', // once an hour
-        onTick: updateChecker.checkBoxUpdates,
+        onTick: () => updateChecker.checkBoxUpdates(NOOP_CALLBACK),
        start: true,
        timeZone: tz
    });
@@ -148,7 +136,7 @@ function recreateJobs(tz) {
    if (gJobs.appUpdateChecker) gJobs.appUpdateChecker.stop();
    gJobs.appUpdateChecker = new CronJob({
        cronTime: '00 ' + randomMinute + ' * * * *', // once an hour
-        onTick: updateChecker.checkAppUpdates,
+        onTick: () => updateChecker.checkAppUpdates(NOOP_CALLBACK),
        start: true,
        timeZone: tz
    });
@@ -164,7 +152,7 @@ function recreateJobs(tz) {
    if (gJobs.cleanupBackups) gJobs.cleanupBackups.stop();
    gJobs.cleanupBackups = new CronJob({
        cronTime: '00 45 */6 * * *', // every 6 hours. try not to overlap with ensureBackup job
-        onTick: backups.startCleanupTask.bind(null, AUDIT_SOURCE, NOOP_CALLBACK),
+        onTick: backups.startCleanupTask.bind(null, auditSource.CRON, NOOP_CALLBACK),
        start: true,
        timeZone: tz
    });
@@ -187,7 +175,7 @@ function recreateJobs(tz) {

    if (gJobs.schedulerSync) gJobs.schedulerSync.stop();
    gJobs.schedulerSync = new CronJob({
-        cronTime: config.TEST ? '*/10 * * * * *' : '00 */1 * * * *', // every minute
+        cronTime: constants.TEST ? '*/10 * * * * *' : '00 */1 * * * *', // every minute
        onTick: scheduler.sync,
        start: true,
        timeZone: tz
@@ -196,15 +184,7 @@ function recreateJobs(tz) {
    if (gJobs.certificateRenew) gJobs.certificateRenew.stop();
    gJobs.certificateRenew = new CronJob({
        cronTime: '00 00 */12 * * *', // every 12 hours
-        onTick: cloudron.renewCerts.bind(null, {}, AUDIT_SOURCE, NOOP_CALLBACK),
-        start: true,
-        timeZone: tz
-    });
-
-    if (gJobs.digestEmail) gJobs.digestEmail.stop();
-    gJobs.digestEmail = new CronJob({
-        cronTime: '00 00 00 * * 3', // every wednesday
-        onTick: digest.send,
+        onTick: cloudron.renewCerts.bind(null, {}, auditSource.CRON, NOOP_CALLBACK),
        start: true,
        timeZone: tz
    });
@@ -234,7 +214,7 @@ function boxAutoupdatePatternChanged(pattern) {
            var updateInfo = updateChecker.getUpdateInfo();
            if (updateInfo.box) {
                debug('Starting autoupdate to %j', updateInfo.box);
-                updater.updateToLatest(AUDIT_SOURCE, NOOP_CALLBACK);
+                updater.updateToLatest({ skipBackup: false }, auditSource.CRON, NOOP_CALLBACK);
            } else {
                debug('No box auto updates available');
            }
@@ -260,7 +240,7 @@ function appAutoupdatePatternChanged(pattern) {
            var updateInfo = updateChecker.getUpdateInfo();
            if (updateInfo.apps) {
                debug('Starting app update to %j', updateInfo.apps);
-                apps.autoupdateApps(updateInfo.apps, AUDIT_SOURCE, NOOP_CALLBACK);
+                apps.autoupdateApps(updateInfo.apps, auditSource.CRON, NOOP_CALLBACK);
            } else {
                debug('No app auto updates available');
            }
@@ -278,8 +258,8 @@ function dynamicDnsChanged(enabled) {

    if (enabled) {
        gJobs.dynamicDns = new CronJob({
-            cronTime: '00 */10 * * * *',
-            onTick: dyndns.sync,
+            cronTime: '5 * * * * *',    // we only update the records if the ip has changed.
+            onTick: dyndns.sync.bind(null, auditSource.CRON, NOOP_CALLBACK),
            start: true,
            timeZone: gJobs.boxUpdateCheckerJob.cronTime.zone // hack
        });
@@ -0,0 +1,66 @@
+'use strict';
+
+let debug = require('debug')('box:custom'),
+    lodash = require('lodash'),
+    paths = require('./paths.js'),
+    safe = require('safetydance'),
+    yaml = require('js-yaml');
+
+exports = module.exports = {
+    uiSpec: uiSpec,
+    spec: spec
+};
+
+const DEFAULT_SPEC = {
+    appstore: {
+        blacklist: [],
+        whitelist: null // null imples, not set. this is an object and not an array
+    },
+    backups: {
+        configurable: true
+    },
+    domains: {
+        dynamicDns: true,
+        changeDashboardDomain: true
+    },
+    subscription: {
+        configurable: true
+    },
+    support: {
+        email: 'support@cloudron.io',
+        remoteSupport: true,
+        ticketFormBody:
+            'Use this form to open support tickets. You can also write directly to [support@cloudron.io](mailto:support@cloudron.io).\n\n'
+            + '* [Knowledge Base & App Docs](https://cloudron.io/documentation/apps/?support_view)\n'
+            + '* [Custom App Packaging & API](https://cloudron.io/developer/packaging/?support_view)\n'
+            + '* [Forum](https://forum.cloudron.io/)\n\n',
+        submitTickets: true
+    },
+    alerts: {
+        email: '',
+        notifyCloudronAdmins: true
+    },
+    footer: {
+        body: '&copy; 2019 [Cloudron](https://cloudron.io) [Forum <i class="fa fa-comments"></i>](https://forum.cloudron.io)'
+    }
+};
+
+const gSpec = (function () {
+    try {
+        if (!safe.fs.existsSync(paths.CUSTOM_FILE)) return DEFAULT_SPEC;
+        const c = yaml.safeLoad(safe.fs.readFileSync(paths.CUSTOM_FILE, 'utf8'));
+        return lodash.merge({}, DEFAULT_SPEC, c);
+    } catch (e) {
+        debug(`Error loading features file from ${paths.CUSTOM_FILE} : ${e.message}`);
+        return DEFAULT_SPEC;
+    }
+})();
+
+// flags sent to the UI. this is separate because we have values that are secret to the backend
+function uiSpec() {
+    return gSpec;
+}
+
+function spec() {
+    return gSpec;
+}
@@ -15,7 +15,7 @@ exports = module.exports = {
 var assert = require('assert'),
    async = require('async'),
    child_process = require('child_process'),
-    config = require('./config.js'),
+    constants = require('./constants.js'),
    mysql = require('mysql'),
    once = require('once'),
    util = require('util');
@@ -23,24 +23,38 @@ var assert = require('assert'),
 var gConnectionPool = null,
    gDefaultConnection = null;

+const gDatabase = {
+    hostname: '127.0.0.1',
+    username: 'root',
+    password: 'password',
+    port: 3306,
+    name: 'box'
+};
+
 function initialize(callback) {
    assert.strictEqual(typeof callback, 'function');

    if (gConnectionPool !== null) return callback(null);

+    if (constants.TEST) {
+        // see setupTest script how the mysql-server is run
+        gDatabase.hostname = require('child_process').execSync('docker inspect -f "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}" mysql-server').toString().trim();
+    }
+
    gConnectionPool  = mysql.createPool({
        connectionLimit: 5, // this has to be > 1 since we store one connection as 'default'. the rest for transactions
-        host: config.database().hostname,
-        user: config.database().username,
-        password: config.database().password,
-        port: config.database().port,
-        database: config.database().name,
+        host: gDatabase.hostname,
+        user: gDatabase.username,
+        password: gDatabase.password,
+        port: gDatabase.port,
+        database: gDatabase.name,
        multipleStatements: false,
-        ssl: false
+        ssl: false,
+        timezone: 'Z' // mysql follows the SYSTEM timezone. on Cloudron, this is UTC
    });

    gConnectionPool.on('connection', function (connection) {
-        connection.query('USE ' + config.database().name);
+        connection.query('USE ' + gDatabase.name);
        connection.query('SET SESSION sql_mode = \'strict_all_tables\'');
    });

@@ -86,12 +100,12 @@ function clear(callback) {
    assert.strictEqual(typeof callback, 'function');

    var cmd = util.format('mysql --host="%s" --user="%s" --password="%s" -Nse "SHOW TABLES" %s | grep -v "^migrations$" | while read table; do mysql --host="%s" --user="%s" --password="%s" -e "SET FOREIGN_KEY_CHECKS = 0; TRUNCATE TABLE $table" %s; done',
-        config.database().hostname, config.database().username, config.database().password, config.database().name,
-        config.database().hostname, config.database().username, config.database().password, config.database().name);
+        gDatabase.hostname, gDatabase.username, gDatabase.password, gDatabase.name,
+        gDatabase.hostname, gDatabase.username, gDatabase.password, gDatabase.name);

    async.series([
        child_process.exec.bind(null, cmd),
-        require('./clientdb.js')._addDefaultClients
+        require('./clients.js').addDefaultClients.bind(null, 'https://admin-localhost')
    ], callback);
 }

@@ -177,7 +191,7 @@ function importFromFile(file, callback) {
    assert.strictEqual(typeof file, 'string');
    assert.strictEqual(typeof callback, 'function');

-    var cmd = `/usr/bin/mysql -h "${config.database().hostname}" -u ${config.database().username} -p${config.database().password} ${config.database().name} < ${file}`;
+    var cmd = `/usr/bin/mysql -h "${gDatabase.hostname}" -u ${gDatabase.username} -p${gDatabase.password} ${gDatabase.name} < ${file}`;

    async.series([
        query.bind(null, 'CREATE DATABASE IF NOT EXISTS box'),
@@ -189,7 +203,7 @@ function exportToFile(file, callback) {
    assert.strictEqual(typeof file, 'string');
    assert.strictEqual(typeof callback, 'function');

-    var cmd = `/usr/bin/mysqldump -h "${config.database().hostname}" -u root -p${config.database().password} --single-transaction --routines --triggers ${config.database().name} > "${file}"`;
+    var cmd = `/usr/bin/mysqldump -h "${gDatabase.hostname}" -u root -p${gDatabase.password} --single-transaction --routines --triggers ${gDatabase.name} > "${file}"`;

    child_process.exec(cmd, callback);
 }
@@ -1,34 +0,0 @@
-/* jslint node:true */
-
-'use strict';
-
-exports = module.exports = DatabaseError;
-
-var assert = require('assert'),
-    util = require('util');
-
-function DatabaseError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(DatabaseError, Error);
-
-DatabaseError.INTERNAL_ERROR = 'Internal error';
-DatabaseError.ALREADY_EXISTS = 'Entry already exist';
-DatabaseError.NOT_FOUND = 'Record not found';
-DatabaseError.BAD_FIELD = 'Invalid field';
-DatabaseError.IN_USE = 'In Use';
@@ -1,62 +0,0 @@
-'use strict';
-
-var debug = require('debug')('box:digest'),
-    eventlog = require('./eventlog.js'),
-    updatechecker = require('./updatechecker.js'),
-    mailer = require('./mailer.js'),
-    settings = require('./settings.js');
-
-var NOOP_CALLBACK = function (error) { if (error) debug(error); };
-
-exports = module.exports = {
-    send: send
-};
-
-function send(callback) {
-    callback = callback || NOOP_CALLBACK;
-
-    settings.getEmailDigest(function (error, enabled) {
-        if (error) return callback(error);
-
-        if (!enabled) {
-            debug('Email digest is disabled');
-            return callback();
-        }
-
-        var updateInfo = updatechecker.getUpdateInfo();
-        var pendingAppUpdates = updateInfo.apps || {};
-        pendingAppUpdates = Object.keys(pendingAppUpdates).map(function (key) { return pendingAppUpdates[key]; });
-
-        eventlog.getByCreationTime(new Date(new Date() - 7*86400000), function (error, events) {
-            if (error) return callback(error);
-
-            var appUpdates = events.filter(function (e) { return e.action === eventlog.ACTION_APP_UPDATE; }).map(function (e) { return e.data; });
-            var boxUpdates = events.filter(function (e) { return e.action === eventlog.ACTION_UPDATE; }).map(function (e) { return e.data; });
-            var certRenewals = events.filter(function (e) { return e.action === eventlog.ACTION_CERTIFICATE_RENEWAL; }).map(function (e) { return e.data; });
-            var usersAdded = events.filter(function (e) { return e.action === eventlog.ACTION_USER_ADD; }).map(function (e) { return e.data; });
-            var usersRemoved = events.filter(function (e) { return e.action === eventlog.ACTION_USER_REMOVE; }).map(function (e) { return e.data; });
-            var finishedBackups = events.filter(function (e) { return e.action === eventlog.ACTION_BACKUP_FINISH && !e.errorMessage; }).map(function (e) { return e.data; });
-
-            if (error) return callback(error);
-
-            var info = {
-                pendingAppUpdates: pendingAppUpdates,
-                pendingBoxUpdate: updateInfo.box || null,
-
-                finishedAppUpdates: appUpdates,
-                finishedBoxUpdates: boxUpdates,
-
-                certRenewals: certRenewals,
-                finishedBackups: finishedBackups, // only the successful backups
-                usersAdded: usersAdded,
-                usersRemoved: usersRemoved // unused because we don't have username to work with
-            };
-
-            // always send digest for backup failure notification
-            debug('send: sending digest email', info);
-            mailer.sendDigest(info);
-
-            callback();
-        });
-    });
-}
@@ -0,0 +1,96 @@
+'use strict';
+
+exports = module.exports = {
+    getDisks: getDisks,
+    checkDiskSpace: checkDiskSpace
+};
+
+const apps = require('./apps.js'),
+    assert = require('assert'),
+    async = require('async'),
+    BoxError = require('./boxerror.js'),
+    debug = require('debug')('box:disks'),
+    df = require('@sindresorhus/df'),
+    docker = require('./docker.js'),
+    notifications = require('./notifications.js'),
+    paths = require('./paths.js');
+
+function getDisks(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    const dfAsync = async.asyncify(df), dfFileAsync = async.asyncify(df.file);
+
+    docker.info(function (error, info) {
+        if (error) return callback(error);
+
+        async.series([
+            dfAsync,
+            dfFileAsync.bind(null, paths.BOX_DATA_DIR),
+            dfFileAsync.bind(null, paths.PLATFORM_DATA_DIR),
+            dfFileAsync.bind(null, paths.APPS_DATA_DIR),
+            dfFileAsync.bind(null, info.DockerRootDir)
+        ], function (error, values) {
+            if (error) return callback(new BoxError(BoxError.FS_ERROR, error));
+
+            // filter by ext4 and then sort to make sure root disk is first
+            const ext4Disks = values[0].filter((r) => r.type === 'ext4').sort((a, b) => a.mountpoint.localeCompare(b.mountpoint));
+
+            const disks = {
+                disks: ext4Disks, // root disk is first
+                boxDataDisk: values[1].filesystem,
+                mailDataDisk: values[1].filesystem,
+                platformDataDisk: values[2].filesystem,
+                appsDataDisk: values[3].filesystem,
+                dockerDataDisk: values[4].filesystem,
+                apps: {}
+            };
+
+            apps.getAll(function (error, allApps) {
+                if (error) return callback(error);
+
+                async.eachSeries(allApps, function (app, iteratorDone) {
+                    if (!app.dataDir) {
+                        disks.apps[app.id] = disks.appsDataDisk;
+                        return iteratorDone();
+                    }
+
+                    dfFileAsync(app.dataDir, function (error, result) {
+                        disks.apps[app.id] = error ? disks.appsDataDisk : result.filesystem; // ignore any errors
+                        iteratorDone();
+                    });
+                }, function (error) {
+                    if (error) return callback(error);
+
+                    callback(null, disks);
+                });
+            });
+        });
+    });
+}
+
+function checkDiskSpace(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    debug('Checking disk space');
+
+    getDisks(function (error, disks) {
+        if (error) {
+            debug('checkDiskSpace: error getting disks %s', error.message);
+            return callback();
+        }
+
+        var oos = disks.disks.some(function (entry) {
+            // ignore other filesystems but where box, app and platform data is
+            if (entry.filesystem !== disks.boxDataDisk
+                && entry.filesystem !== disks.platformDataDisk
+                && entry.filesystem !== disks.appsDataDisk
+                && entry.filesystem !== disks.dockerDataDisk) return false;
+
+            return (entry.available <= (1.25 * 1024 * 1024 * 1024)); // 1.5G
+        });
+
+        debug('checkDiskSpace: disk space checked. ok: %s', !oos);
+
+        notifications.alert(notifications.ALERT_DISK_SPACE, 'Server is running out of disk space', oos ? JSON.stringify(disks.disks, null, 4) : '', callback);
+    });
+}
@@ -11,14 +11,18 @@ exports = module.exports = {
 };

 var assert = require('assert'),
-    config = require('../config.js'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/caas'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
+    settings = require('../settings.js'),
    superagent = require('superagent'),
    util = require('util'),
    waitForDns = require('./waitfordns.js');

+function formatError(response) {
+    return util.format('Caas DNS error [%s] %j', response.statusCode, response.body);
+}
+
 function getFqdn(location, domain) {
    assert.strictEqual(typeof location, 'string');
    assert.strictEqual(typeof domain, 'string');
@@ -58,15 +62,15 @@ function upsert(domainObject, location, type, values, callback) {
    };

    superagent
-        .post(config.apiServerOrigin() + '/api/v1/domains/' + fqdn)
+        .post(settings.apiServerOrigin() + '/api/v1/caas/domains/' + fqdn)
        .query({ token: dnsConfig.token })
        .send(data)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
-            if (result.statusCode === 420) return callback(new DomainsError(DomainsError.STILL_BUSY));
-            if (result.statusCode !== 201) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 400) return callback(new BoxError(BoxError.BAD_FIELD, result.body.message));
+            if (result.statusCode === 420) return callback(new BoxError(BoxError.BUSY));
+            if (result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            return callback(null);
        });
@@ -84,12 +88,12 @@ function get(domainObject, location, type, callback) {
    debug('get: zoneName: %s subdomain: %s type: %s fqdn: %s', domainObject.domain, location, type, fqdn);

    superagent
-        .get(config.apiServerOrigin() + '/api/v1/domains/' + fqdn)
+        .get(settings.apiServerOrigin() + '/api/v1/caas/domains/' + fqdn)
        .query({ token: dnsConfig.token, type: type })
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            return callback(null, result.body.values);
        });
@@ -111,16 +115,16 @@ function del(domainObject, location, type, values, callback) {
    };

    superagent
-        .del(config.apiServerOrigin() + '/api/v1/domains/' + getFqdn(location, domainObject.domain))
+        .del(settings.apiServerOrigin() + '/api/v1/caas/domains/' + getFqdn(location, domainObject.domain))
        .query({ token: dnsConfig.token })
        .send(data)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
-            if (result.statusCode === 420) return callback(new DomainsError(DomainsError.STILL_BUSY));
-            if (result.statusCode === 404) return callback(new DomainsError(DomainsError.NOT_FOUND));
-            if (result.statusCode !== 204) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 400) return callback(new BoxError(BoxError.BAD_FIELD, result.body.message));
+            if (result.statusCode === 420) return callback(new BoxError(BoxError.BUSY));
+            if (result.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND));
+            if (result.statusCode !== 204) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            return callback(null);
        });
@@ -145,7 +149,7 @@ function verifyDnsConfig(domainObject, callback) {

    const dnsConfig = domainObject.config;

-    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'token must be a non-empty string'));
+    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'token must be a non-empty string', { field: 'token' }));

    const ip = '127.0.0.1';

@@ -12,10 +12,10 @@ exports = module.exports = {

 var assert = require('assert'),
    async = require('async'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/cloudflare'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    superagent = require('superagent'),
    util = require('util'),
    waitForDns = require('./waitfordns.js'),
@@ -37,15 +37,15 @@ function translateRequestError(result, callback) {
    assert.strictEqual(typeof result, 'object');
    assert.strictEqual(typeof callback, 'function');

-    if (result.statusCode === 404) return callback(new DomainsError(DomainsError.NOT_FOUND, util.format('%s %j', result.statusCode, 'API does not exist')));
-    if (result.statusCode === 422) return callback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
+    if (result.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND, util.format('%s %j', result.statusCode, 'API does not exist')));
+    if (result.statusCode === 422) return callback(new BoxError(BoxError.BAD_FIELD, result.body.message));
    if ((result.statusCode === 400 || result.statusCode === 401 || result.statusCode === 403) && result.body.errors.length > 0) {
        let error = result.body.errors[0];
        let message = `message: ${error.message} statusCode: ${result.statusCode} code:${error.code}`;
-        return callback(new DomainsError(DomainsError.ACCESS_DENIED, message));
+        return callback(new BoxError(BoxError.ACCESS_DENIED, message));
    }

-    callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
+    callback(new BoxError(BoxError.EXTERNAL_ERROR, util.format('%s %j', result.statusCode, result.body)));
 }

 function getZoneByName(dnsConfig, zoneName, callback) {
@@ -60,7 +60,7 @@ function getZoneByName(dnsConfig, zoneName, callback) {
        .end(function (error, result) {
            if (error && !error.response) return callback(error);
            if (result.statusCode !== 200 || result.body.success !== true) return translateRequestError(result, callback);
-            if (!result.body.result.length) return callback(new DomainsError(DomainsError.NOT_FOUND, util.format('%s %j', result.statusCode, result.body)));
+            if (!result.body.result.length) return callback(new BoxError(BoxError.NOT_FOUND, util.format('%s %j', result.statusCode, result.body)));

            callback(null, result.body.result[0]);
        });
@@ -259,7 +259,7 @@ function wait(domainObject, location, type, value, options, callback) {

        getDnsRecords(dnsConfig, zoneId, fqdn, type, function (error, dnsRecords) {
            if (error) return callback(error);
-            if (dnsRecords.length === 0) return callback(new DomainsError(DomainsError.NOT_FOUND, 'Domain not found'));
+            if (dnsRecords.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Domain not found'));

            if (!dnsRecords[0].proxied) return waitForDns(fqdn, domainObject.zoneName, type, value, options, callback);

@@ -277,8 +277,8 @@ function verifyDnsConfig(domainObject, callback) {
    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName;

-    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'token must be a non-empty string'));
-    if (!dnsConfig.email || typeof dnsConfig.email !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'email must be a non-empty string'));
+    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'token must be a non-empty string', { field: 'token' }));
+    if (!dnsConfig.email || typeof dnsConfig.email !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'email must be a non-empty string', { field: 'email' }));

    const ip = '127.0.0.1';

@@ -290,15 +290,15 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        getZoneByName(dnsConfig, zoneName, function(error, zone) {
            if (error) return callback(error);

            if (!_.isEqual(zone.name_servers.sort(), nameservers.sort())) {
                debug('verifyDnsConfig: %j and %j do not match', nameservers, zone.name_servers);
-                return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Cloudflare'));
+                return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to Cloudflare', { field: 'nameservers' }));
            }

            const location = 'cloudrontestdns';
@@ -12,10 +12,10 @@ exports = module.exports = {

 var assert = require('assert'),
    async = require('async'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/digitalocean'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    safe = require('safetydance'),
    superagent = require('superagent'),
    util = require('util'),
@@ -45,17 +45,20 @@ function getInternal(dnsConfig, zoneName, name, type, callback) {

    var nextPage = null, matchingRecords = [];

+    debug(`getInternal: getting dns records of ${zoneName} with ${name} and type ${type}`);
+
    async.doWhilst(function (iteratorDone) {
        var url = nextPage ? nextPage : DIGITALOCEAN_ENDPOINT + '/v2/domains/' + zoneName + '/records';

        superagent.get(url)
            .set('Authorization', 'Bearer ' + dnsConfig.token)
            .timeout(30 * 1000)
+            .retry(5)
            .end(function (error, result) {
-                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-                if (result.statusCode === 404) return callback(new DomainsError(DomainsError.NOT_FOUND, formatError(result)));
-                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-                if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+                if (error && !error.response) return iteratorDone(new BoxError(BoxError.NETWORK_ERROR, error.message));
+                if (result.statusCode === 404) return iteratorDone(new BoxError(BoxError.NOT_FOUND, formatError(result)));
+                if (result.statusCode === 403 || result.statusCode === 401) return iteratorDone(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 200) return iteratorDone(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

                matchingRecords = matchingRecords.concat(result.body.domain_records.filter(function (record) {
                    return (record.type === type && record.name === name);
@@ -66,9 +69,9 @@ function getInternal(dnsConfig, zoneName, name, type, callback) {
                iteratorDone();
            });
    }, function () { return !!nextPage; }, function (error) {
-        if (error) return callback(error);
+        debug('getInternal:', error, JSON.stringify(matchingRecords));

-        debug('getInternal: %j', matchingRecords);
+        if (error) return callback(error);

        return callback(null, matchingRecords);
    });
@@ -106,7 +109,7 @@ function upsert(domainObject, location, type, values, callback) {
                name: name,
                data: value,
                priority: priority,
-                ttl: 1
+                ttl: 30 // Recent DO DNS API break means this value must atleast be 30
            };

            if (i >= result.length) {
@@ -114,11 +117,12 @@ function upsert(domainObject, location, type, values, callback) {
                    .set('Authorization', 'Bearer ' + dnsConfig.token)
                    .send(data)
                    .timeout(30 * 1000)
+                    .retry(5)
                    .end(function (error, result) {
-                        if (error && !error.response) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-                        if (result.statusCode === 422) return iteratorCallback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
-                        if (result.statusCode !== 201) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+                        if (error && !error.response) return iteratorCallback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+                        if (result.statusCode === 422) return iteratorCallback(new BoxError(BoxError.BAD_FIELD, result.body.message));
+                        if (result.statusCode !== 201) return iteratorCallback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

                        recordIds.push(safe.query(result.body, 'domain_record.id'));

@@ -129,21 +133,28 @@ function upsert(domainObject, location, type, values, callback) {
                    .set('Authorization', 'Bearer ' + dnsConfig.token)
                    .send(data)
                    .timeout(30 * 1000)
+                    .retry(5)
                    .end(function (error, result) {
                    // increment, as we have consumed the record
                        ++i;

-                        if (error && !error.response) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-                        if (result.statusCode === 422) return iteratorCallback(new DomainsError(DomainsError.BAD_FIELD, result.body.message));
-                        if (result.statusCode !== 200) return iteratorCallback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+                        if (error && !error.response) return iteratorCallback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+                        if (result.statusCode === 403 || result.statusCode === 401) return iteratorCallback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+                        if (result.statusCode === 422) return iteratorCallback(new BoxError(BoxError.BAD_FIELD, result.body.message));
+                        if (result.statusCode !== 200) return iteratorCallback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

                        recordIds.push(safe.query(result.body, 'domain_record.id'));

                        return iteratorCallback(null);
                    });
            }
-        }, callback);
+        }, function (error) {
+            if (error) return callback(error);
+
+            debug('upsert: completed with recordIds:%j', recordIds);
+
+            callback();
+        });
    });
 }

@@ -196,11 +207,12 @@ function del(domainObject, location, type, values, callback) {
        superagent.del(DIGITALOCEAN_ENDPOINT + '/v2/domains/' + zoneName + '/records/' + tmp[0].id)
            .set('Authorization', 'Bearer ' + dnsConfig.token)
            .timeout(30 * 1000)
+            .retry(5)
            .end(function (error, result) {
-                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+                if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
                if (result.statusCode === 404) return callback(null);
-                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-                if (result.statusCode !== 204) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+                if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 204) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

                debug('del: done');

@@ -229,7 +241,7 @@ function verifyDnsConfig(domainObject, callback) {
    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName;

-    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'token must be a non-empty string'));
+    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'token must be a non-empty string', { field: 'token' }));

    const ip = '127.0.0.1';

@@ -240,12 +252,12 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        if (nameservers.map(function (n) { return n.toLowerCase(); }).indexOf('ns1.digitalocean.com') === -1) {
            debug('verifyDnsConfig: %j does not contains DO NS', nameservers);
-            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Digital Ocean'));
+            return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to DigitalOcean', { field: 'nameservers' }));
        }

        const location = 'cloudrontestdns';
@@ -11,10 +11,10 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/gandi'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    superagent = require('superagent'),
    util = require('util'),
    waitForDns = require('./waitfordns.js');
@@ -57,10 +57,10 @@ function upsert(domainObject, location, type, values, callback) {
        .timeout(30 * 1000)
        .send(data)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, formatError(result)));
-            if (result.statusCode !== 201) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode === 400) return callback(new BoxError(BoxError.BAD_FIELD, formatError(result)));
+            if (result.statusCode !== 201) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            return callback(null);
        });
@@ -82,10 +82,10 @@ function get(domainObject, location, type, callback) {
        .set('X-Api-Key', dnsConfig.token)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
            if (result.statusCode === 404) return callback(null, [ ]);
-            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            debug('get: %j', result.body);

@@ -110,10 +110,10 @@ function del(domainObject, location, type, values, callback) {
        .set('X-Api-Key', dnsConfig.token)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
            if (result.statusCode === 404) return callback(null);
-            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-            if (result.statusCode !== 204) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 204) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            debug('del: done');

@@ -141,7 +141,7 @@ function verifyDnsConfig(domainObject, callback) {
    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName;

-    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'token must be a non-empty string'));
+    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'token must be a non-empty string', { field: 'token' }));

    var credentials = {
        token: dnsConfig.token
@@ -152,12 +152,12 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        if (!nameservers.every(function (n) { return n.toLowerCase().indexOf('.gandi.net') !== -1; })) {
            debug('verifyDnsConfig: %j does not contain Gandi NS', nameservers);
-            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Gandi'));
+            return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to Gandi', { field: 'nameservers' }));
        }

        const location = 'cloudrontestdns';
@@ -11,11 +11,11 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/gcdns'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
-    GCDNS = require('@google-cloud/dns'),
+    GCDNS = require('@google-cloud/dns').DNS,
    util = require('util'),
    waitForDns = require('./waitfordns.js'),
    _ = require('underscore');
@@ -46,23 +46,23 @@ function getZoneByName(dnsConfig, zoneName, callback) {
    assert.strictEqual(typeof zoneName, 'string');
    assert.strictEqual(typeof callback, 'function');

-    var gcdns = GCDNS(getDnsCredentials(dnsConfig));
+    var gcdns = new GCDNS(getDnsCredentials(dnsConfig));

    gcdns.getZones(function (error, zones) {
-        if (error && error.message === 'invalid_grant') return callback(new DomainsError(DomainsError.ACCESS_DENIED, 'The key was probably revoked'));
-        if (error && error.reason === 'No such domain') return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
-        if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-        if (error && error.code === 404) return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
+        if (error && error.message === 'invalid_grant') return callback(new BoxError(BoxError.ACCESS_DENIED, 'The key was probably revoked'));
+        if (error && error.reason === 'No such domain') return callback(new BoxError(BoxError.NOT_FOUND, error.message));
+        if (error && error.code === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+        if (error && error.code === 404) return callback(new BoxError(BoxError.NOT_FOUND, error.message));
        if (error) {
            debug('gcdns.getZones', error);
-            return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error));
+            return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
        }

        var zone = zones.filter(function (zone) {
            return zone.metadata.dnsName.slice(0, -1) === zoneName;     // the zone name contains a '.' at the end
        })[0];

-        if (!zone) return callback(new DomainsError(DomainsError.NOT_FOUND, 'no such zone'));
+        if (!zone) return callback(new BoxError(BoxError.NOT_FOUND, 'no such zone'));

        callback(null, zone); //zone.metadata ~= {name="", dnsName="", nameServers:[]}
    });
@@ -85,10 +85,10 @@ function upsert(domainObject, location, type, values, callback) {
        if (error) return callback(error);

        zone.getRecords({ type: type, name: fqdn + '.' }, function (error, oldRecords) {
-            if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
            if (error) {
                debug('upsert->zone.getRecords', error);
-                return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+                return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
            }

            var newRecord = zone.record(type, {
@@ -98,11 +98,11 @@ function upsert(domainObject, location, type, values, callback) {
            });

            zone.createChange({ delete: oldRecords, add: newRecord }, function(error /*, change */) {
-                if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-                if (error && error.code === 412) return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
+                if (error && error.code === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+                if (error && error.code === 412) return callback(new BoxError(BoxError.BUSY, error.message));
                if (error) {
                    debug('upsert->zone.createChange', error);
-                    return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+                    return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
                }

                callback(null);
@@ -130,8 +130,8 @@ function get(domainObject, location, type, callback) {
        };

        zone.getRecords(params, function (error, records) {
-            if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error));
+            if (error && error.code === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
            if (records.length === 0) return callback(null, [ ]);

            return callback(null, records[0].data);
@@ -154,18 +154,18 @@ function del(domainObject, location, type, values, callback) {
        if (error) return callback(error);

        zone.getRecords({ type: type, name: fqdn + '.' }, function(error, oldRecords) {
-            if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
            if (error) {
                debug('del->zone.getRecords', error);
-                return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+                return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
            }

            zone.deleteRecords(oldRecords, function (error, change) {
-                if (error && error.code === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-                if (error && error.code === 412) return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
+                if (error && error.code === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+                if (error && error.code === 412) return callback(new BoxError(BoxError.BUSY, error.message));
                if (error) {
                    debug('del->zone.createChange', error);
-                    return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+                    return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
                }

                callback(null, change.id);
@@ -194,10 +194,10 @@ function verifyDnsConfig(domainObject, callback) {
    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName;

-    if (typeof dnsConfig.projectId !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'projectId must be a string'));
-    if (!dnsConfig.credentials || typeof dnsConfig.credentials !== 'object') return callback(new DomainsError(DomainsError.BAD_FIELD, 'credentials must be an object'));
-    if (typeof dnsConfig.credentials.client_email !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'credentials.client_email must be a string'));
-    if (typeof dnsConfig.credentials.private_key !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'credentials.private_key must be a string'));
+    if (typeof dnsConfig.projectId !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'projectId must be a string', { field: 'projectId' }));
+    if (!dnsConfig.credentials || typeof dnsConfig.credentials !== 'object') return callback(new BoxError(BoxError.BAD_FIELD, 'credentials must be an object', { field: 'credentials' }));
+    if (typeof dnsConfig.credentials.client_email !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'credentials.client_email must be a string', { field: 'client_email' }));
+    if (typeof dnsConfig.credentials.private_key !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'credentials.private_key must be a string', { field: 'private_key' }));

    var credentials = getDnsCredentials(dnsConfig);

@@ -206,8 +206,8 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        getZoneByName(credentials, zoneName, function (error, zone) {
            if (error) return callback(error);
@@ -215,7 +215,7 @@ function verifyDnsConfig(domainObject, callback) {
            var definedNS = zone.metadata.nameServers.sort().map(function(r) { return r.replace(/\.$/, ''); });
            if (!_.isEqual(definedNS, nameservers.sort())) {
                debug('verifyDnsConfig: %j and %j do not match', nameservers, definedNS);
-                return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Google Cloud DNS'));
+                return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to Google Cloud DNS', { field: 'nameservers' }));
            }

            const location = 'cloudrontestdns';
@@ -11,10 +11,10 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/godaddy'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    superagent = require('superagent'),
    util = require('util'),
    waitForDns = require('./waitfordns.js');
@@ -72,11 +72,11 @@ function upsert(domainObject, location, type, values, callback) {
        .timeout(30 * 1000)
        .send(records)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-            if (result.statusCode === 400) return callback(new DomainsError(DomainsError.BAD_FIELD, formatError(result))); // no such zone
-            if (result.statusCode === 422) return callback(new DomainsError(DomainsError.BAD_FIELD, formatError(result))); // conflict
-            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode === 400) return callback(new BoxError(BoxError.BAD_FIELD, formatError(result))); // no such zone
+            if (result.statusCode === 422) return callback(new BoxError(BoxError.BAD_FIELD, formatError(result))); // conflict
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            return callback(null);
        });
@@ -98,10 +98,10 @@ function get(domainObject, location, type, callback) {
        .set('Authorization', `sso-key ${dnsConfig.apiKey}:${dnsConfig.apiSecret}`)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
-            if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
            if (result.statusCode === 404) return callback(null, [ ]);
-            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            debug('get: %j', result.body);

@@ -126,7 +126,7 @@ function del(domainObject, location, type, values, callback) {

    debug(`get: ${name} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);

-    if (type !== 'A' && type !== 'TXT') return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, new Error('Record deletion is not supported by GoDaddy API')));
+    if (type !== 'A' && type !== 'TXT') return callback(new BoxError(BoxError.EXTERNAL_ERROR, new Error('Record deletion is not supported by GoDaddy API')));

    // check if the record exists at all so that we don't insert the "Dead" record for no reason
    get(domainObject, location, type, function (error, values) {
@@ -144,10 +144,10 @@ function del(domainObject, location, type, values, callback) {
            .send(records)
            .timeout(30 * 1000)
            .end(function (error, result) {
-                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, util.format('Network error %s', error.message)));
+                if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
                if (result.statusCode === 404) return callback(null);
-                if (result.statusCode === 403 || result.statusCode === 401) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-                if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+                if (result.statusCode === 403 || result.statusCode === 401) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

                debug('del: done');

@@ -176,8 +176,8 @@ function verifyDnsConfig(domainObject, callback) {
    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName;

-    if (!dnsConfig.apiKey || typeof dnsConfig.apiKey !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'apiKey must be a non-empty string'));
-    if (!dnsConfig.apiSecret || typeof dnsConfig.apiSecret !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'apiSecret must be a non-empty string'));
+    if (!dnsConfig.apiKey || typeof dnsConfig.apiKey !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'apiKey must be a non-empty string', { field: 'apiKey' }));
+    if (!dnsConfig.apiSecret || typeof dnsConfig.apiSecret !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'apiSecret must be a non-empty string', { field: 'apiSecret' }));

    const ip = '127.0.0.1';

@@ -189,12 +189,12 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        if (!nameservers.every(function (n) { return n.toLowerCase().indexOf('.domaincontrol.com') !== -1; })) {
            debug('verifyDnsConfig: %j does not contain GoDaddy NS', nameservers);
-            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to GoDaddy'));
+            return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to GoDaddy', { field: 'nameservers' }));
        }

        const location = 'cloudrontestdns';
@@ -11,10 +11,10 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/manual'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    util = require('util'),
    waitForDns = require('./waitfordns.js');

@@ -22,6 +22,7 @@ function removePrivateFields(domainObject) {
    return domainObject;
 }

+// eslint-disable-next-line no-unused-vars
 function injectPrivateFields(newConfig, currentConfig) {

 }
@@ -78,8 +79,8 @@ function verifyDnsConfig(domainObject, callback) {

    // Very basic check if the nameservers can be fetched
    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        callback(null, {});
    });
@@ -11,18 +11,18 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/namecheap'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
-    Namecheap = require('namecheap'),
+    safe = require('safetydance'),
+    superagent = require('superagent'),
    sysinfo = require('../sysinfo.js'),
    util = require('util'),
-    waitForDns = require('./waitfordns.js');
+    waitForDns = require('./waitfordns.js'),
+    xml2js = require('xml2js');

-function formatError(response) {
-    return util.format('NameCheap DNS error [%s] %j', response.code, response.message);
-}
+const ENDPOINT = 'https://api.namecheap.com/xml.response';

 function removePrivateFields(domainObject) {
    domainObject.config.token = domains.SECRET_PLACEHOLDER;
@@ -33,37 +33,19 @@ function injectPrivateFields(newConfig, currentConfig) {
    if (newConfig.token === domains.SECRET_PLACEHOLDER) newConfig.token = currentConfig.token;
 }

-// Only send required fields - https://www.namecheap.com/support/api/methods/domains-dns/set-hosts.aspx
-function mapHosts(hosts) {
-    return hosts.map(function (host) {
-        let tmp = {};
-
-        tmp.TTL = '300';
-        tmp.RecordType = host.RecordType || host.Type;
-        tmp.HostName = host.HostName || host.Name;
-        tmp.Address = host.Address;
-
-        if (tmp.RecordType === 'MX') {
-            tmp.EmailType = 'MX';
-            if (host.MXPref) tmp.MXPref = host.MXPref;
-        }
-
-        return tmp;
-    });
-}
-
-function getApi(dnsConfig, callback) {
+function getQuery(dnsConfig, callback) {
    assert.strictEqual(typeof dnsConfig, 'object');
    assert.strictEqual(typeof callback, 'function');

-    sysinfo.getPublicIp(function (error, ip) {
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+    sysinfo.getServerIp(function (error, ip) {
+        if (error) return callback(error);

-        // Note that for all NameCheap calls to go through properly, the public IP returned by the getPublicIp method below must be whitelisted on NameCheap's API dashboard
-        let namecheap = new Namecheap(dnsConfig.username, dnsConfig.token, ip);
-        namecheap.setUsername(dnsConfig.username);
-
-        callback(null, namecheap);
+        callback(null, {
+            ApiUser: dnsConfig.username,
+            ApiKey: dnsConfig.token,
+            UserName: dnsConfig.username,
+            ClientIp: ip
+        });
    });
 }

@@ -74,15 +56,36 @@ function getInternal(dnsConfig, zoneName, subdomain, type, callback) {
    assert.strictEqual(typeof type, 'string');
    assert.strictEqual(typeof callback, 'function');

-    getApi(dnsConfig, function (error, namecheap) {
+    getQuery(dnsConfig, function (error, query) {
        if (error) return callback(error);

-        namecheap.domains.dns.getHosts(zoneName, function (error, result) {
-            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(error)));
+        query.Command = 'namecheap.domains.dns.getHosts';
+        query.SLD = zoneName.split('.')[0];
+        query.TLD = zoneName.split('.')[1];

-            debug('entire getInternal response: %j', result);
+        superagent.get(ENDPOINT).query(query).end(function (error, result) {
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));

-            return callback(null, result['DomainDNSGetHostsResult']['host']);
+            var parser = new xml2js.Parser();
+            parser.parseString(result.text, function (error, result) {
+                if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
+
+                var tmp = result.ApiResponse;
+                if (tmp['$'].Status !== 'OK') {
+                    var errorMessage = safe.query(tmp, 'Errors[0].Error[0]._', 'Invalid response');
+                    if (errorMessage === 'API Key is invalid or API access has not been enabled') return callback(new BoxError(BoxError.ACCESS_DENIED, errorMessage));
+
+                    return callback(new BoxError(BoxError.EXTERNAL_ERROR, errorMessage));
+                }
+                if (!tmp.CommandResponse[0]) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response'));
+                if (!tmp.CommandResponse[0].DomainDNSGetHostsResult[0]) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response'));
+
+                var hosts = result.ApiResponse.CommandResponse[0].DomainDNSGetHostsResult[0].host.map(function (h) {
+                    return h['$'];
+                });
+
+                callback(null, hosts);
+            });
        });
    });
 }
@@ -93,15 +96,47 @@ function setInternal(dnsConfig, zoneName, hosts, callback) {
    assert(Array.isArray(hosts));
    assert.strictEqual(typeof callback, 'function');

-    let mappedHosts = mapHosts(hosts);
-
-    getApi(dnsConfig, function (error, namecheap) {
+    getQuery(dnsConfig, function (error, query) {
        if (error) return callback(error);

-        namecheap.domains.dns.setHosts(zoneName, mappedHosts, function (error, result) {
-            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(error)));
+        query.Command = 'namecheap.domains.dns.setHosts';
+        query.SLD = zoneName.split('.')[0];
+        query.TLD = zoneName.split('.')[1];

-            return callback(null, result);
+        // Map to query params https://www.namecheap.com/support/api/methods/domains-dns/set-hosts.aspx
+        hosts.forEach(function (host, i) {
+            var n = i+1; // api starts with 1 not 0
+            query['TTL' + n] = '300'; // keep it low
+            query['HostName' + n] = host.HostName || host.Name;
+            query['RecordType' + n] = host.RecordType || host.Type;
+            query['Address' + n] = host.Address;
+
+            if (host.Type === 'MX') {
+                query['EmailType' + n] = 'MX';
+                if (host.MXPref) query['MXPref' + n] = host.MXPref;
+            }
+        });
+
+        superagent.post(ENDPOINT).query(query).end(function (error, result) {
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
+
+            var parser = new xml2js.Parser();
+            parser.parseString(result.text, function (error, result) {
+                if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
+
+                var tmp = result.ApiResponse;
+                if (tmp['$'].Status !== 'OK') {
+                    var errorMessage = safe.query(tmp, 'Errors[0].Error[0]._', 'Invalid response');
+                    if (errorMessage === 'API Key is invalid or API access has not been enabled') return callback(new BoxError(BoxError.ACCESS_DENIED, errorMessage));
+
+                    return callback(new BoxError(BoxError.EXTERNAL_ERROR, errorMessage));
+                }
+                if (!tmp.CommandResponse[0]) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response'));
+                if (!tmp.CommandResponse[0].DomainDNSSetHostsResult[0]) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response'));
+                if (tmp.CommandResponse[0].DomainDNSSetHostsResult[0]['$'].IsSuccess !== 'true') return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Invalid response'));
+
+                callback(null);
+            });
        });
    });
 }
@@ -246,8 +281,8 @@ function verifyDnsConfig(domainObject, callback) {
    const zoneName = domainObject.zoneName;
    const ip = '127.0.0.1';

-    if (!dnsConfig.username || typeof dnsConfig.username !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'username must be a non-empty string'));
-    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'token must be a non-empty string'));
+    if (!dnsConfig.username || typeof dnsConfig.username !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'username must be a non-empty string', { field: 'username' }));
+    if (!dnsConfig.token || typeof dnsConfig.token !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'token must be a non-empty string', { field: 'token' }));

    let credentials = {
        username: dnsConfig.username,
@@ -257,12 +292,12 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        if (nameservers.some(function (n) { return n.toLowerCase().indexOf('.registrar-servers.com') === -1; })) {
            debug('verifyDnsConfig: %j does not contains NC NS', nameservers);
-            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to NameCheap'));
+            return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to NameCheap', { field: 'nameservers' }));
        }

        const testSubdomain = 'cloudrontestdns';
@@ -11,10 +11,10 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/namecom'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    safe = require('safetydance'),
    superagent = require('superagent'),
    util = require('util'),
@@ -63,9 +63,9 @@ function addRecord(dnsConfig, zoneName, name, type, values, callback) {
        .timeout(30 * 1000)
        .send(data)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
-            if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            return callback(null, 'unused-id');
        });
@@ -100,9 +100,9 @@ function updateRecord(dnsConfig, zoneName, recordId, name, type, values, callbac
        .timeout(30 * 1000)
        .send(data)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
-            if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            return callback(null);
        });
@@ -121,9 +121,9 @@ function getInternal(dnsConfig, zoneName, name, type, callback) {
        .auth(dnsConfig.username, dnsConfig.token)
        .timeout(30 * 1000)
        .end(function (error, result) {
-            if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
-            if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-            if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+            if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+            if (result.statusCode === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+            if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

            // name.com does not return the correct content-type
            result.body = safe.JSON.parse(result.text);
@@ -131,7 +131,7 @@ function getInternal(dnsConfig, zoneName, name, type, callback) {

            result.body.records.forEach(function (r) {
                // name.com api simply strips empty properties
-                r.host = r.host || '@';
+                r.host = r.host || '';
            });

            var results = result.body.records.filter(function (r) {
@@ -153,7 +153,7 @@ function upsert(domainObject, location, type, values, callback) {

    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName,
-        name = domains.getName(domainObject, location, type) || '@';
+        name = domains.getName(domainObject, location, type) || '';

    debug(`upsert: ${name} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);

@@ -174,7 +174,7 @@ function get(domainObject, location, type, callback) {

    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName,
-        name = domains.getName(domainObject, location, type) || '@';
+        name = domains.getName(domainObject, location, type) || '';

    getInternal(dnsConfig, zoneName, name, type, function (error, result) {
        if (error) return callback(error);
@@ -196,7 +196,7 @@ function del(domainObject, location, type, values, callback) {

    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName,
-        name = domains.getName(domainObject, location, type) || '@';
+        name = domains.getName(domainObject, location, type) || '';

    debug(`del: ${name} in zone ${zoneName} of type ${type} with values ${JSON.stringify(values)}`);

@@ -209,9 +209,9 @@ function del(domainObject, location, type, values, callback) {
            .auth(dnsConfig.username, dnsConfig.token)
            .timeout(30 * 1000)
            .end(function (error, result) {
-                if (error && !error.response) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Network error ${error.message}`));
-                if (result.statusCode === 403) return callback(new DomainsError(DomainsError.ACCESS_DENIED, formatError(result)));
-                if (result.statusCode !== 200) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, formatError(result)));
+                if (error && !error.response) return callback(new BoxError(BoxError.NETWORK_ERROR, error.message));
+                if (result.statusCode === 403) return callback(new BoxError(BoxError.ACCESS_DENIED, formatError(result)));
+                if (result.statusCode !== 200) return callback(new BoxError(BoxError.EXTERNAL_ERROR, formatError(result)));

                return callback(null);
            });
@@ -238,8 +238,8 @@ function verifyDnsConfig(domainObject, callback) {
    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName;

-    if (typeof dnsConfig.username !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'username must be a string'));
-    if (typeof dnsConfig.token !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'token must be a string'));
+    if (typeof dnsConfig.username !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'username must be a string', { field: 'username' }));
+    if (typeof dnsConfig.token !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'token must be a string', { field: 'token' }));

    var credentials = {
        username: dnsConfig.username,
@@ -251,12 +251,12 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        if (!nameservers.every(function (n) { return n.toLowerCase().indexOf('.name.com') !== -1; })) {
            debug('verifyDnsConfig: %j does not contain Name.com NS', nameservers);
-            return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Name.com'));
+            return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to name.com', { field: 'nameservers' }));
        }

        const location = 'cloudrontestdns';
@@ -18,6 +18,7 @@ function removePrivateFields(domainObject) {
    return domainObject;
 }

+// eslint-disable-next-line no-unused-vars
 function injectPrivateFields(newConfig, currentConfig) {
 }

@@ -12,10 +12,10 @@ exports = module.exports = {

 var assert = require('assert'),
    AWS = require('aws-sdk'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/route53'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    util = require('util'),
    waitForDns = require('./waitfordns.js'),
    _ = require('underscore');
@@ -59,15 +59,15 @@ function getZoneByName(dnsConfig, zoneName, callback) {
    }

    listHostedZones(function (error, result) {
-        if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-        if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-        if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+        if (error && error.code === 'AccessDenied') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+        if (error && error.code === 'InvalidClientTokenId') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+        if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));

        var zone = result.HostedZones.filter(function (zone) {
            return zone.Name.slice(0, -1) === zoneName;     // aws zone name contains a '.' at the end
        })[0];

-        if (!zone) return callback(new DomainsError(DomainsError.NOT_FOUND, 'no such zone'));
+        if (!zone) return callback(new BoxError(BoxError.NOT_FOUND, 'no such zone'));

        callback(null, zone);
    });
@@ -83,9 +83,9 @@ function getHostedZone(dnsConfig, zoneName, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.getHostedZone({ Id: zone.Id }, function (error, result) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));

            callback(null, result);
        });
@@ -127,11 +127,11 @@ function upsert(domainObject, location, type, values, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.changeResourceRecordSets(params, function(error) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'PriorRequestNotComplete') return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
-            if (error && error.code === 'InvalidChangeBatch') return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
-            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'PriorRequestNotComplete') return callback(new BoxError(BoxError.BUSY, error.message));
+            if (error && error.code === 'InvalidChangeBatch') return callback(new BoxError(BoxError.BAD_FIELD, error.message));
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));

            callback(null);
        });
@@ -160,9 +160,9 @@ function get(domainObject, location, type, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.listResourceRecordSets(params, function (error, result) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
            if (result.ResourceRecordSets.length === 0) return callback(null, [ ]);
            if (result.ResourceRecordSets[0].Name !== params.StartRecordName || result.ResourceRecordSets[0].Type !== params.StartRecordType) return callback(null, [ ]);

@@ -208,23 +208,23 @@ function del(domainObject, location, type, values, callback) {

        var route53 = new AWS.Route53(getDnsCredentials(dnsConfig));
        route53.changeResourceRecordSets(params, function(error) {
-            if (error && error.code === 'AccessDenied') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
-            if (error && error.code === 'InvalidClientTokenId') return callback(new DomainsError(DomainsError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'AccessDenied') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
+            if (error && error.code === 'InvalidClientTokenId') return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));
            if (error && error.message && error.message.indexOf('it was not found') !== -1) {
                debug('del: resource record set not found.', error);
-                return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
+                return callback(new BoxError(BoxError.NOT_FOUND, error.message));
            } else if (error && error.code === 'NoSuchHostedZone') {
                debug('del: hosted zone not found.', error);
-                return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
+                return callback(new BoxError(BoxError.NOT_FOUND, error.message));
            } else if (error && error.code === 'PriorRequestNotComplete') {
                debug('del: resource is still busy', error);
-                return callback(new DomainsError(DomainsError.STILL_BUSY, error.message));
+                return callback(new BoxError(BoxError.BUSY, error.message));
            } else if (error && error.code === 'InvalidChangeBatch') {
                debug('del: invalid change batch. No such record to be deleted.');
-                return callback(new DomainsError(DomainsError.NOT_FOUND, error.message));
+                return callback(new BoxError(BoxError.NOT_FOUND, error.message));
            } else if (error) {
                debug('del: error', error);
-                return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+                return callback(new BoxError(BoxError.EXTERNAL_ERROR, error.message));
            }

            callback(null);
@@ -252,8 +252,8 @@ function verifyDnsConfig(domainObject, callback) {
    const dnsConfig = domainObject.config,
        zoneName = domainObject.zoneName;

-    if (!dnsConfig.accessKeyId || typeof dnsConfig.accessKeyId !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'accessKeyId must be a non-empty string'));
-    if (!dnsConfig.secretAccessKey || typeof dnsConfig.secretAccessKey !== 'string') return callback(new DomainsError(DomainsError.BAD_FIELD, 'secretAccessKey must be a non-empty string'));
+    if (!dnsConfig.accessKeyId || typeof dnsConfig.accessKeyId !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'accessKeyId must be a non-empty string', { field: 'accessKeyId' }));
+    if (!dnsConfig.secretAccessKey || typeof dnsConfig.secretAccessKey !== 'string') return callback(new BoxError(BoxError.BAD_FIELD, 'secretAccessKey must be a non-empty string', { field: 'secretAccessKey' }));

    var credentials = {
        accessKeyId: dnsConfig.accessKeyId,
@@ -268,15 +268,15 @@ function verifyDnsConfig(domainObject, callback) {
    if (process.env.BOX_ENV === 'test') return callback(null, credentials); // this shouldn't be here

    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        getHostedZone(credentials, zoneName, function (error, zone) {
            if (error) return callback(error);

            if (!_.isEqual(zone.DelegationSet.NameServers.sort(), nameservers.sort())) {
                debug('verifyDnsConfig: %j and %j do not match', nameservers, zone.DelegationSet.NameServers);
-                return callback(new DomainsError(DomainsError.BAD_FIELD, 'Domain nameservers are not set to Route53'));
+                return callback(new BoxError(BoxError.BAD_FIELD, 'Domain nameservers are not set to Route53', { field: 'nameservers' }));
            }

            const location = 'cloudrontestdns';
@@ -4,9 +4,9 @@ exports = module.exports = waitForDns;

 var assert = require('assert'),
    async = require('async'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/waitfordns'),
-    dns = require('../native-dns.js'),
-    DomainsError = require('../domains.js').DomainsError;
+    dns = require('../native-dns.js');

 function resolveIp(hostname, options, callback) {
    assert.strictEqual(typeof hostname, 'string');
@@ -92,12 +92,12 @@ function waitForDns(hostname, zoneName, type, value, options, callback) {
        debug(`waitForDns (try ${attempt}): ${hostname} to be ${value} in zone ${zoneName}`);

        dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-            if (error || !nameservers) return retryCallback(error || new DomainsError(DomainsError.EXTERNAL_ERROR, 'Unable to get nameservers'));
+            if (error || !nameservers) return retryCallback(error || new BoxError(BoxError.EXTERNAL_ERROR, 'Unable to get nameservers'));

            async.every(nameservers, isChangeSynced.bind(null, hostname, type, value), function (error, synced) {
                debug('waitForDns: %s %s ns: %j', hostname, synced ? 'done' : 'not done', nameservers);

-                retryCallback(synced ? null : new DomainsError(DomainsError.EXTERNAL_ERROR, 'ETRYAGAIN'));
+                retryCallback(synced ? null : new BoxError(BoxError.EXTERNAL_ERROR, 'ETRYAGAIN'));
            });
        });
    }, function retryDone(error) {
@@ -11,10 +11,10 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('../boxerror.js'),
    debug = require('debug')('box:dns/manual'),
    dns = require('../native-dns.js'),
    domains = require('../domains.js'),
-    DomainsError = require('../domains.js').DomainsError,
    sysinfo = require('../sysinfo.js'),
    util = require('util'),
    waitForDns = require('./waitfordns.js');
@@ -23,6 +23,7 @@ function removePrivateFields(domainObject) {
    return domainObject;
 }

+// eslint-disable-next-line no-unused-vars
 function injectPrivateFields(newConfig, currentConfig) {
 }

@@ -78,20 +79,20 @@ function verifyDnsConfig(domainObject, callback) {

    // Very basic check if the nameservers can be fetched
    dns.resolve(zoneName, 'NS', { timeout: 5000 }, function (error, nameservers) {
-        if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, 'Unable to resolve nameservers for this domain'));
-        if (error || !nameservers) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : 'Unable to get nameservers'));
+        if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, 'Unable to resolve nameservers for this domain', { field: 'nameservers' }));
+        if (error || !nameservers) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : 'Unable to get nameservers', { field: 'nameservers' }));

        const location = 'cloudrontestdns';
        const fqdn = domains.fqdn(location, domainObject);

        dns.resolve(fqdn, 'A', { server: '127.0.0.1', timeout: 5000 }, function (error, result) {
-            if (error && error.code === 'ENOTFOUND') return callback(new DomainsError(DomainsError.BAD_FIELD, `Unable to resolve ${fqdn}`));
-            if (error || !result) return callback(new DomainsError(DomainsError.BAD_FIELD, error ? error.message : `Unable to resolve ${fqdn}`));
+            if (error && error.code === 'ENOTFOUND') return callback(new BoxError(BoxError.BAD_FIELD, `Unable to resolve ${fqdn}`, { field: 'nameservers' }));
+            if (error || !result) return callback(new BoxError(BoxError.BAD_FIELD, error ? error.message : `Unable to resolve ${fqdn}`, { field: 'nameservers' }));

-            sysinfo.getPublicIp(function (error, ip) {
-                if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Failed to detect IP of this server: ${error.message}`));
+            sysinfo.getServerIp(function (error, ip) {
+                if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `Failed to detect IP of this server: ${error.message}`));

-                if (result.length !== 1 || ip !== result[0]) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, `Domain resolves to ${JSON.stringify(result)} instead of ${ip}`));
+                if (result.length !== 1 || ip !== result[0]) return callback(new BoxError(BoxError.EXTERNAL_ERROR, `Domain resolves to ${JSON.stringify(result)} instead of ${ip}`));

                callback(null, {});
            });
@@ -1,13 +1,18 @@
 'use strict';

 exports = module.exports = {
-    DockerError: DockerError,
-
    connection: connectionInstance(),
+
+    testRegistryConfig: testRegistryConfig,
    setRegistryConfig: setRegistryConfig,
+    injectPrivateFields: injectPrivateFields,
+    removePrivateFields: removePrivateFields,
+
+    SECRET_PLACEHOLDER: String.fromCharCode(0x25CF).repeat(8),

    ping: ping,

+    info: info,
    downloadImage: downloadImage,
    createContainer: createContainer,
    startContainer: startContainer,
@@ -24,7 +29,6 @@ exports = module.exports = {
    inspectByName: inspect,
    getEvents: getEvents,
    memoryUsage: memoryUsage,
-    execContainer: execContainer,
    createVolume: createVolume,
    removeVolume: removeVolume,
    clearVolume: clearVolume
@@ -33,67 +37,57 @@ exports = module.exports = {
 // timeout is optional
 function connectionInstance(timeout) {
    var Docker = require('dockerode');
-    var docker;
-
-    if (process.env.BOX_ENV === 'test') {
-        // test code runs a docker proxy on this port
-        docker = new Docker({ host: 'http://localhost', port: 5687, timeout: timeout });
-
-        // proxy code uses this to route to the real docker
-        docker.options = { socketPath: '/var/run/docker.sock' };
-    } else {
-        docker = new Docker({ socketPath: '/var/run/docker.sock', timeout: timeout });
-    }
-
+    var docker = new Docker({ socketPath: '/var/run/docker.sock', timeout: timeout });
    return docker;
 }

 var addons = require('./addons.js'),
    async = require('async'),
    assert = require('assert'),
+    BoxError = require('./boxerror.js'),
    child_process = require('child_process'),
-    config = require('./config.js'),
    constants = require('./constants.js'),
    debug = require('debug')('box:docker.js'),
-    once = require('once'),
    path = require('path'),
+    settings = require('./settings.js'),
    shell = require('./shell.js'),
-    spawn = child_process.spawn,
+    safe = require('safetydance'),
    util = require('util'),
    _ = require('underscore');

 const CLEARVOLUME_CMD = path.join(__dirname, 'scripts/clearvolume.sh'),
    MKDIRVOLUME_CMD = path.join(__dirname, 'scripts/mkdirvolume.sh');

-function DockerError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(DockerError, Error);
-DockerError.INTERNAL_ERROR = 'Internal Error';
-DockerError.NOT_FOUND = 'Not found';
-DockerError.BAD_FIELD = 'Bad field';
-
-function debugApp(app, args) {
+function debugApp(app) {
    assert(typeof app === 'object');

    debug(app.fqdn + ' ' + util.format.apply(util, Array.prototype.slice.call(arguments, 1)));
 }

+function testRegistryConfig(auth, callback) {
+    assert.strictEqual(typeof auth, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
+    let docker = exports.connection;
+    docker.checkAuth(auth, function (error /*, data */) { // this returns a 500 even for auth errors
+        if (error) return callback(new BoxError(BoxError.BAD_FIELD, error, { field: 'serverAddress' }));
+
+        callback();
+    });
+}
+
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.password === exports.SECRET_PLACEHOLDER) newConfig.password = currentConfig.password;
+}
+
+function removePrivateFields(registryConfig) {
+    assert.strictEqual(typeof registryConfig, 'object');
+
+    if (registryConfig.password) registryConfig.password = exports.SECRET_PLACEHOLDER;
+
+    return registryConfig;
+}
+
 function setRegistryConfig(auth, callback) {
    assert.strictEqual(typeof auth, 'object');
    assert.strictEqual(typeof callback, 'function');
@@ -101,10 +95,10 @@ function setRegistryConfig(auth, callback) {
    const isLogin = !!auth.password;

    // currently, auth info is not stashed in the db but maybe it should for restore to work?
-    const cmd = isLogin ? `docker login ${auth.serveraddress} --username ${auth.username} --password ${auth.password}` : `docker logout ${auth.serveraddress}`;
+    const cmd = isLogin ? `docker login ${auth.serverAddress} --username ${auth.username} --password ${auth.password}` : `docker logout ${auth.serverAddress}`;

-    child_process.exec(cmd, { }, function (error, stdout, stderr) {
-        if (error) return callback(new DockerError(DockerError.BAD_FIELD, stderr));
+    child_process.exec(cmd, { }, function (error /*, stdout, stderr */) {
+        if (error) return callback(new BoxError(BoxError.ACCESS_DENIED, error.message));

        callback();
    });
@@ -117,34 +111,67 @@ function ping(callback) {
    var docker = connectionInstance(1000);

    docker.ping(function (error, result) {
-        if (error) return callback(new DockerError(DockerError.INTERNAL_ERROR, error));
-        if (result !== 'OK') return callback(new DockerError(DockerError.INTERNAL_ERROR, 'Unable to ping the docker daemon'));
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));
+        if (result !== 'OK') return callback(new BoxError(BoxError.DOCKER_ERROR, 'Unable to ping the docker daemon'));

        callback(null);
    });
 }

+function getRegistryConfig(image, callback) {
+    const parts = image.split('/');
+    if (parts.length === 2) return callback(null, null); // public docker registry
+
+    settings.getRegistryConfig(function (error, registryConfig) {
+        if (error) return callback(error);
+
+        // https://github.com/apocas/dockerode#pull-from-private-repos
+        const auth = {
+            username: registryConfig.username,
+            password: registryConfig.password,
+            auth: registryConfig.auth || '', // the auth token at login time
+            email: registryConfig.email || '',
+            serveraddress: registryConfig.serverAddress
+        };
+
+        callback(null, auth);
+    });
+}
+
 function pullImage(manifest, callback) {
    var docker = exports.connection;

-    // Use docker CLI here to support downloading of private repos. for dockerode, we have to use
-    // https://github.com/apocas/dockerode#pull-from-private-repos
-    shell.spawn('pullImage', '/usr/bin/docker', [ 'pull', manifest.dockerImage ], {}, function (error) {
-        if (error) {
-            debug(`pullImage: Error pulling image ${manifest.dockerImage} of ${manifest.id}: ${error.message}`);
-            return callback(new Error('Failed to pull image'));
-        }
+    getRegistryConfig(manifest.dockerImage, function (error, authConfig) {
+        if (error) return callback(error);

-        var image = docker.getImage(manifest.dockerImage);
+        debug(`pullImage: will pull ${manifest.dockerImage}. auth: ${authConfig ? 'yes' : 'no'}`);

-        image.inspect(function (err, data) {
-            if (err) return callback(new Error('Error inspecting image:' + err.message));
-            if (!data || !data.Config) return callback(new Error('Missing Config in image:' + JSON.stringify(data, null, 4)));
-            if (!data.Config.Entrypoint && !data.Config.Cmd) return callback(new Error('Only images with entry point are allowed'));
+        docker.pull(manifest.dockerImage, { authconfig: authConfig }, function (error, stream) {
+            if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, 'Unable to pull image. Please check the network or if the image needs authentication. statusCode: ' + error.statusCode));

-            if (data.Config.ExposedPorts) debug('This image of %s exposes ports: %j', manifest.id, data.Config.ExposedPorts);
+            // https://github.com/dotcloud/docker/issues/1074 says each status message
+            // is emitted as a chunk
+            stream.on('data', function (chunk) {
+                var data = safe.JSON.parse(chunk) || { };
+                debug('pullImage %s: %j', manifest.id, data);

-            callback(null);
+                // The data.status here is useless because this is per layer as opposed to per image
+                if (!data.status && data.error) {
+                    debug('pullImage error %s: %s', manifest.id, data.errorDetail.message);
+                }
+            });
+
+            stream.on('end', function () {
+                debug('downloaded image %s of %s successfully', manifest.dockerImage, manifest.id);
+
+                callback(null);
+            });
+
+            stream.on('error', function (error) {
+                debug('error pulling image %s of %s: %j', manifest.dockerImage, manifest.id, error);
+
+                callback(new BoxError(BoxError.DOCKER_ERROR, error.message));
+            });
        });
    });
 }
@@ -176,19 +203,23 @@ function createSubcontainer(app, name, cmd, options, callback) {
    assert.strictEqual(typeof callback, 'function');

    var docker = exports.connection,
-        isAppContainer = !cmd; // non app-containers are like scheduler containers
+        isAppContainer = !cmd; // non app-containers are like scheduler and exec (terminal) containers

    var manifest = app.manifest;
    var exposedPorts = {}, dockerPortBindings = { };
    var domain = app.fqdn;
-    // TODO: these should all have the CLOUDRON_ prefix
-    var stdEnv = [
+    const hostname = isAppContainer ? app.id : name;
+
+    const envPrefix = manifest.manifestVersion <= 1 ? '' : 'CLOUDRON_';
+
+    let stdEnv = [
        'CLOUDRON=1',
        'CLOUDRON_PROXY_IP=172.18.0.1',
-        'WEBADMIN_ORIGIN=' + config.adminOrigin(),
-        'API_ORIGIN=' + config.adminOrigin(),
-        'APP_ORIGIN=https://' + domain,
-        'APP_DOMAIN=' + domain
+        `CLOUDRON_APP_HOSTNAME=${app.id}`,
+        `${envPrefix}WEBADMIN_ORIGIN=${settings.adminOrigin()}`,
+        `${envPrefix}API_ORIGIN=${settings.adminOrigin()}`,
+        `${envPrefix}APP_ORIGIN=https://${domain}`,
+        `${envPrefix}APP_DOMAIN=${domain}`
    ];

    // docker portBindings requires ports to be exposed
@@ -199,7 +230,7 @@ function createSubcontainer(app, name, cmd, options, callback) {
    var portEnv = [];
    for (let portName in app.portBindings) {
        const hostPort = app.portBindings[portName];
-        const portType = portName in manifest.tcpPorts ? 'tcp' : 'udp';
+        const portType = (manifest.tcpPorts && portName in manifest.tcpPorts) ? 'tcp' : 'udp';
        const ports = portType == 'tcp' ? manifest.tcpPorts : manifest.udpPorts;

        var containerPort = ports[portName].containerPort || hostPort;
@@ -227,7 +258,7 @@ function createSubcontainer(app, name, cmd, options, callback) {
    if (!isAppContainer) memoryLimit *= 2;

    addons.getEnvironment(app, function (error, addonEnv) {
-        if (error) return callback(new Error('Error getting addon environment : ' + error));
+        if (error) return callback(error);

        // do no set hostname of containers to location as it might conflict with addons names. for example, an app installed in mail
        // location may not reach mail container anymore by DNS. We cannot set hostname to fqdn either as that sets up the dns
@@ -235,9 +266,9 @@ function createSubcontainer(app, name, cmd, options, callback) {
        // Note that Hostname has no effect on DNS. We have to use the --net-alias for dns.
        // Hostname cannot be set with container NetworkMode
        var containerOptions = {
-            name: name, // used for filtering logs
+            name: name, // for referencing containers
            Tty: isAppContainer,
-            Hostname: app.id, // set to something 'constant' so app containers can use this to communicate (across app updates)
+            Hostname: hostname,
            Image: app.manifest.dockerImage,
            Cmd: (isAppContainer && app.debugMode && app.debugMode.cmd) ? app.debugMode.cmd : cmd,
            Env: stdEnv.concat(addonEnv).concat(portEnv).concat(appEnv),
@@ -273,10 +304,17 @@ function createSubcontainer(app, name, cmd, options, callback) {
                },
                CpuShares: 512, // relative to 1024 for system processes
                VolumesFrom: isAppContainer ? null : [ app.containerId + ':rw' ],
-                NetworkMode: 'cloudron',
+                NetworkMode: 'cloudron', // user defined bridge network
                Dns: ['172.18.0.1'], // use internal dns
                DnsSearch: ['.'], // use internal dns
                SecurityOpt: [ 'apparmor=docker-cloudron-app' ]
+            },
+            NetworkingConfig: {
+                EndpointsConfig: {
+                    cloudron: {
+                        Aliases: [ name ] // this allows sub-containers reach app containers by name
+                    }
+                }
            }
        };

@@ -291,7 +329,11 @@ function createSubcontainer(app, name, cmd, options, callback) {

        debugApp(app, 'Creating container for %s', app.manifest.dockerImage);

-        docker.createContainer(containerOptions, callback);
+        docker.createContainer(containerOptions, function (error, container) {
+            if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));
+
+            callback(null, container);
+        });
    });
 }

@@ -309,7 +351,9 @@ function startContainer(containerId, callback) {
    debug('Starting container %s', containerId);

    container.start(function (error) {
-        if (error && error.statusCode !== 304) return callback(new Error('Error starting container :' + error));
+        if (error && error.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND));
+        if (error && error.statusCode === 400) return callback(new BoxError(BoxError.BAD_FIELD, error)); // e.g start.sh is not executable
+        if (error && error.statusCode !== 304) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        return callback(null);
    });
@@ -333,12 +377,12 @@ function stopContainer(containerId, callback) {
    };

    container.stop(options, function (error) {
-        if (error && (error.statusCode !== 304 && error.statusCode !== 404)) return callback(new Error('Error stopping container:' + error));
+        if (error && (error.statusCode !== 304 && error.statusCode !== 404)) return callback(new BoxError(BoxError.DOCKER_ERROR, 'Error stopping container:' + error.message));

        debug('Waiting for container ' + containerId);

        container.wait(function (error, data) {
-            if (error && (error.statusCode !== 304 && error.statusCode !== 404)) return callback(new Error('Error waiting on container:' + error));
+            if (error && (error.statusCode !== 304 && error.statusCode !== 404)) return callback(new BoxError(BoxError.DOCKER_ERROR, 'Error waiting on container:' + error.message));

            debug('Container %s stopped with status code [%s]', containerId, data ? String(data.StatusCode) : '');

@@ -366,9 +410,12 @@ function deleteContainer(containerId, callback) {
    container.remove(removeOptions, function (error) {
        if (error && error.statusCode === 404) return callback(null);

-        if (error) debug('Error removing container %s : %j', containerId, error);
+        if (error) {
+            debug('Error removing container %s : %j', containerId, error);
+            return callback(new BoxError(BoxError.DOCKER_ERROR, error));
+        }

-        callback(error);
+        callback(null);
    });
 }

@@ -385,7 +432,7 @@ function deleteContainers(appId, options, callback) {
    if (options.managedOnly) labels.push('isCloudronManaged=true');

    docker.listContainers({ all: 1, filters: JSON.stringify({ label: labels }) }, function (error, containers) {
-        if (error) return callback(error);
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        async.eachSeries(containers, function (container, iteratorDone) {
            deleteContainer(container.Id, iteratorDone);
@@ -402,7 +449,7 @@ function stopContainers(appId, callback) {
    debug('stopping containers of %s', appId);

    docker.listContainers({ all: 1, filters: JSON.stringify({ label: [ 'appId=' + appId ] }) }, function (error, containers) {
-        if (error) return callback(error);
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        async.eachSeries(containers, function (container, iteratorDone) {
            stopContainer(container.Id, iteratorDone);
@@ -432,9 +479,12 @@ function deleteImage(manifest, callback) {
        if (error && error.statusCode === 404) return callback(null); // not found
        if (error && error.statusCode === 409) return callback(null); // another container using the image

-        if (error) debug('Error removing image %s : %j', dockerImage, error);
+        if (error) {
+            debug('Error removing image %s : %j', dockerImage, error);
+            return callback(new BoxError(BoxError.DOCKER_ERROR, error));
+        }

-        callback(error);
+        callback(null);
    });
 }

@@ -446,7 +496,7 @@ function getContainerIdByIp(ip, callback) {

    docker.getNetwork('cloudron').inspect(function (error, bridge) {
        if (error && error.statusCode === 404) return callback(new Error('Unable to find the cloudron network'));
-        if (error) return callback(error);
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        var containerId;
        for (var id in bridge.Containers) {
@@ -468,8 +518,8 @@ function inspect(containerId, callback) {
    var container = exports.connection.getContainer(containerId);

    container.inspect(function (error, result) {
-        if (error && error.statusCode === 404) return callback(new DockerError(DockerError.NOT_FOUND));
-        if (error) return callback(new DockerError(DockerError.INTERNAL_ERROR, error));
+        if (error && error.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        callback(null, result);
    });
@@ -482,7 +532,7 @@ function getEvents(options, callback) {
    let docker = exports.connection;

    docker.getEvents(options, function (error, stream) {
-        if (error) return callback(new DockerError(DockerError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        callback(null, stream);
    });
@@ -495,44 +545,13 @@ function memoryUsage(containerId, callback) {
    var container = exports.connection.getContainer(containerId);

    container.stats({ stream: false }, function (error, result) {
-        if (error && error.statusCode === 404) return callback(new DockerError(DockerError.NOT_FOUND));
-        if (error) return callback(new DockerError(DockerError.INTERNAL_ERROR, error));
+        if (error && error.statusCode === 404) return callback(new BoxError(BoxError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        callback(null, result);
    });
 }

-function execContainer(containerId, cmd, options, callback) {
-    assert.strictEqual(typeof containerId, 'string');
-    assert(util.isArray(cmd));
-    assert.strictEqual(typeof options, 'object');
-    assert.strictEqual(typeof callback, 'function');
-
-    callback = once(callback); // ChildProcess exit may or may not be called after error
-
-    var cp = spawn('/usr/bin/docker', [ 'exec', '-i', containerId  ].concat(cmd));
-
-    var chunks = [ ];
-
-    if (options.stdout) {
-        cp.stdout.pipe(options.stdout);
-    } else if (options.bufferStdout) {
-        cp.stdout.on('data', function (chunk) { chunks.push(chunk); });
-    } else {
-        cp.stdout.pipe(process.stdout);
-    }
-
-    cp.on('error', callback);
-    cp.on('exit', function (code, signal) {
-        debug('execContainer code: %s signal: %s', code, signal);
-        if (!callback.called) callback(code ? 'Failed with status ' + code : null, Buffer.concat(chunks));
-    });
-
-    cp.stderr.pipe(options.stderr || process.stderr);
-
-    if (options.stdin) options.stdin.pipe(cp.stdin).on('error', callback);
-}
-
 function createVolume(app, name, volumeDataDir, callback) {
    assert.strictEqual(typeof app, 'object');
    assert.strictEqual(typeof name, 'string');
@@ -560,7 +579,7 @@ function createVolume(app, name, volumeDataDir, callback) {
        if (error) return callback(new Error(`Error creating app data dir: ${error.message}`));

        docker.createVolume(volumeOptions, function (error) {
-            if (error) return callback(error);
+            if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

            callback();
        });
@@ -577,10 +596,14 @@ function clearVolume(app, name, options, callback) {
    let volume = docker.getVolume(name);
    volume.inspect(function (error, v) {
        if (error && error.statusCode === 404) return callback();
-        if (error) return callback(error);
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, error));

        const volumeDataDir = v.Options.device;
-        shell.sudo('clearVolume', [ CLEARVOLUME_CMD, options.removeDirectory ? 'rmdir' : 'clear', volumeDataDir ], {}, callback);
+        shell.sudo('clearVolume', [ CLEARVOLUME_CMD, options.removeDirectory ? 'rmdir' : 'clear', volumeDataDir ], {}, function (error) {
+            if (error) return callback(new BoxError(BoxError.FS_ERROR, error));
+
+            callback();
+        });
    });
 }

@@ -594,8 +617,20 @@ function removeVolume(app, name, callback) {

    let volume = docker.getVolume(name);
    volume.remove(function (error) {
-        if (error && error.statusCode !== 404) return callback(new Error(`removeVolume: Error removing volume of ${app.id} ${error.message}`));
+        if (error && error.statusCode !== 404) return callback(new BoxError(BoxError.DOCKER_ERROR, `removeVolume: Error removing volume of ${app.id} ${error.message}`));

        callback();
    });
 }
+
+function info(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    let docker = exports.connection;
+
+    docker.info(function (error, result) {
+        if (error) return callback(new BoxError(BoxError.DOCKER_ERROR, 'Error connecting to docker'));
+
+        callback(null, result);
+    });
+}
@@ -6,9 +6,9 @@ exports = module.exports = {
 };

 var apps = require('./apps.js'),
-    AppsError = apps.AppsError,
    assert = require('assert'),
-    config = require('./config.js'),
+    BoxError = require('./boxerror.js'),
+    constants = require('./constants.js'),
    express = require('express'),
    debug = require('debug')('box:dockerproxy'),
    http = require('http'),
@@ -29,13 +29,13 @@ function authorizeApp(req, res, next) {
    // - only allow managing and inspection of containers belonging to the app

    // make the tests pass for now
-    if (config.TEST) {
+    if (constants.TEST) {
        req.app = { id: 'testappid' };
        return next();
    }

    apps.getByIpAddress(req.connection.remoteAddress, function (error, app) {
-        if (error && error.reason === AppsError.NOT_FOUND) return next(new HttpError(401, 'Unauthorized'));
+        if (error && error.reason === BoxError.NOT_FOUND) return next(new HttpError(401, 'Unauthorized'));
        if (error) return next(new HttpError(500, error));

        if (!('docker' in app.manifest.addons)) return next(new HttpError(401, 'Unauthorized'));
@@ -67,6 +67,7 @@ function attachDockerRequest(req, res, next) {
    next();
 }

+// eslint-disable-next-line no-unused-vars
 function containersCreate(req, res, next) {
    safe.set(req.body, 'HostConfig.NetworkMode', 'cloudron'); // overwrite the network the container lives in
    safe.set(req.body, 'NetworkingConfig', {}); // drop any custom network configs
@@ -97,6 +98,7 @@ function containersCreate(req, res, next) {
    req.dockerRequest.end(plainBody);
 }

+// eslint-disable-next-line no-unused-vars
 function process(req, res, next) {
    // we have to rebuild the body since we consumed in in the parser
    if (Object.keys(req.body).length !== 0) {
@@ -120,7 +122,7 @@ function start(callback) {

    let proxyServer = express();

-    if (config.TEST) {
+    if (constants.TEST) {
        proxyServer.use(function (req, res, next) {
            debug('proxying: ' + req.method, req.url);
            next();
@@ -135,10 +137,11 @@ function start(callback) {
        .use(middleware.lastMile());

    gHttpServer = http.createServer(proxyServer);
-    gHttpServer.listen(config.get('dockerProxyPort'), '0.0.0.0', callback);
+    gHttpServer.listen(constants.DOCKER_PROXY_PORT, '0.0.0.0', callback);

-    debug(`startDockerProxy: started proxy on port ${config.get('dockerProxyPort')}`);
+    debug(`startDockerProxy: started proxy on port ${constants.DOCKER_PROXY_PORT}`);

+    // eslint-disable-next-line no-unused-vars
    gHttpServer.on('upgrade', function (req, client, head) {
        // Create a new tcp connection to the TCP server
        var remote = net.connect('/var/run/docker.sock', function () {
@@ -150,7 +153,7 @@ function start(callback) {
            if (req.headers['content-type'] === 'application/json') {
                // TODO we have to parse the immediate upgrade request body, but I don't know how
                let plainBody = '{"Detach":false,"Tty":false}\r\n';
-                upgradeMessage += `Content-Type: application/json\r\n`;
+                upgradeMessage += 'Content-Type: application/json\r\n';
                upgradeMessage += `Content-Length: ${Buffer.byteLength(plainBody)}\r\n`;
                upgradeMessage += '\r\n';
                upgradeMessage += plainBody;
@@ -12,8 +12,8 @@ exports = module.exports = {
 };

 var assert = require('assert'),
+    BoxError = require('./boxerror.js'),
    database = require('./database.js'),
-    DatabaseError = require('./databaseerror'),
    safe = require('safetydance');

 var DOMAINS_FIELDS = [ 'domain', 'zoneName', 'provider', 'configJson', 'tlsConfigJson', 'locked' ].join(',');
@@ -34,8 +34,8 @@ function get(domain, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query(`SELECT ${DOMAINS_FIELDS} FROM domains WHERE domain=?`, [ domain ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Domain not found'));

        postProcess(result[0]);

@@ -45,7 +45,7 @@ function get(domain, callback) {

 function getAll(callback) {
    database.query(`SELECT ${DOMAINS_FIELDS} FROM domains ORDER BY domain`, function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        results.forEach(postProcess);

@@ -63,8 +63,8 @@ function add(name, domain, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('INSERT INTO domains (domain, zoneName, provider, configJson, tlsConfigJson) VALUES (?, ?, ?, ?, ?)', [ name, domain.zoneName, domain.provider, JSON.stringify(domain.config), JSON.stringify(domain.tlsConfig) ], function (error) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS, error));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -91,8 +91,8 @@ function update(name, domain, callback) {
    args.push(name);

    database.query('UPDATE domains SET ' + fields.join(', ') + ' WHERE domain=?', args, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(new BoxError(BoxError.NOT_FOUND, 'Domain not found'));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -103,9 +103,9 @@ function del(domain, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM domains WHERE domain=?', [ domain ], function (error, result) {
-        if (error && error.code === 'ER_ROW_IS_REFERENCED_2') return callback(new DatabaseError(DatabaseError.IN_USE));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error && error.code === 'ER_ROW_IS_REFERENCED_2') return callback(new BoxError(BoxError.CONFLICT));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Domain not found'));

        callback(null);
    });
@@ -113,7 +113,7 @@ function del(domain, callback) {

 function clear(callback) {
    database.query('DELETE FROM domains', function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(error);
    });
@@ -26,59 +26,28 @@ module.exports = exports = {

    parentDomain: parentDomain,

-    prepareDashboardDomain: prepareDashboardDomain,
+    checkDnsRecords: checkDnsRecords,

-    DomainsError: DomainsError,
+    prepareDashboardDomain: prepareDashboardDomain,

    SECRET_PLACEHOLDER: String.fromCharCode(0x25CF).repeat(8)
 };

 var assert = require('assert'),
    async = require('async'),
-    config = require('./config.js'),
+    BoxError = require('./boxerror.js'),
    constants = require('./constants.js'),
-    DatabaseError = require('./databaseerror.js'),
    debug = require('debug')('box:domains'),
    domaindb = require('./domaindb.js'),
    eventlog = require('./eventlog.js'),
    reverseProxy = require('./reverseproxy.js'),
-    ReverseProxyError = reverseProxy.ReverseProxyError,
    safe = require('safetydance'),
+    settings = require('./settings.js'),
    sysinfo = require('./sysinfo.js'),
    tld = require('tldjs'),
    util = require('util'),
    _ = require('underscore');

-function DomainsError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(DomainsError, Error);
-
-DomainsError.NOT_FOUND = 'No such domain';
-DomainsError.ALREADY_EXISTS = 'Domain already exists';
-DomainsError.EXTERNAL_ERROR = 'External error';
-DomainsError.BAD_FIELD = 'Bad Field';
-DomainsError.STILL_BUSY = 'Still busy';
-DomainsError.IN_USE = 'In Use';
-DomainsError.INTERNAL_ERROR = 'Internal error';
-DomainsError.ACCESS_DENIED = 'Access denied';
-DomainsError.INVALID_PROVIDER = 'provider must be route53, gcdns, digitalocean, gandi, cloudflare, namecom, noop, wildcard, manual or caas';
-
 // choose which subdomain backend we use for test purpose we use route53
 function api(provider) {
    assert.strictEqual(typeof provider, 'string');
@@ -113,16 +82,14 @@ function verifyDnsConfig(dnsConfig, domain, zoneName, provider, callback) {
    assert.strictEqual(typeof callback, 'function');

    var backend = api(provider);
-    if (!backend) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid provider'));
+    if (!backend) return callback(new BoxError(BoxError.BAD_FIELD, 'Invalid provider', { field: 'provider' }));

    const domainObject = { config: dnsConfig, domain: domain, zoneName: zoneName };
    api(provider).verifyDnsConfig(domainObject, function (error, result) {
-        if (error && error.reason === DomainsError.ACCESS_DENIED) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Incorrect configuration. Access denied'));
-        if (error && error.reason === DomainsError.NOT_FOUND) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Zone not found'));
-        if (error && error.reason === DomainsError.EXTERNAL_ERROR) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Configuration error: ' + error.message));
-        if (error && error.reason === DomainsError.BAD_FIELD) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
-        if (error && error.reason === DomainsError.INVALID_PROVIDER) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error && error.reason === BoxError.ACCESS_DENIED) return callback(new BoxError(BoxError.BAD_FIELD, 'Incorrect configuration. Access denied'));
+        if (error && error.reason === BoxError.NOT_FOUND) return callback(new BoxError(BoxError.BAD_FIELD, 'Zone not found'));
+        if (error && error.reason === BoxError.EXTERNAL_ERROR) return callback(new BoxError(BoxError.BAD_FIELD, 'Configuration error: ' + error.message));
+        if (error) return callback(error);

        result.hyphenatedSubdomains = !!dnsConfig.hyphenatedSubdomains;

@@ -145,29 +112,28 @@ function validateHostname(location, domainObject) {
    const hostname = fqdn(location, domainObject);

    const RESERVED_LOCATIONS = [
-        constants.API_LOCATION,
        constants.SMTP_LOCATION,
        constants.IMAP_LOCATION
    ];
-    if (RESERVED_LOCATIONS.indexOf(location) !== -1) return new DomainsError(DomainsError.BAD_FIELD, location + ' is reserved');
+    if (RESERVED_LOCATIONS.indexOf(location) !== -1) return new BoxError(BoxError.BAD_FIELD, location + ' is reserved', { field: 'location' });

-    if (hostname === config.adminFqdn()) return new DomainsError(DomainsError.BAD_FIELD, location + ' is reserved');
+    if (hostname === settings.adminFqdn()) return new BoxError(BoxError.BAD_FIELD, location + ' is reserved', { field: 'location' });

    // workaround https://github.com/oncletom/tld.js/issues/73
    var tmp = hostname.replace('_', '-');
-    if (!tld.isValid(tmp)) return new DomainsError(DomainsError.BAD_FIELD, 'Hostname is not a valid domain name');
+    if (!tld.isValid(tmp)) return new BoxError(BoxError.BAD_FIELD, 'Hostname is not a valid domain name', { field: 'location' });

-    if (hostname.length > 253) return new DomainsError(DomainsError.BAD_FIELD, 'Hostname length exceeds 253 characters');
+    if (hostname.length > 253) return new BoxError(BoxError.BAD_FIELD, 'Hostname length exceeds 253 characters', { field: 'location' });

    if (location) {
        // label validation
-        if (location.split('.').some(function (p) { return p.length > 63 || p.length < 1; })) return new DomainsError(DomainsError.BAD_FIELD, 'Invalid subdomain length');
-        if (location.match(/^[A-Za-z0-9-.]+$/) === null) return new DomainsError(DomainsError.BAD_FIELD, 'Subdomain can only contain alphanumeric, hyphen and dot');
-        if (/^[-.]/.test(location)) return new DomainsError(DomainsError.BAD_FIELD, 'Subdomain cannot start or end with hyphen or dot');
+        if (location.split('.').some(function (p) { return p.length > 63 || p.length < 1; })) return new BoxError(BoxError.BAD_FIELD, 'Invalid subdomain length', { field: 'location' });
+        if (location.match(/^[A-Za-z0-9-.]+$/) === null) return new BoxError(BoxError.BAD_FIELD, 'Subdomain can only contain alphanumeric, hyphen and dot', { field: 'location' });
+        if (/^[-.]/.test(location)) return new BoxError(BoxError.BAD_FIELD, 'Subdomain cannot start or end with hyphen or dot', { field: 'location' });
    }

    if (domainObject.config.hyphenatedSubdomains) {
-        if (location.indexOf('.') !== -1) return new DomainsError(DomainsError.BAD_FIELD, 'Subdomain cannot contain a dot');
+        if (location.indexOf('.') !== -1) return new BoxError(BoxError.BAD_FIELD, 'Subdomain cannot contain a dot', { field: 'location' });
    }

    return null;
@@ -184,12 +150,12 @@ function validateTlsConfig(tlsConfig, dnsProvider) {
    case 'caas':
        break;
    default:
-        return new DomainsError(DomainsError.BAD_FIELD, 'tlsConfig.provider must be caas, fallback, letsencrypt-prod/staging');
+        return new BoxError(BoxError.BAD_FIELD, 'tlsConfig.provider must be caas, fallback, letsencrypt-prod/staging', { field: 'tlsProvider' });
    }

    if (tlsConfig.wildcard) {
-        if (!tlsConfig.provider.startsWith('letsencrypt')) return new DomainsError(DomainsError.BAD_FIELD, 'wildcard can only be set with letsencrypt');
-        if (dnsProvider === 'manual' || dnsProvider === 'noop' || dnsProvider === 'wildcard') return new DomainsError(DomainsError.BAD_FIELD, 'wildcard cert requires a programmable DNS backend');
+        if (!tlsConfig.provider.startsWith('letsencrypt')) return new BoxError(BoxError.BAD_FIELD, 'wildcard can only be set with letsencrypt', { field: 'wildcard' });
+        if (dnsProvider === 'manual' || dnsProvider === 'noop' || dnsProvider === 'wildcard') return new BoxError(BoxError.BAD_FIELD, 'wildcard cert requires a programmable DNS backend', { field: 'tlsProvider' });
    }

    return null;
@@ -206,22 +172,22 @@ function add(domain, data, auditSource, callback) {

    let { zoneName, provider, config, fallbackCertificate, tlsConfig } = data;

-    if (!tld.isValid(domain)) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid domain'));
-    if (domain.endsWith('.')) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid domain'));
+    if (!tld.isValid(domain)) return callback(new BoxError(BoxError.BAD_FIELD, 'Invalid domain', { field: 'domain' }));
+    if (domain.endsWith('.')) return callback(new BoxError(BoxError.BAD_FIELD, 'Invalid domain', { field: 'domain' }));

    if (zoneName) {
-        if (!tld.isValid(zoneName)) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid zoneName'));
-        if (zoneName.endsWith('.')) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid zoneName'));
+        if (!tld.isValid(zoneName)) return callback(new BoxError(BoxError.BAD_FIELD, 'Invalid zoneName', { field: 'zoneName' }));
+        if (zoneName.endsWith('.')) return callback(new BoxError(BoxError.BAD_FIELD, 'Invalid zoneName', { field: 'zoneName' }));
    } else {
        zoneName = tld.getDomain(domain) || domain;
    }

    if (fallbackCertificate) {
        let error = reverseProxy.validateCertificate('test', { domain, config }, fallbackCertificate);
-        if (error) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
+        if (error) return callback(error);
    } else {
        fallbackCertificate = reverseProxy.generateFallbackCertificateSync({ domain, config });
-        if (fallbackCertificate.error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, fallbackCertificate.error));
+        if (fallbackCertificate.error) return callback(error);
    }

    let error = validateTlsConfig(tlsConfig, provider);
@@ -231,11 +197,10 @@ function add(domain, data, auditSource, callback) {
        if (error) return callback(error);

        domaindb.add(domain, { zoneName: zoneName, provider: provider, config: sanitizedConfig, tlsConfig: tlsConfig }, function (error) {
-            if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new DomainsError(DomainsError.ALREADY_EXISTS));
-            if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+            if (error) return callback(error);

            reverseProxy.setFallbackCertificate(domain, fallbackCertificate, function (error) {
-                if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+                if (error) return callback(error);

                eventlog.add(eventlog.ACTION_DOMAIN_ADD, auditSource, { domain, zoneName, provider });

@@ -251,16 +216,13 @@ function get(domain, callback) {

    domaindb.get(domain, function (error, result) {
        // TODO try to find subdomain entries maybe based on zoneNames or so
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
-
-        reverseProxy.getFallbackCertificate(domain, function (error, bundle) {
-            if (error && error.reason !== ReverseProxyError.NOT_FOUND) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

+        reverseProxy.getFallbackCertificate(domain, function (_, bundle) { // never returns an error
            var cert = safe.fs.readFileSync(bundle.certFilePath, 'utf-8');
            var key = safe.fs.readFileSync(bundle.keyFilePath, 'utf-8');

-            if (!cert || !key) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, 'unable to read certificates from disk'));
+            if (!cert || !key) return callback(new BoxError(BoxError.FS_ERROR, 'unable to read certificates from disk'));

            result.fallbackCertificate = { cert: cert, key: key };

@@ -273,7 +235,7 @@ function getAll(callback) {
    assert.strictEqual(typeof callback, 'function');

    domaindb.getAll(function (error, result) {
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -292,18 +254,17 @@ function update(domain, data, auditSource, callback) {
    let { zoneName, provider, config, fallbackCertificate, tlsConfig } = data;

    domaindb.get(domain, function (error, domainObject) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        if (zoneName) {
-            if (!tld.isValid(zoneName)) return callback(new DomainsError(DomainsError.BAD_FIELD, 'Invalid zoneName'));
+            if (!tld.isValid(zoneName)) return callback(new BoxError(BoxError.BAD_FIELD, 'Invalid zoneName', { field: 'zoneName' }));
        } else {
            zoneName = domainObject.zoneName;
        }

        if (fallbackCertificate) {
            let error = reverseProxy.validateCertificate('test', domainObject, fallbackCertificate);
-            if (error) return callback(new DomainsError(DomainsError.BAD_FIELD, error.message));
+            if (error) return callback(error);
        }

        error = validateTlsConfig(tlsConfig, provider);
@@ -322,13 +283,12 @@ function update(domain, data, auditSource, callback) {
            };

            domaindb.update(domain, newData, function (error) {
-                if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
-                if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+                if (error) return callback(error);

                if (!fallbackCertificate) return callback();

                reverseProxy.setFallbackCertificate(domain, fallbackCertificate, function (error) {
-                    if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+                    if (error) return callback(error);

                    eventlog.add(eventlog.ACTION_DOMAIN_UPDATE, auditSource, { domain, zoneName, provider });

@@ -344,12 +304,10 @@ function del(domain, auditSource, callback) {
    assert.strictEqual(typeof auditSource, 'object');
    assert.strictEqual(typeof callback, 'function');

-    if (domain === config.adminDomain()) return callback(new DomainsError(DomainsError.IN_USE));
+    if (domain === settings.adminDomain()) return callback(new BoxError(BoxError.CONFLICT, 'Cannot remove admin domain'));

    domaindb.del(domain, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new DomainsError(DomainsError.NOT_FOUND));
-        if (error && error.reason === DatabaseError.IN_USE) return callback(new DomainsError(DomainsError.IN_USE));
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        eventlog.add(eventlog.ACTION_DOMAIN_REMOVE, auditSource, { domain });

@@ -361,7 +319,7 @@ function clear(callback) {
    assert.strictEqual(typeof callback, 'function');

    domaindb.clear(function (error) {
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null);
    });
@@ -395,7 +353,7 @@ function getDnsRecords(location, domain, type, callback) {
    assert.strictEqual(typeof callback, 'function');

    get(domain, function (error, domainObject) {
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        api(domainObject.provider).get(domainObject, location, type, function (error, values) {
            if (error) return callback(error);
@@ -405,6 +363,25 @@ function getDnsRecords(location, domain, type, callback) {
    });
 }

+function checkDnsRecords(location, domain, callback) {
+    assert.strictEqual(typeof location, 'string');
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    getDnsRecords(location, domain, 'A', function (error, values) {
+        if (error) return callback(error);
+
+        sysinfo.getServerIp(function (error, ip) {
+            if (error) return callback(error);
+
+            if (values.length === 0) return callback(null, { needsOverwrite: false }); // does not exist
+            if (values[0] === ip) return callback(null, { needsOverwrite: false }); // exists but in sync
+
+            callback(null, { needsOverwrite: true });
+        });
+    });
+}
+
 // note: for TXT records the values must be quoted
 function upsertDnsRecords(location, domain, type, values, callback) {
    assert.strictEqual(typeof location, 'string');
@@ -416,7 +393,7 @@ function upsertDnsRecords(location, domain, type, values, callback) {
    debug('upsertDNSRecord: %s on %s type %s values', location, domain, type, values);

    get(domain, function (error, domainObject) {
-        if (error) return callback(new DomainsError(DomainsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        api(domainObject.provider).upsert(domainObject, location, type, values, function (error) {
            if (error) return callback(error);
@@ -439,7 +416,7 @@ function removeDnsRecords(location, domain, type, values, callback) {
        if (error) return callback(error);

        api(domainObject.provider).del(domainObject, location, type, values, function (error) {
-            if (error && error.reason !== DomainsError.NOT_FOUND) return callback(error);
+            if (error && error.reason !== BoxError.NOT_FOUND) return callback(error);

            callback(null);
        });
@@ -494,15 +471,17 @@ function prepareDashboardDomain(domain, auditSource, progressCallback, callback)
    get(domain, function (error, domainObject) {
        if (error) return callback(error);

-        sysinfo.getPublicIp(function (error, ip) {
-            if (error) return callback(new DomainsError(DomainsError.EXTERNAL_ERROR, error.message));
+        const adminFqdn = fqdn(constants.ADMIN_LOCATION, domainObject);
+
+        sysinfo.getServerIp(function (error, ip) {
+            if (error) return callback(error);

            async.series([
-                (done) => { progressCallback({ percent: 10, message: 'Updating DNS' }); done(); },
+                (done) => { progressCallback({ percent: 10, message: `Updating DNS of ${adminFqdn}` }); done(); },
                upsertDnsRecords.bind(null, constants.ADMIN_LOCATION, domain, 'A', [ ip ]),
-                (done) => { progressCallback({ percent: 40, message: 'Waiting for DNS' }); done(); },
+                (done) => { progressCallback({ percent: 40, message: `Waiting for DNS of ${adminFqdn}` }); done(); },
                waitForDnsRecord.bind(null, constants.ADMIN_LOCATION, domain, 'A', ip, { interval: 30000, times: 50000 }),
-                (done) => { progressCallback({ percent: 70, message: 'Getting certificate' }); done(); },
+                (done) => { progressCallback({ percent: 70, message: `Getting certificate of ${adminFqdn}` }); done(); },
                reverseProxy.ensureCertificate.bind(null, fqdn(constants.ADMIN_LOCATION, domainObject), domain, auditSource)
            ], function (error) {
                if (error) return callback(error);
@@ -4,24 +4,24 @@ exports = module.exports = {
    sync: sync
 };

-var appdb = require('./appdb.js'),
-    apps = require('./apps.js'),
+let apps = require('./apps.js'),
+    assert = require('assert'),
    async = require('async'),
-    config = require('./config.js'),
+    constants = require('./constants.js'),
    debug = require('debug')('box:dyndns'),
    domains = require('./domains.js'),
    eventlog = require('./eventlog.js'),
    paths = require('./paths.js'),
    safe = require('safetydance'),
+    settings = require('./settings.js'),
    sysinfo = require('./sysinfo.js');

-var NOOP_CALLBACK = function (error) { if (error) debug(error); };
-
 // called for dynamic dns setups where we have to update the IP
-function sync(callback) {
-    callback = callback || NOOP_CALLBACK;
+function sync(auditSource, callback) {
+    assert.strictEqual(typeof auditSource, 'object');
+    assert.strictEqual(typeof callback, 'function');

-    sysinfo.getPublicIp(function (error, ip) {
+    sysinfo.getServerIp(function (error, ip) {
        if (error) return callback(error);

        let info = safe.JSON.parse(safe.fs.readFileSync(paths.DYNDNS_INFO_FILE, 'utf8')) || { ip: null };
@@ -32,7 +32,7 @@ function sync(callback) {

        debug(`refreshDNS: updating ip from ${info.ip} to ${ip}`);

-        domains.upsertDnsRecords(config.adminLocation(), config.adminDomain(), 'A', [ ip ], function (error) {
+        domains.upsertDnsRecords(constants.ADMIN_LOCATION, settings.adminDomain(), 'A', [ ip ], function (error) {
            if (error) return callback(error);

            debug('refreshDNS: updated admin location');
@@ -42,7 +42,7 @@ function sync(callback) {

                async.each(result, function (app, callback) {
                    // do not change state of installing apps since apptask will error if dns record already exists
-                    if (app.installationState !== appdb.ISTATE_INSTALLED) return callback();
+                    if (app.installationState !== apps.ISTATE_INSTALLED) return callback();

                    domains.upsertDnsRecords(app.location, app.domain, 'A', [ ip ], callback);
                }, function (error) {
@@ -50,7 +50,7 @@ function sync(callback) {

                    debug('refreshDNS: updated apps');

-                    eventlog.add(eventlog.ACTION_DYNDNS_UPDATE, { userId: null, username: 'cron' }, { fromIp: info.ip, toIp: ip });
+                    eventlog.add(eventlog.ACTION_DYNDNS_UPDATE, auditSource, { fromIp: info.ip, toIp: ip });
                    info.ip = ip;
                    safe.fs.writeFileSync(paths.DYNDNS_INFO_FILE, JSON.stringify(info), 'utf8');

@@ -1,8 +1,6 @@
 'use strict';

 exports = module.exports = {
-    EventLogError: EventLogError,
-
    add: add,
    get: get,
    getAllPaged: getAllPaged,
@@ -13,19 +11,20 @@ exports = module.exports = {
    ACTION_ACTIVATE: 'cloudron.activate',
    ACTION_APP_CLONE: 'app.clone',
    ACTION_APP_CONFIGURE: 'app.configure',
+    ACTION_APP_REPAIR: 'app.repair',
    ACTION_APP_INSTALL: 'app.install',
    ACTION_APP_RESTORE: 'app.restore',
    ACTION_APP_UNINSTALL: 'app.uninstall',
    ACTION_APP_UPDATE: 'app.update',
+    ACTION_APP_UPDATE_FINISH: 'app.update.finish',
    ACTION_APP_LOGIN: 'app.login',
    ACTION_APP_OOM: 'app.oom',
    ACTION_APP_UP: 'app.up',
    ACTION_APP_DOWN: 'app.down',
-    ACTION_APP_TASK_CRASH: 'app.task.crash',

    ACTION_BACKUP_FINISH: 'backup.finish',
    ACTION_BACKUP_START: 'backup.start',
-    ACTION_BACKUP_CLEANUP_START: 'backup.cleanup.start',
+    ACTION_BACKUP_CLEANUP_START: 'backup.cleanup.start', // obsolete
    ACTION_BACKUP_CLEANUP_FINISH: 'backup.cleanup.finish',

    ACTION_CERTIFICATE_NEW: 'certificate.new',
@@ -48,6 +47,7 @@ exports = module.exports = {
    ACTION_RESTORE: 'cloudron.restore', // unused
    ACTION_START: 'cloudron.start',
    ACTION_UPDATE: 'cloudron.update',
+    ACTION_UPDATE_FINISH: 'cloudron.update.finish',

    ACTION_USER_ADD: 'user.add',
    ACTION_USER_LOGIN: 'user.login',
@@ -61,7 +61,6 @@ exports = module.exports = {
 };

 var assert = require('assert'),
-    DatabaseError = require('./databaseerror.js'),
    debug = require('debug')('box:eventlog'),
    eventlogdb = require('./eventlogdb.js'),
    notifications = require('./notifications.js'),
@@ -70,28 +69,6 @@ var assert = require('assert'),

 var NOOP_CALLBACK = function (error) { if (error) debug(error); };

-function EventLogError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(EventLogError, Error);
-EventLogError.INTERNAL_ERROR = 'Internal error';
-EventLogError.NOT_FOUND = 'Not Found';
-
 function add(action, source, data, callback) {
    assert.strictEqual(typeof action, 'string');
    assert.strictEqual(typeof source, 'object');
@@ -103,10 +80,10 @@ function add(action, source, data, callback) {
    // we do only daily upserts for login actions, so they don't spam the db
    var api = action === exports.ACTION_USER_LOGIN ? eventlogdb.upsert : eventlogdb.add;
    api(uuid.v4(), action, source, data, function (error, id) {
-        if (error) return callback(new EventLogError(EventLogError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        notifications.onEvent(id, action, source, data, function (error) {
-            if (error) return callback(new EventLogError(EventLogError.INTERNAL_ERROR, error));
+            if (error) return callback(error);

            callback(null, { id: id });
        });
@@ -118,8 +95,7 @@ function get(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    eventlogdb.get(id, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new EventLogError(EventLogError.NOT_FOUND, 'No such event'));
-        if (error) return callback(new EventLogError(EventLogError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, result);
    });
@@ -133,7 +109,7 @@ function getAllPaged(actions, search, page, perPage, callback) {
    assert.strictEqual(typeof callback, 'function');

    eventlogdb.getAllPaged(actions, search, page, perPage, function (error, events) {
-        if (error) return callback(new EventLogError(EventLogError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, events);
    });
@@ -144,7 +120,7 @@ function getByCreationTime(creationTime, callback) {
    assert.strictEqual(typeof callback, 'function');

    eventlogdb.getByCreationTime(creationTime, function (error, events) {
-        if (error) return callback(new EventLogError(EventLogError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, events);
    });
@@ -157,7 +133,7 @@ function cleanup(callback) {
    d.setDate(d.getDate() - 10); // 10 days ago

    eventlogdb.delByCreationTime(d, function (error) {
-        if (error) return callback(new EventLogError(EventLogError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null);
    });
@@ -14,8 +14,8 @@ exports = module.exports = {

 var assert = require('assert'),
    async = require('async'),
+    BoxError = require('./boxerror.js'),
    database = require('./database.js'),
-    DatabaseError = require('./databaseerror'),
    mysql = require('mysql'),
    safe = require('safetydance'),
    util = require('util');
@@ -35,8 +35,8 @@ function get(eventId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + EVENTLOG_FIELDS + ' FROM eventlog WHERE id = ?', [ eventId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Eventlog not found'));

        callback(null, postProcess(result[0]));
    });
@@ -68,7 +68,7 @@ function getAllPaged(actions, search, page, perPage, callback) {
    data.push(perPage);

    database.query(query, data, function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        results.forEach(postProcess);

@@ -82,7 +82,7 @@ function getByCreationTime(creationTime, callback) {

    var query = 'SELECT ' + EVENTLOG_FIELDS + ' FROM eventlog WHERE creationTime >= ? ORDER BY creationTime DESC';
    database.query(query, [ creationTime ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        results.forEach(postProcess);

@@ -98,8 +98,8 @@ function add(id, action, source, data, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('INSERT INTO eventlog (id, action, source, data) VALUES (?, ?, ?, ?)', [ id, action, JSON.stringify(source), JSON.stringify(data) ], function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS, error));
-        if (error || result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS, error));
+        if (error || result.affectedRows !== 1) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, id);
    });
@@ -123,7 +123,7 @@ function upsert(id, action, source, data, callback) {
    }];

    database.transaction(queries, function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
        if (result[0].affectedRows >= 1) return callback(null, result[1][0].id);

        // no existing eventlog found, create one
@@ -135,7 +135,7 @@ function count(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT COUNT(*) AS total FROM eventlog', function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        return callback(null, result[0].total);
    });
@@ -143,9 +143,9 @@ function count(callback) {

 function clear(callback) {
    database.query('DELETE FROM eventlog', function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

-        callback(error);
+        callback(null);
    });
 }

@@ -153,19 +153,19 @@ function delByCreationTime(creationTime, callback) {
    assert(util.isDate(creationTime));
    assert.strictEqual(typeof callback, 'function');

-    // since notifications reference eventlog items, we have to clean them up as well
-    database.query('SELECT * FROM eventlog WHERE creationTime < ?', [ creationTime ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+    // remove notifications that reference the events as well
+    database.query('SELECT * FROM eventlog WHERE creationTime <= ?', [ creationTime ], function (error, result) {
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

-        async.eachSeries(result, function (item, callback) {
-            database.query('DELETE FROM notifications WHERE eventId=?', [ item.id ], function (error) {
-                if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        async.eachSeries(result, function (item, iteratorCallback) {
+            async.series([
+                database.query.bind(null, 'DELETE FROM notifications WHERE eventId=?', [ item.id ]),
+                database.query.bind(null, 'DELETE FROM eventlog WHERE id=?', [ item.id ])
+            ], iteratorCallback);
+        }, function (error) {
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

-                database.query('DELETE FROM eventlog WHERE id=?', [ item.id ], function (error) {
-                    if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-                    callback();
-                });
-            });
-        }, callback);
+            callback(null);
+        });
    });
 }
@@ -0,0 +1,256 @@
+'use strict';
+
+exports = module.exports = {
+    verifyPassword: verifyPassword,
+
+    testConfig: testConfig,
+    startSyncer: startSyncer,
+
+    injectPrivateFields: injectPrivateFields,
+    removePrivateFields: removePrivateFields,
+
+    sync: sync
+};
+
+var assert = require('assert'),
+    async = require('async'),
+    auditSource = require('./auditsource.js'),
+    BoxError = require('./boxerror.js'),
+    constants = require('./constants.js'),
+    debug = require('debug')('box:externalldap'),
+    ldap = require('ldapjs'),
+    settings = require('./settings.js'),
+    tasks = require('./tasks.js'),
+    users = require('./users.js');
+
+function injectPrivateFields(newConfig, currentConfig) {
+    if (newConfig.bindPassword === constants.SECRET_PLACEHOLDER) newConfig.bindPassword = currentConfig.bindPassword;
+}
+
+function removePrivateFields(ldapConfig) {
+    assert.strictEqual(typeof ldapConfig, 'object');
+    if (ldapConfig.bindPassword) ldapConfig.bindPassword = constants.SECRET_PLACEHOLDER;
+    return ldapConfig;
+}
+
+// performs service bind if required
+function getClient(externalLdapConfig, callback) {
+    assert.strictEqual(typeof externalLdapConfig, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
+    // basic validation to not crash
+    try { ldap.parseDN(externalLdapConfig.baseDn); } catch (e) { return callback(new BoxError(BoxError.BAD_FIELD, 'invalid baseDn')); }
+    try { ldap.parseFilter(externalLdapConfig.filter); } catch (e) { return callback(new BoxError(BoxError.BAD_FIELD, 'invalid filter')); }
+
+    var client;
+    try {
+        client = ldap.createClient({ url: externalLdapConfig.url });
+    } catch (e) {
+        if (e instanceof ldap.ProtocolError) return callback(new BoxError(BoxError.BAD_FIELD, 'url protocol is invalid'));
+        return callback(new BoxError(BoxError.INTERNAL_ERROR, e));
+    }
+
+    if (!externalLdapConfig.bindDn) return callback(null, client);
+
+    client.bind(externalLdapConfig.bindDn, externalLdapConfig.bindPassword, function (error) {
+        if (error instanceof ldap.InvalidCredentialsError) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+        if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
+
+        callback(null, client, externalLdapConfig);
+    });
+}
+
+function ldapSearch(externalLdapConfig, options, callback) {
+    assert.strictEqual(typeof externalLdapConfig, 'object');
+    assert.strictEqual(typeof options, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
+    getClient(externalLdapConfig, function (error, client) {
+        if (error) return callback(error);
+
+        let searchOptions = {
+            paged: true,
+            filter: ldap.parseFilter(externalLdapConfig.filter),
+            scope: 'sub'    // We may have to make this configurable
+        };
+
+        if (options.filter) { // https://github.com/ldapjs/node-ldapjs/blob/master/docs/filters.md
+            let extraFilter = ldap.parseFilter(options.filter);
+            searchOptions.filter = new ldap.AndFilter({ filters: [ extraFilter, searchOptions.filter ] });
+        }
+
+        debug(`Listing users at ${externalLdapConfig.baseDn} with filter ${searchOptions.filter.toString()}`);
+
+        client.search(externalLdapConfig.baseDn, searchOptions, function (error, result) {
+            if (error instanceof ldap.NoSuchObjectError) return callback(new BoxError(BoxError.NOT_FOUND));
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
+
+            let ldapUsers = [];
+
+            result.on('searchEntry', entry => ldapUsers.push(entry.object));
+            result.on('error', error => callback(new BoxError(BoxError.EXTERNAL_ERROR, error)));
+
+            result.on('end', function (result) {
+                client.unbind();
+
+                if (result.status !== 0) return callback(new BoxError(BoxError.EXTERNAL_ERROR, 'Server returned status ' + result.status));
+
+                callback(null, ldapUsers);
+            });
+        });
+    });
+}
+
+function testConfig(config, callback) {
+    assert.strictEqual(typeof config, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
+    if (config.provider === 'noop') return callback();
+
+    if (!config.url) return callback(new BoxError(BoxError.BAD_FIELD, 'url must not be empty'));
+    if (!config.url.startsWith('ldap://') && !config.url.startsWith('ldaps://')) return callback(new BoxError(BoxError.BAD_FIELD, 'url is missing ldap:// or ldaps:// prefix'));
+    if (!config.usernameField) config.usernameField = 'uid';
+
+    // bindDn may not be a dn!
+    if (!config.baseDn) return callback(new BoxError(BoxError.BAD_FIELD, 'basedn must not be empty'));
+    try { ldap.parseDN(config.baseDn); } catch (e) { return callback(new BoxError(BoxError.BAD_FIELD, 'invalid baseDn')); }
+
+    if (!config.filter) return callback(new BoxError(BoxError.BAD_FIELD, 'filter must not be empty'));
+    try { ldap.parseFilter(config.filter); } catch (e) { return callback(new BoxError(BoxError.BAD_FIELD, 'invalid filter')); }
+
+    getClient(config, function (error, client) {
+        if (error) return callback(error);
+
+        var opts = {
+            filter: config.filter,
+            scope: 'sub'
+        };
+
+        client.search(config.baseDn, opts, function (error, result) {
+            if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
+
+            result.on('searchEntry', function (/* entry */) {});
+            result.on('error', function (error) { client.unbind(); callback(new BoxError(BoxError.BAD_FIELD, `Unable to search directory: ${error.message}`)); });
+            result.on('end', function (/* result */) { client.unbind(); callback(); });
+        });
+    });
+}
+
+function verifyPassword(user, password, callback) {
+    assert.strictEqual(typeof user, 'object');
+    assert.strictEqual(typeof password, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    settings.getExternalLdapConfig(function (error, externalLdapConfig) {
+        if (error) return callback(error);
+        if (externalLdapConfig.provider === 'noop') return callback(new BoxError(BoxError.BAD_STATE, 'not enabled'));
+
+        ldapSearch(externalLdapConfig, { filter: `${externalLdapConfig.usernameField}=${user.username}` }, function (error, ldapUsers) {
+            if (error) return callback(error);
+            if (ldapUsers.length === 0) return callback(new BoxError(BoxError.NOT_FOUND));
+            if (ldapUsers.length > 1) return callback(new BoxError(BoxError.CONFLICT));
+
+            const userDn = ldapUsers[0].dn;
+            let client = ldap.createClient({ url: externalLdapConfig.url });
+
+            client.bind(userDn, password, function (error) {
+                if (error instanceof ldap.InvalidCredentialsError) return callback(new BoxError(BoxError.INVALID_CREDENTIALS));
+                if (error) return callback(new BoxError(BoxError.EXTERNAL_ERROR, error));
+
+                callback();
+            });
+        });
+    });
+}
+
+function startSyncer(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    settings.getExternalLdapConfig(function (error, externalLdapConfig) {
+        if (error) return callback(error);
+        if (externalLdapConfig.provider === 'noop') return callback(new BoxError(BoxError.BAD_STATE, 'not enabled'));
+
+        tasks.add(tasks.TASK_SYNC_EXTERNAL_LDAP, [], function (error, taskId) {
+            if (error) return callback(error);
+
+            tasks.startTask(taskId, {}, function (error, result) {
+                debug('sync: done', error, result);
+            });
+
+            callback(null, taskId);
+        });
+    });
+}
+
+function sync(progressCallback, callback) {
+    assert.strictEqual(typeof progressCallback, 'function');
+    assert.strictEqual(typeof callback, 'function');
+
+    progressCallback({ percent: 10, message: 'Starting ldap user sync' });
+
+    settings.getExternalLdapConfig(function (error, externalLdapConfig) {
+        if (error) return callback(error);
+        if (externalLdapConfig.provider === 'noop') return callback(new BoxError(BoxError.BAD_STATE, 'not enabled'));
+
+        ldapSearch(externalLdapConfig, {}, function (error, ldapUsers) {
+            if (error) return callback(error);
+
+            debug(`Found ${ldapUsers.length} users`);
+            let percent = 10;
+            let step = 90/(ldapUsers.length+1); // ensure no divide by 0
+
+            // we ignore all errors here and just log them for now
+            async.eachSeries(ldapUsers, function (user, iteratorCallback) {
+const delayedCallback = (error) => setTimeout(iteratorCallback, 40000);
+
+                const username = user[externalLdapConfig.usernameField];
+                const email = user.mail;
+                const displayName = user.cn; // user.giveName + ' ' + user.sn
+
+                if (!username || !email || !displayName) {
+                    debug(`[empty username/email/displayName] username=${username} email=${email} displayName=${displayName} usernameField=${externalLdapConfig.usernameField}`);
+                    return delayedCallback();
+                }
+
+                percent += step;
+                progressCallback({ percent, message: `Syncing... ${username}` });
+
+                users.getByUsername(username, function (error, result) {
+                    if (error && error.reason !== BoxError.NOT_FOUND) {
+                        debug(`Could not find user with username ${username}: ${error.message}`);
+                        return delayedCallback();
+                    }
+
+                    if (error) {
+                        debug(`[adding user] username=${username} email=${email} displayName=${displayName}`);
+
+                        users.create(username, null /* password */, email, displayName, { source: 'ldap' }, auditSource.EXTERNAL_LDAP_TASK, function (error) {
+                            if (error) console.error('Failed to create user', user, error);
+                            delayedCallback();
+                        });
+                    } else if (result.source !== 'ldap') {
+                        debug(`[conflicting user] username=${username} email=${email} displayName=${displayName}`);
+
+                        delayedCallback();
+                    } else if (result.email !== email || result.displayName !== displayName) {
+                        debug(`[updating user] username=${username} email=${email} displayName=${displayName}`);
+
+                        users.update(result.id, { email: email, fallbackEmail: email, displayName: displayName }, auditSource.EXTERNAL_LDAP_TASK, function (error) {
+                            if (error) debug('Failed to update user', user, error);
+
+                            delayedCallback();
+                        });
+                    } else {
+                        // user known and up-to-date
+                        debug(`[up-to-date user] username=${username} email=${email} displayName=${displayName}`);
+
+                        delayedCallback();
+                    }
+                });
+            }, function (error) {
+                debug('sync: ldap sync is done', error);
+                callback(error);
+            });
+        });
+    });
+}
@@ -19,6 +19,7 @@ function startGraphite(existingInfra, callback) {
    if (existingInfra.version === infra.version && infra.images.graphite.tag === existingInfra.images.graphite.tag) return callback();

    const cmd = `docker run --restart=always -d --name="graphite" \
+                --hostname graphite \
                --net cloudron \
                --net-alias graphite \
                --log-driver syslog \
@@ -25,8 +25,8 @@ exports = module.exports = {
 };

 var assert = require('assert'),
-    database = require('./database.js'),
-    DatabaseError = require('./databaseerror');
+    BoxError = require('./boxerror.js'),
+    database = require('./database.js');

 var GROUPS_FIELDS = [ 'id', 'name' ].join(',');

@@ -35,8 +35,8 @@ function get(groupId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + GROUPS_FIELDS + ' FROM userGroups WHERE id = ? ORDER BY name', [ groupId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));

        callback(null, result[0]);
    });
@@ -50,8 +50,8 @@ function getWithMembers(groupId, callback) {
                    ' FROM userGroups LEFT OUTER JOIN groupMembers ON userGroups.id = groupMembers.groupId ' +
                    ' WHERE userGroups.id = ? ' +
                    ' GROUP BY userGroups.id', [ groupId ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (results.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (results.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));

        var result = results[0];
        result.userIds = result.userIds ? result.userIds.split(',') : [ ];
@@ -64,7 +64,7 @@ function getAll(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT ' + GROUPS_FIELDS + ' FROM userGroups', function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
@@ -74,8 +74,8 @@ function getAllWithMembers(callback) {
    database.query('SELECT ' + GROUPS_FIELDS + ',GROUP_CONCAT(groupMembers.userId) AS userIds ' +
                    ' FROM userGroups LEFT OUTER JOIN groupMembers ON userGroups.id = groupMembers.groupId ' +
                    ' GROUP BY userGroups.id', function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (results.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (results.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));

        results.forEach(function (result) { result.userIds = result.userIds ? result.userIds.split(',') : [ ]; });

@@ -89,8 +89,8 @@ function add(id, name, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('INSERT INTO userGroups (id, name) VALUES (?, ?)', [ id, name ], function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS, error));
-        if (error || result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS, error));
+        if (error || result.affectedRows !== 1) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -113,9 +113,9 @@ function update(id, data, callback) {
    args.push(id);

    database.query('UPDATE userGroups SET ' + fields.join(', ') + ' WHERE id = ?', args, function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY' && error.sqlMessage.indexOf('userGroups_name') !== -1) return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS, 'name already exists'));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error && error.code === 'ER_DUP_ENTRY' && error.sqlMessage.indexOf('userGroups_name') !== -1) return callback(new BoxError(BoxError.ALREADY_EXISTS, 'name already exists'));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));

        return callback(null);
    });
@@ -131,8 +131,8 @@ function del(id, callback) {
    queries.push({ query: 'DELETE FROM userGroups WHERE id = ?', args: [ id ] });

    database.transaction(queries, function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result[1].affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result[1].affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));

        callback(error);
    });
@@ -142,7 +142,7 @@ function count(callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT COUNT(*) AS total FROM userGroups', function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        return callback(null, result[0].total);
    });
@@ -150,10 +150,10 @@ function count(callback) {

 function clear(callback) {
    database.query('DELETE FROM groupMembers', function (error) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        database.query('DELETE FROM userGroups', function (error) {
-            if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+            if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

            callback(error);
        });
@@ -165,8 +165,8 @@ function getMembers(groupId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT userId FROM groupMembers WHERE groupId=?', [ groupId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        // if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND)); // need to differentiate group with no members and invalid groupId
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        // if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found')); // need to differentiate group with no members and invalid groupId

        callback(error, result.map(function (r) { return r.userId; }));
    });
@@ -184,8 +184,8 @@ function setMembers(groupId, userIds, callback) {
    }

    database.transaction(queries, function (error) {
-        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(error);
    });
@@ -196,8 +196,8 @@ function getMembership(userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT groupId FROM groupMembers WHERE userId=? ORDER BY groupId', [ userId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        // if (result.length === 0) return callback(new DatabaseError(DatabaseError.NOT_FOUND)); // need to differentiate group with no members and invalid groupId
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        // if (result.length === 0) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found')); // need to differentiate group with no members and invalid groupId

        callback(error, result.map(function (r) { return r.groupId; }));
    });
@@ -215,8 +215,8 @@ function setMembership(userId, groupIds, callback) {
    });

    database.transaction(queries, function (error) {
-        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND, error.message));
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new BoxError(BoxError.NOT_FOUND, error.message));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -228,9 +228,9 @@ function addMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('INSERT INTO groupMembers (groupId, userId) VALUES (?, ?)', [ groupId, userId ], function (error, result) {
-        if (error && error.code === 'ER_DUP_ENTRY') return callback(new DatabaseError(DatabaseError.ALREADY_EXISTS, error));
-        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new DatabaseError(DatabaseError.NOT_FOUND));
-        if (error || result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.ALREADY_EXISTS, error));
+        if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));
+        if (error || result.affectedRows !== 1) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null);
    });
@@ -242,8 +242,8 @@ function removeMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('DELETE FROM groupMembers WHERE groupId = ? AND userId = ?', [ groupId, userId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
-        if (result.affectedRows !== 1) return callback(new DatabaseError(DatabaseError.NOT_FOUND));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
+        if (result.affectedRows !== 1) return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));

        callback(null);
    });
@@ -255,7 +255,7 @@ function isMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    database.query('SELECT 1 FROM groupMembers WHERE groupId=? AND userId=?', [ groupId, userId ], function (error, result) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, result.length !== 0);
    });
@@ -267,7 +267,7 @@ function getGroups(userId, callback) {

    database.query('SELECT ' + GROUPS_FIELDS + ' ' +
        ' FROM userGroups INNER JOIN groupMembers ON userGroups.id = groupMembers.groupId AND groupMembers.userId = ?', [ userId ], function (error, results) {
-        if (error) return callback(new DatabaseError(DatabaseError.INTERNAL_ERROR, error));
+        if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));

        callback(null, results);
    });
@@ -1,8 +1,6 @@
 'use strict';

 exports = module.exports = {
-    GroupsError: GroupsError,
-
    create: create,
    remove: remove,
    get: get,
@@ -20,56 +18,29 @@ exports = module.exports = {
    getGroups: getGroups,

    setMembership: setMembership,
-    getMembership: getMembership
+    getMembership: getMembership,
+
+    count: count
 };

 var assert = require('assert'),
+    BoxError = require('./boxerror.js'),
    constants = require('./constants.js'),
-    DatabaseError = require('./databaseerror.js'),
    groupdb = require('./groupdb.js'),
-    util = require('util'),
    uuid = require('uuid'),
    _ = require('underscore');

-// http://dustinsenos.com/articles/customErrorsInNode
-// http://code.google.com/p/v8/wiki/JavaScriptStackTraceApi
-function GroupsError(reason, errorOrMessage) {
-    assert.strictEqual(typeof reason, 'string');
-    assert(errorOrMessage instanceof Error || typeof errorOrMessage === 'string' || typeof errorOrMessage === 'undefined');
-
-    Error.call(this);
-    Error.captureStackTrace(this, this.constructor);
-
-    this.name = this.constructor.name;
-    this.reason = reason;
-    if (typeof errorOrMessage === 'undefined') {
-        this.message = reason;
-    } else if (typeof errorOrMessage === 'string') {
-        this.message = errorOrMessage;
-    } else {
-        this.message = 'Internal error';
-        this.nestedError = errorOrMessage;
-    }
-}
-util.inherits(GroupsError, Error);
-GroupsError.INTERNAL_ERROR = 'Internal Error';
-GroupsError.ALREADY_EXISTS = 'Already Exists';
-GroupsError.NOT_FOUND = 'Not Found';
-GroupsError.BAD_FIELD = 'Field error';
-GroupsError.NOT_EMPTY = 'Not Empty';
-GroupsError.NOT_ALLOWED = 'Not Allowed';
-
 // keep this in sync with validateUsername
 function validateGroupname(name) {
    assert.strictEqual(typeof name, 'string');

-    if (name.length < 1) return new GroupsError(GroupsError.BAD_FIELD, 'name must be atleast 1 char');
-    if (name.length >= 200) return new GroupsError(GroupsError.BAD_FIELD, 'name too long');
+    if (name.length < 1) return new BoxError(BoxError.BAD_FIELD, 'name must be atleast 1 char', { field: 'name' });
+    if (name.length >= 200) return new BoxError(BoxError.BAD_FIELD, 'name too long', { field: 'name' });

-    if (constants.RESERVED_NAMES.indexOf(name) !== -1) return new GroupsError(GroupsError.BAD_FIELD, 'name is reserved');
+    if (constants.RESERVED_NAMES.indexOf(name) !== -1) return new BoxError(BoxError.BAD_FIELD, 'name is reserved', { field: name });

    // need to consider valid LDAP characters here (e.g '+' is reserved)
-    if (/[^a-zA-Z0-9.-]/.test(name)) return new GroupsError(GroupsError.BAD_FIELD, 'name can only contain alphanumerals, hyphen and dot');
+    if (/[^a-zA-Z0-9.-]/.test(name)) return new BoxError(BoxError.BAD_FIELD, 'name can only contain alphanumerals, hyphen and dot', { field: 'name' });

    return null;
 }
@@ -86,8 +57,7 @@ function create(name, callback) {

    var id = 'gid-' + uuid.v4();
    groupdb.add(id, name, function (error) {
-        if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new GroupsError(GroupsError.ALREADY_EXISTS));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, { id: id, name: name });
    });
@@ -98,8 +68,7 @@ function remove(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.del(id, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null);
    });
@@ -110,8 +79,7 @@ function get(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.get(id, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -122,8 +90,7 @@ function getWithMembers(id, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getWithMembers(id, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -133,7 +100,7 @@ function getAll(callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getAll(function (error, result) {
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -143,7 +110,7 @@ function getAllWithMembers(callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getAllWithMembers(function (error, result) {
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -154,8 +121,7 @@ function getMembers(groupId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getMembers(groupId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -166,8 +132,7 @@ function getMembership(userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getMembership(userId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -179,8 +144,7 @@ function setMembership(userId, groupIds, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.setMembership(userId, groupIds, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null);
    });
@@ -192,8 +156,7 @@ function addMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.addMember(groupId, userId, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null);
    });
@@ -205,8 +168,7 @@ function setMembers(groupId, userIds, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.setMembers(groupId, userIds, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND, 'Invalid group or user id'));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null);
    });
@@ -218,8 +180,7 @@ function removeMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.removeMember(groupId, userId, function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null);
    });
@@ -231,8 +192,7 @@ function isMember(groupId, userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.isMember(groupId, userId, function (error, result) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        return callback(null, result);
    });
@@ -251,8 +211,7 @@ function update(groupId, data, callback) {
    }

    groupdb.update(groupId, _.pick(data, 'name'), function (error) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new GroupsError(GroupsError.NOT_FOUND));
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null);
    });
@@ -263,8 +222,18 @@ function getGroups(userId, callback) {
    assert.strictEqual(typeof callback, 'function');

    groupdb.getGroups(userId, function (error, results) {
-        if (error) return callback(new GroupsError(GroupsError.INTERNAL_ERROR, error));
+        if (error) return callback(error);

        callback(null, results);
    });
 }
+
+function count(callback) {
+    assert.strictEqual(typeof callback, 'function');
+
+    groupdb.count(function (error, count) {
+        if (error) return callback(error);
+
+        callback(null, count);
+    });
+}
--- a/Show More
+++ b/Show More