feat: add health check interface and status reporting to provider

feat: implement in-memory vault for secrets management

feat: add template management functionality to Badger store

feat: implement template operations in memory store

feat: add template management to MongoDB store

feat: implement template operations in PostgreSQL store

feat: add template management to SQLite store

feat: enhance worker scheduler with runtime status tracking

Author: juicycleff

Makefile

@@ -99,7 +99,16 @@ clean c:
 ## fmt (f): Format code
 fmt f:
 	@echo "$(BLUE)Formatting code...$(NC)"
-	@gofmt -s -w .
+	@COUNT=0; \
+	ROOT_DIR=$$(pwd); \
+	for modfile in $$(find . -name "go.mod" -type f | grep -v "/vendor/" | sort); do \
+		dir=$$(dirname $$modfile); \
+		echo "  Formatting $$dir..."; \
+		cd "$$ROOT_DIR/$$dir" && $(GO) fmt ./...; \
+		COUNT=$$((COUNT + 1)); \
+	done; \
+	cd "$$ROOT_DIR"; \
+	echo "$(GREEN)✓ Formatted $$COUNT module(s)$(NC)"
 	@command -v goimports >/dev/null 2>&1 && goimports -w -local github.com/xraph/ctrlplane . || echo "$(YELLOW)goimports not found, skipping (run: go install golang.org/x/tools/cmd/goimports@latest)$(NC)"
 	@echo "$(GREEN)✓ Formatting complete$(NC)"
 

admin/admin.go

@@ -40,10 +40,22 @@ type Service interface {
 	// ListProviders returns status of all registered providers.
 	ListProviders(ctx context.Context) ([]ProviderStatus, error)
 
+	// TestProviderHealth runs a health check against a specific provider.
+	TestProviderHealth(ctx context.Context, providerName string) (*ProviderHealthResult, error)
+
 	// QueryAuditLog queries the audit log.
 	QueryAuditLog(ctx context.Context, opts AuditQuery) (*AuditResult, error)
 }
 
+// ProviderHealthResult holds the result of a provider health test.
+type ProviderHealthResult struct {
+	Name      string        `db:"name"       json:"name"`
+	Healthy   bool          `db:"healthy"    json:"healthy"`
+	Message   string        `db:"message"    json:"message"`
+	Latency   time.Duration `db:"latency"    json:"latency"`
+	CheckedAt time.Time     `db:"checked_at" json:"checked_at"`
+}
+
 // CreateTenantRequest holds the parameters for creating a tenant.
 type CreateTenantRequest struct {
 	Name       string            `json:"name"                  validate:"required"`

admin/service_impl.go

@@ -373,6 +373,53 @@ func (s *service) ListProviders(ctx context.Context) ([]ProviderStatus, error) {
 	return statuses, nil
 }
 
+// TestProviderHealth runs a health check against a specific provider.
+func (s *service) TestProviderHealth(ctx context.Context, providerName string) (*ProviderHealthResult, error) {
+	claims, err := auth.RequireClaims(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("test provider health: %w", err)
+	}
+
+	if !claims.IsSystemAdmin() {
+		return nil, fmt.Errorf("test provider health: %w", ctrlplane.ErrForbidden)
+	}
+
+	p, err := s.providers.Get(providerName)
+	if err != nil {
+		return nil, fmt.Errorf("test provider health: %w", err)
+	}
+
+	// If the provider implements HealthChecker, use it.
+	if hc, ok := p.(provider.HealthChecker); ok {
+		status, healthErr := hc.HealthCheck(ctx)
+
+		result := &ProviderHealthResult{
+			Name:      providerName,
+			CheckedAt: time.Now().UTC(),
+		}
+
+		switch {
+		case healthErr != nil:
+			result.Message = healthErr.Error()
+		default:
+			result.Healthy = status.Healthy
+			result.Message = status.Message
+			result.Latency = status.Latency
+			result.CheckedAt = status.CheckedAt
+		}
+
+		return result, nil
+	}
+
+	// Fall back to reporting healthy if no HealthChecker interface.
+	return &ProviderHealthResult{
+		Name:      providerName,
+		Healthy:   true,
+		Message:   "provider does not implement health checking",
+		CheckedAt: time.Now().UTC(),
+	}, nil
+}
+
 // QueryAuditLog queries the audit log.
 func (s *service) QueryAuditLog(ctx context.Context, opts AuditQuery) (*AuditResult, error) {
 	_, err := auth.RequireClaims(ctx)

app/controlplane.go

@@ -18,6 +18,7 @@ import (
 	"github.com/xraph/ctrlplane/plugin"
 	"github.com/xraph/ctrlplane/provider"
 	"github.com/xraph/ctrlplane/secrets"
+	"github.com/xraph/ctrlplane/secrets/memoryvault"
 	"github.com/xraph/ctrlplane/store"
 	"github.com/xraph/ctrlplane/telemetry"
 	"github.com/xraph/ctrlplane/worker"
@@ -27,6 +28,7 @@ import (
 type CtrlPlane struct {
 	config      ctrlplane.Config
 	store       store.Store
+	vault       secrets.Vault
 	auth        auth.Provider
 	providers   *provider.Registry
 	events      event.Bus
@@ -91,6 +93,16 @@ func (cp *CtrlPlane) Events() event.Bus {
 	return cp.events
 }
 
+// Vault returns the vault backend used for secret storage.
+func (cp *CtrlPlane) Vault() secrets.Vault {
+	return cp.vault
+}
+
+// Scheduler returns the background worker scheduler.
+func (cp *CtrlPlane) Scheduler() *worker.Scheduler {
+	return cp.scheduler
+}
+
 // Extensions returns the plugin registry.
 func (cp *CtrlPlane) Extensions() *plugin.Registry {
 	return cp.extensions
@@ -128,11 +140,16 @@ func (cp *CtrlPlane) Stop(ctx context.Context) error {
 
 // wireServices instantiates all service implementations and background workers.
 func (cp *CtrlPlane) wireServices() {
+	// Default to an in-memory vault when none was provided via WithVault.
+	if cp.vault == nil {
+		cp.vault = memoryvault.New()
+	}
+
 	// Instance service.
 	cp.Instances = instance.NewService(cp.store, cp.providers, cp.events, cp.auth)
 
 	// Deploy service with strategies.
-	deploySvc := deploy.NewService(cp.store, cp.store, cp.providers, cp.events, cp.auth)
+	deploySvc := deploy.NewService(cp.store, cp.store, cp.providers, cp.events, cp.auth, cp.vault)
 	deploySvc.RegisterStrategy(strategies.NewRolling())
 	deploySvc.RegisterStrategy(strategies.NewBlueGreen())
 	deploySvc.RegisterStrategy(strategies.NewCanary())
@@ -149,8 +166,8 @@ func (cp *CtrlPlane) wireServices() {
 	// Network service (no external router by default).
 	cp.Network = network.NewService(cp.store, nil, cp.events, cp.auth)
 
-	// Secrets service (no vault by default; users should provide one via options).
-	cp.Secrets = secrets.NewService(cp.store, nil, cp.auth)
+	// Secrets service backed by the configured vault.
+	cp.Secrets = secrets.NewService(cp.store, cp.vault, cp.auth)
 
 	// Admin service.
 	cp.Admin = admin.NewService(cp.store, cp.store, cp.store, cp.store, cp.providers, cp.events, cp.auth)

app/options.go

@@ -6,6 +6,7 @@ import (
 	"github.com/xraph/ctrlplane/event"
 	"github.com/xraph/ctrlplane/plugin"
 	"github.com/xraph/ctrlplane/provider"
+	"github.com/xraph/ctrlplane/secrets"
 	"github.com/xraph/ctrlplane/store"
 )
 
@@ -66,6 +67,15 @@ func WithDefaultProvider(name string) Option {
 	}
 }
 
+// WithVault sets the secret storage backend.
+func WithVault(v secrets.Vault) Option {
+	return func(cp *CtrlPlane) error {
+		cp.vault = v
+
+		return nil
+	}
+}
+
 // WithExtension registers a plugin extension with the control plane.
 func WithExtension(ext plugin.Extension) Option {
 	return func(cp *CtrlPlane) error {

cmd/controlplane/main.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/xraph/forge"
 
-	"github.com/xraph/ctrlplane/app"
 	"github.com/xraph/ctrlplane/extension"
 	"github.com/xraph/ctrlplane/provider/docker"
 	"github.com/xraph/ctrlplane/store/memory"
@@ -34,10 +33,16 @@ func run() error {
 		})),
 	)
 
+	// Create Docker provider with sane defaults.
+	dockerProv, err := docker.New()
+	if err != nil {
+		return err
+	}
+
 	// Register CtrlPlane as a Forge extension
 	cpExt := extension.New(
-		extension.WithStore(app.WithStore(memory.New())),
-		extension.WithProvider("docker", docker.New(docker.Config{})),
+		extension.WithStore(memory.New()),
+		extension.WithProvider("docker", dockerProv),
 		extension.WithBasePath("/api/cp"),
 	)
 

dashboard/components/audit_table.templ

@@ -0,0 +1,59 @@
+package components
+
+import (
+	"github.com/xraph/forgeui/components/badge"
+	"github.com/xraph/forgeui/components/table"
+
+	"github.com/xraph/ctrlplane/admin"
+)
+
+// AuditTable renders a table of audit log entries.
+templ AuditTable(entries []admin.AuditEntry) {
+	if len(entries) == 0 {
+		@EmptyState("scroll-text", "No audit entries", "Actions will be recorded here as they happen.")
+	} else {
+		@table.Table() {
+			@table.Header() {
+				@table.Row() {
+					@table.Head() { Time }
+					@table.Head() { Actor }
+					@table.Head() { Action }
+					@table.Head() { Resource }
+					@table.Head() { Resource ID }
+					@table.Head() { IP Address }
+				}
+			}
+			@table.Body() {
+				for _, entry := range entries {
+					@table.Row() {
+						@table.Cell() {
+							<span class="text-muted-foreground text-xs">{ entry.CreatedAt.Format("Jan 02 15:04:05") }</span>
+						}
+						@table.Cell() {
+							<div class="flex flex-col">
+								<span class="text-sm">{ entry.ActorID }</span>
+								@badge.Badge(badge.Props{Variant: badge.VariantOutline, Class: "text-[10px] w-fit"}) {
+									{ entry.ActorType }
+								}
+							</div>
+						}
+						@table.Cell() {
+							@badge.Badge(badge.Props{Variant: badge.VariantSecondary}) {
+								{ entry.Action }
+							}
+						}
+						@table.Cell() {
+							<span class="text-muted-foreground">{ entry.Resource }</span>
+						}
+						@table.Cell() {
+							<span class="font-mono text-xs text-muted-foreground">{ truncStr(entry.ResourceID, 24) }</span>
+						}
+						@table.Cell() {
+							<span class="text-muted-foreground text-xs">{ entry.IPAddress }</span>
+						}
+					}
+				}
+			}
+		}
+	}
+}