Update installation.md

fix: hide payment details for failed payments (#3393 )
chore: clean prin statement (#3391 )
2025-10-08 16:32:08 +01:00 · 2025-10-08 14:43:40 +02:00 · 2025-10-07 14:39:24 +03:00 · 2025-10-06 17:06:18 +01:00 · 2025-10-06 10:56:12 +02:00 · 2025-10-06 10:53:03 +02:00
294 changed files with 44030 additions and 19462 deletions
@@ -1,8 +1,28 @@
 #For more information on .env files, their content and format: https://pypi.org/project/python-dotenv/

 ######################################
-########### Admin Settings ###########
+###### .env ONLY SETTINGS ############
 ######################################
+# The following settings are ONLY set in your .env file.
+# They are NOT managed by the Admin UI and are not stored in the database.
+
+# === Logging and Development ===
+
+DEBUG=False
+DEBUG_DATABASE=False
+BUNDLE_ASSETS=True
+
+# logging into LNBITS_DATA_FOLDER/logs/
+ENABLE_LOG_TO_FILE=true
+
+# https://loguru.readthedocs.io/en/stable/api/logger.html#file
+LOG_ROTATION="100 MB"
+LOG_RETENTION="3 months"
+    
+# for database cleanup commands
+# CLEANUP_WALLETS_DAYS=90
+
+# === Admin Settings ===

 # Enable Admin GUI, available for the first user in LNBITS_ADMIN_USERS if available.
 # Warning: Enabling this will make LNbits ignore most configurations in file. Only the
@@ -12,30 +32,90 @@
 # Disable this and clear `settings` table from database to make LNbits use this config file again.
 LNBITS_ADMIN_UI=true

+HOST=127.0.0.1
+PORT=5000
+# VERSION=
+# USER_AGENT=
+
+# === LNbits ===
+
+# Database: to use SQLite, specify LNBITS_DATA_FOLDER
+#           to use PostgreSQL, specify LNBITS_DATABASE_URL=postgres://...
+#           to use CockroachDB, specify LNBITS_DATABASE_URL=cockroachdb://...
+# for both PostgreSQL and CockroachDB, you'll need to install
+#   psycopg2 as an additional dependency
+LNBITS_DATA_FOLDER="./data"
+# LNBITS_DATABASE_URL="postgres://user:password@host:port/databasename"
+
+# Extensions to be installed by default. If an extension from this list is uninstalled then it will be re-installed on the next restart.
+# The extension must be removed from this list in order to not be re-installed.
+LNBITS_EXTENSIONS_DEFAULT_INSTALL="tpos"
+
+# LNBITS_EXTENSIONS_MANIFESTS="https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json,https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions-trial.json"
+# GitHub has rate-limits for its APIs. The limit can be increased specifying a GITHUB_TOKEN
+# LNBITS_EXT_GITHUB_TOKEN=github_pat_xxxxxxxxxxxxxxxxxx
+
+# which fundingsources are allowed in the admin ui
+# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet, StrikeWallet, CLNRestWallet"
+
+# uvicorn variable, allow https behind a proxy
+# IMPORTANT: this also needs the webserver to be configured to forward the headers
+# http://docs.lnbits.org/guide/installation.html#running-behind-an-apache2-reverse-proxy-over-https
+FORWARDED_ALLOW_IPS="*"
+
+# Path where extensions will be installed (defaults to `./lnbits/`).
+# Inside this directory the `extensions` and `upgrades` sub-directories will be created.
+# LNBITS_EXTENSIONS_PATH="/path/to/some/dir"
+
+# ID of the super user. The user ID must exist.
+# SUPER_USER=""
+
+# LNBITS_TITLE="LNbits API"
+# LNBITS_PATH="folder/path"
+
+# === Auth Configurations ===
+
+# Secret Key: will default to the hash of the super user.
+# !!!!! It is strongly recommended that you set your own strong random value !!!!
+AUTH_SECRET_KEY=""
+
+# === Funding Source ===# How many times to retry connectiong to the Funding Source before defaulting to the VoidWallet
+# FUNDING_SOURCE_MAX_RETRIES=4
+
+######################################
+###### END .env ONLY SETTINGS ########
+######################################
+
+######################################
+####### Auth Configurations ##########
+######################################
+
+AUTH_TOKEN_EXPIRE_MINUTES=525600
+# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth
+AUTH_ALLOWED_METHODS="user-id-only, username-password"
+# Set this flag if HTTP is used for OAuth
+# OAUTHLIB_INSECURE_TRANSPORT="1"
+
+######################################
+########### Admin Settings ###########
+######################################
+
 # Change theme
 LNBITS_SITE_TITLE="LNbits"
-LNBITS_SITE_TAGLINE="free and open-source lightning wallet"
+LNBITS_SITE_TAGLINE="Open Source Lightning Payments Platform"
 LNBITS_SITE_DESCRIPTION="The world's most powerful suite of bitcoin tools. Run for yourself, for others, or as part of a stack."
 # Choose from bitcoin, mint, flamingo, freedom, salvador, autumn, monochrome, classic, cyber
 LNBITS_THEME_OPTIONS="classic, bitcoin, flamingo, freedom, mint, autumn, monochrome, salvador, cyber"
 # LNBITS_CUSTOM_LOGO="https://lnbits.com/assets/images/logo/logo.svg"

-HOST=127.0.0.1
-PORT=5000
-
 ######################################
 ########## Funding Source ############
 ######################################

-# which fundingsources are allowed in the admin ui
-# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet"
-
 LNBITS_BACKEND_WALLET_CLASS=VoidWallet
 # VoidWallet is just a fallback that works without any actual Lightning capabilities,
 # just so you can see the UI before dealing with this file.

-# How many times to retry connectiong to the Funding Source before defaulting to the VoidWallet
-# FUNDING_SOURCE_MAX_RETRIES=4

 # Invoice expiry for LND, CLN, Eclair, LNbits funding sources
 LIGHTNING_INVOICE_EXPIRY=3600
@@ -49,6 +129,20 @@ CLICHE_ENDPOINT=ws://127.0.0.1:12000
 SPARK_URL=http://localhost:9737/rpc
 SPARK_TOKEN=myaccesstoken

+#CLNRest (using runes)
+CLNREST_URL=https://127.0.0.1:3010
+CLNREST_CA=/home/lightningd/.lightning/bitcoin/ca.pem
+CLNREST_CERT=/home/lightningd/.lightning/bitcoin/server.pem
+# CLNREST_CA = cat ca.pem | awk '{printf "%s\\n", $0} END {printf "\n"}'
+# CLNREST_CERT =  cat server.pem | awk '{printf "%s\\n", $0} END {printf "\n"}'
+
+CLNREST_READONLY_RUNE=lightning-cli createrune restrictions='[["method=listfunds", "method=listpays", "method=listinvoices", "method=getinfo", "method=summary", "method=waitanyinvoice"]]' | jq -r .rune
+CLNREST_INVOICE_RUNE=lightning-cli createrune restrictions='[["method=invoice"], ["pnameamount_msat<1000001"], ["pnamelabel^LNbits"], ["rate=60"]]' | jq -r .rune
+CLNREST_PAY_RUNE=lightning-cli createrune restrictions='[["method=pay"], ["pinvbolt11_amount<1001"],   ["pnamelabel^LNbits"], ["rate=1"]]' | jq -r .rune
+#CLNREST_RENEPAY_RUNE=lightning-cli createrune restrictions='[["method=renepay"], ["pinvinvstring_amount<1001"], ["pnamelabel^LNbits"], ["rate=1"]]' | jq -r .rune
+#CLNREST_LAST_PAY_INDEX='lightning-cli listinvoices | jq -r '.invoices | map(.created_index) | max'
+#CLNREST_NODEID=lightning-cli getinfo | jq -r .id # only required for v23.08
+
 # CoreLightningWallet
 CORELIGHTNING_RPC="/home/bob/.lightning/bitcoin/lightning-rpc"

@@ -89,10 +183,16 @@ ALBY_ACCESS_TOKEN=ALBY_ACCESS_TOKEN

 # BoltzWallet
 BOLTZ_CLIENT_ENDPOINT=127.0.0.1:9002
-BOLTZ_CLIENT_MACAROON="/home/bob/.boltz/macaroon" # or HEXSTRING
-BOLTZ_CLIENT_CERT="/home/bob/.boltz/tls.cert" # or HEXSTRING
+# HEXSTRING instead of path also possible
+BOLTZ_CLIENT_MACAROON="/home/bob/.boltz/macaroons/admin.macaroon"
+# HEXSTRING instead of path also possible
+BOLTZ_CLIENT_CERT="/home/bob/.boltz/tls.cert"
 BOLTZ_CLIENT_WALLET="lnbits"

+# StrikeWallet
+STRIKE_API_ENDPOINT=https://api.strike.me/v1
+STRIKE_API_KEY=YOUR_STRIKE_API_KEY
+
 # ZBDWallet
 ZBD_API_ENDPOINT=https://api.zebedee.io/v0/
 ZBD_API_KEY=ZBD_ACCESS_TOKEN
@@ -133,17 +233,14 @@ BREEZ_GREENLIGHT_SEED=SEED
 BREEZ_GREENLIGHT_INVITE_CODE=CODE
 BREEZ_GREENLIGHT_DEVICE_KEY="/path/to/breezsdk/device.pem"  # or BASE64/HEXSTRING
 BREEZ_GREENLIGHT_DEVICE_CERT="/path/to/breezsdk/device.crt"  # or BASE64/HEXSTRING
+# BREEZ_USE_TRAMPOLINE=true

-######################################
-####### Auth Configurations ##########
-######################################
-# Secret Key: will default to the hash of the super user. It is strongly recommended that you set your own value.
-AUTH_SECRET_KEY=""
-AUTH_TOKEN_EXPIRE_MINUTES=525600
-# Possible authorization methods: user-id-only, username-password, nostr-auth-nip98, google-auth, github-auth, keycloak-auth
-AUTH_ALLOWED_METHODS="user-id-only, username-password"
-# Set this flag if HTTP is used for OAuth
-# OAUTHLIB_INSECURE_TRANSPORT="1"
+# BreezLiquidSdkWallet
+# get your own api key here https://breez.technology/request-api-key/#contact-us-form-sdk
+# or keep the api key empty to use the LNbits key for referrals (API key is not a secret)
+# BREEZ_LIQUID_API_KEY=""
+BREEZ_LIQUID_SEED="MNEMONIC SEED PHRASE"
+# BREEZ_LIQUID_FEE_OFFSET_SAT=50

 # Google OAuth Config
 # Make sure that the authorized redirect URIs contain https://{domain}/api/v1/auth/google/token
@@ -160,15 +257,12 @@ GITHUB_CLIENT_SECRET=""
 KEYCLOAK_CLIENT_ID=""
 KEYCLOAK_CLIENT_SECRET=""
 KEYCLOAK_DISCOVERY_URL=""
+KEYCLOAK_CLIENT_CUSTOM_ORG=""
+KEYCLOAK_CLIENT_CUSTOM_ICON=""


 ######################################

-# uvicorn variable, uncomment to allow https behind a proxy
-# IMPORTANT: this also needs the webserver to be configured to forward the headers
-# http://docs.lnbits.org/guide/installation.html#running-behind-an-apache2-reverse-proxy-over-https
-# FORWARDED_ALLOW_IPS="*"
-
 # Server security, rate limiting ips, blocked ips, allowed ips
 LNBITS_RATE_LIMIT_NO="200"
 LNBITS_RATE_LIMIT_UNIT="minute"
@@ -179,11 +273,10 @@ LNBITS_BLOCKED_IPS=""
 # if set new users will not be able to create accounts
 LNBITS_ALLOWED_USERS=""
 LNBITS_ADMIN_USERS=""
-# ID of the super user. The user ID must exist.
-# SUPER_USER=""
+

 # Extensions only admin can access
-LNBITS_ADMIN_EXTENSIONS="ngrok, admin"
+LNBITS_ADMIN_EXTENSIONS="ngrok, nostrclient"
 # Extensions enabled by default when a user is created
 LNBITS_USER_DEFAULT_EXTENSIONS="lnurlp"

@@ -213,26 +306,6 @@ LNBITS_DEFAULT_WALLET_NAME="LNbits wallet"
 # Hides wallet api, extensions can choose to honor
 LNBITS_HIDE_API=false

-# LNBITS_EXTENSIONS_MANIFESTS="https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json,https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions-trial.json"
-# GitHub has rate-limits for its APIs. The limit can be increased specifying a GITHUB_TOKEN
-# LNBITS_EXT_GITHUB_TOKEN=github_pat_xxxxxxxxxxxxxxxxxx
-
-# Path where extensions will be installed (defaults to `./lnbits/`).
-# Inside this directory the `extensions` and `upgrades` sub-directories will be created.
-# LNBITS_EXTENSIONS_PATH="/path/to/some/dir"
-
-# Extensions to be installed by default. If an extension from this list is uninstalled then it will be re-installed on the next restart.
-# The extension must be removed from this list in order to not be re-installed.
-LNBITS_EXTENSIONS_DEFAULT_INSTALL="tpos"
-
-# Database: to use SQLite, specify LNBITS_DATA_FOLDER
-#           to use PostgreSQL, specify LNBITS_DATABASE_URL=postgres://...
-#           to use CockroachDB, specify LNBITS_DATABASE_URL=cockroachdb://...
-# for both PostgreSQL and CockroachDB, you'll need to install
-#   psycopg2 as an additional dependency
-LNBITS_DATA_FOLDER="./data"
-# LNBITS_DATABASE_URL="postgres://user:password@host:port/databasename"
-
 # the service fee (in percent)
 LNBITS_SERVICE_FEE=0.0
 # the wallet where fees go to
@@ -261,16 +334,3 @@ LNBITS_RESERVE_FEE_PERCENT=1.0
 ###### Logging and Development #######
 ######################################

-DEBUG=false
-DEBUG_DATABASE=false
-BUNDLE_ASSETS=true
-
-# logging into LNBITS_DATA_FOLDER/logs/
-ENABLE_LOG_TO_FILE=true
-
-# https://loguru.readthedocs.io/en/stable/api/logger.html#file
-LOG_ROTATION="100 MB"
-LOG_RETENTION="3 months"
-
-# for database cleanup commands
-# CLEANUP_WALLETS_DAYS=90
@@ -4,10 +4,7 @@ inputs:
  python-version:
    description: "Python Version"
    required: true
-    default: "3.9"
-  poetry-version:
-    description: "Poetry Version"
-    default: "1.7.0"
+    default: "3.10"
  node-version:
    description: "Node Version"
    default: "20.x"
@@ -24,32 +21,16 @@ runs:
      uses: actions/setup-python@v5
      with:
        python-version: ${{ inputs.python-version }}
-        # cache poetry install via pip
-        cache: "pip"

-    - name: Set up Poetry ${{ inputs.poetry-version }}
-      uses: abatilo/actions-poetry@v2
+    - name: Install uv
+      uses: astral-sh/setup-uv@v6
      with:
-        poetry-version: ${{ inputs.poetry-version }}
-
-    - name: Setup a local virtual environment (if no poetry.toml file)
-      shell: bash
-      run: |
-        poetry config virtualenvs.create true --local
-        poetry config virtualenvs.in-project true --local
-
-    - uses: actions/cache@v4
-      name: Define a cache for the virtual environment based on the dependencies lock file
-      with:
-        path: ./.venv
-        key: venv-${{ hashFiles('poetry.lock') }}
+        enable-cache: true
+        python-version: ${{ inputs.python-version }}

    - name: Install the project dependencies
      shell: bash
-      run: |
-        poetry install
-        # needed for conv tests
-        poetry add psycopg2-binary
+      run: uv sync --locked --all-extras --dev

    - name: Use Node.js ${{ inputs.node-version }}
      if: ${{ (inputs.npm == 'true') }}
@@ -0,0 +1,80 @@
+#!/bin/sh
+LAUNCH_DIR="$PWD" 
+
+# Define persistent storage for extracted LNbits
+PERSISTENT_DIR="$HOME/.local/share/lnbits"
+
+# Remove existing LNbits directory before extraction
+if [ -d "$PERSISTENT_DIR" ]; then
+    echo "Removing existing LNbits directory..."
+    rm -rf "$PERSISTENT_DIR"
+fi
+
+# Ensure the persistent directory exists
+mkdir -p "$PERSISTENT_DIR"
+
+# Extract LNbits from the AppImage if not already extracted
+echo "Extracting LNbits to disk for better performance..."
+cp -r "$APPDIR/usr/lnbits"/* "$PERSISTENT_DIR/"
+chmod +x "$PERSISTENT_DIR/dist/lnbits"
+
+# Check if the directory exists, and create it if it doesn't
+if [ ! -d "$LAUNCH_DIR/lnbits/database" ]; then
+    mkdir -p "$LAUNCH_DIR/lnbits/database"
+    echo "Created database directory at $LAUNCH_DIR/lnbits/database"
+fi
+
+if [ ! -d "$LAUNCH_DIR/lnbits/extensions" ]; then
+    mkdir -p "$LAUNCH_DIR/lnbits/extensions"
+    echo "Created extensions directory at $LAUNCH_DIR/lnbits/extensions"
+fi
+
+cd "$PERSISTENT_DIR"
+
+# Export the directory as an environment variable for the app
+LNBITS_DATA_FOLDER="${LNBITS_DATA_FOLDER:-$LAUNCH_DIR/lnbits/database}"
+LNBITS_EXTENSIONS_PATH="${LNBITS_EXTENSIONS_PATH:-$LAUNCH_DIR/lnbits/extensions}"
+export LNBITS_DATA_FOLDER
+export LNBITS_EXTENSIONS_PATH
+
+# Define the LNbits URL
+URL="http://0.0.0.0:5000"
+
+"./dist/lnbits" "$@" &
+LNBITS_PID=$!
+
+# Wait for LNbits to be ready before showing the popup
+sleep 3
+CLOSED=false
+
+# Function to stop LNbits gracefully
+kill_lnbits() {
+    LN_PIDS=$(lsof -t -i:5000 2>/dev/null)  # Capture all PIDs
+    if [ -n "$LN_PIDS" ]; then
+        echo "Stopping LNbits (PIDs: $LN_PIDS)..."
+        kill -2 $LN_PIDS  # Send SIGINT to all processes on port 5000
+        CLOSED=true
+    fi
+}
+
+# Show a GUI with a clickable link to open the browser
+if command -v zenity >/dev/null 2>&1; then
+    while [ "$CLOSED" = false ]; do
+        zenity --info --title="LNbits" --width=400 --text="<b>LNbits is running.</b>\n\n<a href='$URL'>$URL</a>\n\nClick 'Close Server' to stop LNbits." --ok-label="Close Server"
+        kill_lnbits
+        sleep 1
+    done
+elif command -v yad >/dev/null 2>&1; then
+    while [ "$CLOSED" = false ]; do
+        yad --title="LNbits" --width=400 --text="<b>LNbits is running.</b>\n\n<a href='$URL'>$URL</a>\n\nClick 'Close Server' to stop LNbits." --button="Close Server":0
+        kill_lnbits
+        sleep 1
+    done
+else
+    echo "No GUI tool found. LNbits is running at $URL"
+fi
+
+# Ensure the script doesn't hang after closing
+if ps -p $LNBITS_PID >/dev/null 2>&1; then
+    wait $LNBITS_PID 2>/dev/null || true
+fi
@@ -0,0 +1,6 @@
+[Desktop Entry]
+Name=LNbits
+Exec=lnbits
+Icon=lnbits
+Type=Application
+Categories=X-Bitcoin;X-LightningNetwork;X-Finance;Network;
@@ -16,11 +16,11 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
-      custom-pytest: "poetry run pytest tests/api"
+      custom-pytest: "uv run pytest tests/api"
      python-version: ${{ matrix.python-version }}
      db-url: ${{ matrix.db-url }}
    secrets:
@@ -30,11 +30,11 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
-      custom-pytest: "poetry run pytest tests/wallets"
+      custom-pytest: "uv run pytest tests/wallets"
      python-version: ${{ matrix.python-version }}
      db-url: ${{ matrix.db-url }}
    secrets:
@@ -44,11 +44,11 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
-      custom-pytest: "poetry run pytest tests/unit"
+      custom-pytest: "uv run pytest tests/unit"
      python-version: ${{ matrix.python-version }}
      db-url: ${{ matrix.db-url }}
    secrets:
@@ -58,7 +58,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
    uses: ./.github/workflows/migration.yml
    with:
      python-version: ${{ matrix.python-version }}
@@ -74,10 +74,10 @@ jobs:
    uses: ./.github/workflows/regtest.yml
    strategy:
      matrix:
-        python-version: ["3.9"]
+        python-version: ["3.10"]
        backend-wallet-class: ["LndRestWallet", "LndWallet", "CoreLightningWallet", "CoreLightningRestWallet", "LNbitsWallet", "EclairWallet"]
    with:
-      custom-pytest: "poetry run pytest tests/regtest"
+      custom-pytest: "uv run pytest tests/regtest"
      python-version: ${{ matrix.python-version }}
      backend-wallet-class: ${{ matrix.backend-wallet-class }}
    secrets:
@@ -87,9 +87,7 @@ jobs:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.9"]
-        poetry-version: ["1.5.1"]
+        python-version: ["3.10"]
    uses: ./.github/workflows/jmeter.yml
    with:
      python-version: ${{ matrix.python-version }}
-      poetry-version: ${{ matrix.poetry-version }}
@@ -10,7 +10,7 @@ on:

 jobs:
  analyze:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
@@ -19,7 +19,7 @@ on:

 jobs:
  push_to_dockerhub:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -51,3 +51,14 @@ jobs:
            platforms: linux/amd64,linux/arm64
            cache-from: type=local,src=/tmp/.buildx-cache
            cache-to: type=local,dest=/tmp/.buildx-cache
+
+      - name: Build and push boltz
+        uses: docker/build-push-action@v5
+        with:
+            context: .
+            file: Dockerfile.boltz
+            push: true
+            tags: ${{ secrets.DOCKER_USERNAME }}/lnbits-boltz:${{ inputs.tag }}
+            platforms: linux/amd64,linux/arm64
+            cache-from: type=local,src=/tmp/.buildx-cache
+            cache-to: type=local,dest=/tmp/.buildx-cache
@@ -6,17 +6,12 @@ on:
      python-version:
        description: "Python Version"
        required: true
-        default: "3.9"
-        type: string
-      poetry-version:
-        description: "Poetry Version"
-        required: true
-        default: "1.5.1"
+        default: "3.10"
        type: string

 jobs:
  jmeter:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4

@@ -30,10 +25,19 @@ jobs:
          LNBITS_EXTENSIONS_DEFAULT_INSTALL: "watchonly, satspay, tipjar, tpos, lnurlp, withdraw"
          LNBITS_BACKEND_WALLET_CLASS: FakeWallet
        run: |
-          poetry run lnbits &
-          sleep 5
+          uv run lnbits &
+          sleep 10
+
+      - name: setup java version
+        run: |
+          update-java-alternatives --list
+          sudo update-java-alternatives --set /usr/lib/jvm/temurin-8-jdk-amd64
+          java -version

      - name: clone lnbits-extensions, install jmeter and run tests
+        env:
+          JAVA_HOME: /usr/lib/jvm/temurin-8-jdk-amd64
+          EXTENSIONS_MANIFEST_PATH: "/lnbits/lnbits-extensions/refs/heads/main/extensions.json"
        run: |
          git clone https://github.com/lnbits/lnbits-extensions
          cd lnbits-extensions
@@ -43,6 +47,13 @@ jobs:
          make start-mirror-server
          make test

+      - name: print lnbits log
+        if: ${{ always() }}
+        run: |
+          # catch up time for lnbits
+          sleep 1
+          cat data/logs/debug.log
+
      - name: upload jmeter test results
        uses: actions/upload-artifact@v4
        if: ${{ always() }}
@@ -8,7 +8,7 @@ jobs:
    uses: ./.github/workflows/make.yml
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkblack
      python-version: ${{ matrix.python-version }}
@@ -17,7 +17,7 @@ jobs:
    uses: ./.github/workflows/make.yml
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: checkruff
      python-version: ${{ matrix.python-version }}
@@ -26,7 +26,7 @@ jobs:
    uses: ./.github/workflows/make.yml
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: mypy
      python-version: ${{ matrix.python-version }}
@@ -35,7 +35,7 @@ jobs:
    uses: ./.github/workflows/make.yml
    strategy:
      matrix:
-        python-version: ["3.9", "3.10"]
+        python-version: ["3.10", "3.11", "3.12"]
    with:
      make: pyright
      python-version: ${{ matrix.python-version }}
@@ -53,3 +53,6 @@ jobs:
    with:
      make: checkbundle
      npm: true
+
+  poetry:
+    uses: ./.github/workflows/poetry.yml
@@ -21,7 +21,7 @@ jobs:
    name: ${{ inputs.make }} (${{ inputs.python-version }})
    strategy:
      matrix:
-        os-version: ["ubuntu-latest"]
+        os-version: ["ubuntu-24.04"]
        node-version: ["18.x"]
    runs-on: ${{ matrix.os-version }}
    steps:
@@ -13,7 +13,7 @@ jobs:
    name: migration (${{ inputs.python-version }})
    strategy:
      matrix:
-        os-version: ["ubuntu-latest"]
+        os-version: ["ubuntu-24.04"]
    runs-on: ${{ matrix.os-version }}
    services:
      postgres:
@@ -14,18 +14,18 @@ on:
      - 'flake.nix'
      - 'flake.lock'
      - 'pyproject.toml'
-      - 'poetry.lock'
+      - 'uv.lock'
      - '.github/workflows/nix.yml'
  pull_request:
    paths:
      - 'flake.nix'
      - 'flake.lock'
      - 'pyproject.toml'
-      - 'poetry.lock'
+      - 'uv.lock'

 jobs:
  nix:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: cachix/install-nix-action@v27
@@ -0,0 +1,105 @@
+name: Build LNbits AppImage
+
+on:
+  release:
+    types: [published]
+
+jobs:
+
+  build-linux-package:
+    runs-on: ubuntu-latest
+    steps:
+      # Step 1: Checkout the repository
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Step 2: Set up Python (uv will still use this toolchain)
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Step 3: Install system deps (fuse) + uv
+      - name: Install system deps and uv
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libfuse2
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+        shell: bash
+
+      # Optional: Cache uv + venv to speed up CI
+      - name: Cache uv and venv
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock', 'pyproject.toml') }}
+
+      # Step 4: Prepare packaging tree and clone LNbits
+      - name: Prepare packaging & clone LNbits
+        run: |
+          mv .github/packaging packaging
+          mkdir -p packaging/linux/AppDir/usr
+          git clone https://github.com/lnbits/lnbits.git packaging/linux/AppDir/usr/lnbits
+        shell: bash
+
+      # Step 5: Build the LNbits binary with uv + PyInstaller
+      - name: Build LNbits binary (uv + PyInstaller)
+        run: |
+          cd packaging/linux/AppDir/usr/lnbits
+
+          # Install project deps into .venv using uv
+          uv sync
+
+          # Install PyInstaller into the same environment
+          uv pip install pyinstaller
+
+          # Build the LNbits binary
+          uv run pyinstaller \
+            --onefile \
+            --name lnbits \
+            --hidden-import=embit \
+            --collect-all embit \
+            --collect-all lnbits \
+            --collect-all sqlalchemy \
+            --collect-all aiosqlite \
+            --hidden-import=passlib.handlers.bcrypt \
+            "$(uv run which lnbits)"
+
+          cd ../../../../..
+          chmod +x packaging/linux/AppDir/AppRun
+          chmod +x packaging/linux/AppDir/lnbits.desktop
+          chmod +x packaging/linux/AppDir/usr/lnbits/dist/lnbits
+
+          # Clean out non-dist content from the app dir to keep AppImage slim
+          find packaging/linux/AppDir/usr/lnbits -mindepth 1 -maxdepth 1 \
+              ! -name 'dist' \
+              ! -name 'lnbits' \
+              -exec rm -rf {} +
+
+          # Build AppImage
+          wget https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage
+          chmod +x appimagetool-x86_64.AppImage
+          TAG_NAME=${{ github.event.release.tag_name }}
+          APPIMAGE_NAME="LNbits-${TAG_NAME}.AppImage"
+          ./appimagetool-x86_64.AppImage \
+            --updateinformation "gh-releases-zsync|lnbits|lnbits|latest|*.AppImage.zsync" \
+            packaging/linux/AppDir "$APPIMAGE_NAME"
+          chmod +x "$APPIMAGE_NAME"
+          echo "APPIMAGE_NAME=$APPIMAGE_NAME" >> $GITHUB_ENV
+        shell: bash
+
+      # Step 6: Upload Linux Release Asset
+      - name: Upload Linux Release Asset
+        uses: actions/upload-release-asset@v1
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: ${{ env.APPIMAGE_NAME }}
+          asset_name: ${{ env.APPIMAGE_NAME }}
+          asset_content_type: application/octet-stream
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,24 @@
+name: poetry
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        description: "python version"
+        type: string
+        default: "3.10"
+
+jobs:
+  poetry:
+    name: run poetry install to check lock file
+    runs-on: "ubuntu-24.04"
+    steps:
+      - uses: actions/checkout@v4
+      - name: set up python ${{ inputs.python-version }}
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ inputs.python-version }}
+      - name: install poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | python3 -
+          poetry install
@@ -8,10 +8,10 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.9"
+        default: "3.10"
        type: string
      os-version:
-        default: "ubuntu-latest"
+        default: "ubuntu-24.04"
        type: string
      backend-wallet-class:
        required: true
@@ -32,6 +32,10 @@ jobs:
        run: |
          docker build -t lnbits/lnbits .

+      - uses: ./.github/actions/prepare
+        with:
+          python-version: ${{ inputs.python-version }}
+
      - name: Setup Regtest
        run: |
          git clone https://github.com/lnbits/legend-regtest-enviroment.git docker
@@ -40,10 +44,6 @@ jobs:
          ./tests
          sudo chmod -R a+rwx .

-      - uses: ./.github/actions/prepare
-        with:
-          python-version: ${{ inputs.python-version }}
-
      - name: Run pytest
        uses: pavelzw/pytest-action@v2
        env:
@@ -63,6 +63,8 @@ jobs:
          LNBITS_ENDPOINT: http://localhost:5001
          LNBITS_KEY: "d08a3313322a4514af75d488bcc27eee"
          ECLAIR_URL: http://127.0.0.1:8082
+          LNBITS_MAX_OUTGOING_PAYMENT_AMOUNT_SATS: 1000000000
+          LNBITS_MAX_INCOMING_PAYMENT_AMOUNT_SATS: 1000000000
          ECLAIR_PASS: lnbits
          PYTHONUNBUFFERED: 1
          DEBUG: true
@@ -3,7 +3,7 @@ name: release-rc
 on:
  push:
    tags:
-      - "*-rc[0-9]"
+      - "*-rc[0-9]+"

 permissions:
  contents: write
@@ -19,7 +19,7 @@ jobs:
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

  pypi:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    steps:
      - name: Install dependencies for building secp256k1
        run: |
@@ -12,7 +12,7 @@ permissions:
 jobs:

  release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Create github release
@@ -41,7 +41,7 @@ jobs:
      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

  pypi:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
    steps:
      - name: Install dependencies for building secp256k1
        run: |
@@ -8,10 +8,10 @@ on:
        required: true
        type: string
      python-version:
-        default: "3.9"
+        default: "3.10"
        type: string
      os-version:
-        default: "ubuntu-latest"
+        default: "ubuntu-24.04"
        type: string
      db-url:
        default: ""
@@ -7,6 +7,7 @@ __pycache__
 .mypy_cache
 .vscode
 *-lock.json
+.python-version

 *.egg
 *.egg-info
@@ -39,6 +40,8 @@ lnbits/static/bundle-components.js
 lnbits/static/bundle.css
 lnbits/static/bundle.min.js.old
 lnbits/static/bundle.min.css.old
+lnbits/static/bundle-components.min.js.old
+lnbits/upgrades
 docker

 # Nix
@@ -51,10 +54,11 @@ lnbits-backup.zip

 # Ignore extensions (post installable extension PR)
 /lnbits/extensions
-/upgrades/
+/lnbits/upgrades/

 # builded python package
 dist

 # jetbrains
 .idea
+.venv
@@ -2,7 +2,7 @@ exclude: '^lnbits/static/bundle.*|^docs/.*|^lnbits/static/vendor/.*|^lnbits/exte

 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.3.0
+    rev: v6.0.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
@@ -14,16 +14,16 @@ repos:
      - id: mixed-line-ending
      - id: check-case-conflict
  - repo: https://github.com/psf/black
-    rev: 24.2.0
+    rev: 25.1.0
    hooks:
      - id: black
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.3.2
+    rev: v0.12.10
    hooks:
      - id: ruff
        args: [ --fix, --exit-non-zero-on-fix ]
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: "v4.0.0-alpha.8"
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.6.2
    hooks:
      - id: prettier
        types_or: [css, javascript, html, json]
@@ -1,27 +1,23 @@
-FROM python:3.10-slim-bookworm AS builder
+FROM python:3.12-slim-bookworm AS builder

 RUN apt-get clean
 RUN apt-get update
-RUN apt-get install -y curl pkg-config build-essential libnss-myhostname
+RUN apt-get install -y curl pkg-config build-essential libnss-myhostname automake

-RUN curl -sSL https://install.python-poetry.org | python3 -
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 ENV PATH="/root/.local/bin:$PATH"

 WORKDIR /app

 # Only copy the files required to install the dependencies
-COPY pyproject.toml poetry.lock ./
+COPY pyproject.toml uv.lock ./
+RUN touch README.md

 RUN mkdir data

-ENV POETRY_NO_INTERACTION=1 \
-    POETRY_VIRTUALENVS_IN_PROJECT=1 \
-    POETRY_VIRTUALENVS_CREATE=1 \
-    POETRY_CACHE_DIR=/tmp/poetry_cache
+RUN uv sync --all-extras

-RUN poetry install --only main
-
-FROM python:3.10-slim-bookworm
+FROM python:3.12-slim-bookworm

 # needed for backups postgresql-client version 14 (pg_dump)
 RUN apt-get update && apt-get -y upgrade && \
@@ -32,25 +28,19 @@ RUN apt-get update && apt-get -y upgrade && \
    apt-get -y install postgresql-client-14 postgresql-client-common && \
    apt-get clean all && rm -rf /var/lib/apt/lists/*

-RUN curl -sSL https://install.python-poetry.org | python3 -
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 ENV PATH="/root/.local/bin:$PATH"

-ENV POETRY_NO_INTERACTION=1 \
-    POETRY_VIRTUALENVS_IN_PROJECT=1 \
-    POETRY_VIRTUALENVS_CREATE=1 \
-    VIRTUAL_ENV=/app/.venv \
-    PATH="/app/.venv/bin:$PATH"
-
 WORKDIR /app

 COPY . .
 COPY --from=builder /app/.venv .venv

-RUN poetry install --only main
+RUN uv sync --all-extras

 ENV LNBITS_PORT="5000"
 ENV LNBITS_HOST="0.0.0.0"

 EXPOSE 5000

-CMD ["sh", "-c", "poetry run lnbits --port $LNBITS_PORT --host $LNBITS_HOST"]
+CMD ["sh", "-c", "uv run lnbits --port $LNBITS_PORT --host $LNBITS_HOST --forwarded-allow-ips='*'"]
@@ -0,0 +1,32 @@
+FROM boltz/boltz-client:latest AS boltz
+
+FROM lnbits/lnbits:latest
+
+COPY --from=boltz /bin/boltzd /bin/boltzcli /usr/local/bin/
+RUN ls -l /usr/local/bin/boltzd
+RUN apt-get update && apt-get -y upgrade && \
+    apt-get install -y netcat-openbsd
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
+ENV PATH="/root/.local/bin:$PATH"
+
+# Reinstall dependencies just in case (needed for CMD usage)
+RUN uv sync --all-extras
+
+# LNbits + boltzd configuration
+ENV LNBITS_PORT="5000"
+ENV LNBITS_HOST="0.0.0.0"
+ENV LNBITS_BACKEND_WALLET_CLASS="BoltzWallet"
+ENV FUNDING_SOURCE_MAX_RETRIES=10
+ENV BOLTZ_CLIENT_ENDPOINT="127.0.0.1:9002"
+ENV BOLTZ_CLIENT_MACAROON="/root/.boltz/macaroons/admin.macaroon"
+ENV BOLTZ_CLIENT_CERT="/root/.boltz/tls.cert"
+ENV BOLTZ_CLIENT_WALLET="lnbits"
+
+EXPOSE 5000
+
+# Entrypoint to start boltzd and LNbits
+COPY dockerboltz.sh /dockerboltz.sh
+RUN chmod +x /dockerboltz.sh
+
+CMD ["/dockerboltz.sh"]
@@ -9,34 +9,34 @@ check: mypy pyright checkblack checkruff checkprettier checkbundle
 test: test-unit test-wallets test-api test-regtest

 prettier:
-	poetry run ./node_modules/.bin/prettier --write .
+	uv run ./node_modules/.bin/prettier --write .

 pyright:
-	poetry run ./node_modules/.bin/pyright
+	uv run ./node_modules/.bin/pyright

 mypy:
-	poetry run mypy
+	uv run mypy

 black:
-	poetry run black .
+	uv run black .

 ruff:
-	poetry run ruff check . --fix
+	uv run ruff check . --fix

 checkruff:
-	poetry run ruff check .
+	uv run ruff check .

 checkprettier:
-	poetry run ./node_modules/.bin/prettier --check .
+	uv run ./node_modules/.bin/prettier --check .

 checkblack:
-	poetry run black --check .
+	uv run black --check .

 checkeditorconfig:
 	editorconfig-checker

 dev:
-	poetry run lnbits --reload
+	uv run lnbits --reload

 docker:
 	docker build -t lnbits/lnbits .
@@ -46,27 +46,27 @@ test-wallets:
 	LNBITS_BACKEND_WALLET_CLASS="FakeWallet" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	poetry run pytest tests/wallets
+	uv run pytest tests/wallets

 test-unit:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	LNBITS_BACKEND_WALLET_CLASS="FakeWallet" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	poetry run pytest tests/unit
+	uv run pytest tests/unit

 test-api:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	LNBITS_BACKEND_WALLET_CLASS="FakeWallet" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	poetry run pytest tests/api
+	uv run pytest tests/api

 test-regtest:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	poetry run pytest tests/regtest
+	uv run pytest tests/regtest

 test-migration:
 	LNBITS_ADMIN_UI=True \
@@ -74,18 +74,18 @@ test-migration:
 	HOST=0.0.0.0 \
 	PORT=5002 \
 	LNBITS_DATA_FOLDER="./tests/data" \
-	timeout 5s poetry run lnbits --host 0.0.0.0 --port 5002 || code=$?; if [[ $code -ne 124 && $code -ne 0 ]]; then exit $code; fi
+	timeout 5s uv run lnbits --host 0.0.0.0 --port 5002 || code=$?; if [[ $code -ne 124 && $code -ne 0 ]]; then exit $code; fi
 	HOST=0.0.0.0 \
 	PORT=5002 \
 	LNBITS_DATABASE_URL="postgres://lnbits:lnbits@localhost:5432/migration" \
 	LNBITS_ADMIN_UI=False \
-	timeout 5s poetry run lnbits --host 0.0.0.0 --port 5002 || code=$?; if [[ $code -ne 124 && $code -ne 0 ]]; then exit $code; fi
+	timeout 5s uv run lnbits --host 0.0.0.0 --port 5002 || code=$?; if [[ $code -ne 124 && $code -ne 0 ]]; then exit $code; fi
 	LNBITS_DATA_FOLDER="./tests/data" \
 	LNBITS_DATABASE_URL="postgres://lnbits:lnbits@localhost:5432/migration" \
-	poetry run python tools/conv.py
+	uv run python tools/conv.py

 migration:
-	poetry run python tools/conv.py
+	uv run python tools/conv.py

 openapi:
 	LNBITS_ADMIN_UI=False \
@@ -94,9 +94,9 @@ openapi:
 	PYTHONUNBUFFERED=1 \
 	HOST=0.0.0.0 \
 	PORT=5003 \
-	poetry run lnbits &
+	uv run lnbits &
 	sleep 15
-	curl -s http://0.0.0.0:5003/openapi.json | poetry run openapi-spec-validator --errors=all -
+	curl -s http://0.0.0.0:5003/openapi.json | uv run openapi-spec-validator --errors=all -
 	# kill -9 %1

 bak:
@@ -109,7 +109,7 @@ sass:
 bundle:
 	npm install
 	npm run bundle
-	poetry run ./node_modules/.bin/prettier -w ./lnbits/static/vendor.json
+	uv run ./node_modules/.bin/prettier -w ./lnbits/static/vendor.json

 checkbundle:
 	cp lnbits/static/bundle.min.js lnbits/static/bundle.min.js.old
@@ -126,8 +126,8 @@ checkbundle:

 install-pre-commit-hook:
 	@echo "Installing pre-commit hook to git"
-	@echo "Uninstall the hook with poetry run pre-commit uninstall"
-	poetry run pre-commit install
+	@echo "Uninstall the hook with uv run pre-commit uninstall"
+	uv run pre-commit install

 pre-commit:
-	poetry run pre-commit run --all-files
+	uv run pre-commit run --all-files
@@ -0,0 +1,26 @@
+#!/bin/bash
+set -e
+
+boltzd --standalone --referralId lnbits &
+
+# Capture boltzd PID to monitor if needed
+BOLTZ_PID=$!
+
+# Wait for boltzd to start
+for i in {1..10}; do
+  if nc -z localhost 9002; then
+    echo "boltzd is up!"
+    break
+  fi
+  echo "Waiting for boltzd to start..."
+  sleep 1
+done
+
+# Optional: check if still not up
+if ! nc -z localhost 9002; then
+  echo "boltzd did not start successfully."
+  exit 1
+fi
+
+echo "Starting LNbits on $LNBITS_HOST:$LNBITS_PORT..."
+exec uv run lnbits --port "$LNBITS_PORT" --host "$LNBITS_HOST" --forwarded-allow-ips='*'
@@ -11,13 +11,13 @@ Thanks for contributing :)

 # Run

-Follow the [Basic installation: Option 1 (recommended): poetry](https://docs.lnbits.org/guide/installation.html#option-1-recommended-poetry)
-guide to install poetry and other dependencies.
+Follow the [Option 2 (recommended): UV](https://docs.lnbits.org/guide/installation.html)
+guide to install uv and other dependencies.

 Then you can start LNbits uvicorn server with:

 ```bash
-poetry run lnbits
+uv run lnbits
 ```

 Or you can use the following to start uvicorn with hot reloading enabled:
@@ -25,7 +25,7 @@ Or you can use the following to start uvicorn with hot reloading enabled:
 ```bash
 make dev
 # or
-poetry run lnbits --reload
+uv run lnbits --reload
 ```

 You might need the following extra dependencies on clean installation of Debian:
@@ -50,7 +50,7 @@ make install-pre-commit-hook
 This project has unit tests that help prevent regressions. Before you can run the tests, you must install a few dependencies:

 ```bash
-poetry install
+uv sync --all-extras --dev
 npm i
 ```

@@ -69,7 +69,7 @@ make format
 Run mypy checks:

 ```bash
-poetry run mypy
+make mypy
 ```

 Run everything:
@@ -42,14 +42,10 @@ mv templates/example templates/mysuperplugin # Rename templates folder.

 DO NOT ADD NEW DEPENDENCIES. Try to use the dependencies that are available in `pyproject.toml`. Getting the LNbits project to accept a new dependency is time consuming and uncertain, and may result in your extension NOT being made available to others.

-If for some reason your extensions must have a new python package to work, and its nees are not met in `pyproject.toml`, you can add a new package using `poerty`:
-
-```sh
-$ poetry add <package>
-```
+If for some reason your extensions must have a new python package to work, and its nees are not met in `pyproject.toml`, you can add a new package using `poerty` or `uv`:

 **But we need an extra step to make sure LNbits doesn't break in production.**
-Dependencies need to be added to `pyproject.toml`, then tested by running on `poetry` compatibility can be tested with `nix build .#checks.x86_64-linux.vmTest`.
+Dependencies need to be added to `pyproject.toml`, then tested by running on `uv` and `poetry` compatibility can be tested with `nix build .#checks.x86_64-linux.vmTest`.

 ## SQLite to PostgreSQL migration

@@ -53,7 +53,7 @@ $ sudo nano .env
 Now start LNbits once in the terminal window

 ```
-$ poetry run lnbits
+$ uv run lnbits
 ```

 You can now `cat` the Super User ID:
@@ -67,7 +67,7 @@ You can access your super user account at `/wallet?usr=super_user_id`. You just

 After that you will find the **`Admin` / `Manage Server`** between `Wallets` and `Extensions`

-Here you can design the interface, it has TOPUP to fill wallets and you can restrict access rights to extensions only for admins or generally deactivated for everyone. You can make users admins or set up Allowed Users if you want to restrict access. And of course the classic settings of the .env file, e.g. to change the funding source wallet or set a charge fee.
+Here you can design the interface, it has credit/debit to change wallets balances and you can restrict access rights to extensions only for admins or generally deactivated for everyone. You can make users admins or set up Allowed Users if you want to restrict access. And of course the classic settings of the .env file, e.g. to change the funding source wallet or set a charge fee.

 Do not forget

@@ -0,0 +1,30 @@
+# LNbits Funding Sources Comparison Table
+
+LNbits can use a number of different Lightning Network funding source.
+
+There may be trade-offs between the funding sources used, for example funding LNbits using Strike requires the user to KYC themselves and has some
+privacy compromises versus running your own LND node. However the technical barrier to entry of using Strike is lower than using LND.
+
+The table below offers a comparison of the different Lightning Network funding sources that can be used with LNbits.
+
+## LNbits Lightning Network Funding Sources Comparison Table
+
+| **Funding Source**         | **Custodial Type** | **KYC Required**    | **Technical Knowledge Needed** | **Node Hosting Required** | **Privacy Level** | **Liquidity Management** | **Ease of Setup** | **Maintenance Effort** | **Cost Implications**                        | **Scalability** | **Notes**                                                        |
+| -------------------------- | ------------------ | ------------------- | ------------------------------ | ------------------------- | ----------------- | ------------------------ | ----------------- | ---------------------- | -------------------------------------------- | --------------- | ---------------------------------------------------------------- |
+| LND (gRPC)                 | Self-custodial     | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | gRPC interface for LND; suitable for advanced integrations.      |
+| CoreLightning (CLN)        | Self-custodial     | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | Requires setting up and managing your own CLN node.              |
+| Phoenixd                   | Self-custodial     | ❌                  | Medium                         | ❌                        | Medium            | Automatic                | Moderate          | Low                    | Minimal fees                                 | Medium          | Mobile wallet backend; suitable for mobile integrations.         |
+| Nostr Wallet Connect (NWC) | Custodial          | Depends on provider | Low                            | ❌                        | Variable          | Provider-managed         | Easy              | Low                    | May incur fees                               | Medium          | Connects via Nostr protocol; depends on provider's policies.     |
+| Boltz                      | Self-custodial     | ❌                  | Medium                         | ❌                        | Medium            | Provider-managed         | Moderate          | Moderate               | Minimal fees                                 | Medium          | Uses submarine swaps; connects to Boltz client.                  |
+| LND (REST)                 | Self-custodial     | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | REST interface for LND; suitable for web integrations.           |
+| CoreLightning REST         | Self-custodial     | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | REST interface for CLN; suitable for web integrations.           |
+| LNbits (another instance)  | Custodial          | Depends on host     | Low                            | ❌                        | Variable          | Provider-managed         | Easy              | Low                    | May incur hosting fees                       | Medium          | Connects to another LNbits instance; depends on host's policies. |
+| Alby                       | Custodial          | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Browser extension wallet; suitable for web users.                |
+| Breez SDK                  | Self-custodial     | ❌                  | Medium                         | ❌                        | High              | Automatic                | Moderate          | Low                    | Minimal fees                                 | Medium          | SDK for integrating Breez wallet functionalities.                |
+| OpenNode                   | Custodial          | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for merchants.                     |
+| Blink                      | Custodial          | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; focuses on mobile integrations.             |
+| ZBD                        | Custodial          | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Gaming-focused payment platform.                                 |
+| Spark (CLN)                | Self-custodial     | ❌                  | Higher                         | ✅                        | High              | Manual                   | Moderate          | High                   | Infrastructure cost and channel opening fees | High            | Web interface for CLN; requires Spark server setup.              |
+| Cliche Wallet              | Self-custodial     | ❌                  | Medium                         | ❌                        | Medium            | Manual                   | Moderate          | Moderate               | Minimal fees                                 | Medium          | Lightweight wallet; suitable for embedded systems.               |
+| Strike                     | Custodial          | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                  |
+| LNPay                      | Custodial          | ✅                  | Low                            | ❌                        | Low               | Provider-managed         | Easy              | Low                    | Transaction fees apply                       | Medium          | Third-party service; suitable for quick setups.                  |
@@ -6,13 +6,32 @@ nav_order: 2

 # Basic installation

-The following sections explain how to install LNbits using varions package managers: `poetry`, `nix`, `Docker` and `Fly.io`.
-
 Note that by default LNbits uses SQLite as its database, which is simple and effective but you can configure it to use PostgreSQL instead which is also described in a section below.

-## Option 1 (recommended): Poetry
+## Option 1: AppImage (LInux)

-It is recommended to use the latest version of Poetry. Make sure you have Python version 3.9 or higher installed.
+### AppImage (Linux)
+
+Go to [releases](https://github.com/lnbits/lnbits/releases) and pull latest AppImage, or:
+
+```sh
+sudo apt-get install jq libfuse2
+wget $(curl -s https://api.github.com/repos/arcbtc/lnbits/releases/latest | jq -r '.assets[] | select(.name | endswith(".AppImage")) | .browser_download_url') -O LNbits-latest.AppImage
+chmod +x LNbits-latest.AppImage
+LNBITS_ADMIN_UI=true HOST=0.0.0.0 PORT=5000 ./LNbits-latest.AppImage # most system settings are now in the admin UI, but pass additional .env variables here
+```
+
+LNbits will create a folder for db and extension files in the folder the AppImage runs from.
+
+## Option 2: UV (recommended for developers)
+
+It is recommended to use the latest version of UV. Make sure you have Python version `3.12` installed.
+
+### Install Python 3.12
+
+## Option 2 (recommended): UV
+
+It is recommended to use the latest version of UV. Make sure you have Python version 3.10 or higher installed.

 ### Verify Python version

@@ -20,44 +39,81 @@ It is recommended to use the latest version of Poetry. Make sure you have Python
 python3 --version
 ```

-### Install Poetry
+### Install UV

 ```sh
-curl -sSL https://install.python-poetry.org | python3 -
-# Once the above poetry install is completed, use the installation path printed to terminal and replace in the following command
-export PATH="/home/user/.local/bin:$PATH"
+curl -LsSf https://astral.sh/uv/install.sh | sh
+export PATH="$HOME/.local/bin:$PATH"
 ```

+### (old) Install Poetry
+
+```sh
+# If path 'export PATH="$HOME/.local/bin:$PATH"' fails, use the path echoed by the install
+curl -sSL https://install.python-poetry.org | python3 -
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+### install LNbits
+
 ```sh
 git clone https://github.com/lnbits/lnbits.git
 cd lnbits
 git checkout main
+uv sync --all-extras

-poetry install --only main
+# or poetry
+# poetry env use 3.12
+# poetry install --only main

 cp .env.example .env
-# set funding source amongst other options
-nano .env
+# Optional: to set funding source amongst other options via the env `nano .env`
 ```

 #### Running the server

 ```sh
-poetry run lnbits
-# To change port/host pass 'poetry run lnbits --port 9000 --host 0.0.0.0'
+uv run lnbits
+# To change port/host pass 'uv run lnbits --port 9000 --host 0.0.0.0'
+
+# or poetry
+# poetry run lnbits
 # adding --debug in the start-up command above to help your troubleshooting and generate a more verbose output
 # Note that you have to add the line DEBUG=true in your .env file, too.
 ```

+#### LNbits-cli
+
+```sh
+# A very useful terminal client for getting the supersuer ID, updating extensions, etc
+uv run lnbits-cli --help
+```
+
 #### Updating the server

-```
+```sh
 cd lnbits
-# Stop LNbits with `ctrl + x`
-git pull
-# Keep your poetry install up to date, this can be done with `poetry self update`
-poetry install --only main
-# Start LNbits with `poetry run lnbits`
+# Stop LNbits with `ctrl + x` or with service manager
+# sudo systemctl stop lnbits
+
+# Update LNbits
+git pull --rebase
+
+# Check your poetry version with
+# poetry env list
+# If version is less 3.12, update it by running
+# poetry env use python3.12
+# poetry env remove python3.9
+# poetry env list
+
+# Run install and start LNbits with
+# poetry install --only main
+# poetry run lnbits
+
+uv sync --all-extras
+uv run lnbits
+
+# use LNbits admin UI Extensions page function "Update All" do get extensions onto proper level
 ```

 ## Option 2: Install script (on Debian/Ubuntu)
@@ -70,16 +126,24 @@ chmod +x lnbits.sh &&

 Now visit `0.0.0.0:5000` to make a super-user account.

-`export PATH="/home/$USER/.local/bin:$PATH"` then `./lnbits.sh` can be used to run, but for more control `cd lnbits` and use `poetry run lnbits` (see previous option).
+`./lnbits.sh` can be used to run, but for more control `cd lnbits` and use `uv run lnbits` (see previous option).

 ## Option 3: Nix

 ```sh
 # Install nix. If you have installed via another manager, remove and use this install (from https://nixos.org/download)
-sh <(curl -L https://nixos.org/nix/install) --daemon
+sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install) --daemon

 # Enable nix-command and flakes experimental features for nix:
-echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
+grep -qxF 'experimental-features = nix-command flakes' /etc/nix/nix.conf || \
+echo 'experimental-features = nix-command flakes' | sudo tee -a /etc/nix/nix.conf
+
+# Add user to Nix
+grep -qxF "trusted-users = root $USER" /etc/nix/nix.conf || \
+echo "trusted-users = root $USER" | sudo tee -a /etc/nix/nix.conf
+
+# Restart daemon so changes apply
+sudo systemctl restart nix-daemon

 # Add cachix for cached binaries
 nix-env -iA cachix -f https://cachix.org/api/v1/install
@@ -104,7 +168,7 @@ but you can also set the env variables or pass command line arguments:

 ```sh
 # .env variables are currently passed when running, but LNbits can be managed with the admin UI.
-LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
+LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000 --host 0.0.0.0

 # Once you have created a user, you can set as the super_user
 SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
@@ -112,7 +176,7 @@ SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/ln

 ## Option 4: Docker

-use latest version from docker hub
+Use latest version from Docker Hub.

 ```sh
 docker pull lnbits/lnbits
@@ -121,7 +185,15 @@ mkdir data
 docker run --detach --publish 5000:5000 --name lnbits --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbits/lnbits
 ```

-build the image yourself
+The LNbits Docker image comes with no extensions installed. User-installed extensions will be stored by default in a container directory.
+It is recommended to point the `LNBITS_EXTENSIONS_PATH` environment variable to a directory that is mapped to a Docker volume. This way, the extensions will not be reinstalled when the container is destroyed.
+Example:
+
+```sh
+docker run ... -e "LNBITS_EXTENSIONS_PATH='/app/data/extensions'" --volume ${PWD}/data/:/app/data ...
+```
+
+Build the image yourself.

 ```sh
 git clone https://github.com/lnbits/lnbits.git
@@ -132,6 +204,12 @@ mkdir data
 docker run --detach --publish 5000:5000 --name lnbits --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbits/lnbits
 ```

+You can optionally override the arguments that are passed to `poetry install` during the build process by setting the Docker build argument named `POETRY_INSTALL_ARGS`. For example, to enable the Breez funding source, build the Docker image with the command:
+
+```sh
+docker build --build-arg POETRY_INSTALL_ARGS="-E breez" -t lnbits/lnbits .
+```
+
 ## Option 5: Fly.io

 Fly.io is a docker container hosting platform that has a generous free tier. You can host LNbits for free on Fly.io for personal use.
@@ -215,7 +293,7 @@ Problems installing? These commands have helped us install LNbits.
 sudo apt install pkg-config libffi-dev libpq-dev

 # build essentials for debian/ubuntu
-sudo apt install python3.9-dev gcc build-essential
+sudo apt install python3.10-dev gcc build-essential

 # if the secp256k1 build fails:
 # if you used poetry
@@ -280,7 +358,7 @@ LNBITS_DATABASE_URL="postgres://postgres:postgres@localhost/lnbits"

 # START LNbits
 # STOP LNbits
-poetry run python tools/conv.py
+uv run python tools/conv.py
 # or
 make migration
 ```
@@ -305,8 +383,8 @@ Description=LNbits
 [Service]
 # replace with the absolute path of your lnbits installation
 WorkingDirectory=/home/lnbits/lnbits
-# same here. run `which poetry` if you can't find the poetry binary
-ExecStart=/home/lnbits/.local/bin/poetry run lnbits
+# same here. run `which uv` if you can't find the poetry binary
+ExecStart=/home/lnbits/.local/bin/uv run lnbits
 # replace with the user that you're running lnbits on
 User=lnbits
 Restart=always
@@ -348,15 +426,6 @@ Assuming your LNbits is running on port `5000` add:

 ```
 yourdomain.com {
-  handle /api/v1/payments/sse* {
-    reverse_proxy 0.0.0.0:5000 {
-      header_up X-Forwarded-Host yourdomain.com
-      transport http {
-         keepalive off
-         compression off
-      }
-    }
-  }
  reverse_proxy 0.0.0.0:5000 {
    header_up X-Forwarded-Host yourdomain.com
  }
@@ -548,3 +617,12 @@ docker run --detach --publish 5000:5000 --name lnbits -e "LNBITS_BACKEND_WALLET_
 ```

 Finally you can access your lnbits on your machine at port 5000.
+
+### FreeBSD notes
+
+Currently there is an issue with secp256k1 0.14.0 on FreeBSD. Thanks to @GitKalle
+
+1. Install package `py311-secp256k1` with `pkg install py311-secp256k1`
+2. Change version in `pyproject.toml` from 0.14.0 to 0.13.2
+3. Rewrite `poetry.lock` file with command `poetry lock`
+4. Follow install instruction with Poetry
@@ -10,6 +10,25 @@ LNbits can run on top of many Lightning Network funding sources with more being

 A backend wallet can be configured using the following LNbits environment variables:

+You can [compare the LNbits compatible Lightning Network funding sources here](wallets.md).
+
+### CLNRest (using [runes](https://docs.corelightning.org/reference/lightning-createrune))
+
+[Core lightning Rest API docs](https://docs.corelightning.org/docs/rest)
+
+Should also work with the [Rust version of CLNRest](https://github.com/daywalker90/clnrest-rs)
+
+- `LNBITS_BACKEND_WALLET_CLASS`: **CLNRestWallet**
+- `CLNREST_URL`: `https://127.0.0.1:3010`
+- `CLNREST_CA`: `/home/lightningd/.lightning/bitcoin/ca.pem` (or the content of the `ca.pem` file)
+- `CLNREST_CERT`: `/home/lightningd/.lightning/bitcoin/server.pem` (or the content of the `server.pem` file)
+- `CLNREST_READONLY_RUNE`: `lightning-cli createrune restrictions='[["method=listfunds", "method=listpays", "method=listinvoices", "method=getinfo", "method=summary", "method=waitanyinvoice"]]' | jq -r .rune`
+- `CLNREST_INVOICE_RUNE`: `lightning-cli createrune restrictions='[["method=invoice"], ["pnameamount_msat<1000001"], ["pnamelabel^LNbits"], ["rate=60"]]' | jq -r .rune`
+- `CLNREST_PAY_RUNE`: `lightning-cli createrune restrictions='[["method=pay"], ["pinvbolt11_amount<1001"], ["pnamelabel^LNbits"], ["rate=1"]]' | jq -r .rune`
+- `CLNREST_RENEPAY_RUNE`: `lightning-cli createrune restrictions='[["method=renepay"], ["pinvinvstring_amount<1001"], ["pnamelabel^LNbits"], ["rate=1"]]' | jq -r .rune`
+- `CLNREST_LAST_PAY_INDEX`: `lightning-cli listinvoices | jq -r '.invoices | map(.created_index) | max' `
+- `CLNREST_NODEID`: `lightning-cli getinfo | jq -r .id` (only required for v23.08)
+
 ### CoreLightning

 - `LNBITS_BACKEND_WALLET_CLASS`: **CoreLightningWallet**
@@ -17,6 +36,8 @@ A backend wallet can be configured using the following LNbits environment variab

 ### CoreLightning REST

+This is the old REST interface that uses [Ride The Lightning/c-lightning-REST](https://github.com/Ride-The-Lightning/c-lightning-REST)
+
 - `LNBITS_BACKEND_WALLET_CLASS`: **CoreLightningRestWallet**
 - `CORELIGHTNING_REST_URL`: http://127.0.0.1:8185/
 - `CORELIGHTNING_REST_MACAROON`: /file/path/admin.macaroon or Base64/Hex
@@ -51,7 +72,7 @@ You can also use an AES-encrypted macaroon (more info) instead by using

 - `LND_GRPC_MACAROON_ENCRYPTED`: eNcRyPtEdMaCaRoOn

-To encrypt your macaroon, run `poetry run python lnbits/wallets/macaroon/macaroon.py`.
+To encrypt your macaroon, run `uv run lnbits-cli encrypt macaroon`.

 ### LNbits

@@ -133,6 +154,18 @@ A Greenlight invite code or Greenlight partner certificate/key can be used to re
 - `BREEZ_GREENLIGHT_DEVICE_KEY`: /path/to/breezsdk/device.pem or Base64/Hex
 - `BREEZ_GREENLIGHT_DEVICE_CERT`: /path/to/breezsdk/device.crt or Base64/Hex

+### Breez Liquid SDK
+
+This funding source leverages the [Breez SDK - Liquid](https://sdk-doc-liquid.breez.technology/) to manage all Lightning payments via submarine swaps on the Liquid network. To get started, simply provide a mnemonic seed phrase. The easiest way to generate one is by using a liquid wallet, such as [Blockstream Green](https://blockstream.com/green/). Once generated, you can copy the seed to your environment variable or enter it in the admin UI.
+
+- `LNBITS_BACKEND_WALLET_CLASS`: **BreezLiquidSdkWallet**
+- `BREEZ_LIQUID_SEED`: ...
+
+Each submarine swap incurs service and on-chain fees. To account for these, you may need to increase the reserve fee in the admin UI by navigating to **Settings -> Funding**, or by setting the following environment variables:
+
+- `LNBITS_RESERVE_FEE_MIN`: ...
+- `LNBITS_RESERVE_FEE_PERCENT`: ...
+
 ### Cliche Wallet

 - `CLICHE_ENDPOINT`: ws://127.0.0.1:12000
@@ -1,15 +1,39 @@
 {
  "nodes": {
+    "build-system-pkgs": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ],
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1755484659,
+        "narHash": "sha256-2FfbqsaHVQd12XFFUAinIMAuGO3853LONmva1gT3vKw=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "9778e87c2361810ff15e287ca5895c9da4a0e900",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
    "flake-utils": {
      "inputs": {
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
@@ -18,71 +42,49 @@
        "type": "github"
      }
    },
-    "nix-github-actions": {
-      "inputs": {
-        "nixpkgs": [
-          "poetry2nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1703863825,
-        "narHash": "sha256-rXwqjtwiGKJheXB43ybM8NwWB8rO2dSRrEqes0S7F5Y=",
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "rev": "5163432afc817cf8bd1f031418d1869e4c9d5547",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nix-github-actions",
-        "type": "github"
-      }
-    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1723938990,
-        "narHash": "sha256-9tUadhnZQbWIiYVXH8ncfGXGvkNq3Hag4RCBEMUk7MI=",
-        "owner": "nixos",
+        "lastModified": 1751274312,
+        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "c42fcfbdfeae23e68fc520f9182dde9f38ad1890",
+        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
        "type": "github"
      },
      "original": {
-        "owner": "nixos",
-        "ref": "nixos-24.05",
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
-    "poetry2nix": {
+    "pyproject-nix": {
      "inputs": {
-        "flake-utils": "flake-utils",
-        "nix-github-actions": "nix-github-actions",
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "systems": "systems_2",
-        "treefmt-nix": "treefmt-nix"
+        ]
      },
      "locked": {
-        "lastModified": 1724134185,
-        "narHash": "sha256-nDqpGjz7cq3ThdC98BPe1ANCNlsJds/LLZ3/MdIXjA0=",
-        "owner": "nix-community",
-        "repo": "poetry2nix",
-        "rev": "5ee730a8752264e463c0eaf06cc060fd07f6dae9",
+        "lastModified": 1754923840,
+        "narHash": "sha256-QSKpYg+Ts9HYF155ltlj40iBex39c05cpOF8gjoE2EM=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "023cd4be230eacae52635be09eef100c37ef78da",
        "type": "github"
      },
      "original": {
-        "owner": "nix-community",
-        "repo": "poetry2nix",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
+        "build-system-pkgs": "build-system-pkgs",
+        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs",
-        "poetry2nix": "poetry2nix"
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix_2"
      }
    },
    "systems": {
@@ -100,38 +102,51 @@
        "type": "github"
      }
    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "id": "systems",
-        "type": "indirect"
-      }
-    },
-    "treefmt-nix": {
+    "uv2nix": {
      "inputs": {
        "nixpkgs": [
-          "poetry2nix",
+          "build-system-pkgs",
          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "build-system-pkgs",
+          "pyproject-nix"
        ]
      },
      "locked": {
-        "lastModified": 1719749022,
-        "narHash": "sha256-ddPKHcqaKCIFSFc/cvxS14goUhCOAwsM1PbMr0ZtHMg=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "8df5ff62195d4e67e2264df0b7f5e8c9995fd0bd",
+        "lastModified": 1755210905,
+        "narHash": "sha256-WnoFEk79ysjL85TNP7bvImzhxvQw9B6uNtnLd4oJntw=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "87bcba013ef304bbfd67c8e8a257aee634ed5a4c",
        "type": "github"
      },
      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
+    "uv2nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755485731,
+        "narHash": "sha256-k8kxwVs8Oze6q/jAaRa3RvZbb50I/K0b5uptlsh0HXI=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "bebbd80bf56110fcd20b425589814af28f1939eb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
        "type": "github"
      }
    }
@@ -1,60 +1,150 @@
 {
-  description = "LNbits, free and open-source Lightning wallet and accounts system";
+  description = "LNbits, free and open-source Lightning wallet and accounts system (uv2nix)";

  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
-    poetry2nix = {
-      url = "github:nix-community/poetry2nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    flake-utils.url = "github:numtide/flake-utils";
+
+    pyproject-nix.url = "github:pyproject-nix/pyproject.nix";
+    uv2nix.url = "github:pyproject-nix/uv2nix";
+    build-system-pkgs.url = "github:pyproject-nix/build-system-pkgs";
+
+    pyproject-nix.inputs.nixpkgs.follows = "nixpkgs";
+    uv2nix.inputs.nixpkgs.follows = "nixpkgs";
+    build-system-pkgs.inputs.nixpkgs.follows = "nixpkgs";
+    uv2nix.inputs.pyproject-nix.follows = "pyproject-nix";
+    build-system-pkgs.inputs.pyproject-nix.follows = "pyproject-nix";
  };
-  outputs = { self, nixpkgs, poetry2nix }@inputs:
-    let
-      supportedSystems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
-      forSystems = systems: f:
-        nixpkgs.lib.genAttrs systems
-        (system: f system (import nixpkgs { inherit system; overlays = [ poetry2nix.overlays.default self.overlays.default ]; }));
-      forAllSystems = forSystems supportedSystems;
-      projectName = "lnbits";
-    in
-    {
-      overlays = {
-        default = final: prev: {
-          ${projectName} = self.packages.${prev.stdenv.hostPlatform.system}.${projectName};
-        };
-      };
-      packages = forAllSystems (system: pkgs: {
-        default = self.packages.${system}.${projectName};
-        ${projectName} = pkgs.poetry2nix.mkPoetryApplication {
-          projectDir = ./.;
-          meta.rev = self.dirtyRev or self.rev;
-          meta.mainProgram = projectName;
-          overrides = pkgs.poetry2nix.overrides.withDefaults (final: prev: {
-            coincurve = prev.coincurve.override { preferWheel = true; };
-            protobuf = prev.protobuf.override { preferWheel = true; };
-            ruff = prev.ruff.override { preferWheel = true; };
-            wallycore = prev.wallycore.override { preferWheel = true; };
-          });
-        };
-      });
-      nixosModules = {
-        default = { pkgs, lib, config, ... }: {
-          imports = [ "${./nix/modules/${projectName}-service.nix}" ];
-          nixpkgs.overlays = [ self.overlays.default ];
-        };
-      };
-      checks = forAllSystems (system: pkgs:
+
+  outputs = { self, nixpkgs, flake-utils, uv2nix, pyproject-nix, build-system-pkgs, ... }:
+    flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ]
+      (system:
        let
-          vmTests = import ./nix/tests {
-            makeTest = (import (nixpkgs + "/nixos/lib/testing-python.nix") { inherit system; }).makeTest;
-            inherit inputs pkgs;
+          pkgs = import nixpkgs { inherit system; };
+          lib = pkgs.lib;
+
+          python = pkgs.python312;
+
+          # Read uv.lock / pyproject via uv2nix
+          workspace = uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
+
+          # Prefer wheels when available
+          uvLockedOverlay = workspace.mkPyprojectOverlay { sourcePreference = "wheel"; };
+
+          # Helper for extending lists safely (works if a is null)
+          plus = a: b: lib.unique (((if a == null then [] else a)) ++ b);
+
+          # Extra build inputs for troublesome sdists
+          myOverrides = (final: prev: {
+            # embit needs setuptools at build time
+            embit = prev.embit.overrideAttrs (old: {
+              nativeBuildInputs = plus (old.nativeBuildInputs or []) [ prev.setuptools ];
+            });
+
+            # http-ece (pywebpush dep) needs setuptools
+            "http-ece" = prev."http-ece".overrideAttrs (old: {
+              nativeBuildInputs = plus (old.nativeBuildInputs or []) [ prev.setuptools ];
+            });
+
+            # pyqrcode needs setuptools
+            pyqrcode = prev.pyqrcode.overrideAttrs (old: {
+              nativeBuildInputs = plus (old.nativeBuildInputs or []) [ prev.setuptools ];
+            });
+
+            # tlv8 needs setuptools
+            tlv8 = prev.tlv8.overrideAttrs (old: {
+              nativeBuildInputs = plus (old.nativeBuildInputs or []) [ prev.setuptools ];
+            });
+
+            # secp256k1 Python binding:
+            #  - setuptools, pkg-config
+            #  - cffi + pycparser
+            #  - system libsecp256k1 for headers/libs
+            secp256k1 = prev.secp256k1.overrideAttrs (old: {
+              nativeBuildInputs = plus (old.nativeBuildInputs or []) [
+                prev.setuptools
+                pkgs.pkg-config
+                prev.cffi
+                prev.pycparser
+              ];
+              buildInputs = plus (old.buildInputs or []) [ pkgs.secp256k1 ];
+              propagatedBuildInputs = plus (old.propagatedBuildInputs or []) [ prev.cffi prev.pycparser ];
+              env = (old.env or { }) // { PKG_CONFIG = "${pkgs.pkg-config}/bin/pkg-config"; };
+            });
+
+            # pynostr uses setuptools-scm for versioning
+            pynostr = prev.pynostr.overrideAttrs (old: {
+              nativeBuildInputs = plus (old.nativeBuildInputs or []) [ prev.setuptools-scm ];
+            });
+          });
+
+          # Compose Python package set honoring uv.lock
+          pythonSet =
+            (pkgs.callPackage pyproject-nix.build.packages { inherit python; })
+              .overrideScope (lib.composeManyExtensions [
+                build-system-pkgs.overlays.default
+                uvLockedOverlay
+                myOverrides
+              ]);
+
+          projectName = "lnbits";
+
+          # Build a venv from the locked spec (this installs the resolved wheels)
+          runtimeVenv = pythonSet.mkVirtualEnv "${projectName}-env" workspace.deps.default;
+
+          # Wrapper so `nix run` behaves like `uv run` (use local source tree for templates/static/extensions)
+          lnbitsApp = pkgs.writeShellApplication {
+            name = "lnbits";
+            text = ''
+              export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+              export REQUESTS_CA_BUNDLE=$SSL_CERT_FILE
+              export PYTHONPATH="$PWD:${PYTHONPATH:-}"
+              exec ${runtimeVenv}/bin/lnbits "$@"
+            '';
+          };
+
+          lnbitsCliApp = pkgs.writeShellApplication {
+            name = "lnbits-cli";
+            text = ''
+              export PYTHONPATH="$PWD:${PYTHONPATH:-}"
+              exec ${runtimeVenv}/bin/lnbits-cli "$@"
+            '';
          };
        in
-        pkgs.lib.optionalAttrs pkgs.stdenv.isLinux vmTests # vmTests can only be ran on Linux, so append them only if on Linux.
-        //
        {
-          # Other checks here...
-        }
-      );
-    };
+          # nix build → produces the venv in ./result
+          packages.default = runtimeVenv;
+          packages.${projectName} = runtimeVenv;
+
+          # nix run . → launches via wrapper that imports from source tree
+          apps.default = { type = "app"; program = "${lnbitsApp}/bin/lnbits"; };
+          apps.${projectName} = self.apps.${system}.default;
+          apps."${projectName}-cli" = { type = "app"; program = "${lnbitsCliApp}/bin/lnbits-cli"; };
+
+          # dev shell with locked deps + tools
+          devShells.default = pkgs.mkShell {
+            packages = [
+              runtimeVenv
+              pkgs.uv
+              pkgs.ruff
+              pkgs.black
+              pkgs.mypy
+              pkgs.pre-commit
+              pkgs.openapi-generator-cli
+            ];
+          };
+
+          overlays.default = final: prev: {
+            ${projectName} = self.packages.${final.stdenv.hostPlatform.system}.${projectName};
+            replaceVars = prev.replaceVars or (path: vars: prev.substituteAll ({ src = path; } // vars));
+          };
+
+          # System-specific nixos modules to avoid circular dependency
+          nixosModules.default = { pkgs, lib, config, ... }: {
+            imports = [ "${./nix/modules/lnbits-service.nix}" ];
+            nixpkgs.overlays = [ self.overlays.${system}.default ];
+          };
+
+          checks = { };
+        });
 }
@@ -6,17 +6,16 @@ if [ ! -d lnbits/data ]; then
  # Update package list and install prerequisites non-interactively
  sudo apt update -y
  sudo apt install -y software-properties-common
-  
+
  # Add the deadsnakes PPA repository non-interactively
  sudo add-apt-repository -y ppa:deadsnakes/ppa
-  
-  # Install Python 3.9 and distutils non-interactively
-  sudo apt install -y python3.9 python3.9-distutils

-  # Install Poetry
-  curl -sSL https://install.python-poetry.org | python3.9 -
+  # Install Python 3.10 and distutils non-interactively
+  sudo apt install -y python3.10 python3.10-distutils
+
+  # Install UV
+  curl -LsSf https://astral.sh/uv/install.sh | sh

-  # Add Poetry to PATH for the current session
  export PATH="/home/$USER/.local/bin:$PATH"

  if [ ! -d lnbits/wallets ]; then
@@ -42,16 +41,13 @@ elif [ ! -d lnbits/wallets ]; then
  cd lnbits || { echo "Failed to cd into lnbits ... FAIL"; exit 1; }
 fi

-# Set path for running after install
-export PATH="/home/$USER/.local/bin:$PATH"
+# Install the dependencies using UV
+uv sync --all-extras

-# Install the dependencies using Poetry
-poetry env use python3.9
-poetry install --only main

 # Set environment variables for LNbits
 export LNBITS_ADMIN_UI=true
 export HOST=0.0.0.0

 # Run LNbits
-poetry run lnbits
+uv run lnbits
@@ -9,16 +9,13 @@ from .decorators import (
 from .exceptions import InvoiceError, PaymentError

 __all__ = [
-    # decorators
-    "require_admin_key",
-    "require_invoice_key",
+    "InvoiceError",
+    "PaymentError",
    "check_admin",
    "check_super_user",
    "check_user_exists",
-    # services
-    "pay_invoice",
    "create_invoice",
-    # exceptions
-    "PaymentError",
-    "InvoiceError",
+    "pay_invoice",
+    "require_admin_key",
+    "require_invoice_key",
 ]
@@ -4,9 +4,10 @@ import importlib
 import os
 import shutil
 import sys
+import time
+from collections.abc import Callable
 from contextlib import asynccontextmanager
 from pathlib import Path
-from typing import Callable, Optional

 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
@@ -14,6 +15,7 @@ from fastapi.staticfiles import StaticFiles
 from loguru import logger
 from slowapi import Limiter
 from slowapi.util import get_remote_address
+from starlette.middleware.gzip import GZipMiddleware
 from starlette.middleware.sessions import SessionMiddleware

 from lnbits.core.crud import (
@@ -23,13 +25,18 @@ from lnbits.core.crud import (
 )
 from lnbits.core.crud.extensions import create_installed_extension
 from lnbits.core.helpers import migrate_extension_database
+from lnbits.core.models.notifications import NotificationType
 from lnbits.core.services.extensions import deactivate_extension, get_valid_extensions
-from lnbits.core.tasks import (  # watchdog_task
+from lnbits.core.services.notifications import enqueue_admin_notification
+from lnbits.core.services.payments import check_pending_payments
+from lnbits.core.tasks import (
    audit_queue,
-    killswitch_task,
+    collect_exchange_rates_data,
    purge_audit_data,
+    run_by_the_minute_tasks,
    wait_for_audit_data,
    wait_for_paid_invoices,
+    wait_notification_messages,
 )
 from lnbits.exceptions import register_exception_handlers
 from lnbits.helpers import version_parse
@@ -54,32 +61,31 @@ from .core.models.extensions import Extension, ExtensionMeta, InstallableExtensi
 from .core.services import check_admin_settings, check_webpush_settings
 from .middleware import (
    AuditMiddleware,
-    CustomGZipMiddleware,
    ExtensionsRedirectMiddleware,
    InstalledExtensionMiddleware,
    add_first_install_middleware,
    add_ip_block_middleware,
    add_ratelimit_middleware,
 )
-from .requestvars import g
-from .tasks import (
-    check_pending_payments,
-    create_task,
-    internal_invoice_listener,
-    invoice_listener,
-)
+from .tasks import internal_invoice_listener, invoice_listener, run_interval


 async def startup(app: FastAPI):
+    logger.info(f"Starting LNbits Version: {settings.version}")
+    start = time.perf_counter()
    settings.lnbits_running = True
-
    # wait till migration is done
    await migrate_databases()

    # setup admin settings
    await check_admin_settings()
+    core_app_extra.register_new_ratelimiter()
    await check_webpush_settings()

+    # check extensions after restart
+    if not settings.lnbits_extensions_deactivate_all:
+        await check_and_register_extensions(app)
+
    log_server_info()

    # initialize WALLET
@@ -96,11 +102,29 @@ async def startup(app: FastAPI):
    init_core_routers(app)

    # initialize tasks
-    register_async_tasks(app)
+    register_async_tasks()
+
+    enqueue_admin_notification(
+        NotificationType.server_start_stop,
+        {
+            "message": "LNbits server started.",
+            "up_time": settings.lnbits_server_up_time,
+        },
+    )
+
+    end = time.perf_counter()
+    logger.success(f"LNbits started in {end - start:.2f} seconds.")


 async def shutdown():
    logger.warning("LNbits shutting down...")
+    enqueue_admin_notification(
+        NotificationType.server_start_stop,
+        {
+            "message": "LNbits server shutting down...",
+            "up_time": settings.lnbits_server_up_time,
+        },
+    )
    settings.lnbits_running = False

    # shutdown event
@@ -140,19 +164,18 @@ def create_app() -> FastAPI:
    core_app_extra.register_new_ratelimiter = register_new_ratelimiter(app)

    # register static files
-    static_path = Path("lnbits", "static")
-    static = StaticFiles(directory=static_path)
-    app.mount("/static", static, name="static")
-
-    g().base_url = f"http://{settings.host}:{settings.port}"
+    app.mount("/static", StaticFiles(directory=Path("lnbits", "static")), name="static")
+    Path(settings.lnbits_data_folder, "images").mkdir(parents=True, exist_ok=True)
+    app.mount(
+        "/library",
+        StaticFiles(directory=Path(settings.lnbits_data_folder, "images")),
+        name="library",
+    )

    app.add_middleware(
        CORSMiddleware, allow_origins=["*"], allow_methods=["*"], allow_headers=["*"]
    )
-
-    app.add_middleware(
-        CustomGZipMiddleware, minimum_size=1000, exclude_paths=["/api/v1/payments/sse"]
-    )
+    app.add_middleware(GZipMiddleware, minimum_size=1000)

    app.add_middleware(AuditMiddleware, audit_queue=audit_queue)

@@ -256,22 +279,22 @@ async def check_installed_extensions(app: FastAPI):
        logger.info(f"{ext.id} ({ext.installed_version})")


-async def build_all_installed_extensions_list(
-    include_deactivated: Optional[bool] = True,
+async def build_all_installed_extensions_list(  # noqa: C901
+    include_deactivated: bool | None = True,
 ) -> list[InstallableExtension]:
    """
    Returns a list of all the installed extensions plus the extensions that
    MUST be installed by default (see LNBITS_EXTENSIONS_DEFAULT_INSTALL).
    """
    installed_extensions = await get_installed_extensions()
-    settings.lnbits_all_extensions_ids = {e.id for e in installed_extensions}
+    settings.lnbits_installed_extensions_ids = {e.id for e in installed_extensions}

    for ext_dir in Path(settings.lnbits_extensions_path, "extensions").iterdir():
        try:
            if not ext_dir.is_dir():
                continue
            ext_id = ext_dir.name
-            if ext_id in settings.lnbits_all_extensions_ids:
+            if ext_id in settings.lnbits_installed_extensions_ids:
                continue
            ext_info = InstallableExtension.from_ext_dir(ext_id)
            if not ext_info:
@@ -286,7 +309,7 @@ async def build_all_installed_extensions_list(
            logger.warning(e)

    for ext_id in settings.lnbits_extensions_default_install:
-        if ext_id in settings.lnbits_all_extensions_ids:
+        if ext_id in settings.lnbits_installed_extensions_ids:
            continue

        ext_releases = await InstallableExtension.get_extension_releases(ext_id)
@@ -347,6 +370,11 @@ async def restore_installed_extension(app: FastAPI, ext: InstallableExtension):


 def register_custom_extensions_path():
+    upgrades_dir = settings.lnbits_extensions_upgrade_path
+    shutil.rmtree(upgrades_dir, True)
+    Path(upgrades_dir).mkdir(parents=True, exist_ok=True)
+    sys.path.append(str(upgrades_dir))
+
    if settings.has_default_extension_path:
        return
    default_ext_path = os.path.join("lnbits", "extensions")
@@ -365,11 +393,6 @@ def register_custom_extensions_path():
    Path(extensions_dir).mkdir(parents=True, exist_ok=True)
    sys.path.append(str(extensions_dir))

-    upgrades_dir = Path(settings.lnbits_extensions_path, "upgrades")
-    shutil.rmtree(upgrades_dir, True)
-    Path(upgrades_dir).mkdir(parents=True, exist_ok=True)
-    sys.path.append(str(upgrades_dir))
-

 def register_new_ext_routes(app: FastAPI) -> Callable:
    # Returns a function that registers new routes for an extension.
@@ -394,16 +417,21 @@ def register_new_ratelimiter(app: FastAPI) -> Callable:
    return register_new_ratelimiter_fn


+def register_ext_tasks(ext: Extension) -> None:
+    """Register extension async tasks."""
+    ext_module = importlib.import_module(ext.module_name)
+
+    if hasattr(ext_module, f"{ext.code}_start"):
+        ext_start_func = getattr(ext_module, f"{ext.code}_start")
+        ext_start_func()
+
+
 def register_ext_routes(app: FastAPI, ext: Extension) -> None:
    """Register FastAPI routes for extension."""
    ext_module = importlib.import_module(ext.module_name)

    ext_route = getattr(ext_module, f"{ext.code}_ext")

-    if hasattr(ext_module, f"{ext.code}_start"):
-        ext_start_func = getattr(ext_module, f"{ext.code}_start")
-        ext_start_func()
-
    if hasattr(ext_module, f"{ext.code}_static_files"):
        ext_statics = getattr(ext_module, f"{ext.code}_static_files")
        for s in ext_statics:
@@ -425,36 +453,34 @@ def register_ext_routes(app: FastAPI, ext: Extension) -> None:
    app.include_router(router=ext_route, prefix=prefix)


-async def check_and_register_extensions(app: FastAPI):
+async def check_and_register_extensions(app: FastAPI) -> None:
    await check_installed_extensions(app)
    for ext in await get_valid_extensions(False):
        try:
            register_ext_routes(app, ext)
+            register_ext_tasks(ext)
        except Exception as exc:
            logger.error(f"Could not load extension `{ext.code}`: {exc!s}")


-def register_async_tasks(app: FastAPI):
-
-    # check extensions after restart
-    if not settings.lnbits_extensions_deactivate_all:
-        create_task(check_and_register_extensions(app))
+def register_async_tasks() -> None:

    create_permanent_task(wait_for_audit_data)
-    create_permanent_task(check_pending_payments)
+    create_permanent_task(wait_notification_messages)
+
+    create_permanent_task(run_interval(30 * 60, check_pending_payments))
    create_permanent_task(invoice_listener)
    create_permanent_task(internal_invoice_listener)
    create_permanent_task(cache.invalidate_forever)

    # core invoice listener
-    invoice_queue: asyncio.Queue = asyncio.Queue(5)
+    invoice_queue: asyncio.Queue = asyncio.Queue()
    register_invoice_listener(invoice_queue, "core")
    create_permanent_task(lambda: wait_for_paid_invoices(invoice_queue))

-    # TODO: implement watchdog properly
-    # create_permanent_task(watchdog_task)
-    create_permanent_task(killswitch_task)
+    create_permanent_task(run_by_the_minute_tasks)
    create_permanent_task(purge_audit_data)
+    create_permanent_task(collect_exchange_rates_data)

    # server logs for websocket
    if settings.lnbits_admin_ui:
@@ -1,9 +1,11 @@
 import asyncio
 import importlib
+import sys
 import time
 from functools import wraps
+from getpass import getpass
 from pathlib import Path
-from typing import Optional
+from uuid import uuid4

 import click
 import httpx
@@ -26,19 +28,21 @@ from lnbits.core.crud import (
    update_payment,
 )
 from lnbits.core.helpers import is_valid_url, migrate_databases
-from lnbits.core.models import Payment, PaymentState
+from lnbits.core.models import Account, Payment, PaymentState
 from lnbits.core.models.extensions import (
    CreateExtension,
    ExtensionRelease,
    InstallableExtension,
 )
-from lnbits.core.services import check_admin_settings
+from lnbits.core.services import check_admin_settings, create_user_account_no_ckeck
 from lnbits.core.views.extension_api import (
    api_install_extension,
    api_uninstall_extension,
 )
 from lnbits.settings import settings
+from lnbits.utils.crypto import AESCipher
 from lnbits.wallets.base import Wallet
+from lnbits.wallets.macaroon import load_macaroon


 def coro(f):
@@ -63,6 +67,13 @@ def db():
    """


+@lnbits_cli.group()
+def users():
+    """
+    Users related commands
+    """
+
+
@lnbits_cli.group()
 def extensions():
    """
@@ -70,7 +81,21 @@ def extensions():
    """


-def get_super_user() -> Optional[str]:
+@lnbits_cli.group()
+def encrypt():
+    """
+    Encryption commands
+    """
+
+
+@lnbits_cli.group()
+def decrypt():
+    """
+    Decryption commands
+    """
+
+
+def get_super_user() -> str | None:
    """Get the superuser"""
    superuser_file = Path(settings.lnbits_data_folder, ".super_user")
    if not superuser_file.exists() or not superuser_file.is_file():
@@ -108,7 +133,7 @@ async def delete_settings():
    """Deletes the settings"""

    async with core_db.connect() as conn:
-        await conn.execute("DELETE from settings")
+        await conn.execute("DELETE from system_settings")


@db.command("migrate")
@@ -129,7 +154,7 @@ async def db_versions():
@db.command("cleanup-wallets")
@click.argument("days", type=int, required=False)
@coro
-async def database_cleanup_wallets(days: Optional[int] = None):
+async def database_cleanup_wallets(days: int | None = None):
    """Delete all wallets that never had any transaction"""
    async with core_db.connect() as conn:
        delta = days or settings.cleanup_wallets_days
@@ -179,17 +204,6 @@ async def database_revert_payment(checking_id: str):
        click.echo(f"Payment '{checking_id}' marked as pending.")


-@db.command("cleanup-accounts")
-@click.argument("days", type=int, required=False)
-@coro
-async def database_cleanup_accounts(days: Optional[int] = None):
-    """Delete all accounts that have no wallets"""
-    async with core_db.connect() as conn:
-        delta = days or settings.cleanup_wallets_days
-        delta = delta * 24 * 60 * 60
-        await delete_accounts_no_wallets(delta, conn)
-
-
@db.command("check-payments")
@click.option("-d", "--days", help="Maximum age of payments in days.")
@click.option("-l", "--limit", help="Maximum number of payments to be checked.")
@@ -197,10 +211,10 @@ async def database_cleanup_accounts(days: Optional[int] = None):
@click.option("-v", "--verbose", is_flag=True, help="Detailed log.")
@coro
 async def check_invalid_payments(
-    days: Optional[int] = None,
-    limit: Optional[int] = None,
-    wallet: Optional[str] = None,
-    verbose: Optional[bool] = False,
+    days: int | None = None,
+    limit: int | None = None,
+    wallet: str | None = None,
+    verbose: bool | None = False,
 ):
    """Check payments that are settled in the DB but pending on the Funding Source"""
    await check_admin_settings()
@@ -270,6 +284,32 @@ async def check_invalid_payments(
        click.echo(" ".join([w, str(data[0]), str(data[1] / 1000).ljust(10)]))


+@users.command("new")
+@click.option("-u", "--username", required=True, help="Username.")
+@click.option("-p", "--password", required=True, help="Password.")
+@coro
+async def create_user(username: str, password: str):
+    """Create a new user bypassing the system 'new_accounts_allowed' rules"""
+    account = Account(
+        id=uuid4().hex,
+        username=username,
+    )
+    account.hash_password(password)
+    user = await create_user_account_no_ckeck(account)
+    click.echo(f"User '{user.username}' created. Id: '{user.id}'")
+
+
+@users.command("cleanup-accounts")
+@click.argument("days", type=int, required=False)
+@coro
+async def database_cleanup_accounts(days: int | None = None):
+    """Delete all accounts that have no wallets"""
+    async with core_db.connect() as conn:
+        delta = days or settings.cleanup_wallets_days
+        delta = delta * 24 * 60 * 60
+        await delete_accounts_no_wallets(delta, conn)
+
+
@extensions.command("list")
@coro
 async def extensions_list():
@@ -279,9 +319,8 @@ async def extensions_list():
    from lnbits.app import build_all_installed_extensions_list

    for ext in await build_all_installed_extensions_list():
-        assert (
-            ext.meta and ext.meta.installed_release
-        ), f"Extension {ext.id} has no installed_release"
+        if not ext.meta or not ext.meta.installed_release:
+            raise ValueError(f"Extension {ext.id} has no installed_release")
        click.echo(f"  - {ext.id} ({ext.meta.installed_release.version})")


@@ -312,13 +351,13 @@ async def extensions_list():
    help="Admin user ID (must have permissions to install extensions).",
 )
@coro
-async def extensions_update(
-    extension: Optional[str] = None,
-    all_extensions: Optional[bool] = False,
-    repo_index: Optional[str] = None,
-    source_repo: Optional[str] = None,
-    url: Optional[str] = None,
-    admin_user: Optional[str] = None,
+async def extensions_update(  # noqa: C901
+    extension: str | None = None,
+    all_extensions: bool | None = False,
+    repo_index: str | None = None,
+    source_repo: str | None = None,
+    url: str | None = None,
+    admin_user: str | None = None,
 ):
    """
    Update extension to the latest version.
@@ -338,12 +377,17 @@ async def extensions_update(
    if not await _can_run_operation(url):
        return

+    upgrades_dir = settings.lnbits_extensions_upgrade_path
+    Path(upgrades_dir).mkdir(parents=True, exist_ok=True)
+    sys.path.append(str(upgrades_dir))
+
    if extension:
        await update_extension(extension, repo_index, source_repo, url, admin_user)
        return

-    click.echo("Updating all extensions...")
+    click.echo("Updating all extensions:")
    installed_extensions = await get_installed_extensions()
+    click.echo(f"   {[e.id for e in installed_extensions]}")
    updated_extensions = []
    for e in installed_extensions:
        try:
@@ -398,10 +442,10 @@ async def extensions_update(
@coro
 async def extensions_install(
    extension: str,
-    repo_index: Optional[str] = None,
-    source_repo: Optional[str] = None,
-    url: Optional[str] = None,
-    admin_user: Optional[str] = None,
+    repo_index: str | None = None,
+    source_repo: str | None = None,
+    url: str | None = None,
+    admin_user: str | None = None,
 ):
    """Install a extension"""
    click.echo(f"Installing {extension}... {repo_index}")
@@ -428,7 +472,7 @@ async def extensions_install(
 )
@coro
 async def extensions_uninstall(
-    extension: str, url: Optional[str] = None, admin_user: Optional[str] = None
+    extension: str, url: str | None = None, admin_user: str | None = None
 ):
    """Uninstall a extension"""
    click.echo(f"Uninstalling '{extension}'...")
@@ -450,6 +494,62 @@ async def extensions_uninstall(
        return False, str(ex)


+@encrypt.command("macaroon")
+def encrypt_macaroon():
+    """Encrypts a macaroon (LND wallets)"""
+    _macaroon = getpass("Enter macaroon: ")
+    try:
+        macaroon = load_macaroon(_macaroon)
+    except Exception as ex:
+        click.echo(f"Error loading macaroon: {ex}")
+        return
+    key = getpass("Enter encryption key: ")
+    aes = AESCipher(key.encode())
+    try:
+        encrypted_macaroon = aes.encrypt(bytes.fromhex(macaroon))
+    except Exception as ex:
+        click.echo(f"Error encrypting macaroon: {ex}")
+        return
+    click.echo("Encrypted macaroon: ")
+    click.echo(encrypted_macaroon)
+
+
+@encrypt.command("aes")
+@click.option("-p", "--payload", required=True, help="Payload to encrypt.")
+@click.option(
+    "-u", "--urlsafe", is_flag=True, required=False, help="Urlsafe b64encode."
+)
+def encrypt_aes(payload: str, urlsafe: bool = False):
+    """AES encrypts a payload"""
+    key = getpass("Enter encryption key: ")
+    aes = AESCipher(key.encode())
+    try:
+        encrypted = aes.encrypt(payload.encode(), urlsafe=urlsafe)
+    except Exception as ex:
+        click.echo(f"Error encrypting payload: {ex}")
+        return
+    click.echo("Encrypted payload: ")
+    click.echo(encrypted)
+
+
+@decrypt.command("aes")
+@click.option("-p", "--payload", required=True, help="Payload to decrypt.")
+@click.option(
+    "-u", "--urlsafe", is_flag=True, required=False, help="Urlsafe b64decode."
+)
+def decrypt_aes(payload: str, urlsafe: bool = False):
+    """AES decrypts a payload"""
+    key = getpass("Enter encryption key: ")
+    aes = AESCipher(key.encode())
+    try:
+        decrypted = aes.decrypt(payload, urlsafe=urlsafe)
+    except Exception as ex:
+        click.echo(f"Error decrypting payload: {ex}")
+        return
+    click.echo("Decrypted payload: ")
+    click.echo(decrypted)
+
+
 def main():
    """main function"""
    lnbits_cli()
@@ -461,10 +561,10 @@ if __name__ == "__main__":

 async def install_extension(
    extension: str,
-    repo_index: Optional[str] = None,
-    source_repo: Optional[str] = None,
-    url: Optional[str] = None,
-    admin_user: Optional[str] = None,
+    repo_index: str | None = None,
+    source_repo: str | None = None,
+    url: str | None = None,
+    admin_user: str | None = None,
 ) -> tuple[bool, str]:
    try:
        release = await _select_release(extension, repo_index, source_repo)
@@ -490,10 +590,10 @@ async def install_extension(

 async def update_extension(
    extension: str,
-    repo_index: Optional[str] = None,
-    source_repo: Optional[str] = None,
-    url: Optional[str] = None,
-    admin_user: Optional[str] = None,
+    repo_index: str | None = None,
+    source_repo: str | None = None,
+    url: str | None = None,
+    admin_user: str | None = None,
 ) -> tuple[bool, str]:
    try:
        click.echo(f"Updating '{extension}' extension.")
@@ -506,9 +606,10 @@ async def update_extension(

        click.echo(f"Current '{extension}' version: {installed_ext.installed_version}.")

-        assert (
-            installed_ext.meta and installed_ext.meta.installed_release
-        ), "Cannot find previously installed release. Please uninstall first."
+        if not installed_ext.meta or not installed_ext.meta.installed_release:
+            raise ValueError(
+                "Cannot find previously installed release. Please uninstall first."
+            )

        release = await _select_release(extension, repo_index, source_repo)
        if not release:
@@ -542,9 +643,9 @@ async def update_extension(

 async def _select_release(
    extension: str,
-    repo_index: Optional[str] = None,
-    source_repo: Optional[str] = None,
-) -> Optional[ExtensionRelease]:
+    repo_index: str | None = None,
+    source_repo: str | None = None,
+) -> ExtensionRelease | None:
    all_releases = await InstallableExtension.get_extension_releases(extension)
    if len(all_releases) == 0:
        click.echo(f"No repository found for extension '{extension}'.")
@@ -604,7 +705,7 @@ def _get_latest_release_per_repo(all_releases):


 async def _call_install_extension(
-    data: CreateExtension, url: Optional[str], user_id: Optional[str] = None
+    data: CreateExtension, url: str | None, user_id: str | None = None
 ):
    if url:
        user_id = user_id or get_super_user()
@@ -618,7 +719,7 @@ async def _call_install_extension(


 async def _call_uninstall_extension(
-    extension: str, url: Optional[str], user_id: Optional[str] = None
+    extension: str, url: str | None, user_id: str | None = None
 ):
    if url:
        user_id = user_id or get_super_user()
@@ -654,7 +755,7 @@ async def _can_run_operation(url) -> bool:
    return True


-async def _is_lnbits_started(url: Optional[str]):
+async def _is_lnbits_started(url: str | None):
    try:
        url = url or f"http://{settings.host}:{settings.port}/api/v1/health"
        async with httpx.AsyncClient() as client:
@@ -5,13 +5,16 @@ from .views.admin_api import admin_router
 from .views.api import api_router
 from .views.audit_api import audit_router
 from .views.auth_api import auth_router
+from .views.callback_api import callback_router
 from .views.extension_api import extension_router
+from .views.extensions_builder_api import extension_builder_router
+from .views.fiat_api import fiat_router

 # this compat is needed for usermanager extension
 from .views.generic import generic_router
+from .views.lnurl_api import lnurl_router
 from .views.node_api import node_router, public_node_router, super_node_router
 from .views.payment_api import payment_router
-from .views.public_api import public_router
 from .views.tinyurl_api import tinyurl_router
 from .views.user_api import users_router
 from .views.wallet_api import wallet_router
@@ -29,17 +32,20 @@ def init_core_routers(app: FastAPI):
    app.include_router(admin_router)
    app.include_router(node_router)
    app.include_router(extension_router)
+    app.include_router(extension_builder_router)
    app.include_router(super_node_router)
    app.include_router(public_node_router)
-    app.include_router(public_router)
    app.include_router(payment_router)
    app.include_router(wallet_router)
    app.include_router(api_router)
    app.include_router(websocket_router)
+    app.include_router(callback_router)
    app.include_router(tinyurl_router)
    app.include_router(webpush_router)
    app.include_router(users_router)
    app.include_router(audit_router)
+    app.include_router(fiat_router)
+    app.include_router(lnurl_router)


 __all__ = ["core_app", "core_app_extra", "db"]
@@ -43,6 +43,7 @@ from .settings import (
    delete_admin_settings,
    get_admin_settings,
    get_super_settings,
+    reset_core_settings,
    update_admin_settings,
    update_super_user,
 )
@@ -58,6 +59,7 @@ from .users import (
    get_account_by_username_or_email,
    get_accounts,
    get_user,
+    get_user_access_control_lists,
    get_user_from_account,
    update_account,
 )
@@ -83,85 +85,78 @@ from .webpush import (
 )

 __all__ = [
-    # audit
-    "create_audit_entry",
-    # db_versions
-    "get_db_version",
-    "get_db_versions",
-    "update_migration_version",
-    "delete_dbversion",
-    # extensions
-    "create_installed_extension",
-    "create_user_extension",
-    "delete_installed_extension",
-    "drop_extension_db",
-    "get_installed_extension",
-    "get_installed_extensions",
-    "get_user_active_extensions_ids",
-    "get_user_extension",
-    "update_installed_extension",
-    "update_installed_extension_state",
-    "update_user_extension",
-    "get_user_extensions",
-    # payments
    "DateTrunc",
    "check_internal",
-    "create_payment",
-    "delete_expired_invoices",
-    "delete_wallet_payment",
-    "get_latest_payments_by_extension",
-    "get_payment",
-    "get_payments",
-    "get_payments_history",
-    "get_payments_paginated",
-    "get_standalone_payment",
-    "get_wallet_payment",
-    "is_internal_status_success",
-    "mark_webhook_sent",
-    "update_payment",
-    "update_payment_checking_id",
-    "update_payment_extra",
-    # settings
-    "create_admin_settings",
-    "delete_admin_settings",
-    "get_admin_settings",
-    "get_super_settings",
-    "update_admin_settings",
-    "update_super_user",
-    # tinyurl
-    "create_tinyurl",
-    "delete_tinyurl",
-    "get_tinyurl",
-    "get_tinyurl_by_url",
-    # users
    "create_account",
+    "create_admin_settings",
+    "create_audit_entry",
+    "create_installed_extension",
+    "create_payment",
+    "create_tinyurl",
+    "create_user_extension",
+    "create_wallet",
+    "create_webpush_subscription",
    "delete_account",
    "delete_accounts_no_wallets",
+    "delete_admin_settings",
+    "delete_dbversion",
+    "delete_expired_invoices",
+    "delete_installed_extension",
+    "delete_tinyurl",
+    "delete_unused_wallets",
+    "delete_wallet",
+    "delete_wallet_by_id",
+    "delete_wallet_payment",
+    "delete_webpush_subscription",
+    "delete_webpush_subscriptions",
+    "drop_extension_db",
+    "force_delete_wallet",
    "get_account",
    "get_account_by_email",
    "get_account_by_pubkey",
    "get_account_by_username",
    "get_account_by_username_or_email",
    "get_accounts",
-    "get_user",
-    "get_user_from_account",
-    "update_account",
-    # wallets
-    "create_wallet",
-    "delete_unused_wallets",
-    "delete_wallet",
-    "delete_wallet_by_id",
-    "force_delete_wallet",
+    "get_admin_settings",
+    "get_db_version",
+    "get_db_versions",
+    "get_installed_extension",
+    "get_installed_extensions",
+    "get_latest_payments_by_extension",
+    "get_payment",
+    "get_payments",
+    "get_payments_history",
+    "get_payments_paginated",
+    "get_standalone_payment",
+    "get_super_settings",
+    "get_tinyurl",
+    "get_tinyurl_by_url",
    "get_total_balance",
+    "get_user",
+    "get_user_access_control_lists",
+    "get_user_active_extensions_ids",
+    "get_user_extension",
+    "get_user_extensions",
+    "get_user_from_account",
    "get_wallet",
    "get_wallet_for_key",
+    "get_wallet_payment",
    "get_wallets",
-    "remove_deleted_wallets",
-    "update_wallet",
-    # webpush
-    "create_webpush_subscription",
-    "delete_webpush_subscription",
-    "delete_webpush_subscriptions",
    "get_webpush_subscription",
    "get_webpush_subscriptions_for_user",
+    "is_internal_status_success",
+    "mark_webhook_sent",
+    "remove_deleted_wallets",
+    "reset_core_settings",
+    "update_account",
+    "update_admin_settings",
+    "update_installed_extension",
+    "update_installed_extension_state",
+    "update_migration_version",
+    "update_payment",
+    "update_payment_checking_id",
+    "update_payment_extra",
+    "update_super_user",
+    "update_user_extension",
+    "update_wallet",
 ]
@@ -1,5 +1,3 @@
-from typing import Optional
-
 from lnbits.core.db import db
 from lnbits.core.models import AuditEntry, AuditFilters
 from lnbits.core.models.audit import AuditCountStat
@@ -8,14 +6,14 @@ from lnbits.db import Connection, Filters, Page

 async def create_audit_entry(
    entry: AuditEntry,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> None:
    await (conn or db).insert("audit", entry)


 async def get_audit_entries(
-    filters: Optional[Filters[AuditFilters]] = None,
-    conn: Optional[Connection] = None,
+    filters: Filters[AuditFilters] | None = None,
+    conn: Connection | None = None,
 ) -> Page[AuditEntry]:
    return await (conn or db).fetch_page(
        "SELECT * from audit",
@@ -27,20 +25,21 @@ async def get_audit_entries(


 async def delete_expired_audit_entries(
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ):
    await (conn or db).execute(
+        # Timestamp placeholder is safe from SQL injection (not user input)
        f"""
            DELETE from audit
            WHERE delete_at < {db.timestamp_now}
-        """,
+        """,  # noqa: S608
    )


 async def get_count_stats(
    field: str,
-    filters: Optional[Filters[AuditFilters]] = None,
-    conn: Optional[Connection] = None,
+    filters: Filters[AuditFilters] | None = None,
+    conn: Connection | None = None,
 ) -> list[AuditCountStat]:
    if field not in ["request_method", "component", "response_code"]:
        return []
@@ -48,13 +47,16 @@ async def get_count_stats(
        filters = Filters()
    clause = filters.where()
    data = await (conn or db).fetchall(
+        # SQL injection vectors safety:
+        # - `field` is a static string, not user input
+        # - `clause` is generated from filters, which are validated and sanitized
        query=f"""
            SELECT {field} as field, count({field}) as total
            FROM audit
            {clause}
            GROUP BY {field}
            ORDER BY {field}
-        """,
+        """,  # noqa: S608
        values=filters.values(),
        model=AuditCountStat,
    )
@@ -63,20 +65,22 @@ async def get_count_stats(


 async def get_long_duration_stats(
-    filters: Optional[Filters[AuditFilters]] = None,
-    conn: Optional[Connection] = None,
+    filters: Filters[AuditFilters] | None = None,
+    conn: Connection | None = None,
 ) -> list[AuditCountStat]:
    if not filters:
        filters = Filters()
    clause = filters.where()
    long_duration_paths = await (conn or db).fetchall(
+        # This query is safe from SQL injection
+        # The `clause` is constructed from sanitized inputs
        query=f"""
            SELECT path as field, max(duration) as total FROM audit
            {clause}
            GROUP BY path
            ORDER BY total DESC
            LIMIT 5
-        """,
+        """,  # noqa: S608
        values=filters.values(),
        model=AuditCountStat,
    )
@@ -1,5 +1,3 @@
-from typing import Optional
-
 from lnbits.core.db import db
 from lnbits.db import Connection

@@ -7,8 +5,8 @@ from ..models import DbVersion


 async def get_db_version(
-    ext_id: str, conn: Optional[Connection] = None
-) -> Optional[DbVersion]:
+    ext_id: str, conn: Connection | None = None
+) -> DbVersion | None:
    return await (conn or db).fetchone(
        "SELECT * FROM dbversions WHERE db = :ext_id",
        {"ext_id": ext_id},
@@ -16,7 +14,7 @@ async def get_db_version(
    )


-async def get_db_versions(conn: Optional[Connection] = None) -> list[DbVersion]:
+async def get_db_versions(conn: Connection | None = None) -> list[DbVersion]:
    return await (conn or db).fetchall("SELECT * FROM dbversions", model=DbVersion)


@@ -30,7 +28,7 @@ async def update_migration_version(conn, db_name, version):
    )


-async def delete_dbversion(*, ext_id: str, conn: Optional[Connection] = None) -> None:
+async def delete_dbversion(*, ext_id: str, conn: Connection | None = None) -> None:
    await (conn or db).execute(
        """
        DELETE FROM dbversions WHERE db = :ext
@@ -1,5 +1,3 @@
-from typing import Optional
-
 from lnbits.core.db import db
 from lnbits.core.models.extensions import (
    InstallableExtension,
@@ -10,20 +8,20 @@ from lnbits.db import Connection, Database

 async def create_installed_extension(
    ext: InstallableExtension,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> None:
    await (conn or db).insert("installed_extensions", ext)


 async def update_installed_extension(
    ext: InstallableExtension,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> None:
    await (conn or db).update("installed_extensions", ext)


 async def update_installed_extension_state(
-    *, ext_id: str, active: bool, conn: Optional[Connection] = None
+    *, ext_id: str, active: bool, conn: Connection | None = None
 ) -> None:
    await (conn or db).execute(
        """
@@ -34,7 +32,7 @@ async def update_installed_extension_state(


 async def delete_installed_extension(
-    *, ext_id: str, conn: Optional[Connection] = None
+    *, ext_id: str, conn: Connection | None = None
 ) -> None:
    await (conn or db).execute(
        """
@@ -44,13 +42,14 @@ async def delete_installed_extension(
    )


-async def drop_extension_db(ext_id: str, conn: Optional[Connection] = None) -> None:
+async def drop_extension_db(ext_id: str, conn: Connection | None = None) -> None:
    row: dict = await (conn or db).fetchone(
        "SELECT * FROM dbversions WHERE db = :id",
        {"id": ext_id},
    )
    # Check that 'ext_id' is a valid extension id and not a malicious string
-    assert row, f"Extension '{ext_id}' db version cannot be found"
+    if not row:
+        raise Exception(f"Extension '{ext_id}' db version cannot be found")

    is_file_based_db = await Database.clean_ext_db_files(ext_id)
    if is_file_based_db:
@@ -64,8 +63,8 @@ async def drop_extension_db(ext_id: str, conn: Optional[Connection] = None) -> N


 async def get_installed_extension(
-    ext_id: str, conn: Optional[Connection] = None
-) -> Optional[InstallableExtension]:
+    ext_id: str, conn: Connection | None = None
+) -> InstallableExtension | None:
    extension = await (conn or db).fetchone(
        "SELECT * FROM installed_extensions WHERE id = :id",
        {"id": ext_id},
@@ -75,13 +74,16 @@ async def get_installed_extension(


 async def get_installed_extensions(
-    active: Optional[bool] = None,
-    conn: Optional[Connection] = None,
+    active: bool | None = None,
+    conn: Connection | None = None,
 ) -> list[InstallableExtension]:
-    where = "WHERE active = :active" if active is not None else ""
+    query = "SELECT * FROM installed_extensions"
+    if active is not None:
+        query += " WHERE active = :active"
+
    values = {"active": active} if active is not None else {}
    all_extensions = await (conn or db).fetchall(
-        f"SELECT * FROM installed_extensions {where}",
+        query,
        values,
        model=InstallableExtension,
    )
@@ -89,8 +91,8 @@ async def get_installed_extensions(


 async def get_user_extension(
-    user_id: str, extension: str, conn: Optional[Connection] = None
-) -> Optional[UserExtension]:
+    user_id: str, extension: str, conn: Connection | None = None
+) -> UserExtension | None:
    return await (conn or db).fetchone(
        """
        SELECT * FROM extensions
@@ -102,7 +104,7 @@ async def get_user_extension(


 async def get_user_extensions(
-    user_id: str, conn: Optional[Connection] = None
+    user_id: str, conn: Connection | None = None
 ) -> list[UserExtension]:
    return await (conn or db).fetchall(
        """SELECT * FROM extensions WHERE "user" = :user""",
@@ -112,20 +114,20 @@ async def get_user_extensions(


 async def create_user_extension(
-    user_extension: UserExtension, conn: Optional[Connection] = None
+    user_extension: UserExtension, conn: Connection | None = None
 ) -> None:
    await (conn or db).insert("extensions", user_extension)


 async def update_user_extension(
-    user_extension: UserExtension, conn: Optional[Connection] = None
+    user_extension: UserExtension, conn: Connection | None = None
 ) -> None:
    where = """WHERE extension = :extension AND "user" = :user"""
    await (conn or db).update("extensions", user_extension, where)


 async def get_user_active_extensions_ids(
-    user_id: str, conn: Optional[Connection] = None
+    user_id: str, conn: Connection | None = None
 ) -> list[str]:
    exts = await (conn or db).fetchall(
        """
@@ -1,31 +1,29 @@
 from time import time
-from typing import Literal, Optional
+from typing import Any

-from lnbits.core.crud.wallets import get_total_balance, get_wallet
+from lnbits.core.crud.wallets import get_total_balance, get_wallet, get_wallets_ids
 from lnbits.core.db import db
 from lnbits.core.models import PaymentState
-from lnbits.db import DB_TYPE, SQLITE, Connection, Filters, Page
+from lnbits.db import Connection, DateTrunc, Filters, Page

 from ..models import (
    CreatePayment,
    Payment,
+    PaymentCountField,
+    PaymentCountStat,
+    PaymentDailyStats,
    PaymentFilters,
    PaymentHistoryPoint,
+    PaymentsStatusCount,
+    PaymentWalletStats,
 )

-DateTrunc = Literal["hour", "day", "month"]
-sqlite_formats = {
-    "hour": "%Y-%m-%d %H:00:00",
-    "day": "%Y-%m-%d 00:00:00",
-    "month": "%Y-%m-01 00:00:00",
-}
-

 def update_payment_extra():
    pass


-async def get_payment(checking_id: str, conn: Optional[Connection] = None) -> Payment:
+async def get_payment(checking_id: str, conn: Connection | None = None) -> Payment:
    return await (conn or db).fetchone(
        "SELECT * FROM apipayments WHERE checking_id = :checking_id",
        {"checking_id": checking_id},
@@ -35,10 +33,10 @@ async def get_payment(checking_id: str, conn: Optional[Connection] = None) -> Pa

 async def get_standalone_payment(
    checking_id_or_hash: str,
-    conn: Optional[Connection] = None,
-    incoming: Optional[bool] = False,
-    wallet_id: Optional[str] = None,
-) -> Optional[Payment]:
+    conn: Connection | None = None,
+    incoming: bool | None = False,
+    wallet_id: str | None = None,
+) -> Payment | None:
    clause: str = "checking_id = :checking_id OR payment_hash = :hash"
    values = {
        "wallet_id": wallet_id,
@@ -52,11 +50,13 @@ async def get_standalone_payment(
        clause = f"({clause}) AND wallet_id = :wallet_id"

    row = await (conn or db).fetchone(
+        # This query is safe from SQL injection
+        # The `clause` is constructed from sanitized inputs
        f"""
        SELECT * FROM apipayments
        WHERE {clause}
        ORDER BY amount LIMIT 1
-        """,
+        """,  # noqa: S608
        values,
        Payment,
    )
@@ -64,8 +64,8 @@ async def get_standalone_payment(


 async def get_wallet_payment(
-    wallet_id: str, payment_hash: str, conn: Optional[Connection] = None
-) -> Optional[Payment]:
+    wallet_id: str, payment_hash: str, conn: Connection | None = None
+) -> Payment | None:
    payment = await (conn or db).fetchone(
        """
        SELECT *
@@ -82,36 +82,44 @@ async def get_latest_payments_by_extension(
    ext_name: str, ext_id: str, limit: int = 5
 ) -> list[Payment]:
    return await db.fetchall(
+        # This query is safe from SQL injection
+        # The limtit is an integer and not user input
        f"""
        SELECT * FROM apipayments
-        WHERE status = '{PaymentState.SUCCESS}'
+        WHERE status = :status
        AND extra LIKE :ext_name
        AND extra LIKE :ext_id
-        ORDER BY time DESC LIMIT {limit}
-        """,
-        {"ext_name": f"%{ext_name}%", "ext_id": f"%{ext_id}%"},
+        ORDER BY time DESC LIMIT {int(limit)}
+        """,  # noqa: S608
+        {
+            "status": f"{PaymentState.SUCCESS}",
+            "ext_name": f"%{ext_name}%",
+            "ext_id": f"%{ext_id}%",
+        },
        Payment,
    )


-async def get_payments_paginated(
+async def get_payments_paginated(  # noqa: C901
    *,
-    wallet_id: Optional[str] = None,
+    wallet_id: str | None = None,
+    user_id: str | None = None,
    complete: bool = False,
    pending: bool = False,
+    failed: bool = False,
    outgoing: bool = False,
    incoming: bool = False,
-    since: Optional[int] = None,
+    since: int | None = None,
    exclude_uncheckable: bool = False,
-    filters: Optional[Filters[PaymentFilters]] = None,
-    conn: Optional[Connection] = None,
+    filters: Filters[PaymentFilters] | None = None,
+    conn: Connection | None = None,
 ) -> Page[Payment]:
    """
-    Filters payments to be returned by complete | pending | outgoing | incoming.
+    Filters payments to be returned by:
+      - complete | pending | failed | outgoing | incoming.
    """

-    values: dict = {
-        "wallet_id": wallet_id,
+    values: dict[str, Any] = {
        "time": since,
    }
    clause: list[str] = []
@@ -120,18 +128,29 @@ async def get_payments_paginated(
        clause.append(f"time > {db.timestamp_placeholder('time')}")

    if wallet_id:
+        values["wallet_id"] = wallet_id
        clause.append("wallet_id = :wallet_id")
+    elif user_id:
+        only_user_wallets = await _only_user_wallets_statement(user_id, conn=conn)
+        clause.append(only_user_wallets)

    if complete and pending:
-        pass
+        clause.append(
+            f"(status = '{PaymentState.SUCCESS}' OR status = '{PaymentState.PENDING}')"
+        )
    elif complete:
        clause.append(
-            f"((amount > 0 AND status = '{PaymentState.SUCCESS}') OR amount < 0)"
+            f"""
+            (
+                status = '{PaymentState.SUCCESS}'
+                OR (amount < 0 AND status = '{PaymentState.PENDING}')
+            )
+            """
        )
    elif pending:
        clause.append(f"status = '{PaymentState.PENDING}'")
-    else:
-        pass
+    elif failed:
+        clause.append(f"status = '{PaymentState.FAILED}'")

    if outgoing and incoming:
        pass
@@ -157,17 +176,17 @@ async def get_payments_paginated(

 async def get_payments(
    *,
-    wallet_id: Optional[str] = None,
+    wallet_id: str | None = None,
    complete: bool = False,
    pending: bool = False,
    outgoing: bool = False,
    incoming: bool = False,
-    since: Optional[int] = None,
+    since: int | None = None,
    exclude_uncheckable: bool = False,
-    filters: Optional[Filters[PaymentFilters]] = None,
-    conn: Optional[Connection] = None,
-    limit: Optional[int] = None,
-    offset: Optional[int] = None,
+    filters: Filters[PaymentFilters] | None = None,
+    conn: Connection | None = None,
+    limit: int | None = None,
+    offset: int | None = None,
 ) -> list[Payment]:
    """
    Filters payments to be returned by complete | pending | outgoing | incoming.
@@ -195,27 +214,44 @@ async def get_payments(
    return page.data


+async def get_payments_status_count() -> PaymentsStatusCount:
+    empty_page: Filters = Filters(limit=0)
+    in_payments = await get_payments_paginated(incoming=True, filters=empty_page)
+    out_payments = await get_payments_paginated(outgoing=True, filters=empty_page)
+    pending_payments = await get_payments_paginated(pending=True, filters=empty_page)
+    failed_payments = await get_payments_paginated(failed=True, filters=empty_page)
+
+    return PaymentsStatusCount(
+        incoming=in_payments.total,
+        outgoing=out_payments.total,
+        pending=pending_payments.total,
+        failed=failed_payments.total,
+    )
+
+
 async def delete_expired_invoices(
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> None:
    # first we delete all invoices older than one month

    await (conn or db).execute(
+        # Timestamp placeholder is safe from SQL injection (not user input)
        f"""
        DELETE FROM apipayments
-        WHERE status = '{PaymentState.PENDING}' AND amount > 0
+        WHERE status = :status AND amount > 0
        AND time < {db.timestamp_placeholder("delta")}
-        """,
-        {"delta": int(time() - 2592000)},
+        """,  # noqa: S608
+        {"status": f"{PaymentState.PENDING}", "delta": int(time() - 2592000)},
    )
    # then we delete all invoices whose expiry date is in the past
    await (conn or db).execute(
+        # Timestamp placeholder is safe from SQL injection (not user input)
        f"""
        DELETE FROM apipayments
-        WHERE status = '{PaymentState.PENDING}' AND amount > 0
+        WHERE status = :status AND amount > 0
        AND expiry < {db.timestamp_placeholder("now")}
-        """,
-        {"now": int(time())},
+        """,  # noqa: S608
+        {"status": f"{PaymentState.PENDING}", "now": int(time())},
    )


@@ -223,12 +259,14 @@ async def create_payment(
    checking_id: str,
    data: CreatePayment,
    status: PaymentState = PaymentState.PENDING,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> Payment:
    # we don't allow the creation of the same invoice twice
    # note: this can be removed if the db uniqueness constraints are set appropriately
    previous_payment = await get_standalone_payment(checking_id, conn=conn)
-    assert previous_payment is None, "Payment already exists"
+    if previous_payment is not None:
+        raise ValueError("Payment already exists")
+    extra = data.extra or {}

    payment = Payment(
        checking_id=checking_id,
@@ -241,8 +279,9 @@ async def create_payment(
        preimage=data.preimage,
        expiry=data.expiry,
        webhook=data.webhook,
-        fee=data.fee,
-        extra=data.extra or {},
+        fee=-abs(data.fee),
+        tag=extra.get("tag", None),
+        extra=extra,
    )

    await (conn or db).insert("apipayments", payment)
@@ -251,7 +290,7 @@ async def create_payment(


 async def update_payment_checking_id(
-    checking_id: str, new_checking_id: str, conn: Optional[Connection] = None
+    checking_id: str, new_checking_id: str, conn: Connection | None = None
 ) -> None:
    await (conn or db).execute(
        "UPDATE apipayments SET checking_id = :new_id WHERE checking_id = :old_id",
@@ -261,8 +300,8 @@ async def update_payment_checking_id(

 async def update_payment(
    payment: Payment,
-    new_checking_id: Optional[str] = None,
-    conn: Optional[Connection] = None,
+    new_checking_id: str | None = None,
+    conn: Connection | None = None,
 ) -> None:
    await (conn or db).update(
        "apipayments", payment, "WHERE checking_id = :checking_id"
@@ -272,36 +311,41 @@ async def update_payment(


 async def get_payments_history(
-    wallet_id: Optional[str] = None,
+    wallet_id: str | None = None,
    group: DateTrunc = "day",
-    filters: Optional[Filters] = None,
+    filters: Filters | None = None,
 ) -> list[PaymentHistoryPoint]:
    if not filters:
        filters = Filters()

-    if DB_TYPE == SQLITE and group in sqlite_formats:
-        date_trunc = f"strftime('{sqlite_formats[group]}', time, 'unixepoch')"
-    elif group in ("day", "hour", "month"):
-        date_trunc = f"date_trunc('{group}', time)"
-    else:
-        raise ValueError(f"Invalid group value: {group}")
+    date_trunc = db.datetime_grouping(group)

    values = {
        "wallet_id": wallet_id,
    }
+    # count outgoing payments if they are still pending
    where = [
-        f"wallet_id = :wallet_id AND (status = '{PaymentState.SUCCESS}' OR amount < 0)"
+        f"""
+        wallet_id = :wallet_id AND (
+            status = '{PaymentState.SUCCESS}'
+            OR (amount < 0 AND status = '{PaymentState.PENDING}')
+        )
+        """
    ]
+    clause = filters.where(where)
    transactions: list[dict] = await db.fetchall(
+        # This query is safe from SQL injection:
+        # - `date_trunc` is a static string, not user input
+        # - `clause` is generated from filters, which are validated and sanitized
        f"""
        SELECT {date_trunc} date,
               SUM(CASE WHEN amount > 0 THEN amount ELSE 0 END) income,
               SUM(CASE WHEN amount < 0 THEN abs(amount) + abs(fee) ELSE 0 END) spending
        FROM apipayments
-        {filters.where(where)}
+        {clause}
        GROUP BY date
        ORDER BY date DESC
-        """,
+        """,  # noqa: S608
        filters.values(values),
    )
    if wallet_id:
@@ -330,8 +374,141 @@ async def get_payments_history(
    return results


+async def get_payment_count_stats(
+    field: PaymentCountField,
+    filters: Filters[PaymentFilters] | None = None,
+    user_id: str | None = None,
+    conn: Connection | None = None,
+) -> list[PaymentCountStat]:
+
+    if not filters:
+        filters = Filters()
+    extra_stmts = []
+
+    if user_id:
+        only_user_wallets = await _only_user_wallets_statement(user_id, conn=conn)
+        extra_stmts.append(only_user_wallets)
+
+    clause = filters.where(extra_stmts)
+    data = await (conn or db).fetchall(
+        # SQL injection vectors safety:
+        # - `field` is a static string, not user input
+        # - `clause` is generated from filters, which are validated and sanitized
+        query=f"""
+            SELECT {field} as field, count(*) as total
+            FROM apipayments
+            {clause}
+            GROUP BY {field}
+            ORDER BY {field}
+        """,  # noqa: S608
+        values=filters.values(),
+        model=PaymentCountStat,
+    )
+
+    return data
+
+
+async def get_daily_stats(
+    filters: Filters[PaymentFilters] | None = None,
+    user_id: str | None = None,
+    conn: Connection | None = None,
+) -> tuple[list[PaymentDailyStats], list[PaymentDailyStats]]:
+
+    if not filters:
+        filters = Filters()
+
+    in_where_stmts = ["(apipayments.status = 'success' AND apipayments.amount > 0)"]
+    out_where_stmts = [
+        "(apipayments.status IN ('success', 'pending') AND apipayments.amount < 0)"
+    ]
+
+    if user_id:
+        only_user_wallets = await _only_user_wallets_statement(user_id, conn=conn)
+        in_where_stmts.append(only_user_wallets)
+        out_where_stmts.append(only_user_wallets)
+
+    in_clause = filters.where(in_where_stmts)
+    out_clause = filters.where(out_where_stmts)
+
+    date_trunc = db.datetime_grouping("day")
+    query = """
+        SELECT {date_trunc} date,
+            SUM(apipayments.amount - ABS(apipayments.fee)) AS balance,
+            ABS(SUM(apipayments.fee)) as fee,
+            COUNT(*) as payments_count
+        FROM wallets
+        LEFT JOIN apipayments ON apipayments.wallet_id = wallets.id
+        {clause}
+        AND (wallets.deleted = false OR wallets.deleted is NULL)
+        GROUP BY date
+        ORDER BY date ASC
+    """
+
+    data_in = await (conn or db).fetchall(
+        query=query.format(date_trunc=date_trunc, clause=in_clause),
+        values=filters.values(),
+        model=PaymentDailyStats,
+    )
+    data_out = await (conn or db).fetchall(
+        query=query.format(date_trunc=date_trunc, clause=out_clause),
+        values=filters.values(),
+        model=PaymentDailyStats,
+    )
+
+    return data_in, data_out
+
+
+async def get_wallets_stats(
+    filters: Filters[PaymentFilters] | None = None,
+    user_id: str | None = None,
+    conn: Connection | None = None,
+) -> list[PaymentWalletStats]:
+
+    if not filters:
+        filters = Filters()
+
+    where_stmts = [
+        "(wallets.deleted = false OR wallets.deleted is NULL)",
+        """
+        (
+            (apipayments.status = 'success' AND apipayments.amount > 0)
+            OR (
+                apipayments.status IN ('success', 'pending')
+                AND apipayments.amount < 0
+                )
+        )
+        """,
+    ]
+    if user_id:
+        only_user_wallets = await _only_user_wallets_statement(user_id, conn=conn)
+        where_stmts.append(only_user_wallets)
+
+    clauses = filters.where(where_stmts)
+
+    data = await (conn or db).fetchall(
+        # This query is safe from SQL injection
+        # The `clauses` is constructed from sanitized inputs
+        query=f"""
+            SELECT apipayments.wallet_id,
+                    MAX(wallets.name) AS wallet_name,
+                    MAX(wallets.user) AS user_id,
+                    COUNT(*) as payments_count,
+                    SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
+            FROM wallets
+            LEFT JOIN apipayments ON apipayments.wallet_id = wallets.id
+            {clauses}
+            GROUP BY apipayments.wallet_id
+            ORDER BY payments_count
+        """,  # noqa: S608
+        values=filters.values(),
+        model=PaymentWalletStats,
+    )
+
+    return data
+
+
 async def delete_wallet_payment(
-    checking_id: str, wallet_id: str, conn: Optional[Connection] = None
+    checking_id: str, wallet_id: str, conn: Connection | None = None
 ) -> None:
    await (conn or db).execute(
        "DELETE FROM apipayments WHERE checking_id = :checking_id AND wallet = :wallet",
@@ -340,24 +517,24 @@ async def delete_wallet_payment(


 async def check_internal(
-    payment_hash: str, conn: Optional[Connection] = None
-) -> Optional[Payment]:
+    payment_hash: str, conn: Connection | None = None
+) -> Payment | None:
    """
    Returns the checking_id of the internal payment if it exists,
    otherwise None
    """
    return await (conn or db).fetchone(
-        f"""
+        """
        SELECT * FROM apipayments
-        WHERE payment_hash = :hash AND status = '{PaymentState.PENDING}' AND amount > 0
+        WHERE payment_hash = :hash AND status = :status AND amount > 0
        """,
-        {"hash": payment_hash},
+        {"status": f"{PaymentState.PENDING}", "hash": payment_hash},
        Payment,
    )


 async def is_internal_status_success(
-    payment_hash: str, conn: Optional[Connection] = None
+    payment_hash: str, conn: Connection | None = None
 ) -> bool:
    """
    Returns True if the internal payment was found and is successful,
@@ -375,7 +552,7 @@ async def is_internal_status_success(
    return payment.status == PaymentState.SUCCESS.value


-async def mark_webhook_sent(payment_hash: str, status: int) -> None:
+async def mark_webhook_sent(payment_hash: str, status: str) -> None:
    await db.execute(
        """
        UPDATE apipayments SET webhook_status = :status
@@ -383,3 +560,14 @@ async def mark_webhook_sent(payment_hash: str, status: int) -> None:
        """,
        {"status": status, "hash": payment_hash},
    )
+
+
+async def _only_user_wallets_statement(
+    user_id: str, conn: Connection | None = None
+) -> str:
+    wallet_ids = await get_wallets_ids(user_id=user_id, conn=conn) or [
+        "no-wallets-for-user"
+    ]
+    # wallet ids are safe to use in sql queries
+    wallet_ids_str = [f"'{w}'" for w in wallet_ids]
+    return f""" wallet_id IN ({", ".join(wallet_ids_str)}) """
@@ -1,9 +1,10 @@
 import json
-from typing import Any, Optional
+from typing import Any

 from loguru import logger

 from lnbits.core.db import db
+from lnbits.db import dict_to_model
 from lnbits.settings import (
    AdminSettings,
    EditableSettings,
@@ -13,16 +14,17 @@ from lnbits.settings import (
 )


-async def get_super_settings() -> Optional[SuperSettings]:
+async def get_super_settings() -> SuperSettings | None:
    data = await get_settings_by_tag("core")
    if data:
        super_user = await get_settings_field("super_user")
        super_user_id = super_user.value if super_user else None
-        return SuperSettings(**{"super_user": super_user_id, **data})
+        settings_dict = {"super_user": super_user_id, **data}
+        return dict_to_model(settings_dict, SuperSettings)
    return None


-async def get_admin_settings(is_super_user: bool = False) -> Optional[AdminSettings]:
+async def get_admin_settings(is_super_user: bool = False) -> AdminSettings | None:
    sets = await get_super_settings()
    if not sets:
        return None
@@ -39,7 +41,7 @@ async def get_admin_settings(is_super_user: bool = False) -> Optional[AdminSetti


 async def update_admin_settings(
-    data: EditableSettings, tag: Optional[str] = "core"
+    data: EditableSettings, tag: str | None = "core"
 ) -> None:
    editable_settings = await get_settings_by_tag("core") or {}
    editable_settings.update(data.dict(exclude_unset=True))
@@ -54,12 +56,29 @@ async def update_admin_settings(
 async def update_super_user(super_user: str) -> SuperSettings:
    await set_settings_field("super_user", super_user)
    settings = await get_super_settings()
-    assert settings, "updated super_user settings could not be retrieved"
+    if not settings:
+        raise ValueError("updated super_user settings could not be retrieved")
    return settings


-async def delete_admin_settings(tag: Optional[str] = "core") -> None:
-    await db.execute("DELETE FROM settings WHERE tag = :tag", {"tag": tag})
+async def delete_admin_settings(tag: str | None = "core") -> None:
+    await db.execute(
+        "DELETE FROM system_settings WHERE tag = :tag",
+        {"tag": tag},
+    )
+
+
+async def reset_core_settings() -> None:
+    await db.execute(
+        """
+        DELETE FROM system_settings WHERE tag = 'core'
+        AND id NOT IN (
+            'super_user',
+            'lnbits_webpush_pubkey',
+            'lnbits_webpush_privkey'
+        )
+        """,
+    )


 async def create_admin_settings(super_user: str, new_settings: dict) -> SuperSettings:
@@ -68,13 +87,14 @@ async def create_admin_settings(super_user: str, new_settings: dict) -> SuperSet
        await set_settings_field(key, value)

    settings = await get_super_settings()
-    assert settings, "created admin settings could not be retrieved"
+    if not settings:
+        raise ValueError("created admin settings could not be retrieved")
    return settings


 async def get_settings_field(
-    id_: str, tag: Optional[str] = "core"
-) -> Optional[SettingsField]:
+    id_: str, tag: str | None = "core"
+) -> SettingsField | None:

    row: dict = await db.fetchone(
        """
@@ -88,9 +108,7 @@ async def get_settings_field(
    return SettingsField(id=row["id"], value=json.loads(row["value"]), tag=row["tag"])


-async def set_settings_field(
-    id_: str, value: Optional[Any], tag: Optional[str] = "core"
-):
+async def set_settings_field(id_: str, value: Any | None, tag: str | None = "core"):
    value = json.dumps(value) if value is not None else None
    await db.execute(
        """
@@ -102,7 +120,7 @@ async def set_settings_field(
    )


-async def get_settings_by_tag(tag: str) -> Optional[dict[str, Any]]:
+async def get_settings_by_tag(tag: str) -> dict[str, Any] | None:
    rows: list[dict] = await db.fetchall(
        "SELECT * FROM system_settings WHERE tag = :tag", {"tag": tag}
    )
@@ -1,5 +1,3 @@
-from typing import Optional
-
 import shortuuid

 from lnbits.core.db import db
@@ -19,7 +17,7 @@ async def create_tinyurl(domain: str, endless: bool, wallet: str):
    return await get_tinyurl(tinyurl_id)


-async def get_tinyurl(tinyurl_id: str) -> Optional[TinyURL]:
+async def get_tinyurl(tinyurl_id: str) -> TinyURL | None:
    return await db.fetchone(
        "SELECT * FROM tiny_url WHERE id = :tinyurl",
        {"tinyurl": tinyurl_id},
@@ -1,11 +1,12 @@
 from datetime import datetime, timezone
 from time import time
-from typing import Optional
+from typing import Any
 from uuid import uuid4

 from lnbits.core.crud.extensions import get_user_active_extensions_ids
 from lnbits.core.crud.wallets import get_wallets
 from lnbits.core.db import db
+from lnbits.core.models import UserAcls
 from lnbits.db import Connection, Filters, Page

 from ..models import (
@@ -17,8 +18,8 @@ from ..models import (


 async def create_account(
-    account: Optional[Account] = None,
-    conn: Optional[Connection] = None,
+    account: Account | None = None,
+    conn: Connection | None = None,
 ) -> Account:
    if account:
        account.validate_fields()
@@ -35,7 +36,7 @@ async def update_account(account: Account) -> Account:
    return account


-async def delete_account(user_id: str, conn: Optional[Connection] = None) -> None:
+async def delete_account(user_id: str, conn: Connection | None = None) -> None:
    await (conn or db).execute(
        "DELETE from accounts WHERE id = :user",
        {"user": user_id},
@@ -43,9 +44,23 @@ async def delete_account(user_id: str, conn: Optional[Connection] = None) -> Non


 async def get_accounts(
-    filters: Optional[Filters[AccountFilters]] = None,
-    conn: Optional[Connection] = None,
+    filters: Filters[AccountFilters] | None = None,
+    conn: Connection | None = None,
 ) -> Page[AccountOverview]:
+    where_clauses = []
+    values: dict[str, Any] = {}
+
+    # Make wallet filter explicit
+    wallet_filter = (
+        next((f for f in filters.filters if f.field == "wallet_id"), None)
+        if filters
+        else None
+    )
+    if filters and wallet_filter and wallet_filter.values:
+        where_clauses.append("wallets.id = :wallet_id")
+        values = {**values, "wallet_id": next(iter(wallet_filter.values.values()))}
+        filters.filters = [f for f in filters.filters if f.field != "wallet_id"]
+
    return await (conn or db).fetch_page(
        """
        SELECT
@@ -53,7 +68,7 @@ async def get_accounts(
            accounts.username,
            accounts.email,
            accounts.pubkey,
-            wallets.id as wallet_id,
+            accounts.external_id,
            SUM(COALESCE((
                SELECT balance FROM balances WHERE wallet_id = wallets.id
            ), 0)) as balance_msat,
@@ -69,17 +84,17 @@ async def get_accounts(
            )) as last_payment
            FROM accounts LEFT JOIN wallets ON accounts.id = wallets.user
        """,
-        [],
-        {},
+        where_clauses,
+        values,
        filters=filters,
        model=AccountOverview,
        group_by=["accounts.id"],
    )


-async def get_account(
-    user_id: str, conn: Optional[Connection] = None
-) -> Optional[Account]:
+async def get_account(user_id: str, conn: Connection | None = None) -> Account | None:
+    if len(user_id) == 0:
+        return None
    return await (conn or db).fetchone(
        "SELECT * FROM accounts WHERE id = :id",
        {"id": user_id},
@@ -89,10 +104,11 @@ async def get_account(

 async def delete_accounts_no_wallets(
    time_delta: int,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> None:
    delta = int(time()) - time_delta
    await (conn or db).execute(
+        # Timestamp placeholder is safe from SQL injection (not user input)
        f"""
        DELETE FROM accounts
        WHERE NOT EXISTS (
@@ -101,52 +117,59 @@ async def delete_accounts_no_wallets(
            (updated_at is null AND created_at < :delta)
            OR updated_at < {db.timestamp_placeholder("delta")}
        )
-        """,
+        """,  # noqa: S608
        {"delta": delta},
    )


 async def get_account_by_username(
-    username: str, conn: Optional[Connection] = None
-) -> Optional[Account]:
+    username: str, conn: Connection | None = None
+) -> Account | None:
+    if len(username) == 0:
+        return None
    return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE username = :username",
-        {"username": username},
+        "SELECT * FROM accounts WHERE LOWER(username) = :username",
+        {"username": username.lower()},
        Account,
    )


 async def get_account_by_pubkey(
-    pubkey: str, conn: Optional[Connection] = None
-) -> Optional[Account]:
+    pubkey: str, conn: Connection | None = None
+) -> Account | None:
    return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE pubkey = :pubkey",
-        {"pubkey": pubkey},
+        "SELECT * FROM accounts WHERE LOWER(pubkey) = :pubkey",
+        {"pubkey": pubkey.lower()},
        Account,
    )


 async def get_account_by_email(
-    email: str, conn: Optional[Connection] = None
-) -> Optional[Account]:
+    email: str, conn: Connection | None = None
+) -> Account | None:
+    if len(email) == 0:
+        return None
    return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE email = :email",
-        {"email": email},
+        "SELECT * FROM accounts WHERE LOWER(email) = :email",
+        {"email": email.lower()},
        Account,
    )


 async def get_account_by_username_or_email(
-    username_or_email: str, conn: Optional[Connection] = None
-) -> Optional[Account]:
+    username_or_email: str, conn: Connection | None = None
+) -> Account | None:
    return await (conn or db).fetchone(
-        "SELECT * FROM accounts WHERE email = :value or username = :value",
-        {"value": username_or_email},
+        """
+            SELECT * FROM accounts
+            WHERE LOWER(email) = :value or LOWER(username) = :value
+        """,
+        {"value": username_or_email.lower()},
        Account,
    )


-async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[User]:
+async def get_user(user_id: str, conn: Connection | None = None) -> User | None:
    account = await get_account(user_id, conn)
    if not account:
        return None
@@ -154,8 +177,8 @@ async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[


 async def get_user_from_account(
-    account: Account, conn: Optional[Connection] = None
-) -> Optional[User]:
+    account: Account, conn: Connection | None = None
+) -> User | None:
    extensions = await get_user_active_extensions_ids(account.id, conn)
    wallets = await get_wallets(account.id, False, conn=conn)
    return User(
@@ -163,6 +186,7 @@ async def get_user_from_account(
        email=account.email,
        username=account.username,
        pubkey=account.pubkey,
+        external_id=account.external_id,
        extra=account.extra,
        created_at=account.created_at,
        updated_at=account.updated_at,
@@ -170,5 +194,23 @@ async def get_user_from_account(
        wallets=wallets,
        admin=account.is_admin,
        super_user=account.is_super_user,
+        fiat_providers=account.fiat_providers,
        has_password=account.password_hash is not None,
    )
+
+
+async def update_user_access_control_list(user_acls: UserAcls):
+    user_acls.updated_at = datetime.now(timezone.utc)
+    await db.update("accounts", user_acls)
+
+
+async def get_user_access_control_lists(
+    user_id: str, conn: Connection | None = None
+) -> UserAcls:
+    user_acls = await (conn or db).fetchone(
+        "SELECT id, access_control_list FROM accounts WHERE id = :id",
+        {"id": user_id},
+        UserAcls,
+    )
+
+    return user_acls or UserAcls(id=user_id)
@@ -1,10 +1,10 @@
 from datetime import datetime, timezone
 from time import time
-from typing import Optional
 from uuid import uuid4

 from lnbits.core.db import db
-from lnbits.db import Connection
+from lnbits.core.models.wallets import WalletsFilters
+from lnbits.db import Connection, Filters, Page
 from lnbits.settings import settings

 from ..models import Wallet
@@ -13,8 +13,8 @@ from ..models import Wallet
 async def create_wallet(
    *,
    user_id: str,
-    wallet_name: Optional[str] = None,
-    conn: Optional[Connection] = None,
+    wallet_name: str | None = None,
+    conn: Connection | None = None,
 ) -> Wallet:
    wallet_id = uuid4().hex
    wallet = Wallet(
@@ -23,6 +23,7 @@ async def create_wallet(
        user=user_id,
        adminkey=uuid4().hex,
        inkey=uuid4().hex,
+        currency=settings.lnbits_default_accounting_currency or "USD",
    )
    await (conn or db).insert("wallets", wallet)
    return wallet
@@ -30,8 +31,8 @@ async def create_wallet(

 async def update_wallet(
    wallet: Wallet,
-    conn: Optional[Connection] = None,
-) -> Optional[Wallet]:
+    conn: Connection | None = None,
+) -> Wallet:
    wallet.updated_at = datetime.now(timezone.utc)
    await (conn or db).update("wallets", wallet)
    return wallet
@@ -42,22 +43,21 @@ async def delete_wallet(
    user_id: str,
    wallet_id: str,
    deleted: bool = True,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> None:
    now = int(time())
    await (conn or db).execute(
+        # Timestamp placeholder is safe from SQL injection (not user input)
        f"""
        UPDATE wallets
        SET deleted = :deleted, updated_at = {db.timestamp_placeholder('now')}
        WHERE id = :wallet AND "user" = :user
-        """,
+        """,  # noqa: S608
        {"wallet": wallet_id, "user": user_id, "deleted": deleted, "now": now},
    )


-async def force_delete_wallet(
-    wallet_id: str, conn: Optional[Connection] = None
-) -> None:
+async def force_delete_wallet(wallet_id: str, conn: Connection | None = None) -> None:
    await (conn or db).execute(
        "DELETE FROM wallets WHERE id = :wallet",
        {"wallet": wallet_id},
@@ -65,27 +65,28 @@ async def force_delete_wallet(


 async def delete_wallet_by_id(
-    wallet_id: str, conn: Optional[Connection] = None
-) -> Optional[int]:
+    wallet_id: str, conn: Connection | None = None
+) -> int | None:
    now = int(time())
    result = await (conn or db).execute(
+        # Timestamp placeholder is safe from SQL injection (not user input)
        f"""
        UPDATE wallets
        SET deleted = true, updated_at = {db.timestamp_placeholder('now')}
        WHERE id = :wallet
-        """,
+        """,  # noqa: S608
        {"wallet": wallet_id, "now": now},
    )
    return result.rowcount


-async def remove_deleted_wallets(conn: Optional[Connection] = None) -> None:
+async def remove_deleted_wallets(conn: Connection | None = None) -> None:
    await (conn or db).execute("DELETE FROM wallets WHERE deleted = true")


 async def delete_unused_wallets(
    time_delta: int,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> None:
    delta = int(time()) - time_delta
    await (conn or db).execute(
@@ -103,41 +104,87 @@ async def delete_unused_wallets(


 async def get_wallet(
-    wallet_id: str, deleted: Optional[bool] = None, conn: Optional[Connection] = None
-) -> Optional[Wallet]:
-    where = "AND deleted = :deleted" if deleted is not None else ""
+    wallet_id: str, deleted: bool | None = None, conn: Connection | None = None
+) -> Wallet | None:
+    query = """
+            SELECT *, COALESCE((
+                SELECT balance FROM balances WHERE wallet_id = wallets.id
+            ), 0) AS balance_msat FROM wallets
+            WHERE id = :wallet
+            """
+    if deleted is not None:
+        query += " AND deleted = :deleted "
    return await (conn or db).fetchone(
-        f"""
-        SELECT *, COALESCE((
-            SELECT balance FROM balances WHERE wallet_id = wallets.id
-        ), 0) AS balance_msat FROM wallets
-        WHERE id = :wallet {where}
-        """,
+        query,
        {"wallet": wallet_id, "deleted": deleted},
        Wallet,
    )


 async def get_wallets(
-    user_id: str, deleted: Optional[bool] = None, conn: Optional[Connection] = None
+    user_id: str, deleted: bool | None = None, conn: Connection | None = None
 ) -> list[Wallet]:
-    where = "AND deleted = :deleted" if deleted is not None else ""
+    query = """
+            SELECT *, COALESCE((
+                SELECT balance FROM balances WHERE wallet_id = wallets.id
+            ), 0) AS balance_msat FROM wallets
+            WHERE "user" = :user
+            """
+    if deleted is not None:
+        query += " AND deleted = :deleted "
    return await (conn or db).fetchall(
-        f"""
-        SELECT *, COALESCE((
-            SELECT balance FROM balances WHERE wallet_id = wallets.id
-        ), 0) AS balance_msat FROM wallets
-        WHERE "user" = :user {where}
-        """,
+        query,
        {"user": user_id, "deleted": deleted},
        Wallet,
    )


+async def get_wallets_paginated(
+    user_id: str,
+    deleted: bool | None = None,
+    filters: Filters[WalletsFilters] | None = None,
+    conn: Connection | None = None,
+) -> Page[Wallet]:
+    if deleted is None:
+        deleted = False
+
+    where: list[str] = [""" "user" = :user AND deleted = :deleted """]
+    return await (conn or db).fetch_page(
+        """
+            SELECT *, COALESCE((
+                SELECT balance FROM balances WHERE wallet_id = wallets.id
+            ), 0) AS balance_msat FROM wallets
+        """,
+        where=where,
+        values={"user": user_id, "deleted": deleted},
+        filters=filters,
+        model=Wallet,
+    )
+
+
+async def get_wallets_ids(
+    user_id: str, deleted: bool | None = None, conn: Connection | None = None
+) -> list[str]:
+    query = """SELECT id FROM wallets  WHERE "user" = :user"""
+    if deleted is not None:
+        query += "AND deleted = :deleted"
+    result: list[dict] = await (conn or db).fetchall(
+        query,
+        {"user": user_id, "deleted": deleted},
+    )
+    return [row["id"] for row in result]
+
+
+async def get_wallets_count():
+    result = await db.execute("SELECT COUNT(*) as count FROM wallets")
+    row = result.mappings().first()
+    return row.get("count", 0)
+
+
 async def get_wallet_for_key(
    key: str,
-    conn: Optional[Connection] = None,
-) -> Optional[Wallet]:
+    conn: Connection | None = None,
+) -> Wallet | None:
    return await (conn or db).fetchone(
        """
        SELECT *, COALESCE((
@@ -151,7 +198,7 @@ async def get_wallet_for_key(
    )


-async def get_total_balance(conn: Optional[Connection] = None):
-    result = await (conn or db).execute("SELECT SUM(balance) FROM balances")
+async def get_total_balance(conn: Connection | None = None):
+    result = await (conn or db).execute("SELECT SUM(balance) as balance FROM balances")
    row = result.mappings().first()
-    return row.get("balance", 0)
+    return row.get("balance", 0) or 0
@@ -1,5 +1,3 @@
-from typing import Optional
-
 from lnbits.core.db import db

 from ..models import WebPushSubscription
@@ -7,7 +5,7 @@ from ..models import WebPushSubscription

 async def get_webpush_subscription(
    endpoint: str, user: str
-) -> Optional[WebPushSubscription]:
+) -> WebPushSubscription | None:
    return await db.fetchone(
        """
        SELECT * FROM webpush_subscriptions
@@ -37,7 +35,8 @@ async def create_webpush_subscription(
        {"endpoint": endpoint, "user": user, "data": data, "host": host},
    )
    subscription = await get_webpush_subscription(endpoint, user)
-    assert subscription, "Newly created webpush subscription couldn't be retrieved"
+    if not subscription:
+        raise ValueError("Newly created webpush subscription couldn't be retrieved")
    return subscription


@@ -1,6 +1,6 @@
 import importlib
 import re
-from typing import Any, Optional
+from typing import Any
 from urllib.parse import urlparse
 from uuid import UUID

@@ -20,7 +20,7 @@ from lnbits.settings import settings


 async def migrate_extension_database(
-    ext: InstallableExtension, current_version: Optional[DbVersion] = None
+    ext: InstallableExtension, current_version: DbVersion | None = None
 ):

    try:
@@ -38,7 +38,7 @@ async def run_migration(
    db: Connection,
    migrations_module: Any,
    db_name: str,
-    current_version: Optional[DbVersion] = None,
+    current_version: DbVersion | None = None,
 ):
    matcher = re.compile(r"^m(\d\d\d)_")

@@ -9,7 +9,7 @@ from lnbits import bolt11
 from lnbits.db import Connection


-async def m000_create_migrations_table(db):
+async def m000_create_migrations_table(db: Connection):
    await db.execute(
        """
    CREATE TABLE IF NOT EXISTS dbversions (
@@ -20,7 +20,7 @@ async def m000_create_migrations_table(db):
    )


-async def m001_initial(db):
+async def m001_initial(db: Connection):
    """
    Initial LNbits tables.
    """
@@ -89,7 +89,7 @@ async def m001_initial(db):
    )


-async def m002_add_fields_to_apipayments(db):
+async def m002_add_fields_to_apipayments(db: Connection):
    """
    Adding fields to apipayments for better accounting,
    and renaming payhash to checking_id since that is what it really is.
@@ -133,7 +133,7 @@ async def m002_add_fields_to_apipayments(db):
        pass


-async def m003_add_invoice_webhook(db):
+async def m003_add_invoice_webhook(db: Connection):
    """
    Special column for webhook endpoints that can be assigned
    to each different invoice.
@@ -143,7 +143,7 @@ async def m003_add_invoice_webhook(db):
    await db.execute("ALTER TABLE apipayments ADD COLUMN webhook_status TEXT")


-async def m004_ensure_fees_are_always_negative(db):
+async def m004_ensure_fees_are_always_negative(db: Connection):
    """
    Use abs() so wallet backends don't have to care about the sign of the fees.
    """
@@ -168,7 +168,7 @@ async def m004_ensure_fees_are_always_negative(db):
    )


-async def m005_balance_check_balance_notify(db):
+async def m005_balance_check_balance_notify(db: Connection):
    """
    Keep track of balanceCheck-enabled lnurl-withdrawals to be consumed by an
    LNbits wallet and of balanceNotify URLs supplied by users to empty their wallets.
@@ -198,7 +198,7 @@ async def m005_balance_check_balance_notify(db):
    )


-async def m006_add_invoice_expiry_to_apipayments(db):
+async def m006_add_invoice_expiry_to_apipayments(db: Connection):
    """
    Adds invoice expiry column to apipayments.
    """
@@ -208,12 +208,13 @@ async def m006_add_invoice_expiry_to_apipayments(db):
        pass


-async def m007_set_invoice_expiries(db):
+async def m007_set_invoice_expiries(db: Connection):
    """
    Precomputes invoice expiry for existing pending incoming payments.
    """
    try:
        result = await db.execute(
+            # Timestamp placeholder is safe from SQL injection (not user input)
            f"""
            SELECT bolt11, checking_id
            FROM apipayments
@@ -222,7 +223,7 @@ async def m007_set_invoice_expiries(db):
            AND bolt11 IS NOT NULL
            AND expiry IS NULL
            AND time < {db.timestamp_now}
-            """
+            """  # noqa: S608
        )
        rows = result.mappings().all()
        if len(rows):
@@ -242,13 +243,15 @@ async def m007_set_invoice_expiries(db):
                    f" {invoice.payment_hash} to {expiration_date}"
                )
                await db.execute(
+                    # Timestamp placeholder is safe from SQL injection (not user input)
                    f"""
                    UPDATE apipayments SET expiry = {db.timestamp_placeholder('expiry')}
                    WHERE checking_id = :checking_id AND amount > 0
-                    """,
+                    """,  # noqa: S608
                    {"expiry": expiration_date, "checking_id": checking_id},
                )
-            except Exception:
+            except Exception as exc:
+                logger.debug(exc)
                continue
    except OperationalError:
        # this is necessary now because it may be the case that this migration will
@@ -258,7 +261,7 @@ async def m007_set_invoice_expiries(db):
        pass


-async def m008_create_admin_settings_table(db):
+async def m008_create_admin_settings_table(db: Connection):
    await db.execute(
        """
        CREATE TABLE IF NOT EXISTS settings (
@@ -269,7 +272,7 @@ async def m008_create_admin_settings_table(db):
    )


-async def m009_create_tinyurl_table(db):
+async def m009_create_tinyurl_table(db: Connection):
    await db.execute(
        f"""
        CREATE TABLE IF NOT EXISTS tiny_url (
@@ -283,7 +286,7 @@ async def m009_create_tinyurl_table(db):
    )


-async def m010_create_installed_extensions_table(db):
+async def m010_create_installed_extensions_table(db: Connection):
    await db.execute(
        """
        CREATE TABLE IF NOT EXISTS installed_extensions (
@@ -300,7 +303,7 @@ async def m010_create_installed_extensions_table(db):
    )


-async def m011_optimize_balances_view(db):
+async def m011_optimize_balances_view(db: Connection):
    """
    Make the calculation of the balance a single aggregation
    over the payments table instead of 2.
@@ -317,7 +320,7 @@ async def m011_optimize_balances_view(db):
    )


-async def m012_add_currency_to_wallet(db):
+async def m012_add_currency_to_wallet(db: Connection):
    await db.execute(
        """
        ALTER TABLE wallets ADD COLUMN currency TEXT
@@ -325,7 +328,7 @@ async def m012_add_currency_to_wallet(db):
    )


-async def m013_add_deleted_to_wallets(db):
+async def m013_add_deleted_to_wallets(db: Connection):
    """
    Adds deleted column to wallets.
    """
@@ -337,7 +340,7 @@ async def m013_add_deleted_to_wallets(db):
        pass


-async def m014_set_deleted_wallets(db):
+async def m014_set_deleted_wallets(db: Connection):
    """
    Sets deleted column to wallets.
    """
@@ -371,7 +374,8 @@ async def m014_set_deleted_wallets(db):
                        "wallet": row.get("id"),
                    },
                )
-            except Exception:
+            except Exception as exc:
+                logger.debug(exc)
                continue
    except OperationalError:
        # this is necessary now because it may be the case that this migration will
@@ -381,7 +385,7 @@ async def m014_set_deleted_wallets(db):
        pass


-async def m015_create_push_notification_subscriptions_table(db):
+async def m015_create_push_notification_subscriptions_table(db: Connection):
    await db.execute(
        f"""
        CREATE TABLE IF NOT EXISTS webpush_subscriptions (
@@ -396,7 +400,7 @@ async def m015_create_push_notification_subscriptions_table(db):
    )


-async def m016_add_username_column_to_accounts(db):
+async def m016_add_username_column_to_accounts(db: Connection):
    """
    Adds username column to accounts.
    """
@@ -407,7 +411,7 @@ async def m016_add_username_column_to_accounts(db):
        pass


-async def m017_add_timestamp_columns_to_accounts_and_wallets(db):
+async def m017_add_timestamp_columns_to_accounts_and_wallets(db: Connection):
    """
    Adds created_at and updated_at column to accounts and wallets.
    """
@@ -454,17 +458,19 @@ async def m017_add_timestamp_columns_to_accounts_and_wallets(db):
        # set all to now where they are null
        now = int(time())
        await db.execute(
+            # Timestamp placeholder is safe from SQL injection (not user input)
            f"""
            UPDATE wallets SET created_at = {db.timestamp_placeholder('now')}
            WHERE created_at IS NULL
-            """,
+            """,  # noqa: S608
            {"now": now},
        )
        await db.execute(
+            # Timestamp placeholder is safe from SQL injection (not user input)
            f"""
            UPDATE accounts SET created_at = {db.timestamp_placeholder('now')}
            WHERE created_at IS NULL
-            """,
+            """,  # noqa: S608
            {"now": now},
        )

@@ -473,7 +479,7 @@ async def m017_add_timestamp_columns_to_accounts_and_wallets(db):
        pass


-async def m018_balances_view_exclude_deleted(db):
+async def m018_balances_view_exclude_deleted(db: Connection):
    """
    Make deleted wallets not show up in the balances view.
    """
@@ -493,7 +499,7 @@ async def m018_balances_view_exclude_deleted(db):
    )


-async def m019_balances_view_based_on_wallets(db):
+async def m019_balances_view_based_on_wallets(db: Connection):
    """
    Make deleted wallets not show up in the balances view.
    Important for querying whole lnbits balances.
@@ -514,14 +520,14 @@ async def m019_balances_view_based_on_wallets(db):
    )


-async def m020_add_column_column_to_user_extensions(db):
+async def m020_add_column_column_to_user_extensions(db: Connection):
    """
    Adds extra column to user extensions.
    """
    await db.execute("ALTER TABLE extensions ADD COLUMN extra TEXT")


-async def m021_add_success_failed_to_apipayments(db):
+async def m021_add_success_failed_to_apipayments(db: Connection):
    """
    Adds success and failed columns to apipayments.
    """
@@ -547,7 +553,7 @@ async def m021_add_success_failed_to_apipayments(db):
    )


-async def m022_add_pubkey_to_accounts(db):
+async def m022_add_pubkey_to_accounts(db: Connection):
    """
    Adds pubkey column to accounts.
    """
@@ -557,7 +563,7 @@ async def m022_add_pubkey_to_accounts(db):
        pass


-async def m023_add_column_column_to_apipayments(db):
+async def m023_add_column_column_to_apipayments(db: Connection):
    """
    renames hash to payment_hash and drops unused index
    """
@@ -569,11 +575,11 @@ async def m023_add_column_column_to_apipayments(db):
    await db.execute("CREATE INDEX by_hash ON apipayments (payment_hash)")


-async def m024_drop_pending(db):
+async def m024_drop_pending(db: Connection):
    await db.execute("ALTER TABLE apipayments DROP COLUMN pending")


-async def m025_refresh_view(db):
+async def m025_refresh_view(db: Connection):
    await db.execute("DROP VIEW balances")
    await db.execute(
        """
@@ -592,7 +598,7 @@ async def m025_refresh_view(db):
    )


-async def m026_update_payment_table(db):
+async def m026_update_payment_table(db: Connection):
    await db.execute("ALTER TABLE apipayments ADD COLUMN tag TEXT")
    await db.execute("ALTER TABLE apipayments ADD COLUMN extension TEXT")
    await db.execute("ALTER TABLE apipayments ADD COLUMN created_at TIMESTAMP")
@@ -602,34 +608,52 @@ async def m026_update_payment_table(db):
 async def m027_update_apipayments_data(db: Connection):
    result = None
    try:
-        result = await db.execute("SELECT * FROM apipayments")
+        result = await db.execute("SELECT * FROM apipayments LIMIT 100")
    except Exception as exc:
        logger.warning("Could not select, trying again after cache cleared.")
        logger.debug(exc)
        await db.execute("COMMIT")

-    result = await db.execute("SELECT * FROM apipayments")
+    offset = 0
+    limit = 1000
+    payments: list[dict[Any, Any]] = []
+    logger.info("Updating payments")
+    while len(payments) > 0 or offset == 0:
+        logger.info(f"Updating {offset} to {offset+limit}")

-    payments = result.mappings().all()
-    for payment in payments:
-        tag = None
-        created_at = payment.get("time")
-        if payment.get("extra"):
-            extra = json.loads(payment.get("extra"))
-            tag = extra.get("tag")
-        tsph = db.timestamp_placeholder("created_at")
-        await db.execute(
+        result = await db.execute(
+            # Limit and Offset safe from SQL injection
+            # since they are integers and are not user input
            f"""
-            UPDATE apipayments
-            SET tag = :tag, created_at = {tsph}, updated_at = {tsph}
-            WHERE checking_id = :checking_id
-            """,
-            {
-                "tag": tag,
-                "created_at": created_at,
-                "checking_id": payment.get("checking_id"),
-            },
+                SELECT * FROM apipayments
+                ORDER BY time LIMIT {int(limit)} OFFSET {int(offset)}
+            """  # noqa: S608
        )
+        payments = result.mappings().all()
+        logger.info(f"Payments count: {len(payments)}")
+
+        for payment in payments:
+            tag = None
+            created_at = payment.get("time")
+            if payment.get("extra"):
+                extra = json.loads(str(payment.get("extra")))
+                tag = extra.get("tag")
+            tsph = db.timestamp_placeholder("created_at")
+            await db.execute(
+                # Timestamp placeholder is safe from SQL injection (not user input)
+                f"""
+                UPDATE apipayments
+                SET tag = :tag, created_at = {tsph}, updated_at = {tsph}
+                WHERE checking_id = :checking_id
+                """,  # noqa: S608
+                {
+                    "tag": tag,
+                    "created_at": created_at,
+                    "checking_id": payment.get("checking_id"),
+                },
+            )
+        offset += limit
+    logger.info("Payments updated")


 async def m028_update_settings(db: Connection):
@@ -666,7 +690,7 @@ async def m028_update_settings(db: Connection):
    await db.execute("drop table settings")


-async def m029_create_audit_table(db):
+async def m029_create_audit_table(db: Connection):
    await db.execute(
        f"""
        CREATE TABLE IF NOT EXISTS audit (
@@ -684,3 +708,38 @@ async def m029_create_audit_table(db):
        );
        """
    )
+
+
+async def m030_add_user_api_tokens_column(db: Connection):
+    await db.execute(
+        """
+        ALTER TABLE accounts ADD COLUMN access_control_list TEXT
+        """
+    )
+
+
+async def m031_add_color_and_icon_to_wallets(db: Connection):
+    """
+    Adds icon and color columns to wallets.
+    """
+    await db.execute("ALTER TABLE wallets ADD COLUMN extra TEXT")
+
+
+async def m032_add_external_id_to_accounts(db: Connection):
+    """
+    Adds external_id column to accounts.
+    Used for external account linking.
+    """
+    await db.execute("ALTER TABLE accounts ADD COLUMN external_id TEXT")
+
+
+async def m033_update_payment_table(db: Connection):
+    await db.execute("ALTER TABLE apipayments ADD COLUMN fiat_provider TEXT")
+
+
+async def m034_add_stored_paylinks_to_wallet(db: Connection):
+    await db.execute(
+        """
+        ALTER TABLE wallets ADD COLUMN stored_paylinks TEXT
+        """
+    )
@@ -1,5 +1,5 @@
 from .audit import AuditEntry, AuditFilters
-from .lnurl import CreateLnurl, CreateLnurlAuth, PayLnurlWData
+from .lnurl import CreateLnurlPayment, CreateLnurlWithdraw
 from .misc import (
    BalanceDelta,
    Callback,
@@ -9,15 +9,22 @@ from .misc import (
    SimpleStatus,
 )
 from .payments import (
+    CancelInvoice,
    CreateInvoice,
    CreatePayment,
    DecodePayment,
    PayInvoice,
    Payment,
+    PaymentCountField,
+    PaymentCountStat,
+    PaymentDailyStats,
    PaymentExtra,
    PaymentFilters,
    PaymentHistoryPoint,
+    PaymentsStatusCount,
    PaymentState,
+    PaymentWalletStats,
+    SettleInvoice,
 )
 from .tinyurl import TinyURL
 from .users import (
@@ -25,73 +32,73 @@ from .users import (
    Account,
    AccountFilters,
    AccountOverview,
-    CreateTopup,
    CreateUser,
    LoginUsernamePassword,
    LoginUsr,
    RegisterUser,
    ResetUserPassword,
+    UpdateBalance,
    UpdateSuperuserPassword,
    UpdateUser,
    UpdateUserPassword,
    UpdateUserPubkey,
    User,
+    UserAcls,
    UserExtra,
 )
 from .wallets import BaseWallet, CreateWallet, KeyType, Wallet, WalletTypeInfo
 from .webpush import CreateWebPushSubscription, WebPushSubscription

 __all__ = [
-    # audit
-    "AuditEntry",
-    "AuditFilters",
-    # lnurl
-    "CreateLnurl",
-    "CreateLnurlAuth",
-    "PayLnurlWData",
-    # misc
-    "BalanceDelta",
-    "Callback",
-    "ConversionData",
-    "CoreAppExtra",
-    "DbVersion",
-    "SimpleStatus",
-    # payments
-    "CreateInvoice",
-    "CreatePayment",
-    "DecodePayment",
-    "PayInvoice",
-    "Payment",
-    "PaymentExtra",
-    "PaymentFilters",
-    "PaymentHistoryPoint",
-    "PaymentState",
-    # tinyurl
-    "TinyURL",
-    # users
    "AccessTokenPayload",
    "Account",
    "AccountFilters",
    "AccountOverview",
-    "CreateTopup",
+    "AuditEntry",
+    "AuditFilters",
+    "BalanceDelta",
+    "BaseWallet",
+    "Callback",
+    "CancelInvoice",
+    "ConversionData",
+    "CoreAppExtra",
+    "CreateInvoice",
+    "CreateLnurlPayment",
+    "CreateLnurlWithdraw",
+    "CreatePayment",
    "CreateUser",
-    "RegisterUser",
+    "CreateWallet",
+    "CreateWebPushSubscription",
+    "DbVersion",
+    "DecodePayment",
+    "KeyType",
    "LoginUsernamePassword",
    "LoginUsr",
+    "PayInvoice",
+    "Payment",
+    "PaymentCountField",
+    "PaymentCountStat",
+    "PaymentDailyStats",
+    "PaymentExtra",
+    "PaymentFilters",
+    "PaymentHistoryPoint",
+    "PaymentState",
+    "PaymentWalletStats",
+    "PaymentsStatusCount",
+    "RegisterUser",
    "ResetUserPassword",
+    "SettleInvoice",
+    "SimpleStatus",
+    "TinyURL",
+    "UpdateBalance",
    "UpdateSuperuserPassword",
    "UpdateUser",
    "UpdateUserPassword",
    "UpdateUserPubkey",
    "User",
+    "UserAcls",
    "UserExtra",
-    # wallets
-    "BaseWallet",
-    "CreateWallet",
-    "KeyType",
    "Wallet",
    "WalletTypeInfo",
-    # webpush
-    "CreateWebPushSubscription",
    "WebPushSubscription",
 ]
@@ -1,7 +1,6 @@
 from __future__ import annotations

 from datetime import datetime, timedelta, timezone
-from typing import Optional

 from pydantic import BaseModel, Field

@@ -10,16 +9,16 @@ from lnbits.settings import settings


 class AuditEntry(BaseModel):
-    component: Optional[str] = None
-    ip_address: Optional[str] = None
-    user_id: Optional[str] = None
-    path: Optional[str] = None
-    request_type: Optional[str] = None
-    request_method: Optional[str] = None
-    request_details: Optional[str] = None
-    response_code: Optional[str] = None
+    component: str | None = None
+    ip_address: str | None = None
+    user_id: str | None = None
+    path: str | None = None
+    request_type: str | None = None
+    request_method: str | None = None
+    request_details: str | None = None
+    response_code: str | None = None
    duration: float
-    delete_at: Optional[datetime] = None
+    delete_at: datetime | None = None
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

    def __init__(self, **data):
@@ -42,17 +41,17 @@ class AuditFilters(FilterModel):
        "duration",
    ]

-    ip_address: Optional[str] = None
-    user_id: Optional[str] = None
-    path: Optional[str] = None
-    request_method: Optional[str] = None
-    response_code: Optional[str] = None
-    component: Optional[str] = None
+    ip_address: str | None = None
+    user_id: str | None = None
+    path: str | None = None
+    request_method: str | None = None
+    response_code: str | None = None
+    component: str | None = None


 class AuditCountStat(BaseModel):
-    field: str
-    total: float
+    field: str = ""
+    total: float = 0


 class AuditStats(BaseModel):
@@ -7,7 +7,7 @@ import os
 import shutil
 import zipfile
 from pathlib import Path
-from typing import Any, Optional
+from typing import Any

 import httpx
 from loguru import logger
@@ -16,6 +16,7 @@ from pydantic import BaseModel
 from lnbits.helpers import (
    download_url,
    file_hash,
+    is_lnbits_version_ok,
    version_parse,
 )
 from lnbits.settings import settings
@@ -28,21 +29,21 @@ class ExplicitRelease(BaseModel):
    archive: str
    hash: str
    dependencies: list[str] = []
-    repo: Optional[str]
-    icon: Optional[str]
-    short_description: Optional[str]
-    min_lnbits_version: Optional[str]
-    html_url: Optional[str]  # todo: release_url
-    warning: Optional[str]
-    info_notification: Optional[str]
-    critical_notification: Optional[str]
-    details_link: Optional[str]
-    pay_link: Optional[str]
+    repo: str | None
+    icon: str | None
+    short_description: str | None
+    min_lnbits_version: str | None
+    max_lnbits_version: str | None
+    html_url: str | None  # todo: release_url
+    warning: str | None
+    info_notification: str | None
+    critical_notification: str | None
+    details_link: str | None
+    paid_features: str | None
+    pay_link: str | None

    def is_version_compatible(self):
-        if not self.min_lnbits_version:
-            return True
-        return version_parse(self.min_lnbits_version) <= version_parse(settings.version)
+        return is_lnbits_version_ok(self.min_lnbits_version, self.max_lnbits_version)


 class GitHubRelease(BaseModel):
@@ -77,18 +78,17 @@ class ExtensionConfig(BaseModel):
    name: str
    short_description: str
    tile: str = ""
-    warning: Optional[str] = ""
-    min_lnbits_version: Optional[str]
+    warning: str | None = ""
+    min_lnbits_version: str | None
+    max_lnbits_version: str | None

-    def is_version_compatible(self):
-        if not self.min_lnbits_version:
-            return True
-        return version_parse(self.min_lnbits_version) <= version_parse(settings.version)
+    def is_version_compatible(self) -> bool:
+        return is_lnbits_version_ok(self.min_lnbits_version, self.max_lnbits_version)

    @classmethod
    async def fetch_github_release_config(
        cls, org: str, repo: str, tag_name: str
-    ) -> Optional[ExtensionConfig]:
+    ) -> ExtensionConfig | None:
        config_url = (
            f"https://raw.githubusercontent.com/{org}/{repo}/{tag_name}/config.json"
        )
@@ -98,28 +98,28 @@ class ExtensionConfig(BaseModel):


 class ReleasePaymentInfo(BaseModel):
-    amount: Optional[int] = None
-    pay_link: Optional[str] = None
-    payment_hash: Optional[str] = None
-    payment_request: Optional[str] = None
+    amount: int | None = None
+    pay_link: str | None = None
+    payment_hash: str | None = None
+    payment_request: str | None = None


 class PayToEnableInfo(BaseModel):
-    amount: int
+    amount: int = 0
    required: bool = False
-    wallet: Optional[str] = None
+    wallet: str | None = None


 class UserExtensionInfo(BaseModel):
-    paid_to_enable: Optional[bool] = False
-    payment_hash_to_enable: Optional[str] = None
+    paid_to_enable: bool | None = False
+    payment_hash_to_enable: str | None = None


 class UserExtension(BaseModel):
    user: str
    extension: str
    active: bool
-    extra: Optional[UserExtensionInfo] = None
+    extra: UserExtensionInfo | None = None

    @property
    def is_paid(self) -> bool:
@@ -141,16 +141,14 @@ class UserExtension(BaseModel):
 class Extension(BaseModel):
    code: str
    is_valid: bool
-    name: Optional[str] = None
-    short_description: Optional[str] = None
-    tile: Optional[str] = None
-    upgrade_hash: Optional[str] = ""
+    name: str | None = None
+    short_description: str | None = None
+    tile: str | None = None
+    upgrade_hash: str | None = ""

    @property
    def module_name(self) -> str:
        if self.is_upgrade_extension:
-            if settings.has_default_extension_path:
-                return f"lnbits.upgrades.{self.code}-{self.upgrade_hash}"
            return f"{self.code}-{self.upgrade_hash}"

        if settings.has_default_extension_path:
@@ -179,20 +177,22 @@ class ExtensionRelease(BaseModel):
    archive: str
    source_repo: str
    is_github_release: bool = False
-    hash: Optional[str] = None
-    min_lnbits_version: Optional[str] = None
-    is_version_compatible: Optional[bool] = True
-    html_url: Optional[str] = None
-    description: Optional[str] = None
-    warning: Optional[str] = None
-    repo: Optional[str] = None
-    icon: Optional[str] = None
-    details_link: Optional[str] = None
+    hash: str | None = None
+    min_lnbits_version: str | None = None
+    max_lnbits_version: str | None = None
+    is_version_compatible: bool | None = True
+    html_url: str | None = None
+    description: str | None = None
+    warning: str | None = None
+    repo: str | None = None
+    icon: str | None = None
+    details_link: str | None = None

-    pay_link: Optional[str] = None
-    cost_sats: Optional[int] = None
-    paid_sats: Optional[int] = 0
-    payment_hash: Optional[str] = None
+    paid_features: str | None = None
+    pay_link: str | None = None
+    cost_sats: int | None = None
+    paid_sats: int | None = 0
+    payment_hash: str | None = None

    @property
    def archive_url(self) -> str:
@@ -210,10 +210,11 @@ class ExtensionRelease(BaseModel):
        self.cost_sats = payment_info.amount if payment_info else None

    async def fetch_release_payment_info(
-        self, amount: Optional[int] = None
-    ) -> Optional[ReleasePaymentInfo]:
+        self, amount: int | None = None
+    ) -> ReleasePaymentInfo | None:
        url = f"{self.pay_link}?amount={amount}" if amount else self.pay_link
-        assert url, "Missing URL for payment info."
+        if not url:
+            raise ValueError("Missing URL for payment info.")
        try:
            async with httpx.AsyncClient() as client:
                resp = await client.get(url)
@@ -251,11 +252,13 @@ class ExtensionRelease(BaseModel):
            source_repo=source_repo,
            description=e.short_description,
            min_lnbits_version=e.min_lnbits_version,
+            max_lnbits_version=e.max_lnbits_version,
            is_version_compatible=e.is_version_compatible(),
            warning=e.warning,
            html_url=e.html_url,
            details_link=e.details_link,
            pay_link=e.pay_link,
+            paid_features=e.paid_features,
            repo=e.repo,
            icon=e.icon,
        )
@@ -282,7 +285,7 @@ class ExtensionRelease(BaseModel):
        return [GitHubRepoRelease.parse_obj(r) for r in releases]

    @classmethod
-    async def fetch_release_details(cls, details_link: str) -> Optional[dict]:
+    async def fetch_release_details(cls, details_link: str) -> dict | None:

        try:
            async with httpx.AsyncClient() as client:
@@ -301,24 +304,27 @@ class ExtensionRelease(BaseModel):


 class ExtensionMeta(BaseModel):
-    installed_release: Optional[ExtensionRelease] = None
-    latest_release: Optional[ExtensionRelease] = None
-    pay_to_enable: Optional[PayToEnableInfo] = None
+    installed_release: ExtensionRelease | None = None
+    latest_release: ExtensionRelease | None = None
+    pay_to_enable: PayToEnableInfo | None = None
    payments: list[ReleasePaymentInfo] = []
    dependencies: list[str] = []
-    archive: Optional[str] = None
+    archive: str | None = None
    featured: bool = False
+    paid_features: str | None = None
+    has_paid_release: bool = False
+    has_free_release: bool = False


 class InstallableExtension(BaseModel):
    id: str
    name: str
    version: str
-    active: Optional[bool] = False
-    short_description: Optional[str] = None
-    icon: Optional[str] = None
+    active: bool | None = False
+    short_description: str | None = None
+    icon: str | None = None
    stars: int = 0
-    meta: Optional[ExtensionMeta] = None
+    meta: ExtensionMeta | None = None

    @property
    def hash(self) -> str:
@@ -342,12 +348,13 @@ class InstallableExtension(BaseModel):

    @property
    def ext_upgrade_dir(self) -> Path:
-        return Path(
-            settings.lnbits_extensions_path, "upgrades", f"{self.id}-{self.hash}"
-        )
+        return Path(settings.lnbits_extensions_upgrade_path, f"{self.id}-{self.hash}")

    @property
    def module_name(self) -> str:
+        if self.ext_upgrade_dir.is_dir():
+            return f"{self.id}-{self.hash}"
+
        if settings.has_default_extension_path:
            return f"lnbits.extensions.{self.id}"
        return self.id
@@ -376,9 +383,8 @@ class InstallableExtension(BaseModel):
        if ext_zip_file.is_file():
            os.remove(ext_zip_file)
        try:
-            assert (
-                self.meta and self.meta.installed_release
-            ), "installed_release is none."
+            if not self.meta or not self.meta.installed_release:
+                raise ValueError("No installed release.")

            self._restore_payment_info()

@@ -405,13 +411,10 @@ class InstallableExtension(BaseModel):

    def extract_archive(self):
        logger.info(f"Extracting extension {self.name} ({self.installed_version}).")
-        Path(settings.lnbits_extensions_path, "upgrades").mkdir(
-            parents=True, exist_ok=True
-        )
+        Path(settings.lnbits_extensions_upgrade_path).mkdir(parents=True, exist_ok=True)

        tmp_dir = Path(settings.lnbits_data_folder, "unzip-temp", self.hash)
        shutil.rmtree(tmp_dir, True)
-
        with zipfile.ZipFile(self.zip_path, "r") as zip_ref:
            zip_ref.extractall(tmp_dir)
        generated_dir_name = os.listdir(tmp_dir)[0]
@@ -454,9 +457,23 @@ class InstallableExtension(BaseModel):

        shutil.rmtree(self.ext_upgrade_dir, True)

-    def check_latest_version(self, release: Optional[ExtensionRelease]):
+    def check_release_updates(self, release: ExtensionRelease | None):
+        self._check_latest_version(release)
+        self._check_payment_link(release)
+
+    def find_existing_payment(self, pay_link: str | None) -> ReleasePaymentInfo | None:
+        if not pay_link or not self.meta or not self.meta.payments:
+            return None
+        return next(
+            (p for p in self.meta.payments if p.pay_link == pay_link),
+            None,
+        )
+
+    def _check_latest_version(self, release: ExtensionRelease | None):
        if not release:
            return
+        if not release.is_version_compatible:
+            return
        if not self.meta or not self.meta.latest_release:
            meta = self.meta or ExtensionMeta()
            meta.latest_release = release
@@ -467,15 +484,19 @@ class InstallableExtension(BaseModel):
        ):
            self.meta.latest_release = release

-    def find_existing_payment(
-        self, pay_link: Optional[str]
-    ) -> Optional[ReleasePaymentInfo]:
-        if not pay_link or not self.meta or not self.meta.payments:
-            return None
-        return next(
-            (p for p in self.meta.payments if p.pay_link == pay_link),
-            None,
-        )
+    def _check_payment_link(self, release: ExtensionRelease | None):
+        if not release:
+            return
+        if not release.is_version_compatible:
+            return
+        if not self.meta:
+            self.meta = ExtensionMeta()
+        if release.pay_link:
+            self.meta.has_paid_release = True
+        else:
+            self.meta.has_free_release = True
+        if release.paid_features:
+            self.meta.paid_features = release.paid_features

    def _restore_payment_info(self):
        if (
@@ -509,7 +530,7 @@ class InstallableExtension(BaseModel):
    @classmethod
    async def from_github_release(
        cls, github_release: GitHubRelease
-    ) -> Optional[InstallableExtension]:
+    ) -> InstallableExtension | None:
        try:
            repo, latest_release, config = await cls.fetch_github_repo_info(
                github_release.organisation, github_release.repository
@@ -548,7 +569,7 @@ class InstallableExtension(BaseModel):
        )

    @classmethod
-    def from_ext_dir(cls, ext_id: str) -> Optional[InstallableExtension]:
+    def from_ext_dir(cls, ext_id: str) -> InstallableExtension | None:
        try:
            conf_path = Path(
                settings.lnbits_extensions_path, "extensions", ext_id, "config.json"
@@ -573,6 +594,7 @@ class InstallableExtension(BaseModel):
                            archive=f"{conf_path}",
                            source_repo=f"{conf_path}",
                            min_lnbits_version=config_json.get("min_lnbits_version"),
+                            max_lnbits_version=config_json.get("max_lnbits_version"),
                        )
                    ),
                )
@@ -587,7 +609,6 @@ class InstallableExtension(BaseModel):
        cls,
    ) -> list[InstallableExtension]:
        extension_list: list[InstallableExtension] = []
-        extension_id_list: list[str] = []

        for url in settings.lnbits_extensions_manifests:
            try:
@@ -601,14 +622,13 @@ class InstallableExtension(BaseModel):
                        (ee for ee in extension_list if ee.id == r.id), None
                    )
                    if existing_ext and ext.meta:
-                        existing_ext.check_latest_version(ext.meta.latest_release)
+                        existing_ext.check_release_updates(ext.meta.latest_release)
                        continue

                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
                    ext.meta = meta
                    extension_list += [ext]
-                    extension_id_list += [ext.id]

                for e in manifest.extensions:
                    release = ExtensionRelease.from_explicit_release(url, e)
@@ -616,25 +636,28 @@ class InstallableExtension(BaseModel):
                        (ee for ee in extension_list if ee.id == e.id), None
                    )
                    if existing_ext:
-                        existing_ext.check_latest_version(release)
+                        existing_ext.check_release_updates(release)
                        continue
                    ext = InstallableExtension.from_explicit_release(e)
-                    ext.check_latest_version(release)
+                    ext.check_release_updates(release)
                    meta = ext.meta or ExtensionMeta()
                    meta.featured = ext.id in manifest.featured
                    ext.meta = meta
                    extension_list += [ext]
-                    extension_id_list += [e.id]
            except Exception as e:
                logger.warning(f"Manifest {url} failed with '{e!s}'")

+        settings.lnbits_all_extensions_ids = {e.id for e in extension_list}
        return extension_list

    @classmethod
    async def get_extension_releases(cls, ext_id: str) -> list[ExtensionRelease]:
        extension_releases: list[ExtensionRelease] = []
-
-        for url in settings.lnbits_extensions_manifests:
+        all_manifests = [
+            *settings.lnbits_extensions_manifests,
+            settings.lnbits_extensions_builder_manifest_url,
+        ]
+        for url in all_manifests:
            try:
                manifest = await cls.fetch_manifest(url)
                for r in manifest.repos:
@@ -660,7 +683,7 @@ class InstallableExtension(BaseModel):
    @classmethod
    async def get_extension_release(
        cls, ext_id: str, source_repo: str, archive: str, version: str
-    ) -> Optional[ExtensionRelease]:
+    ) -> ExtensionRelease | None:
        all_releases: list[ExtensionRelease] = (
            await InstallableExtension.get_extension_releases(ext_id)
        )
@@ -711,8 +734,8 @@ class CreateExtension(BaseModel):
    archive: str
    source_repo: str
    version: str
-    cost_sats: Optional[int] = 0
-    payment_hash: Optional[str] = None
+    cost_sats: int | None = 0
+    payment_hash: str | None = None


 class ExtensionDetailsRequest(BaseModel):
@@ -721,7 +744,7 @@ class ExtensionDetailsRequest(BaseModel):
    version: str


-async def github_api_get(url: str, error_msg: Optional[str]) -> Any:
+async def github_api_get(url: str, error_msg: str | None) -> Any:
    headers = {"User-Agent": settings.user_agent}
    if settings.lnbits_ext_github_token:
        headers["Authorization"] = f"Bearer {settings.lnbits_ext_github_token}"
@@ -733,7 +756,7 @@ async def github_api_get(url: str, error_msg: Optional[str]) -> Any:
        return resp.json()


-def icon_to_github_url(source_repo: str, path: Optional[str]) -> str:
+def icon_to_github_url(source_repo: str, path: str | None) -> str:
    if not path:
        return ""
    _, _, *rest = path.split("/")
@@ -0,0 +1,460 @@
+from __future__ import annotations
+
+import json
+from datetime import datetime, timedelta, timezone
+from typing import Any, Literal
+
+from pydantic import BaseModel, validator
+
+from lnbits.helpers import (
+    camel_to_snake,
+    is_camel_case,
+    is_snake_case,
+    urlsafe_short_hash,
+)
+
+
+class DataField(BaseModel):
+    name: str
+    type: str
+    label: str | None = None
+    hint: str | None = None
+    optional: bool = False
+    editable: bool = False
+    searchable: bool = False
+    sortable: bool = False
+    fields: list[DataField] = []
+
+    def normalize(self) -> None:
+        self.name = self.name.strip()
+        self.type = self.type.strip()
+        if self.label:
+            self.label = self.label.strip()
+        if self.hint:
+            self.hint = self.hint.strip()
+        if self.type == "json":
+            self.editable = False
+            self.searchable = False
+            self.sortable = False
+        else:
+            self.fields = []
+
+        for field in self.fields:
+            field.normalize()
+
+    def field_to_py(self) -> str:
+        field_name = camel_to_snake(self.name)
+        field_type = self.type
+        if self.type == "json":
+            field_type = "dict"
+        elif self.type in ["wallet", "currency", "text"]:
+            field_type = "str"
+        if self.optional:
+            field_type += " | None"
+        if self.type == "currency":
+            field_type += ' = "sat"'
+        return f"{field_name}: {field_type}"
+
+    def field_to_js(self) -> str:
+        field_name = camel_to_snake(self.name)
+        default_value = "null"
+        if self.type == "json":
+            default_value = "{}"
+        if self.type == "currency":
+            default_value = '"sat"'
+        return f"{field_name}: {default_value}"
+
+    def field_to_ui_table_column(self) -> str:
+        column = {
+            "name": self.name,
+            "align": "left",
+            "label": self.label or self.name,
+            "field": self.name,
+            "sortable": self.sortable,
+        }
+
+        return json.dumps(column)
+
+    def field_to_db(self) -> str:
+        field_name = camel_to_snake(self.name)
+        field_type = self.type
+        if field_type == "str":
+            db_type = "TEXT"
+        elif field_type == "int":
+            db_type = "INT"
+        elif field_type == "float":
+            db_type = "REAL"
+        elif field_type == "bool":
+            db_type = "BOOLEAN"
+        elif field_type == "datetime":
+            db_type = "TIMESTAMP"
+        else:
+            db_type = "TEXT"
+
+        db_field = f"{field_name} {db_type}"
+        if not self.optional:
+            db_field += " NOT NULL"
+        if field_type == "json":
+            db_field += " DEFAULT '{empty_dict}'"
+        return db_field
+
+    def field_mock_value(self, index: int) -> Any:
+        if self.name == "id":
+            return urlsafe_short_hash()
+        if self.type == "int":
+            return index
+        elif self.type == "float":
+            return float(f"{index}.0{index * 2}")
+        elif self.type == "bool":
+            return True if index % 2 == 0 else False
+        elif self.type == "datetime":
+            return (datetime.now(timezone.utc) - timedelta(hours=index * 2)).isoformat()
+        elif self.type == "json":
+            return {"key": "value"}
+        elif self.type == "currency":
+            return "USD"
+        else:
+            return f"{self.name} {index}"
+
+    @validator("name")
+    def validate_name(cls, v: str) -> str:
+        if v.strip() == "":
+            raise ValueError("Field name is required.")
+        if not is_snake_case(v):
+            raise ValueError(f"Field Name must be snake_case. Found: {v}")
+        return v
+
+    @validator("type")
+    def validate_type(cls, v: str) -> str:
+        if v.strip() == "":
+            raise ValueError("Owner Data type is required")
+        if v not in [
+            "str",
+            "int",
+            "float",
+            "bool",
+            "datetime",
+            "json",
+            "wallet",
+            "currency",
+            "text",
+        ]:
+            raise ValueError(
+                "Field Type must be one of: "
+                "str, int, float, bool, datetime, json, wallet, currency, text."
+                f" Found: {v}"
+            )
+        return v
+
+    @validator("label")
+    def validate_label(cls, v: str | None) -> str | None:
+        if v and '"' in v:
+            raise ValueError(
+                f'Field label cannot contain double quotes ("). Value: {v}'
+            )
+        return v
+
+    @validator("hint")
+    def validate_hint(cls, v: str | None) -> str | None:
+        if v and '"' in v:
+            raise ValueError(f'Field hint cannot contain double quotes ("). Value: {v}')
+        return v
+
+
+class DataFields(BaseModel):
+    name: str
+    editable: bool = True
+    fields: list[DataField] = []
+
+    def __init__(self, **data):
+        super().__init__(**data)
+        self.normalize()
+
+    def normalize(self) -> None:
+        self.name = self.name.strip()
+        for field in self.fields:
+            field.normalize()
+        if all(not field.editable for field in self.fields):
+            self.editable = False
+
+    def get_field_by_name(self, name: str | None) -> DataField | None:
+        if not name:
+            return None
+        for field in self.fields:
+            if field.name == name:
+                return field
+        return None
+
+    @validator("name")
+    def validate_name(cls, v: str) -> str:
+        if v.strip() == "":
+            raise ValueError("Data fields name is required")
+        if not is_camel_case(v):
+            raise ValueError(f"Data name must be CamelCase. Found: {v}")
+        return v
+
+
+class SettingsFields(DataFields):
+    enabled: bool = False
+    type: str = "user"
+
+    @validator("type")
+    def validate_type(cls, v: str) -> str:
+        if v.strip() == "":
+            raise ValueError("Settings type is required")
+        if v not in ["user", "admin"]:
+            raise ValueError("Field Type must be one of: user, admin." f" Found: {v}")
+        return v
+
+
+class ActionFields(BaseModel):
+    generate_action: bool = False
+    generate_payment_logic: bool = False
+    wallet_id: str | None = None
+    currency: str | None = None
+    amount: str | None = None
+    amount_source: Literal["owner_data", "client_data"] | None = None
+    paid_flag: str | None = None
+
+
+class OwnerDataFields(BaseModel):
+    name: str | None = None
+    description: str | None = None
+
+
+class ClientDataFields(BaseModel):
+    public_inputs: list[str] = []
+
+
+class PublicPageFields(BaseModel):
+    has_public_page: bool = False
+    owner_data_fields: OwnerDataFields
+    client_data_fields: ClientDataFields
+    action_fields: ActionFields
+
+
+class PreviewAction(BaseModel):
+    is_preview_mode: bool = False
+    is_settings_preview: bool = False
+    is_owner_data_preview: bool = False
+    is_client_data_preview: bool = False
+    is_public_page_preview: bool = False
+
+    def __init__(self, **data):
+        super().__init__(**data)
+        if not self.is_preview_mode:
+            self.is_settings_preview = False
+            self.is_owner_data_preview = False
+            self.is_client_data_preview = False
+            self.is_public_page_preview = False
+
+
+class ExtensionData(BaseModel):
+    id: str
+    name: str
+    stub_version: str | None
+    short_description: str | None = None
+    description: str | None = None
+    owner_data: DataFields
+    client_data: DataFields
+    settings_data: SettingsFields
+    public_page: PublicPageFields
+    preview_action: PreviewAction = PreviewAction()
+
+    def __init__(self, **data):
+        super().__init__(**data)
+        self.validate_data()
+        self.normalize()
+
+    def normalize(self) -> None:
+        self.id = self.id.strip()
+        self.name = self.name.strip()
+        if self.stub_version:
+            self.stub_version = self.stub_version.strip()
+        if self.short_description:
+            self.short_description = self.short_description.strip()
+        if self.description:
+            self.description = self.description.strip()
+        if not self.public_page.has_public_page:
+            self.public_page.action_fields.generate_action = False
+            self.public_page.action_fields.generate_payment_logic = False
+        if not self.public_page.action_fields.generate_action:
+            self.public_page.action_fields.generate_payment_logic = False
+
+    def validate_data(self) -> None:
+        self._validate_field_names()
+        self._validate_public_page_fields()
+        self._validate_action_fields()
+
+    def _validate_public_page_fields(self) -> None:
+        if not self.public_page.has_public_page:
+            return
+
+        public_page_name = self.public_page.owner_data_fields.name
+        if public_page_name:
+            public_page_name_field = self.owner_data.get_field_by_name(public_page_name)
+            if not public_page_name_field:
+                raise ValueError(
+                    "Public Page Name must be one of the owner data fields."
+                    f" Received: {public_page_name}."
+                )
+
+        public_page_description = self.public_page.owner_data_fields.description
+        if public_page_description:
+            public_page_description_field = self.owner_data.get_field_by_name(
+                public_page_description
+            )
+            if not public_page_description_field:
+                raise ValueError(
+                    "Public Page Description must be one of the owner data fields."
+                    f" Received: {public_page_description}."
+                )
+
+        public_page_inputs = self.public_page.client_data_fields.public_inputs
+        if public_page_inputs:
+            for input_field in public_page_inputs:
+                input_field_obj = self.client_data.get_field_by_name(input_field)
+                if not input_field_obj:
+                    raise ValueError(
+                        "Public Page Input fields"
+                        " must be one of the client data fields."
+                        f" Received: {input_field}."
+                    )
+
+    def _validate_action_fields(self) -> None:
+        if not self.public_page.action_fields.generate_action:
+            return
+        if not self.public_page.action_fields.generate_payment_logic:
+            return
+
+        self._validate_owner_data_fields()
+        self._validate_client_data_fields()
+
+    def _validate_owner_data_fields(self) -> None:
+        wallet_id = self.public_page.action_fields.wallet_id
+        if wallet_id:
+            wallet_id_field = self.owner_data.get_field_by_name(wallet_id)
+            if not wallet_id_field:
+                raise ValueError(
+                    "Action Wallet ID must be one of the owner data fields."
+                    f" Received: {wallet_id}."
+                )
+            if wallet_id_field.type != "wallet":
+                raise ValueError(
+                    "Action Wallet ID field type must be 'wallet'."
+                    f" Received: {wallet_id_field.type}."
+                )
+        currency = self.public_page.action_fields.currency
+        if currency:
+            currency_field = self.owner_data.get_field_by_name(currency)
+            if not currency_field:
+                raise ValueError(
+                    "Action Currency must be one of the owner data fields."
+                    f" Received: {currency}."
+                )
+            if currency_field.type != "currency":
+                raise ValueError(
+                    "Action Currency field type must be 'currency'."
+                    f" Received: {currency_field.type}."
+                )
+
+    def _validate_field_names(self) -> None:
+        reserved_names = {"id", "created_at", "updated_at"}
+        nok = {f.name for f in self.owner_data.fields}.intersection(reserved_names)
+        if nok:
+            raise ValueError(
+                f"Owner Data fields cannot have reserved names: '{', '.join(nok)}.'"
+            )
+        nok = {f.name for f in self.client_data.fields}.intersection(reserved_names)
+        if nok:
+            raise ValueError(
+                f"Client Data fields cannot have reserved names: '{', '.join(nok)}.'"
+            )
+        nok = {f.name for f in self.settings_data.fields}.intersection(reserved_names)
+        if nok:
+            raise ValueError(
+                f"Settings fields cannot have reserved names: '{', '.join(nok)}.'"
+            )
+
+    def _validate_client_data_fields(self) -> None:
+        amount = self.public_page.action_fields.amount
+        amount_source = self.public_page.action_fields.amount_source
+        if amount_source and amount:
+            if amount_source == "owner_data":
+                amount_field = self.owner_data.get_field_by_name(amount)
+            else:
+                amount_field = self.client_data.get_field_by_name(amount)
+            if not amount_field:
+                raise ValueError(
+                    "Action Amount must be one of the "
+                    "client data or owner data fields."
+                    f" Received: {amount}."
+                )
+            if amount_field.type not in ["int", "float"]:
+                raise ValueError(
+                    "Action Amount field type must be 'int' or 'float'."
+                    f" Received: {amount_field.type}."
+                )
+        paid_flag = self.public_page.action_fields.paid_flag
+        if paid_flag:
+            paid_flag_field = self.client_data.get_field_by_name(paid_flag)
+            if not paid_flag_field:
+                raise ValueError(
+                    "Action Paid Flag must be one of the client data fields."
+                    f" Received: {paid_flag}."
+                )
+            if paid_flag_field.type != "bool":
+                raise ValueError(
+                    "Action Paid Flag field type must be 'bool'."
+                    f" Received: {paid_flag_field.type}."
+                )
+
+    @validator("id")
+    def validate_id(cls, v: str) -> str:
+        if v.strip() == "":
+            raise ValueError("Extension ID is required")
+        if not is_snake_case(v):
+            raise ValueError(f"Extension Id must be snake_case. Found: {v}")
+        return v
+
+    @validator("name")
+    def validate_name(cls, v: str) -> str:
+        if v.strip() == "":
+            raise ValueError("Extension name is required")
+        return v
+
+    @validator("stub_version")
+    def validate_stub_version(cls, v: str | None) -> str | None:
+        if v and '"' in v:
+            raise ValueError(
+                f'Extension stub version cannot contain double quotes ("). Value: {v}'
+            )
+        return v
+
+    @validator("short_description")
+    def validate_short_description(cls, v: str | None) -> str | None:
+        if v and '"' in v:
+            raise ValueError(
+                f'Field short description cannot contain double quotes ("). Value: {v}'
+            )
+        return v
+
+    @validator("description")
+    def validate_description(cls, v: str | None) -> str | None:
+        if v and '"' in v:
+            raise ValueError(
+                f'Field description cannot contain double quotes ("). Value: {v}'
+            )
+        return v
+
+    @validator("owner_data")
+    def validate_owner_data(cls, v: DataFields) -> DataFields:
+        if len(v.fields) == 0:
+            raise ValueError("At least one owner data field is required")
+        return v
+
+    @validator("client_data")
+    def validate_client_data(cls, v: DataFields) -> DataFields:
+        if len(v.fields) == 0:
+            raise ValueError("At least one client data field is required")
+        return v
@@ -1,20 +1,31 @@
-from typing import Optional
+from time import time

-from pydantic import BaseModel
+from lnurl import LnAddress, Lnurl, LnurlPayResponse
+from pydantic import BaseModel, Field


-class CreateLnurl(BaseModel):
-    description_hash: str
-    callback: str
+class CreateLnurlPayment(BaseModel):
+    res: LnurlPayResponse | None = None
+    lnurl: Lnurl | LnAddress | None = None
    amount: int
-    comment: Optional[str] = None
-    description: Optional[str] = None
-    unit: Optional[str] = None
+    comment: str | None = None
+    unit: str | None = None
+    internal_memo: str | None = None


-class CreateLnurlAuth(BaseModel):
-    callback: str
+class CreateLnurlWithdraw(BaseModel):
+    lnurl_w: Lnurl


-class PayLnurlWData(BaseModel):
-    lnurl_w: str
+class LnurlScan(BaseModel):
+    lnurl: Lnurl | LnAddress
+
+
+class StoredPayLink(BaseModel):
+    lnurl: str
+    label: str
+    last_used: int = Field(default_factory=lambda: int(time()))
+
+
+class StoredPayLinks(BaseModel):
+    links: list[StoredPayLink] = []
@@ -1,6 +1,6 @@
 from __future__ import annotations

-from typing import Callable
+from collections.abc import Callable

 from pydantic import BaseModel

@@ -25,12 +25,12 @@ class Callback(BaseModel):


 class BalanceDelta(BaseModel):
-    lnbits_balance_msats: int
-    node_balance_msats: int
+    lnbits_balance_sats: int
+    node_balance_sats: int

    @property
-    def delta_msats(self):
-        return self.node_balance_msats - self.lnbits_balance_msats
+    def delta_sats(self) -> int:
+        return int(self.lnbits_balance_sats - self.node_balance_sats)


 class SimpleStatus(BaseModel):
@@ -38,6 +38,16 @@ class SimpleStatus(BaseModel):
    message: str


+class SimpleItem(BaseModel):
+    id: str
+    name: str
+
+
 class DbVersion(BaseModel):
    db: str
    version: int
+
+
+class Image(BaseModel):
+    filename: str
+    directory: str = "library"
@@ -0,0 +1,68 @@
+from enum import Enum
+
+from pydantic import BaseModel
+
+from lnbits.core.models.users import UserNotifications
+
+
+class NotificationType(Enum):
+    server_status = "server_status"
+    settings_update = "settings_update"
+    balance_update = "balance_update"
+    watchdog_check = "watchdog_check"
+    balance_delta = "balance_delta"
+    server_start_stop = "server_start_stop"
+    incoming_payment = "incoming_payment"
+    outgoing_payment = "outgoing_payment"
+    text_message = "text_message"
+
+
+class NotificationMessage(BaseModel):
+    message_type: NotificationType
+    values: dict
+    user_notifications: UserNotifications | None = None
+
+
+NOTIFICATION_TEMPLATES = {
+    "text_message": "{message}",
+    "server_status": """*SERVER STATUS*
+        *Up time*: `{up_time}`.
+        *Accounts*: `{accounts_count}`.
+        *Wallets*: `{wallets_count}`.
+        *In/Out payments*: `{in_payments_count}`/`{out_payments_count}`.
+        *Pending payments*: `{pending_payments_count}`.
+        *Failed payments*: `{failed_payments_count}`.
+        *LNbits balance*: `{lnbits_balance_sats}` sats.
+        *Node balance*: `{node_balance_sats}` sats.""",
+    "server_start_stop": """*SERVER*
+        {message}
+        *Time*: `{up_time}` seconds.
+    """,
+    "settings_update": """*SETTINGS UPDATED*
+        User: `{username}`.
+    """,
+    "balance_update": """*WALLET CREDIT/DEBIT*
+        Wallet `{wallet_name}` balance updated with `{amount}` sats.
+        *Current balance*: `{balance}` sats.
+        *Wallet ID*: `{wallet_id}`
+        """,
+    "watchdog_check": """*WATCHDOG BALANCE CHECK*
+        *Delta*: `{delta_sats}` sats.
+        *LNbits balance*: `{lnbits_balance_sats}` sats.
+        *Node balance*: `{node_balance_sats}` sats.
+        *Switching to Void Wallet*: `{switch_to_void_wallet}`.
+        """,
+    "balance_delta": """*BALANCE DELTA CHANGED*
+        *New delta*: `{delta_sats}` sats.
+        *Old delta*: `{old_delta_sats}` sats.
+        *LNbits balance*: `{lnbits_balance_sats}` sats.
+        *Node balance*: `{node_balance_sats}` sats.
+        """,
+    "outgoing_payment": """*PAYMENT SENT*
+        *Amount*: {fiat_value_fmt}`{amount_sats}`*sats*.
+        *Wallet*: `{wallet_name}` ({wallet_id}).""",
+    "incoming_payment": """*PAYMENT RECEIVED*
+        *Amount*: {fiat_value_fmt}`{amount_sats}`*sats*.
+        *Wallet*: `{wallet_name}` ({wallet_id}).
+        """,
+}
@@ -2,12 +2,20 @@ from __future__ import annotations

 from datetime import datetime, timezone
 from enum import Enum
-from typing import Optional
+from typing import Literal

 from fastapi import Query
+from lnurl import LnurlWithdrawResponse
 from pydantic import BaseModel, Field, validator

 from lnbits.db import FilterModel
+from lnbits.fiat import get_fiat_provider
+from lnbits.fiat.base import (
+    FiatPaymentFailedStatus,
+    FiatPaymentPendingStatus,
+    FiatPaymentStatus,
+    FiatPaymentSuccessStatus,
+)
 from lnbits.utils.exchange_rates import allowed_currencies
 from lnbits.wallets import get_funding_source
 from lnbits.wallets.base import (
@@ -28,16 +36,16 @@ class PaymentState(str, Enum):


 class PaymentExtra(BaseModel):
-    comment: Optional[str] = None
-    success_action: Optional[str] = None
-    lnurl_response: Optional[str] = None
+    comment: str | None = None
+    success_action: str | None = None
+    lnurl_response: str | None = None


 class PayInvoice(BaseModel):
    payment_request: str
-    description: Optional[str] = None
-    max_sat: Optional[int] = None
-    extra: Optional[dict] = {}
+    description: str | None = None
+    max_sat: int | None = None
+    extra: dict | None = {}


 class CreatePayment(BaseModel):
@@ -46,10 +54,10 @@ class CreatePayment(BaseModel):
    bolt11: str
    amount_msat: int
    memo: str
-    extra: Optional[dict] = {}
-    preimage: Optional[str] = None
-    expiry: Optional[datetime] = None
-    webhook: Optional[str] = None
+    extra: dict | None = {}
+    preimage: str | None = None
+    expiry: datetime | None = None
+    webhook: str | None = None
    fee: int = 0


@@ -60,14 +68,16 @@ class Payment(BaseModel):
    amount: int
    fee: int
    bolt11: str
+    # payment_request: str | None
+    fiat_provider: str | None = None
    status: str = PaymentState.PENDING
-    memo: Optional[str] = None
-    expiry: Optional[datetime] = None
-    webhook: Optional[str] = None
-    webhook_status: Optional[int] = None
-    preimage: Optional[str] = None
-    tag: Optional[str] = None
-    extension: Optional[str] = None
+    memo: str | None = None
+    expiry: datetime | None = None
+    webhook: str | None = None
+    webhook_status: str | None = None
+    preimage: str | None = None
+    tag: str | None = None
+    extension: str | None = None
    time: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
@@ -107,14 +117,23 @@ class Payment(BaseModel):

    @property
    def is_internal(self) -> bool:
-        return self.checking_id.startswith("internal_")
+        return self.checking_id.startswith("internal_") or self.checking_id.startswith(
+            "fiat_"
+        )

-    async def check_status(self) -> PaymentStatus:
+    async def check_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> PaymentStatus:
        if self.is_internal:
            if self.success:
                return PaymentSuccessStatus()
            if self.failed:
                return PaymentFailedStatus()
+            if self.is_in and self.fiat_provider:
+                fiat_status = await self.check_fiat_status(
+                    skip_internal_payment_notifications
+                )
+                return PaymentStatus(paid=fiat_status.paid)
            return PaymentPendingStatus()
        funding_source = get_funding_source()
        if self.is_out:
@@ -123,23 +142,95 @@ class Payment(BaseModel):
            status = await funding_source.get_invoice_status(self.checking_id)
        return status

+    async def check_fiat_status(
+        self, skip_internal_payment_notifications: bool | None = False
+    ) -> FiatPaymentStatus:
+        if not self.is_internal:
+            return FiatPaymentPendingStatus()
+        if self.success:
+            return FiatPaymentSuccessStatus()
+        if self.failed:
+            return FiatPaymentFailedStatus()
+
+        if not self.fiat_provider:
+            return FiatPaymentPendingStatus()
+
+        checking_id = self.extra.get("fiat_checking_id")
+        if not checking_id:
+            return FiatPaymentPendingStatus()
+
+        fiat_provider = await get_fiat_provider(self.fiat_provider)
+        if not fiat_provider:
+            return FiatPaymentPendingStatus()
+        fiat_status = await fiat_provider.get_invoice_status(checking_id)
+
+        if skip_internal_payment_notifications:
+            return fiat_status
+
+        if fiat_status.success:
+            # notify receivers asynchronously
+            from lnbits.tasks import internal_invoice_queue
+
+            await internal_invoice_queue.put(self.checking_id)
+
+        return fiat_status
+

 class PaymentFilters(FilterModel):
-    __search_fields__ = ["memo", "amount"]
+    __search_fields__ = ["memo", "amount", "wallet_id", "tag", "status", "time"]

-    checking_id: str
+    __sort_fields__ = ["created_at", "amount", "fee", "memo", "time", "tag"]
+
+    status: str | None
+    tag: str | None
+    checking_id: str | None
    amount: int
    fee: int
-    memo: Optional[str]
+    memo: str | None
    time: datetime
-    bolt11: str
-    preimage: str
-    payment_hash: str
-    expiry: Optional[datetime]
-    extra: dict = {}
-    wallet_id: str
-    webhook: Optional[str]
-    webhook_status: Optional[int]
+    preimage: str | None
+    payment_hash: str | None
+    wallet_id: str | None
+
+
+class PaymentDataPoint(BaseModel):
+    date: datetime
+    count: int
+    max_amount: int
+    min_amount: int
+    average_amount: int
+    total_amount: int
+    max_fee: int
+    min_fee: int
+    average_fee: int
+    total_fee: int
+
+
+PaymentCountField = Literal["status", "tag", "extension", "wallet_id"]
+
+
+class PaymentCountStat(BaseModel):
+    field: str = ""
+    total: float = 0
+
+
+class PaymentWalletStats(BaseModel):
+    wallet_id: str = ""
+    wallet_name: str = ""
+    user_id: str = ""
+    payments_count: int
+    balance: float = 0
+
+
+class PaymentDailyStats(BaseModel):
+    date: datetime
+    balance: float = 0
+    balance_in: float | None = 0
+    balance_out: float | None = 0
+    payments_count: int = 0
+    count_in: int | None = 0
+    count_out: int | None = 0
+    fee: float = 0


 class PaymentHistoryPoint(BaseModel):
@@ -151,7 +242,7 @@ class PaymentHistoryPoint(BaseModel):

 class DecodePayment(BaseModel):
    data: str
-    filter_fields: Optional[list[str]] = []
+    filter_fields: list[str] | None = []


 class CreateInvoice(BaseModel):
@@ -159,14 +250,27 @@ class CreateInvoice(BaseModel):
    internal: bool = False
    out: bool = True
    amount: float = Query(None, ge=0)
-    memo: Optional[str] = None
-    description_hash: Optional[str] = None
-    unhashed_description: Optional[str] = None
-    expiry: Optional[int] = None
-    extra: Optional[dict] = None
-    webhook: Optional[str] = None
-    bolt11: Optional[str] = None
-    lnurl_callback: Optional[str] = None
+    memo: str | None = Query(None, max_length=640)
+    description_hash: str | None = None
+    unhashed_description: str | None = None
+    payment_hash: str | None = Query(
+        None,
+        description="The payment hash of the hold invoice.",
+        min_length=64,
+        max_length=64,
+    )
+    expiry: int | None = None
+    extra: dict | None = None
+    webhook: str | None = None
+    bolt11: str | None = None
+    lnurl_withdraw: LnurlWithdrawResponse | None = None
+    fiat_provider: str | None = None
+
+    @validator("payment_hash")
+    def check_hex(cls, v):
+        if v:
+            _ = bytes.fromhex(v)
+        return v

    @validator("unit")
    @classmethod
@@ -174,3 +278,38 @@ class CreateInvoice(BaseModel):
        if v != "sat" and v not in allowed_currencies():
            raise ValueError("The provided unit is not supported")
        return v
+
+
+class PaymentsStatusCount(BaseModel):
+    incoming: int = 0
+    outgoing: int = 0
+    failed: int = 0
+    pending: int = 0
+
+
+class SettleInvoice(BaseModel):
+    preimage: str = Field(
+        ...,
+        description="The preimage of the payment hash to settle the invoice.",
+        min_length=64,
+        max_length=64,
+    )
+
+    @validator("preimage")
+    def check_hex(cls, v):
+        _ = bytes.fromhex(v)
+        return v
+
+
+class CancelInvoice(BaseModel):
+    payment_hash: str = Field(
+        ...,
+        description="The payment hash of the invoice to cancel.",
+        min_length=64,
+        max_length=64,
+    )
+
+    @validator("payment_hash")
+    def check_hex(cls, v):
+        _ = bytes.fromhex(v)
+        return v
@@ -1,5 +1,4 @@
-"""Keycloak SSO Login Helper
-"""
+"""Keycloak SSO Login Helper"""

 from typing import Optional

@@ -1,63 +1,148 @@
 from __future__ import annotations

 from datetime import datetime, timezone
-from typing import Optional
 from uuid import UUID

+from bcrypt import checkpw, gensalt, hashpw
 from fastapi import Query
-from passlib.context import CryptContext
 from pydantic import BaseModel, Field

+from lnbits.core.models.misc import SimpleItem
 from lnbits.db import FilterModel
-from lnbits.helpers import is_valid_email_address, is_valid_pubkey, is_valid_username
+from lnbits.helpers import (
+    is_valid_email_address,
+    is_valid_external_id,
+    is_valid_pubkey,
+    is_valid_username,
+)
 from lnbits.settings import settings

 from .wallets import Wallet


+class UserNotifications(BaseModel):
+    nostr_identifier: str | None = None
+    telegram_chat_id: str | None = None
+    email_address: str | None = None
+    excluded_wallets: list[str] = []
+    outgoing_payments_sats: int = 0
+    incoming_payments_sats: int = 0
+
+
 class UserExtra(BaseModel):
-    email_verified: Optional[bool] = False
-    first_name: Optional[str] = None
-    last_name: Optional[str] = None
-    display_name: Optional[str] = None
-    picture: Optional[str] = None
+    email_verified: bool | None = False
+    first_name: str | None = None
+    last_name: str | None = None
+    display_name: str | None = None
+    picture: str | None = None
    # Auth provider, possible values:
    # - "env": the user was created automatically by the system
    # - "lnbits": the user was created via register form (username/pass or user_id only)
    # - "google | github | ...": the user was created using an SSO provider
-    provider: Optional[str] = "lnbits"  # auth provider
+    provider: str | None = "lnbits"  # auth provider
+
+    # how many wallets are shown in the user interface
+    visible_wallet_count: int | None = 10
+
+    notifications: UserNotifications = UserNotifications()
+
+
+class EndpointAccess(BaseModel):
+    path: str
+    name: str
+    read: bool = False
+    write: bool = False
+
+    def supports_method(self, method: str) -> bool:
+        # all http methods
+        if method in ["GET", "OPTIONS", "HEAD"]:
+            return self.read
+        if method in ["POST", "PUT", "PATCH", "DELETE"]:
+            return self.write
+        return False
+
+
+class AccessControlList(BaseModel):
+    id: str
+    name: str
+    endpoints: list[EndpointAccess] = []
+    token_id_list: list[SimpleItem] = []
+
+    def get_endpoint(self, path: str) -> EndpointAccess | None:
+        for e in self.endpoints:
+            if e.path == path:
+                return e
+        return None
+
+    def get_token_by_id(self, token_id: str) -> SimpleItem | None:
+        for t in self.token_id_list:
+            if t.id == token_id:
+                return t
+        return None
+
+    def delete_token_by_id(self, token_id: str):
+        self.token_id_list = [t for t in self.token_id_list if t.id != token_id]
+
+
+class UserAcls(BaseModel):
+    id: str
+    access_control_list: list[AccessControlList] = []
+    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+
+    def get_acl_by_id(self, acl_id: str) -> AccessControlList | None:
+        for acl in self.access_control_list:
+            if acl.id == acl_id:
+                return acl
+        return None
+
+    def delete_acl_by_id(self, acl_id: str):
+        self.access_control_list = [
+            acl for acl in self.access_control_list if acl.id != acl_id
+        ]
+
+    def get_acl_by_token_id(self, token_id: str) -> AccessControlList | None:
+        for acl in self.access_control_list:
+            if acl.get_token_by_id(token_id):
+                return acl
+        return None


 class Account(BaseModel):
    id: str
-    username: Optional[str] = None
-    password_hash: Optional[str] = None
-    pubkey: Optional[str] = None
-    email: Optional[str] = None
+    external_id: str | None = None  # for external account linking
+    username: str | None = None
+    password_hash: str | None = None
+    pubkey: str | None = None
+    email: str | None = None
    extra: UserExtra = UserExtra()
+
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))

    is_super_user: bool = Field(default=False, no_database=True)
    is_admin: bool = Field(default=False, no_database=True)
+    fiat_providers: list[str] = Field(default=[], no_database=True)

    def __init__(self, **data):
        super().__init__(**data)
        self.is_super_user = settings.is_super_user(self.id)
        self.is_admin = settings.is_admin_user(self.id)
+        self.fiat_providers = settings.get_fiat_providers_for_user(self.id)

    def hash_password(self, password: str) -> str:
        """sets and returns the hashed password"""
-        pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-        self.password_hash = pwd_context.hash(password)
+        salt = gensalt()
+        hashed_pw = hashpw(password.encode(), salt)
+        if not hashed_pw:
+            raise ValueError("Password hashing failed.")
+        self.password_hash = hashed_pw.decode()
        return self.password_hash

    def verify_password(self, password: str) -> bool:
        """returns True if the password matches the hash"""
        if not self.password_hash:
            return False
-        pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
-        return pwd_context.verify(password, self.password_hash)
+        return checkpw(password.encode(), self.password_hash.encode())

    def validate_fields(self):
        if self.username and not is_valid_username(self.username):
@@ -66,20 +151,32 @@ class Account(BaseModel):
            raise ValueError("Invalid email.")
        if self.pubkey and not is_valid_pubkey(self.pubkey):
            raise ValueError("Invalid pubkey.")
+        if self.external_id and not is_valid_external_id(self.external_id):
+            raise ValueError(
+                "Invalid external id. Max length is 256 characters. "
+                "Space and newlines are not allowed."
+            )
        user_uuid4 = UUID(hex=self.id, version=4)
        if user_uuid4.hex != self.id:
            raise ValueError("User ID is not valid UUID4 hex string.")


 class AccountOverview(Account):
-    transaction_count: Optional[int] = 0
-    wallet_count: Optional[int] = 0
-    balance_msat: Optional[int] = 0
-    last_payment: Optional[datetime] = None
+    transaction_count: int | None = 0
+    wallet_count: int | None = 0
+    balance_msat: int | None = 0
+    last_payment: datetime | None = None


 class AccountFilters(FilterModel):
-    __search_fields__ = ["user", "email", "username", "pubkey", "wallet_id"]
+    __search_fields__ = [
+        "user",
+        "email",
+        "username",
+        "pubkey",
+        "external_id",
+        "wallet_id",
+    ]
    __sort_fields__ = [
        "balance_msat",
        "email",
@@ -89,24 +186,27 @@ class AccountFilters(FilterModel):
        "last_payment",
    ]

-    email: Optional[str] = None
-    user: Optional[str] = None
-    username: Optional[str] = None
-    pubkey: Optional[str] = None
-    wallet_id: Optional[str] = None
+    email: str | None = None
+    user: str | None = None
+    username: str | None = None
+    pubkey: str | None = None
+    external_id: str | None = None
+    wallet_id: str | None = None


 class User(BaseModel):
    id: str
    created_at: datetime
    updated_at: datetime
-    email: Optional[str] = None
-    username: Optional[str] = None
-    pubkey: Optional[str] = None
+    email: str | None = None
+    username: str | None = None
+    pubkey: str | None = None
+    external_id: str | None = None  # for external account linking
    extensions: list[str] = []
    wallets: list[Wallet] = []
    admin: bool = False
    super_user: bool = False
+    fiat_providers: list[str] = []
    has_password: bool = False
    extra: UserExtra = UserExtra()

@@ -114,7 +214,7 @@ class User(BaseModel):
    def wallet_ids(self) -> list[str]:
        return [wallet.id for wallet in self.wallets]

-    def get_wallet(self, wallet_id: str) -> Optional[Wallet]:
+    def get_wallet(self, wallet_id: str) -> Wallet | None:
        w = [wallet for wallet in self.wallets if wallet.id == wallet_id]
        return w[0] if w else None

@@ -130,33 +230,33 @@ class User(BaseModel):


 class RegisterUser(BaseModel):
-    email: Optional[str] = Query(default=None)
+    email: str | None = Query(default=None)
    username: str = Query(default=..., min_length=2, max_length=20)
    password: str = Query(default=..., min_length=8, max_length=50)
    password_repeat: str = Query(default=..., min_length=8, max_length=50)


 class CreateUser(BaseModel):
-    id: Optional[str] = Query(default=None)
-    email: Optional[str] = Query(default=None)
-    username: Optional[str] = Query(default=None, min_length=2, max_length=20)
-    password: Optional[str] = Query(default=None, min_length=8, max_length=50)
-    password_repeat: Optional[str] = Query(default=None, min_length=8, max_length=50)
+    id: str | None = Query(default=None)
+    email: str | None = Query(default=None)
+    username: str | None = Query(default=None, min_length=2, max_length=20)
+    password: str | None = Query(default=None, min_length=8, max_length=50)
+    password_repeat: str | None = Query(default=None, min_length=8, max_length=50)
    pubkey: str = Query(default=None, max_length=64)
-    extensions: Optional[list[str]] = None
-    extra: Optional[UserExtra] = None
+    external_id: str = Query(default=None, max_length=256)
+    extensions: list[str] | None = None
+    extra: UserExtra | None = None


 class UpdateUser(BaseModel):
    user_id: str
-    email: Optional[str] = Query(default=None)
-    username: Optional[str] = Query(default=..., min_length=2, max_length=20)
-    extra: Optional[UserExtra] = None
+    username: str | None = Query(default=..., min_length=2, max_length=20)
+    extra: UserExtra | None = None


 class UpdateUserPassword(BaseModel):
    user_id: str
-    password_old: Optional[str] = None
+    password_old: str | None = None
    password: str = Query(default=..., min_length=8, max_length=50)
    password_repeat: str = Query(default=..., min_length=8, max_length=50)
    username: str = Query(default=..., min_length=2, max_length=20)
@@ -190,11 +290,39 @@ class LoginUsernamePassword(BaseModel):

 class AccessTokenPayload(BaseModel):
    sub: str
-    usr: Optional[str] = None
-    email: Optional[str] = None
-    auth_time: Optional[int] = 0
+    usr: str | None = None
+    email: str | None = None
+    auth_time: int | None = 0
+    api_token_id: str | None = None


-class CreateTopup(BaseModel):
+class UpdateBalance(BaseModel):
    id: str
    amount: int
+
+
+class ApiTokenRequest(BaseModel):
+    acl_id: str
+    token_name: str
+    password: str
+    expiration_time_minutes: int
+
+
+class ApiTokenResponse(BaseModel):
+    id: str
+    api_token: str
+
+
+class UpdateAccessControlList(AccessControlList):
+    password: str
+
+
+class DeleteAccessControlList(BaseModel):
+    id: str
+    password: str
+
+
+class DeleteTokenRequest(BaseModel):
+    id: str
+    acl_id: str
+    password: str
@@ -1,17 +1,15 @@
 from __future__ import annotations

-import hashlib
-import hmac
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from enum import Enum
-from typing import Optional

-from ecdsa import SECP256k1, SigningKey
+from lnurl import encode as lnurl_encode
 from pydantic import BaseModel, Field

+from lnbits.core.models.lnurl import StoredPayLinks
+from lnbits.db import FilterModel
 from lnbits.helpers import url_for
-from lnbits.lnurl import encode as lnurl_encode
 from lnbits.settings import settings


@@ -23,6 +21,12 @@ class BaseWallet(BaseModel):
    balance_msat: int


+class WalletExtra(BaseModel):
+    icon: str = "flash_on"
+    color: str = "primary"
+    pinned: bool = False
+
+
 class Wallet(BaseModel):
    id: str
    user: str
@@ -32,8 +36,10 @@ class Wallet(BaseModel):
    deleted: bool = False
    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
-    currency: Optional[str] = None
+    currency: str | None = None
    balance_msat: int = Field(default=0, no_database=True)
+    extra: WalletExtra = WalletExtra()
+    stored_paylinks: StoredPayLinks = StoredPayLinks()

    @property
    def balance(self) -> int:
@@ -51,17 +57,9 @@ class Wallet(BaseModel):
        except Exception:
            return ""

-    def lnurlauth_key(self, domain: str) -> SigningKey:
-        hashing_key = hashlib.sha256(self.id.encode()).digest()
-        linking_key = hmac.digest(hashing_key, domain.encode(), "sha256")
-
-        return SigningKey.from_string(
-            linking_key, curve=SECP256k1, hashfunc=hashlib.sha256
-        )
-

 class CreateWallet(BaseModel):
-    name: Optional[str] = None
+    name: str | None = None


 class KeyType(Enum):
@@ -78,3 +76,13 @@ class KeyType(Enum):
 class WalletTypeInfo:
    key_type: KeyType
    wallet: Wallet
+
+
+class WalletsFilters(FilterModel):
+    __search_fields__ = ["id", "name", "currency"]
+
+    __sort_fields__ = ["id", "name", "currency", "created_at", "updated_at"]
+
+    id: str | None
+    name: str | None
+    currency: str | None
@@ -2,17 +2,24 @@ from .funding_source import (
    get_balance_delta,
    switch_to_voidwallet,
 )
-from .lnurl import perform_lnurlauth, redeem_lnurl_withdraw
+from .lnurl import fetch_lnurl_pay_request, get_pr_from_lnurl, perform_withdraw
+from .notifications import enqueue_admin_notification, send_payment_notification
 from .payments import (
    calculate_fiat_amounts,
+    cancel_hold_invoice,
    check_transaction_status,
    check_wallet_limits,
+    create_fiat_invoice,
    create_invoice,
+    create_payment_request,
+    create_wallet_invoice,
    fee_reserve,
    fee_reserve_total,
+    get_payments_daily_stats,
    pay_invoice,
-    send_payment_notification,
    service_fee,
+    settle_hold_invoice,
+    update_pending_payment,
    update_pending_payments,
    update_wallet_balance,
 )
@@ -24,42 +31,43 @@ from .users import (
    check_admin_settings,
    create_user_account,
    create_user_account_no_ckeck,
-    init_admin_settings,
    update_user_account,
    update_user_extensions,
 )
 from .websockets import websocket_manager, websocket_updater

 __all__ = [
-    # funding source
-    "get_balance_delta",
-    "switch_to_voidwallet",
-    # lnurl
-    "redeem_lnurl_withdraw",
-    "perform_lnurlauth",
-    # payments
    "calculate_fiat_amounts",
+    "cancel_hold_invoice",
+    "check_admin_settings",
    "check_transaction_status",
    "check_wallet_limits",
-    "create_invoice",
-    "fee_reserve",
-    "fee_reserve_total",
-    "pay_invoice",
-    "send_payment_notification",
-    "service_fee",
-    "update_pending_payments",
-    "update_wallet_balance",
-    # settings
    "check_webpush_settings",
-    "update_cached_settings",
-    # users
-    "check_admin_settings",
+    "create_fiat_invoice",
+    "create_invoice",
+    "create_payment_request",
    "create_user_account",
    "create_user_account_no_ckeck",
-    "init_admin_settings",
+    "create_wallet_invoice",
+    "enqueue_admin_notification",
+    "fee_reserve",
+    "fee_reserve_total",
+    "fetch_lnurl_pay_request",
+    "get_balance_delta",
+    "get_payments_daily_stats",
+    "get_pr_from_lnurl",
+    "pay_invoice",
+    "perform_withdraw",
+    "send_payment_notification",
+    "service_fee",
+    "settle_hold_invoice",
+    "switch_to_voidwallet",
+    "update_cached_settings",
+    "update_pending_payment",
+    "update_pending_payments",
    "update_user_account",
    "update_user_extensions",
-    # websockets
+    "update_wallet_balance",
    "websocket_manager",
    "websocket_updater",
 ]
@@ -1,6 +1,5 @@
 import asyncio
 import importlib
-from typing import Optional

 from loguru import logger

@@ -22,19 +21,28 @@ from lnbits.settings import settings
 from ..models.extensions import Extension, ExtensionMeta, InstallableExtension


-async def install_extension(ext_info: InstallableExtension) -> Extension:
-    ext_id = ext_info.id
-    extension = Extension.from_installable_ext(ext_info)
-    installed_ext = await get_installed_extension(ext_id)
+async def install_extension(
+    ext_info: InstallableExtension, skip_download: bool | None = False
+) -> Extension:
+
+    ext_info.meta = ext_info.meta or ExtensionMeta()
+
+    if (
+        ext_info.meta.installed_release
+        and not ext_info.meta.installed_release.is_version_compatible
+    ):
+        raise ValueError("Incompatible extension version")
+
+    installed_ext = await get_installed_extension(ext_info.id)
    if installed_ext and installed_ext.meta:
-        ext_info.meta = ext_info.meta or ExtensionMeta()
        ext_info.meta.payments = installed_ext.meta.payments

-    await ext_info.download_archive()
+    if not skip_download:
+        await ext_info.download_archive()

    ext_info.extract_archive()

-    db_version = await get_db_version(ext_id)
+    db_version = await get_db_version(ext_info.id)
    await migrate_extension_database(ext_info, db_version)

    # if the extensions does not exist in the installed extensions table, create it
@@ -44,9 +52,12 @@ async def install_extension(ext_info: InstallableExtension) -> Extension:
    else:
        await update_installed_extension(ext_info)

+    extension = Extension.from_installable_ext(ext_info)
    if extension.is_upgrade_extension:
        # call stop while the old routes are still active
-        await stop_extension_background_work(ext_id)
+        await stop_extension_background_work(ext_info.id)
+
+    await start_extension_background_work(ext_info.id)

    return extension

@@ -65,17 +76,19 @@ async def uninstall_extension(ext_id: str):
 async def activate_extension(ext: Extension):
    core_app_extra.register_new_ext_routes(ext)
    await update_installed_extension_state(ext_id=ext.code, active=True)
+    await start_extension_background_work(ext.code)


 async def deactivate_extension(ext_id: str):
    settings.deactivate_extension_paths(ext_id)
    await update_installed_extension_state(ext_id=ext_id, active=False)
+    await stop_extension_background_work(ext_id)


 async def stop_extension_background_work(ext_id: str) -> bool:
    """
    Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
-    Extensions SHOULD expose a `api_stop()` function.
+    Extension must expose a `myextension_stop()` function if it is starting tasks.
    """
    upgrade_hash = settings.extension_upgrade_hash(ext_id)
    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
@@ -84,11 +97,9 @@ async def stop_extension_background_work(ext_id: str) -> bool:
        logger.info(f"Stopping background work for extension '{ext.module_name}'.")
        old_module = importlib.import_module(ext.module_name)

-        # Extensions must expose an `{ext_id}_stop()` function at the module level
-        # The `api_stop()` function is for backwards compatibility (will be deprecated)
-        stop_fns = [f"{ext_id}_stop", "api_stop"]
-        stop_fn_name = next((fn for fn in stop_fns if hasattr(old_module, fn)), None)
-        assert stop_fn_name, f"No stop function found for '{ext.module_name}'."
+        stop_fn_name = f"{ext_id}_stop"
+        if not hasattr(old_module, stop_fn_name):
+            raise ValueError(f"No stop function found for '{ext.module_name}'.")

        stop_fn = getattr(old_module, stop_fn_name)
        if stop_fn:
@@ -96,7 +107,6 @@ async def stop_extension_background_work(ext_id: str) -> bool:
                await stop_fn()
            else:
                stop_fn()
-
        logger.info(f"Stopped background work for extension '{ext.module_name}'.")
    except Exception as ex:
        logger.warning(f"Failed to stop background work for '{ext.module_name}'.")
@@ -106,8 +116,40 @@ async def stop_extension_background_work(ext_id: str) -> bool:
    return True


+async def start_extension_background_work(ext_id: str) -> bool:
+    """
+    Start background work for extension (like asyncio.Tasks, WebSockets, etc).
+    Extension CAN expose a `myextension_start()` function if it is starting tasks.
+    Extension MUST expose a `myextension_stop()` in that case.
+    """
+    upgrade_hash = settings.extension_upgrade_hash(ext_id)
+    ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
+
+    try:
+        logger.info(f"Starting background work for extension '{ext.module_name}'.")
+        new_module = importlib.import_module(ext.module_name)
+        start_fn_name = f"{ext_id}_start"
+
+        # start function is optional, return False if not found
+        if not hasattr(new_module, start_fn_name):
+            return False
+
+        start_fn = getattr(new_module, start_fn_name)
+        if start_fn:
+            if asyncio.iscoroutinefunction(start_fn):
+                await start_fn()
+            else:
+                start_fn()
+        logger.info(f"Started background work for extension '{ext.module_name}'.")
+        return True
+    except Exception as ex:
+        logger.warning(f"Failed to start background work for '{ext.module_name}'.")
+        logger.warning(ex)
+        return False
+
+
 async def get_valid_extensions(
-    include_deactivated: Optional[bool] = True,
+    include_deactivated: bool | None = True,
 ) -> list[Extension]:
    installed_extensions = await get_installed_extensions()
    valid_extensions = [Extension.from_installable_ext(e) for e in installed_extensions]
@@ -126,8 +168,8 @@ async def get_valid_extensions(


 async def get_valid_extension(
-    ext_id: str, include_deactivated: Optional[bool] = True
-) -> Optional[Extension]:
+    ext_id: str, include_deactivated: bool | None = True
+) -> Extension | None:
    ext = await get_installed_extension(ext_id)
    if not ext:
        return None
@@ -0,0 +1,543 @@
+import asyncio
+import json
+import os
+import shutil
+import zipfile
+from hashlib import sha256
+from pathlib import Path
+from time import time
+from uuid import uuid4
+
+import shortuuid
+from jinja2 import Environment, FileSystemLoader
+from loguru import logger
+
+from lnbits.core.models.extensions import ExtensionRelease, InstallableExtension
+from lnbits.core.models.extensions_builder import DataField, ExtensionData
+from lnbits.db import dict_to_model
+from lnbits.helpers import (
+    camel_to_snake,
+    camel_to_words,
+    download_url,
+    lowercase_first_letter,
+)
+from lnbits.settings import settings
+
+py_files = [
+    "__init__.py",
+    "models.py",
+    "migrations.py",
+    "views_api.py",
+    "crud.py",
+    "views.py",
+    "tasks.py",
+    "services.py",
+]
+
+remove_line_marker = "{remove_line_marker}}"
+
+ui_table_columns = [
+    DataField(
+        name="updated_at",
+        type="datetime",
+        label="Updated At",
+        hint="Timestamp of the last update",
+        optional=False,
+        editable=False,
+        searchable=False,
+        sortable=True,
+    ),
+    DataField(
+        name="id",
+        type="str",
+        label="ID",
+        hint="Unique identifier",
+        optional=False,
+        editable=False,
+        searchable=False,
+        sortable=True,
+    ),
+]
+
+
+excluded_dirs = {"./.", "./__pycache__", "./node_modules", "./transform"}
+
+
+async def build_extension_from_data(
+    data: ExtensionData, stub_ext_id: str, working_dir_name: str | None = None
+):
+    release = await _get_extension_stub_release(stub_ext_id, data.stub_version)
+    release.hash = sha256(uuid4().hex.encode("utf-8")).hexdigest()
+    release.icon = f"/{data.id}/static/image/{data.id}.png"
+    release.is_github_release = False
+    await _fetch_extension_builder_stub(stub_ext_id, release)
+    build_dir = _copy_ext_stub_to_build_dir(
+        stub_ext_id=stub_ext_id,
+        stub_version=release.version,
+        new_ext_id=data.id,
+        working_dir_name=working_dir_name,
+    )
+    _transform_extension_builder_stub(data, build_dir)
+    _export_extension_data_json(data, build_dir)
+    return release, build_dir
+
+
+def clean_extension_builder_data() -> None:
+    working_dir = Path(settings.extension_builder_working_dir_path)
+    if working_dir.is_dir():
+        shutil.rmtree(working_dir, True)
+    working_dir.mkdir(parents=True, exist_ok=True)
+
+
+def _transform_extension_builder_stub(data: ExtensionData, extension_dir: Path) -> None:
+    _replace_jinja_placeholders(data, extension_dir)
+    _rename_extension_builder_stub(data, extension_dir)
+
+
+def _export_extension_data_json(data: ExtensionData, build_dir: Path):
+    json.dump(
+        data.dict(),
+        open(Path(build_dir, "builder.json"), "w", encoding="utf-8"),
+        indent=4,
+    )
+
+
+async def _get_extension_stub_release(
+    stub_ext_id: str, stub_version: str | None = None
+) -> ExtensionRelease:
+    working_dir = Path(settings.extension_builder_working_dir_path, stub_ext_id)
+    cache_dir = Path(working_dir, f"cache-{stub_version}")
+    cache_dir.mkdir(parents=True, exist_ok=True)
+    release_cache_file = Path(cache_dir, "release.json")
+
+    if stub_version:
+        cached_release = _load_extension_stub_release_from_cache(
+            stub_ext_id, stub_version
+        )
+        if cached_release:
+            logger.debug(f"Loading release from cache {stub_ext_id} ({stub_version}).")
+            return cached_release
+
+    releases: list[ExtensionRelease] = (
+        await InstallableExtension.get_extension_releases(stub_ext_id)
+    )
+
+    release = next((r for r in releases if r.version == stub_version), None)
+
+    if not release and len(releases) > 0:
+        release = releases[0]
+
+    if not release:
+        raise ValueError(f"Release {stub_ext_id} ({stub_version}) not found.")
+
+    logger.debug(f"Save release cache {stub_ext_id} ({stub_version}).")
+    with open(release_cache_file, "w", encoding="utf-8") as f:
+        f.write(json.dumps(release.dict(), indent=4))
+
+    return release
+
+
+def _load_extension_stub_release_from_cache(
+    stub_ext_id: str, stub_version: str
+) -> ExtensionRelease | None:
+    working_dir = Path(settings.extension_builder_working_dir_path, stub_ext_id)
+    cache_dir = Path(working_dir, f"cache-{stub_version}")
+    release_cache_file = Path(cache_dir, "release.json")
+    if release_cache_file.is_file():
+        with open(release_cache_file, encoding="utf-8") as f:
+            return dict_to_model(json.load(f), ExtensionRelease)
+    return None
+
+
+async def _fetch_extension_builder_stub(
+    stub_ext_id: str, release: ExtensionRelease
+) -> Path:
+    working_dir = Path(settings.extension_builder_working_dir_path, stub_ext_id)
+    cache_dir = Path(working_dir, f"cache-{release.version}")
+    cache_dir.mkdir(parents=True, exist_ok=True)
+
+    stub_ext_zip_path = Path(cache_dir, release.version + ".zip")
+    ext_stub_cache_dir = Path(cache_dir, stub_ext_id)
+
+    if not stub_ext_zip_path.is_file():
+        await asyncio.to_thread(download_url, release.archive_url, stub_ext_zip_path)
+        shutil.rmtree(ext_stub_cache_dir, True)
+
+    if not ext_stub_cache_dir.is_dir():
+        tmp_dir = Path(cache_dir, "tmp")
+        shutil.rmtree(tmp_dir, True)
+        tmp_dir.mkdir(parents=True, exist_ok=True)
+        with zipfile.ZipFile(stub_ext_zip_path, "r") as zip_ref:
+            zip_ref.extractall(tmp_dir)
+        generated_dir = Path(tmp_dir, os.listdir(tmp_dir)[0])
+        shutil.copytree(generated_dir, Path(ext_stub_cache_dir))
+        shutil.rmtree(tmp_dir, True)
+
+    return ext_stub_cache_dir
+
+
+def _copy_ext_stub_to_build_dir(
+    stub_ext_id: str,
+    stub_version: str,
+    new_ext_id: str,
+    working_dir_name: str | None = None,
+) -> Path:
+    working_dir = Path(settings.extension_builder_working_dir_path, stub_ext_id)
+    cache_dir = Path(working_dir, f"cache-{stub_version}")
+
+    ext_stub_cache_dir = Path(cache_dir, stub_ext_id)
+    if not ext_stub_cache_dir.is_dir():
+        raise ValueError(
+            f"Extension stub cache dir not found: {stub_ext_id} ({stub_version})"
+        )
+
+    working_dir_name = working_dir_name or f"ext-{int(time())}-{shortuuid.uuid()}"
+    ext_build_dir = Path(working_dir, new_ext_id, working_dir_name, new_ext_id)
+    shutil.rmtree(ext_build_dir, True)
+
+    shutil.copytree(ext_stub_cache_dir, ext_build_dir)
+    return ext_build_dir
+
+
+def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None:
+    parsed_data = _parse_extension_data(data)
+    for py_file in py_files:
+        template_path = Path(ext_stub_dir, py_file).as_posix()
+        rederer = _render_file(template_path, parsed_data)
+        with open(template_path, "w", encoding="utf-8") as f:
+            f.write(rederer)
+
+        _remove_lines_with_string(template_path, remove_line_marker)
+
+    template_path = Path(ext_stub_dir, "static", "js", "index.js").as_posix()
+    rederer = _render_file(
+        template_path, {"preview": data.preview_action, **parsed_data}
+    )
+    embeded_index_js = rederer
+    with open(template_path, "w", encoding="utf-8") as f:
+        f.write(rederer)
+
+    _remove_lines_with_string(template_path, remove_line_marker)
+
+    owner_inputs = _fields_to_html_input(
+        [f for f in data.owner_data.fields if f.editable],
+        "ownerDataFormDialog.data",
+        ext_stub_dir,
+    )
+    client_inputs = _fields_to_html_input(
+        [f for f in data.client_data.fields if f.editable],
+        "clientDataFormDialog.data",
+        ext_stub_dir,
+    )
+    settings_inputs = _fields_to_html_input(
+        [f for f in data.settings_data.fields if f.editable],
+        "settingsFormDialog.data",
+        ext_stub_dir,
+    )
+    template_path = Path(
+        ext_stub_dir, "templates", "extension_builder_stub", "index.html"
+    ).as_posix()
+    rederer = _render_file(
+        template_path,
+        {
+            "embeded_index_js": embeded_index_js,
+            "extension_builder_stub_owner_inputs": owner_inputs,
+            "extension_builder_stub_settings_inputs": settings_inputs,
+            "extension_builder_stub_client_inputs": client_inputs,
+            "preview": data.preview_action,
+            "cancel_comment": remove_line_marker,
+            **parsed_data,
+        },
+    )
+    with open(template_path, "w", encoding="utf-8") as f:
+        f.write(rederer)
+
+    _remove_lines_with_string(template_path, remove_line_marker)
+
+    public_client_inputs = _fields_to_html_input(
+        [
+            f
+            for f in data.client_data.fields
+            if f.name in data.public_page.client_data_fields.public_inputs
+        ],
+        "publicClientData",
+        ext_stub_dir,
+    )
+    public_template_path = Path(
+        ext_stub_dir, "templates", "extension_builder_stub", "public_page.html"
+    )
+    template_path = public_template_path.as_posix()
+    if not data.public_page.has_public_page:
+        public_template_path.unlink(missing_ok=True)
+    else:
+        rederer = _render_file(
+            template_path,
+            {
+                "extension_builder_stub_public_client_inputs": public_client_inputs,
+                "preview": data.preview_action,
+                **data.public_page.action_fields.dict(),
+                "cancel_comment": remove_line_marker,
+            },
+        )
+
+        with open(template_path, "w", encoding="utf-8") as f:
+            f.write(rederer)
+
+        _remove_lines_with_string(template_path, remove_line_marker)
+
+
+def zip_directory(source_dir, zip_path):
+    """
+    Zips the contents of a directory (including subdirectories and files).
+
+    Parameters:
+    - source_dir (str): The path of the directory to zip.
+    - zip_path (str): The path where the .zip file will be saved.
+    """
+    with zipfile.ZipFile(zip_path, "w", zipfile.ZIP_DEFLATED) as zipf:
+        for root, _, files in os.walk(source_dir):
+            if _is_excluded_dir(root):
+                continue
+
+            for file in files:
+                full_path = os.path.join(root, file)
+                # Add file with a relative path inside the zip
+                relative_path = os.path.relpath(full_path, start=source_dir)
+                zipf.write(full_path, arcname=relative_path)
+
+
+def _rename_extension_builder_stub(data: ExtensionData, extension_dir: Path) -> None:
+    extension_dir_path = extension_dir.as_posix()
+    rename_values = {
+        "extension_builder_stub_name": data.name,
+        "extension_builder_stub_short_description": data.short_description or "",
+        "extension_builder_stub": data.id,
+        "OwnerData": data.owner_data.name,
+        "ownerData": lowercase_first_letter(data.owner_data.name),
+        "Owner Data": camel_to_words(data.owner_data.name),
+        "owner data": camel_to_words(data.owner_data.name).lower(),
+        "owner_data": camel_to_snake(data.owner_data.name),
+        "ClientData": data.client_data.name,
+        "clientData": lowercase_first_letter(data.client_data.name),
+        "Client Data": camel_to_words(data.client_data.name),
+        "client data": camel_to_words(data.client_data.name).lower(),
+        "client_data": camel_to_snake(data.client_data.name),
+    }
+    for old_text, new_text in rename_values.items():
+        _replace_text_in_files(
+            directory=extension_dir_path,
+            old_text=old_text,
+            new_text=new_text,
+            file_extensions=[".py", ".js", ".html", ".md", ".json", ".toml"],
+        )
+
+    _rename_files_and_dirs_in_directory(
+        directory=extension_dir_path,
+        old_text="extension_builder_stub",
+        new_text=data.id,
+    )
+    _rename_files_and_dirs_in_directory(
+        directory=extension_dir_path,
+        old_text="owner_data",
+        new_text=camel_to_snake(data.owner_data.name),
+    )
+
+
+def _replace_text_in_files(
+    directory: str,
+    old_text: str,
+    new_text: str,
+    file_extensions: list[str] | None = None,
+):
+    """
+    Recursively replaces text in all files under the given directory.
+    """
+    for root, _, files in os.walk(directory):
+        if _is_excluded_dir(root):
+            continue
+
+        for filename in files:
+            if file_extensions:
+                if not any(filename.endswith(ext) for ext in file_extensions):
+                    continue
+
+            file_path = os.path.join(root, filename)
+            try:
+                with open(file_path, encoding="utf-8") as f:
+                    content = f.read()
+                if old_text in content:
+                    new_content = content.replace(old_text, new_text)
+                    with open(file_path, "w", encoding="utf-8") as f:
+                        f.write(new_content)
+                    logger.trace(f"Updated: {file_path}")
+            except (UnicodeDecodeError, PermissionError, FileNotFoundError) as e:
+                logger.debug(f"Skipped {file_path}: {e}")
+
+
+def _render_file(template_path: str, data: dict) -> str:
+    # Extract directory and file name
+    template_dir = os.path.dirname(template_path)
+    template_file = os.path.basename(template_path)
+
+    # Create Jinja environment
+    # env = Environment(loader=FileSystemLoader(template_dir))
+    env = _jinja_env(template_dir)
+    template = env.get_template(template_file)
+
+    # Render the template with data
+    return template.render(**data)
+
+
+def _jinja_env(template_dir: str) -> Environment:
+    return Environment(
+        loader=FileSystemLoader(template_dir),
+        variable_start_string="<<",
+        variable_end_string=">>",
+        block_start_string="<%",
+        block_end_string="%>",
+        comment_start_string="<#",
+        comment_end_string="#>",
+        autoescape=False,
+    )
+
+
+def _parse_extension_data(data: ExtensionData) -> dict:
+    return {
+        "owner_data": {
+            "name": data.owner_data.name,
+            "editable": data.owner_data.editable,
+            "js_fields": [
+                field.field_to_js()
+                for field in data.owner_data.fields
+                if field.editable
+            ],
+            "search_fields": [
+                camel_to_snake(field.name)
+                for field in data.owner_data.fields
+                if field.searchable
+            ],
+            "ui_table_columns": [
+                field.field_to_ui_table_column()
+                for field in data.owner_data.fields + ui_table_columns
+                if field.sortable
+            ],
+            "ui_mock_data": [
+                json.dumps(
+                    {
+                        field.name: field.field_mock_value(index=index)
+                        for field in data.owner_data.fields + ui_table_columns
+                    }
+                )
+                for index in range(1, 5)
+            ],
+            "db_fields": [field.field_to_db() for field in data.owner_data.fields],
+            "all_fields": [field.field_to_py() for field in data.owner_data.fields],
+        },
+        "client_data": {
+            "name": data.client_data.name,
+            "editable": data.client_data.editable,
+            "search_fields": [
+                camel_to_snake(field.name)
+                for field in data.client_data.fields
+                if field.searchable
+            ],
+            "ui_table_columns": [
+                field.field_to_ui_table_column()
+                for field in data.client_data.fields + ui_table_columns
+                if field.sortable
+            ],
+            "ui_mock_data": [
+                json.dumps(
+                    {
+                        field.name: field.field_mock_value(index=index)
+                        for field in data.client_data.fields + ui_table_columns
+                    }
+                )
+                for index in range(1, 7)
+            ],
+            "db_fields": [field.field_to_db() for field in data.client_data.fields],
+            "all_fields": [field.field_to_py() for field in data.client_data.fields],
+        },
+        "settings_data": {
+            "enabled": data.settings_data.enabled,
+            "is_admin_settings_only": data.settings_data.type == "admin",
+            "db_fields": [field.field_to_db() for field in data.settings_data.fields],
+            "all_fields": [field.field_to_py() for field in data.settings_data.fields],
+        },
+        "public_page": data.public_page,
+        "cancel_comment": remove_line_marker,
+    }
+
+
+def _fields_to_html_input(
+    fields: list[DataField], model_name: str, ext_stub_dir: Path
+) -> str:
+    template_path = Path(
+        ext_stub_dir, "templates", "extension_builder_stub", "_input_fields.html"
+    ).as_posix()
+
+    rederer = _render_file(
+        template_path,
+        {
+            "fields": fields,
+            "model_name": model_name,
+        },
+    )
+    return rederer
+
+
+def _remove_lines_with_string(file_path: str, target: str) -> None:
+    """
+    Removes lines from a file that contain the given target string.
+
+    Args:
+        file_path (str): Path to the file.
+        target (str): Substring to search for in lines to remove.
+    """
+    with open(file_path, encoding="utf-8") as f:
+        lines = f.readlines()
+
+    filtered_lines = [line for line in lines if target not in line]
+
+    with open(file_path, "w", encoding="utf-8") as f:
+        f.writelines(filtered_lines)
+
+
+def _rename_files_and_dirs_in_directory(directory, old_text, new_text):
+    """
+    Recursively renames files and directories by replacing part of their names.
+    """
+    # First rename directories (bottom-up) so we don't lose paths while renaming
+    for root, dirs, files in os.walk(directory, topdown=False):
+        if _is_excluded_dir(root):
+            continue
+        # Rename files
+        for filename in files:
+            if old_text in filename:
+                old_path = os.path.join(root, filename)
+                new_filename = filename.replace(old_text, new_text)
+                new_path = os.path.join(root, new_filename)
+                try:
+                    os.rename(old_path, new_path)
+                    logger.trace(f"Renamed file: {old_path} -> {new_path}")
+                except Exception as e:
+                    logger.warning(f"Failed to rename file {old_path}: {e}")
+
+        # Rename directories
+        for dirname in dirs:
+            if old_text in dirname:
+                old_dir_path = os.path.join(root, dirname)
+                new_dir_name = dirname.replace(old_text, new_text)
+                new_dir_path = os.path.join(root, new_dir_name)
+                try:
+                    os.rename(old_dir_path, new_dir_path)
+                    logger.trace(f"Renamed directory: {old_dir_path} -> {new_dir_path}")
+                except Exception as e:
+                    logger.warning(f"Failed to rename directory {old_dir_path}: {e}")
+
+
+def _is_excluded_dir(path):
+    for excluded_dir in excluded_dirs:
+        if path.startswith(excluded_dir):
+            return True
+    return False
@@ -0,0 +1,193 @@
+import hashlib
+import hmac
+import time
+
+from loguru import logger
+
+from lnbits.core.crud import get_wallet
+from lnbits.core.crud.payments import create_payment, get_standalone_payment
+from lnbits.core.models import CreatePayment, Payment, PaymentState
+from lnbits.core.models.misc import SimpleStatus
+from lnbits.db import Connection
+from lnbits.fiat import get_fiat_provider
+from lnbits.settings import settings
+
+
+async def handle_fiat_payment_confirmation(
+    payment: Payment, conn: Connection | None = None
+):
+    try:
+        await _credit_fiat_service_fee_wallet(payment, conn=conn)
+    except Exception as e:
+        logger.warning(e)
+
+    try:
+        await _debit_fiat_service_faucet_wallet(payment, conn=conn)
+    except Exception as e:
+        logger.warning(e)
+
+
+async def _credit_fiat_service_fee_wallet(
+    payment: Payment, conn: Connection | None = None
+):
+    fiat_provider_name = payment.fiat_provider
+    if not fiat_provider_name:
+        return
+    if payment.fee == 0:
+        return
+
+    limits = settings.get_fiat_provider_limits(fiat_provider_name)
+    if not limits:
+        return
+
+    if not limits.service_fee_wallet_id:
+        return
+
+    memo = (
+        f"Service fee for fiat payment of "
+        f"{abs(payment.sat)} sats. "
+        f"Provider: {fiat_provider_name}. "
+        f"Wallet: '{payment.wallet_id}'."
+    )
+    create_payment_model = CreatePayment(
+        wallet_id=limits.service_fee_wallet_id,
+        bolt11=payment.bolt11,
+        payment_hash=payment.payment_hash,
+        amount_msat=abs(payment.fee),
+        memo=memo,
+    )
+    await create_payment(
+        checking_id=f"service_fee_{payment.payment_hash}",
+        data=create_payment_model,
+        status=PaymentState.SUCCESS,
+        conn=conn,
+    )
+
+
+async def _debit_fiat_service_faucet_wallet(
+    payment: Payment, conn: Connection | None = None
+):
+    fiat_provider_name = payment.fiat_provider
+    if not fiat_provider_name:
+        return
+
+    limits = settings.get_fiat_provider_limits(fiat_provider_name)
+    if not limits:
+        return
+
+    if not limits.service_faucet_wallet_id:
+        return
+
+    faucet_wallet = await get_wallet(limits.service_faucet_wallet_id, conn=conn)
+    if not faucet_wallet:
+        raise ValueError(
+            f"Fiat provider '{fiat_provider_name}' faucet wallet not found."
+        )
+
+    memo = (
+        f"Faucet payment of {abs(payment.sat)} sats. "
+        f"Provider: {fiat_provider_name}. "
+        f"Wallet: '{payment.wallet_id}'."
+    )
+    create_payment_model = CreatePayment(
+        wallet_id=limits.service_faucet_wallet_id,
+        bolt11=payment.bolt11,
+        payment_hash=payment.payment_hash,
+        amount_msat=-abs(payment.amount),
+        memo=memo,
+        extra=payment.extra,
+    )
+    await create_payment(
+        checking_id=f"internal_fiat_{fiat_provider_name}_"
+        f"faucet_{payment.payment_hash}",
+        data=create_payment_model,
+        status=PaymentState.SUCCESS,
+        conn=conn,
+    )
+
+
+async def handle_stripe_event(event: dict):
+    event_id = event.get("id")
+    event_object = event.get("data", {}).get("object", {})
+    object_type = event_object.get("object")
+    payment_hash = event_object.get("metadata", {}).get("payment_hash")
+    logger.debug(
+        f"Handling Stripe event: '{event_id}'. Type: '{object_type}'."
+        f" Payment hash: '{payment_hash}'."
+    )
+    if not payment_hash:
+        logger.warning("Stripe event does not contain a payment hash.")
+        return
+
+    payment = await get_standalone_payment(payment_hash)
+    if not payment:
+        logger.warning(f"No payment found for hash: '{payment_hash}'.")
+        return
+    await payment.check_fiat_status()
+
+
+def check_stripe_signature(
+    payload: bytes,
+    sig_header: str | None,
+    secret: str | None,
+    tolerance_seconds=300,
+):
+    if not sig_header:
+        logger.warning("Stripe-Signature header is missing.")
+        raise ValueError("Stripe-Signature header is missing.")
+
+    if not secret:
+        logger.warning("Stripe webhook signing secret is not set.")
+        raise ValueError("Stripe webhook cannot be verified.")
+
+    # Split the Stripe-Signature header
+    items = dict(i.split("=") for i in sig_header.split(","))
+    timestamp = int(items["t"])
+    signature = items["v1"]
+
+    # Check timestamp tolerance
+    if abs(time.time() - timestamp) > tolerance_seconds:
+        logger.warning("Timestamp outside tolerance.")
+        logger.debug(
+            f"Current time: {time.time()}, "
+            f"Timestamp: {timestamp}, "
+            f"Tolerance: {tolerance_seconds} seconds"
+        )
+
+        raise ValueError("Timestamp outside tolerance." f"Timestamp: {timestamp}")
+
+    signed_payload = f"{timestamp}.{payload.decode()}"
+
+    # Compute HMAC SHA256 using the webhook secret
+    computed_signature = hmac.new(
+        key=secret.encode(), msg=signed_payload.encode(), digestmod=hashlib.sha256
+    ).hexdigest()
+
+    # Compare signatures using constant time comparison
+    if hmac.compare_digest(computed_signature, signature) is not True:
+        logger.warning("Stripe signature verification failed.")
+        raise ValueError("Stripe signature verification failed.")
+
+
+async def test_connection(provider: str) -> SimpleStatus:
+    """
+    Test the connection to Stripe by checking if the API key is valid.
+    This function should be called when setting up or testing the Stripe integration.
+    """
+    fiat_provider = await get_fiat_provider(provider)
+    if not fiat_provider:
+        return SimpleStatus(
+            success=False,
+            message=f"Fiat provider '{provider}' not found.",
+        )
+    status = await fiat_provider.status()
+    if status.error_message:
+        return SimpleStatus(
+            success=False,
+            message=f"Cconnection test failed: {status.error_message}",
+        )
+
+    return SimpleStatus(
+        success=True,
+        message="Connection test successful." f" Balance: {status.balance}.",
+    )
@@ -1,3 +1,7 @@
+from loguru import logger
+
+from lnbits.core.models.notifications import NotificationType
+from lnbits.core.services.notifications import enqueue_admin_notification
 from lnbits.settings import settings
 from lnbits.wallets import get_funding_source, set_funding_source

@@ -18,6 +22,62 @@ async def get_balance_delta() -> BalanceDelta:
    status = await funding_source.status()
    lnbits_balance = await get_total_balance()
    return BalanceDelta(
-        lnbits_balance_msats=lnbits_balance,
-        node_balance_msats=status.balance_msat,
+        lnbits_balance_sats=int(lnbits_balance) // 1000,
+        node_balance_sats=status.balance_msat // 1000,
    )
+
+
+async def check_server_balance_against_node():
+    """
+    Watchdog will check lnbits balance and nodebalance
+    and will switch to VoidWallet if the watchdog delta is reached.
+    """
+    if (
+        not settings.lnbits_watchdog_switch_to_voidwallet
+        and not settings.lnbits_notification_watchdog
+    ):
+        return
+
+    funding_source = get_funding_source()
+    if funding_source.__class__.__name__ == "VoidWallet":
+        return
+
+    status = await get_balance_delta()
+    if status.delta_sats < settings.lnbits_watchdog_delta:
+        return
+
+    use_voidwallet = settings.lnbits_watchdog_switch_to_voidwallet
+    logger.warning(
+        f"Balance delta reached: {status.delta_sats} sats."
+        f" Switch to void wallet: {use_voidwallet}."
+    )
+    enqueue_admin_notification(
+        NotificationType.watchdog_check,
+        {
+            "delta_sats": status.delta_sats,
+            "lnbits_balance_sats": status.lnbits_balance_sats,
+            "node_balance_sats": status.node_balance_sats,
+            "switch_to_void_wallet": use_voidwallet,
+        },
+    )
+    if use_voidwallet:
+        logger.error(f"Switching to VoidWallet. Delta: {status.delta_sats} sats.")
+        await switch_to_voidwallet()
+
+
+async def check_balance_delta_changed():
+    status = await get_balance_delta()
+    if settings.latest_balance_delta_sats is None:
+        settings.latest_balance_delta_sats = status.delta_sats
+        return
+    if status.delta_sats != settings.latest_balance_delta_sats:
+        enqueue_admin_notification(
+            NotificationType.balance_delta,
+            {
+                "delta_sats": status.delta_sats,
+                "old_delta_sats": settings.latest_balance_delta_sats,
+                "lnbits_balance_sats": status.lnbits_balance_sats,
+                "node_balance_sats": status.node_balance_sats,
+            },
+        )
+    settings.latest_balance_delta_sats = status.delta_sats
@@ -1,155 +1,167 @@
-import asyncio
-import json
-from io import BytesIO
-from typing import Optional
-from urllib.parse import parse_qs, urlparse
+from time import time

-import httpx
-from fastapi import Depends
+from lnurl import (
+    LnAddress,
+    Lnurl,
+    LnurlErrorResponse,
+    LnurlPayActionResponse,
+    LnurlPayResponse,
+    LnurlResponseException,
+    LnurlSuccessResponse,
+    LnurlWithdrawResponse,
+    execute_pay_request,
+    execute_withdraw,
+    handle,
+)
 from loguru import logger

-from lnbits.db import Connection
-from lnbits.decorators import (
-    WalletTypeInfo,
-    require_admin_key,
-)
-from lnbits.helpers import url_for
-from lnbits.lnurl import LnurlErrorResponse
-from lnbits.lnurl import decode as decode_lnurl
+from lnbits.core.crud import update_wallet
+from lnbits.core.models import CreateLnurlPayment, Wallet
+from lnbits.core.models.lnurl import StoredPayLink
+from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
-
-from .payments import create_invoice
+from lnbits.utils.exchange_rates import fiat_amount_as_satoshis


-async def redeem_lnurl_withdraw(
-    wallet_id: str,
-    lnurl_request: str,
-    memo: Optional[str] = None,
-    extra: Optional[dict] = None,
-    wait_seconds: int = 0,
-    conn: Optional[Connection] = None,
-) -> None:
-    if not lnurl_request:
-        return None
-
-    res = {}
-
-    headers = {"User-Agent": settings.user_agent}
-    async with httpx.AsyncClient(headers=headers) as client:
-        lnurl = decode_lnurl(lnurl_request)
-        r = await client.get(str(lnurl))
-        res = r.json()
-
+async def perform_withdraw(lnurl: str, payment_request: str) -> None:
+    """
+    Perform an LNURL withdraw to the given LNURL-withdraw link.
+    :param lnurl: The LNURL-withdraw link. bech32 or lud17 format.
+    :param payment_request: The BOLT11 payment request to pay.
+    :raises LnurlResponseException: If the LNURL-withdraw process fails.
+    """
+    res = await handle(lnurl, user_agent=settings.user_agent, timeout=10)
+    if isinstance(res, LnurlErrorResponse):
+        raise LnurlResponseException(res.reason)
+    if not isinstance(res, LnurlWithdrawResponse):
+        raise LnurlResponseException("Invalid LNURL-withdraw response.")
    try:
-        _, payment_request = await create_invoice(
-            wallet_id=wallet_id,
-            amount=int(res["maxWithdrawable"] / 1000),
-            memo=memo or res["defaultDescription"] or "",
-            extra=extra,
-            conn=conn,
+        check_callback_url(res.callback)
+    except ValueError as exc:
+        raise LnurlResponseException(f"Invalid callback URL: {exc!s}") from exc
+    res2 = await execute_withdraw(
+        res, payment_request, user_agent=settings.user_agent, timeout=10
+    )
+    if isinstance(res2, LnurlErrorResponse):
+        raise LnurlResponseException(res2.reason)
+    if not isinstance(res2, LnurlSuccessResponse):
+        raise LnurlResponseException("Invalid LNURL-withdraw success response.")
+
+
+async def get_pr_from_lnurl(
+    lnurl: str, amount_msat: int, comment: str | None = None
+) -> str:
+    res = await handle(lnurl, user_agent=settings.user_agent, timeout=10)
+    if isinstance(res, LnurlErrorResponse):
+        raise LnurlResponseException(res.reason)
+    if not isinstance(res, LnurlPayResponse):
+        raise LnurlResponseException(
+            "Invalid LNURL response. Expected LnurlPayResponse."
        )
-    except Exception:
-        logger.warning(
-            f"failed to create invoice on redeem_lnurl_withdraw "
-            f"from {lnurl}. params: {res}"
-        )
-        return None
-
-    if wait_seconds:
-        await asyncio.sleep(wait_seconds)
-
-    params = {"k1": res["k1"], "pr": payment_request}
-
-    try:
-        params["balanceNotify"] = url_for(
-            f"/withdraw/notify/{urlparse(lnurl_request).netloc}",
-            external=True,
-            wal=wallet_id,
-        )
-    except Exception:
-        pass
-
-    headers = {"User-Agent": settings.user_agent}
-    async with httpx.AsyncClient(headers=headers) as client:
-        try:
-            await client.get(res["callback"], params=params)
-        except Exception:
-            pass
+    res2 = await execute_pay_request(
+        res,
+        msat=amount_msat,
+        comment=comment,
+        user_agent=settings.user_agent,
+        timeout=10,
+    )
+    if isinstance(res2, LnurlErrorResponse):
+        raise LnurlResponseException(res2.reason)
+    return res2.pr


-async def perform_lnurlauth(
-    callback: str,
-    wallet: WalletTypeInfo = Depends(require_admin_key),
-) -> Optional[LnurlErrorResponse]:
-    cb = urlparse(callback)
+async def fetch_lnurl_pay_request(
+    data: CreateLnurlPayment, wallet: Wallet | None = None
+) -> tuple[LnurlPayResponse, LnurlPayActionResponse]:
+    """
+    Pay an LNURL payment request.
+    optional `wallet` is used to store the pay link in the wallet's stored links.

-    k1 = bytes.fromhex(parse_qs(cb.query)["k1"][0])
-
-    key = wallet.wallet.lnurlauth_key(cb.netloc)
-
-    def int_to_bytes_suitable_der(x: int) -> bytes:
-        """for strict DER we need to encode the integer with some quirks"""
-        b = x.to_bytes((x.bit_length() + 7) // 8, "big")
-
-        if len(b) == 0:
-            # ensure there's at least one byte when the int is zero
-            return bytes([0])
-
-        if b[0] & 0x80 != 0:
-            # ensure it doesn't start with a 0x80 and so it isn't
-            # interpreted as a negative number
-            return bytes([0]) + b
-
-        return b
-
-    def encode_strict_der(r: int, s: int, order: int):
-        # if s > order/2 verification will fail sometimes
-        # so we must fix it here see:
-        # https://github.com/indutny/elliptic/blob/e71b2d9359c5fe9437fbf46f1f05096de447de57/lib/elliptic/ec/index.js#L146-L147
-        if s > order // 2:
-            s = order - s
-
-        # now we do the strict DER encoding copied from
-        # https://github.com/KiriKiri/bip66 (without any checks)
-        r_temp = int_to_bytes_suitable_der(r)
-        s_temp = int_to_bytes_suitable_der(s)
-
-        r_len = len(r_temp)
-        s_len = len(s_temp)
-        sign_len = 6 + r_len + s_len
-
-        signature = BytesIO()
-        signature.write(0x30.to_bytes(1, "big", signed=False))
-        signature.write((sign_len - 2).to_bytes(1, "big", signed=False))
-        signature.write(0x02.to_bytes(1, "big", signed=False))
-        signature.write(r_len.to_bytes(1, "big", signed=False))
-        signature.write(r_temp)
-        signature.write(0x02.to_bytes(1, "big", signed=False))
-        signature.write(s_len.to_bytes(1, "big", signed=False))
-        signature.write(s_temp)
-
-        return signature.getvalue()
-
-    sig = key.sign_digest_deterministic(k1, sigencode=encode_strict_der)
-
-    headers = {"User-Agent": settings.user_agent}
-    async with httpx.AsyncClient(headers=headers) as client:
-        assert key.verifying_key, "LNURLauth verifying_key does not exist"
-        r = await client.get(
-            callback,
-            params={
-                "k1": k1.hex(),
-                "key": key.verifying_key.to_string("compressed").hex(),
-                "sig": sig.hex(),
-            },
-        )
-        try:
-            resp = json.loads(r.text)
-            if resp["status"] == "OK":
-                return None
-
-            return LnurlErrorResponse(reason=resp["reason"])
-        except (KeyError, json.decoder.JSONDecodeError):
-            return LnurlErrorResponse(
-                reason=r.text[:200] + "..." if len(r.text) > 200 else r.text
+    raises `LnurlResponseException` if pay request fails
+    """
+    if not data.res and data.lnurl:
+        res = await handle(data.lnurl, user_agent=settings.user_agent, timeout=5)
+        if isinstance(res, LnurlErrorResponse):
+            raise LnurlResponseException(res.reason)
+        if not isinstance(res, LnurlPayResponse):
+            raise LnurlResponseException(
+                "Invalid LNURL response. Expected LnurlPayResponse."
            )
+        data.res = res
+    if not data.res:
+        raise LnurlResponseException("No LNURL pay request provided.")
+
+    if data.unit and data.unit != "sat":
+        # shift to float with 2 decimal places
+        amount = round(data.amount / 1000, 2)
+        amount_msat = await fiat_amount_as_satoshis(amount, data.unit)
+        amount_msat *= 1000
+    else:
+        amount_msat = data.amount
+
+    res2 = await execute_pay_request(
+        data.res,
+        msat=amount_msat,
+        comment=data.comment,
+        user_agent=settings.user_agent,
+        timeout=10,
+    )
+
+    if wallet:
+        await store_paylink(data.res, res2, wallet, data.lnurl)
+
+    return data.res, res2
+
+
+async def store_paylink(
+    res: LnurlPayResponse,
+    res2: LnurlPayActionResponse,
+    wallet: Wallet,
+    lnurl: LnAddress | Lnurl | None = None,
+) -> None:
+
+    if res2.disposable is not False:
+        return  # do not store disposable LNURL pay links
+
+    logger.debug(f"storing lnurl pay link for wallet {wallet.id}. ")
+
+    stored_paylink = None
+    # If we have only a LnurlPayResponse, we can use its lnaddress
+    # because the lnurl is not available.
+    if not lnurl:
+        for _data in res.metadata.list():
+            if _data[0] == "text/identifier":
+                stored_paylink = StoredPayLink(
+                    lnurl=LnAddress(_data[1]), label=res.metadata.text
+                )
+        if not stored_paylink:
+            logger.warning(
+                "No lnaddress found in metadata for LNURL pay link. "
+                "Skipping storage."
+            )
+            return  # skip if lnaddress not found in metadata
+    else:
+        if isinstance(lnurl, Lnurl):
+            _lnurl = str(lnurl.lud17 or lnurl.bech32)
+        else:
+            _lnurl = str(lnurl)
+        stored_paylink = StoredPayLink(lnurl=_lnurl, label=res.metadata.text)
+
+    # update last_used if its already stored
+    for pl in wallet.stored_paylinks.links:
+        if pl.lnurl == stored_paylink.lnurl:
+            pl.last_used = int(time())
+            await update_wallet(wallet)
+            logger.debug(
+                "Updated last used time for LNURL "
+                f"pay link {stored_paylink.lnurl} in wallet {wallet.id}."
+            )
+            return
+
+    # if not already stored, append it
+    if not any(stored_paylink.lnurl == pl.lnurl for pl in wallet.stored_paylinks.links):
+        wallet.stored_paylinks.links.append(stored_paylink)
+        await update_wallet(wallet)
+        logger.debug(
+            f"Stored LNURL pay link {stored_paylink.lnurl} for wallet {wallet.id}."
+        )
@@ -0,0 +1,72 @@
+import asyncio
+
+import httpx
+from loguru import logger
+from pynostr.encrypted_dm import EncryptedDirectMessage
+from websocket import WebSocket, create_connection
+
+from lnbits.core.helpers import is_valid_url
+from lnbits.utils.nostr import (
+    validate_identifier,
+    validate_pub_key,
+)
+
+
+async def send_nostr_dm(
+    from_private_key_hex: str,
+    to_pubkey_hex: str,
+    message: str,
+    relays: list[str],
+) -> dict:
+    dm = EncryptedDirectMessage()
+    dm.encrypt(
+        private_key_hex=from_private_key_hex,
+        recipient_pubkey=to_pubkey_hex,
+        cleartext_content=message,
+    )
+
+    dm_event = dm.to_event()
+    dm_event.sign(private_key_hex=from_private_key_hex)
+    notification = dm_event.to_message()
+
+    ws_connections: list[WebSocket] = []
+    for relay in relays:
+        try:
+            ws = create_connection(relay, timeout=2)
+            ws.send(notification)
+            ws_connections.append(ws)
+        except Exception as e:
+            logger.warning(f"Error sending notification to relay {relay}: {e}")
+    await asyncio.sleep(1)
+    for ws in ws_connections:
+        try:
+            ws.close()
+        except Exception as e:
+            logger.debug(f"Failed to close websocket connection: {e}")
+
+    return dm_event.to_dict()
+
+
+async def fetch_nip5_details(identifier: str) -> tuple[str, list[str]]:
+    identifier, domain = identifier.split("@")
+    if not identifier or not domain:
+        raise ValueError("Invalid NIP5 identifier")
+
+    if not is_valid_url(f"https://{domain}"):
+        raise ValueError("Invalid NIP5 domain")
+
+    validate_identifier(identifier)
+
+    url = f"https://{domain}/.well-known/nostr.json?name={identifier}"
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(url)
+        resp.raise_for_status()
+        data = resp.json()
+        if "names" not in data or identifier not in data["names"]:
+            raise ValueError("NIP5 not name found")
+        pubkey = data["names"][identifier]
+        validate_pub_key(pubkey)
+
+        relays = data["relays"].get(pubkey, []) if "relays" in data else []
+
+        return pubkey, relays
@@ -0,0 +1,408 @@
+import asyncio
+import json
+import smtplib
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+from http import HTTPStatus
+
+import httpx
+from loguru import logger
+from py_vapid import Vapid
+from pywebpush import WebPushException, webpush
+
+from lnbits.core.crud import (
+    delete_webpush_subscriptions,
+    get_webpush_subscriptions_for_user,
+    mark_webhook_sent,
+)
+from lnbits.core.crud.users import get_user
+from lnbits.core.models import Payment, Wallet
+from lnbits.core.models.notifications import (
+    NOTIFICATION_TEMPLATES,
+    NotificationMessage,
+    NotificationType,
+)
+from lnbits.core.models.users import UserNotifications
+from lnbits.core.services.nostr import fetch_nip5_details, send_nostr_dm
+from lnbits.core.services.websockets import websocket_manager
+from lnbits.helpers import check_callback_url, is_valid_email_address
+from lnbits.settings import settings
+from lnbits.utils.nostr import normalize_private_key
+
+notifications_queue: asyncio.Queue[NotificationMessage] = asyncio.Queue()
+
+
+def enqueue_admin_notification(message_type: NotificationType, values: dict) -> None:
+    if not _is_message_type_enabled(message_type):
+        return
+    try:
+        notifications_queue.put_nowait(
+            NotificationMessage(message_type=message_type, values=values)
+        )
+    except Exception as e:
+        logger.error(f"Error enqueuing notification: {e}")
+
+
+def enqueue_user_notification(
+    message_type: NotificationType, values: dict, user_notifications: UserNotifications
+) -> None:
+    try:
+        notifications_queue.put_nowait(
+            NotificationMessage(
+                message_type=message_type,
+                values=values,
+                user_notifications=user_notifications,
+            )
+        )
+    except Exception as e:
+        logger.error(f"Error enqueuing notification: {e}")
+
+
+async def process_next_notification() -> None:
+    notification_message = await notifications_queue.get()
+    message_type, text = _notification_message_to_text(notification_message)
+    user_notifications = notification_message.user_notifications
+    if user_notifications:
+        await send_user_notification(user_notifications, text, message_type)
+    else:
+        await send_admin_notification(text, message_type)
+
+
+async def send_admin_notification(
+    message: str,
+    message_type: str | None = None,
+) -> None:
+    return await send_notification(
+        settings.lnbits_telegram_notifications_chat_id,
+        settings.lnbits_nostr_notifications_identifiers,
+        settings.lnbits_email_notifications_to_emails,
+        message,
+        message_type,
+    )
+
+
+async def send_user_notification(
+    user_notifications: UserNotifications,
+    message: str,
+    message_type: str | None = None,
+) -> None:
+
+    email_address = (
+        [user_notifications.email_address] if user_notifications.email_address else []
+    )
+    nostr_identifiers = (
+        [user_notifications.nostr_identifier]
+        if user_notifications.nostr_identifier
+        else []
+    )
+    return await send_notification(
+        user_notifications.telegram_chat_id,
+        nostr_identifiers,
+        email_address,
+        message,
+        message_type,
+    )
+
+
+async def send_notification(
+    telegram_chat_id: str | None,
+    nostr_identifiers: list[str] | None,
+    email_addresses: list[str] | None,
+    message: str,
+    message_type: str | None = None,
+) -> None:
+    try:
+        if telegram_chat_id and settings.is_telegram_notifications_configured():
+            await send_telegram_notification(telegram_chat_id, message)
+            logger.debug(f"Sent telegram notification: {message_type}")
+    except Exception as e:
+        logger.error(f"Error sending telegram notification {message_type}: {e}")
+
+    try:
+        if nostr_identifiers and settings.is_nostr_notifications_configured():
+            await send_nostr_notifications(nostr_identifiers, message)
+            logger.debug(f"Sent nostr notification: {message_type}")
+    except Exception as e:
+        logger.error(f"Error sending nostr notification {message_type}: {e}")
+    try:
+        if email_addresses and settings.lnbits_email_notifications_enabled:
+            await send_email_notification(email_addresses, message)
+            logger.debug(f"Sent email notification: {message_type}")
+    except Exception as e:
+        logger.error(f"Error sending email notification {message_type}: {e}")
+
+
+async def send_nostr_notifications(identifiers: list[str], message: str) -> list[str]:
+    success_sent: list[str] = []
+    for identifier in identifiers:
+        try:
+            await send_nostr_notification(identifier, message)
+            success_sent.append(identifier)
+        except Exception as e:
+            logger.warning(f"Error notifying identifier {identifier}: {e}")
+    return success_sent
+
+
+async def send_nostr_notification(identifier: str, message: str):
+    nip5 = await fetch_nip5_details(identifier)
+    user_pubkey = nip5[0]
+    relays = nip5[1]
+    server_private_key = normalize_private_key(
+        settings.lnbits_nostr_notifications_private_key
+    )
+    await send_nostr_dm(
+        server_private_key,
+        user_pubkey,
+        message,
+        relays,
+    )
+
+
+async def send_telegram_notification(chat_id: str, message: str) -> dict:
+    return await send_telegram_message(
+        settings.lnbits_telegram_notifications_access_token,
+        chat_id,
+        message,
+    )
+
+
+async def send_telegram_message(token: str, chat_id: str, message: str) -> dict:
+    url = f"https://api.telegram.org/bot{token}/sendMessage"
+    payload = {"chat_id": chat_id, "text": message, "parse_mode": "markdown"}
+    async with httpx.AsyncClient() as client:
+        response = await client.post(url, data=payload)
+        response.raise_for_status()
+        return response.json()
+
+
+async def send_email_notification(
+    to_emails: list[str], message: str, subject: str = "LNbits Notification"
+) -> dict:
+    if not settings.lnbits_email_notifications_enabled:
+        return {"status": "error", "message": "Email notifications are disabled"}
+    try:
+        await send_email(
+            settings.lnbits_email_notifications_server,
+            settings.lnbits_email_notifications_port,
+            settings.lnbits_email_notifications_username,
+            settings.lnbits_email_notifications_password,
+            settings.lnbits_email_notifications_email,
+            to_emails,
+            subject,
+            message,
+        )
+        return {"status": "ok"}
+    except Exception as e:
+        logger.error(f"Error sending email notification: {e}")
+        return {"status": "error", "message": str(e)}
+
+
+async def send_email(
+    server: str,
+    port: int,
+    username: str,
+    password: str,
+    from_email: str,
+    to_emails: list[str],
+    subject: str,
+    message: str,
+) -> bool:
+    if not is_valid_email_address(from_email):
+        raise ValueError(f"Invalid from email address: {from_email}")
+    if len(to_emails) == 0:
+        raise ValueError("No email addresses provided")
+    for email in to_emails:
+        if not is_valid_email_address(email):
+            raise ValueError(f"Invalid email address: {email}")
+    msg = MIMEMultipart()
+    msg["From"] = from_email
+    msg["To"] = ", ".join(to_emails)
+    msg["Subject"] = subject
+    msg.attach(MIMEText(message, "plain"))
+    username = username if len(username) > 0 else from_email
+    with smtplib.SMTP(server, port) as smtp_server:
+        smtp_server.starttls()
+        smtp_server.login(username, password)
+        smtp_server.sendmail(from_email, to_emails, msg.as_string())
+        return True
+
+
+async def dispatch_webhook(payment: Payment):
+    """
+    Dispatches the webhook to the webhook url.
+    """
+    logger.debug("sending webhook", payment.webhook)
+
+    if not payment.webhook:
+        return await mark_webhook_sent(payment.payment_hash, "-1")
+
+    headers = {"User-Agent": settings.user_agent}
+    async with httpx.AsyncClient(headers=headers) as client:
+        try:
+            check_callback_url(payment.webhook)
+            r = await client.post(payment.webhook, json=payment.json(), timeout=40)
+            r.raise_for_status()
+            await mark_webhook_sent(payment.payment_hash, str(r.status_code))
+        except httpx.HTTPStatusError as exc:
+            await mark_webhook_sent(payment.payment_hash, str(exc.response.status_code))
+            logger.warning(
+                f"webhook returned a bad status_code: {exc.response.status_code} "
+                f"while requesting {exc.request.url!r}."
+            )
+        except httpx.RequestError:
+            await mark_webhook_sent(payment.payment_hash, "-1")
+            logger.warning(f"Could not send webhook to {payment.webhook}")
+
+
+async def send_payment_notification(wallet: Wallet, payment: Payment):
+    try:
+        await send_ws_payment_notification(wallet, payment)
+    except Exception as e:
+        logger.error(f"Error sending websocket payment notification {e!s}")
+    try:
+        await send_chat_payment_notification(wallet, payment)
+    except Exception as e:
+        logger.error(f"Error sending chat payment notification {e!s}")
+    try:
+        await send_payment_push_notification(wallet, payment)
+    except Exception as e:
+        logger.error(f"Error sending push payment notification {e!s}")
+
+    try:
+        if payment.webhook and not payment.webhook_status:
+            await dispatch_webhook(payment)
+    except Exception as e:
+        logger.error(f"Error dispatching webhook: {e!s}")
+
+
+async def send_ws_payment_notification(wallet: Wallet, payment: Payment):
+    # TODO: websocket message should be a clean payment model
+    # await websocket_manager.send(wallet.inkey, payment.json())
+    # TODO: figure out why we send the balance with the payment here.
+    # cleaner would be to have a separate message for the balance
+    # and send it with the id of the wallet so wallets can subscribe to it
+    payment_notification = json.dumps(
+        {
+            "wallet_balance": wallet.balance,
+            # use pydantic json serialization to get the correct datetime format
+            "payment": json.loads(payment.json()),
+        },
+    )
+    await websocket_manager.send(wallet.inkey, payment_notification)
+    await websocket_manager.send(wallet.adminkey, payment_notification)
+    await websocket_manager.send(
+        payment.payment_hash,
+        json.dumps({"pending": payment.pending, "status": payment.status}),
+    )
+
+
+async def send_chat_payment_notification(wallet: Wallet, payment: Payment):
+    amount_sats = abs(payment.sat)
+    values: dict = {
+        "wallet_id": wallet.id,
+        "wallet_name": wallet.name,
+        "amount_sats": amount_sats,
+        "fiat_value_fmt": "",
+    }
+    if payment.extra.get("wallet_fiat_currency", None):
+        amount_fiat = payment.extra.get("wallet_fiat_amount", None)
+        currency = payment.extra.get("wallet_fiat_currency", None)
+        values["fiat_value_fmt"] = f"`{amount_fiat}`*{currency}* / "
+
+    if payment.is_out:
+        if amount_sats >= settings.lnbits_notification_outgoing_payment_amount_sats:
+            enqueue_admin_notification(NotificationType.outgoing_payment, values)
+    elif amount_sats >= settings.lnbits_notification_incoming_payment_amount_sats:
+        enqueue_admin_notification(NotificationType.incoming_payment, values)
+
+    user = await get_user(wallet.user)
+    user_notifications = user.extra.notifications if user else None
+    if user_notifications and wallet.id not in user_notifications.excluded_wallets:
+        out_limit = user_notifications.outgoing_payments_sats
+        in_limit = user_notifications.incoming_payments_sats
+        if payment.is_out and (amount_sats >= out_limit):
+            enqueue_user_notification(
+                NotificationType.outgoing_payment, values, user_notifications
+            )
+        elif amount_sats >= in_limit:
+            enqueue_user_notification(
+                NotificationType.incoming_payment, values, user_notifications
+            )
+
+
+async def send_payment_push_notification(wallet: Wallet, payment: Payment):
+    subscriptions = await get_webpush_subscriptions_for_user(wallet.user)
+
+    amount = int(payment.amount / 1000)
+
+    title = f"LNbits: {wallet.name}"
+    body = f"You just received {amount} sat{'s'[:amount^1]}!"
+
+    if payment.memo:
+        body += f"\r\n{payment.memo}"
+
+    for subscription in subscriptions:
+        # todo: review permissions when user-id-only not allowed
+        # todo: replace all this logic with websockets?
+        url = f"https://{subscription.host}/wallet?usr={wallet.user}&wal={wallet.id}"
+        await send_push_notification(subscription, title, body, url)
+
+
+async def send_push_notification(subscription, title, body, url=""):
+    vapid = Vapid()
+    try:
+        logger.debug("sending push notification")
+        webpush(
+            json.loads(subscription.data),
+            json.dumps({"title": title, "body": body, "url": url}),
+            (
+                vapid.from_pem(bytes(settings.lnbits_webpush_privkey, "utf-8"))
+                if settings.lnbits_webpush_privkey
+                else None
+            ),
+            {"aud": "", "sub": "mailto:alan@lnbits.com"},
+        )
+    except WebPushException as e:
+        if e.response and e.response.status_code == HTTPStatus.GONE:
+            # cleanup unsubscribed or expired push subscriptions
+            await delete_webpush_subscriptions(subscription.endpoint)
+        else:
+            logger.error(
+                f"failed sending push notification: "
+                f"{e.response.text if e.response else e}"
+            )
+
+
+def _is_message_type_enabled(message_type: NotificationType) -> bool:
+    if message_type == NotificationType.balance_update:
+        return settings.lnbits_notification_credit_debit
+    if message_type == NotificationType.settings_update:
+        return settings.lnbits_notification_settings_update
+    if message_type == NotificationType.watchdog_check:
+        return settings.lnbits_notification_watchdog
+    if message_type == NotificationType.balance_delta:
+        return settings.notification_balance_delta_changed
+    if message_type == NotificationType.server_start_stop:
+        return settings.lnbits_notification_server_start_stop
+    if message_type == NotificationType.server_status:
+        return settings.lnbits_notification_server_status_hours > 0
+    if message_type == NotificationType.incoming_payment:
+        return settings.lnbits_notification_incoming_payment_amount_sats > 0
+    if message_type == NotificationType.outgoing_payment:
+        return settings.lnbits_notification_outgoing_payment_amount_sats > 0
+
+    return False
+
+
+def _notification_message_to_text(
+    notification_message: NotificationMessage,
+) -> tuple[str, str]:
+    message_type = notification_message.message_type.value
+    meesage_value = NOTIFICATION_TEMPLATES.get(message_type, message_type)
+    try:
+        text = meesage_value.format(**notification_message.values)
+    except Exception as e:
+        logger.warning(f"Error formatting notification message: {e}")
+        text = meesage_value
+    text = f"""[{settings.lnbits_site_title}]\n{text}"""
+    return message_type, text
@@ -1,19 +1,30 @@
-import json
+import asyncio
 import time
-from typing import Optional
+from datetime import datetime, timedelta, timezone

+from bolt11 import Bolt11, MilliSatoshi, Tags
 from bolt11 import decode as bolt11_decode
-from bolt11.types import Bolt11
+from bolt11 import encode as bolt11_encode
+from lnurl import LnurlErrorResponse, LnurlSuccessResponse
+from lnurl import execute_withdraw as lnurl_withdraw
 from loguru import logger

+from lnbits.core.crud.payments import get_daily_stats
 from lnbits.core.db import db
-from lnbits.db import Connection
+from lnbits.core.models import PaymentDailyStats, PaymentFilters
+from lnbits.core.models.payments import CreateInvoice
+from lnbits.db import Connection, Filters
 from lnbits.decorators import check_user_extension_access
-from lnbits.exceptions import InvoiceError, PaymentError
+from lnbits.exceptions import InvoiceError, PaymentError, UnsupportedError
+from lnbits.fiat import get_fiat_provider
+from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
+from lnbits.tasks import create_task, internal_invoice_queue_put
+from lnbits.utils.crypto import fake_privkey, random_secret_and_hash, verify_preimage
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
 from lnbits.wallets import fake_wallet, get_funding_source
 from lnbits.wallets.base import (
+    InvoiceResponse,
    PaymentPendingStatus,
    PaymentResponse,
    PaymentStatus,
@@ -36,27 +47,33 @@ from ..models import (
    PaymentState,
    Wallet,
 )
-from .websockets import websocket_manager
+from .notifications import send_payment_notification
+
+payment_lock = asyncio.Lock()
+wallets_payments_lock: dict[str, asyncio.Lock] = {}


 async def pay_invoice(
    *,
    wallet_id: str,
    payment_request: str,
-    max_sat: Optional[int] = None,
-    extra: Optional[dict] = None,
+    max_sat: int | None = None,
+    extra: dict | None = None,
    description: str = "",
    tag: str = "",
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> Payment:
+    if settings.lnbits_only_allow_incoming_payments:
+        raise PaymentError("Only incoming payments allowed.", status="failed")
    invoice = _validate_payment_request(payment_request, max_sat)
-    assert invoice.amount_msat
+    if not invoice.amount_msat:
+        raise ValueError("Missig invoice amount.")

-    async with db.reuse_conn(conn) if conn else db.connect() as conn:
+    async with db.reuse_conn(conn) if conn else db.connect() as new_conn:
        amount_msat = invoice.amount_msat
-        wallet = await _check_wallet_for_payment(wallet_id, tag, amount_msat, conn)
+        wallet = await _check_wallet_for_payment(wallet_id, tag, amount_msat, new_conn)

-        if await is_internal_status_success(invoice.payment_hash, conn):
+        if await is_internal_status_success(invoice.payment_hash, new_conn):
            raise PaymentError("Internal invoice already paid.", status="failed")

        _, extra = await calculate_fiat_amounts(amount_msat / 1000, wallet, extra=extra)
@@ -71,25 +88,160 @@ async def pay_invoice(
            extra=extra,
        )

-        payment = await _pay_invoice(wallet, create_payment_model, conn)
-        await _credit_service_fee_wallet(payment, conn)
+    payment = await _pay_invoice(wallet.id, create_payment_model, conn)

-        return payment
+    async with db.reuse_conn(conn) if conn else db.connect() as new_conn:
+        await _credit_service_fee_wallet(wallet, payment, new_conn)
+
+    return payment
+
+
+async def create_payment_request(
+    wallet_id: str, invoice_data: CreateInvoice
+) -> Payment:
+    """
+    Create a lightning invoice or a fiat payment request.
+    """
+    if invoice_data.fiat_provider:
+        return await create_fiat_invoice(wallet_id, invoice_data)
+
+    return await create_wallet_invoice(wallet_id, invoice_data)
+
+
+async def create_fiat_invoice(
+    wallet_id: str, invoice_data: CreateInvoice, conn: Connection | None = None
+):
+    fiat_provider_name = invoice_data.fiat_provider
+    if not fiat_provider_name:
+        raise ValueError("Fiat provider is required for fiat invoices.")
+    if not settings.is_fiat_provider_enabled(fiat_provider_name):
+        raise ValueError(
+            f"Fiat provider '{fiat_provider_name}' is not enabled.",
+        )
+
+    if invoice_data.unit == "sat":
+        raise ValueError("Fiat provider cannot be used with satoshis.")
+    amount_sat = await fiat_amount_as_satoshis(invoice_data.amount, invoice_data.unit)
+    await _check_fiat_invoice_limits(amount_sat, fiat_provider_name, conn)
+
+    invoice_data.internal = True  # use FakeWallet for fiat invoices
+    if not invoice_data.memo:
+        invoice_data.memo = settings.lnbits_site_title + f" ({fiat_provider_name})"
+
+    internal_payment = await create_wallet_invoice(wallet_id, invoice_data)
+
+    fiat_provider = await get_fiat_provider(fiat_provider_name)
+    if not fiat_provider:
+        raise InvoiceError("No fiat provider found.", status="failed")
+
+    fiat_invoice = await fiat_provider.create_invoice(
+        amount=invoice_data.amount,
+        payment_hash=internal_payment.payment_hash,
+        currency=invoice_data.unit,
+        memo=invoice_data.memo,
+        extra=invoice_data.extra or {},
+    )
+
+    if fiat_invoice.failed:
+        logger.warning(fiat_invoice.error_message)
+        internal_payment.status = PaymentState.FAILED
+        await update_payment(internal_payment, conn=conn)
+        raise ValueError(
+            f"Cannot create payment request for '{fiat_provider_name}'.",
+        )
+
+    internal_payment.fee = -abs(
+        service_fee_fiat(internal_payment.msat, fiat_provider_name)
+    )
+
+    internal_payment.fiat_provider = fiat_provider_name
+    internal_payment.extra["fiat_checking_id"] = fiat_invoice.checking_id
+    # todo: move to payent
+    internal_payment.extra["fiat_payment_request"] = fiat_invoice.payment_request
+    new_checking_id = (
+        f"fiat_{fiat_provider_name}_"
+        f"{fiat_invoice.checking_id or internal_payment.checking_id}"
+    )
+    await update_payment(internal_payment, new_checking_id, conn=conn)
+    internal_payment.checking_id = new_checking_id
+
+    return internal_payment
+
+
+async def create_wallet_invoice(wallet_id: str, data: CreateInvoice) -> Payment:
+    description_hash = None
+    unhashed_description = None
+    memo = data.memo or settings.lnbits_site_title
+    if data.description_hash or data.unhashed_description:
+        if data.description_hash:
+            try:
+                description_hash = bytes.fromhex(data.description_hash)
+            except ValueError as exc:
+                raise ValueError(
+                    "'description_hash' must be a valid hex string"
+                ) from exc
+        if data.unhashed_description:
+            try:
+                unhashed_description = bytes.fromhex(data.unhashed_description)
+            except ValueError as exc:
+                raise ValueError(
+                    "'unhashed_description' must be a valid hex string",
+                ) from exc
+        # do not save memo if description_hash or unhashed_description is set
+        memo = ""
+
+    payment = await create_invoice(
+        wallet_id=wallet_id,
+        amount=data.amount,
+        memo=memo,
+        currency=data.unit,
+        description_hash=description_hash,
+        unhashed_description=unhashed_description,
+        expiry=data.expiry,
+        extra=data.extra,
+        webhook=data.webhook,
+        internal=data.internal,
+        payment_hash=data.payment_hash,
+    )
+
+    if data.lnurl_withdraw:
+        try:
+            check_callback_url(data.lnurl_withdraw.callback)
+            res = await lnurl_withdraw(
+                data.lnurl_withdraw,
+                payment.bolt11,
+                user_agent=settings.user_agent,
+                timeout=10,
+            )
+            if isinstance(res, LnurlErrorResponse):
+                payment.extra["lnurl_response"] = res.reason
+                payment.status = "failed"
+            elif isinstance(res, LnurlSuccessResponse):
+                payment.extra["lnurl_response"] = True
+                payment.status = "success"
+        except Exception as exc:
+            payment.extra["lnurl_response"] = str(exc)
+            payment.status = "failed"
+        # updating to payment here would run into a race condition
+        # with the payment listeners and they will overwrite each other
+
+    return payment


 async def create_invoice(
    *,
    wallet_id: str,
    amount: float,
-    currency: Optional[str] = "sat",
+    currency: str | None = "sat",
    memo: str,
-    description_hash: Optional[bytes] = None,
-    unhashed_description: Optional[bytes] = None,
-    expiry: Optional[int] = None,
-    extra: Optional[dict] = None,
-    webhook: Optional[str] = None,
-    internal: Optional[bool] = False,
-    conn: Optional[Connection] = None,
+    description_hash: bytes | None = None,
+    unhashed_description: bytes | None = None,
+    expiry: int | None = None,
+    extra: dict | None = None,
+    webhook: str | None = None,
+    internal: bool | None = False,
+    payment_hash: str | None = None,
+    conn: Connection | None = None,
 ) -> Payment:
    if not amount > 0:
        raise InvoiceError("Amountless invoices not supported.", status="failed")
@@ -98,7 +250,7 @@ async def create_invoice(
    if not user_wallet:
        raise InvoiceError(f"Could not fetch wallet '{wallet_id}'.", status="failed")

-    invoice_memo = None if description_hash else memo
+    invoice_memo = None if description_hash else memo[:640]

    # use the fake wallet if the invoice is for internal use only
    funding_source = fake_wallet if internal else get_funding_source()
@@ -107,6 +259,12 @@ async def create_invoice(
        amount, user_wallet, currency, extra
    )

+    if amount_sat > settings.lnbits_max_incoming_payment_amount_sats:
+        raise InvoiceError(
+            f"Invoice amount {amount_sat} sats is too high. Max allowed: "
+            f"{settings.lnbits_max_incoming_payment_amount_sats} sats.",
+            status="failed",
+        )
    if settings.is_wallet_max_balance_exceeded(
        user_wallet.balance_msat / 1000 + amount_sat
    ):
@@ -116,38 +274,54 @@ async def create_invoice(
            status="failed",
        )

-    (
-        ok,
-        checking_id,
-        payment_request,
-        error_message,
-    ) = await funding_source.create_invoice(
-        amount=amount_sat,
-        memo=invoice_memo,
-        description_hash=description_hash,
-        unhashed_description=unhashed_description,
-        expiry=expiry or settings.lightning_invoice_expiry,
-    )
-    if not ok or not payment_request or not checking_id:
-        raise InvoiceError(
-            error_message or "unexpected backend error.", status="pending"
+    if payment_hash:
+        try:
+            invoice_response = await funding_source.create_hold_invoice(
+                amount=amount_sat,
+                memo=invoice_memo,
+                payment_hash=payment_hash,
+                description_hash=description_hash,
+            )
+            extra["hold_invoice"] = True
+        except UnsupportedError as exc:
+            raise InvoiceError(
+                "Hold invoices are not supported by the funding source.",
+                status="failed",
+            ) from exc
+    else:
+        invoice_response = await funding_source.create_invoice(
+            amount=amount_sat,
+            memo=invoice_memo,
+            description_hash=description_hash,
+            unhashed_description=unhashed_description,
+            expiry=expiry or settings.lightning_invoice_expiry,
        )
-
-    invoice = bolt11_decode(payment_request)
+    if (
+        not invoice_response.ok
+        or not invoice_response.payment_request
+        or not invoice_response.checking_id
+    ):
+        raise InvoiceError(
+            message=invoice_response.error_message or "unexpected backend error.",
+            status="pending",
+        )
+    invoice = bolt11_decode(invoice_response.payment_request)

    create_payment_model = CreatePayment(
        wallet_id=wallet_id,
-        bolt11=payment_request,
+        bolt11=invoice_response.payment_request,
        payment_hash=invoice.payment_hash,
+        preimage=invoice_response.preimage,
        amount_msat=amount_sat * 1000,
        expiry=invoice.expiry_date,
        memo=memo,
        extra=extra,
        webhook=webhook,
+        fee=invoice_response.fee_msat or 0,
    )

    payment = await create_payment(
-        checking_id=checking_id,
+        checking_id=invoice_response.checking_id,
        data=create_payment_model,
        conn=conn,
    )
@@ -162,13 +336,48 @@ async def update_pending_payments(wallet_id: str):
        exclude_uncheckable=True,
    )
    for payment in pending_payments:
-        status = await payment.check_status()
-        if status.failed:
-            payment.status = PaymentState.FAILED
-            await update_payment(payment)
-        elif status.success:
-            payment.status = PaymentState.SUCCESS
-            await update_payment(payment)
+        await update_pending_payment(payment)
+
+
+async def update_pending_payment(payment: Payment) -> Payment:
+    status = await payment.check_status()
+    if status.failed:
+        payment.status = PaymentState.FAILED
+        await update_payment(payment)
+    elif status.success:
+        payment = await update_payment_success_status(payment, status)
+    return payment
+
+
+async def check_pending_payments():
+    """
+    check_pending_payments is called during startup to check for pending payments with
+    the backend and also to delete expired invoices. Incoming payments will be
+    checked only once, outgoing pending payments will be checked regularly.
+    """
+    funding_source = get_funding_source()
+    if funding_source.__class__.__name__ == "VoidWallet":
+        logger.warning("Task: skipping pending check for VoidWallet")
+        return
+    start_time = time.time()
+    pending_payments = await get_payments(
+        since=(int(time.time()) - 60 * 60 * 24 * 15),  # 15 days ago
+        complete=False,
+        pending=True,
+        exclude_uncheckable=True,
+    )
+    count = len(pending_payments)
+    if count > 0:
+        logger.info(f"Task: checking {count} pending payments of last 15 days...")
+        for i, payment in enumerate(pending_payments):
+            payment = await update_pending_payment(payment)
+            prefix = f"payment ({i+1} / {count})"
+            logger.debug(f"{prefix} {payment.status} {payment.checking_id}")
+            await asyncio.sleep(0.01)  # to avoid complete blocking
+        logger.info(
+            f"Task: pending check finished for {count} payments"
+            f" (took {time.time() - start_time:0.3f} s)"
+        )


 def fee_reserve_total(amount_msat: int, internal: bool = False) -> int:
@@ -176,6 +385,7 @@ def fee_reserve_total(amount_msat: int, internal: bool = False) -> int:


 def fee_reserve(amount_msat: int, internal: bool = False) -> int:
+    amount_msat = abs(amount_msat)
    return settings.fee_reserve(amount_msat, internal)


@@ -195,53 +405,96 @@ def service_fee(amount_msat: int, internal: bool = False) -> int:
        return 0


-async def update_wallet_balance(wallet_id: str, amount: int):
-    async with db.connect() as conn:
+def service_fee_fiat(amount_msat: int, fiat_provider_name: str) -> int:
+    """
+    Calculate the service fee for a fiat provider based on the amount in msat.
+    Return the fee in msat.
+    """
+    limits = settings.get_fiat_provider_limits(fiat_provider_name)
+    if not limits:
+        return 0
+    amount_msat = abs(amount_msat)
+    fee_max = limits.service_max_fee_sats * 1000
+    if not limits.service_fee_wallet_id:
+        return 0
+
+    fee_percentage = int(amount_msat / 100 * limits.service_fee_percent)
+    if fee_max > 0 and fee_percentage > fee_max:
+        return fee_max
+    else:
+        return fee_percentage
+
+
+async def update_wallet_balance(
+    wallet: Wallet,
+    amount: int,
+    conn: Connection | None = None,
+):
+    if amount == 0:
+        raise ValueError("Amount cannot be 0.")
+
+    # negative balance change
+    if amount < 0:
+        if wallet.balance + amount < 0:
+            raise ValueError("Balance change failed, can not go into negative balance.")
+        async with db.reuse_conn(conn) if conn else db.connect() as conn:
+            payment_secret, payment_hash = random_secret_and_hash()
+            invoice = Bolt11(
+                currency="bc",
+                amount_msat=MilliSatoshi(abs(amount) * 1000),
+                date=int(time.time()),
+                tags=Tags.from_dict(
+                    {
+                        "payment_hash": payment_hash,
+                        "payment_secret": payment_secret,
+                        "description": "Admin debit",
+                    }
+                ),
+            )
+            privkey = fake_privkey(settings.fake_wallet_secret)
+            bolt11 = bolt11_encode(invoice, privkey)
+            await create_payment(
+                checking_id=f"internal_{payment_hash}",
+                data=CreatePayment(
+                    wallet_id=wallet.id,
+                    bolt11=bolt11,
+                    payment_hash=payment_hash,
+                    amount_msat=amount * 1000,
+                    memo="Admin debit",
+                ),
+                status=PaymentState.SUCCESS,
+                conn=conn,
+            )
+        return None
+
+    # positive balance change
+    if (
+        settings.lnbits_wallet_limit_max_balance > 0
+        and wallet.balance + amount > settings.lnbits_wallet_limit_max_balance
+    ):
+        raise ValueError("Balance change failed, amount exceeds maximum balance.")
+    async with db.reuse_conn(conn) if conn else db.connect() as conn:
        payment = await create_invoice(
-            wallet_id=wallet_id,
+            wallet_id=wallet.id,
            amount=amount,
-            memo="Admin top up",
+            memo="Admin credit",
            internal=True,
            conn=conn,
        )
        payment.status = PaymentState.SUCCESS
        await update_payment(payment, conn=conn)
-        # notify receiver asynchronously
-        from lnbits.tasks import internal_invoice_queue
-
-        await internal_invoice_queue.put(payment.checking_id)
-
-
-async def send_payment_notification(wallet: Wallet, payment: Payment):
-    # TODO: websocket message should be a clean payment model
-    # await websocket_manager.send_data(payment.json(), wallet.inkey)
-    # TODO: figure out why we send the balance with the payment here.
-    # cleaner would be to have a separate message for the balance
-    # and send it with the id of the wallet so wallets can subscribe to it
-    await websocket_manager.send_data(
-        json.dumps(
-            {
-                "wallet_balance": wallet.balance,
-                # use pydantic json serialization to get the correct datetime format
-                "payment": json.loads(payment.json()),
-            },
-        ),
-        wallet.inkey,
-    )
-    await websocket_manager.send_data(
-        json.dumps({"pending": payment.pending}), payment.payment_hash
-    )
+        await internal_invoice_queue_put(payment.checking_id)


 async def check_wallet_limits(
-    wallet_id: str, amount_msat: int, conn: Optional[Connection] = None
+    wallet_id: str, amount_msat: int, conn: Connection | None = None
 ):
    await check_time_limit_between_transactions(wallet_id, conn)
    await check_wallet_daily_withdraw_limit(wallet_id, amount_msat, conn)


 async def check_time_limit_between_transactions(
-    wallet_id: str, conn: Optional[Connection] = None
+    wallet_id: str, conn: Connection | None = None
 ):
    limit = settings.lnbits_wallet_limit_secs_between_trans
    if not limit or limit <= 0:
@@ -261,7 +514,7 @@ async def check_time_limit_between_transactions(


 async def check_wallet_daily_withdraw_limit(
-    wallet_id: str, amount_msat: int, conn: Optional[Connection] = None
+    wallet_id: str, amount_msat: int, conn: Connection | None = None
 ):
    limit = settings.lnbits_wallet_limit_daily_max_withdraw
    if not limit:
@@ -294,8 +547,8 @@ async def check_wallet_daily_withdraw_limit(
 async def calculate_fiat_amounts(
    amount: float,
    wallet: Wallet,
-    currency: Optional[str] = None,
-    extra: Optional[dict] = None,
+    currency: str | None = None,
+    extra: dict | None = None,
 ) -> tuple[int, dict]:
    wallet_currency = wallet.currency or settings.lnbits_default_accounting_currency
    fiat_amounts: dict = extra or {}
@@ -305,17 +558,22 @@ async def calculate_fiat_amounts(
            fiat_amounts["fiat_currency"] = currency
            fiat_amounts["fiat_amount"] = round(amount, ndigits=3)
            fiat_amounts["fiat_rate"] = amount_sat / amount
+            fiat_amounts["btc_rate"] = (amount / amount_sat) * 100_000_000
    else:
        amount_sat = int(amount)

    if wallet_currency:
-        if wallet_currency == currency:
-            fiat_amount = amount
-        else:
-            fiat_amount = await satoshis_amount_as_fiat(amount_sat, wallet_currency)
-        fiat_amounts["wallet_fiat_currency"] = wallet_currency
-        fiat_amounts["wallet_fiat_amount"] = round(fiat_amount, ndigits=3)
-        fiat_amounts["wallet_fiat_rate"] = amount_sat / fiat_amount
+        try:
+            if wallet_currency == currency:
+                fiat_amount = amount
+            else:
+                fiat_amount = await satoshis_amount_as_fiat(amount_sat, wallet_currency)
+            fiat_amounts["wallet_fiat_currency"] = wallet_currency
+            fiat_amounts["wallet_fiat_amount"] = round(fiat_amount, ndigits=3)
+            fiat_amounts["wallet_fiat_rate"] = amount_sat / fiat_amount
+            fiat_amounts["wallet_btc_rate"] = (fiat_amount / amount_sat) * 100_000_000
+        except Exception as e:
+            logger.error(f"Error calculating fiat amount for wallet '{wallet.id}': {e}")

    logger.debug(
        f"Calculated fiat amounts {wallet.id=} {amount=} {currency=}: {fiat_amounts=}"
@@ -325,9 +583,9 @@ async def calculate_fiat_amounts(


 async def check_transaction_status(
-    wallet_id: str, payment_hash: str, conn: Optional[Connection] = None
+    wallet_id: str, payment_hash: str, conn: Connection | None = None
 ) -> PaymentStatus:
-    payment: Optional[Payment] = await get_wallet_payment(
+    payment: Payment | None = await get_wallet_payment(
        wallet_id, payment_hash, conn=conn
    )
    if not payment:
@@ -339,18 +597,82 @@ async def check_transaction_status(
    return await payment.check_status()


-async def _pay_invoice(wallet, create_payment_model, conn):
-    payment = await _pay_internal_invoice(wallet, create_payment_model, conn)
-    if not payment:
-        payment = await _pay_external_invoice(wallet, create_payment_model, conn)
-    return payment
+async def get_payments_daily_stats(
+    filters: Filters[PaymentFilters],
+    user_id: str | None = None,
+) -> list[PaymentDailyStats]:
+    data_in, data_out = await get_daily_stats(filters, user_id=user_id)
+    balance_total: float = 0
+
+    _none = PaymentDailyStats(date=datetime.now(timezone.utc))
+    if len(data_in) == 0 and len(data_out) == 0:
+        return []
+    if len(data_in) == 0:
+        data_in = [_none]
+    if len(data_out) == 0:
+        data_out = [_none]
+
+    data: list[PaymentDailyStats] = []
+
+    def _tz(dt: datetime) -> datetime:
+        return dt.replace(tzinfo=timezone.utc)
+
+    start_date = min(_tz(data_in[0].date), _tz(data_out[0].date))
+    end_date = max(_tz(data_in[-1].date), _tz(data_out[-1].date))
+    delta = timedelta(days=1)
+    while start_date <= end_date:
+
+        data_in_point = next((x for x in data_in if _tz(x.date) == start_date), _none)
+        data_out_point = next((x for x in data_out if _tz(x.date) == start_date), _none)
+
+        balance_total += data_in_point.balance + data_out_point.balance
+        data.append(
+            PaymentDailyStats(
+                date=start_date,
+                balance=balance_total // 1000,
+                balance_in=data_in_point.balance // 1000,
+                balance_out=data_out_point.balance // 1000,
+                payments_count=data_in_point.payments_count
+                + data_out_point.payments_count,
+                count_in=data_in_point.payments_count,
+                count_out=data_out_point.payments_count,
+                fee=(data_in_point.fee + data_out_point.fee) // 1000,
+            )
+        )
+
+        start_date += delta
+
+    return data
+
+
+async def _pay_invoice(
+    wallet_id: str,
+    create_payment_model: CreatePayment,
+    conn: Connection | None = None,
+):
+    async with payment_lock:
+        if wallet_id not in wallets_payments_lock:
+            wallets_payments_lock[wallet_id] = asyncio.Lock()
+
+    async with wallets_payments_lock[wallet_id]:
+        # get the wallet again to make sure we have the latest balance
+        wallet = await get_wallet(wallet_id, conn=conn)
+        if not wallet:
+            raise PaymentError(
+                f"Could not fetch wallet '{wallet_id}'.", status="failed"
+            )
+
+        payment = await _pay_internal_invoice(wallet, create_payment_model, conn)
+        if not payment:
+            payment = await _pay_external_invoice(wallet, create_payment_model, conn)
+        return payment


 async def _pay_internal_invoice(
    wallet: Wallet,
    create_payment_model: CreatePayment,
-    conn: Optional[Connection] = None,
-) -> Optional[Payment]:
+    conn: Connection | None = None,
+) -> Payment | None:
    """
    Pay an internal payment.
    returns None if the payment is not internal.
@@ -378,12 +700,15 @@ async def _pay_internal_invoice(
    ):
        raise PaymentError("Invalid invoice. Bolt11 changed.", status="failed")

-    fee_reserve_total_msat = fee_reserve_total(abs(amount_msat), internal=True)
+    fee_reserve_total_msat = fee_reserve_total(amount_msat, internal=True)
    create_payment_model.fee = abs(fee_reserve_total_msat)

    if wallet.balance_msat < abs(amount_msat) + fee_reserve_total_msat:
        raise PaymentError("Insufficient balance.", status="failed")

+    # release the preimage
+    create_payment_model.preimage = internal_invoice.preimage
+
    internal_id = f"internal_{create_payment_model.payment_hash}"
    logger.debug(f"creating temporary internal payment with id {internal_id}")
    payment = await create_payment(
@@ -414,13 +739,15 @@ async def _pay_internal_invoice(
 async def _pay_external_invoice(
    wallet: Wallet,
    create_payment_model: CreatePayment,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ) -> Payment:
    checking_id = create_payment_model.payment_hash
    amount_msat = create_payment_model.amount_msat

    fee_reserve_total_msat = fee_reserve_total(amount_msat, internal=False)

+    if wallet.balance_msat < abs(amount_msat):
+        raise PaymentError("Insufficient balance.", status="failed")
    if wallet.balance_msat < abs(amount_msat) + fee_reserve_total_msat:
        raise PaymentError(
            f"You must reserve at least ({round(fee_reserve_total_msat/1000)}"
@@ -440,55 +767,72 @@ async def _pay_external_invoice(
    )

    fee_reserve_msat = fee_reserve(amount_msat, internal=False)
-    service_fee_msat = service_fee(amount_msat, internal=False)

-    funding_source = get_funding_source()
-
-    logger.debug(f"fundingsource: sending payment {checking_id}")
-    payment_response: PaymentResponse = await funding_source.pay_invoice(
-        create_payment_model.bolt11, fee_reserve_msat
+    task = create_task(
+        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat)
    )
-    logger.debug(f"backend: pay_invoice finished {checking_id}, {payment_response}")
-    if payment_response.checking_id and payment_response.checking_id != checking_id:
-        logger.warning(
-            f"backend sent unexpected checking_id (expected: {checking_id} got:"
-            f" {payment_response.checking_id})"
+
+    # make sure a hold invoice or deferred payment is not blocking the server
+    wait_time = max(1, settings.lnbits_funding_source_pay_invoice_wait_seconds)
+    try:
+        payment_response = await asyncio.wait_for(task, timeout=wait_time)
+    except asyncio.TimeoutError:
+        # return pending payment on timeout
+        logger.debug(
+            f"payment timeout after {wait_time}s, {checking_id} is still pending"
        )
-    if payment_response.checking_id and payment_response.ok is not False:
-        # payment.ok can be True (paid) or None (pending)!
-        logger.debug(f"updating payment {checking_id}")
-        payment.status = (
-            PaymentState.SUCCESS
-            if payment_response.ok is True
-            else PaymentState.PENDING
-        )
-        payment.fee = -(abs(payment_response.fee_msat or 0) + abs(service_fee_msat))
-        payment.preimage = payment_response.preimage
-        await update_payment(payment, payment_response.checking_id, conn=conn)
-        payment.checking_id = payment_response.checking_id
-        if payment.success:
-            await send_payment_notification(wallet, payment)
-        logger.success(f"payment successful {payment_response.checking_id}")
-    elif payment_response.checking_id is None and payment_response.ok is False:
-        # payment failed
-        logger.debug(f"payment failed {checking_id}, {payment_response.error_message}")
+        return payment
+
+    # payment failed
+    if (
+        payment_response.checking_id is None
+        or payment_response.ok is False
+        or payment_response.checking_id != checking_id
+    ):
        payment.status = PaymentState.FAILED
        await update_payment(payment, conn=conn)
-        raise PaymentError(
-            f"Payment failed: {payment_response.error_message}"
-            or "Payment failed, but backend didn't give us an error message.",
-            status="failed",
-        )
-    else:
-        logger.warning(
-            "didn't receive checking_id from backend, payment may be stuck in"
-            f" database: {checking_id}"
+        message = payment_response.error_message or "without an error message."
+        raise PaymentError(f"Payment failed: {message}", status="failed")
+
+    if payment_response.success:
+        payment = await update_payment_success_status(
+            payment, payment_response, conn=conn
        )
+        await send_payment_notification(wallet, payment)
+        logger.success(f"payment successful {payment_response.checking_id}")
+
+    payment.checking_id = payment_response.checking_id
    return payment


+async def update_payment_success_status(
+    payment: Payment,
+    status: PaymentStatus,
+    conn: Connection | None = None,
+) -> Payment:
+    if status.success:
+        service_fee_msat = service_fee(payment.amount, internal=False)
+        payment.status = PaymentState.SUCCESS
+        payment.fee = -(abs(status.fee_msat or 0) + abs(service_fee_msat))
+        payment.preimage = payment.preimage or status.preimage
+        await update_payment(payment, conn=conn)
+    return payment
+
+
+async def _fundingsource_pay_invoice(
+    checking_id: str, bolt11: str, fee_reserve_msat: int
+) -> PaymentResponse:
+    logger.debug(f"fundingsource: sending payment {checking_id}")
+    funding_source = get_funding_source()
+    payment_response: PaymentResponse = await funding_source.pay_invoice(
+        bolt11, fee_reserve_msat
+    )
+    logger.debug(f"backend: pay_invoice finished {checking_id}, {payment_response}")
+    return payment_response
+
+
 async def _verify_external_payment(
-    payment: Payment, conn: Optional[Connection] = None
+    payment: Payment, conn: Connection | None = None
 ) -> Payment:
    # fail on pending payments
    if payment.pending:
@@ -505,8 +849,7 @@ async def _verify_external_payment(

    if status.success:
        # payment was successful on the fundingsource
-        payment.status = PaymentState.SUCCESS
-        await update_payment(payment, conn=conn)
+        await update_payment_success_status(payment, status, conn=conn)
        raise PaymentError(
            "Failed payment was already paid on the fundingsource.",
            status="success",
@@ -520,7 +863,7 @@ async def _check_wallet_for_payment(
    wallet_id: str,
    tag: str,
    amount_msat: int,
-    conn: Optional[Connection] = None,
+    conn: Connection | None = None,
 ):
    wallet = await get_wallet(wallet_id, conn=conn)
    if not wallet:
@@ -536,7 +879,7 @@ async def _check_wallet_for_payment(


 def _validate_payment_request(
-    payment_request: str, max_sat: Optional[int] = None
+    payment_request: str, max_sat: int | None = None
 ) -> Bolt11:
    try:
        invoice = bolt11_decode(payment_request)
@@ -546,25 +889,35 @@ def _validate_payment_request(
    if not invoice.amount_msat or not invoice.amount_msat > 0:
        raise PaymentError("Amountless invoices not supported.", status="failed")

-    if max_sat and invoice.amount_msat > max_sat * 1000:
-        raise PaymentError("Amount in invoice is too high.", status="failed")
+    max_sat = max_sat or settings.lnbits_max_outgoing_payment_amount_sats
+    max_sat = min(max_sat, settings.lnbits_max_outgoing_payment_amount_sats)
+    if invoice.amount_msat > max_sat * 1000:
+        raise PaymentError(
+            f"Invoice amount {invoice.amount_msat // 1000} sats is too high. "
+            f"Max allowed: {max_sat} sats.",
+            status="failed",
+        )

    return invoice


 async def _credit_service_fee_wallet(
-    payment: Payment, conn: Optional[Connection] = None
+    wallet: Wallet, payment: Payment, conn: Connection | None = None
 ):
    service_fee_msat = service_fee(payment.amount, internal=payment.is_internal)
    if not settings.lnbits_service_fee_wallet or not service_fee_msat:
        return

+    memo = f"""
+        Service fee for payment of {abs(payment.sat)} sats.
+        Wallet: '{wallet.name}' ({wallet.id})."""
+
    create_payment_model = CreatePayment(
        wallet_id=settings.lnbits_service_fee_wallet,
        bolt11=payment.bolt11,
        payment_hash=payment.payment_hash,
        amount_msat=abs(service_fee_msat),
-        memo="Service fee",
+        memo=memo,
    )
    await create_payment(
        checking_id=f"service_fee_{payment.payment_hash}",
@@ -572,3 +925,84 @@ async def _credit_service_fee_wallet(
        status=PaymentState.SUCCESS,
        conn=conn,
    )
+
+
+async def _check_fiat_invoice_limits(
+    amount_sat: int, fiat_provider_name: str, conn: Connection | None = None
+):
+    limits = settings.get_fiat_provider_limits(fiat_provider_name)
+    if not limits:
+        raise ValueError(
+            f"Fiat provider '{fiat_provider_name}' does not have limits configured.",
+        )
+
+    min_amount_sat = limits.service_min_amount_sats
+    if min_amount_sat and (amount_sat < min_amount_sat):
+        raise ValueError(
+            f"Minimum amount is {min_amount_sat} " f"sats for '{fiat_provider_name}'.",
+        )
+    max_amount_sats = limits.service_max_amount_sats
+    if max_amount_sats and (amount_sat > max_amount_sats):
+        raise ValueError(
+            f"Maximum amount is {max_amount_sats} " f"sats for '{fiat_provider_name}'.",
+        )
+
+    if limits.service_max_fee_sats > 0 or limits.service_fee_percent > 0:
+        if not limits.service_fee_wallet_id:
+            raise ValueError(
+                f"Fiat provider '{fiat_provider_name}' service fee wallet missing.",
+            )
+        fees_wallet = await get_wallet(limits.service_fee_wallet_id, conn=conn)
+        if not fees_wallet:
+            raise ValueError(
+                f"Fiat provider '{fiat_provider_name}' service fee wallet not found.",
+            )
+
+    if limits.service_faucet_wallet_id:
+        faucet_wallet = await get_wallet(limits.service_faucet_wallet_id, conn=conn)
+        if not faucet_wallet:
+            raise ValueError(
+                f"Fiat provider '{fiat_provider_name}' faucet wallet not found.",
+            )
+        if faucet_wallet.balance < amount_sat:
+            raise ValueError(
+                f"The amount exceeds the '{fiat_provider_name}'"
+                "faucet wallet balance.",
+            )
+
+
+async def settle_hold_invoice(payment: Payment, preimage: str) -> InvoiceResponse:
+    if verify_preimage(preimage, payment.payment_hash) is False:
+        raise InvoiceError("Invalid preimage.", status="failed")
+
+    funding_source = get_funding_source()
+    response = await funding_source.settle_hold_invoice(preimage=preimage)
+
+    if not response.ok:
+        raise InvoiceError(
+            response.error_message or "Unexpected backend error.", status="failed"
+        )
+
+    payment.preimage = preimage
+    payment.extra["hold_invoice_settled"] = True
+    await update_payment(payment)
+
+    return response
+
+
+async def cancel_hold_invoice(payment: Payment) -> InvoiceResponse:
+    funding_source = get_funding_source()
+    response = await funding_source.cancel_hold_invoice(
+        payment_hash=payment.payment_hash
+    )
+
+    if not response.ok:
+        raise InvoiceError(
+            response.error_message or "Unexpected backend error.", status="failed"
+        )
+
+    payment.status = PaymentState.FAILED
+    payment.extra["hold_invoice_cancelled"] = True
+    await update_payment(payment)
+
+    return response
@@ -3,8 +3,10 @@ from loguru import logger
 from py_vapid import Vapid
 from py_vapid.utils import b64urlencode

+from lnbits.db import dict_to_model
 from lnbits.settings import (
    EditableSettings,
+    UpdateSettings,
    readonly_variables,
    settings,
 )
@@ -17,7 +19,8 @@ async def check_webpush_settings():
        vapid = Vapid()
        vapid.generate_keys()
        privkey = vapid.private_pem()
-        assert vapid.public_key, "VAPID public key does not exist"
+        if not vapid.public_key:
+            raise ValueError("VAPID public key does not exist")
        pubkey = b64urlencode(
            vapid.public_key.public_bytes(
                serialization.Encoding.X962,
@@ -36,15 +39,21 @@ async def check_webpush_settings():
    logger.info(f"Pubkey: {settings.lnbits_webpush_pubkey}")


+def dict_to_settings(sets_dict: dict) -> UpdateSettings:
+    return dict_to_model(sets_dict, UpdateSettings)
+
+
 def update_cached_settings(sets_dict: dict):
-    for key, value in sets_dict.items():
+    editable_settings = dict_to_settings(sets_dict)
+    for key in sets_dict.keys():
        if key in readonly_variables:
            continue
        if key not in settings.dict().keys():
            continue
        try:
+            value = getattr(editable_settings, key)
            setattr(settings, key, value)
        except Exception:
-            logger.warning(f"Failed overriding setting: {key}, value: {value}")
+            logger.warning(f"Failed overriding setting: {key}.")
    if "super_user" in sets_dict:
        settings.super_user = sets_dict["super_user"]
@@ -1,5 +1,4 @@
 from pathlib import Path
-from typing import Optional
 from uuid import uuid4

 from loguru import logger
@@ -8,7 +7,6 @@ from lnbits.core.models.extensions import UserExtension
 from lnbits.settings import (
    EditableSettings,
    SuperSettings,
-    send_admin_user_to_saas,
    settings,
 )

@@ -38,7 +36,7 @@ from .settings import update_cached_settings


 async def create_user_account(
-    account: Optional[Account] = None, wallet_name: Optional[str] = None
+    account: Account | None = None, wallet_name: str | None = None
 ) -> User:
    if not settings.new_accounts_allowed:
        raise ValueError("Account creation is disabled.")
@@ -47,7 +45,9 @@ async def create_user_account(


 async def create_user_account_no_ckeck(
-    account: Optional[Account] = None, wallet_name: Optional[str] = None
+    account: Account | None = None,
+    wallet_name: str | None = None,
+    default_exts: list[str] | None = None,
 ) -> User:

    if account:
@@ -70,12 +70,17 @@ async def create_user_account_no_ckeck(
        wallet_name=wallet_name or settings.lnbits_default_wallet_name,
    )

-    for ext_id in settings.lnbits_user_default_extensions:
-        user_ext = UserExtension(user=account.id, extension=ext_id, active=True)
-        await update_user_extension(user_ext)
+    user_extensions = (default_exts or []) + settings.lnbits_user_default_extensions
+    for ext_id in user_extensions:
+        try:
+            user_ext = UserExtension(user=account.id, extension=ext_id, active=True)
+            await create_user_extension(user_ext)
+        except Exception as e:
+            logger.error(f"Error enabeling default extension {ext_id}: {e}")

    user = await get_user_from_account(account)
-    assert user, "Cannot find user for account."
+    if not user:
+        raise ValueError("Cannot find user for account.")

    return user

@@ -154,25 +159,17 @@ async def check_admin_settings():
        with open(Path(settings.lnbits_data_folder) / ".super_user", "w") as file:
            file.write(settings.super_user)

-        # callback for saas
-        if (
-            settings.lnbits_saas_callback
-            and settings.lnbits_saas_secret
-            and settings.lnbits_saas_instance_id
-        ):
-            send_admin_user_to_saas()
-
        account = await get_account(settings.super_user)
        if account and account.extra and account.extra.provider == "env":
            settings.first_install = True

        logger.success(
-            "✔️ Admin UI is enabled. run `poetry run lnbits-cli superuser` "
+            "✔️ Admin UI is enabled. run `uv run lnbits-cli superuser` "
            "to get the superuser."
        )


-async def init_admin_settings(super_user: Optional[str] = None) -> SuperSettings:
+async def init_admin_settings(super_user: str | None = None) -> SuperSettings:
    account = None
    if super_user:
        account = await get_account(super_user)
@@ -1,27 +1,65 @@
-from fastapi import WebSocket
+from asyncio import Queue
+from dataclasses import dataclass
+
+from fastapi import WebSocket, WebSocketDisconnect
 from loguru import logger

+from lnbits.settings import settings
+
+
+@dataclass
+class WebsocketConnection:
+    item_id: str
+    websocket: WebSocket
+    receive_queue: Queue[str]
+

 class WebsocketConnectionManager:
    def __init__(self) -> None:
-        self.active_connections: list[WebSocket] = []
+        self.active_connections: list[WebsocketConnection] = []

-    async def connect(self, websocket: WebSocket, item_id: str):
+    async def connect(self, item_id: str, websocket: WebSocket) -> WebsocketConnection:
        logger.debug(f"Websocket connected to {item_id}")
        await websocket.accept()
-        self.active_connections.append(websocket)
+        conn = WebsocketConnection(
+            item_id=item_id,
+            websocket=websocket,
+            receive_queue=Queue(),
+        )
+        self.active_connections.append(conn)
+        return conn

-    def disconnect(self, websocket: WebSocket):
-        self.active_connections.remove(websocket)
+    async def listen(self, conn: WebsocketConnection) -> None:
+        while settings.lnbits_running:
+            try:
+                data = await conn.websocket.receive_text()
+                logger.debug(f"WS received data from {conn.item_id}: {data}")
+                conn.receive_queue.put_nowait(data)
+            except WebSocketDisconnect:
+                for _conn in self.active_connections:
+                    if _conn.websocket == conn.websocket:
+                        self.active_connections.remove(_conn)
+                        logger.debug(f"WS disconnected from {conn.item_id}")
+                break  # out of the listen and the fastapi route

-    async def send_data(self, message: str, item_id: str):
-        for connection in self.active_connections:
-            if connection.path_params["item_id"] == item_id:
-                await connection.send_text(message)
+    def get_connections(self, item_id: str) -> list[WebsocketConnection]:
+        conns = []
+        for conn in self.active_connections:
+            if conn.item_id == item_id:
+                conns.append(conn)
+        return conns
+
+    def has_connection(self, item_id: str) -> bool:
+        return len(self.get_connections(item_id)) > 0
+
+    async def send(self, item_id: str, data: str) -> None:
+        for conn in self.get_connections(item_id):
+            await conn.websocket.send_text(data)


 websocket_manager = WebsocketConnectionManager()


-async def websocket_updater(item_id: str, data: str):
-    return await websocket_manager.send_data(data, item_id)
+# deprecated import and use `websocket_manager.send()` instead
+async def websocket_updater(item_id: str, data: str) -> None:
+    return await websocket_manager.send(item_id, data)
@@ -1,174 +1,114 @@
 import asyncio
-from typing import Dict
+import traceback
+from collections.abc import Callable, Coroutine

-import httpx
 from loguru import logger

 from lnbits.core.crud import (
    create_audit_entry,
    get_wallet,
-    get_webpush_subscriptions_for_user,
-    mark_webhook_sent,
 )
 from lnbits.core.crud.audit import delete_expired_audit_entries
-from lnbits.core.models import AuditEntry, Payment
-from lnbits.core.services import (
+from lnbits.core.crud.payments import get_payments_status_count
+from lnbits.core.crud.users import get_accounts
+from lnbits.core.crud.wallets import get_wallets_count
+from lnbits.core.models.audit import AuditEntry
+from lnbits.core.models.extensions import InstallableExtension
+from lnbits.core.models.notifications import NotificationType
+from lnbits.core.services.funding_source import (
+    check_balance_delta_changed,
+    check_server_balance_against_node,
    get_balance_delta,
-    send_payment_notification,
-    switch_to_voidwallet,
 )
-from lnbits.settings import get_funding_source, settings
-from lnbits.tasks import send_push_notification
+from lnbits.core.services.notifications import (
+    enqueue_admin_notification,
+    process_next_notification,
+    send_payment_notification,
+)
+from lnbits.db import Filters
+from lnbits.settings import settings
+from lnbits.tasks import create_unique_task
+from lnbits.utils.exchange_rates import btc_rates

-api_invoice_listeners: Dict[str, asyncio.Queue] = {}
-audit_queue: asyncio.Queue = asyncio.Queue()
+audit_queue: asyncio.Queue[AuditEntry] = asyncio.Queue()


-async def killswitch_task():
-    """
-    killswitch will check lnbits-status repository for a signal from
-    LNbits and will switch to VoidWallet if the killswitch is triggered.
-    """
+async def run_by_the_minute_tasks() -> None:
+    minute_counter = 0
    while settings.lnbits_running:
-        funding_source = get_funding_source()
-        if (
-            settings.lnbits_killswitch
-            and funding_source.__class__.__name__ != "VoidWallet"
-        ):
-            with httpx.Client() as client:
-                try:
-                    r = client.get(settings.lnbits_status_manifest, timeout=4)
-                    r.raise_for_status()
-                    if r.status_code == 200:
-                        ks = r.json().get("killswitch")
-                        if ks and ks == 1:
-                            logger.error(
-                                "Switching to VoidWallet. Killswitch triggered."
-                            )
-                            await switch_to_voidwallet()
-                except (httpx.RequestError, httpx.HTTPStatusError):
-                    logger.error(
-                        "Cannot fetch lnbits status manifest."
-                        f" {settings.lnbits_status_manifest}"
-                    )
-        await asyncio.sleep(settings.lnbits_killswitch_interval * 60)
+        status_minutes = settings.lnbits_notification_server_status_hours * 60

-
-async def watchdog_task():
-    """
-    Registers a watchdog which will check lnbits balance and nodebalance
-    and will switch to VoidWallet if the watchdog delta is reached.
-    """
-    while settings.lnbits_running:
-        funding_source = get_funding_source()
-        if (
-            settings.lnbits_watchdog
-            and funding_source.__class__.__name__ != "VoidWallet"
-        ):
+        if settings.notification_balance_delta_changed:
            try:
-                balance = await get_balance_delta()
-                delta = balance.delta_msats
-                logger.debug(f"Running watchdog task. current delta: {delta}")
-                if delta + settings.lnbits_watchdog_delta <= 0:
-                    logger.error(f"Switching to VoidWallet. current delta: {delta}")
-                    await switch_to_voidwallet()
-            except Exception as e:
-                logger.error("Error in watchdog task", e)
-        await asyncio.sleep(settings.lnbits_watchdog_interval * 60)
+                # runs by default every minute, the delta should not change that often
+                await check_balance_delta_changed()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % settings.lnbits_watchdog_interval_minutes == 0:
+            try:
+                await check_server_balance_against_node()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % status_minutes == 0:
+            try:
+                await _notify_server_status()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % 60 == 0:
+            try:
+                # initialize the list of all extensions
+                await InstallableExtension.get_installable_extensions()
+            except Exception as ex:
+                logger.error(ex)
+
+        minute_counter += 1
+        await asyncio.sleep(60)


-async def wait_for_paid_invoices(invoice_paid_queue: asyncio.Queue):
+async def _notify_server_status() -> None:
+    accounts = await get_accounts(filters=Filters(limit=0))
+    wallets_count = await get_wallets_count()
+    payments = await get_payments_status_count()
+
+    status = await get_balance_delta()
+    values = {
+        "up_time": settings.lnbits_server_up_time,
+        "accounts_count": accounts.total,
+        "wallets_count": wallets_count,
+        "in_payments_count": payments.incoming,
+        "out_payments_count": payments.outgoing,
+        "pending_payments_count": payments.pending,
+        "failed_payments_count": payments.failed,
+        "delta_sats": status.delta_sats,
+        "lnbits_balance_sats": status.lnbits_balance_sats,
+        "node_balance_sats": status.node_balance_sats,
+    }
+    enqueue_admin_notification(NotificationType.server_status, values)
+
+
+async def wait_for_paid_invoices(invoice_paid_queue: asyncio.Queue) -> None:
    """
    This worker dispatches events to all extensions and dispatches webhooks.
    """
    while settings.lnbits_running:
        payment = await invoice_paid_queue.get()
        logger.trace("received invoice paid event")
-        # dispatch api_invoice_listeners
-        await dispatch_api_invoice_listeners(payment)
        # payment notification
        wallet = await get_wallet(payment.wallet_id)
        if wallet:
            await send_payment_notification(wallet, payment)
-        # dispatch webhook
-        if payment.webhook and not payment.webhook_status:
-            await dispatch_webhook(payment)
-        # dispatch push notification
-        await send_payment_push_notification(payment)


-async def dispatch_api_invoice_listeners(payment: Payment):
-    """
-    Emits events to invoice listener subscribed from the API.
-    """
-    for chan_name, send_channel in api_invoice_listeners.items():
-        try:
-            logger.debug(f"api invoice listener: sending paid event to {chan_name}")
-            send_channel.put_nowait(payment)
-        except asyncio.QueueFull:
-            logger.error(
-                f"api invoice listener: QueueFull, removing {send_channel}:{chan_name}"
-            )
-            api_invoice_listeners.pop(chan_name)
-
-
-async def dispatch_webhook(payment: Payment):
-    """
-    Dispatches the webhook to the webhook url.
-    """
-    logger.debug("sending webhook", payment.webhook)
-
-    if not payment.webhook:
-        return await mark_webhook_sent(payment.payment_hash, -1)
-
-    headers = {"User-Agent": settings.user_agent}
-    async with httpx.AsyncClient(headers=headers) as client:
-        data = payment.dict()
-        try:
-            r = await client.post(payment.webhook, json=data, timeout=40)
-            r.raise_for_status()
-            await mark_webhook_sent(payment.payment_hash, r.status_code)
-        except httpx.HTTPStatusError as exc:
-            await mark_webhook_sent(payment.payment_hash, exc.response.status_code)
-            logger.warning(
-                f"webhook returned a bad status_code: {exc.response.status_code} "
-                f"while requesting {exc.request.url!r}."
-            )
-        except httpx.RequestError:
-            await mark_webhook_sent(payment.payment_hash, -1)
-            logger.warning(f"Could not send webhook to {payment.webhook}")
-
-
-async def send_payment_push_notification(payment: Payment):
-    wallet = await get_wallet(payment.wallet_id)
-
-    if wallet:
-        subscriptions = await get_webpush_subscriptions_for_user(wallet.user)
-
-        amount = int(payment.amount / 1000)
-
-        title = f"LNbits: {wallet.name}"
-        body = f"You just received {amount} sat{'s'[:amount^1]}!"
-
-        if payment.memo:
-            body += f"\r\n{payment.memo}"
-
-        for subscription in subscriptions:
-            # todo: review permissions when user-id-only not allowed
-            # todo: replace all this logic with websockets?
-            url = (
-                f"https://{subscription.host}/wallet?usr={wallet.user}&wal={wallet.id}"
-            )
-            await send_push_notification(subscription, title, body, url)
-
-
-async def wait_for_audit_data():
+async def wait_for_audit_data() -> None:
    """
    Waits for audit entries to be pushed to the queue.
    Then it inserts the entries into the DB.
    """
    while settings.lnbits_running:
-        data: AuditEntry = await audit_queue.get()
+        data = await audit_queue.get()
        try:
            await create_audit_entry(data)
        except Exception as ex:
@@ -176,7 +116,17 @@ async def wait_for_audit_data():
            await asyncio.sleep(3)


-async def purge_audit_data():
+async def wait_notification_messages() -> None:
+
+    while settings.lnbits_running:
+        try:
+            await process_next_notification()
+        except Exception as ex:
+            logger.warning("Payment notification error", ex)
+            await asyncio.sleep(3)
+
+
+async def purge_audit_data() -> None:
    """
    Remove audit entries which have passed their retention period.
    """
@@ -188,3 +138,38 @@ async def purge_audit_data():

        # clean every hour
        await asyncio.sleep(60 * 60)
+
+
+async def collect_exchange_rates_data() -> None:
+    """
+    Collect exchange rates data. Used for monitoring only.
+    """
+    while settings.lnbits_running:
+        currency = settings.lnbits_default_accounting_currency or "USD"
+        max_history_size = settings.lnbits_exchange_history_size
+        sleep_time = settings.lnbits_exchange_history_refresh_interval_seconds
+
+        if sleep_time > 0:
+            try:
+                rates = await btc_rates(currency)
+                if rates:
+                    rates_values = [r[1] for r in rates]
+                    lnbits_rate = sum(rates_values) / len(rates_values)
+                    rates.append(("LNbits", lnbits_rate))
+                settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
+            except Exception as ex:
+                logger.warning(ex)
+        else:
+            sleep_time = 60
+        await asyncio.sleep(sleep_time)
+
+
+def _create_unique_task(name: str, func: Callable):
+    async def _to_coro(func: Callable[[], Coroutine]) -> Coroutine:
+        return await func()
+
+    try:
+        create_unique_task(name, _to_coro(func))
+    except Exception as e:
+        logger.error(f"Error in {name} task", e)
+        logger.error(traceback.format_exc())
@@ -15,11 +15,8 @@
            />
          </q-item-section>
          <q-item-section>
-            <q-item-label>Enable audit</q-item-label>
-            <q-item-label caption
-              >Record HTTP requests according with the specified
-              filters</q-item-label
-            >
+            <q-item-label v-text="$t('enable_audit')"></q-item-label>
+            <q-item-label caption v-text="$t('audit_desc')"></q-item-label>
          </q-item-section>
        </q-item>
      </div>
@@ -48,14 +45,16 @@
            />
          </q-item-section>
          <q-item-section>
-            <q-item-label>Record Request Body</q-item-label>
-            <q-item-label caption
-              >Warning:
+            <q-item-label v-text="$t('audit_record_req')"></q-item-label>
+            <q-item-label caption>
+              <span v-text="$t('audit_record_warning')"></span>
+              <br />
              <ul>
-                <li>confidential data (like passwords) will be logged</li>
-                <li>the request body can have large size.</li>
+                <li><span v-text="$t('audit_record_req_warning_1')"></span></li>
+                <li><span v-text="$t('audit_record_req_warning_2')"></span></li>
              </ul>
-              Use it with caution.
+              <br />
+              <span v-text="$t('audit_record_use')"></span>
            </q-item-label>
          </q-item-section>
        </q-item>
@@ -72,8 +71,12 @@
            />
          </q-item-section>
          <q-item-section>
-            <q-item-label>Record IP Address</q-item-label>
-            <q-item-label caption>Save the client IP address.</q-item-label>
+            <q-item-label>
+              <span v-text="$t('audit_ip')"></span>
+            </q-item-label>
+            <q-item-label caption>
+              <span v-text="$t('audit_ip_desc')"></span>
+            </q-item-label>
          </q-item-section>
        </q-item>
      </div>
@@ -89,8 +92,12 @@
            />
          </q-item-section>
          <q-item-section>
-            <q-item-label>Record Path Parameters</q-item-label>
-            <q-item-label caption>Recommended. </q-item-label>
+            <q-item-label>
+              <span v-text="$t('audit_path_params')"></span>
+            </q-item-label>
+            <q-item-label caption>
+              <span v-text="$t('recommended')"></span>
+            </q-item-label>
          </q-item-section>
        </q-item>
      </div>
@@ -106,8 +113,12 @@
            />
          </q-item-section>
          <q-item-section>
-            <q-item-label>Record Query Parameters</q-item-label>
-            <q-item-label caption>Recommended.</q-item-label>
+            <q-item-label>
+              <span v-text="$t('audit_query_params')"></span>
+            </q-item-label>
+            <q-item-label caption>
+              <span v-text="$t('recommended')"></span>
+            </q-item-label>
          </q-item-section>
        </q-item>
      </div>
@@ -115,25 +126,26 @@
    <q-separator class="q-mb-xl q-mt-sm"></q-separator>
    <div class="row q-mb-lg">
      <div class="col-md-6 col-sm-12 q-pr-sm">
-        <p>Include HTTP Methods</p>
+        <p><span v-text="$t('audit_http_methods')"></span></p>
        <q-select
          filled
          v-model="formData.lnbits_audit_http_methods"
          multiple
-          hint="List of HTTP methods to be included. Empty lists means all."
-          label="HTTP Methods"
+          :hint="$t('audit_http_methods_hint')"
+          :label="$t('audit_http_methods_label')"
          :options="['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']"
        ></q-select>
      </div>
      <div class="col-md-6 col-sm-12 q-pr-sm">
-        <p>Include HTTP Response Codes</p>
+        <p><span v-text="$t('audit_resp_codes')"></span></p>
        <q-input
+          class="q-mb-md"
          filled
          v-model="formAddIncludeResponseCode"
          @keydown.enter="addIncludeResponseCode"
          type="text"
-          label="HTTP Response code (regex)"
-          hint="List of HTTP codes to be included (regex match). Empty lists means all. Eg: 4.*, 5.*"
+          :label="$t('audit_resp_codes_label')"
+          :hint="$t('audit_resp_codes_hint')"
        >
          <q-btn @click="addIncludeResponseCode" dense flat icon="add"></q-btn>
        </q-input>
@@ -154,14 +166,15 @@

    <div class="row">
      <div class="col-md-6 col-sm-12 q-pr-sm">
-        <p>Include Paths</p>
+        <p><span v-text="$t('audit_paths')"></span></p>
        <q-input
+          class="q-mb-md"
          filled
          v-model="formAddIncludePath"
          @keydown.enter="addIncludePath"
          type="text"
-          label="HTTP Path (regex)"
-          hint="List of paths to be included (regex match). Empty list means all."
+          :label="$t('audit_paths_label')"
+          :hint="$t('audit_paths_hint')"
        >
          <q-btn @click="addIncludePath" dense flat icon="add"></q-btn>
        </q-input>
@@ -180,14 +193,17 @@
        <br />
      </div>
      <div class="col-md-6 col-sm-12">
-        <p>Exclude Paths</p>
+        <p>
+          <span v-text="$t('audit_paths_exclude')"></span>
+        </p>
        <q-input
+          class="q-mb-md"
          filled
          v-model="formAddExcludePath"
          @keydown.enter="addExcludePath"
          type="text"
-          label="HTTP Path (regex)"
-          hint="List of paths to be excluded (regex match). Empty list means none."
+          :label="$t('audit_paths_exclude_label')"
+          :hint="$t('audit_paths_exclude_hint')"
        >
          <q-btn @click="addExcludePath" dense flat icon="add"></q-btn>
        </q-input>
@@ -0,0 +1,197 @@
+<q-tab-panel name="exchange_providers">
+  <h6 class="q-my-none q-mb-sm">
+    <span v-text="$t('exchange_providers')"></span>
+  </h6>
+
+  <div class="row">
+    <div class="col-md-8 col-sm-12">
+      <div class="q-pa-sm">
+        <canvas
+          style="
+            width: 100% !important;
+            height: auto !important;
+            min-height: 350px;
+            max-height: 50vh;
+          "
+          ref="exchangeRatesChart"
+        ></canvas>
+      </div>
+    </div>
+    <div class="col-md-4 col-sm-12">
+      <q-input
+        filled
+        v-model="formData.lnbits_exchange_history_refresh_interval_seconds"
+        type="number"
+        label="Refresh Interval (seconds)"
+        hint="How often should the exchange rates be fetched. Set to zero to disable."
+      >
+      </q-input>
+      <q-input
+        filled
+        v-model="formData.lnbits_exchange_history_size"
+        type="number"
+        label="History Size"
+        hint="How many data points should be kept in memory."
+      >
+      </q-input>
+      <ul>
+        <li>
+          <code>Refresh Interval</code> and <code> History Size </code>are for
+          historical purposes only.
+        </li>
+        <li>These two settings do not affect the live price computation.</li>
+        <li>
+          Chart currency:
+          <strong
+            ><span
+              v-text="formData.lnbits_default_accounting_currency || 'USD'"
+            ></span
+          ></strong>
+        </li>
+      </ul>
+    </div>
+  </div>
+
+  <div class="row q-mt-md">
+    <div class="col-6">
+      <q-btn
+        @click="addExchangeProvider()"
+        label="Add Exchange Provider"
+        color="primary"
+        class="q-mb-md"
+      >
+      </q-btn>
+    </div>
+    <div class="col-6">
+      <q-btn
+        @click="getDefaultSetting('lnbits_exchange_rate_providers')"
+        flat
+        :label="$t('reset_defaults')"
+        color="primary"
+        class="float-right"
+      >
+      </q-btn>
+    </div>
+  </div>
+
+  <q-table
+    row-key="name"
+    :rows="formData.lnbits_exchange_rate_providers"
+    :columns="exchangesTable.columns"
+    v-model:pagination="exchangesTable.pagination"
+  >
+    <template v-slot:header="props">
+      <q-tr :props="props">
+        <q-th auto-width></q-th>
+        <q-th v-for="col in props.cols" :key="col.name" :props="props">
+          <span v-text="col.label"></span>
+        </q-th>
+      </q-tr>
+    </template>
+    <template v-slot:body="props">
+      <q-tr :props="props">
+        <q-td>
+          <q-btn
+            @click="removeExchangeProvider(props.row)"
+            round
+            icon="delete"
+            size="sm"
+            color="negative"
+            class="q-ml-xs"
+          >
+          </q-btn>
+        </q-td>
+        <q-td>
+          <q-input
+            dense
+            filled
+            v-model="props.row.name"
+            @update:model-value="touchSettings()"
+            type="text"
+          >
+          </q-input>
+        </q-td>
+        <q-td full-width>
+          <q-input
+            dense
+            filled
+            v-model="props.row.api_url"
+            @update:model-value="touchSettings()"
+            type="text"
+          >
+          </q-input
+        ></q-td>
+        <q-td>
+          <q-input
+            dense
+            filled
+            v-model="props.row.path"
+            @update:model-value="touchSettings()"
+            type="text"
+          >
+          </q-input>
+        </q-td>
+        <q-td>
+          <q-select
+            filled
+            dense
+            v-model="props.row.exclude_to"
+            @update:model-value="touchSettings()"
+            multiple
+            :options="{{ currencies | safe }}"
+          ></q-select>
+        </q-td>
+        <q-td>
+          <q-btn
+            @click="showTickerConversionDialog(props.row)"
+            round
+            icon="add"
+            size="sm"
+            color="gray"
+            class="q-ml-xs"
+          >
+          </q-btn>
+          <q-chip
+            v-for="ticker, index in props.row.ticker_conversion"
+            :key="ticker"
+            removable
+            dense
+            filled
+            @remove="removeExchangeTickerConversion(props.row, ticker)"
+            color="primary"
+            text-color="white"
+            :label="ticker"
+            class="ellipsis"
+          >
+          </q-chip>
+        </q-td>
+      </q-tr>
+    </template>
+  </q-table>
+  <ul>
+    <li>
+      <code>API URL</code> and <code>JSON Path</code> fields can use the
+      <code>{to}</code> and <code>{TO}</code> placeholders for the code of the
+      currency
+    </li>
+    <li>
+      <code>{TO}</code> is the uppercase code and <code>{to}</code> is the
+      lowercase code
+    </li>
+  </ul>
+
+  <q-separator class="q-ma-md"></q-separator>
+  <div class="row">
+    <div class="col-md-4 col-sm-12">
+      <q-input
+        filled
+        v-model="formData.lnbits_exchange_rate_cache_seconds"
+        type="number"
+        label="Exchange rate cache (seconds)"
+        hint="For how many seconds should the exchange rate be cached."
+      >
+      </q-input>
+    </div>
+    <div class="col-md-8 col-sm-12"></div>
+  </div>
+</q-tab-panel>
@@ -1,17 +1,22 @@
 <q-tab-panel name="extensions">
  <q-card-section class="q-pa-none">
    <div>
-      <h6 class="q-my-none">Extensions</h6>
+      <h6 class="q-my-none">
+        <span v-text="$t('extensions')"></span>
+      </h6>
      <div class="row q-col-gutter-md">
-        <div class="col-12">
-          <p>Extension Sources</p>
+        <div class="col-12 q-mb-md">
+          <p>
+            <span v-text="$t('extension_sources')"></span>
+          </p>
          <q-input
+            class="q-mb-md"
            filled
            v-model="formAddExtensionsManifest"
            @keydown.enter="addExtensionsManifest"
            type="text"
-            label="Source URL (only use the official LNbits extension source, and sources you can trust)"
-            hint="Repositories from where the extensions can be downloaded"
+            :label="$t('ext_sources_label')"
+            :hint="$t('ext_sources_hint')"
          >
            <q-btn @click="addExtensionsManifest" dense flat icon="add"></q-btn>
          </q-input>
@@ -30,34 +35,44 @@
      </div>
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-6">
-          <p>Admin Extensions</p>
+          <p>
+            <span v-text="$t('admin_extensions')"></span>
+          </p>
          <q-select
            filled
            v-model="formData.lnbits_admin_extensions"
            multiple
-            hint="Extensions only user with admin privileges can use"
-            label="Admin extensions"
+            :label="$t('admin_extensions_label')"
+            :hint="$t('admin_extensions_hint')"
            :options="g.extensions"
          ></q-select>
        </div>

        <div class="col-12 col-md-6">
-          <p>User Default Extensions</p>
+          <p>
+            <span v-text="$t('user_default_extensions')"></span>
+          </p>
          <q-select
            filled
            v-model="formData.lnbits_user_default_extensions"
            multiple
-            hint="Extensions that will be enabled by default for the users."
-            label="User extensions"
+            :label="$t('user_default_extensions_label')"
+            :hint="$t('user_default_extensions_hint')"
            :options="g.extensions"
          ></q-select>
        </div>
        <div class="col-12 col-md-6">
-          <p>Miscellaneous</p>
+          <p>
+            <span v-text="$t('miscellaneous')"></span>
+          </p>
          <q-item tag="label" v-ripple>
            <q-item-section>
-              <q-item-label>Disable Extensions</q-item-label>
-              <q-item-label caption>Disables all extensions</q-item-label>
+              <q-item-label>
+                <span v-text="$t('misc_disable_extensions')"></span>
+              </q-item-label>
+              <q-item-label caption>
+                <span v-text="$t('misc_disable_extensions_label')"></span>
+              </q-item-label>
            </q-item-section>
            <q-item-section avatar>
              <q-toggle
@@ -71,10 +86,33 @@
          </q-item>
          <q-item tag="label" v-ripple>
            <q-item-section>
-              <q-item-label>Hide API</q-item-label>
-              <q-item-label caption
-                >Hides wallet api, extensions can choose to honor</q-item-label
-              >
+              <q-item-label>
+                <span v-text="$t('misc_disable_extensions_builder')"></span>
+              </q-item-label>
+              <q-item-label caption>
+                <span
+                  v-text="$t('misc_disable_extensions_builder_label')"
+                ></span>
+              </q-item-label>
+            </q-item-section>
+            <q-item-section avatar>
+              <q-toggle
+                size="md"
+                v-model="formData.lnbits_extensions_builder_activate_non_admins"
+                checked-icon="check"
+                color="green"
+                unchecked-icon="clear"
+              />
+            </q-item-section>
+          </q-item>
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label>
+                <span v-text="$t('misc_hide_api')"></span>
+              </q-item-label>
+              <q-item-label caption>
+                <span v-text="$t('misc_hide_api_label')"></span>
+              </q-item-label>
            </q-item-section>
            <q-item-section avatar>
              <q-toggle
@@ -88,6 +126,17 @@
          </q-item>
          <br />
        </div>
+        <div class="col-12 col-md-6">
+          <p>
+            <span v-text="$t('extension_builder_manifest_url')"></span>
+          </p>
+          <q-input
+            filled
+            v-model="formData.lnbits_extensions_builder_manifest_url"
+            :label="$t('extension_builder_manifest_url')"
+            :hint="$t('extension_builder_manifest_url_hint')"
+          ></q-input>
+        </div>
      </div>
    </div>
  </q-card-section>
@@ -0,0 +1,287 @@
+<q-tab-panel name="fiat_providers">
+  <h6 class="q-my-none q-mb-sm">
+    <span v-text="$t('fiat_providers')"></span>
+    <q-btn
+      round
+      flat
+      @click="hideInputsToggle()"
+      :icon="hideInputToggle ? 'visibility_off' : 'visibility'"
+    ></q-btn>
+  </h6>
+
+  <div class="row">
+    <div class="col">
+      <q-list bordered class="rounded-borders">
+        <q-expansion-item header-class="text-primary text-bold">
+          <template v-slot:header>
+            <q-item-section avatar>
+              <q-avatar>
+                <img
+                  :src="'{{ static_url_for('static', 'images/stripe_logo.ico') }}'"
+                />
+              </q-avatar>
+            </q-item-section>
+
+            <q-item-section> Stripe </q-item-section>
+
+            <q-item-section side>
+              <div class="row items-center">
+                <q-toggle
+                  size="md"
+                  :label="$t('enabled')"
+                  v-model="formData.stripe_enabled"
+                  color="green"
+                  unchecked-icon="clear"
+                />
+              </div>
+            </q-item-section>
+          </template>
+
+          <q-card class="q-pb-xl">
+            <q-expansion-item :label="$t('api')" default-opened>
+              <q-card-section class="q-pa-md">
+                <q-input
+                  filled
+                  type="text"
+                  v-model="formData.stripe_api_endpoint"
+                  :label="$t('endpoint')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  v-model="formData.stripe_api_secret_key"
+                  :label="$t('secret_key')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  type="text"
+                  v-model="formData.stripe_payment_success_url"
+                  :label="$t('callback_success_url')"
+                  :hint="$t('callback_success_url_hint')"
+                ></q-input>
+              </q-card-section>
+              <q-card-section class="q-pa-md">
+                <div class="row">
+                  <div class="col">
+                    <q-btn
+                      outline
+                      color="grey"
+                      class="float-right"
+                      :label="$t('check_connection')"
+                      @click="checkFiatProvider('stripe')"
+                    ></q-btn>
+                  </div>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+
+            <q-expansion-item :label="$t('webhook')" default-opened>
+              <q-card-section>
+                <span v-text="$t('webhook_stripe_description')"></span>
+              </q-card-section>
+              <q-card-section>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  type="text"
+                  disable
+                  v-model="formData.stripe_payment_webhook_url"
+                  :label="$t('webhook_url')"
+                  :hint="$t('webhook_url_hint')"
+                ></q-input>
+                <q-input
+                  filled
+                  class="q-mt-md"
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  v-model="formData.stripe_webhook_signing_secret"
+                  :label="$t('signing_secret')"
+                  :hint="$t('signing_secret_hint')"
+                ></q-input>
+              </q-card-section>
+              <q-card-section>
+                <span v-text="$t('webhook_events_list')"></span>
+                <ul>
+                  <li><code>checkout.session.async_payment_failed</code></li>
+                  <li><code>checkout.session.async_payment_succeeded</code></li>
+                  <li><code>checkout.session.completed</code></li>
+                  <li><code>checkout.session.expired</code></li>
+                </ul>
+              </q-card-section>
+            </q-expansion-item>
+            <q-expansion-item :label="$t('service_fee')">
+              <q-card-section>
+                <div class="row">
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.stripe_limits.service_fee_percent"
+                      @update:model-value="touchSettings()"
+                      :label="$t('service_fee_label')"
+                      :hint="$t('service_fee_hint')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.stripe_limits.service_max_fee_sats"
+                      @update:model-value="touchSettings()"
+                      :label="$t('service_fee_max')"
+                      :hint="$t('service_fee_max_hint')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="text"
+                      v-model="formData.stripe_limits.service_fee_wallet_id"
+                      @update:model-value="touchSettings()"
+                      :label="$t('fee_wallet_label')"
+                      :hint="$t('fee_wallet_hint')"
+                    ></q-input>
+                  </div>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+            <q-expansion-item :label="$t('amount_limits')">
+              <q-card-section>
+                <div class="row">
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.stripe_limits.service_min_amount_sats"
+                      @update:model-value="touchSettings()"
+                      :label="$t('min_incoming_payment_amount')"
+                      :hint="$t('min_incoming_payment_amount_desc')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      type="number"
+                      min="0"
+                      v-model="formData.stripe_limits.service_max_amount_sats"
+                      @update:model-value="touchSettings()"
+                      :label="$t('max_incoming_payment_amount')"
+                      :hint="$t('max_incoming_payment_amount_desc')"
+                    ></q-input>
+                  </div>
+                  <div class="col-md-4 col-sm-12">
+                    <q-input
+                      filled
+                      class="q-ma-sm"
+                      v-model="formData.stripe_limits.service_faucet_wallet_id"
+                      @update:model-value="touchSettings()"
+                      :label="$t('faucest_wallet_id')"
+                      :hint="$t('faucest_wallet_id_hint')"
+                    ></q-input>
+                  </div>
+                </div>
+                <q-item>
+                  <q-item-section>
+                    <q-item-label v-text="$t('faucest_wallet')"></q-item-label>
+                    <q-item-label caption>
+                      <ul>
+                        <li>
+                          <span
+                            v-text="$t('faucest_wallet_desc_1', {provider: 'stripe'})"
+                          ></span>
+                        </li>
+                        <li>
+                          <span
+                            v-text="$t('faucest_wallet_desc_2', {provider: 'stripe'})"
+                          ></span>
+                        </li>
+                        <li>
+                          <span v-text="$t('faucest_wallet_desc_3')"></span>
+                        </li>
+                        <li>
+                          <span
+                            v-text="$t('faucest_wallet_desc_4', {provider: 'stripe'})"
+                          ></span>
+                        </li>
+                        <li>
+                          <span v-text="$t('faucest_wallet_desc_5')"></span>
+                        </li>
+                      </ul>
+                      <br />
+                    </q-item-label>
+                  </q-item-section>
+                </q-item>
+              </q-card-section>
+            </q-expansion-item>
+            <q-expansion-item :label="$t('allowed_users')">
+              <q-card-section>
+                <q-input
+                  filled
+                  v-model="formAddStripeUser"
+                  @keydown.enter="addAllowedUser"
+                  type="text"
+                  :label="$t('allowed_users_label')"
+                  :hint="$t('allowed_users_hint_feature', {feature: 'Stripe'})"
+                >
+                  <q-btn
+                    @click="addStripeAllowedUser"
+                    dense
+                    flat
+                    icon="add"
+                  ></q-btn>
+                </q-input>
+                <div>
+                  <q-chip
+                    v-for="user in formData.stripe_limits.allowed_users"
+                    @update:model-value="touchSettings()"
+                    :key="user"
+                    removable
+                    @remove="removeStripeAllowedUser(user)"
+                    color="primary"
+                    text-color="white"
+                    :label="user"
+                    class="ellipsis"
+                  >
+                  </q-chip>
+                </div>
+              </q-card-section>
+            </q-expansion-item>
+          </q-card>
+        </q-expansion-item>
+
+        <q-separator />
+
+        <q-expansion-item header-class="text-primary text-bold">
+          <template v-slot:header>
+            <q-item-section avatar>
+              <q-avatar>
+                <img
+                  :src="'{{ static_url_for('static', 'images/square_logo.png') }}'"
+                />
+              </q-avatar>
+            </q-item-section>
+
+            <q-item-section> Square </q-item-section>
+
+            <q-item-section side>
+              <div class="row items-center">Disabled</div>
+            </q-item-section>
+          </template>
+
+          <q-card>
+            <q-card-section> Coming Soon </q-card-section>
+          </q-card>
+        </q-expansion-item>
+      </q-list>
+    </div>
+  </div>
+</q-tab-panel>
@@ -1,88 +1,104 @@
 <q-tab-panel name="funding">
  <q-card-section class="q-pa-none">
-    <h6 class="q-my-none">Wallets Management</h6>
+    <h6 class="q-my-none">
+      <span v-text="$t('wallets_management')"></span>
+    </h6>
    <br />
    <div>
      <div class="row">
        <div class="col">
-          <p>Funding Source Info</p>
+          <p>
+            <span v-text="$t('funding_source_info')"></span>
+          </p>
          <ul>
            <li
-              v-text="'Funding Source: '+ settings.lnbits_backend_wallet_class"
+              v-text="$t('funding_source', {wallet_class: settings.lnbits_backend_wallet_class})"
            ></li>
            <li
-              v-text="'Node Balance: ' + (auditData.node_balance_msats /
-              1000).toLocaleString() + ' sats'"
+              v-text="$t('node_balance', {balance: (auditData.node_balance_sats || 0).toLocaleString()})"
            ></li>
            <li
-              v-text="'LNbits Balance: ' + (auditData.lnbits_balance_msats /
-              1000).toLocaleString() + ' sats'"
+              v-text="$t('lnbits_balance', {balance: (auditData.lnbits_balance_sats || 0).toLocaleString()})"
            ></li>
            <li
-              v-text="'Reserve Percent: ' + (auditData.node_balance_msats /
-              auditData.lnbits_balance_msats * 100).toFixed(2) + ' %'"
+              v-text="$t('funding_reserve_percent', {
+                percent: auditData.lnbits_balance_sats > 0
+                  ? (auditData.node_balance_sats / auditData.lnbits_balance_sats * 100).toFixed(2)
+                  : 100
+              })"
            ></li>
          </ul>
          <br />
        </div>
        <div class="col">
          {% if LNBITS_NODE_UI_AVAILABLE %}
-          <p>Node Management</p>
+          <p><span v-text="$t('node_management')"></span></p>
          <q-toggle
-            label="Node UI"
+            :label="$t('toggle_node_ui')"
            v-model="formData.lnbits_node_ui"
          ></q-toggle>
          <q-toggle
            v-if="formData.lnbits_node_ui"
-            label="Public node UI"
+            :label="$t('toggle_public_node_ui')"
            v-model="formData.lnbits_public_node_ui"
          ></q-toggle>
          <br />
          <q-toggle
            v-if="formData.lnbits_node_ui"
-            label="Transactions Tab (Disable on large CLN nodes)"
+            :label="$t('toggle_transactions_node_ui')"
            v-model="formData.lnbits_node_ui_transactions"
          ></q-toggle>
          {% else %}
-          <p>Node Management not supported by active funding source</p>
+          <p><span v-text="$t('node_management_not_supported')"></span></p>
          {% endif %}
        </div>
      </div>
      <div class="row q-col-gutter-md">
-        <div class="col-12 col-md-4">
-          <p>Invoice Expiry</p>
+        <div class="col-12 col-md-3">
+          <p><span v-text="$t('fee_reserve')"></span></p>
+
+          <q-input
+            type="number"
+            filled
+            v-model="formData.lnbits_reserve_fee_min"
+            :label="$t('fee_reserve_msats')"
+          >
+          </q-input>
+        </div>
+        <div class="col-12 col-md-3">
+          <p><span v-text="$t('fee_reserve_percent')"></span></p>
+          <q-input
+            type="number"
+            filled
+            name="lnbits_reserve_fee_percent"
+            v-model="formData.lnbits_reserve_fee_percent"
+            :label="$t('reserve_fee_in_percent')"
+            step="0.1"
+          ></q-input>
+        </div>
+        <div class="col-12 col-md-3">
+          <p><span v-text="$t('invoice_expiry')"></span></p>
          <q-input
            filled
            v-model.number="formData.lightning_invoice_expiry"
            type="number"
-            label="Invoice expiry (seconds)"
+            :label="$t('invoice_expiry_label')"
            mask="#######"
          >
          </q-input>
        </div>
-        <div class="col-12 col-md-8">
-          <p>Fee reserve</p>
-          <div class="row q-col-gutter-md">
-            <div class="col-6">
-              <q-input
-                type="number"
-                filled
-                v-model="formData.lnbits_reserve_fee_min"
-                label="Reserve fee in msats"
-              >
-              </q-input>
-            </div>
-            <div class="col-6">
-              <q-input
-                type="number"
-                filled
-                name="lnbits_reserve_fee_percent"
-                v-model="formData.lnbits_reserve_fee_percent"
-                label="Reserve fee in percent"
-                step="0.1"
-              ></q-input>
-            </div>
-          </div>
+        <div class="col-12 col-md-3">
+          <p><span v-text="$t('payment_wait_time')"></span></p>
+          <q-input
+            type="number"
+            filled
+            name="lnbits_funding_source_pay_invoice_wait_seconds"
+            v-model="formData.lnbits_funding_source_pay_invoice_wait_seconds"
+            :label="$t('payment_wait_time')"
+            :hint="$t('payment_wait_time_desc')"
+            step="1"
+            min="0"
+          ></q-input>
        </div>
      </div>
      <div v-if="isSuperUser">
@@ -91,6 +107,90 @@
          :allowed-funding-sources="settings.lnbits_allowed_funding_sources"
        />
      </div>
+      <q-separator></q-separator>
+      <h6 class="q-mt-lg q-mb-sm">
+        <p v-text="$t('watchdog')"></p>
+      </h6>
+      <div class="row q-col-gutter-md">
+        <div class="col-12 col-md-6">
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label v-text="$t('enable_watchdog')"></q-item-label>
+              <q-item-label
+                caption
+                v-text="$t('enable_watchdog_desc')"
+              ></q-item-label>
+            </q-item-section>
+            <q-item-section avatar>
+              <q-toggle
+                size="md"
+                v-model="formData.lnbits_watchdog_switch_to_voidwallet"
+                checked-icon="check"
+                color="green"
+                unchecked-icon="clear"
+              />
+            </q-item-section>
+          </q-item>
+        </div>
+        <div class="col-12 col-md-6">
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label
+                v-text="$t('notification_watchdog_limit')"
+              ></q-item-label>
+              <q-item-label
+                caption
+                v-text="$t('notification_watchdog_limit_desc')"
+              ></q-item-label>
+            </q-item-section>
+            <q-item-section avatar>
+              <q-toggle
+                size="md"
+                v-model="formData.lnbits_notification_watchdog"
+                checked-icon="check"
+                color="green"
+                unchecked-icon="clear"
+              />
+            </q-item-section>
+          </q-item>
+        </div>
+        <div class="col-12 col-md-6">
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label v-text="$t('watchdog_interval')"></q-item-label>
+              <q-item-label
+                caption
+                v-text="$t('watchdog_interval_desc')"
+              ></q-item-label>
+            </q-item-section>
+            <q-item-section>
+              <q-input
+                filled
+                v-model="formData.lnbits_watchdog_interval_minutes"
+                type="number"
+              />
+            </q-item-section>
+          </q-item>
+        </div>
+        <div class="col-12 col-md-6">
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label v-text="$t('watchdog_delta')"></q-item-label>
+              <q-item-label
+                caption
+                v-text="$t('watchdog_delta_desc')"
+              ></q-item-label>
+            </q-item-section>
+            <q-item-section>
+              <q-input
+                filled
+                v-model="formData.lnbits_watchdog_delta"
+                type="number"
+              />
+            </q-item-section>
+          </q-item>
+        </div>
+      </div>
    </div>
  </q-card-section>
 </q-tab-panel>
@@ -0,0 +1,67 @@
+<q-tab-panel name="library">
+  <q-card-section class="q-pa-none">
+    <h6 class="q-my-none q-mb-sm">
+      <span v-text="$t('image_library')"></span>
+    </h6>
+    <q-btn
+      color="primary"
+      label="Add Image"
+      @click="$refs.imageInput.click()"
+      class="q-mb-md"
+    />
+    <input
+      type="file"
+      ref="imageInput"
+      accept="image/png, image/jpeg, image/gif"
+      style="display: none"
+      @change="onImageInput"
+    />
+  </q-card-section>
+  <div class="row q-col-gutter-sm q-pa-sm">
+    <div
+      v-for="image in library_images"
+      :key="image.filename"
+      class="col-6 col-sm-4 col-md-3 col-lg-2"
+      style="max-width: 200px"
+    >
+      <q-card class="q-mb-sm">
+        <q-img :src="image.url" style="height: 150px" />
+
+        <q-card-section
+          class="q-pt-md q-pb-md row items-center justify-between"
+        >
+          <small
+            ><div
+              class="text-caption ellipsis"
+              style="max-width: 100px"
+              :title="image.filename"
+              v-text="image.filename"
+            ></div
+          ></small>
+          <q-btn
+            dense
+            flat
+            size="sm"
+            icon="content_copy"
+            @click="copyText(image.url)"
+            :title="$t('copy')"
+            ><q-tooltip>Copy image link</q-tooltip></q-btn
+          >
+          <q-btn
+            dense
+            flat
+            size="sm"
+            icon="delete"
+            color="negative"
+            @click="deleteImage(image.filename)"
+            :title="$t('delete')"
+            ><q-tooltip>Delete image</q-tooltip></q-btn
+          >
+        </q-card-section>
+      </q-card>
+    </div>
+  </div>
+  <div v-if="library_images.length === 0" class="q-pa-xl">
+    <div class="text-subtitle2 text-grey">No images uploaded yet.</div>
+  </div>
+</q-tab-panel>
@@ -1,140 +1,505 @@
 <q-tab-panel name="notifications">
  <q-card-section class="q-pa-none">
-    <div>
-      <div class="row q-col-gutter-md">
-        <div class="col-12 col-md-6">
-          <q-item tag="label" v-ripple>
-            <q-item-section>
-              <q-item-label v-text="$t('enable_notifications')"></q-item-label>
-              <q-item-label
-                caption
-                v-text="$t('enable_notifications_desc')"
-              ></q-item-label>
-            </q-item-section>
-            <q-item-section avatar>
-              <q-toggle
-                size="md"
-                v-model="formData.lnbits_notifications"
-                checked-icon="check"
-                color="green"
-                unchecked-icon="clear"
-              />
-            </q-item-section>
-          </q-item>
-          <br />
-          <p
-            v-if="!formData.lnbits_notifications"
-            v-text="$t('notifications_disabled')"
-          ></p>
-          <div v-if="formData.lnbits_notifications">
-            {% include "admin/_tab_security_notifications.html" %}
-          </div>
-          <br />
-          <div>
-            <p v-text="$t('notification_source')"></p>
+    <h6 class="q-my-none q-mb-sm">
+      <span v-text="$t('notifications_configure')"></span>
+      <q-btn
+        round
+        flat
+        @click="hideInputsToggle()"
+        :icon="hideInputToggle ? 'visibility_off' : 'visibility'"
+      ></q-btn>
+    </h6>
+
+    <q-separator class="q-mt-md q-mb-sm"></q-separator>
+    <div class="row q-col-gutter-md">
+      <div class="col-sm-12 col-md-6">
+        <strong v-text="$t('notifications_nostr_config')"></strong>
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notifications_enable_nostr')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notifications_enable_nostr_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_nostr_notifications_enabled"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notifications_nostr_private_key')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notifications_nostr_private_key_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section>
+            <q-input
+              :type="hideInputToggle ? 'password' : 'text'"
+              filled
+              v-model="formData.lnbits_nostr_notifications_private_key"
+            />
+          </q-item-section>
+        </q-item>
+
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notifications_nostr_identifiers')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notifications_nostr_identifiers_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section>
            <q-input
              filled
-              v-model="formData.lnbits_status_manifest"
-              type="text"
-              :label="$t('notification_source_label')"
+              v-model="nostrNotificationIdentifier"
+              @keydown.enter="addNostrNotificationIdentifier"
+            >
+              <q-btn
+                @click="addNostrNotificationIdentifier()"
+                dense
+                flat
+                icon="add"
+              ></q-btn>
+            </q-input>
+            <div>
+              <q-chip
+                v-for="identifier in formData.lnbits_nostr_notifications_identifiers"
+                :key="identifier"
+                removable
+                @remove="removeNostrNotificationIdentifier(identifier)"
+                color="primary"
+                text-color="white"
+                ><span class="ellipsis" v-text="identifier"></span
+              ></q-chip>
+            </div>
+          </q-item-section>
+        </q-item>
+      </div>
+
+      <div class="col-sm-12 col-md-6">
+        <strong v-text="$t('notifications_telegram_config')"></strong>
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notifications_enable_telegram')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notifications_enable_telegram_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_telegram_notifications_enabled"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
            />
+          </q-item-section>
+        </q-item>
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notifications_telegram_access_token')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notifications_telegram_access_token_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section>
+            <q-input
+              :type="hideInputToggle ? 'password' : 'text'"
+              filled
+              v-model="formData.lnbits_telegram_notifications_access_token"
+            />
+          </q-item-section>
+        </q-item>
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label v-text="$t('notifications_chat_id')"></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notifications_chat_id_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section>
+            <q-input
+              filled
+              v-model="formData.lnbits_telegram_notifications_chat_id"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-sm-12">
+        <q-separator></q-separator>
+      </div>
+      <div class="col-12">
+        <strong v-text="$t('notifications_email_config')"></strong>
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notifications_enable_email')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notifications_enable_email_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_email_notifications_enabled"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+
+        <div v-if="formData.lnbits_email_notifications_enabled" class="row">
+          <div class="col">
+            <q-item tag="label" v-ripple>
+              <q-item-section>
+                <q-item-label
+                  v-text="$t('notifications_send_email')"
+                ></q-item-label>
+                <q-item-label
+                  caption
+                  v-text="$t('notifications_send_email_desc')"
+                ></q-item-label>
+              </q-item-section>
+              <q-item-section>
+                <q-input
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  filled
+                  v-model="formData.lnbits_email_notifications_email"
+                />
+              </q-item-section>
+            </q-item>
+            <q-item tag="label" v-ripple>
+              <q-item-section>
+                <q-item-label
+                  v-text="$t('notifications_send_email_username')"
+                ></q-item-label>
+                <q-item-label
+                  caption
+                  v-text="$t('notifications_send_email_username_desc')"
+                ></q-item-label>
+              </q-item-section>
+              <q-item-section>
+                <q-input
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  filled
+                  v-model="formData.lnbits_email_notifications_username"
+                />
+              </q-item-section>
+            </q-item>
+            <q-item tag="label" v-ripple>
+              <q-item-section>
+                <q-item-label
+                  v-text="$t('notifications_send_email_password')"
+                ></q-item-label>
+                <q-item-label
+                  caption
+                  v-text="$t('notifications_send_email_password_desc')"
+                ></q-item-label>
+              </q-item-section>
+              <q-item-section>
+                <q-input
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  filled
+                  v-model="formData.lnbits_email_notifications_password"
+                />
+              </q-item-section>
+            </q-item>
+            <q-item>
+              <q-btn
+                @click="sendTestEmail()"
+                :label="$t('notifications_send_test_email')"
+                color="primary"
+                class="q-mt-md"
+              ></q-btn>
+            </q-item>
+          </div>
+
+          <div class="col">
+            <q-item tag="label" v-ripple>
+              <q-item-section>
+                <q-item-label
+                  v-text="$t('notifications_send_to_emails')"
+                ></q-item-label>
+                <q-item-label
+                  caption
+                  v-text="$t('notifications_send_to_emails_desc')"
+                ></q-item-label>
+              </q-item-section>
+              <q-item-section>
+                <q-input
+                  filled
+                  v-model="emailNotificationAddress"
+                  @keydown.enter="addEmailNotificationAddress"
+                >
+                  <q-btn
+                    @click="addEmailNotificationAddress()"
+                    dense
+                    flat
+                    icon="add"
+                  ></q-btn>
+                </q-input>
+                <div>
+                  <q-chip
+                    v-for="to_email in formData.lnbits_email_notifications_to_emails"
+                    :key="to_email"
+                    removable
+                    @remove="removeEmailNotificationAddress(to_email)"
+                    color="primary"
+                    text-color="white"
+                    ><span class="ellipsis" v-text="to_email"></span
+                  ></q-chip>
+                </div>
+              </q-item-section>
+            </q-item>
+            <q-item tag="label" v-ripple>
+              <q-item-section>
+                <q-item-label
+                  v-text="$t('notifications_send_email_server_port')"
+                ></q-item-label>
+                <q-item-label
+                  caption
+                  v-text="$t('notifications_send_email_server_port_desc')"
+                ></q-item-label>
+              </q-item-section>
+              <q-item-section>
+                <q-input
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  filled
+                  v-model="formData.lnbits_email_notifications_port"
+                />
+              </q-item-section>
+            </q-item>
+            <q-item tag="label" v-ripple>
+              <q-item-section>
+                <q-item-label
+                  v-text="$t('notifications_send_email_server')"
+                ></q-item-label>
+                <q-item-label
+                  caption
+                  v-text="$t('notifications_send_email_server_desc')"
+                ></q-item-label>
+              </q-item-section>
+              <q-item-section>
+                <q-input
+                  :type="hideInputToggle ? 'password' : 'text'"
+                  filled
+                  v-model="formData.lnbits_email_notifications_server"
+                />
+              </q-item-section>
+            </q-item>
          </div>
-          <br />
-        </div>
-        <div class="col-12 col-md-6">
-          <p v-text="$t('killswitch')"></p>
-          <q-item tag="label" v-ripple>
-            <q-item-section>
-              <q-item-label v-text="$t('enable_killswitch')"></q-item-label>
-              <q-item-label
-                caption
-                v-text="$t('enable_killswitch_desc')"
-              ></q-item-label>
-            </q-item-section>
-            <q-item-section avatar>
-              <q-toggle
-                size="md"
-                v-model="formData.lnbits_killswitch"
-                checked-icon="check"
-                color="green"
-                unchecked-icon="clear"
-              />
-            </q-item-section>
-          </q-item>
-          <q-item tag="label" v-ripple>
-            <q-item-section>
-              <q-item-label v-text="$t('killswitch_interval')"></q-item-label>
-              <q-item-label
-                caption
-                v-text="$t('killswitch_interval_desc')"
-              ></q-item-label>
-            </q-item-section>
-            <q-item-section>
-              <q-input
-                filled
-                v-model="formData.lnbits_killswitch_interval"
-                type="number"
-              />
-            </q-item-section>
-          </q-item>
-          <br />
-          <p v-text="$t('watchdog')"></p>
-          <q-item disabled tag="label" v-ripple>
-            <q-tooltip><span v-text="$t('coming_soon')"></span></q-tooltip>
-            <q-item-section>
-              <q-item-label v-text="$t('enable_watchdog')"></q-item-label>
-              <q-item-label
-                caption
-                v-text="$t('enable_watchdog_desc')"
-              ></q-item-label>
-            </q-item-section>
-            <q-item-section avatar>
-              <q-toggle
-                size="md"
-                v-model="formData.lnbits_watchdog"
-                checked-icon="check"
-                color="green"
-                unchecked-icon="clear"
-              />
-            </q-item-section>
-          </q-item>
-          <q-item disabled tag="label" v-ripple>
-            <q-tooltip><span v-text="$t('coming_soon')"></span></q-tooltip>
-            <q-item-section>
-              <q-item-label v-text="$t('watchdog_interval')"></q-item-label>
-              <q-item-label
-                caption
-                v-text="$t('watchdog_interval_desc')"
-              ></q-item-label>
-            </q-item-section>
-            <q-item-section>
-              <q-input
-                filled
-                v-model="formData.lnbits_watchdog_interval"
-                type="number"
-              />
-            </q-item-section>
-          </q-item>
-          <q-item disabled tag="label" v-ripple>
-            <q-tooltip><span v-text="$t('coming_soon')"></span></q-tooltip>
-            <q-item-section>
-              <q-item-label v-text="$t('watchdog_delta')"></q-item-label>
-              <q-item-label
-                caption
-                v-text="$t('watchdog_delta_desc')"
-              ></q-item-label>
-            </q-item-section>
-            <q-item-section>
-              <q-input
-                filled
-                v-model="formData.lnbits_watchdog_delta"
-                type="number"
-              />
-            </q-item-section>
-          </q-item>
-          <br />
        </div>
      </div>
    </div>
+    <q-separator> </q-separator>
+    <h6 class="q-mb-sm">
+      <span v-text="$t('notifications')"></span>
+    </h6>
+    <div class="row q-col-gutter-md">
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_settings_update')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_settings_update_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_notification_settings_update"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_credit_debit')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_credit_debit_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_notification_credit_debit"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_server_start_stop')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_server_start_stop_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_notification_server_start_stop"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_balance_delta_changed')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_balance_delta_changed_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.notification_balance_delta_changed"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_watchdog_limit')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_watchdog_limit_desc')"
+            ></q-item-label>
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_notification_watchdog"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_server_status')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_server_status_desc')"
+            ></q-item-label>
+          </q-item-section>
+
+          <q-item-section avatar>
+            <q-input
+              class="flow-right"
+              type="number"
+              min="0"
+              filled
+              v-model="formData.lnbits_notification_server_status_hours"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_incoming_payment')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_incoming_payment_desc')"
+            ></q-item-label>
+          </q-item-section>
+
+          <q-item-section avatar>
+            <q-input
+              class="flow-right"
+              type="number"
+              min="0"
+              filled
+              v-model="formData.lnbits_notification_incoming_payment_amount_sats"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+      <div class="col-12">
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label
+              v-text="$t('notification_outgoing_payment')"
+            ></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('notification_outgoing_payment_desc')"
+            ></q-item-label>
+          </q-item-section>
+
+          <q-item-section avatar>
+            <q-input
+              class="flow-right"
+              type="number"
+              min="0"
+              filled
+              v-model="formData.lnbits_notification_outgoing_payment_amount_sats"
+            />
+          </q-item-section>
+        </q-item>
+      </div>
+    </div>
  </q-card-section>
 </q-tab-panel>
@@ -1,26 +1,28 @@
 <q-tab-panel name="security">
  <q-card-section class="q-pa-none">
-    <h6 class="q-my-none">Server Management</h6>
+    <h6 class="q-my-none"><span v-text="$t('server_management')"></span></h6>
    <div class="row">
      <div class="col-md-6">
-        <p>Base URL</p>
+        <p><span v-text="$t('base_url')"></span></p>
        <q-input
          filled
          v-model.number="formData.lnbits_baseurl"
-          label="Static/Base url for the server"
+          :label="$t('base_url_label')"
        ></q-input>
        <br />
      </div>
    </div>
-    <h6 class="q-my-none q-mb-sm">Authentication</h6>
+    <h6 class="q-my-none q-mb-sm">
+      <span v-text="$t('authentication')"></span>
+    </h6>
    <div class="row q-col-gutter-sm">
      <div class="col-12 col-sm-6">
        <q-input
          filled
          v-model="formData.auth_token_expire_minutes"
          type="number"
-          label="Token expire minutes"
-          hint="Time in minutes until the token expires"
+          :label="$t('auth_token_expiry_label')"
+          :hint="$t('auth_token_expiry_hint')"
        >
        </q-input>
      </div>
@@ -29,8 +31,8 @@
          filled
          v-model="formData.auth_allowed_methods"
          multiple
-          hint="Allowed authorization methods"
-          label="Select authorization methods"
+          :hint="$t('auth_allowed_methods_hint')"
+          :label="$t('auth_allowed_methods_label')"
          :options="formData.auth_all_methods"
        ></q-select>
      </div>
@@ -50,8 +52,8 @@
          v-model="nostrAcceptedUrl"
          @keydown.enter="addNostrUrl"
          type="text"
-          label="Nostr Request URL"
-          hint="Absolute URL that the clients will use to login."
+          :label="$t('auth_nostr_label')"
+          :hint="$t('auth_nostr_hint')"
        >
          <q-btn @click="addNostrUrl" dense flat icon="add"></q-btn>
        </q-input>
@@ -81,8 +83,8 @@
        <q-input
          filled
          v-model="formData.google_client_id"
-          label="Google Client ID"
-          hint="Make sure thant the authorized redirect URIs contain https://{domain}/api/v1/auth/google/token"
+          :label="$t('auth_google_ci_label')"
+          :hint="$t('auth_google_ci_hint')"
        >
        </q-input>
      </div>
@@ -91,7 +93,7 @@
          filled
          v-model="formData.google_client_secret"
          type="password"
-          label="Google Client Secret"
+          :label="$t('auth_google_cs_label')"
        >
        </q-input>
      </div>
@@ -108,8 +110,8 @@
        <q-input
          filled
          v-model="formData.github_client_id"
-          label="GitHub Client ID"
-          hint="Make sure thant the authorization callback URL is set to https://{domain}/api/v1/auth/github/token"
+          :label="$t('auth_gh_client_id_label')"
+          :hint="$t('auth_gh_client_id_hint')"
        >
        </q-input>
      </div>
@@ -118,7 +120,7 @@
          filled
          v-model="formData.github_client_secret"
          type="password"
-          label="GitHub Client Secret"
+          :label="$t('auth_gh_client_secret_label')"
        >
        </q-input>
      </div>
@@ -130,21 +132,21 @@
  >
    <strong class="q-my-none q-mb-sm">Keycloak Auth</strong>

-    <div class="row">
-      <div class="col-md-4 col-sm-12 q-pr-sm">
+    <div class="row q-col-gutter-sm q-col-gutter-y-md">
+      <div class="col-md-4 col-sm-12">
        <q-input
          filled
          v-model="formData.keycloak_discovery_url"
-          label="Keycloak Discovey URL"
+          :label="$t('auth_keycloak_label')"
        >
        </q-input>
      </div>
-      <div class="col-md-4 col-sm-12 q-pr-sm">
+      <div class="col-md-4 col-sm-12">
        <q-input
          filled
          v-model="formData.keycloak_client_id"
-          label="Keycloak Client ID"
-          hint="Make sure thant the authorization callback URL is set to https://{domain}/api/v1/auth/keycloak/token"
+          :label="$t('auth_keycloak_ci_label')"
+          :hint="$t('auth_keycloak_ci_hint')"
        >
        </q-input>
      </div>
@@ -153,7 +155,23 @@
          filled
          v-model="formData.keycloak_client_secret"
          type="password"
-          label="Keycloak Client Secret"
+          :label="$t('auth_keycloak_cs_label')"
+        >
+        </q-input>
+      </div>
+      <div class="col-md-4 col-sm-12">
+        <q-input
+          filled
+          v-model="formData.keycloak_client_custom_org"
+          :label="$t('auth_keycloak_custom_org_label')"
+        >
+        </q-input>
+      </div>
+      <div class="col-md-8 col-sm-12">
+        <q-input
+          filled
+          v-model="formData.keycloak_client_custom_icon"
+          :label="$t('auth_keycloak_custom_icon_label')"
        >
        </q-input>
      </div>
@@ -281,31 +299,37 @@
        </div>

        <div class="col-12 col-md-12">
-          <p v-text="$t('wallet_limiter')"></p>
+          <p v-text="$t('callback_url_rules')"></p>
          <div class="row q-col-gutter-md">
-            <div class="col-4">
+            <div class="col-12">
              <q-input
                filled
-                type="number"
-                v-model.number="formData.lnbits_wallet_limit_max_balance"
-                :label="$t('wallet_max_ballance')"
-              ></q-input>
-            </div>
-            <div class="col-4">
-              <q-input
-                filled
-                type="number"
-                v-model.number="formData.lnbits_wallet_limit_daily_max_withdraw"
-                :label="$t('wallet_limit_max_withdraw_per_day')"
-              ></q-input>
-            </div>
-            <div class="col-4">
-              <q-input
-                filled
-                type="number"
-                v-model.number="formData.lnbits_wallet_limit_secs_between_trans"
-                :label="$t('wallet_limit_secs_between_trans')"
-              ></q-input>
+                v-model="formCallbackUrlRule"
+                @keydown.enter="addCallbackUrlRule"
+                type="text"
+                :label="$t('enter_callback_url_rule')"
+                :hint="$t('callback_url_rule_hint')"
+              >
+                <q-btn
+                  @click="addCallbackUrlRule"
+                  dense
+                  flat
+                  icon="add"
+                ></q-btn>
+              </q-input>
+              <div>
+                <q-chip
+                  v-for="rule in formData.lnbits_callback_url_rules"
+                  :key="rule"
+                  removable
+                  @remove="removeCallbackUrlRule(rule)"
+                  color="primary"
+                  text-color="white"
+                  :label="rule"
+                  class="ellipsis"
+                ></q-chip>
+              </div>
+              <br />
            </div>
          </div>
        </div>
@@ -1,77 +0,0 @@
-<q-banner v-if="updateAvailable" class="bg-primary text-white">
-  <q-icon size="28px" name="update"></q-icon>
-
-  <span v-text="$t('update_available', {version: statusData.version})"></span>
-  <template v-slot:action>
-    <a
-      class="q-btn"
-      color="white"
-      target="_blank"
-      rel="noopener noreferrer"
-      href="https://github.com/lnbits/lnbits/releases"
-      v-text="$t('releases')"
-    ></a>
-  </template>
-</q-banner>
-<q-banner v-if="!updateAvailable" class="bg-green text-white">
-  <q-icon size="28px" name="checkmark"></q-icon>
-  <span v-text="$t('latest_update', {version: statusData.version})"></span>
-</q-banner>
-<q-card>
-  <q-card-section>
-    <q-table
-      dense
-      flat
-      :rows="statusData.notifications"
-      :columns="statusDataTable.columns"
-      :no-data-label="$t('no_notifications')"
-    >
-      <template v-slot:header="props">
-        <q-tr :props="props">
-          <q-th auto-width> </q-th>
-          <q-th
-            v-for="col in props.cols"
-            :key="col.name"
-            :props="props"
-            v-text="col.label"
-          ></q-th>
-        </q-tr>
-      </template>
-      <template v-slot:body="props">
-        <q-tr :props="props">
-          <q-td auto-width class="text-center">
-            <q-icon
-              v-if="props.row.type === 'update'"
-              size="18px"
-              name="update"
-              color="green"
-            ></q-icon>
-            <q-icon
-              v-if="props.row.type === 'warning'"
-              size="18px"
-              name="warning"
-              color="red"
-            ></q-icon>
-          </q-td>
-          <q-td
-            auto-width
-            key="date"
-            :props="props"
-            v-text="formatDate(props.row.date)"
-          >
-          </q-td>
-          <q-td key="message" :props="props"
-            ><span v-text="props.row.message"></span
-            ><a
-              v-if="props.row.link"
-              target="_blank"
-              rel="noopener noreferrer"
-              :href="props.row.link"
-              v-text="$t('more')"
-            ></a
-          ></q-td>
-        </q-tr>
-      </template>
-    </q-table>
-  </q-card-section>
-</q-card>
@@ -1,79 +1,144 @@
 <q-tab-panel name="server">
  <q-card-section class="q-pa-none">
    <div>
-      <h6 class="q-my-none">Currency Settings</h6>
+      <h6 class="q-my-none"><span v-text="$t('currency_settings')"></span></h6>
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-6">
-          <p>Allowed currencies</p>
+          <p><span v-text="$t('allowed_currencies')"></span></p>
          <q-select
            filled
            v-model="formData.lnbits_allowed_currencies"
            multiple
-            hint="Limit the number of available fiat currencies"
-            label="Allowed currencies"
+            :hint="$t('allowed_currencies_hint')"
+            :label="$t('allowed_currencies')"
            :options="{{ currencies | safe }}"
          ></q-select>
-          <br />
        </div>
        <div class="col-12 col-md-6">
-          <p>Default Accounting Currency</p>
+          <p><span v-text="$t('default_account_currency')"></span></p>
          <q-select
            filled
            v-model="formData.lnbits_default_accounting_currency"
            clearable
-            hint="Default currency for accounting"
-            label="Currency"
+            :hint="$t('default_account_currency_hint')"
+            :label="$t('currency')"
            :options="formData.lnbits_allowed_currencies?.length ? formData.lnbits_allowed_currencies : {{ currencies }}"
          ></q-select>
-          <br />
        </div>
      </div>

-      <br />
-      <h6 class="q-my-none">Service Fee</h6>
+      <q-separator class="q-mb-lg q-mt-sm"></q-separator>
+      <h6 class="q-my-none"><span v-text="$t('payments')"></span></h6>
+      <div class="row q-col-gutter-md">
+        <div class="col-12 col-md-3">
+          <p><span v-text="$t('max_outgoing_payment_amount')"></span></p>
+          <q-input
+            filled
+            type="number"
+            v-model.number="formData.lnbits_max_outgoing_payment_amount_sats"
+            :label="$t('max_outgoing_payment_amount')"
+            step="1"
+            min="0"
+            :hint="$t('max_outgoing_payment_amount_desc')"
+          ></q-input>
+        </div>
+
+        <div class="col-12 col-md-3">
+          <p><span v-text="$t('max_incoming_payment_amount')"></span></p>
+          <q-input
+            filled
+            type="number"
+            v-model.number="formData.lnbits_max_incoming_payment_amount_sats"
+            :label="$t('max_incoming_payment_amount')"
+            step="1"
+            min="0"
+            :hint="$t('max_incoming_payment_amount_desc')"
+          ></q-input>
+        </div>
+        <div class="col-12 col-md-6"></div>
+      </div>
+
+      <q-separator class="q-mb-lg q-mt-sm"></q-separator>
+      <h6 class="q-my-none"><span v-text="$t('wallet_limiter')"></span></h6>
+      <div class="row q-col-gutter-md">
+        <div class="col-12 col-md-3">
+          <q-input
+            filled
+            type="number"
+            v-model.number="formData.lnbits_wallet_limit_max_balance"
+            :label="$t('wallet_max_ballance')"
+          ></q-input>
+        </div>
+        <div class="col-12 col-md-3">
+          <q-input
+            filled
+            type="number"
+            v-model.number="formData.lnbits_wallet_limit_daily_max_withdraw"
+            :label="$t('wallet_limit_max_withdraw_per_day')"
+          ></q-input>
+        </div>
+        <div class="col-12 col-md-3">
+          <q-input
+            filled
+            type="number"
+            v-model.number="formData.lnbits_wallet_limit_secs_between_trans"
+            :label="$t('wallet_limit_secs_between_trans')"
+          ></q-input>
+        </div>
+        <div class="col-12 col-md-3">
+          <q-toggle
+            v-model="formData.lnbits_only_allow_incoming_payments"
+            :label="$t('only_incoming_payments_allowed')"
+            ><q-tooltip v-text="$t('disable_outgoing_payments')"></q-tooltip
+          ></q-toggle>
+        </div>
+      </div>
+
+      <q-separator class="q-mb-lg q-mt-sm"></q-separator>
+      <h6 class="q-my-none"><span v-text="$t('service_fee')"></span></h6>
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-6">
-          <p>Service Fee</p>
+          <p><span v-text="$t('service_fee')"></span></p>
          <q-input
            filled
            type="number"
            v-model.number="formData.lnbits_service_fee"
-            label="Service fee (%)"
+            :label="$t('service_fee_label')"
            step="0.1"
-            hint="Fee charged per tx (%)"
+            :hint="$t('service_fee_hint')"
          ></q-input>
          <br />
        </div>
        <div class="col-12 col-md-6">
-          <p>Service fee max</p>
+          <p><span v-text="$t('service_fee_max')"></span></p>
          <q-input
            filled
            type="number"
            v-model.number="formData.lnbits_service_fee_max"
-            label="Service fee max (sats)"
-            hint="Max service fee to charge in (sats)"
+            :label="$t('service_fee_max_label')"
+            :hint="$t('service_fee_max_hint')"
          ></q-input>
          <br />
        </div>
        <div class="col-12 col-md-6">
-          <p>Fee Wallet</p>
+          <p><span v-text="$t('fee_wallet')"></span></p>
          <q-input
            filled
            v-model="formData.lnbits_service_fee_wallet"
-            label="Fee wallet (wallet ID)"
-            hint="Wallet ID to send funds to"
+            :label="$t('fee_wallet_label')"
+            :hint="$t('fee_wallet_hint')"
          ></q-input>
          <br />
        </div>
        <div class="col-12 col-md-6">
-          <p>Disable Service Fee for Internal Payments</p>
+          <p><span v-text="$t('disable_fee_internal')"></span></p>
          <q-item tag="label" v-ripple>
            <q-item-section>
-              <q-item-label>Disable Fee</q-item-label>
-              <q-item-label caption
-                >Disable Service Fee for Internal Lightning
-                Payments</q-item-label
-              >
+              <q-item-label v-text="$t('disable_fee')"></q-item-label>
+              <q-item-label
+                caption
+                v-text="$t('disable_fee_internal_desc')"
+              ></q-item-label>
            </q-item-section>
            <q-item-section avatar>
              <q-toggle
@@ -1,90 +1,80 @@
 <q-tab-panel name="site_customisation">
  <q-card-section class="q-pa-none">
-    <h6 class="q-my-none">UI Management</h6>
+    <h6 class="q-my-none"><span v-text="$t('ui_management')"></span></h6>
    <br />
    <div>
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-5">
-          <p>Site Title</p>
+          <p><span v-text="$t('ui_site_title')"></span></p>
          <q-input
            filled
            type="text"
            v-model="formData.lnbits_site_title"
-            label="Site title"
+            :label="$t('ui_site_title') + $t('ui_changing_remove_lnbits_elements')"
          ></q-input>
          <br />
        </div>
        <div class="col-12 col-md-5">
-          <p>Site Tagline</p>
+          <p><span v-text="$t('ui_site_tagline')"></span></p>
          <q-input
            filled
            type="text"
            v-model="formData.lnbits_site_tagline"
-            label="Site tagline"
+            :label="$t('ui_site_tagline')"
          ></q-input>
          <br />
        </div>
        <div class="col-12 col-md-2 q-mt-xl">
          <q-toggle
-            tip="Remove homepage elements like 'runs on' etc"
+            :tip="$t('ui_toggle_elements_tip')"
            v-model="formData.lnbits_show_home_page_elements"
-            :label="formData.lnbits_show_home_page_elements ? 'Enable elements on homepage' : 'Disable elements on homepage'"
+            :label="formData.lnbits_show_home_page_elements ? $t('ui_elements_enable') : $t('ui_elements_disable')"
          ></q-toggle>
        </div>
      </div>

      <div>
-        <p>Site Description</p>
+        <p><span v-text="$t('ui_site_description')"></span></p>
        <q-input
          v-model="formData.lnbits_site_description"
          filled
          type="textarea"
-          hint="Use plain text, Markdown, or raw HTML"
+          :hint="$t('ui_site_description_hint')"
        />
      </div>
      <br />
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-4">
-          <p>Default Wallet Name</p>
+          <p><span v-text="$t('ui_default_wallet_name')"></span></p>
          <q-input
            filled
            type="text"
            v-model="formData.lnbits_default_wallet_name"
-            label="LNbits wallet"
+            :label="$t('lnbits_wallet')"
          ></q-input>
        </div>
        <div class="col-12 col-md-4">
-          <p>Denomination</p>
-          <q-input
-            filled
-            type="text"
-            v-model="formData.lnbits_denomination"
-            label="sats"
-            hint="The name for the FakeWallet token"
-          ></q-input>
-        </div>
-        <div class="col-12 col-md-4">
-          <p>QR code logo</p>
+          <p><span v-text="$t('ui_qr_code_logo')"></span></p>
          <q-input
            filled
            type="text"
            v-model="formData.lnbits_qr_logo"
            label="https://example.com/image.svg"
-            hint="URL to logo image in QR code"
+            :hint="$t('ui_qr_code_logo_hint')"
          ></q-input>
        </div>
      </div>
-      <div class="row q-col-gutter-md">
-        <div class="col-12 col-md-4">
-          <p>Custom Badge</p>
+      <div class="row q-col-gutter-md q-mt-md">
+        <div class="col-12 col-md-6">
+          <p><span v-text="$t('ui_custom_badge')"></span></p>
          <div class="row q-col-gutter-md">
            <div class="col-12 col-md-8">
              <q-input
                filled
                type="text"
                tip="Custom Badge"
-                v-model="formData.lnbits_custom_badge"
-                label="Custom Badge 'USE WITH CAUTION - LNbits wallet is still in BETA'"
+                v-model.trim="formData.lnbits_custom_badge"
+                :label="$t('ui_custom_badge_label')"
              ></q-input>
            </div>
            <div class="col-12 col-md-4">
@@ -92,67 +82,129 @@
                filled
                v-model="formData.lnbits_custom_badge_color"
                :options="colors"
-                label="Custom badge color"
+                :label="$t('ui_custom_badge_color_label')"
              ></q-select>
            </div>
          </div>
        </div>
+        <div class="col-12 col-md-6">
+          <p><span v-text="$t('ui_custom_image')"></span></p>
+          <q-input
+            filled
+            type="text"
+            tip="Custom Image"
+            v-model.trim="formData.lnbits_custom_image"
+            :label="$t('ui_custom_image_label')"
+            :hint="$t('ui_custom_image_hint')"
+          ></q-input>
+        </div>
      </div>
      <br />
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-6">
-          <p>Themes</p>
+          <p><span v-text="$t('themes')"></span></p>
          <q-select
            filled
            v-model="formData.lnbits_theme_options"
            multiple
-            hint="Choose themes available for users"
+            :hint="$t('themes_hint')"
            :options="lnbits_theme_options"
-            label="Themes"
+            :label="$t('themes')"
          ></q-select>
          <br />
        </div>
        <div class="col-12 col-md-6">
-          <p>Custom Logo</p>
+          <p><span v-text="$t('custom_logo')"></span></p>
          <q-input
            filled
            type="text"
            v-model="formData.lnbits_custom_logo"
            label="https://example.com/image.png"
-            hint="URL to logo image"
+            :hint="$t('custom_logo_hint')"
          ></q-input>
          <br />
        </div>
      </div>
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-6">
-          <p>Ad Space Title</p>
+          <p><span v-text="$t('ad_space_title')"></span></p>
          <q-input
            filled
            type="text"
            v-model="formData.lnbits_ad_space_title"
-            label="Supported by"
+            :label="$t('ad_space_title_label')"
          ></q-input>
          <br />
        </div>
        <div class="col-12 col-md-6">
-          <p>Advertisement Slots</p>
+          <p><span v-text="$t('ad_slots')"></span></p>
          <q-input
            class="q-mb-md"
            filled
            v-model="formData.lnbits_ad_space"
            type="text"
-            label="url;img_light_url;img_dark_url, url..."
-            hint="Ad url and image filepaths in CSV format, extensions can choose to honor"
-          >
+            :label="$t('ad_slots_label')"
+            :hint="$t('ad_slots_hint')"
+            ><q-tooltip>
+              format {url};{img-light};{img-dark},{url};{img-light};{img-dark}"
+            </q-tooltip>
          </q-input>
          <q-toggle
            v-model="formData.lnbits_ad_space_enabled"
-            :label="formData.lnbits_ad_space_enabled ? 'Ads enabled' : 'Ads disabled'"
+            :label="formData.lnbits_ad_space_enabled ? $t('ads_enabled') : $t('ads_disabled')"
          />
          <br />
        </div>
      </div>
+      <div class="row q-col-gutter-md q-my-md">
+        <div class="col-12" v-text="$t('ui_default_theme')"></div>
+        <div class="col-12 col-sm-6 col-lg-3">
+          <q-select
+            v-model="formData.lnbits_default_border"
+            :options="globalBorderOptions"
+            label="Border"
+            @update:model-value="applyGlobalBorder"
+          >
+          </q-select>
+        </div>
+        <div class="col-12 col-sm-6 col-lg-3">
+          <q-select
+            v-model="formData.lnbits_default_theme"
+            :options="lnbits_theme_options"
+            label="Theme"
+            @update:model-value="applyGlobalTheme"
+          >
+          </q-select>
+        </div>
+        <div class="col-12 col-sm-6 col-lg-3">
+          <q-select
+            v-model="formData.lnbits_default_reaction"
+            :options="reactionOptions"
+            label="Payment reaction"
+            @update:model-value="applyGlobalReaction"
+          >
+          </q-select>
+        </div>
+        <div class="col-12 col-sm-6 col-lg-3">
+          <q-input
+            type="text"
+            v-model="formData.lnbits_default_bgimage"
+            label="Background Image"
+            @update:model-value="applyGlobalBgimage"
+            hint="This must be a trusted source. It can change the content and it can log your IP address."
+          >
+          </q-input>
+        </div>
+        <div class="col-12 col-sm-6 col-lg-3">
+          <q-toggle
+            type="bool"
+            v-model="formData.lnbits_default_gradient"
+            color="primary"
+            label="Gradient Background"
+          >
+          </q-toggle>
+        </div>
+      </div>
    </div>
  </q-card-section>
 </q-tab-panel>
@@ -1,17 +1,19 @@
 <q-tab-panel name="users">
  <q-card-section class="q-pa-none">
-    <h6 class="q-my-none q-mb-sm">User Management</h6>
+    <h6 class="q-my-none q-mb-sm">
+      <span v-text="$t('user_management')"></span>
+    </h6>

    <div class="row">
      <div class="col-12 col-md-6 q-pr-sm">
-        <p>Admin Users</p>
+        <p><span v-text="$t('admin_users')"></span></p>
        <q-input
          filled
          v-model="formAddAdmin"
          @keydown.enter="addAdminUser"
          type="text"
-          label="User ID"
-          hint="Users with admin privileges"
+          :label="$t('admin_users_label')"
+          :hint="$t('admin_users_hint')"
        >
          <q-btn @click="addAdminUser" dense flat icon="add"></q-btn>
        </q-input>
@@ -31,14 +33,14 @@
        <br />
      </div>
      <div class="col-12 col-md-6">
-        <p>Allowed Users</p>
+        <p><span v-text="$t('allowed_users')"></span></p>
        <q-input
          filled
          v-model="formAddUser"
          @keydown.enter="addAllowedUser"
          type="text"
-          label="User ID"
-          hint="Only these users can use LNbits"
+          :label="$t('allowed_users_label')"
+          :hint="$t('allowed_users_hint')"
        >
          <q-btn @click="addAllowedUser" dense flat icon="add"></q-btn>
        </q-input>
@@ -58,10 +60,11 @@
        <br />
        <q-item tag="label" v-ripple>
          <q-item-section>
-            <q-item-label>Allow creation of new users</q-item-label>
-            <q-item-label caption
-              >Allow creation of new users on the index page</q-item-label
-            >
+            <q-item-label v-text="$t('allow_creation_user')"></q-item-label>
+            <q-item-label
+              caption
+              v-text="$t('allow_creation_user_desc')"
+            ></q-item-label>
          </q-item-section>
          <q-item-section avatar>
            <q-toggle
@@ -1,60 +1,75 @@
-{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
-%} {% block page %}
-<div class="row q-col-gutter-md justify-center">
-  <div class="col q-my-md">
-    <q-btn
-      :label="$t('save')"
-      color="primary"
-      @click="updateSettings"
-      :disabled="!checkChanges"
-    >
-      <q-tooltip v-if="checkChanges">
-        <span v-text="$t('save_tooltip')"></span>
-      </q-tooltip>
+{% if not ajax %} {% extends "base.html" %} {% endif %} {% from "macros.jinja"
+import window_vars with context %} {% block scripts %} {{ window_vars(user) }}
+{% endblock %} {% block page %}

-      <q-badge
-        v-if="checkChanges"
-        color="red"
-        rounded
-        floating
-        style="padding: 6px; border-radius: 6px"
-      />
-    </q-btn>
+<div class="row q-col-gutter-md q-mb-md">
+  <div class="col-12">
+    <q-card>
+      <div class="q-pa-sm">
+        <div class="row items-center justify-between q-gutter-xs">
+          <div class="col">
+            <q-btn
+              :label="$t('save')"
+              color="primary"
+              @click="updateSettings"
+              :disabled="!checkChanges"
+            >
+              <q-tooltip v-if="checkChanges">
+                <span v-text="$t('save_tooltip')"></span>
+              </q-tooltip>

-    <q-btn
-      v-if="isSuperUser"
-      :label="$t('restart')"
-      color="primary"
-      @click="restartServer"
-      class="q-ml-md"
-    >
-      <q-tooltip v-if="needsRestart">
-        <span v-text="$t('restart_tooltip')"></span>
-      </q-tooltip>
+              <q-badge
+                v-if="checkChanges"
+                color="red"
+                rounded
+                floating
+                style="padding: 6px; border-radius: 6px"
+              />
+            </q-btn>

-      <q-badge
-        v-if="needsRestart"
-        color="red"
-        rounded
-        floating
-        style="padding: 6px; border-radius: 6px"
-      />
-    </q-btn>
+            <q-btn
+              v-if="isSuperUser"
+              :label="$t('restart')"
+              color="primary"
+              @click="restartServer"
+              class="q-ml-md"
+            >
+              <q-tooltip v-if="needsRestart">
+                <span v-text="$t('restart_tooltip')"></span>
+              </q-tooltip>

-    <q-btn :label="$t('download_backup')" flat @click="downloadBackup"></q-btn>
+              <q-badge
+                v-if="needsRestart"
+                color="red"
+                rounded
+                floating
+                style="padding: 6px; border-radius: 6px"
+              />
+            </q-btn>

-    <q-btn
-      flat
-      v-if="isSuperUser"
-      :label="$t('reset_defaults')"
-      color="primary"
-      @click="deleteSettings"
-      class="float-right"
-    >
-      <q-tooltip>
-        <span v-text="$t('reset_defaults_tooltip')"></span>
-      </q-tooltip>
-    </q-btn>
+            <q-btn
+              :label="$t('download_backup')"
+              flat
+              @click="downloadBackup"
+            ></q-btn>
+
+            <q-btn
+              flat
+              v-if="isSuperUser"
+              :label="$t('reset_defaults')"
+              color="primary"
+              @click="deleteSettings"
+              class="float-right"
+            >
+              <q-tooltip>
+                <span v-text="$t('reset_defaults_tooltip')"></span>
+              </q-tooltip>
+            </q-btn>
+          </div>
+          <div></div>
+        </div>
+      </div>
+    </q-card>
  </div>
 </div>

@@ -63,7 +78,12 @@
    <q-card>
      <q-splitter>
        <template v-slot:before>
-          <q-tabs v-model="tab" vertical active-color="primary">
+          <q-tabs
+            @update:model-value="showExchangeProvidersTab"
+            v-model="tab"
+            vertical
+            active-color="primary"
+          >
            <q-tab
              name="funding"
              icon="account_balance_wallet"
@@ -80,23 +100,6 @@
              ><q-tooltip v-if="!$q.screen.gt.sm"
                ><span v-text="$t('security')"></span></q-tooltip
            ></q-tab>
-
-            <q-tab
-              name="users"
-              icon="group"
-              :label="$q.screen.gt.sm ? $t('users') : null"
-              @update="val => tab = val.name"
-              ><q-tooltip v-if="!$q.screen.gt.sm"
-                ><span v-text="$t('users')"></span></q-tooltip
-            ></q-tab>
-            <q-tab
-              name="extensions"
-              icon="extension"
-              :label="$q.screen.gt.sm ? $t('extensions') : null"
-              @update="val => tab = val.name"
-              ><q-tooltip v-if="!$q.screen.gt.sm"
-                ><span v-text="$t('extensions')"></span></q-tooltip
-            ></q-tab>
            <q-tab
              name="server"
              icon="price_change"
@@ -105,6 +108,38 @@
              ><q-tooltip v-if="!$q.screen.gt.sm"
                ><span v-text="$t('payments')"></span></q-tooltip
            ></q-tab>
+            <q-tab
+              name="exchange_providers"
+              icon="show_chart"
+              :label="$q.screen.gt.sm ? $t('exchanges') : null"
+              ><q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('exchanges')"></span></q-tooltip
+            ></q-tab>
+            <q-tab
+              name="fiat_providers"
+              icon="credit_score"
+              :label="$q.screen.gt.sm ? $t('fiat_providers') : null"
+              ><q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('fiat_providers')"></span></q-tooltip
+            ></q-tab>
+            <q-tab
+              name="users"
+              icon="group"
+              :label="$q.screen.gt.sm ? $t('users') : null"
+              @update="val => tab = val.name"
+              ><q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('users')"></span></q-tooltip
+            ></q-tab>
+
+            <q-tab
+              name="extensions"
+              icon="extension"
+              :label="$q.screen.gt.sm ? $t('extensions') : null"
+              @update="val => tab = val.name"
+              ><q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('extensions')"></span></q-tooltip
+            ></q-tab>
+
            <q-tab
              name="notifications"
              icon="notifications"
@@ -121,6 +156,14 @@
              ><q-tooltip v-if="!$q.screen.gt.sm"
                ><span v-text="$t('audit')"></span></q-tooltip
            ></q-tab>
+            <q-tab
+              name="library"
+              icon="image"
+              :label="$q.screen.gt.sm ? $t('library') : null"
+              @update="val => tab = val.name"
+              ><q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('library')"></span></q-tooltip
+            ></q-tab>
            <q-tab
              style="word-break: break-all"
              name="site_customisation"
@@ -135,21 +178,27 @@

        <template v-slot:after>
          <q-form name="settings_form" id="settings_form">
-            <q-tab-panels
-              v-model="tab"
-              animated
-              swipeable
-              vertical
-              transition-prev="jump-up"
-              transition-next="jump-up"
-            >
-              {% include "admin/_tab_funding.html" %} {% include
-              "admin/_tab_users.html" %} {% include "admin/_tab_server.html" %}
-              {% include "admin/_tab_extensions.html" %} {% include
-              "admin/_tab_notifications.html" %} {% include
-              "admin/_tab_security.html" %} {% include "admin/_tab_theme.html"
-              %}{% include "admin/_tab_audit.html"%}
-            </q-tab-panels>
+            <q-scroll-area style="height: 100vh">
+              <q-tab-panels
+                v-model="tab"
+                animated
+                swipeable
+                vertical
+                scroll
+                transition-prev="jump-up"
+                transition-next="jump-up"
+              >
+                {% include "admin/_tab_funding.html" %} {% include
+                "admin/_tab_users.html" %} {% include "admin/_tab_server.html"
+                %} {% include "admin/_tab_exchange_providers.html" %}{% include
+                "admin/_tab_fiat_providers.html" %} {% include
+                "admin/_tab_extensions.html" %} {% include
+                "admin/_tab_notifications.html" %} {% include
+                "admin/_tab_security.html" %} {% include "admin/_tab_theme.html"
+                %}{% include "admin/_tab_audit.html"%}{% include
+                "admin/_tab_library.html"%}
+              </q-tab-panels>
+            </q-scroll-area>
          </q-form>
        </template>
      </q-splitter>
@@ -157,6 +206,46 @@
  </div>
 </div>

-{% endblock %} {% block scripts %} {{ window_vars(user) }}
-<script src="{{ static_url_for('static', 'js/admin.js') }}"></script>
+<q-dialog v-model="exchangeData.showTickerConversion" position="top">
+  <q-card class="q-pa-md q-pt-md lnbits__dialog-card">
+    <div class="q-mb-md">
+      <strong v-text="$t('create_ticker_converter')"></strong>
+    </div>
+    <div class="row">
+      <div class="col-12 q-mb-md">
+        <q-select
+          filled
+          dense
+          v-model="exchangeData.convertFromTicker"
+          label="From Currency"
+          :options="{{ currencies | safe }}"
+        ></q-select>
+      </div>
+      <div class="col-12">
+        <q-input
+          v-model="exchangeData.convertToTicker"
+          dense
+          filled
+          label="New Ticker"
+          hint="This ticker will be used for the exchange API calls."
+        >
+        </q-input>
+      </div>
+    </div>
+    <div class="row q-mt-lg">
+      <q-btn
+        @click="addExchangeTickerConversion()"
+        label="Add Ticker Conversion"
+        color="primary"
+      ></q-btn>
+      <q-btn
+        v-close-popup
+        flat
+        color="grey"
+        class="q-ml-auto"
+        v-text="$t('close')"
+      ></q-btn>
+    </div>
+  </q-card>
+</q-dialog>
 {% endblock %}
@@ -1,36 +1,63 @@
-{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
-%} {% block page %}
+{% if not ajax %} {% extends "base.html" %} {% endif %}
+<!---->
+{% from "macros.jinja" import window_vars with context %}
+<!---->
+{% block scripts %} {{ window_vars(user) }} {% endblock %} {% block page %}
+<div class="row q-col-gutter-md q-mb-md">
+  <div class="col-12">
+    <q-card>
+      <div class="q-pa-sm q-pl-lg">
+        <div class="row items-center justify-between q-gutter-xs">
+          <div class="col">
+            <!-- Optional: Add content here if needed -->
+          </div>
+          <div>
+            <q-btn
+              v-if="g.user.admin"
+              flat
+              round
+              icon="settings"
+              to="/admin#audit"
+            >
+              <q-tooltip v-text="$t('admin_settings')"></q-tooltip>
+            </q-btn>
+          </div>
+        </div>
+      </div>
+    </q-card>
+  </div>
+</div>

-<div class="row q-col-gutter-md justify-center q-mb-xl">
+<div class="row q-col-gutter-md justify-center q-mb-lg">
  <div class="col-lg-3 col-md-6 col-sm-12 text-center">
    <q-card class="q-pt-sm">
-      <strong>Components</strong>
+      <strong v-text="$t('components')"></strong>
      <div style="width: 250px" class="q-pa-sm">
-        <canvas ref="componentUseChart"></canvas>
+        <canvas v-if="chartsReady" ref="componentUseChart"></canvas>
      </div>
    </q-card>
  </div>
  <div class="col-lg-3 col-md-6 col-sm-12 text-center">
    <q-card class="q-pt-sm">
-      <strong>To 5 Long Running Endpoints</strong>
+      <strong v-text="$t('long_running_endpoints')"></strong>
      <div style="width: 250px; height: 250px" class="q-pa-sm">
-        <canvas ref="longDurationChart"></canvas>
+        <canvas v-if="chartsReady" ref="longDurationChart"></canvas>
      </div>
    </q-card>
  </div>
  <div class="col-lg-3 col-md-6 col-sm-12 text-center">
    <q-card class="q-pt-sm">
-      <strong>HTTP Request Methods</strong>
+      <strong v-text="$t('http_request_methods')"></strong>
      <div style="width: 250px; height: 250px" class="q-pa-sm">
-        <canvas ref="requestMethodChart"></canvas>
+        <canvas v-if="chartsReady" ref="requestMethodChart"></canvas>
      </div>
    </q-card>
  </div>
  <div class="col-lg-3 col-md-6 col-sm-12 text-center">
    <q-card class="q-pt-sm">
-      <strong>HTTP Response Codes</strong>
+      <strong v-text="$t('http_response_codes')"></strong>
      <div style="width: 250px; height: 250px" class="q-pa-sm">
-        <canvas ref="responseCodeChart"></canvas>
+        <canvas v-if="chartsReady" ref="responseCodeChart"></canvas>
      </div>
    </q-card>
  </div>
@@ -70,6 +97,7 @@
                  />
                </template>
              </q-input>
+
              <q-select
                v-else-if="['component', 'response_code','request_method'].includes(col.name)"
                v-model="searchData[col.name]"
@@ -96,7 +124,9 @@
                  class="cursor-pointer q-mr-xs"
                  @click="showDetailsDialog(props.row)"
                >
-                  <q-tooltip>Request Details</q-tooltip>
+                  <q-tooltip
+                    ><span v-text="$t('request_details')"></span
+                  ></q-tooltip>
                </q-btn>

                <span v-text="formatDate(props.row.created_at)"></span>
@@ -140,7 +170,7 @@

 <q-dialog v-model="auditDetailsDialog.show" position="top">
  <q-card class="q-pa-md q-pt-md lnbits__dialog-card">
-    <strong>HTTP Request Details</strong>
+    <strong v-text="$t('http_request_details')"></strong>
    <q-input
      filled
      dense
@@ -168,6 +198,4 @@
  </q-card>
 </q-dialog>

-{% endblock %} {% block scripts %} {{ window_vars(user) }}
-<script src="{{ static_url_for('static', 'js/audit.js') }}"></script>
 {% endblock %}
@@ -48,6 +48,16 @@
              class="cursor-pointer q-ml-sm"
              @click="copyText(wallet.adminkey)"
            ></q-icon>
+            <q-icon name="qr_code" class="cursor-pointer q-ml-sm">
+              <q-popup-proxy>
+                <div class="q-pa-md">
+                  <lnbits-qrcode
+                    :value="wallet.adminkey"
+                    :show-buttons="false"
+                  ></lnbits-qrcode>
+                </div>
+              </q-popup-proxy>
+            </q-icon>
          </div>
        </q-item-section>
      </q-item>
@@ -70,6 +80,16 @@
              class="cursor-pointer q-ml-sm"
              @click="copyText(wallet.inkey)"
            ></q-icon>
+            <q-icon name="qr_code" class="cursor-pointer q-ml-sm">
+              <q-popup-proxy>
+                <div class="q-pa-md">
+                  <lnbits-qrcode
+                    :value="wallet.inkey"
+                    :show-buttons="false"
+                  ></lnbits-qrcode>
+                </div>
+              </q-popup-proxy>
+            </q-icon>
          </div>
        </q-item-section>
      </q-item>
@@ -85,7 +105,12 @@
      <q-card-section>
        <code><span class="text-light-green">GET</span> /api/v1/wallet</code>
        <h5 class="text-caption q-mt-sm q-mb-none">Headers</h5>
-        <code>{"X-Api-Key": "<i v-text="wallet.inkey"></i>"}</code><br />
+        <code
+          >{"X-Api-Key": "<i
+            v-text="inkeyHidden ? '****************' : wallet.inkey"
+          ></i
+          >"}</code
+        ><br />
        <h5 class="text-caption q-mt-sm q-mb-none">
          Returns 200 OK (application/json)
        </h5>
@@ -96,7 +121,8 @@
        <h5 class="text-caption q-mt-sm q-mb-none">Curl example</h5>
        <code
          >curl <span v-text="baseUrl"></span>api/v1/wallet -H "X-Api-Key:
-          <i v-text="wallet.inkey"></i>"</code
+          <i v-text="inkeyHidden ? '****************' : wallet.inkey"></i
+          >"</code
        >
      </q-card-section>
    </q-card>
@@ -112,7 +138,12 @@
      <q-card-section>
        <code><span class="text-light-green">POST</span> /api/v1/payments</code>
        <h5 class="text-caption q-mt-sm q-mb-none">Headers</h5>
-        <code>{"X-Api-Key": "<i v-text="wallet.inkey"></i>"}</code><br />
+        <code
+          >{"X-Api-Key": "<i
+            v-text="inkeyHidden ? '****************' : wallet.inkey"
+          ></i
+          >"}</code
+        ><br />
        <h5 class="text-caption q-mt-sm q-mb-none">Body (application/json)</h5>
        <code
          >{"out": false, "amount": &lt;int&gt;, "memo": &lt;string&gt;,
@@ -130,8 +161,9 @@
        <code
          >curl -X POST <span v-text="baseUrl"></span>api/v1/payments -d
          '{"out": false, "amount": &lt;int&gt;, "memo": &lt;string&gt;}' -H
-          "X-Api-Key: <i v-text="wallet.inkey"></i>" -H "Content-type:
-          application/json"</code
+          "X-Api-Key:
+          <i v-text="inkeyHidden ? '****************' : wallet.inkey"></i>" -H
+          "Content-type: application/json"</code
        >
      </q-card-section>
    </q-card>
@@ -218,7 +250,12 @@
          /api/v1/payments/&lt;payment_hash&gt;</code
        >
        <h5 class="text-caption q-mt-sm q-mb-none">Headers</h5>
-        <code>{"X-Api-Key": "{{ wallet.inkey }}"}</code>
+        <code
+          >{"X-Api-Key": "<i
+            v-text="inkeyHidden ? '****************' : wallet.inkey"
+          ></i
+          >"}</code
+        >
        <h5 class="text-caption q-mt-sm q-mb-none">
          Returns 200 OK (application/json)
        </h5>
@@ -227,10 +264,42 @@
        <code
          >curl -X GET
          <span v-text="baseUrl"></span>api/v1/payments/&lt;payment_hash&gt; -H
-          "X-Api-Key: <i v-text="wallet.inkey"></i>" -H "Content-type:
-          application/json"</code
+          "X-Api-Key:
+          <i v-text="inkeyHidden ? '****************' : wallet.inkey"></i>" -H
+          "Content-type: application/json"</code
        >
      </q-card-section>
    </q-card>
+    <q-card>
+      <q-card-section>
+        <code
+          ><span class="text-pink">WS</span>
+          /api/v1/ws/&lt;invoice_key&gt;</code
+        >
+        <h5
+          class="text-caption q-mt-sm q-mb-none"
+          v-text="$t('websocket_example')"
+        ></h5>
+        <code
+          >wscat -c <span v-text="websocketUrl"></span>/<span
+            v-text="inkeyHidden ? '****************' : wallet.inkey"
+          ></span
+        ></code>
+        <h5 class="text-caption q-mt-sm q-mb-none">
+          Returns 200 OK (application/json)/payments
+        </h5>
+        <code>{"balance": &lt;int&gt;, "payment": &lt;object&gt;}</code>
+      </q-card-section>
+    </q-card>
  </q-expansion-item>
+  <q-separator></q-separator>
+  <q-card-section>
+    <p v-text="$t('reset_wallet_keys_desc')"></p>
+    <q-btn
+      unelevated
+      color="red-10"
+      @click="resetKeys()"
+      :label="$t('reset_wallet_keys')"
+    ></q-btn>
+  </q-card-section>
 </q-expansion-item>
@@ -1,39 +1,84 @@
-{% extends "base.html" %}
+{% if not ajax %} {% extends "base.html" %} {% endif %}
 <!---->
 {% from "macros.jinja" import window_vars with context %}
 <!---->
-{% block scripts %} {{ window_vars(user) }}
-<script src="{{ static_url_for('static', 'js/account.js') }}"></script>
-{% endblock %} {% block page %}
+{% block scripts %} {{ window_vars(user) }}{% endblock %} {% block page %}

-<div class="row q-col-gutter-md">
-  <div v-if="user" class="col-12 col-md-6 q-gutter-y-md">
+<div class="row q-col-gutter-md q-mb-md">
+  <div class="col-12">
    <q-card>
-      <q-card-section>
-        <div class="row">
+      <div class="q-pa-sm">
+        <div class="row items-center justify-between q-gutter-xs">
          <div class="col">
-            <q-tabs v-model="tab" align="justify">
-              <q-tab
-                name="user"
-                :label="$t('account_settings')"
-                @update="val => tab = val.name"
-              ></q-tab>
-              <q-tab
-                name="theme"
-                :label="$t('look_and_feel')"
-                @update="val => tab = val.name"
-              ></q-tab>
-            </q-tabs>
-            <q-tab-panels v-model="tab">
+            <q-btn @click="updateAccount" unelevated color="primary">
+              <span v-text="$t('update_account')"></span>
+            </q-btn>
+          </div>
+        </div>
+      </div>
+    </q-card>
+  </div>
+</div>
+
+<div class="row q-col-gutter-md q-mb-md">
+  <div class="col-12">
+    <q-card>
+      <q-splitter>
+        <template v-slot:before>
+          <q-tabs v-model="tab" vertical active-color="primary">
+            <q-tab
+              name="user"
+              icon="person"
+              :label="$q.screen.gt.sm ? $t('account_settings') : ''"
+              @update="val => tab = val.name"
+            >
+              <q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('account_settings')"></span
+              ></q-tooltip>
+            </q-tab>
+
+            <q-tab
+              name="notifications"
+              icon="notifications"
+              :label="$q.screen.gt.sm ? $t('notifications') : ''"
+              @update="val => tab = val.name"
+            >
+              <q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('notifications')"></span
+              ></q-tooltip>
+            </q-tab>
+            <q-tab
+              name="theme"
+              icon="palette"
+              :label="$q.screen.gt.sm ? $t('look_and_feel') : ''"
+              @update="val => tab = val.name"
+            >
+              <q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('look_and_feel')"></span
+              ></q-tooltip>
+            </q-tab>
+            <q-tab
+              name="api_acls"
+              icon="lock"
+              :label="$q.screen.gt.sm ? $t('access_control_list') : ''"
+              @update="val => tab = val.name"
+            >
+              <q-tooltip v-if="!$q.screen.gt.sm"
+                ><span v-text="$t('access_control_list')"></span
+              ></q-tooltip>
+            </q-tab>
+          </q-tabs>
+        </template>
+        <template v-slot:after>
+          <q-scroll-area style="height: 80vh">
+            <q-tab-panels v-if="user" v-model="tab">
              <q-tab-panel name="user">
                <div v-if="credentialsData.show">
-                  <q-separator></q-separator>
-
                  <q-card-section>
                    <div class="row">
                      <div class="col">
                        <h4 class="q-my-none">
-                          <span v-text="$t('password_config')"></span>
+                          <span v-text="$t('password')"></span>
                        </h4>
                      </div>
                      <div class="col">
@@ -90,7 +135,7 @@
                      unelevated
                      color="primary"
                      class="float-right"
-                      :label="$t('change_password')"
+                      :label="$t('update_password')"
                    >
                    </q-btn>
                  </q-card-section>
@@ -98,7 +143,7 @@
                  <q-card-section>
                    <div class="col q-mb-sm">
                      <h4 class="q-my-none">
-                        <span v-text="$t('pubkey')"></span>
+                        Nostr <span v-text="$t('pubkey')"></span>
                      </h4>
                    </div>
                    <q-input
@@ -129,11 +174,10 @@
                  </q-card-section>
                </div>
                <div v-else>
-                  <q-card-section>
+                  <q-card-section v-if="user.extra.picture">
                    <div class="row">
                      <div class="col">
                        <q-img
-                          v-if="user.extra.picture"
                          style="max-width: 100px"
                          :src="user.extra.picture"
                          class="float-right"
@@ -141,7 +185,6 @@
                      </div>
                    </div>
                  </q-card-section>
-                  <q-separator></q-separator>

                  <q-card-section>
                    <q-input
@@ -262,22 +305,30 @@
                      class="q-mb-md"
                    >
                    </q-input>
+                    <q-input
+                      v-model="user.external_id"
+                      :label="$t('external_id')"
+                      filled
+                      dense
+                      readonly
+                      class="q-mb-md"
+                    >
+                    </q-input>
+
                    <q-input
                      v-model="user.extra.picture"
                      :label="$t('picture')"
                      filled
+                      dense
                      class="q-mb-md"
                    >
                    </q-input>
                  </q-card-section>
                  <q-separator></q-separator>
                  <q-card-section>
-                    <q-btn @click="updateAccount" unelevated color="primary">
-                      <span v-text="$t('update_account')"></span>
-                    </q-btn>
                    <q-btn
                      @click="showUpdateCredentials()"
-                      :label="$t('update_credentials')"
+                      :label="$t('change_password')"
                      filled
                      color="primary"
                      class="float-right"
@@ -286,6 +337,15 @@
                </div>
              </q-tab-panel>
              <q-tab-panel name="theme">
+                <q-btn
+                  v-if="g.user.admin"
+                  class="absolute-top-right"
+                  flat
+                  round
+                  icon="settings"
+                  to="/admin#site_customisation"
+                  ><q-tooltip v-text="$t('admin_settings')"></q-tooltip
+                ></q-btn>
                <div class="row q-mb-md">
                  <div class="col-4"><span v-text="$t('language')"></span></div>
                  <div class="col-8">
@@ -316,95 +376,111 @@
                    </q-btn-dropdown>
                  </div>
                </div>
+                <div class="row q-mb-md">
+                  <div class="col-4">
+                    <span v-text="$t('visible_wallet_count')"></span>
+                  </div>
+                  <div class="col-8">
+                    <q-input
+                      v-model="user.extra.visible_wallet_count"
+                      :label="$t('visible_wallet_count')"
+                      filled
+                      dense
+                      type="number"
+                      class="q-mb-md"
+                    ></q-input>
+                  </div>
+                </div>
+
                <div class="row q-mb-md">
                  <div class="col-4">
                    <span v-text="$t('color_scheme')"></span>
                  </div>
                  <div class="col-8">
                    <q-btn
-                      v-if="g.allowedThemes.includes('classic')"
+                      v-if="allowedThemes.includes('classic')"
                      dense
                      flat
-                      @click="changeColor('classic')"
+                      @click="changeTheme('classic')"
                      icon="circle"
                      color="deep-purple"
                      size="md"
                      ><q-tooltip>classic</q-tooltip>
                    </q-btn>
                    <q-btn
-                      v-if="g.allowedThemes.includes('bitcoin')"
+                      v-if="allowedThemes.includes('bitcoin')"
                      dense
                      flat
-                      @click="changeColor('bitcoin')"
+                      @click="changeTheme('bitcoin')"
                      icon="circle"
-                      color="orange"
+                      color="deep-orange"
                      size="md"
                      ><q-tooltip>bitcoin</q-tooltip>
                    </q-btn>
                    <q-btn
-                      v-if="g.allowedThemes.includes('mint')"
+                      v-if="allowedThemes.includes('mint')"
                      dense
                      flat
-                      @click="changeColor('mint')"
+                      @click="changeTheme('mint')"
                      icon="circle"
                      color="green"
                      size="md"
                      ><q-tooltip>mint</q-tooltip> </q-btn
                    ><q-btn
-                      v-if="g.allowedThemes.includes('autumn')"
+                      v-if="allowedThemes.includes('autumn')"
                      dense
                      flat
-                      @click="changeColor('autumn')"
+                      @click="changeTheme('autumn')"
                      icon="circle"
                      color="brown"
                      size="md"
                      ><q-tooltip>autumn</q-tooltip>
                    </q-btn>
                    <q-btn
-                      v-if="g.allowedThemes.includes('monochrome')"
+                      v-if="allowedThemes.includes('monochrome')"
                      dense
                      flat
-                      @click="changeColor('monochrome')"
+                      @click="changeTheme('monochrome')"
                      icon="circle"
                      color="grey"
                      size="md"
                      ><q-tooltip>monochrome</q-tooltip>
                    </q-btn>
                    <q-btn
-                      v-if="g.allowedThemes.includes('salvador')"
+                      v-if="allowedThemes.includes('salvador')"
                      dense
                      flat
-                      @click="changeColor('salvador')"
+                      @click="changeTheme('salvador')"
                      icon="circle"
                      color="blue-10"
                      size="md"
                      ><q-tooltip>elSalvador</q-tooltip>
                    </q-btn>
                    <q-btn
-                      v-if="g.allowedThemes.includes('freedom')"
+                      v-if="allowedThemes.includes('freedom')"
                      dense
                      flat
-                      @click="changeColor('freedom')"
+                      @click="changeTheme('freedom')"
                      icon="circle"
                      color="pink-13"
                      size="md"
                      ><q-tooltip>freedom</q-tooltip>
                    </q-btn>
                    <q-btn
-                      v-if="g.allowedThemes.includes('cyber')"
+                      v-if="allowedThemes.includes('cyber')"
                      dense
                      flat
-                      @click="changeColor('cyber')"
+                      @click="changeTheme('cyber')"
                      icon="circle"
                      color="light-green-9"
                      size="md"
                      ><q-tooltip>cyber</q-tooltip>
                    </q-btn>
                    <q-btn
-                      v-if="g.allowedThemes.includes('flamingo')"
+                      v-if="allowedThemes.includes('flamingo')"
                      dense
                      flat
-                      @click="changeColor('flamingo')"
+                      @click="changeTheme('flamingo')"
                      icon="circle"
                      color="pink-3"
                      size="md"
@@ -412,24 +488,39 @@
                    </q-btn>
                  </div>
                </div>
+                <div class="row q-mb-md">
+                  <div class="col-4">
+                    <span v-text="$t('background_image')"></span>
+                  </div>
+                  <div class="col-8">
+                    <q-input
+                      v-model="bgimageChoice"
+                      :label="$t('background_image')"
+                      @update:model-value="applyBackgroundImage"
+                    >
+                      <q-tooltip
+                        ><span v-text="$t('background_image')"></span
+                      ></q-tooltip>
+                    </q-input>
+                  </div>
+                </div>
                <div class="row q-mb-md">
                  <div class="col-4">
                    <span v-text="$t('gradient_background')"></span>
                  </div>
                  <div class="col-8">
-                    <q-btn
+                    <q-toggle
                      dense
                      flat
                      round
-                      @click="toggleGradient"
                      icon="gradient"
-                      size="sm"
                      v-model="gradientChoice"
+                      @update:model-value="applyGradient"
                    >
                      <q-tooltip
                        ><span v-text="$t('toggle_gradient')"></span
                      ></q-tooltip>
-                    </q-btn>
+                    </q-toggle>
                  </div>
                </div>

@@ -438,10 +529,11 @@
                    <span v-text="$t('toggle_darkmode')"></span>
                  </div>
                  <div class="col-8">
-                    <q-btn
+                    <q-toggle
                      dense
                      flat
                      round
+                      v-model="darkChoice"
                      @click="toggleDarkMode"
                      :icon="($q.dark.isActive) ? 'brightness_3' : 'wb_sunny'"
                      size="sm"
@@ -449,7 +541,7 @@
                      <q-tooltip
                        ><span v-text="$t('toggle_darkmode')"></span
                      ></q-tooltip>
-                    </q-btn>
+                    </q-toggle>
                  </div>
                </div>
                <div class="row q-mb-md">
@@ -460,7 +552,7 @@
                    <q-select
                      v-model="borderChoice"
                      :options="borderOptions"
-                      label="Reactions"
+                      label="Borders"
                      @update:model-value="applyBorder"
                    >
                      <q-tooltip
@@ -470,7 +562,9 @@
                  </div>
                </div>
                <div class="row q-mb-md">
-                  <div class="col-4">Notifications</div>
+                  <div class="col-4">
+                    <span v-text="$t('notifications')"></span>
+                  </div>
                  <div class="col-8">
                    <lnbits-notifications-btn
                      v-if="g.user"
@@ -496,18 +590,452 @@
                  </div>
                </div>
              </q-tab-panel>
+              <q-tab-panel name="notifications">
+                <q-card-section>
+                  <div class="row q-mb-md">
+                    <div class="col-4">
+                      <span
+                        v-text="$t('notifications_nostr_identifier')"
+                      ></span>
+                      {%if not nostr_configured%}
+                      <br />
+                      <q-badge v-text="$t('not_connected')"></q-badge>
+                      {%endif%}
+                    </div>
+                    <div class="col-8">
+                      <q-input
+                        filled
+                        dense
+                        v-model="user.extra.notifications.nostr_identifier"
+                        :hint="$t('notifications_nostr_identifier_desc')"
+                      >
+                      </q-input>
+                    </div>
+                  </div>
+
+                  <div class="row q-mb-md">
+                    <div class="col-4">
+                      <span v-text="$t('notifications_chat_id')"></span>
+                      {%if not telegram_configured%}
+                      <br />
+                      <q-badge v-text="$t('not_connected')"></q-badge>
+                      {%endif%}
+                    </div>
+                    <div class="col-8">
+                      <q-input
+                        filled
+                        dense
+                        v-model="user.extra.notifications.telegram_chat_id"
+                        :hint="$t('notifications_chat_id_desc')"
+                      />
+                    </div>
+                  </div>
+                  <q-separator class="q-mb-md"></q-separator>
+                  <div class="row q-mb-md">
+                    <div class="col-4">
+                      <span v-text="$t('notification_outgoing_payment')"></span>
+                    </div>
+                    <div class="col-8">
+                      <q-input
+                        filled
+                        dense
+                        type="number"
+                        min="0"
+                        step="1"
+                        v-model="user.extra.notifications.outgoing_payments_sats"
+                        :hint="$t('notification_outgoing_payment_desc')"
+                      />
+                    </div>
+                  </div>
+                  <div class="row q-mb-md">
+                    <div class="col-4">
+                      <span v-text="$t('notification_incoming_payment')"></span>
+                    </div>
+                    <div class="col-8">
+                      <q-input
+                        filled
+                        dense
+                        type="number"
+                        min="0"
+                        step="1"
+                        v-model="user.extra.notifications.incoming_payments_sats"
+                        :hint="$t('notification_incoming_payment_desc')"
+                      />
+                    </div>
+                  </div>
+                  <div class="row q-mb-md">
+                    <div class="col-4">
+                      <span v-text="$t('exclude_wallets')"></span>
+                    </div>
+                    <div class="col-8">
+                      <q-select
+                        filled
+                        dense
+                        emit-value
+                        map-options
+                        multiple
+                        v-model="user.extra.notifications.excluded_wallets"
+                        :options="g.user.walletOptions"
+                        :label="$t('exclude_wallets')"
+                        :hint="$t('notifications_excluded_wallets_desc')"
+                        class="q-mt-sm"
+                      >
+                      </q-select>
+                    </div>
+                  </div>
+                </q-card-section>
+              </q-tab-panel>
+              <q-tab-panel name="api_acls">
+                <div class="row q-mb-md">
+                  <q-badge v-if="user.admin">
+                    <span
+                      v-text="$t('access_control_list_admin_warning')"
+                    ></span>
+                  </q-badge>
+                </div>
+
+                <q-card-section>
+                  <div class="row q-mb-md q-gutter-y-md">
+                    <div class="col-sm-12 col-md-6">
+                      <q-select
+                        v-model="selectedApiAcl.id"
+                        emit-value
+                        map-options
+                        @update:model-value="handleApiACLSelected"
+                        :options="apiAcl.data.map(t => ({label: t.name, value: t.id}))"
+                        :label="$t('access_control_list')"
+                        dense
+                      >
+                      </q-select>
+                    </div>
+                    <div class="col-sm-12 col-md-6">
+                      <q-btn
+                        @click="askPasswordAndRunFunction('newApiAclDialog')"
+                        filled
+                        outline
+                        icon="add"
+                        :label="$t('access_control_list')"
+                        color="grey"
+                        class="float-right"
+                      ></q-btn>
+                    </div>
+                  </div>
+                  <div v-if="selectedApiAcl.id">
+                    <div class="row q-mb-md">
+                      <div class="col-sm-12 col-md-6">
+                        <q-select
+                          :options="selectedApiAcl.token_id_list.map(t => ({label: t.name, value: t.id}))"
+                          v-model="apiAcl.selectedTokenId"
+                          emit-value
+                          map-options
+                          :label="$t('api_tokens')"
+                          dense
+                        >
+                        </q-select>
+                      </div>
+
+                      <div class="col-sm-12 col-md-6 q-pl-sm">
+                        <q-btn
+                          v-if="apiAcl.selectedTokenId"
+                          @click="askPasswordAndRunFunction('deleteToken')"
+                          icon="delete"
+                          filled
+                          color="negative"
+                          class="float-left"
+                        ></q-btn>
+                        <q-btn
+                          @click="askPasswordAndRunFunction('newTokenAclDialog')"
+                          outline
+                          icon="add"
+                          :label="$t('api_token')"
+                          filled
+                          color="grey"
+                          class="float-right"
+                        ></q-btn>
+                      </div>
+                    </div>
+                    <div v-if="apiAcl.apiToken" class="row q-mb-md">
+                      <div class="col-12">
+                        <q-badge>
+                          <span>Use this token in the HTTP</span>
+                          <strong>
+                            &nbsp;<code>Authorization</code>
+                            &nbsp;
+                          </strong>
+                          <span> header.</span>
+                        </q-badge>
+                      </div>
+                      <div class="col-12">
+                        <table
+                          class="full-width lnbits__table-bordered"
+                          style="
+                            border-collapse: collapse;
+                            background-color: grey;
+                          "
+                        >
+                          <thead>
+                            <tr>
+                              <th>
+                                <span class="float-left">Header Name</span>
+                              </th>
+                              <th>
+                                <span class="float-left">Header Value</span>
+                              </th>
+                            </tr>
+                          </thead>
+                          <tbody>
+                            <tr>
+                              <td>
+                                <strong>Authorization</strong>
+                              </td>
+                              <td>
+                                <div class="row q-pt-sm">
+                                  <div class="col-2 q-mt-sm">
+                                    <strong>Bearer &nbsp;</strong>
+                                  </div>
+                                  <div class="col-10">
+                                    <q-input
+                                      v-model="apiAcl.apiToken"
+                                      :label="$t('api_token_id')"
+                                      filled
+                                      dense
+                                      readonly
+                                      :type="selectedApiAcl.showId ? 'text': 'password'"
+                                      class="q-mb-md"
+                                    >
+                                      <q-btn
+                                        @click="selectedApiAcl.showId = !selectedApiAcl.showId"
+                                        dense
+                                        flat
+                                        :icon="selectedApiAcl.showId ? 'visibility_off' : 'visibility'"
+                                        color="black"
+                                      ></q-btn>
+
+                                      <q-btn
+                                        @click="copyText(apiAcl.apiToken)"
+                                        icon="content_copy"
+                                        color="black"
+                                        flat
+                                        dense
+                                      ></q-btn>
+                                    </q-input>
+                                  </div>
+                                </div>
+                              </td>
+                            </tr>
+                          </tbody>
+                        </table>
+                      </div>
+                      <div class="col-12">
+                        <q-badge>
+                          <span
+                            >Please store this token. It cannot be later
+                            retrieved, only revoked.</span
+                          >
+                        </q-badge>
+                      </div>
+                    </div>
+
+                    <q-table
+                      row-key="path"
+                      :rows="selectedApiAcl.endpoints"
+                      :columns="apiAcl.columns"
+                      v-model:pagination="apiAcl.pagination"
+                    >
+                      <template v-slot:header="props">
+                        <q-tr :props="props">
+                          <q-th
+                            v-for="col in props.cols"
+                            :key="col.name"
+                            :props="props"
+                          >
+                            <q-toggle
+                              v-if="col.name == 'read'"
+                              v-model="selectedApiAcl.allRead"
+                              @update:model-value="handleAllEndpointsReadAccess()"
+                              :label="$t('read')"
+                              size="sm"
+                            ></q-toggle>
+                            <q-toggle
+                              v-else-if="col.name == 'write'"
+                              v-model="selectedApiAcl.allWrite"
+                              @update:model-value="handleAllEndpointsWriteAccess()"
+                              :label="$t('write')"
+                              size="sm"
+                            ></q-toggle>
+                            <span v-else v-text="col.label"></span>
+                          </q-th>
+                        </q-tr>
+                      </template>
+                      <template v-slot:body="props">
+                        <q-tr :props="props">
+                          <q-td>
+                            <span v-text="props.row.name"></span>
+                          </q-td>
+                          <q-td>
+                            <span v-text="props.row.path"></span>
+                          </q-td>
+                          <q-td>
+                            <q-toggle size="sm" v-model="props.row.read" />
+                          </q-td>
+                          <q-td>
+                            <q-toggle size="sm" v-model="props.row.write" />
+                          </q-td>
+                        </q-tr>
+                      </template>
+                    </q-table>
+                    <q-separator></q-separator>
+                  </div>
+
+                  <div v-if="selectedApiAcl.id" class="row q-mt-md">
+                    <div class="col-sm-12 col-md-6">
+                      <q-btn
+                        @click="askPasswordAndRunFunction('updateApiACLs')"
+                        :label="$t('update')"
+                        filled
+                        color="primary"
+                      ></q-btn>
+                    </div>
+                    <div class="col-sm-12 col-md-6">
+                      <q-btn
+                        @click="askPasswordAndRunFunction('deleteApiACL')"
+                        :label="$t('delete')"
+                        icon="delete"
+                        color="negative"
+                        class="float-right"
+                      >
+                      </q-btn>
+                    </div>
+                  </div>
+                </q-card-section>
+              </q-tab-panel>
            </q-tab-panels>
-          </div>
-        </div>
-      </q-card-section>
-    </q-card>
-  </div>
-  <div v-else class="col-12 col-md-6 q-gutter-y-md">
-    <q-card>
-      <q-card-section>
-        <h4 class="q-my-none"><span v-text="$t('account')"></span></h4>
-      </q-card-section>
+          </q-scroll-area>
+        </template>
+      </q-splitter>
    </q-card>
  </div>
 </div>
+
+<q-dialog v-model="apiAcl.showPasswordDialog" position="top">
+  <q-card class="q-pa-md q-pt-md lnbits__dialog-card">
+    <strong>User Password</strong>
+    <div class="row q-mt-md q-col-gutter-md">
+      <div class="col-12">
+        <q-input
+          v-model="apiAcl.password"
+          type="password"
+          dense
+          filled
+          label="Password"
+          hint="User password is required for this action."
+        >
+        </q-input>
+      </div>
+    </div>
+    <div class="row q-mt-lg">
+      <q-btn
+        @click="runPasswordGuardedFunction()"
+        :label="$t('ok')"
+        color="primary"
+      ></q-btn>
+      <q-btn
+        v-close-popup
+        flat
+        color="grey"
+        class="q-ml-auto"
+        v-text="$t('cancel')"
+      ></q-btn>
+    </div>
+  </q-card>
+</q-dialog>
+
+<q-dialog v-model="apiAcl.showNewAclDialog" position="top">
+  <q-card class="q-pa-md q-pt-md lnbits__dialog-card">
+    <strong>New API Access Control List</strong>
+    <div class="row q-mt-md q-col-gutter-md">
+      <div class="col-12">
+        <q-input v-model="apiAcl.newAclName" dense filled label="ACL Name">
+        </q-input>
+      </div>
+    </div>
+    <div class="row q-mt-lg">
+      <q-btn @click="addApiACL()" label="Create" color="primary"></q-btn>
+      <q-btn
+        v-close-popup
+        flat
+        color="grey"
+        class="q-ml-auto"
+        v-text="$t('close')"
+      ></q-btn>
+    </div>
+  </q-card>
+</q-dialog>
+<q-dialog v-model="apiAcl.showNewTokenDialog" position="top">
+  <q-card class="q-pa-md q-pt-md lnbits__dialog-card">
+    <strong>New API Token</strong>
+    <div class="row q-col-gutter-md q-mt-md">
+      <div class="col-12">
+        <q-input v-model="apiAcl.newTokenName" dense filled label="Token Name">
+        </q-input>
+      </div>
+      <div class="col-12">
+        <q-input
+          v-model="apiAcl.newTokenExpiry"
+          dense
+          filled
+          label="Expiration"
+          hit="Expiration time in minutes (default xxx)"
+        >
+          <template v-slot:prepend>
+            <q-icon name="event" class="cursor-pointer">
+              <q-popup-proxy
+                cover
+                transition-show="scale"
+                transition-hide="scale"
+              >
+                <q-date v-model="apiAcl.newTokenExpiry" mask="YYYY-MM-DD HH:mm">
+                  <div class="row items-center justify-end">
+                    <q-btn v-close-popup label="Close" color="primary" flat />
+                  </div>
+                </q-date>
+              </q-popup-proxy>
+            </q-icon>
+          </template>
+
+          <template v-slot:append>
+            <q-icon name="access_time" class="cursor-pointer">
+              <q-popup-proxy
+                cover
+                transition-show="scale"
+                transition-hide="scale"
+              >
+                <q-time
+                  v-model="apiAcl.newTokenExpiry"
+                  mask="YYYY-MM-DD HH:mm"
+                  format24h
+                >
+                  <div class="row items-center justify-end">
+                    <q-btn v-close-popup label="Close" color="primary" flat />
+                  </div>
+                </q-time>
+              </q-popup-proxy>
+            </q-icon>
+          </template>
+        </q-input>
+      </div>
+    </div>
+    <div class="row q-mt-lg">
+      <q-btn @click="generateApiToken()" label="Create" color="primary"></q-btn>
+      <q-btn
+        v-close-popup
+        flat
+        color="grey"
+        class="q-ml-auto"
+        v-text="$t('close')"
+      ></q-btn>
+    </div>
+  </q-card>
+</q-dialog>
+
 {% endblock %}
@@ -1,26 +1,14 @@
-{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
-%} {{ window_vars(user, extensions) }}{% block page %}
-<div class="row q-col-gutter-md q-mb-md">
-  <div class="col-sm-9 col-xs-12">
-    <p class="text-h4 gt-sm" v-text="$t('extensions')"></p>
-  </div>
-
-  <div class="col-sm-3 col-xs-12 q-ml-auto">
-    <q-input v-model="searchTerm" :label="$t('search_extensions')">
-      <q-icon
-        v-if="searchTerm !== ''"
-        name="close"
-        @click="searchTerm = ''"
-        class="cursor-pointer"
-      />
-    </q-input>
-  </div>
-</div>
+{% if not ajax %} {% extends "base.html" %} {% endif %}
+<!---->
+{% from "macros.jinja" import window_vars with context %}
+<!---->
+{% block scripts %} {{ window_vars(user, wallet, extensions, extension_data)
+}}{% endblock %} {% block page %}

 <div class="row q-col-gutter-md q-mb-md">
  <div class="col-12">
    <q-card>
-      <div class="q-pa-xs">
+      <div>
        <div class="q-gutter-y-md">
          <q-tabs
            :model-value="tab"
@@ -35,6 +23,57 @@
              v-if="!g.user.admin && tab != 'installed'"
              v-text="$t('only_admins_can_install')"
            ></i>
+            <q-space></q-space>
+
+            <q-input
+              :label="$t('search_extensions')"
+              :dense="dense"
+              class="float-right q-pr-xl"
+              v-model="searchTerm"
+            >
+              <template v-slot:before>
+                <q-icon name="search"> </q-icon>
+              </template>
+              <template v-slot:append>
+                <q-icon
+                  v-if="searchTerm !== ''"
+                  name="close"
+                  @click="searchTerm = ''"
+                  class="cursor-pointer"
+                >
+                </q-icon>
+              </template>
+            </q-input>
+            <q-badge
+              v-if="g.user.admin && updatableExtensions?.length"
+              @click="showUpdateAllDialog = true"
+              color="primary"
+              class="float-right q-pa-sm q-mr-md cursor-pointer"
+            >
+              <span
+                v-text="$t('new_version') + ` (${updatableExtensions?.length})`"
+              ></span>
+            </q-badge>
+            {% if extension_builder_enabled %}
+            <q-btn flat no-caps icon="architecture" to="/extensions/builder"
+              ><span v-text="$t('create_extension')"></span
+            ></q-btn>
+            {% else %}
+            <q-btn disabled flat no-caps icon="architecture"
+              ><span v-text="$t('create_extension')"></span>
+              <q-tooltip
+                v-text="$t('only_admins_can_create_extensions')"
+              ></q-tooltip>
+            </q-btn>
+            {% endif %}
+            <q-btn
+              v-if="g.user.admin"
+              flat
+              round
+              icon="settings"
+              to="/admin#extensions"
+              ><q-tooltip v-text="$t('admin_settings')"></q-tooltip
+            ></q-btn>
          </q-tabs>
        </div>
      </div>
@@ -43,6 +82,7 @@
 </div>
 <div class="row q-col-gutter-md">
  <div
+    v-if="filteredExtensions"
    class="col-12 col-sm-6 col-md-6 col-lg-4"
    v-for="extension in filteredExtensions"
    :key="extension.id + extension.hash"
@@ -91,13 +131,46 @@
              ></q-tooltip>
            </q-badge>
            <div
+              v-if="extension.name"
              class="text-h5"
              style="cursor: pointer"
              @click="showExtensionDetails(extension.id, extension.details_link)"
              v-text="extension.name"
            ></div>
-            <div>
+            <div style="justify-content: space-between; display: flex">
              <lnbits-extension-rating :rating="0" />
+              <q-btn-group size="xs" style="margin: 5px 0">
+                <q-btn
+                  v-if="extension.hasFreeRelease"
+                  color="green"
+                  size="xs"
+                  :label="$t('free')"
+                >
+                  <q-tooltip>
+                    <span v-text="$t('extension_has_free_release')"></span>
+                  </q-tooltip>
+                </q-btn>
+                <q-btn
+                  v-if="extension.hasPaidRelease || extension.paidFeatures"
+                  color="primary"
+                  size="xs"
+                  :label="$t('paid')"
+                >
+                  <q-tooltip>
+                    <span
+                      v-if="extension.hasPaidRelease"
+                      v-text="$t('extension_has_paid_release')"
+                    ></span>
+                    <br
+                      v-if="extension.hasPaidRelease && extension.paidFeatures"
+                    />
+                    <span
+                      v-if="extension.paidFeatures"
+                      v-text="extension.paidFeatures"
+                    ></span>
+                  </q-tooltip>
+                </q-btn>
+              </q-btn-group>
            </div>
            <div style="justify-content: space-between; display: flex">
              <q-toggle
@@ -163,7 +236,7 @@
        <div class="col-10">
          <div v-if="!extension.inProgress">
            <q-btn
-              v-if="user.extensions.includes(extension.id) && extension.isActive && extension.isInstalled"
+              v-if="g.user.extensions.includes(extension.id) && extension.isActive && extension.isInstalled"
              flat
              color="primary"
              type="a"
@@ -171,20 +244,20 @@
              :label="$t('open')"
            ></q-btn>
            <q-btn
-              v-if="user.extensions.includes(extension.id) && extension.isActive && extension.isInstalled"
+              v-if="g.user.extensions.includes(extension.id) && extension.isActive && extension.isInstalled"
              flat
              color="grey-5"
              @click="disableExtension(extension)"
              :label="$t('disable')"
            ></q-btn>
            <q-badge
-              v-if="extension.isAdminOnly && !user.admin"
+              v-if="extension.isAdminOnly && !g.user.admin"
              v-text="$t('admin_only')"
            >
            </q-badge>

            <q-btn
-              v-else-if="extension.isInstalled && extension.isActive && !user.extensions.includes(extension.id)"
+              v-else-if="extension.isInstalled && extension.isActive && !g.user.extensions.includes(extension.id)"
              flat
              color="primary"
              @click="enableExtensionForUser(extension)"
@@ -207,7 +280,7 @@
            </q-btn>
          </div>
          <div v-else>
-            <q-spinner color="primary" size="2.55em"></q-spinner>
+            <q-spinner-bars color="primary" size="2.55em"></q-spinner-bars>
          </div>
        </div>

@@ -229,7 +302,7 @@
  </div>
 </div>

-<q-dialog v-model="showUninstallDialog">
+<q-dialog v-model="showUninstallDialog" position="top">
  <q-card class="q-pa-lg">
    <h6 class="q-my-md text-primary" v-text="$t('warning')"></h6>
    <p>
@@ -266,7 +339,7 @@
  </q-card>
 </q-dialog>

-<q-dialog v-model="showDropDbDialog">
+<q-dialog v-model="showDropDbDialog" position="top">
  <q-card v-if="selectedExtension" class="q-pa-lg">
    <h6 class="q-my-md text-primary" v-text="$t('warning')"></h6>
    <p><span v-text="$t('extension_db_drop_warning')"></span><br /></p>
@@ -296,20 +369,17 @@
  </q-card>
 </q-dialog>

-<q-dialog v-model="showManageExtensionDialog">
+<q-dialog v-model="showManageExtensionDialog" position="top">
  <q-card v-if="selectedRelease" class="q-pa-lg lnbits__dialog-card">
    <q-card-section>
      <div v-if="selectedRelease.paymentRequest">
-        <a :href="'lightning:' + selectedRelease.paymentRequest">
-          <q-responsive :ratio="1" class="q-mx-xl">
-            <lnbits-qrcode
-              :value="'lightning:' + selectedRelease.paymentRequest.toUpperCase()"
-            ></lnbits-qrcode>
-          </q-responsive>
-        </a>
+        <lnbits-qrcode
+          :value="'lightning:' + selectedRelease.paymentRequest.toUpperCase()"
+          :href="'lightning:' + selectedRelease.paymentRequest"
+        ></lnbits-qrcode>
      </div>
      <div v-else>
-        <q-spinner color="primary" size="2.55em"></q-spinner>
+        <q-spinner-bars color="primary" size="2.55em"></q-spinner-bars>
      </div>
    </q-card-section>

@@ -408,7 +478,10 @@
                :header-class="getReleaseIconColor(release)"
              >
                <div v-if="release.inProgress">
-                  <q-spinner color="primary" size="2.55em"></q-spinner>
+                  <q-spinner-bars
+                    color="primary"
+                    size="2.55em"
+                  ></q-spinner-bars>
                </div>
                <div v-else-if="release.error">
                  <q-icon
@@ -419,7 +492,7 @@
                  ></q-icon>
                  <span v-text="$t('release_details_error')"></span>
                </div>
-                <q-card v-else>
+                <q-card class="no-border" v-else>
                  <q-card-section v-if="release.is_version_compatible">
                    <span
                      v-if="release.requiresPayment && !release.paid_sats"
@@ -527,10 +600,26 @@
                    ></a>
                  </q-card-section>
                  <q-card-section v-else>
-                    <span v-text="$t('extension_min_lnbits_version')"></span>
-                    <strong>
-                      <span v-text="release.min_lnbits_version"></span>
-                    </strong>
+                    <span
+                      v-text="$t('extension_required_lnbits_version')"
+                    ></span>
+                    <span class="q-mr-sm">:</span>
+                    <ul>
+                      <li v-if="release.min_lnbits_version">
+                        <span v-text="$t('min_version')"></span>
+                        <span class="q-mr-sm">:</span>
+                        <strong>
+                          <span v-text="release.min_lnbits_version"></span>
+                        </strong>
+                      </li>
+                      <li v-if="release.max_lnbits_version">
+                        <span v-text="$t('max_version')"></span>
+                        <span class="q-mr-sm">:</span>
+                        <strong>
+                          <span v-text="release.max_lnbits_version"></span>
+                        </strong>
+                      </li>
+                    </ul>
                  </q-card-section>
                  <q-card v-if="release.warning">
                    <q-card-section>
@@ -578,7 +667,7 @@
        ></q-btn>
      </div>
    </div>
-    <q-spinner v-else color="primary" size="2.55em"></q-spinner>
+    <q-spinner-bars v-else color="primary" size="2.55em"></q-spinner-bars>
    <div
      v-if="selectedExtension"
      v-show="manageExtensionTab === 'sell'"
@@ -632,7 +721,7 @@
  </q-card>
 </q-dialog>

-<q-dialog v-model="showPayToEnableDialog">
+<q-dialog v-model="showPayToEnableDialog" position="top">
  <q-card v-if="selectedExtension" class="q-pa-md">
    <q-card-section>
      <p>
@@ -655,16 +744,13 @@
    <q-card-section v-if="selectedExtension.payToEnable.showQRCode">
      <div class="row q-mt-lg">
        <div v-if="selectedExtension.payToEnable.paymentRequest" class="col">
-          <a
+          <lnbits-qrcode
+            :value="'lightning:' + selectedExtension.payToEnable.paymentRequest.toUpperCase()"
            :href="'lightning:' + selectedExtension.payToEnable.paymentRequest"
-          >
-            <lnbits-qrcode
-              :value="'lightning:' + selectedExtension.payToEnable.paymentRequest.toUpperCase()"
-            ></lnbits-qrcode>
-          </a>
+          ></lnbits-qrcode>
        </div>
        <div v-else class="col">
-          <q-spinner color="primary" size="2.55em"></q-spinner>
+          <q-spinner-bars color="primary" size="2.55em"></q-spinner-bars>
        </div>
      </div>
      <div class="row q-mt-lg">
@@ -738,7 +824,7 @@
  </q-card>
 </q-dialog>

-<q-dialog v-model="showExtensionDetailsDialog">
+<q-dialog v-model="showExtensionDetailsDialog" position="top">
  <q-card
    v-if="selectedExtensionDetails"
    class="q-pa-sm"
@@ -862,7 +948,6 @@
                :href="selectedExtensionDetails.repo"
                target="_blank"
                rel="noopener noreferrer"
-                class="q-pr-xs"
                ><q-tooltip>repository</q-tooltip></q-btn
              >
            </div>
@@ -884,617 +969,61 @@
    </q-card-section>
  </q-card>
 </q-dialog>
-{% endblock %} {% block scripts %} {{ window_vars(user) }}
-<script>
-  window.app = Vue.createApp({
-    el: '#vue',
+<q-dialog v-model="showUpdateAllDialog" position="top">
+  <q-card class="q-pa-md q-pt-md lnbits__dialog-card">
+    <div class="row">
+      <div class="col-12">
+        <h6 class="q-my-md" v-text="$t('update')"></h6>
+      </div>
+    </div>
+    <div v-if="updatableExtensions?.length > 1" class="row">
+      <div class="col-12">
+        <q-btn
+          outline
+          color="grey"
+          @click="selectAllUpdatableExtensionss()"
+          v-text="$t('select_all')"
+        ></q-btn>
+      </div>
+    </div>

-    data: function () {
-      return {
-        slide: 0,
-        fullscreen: false,
-        autoplay: true,
-        searchTerm: '',
-        tab: 'all',
-        manageExtensionTab: 'releases',
-        filteredExtensions: null,
-        showUninstallDialog: false,
-        showManageExtensionDialog: false,
-        showExtensionDetailsDialog: false,
-        showDropDbDialog: false,
-        showPayToEnableDialog: false,
-        dropDbExtensionId: '',
-        selectedExtension: null,
-        selectedImage: null,
-        selectedExtensionDetails: null,
-        selectedExtensionRepos: null,
-        selectedRelease: null,
-        uninstallAndDropDb: false,
-        maxStars: 5,
-        paylinkWebsocket: null,
-        user: null
-      }
-    },
-    watch: {
-      searchTerm(term) {
-        this.filterExtensions(term, this.tab)
-      }
-    },
-    methods: {
-      handleTabChanged: function (tab) {
-        this.filterExtensions(this.searchTerm, tab)
-      },
-      filterExtensions: function (term, tab) {
-        // Filter the extensions list
-        function extensionNameContains(searchTerm) {
-          return function (extension) {
-            return (
-              extension.name.toLowerCase().includes(searchTerm.toLowerCase()) ||
-              extension.shortDescription
-                ?.toLowerCase()
-                .includes(searchTerm.toLowerCase())
-            )
-          }
-        }
+    <q-virtual-scroll :items="updatableExtensions" style="max-height: 400px">
+      <template v-slot="{ item, index }">
+        <div class="row">
+          <div class="q-col">
+            <q-checkbox
+              v-model="item.selectedForUpdate"
+              :disable="item.isUpgraded"
+              value="false"
+              :label="item.name + ` (v${item.latestRelease?.version})`"
+            >
+              <q-spinner-bars
+                v-if="item.inProgress"
+                color="primary"
+                size="1.5em"
+                class="q-ml-md"
+              ></q-spinner-bars>
+            </q-checkbox>
+          </div>
+        </div>
+      </template>
+    </q-virtual-scroll>
+    <div class="row q-mt-lg">
+      <q-btn
+        @click="updateSelectedExtensions()"
+        outline
+        color="grey"
+        v-text="$t('update')"
+      ></q-btn>

-        this.filteredExtensions = this.extensions
-          .filter(e => (tab === 'all' ? !e.isInstalled : true))
-          .filter(e => (tab === 'installed' ? e.isInstalled : true))
-          .filter(e =>
-            tab === 'installed'
-              ? e.isActive
-                ? true
-                : !!this.g.user.admin
-              : true
-          )
-          .filter(e => (tab === 'featured' ? e.isFeatured : true))
-          .filter(extensionNameContains(term))
-          .map(e => ({
-            ...e,
-            details_link:
-              e.installedRelease?.details_link || e.latestRelease?.details_link
-          }))
-        this.tab = tab
-      },
-
-      installExtension: async function (release) {
-        // no longer required to check if the invoice was paid
-        // the install logic has been triggered one way or another
-        this.unsubscribeFromPaylinkWs()
-
-        const extension = this.selectedExtension
-        extension.inProgress = true
-        this.showManageExtensionDialog = false
-        release.payment_hash =
-          release.payment_hash || this.getPaylinkHash(release.pay_link)
-
-        LNbits.api
-          .request(
-            'POST',
-            `/api/v1/extension`,
-            this.g.user.wallets[0].adminkey,
-            {
-              ext_id: extension.id,
-              archive: release.archive,
-              source_repo: release.source_repo,
-              payment_hash: release.payment_hash,
-              version: release.version
-            }
-          )
-          .then(response => {
-            extension.isAvailable = true
-            extension.isInstalled = true
-            extension.installedRelease = release
-            this.toggleExtension(extension)
-            extension.inProgress = false
-            this.filteredExtensions = this.extensions.concat([])
-            this.handleTabChanged('installed')
-            this.tab = 'installed'
-            window.location.reload()
-          })
-          .catch(err => {
-            console.warn(err)
-            extension.inProgress = false
-            LNbits.utils.notifyApiError(err)
-          })
-      },
-      uninstallExtension: async function () {
-        const extension = this.selectedExtension
-        this.showManageExtensionDialog = false
-        this.showUninstallDialog = false
-        extension.inProgress = true
-        LNbits.api
-          .request(
-            'DELETE',
-            `/api/v1/extension/${extension.id}`,
-            this.g.user.wallets[0].adminkey
-          )
-          .then(response => {
-            extension.isAvailable = false
-            extension.isInstalled = false
-            extension.inProgress = false
-            extension.installedRelease = null
-            this.filteredExtensions = this.extensions.concat([])
-            this.handleTabChanged('installed')
-            this.tab = 'installed'
-            Quasar.Notify.create({
-              type: 'positive',
-              message: 'Extension uninstalled!'
-            })
-            if (this.uninstallAndDropDb) {
-              this.showDropDb()
-            } else {
-              setTimeout(() => {
-                window.location.reload()
-              }, 300)
-            }
-          })
-          .catch(err => {
-            LNbits.utils.notifyApiError(err)
-            extension.inProgress = false
-          })
-      },
-
-      dropExtensionDb: async function () {
-        const extension = this.selectedExtension
-        this.showManageExtensionDialog = false
-        this.showDropDbDialog = false
-        this.dropDbExtensionId = ''
-        extension.inProgress = true
-        LNbits.api
-          .request(
-            'DELETE',
-            `/api/v1/extension/${extension.id}/db`,
-            this.g.user.wallets[0].adminkey
-          )
-          .then(response => {
-            extension.installedRelease = null
-            extension.inProgress = false
-            extension.hasDatabaseTables = false
-            Quasar.Notify.create({
-              type: 'positive',
-              message: 'Extension DB deleted!'
-            })
-            setTimeout(() => {
-              window.location.reload()
-            }, 300)
-          })
-          .catch(err => {
-            LNbits.utils.notifyApiError(err)
-            extension.inProgress = false
-          })
-      },
-      toggleExtension(extension) {
-        const action = extension.isActive ? 'activate' : 'deactivate'
-        LNbits.api
-          .request(
-            'PUT',
-            `/api/v1/extension/${extension.id}/${action}`,
-            this.g.user.wallets[0].adminkey
-          )
-          .then(response => {
-            Quasar.Notify.create({
-              type: 'positive',
-              message: `Extension '${extension.id}' ${action}d!`
-            })
-          })
-          .catch(err => {
-            LNbits.utils.notifyApiError(err)
-            extension.isActive = false
-            extension.inProgress = false
-          })
-      },
-      enableExtensionForUser: function (extension) {
-        if (extension.isPaymentRequired) {
-          this.showPayToEnable(extension)
-          return
-        }
-        this.enableExtension(extension)
-      },
-      enableExtension: function (extension) {
-        LNbits.api
-          .request(
-            'PUT',
-            `/api/v1/extension/${extension.id}/enable`,
-            this.g.user.wallets[0].adminkey
-          )
-          .then(response => {
-            Quasar.Notify.create({
-              type: 'positive',
-              message: 'Extension enabled!'
-            })
-            setTimeout(() => {
-              window.location.reload()
-            }, 300)
-          })
-          .catch(err => {
-            console.warn(err)
-            LNbits.utils.notifyApiError(err)
-          })
-      },
-      disableExtension: function (extension) {
-        LNbits.api
-          .request(
-            'PUT',
-            `/api/v1/extension/${extension.id}/disable`,
-            this.g.user.wallets[0].adminkey
-          )
-          .then(response => {
-            Quasar.Notify.create({
-              type: 'positive',
-              message: 'Extension disabled!'
-            })
-            setTimeout(() => {
-              window.location.reload()
-            }, 300)
-          })
-          .catch(err => {
-            console.warn(error)
-            LNbits.utils.notifyApiError(err)
-          })
-      },
-      showPayToEnable: function (extension) {
-        this.selectedExtension = extension
-        this.selectedExtension.payToEnable.paidAmount =
-          extension.payToEnable.amount
-        this.selectedExtension.payToEnable.showQRCode = false
-        this.showPayToEnableDialog = true
-      },
-      updatePayToInstallData: function (extension) {
-        LNbits.api
-          .request(
-            'PUT',
-            `/api/v1/extension/${extension.id}/sell`,
-            this.g.user.wallets[0].adminkey,
-            {
-              required: extension.payToEnable.required,
-              amount: extension.payToEnable.amount,
-              wallet: extension.payToEnable.wallet
-            }
-          )
-          .then(response => {
-            Quasar.Notify.create({
-              type: 'positive',
-              message: 'Payment info updated!'
-            })
-            this.showManageExtensionDialog = false
-          })
-          .catch(err => {
-            LNbits.utils.notifyApiError(err)
-            extension.inProgress = false
-          })
-      },
-
-      showUninstall: function () {
-        this.showManageExtensionDialog = false
-        this.showUninstallDialog = true
-        this.uninstallAndDropDb = false
-      },
-
-      showDropDb: function () {
-        this.showDropDbDialog = true
-      },
-
-      showManageExtension: async function (extension) {
-        this.selectedExtension = extension
-        this.selectedRelease = null
-        this.selectedExtensionRepos = null
-        this.manageExtensionTab = 'releases'
-        this.showManageExtensionDialog = true
-
-        try {
-          const {data} = await LNbits.api.request(
-            'GET',
-            `/api/v1/extension/${extension.id}/releases`,
-            this.g.user.wallets[0].adminkey
-          )
-
-          this.selectedExtensionRepos = data.reduce((repos, release) => {
-            repos[release.source_repo] = repos[release.source_repo] || {
-              releases: [],
-              isInstalled: false,
-              repo: release.repo
-            }
-            release.inProgress = false
-            release.error = null
-            release.loaded = false
-            release.isInstalled = this.isInstalledVersion(
-              this.selectedExtension,
-              release
-            )
-            if (release.isInstalled) {
-              repos[release.source_repo].isInstalled = true
-            }
-            if (release.pay_link) {
-              release.requiresPayment = true
-              release.paidAmount = release.cost_sats
-              release.payment_hash = this.getPaylinkHash(release.pay_link)
-            }
-
-            repos[release.source_repo].releases.push(release)
-            return repos
-          }, {})
-        } catch (error) {
-          LNbits.utils.notifyApiError(error)
-          extension.inProgress = false
-        }
-      },
-
-      showExtensionDetails: async function (extId, detailsLink) {
-        if (!detailsLink) {
-          return
-        }
-        this.selectedExtensionDetails = null
-        this.showExtensionDetailsDialog = true
-        this.slide = 0
-        this.fullscreen = false
-
-        try {
-          const {data} = await LNbits.api.request(
-            'GET',
-            `/api/v1/extension/${extId}/details?details_link=${detailsLink}`,
-            this.g.user.wallets[0].inkey
-          )
-
-          this.selectedExtensionDetails = data
-          this.selectedExtensionDetails.description_md =
-            LNbits.utils.convertMarkdown(data.description_md)
-        } catch (error) {
-          console.warn(error)
-        }
-      },
-      async payAndInstall(release) {
-        try {
-          this.selectedExtension.inProgress = true
-          this.showManageExtensionDialog = false
-          const paymentInfo = await this.requestPaymentForInstall(
-            this.selectedExtension.id,
-            release
-          )
-          this.rememberPaylinkHash(release.pay_link, paymentInfo.payment_hash)
-          const wallet = this.g.user.wallets.find(w => w.id === release.wallet)
-          const {data} = await LNbits.api.payInvoice(
-            wallet,
-            paymentInfo.payment_request
-          )
-
-          release.payment_hash = data.payment_hash
-
-          await this.installExtension(release)
-        } catch (err) {
-          console.warn(err)
-          LNbits.utils.notifyApiError(err)
-        } finally {
-          this.selectedExtension.inProgress = false
-        }
-      },
-      async payAndEnable(extension) {
-        try {
-          const paymentInfo = await this.requestPaymentForEnable(
-            extension.id,
-            extension.payToEnable.paidAmount
-          )
-
-          const wallet = this.g.user.wallets.find(
-            w => w.id === extension.payToEnable.paymentWallet
-          )
-          const {data} = await LNbits.api.payInvoice(
-            wallet,
-            paymentInfo.payment_request
-          )
-          this.enableExtension(extension)
-          this.showPayToEnableDialog = false
-        } catch (err) {
-          console.warn(err)
-          LNbits.utils.notifyApiError(err)
-        }
-      },
-      async showInstallQRCode(release) {
-        this.selectedRelease = release
-
-        try {
-          const data = await this.requestPaymentForInstall(
-            this.selectedExtension.id,
-            release
-          )
-
-          this.selectedRelease.paymentRequest = data.payment_request
-          this.selectedRelease.payment_hash = data.payment_hash
-          this.selectedRelease = _.clone(this.selectedRelease)
-          this.rememberPaylinkHash(
-            this.selectedRelease.pay_link,
-            this.selectedRelease.payment_hash
-          )
-
-          this.subscribeToPaylinkWs(
-            this.selectedRelease.pay_link,
-            data.payment_hash
-          )
-        } catch (err) {
-          console.warn(err)
-          LNbits.utils.notifyApiError(err)
-        }
-      },
-
-      async showEnableQRCode(extension) {
-        try {
-          extension.payToEnable.showQRCode = true
-          this.selectedExtension = _.clone(extension)
-
-          const data = await this.requestPaymentForEnable(
-            extension.id,
-            extension.payToEnable.paidAmount
-          )
-          extension.payToEnable.paymentRequest = data.payment_request
-          this.selectedExtension = _.clone(extension)
-
-          const url = new URL(window.location)
-          url.protocol = url.protocol === 'https:' ? 'wss' : 'ws'
-          url.pathname = `/api/v1/ws/${data.payment_hash}`
-          const ws = new WebSocket(url)
-          ws.addEventListener('message', async ({data}) => {
-            const payment = JSON.parse(data)
-            if (payment.pending === false) {
-              Quasar.Notify.create({
-                type: 'positive',
-                message: 'Invoice Paid!'
-              })
-
-              this.enableExtension(extension)
-              ws.close()
-            }
-          })
-        } catch (err) {
-          console.warn(err)
-          LNbits.utils.notifyApiError(err)
-        }
-      },
-
-      async requestPaymentForInstall(extId, release) {
-        const {data} = await LNbits.api.request(
-          'PUT',
-          `/api/v1/extension/${extId}/invoice/install`,
-          this.g.user.wallets[0].adminkey,
-          {
-            ext_id: extId,
-            archive: release.archive,
-            source_repo: release.source_repo,
-            cost_sats: release.paidAmount,
-            version: release.version
-          }
-        )
-        return data
-      },
-
-      async requestPaymentForEnable(extId, amount) {
-        const {data} = await LNbits.api.request(
-          'PUT',
-          `/api/v1/extension/${extId}/invoice/enable`,
-          this.g.user.wallets[0].adminkey,
-          {
-            amount
-          }
-        )
-        return data
-      },
-
-      clearHangingInvoice(release) {
-        this.forgetPaylinkHash(release.pay_link)
-        release.payment_hash = null
-      },
-
-      rememberPaylinkHash(pay_link, payment_hash) {
-        this.$q.localStorage.set(
-          `lnbits.extensions.paylink.${pay_link}`,
-          payment_hash
-        )
-      },
-      getPaylinkHash(pay_link) {
-        return this.$q.localStorage.getItem(
-          `lnbits.extensions.paylink.${pay_link}`
-        )
-      },
-      forgetPaylinkHash(pay_link) {
-        this.$q.localStorage.remove(`lnbits.extensions.paylink.${pay_link}`)
-      },
-      subscribeToPaylinkWs(pay_link, payment_hash) {
-        const url = new URL(`${pay_link}/${payment_hash}`)
-        url.protocol = url.protocol === 'https:' ? 'wss' : 'ws'
-        this.paylinkWebsocket = new WebSocket(url)
-        this.paylinkWebsocket.addEventListener('message', async ({data}) => {
-          const resp = JSON.parse(data)
-          if (resp.paid) {
-            Quasar.Notify.create({
-              type: 'positive',
-              message: 'Invoice Paid!'
-            })
-            this.installExtension(this.selectedRelease)
-          } else {
-            Quasar.Notify.create({
-              type: 'warning',
-              message: 'Invoice tracking lost!'
-            })
-          }
-        })
-      },
-      unsubscribeFromPaylinkWs() {
-        try {
-          this.paylinkWebsocket && this.paylinkWebsocket.close()
-        } catch (error) {
-          console.warn(error)
-        }
-      },
-
-      hasNewVersion: function (extension) {
-        if (extension.installedRelease && extension.latestRelease) {
-          return (
-            extension.installedRelease.version !==
-            extension.latestRelease.version
-          )
-        }
-      },
-      isInstalledVersion: function (extension, release) {
-        if (extension.installedRelease) {
-          return (
-            extension.installedRelease.source_repo === release.source_repo &&
-            extension.installedRelease.version === release.version
-          )
-        }
-      },
-      getReleaseIcon: function (release) {
-        if (!release.is_version_compatible) return 'block'
-        if (release.isInstalled) return 'download_done'
-
-        return 'download'
-      },
-      getReleaseIconColor: function (release) {
-        if (!release.is_version_compatible) return 'text-red'
-        if (release.isInstalled) return 'text-green'
-
-        return ''
-      },
-      getGitHubReleaseDetails: async function (release) {
-        if (!release.is_github_release || release.loaded) {
-          return
-        }
-        const [org, repo] = release.source_repo.split('/')
-        release.inProgress = true
-        try {
-          const {data} = await LNbits.api.request(
-            'GET',
-            `/api/v1/extension/release/${org}/${repo}/${release.version}`,
-            this.g.user.wallets[0].adminkey
-          )
-          release.loaded = true
-          release.is_version_compatible = data.is_version_compatible
-          release.min_lnbits_version = data.min_lnbits_version
-          release.warning = data.warning
-        } catch (error) {
-          console.warn(error)
-          release.error = error
-          LNbits.utils.notifyApiError(error)
-        } finally {
-          release.inProgress = false
-        }
-      }
-    },
-    created: function () {
-      this.extensions = JSON.parse('{{extensions | tojson | safe}}').map(e => ({
-        ...e,
-        inProgress: false
-      }))
-      this.filteredExtensions = this.extensions.concat([])
-      for (let i = 0; i < this.filteredExtensions.length; i++) {
-        if (this.filteredExtensions[i].isInstalled != false) {
-          this.handleTabChanged('installed')
-          this.tab = 'installed'
-        }
-      }
-      if (window.user) {
-        this.user = LNbits.map.user(window.user)
-      }
-    },
-    mixins: [windowMixin]
-  })
-</script>
+      <q-btn
+        v-close-popup
+        flat
+        color="grey"
+        class="q-ml-auto"
+        v-text="$t('cancel')"
+      ></q-btn>
+    </div>
+  </q-card>
+</q-dialog>
 {% endblock %}
@@ -0,0 +1,830 @@
+{% if not ajax %} {% extends "base.html" %} {% endif %}
+<!---->
+{% from "macros.jinja" import window_vars with context %}
+<!---->
+{% block scripts %} {{ window_vars(user) }}{% endblock %} {% block page %}
+
+<div class="row">
+  <div class="col-12">
+    <q-stepper
+      v-model="step"
+      ref="stepper"
+      color="primary"
+      animated
+      header-nav
+      class="q-pt-sm"
+      @update:model-value="onStepChange"
+    >
+      <q-step
+        :name="1"
+        title="Describe"
+        icon="info"
+        :done="step > 1"
+        style="min-height: 100px"
+      >
+        <div class="row q-col-gutter-md">
+          <div class="col-12">
+            <span class="text-h6">
+              Tell us something about your extension:
+            </span>
+            <ul>
+              <li>This is the first step, you can return and change it.</li>
+              <li>
+                The <code>`name`</code> and
+                <code>`sort description`</code> fields are what the users will
+                see when browsing the list of extensions.
+              </li>
+              <li>
+                The <code>`id`</code> field is used internally and in the URL of
+                your extension.
+              </li>
+            </ul>
+          </div>
+
+          <!-- todo: add icon -->
+
+          <div class="col-12">
+            <div>
+              <q-btn
+                color="primary"
+                label="Upload Existing config"
+                @click="$refs.extensionDataInput.click()"
+                class="q-mb-md"
+              />
+              <input
+                type="file"
+                ref="extensionDataInput"
+                accept="application/json"
+                style="display: none"
+                @change="onJsonDataInput"
+              />
+            </div>
+          </div>
+        </div>
+        <q-separator class="q-mt-sm"></q-separator>
+        <div class="row q-col-gutter-md q-mt-md">
+          <div class="col-md-4 col-sm-12">
+            <q-input
+              filled
+              v-model="extensionData.name"
+              label="Extension Name"
+              hint="The name of your extension"
+            >
+            </q-input>
+          </div>
+          <div class="col-md-4 col-sm-12">
+            <q-input
+              filled
+              v-model="extensionData.id"
+              label="Extension Id"
+              hint="Lowercase letters, numbers, and underscores only (snake_case). This will be used in the URL."
+            >
+            </q-input>
+          </div>
+          <div class="col-md-4 col-sm-12">
+            <q-input
+              filled
+              v-model="extensionData.short_description"
+              label="Short Description"
+              hint="A short description that is shown in the extension list."
+            >
+            </q-input>
+          </div>
+        </div>
+        <div class="row q-mt-lg">
+          <div class="col-12">
+            <q-input
+              filled
+              v-model="extensionData.description"
+              label="Description"
+              hint="A detailed description of your extension."
+              type="textarea"
+              rows="3"
+              maxlength="1000"
+            >
+            </q-input>
+          </div>
+        </div>
+      </q-step>
+
+      <q-step
+        :name="2"
+        title="Settings"
+        icon="settings"
+        :done="step > 2"
+        style="min-height: 100px"
+      >
+        <div class="row q-col-gutter-md q-mt-md">
+          <div class="col-md-8 col-sm-12">
+            <iframe
+              ref="iframeStep2"
+              class="full-width"
+              height="400px"
+              sandbox="allow-scripts allow-same-origin"
+            ></iframe>
+          </div>
+          <div class="col-md-4 col-sm-12">
+            <q-btn
+              @click="previewExtension('settings')"
+              color="primary"
+              outline
+              label="Refresh Preview"
+              class="full-width q-mb-md"
+            ></q-btn>
+            <q-toggle
+              v-model="extensionData.settings_data.enabled"
+              label="Generate Settings Fields"
+              size="md"
+              color="green"
+            />
+            <br />
+
+            <ul>
+              <li>Define what settings your extension will have.</li>
+              <li>
+                You can choose if each user has its own settings or if the
+                settings are global (set by the admin).
+              </li>
+            </ul>
+          </div>
+        </div>
+
+        <q-separator
+          v-if="extensionData.settings_data.enabled"
+          class="q-mt-sm"
+        ></q-separator>
+        <div v-if="extensionData.settings_data.enabled" class="row q-mt-lg">
+          <div class="col-md-2 col-sm-12">
+            <q-select
+              filled
+              dense
+              emit-value
+              map-options
+              v-model="extensionData.settings_data.type"
+              :options="settingsTypes"
+            ></q-select>
+          </div>
+          <div class="col-md-10 col-sm-12 q-pt-sm">
+            <q-badge
+              v-if="extensionData.settings_data.type === 'user'"
+              outline
+              class="text-caption q-ml-md"
+              >Each user can set its own settings for this extension.</q-badge
+            >
+            <q-badge v-else outline class="text-caption q-ml-md"
+              >Settings are set by the admin and apply to all users of the
+              extension</q-badge
+            >
+          </div>
+        </div>
+        <div v-if="extensionData.settings_data.enabled" class="row q-mt-lg">
+          <div class="col-12">
+            <lnbits-data-fields
+              :fields="extensionData.settings_data.fields"
+              :hide-advanced="true"
+            ></lnbits-data-fields>
+          </div>
+        </div>
+      </q-step>
+
+      <q-step
+        :name="3"
+        :done="step > 3"
+        title="Owner Data"
+        icon="list"
+        style="min-height: 100px"
+      >
+        <div class="row q-col-gutter-md q-mt-md">
+          <div class="col-md-8 col-sm-12">
+            <iframe
+              ref="iframeStep3"
+              class="full-width"
+              height="400px"
+              sandbox="allow-scripts allow-same-origin"
+            ></iframe>
+          </div>
+          <div class="col-md-4 col-sm-12">
+            <q-btn
+              @click="previewExtension('owner_data')"
+              color="primary"
+              outline
+              label="Refresh Preview"
+              class="full-width q-mb-md"
+            ></q-btn>
+            <q-input
+              v-model="extensionData.owner_data.name"
+              filled
+              label="Owner Table Name"
+              hint="CamelCase name for the owner data table (e.g. Campaign, PoS, etc.)"
+              class="q-mb-xl"
+            >
+            </q-input>
+
+            <ul>
+              <li>
+                The owner of the extension manages this data. It can add, remove
+                and update instances of it.
+              </li>
+
+              <li>
+                Some fileds are present by default, like
+                <code>created_at</code>, <code>updated_at</code> and
+                <code>extra</code>.
+              </li>
+            </ul>
+          </div>
+        </div>
+
+        <div class="row q-mt-lg">
+          <div class="col-12">
+            <lnbits-data-fields
+              :fields="extensionData.owner_data.fields"
+            ></lnbits-data-fields>
+          </div>
+        </div>
+      </q-step>
+
+      <q-step
+        :name="4"
+        :done="step > 4"
+        title="Client Data"
+        icon="blur_linear"
+        style="min-height: 100px"
+      >
+        <div class="row q-col-gutter-md q-mt-md">
+          <div class="col-md-8 col-sm-12">
+            <iframe
+              ref="iframeStep4"
+              class="full-width"
+              height="400px"
+              sandbox="allow-scripts allow-same-origin"
+            ></iframe>
+          </div>
+          <div class="col-md-4 col-sm-12">
+            <q-btn
+              @click="previewExtension('client_data')"
+              color="primary"
+              outline
+              label="Refresh Preview"
+              class="full-width q-mb-md"
+            ></q-btn>
+            <!-- <q-toggle
+              v-model="extensionData.client_data.enabled"
+              label="Generate Client Table"
+              disable
+              size="md"
+              color="green"
+            />
+
+            <br /> -->
+            <q-input
+              v-if="extensionData.client_data.enabled"
+              v-model="extensionData.client_data.name"
+              filled
+              label="Client Table Name"
+              hint="CamelCase name for the client data table (e.g. Donation, Payment, etc.)"
+              class="q-mb-xl"
+            >
+            </q-input>
+            <ul>
+              <li>
+                This data is created by users of the extension. Usually when
+                they submit a form or make a payment.
+              </li>
+              <li>
+                The owner of the extension can view this data, but should not
+                modify it.
+              </li>
+            </ul>
+          </div>
+        </div>
+        <q-separator
+          v-if="extensionData.client_data.enabled"
+          class="q-mt-sm"
+        ></q-separator>
+        <div v-if="extensionData.client_data.enabled" class="row q-mt-lg">
+          <div class="col-12">
+            <lnbits-data-fields
+              :fields="extensionData.client_data.fields"
+            ></lnbits-data-fields>
+          </div>
+        </div>
+      </q-step>
+
+      <q-step
+        :name="5"
+        :done="step > 5"
+        title="Public Pages"
+        icon="link"
+        style="min-height: 100px"
+      >
+        <div class="row q-col-gutter-md q-mt-md">
+          <div class="col-md-8 col-sm-12">
+            <iframe
+              ref="iframeStep5"
+              class="full-width"
+              height="400px"
+              sandbox="allow-scripts allow-same-origin"
+            ></iframe>
+          </div>
+
+          <div class="col-md-4 col-sm-12">
+            <q-btn
+              @click="previewExtension('public_page')"
+              color="primary"
+              outline
+              label="Refresh Preview"
+              class="full-width q-mb-md"
+            ></q-btn>
+            <q-toggle
+              v-model="extensionData.public_page.has_public_page"
+              label="Generate Public Page"
+              size="md"
+              color="green"
+            />
+            <br />
+
+            <ul>
+              <li>
+                Most extensions have a public page that can be shared (this page
+                will still be accessible even if you have restricted access to
+                your LNbits install).
+              </li>
+            </ul>
+          </div>
+        </div>
+        <div v-if="extensionData.public_page.has_public_page">
+          <div class="row q-col-gutter-md q-mt-md">
+            <div class="col-12 col-md-6">
+              <q-item tag="label" v-ripple>
+                <q-item-section>
+                  <q-item-label>Public page title</q-item-label>
+                  <q-item-label caption
+                    >Select the field from the
+                    <code v-text="extensionData.owner_data.name"></code>&nbsp;
+                    (Owner Data) that will be used as a title for the public
+                    page.</q-item-label
+                  >
+                </q-item-section>
+                <q-item-section>
+                  <q-select
+                    filled
+                    dense
+                    emit-value
+                    map-options
+                    v-model="extensionData.public_page.owner_data_fields.name"
+                    :options="[''].concat(extensionData.owner_data.fields.map(f => f.name))"
+                  ></q-select>
+                </q-item-section>
+              </q-item>
+            </div>
+            <div class="col-12 col-md-6">
+              <q-item tag="label" v-ripple>
+                <q-item-section>
+                  <q-item-label>Public page description</q-item-label>
+                  <q-item-label caption
+                    >Select the field from the
+                    <code v-text="extensionData.owner_data.name"></code>&nbsp;
+                    (Owner Data) that will be used as a description for the
+                    public page.</q-item-label
+                  >
+                </q-item-section>
+                <q-item-section>
+                  <q-select
+                    filled
+                    dense
+                    emit-value
+                    map-options
+                    v-model="extensionData.public_page.owner_data_fields.description"
+                    :options="[''].concat(extensionData.owner_data.fields.map(f => f.name))"
+                  ></q-select>
+                </q-item-section>
+              </q-item>
+            </div>
+            <div class="col-12 col-md-6">
+              <q-item tag="label" v-ripple>
+                <q-item-section>
+                  <q-item-label>Public page inputs</q-item-label>
+                  <q-item-label caption>
+                    <ul class="q-pa-none q-ma-none">
+                      <li>
+                        Select the fields from the
+                        <code v-text="extensionData.client_data.name"></code
+                        >&nbsp; (Client Data) that will be shown as inputs in
+                        the public page form.
+                      </li>
+                      <li>You can select multiple fields.</li>
+                      <li>
+                        A corresponding input field will be created for each
+                        selected field.
+                      </li>
+                    </ul>
+                  </q-item-label>
+                </q-item-section>
+                <q-item-section>
+                  <q-select
+                    filled
+                    dense
+                    emit-value
+                    map-options
+                    multiple
+                    use-chips
+                    v-model="extensionData.public_page.client_data_fields.public_inputs"
+                    :options="extensionData.client_data.fields.map(f => f.name)"
+                  ></q-select>
+                </q-item-section>
+              </q-item>
+            </div>
+            <div class="col-12 col-md-6">
+              <q-item tag="label" v-ripple>
+                <q-item-section>
+                  <q-item-label>Generate Action Button</q-item-label>
+                  <q-item-label caption>
+                    <ul class="q-pa-none q-ma-none">
+                      <li>
+                        If enabled, the public page will have a button to
+                        perform an action (e.g. generate a payment request).
+                      </li>
+                      <li>
+                        The action will use the selected input fields from
+                        <code v-text="extensionData.client_data.name"></code
+                        >&nbsp; (Client Data) as parameters.
+                      </li>
+                      <li>
+                        A corresponding REST API endpoint will be created.
+                      </li>
+                    </ul></q-item-label
+                  >
+                </q-item-section>
+                <q-item-section avatar>
+                  <q-toggle
+                    v-model="extensionData.public_page.action_fields.generate_action"
+                    size="md"
+                    color="green"
+                  />
+                </q-item-section>
+              </q-item>
+            </div>
+          </div>
+          <q-separator
+            v-if="extensionData.public_page.action_fields.generate_action"
+            class="q-mt-sm"
+          ></q-separator>
+
+          <div v-if="extensionData.public_page.action_fields.generate_action">
+            <div class="row q-col-gutter-md q-mt-md">
+              <div class="col-12 col-md-6">
+                <q-item tag="label" v-ripple>
+                  <q-item-section>
+                    <q-item-label>Generate Payment Logic</q-item-label>
+                    <q-item-label caption>
+                      <ul class="q-pa-none q-ma-none">
+                        <li>
+                          If enabled, the endpoint will create an invoice from
+                          the submitted data and the UI will show the QR code
+                          with the invoice.
+                        </li>
+                        <li>
+                          A listener will be created to check for the pay event.
+                        </li>
+                        <li>You must map the fieds.</li>
+                      </ul></q-item-label
+                    >
+                  </q-item-section>
+                  <q-item-section avatar>
+                    <q-toggle
+                      v-model="extensionData.public_page.action_fields.generate_payment_logic"
+                      size="md"
+                      color="green"
+                    />
+                  </q-item-section>
+                </q-item>
+              </div>
+
+              <div class="col-12 col-md-6"></div>
+            </div>
+            <div
+              v-if="extensionData.public_page.action_fields.generate_action && extensionData.public_page.action_fields.generate_payment_logic"
+              class="row q-col-gutter-md q-mt-md"
+            >
+              <div class="col-12 col-md-6">
+                <q-item tag="label" v-ripple>
+                  <q-item-section>
+                    <q-item-label>Wallet</q-item-label>
+                    <q-item-label caption>
+                      <ul class="q-pa-none q-ma-none">
+                        <li>
+                          Select the field from the
+                          <code v-text="extensionData.owner_data.name"></code
+                          >&nbsp; (Owner Data) that represents the wallet which
+                          will generate the invoice and receive the payments.
+                        </li>
+
+                        <li>
+                          Only fields with the type <code>Wallet</code> will be
+                          shown.
+                        </li>
+                      </ul>
+                    </q-item-label>
+                  </q-item-section>
+                  <q-item-section>
+                    <q-select
+                      filled
+                      dense
+                      emit-value
+                      map-options
+                      v-model="extensionData.public_page.action_fields.wallet_id"
+                      :options="[''].concat(extensionData.owner_data.fields.filter(f => f.type === 'wallet').map(f => f.name))"
+                    ></q-select>
+                  </q-item-section>
+                </q-item>
+              </div>
+
+              <div class="col-12 col-md-6">
+                <q-item tag="label" v-ripple>
+                  <q-item-section>
+                    <q-item-label>Currency</q-item-label>
+                    <q-item-label caption>
+                      <ul class="q-pa-none q-ma-none">
+                        <li>
+                          Select the field from the
+                          <code v-text="extensionData.owner_data.name"></code
+                          >&nbsp; (Owner Data) that represents the currency
+                          which will be used to for the amount.
+                        </li>
+                        <li>
+                          Only fields with the type <code>Currency</code> will
+                          be shown.
+                        </li>
+                        <li>Empty if you want to use sats.</li>
+                      </ul>
+                    </q-item-label>
+                  </q-item-section>
+                  <q-item-section>
+                    <q-select
+                      filled
+                      dense
+                      emit-value
+                      map-options
+                      v-model="extensionData.public_page.action_fields.currency"
+                      :options="[''].concat(extensionData.owner_data.fields.filter(f => f.type === 'currency').map(f => f.name))"
+                    ></q-select>
+                  </q-item-section>
+                </q-item>
+              </div>
+
+              <div class="col-12 col-md-6">
+                <q-item tag="label" v-ripple>
+                  <q-item-section>
+                    <q-item-label>Amount</q-item-label>
+                    <q-item-label caption>
+                      <ul class="q-pa-none q-ma-none">
+                        <li>
+                          Select the field from the
+                          <code v-text="extensionData.owner_data.name"></code
+                          >&nbsp; (Owner Data) or
+                          <code v-text="extensionData.client_data.name"></code
+                          >&nbsp; (Client Data) that represents the amount (in
+                          the selected currency).
+                        </li>
+                        <li>
+                          Only fields with the type <code>Integer</code> and
+                          <code>Float</code> will be shown.
+                        </li>
+                      </ul>
+                    </q-item-label>
+                  </q-item-section>
+                  <q-item-section>
+                    <div class="row">
+                      <div class="col-6">
+                        <q-select
+                          filled
+                          dense
+                          emit-value
+                          map-options
+                          v-model="extensionData.public_page.action_fields.amount_source"
+                          :options="amountSource"
+                          class="q-mr-sm"
+                        ></q-select>
+                      </div>
+                      <div class="col-6">
+                        <q-select
+                          filled
+                          dense
+                          emit-value
+                          map-options
+                          v-model="extensionData.public_page.action_fields.amount"
+                          :options="paymentActionAmountFields"
+                        ></q-select>
+                      </div>
+                    </div>
+                  </q-item-section>
+                </q-item>
+              </div>
+
+              <div class="col-12 col-md-6">
+                <q-item tag="label" v-ripple>
+                  <q-item-section>
+                    <q-item-label>Paid Flag</q-item-label>
+                    <q-item-label caption>
+                      <ul class="q-pa-none q-ma-none">
+                        <li>
+                          Select the field from the
+                          <code v-text="extensionData.client_data.name"></code
+                          >&nbsp; (Client Data) that will be set to true when
+                          the invoice is paid.
+                        </li>
+                        <li>
+                          Only fields with the type <code>Boolean</code> will be
+                          shown.
+                        </li>
+                      </ul>
+                    </q-item-label>
+                  </q-item-section>
+                  <q-item-section>
+                    <q-select
+                      filled
+                      dense
+                      emit-value
+                      map-options
+                      v-model="extensionData.public_page.action_fields.paid_flag"
+                      :options="[''].concat(extensionData.client_data.fields.filter(f => f.type === 'bool').map(f => f.name))"
+                    ></q-select>
+                  </q-item-section>
+                </q-item>
+              </div>
+            </div>
+          </div>
+        </div>
+      </q-step>
+
+      <q-step
+        :name="6"
+        :done="step > 6"
+        title="Publish"
+        icon="publish"
+        style="min-height: 100px"
+      >
+        <div v-if="g.user.admin" class="row">
+          <div class="col-md-4 col-sm-12 col-xs-12">
+            <q-select
+              filled
+              dense
+              emit-value
+              map-options
+              v-model="extensionData.stub_version"
+              hint="The version of the extension stub. Make sure it is compatible with your LNbits install."
+              :options="extensionStubVersions.map(f => f.version)"
+            ></q-select>
+          </div>
+          <div class="col-md-4 col-sm-12 col-xs-12">
+            <q-btn
+              @click="cleanCacheData()"
+              color="grey"
+              outline
+              label="Clean Cache"
+              class="q-ml-md"
+            />
+            <q-icon
+              name="info"
+              size="md"
+              color="primary"
+              class="cursor-pointer q-ml-xs q-mb-xs"
+            >
+              <q-tooltip>
+                <ul class="q-pl-sm">
+                  <li>
+                    The extension builder uses caching to speed up the build
+                    process.
+                  </li>
+                  <li>
+                    This action clears old data and redownloads the Extension
+                    Builder Stub release.
+                  </li>
+                </ul>
+              </q-tooltip>
+            </q-icon>
+          </div>
+        </div>
+        <div v-if="g.user.admin" class="row q-mt-md">
+          <div class="col-md-4 col-sm-12 col-xs-12">
+            <div class="row">
+              <q-btn
+                @click="buildExtensionAndDeploy()"
+                color="primary"
+                label="Build and Deploy (Admin Only)"
+                class="col"
+              />
+              <q-icon
+                name="info"
+                size="md"
+                color="primary"
+                class="cursor-pointer q-ml-sm self-center"
+              >
+                <q-tooltip>
+                  <ul class="q-pl-sm">
+                    <li>
+                      Installs the extension directly to this LNbits instance.
+                    </li>
+                    <li>
+                      The extension will be enabled by default, and available to
+                      all users.
+                    </li>
+                  </ul>
+                </q-tooltip>
+              </q-icon>
+            </div>
+          </div>
+        </div>
+
+        <div class="row q-mt-md">
+          <div class="col-md-4 col-sm-12 col-xs-12">
+            <div class="row">
+              <q-btn
+                @click="buildExtension()"
+                outline
+                color="gray"
+                label="Download Extension Zip"
+                icon="download"
+                class="col"
+              />
+              <q-icon
+                name="info"
+                size="md"
+                color="primary"
+                class="cursor-pointer q-ml-sm self-center"
+              >
+                <q-tooltip>
+                  Builds the extension and downloads a zip file with the code.
+                  You can then install it manually in your LNbits instance.
+                </q-tooltip>
+              </q-icon>
+            </div>
+          </div>
+        </div>
+      </q-step>
+
+      <template v-slot:navigation>
+        <q-separator></q-separator>
+        <div class="row">
+          <div class="col-md-6 col-sm-12 q-pl-md q-pt-md">
+            <q-btn
+              v-if="step == 1"
+              label="Clear All Data"
+              color="negative"
+              @click="clearAllData"
+            ></q-btn>
+            <q-btn
+              v-else
+              flat
+              color="grey-8"
+              class="q-mr-sm"
+              @click="previousStep()"
+              label="Back"
+              icon="chevron_left"
+            />
+          </div>
+          <div class="col-md-6 col-sm-12 q-pr-md q-pb-md">
+            <q-stepper-navigation class="float-right">
+              <q-btn
+                v-if="step < 6"
+                @click="nextStep()"
+                color="primary"
+                label="Next"
+              ></q-btn>
+              <template v-else>
+                <q-btn
+                  @click="exportJsonData()"
+                  color="primary"
+                  label="Export JSON Data"
+                ></q-btn>
+                <q-icon
+                  name="info"
+                  size="md"
+                  color="primary"
+                  class="cursor-pointer q-ml-sm self-center"
+                >
+                  <q-tooltip>
+                    <ul class="q-pl-sm">
+                      <li>
+                        Exports the config JSON so it can be later imported or
+                        shared.
+                      </li>
+                      <li>
+                        This JSON is also added to the zip in a file called
+                        `builder.json`.
+                      </li>
+                    </ul>
+                  </q-tooltip>
+                </q-icon>
+              </template>
+            </q-stepper-navigation>
+          </div>
+        </div>
+      </template>
+    </q-stepper>
+  </div>
+</div>
+<div class="row q-col-gutter-md"></div>
+
+{% endblock %}
@@ -1,139 +1,150 @@
-{% extends "public.html" %} {% block page %}
-<div class="row q-col-gutter-md justify-center main">
-  <div class="col-10 col-md-8 col-lg-6 q-gutter-y-md">
-    <q-card>
-      <q-card-section class="grid">
-        <div>
-          <h6 class="q-my-none text-center">
-            <strong>Welcome to LNbits</strong>
-            <p>Set up the Superuser account below.</p>
-          </h6>
-          <br />
-          <q-form class="q-gutter-md">
-            <q-input
-              filled
-              v-model="loginData.username"
-              :label="$t('username')"
-            ></q-input>
-            <q-input
-              filled
-              v-model.trim="loginData.password"
-              :type="loginData.isPwd ? 'password' : 'text'"
-              autocomplete="off"
-              :label="$t('password')"
-              :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
-              ><template v-slot:append>
-                <q-icon
-                  :name="loginData.isPwd ? 'visibility_off' : 'visibility'"
-                  class="cursor-pointer"
-                  @click="loginData.isPwd = !loginData.isPwd"
-                /> </template
-            ></q-input>
-            <q-input
-              filled
-              v-model.trim="loginData.passwordRepeat"
-              :type="loginData.isPwdRepeat ? 'password' : 'text'"
-              autocomplete="off"
-              :label="$t('password_repeat')"
-              :rules="[(val) => !val || val.length >= 8 || $t('invalid_password'), (val) => val === loginData.password || 'Passwords_dont_match']"
-              ><template v-slot:append>
-                <q-icon
-                  :name="loginData.isPwdRepeat ? 'visibility_off' : 'visibility'"
-                  class="cursor-pointer"
-                  @click="loginData.isPwdRepeat = !loginData.isPwdRepeat"
-                /> </template
-            ></q-input>
-            <q-btn
-              @click="setPassword()"
-              unelevated
-              color="primary"
-              :label="$t('login')"
-              :disable="checkPasswordsMatch || !loginData.username || !loginData.password || !loginData.passwordRepeat"
-            ></q-btn>
-          </q-form>
-        </div>
-        <div class="hero-wrapper">
-          <div class="hero q-mx-auto"></div>
-        </div>
-      </q-card-section>
-    </q-card>
-  </div>
-</div>
-{% endblock %} {% block scripts %}
-<style>
-  main {
-    display: flex;
-    flex-direction: column;
-    justify-content: center;
-  }
-  .grid {
-    display: block;
-  }
-  .hero-wrapper {
-    display: none;
-  }
-  .hero {
-    display: block;
-    height: 100%;
-    max-width: 250px;
-    background-image: url("{{ static_url_for('static', 'images/logos/lnbits.svg') }}");
-    background-position: center;
-    background-size: contain;
-    background-repeat: no-repeat;
-  }
+{% extends "public.html" %} {% block page_container %}
+<q-page-container>
+  <q-page class="q-px-md q-py-lg" :class="{'q-px-lg': $q.screen.gt.xs}">
+    {% block page %}
+    <div class="row q-col-gutter-md justify-center main">
+      <div class="col-10 col-md-8 col-lg-6 q-gutter-y-md">
+        <q-card>
+          <q-card-section class="grid">
+            <div>
+              <h6 class="q-my-none text-center">
+                <strong v-text="$t('welcome_lnbits')"></strong>
+                <p><span v-text="$t('setup_su_account')"></span></p>
+              </h6>
+              <br />
+              <q-form class="q-gutter-md">
+                <q-input
+                  filled
+                  v-model="loginData.username"
+                  :label="$t('username')"
+                ></q-input>
+                <q-input
+                  filled
+                  v-model.trim="loginData.password"
+                  :type="loginData.isPwd ? 'password' : 'text'"
+                  autocomplete="off"
+                  :label="$t('password')"
+                  :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
+                  ><template v-slot:append>
+                    <q-icon
+                      :name="loginData.isPwd ? 'visibility_off' : 'visibility'"
+                      class="cursor-pointer"
+                      @click="loginData.isPwd = !loginData.isPwd"
+                    /> </template
+                ></q-input>
+                <q-input
+                  filled
+                  v-model.trim="loginData.passwordRepeat"
+                  :type="loginData.isPwdRepeat ? 'password' : 'text'"
+                  autocomplete="off"
+                  :label="$t('password_repeat')"
+                  :rules="[(val) => !val || val.length >= 8 || $t('invalid_password'), (val) => val === loginData.password || $t('invalid_password_repeat')]"
+                  ><template v-slot:append>
+                    <q-icon
+                      :name="loginData.isPwdRepeat ? 'visibility_off' : 'visibility'"
+                      class="cursor-pointer"
+                      @click="loginData.isPwdRepeat = !loginData.isPwdRepeat"
+                    /> </template
+                ></q-input>
+                <q-btn
+                  @click="setPassword()"
+                  unelevated
+                  color="primary"
+                  :label="$t('login')"
+                  :disable="checkPasswordsMatch || !loginData.username || !loginData.password || !loginData.passwordRepeat"
+                ></q-btn>
+              </q-form>
+            </div>
+            <div class="hero-wrapper">
+              <div class="hero q-mx-auto"></div>
+            </div>
+          </q-card-section>
+        </q-card>
+      </div>
+    </div>
+    {% endblock %} {% block scripts %}
+    <style>
+      main {
+        display: flex;
+        flex-direction: column;
+        justify-content: center;
+      }
+      .grid {
+        display: block;
+      }
+      .hero-wrapper {
+        display: none;
+      }
+      .hero {
+        display: block;
+        height: 100%;
+        max-width: 250px;
+        background-image: url("{{ static_url_for('static', 'images/logos/lnbits.svg') }}");
+        background-position: center;
+        background-size: contain;
+        background-repeat: no-repeat;
+      }

-  @media (min-width: 992px) {
-    .grid {
-      display: grid;
-      grid-template-columns: 1fr 1fr;
-      grid-gap: 1rem;
-    }
-    .hero-wrapper {
-      display: block;
-      position: relative;
-      height: 100%;
-      padding: 1rem;
-    }
-  }
-</style>
-<script>
-  window.app = Vue.createApp({
-    el: '#vue',
-    mixins: [window.windowMixin],
-    data: function () {
-      return {
-        loginData: {
-          isPwd: true,
-          isPwdRepeat: true,
-          username: '',
-          password: '',
-          passwordRepeat: ''
+      @media (min-width: 992px) {
+        .grid {
+          display: grid;
+          grid-template-columns: 1fr 1fr;
+          grid-gap: 1rem;
+        }
+        .hero-wrapper {
+          display: block;
+          position: relative;
+          height: 100%;
+          padding: 1rem;
        }
      }
-    },
-    created() {
-      this.hasAdminUI = '{{ LNBITS_ADMIN_UI | tojson}}'
-    },
-    computed: {
-      checkPasswordsMatch() {
-        return this.loginData.password !== this.loginData.passwordRepeat
-      }
-    },
-    methods: {
-      async setPassword() {
-        try {
-          await LNbits.api.request('PUT', '/api/v1/auth/first_install', null, {
-            username: this.loginData.username,
-            password: this.loginData.password,
-            password_repeat: this.loginData.passwordRepeat
-          })
+    </style>
+    <script>
+      window.app = Vue.createApp({
+        el: '#vue',
+        mixins: [window.windowMixin],
+        data: function () {
+          return {
+            loginData: {
+              isPwd: true,
+              isPwdRepeat: true,
+              username: '',
+              password: '',
+              passwordRepeat: ''
+            }
+          }
+        },
+        created() {
+          this.hasAdminUI = '{{ LNBITS_ADMIN_UI | tojson}}'
+        },
+        computed: {
+          checkPasswordsMatch() {
+            return this.loginData.password !== this.loginData.passwordRepeat
+          }
+        },
+        methods: {
+          async setPassword() {
+            try {
+              await LNbits.api.request(
+                'PUT',
+                '/api/v1/auth/first_install',
+                null,
+                {
+                  username: this.loginData.username,
+                  password: this.loginData.password,
+                  password_repeat: this.loginData.passwordRepeat
+                }
+              )

-          window.location.href = '/admin'
-        } catch (e) {
-          LNbits.utils.notifyApiError(e)
+              window.location.href = '/admin'
+            } catch (e) {
+              LNbits.utils.notifyApiError(e)
+            }
+          }
        }
-      }
-    }
-  })
-</script>
+      })
+    </script>
+    {% endblock %}
+  </q-page>
+</q-page-container>
 {% endblock %}
@@ -0,0 +1,165 @@
+{% if not ajax %} {% extends "base.html" %} {% endif %}
+<!---->
+{% from "macros.jinja" import window_vars with context %}
+<!---->
+{% block scripts %} {{ window_vars(user) }}{% endblock %} {% block page %}
+
+<div class="row q-col-gutter-md q-mb-md">
+  <div class="col-12">
+    <q-card>
+      <div class="q-pa-sm q-pl-lg">
+        <div class="row items-center justify-between q-gutter-xs">
+          <div class="col">
+            <q-btn
+              @click="showAddWalletDialog.show = true"
+              :label="$t('add_wallet')"
+              color="primary"
+            >
+            </q-btn>
+          </div>
+          <div class="float-left">
+            <q-input
+              :label="$t('search_wallets')"
+              dense
+              class="float-right q-pr-xl"
+              v-model="walletsTable.search"
+            >
+              <template v-slot:before>
+                <q-icon name="search"> </q-icon>
+              </template>
+              <template v-slot:append>
+                <q-icon
+                  v-if="walletsTable.search !== ''"
+                  name="close"
+                  @click="walletsTable.search = ''"
+                  class="cursor-pointer"
+                >
+                </q-icon>
+              </template>
+            </q-input>
+          </div>
+        </div>
+      </div>
+    </q-card>
+  </div>
+</div>
+<div>
+  <div>
+    <div>
+      <q-table
+        grid
+        grid-header
+        flat
+        bordered
+        :rows="wallets"
+        :columns="walletsTable.columns"
+        v-model:pagination="walletsTable.pagination"
+        :loading="walletsTable.loading"
+        @request="getUserWallets"
+        row-key="id"
+        :filter="filter"
+        hide-header
+      >
+        <template v-slot:item="props">
+          <div class="q-pa-xs col-xs-12 col-sm-6 col-md-4">
+            <q-card
+              class="q-ma-sm cursor-pointer wallet-list-card"
+              style="text-decoration: none"
+              @click="goToWallet(props.row.id)"
+            >
+              <q-card-section>
+                <div class="row items-center">
+                  <q-avatar
+                    size="lg"
+                    :text-color="$q.dark.isActive ? 'black' : 'grey-3'"
+                    :color="props.row.extra.color"
+                    :icon="props.row.extra.icon"
+                  >
+                  </q-avatar>
+
+                  <div
+                    class="text-h6 q-pl-md ellipsis"
+                    class="text-bold"
+                    v-text="props.row.name"
+                  ></div>
+                  <q-space> </q-space>
+                  <q-btn
+                    v-if="props.row.extra.pinned"
+                    round
+                    color="primary"
+                    text-color="black"
+                    size="xs"
+                    icon="push_pin"
+                    class="float-right"
+                    style="transform: rotate(30deg)"
+                  ></q-btn>
+                </div>
+
+                <div class="row items-center q-pt-sm">
+                  <h6 class="q-my-none ellipsis full-width">
+                    <strong
+                      v-text="formatBalance(props.row.balance_msat / 1000)"
+                    ></strong>
+                  </h6>
+                </div>
+              </q-card-section>
+              <q-separator />
+
+              <q-card-section class="text-left">
+                <small>
+                  <strong>
+                    <span v-text="$t('currency')"></span>
+                  </strong>
+                  <span v-text="props.row.currency || 'sat'"></span>
+                </small>
+                <br />
+                <small>
+                  <strong>
+                    <span v-text="$t('id')"></span>
+                    :
+                  </strong>
+                  <span v-text="props.row.id"></span>
+                </small>
+              </q-card-section>
+            </q-card>
+          </div>
+        </template>
+      </q-table>
+    </div>
+  </div>
+</div>
+
+<q-dialog
+  v-model="showAddWalletDialog.show"
+  persistent
+  @hide="showAddWalletDialog = {show: false}"
+>
+  <q-card style="min-width: 350px">
+    <q-card-section>
+      <div class="text-h6">
+        <span v-text="$t('wallet_name')"></span>
+      </div>
+    </q-card-section>
+
+    <q-card-section class="q-pt-none">
+      <q-input
+        dense
+        v-model="showAddWalletDialog.name"
+        autofocus
+        @keyup.enter="submitAddWallet()"
+      ></q-input>
+    </q-card-section>
+
+    <q-card-actions align="right" class="text-primary">
+      <q-btn flat :label="$t('cancel')" v-close-popup></q-btn>
+      <q-btn
+        flat
+        :label="$t('add_wallet')"
+        v-close-popup
+        @click="submitAddWallet()"
+      ></q-btn>
+    </q-card-actions>
+  </q-card>
+</q-dialog>
+
+{% endblock %}
@@ -1,5 +1,5 @@
 <q-tab-panel name="channels">
-  <q-dialog v-model="connectPeerDialog.show">
+  <q-dialog v-model="connectPeerDialog.show" position="top">
    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
      <q-form class="q-gutter-md">
        <q-input
@@ -29,6 +29,45 @@
    </q-card>
  </q-dialog>

+  <q-dialog v-model="setFeeDialog.show">
+    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+      <label class="text-h6">Set Channel Fee</label>
+      <p class="text-caption" v-text="setFeeDialog.channel_id"></p>
+      <q-separator></q-separator>
+      <q-form class="q-gutter-md">
+        <q-input
+          dense
+          type="number"
+          filled
+          v-model.number="setFeeDialog.data.fee_ppm"
+          label="Fee Rate PPM"
+        ></q-input>
+        <q-input
+          dense
+          type="number"
+          filled
+          v-model.number="setFeeDialog.data.fee_base_msat"
+          label="Fee Base msat"
+        ></q-input>
+
+        <div class="row q-mt-lg">
+          <q-btn
+            :label="$t('set')"
+            color="primary"
+            @click="setChannelFee(setFeeDialog.channel_id)"
+          ></q-btn>
+          <q-btn
+            v-close-popup
+            flat
+            color="grey"
+            class="q-ml-auto"
+            :label="$t('cancel')"
+          ></q-btn>
+        </div>
+      </q-form>
+    </q-card>
+  </q-dialog>
+
  <q-dialog v-model="openChannelDialog.show">
    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
      <q-form class="q-gutter-md">
@@ -89,7 +128,7 @@
    </q-card>
  </q-dialog>

-  <q-dialog v-model="closeChannelDialog.show">
+  <q-dialog v-model="closeChannelDialog.show" position="top">
    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
      <q-form class="q-gutter-md">
        <div>
@@ -171,10 +210,41 @@
                <q-tr :props="props">
                  <div class="q-pb-sm">
                    <div class="row items-center q-gutter-sm">
-                      <div
-                        class="text-subtitle1 col-grow"
-                        v-text="props.row.name"
-                      ></div>
+                      <div class="text-subtitle1" v-text="props.row.name"></div>
+                      <div class="text-caption" v-if="props.row.peer_id">
+                        <span>Peer ID</span>
+                        <q-btn
+                          size="xs"
+                          flat
+                          dense
+                          icon="content_paste"
+                          @click="copyText(props.row.peer_id)"
+                        ></q-btn>
+                      </div>
+                      <div class="text-caption col-grow">
+                        <span>Fees</span>
+                        <q-btn
+                          size="xs"
+                          flat
+                          dense
+                          icon="settings"
+                          @click="showSetFeeDialog(props.row.id)"
+                        ></q-btn>
+                        <span v-if="props.row.fee_ppm">
+                          <span v-text="props.row.fee_ppm"></span> ppm,
+                          <span v-text="props.row.fee_base_msat"></span> msat
+                        </span>
+                      </div>
+                      <div class="text-caption" v-if="props.row.id">
+                        <span>Channel ID</span>
+                        <q-btn
+                          size="xs"
+                          flat
+                          dense
+                          icon="content_paste"
+                          @click="copyText(props.row.id)"
+                        ></q-btn>
+                      </div>
                      <div class="text-caption" v-if="props.row.short_id">
                        <span v-text="props.row.short_id"></span>
                        <q-btn
@@ -201,6 +271,7 @@
                        color="pink"
                      ></q-btn>
                    </div>
+
                    <lnbits-channel-balance
                      :balance="props.row.balance"
                      :color="props.row.color"
--- a/Show More
+++ b/Show More