cmdbsyncer 4.1.0.dev1__tar.gz → 4.1.0.dev2__tar.gz

{cmdbsyncer-4.1.0.dev1/cmdbsyncer.egg-info → cmdbsyncer-4.1.0.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cmdbsyncer
-Version: 4.1.0.dev1
+Version: 4.1.0.dev2
 Summary: Rule-based modular synchronizer for Checkmk, Netbox, Ansible, I-DOIT, Jira CMDB and 15+ other CMDB/monitoring systems
 Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
 Maintainer-email: Bastian Kuhn <mail@bastian-kuhn.de>

{cmdbsyncer-4.1.0.dev1 → cmdbsyncer-4.1.0.dev2}/application/auth/views.py

@@ -15,7 +15,7 @@ from joserfc.errors import JoseError
 from mongoengine.errors import DoesNotExist
 
 from application import login_manager, app, log, limiter
-from application.enterprise import run_hook
+from application.enterprise import has_feature, run_hook
 from application.helpers.audit import audit
 from application.models.user import User
 from application.themes_registry import get_choices as theme_choices, is_known as theme_is_known
@@ -27,6 +27,23 @@ AUTH_RATE_LIMIT = app.config.get('AUTH_RATE_LIMIT', '3 per minute; 10 per hour')
 AUTH = Blueprint('auth', __name__)
 
 
+def _dbg(message, **details):
+    """Write a Settings → Log entry only when AUTH_DEBUG is on."""
+    if not app.config.get('AUTH_DEBUG'):
+        return
+    log.log(message, source='AUTH', details=details or None)
+
+
+def _candidate_remote_user_headers(req):
+    """Common reverse-proxy headers that *should* carry the user id when
+    REMOTE_USER itself is empty. Helps operators spot a misconfigured
+    Apache/nginx that forwards e.g. ``X-Forwarded-User`` instead of
+    setting the WSGI ``REMOTE_USER`` environ key."""
+    wanted = {'x-remote-user', 'x-forwarded-user',
+              'remote-user', 'x-authenticated-user', 'x-auth-user'}
+    return {k: v for k, v in req.headers.items() if k.lower() in wanted} or None
+
+
 @AUTH.errorhandler(429)
 def ratelimit_handler(_error):
     """Generic message on rate-limit hit; details intentionally omitted."""
@@ -53,33 +70,56 @@ def login():  # pylint: disable=too-many-return-statements,too-many-branches,too
         flash('Already Logged in')
         return redirect(url_for("admin.index"))
 
-    if app.config['REMOTE_USER_LOGIN'] and request.remote_user:
-        try:
-            existing_user = run_hook('remote_user', request)
-            if existing_user:
-                session.clear()
-                login_user(
-                    existing_user,
-                    remember=False,
-                    duration=timedelta(
-                        hours=(current_app.config['ADMIN_SESSION_HOURS'] or 8)
+    if app.config['REMOTE_USER_LOGIN']:
+        _dbg('remote_user dispatcher: entry',
+             remote_user=request.remote_user or None,
+             has_remote_user=bool(request.remote_user),
+             remote_addr=request.remote_addr,
+             trusted_proxies=app.config.get('TRUSTED_PROXIES', 0),
+             enterprise_hook_registered=has_feature('remote_user'))
+        if not request.remote_user:
+            _dbg('remote_user dispatcher: REMOTE_USER_LOGIN is on, but '
+                 'the proxy did not pass REMOTE_USER',
+                 remote_addr=request.remote_addr,
+                 candidate_headers=_candidate_remote_user_headers(request))
+        else:
+            try:
+                existing_user = run_hook('remote_user', request)
+                if existing_user:
+                    session.clear()
+                    login_user(
+                        existing_user,
+                        remember=False,
+                        duration=timedelta(
+                            hours=(current_app.config['ADMIN_SESSION_HOURS'] or 8)
+                        )
                     )
-                )
-                existing_user.last_login = datetime.utcnow()
-                existing_user.save()
-                audit('user.login.success',
-                      actor_type='user',
-                      actor_id=str(existing_user.id),
-                      actor_name=existing_user.email,
-                      metadata={'method': 'remote_user'})
-                return redirect(url_for("admin.index"))
-        except Exception:  # pylint: disable=broad-exception-caught
-            log.log("Remote User login failed", source="AUTH")
-            audit('user.login.failure', outcome='failure',
-                  actor_name=request.remote_user,
-                  metadata={'method': 'remote_user',
-                            'reason': 'hook_exception'})
-            flash('Remote User Error', 'danger')
+                    existing_user.last_login = datetime.utcnow()
+                    existing_user.save()
+                    audit('user.login.success',
+                          actor_type='user',
+                          actor_id=str(existing_user.id),
+                          actor_name=existing_user.email,
+                          metadata={'method': 'remote_user'})
+                    _dbg('remote_user dispatcher: login success',
+                         remote_user=request.remote_user,
+                         user_id=str(existing_user.id),
+                         email=existing_user.email)
+                    return redirect(url_for("admin.index"))
+                _dbg('remote_user dispatcher: hook returned no user — '
+                     'falling through to login form',
+                     remote_user=request.remote_user,
+                     enterprise_hook_registered=has_feature('remote_user'))
+            except Exception as exp:  # pylint: disable=broad-exception-caught
+                log.log("Remote User login failed", source="AUTH")
+                _dbg('remote_user dispatcher: hook raised exception',
+                     remote_user=request.remote_user,
+                     error=f'{exp.__class__.__name__}: {exp}')
+                audit('user.login.failure', outcome='failure',
+                      actor_name=request.remote_user,
+                      metadata={'method': 'remote_user',
+                                'reason': 'hook_exception'})
+                flash('Remote User Error', 'danger')
 
 
     login_form = LoginForm(request.form)

cmdbsyncer-4.1.0.dev2/application/buildinfo.txt

@@ -0,0 +1 @@
+BUILD_DATE=2026-05-08T11:38:53Z

{cmdbsyncer-4.1.0.dev1 → cmdbsyncer-4.1.0.dev2}/application/changelog/v4.1.md

@@ -82,6 +82,7 @@
 - FEAT: Drop a `.css` file into `plugins/themes/` to add your own theme to the picker
 - FEAT: Set Theme, Set 2FA and Change Password pages now keep the admin navigation
 - FIX: Settings → License menu entry is hidden on Community Edition installs (no enterprise package present), so admins are not pointed at a page with no upload form and an empty feature table
+- FIX: PyPI installs ship the bundled theme CSS files (Gruvbox Dark / Light, Nord, Dracula) so the theme picker actually shows themes other than Default
 
 ### Plugin runtime
 - FIX: HTTP sessions and CA-cert temp files are released even when a plugin's init fails
@@ -90,7 +91,7 @@
 - FEAT: `cmdbsyncer sys self_configure` now creates a default `app.wsgi` so PyPI installs can be served by Apache/mod_wsgi or uWSGI without writing one by hand
 - FIX: `Edit local_config.py` GUI now writes to the same `local_config.py` Python actually imports. PyPI installs previously wrote into site-packages instead of the deployment directory next to `app.wsgi`
 - FEAT: Offline installation bundle always ships base, extras and ansible Python dependencies plus the default Ansible playbook collection, and the bundled `install.sh` deploys the playbooks to `/opt/cmdbsyncer/ansible` (override via `ANSIBLE_TARGET`, skip with `SKIP_ANSIBLE=1`, replace existing target with `FORCE=1`)
-- FEAT: New `make release-pre` target ships sequential pre-release builds (`.devN` / `aN` / `bN` / `rcN`) to PyPI without requiring a hand-edit before each upload; `tools/build_offline_bundle.sh --pre` lets the offline bundle pick those pre-releases up so QA can test them on air-gapped systems
+- FEAT: New `make release-pre` target ships sequential pre-release builds (`.devN` / `aN` / `bN` / `rcN`) to PyPI without requiring a hand-edit before each upload; `tools/build_offline_bundle.sh --syncer-version 4.1.0.dev3 --enterprise-version 0.3.9.dev1` pins the offline bundle to those pre-releases so QA can test them on air-gapped systems
 
 ### Refactor
 - REFACTOR: `application/views/host.py` split into focused modules (widgets, filters, renderers)

cmdbsyncer-4.1.0.dev2/application/themes/dracula.css

@@ -0,0 +1,234 @@
+/* @name: Dracula */
+:root {
+    --nav-bg: #21222c;
+    --nav-link: #f8f8f2;
+    --cmk-group-bg: #bd93f9;
+    --cmk-group-bg-hover: #ff79c6;
+    --cmk-group-fg: #282a36;
+    --cmk-group-border: #44475a;
+}
+body, .main-container, .container, .container-fluid {
+    background-color: #282a36 !important;
+    color: #f8f8f2;
+}
+a { color: #8be9fd; }
+a:hover, a:focus { color: #f1fa8c; }
+h1, h2, h3, h4, h5, h6, label, legend, .form-text, p { color: #f8f8f2; }
+
+.table, .model-list, .table.searchable, .table.table-bordered {
+    --bs-table-bg: #343746;
+    --bs-table-color: #f8f8f2;
+    --bs-table-striped-bg: #2e303e;
+    --bs-table-striped-color: #f8f8f2;
+    --bs-table-hover-bg: #44475a;
+    --bs-table-hover-color: #f1fa8c;
+    --bs-table-border-color: #44475a;
+    --bs-table-active-bg: #44475a;
+    --bs-table-active-color: #f1fa8c;
+    background-color: #343746 !important;
+    color: #f8f8f2 !important;
+    border-color: #44475a !important;
+}
+.table th, .table td,
+.model-list th, .model-list td {
+    background-color: transparent !important;
+    color: #f8f8f2 !important;
+    border-color: #44475a !important;
+}
+.model-list thead th, .table thead th {
+    background-color: #44475a !important;
+    color: #f8f8f2 !important;
+    border-bottom-color: #6272a4 !important;
+    box-shadow: inset 0 -1px 0 #6272a4;
+}
+.table-striped > tbody > tr:nth-of-type(odd) > * {
+    background-color: #2e303e !important;
+    color: #f8f8f2 !important;
+}
+.table-hover > tbody > tr:hover > *,
+.table.searchable tbody tr:hover > * {
+    background-color: #44475a !important;
+    color: #f1fa8c !important;
+}
+.table.searchable td:first-child {
+    background-color: #2e303e !important;
+    color: #bd93f9 !important;
+}
+.table-responsive {
+    border-color: #44475a;
+    box-shadow: 0 2px 6px rgba(0,0,0,0.45);
+}
+
+.table .fa, .table .fas, .table .far, .table .glyphicon,
+.table a, .table a > i,
+.model-list .fa, .model-list .fas, .model-list .glyphicon,
+.model-list a, .model-list a > i {
+    color: #f8f8f2 !important;
+}
+.table a:hover, .table a:hover > i,
+.table .fa:hover, .table .glyphicon:hover,
+.model-list a:hover, .model-list a:hover > i {
+    color: #f1fa8c !important;
+}
+.icon-minus-sign, .fa-times, .fa-trash, .fa-remove { color: #ff5555 !important; }
+.icon-ok-circle, .fa-check, .fa-ok { color: #50fa7b !important; }
+
+.app-card, .card, fieldset.inline-field, .well, .panel,
+.rule-section, .rule-section-body {
+    background-color: #343746 !important;
+    border-color: #44475a !important;
+    color: #f8f8f2 !important;
+}
+.rule-section-head {
+    background-color: #2e303e !important;
+    border-bottom-color: #44475a !important;
+}
+.rule-section-head h4, .rule-section-head p { color: #f8f8f2 !important; }
+
+.form-control, .form-control:focus, .form-select,
+select, textarea,
+input[type=text], input[type=email], input[type=password],
+input[type=number], input[type=search], input[type=url],
+input[type=date], input[type=time], input[type=datetime-local] {
+    background-color: #21222c !important;
+    color: #f8f8f2 !important;
+    border-color: #44475a !important;
+}
+select option, .form-select option { background-color: #21222c; color: #f8f8f2; }
+.form-control::placeholder { color: #6272a4; }
+
+.dropdown-menu {
+    background-color: #343746 !important;
+    border-color: #44475a !important;
+    color: #f8f8f2 !important;
+}
+.dropdown-item, .dropdown-menu > li > a {
+    color: #f8f8f2 !important;
+}
+.dropdown-item:hover, .dropdown-item:focus,
+.dropdown-menu > li > a:hover, .dropdown-menu > li > a:focus {
+    background-color: #44475a !important;
+    color: #f1fa8c !important;
+}
+.dropdown-divider, .dropdown-menu .divider { border-top-color: #44475a !important; background-color: #44475a !important; }
+.dropdown-header { color: #6272a4 !important; }
+
+.btn-default, .btn-secondary, .btn-light,
+.btn-outline-secondary, .btn-outline-default {
+    background-color: #44475a !important;
+    border-color: #6272a4 !important;
+    color: #f8f8f2 !important;
+}
+.btn-default:hover, .btn-secondary:hover, .btn-light:hover,
+.btn-outline-secondary:hover, .btn-outline-default:hover {
+    background-color: #6272a4 !important;
+    color: #f1fa8c !important;
+}
+
+.pagination .page-link {
+    background-color: #343746;
+    color: #f8f8f2;
+    border-color: #44475a;
+}
+.pagination .page-item.active .page-link {
+    background-color: #bd93f9;
+    border-color: #bd93f9;
+    color: #282a36;
+}
+.pagination .page-link:hover { background-color: #44475a; color: #f1fa8c; }
+
+.modal-content { background-color: #343746 !important; color: #f8f8f2 !important; border-color: #44475a !important; }
+.modal-header, .modal-footer { border-color: #44475a !important; }
+.alert { background-color: #343746; color: #f8f8f2; border-color: #44475a; }
+
+.filters .filter-op, .filters select, .filters input { background-color: #21222c !important; color: #f8f8f2 !important; border-color: #44475a !important; }
+
+.home-hero { color: #f8f8f2 !important; border-bottom-color: #44475a !important; }
+.home-hero h1, .home-hero p { color: #f8f8f2 !important; }
+.home-hero .build-pill { background-color: #bd93f9 !important; color: #282a36 !important; }
+.home-card {
+    background-color: #343746 !important;
+    border-color: #44475a !important;
+    color: #f8f8f2 !important;
+    box-shadow: 0 2px 6px rgba(0,0,0,0.45) !important;
+}
+.home-card h2, .home-card h4 { color: #f8f8f2 !important; border-bottom-color: #44475a !important; }
+.links-list a { color: #8be9fd !important; }
+.links-list a:hover { color: #f1fa8c !important; }
+#changelog-content {
+    background-color: #2e303e !important;
+    border-color: #44475a !important;
+    color: #f8f8f2 !important;
+}
+#changelog-content details { border-left-color: #44475a !important; }
+#changelog-content details[open] { border-left-color: #bd93f9 !important; }
+#changelog-content summary.changelog-version::before { color: #6272a4 !important; }
+#changelog-content details[open] > summary.changelog-version::before { color: #bd93f9 !important; }
+#changelog-content .changelog-version-title { color: #f8f8f2 !important; }
+#changelog-content details[open] > summary .changelog-version-title { color: #f1fa8c !important; }
+.filter-chip { background-color: #2e303e !important; border-color: #44475a !important; color: #f8f8f2 !important; }
+.filter-chip.active-feat { color: #8be9fd !important; border-color: #8be9fd !important; background-color: #21222c !important; }
+.filter-chip.active-fix  { color: #50fa7b !important; border-color: #50fa7b !important; background-color: #21222c !important; }
+.filter-chip.active-inc  { color: #ff5555 !important; border-color: #ff5555 !important; background-color: #21222c !important; }
+.filter-chip.active-sec  { color: #ffb86c !important; border-color: #ffb86c !important; background-color: #21222c !important; }
+.filter-chip.active-oth  { color: #6272a4 !important; border-color: #44475a !important; background-color: #21222c !important; }
+.filter-toggle-all { background-color: #44475a !important; color: #f8f8f2 !important; }
+.filter-toggle-all:hover { background-color: #6272a4 !important; }
+.notice-box {
+    background-color: #343746 !important;
+    border-color: #ff79c6 !important;
+    border-left-color: #ff79c6 !important;
+    color: #f8f8f2 !important;
+}
+.notice-box .notice-confirm { background-color: #ff79c6 !important; color: #282a36 !important; }
+.notice-box .notice-confirm:hover { background-color: #bd93f9 !important; }
+.previous-releases a { background-color: #44475a !important; color: #f8f8f2 !important; }
+.previous-releases a:hover { background-color: #6272a4 !important; color: #f1fa8c !important; }
+
+/* Renderer-injected widgets. */
+.cmdb-label-row,
+.cmdb-inv-grid .cmdb-label-row { border-bottom-color: #44475a !important; }
+.cmdb-label-row .lbl-val,
+.cmdb-inv-grid .lbl-val { color: #f8f8f2 !important; }
+.cmdb-inv-grid .lbl-src { background: #44475a !important; color: #f8f8f2 !important; }
+.cmdb-log-list { background: #2e303e !important; border-color: #44475a !important; }
+.cmdb-log-row { border-bottom-color: #44475a !important; }
+.cmdb-log-row .log-msg { color: #f8f8f2 !important; }
+.cmdb-log-row .log-ts,
+.cmdb-log-meta { color: #6272a4 !important; }
+
+/* Nav-tabs strip at the top of every Flask-Admin edit/detail page. */
+.nav-tabs {
+    border-bottom-color: #44475a !important;
+}
+.nav-tabs .nav-link {
+    color: #f8f8f2 !important;
+    border-color: transparent !important;
+}
+.nav-tabs .nav-link:hover,
+.nav-tabs .nav-link:focus {
+    color: #f1fa8c !important;
+    border-color: #44475a #44475a #44475a !important;
+    background-color: #343746 !important;
+}
+.nav-tabs .nav-link.active,
+.nav-tabs .nav-item.show .nav-link {
+    background-color: #282a36 !important;
+    color: #f1fa8c !important;
+    border-color: #44475a #44475a #282a36 !important;
+}
+
+/* Theme-aware surface tokens — used by debug_host, _host_tabs,
+   ansible_project_detail, host_relations_graph, ansible_rule_list,
+   ansible_playbook_run and any future template that opts in via
+   var(--surface-*, fallback). */
+:root {
+    --surface-bg: #282a36;
+    --surface-subtle:  #343746;
+    --surface-border:  #44475a;
+    --surface-divider: #44475a;
+    --surface-text:    #f8f8f2;
+    --surface-muted:   #6272a4;
+    --debug-key:     #8be9fd;
+    --debug-row-hit: #2d4438;
+}

cmdbsyncer-4.1.0.dev2/application/themes/gruvbox-dark.css

@@ -0,0 +1,241 @@
+/* @name: Gruvbox Dark */
+:root {
+    --nav-bg: #1d2021;
+    --nav-link: #ebdbb2;
+    --cmk-group-bg: #504945;
+    --cmk-group-bg-hover: #665c54;
+    --cmk-group-fg: #fabd2f;
+    --cmk-group-border: #3c3836;
+}
+body, .main-container, .container, .container-fluid {
+    background-color: #282828 !important;
+    color: #ebdbb2;
+}
+a { color: #83a598; }
+a:hover, a:focus { color: #fabd2f; }
+h1, h2, h3, h4, h5, h6, label, legend, .form-text, p { color: #ebdbb2; }
+
+.table, .model-list, .table.searchable, .table.table-bordered {
+    --bs-table-bg: #3c3836;
+    --bs-table-color: #ebdbb2;
+    --bs-table-striped-bg: #32302f;
+    --bs-table-striped-color: #ebdbb2;
+    --bs-table-hover-bg: #504945;
+    --bs-table-hover-color: #fabd2f;
+    --bs-table-border-color: #504945;
+    --bs-table-active-bg: #504945;
+    --bs-table-active-color: #fabd2f;
+    background-color: #3c3836 !important;
+    color: #ebdbb2 !important;
+    border-color: #504945 !important;
+}
+.table th, .table td,
+.model-list th, .model-list td {
+    background-color: transparent !important;
+    color: #ebdbb2 !important;
+    border-color: #504945 !important;
+}
+.model-list thead th, .table thead th {
+    background-color: #504945 !important;
+    color: #ebdbb2 !important;
+    border-bottom-color: #665c54 !important;
+    box-shadow: inset 0 -1px 0 #665c54;
+}
+.table-striped > tbody > tr:nth-of-type(odd) > * {
+    background-color: #32302f !important;
+    color: #ebdbb2 !important;
+}
+.table-hover > tbody > tr:hover > *,
+.table.searchable tbody tr:hover > * {
+    background-color: #504945 !important;
+    color: #fabd2f !important;
+}
+.table.searchable td:first-child {
+    background-color: #32302f !important;
+    color: #fabd2f !important;
+}
+.table-responsive {
+    border-color: #504945;
+    box-shadow: 0 2px 6px rgba(0,0,0,0.45);
+}
+
+.table .fa, .table .fas, .table .far, .table .glyphicon,
+.table a, .table a > i,
+.model-list .fa, .model-list .fas, .model-list .glyphicon,
+.model-list a, .model-list a > i {
+    color: #ebdbb2 !important;
+}
+.table a:hover, .table a:hover > i,
+.table .fa:hover, .table .glyphicon:hover,
+.model-list a:hover, .model-list a:hover > i {
+    color: #fabd2f !important;
+}
+.icon-minus-sign, .fa-times, .fa-trash, .fa-remove { color: #fb4934 !important; }
+.icon-ok-circle, .fa-check, .fa-ok { color: #b8bb26 !important; }
+
+.app-card, .card, fieldset.inline-field, .well, .panel,
+.rule-section, .rule-section-body {
+    background-color: #3c3836 !important;
+    border-color: #504945 !important;
+    color: #ebdbb2 !important;
+}
+.rule-section-head {
+    background-color: #32302f !important;
+    border-bottom-color: #504945 !important;
+}
+.rule-section-head h4, .rule-section-head p { color: #ebdbb2 !important; }
+
+.form-control, .form-control:focus, .form-select,
+select, textarea,
+input[type=text], input[type=email], input[type=password],
+input[type=number], input[type=search], input[type=url],
+input[type=date], input[type=time], input[type=datetime-local] {
+    background-color: #32302f !important;
+    color: #ebdbb2 !important;
+    border-color: #504945 !important;
+}
+select option, .form-select option { background-color: #32302f; color: #ebdbb2; }
+.form-control::placeholder { color: #a89984; }
+
+.dropdown-menu {
+    background-color: #3c3836 !important;
+    border-color: #504945 !important;
+    color: #ebdbb2 !important;
+}
+.dropdown-item, .dropdown-menu > li > a {
+    color: #ebdbb2 !important;
+}
+.dropdown-item:hover, .dropdown-item:focus,
+.dropdown-menu > li > a:hover, .dropdown-menu > li > a:focus {
+    background-color: #504945 !important;
+    color: #fabd2f !important;
+}
+.dropdown-divider, .dropdown-menu .divider { border-top-color: #504945 !important; background-color: #504945 !important; }
+.dropdown-header { color: #a89984 !important; }
+
+.btn-default, .btn-secondary, .btn-light,
+.btn-outline-secondary, .btn-outline-default {
+    background-color: #504945 !important;
+    border-color: #665c54 !important;
+    color: #ebdbb2 !important;
+}
+.btn-default:hover, .btn-secondary:hover, .btn-light:hover,
+.btn-outline-secondary:hover, .btn-outline-default:hover {
+    background-color: #665c54 !important;
+    color: #fabd2f !important;
+}
+
+.pagination .page-link {
+    background-color: #3c3836;
+    color: #ebdbb2;
+    border-color: #504945;
+}
+.pagination .page-item.active .page-link {
+    background-color: #d79921;
+    border-color: #d79921;
+    color: #282828;
+}
+.pagination .page-link:hover { background-color: #504945; color: #fabd2f; }
+
+.modal-content { background-color: #3c3836 !important; color: #ebdbb2 !important; border-color: #504945 !important; }
+.modal-header, .modal-footer { border-color: #504945 !important; }
+.alert { background-color: #3c3836; color: #ebdbb2; border-color: #504945; }
+
+.filters .filter-op, .filters select, .filters input { background-color: #32302f !important; color: #ebdbb2 !important; border-color: #504945 !important; }
+
+.home-hero { color: #ebdbb2 !important; border-bottom-color: #504945 !important; }
+.home-hero h1, .home-hero p { color: #ebdbb2 !important; }
+.home-hero .build-pill { background-color: #d79921 !important; color: #282828 !important; }
+.home-card {
+    background-color: #3c3836 !important;
+    border-color: #504945 !important;
+    color: #ebdbb2 !important;
+    box-shadow: 0 2px 6px rgba(0,0,0,0.45) !important;
+}
+.home-card h2, .home-card h4 { color: #ebdbb2 !important; border-bottom-color: #504945 !important; }
+.links-list a { color: #ebdbb2 !important; }
+.links-list a:hover { color: #fabd2f !important; }
+#changelog-content {
+    background-color: #32302f !important;
+    border-color: #504945 !important;
+    color: #ebdbb2 !important;
+}
+#changelog-content details { border-left-color: #504945 !important; }
+#changelog-content details[open] { border-left-color: #83a598 !important; }
+#changelog-content summary.changelog-version::before { color: #a89984 !important; }
+#changelog-content details[open] > summary.changelog-version::before { color: #83a598 !important; }
+#changelog-content .changelog-version-title { color: #d5c4a1 !important; }
+#changelog-content details[open] > summary .changelog-version-title { color: #ebdbb2 !important; }
+.filter-chip { background-color: #32302f !important; border-color: #504945 !important; color: #ebdbb2 !important; }
+.filter-chip.active-feat { color: #83a598 !important; border-color: #458588 !important; background-color: #1d2021 !important; }
+.filter-chip.active-fix  { color: #b8bb26 !important; border-color: #98971a !important; background-color: #1d2021 !important; }
+.filter-chip.active-inc  { color: #fb4934 !important; border-color: #cc241d !important; background-color: #1d2021 !important; }
+.filter-chip.active-sec  { color: #fe8019 !important; border-color: #d65d0e !important; background-color: #1d2021 !important; }
+.filter-chip.active-oth  { color: #a89984 !important; border-color: #504945 !important; background-color: #1d2021 !important; }
+.filter-toggle-all { background-color: #504945 !important; color: #ebdbb2 !important; }
+.filter-toggle-all:hover { background-color: #665c54 !important; }
+.notice-box {
+    background-color: #3c3836 !important;
+    border-color: #d79921 !important;
+    border-left-color: #fabd2f !important;
+    color: #ebdbb2 !important;
+}
+.notice-box .notice-confirm { background-color: #d79921 !important; color: #282828 !important; }
+.notice-box .notice-confirm:hover { background-color: #b57614 !important; }
+.previous-releases a { background-color: #504945 !important; color: #ebdbb2 !important; }
+.previous-releases a:hover { background-color: #665c54 !important; color: #fabd2f !important; }
+
+/* Renderer-injected widgets: host_renderers.py emits inline <style>
+   blocks with hardcoded light-theme colours (e.g. .lbl-val:#2c3e50 on
+   white). Override the few classes whose colours don't read on dark
+   backgrounds. The badges themselves keep their contrast. */
+.cmdb-label-row,
+.cmdb-inv-grid .cmdb-label-row { border-bottom-color: #504945 !important; }
+.cmdb-label-row .lbl-val,
+.cmdb-inv-grid .lbl-val { color: #ebdbb2 !important; }
+.cmdb-inv-grid .lbl-src { background: #504945 !important; color: #ebdbb2 !important; }
+.cmdb-log-list { background: #32302f !important; border-color: #504945 !important; }
+.cmdb-log-row { border-bottom-color: #504945 !important; }
+.cmdb-log-row .log-msg { color: #ebdbb2 !important; }
+.cmdb-log-row .log-ts,
+.cmdb-log-meta { color: #a89984 !important; }
+
+/* Nav-tabs strip at the top of every Flask-Admin edit/detail page
+   (List / Create / Edit / Details). Bootstrap defaults give the
+   active tab a white border-bottom and inactive tabs default link
+   blue, both invisible on dark themes. */
+.nav-tabs {
+    border-bottom-color: #504945 !important;
+}
+.nav-tabs .nav-link {
+    color: #ebdbb2 !important;
+    border-color: transparent !important;
+}
+.nav-tabs .nav-link:hover,
+.nav-tabs .nav-link:focus {
+    color: #fabd2f !important;
+    border-color: #504945 #504945 #504945 !important;
+    background-color: #3c3836 !important;
+}
+.nav-tabs .nav-link.active,
+.nav-tabs .nav-item.show .nav-link {
+    background-color: #282828 !important;
+    color: #fabd2f !important;
+    border-color: #504945 #504945 #282828 !important;
+}
+
+
+/* Theme-aware surface tokens — used by debug_host, _host_tabs,
+   ansible_project_detail, host_relations_graph, ansible_rule_list,
+   ansible_playbook_run and any future template that opts in via
+   var(--surface-*, fallback). */
+:root {
+    --surface-bg: #3c3836;
+    --surface-subtle:  #504945;
+    --surface-border:  #504945;
+    --surface-divider: #504945;
+    --surface-text:    #ebdbb2;
+    --surface-muted:   #a89984;
+    --debug-key:     #8ec07c;
+    --debug-row-hit: #2d4a2d;
+}