Feature: System settings in DB - configurable backend URLs and API key

backend/api/handlers.go

@@ -59,6 +59,10 @@ func (h *Handler) SetupRoutes(mux *http.ServeMux, hub *ws.Hub) {
 	mux.HandleFunc("POST /api/v1/apikeys", h.createAPIKey)
 	mux.HandleFunc("DELETE /api/v1/apikeys/{id}", h.deleteAPIKey)
 
+	// System Settings
+	mux.HandleFunc("GET /api/v1/settings", h.getSettings)
+	mux.HandleFunc("PUT /api/v1/settings", h.updateSettings)
+
 	// Audit-Log
 	mux.HandleFunc("GET /api/v1/audit", h.getAuditLogs)
 

backend/api/settings.go

@@ -0,0 +1,58 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// GET /api/v1/settings
+func (h *Handler) getSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := h.db.GetSettings()
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "Settings laden fehlgeschlagen")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"data": settings})
+}
+
+// PUT /api/v1/settings (JWT only - checked via context)
+func (h *Handler) updateSettings(w http.ResponseWriter, r *http.Request) {
+	// JWT-only: check that user context exists
+	claims := r.Context().Value(UserContextKey)
+	if claims == nil {
+		writeError(w, http.StatusForbidden, "Nur mit JWT-Authentifizierung erlaubt")
+		return
+	}
+
+	var body map[string]string
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, http.StatusBadRequest, "Ungueltige Anfrage")
+		return
+	}
+
+	allowedKeys := map[string]bool{
+		"backend_url_internal": true,
+		"backend_url_external": true,
+		"api_key":              true,
+	}
+
+	var changed []string
+	for k, v := range body {
+		if !allowedKeys[k] {
+			continue
+		}
+		if err := h.db.SetSetting(k, v); err != nil {
+			writeError(w, http.StatusInternalServerError, fmt.Sprintf("Setting '%s' speichern fehlgeschlagen", k))
+			return
+		}
+		changed = append(changed, k)
+	}
+
+	if len(changed) > 0 {
+		h.auditLog(r, "settings.update", "settings", "", "", "Geaendert: "+strings.Join(changed, ", "))
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"message": "Settings aktualisiert"})
+}

backend/db/postgres.go

@@ -216,6 +216,17 @@ func (d *Database) migrate() error {
 	)`)
 	d.db.Exec(`CREATE INDEX IF NOT EXISTS idx_audit_log_timestamp ON audit_log(timestamp DESC)`)
 
+	// System Settings Tabelle
+	d.db.Exec(`CREATE TABLE IF NOT EXISTS system_settings (
+		key TEXT PRIMARY KEY,
+		value TEXT NOT NULL,
+		updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+	)`)
+	// Default-Keys anlegen (leere Werte)
+	for _, k := range []string{"backend_url_internal", "backend_url_external", "api_key"} {
+		d.db.Exec(`INSERT INTO system_settings (key, value) VALUES ($1, '') ON CONFLICT DO NOTHING`, k)
+	}
+
 	// Retention Policy (90 Tage)
 	d.setupRetention()
 
@@ -1197,6 +1208,42 @@ func (d *Database) GetAuditLogs(limit int, offset int, action string, agentID st
 	return entries, total, rows.Err()
 }
 
+// --- System Settings ---
+
+func (d *Database) GetSettings() (map[string]string, error) {
+	rows, err := d.db.Query("SELECT key, value FROM system_settings ORDER BY key")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	settings := make(map[string]string)
+	for rows.Next() {
+		var k, v string
+		if err := rows.Scan(&k, &v); err != nil {
+			return nil, err
+		}
+		settings[k] = v
+	}
+	return settings, rows.Err()
+}
+
+func (d *Database) GetSetting(key string) (string, error) {
+	var value string
+	err := d.db.QueryRow("SELECT value FROM system_settings WHERE key = $1", key).Scan(&value)
+	if err != nil {
+		return "", err
+	}
+	return value, nil
+}
+
+func (d *Database) SetSetting(key, value string) error {
+	_, err := d.db.Exec(`
+		INSERT INTO system_settings (key, value, updated_at) VALUES ($1, $2, NOW())
+		ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()
+	`, key, value)
+	return err
+}
+
 func (d *Database) MigrateConfigAPIKeys(configKeys []string) {
 	for _, key := range configKeys {
 		var exists bool