Security: remove hardcoded credentials, use placeholders and config

2026-03-04 08:17:37 +01:00 · 2026-03-04 08:17:37 +01:00 · 7f5bb07409
commit 7f5bb07409
parent 240cbe37fa
19 changed files with 252 additions and 231 deletions
--- a/.gitignore
+++ b/.gitignore
@ -11,3 +11,5 @@ opnsense-plugin/stage/
 opnsense-plugin/*.pkg
 frontend/node_modules/
 frontend/dist/
+agent/config.yaml
+backend/config.yaml
--- a/README.md
+++ b/README.md
@ -172,14 +172,14 @@ rmm/
 ## Zugangsdaten

 ```
-Backend:   https://192.168.85.13:8443
-API-Key:   01532e5a7c9e70bf2757df77a2f5b9b9
-Frontend:  http://192.168.85.20 (admin / Start!123)
+Backend:   https://your-backend:8443
+API-Key:   YOUR_API_KEY
+Frontend:  http://your-backend (admin / YOUR_PASSWORD)

 Agent-IDs:
-  6beb8dfd38ecf03eab6c0f21b4ac7bee  OPN-PROD.intra.weidenhaupt.net  (192.168.85.1, READ-ONLY)
-  e92e87a684b20db15d8d2344583c5887  OPN-REP.intra.weidenhaupt.net   (192.168.85.33)
-  1697d28e57bc126534afc282b5de8ee0  OPN-TEST-UPDATE                 (192.168.85.19)
+  6beb8dfd38ecf03eab6c0f21b4ac7bee  OPN-PROD.intra.weidenhaupt.net  (your-backend, READ-ONLY)
+  e92e87a684b20db15d8d2344583c5887  OPN-REP.intra.weidenhaupt.net   (your-backend)
+  1697d28e57bc126534afc282b5de8ee0  OPN-TEST-UPDATE                 (your-backend)
 ```

 ## Lizenz
--- a/agent/config.yaml.example
+++ b/agent/config.yaml.example
@ -0,0 +1,6 @@
+# RMM Agent Konfiguration
+backend_url: "https://your-backend:8443"
+api_key: "YOUR_API_KEY"
+interval_seconds: 60
+agent_name: "your-agent-name"
+insecure: true
--- a/backend/config.yaml.example
+++ b/backend/config.yaml.example
@ -0,0 +1,8 @@
+# RMM Backend Konfiguration
+listen_addr: ":8443"
+tls_cert: "certs/server.crt"
+tls_key: "certs/server.key"
+db_path: "rmm.db"
+
+api_keys:
+  - "YOUR_API_KEY"
--- a/docs/API.md
+++ b/docs/API.md
@ -2,7 +2,7 @@

 Vollstaendige REST API Dokumentation mit allen Endpoints und Beispielen.

-**Base-URL**: `https://192.168.85.13:8443/api/v1`
+**Base-URL**: `https://your-backend:8443/api/v1`

 ## Authentifizierung

@ -15,7 +15,7 @@ Zwei Auth-Methoden (CombinedAuth Middleware):
 | POST | `/auth/login` | Login (username + password → JWT Token, 8h Ablauf) |
 | GET | `/auth/me` | Eigene Benutzerdaten |

-Default-Admin: `admin` / `Start!123` (min. 6 Zeichen).
+Default-Admin: `admin` / `YOUR_PASSWORD` (min. 6 Zeichen).

 ---

@ -51,28 +51,28 @@ Bei Agent-Registration wird automatisch nach Name gematcht (`GetAgentByName`).

 ```bash
 # Alle Agents auflisten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents

 # Einzelner Agent mit Systemdaten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887

 # Nur Systemdaten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/system
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/system

 # Agent loeschen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X DELETE \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887

 # Hub-Status (verbundene Agents, aktive Tunnel)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/hub/status
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/hub/status

 # Remote-Command ausfuehren
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/exec \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/exec \
  -d '{"command":"uptime","timeout":30}'
 ```

@ -89,12 +89,12 @@ Event-Typen: `online`, `offline`, `stale`, `connected`, `disconnected`

 ```bash
 # Alle Events (letzte 10)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/events?limit=10"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/events?limit=10"

 # Nur Offline-Events eines Agents
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?type=offline"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?type=offline"
 ```

 ---
@ -142,20 +142,20 @@ Retention: 90 Tage (Raw), Compression nach 7 Tagen.

 ```bash
 # CPU-Auslastung der letzten 24h
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics?metric=cpu_usage"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics?metric=cpu_usage"

 # RAM-Nutzung mit Zeitraum
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics?metric=memory_used_percent&from=2026-02-28T00:00:00Z&to=2026-02-28T23:59:59Z"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics?metric=memory_used_percent&from=2026-02-28T00:00:00Z&to=2026-02-28T23:59:59Z"

 # 5-Minuten-Durchschnitte der CPU
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=cpu_usage&bucket=5+minutes"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=cpu_usage&bucket=5+minutes"

 # Stuendliche RAM-Zusammenfassung
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=memory_used_percent&bucket=1+hour"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=memory_used_percent&bucket=1+hour"
 ```

 ---
@ -176,21 +176,21 @@ Backups werden dedupliziert: gleicher SHA256-Hash = kein neuer Eintrag.

 ```bash
 # Backup ausloesen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backup
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backup

 # Alle Backups auflisten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backups
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backups

 # Neuestes Backup als XML herunterladen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/latest?format=xml" \
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/latest?format=xml" \
  -o config-backup.xml

 # Diff zwischen Backup 1 und 3
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/diff?a=1&b=3"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/diff?a=1&b=3"
 ```

 ---
@ -208,25 +208,25 @@ curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \

 ```bash
 # SSH-Tunnel zur OPNsense
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
  -d '{"target_host":"127.0.0.1","target_port":22}'
 # Response: {"tunnel_id":"xxx","proxy_port":10000,...}
-# Verbinden: ssh -p 10000 root@192.168.85.13
+# Verbinden: ssh -p 10000 root@your-backend

 # WebGUI-Tunnel (OPNsense auf Port 4444)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
  -d '{"target_host":"127.0.0.1","target_port":4444}'
-# Im Browser: https://192.168.85.13:10001/
+# Im Browser: https://your-backend:10001/

 # Aktive Tunnel auflisten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnels
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnels

 # Tunnel schliessen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel/TUNNEL_ID
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X DELETE \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel/TUNNEL_ID
 ```

 ---
@ -289,22 +289,22 @@ Siehe [FIRMWARE.md](FIRMWARE.md) fuer Details.

 ```bash
 # Peer anlegen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers \
  -d '{"name":"VPN_MUELLER","allowed_ips":"0.0.0.0/0","dns":"10.172.100.210"}'

 # Peer mit eigenem Endpoint
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers \
  -d '{"name":"VPN_EXTERN","allowed_ips":"0.0.0.0/0","endpoint":"vpn.kunde.de:8080"}'

 # Alle Peers auflisten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers

 # Peer loeschen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X DELETE \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
 ```

 ---
--- a/docs/BACKEND.md
+++ b/docs/BACKEND.md
@ -145,7 +145,7 @@ Beim ersten Start:
 - Tabellen werden automatisch angelegt
 - Hypertable `metrics` wird erstellt (TimescaleDB)
 - Retention Policy (90 Tage) und Compression Policy (nach 7 Tagen) werden automatisch gesetzt
- Default-Admin `admin` / `Start!123` wird erstellt
+- Default-Admin `admin` / `YOUR_PASSWORD` wird erstellt

 ## Datenbank-Schema (automatisch)

@ -173,7 +173,7 @@ Beim ersten Start:

 ## API Endpoints

-Base-URL: `https://192.168.85.13:8443/api/v1`
+Base-URL: `https://your-backend:8443/api/v1`

 ### Authentifizierung

@ -188,8 +188,8 @@ GET    /auth/me         Eigene Benutzerdaten

 ```bash
 # Login
-curl -sk -X POST https://192.168.85.13:8443/api/v1/auth/login \
-  -d '{"username":"admin","password":"Start!123"}'
+curl -sk -X POST https://your-backend:8443/api/v1/auth/login \
+  -d '{"username":"admin","password":"YOUR_PASSWORD"}'
 # → {"token":"eyJhbG...","user":{"id":1,"username":"admin"}}
 ```

@ -209,29 +209,29 @@ POST   /agent/heartbeat           Heartbeat + Systemdaten (vom Agent)

 ```bash
 # Alle Agents
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents

 # Agent mit Systemdaten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee

 # Nur Systemdaten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/system
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/system

 # Pre-Registrierung
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents \
  -d '{"name":"OPN.intra.kunde.de","customer_id":1}'

 # Agent loeschen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X DELETE \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887

 # Kunden zuordnen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X PUT \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/customer \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X PUT \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/customer \
  -d '{"customer_id":1}'
 ```

@ -254,11 +254,11 @@ GET    /agents/{id}/events        Events eines Agents
 Event-Typen: `online`, `offline`, `stale`, `connected`, `disconnected`

 ```bash
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/events?limit=10"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/events?limit=10"

-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?type=offline"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?type=offline"
 ```

 ### Remote-Befehle (Exec)
@ -268,8 +268,8 @@ POST   /agents/{id}/exec          Shell-Befehl ausfuehren
 ```

 ```bash
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/exec \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/exec \
  -d '{"command":"uptime","timeout":30}'
 # → {"data":{"output":"10:30AM  up 45 days, ..."},"status":"ok"}
 ```
@ -284,30 +284,30 @@ DELETE /agents/{id}/tunnel/{tid}  Tunnel schliessen

 ```bash
 # SSH-Tunnel
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
  -d '{"target_host":"127.0.0.1","target_port":22}'
 # → {"tunnel_id":"abc123","proxy_port":10000,...}
-# Verbinden: ssh -p 10000 root@192.168.85.13
+# Verbinden: ssh -p 10000 root@your-backend

 # WebGUI-Tunnel (OPNsense Port 4444)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel \
  -d '{"target_host":"127.0.0.1","target_port":4444}'
-# Im Browser: https://192.168.85.13:10001/
+# Im Browser: https://your-backend:10001/

 # PVE WebGUI-Tunnel (Proxmox Port 8006)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/3f0a83a25d6fcdd8a623e76953559c87/tunnel \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/3f0a83a25d6fcdd8a623e76953559c87/tunnel \
  -d '{"target_host":"127.0.0.1","target_port":8006}'

 # Aktive Tunnel
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnels
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnels

 # Tunnel schliessen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel/abc123
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X DELETE \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/tunnel/abc123
 ```

 Tunnel-Architektur:
@ -328,21 +328,21 @@ GET    /agents/{id}/backups/diff           Diff (?a=ID&b=ID)

 ```bash
 # Backup ausloesen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backup
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backup

 # Alle Backups
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backups
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/backups

 # Neuestes als XML
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/latest?format=xml" \
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/latest?format=xml" \
  -o config-backup.xml

 # Diff
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/diff?a=1&b=3"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/backups/diff?a=1&b=3"
 ```

 Deduplizierung: Gleicher SHA256-Hash = kein neuer Eintrag.
@ -359,17 +359,17 @@ Peer-Anlage: Keypair generiert auf Firewall, naechste freie IP automatisch, Endp

 ```bash
 # Peer anlegen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers \
  -d '{"name":"VPN_MUELLER","allowed_ips":"0.0.0.0/0","dns":"10.172.100.210"}'

 # Alle Peers
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers

 # Peer loeschen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X DELETE \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
 ```

 ### Kunden (Customers)
@ -385,18 +385,18 @@ GET    /customers/{id}/agents      Agents eines Kunden

 ```bash
 # Kunden anlegen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/customers \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/customers \
  -d '{"number":"K05001","name":"Beispiel GmbH"}'

 # Kunden aktualisieren
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X PUT \
-  https://192.168.85.13:8443/api/v1/customers/1 \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X PUT \
+  https://your-backend:8443/api/v1/customers/1 \
  -d '{"number":"K05001","name":"Beispiel AG"}'

 # Agents eines Kunden
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/customers/1/agents
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/customers/1/agents
 ```

 ### Benutzer (Users)
@ -411,12 +411,12 @@ DELETE /users/{id}                 Benutzer loeschen
 ```bash
 # Benutzer anlegen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/users \
+  https://your-backend:8443/api/v1/users \
  -d '{"username":"operator","password":"Sicher!123"}'

 # Passwort aendern
 curl -sk -H "Authorization: Bearer <TOKEN>" -X PUT \
-  https://192.168.85.13:8443/api/v1/users/1/password \
+  https://your-backend:8443/api/v1/users/1/password \
  -d '{"password":"NeuesPasswort!123"}'
 ```

@ -431,16 +431,16 @@ Verfuegbare Metriken: `cpu_usage`, `memory_used_percent`, `memory_used_bytes`, `

 ```bash
 # CPU letzte 24h
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics?metric=cpu_usage"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics?metric=cpu_usage"

 # 5-Minuten-Durchschnitte
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=cpu_usage&bucket=5+minutes"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=cpu_usage&bucket=5+minutes"

 # Stuendliche RAM-Zusammenfassung mit Zeitraum
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=memory_used_percent&bucket=1+hour&from=2026-03-01T00:00:00Z&to=2026-03-01T23:59:59Z"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/metrics/summary?metric=memory_used_percent&bucket=1+hour&from=2026-03-01T00:00:00Z&to=2026-03-01T23:59:59Z"
 ```

 ### Updates & Reboot
@ -454,27 +454,27 @@ POST   /agents/{id}/reboot          Reboot

 ```bash
 # Update-Check
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update-check
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update-check

 # Update mit Reboot
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update \
  -d '{"reboot":true}'

 # Major-Update Phase 1 (Base+Kernel, dann Reboot)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/major-update \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/major-update \
  -d '{"version":"26.1","reboot":true}'

 # Major-Update Phase 2 (nach Reboot: Packages)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/major-update \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/major-update \
  -d '{"version":"26.1","phase":"2"}'

 # Reboot
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/reboot \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/reboot \
  -d '{"delay":5}'
 ```

@ -492,34 +492,34 @@ POST   /agents/{id}/agent-update           Legacy: Binary direkt via WebSocket p

 ```bash
 # Firmware-Info
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/firmware
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/firmware

 # Nur FreeBSD-Firmware
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  "https://192.168.85.13:8443/api/v1/firmware?platform=freebsd"
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  "https://your-backend:8443/api/v1/firmware?platform=freebsd"

 # Firmware hochladen (FreeBSD)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  "https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  "https://your-backend:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
  --data-binary @build/rmm-agent

 # Firmware hochladen (Linux)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  "https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.1&platform=linux" \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  "https://your-backend:8443/api/v1/firmware/upload?version=1.0.1&platform=linux" \
  --data-binary @build/rmm-agent-linux

 # Update fuer einzelnen Agent anfordern
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/request-update
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/request-update

 # Update-Flag zuruecksetzen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/request-update
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X DELETE \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/request-update

 # Alle Agents updaten
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/request-update-all
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/request-update-all
 ```

 Update-Flow: Frontend setzt Flag → Updater (separater Prozess auf Firewall) pollt alle 60s → Download + SHA256-Verify + Rollback bei Fehler → Flag wird geloescht.
@ -533,8 +533,8 @@ GET    /hub/status                        Hub-Status

 ```bash
 # Hub-Status (verbundene Agents, aktive Tunnel)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
-  https://192.168.85.13:8443/api/v1/hub/status
+curl -sk -H "X-API-Key: YOUR_API_KEY" \
+  https://your-backend:8443/api/v1/hub/status
 ```

 WebSocket Commands (Backend → Agent):
--- a/docs/FIRMWARE.md
+++ b/docs/FIRMWARE.md
@ -40,22 +40,22 @@ Der Update-Prozess fuer Agent-Binaries nutzt den **rmm-updater** Daemon:

 ```bash
 # FreeBSD Agent hochladen
-curl -sk -X POST "https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
-  -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
+curl -sk -X POST "https://your-backend:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
+  -H "X-API-Key: YOUR_API_KEY" \
  --data-binary @build/rmm-agent

 # Linux Agent hochladen
-curl -sk -X POST "https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.3&platform=linux" \
-  -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" \
+curl -sk -X POST "https://your-backend:8443/api/v1/firmware/upload?version=1.0.3&platform=linux" \
+  -H "X-API-Key: YOUR_API_KEY" \
  --data-binary @build/rmm-agent-linux

 # Update fuer einzelnen Agent anfordern
-curl -sk -X POST "https://192.168.85.13:8443/api/v1/agents/e92e87a6.../request-update" \
-  -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9"
+curl -sk -X POST "https://your-backend:8443/api/v1/agents/e92e87a6.../request-update" \
+  -H "X-API-Key: YOUR_API_KEY"

 # Update fuer alle Agents anfordern
-curl -sk -X POST "https://192.168.85.13:8443/api/v1/agents/request-update-all" \
-  -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9"
+curl -sk -X POST "https://your-backend:8443/api/v1/agents/request-update-all" \
+  -H "X-API-Key: YOUR_API_KEY"
 ```

 ### Updater — Technische Details
@ -102,20 +102,20 @@ z.B. 25.7 → 26.1:

 ```bash
 # Verfuegbare Updates pruefen
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update-check
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update-check

 # Normales Update mit Reboot
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/update \
  -d '{"reboot":true}'

 # Major-Upgrade auf Version 26.7
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/major-update \
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/major-update \
  -d '{"version":"26.7","reboot":true}'

 # Reboot (5s Verzoegerung default)
-curl -sk -H "X-API-Key: 01532e5a7c9e70bf2757df77a2f5b9b9" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/reboot
+curl -sk -H "X-API-Key: YOUR_API_KEY" -X POST \
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887/reboot
 ```
--- a/docs/FRONTEND.md
+++ b/docs/FRONTEND.md
@ -4,11 +4,11 @@ React + Vite + TailwindCSS Web-Frontend, deployed als statische Dateien auf Ngin

 ## Eckdaten

- **Server**: 192.168.85.20 (Debian 13, Nginx)
+- **Server**: your-backend (Debian 13, Nginx)
 - **Tech**: React 18, Vite, TailwindCSS, Recharts, Zustand, lucide-react
 - **Theme**: Dark mit Orange-Akzent, komplett deutsch
 - **Auth**: JWT Login (8h Token)
- **Default-Login**: `admin` / `Start!123`
+- **Default-Login**: `admin` / `YOUR_PASSWORD`

 ## Seiten

@ -54,8 +54,8 @@ Im **Uebersicht-Tab** des AgentPanel:
 ```bash
 cd frontend
 npm run build                                              # ~330 KB JS, ~32 KB CSS
-ssh root@192.168.85.20 'rm -rf /var/www/html/assets/*'     # Alte Hashes loeschen!
-scp -r dist/* root@192.168.85.20:/var/www/html/
+ssh root@your-backend 'rm -rf /var/www/html/assets/*'     # Alte Hashes loeschen!
+scp -r dist/* root@your-backend:/var/www/html/
 ```

 **Wichtig:** Vor Deploy immer `assets/` loeschen — Vite generiert Hash-basierte Dateinamen, alte Dateien bleiben sonst auf dem Server und Browser-Cache liefert 404.
--- a/docs/POSTGRES_SETUP.md
+++ b/docs/POSTGRES_SETUP.md
@ -1,6 +1,6 @@
 # PostgreSQL + TimescaleDB Setup

-Anleitung fuer die Einrichtung von PostgreSQL mit TimescaleDB-Extension auf dem RMM-Backend-Server (192.168.85.13, Debian 13 Trixie).
+Anleitung fuer die Einrichtung von PostgreSQL mit TimescaleDB-Extension auf dem RMM-Backend-Server (your-backend, Debian 13 Trixie).

 ## 1. PostgreSQL installieren

@ -57,7 +57,7 @@ sudo -u postgres psql
 CREATE DATABASE rmm;

 -- User anlegen (Passwort anpassen!)
-CREATE USER rmm WITH PASSWORD 'Cynf0-RMM-2026!';
+CREATE USER rmm WITH PASSWORD 'YOUR_DB_PASSWORD';

 -- Rechte vergeben
 GRANT ALL PRIVILEGES ON DATABASE rmm TO rmm;
@ -92,7 +92,7 @@ systemctl reload postgresql

 ```bash
 psql -h 127.0.0.1 -U rmm -d rmm -c "SELECT version();"
-# Passwort: Cynf0-RMM-2026!
+# Passwort: YOUR_DB_PASSWORD

 psql -h 127.0.0.1 -U rmm -d rmm -c "SELECT extname, extversion FROM pg_extension WHERE extname = 'timescaledb';"
 # Sollte timescaledb mit Version zeigen
@ -218,7 +218,7 @@ database:
  host: "127.0.0.1"
  port: 5432
  user: "rmm"
-  password: "Cynf0-RMM-2026!"
+  password: "YOUR_DB_PASSWORD"
  dbname: "rmm"
  sslmode: "disable"
 ```
--- a/frontend/README.md
+++ b/frontend/README.md
@ -6,12 +6,12 @@ React + Vite + TailwindCSS Web-Frontend fuer das OPNsense RMM System.

 | | |
 |---|---|
-| **Server** | 192.168.85.20 (Debian 13, Nginx) |
+| **Server** | your-backend (Debian 13, Nginx) |
 | **Tech** | React 18, Vite, TailwindCSS, Recharts, Zustand, lucide-react |
 | **Theme** | Dark mit Orange-Akzent, komplett deutsch |
 | **Auth** | JWT Login (8h Token) |
-| **Default-Login** | `admin` / `Start!123` |
-| **Backend** | https://192.168.85.13:8443 |
+| **Default-Login** | `admin` / `YOUR_PASSWORD` |
+| **Backend** | https://your-backend:8443 |

 ## Seiten

@ -61,13 +61,13 @@ GET    /api/v1/auth/me             Eigene Benutzerdaten
 **Beispiel:**
 ```bash
 # Login
-curl -sk -X POST https://192.168.85.13:8443/api/v1/auth/login \
-  -d '{"username":"admin","password":"Start!123"}'
+curl -sk -X POST https://your-backend:8443/api/v1/auth/login \
+  -d '{"username":"admin","password":"YOUR_PASSWORD"}'
 # → {"token":"eyJhbG...","user":{"id":1,"username":"admin"}}

 # Eigene Daten
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/auth/me
+  https://your-backend:8443/api/v1/auth/me
 ```

 ### Agents (Firewalls)
@ -86,28 +86,28 @@ DELETE /api/v1/agents/{id}/customer  Kundenzuordnung entfernen
 ```bash
 # Alle Agents
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/agents
+  https://your-backend:8443/api/v1/agents

 # Agent-Details mit Systemdaten
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee

 # Firewall pre-registrieren
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents \
+  https://your-backend:8443/api/v1/agents \
  -d '{"name":"OPN.intra.kunde.de","customer_id":1}'

 # Agent loeschen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887
+  https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887

 # Events (letzte 50)
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?limit=50"
+  "https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?limit=50"

 # Kunden zuordnen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X PUT \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/customer \
+  https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/customer \
  -d '{"customer_id":1}'
 ```

@ -125,17 +125,17 @@ GET    /api/v1/customers/{id}/agents  Agents eines Kunden
 ```bash
 # Kunden anlegen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/customers \
+  https://your-backend:8443/api/v1/customers \
  -d '{"number":"K05001","name":"Beispiel GmbH"}'

 # Kunden aktualisieren
 curl -sk -H "Authorization: Bearer <TOKEN>" -X PUT \
-  https://192.168.85.13:8443/api/v1/customers/1 \
+  https://your-backend:8443/api/v1/customers/1 \
  -d '{"number":"K05001","name":"Beispiel AG"}'

 # Agents eines Kunden
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/customers/1/agents
+  https://your-backend:8443/api/v1/customers/1/agents
 ```

 ### Benutzer (Users)
@ -151,12 +151,12 @@ DELETE /api/v1/users/{id}          Benutzer loeschen
 ```bash
 # Benutzer anlegen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/users \
+  https://your-backend:8443/api/v1/users \
  -d '{"username":"operator","password":"Sicher!123"}'

 # Passwort aendern
 curl -sk -H "Authorization: Bearer <TOKEN>" -X PUT \
-  https://192.168.85.13:8443/api/v1/users/1/password \
+  https://your-backend:8443/api/v1/users/1/password \
  -d '{"password":"NeuesPasswort!123"}'
 ```

@ -173,15 +173,15 @@ Verfuegbare Metriken: `cpu_usage`, `memory_used_percent`, `memory_used_bytes`, `
 ```bash
 # CPU letzte 24h
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../metrics?metric=cpu_usage"
+  "https://your-backend:8443/api/v1/agents/6beb8dfd.../metrics?metric=cpu_usage"

 # RAM mit Zeitraum
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../metrics?metric=memory_used_percent&from=2026-03-01T00:00:00Z&to=2026-03-01T23:59:59Z"
+  "https://your-backend:8443/api/v1/agents/6beb8dfd.../metrics?metric=memory_used_percent&from=2026-03-01T00:00:00Z&to=2026-03-01T23:59:59Z"

 # 5-Minuten-Durchschnitte
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../metrics/summary?metric=cpu_usage&bucket=5+minutes"
+  "https://your-backend:8443/api/v1/agents/6beb8dfd.../metrics/summary?metric=cpu_usage&bucket=5+minutes"
 ```

 ### Config-Backups
@ -199,20 +199,20 @@ GET    /api/v1/agents/{id}/backups/diff      Diff (?a=ID&b=ID)
 ```bash
 # Backup ausloesen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backup
+  https://your-backend:8443/api/v1/agents/6beb8dfd.../backup

 # Backups auflisten
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backups
+  https://your-backend:8443/api/v1/agents/6beb8dfd.../backups

 # Als XML herunterladen
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backups/latest?format=xml" \
+  "https://your-backend:8443/api/v1/agents/6beb8dfd.../backups/latest?format=xml" \
  -o config-backup.xml

 # Diff zwischen zwei Backups
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  "https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backups/diff?a=1&b=3"
+  "https://your-backend:8443/api/v1/agents/6beb8dfd.../backups/diff?a=1&b=3"
 ```

 ### Tunnel
@ -227,29 +227,29 @@ DELETE /api/v1/agents/{id}/tunnel/{tid}     Tunnel schliessen
 ```bash
 # SSH-Tunnel
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnel \
+  https://your-backend:8443/api/v1/agents/e92e87a6.../tunnel \
  -d '{"target_host":"127.0.0.1","target_port":22}'
 # → {"tunnel_id":"abc123","proxy_port":10000,...}
-# Dann: ssh -p 10000 root@192.168.85.13
+# Dann: ssh -p 10000 root@your-backend

 # WebGUI-Tunnel (OPNsense Port 4444)
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnel \
+  https://your-backend:8443/api/v1/agents/e92e87a6.../tunnel \
  -d '{"target_host":"127.0.0.1","target_port":4444}'
-# Im Browser: https://192.168.85.13:10001/
+# Im Browser: https://your-backend:10001/

 # PVE WebGUI-Tunnel (Proxmox Port 8006)
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/3f0a83a2.../tunnel \
+  https://your-backend:8443/api/v1/agents/3f0a83a2.../tunnel \
  -d '{"target_host":"127.0.0.1","target_port":8006}'

 # Aktive Tunnel
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnels
+  https://your-backend:8443/api/v1/agents/e92e87a6.../tunnels

 # Tunnel schliessen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnel/abc123
+  https://your-backend:8443/api/v1/agents/e92e87a6.../tunnel/abc123
 ```

 ### WireGuard Peer-Management
@ -264,17 +264,17 @@ DELETE /api/v1/agents/{id}/wireguard/peers/{uuid}  Peer loeschen
 ```bash
 # Peer anlegen (Auto: Keypair, naechste freie IP, Endpoint)
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../wireguard/peers \
+  https://your-backend:8443/api/v1/agents/6beb8dfd.../wireguard/peers \
  -d '{"name":"VPN_MUELLER","allowed_ips":"0.0.0.0/0","dns":"10.172.100.210"}'
 # → {peer_config: "[Interface]\nPrivateKey=...\n[Peer]\n...", ...}

 # Alle Peers
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../wireguard/peers
+  https://your-backend:8443/api/v1/agents/6beb8dfd.../wireguard/peers

 # Peer loeschen
 curl -sk -H "Authorization: Bearer <TOKEN>" -X DELETE \
-  https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
+  https://your-backend:8443/api/v1/agents/6beb8dfd.../wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
 ```

 ### Remote-Befehle (Exec)
@ -286,7 +286,7 @@ POST   /api/v1/agents/{id}/exec    Befehl ausfuehren
 **Beispiel:**
 ```bash
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../exec \
+  https://your-backend:8443/api/v1/agents/e92e87a6.../exec \
  -d '{"command":"uptime","timeout":30}'
 # → {"data":{"output":"10:30AM  up 45 days, ..."}, "status":"ok"}
 ```
@ -304,16 +304,16 @@ POST   /api/v1/agents/{id}/reboot          Reboot
 ```bash
 # Update-Check
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../update-check
+  https://your-backend:8443/api/v1/agents/e92e87a6.../update-check

 # Update mit Reboot
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../update \
+  https://your-backend:8443/api/v1/agents/e92e87a6.../update \
  -d '{"reboot":true}'

 # Major-Update Phase 1
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../major-update \
+  https://your-backend:8443/api/v1/agents/e92e87a6.../major-update \
  -d '{"version":"26.1","reboot":true}'
 ```

@ -332,25 +332,25 @@ POST   /api/v1/agents/request-update-all       Alle Agents updaten
 ```bash
 # Firmware-Info
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/firmware
+  https://your-backend:8443/api/v1/firmware

 # Firmware hochladen (FreeBSD)
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  "https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
+  "https://your-backend:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
  --data-binary @build/rmm-agent

 # Firmware hochladen (Linux)
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  "https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.1&platform=linux" \
+  "https://your-backend:8443/api/v1/firmware/upload?version=1.0.1&platform=linux" \
  --data-binary @build/rmm-agent-linux

 # Update fuer einzelnen Agent anfordern
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/e92e87a6.../request-update
+  https://your-backend:8443/api/v1/agents/e92e87a6.../request-update

 # Update fuer alle Agents
 curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
-  https://192.168.85.13:8443/api/v1/agents/request-update-all
+  https://your-backend:8443/api/v1/agents/request-update-all
 ```

 ### Hub-Status
@ -362,7 +362,7 @@ GET    /api/v1/hub/status          WebSocket Hub Status
 **Beispiel:**
 ```bash
 curl -sk -H "Authorization: Bearer <TOKEN>" \
-  https://192.168.85.13:8443/api/v1/hub/status
+  https://your-backend:8443/api/v1/hub/status
 # → {"connected_agents":3,"active_tunnels":1}
 ```

@ -376,8 +376,8 @@ npm install
 npm run build                                              # ~330 KB JS, ~32 KB CSS

 # Deploy
-ssh root@192.168.85.20 'rm -rf /var/www/html/assets/*'     # Alte Hashes loeschen!
-scp -r dist/* root@192.168.85.20:/var/www/html/
+ssh root@your-backend 'rm -rf /var/www/html/assets/*'     # Alte Hashes loeschen!
+scp -r dist/* root@your-backend:/var/www/html/
 ```

 **Wichtig:** Vor Deploy immer `assets/` loeschen — Vite generiert Hash-basierte Dateinamen, alte Dateien bleiben sonst auf dem Server.
@ -389,7 +389,7 @@ cd frontend
 npm run dev     # Startet Vite Dev-Server mit Proxy zu Backend
 ```

-Vite Proxy-Config (`vite.config.js`): `/api/` wird auf `https://192.168.85.13:8443` weitergeleitet.
+Vite Proxy-Config (`vite.config.js`): `/api/` wird auf `https://your-backend:8443` weitergeleitet.

 ## Dateistruktur

--- a/frontend/src/components/AgentPanel.jsx
+++ b/frontend/src/components/AgentPanel.jsx
@ -2,6 +2,7 @@ import { useEffect, useState } from 'react'
 import api from '../api/client'
 import StatusBadge from './StatusBadge'
 import { copyToClipboard } from '../utils/clipboard'
+import { BACKEND_HOST } from '../config'
 import {
  X, Cpu, MemoryStick, HardDrive, Clock, Network, Shield, Route,
  Globe, Key, Download, Terminal, Wifi, Search, Plus, Trash2, Copy, Check, ExternalLink, Unplug, Plug, MonitorSmartphone,
@ -568,7 +569,7 @@ function TunnelTab({ agentId, agent }) {
  const [error, setError] = useState('')
  const [sshCopied, setSshCopied] = useState(null)

-  const backendHost = '192.168.85.13'
+  const backendHost = BACKEND_HOST

  const loadTunnels = () => {
    api.getTunnels(agentId)
--- a/frontend/src/components/InstallGuide.jsx
+++ b/frontend/src/components/InstallGuide.jsx
@ -1,9 +1,7 @@
 import { useState } from 'react'
 import { Copy, Check, Terminal, Monitor } from 'lucide-react'
 import { copyToClipboard } from '../utils/clipboard'
-
-const BACKEND_URL = 'https://dsbmueller.spdns.org:8443'
-const API_KEY = '01532e5a7c9e70bf2757df77a2f5b9b9'
+import { BACKEND_URL, API_KEY } from '../config'

 export default function InstallGuide({ agentName, platform: initialPlatform }) {
  const [platform, setPlatform] = useState(initialPlatform || 'freebsd')
--- a/frontend/src/components/ProxmoxPanel.jsx
+++ b/frontend/src/components/ProxmoxPanel.jsx
@ -1,5 +1,6 @@
 import { useEffect, useState } from 'react'
 import api from '../api/client'
+import { BACKEND_HOST } from '../config'
 import StatusBadge from './StatusBadge'
 import {
  X, Cpu, MemoryStick, HardDrive, Clock, Network, Server, Monitor,
@ -673,7 +674,7 @@ function TunnelTab({ agentId, agent, webguiPort = 8006 }) {
  const [customPort, setCustomPort] = useState('')
  const [error, setError] = useState('')

-  const backendHost = '192.168.85.13'
+  const backendHost = BACKEND_HOST

  const loadTunnels = () => {
    api.getTunnels(agentId)
--- a/frontend/src/config.js
+++ b/frontend/src/config.js
@ -0,0 +1,4 @@
+// Frontend-Konfiguration — bei Deployment anpassen
+export const BACKEND_HOST = 'your-backend.example.com'
+export const BACKEND_URL = `https://${BACKEND_HOST}:8443`
+export const API_KEY = 'YOUR_API_KEY'
--- a/frontend/src/pages/Firmware.jsx
+++ b/frontend/src/pages/Firmware.jsx
@ -9,7 +9,7 @@ const PLATFORMS = [
  { id: 'windows', label: 'Windows', icon: Cpu },
 ]

-const BACKEND_URL = 'https://dsbmueller.spdns.org:8443'
+import { BACKEND_URL } from '../config'

 export default function Firmware() {
  const [firmwareData, setFirmwareData] = useState(null)
@ -243,10 +243,10 @@ export default function Firmware() {
        {installerData?.installers?.some(i => i.platform === 'freebsd') && (
          <div className="mb-4 bg-gray-950 rounded p-3 relative">
            <div className="text-[10px] text-gray-500 mb-1">Installationsbefehl (OPNsense):</div>
-            <pre className="text-xs font-mono text-orange-300 whitespace-pre-wrap">{`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=01532e5a7c9e70bf2757df77a2f5b9b9" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`}</pre>
+            <pre className="text-xs font-mono text-orange-300 whitespace-pre-wrap">{`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=YOUR_API_KEY" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`}</pre>
            <button
              onClick={() => {
-                copyToClipboard(`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=01532e5a7c9e70bf2757df77a2f5b9b9" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`)
+                copyToClipboard(`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=YOUR_API_KEY" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`)
                setCopied(true)
                setTimeout(() => setCopied(false), 2000)
              }}
--- a/frontend/src/pages/SettingsPage.jsx
+++ b/frontend/src/pages/SettingsPage.jsx
@ -3,6 +3,7 @@ import api from '../api/client'
 import { useAuthStore } from '../stores/auth'
 import { copyToClipboard } from '../utils/clipboard'
 import { Plus, Trash2, KeyRound, ShieldAlert, Copy, Check, Key } from 'lucide-react'
+import { BACKEND_HOST } from '../config'

 export default function SettingsPage() {
  const [users, setUsers] = useState([])
@ -211,7 +212,7 @@ export default function SettingsPage() {
        <div className="px-4 py-3 space-y-1 text-sm">
          <div className="flex justify-between">
            <span className="text-gray-500">Backend</span>
-            <span className="text-gray-400">192.168.85.13:8443</span>
+            <span className="text-gray-400">{BACKEND_HOST + ':8443'}</span>
          </div>
          <div className="flex justify-between">
            <span className="text-gray-500">Authentifizierung</span>
--- a/frontend/src/pages/Tunnels.jsx
+++ b/frontend/src/pages/Tunnels.jsx
@ -4,7 +4,7 @@ import api from '../api/client'
 import StatusBadge from '../components/StatusBadge'
 import { Cable, Unplug, ExternalLink, RefreshCw, Search } from 'lucide-react'

-const BACKEND_HOST = '192.168.85.13'
+import { BACKEND_HOST } from '../config'

 export default function Tunnels() {
  const [agents, setAgents] = useState([])
--- a/frontend/vite.config.js
+++ b/frontend/vite.config.js
@ -7,7 +7,7 @@ export default defineConfig({
  server: {
    proxy: {
      '/api': {
-        target: 'https://192.168.85.13:8443',
+        target: 'https://your-backend:8443', // TODO: set your backend URL
        changeOrigin: true,
        secure: false,
      },
--- a/opnsense-plugin/install.sh
+++ b/opnsense-plugin/install.sh
@ -16,8 +16,8 @@ set -e
 BASEDIR="/tmp"
 BINARY="${BASEDIR}/rmm-agent"
 UPDATER_BINARY="${BASEDIR}/rmm-updater"
-BACKEND_URL="${RMM_BACKEND:-https://dsbmueller.spdns.org:8443}"
-API_KEY="${RMM_API_KEY:-01532e5a7c9e70bf2757df77a2f5b9b9}"
+BACKEND_URL="${RMM_BACKEND:-https://your-backend:8443}"
+API_KEY="${RMM_API_KEY:-YOUR_API_KEY}"

 echo "========================================"
 echo " RMM Agent Plugin Installer"
@ -412,7 +412,7 @@ cat > /usr/local/opnsense/mvc/app/controllers/OPNsense/RMMAgent/forms/general.xm
        <id>rmmagent.general.BackendUrl</id>
        <label>Backend URL</label>
        <type>text</type>
-        <help>URL des RMM Backends (z.B. https://192.168.85.13:8443)</help>
+        <help>URL des RMM Backends (z.B. https://your-backend:8443)</help>
    </field>
    <field>
        <id>rmmagent.general.ApiKey</id>