Initial commit: Telemetry service for ProxmoxVE/VED

- Go microservice for anonymous telemetry collection - PocketBase integration for data storage - Rate limiting and caching support - SMTP alerts for failure rate monitoring - Built-in dashboard for visualization - Migration tool for data import - GDPR/DSGVO compliant (no personal data, no IP logging)
2026-07-01 13:54:38 -04:00 · 2026-02-09 20:35:41 +01:00
parent dff2afc694
commit 1e0127d51a
13 changed files with 3583 additions and 3 deletions
@@ -7,6 +7,8 @@
 *.dll
 *.so
 *.dylib
+telemetry-service
+migration/migrate

 # Test binary, built with `go test -c`
 *.test
@@ -0,0 +1,52 @@
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum* ./
+RUN go mod download 2>/dev/null || true
+COPY . .
+RUN go build -trimpath -ldflags "-s -w" -o /out/telemetry-service .
+RUN go build -trimpath -ldflags "-s -w" -o /out/migrate ./migration/migrate.go
+
+FROM alpine:3.23
+RUN apk add --no-cache ca-certificates tzdata
+WORKDIR /app
+COPY --from=build /out/telemetry-service /app/telemetry-service
+COPY --from=build /out/migrate /app/migrate
+COPY entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh /app/migrate
+
+# Service config
+ENV LISTEN_ADDR=":8080"
+ENV MAX_BODY_BYTES="1024"
+ENV RATE_LIMIT_RPM="60"
+ENV RATE_BURST="20"
+ENV UPSTREAM_TIMEOUT_MS="4000"
+ENV ENABLE_REQUEST_LOGGING="false"
+
+# Cache config (optional)
+ENV ENABLE_CACHE="true"
+ENV CACHE_TTL_SECONDS="60"
+ENV ENABLE_REDIS="false"
+# ENV REDIS_URL="redis://localhost:6379"
+
+# Alert config (optional)
+ENV ALERT_ENABLED="false"
+# ENV SMTP_HOST=""
+# ENV SMTP_PORT="587"
+# ENV SMTP_USER=""
+# ENV SMTP_PASSWORD=""
+# ENV SMTP_FROM="telemetry@proxmoxved.local"
+# ENV SMTP_TO=""
+# ENV SMTP_USE_TLS="false"
+ENV ALERT_FAILURE_THRESHOLD="20.0"
+ENV ALERT_CHECK_INTERVAL_MIN="15"
+ENV ALERT_COOLDOWN_MIN="60"
+
+# Migration config (optional)
+ENV RUN_MIGRATION="false"
+ENV MIGRATION_REQUIRED="false"
+ENV MIGRATION_SOURCE_URL="https://api.htl-braunau.at/dev/data"
+
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+    CMD wget -q --spider http://localhost:8080/healthz || exit 1
+ENTRYPOINT ["/app/entrypoint.sh"]
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2026 Proxmox Helper Scripts (CE)
+Copyright (c) 2026 Community Scripts

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -1,2 +1,81 @@
-# telemetry-service
-Standalone Go service for ProxmoxVE and ProxmoxVE data, cache, and telemetry.
+# Telemetry Service
+
+A standalone Go microservice that collects anonymous telemetry data from [ProxmoxVE](https://github.com/community-scripts/ProxmoxVE) and [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) script installations.
+
+## Overview
+
+This service acts as a telemetry ingestion layer between the bash installation scripts and a PocketBase backend. When users run scripts from the ProxmoxVE/ProxmoxVED repositories, optional anonymous usage data is sent here for aggregation and analysis.
+
+**What gets collected:**
+- Script name and installation status (success/failed)
+- Container/VM type and resource allocation (CPU, RAM, disk)
+- OS type and version
+- Proxmox VE version
+- Anonymous session ID (randomly generated UUID)
+
+**What is NOT collected:**
+- IP addresses (not logged, not stored)
+- Hostnames or domain names
+- User credentials or personal information
+- Hardware identifiers (MAC addresses, serial numbers)
+- Network configuration or internal IPs
+- Any data that could identify a person or system
+
+**What this enables:**
+- Understanding which scripts are most popular
+- Identifying scripts with high failure rates
+- Tracking resource allocation trends
+- Improving script quality based on real-world data
+
+## Features
+
+- **Telemetry Ingestion** - Receives and validates telemetry data from bash scripts
+- **PocketBase Integration** - Stores data in PocketBase collections
+- **Rate Limiting** - Configurable per-IP rate limiting to prevent abuse
+- **Caching** - In-memory or Redis-backed caching support
+- **Email Alerts** - SMTP-based alerts when failure rates exceed thresholds
+- **Dashboard** - Built-in HTML dashboard for telemetry visualization
+- **Migration Tool** - Migrate data from external sources to PocketBase
+
+## Architecture
+
+```
+┌─────────────────┐     ┌───────────────────┐     ┌────────────┐
+│  Bash Scripts   │────▶│ Telemetry Service │────▶│ PocketBase │
+│ (ProxmoxVE/VED) │     │    (this repo)    │     │  Database  │
+└─────────────────┘     └───────────────────┘     └────────────┘
+```
+
+## Project Structure
+
+```
+├── service.go          # Main service, HTTP handlers, rate limiting
+├── cache.go            # In-memory and Redis caching
+├── alerts.go           # SMTP alert system
+├── dashboard.go        # Dashboard HTML generation
+├── migration/
+│   ├── migrate.go      # Data migration tool
+│   └── migrate.sh      # Migration shell script
+├── Dockerfile          # Container build
+├── entrypoint.sh       # Container entrypoint with migration support
+└── go.mod              # Go module definition
+```
+
+## Related Projects
+
+- [ProxmoxVE](https://github.com/community-scripts/ProxmoxVE) - Proxmox VE Helper Scripts
+- [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) - Proxmox VE Helper Scripts (Dev)
+
+## Privacy & Compliance
+
+This service is designed with privacy in mind and is **GDPR/DSGVO compliant**:
+
+- ✅ **No personal data** - Only anonymous technical metrics are collected
+- ✅ **No IP logging** - Request logging is disabled by default, IPs are never stored
+- ✅ **Transparent** - All collected fields are documented and the code is open source
+- ✅ **No tracking** - Session IDs are randomly generated and cannot be linked to users
+- ✅ **No third parties** - Data is only stored in our self-hosted PocketBase instance
+
+## License
+
+MIT License - see [LICENSE](LICENSE) file.
@@ -0,0 +1,267 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"log"
+	"net/smtp"
+	"strings"
+	"sync"
+	"time"
+)
+
+// AlertConfig holds SMTP alert configuration
+type AlertConfig struct {
+	Enabled          bool
+	SMTPHost         string
+	SMTPPort         int
+	SMTPUser         string
+	SMTPPassword     string
+	SMTPFrom         string
+	SMTPTo           []string
+	UseTLS           bool
+	FailureThreshold float64       // Alert when failure rate exceeds this (e.g., 20.0 = 20%)
+	CheckInterval    time.Duration // How often to check
+	Cooldown         time.Duration // Minimum time between alerts
+}
+
+// Alerter handles alerting functionality
+type Alerter struct {
+	cfg          AlertConfig
+	lastAlertAt  time.Time
+	mu           sync.Mutex
+	pb           *PBClient
+	lastStats    alertStats
+	alertHistory []AlertEvent
+}
+
+type alertStats struct {
+	successCount int
+	failedCount  int
+	checkedAt    time.Time
+}
+
+// AlertEvent records an alert that was sent
+type AlertEvent struct {
+	Timestamp   time.Time `json:"timestamp"`
+	Type        string    `json:"type"`
+	Message     string    `json:"message"`
+	FailureRate float64   `json:"failure_rate,omitempty"`
+}
+
+// NewAlerter creates a new alerter instance
+func NewAlerter(cfg AlertConfig, pb *PBClient) *Alerter {
+	return &Alerter{
+		cfg:          cfg,
+		pb:           pb,
+		alertHistory: make([]AlertEvent, 0),
+	}
+}
+
+// Start begins the alert monitoring loop
+func (a *Alerter) Start() {
+	if !a.cfg.Enabled {
+		log.Println("INFO: alerting disabled")
+		return
+	}
+
+	if a.cfg.SMTPHost == "" || len(a.cfg.SMTPTo) == 0 {
+		log.Println("WARN: alerting enabled but SMTP not configured")
+		return
+	}
+
+	go a.monitorLoop()
+	log.Printf("INFO: alert monitoring started (threshold: %.1f%%, interval: %v)", a.cfg.FailureThreshold, a.cfg.CheckInterval)
+}
+
+func (a *Alerter) monitorLoop() {
+	ticker := time.NewTicker(a.cfg.CheckInterval)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		a.checkAndAlert()
+	}
+}
+
+func (a *Alerter) checkAndAlert() {
+	ctx, cancel := newTimeoutContext(10 * time.Second)
+	defer cancel()
+
+	// Fetch last hour's data
+	data, err := a.pb.FetchDashboardData(ctx, 1)
+	if err != nil {
+		log.Printf("WARN: alert check failed: %v", err)
+		return
+	}
+
+	// Calculate current failure rate
+	total := data.SuccessCount + data.FailedCount
+	if total < 10 {
+		// Not enough data to determine rate
+		return
+	}
+
+	failureRate := float64(data.FailedCount) / float64(total) * 100
+
+	// Check if we should alert
+	if failureRate >= a.cfg.FailureThreshold {
+		a.maybeSendAlert(failureRate, data.FailedCount, total)
+	}
+}
+
+func (a *Alerter) maybeSendAlert(rate float64, failed, total int) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	// Check cooldown
+	if time.Since(a.lastAlertAt) < a.cfg.Cooldown {
+		return
+	}
+
+	// Send alert
+	subject := fmt.Sprintf("[ProxmoxVED Alert] High Failure Rate: %.1f%%", rate)
+	body := fmt.Sprintf(`ProxmoxVE Helper Scripts - Telemetry Alert
+
+⚠️ High installation failure rate detected!
+
+Current Statistics (last 24h):
+- Failure Rate: %.1f%%
+- Failed Installations: %d
+- Total Installations: %d
+- Threshold: %.1f%%
+
+Time: %s
+
+Please check the dashboard for more details.
+
+---
+This is an automated alert from the telemetry service.
+`, rate, failed, total, a.cfg.FailureThreshold, time.Now().Format(time.RFC1123))
+
+	if err := a.sendEmail(subject, body); err != nil {
+		log.Printf("ERROR: failed to send alert email: %v", err)
+		return
+	}
+
+	a.lastAlertAt = time.Now()
+	a.alertHistory = append(a.alertHistory, AlertEvent{
+		Timestamp:   time.Now(),
+		Type:        "high_failure_rate",
+		Message:     fmt.Sprintf("Failure rate %.1f%% exceeded threshold %.1f%%", rate, a.cfg.FailureThreshold),
+		FailureRate: rate,
+	})
+
+	// Keep only last 100 alerts
+	if len(a.alertHistory) > 100 {
+		a.alertHistory = a.alertHistory[len(a.alertHistory)-100:]
+	}
+
+	log.Printf("ALERT: sent high failure rate alert (%.1f%%)", rate)
+}
+
+func (a *Alerter) sendEmail(subject, body string) error {
+	// Build message
+	var msg bytes.Buffer
+	msg.WriteString(fmt.Sprintf("From: %s\r\n", a.cfg.SMTPFrom))
+	msg.WriteString(fmt.Sprintf("To: %s\r\n", strings.Join(a.cfg.SMTPTo, ", ")))
+	msg.WriteString(fmt.Sprintf("Subject: %s\r\n", subject))
+	msg.WriteString("MIME-Version: 1.0\r\n")
+	msg.WriteString("Content-Type: text/plain; charset=UTF-8\r\n")
+	msg.WriteString("\r\n")
+	msg.WriteString(body)
+
+	addr := fmt.Sprintf("%s:%d", a.cfg.SMTPHost, a.cfg.SMTPPort)
+
+	var auth smtp.Auth
+	if a.cfg.SMTPUser != "" && a.cfg.SMTPPassword != "" {
+		auth = smtp.PlainAuth("", a.cfg.SMTPUser, a.cfg.SMTPPassword, a.cfg.SMTPHost)
+	}
+
+	if a.cfg.UseTLS {
+		// TLS connection
+		tlsConfig := &tls.Config{
+			ServerName: a.cfg.SMTPHost,
+		}
+
+		conn, err := tls.Dial("tcp", addr, tlsConfig)
+		if err != nil {
+			return fmt.Errorf("TLS dial failed: %w", err)
+		}
+		defer conn.Close()
+
+		client, err := smtp.NewClient(conn, a.cfg.SMTPHost)
+		if err != nil {
+			return fmt.Errorf("SMTP client failed: %w", err)
+		}
+		defer client.Close()
+
+		if auth != nil {
+			if err := client.Auth(auth); err != nil {
+				return fmt.Errorf("SMTP auth failed: %w", err)
+			}
+		}
+
+		if err := client.Mail(a.cfg.SMTPFrom); err != nil {
+			return fmt.Errorf("SMTP MAIL failed: %w", err)
+		}
+
+		for _, to := range a.cfg.SMTPTo {
+			if err := client.Rcpt(to); err != nil {
+				return fmt.Errorf("SMTP RCPT failed: %w", err)
+			}
+		}
+
+		w, err := client.Data()
+		if err != nil {
+			return fmt.Errorf("SMTP DATA failed: %w", err)
+		}
+
+		_, err = w.Write(msg.Bytes())
+		if err != nil {
+			return fmt.Errorf("SMTP write failed: %w", err)
+		}
+
+		return w.Close()
+	}
+
+	// Non-TLS (STARTTLS)
+	return smtp.SendMail(addr, auth, a.cfg.SMTPFrom, a.cfg.SMTPTo, msg.Bytes())
+}
+
+// GetAlertHistory returns recent alert events
+func (a *Alerter) GetAlertHistory() []AlertEvent {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	result := make([]AlertEvent, len(a.alertHistory))
+	copy(result, a.alertHistory)
+	return result
+}
+
+// TestAlert sends a test alert email
+func (a *Alerter) TestAlert() error {
+	if !a.cfg.Enabled || a.cfg.SMTPHost == "" {
+		return fmt.Errorf("alerting not configured")
+	}
+
+	subject := "[ProxmoxVED] Test Alert"
+	body := fmt.Sprintf(`This is a test alert from ProxmoxVE Helper Scripts telemetry service.
+
+If you received this email, your alert configuration is working correctly.
+
+Time: %s
+SMTP Host: %s
+Recipients: %s
+
+---
+This is an automated test message.
+`, time.Now().Format(time.RFC1123), a.cfg.SMTPHost, strings.Join(a.cfg.SMTPTo, ", "))
+
+	return a.sendEmail(subject, body)
+}
+
+// Helper for timeout context
+func newTimeoutContext(d time.Duration) (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), d)
+}
@@ -0,0 +1,158 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+// CacheConfig holds cache configuration
+type CacheConfig struct {
+	RedisURL    string
+	EnableRedis bool
+	DefaultTTL  time.Duration
+}
+
+// Cache provides caching functionality with Redis or in-memory fallback
+type Cache struct {
+	redis      *redis.Client
+	useRedis   bool
+	defaultTTL time.Duration
+
+	// In-memory fallback
+	mu      sync.RWMutex
+	memData map[string]cacheEntry
+}
+
+type cacheEntry struct {
+	data      []byte
+	expiresAt time.Time
+}
+
+// NewCache creates a new cache instance
+func NewCache(cfg CacheConfig) *Cache {
+	c := &Cache{
+		defaultTTL: cfg.DefaultTTL,
+		memData:    make(map[string]cacheEntry),
+	}
+
+	if cfg.EnableRedis && cfg.RedisURL != "" {
+		opts, err := redis.ParseURL(cfg.RedisURL)
+		if err != nil {
+			log.Printf("WARN: invalid redis URL, using in-memory cache: %v", err)
+			return c
+		}
+
+		client := redis.NewClient(opts)
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+
+		if err := client.Ping(ctx).Err(); err != nil {
+			log.Printf("WARN: redis connection failed, using in-memory cache: %v", err)
+			return c
+		}
+
+		c.redis = client
+		c.useRedis = true
+		log.Printf("INFO: connected to Redis for caching")
+	}
+
+	// Start cleanup goroutine for in-memory cache
+	if !c.useRedis {
+		go c.cleanupLoop()
+	}
+
+	return c
+}
+
+func (c *Cache) cleanupLoop() {
+	ticker := time.NewTicker(5 * time.Minute)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		c.mu.Lock()
+		now := time.Now()
+		for k, v := range c.memData {
+			if now.After(v.expiresAt) {
+				delete(c.memData, k)
+			}
+		}
+		c.mu.Unlock()
+	}
+}
+
+// Get retrieves a value from cache
+func (c *Cache) Get(ctx context.Context, key string, dest interface{}) bool {
+	if c.useRedis {
+		data, err := c.redis.Get(ctx, key).Bytes()
+		if err != nil {
+			return false
+		}
+		return json.Unmarshal(data, dest) == nil
+	}
+
+	// In-memory fallback
+	c.mu.RLock()
+	entry, ok := c.memData[key]
+	c.mu.RUnlock()
+
+	if !ok || time.Now().After(entry.expiresAt) {
+		return false
+	}
+
+	return json.Unmarshal(entry.data, dest) == nil
+}
+
+// Set stores a value in cache
+func (c *Cache) Set(ctx context.Context, key string, value interface{}, ttl time.Duration) error {
+	if ttl == 0 {
+		ttl = c.defaultTTL
+	}
+
+	data, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+
+	if c.useRedis {
+		return c.redis.Set(ctx, key, data, ttl).Err()
+	}
+
+	// In-memory fallback
+	c.mu.Lock()
+	c.memData[key] = cacheEntry{
+		data:      data,
+		expiresAt: time.Now().Add(ttl),
+	}
+	c.mu.Unlock()
+
+	return nil
+}
+
+// Delete removes a key from cache
+func (c *Cache) Delete(ctx context.Context, key string) error {
+	if c.useRedis {
+		return c.redis.Del(ctx, key).Err()
+	}
+
+	c.mu.Lock()
+	delete(c.memData, key)
+	c.mu.Unlock()
+	return nil
+}
+
+// InvalidateDashboard clears dashboard cache
+func (c *Cache) InvalidateDashboard(ctx context.Context) {
+	// Delete all dashboard cache keys
+	for days := 1; days <= 365; days++ {
+		_ = c.Delete(ctx, dashboardCacheKey(days))
+	}
+}
+
+func dashboardCacheKey(days int) string {
+	return "dashboard:" + string(rune(days))
+}
@@ -0,0 +1,55 @@
+#!/bin/sh
+set -e
+
+echo "============================================="
+echo "   ProxmoxVED Telemetry Service"
+echo "============================================="
+
+# Map Coolify ENV names to migration script names
+# Coolify uses PB_URL, PB_TARGET_COLLECTION
+export POCKETBASE_URL="${POCKETBASE_URL:-$PB_URL}"
+export POCKETBASE_COLLECTION="${POCKETBASE_COLLECTION:-$PB_TARGET_COLLECTION}"
+
+# Run migration if enabled
+if [ "$RUN_MIGRATION" = "true" ]; then
+    echo ""
+    echo "🔄 Migration mode enabled"
+    echo "   Source: $MIGRATION_SOURCE_URL"
+    echo "   Target: $POCKETBASE_URL"
+    echo "   Collection: $POCKETBASE_COLLECTION"
+    echo ""
+    
+    # Wait for PocketBase to be ready
+    echo "⏳ Waiting for PocketBase to be ready..."
+    RETRIES=30
+    until wget -q --spider "$POCKETBASE_URL/api/health" 2>/dev/null; do
+        RETRIES=$((RETRIES - 1))
+        if [ $RETRIES -le 0 ]; then
+            echo "❌ PocketBase not reachable after 30 attempts"
+            if [ "$MIGRATION_REQUIRED" = "true" ]; then
+                exit 1
+            fi
+            echo "⚠️  Continuing without migration..."
+            break
+        fi
+        echo "   Waiting... ($RETRIES attempts left)"
+        sleep 2
+    done
+    
+    if wget -q --spider "$POCKETBASE_URL/api/health" 2>/dev/null; then
+        echo "✅ PocketBase is ready"
+        echo ""
+        echo "🚀 Starting migration..."
+        /app/migrate || {
+            if [ "$MIGRATION_REQUIRED" = "true" ]; then
+                echo "❌ Migration failed!"
+                exit 1
+            fi
+            echo "⚠️  Migration failed, but continuing..."
+        }
+        echo ""
+    fi
+fi
+
+echo "🚀 Starting telemetry service..."
+exec /app/telemetry-service
@@ -0,0 +1,10 @@
+module github.com/community-scripts/telemetry-service
+
+go 1.25.5
+
+require github.com/redis/go-redis/v9 v9.7.0
+
+require (
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+)
@@ -0,0 +1,10 @@
+github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
+github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
+github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
+github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/redis/go-redis/v9 v9.7.0 h1:HhLSs+B6O021gwzl+locl0zEDnyNkxMtf/Z3NNBMa9E=
+github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93GewI7inzyWw=
@@ -0,0 +1,366 @@
+// +build ignore
+
+// Migration script to import data from the old API to PocketBase
+// Run with: go run migrate.go
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"time"
+)
+
+const (
+	defaultSourceAPI = "https://api.htl-braunau.at/dev/data"
+	defaultPBURL     = "http://localhost:8090"
+	batchSize        = 100
+)
+
+var (
+	sourceAPI  string
+	summaryAPI string
+	authToken  string // PocketBase auth token
+)
+
+// OldDataModel represents the data structure from the old API
+type OldDataModel struct {
+	ID         string `json:"id"`
+	CtType     int    `json:"ct_type"`
+	DiskSize   int    `json:"disk_size"`
+	CoreCount  int    `json:"core_count"`
+	RamSize    int    `json:"ram_size"`
+	OsType     string `json:"os_type"`
+	OsVersion  string `json:"os_version"`
+	DisableIP6 string `json:"disableip6"`
+	NsApp      string `json:"nsapp"`
+	Method     string `json:"method"`
+	CreatedAt  string `json:"created_at"`
+	PveVersion string `json:"pve_version"`
+	Status     string `json:"status"`
+	RandomID   string `json:"random_id"`
+	Type       string `json:"type"`
+	Error      string `json:"error"`
+}
+
+// PBRecord represents the PocketBase record format
+type PBRecord struct {
+	CtType     int    `json:"ct_type"`
+	DiskSize   int    `json:"disk_size"`
+	CoreCount  int    `json:"core_count"`
+	RamSize    int    `json:"ram_size"`
+	OsType     string `json:"os_type"`
+	OsVersion  string `json:"os_version"`
+	DisableIP6 string `json:"disableip6"`
+	NsApp      string `json:"nsapp"`
+	Method     string `json:"method"`
+	PveVersion string `json:"pve_version"`
+	Status     string `json:"status"`
+	RandomID   string `json:"random_id"`
+	Type       string `json:"type"`
+	Error      string `json:"error"`
+	// created_at will be set automatically by PocketBase
+}
+
+type Summary struct {
+	TotalEntries int `json:"total_entries"`
+}
+
+func main() {
+	// Setup source URLs
+	baseURL := os.Getenv("MIGRATION_SOURCE_URL")
+	if baseURL == "" {
+		baseURL = defaultSourceAPI
+	}
+	sourceAPI = baseURL + "/paginated"
+	summaryAPI = baseURL + "/summary"
+
+	// Support both POCKETBASE_URL and PB_URL (Coolify uses PB_URL)
+	pbURL := os.Getenv("POCKETBASE_URL")
+	if pbURL == "" {
+		pbURL = os.Getenv("PB_URL")
+	}
+	if pbURL == "" {
+		pbURL = defaultPBURL
+	}
+
+	// Support both POCKETBASE_COLLECTION and PB_TARGET_COLLECTION
+	pbCollection := os.Getenv("POCKETBASE_COLLECTION")
+	if pbCollection == "" {
+		pbCollection = os.Getenv("PB_TARGET_COLLECTION")
+	}
+	if pbCollection == "" {
+		pbCollection = "_dev_telemetry_data"
+	}
+
+	// Auth collection
+	authCollection := os.Getenv("PB_AUTH_COLLECTION")
+	if authCollection == "" {
+		authCollection = "_dev_telemetry_service"
+	}
+
+	// Credentials
+	pbIdentity := os.Getenv("PB_IDENTITY")
+	pbPassword := os.Getenv("PB_PASSWORD")
+
+	fmt.Println("===========================================")
+	fmt.Println("   Data Migration to PocketBase")
+	fmt.Println("===========================================")
+	fmt.Printf("Source API:       %s\n", baseURL)
+	fmt.Printf("PocketBase URL:   %s\n", pbURL)
+	fmt.Printf("Collection:       %s\n", pbCollection)
+	fmt.Printf("Auth Collection:  %s\n", authCollection)
+	fmt.Println("-------------------------------------------")
+
+	// Authenticate with PocketBase
+	if pbIdentity != "" && pbPassword != "" {
+		fmt.Println("🔐 Authenticating with PocketBase...")
+		err := authenticate(pbURL, authCollection, pbIdentity, pbPassword)
+		if err != nil {
+			fmt.Printf("❌ Authentication failed: %v\n", err)
+			os.Exit(1)
+		}
+		fmt.Println("✅ Authentication successful")
+	} else {
+		fmt.Println("⚠️  No credentials provided, trying without auth...")
+	}
+	fmt.Println("-------------------------------------------")
+
+	// Get total count
+	summary, err := getSummary()
+	if err != nil {
+		fmt.Printf("❌ Failed to get summary: %v\n", err)
+		os.Exit(1)
+	}
+	fmt.Printf("📊 Total entries to migrate: %d\n", summary.TotalEntries)
+	fmt.Println("-------------------------------------------")
+
+	// Calculate pages
+	totalPages := (summary.TotalEntries + batchSize - 1) / batchSize
+
+	var totalMigrated, totalFailed, totalSkipped int
+
+	for page := 1; page <= totalPages; page++ {
+		fmt.Printf("📦 Fetching page %d/%d (items %d-%d)...\n",
+			page, totalPages,
+			(page-1)*batchSize+1,
+			min(page*batchSize, summary.TotalEntries))
+
+		data, err := fetchPage(page, batchSize)
+		if err != nil {
+			fmt.Printf("   ❌ Failed to fetch page %d: %v\n", page, err)
+			totalFailed += batchSize
+			continue
+		}
+
+		for i, record := range data {
+			err := importRecord(pbURL, pbCollection, record)
+			if err != nil {
+				if isUniqueViolation(err) {
+					totalSkipped++
+					continue
+				}
+				fmt.Printf("   ❌ Failed to import record %d: %v\n", (page-1)*batchSize+i+1, err)
+				totalFailed++
+				continue
+			}
+			totalMigrated++
+		}
+
+		fmt.Printf("   ✅ Page %d complete (migrated: %d, skipped: %d, failed: %d)\n",
+			page, len(data), totalSkipped, totalFailed)
+
+		// Small delay to avoid overwhelming the server
+		time.Sleep(100 * time.Millisecond)
+	}
+
+	fmt.Println("===========================================")
+	fmt.Println("   Migration Complete")
+	fmt.Println("===========================================")
+	fmt.Printf("✅ Successfully migrated: %d\n", totalMigrated)
+	fmt.Printf("⏭️  Skipped (duplicates):  %d\n", totalSkipped)
+	fmt.Printf("❌ Failed:                 %d\n", totalFailed)
+	fmt.Println("===========================================")
+}
+
+func getSummary() (*Summary, error) {
+	resp, err := http.Get(summaryAPI)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	var summary Summary
+	if err := json.NewDecoder(resp.Body).Decode(&summary); err != nil {
+		return nil, err
+	}
+
+	return &summary, nil
+}
+
+func authenticate(pbURL, authCollection, identity, password string) error {
+	body := map[string]string{
+		"identity": identity,
+		"password": password,
+	}
+	jsonData, _ := json.Marshal(body)
+
+	url := fmt.Sprintf("%s/api/collections/%s/auth-with-password", pbURL, authCollection)
+	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		Token string `json:"token"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return err
+	}
+	if result.Token == "" {
+		return fmt.Errorf("no token in response")
+	}
+
+	authToken = result.Token
+	return nil
+}
+
+func fetchPage(page, limit int) ([]OldDataModel, error) {
+	url := fmt.Sprintf("%s?page=%d&limit=%d", sourceAPI, page, limit)
+
+	resp, err := http.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
+	}
+
+	var data []OldDataModel
+	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+		return nil, err
+	}
+
+	return data, nil
+}
+
+func importRecord(pbURL, collection string, old OldDataModel) error {
+	// Map status: "done" -> "success"
+	status := old.Status
+	switch status {
+	case "done":
+		status = "success"
+	case "installing", "failed", "unknown", "success":
+		// keep as-is
+	default:
+		status = "unknown"
+	}
+
+	// Ensure ct_type is not 0 (required field)
+	ctType := old.CtType
+	if ctType == 0 {
+		ctType = 1 // default to unprivileged
+	}
+
+	// Ensure type is set
+	recordType := old.Type
+	if recordType == "" {
+		recordType = "lxc"
+	}
+
+	record := PBRecord{
+		CtType:     ctType,
+		DiskSize:   old.DiskSize,
+		CoreCount:  old.CoreCount,
+		RamSize:    old.RamSize,
+		OsType:     old.OsType,
+		OsVersion:  old.OsVersion,
+		DisableIP6: old.DisableIP6,
+		NsApp:      old.NsApp,
+		Method:     old.Method,
+		PveVersion: old.PveVersion,
+		Status:     status,
+		RandomID:   old.RandomID,
+		Type:       recordType,
+		Error:      old.Error,
+	}
+
+	jsonData, err := json.Marshal(record)
+	if err != nil {
+		return err
+	}
+
+	url := fmt.Sprintf("%s/api/collections/%s/records", pbURL, collection)
+	req, err := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if authToken != "" {
+		req.Header.Set("Authorization", "Bearer "+authToken)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
+	}
+
+	return nil
+}
+
+func isUniqueViolation(err error) bool {
+	if err == nil {
+		return false
+	}
+	errStr := err.Error()
+	return contains(errStr, "UNIQUE constraint failed") ||
+		contains(errStr, "duplicate") ||
+		contains(errStr, "already exists") ||
+		contains(errStr, "validation_not_unique")
+}
+
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && (s == substr || len(s) > 0 && containsHelper(s, substr))
+}
+
+func containsHelper(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
@@ -0,0 +1,67 @@
+#!/bin/bash
+# Migration script to import data from the old API to PocketBase
+# Usage: ./migrate.sh [POCKETBASE_URL] [COLLECTION_NAME]
+#
+# Examples:
+#   ./migrate.sh                                    # Uses defaults
+#   ./migrate.sh http://localhost:8090              # Custom PB URL
+#   ./migrate.sh http://localhost:8090 my_telemetry # Custom URL and collection
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Default values
+POCKETBASE_URL="${1:-http://localhost:8090}"
+POCKETBASE_COLLECTION="${2:-_dev_telemetry_data}"
+
+echo "============================================="
+echo "   ProxmoxVED Data Migration Tool"
+echo "============================================="
+echo ""
+echo "This script will migrate telemetry data from:"
+echo "  Source: https://api.htl-braunau.at/dev/data"
+echo "  Target: $POCKETBASE_URL"
+echo "  Collection: $POCKETBASE_COLLECTION"
+echo ""
+
+# Check if PocketBase is reachable
+echo "🔍 Checking PocketBase connection..."
+if ! curl -sf "$POCKETBASE_URL/api/health" > /dev/null 2>&1; then
+    echo "❌ Cannot reach PocketBase at $POCKETBASE_URL"
+    echo "   Make sure PocketBase is running and the URL is correct."
+    exit 1
+fi
+echo "✅ PocketBase is reachable"
+echo ""
+
+# Check source API
+echo "🔍 Checking source API..."
+SUMMARY=$(curl -sf "https://api.htl-braunau.at/dev/data/summary" 2>/dev/null || echo "")
+if [ -z "$SUMMARY" ]; then
+    echo "❌ Cannot reach source API"
+    exit 1
+fi
+
+TOTAL=$(echo "$SUMMARY" | grep -o '"total_entries":[0-9]*' | cut -d: -f2)
+echo "✅ Source API is reachable ($TOTAL entries available)"
+echo ""
+
+# Confirm migration
+read -p "⚠️  Do you want to start the migration? [y/N] " -n 1 -r
+echo ""
+if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+    echo "Migration cancelled."
+    exit 0
+fi
+
+echo ""
+echo "Starting migration..."
+echo ""
+
+# Run the Go migration script
+cd "$SCRIPT_DIR"
+POCKETBASE_URL="$POCKETBASE_URL" POCKETBASE_COLLECTION="$POCKETBASE_COLLECTION" go run migrate.go
+
+echo ""
+echo "Migration complete!"