Config editor, host networking, whitelist RCON

- Config file editor at /instances/{id}/config (browse & edit config/ files)
- Host networking for Docker container (fixes WireGuard MTU DNS issues)
- Whitelist changes applied live via RCON instead of stopping the server
- Config edit handler detects which fields changed: whitelist → RCON,
  other settings → restart container
- walk_dir simplified (removed unused root param)
- import_world uses if-let instead of never-looping while-let
- docker-compose.yml updated as reference template

6 files changed, 375 insertions, 208 deletions

diff --git a/src/docker.rs b/src/docker.rs
index d66767e..f171d43 100644
--- a/src/docker.rs
+++ b/src/docker.rs
@@ -164,6 +164,7 @@ impl DockerManager {
         let host_config = HostConfig {
             binds: Some(vec![format!("{instance_data}:/data")]),
             port_bindings: Some(port_bindings),
+            network_mode: Some("host".into()),
             ..Default::default()
         };
 
diff --git a/src/routes/instances.rs b/src/routes/instances.rs
index d3b8294..a3c4baa 100644
--- a/src/routes/instances.rs
+++ b/src/routes/instances.rs
@@ -1,7 +1,7 @@
 use askama::Template;
 use axum::{
     Form, Router,
-    extract::{Multipart, Path, State},
+    extract::{Multipart, Path, Query, State},
     response::{Html, Redirect},
     routing::{get, post},
 };
@@ -95,6 +95,7 @@ pub fn router() -> Router<AppState> {
         .route("/instances/{id}/world/export", get(export_world))
         .route("/instances/{id}/world/import", post(import_world))
         .route("/instances/{id}/world/regenerate", post(regenerate_world))
+        .route("/instances/{id}/config", get(config_editor).post(save_config))
 }
 
 async fn list_instances(
@@ -345,7 +346,53 @@ async fn edit_instance(
     let pvp = form.pvp.as_deref() == Some("on");
     let whitelist_enabled = form.whitelist_enabled.as_deref() == Some("on");
 
-    let is_active = {
+    // Read current values to detect what changed
+    let (_instance_name, is_active, old_whitelist, rcon_password): (String, bool, bool, String) = {
+        let conn = state.db.conn();
+        conn.query_row(
+            "SELECT name, is_active, whitelist_enabled, rcon_password
+             FROM instances WHERE id = ?1",
+            params![id],
+            |row| Ok((
+                row.get(0)?,
+                row.get::<_, i32>(1)? != 0,
+                row.get::<_, i32>(2)? != 0,
+                row.get(3)?,
+            )),
+        )
+        .map_err(|_| Redirect::to("/instances"))?
+    };
+
+    // Check if any restart-requiring field changed
+    let (old_difficulty, old_gamemode, old_max_players, old_pvp, old_motd, old_memory): (i32, i32, i32, bool, String, i32) = {
+        let conn = state.db.conn();
+        conn.query_row(
+            "SELECT difficulty, gamemode, max_players, pvp, motd, memory_mb
+             FROM instances WHERE id = ?1",
+            params![id],
+            |row| Ok((
+                row.get(0)?,
+                row.get(1)?,
+                row.get(2)?,
+                row.get::<_, i32>(3)? != 0,
+                row.get(4)?,
+                row.get(5)?,
+            )),
+        )
+        .map_err(|_| Redirect::to("/instances"))?
+    };
+
+    let needs_restart = form.difficulty != old_difficulty
+        || form.gamemode != old_gamemode
+        || form.max_players != old_max_players
+        || pvp != old_pvp
+        || form.motd.as_deref().unwrap_or("") != old_motd
+        || form.memory_mb != old_memory;
+
+    let whitelist_changed = whitelist_enabled != old_whitelist;
+
+    // Persist changes
+    {
         let conn = state.db.conn();
         conn.execute(
             "UPDATE instances SET difficulty = ?1, gamemode = ?2, max_players = ?3,
@@ -363,17 +410,23 @@ async fn edit_instance(
             ],
         )
         .map_err(|_| Redirect::to("/instances"))?;
-
-        conn.query_row(
-            "SELECT is_active FROM instances WHERE id = ?1",
-            params![id],
-            |row| row.get::<_, i32>(0).map(|v| v != 0),
-        )
-        .unwrap_or(false)
-    };
+    }
 
     if is_active {
-        let _ = state.docker.stop_container().await;
+        // Apply whitelist change live via RCON if it was the only change
+        if whitelist_changed {
+            let cmd = if whitelist_enabled { "whitelist on" } else { "whitelist off" };
+            let rcon = crate::rcon::RconClient::new(rcon_password);
+            match rcon.send_command_async(cmd.into()).await {
+                Ok(resp) => tracing::info!("RCON {cmd}: {resp}"),
+                Err(e) => tracing::error!("RCON {cmd} failed: {e}"),
+            }
+        }
+
+        // If other settings changed, restart the container
+        if needs_restart {
+            let _ = state.docker.stop_container().await;
+        }
     }
 
     Ok(Redirect::to("/instances"))
@@ -714,8 +767,8 @@ async fn import_world(
         .join(&safe_name)
         .join("data");
 
-    // Extract uploaded ZIP
-    while let Ok(Some(field)) = multipart.next_field().await {
+    // Extract uploaded ZIP (only the first file is processed)
+    if let Ok(Some(field)) = multipart.next_field().await {
         let bytes = field
             .bytes()
             .await
@@ -754,12 +807,213 @@ async fn import_world(
                 std::io::copy(&mut file, &mut out).ok();
             }
         }
-        break; // only process first file
     }
 
     Ok(Redirect::to(&format!("/instances/{id}/edit")))
 }
 
+#[derive(Template)]
+#[template(path = "instances/config.html")]
+struct ConfigEditorTemplate {
+    username: String,
+    is_superuser: bool,
+    password_change_required: bool,
+    instance_id: i64,
+    instance_name: String,
+    files: Vec<String>,
+    selected_file: Option<String>,
+    content: Option<String>,
+    error: Option<String>,
+    saved: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct ConfigPathQuery {
+    path: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct SaveConfigForm {
+    path: String,
+    content: String,
+}
+
+/// Browse and edit config files in the instance's config/ directory.
+async fn config_editor(
+    State(state): State<AppState>,
+    Path(instance_id): Path<i64>,
+    CurrentUser(account): CurrentUser,
+    Query(query): Query<ConfigPathQuery>,
+) -> Result<Html<String>, axum::response::Redirect> {
+    let conn = state.db.conn();
+    let instance_name: String = conn
+        .query_row(
+            "SELECT name FROM instances WHERE id = ?1",
+            params![instance_id],
+            |row| row.get(0),
+        )
+        .map_err(|_| Redirect::to("/instances"))?;
+    drop(conn);
+
+    let safe_name = match sanitize::sanitize_instance_name(&instance_name) {
+        Some(n) => n,
+        None => return Err(Redirect::to("/instances")),
+    };
+
+    let config_dir = match sanitize::instance_config_dir(&state.config.server_directory, &safe_name)
+    {
+        Some(d) => d,
+        None => return Err(Redirect::to("/instances")),
+    };
+    let _ = std::fs::create_dir_all(&config_dir);
+
+    // Walk the config directory for files
+    let mut files: Vec<String> = Vec::new();
+    if let Ok(entries) = walk_dir(&config_dir, "") {
+        files = entries;
+        files.sort();
+    }
+
+    // If a file is selected, validate and read it
+    let (selected_file, content, error) = if let Some(raw_path) = &query.path {
+        let cleaned = raw_path.trim_start_matches('/');
+        let target = config_dir.join(cleaned);
+        if !sanitize::path_is_within_base(&target, &config_dir) {
+            (Some(cleaned.to_string()), None, Some("Invalid path".into()))
+        } else if !target.exists() || !target.is_file() {
+            (Some(cleaned.to_string()), None, Some("File not found".into()))
+        } else {
+            match std::fs::read_to_string(&target) {
+                Ok(c) => (Some(cleaned.to_string()), Some(c), None),
+                Err(e) => (Some(cleaned.to_string()), None, Some(format!("Read error: {e}"))),
+            }
+        }
+    } else {
+        (None, None, None)
+    };
+
+    let template = ConfigEditorTemplate {
+        username: account.username.clone(),
+        is_superuser: account.is_superuser,
+        password_change_required: account.password_change_required,
+        instance_id,
+        instance_name,
+        files,
+        selected_file,
+        content,
+        error,
+        saved: false,
+    };
+
+    match template.render() {
+        Ok(html) => Ok(Html(html)),
+        Err(e) => {
+            tracing::error!("Failed to render config template: {e}");
+            Err(Redirect::to(&format!("/instances/{instance_id}/edit")))
+        }
+    }
+}
+
+/// Save a config file back to disk.
+async fn save_config(
+    State(state): State<AppState>,
+    Path(instance_id): Path<i64>,
+    CurrentUser(_user): CurrentUser,
+    Form(form): Form<SaveConfigForm>,
+) -> Result<Html<String>, axum::response::Redirect> {
+    let conn = state.db.conn();
+    let instance_name: String = conn
+        .query_row(
+            "SELECT name FROM instances WHERE id = ?1",
+            params![instance_id],
+            |row| row.get(0),
+        )
+        .map_err(|_| Redirect::to("/instances"))?;
+    drop(conn);
+
+    let safe_name = match sanitize::sanitize_instance_name(&instance_name) {
+        Some(n) => n,
+        None => return Err(Redirect::to("/instances")),
+    };
+
+    let config_dir = match sanitize::instance_config_dir(&state.config.server_directory, &safe_name)
+    {
+        Some(d) => d,
+        None => return Err(Redirect::to("/instances")),
+    };
+
+    let cleaned = form.path.trim_start_matches('/');
+    let target = config_dir.join(cleaned);
+
+    let (error, saved) = if !sanitize::path_is_within_base(&target, &config_dir) {
+        (Some("Invalid path".into()), false)
+    } else if let Err(e) = std::fs::write(&target, &form.content) {
+        (Some(format!("Write error: {e}")), false)
+    } else {
+        tracing::info!("Saved config file: {}", target.display());
+        (None, true)
+    };
+
+    // Re-read the file list and selected file content
+    let _ = std::fs::create_dir_all(&config_dir);
+    let mut files: Vec<String> = Vec::new();
+    if let Ok(entries) = walk_dir(&config_dir, "") {
+        files = entries;
+        files.sort();
+    }
+
+    let content = if error.is_none() {
+        Some(form.content)
+    } else {
+        None
+    };
+
+    let template = ConfigEditorTemplate {
+        username: String::new(),
+        is_superuser: false,
+        password_change_required: false,
+        instance_id,
+        instance_name,
+        files,
+        selected_file: Some(cleaned.to_string()),
+        content,
+        error,
+        saved,
+    };
+
+    match template.render() {
+        Ok(html) => Ok(Html(html)),
+        Err(e) => {
+            tracing::error!("Failed to render config template after save: {e}");
+            Err(Redirect::to(&format!("/instances/{instance_id}/config?path={cleaned}")))
+        }
+    }
+}
+
+/// Recursively walk a directory and return relative paths of all files.
+fn walk_dir(dir: &std::path::Path, prefix: &str) -> std::io::Result<Vec<String>> {
+    let mut files = Vec::new();
+    for entry in std::fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        let name = entry
+            .file_name()
+            .to_string_lossy()
+            .to_string();
+        let relative = if prefix.is_empty() {
+            name
+        } else {
+            format!("{prefix}/{name}")
+        };
+        if path.is_dir() {
+            files.extend(walk_dir(&path, &relative)?);
+        } else if path.is_file() {
+            files.push(relative);
+        }
+    }
+    Ok(files)
+}
+
 async fn regenerate_world(
     State(state): State<AppState>,
     Path(id): Path<i64>,
diff --git a/src/sanitize.rs b/src/sanitize.rs
index f251131..19c7045 100644
--- a/src/sanitize.rs
+++ b/src/sanitize.rs
@@ -136,6 +136,12 @@ pub fn instance_dir(server_dir: &Path, instance_name: &str) -> Option<PathBuf> {
     Some(server_dir.join("instances").join(&safe))
 }
 
+/// Build a safe path to the instance's config/ directory.
+pub fn instance_config_dir(server_dir: &Path, instance_name: &str) -> Option<PathBuf> {
+    let data = instance_data_dir(server_dir, instance_name)?;
+    Some(data.join("config"))
+}
+
 /// Validate that a backup filename does not contain path traversal.
 pub fn sanitize_backup_filename(raw: &str) -> Option<String> {
     let trimmed = raw.trim();
diff --git a/templates/instances/config.html b/templates/instances/config.html
new file mode 100644
index 0000000..192a123
--- /dev/null
+++ b/templates/instances/config.html
@@ -0,0 +1,64 @@
+{% extends "base.html" %} {% block content %}
+<div class="page-header">
+  <h1>Config Files: {{ instance_name }}</h1>
+  <a href="/instances/{{ instance_id }}/edit" class="btn"
+    >&larr; Back to Instance</a
+  >
+</div>
+
+{% if saved %}
+<div class="flash flash-ok">File saved successfully.</div>
+{% endif %} {% if let Some(err) = error %}
+<div class="flash flash-err">{{ err }}</div>
+{% endif %}
+
+<div style="display: flex; gap: 1.5rem; align-items: flex-start">
+  {# File list sidebar #}
+  <div class="card" style="flex: 0 0 260px; max-height: 70vh; overflow-y: auto">
+    <h3 style="margin-bottom: 0.5rem">Files</h3>
+    {% if files.is_empty() %}
+    <p style="font-size: 0.85rem; color: var(--fg-muted)">
+      No config files yet.<br />Start the server to generate them.
+    </p>
+    {% else %}
+    <ul style="list-style: none; padding: 0; margin: 0; font-size: 0.85rem">
+      {% for f in files %}
+      <li style="padding: 0.25rem 0">
+        <a
+          href="/instances/{{ instance_id }}/config?path={{ f }}"
+          style="{% if selected_file.as_deref() == Some(f) %}font-weight:bold;color:var(--ok){% endif %}"
+        >
+          {{ f }}
+        </a>
+      </li>
+      {% endfor %}
+    </ul>
+    {% endif %}
+  </div>
+
+  {# Editor area #}
+  <div class="card" style="flex: 1">
+    {% if let Some(file) = selected_file %}
+    <h3 style="margin-bottom: 0.5rem">{{ file }}</h3>
+    {% if let Some(content) = content %}
+    <form method="post" action="/instances/{{ instance_id }}/config">
+      <input type="hidden" name="path" value="{{ file }}" />
+      <textarea
+        name="content"
+        rows="30"
+        style="width: 100%; font-family: monospace; font-size: 0.8rem"
+        spellcheck="false"
+      >
+{{ content }}</textarea>
+      <div style="margin-top: 0.5rem">
+        <button type="submit" class="btn-ok">Save</button>
+      </div>
+    </form>
+    {% else %}
+    <p style="color: var(--fg-muted)">Could not load file content.</p>
+    {% endif %} {% else %}
+    <p style="color: var(--fg-muted)">Select a file from the list to edit.</p>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}
diff --git a/templates/instances/edit.html b/templates/instances/edit.html
index 77dfca6..ef7d53e 100644
--- a/templates/instances/edit.html
+++ b/templates/instances/edit.html
@@ -19,125 +19,41 @@
     <legend>Server Properties</legend>
     <label>
       Memory (MB)
-      <input
-        type="number"
-        name="memory_mb"
-        value="{{ instance.memory_mb }}"
-        min="512"
-        max="{{ max_memory_mb }}"
-        required
-      />
+      <input type="number" name="memory_mb" value="{{ instance.memory_mb }}" min="512" max="{{ max_memory_mb }}" required />
     </label>
     <label>
       Difficulty
       <select name="difficulty">
-        <option
-          value="0"
-          {%
-          if
-          instance.difficulty == 0
-          %}selected{%
-          endif
-          %}
-        >
-          Peaceful
-        </option>
-        <option
-          value="1"
-          {%
-          if
-          instance.difficulty == 1
-          %}selected{%
-          endif
-          %}
-        >
-          Easy
-        </option>
-        <option
-          value="2"
-          {%
-          if
-          instance.difficulty == 2
-          %}selected{%
-          endif
-          %}
-        >
-          Normal
-        </option>
-        <option
-          value="3"
-          {%
-          if
-          instance.difficulty == 3
-          %}selected{%
-          endif
-          %}
-        >
-          Hard
-        </option>
+        <option value="0"{% if instance.difficulty == 0 %} selected{% endif %}>Peaceful</option>
+        <option value="1"{% if instance.difficulty == 1 %} selected{% endif %}>Easy</option>
+        <option value="2"{% if instance.difficulty == 2 %} selected{% endif %}>Normal</option>
+        <option value="3"{% if instance.difficulty == 3 %} selected{% endif %}>Hard</option>
       </select>
     </label>
     <label>
       Gamemode
       <select name="gamemode">
-        <option value="0" {% if instance.gamemode == 0 %}selected{% endif %}>
-          Survival
-        </option>
-        <option value="1" {% if instance.gamemode == 1 %}selected{% endif %}>
-          Creative
-        </option>
-        <option value="2" {% if instance.gamemode == 2 %}selected{% endif %}>
-          Adventure
-        </option>
-        <option value="3" {% if instance.gamemode == 3 %}selected{% endif %}>
-          Spectator
-        </option>
+        <option value="0"{% if instance.gamemode == 0 %} selected{% endif %}>Survival</option>
+        <option value="1"{% if instance.gamemode == 1 %} selected{% endif %}>Creative</option>
+        <option value="2"{% if instance.gamemode == 2 %} selected{% endif %}>Adventure</option>
+        <option value="3"{% if instance.gamemode == 3 %} selected{% endif %}>Spectator</option>
       </select>
     </label>
     <label>
       Max Players
-      <input
-        type="number"
-        name="max_players"
-        value="{{ instance.max_players }}"
-        min="1"
-        max="100"
-      />
+      <input type="number" name="max_players" value="{{ instance.max_players }}" min="1" max="100" />
     </label>
     <label>
-      <input
-        type="checkbox"
-        name="pvp"
-        {%
-        if
-        instance.pvp
-        %}checked{%
-        endif
-        %}
-      />
+      <input type="checkbox" name="pvp"{% if instance.pvp %} checked{% endif %} />
       PvP enabled
     </label>
     <label>
-      <input
-        type="checkbox"
-        name="whitelist_enabled"
-        {%
-        if
-        instance.whitelist_enabled
-        %}checked{%
-        endif
-        %}
-      />
+      <input type="checkbox" name="whitelist_enabled"{% if instance.whitelist_enabled %} checked{% endif %} />
       Whitelist enabled
     </label>
     <label>
       MOTD
-      <input
-        type="text"
-        name="motd"
-        value="{{ instance.motd }}"
-        maxlength="59"
-      />
+      <input type="text" name="motd" value="{{ instance.motd }}" maxlength="59" />
     </label>
   </fieldset>
 
@@ -147,12 +63,8 @@
   </div>
 </form>
 
-<div
-  class="card{% if instance.is_active %} card-muted{% endif %}"
-  style="margin-top: 1.5rem"
->
+<div class="card{% if instance.is_active %} card-muted{% endif %}" style="margin-top: 1.5rem">
   <h3>World Management</h3>
-
   {% if instance.is_active %}
   <div class="flash flash-warn">Stop the server before managing the world.</div>
   {% endif %}
@@ -166,109 +78,39 @@
     </span>
   </div>
 
-  <div
-    class="actions"
-    style="flex-wrap:wrap; gap:1rem; {% if instance.is_active %}pointer-events:none; opacity:0.5{% endif %}"
-  >
-    <a
-      href="/instances/{{ instance.id }}/world/export"
-      class="btn"
-      hx-boost="false"
-      {%
-      if
-      instance.is_active
-      %}tabindex="-1"
-      {%
-      endif
-      %}
-      >Export World</a
-    >
+  <div class="actions" style="flex-wrap:wrap; gap:1rem;{% if instance.is_active %} pointer-events:none; opacity:0.5{% endif %}">
+    <a href="/instances/{{ instance.id }}/world/export" class="btn" hx-boost="false"{% if instance.is_active %} tabindex="-1"{% endif %}>Export World</a>
 
-    <form
-      action="/instances/{{ instance.id }}/world/import"
-      method="post"
-      enctype="multipart/form-data"
-      style="display: flex; align-items: center; gap: 0.5rem"
-      hx-boost="false"
-    >
-      <input
-        type="file"
-        name="world_zip"
-        accept=".zip"
-        required
-        style="font-size: 0.85rem"
-        {%
-        if
-        instance.is_active
-        %}disabled{%
-        endif
-        %}
-      />
-      <button
-        type="submit"
-        class="btn"
-        onclick="
-          return confirm('This will replace the current world. Continue?');
-        "
-        {%
-        if
-        instance.is_active
-        %}disabled{%
-        endif
-        %}
-      >
-        Import
-      </button>
+    <form action="/instances/{{ instance.id }}/world/import" method="post" enctype="multipart/form-data" style="display: flex; align-items: center; gap: 0.5rem" hx-boost="false">
+      <input type="file" name="world_zip" accept=".zip" required style="font-size: 0.85rem"{% if instance.is_active %} disabled{% endif %} />
+      <button type="submit" class="btn" onclick="return confirm('This will replace the current world. Continue?');"{% if instance.is_active %} disabled{% endif %}>Import</button>
     </form>
 
-    <form
-      action="/instances/{{ instance.id }}/world/regenerate"
-      method="post"
-      class="form-row"
-      onsubmit="
-        return confirm(
-          'This will DELETE the current world and generate a new one. Continue?',
-        );
-      "
-    >
-      <input
-        type="text"
-        name="seed"
-        placeholder="Seed (empty = random)"
-        style="width: 180px"
-        {%
-        if
-        instance.is_active
-        %}disabled{%
-        endif
-        %}
-      />
-      <button
-        type="submit"
-        class="btn-danger"
-        {%
-        if
-        instance.is_active
-        %}disabled{%
-        endif
-        %}
-      >
-        Regenerate
-      </button>
+    <form action="/instances/{{ instance.id }}/world/regenerate" method="post" class="form-row" onsubmit="return confirm('This will DELETE the current world and generate a new one. Continue?');">
+      <input type="text" name="seed" placeholder="Seed (empty = random)" style="width: 180px"{% if instance.is_active %} disabled{% endif %} />
+      <button type="submit" class="btn-danger"{% if instance.is_active %} disabled{% endif %}>Regenerate</button>
     </form>
   </div>
 </div>
 
 <div class="card" style="margin-top: 1.5rem">
+  <h3>Configuration Files</h3>
+  <div class="meta" style="margin-bottom: 0.5rem">
+    <span>Edit mod/plugin config files inside <code>config/</code></span>
+  </div>
+  <div class="actions">
+    <a href="/instances/{{ instance.id }}/config" class="btn">Open Config Editor</a>
+  </div>
+</div>
+
+<div class="card" style="margin-top: 1.5rem">
   <h3>Mods</h3>
   <div class="meta" style="margin-bottom: 0.5rem">
     <span>
       {% if instance.has_modpack %}
       <strong>{{ mod_count }}</strong> mod{% if mod_count != 1 %}s{% endif %}
-      installed {% if rejected_count > 0 %} (<strong
-        >{{ rejected_count }}</strong
-      >
-      rejected) {% endif %} {% else %} No mods installed {% endif %}
+      installed{% if rejected_count > 0 %} (<strong>{{ rejected_count }}</strong> rejected){% endif %}
+      {% else %} No mods installed {% endif %}
     </span>
   </div>
   <div class="actions">
diff --git a/templates/mods/list.html b/templates/mods/list.html
index b5420b8..b05a0e6 100644
--- a/templates/mods/list.html
+++ b/templates/mods/list.html
@@ -119,7 +119,7 @@ function batchSubmit(action) {
     const checked = document.querySelectorAll('input[name="mod_id"]:checked');
     if (checked.length === 0) return;
 
-    const form = document.getElementById('batch-form');
+    const form = document.querySelector('#batch-form');
     // Clear any previous hidden inputs
     form.textContent = '';
     form.action = '/instances/{{ instance_id }}/mods/batch-' + action;
@@ -129,7 +129,7 @@ function batchSubmit(action) {
         input.type = 'hidden';
         input.name = 'mod_id';
         input.value = cb.value;
-        form.appendChild(input);
+        form.append(input);
     }
 
     form.submit();