feat(api): Add setup wizard and infrastructure bootstrap

Introduce setup API for the dashboard-based setup wizard flow.
Bootstrap nginx reverse proxy on first boot with welcome page.
Add system counts to /stats for accurate sidebar navigation.

Signed-off-by: nfebe <fenn25.fn@gmail.com>

Author: nfebe

internal/api/server.go

@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"log"
 	"net/http"
+	"net/http/httputil"
+	"net/url"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -70,6 +72,8 @@ type Server struct {
 	auditMiddleware    *audit.Middleware
 	powerDNSManager    *dns.PowerDNSManager
 	clusterManager     *cluster.Manager
+	dashboardServer    *http.Server
+	cachedIP           string
 }
 
 func New(cfg *config.Config, configPath string) *Server {
@@ -232,6 +236,9 @@ func New(cfg *config.Config, configPath string) *Server {
 
 	s.setupRoutes()
 
+	// Start dashboard server on port 8080
+	go s.StartDashboard()
+
 	return s
 }
 
@@ -246,6 +253,24 @@ func (s *Server) setupRoutes() {
 		// WebSocket endpoint handles its own auth via first-message
 		api.GET("/containers/:id/exec", s.containerExec)
 
+		// Setup endpoints (public, permissive CORS, gated by setup state)
+		setup := api.Group("/setup")
+		setup.Use(s.setupCORS())
+		{
+			setup.GET("/status", s.getSetupStatus)
+
+			guarded := setup.Group("")
+			guarded.GET("/info", s.getSetupInfo)
+			guarded.Use(s.setupGuard())
+			{
+				guarded.POST("/validate", s.validateSystem)
+				guarded.GET("/verify-dns", s.verifyDNS)
+				guarded.POST("/settings", s.configureSettings)
+				guarded.POST("/authentication", s.configureAuthentication)
+				guarded.POST("/complete", s.completeSetup)
+			}
+		}
+
 		protected := api.Group("")
 		protected.Use(s.authMiddleware.RequireAuth())
 		if s.auditMiddleware != nil {
@@ -564,10 +589,58 @@ func (s *Server) Start() error {
 	return s.server.ListenAndServe()
 }
 
+func (s *Server) StartDashboard() {
+	installDir := os.Getenv("INSTALL_DIR")
+	if installDir == "" {
+		installDir = "/opt/flatrun"
+	}
+	distDir := filepath.Join(installDir, "ui", "dist")
+
+	apiTarget, _ := url.Parse(fmt.Sprintf("http://127.0.0.1:%d", s.config.API.Port))
+	proxy := httputil.NewSingleHostReverseProxy(apiTarget)
+
+	mux := http.NewServeMux()
+
+	mux.HandleFunc("/api/", func(w http.ResponseWriter, r *http.Request) {
+		proxy.ServeHTTP(w, r)
+	})
+
+	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		filePath := filepath.Join(distDir, filepath.Clean(r.URL.Path))
+
+		if info, err := os.Stat(filePath); err == nil && !info.IsDir() {
+			http.ServeFile(w, r, filePath)
+			return
+		}
+
+		indexPath := filepath.Join(distDir, "index.html")
+		if _, err := os.Stat(indexPath); err != nil {
+			http.Error(w, "Dashboard UI not installed", http.StatusNotFound)
+			return
+		}
+		http.ServeFile(w, r, indexPath)
+	})
+
+	s.dashboardServer = &http.Server{
+		Addr:    ":8080",
+		Handler: mux,
+	}
+
+	log.Printf("Dashboard server starting on :8080 (serving %s)", distDir)
+	if err := s.dashboardServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		log.Printf("Dashboard server error: %v", err)
+	}
+}
+
 func (s *Server) Stop() error {
 	if s.clusterManager != nil {
 		s.clusterManager.Stop()
 	}
+	if s.dashboardServer != nil {
+		dCtx, dCancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer dCancel()
+		_ = s.dashboardServer.Shutdown(dCtx)
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	return s.server.Shutdown(ctx)
@@ -3769,14 +3842,41 @@ func (s *Server) getSystemStats(c *gin.Context) {
 
 	systemStats, _ := system.GetSystemStats()
 
+	var systemPortCount int
+	if ports, err := s.networksManager.ListPorts(); err == nil {
+		systemPortCount = len(ports)
+	}
+
+	var systemServiceCount int
+	if services, err := s.servicesManager.ListServices(); err == nil {
+		systemServiceCount = len(services)
+	}
+
+	var infraCount int
+	if services, err := s.infraManager.ListServices(); err == nil {
+		infraCount = len(services)
+	}
+
+	var certCount int
+	if certs, err := s.proxyOrchestrator.ListCertificates(); err == nil {
+		certCount = len(certs)
+	}
+
+	appCount := len(s.pluginRegistry.List())
+
 	c.JSON(http.StatusOK, gin.H{
-		"deployments": depStats,
-		"containers":  containerStats,
-		"images":      imageStats,
-		"volumes":     volumeStats,
-		"networks":    gin.H{"total": networkCount},
-		"ports":       gin.H{"total": portCount},
-		"system":      systemStats,
+		"deployments":    depStats,
+		"containers":     containerStats,
+		"images":         imageStats,
+		"volumes":        volumeStats,
+		"networks":       gin.H{"total": networkCount},
+		"ports":          gin.H{"total": portCount},
+		"system":         systemStats,
+		"system_ports":   gin.H{"total": systemPortCount},
+		"services":       gin.H{"total": systemServiceCount},
+		"infrastructure": gin.H{"total": infraCount},
+		"certificates":   gin.H{"total": certCount},
+		"apps":           gin.H{"total": appCount},
 	})
 }