Remove timeout wrapper from nft command

Run sudo nft directly without timeout wrapper to preserve capabilities.
The timeout -> sudo chain was preventing nft from accessing netlink
with proper permissions.

- Change from 'timeout 3 sudo nft' to 'sudo nft'
- Allows CAP_NET_ADMIN to pass through correctly
- Update version to v0.1.256

Cargo.lock

@@ -279,7 +279,7 @@ checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
 
 [[package]]
 name = "cm-dashboard"
-version = "0.1.237"
+version = "0.1.255"
 dependencies = [
  "anyhow",
  "chrono",
@@ -301,7 +301,7 @@ dependencies = [
 
 [[package]]
 name = "cm-dashboard-agent"
-version = "0.1.237"
+version = "0.1.255"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -325,7 +325,7 @@ dependencies = [
 
 [[package]]
 name = "cm-dashboard-shared"
-version = "0.1.237"
+version = "0.1.255"
 dependencies = [
  "chrono",
  "serde",

agent/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cm-dashboard-agent"
-version = "0.1.237"
+version = "0.1.256"
 edition = "2021"
 
 [dependencies]

agent/src/collectors/cpu.rs

@@ -119,6 +119,71 @@ impl CpuCollector {
         utils::parse_u64(content.trim())
     }
 
+    /// Collect static CPU information from /proc/cpuinfo (only once at startup)
+    async fn collect_cpu_info(&self, agent_data: &mut AgentData) -> Result<(), CollectorError> {
+        let content = utils::read_proc_file("/proc/cpuinfo")?;
+
+        let mut model_name: Option<String> = None;
+        let mut core_count: u32 = 0;
+
+        for line in content.lines() {
+            if line.starts_with("model name") {
+                if let Some(colon_pos) = line.find(':') {
+                    let full_name = line[colon_pos + 1..].trim();
+                    // Extract just the model number (e.g., "i7-9700" from "Intel(R) Core(TM) i7-9700 CPU @ 3.00GHz")
+                    let model = Self::extract_cpu_model(full_name);
+                    if model_name.is_none() {
+                        model_name = Some(model);
+                    }
+                }
+            } else if line.starts_with("processor") {
+                core_count += 1;
+            }
+        }
+
+        agent_data.system.cpu.model_name = model_name;
+        if core_count > 0 {
+            agent_data.system.cpu.core_count = Some(core_count);
+        }
+
+        Ok(())
+    }
+
+    /// Extract CPU model number from full model name
+    /// Examples:
+    /// - "Intel(R) Core(TM) i7-9700 CPU @ 3.00GHz" -> "i7-9700"
+    /// - "12th Gen Intel(R) Core(TM) i7-12700K" -> "i7-12700K"
+    /// - "AMD Ryzen 9 5950X 16-Core Processor" -> "Ryzen 9 5950X"
+    fn extract_cpu_model(full_name: &str) -> String {
+        // Look for Intel Core patterns (both old and new gen): i3, i5, i7, i9
+        // Match pattern like "i7-12700K" or "i7-9700"
+        for prefix in &["i3-", "i5-", "i7-", "i9-"] {
+            if let Some(pos) = full_name.find(prefix) {
+                // Find end of model number (until space or end of string)
+                let after_prefix = &full_name[pos..];
+                let end = after_prefix.find(' ').unwrap_or(after_prefix.len());
+                return after_prefix[..end].to_string();
+            }
+        }
+
+        // Look for AMD Ryzen pattern
+        if let Some(pos) = full_name.find("Ryzen") {
+            // Extract "Ryzen X XXXX" pattern
+            let after_ryzen = &full_name[pos..];
+            let parts: Vec<&str> = after_ryzen.split_whitespace().collect();
+            if parts.len() >= 3 {
+                return format!("{} {} {}", parts[0], parts[1], parts[2]);
+            }
+        }
+
+        // Fallback: return first 15 characters or full name if shorter
+        if full_name.len() > 15 {
+            full_name[..15].to_string()
+        } else {
+            full_name.to_string()
+        }
+    }
+
     /// Collect CPU C-state (idle depth) and populate AgentData with top 3 C-states by usage
     async fn collect_cstate(&self, agent_data: &mut AgentData) -> Result<(), CollectorError> {
         // Read C-state usage from first CPU (representative of overall system)
@@ -192,6 +257,11 @@ impl Collector for CpuCollector {
         debug!("Collecting CPU metrics");
         let start = std::time::Instant::now();
 
+        // Collect static CPU info (only once at startup)
+        if agent_data.system.cpu.model_name.is_none() || agent_data.system.cpu.core_count.is_none() {
+            self.collect_cpu_info(agent_data).await?;
+        }
+
         // Collect load averages (always available)
         self.collect_load_averages(agent_data).await?;
 
@@ -212,8 +282,8 @@ impl Collector for CpuCollector {
             );
         }
 
-        // Calculate status using thresholds
+        // Calculate status using thresholds (use 5-minute average for stability)
-        agent_data.system.cpu.load_status = self.calculate_load_status(agent_data.system.cpu.load_1min);
+        agent_data.system.cpu.load_status = self.calculate_load_status(agent_data.system.cpu.load_5min);
         agent_data.system.cpu.temperature_status = if let Some(temp) = agent_data.system.cpu.temperature_celsius {
             self.calculate_temperature_status(temp)
         } else {

agent/src/collectors/systemd.rs

@@ -4,7 +4,7 @@ use cm_dashboard_shared::{AgentData, ServiceData, SubServiceData, SubServiceMetr
 use std::process::Command;
 use std::sync::RwLock;
 use std::time::Instant;
-use tracing::debug;
+use tracing::{debug, info};
 
 use super::{Collector, CollectorError};
 use crate::config::SystemdConfig;
@@ -142,40 +142,65 @@ impl SystemdCollector {
 
                         // Add Docker images
                         let docker_images = self.get_docker_images();
-                        for (image_name, image_status, image_size_mb) in docker_images {
+                        for (image_name, _image_status, image_size_mb) in docker_images {
-                            let mut metrics = Vec::new();
+                            let metrics = Vec::new();
-                            metrics.push(SubServiceMetric {
-                                label: "size".to_string(),
-                                value: image_size_mb,
-                                unit: Some("MB".to_string()),
-                            });
 
                             sub_services.push(SubServiceData {
-                                name: image_name.to_string(),
+                                name: format!("{} size: {:.1} MB", image_name, image_size_mb),
-                                service_status: self.calculate_service_status(&image_name, &image_status),
+                                service_status: Status::Info,  // Informational only, no status icon
                                 metrics,
                                 service_type: "image".to_string(),
                             });
                         }
                     }
 
-                    if service_name == "openvpn-vpn-connection" && status_info.active_state == "active" {
+                    if service_name == "openvpn-vpn-download" && status_info.active_state == "active" {
-                        tracing::info!("Checking VPN external IP for service: {}", service_name);
+                        // Add VPN route
-                        match self.get_vpn_external_ip() {
+                        if let Some(external_ip) = self.get_vpn_external_ip() {
-                            Some(external_ip) => {
+                            let metrics = Vec::new();
-                                tracing::info!("Got VPN external IP: {}", external_ip);
-                                let metrics = Vec::new();
 
-                                sub_services.push(SubServiceData {
+                            sub_services.push(SubServiceData {
-                                    name: format!("ip: {}", external_ip),
+                                name: format!("route: {}", external_ip),
-                                    service_status: Status::Info,
+                                service_status: Status::Info,
-                                    metrics,
+                                metrics,
-                                    service_type: "vpn_route".to_string(),
+                                service_type: "vpn_route".to_string(),
-                                });
+                            });
-                            }
+                        }
-                            None => {
+
-                                tracing::warn!("Failed to get VPN external IP");
+                        // Add torrent stats
-                            }
+                        if let Some((active_count, download_mbps, upload_mbps)) = self.get_qbittorrent_stats() {
+                            let metrics = Vec::new();
+
+                            sub_services.push(SubServiceData {
+                                name: format!("{} active, ↓ {:.1} MB/s, ↑ {:.1} MB/s", active_count, download_mbps, upload_mbps),
+                                service_status: Status::Info,
+                                metrics,
+                                service_type: "torrent_stats".to_string(),
+                            });
+                        }
+                    }
+
+                    if service_name == "nftables" && status_info.active_state == "active" {
+                        let (tcp_ports, udp_ports) = self.get_nftables_open_ports();
+
+                        if !tcp_ports.is_empty() {
+                            let metrics = Vec::new();
+                            sub_services.push(SubServiceData {
+                                name: format!("TCP: {}", tcp_ports),
+                                service_status: Status::Info,
+                                metrics,
+                                service_type: "firewall_port".to_string(),
+                            });
+                        }
+
+                        if !udp_ports.is_empty() {
+                            let metrics = Vec::new();
+                            sub_services.push(SubServiceData {
+                                name: format!("UDP: {}", udp_ports),
+                                service_status: Status::Info,
+                                metrics,
+                                service_type: "firewall_port".to_string(),
+                            });
                         }
                     }
 
@@ -883,10 +908,186 @@ impl SystemdCollector {
             }
         }
 
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        tracing::warn!("VPN external IP query failed. Exit code: {:?}, stderr: {}", output.status.code(), stderr);
         None
     }
+
+    /// Get nftables open ports grouped by protocol
+    /// Returns: (tcp_ports_string, udp_ports_string)
+    fn get_nftables_open_ports(&self) -> (String, String) {
+        let output = Command::new("sudo")
+            .args(&["/run/current-system/sw/bin/nft", "list", "ruleset"])
+            .output();
+
+        let output = match output {
+            Ok(out) if out.status.success() => out,
+            Ok(out) => {
+                info!("nft command failed with status: {:?}, stderr: {}",
+                    out.status, String::from_utf8_lossy(&out.stderr));
+                return (String::new(), String::new());
+            }
+            Err(e) => {
+                info!("Failed to execute nft command: {}", e);
+                return (String::new(), String::new());
+            }
+        };
+
+        let output_str = match String::from_utf8(output.stdout) {
+            Ok(s) => s,
+            Err(_) => {
+                info!("Failed to parse nft output as UTF-8");
+                return (String::new(), String::new());
+            }
+        };
+
+        let mut tcp_ports = std::collections::HashSet::new();
+        let mut udp_ports = std::collections::HashSet::new();
+
+        // Parse nftables output for WAN incoming accept rules with dport
+        // Looking for patterns like: tcp dport 22 accept or tcp dport { 22, 80, 443 } accept
+        // Only include rules in input_wan chain
+        let mut in_wan_chain = false;
+
+        for line in output_str.lines() {
+            let line = line.trim();
+
+            // Track if we're in the input_wan chain
+            if line.contains("chain input_wan") {
+                in_wan_chain = true;
+                continue;
+            }
+
+            // Reset when exiting chain (closing brace) or entering other chains
+            if line == "}" || (line.starts_with("chain ") && !line.contains("input_wan")) {
+                in_wan_chain = false;
+                continue;
+            }
+
+            // Only process rules in input_wan chain
+            if !in_wan_chain {
+                continue;
+            }
+
+            // Skip if not an accept rule
+            if !line.contains("accept") {
+                continue;
+            }
+
+            // Parse TCP ports
+            if line.contains("tcp dport") {
+                for port in self.extract_ports_from_nft_rule(line) {
+                    tcp_ports.insert(port);
+                }
+            }
+
+            // Parse UDP ports
+            if line.contains("udp dport") {
+                for port in self.extract_ports_from_nft_rule(line) {
+                    udp_ports.insert(port);
+                }
+            }
+        }
+
+        // Sort and format
+        let mut tcp_vec: Vec<u16> = tcp_ports.into_iter().collect();
+        let mut udp_vec: Vec<u16> = udp_ports.into_iter().collect();
+        tcp_vec.sort();
+        udp_vec.sort();
+
+        let tcp_str = tcp_vec.iter().map(|p| p.to_string()).collect::<Vec<_>>().join(", ");
+        let udp_str = udp_vec.iter().map(|p| p.to_string()).collect::<Vec<_>>().join(", ");
+
+        info!("nftables WAN ports - TCP: '{}', UDP: '{}'", tcp_str, udp_str);
+
+        (tcp_str, udp_str)
+    }
+
+    /// Extract port numbers from nftables rule line
+    /// Returns vector of ports (handles both single ports and sets)
+    fn extract_ports_from_nft_rule(&self, line: &str) -> Vec<u16> {
+        let mut ports = Vec::new();
+
+        // Pattern: "tcp dport 22 accept" or "tcp dport { 22, 80, 443 } accept"
+        if let Some(dport_pos) = line.find("dport") {
+            let after_dport = &line[dport_pos + 5..].trim();
+
+            // Handle port sets like { 22, 80, 443 }
+            if after_dport.starts_with('{') {
+                if let Some(end_brace) = after_dport.find('}') {
+                    let ports_str = &after_dport[1..end_brace];
+                    // Parse each port in the set
+                    for port_str in ports_str.split(',') {
+                        if let Ok(port) = port_str.trim().parse::<u16>() {
+                            ports.push(port);
+                        }
+                    }
+                }
+            } else {
+                // Single port
+                if let Some(port_str) = after_dport.split_whitespace().next() {
+                    if let Ok(port) = port_str.parse::<u16>() {
+                        ports.push(port);
+                    }
+                }
+            }
+        }
+
+        ports
+    }
+
+    /// Get aggregate qBittorrent torrent statistics
+    /// Returns: (active_count, download_mbps, upload_mbps)
+    fn get_qbittorrent_stats(&self) -> Option<(u32, f32, f32)> {
+        // Query qBittorrent API through VPN namespace
+        let output = Command::new("timeout")
+            .args(&[
+                "5",
+                "sudo",
+                "ip",
+                "netns",
+                "exec",
+                "vpn",
+                "curl",
+                "-s",
+                "--max-time",
+                "4",
+                "http://localhost:8080/api/v2/torrents/info"
+            ])
+            .output()
+            .ok()?;
+
+        if !output.status.success() {
+            return None;
+        }
+
+        let output_str = String::from_utf8_lossy(&output.stdout);
+        let torrents: Vec<serde_json::Value> = serde_json::from_str(&output_str).ok()?;
+
+        let mut active_count = 0u32;
+        let mut total_download_bps = 0.0f64;
+        let mut total_upload_bps = 0.0f64;
+
+        for torrent in torrents {
+            let state = torrent["state"].as_str().unwrap_or("");
+            let dlspeed = torrent["dlspeed"].as_f64().unwrap_or(0.0);
+            let upspeed = torrent["upspeed"].as_f64().unwrap_or(0.0);
+
+            // States: downloading, uploading, stalledDL, stalledUP, queuedDL, queuedUP, pausedDL, pausedUP
+            // Count as active if downloading or uploading (seeding)
+            if state.contains("downloading") || state.contains("uploading") ||
+               state == "stalledDL" || state == "stalledUP" {
+                active_count += 1;
+            }
+
+            total_download_bps += dlspeed;
+            total_upload_bps += upspeed;
+        }
+
+        // qBittorrent returns bytes/s, convert to MB/s
+        let download_mbps = (total_download_bps / 1024.0 / 1024.0) as f32;
+        let upload_mbps = (total_upload_bps / 1024.0 / 1024.0) as f32;
+
+        Some((active_count, download_mbps, upload_mbps))
+    }
 }
 
 #[async_trait]

dashboard/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cm-dashboard"
-version = "0.1.237"
+version = "0.1.256"
 edition = "2021"
 
 [dependencies]

dashboard/src/ui/mod.rs

@@ -110,14 +110,6 @@ impl TuiApp {
                 host_widgets.system_widget.update_from_agent_data(agent_data);
                 host_widgets.services_widget.update_from_agent_data(agent_data);
 
-                // Update ZMQ stats
-                if let Some(zmq_stats) = metric_store.get_zmq_stats(&hostname) {
-                    host_widgets.system_widget.update_zmq_stats(
-                        zmq_stats.packets_received,
-                        zmq_stats.last_packet_age_secs
-                    );
-                }
-
                 host_widgets.last_update = Some(Instant::now());
             }
         }

dashboard/src/ui/widgets/services.rs

@@ -230,9 +230,12 @@ impl ServicesWidget {
         info: &ServiceInfo,
         is_last: bool,
     ) -> Vec<ratatui::text::Span<'static>> {
+        // Informational sub-services (Status::Info) can use more width since they don't show columns
+        let max_width = if info.widget_status == Status::Info { 50 } else { 18 };
+
         // Truncate long sub-service names to fit layout (accounting for indentation)
-        let short_name = if name.len() > 18 {
+        let short_name = if name.len() > max_width {
-            format!("{}...", &name[..15])
+            format!("{}...", &name[..(max_width.saturating_sub(3))])
         } else {
             name.to_string()
         };
@@ -273,50 +276,34 @@ impl ServicesWidget {
         };
         let tree_symbol = if is_last { "└─" } else { "├─" };
 
-        // Docker images use docker whale icon
+        if info.widget_status == Status::Info {
-        if info.service_type == "image" {
+            // Informational data - no status icon, show metrics if available
-            vec![
+            let mut spans = vec![
                 // Indentation and tree prefix
                 ratatui::text::Span::styled(
                     format!("  {} ", tree_symbol),
                     Typography::tree(),
                 ),
-                // Docker icon (simple character for performance)
+                // Service name (no icon) - no fixed width padding for Info status
-                ratatui::text::Span::styled(
-                    "D ".to_string(),
-                    Style::default().fg(Theme::highlight()).bg(Theme::background()),
-                ),
-                // Service name
-                ratatui::text::Span::styled(
-                    format!("{:<18} ", short_name),
-                    Style::default()
-                        .fg(Theme::secondary_text())
-                        .bg(Theme::background()),
-                ),
-                // Status/metrics text
-                ratatui::text::Span::styled(
-                    status_str,
-                    Style::default()
-                        .fg(Theme::secondary_text())
-                        .bg(Theme::background()),
-                ),
-            ]
-        } else if info.widget_status == Status::Info {
-            // Informational data - no status icon
-            vec![
-                // Indentation and tree prefix
-                ratatui::text::Span::styled(
-                    format!("  {} ", tree_symbol),
-                    Typography::tree(),
-                ),
-                // Service name (no icon)
                 ratatui::text::Span::styled(
                     short_name,
                     Style::default()
                         .fg(Theme::secondary_text())
                         .bg(Theme::background()),
                 ),
-            ]
+            ];
+
+            // Add metrics if available (e.g., Docker image size)
+            if !status_str.is_empty() {
+                spans.push(ratatui::text::Span::styled(
+                    status_str,
+                    Style::default()
+                        .fg(Theme::secondary_text())
+                        .bg(Theme::background()),
+                ));
+            }
+
+            spans
         } else {
             vec![
                 // Indentation and tree prefix

dashboard/src/ui/widgets/system.rs

@@ -15,10 +15,6 @@ pub struct SystemWidget {
     nixos_build: Option<String>,
     agent_hash: Option<String>,
 
-    // ZMQ communication stats
-    zmq_packets_received: Option<u64>,
-    zmq_last_packet_age: Option<f64>,
-
     // Network interfaces
     network_interfaces: Vec<cm_dashboard_shared::NetworkInterfaceData>,
 
@@ -27,6 +23,8 @@ pub struct SystemWidget {
     cpu_load_5min: Option<f32>,
     cpu_load_15min: Option<f32>,
     cpu_cstates: Vec<cm_dashboard_shared::CStateInfo>,
+    cpu_model_name: Option<String>,
+    cpu_core_count: Option<u32>,
     cpu_status: Status,
     
     // Memory metrics
@@ -90,13 +88,13 @@ impl SystemWidget {
         Self {
             nixos_build: None,
             agent_hash: None,
-            zmq_packets_received: None,
-            zmq_last_packet_age: None,
             network_interfaces: Vec::new(),
             cpu_load_1min: None,
             cpu_load_5min: None,
             cpu_load_15min: None,
             cpu_cstates: Vec::new(),
+            cpu_model_name: None,
+            cpu_core_count: None,
             cpu_status: Status::Unknown,
             memory_usage_percent: None,
             memory_used_gb: None,
@@ -155,12 +153,6 @@ impl SystemWidget {
     pub fn _get_agent_hash(&self) -> Option<&String> {
         self.agent_hash.as_ref()
     }
-
-    /// Update ZMQ communication statistics
-    pub fn update_zmq_stats(&mut self, packets_received: u64, last_packet_age_secs: f64) {
-        self.zmq_packets_received = Some(packets_received);
-        self.zmq_last_packet_age = Some(last_packet_age_secs);
-    }
 }
 
 use super::Widget;
@@ -184,6 +176,8 @@ impl Widget for SystemWidget {
         self.cpu_load_5min = Some(cpu.load_5min);
         self.cpu_load_15min = Some(cpu.load_15min);
         self.cpu_cstates = cpu.cstates.clone();
+        self.cpu_model_name = cpu.model_name.clone();
+        self.cpu_core_count = cpu.core_count;
         self.cpu_status = Status::Ok;
 
         // Extract memory data directly
@@ -805,18 +799,6 @@ impl SystemWidget {
             Span::styled(format!("Agent: {}", agent_version_text), Typography::secondary())
         ]));
 
-        // ZMQ communication stats
-        if let (Some(packets), Some(age)) = (self.zmq_packets_received, self.zmq_last_packet_age) {
-            let age_text = if age < 1.0 {
-                format!("{:.0}ms ago", age * 1000.0)
-            } else {
-                format!("{:.1}s ago", age)
-            };
-            lines.push(Line::from(vec![
-                Span::styled(format!("ZMQ: {} pkts, last {}", packets, age_text), Typography::secondary())
-            ]));
-        }
-
         // CPU section
         lines.push(Line::from(vec![
             Span::styled("CPU:", Typography::widget_title())
@@ -830,11 +812,31 @@ impl SystemWidget {
         lines.push(Line::from(cpu_spans));
 
         let cstate_text = self.format_cpu_cstate();
+        let has_cpu_info = self.cpu_model_name.is_some() || self.cpu_core_count.is_some();
+        let cstate_tree = if has_cpu_info { "  ├─ " } else { "  └─ " };
         lines.push(Line::from(vec![
-            Span::styled("  └─ ", Typography::tree()),
+            Span::styled(cstate_tree, Typography::tree()),
             Span::styled(format!("C-state: {}", cstate_text), Typography::secondary())
         ]));
 
+        // CPU model and core count (if available)
+        if let (Some(model), Some(cores)) = (&self.cpu_model_name, self.cpu_core_count) {
+            lines.push(Line::from(vec![
+                Span::styled("  └─ ", Typography::tree()),
+                Span::styled(format!("{} ({} cores)", model, cores), Typography::secondary())
+            ]));
+        } else if let Some(model) = &self.cpu_model_name {
+            lines.push(Line::from(vec![
+                Span::styled("  └─ ", Typography::tree()),
+                Span::styled(model.clone(), Typography::secondary())
+            ]));
+        } else if let Some(cores) = self.cpu_core_count {
+            lines.push(Line::from(vec![
+                Span::styled("  └─ ", Typography::tree()),
+                Span::styled(format!("{} cores", cores), Typography::secondary())
+            ]));
+        }
+
         // RAM section
         lines.push(Line::from(vec![
             Span::styled("RAM:", Typography::widget_title())

shared/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cm-dashboard-shared"
-version = "0.1.237"
+version = "0.1.256"
 edition = "2021"
 
 [dependencies]

shared/src/agent_data.rs

@@ -57,6 +57,11 @@ pub struct CpuData {
     pub temperature_celsius: Option<f32>,
     pub load_status: Status,
     pub temperature_status: Status,
+    // Static CPU information (collected once at startup)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_name: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub core_count: Option<u32>,
 }
 
 /// Memory monitoring data
@@ -219,6 +224,8 @@ impl AgentData {
                     temperature_celsius: None,
                     load_status: Status::Unknown,
                     temperature_status: Status::Unknown,
+                    model_name: None,
+                    core_count: None,
                 },
                 memory: MemoryData {
                     usage_percent: 0.0,