Initial commit — DRB server stack

Includes c2-core (FastAPI/MQTT/Firestore), discord-bot (slash commands), frontend (Next.js admin UI), and mosquitto config.
2026-04-05 19:01:39 -04:00
commit 2f0597c81b
77 changed files with 4126 additions and 0 deletions
@@ -0,0 +1,31 @@
+# Environment / secrets
+.env
+drb-c2-core/.env
+drb-server-discord-bot/.env
+drb-frontend/.env
+drb-c2-core/gcp-key.json
+
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+.venv/
+venv/
+
+# Node / Next.js
+node_modules/
+.next/
+*.tsbuildinfo
+
+# Logs and debug captures
+*.log
+logs/
+*.har
+
+# Docker volumes / runtime data
+mosquitto/data/
+recordings/
+
+# OS
+.DS_Store
+Thumbs.db
@@ -0,0 +1,28 @@
+.PHONY: setup up down build logs logs-c2 logs-bot logs-frontend
+
+setup:
+	@[ -f drb-c2-core/.env ]             && echo "drb-c2-core/.env already exists, skipping."             || (cp drb-c2-core/.env.example             drb-c2-core/.env             && echo "Created drb-c2-core/.env")
+	@[ -f drb-server-discord-bot/.env ]  && echo "drb-server-discord-bot/.env already exists, skipping." || (cp drb-server-discord-bot/.env.example  drb-server-discord-bot/.env  && echo "Created drb-server-discord-bot/.env")
+	@[ -f drb-frontend/.env ]            && echo "drb-frontend/.env already exists, skipping."            || (cp drb-frontend/.env.example            drb-frontend/.env            && echo "Created drb-frontend/.env")
+	@echo "Done. Fill in any secrets before running 'make up'."
+
+up:
+	docker compose up -d
+
+down:
+	docker compose down
+
+build:
+	docker compose build
+
+logs:
+	docker compose logs -f
+
+logs-c2:
+	docker compose logs -f c2-core
+
+logs-bot:
+	docker compose logs -f discord-bot
+
+logs-frontend:
+	docker compose logs -f frontend
@@ -0,0 +1,107 @@
+# DRB Server
+
+The server-side stack for the Discord Radio Bot system. Handles command-and-control, Firestore sync, Discord slash commands, and the web frontend.
+
+## Services
+
+| Service | Description | Port |
+|---|---|---|
+| `mosquitto` | MQTT broker — receives telemetry from edge nodes | 1883 |
+| `c2-core` | FastAPI C2 API — processes MQTT, writes to Firestore, manages nodes/systems/tokens | 8888 |
+| `discord-bot` | Discord bot — `/join`, `/leave`, `/status` slash commands | — |
+| `frontend` | Next.js admin UI — real-time dashboard, node management, call history | 3000 |
+
+## Prerequisites
+
+- Docker + Docker Compose
+- A Firebase project with Firestore enabled (Native mode)
+- A GCP service account key with Firestore and Firebase Auth permissions
+- A Discord bot token (for the server bot that handles slash commands)
+- One or more Discord bot tokens in the token pool (for edge nodes to join voice channels)
+
+## Setup
+
+```bash
+# 1. Copy env files
+make setup
+
+# 2. Fill in secrets
+#    drb-c2-core/.env       — MQTT, Firestore database name, GCS bucket
+#    drb-server-discord-bot/.env — Discord bot token, C2 URL
+#    drb-frontend/.env      — Firebase config (NEXT_PUBLIC_*), C2 URL
+
+# 3. Place your GCP service account key
+cp /path/to/your-key.json drb-c2-core/gcp-key.json
+
+# 4. Build and start
+make build
+make up
+```
+
+## Environment Variables
+
+### `drb-c2-core/.env`
+| Variable | Description |
+|---|---|
+| `MQTT_BROKER` | Hostname of the MQTT broker (default: `mosquitto`) |
+| `FIRESTORE_DATABASE` | Firestore database name (default: `(default)`) |
+| `GCP_CREDENTIALS_PATH` | Path to the GCP key file inside the container |
+| `GCS_BUCKET` | GCS bucket name for audio uploads (optional) |
+
+### `drb-server-discord-bot/.env`
+| Variable | Description |
+|---|---|
+| `DISCORD_TOKEN` | Bot token for the server-side command bot |
+| `C2_URL` | Internal URL of c2-core (default: `http://c2-core:8000`) |
+| `DEV_GUILD_ID` | Optional guild ID to sync slash commands instantly during dev |
+
+### `drb-frontend/.env`
+| Variable | Description |
+|---|---|
+| `NEXT_PUBLIC_FIREBASE_*` | Firebase project config (from Firebase console) |
+| `NEXT_PUBLIC_FIRESTORE_DATABASE` | Firestore database name (must match c2-core) |
+| `NEXT_PUBLIC_C2_URL` | C2 API URL reachable from the browser |
+
+## Admin Setup
+
+After the stack is running, grant admin access to your Firebase user:
+
+```bash
+cd drb-c2-core
+python scripts/set_admin.py grant your@email.com
+```
+
+Then sign out and back in to the frontend.
+
+## Makefile Targets
+
+```
+make setup    — copy .env.example files
+make build    — docker compose build
+make up       — docker compose up -d
+make down     — docker compose down
+make logs     — follow all logs
+make logs-c2       — c2-core logs only
+make logs-bot      — discord-bot logs only
+make logs-frontend — frontend logs only
+```
+
+## Architecture
+
+```
+Edge Node (client machine)
+    │
+    ├── MQTT checkin/status/metadata ──► mosquitto ──► c2-core ──► Firestore
+    │
+    └── MQTT commands ◄─────────────────────────────── c2-core
+              │
+              └── discord_join ──► edge node joins Discord voice + streams Icecast
+
+Discord User
+    │
+    └── /join /leave /status ──► discord-bot ──► c2-core ──► MQTT ──► edge node
+
+Browser (admin)
+    └── frontend ──► Firestore (real-time reads)
+                └── c2-core REST API (writes/commands)
+```
@@ -0,0 +1,35 @@
+services:
+  mosquitto:
+    image: eclipse-mosquitto:2
+    restart: unless-stopped
+    ports:
+      - "1883:1883"
+    volumes:
+      - ./drb-c2-core/mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf
+
+  c2-core:
+    build: ./drb-c2-core
+    restart: unless-stopped
+    ports:
+      - "8888:8000"
+    env_file: ./drb-c2-core/.env
+    volumes:
+      - ./drb-c2-core/gcp-key.json:/app/gcp-key.json:ro
+    depends_on:
+      - mosquitto
+
+  discord-bot:
+    build: ./drb-server-discord-bot
+    restart: unless-stopped
+    env_file: ./drb-server-discord-bot/.env
+    depends_on:
+      - c2-core
+
+  frontend:
+    build: ./drb-frontend
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    env_file: ./drb-frontend/.env
+    depends_on:
+      - c2-core
@@ -0,0 +1,7 @@
+__pycache__
+*.pyc
+*.pyo
+.git
+*.log
+.env
+.pytest_cache
@@ -0,0 +1,21 @@
+# MQTT broker (usually the mosquitto container on this host)
+MQTT_BROKER=mosquitto
+MQTT_PORT=1883
+MQTT_USER=
+MQTT_PASS=
+
+# GCP — path to service account JSON inside the container
+GCP_CREDENTIALS_PATH=/app/gcp-key.json
+
+# Firestore database name (use "(default)" if you didn't create a named database)
+FIRESTORE_DATABASE=c2-server
+
+# GCS bucket for audio storage
+GCS_BUCKET=your-bucket-name
+
+# How long (seconds) before a node is marked offline if no checkin received
+NODE_OFFLINE_THRESHOLD=90
+
+# Auth — static key that edge nodes send as Bearer token on /upload
+# Generate with: openssl rand -hex 32
+NODE_API_KEY=
@@ -0,0 +1,11 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app/ ./app/
+COPY tests/ ./tests/
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
@@ -0,0 +1,24 @@
+from pydantic_settings import BaseSettings
+from typing import Optional
+
+
+class Settings(BaseSettings):
+    # MQTT
+    mqtt_broker: str = "localhost"
+    mqtt_port: int = 1883
+    mqtt_user: Optional[str] = None
+    mqtt_pass: Optional[str] = None
+
+    # GCP
+    gcp_credentials_path: Optional[str] = None  # None → uses ADC
+    gcs_bucket: Optional[str] = None             # None → audio upload disabled
+    firestore_database: str = "(default)"
+
+    # Node health
+    node_offline_threshold: int = 90  # seconds without checkin before marking offline
+
+    class Config:
+        env_file = ".env"
+
+
+settings = Settings()
@@ -0,0 +1,28 @@
+from typing import Optional
+from fastapi import HTTPException, Security
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from firebase_admin import auth as firebase_auth
+
+_bearer = HTTPBearer(auto_error=False)
+
+
+async def require_firebase_token(
+    credentials: Optional[HTTPAuthorizationCredentials] = Security(_bearer),
+) -> dict:
+    """Verify a Firebase ID token from the Authorization: Bearer header."""
+    if not credentials:
+        raise HTTPException(status_code=401, detail="Missing authorization token")
+    try:
+        return firebase_auth.verify_id_token(credentials.credentials)
+    except Exception:
+        raise HTTPException(status_code=401, detail="Invalid or expired token")
+
+
+async def require_admin_token(
+    credentials: Optional[HTTPAuthorizationCredentials] = Security(_bearer),
+) -> dict:
+    """Verify a Firebase ID token AND require the admin custom claim."""
+    decoded = await require_firebase_token(credentials)
+    if not decoded.get("admin"):
+        raise HTTPException(status_code=403, detail="Admin access required")
+    return decoded
@@ -0,0 +1,62 @@
+import asyncio
+from typing import Optional, Any
+import firebase_admin
+from firebase_admin import credentials, firestore as fs
+from app.config import settings
+from app.internal.logger import logger
+
+
+def _init_firebase():
+    if firebase_admin._apps:
+        return firestore.client()
+
+    if settings.gcp_credentials_path:
+        cred = credentials.Certificate(settings.gcp_credentials_path)
+    else:
+        cred = credentials.ApplicationDefault()
+
+    firebase_admin.initialize_app(cred)
+    logger.info("Firebase initialised.")
+
+
+_init_firebase()
+db = fs.client(database_id=settings.firestore_database)
+
+
+# ---------------------------------------------------------------------------
+# Thin async wrappers — firebase-admin is synchronous, run in thread executor
+# ---------------------------------------------------------------------------
+
+async def doc_set(collection: str, doc_id: str, data: dict, merge: bool = True) -> None:
+    ref = db.collection(collection).document(doc_id)
+    await asyncio.to_thread(ref.set, data, merge=merge)
+
+
+async def doc_get(collection: str, doc_id: str) -> Optional[dict]:
+    ref = db.collection(collection).document(doc_id)
+    snap = await asyncio.to_thread(ref.get)
+    return snap.to_dict() if snap.exists else None
+
+
+async def doc_update(collection: str, doc_id: str, data: dict) -> None:
+    ref = db.collection(collection).document(doc_id)
+    await asyncio.to_thread(ref.update, data)
+
+
+async def collection_list(collection: str, **filters) -> list[dict]:
+    """
+    List all documents in a collection.
+    Optional keyword filters: field=value pairs passed as equality where-clauses.
+    """
+    def _query():
+        ref = db.collection(collection)
+        for field, value in filters.items():
+            ref = ref.where(field, "==", value)
+        return [doc.to_dict() for doc in ref.stream()]
+
+    return await asyncio.to_thread(_query)
+
+
+async def doc_delete(collection: str, doc_id: str) -> None:
+    ref = db.collection(collection).document(doc_id)
+    await asyncio.to_thread(ref.delete)
@@ -0,0 +1,10 @@
+import logging
+import sys
+
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
+    handlers=[logging.StreamHandler(sys.stdout)],
+)
+
+logger = logging.getLogger("drb-c2-core")
@@ -0,0 +1,244 @@
+import asyncio
+import json
+from datetime import datetime, timezone
+from typing import Optional
+import paho.mqtt.client as mqtt
+from app.config import settings
+from app.internal.logger import logger
+from app.internal import firestore as fstore
+
+
+class MQTTHandler:
+    def __init__(self):
+        self._client: Optional[mqtt.Client] = None
+        self._loop: Optional[asyncio.AbstractEventLoop] = None
+        self._connected = False
+
+    def _build_client(self) -> mqtt.Client:
+        client = mqtt.Client(
+            callback_api_version=mqtt.CallbackAPIVersion.VERSION2,
+            client_id="drb-c2-core",
+        )
+        if settings.mqtt_user:
+            client.username_pw_set(settings.mqtt_user, settings.mqtt_pass)
+
+        client.on_connect    = self._on_connect
+        client.on_disconnect = self._on_disconnect
+        client.on_message    = self._on_message
+        return client
+
+    def _on_connect(self, client, userdata, flags, reason_code, properties):
+        if reason_code == 0:
+            self._connected = True
+            client.subscribe("nodes/+/checkin",  qos=1)
+            client.subscribe("nodes/+/status",   qos=1)
+            client.subscribe("nodes/+/metadata", qos=1)
+            logger.info("MQTT connected — subscribed to node topics.")
+        else:
+            logger.error(f"MQTT connect refused: {reason_code}")
+
+    def _on_disconnect(self, client, userdata, disconnect_flags, reason_code, properties):
+        self._connected = False
+        logger.warning(f"MQTT disconnected: {reason_code}")
+
+    def _on_message(self, client, userdata, msg):
+        try:
+            payload = json.loads(msg.payload.decode())
+        except Exception:
+            logger.warning(f"Non-JSON MQTT message on {msg.topic}")
+            return
+
+        asyncio.run_coroutine_threadsafe(
+            self._dispatch(msg.topic, payload), self._loop
+        )
+
+    async def _dispatch(self, topic: str, payload: dict):
+        parts = topic.split("/")
+        # Expected: nodes/{node_id}/{type}
+        if len(parts) != 3 or parts[0] != "nodes":
+            return
+
+        node_id = parts[1]
+        msg_type = parts[2]
+
+        try:
+            if msg_type == "checkin":
+                await self._handle_checkin(node_id, payload)
+            elif msg_type == "status":
+                await self._handle_status(node_id, payload)
+            elif msg_type == "metadata":
+                await self._handle_metadata(node_id, payload)
+        except Exception as e:
+            logger.error(f"MQTT dispatch error [{msg_type}] from {node_id}: {e}")
+
+    # ------------------------------------------------------------------
+    # Checkin — upsert node; flag new unconfigured nodes
+    # ------------------------------------------------------------------
+
+    async def _handle_checkin(self, node_id: str, payload: dict):
+        existing = await fstore.doc_get("nodes", node_id)
+        now = datetime.now(timezone.utc)
+
+        if not existing:
+            # First time we've seen this node — create it as unconfigured, pending approval
+            doc = {
+                "node_id": node_id,
+                "name": payload.get("name", node_id),
+                "lat": payload.get("lat", 0.0),
+                "lon": payload.get("lon", 0.0),
+                "status": "unconfigured",
+                "configured": False,
+                "last_seen": now.isoformat(),
+                "assigned_system_id": None,
+                "approval_status": "pending",
+            }
+            await fstore.doc_set("nodes", node_id, doc, merge=False)
+            logger.info(f"New node registered: {node_id} — pending admin approval.")
+        else:
+            updates = {
+                "last_seen": now.isoformat(),
+                "name": payload.get("name", existing.get("name", node_id)),
+                "lat": payload.get("lat", existing.get("lat", 0.0)),
+                "lon": payload.get("lon", existing.get("lon", 0.0)),
+            }
+            # Only promote to online if already configured (don't overwrite explicit status)
+            if existing.get("configured") and existing.get("status") not in ("recording",):
+                updates["status"] = "online"
+            await fstore.doc_update("nodes", node_id, updates)
+
+    # ------------------------------------------------------------------
+    # Status update
+    # ------------------------------------------------------------------
+
+    async def _handle_status(self, node_id: str, payload: dict):
+        status = payload.get("status")
+        if not status:
+            return
+        await fstore.doc_update("nodes", node_id, {
+            "status": status,
+            "last_seen": datetime.now(timezone.utc).isoformat(),
+        })
+
+    # ------------------------------------------------------------------
+    # Metadata — call_start / call_end events
+    # ------------------------------------------------------------------
+
+    async def _handle_metadata(self, node_id: str, payload: dict):
+        event = payload.get("event")
+        if event == "call_start":
+            await self._on_call_start(node_id, payload)
+        elif event == "call_end":
+            await self._on_call_end(node_id, payload)
+
+    async def _on_call_start(self, node_id: str, payload: dict):
+        call_id = payload.get("call_id")
+        if not call_id:
+            return
+
+        # Look up assigned system for this node
+        node = await fstore.doc_get("nodes", node_id)
+        system_id = node.get("assigned_system_id") if node else None
+
+        started_at_raw = payload.get("started_at")
+        started_at = (
+            datetime.fromisoformat(started_at_raw)
+            if started_at_raw
+            else datetime.now(timezone.utc)
+        )
+
+        doc = {
+            "call_id": call_id,
+            "node_id": node_id,
+            "system_id": system_id,
+            "talkgroup_id": payload.get("tgid"),
+            "talkgroup_name": payload.get("tgid_name") or "",
+            "freq": payload.get("freq"),
+            "srcaddr": payload.get("srcaddr"),
+            "started_at": started_at,
+            "ended_at": None,
+            "audio_url": None,
+            "transcript": None,
+            "incident_id": None,
+            "location": None,
+            "tags": [],
+            "status": "active",
+        }
+        await fstore.doc_set("calls", call_id, doc, merge=False)
+        logger.info(f"Call start: {call_id} (node={node_id}, tgid={payload.get('tgid')})")
+
+    async def _on_call_end(self, node_id: str, payload: dict):
+        call_id = payload.get("call_id")
+        if not call_id:
+            return
+
+        ended_at_raw = payload.get("ended_at")
+        ended_at = (
+            datetime.fromisoformat(ended_at_raw)
+            if ended_at_raw
+            else datetime.now(timezone.utc)
+        )
+
+        updates = {
+            "ended_at": ended_at,
+            "status": "ended",
+        }
+        if payload.get("audio_url"):
+            updates["audio_url"] = payload["audio_url"]
+
+        await fstore.doc_update("calls", call_id, updates)
+        logger.info(f"Call end: {call_id}")
+
+    # ------------------------------------------------------------------
+    # Outbound — send a command to a specific node
+    # ------------------------------------------------------------------
+
+    def send_command(self, node_id: str, payload: dict):
+        topic = f"nodes/{node_id}/commands"
+        if self._client and self._connected:
+            self._client.publish(topic, json.dumps(payload), qos=1)
+            logger.info(f"Command sent to {node_id}: {payload.get('action')}")
+        else:
+            logger.warning(f"MQTT not connected — could not send command to {node_id}")
+
+    def push_config(self, node_id: str, system_config: dict):
+        topic = f"nodes/{node_id}/config"
+        if self._client and self._connected:
+            self._client.publish(topic, json.dumps(system_config), qos=1)
+            logger.info(f"Config pushed to {node_id}")
+        else:
+            logger.warning(f"MQTT not connected — could not push config to {node_id}")
+
+    def publish_node_key(self, node_id: str, api_key: str):
+        """Publish the provisioned API key to the node (retained so it survives reconnects)."""
+        topic = f"nodes/{node_id}/api_key"
+        if self._client and self._connected:
+            self._client.publish(topic, json.dumps({"api_key": api_key}), qos=2, retain=True)
+            logger.info(f"API key provisioned to {node_id}")
+        else:
+            logger.warning(f"MQTT not connected — could not provision key to {node_id}")
+
+    # ------------------------------------------------------------------
+    # Lifecycle
+    # ------------------------------------------------------------------
+
+    async def connect(self):
+        self._loop = asyncio.get_event_loop()
+        self._client = self._build_client()
+        try:
+            self._client.connect(settings.mqtt_broker, settings.mqtt_port, keepalive=60)
+            self._client.loop_start()
+            logger.info(f"MQTT connecting to {settings.mqtt_broker}:{settings.mqtt_port}")
+        except Exception as e:
+            logger.error(f"MQTT connection error: {e}")
+
+    async def disconnect(self):
+        if self._client:
+            self._client.loop_stop()
+            self._client.disconnect()
+
+    @property
+    def is_connected(self) -> bool:
+        return self._connected
+
+
+mqtt_handler = MQTTHandler()
@@ -0,0 +1,55 @@
+import asyncio
+from datetime import datetime, timezone, timedelta
+from app.config import settings
+from app.internal.logger import logger
+from app.internal import firestore as fstore
+
+SWEEP_INTERVAL = 30  # seconds
+
+
+async def sweeper_loop():
+    """
+    Periodically check for nodes that haven't checked in recently
+    and mark them offline in Firestore.
+    """
+    logger.info("Node sweeper started.")
+    while True:
+        await asyncio.sleep(SWEEP_INTERVAL)
+        try:
+            await _sweep()
+        except Exception as e:
+            logger.error(f"Sweeper error: {e}")
+
+
+async def _sweep():
+    threshold = datetime.now(timezone.utc) - timedelta(seconds=settings.node_offline_threshold)
+
+    def _query():
+        from app.internal.firestore import db
+        return [
+            doc.to_dict()
+            for doc in db.collection("nodes").stream()
+        ]
+
+    nodes = await asyncio.to_thread(_query)
+    for node in nodes:
+        status = node.get("status", "offline")
+        if status == "offline":
+            continue
+
+        last_seen_raw = node.get("last_seen")
+        if not last_seen_raw:
+            continue
+
+        # last_seen may be a Firestore Timestamp, a datetime, or an ISO string
+        if isinstance(last_seen_raw, str):
+            last_seen = datetime.fromisoformat(last_seen_raw)
+        else:
+            last_seen = last_seen_raw
+        if last_seen.tzinfo is None:
+            last_seen = last_seen.replace(tzinfo=timezone.utc)
+
+        if last_seen < threshold:
+            node_id = node.get("node_id")
+            await fstore.doc_update("nodes", node_id, {"status": "offline"})
+            logger.info(f"Node {node_id} marked offline (last seen: {last_seen.isoformat()})")
@@ -0,0 +1,28 @@
+import asyncio
+from typing import Optional
+from app.config import settings
+from app.internal.logger import logger
+
+
+async def upload_audio(data: bytes, filename: str) -> Optional[str]:
+    """Upload audio bytes to GCS and return the public URL, or None if disabled."""
+    if not settings.gcs_bucket:
+        logger.info("GCS_BUCKET not configured — skipping audio upload.")
+        return None
+
+    def _upload() -> str:
+        from google.cloud import storage
+        client = storage.Client()
+        bucket = client.bucket(settings.gcs_bucket)
+        blob = bucket.blob(f"calls/{filename}")
+        blob.upload_from_string(data, content_type="audio/mpeg")
+        blob.make_public()
+        return blob.public_url
+
+    try:
+        url = await asyncio.to_thread(_upload)
+        logger.info(f"Audio uploaded: {url}")
+        return url
+    except Exception as e:
+        logger.error(f"GCS upload failed: {e}")
+        return None
@@ -0,0 +1,44 @@
+import asyncio
+from contextlib import asynccontextmanager
+from fastapi import FastAPI, Depends
+from fastapi.middleware.cors import CORSMiddleware
+from app.internal.logger import logger
+from app.internal.mqtt_handler import mqtt_handler
+from app.internal.node_sweeper import sweeper_loop
+from app.internal.auth import require_firebase_token
+from app.routers import nodes, systems, calls, upload, tokens
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    logger.info("DRB C2 Core starting.")
+
+    await mqtt_handler.connect()
+    sweeper_task = asyncio.create_task(sweeper_loop())
+
+    yield  # --- app running ---
+
+    logger.info("DRB C2 Core shutting down.")
+    sweeper_task.cancel()
+    await mqtt_handler.disconnect()
+
+
+app = FastAPI(title="DRB C2 Core", lifespan=lifespan)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+app.include_router(nodes.router,   dependencies=[Depends(require_firebase_token)])
+app.include_router(systems.router, dependencies=[Depends(require_firebase_token)])
+app.include_router(calls.router,   dependencies=[Depends(require_firebase_token)])
+app.include_router(tokens.router,  dependencies=[Depends(require_firebase_token)])
+app.include_router(upload.router)  # auth is per-node, handled inline
+
+
+@app.get("/health")
+async def health():
+    return {"ok": True, "mqtt_connected": mqtt_handler.is_connected}
@@ -0,0 +1,80 @@
+from pydantic import BaseModel, Field
+from typing import Optional, List, Dict, Any
+from datetime import datetime
+
+
+# ---------------------------------------------------------------------------
+# Nodes
+# ---------------------------------------------------------------------------
+
+class NodeRecord(BaseModel):
+    node_id: str
+    name: str
+    lat: float = 0.0
+    lon: float = 0.0
+    status: str = "offline"          # online / offline / recording / unconfigured
+    configured: bool = False
+    last_seen: Optional[datetime] = None
+    assigned_system_id: Optional[str] = None
+
+
+class CommandPayload(BaseModel):
+    action: str                      # discord_join / discord_leave / op25_restart
+    guild_id: Optional[str] = None
+    channel_id: Optional[str] = None
+
+
+# ---------------------------------------------------------------------------
+# Systems
+# ---------------------------------------------------------------------------
+
+class SystemRecord(BaseModel):
+    system_id: str
+    name: str
+    type: str                        # P25 / DMR / NBFM
+    config: Dict[str, Any] = {}     # OP25-compatible config blob
+
+
+class SystemCreate(BaseModel):
+    name: str
+    type: str
+    config: Dict[str, Any] = {}
+
+
+# ---------------------------------------------------------------------------
+# Calls
+# ---------------------------------------------------------------------------
+
+class CallRecord(BaseModel):
+    call_id: str
+    node_id: str
+    system_id: Optional[str] = None
+    talkgroup_id: Optional[int] = None
+    talkgroup_name: Optional[str] = None
+    freq: Optional[float] = None
+    srcaddr: Optional[str] = None
+    started_at: datetime
+    ended_at: Optional[datetime] = None
+    audio_url: Optional[str] = None
+    transcript: Optional[str] = None   # populated later by STT
+    incident_id: Optional[str] = None  # populated later by intelligence layer
+    location: Optional[Dict[str, float]] = None  # {lat, lng}
+    tags: List[str] = []
+    status: str = "active"             # active / ended
+
+
+# ---------------------------------------------------------------------------
+# Incidents
+# ---------------------------------------------------------------------------
+
+class IncidentRecord(BaseModel):
+    incident_id: str
+    title: Optional[str] = None
+    type: Optional[str] = None         # fire / police / ems / etc.
+    status: str = "active"             # active / resolved
+    location: Optional[Dict[str, float]] = None
+    call_ids: List[str] = []
+    started_at: datetime
+    updated_at: datetime
+    summary: Optional[str] = None
+    tags: List[str] = []
@@ -0,0 +1,29 @@
+from fastapi import APIRouter, HTTPException, Query
+from typing import Optional
+from app.internal import firestore as fstore
+
+router = APIRouter(prefix="/calls", tags=["calls"])
+
+
+@router.get("")
+async def list_calls(
+    node_id: Optional[str] = Query(None),
+    status: Optional[str] = Query(None),
+    system_id: Optional[str] = Query(None),
+):
+    filters = {}
+    if node_id:
+        filters["node_id"] = node_id
+    if status:
+        filters["status"] = status
+    if system_id:
+        filters["system_id"] = system_id
+    return await fstore.collection_list("calls", **filters)
+
+
+@router.get("/{call_id}")
+async def get_call(call_id: str):
+    call = await fstore.doc_get("calls", call_id)
+    if not call:
+        raise HTTPException(404, f"Call '{call_id}' not found.")
+    return call
@@ -0,0 +1,91 @@
+import secrets
+from fastapi import APIRouter, HTTPException, Depends
+from app.models import CommandPayload
+from app.internal import firestore as fstore
+from app.internal.mqtt_handler import mqtt_handler
+from app.internal.auth import require_admin_token
+from app.routers.tokens import assign_token, release_token
+
+router = APIRouter(prefix="/nodes", tags=["nodes"])
+
+
+@router.get("")
+async def list_nodes():
+    return await fstore.collection_list("nodes")
+
+
+@router.get("/{node_id}")
+async def get_node(node_id: str):
+    node = await fstore.doc_get("nodes", node_id)
+    if not node:
+        raise HTTPException(404, f"Node '{node_id}' not found.")
+    return node
+
+
+@router.post("/{node_id}/approve")
+async def approve_node(node_id: str, _: dict = Depends(require_admin_token)):
+    node = await fstore.doc_get("nodes", node_id)
+    if not node:
+        raise HTTPException(404, f"Node '{node_id}' not found.")
+
+    api_key = secrets.token_hex(32)
+    await fstore.doc_set("node_keys", node_id, {"node_id": node_id, "api_key": api_key}, merge=False)
+    await fstore.doc_update("nodes", node_id, {"approval_status": "approved"})
+    mqtt_handler.publish_node_key(node_id, api_key)
+    return {"ok": True}
+
+
+@router.post("/{node_id}/reject")
+async def reject_node(node_id: str, _: dict = Depends(require_admin_token)):
+    node = await fstore.doc_get("nodes", node_id)
+    if not node:
+        raise HTTPException(404, f"Node '{node_id}' not found.")
+    await fstore.doc_update("nodes", node_id, {"approval_status": "rejected"})
+    return {"ok": True}
+
+
+@router.post("/{node_id}/command")
+async def send_command(node_id: str, cmd: CommandPayload):
+    node = await fstore.doc_get("nodes", node_id)
+    if not node:
+        raise HTTPException(404, f"Node '{node_id}' not found.")
+
+    payload = cmd.model_dump(exclude_none=True)
+
+    if cmd.action == "discord_join":
+        token = await assign_token(node_id)
+        if not token:
+            raise HTTPException(503, "No Discord bot tokens available in the pool.")
+        payload["token"] = token
+
+    elif cmd.action == "discord_leave":
+        await release_token(node_id)
+
+    mqtt_handler.send_command(node_id, payload)
+    return {"ok": True}
+
+
+@router.post("/{node_id}/config/{system_id}")
+async def assign_system(node_id: str, system_id: str):
+    """
+    Assign a system to a node. Fetches the system config from Firestore
+    and pushes it to the node via MQTT, then marks the node as configured.
+    """
+    node = await fstore.doc_get("nodes", node_id)
+    if not node:
+        raise HTTPException(404, f"Node '{node_id}' not found.")
+
+    system = await fstore.doc_get("systems", system_id)
+    if not system:
+        raise HTTPException(404, f"System '{system_id}' not found.")
+
+    # Push config to the node via MQTT
+    mqtt_handler.push_config(node_id, system)
+
+    # Update Firestore
+    await fstore.doc_update("nodes", node_id, {
+        "assigned_system_id": system_id,
+        "configured": True,
+    })
+
+    return {"ok": True}
@@ -0,0 +1,44 @@
+import uuid
+from fastapi import APIRouter, HTTPException
+from app.models import SystemCreate, SystemRecord
+from app.internal import firestore as fstore
+
+router = APIRouter(prefix="/systems", tags=["systems"])
+
+
+@router.get("")
+async def list_systems():
+    return await fstore.collection_list("systems")
+
+
+@router.get("/{system_id}")
+async def get_system(system_id: str):
+    system = await fstore.doc_get("systems", system_id)
+    if not system:
+        raise HTTPException(404, f"System '{system_id}' not found.")
+    return system
+
+
+@router.post("", status_code=201)
+async def create_system(body: SystemCreate):
+    system_id = str(uuid.uuid4())
+    doc = SystemRecord(system_id=system_id, **body.model_dump())
+    await fstore.doc_set("systems", system_id, doc.model_dump(), merge=False)
+    return doc
+
+
+@router.put("/{system_id}")
+async def update_system(system_id: str, body: SystemCreate):
+    existing = await fstore.doc_get("systems", system_id)
+    if not existing:
+        raise HTTPException(404, f"System '{system_id}' not found.")
+    await fstore.doc_update("systems", system_id, body.model_dump())
+    return {**existing, **body.model_dump()}
+
+
+@router.delete("/{system_id}", status_code=204)
+async def delete_system(system_id: str):
+    existing = await fstore.doc_get("systems", system_id)
+    if not existing:
+        raise HTTPException(404, f"System '{system_id}' not found.")
+    await fstore.doc_delete("systems", system_id)
@@ -0,0 +1,103 @@
+import uuid
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+from typing import Optional
+from datetime import datetime, timezone
+from app.internal import firestore as fstore
+
+router = APIRouter(prefix="/tokens", tags=["tokens"])
+
+
+class TokenCreate(BaseModel):
+    name: str        # friendly label e.g. "DRB Bot 1"
+    token: str       # the actual Discord bot token
+
+
+# ---------------------------------------------------------------------------
+# CRUD
+# ---------------------------------------------------------------------------
+
+@router.get("")
+async def list_tokens():
+    """List all tokens. The actual token string is masked for safety."""
+    tokens = await fstore.collection_list("bot_tokens")
+    return [
+        {**t, "token": t["token"][:10] + "…" + t["token"][-4:]}
+        for t in tokens
+    ]
+
+
+@router.post("", status_code=201)
+async def add_token(body: TokenCreate):
+    token_id = str(uuid.uuid4())
+    doc = {
+        "token_id": token_id,
+        "name": body.name,
+        "token": body.token,
+        "in_use": False,
+        "assigned_node_id": None,
+        "assigned_at": None,
+    }
+    await fstore.doc_set("bot_tokens", token_id, doc, merge=False)
+    return {"token_id": token_id, "name": body.name}
+
+
+@router.delete("/{token_id}", status_code=204)
+async def delete_token(token_id: str):
+    existing = await fstore.doc_get("bot_tokens", token_id)
+    if not existing:
+        raise HTTPException(404, "Token not found.")
+    if existing.get("in_use"):
+        raise HTTPException(409, "Token is currently in use by a node.")
+    await fstore.doc_delete("bot_tokens", token_id)
+
+
+# ---------------------------------------------------------------------------
+# Internal helpers — used by the nodes router, not exposed via HTTP
+# ---------------------------------------------------------------------------
+
+async def assign_token(node_id: str) -> Optional[str]:
+    """
+    Find a free token, mark it as in-use, return the token string.
+    Returns None if no tokens are available.
+    """
+    def _find_free():
+        from app.internal.firestore import db
+        docs = db.collection("bot_tokens").where("in_use", "==", False).limit(1).stream()
+        return [d for d in docs]
+
+    import asyncio
+    results = await asyncio.to_thread(_find_free)
+    if not results:
+        return None
+
+    doc = results[0]
+    token_id = doc.id
+    token_value = doc.to_dict()["token"]
+
+    await fstore.doc_update("bot_tokens", token_id, {
+        "in_use": True,
+        "assigned_node_id": node_id,
+        "assigned_at": datetime.now(timezone.utc),
+    })
+    return token_value
+
+
+async def release_token(node_id: str) -> None:
+    """Free whichever token is currently assigned to this node."""
+    def _find_assigned():
+        from app.internal.firestore import db
+        return [
+            d for d in db.collection("bot_tokens")
+            .where("assigned_node_id", "==", node_id)
+            .stream()
+        ]
+
+    import asyncio
+    results = await asyncio.to_thread(_find_assigned)
+    for doc in results:
+        await fstore.doc_update("bot_tokens", doc.id, {
+            "in_use": False,
+            "assigned_node_id": None,
+            "assigned_at": None,
+        })
@@ -0,0 +1,44 @@
+from typing import Optional
+from fastapi import APIRouter, UploadFile, File, Form, HTTPException, Security
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from app.internal.storage import upload_audio
+from app.internal import firestore as fstore
+from app.internal.logger import logger
+
+router = APIRouter(tags=["upload"])
+
+_bearer = HTTPBearer(auto_error=False)
+
+
+@router.post("/upload")
+async def upload_call_audio(
+    file: UploadFile = File(...),
+    call_id: str = Form(...),
+    node_id: str = Form(...),
+    credentials: Optional[HTTPAuthorizationCredentials] = Security(_bearer),
+):
+    """
+    Receive an audio recording from an edge node.
+    Upload to GCS, update the call document in Firestore with the audio URL.
+    """
+    # Verify the per-node API key
+    if not credentials:
+        raise HTTPException(401, "Missing authorization")
+    key_doc = await fstore.doc_get("node_keys", node_id)
+    if not key_doc or key_doc.get("api_key") != credentials.credentials:
+        raise HTTPException(401, "Invalid node API key")
+
+    data = await file.read()
+    if not data:
+        raise HTTPException(400, "Empty file.")
+
+    filename = f"{call_id}_{file.filename}"
+    audio_url = await upload_audio(data, filename)
+
+    if audio_url:
+        try:
+            await fstore.doc_update("calls", call_id, {"audio_url": audio_url})
+        except Exception as e:
+            logger.warning(f"Could not update call {call_id} with audio_url: {e}")
+
+    return {"url": audio_url}
@@ -0,0 +1,8 @@
+listener 1883
+allow_anonymous true
+
+# Persist messages across restarts
+persistence true
+persistence_location /mosquitto/data/
+
+log_dest stdout
@@ -0,0 +1,3 @@
+[pytest]
+asyncio_mode = auto
+testpaths = tests
@@ -0,0 +1,9 @@
+fastapi
+uvicorn[standard]
+pydantic-settings
+paho-mqtt>=2.0.0
+firebase-admin
+google-cloud-storage
+python-multipart
+pytest
+pytest-asyncio
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""
+Set or remove the 'admin' custom claim on a Firebase user.
+
+Usage (run from drb-c2-core directory):
+  python scripts/set_admin.py grant user@example.com
+  python scripts/set_admin.py revoke user@example.com
+
+Requires GCP_CREDENTIALS_PATH or Application Default Credentials.
+The user must sign out and back in (or wait up to 1 hour) for the
+new claim to take effect in their ID token.
+"""
+import sys
+import os
+import firebase_admin
+from firebase_admin import credentials, auth
+
+def main():
+    if len(sys.argv) != 3 or sys.argv[1] not in ("grant", "revoke"):
+        print(__doc__)
+        sys.exit(1)
+
+    action, email = sys.argv[1], sys.argv[2]
+
+    creds_path = os.getenv("GCP_CREDENTIALS_PATH", "gcp-key.json")
+    cred = credentials.Certificate(creds_path)
+    firebase_admin.initialize_app(cred)
+
+    try:
+        user = auth.get_user_by_email(email)
+    except auth.UserNotFoundError:
+        print(f"No Firebase user found for {email!r}")
+        sys.exit(1)
+
+    existing = user.custom_claims or {}
+    if action == "grant":
+        updated = {**existing, "admin": True}
+        auth.set_custom_user_claims(user.uid, updated)
+        print(f"Admin granted to {email} ({user.uid})")
+    else:
+        updated = {k: v for k, v in existing.items() if k != "admin"}
+        auth.set_custom_user_claims(user.uid, updated)
+        print(f"Admin revoked from {email} ({user.uid})")
+
+    print("The user must sign out and back in for the change to take effect.")
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,2 @@
+# All C2 core settings have defaults — no env setup needed.
+# Add any shared fixtures here if required in the future.
@@ -0,0 +1,286 @@
+"""
+Unit tests for MQTTHandler — topic dispatch and Firestore write logic.
+Firestore is mocked throughout; no MQTT broker or DB required.
+"""
+import pytest
+from unittest.mock import AsyncMock, patch, call
+from app.internal.mqtt_handler import MQTTHandler
+
+
+@pytest.fixture
+def handler():
+    return MQTTHandler()
+
+
+# ---------------------------------------------------------------------------
+# Topic dispatch
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_dispatch_routes_checkin(handler):
+    with patch.object(handler, "_handle_checkin", new=AsyncMock()) as m:
+        await handler._dispatch("nodes/node-01/checkin", {"name": "Pi"})
+    m.assert_called_once_with("node-01", {"name": "Pi"})
+
+
+@pytest.mark.asyncio
+async def test_dispatch_routes_status(handler):
+    with patch.object(handler, "_handle_status", new=AsyncMock()) as m:
+        await handler._dispatch("nodes/node-01/status", {"status": "online"})
+    m.assert_called_once_with("node-01", {"status": "online"})
+
+
+@pytest.mark.asyncio
+async def test_dispatch_routes_metadata(handler):
+    with patch.object(handler, "_handle_metadata", new=AsyncMock()) as m:
+        await handler._dispatch("nodes/node-01/metadata", {"event": "call_start"})
+    m.assert_called_once_with("node-01", {"event": "call_start"})
+
+
+@pytest.mark.asyncio
+async def test_dispatch_ignores_wrong_prefix(handler):
+    with patch.object(handler, "_handle_checkin", new=AsyncMock()) as m:
+        await handler._dispatch("other/topic/here", {})
+    m.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_dispatch_ignores_malformed_topic(handler):
+    with patch.object(handler, "_handle_checkin", new=AsyncMock()) as m:
+        await handler._dispatch("nodes/checkin", {})  # only 2 parts
+    m.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# Checkin — new node
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_checkin_creates_new_node(handler):
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=None)
+        mock_fstore.doc_set = AsyncMock()
+
+        await handler._handle_checkin(
+            "new-node",
+            {"name": "Pi Zero W", "lat": 40.7, "lon": -74.0},
+        )
+
+    mock_fstore.doc_set.assert_called_once()
+    _, _, doc, _ = mock_fstore.doc_set.call_args[0]
+    assert doc["node_id"] == "new-node"
+    assert doc["name"] == "Pi Zero W"
+    assert doc["status"] == "unconfigured"
+    assert doc["configured"] is False
+    assert doc["lat"] == 40.7
+
+
+@pytest.mark.asyncio
+async def test_checkin_new_node_defaults_lat_lon(handler):
+    """Missing lat/lon in payload should default to 0.0."""
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=None)
+        mock_fstore.doc_set = AsyncMock()
+
+        await handler._handle_checkin("new-node", {})
+
+    _, _, doc, _ = mock_fstore.doc_set.call_args[0]
+    assert doc["lat"] == 0.0
+    assert doc["lon"] == 0.0
+
+
+# ---------------------------------------------------------------------------
+# Checkin — existing node
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_checkin_updates_existing_configured_node(handler):
+    existing = {
+        "node_id": "node-01",
+        "name": "Old Name",
+        "lat": 0.0,
+        "lon": 0.0,
+        "status": "online",
+        "configured": True,
+    }
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=existing)
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._handle_checkin("node-01", {"name": "New Name", "lat": 1.1, "lon": 2.2})
+
+    updates = mock_fstore.doc_update.call_args[0][2]
+    assert updates["name"] == "New Name"
+    assert updates["lat"] == 1.1
+    assert updates["status"] == "online"
+    assert "last_seen" in updates
+
+
+@pytest.mark.asyncio
+async def test_checkin_does_not_promote_unconfigured_to_online(handler):
+    existing = {
+        "node_id": "node-02",
+        "name": "Node",
+        "lat": 0.0,
+        "lon": 0.0,
+        "status": "unconfigured",
+        "configured": False,
+    }
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=existing)
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._handle_checkin("node-02", {})
+
+    updates = mock_fstore.doc_update.call_args[0][2]
+    assert "status" not in updates
+
+
+@pytest.mark.asyncio
+async def test_checkin_does_not_override_recording_status(handler):
+    existing = {
+        "node_id": "node-03",
+        "name": "Node",
+        "lat": 0.0,
+        "lon": 0.0,
+        "status": "recording",
+        "configured": True,
+    }
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=existing)
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._handle_checkin("node-03", {})
+
+    updates = mock_fstore.doc_update.call_args[0][2]
+    assert "status" not in updates
+
+
+# ---------------------------------------------------------------------------
+# Status update
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_handle_status_updates_firestore(handler):
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._handle_status("node-01", {"status": "recording"})
+
+    updates = mock_fstore.doc_update.call_args[0][2]
+    assert updates["status"] == "recording"
+    assert "last_seen" in updates
+
+
+@pytest.mark.asyncio
+async def test_handle_status_ignores_empty_payload(handler):
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._handle_status("node-01", {})
+
+    mock_fstore.doc_update.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# Metadata — call_start / call_end
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_call_start_creates_call_doc(handler):
+    node = {"node_id": "node-01", "assigned_system_id": "sys-001"}
+    payload = {
+        "event": "call_start",
+        "call_id": "call-abc123",
+        "tgid": 1234,
+        "tgid_name": "Police Dispatch",
+        "started_at": "2026-01-01T00:00:00+00:00",
+        "freq": 851012500,
+        "srcaddr": 42,
+    }
+
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=node)
+        mock_fstore.doc_set = AsyncMock()
+
+        await handler._on_call_start("node-01", payload)
+
+    mock_fstore.doc_set.assert_called_once()
+    _, _, doc, _ = mock_fstore.doc_set.call_args[0]
+    assert doc["call_id"] == "call-abc123"
+    assert doc["node_id"] == "node-01"
+    assert doc["system_id"] == "sys-001"
+    assert doc["talkgroup_id"] == 1234
+    assert doc["talkgroup_name"] == "Police Dispatch"
+    assert doc["status"] == "active"
+    assert doc["audio_url"] is None
+
+
+@pytest.mark.asyncio
+async def test_call_start_handles_missing_call_id(handler):
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value={})
+        mock_fstore.doc_set = AsyncMock()
+
+        await handler._on_call_start("node-01", {"event": "call_start"})
+
+    mock_fstore.doc_set.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_call_start_uses_now_when_started_at_missing(handler):
+    node = {"node_id": "node-01", "assigned_system_id": None}
+    payload = {"call_id": "call-xyz", "tgid": 99}
+
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=node)
+        mock_fstore.doc_set = AsyncMock()
+
+        await handler._on_call_start("node-01", payload)
+
+    _, _, doc, _ = mock_fstore.doc_set.call_args[0]
+    assert doc["started_at"] is not None
+
+
+@pytest.mark.asyncio
+async def test_call_end_updates_status_and_times(handler):
+    payload = {
+        "call_id": "call-abc123",
+        "ended_at": "2026-01-01T00:05:00+00:00",
+    }
+
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._on_call_end("node-01", payload)
+
+    updates = mock_fstore.doc_update.call_args[0][2]
+    assert updates["status"] == "ended"
+    assert updates["ended_at"] is not None
+
+
+@pytest.mark.asyncio
+async def test_call_end_sets_audio_url_when_present(handler):
+    payload = {
+        "call_id": "call-abc123",
+        "ended_at": "2026-01-01T00:05:00+00:00",
+        "audio_url": "https://storage.example.com/call.mp3",
+    }
+
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._on_call_end("node-01", payload)
+
+    updates = mock_fstore.doc_update.call_args[0][2]
+    assert updates["audio_url"] == "https://storage.example.com/call.mp3"
+
+
+@pytest.mark.asyncio
+async def test_call_end_ignores_missing_call_id(handler):
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+
+        await handler._on_call_end("node-01", {"ended_at": "2026-01-01T00:05:00+00:00"})
+
+    mock_fstore.doc_update.assert_not_called()
@@ -0,0 +1,150 @@
+"""
+Unit tests for node_sweeper — datetime comparison logic and Firestore update gating.
+Firestore and asyncio.to_thread are mocked — no real DB required.
+"""
+import pytest
+import asyncio
+from datetime import datetime, timezone, timedelta
+from unittest.mock import AsyncMock, patch, MagicMock
+from app.internal.node_sweeper import _sweep
+
+
+def _node(node_id, status, age_seconds):
+    """Helper: build a node dict with last_seen age_seconds ago (tz-aware)."""
+    return {
+        "node_id": node_id,
+        "status": status,
+        "last_seen": datetime.now(timezone.utc) - timedelta(seconds=age_seconds),
+    }
+
+
+def _node_naive(node_id, status, age_seconds):
+    """Helper: tz-naive last_seen (simulates some Firestore SDK versions)."""
+    return {
+        "node_id": node_id,
+        "status": status,
+        "last_seen": datetime.utcnow() - timedelta(seconds=age_seconds),
+    }
+
+
+# ---------------------------------------------------------------------------
+# Core sweep logic
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_stale_online_node_marked_offline():
+    nodes = [_node("node-01", "online", age_seconds=120)]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    mock_fstore.doc_update.assert_called_once_with(
+        "nodes", "node-01", {"status": "offline"}
+    )
+
+
+@pytest.mark.asyncio
+async def test_stale_recording_node_marked_offline():
+    nodes = [_node("node-02", "recording", age_seconds=200)]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    mock_fstore.doc_update.assert_called_once_with(
+        "nodes", "node-02", {"status": "offline"}
+    )
+
+
+@pytest.mark.asyncio
+async def test_fresh_node_not_touched():
+    nodes = [_node("node-03", "online", age_seconds=10)]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    mock_fstore.doc_update.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_already_offline_node_skipped():
+    """Offline nodes must be skipped even if last_seen is ancient."""
+    nodes = [_node("node-04", "offline", age_seconds=9999)]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    mock_fstore.doc_update.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_node_with_no_last_seen_skipped():
+    nodes = [{"node_id": "node-05", "status": "online", "last_seen": None}]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    mock_fstore.doc_update.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# Timezone edge cases
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_tz_naive_last_seen_is_handled():
+    """Firestore may return tz-naive datetimes; sweeper must not crash."""
+    nodes = [_node_naive("node-06", "online", age_seconds=120)]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    mock_fstore.doc_update.assert_called_once_with(
+        "nodes", "node-06", {"status": "offline"}
+    )
+
+
+@pytest.mark.asyncio
+async def test_tz_naive_fresh_node_not_touched():
+    nodes = [_node_naive("node-07", "online", age_seconds=5)]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    mock_fstore.doc_update.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# Batch behaviour
+# ---------------------------------------------------------------------------
+
+@pytest.mark.asyncio
+async def test_only_stale_nodes_updated_in_batch():
+    nodes = [
+        _node("node-08", "online", age_seconds=200),   # stale → offline
+        _node("node-09", "online", age_seconds=5),     # fresh → skip
+        _node("node-10", "offline", age_seconds=500),  # already offline → skip
+        _node("node-11", "recording", age_seconds=150), # stale recording → offline
+    ]
+
+    with patch("asyncio.to_thread", new=AsyncMock(return_value=nodes)), \
+         patch("app.internal.node_sweeper.fstore") as mock_fstore:
+        mock_fstore.doc_update = AsyncMock()
+        await _sweep()
+
+    assert mock_fstore.doc_update.call_count == 2
+    updated_ids = {call.args[1] for call in mock_fstore.doc_update.call_args_list}
+    assert updated_ids == {"node-08", "node-11"}
@@ -0,0 +1,4 @@
+node_modules
+.next
+.git
+*.log
@@ -0,0 +1,12 @@
+# Firebase — get these from your Firebase project settings
+NEXT_PUBLIC_FIREBASE_API_KEY=
+NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=
+NEXT_PUBLIC_FIREBASE_PROJECT_ID=
+NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=
+NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=
+NEXT_PUBLIC_FIREBASE_APP_ID=
+# Named Firestore database (omit or set to "(default)" if using the default database)
+NEXT_PUBLIC_FIRESTORE_DATABASE=
+
+# C2 API — must be reachable from the browser (or a server-side proxy)
+NEXT_PUBLIC_C2_URL=http://localhost:8888
@@ -0,0 +1,17 @@
+FROM node:20-slim AS builder
+
+WORKDIR /app
+COPY package.json ./
+RUN npm install
+COPY . .
+RUN npm run build
+
+FROM node:20-slim AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+
+COPY --from=builder /app/.next/standalone ./
+COPY --from=builder /app/.next/static ./.next/static
+
+EXPOSE 3000
+CMD ["node", "server.js"]
@@ -0,0 +1,93 @@
+"use client";
+
+import { useState } from "react";
+import { useCalls } from "@/lib/useCalls";
+import { useSystems } from "@/lib/useSystems";
+import { CallRow } from "@/components/CallRow";
+
+export default function CallsPage() {
+  const [limitCount, setLimitCount] = useState(100);
+  const { calls, loading } = useCalls(limitCount);
+  const { systems } = useSystems();
+  const systemMap = Object.fromEntries(systems.map((s) => [s.system_id, s]));
+
+  const active = calls.filter((c) => c.status === "active");
+  const ended  = calls.filter((c) => c.status === "ended");
+
+  return (
+    <div className="space-y-6">
+      <div className="flex items-center justify-between">
+        <h1 className="text-xl font-bold text-white font-mono">Calls</h1>
+        <span className="text-xs text-gray-500 font-mono">{calls.length} loaded</span>
+      </div>
+
+      {active.length > 0 && (
+        <section>
+          <h2 className="text-sm font-semibold text-orange-400 uppercase tracking-wider mb-3">
+            Live ({active.length})
+          </h2>
+          <div className="overflow-x-auto">
+            <table className="w-full text-sm">
+              <thead>
+                <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800">
+                  <th className="px-4 py-2 text-left">Time</th>
+                  <th className="px-4 py-2 text-left">Talkgroup</th>
+                  <th className="px-4 py-2 text-left">System</th>
+                  <th className="px-4 py-2 text-left">Node</th>
+                  <th className="px-4 py-2 text-left">Duration</th>
+                  <th className="px-4 py-2 text-left">Audio</th>
+                </tr>
+              </thead>
+              <tbody>
+                {active.map((c) => (
+                  <CallRow key={c.call_id} call={c} systemName={systemMap[c.system_id ?? ""]?.name} />
+                ))}
+              </tbody>
+            </table>
+          </div>
+        </section>
+      )}
+
+      <section>
+        <h2 className="text-sm font-semibold text-gray-400 uppercase tracking-wider mb-3">
+          History
+        </h2>
+        {loading ? (
+          <p className="text-gray-600 text-sm font-mono">Loading…</p>
+        ) : ended.length === 0 ? (
+          <p className="text-gray-600 text-sm font-mono">No calls recorded yet.</p>
+        ) : (
+          <>
+            <div className="overflow-x-auto">
+              <table className="w-full text-sm">
+                <thead>
+                  <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800">
+                    <th className="px-4 py-2 text-left">Time</th>
+                    <th className="px-4 py-2 text-left">Talkgroup</th>
+                    <th className="px-4 py-2 text-left">System</th>
+                    <th className="px-4 py-2 text-left">Node</th>
+                    <th className="px-4 py-2 text-left">Duration</th>
+                    <th className="px-4 py-2 text-left">Audio</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {ended.map((c) => (
+                    <CallRow key={c.call_id} call={c} systemName={systemMap[c.system_id ?? ""]?.name} />
+                  ))}
+                </tbody>
+              </table>
+            </div>
+            {ended.length >= limitCount && (
+              <button
+                onClick={() => setLimitCount((n) => n + 100)}
+                className="mt-4 text-sm text-indigo-400 hover:text-indigo-300 font-mono transition-colors"
+              >
+                Load more
+              </button>
+            )}
+          </>
+        )}
+      </section>
+    </div>
+  );
+}
@@ -0,0 +1,118 @@
+"use client";
+
+import { useNodes, useUnconfiguredNodes } from "@/lib/useNodes";
+import { useCalls, useActiveCalls } from "@/lib/useCalls";
+import { useSystems } from "@/lib/useSystems";
+import { NodeCard } from "@/components/NodeCard";
+import { CallRow } from "@/components/CallRow";
+import { NodeConfigModal } from "@/components/NodeConfigModal";
+import { useState } from "react";
+import type { NodeRecord } from "@/lib/types";
+
+function StatCard({ label, value, accent }: { label: string; value: string | number; accent?: string }) {
+  return (
+    <div className="bg-gray-900 border border-gray-800 rounded-lg p-4">
+      <p className="text-xs text-gray-500 uppercase tracking-wider mb-1">{label}</p>
+      <p className={`text-3xl font-bold font-mono ${accent ?? "text-white"}`}>{value}</p>
+    </div>
+  );
+}
+
+export default function DashboardPage() {
+  const { nodes, error: nodesError } = useNodes();
+  const { nodes: pending } = useUnconfiguredNodes();
+  const { calls, error: callsError } = useCalls(20);
+  const activeCalls = useActiveCalls();
+  const { systems, error: systemsError } = useSystems();
+  const [configNode, setConfigNode] = useState<NodeRecord | null>(null);
+
+  const systemMap = Object.fromEntries(systems.map((s) => [s.system_id, s]));
+  const onlineCount = nodes.filter((n) => n.status !== "offline").length;
+
+  const fsError = nodesError ?? callsError ?? systemsError;
+
+  return (
+    <div className="space-y-6">
+      <h1 className="text-xl font-bold text-white font-mono">Dashboard</h1>
+
+      {fsError && (
+        <div className="bg-red-950 border border-red-800 rounded-lg p-4">
+          <p className="text-red-400 text-sm font-mono">Firestore error: {fsError}</p>
+        </div>
+      )}
+
+      {/* Pending config banner */}
+      {pending.length > 0 && (
+        <div className="bg-indigo-950 border border-indigo-800 rounded-lg p-4 flex items-center justify-between">
+          <p className="text-indigo-300 text-sm font-mono">
+            {pending.length} new node{pending.length > 1 ? "s" : ""} connected and need{pending.length === 1 ? "s" : ""} configuration.
+          </p>
+          <button
+            onClick={() => setConfigNode(pending[0])}
+            className="text-xs bg-indigo-700 hover:bg-indigo-600 text-white px-3 py-1.5 rounded-lg transition-colors"
+          >
+            Configure now
+          </button>
+        </div>
+      )}
+
+      {/* Stats */}
+      <div className="grid grid-cols-2 md:grid-cols-4 gap-4">
+        <StatCard label="Nodes Online" value={onlineCount} accent="text-green-400" />
+        <StatCard label="Active Calls" value={activeCalls.length} accent={activeCalls.length > 0 ? "text-orange-400" : undefined} />
+        <StatCard label="Total Nodes" value={nodes.length} />
+        <StatCard label="Systems" value={systems.length} />
+      </div>
+
+      {/* Nodes */}
+      <section>
+        <h2 className="text-sm font-semibold text-gray-400 uppercase tracking-wider mb-3">Nodes</h2>
+        {nodes.length === 0 ? (
+          <p className="text-gray-600 text-sm font-mono">No nodes registered yet.</p>
+        ) : (
+          <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+            {nodes.map((n) => (
+              <NodeCard key={n.node_id} node={n} system={systemMap[n.assigned_system_id ?? ""]} />
+            ))}
+          </div>
+        )}
+      </section>
+
+      {/* Recent calls */}
+      <section>
+        <h2 className="text-sm font-semibold text-gray-400 uppercase tracking-wider mb-3">Recent Calls</h2>
+        {calls.length === 0 ? (
+          <p className="text-gray-600 text-sm font-mono">No calls recorded yet.</p>
+        ) : (
+          <div className="overflow-x-auto">
+            <table className="w-full text-sm">
+              <thead>
+                <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800">
+                  <th className="px-4 py-2 text-left">Time</th>
+                  <th className="px-4 py-2 text-left">Talkgroup</th>
+                  <th className="px-4 py-2 text-left">System</th>
+                  <th className="px-4 py-2 text-left">Node</th>
+                  <th className="px-4 py-2 text-left">Duration</th>
+                  <th className="px-4 py-2 text-left">Audio</th>
+                </tr>
+              </thead>
+              <tbody>
+                {calls.map((c) => (
+                  <CallRow key={c.call_id} call={c} systemName={systemMap[c.system_id ?? ""]?.name} />
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </section>
+
+      {configNode && (
+        <NodeConfigModal
+          node={configNode}
+          systems={systems}
+          onClose={() => setConfigNode(null)}
+        />
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,7 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+html, body {
+  @apply bg-gray-950 text-gray-100 font-mono;
+}
@@ -0,0 +1,22 @@
+import type { Metadata } from "next";
+import { Nav } from "@/components/Nav";
+import { AuthProvider } from "@/components/AuthProvider";
+import "./globals.css";
+
+export const metadata: Metadata = {
+  title: "DRB Portal",
+  description: "Distributed Radio Bot — Control & Monitoring",
+};
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en" className="dark">
+      <body className="min-h-screen bg-gray-950">
+        <AuthProvider>
+          <Nav />
+          <main className="p-6">{children}</main>
+        </AuthProvider>
+      </body>
+    </html>
+  );
+}
@@ -0,0 +1,69 @@
+"use client";
+
+import { useState } from "react";
+import { signInWithEmailAndPassword } from "firebase/auth";
+import { auth } from "@/lib/firebase";
+import { useRouter } from "next/navigation";
+
+export default function LoginPage() {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+  const router = useRouter();
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setLoading(true);
+    setError(null);
+    try {
+      await signInWithEmailAndPassword(auth, email, password);
+      router.push("/dashboard");
+    } catch {
+      setError("Invalid email or password.");
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  return (
+    <div className="max-w-sm mx-auto pt-16">
+      <form
+        onSubmit={handleSubmit}
+        className="bg-gray-900 border border-gray-700 rounded-xl p-8 space-y-5 font-mono"
+      >
+        <h1 className="text-white text-lg font-bold">DRB Portal</h1>
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">Email</label>
+          <input
+            type="email"
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+            required
+            autoComplete="email"
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+          />
+        </div>
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">Password</label>
+          <input
+            type="password"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+            required
+            autoComplete="current-password"
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+          />
+        </div>
+        {error && <p className="text-red-400 text-xs">{error}</p>}
+        <button
+          type="submit"
+          disabled={loading}
+          className="w-full bg-indigo-600 hover:bg-indigo-500 disabled:opacity-50 text-white rounded-lg py-2 text-sm font-semibold transition-colors"
+        >
+          {loading ? "Signing in…" : "Sign in"}
+        </button>
+      </form>
+    </div>
+  );
+}
@@ -0,0 +1,37 @@
+"use client";
+
+import dynamic from "next/dynamic";
+import { useNodes } from "@/lib/useNodes";
+import { useActiveCalls } from "@/lib/useCalls";
+
+// Leaflet is browser-only — must be dynamically imported with no SSR
+const MapView = dynamic(() => import("@/components/MapView"), { ssr: false });
+
+export default function MapPage() {
+  const { nodes, loading } = useNodes();
+  const activeCalls = useActiveCalls();
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center justify-between">
+        <h1 className="text-xl font-bold text-white font-mono">Map</h1>
+        <div className="flex items-center gap-4 text-xs font-mono text-gray-400">
+          <span><span className="text-green-400">●</span> Online</span>
+          <span><span className="text-orange-400 animate-pulse">●</span> Recording</span>
+          <span><span className="text-indigo-400">●</span> Unconfigured</span>
+          <span><span className="text-gray-600">●</span> Offline</span>
+        </div>
+      </div>
+
+      {loading ? (
+        <div className="flex items-center justify-center h-96 text-gray-600 font-mono text-sm">
+          Loading map…
+        </div>
+      ) : (
+        <div style={{ height: "calc(100vh - 160px)" }}>
+          <MapView nodes={nodes} activeCalls={activeCalls} />
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,295 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useParams } from "next/navigation";
+import { doc, onSnapshot } from "firebase/firestore";
+import { db } from "@/lib/firebase";
+import { useSystems } from "@/lib/useSystems";
+import { useCalls } from "@/lib/useCalls";
+import { StatusBadge } from "@/components/StatusBadge";
+import { NodeConfigModal } from "@/components/NodeConfigModal";
+import { CallRow } from "@/components/CallRow";
+import { useAuth } from "@/components/AuthProvider";
+import { c2api } from "@/lib/c2api";
+import type { NodeRecord } from "@/lib/types";
+
+function ApprovalBadge({ status }: { status: string | null }) {
+  if (status === "approved") return (
+    <span className="text-xs text-green-400 bg-green-400/10 px-2 py-0.5 rounded font-mono">Approved</span>
+  );
+  if (status === "rejected") return (
+    <span className="text-xs text-red-400 bg-red-400/10 px-2 py-0.5 rounded font-mono">Rejected</span>
+  );
+  return (
+    <span className="text-xs text-yellow-400 bg-yellow-400/10 px-2 py-0.5 rounded font-mono">Pending approval</span>
+  );
+}
+
+function DiscordJoinModal({
+  nodeId,
+  onClose,
+}: {
+  nodeId: string;
+  onClose: () => void;
+}) {
+  const [guildId, setGuildId] = useState("");
+  const [channelId, setChannelId] = useState("");
+  const [sending, setSending] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setSending(true);
+    setError(null);
+    try {
+      await c2api.sendCommand(nodeId, {
+        action: "discord_join",
+        guild_id: guildId,
+        channel_id: channelId,
+      });
+      onClose();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Failed to send join command.");
+    } finally {
+      setSending(false);
+    }
+  }
+
+  return (
+    <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50 p-4">
+      <form
+        onSubmit={handleSubmit}
+        className="bg-gray-900 border border-gray-700 rounded-xl p-6 space-y-4 font-mono w-full max-w-sm"
+      >
+        <h3 className="text-white font-semibold">Join Discord Voice</h3>
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">Server ID (Guild)</label>
+          <input
+            value={guildId}
+            onChange={(e) => setGuildId(e.target.value)}
+            required
+            pattern="[0-9]+"
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            placeholder="123456789012345678"
+          />
+        </div>
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">Voice Channel ID</label>
+          <input
+            value={channelId}
+            onChange={(e) => setChannelId(e.target.value)}
+            required
+            pattern="[0-9]+"
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            placeholder="123456789012345678"
+          />
+        </div>
+        <p className="text-xs text-gray-600">
+          A token will be drawn from the pool automatically. Make sure the bot is a member of the server.
+        </p>
+        {error && <p className="text-red-400 text-xs">{error}</p>}
+        <div className="flex gap-3">
+          <button
+            type="submit"
+            disabled={sending}
+            className="flex-1 bg-indigo-600 hover:bg-indigo-500 disabled:opacity-50 text-white rounded-lg py-2 text-sm font-semibold transition-colors"
+          >
+            {sending ? "Joining…" : "Join"}
+          </button>
+          <button
+            type="button"
+            onClick={onClose}
+            className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+          >
+            Cancel
+          </button>
+        </div>
+      </form>
+    </div>
+  );
+}
+
+export default function NodeDetailPage() {
+  const { id } = useParams<{ id: string }>();
+  const [node, setNode] = useState<NodeRecord | null>(null);
+  const [showConfig, setShowConfig] = useState(false);
+  const [showDiscordJoin, setShowDiscordJoin] = useState(false);
+  const [sending, setSending] = useState(false);
+  const [approving, setApproving] = useState(false);
+  const { systems } = useSystems();
+  const { calls } = useCalls(20);
+  const { isAdmin } = useAuth();
+
+  const systemMap = Object.fromEntries(systems.map((s) => [s.system_id, s]));
+  const nodeCalls = calls.filter((c) => c.node_id === id);
+
+  useEffect(() => {
+    const unsub = onSnapshot(doc(db, "nodes", id), (snap) => {
+      setNode(snap.exists() ? (snap.data() as NodeRecord) : null);
+    });
+    return unsub;
+  }, [id]);
+
+  async function sendCommand(action: string) {
+    setSending(true);
+    try {
+      await c2api.sendCommand(id, { action });
+    } finally {
+      setSending(false);
+    }
+  }
+
+  async function handleApprove() {
+    setApproving(true);
+    try {
+      await c2api.approveNode(id);
+    } catch (err) {
+      alert(err instanceof Error ? err.message : "Approval failed.");
+    } finally {
+      setApproving(false);
+    }
+  }
+
+  async function handleReject() {
+    if (!confirm("Reject this node? It will not be able to upload recordings.")) return;
+    setApproving(true);
+    try {
+      await c2api.rejectNode(id);
+    } catch (err) {
+      alert(err instanceof Error ? err.message : "Rejection failed.");
+    } finally {
+      setApproving(false);
+    }
+  }
+
+  if (!node) {
+    return <p className="text-gray-500 font-mono text-sm">Loading node…</p>;
+  }
+
+  const system = systemMap[node.assigned_system_id ?? ""];
+
+  return (
+    <div className="space-y-6 max-w-3xl">
+      <div className="flex items-start justify-between">
+        <div>
+          <h1 className="text-xl font-bold text-white font-mono">{node.name}</h1>
+          <p className="text-gray-500 text-sm font-mono">{node.node_id}</p>
+        </div>
+        <StatusBadge status={node.status} />
+      </div>
+
+      {/* Info */}
+      <div className="bg-gray-900 border border-gray-800 rounded-lg divide-y divide-gray-800 font-mono text-sm">
+        {[
+          ["System",    system?.name ?? "Unassigned"],
+          ["Location",  `${node.lat}, ${node.lon}`],
+          ["Last Seen", node.last_seen ? new Date(node.last_seen).toLocaleString() : "never"],
+          ["Configured", node.configured ? "Yes" : "No"],
+        ].map(([label, value]) => (
+          <div key={label} className="flex justify-between px-4 py-2.5">
+            <span className="text-gray-500">{label}</span>
+            <span className="text-gray-200">{value}</span>
+          </div>
+        ))}
+        <div className="flex justify-between px-4 py-2.5">
+          <span className="text-gray-500">Approval</span>
+          <ApprovalBadge status={node.approval_status ?? null} />
+        </div>
+      </div>
+
+      {/* Admin approval actions */}
+      {isAdmin && node.approval_status === "pending" && (
+        <div className="flex gap-3 items-center">
+          <span className="text-sm text-yellow-400 font-mono">This node is awaiting approval.</span>
+          <button
+            onClick={handleApprove}
+            disabled={approving}
+            className="px-4 py-2 bg-green-700 hover:bg-green-600 disabled:opacity-50 text-white rounded-lg text-sm font-mono transition-colors"
+          >
+            {approving ? "…" : "Approve"}
+          </button>
+          <button
+            onClick={handleReject}
+            disabled={approving}
+            className="px-4 py-2 bg-red-900 hover:bg-red-800 disabled:opacity-50 text-gray-300 rounded-lg text-sm font-mono transition-colors"
+          >
+            Reject
+          </button>
+        </div>
+      )}
+
+      {/* Actions */}
+      <div className="flex flex-wrap gap-3">
+        <button
+          onClick={() => setShowConfig(true)}
+          className="px-4 py-2 bg-indigo-700 hover:bg-indigo-600 text-white rounded-lg text-sm font-mono transition-colors"
+        >
+          {node.configured ? "Reassign System" : "Configure"}
+        </button>
+        <button
+          disabled={sending}
+          onClick={() => sendCommand("op25_restart")}
+          className="px-4 py-2 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
+        >
+          Restart OP25
+        </button>
+        <button
+          onClick={() => setShowDiscordJoin(true)}
+          className="px-4 py-2 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg text-sm font-mono transition-colors"
+        >
+          Join Discord
+        </button>
+        <button
+          disabled={sending}
+          onClick={() => sendCommand("discord_leave")}
+          className="px-4 py-2 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
+        >
+          Leave Discord
+        </button>
+      </div>
+
+      {/* Recent calls */}
+      <section>
+        <h2 className="text-sm font-semibold text-gray-400 uppercase tracking-wider mb-3">Recent Calls</h2>
+        {nodeCalls.length === 0 ? (
+          <p className="text-gray-600 text-sm font-mono">No calls recorded from this node.</p>
+        ) : (
+          <div className="overflow-x-auto">
+            <table className="w-full text-sm">
+              <thead>
+                <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800">
+                  <th className="px-4 py-2 text-left">Time</th>
+                  <th className="px-4 py-2 text-left">Talkgroup</th>
+                  <th className="px-4 py-2 text-left">System</th>
+                  <th className="px-4 py-2 text-left">Node</th>
+                  <th className="px-4 py-2 text-left">Duration</th>
+                  <th className="px-4 py-2 text-left">Audio</th>
+                </tr>
+              </thead>
+              <tbody>
+                {nodeCalls.map((c) => (
+                  <CallRow key={c.call_id} call={c} systemName={system?.name} />
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </section>
+
+      {showConfig && (
+        <NodeConfigModal
+          node={node}
+          systems={systems}
+          onClose={() => setShowConfig(false)}
+        />
+      )}
+
+      {showDiscordJoin && (
+        <DiscordJoinModal
+          nodeId={id}
+          onClose={() => setShowDiscordJoin(false)}
+        />
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,63 @@
+"use client";
+
+import { useState } from "react";
+import { useNodes } from "@/lib/useNodes";
+import { useSystems } from "@/lib/useSystems";
+import { NodeCard } from "@/components/NodeCard";
+import { NodeConfigModal } from "@/components/NodeConfigModal";
+import type { NodeRecord } from "@/lib/types";
+
+export default function NodesPage() {
+  const { nodes, loading } = useNodes();
+  const { systems } = useSystems();
+  const [configNode, setConfigNode] = useState<NodeRecord | null>(null);
+
+  const systemMap = Object.fromEntries(systems.map((s) => [s.system_id, s]));
+  const pending = nodes.filter((n) => !n.configured);
+
+  return (
+    <div className="space-y-6">
+      <h1 className="text-xl font-bold text-white font-mono">Nodes</h1>
+
+      {pending.length > 0 && (
+        <div className="space-y-2">
+          <h2 className="text-sm font-semibold text-indigo-400 uppercase tracking-wider">
+            Needs Configuration ({pending.length})
+          </h2>
+          <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+            {pending.map((n) => (
+              <div key={n.node_id} onClick={() => setConfigNode(n)} className="cursor-pointer">
+                <NodeCard node={n} system={systemMap[n.assigned_system_id ?? ""]} />
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
+      <div className="space-y-2">
+        <h2 className="text-sm font-semibold text-gray-400 uppercase tracking-wider">
+          All Nodes ({nodes.length})
+        </h2>
+        {loading ? (
+          <p className="text-gray-600 text-sm font-mono">Loading…</p>
+        ) : nodes.length === 0 ? (
+          <p className="text-gray-600 text-sm font-mono">No nodes registered yet. Boot a Pi to get started.</p>
+        ) : (
+          <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
+            {nodes.map((n) => (
+              <NodeCard key={n.node_id} node={n} system={systemMap[n.assigned_system_id ?? ""]} />
+            ))}
+          </div>
+        )}
+      </div>
+
+      {configNode && (
+        <NodeConfigModal
+          node={configNode}
+          systems={systems}
+          onClose={() => setConfigNode(null)}
+        />
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,5 @@
+import { redirect } from "next/navigation";
+
+export default function Home() {
+  redirect("/dashboard");
+}
@@ -0,0 +1,519 @@
+"use client";
+
+import { useState } from "react";
+import { useSystems } from "@/lib/useSystems";
+import { c2api } from "@/lib/c2api";
+import type { SystemRecord } from "@/lib/types";
+
+// ── P25 structured config types ──────────────────────────────────────────────
+
+interface TalkgroupEntry {
+  id: string;
+  name: string;
+  tag: string;
+}
+
+interface P25Config {
+  nac: string;
+  system_id: string;
+  wacn: string;
+  control_channels: string;
+  voice_channels: string;
+  talkgroups: TalkgroupEntry[];
+}
+
+const DEFAULT_P25: P25Config = {
+  nac: "",
+  system_id: "",
+  wacn: "",
+  control_channels: "",
+  voice_channels: "",
+  talkgroups: [],
+};
+
+const TG_TAGS = ["fire", "police", "ems", "transit", "public works", "other"];
+
+function recordToP25Config(c: Record<string, unknown>): P25Config {
+  return {
+    nac: String(c.nac ?? ""),
+    system_id: String(c.system_id ?? ""),
+    wacn: String(c.wacn ?? ""),
+    control_channels: Array.isArray(c.control_channels)
+      ? (c.control_channels as number[]).join(", ")
+      : "",
+    voice_channels: Array.isArray(c.voice_channels)
+      ? (c.voice_channels as number[]).join(", ")
+      : "",
+    talkgroups: Array.isArray(c.talkgroups)
+      ? (c.talkgroups as Array<{ id: number; name: string; tag: string }>).map((tg) => ({
+          id: String(tg.id),
+          name: tg.name,
+          tag: tg.tag ?? "other",
+        }))
+      : [],
+  };
+}
+
+function p25ConfigToRecord(p: P25Config): Record<string, unknown> {
+  const parseFreqs = (s: string) =>
+    s
+      .split(",")
+      .map((f) => parseFloat(f.trim()))
+      .filter((f) => !isNaN(f));
+  return {
+    nac: p.nac,
+    system_id: p.system_id ? parseInt(p.system_id, 10) : undefined,
+    wacn: p.wacn,
+    control_channels: parseFreqs(p.control_channels),
+    voice_channels: parseFreqs(p.voice_channels),
+    talkgroups: p.talkgroups
+      .filter((tg) => tg.id && tg.name)
+      .map((tg) => ({ id: parseInt(tg.id, 10), name: tg.name, tag: tg.tag })),
+  };
+}
+
+// ── Talkgroup table editor ────────────────────────────────────────────────────
+
+function TalkgroupEditor({
+  talkgroups,
+  onChange,
+}: {
+  talkgroups: TalkgroupEntry[];
+  onChange: (tgs: TalkgroupEntry[]) => void;
+}) {
+  const [showPaste, setShowPaste] = useState(false);
+  const [pasteText, setPasteText] = useState("");
+
+  function addRow() {
+    onChange([...talkgroups, { id: "", name: "", tag: "other" }]);
+  }
+
+  function removeRow(i: number) {
+    onChange(talkgroups.filter((_, idx) => idx !== i));
+  }
+
+  function updateRow(i: number, field: keyof TalkgroupEntry, value: string) {
+    const updated = [...talkgroups];
+    updated[i] = { ...updated[i], [field]: value };
+    onChange(updated);
+  }
+
+  function handlePasteImport() {
+    const lines = pasteText.trim().split("\n");
+    const parsed: TalkgroupEntry[] = lines
+      .map((line) => {
+        const parts = line.includes("\t") ? line.split("\t") : line.split(",");
+        const id = parts[0]?.trim() ?? "";
+        const name = parts[1]?.trim() ?? "";
+        const rawTag = parts[2]?.trim()?.toLowerCase() ?? "other";
+        const tag = TG_TAGS.includes(rawTag) ? rawTag : "other";
+        return { id, name, tag };
+      })
+      .filter((e) => e.id && e.name);
+    onChange([...talkgroups, ...parsed]);
+    setPasteText("");
+    setShowPaste(false);
+  }
+
+  return (
+    <div className="space-y-2">
+      <div className="flex items-center justify-between">
+        <label className="text-xs text-gray-400">
+          Talkgroups{talkgroups.length > 0 && <span className="text-gray-600 ml-1">({talkgroups.length})</span>}
+        </label>
+        <div className="flex gap-3">
+          <button
+            type="button"
+            onClick={() => setShowPaste(!showPaste)}
+            className="text-xs text-indigo-400 hover:text-indigo-300 transition-colors"
+          >
+            {showPaste ? "Cancel paste" : "Paste import"}
+          </button>
+          <button
+            type="button"
+            onClick={addRow}
+            className="text-xs text-indigo-400 hover:text-indigo-300 transition-colors"
+          >
+            + Add row
+          </button>
+        </div>
+      </div>
+
+      {showPaste && (
+        <div className="space-y-2 p-3 bg-gray-800 rounded-lg border border-gray-700">
+          <p className="text-xs text-gray-500">
+            Paste rows from RadioReference — tab- or comma-separated: <span className="text-gray-400">ID, Name, Tag</span>
+            <br />Tags: fire · police · ems · transit · public works · other
+          </p>
+          <textarea
+            value={pasteText}
+            onChange={(e) => setPasteText(e.target.value)}
+            rows={6}
+            placeholder={"1234\tFire Dispatch\tfire\n5678\tPolice Zone 1\tpolice\n9012\tEMS\tems"}
+            className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
+          />
+          <button
+            type="button"
+            onClick={handlePasteImport}
+            disabled={!pasteText.trim()}
+            className="bg-indigo-700 hover:bg-indigo-600 disabled:opacity-50 text-white px-3 py-1.5 rounded text-xs font-semibold transition-colors"
+          >
+            Import rows
+          </button>
+        </div>
+      )}
+
+      {talkgroups.length > 0 ? (
+        <div className="border border-gray-800 rounded-lg overflow-hidden">
+          <table className="w-full text-xs font-mono">
+            <thead>
+              <tr className="bg-gray-800 text-gray-400">
+                <th className="px-3 py-1.5 text-left w-20">Dec ID</th>
+                <th className="px-3 py-1.5 text-left">Name</th>
+                <th className="px-3 py-1.5 text-left w-28">Tag</th>
+                <th className="px-3 py-1.5 w-8"></th>
+              </tr>
+            </thead>
+            <tbody>
+              {talkgroups.map((tg, i) => (
+                <tr key={i} className="border-t border-gray-800 hover:bg-gray-800/30">
+                  <td className="px-2 py-1">
+                    <input
+                      value={tg.id}
+                      onChange={(e) => updateRow(i, "id", e.target.value)}
+                      className="w-full bg-transparent text-white focus:outline-none"
+                      placeholder="1234"
+                    />
+                  </td>
+                  <td className="px-2 py-1">
+                    <input
+                      value={tg.name}
+                      onChange={(e) => updateRow(i, "name", e.target.value)}
+                      className="w-full bg-transparent text-white focus:outline-none"
+                      placeholder="Fire Dispatch"
+                    />
+                  </td>
+                  <td className="px-2 py-1">
+                    <select
+                      value={tg.tag}
+                      onChange={(e) => updateRow(i, "tag", e.target.value)}
+                      className="w-full bg-gray-900 text-gray-300 focus:outline-none rounded px-1"
+                    >
+                      {TG_TAGS.map((t) => (
+                        <option key={t} value={t}>{t}</option>
+                      ))}
+                    </select>
+                  </td>
+                  <td className="px-2 py-1 text-center">
+                    <button
+                      type="button"
+                      onClick={() => removeRow(i)}
+                      className="text-gray-600 hover:text-red-400 transition-colors font-bold"
+                    >
+                      ×
+                    </button>
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      ) : (
+        <p className="text-xs text-gray-600 italic py-1">No talkgroups — add rows or paste from RadioReference.</p>
+      )}
+    </div>
+  );
+}
+
+// ── P25 structured form ───────────────────────────────────────────────────────
+
+function P25Form({ value, onChange }: { value: P25Config; onChange: (v: P25Config) => void }) {
+  return (
+    <div className="space-y-4">
+      <div className="grid grid-cols-3 gap-3">
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">NAC (hex)</label>
+          <input
+            value={value.nac}
+            onChange={(e) => onChange({ ...value, nac: e.target.value })}
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            placeholder="0x293"
+          />
+        </div>
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">System ID</label>
+          <input
+            value={value.system_id}
+            onChange={(e) => onChange({ ...value, system_id: e.target.value })}
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            placeholder="50513"
+          />
+        </div>
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">WACN (hex)</label>
+          <input
+            value={value.wacn}
+            onChange={(e) => onChange({ ...value, wacn: e.target.value })}
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            placeholder="0xBEE00"
+          />
+        </div>
+      </div>
+      <div>
+        <label className="text-xs text-gray-400 block mb-1">
+          Control Channels <span className="text-gray-600">(MHz, comma-separated)</span>
+        </label>
+        <input
+          value={value.control_channels}
+          onChange={(e) => onChange({ ...value, control_channels: e.target.value })}
+          className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+          placeholder="851.0125, 851.5125, 852.0125"
+        />
+      </div>
+      <div>
+        <label className="text-xs text-gray-400 block mb-1">
+          Voice Channels <span className="text-gray-600">(MHz, comma-separated — leave blank for auto-discovery)</span>
+        </label>
+        <input
+          value={value.voice_channels}
+          onChange={(e) => onChange({ ...value, voice_channels: e.target.value })}
+          className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+          placeholder="Optional"
+        />
+      </div>
+      <TalkgroupEditor
+        talkgroups={value.talkgroups}
+        onChange={(tgs) => onChange({ ...value, talkgroups: tgs })}
+      />
+    </div>
+  );
+}
+
+// ── Main system form ──────────────────────────────────────────────────────────
+
+function SystemForm({
+  initial,
+  onSave,
+  onCancel,
+}: {
+  initial?: SystemRecord;
+  onSave: () => void;
+  onCancel: () => void;
+}) {
+  const [name, setName] = useState(initial?.name ?? "");
+  const [type, setType] = useState(initial?.type ?? "P25");
+  const [p25, setP25] = useState<P25Config>(
+    initial?.type === "P25" && initial.config
+      ? recordToP25Config(initial.config)
+      : DEFAULT_P25
+  );
+  const [rawJson, setRawJson] = useState(
+    initial?.type !== "P25" && initial?.config
+      ? JSON.stringify(initial.config, null, 2)
+      : "{}"
+  );
+  const [showRaw, setShowRaw] = useState(initial?.type !== "P25");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  function handleTypeChange(t: string) {
+    setType(t);
+    setShowRaw(t !== "P25");
+  }
+
+  function toggleRaw() {
+    if (!showRaw) {
+      setRawJson(JSON.stringify(p25ConfigToRecord(p25), null, 2));
+    } else {
+      try {
+        setP25(recordToP25Config(JSON.parse(rawJson)));
+      } catch {
+        // keep current p25 state if parse fails
+      }
+    }
+    setShowRaw(!showRaw);
+  }
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setSaving(true);
+    setError(null);
+    try {
+      let config: Record<string, unknown>;
+      if (type === "P25" && !showRaw) {
+        config = p25ConfigToRecord(p25);
+      } else {
+        config = JSON.parse(rawJson);
+      }
+      if (initial) {
+        await c2api.updateSystem(initial.system_id, { name, type, config });
+      } else {
+        await c2api.createSystem({ name, type, config });
+      }
+      onSave();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Invalid config or save failed.");
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  return (
+    <form onSubmit={handleSubmit} className="bg-gray-900 border border-gray-700 rounded-xl p-5 space-y-4 font-mono">
+      <h3 className="text-white font-semibold">{initial ? "Edit System" : "New System"}</h3>
+
+      <div className="grid grid-cols-2 gap-3">
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">Name</label>
+          <input
+            value={name}
+            onChange={(e) => setName(e.target.value)}
+            required
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            placeholder="Westchester County P25"
+          />
+        </div>
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">Type</label>
+          <select
+            value={type}
+            onChange={(e) => handleTypeChange(e.target.value)}
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+          >
+            <option>P25</option>
+            <option>DMR</option>
+            <option>NBFM</option>
+          </select>
+        </div>
+      </div>
+
+      {type === "P25" && !showRaw ? (
+        <P25Form value={p25} onChange={setP25} />
+      ) : (
+        <div>
+          <label className="text-xs text-gray-400 block mb-1">Config (JSON)</label>
+          <textarea
+            value={rawJson}
+            onChange={(e) => setRawJson(e.target.value)}
+            rows={10}
+            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
+          />
+        </div>
+      )}
+
+      {type === "P25" && (
+        <button
+          type="button"
+          onClick={toggleRaw}
+          className="text-xs text-gray-600 hover:text-gray-400 transition-colors"
+        >
+          {showRaw ? "← Use structured form" : "Edit raw JSON →"}
+        </button>
+      )}
+
+      {error && <p className="text-red-400 text-xs">{error}</p>}
+
+      <div className="flex gap-3">
+        <button
+          type="submit"
+          disabled={saving}
+          className="flex-1 bg-indigo-600 hover:bg-indigo-500 disabled:opacity-50 text-white rounded-lg py-2 text-sm font-semibold transition-colors"
+        >
+          {saving ? "Saving…" : "Save"}
+        </button>
+        <button
+          type="button"
+          onClick={onCancel}
+          className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+        >
+          Cancel
+        </button>
+      </div>
+    </form>
+  );
+}
+
+// ── Systems list page ─────────────────────────────────────────────────────────
+
+export default function SystemsPage() {
+  const { systems, loading } = useSystems();
+  const [editing, setEditing] = useState<SystemRecord | null | "new">(null);
+
+  async function handleDelete(id: string) {
+    if (!confirm("Delete this system?")) return;
+    await c2api.deleteSystem(id);
+  }
+
+  return (
+    <div className="space-y-6 max-w-3xl">
+      <div className="flex items-center justify-between">
+        <h1 className="text-xl font-bold text-white font-mono">Systems</h1>
+        <button
+          onClick={() => setEditing("new")}
+          className="bg-indigo-600 hover:bg-indigo-500 text-white px-4 py-2 rounded-lg text-sm font-mono transition-colors"
+        >
+          + New System
+        </button>
+      </div>
+
+      {editing && (
+        <SystemForm
+          initial={editing === "new" ? undefined : editing}
+          onSave={() => setEditing(null)}
+          onCancel={() => setEditing(null)}
+        />
+      )}
+
+      {loading ? (
+        <p className="text-gray-600 text-sm font-mono">Loading…</p>
+      ) : systems.length === 0 ? (
+        <p className="text-gray-600 text-sm font-mono">No systems defined yet.</p>
+      ) : (
+        <div className="space-y-3">
+          {systems.map((s) => {
+            const tgCount = Array.isArray(s.config.talkgroups)
+              ? (s.config.talkgroups as unknown[]).length
+              : null;
+            const ccCount = Array.isArray(s.config.control_channels)
+              ? (s.config.control_channels as unknown[]).length
+              : null;
+            return (
+              <div key={s.system_id} className="bg-gray-900 border border-gray-800 rounded-lg p-4 font-mono">
+                <div className="flex items-start justify-between">
+                  <div>
+                    <p className="text-white font-semibold">{s.name}</p>
+                    <p className="text-xs text-gray-500">{s.system_id}</p>
+                    {(s.config.nac || ccCount !== null || tgCount !== null) && (
+                      <p className="text-xs text-gray-600 mt-0.5 space-x-2">
+                        {!!s.config.nac && <span>NAC {String(s.config.nac)}</span>}
+                        {ccCount !== null && <span>· {ccCount} CC</span>}
+                        {tgCount !== null && <span>· {tgCount} TGs</span>}
+                      </p>
+                    )}
+                  </div>
+                  <span className="text-xs bg-gray-800 border border-gray-700 text-gray-400 px-2 py-0.5 rounded">
+                    {s.type}
+                  </span>
+                </div>
+                <div className="mt-3 flex gap-3">
+                  <button
+                    onClick={() => setEditing(s)}
+                    className="text-xs text-indigo-400 hover:text-indigo-300 transition-colors"
+                  >
+                    Edit
+                  </button>
+                  <button
+                    onClick={() => handleDelete(s.system_id)}
+                    className="text-xs text-red-500 hover:text-red-400 transition-colors"
+                  >
+                    Delete
+                  </button>
+                </div>
+              </div>
+            );
+          })}
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,181 @@
+"use client";
+
+import { useState, useEffect, useCallback } from "react";
+import { useRouter } from "next/navigation";
+import { c2api } from "@/lib/c2api";
+import { useAuth } from "@/components/AuthProvider";
+
+interface TokenRecord {
+  token_id: string;
+  name: string;
+  token: string; // masked server-side
+  in_use: boolean;
+  assigned_node_id: string | null;
+  assigned_at: string | null;
+}
+
+export default function TokensPage() {
+  const { isAdmin, loading: authLoading } = useAuth();
+  const router = useRouter();
+  const [tokens, setTokens] = useState<TokenRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [showAdd, setShowAdd] = useState(false);
+  const [name, setName] = useState("");
+  const [token, setToken] = useState("");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!authLoading && !isAdmin) router.replace("/dashboard");
+  }, [authLoading, isAdmin, router]);
+
+  const refresh = useCallback(async () => {
+    try {
+      const data = await c2api.getTokens();
+      setTokens(data as TokenRecord[]);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => { refresh(); }, [refresh]);
+
+  async function handleAdd(e: React.FormEvent) {
+    e.preventDefault();
+    setSaving(true);
+    setError(null);
+    try {
+      await c2api.addToken({ name, token });
+      setName("");
+      setToken("");
+      setShowAdd(false);
+      await refresh();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Failed to add token.");
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function handleDelete(id: string) {
+    if (!confirm("Remove this token from the pool?")) return;
+    try {
+      await c2api.deleteToken(id);
+      await refresh();
+    } catch (err) {
+      alert(err instanceof Error ? err.message : "Delete failed.");
+    }
+  }
+
+  if (authLoading || !isAdmin) return null;
+
+  return (
+    <div className="space-y-6 max-w-2xl">
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-xl font-bold text-white font-mono">Bot Token Pool</h1>
+          <p className="text-xs text-gray-500 font-mono mt-0.5">
+            Discord bot tokens assigned to nodes when they join a voice channel.
+          </p>
+        </div>
+        <button
+          onClick={() => setShowAdd(!showAdd)}
+          className="bg-indigo-600 hover:bg-indigo-500 text-white px-4 py-2 rounded-lg text-sm font-mono transition-colors"
+        >
+          + Add Token
+        </button>
+      </div>
+
+      {showAdd && (
+        <form onSubmit={handleAdd} className="bg-gray-900 border border-gray-700 rounded-xl p-5 space-y-4 font-mono">
+          <h3 className="text-white font-semibold text-sm">Add Token</h3>
+          <div>
+            <label className="text-xs text-gray-400 block mb-1">Label</label>
+            <input
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+              required
+              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              placeholder="DRB Bot 1"
+            />
+          </div>
+          <div>
+            <label className="text-xs text-gray-400 block mb-1">Discord Bot Token</label>
+            <input
+              value={token}
+              onChange={(e) => setToken(e.target.value)}
+              required
+              type="password"
+              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+              placeholder="MTxxxxxxxxxx.Gxxxxx.xxxxxxxxxx"
+            />
+          </div>
+          {error && <p className="text-red-400 text-xs">{error}</p>}
+          <div className="flex gap-3">
+            <button
+              type="submit"
+              disabled={saving}
+              className="flex-1 bg-indigo-600 hover:bg-indigo-500 disabled:opacity-50 text-white rounded-lg py-2 text-sm font-semibold transition-colors"
+            >
+              {saving ? "Saving…" : "Save"}
+            </button>
+            <button
+              type="button"
+              onClick={() => setShowAdd(false)}
+              className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+            >
+              Cancel
+            </button>
+          </div>
+        </form>
+      )}
+
+      {loading ? (
+        <p className="text-gray-600 text-sm font-mono">Loading…</p>
+      ) : tokens.length === 0 ? (
+        <p className="text-gray-600 text-sm font-mono">No tokens in the pool. Add one to enable Discord voice streaming.</p>
+      ) : (
+        <div className="border border-gray-800 rounded-lg overflow-hidden font-mono">
+          <table className="w-full text-sm">
+            <thead>
+              <tr className="bg-gray-900 text-xs text-gray-500 uppercase tracking-wider">
+                <th className="px-4 py-2.5 text-left">Label</th>
+                <th className="px-4 py-2.5 text-left">Token</th>
+                <th className="px-4 py-2.5 text-left">Status</th>
+                <th className="px-4 py-2.5 text-left">Node</th>
+                <th className="px-4 py-2.5 w-16"></th>
+              </tr>
+            </thead>
+            <tbody>
+              {tokens.map((t) => (
+                <tr key={t.token_id} className="border-t border-gray-800 hover:bg-gray-900/50">
+                  <td className="px-4 py-2.5 text-white">{t.name}</td>
+                  <td className="px-4 py-2.5 text-gray-500 text-xs">{t.token}</td>
+                  <td className="px-4 py-2.5">
+                    {t.in_use ? (
+                      <span className="text-xs text-green-400 bg-green-400/10 px-2 py-0.5 rounded">In use</span>
+                    ) : (
+                      <span className="text-xs text-gray-500 bg-gray-800 px-2 py-0.5 rounded">Free</span>
+                    )}
+                  </td>
+                  <td className="px-4 py-2.5 text-gray-500 text-xs">
+                    {t.assigned_node_id ?? "—"}
+                  </td>
+                  <td className="px-4 py-2.5 text-right">
+                    <button
+                      onClick={() => handleDelete(t.token_id)}
+                      disabled={t.in_use}
+                      className="text-xs text-red-600 hover:text-red-400 disabled:opacity-30 disabled:cursor-not-allowed transition-colors"
+                    >
+                      Remove
+                    </button>
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,57 @@
+"use client";
+
+import { createContext, useContext, useEffect, useState } from "react";
+import { onAuthStateChanged, signOut as firebaseSignOut, User } from "firebase/auth";
+import { auth } from "@/lib/firebase";
+
+interface AuthContextType {
+  user: User | null;
+  loading: boolean;
+  isAdmin: boolean;
+  signOut: () => Promise<void>;
+}
+
+const AuthContext = createContext<AuthContextType>({
+  user: null,
+  loading: true,
+  isAdmin: false,
+  signOut: async () => {},
+});
+
+export function AuthProvider({ children }: { children: React.ReactNode }) {
+  const [user, setUser] = useState<User | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [isAdmin, setIsAdmin] = useState(false);
+
+  useEffect(() => {
+    return onAuthStateChanged(auth, async (u) => {
+      setUser(u);
+      setLoading(false);
+
+      if (u) {
+        document.cookie = "drb_session=1; path=/; SameSite=Strict";
+        // Read custom claims to determine admin status
+        const result = await u.getIdTokenResult(true);
+        setIsAdmin(!!result.claims.admin);
+      } else {
+        document.cookie = "drb_session=; path=/; max-age=0";
+        setIsAdmin(false);
+      }
+    });
+  }, []);
+
+  async function signOut() {
+    await firebaseSignOut(auth);
+    document.cookie = "drb_session=; path=/; max-age=0";
+  }
+
+  return (
+    <AuthContext.Provider value={{ user, loading, isAdmin, signOut }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export function useAuth() {
+  return useContext(AuthContext);
+}
@@ -0,0 +1,51 @@
+import type { CallRecord } from "@/lib/types";
+
+interface Props {
+  call: CallRecord;
+  systemName?: string;
+}
+
+function duration(started: string, ended: string | null): string {
+  if (!ended) return "active";
+  const ms = new Date(ended).getTime() - new Date(started).getTime();
+  const s = Math.floor(ms / 1000);
+  return s < 60 ? `${s}s` : `${Math.floor(s / 60)}m ${s % 60}s`;
+}
+
+export function CallRow({ call, systemName }: Props) {
+  const isActive = call.status === "active";
+
+  return (
+    <tr className="border-b border-gray-800 hover:bg-gray-900/50 font-mono text-sm">
+      <td className="px-4 py-2 text-gray-400 text-xs">
+        {new Date(call.started_at).toLocaleTimeString()}
+      </td>
+      <td className="px-4 py-2 text-gray-300">
+        {call.talkgroup_name || call.talkgroup_id || "—"}
+      </td>
+      <td className="px-4 py-2 text-gray-400">{systemName ?? call.system_id ?? "—"}</td>
+      <td className="px-4 py-2 text-gray-400">{call.node_id}</td>
+      <td className="px-4 py-2">
+        {isActive ? (
+          <span className="text-orange-400 animate-pulse">● live</span>
+        ) : (
+          <span className="text-gray-500">{duration(call.started_at, call.ended_at)}</span>
+        )}
+      </td>
+      <td className="px-4 py-2">
+        {call.audio_url ? (
+          <a
+            href={call.audio_url}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="text-blue-400 hover:text-blue-300 text-xs"
+          >
+            audio
+          </a>
+        ) : (
+          <span className="text-gray-700 text-xs">—</span>
+        )}
+      </td>
+    </tr>
+  );
+}
@@ -0,0 +1,77 @@
+"use client";
+
+import { useEffect } from "react";
+import { MapContainer, TileLayer, Marker, Popup, useMap } from "react-leaflet";
+import L from "leaflet";
+import type { NodeRecord, CallRecord } from "@/lib/types";
+import "leaflet/dist/leaflet.css";
+
+// Fix Leaflet default icon paths broken by webpack
+delete (L.Icon.Default.prototype as unknown as Record<string, unknown>)._getIconUrl;
+L.Icon.Default.mergeOptions({
+  iconRetinaUrl: "https://unpkg.com/leaflet@1.9.4/dist/images/marker-icon-2x.png",
+  iconUrl:       "https://unpkg.com/leaflet@1.9.4/dist/images/marker-icon.png",
+  shadowUrl:     "https://unpkg.com/leaflet@1.9.4/dist/images/marker-shadow.png",
+});
+
+const nodeIcon = (status: string) =>
+  L.divIcon({
+    className: "",
+    html: `<div style="
+      width:14px;height:14px;border-radius:50%;
+      background:${status === "online" || status === "recording" ? "#4ade80" : status === "unconfigured" ? "#818cf8" : "#6b7280"};
+      border:2px solid #111827;
+      box-shadow:0 0 6px ${status === "recording" ? "#fb923c" : "transparent"};
+    "></div>`,
+    iconSize: [14, 14],
+    iconAnchor: [7, 7],
+  });
+
+interface Props {
+  nodes: NodeRecord[];
+  activeCalls: CallRecord[];
+}
+
+export default function MapView({ nodes, activeCalls }: Props) {
+  const activeByNode = Object.fromEntries(
+    activeCalls.map((c) => [c.node_id, c])
+  );
+
+  const center: [number, number] =
+    nodes.length > 0 ? [nodes[0].lat, nodes[0].lon] : [39.5, -98.35];
+
+  return (
+    <MapContainer
+      center={center}
+      zoom={nodes.length > 0 ? 10 : 4}
+      className="w-full h-full rounded-lg"
+      style={{ background: "#111827" }}
+    >
+      <TileLayer
+        url="https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"
+        attribution='&copy; <a href="https://carto.com/">CARTO</a>'
+      />
+      {nodes.map((node) => (
+        <Marker
+          key={node.node_id}
+          position={[node.lat, node.lon]}
+          icon={nodeIcon(node.status)}
+        >
+          <Popup className="font-mono">
+            <div className="text-gray-900">
+              <p className="font-bold">{node.name}</p>
+              <p className="text-xs text-gray-500">{node.node_id}</p>
+              <p className="text-xs mt-1 capitalize">{node.status}</p>
+              {activeByNode[node.node_id] && (
+                <p className="text-xs text-orange-600 mt-1">
+                  ● TG {activeByNode[node.node_id].talkgroup_id ?? "—"}{" "}
+                  {activeByNode[node.node_id].talkgroup_name}
+                </p>
+              )}
+            </div>
+          </Popup>
+        </Marker>
+      ))}
+    </MapContainer>
+  );
+}
@@ -0,0 +1,58 @@
+"use client";
+
+import Link from "next/link";
+import { usePathname } from "next/navigation";
+import { useUnconfiguredNodes } from "@/lib/useNodes";
+import { useAuth } from "@/components/AuthProvider";
+
+const links = [
+  { href: "/dashboard", label: "Dashboard" },
+  { href: "/nodes",     label: "Nodes" },
+  { href: "/systems",   label: "Systems" },
+  { href: "/calls",     label: "Calls" },
+  { href: "/map",       label: "Map" },
+];
+
+const adminLinks = [
+  { href: "/tokens", label: "Tokens" },
+];
+
+export function Nav() {
+  const { user, isAdmin, signOut } = useAuth();
+  const pathname = usePathname();
+  const { nodes: pending } = useUnconfiguredNodes();
+
+  if (!user) return null;
+
+  return (
+    <nav className="border-b border-gray-800 bg-gray-950 px-6 py-3 flex items-center gap-6">
+      <span className="font-mono font-bold text-white tracking-tight mr-4">DRB</span>
+      {[...links, ...(isAdmin ? adminLinks : [])].map(({ href, label }) => (
+        <Link
+          key={href}
+          href={href}
+          className={`text-sm font-mono transition-colors ${
+            pathname.startsWith(href)
+              ? "text-white"
+              : "text-gray-500 hover:text-gray-300"
+          }`}
+        >
+          {label}
+          {label === "Nodes" && pending.length > 0 && (
+            <span className="ml-1.5 inline-flex items-center justify-center w-4 h-4 rounded-full bg-yellow-500 text-gray-950 text-xs font-bold">
+              {pending.length}
+            </span>
+          )}
+        </Link>
+      ))}
+      <div className="ml-auto">
+        <button
+          onClick={signOut}
+          className="text-sm font-mono text-gray-500 hover:text-gray-300 transition-colors"
+        >
+          Sign out
+        </button>
+      </div>
+    </nav>
+  );
+}
@@ -0,0 +1,51 @@
+import Link from "next/link";
+import { StatusBadge } from "@/components/StatusBadge";
+import type { NodeRecord, SystemRecord } from "@/lib/types";
+
+interface Props {
+  node: NodeRecord;
+  system?: SystemRecord;
+}
+
+export function NodeCard({ node, system }: Props) {
+  const lastSeen = node.last_seen
+    ? new Date(node.last_seen).toLocaleTimeString()
+    : "never";
+
+  return (
+    <Link href={`/nodes/${node.node_id}`}>
+      <div className="bg-gray-900 border border-gray-800 rounded-lg p-4 hover:border-gray-600 transition-colors cursor-pointer">
+        <div className="flex items-start justify-between mb-3">
+          <div>
+            <p className="font-mono font-semibold text-white">{node.name}</p>
+            <p className="text-xs text-gray-500 font-mono">{node.node_id}</p>
+          </div>
+          <StatusBadge status={node.status} />
+        </div>
+        <div className="space-y-1 text-xs font-mono text-gray-400">
+          <div className="flex justify-between">
+            <span>System</span>
+            <span className="text-gray-300">{system?.name ?? "Unassigned"}</span>
+          </div>
+          <div className="flex justify-between">
+            <span>Location</span>
+            <span className="text-gray-300">
+              {node.lat != null && node.lon != null
+                ? `${node.lat.toFixed(4)}, ${node.lon.toFixed(4)}`
+                : "Unknown"}
+            </span>
+          </div>
+          <div className="flex justify-between">
+            <span>Last seen</span>
+            <span className="text-gray-300">{lastSeen}</span>
+          </div>
+        </div>
+        {!node.configured && (
+          <div className="mt-3 text-xs text-indigo-400 font-mono border-t border-gray-800 pt-2">
+            ⚠ Needs configuration
+          </div>
+        )}
+      </div>
+    </Link>
+  );
+}
@@ -0,0 +1,82 @@
+"use client";
+
+import { useState } from "react";
+import { c2api } from "@/lib/c2api";
+import type { NodeRecord, SystemRecord } from "@/lib/types";
+
+interface Props {
+  node: NodeRecord;
+  systems: SystemRecord[];
+  onClose: () => void;
+}
+
+export function NodeConfigModal({ node, systems, onClose }: Props) {
+  const [systemId, setSystemId] = useState("");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    if (!systemId) return;
+    setSaving(true);
+    setError(null);
+    try {
+      await c2api.assignSystem(node.node_id, systemId);
+      onClose();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Failed to assign system.");
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  return (
+    <div className="fixed inset-0 bg-black/70 flex items-center justify-center z-50">
+      <div className="bg-gray-900 border border-gray-700 rounded-xl p-6 w-full max-w-md font-mono">
+        <h2 className="text-white font-semibold mb-1">Configure Node</h2>
+        <p className="text-gray-400 text-sm mb-5">
+          <span className="text-indigo-400">{node.node_id}</span> connected for the first time.
+          Assign it a radio system to begin monitoring.
+        </p>
+
+        <form onSubmit={handleSubmit} className="space-y-4">
+          <div>
+            <label className="block text-xs text-gray-400 mb-1">Radio System</label>
+            <select
+              value={systemId}
+              onChange={(e) => setSystemId(e.target.value)}
+              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              required
+            >
+              <option value="">Select a system…</option>
+              {systems.map((s) => (
+                <option key={s.system_id} value={s.system_id}>
+                  {s.name} ({s.type})
+                </option>
+              ))}
+            </select>
+          </div>
+
+          {error && <p className="text-red-400 text-xs">{error}</p>}
+
+          <div className="flex gap-3 pt-1">
+            <button
+              type="submit"
+              disabled={saving || !systemId}
+              className="flex-1 bg-indigo-600 hover:bg-indigo-500 disabled:opacity-50 text-white rounded-lg py-2 text-sm font-semibold transition-colors"
+            >
+              {saving ? "Saving…" : "Assign & Configure"}
+            </button>
+            <button
+              type="button"
+              onClick={onClose}
+              className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+            >
+              Cancel
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  );
+}
@@ -0,0 +1,16 @@
+import type { NodeStatus } from "@/lib/types";
+
+const styles: Record<NodeStatus, string> = {
+  online:       "bg-green-950 text-green-400 border border-green-800",
+  recording:    "bg-orange-950 text-orange-400 border border-orange-800 animate-pulse",
+  offline:      "bg-gray-900 text-gray-500 border border-gray-700",
+  unconfigured: "bg-indigo-950 text-indigo-400 border border-indigo-800",
+};
+
+export function StatusBadge({ status }: { status: NodeStatus }) {
+  return (
+    <span className={`inline-block px-2 py-0.5 rounded-full text-xs font-semibold uppercase tracking-wide ${styles[status] ?? styles.offline}`}>
+      {status}
+    </span>
+  );
+}
@@ -0,0 +1,58 @@
+import { auth } from "@/lib/firebase";
+
+const BASE = process.env.NEXT_PUBLIC_C2_URL ?? "http://localhost:8000";
+
+async function request<T>(path: string, options?: RequestInit): Promise<T> {
+  const user = auth.currentUser;
+  const token = user ? await user.getIdToken() : null;
+
+  const res = await fetch(`${BASE}${path}`, {
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...(options?.headers as Record<string, string> | undefined),
+    },
+  });
+  if (!res.ok) throw new Error(`C2 API error ${res.status}: ${await res.text()}`);
+  if (res.status === 204) return undefined as T;
+  return res.json();
+}
+
+export const c2api = {
+  // Nodes
+  getNodes: () => request<unknown[]>("/nodes"),
+  getNode: (id: string) => request<unknown>(`/nodes/${id}`),
+  sendCommand: (nodeId: string, payload: object) =>
+    request(`/nodes/${nodeId}/command`, { method: "POST", body: JSON.stringify(payload) }),
+  assignSystem: (nodeId: string, systemId: string) =>
+    request(`/nodes/${nodeId}/config/${systemId}`, { method: "POST" }),
+
+  // Systems
+  getSystems: () => request<unknown[]>("/systems"),
+  createSystem: (body: object) =>
+    request("/systems", { method: "POST", body: JSON.stringify(body) }),
+  updateSystem: (id: string, body: object) =>
+    request(`/systems/${id}`, { method: "PUT", body: JSON.stringify(body) }),
+  deleteSystem: (id: string) =>
+    request(`/systems/${id}`, { method: "DELETE" }),
+
+  // Tokens
+  getTokens: () => request<unknown[]>("/tokens"),
+  addToken: (body: { name: string; token: string }) =>
+    request("/tokens", { method: "POST", body: JSON.stringify(body) }),
+  deleteToken: (id: string) =>
+    request(`/tokens/${id}`, { method: "DELETE" }),
+
+  // Node approval
+  approveNode: (id: string) =>
+    request(`/nodes/${id}/approve`, { method: "POST" }),
+  rejectNode: (id: string) =>
+    request(`/nodes/${id}/reject`, { method: "POST" }),
+
+  // Calls
+  getCalls: (params?: Record<string, string>) => {
+    const qs = params ? "?" + new URLSearchParams(params).toString() : "";
+    return request<unknown[]>(`/calls${qs}`);
+  },
+};
@@ -0,0 +1,18 @@
+import { initializeApp, getApps, getApp } from "firebase/app";
+import { getFirestore } from "firebase/firestore";
+import { getAuth } from "firebase/auth";
+
+const firebaseConfig = {
+  apiKey:            process.env.NEXT_PUBLIC_FIREBASE_API_KEY,
+  authDomain:        process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN,
+  projectId:         process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID,
+  storageBucket:     process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET,
+  messagingSenderId: process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID,
+  appId:             process.env.NEXT_PUBLIC_FIREBASE_APP_ID,
+};
+
+const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
+const databaseId = process.env.NEXT_PUBLIC_FIRESTORE_DATABASE || "(default)";
+export const db = getFirestore(app, databaseId);
+export const auth = getAuth(app);
+export { app };
@@ -0,0 +1,51 @@
+export type NodeStatus = "online" | "offline" | "recording" | "unconfigured";
+export type ApprovalStatus = "pending" | "approved" | "rejected";
+
+export interface NodeRecord {
+  node_id: string;
+  name: string;
+  lat: number;
+  lon: number;
+  status: NodeStatus;
+  configured: boolean;
+  last_seen: string | null;
+  assigned_system_id: string | null;
+  approval_status: ApprovalStatus | null;
+}
+
+export interface SystemRecord {
+  system_id: string;
+  name: string;
+  type: string; // P25 | DMR | NBFM
+  config: Record<string, unknown>;
+}
+
+export interface CallRecord {
+  call_id: string;
+  node_id: string;
+  system_id: string | null;
+  talkgroup_id: number | null;
+  talkgroup_name: string | null;
+  freq: number | null;
+  started_at: string;
+  ended_at: string | null;
+  audio_url: string | null;
+  transcript: string | null;
+  incident_id: string | null;
+  location: { lat: number; lng: number } | null;
+  tags: string[];
+  status: "active" | "ended";
+}
+
+export interface IncidentRecord {
+  incident_id: string;
+  title: string | null;
+  type: string | null;
+  status: "active" | "resolved";
+  location: { lat: number; lng: number } | null;
+  call_ids: string[];
+  started_at: string;
+  updated_at: string;
+  summary: string | null;
+  tags: string[];
+}
@@ -0,0 +1,73 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { collection, onSnapshot, query, orderBy, limit, where, FirestoreError } from "firebase/firestore";
+import { onAuthStateChanged } from "firebase/auth";
+import { db, auth } from "@/lib/firebase";
+import type { CallRecord } from "@/lib/types";
+
+export function useCalls(limitCount = 50) {
+  const [calls, setCalls] = useState<CallRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let unsubFirestore: (() => void) | undefined;
+
+    const unsubAuth = onAuthStateChanged(auth, (user) => {
+      if (unsubFirestore) { unsubFirestore(); unsubFirestore = undefined; }
+
+      if (!user) {
+        setCalls([]);
+        setLoading(false);
+        return;
+      }
+
+      const q = query(
+        collection(db, "calls"),
+        orderBy("started_at", "desc"),
+        limit(limitCount)
+      );
+      unsubFirestore = onSnapshot(q, (snap) => {
+        setCalls(snap.docs.map((d) => d.data() as CallRecord));
+        setLoading(false);
+      }, (err: FirestoreError) => { console.error("useCalls:", err); setError(err.message); setLoading(false); });
+    });
+
+    return () => {
+      unsubAuth();
+      if (unsubFirestore) unsubFirestore();
+    };
+  }, [limitCount]);
+
+  return { calls, loading, error };
+}
+
+export function useActiveCalls() {
+  const [calls, setCalls] = useState<CallRecord[]>([]);
+
+  useEffect(() => {
+    let unsubFirestore: (() => void) | undefined;
+
+    const unsubAuth = onAuthStateChanged(auth, (user) => {
+      if (unsubFirestore) { unsubFirestore(); unsubFirestore = undefined; }
+
+      if (!user) {
+        setCalls([]);
+        return;
+      }
+
+      const q = query(collection(db, "calls"), where("status", "==", "active"));
+      unsubFirestore = onSnapshot(q, (snap) => {
+        setCalls(snap.docs.map((d) => d.data() as CallRecord));
+      }, (err: FirestoreError) => { console.error("useActiveCalls:", err); });
+    });
+
+    return () => {
+      unsubAuth();
+      if (unsubFirestore) unsubFirestore();
+    };
+  }, []);
+
+  return calls;
+}
@@ -0,0 +1,48 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { collection, onSnapshot, query, FirestoreError } from "firebase/firestore";
+import { onAuthStateChanged } from "firebase/auth";
+import { db, auth } from "@/lib/firebase";
+import type { NodeRecord } from "@/lib/types";
+
+export function useNodes() {
+  const [nodes, setNodes] = useState<NodeRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let unsubFirestore: (() => void) | undefined;
+
+    const unsubAuth = onAuthStateChanged(auth, (user) => {
+      if (unsubFirestore) { unsubFirestore(); unsubFirestore = undefined; }
+
+      if (!user) {
+        setNodes([]);
+        setLoading(false);
+        return;
+      }
+
+      const q = query(collection(db, "nodes"));
+      unsubFirestore = onSnapshot(q, (snap) => {
+        setNodes(snap.docs.map((d) => d.data() as NodeRecord));
+        setLoading(false);
+      }, (err: FirestoreError) => { console.error("useNodes:", err); setError(err.message); setLoading(false); });
+    });
+
+    return () => {
+      unsubAuth();
+      if (unsubFirestore) unsubFirestore();
+    };
+  }, []);
+
+  return { nodes, loading, error };
+}
+
+export function useUnconfiguredNodes() {
+  const { nodes, loading } = useNodes();
+  return {
+    nodes: nodes.filter((n) => !n.configured),
+    loading,
+  };
+}
@@ -0,0 +1,39 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { collection, onSnapshot, FirestoreError } from "firebase/firestore";
+import { onAuthStateChanged } from "firebase/auth";
+import { db, auth } from "@/lib/firebase";
+import type { SystemRecord } from "@/lib/types";
+
+export function useSystems() {
+  const [systems, setSystems] = useState<SystemRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let unsubFirestore: (() => void) | undefined;
+
+    const unsubAuth = onAuthStateChanged(auth, (user) => {
+      if (unsubFirestore) { unsubFirestore(); unsubFirestore = undefined; }
+
+      if (!user) {
+        setSystems([]);
+        setLoading(false);
+        return;
+      }
+
+      unsubFirestore = onSnapshot(collection(db, "systems"), (snap) => {
+        setSystems(snap.docs.map((d) => d.data() as SystemRecord));
+        setLoading(false);
+      }, (err: FirestoreError) => { console.error("useSystems:", err); setError(err.message); setLoading(false); });
+    });
+
+    return () => {
+      unsubAuth();
+      if (unsubFirestore) unsubFirestore();
+    };
+  }, []);
+
+  return { systems, loading, error };
+}
@@ -0,0 +1,20 @@
+import { NextRequest, NextResponse } from "next/server";
+
+export function middleware(request: NextRequest) {
+  const session = request.cookies.get("drb_session");
+  const { pathname } = request.nextUrl;
+
+  if (pathname === "/login") {
+    if (session) return NextResponse.redirect(new URL("/dashboard", request.url));
+    return NextResponse.next();
+  }
+
+  if (!session) {
+    return NextResponse.redirect(new URL("/login", request.url));
+  }
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon\\.ico).*)"],
+};
@@ -0,0 +1,6 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  output: "standalone",
+};
+
+export default nextConfig;
@@ -0,0 +1,28 @@
+{
+  "name": "drb-frontend",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start"
+  },
+  "dependencies": {
+    "next": "^15",
+    "react": "^18.3.0",
+    "react-dom": "^18.3.0",
+    "firebase": "^10.12.0",
+    "leaflet": "^1.9.4",
+    "react-leaflet": "^4.2.1"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "@types/node": "^20.12.0",
+    "@types/leaflet": "^1.9.12",
+    "tailwindcss": "^3.4.0",
+    "postcss": "^8.4.0",
+    "autoprefixer": "^10.4.0"
+  }
+}
@@ -0,0 +1,6 @@
+module.exports = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
@@ -0,0 +1,18 @@
+import type { Config } from "tailwindcss";
+
+const config: Config = {
+  content: [
+    "./app/**/*.{ts,tsx}",
+    "./components/**/*.{ts,tsx}",
+  ],
+  theme: {
+    extend: {
+      fontFamily: {
+        mono: ["ui-monospace", "Cascadia Code", "Source Code Pro", "monospace"],
+      },
+    },
+  },
+  plugins: [],
+};
+
+export default config;
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [{ "name": "next" }],
+    "paths": { "@/*": ["./*"] }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}
@@ -0,0 +1,7 @@
+__pycache__
+*.pyc
+*.pyo
+.git
+*.log
+.env
+.pytest_cache
@@ -0,0 +1,7 @@
+DISCORD_TOKEN=your-bot-token-here
+
+# C2 core API
+C2_URL=http://c2-core:8000
+
+# Optional: restrict slash command sync to one guild during dev (faster than global)
+# DEV_GUILD_ID=123456789
@@ -0,0 +1,10 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app/ ./app/
+
+CMD ["python", "-m", "app.bot"]
@@ -0,0 +1,38 @@
+import asyncio
+import discord
+from discord.ext import commands
+from app.config import settings
+from app.internal.logger import logger
+
+
+class DRBBot(commands.Bot):
+    def __init__(self):
+        intents = discord.Intents.default()
+        super().__init__(command_prefix="!", intents=intents)
+
+    async def setup_hook(self):
+        await self.load_extension("app.commands.radio")
+
+        if settings.dev_guild_id:
+            guild = discord.Object(id=settings.dev_guild_id)
+            self.tree.copy_global_to(guild=guild)
+            await self.tree.sync(guild=guild)
+            logger.info(f"Slash commands synced to dev guild {settings.dev_guild_id}.")
+        else:
+            await self.tree.sync()
+            logger.info("Slash commands synced globally.")
+
+    async def on_ready(self):
+        logger.info(f"Bot ready: {self.user} ({self.user.id})")
+        await self.change_presence(
+            activity=discord.Activity(
+                type=discord.ActivityType.listening,
+                name="the radio"
+            )
+        )
+
+
+bot = DRBBot()
+
+if __name__ == "__main__":
+    bot.run(settings.discord_token)
@@ -0,0 +1,130 @@
+import discord
+from discord import app_commands
+from discord.ext import commands
+from typing import Optional
+from app.internal.c2_client import c2
+from app.internal.logger import logger
+
+
+class RadioCommands(commands.Cog):
+    def __init__(self, bot: commands.Bot):
+        self.bot = bot
+
+    # ------------------------------------------------------------------
+    # Autocomplete — system names from C2
+    # ------------------------------------------------------------------
+
+    async def system_autocomplete(
+        self, interaction: discord.Interaction, current: str
+    ) -> list[app_commands.Choice[str]]:
+        systems = await c2.get_systems()
+        return [
+            app_commands.Choice(name=s["name"], value=s["system_id"])
+            for s in systems
+            if current.lower() in s["name"].lower()
+        ][:25]
+
+    # ------------------------------------------------------------------
+    # /join
+    # ------------------------------------------------------------------
+
+    @app_commands.command(name="join", description="Stream a radio system to your voice channel.")
+    @app_commands.describe(system="The radio system to listen to.")
+    @app_commands.autocomplete(system=system_autocomplete)
+    async def join(self, interaction: discord.Interaction, system: str):
+        await interaction.response.defer(ephemeral=True)
+
+        if not interaction.user.voice or not interaction.user.voice.channel:
+            await interaction.followup.send("You need to be in a voice channel first.")
+            return
+
+        channel = interaction.user.voice.channel
+        guild_id = str(interaction.guild_id)
+        channel_id = str(channel.id)
+
+        node = await c2.find_node_for_system(system)
+        if not node:
+            await interaction.followup.send(
+                "No online node is assigned to that system. Check `/status` for availability."
+            )
+            return
+
+        ok = await c2.send_command(node["node_id"], {
+            "action": "discord_join",
+            "guild_id": guild_id,
+            "channel_id": channel_id,
+        })
+
+        if ok:
+            systems = await c2.get_systems()
+            system_name = next((s["name"] for s in systems if s["system_id"] == system), system)
+            await interaction.followup.send(
+                f"Streaming **{system_name}** from node `{node['node_id']}` to {channel.mention}."
+            )
+        else:
+            await interaction.followup.send("Failed to contact the node. It may be offline.")
+
+    # ------------------------------------------------------------------
+    # /leave
+    # ------------------------------------------------------------------
+
+    @app_commands.command(name="leave", description="Stop streaming radio in this server.")
+    async def leave(self, interaction: discord.Interaction):
+        await interaction.response.defer(ephemeral=True)
+
+        # Find any node currently streaming to this guild
+        nodes = await c2.get_nodes()
+        streaming_nodes = [
+            n for n in nodes if n.get("status") in ("online", "recording")
+        ]
+
+        if not streaming_nodes:
+            await interaction.followup.send("No nodes appear to be active right now.")
+            return
+
+        # Send leave to all online nodes in case more than one joined
+        for node in streaming_nodes:
+            await c2.send_command(node["node_id"], {"action": "discord_leave"})
+
+        await interaction.followup.send("Disconnected.")
+
+    # ------------------------------------------------------------------
+    # /status
+    # ------------------------------------------------------------------
+
+    @app_commands.command(name="status", description="Show all node and system status.")
+    async def status(self, interaction: discord.Interaction):
+        await interaction.response.defer()
+
+        nodes = await c2.get_nodes()
+        systems = await c2.get_systems()
+
+        system_map = {s["system_id"]: s["name"] for s in systems}
+
+        status_emoji = {
+            "online": "🟢",
+            "recording": "🔴",
+            "offline": "⚫",
+            "unconfigured": "🟡",
+        }
+
+        embed = discord.Embed(title="DRB Node Status", color=0x2b2d31)
+
+        if not nodes:
+            embed.description = "No nodes registered."
+        else:
+            for node in sorted(nodes, key=lambda n: n.get("name", "")):
+                s = node.get("status", "offline")
+                emoji = status_emoji.get(s, "⚪")
+                system_name = system_map.get(node.get("assigned_system_id", ""), "Unassigned")
+                embed.add_field(
+                    name=f"{emoji} {node.get('name', node['node_id'])}",
+                    value=f"`{s}` — {system_name}",
+                    inline=True,
+                )
+
+        await interaction.followup.send(embed=embed)
+
+
+async def setup(bot: commands.Bot):
+    await bot.add_cog(RadioCommands(bot))
@@ -0,0 +1,14 @@
+from pydantic_settings import BaseSettings
+from typing import Optional
+
+
+class Settings(BaseSettings):
+    discord_token: str
+    c2_url: str = "http://localhost:8000"
+    dev_guild_id: Optional[int] = None  # set to sync commands instantly during dev
+
+    class Config:
+        env_file = ".env"
+
+
+settings = Settings()
@@ -0,0 +1,56 @@
+import httpx
+from typing import Optional
+from app.config import settings
+from app.internal.logger import logger
+
+
+class C2Client:
+    def __init__(self):
+        self.base = settings.c2_url.rstrip("/")
+
+    async def get_nodes(self) -> list:
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                r = await client.get(f"{self.base}/nodes")
+                r.raise_for_status()
+                return r.json()
+        except Exception as e:
+            logger.error(f"C2 get_nodes failed: {e}")
+            return []
+
+    async def get_systems(self) -> list:
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                r = await client.get(f"{self.base}/systems")
+                r.raise_for_status()
+                return r.json()
+        except Exception as e:
+            logger.error(f"C2 get_systems failed: {e}")
+            return []
+
+    async def send_command(self, node_id: str, payload: dict) -> bool:
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                r = await client.post(
+                    f"{self.base}/nodes/{node_id}/command",
+                    json=payload,
+                )
+                r.raise_for_status()
+                return True
+        except Exception as e:
+            logger.error(f"C2 send_command failed: {e}")
+            return False
+
+    async def find_node_for_system(self, system_id: str) -> Optional[dict]:
+        """Return the first online node assigned to the given system."""
+        nodes = await self.get_nodes()
+        for node in nodes:
+            if (
+                node.get("assigned_system_id") == system_id
+                and node.get("status") in ("online", "recording")
+            ):
+                return node
+        return None
+
+
+c2 = C2Client()
@@ -0,0 +1,10 @@
+import logging
+import sys
+
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
+    handlers=[logging.StreamHandler(sys.stdout)],
+)
+
+logger = logging.getLogger("drb-server-bot")
@@ -0,0 +1,3 @@
+discord.py>=2.3.0
+pydantic-settings
+httpx